From eb53ffb119622bf110775e5ebd4ad7486baa032e Mon Sep 17 00:00:00 2001 From: Classic Values Date: Wed, 12 Jun 2024 16:30:20 -0700 Subject: [PATCH] COMMIT --- .circleci/config.yml | 7 - .deepsource.toml | 41 - .github/workflows/alibabacloud.yml | 246 +- .github/workflows/anchore.yml | 90 +- .github/workflows/apisec-scan.yml | 138 +- .github/workflows/aws.yml | 190 +- .github/workflows/azure-container-webapp.yml | 174 +- .../azure-kubernetes-service-helm.yml | 324 +- .../azure-kubernetes-service-kompose.yml | 314 +- .../azure-kubernetes-service-kustomize.yml | 314 +- .../workflows/azure-kubernetes-service.yml | 288 +- .github/workflows/azure-staticwebapp.yml | 144 +- .../workflows/azure-webapps-dotnet-core.yml | 178 +- .github/workflows/azure-webapps-java-jar.yml | 160 +- .github/workflows/azure-webapps-node.yml | 158 +- .github/workflows/azure-webapps-php.yml | 200 +- .github/workflows/azure-webapps-python.yml | 174 +- .github/workflows/azure.yml | 100 +- .github/workflows/brakeman.yml | 114 +- .github/workflows/checkmarx.yml | 108 +- .github/workflows/clj-holmes.yml | 94 +- .github/workflows/clj-watson.yml | 106 +- .github/workflows/codacy.yml | 120 +- .github/workflows/codeql.yml | 152 +- .github/workflows/codescan.yml | 96 +- .github/workflows/codescaner-analysis.yml | 74 +- .github/workflows/crunch42.yml | 118 +- .github/workflows/datadog-synthetics.yml | 76 +- .github/workflows/deno.yml | 78 +- .github/workflows/dependency-review.yml | 48 +- .github/workflows/detekt.yml | 236 +- .github/workflows/devskim.yml | 76 +- .github/workflows/docker-image.yml | 36 +- .github/workflows/docker-publish.yml | 186 +- .github/workflows/eslint.yml | 98 +- .github/workflows/fortify.yml | 196 +- .github/workflows/google-cloudrun-docker.yml | 228 +- .github/workflows/google-cloudrun-source.yml | 192 +- .github/workflows/google.yml | 160 +- .github/workflows/googleXs.yml | 168 +- .github/workflows/hadolint.yml | 94 +- .github/workflows/ibm.yml | 152 +- .github/workflows/jekyll.yml | 40 +- .github/workflows/kubesec.yml | 82 +- .github/workflows/manual.yml | 60 +- .github/workflows/mayhem-for-api.yml | 132 +- .github/workflows/mobsf.yml | 92 +- .github/workflows/neuralegion.yml | 350 +- .github/workflows/njsscan.yml | 90 +- .github/workflows/node.js.yml | 60 +- .github/workflows/nowsecure.yml | 104 +- .github/workflows/npm-grunt.yml | 56 +- .github/workflows/npm-gulp.yml | 56 +- .../workflows/npm-publish-github-packages.yml | 72 +- .github/workflows/npm-publish.yml | 100 +- .github/workflows/openshift.yml | 374 +- .github/workflows/ossar-analysis.yml | 88 +- .github/workflows/ossar.yml | 118 +- .github/workflows/pmd.yml | 92 +- .github/workflows/powershell.yml | 104 +- .github/workflows/python-app.yml | 72 +- .github/workflows/rubocop.yml | 104 +- .github/workflows/rust-clippy.yml | 118 +- .github/workflows/scorecards.yml | 110 +- .github/workflows/securitycodescan.yml | 82 +- .github/workflows/semgrep.yml | 104 +- .github/workflows/snyk-container.yml | 108 +- .github/workflows/snyk-infrastructure.yml | 106 +- .github/workflows/sobelow.yml | 80 +- .github/workflows/sonarcloud.yml | 136 +- .github/workflows/stackhawk.yml | 134 +- .github/workflows/synopsys-io.yml | 154 +- .github/workflows/sysdig-scan.yml | 122 +- .github/workflows/tencent.yml | 160 +- .github/workflows/terraform.yml | 188 +- .github/workflows/tfsec.yml | 76 +- .github/workflows/trivy.yml | 94 +- .github/workflows/veracode.yml | 116 +- .github/workflows/webpack.yml | 56 +- .github/workflows/xanitizer.yml | 198 +- .gitignore | 129 - .vs/ProjectSettings.json | 4 +- .whitesource | 12 - Application/.editorconfig | 10 - Application/.gitignore | 118 - Application/.sailsrc | 5 - Application/Dockerfile | 12 - Application/Gruntfile.js | 82 - Application/api/policies/sessionAuth.js | 21 - Application/api/responses/badRequest.js | 76 - Application/api/responses/created.js | 60 - Application/api/responses/forbidden.js | 89 - Application/api/responses/notFound.js | 94 - Application/api/responses/ok.js | 60 - Application/api/responses/serverError.js | 89 - Application/app.js | 69 - Application/assets/favicon.ico | Bin 920 -> 0 bytes Application/assets/fonts/segoeuil.ttf | Bin 808120 -> 0 bytes Application/assets/images/cloneWhite.svg | 1 - Application/assets/images/deployWhite.svg | 1 - Application/assets/images/lightbulbWhite.svg | 1 - Application/assets/images/stackWhite.svg | 1 - Application/assets/images/successCloudNew.svg | 1 - Application/assets/images/tweetThis.svg | 1 - .../assets/js/dependencies/sails.io.js | 1528 ----- Application/assets/robots.txt | 8 - Application/assets/styles/importer.less | 30 - Application/config/blueprints.js | 162 - Application/config/bootstrap.js | 17 - Application/config/connections.js | 92 - Application/config/cors.js | 78 - Application/config/csrf.js | 64 - Application/config/env/development.js | 24 - Application/config/env/production.js | 38 - Application/config/globals.js | 63 - Application/config/http.js | 93 - Application/config/i18n.js | 57 - Application/config/locales/_README.md | 28 - Application/config/locales/de.json | 4 - Application/config/locales/en.json | 4 - Application/config/locales/es.json | 4 - Application/config/locales/fr.json | 4 - Application/config/log.js | 29 - Application/config/models.js | 32 - Application/config/policies.js | 51 - Application/config/routes.js | 49 - Application/config/session.js | 100 - Application/config/sockets.js | 141 - Application/config/views.js | 95 - Application/package-lock.json | 4995 ----------------- Application/package.json | 39 - Application/tasks/README.md | 54 - Application/tasks/config/clean.js | 21 - Application/tasks/config/coffee.js | 33 - Application/tasks/config/concat.js | 31 - Application/tasks/config/copy.js | 44 - Application/tasks/config/cssmin.js | 27 - Application/tasks/config/jst.js | 48 - Application/tasks/config/less.js | 31 - Application/tasks/config/sails-linker.js | 283 - Application/tasks/config/sync.js | 31 - Application/tasks/config/uglify.js | 22 - Application/tasks/config/watch.js | 31 - Application/tasks/pipeline.js | 87 - Application/tasks/register/build.js | 27 - Application/tasks/register/buildProd.js | 29 - Application/tasks/register/compileAssets.js | 22 - Application/tasks/register/default.js | 26 - Application/tasks/register/linkAssets.js | 23 - Application/tasks/register/linkAssetsBuild.js | 22 - .../tasks/register/linkAssetsBuildProd.js | 22 - Application/tasks/register/prod.js | 27 - Application/tasks/register/syncAssets.js | 20 - Application/views/403.ejs | 68 - Application/views/404.ejs | 68 - Application/views/500.ejs | 73 - Application/views/homepage.ejs | 194 - Application/views/layout.ejs | 94 - ArmTemplates/container-webapp-template.json | 125 - ArmTemplates/containerRegistry-template.json | 30 - LICENSE | 42 +- .../.gitkeep => Notes/10ReasearchGoals.md | 0 .../.gitkeep => Notes/11ChapterBreakdowns.md | 0 .../.gitkeep => Notes/12ChapterSections.md | 0 .../.gitkeep => Notes/13FirstSections.md | 0 .../.gitkeep => Notes/14LastSection.md | 0 Notes/15Real-worldExamples.md | 0 Notes/16Notes_Marginals.md | 0 Notes/17RevisionPlan.md | 0 Notes/18Excercises.md | 0 Notes/19Concepts_Terminology.md | 0 Notes/1MainArguments.md | 0 Notes/20Questions.md | 0 Notes/21CitationReference.md | 0 Notes/22LanguageReference.md | 0 Notes/23TimeReference.md | 0 Notes/24TopicReference.md | 0 Notes/25MasterReference.md | 0 Notes/26ProfessionalReference.md | 0 Notes/27ArgumentFormed.md | 0 Notes/28In-depthAnalysis.md | 0 Notes/29FinalThoughts.md | 0 Notes/2Overview.md | 0 Notes/30Diagrams_Tables.md | 0 Notes/31SupplementaryMaterials.md | 0 Notes/32ExtendedCaseStudies.md | 0 Notes/33CurrentTrends.md | 0 Notes/34FinalSelf-assesment.md | 0 Notes/35Peer-review.md | 0 Notes/36ReadingDateTime.md | 0 Notes/37NotesOverview.md | 0 Notes/3IndexBibliography.md | 0 Notes/4Theories_Models.md | 0 Notes/5CaseStudies.md | 0 Notes/6Subjects.md | 0 Notes/7MainIdeas.md | 0 Notes/8SubIdeas.md | 0 Notes/9Quotes_Phrases.md | 0 README.md | 1418 ++--- SECURITY.md | 42 +- Tests/.gitignore | 261 - .../functional_tests/sampleFunctionalTests.js | 55 - Tests/gulpfile.js | 26 - Tests/nodejs-webapp-tests.njsproj | 71 - Tests/package-lock.json | 3797 ------------- Tests/package.json | 33 - _config.yml | 1 - azure-pipelines.yml | 21 - renovate.json | 6 - test-FUNDING.yml | 24 +- 210 files changed, 6058 insertions(+), 20751 deletions(-) delete mode 100644 .circleci/config.yml delete mode 100644 .deepsource.toml delete mode 100644 .gitignore delete mode 100644 .whitesource delete mode 100644 Application/.editorconfig delete mode 100644 Application/.gitignore delete mode 100644 Application/.sailsrc delete mode 100644 Application/Dockerfile delete mode 100644 Application/Gruntfile.js delete mode 100644 Application/api/policies/sessionAuth.js delete mode 100644 Application/api/responses/badRequest.js delete mode 100644 Application/api/responses/created.js delete mode 100644 Application/api/responses/forbidden.js delete mode 100644 Application/api/responses/notFound.js delete mode 100644 Application/api/responses/ok.js delete mode 100644 Application/api/responses/serverError.js delete mode 100644 Application/app.js delete mode 100644 Application/assets/favicon.ico delete mode 100644 Application/assets/fonts/segoeuil.ttf delete mode 100644 Application/assets/images/cloneWhite.svg delete mode 100644 Application/assets/images/deployWhite.svg delete mode 100644 Application/assets/images/lightbulbWhite.svg delete mode 100644 Application/assets/images/stackWhite.svg delete mode 100644 Application/assets/images/successCloudNew.svg delete mode 100644 Application/assets/images/tweetThis.svg delete mode 100644 Application/assets/js/dependencies/sails.io.js delete mode 100644 Application/assets/robots.txt delete mode 100644 Application/assets/styles/importer.less delete mode 100644 Application/config/blueprints.js delete mode 100644 Application/config/bootstrap.js delete mode 100644 Application/config/connections.js delete mode 100644 Application/config/cors.js delete mode 100644 Application/config/csrf.js delete mode 100644 Application/config/env/development.js delete mode 100644 Application/config/env/production.js delete mode 100644 Application/config/globals.js delete mode 100644 Application/config/http.js delete mode 100644 Application/config/i18n.js delete mode 100644 Application/config/locales/_README.md delete mode 100644 Application/config/locales/de.json delete mode 100644 Application/config/locales/en.json delete mode 100644 Application/config/locales/es.json delete mode 100644 Application/config/locales/fr.json delete mode 100644 Application/config/log.js delete mode 100644 Application/config/models.js delete mode 100644 Application/config/policies.js delete mode 100644 Application/config/routes.js delete mode 100644 Application/config/session.js delete mode 100644 Application/config/sockets.js delete mode 100644 Application/config/views.js delete mode 100644 Application/package-lock.json delete mode 100644 Application/package.json delete mode 100644 Application/tasks/README.md delete mode 100644 Application/tasks/config/clean.js delete mode 100644 Application/tasks/config/coffee.js delete mode 100644 Application/tasks/config/concat.js delete mode 100644 Application/tasks/config/copy.js delete mode 100644 Application/tasks/config/cssmin.js delete mode 100644 Application/tasks/config/jst.js delete mode 100644 Application/tasks/config/less.js delete mode 100644 Application/tasks/config/sails-linker.js delete mode 100644 Application/tasks/config/sync.js delete mode 100644 Application/tasks/config/uglify.js delete mode 100644 Application/tasks/config/watch.js delete mode 100644 Application/tasks/pipeline.js delete mode 100644 Application/tasks/register/build.js delete mode 100644 Application/tasks/register/buildProd.js delete mode 100644 Application/tasks/register/compileAssets.js delete mode 100644 Application/tasks/register/default.js delete mode 100644 Application/tasks/register/linkAssets.js delete mode 100644 Application/tasks/register/linkAssetsBuild.js delete mode 100644 Application/tasks/register/linkAssetsBuildProd.js delete mode 100644 Application/tasks/register/prod.js delete mode 100644 Application/tasks/register/syncAssets.js delete mode 100644 Application/views/403.ejs delete mode 100644 Application/views/404.ejs delete mode 100644 Application/views/500.ejs delete mode 100644 Application/views/homepage.ejs delete mode 100644 Application/views/layout.ejs delete mode 100644 ArmTemplates/container-webapp-template.json delete mode 100644 ArmTemplates/containerRegistry-template.json rename Application/api/controllers/.gitkeep => Notes/10ReasearchGoals.md (100%) rename Application/api/models/.gitkeep => Notes/11ChapterBreakdowns.md (100%) rename Application/api/services/.gitkeep => Notes/12ChapterSections.md (100%) rename Application/assets/images/.gitkeep => Notes/13FirstSections.md (100%) rename Application/assets/templates/.gitkeep => Notes/14LastSection.md (100%) create mode 100644 Notes/15Real-worldExamples.md create mode 100644 Notes/16Notes_Marginals.md create mode 100644 Notes/17RevisionPlan.md create mode 100644 Notes/18Excercises.md create mode 100644 Notes/19Concepts_Terminology.md create mode 100644 Notes/1MainArguments.md create mode 100644 Notes/20Questions.md create mode 100644 Notes/21CitationReference.md create mode 100644 Notes/22LanguageReference.md create mode 100644 Notes/23TimeReference.md create mode 100644 Notes/24TopicReference.md create mode 100644 Notes/25MasterReference.md create mode 100644 Notes/26ProfessionalReference.md create mode 100644 Notes/27ArgumentFormed.md create mode 100644 Notes/28In-depthAnalysis.md create mode 100644 Notes/29FinalThoughts.md create mode 100644 Notes/2Overview.md create mode 100644 Notes/30Diagrams_Tables.md create mode 100644 Notes/31SupplementaryMaterials.md create mode 100644 Notes/32ExtendedCaseStudies.md create mode 100644 Notes/33CurrentTrends.md create mode 100644 Notes/34FinalSelf-assesment.md create mode 100644 Notes/35Peer-review.md create mode 100644 Notes/36ReadingDateTime.md create mode 100644 Notes/37NotesOverview.md create mode 100644 Notes/3IndexBibliography.md create mode 100644 Notes/4Theories_Models.md create mode 100644 Notes/5CaseStudies.md create mode 100644 Notes/6Subjects.md create mode 100644 Notes/7MainIdeas.md create mode 100644 Notes/8SubIdeas.md create mode 100644 Notes/9Quotes_Phrases.md delete mode 100644 Tests/.gitignore delete mode 100644 Tests/functional_tests/sampleFunctionalTests.js delete mode 100644 Tests/gulpfile.js delete mode 100644 Tests/nodejs-webapp-tests.njsproj delete mode 100644 Tests/package-lock.json delete mode 100644 Tests/package.json delete mode 100644 _config.yml delete mode 100644 azure-pipelines.yml delete mode 100644 renovate.json diff --git a/.circleci/config.yml b/.circleci/config.yml deleted file mode 100644 index 00f840e..0000000 --- a/.circleci/config.yml +++ /dev/null @@ -1,7 +0,0 @@ -version: 2.1 -orbs: - node: circleci/node@5.1.0 -workflows: - node-tests: - jobs: - - node/test diff --git a/.deepsource.toml b/.deepsource.toml deleted file mode 100644 index 3aa065a..0000000 --- a/.deepsource.toml +++ /dev/null @@ -1,41 +0,0 @@ -version = 1 - -[[analyzers]] -name = "python" -enabled = true - - [analyzers.meta] - runtime_version = "3.x.x" - -[[analyzers]] -name = "test-coverage" -enabled = true - -[[analyzers]] -name = "docker" -enabled = true - -[[analyzers]] -name = "javascript" -enabled = true - - [analyzers.meta] - plugins = [ - "react", - "meteor", - "vue", - "angularjs", - "ember", - "angular" - ] - -[[analyzers]] -name = "shell" -enabled = true - -[[analyzers]] -name = "java" -enabled = true - - [analyzers.meta] - runtime_version = "14" diff --git a/.github/workflows/alibabacloud.yml b/.github/workflows/alibabacloud.yml index 872de3a..a5f1add 100644 --- a/.github/workflows/alibabacloud.yml +++ b/.github/workflows/alibabacloud.yml @@ -1,123 +1,123 @@ -# This workflow will build and push a new container image to Alibaba Cloud Container Registry (ACR), -# and then will deploy it to Alibaba Cloud Container Service for Kubernetes (ACK), when there is a push to the master branch. -# -# To use this workflow, you will need to complete the following set-up steps: -# -# 1. Create an ACR repository to store your container images. -# You can use ACR EE instance for more security and better performance. -# For instructions see https://www.alibabacloud.com/help/doc-detail/142168.htm -# -# 2. Create an ACK cluster to run your containerized application. -# You can use ACK Pro cluster for more security and better performance. -# For instructions see https://www.alibabacloud.com/help/doc-detail/95108.htm -# -# 3. Store your AccessKey pair in GitHub Actions secrets named `ACCESS_KEY_ID` and `ACCESS_KEY_SECRET`. -# For instructions on setting up secrets see: https://developer.github.com/actions/managing-workflows/storing-secrets/ -# -# 4. Change the values for the REGION_ID, REGISTRY, NAMESPACE, IMAGE, ACK_CLUSTER_ID, and ACK_DEPLOYMENT_NAME. -# - -name: Build and Deploy to ACK - -on: - push: - branches: - - master - -# Environment variables available to all jobs and steps in this workflow. -env: - REGION_ID: cn-hangzhou - REGISTRY: registry.cn-hangzhou.aliyuncs.com - NAMESPACE: namespace - IMAGE: repo - TAG: ${{ github.sha }} - ACK_CLUSTER_ID: clusterID - ACK_DEPLOYMENT_NAME: nginx-deployment - - ACR_EE_REGISTRY: myregistry.cn-hangzhou.cr.aliyuncs.com - ACR_EE_INSTANCE_ID: instanceID - ACR_EE_NAMESPACE: namespace - ACR_EE_IMAGE: repo - ACR_EE_TAG: ${{ github.sha }} - -permissions: - contents: read - -jobs: - build: - runs-on: ubuntu-latest - environment: production - - steps: - - name: Checkout - uses: actions/checkout@v3 - - # 1.1 Login to ACR - - name: Login to ACR with the AccessKey pair - uses: aliyun/acr-login@v1 - with: - region-id: "${{ env.REGION_ID }}" - access-key-id: "${{ secrets.ACCESS_KEY_ID }}" - access-key-secret: "${{ secrets.ACCESS_KEY_SECRET }}" - - # 1.2 Buid and push image to ACR - - name: Build and push image to ACR - run: | - docker build --tag "$REGISTRY/$NAMESPACE/$IMAGE:$TAG" . - docker push "$REGISTRY/$NAMESPACE/$IMAGE:$TAG" - - # 1.3 Scan image in ACR - - name: Scan image in ACR - uses: aliyun/acr-scan@v1 - with: - region-id: "${{ env.REGION_ID }}" - access-key-id: "${{ secrets.ACCESS_KEY_ID }}" - access-key-secret: "${{ secrets.ACCESS_KEY_SECRET }}" - repository: "${{ env.NAMESPACE }}/${{ env.IMAGE }}" - tag: "${{ env.TAG }}" - - # 2.1 (Optional) Login to ACR EE - - uses: actions/checkout@v3 - - name: Login to ACR EE with the AccessKey pair - uses: aliyun/acr-login@v1 - with: - login-server: "https://${{ env.ACR_EE_REGISTRY }}" - region-id: "${{ env.REGION_ID }}" - access-key-id: "${{ secrets.ACCESS_KEY_ID }}" - access-key-secret: "${{ secrets.ACCESS_KEY_SECRET }}" - instance-id: "${{ env.ACR_EE_INSTANCE_ID }}" - - # 2.2 (Optional) Build and push image ACR EE - - name: Build and push image to ACR EE - run: | - docker build -t "$ACR_EE_REGISTRY/$ACR_EE_NAMESPACE/$ACR_EE_IMAGE:$TAG" . - docker push "$ACR_EE_REGISTRY/$ACR_EE_NAMESPACE/$ACR_EE_IMAGE:$TAG" - # 2.3 (Optional) Scan image in ACR EE - - name: Scan image in ACR EE - uses: aliyun/acr-scan@v1 - with: - region-id: "${{ env.REGION_ID }}" - access-key-id: "${{ secrets.ACCESS_KEY_ID }}" - access-key-secret: "${{ secrets.ACCESS_KEY_SECRET }}" - instance-id: "${{ env.ACR_EE_INSTANCE_ID }}" - repository: "${{ env.ACR_EE_NAMESPACE}}/${{ env.ACR_EE_IMAGE }}" - tag: "${{ env.ACR_EE_TAG }}" - - # 3.1 Set ACK context - - name: Set K8s context - uses: aliyun/ack-set-context@v1 - with: - access-key-id: "${{ secrets.ACCESS_KEY_ID }}" - access-key-secret: "${{ secrets.ACCESS_KEY_SECRET }}" - cluster-id: "${{ env.ACK_CLUSTER_ID }}" - - # 3.2 Deploy the image to the ACK cluster - - name: Set up Kustomize - run: |- - curl -s "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh" | bash /dev/stdin 3.8.6 - - name: Deploy - run: |- - ./kustomize edit set image REGISTRY/NAMESPACE/IMAGE:TAG=$REGISTRY/$NAMESPACE/$IMAGE:$TAG - ./kustomize build . | kubectl apply -f - - kubectl rollout status deployment/$ACK_DEPLOYMENT_NAME - kubectl get services -o wide +# This workflow will build and push a new container image to Alibaba Cloud Container Registry (ACR), +# and then will deploy it to Alibaba Cloud Container Service for Kubernetes (ACK), when there is a push to the master branch. +# +# To use this workflow, you will need to complete the following set-up steps: +# +# 1. Create an ACR repository to store your container images. +# You can use ACR EE instance for more security and better performance. +# For instructions see https://www.alibabacloud.com/help/doc-detail/142168.htm +# +# 2. Create an ACK cluster to run your containerized application. +# You can use ACK Pro cluster for more security and better performance. +# For instructions see https://www.alibabacloud.com/help/doc-detail/95108.htm +# +# 3. Store your AccessKey pair in GitHub Actions secrets named `ACCESS_KEY_ID` and `ACCESS_KEY_SECRET`. +# For instructions on setting up secrets see: https://developer.github.com/actions/managing-workflows/storing-secrets/ +# +# 4. Change the values for the REGION_ID, REGISTRY, NAMESPACE, IMAGE, ACK_CLUSTER_ID, and ACK_DEPLOYMENT_NAME. +# + +name: Build and Deploy to ACK + +on: + push: + branches: + - master + +# Environment variables available to all jobs and steps in this workflow. +env: + REGION_ID: cn-hangzhou + REGISTRY: registry.cn-hangzhou.aliyuncs.com + NAMESPACE: namespace + IMAGE: repo + TAG: ${{ github.sha }} + ACK_CLUSTER_ID: clusterID + ACK_DEPLOYMENT_NAME: nginx-deployment + + ACR_EE_REGISTRY: myregistry.cn-hangzhou.cr.aliyuncs.com + ACR_EE_INSTANCE_ID: instanceID + ACR_EE_NAMESPACE: namespace + ACR_EE_IMAGE: repo + ACR_EE_TAG: ${{ github.sha }} + +permissions: + contents: read + +jobs: + build: + runs-on: ubuntu-latest + environment: production + + steps: + - name: Checkout + uses: actions/checkout@v3 + + # 1.1 Login to ACR + - name: Login to ACR with the AccessKey pair + uses: aliyun/acr-login@v1 + with: + region-id: "${{ env.REGION_ID }}" + access-key-id: "${{ secrets.ACCESS_KEY_ID }}" + access-key-secret: "${{ secrets.ACCESS_KEY_SECRET }}" + + # 1.2 Buid and push image to ACR + - name: Build and push image to ACR + run: | + docker build --tag "$REGISTRY/$NAMESPACE/$IMAGE:$TAG" . + docker push "$REGISTRY/$NAMESPACE/$IMAGE:$TAG" + + # 1.3 Scan image in ACR + - name: Scan image in ACR + uses: aliyun/acr-scan@v1 + with: + region-id: "${{ env.REGION_ID }}" + access-key-id: "${{ secrets.ACCESS_KEY_ID }}" + access-key-secret: "${{ secrets.ACCESS_KEY_SECRET }}" + repository: "${{ env.NAMESPACE }}/${{ env.IMAGE }}" + tag: "${{ env.TAG }}" + + # 2.1 (Optional) Login to ACR EE + - uses: actions/checkout@v3 + - name: Login to ACR EE with the AccessKey pair + uses: aliyun/acr-login@v1 + with: + login-server: "https://${{ env.ACR_EE_REGISTRY }}" + region-id: "${{ env.REGION_ID }}" + access-key-id: "${{ secrets.ACCESS_KEY_ID }}" + access-key-secret: "${{ secrets.ACCESS_KEY_SECRET }}" + instance-id: "${{ env.ACR_EE_INSTANCE_ID }}" + + # 2.2 (Optional) Build and push image ACR EE + - name: Build and push image to ACR EE + run: | + docker build -t "$ACR_EE_REGISTRY/$ACR_EE_NAMESPACE/$ACR_EE_IMAGE:$TAG" . + docker push "$ACR_EE_REGISTRY/$ACR_EE_NAMESPACE/$ACR_EE_IMAGE:$TAG" + # 2.3 (Optional) Scan image in ACR EE + - name: Scan image in ACR EE + uses: aliyun/acr-scan@v1 + with: + region-id: "${{ env.REGION_ID }}" + access-key-id: "${{ secrets.ACCESS_KEY_ID }}" + access-key-secret: "${{ secrets.ACCESS_KEY_SECRET }}" + instance-id: "${{ env.ACR_EE_INSTANCE_ID }}" + repository: "${{ env.ACR_EE_NAMESPACE}}/${{ env.ACR_EE_IMAGE }}" + tag: "${{ env.ACR_EE_TAG }}" + + # 3.1 Set ACK context + - name: Set K8s context + uses: aliyun/ack-set-context@v1 + with: + access-key-id: "${{ secrets.ACCESS_KEY_ID }}" + access-key-secret: "${{ secrets.ACCESS_KEY_SECRET }}" + cluster-id: "${{ env.ACK_CLUSTER_ID }}" + + # 3.2 Deploy the image to the ACK cluster + - name: Set up Kustomize + run: |- + curl -s "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh" | bash /dev/stdin 3.8.6 + - name: Deploy + run: |- + ./kustomize edit set image REGISTRY/NAMESPACE/IMAGE:TAG=$REGISTRY/$NAMESPACE/$IMAGE:$TAG + ./kustomize build . | kubectl apply -f - + kubectl rollout status deployment/$ACK_DEPLOYMENT_NAME + kubectl get services -o wide diff --git a/.github/workflows/anchore.yml b/.github/workflows/anchore.yml index 878adc4..a16cd59 100644 --- a/.github/workflows/anchore.yml +++ b/.github/workflows/anchore.yml @@ -1,45 +1,45 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -# This workflow checks out code, builds an image, performs a container image -# vulnerability scan with Anchore's Grype tool, and integrates the results with GitHub Advanced Security -# code scanning feature. For more information on the Anchore scan action usage -# and parameters, see https://github.com/anchore/scan-action. For more -# information on Anchore's container image scanning tool Grype, see -# https://github.com/anchore/grype -name: Anchore Container Scan - -on: - push: - branches: [ master ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ master ] - schedule: - - cron: '22 9 * * 2' - -permissions: - contents: read - -jobs: - Anchore-Build-Scan: - permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - runs-on: ubuntu-latest - steps: - - name: Checkout the code - uses: actions/checkout@v3 - - name: Build the Docker image - run: docker build . --file Dockerfile --tag localbuild/testimage:latest - - name: Run the Anchore scan action itself with GitHub Advanced Security code scanning integration enabled - uses: anchore/scan-action@487706fd9fc531f35bd6fc1edcdbae6bb79870fa - with: - image: "localbuild/testimage:latest" - acs-report-enable: true - - name: Upload Anchore Scan Report - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: results.sarif +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# This workflow checks out code, builds an image, performs a container image +# vulnerability scan with Anchore's Grype tool, and integrates the results with GitHub Advanced Security +# code scanning feature. For more information on the Anchore scan action usage +# and parameters, see https://github.com/anchore/scan-action. For more +# information on Anchore's container image scanning tool Grype, see +# https://github.com/anchore/grype +name: Anchore Container Scan + +on: + push: + branches: [ master ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ master ] + schedule: + - cron: '22 9 * * 2' + +permissions: + contents: read + +jobs: + Anchore-Build-Scan: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + runs-on: ubuntu-latest + steps: + - name: Checkout the code + uses: actions/checkout@v3 + - name: Build the Docker image + run: docker build . --file Dockerfile --tag localbuild/testimage:latest + - name: Run the Anchore scan action itself with GitHub Advanced Security code scanning integration enabled + uses: anchore/scan-action@487706fd9fc531f35bd6fc1edcdbae6bb79870fa + with: + image: "localbuild/testimage:latest" + acs-report-enable: true + - name: Upload Anchore Scan Report + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: results.sarif diff --git a/.github/workflows/apisec-scan.yml b/.github/workflows/apisec-scan.yml index 5d2d47b..d38090a 100644 --- a/.github/workflows/apisec-scan.yml +++ b/.github/workflows/apisec-scan.yml @@ -1,69 +1,69 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -# APIsec addresses the critical need to secure APIs before they reach production. -# APIsec provides the industry’s only automated and continuous API testing platform that uncovers security vulnerabilities and logic flaws in APIs. -# Clients rely on APIsec to evaluate every update and release, ensuring that no APIs go to production with vulnerabilities. - -# How to Get Started with APIsec.ai -# 1. Schedule a demo at https://www.apisec.ai/request-a-demo . -# -# 2. Register your account at https://cloud.fxlabs.io/#/signup . -# -# 3. Register your API . See the video (https://www.youtube.com/watch?v=MK3Xo9Dbvac) to get up and running with APIsec quickly. -# -# 4. Get GitHub Actions scan attributes from APIsec Project -> Configurations -> Integrations -> CI-CD -> GitHub Actions -# -# apisec-run-scan -# -# This action triggers the on-demand scans for projects registered in APIsec. -# If your GitHub account allows code scanning alerts, you can then upload the sarif file generated by this action to show the scan findings. -# Else you can view the scan results from the project home page in APIsec Platform. -# The link to view the scan results is also displayed on the console on successful completion of action. - -# This is a starter workflow to help you get started with APIsec-Scan Actions - -name: APIsec - -# Controls when the workflow will run -on: - # Triggers the workflow on push or pull request events but only for the master branch - # Customize trigger events based on your DevSecOps processes. - push: - branches: [ master ] - pull_request: - branches: [ master ] - schedule: - - cron: '32 17 * * 5' - - # Allows you to run this workflow manually from the Actions tab - workflow_dispatch: - - -permissions: - contents: read - -jobs: - Trigger APIsec scan: - permissions: - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - runs-on: ubuntu-latest - - steps: - - name: APIsec scan - uses: apisec-inc/apisec-run-scan@eadaedebb5b8516971299b64cea226dc9d9edb6c - with: - # The APIsec username with which the scans will be executed - apisec-username: ${{ secrets.apisec_username }} - # The Password of the APIsec user with which the scans will be executed - apisec-password: ${{ secrets.apisec_password}} - # The name of the project for security scan - apisec-project: "VAmPI" - # The name of the sarif format result file The file is written only if this property is provided. - sarif-result-file: "apisec-results.sarif" - - name: Import results - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: ./apisec-results.sarif +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# APIsec addresses the critical need to secure APIs before they reach production. +# APIsec provides the industry’s only automated and continuous API testing platform that uncovers security vulnerabilities and logic flaws in APIs. +# Clients rely on APIsec to evaluate every update and release, ensuring that no APIs go to production with vulnerabilities. + +# How to Get Started with APIsec.ai +# 1. Schedule a demo at https://www.apisec.ai/request-a-demo . +# +# 2. Register your account at https://cloud.fxlabs.io/#/signup . +# +# 3. Register your API . See the video (https://www.youtube.com/watch?v=MK3Xo9Dbvac) to get up and running with APIsec quickly. +# +# 4. Get GitHub Actions scan attributes from APIsec Project -> Configurations -> Integrations -> CI-CD -> GitHub Actions +# +# apisec-run-scan +# +# This action triggers the on-demand scans for projects registered in APIsec. +# If your GitHub account allows code scanning alerts, you can then upload the sarif file generated by this action to show the scan findings. +# Else you can view the scan results from the project home page in APIsec Platform. +# The link to view the scan results is also displayed on the console on successful completion of action. + +# This is a starter workflow to help you get started with APIsec-Scan Actions + +name: APIsec + +# Controls when the workflow will run +on: + # Triggers the workflow on push or pull request events but only for the master branch + # Customize trigger events based on your DevSecOps processes. + push: + branches: [ master ] + pull_request: + branches: [ master ] + schedule: + - cron: '32 17 * * 5' + + # Allows you to run this workflow manually from the Actions tab + workflow_dispatch: + + +permissions: + contents: read + +jobs: + Trigger APIsec scan: + permissions: + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + runs-on: ubuntu-latest + + steps: + - name: APIsec scan + uses: apisec-inc/apisec-run-scan@eadaedebb5b8516971299b64cea226dc9d9edb6c + with: + # The APIsec username with which the scans will be executed + apisec-username: ${{ secrets.apisec_username }} + # The Password of the APIsec user with which the scans will be executed + apisec-password: ${{ secrets.apisec_password}} + # The name of the project for security scan + apisec-project: "VAmPI" + # The name of the sarif format result file The file is written only if this property is provided. + sarif-result-file: "apisec-results.sarif" + - name: Import results + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: ./apisec-results.sarif diff --git a/.github/workflows/aws.yml b/.github/workflows/aws.yml index a6d3a8c..1253332 100644 --- a/.github/workflows/aws.yml +++ b/.github/workflows/aws.yml @@ -1,95 +1,95 @@ -# This workflow will build and push a new container image to Amazon ECR, -# and then will deploy a new task definition to Amazon ECS, when there is a push to the master branch. -# -# To use this workflow, you will need to complete the following set-up steps: -# -# 1. Create an ECR repository to store your images. -# For example: `aws ecr create-repository --repository-name my-ecr-repo --region us-east-2`. -# Replace the value of the `ECR_REPOSITORY` environment variable in the workflow below with your repository's name. -# Replace the value of the `AWS_REGION` environment variable in the workflow below with your repository's region. -# -# 2. Create an ECS task definition, an ECS cluster, and an ECS service. -# For example, follow the Getting Started guide on the ECS console: -# https://us-east-2.console.aws.amazon.com/ecs/home?region=us-east-2#/firstRun -# Replace the value of the `ECS_SERVICE` environment variable in the workflow below with the name you set for the Amazon ECS service. -# Replace the value of the `ECS_CLUSTER` environment variable in the workflow below with the name you set for the cluster. -# -# 3. Store your ECS task definition as a JSON file in your repository. -# The format should follow the output of `aws ecs register-task-definition --generate-cli-skeleton`. -# Replace the value of the `ECS_TASK_DEFINITION` environment variable in the workflow below with the path to the JSON file. -# Replace the value of the `CONTAINER_NAME` environment variable in the workflow below with the name of the container -# in the `containerDefinitions` section of the task definition. -# -# 4. Store an IAM user access key in GitHub Actions secrets named `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`. -# See the documentation for each action used below for the recommended IAM policies for this IAM user, -# and best practices on handling the access key credentials. - -name: Deploy to Amazon ECS - -on: - push: - branches: - - master - -env: - AWS_REGION: MY_AWS_REGION # set this to your preferred AWS region, e.g. us-west-1 - ECR_REPOSITORY: MY_ECR_REPOSITORY # set this to your Amazon ECR repository name - ECS_SERVICE: MY_ECS_SERVICE # set this to your Amazon ECS service name - ECS_CLUSTER: MY_ECS_CLUSTER # set this to your Amazon ECS cluster name - ECS_TASK_DEFINITION: MY_ECS_TASK_DEFINITION # set this to the path to your Amazon ECS task definition - # file, e.g. .aws/task-definition.json - CONTAINER_NAME: MY_CONTAINER_NAME # set this to the name of the container in the - # containerDefinitions section of your task definition - -permissions: - contents: read - -jobs: - deploy: - name: Deploy - runs-on: ubuntu-latest - environment: production - - steps: - - name: Checkout - uses: actions/checkout@v3 - - - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v2 - with: - aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} - aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - aws-region: ${{ env.AWS_REGION }} - - - name: Login to Amazon ECR - id: login-ecr - uses: aws-actions/amazon-ecr-login@v1 - - - name: Build, tag, and push image to Amazon ECR - id: build-image - env: - ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }} - IMAGE_TAG: ${{ github.sha }} - run: | - # Build a docker container and - # push it to ECR so that it can - # be deployed to ECS. - docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG . - docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG - echo "::set-output name=image::$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" - - - name: Fill in the new image ID in the Amazon ECS task definition - id: task-def - uses: aws-actions/amazon-ecs-render-task-definition@v1 - with: - task-definition: ${{ env.ECS_TASK_DEFINITION }} - container-name: ${{ env.CONTAINER_NAME }} - image: ${{ steps.build-image.outputs.image }} - - - name: Deploy Amazon ECS task definition - uses: aws-actions/amazon-ecs-deploy-task-definition@v1 - with: - task-definition: ${{ steps.task-def.outputs.task-definition }} - service: ${{ env.ECS_SERVICE }} - cluster: ${{ env.ECS_CLUSTER }} - wait-for-service-stability: true +# This workflow will build and push a new container image to Amazon ECR, +# and then will deploy a new task definition to Amazon ECS, when there is a push to the master branch. +# +# To use this workflow, you will need to complete the following set-up steps: +# +# 1. Create an ECR repository to store your images. +# For example: `aws ecr create-repository --repository-name my-ecr-repo --region us-east-2`. +# Replace the value of the `ECR_REPOSITORY` environment variable in the workflow below with your repository's name. +# Replace the value of the `AWS_REGION` environment variable in the workflow below with your repository's region. +# +# 2. Create an ECS task definition, an ECS cluster, and an ECS service. +# For example, follow the Getting Started guide on the ECS console: +# https://us-east-2.console.aws.amazon.com/ecs/home?region=us-east-2#/firstRun +# Replace the value of the `ECS_SERVICE` environment variable in the workflow below with the name you set for the Amazon ECS service. +# Replace the value of the `ECS_CLUSTER` environment variable in the workflow below with the name you set for the cluster. +# +# 3. Store your ECS task definition as a JSON file in your repository. +# The format should follow the output of `aws ecs register-task-definition --generate-cli-skeleton`. +# Replace the value of the `ECS_TASK_DEFINITION` environment variable in the workflow below with the path to the JSON file. +# Replace the value of the `CONTAINER_NAME` environment variable in the workflow below with the name of the container +# in the `containerDefinitions` section of the task definition. +# +# 4. Store an IAM user access key in GitHub Actions secrets named `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`. +# See the documentation for each action used below for the recommended IAM policies for this IAM user, +# and best practices on handling the access key credentials. + +name: Deploy to Amazon ECS + +on: + push: + branches: + - master + +env: + AWS_REGION: MY_AWS_REGION # set this to your preferred AWS region, e.g. us-west-1 + ECR_REPOSITORY: MY_ECR_REPOSITORY # set this to your Amazon ECR repository name + ECS_SERVICE: MY_ECS_SERVICE # set this to your Amazon ECS service name + ECS_CLUSTER: MY_ECS_CLUSTER # set this to your Amazon ECS cluster name + ECS_TASK_DEFINITION: MY_ECS_TASK_DEFINITION # set this to the path to your Amazon ECS task definition + # file, e.g. .aws/task-definition.json + CONTAINER_NAME: MY_CONTAINER_NAME # set this to the name of the container in the + # containerDefinitions section of your task definition + +permissions: + contents: read + +jobs: + deploy: + name: Deploy + runs-on: ubuntu-latest + environment: production + + steps: + - name: Checkout + uses: actions/checkout@v3 + + - name: Configure AWS credentials + uses: aws-actions/configure-aws-credentials@v2 + with: + aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} + aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} + aws-region: ${{ env.AWS_REGION }} + + - name: Login to Amazon ECR + id: login-ecr + uses: aws-actions/amazon-ecr-login@v1 + + - name: Build, tag, and push image to Amazon ECR + id: build-image + env: + ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }} + IMAGE_TAG: ${{ github.sha }} + run: | + # Build a docker container and + # push it to ECR so that it can + # be deployed to ECS. + docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG . + docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG + echo "::set-output name=image::$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" + + - name: Fill in the new image ID in the Amazon ECS task definition + id: task-def + uses: aws-actions/amazon-ecs-render-task-definition@v1 + with: + task-definition: ${{ env.ECS_TASK_DEFINITION }} + container-name: ${{ env.CONTAINER_NAME }} + image: ${{ steps.build-image.outputs.image }} + + - name: Deploy Amazon ECS task definition + uses: aws-actions/amazon-ecs-deploy-task-definition@v1 + with: + task-definition: ${{ steps.task-def.outputs.task-definition }} + service: ${{ env.ECS_SERVICE }} + cluster: ${{ env.ECS_CLUSTER }} + wait-for-service-stability: true diff --git a/.github/workflows/azure-container-webapp.yml b/.github/workflows/azure-container-webapp.yml index b2a2e5d..ba599e4 100644 --- a/.github/workflows/azure-container-webapp.yml +++ b/.github/workflows/azure-container-webapp.yml @@ -1,87 +1,87 @@ -# This workflow will build and push a Docker container to an Azure Web App when a commit is pushed to your default branch. -# -# This workflow assumes you have already created the target Azure App Service web app. -# For instructions see https://docs.microsoft.com/en-us/azure/app-service/quickstart-custom-container?tabs=dotnet&pivots=container-linux -# -# To configure this workflow: -# -# 1. Download the Publish Profile for your Azure Web App. You can download this file from the Overview page of your Web App in the Azure Portal. -# For more information: https://docs.microsoft.com/en-us/azure/app-service/deploy-github-actions?tabs=applevel#generate-deployment-credentials -# -# 2. Create a secret in your repository named AZURE_WEBAPP_PUBLISH_PROFILE, paste the publish profile contents as the value of the secret. -# For instructions on obtaining the publish profile see: https://docs.microsoft.com/azure/app-service/deploy-github-actions#configure-the-github-secret -# -# 3. Create a GitHub Personal access token with "repo" and "read:packages" permissions. -# -# 4. Create three app settings on your Azure Web app: -# DOCKER_REGISTRY_SERVER_URL: Set this to "https://ghcr.io" -# DOCKER_REGISTRY_SERVER_USERNAME: Set this to the GitHub username or organization that owns the repository -# DOCKER_REGISTRY_SERVER_PASSWORD: Set this to the value of your PAT token from the previous step -# -# 5. Change the value for the AZURE_WEBAPP_NAME. -# -# For more information on GitHub Actions for Azure: https://github.com/Azure/Actions -# For more information on the Azure Web Apps Deploy action: https://github.com/Azure/webapps-deploy -# For more samples to get started with GitHub Action workflows to deploy to Azure: https://github.com/Azure/actions-workflow-samples - -name: Build and deploy a container to an Azure Web App - -env: - AZURE_WEBAPP_NAME: your-app-name # set this to the name of your Azure Web App - -on: - push: - branches: - - master - workflow_dispatch: - -permissions: - contents: read - -jobs: - build: - runs-on: ubuntu-latest - - steps: - - uses: actions/checkout@v3 - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v2 - - - name: Log in to GitHub container registry - uses: docker/login-action@v2.2.0 - with: - registry: ghcr.io - username: ${{ github.actor }} - password: ${{ github.token }} - - - name: Lowercase the repo name and username - run: echo "REPO=${GITHUB_REPOSITORY,,}" >>${GITHUB_ENV} - - - name: Build and push container image to registry - uses: docker/build-push-action@v4 - with: - push: true - tags: ghcr.io/${{ env.REPO }}:${{ github.sha }} - file: ./Dockerfile - - deploy: - permissions: - contents: none - runs-on: ubuntu-latest - needs: build - environment: - name: 'Development' - url: ${{ steps.deploy-to-webapp.outputs.webapp-url }} - - steps: - - name: Lowercase the repo name and username - run: echo "REPO=${GITHUB_REPOSITORY,,}" >>${GITHUB_ENV} - - - name: Deploy to Azure Web App - id: deploy-to-webapp - uses: azure/webapps-deploy@v2 - with: - app-name: ${{ env.AZURE_WEBAPP_NAME }} - publish-profile: ${{ secrets.AZURE_WEBAPP_PUBLISH_PROFILE }} - images: 'ghcr.io/${{ env.REPO }}:${{ github.sha }}' +# This workflow will build and push a Docker container to an Azure Web App when a commit is pushed to your default branch. +# +# This workflow assumes you have already created the target Azure App Service web app. +# For instructions see https://docs.microsoft.com/en-us/azure/app-service/quickstart-custom-container?tabs=dotnet&pivots=container-linux +# +# To configure this workflow: +# +# 1. Download the Publish Profile for your Azure Web App. You can download this file from the Overview page of your Web App in the Azure Portal. +# For more information: https://docs.microsoft.com/en-us/azure/app-service/deploy-github-actions?tabs=applevel#generate-deployment-credentials +# +# 2. Create a secret in your repository named AZURE_WEBAPP_PUBLISH_PROFILE, paste the publish profile contents as the value of the secret. +# For instructions on obtaining the publish profile see: https://docs.microsoft.com/azure/app-service/deploy-github-actions#configure-the-github-secret +# +# 3. Create a GitHub Personal access token with "repo" and "read:packages" permissions. +# +# 4. Create three app settings on your Azure Web app: +# DOCKER_REGISTRY_SERVER_URL: Set this to "https://ghcr.io" +# DOCKER_REGISTRY_SERVER_USERNAME: Set this to the GitHub username or organization that owns the repository +# DOCKER_REGISTRY_SERVER_PASSWORD: Set this to the value of your PAT token from the previous step +# +# 5. Change the value for the AZURE_WEBAPP_NAME. +# +# For more information on GitHub Actions for Azure: https://github.com/Azure/Actions +# For more information on the Azure Web Apps Deploy action: https://github.com/Azure/webapps-deploy +# For more samples to get started with GitHub Action workflows to deploy to Azure: https://github.com/Azure/actions-workflow-samples + +name: Build and deploy a container to an Azure Web App + +env: + AZURE_WEBAPP_NAME: your-app-name # set this to the name of your Azure Web App + +on: + push: + branches: + - master + workflow_dispatch: + +permissions: + contents: read + +jobs: + build: + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v3 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v2 + + - name: Log in to GitHub container registry + uses: docker/login-action@v2.2.0 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ github.token }} + + - name: Lowercase the repo name and username + run: echo "REPO=${GITHUB_REPOSITORY,,}" >>${GITHUB_ENV} + + - name: Build and push container image to registry + uses: docker/build-push-action@v4 + with: + push: true + tags: ghcr.io/${{ env.REPO }}:${{ github.sha }} + file: ./Dockerfile + + deploy: + permissions: + contents: none + runs-on: ubuntu-latest + needs: build + environment: + name: 'Development' + url: ${{ steps.deploy-to-webapp.outputs.webapp-url }} + + steps: + - name: Lowercase the repo name and username + run: echo "REPO=${GITHUB_REPOSITORY,,}" >>${GITHUB_ENV} + + - name: Deploy to Azure Web App + id: deploy-to-webapp + uses: azure/webapps-deploy@v2 + with: + app-name: ${{ env.AZURE_WEBAPP_NAME }} + publish-profile: ${{ secrets.AZURE_WEBAPP_PUBLISH_PROFILE }} + images: 'ghcr.io/${{ env.REPO }}:${{ github.sha }}' diff --git a/.github/workflows/azure-kubernetes-service-helm.yml b/.github/workflows/azure-kubernetes-service-helm.yml index 3914e51..6480383 100644 --- a/.github/workflows/azure-kubernetes-service-helm.yml +++ b/.github/workflows/azure-kubernetes-service-helm.yml @@ -1,162 +1,162 @@ -# This workflow will build and push an application to a Azure Kubernetes Service (AKS) cluster when you push your code -# -# This workflow assumes you have already created the target AKS cluster and have created an Azure Container Registry (ACR) -# For instructions see: -# - https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough-portal -# - https://docs.microsoft.com/en-us/azure/container-registry/container-registry-get-started-portal -# - https://github.com/Azure/aks-create-action -# -# To configure this workflow: -# -# 1. Set the following secrets in your repository (instructions for getting these -# https://docs.microsoft.com/en-us/azure/developer/github/connect-from-azure?tabs=azure-cli%2Clinux)): -# - AZURE_CLIENT_ID -# - AZURE_TENANT_ID -# - AZURE_SUBSCRIPTION_ID -# -# 2. Set the following environment variables (or replace the values below): -# - AZURE_CONTAINER_REGISTRY (name of your container registry / ACR) -# - CONTAINER_NAME (name of the container image you would like to push up to your ACR) -# - RESOURCE_GROUP (where your cluster is deployed) -# - CLUSTER_NAME (name of your AKS cluster) -# - IMAGE_PULL_SECRET_NAME (name of the ImagePullSecret that will be created to pull your ACR image) -# -# 3. Choose the appropriate render engine for the bake step https://github.com/Azure/k8s-bake. The config below assumes Helm. -# Set your helmChart, overrideFiles, overrides, and helm-version to suit your configuration. -# - CHART_PATH (path to your helm chart) -# - CHART_OVERRIDE_PATH (path to your helm chart with override values) -# -# For more information on GitHub Actions for Azure, refer to https://github.com/Azure/Actions -# For more samples to get started with GitHub Action workflows to deploy to Azure, refer to https://github.com/Azure/actions-workflow-samples -# For more options with the actions used below please refer to https://github.com/Azure/login - -name: Build and deploy an app to AKS with Helm - -on: - push: - branches: - - master - workflow_dispatch: - -env: - AZURE_CONTAINER_REGISTRY: "your-azure-container-registry" - CONTAINER_NAME: "your-container-name" - RESOURCE_GROUP: "your-resource-group" - CLUSTER_NAME: "your-cluster-name" - IMAGE_PULL_SECRET_NAME: "your-image-pull-secret-name" - CHART_PATH: "your-chart-path" - CHART_OVERRIDE_PATH: "your-chart-override-path" - -jobs: - buildImage: - permissions: - contents: read - id-token: write - runs-on: ubuntu-latest - steps: - # Checks out the repository this file is in - - uses: actions/checkout@v3 - - # Logs in with your Azure credentials - - name: Azure login - uses: azure/login@v1.4.7 - with: - client-id: ${{ secrets.AZURE_CLIENT_ID }} - tenant-id: ${{ secrets.AZURE_TENANT_ID }} - subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - - # Builds and pushes an image up to your Azure Container Registry - - name: Build and push image to ACR - run: | - az acr build --image ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }} --registry ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} . - - createSecret: - permissions: - contents: read - id-token: write - runs-on: ubuntu-latest - steps: - # Logs in with your Azure credentials - - name: Azure login - uses: azure/login@v1.4.7 - with: - client-id: ${{ secrets.AZURE_CLIENT_ID }} - tenant-id: ${{ secrets.AZURE_TENANT_ID }} - subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - - # Retrieves your Azure Kubernetes Service cluster's kubeconfig file - - name: Get K8s context - uses: azure/aks-set-context@v3.2 - with: - resource-group: ${{ env.RESOURCE_GROUP }} - cluster-name: ${{ env.CLUSTER_NAME }} - - # Retrieves the credentials for pulling images from your Azure Container Registry - - name: Get ACR credentials - run: | - az acr update -n ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} --admin-enabled true - ACR_USERNAME=$(az acr credential show -g ${{ env.RESOURCE_GROUP }} -n ${{ env.AZURE_CONTAINER_REGISTRY }} --query username -o tsv) - ACR_PASSWORD=$(az acr credential show -g ${{ env.RESOURCE_GROUP }} -n ${{ env.AZURE_CONTAINER_REGISTRY }} --query passwords[0].value -o tsv) - echo "::add-mask::${ACR_USERNAME}" - echo "::set-output name=username::${ACR_USERNAME}" - echo "::add-mask::${ACR_PASSWORD}" - echo "::set-output name=password::${ACR_PASSWORD}" - id: get-acr-creds - - # Creates a kubernetes secret on your Azure Kubernetes Service cluster that matches up to the credentials from the last step - - name: Create K8s secret for pulling image from ACR - uses: Azure/k8s-create-secret@v4.0 - with: - container-registry-url: ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io - container-registry-username: ${{ steps.get-acr-creds.outputs.username }} - container-registry-password: ${{ steps.get-acr-creds.outputs.password }} - secret-name: ${{ env.IMAGE_PULL_SECRET_NAME }} - - deploy: - permissions: - actions: read - contents: read - id-token: write - runs-on: ubuntu-latest - needs: [buildImage, createSecret] - steps: - # Checks out the repository this file is in - - uses: actions/checkout@v3 - - # Logs in with your Azure credentials - - name: Azure login - uses: azure/login@v1.4.7 - with: - client-id: ${{ secrets.AZURE_CLIENT_ID }} - tenant-id: ${{ secrets.AZURE_TENANT_ID }} - subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - - # Retrieves your Azure Kubernetes Service cluster's kubeconfig file - - name: Get K8s context - uses: azure/aks-set-context@v3.2 - with: - resource-group: ${{ env.RESOURCE_GROUP }} - cluster-name: ${{ env.CLUSTER_NAME }} - - # Runs Helm to create manifest files - - name: Bake deployment - uses: azure/k8s-bake@v2.4 - with: - renderEngine: 'helm' - helmChart: ${{ env.CHART_PATH }} - overrideFiles: ${{ env.CHART_OVERRIDE_PATH }} - overrides: | - replicas:2 - helm-version: 'latest' - id: bake - - # Deploys application based on manifest files from previous step - - name: Deploy application - uses: Azure/k8s-deploy@v4.9 - with: - action: deploy - manifests: ${{ steps.bake.outputs.manifestsBundle }} - images: | - ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }} - imagepullsecrets: | - ${{ env.IMAGE_PULL_SECRET_NAME }} +# This workflow will build and push an application to a Azure Kubernetes Service (AKS) cluster when you push your code +# +# This workflow assumes you have already created the target AKS cluster and have created an Azure Container Registry (ACR) +# For instructions see: +# - https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough-portal +# - https://docs.microsoft.com/en-us/azure/container-registry/container-registry-get-started-portal +# - https://github.com/Azure/aks-create-action +# +# To configure this workflow: +# +# 1. Set the following secrets in your repository (instructions for getting these +# https://docs.microsoft.com/en-us/azure/developer/github/connect-from-azure?tabs=azure-cli%2Clinux)): +# - AZURE_CLIENT_ID +# - AZURE_TENANT_ID +# - AZURE_SUBSCRIPTION_ID +# +# 2. Set the following environment variables (or replace the values below): +# - AZURE_CONTAINER_REGISTRY (name of your container registry / ACR) +# - CONTAINER_NAME (name of the container image you would like to push up to your ACR) +# - RESOURCE_GROUP (where your cluster is deployed) +# - CLUSTER_NAME (name of your AKS cluster) +# - IMAGE_PULL_SECRET_NAME (name of the ImagePullSecret that will be created to pull your ACR image) +# +# 3. Choose the appropriate render engine for the bake step https://github.com/Azure/k8s-bake. The config below assumes Helm. +# Set your helmChart, overrideFiles, overrides, and helm-version to suit your configuration. +# - CHART_PATH (path to your helm chart) +# - CHART_OVERRIDE_PATH (path to your helm chart with override values) +# +# For more information on GitHub Actions for Azure, refer to https://github.com/Azure/Actions +# For more samples to get started with GitHub Action workflows to deploy to Azure, refer to https://github.com/Azure/actions-workflow-samples +# For more options with the actions used below please refer to https://github.com/Azure/login + +name: Build and deploy an app to AKS with Helm + +on: + push: + branches: + - master + workflow_dispatch: + +env: + AZURE_CONTAINER_REGISTRY: "your-azure-container-registry" + CONTAINER_NAME: "your-container-name" + RESOURCE_GROUP: "your-resource-group" + CLUSTER_NAME: "your-cluster-name" + IMAGE_PULL_SECRET_NAME: "your-image-pull-secret-name" + CHART_PATH: "your-chart-path" + CHART_OVERRIDE_PATH: "your-chart-override-path" + +jobs: + buildImage: + permissions: + contents: read + id-token: write + runs-on: ubuntu-latest + steps: + # Checks out the repository this file is in + - uses: actions/checkout@v3 + + # Logs in with your Azure credentials + - name: Azure login + uses: azure/login@v1.4.7 + with: + client-id: ${{ secrets.AZURE_CLIENT_ID }} + tenant-id: ${{ secrets.AZURE_TENANT_ID }} + subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} + + # Builds and pushes an image up to your Azure Container Registry + - name: Build and push image to ACR + run: | + az acr build --image ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }} --registry ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} . + + createSecret: + permissions: + contents: read + id-token: write + runs-on: ubuntu-latest + steps: + # Logs in with your Azure credentials + - name: Azure login + uses: azure/login@v1.4.7 + with: + client-id: ${{ secrets.AZURE_CLIENT_ID }} + tenant-id: ${{ secrets.AZURE_TENANT_ID }} + subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} + + # Retrieves your Azure Kubernetes Service cluster's kubeconfig file + - name: Get K8s context + uses: azure/aks-set-context@v3.2 + with: + resource-group: ${{ env.RESOURCE_GROUP }} + cluster-name: ${{ env.CLUSTER_NAME }} + + # Retrieves the credentials for pulling images from your Azure Container Registry + - name: Get ACR credentials + run: | + az acr update -n ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} --admin-enabled true + ACR_USERNAME=$(az acr credential show -g ${{ env.RESOURCE_GROUP }} -n ${{ env.AZURE_CONTAINER_REGISTRY }} --query username -o tsv) + ACR_PASSWORD=$(az acr credential show -g ${{ env.RESOURCE_GROUP }} -n ${{ env.AZURE_CONTAINER_REGISTRY }} --query passwords[0].value -o tsv) + echo "::add-mask::${ACR_USERNAME}" + echo "::set-output name=username::${ACR_USERNAME}" + echo "::add-mask::${ACR_PASSWORD}" + echo "::set-output name=password::${ACR_PASSWORD}" + id: get-acr-creds + + # Creates a kubernetes secret on your Azure Kubernetes Service cluster that matches up to the credentials from the last step + - name: Create K8s secret for pulling image from ACR + uses: Azure/k8s-create-secret@v4.0 + with: + container-registry-url: ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io + container-registry-username: ${{ steps.get-acr-creds.outputs.username }} + container-registry-password: ${{ steps.get-acr-creds.outputs.password }} + secret-name: ${{ env.IMAGE_PULL_SECRET_NAME }} + + deploy: + permissions: + actions: read + contents: read + id-token: write + runs-on: ubuntu-latest + needs: [buildImage, createSecret] + steps: + # Checks out the repository this file is in + - uses: actions/checkout@v3 + + # Logs in with your Azure credentials + - name: Azure login + uses: azure/login@v1.4.7 + with: + client-id: ${{ secrets.AZURE_CLIENT_ID }} + tenant-id: ${{ secrets.AZURE_TENANT_ID }} + subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} + + # Retrieves your Azure Kubernetes Service cluster's kubeconfig file + - name: Get K8s context + uses: azure/aks-set-context@v3.2 + with: + resource-group: ${{ env.RESOURCE_GROUP }} + cluster-name: ${{ env.CLUSTER_NAME }} + + # Runs Helm to create manifest files + - name: Bake deployment + uses: azure/k8s-bake@v2.4 + with: + renderEngine: 'helm' + helmChart: ${{ env.CHART_PATH }} + overrideFiles: ${{ env.CHART_OVERRIDE_PATH }} + overrides: | + replicas:2 + helm-version: 'latest' + id: bake + + # Deploys application based on manifest files from previous step + - name: Deploy application + uses: Azure/k8s-deploy@v4.9 + with: + action: deploy + manifests: ${{ steps.bake.outputs.manifestsBundle }} + images: | + ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }} + imagepullsecrets: | + ${{ env.IMAGE_PULL_SECRET_NAME }} diff --git a/.github/workflows/azure-kubernetes-service-kompose.yml b/.github/workflows/azure-kubernetes-service-kompose.yml index 73a95de..bcafc42 100644 --- a/.github/workflows/azure-kubernetes-service-kompose.yml +++ b/.github/workflows/azure-kubernetes-service-kompose.yml @@ -1,157 +1,157 @@ -# This workflow will build and push an application to a Azure Kubernetes Service (AKS) cluster when you push your code -# -# This workflow assumes you have already created the target AKS cluster and have created an Azure Container Registry (ACR) -# For instructions see: -# - https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough-portal -# - https://docs.microsoft.com/en-us/azure/container-registry/container-registry-get-started-portal -# - https://github.com/Azure/aks-create-action -# -# To configure this workflow: -# -# 1. Set the following secrets in your repository (instructions for getting these -# https://docs.microsoft.com/en-us/azure/developer/github/connect-from-azure?tabs=azure-cli%2Clinux): -# - AZURE_CLIENT_ID -# - AZURE_TENANT_ID -# - AZURE_SUBSCRIPTION_ID -# -# 2. Set the following environment variables (or replace the values below): -# - AZURE_CONTAINER_REGISTRY (name of your container registry / ACR) -# - CONTAINER_NAME (name of the container image you would like to push up to your ACR) -# - RESOURCE_GROUP (where your cluster is deployed) -# - CLUSTER_NAME (name of your AKS cluster) -# - IMAGE_PULL_SECRET_NAME (name of the ImagePullSecret that will be created to pull your ACR image) -# -# 3. Choose the appropriate render engine for the bake step https://github.com/Azure/k8s-bake. The config below assumes Kompose. -# Set your dockerComposeFile and kompose-version to suit your configuration. -# - DOCKER_COMPOSE_FILE_PATH (the path where your Kompose deployment manifest is located) -# -# For more information on GitHub Actions for Azure, refer to https://github.com/Azure/Actions -# For more samples to get started with GitHub Action workflows to deploy to Azure, refer to https://github.com/Azure/actions-workflow-samples -# For more options with the actions used below please refer to https://github.com/Azure/login - -name: Build and deploy an app to AKS with Kompose - -on: - push: - branches: - - master - workflow_dispatch: - -env: - AZURE_CONTAINER_REGISTRY: "your-azure-container-registry" - CONTAINER_NAME: "your-container-name" - RESOURCE_GROUP: "your-resource-group" - CLUSTER_NAME: "your-cluster-name" - IMAGE_PULL_SECRET_NAME: "your-image-pull-secret-name" - DOCKER_COMPOSE_FILE_PATH: "your-docker-compose-file-path" - -jobs: - buildImage: - permissions: - contents: read - id-token: write - runs-on: ubuntu-latest - steps: - # Checks out the repository this file is in - - uses: actions/checkout@v3 - - # Logs in with your Azure credentials - - name: Azure login - uses: azure/login@v1.4.7 - with: - client-id: ${{ secrets.AZURE_CLIENT_ID }} - tenant-id: ${{ secrets.AZURE_TENANT_ID }} - subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - - # Builds and pushes an image up to your Azure Container Registry - - name: Build and push image to ACR - run: | - az acr build --image ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }} --registry ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} . - - createSecret: - permissions: - contents: read - id-token: write - runs-on: ubuntu-latest - steps: - # Logs in with your Azure credentials - - name: Azure login - uses: azure/login@v1.4.7 - with: - client-id: ${{ secrets.AZURE_CLIENT_ID }} - tenant-id: ${{ secrets.AZURE_TENANT_ID }} - subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - - # Retrieves your Azure Kubernetes Service cluster's kubeconfig file - - name: Get K8s context - uses: azure/aks-set-context@v3.2 - with: - resource-group: ${{ env.RESOURCE_GROUP }} - cluster-name: ${{ env.CLUSTER_NAME }} - - # Retrieves the credentials for pulling images from your Azure Container Registry - - name: Get ACR credentials - run: | - az acr update -n ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} --admin-enabled true - ACR_USERNAME=$(az acr credential show -g ${{ env.RESOURCE_GROUP }} -n ${{ env.AZURE_CONTAINER_REGISTRY }} --query username -o tsv) - ACR_PASSWORD=$(az acr credential show -g ${{ env.RESOURCE_GROUP }} -n ${{ env.AZURE_CONTAINER_REGISTRY }} --query passwords[0].value -o tsv) - echo "::add-mask::${ACR_USERNAME}" - echo "::set-output name=username::${ACR_USERNAME}" - echo "::add-mask::${ACR_PASSWORD}" - echo "::set-output name=password::${ACR_PASSWORD}" - id: get-acr-creds - - # Creates a kubernetes secret on your Azure Kubernetes Service cluster that matches up to the credentials from the last step - - name: Create K8s secret for pulling image from ACR - uses: Azure/k8s-create-secret@v4.0 - with: - container-registry-url: ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io - container-registry-username: ${{ steps.get-acr-creds.outputs.username }} - container-registry-password: ${{ steps.get-acr-creds.outputs.password }} - secret-name: ${{ env.IMAGE_PULL_SECRET_NAME }} - - deploy: - permissions: - actions: read - contents: read - id-token: write - runs-on: ubuntu-latest - needs: [buildImage, createSecret] - steps: - # Checks out the repository this file is in - - uses: actions/checkout@v3 - - # Logs in with your Azure credentials - - name: Azure login - uses: azure/login@v1.4.7 - with: - client-id: ${{ secrets.AZURE_CLIENT_ID }} - tenant-id: ${{ secrets.AZURE_TENANT_ID }} - subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - - # Retrieves your Azure Kubernetes Service cluster's kubeconfig file - - name: Get K8s context - uses: azure/aks-set-context@v3.2 - with: - resource-group: ${{ env.RESOURCE_GROUP }} - cluster-name: ${{ env.CLUSTER_NAME }} - - # Runs Kompose to create manifest files - - name: Bake deployment - uses: azure/k8s-bake@v2.4 - with: - renderEngine: 'kompose' - dockerComposeFile: ${{ env.DOCKER_COMPOSE_FILE_PATH }} - kompose-version: 'latest' - id: bake - - # Deploys application based on manifest files from previous step - - name: Deploy application - uses: Azure/k8s-deploy@v4.9 - with: - action: deploy - manifests: ${{ steps.bake.outputs.manifestsBundle }} - images: | - ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }} - imagepullsecrets: | - ${{ env.IMAGE_PULL_SECRET_NAME }} +# This workflow will build and push an application to a Azure Kubernetes Service (AKS) cluster when you push your code +# +# This workflow assumes you have already created the target AKS cluster and have created an Azure Container Registry (ACR) +# For instructions see: +# - https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough-portal +# - https://docs.microsoft.com/en-us/azure/container-registry/container-registry-get-started-portal +# - https://github.com/Azure/aks-create-action +# +# To configure this workflow: +# +# 1. Set the following secrets in your repository (instructions for getting these +# https://docs.microsoft.com/en-us/azure/developer/github/connect-from-azure?tabs=azure-cli%2Clinux): +# - AZURE_CLIENT_ID +# - AZURE_TENANT_ID +# - AZURE_SUBSCRIPTION_ID +# +# 2. Set the following environment variables (or replace the values below): +# - AZURE_CONTAINER_REGISTRY (name of your container registry / ACR) +# - CONTAINER_NAME (name of the container image you would like to push up to your ACR) +# - RESOURCE_GROUP (where your cluster is deployed) +# - CLUSTER_NAME (name of your AKS cluster) +# - IMAGE_PULL_SECRET_NAME (name of the ImagePullSecret that will be created to pull your ACR image) +# +# 3. Choose the appropriate render engine for the bake step https://github.com/Azure/k8s-bake. The config below assumes Kompose. +# Set your dockerComposeFile and kompose-version to suit your configuration. +# - DOCKER_COMPOSE_FILE_PATH (the path where your Kompose deployment manifest is located) +# +# For more information on GitHub Actions for Azure, refer to https://github.com/Azure/Actions +# For more samples to get started with GitHub Action workflows to deploy to Azure, refer to https://github.com/Azure/actions-workflow-samples +# For more options with the actions used below please refer to https://github.com/Azure/login + +name: Build and deploy an app to AKS with Kompose + +on: + push: + branches: + - master + workflow_dispatch: + +env: + AZURE_CONTAINER_REGISTRY: "your-azure-container-registry" + CONTAINER_NAME: "your-container-name" + RESOURCE_GROUP: "your-resource-group" + CLUSTER_NAME: "your-cluster-name" + IMAGE_PULL_SECRET_NAME: "your-image-pull-secret-name" + DOCKER_COMPOSE_FILE_PATH: "your-docker-compose-file-path" + +jobs: + buildImage: + permissions: + contents: read + id-token: write + runs-on: ubuntu-latest + steps: + # Checks out the repository this file is in + - uses: actions/checkout@v3 + + # Logs in with your Azure credentials + - name: Azure login + uses: azure/login@v1.4.7 + with: + client-id: ${{ secrets.AZURE_CLIENT_ID }} + tenant-id: ${{ secrets.AZURE_TENANT_ID }} + subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} + + # Builds and pushes an image up to your Azure Container Registry + - name: Build and push image to ACR + run: | + az acr build --image ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }} --registry ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} . + + createSecret: + permissions: + contents: read + id-token: write + runs-on: ubuntu-latest + steps: + # Logs in with your Azure credentials + - name: Azure login + uses: azure/login@v1.4.7 + with: + client-id: ${{ secrets.AZURE_CLIENT_ID }} + tenant-id: ${{ secrets.AZURE_TENANT_ID }} + subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} + + # Retrieves your Azure Kubernetes Service cluster's kubeconfig file + - name: Get K8s context + uses: azure/aks-set-context@v3.2 + with: + resource-group: ${{ env.RESOURCE_GROUP }} + cluster-name: ${{ env.CLUSTER_NAME }} + + # Retrieves the credentials for pulling images from your Azure Container Registry + - name: Get ACR credentials + run: | + az acr update -n ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} --admin-enabled true + ACR_USERNAME=$(az acr credential show -g ${{ env.RESOURCE_GROUP }} -n ${{ env.AZURE_CONTAINER_REGISTRY }} --query username -o tsv) + ACR_PASSWORD=$(az acr credential show -g ${{ env.RESOURCE_GROUP }} -n ${{ env.AZURE_CONTAINER_REGISTRY }} --query passwords[0].value -o tsv) + echo "::add-mask::${ACR_USERNAME}" + echo "::set-output name=username::${ACR_USERNAME}" + echo "::add-mask::${ACR_PASSWORD}" + echo "::set-output name=password::${ACR_PASSWORD}" + id: get-acr-creds + + # Creates a kubernetes secret on your Azure Kubernetes Service cluster that matches up to the credentials from the last step + - name: Create K8s secret for pulling image from ACR + uses: Azure/k8s-create-secret@v4.0 + with: + container-registry-url: ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io + container-registry-username: ${{ steps.get-acr-creds.outputs.username }} + container-registry-password: ${{ steps.get-acr-creds.outputs.password }} + secret-name: ${{ env.IMAGE_PULL_SECRET_NAME }} + + deploy: + permissions: + actions: read + contents: read + id-token: write + runs-on: ubuntu-latest + needs: [buildImage, createSecret] + steps: + # Checks out the repository this file is in + - uses: actions/checkout@v3 + + # Logs in with your Azure credentials + - name: Azure login + uses: azure/login@v1.4.7 + with: + client-id: ${{ secrets.AZURE_CLIENT_ID }} + tenant-id: ${{ secrets.AZURE_TENANT_ID }} + subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} + + # Retrieves your Azure Kubernetes Service cluster's kubeconfig file + - name: Get K8s context + uses: azure/aks-set-context@v3.2 + with: + resource-group: ${{ env.RESOURCE_GROUP }} + cluster-name: ${{ env.CLUSTER_NAME }} + + # Runs Kompose to create manifest files + - name: Bake deployment + uses: azure/k8s-bake@v2.4 + with: + renderEngine: 'kompose' + dockerComposeFile: ${{ env.DOCKER_COMPOSE_FILE_PATH }} + kompose-version: 'latest' + id: bake + + # Deploys application based on manifest files from previous step + - name: Deploy application + uses: Azure/k8s-deploy@v4.9 + with: + action: deploy + manifests: ${{ steps.bake.outputs.manifestsBundle }} + images: | + ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }} + imagepullsecrets: | + ${{ env.IMAGE_PULL_SECRET_NAME }} diff --git a/.github/workflows/azure-kubernetes-service-kustomize.yml b/.github/workflows/azure-kubernetes-service-kustomize.yml index 936bc31..f5dc5cc 100644 --- a/.github/workflows/azure-kubernetes-service-kustomize.yml +++ b/.github/workflows/azure-kubernetes-service-kustomize.yml @@ -1,157 +1,157 @@ -# This workflow will build and push an application to a Azure Kubernetes Service (AKS) cluster when you push your code -# -# This workflow assumes you have already created the target AKS cluster and have created an Azure Container Registry (ACR) -# For instructions see: -# - https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough-portal -# - https://docs.microsoft.com/en-us/azure/container-registry/container-registry-get-started-portal -# - https://github.com/Azure/aks-create-action -# -# To configure this workflow: -# -# 1. Set the following secrets in your repository (instructions for getting these -# https://docs.microsoft.com/en-us/azure/developer/github/connect-from-azure?tabs=azure-cli%2Clinux): -# - AZURE_CLIENT_ID -# - AZURE_TENANT_ID -# - AZURE_SUBSCRIPTION_ID -# -# 2. Set the following environment variables (or replace the values below): -# - AZURE_CONTAINER_REGISTRY (name of your container registry / ACR) -# - CONTAINER_NAME (name of the container image you would like to push up to your ACR) -# - RESOURCE_GROUP (where your cluster is deployed) -# - CLUSTER_NAME (name of your AKS cluster) -# - IMAGE_PULL_SECRET_NAME (name of the ImagePullSecret that will be created to pull your ACR image) -# -# 3. Choose the appropriate render engine for the bake step https://github.com/Azure/k8s-bake. The config below assumes Kustomize. -# Set your kustomizationPath and kubectl-version to suit your configuration. -# - KUSTOMIZE_PATH (the path where your Kustomize manifests are located) -# -# For more information on GitHub Actions for Azure, refer to https://github.com/Azure/Actions -# For more samples to get started with GitHub Action workflows to deploy to Azure, refer to https://github.com/Azure/actions-workflow-samples -# For more options with the actions used below please refer to https://github.com/Azure/login - -name: Build and deploy an app to AKS with Kustomize - -on: - push: - branches: - - master - workflow_dispatch: - -env: - AZURE_CONTAINER_REGISTRY: "your-azure-container-registry" - CONTAINER_NAME: "your-container-name" - RESOURCE_GROUP: "your-resource-group" - CLUSTER_NAME: "your-cluster-name" - IMAGE_PULL_SECRET_NAME: "your-image-pull-secret-name" - KUSTOMIZE_PATH: "your-kustomize-path" - -jobs: - buildImage: - permissions: - contents: read - id-token: write - runs-on: ubuntu-latest - steps: - # Checks out the repository this file is in - - uses: actions/checkout@v3 - - # Logs in with your Azure credentials - - name: Azure login - uses: azure/login@v1.4.7 - with: - client-id: ${{ secrets.AZURE_CLIENT_ID }} - tenant-id: ${{ secrets.AZURE_TENANT_ID }} - subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - - # Builds and pushes an image up to your Azure Container Registry - - name: Build and push image to ACR - run: | - az acr build --image ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }} --registry ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} . - - createSecret: - permissions: - contents: read - id-token: write - runs-on: ubuntu-latest - steps: - # Logs in with your Azure credentials - - name: Azure login - uses: azure/login@v1.4.7 - with: - client-id: ${{ secrets.AZURE_CLIENT_ID }} - tenant-id: ${{ secrets.AZURE_TENANT_ID }} - subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - - # Retrieves your Azure Kubernetes Service cluster's kubeconfig file - - name: Get K8s context - uses: azure/aks-set-context@v3.2 - with: - resource-group: ${{ env.RESOURCE_GROUP }} - cluster-name: ${{ env.CLUSTER_NAME }} - - # Retrieves the credentials for pulling images from your Azure Container Registry - - name: Get ACR credentials - run: | - az acr update -n ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} --admin-enabled true - ACR_USERNAME=$(az acr credential show -g ${{ env.RESOURCE_GROUP }} -n ${{ env.AZURE_CONTAINER_REGISTRY }} --query username -o tsv) - ACR_PASSWORD=$(az acr credential show -g ${{ env.RESOURCE_GROUP }} -n ${{ env.AZURE_CONTAINER_REGISTRY }} --query passwords[0].value -o tsv) - echo "::add-mask::${ACR_USERNAME}" - echo "::set-output name=username::${ACR_USERNAME}" - echo "::add-mask::${ACR_PASSWORD}" - echo "::set-output name=password::${ACR_PASSWORD}" - id: get-acr-creds - - # Creates a kubernetes secret on your Azure Kubernetes Service cluster that matches up to the credentials from the last step - - name: Create K8s secret for pulling image from ACR - uses: Azure/k8s-create-secret@v4.0 - with: - container-registry-url: ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io - container-registry-username: ${{ steps.get-acr-creds.outputs.username }} - container-registry-password: ${{ steps.get-acr-creds.outputs.password }} - secret-name: ${{ env.IMAGE_PULL_SECRET_NAME }} - - deploy: - permissions: - actions: read - contents: read - id-token: write - runs-on: ubuntu-latest - needs: [buildImage, createSecret] - steps: - # Checks out the repository this file is in - - uses: actions/checkout@v3 - - # Logs in with your Azure credentials - - name: Azure login - uses: azure/login@v1.4.7 - with: - client-id: ${{ secrets.AZURE_CLIENT_ID }} - tenant-id: ${{ secrets.AZURE_TENANT_ID }} - subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - - # Retrieves your Azure Kubernetes Service cluster's kubeconfig file - - name: Get K8s context - uses: azure/aks-set-context@v3.2 - with: - resource-group: ${{ env.RESOURCE_GROUP }} - cluster-name: ${{ env.CLUSTER_NAME }} - - # Runs Kustomize to create manifest files - - name: Bake deployment - uses: azure/k8s-bake@v2.4 - with: - renderEngine: 'kustomize' - kustomizationPath: ${{ env.KUSTOMIZE_PATH }} - kubectl-version: latest - id: bake - - # Deploys application based on manifest files from previous step - - name: Deploy application - uses: Azure/k8s-deploy@v4.9 - with: - action: deploy - manifests: ${{ steps.bake.outputs.manifestsBundle }} - images: | - ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }} - imagepullsecrets: | - ${{ env.IMAGE_PULL_SECRET_NAME }} +# This workflow will build and push an application to a Azure Kubernetes Service (AKS) cluster when you push your code +# +# This workflow assumes you have already created the target AKS cluster and have created an Azure Container Registry (ACR) +# For instructions see: +# - https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough-portal +# - https://docs.microsoft.com/en-us/azure/container-registry/container-registry-get-started-portal +# - https://github.com/Azure/aks-create-action +# +# To configure this workflow: +# +# 1. Set the following secrets in your repository (instructions for getting these +# https://docs.microsoft.com/en-us/azure/developer/github/connect-from-azure?tabs=azure-cli%2Clinux): +# - AZURE_CLIENT_ID +# - AZURE_TENANT_ID +# - AZURE_SUBSCRIPTION_ID +# +# 2. Set the following environment variables (or replace the values below): +# - AZURE_CONTAINER_REGISTRY (name of your container registry / ACR) +# - CONTAINER_NAME (name of the container image you would like to push up to your ACR) +# - RESOURCE_GROUP (where your cluster is deployed) +# - CLUSTER_NAME (name of your AKS cluster) +# - IMAGE_PULL_SECRET_NAME (name of the ImagePullSecret that will be created to pull your ACR image) +# +# 3. Choose the appropriate render engine for the bake step https://github.com/Azure/k8s-bake. The config below assumes Kustomize. +# Set your kustomizationPath and kubectl-version to suit your configuration. +# - KUSTOMIZE_PATH (the path where your Kustomize manifests are located) +# +# For more information on GitHub Actions for Azure, refer to https://github.com/Azure/Actions +# For more samples to get started with GitHub Action workflows to deploy to Azure, refer to https://github.com/Azure/actions-workflow-samples +# For more options with the actions used below please refer to https://github.com/Azure/login + +name: Build and deploy an app to AKS with Kustomize + +on: + push: + branches: + - master + workflow_dispatch: + +env: + AZURE_CONTAINER_REGISTRY: "your-azure-container-registry" + CONTAINER_NAME: "your-container-name" + RESOURCE_GROUP: "your-resource-group" + CLUSTER_NAME: "your-cluster-name" + IMAGE_PULL_SECRET_NAME: "your-image-pull-secret-name" + KUSTOMIZE_PATH: "your-kustomize-path" + +jobs: + buildImage: + permissions: + contents: read + id-token: write + runs-on: ubuntu-latest + steps: + # Checks out the repository this file is in + - uses: actions/checkout@v3 + + # Logs in with your Azure credentials + - name: Azure login + uses: azure/login@v1.4.7 + with: + client-id: ${{ secrets.AZURE_CLIENT_ID }} + tenant-id: ${{ secrets.AZURE_TENANT_ID }} + subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} + + # Builds and pushes an image up to your Azure Container Registry + - name: Build and push image to ACR + run: | + az acr build --image ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }} --registry ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} . + + createSecret: + permissions: + contents: read + id-token: write + runs-on: ubuntu-latest + steps: + # Logs in with your Azure credentials + - name: Azure login + uses: azure/login@v1.4.7 + with: + client-id: ${{ secrets.AZURE_CLIENT_ID }} + tenant-id: ${{ secrets.AZURE_TENANT_ID }} + subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} + + # Retrieves your Azure Kubernetes Service cluster's kubeconfig file + - name: Get K8s context + uses: azure/aks-set-context@v3.2 + with: + resource-group: ${{ env.RESOURCE_GROUP }} + cluster-name: ${{ env.CLUSTER_NAME }} + + # Retrieves the credentials for pulling images from your Azure Container Registry + - name: Get ACR credentials + run: | + az acr update -n ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} --admin-enabled true + ACR_USERNAME=$(az acr credential show -g ${{ env.RESOURCE_GROUP }} -n ${{ env.AZURE_CONTAINER_REGISTRY }} --query username -o tsv) + ACR_PASSWORD=$(az acr credential show -g ${{ env.RESOURCE_GROUP }} -n ${{ env.AZURE_CONTAINER_REGISTRY }} --query passwords[0].value -o tsv) + echo "::add-mask::${ACR_USERNAME}" + echo "::set-output name=username::${ACR_USERNAME}" + echo "::add-mask::${ACR_PASSWORD}" + echo "::set-output name=password::${ACR_PASSWORD}" + id: get-acr-creds + + # Creates a kubernetes secret on your Azure Kubernetes Service cluster that matches up to the credentials from the last step + - name: Create K8s secret for pulling image from ACR + uses: Azure/k8s-create-secret@v4.0 + with: + container-registry-url: ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io + container-registry-username: ${{ steps.get-acr-creds.outputs.username }} + container-registry-password: ${{ steps.get-acr-creds.outputs.password }} + secret-name: ${{ env.IMAGE_PULL_SECRET_NAME }} + + deploy: + permissions: + actions: read + contents: read + id-token: write + runs-on: ubuntu-latest + needs: [buildImage, createSecret] + steps: + # Checks out the repository this file is in + - uses: actions/checkout@v3 + + # Logs in with your Azure credentials + - name: Azure login + uses: azure/login@v1.4.7 + with: + client-id: ${{ secrets.AZURE_CLIENT_ID }} + tenant-id: ${{ secrets.AZURE_TENANT_ID }} + subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} + + # Retrieves your Azure Kubernetes Service cluster's kubeconfig file + - name: Get K8s context + uses: azure/aks-set-context@v3.2 + with: + resource-group: ${{ env.RESOURCE_GROUP }} + cluster-name: ${{ env.CLUSTER_NAME }} + + # Runs Kustomize to create manifest files + - name: Bake deployment + uses: azure/k8s-bake@v2.4 + with: + renderEngine: 'kustomize' + kustomizationPath: ${{ env.KUSTOMIZE_PATH }} + kubectl-version: latest + id: bake + + # Deploys application based on manifest files from previous step + - name: Deploy application + uses: Azure/k8s-deploy@v4.9 + with: + action: deploy + manifests: ${{ steps.bake.outputs.manifestsBundle }} + images: | + ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }} + imagepullsecrets: | + ${{ env.IMAGE_PULL_SECRET_NAME }} diff --git a/.github/workflows/azure-kubernetes-service.yml b/.github/workflows/azure-kubernetes-service.yml index 7e12308..a7fe806 100644 --- a/.github/workflows/azure-kubernetes-service.yml +++ b/.github/workflows/azure-kubernetes-service.yml @@ -1,144 +1,144 @@ -# This workflow will build and push an application to a Azure Kubernetes Service (AKS) cluster when you push your code -# -# This workflow assumes you have already created the target AKS cluster and have created an Azure Container Registry (ACR) -# For instructions see: -# - https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough-portal -# - https://docs.microsoft.com/en-us/azure/container-registry/container-registry-get-started-portal -# - https://github.com/Azure/aks-create-action -# -# To configure this workflow: -# -# 1. Set the following secrets in your repository (instructions for getting these can be found at https://docs.microsoft.com/en-us/azure/developer/github/connect-from-azure?tabs=azure-cli%2Clinux): -# - AZURE_CLIENT_ID -# - AZURE_TENANT_ID -# - AZURE_SUBSCRIPTION_ID -# -# 2. Set the following environment variables (or replace the values below): -# - AZURE_CONTAINER_REGISTRY (name of your container registry / ACR) -# - RESOURCE_GROUP (where your cluster is deployed) -# - CLUSTER_NAME (name of your AKS cluster) -# - CONTAINER_NAME (name of the container image you would like to push up to your ACR) -# - IMAGE_PULL_SECRET_NAME (name of the ImagePullSecret that will be created to pull your ACR image) -# - DEPLOYMENT_MANIFEST_PATH (path to the manifest yaml for your deployment) -# -# For more information on GitHub Actions for Azure, refer to https://github.com/Azure/Actions -# For more samples to get started with GitHub Action workflows to deploy to Azure, refer to https://github.com/Azure/actions-workflow-samples -# For more options with the actions used below please refer to https://github.com/Azure/login - -name: Build and deploy an app to AKS - -on: - push: - branches: - - master - workflow_dispatch: - -env: - AZURE_CONTAINER_REGISTRY: "your-azure-container-registry" - CONTAINER_NAME: "your-container-name" - RESOURCE_GROUP: "your-resource-group" - CLUSTER_NAME: "your-cluster-name" - IMAGE_PULL_SECRET_NAME: "your-image-pull-secret-name" - DEPLOYMENT_MANIFEST_PATH: 'your-deployment-manifest-path' - -jobs: - buildImage: - permissions: - contents: read - id-token: write - runs-on: ubuntu-latest - steps: - # Checks out the repository this file is in - - uses: actions/checkout@v3 - - # Logs in with your Azure credentials - - name: Azure login - uses: azure/login@v1.4.7 - with: - client-id: ${{ secrets.AZURE_CLIENT_ID }} - tenant-id: ${{ secrets.AZURE_TENANT_ID }} - subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - - # Builds and pushes an image up to your Azure Container Registry - - name: Build and push image to ACR - run: | - az acr build --image ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }} --registry ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} . - - createSecret: - permissions: - contents: read - id-token: write - runs-on: ubuntu-latest - steps: - # Logs in with your Azure credentials - - name: Azure login - uses: azure/login@v1.4.7 - with: - client-id: ${{ secrets.AZURE_CLIENT_ID }} - tenant-id: ${{ secrets.AZURE_TENANT_ID }} - subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - - # Retrieves your Azure Kubernetes Service cluster's kubeconfig file - - name: Get K8s context - uses: azure/aks-set-context@v3.2 - with: - resource-group: ${{ env.RESOURCE_GROUP }} - cluster-name: ${{ env.CLUSTER_NAME }} - - # Retrieves the credentials for pulling images from your Azure Container Registry - - name: Get ACR credentials - run: | - az acr update -n ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} --admin-enabled true - ACR_USERNAME=$(az acr credential show -g ${{ env.RESOURCE_GROUP }} -n ${{ env.AZURE_CONTAINER_REGISTRY }} --query username -o tsv) - ACR_PASSWORD=$(az acr credential show -g ${{ env.RESOURCE_GROUP }} -n ${{ env.AZURE_CONTAINER_REGISTRY }} --query passwords[0].value -o tsv) - echo "::add-mask::${ACR_USERNAME}" - echo "::set-output name=username::${ACR_USERNAME}" - echo "::add-mask::${ACR_PASSWORD}" - echo "::set-output name=password::${ACR_PASSWORD}" - id: get-acr-creds - - # Creates a kubernetes secret on your Azure Kubernetes Service cluster that matches up to the credentials from the last step - - name: Create K8s secret for pulling image from ACR - uses: Azure/k8s-create-secret@v4.0 - with: - container-registry-url: ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io - container-registry-username: ${{ steps.get-acr-creds.outputs.username }} - container-registry-password: ${{ steps.get-acr-creds.outputs.password }} - secret-name: ${{ env.IMAGE_PULL_SECRET_NAME }} - - deploy: - permissions: - actions: read - contents: read - id-token: write - runs-on: ubuntu-latest - needs: [buildImage, createSecret] - steps: - # Checks out the repository this file is in - - uses: actions/checkout@v3 - - # Logs in with your Azure credentials - - name: Azure login - uses: azure/login@v1.4.7 - with: - client-id: ${{ secrets.AZURE_CLIENT_ID }} - tenant-id: ${{ secrets.AZURE_TENANT_ID }} - subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - - # Retrieves your Azure Kubernetes Service cluster's kubeconfig file - - name: Get K8s context - uses: azure/aks-set-context@v3.2 - with: - resource-group: ${{ env.RESOURCE_GROUP }} - cluster-name: ${{ env.CLUSTER_NAME }} - - # Deploys application based on given manifest file - - name: Deploys application - uses: Azure/k8s-deploy@v4.9 - with: - action: deploy - manifests: ${{ env.DEPLOYMENT_MANIFEST_PATH }} - images: | - ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }} - imagepullsecrets: | - ${{ env.IMAGE_PULL_SECRET_NAME }} +# This workflow will build and push an application to a Azure Kubernetes Service (AKS) cluster when you push your code +# +# This workflow assumes you have already created the target AKS cluster and have created an Azure Container Registry (ACR) +# For instructions see: +# - https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough-portal +# - https://docs.microsoft.com/en-us/azure/container-registry/container-registry-get-started-portal +# - https://github.com/Azure/aks-create-action +# +# To configure this workflow: +# +# 1. Set the following secrets in your repository (instructions for getting these can be found at https://docs.microsoft.com/en-us/azure/developer/github/connect-from-azure?tabs=azure-cli%2Clinux): +# - AZURE_CLIENT_ID +# - AZURE_TENANT_ID +# - AZURE_SUBSCRIPTION_ID +# +# 2. Set the following environment variables (or replace the values below): +# - AZURE_CONTAINER_REGISTRY (name of your container registry / ACR) +# - RESOURCE_GROUP (where your cluster is deployed) +# - CLUSTER_NAME (name of your AKS cluster) +# - CONTAINER_NAME (name of the container image you would like to push up to your ACR) +# - IMAGE_PULL_SECRET_NAME (name of the ImagePullSecret that will be created to pull your ACR image) +# - DEPLOYMENT_MANIFEST_PATH (path to the manifest yaml for your deployment) +# +# For more information on GitHub Actions for Azure, refer to https://github.com/Azure/Actions +# For more samples to get started with GitHub Action workflows to deploy to Azure, refer to https://github.com/Azure/actions-workflow-samples +# For more options with the actions used below please refer to https://github.com/Azure/login + +name: Build and deploy an app to AKS + +on: + push: + branches: + - master + workflow_dispatch: + +env: + AZURE_CONTAINER_REGISTRY: "your-azure-container-registry" + CONTAINER_NAME: "your-container-name" + RESOURCE_GROUP: "your-resource-group" + CLUSTER_NAME: "your-cluster-name" + IMAGE_PULL_SECRET_NAME: "your-image-pull-secret-name" + DEPLOYMENT_MANIFEST_PATH: 'your-deployment-manifest-path' + +jobs: + buildImage: + permissions: + contents: read + id-token: write + runs-on: ubuntu-latest + steps: + # Checks out the repository this file is in + - uses: actions/checkout@v3 + + # Logs in with your Azure credentials + - name: Azure login + uses: azure/login@v1.4.7 + with: + client-id: ${{ secrets.AZURE_CLIENT_ID }} + tenant-id: ${{ secrets.AZURE_TENANT_ID }} + subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} + + # Builds and pushes an image up to your Azure Container Registry + - name: Build and push image to ACR + run: | + az acr build --image ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }} --registry ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} . + + createSecret: + permissions: + contents: read + id-token: write + runs-on: ubuntu-latest + steps: + # Logs in with your Azure credentials + - name: Azure login + uses: azure/login@v1.4.7 + with: + client-id: ${{ secrets.AZURE_CLIENT_ID }} + tenant-id: ${{ secrets.AZURE_TENANT_ID }} + subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} + + # Retrieves your Azure Kubernetes Service cluster's kubeconfig file + - name: Get K8s context + uses: azure/aks-set-context@v3.2 + with: + resource-group: ${{ env.RESOURCE_GROUP }} + cluster-name: ${{ env.CLUSTER_NAME }} + + # Retrieves the credentials for pulling images from your Azure Container Registry + - name: Get ACR credentials + run: | + az acr update -n ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} --admin-enabled true + ACR_USERNAME=$(az acr credential show -g ${{ env.RESOURCE_GROUP }} -n ${{ env.AZURE_CONTAINER_REGISTRY }} --query username -o tsv) + ACR_PASSWORD=$(az acr credential show -g ${{ env.RESOURCE_GROUP }} -n ${{ env.AZURE_CONTAINER_REGISTRY }} --query passwords[0].value -o tsv) + echo "::add-mask::${ACR_USERNAME}" + echo "::set-output name=username::${ACR_USERNAME}" + echo "::add-mask::${ACR_PASSWORD}" + echo "::set-output name=password::${ACR_PASSWORD}" + id: get-acr-creds + + # Creates a kubernetes secret on your Azure Kubernetes Service cluster that matches up to the credentials from the last step + - name: Create K8s secret for pulling image from ACR + uses: Azure/k8s-create-secret@v4.0 + with: + container-registry-url: ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io + container-registry-username: ${{ steps.get-acr-creds.outputs.username }} + container-registry-password: ${{ steps.get-acr-creds.outputs.password }} + secret-name: ${{ env.IMAGE_PULL_SECRET_NAME }} + + deploy: + permissions: + actions: read + contents: read + id-token: write + runs-on: ubuntu-latest + needs: [buildImage, createSecret] + steps: + # Checks out the repository this file is in + - uses: actions/checkout@v3 + + # Logs in with your Azure credentials + - name: Azure login + uses: azure/login@v1.4.7 + with: + client-id: ${{ secrets.AZURE_CLIENT_ID }} + tenant-id: ${{ secrets.AZURE_TENANT_ID }} + subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} + + # Retrieves your Azure Kubernetes Service cluster's kubeconfig file + - name: Get K8s context + uses: azure/aks-set-context@v3.2 + with: + resource-group: ${{ env.RESOURCE_GROUP }} + cluster-name: ${{ env.CLUSTER_NAME }} + + # Deploys application based on given manifest file + - name: Deploys application + uses: Azure/k8s-deploy@v4.9 + with: + action: deploy + manifests: ${{ env.DEPLOYMENT_MANIFEST_PATH }} + images: | + ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/${{ env.CONTAINER_NAME }}:${{ github.sha }} + imagepullsecrets: | + ${{ env.IMAGE_PULL_SECRET_NAME }} diff --git a/.github/workflows/azure-staticwebapp.yml b/.github/workflows/azure-staticwebapp.yml index 8f95868..b7c064b 100644 --- a/.github/workflows/azure-staticwebapp.yml +++ b/.github/workflows/azure-staticwebapp.yml @@ -1,72 +1,72 @@ -# This workflow will build and push a web application to an Azure Static Web App when you change your code. -# -# This workflow assumes you have already created the target Azure Static Web App. -# For instructions see https://docs.microsoft.com/azure/static-web-apps/get-started-portal?tabs=vanilla-javascript -# -# To configure this workflow: -# -# 1. Set up a secret in your repository named AZURE_STATIC_WEB_APPS_API_TOKEN with the value of your Static Web Apps deployment token. -# For instructions on obtaining the deployment token see: https://docs.microsoft.com/azure/static-web-apps/deployment-token-management -# -# 3. Change the values for the APP_LOCATION, API_LOCATION and APP_ARTIFACT_LOCATION, AZURE_STATIC_WEB_APPS_API_TOKEN environment variables (below). -# For instructions on setting up the appropriate configuration values go to https://docs.microsoft.com/azure/static-web-apps/front-end-frameworks -name: Deploy web app to Azure Static Web Apps - -on: - push: - branches: - - master - pull_request: - types: [opened, synchronize, reopened, closed] - branches: - - master - -# Environment variables available to all jobs and steps in this workflow -env: - APP_LOCATION: "/" # location of your client code - API_LOCATION: "api" # location of your api source code - optional - APP_ARTIFACT_LOCATION: "build" # location of client code build output - AZURE_STATIC_WEB_APPS_API_TOKEN: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN }} # secret containing deployment token for your static web app - -permissions: - contents: read - -jobs: - build_and_deploy_job: - permissions: - contents: read # for actions/checkout to fetch code - pull-requests: write # for Azure/static-web-apps-deploy to comment on PRs - if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.action != 'closed') - runs-on: ubuntu-latest - name: Build and Deploy Job - steps: - - uses: actions/checkout@v3 - with: - submodules: true - - name: Build And Deploy - id: builddeploy - uses: Azure/static-web-apps-deploy@v1 - with: - azure_static_web_apps_api_token: ${{ env.AZURE_STATIC_WEB_APPS_API_TOKEN }} # secret containing api token for app - repo_token: ${{ secrets.GITHUB_TOKEN }} # Used for Github integrations (i.e. PR comments) - action: "upload" - ###### Repository/Build Configurations - These values can be configured to match you app requirements. ###### - # For more information regarding Static Web App workflow configurations, please visit: https://aka.ms/swaworkflowconfig - app_location: ${{ env.APP_LOCATION }} - api_location: ${{ env.API_LOCATION }} - app_artifact_location: ${{ env.APP_ARTIFACT_LOCATION }} - ###### End of Repository/Build Configurations ###### - - close_pull_request_job: - permissions: - contents: none - if: github.event_name == 'pull_request' && github.event.action == 'closed' - runs-on: ubuntu-latest - name: Close Pull Request Job - steps: - - name: Close Pull Request - id: closepullrequest - uses: Azure/static-web-apps-deploy@v1 - with: - azure_static_web_apps_api_token: ${{ env.AZURE_STATIC_WEB_APPS_API_TOKEN }} # secret containing api token for app - action: "close" +# This workflow will build and push a web application to an Azure Static Web App when you change your code. +# +# This workflow assumes you have already created the target Azure Static Web App. +# For instructions see https://docs.microsoft.com/azure/static-web-apps/get-started-portal?tabs=vanilla-javascript +# +# To configure this workflow: +# +# 1. Set up a secret in your repository named AZURE_STATIC_WEB_APPS_API_TOKEN with the value of your Static Web Apps deployment token. +# For instructions on obtaining the deployment token see: https://docs.microsoft.com/azure/static-web-apps/deployment-token-management +# +# 3. Change the values for the APP_LOCATION, API_LOCATION and APP_ARTIFACT_LOCATION, AZURE_STATIC_WEB_APPS_API_TOKEN environment variables (below). +# For instructions on setting up the appropriate configuration values go to https://docs.microsoft.com/azure/static-web-apps/front-end-frameworks +name: Deploy web app to Azure Static Web Apps + +on: + push: + branches: + - master + pull_request: + types: [opened, synchronize, reopened, closed] + branches: + - master + +# Environment variables available to all jobs and steps in this workflow +env: + APP_LOCATION: "/" # location of your client code + API_LOCATION: "api" # location of your api source code - optional + APP_ARTIFACT_LOCATION: "build" # location of client code build output + AZURE_STATIC_WEB_APPS_API_TOKEN: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN }} # secret containing deployment token for your static web app + +permissions: + contents: read + +jobs: + build_and_deploy_job: + permissions: + contents: read # for actions/checkout to fetch code + pull-requests: write # for Azure/static-web-apps-deploy to comment on PRs + if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.action != 'closed') + runs-on: ubuntu-latest + name: Build and Deploy Job + steps: + - uses: actions/checkout@v3 + with: + submodules: true + - name: Build And Deploy + id: builddeploy + uses: Azure/static-web-apps-deploy@v1 + with: + azure_static_web_apps_api_token: ${{ env.AZURE_STATIC_WEB_APPS_API_TOKEN }} # secret containing api token for app + repo_token: ${{ secrets.GITHUB_TOKEN }} # Used for Github integrations (i.e. PR comments) + action: "upload" + ###### Repository/Build Configurations - These values can be configured to match you app requirements. ###### + # For more information regarding Static Web App workflow configurations, please visit: https://aka.ms/swaworkflowconfig + app_location: ${{ env.APP_LOCATION }} + api_location: ${{ env.API_LOCATION }} + app_artifact_location: ${{ env.APP_ARTIFACT_LOCATION }} + ###### End of Repository/Build Configurations ###### + + close_pull_request_job: + permissions: + contents: none + if: github.event_name == 'pull_request' && github.event.action == 'closed' + runs-on: ubuntu-latest + name: Close Pull Request Job + steps: + - name: Close Pull Request + id: closepullrequest + uses: Azure/static-web-apps-deploy@v1 + with: + azure_static_web_apps_api_token: ${{ env.AZURE_STATIC_WEB_APPS_API_TOKEN }} # secret containing api token for app + action: "close" diff --git a/.github/workflows/azure-webapps-dotnet-core.yml b/.github/workflows/azure-webapps-dotnet-core.yml index a691a44..7c8cb20 100644 --- a/.github/workflows/azure-webapps-dotnet-core.yml +++ b/.github/workflows/azure-webapps-dotnet-core.yml @@ -1,89 +1,89 @@ -# This workflow will build and push a .NET Core app to an Azure Web App when a commit is pushed to your default branch. -# -# This workflow assumes you have already created the target Azure App Service web app. -# For instructions see https://docs.microsoft.com/en-us/azure/app-service/quickstart-dotnetcore?tabs=net60&pivots=development-environment-vscode -# -# To configure this workflow: -# -# 1. Download the Publish Profile for your Azure Web App. You can download this file from the Overview page of your Web App in the Azure Portal. -# For more information: https://docs.microsoft.com/en-us/azure/app-service/deploy-github-actions?tabs=applevel#generate-deployment-credentials -# -# 2. Create a secret in your repository named AZURE_WEBAPP_PUBLISH_PROFILE, paste the publish profile contents as the value of the secret. -# For instructions on obtaining the publish profile see: https://docs.microsoft.com/azure/app-service/deploy-github-actions#configure-the-github-secret -# -# 3. Change the value for the AZURE_WEBAPP_NAME. Optionally, change the AZURE_WEBAPP_PACKAGE_PATH and DOTNET_VERSION environment variables below. -# -# For more information on GitHub Actions for Azure: https://github.com/Azure/Actions -# For more information on the Azure Web Apps Deploy action: https://github.com/Azure/webapps-deploy -# For more samples to get started with GitHub Action workflows to deploy to Azure: https://github.com/Azure/actions-workflow-samples - -name: Build and deploy ASP.Net Core app to an Azure Web App - -env: - AZURE_WEBAPP_NAME: your-app-name # set this to the name of your Azure Web App - AZURE_WEBAPP_PACKAGE_PATH: '.' # set this to the path to your web app project, defaults to the repository root - DOTNET_VERSION: '5' # set this to the .NET Core version to use - -on: - push: - branches: - - master - workflow_dispatch: - -permissions: - contents: read - -jobs: - build: - runs-on: ubuntu-latest - - steps: - - uses: actions/checkout@v3 - - - name: Set up .NET Core - uses: actions/setup-dotnet@v3 - with: - dotnet-version: ${{ env.DOTNET_VERSION }} - - - name: Set up dependency caching for faster builds - uses: actions/cache@v3 - with: - path: ~/.nuget/packages - key: ${{ runner.os }}-nuget-${{ hashFiles('**/packages.lock.json') }} - restore-keys: | - ${{ runner.os }}-nuget- - - - name: Build with dotnet - run: dotnet build --configuration Release - - - name: dotnet publish - run: dotnet publish -c Release -o ${{env.DOTNET_ROOT}}/myapp - - - name: Upload artifact for deployment job - uses: actions/upload-artifact@v3 - with: - name: .net-app - path: ${{env.DOTNET_ROOT}}/myapp - - deploy: - permissions: - contents: none - runs-on: ubuntu-latest - needs: build - environment: - name: 'Development' - url: ${{ steps.deploy-to-webapp.outputs.webapp-url }} - - steps: - - name: Download artifact from build job - uses: actions/download-artifact@v3 - with: - name: .net-app - - - name: Deploy to Azure Web App - id: deploy-to-webapp - uses: azure/webapps-deploy@v2 - with: - app-name: ${{ env.AZURE_WEBAPP_NAME }} - publish-profile: ${{ secrets.AZURE_WEBAPP_PUBLISH_PROFILE }} - package: ${{ env.AZURE_WEBAPP_PACKAGE_PATH }} +# This workflow will build and push a .NET Core app to an Azure Web App when a commit is pushed to your default branch. +# +# This workflow assumes you have already created the target Azure App Service web app. +# For instructions see https://docs.microsoft.com/en-us/azure/app-service/quickstart-dotnetcore?tabs=net60&pivots=development-environment-vscode +# +# To configure this workflow: +# +# 1. Download the Publish Profile for your Azure Web App. You can download this file from the Overview page of your Web App in the Azure Portal. +# For more information: https://docs.microsoft.com/en-us/azure/app-service/deploy-github-actions?tabs=applevel#generate-deployment-credentials +# +# 2. Create a secret in your repository named AZURE_WEBAPP_PUBLISH_PROFILE, paste the publish profile contents as the value of the secret. +# For instructions on obtaining the publish profile see: https://docs.microsoft.com/azure/app-service/deploy-github-actions#configure-the-github-secret +# +# 3. Change the value for the AZURE_WEBAPP_NAME. Optionally, change the AZURE_WEBAPP_PACKAGE_PATH and DOTNET_VERSION environment variables below. +# +# For more information on GitHub Actions for Azure: https://github.com/Azure/Actions +# For more information on the Azure Web Apps Deploy action: https://github.com/Azure/webapps-deploy +# For more samples to get started with GitHub Action workflows to deploy to Azure: https://github.com/Azure/actions-workflow-samples + +name: Build and deploy ASP.Net Core app to an Azure Web App + +env: + AZURE_WEBAPP_NAME: your-app-name # set this to the name of your Azure Web App + AZURE_WEBAPP_PACKAGE_PATH: '.' # set this to the path to your web app project, defaults to the repository root + DOTNET_VERSION: '5' # set this to the .NET Core version to use + +on: + push: + branches: + - master + workflow_dispatch: + +permissions: + contents: read + +jobs: + build: + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v3 + + - name: Set up .NET Core + uses: actions/setup-dotnet@v3 + with: + dotnet-version: ${{ env.DOTNET_VERSION }} + + - name: Set up dependency caching for faster builds + uses: actions/cache@v3 + with: + path: ~/.nuget/packages + key: ${{ runner.os }}-nuget-${{ hashFiles('**/packages.lock.json') }} + restore-keys: | + ${{ runner.os }}-nuget- + + - name: Build with dotnet + run: dotnet build --configuration Release + + - name: dotnet publish + run: dotnet publish -c Release -o ${{env.DOTNET_ROOT}}/myapp + + - name: Upload artifact for deployment job + uses: actions/upload-artifact@v3 + with: + name: .net-app + path: ${{env.DOTNET_ROOT}}/myapp + + deploy: + permissions: + contents: none + runs-on: ubuntu-latest + needs: build + environment: + name: 'Development' + url: ${{ steps.deploy-to-webapp.outputs.webapp-url }} + + steps: + - name: Download artifact from build job + uses: actions/download-artifact@v3 + with: + name: .net-app + + - name: Deploy to Azure Web App + id: deploy-to-webapp + uses: azure/webapps-deploy@v2 + with: + app-name: ${{ env.AZURE_WEBAPP_NAME }} + publish-profile: ${{ secrets.AZURE_WEBAPP_PUBLISH_PROFILE }} + package: ${{ env.AZURE_WEBAPP_PACKAGE_PATH }} diff --git a/.github/workflows/azure-webapps-java-jar.yml b/.github/workflows/azure-webapps-java-jar.yml index 794d6a8..a889928 100644 --- a/.github/workflows/azure-webapps-java-jar.yml +++ b/.github/workflows/azure-webapps-java-jar.yml @@ -1,80 +1,80 @@ -# This workflow will build and push a Java application to an Azure Web App when a commit is pushed to your default branch. -# -# This workflow assumes you have already created the target Azure App Service web app. -# For instructions see https://docs.microsoft.com/en-us/azure/app-service/quickstart-java?tabs=javase&pivots=platform-linux -# -# To configure this workflow: -# -# 1. Download the Publish Profile for your Azure Web App. You can download this file from the Overview page of your Web App in the Azure Portal. -# For more information: https://docs.microsoft.com/en-us/azure/app-service/deploy-github-actions?tabs=applevel#generate-deployment-credentials -# -# 2. Create a secret in your repository named AZURE_WEBAPP_PUBLISH_PROFILE, paste the publish profile contents as the value of the secret. -# For instructions on obtaining the publish profile see: https://docs.microsoft.com/azure/app-service/deploy-github-actions#configure-the-github-secret -# -# 3. Change the value for the AZURE_WEBAPP_NAME. Optionally, change the JAVA_VERSION environment variable below. -# -# For more information on GitHub Actions for Azure: https://github.com/Azure/Actions -# For more information on the Azure Web Apps Deploy action: https://github.com/Azure/webapps-deploy -# For more samples to get started with GitHub Action workflows to deploy to Azure: https://github.com/Azure/actions-workflow-samples - -name: Build and deploy JAR app to Azure Web App - -env: - AZURE_WEBAPP_NAME: your-app-name # set this to the name of your Azure Web App - JAVA_VERSION: '11' # set this to the Java version to use - DISTRIBUTION: zulu # set this to the Java distribution - -on: - push: - branches: - - master - workflow_dispatch: - -permissions: - contents: read - -jobs: - build: - runs-on: ubuntu-latest - - steps: - - uses: actions/checkout@v3 - - - name: Set up Java version - uses: actions/setup-java@v3.11.0 - with: - java-version: ${{ env.JAVA_VERSION }} - distribution: ${{ env.DISTRIBUTION }} - cache: 'maven' - - - name: Build with Maven - run: mvn clean install - - - name: Upload artifact for deployment job - uses: actions/upload-artifact@v3 - with: - name: java-app - path: '${{ github.workspace }}/target/*.jar' - - deploy: - permissions: - contents: none - runs-on: ubuntu-latest - needs: build - environment: - name: 'Development' - url: ${{ steps.deploy-to-webapp.outputs.webapp-url }} - - steps: - - name: Download artifact from build job - uses: actions/download-artifact@v3 - with: - name: java-app - - - name: Deploy to Azure Web App - id: deploy-to-webapp - uses: azure/webapps-deploy@v2 - with: - app-name: ${{ env.AZURE_WEBAPP_NAME }} - publish-profile: ${{ secrets.AZURE_WEBAPP_PUBLISH_PROFILE }} - package: '*.jar' +# This workflow will build and push a Java application to an Azure Web App when a commit is pushed to your default branch. +# +# This workflow assumes you have already created the target Azure App Service web app. +# For instructions see https://docs.microsoft.com/en-us/azure/app-service/quickstart-java?tabs=javase&pivots=platform-linux +# +# To configure this workflow: +# +# 1. Download the Publish Profile for your Azure Web App. You can download this file from the Overview page of your Web App in the Azure Portal. +# For more information: https://docs.microsoft.com/en-us/azure/app-service/deploy-github-actions?tabs=applevel#generate-deployment-credentials +# +# 2. Create a secret in your repository named AZURE_WEBAPP_PUBLISH_PROFILE, paste the publish profile contents as the value of the secret. +# For instructions on obtaining the publish profile see: https://docs.microsoft.com/azure/app-service/deploy-github-actions#configure-the-github-secret +# +# 3. Change the value for the AZURE_WEBAPP_NAME. Optionally, change the JAVA_VERSION environment variable below. +# +# For more information on GitHub Actions for Azure: https://github.com/Azure/Actions +# For more information on the Azure Web Apps Deploy action: https://github.com/Azure/webapps-deploy +# For more samples to get started with GitHub Action workflows to deploy to Azure: https://github.com/Azure/actions-workflow-samples + +name: Build and deploy JAR app to Azure Web App + +env: + AZURE_WEBAPP_NAME: your-app-name # set this to the name of your Azure Web App + JAVA_VERSION: '11' # set this to the Java version to use + DISTRIBUTION: zulu # set this to the Java distribution + +on: + push: + branches: + - master + workflow_dispatch: + +permissions: + contents: read + +jobs: + build: + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v3 + + - name: Set up Java version + uses: actions/setup-java@v3.11.0 + with: + java-version: ${{ env.JAVA_VERSION }} + distribution: ${{ env.DISTRIBUTION }} + cache: 'maven' + + - name: Build with Maven + run: mvn clean install + + - name: Upload artifact for deployment job + uses: actions/upload-artifact@v3 + with: + name: java-app + path: '${{ github.workspace }}/target/*.jar' + + deploy: + permissions: + contents: none + runs-on: ubuntu-latest + needs: build + environment: + name: 'Development' + url: ${{ steps.deploy-to-webapp.outputs.webapp-url }} + + steps: + - name: Download artifact from build job + uses: actions/download-artifact@v3 + with: + name: java-app + + - name: Deploy to Azure Web App + id: deploy-to-webapp + uses: azure/webapps-deploy@v2 + with: + app-name: ${{ env.AZURE_WEBAPP_NAME }} + publish-profile: ${{ secrets.AZURE_WEBAPP_PUBLISH_PROFILE }} + package: '*.jar' diff --git a/.github/workflows/azure-webapps-node.yml b/.github/workflows/azure-webapps-node.yml index 1376800..3029065 100644 --- a/.github/workflows/azure-webapps-node.yml +++ b/.github/workflows/azure-webapps-node.yml @@ -1,79 +1,79 @@ -# This workflow will build and push a node.js application to an Azure Web App when a commit is pushed to your default branch. -# -# This workflow assumes you have already created the target Azure App Service web app. -# For instructions see https://docs.microsoft.com/en-us/azure/app-service/quickstart-nodejs?tabs=linux&pivots=development-environment-cli -# -# To configure this workflow: -# -# 1. Download the Publish Profile for your Azure Web App. You can download this file from the Overview page of your Web App in the Azure Portal. -# For more information: https://docs.microsoft.com/en-us/azure/app-service/deploy-github-actions?tabs=applevel#generate-deployment-credentials -# -# 2. Create a secret in your repository named AZURE_WEBAPP_PUBLISH_PROFILE, paste the publish profile contents as the value of the secret. -# For instructions on obtaining the publish profile see: https://docs.microsoft.com/azure/app-service/deploy-github-actions#configure-the-github-secret -# -# 3. Change the value for the AZURE_WEBAPP_NAME. Optionally, change the AZURE_WEBAPP_PACKAGE_PATH and NODE_VERSION environment variables below. -# -# For more information on GitHub Actions for Azure: https://github.com/Azure/Actions -# For more information on the Azure Web Apps Deploy action: https://github.com/Azure/webapps-deploy -# For more samples to get started with GitHub Action workflows to deploy to Azure: https://github.com/Azure/actions-workflow-samples - -on: - push: - branches: - - master - workflow_dispatch: - -env: - AZURE_WEBAPP_NAME: your-app-name # set this to your application's name - AZURE_WEBAPP_PACKAGE_PATH: '.' # set this to the path to your web app project, defaults to the repository root - NODE_VERSION: '14.x' # set this to the node version to use - -permissions: - contents: read - -jobs: - build: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v3 - - - name: Set up Node.js - uses: actions/setup-node@v3 - with: - node-version: ${{ env.NODE_VERSION }} - cache: 'npm' - - - name: npm install, build, and test - run: | - npm install - npm run build --if-present - npm run test --if-present - - - name: Upload artifact for deployment job - uses: actions/upload-artifact@v3 - with: - name: node-app - path: . - - deploy: - permissions: - contents: none - runs-on: ubuntu-latest - needs: build - environment: - name: 'Development' - url: ${{ steps.deploy-to-webapp.outputs.webapp-url }} - - steps: - - name: Download artifact from build job - uses: actions/download-artifact@v3 - with: - name: node-app - - - name: 'Deploy to Azure WebApp' - id: deploy-to-webapp - uses: azure/webapps-deploy@v2 - with: - app-name: ${{ env.AZURE_WEBAPP_NAME }} - publish-profile: ${{ secrets.AZURE_WEBAPP_PUBLISH_PROFILE }} - package: ${{ env.AZURE_WEBAPP_PACKAGE_PATH }} +# This workflow will build and push a node.js application to an Azure Web App when a commit is pushed to your default branch. +# +# This workflow assumes you have already created the target Azure App Service web app. +# For instructions see https://docs.microsoft.com/en-us/azure/app-service/quickstart-nodejs?tabs=linux&pivots=development-environment-cli +# +# To configure this workflow: +# +# 1. Download the Publish Profile for your Azure Web App. You can download this file from the Overview page of your Web App in the Azure Portal. +# For more information: https://docs.microsoft.com/en-us/azure/app-service/deploy-github-actions?tabs=applevel#generate-deployment-credentials +# +# 2. Create a secret in your repository named AZURE_WEBAPP_PUBLISH_PROFILE, paste the publish profile contents as the value of the secret. +# For instructions on obtaining the publish profile see: https://docs.microsoft.com/azure/app-service/deploy-github-actions#configure-the-github-secret +# +# 3. Change the value for the AZURE_WEBAPP_NAME. Optionally, change the AZURE_WEBAPP_PACKAGE_PATH and NODE_VERSION environment variables below. +# +# For more information on GitHub Actions for Azure: https://github.com/Azure/Actions +# For more information on the Azure Web Apps Deploy action: https://github.com/Azure/webapps-deploy +# For more samples to get started with GitHub Action workflows to deploy to Azure: https://github.com/Azure/actions-workflow-samples + +on: + push: + branches: + - master + workflow_dispatch: + +env: + AZURE_WEBAPP_NAME: your-app-name # set this to your application's name + AZURE_WEBAPP_PACKAGE_PATH: '.' # set this to the path to your web app project, defaults to the repository root + NODE_VERSION: '14.x' # set this to the node version to use + +permissions: + contents: read + +jobs: + build: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v3 + + - name: Set up Node.js + uses: actions/setup-node@v3 + with: + node-version: ${{ env.NODE_VERSION }} + cache: 'npm' + + - name: npm install, build, and test + run: | + npm install + npm run build --if-present + npm run test --if-present + + - name: Upload artifact for deployment job + uses: actions/upload-artifact@v3 + with: + name: node-app + path: . + + deploy: + permissions: + contents: none + runs-on: ubuntu-latest + needs: build + environment: + name: 'Development' + url: ${{ steps.deploy-to-webapp.outputs.webapp-url }} + + steps: + - name: Download artifact from build job + uses: actions/download-artifact@v3 + with: + name: node-app + + - name: 'Deploy to Azure WebApp' + id: deploy-to-webapp + uses: azure/webapps-deploy@v2 + with: + app-name: ${{ env.AZURE_WEBAPP_NAME }} + publish-profile: ${{ secrets.AZURE_WEBAPP_PUBLISH_PROFILE }} + package: ${{ env.AZURE_WEBAPP_PACKAGE_PATH }} diff --git a/.github/workflows/azure-webapps-php.yml b/.github/workflows/azure-webapps-php.yml index 955b03d..ca2ed48 100644 --- a/.github/workflows/azure-webapps-php.yml +++ b/.github/workflows/azure-webapps-php.yml @@ -1,100 +1,100 @@ -# This workflow will build and push a PHP application to an Azure Web App when a commit is pushed to your default branch. -# -# This workflow assumes you have already created the target Azure App Service web app. -# For instructions see https://docs.microsoft.com/en-us/azure/app-service/quickstart-php?pivots=platform-linux -# -# To configure this workflow: -# -# 1. Download the Publish Profile for your Azure Web App. You can download this file from the Overview page of your Web App in the Azure Portal. -# For more information: https://docs.microsoft.com/en-us/azure/app-service/deploy-github-actions?tabs=applevel#generate-deployment-credentials -# -# 2. Create a secret in your repository named AZURE_WEBAPP_PUBLISH_PROFILE, paste the publish profile contents as the value of the secret. -# For instructions on obtaining the publish profile see: https://docs.microsoft.com/azure/app-service/deploy-github-actions#configure-the-github-secret -# -# 3. Change the value for the AZURE_WEBAPP_NAME. Optionally, change the AZURE_WEBAPP_PACKAGE_PATH and PHP_VERSION environment variables below. -# -# For more information on GitHub Actions for Azure: https://github.com/Azure/Actions -# For more information on the Azure Web Apps Deploy action: https://github.com/Azure/webapps-deploy -# For more samples to get started with GitHub Action workflows to deploy to Azure: https://github.com/Azure/actions-workflow-samples - -name: Build and deploy PHP app to Azure Web App - -on: - push: - branches: - - master - workflow_dispatch: - -env: - AZURE_WEBAPP_NAME: your-app-name # set this to your application's name - AZURE_WEBAPP_PACKAGE_PATH: '.' # set this to the path to your web app project, defaults to the repository root - PHP_VERSION: '8.x' # set this to the PHP version to use - -permissions: - contents: read - -jobs: - build: - runs-on: ubuntu-latest - - steps: - - uses: actions/checkout@v3 - - - name: Setup PHP - uses: shivammathur/setup-php@9c77701ae57b0c47f6732beebfbdec76e4e5c90a - with: - php-version: ${{ env.PHP_VERSION }} - - - name: Check if composer.json exists - id: check_files - uses: andstor/file-existence-action@20b4d2e596410855db8f9ca21e96fbe18e12930b - with: - files: 'composer.json' - - - name: Get Composer Cache Directory - id: composer-cache - if: steps.check_files.outputs.files_exists == 'true' - run: | - echo "::set-output name=dir::$(composer config cache-files-dir)" - - - name: Set up dependency caching for faster installs - uses: actions/cache@v3 - if: steps.check_files.outputs.files_exists == 'true' - with: - path: ${{ steps.composer-cache.outputs.dir }} - key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }} - restore-keys: | - ${{ runner.os }}-composer- - - - name: Run composer install if composer.json exists - if: steps.check_files.outputs.files_exists == 'true' - run: composer validate --no-check-publish && composer install --prefer-dist --no-progress - - - name: Upload artifact for deployment job - uses: actions/upload-artifact@v3 - with: - name: php-app - path: . - - deploy: - permissions: - contents: none - runs-on: ubuntu-latest - needs: build - environment: - name: 'Development' - url: ${{ steps.deploy-to-webapp.outputs.webapp-url }} - - steps: - - name: Download artifact from build job - uses: actions/download-artifact@v3 - with: - name: php-app - - - name: 'Deploy to Azure Web App' - id: deploy-to-webapp - uses: azure/webapps-deploy@v2 - with: - app-name: ${{ env.AZURE_WEBAPP_NAME }} - publish-profile: ${{ secrets.AZURE_WEBAPP_PUBLISH_PROFILE }} - package: . +# This workflow will build and push a PHP application to an Azure Web App when a commit is pushed to your default branch. +# +# This workflow assumes you have already created the target Azure App Service web app. +# For instructions see https://docs.microsoft.com/en-us/azure/app-service/quickstart-php?pivots=platform-linux +# +# To configure this workflow: +# +# 1. Download the Publish Profile for your Azure Web App. You can download this file from the Overview page of your Web App in the Azure Portal. +# For more information: https://docs.microsoft.com/en-us/azure/app-service/deploy-github-actions?tabs=applevel#generate-deployment-credentials +# +# 2. Create a secret in your repository named AZURE_WEBAPP_PUBLISH_PROFILE, paste the publish profile contents as the value of the secret. +# For instructions on obtaining the publish profile see: https://docs.microsoft.com/azure/app-service/deploy-github-actions#configure-the-github-secret +# +# 3. Change the value for the AZURE_WEBAPP_NAME. Optionally, change the AZURE_WEBAPP_PACKAGE_PATH and PHP_VERSION environment variables below. +# +# For more information on GitHub Actions for Azure: https://github.com/Azure/Actions +# For more information on the Azure Web Apps Deploy action: https://github.com/Azure/webapps-deploy +# For more samples to get started with GitHub Action workflows to deploy to Azure: https://github.com/Azure/actions-workflow-samples + +name: Build and deploy PHP app to Azure Web App + +on: + push: + branches: + - master + workflow_dispatch: + +env: + AZURE_WEBAPP_NAME: your-app-name # set this to your application's name + AZURE_WEBAPP_PACKAGE_PATH: '.' # set this to the path to your web app project, defaults to the repository root + PHP_VERSION: '8.x' # set this to the PHP version to use + +permissions: + contents: read + +jobs: + build: + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v3 + + - name: Setup PHP + uses: shivammathur/setup-php@9c77701ae57b0c47f6732beebfbdec76e4e5c90a + with: + php-version: ${{ env.PHP_VERSION }} + + - name: Check if composer.json exists + id: check_files + uses: andstor/file-existence-action@20b4d2e596410855db8f9ca21e96fbe18e12930b + with: + files: 'composer.json' + + - name: Get Composer Cache Directory + id: composer-cache + if: steps.check_files.outputs.files_exists == 'true' + run: | + echo "::set-output name=dir::$(composer config cache-files-dir)" + + - name: Set up dependency caching for faster installs + uses: actions/cache@v3 + if: steps.check_files.outputs.files_exists == 'true' + with: + path: ${{ steps.composer-cache.outputs.dir }} + key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }} + restore-keys: | + ${{ runner.os }}-composer- + + - name: Run composer install if composer.json exists + if: steps.check_files.outputs.files_exists == 'true' + run: composer validate --no-check-publish && composer install --prefer-dist --no-progress + + - name: Upload artifact for deployment job + uses: actions/upload-artifact@v3 + with: + name: php-app + path: . + + deploy: + permissions: + contents: none + runs-on: ubuntu-latest + needs: build + environment: + name: 'Development' + url: ${{ steps.deploy-to-webapp.outputs.webapp-url }} + + steps: + - name: Download artifact from build job + uses: actions/download-artifact@v3 + with: + name: php-app + + - name: 'Deploy to Azure Web App' + id: deploy-to-webapp + uses: azure/webapps-deploy@v2 + with: + app-name: ${{ env.AZURE_WEBAPP_NAME }} + publish-profile: ${{ secrets.AZURE_WEBAPP_PUBLISH_PROFILE }} + package: . diff --git a/.github/workflows/azure-webapps-python.yml b/.github/workflows/azure-webapps-python.yml index 85aafc7..b4d791c 100644 --- a/.github/workflows/azure-webapps-python.yml +++ b/.github/workflows/azure-webapps-python.yml @@ -1,87 +1,87 @@ -# This workflow will build and push a Python application to an Azure Web App when a commit is pushed to your default branch. -# -# This workflow assumes you have already created the target Azure App Service web app. -# For instructions see https://docs.microsoft.com/en-us/azure/app-service/quickstart-python?tabs=bash&pivots=python-framework-flask -# -# To configure this workflow: -# -# 1. Download the Publish Profile for your Azure Web App. You can download this file from the Overview page of your Web App in the Azure Portal. -# For more information: https://docs.microsoft.com/en-us/azure/app-service/deploy-github-actions?tabs=applevel#generate-deployment-credentials -# -# 2. Create a secret in your repository named AZURE_WEBAPP_PUBLISH_PROFILE, paste the publish profile contents as the value of the secret. -# For instructions on obtaining the publish profile see: https://docs.microsoft.com/azure/app-service/deploy-github-actions#configure-the-github-secret -# -# 3. Change the value for the AZURE_WEBAPP_NAME. Optionally, change the PYTHON_VERSION environment variables below. -# -# For more information on GitHub Actions for Azure: https://github.com/Azure/Actions -# For more information on the Azure Web Apps Deploy action: https://github.com/Azure/webapps-deploy -# For more samples to get started with GitHub Action workflows to deploy to Azure: https://github.com/Azure/actions-workflow-samples - -name: Build and deploy Python app to Azure Web App - -env: - AZURE_WEBAPP_NAME: your-app-name # set this to the name of your Azure Web App - PYTHON_VERSION: '3.8' # set this to the Python version to use - -on: - push: - branches: - - master - workflow_dispatch: - -permissions: - contents: read - -jobs: - build: - runs-on: ubuntu-latest - - steps: - - uses: actions/checkout@v3 - - - name: Set up Python version - uses: actions/setup-python@v4.6.1 - with: - python-version: ${{ env.PYTHON_VERSION }} - cache: 'pip' - - - name: Create and start virtual environment - run: | - python -m venv venv - source venv/bin/activate - - - name: Install dependencies - run: pip install -r requirements.txt - - # Optional: Add step to run tests here (PyTest, Django test suites, etc.) - - - name: Upload artifact for deployment jobs - uses: actions/upload-artifact@v3 - with: - name: python-app - path: | - . - !venv/ - - deploy: - permissions: - contents: none - runs-on: ubuntu-latest - needs: build - environment: - name: 'Development' - url: ${{ steps.deploy-to-webapp.outputs.webapp-url }} - - steps: - - name: Download artifact from build job - uses: actions/download-artifact@v3 - with: - name: python-app - path: . - - - name: 'Deploy to Azure Web App' - id: deploy-to-webapp - uses: azure/webapps-deploy@v2 - with: - app-name: ${{ env.AZURE_WEBAPP_NAME }} - publish-profile: ${{ secrets.AZURE_WEBAPP_PUBLISH_PROFILE }} +# This workflow will build and push a Python application to an Azure Web App when a commit is pushed to your default branch. +# +# This workflow assumes you have already created the target Azure App Service web app. +# For instructions see https://docs.microsoft.com/en-us/azure/app-service/quickstart-python?tabs=bash&pivots=python-framework-flask +# +# To configure this workflow: +# +# 1. Download the Publish Profile for your Azure Web App. You can download this file from the Overview page of your Web App in the Azure Portal. +# For more information: https://docs.microsoft.com/en-us/azure/app-service/deploy-github-actions?tabs=applevel#generate-deployment-credentials +# +# 2. Create a secret in your repository named AZURE_WEBAPP_PUBLISH_PROFILE, paste the publish profile contents as the value of the secret. +# For instructions on obtaining the publish profile see: https://docs.microsoft.com/azure/app-service/deploy-github-actions#configure-the-github-secret +# +# 3. Change the value for the AZURE_WEBAPP_NAME. Optionally, change the PYTHON_VERSION environment variables below. +# +# For more information on GitHub Actions for Azure: https://github.com/Azure/Actions +# For more information on the Azure Web Apps Deploy action: https://github.com/Azure/webapps-deploy +# For more samples to get started with GitHub Action workflows to deploy to Azure: https://github.com/Azure/actions-workflow-samples + +name: Build and deploy Python app to Azure Web App + +env: + AZURE_WEBAPP_NAME: your-app-name # set this to the name of your Azure Web App + PYTHON_VERSION: '3.8' # set this to the Python version to use + +on: + push: + branches: + - master + workflow_dispatch: + +permissions: + contents: read + +jobs: + build: + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v3 + + - name: Set up Python version + uses: actions/setup-python@v4.6.1 + with: + python-version: ${{ env.PYTHON_VERSION }} + cache: 'pip' + + - name: Create and start virtual environment + run: | + python -m venv venv + source venv/bin/activate + + - name: Install dependencies + run: pip install -r requirements.txt + + # Optional: Add step to run tests here (PyTest, Django test suites, etc.) + + - name: Upload artifact for deployment jobs + uses: actions/upload-artifact@v3 + with: + name: python-app + path: | + . + !venv/ + + deploy: + permissions: + contents: none + runs-on: ubuntu-latest + needs: build + environment: + name: 'Development' + url: ${{ steps.deploy-to-webapp.outputs.webapp-url }} + + steps: + - name: Download artifact from build job + uses: actions/download-artifact@v3 + with: + name: python-app + path: . + + - name: 'Deploy to Azure Web App' + id: deploy-to-webapp + uses: azure/webapps-deploy@v2 + with: + app-name: ${{ env.AZURE_WEBAPP_NAME }} + publish-profile: ${{ secrets.AZURE_WEBAPP_PUBLISH_PROFILE }} diff --git a/.github/workflows/azure.yml b/.github/workflows/azure.yml index f3040b7..7450411 100644 --- a/.github/workflows/azure.yml +++ b/.github/workflows/azure.yml @@ -1,50 +1,50 @@ -# This workflow will build and push a node.js application to an Azure Web App when a release is created. -# -# This workflow assumes you have already created the target Azure App Service web app. -# For instructions see https://docs.microsoft.com/azure/app-service/app-service-plan-manage#create-an-app-service-plan -# -# To configure this workflow: -# -# 1. For Linux apps, add an app setting called WEBSITE_WEBDEPLOY_USE_SCM and set it to true in your app **before downloading the file**. -# For more instructions see: https://docs.microsoft.com/azure/app-service/configure-common#configure-app-settings -# -# 2. Set up a secret in your repository named AZURE_WEBAPP_PUBLISH_PROFILE with the value of your Azure publish profile. -# For instructions on obtaining the publish profile see: https://docs.microsoft.com/azure/app-service/deploy-github-actions#configure-the-github-secret -# -# 3. Change the values for the AZURE_WEBAPP_NAME, AZURE_WEBAPP_PACKAGE_PATH and NODE_VERSION environment variables (below). -# -# For more information on GitHub Actions for Azure, refer to https://github.com/Azure/Actions -# For more samples to get started with GitHub Action workflows to deploy to Azure, refer to https://github.com/Azure/actions-workflow-samples -on: - release: - types: [created] - -env: - AZURE_WEBAPP_NAME: your-app-name # set this to your application's name - AZURE_WEBAPP_PACKAGE_PATH: '.' # set this to the path to your web app project, defaults to the repository root - NODE_VERSION: '10.x' # set this to the node version to use - -jobs: - build-and-deploy: - name: Build and Deploy - runs-on: ubuntu-latest - environment: production - steps: - - uses: actions/checkout@v3 - - name: Use Node.js ${{ env.NODE_VERSION }} - uses: actions/setup-node@v3 - with: - node-version: ${{ env.NODE_VERSION }} - - name: npm install, build, and test - run: | - # Build and test the project, then - # deploy to Azure Web App. - npm install - npm run build --if-present - npm run test --if-present - - name: 'Deploy to Azure WebApp' - uses: azure/webapps-deploy@v2 - with: - app-name: ${{ env.AZURE_WEBAPP_NAME }} - publish-profile: ${{ secrets.AZURE_WEBAPP_PUBLISH_PROFILE }} - package: ${{ env.AZURE_WEBAPP_PACKAGE_PATH }} +# This workflow will build and push a node.js application to an Azure Web App when a release is created. +# +# This workflow assumes you have already created the target Azure App Service web app. +# For instructions see https://docs.microsoft.com/azure/app-service/app-service-plan-manage#create-an-app-service-plan +# +# To configure this workflow: +# +# 1. For Linux apps, add an app setting called WEBSITE_WEBDEPLOY_USE_SCM and set it to true in your app **before downloading the file**. +# For more instructions see: https://docs.microsoft.com/azure/app-service/configure-common#configure-app-settings +# +# 2. Set up a secret in your repository named AZURE_WEBAPP_PUBLISH_PROFILE with the value of your Azure publish profile. +# For instructions on obtaining the publish profile see: https://docs.microsoft.com/azure/app-service/deploy-github-actions#configure-the-github-secret +# +# 3. Change the values for the AZURE_WEBAPP_NAME, AZURE_WEBAPP_PACKAGE_PATH and NODE_VERSION environment variables (below). +# +# For more information on GitHub Actions for Azure, refer to https://github.com/Azure/Actions +# For more samples to get started with GitHub Action workflows to deploy to Azure, refer to https://github.com/Azure/actions-workflow-samples +on: + release: + types: [created] + +env: + AZURE_WEBAPP_NAME: your-app-name # set this to your application's name + AZURE_WEBAPP_PACKAGE_PATH: '.' # set this to the path to your web app project, defaults to the repository root + NODE_VERSION: '10.x' # set this to the node version to use + +jobs: + build-and-deploy: + name: Build and Deploy + runs-on: ubuntu-latest + environment: production + steps: + - uses: actions/checkout@v3 + - name: Use Node.js ${{ env.NODE_VERSION }} + uses: actions/setup-node@v3 + with: + node-version: ${{ env.NODE_VERSION }} + - name: npm install, build, and test + run: | + # Build and test the project, then + # deploy to Azure Web App. + npm install + npm run build --if-present + npm run test --if-present + - name: 'Deploy to Azure WebApp' + uses: azure/webapps-deploy@v2 + with: + app-name: ${{ env.AZURE_WEBAPP_NAME }} + publish-profile: ${{ secrets.AZURE_WEBAPP_PUBLISH_PROFILE }} + package: ${{ env.AZURE_WEBAPP_PACKAGE_PATH }} diff --git a/.github/workflows/brakeman.yml b/.github/workflows/brakeman.yml index 207ce9c..1ef898b 100644 --- a/.github/workflows/brakeman.yml +++ b/.github/workflows/brakeman.yml @@ -1,57 +1,57 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -# This workflow integrates Brakeman with GitHub's Code Scanning feature -# Brakeman is a static analysis security vulnerability scanner for Ruby on Rails applications - -name: Brakeman Scan - -on: - push: - branches: [ master ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ master ] - schedule: - - cron: '22 16 * * 0' - -permissions: - contents: read - -jobs: - brakeman-scan: - permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - name: Brakeman Scan - runs-on: ubuntu-latest - steps: - # Checkout the repository to the GitHub Actions runner - - name: Checkout - uses: actions/checkout@v3 - - # Customize the ruby version depending on your needs - - name: Setup Ruby - uses: ruby/setup-ruby@250fcd6a742febb1123a77a841497ccaa8b9e939 - with: - ruby-version: '2.7' - - - name: Setup Brakeman - env: - BRAKEMAN_VERSION: '4.10' # SARIF support is provided in Brakeman version 4.10+ - run: | - gem install brakeman --version $BRAKEMAN_VERSION - - # Execute Brakeman CLI and generate a SARIF output with the security issues identified during the analysis - - name: Scan - continue-on-error: true - run: | - brakeman -f sarif -o output.sarif.json . - - # Upload the SARIF file generated in the previous step - - name: Upload SARIF - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: output.sarif.json +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# This workflow integrates Brakeman with GitHub's Code Scanning feature +# Brakeman is a static analysis security vulnerability scanner for Ruby on Rails applications + +name: Brakeman Scan + +on: + push: + branches: [ master ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ master ] + schedule: + - cron: '22 16 * * 0' + +permissions: + contents: read + +jobs: + brakeman-scan: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + name: Brakeman Scan + runs-on: ubuntu-latest + steps: + # Checkout the repository to the GitHub Actions runner + - name: Checkout + uses: actions/checkout@v3 + + # Customize the ruby version depending on your needs + - name: Setup Ruby + uses: ruby/setup-ruby@250fcd6a742febb1123a77a841497ccaa8b9e939 + with: + ruby-version: '2.7' + + - name: Setup Brakeman + env: + BRAKEMAN_VERSION: '4.10' # SARIF support is provided in Brakeman version 4.10+ + run: | + gem install brakeman --version $BRAKEMAN_VERSION + + # Execute Brakeman CLI and generate a SARIF output with the security issues identified during the analysis + - name: Scan + continue-on-error: true + run: | + brakeman -f sarif -o output.sarif.json . + + # Upload the SARIF file generated in the previous step + - name: Upload SARIF + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: output.sarif.json diff --git a/.github/workflows/checkmarx.yml b/.github/workflows/checkmarx.yml index 1138db3..f3e8062 100644 --- a/.github/workflows/checkmarx.yml +++ b/.github/workflows/checkmarx.yml @@ -1,54 +1,54 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -# This is a basic workflow to help you get started with Using Checkmarx CxFlow Action - -name: CxFlow - -on: - push: - branches: [ master ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ master ] - schedule: - - cron: '33 7 * * 5' - -# A workflow run is made up of one or more jobs that can run sequentially or in parallel - this job is specifically configured to use the Checkmarx CxFlow Action -permissions: - contents: read - -jobs: - # This workflow contains a single job called "build" - build: - # The type of runner that the job will run on - Ubuntu is required as Docker is leveraged for the action - permissions: - contents: read # for actions/checkout to fetch code - issues: write # for checkmarx-ts/checkmarx-cxflow-github-action to write feedback to github issues - pull-requests: write # for checkmarx-ts/checkmarx-cxflow-github-action to write feedback to PR - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - runs-on: ubuntu-latest - - # Steps require - checkout code, run CxFlow Action, Upload SARIF report (optional) - steps: - # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it - - uses: actions/checkout@v3 - # Runs the Checkmarx Scan leveraging the latest version of CxFlow - REFER to Action README for list of inputs - - name: Checkmarx CxFlow Action - uses: checkmarx-ts/checkmarx-cxflow-github-action@9c07e2adcb17d0fdf60f3184ff53720513ea3c09 - with: - project: ${{ secrets.CHECKMARX_PROJECT }} - team: ${{ secrets.CHECKMARX_TEAMS }} - checkmarx_url: ${{ secrets.CHECKMARX_URL }} - checkmarx_username: ${{ secrets.CHECKMARX_USERNAME }} - checkmarx_password: ${{ secrets.CHECKMARX_PASSWORD }} - checkmarx_client_secret: ${{ secrets.CHECKMARX_CLIENT_SECRET }} - scanners: sast - params: --namespace=${{ github.repository_owner }} --repo-name=${{ github.event.repository.name }} --branch=${{ github.ref }} --cx-flow.filterSeverity --cx-flow.filterCategory - # Upload the Report for CodeQL/Security Alerts - - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: cx.sarif +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# This is a basic workflow to help you get started with Using Checkmarx CxFlow Action + +name: CxFlow + +on: + push: + branches: [ master ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ master ] + schedule: + - cron: '33 7 * * 5' + +# A workflow run is made up of one or more jobs that can run sequentially or in parallel - this job is specifically configured to use the Checkmarx CxFlow Action +permissions: + contents: read + +jobs: + # This workflow contains a single job called "build" + build: + # The type of runner that the job will run on - Ubuntu is required as Docker is leveraged for the action + permissions: + contents: read # for actions/checkout to fetch code + issues: write # for checkmarx-ts/checkmarx-cxflow-github-action to write feedback to github issues + pull-requests: write # for checkmarx-ts/checkmarx-cxflow-github-action to write feedback to PR + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + runs-on: ubuntu-latest + + # Steps require - checkout code, run CxFlow Action, Upload SARIF report (optional) + steps: + # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it + - uses: actions/checkout@v3 + # Runs the Checkmarx Scan leveraging the latest version of CxFlow - REFER to Action README for list of inputs + - name: Checkmarx CxFlow Action + uses: checkmarx-ts/checkmarx-cxflow-github-action@9c07e2adcb17d0fdf60f3184ff53720513ea3c09 + with: + project: ${{ secrets.CHECKMARX_PROJECT }} + team: ${{ secrets.CHECKMARX_TEAMS }} + checkmarx_url: ${{ secrets.CHECKMARX_URL }} + checkmarx_username: ${{ secrets.CHECKMARX_USERNAME }} + checkmarx_password: ${{ secrets.CHECKMARX_PASSWORD }} + checkmarx_client_secret: ${{ secrets.CHECKMARX_CLIENT_SECRET }} + scanners: sast + params: --namespace=${{ github.repository_owner }} --repo-name=${{ github.event.repository.name }} --branch=${{ github.ref }} --cx-flow.filterSeverity --cx-flow.filterCategory + # Upload the Report for CodeQL/Security Alerts + - name: Upload SARIF file + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: cx.sarif diff --git a/.github/workflows/clj-holmes.yml b/.github/workflows/clj-holmes.yml index 480f215..3dc860c 100644 --- a/.github/workflows/clj-holmes.yml +++ b/.github/workflows/clj-holmes.yml @@ -1,47 +1,47 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -name: clj-holmes - -on: - push: - branches: [ master ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ master ] - schedule: - - cron: '15 13 * * 5' - -permissions: - contents: read - -jobs: - clj-holmes: - name: Run clj-holmes scanning - runs-on: ubuntu-latest - permissions: - contents: read - security-events: write - steps: - - name: Checkout code - uses: actions/checkout@v3 - - - name: Scan code - uses: clj-holmes/clj-holmes-action@53daa4da4ff495cccf791e4ba4222a8317ddae9e - with: - rules-repository: 'git://org/private-rules-repo#main' - output-type: 'sarif' - output-file: 'clj-holmes-results.sarif' - fail-on-result: 'false' - - - name: Upload analysis results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: ${{github.workspace}}/clj-holmes-results.sarif - ait-for-processing: true - - name: Upload coverage reports to Codecov - uses: codecov/codecov-action@v3 - env: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +name: clj-holmes + +on: + push: + branches: [ master ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ master ] + schedule: + - cron: '15 13 * * 5' + +permissions: + contents: read + +jobs: + clj-holmes: + name: Run clj-holmes scanning + runs-on: ubuntu-latest + permissions: + contents: read + security-events: write + steps: + - name: Checkout code + uses: actions/checkout@v3 + + - name: Scan code + uses: clj-holmes/clj-holmes-action@53daa4da4ff495cccf791e4ba4222a8317ddae9e + with: + rules-repository: 'git://org/private-rules-repo#main' + output-type: 'sarif' + output-file: 'clj-holmes-results.sarif' + fail-on-result: 'false' + + - name: Upload analysis results to GitHub Security tab + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: ${{github.workspace}}/clj-holmes-results.sarif + ait-for-processing: true + - name: Upload coverage reports to Codecov + uses: codecov/codecov-action@v3 + env: + CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} diff --git a/.github/workflows/clj-watson.yml b/.github/workflows/clj-watson.yml index 20c0564..92f9dbf 100644 --- a/.github/workflows/clj-watson.yml +++ b/.github/workflows/clj-watson.yml @@ -1,53 +1,53 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. -# clj-watson scans dependencies in a clojure deps.edn -# seeking for vulnerable direct/transitive dependencies and -# build a report with all the information needed to help you -# understand how the vulnerability manifest in your software. -# More details at https://github.com/clj-holmes/clj-watson - -name: clj-watson - -on: - push: - branches: [ master ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ master ] - schedule: - - cron: '19 10 * * 0' - -permissions: - contents: read - -jobs: - clj-holmes: - name: Run clj-watson scanning - runs-on: ubuntu-latest - permissions: - contents: read - security-events: write - steps: - - name: Checkout code - uses: actions/checkout@v3 - - - name: Dependency scan - uses: clj-holmes/clj-watson-action@b4c3623c4d603932e60e6012a3a1db7bc60058c2 - with: - clj-watson-sha: "65d928c" - clj-watson-tag: "v4.0.1" - database-strategy: github-advisory - aliases: clojure-lsp,test - deps-edn-path: deps.edn - suggest-fix: true - output-type: sarif - output-file: clj-watson-results.sarif - fail-on-result: false - - - name: Upload analysis results to GitHub - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: ${{github.workspace}}/clj-watson-results.sarif - wait-for-processing: true +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. +# clj-watson scans dependencies in a clojure deps.edn +# seeking for vulnerable direct/transitive dependencies and +# build a report with all the information needed to help you +# understand how the vulnerability manifest in your software. +# More details at https://github.com/clj-holmes/clj-watson + +name: clj-watson + +on: + push: + branches: [ master ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ master ] + schedule: + - cron: '19 10 * * 0' + +permissions: + contents: read + +jobs: + clj-holmes: + name: Run clj-watson scanning + runs-on: ubuntu-latest + permissions: + contents: read + security-events: write + steps: + - name: Checkout code + uses: actions/checkout@v3 + + - name: Dependency scan + uses: clj-holmes/clj-watson-action@b4c3623c4d603932e60e6012a3a1db7bc60058c2 + with: + clj-watson-sha: "65d928c" + clj-watson-tag: "v4.0.1" + database-strategy: github-advisory + aliases: clojure-lsp,test + deps-edn-path: deps.edn + suggest-fix: true + output-type: sarif + output-file: clj-watson-results.sarif + fail-on-result: false + + - name: Upload analysis results to GitHub + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: ${{github.workspace}}/clj-watson-results.sarif + wait-for-processing: true diff --git a/.github/workflows/codacy.yml b/.github/workflows/codacy.yml index bca5600..015cebc 100644 --- a/.github/workflows/codacy.yml +++ b/.github/workflows/codacy.yml @@ -1,60 +1,60 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -# This workflow checks out code, performs a Codacy security scan -# and integrates the results with the -# GitHub Advanced Security code scanning feature. For more information on -# the Codacy security scan action usage and parameters, see -# https://github.com/codacy/codacy-analysis-cli-action. -# For more information on Codacy Analysis CLI in general, see -# https://github.com/codacy/codacy-analysis-cli. - -name: Codacy Security Scan - -on: - push: - branches: [ master ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ master ] - schedule: - - cron: '37 2 * * 3' - -permissions: - contents: read - -jobs: - codacy-security-scan: - permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - name: Codacy Security Scan - runs-on: ubuntu-latest - steps: - # Checkout the repository to the GitHub Actions runner - - name: Checkout code - uses: actions/checkout@v3 - - # Execute Codacy Analysis CLI and generate a SARIF output with the security issues identified during the analysis - - name: Run Codacy Analysis CLI - uses: codacy/codacy-analysis-cli-action@fde117cc9d692f9e6f9221272c7b65a2f659f064 - with: - # Check https://github.com/codacy/codacy-analysis-cli#project-token to get your project token from your Codacy repository - # You can also omit the token and run the tools that support default configurations - project-token: ${{ secrets.CODACY_PROJECT_TOKEN }} - verbose: true - output: results.sarif - format: sarif - # Adjust severity of non-security issues - gh-code-scanning-compat: true - # Force 0 exit code to allow SARIF file generation - # This will handover control about PR rejection to the GitHub side - max-allowed-issues: 2147483647 - - # Upload the SARIF file generated in the previous step - - name: Upload SARIF results file - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: results.sarif +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# This workflow checks out code, performs a Codacy security scan +# and integrates the results with the +# GitHub Advanced Security code scanning feature. For more information on +# the Codacy security scan action usage and parameters, see +# https://github.com/codacy/codacy-analysis-cli-action. +# For more information on Codacy Analysis CLI in general, see +# https://github.com/codacy/codacy-analysis-cli. + +name: Codacy Security Scan + +on: + push: + branches: [ master ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ master ] + schedule: + - cron: '37 2 * * 3' + +permissions: + contents: read + +jobs: + codacy-security-scan: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + name: Codacy Security Scan + runs-on: ubuntu-latest + steps: + # Checkout the repository to the GitHub Actions runner + - name: Checkout code + uses: actions/checkout@v3 + + # Execute Codacy Analysis CLI and generate a SARIF output with the security issues identified during the analysis + - name: Run Codacy Analysis CLI + uses: codacy/codacy-analysis-cli-action@fde117cc9d692f9e6f9221272c7b65a2f659f064 + with: + # Check https://github.com/codacy/codacy-analysis-cli#project-token to get your project token from your Codacy repository + # You can also omit the token and run the tools that support default configurations + project-token: ${{ secrets.CODACY_PROJECT_TOKEN }} + verbose: true + output: results.sarif + format: sarif + # Adjust severity of non-security issues + gh-code-scanning-compat: true + # Force 0 exit code to allow SARIF file generation + # This will handover control about PR rejection to the GitHub side + max-allowed-issues: 2147483647 + + # Upload the SARIF file generated in the previous step + - name: Upload SARIF results file + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: results.sarif diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index e84ec2c..7d33837 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,76 +1,76 @@ -# For most projects, this workflow file will not need changing; you simply need -# to commit it to your repository. -# -# You may wish to alter this file to override the set of languages analyzed, -# or to provide custom queries or build logic. -# -# ******** NOTE ******** -# We have attempted to detect the languages in your repository. Please check -# the `language` matrix defined below to confirm you have the correct set of -# supported CodeQL languages. -# -name: "CodeQL" - -on: - push: - branches: [ master ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ master ] - schedule: - - cron: '31 22 * * 6' - -jobs: - analyze: - name: Analyze - runs-on: ubuntu-latest - permissions: - actions: read - contents: read - security-events: write - - strategy: - fail-fast: false - matrix: - language: [ 'javascript' ] - # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ] - # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support - - steps: - - name: Checkout repository - uses: actions/checkout@v3 - - # Initializes the CodeQL tools for scanning. - - name: Initialize CodeQL - uses: github/codeql-action/init@v2 - with: - languages: ${{ matrix.language }} - # If you wish to specify custom queries, you can do so here or in a config file. - # By default, queries listed here will override any specified in a config file. - # Prefix the list here with "+" to use these queries and those in the config file. - - # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs - # queries: security-extended,security-and-quality - - - # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). - # If this step fails, then you should remove it and run the build manually (see below) - - name: Autobuild - uses: github/codeql-action/autobuild@v2 - - # ℹ️ Command-line programs to run using the OS shell. - # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun - - # If the Autobuild fails above, remove it and uncomment the following three lines. - # modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance. - - # - run: | - # echo "Run, Build Application using script" - # ./location_of_script_within_repo/buildscript.sh - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v2 - - name: Upload coverage reports to Codecov - uses: codecov/codecov-action@v3 - env: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} +# For most projects, this workflow file will not need changing; you simply need +# to commit it to your repository. +# +# You may wish to alter this file to override the set of languages analyzed, +# or to provide custom queries or build logic. +# +# ******** NOTE ******** +# We have attempted to detect the languages in your repository. Please check +# the `language` matrix defined below to confirm you have the correct set of +# supported CodeQL languages. +# +name: "CodeQL" + +on: + push: + branches: [ master ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ master ] + schedule: + - cron: '31 22 * * 6' + +jobs: + analyze: + name: Analyze + runs-on: ubuntu-latest + permissions: + actions: read + contents: read + security-events: write + + strategy: + fail-fast: false + matrix: + language: [ 'javascript' ] + # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ] + # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support + + steps: + - name: Checkout repository + uses: actions/checkout@v3 + + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + uses: github/codeql-action/init@v2 + with: + languages: ${{ matrix.language }} + # If you wish to specify custom queries, you can do so here or in a config file. + # By default, queries listed here will override any specified in a config file. + # Prefix the list here with "+" to use these queries and those in the config file. + + # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs + # queries: security-extended,security-and-quality + + + # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). + # If this step fails, then you should remove it and run the build manually (see below) + - name: Autobuild + uses: github/codeql-action/autobuild@v2 + + # ℹ️ Command-line programs to run using the OS shell. + # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun + + # If the Autobuild fails above, remove it and uncomment the following three lines. + # modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance. + + # - run: | + # echo "Run, Build Application using script" + # ./location_of_script_within_repo/buildscript.sh + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v2 + - name: Upload coverage reports to Codecov + uses: codecov/codecov-action@v3 + env: + CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} diff --git a/.github/workflows/codescan.yml b/.github/workflows/codescan.yml index 79006ad..d52cf12 100644 --- a/.github/workflows/codescan.yml +++ b/.github/workflows/codescan.yml @@ -1,48 +1,48 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -# This workflow requires that you have an existing account with codescan.io -# For more information about configuring your workflow, -# read our documentation at https://github.com/codescan-io/codescan-scanner-action -name: CodeScan - -on: - push: - branches: [ master ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ master ] - schedule: - - cron: '22 16 * * 2' - -permissions: - contents: read - -jobs: - CodeScan: - permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - runs-on: ubuntu-latest - steps: - - name: Checkout repository - uses: actions/checkout@v3 - - name: Cache files - uses: actions/cache@v3 - with: - path: | - ~/.sonar - key: ${{ runner.os }}-sonar - restore-keys: ${{ runner.os }}-sonar - - name: Run Analysis - uses: codescan-io/codescan-scanner-action@34bb1239ae63550b540bb82f8f5de370ecb34d99 - with: - login: ${{ secrets.CODESCAN_AUTH_TOKEN }} - organization: ${{ secrets.CODESCAN_ORGANIZATION_KEY }} - projectKey: ${{ secrets.CODESCAN_PROJECT_KEY }} - - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: codescan.sarif +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# This workflow requires that you have an existing account with codescan.io +# For more information about configuring your workflow, +# read our documentation at https://github.com/codescan-io/codescan-scanner-action +name: CodeScan + +on: + push: + branches: [ master ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ master ] + schedule: + - cron: '22 16 * * 2' + +permissions: + contents: read + +jobs: + CodeScan: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + runs-on: ubuntu-latest + steps: + - name: Checkout repository + uses: actions/checkout@v3 + - name: Cache files + uses: actions/cache@v3 + with: + path: | + ~/.sonar + key: ${{ runner.os }}-sonar + restore-keys: ${{ runner.os }}-sonar + - name: Run Analysis + uses: codescan-io/codescan-scanner-action@34bb1239ae63550b540bb82f8f5de370ecb34d99 + with: + login: ${{ secrets.CODESCAN_AUTH_TOKEN }} + organization: ${{ secrets.CODESCAN_ORGANIZATION_KEY }} + projectKey: ${{ secrets.CODESCAN_PROJECT_KEY }} + - name: Upload SARIF file + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: codescan.sarif diff --git a/.github/workflows/codescaner-analysis.yml b/.github/workflows/codescaner-analysis.yml index 2804ef6..9dde7b9 100644 --- a/.github/workflows/codescaner-analysis.yml +++ b/.github/workflows/codescaner-analysis.yml @@ -1,37 +1,37 @@ -# This workflow requires that you have an existing account with codescan.io -# For more information about configuring your workflow, -# read our documentation at https://github.com/codescan-io/codescan-scanner-action -name: CodeScan - -on: - push: - branches: [ master ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ master ] - schedule: - - cron: '32 22 * * 2' - -jobs: - CodeScan: - runs-on: ubuntu-latest - steps: - - name: Checkout repository - uses: actions/checkout@v3 - - name: Cache files - uses: actions/cache@v3 - with: - path: | - ~/.sonar - key: ${{ runner.os }}-sonar - restore-keys: ${{ runner.os }}-sonar - - name: Run Analysis - uses: codescan-io/codescan-scanner-action@master - with: - login: ${{ secrets.CODESCAN_AUTH_TOKEN }} - organization: ${{ secrets.CODESCAN_ORGANIZATION_KEY }} - projectKey: ${{ secrets.CODESCAN_PROJECT_KEY }} - - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: codescan.sarif +# This workflow requires that you have an existing account with codescan.io +# For more information about configuring your workflow, +# read our documentation at https://github.com/codescan-io/codescan-scanner-action +name: CodeScan + +on: + push: + branches: [ master ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ master ] + schedule: + - cron: '32 22 * * 2' + +jobs: + CodeScan: + runs-on: ubuntu-latest + steps: + - name: Checkout repository + uses: actions/checkout@v3 + - name: Cache files + uses: actions/cache@v3 + with: + path: | + ~/.sonar + key: ${{ runner.os }}-sonar + restore-keys: ${{ runner.os }}-sonar + - name: Run Analysis + uses: codescan-io/codescan-scanner-action@master + with: + login: ${{ secrets.CODESCAN_AUTH_TOKEN }} + organization: ${{ secrets.CODESCAN_ORGANIZATION_KEY }} + projectKey: ${{ secrets.CODESCAN_PROJECT_KEY }} + - name: Upload SARIF file + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: codescan.sarif diff --git a/.github/workflows/crunch42.yml b/.github/workflows/crunch42.yml index 14ed122..f387276 100644 --- a/.github/workflows/crunch42.yml +++ b/.github/workflows/crunch42.yml @@ -1,59 +1,59 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -# This workflow locates REST API file contracts -# (Swagger or OpenAPI format, v2 and v3, JSON and YAML) -# and runs 200+ security checks on them using 42Crunch Security Audit technology. -# -# Documentation is located here: https://docs.42crunch.com/latest/content/tasks/integrate_github_actions.htm -# -# To use this workflow, you will need to complete the following setup steps. -# -# 1. Create a free 42Crunch account at https://platform.42crunch.com/register -# -# 2. Follow steps at https://docs.42crunch.com/latest/content/tasks/integrate_github_actions.htm -# to create an API Token on the 42Crunch platform -# -# 3. Add a secret in GitHub as explained in https://docs.42crunch.com/latest/content/tasks/integrate_github_actions.htm, -# store the 42Crunch API Token in that secret, and supply the secret's name as api-token parameter in this workflow -# -# If you have any questions or need help contact https://support.42crunch.com - -name: "42Crunch REST API Static Security Testing" - -# follow standard Code Scanning triggers -on: - push: - branches: [ master ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ master ] - schedule: - - cron: '35 17 * * 6' - -permissions: - contents: read - -jobs: - rest-api-static-security-testing: - permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for 42Crunch/api-security-audit-action to upload results to Github Code Scanning - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v3 - - - name: 42Crunch REST API Static Security Testing - uses: 42Crunch/api-security-audit-action@ae75e3c3693658c6bfab6e1d4650185c402fd6f9 - with: - # Please create free account at https://platform.42crunch.com/register - # Follow these steps to configure API_TOKEN https://docs.42crunch.com/latest/content/tasks/integrate_github_actions.htm - api-token: ${{ secrets.API_TOKEN }} - # Fail if any OpenAPI file scores lower than 75 - min-score: 75 - # Upload results to Github code scanning - upload-to-code-scanning: true - # Github token for uploading the results - github-token: ${{ github.token }} +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# This workflow locates REST API file contracts +# (Swagger or OpenAPI format, v2 and v3, JSON and YAML) +# and runs 200+ security checks on them using 42Crunch Security Audit technology. +# +# Documentation is located here: https://docs.42crunch.com/latest/content/tasks/integrate_github_actions.htm +# +# To use this workflow, you will need to complete the following setup steps. +# +# 1. Create a free 42Crunch account at https://platform.42crunch.com/register +# +# 2. Follow steps at https://docs.42crunch.com/latest/content/tasks/integrate_github_actions.htm +# to create an API Token on the 42Crunch platform +# +# 3. Add a secret in GitHub as explained in https://docs.42crunch.com/latest/content/tasks/integrate_github_actions.htm, +# store the 42Crunch API Token in that secret, and supply the secret's name as api-token parameter in this workflow +# +# If you have any questions or need help contact https://support.42crunch.com + +name: "42Crunch REST API Static Security Testing" + +# follow standard Code Scanning triggers +on: + push: + branches: [ master ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ master ] + schedule: + - cron: '35 17 * * 6' + +permissions: + contents: read + +jobs: + rest-api-static-security-testing: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for 42Crunch/api-security-audit-action to upload results to Github Code Scanning + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v3 + + - name: 42Crunch REST API Static Security Testing + uses: 42Crunch/api-security-audit-action@ae75e3c3693658c6bfab6e1d4650185c402fd6f9 + with: + # Please create free account at https://platform.42crunch.com/register + # Follow these steps to configure API_TOKEN https://docs.42crunch.com/latest/content/tasks/integrate_github_actions.htm + api-token: ${{ secrets.API_TOKEN }} + # Fail if any OpenAPI file scores lower than 75 + min-score: 75 + # Upload results to Github code scanning + upload-to-code-scanning: true + # Github token for uploading the results + github-token: ${{ github.token }} diff --git a/.github/workflows/datadog-synthetics.yml b/.github/workflows/datadog-synthetics.yml index e9a0926..3d52f49 100644 --- a/.github/workflows/datadog-synthetics.yml +++ b/.github/workflows/datadog-synthetics.yml @@ -1,38 +1,38 @@ -# This workflow will trigger Datadog Synthetic tests within your Datadog organisation -# For more information on running Synthetic tests within your GitHub workflows see: https://docs.datadoghq.com/synthetics/cicd_integrations/github_actions/ - -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -# To get started: - -# 1. Add your Datadog API (DD_API_KEY) and Application Key (DD_APP_KEY) as secrets to your GitHub repository. For more information, see: https://docs.datadoghq.com/account_management/api-app-keys/. -# 2. Start using the action within your workflow - -name: Run Datadog Synthetic tests - -on: - push: - branches: [ master ] - pull_request: - branches: [ master ] - -jobs: - build: - runs-on: ubuntu-latest - - steps: - - uses: actions/checkout@v3 - - # Run Synthetic tests within your GitHub workflow. - # For additional configuration options visit the action within the marketplace: https://github.com/marketplace/actions/datadog-synthetics-ci - - name: Run Datadog Synthetic tests - uses: DataDog/synthetics-ci-github-action@a3ae3be10856e996d9f1f7bd188c4a449c7746c9 - with: - api_key: ${{secrets.DD_API_KEY}} - app_key: ${{secrets.DD_APP_KEY}} - test_search_query: 'tag:e2e-tests' #Modify this tag to suit your tagging strategy - - +# This workflow will trigger Datadog Synthetic tests within your Datadog organisation +# For more information on running Synthetic tests within your GitHub workflows see: https://docs.datadoghq.com/synthetics/cicd_integrations/github_actions/ + +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# To get started: + +# 1. Add your Datadog API (DD_API_KEY) and Application Key (DD_APP_KEY) as secrets to your GitHub repository. For more information, see: https://docs.datadoghq.com/account_management/api-app-keys/. +# 2. Start using the action within your workflow + +name: Run Datadog Synthetic tests + +on: + push: + branches: [ master ] + pull_request: + branches: [ master ] + +jobs: + build: + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v3 + + # Run Synthetic tests within your GitHub workflow. + # For additional configuration options visit the action within the marketplace: https://github.com/marketplace/actions/datadog-synthetics-ci + - name: Run Datadog Synthetic tests + uses: DataDog/synthetics-ci-github-action@a3ae3be10856e996d9f1f7bd188c4a449c7746c9 + with: + api_key: ${{secrets.DD_API_KEY}} + app_key: ${{secrets.DD_APP_KEY}} + test_search_query: 'tag:e2e-tests' #Modify this tag to suit your tagging strategy + + diff --git a/.github/workflows/deno.yml b/.github/workflows/deno.yml index 52f65c4..c6c1d9c 100644 --- a/.github/workflows/deno.yml +++ b/.github/workflows/deno.yml @@ -1,39 +1,39 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -# This workflow will install Deno and run tests across stable and nightly builds on Windows, Ubuntu and macOS. -# For more information see: https://github.com/denolib/setup-deno - -name: Deno - -on: - push: - branches: [master] - pull_request: - branches: [master] - -jobs: - test: - runs-on: ${{ matrix.os }} # runs a test on Ubuntu, Windows and macOS - - strategy: - matrix: - deno: ["v1.x", "nightly"] - os: [macOS-latest, windows-latest, ubuntu-latest] - - steps: - - name: Setup repo - uses: actions/checkout@v3 - - - name: Setup Deno - uses: denolib/setup-deno@3c5f954c869f1b0d106e129797480905587250f5 - with: - deno-version: ${{ matrix.deno }} # tests across multiple Deno versions - - - name: Cache Dependencies - run: deno cache deps.ts - - - name: Run Tests - run: deno test -A --unstable +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# This workflow will install Deno and run tests across stable and nightly builds on Windows, Ubuntu and macOS. +# For more information see: https://github.com/denolib/setup-deno + +name: Deno + +on: + push: + branches: [master] + pull_request: + branches: [master] + +jobs: + test: + runs-on: ${{ matrix.os }} # runs a test on Ubuntu, Windows and macOS + + strategy: + matrix: + deno: ["v1.x", "nightly"] + os: [macOS-latest, windows-latest, ubuntu-latest] + + steps: + - name: Setup repo + uses: actions/checkout@v3 + + - name: Setup Deno + uses: denolib/setup-deno@3c5f954c869f1b0d106e129797480905587250f5 + with: + deno-version: ${{ matrix.deno }} # tests across multiple Deno versions + + - name: Cache Dependencies + run: deno cache deps.ts + + - name: Run Tests + run: deno test -A --unstable diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 7258766..fab0e4d 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -1,24 +1,24 @@ -# Dependency Review Action -# -# This Action will scan dependency manifest files that change as part of a Pull Request, surfacing known-vulnerable versions of the packages declared or updated in the PR. Once installed, if the workflow run is marked as required, PRs introducing known-vulnerable packages will be blocked from merging. -# -# Source repository: https://github.com/actions/dependency-review-action -# Public documentation: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#dependency-review-enforcement -name: 'Dependency Review' -on: [pull_request] - -permissions: - contents: read - -jobs: - dependency-review: - runs-on: ubuntu-latest - steps: - - name: 'Checkout Repository' - uses: actions/checkout@v3 - - name: 'Dependency Review' - uses: actions/dependency-review-action@v3 - - name: Upload coverage reports to Codecov - uses: codecov/codecov-action@v3 - env: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} +# Dependency Review Action +# +# This Action will scan dependency manifest files that change as part of a Pull Request, surfacing known-vulnerable versions of the packages declared or updated in the PR. Once installed, if the workflow run is marked as required, PRs introducing known-vulnerable packages will be blocked from merging. +# +# Source repository: https://github.com/actions/dependency-review-action +# Public documentation: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#dependency-review-enforcement +name: 'Dependency Review' +on: [pull_request] + +permissions: + contents: read + +jobs: + dependency-review: + runs-on: ubuntu-latest + steps: + - name: 'Checkout Repository' + uses: actions/checkout@v3 + - name: 'Dependency Review' + uses: actions/dependency-review-action@v3 + - name: Upload coverage reports to Codecov + uses: codecov/codecov-action@v3 + env: + CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} diff --git a/.github/workflows/detekt.yml b/.github/workflows/detekt.yml index d42c42c..0c22dbc 100644 --- a/.github/workflows/detekt.yml +++ b/.github/workflows/detekt.yml @@ -1,118 +1,118 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -# This workflow performs a static analysis of your Kotlin source code using -# Detekt. -# -# Scans are triggered: -# 1. On every push to default and protected branches -# 2. On every Pull Request targeting the default branch -# 3. On a weekly schedule -# 4. Manually, on demand, via the "workflow_dispatch" event -# -# The workflow should work with no modifications, but you might like to use a -# later version of the Detekt CLI by modifing the $DETEKT_RELEASE_TAG -# environment variable. -name: Scan with Detekt - -on: - # Triggers the workflow on push or pull request events but only for default and protected branches - push: - branches: [ master ] - pull_request: - branches: [ master ] - schedule: - - cron: '45 19 * * 6' - - # Allows you to run this workflow manually from the Actions tab - workflow_dispatch: - -env: - # Release tag associated with version of Detekt to be installed - # SARIF support (required for this workflow) was introduced in Detekt v1.15.0 - DETEKT_RELEASE_TAG: v1.15.0 - -# A workflow run is made up of one or more jobs that can run sequentially or in parallel -jobs: - # This workflow contains a single job called "scan" - scan: - name: Scan - # The type of runner that the job will run on - runs-on: ubuntu-latest - - # Steps represent a sequence of tasks that will be executed as part of the job - steps: - # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it - - uses: actions/checkout@v3 - - # Gets the download URL associated with the $DETEKT_RELEASE_TAG - - name: Get Detekt download URL - id: detekt_info - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: | - gh api graphql --field tagName=$DETEKT_RELEASE_TAG --raw-field query=' - query getReleaseAssetDownloadUrl($tagName: String!) { - repository(name: "detekt", owner: "detekt") { - release(tagName: $tagName) { - releaseAssets(name: "detekt", first: 1) { - nodes { - downloadUrl - } - } - tagCommit { - oid - } - } - } - } - ' 1> gh_response.json - - DETEKT_RELEASE_SHA=$(jq --raw-output '.data.repository.release.releaseAssets.tagCommit.oid' gh_response.json) - if [ $DETEKT_RELEASE_SHA != "37f0a1d006977512f1f216506cd695039607c3e5" ]; then - echo "Release tag doesn't match expected commit SHA" - exit 1 - fi - - DETEKT_DOWNLOAD_URL=$(jq --raw-output '.data.repository.release.releaseAssets.nodes[0].downloadUrl' gh_response.json) - echo "::set-output name=download_url::$DETEKT_DOWNLOAD_URL" - - # Sets up the detekt cli - - name: Setup Detekt - run: | - dest=$( mktemp -d ) - curl --request GET \ - --url ${{ steps.detekt_info.outputs.download_url }} \ - --silent \ - --location \ - --output $dest/detekt - chmod a+x $dest/detekt - echo $dest >> $GITHUB_PATH - - # Performs static analysis using Detekt - - name: Run Detekt - continue-on-error: true - run: | - detekt --input ${{ github.workspace }} --report sarif:${{ github.workspace }}/detekt.sarif.json - - # Modifies the SARIF output produced by Detekt so that absolute URIs are relative - # This is so we can easily map results onto their source files - # This can be removed once relative URI support lands in Detekt: https://git.io/JLBbA - - name: Make artifact location URIs relative - continue-on-error: true - run: | - echo "$( - jq \ - --arg github_workspace ${{ github.workspace }} \ - '. | ( .runs[].results[].locations[].physicalLocation.artifactLocation.uri |= if test($github_workspace) then .[($github_workspace | length | . + 1):] else . end )' \ - ${{ github.workspace }}/detekt.sarif.json - )" > ${{ github.workspace }}/detekt.sarif.json - - # Uploads results to GitHub repository using the upload-sarif action - - uses: github/codeql-action/upload-sarif@v2 - with: - # Path to SARIF file relative to the root of the repository - sarif_file: ${{ github.workspace }}/detekt.sarif.json - checkout_path: ${{ github.workspace }} +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# This workflow performs a static analysis of your Kotlin source code using +# Detekt. +# +# Scans are triggered: +# 1. On every push to default and protected branches +# 2. On every Pull Request targeting the default branch +# 3. On a weekly schedule +# 4. Manually, on demand, via the "workflow_dispatch" event +# +# The workflow should work with no modifications, but you might like to use a +# later version of the Detekt CLI by modifing the $DETEKT_RELEASE_TAG +# environment variable. +name: Scan with Detekt + +on: + # Triggers the workflow on push or pull request events but only for default and protected branches + push: + branches: [ master ] + pull_request: + branches: [ master ] + schedule: + - cron: '45 19 * * 6' + + # Allows you to run this workflow manually from the Actions tab + workflow_dispatch: + +env: + # Release tag associated with version of Detekt to be installed + # SARIF support (required for this workflow) was introduced in Detekt v1.15.0 + DETEKT_RELEASE_TAG: v1.15.0 + +# A workflow run is made up of one or more jobs that can run sequentially or in parallel +jobs: + # This workflow contains a single job called "scan" + scan: + name: Scan + # The type of runner that the job will run on + runs-on: ubuntu-latest + + # Steps represent a sequence of tasks that will be executed as part of the job + steps: + # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it + - uses: actions/checkout@v3 + + # Gets the download URL associated with the $DETEKT_RELEASE_TAG + - name: Get Detekt download URL + id: detekt_info + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + gh api graphql --field tagName=$DETEKT_RELEASE_TAG --raw-field query=' + query getReleaseAssetDownloadUrl($tagName: String!) { + repository(name: "detekt", owner: "detekt") { + release(tagName: $tagName) { + releaseAssets(name: "detekt", first: 1) { + nodes { + downloadUrl + } + } + tagCommit { + oid + } + } + } + } + ' 1> gh_response.json + + DETEKT_RELEASE_SHA=$(jq --raw-output '.data.repository.release.releaseAssets.tagCommit.oid' gh_response.json) + if [ $DETEKT_RELEASE_SHA != "37f0a1d006977512f1f216506cd695039607c3e5" ]; then + echo "Release tag doesn't match expected commit SHA" + exit 1 + fi + + DETEKT_DOWNLOAD_URL=$(jq --raw-output '.data.repository.release.releaseAssets.nodes[0].downloadUrl' gh_response.json) + echo "::set-output name=download_url::$DETEKT_DOWNLOAD_URL" + + # Sets up the detekt cli + - name: Setup Detekt + run: | + dest=$( mktemp -d ) + curl --request GET \ + --url ${{ steps.detekt_info.outputs.download_url }} \ + --silent \ + --location \ + --output $dest/detekt + chmod a+x $dest/detekt + echo $dest >> $GITHUB_PATH + + # Performs static analysis using Detekt + - name: Run Detekt + continue-on-error: true + run: | + detekt --input ${{ github.workspace }} --report sarif:${{ github.workspace }}/detekt.sarif.json + + # Modifies the SARIF output produced by Detekt so that absolute URIs are relative + # This is so we can easily map results onto their source files + # This can be removed once relative URI support lands in Detekt: https://git.io/JLBbA + - name: Make artifact location URIs relative + continue-on-error: true + run: | + echo "$( + jq \ + --arg github_workspace ${{ github.workspace }} \ + '. | ( .runs[].results[].locations[].physicalLocation.artifactLocation.uri |= if test($github_workspace) then .[($github_workspace | length | . + 1):] else . end )' \ + ${{ github.workspace }}/detekt.sarif.json + )" > ${{ github.workspace }}/detekt.sarif.json + + # Uploads results to GitHub repository using the upload-sarif action + - uses: github/codeql-action/upload-sarif@v2 + with: + # Path to SARIF file relative to the root of the repository + sarif_file: ${{ github.workspace }}/detekt.sarif.json + checkout_path: ${{ github.workspace }} diff --git a/.github/workflows/devskim.yml b/.github/workflows/devskim.yml index 417f182..ebe3c96 100644 --- a/.github/workflows/devskim.yml +++ b/.github/workflows/devskim.yml @@ -1,38 +1,38 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -name: DevSkim - -on: - push: - branches: [ master ] - pull_request: - branches: [ master ] - schedule: - - cron: '22 0 * * 6' - -jobs: - lint: - name: DevSkim - runs-on: ubuntu-20.04 - permissions: - actions: read - contents: read - security-events: write - steps: - - name: Checkout code - uses: actions/checkout@v3 - - - name: Run DevSkim scanner - uses: microsoft/DevSkim-Action@v1 - - - name: Upload DevSkim scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: devskim-results.sarif - - name: Upload coverage reports to Codecov - uses: codecov/codecov-action@v3 - env: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +name: DevSkim + +on: + push: + branches: [ master ] + pull_request: + branches: [ master ] + schedule: + - cron: '22 0 * * 6' + +jobs: + lint: + name: DevSkim + runs-on: ubuntu-20.04 + permissions: + actions: read + contents: read + security-events: write + steps: + - name: Checkout code + uses: actions/checkout@v3 + + - name: Run DevSkim scanner + uses: microsoft/DevSkim-Action@v1 + + - name: Upload DevSkim scan results to GitHub Security tab + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: devskim-results.sarif + - name: Upload coverage reports to Codecov + uses: codecov/codecov-action@v3 + env: + CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml index 85da952..73ac519 100644 --- a/.github/workflows/docker-image.yml +++ b/.github/workflows/docker-image.yml @@ -1,18 +1,18 @@ -name: Docker Image CI - -on: - push: - branches: [ master ] - pull_request: - branches: [ master ] - -jobs: - - build: - - runs-on: ubuntu-latest - - steps: - - uses: actions/checkout@v3 - - name: Build the Docker image - run: docker build . --file Dockerfile --tag my-image-name:$(date +%s) +name: Docker Image CI + +on: + push: + branches: [ master ] + pull_request: + branches: [ master ] + +jobs: + + build: + + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v3 + - name: Build the Docker image + run: docker build . --file Dockerfile --tag my-image-name:$(date +%s) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index e780c5e..9a83aae 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -1,93 +1,93 @@ -name: Docker - -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -on: - schedule: - - cron: '35 6 * * *' - push: - branches: [ master ] - # Publish semver tags as releases. - tags: [ 'v*.*.*' ] - pull_request: - branches: [ master ] - -env: - # Use docker.io for Docker Hub if empty - REGISTRY: ghcr.io - # github.repository as / - IMAGE_NAME: ${{ github.repository }} - - -jobs: - build: - - runs-on: ubuntu-latest - permissions: - contents: read - packages: write - # This is used to complete the identity challenge - # with sigstore/fulcio when running outside of PRs. - id-token: write - - steps: - - name: Checkout repository - uses: actions/checkout@v3 - - # Install the cosign tool except on PR - # https://github.com/sigstore/cosign-installer - - name: Install cosign - if: github.event_name != 'pull_request' - uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 - with: - cosign-release: 'v1.7.1' - - - # Workaround: https://github.com/docker/build-push-action/issues/461 - - name: Setup Docker buildx - uses: docker/setup-buildx-action@16c0bc4a6e6ada2cfd8afd41d22d95379cf7c32a - - # Login against a Docker registry except on PR - # https://github.com/docker/login-action - - name: Log into registry ${{ env.REGISTRY }} - if: github.event_name != 'pull_request' - uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc - with: - registry: ${{ env.REGISTRY }} - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - # Extract metadata (tags, labels) for Docker - # https://github.com/docker/metadata-action - - name: Extract Docker metadata - id: meta - uses: docker/metadata-action@ef25336f420be2d1a49205baf41a9b88712a65a1 - with: - images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - - # Build and push Docker image with Buildx (don't push on PR) - # https://github.com/docker/build-push-action - - name: Build and push Docker image - id: build-and-push - uses: docker/build-push-action@68d0dc20df34f84bca5214ce60a32e2d589dbaf2 - with: - context: . - push: ${{ github.event_name != 'pull_request' }} - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} - - # Sign the resulting Docker image digest except on PRs. - # This will only write to the public Rekor transparency log when the Docker - # repository is public to avoid leaking data. If you would like to publish - # transparency data even for private images, pass --force to cosign below. - # https://github.com/sigstore/cosign - - name: Sign the published Docker image - if: ${{ github.event_name != 'pull_request' }} - env: - COSIGN_EXPERIMENTAL: "true" - # This step uses the identity token to provision an ephemeral certificate - # against the sigstore community Fulcio instance. - run: cosign sign ${{ steps.meta.outputs.tags }}@${{ steps.build-and-push.outputs.digest }} +name: Docker + +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +on: + schedule: + - cron: '35 6 * * *' + push: + branches: [ master ] + # Publish semver tags as releases. + tags: [ 'v*.*.*' ] + pull_request: + branches: [ master ] + +env: + # Use docker.io for Docker Hub if empty + REGISTRY: ghcr.io + # github.repository as / + IMAGE_NAME: ${{ github.repository }} + + +jobs: + build: + + runs-on: ubuntu-latest + permissions: + contents: read + packages: write + # This is used to complete the identity challenge + # with sigstore/fulcio when running outside of PRs. + id-token: write + + steps: + - name: Checkout repository + uses: actions/checkout@v3 + + # Install the cosign tool except on PR + # https://github.com/sigstore/cosign-installer + - name: Install cosign + if: github.event_name != 'pull_request' + uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 + with: + cosign-release: 'v1.7.1' + + + # Workaround: https://github.com/docker/build-push-action/issues/461 + - name: Setup Docker buildx + uses: docker/setup-buildx-action@16c0bc4a6e6ada2cfd8afd41d22d95379cf7c32a + + # Login against a Docker registry except on PR + # https://github.com/docker/login-action + - name: Log into registry ${{ env.REGISTRY }} + if: github.event_name != 'pull_request' + uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc + with: + registry: ${{ env.REGISTRY }} + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + # Extract metadata (tags, labels) for Docker + # https://github.com/docker/metadata-action + - name: Extract Docker metadata + id: meta + uses: docker/metadata-action@ef25336f420be2d1a49205baf41a9b88712a65a1 + with: + images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} + + # Build and push Docker image with Buildx (don't push on PR) + # https://github.com/docker/build-push-action + - name: Build and push Docker image + id: build-and-push + uses: docker/build-push-action@68d0dc20df34f84bca5214ce60a32e2d589dbaf2 + with: + context: . + push: ${{ github.event_name != 'pull_request' }} + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + + # Sign the resulting Docker image digest except on PRs. + # This will only write to the public Rekor transparency log when the Docker + # repository is public to avoid leaking data. If you would like to publish + # transparency data even for private images, pass --force to cosign below. + # https://github.com/sigstore/cosign + - name: Sign the published Docker image + if: ${{ github.event_name != 'pull_request' }} + env: + COSIGN_EXPERIMENTAL: "true" + # This step uses the identity token to provision an ephemeral certificate + # against the sigstore community Fulcio instance. + run: cosign sign ${{ steps.meta.outputs.tags }}@${{ steps.build-and-push.outputs.digest }} diff --git a/.github/workflows/eslint.yml b/.github/workflows/eslint.yml index 22b9c5d..77708b4 100644 --- a/.github/workflows/eslint.yml +++ b/.github/workflows/eslint.yml @@ -1,49 +1,49 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. -# ESLint is a tool for identifying and reporting on patterns -# found in ECMAScript/JavaScript code. -# More details at https://github.com/eslint/eslint -# and https://eslint.org - -name: ESLint - -on: - push: - branches: [ master ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ master ] - schedule: - - cron: '30 7 * * 0' - -jobs: - eslint: - name: Run eslint scanning - runs-on: ubuntu-latest - permissions: - contents: read - security-events: write - steps: - - name: Checkout code - uses: actions/checkout@v3 - - - name: Install ESLint - run: | - npm install eslint@8.10.0 - npm install @microsoft/eslint-formatter-sarif@2.1.7 - - - name: Run ESLint - run: npx eslint . - --config .eslintrc.js - --ext .js,.jsx,.ts,.tsx - --format @microsoft/eslint-formatter-sarif - --output-file eslint-results.sarif - continue-on-error: true - - - name: Upload analysis results to GitHub - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: eslint-results.sarif - wait-for-processing: true +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. +# ESLint is a tool for identifying and reporting on patterns +# found in ECMAScript/JavaScript code. +# More details at https://github.com/eslint/eslint +# and https://eslint.org + +name: ESLint + +on: + push: + branches: [ master ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ master ] + schedule: + - cron: '30 7 * * 0' + +jobs: + eslint: + name: Run eslint scanning + runs-on: ubuntu-latest + permissions: + contents: read + security-events: write + steps: + - name: Checkout code + uses: actions/checkout@v3 + + - name: Install ESLint + run: | + npm install eslint@8.10.0 + npm install @microsoft/eslint-formatter-sarif@2.1.7 + + - name: Run ESLint + run: npx eslint . + --config .eslintrc.js + --ext .js,.jsx,.ts,.tsx + --format @microsoft/eslint-formatter-sarif + --output-file eslint-results.sarif + continue-on-error: true + + - name: Upload analysis results to GitHub + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: eslint-results.sarif + wait-for-processing: true diff --git a/.github/workflows/fortify.yml b/.github/workflows/fortify.yml index b399e52..f0edc7d 100644 --- a/.github/workflows/fortify.yml +++ b/.github/workflows/fortify.yml @@ -1,98 +1,98 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -################################################################################################################################################ -# Fortify lets you build secure software fast with an appsec platform that automates testing throughout the DevSecOps pipeline. Fortify static,# -# dynamic, interactive, and runtime security testing is available on premises or as a service. To learn more about Fortify, start a free trial # -# or contact our sales team, visit microfocus.com/appsecurity. # -# # -# Use this workflow template as a basis for integrating Fortify on Demand Static Application Security Testing(SAST) into your GitHub workflows.# -# This template demonstrates the steps to prepare the code+dependencies, initiate a scan, download results once complete and import into # -# GitHub Security Code Scanning Alerts. Existing customers should review inputs and environment variables below to configure scanning against # -# an existing application in your Fortify on Demand tenant. Additional information is available in the comments throughout the workflow, the # -# documentation for the Fortify actions used, and the Fortify on Demand / ScanCentral Client product documentation. If you need additional # -# assistance with configuration, feel free to create a help ticket in the Fortify on Demand portal. # -################################################################################################################################################ - -name: Fortify on Demand Scan - -# TODO: Customize trigger events based on your DevSecOps processes and typical FoD SAST scan time -on: - workflow_dispatch: - push: - branches: [ master ] - schedule: - - cron: '40 3 * * 1' - -jobs: - FoD-SAST-Scan: - # Use the appropriate runner for building your source code. - # TODO: Use a Windows runner for .NET projects that use msbuild. Additional changes to RUN commands will be required to switch to Windows syntax. - runs-on: ubuntu-latest - permissions: - actions: read - contents: read - security-events: write - - steps: - # Check out source code - - name: Check Out Source Code - uses: actions/checkout@v3 - - # Java is required to run the various Fortify utilities. - # When scanning a Java application, please use the appropriate Java version for building your application. - - name: Setup Java - uses: actions/setup-java@v3 - with: - java-version: 8 - distribution: 'temurin' - - # Prepare source+dependencies for upload. The default example is for a Maven project that uses pom.xml. - # TODO: Update PACKAGE_OPTS based on the ScanCentral Client documentation for your project's included tech stack(s). Helpful hints: - # ScanCentral Client will download dependencies for maven (-bt mvn) and gradle (-bt gradle). - # ScanCentral Client can download dependencies for msbuild projects (-bt msbuild); however, you must convert the workflow to use a Windows runner. - # ScanCentral has additional options that should be set for PHP and Python projects - # For other build tools, add your build commands to download necessary dependencies and prepare according to Fortify on Demand Packaging documentation. - # ScanCentral Client documentation is located at https://www.microfocus.com/documentation/fortify-software-security-center/ - - name: Download Fortify ScanCentral Client - uses: fortify/gha-setup-scancentral-client@0dd7fb438a6ec17131fd0552b4c105f49c1ab351 - - name: Package Code + Dependencies - run: scancentral package $PACKAGE_OPTS -o package.zip - env: - PACKAGE_OPTS: "-bt mvn" - - # Start Fortify on Demand SAST scan and wait until results complete. For more information on FoDUploader commands, see https://github.com/fod-dev/fod-uploader-java - # TODO: Update ENV variables for your application and create the necessary GitHub Secrets. Helpful hints: - # Credentials and release ID should be obtained from your FoD tenant (either Personal Access Token or API Key can be used). - # Automated Audit preference should be configured for the release's Static Scan Settings in the Fortify on Demand portal. - - name: Download Fortify on Demand Universal CI Tool - uses: fortify/gha-setup-fod-uploader@16e5036c084b26cee63cb0c38cfc2101cc9fd13d - - name: Perform SAST Scan - run: java -jar $FOD_UPLOAD_JAR -z package.zip -aurl $FOD_API_URL -purl $FOD_URL -rid "$FOD_RELEASE_ID" -tc "$FOD_TENANT" -uc "$FOD_USER" "$FOD_PAT" $FOD_UPLOADER_OPTS -n "$FOD_UPLOADER_NOTES" - env: - FOD_URL: "https://ams.fortify.com/" - FOD_API_URL: "https://api.ams.fortify.com/" - FOD_TENANT: ${{ secrets.FOD_TENANT }} - FOD_USER: ${{ secrets.FOD_USER }} - FOD_PAT: ${{ secrets.FOD_PAT }} - FOD_RELEASE_ID: ${{ secrets.FOD_RELEASE_ID }} - FOD_UPLOADER_OPTS: "-ep 2 -pp 0 -I 1 -apf" - FOD_UPLOADER_NOTES: 'Triggered by GitHub Actions (${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})' - - # Once scan completes, pull SAST issues from Fortify on Demand and generate SARIF output. - - name: Export results to GitHub-optimized SARIF - uses: fortify/gha-export-vulnerabilities@710c062be6afe6c5afc15adff75184760fb70493 - with: - fod_base_url: "https://ams.fortify.com/" - fod_tenant: ${{ secrets.FOD_TENANT }} - fod_user: ${{ secrets.FOD_USER }} - fod_password: ${{ secrets.FOD_PAT }} - fod_release_id: ${{ secrets.FOD_RELEASE_ID }} - - # Import Fortify on Demand results to GitHub Security Code Scanning - - name: Import Results - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: ./gh-fortify-sast.sarif +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +################################################################################################################################################ +# Fortify lets you build secure software fast with an appsec platform that automates testing throughout the DevSecOps pipeline. Fortify static,# +# dynamic, interactive, and runtime security testing is available on premises or as a service. To learn more about Fortify, start a free trial # +# or contact our sales team, visit microfocus.com/appsecurity. # +# # +# Use this workflow template as a basis for integrating Fortify on Demand Static Application Security Testing(SAST) into your GitHub workflows.# +# This template demonstrates the steps to prepare the code+dependencies, initiate a scan, download results once complete and import into # +# GitHub Security Code Scanning Alerts. Existing customers should review inputs and environment variables below to configure scanning against # +# an existing application in your Fortify on Demand tenant. Additional information is available in the comments throughout the workflow, the # +# documentation for the Fortify actions used, and the Fortify on Demand / ScanCentral Client product documentation. If you need additional # +# assistance with configuration, feel free to create a help ticket in the Fortify on Demand portal. # +################################################################################################################################################ + +name: Fortify on Demand Scan + +# TODO: Customize trigger events based on your DevSecOps processes and typical FoD SAST scan time +on: + workflow_dispatch: + push: + branches: [ master ] + schedule: + - cron: '40 3 * * 1' + +jobs: + FoD-SAST-Scan: + # Use the appropriate runner for building your source code. + # TODO: Use a Windows runner for .NET projects that use msbuild. Additional changes to RUN commands will be required to switch to Windows syntax. + runs-on: ubuntu-latest + permissions: + actions: read + contents: read + security-events: write + + steps: + # Check out source code + - name: Check Out Source Code + uses: actions/checkout@v3 + + # Java is required to run the various Fortify utilities. + # When scanning a Java application, please use the appropriate Java version for building your application. + - name: Setup Java + uses: actions/setup-java@v3 + with: + java-version: 8 + distribution: 'temurin' + + # Prepare source+dependencies for upload. The default example is for a Maven project that uses pom.xml. + # TODO: Update PACKAGE_OPTS based on the ScanCentral Client documentation for your project's included tech stack(s). Helpful hints: + # ScanCentral Client will download dependencies for maven (-bt mvn) and gradle (-bt gradle). + # ScanCentral Client can download dependencies for msbuild projects (-bt msbuild); however, you must convert the workflow to use a Windows runner. + # ScanCentral has additional options that should be set for PHP and Python projects + # For other build tools, add your build commands to download necessary dependencies and prepare according to Fortify on Demand Packaging documentation. + # ScanCentral Client documentation is located at https://www.microfocus.com/documentation/fortify-software-security-center/ + - name: Download Fortify ScanCentral Client + uses: fortify/gha-setup-scancentral-client@0dd7fb438a6ec17131fd0552b4c105f49c1ab351 + - name: Package Code + Dependencies + run: scancentral package $PACKAGE_OPTS -o package.zip + env: + PACKAGE_OPTS: "-bt mvn" + + # Start Fortify on Demand SAST scan and wait until results complete. For more information on FoDUploader commands, see https://github.com/fod-dev/fod-uploader-java + # TODO: Update ENV variables for your application and create the necessary GitHub Secrets. Helpful hints: + # Credentials and release ID should be obtained from your FoD tenant (either Personal Access Token or API Key can be used). + # Automated Audit preference should be configured for the release's Static Scan Settings in the Fortify on Demand portal. + - name: Download Fortify on Demand Universal CI Tool + uses: fortify/gha-setup-fod-uploader@16e5036c084b26cee63cb0c38cfc2101cc9fd13d + - name: Perform SAST Scan + run: java -jar $FOD_UPLOAD_JAR -z package.zip -aurl $FOD_API_URL -purl $FOD_URL -rid "$FOD_RELEASE_ID" -tc "$FOD_TENANT" -uc "$FOD_USER" "$FOD_PAT" $FOD_UPLOADER_OPTS -n "$FOD_UPLOADER_NOTES" + env: + FOD_URL: "https://ams.fortify.com/" + FOD_API_URL: "https://api.ams.fortify.com/" + FOD_TENANT: ${{ secrets.FOD_TENANT }} + FOD_USER: ${{ secrets.FOD_USER }} + FOD_PAT: ${{ secrets.FOD_PAT }} + FOD_RELEASE_ID: ${{ secrets.FOD_RELEASE_ID }} + FOD_UPLOADER_OPTS: "-ep 2 -pp 0 -I 1 -apf" + FOD_UPLOADER_NOTES: 'Triggered by GitHub Actions (${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})' + + # Once scan completes, pull SAST issues from Fortify on Demand and generate SARIF output. + - name: Export results to GitHub-optimized SARIF + uses: fortify/gha-export-vulnerabilities@710c062be6afe6c5afc15adff75184760fb70493 + with: + fod_base_url: "https://ams.fortify.com/" + fod_tenant: ${{ secrets.FOD_TENANT }} + fod_user: ${{ secrets.FOD_USER }} + fod_password: ${{ secrets.FOD_PAT }} + fod_release_id: ${{ secrets.FOD_RELEASE_ID }} + + # Import Fortify on Demand results to GitHub Security Code Scanning + - name: Import Results + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: ./gh-fortify-sast.sarif diff --git a/.github/workflows/google-cloudrun-docker.yml b/.github/workflows/google-cloudrun-docker.yml index 77eb0f6..d206113 100644 --- a/.github/workflows/google-cloudrun-docker.yml +++ b/.github/workflows/google-cloudrun-docker.yml @@ -1,114 +1,114 @@ -# This workflow build and push a Docker container to Google Artifact Registry and deploy it on Cloud Run when a commit is pushed to the master branch -# -# Overview: -# -# 1. Authenticate to Google Cloud -# 2. Authenticate Docker to Artifact Registry -# 3. Build a docker container -# 4. Publish it to Google Artifact Registry -# 5. Deploy it to Cloud Run -# -# To configure this workflow: -# -# 1. Ensure the required Google Cloud APIs are enabled: -# -# Cloud Run run.googleapis.com -# Artifact Registry artifactregistry.googleapis.com -# -# 2. Create and configure Workload Identity Federation for GitHub (https://github.com/google-github-actions/auth#setting-up-workload-identity-federation) -# -# 3. Ensure the required IAM permissions are granted -# -# Cloud Run -# roles/run.admin -# roles/iam.serviceAccountUser (to act as the Cloud Run runtime service account) -# -# Artifact Registry -# roles/artifactregistry.admin (project or repository level) -# -# NOTE: You should always follow the principle of least privilege when assigning IAM roles -# -# 4. Create GitHub secrets for WIF_PROVIDER and WIF_SERVICE_ACCOUNT -# -# 5. Change the values for the GAR_LOCATION, SERVICE and REGION environment variables (below). -# -# NOTE: To use Google Container Registry instead, replace ${{ env.GAR_LOCATION }}-docker.pkg.dev with gcr.io -# -# For more support on how to run this workflow, please visit https://github.com/marketplace/actions/deploy-to-cloud-run -# -# Further reading: -# Cloud Run IAM permissions - https://cloud.google.com/run/docs/deploying -# Artifact Registry IAM permissions - https://cloud.google.com/artifact-registry/docs/access-control#roles -# Container Registry vs Artifact Registry - https://cloud.google.com/blog/products/application-development/understanding-artifact-registry-vs-container-registry -# Principle of least privilege - https://cloud.google.com/blog/products/identity-security/dont-get-pwned-practicing-the-principle-of-least-privilege - -name: Build and Deploy to Cloud Run - -on: - push: - branches: - - master - -env: - PROJECT_ID: YOUR_PROJECT_ID # TODO: update Google Cloud project id - GAR_LOCATION: YOUR_GAR_LOCATION # TODO: update Artifact Registry location - SERVICE: YOUR_SERVICE_NAME # TODO: update Cloud Run service name - REGION: YOUR_SERVICE_REGION # TODO: update Cloud Run service region - -jobs: - deploy: - # Add 'id-token' with the intended permissions for workload identity federation - permissions: - contents: 'read' - id-token: 'write' - - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v3 - - - name: Google Auth - id: auth - uses: 'google-github-actions/auth@v1' - with: - token_format: 'access_token' - workload_identity_provider: '${{ secrets.WIF_PROVIDER }}' # e.g. - projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider - service_account: '${{ secrets.WIF_SERVICE_ACCOUNT }}' # e.g. - my-service-account@my-project.iam.gserviceaccount.com - - # NOTE: Alternative option - authentication via credentials json - # - name: Google Auth - # id: auth - # uses: 'google-github-actions/auth@v0' - # with: - # credentials_json: '${{ secrets.GCP_CREDENTIALS }}'' - - # BEGIN - Docker auth and build (NOTE: If you already have a container image, these Docker steps can be omitted) - - # Authenticate Docker to Google Cloud Artifact Registry - - name: Docker Auth - id: docker-auth - uses: 'docker/login-action@v2' - with: - username: 'oauth2accesstoken' - password: '${{ steps.auth.outputs.access_token }}' - registry: '${{ env.GAR_LOCATION }}-docker.pkg.dev' - - - name: Build and Push Container - run: |- - docker build -t "${{ env.GAR_LOCATION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.SERVICE }}:${{ github.sha }}" ./ - docker push "${{ env.GAR_LOCATION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.SERVICE }}:${{ github.sha }}" - - # END - Docker auth and build - - - name: Deploy to Cloud Run - id: deploy - uses: google-github-actions/deploy-cloudrun@v1 - with: - service: ${{ env.SERVICE }} - region: ${{ env.REGION }} - # NOTE: If using a pre-built image, update the image name here - image: ${{ env.GAR_LOCATION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.SERVICE }}:${{ github.sha }} - - # If required, use the Cloud Run url output in later steps - - name: Show Output - run: echo ${{ steps.deploy.outputs.url }} +# This workflow build and push a Docker container to Google Artifact Registry and deploy it on Cloud Run when a commit is pushed to the master branch +# +# Overview: +# +# 1. Authenticate to Google Cloud +# 2. Authenticate Docker to Artifact Registry +# 3. Build a docker container +# 4. Publish it to Google Artifact Registry +# 5. Deploy it to Cloud Run +# +# To configure this workflow: +# +# 1. Ensure the required Google Cloud APIs are enabled: +# +# Cloud Run run.googleapis.com +# Artifact Registry artifactregistry.googleapis.com +# +# 2. Create and configure Workload Identity Federation for GitHub (https://github.com/google-github-actions/auth#setting-up-workload-identity-federation) +# +# 3. Ensure the required IAM permissions are granted +# +# Cloud Run +# roles/run.admin +# roles/iam.serviceAccountUser (to act as the Cloud Run runtime service account) +# +# Artifact Registry +# roles/artifactregistry.admin (project or repository level) +# +# NOTE: You should always follow the principle of least privilege when assigning IAM roles +# +# 4. Create GitHub secrets for WIF_PROVIDER and WIF_SERVICE_ACCOUNT +# +# 5. Change the values for the GAR_LOCATION, SERVICE and REGION environment variables (below). +# +# NOTE: To use Google Container Registry instead, replace ${{ env.GAR_LOCATION }}-docker.pkg.dev with gcr.io +# +# For more support on how to run this workflow, please visit https://github.com/marketplace/actions/deploy-to-cloud-run +# +# Further reading: +# Cloud Run IAM permissions - https://cloud.google.com/run/docs/deploying +# Artifact Registry IAM permissions - https://cloud.google.com/artifact-registry/docs/access-control#roles +# Container Registry vs Artifact Registry - https://cloud.google.com/blog/products/application-development/understanding-artifact-registry-vs-container-registry +# Principle of least privilege - https://cloud.google.com/blog/products/identity-security/dont-get-pwned-practicing-the-principle-of-least-privilege + +name: Build and Deploy to Cloud Run + +on: + push: + branches: + - master + +env: + PROJECT_ID: YOUR_PROJECT_ID # TODO: update Google Cloud project id + GAR_LOCATION: YOUR_GAR_LOCATION # TODO: update Artifact Registry location + SERVICE: YOUR_SERVICE_NAME # TODO: update Cloud Run service name + REGION: YOUR_SERVICE_REGION # TODO: update Cloud Run service region + +jobs: + deploy: + # Add 'id-token' with the intended permissions for workload identity federation + permissions: + contents: 'read' + id-token: 'write' + + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v3 + + - name: Google Auth + id: auth + uses: 'google-github-actions/auth@v1' + with: + token_format: 'access_token' + workload_identity_provider: '${{ secrets.WIF_PROVIDER }}' # e.g. - projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider + service_account: '${{ secrets.WIF_SERVICE_ACCOUNT }}' # e.g. - my-service-account@my-project.iam.gserviceaccount.com + + # NOTE: Alternative option - authentication via credentials json + # - name: Google Auth + # id: auth + # uses: 'google-github-actions/auth@v0' + # with: + # credentials_json: '${{ secrets.GCP_CREDENTIALS }}'' + + # BEGIN - Docker auth and build (NOTE: If you already have a container image, these Docker steps can be omitted) + + # Authenticate Docker to Google Cloud Artifact Registry + - name: Docker Auth + id: docker-auth + uses: 'docker/login-action@v2' + with: + username: 'oauth2accesstoken' + password: '${{ steps.auth.outputs.access_token }}' + registry: '${{ env.GAR_LOCATION }}-docker.pkg.dev' + + - name: Build and Push Container + run: |- + docker build -t "${{ env.GAR_LOCATION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.SERVICE }}:${{ github.sha }}" ./ + docker push "${{ env.GAR_LOCATION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.SERVICE }}:${{ github.sha }}" + + # END - Docker auth and build + + - name: Deploy to Cloud Run + id: deploy + uses: google-github-actions/deploy-cloudrun@v1 + with: + service: ${{ env.SERVICE }} + region: ${{ env.REGION }} + # NOTE: If using a pre-built image, update the image name here + image: ${{ env.GAR_LOCATION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.SERVICE }}:${{ github.sha }} + + # If required, use the Cloud Run url output in later steps + - name: Show Output + run: echo ${{ steps.deploy.outputs.url }} diff --git a/.github/workflows/google-cloudrun-source.yml b/.github/workflows/google-cloudrun-source.yml index 14a9da3..f15f342 100644 --- a/.github/workflows/google-cloudrun-source.yml +++ b/.github/workflows/google-cloudrun-source.yml @@ -1,96 +1,96 @@ -# This workflow will deploy source code on Cloud Run when a commit is pushed to the master branch -# -# Overview: -# -# 1. Authenticate to Google Cloud -# 2. Deploy it to Cloud Run -# -# To configure this workflow: -# -# 1. Ensure the required Google Cloud APIs are enabled: -# -# Cloud Run run.googleapis.com -# Cloud Build cloudbuild.googleapis.com -# Artifact Registry artifactregistry.googleapis.com -# -# 2. Create and configure Workload Identity Federation for GitHub (https://github.com/google-github-actions/auth#setting-up-workload-identity-federation) -# -# 3. Ensure the required IAM permissions are granted -# -# Cloud Run -# roles/run.admin -# roles/iam.serviceAccountUser (to act as the Cloud Run runtime service account) -# -# Cloud Build -# roles/cloudbuild.builds.editor -# -# Cloud Storage -# roles/storage.objectAdmin -# -# Artifact Registry -# roles/artifactregistry.admin (project or repository level) -# -# NOTE: You should always follow the principle of least privilege when assigning IAM roles -# -# 4. Create GitHub secrets for WIF_PROVIDER and WIF_SERVICE_ACCOUNT -# -# 5. Change the values for the SERVICE and REGION environment variables (below). -# -# For more support on how to run this workflow, please visit https://github.com/marketplace/actions/deploy-to-cloud-run -# -# Further reading: -# Cloud Run runtime service account - https://cloud.google.com/run/docs/securing/service-identity -# Cloud Run IAM permissions - https://cloud.google.com/run/docs/deploying-source-code#permissions_required_to_deploy -# Cloud Run builds from source - https://cloud.google.com/run/docs/deploying-source-code -# Principle of least privilege - https://cloud.google.com/blog/products/identity-security/dont-get-pwned-practicing-the-principle-of-least-privilege - -name: Deploy to Cloud Run from Source - -on: - push: - branches: - - master - -env: - PROJECT_ID: YOUR_PROJECT_ID # TODO: update Google Cloud project id - SERVICE: YOUR_SERVICE_NAME # TODO: update Cloud Run service name - REGION: YOUR_SERVICE_REGION # TODO: update Cloud Run service region - -jobs: - deploy: - # Add 'id-token' with the intended permissions for workload identity federation - permissions: - contents: 'read' - id-token: 'write' - - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v3 - - - name: Google Auth - id: auth - uses: 'google-github-actions/auth@v1' - with: - workload_identity_provider: '${{ secrets.WIF_PROVIDER }}' # e.g. - projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider - service_account: '${{ secrets.WIF_SERVICE_ACCOUNT }}' # e.g. - my-service-account@my-project.iam.gserviceaccount.com - - # NOTE: Alternative option - authentication via credentials json - # - name: Google Auth - # id: auth - # uses: 'google-github-actions/auth@v0' - # with: - # credentials_json: '${{ secrets.GCP_CREDENTIALS }}' - - - name: Deploy to Cloud Run - id: deploy - uses: google-github-actions/deploy-cloudrun@v1 - with: - service: ${{ env.SERVICE }} - region: ${{ env.REGION }} - # NOTE: If required, update to the appropriate source folder - source: ./ - - # If required, use the Cloud Run url output in later steps - - name: Show Output - run: echo ${{ steps.deploy.outputs.url }} +# This workflow will deploy source code on Cloud Run when a commit is pushed to the master branch +# +# Overview: +# +# 1. Authenticate to Google Cloud +# 2. Deploy it to Cloud Run +# +# To configure this workflow: +# +# 1. Ensure the required Google Cloud APIs are enabled: +# +# Cloud Run run.googleapis.com +# Cloud Build cloudbuild.googleapis.com +# Artifact Registry artifactregistry.googleapis.com +# +# 2. Create and configure Workload Identity Federation for GitHub (https://github.com/google-github-actions/auth#setting-up-workload-identity-federation) +# +# 3. Ensure the required IAM permissions are granted +# +# Cloud Run +# roles/run.admin +# roles/iam.serviceAccountUser (to act as the Cloud Run runtime service account) +# +# Cloud Build +# roles/cloudbuild.builds.editor +# +# Cloud Storage +# roles/storage.objectAdmin +# +# Artifact Registry +# roles/artifactregistry.admin (project or repository level) +# +# NOTE: You should always follow the principle of least privilege when assigning IAM roles +# +# 4. Create GitHub secrets for WIF_PROVIDER and WIF_SERVICE_ACCOUNT +# +# 5. Change the values for the SERVICE and REGION environment variables (below). +# +# For more support on how to run this workflow, please visit https://github.com/marketplace/actions/deploy-to-cloud-run +# +# Further reading: +# Cloud Run runtime service account - https://cloud.google.com/run/docs/securing/service-identity +# Cloud Run IAM permissions - https://cloud.google.com/run/docs/deploying-source-code#permissions_required_to_deploy +# Cloud Run builds from source - https://cloud.google.com/run/docs/deploying-source-code +# Principle of least privilege - https://cloud.google.com/blog/products/identity-security/dont-get-pwned-practicing-the-principle-of-least-privilege + +name: Deploy to Cloud Run from Source + +on: + push: + branches: + - master + +env: + PROJECT_ID: YOUR_PROJECT_ID # TODO: update Google Cloud project id + SERVICE: YOUR_SERVICE_NAME # TODO: update Cloud Run service name + REGION: YOUR_SERVICE_REGION # TODO: update Cloud Run service region + +jobs: + deploy: + # Add 'id-token' with the intended permissions for workload identity federation + permissions: + contents: 'read' + id-token: 'write' + + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v3 + + - name: Google Auth + id: auth + uses: 'google-github-actions/auth@v1' + with: + workload_identity_provider: '${{ secrets.WIF_PROVIDER }}' # e.g. - projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider + service_account: '${{ secrets.WIF_SERVICE_ACCOUNT }}' # e.g. - my-service-account@my-project.iam.gserviceaccount.com + + # NOTE: Alternative option - authentication via credentials json + # - name: Google Auth + # id: auth + # uses: 'google-github-actions/auth@v0' + # with: + # credentials_json: '${{ secrets.GCP_CREDENTIALS }}' + + - name: Deploy to Cloud Run + id: deploy + uses: google-github-actions/deploy-cloudrun@v1 + with: + service: ${{ env.SERVICE }} + region: ${{ env.REGION }} + # NOTE: If required, update to the appropriate source folder + source: ./ + + # If required, use the Cloud Run url output in later steps + - name: Show Output + run: echo ${{ steps.deploy.outputs.url }} diff --git a/.github/workflows/google.yml b/.github/workflows/google.yml index b81718f..c4699d2 100644 --- a/.github/workflows/google.yml +++ b/.github/workflows/google.yml @@ -1,80 +1,80 @@ -# This workflow will build a docker container, publish it to Google Container Registry, and deploy it to GKE when a release is created -# -# To configure this workflow: -# -# 1. Ensure that your repository contains the necessary configuration for your Google Kubernetes Engine cluster, including deployment.yml, kustomization.yml, service.yml, etc. -# -# 2. Set up secrets in your workspace: GKE_PROJECT with the name of the project and GKE_SA_KEY with the Base64 encoded JSON service account key (https://github.com/GoogleCloudPlatform/github-actions/tree/docs/service-account-key/setup-gcloud#inputs). -# -# 3. Change the values for the GKE_ZONE, GKE_CLUSTER, IMAGE, and DEPLOYMENT_NAME environment variables (below). -# -# For more support on how to run the workflow, please visit https://github.com/google-github-actions/setup-gcloud/tree/master/example-workflows/gke - -name: Build and Deploy to GKE - -on: - release: - types: [created] - -env: - PROJECT_ID: ${{ secrets.GKE_PROJECT }} - GKE_CLUSTER: cluster-1 # TODO: update to cluster name - GKE_ZONE: us-central1-c # TODO: update to cluster zone - DEPLOYMENT_NAME: gke-test # TODO: update to deployment name - IMAGE: static-site - -jobs: - setup-build-publish-deploy: - name: Setup, Build, Publish, and Deploy - runs-on: ubuntu-latest - environment: production - - steps: - - name: Checkout - uses: actions/checkout@v3 - - # Setup gcloud CLI - - uses: google-github-actions/setup-gcloud@v1.1.1 - with: - service_account_key: ${{ secrets.GKE_SA_KEY }} - project_id: ${{ secrets.GKE_PROJECT }} - - # Configure Docker to use the gcloud command-line tool as a credential - # helper for authentication - - run: |- - gcloud --quiet auth configure-docker - - # Get the GKE credentials so we can deploy to the cluster - - uses: google-github-actions/get-gke-credentials@v1.0.2 - with: - cluster_name: ${{ env.GKE_CLUSTER }} - location: ${{ env.GKE_ZONE }} - credentials: ${{ secrets.GKE_SA_KEY }} - - # Build the Docker image - - name: Build - run: |- - docker build \ - --tag "gcr.io/$PROJECT_ID/$IMAGE:$GITHUB_SHA" \ - --build-arg GITHUB_SHA="$GITHUB_SHA" \ - --build-arg GITHUB_REF="$GITHUB_REF" \ - . - - # Push the Docker image to Google Container Registry - - name: Publish - run: |- - docker push "gcr.io/$PROJECT_ID/$IMAGE:$GITHUB_SHA" - - # Set up kustomize - - name: Set up Kustomize - run: |- - curl -sfLo kustomize https://github.com/kubernetes-sigs/kustomize/releases/download/v3.1.0/kustomize_3.1.0_linux_amd64 - chmod u+x ./kustomize - - # Deploy the Docker image to the GKE cluster - - name: Deploy - run: |- - ./kustomize edit set image gcr.io/PROJECT_ID/IMAGE:TAG=gcr.io/$PROJECT_ID/$IMAGE:$GITHUB_SHA - ./kustomize build . | kubectl apply -f - - kubectl rollout status deployment/$DEPLOYMENT_NAME - kubectl get services -o wide +# This workflow will build a docker container, publish it to Google Container Registry, and deploy it to GKE when a release is created +# +# To configure this workflow: +# +# 1. Ensure that your repository contains the necessary configuration for your Google Kubernetes Engine cluster, including deployment.yml, kustomization.yml, service.yml, etc. +# +# 2. Set up secrets in your workspace: GKE_PROJECT with the name of the project and GKE_SA_KEY with the Base64 encoded JSON service account key (https://github.com/GoogleCloudPlatform/github-actions/tree/docs/service-account-key/setup-gcloud#inputs). +# +# 3. Change the values for the GKE_ZONE, GKE_CLUSTER, IMAGE, and DEPLOYMENT_NAME environment variables (below). +# +# For more support on how to run the workflow, please visit https://github.com/google-github-actions/setup-gcloud/tree/master/example-workflows/gke + +name: Build and Deploy to GKE + +on: + release: + types: [created] + +env: + PROJECT_ID: ${{ secrets.GKE_PROJECT }} + GKE_CLUSTER: cluster-1 # TODO: update to cluster name + GKE_ZONE: us-central1-c # TODO: update to cluster zone + DEPLOYMENT_NAME: gke-test # TODO: update to deployment name + IMAGE: static-site + +jobs: + setup-build-publish-deploy: + name: Setup, Build, Publish, and Deploy + runs-on: ubuntu-latest + environment: production + + steps: + - name: Checkout + uses: actions/checkout@v3 + + # Setup gcloud CLI + - uses: google-github-actions/setup-gcloud@v1.1.1 + with: + service_account_key: ${{ secrets.GKE_SA_KEY }} + project_id: ${{ secrets.GKE_PROJECT }} + + # Configure Docker to use the gcloud command-line tool as a credential + # helper for authentication + - run: |- + gcloud --quiet auth configure-docker + + # Get the GKE credentials so we can deploy to the cluster + - uses: google-github-actions/get-gke-credentials@v1.0.2 + with: + cluster_name: ${{ env.GKE_CLUSTER }} + location: ${{ env.GKE_ZONE }} + credentials: ${{ secrets.GKE_SA_KEY }} + + # Build the Docker image + - name: Build + run: |- + docker build \ + --tag "gcr.io/$PROJECT_ID/$IMAGE:$GITHUB_SHA" \ + --build-arg GITHUB_SHA="$GITHUB_SHA" \ + --build-arg GITHUB_REF="$GITHUB_REF" \ + . + + # Push the Docker image to Google Container Registry + - name: Publish + run: |- + docker push "gcr.io/$PROJECT_ID/$IMAGE:$GITHUB_SHA" + + # Set up kustomize + - name: Set up Kustomize + run: |- + curl -sfLo kustomize https://github.com/kubernetes-sigs/kustomize/releases/download/v3.1.0/kustomize_3.1.0_linux_amd64 + chmod u+x ./kustomize + + # Deploy the Docker image to the GKE cluster + - name: Deploy + run: |- + ./kustomize edit set image gcr.io/PROJECT_ID/IMAGE:TAG=gcr.io/$PROJECT_ID/$IMAGE:$GITHUB_SHA + ./kustomize build . | kubectl apply -f - + kubectl rollout status deployment/$DEPLOYMENT_NAME + kubectl get services -o wide diff --git a/.github/workflows/googleXs.yml b/.github/workflows/googleXs.yml index 590d25e..8809327 100644 --- a/.github/workflows/googleXs.yml +++ b/.github/workflows/googleXs.yml @@ -1,84 +1,84 @@ -# This workflow will build a docker container, publish it to Google Container Registry, and deploy it to GKE when a release is created -# -# To configure this workflow: -# -# 1. Ensure that your repository contains the necessary configuration for your Google Kubernetes Engine cluster, including deployment.yml, kustomization.yml, service.yml, etc. -# -# 2. Set up secrets in your workspace: GKE_PROJECT with the name of the project and GKE_SA_KEY with the Base64 encoded JSON service account key (https://github.com/GoogleCloudPlatform/github-actions/tree/docs/service-account-key/setup-gcloud#inputs). -# -# 3. Change the values for the GKE_ZONE, GKE_CLUSTER, IMAGE, and DEPLOYMENT_NAME environment variables (below). -# -# For more support on how to run the workflow, please visit https://github.com/google-github-actions/setup-gcloud/tree/master/example-workflows/gke - -name: Build and Deploy to GKE - -on: - release: - types: [created] - -env: - PROJECT_ID: ${{ secrets.GKE_PROJECT }} - GKE_CLUSTER: cluster-1 # TODO: update to cluster name - GKE_ZONE: us-central1-c # TODO: update to cluster zone - DEPLOYMENT_NAME: gke-test # TODO: update to deployment name - IMAGE: static-site - -jobs: - setup-build-publish-deploy: - name: Setup, Build, Publish, and Deploy - runs-on: ubuntu-latest - environment: production - - steps: - - name: Checkout - uses: actions/checkout@v3 - - # Setup gcloud CLI - - uses: google-github-actions/setup-gcloud@v1.1.1 - with: - service_account_key: ${{ secrets.GKE_SA_KEY }} - project_id: ${{ secrets.GKE_PROJECT }} - - # Configure Docker to use the gcloud command-line tool as a credential - # helper for authentication - - run: |- - gcloud --quiet auth configure-docker - - - name: DefenseCode ThunderScan Action - uses: defensecode/thunderscan-action@v1.0 - - - # Get the GKE credentials so we can deploy to the cluster - - uses: google-github-actions/get-gke-credentials@v1.0.2 - with: - cluster_name: ${{ env.GKE_CLUSTER }} - location: ${{ env.GKE_ZONE }} - credentials: ${{ secrets.GKE_SA_KEY }} - - # Build the Docker image - - name: Build - run: |- - docker build \ - --tag "gcr.io/$PROJECT_ID/$IMAGE:$GITHUB_SHA" \ - --build-arg GITHUB_SHA="$GITHUB_SHA" \ - --build-arg GITHUB_REF="$GITHUB_REF" \ - . - - # Push the Docker image to Google Container Registry - - name: Publish - run: |- - docker push "gcr.io/$PROJECT_ID/$IMAGE:$GITHUB_SHA" - - # Set up kustomize - - name: Set up Kustomize - run: |- - curl -sfLo kustomize https://github.com/kubernetes-sigs/kustomize/releases/download/v3.1.0/kustomize_3.1.0_linux_amd64 - chmod u+x ./kustomize - - # Deploy the Docker image to the GKE cluster - - name: Deploy - run: |- - ./kustomize edit set image gcr.io/PROJECT_ID/IMAGE:TAG=gcr.io/$PROJECT_ID/$IMAGE:$GITHUB_SHA - ./kustomize build . | kubectl apply -f - - kubectl rollout status deployment/$DEPLOYMENT_NAME - kubectl get services -o wide +# This workflow will build a docker container, publish it to Google Container Registry, and deploy it to GKE when a release is created +# +# To configure this workflow: +# +# 1. Ensure that your repository contains the necessary configuration for your Google Kubernetes Engine cluster, including deployment.yml, kustomization.yml, service.yml, etc. +# +# 2. Set up secrets in your workspace: GKE_PROJECT with the name of the project and GKE_SA_KEY with the Base64 encoded JSON service account key (https://github.com/GoogleCloudPlatform/github-actions/tree/docs/service-account-key/setup-gcloud#inputs). +# +# 3. Change the values for the GKE_ZONE, GKE_CLUSTER, IMAGE, and DEPLOYMENT_NAME environment variables (below). +# +# For more support on how to run the workflow, please visit https://github.com/google-github-actions/setup-gcloud/tree/master/example-workflows/gke + +name: Build and Deploy to GKE + +on: + release: + types: [created] + +env: + PROJECT_ID: ${{ secrets.GKE_PROJECT }} + GKE_CLUSTER: cluster-1 # TODO: update to cluster name + GKE_ZONE: us-central1-c # TODO: update to cluster zone + DEPLOYMENT_NAME: gke-test # TODO: update to deployment name + IMAGE: static-site + +jobs: + setup-build-publish-deploy: + name: Setup, Build, Publish, and Deploy + runs-on: ubuntu-latest + environment: production + + steps: + - name: Checkout + uses: actions/checkout@v3 + + # Setup gcloud CLI + - uses: google-github-actions/setup-gcloud@v1.1.1 + with: + service_account_key: ${{ secrets.GKE_SA_KEY }} + project_id: ${{ secrets.GKE_PROJECT }} + + # Configure Docker to use the gcloud command-line tool as a credential + # helper for authentication + - run: |- + gcloud --quiet auth configure-docker + + - name: DefenseCode ThunderScan Action + uses: defensecode/thunderscan-action@v1.0 + + + # Get the GKE credentials so we can deploy to the cluster + - uses: google-github-actions/get-gke-credentials@v1.0.2 + with: + cluster_name: ${{ env.GKE_CLUSTER }} + location: ${{ env.GKE_ZONE }} + credentials: ${{ secrets.GKE_SA_KEY }} + + # Build the Docker image + - name: Build + run: |- + docker build \ + --tag "gcr.io/$PROJECT_ID/$IMAGE:$GITHUB_SHA" \ + --build-arg GITHUB_SHA="$GITHUB_SHA" \ + --build-arg GITHUB_REF="$GITHUB_REF" \ + . + + # Push the Docker image to Google Container Registry + - name: Publish + run: |- + docker push "gcr.io/$PROJECT_ID/$IMAGE:$GITHUB_SHA" + + # Set up kustomize + - name: Set up Kustomize + run: |- + curl -sfLo kustomize https://github.com/kubernetes-sigs/kustomize/releases/download/v3.1.0/kustomize_3.1.0_linux_amd64 + chmod u+x ./kustomize + + # Deploy the Docker image to the GKE cluster + - name: Deploy + run: |- + ./kustomize edit set image gcr.io/PROJECT_ID/IMAGE:TAG=gcr.io/$PROJECT_ID/$IMAGE:$GITHUB_SHA + ./kustomize build . | kubectl apply -f - + kubectl rollout status deployment/$DEPLOYMENT_NAME + kubectl get services -o wide diff --git a/.github/workflows/hadolint.yml b/.github/workflows/hadolint.yml index cca782c..b5375f0 100644 --- a/.github/workflows/hadolint.yml +++ b/.github/workflows/hadolint.yml @@ -1,47 +1,47 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. -# hadoint is a Dockerfile linter written in Haskell -# that helps you build best practice Docker images. -# More details at https://github.com/hadolint/hadolint - -name: Hadolint - -on: - push: - branches: [ master ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ master ] - schedule: - - cron: '20 13 * * 4' - -permissions: - contents: read - -jobs: - hadolint: - name: Run hadolint scanning - runs-on: ubuntu-latest - permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - - steps: - - name: Checkout code - uses: actions/checkout@v3 - - - name: Run hadolint - uses: hadolint/hadolint-action@d292784f8f3eacda47060b259a580467b0ba410c - with: - dockerfile: ./Dockerfile - format: sarif - output-file: hadolint-results.sarif - no-fail: true - - - name: Upload analysis results to GitHub - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: hadolint-results.sarif - wait-for-processing: true +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. +# hadoint is a Dockerfile linter written in Haskell +# that helps you build best practice Docker images. +# More details at https://github.com/hadolint/hadolint + +name: Hadolint + +on: + push: + branches: [ master ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ master ] + schedule: + - cron: '20 13 * * 4' + +permissions: + contents: read + +jobs: + hadolint: + name: Run hadolint scanning + runs-on: ubuntu-latest + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + + steps: + - name: Checkout code + uses: actions/checkout@v3 + + - name: Run hadolint + uses: hadolint/hadolint-action@d292784f8f3eacda47060b259a580467b0ba410c + with: + dockerfile: ./Dockerfile + format: sarif + output-file: hadolint-results.sarif + no-fail: true + + - name: Upload analysis results to GitHub + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: hadolint-results.sarif + wait-for-processing: true diff --git a/.github/workflows/ibm.yml b/.github/workflows/ibm.yml index 45d4c25..b51fdea 100644 --- a/.github/workflows/ibm.yml +++ b/.github/workflows/ibm.yml @@ -1,76 +1,76 @@ -# This workflow will build a docker container, publish it to IBM Container Registry, and deploy it to IKS when there is a push to the master branch. -# -# To configure this workflow: -# -# 1. Ensure that your repository contains a Dockerfile -# 2. Setup secrets in your repository by going to settings: Create ICR_NAMESPACE and IBM_CLOUD_API_KEY -# 3. Change the values for the IBM_CLOUD_REGION, REGISTRY_HOSTNAME, IMAGE_NAME, IKS_CLUSTER, DEPLOYMENT_NAME, and PORT - -name: Build and Deploy to IKS - -on: - push: - branches: - - master - -# Environment variables available to all jobs and steps in this workflow -env: - GITHUB_SHA: ${{ github.sha }} - IBM_CLOUD_API_KEY: ${{ secrets.IBM_CLOUD_API_KEY }} - IBM_CLOUD_REGION: us-south - ICR_NAMESPACE: ${{ secrets.ICR_NAMESPACE }} - REGISTRY_HOSTNAME: us.icr.io - IMAGE_NAME: iks-test - IKS_CLUSTER: example-iks-cluster-name-or-id - DEPLOYMENT_NAME: iks-test - PORT: 5001 - -jobs: - setup-build-publish-deploy: - name: Setup, Build, Publish, and Deploy - runs-on: ubuntu-latest - environment: production - steps: - - - name: Checkout - uses: actions/checkout@v3 - - # Download and Install IBM Cloud CLI - - name: Install IBM Cloud CLI - run: | - curl -fsSL https://clis.cloud.ibm.com/install/linux | sh - ibmcloud --version - ibmcloud config --check-version=false - ibmcloud plugin install -f kubernetes-service - ibmcloud plugin install -f container-registry - - # Authenticate with IBM Cloud CLI - - name: Authenticate with IBM Cloud CLI - run: | - ibmcloud login --apikey "${IBM_CLOUD_API_KEY}" -r "${IBM_CLOUD_REGION}" -g default - ibmcloud cr region-set "${IBM_CLOUD_REGION}" - ibmcloud cr login - - # Build the Docker image - - name: Build with Docker - run: | - docker build -t "$REGISTRY_HOSTNAME"/"$ICR_NAMESPACE"/"$IMAGE_NAME":"$GITHUB_SHA" \ - --build-arg GITHUB_SHA="$GITHUB_SHA" \ - --build-arg GITHUB_REF="$GITHUB_REF" . - - # Push the image to IBM Container Registry - - name: Push the image to ICR - run: | - docker push $REGISTRY_HOSTNAME/$ICR_NAMESPACE/$IMAGE_NAME:$GITHUB_SHA - - # Deploy the Docker image to the IKS cluster - - name: Deploy to IKS - run: | - ibmcloud ks cluster config --cluster $IKS_CLUSTER - kubectl config current-context - kubectl create deployment $DEPLOYMENT_NAME --image=$REGISTRY_HOSTNAME/$ICR_NAMESPACE/$IMAGE_NAME:$GITHUB_SHA --dry-run -o yaml > deployment.yaml - kubectl apply -f deployment.yaml - kubectl rollout status deployment/$DEPLOYMENT_NAME - kubectl create service loadbalancer $DEPLOYMENT_NAME --tcp=80:$PORT --dry-run -o yaml > service.yaml - kubectl apply -f service.yaml - kubectl get services -o wide +# This workflow will build a docker container, publish it to IBM Container Registry, and deploy it to IKS when there is a push to the master branch. +# +# To configure this workflow: +# +# 1. Ensure that your repository contains a Dockerfile +# 2. Setup secrets in your repository by going to settings: Create ICR_NAMESPACE and IBM_CLOUD_API_KEY +# 3. Change the values for the IBM_CLOUD_REGION, REGISTRY_HOSTNAME, IMAGE_NAME, IKS_CLUSTER, DEPLOYMENT_NAME, and PORT + +name: Build and Deploy to IKS + +on: + push: + branches: + - master + +# Environment variables available to all jobs and steps in this workflow +env: + GITHUB_SHA: ${{ github.sha }} + IBM_CLOUD_API_KEY: ${{ secrets.IBM_CLOUD_API_KEY }} + IBM_CLOUD_REGION: us-south + ICR_NAMESPACE: ${{ secrets.ICR_NAMESPACE }} + REGISTRY_HOSTNAME: us.icr.io + IMAGE_NAME: iks-test + IKS_CLUSTER: example-iks-cluster-name-or-id + DEPLOYMENT_NAME: iks-test + PORT: 5001 + +jobs: + setup-build-publish-deploy: + name: Setup, Build, Publish, and Deploy + runs-on: ubuntu-latest + environment: production + steps: + + - name: Checkout + uses: actions/checkout@v3 + + # Download and Install IBM Cloud CLI + - name: Install IBM Cloud CLI + run: | + curl -fsSL https://clis.cloud.ibm.com/install/linux | sh + ibmcloud --version + ibmcloud config --check-version=false + ibmcloud plugin install -f kubernetes-service + ibmcloud plugin install -f container-registry + + # Authenticate with IBM Cloud CLI + - name: Authenticate with IBM Cloud CLI + run: | + ibmcloud login --apikey "${IBM_CLOUD_API_KEY}" -r "${IBM_CLOUD_REGION}" -g default + ibmcloud cr region-set "${IBM_CLOUD_REGION}" + ibmcloud cr login + + # Build the Docker image + - name: Build with Docker + run: | + docker build -t "$REGISTRY_HOSTNAME"/"$ICR_NAMESPACE"/"$IMAGE_NAME":"$GITHUB_SHA" \ + --build-arg GITHUB_SHA="$GITHUB_SHA" \ + --build-arg GITHUB_REF="$GITHUB_REF" . + + # Push the image to IBM Container Registry + - name: Push the image to ICR + run: | + docker push $REGISTRY_HOSTNAME/$ICR_NAMESPACE/$IMAGE_NAME:$GITHUB_SHA + + # Deploy the Docker image to the IKS cluster + - name: Deploy to IKS + run: | + ibmcloud ks cluster config --cluster $IKS_CLUSTER + kubectl config current-context + kubectl create deployment $DEPLOYMENT_NAME --image=$REGISTRY_HOSTNAME/$ICR_NAMESPACE/$IMAGE_NAME:$GITHUB_SHA --dry-run -o yaml > deployment.yaml + kubectl apply -f deployment.yaml + kubectl rollout status deployment/$DEPLOYMENT_NAME + kubectl create service loadbalancer $DEPLOYMENT_NAME --tcp=80:$PORT --dry-run -o yaml > service.yaml + kubectl apply -f service.yaml + kubectl get services -o wide diff --git a/.github/workflows/jekyll.yml b/.github/workflows/jekyll.yml index 5732d6d..7292054 100644 --- a/.github/workflows/jekyll.yml +++ b/.github/workflows/jekyll.yml @@ -1,20 +1,20 @@ -name: Jekyll site CI - -on: - push: - branches: [ master ] - pull_request: - branches: [ master ] - -jobs: - build: - - runs-on: ubuntu-latest - - steps: - - uses: actions/checkout@v3 - - name: Build the site in the jekyll/builder container - run: | - docker run \ - -v ${{ github.workspace }}:/srv/jekyll -v ${{ github.workspace }}/_site:/srv/jekyll/_site \ - jekyll/builder:latest /bin/bash -c "chmod -R 777 /srv/jekyll && jekyll build --future" +name: Jekyll site CI + +on: + push: + branches: [ master ] + pull_request: + branches: [ master ] + +jobs: + build: + + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v3 + - name: Build the site in the jekyll/builder container + run: | + docker run \ + -v ${{ github.workspace }}:/srv/jekyll -v ${{ github.workspace }}/_site:/srv/jekyll/_site \ + jekyll/builder:latest /bin/bash -c "chmod -R 777 /srv/jekyll && jekyll build --future" diff --git a/.github/workflows/kubesec.yml b/.github/workflows/kubesec.yml index 552dddc..84b17b8 100644 --- a/.github/workflows/kubesec.yml +++ b/.github/workflows/kubesec.yml @@ -1,41 +1,41 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -name: Kubesec - -on: - push: - branches: [ master ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ master ] - schedule: - - cron: '38 9 * * 1' - -jobs: - lint: - name: Kubesec - runs-on: ubuntu-20.04 - permissions: - actions: read - contents: read - security-events: write - steps: - - name: Checkout code - uses: actions/checkout@v3 - - - name: Run kubesec scanner - uses: controlplaneio/kubesec-action@43d0ddff5ffee89a6bb9f29b64cd865411137b14 - with: - input: file.yaml # specify configuration file to scan here - format: template - template: template/sarif.tpl - output: kubesec-results.sarif - exit-code: "0" - - - name: Upload Kubesec scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: kubesec-results.sarif +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +name: Kubesec + +on: + push: + branches: [ master ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ master ] + schedule: + - cron: '38 9 * * 1' + +jobs: + lint: + name: Kubesec + runs-on: ubuntu-20.04 + permissions: + actions: read + contents: read + security-events: write + steps: + - name: Checkout code + uses: actions/checkout@v3 + + - name: Run kubesec scanner + uses: controlplaneio/kubesec-action@43d0ddff5ffee89a6bb9f29b64cd865411137b14 + with: + input: file.yaml # specify configuration file to scan here + format: template + template: template/sarif.tpl + output: kubesec-results.sarif + exit-code: "0" + + - name: Upload Kubesec scan results to GitHub Security tab + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: kubesec-results.sarif diff --git a/.github/workflows/manual.yml b/.github/workflows/manual.yml index 47f24e1..53b17e9 100644 --- a/.github/workflows/manual.yml +++ b/.github/workflows/manual.yml @@ -1,30 +1,30 @@ -# This is a basic workflow that is manually triggered - -name: Manual workflow - -# Controls when the action will run. Workflow runs when manually triggered using the UI -# or API. -on: - workflow_dispatch: - # Inputs the workflow accepts. - inputs: - name: - # Friendly description to be shown in the UI instead of 'name' - description: 'Person to greet' - # Default value if no value is explicitly provided - default: 'World' - # Input has to be provided for the workflow to run - required: true - -# A workflow run is made up of one or more jobs that can run sequentially or in parallel -jobs: - # This workflow contains a single job called "greet" - greet: - # The type of runner that the job will run on - runs-on: ubuntu-latest - - # Steps represent a sequence of tasks that will be executed as part of the job - steps: - # Runs a single command using the runners shell - - name: Send greeting - run: echo "Hello ${{ github.event.inputs.name }}" +# This is a basic workflow that is manually triggered + +name: Manual workflow + +# Controls when the action will run. Workflow runs when manually triggered using the UI +# or API. +on: + workflow_dispatch: + # Inputs the workflow accepts. + inputs: + name: + # Friendly description to be shown in the UI instead of 'name' + description: 'Person to greet' + # Default value if no value is explicitly provided + default: 'World' + # Input has to be provided for the workflow to run + required: true + +# A workflow run is made up of one or more jobs that can run sequentially or in parallel +jobs: + # This workflow contains a single job called "greet" + greet: + # The type of runner that the job will run on + runs-on: ubuntu-latest + + # Steps represent a sequence of tasks that will be executed as part of the job + steps: + # Runs a single command using the runners shell + - name: Send greeting + run: echo "Hello ${{ github.event.inputs.name }}" diff --git a/.github/workflows/mayhem-for-api.yml b/.github/workflows/mayhem-for-api.yml index 8dc3181..2a2b820 100644 --- a/.github/workflows/mayhem-for-api.yml +++ b/.github/workflows/mayhem-for-api.yml @@ -1,66 +1,66 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. -# -# This workflow starts your API and fuzzes it with ForAllSecure Mayhem for API -# to find reliability, performance and security issues before they reach -# production. -# -# To use this workflow, you will need to: -# -# 1. Create a Mayhem for API account at -# https://mayhem4api.forallsecure.com/signup -# -# 2. Create a service account token `mapi organization service-account create -# ` -# -# 3. Add the service account token as a secret in GitHub called "MAPI_TOKEN" -# -# 4. Update the "Start your API" step to run your API in the background before -# starting the Mayhem for API scan, and update the `api-url` & `api-spec` -# field. -# -# If you have any questions, please contact us at mayhem4api@forallsecure.com - -name: "Mayhem for API" - -on: - push: - branches: [ master ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ master ] - -jobs: - mayhem-for-api: - name: Mayhem for API - # Mayhem for API runs on linux, mac and windows - runs-on: ubuntu-latest - permissions: - actions: read - contents: read - security-events: write - steps: - - uses: actions/checkout@v3 - - # Run your API in the background. Ideally, the API would run in debug - # mode & send stacktraces back on "500 Internal Server Error" responses - # (don't do this in production though!) - - name: Start your API - run: ./run_your_api.sh & # <- ✏️ update this - - - name: Mayhem for API - uses: ForAllSecure/mapi-action@353b38b08ade35fe6c68053797a619834a8d225d - continue-on-error: true - with: - mapi-token: ${{ secrets.MAPI_TOKEN }} - api-url: https://localhost:8080 # <- ✏️ update this - api-spec: https://localhost:8080/openapi.json # <- ✏️ update this - duration: 60 - sarif-report: mapi.sarif - - - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: mapi.sarif +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. +# +# This workflow starts your API and fuzzes it with ForAllSecure Mayhem for API +# to find reliability, performance and security issues before they reach +# production. +# +# To use this workflow, you will need to: +# +# 1. Create a Mayhem for API account at +# https://mayhem4api.forallsecure.com/signup +# +# 2. Create a service account token `mapi organization service-account create +# ` +# +# 3. Add the service account token as a secret in GitHub called "MAPI_TOKEN" +# +# 4. Update the "Start your API" step to run your API in the background before +# starting the Mayhem for API scan, and update the `api-url` & `api-spec` +# field. +# +# If you have any questions, please contact us at mayhem4api@forallsecure.com + +name: "Mayhem for API" + +on: + push: + branches: [ master ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ master ] + +jobs: + mayhem-for-api: + name: Mayhem for API + # Mayhem for API runs on linux, mac and windows + runs-on: ubuntu-latest + permissions: + actions: read + contents: read + security-events: write + steps: + - uses: actions/checkout@v3 + + # Run your API in the background. Ideally, the API would run in debug + # mode & send stacktraces back on "500 Internal Server Error" responses + # (don't do this in production though!) + - name: Start your API + run: ./run_your_api.sh & # <- ✏️ update this + + - name: Mayhem for API + uses: ForAllSecure/mapi-action@353b38b08ade35fe6c68053797a619834a8d225d + continue-on-error: true + with: + mapi-token: ${{ secrets.MAPI_TOKEN }} + api-url: https://localhost:8080 # <- ✏️ update this + api-spec: https://localhost:8080/openapi.json # <- ✏️ update this + duration: 60 + sarif-report: mapi.sarif + + - name: Upload SARIF file + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: mapi.sarif diff --git a/.github/workflows/mobsf.yml b/.github/workflows/mobsf.yml index d077ba3..adca965 100644 --- a/.github/workflows/mobsf.yml +++ b/.github/workflows/mobsf.yml @@ -1,46 +1,46 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -name: MobSF - -on: - push: - branches: [ master ] - pull_request: - branches: [ master ] - schedule: - - cron: '20 11 * * 5' - -permissions: - contents: read - -jobs: - mobile-security: - permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - runs-on: ubuntu-latest - - steps: - - uses: actions/checkout@v3 - - - name: Setup python - uses: actions/setup-python@v4 - with: - python-version: 3.8 - - - name: Run mobsfscan - uses: MobSF/mobsfscan@1a796a0729f9d1a0e1fa4fe6b156fde47f4f3185 - with: - args: . --sarif --output results.sarif || true - - - name: Upload mobsfscan report - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: results.sarif - - name: Upload coverage reports to Codecov - uses: codecov/codecov-action@v3 - env: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +name: MobSF + +on: + push: + branches: [ master ] + pull_request: + branches: [ master ] + schedule: + - cron: '20 11 * * 5' + +permissions: + contents: read + +jobs: + mobile-security: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v3 + + - name: Setup python + uses: actions/setup-python@v4 + with: + python-version: 3.8 + + - name: Run mobsfscan + uses: MobSF/mobsfscan@1a796a0729f9d1a0e1fa4fe6b156fde47f4f3185 + with: + args: . --sarif --output results.sarif || true + + - name: Upload mobsfscan report + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: results.sarif + - name: Upload coverage reports to Codecov + uses: codecov/codecov-action@v3 + env: + CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} diff --git a/.github/workflows/neuralegion.yml b/.github/workflows/neuralegion.yml index 24f7514..e95d1ac 100644 --- a/.github/workflows/neuralegion.yml +++ b/.github/workflows/neuralegion.yml @@ -1,175 +1,175 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. -# -# Run a Nexploit Scan -# This action runs a new security scan in Nexploit, or reruns an existing one. -# Build Secure Apps & APIs. Fast. -# [NeuraLegion](https://www.neuralegion.com) is a powerful dynamic application & API security testing (DAST) platform that security teams trust and developers love. -# Automatically Tests Every Aspect of Your Apps & APIs -# Scans any target, whether Web Apps, APIs (REST. & SOAP, GraphQL & more), Web sockets or mobile, providing actionable reports -# Seamlessly integrates with the Tools and Workflows You Already Use -# -# NeuraLegion works with your existing CI/CD pipelines – trigger scans on every commit, pull request or build with unit testing. -# Spin-Up, Configure and Control Scans with Code -# One file. One command. One scan. No UI needed. -# -# Super-Fast Scans -# -# Interacts with applications and APIs, instead of just crawling them and guessing. -# Scans are fast as our AI-powered engine can understand application architecture and generate sophisticated and targeted attacks. -# -# No False Positives -# -# Stop chasing ghosts and wasting time. NeuraLegion doesn’t return false positives, so you can focus on releasing code. -# -# Comprehensive Security Testing -# -# NeuraLegion tests for all common vulnerabilities, such as SQL injection, CSRF, XSS, and XXE -- as well as uncommon vulnerabilities, such as business logic vulnerabilities. -# -# More information is available on NeuraLegion’s: -# * [Website](https://www.neuralegion.com/) -# * [Knowledge base](https://docs.neuralegion.com/docs/quickstart) -# * [YouTube channel](https://www.youtube.com/channel/UCoIC0T1pmozq3eKLsUR2uUw) -# * [GitHub Actions](https://github.com/marketplace?query=neuralegion+) -# -# Inputs -# -# `name` -# -# **Required**. Scan name. -# -# _Example:_ `name: GitHub scan ${{ github.sha }}` -# -# `api_token` -# -# **Required**. Your Nexploit API authorization token (key). You can generate it in the **Organization** section on [nexploit.app](https://nexploit.app/login). Find more information [here](https://kb.neuralegion.com/#/guide/np-web-ui/advanced-set-up/managing-org?id=managing-organization-apicli-authentication-tokens). -# -# _Example:_ `api_token: ${{ secrets.NEXPLOIT_TOKEN }}` -# -# `restart_scan` -# -# **Required** when restarting an existing scan by its ID. You can get the scan ID in the Scans section on [nexploit.app](https://nexploit.app/login).
Please make sure to only use the necessary parameters. Otherwise, you will get a response with the parameter usage requirements. -# -# _Example:_ `restart_scan: ai3LG8DmVn9Rn1YeqCNRGQ)` -# -# `discovery_types` -# -# **Required**. Array of discovery types. The following types are available: -# * `archive` - uses an uploaded HAR-file for a scan -# * `crawler` - uses a crawler to define the attack surface for a scan -# * `oas` - uses an uploaded OpenAPI schema for a scan
-# If no discovery type is specified, `crawler` is applied by default. -# -# _Example:_ -# -# ```yml -# discovery_types: | -# [ "crawler", "archive" ] -# ``` -# -# `file_id` -# -# **Required** if the discovery type is set to `archive` or `oas`. ID of a HAR-file or an OpenAPI schema you want to use for a scan. You can get the ID of an uploaded HAR-file or an OpenAPI schema in the **Storage** section on [nexploit.app](https://nexploit.app/login). -# -# _Example:_ -# -# ``` -# FILE_ID=$(nexploit-cli archive:upload \ -# --token ${{ secrets.NEXPLOIT_TOKEN }} \ -# --discard true \ -# ./example.har) -# ``` -# -# `crawler_urls` -# -# **Required** if the discovery type is set to `crawler`. Target URLs to be used by the crawler to define the attack surface. -# -# _Example:_ -# -# ``` -# crawler_urls: | -# [ "http://vulnerable-bank.com" ] -# ``` -# -# `hosts_filter` -# -# **Required** when the the discovery type is set to `archive`. Allows selecting specific hosts for a scan. -# -# Outputs -# -# `url` -# -# Url of the resulting scan -# -# `id` -# -# ID of the created scan. This ID could then be used to restart the scan, or for the following GitHub actions: -# * [Nexploit Wait for Issues](https://github.com/marketplace/actions/nexploit-wait-for-issues) -# * [Nexploit Stop Scan](https://github.com/marketplace/actions/nexploit-stop-scan) -# -# Example usage -# -# Start a new scan with parameters -# -# ```yml -# steps: -# - name: Start Nexploit Scan -# id: start -# uses: NeuraLegion/run-scan@29ebd17b4fd6292ce7a238a59401668953b37fbe -# with: -# api_token: ${{ secrets.NEXPLOIT_TOKEN }} -# name: GitHub scan ${{ github.sha }} -# discovery_types: | -# [ "crawler", "archive" ] -# crawler_urls: | -# [ "http://vulnerable-bank.com" ] -# file_id: LiYknMYSdbSZbqgMaC9Sj -# hosts_filter: | -# [ ] -# - name: Get the output scan url -# run: echo "The scan was started on ${{ steps.start.outputs.url }}" -# ``` -# -# Restart an existing scan -# -# ```yml -# steps: -# - name: Start Nexploit Scan -# id: start -# uses: NeuraLegion/run-scan@29ebd17b4fd6292ce7a238a59401668953b37fbe -# with: -# api_token: ${{ secrets.NEXPLOIT_TOKEN }} -# name: GitHub scan ${{ github.sha }} -# restart_scan: ai3LG8DmVn9Rn1YeqCNRGQ -# - name: Get the output scan url -# run: echo "The scan was started on ${{ steps.start.outputs.url }}" - - -name: "NeuraLegion" - -on: - push: - branches: [ master ] - pull_request: - branches: [ master ] - schedule: - - cron: '30 4 * * 3' - -jobs: - neuralegion_scan: - runs-on: ubuntu-18.04 - name: A job to run a Nexploit scan - steps: - - uses: actions/checkout@v3 - - name: Start Nexploit Scan 🏁 - id: start - uses: NeuraLegion/run-scan@e8a357749253841cb233872e6c1fa9f71bb308f8 - with: - api_token: ${{ secrets.NEURALEGION_TOKEN }} - name: GitHub scan ${{ github.sha }} - discovery_types: | - [ "crawler" ] - crawler_urls: | - [ "https://brokencrystals.com" ] # ✏️ Update this to the url you wish to scan +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. +# +# Run a Nexploit Scan +# This action runs a new security scan in Nexploit, or reruns an existing one. +# Build Secure Apps & APIs. Fast. +# [NeuraLegion](https://www.neuralegion.com) is a powerful dynamic application & API security testing (DAST) platform that security teams trust and developers love. +# Automatically Tests Every Aspect of Your Apps & APIs +# Scans any target, whether Web Apps, APIs (REST. & SOAP, GraphQL & more), Web sockets or mobile, providing actionable reports +# Seamlessly integrates with the Tools and Workflows You Already Use +# +# NeuraLegion works with your existing CI/CD pipelines – trigger scans on every commit, pull request or build with unit testing. +# Spin-Up, Configure and Control Scans with Code +# One file. One command. One scan. No UI needed. +# +# Super-Fast Scans +# +# Interacts with applications and APIs, instead of just crawling them and guessing. +# Scans are fast as our AI-powered engine can understand application architecture and generate sophisticated and targeted attacks. +# +# No False Positives +# +# Stop chasing ghosts and wasting time. NeuraLegion doesn’t return false positives, so you can focus on releasing code. +# +# Comprehensive Security Testing +# +# NeuraLegion tests for all common vulnerabilities, such as SQL injection, CSRF, XSS, and XXE -- as well as uncommon vulnerabilities, such as business logic vulnerabilities. +# +# More information is available on NeuraLegion’s: +# * [Website](https://www.neuralegion.com/) +# * [Knowledge base](https://docs.neuralegion.com/docs/quickstart) +# * [YouTube channel](https://www.youtube.com/channel/UCoIC0T1pmozq3eKLsUR2uUw) +# * [GitHub Actions](https://github.com/marketplace?query=neuralegion+) +# +# Inputs +# +# `name` +# +# **Required**. Scan name. +# +# _Example:_ `name: GitHub scan ${{ github.sha }}` +# +# `api_token` +# +# **Required**. Your Nexploit API authorization token (key). You can generate it in the **Organization** section on [nexploit.app](https://nexploit.app/login). Find more information [here](https://kb.neuralegion.com/#/guide/np-web-ui/advanced-set-up/managing-org?id=managing-organization-apicli-authentication-tokens). +# +# _Example:_ `api_token: ${{ secrets.NEXPLOIT_TOKEN }}` +# +# `restart_scan` +# +# **Required** when restarting an existing scan by its ID. You can get the scan ID in the Scans section on [nexploit.app](https://nexploit.app/login).
Please make sure to only use the necessary parameters. Otherwise, you will get a response with the parameter usage requirements. +# +# _Example:_ `restart_scan: ai3LG8DmVn9Rn1YeqCNRGQ)` +# +# `discovery_types` +# +# **Required**. Array of discovery types. The following types are available: +# * `archive` - uses an uploaded HAR-file for a scan +# * `crawler` - uses a crawler to define the attack surface for a scan +# * `oas` - uses an uploaded OpenAPI schema for a scan
+# If no discovery type is specified, `crawler` is applied by default. +# +# _Example:_ +# +# ```yml +# discovery_types: | +# [ "crawler", "archive" ] +# ``` +# +# `file_id` +# +# **Required** if the discovery type is set to `archive` or `oas`. ID of a HAR-file or an OpenAPI schema you want to use for a scan. You can get the ID of an uploaded HAR-file or an OpenAPI schema in the **Storage** section on [nexploit.app](https://nexploit.app/login). +# +# _Example:_ +# +# ``` +# FILE_ID=$(nexploit-cli archive:upload \ +# --token ${{ secrets.NEXPLOIT_TOKEN }} \ +# --discard true \ +# ./example.har) +# ``` +# +# `crawler_urls` +# +# **Required** if the discovery type is set to `crawler`. Target URLs to be used by the crawler to define the attack surface. +# +# _Example:_ +# +# ``` +# crawler_urls: | +# [ "http://vulnerable-bank.com" ] +# ``` +# +# `hosts_filter` +# +# **Required** when the the discovery type is set to `archive`. Allows selecting specific hosts for a scan. +# +# Outputs +# +# `url` +# +# Url of the resulting scan +# +# `id` +# +# ID of the created scan. This ID could then be used to restart the scan, or for the following GitHub actions: +# * [Nexploit Wait for Issues](https://github.com/marketplace/actions/nexploit-wait-for-issues) +# * [Nexploit Stop Scan](https://github.com/marketplace/actions/nexploit-stop-scan) +# +# Example usage +# +# Start a new scan with parameters +# +# ```yml +# steps: +# - name: Start Nexploit Scan +# id: start +# uses: NeuraLegion/run-scan@29ebd17b4fd6292ce7a238a59401668953b37fbe +# with: +# api_token: ${{ secrets.NEXPLOIT_TOKEN }} +# name: GitHub scan ${{ github.sha }} +# discovery_types: | +# [ "crawler", "archive" ] +# crawler_urls: | +# [ "http://vulnerable-bank.com" ] +# file_id: LiYknMYSdbSZbqgMaC9Sj +# hosts_filter: | +# [ ] +# - name: Get the output scan url +# run: echo "The scan was started on ${{ steps.start.outputs.url }}" +# ``` +# +# Restart an existing scan +# +# ```yml +# steps: +# - name: Start Nexploit Scan +# id: start +# uses: NeuraLegion/run-scan@29ebd17b4fd6292ce7a238a59401668953b37fbe +# with: +# api_token: ${{ secrets.NEXPLOIT_TOKEN }} +# name: GitHub scan ${{ github.sha }} +# restart_scan: ai3LG8DmVn9Rn1YeqCNRGQ +# - name: Get the output scan url +# run: echo "The scan was started on ${{ steps.start.outputs.url }}" + + +name: "NeuraLegion" + +on: + push: + branches: [ master ] + pull_request: + branches: [ master ] + schedule: + - cron: '30 4 * * 3' + +jobs: + neuralegion_scan: + runs-on: ubuntu-18.04 + name: A job to run a Nexploit scan + steps: + - uses: actions/checkout@v3 + - name: Start Nexploit Scan 🏁 + id: start + uses: NeuraLegion/run-scan@e8a357749253841cb233872e6c1fa9f71bb308f8 + with: + api_token: ${{ secrets.NEURALEGION_TOKEN }} + name: GitHub scan ${{ github.sha }} + discovery_types: | + [ "crawler" ] + crawler_urls: | + [ "https://brokencrystals.com" ] # ✏️ Update this to the url you wish to scan diff --git a/.github/workflows/njsscan.yml b/.github/workflows/njsscan.yml index 95d7d9f..4707323 100644 --- a/.github/workflows/njsscan.yml +++ b/.github/workflows/njsscan.yml @@ -1,45 +1,45 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -# This workflow integrates njsscan with GitHub's Code Scanning feature -# nodejsscan is a static security code scanner that finds insecure code patterns in your Node.js applications - -name: njsscan sarif - -on: - push: - branches: [ master ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ master ] - schedule: - - cron: '17 4 * * 6' - -permissions: - contents: read - -jobs: - njsscan: - permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - runs-on: ubuntu-latest - name: njsscan code scanning - steps: - - name: Checkout the code - uses: actions/checkout@v3 - - name: nodejsscan scan - id: njsscan - uses: ajinabraham/njsscan-action@74e5a58c1edb363b84c9ddd626b0e22f038ac09e - with: - args: '. --sarif --output results.sarif || true' - - name: Upload njsscan report - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: results.sarif - - name: Upload coverage reports to Codecov - uses: codecov/codecov-action@v3 - env: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# This workflow integrates njsscan with GitHub's Code Scanning feature +# nodejsscan is a static security code scanner that finds insecure code patterns in your Node.js applications + +name: njsscan sarif + +on: + push: + branches: [ master ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ master ] + schedule: + - cron: '17 4 * * 6' + +permissions: + contents: read + +jobs: + njsscan: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + runs-on: ubuntu-latest + name: njsscan code scanning + steps: + - name: Checkout the code + uses: actions/checkout@v3 + - name: nodejsscan scan + id: njsscan + uses: ajinabraham/njsscan-action@74e5a58c1edb363b84c9ddd626b0e22f038ac09e + with: + args: '. --sarif --output results.sarif || true' + - name: Upload njsscan report + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: results.sarif + - name: Upload coverage reports to Codecov + uses: codecov/codecov-action@v3 + env: + CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} diff --git a/.github/workflows/node.js.yml b/.github/workflows/node.js.yml index f75d5f8..ea701c5 100644 --- a/.github/workflows/node.js.yml +++ b/.github/workflows/node.js.yml @@ -1,30 +1,30 @@ -# This workflow will do a clean install of node dependencies, build the source code and run tests across different versions of node -# For more information see: https://help.github.com/actions/language-and-framework-guides/using-nodejs-with-github-actions - -name: Node.js CI - -on: - push: - branches: [ master ] - pull_request: - branches: [ master ] - -jobs: - build: - - runs-on: ubuntu-latest - - strategy: - matrix: - node-version: [10.x, 12.x, 14.x, 15.x] - # See supported Node.js release schedule at https://nodejs.org/en/about/releases/ - - steps: - - uses: actions/checkout@v3 - - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 - with: - node-version: ${{ matrix.node-version }} - - run: npm ci - - run: npm run build --if-present - - run: npm test +# This workflow will do a clean install of node dependencies, build the source code and run tests across different versions of node +# For more information see: https://help.github.com/actions/language-and-framework-guides/using-nodejs-with-github-actions + +name: Node.js CI + +on: + push: + branches: [ master ] + pull_request: + branches: [ master ] + +jobs: + build: + + runs-on: ubuntu-latest + + strategy: + matrix: + node-version: [10.x, 12.x, 14.x, 15.x] + # See supported Node.js release schedule at https://nodejs.org/en/about/releases/ + + steps: + - uses: actions/checkout@v3 + - name: Use Node.js ${{ matrix.node-version }} + uses: actions/setup-node@v3 + with: + node-version: ${{ matrix.node-version }} + - run: npm ci + - run: npm run build --if-present + - run: npm test diff --git a/.github/workflows/nowsecure.yml b/.github/workflows/nowsecure.yml index edfeaab..5581d1d 100644 --- a/.github/workflows/nowsecure.yml +++ b/.github/workflows/nowsecure.yml @@ -1,52 +1,52 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. -# -# NowSecure: The Mobile Security Experts . -# -# To use this workflow, you must be an existing NowSecure customer with GitHub Advanced Security (GHAS) enabled for your -# repository. -# -# If you *are not* an existing customer, click here to contact us for licensing and pricing details: -# . -# -# Instructions: -# -# 1. In the settings for your repository, click "Secrets" then "New repository secret". Name the secret "NS_TOKEN" and -# paste in your Platform token. If you do not have a Platform token, or wish to create a new one for GitHub, visit -# NowSecure Platform and go to "Profile & Preferences" then create a token labelled "GitHub". -# -# 2. Follow the annotated workflow below and make any necessary modifications then save the workflow to your repository -# and review the "Security" tab once the action has run. - -name: "NowSecure" - -on: - push: - branches: [ master ] - pull_request: - branches: [ master ] - -jobs: - nowsecure: - name: NowSecure - runs-on: ubuntu-latest - steps: - - name: Checkout code - uses: actions/checkout@v3 - - - name: Build your application - run: ./gradlew assembleDebug # Update this to build your Android or iOS application - - - name: Run NowSecure - uses: nowsecure/nowsecure-action@5459f15cabd7040dee56dea24891ce4d291f25b4 - with: - token: ${{ secrets.NS_TOKEN }} - app_file: app-debug.apk # Update this to a path to your .ipa or .apk - group_id: {{ groupId }} # Update this to your desired Platform group ID - - - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: NowSecure.sarif +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. +# +# NowSecure: The Mobile Security Experts . +# +# To use this workflow, you must be an existing NowSecure customer with GitHub Advanced Security (GHAS) enabled for your +# repository. +# +# If you *are not* an existing customer, click here to contact us for licensing and pricing details: +# . +# +# Instructions: +# +# 1. In the settings for your repository, click "Secrets" then "New repository secret". Name the secret "NS_TOKEN" and +# paste in your Platform token. If you do not have a Platform token, or wish to create a new one for GitHub, visit +# NowSecure Platform and go to "Profile & Preferences" then create a token labelled "GitHub". +# +# 2. Follow the annotated workflow below and make any necessary modifications then save the workflow to your repository +# and review the "Security" tab once the action has run. + +name: "NowSecure" + +on: + push: + branches: [ master ] + pull_request: + branches: [ master ] + +jobs: + nowsecure: + name: NowSecure + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v3 + + - name: Build your application + run: ./gradlew assembleDebug # Update this to build your Android or iOS application + + - name: Run NowSecure + uses: nowsecure/nowsecure-action@5459f15cabd7040dee56dea24891ce4d291f25b4 + with: + token: ${{ secrets.NS_TOKEN }} + app_file: app-debug.apk # Update this to a path to your .ipa or .apk + group_id: {{ groupId }} # Update this to your desired Platform group ID + + - name: Upload SARIF file + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: NowSecure.sarif diff --git a/.github/workflows/npm-grunt.yml b/.github/workflows/npm-grunt.yml index b1ff267..339efa4 100644 --- a/.github/workflows/npm-grunt.yml +++ b/.github/workflows/npm-grunt.yml @@ -1,28 +1,28 @@ -name: NodeJS with Grunt - -on: - push: - branches: [ master ] - pull_request: - branches: [ master ] - -jobs: - build: - runs-on: ubuntu-latest - - strategy: - matrix: - node-version: [12.x, 14.x, 16.x] - - steps: - - uses: actions/checkout@v3 - - - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 - with: - node-version: ${{ matrix.node-version }} - - - name: Build - run: | - npm install - grunt +name: NodeJS with Grunt + +on: + push: + branches: [ master ] + pull_request: + branches: [ master ] + +jobs: + build: + runs-on: ubuntu-latest + + strategy: + matrix: + node-version: [12.x, 14.x, 16.x] + + steps: + - uses: actions/checkout@v3 + + - name: Use Node.js ${{ matrix.node-version }} + uses: actions/setup-node@v3 + with: + node-version: ${{ matrix.node-version }} + + - name: Build + run: | + npm install + grunt diff --git a/.github/workflows/npm-gulp.yml b/.github/workflows/npm-gulp.yml index 32297a6..2474c82 100644 --- a/.github/workflows/npm-gulp.yml +++ b/.github/workflows/npm-gulp.yml @@ -1,28 +1,28 @@ -name: NodeJS with Gulp - -on: - push: - branches: [ master ] - pull_request: - branches: [ master ] - -jobs: - build: - runs-on: ubuntu-latest - - strategy: - matrix: - node-version: [12.x, 14.x, 16.x] - - steps: - - uses: actions/checkout@v3 - - - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 - with: - node-version: ${{ matrix.node-version }} - - - name: Build - run: | - npm install - gulp +name: NodeJS with Gulp + +on: + push: + branches: [ master ] + pull_request: + branches: [ master ] + +jobs: + build: + runs-on: ubuntu-latest + + strategy: + matrix: + node-version: [12.x, 14.x, 16.x] + + steps: + - uses: actions/checkout@v3 + + - name: Use Node.js ${{ matrix.node-version }} + uses: actions/setup-node@v3 + with: + node-version: ${{ matrix.node-version }} + + - name: Build + run: | + npm install + gulp diff --git a/.github/workflows/npm-publish-github-packages.yml b/.github/workflows/npm-publish-github-packages.yml index 42f900b..3ca9c50 100644 --- a/.github/workflows/npm-publish-github-packages.yml +++ b/.github/workflows/npm-publish-github-packages.yml @@ -1,36 +1,36 @@ -# This workflow will run tests using node and then publish a package to GitHub Packages when a release is created -# For more information see: https://help.github.com/actions/language-and-framework-guides/publishing-nodejs-packages - -name: Node.js Package - -on: - release: - types: [created] - -jobs: - build: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v3 - - uses: actions/setup-node@v3 - with: - node-version: 16 - - run: npm ci - - run: npm test - - publish-gpr: - needs: build - runs-on: ubuntu-latest - permissions: - contents: read - packages: write - steps: - - uses: actions/checkout@v3 - - uses: actions/setup-node@v3 - with: - node-version: 16 - registry-url: https://npm.pkg.github.com/ - - run: npm ci - - run: npm publish - env: - NODE_AUTH_TOKEN: ${{secrets.GITHUB_TOKEN}} +# This workflow will run tests using node and then publish a package to GitHub Packages when a release is created +# For more information see: https://help.github.com/actions/language-and-framework-guides/publishing-nodejs-packages + +name: Node.js Package + +on: + release: + types: [created] + +jobs: + build: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v3 + - uses: actions/setup-node@v3 + with: + node-version: 16 + - run: npm ci + - run: npm test + + publish-gpr: + needs: build + runs-on: ubuntu-latest + permissions: + contents: read + packages: write + steps: + - uses: actions/checkout@v3 + - uses: actions/setup-node@v3 + with: + node-version: 16 + registry-url: https://npm.pkg.github.com/ + - run: npm ci + - run: npm publish + env: + NODE_AUTH_TOKEN: ${{secrets.GITHUB_TOKEN}} diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index 512c11f..d9018b2 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -1,50 +1,50 @@ -# This workflow will run tests using node and then publish a package to GitHub Packages when a release is created -# For more information see: https://help.github.com/actions/language-and-framework-guides/publishing-nodejs-packages - -name: Node.js Package - -on: - release: - types: [created] - -jobs: - build: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v3 - - uses: actions/setup-node@v3 - with: - node-version: 12 - - run: npm ci - - run: npm test - - publish-npm: - needs: build - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v3 - - uses: actions/setup-node@v3 - with: - node-version: 12 - registry-url: https://registry.npmjs.org/ - - run: npm ci - - run: npm publish - env: - NODE_AUTH_TOKEN: ${{secrets.npm_token}} - - publish-gpr: - needs: build - runs-on: ubuntu-latest - permissions: - contents: read - packages: write - steps: - - uses: actions/checkout@v3 - - uses: actions/setup-node@v3 - with: - node-version: 12 - registry-url: https://npm.pkg.github.com/ - - run: npm ci - - run: npm publish - env: - NODE_AUTH_TOKEN: ${{secrets.GITHUB_TOKEN}} +# This workflow will run tests using node and then publish a package to GitHub Packages when a release is created +# For more information see: https://help.github.com/actions/language-and-framework-guides/publishing-nodejs-packages + +name: Node.js Package + +on: + release: + types: [created] + +jobs: + build: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v3 + - uses: actions/setup-node@v3 + with: + node-version: 12 + - run: npm ci + - run: npm test + + publish-npm: + needs: build + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v3 + - uses: actions/setup-node@v3 + with: + node-version: 12 + registry-url: https://registry.npmjs.org/ + - run: npm ci + - run: npm publish + env: + NODE_AUTH_TOKEN: ${{secrets.npm_token}} + + publish-gpr: + needs: build + runs-on: ubuntu-latest + permissions: + contents: read + packages: write + steps: + - uses: actions/checkout@v3 + - uses: actions/setup-node@v3 + with: + node-version: 12 + registry-url: https://npm.pkg.github.com/ + - run: npm ci + - run: npm publish + env: + NODE_AUTH_TOKEN: ${{secrets.GITHUB_TOKEN}} diff --git a/.github/workflows/openshift.yml b/.github/workflows/openshift.yml index bff4e16..72b17cd 100644 --- a/.github/workflows/openshift.yml +++ b/.github/workflows/openshift.yml @@ -1,187 +1,187 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -# 💁 The OpenShift Starter workflow will: -# - Checkout your repository -# - Perform a container image build -# - Push the built image to the GitHub Container Registry (GHCR) -# - Log in to your OpenShift cluster -# - Create an OpenShift app from the image and expose it to the internet - -# ℹ️ Configure your repository and the workflow with the following steps: -# 1. Have access to an OpenShift cluster. Refer to https://www.openshift.com/try -# 2. Create the OPENSHIFT_SERVER and OPENSHIFT_TOKEN repository secrets. Refer to: -# - https://github.com/redhat-actions/oc-login#readme -# - https://docs.github.com/en/actions/reference/encrypted-secrets -# - https://cli.github.com/manual/gh_secret_set -# 3. (Optional) Edit the top-level 'env' section as marked with '🖊️' if the defaults are not suitable for your project. -# 4. (Optional) Edit the build-image step to build your project. -# The default build type is by using a Dockerfile at the root of the repository, -# but can be replaced with a different file, a source-to-image build, or a step-by-step buildah build. -# 5. Commit and push the workflow file to your default branch to trigger a workflow run. - -# 👋 Visit our GitHub organization at https://github.com/redhat-actions/ to see our actions and provide feedback. - -name: OpenShift - -env: - # 🖊️ EDIT your repository secrets to log into your OpenShift cluster and set up the context. - # See https://github.com/redhat-actions/oc-login#readme for how to retrieve these values. - # To get a permanent token, refer to https://github.com/redhat-actions/oc-login/wiki/Using-a-Service-Account-for-GitHub-Actions - OPENSHIFT_SERVER: ${{ secrets.OPENSHIFT_SERVER }} - OPENSHIFT_TOKEN: ${{ secrets.OPENSHIFT_TOKEN }} - # 🖊️ EDIT to set the kube context's namespace after login. Leave blank to use your user's default namespace. - OPENSHIFT_NAMESPACE: "" - - # 🖊️ EDIT to set a name for your OpenShift app, or a default one will be generated below. - APP_NAME: "" - - # 🖊️ EDIT with the port your application should be accessible on. - # If the container image exposes *exactly one* port, this can be left blank. - # Refer to the 'port' input of https://github.com/redhat-actions/oc-new-app - APP_PORT: "" - - # 🖊️ EDIT to change the image registry settings. - # Registries such as GHCR, Quay.io, and Docker Hub are supported. - IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }} - IMAGE_REGISTRY_USER: ${{ github.actor }} - IMAGE_REGISTRY_PASSWORD: ${{ github.token }} - - # 🖊️ EDIT to specify custom tags for the container image, or default tags will be generated below. - IMAGE_TAGS: "" - -on: - # https://docs.github.com/en/actions/reference/events-that-trigger-workflows - push: - # Edit to the branch(es) you want to build and deploy on each push. - branches: [ master ] - -jobs: - openshift-ci-cd: - name: Build and deploy to OpenShift - # ubuntu-20.04 can also be used. - runs-on: ubuntu-18.04 - environment: production - - outputs: - ROUTE: ${{ steps.deploy-and-expose.outputs.route }} - SELECTOR: ${{ steps.deploy-and-expose.outputs.selector }} - - steps: - - name: Check for required secrets - uses: actions/github-script@v6 - with: - script: | - const secrets = { - OPENSHIFT_SERVER: `${{ secrets.OPENSHIFT_SERVER }}`, - OPENSHIFT_TOKEN: `${{ secrets.OPENSHIFT_TOKEN }}`, - }; - - const GHCR = "ghcr.io"; - if (`${{ env.IMAGE_REGISTRY }}`.startsWith(GHCR)) { - core.info(`Image registry is ${GHCR} - no registry password required`); - } - else { - core.info("A registry password is required"); - secrets["IMAGE_REGISTRY_PASSWORD"] = `${{ secrets.IMAGE_REGISTRY_PASSWORD }}`; - } - - const missingSecrets = Object.entries(secrets).filter(([ name, value ]) => { - if (value.length === 0) { - core.error(`Secret "${name}" is not set`); - return true; - } - core.info(`✔️ Secret "${name}" is set`); - return false; - }); - - if (missingSecrets.length > 0) { - core.setFailed(`❌ At least one required secret is not set in the repository. \n` + - "You can add it using:\n" + - "GitHub UI: https://docs.github.com/en/actions/reference/encrypted-secrets#creating-encrypted-secrets-for-a-repository \n" + - "GitHub CLI: https://cli.github.com/manual/gh_secret_set \n" + - "Also, refer to https://github.com/redhat-actions/oc-login#getting-started-with-the-action-or-see-example"); - } - else { - core.info(`✅ All the required secrets are set`); - } - - - name: Check out repository - uses: actions/checkout@v3 - - - name: Determine app name - if: env.APP_NAME == '' - run: | - echo "APP_NAME=$(basename $PWD)" | tee -a $GITHUB_ENV - - - name: Determine image tags - if: env.IMAGE_TAGS == '' - run: | - echo "IMAGE_TAGS=latest ${GITHUB_SHA::12}" | tee -a $GITHUB_ENV - - # https://github.com/redhat-actions/buildah-build#readme - - name: Build from Dockerfile - id: build-image - uses: redhat-actions/buildah-build@v2 - with: - image: ${{ env.APP_NAME }} - tags: ${{ env.IMAGE_TAGS }} - - # If you don't have a Dockerfile/Containerfile, refer to https://github.com/redhat-actions/buildah-build#scratch-build-inputs - # Or, perform a source-to-image build using https://github.com/redhat-actions/s2i-build - # Otherwise, point this to your Dockerfile/Containerfile relative to the repository root. - dockerfiles: | - ./Dockerfile - - # https://github.com/redhat-actions/push-to-registry#readme - - name: Push to registry - id: push-image - uses: redhat-actions/push-to-registry@v2 - with: - image: ${{ steps.build-image.outputs.image }} - tags: ${{ steps.build-image.outputs.tags }} - registry: ${{ env.IMAGE_REGISTRY }} - username: ${{ env.IMAGE_REGISTRY_USER }} - password: ${{ env.IMAGE_REGISTRY_PASSWORD }} - - # The path the image was pushed to is now stored in ${{ steps.push-image.outputs.registry-path }} - - - name: Install oc - uses: redhat-actions/openshift-tools-installer@v1 - with: - oc: 4 - - # https://github.com/redhat-actions/oc-login#readme - - name: Log in to OpenShift - uses: redhat-actions/oc-login@v1 - with: - openshift_server_url: ${{ env.OPENSHIFT_SERVER }} - openshift_token: ${{ env.OPENSHIFT_TOKEN }} - insecure_skip_tls_verify: true - namespace: ${{ env.OPENSHIFT_NAMESPACE }} - - # This step should create a deployment, service, and route to run your app and expose it to the internet. - # https://github.com/redhat-actions/oc-new-app#readme - - name: Create and expose app - id: deploy-and-expose - uses: redhat-actions/oc-new-app@v1 - with: - app_name: ${{ env.APP_NAME }} - image: ${{ steps.push-image.outputs.registry-path }} - namespace: ${{ env.OPENSHIFT_NAMESPACE }} - port: ${{ env.APP_PORT }} - - - name: Print application URL - env: - ROUTE: ${{ steps.deploy-and-expose.outputs.route }} - SELECTOR: ${{ steps.deploy-and-expose.outputs.selector }} - run: | - [[ -n ${{ env.ROUTE }} ]] || (echo "Determining application route failed in previous step"; exit 1) - echo - echo "======================== Your application is available at: ========================" - echo ${{ env.ROUTE }} - echo "===================================================================================" - echo - echo "Your app can be taken down with: \"oc delete all --selector='${{ env.SELECTOR }}'\"" +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# 💁 The OpenShift Starter workflow will: +# - Checkout your repository +# - Perform a container image build +# - Push the built image to the GitHub Container Registry (GHCR) +# - Log in to your OpenShift cluster +# - Create an OpenShift app from the image and expose it to the internet + +# ℹ️ Configure your repository and the workflow with the following steps: +# 1. Have access to an OpenShift cluster. Refer to https://www.openshift.com/try +# 2. Create the OPENSHIFT_SERVER and OPENSHIFT_TOKEN repository secrets. Refer to: +# - https://github.com/redhat-actions/oc-login#readme +# - https://docs.github.com/en/actions/reference/encrypted-secrets +# - https://cli.github.com/manual/gh_secret_set +# 3. (Optional) Edit the top-level 'env' section as marked with '🖊️' if the defaults are not suitable for your project. +# 4. (Optional) Edit the build-image step to build your project. +# The default build type is by using a Dockerfile at the root of the repository, +# but can be replaced with a different file, a source-to-image build, or a step-by-step buildah build. +# 5. Commit and push the workflow file to your default branch to trigger a workflow run. + +# 👋 Visit our GitHub organization at https://github.com/redhat-actions/ to see our actions and provide feedback. + +name: OpenShift + +env: + # 🖊️ EDIT your repository secrets to log into your OpenShift cluster and set up the context. + # See https://github.com/redhat-actions/oc-login#readme for how to retrieve these values. + # To get a permanent token, refer to https://github.com/redhat-actions/oc-login/wiki/Using-a-Service-Account-for-GitHub-Actions + OPENSHIFT_SERVER: ${{ secrets.OPENSHIFT_SERVER }} + OPENSHIFT_TOKEN: ${{ secrets.OPENSHIFT_TOKEN }} + # 🖊️ EDIT to set the kube context's namespace after login. Leave blank to use your user's default namespace. + OPENSHIFT_NAMESPACE: "" + + # 🖊️ EDIT to set a name for your OpenShift app, or a default one will be generated below. + APP_NAME: "" + + # 🖊️ EDIT with the port your application should be accessible on. + # If the container image exposes *exactly one* port, this can be left blank. + # Refer to the 'port' input of https://github.com/redhat-actions/oc-new-app + APP_PORT: "" + + # 🖊️ EDIT to change the image registry settings. + # Registries such as GHCR, Quay.io, and Docker Hub are supported. + IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }} + IMAGE_REGISTRY_USER: ${{ github.actor }} + IMAGE_REGISTRY_PASSWORD: ${{ github.token }} + + # 🖊️ EDIT to specify custom tags for the container image, or default tags will be generated below. + IMAGE_TAGS: "" + +on: + # https://docs.github.com/en/actions/reference/events-that-trigger-workflows + push: + # Edit to the branch(es) you want to build and deploy on each push. + branches: [ master ] + +jobs: + openshift-ci-cd: + name: Build and deploy to OpenShift + # ubuntu-20.04 can also be used. + runs-on: ubuntu-18.04 + environment: production + + outputs: + ROUTE: ${{ steps.deploy-and-expose.outputs.route }} + SELECTOR: ${{ steps.deploy-and-expose.outputs.selector }} + + steps: + - name: Check for required secrets + uses: actions/github-script@v6 + with: + script: | + const secrets = { + OPENSHIFT_SERVER: `${{ secrets.OPENSHIFT_SERVER }}`, + OPENSHIFT_TOKEN: `${{ secrets.OPENSHIFT_TOKEN }}`, + }; + + const GHCR = "ghcr.io"; + if (`${{ env.IMAGE_REGISTRY }}`.startsWith(GHCR)) { + core.info(`Image registry is ${GHCR} - no registry password required`); + } + else { + core.info("A registry password is required"); + secrets["IMAGE_REGISTRY_PASSWORD"] = `${{ secrets.IMAGE_REGISTRY_PASSWORD }}`; + } + + const missingSecrets = Object.entries(secrets).filter(([ name, value ]) => { + if (value.length === 0) { + core.error(`Secret "${name}" is not set`); + return true; + } + core.info(`✔️ Secret "${name}" is set`); + return false; + }); + + if (missingSecrets.length > 0) { + core.setFailed(`❌ At least one required secret is not set in the repository. \n` + + "You can add it using:\n" + + "GitHub UI: https://docs.github.com/en/actions/reference/encrypted-secrets#creating-encrypted-secrets-for-a-repository \n" + + "GitHub CLI: https://cli.github.com/manual/gh_secret_set \n" + + "Also, refer to https://github.com/redhat-actions/oc-login#getting-started-with-the-action-or-see-example"); + } + else { + core.info(`✅ All the required secrets are set`); + } + + - name: Check out repository + uses: actions/checkout@v3 + + - name: Determine app name + if: env.APP_NAME == '' + run: | + echo "APP_NAME=$(basename $PWD)" | tee -a $GITHUB_ENV + + - name: Determine image tags + if: env.IMAGE_TAGS == '' + run: | + echo "IMAGE_TAGS=latest ${GITHUB_SHA::12}" | tee -a $GITHUB_ENV + + # https://github.com/redhat-actions/buildah-build#readme + - name: Build from Dockerfile + id: build-image + uses: redhat-actions/buildah-build@v2 + with: + image: ${{ env.APP_NAME }} + tags: ${{ env.IMAGE_TAGS }} + + # If you don't have a Dockerfile/Containerfile, refer to https://github.com/redhat-actions/buildah-build#scratch-build-inputs + # Or, perform a source-to-image build using https://github.com/redhat-actions/s2i-build + # Otherwise, point this to your Dockerfile/Containerfile relative to the repository root. + dockerfiles: | + ./Dockerfile + + # https://github.com/redhat-actions/push-to-registry#readme + - name: Push to registry + id: push-image + uses: redhat-actions/push-to-registry@v2 + with: + image: ${{ steps.build-image.outputs.image }} + tags: ${{ steps.build-image.outputs.tags }} + registry: ${{ env.IMAGE_REGISTRY }} + username: ${{ env.IMAGE_REGISTRY_USER }} + password: ${{ env.IMAGE_REGISTRY_PASSWORD }} + + # The path the image was pushed to is now stored in ${{ steps.push-image.outputs.registry-path }} + + - name: Install oc + uses: redhat-actions/openshift-tools-installer@v1 + with: + oc: 4 + + # https://github.com/redhat-actions/oc-login#readme + - name: Log in to OpenShift + uses: redhat-actions/oc-login@v1 + with: + openshift_server_url: ${{ env.OPENSHIFT_SERVER }} + openshift_token: ${{ env.OPENSHIFT_TOKEN }} + insecure_skip_tls_verify: true + namespace: ${{ env.OPENSHIFT_NAMESPACE }} + + # This step should create a deployment, service, and route to run your app and expose it to the internet. + # https://github.com/redhat-actions/oc-new-app#readme + - name: Create and expose app + id: deploy-and-expose + uses: redhat-actions/oc-new-app@v1 + with: + app_name: ${{ env.APP_NAME }} + image: ${{ steps.push-image.outputs.registry-path }} + namespace: ${{ env.OPENSHIFT_NAMESPACE }} + port: ${{ env.APP_PORT }} + + - name: Print application URL + env: + ROUTE: ${{ steps.deploy-and-expose.outputs.route }} + SELECTOR: ${{ steps.deploy-and-expose.outputs.selector }} + run: | + [[ -n ${{ env.ROUTE }} ]] || (echo "Determining application route failed in previous step"; exit 1) + echo + echo "======================== Your application is available at: ========================" + echo ${{ env.ROUTE }} + echo "===================================================================================" + echo + echo "Your app can be taken down with: \"oc delete all --selector='${{ env.SELECTOR }}'\"" diff --git a/.github/workflows/ossar-analysis.yml b/.github/workflows/ossar-analysis.yml index 460c678..2ab5a2f 100644 --- a/.github/workflows/ossar-analysis.yml +++ b/.github/workflows/ossar-analysis.yml @@ -1,44 +1,44 @@ -# This workflow integrates a collection of open source static analysis tools -# with GitHub code scanning. For documentation, or to provide feedback, visit -# https://github.com/github/ossar-action -name: OSSAR - -on: - push: - branches: [ master ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ master ] - schedule: - - cron: '39 16 * * 6' - -jobs: - OSSAR-Scan: - # OSSAR runs on windows-latest. - # ubuntu-latest and macos-latest support coming soon - runs-on: windows-latest - - steps: - - name: Checkout repository - uses: actions/checkout@v3 - - # Ensure a compatible version of dotnet is installed. - # The [Microsoft Security Code Analysis CLI](https://aka.ms/mscadocs) is built with dotnet v3.1.201. - # A version greater than or equal to v3.1.201 of dotnet must be installed on the agent in order to run this action. - # GitHub hosted runners already have a compatible version of dotnet installed and this step may be skipped. - # For self-hosted runners, ensure dotnet version 3.1.201 or later is installed by including this action: - # - name: Install .NET - # uses: actions/setup-dotnet@v1 - # with: - # dotnet-version: '3.1.x' - - # Run open source static analysis tools - - name: Run OSSAR - uses: github/ossar-action@v1 - id: ossar - - # Upload results to the Security tab - - name: Upload OSSAR results - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: ${{ steps.ossar.outputs.sarifFile }} +# This workflow integrates a collection of open source static analysis tools +# with GitHub code scanning. For documentation, or to provide feedback, visit +# https://github.com/github/ossar-action +name: OSSAR + +on: + push: + branches: [ master ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ master ] + schedule: + - cron: '39 16 * * 6' + +jobs: + OSSAR-Scan: + # OSSAR runs on windows-latest. + # ubuntu-latest and macos-latest support coming soon + runs-on: windows-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v3 + + # Ensure a compatible version of dotnet is installed. + # The [Microsoft Security Code Analysis CLI](https://aka.ms/mscadocs) is built with dotnet v3.1.201. + # A version greater than or equal to v3.1.201 of dotnet must be installed on the agent in order to run this action. + # GitHub hosted runners already have a compatible version of dotnet installed and this step may be skipped. + # For self-hosted runners, ensure dotnet version 3.1.201 or later is installed by including this action: + # - name: Install .NET + # uses: actions/setup-dotnet@v1 + # with: + # dotnet-version: '3.1.x' + + # Run open source static analysis tools + - name: Run OSSAR + uses: github/ossar-action@v1 + id: ossar + + # Upload results to the Security tab + - name: Upload OSSAR results + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: ${{ steps.ossar.outputs.sarifFile }} diff --git a/.github/workflows/ossar.yml b/.github/workflows/ossar.yml index c86ca2a..79feada 100644 --- a/.github/workflows/ossar.yml +++ b/.github/workflows/ossar.yml @@ -1,59 +1,59 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -# This workflow integrates a collection of open source static analysis tools -# with GitHub code scanning. For documentation, or to provide feedback, visit -# https://github.com/github/ossar-action -name: OSSAR - -on: - push: - branches: [ master ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ master ] - schedule: - - cron: '22 3 * * 1' - -permissions: - contents: read - -jobs: - OSSAR-Scan: - # OSSAR runs on windows-latest. - # ubuntu-latest and macos-latest support coming soon - permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - runs-on: windows-latest - - steps: - - name: Checkout repository - uses: actions/checkout@v3 - - # Ensure a compatible version of dotnet is installed. - # The [Microsoft Security Code Analysis CLI](https://aka.ms/mscadocs) is built with dotnet v3.1.201. - # A version greater than or equal to v3.1.201 of dotnet must be installed on the agent in order to run this action. - # GitHub hosted runners already have a compatible version of dotnet installed and this step may be skipped. - # For self-hosted runners, ensure dotnet version 3.1.201 or later is installed by including this action: - # - name: Install .NET - # uses: actions/setup-dotnet@v2 - # with: - # dotnet-version: '3.1.x' - - # Run open source static analysis tools - - name: Run OSSAR - uses: github/ossar-action@v1 - id: ossar - - # Upload results to the Security tab - - name: Upload OSSAR results - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: ${{ steps.ossar.outputs.sarifFile }} - - name: Upload coverage reports to Codecov - uses: codecov/codecov-action@v3 - env: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# This workflow integrates a collection of open source static analysis tools +# with GitHub code scanning. For documentation, or to provide feedback, visit +# https://github.com/github/ossar-action +name: OSSAR + +on: + push: + branches: [ master ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ master ] + schedule: + - cron: '22 3 * * 1' + +permissions: + contents: read + +jobs: + OSSAR-Scan: + # OSSAR runs on windows-latest. + # ubuntu-latest and macos-latest support coming soon + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + runs-on: windows-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v3 + + # Ensure a compatible version of dotnet is installed. + # The [Microsoft Security Code Analysis CLI](https://aka.ms/mscadocs) is built with dotnet v3.1.201. + # A version greater than or equal to v3.1.201 of dotnet must be installed on the agent in order to run this action. + # GitHub hosted runners already have a compatible version of dotnet installed and this step may be skipped. + # For self-hosted runners, ensure dotnet version 3.1.201 or later is installed by including this action: + # - name: Install .NET + # uses: actions/setup-dotnet@v2 + # with: + # dotnet-version: '3.1.x' + + # Run open source static analysis tools + - name: Run OSSAR + uses: github/ossar-action@v1 + id: ossar + + # Upload results to the Security tab + - name: Upload OSSAR results + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: ${{ steps.ossar.outputs.sarifFile }} + - name: Upload coverage reports to Codecov + uses: codecov/codecov-action@v3 + env: + CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} diff --git a/.github/workflows/pmd.yml b/.github/workflows/pmd.yml index ecc70d7..b92e7ef 100644 --- a/.github/workflows/pmd.yml +++ b/.github/workflows/pmd.yml @@ -1,46 +1,46 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -name: pmd - -on: - push: - branches: [ master ] - pull_request: - branches: [ master ] - schedule: - - cron: '15 8 * * 1' - -permissions: - contents: read - -jobs: - pmd-code-scan: - permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v3 - - name: Set up JDK 11 - uses: actions/setup-java@v3 - with: - java-version: '11' - distribution: 'temurin' - - name: Run PMD - id: pmd - uses: pmd/pmd-github-action@26c0078b0f7ddbdd322f83d28cfd0eaf6985ab6c - with: - rulesets: 'rulesets/java/quickstart.xml' - sourcePath: 'src/main/java' - analyzeModifiedFilesOnly: false - - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: pmd-report.sarif - - name: Upload coverage reports to Codecov - uses: codecov/codecov-action@v3 - env: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +name: pmd + +on: + push: + branches: [ master ] + pull_request: + branches: [ master ] + schedule: + - cron: '15 8 * * 1' + +permissions: + contents: read + +jobs: + pmd-code-scan: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v3 + - name: Set up JDK 11 + uses: actions/setup-java@v3 + with: + java-version: '11' + distribution: 'temurin' + - name: Run PMD + id: pmd + uses: pmd/pmd-github-action@26c0078b0f7ddbdd322f83d28cfd0eaf6985ab6c + with: + rulesets: 'rulesets/java/quickstart.xml' + sourcePath: 'src/main/java' + analyzeModifiedFilesOnly: false + - name: Upload SARIF file + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: pmd-report.sarif + - name: Upload coverage reports to Codecov + uses: codecov/codecov-action@v3 + env: + CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} diff --git a/.github/workflows/powershell.yml b/.github/workflows/powershell.yml index 528c153..7093036 100644 --- a/.github/workflows/powershell.yml +++ b/.github/workflows/powershell.yml @@ -1,52 +1,52 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. -# -# https://github.com/microsoft/action-psscriptanalyzer -# For more information on PSScriptAnalyzer in general, see -# https://github.com/PowerShell/PSScriptAnalyzer - -name: PSScriptAnalyzer - -on: - push: - branches: [ master ] - pull_request: - branches: [ master ] - schedule: - - cron: '31 9 * * 3' - -permissions: - contents: read - -jobs: - build: - permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - name: PSScriptAnalyzer - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v3 - - - name: Run PSScriptAnalyzer - uses: microsoft/psscriptanalyzer-action@7a0da25f33985767f15f93140306528900744195 - with: - # Check https://github.com/microsoft/action-psscriptanalyzer for more info about the options. - # The below set up runs PSScriptAnalyzer to your entire repository and runs some basic security rules. - path: .\ - recurse: true - # Include your own basic security rules. Removing this option will run all the rules - includeRule: '"PSAvoidGlobalAliases", "PSAvoidUsingConvertToSecureStringWithPlainText"' - output: results.sarif - - # Upload the SARIF file generated in the previous step - - name: Upload SARIF results file - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: results.sarif - - name: Upload coverage reports to Codecov - uses: codecov/codecov-action@v3 - env: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. +# +# https://github.com/microsoft/action-psscriptanalyzer +# For more information on PSScriptAnalyzer in general, see +# https://github.com/PowerShell/PSScriptAnalyzer + +name: PSScriptAnalyzer + +on: + push: + branches: [ master ] + pull_request: + branches: [ master ] + schedule: + - cron: '31 9 * * 3' + +permissions: + contents: read + +jobs: + build: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + name: PSScriptAnalyzer + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v3 + + - name: Run PSScriptAnalyzer + uses: microsoft/psscriptanalyzer-action@7a0da25f33985767f15f93140306528900744195 + with: + # Check https://github.com/microsoft/action-psscriptanalyzer for more info about the options. + # The below set up runs PSScriptAnalyzer to your entire repository and runs some basic security rules. + path: .\ + recurse: true + # Include your own basic security rules. Removing this option will run all the rules + includeRule: '"PSAvoidGlobalAliases", "PSAvoidUsingConvertToSecureStringWithPlainText"' + output: results.sarif + + # Upload the SARIF file generated in the previous step + - name: Upload SARIF results file + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: results.sarif + - name: Upload coverage reports to Codecov + uses: codecov/codecov-action@v3 + env: + CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} diff --git a/.github/workflows/python-app.yml b/.github/workflows/python-app.yml index 764e519..20e58e9 100644 --- a/.github/workflows/python-app.yml +++ b/.github/workflows/python-app.yml @@ -1,36 +1,36 @@ -# This workflow will install Python dependencies, run tests and lint with a single version of Python -# For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions - -name: Python application - -on: - push: - branches: [ master ] - pull_request: - branches: [ master ] - -jobs: - build: - - runs-on: ubuntu-latest - - steps: - - uses: actions/checkout@v3 - - name: Set up Python 3.9 - uses: actions/setup-python@v4 - with: - python-version: 3.9 - - name: Install dependencies - run: | - python -m pip install --upgrade pip - pip install flake8 pytest - if [ -f requirements.txt ]; then pip install -r requirements.txt; fi - - name: Lint with flake8 - run: | - # stop the build if there are Python syntax errors or undefined names - flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics - # exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide - flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics - - name: Test with pytest - run: | - pytest +# This workflow will install Python dependencies, run tests and lint with a single version of Python +# For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions + +name: Python application + +on: + push: + branches: [ master ] + pull_request: + branches: [ master ] + +jobs: + build: + + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v3 + - name: Set up Python 3.9 + uses: actions/setup-python@v4 + with: + python-version: 3.9 + - name: Install dependencies + run: | + python -m pip install --upgrade pip + pip install flake8 pytest + if [ -f requirements.txt ]; then pip install -r requirements.txt; fi + - name: Lint with flake8 + run: | + # stop the build if there are Python syntax errors or undefined names + flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics + # exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide + flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics + - name: Test with pytest + run: | + pytest diff --git a/.github/workflows/rubocop.yml b/.github/workflows/rubocop.yml index e5fb460..b9decee 100644 --- a/.github/workflows/rubocop.yml +++ b/.github/workflows/rubocop.yml @@ -1,52 +1,52 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -# pulled from repo -name: "Rubocop" - -on: - push: - branches: [ master ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ master ] - schedule: - - cron: '34 23 * * 6' - -jobs: - rubocop: - runs-on: ubuntu-latest - strategy: - fail-fast: false - - steps: - - name: Checkout repository - uses: actions/checkout@v3 - - # If running on a self-hosted runner, check it meets the requirements - # listed at https://github.com/ruby/setup-ruby#using-self-hosted-runners - - name: Set up Ruby - uses: ruby/setup-ruby@250fcd6a742febb1123a77a841497ccaa8b9e939 - with: - ruby-version: 2.6 - - # This step is not necessary if you add the gem to your Gemfile - - name: Install Code Scanning integration - run: bundle add code-scanning-rubocop --version 0.3.0 --skip-install - - - name: Install dependencies - run: bundle install - - - name: Rubocop run - run: | - bash -c " - bundle exec rubocop --require code_scanning --format CodeScanning::SarifFormatter -o rubocop.sarif - [[ $? -ne 2 ]] - " - - - name: Upload Sarif output - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: rubocop.sarif +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# pulled from repo +name: "Rubocop" + +on: + push: + branches: [ master ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ master ] + schedule: + - cron: '34 23 * * 6' + +jobs: + rubocop: + runs-on: ubuntu-latest + strategy: + fail-fast: false + + steps: + - name: Checkout repository + uses: actions/checkout@v3 + + # If running on a self-hosted runner, check it meets the requirements + # listed at https://github.com/ruby/setup-ruby#using-self-hosted-runners + - name: Set up Ruby + uses: ruby/setup-ruby@250fcd6a742febb1123a77a841497ccaa8b9e939 + with: + ruby-version: 2.6 + + # This step is not necessary if you add the gem to your Gemfile + - name: Install Code Scanning integration + run: bundle add code-scanning-rubocop --version 0.3.0 --skip-install + + - name: Install dependencies + run: bundle install + + - name: Rubocop run + run: | + bash -c " + bundle exec rubocop --require code_scanning --format CodeScanning::SarifFormatter -o rubocop.sarif + [[ $? -ne 2 ]] + " + + - name: Upload Sarif output + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: rubocop.sarif diff --git a/.github/workflows/rust-clippy.yml b/.github/workflows/rust-clippy.yml index 6603848..c692045 100644 --- a/.github/workflows/rust-clippy.yml +++ b/.github/workflows/rust-clippy.yml @@ -1,59 +1,59 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. -# rust-clippy is a tool that runs a bunch of lints to catch common -# mistakes in your Rust code and help improve your Rust code. -# More details at https://github.com/rust-lang/rust-clippy -# and https://rust-lang.github.io/rust-clippy/ - -name: rust-clippy analyze - -on: - push: - branches: [ master ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ master ] - schedule: - - cron: '19 8 * * 5' - -jobs: - rust-clippy-analyze: - name: Run rust-clippy analyzing - runs-on: ubuntu-latest - permissions: - contents: read - security-events: write - steps: - - name: Checkout code - uses: actions/checkout@v3 - - - name: Install Rust toolchain - uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1 - with: - profile: minimal - toolchain: stable - components: clippy - override: true - - - name: Install required cargo - run: cargo install clippy-sarif sarif-fmt - - - name: Run rust-clippy - run: - cargo clippy - --all-features - --message-format=json | clippy-sarif | tee rust-clippy-results.sarif | sarif-fmt - continue-on-error: true - - - name: Upload analysis results to GitHub - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: rust-clippy-results.sarif - wait-for-processing: true - - - name: Upload coverage reports to Codecov - uses: codecov/codecov-action@v3 - env: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. +# rust-clippy is a tool that runs a bunch of lints to catch common +# mistakes in your Rust code and help improve your Rust code. +# More details at https://github.com/rust-lang/rust-clippy +# and https://rust-lang.github.io/rust-clippy/ + +name: rust-clippy analyze + +on: + push: + branches: [ master ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ master ] + schedule: + - cron: '19 8 * * 5' + +jobs: + rust-clippy-analyze: + name: Run rust-clippy analyzing + runs-on: ubuntu-latest + permissions: + contents: read + security-events: write + steps: + - name: Checkout code + uses: actions/checkout@v3 + + - name: Install Rust toolchain + uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1 + with: + profile: minimal + toolchain: stable + components: clippy + override: true + + - name: Install required cargo + run: cargo install clippy-sarif sarif-fmt + + - name: Run rust-clippy + run: + cargo clippy + --all-features + --message-format=json | clippy-sarif | tee rust-clippy-results.sarif | sarif-fmt + continue-on-error: true + + - name: Upload analysis results to GitHub + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: rust-clippy-results.sarif + wait-for-processing: true + + - name: Upload coverage reports to Codecov + uses: codecov/codecov-action@v3 + env: + CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index 3e77b92..6775364 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -1,55 +1,55 @@ -name: Scorecards supply-chain security -on: - # Only the default branch is supported. - branch_protection_rule: - schedule: - - cron: '35 8 * * 1' - push: - branches: [ master ] - -# Declare default permissions as read only. -permissions: read-all - -jobs: - analysis: - name: Scorecards analysis - runs-on: ubuntu-latest - permissions: - # Needed to upload the results to code-scanning dashboard. - security-events: write - actions: read - contents: read - - steps: - - name: "Checkout code" - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 - with: - persist-credentials: false - - - name: "Run analysis" - uses: ossf/scorecard-action@08b4669551908b1024bb425080c797723083c031 # v2.2.0 - with: - results_file: results.sarif - results_format: sarif - # Read-only PAT token. To create it, - # follow the steps in https://github.com/ossf/scorecard-action#pat-token-creation. - repo_token: ${{ secrets.SCORECARD_READ_TOKEN }} - # Publish the results to enable scorecard badges. For more details, see - # https://github.com/ossf/scorecard-action#publishing-results. - # For private repositories, `publish_results` will automatically be set to `false`, - # regardless of the value entered here. - publish_results: true - - # Upload the results as artifacts (optional). - - name: "Upload artifact" - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2 - with: - name: SARIF file - path: results.sarif - retention-days: 5 - - # Upload the results to GitHub's code scanning dashboard. - - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@004c5de30b6423267685b897a3d595e944f7fed5 # v2.20.2 - with: - sarif_file: results.sarif +name: Scorecards supply-chain security +on: + # Only the default branch is supported. + branch_protection_rule: + schedule: + - cron: '35 8 * * 1' + push: + branches: [ master ] + +# Declare default permissions as read only. +permissions: read-all + +jobs: + analysis: + name: Scorecards analysis + runs-on: ubuntu-latest + permissions: + # Needed to upload the results to code-scanning dashboard. + security-events: write + actions: read + contents: read + + steps: + - name: "Checkout code" + uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 + with: + persist-credentials: false + + - name: "Run analysis" + uses: ossf/scorecard-action@08b4669551908b1024bb425080c797723083c031 # v2.2.0 + with: + results_file: results.sarif + results_format: sarif + # Read-only PAT token. To create it, + # follow the steps in https://github.com/ossf/scorecard-action#pat-token-creation. + repo_token: ${{ secrets.SCORECARD_READ_TOKEN }} + # Publish the results to enable scorecard badges. For more details, see + # https://github.com/ossf/scorecard-action#publishing-results. + # For private repositories, `publish_results` will automatically be set to `false`, + # regardless of the value entered here. + publish_results: true + + # Upload the results as artifacts (optional). + - name: "Upload artifact" + uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2 + with: + name: SARIF file + path: results.sarif + retention-days: 5 + + # Upload the results to GitHub's code scanning dashboard. + - name: "Upload to code-scanning" + uses: github/codeql-action/upload-sarif@004c5de30b6423267685b897a3d595e944f7fed5 # v2.20.2 + with: + sarif_file: results.sarif diff --git a/.github/workflows/securitycodescan.yml b/.github/workflows/securitycodescan.yml index c47254c..d53247d 100644 --- a/.github/workflows/securitycodescan.yml +++ b/.github/workflows/securitycodescan.yml @@ -1,41 +1,41 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -# This workflow integrates SecurityCodeScan with GitHub's Code Scanning feature -# SecurityCodeScan is a vulnerability patterns detector for C# and VB.NET - -name: SecurityCodeScan - -on: - push: - branches: [ master ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ master ] - schedule: - - cron: '35 12 * * 2' - -jobs: - SCS: - runs-on: windows-latest - steps: - - uses: actions/checkout@v3 - - uses: nuget/setup-nuget@296fd3ccf8528660c91106efefe2364482f86d6f - - uses: microsoft/setup-msbuild@v1.3.1 - - - name: Set up projects for analysis - uses: security-code-scan/security-code-scan-add-action@2439fb4aaeda4ad590a7c8bde327d159d03875fd - - - name: Restore dependencies - run: dotnet restore - - - name: Build - run: dotnet build --no-restore - - - name: Convert sarif for uploading to GitHub - uses: security-code-scan/security-code-scan-results-action@579058214e4be88ce9eea302f1fb74df1b8bc1ed - - - name: Upload sarif - uses: github/codeql-action/upload-sarif@v2 +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# This workflow integrates SecurityCodeScan with GitHub's Code Scanning feature +# SecurityCodeScan is a vulnerability patterns detector for C# and VB.NET + +name: SecurityCodeScan + +on: + push: + branches: [ master ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ master ] + schedule: + - cron: '35 12 * * 2' + +jobs: + SCS: + runs-on: windows-latest + steps: + - uses: actions/checkout@v3 + - uses: nuget/setup-nuget@296fd3ccf8528660c91106efefe2364482f86d6f + - uses: microsoft/setup-msbuild@v1.3.1 + + - name: Set up projects for analysis + uses: security-code-scan/security-code-scan-add-action@2439fb4aaeda4ad590a7c8bde327d159d03875fd + + - name: Restore dependencies + run: dotnet restore + + - name: Build + run: dotnet build --no-restore + + - name: Convert sarif for uploading to GitHub + uses: security-code-scan/security-code-scan-results-action@579058214e4be88ce9eea302f1fb74df1b8bc1ed + + - name: Upload sarif + uses: github/codeql-action/upload-sarif@v2 diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index ed26c02..2d6b88a 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -1,52 +1,52 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -# This workflow file requires a free account on Semgrep.dev to -# manage rules, file ignores, notifications, and more. -# -# See https://semgrep.dev/docs - -name: Semgrep - -on: - push: - branches: [ master ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ master ] - schedule: - - cron: '36 7 * * 3' - -permissions: - contents: read - -jobs: - semgrep: - permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - name: Scan - runs-on: ubuntu-latest - steps: - # Checkout project source - - uses: actions/checkout@v3 - - # Scan code using project's configuration on https://semgrep.dev/manage - - uses: returntocorp/semgrep-action@316a1751c53ffb6689b8726910e8204ffb591b4f - with: - publishToken: ${{ secrets.SEMGREP_APP_TOKEN }} - publishDeployment: ${{ secrets.SEMGREP_DEPLOYMENT_ID }} - generateSarif: "1" - - # Upload SARIF file generated in previous step - - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: semgrep.sarif - if: always() - - name: Upload coverage reports to Codecov - uses: codecov/codecov-action@v3 - env: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# This workflow file requires a free account on Semgrep.dev to +# manage rules, file ignores, notifications, and more. +# +# See https://semgrep.dev/docs + +name: Semgrep + +on: + push: + branches: [ master ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ master ] + schedule: + - cron: '36 7 * * 3' + +permissions: + contents: read + +jobs: + semgrep: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + name: Scan + runs-on: ubuntu-latest + steps: + # Checkout project source + - uses: actions/checkout@v3 + + # Scan code using project's configuration on https://semgrep.dev/manage + - uses: returntocorp/semgrep-action@316a1751c53ffb6689b8726910e8204ffb591b4f + with: + publishToken: ${{ secrets.SEMGREP_APP_TOKEN }} + publishDeployment: ${{ secrets.SEMGREP_DEPLOYMENT_ID }} + generateSarif: "1" + + # Upload SARIF file generated in previous step + - name: Upload SARIF file + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: semgrep.sarif + if: always() + - name: Upload coverage reports to Codecov + uses: codecov/codecov-action@v3 + env: + CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} diff --git a/.github/workflows/snyk-container.yml b/.github/workflows/snyk-container.yml index bc3ab94..f40bddf 100644 --- a/.github/workflows/snyk-container.yml +++ b/.github/workflows/snyk-container.yml @@ -1,54 +1,54 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -# A sample workflow which checks out the code, builds a container -# image using Docker and scans that image for vulnerabilities using -# Snyk. The results are then uploaded to GitHub Security Code Scanning -# -# For more examples, including how to limit scans to only high-severity -# issues, monitor images for newly disclosed vulnerabilities in Snyk and -# fail PR checks for new vulnerabilities, see https://github.com/snyk/actions/ - -name: Snyk Container - -on: - push: - branches: [ master ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ master ] - schedule: - - cron: '16 1 * * 0' - -permissions: - contents: read - -jobs: - snyk: - permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v3 - - name: Build a Docker image - run: docker build -t your/image-to-test . - - name: Run Snyk to check Docker image for vulnerabilities - # Snyk can be used to break the build when it detects vulnerabilities. - # In this case we want to upload the issues to GitHub Code Scanning - continue-on-error: true - uses: snyk/actions/docker@87b58602664ec2c1c4fd286e2dcf71f2c5a331d6 - env: - # In order to use the Snyk Action you will need to have a Snyk API token. - # More details in https://github.com/snyk/actions#getting-your-snyk-token - # or you can signup for free at https://snyk.io/login - SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} - with: - image: your/image-to-test - args: --file=Dockerfile - - name: Upload result to GitHub Code Scanning - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: snyk.sarif +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# A sample workflow which checks out the code, builds a container +# image using Docker and scans that image for vulnerabilities using +# Snyk. The results are then uploaded to GitHub Security Code Scanning +# +# For more examples, including how to limit scans to only high-severity +# issues, monitor images for newly disclosed vulnerabilities in Snyk and +# fail PR checks for new vulnerabilities, see https://github.com/snyk/actions/ + +name: Snyk Container + +on: + push: + branches: [ master ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ master ] + schedule: + - cron: '16 1 * * 0' + +permissions: + contents: read + +jobs: + snyk: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v3 + - name: Build a Docker image + run: docker build -t your/image-to-test . + - name: Run Snyk to check Docker image for vulnerabilities + # Snyk can be used to break the build when it detects vulnerabilities. + # In this case we want to upload the issues to GitHub Code Scanning + continue-on-error: true + uses: snyk/actions/docker@87b58602664ec2c1c4fd286e2dcf71f2c5a331d6 + env: + # In order to use the Snyk Action you will need to have a Snyk API token. + # More details in https://github.com/snyk/actions#getting-your-snyk-token + # or you can signup for free at https://snyk.io/login + SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} + with: + image: your/image-to-test + args: --file=Dockerfile + - name: Upload result to GitHub Code Scanning + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: snyk.sarif diff --git a/.github/workflows/snyk-infrastructure.yml b/.github/workflows/snyk-infrastructure.yml index 10dcd72..c86ff72 100644 --- a/.github/workflows/snyk-infrastructure.yml +++ b/.github/workflows/snyk-infrastructure.yml @@ -1,53 +1,53 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -# A sample workflow which checks out your Infrastructure as Code Configuration files, -# such as Kubernetes, Helm & Terraform and scans them for any security issues. -# The results are then uploaded to GitHub Security Code Scanning -# -# For more examples, including how to limit scans to only high-severity issues -# and fail PR checks, see https://github.com/snyk/actions/ - -name: Snyk Infrastructure as Code - -on: - push: - branches: [ master ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ master ] - schedule: - - cron: '32 1 * * 6' - -permissions: - contents: read - -jobs: - snyk: - permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v3 - - name: Run Snyk to check configuration files for security issues - # Snyk can be used to break the build when it detects security issues. - # In this case we want to upload the issues to GitHub Code Scanning - continue-on-error: true - uses: snyk/actions/iac@87b58602664ec2c1c4fd286e2dcf71f2c5a331d6 - env: - # In order to use the Snyk Action you will need to have a Snyk API token. - # More details in https://github.com/snyk/actions#getting-your-snyk-token - # or you can signup for free at https://snyk.io/login - SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} - with: - # Add the path to the configuration file that you would like to test. - # For example `deployment.yaml` for a Kubernetes deployment manifest - # or `main.tf` for a Terraform configuration file - file: your-file-to-test.yaml - - name: Upload result to GitHub Code Scanning - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: snyk.sarif +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# A sample workflow which checks out your Infrastructure as Code Configuration files, +# such as Kubernetes, Helm & Terraform and scans them for any security issues. +# The results are then uploaded to GitHub Security Code Scanning +# +# For more examples, including how to limit scans to only high-severity issues +# and fail PR checks, see https://github.com/snyk/actions/ + +name: Snyk Infrastructure as Code + +on: + push: + branches: [ master ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ master ] + schedule: + - cron: '32 1 * * 6' + +permissions: + contents: read + +jobs: + snyk: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v3 + - name: Run Snyk to check configuration files for security issues + # Snyk can be used to break the build when it detects security issues. + # In this case we want to upload the issues to GitHub Code Scanning + continue-on-error: true + uses: snyk/actions/iac@87b58602664ec2c1c4fd286e2dcf71f2c5a331d6 + env: + # In order to use the Snyk Action you will need to have a Snyk API token. + # More details in https://github.com/snyk/actions#getting-your-snyk-token + # or you can signup for free at https://snyk.io/login + SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} + with: + # Add the path to the configuration file that you would like to test. + # For example `deployment.yaml` for a Kubernetes deployment manifest + # or `main.tf` for a Terraform configuration file + file: your-file-to-test.yaml + - name: Upload result to GitHub Code Scanning + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: snyk.sarif diff --git a/.github/workflows/sobelow.yml b/.github/workflows/sobelow.yml index ac0a75b..cbfc298 100644 --- a/.github/workflows/sobelow.yml +++ b/.github/workflows/sobelow.yml @@ -1,40 +1,40 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. -# -# Sobelow is a security-focused static analysis tool for the Phoenix framework. https://sobelow.io/ -# -# To use this workflow, you must have GitHub Advanced Security (GHAS) enabled for your repository. -# -# Instructions: -# 2. Follow the annotated workflow below and make any necessary modifications then save the workflow to your repository -# and review the "Security" tab once the action has run. -name: Sobelow - -on: - push: - branches: [ master ] - pull_request: - branches: [ master ] - schedule: - - cron: '45 13 * * 2' - -permissions: - contents: read - -jobs: - security-scan: - permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - runs-on: ubuntu-latest - - steps: - - uses: actions/checkout@v3 - - id: run-action - uses: sobelow/action@85a7af55ecfe77cbecbae704398af72df079165e - - name: Upload report - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: results.sarif +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. +# +# Sobelow is a security-focused static analysis tool for the Phoenix framework. https://sobelow.io/ +# +# To use this workflow, you must have GitHub Advanced Security (GHAS) enabled for your repository. +# +# Instructions: +# 2. Follow the annotated workflow below and make any necessary modifications then save the workflow to your repository +# and review the "Security" tab once the action has run. +name: Sobelow + +on: + push: + branches: [ master ] + pull_request: + branches: [ master ] + schedule: + - cron: '45 13 * * 2' + +permissions: + contents: read + +jobs: + security-scan: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v3 + - id: run-action + uses: sobelow/action@85a7af55ecfe77cbecbae704398af72df079165e + - name: Upload report + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: results.sarif diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml index fcb8a91..72018af 100644 --- a/.github/workflows/sonarcloud.yml +++ b/.github/workflows/sonarcloud.yml @@ -1,68 +1,68 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -# This workflow helps you trigger a SonarCloud analysis of your code and populates -# GitHub Code Scanning alerts with the vulnerabilities found. -# Free for open source project. - -# 1. Login to SonarCloud.io using your GitHub account - -# 2. Import your project on SonarCloud -# * Add your GitHub organization first, then add your repository as a new project. -# * Please note that many languages are eligible for automatic analysis, -# which means that the analysis will start automatically without the need to set up GitHub Actions. -# * This behavior can be changed in Administration > Analysis Method. -# -# 3. Follow the SonarCloud in-product tutorial -# * a. Copy/paste the Project Key and the Organization Key into the args parameter below -# (You'll find this information in SonarCloud. Click on "Information" at the bottom left) -# -# * b. Generate a new token and add it to your Github repository's secrets using the name SONAR_TOKEN -# (On SonarCloud, click on your avatar on top-right > My account > Security -# or go directly to https://sonarcloud.io/account/security/) - -# Feel free to take a look at our documentation (https://docs.sonarcloud.io/getting-started/github/) -# or reach out to our community forum if you need some help (https://community.sonarsource.com/c/help/sc/9) - -name: SonarCloud analysis - -on: - push: - branches: [ master ] - pull_request: - branches: [ master ] - workflow_dispatch: - -permissions: - pull-requests: read # allows SonarCloud to decorate PRs with analysis results - -jobs: - Analysis: - runs-on: ubuntu-latest - - steps: - - name: Analyze with SonarCloud - - # You can pin the exact commit or the version. - # uses: SonarSource/sonarcloud-github-action@de2e56b42aa84d0b1c5b622644ac17e505c9a049 - uses: SonarSource/sonarcloud-github-action@9c0534dd12d09f22d69fbb301a1955249e49d910 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information - SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} # Generate a token on Sonarcloud.io, add it to the secrets of this repo with the name SONAR_TOKEN (Settings > Secrets > Actions > add new repository secret) - with: - # Additional arguments for the sonarcloud scanner - args: - # Unique keys of your project and organization. You can find them in SonarCloud > Information (bottom-left menu) - # mandatory - -Dsonar.projectKey= - -Dsonar.organization= - # Comma-separated paths to directories containing main source files. - #-Dsonar.sources= # optional, default is project base directory - # When you need the analysis to take place in a directory other than the one from which it was launched - #-Dsonar.projectBaseDir= # optional, default is . - # Comma-separated paths to directories containing test source files. - #-Dsonar.tests= # optional. For more info about Code Coverage, please refer to https://docs.sonarcloud.io/enriching/test-coverage/overview/ - # Adds more detail to both client and server-side analysis logs, activating DEBUG mode for the scanner, and adding client-side environment variables and system properties to the server-side log of analysis report processing. - #-Dsonar.verbose= # optional, default is false +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# This workflow helps you trigger a SonarCloud analysis of your code and populates +# GitHub Code Scanning alerts with the vulnerabilities found. +# Free for open source project. + +# 1. Login to SonarCloud.io using your GitHub account + +# 2. Import your project on SonarCloud +# * Add your GitHub organization first, then add your repository as a new project. +# * Please note that many languages are eligible for automatic analysis, +# which means that the analysis will start automatically without the need to set up GitHub Actions. +# * This behavior can be changed in Administration > Analysis Method. +# +# 3. Follow the SonarCloud in-product tutorial +# * a. Copy/paste the Project Key and the Organization Key into the args parameter below +# (You'll find this information in SonarCloud. Click on "Information" at the bottom left) +# +# * b. Generate a new token and add it to your Github repository's secrets using the name SONAR_TOKEN +# (On SonarCloud, click on your avatar on top-right > My account > Security +# or go directly to https://sonarcloud.io/account/security/) + +# Feel free to take a look at our documentation (https://docs.sonarcloud.io/getting-started/github/) +# or reach out to our community forum if you need some help (https://community.sonarsource.com/c/help/sc/9) + +name: SonarCloud analysis + +on: + push: + branches: [ master ] + pull_request: + branches: [ master ] + workflow_dispatch: + +permissions: + pull-requests: read # allows SonarCloud to decorate PRs with analysis results + +jobs: + Analysis: + runs-on: ubuntu-latest + + steps: + - name: Analyze with SonarCloud + + # You can pin the exact commit or the version. + # uses: SonarSource/sonarcloud-github-action@de2e56b42aa84d0b1c5b622644ac17e505c9a049 + uses: SonarSource/sonarcloud-github-action@9c0534dd12d09f22d69fbb301a1955249e49d910 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information + SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} # Generate a token on Sonarcloud.io, add it to the secrets of this repo with the name SONAR_TOKEN (Settings > Secrets > Actions > add new repository secret) + with: + # Additional arguments for the sonarcloud scanner + args: + # Unique keys of your project and organization. You can find them in SonarCloud > Information (bottom-left menu) + # mandatory + -Dsonar.projectKey= + -Dsonar.organization= + # Comma-separated paths to directories containing main source files. + #-Dsonar.sources= # optional, default is project base directory + # When you need the analysis to take place in a directory other than the one from which it was launched + #-Dsonar.projectBaseDir= # optional, default is . + # Comma-separated paths to directories containing test source files. + #-Dsonar.tests= # optional. For more info about Code Coverage, please refer to https://docs.sonarcloud.io/enriching/test-coverage/overview/ + # Adds more detail to both client and server-side analysis logs, activating DEBUG mode for the scanner, and adding client-side environment variables and system properties to the server-side log of analysis report processing. + #-Dsonar.verbose= # optional, default is false diff --git a/.github/workflows/stackhawk.yml b/.github/workflows/stackhawk.yml index 41e75cd..31cc1e8 100644 --- a/.github/workflows/stackhawk.yml +++ b/.github/workflows/stackhawk.yml @@ -1,67 +1,67 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -# 🦅 STACKHAWK https://stackhawk.com - -# The StackHawk HawkScan action makes it easy to integrate dynamic application security testing (DAST) into your -# CI pipeline. See the Getting Started guide (https://docs.stackhawk.com/hawkscan/) to get up and running with -# StackHawk quickly. - -# To use this workflow, you must: -# -# 1. Create an API Key and Application: Sign up for a free StackHawk account to obtain an API Key and -# create your first app and configuration file at https://app.stackhawk.com. -# -# 2. Save your API Key as a Secret: Save your API key as a GitHub Secret named HAWK_API_KEY. -# -# 3. Add your Config File: Add your stackhawk.yml configuration file to the base of your repository directory. -# -# 4. Set the Scan Failure Threshold: Add the hawk.failureThreshold configuration option -# (https://docs.stackhawk.com/hawkscan/configuration/#hawk) to your stackhawk.yml configuration file. If your scan -# produces alerts that meet or exceed the hawk.failureThreshold alert level, the scan will return exit code 42 -# and trigger a Code Scanning alert with a link to your scan results. -# -# 5. Update the "Start your service" Step: Update the "Start your service" step in the StackHawk workflow below to -# start your service so that it can be scanned with the "Run HawkScan" step. - - -name: "StackHawk" - -on: - push: - branches: [ master ] - pull_request: - branches: [ master ] - schedule: - - cron: '37 21 * * 1' - -permissions: - contents: read - -jobs: - stackhawk: - permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for stackhawk/hawkscan-action to upload code scanning alert info - name: StackHawk - runs-on: ubuntu-20.04 - steps: - - name: Checkout code - uses: actions/checkout@v3 - - - name: Start your service - run: ./your-service.sh & # ✏️ Update this to run your own service to be scanned - - - name: Run HawkScan - uses: stackhawk/hawkscan-action@81fe3cc71a944ab0e47e04bd41e2b42bf2ff7a4b - continue-on-error: true # ✏️ Set to false to break your build on scan errors - with: - apiKey: ${{ secrets.HAWK_API_KEY }} - codeScanningAlerts: true - githubToken: ${{ github.token }} - - name: Upload coverage reports to Codecov - uses: codecov/codecov-action@v3 - env: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# 🦅 STACKHAWK https://stackhawk.com + +# The StackHawk HawkScan action makes it easy to integrate dynamic application security testing (DAST) into your +# CI pipeline. See the Getting Started guide (https://docs.stackhawk.com/hawkscan/) to get up and running with +# StackHawk quickly. + +# To use this workflow, you must: +# +# 1. Create an API Key and Application: Sign up for a free StackHawk account to obtain an API Key and +# create your first app and configuration file at https://app.stackhawk.com. +# +# 2. Save your API Key as a Secret: Save your API key as a GitHub Secret named HAWK_API_KEY. +# +# 3. Add your Config File: Add your stackhawk.yml configuration file to the base of your repository directory. +# +# 4. Set the Scan Failure Threshold: Add the hawk.failureThreshold configuration option +# (https://docs.stackhawk.com/hawkscan/configuration/#hawk) to your stackhawk.yml configuration file. If your scan +# produces alerts that meet or exceed the hawk.failureThreshold alert level, the scan will return exit code 42 +# and trigger a Code Scanning alert with a link to your scan results. +# +# 5. Update the "Start your service" Step: Update the "Start your service" step in the StackHawk workflow below to +# start your service so that it can be scanned with the "Run HawkScan" step. + + +name: "StackHawk" + +on: + push: + branches: [ master ] + pull_request: + branches: [ master ] + schedule: + - cron: '37 21 * * 1' + +permissions: + contents: read + +jobs: + stackhawk: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for stackhawk/hawkscan-action to upload code scanning alert info + name: StackHawk + runs-on: ubuntu-20.04 + steps: + - name: Checkout code + uses: actions/checkout@v3 + + - name: Start your service + run: ./your-service.sh & # ✏️ Update this to run your own service to be scanned + + - name: Run HawkScan + uses: stackhawk/hawkscan-action@81fe3cc71a944ab0e47e04bd41e2b42bf2ff7a4b + continue-on-error: true # ✏️ Set to false to break your build on scan errors + with: + apiKey: ${{ secrets.HAWK_API_KEY }} + codeScanningAlerts: true + githubToken: ${{ github.token }} + - name: Upload coverage reports to Codecov + uses: codecov/codecov-action@v3 + env: + CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} diff --git a/.github/workflows/synopsys-io.yml b/.github/workflows/synopsys-io.yml index 3797e95..f5827df 100644 --- a/.github/workflows/synopsys-io.yml +++ b/.github/workflows/synopsys-io.yml @@ -1,77 +1,77 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -name: Synopsys Intelligent Security Scan - -on: - push: - branches: [ master ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ master ] - schedule: - - cron: '33 10 * * 4' - -jobs: - analyze: - name: Analyze - runs-on: ubuntu-latest - permissions: - actions: read - contents: read - security-events: write - - steps: - - name: Checkout repository - uses: actions/checkout@v3 - - - name: Synopsys Intelligent Security Scan - id: prescription - uses: synopsys-sig/intelligent-security-scan@33c8084571f0ad75fd2f370d7c8d10a021927599 - with: - ioServerUrl: ${{secrets.IO_SERVER_URL}} - ioServerToken: ${{secrets.IO_SERVER_TOKEN}} - workflowServerUrl: ${{secrets.WORKFLOW_SERVER_URL}} - additionalWorkflowArgs: --polaris.url=${{secrets.POLARIS_SERVER_URL}} --polaris.token=${{secrets.POLARIS_ACCESS_TOKEN}} - stage: "IO" - - # Please note that the ID in previous step was set to prescription - # in order for this logic to work also make sure that POLARIS_ACCESS_TOKEN - # is defined in settings - - name: Static Analysis with Polaris - if: ${{steps.prescription.outputs.sastScan == 'true' }} - run: | - export POLARIS_SERVER_URL=${{ secrets.POLARIS_SERVER_URL}} - export POLARIS_ACCESS_TOKEN=${{ secrets.POLARIS_ACCESS_TOKEN}} - wget -q ${{ secrets.POLARIS_SERVER_URL}}/api/tools/polaris_cli-linux64.zip - unzip -j polaris_cli-linux64.zip -d /tmp - /tmp/polaris analyze -w - - # Please note that the ID in previous step was set to prescription - # in order for this logic to work - - name: Software Composition Analysis with Black Duck - if: ${{steps.prescription.outputs.scaScan == 'true' }} - uses: blackducksoftware/github-action@c106efe02c9ec3ba54a319d9da2c5b105a9af4fc - with: - args: '--blackduck.url="${{ secrets.BLACKDUCK_URL}}" --blackduck.api.token="${{ secrets.BLACKDUCK_TOKEN}}" --detect.tools="SIGNATURE_SCAN,DETECTOR"' - - - name: Synopsys Intelligent Security Scan - if: ${{ steps.prescription.outputs.sastScan == 'true' || steps.prescription.outputs.scaScan == 'true' }} - uses: synopsys-sig/intelligent-security-scan@33c8084571f0ad75fd2f370d7c8d10a021927599 - with: - ioServerUrl: ${{secrets.IO_SERVER_URL}} - ioServerToken: ${{secrets.IO_SERVER_TOKEN}} - workflowServerUrl: ${{secrets.WORKFLOW_SERVER_URL}} - additionalWorkflowArgs: --IS_SAST_ENABLED=${{steps.prescription.outputs.sastScan}} --IS_SCA_ENABLED=${{steps.prescription.outputs.scaScan}} - --polaris.project.name={{PROJECT_NAME}} --polaris.url=${{secrets.POLARIS_SERVER_URL}} --polaris.token=${{secrets.POLARIS_ACCESS_TOKEN}} - --blackduck.project.name={{PROJECT_NAME}}:{{PROJECT_VERSION}} --blackduck.url=${{secrets.BLACKDUCK_URL}} --blackduck.api.token=${{secrets.BLACKDUCK_TOKEN}} - stage: "WORKFLOW" - - - name: Upload SARIF file - if: ${{steps.prescription.outputs.sastScan == 'true' }} - uses: github/codeql-action/upload-sarif@v2 - with: - # Path to SARIF file relative to the root of the repository - sarif_file: workflowengine-results.sarif.json +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +name: Synopsys Intelligent Security Scan + +on: + push: + branches: [ master ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ master ] + schedule: + - cron: '33 10 * * 4' + +jobs: + analyze: + name: Analyze + runs-on: ubuntu-latest + permissions: + actions: read + contents: read + security-events: write + + steps: + - name: Checkout repository + uses: actions/checkout@v3 + + - name: Synopsys Intelligent Security Scan + id: prescription + uses: synopsys-sig/intelligent-security-scan@33c8084571f0ad75fd2f370d7c8d10a021927599 + with: + ioServerUrl: ${{secrets.IO_SERVER_URL}} + ioServerToken: ${{secrets.IO_SERVER_TOKEN}} + workflowServerUrl: ${{secrets.WORKFLOW_SERVER_URL}} + additionalWorkflowArgs: --polaris.url=${{secrets.POLARIS_SERVER_URL}} --polaris.token=${{secrets.POLARIS_ACCESS_TOKEN}} + stage: "IO" + + # Please note that the ID in previous step was set to prescription + # in order for this logic to work also make sure that POLARIS_ACCESS_TOKEN + # is defined in settings + - name: Static Analysis with Polaris + if: ${{steps.prescription.outputs.sastScan == 'true' }} + run: | + export POLARIS_SERVER_URL=${{ secrets.POLARIS_SERVER_URL}} + export POLARIS_ACCESS_TOKEN=${{ secrets.POLARIS_ACCESS_TOKEN}} + wget -q ${{ secrets.POLARIS_SERVER_URL}}/api/tools/polaris_cli-linux64.zip + unzip -j polaris_cli-linux64.zip -d /tmp + /tmp/polaris analyze -w + + # Please note that the ID in previous step was set to prescription + # in order for this logic to work + - name: Software Composition Analysis with Black Duck + if: ${{steps.prescription.outputs.scaScan == 'true' }} + uses: blackducksoftware/github-action@c106efe02c9ec3ba54a319d9da2c5b105a9af4fc + with: + args: '--blackduck.url="${{ secrets.BLACKDUCK_URL}}" --blackduck.api.token="${{ secrets.BLACKDUCK_TOKEN}}" --detect.tools="SIGNATURE_SCAN,DETECTOR"' + + - name: Synopsys Intelligent Security Scan + if: ${{ steps.prescription.outputs.sastScan == 'true' || steps.prescription.outputs.scaScan == 'true' }} + uses: synopsys-sig/intelligent-security-scan@33c8084571f0ad75fd2f370d7c8d10a021927599 + with: + ioServerUrl: ${{secrets.IO_SERVER_URL}} + ioServerToken: ${{secrets.IO_SERVER_TOKEN}} + workflowServerUrl: ${{secrets.WORKFLOW_SERVER_URL}} + additionalWorkflowArgs: --IS_SAST_ENABLED=${{steps.prescription.outputs.sastScan}} --IS_SCA_ENABLED=${{steps.prescription.outputs.scaScan}} + --polaris.project.name={{PROJECT_NAME}} --polaris.url=${{secrets.POLARIS_SERVER_URL}} --polaris.token=${{secrets.POLARIS_ACCESS_TOKEN}} + --blackduck.project.name={{PROJECT_NAME}}:{{PROJECT_VERSION}} --blackduck.url=${{secrets.BLACKDUCK_URL}} --blackduck.api.token=${{secrets.BLACKDUCK_TOKEN}} + stage: "WORKFLOW" + + - name: Upload SARIF file + if: ${{steps.prescription.outputs.sastScan == 'true' }} + uses: github/codeql-action/upload-sarif@v2 + with: + # Path to SARIF file relative to the root of the repository + sarif_file: workflowengine-results.sarif.json diff --git a/.github/workflows/sysdig-scan.yml b/.github/workflows/sysdig-scan.yml index 7790ad0..9324c2b 100644 --- a/.github/workflows/sysdig-scan.yml +++ b/.github/workflows/sysdig-scan.yml @@ -1,61 +1,61 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -name: Sysdig - Build, scan, push and upload sarif report - -on: - push: - branches: [ master ] - pull_request: - branches: [ master ] - schedule: - - cron: '18 0 * * 4' - -permissions: - contents: read - -jobs: - - build: - - permissions: - checks: write # for sysdiglabs/scan-action to publish the checks - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - runs-on: ubuntu-latest - - steps: - - uses: actions/checkout@v3 - - - name: Build the Docker image - # Tag image to be built - # Change ${{ github.repository }} variable by another image name if you want but don't forget changing also image-tag below - run: docker build . --file Dockerfile --tag ${{ github.repository }}:latest - - - name: Sysdig Secure Inline Scan - id: scan - uses: sysdiglabs/scan-action@84e4cc594b1ac7eed0f42ddc0609fec175200868 - with: - # Tag of the image to analyse. - # Change ${{ github.repository }} variable by another image name if you want but don't forget changing also image-tag above - image-tag: ${{ github.repository }}:latest - # API token for Sysdig Scanning auth - sysdig-secure-token: ${{ secrets.SYSDIG_SECURE_TOKEN}} - # Sysdig secure endpoint. Please read: https://docs.sysdig.com/en/docs/administration/saas-regions-and-ip-ranges/ - # US-East https://secure.sysdig.com - # US-West https://us2.app.sysdig.com - # EU https://eu1.app.sysdig.com - sysdig-secure-url: https://us2.app.sysdig.com - dockerfile-path: ./Dockerfile - input-type: docker-daemon - ignore-failed-scan: true - # Sysdig inline scanner requires privileged rights - run-as-user: root - - - uses: github/codeql-action/upload-sarif@v2 - #Upload SARIF file - if: always() - with: - sarif_file: ${{ steps.scan.outputs.sarifReport }} +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +name: Sysdig - Build, scan, push and upload sarif report + +on: + push: + branches: [ master ] + pull_request: + branches: [ master ] + schedule: + - cron: '18 0 * * 4' + +permissions: + contents: read + +jobs: + + build: + + permissions: + checks: write # for sysdiglabs/scan-action to publish the checks + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v3 + + - name: Build the Docker image + # Tag image to be built + # Change ${{ github.repository }} variable by another image name if you want but don't forget changing also image-tag below + run: docker build . --file Dockerfile --tag ${{ github.repository }}:latest + + - name: Sysdig Secure Inline Scan + id: scan + uses: sysdiglabs/scan-action@84e4cc594b1ac7eed0f42ddc0609fec175200868 + with: + # Tag of the image to analyse. + # Change ${{ github.repository }} variable by another image name if you want but don't forget changing also image-tag above + image-tag: ${{ github.repository }}:latest + # API token for Sysdig Scanning auth + sysdig-secure-token: ${{ secrets.SYSDIG_SECURE_TOKEN}} + # Sysdig secure endpoint. Please read: https://docs.sysdig.com/en/docs/administration/saas-regions-and-ip-ranges/ + # US-East https://secure.sysdig.com + # US-West https://us2.app.sysdig.com + # EU https://eu1.app.sysdig.com + sysdig-secure-url: https://us2.app.sysdig.com + dockerfile-path: ./Dockerfile + input-type: docker-daemon + ignore-failed-scan: true + # Sysdig inline scanner requires privileged rights + run-as-user: root + + - uses: github/codeql-action/upload-sarif@v2 + #Upload SARIF file + if: always() + with: + sarif_file: ${{ steps.scan.outputs.sarifReport }} diff --git a/.github/workflows/tencent.yml b/.github/workflows/tencent.yml index 727d77d..478ece7 100644 --- a/.github/workflows/tencent.yml +++ b/.github/workflows/tencent.yml @@ -1,80 +1,80 @@ -# This workflow will build a docker container, publish and deploy it to Tencent Kubernetes Engine (TKE) when there is a push to the master branch. -# -# To configure this workflow: -# -# 1. Ensure that your repository contains the necessary configuration for your Tencent Kubernetes Engine cluster, -# including deployment.yml, kustomization.yml, service.yml, etc. -# -# 2. Set up secrets in your workspace: -# - TENCENT_CLOUD_SECRET_ID with Tencent Cloud secret id -# - TENCENT_CLOUD_SECRET_KEY with Tencent Cloud secret key -# - TENCENT_CLOUD_ACCOUNT_ID with Tencent Cloud account id -# - TKE_REGISTRY_PASSWORD with TKE registry password -# -# 3. Change the values for the TKE_IMAGE_URL, TKE_REGION, TKE_CLUSTER_ID and DEPLOYMENT_NAME environment variables (below). - -name: Tencent Kubernetes Engine - -on: - push: - branches: - - master - -# Environment variables available to all jobs and steps in this workflow -env: - TKE_IMAGE_URL: ccr.ccs.tencentyun.com/demo/mywebapp - TKE_REGION: ap-guangzhou - TKE_CLUSTER_ID: cls-mywebapp - DEPLOYMENT_NAME: tke-test - -permissions: - contents: read - -jobs: - setup-build-publish-deploy: - name: Setup, Build, Publish, and Deploy - runs-on: ubuntu-latest - environment: production - steps: - - - name: Checkout - uses: actions/checkout@v3 - - # Build - - name: Build Docker image - run: | - docker build -t ${TKE_IMAGE_URL}:${GITHUB_SHA} . - - - name: Login TKE Registry - run: | - docker login -u ${{ secrets.TENCENT_CLOUD_ACCOUNT_ID }} -p '${{ secrets.TKE_REGISTRY_PASSWORD }}' ${TKE_IMAGE_URL} - - # Push the Docker image to TKE Registry - - name: Publish - run: | - docker push ${TKE_IMAGE_URL}:${GITHUB_SHA} - - - name: Set up Kustomize - run: | - curl -o kustomize --location https://github.com/kubernetes-sigs/kustomize/releases/download/v3.1.0/kustomize_3.1.0_linux_amd64 - chmod u+x ./kustomize - - - name: Set up ~/.kube/config for connecting TKE cluster - uses: TencentCloud/tke-cluster-credential-action@v1 - with: - secret_id: ${{ secrets.TENCENT_CLOUD_SECRET_ID }} - secret_key: ${{ secrets.TENCENT_CLOUD_SECRET_KEY }} - tke_region: ${{ env.TKE_REGION }} - cluster_id: ${{ env.TKE_CLUSTER_ID }} - - - name: Switch to TKE context - run: | - kubectl config use-context ${TKE_CLUSTER_ID}-context-default - - # Deploy the Docker image to the TKE cluster - - name: Deploy - run: | - ./kustomize edit set image ${TKE_IMAGE_URL}:${GITHUB_SHA} - ./kustomize build . | kubectl apply -f - - kubectl rollout status deployment/${DEPLOYMENT_NAME} - kubectl get services -o wide +# This workflow will build a docker container, publish and deploy it to Tencent Kubernetes Engine (TKE) when there is a push to the master branch. +# +# To configure this workflow: +# +# 1. Ensure that your repository contains the necessary configuration for your Tencent Kubernetes Engine cluster, +# including deployment.yml, kustomization.yml, service.yml, etc. +# +# 2. Set up secrets in your workspace: +# - TENCENT_CLOUD_SECRET_ID with Tencent Cloud secret id +# - TENCENT_CLOUD_SECRET_KEY with Tencent Cloud secret key +# - TENCENT_CLOUD_ACCOUNT_ID with Tencent Cloud account id +# - TKE_REGISTRY_PASSWORD with TKE registry password +# +# 3. Change the values for the TKE_IMAGE_URL, TKE_REGION, TKE_CLUSTER_ID and DEPLOYMENT_NAME environment variables (below). + +name: Tencent Kubernetes Engine + +on: + push: + branches: + - master + +# Environment variables available to all jobs and steps in this workflow +env: + TKE_IMAGE_URL: ccr.ccs.tencentyun.com/demo/mywebapp + TKE_REGION: ap-guangzhou + TKE_CLUSTER_ID: cls-mywebapp + DEPLOYMENT_NAME: tke-test + +permissions: + contents: read + +jobs: + setup-build-publish-deploy: + name: Setup, Build, Publish, and Deploy + runs-on: ubuntu-latest + environment: production + steps: + + - name: Checkout + uses: actions/checkout@v3 + + # Build + - name: Build Docker image + run: | + docker build -t ${TKE_IMAGE_URL}:${GITHUB_SHA} . + + - name: Login TKE Registry + run: | + docker login -u ${{ secrets.TENCENT_CLOUD_ACCOUNT_ID }} -p '${{ secrets.TKE_REGISTRY_PASSWORD }}' ${TKE_IMAGE_URL} + + # Push the Docker image to TKE Registry + - name: Publish + run: | + docker push ${TKE_IMAGE_URL}:${GITHUB_SHA} + + - name: Set up Kustomize + run: | + curl -o kustomize --location https://github.com/kubernetes-sigs/kustomize/releases/download/v3.1.0/kustomize_3.1.0_linux_amd64 + chmod u+x ./kustomize + + - name: Set up ~/.kube/config for connecting TKE cluster + uses: TencentCloud/tke-cluster-credential-action@v1 + with: + secret_id: ${{ secrets.TENCENT_CLOUD_SECRET_ID }} + secret_key: ${{ secrets.TENCENT_CLOUD_SECRET_KEY }} + tke_region: ${{ env.TKE_REGION }} + cluster_id: ${{ env.TKE_CLUSTER_ID }} + + - name: Switch to TKE context + run: | + kubectl config use-context ${TKE_CLUSTER_ID}-context-default + + # Deploy the Docker image to the TKE cluster + - name: Deploy + run: | + ./kustomize edit set image ${TKE_IMAGE_URL}:${GITHUB_SHA} + ./kustomize build . | kubectl apply -f - + kubectl rollout status deployment/${DEPLOYMENT_NAME} + kubectl get services -o wide diff --git a/.github/workflows/terraform.yml b/.github/workflows/terraform.yml index 767c495..72c787e 100644 --- a/.github/workflows/terraform.yml +++ b/.github/workflows/terraform.yml @@ -1,94 +1,94 @@ -# This workflow installs the latest version of Terraform CLI and configures the Terraform CLI configuration file -# with an API token for Terraform Cloud (app.terraform.io). On pull request events, this workflow will run -# `terraform init`, `terraform fmt`, and `terraform plan` (speculative plan via Terraform Cloud). On push events -# to the master branch, `terraform apply` will be executed. -# -# Documentation for `hashicorp/setup-terraform` is located here: https://github.com/hashicorp/setup-terraform -# -# To use this workflow, you will need to complete the following setup steps. -# -# 1. Create a `main.tf` file in the root of this repository with the `remote` backend and one or more resources defined. -# Example `main.tf`: -# # The configuration for the `remote` backend. -# terraform { -# backend "remote" { -# # The name of your Terraform Cloud organization. -# organization = "example-organization" -# -# # The name of the Terraform Cloud workspace to store Terraform state files in. -# workspaces { -# name = "example-workspace" -# } -# } -# } -# -# # An example resource that does nothing. -# resource "null_resource" "example" { -# triggers = { -# value = "A example resource that does nothing!" -# } -# } -# -# -# 2. Generate a Terraform Cloud user API token and store it as a GitHub secret (e.g. TF_API_TOKEN) on this repository. -# Documentation: -# - https://www.terraform.io/docs/cloud/users-teams-organizations/api-tokens.html -# - https://help.github.com/en/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets -# -# 3. Reference the GitHub secret in step using the `hashicorp/setup-terraform` GitHub Action. -# Example: -# - name: Setup Terraform -# uses: hashicorp/setup-terraform@v1 -# with: -# cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }} - -name: 'Terraform' - -on: - push: - branches: - - master - pull_request: - -permissions: - contents: read - -jobs: - terraform: - name: 'Terraform' - runs-on: ubuntu-latest - environment: production - - # Use the Bash shell regardless whether the GitHub Actions runner is ubuntu-latest, macos-latest, or windows-latest - defaults: - run: - shell: bash - - steps: - # Checkout the repository to the GitHub Actions runner - - name: Checkout - uses: actions/checkout@v3 - - # Install the latest version of Terraform CLI and configure the Terraform CLI configuration file with a Terraform Cloud user API token - - name: Setup Terraform - uses: hashicorp/setup-terraform@v2 - with: - cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }} - - # Initialize a new or existing Terraform working directory by creating initial files, loading any remote state, downloading modules, etc. - - name: Terraform Init - run: terraform init - - # Checks that all Terraform configuration files adhere to a canonical format - - name: Terraform Format - run: terraform fmt -check - - # Generates an execution plan for Terraform - - name: Terraform Plan - run: terraform plan -input=false - - # On push to master, build or change infrastructure according to Terraform configuration files - # Note: It is recommended to set up a required "strict" status check in your repository for "Terraform Cloud". See the documentation on "strict" required status checks for more information: https://help.github.com/en/github/administering-a-repository/types-of-required-status-checks - - name: Terraform Apply - if: github.ref == 'refs/heads/master' && github.event_name == 'push' - run: terraform apply -auto-approve -input=false +# This workflow installs the latest version of Terraform CLI and configures the Terraform CLI configuration file +# with an API token for Terraform Cloud (app.terraform.io). On pull request events, this workflow will run +# `terraform init`, `terraform fmt`, and `terraform plan` (speculative plan via Terraform Cloud). On push events +# to the master branch, `terraform apply` will be executed. +# +# Documentation for `hashicorp/setup-terraform` is located here: https://github.com/hashicorp/setup-terraform +# +# To use this workflow, you will need to complete the following setup steps. +# +# 1. Create a `main.tf` file in the root of this repository with the `remote` backend and one or more resources defined. +# Example `main.tf`: +# # The configuration for the `remote` backend. +# terraform { +# backend "remote" { +# # The name of your Terraform Cloud organization. +# organization = "example-organization" +# +# # The name of the Terraform Cloud workspace to store Terraform state files in. +# workspaces { +# name = "example-workspace" +# } +# } +# } +# +# # An example resource that does nothing. +# resource "null_resource" "example" { +# triggers = { +# value = "A example resource that does nothing!" +# } +# } +# +# +# 2. Generate a Terraform Cloud user API token and store it as a GitHub secret (e.g. TF_API_TOKEN) on this repository. +# Documentation: +# - https://www.terraform.io/docs/cloud/users-teams-organizations/api-tokens.html +# - https://help.github.com/en/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets +# +# 3. Reference the GitHub secret in step using the `hashicorp/setup-terraform` GitHub Action. +# Example: +# - name: Setup Terraform +# uses: hashicorp/setup-terraform@v1 +# with: +# cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }} + +name: 'Terraform' + +on: + push: + branches: + - master + pull_request: + +permissions: + contents: read + +jobs: + terraform: + name: 'Terraform' + runs-on: ubuntu-latest + environment: production + + # Use the Bash shell regardless whether the GitHub Actions runner is ubuntu-latest, macos-latest, or windows-latest + defaults: + run: + shell: bash + + steps: + # Checkout the repository to the GitHub Actions runner + - name: Checkout + uses: actions/checkout@v3 + + # Install the latest version of Terraform CLI and configure the Terraform CLI configuration file with a Terraform Cloud user API token + - name: Setup Terraform + uses: hashicorp/setup-terraform@v2 + with: + cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }} + + # Initialize a new or existing Terraform working directory by creating initial files, loading any remote state, downloading modules, etc. + - name: Terraform Init + run: terraform init + + # Checks that all Terraform configuration files adhere to a canonical format + - name: Terraform Format + run: terraform fmt -check + + # Generates an execution plan for Terraform + - name: Terraform Plan + run: terraform plan -input=false + + # On push to master, build or change infrastructure according to Terraform configuration files + # Note: It is recommended to set up a required "strict" status check in your repository for "Terraform Cloud". See the documentation on "strict" required status checks for more information: https://help.github.com/en/github/administering-a-repository/types-of-required-status-checks + - name: Terraform Apply + if: github.ref == 'refs/heads/master' && github.event_name == 'push' + run: terraform apply -auto-approve -input=false diff --git a/.github/workflows/tfsec.yml b/.github/workflows/tfsec.yml index 538d852..bcc6373 100644 --- a/.github/workflows/tfsec.yml +++ b/.github/workflows/tfsec.yml @@ -1,38 +1,38 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -name: tfsec - -on: - push: - branches: [ master ] - pull_request: - branches: [ master ] - schedule: - - cron: '39 23 * * 0' - -jobs: - tfsec: - name: Run tfsec sarif report - runs-on: ubuntu-latest - permissions: - actions: read - contents: read - security-events: write - - steps: - - name: Clone repo - uses: actions/checkout@v3 - - - name: Run tfsec - uses: tfsec/tfsec-sarif-action@21ded20e8ca120cd9d3d6ab04ef746477542a608 - with: - sarif_file: tfsec.sarif - - - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@v2 - with: - # Path to SARIF file relative to the root of the repository - sarif_file: tfsec.sarif +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +name: tfsec + +on: + push: + branches: [ master ] + pull_request: + branches: [ master ] + schedule: + - cron: '39 23 * * 0' + +jobs: + tfsec: + name: Run tfsec sarif report + runs-on: ubuntu-latest + permissions: + actions: read + contents: read + security-events: write + + steps: + - name: Clone repo + uses: actions/checkout@v3 + + - name: Run tfsec + uses: tfsec/tfsec-sarif-action@21ded20e8ca120cd9d3d6ab04ef746477542a608 + with: + sarif_file: tfsec.sarif + + - name: Upload SARIF file + uses: github/codeql-action/upload-sarif@v2 + with: + # Path to SARIF file relative to the root of the repository + sarif_file: tfsec.sarif diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml index 6546367..35aaeb4 100644 --- a/.github/workflows/trivy.yml +++ b/.github/workflows/trivy.yml @@ -1,47 +1,47 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -name: build - -on: - push: - branches: [ master ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ master ] - schedule: - - cron: '25 11 * * 4' - -permissions: - contents: read - -jobs: - build: - permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - name: Build - runs-on: "ubuntu-18.04" - steps: - - name: Checkout code - uses: actions/checkout@v3 - - - name: Build an image from Dockerfile - run: | - docker build -t docker.io/my-organization/my-app:${{ github.sha }} . - - - name: Run Trivy vulnerability scanner - uses: aquasecurity/trivy-action@41f05d9ecffa2ed3f1580af306000f734b733e54 - with: - image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}' - format: 'template' - template: '@/contrib/sarif.tpl' - output: 'trivy-results.sarif' - severity: 'CRITICAL,HIGH' - - - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: 'trivy-results.sarif' +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +name: build + +on: + push: + branches: [ master ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ master ] + schedule: + - cron: '25 11 * * 4' + +permissions: + contents: read + +jobs: + build: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + name: Build + runs-on: "ubuntu-18.04" + steps: + - name: Checkout code + uses: actions/checkout@v3 + + - name: Build an image from Dockerfile + run: | + docker build -t docker.io/my-organization/my-app:${{ github.sha }} . + + - name: Run Trivy vulnerability scanner + uses: aquasecurity/trivy-action@41f05d9ecffa2ed3f1580af306000f734b733e54 + with: + image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}' + format: 'template' + template: '@/contrib/sarif.tpl' + output: 'trivy-results.sarif' + severity: 'CRITICAL,HIGH' + + - name: Upload Trivy scan results to GitHub Security tab + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: 'trivy-results.sarif' diff --git a/.github/workflows/veracode.yml b/.github/workflows/veracode.yml index f1a81fc..7c71b4d 100644 --- a/.github/workflows/veracode.yml +++ b/.github/workflows/veracode.yml @@ -1,58 +1,58 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -# This workflow will initiate a Veracode Static Analysis Pipeline scan, return a results.json and convert to SARIF for upload as a code scanning alert - -name: Veracode Static Analysis Pipeline Scan - -on: - push: - branches: [ master ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ master ] - schedule: - - cron: '18 13 * * 1' - -# A workflow run is made up of one or more jobs that can run sequentially or in parallel -permissions: - contents: read - -jobs: - # This workflow contains a job to build and submit pipeline scan, you will need to customize the build process accordingly and make sure the artifact you build is used as the file input to the pipeline scan file parameter - build-and-pipeline-scan: - # The type of runner that the job will run on - permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - runs-on: ubuntu-latest - steps: - - # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it and copies all sources into ZIP file for submitting for analysis. Replace this section with your applications build steps - - uses: actions/checkout@v3 - with: - repository: '' - - - run: zip -r veracode-scan-target.zip ./ - - # download the Veracode Static Analysis Pipeline scan jar - - run: curl --silent --show-error --fail -O https://downloads.veracode.com/securityscan/pipeline-scan-LATEST.zip - - run: unzip -o pipeline-scan-LATEST.zip - - - uses: actions/setup-java@v3 - with: - java-version: 8 - distribution: 'temurin' - - run: java -jar pipeline-scan.jar --veracode_api_id "${{secrets.VERACODE_API_ID}}" --veracode_api_key "${{secrets.VERACODE_API_KEY}}" --fail_on_severity="Very High, High" --file veracode-scan-target.zip - continue-on-error: true - - name: Convert pipeline scan output to SARIF format - id: convert - uses: veracode/veracode-pipeline-scan-results-to-sarif@99c541b171135ee0e29d3e5b938f74d88b0c5787 - with: - pipeline-results-json: results.json - - uses: github/codeql-action/upload-sarif@v2 - with: - # Path to SARIF file relative to the root of the repository - sarif_file: veracode-results.sarif +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# This workflow will initiate a Veracode Static Analysis Pipeline scan, return a results.json and convert to SARIF for upload as a code scanning alert + +name: Veracode Static Analysis Pipeline Scan + +on: + push: + branches: [ master ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ master ] + schedule: + - cron: '18 13 * * 1' + +# A workflow run is made up of one or more jobs that can run sequentially or in parallel +permissions: + contents: read + +jobs: + # This workflow contains a job to build and submit pipeline scan, you will need to customize the build process accordingly and make sure the artifact you build is used as the file input to the pipeline scan file parameter + build-and-pipeline-scan: + # The type of runner that the job will run on + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + runs-on: ubuntu-latest + steps: + + # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it and copies all sources into ZIP file for submitting for analysis. Replace this section with your applications build steps + - uses: actions/checkout@v3 + with: + repository: '' + + - run: zip -r veracode-scan-target.zip ./ + + # download the Veracode Static Analysis Pipeline scan jar + - run: curl --silent --show-error --fail -O https://downloads.veracode.com/securityscan/pipeline-scan-LATEST.zip + - run: unzip -o pipeline-scan-LATEST.zip + + - uses: actions/setup-java@v3 + with: + java-version: 8 + distribution: 'temurin' + - run: java -jar pipeline-scan.jar --veracode_api_id "${{secrets.VERACODE_API_ID}}" --veracode_api_key "${{secrets.VERACODE_API_KEY}}" --fail_on_severity="Very High, High" --file veracode-scan-target.zip + continue-on-error: true + - name: Convert pipeline scan output to SARIF format + id: convert + uses: veracode/veracode-pipeline-scan-results-to-sarif@99c541b171135ee0e29d3e5b938f74d88b0c5787 + with: + pipeline-results-json: results.json + - uses: github/codeql-action/upload-sarif@v2 + with: + # Path to SARIF file relative to the root of the repository + sarif_file: veracode-results.sarif diff --git a/.github/workflows/webpack.yml b/.github/workflows/webpack.yml index 20802eb..9385d55 100644 --- a/.github/workflows/webpack.yml +++ b/.github/workflows/webpack.yml @@ -1,28 +1,28 @@ -name: NodeJS with Webpack - -on: - push: - branches: [ master ] - pull_request: - branches: [ master ] - -jobs: - build: - runs-on: ubuntu-latest - - strategy: - matrix: - node-version: [12.x, 14.x, 16.x] - - steps: - - uses: actions/checkout@v3 - - - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 - with: - node-version: ${{ matrix.node-version }} - - - name: Build - run: | - npm install - npx webpack +name: NodeJS with Webpack + +on: + push: + branches: [ master ] + pull_request: + branches: [ master ] + +jobs: + build: + runs-on: ubuntu-latest + + strategy: + matrix: + node-version: [12.x, 14.x, 16.x] + + steps: + - uses: actions/checkout@v3 + + - name: Use Node.js ${{ matrix.node-version }} + uses: actions/setup-node@v3 + with: + node-version: ${{ matrix.node-version }} + + - name: Build + run: | + npm install + npx webpack diff --git a/.github/workflows/xanitizer.yml b/.github/workflows/xanitizer.yml index ea58bfd..eb08a9e 100644 --- a/.github/workflows/xanitizer.yml +++ b/.github/workflows/xanitizer.yml @@ -1,99 +1,99 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -# This workflow downloads and installs the latest version of Xanitizer, builds your project, runs a Xanitizer security analysis on it, -# and then archives the findings list reports and uploads the findings into the GitHub code scanning alert section of your repository. -# -# Documentation for the `RIGS-IT/xanitizer-action` is located here: https://github.com/RIGS-IT/xanitizer-action -# -# To use this basic workflow, you will need to complete the following setup steps: -# -# 1. The underlying Xanitizer, used in this workflow, needs a separate license file. -# Licenses are free of charge for open source projects and for educational usage. -# To get more information about the Xanitizer licenses and how to obtain a license file, -# please consult https://www.xanitizer.com/xanitizer-pricing/. -# -# 2. The content of the license file has to be stored as a GitHub secret (e.g. XANITIZER_LICENSE) on this repository. -# Please consult https://docs.github.com/en/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets for details. -# -# 3. Reference the GitHub secret in the step using the `RIGS-IT/xanitizer-action` GitHub action. -# Example: -# - name: Xanitizer Security Analysis -# uses: RIGS-IT/xanitizer-action@v1 -# with: -# license: ${{ secrets.XANITIZER_LICENSE }} -# -# 4. As a static application security testing (SAST) tool, -# Xanitizer requires that all dependencies of the artifacts being analyzed can be resolved successfully. -# So you have to install all used libraries and build your project before running the security analysis, -# e.g. via `mvn compile` for Java or `npm install` for JavaScript - -name: "Xanitizer Security Analysis" - -on: - push: - branches: [ master ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ master ] - schedule: - - cron: '35 6 * * 5' - workflow_dispatch: - -permissions: - contents: read - -jobs: - xanitizer-security-analysis: - # Xanitizer runs on ubuntu-latest and windows-latest. - permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - runs-on: ubuntu-latest - - steps: - # Check out the repository - - name: Checkout - uses: actions/checkout@v3 - - # Set up the correct Java version for your project - # Please comment out, if your project does not contain Java source code. - - name: Set up JDK 11 - uses: actions/setup-java@v3 - with: - java-version: 11 - distribution: 'temurin' - - # Compile the code for Java projects and get all libraries, e.g. via Maven - # Please adapt, if your project uses another build system to compile Java source code. - # Please comment out, if your project does not contain Java source code. - - name: Compile Java code - run: mvn -B compile - - # Install all dependent libraries for JavaScript/TypeScript projects, e.g. via npm - # Please adapt to run `npm install` in the correct directories. - # Please adapt, if your project uses another package manager for getting JavaScript libraries. - # Please comment out, if your project does not use a package manager for getting JavaScript libraries. - - name: Install JavaScript libraries - run: npm install - - # Run the security analysis with default settings - - name: Xanitizer Security Analysis - uses: RIGS-IT/xanitizer-action@87d13138fb113b727cbe040c744a15a2b4fe5316 - with: - license: ${{ secrets.XANITIZER_LICENSE }} - - # Archiving the findings list reports - - uses: actions/upload-artifact@v3 - with: - name: Xanitizer-Reports - path: | - *-Findings-List.pdf - *-Findings-List.sarif - - # Uploads the findings into the GitHub code scanning alert section using the upload-sarif action - - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: Xanitizer-Findings-List.sarif +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# This workflow downloads and installs the latest version of Xanitizer, builds your project, runs a Xanitizer security analysis on it, +# and then archives the findings list reports and uploads the findings into the GitHub code scanning alert section of your repository. +# +# Documentation for the `RIGS-IT/xanitizer-action` is located here: https://github.com/RIGS-IT/xanitizer-action +# +# To use this basic workflow, you will need to complete the following setup steps: +# +# 1. The underlying Xanitizer, used in this workflow, needs a separate license file. +# Licenses are free of charge for open source projects and for educational usage. +# To get more information about the Xanitizer licenses and how to obtain a license file, +# please consult https://www.xanitizer.com/xanitizer-pricing/. +# +# 2. The content of the license file has to be stored as a GitHub secret (e.g. XANITIZER_LICENSE) on this repository. +# Please consult https://docs.github.com/en/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets for details. +# +# 3. Reference the GitHub secret in the step using the `RIGS-IT/xanitizer-action` GitHub action. +# Example: +# - name: Xanitizer Security Analysis +# uses: RIGS-IT/xanitizer-action@v1 +# with: +# license: ${{ secrets.XANITIZER_LICENSE }} +# +# 4. As a static application security testing (SAST) tool, +# Xanitizer requires that all dependencies of the artifacts being analyzed can be resolved successfully. +# So you have to install all used libraries and build your project before running the security analysis, +# e.g. via `mvn compile` for Java or `npm install` for JavaScript + +name: "Xanitizer Security Analysis" + +on: + push: + branches: [ master ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ master ] + schedule: + - cron: '35 6 * * 5' + workflow_dispatch: + +permissions: + contents: read + +jobs: + xanitizer-security-analysis: + # Xanitizer runs on ubuntu-latest and windows-latest. + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + runs-on: ubuntu-latest + + steps: + # Check out the repository + - name: Checkout + uses: actions/checkout@v3 + + # Set up the correct Java version for your project + # Please comment out, if your project does not contain Java source code. + - name: Set up JDK 11 + uses: actions/setup-java@v3 + with: + java-version: 11 + distribution: 'temurin' + + # Compile the code for Java projects and get all libraries, e.g. via Maven + # Please adapt, if your project uses another build system to compile Java source code. + # Please comment out, if your project does not contain Java source code. + - name: Compile Java code + run: mvn -B compile + + # Install all dependent libraries for JavaScript/TypeScript projects, e.g. via npm + # Please adapt to run `npm install` in the correct directories. + # Please adapt, if your project uses another package manager for getting JavaScript libraries. + # Please comment out, if your project does not use a package manager for getting JavaScript libraries. + - name: Install JavaScript libraries + run: npm install + + # Run the security analysis with default settings + - name: Xanitizer Security Analysis + uses: RIGS-IT/xanitizer-action@87d13138fb113b727cbe040c744a15a2b4fe5316 + with: + license: ${{ secrets.XANITIZER_LICENSE }} + + # Archiving the findings list reports + - uses: actions/upload-artifact@v3 + with: + name: Xanitizer-Reports + path: | + *-Findings-List.pdf + *-Findings-List.sarif + + # Uploads the findings into the GitHub code scanning alert section using the upload-sarif action + - uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: Xanitizer-Findings-List.sarif diff --git a/.gitignore b/.gitignore deleted file mode 100644 index b6e4761..0000000 --- a/.gitignore +++ /dev/null @@ -1,129 +0,0 @@ -# Byte-compiled / optimized / DLL files -__pycache__/ -*.py[cod] -*$py.class - -# C extensions -*.so - -# Distribution / packaging -.Python -build/ -develop-eggs/ -dist/ -downloads/ -eggs/ -.eggs/ -lib/ -lib64/ -parts/ -sdist/ -var/ -wheels/ -pip-wheel-metadata/ -share/python-wheels/ -*.egg-info/ -.installed.cfg -*.egg -MANIFEST - -# PyInstaller -# Usually these files are written by a python script from a template -# before PyInstaller builds the exe, so as to inject date/other infos into it. -*.manifest -*.spec - -# Installer logs -pip-log.txt -pip-delete-this-directory.txt - -# Unit test / coverage reports -htmlcov/ -.tox/ -.nox/ -.coverage -.coverage.* -.cache -nosetests.xml -coverage.xml -*.cover -*.py,cover -.hypothesis/ -.pytest_cache/ - -# Translations -*.mo -*.pot - -# Django stuff: -*.log -local_settings.py -db.sqlite3 -db.sqlite3-journal - -# Flask stuff: -instance/ -.webassets-cache - -# Scrapy stuff: -.scrapy - -# Sphinx documentation -docs/_build/ - -# PyBuilder -target/ - -# Jupyter Notebook -.ipynb_checkpoints - -# IPython -profile_default/ -ipython_config.py - -# pyenv -.python-version - -# pipenv -# According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control. -# However, in case of collaboration, if having platform-specific dependencies or dependencies -# having no cross-platform support, pipenv may install dependencies that don't work, or not -# install all needed dependencies. -#Pipfile.lock - -# PEP 582; used by e.g. github.com/David-OConnor/pyflow -__pypackages__/ - -# Celery stuff -celerybeat-schedule -celerybeat.pid - -# SageMath parsed files -*.sage.py - -# Environments -.env -.venv -env/ -venv/ -ENV/ -env.bak/ -venv.bak/ - -# Spyder project settings -.spyderproject -.spyproject - -# Rope project settings -.ropeproject - -# mkdocs documentation -/site - -# mypy -.mypy_cache/ -.dmypy.json -dmypy.json - -# Pyre type checker -.pyre/ diff --git a/.vs/ProjectSettings.json b/.vs/ProjectSettings.json index f8b4888..866f1e1 100644 --- a/.vs/ProjectSettings.json +++ b/.vs/ProjectSettings.json @@ -1,3 +1,3 @@ -{ - "CurrentProjectSetting": null +{ + "CurrentProjectSetting": null } \ No newline at end of file diff --git a/.whitesource b/.whitesource deleted file mode 100644 index 55b922e..0000000 --- a/.whitesource +++ /dev/null @@ -1,12 +0,0 @@ -{ - "scanSettings": { - "baseBranches": [] - }, - "checkRunSettings": { - "vulnerableCheckRunConclusionLevel": "failure", - "displayMode": "diff" - }, - "issueSettings": { - "minSeverityLevel": "LOW" - } -} \ No newline at end of file diff --git a/Application/.editorconfig b/Application/.editorconfig deleted file mode 100644 index 0f09989..0000000 --- a/Application/.editorconfig +++ /dev/null @@ -1,10 +0,0 @@ -# editorconfig.org -root = true - -[*] -indent_style = space -indent_size = 2 -end_of_line = lf -charset = utf-8 -trim_trailing_whitespace = true -insert_final_newline = true diff --git a/Application/.gitignore b/Application/.gitignore deleted file mode 100644 index a52eaec..0000000 --- a/Application/.gitignore +++ /dev/null @@ -1,118 +0,0 @@ -################################################ -############### .gitignore ################## -################################################ -# -# This file is only relevant if you are using git. -# -# Files which match the splat patterns below will -# be ignored by git. This keeps random crap and -# sensitive credentials from being uploaded to -# your repository. It allows you to configure your -# app for your machine without accidentally -# committing settings which will smash the local -# settings of other developers on your team. -# -# Some reasonable defaults are included below, -# but, of course, you should modify/extend/prune -# to fit your needs! -################################################ - - - - -################################################ -# Local Configuration -# -# Explicitly ignore files which contain: -# -# 1. Sensitive information you'd rather not push to -# your git repository. -# e.g., your personal API keys or passwords. -# -# 2. Environment-specific configuration -# Basically, anything that would be annoying -# to have to change every time you do a -# `git pull` -# e.g., your local development database, or -# the S3 bucket you're using for file uploads -# development. -# -################################################ - -config/local.js - - - - - -################################################ -# Dependencies -# -# When releasing a production app, you may -# consider including your node_modules and -# bower_components directory in your git repo, -# but during development, its best to exclude it, -# since different developers may be working on -# different kernels, where dependencies would -# need to be recompiled anyway. -# -# More on that here about node_modules dir: -# http://www.futurealoof.com/posts/nodemodules-in-git.html -# (credit Mikeal Rogers, @mikeal) -# -# About bower_components dir, you can see this: -# http://addyosmani.com/blog/checking-in-front-end-dependencies/ -# (credit Addy Osmani, @addyosmani) -# -################################################ - -node_modules -bower_components - - - - -################################################ -# Sails.js / Waterline / Grunt -# -# Files generated by Sails and Grunt, or related -# tasks and adapters. -################################################ -.tmp -dump.rdb - - - - - -################################################ -# Node.js / NPM -# -# Common files generated by Node, NPM, and the -# related ecosystem. -################################################ -lib-cov -*.seed -*.log -*.out -*.pid -npm-debug.log - - - - - -################################################ -# Miscellaneous -# -# Common files generated by text editors, -# operating systems, file systems, etc. -################################################ - -*~ -*# -.DS_STORE -.netbeans -nbproject -.idea -.node_history diff --git a/Application/.sailsrc b/Application/.sailsrc deleted file mode 100644 index fa89f5e..0000000 --- a/Application/.sailsrc +++ /dev/null @@ -1,5 +0,0 @@ -{ - "generators": { - "modules": {} - } -} \ No newline at end of file diff --git a/Application/Dockerfile b/Application/Dockerfile deleted file mode 100644 index 9407f6d..0000000 --- a/Application/Dockerfile +++ /dev/null @@ -1,12 +0,0 @@ -FROM node:20.8.1 -LABEL maintainer="Azure App Service Container Images " - -# Create app directory -WORKDIR /app - -# Bundle app source -COPY . . -RUN npm install - -EXPOSE 3000 80 -CMD [ "npm", "start" ] diff --git a/Application/Gruntfile.js b/Application/Gruntfile.js deleted file mode 100644 index 212c569..0000000 --- a/Application/Gruntfile.js +++ /dev/null @@ -1,82 +0,0 @@ -/** - * Gruntfile - * - * This Node script is executed when you run `grunt` or `sails lift`. - * It's purpose is to load the Grunt tasks in your project's `tasks` - * folder, and allow you to add and remove tasks as you see fit. - * For more information on how this works, check out the `README.md` - * file that was generated in your `tasks` folder. - * - * WARNING: - * Unless you know what you're doing, you shouldn't change this file. - * Check out the `tasks` directory instead. - */ - -module.exports = function(grunt) { - - - // Load the include-all library in order to require all of our grunt - // configurations and task registrations dynamically. - var includeAll; - try { - includeAll = require('include-all'); - } catch (e0) { - try { - includeAll = require('sails/node_modules/include-all'); - } catch (e1) { - console.error('Could not find `include-all` module.'); - console.error('Skipping grunt tasks...'); - console.error('To fix this, please run:'); - console.error('npm install include-all --save`'); - console.error(); - - grunt.registerTask('default', []); - return; - } - } - - - /** - * Loads Grunt configuration modules from the specified - * relative path. These modules should export a function - * that, when run, should either load/configure or register - * a Grunt task. - */ - function loadTasks(relPath) { - return includeAll({ - dirname: require('path').resolve(__dirname, relPath), - filter: /(.+)\.js$/, - excludeDirs: /^\.(git|svn)$/ - }) || {}; - } - - /** - * Invokes the function from a Grunt configuration module with - * a single argument - the `grunt` object. - */ - function invokeConfigFn(tasks) { - for (var taskName in tasks) { - if (tasks.hasOwnProperty(taskName)) { - tasks[taskName](grunt); - } - } - } - - - - // Load task functions - var taskConfigurations = loadTasks('./tasks/config'), - registerDefinitions = loadTasks('./tasks/register'); - - // (ensure that a default task exists) - if (!registerDefinitions.default) { - registerDefinitions.default = function(grunt) { - grunt.registerTask('default', []); - }; - } - - // Run task functions to configure Grunt. - invokeConfigFn(taskConfigurations); - invokeConfigFn(registerDefinitions); - -}; diff --git a/Application/api/policies/sessionAuth.js b/Application/api/policies/sessionAuth.js deleted file mode 100644 index 8f9a264..0000000 --- a/Application/api/policies/sessionAuth.js +++ /dev/null @@ -1,21 +0,0 @@ -/** - * sessionAuth - * - * @module :: Policy - * @description :: Simple policy to allow any authenticated user - * Assumes that your login action in one of your controllers sets `req.session.authenticated = true;` - * @docs :: http://sailsjs.org/#!/documentation/concepts/Policies - * - */ -module.exports = function(req, res, next) { - - // User is allowed, proceed to the next policy, - // or if this is the last policy, the controller - if (req.session.authenticated) { - return next(); - } - - // User is not allowed - // (default res.forbidden() behavior can be overridden in `config/403.js`) - return res.forbidden('You are not permitted to perform this action.'); -}; diff --git a/Application/api/responses/badRequest.js b/Application/api/responses/badRequest.js deleted file mode 100644 index 4eb96aa..0000000 --- a/Application/api/responses/badRequest.js +++ /dev/null @@ -1,76 +0,0 @@ -/** - * 400 (Bad Request) Handler - * - * Usage: - * return res.badRequest(); - * return res.badRequest(data); - * return res.badRequest(data, 'some/specific/badRequest/view'); - * - * e.g.: - * ``` - * return res.badRequest( - * 'Please choose a valid `password` (6-12 characters)', - * 'trial/signup' - * ); - * ``` - */ - -module.exports = function badRequest(data, options) { - - // Get access to `req`, `res`, & `sails` - var req = this.req; - var res = this.res; - var sails = req._sails; - - // Set status code - res.status(400); - - // Log error to console - if (data !== undefined) { - sails.log.verbose('Sending 400 ("Bad Request") response: \n',data); - } - else sails.log.verbose('Sending 400 ("Bad Request") response'); - - // Only include errors in response if application environment - // is not set to 'production'. In production, we shouldn't - // send back any identifying information about errors. - if (sails.config.environment === 'production' && sails.config.keepResponseErrors !== true) { - data = undefined; - } - - // If the user-agent wants JSON, always respond with JSON - // If views are disabled, revert to json - if (req.wantsJSON || sails.config.hooks.views === false) { - return res.jsonx(data); - } - - // If second argument is a string, we take that to mean it refers to a view. - // If it was omitted, use an empty object (`{}`) - options = (typeof options === 'string') ? { view: options } : options || {}; - - // Attempt to prettify data for views, if it's a non-error object - var viewData = data; - if (!(viewData instanceof Error) && typeof viewData == 'object') { - try { - viewData = require('util').inspect(data, {depth: null}); - } - catch(e) { - viewData = undefined; - } - } - - // If a view was provided in options, serve it. - // Otherwise try to guess an appropriate view, or if that doesn't - // work, just send JSON. - if (options.view) { - return res.view(options.view, { data: viewData, title: 'Bad Request' }); - } - - // If no second argument provided, try to serve the implied view, - // but fall back to sending JSON(P) if no view can be inferred. - else return res.guessView({ data: viewData, title: 'Bad Request' }, function couldNotGuessView () { - return res.jsonx(data); - }); - -}; - diff --git a/Application/api/responses/created.js b/Application/api/responses/created.js deleted file mode 100644 index 17ca6d4..0000000 --- a/Application/api/responses/created.js +++ /dev/null @@ -1,60 +0,0 @@ -/** - * 201 (CREATED) Response - * - * Usage: - * return res.created(); - * return res.created(data); - * return res.created(data, 'auth/login'); - * - * @param {Object} data - * @param {String|Object} options - * - pass string to render specified view - */ - -module.exports = function created (data, options) { - - // Get access to `req`, `res`, & `sails` - var req = this.req; - var res = this.res; - var sails = req._sails; - - sails.log.silly('res.created() :: Sending 201 ("CREATED") response'); - - // Set status code - res.status(201); - - // If appropriate, serve data as JSON(P) - // If views are disabled, revert to json - if (req.wantsJSON || sails.config.hooks.views === false) { - return res.jsonx(data); - } - - // If second argument is a string, we take that to mean it refers to a view. - // If it was omitted, use an empty object (`{}`) - options = (typeof options === 'string') ? { view: options } : options || {}; - - // Attempt to prettify data for views, if it's a non-error object - var viewData = data; - if (!(viewData instanceof Error) && typeof viewData == 'object') { - try { - viewData = require('util').inspect(data, {depth: null}); - } - catch(e) { - viewData = undefined; - } - } - - // If a view was provided in options, serve it. - // Otherwise try to guess an appropriate view, or if that doesn't - // work, just send JSON. - if (options.view) { - return res.view(options.view, { data: viewData, title: 'Created' }); - } - - // If no second argument provided, try to serve the implied view, - // but fall back to sending JSON(P) if no view can be inferred. - else return res.guessView({ data: viewData, title: 'Created' }, function couldNotGuessView () { - return res.jsonx(data); - }); - -}; diff --git a/Application/api/responses/forbidden.js b/Application/api/responses/forbidden.js deleted file mode 100644 index 6b55e42..0000000 --- a/Application/api/responses/forbidden.js +++ /dev/null @@ -1,89 +0,0 @@ -/** - * 403 (Forbidden) Handler - * - * Usage: - * return res.forbidden(); - * return res.forbidden(err); - * return res.forbidden(err, 'some/specific/forbidden/view'); - * - * e.g.: - * ``` - * return res.forbidden('Access denied.'); - * ``` - */ - -module.exports = function forbidden (data, options) { - - // Get access to `req`, `res`, & `sails` - var req = this.req; - var res = this.res; - var sails = req._sails; - - // Set status code - res.status(403); - - // Log error to console - if (data !== undefined) { - sails.log.verbose('Sending 403 ("Forbidden") response: \n',data); - } - else sails.log.verbose('Sending 403 ("Forbidden") response'); - - // Only include errors in response if application environment - // is not set to 'production'. In production, we shouldn't - // send back any identifying information about errors. - if (sails.config.environment === 'production' && sails.config.keepResponseErrors !== true) { - data = undefined; - } - - // If the user-agent wants JSON, always respond with JSON - // If views are disabled, revert to json - if (req.wantsJSON || sails.config.hooks.views === false) { - return res.jsonx(data); - } - - // If second argument is a string, we take that to mean it refers to a view. - // If it was omitted, use an empty object (`{}`) - options = (typeof options === 'string') ? { view: options } : options || {}; - - // Attempt to prettify data for views, if it's a non-error object - var viewData = data; - if (!(viewData instanceof Error) && typeof viewData == 'object') { - try { - viewData = require('util').inspect(data, {depth: null}); - } - catch(e) { - viewData = undefined; - } - } - - // If a view was provided in options, serve it. - // Otherwise try to guess an appropriate view, or if that doesn't - // work, just send JSON. - if (options.view) { - return res.view(options.view, { data: viewData, title: 'Forbidden' }); - } - - // If no second argument provided, try to serve the default view, - // but fall back to sending JSON(P) if any errors occur. - else return res.view('403', { data: viewData, title: 'Forbidden' }, function (err, html) { - - // If a view error occured, fall back to JSON(P). - if (err) { - // - // Additionally: - // • If the view was missing, ignore the error but provide a verbose log. - if (err.code === 'E_VIEW_FAILED') { - sails.log.verbose('res.forbidden() :: Could not locate view for error page (sending JSON instead). Details: ',err); - } - // Otherwise, if this was a more serious error, log to the console with the details. - else { - sails.log.warn('res.forbidden() :: When attempting to render error page view, an error occured (sending JSON instead). Details: ', err); - } - return res.jsonx(data); - } - - return res.send(html); - }); - -}; - diff --git a/Application/api/responses/notFound.js b/Application/api/responses/notFound.js deleted file mode 100644 index 96ab002..0000000 --- a/Application/api/responses/notFound.js +++ /dev/null @@ -1,94 +0,0 @@ -/** - * 404 (Not Found) Handler - * - * Usage: - * return res.notFound(); - * return res.notFound(err); - * return res.notFound(err, 'some/specific/notfound/view'); - * - * e.g.: - * ``` - * return res.notFound(); - * ``` - * - * NOTE: - * If a request doesn't match any explicit routes (i.e. `config/routes.js`) - * or route blueprints (i.e. "shadow routes", Sails will call `res.notFound()` - * automatically. - */ - -module.exports = function notFound (data, options) { - - // Get access to `req`, `res`, & `sails` - var req = this.req; - var res = this.res; - var sails = req._sails; - - // Set status code - res.status(404); - - // Log error to console - if (data !== undefined) { - sails.log.verbose('Sending 404 ("Not Found") response: \n',data); - } - else sails.log.verbose('Sending 404 ("Not Found") response'); - - // Only include errors in response if application environment - // is not set to 'production'. In production, we shouldn't - // send back any identifying information about errors. - if (sails.config.environment === 'production' && sails.config.keepResponseErrors !== true) { - data = undefined; - } - - // If the user-agent wants JSON, always respond with JSON - // If views are disabled, revert to json - if (req.wantsJSON || sails.config.hooks.views === false) { - return res.jsonx(data); - } - - // If second argument is a string, we take that to mean it refers to a view. - // If it was omitted, use an empty object (`{}`) - options = (typeof options === 'string') ? { view: options } : options || {}; - - // Attempt to prettify data for views, if it's a non-error object - var viewData = data; - if (!(viewData instanceof Error) && typeof viewData == 'object') { - try { - viewData = require('util').inspect(data, {depth: null}); - } - catch(e) { - viewData = undefined; - } - } - - // If a view was provided in options, serve it. - // Otherwise try to guess an appropriate view, or if that doesn't - // work, just send JSON. - if (options.view) { - return res.view(options.view, { data: viewData, title: 'Not Found' }); - } - - // If no second argument provided, try to serve the default view, - // but fall back to sending JSON(P) if any errors occur. - else return res.view('404', { data: viewData, title: 'Not Found' }, function (err, html) { - - // If a view error occured, fall back to JSON(P). - if (err) { - // - // Additionally: - // • If the view was missing, ignore the error but provide a verbose log. - if (err.code === 'E_VIEW_FAILED') { - sails.log.verbose('res.notFound() :: Could not locate view for error page (sending JSON instead). Details: ',err); - } - // Otherwise, if this was a more serious error, log to the console with the details. - else { - sails.log.warn('res.notFound() :: When attempting to render error page view, an error occured (sending JSON instead). Details: ', err); - } - return res.jsonx(data); - } - - return res.send(html); - }); - -}; - diff --git a/Application/api/responses/ok.js b/Application/api/responses/ok.js deleted file mode 100644 index cedb33b..0000000 --- a/Application/api/responses/ok.js +++ /dev/null @@ -1,60 +0,0 @@ -/** - * 200 (OK) Response - * - * Usage: - * return res.ok(); - * return res.ok(data); - * return res.ok(data, 'auth/login'); - * - * @param {Object} data - * @param {String|Object} options - * - pass string to render specified view - */ - -module.exports = function sendOK (data, options) { - - // Get access to `req`, `res`, & `sails` - var req = this.req; - var res = this.res; - var sails = req._sails; - - sails.log.silly('res.ok() :: Sending 200 ("OK") response'); - - // Set status code - res.status(200); - - // If appropriate, serve data as JSON(P) - // If views are disabled, revert to json - if (req.wantsJSON || sails.config.hooks.views === false) { - return res.jsonx(data); - } - - // If second argument is a string, we take that to mean it refers to a view. - // If it was omitted, use an empty object (`{}`) - options = (typeof options === 'string') ? { view: options } : options || {}; - - // Attempt to prettify data for views, if it's a non-error object - var viewData = data; - if (!(viewData instanceof Error) && typeof viewData == 'object') { - try { - viewData = require('util').inspect(data, {depth: null}); - } - catch(e) { - viewData = undefined; - } - } - - // If a view was provided in options, serve it. - // Otherwise try to guess an appropriate view, or if that doesn't - // work, just send JSON. - if (options.view) { - return res.view(options.view, { data: viewData, title: 'OK' }); - } - - // If no second argument provided, try to serve the implied view, - // but fall back to sending JSON(P) if no view can be inferred. - else return res.guessView({ data: viewData, title: 'OK' }, function couldNotGuessView () { - return res.jsonx(data); - }); - -}; diff --git a/Application/api/responses/serverError.js b/Application/api/responses/serverError.js deleted file mode 100644 index 202df28..0000000 --- a/Application/api/responses/serverError.js +++ /dev/null @@ -1,89 +0,0 @@ -/** - * 500 (Server Error) Response - * - * Usage: - * return res.serverError(); - * return res.serverError(err); - * return res.serverError(err, 'some/specific/error/view'); - * - * NOTE: - * If something throws in a policy or controller, or an internal - * error is encountered, Sails will call `res.serverError()` - * automatically. - */ - -module.exports = function serverError (data, options) { - - // Get access to `req`, `res`, & `sails` - var req = this.req; - var res = this.res; - var sails = req._sails; - - // Set status code - res.status(500); - - // Log error to console - if (data !== undefined) { - sails.log.error('Sending 500 ("Server Error") response: \n',data); - } - else sails.log.error('Sending empty 500 ("Server Error") response'); - - // Only include errors in response if application environment - // is not set to 'production'. In production, we shouldn't - // send back any identifying information about errors. - if (sails.config.environment === 'production' && sails.config.keepResponseErrors !== true) { - data = undefined; - } - - // If the user-agent wants JSON, always respond with JSON - // If views are disabled, revert to json - if (req.wantsJSON || sails.config.hooks.views === false) { - return res.jsonx(data); - } - - // If second argument is a string, we take that to mean it refers to a view. - // If it was omitted, use an empty object (`{}`) - options = (typeof options === 'string') ? { view: options } : options || {}; - - // Attempt to prettify data for views, if it's a non-error object - var viewData = data; - if (!(viewData instanceof Error) && typeof viewData == 'object') { - try { - viewData = require('util').inspect(data, {depth: null}); - } - catch(e) { - viewData = undefined; - } - } - - // If a view was provided in options, serve it. - // Otherwise try to guess an appropriate view, or if that doesn't - // work, just send JSON. - if (options.view) { - return res.view(options.view, { data: viewData, title: 'Server Error' }); - } - - // If no second argument provided, try to serve the default view, - // but fall back to sending JSON(P) if any errors occur. - else return res.view('500', { data: viewData, title: 'Server Error' }, function (err, html) { - - // If a view error occured, fall back to JSON(P). - if (err) { - // - // Additionally: - // • If the view was missing, ignore the error but provide a verbose log. - if (err.code === 'E_VIEW_FAILED') { - sails.log.verbose('res.serverError() :: Could not locate view for error page (sending JSON instead). Details: ',err); - } - // Otherwise, if this was a more serious error, log to the console with the details. - else { - sails.log.warn('res.serverError() :: When attempting to render error page view, an error occured (sending JSON instead). Details: ', err); - } - return res.jsonx(data); - } - - return res.send(html); - }); - -}; - diff --git a/Application/app.js b/Application/app.js deleted file mode 100644 index 94527cd..0000000 --- a/Application/app.js +++ /dev/null @@ -1,69 +0,0 @@ -/** - * app.js - * - * Use `app.js` to run your app without `sails lift`. - * To start the server, run: `node app.js`. - * - * This is handy in situations where the sails CLI is not relevant or useful. - * - * For example: - * => `node app.js` - * => `forever start app.js` - * => `node debug app.js` - * => `modulus deploy` - * => `heroku scale` - * - * - * The same command-line arguments are supported, e.g.: - * `node app.js --silent --port=80 --prod` - */ - - -// Ensure we're in the project directory, so cwd-relative paths work as expected -// no matter where we actually lift from. -// > Note: This is not required in order to lift, but it is a convenient default. -process.chdir(__dirname); - -// Attempt to import `sails`. -var sails; -//const appInsights = require('applicationinsights'); -//appInsights.setup(); - - -try { - sails = require('sails'); -} catch (e) { - console.error('To run an app using `node app.js`, you usually need to have a version of `sails` installed in the same directory as your app.'); - console.error('To do that, run `npm install sails`'); - console.error(''); - console.error('Alternatively, if you have sails installed globally (i.e. you did `npm install -g sails`), you can use `sails lift`.'); - console.error('When you run `sails lift`, your app will still use a local `./node_modules/sails` dependency if it exists,'); - console.error('but if it doesn\'t, the app will run with the global sails instead!'); - return; -} - -// --• -// Try to get `rc` dependency (for loading `.sailsrc` files). -var rc; -try { - rc = require('rc'); -} catch (e0) { - try { - rc = require('sails/node_modules/rc'); - } catch (e1) { - console.error('Could not find dependency: `rc`.'); - console.error('Your `.sailsrc` file(s) will be ignored.'); - console.error('To resolve this, run:'); - console.error('npm install rc --save'); - rc = function () { return {}; }; - } -} - -var appInsights = require('applicationinsights'); -if(process.env.NODE_ENV == "production"){ - appInsights.setup(); - appInsights.start(); -} - -// Start server -sails.lift(rc('sails')); diff --git a/Application/assets/favicon.ico b/Application/assets/favicon.ico deleted file mode 100644 index 0092ec9cace7b2918865c11aea9c1ab1d84897f5..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 920 zcmV;J184k+P) zd(K&bj!6zjDAd!VjEWg#(M(Mbt0SvDM6BLZ@%CrkWZQT4A^q&TUZqQ9*T}-yYyak{(?%V<% z{|+7rg7!_^hI1Bx_S|0R2QT~p8_Ph$DsH1W3qaer`w`d`2kQ#Kf+=e};{XKX*TJio z!I}r$hSHTj)f3fszKr&#&Y|gQJmmn?#)}f*xmwUS%56Ye0BYm<6<|vTxJ`LNIm2xr zTm82NXfJZ!4`8buG$ptTmll8!M+w;W4lJ3I?*fHRya!r|zi(#yuJCsXXy5sbHn9F} zzKv_kJ`ePcPh5BEO40$2{on!G$E^+A)~ODv%TG_3ubkkwNTyfRYbRJ+3Rd6cwyf4z zKUgycu8w7UMPU~()q{<+%G;iBTNbnzD5N!D`!CSao9R>#raxA<+eD9!s=lYeK=YE zG2IJM0MV3jY`Ur+$17vOB^-{9oR zRRihJK|JR!JvW+3Uz-DsG*0@~N&)<& z{WN}!yY$@3_Y&ONq8t%BK?#7ikI^>nl5;Byb$080aLF?93<@AlNyRF-OO~Uh2f@Ho z(EL#81PWlJ8~ifmzv5=6-5zkmA>{}KFx&|a_HmaeS49Khi5p{30000AtdT4!m5{wiC6y#f(pb{u z<5QAKLW(5GmMCp1B+I;i&-0%97E^uue*WL@_wk>4o$Ku9I@j5*v%GJjiO4k=rew72 z*0yzBFsCrnjnbZPT&h?{A9eMOtTc?l!JvTqE)46cg?KGOfGyNNYGD zb-M(nGVbIXgW5+B> zIYQnIMLM>*W5Aum=5_mMqxil!Cvtyq$nabHwaY!#SmdsYgm)O)Z|sO`e((<^eIDtP zhV>gd;P&{ZCyW1P}I-Q+*r zI3~56O>*o$vh}IFJ9bM-f`pt)*6#c+TFARZ*ONqZRG2B&LP(N?tZK4M`N;c}c^zma zyY*GF+Wb`Nn~Ac-ZY5o@1dqtzKBrChIUK&wuU+p96k|u4a z|5;UUx9-$i)j3ut#lPa|FQIsZzbgSx-GB{`N5Qenyea;!1bivpV$e^^wMGftiO4Ha zGK>Y3Tb+7*C?m~^P}1uu@6|M8~CVuPmZ;^9#X=D3ksJ$L}Pn5E>|J+#ri{>$dxFfME*>t53OaSAo z?lLPTE7j(nIiN3fqYJB1N#7l*K!0`N@-bZcE4iz-m$UgR$hVU|K_(~|gC)gSBq^%? zZogbl*edDdn?=7@eNnYVlqx&@Z-utoISbB#FBA_ksJ4nh^$k5=?$;lds+7}I?=Ka# zp)yGCD%sj1+J77}94yxnXCD2ym3CH2sXnXvjq0DOkEs5^7)UYGs2{w$bx>o2{#hU+ zEut@xQJ@pZw0p`Z>suF@$f}eYGpawr^OKkJrhmD8J4Ok2`~F6mr|PNt*=4H6-*L%u zd7$oYKZ{Z|_Ne1yit1tdhoYt7i?OKsT#PE&xc!bXsm6sGo6vce`C*K@<3!OXq=Y+O z>6bAYlSPcGa$I>=B;WUu%VPMypZ-PPHolhX)>O$<^)a57-A0N`^b+5^kNKdDJY+uM z9M?|EV*1`aXUYt7KJ32C6?OnZ)G$CptJPi^0q} zZKN*!WesEUY3TRRJ*xje-=lpJkfl!j<8Yhq+{XN(=9s9QABf4*T3V22Os+8+mFv>N za*fIH@2Hv=E#{_J|I+elyMli3h&!$spOn#EjZtl*jEu!EOfRQjFWE}|jIj)JhxAZ= z5~#kJZJYG#a?G_r&Hs9Bc|lKSX;tHEpmWgr*g2?Aat_%O#bf3u8IM$Z0V4`pn~VB-8EJ6Y*a~Kb%F{PEyqt zdBVP1?uPHLTt7AE5~lpzxdc9paqy=47UNy<;`vY#y10c&Lhfs3cfvDp&@bRst!?*9 zT~#*zS!!-%d>pfDQ`d({*H`MQvfX)+@`#hCQ!lj+_#)KHl#0xY)j>8$1J|p0`SKVU zB@e~MkJXiRub<4(hsn$O3eBTel-m`I-L%tg$pQ1g8p3PE5Ou%&SNo&$v57vVx=|4(`WR7*mgX)v9H8w`S zXRL0fztX2ve}xvTZF{Ac>YFk7&>xyz2_r*RxY#YL=?9lVf2!hQ7=5t-Zn{|e#QK9f zZq=BIuJxB`bUkwQV%F_{qOpAciJ~jyDINFn`laR$wTAzhF2n!Pm_KvZTIBl#^e5=& zF?klI$Y1FSlMAS`rw~1&<}Ia17p9ljyh1uf%s(dozoVDs7L()EI!H_xiP8IG^TIz- zHJ@JAS(J`n$o;2&uJ#~T=rpl#wJ&k!t|)ifwg!kn4;EDunBtr7}yWEnB?q1PuOd`;JgEN7@s@a zjHB@Rx%0U~bX~rBzr&hjPjvQxy`EQ{&EP|@4SeRV(`x`qMS+24)7t^7elNaVls`%i8}TL1?y*2Z;0s*s=QdbzoTv&7PR9#wA)Ug+ETUQ z=ZeP4`8!IR>~`DbH0|;$ZF1V#2K~%FL!A}=soo=<-S$Z8y_|Z}7d&?%-_g!zo)@V* z_&dIp|7G62>=RWTfSIeE2aiQ*Cupa?kx%r~6p%(vkoSGyiG0O$Ww zR`=46?sd-FBcLP1ve89}`@4dO6Bfze1~s5Jfz#O6f;ezJ?w_GSuov{l&H0*&lYbWX zBCrHJh3eA^dNb$-+C)(tnggB&9ir$6Wod9~gEUYSaAxMb1XTJgKw0_ZnZFvlD!WLu zOwQTzKfq0Tm)FdwTk)>!iD-l?vRy{=&YYHe}j z^ile}+B3rV!|2eX4fYvo-LotyWq;w$J4>~X(Q~7^fwC*T-~K>WTPvN#s{g6=#xsR9 zpOKF$TdmavXHMhLQ3tAhhu+s&Re9s52XDB7IlsAjr;@X;faZ zGGbKKje3dF!>;5xmd@*g*9SptjW1Ll?X=$A2Sjx|>hcVEO@SVQeh@1sMpZj-zECDg zmlm$0=@q{*g0sh%Zj(vBc~5f8HMC`PT~%|Bs&g#QzoVD+#ayko>DT<`RINIw$9S$z z`nj%LRNnyTnazz2l%e_`dl|P*oUKIHfL82*TAA%Rt5N%Z6|Um-B3!NGFNz=iVJ>jb z8quZ7sdYj-h2H6R&g!qI_9bkRdmcFlT}pwt&O@s2pcB8K)7zPsDGs?2asjR*g zkQO|zSK$n<3TJVP-943ihN*3LW+>=`KuhNt`f_ErKes{e*({?O4}Y9*E|!4Nv*3Kw zEGdmtyBiCfbNU(56reV8$TEMSUhFBUZx2;R@>r_<=#(a`wBf;@`V+slO5-7L+g1(QeZzjLdW`ELtD%Yv;Wq!w;3{`dItfwezOl9kk-0$iJ zGuhKEg$MLrW3)VCPDl2pWLlb3HhyuQ^t6-{N`~f_^oyF3V-;tvXvO}unDjGNaW1e$ zl8mG1%l+g5+U-Geqg==Sye4JWRBME)qiRQ+vuFdkgA98Rd)(sEf_bK@d56^XG@;M0 zj*ihwQp_HL`%&ENH_bbxihT_CLF!XS8W>x}Yim-+dKdrbc^YY}n&aUqO8w(ysP|3k z%6TYfgQJ-nhT1>jj+Se#gO~e}p-4J&%0#1s^kptxtl&8+$(|=Ts~;hij8CXTOkd_4 z#W)TRoHfvvJ(&|LQMbBQFXWpp33fktjAy@XqQ5@_?;pZ@bILeJS*o3tUd-O#ev5Xf zN&Pt=G<(uFk8rjck!CTf_G{`)gZ*DIGg_uQKGhjQbng`#lQ9~bhp11%8QfaRQ)h8e zdO5!s@8zYN>W}U`L!XJ!m^@=toquqS(9`6+M2)>a(I`K(ZJx!Mg*jU$s!Zi-*Uzw)fyb+3@0bf9gJ${@*HN&QyJ1n{5&XCu|Li}En&pzNG&H&b@yr#F)I zE~0sm&*IA<9`;#!F6HZ#9e}5;lB(^;PB}(I78C~Y`$y4FohiD!GOqLp^Wjahpb%Q% zz6#{0+_eh>f8|%PFrxmY@xKcAD|cF9;II4&^YM4_{*I5o^RGnSSAp`B`>Oo^LmsZm zPvsxYGX?uqz+bulj<@!NT?OJR_kULwSIL)jrAe>+Dij9(%J1*^=tS66Aii>6#RqyO zf6nv*TtfeJ23eI^V=@?zUe>+|tYx{*Hgm1Bjs7+*imgzEnQmWy!o8nprmvCm>YfPy zC$5HbigEi3evQfhF0c%JRq5qql+ev-GmU6doBkPfS{;JkA{5r9&W`lm919xJr)jY!*eTRZE z+g;PkF{hPNbFvv>eS262SZ~T*(1B{MW6rIp?wyQG?*9_Vr!n(|I(vmTQ=PAphq;t- z`V;fVLJdp$(dleyr96JS9o!3uEDA?s#xi#|hAjhC>`V9vm5hE>da*m->2rt^ zPriyOkd{{jVdlbH^hM}(%b*(k&!(L2!ILP9JYCUmfMrWP%j+Cs{Y;}h1I7wRB=|4FXvd!SvPN`qpp_O zsxR3uqF>dL;@TExW? zKDLBDmVUZKTG20V;coU8U1<9f+zTtTlk$3;#OqH=D`eg*3fA8IFWtF7_1DhiNxs^T z^sCOS?Oo&+=9UEGJmaW~45e(f$L@3msv576My;QuQD-3k6=(+so!=^elaKrRD{=W; z;&0Bdu1M>qD;(dySl0b_Kwa{X(+!{{Xr%urH($nJ*{%Ye` zR66%A2Ktxjqwz1_YyT%{E%wRg-Hg8sNi>UcCp8QA9qfyCFcvG&KQkB)tC%PI%VPI! zzyii=0&%{OrL@ffP_cmKcj2slulY9bY)-TOWQoRJvK(!y-UQ50x@PRY*4oIpQ~i1* z{e-<4`@%AAzh_RSPrGw7{d*~A4L|DZo!ytub7SYa>KuYIR&|G`?$KDRngZ4lm(p)s zyP^+*yTJkL2WiZ^g`3s9&v;k&#|ehx>h1~V2k7mLHOBU{?%jskH*&XUJO+*Kag8sj zQzCx6@lbc>`fu`{(OEVdS@NoJkTv0hC@9PesB^*liWQ6_>{<`}GN2m)ZuO^?1n;xw z%aL2qkB6!`&ohqw!d7%Gcw(-aQV{d6P4;vhK_mMFYs~wy0D8iuU&{jI-j(_0xb-x6 zRI}`Ia-2QV3-I;=G(*|1pfl}bdPwb=u#(3#+`-a8G(f1rv7P5>2e7H9IEx zWP_F<4O|ZzvBym@w#XWEjbY|;S!0X=X}BN5y;|02gz1$f%$?a9qk^olUMK7XG{k!S z4pfKkAuNZz(*Vxn`m+`qQr-?rHDj0D$eLHz_&~0=9*~gTleiV6H)&g|w3K%Pef~+s z!(RfPTz(W!QD|Fu$FW5ofc^|l$9PfvTnU#C#Y+^5kE_a1^}Q0*UGWnu=Su3zLdhcr z?PpSiK5UCHE`g z%3rlXv>jAiC@5K|Hi3uM%C7o=5f6VgnOl^sRUGO`_%PK6RQs!TjkUiqPcl@Pilf@n zcp1G_@kcrA^|Mslb1pg0jid4>&uD*oK>4}x+`OIBE^jLQNzyAGRJ&7mRjz7do&IOv zBc<)Fgl!^@>Wgz|Pt^`8?;W^f{NE!*Raxk>mhl4PFDi4F{{d3kgIa z$a$n+t?mxhy5inRWbp=!bt<}6sdqCEyJsxwZA|oy8hK{G&k%Hvd7w7B{X7Ncz1r^F zcUB&8-*$dPU-HU8i#MR^+?lYuz{AE!^r%1H+Rb5(oB-}pe(KGb;#s{5Iu#U&M7x=7PS!nh4?SDzx%`A(@+)~--1Pd_AeZdH!2IwUCsvc6`<_@;3m(G z}*i*d?E|!JD1(cPJYP6*=c<1>{RljpBKmznJPPZc69SrWju&| z*B^29KI6K9Kp zcSynfbY-}m@ke|$zZOof!mspGabokxRrwSu_aF29pT;ko{y%gVUPu0??mw+V|HZmQ zS#PLyO07@sdKH~NFT11bK`dTOfB4(*!s)MYU%B>C*0jQIwLYr+)%vQ&f^z?fsx>pJ zpTyQq*6aBNDA0HQ@c-X&7ha3)ru5^6?8B8l6|JAE4;0d`3a9)365rKFSTFxJ|H9?J z_J@8~xI8sh&=WO8A!QyPE3HUNy!st9*j85oR_30zoZhsg} zpAgnag#sP3a6F~!t&(Y~KV211^|M8so0LO`i-I|(gIaHG16iRHq9fm_p!6&M)Jq4| zJf`4p%$Q+p5%vIhP}||sY|3~9|7GxbBYhE_kTP`X$oi(ru7f=G0yq}l0y&R>Exs)2 z=Y5s4j2&)xDf~D^a$YA6?|6i_O~QG$Qy+S36e&=3&$&mtME;$nHukyrk-wA%3vq9Q zaw_en4;A>kd615C4NbOzj$mPwcG5NHXV;#f+SP4uiH2v>XSz~P`hk=M@W}T`%)$Cf zXRW@Hd{)Zz0w}k$4*LztZM5NhyOk8RUUv@sU%>v(Iq=_sw)4_51wEmF{*(KEqRTM9 zDgFO47>ll5&Fu{IAdy$j&1Wq$+Qex~}G>(4&n6!Ypg z?!1XkXRG%SZ_BN`L%7u%g1s8{gVgdn{JiHE{1zF=kUZO zjk{-8{?>EsrGAnsYTr!Ug7*j~X`?iZ9pKHQmfwmv40J@_5OZzXxXMA_S< zvvGj3xLZ;1Son9uUV=NHui)!f?7UOsY(2|!15~|XSSxeM&yAzvy7r3reaZbyeQDw; zMVRtm7Nw)1>YVp+DCw=@&>G-bnQJ!`ubG7XEBsCPqg)pyDeolqAn3?>qvG#-_U@e7 z=)YrcDNV?;028@O$L?WXG^^wvwhwbgbV#c3y-Z{5Ddw-z*laCL?2FRa`UQCb`y_rX zK@}-sfA7X?%w1z+H_vQoZVr%}xMOT$RwbOcDo^tXP+p3g_wa7C1YuJt=KwrkkN>UY z|0VhF<2$=5pe=3C0<@AX)}6@vG1@@+^X;O=`#ke3ZB_)oNnjB1R2z7v(`}j?<4I{8NyqZY&Ra^t{>&N?X2=VD7{oV>ofcgxZgewwKN$jA24eG zjee-HLMW>9RkPlkeyQFQsrFHAJ0Hp&mupXV?MpesTdK}YR2;nq_Z6?=R_&qU;m0{s zmdX1rm-6OH`_dU__Hhmv`wG%*N_4C17j;l-sEh zMHQ%mio=)3ZrENkEaP#1qCG8(qkehZBg~4~&5s!OGw6q(@x4&4JNDkte&sIyC243i zldb6D>y+E<&YIGT@63iVrj>tRc~1Eo)i?(pDeKHPdB1gzH(KBE9^iKR>MZF&oEud- zdyK5Jo|0C)?c8eo0-)L^?xFX|Sl*P?aWTy4Vk#t4mdXphV*Hq?(lA!8imUQ62TNy_ zFL)tF-MXmyD9kNXr*EAP^p~771@&=0aLbJ4OIno* zL5@}2@|0Y<@_sD}{M!T7Hrye(ZNYl$sCQs5&>o+Gb@X8VoYVq;*It}=w(sFS4+a92 z$2g$!$O42rs_n4nGd;NBW1z%Qf0tHazYdE-eN?-xCf+XIvsTkS;>_nG=U@Sp+x0tV z+`zm3ro8EI$J_ocyy@@A+kU8C-PxDBvI_1+`;*3k9ufq%hULW?`YdaSQCIcqOwm4ohfzwJx(X0TRPW)4wnEb~W< z`i}4(I)uB0+^g!rd&1$Kqgp()62DV05x?iCa}V`y0=#Ic?-==(Fm~qanJp9S_I&rp z9jv_^K86sUDK)K^InSQUTb1ZLLim~uU*ltL?f{$eUN1qdy=snB-!k&nZYg(PB^XOJ zl}=zbKqq1EVw>(BUa$+}?Juc&e#-eK`mcLF8>7|%IiX;WMXBX?3bch#&h*v2qA^OY z^$d}5UXkAve1uVcH-8i7%ivz{lXIv@JIM&}7SI2lb13|Z^QA&CPPzy8NJf#Pa&zc6 z$qBayi=|F5S#m<}@Uso{s8DN>@FIUE9E1mkE5Dq$@L`w24WMdTV za^m;EV4yL4ye&DNwvq!6IrdqtMi6b7zLXP~P51_W@S_v{*W+%)BM5q?|2%$em`CPw z*Kv_|Fc)POc-y$B6@`8c&Vp^=nJAt&zGJStk#|JYk#FEK&<(Q8N0~#PC7+_uj-Wo6 zO+3}!e4j`DRg?~7UZO9>Vb9>Zr0(bdzwn-jH^cgS*u$VKZlzB(hi)Z(CVo8&V0?pn z31uFq%*V-NDcA>igKGux^N_AD7)xE|xyWKoPw1neQ-4|u1v2mU(4Z$HwG z0;OfFHI=*O58V6a4DOCH>^0~_Z3(**nE~sFR56a==1nl#w z>91ALe=@8NU=n<7gy-L(UlUdWS{E5C7Qf9s8v0(Ajs9jo2B{RU4z(`P& zbt|8GP=6Oa(ZAZ@KNzeAw}a~lqyE-3>UflLfb|A$13s&wTahnv%i+!}!}tv>gpcOL zdjos|pJnkoh-}v5u0XtB!B)lsdL_u=8_5jg0&>G29WF=N%?_>{vy9L2Lmu3(=AiGn zFuFs_6@a-wg=f&-bPalw}bxRQIHL0fpkTBbOjB;6mSB}0sHK^+BADE>F3IwAP0;FHv#-K zKeP+D%{nFj22X;|!ESJ{09p}fQ}8qx9Hnnqr?lqSCxav46EGg^0&78IbCJ9SJ_Rem z7hoDl0nI@v@G5wRd7%mD4jO`+qG$kB^Ia-v3c8vN>9Y-a^U;vE8V&iqfQIPK4cYS) zU@vr}f|a9{;x6_a$OIk1ey|373ka95iNh}ev9>jow?Sjj9efJbfjQtI@DfmIUm|`7 z=n1F=JlN|)y;hE+?xA-^{XSq_d)PXlZ-OR)<=~QaKr0IxV!sYr23i$eDUWr$0pJWq z;j*5eccq@L^kCkA57kyOUpL~t;!64#_ta{AwjO1@-p<HO{d*j53%f%1 z@|_TGPSl;h_gQ|^VWtfBrOOSTA~M+X2JYwh9>?KMy8&)>x1Abw7v=2??{&zp6MIDU zeL`8Nd(V8?eIt5P1NKfUq!R0AS@ag0@on3O*za|cEdP(_FKX|VMH^3$vQ}^ApftYE z>&D*v9jL}wV*lh>!#%i~W6McNqcrc5OS^nGQg`vjV&@xm2hZNIqB)s0vfwRNC6yof zy42VXA0NWU{mAG%Z;xh3C4Gm}&Me07;arp!dR5w>Gjbb?E^`m^y4L+JXDNFZ^<7H| zW0vzZyf;w42cz#NFW!{7YpPmT(Z{G?2K8HN%|qV2)8w~I^7LiIInTMrlZw^~ZF7!5Q~0(g)!l3I zMuEEBuih!B_XXY!ys6sD?|rP3QQj}0_gzLN_UiU*+_U+8kSAmmyk7o|C-VZ#Fx2j&`gDPx-JSPCmDyi&FA+PxS7*W0@2We}!uMD1 zebN>8L&#>Kapir_Kiq#SoibLQt?tVUxeeVp<0AS_!RRV26xbl}=Nv7duE}1&{ma2r zP=8n2ZQ{R$A5=^bi;wj$|1PKXjp3{;`o>S`%*J%qGxhdj5N*#Gu|G$zzaH>5k9BS- z^+>a)(%04aq5pV}@jDwW`E3%VSMz<3t7q4yU-4T3?r&nL?z zEb#MomR%$NsXqzIIj_TGNuQH1KJjDvT{9p7>_G`Smn0-bFpEgoxhP?YU`C`UW>JZA zE^w++3^U#}i%ALW*GNhB-^E?Cgp|TwQc7c%k}}TkoQRjjOptPzWh4=^tRy+-q?{yU zCQ5nCB&p#1CdsZ@UMgZwkxG~qq%tPIOyQiBN>UZGvQ)#YBGsKUQdMeTR^zAT&Pa8s z?VOexaxG>}xel|I)WNLnn%7D_=U2H->SOZF8fIO&9+pW((mxyR?+H&X1BV z?J!$Od(76-0ke&CbbjEjr86e`FUAF*{2S%na#?*+p)0zLTz! ziP=qhVRn}+=cM$I-k3e559UqM7cIYjQ_ z_F|}v!5rqA!{u)5BV-)rNX)O~PMLr?$~8yJJ=pJ(iOe};gx)Q8%OuRPm`7xsJb*dg zH7Ceq?Dxn+m=k4+bC})yRLuKi8s;Q<*x~z0nU48@%*1?9W?@d2+1!FXgn3A&$QlwS$P?A zG3ICToVr?Xut5E<5A^=1$lANWR3rOAhj-;m2|q^AkCOxm%86 z?vby!Y5P=;VeXZ$F+Y>znET{}^MQOW-(c>SlbBz~cbEq-x5}6D1Li^b5%Z919+p$i z`*K8n#yl#&I`7F>u6ayOWB*#tU>=vVm?z{M<~Nw{%C~YJ^Q2tB{LVGMmrKqT`N1`R z6bJiHnud7_^BwtFGcbQ~&0jSW`)SQ`Hp>~!gLzi-V*aN2FwgO2>THdq0R=G!OdbpoC9%q7_%X{SK}8P^j`WaMvBqNxZAkb zm~PB8o-;l&&YB^!vw4d-#Y(X%TRp8?tf|&?YmW84b<#R*n|6Zjc<%Fj;9cxp>CN{I z_xhNM%;R&soDiRALhm6B^EcS^n`d3f@}$@7yRPkyqz zUfwPrE+1F^n)0Q~Czh{TzIyq3wC^DsHH_vEr7B+be!l z@$-tuEA^{%Yo&pehF8w4d|!>BHSVifv1a9(HETMxO4Pbxsk5x=vQf((U-sf7Z! z8JWQoG7Z z**nTkD7&R>emN;Osodgnza*ASOiFB%m=TrpEs2v7*C)Q0xHs|3#9tE6CJAz`l2j+D zQBo7++&5`N(&(hQNsFU$E*_P0$K;IUA<5&D=UyS_qR6>a`EpmtIlFw0E9b=(S6r6! zHsrhyIcFp10j`|K)X1(eqNccVK8&2}EZwy%X<6#B(a71my!`TM%jYg%y!_k+xe$M$ z?1hHNIrTz|3#~5fzS#FtGgr<@$a#`;(Q%wJtQNvay%-#aY1|E{zx-0l)Cjrs8FW02 z@wM+B-+13R-&hsm>*32#RQ-9k`?(eJo%394Z?IchJFQIfs5!(qYfL)dQD3ZA(~dFk zOuIBcKP|uMrRn)aeoy!oe6*)Xbm3H_c;PSx3jkiUgUeOQ6UM=j$AAA}*1>Fit~=i3s|S_uSNDB2_N%+U8X@w< z=&$;ILH&>JJ^JalM^3I$p(0179yxL3=#j7Yw>b90fN6Im-~NKgkVi!Z{|bH>d}Q!^ ze$V$5j~A*It5U3Tu}TH0^c|6U;px88#d^7JO_>@s=7dU2-kDextkK*kiZuoOTx=as z2fK|M+ci96JV>1h=cwnTx0r9QvirG__)q^-+mMpnT@3oK)BEQV?-Tz~%wyoV{~JF# zZ=g&;szAF~>Of0;vtuqr19vI}M*ra#7*b#l3UMfVyf6VSKrK_hq$UF%+%gqHOkE8GSxU2CNo{8px=*>aIJskPQdYpb=Bd~r07 z=GA;`IofL-w2oRQt+SS)@m0MR)IwSpt*iXT3fE2RuJzD*YBy<_S}!e2>#g8K=jn&3!u$hq*d1L)$Y?KY4>XnXb;N2G)^V?eSzxe1IM+=X0Ex~ zTw|^^*O{-G>&@5AJo626gZVFWqxo<1O?`*?mbpomn{S(&&3DW#=DX&5=KJPW^8<66 z`JuVp+@YuHH<~-mkIY@>$L1&IZgY?Mskztu%-m;wZtmC9^cLDf+7xZ7Hcfk2o6Z=l z$l6ias$x~Os#(>o8dgoKmQ~xjmi45LRoAL#)wdd0*INy(Mpk3%2Ayw|^;h*=tBKXr zYGyUJQa#PA8?7{}h1JqZw_52(^rKd5tBuvxYG<{#I#?a8PF80t!_(Z8>bcQg={dq! zKIZw_bKG;n^Nr_Q&q>dB-VeOnydQeEdv|zudOz~+@_y|7#Jk(O$NQ;wFWSRRRwgT3 zmet$pW8G}^)pvT*JT2@o_TBbadz?Mqo?zc&Pqgo~@3SY__uCKH589LMhwLf#RC}8J zusz+Lf$nygleN$7S@vvujy>0Y#D3JCXV14EvlrNp+fUd}+6&Rm!%r@P)tZ*BHBZ#8qw0p>vSHgk~P(!AXqY~EoGF^8JN%;Dw;bEJ8vIm#Su z-erz4?>5Jp zljoG@W=~(wE#@ocD)Uu)pnaP?$iCekY~NuIv4`5j?BVtZd!&75+_|{lgW4heHSMszUOS>4)xOe>>1%bqHq)!)v(V*K7lw)3R;7u3k@nL*HO~Y_I+=eWUHO z{rbQ4H}$vlO?JQz+9A7${=*R|`}_3Z}s^>#zMk=@w7!ERzVwVT<^?Ns|l{Ud#soo2VN zTiWS%E4#Jb#%^o3v)kJp?2eu@p0jo*yR-KT?*Z?Z-hYBwREc7mg1X3ttm19xf3s87>uG7%m-72$u<$4VMci zhLgg{;qu{>aE0(w;k!cpLl1@~haQdlEi^7PK6Fp$-q3xasiA412SN{p=7r{m9t$l9 zJsx@@)H<{(^lB(Kv^w-!XnJT?XlAIq|0Vwl|4RQVf3AOxf4x7?ztR7uf3yER|2F?l z*6}_5z5adv{r-dgqpam8{XhDD@t+Nj4vr1Qv3`~gHTIwP=LhtF9q zLW4rLhX#l42n`8M3{48%A9^HEE0`8)8AuMK1S$q92dV^*2fqoG3)BfT2s92f3#0{F z1=s=@M2&^U}a!cAUCikur9DZ@Md6BU~^zg;Jv`sz_!5l zz|O$_z`?-LKz>jU`h!J+<%5-i)q=Hxb%G6ot%B`>oq}D1J%d@n{=pH!Nx{j%X~CJn zxxx9tCxVNDi-Svp>wMzYqQxJQe&Ucsh7CcrGL% zGh_$Phy0-;p*o>@q1nNsp+%vmL(hbs4J{5m7g`c}GPE%Cd}wLth0wCl+R*aQi=mf7 zD?%@ao(ioAtqi>qS{KL*>Uh%?Zs7?hSMe z^bBO70rh8RGB_|h@MvH|U}NADb}4be;=$6v#=&O6zQIAkA;Fcw+~9k`ZNZ(v7Xy0& zdjlr}3jzxRzXbLLo(WV7)Cg4yRSVS$UJT}k8iX1KmITfQ&Ij*_TOYR}?#;N(aqq=# zi`yCZN!;GJeR2CeAA5fDob&wdIq$jPx#+p%$@e&3@oHY(Yj{ns<^A6KgEmu}rOnpn zXmhnkj9ZNyV}LQxxXl=3+-?ju?l6WJLycj^aASlq(zw$YWsElNGRCkE9vdHuFXAg5 zAJ!h#=IJl#EA*H3mHI3Cs`yBJ(fGLd`1oS+*BIm2$4xNqF($HazR#Fs+;2Q!Jjl-O zA!CX$)tF{H%x-!H`@C7kY@gTX^Z9)NU(grw74e0Akw`~hQD2<*9q$(JyWaOC5*g~< zC~IV`UO&=FtIvtc>#{|g&ne7n@~-#aoLp^|slGD4vc7V@L|>9G*;n2dFYjqhw5HxS zwFZ$6+GE}fUor2K-p9NPy-#@;d7t(^<9(KW<8$mBpZ6}+uJ^v+UFKcxebM`pcZK(5 z_U*5DS9xFc=6Y9q*Lc@@KJo1K?BS$gf#*}tUag_$GtWNH=bruYZ_gK=1D-EE2R(

3E9#jS{Y*?TH(W!x)qtKwdb%jFd8M_wE*lX<@CGS~Z- zueO$|-KeGcu9Y`@^}Snt4I`bs4|*qiAM#G|PW4XnKJ1S~_vU*YpZK)+67ePDOU0LtPlzuQUpBs6eAW1B z@zvvN#Mg|k6<<64+DNHL=}1DPOr&h2TqH4)6iJShkEBE@L@GuqMJh+CM5;!rMXEeGFO z&-7WoRNsxhG+zr}OP}rY_|ko?e64+Ld~M?<#NFfX&I#Gu{vQ6G;YH!6!)?Ru!tKKy z!X3k%!kxnz;V$8>;cnsX;U3|h;hVyl;a=gaaPM%R@Xg`A;akGl;XA@Z!b8Ku!o$NO z!Xv|XhDU`*Ggp;oZfY91A<%@`scoQjpbaxrmq6!02D4V9!1aNK%vl`+?E@W{$La^_ z2I?{MTo$P78$spgDq(#yrts*TVts`wBEtv}q zek4Z^bqsY5bqRG1b#vF8msxdQVcmI^m1i|;&ujj*{&lQCud@dI%m0Rd11r(LS&QEG zzvbV=iuA7k9sd^Ar4Rh?`?s<>?eKr--_9EKvHv6gE>^1DtW}?~T7AZP^*Jlnm;NvO z2Uxd`_z(FHvwD5)|H^-iHSAme3AHEn|KR`5|2^y3&;FnMr&!g__<^+s@$vWo?cmiHlyHFqy2(soC4TJ*`R=(naVu5Q||4Om~ zmI;&%Bn8R^5{pzTQoTrxA~lQDDpI>hl_FIm-6LI6TldcDmD!_vx2|0>I(O>Wp?$ly zZCbZVZ`mU4#?iKzwY6*2tWl+MrHU0&$|on5ELJoUE)oj(eO`}k znTD=Ojig*HJ3ZH^m{hb?zm)Wper;;jNJ=j`sAbI>=_#$UbCdcdZMd)g=@Atd=Rgl5&4= z?HygaS;=*Ta3m*_!sSYFo0Oj0YRsVN>Dln8tq%BGq_h~|uUSJ@`vX`5*mA3+j99Hz zX{Nary-IrH)w*~?s#t28-Y+LNqf2Ib%Y@|QUNvj9%`K8bP6SB{H_KeRMXtxqGU;|| zl`AunR@c}xeP&)n`e#=U=A`8G>yw#l^ds$bBYpbxskud~=T=Q=nOk-Iv69GWKyHnc zmg%|GRj%#3UM{EoA4O`pR>eq4()2Szby9x#o_bv2(=X~{SB#ty6_~5H$kn=LCab@M zR8(aDuA&yDZWJ2O|W*eYpIKZL>m%~O&aCL|ZV9ES}4I#>`3!a>5x$w~|}@=~Qgj@(II zG7H>E(m!F1q}Hz9D_74}A)8_$*Yr>!lVTy4lV_*Uw(YxRPR}(fw#`XNN8&U3~TwA5OG68*3C7F&vlN32yKz>M| zfJ#N)2ZO$N7mn5NQ+v^SdZlCz=%uH4Zck=7(BQ%jIoY}m-Hnv_1EWi+00UzI5iqhgCTvD|FsB%c;- z5|Wud+`pPNbb^zj1(V!Mob)y-Oa(Co66~d&S}4B)xtCM}Dk(E%KuWKaK}or(8JS8% zN<40hM1|qDPeDIu-#zn6*A>D-Op;8nE4ipJb6ZuvEJG#S+}5r;CTsfR)xm9J!AaA- zDeb#WS1pke%~0UHZLX-{k=n2*)n-;vJtl>DJt@L;;Z7FQSEr_`i9&Ubr0FSbbEc#HkY<*A}1DTm6bD-N$4KjDp3kx6c->3X>CTk|w={R$%Cr^&5(dVycW zjkmgzTTrU#gqQ^(sj(bP{JaHzlU%=E>Tk6uiKhCkRBx&;HK>R5gw=2jXZUR3ESzJ^ zwd&Y1VKu4X5$`;0(rRC7LP3m4#7ON`z;O>qwCEmLnQMdmVqb!5Qc#-uqq~$G#K>SR zOHayC9p#>0gQjQqQiDy37mR<7aZ;MmOexJ^#17{AQwF5v22#?Le{<#Eyuja9{+^Vy zT+Tj8K8bOck*i^L@12>e2j= z7CEFHtb3qG_(1amhYlE@68!_P6}$n~gLPz|3w;Hw0Qqe%^|;vfLXZ14Y6c$|8KP@O z>RRnWkDo4S96n#d7QWE@!l4VsC}IyI^|-M)iKQBq?BS_n_Xu-RbI3Nb3AzRJ&T5mG z)w*P2F)gk~e51G?mS*%Y>li%}jOs>jwsTJzR(p1RGmL*3-x+9QHyB?SMjP@ht0nX( z(&xh!t4+(T*iD(KU9xiRX}QuPt9RyVO`F~8p;@yet!(?;IxHL6 zWqY;H&B2nYER(QA%C0UhX}v~`zN@7%~Xz0LJip;=MeUyCO#H;XnSZzrtSJ z%EbQuu*H0?q}_Sxqj)PY3qpEBy13RqI3CU2Ou=7<^oiO!@B*mtU$*OUxem%jTb1J1 z9&1a%t)8e<<^tzeovSJR%C=Dw?aqt-IBuY_RV>~isnmgs7kMGoo_9;FB-PlRz#YP2C7+ z2;jBu0jdrrtH1$~`pB++V=xFT1k|zqS^kOKN}xNK0>0t%ciO0774W@C zqhlhC%K`Yffx6!?na^A(zv&8*X1JT-ZuW~vbL5*!J#I9?evvfFNZT&bg8H`<03Ye_ znZCyTCq|^z2$9y+z+yg?zmuOhSTE9!JlbbRu}!1{vgy#3pI3nIj>knhbpY%5cY{lU zEr5DvAd`#?1}5cnZ3D=w>mqPeq#JeUMp!rU?M@xL!$bF#;4uHzuves~LMt!{5dWrT z0Ge3=P*&z_k*qk72H-afUb8+C>8%6G>rMT8PX~Db{`wRLRJIR1^dWAaUErd~%?-da zV5>-9>fCn-I4^R`K=2|UPIf&2-`UiuUwP08z;8do`{CDr4TG3GZ`}!qpEF)$KxsgE z1Bf#qUu56{k=wFG2Eo_uIlL%9XapOH_1Z2-RS zr2cnif@xqqIL5#890wYLzF;O;2jG2lNze}516F{2{F}@+s0ZL-Of!DYl=_eDBQlQi z$KNY5fv^c1MebQCT#JM4BKNjJTQxx$K>SIhowOKG#{KaBz(IZ*wH#;z;OoJiB9nuN`P|a z(57?N0P>w%1T+SlMIKoMi2Dd}AFTp1!8CyUAEoZ|Y)}vM2af`Hoey90hXL}Ne^lhL z2xta|fK`BW3n*hj6EGN1#)6#yIXzwj^aSwp#0Y>q7A_T8M840!&thb-7?~_4pXbQq zIqLb`aginPu>}5>v;)JyTtN9t_V5_P4@!e-fOBmWjOE0h||kZyNugcPEjp@bZBU z;Cov+kq^n^LuC75zR30>fc$sl@-LW|0d2qVQQ*KWT?G#EDRB_M>u)2#Qm|L}umF(u9QmDl1{@dpowoSBCwKr5@Apqc&I_mo z`he+RBluC|LV3^~OaaL3!byIUxishxmI3&?q=PyDze|sT&EOZb_VS=BcmS*chtWZc zfF@uFSOm6%i<}zN0DZtrun~OE4z~>G0LFr4U=Lpxnc!NG4T!4~S0}DPT!XkqA20;m z0|+;DKzhFZ(d-)FP0>6p!70(avqkfj2YFztXuOWo{M$qej1Vmt2Udv|x>vL!#4oY| z5Edq1bXF~LTC}3%6;~Pz2JeX$UmTEEv7X?hXxEGvt$3DbCCInL0&r2ZlH^_TuxO>o zw=`vxZVdW^#o&Nw2|<8g0(mAp0pKg)oM>elg0bL5uvfIQHmC=vSJ_9wW^hWha#cXz z|Hs+6$LCo8kNO99oY6%C$yj8`9cPu1x{V2W)I}L6o+Qpg&9k;?<5Aw#$IwKy2DM zY50JrBQqU68TgXX7w{!x zEgTi4qc3!Y(XaycL#-&CT0;S#tJ4m+BuZy&@0La8Tbcstw@d@%+=8!teE}Q$4ueI2&c4{vuMr@> zAAP*vLO_1MQ=;^@Aq57)OjrlVxs~)=GXOcaBIj1x_SSQvWCcMNAU$gVASdgzD7Voj zw^9DKA|U;?ZE#+c>?r63_?5i^_5iWGJr4TABv=gxphlFOrjP^EVFM7GJMig_PT+>A zPyy(@gZSLx5ha&8x#-9p0doN#a(D5t0DQiav^&w6*AlLZG61~;kTn212cToXTG$I0 zL>U+W#A09{Aa41T%Rda*>kb3_c2mzyoZQrNQ_oGkLBwQG2f&X4-WO~F>J`vNgJU2Q z3SkW?OnL}+LZDgsY+qqg{tl=WgWOO-#8KREDE(_*~d33P)|q zJ>=bk-S^NABYMDe*e=RQY#12}1+W^n0QQym0&y?Fh7$5h&~-2G?;Q=BVYeuwTEj}f z?orrrA9e1d&V7`-Zy?M9>Tyk}lokT=@9zU^L>Wyxj4lFf98H`@OZgyXqO3N0Usu!cOvB;r2d2Gn><;RDKW5Dl&QI*JQN2P zpjMP=n?-pz3p}FCpxz8@oH+@w{}IZ}!mmdc!$nbMWAkIQ!(-@utVWbM*z@>QQRYTK zb3n$tGos8tB+3)`v0#)aPqr3??VGZYw1uZdd1{>~i^zMLw5Kv46@2- zhq6neJi9=YC0zmgp4%o$`2G4lm&A>LeHjOGM%NNqG@j zFRp+C!uAWuUqgIe$`WPmXdrLxKEQ{U@$qH!zl^Of({3+c7NxQ&kXAVzkXgAA_P`ZU zULo(5)1s^+4(ql+Aq1#H+v`s;I`3Xr`SU*F*KmJOo3*#&k3wpC$U741+(`6}X7 zg`Bsr?X7H>1)Blew*~>ezD@bJFYsU!WW9sF?Iu)+@~%si9jQQ>_YR1%6QACnDax*% zqI^IMKOmO7Cy4Ul9#Qt35apv{QTAf%-eIC}-KFe9&OYMu3F-So;It^8jt6Y`^t>ns z#)@*VC6IOq+diYMKf{N^t3^42KSvIUaugdr_ZQ`u!(~yvpskL(VXG)#X2Kd#PNc## z*eA+Yyq=`)*L{FEox+w=M@9K&zbL1vcls3nsHaktGgC$R4x7Hiw(qdz>V`%n?$*aZ+{S{8f4eTic*&(iih}k=8AIdq^SJc2vx}wRb3-0zX+jfqk&&N()ny0 z7S%FgkEr%^QGLksErJ?R`L`sh-!4)8Dcis;YJe(gUMA! zy`qL65;bCzsFBEtS}baGg{Uz-L~V%tMggKW_JtT|4IWWrSBlys6VMe`E^7QJQ4^4# zm?3J@6xc3mvqDjucM`QlBT-uloEEiJt?;#MQQK}1HEF!4>^;@wYEe@zh}!;&sHxLL zO+#NAy3;0z+5y`#DBn>B%5~l;>J2jiziv1zYFGU1dRf#P7XmUe3t+RT-LTiSP1Nq# z)&o0kiiOjn_S`4x%~M6~)l$^nvqbH4PSjhYcqr%|p+C@h}%w!bUhL>Og-$WT8N#6R;#7*v`!nIVsH3rE3~6J~KQ<1gi8?L?$Q#cqXQ1i>F)&xu3D`fO zLez=)FmaoxlZfY}g`z%aLIj}u!P%lt4uC_VPNCeCeWFh71bak%Xbx11I;{{&0bSG3 zKWzo<7WLuQut?PDNw8N`)=G6o7Eo^n`7q0F3GQ6I;K z#|xoS)VVfLZ|(v(Eb2UD&7=H0Vmgnun@|1u(_y=)PhkHO)O!N^ojQ%O()#QQ0HThsxNyNGx`9RmGfJ`m@{*swSkR=_z?pGk$$ zunCA+8SyVePuT%cpCty*76E0SMbDD9FadUo`kV?~U@B0yoU-M^U@e>ybtz@pBdANU zcbPw6@3J|tU)1GckOSDioU$ug!+5}k71;1R_CG%j_K3O?dspTGFRQUL z%>q8JJt^wTagYZ~;FPG9*jS5#`!S17(uus&_Da$@XJ%)^9=sbpuFYx_~ zHKHDG33K6`s9(+(^#nG2g)Lv567^(Tm;*JUevRByyF~ql&)=fwTl&zMg`$2(9M59^ z_byS-6^r`A2%y~g3{ii?&L4Syf%FR(ME!}^pYW|3y+0GnpSOy7F-z26Qedj6mni>h zDjXH{@_A8zJ1gpywLrNm``{#86!rHYNCN8qUJBU#d$p)n@$(N~=p$-Pk*I(67qynQ zsKZ7NpRa8bO>v2)t`JQdD4IS>G$RZ)ie?=b&8LfKzOzO1+b&vzDA59nVF9d$t#Am= z3qM*TT2NcqCt5Hvf~NxMA*VzOO@I!fg>?ethV22;!_gbQ7IwffxF}lW2GOFZ7p+1J zq>2{P7tk9sS+s^dV4Y}JE^ZN2!cMpM~oM<YO}%CUX}yuvdo1i0tq*O}2l;)_*$0`o_yV!J zWhK;z))zbaZh(uT^+Qg-@qmo}Ay5j~cWZMf0m|KaNwlmCI3(I_Fm+8+s}%| z9!OmkCb5H=L>c`*5fT|~R95upDr((ghK z=N(!RI*N9}VL*NnaUS9el;zAr8{&c-7zW54LSGqD4z%Bp?Qj52!)4KmO^AZl&=srEd;l%8o#iETEF4{-uy4jB(b%hLGx7D2EVAKB-{GGcRszsZJt@CEW0nz4DcYYR31MGZ) z_T)aewjc+nvtSJzf?CnIC$2q-4+~S^glJDq6>Smq7ZJlnHKILD-qXZ!ciEbJAn zj5=k=d{%|gumD!TInkETPnOWeOZvkE(Vla_zUMrmmCpurEai1s3D6G9r;E0t0MN72 zhU0+ED{Dntz;pCDFDJt1Z-f zGZ!|C#(qiTUbprZ`nPTq?d?n;Hrpuk4l#Zw2d2XYI4RopFhJLKH(>wvEkK*Ri*N7t z1lsRi?0EN(Xgg@T9klrlQ0!!4ri84ne3K(vpr|0C@GC=X`ACO8Sm-J1Y?fVz8U1F`%VJs%H;#jq1D zi^jfA+m{L0xNjL?*S=cOK4}dFFc+%etZ1AiY5S44e<9%G{{4WyPvc+#tN_~KQ}PZV z>%cnLCfY$8qM#*U`$6nHh>k<}erOs{_YieITLk1E&K2!QBj^j0U=17=?WhX)d$bU+ z;V3>F#fQ%~!b#DNRl-)-3&{Th`J7v6$0_$^7EA@ooWPG02|)UZLvUKOuaNiEO3_YI z?rVoVKpan*K;9|xPNC=24mbd(;G*yY%s~D(2oUY35rEG>&4IO01=#Y_Ik+lXwGFgcbq4f; zVK5$O|LO`Lw$(cUzp78eCDDEk0rdUsf@~;-`LGOVqo1+kXX5vBwP+Wy;bJUwh5k?g zqhKyz&qZvxcnq-T7kvLE3R*%ZK=v;qV7q9SXtQ6>i*|V+VAF5tzTywO|DCkodA-W# ztJwdC4yjNK3tSgOH}8f>ni{r{x?pM_8b`{9gewKHKY z@VS;Ub&RFD9#8_)fi|kc&bqUrdGOgoJlTV5o(-@YknOo58s9t6u5|)zyEYkC12V5s z@0v$+X$^T$3QJ%k?14+7D?Ro;~3D}rO-KHvB7QGodn;#av1@Bw>LkB2;@uIiFhSu2Lme+REMNc9w z$@r0iP3;qaIJ8G!Dt@KTht;qRke6C3dRkNH56DWJ3oBt0oDjW303fSFF_71R^z^>4 zPV@|H$fyy$V+gbcbaW&Z9mm2lz~7E1f%fWzoKD1}6E<}sztd(Qy)*SXQ?GL=lmqfR z?}gKV>@LXeLK*Id>s@98aqO}M_QP55h<-x^BtaGo2g=>B6{KnYMLvm7=7c4nT28qvEE!){rC{%(t)5_Uqh z=q?jtApyr)I0WZK zze$A{(R(fd`fkrXqW795dY=^0Z$VDKeWKsG8&1L%(X#@ex#+jiR=1IU+eOiD-vGS7 zoiaJTfXzABoHHC|!y3Tu9PG})?mJAt?mH-V2j%Xd+#S=P43KrlZa6D?F6DA5mrJ=^ z%H>incL8hxY`Zf6$h)%;=D;SPULOABr9xjQhRLu9DgnRqYD6DE><1uo05S)ld%zml z57nX%MDD;O$O7^PZh+lz60V4zPkui6`Q+!%1nkM*59sE;weIc#ZWs&1$xU51d4o*o z0;Rxs8H6nbI^aVAvI>R+`U=Wm15mF3odxI|901KB6Y>DPgDErkxaft*Eks5k^*Kk^ z3#nIlN%Xs7ff(F10V-fWoE5z&1iAv{i_llJ77mL(L?8-!LMhNEhR`R5pre>}Eyng@ zH;_IQ-NUAfem8w?_!+1b{T_V3r!7$bp7F36kUK&L`qPL4pq)l+2KvW!e@Na~Fw zW+O+#3LtMJc_Yc=x=$}bW=T(=e#v;4FZ#XsfA1o|uTfh7-$q>#{XTrYF9Wh*GOU5^ zqL=boO1aYAqTi3~(dR`U8zcHSx1u zRG{1h%1xl$gcERC^ojn^6uLq#jDlIP3^v0)I0Ln!PYQ#!&=U$^Jj{pHuno?FNAw3H zzy%{<0U+nW6QWPXhsk+BEG8ciooiBk3T-}RHtd4SqEAhLY@ofSZiJJfKjaTxVJd8e ztD;Zq1VupIY3txH)QbLaQ|J%a_V7yB2b7;q`V8dEa9)u$lbFvO4#=E|JzT@;Gk3yq zxFq@`^r1(vh3i`VksK(2`LGQxi2kSwi$$MZ0O*=c-t5&t{%q<$)*RfT&*Af&bD}>U z1}+!{3xR(8_zuzMVjI_^`n;(?*?G01&+iJ;fcz)W!*{gxC$Qy-RMEL6)fX%R?B%*t zUr;0Zli2!XoahUAU5FhEHv@5d%7zZm6LJ9^Pb~)YJatC&MaW!K1apBpPoEb38SH+B z*gP`EGmBzjp4^nenW3FWW}$S5rD4z(uy<(zj0gN#x*86PzD$Qk&M!>zwJ8cvD6Gh6icQ=tdsKrs-9U6VxrfHJ#> z!FZSji$(vC{11u4N1a69OWZ%6Ec(8SqJJ_RE{nc@5o`x+`7}xN16xEth`)!B|Jhm5 zkD&VqHXNA)E1^pCqh+Fhj?bUx!YDx3=Z8f<<`MmPh3H>m#|dP8MI28e=j1Wbzv(6V zx5WQDVsv(+=;xXOb$-Ye{d^-R75&G7uwV2GDX>TMpD53F1oY}elv$VnAN)PB<@modB}x@?fUuTyN;tM!#js8cb*mWK1u^t6=nA8B})vhVT|^>#7MJ& zxOPBp1~zm=MrRkC6Qj#EF>WXqqbu>eae)|_*%x~RLm9Q1?s$rO=~8Jv6i@0(jV60^LpgGnk~j_jl_68M~uyF#dxDij5n#j z75m=Crgy@`*gjv39lX9r-p+ku>^dO^XJN*ki(>30@8e}+?BnzP{$hMuA;!T}F%A)v z!?VRWdQOaEE5$e-B*vHJVtj=iCp(Gp^*S+59T(#?zMet$nX6))je<*Je7{2s<`Uxv zUe9C81={PUC1O-hgJWX+j19kB7UL56zasOu!(v=nBgXF+#JIXej2is<6W zs>M_a#bn%>`ff3eHDa36#I*a1=@TTTU!|D-!^CWGO3c7KG3mc%hzmA~8LC4MI4)*b zl$hZuK>3JsVn*%|Gpa_+=>1~Gl!@8!w3v-j#cUiPW-Miz921j!Yi1mB6OzPi8Ud7P zM%fm8Zc!^{E9A7^BxW1xv^gney9zOrO2kZFB4!Hp_)d`70Xx&ffc%cU?}Qy)3Sg0# zH(U|(#+hPf9uU*DN6hYv!6Rmmslv}Bih1)2F?*x859#z#v)@@UZ><)Sdq`&XLNV{~ z2g=^*hW%pZbrEwwYgi}dKy(e94cM4Znf%Q_U3YW9clT8>2PHsXm<+4ogqQ``TCf0i z1GWt2wQ!o4clCsAVisk?bTNm-0e%)20=5hl*d^w$`C{IUkHdYTE8rK`3+9L*SR>|0 zY$+kmB}c`)7kPYt)x56}oENiHg%}{ev=}x5^-C{_c|Ym*=fMOqMj%L z$B{pd{PE*gb*KZ3uHoE38xX|u3v)^Jz`+X4G$T@v%r2dH{N!Tnv<5$mfOSfZnHu0d_3v3ag#=78@!zmS%va;Y z+=wl&Ih+!66KSvW{`Ku*ZYFQ@Oflb}{2M#O+~R^wV!oLJC&a9x>|4m*O8(Z1Vs7gz zCiiX39s9+654(5LKJV*d?kW)T13rH+0ZsvBcdM{g%n$p+c`^5(=Of~|ccYm68$=mS6UX`7339I}Z4LH9*W7t2#4`JeWzQ7LFF~w;6tMzJ#R@tNSH%jp#R@qjR@e%$B2J1Gbxy1p z(i`m(D|U@oadX5<*dkWqBC(oH7OQy=u~7JJ2N)l{t3wPLkZVH6w|tKCMik`{`U z(nYNH7sX1;605^HvC_|o)roptris;+GB;+zRQ{bI4dvAT_g?P9qipcJr$ z^FynLKU9cy(+IJ8W&k$d%;#P?ut%)k!{NACeP)VvOA3(IcbQoIsN262To&ur(_&?z z=e8bzt=Z(=-W(2ymD5M8I|5+3Sh?uR-6W*2qzS{E`Z>?#&Ww6lLy1=Y3nmDlLFxVzHK3_wN;JG`@_c?wDO-jXfb2-|@6K zFR~t3DAojGGm*~|SBo`?`jgPf{A^9e&MC;6ihU1_7i${&ALjMpb7DBuZ2@pftarAEwH=$c6U%oC z#oCbpSz^7HE7r~qfKNNA|NaKCc1;lL1LW++uie#RaqrgJ(-qE&_0dAH_LjgUu|7u5 z#|OmPhn{`Z`viHPoDpk(rC6U%66*kV9N_c8#bO=ug|%XR)(Eis@K~{qkapyxSVyV* z`DC$-vVttLSQ#zpM8{~Y0zo(J;Eot8_ z5bF%`zDtElvDh&im0ey7Y;bY8tG)*maxs)>OmV*Tk4_)<&V zI#Vo9tXS8^a&?>nhxqZ}#bT>`W)8Hq$xth{zD;anuh`~Qu`Q3-_7<^yMv3jqt6yue z{loZW$T+bBBE$~tB6iSLv4fY19kM~}(A{E(oe(=bN9>4LI4*V+WuoVZ-HqfgJ_O`;# z*4Wf053sdujo9s|({7#ENiAU#tQ9*MdCAC4#?F-4Vz*cs^R zxL@o}2gL4tQtU2#z5zSAhh*Q_OYF?KVt3;`bFSUpU+f++a9r%0@S!K^Jy(l;b0J_$ zFZA?wi`}QK*thUYnzsxTyDvWUtrWZ8Oehz-|4OlMoeq1%&gua*V&8^;+1Pyhb~py4 z^xyJLaax#-Hp#@usa-$|LgD7Yf_fXiYJL|*?o9lDgnF~EwJa5|@!1TqmyrJ)aeMBP*ySmJyz&~cmo5{Vvsimsso2Z0VLA1dW8(^BKabp% z__K1C*sI8|z|R-Pi@n+f9;DFeblzF9t*z0nEa_b8LyEiO= zZDPM#4#<2JTbZZrjX8j>jcb7V8*9aWjr7;h^IA3(!DyHcOP~sf?Q6(;IvbGy95c|^v zz}Ex#cW{N+hp_9=X0bm@5&JOp4)gv9HXIFu!(xAqAIB(n3^`wv!6~tiBkRj8VxQ;= zxiCq16amCRPoUmORqU@b0a?uP_9bruP1ND0^m|*xwC=6JnnwPG>3e{aCTj;oG^za7OGOsDBv7577`>HRLi~UC*nbe08sb!g zuQd~ZIyGm-{xcRR^C!0bxdgVsDL{W6`Z%Zc;r!J{y(B)mEk4FtI3qsRBJr`ih>yQ1 zJ`E0uPjHm@gye`%=rQq$jD=I;6SYyCUr-l)mN7vzu_VgnqZxd0-BNUsw}GNNm?GF(DaEuW4T>*Swl6>E;SDt={>X+B<(b4|Z9}qduyx?Qn(p zH0TqkHPKW)Yqk#$&gGqSOG`^m3l32_^Ao&-+YD~w)f}9rB?hM{*YfhN=H(&zJx@2~ zJ+!3D6nzR>8uBF3ELWR`4SWoqgRnlou^P}w2@VNfpC1zu5*X4X0YzcrD(F*Ahd$bmTE~kfwPtc+p3AF7{U% zhj_lr%g*y$cK&=9szmkod>N`F49p&=G#HqjuY}gk=&$(q*EV_9WO>FYPda2N?kuI; zGu$D|vqo_X?NM%jZJW2`)emNFd^T&zsC$-IEqLXJd#4u6%Njd=h<@Z?_V8jg zZ_Ep0=Io8!vboJYUF%le{qnf^+l`jN3q}l_k^OAlmtl_$DVQz>Pe1+I@EBXfPat zUmadcaQsb6b-dLQmH!wF|ISlZly7?Hxw4IKJ~i&q8DqxIm_BZ(c2`l>bFc3xa}vkS zo-t}}{4yyB>dwj-{Wsf}ZWX%-gt(x2Ru6k|fuJxqPU-sCHB}->L z!8hD^p6U0-6l0S#A|fd=&(*7Sf;VqVq#iGwTz78KeLf<^FD50U(;;c z$8E;6RFv>=iL^sow{9HCe_DeEiP`xLwB+o3ErMtFI%PG@7CBB6jPn3e1{WCRK5lTkKG}VfTRJ?s7(TSWQEp%`E^b7BO zkk53ysX11E=+5EWY$h$9nx9!LmYn8CY zZ!ewq-V4(nfA99^JwI)|>iO;awS`*eTg&emI^n62)9WIX?u%!hd~Cfa-g(FJ&O2c| zoI&fIuPTZ&p*geT^{GU$>gNzjmwC3TZ7A&{ja>ddhU!wSi*8ldm{7Y>-rF})=>-xT z#E+@)NBO{WP)RHHe5j;*w(>g)hT2FO>{(Lxizm>-zbaHDlH_$>iEWu*1C1s;rAzbG z3_7WO(H*EMysei$*eiZNgAWa%iGQhhs2I^77At88nxy=q^3XHSs=Bjve>l>6sb8rz zNDq*7S3^I;v=q@aU*7;r6BGM+_JM6Pi{tOURN62&B$7tl*EuXcleLwVk5u?Nh6$U7=4f#IbZ)r-n=f^a~uV3D9rKe}x@H{jhktcbA zWkW_~J6E``j}Kk4(rp@=Dooz%^L;F5My;Pmoq5GOiv&9wgA;?})8m6#l)}{yay`S8 zWx2{ywN3q-WgdTK+VSZ2kgjR_8qe_Z&n|reDD^P&u`@;!#%PPhxk3%TMzu za}%khgCv6az#08W{?`cq_WEiT^7ld}%C&E=g{W7(Jt|D-eZLNGOAj+BEsxacbFDX>efuZarvex!A!@|&NLKNuex5nk)Q?#g`~v= z2dP^9+td)=>$^|=cwAX=e%p&x8!MiFEt+TB4dQ8ZkJiO|7I|hG6FnRFZ=dH4o~PGY zeGWhG5K#k+t>P~&T%o3Skua@s`IfwnOa9Rpy1}$ zMs^!Dba0BXwWgQRsz*_?-0*bQt?iJ^MUpljzgkHTSA45R4H}iY8-%uy7Nu?;1KyxT zWMt5|{76$F1qadNEHSv~%qSt99VeBjpk4KU*_)(y$kaP#YD}R_3RZdsn~7L8JS;%9 z0<`e(`0%2Lb~ojZxvBe@-1f^C6m7aQXZt;Q^M_`1E`H>eA+vLvsUO{R)4lH7Zo8v> zazV+%ISZEO_8Zl$Pluv8xkI0OXk>?*?;Sp>cVI47kE1mn#OkIp($%?9hN!?$r@ zU}N7fof~a&rEXIi^K=d0arsJOSY)7IHy*vA`S~SACTipI6Qd(T9Ivi7SN&edyG#;6 z=M#Q8lco~sOq$MHXR+wWO6gr45);#}ze&JFXS)<+gga}do|rIh^;7G2eRH6+c*jSJ z=0CQ$;<3sPJwKFf_SAm5GHv9L*PeWSb?yt#%y_!6IJ;_z=d0WF!1tcsc9zDKRQ7%` z-mxDpJzWWkVH&0GAd{!0*@4c+K(_-~@qLuwfWSaAz%>7E^7>)vHN;L0xXq?l+dC)$LMy+_L<+`9^td${n7^m5J{A{#4}Z$l4UG z?X(LAHxlKQM0pN2MTyIm;ENgJ+aSygBe=oXq67y=`b84X$Y{TSartbz>U)2EIREO3 zbdFt&!|TBdichdY5t&&RZSoOF=BuI37l@hNquG`C|Ij4^)ktiJ7gTH#M!k#CAffSzhcXv%pNK(@~ggE_IO9-F`$Esf^XEsny7+c2b@!r8 zeU0c|y`l|YT~bqHOWmo`lJ<@^x_9i}aa?|2clM**yC()FwsVG0U_X-nv%MKU-l21S zPWX@EL;Htz$W%KfF)?Hk$m>%=tme!NPN+NnE53=uJM_Ok-y46^u%4+oU7B6G2RM{$q1%=?!X7LIEWasYVpC5cz`KT_pEI2gx-b=kE=A|U(PUzEP!hp2oJ16+xox$@{i@)#j zz^bB>4O4Hv{e@pE_IUOlx!;)BY3Q8W2Fx4MAw7R$k3r@4^KY-~S5rNN)ijcQK$Leq z)dB;<%iMwfAxj7ON0_p75Z@5`XO&}O^e(fZ|5|4MeHHoFlACaS>D9)hBqX$J$2Dc` zL;tM8>;%{$-00ODD2cA%>zW(*y8=*|e_dsA4Eu#oxRjwg{aYWKhYR&rrpZsSiTFpy zpU>9sCu(GceuLhMtLpGKb^2yvR2;HKZilG|pHj=R-?Gvo%n65bgh1aNS>fBoQ6-7#xu1qQPv1 z-Nb9vS_HkWjdYYgu4c*UW$xr;O>5cPt!X?$F}9Dp0dt+Sjc%K|bWq#qknH?u-P=(0 zyMJek?`(OUSMPe}Z8pWZ@MB;)D|Qki@qaAYTmb&NIh6-}1Ebq@YaW-G(zscV!JP`9 z@6~&GQQwCLr^luBNJzh_d0>#8)X)Gx+U^zWXq_F7N#d;DxKH_8-Oj~hgS54i*RBFZ6myqJ6m zrbUZJhuke9+8uI7h<}PtO6ZaN6iw@NB;P0XNPZyCYtww1wr(ALB)_%Zw8@eDrtBP@ zJ()BA*Ixp)aputfF;{srS^ev;kl8;u1Ci*2u)as8alNC3Ig5Uf#K*Chm-y6<;U@p! z+o38A`f4orJ)>M9SHBc7d}`+4y2Eq}bW>!Rmb zPk$b~TFgU{U;2F2$^8o}#|@ve>RzR?`lGeqD#_XDH+HG3`l99orHwMo)8Dh*^Ok4g zz`?iitXJoG$=`a0dEWoYb3jYE_~BzKl!#*wJV-AgT>2-h9~QsfpW=!N_7Bpyfn$Yg zdXQR_?{5SJ86<>Ax72QbZ5KHz;8HKrxzy7*4B^4BO7j-YTO^v67Oxksu3NPFKDBY7 z8d>*+pJmy4aL_MmD`mTAG@EuiI4U@*C_gZm6(u-W6eXxApGST~7v(#4{oPjHa|>@P(Py1z z`R6ZJr`}^Q?>Uv_-FcabYxSbmBAX&hPS^-m`3*=hL4R-)srmMS`C->p0znMH0`^EH;J=yjj@Okbey&!QC7Q3nGZ)cl*fbOmn7-f8{4~R$v2?Eq81la~*53`q z$pKd&&NU(DlwPXT6?Gq|A$8Sifl)rF?mc(iX3oXxHRqw(hpUgKnr7P0zSr$$ibgR; z->;yUN7P_cQNE=a^pN_YT;DzZ*63BJc$INM8m=^SbPZKk(7tcF>xQB8ua^CQmW_7S z?Z`+Y+>b_fyTiSW92HrV9~GtAe>L^r4egyhyyt4ygMD2q=P1sF*8kG%Ob*UfvHroy zA8FJwp7h=8olWm=_59*_lL_A3xri?C#;}KYuIWuYXMJ=3QH7obo^L#dJTK=eU;Gsp zeUrCEI=W&lP1oFRUHsf`n{Rg%gUUDPWz<=R}FQBxf8pP zYu_u*==SF~;smio_u%TJzUpwP4K- z3~|ivme#GCb1w7GoJB`*+M`29=2Ruo@gO4H@j;1*bpA{0=(rMWJng493HPXR9*K@H ztf2*JB+tvXe0f%+60Zgh)M}b-xV`P48}+{FIYoE z+;JI8!=$Y%A|w>+Li}tW+wJzz18mW?KRhQ&1dvk={nG|%Xjst-Y}>dcr%CF9E3H!@>|`!MNifrB_3 z@h{3ZS#OB4GiCnQ*+~6-<^8K9I4h}l;^M@Kx$s$K9FLGqQ10<8^c=16yrZOEQ+$;S z&%tPAF{5UHvfML{C2^T&gfWJN^-Iq&&nnJPGI;L!o%M65_62e9rA5+Rje@K}?jV0f zRore>u!%<1G{2&JO;i3gqx>~^yz{B|WXoA$B#{}_yQC-$hbr!`&U^m+asR%Zdp%F6 z-Rj;m%0KyFkLQ{ub%Wk|S-HvCsoi(2oAD{p25Nc&uEJii}L{l7(u2eX%B zOe49&)g~}BJk&p$HmHOuMhssEmf9WVZ#kLwQz zz5QNm-aOHJ4)ND=9T{4`R&z$AmA!kzg#1lIl?B_s*tGJ_+mFW{dcTOi)8T%`9t2)n>}`u&45S^RyP8m``0>?zh*ylUPvx(ynHq&4hG z9!F9GB!&7h`}*k?OM*Wqw5-M6{Ro50nJ=9t@J_>V!HnUcc;`ib+@pFL7As}S-u+7N2p`>StQ4mzH%HpK;iqKZ zt9QJkL)-j6KXm4$toF^^`a^#{lAYYBDc}6@wu0Undz?8jDm0J>I{Su%g!$URn&uN4 zz$#|d&)dw}EMnfo>W6jTwazF~8`j-W*XFtn&U)8C+PK1ORcX+mzBlNqt@slf@4DfH z+PR14>~+0shBF8KE9iN}o?Gr$vO*f_0f|cCy=r{j*J=}OO5LqZdo{aB<(E?w=|M}f zZn2-raK$iKbw#mFQ+JM#oc)uIR=Nw?{uvU^wjr7SouR>KV852GI44SGkEXCw1NNXvbx?w)Xkj3|1k+0 zoLeVjuGiI?=}cv{GiM+ts`4ma3QQ_)T09 z&t)y=S{8e$|9Q_Mm~d)2p35x9lh8d2W2{nyayYMS}iS9>3Ma;c}n#0 zRI!$nFxL&!qghuI% zZyP&%RPTwWcSd%a+F9lp>+H(c>V-ZOsCgfG_*b5_9B z%vSMu7|a=2rYk?S`={4qg)_?(_qtrH^br^~u`uvF&;(P0n3bI;M>1 z>8acQ;iViW8jilt|A~ej)yHkKbqwy!WnCao5#^EK;o13qK}N&>YCZ3Xg)=2x-%9@7 za2yXh#yA^v%^Qa6H?FlQdg`tz@BFM72hJ7~m^YqVb?BXEUfr>E$XF%p*Q-j}J8b;J z)cc?O@b_bfzyD&{U)F6T8X;U2@g0lMV4^`-qWz-#xc#CfJ3lbGNi_FPqN4-&f@F4n zK#*bE8qsp%bbVdL(Eqv~i`hpv3-!i{V-oIsIp-)L;o+>Y&MDK@_bb<}ety^P%h&e3 zyRXPxF>m2J5lZc6)ejesQ5q@QDQ=HmKG!PuwO#LRc1BDhh7L1onZbLynwnu;EEohY zz|W7bB>IJ@+4&(#fFGs>`mkro&Nl<=oA94@^iHYuQFNABY;bNyITuLW%JF{XB~l&M ztlv9Ipy!u@s;UR`fC$az9(<$goyqA?_1iq}6637W+_#}?1*!GdOL4)B zNdk4fWz*CCvtd84^;}uJyy7Wkt^VLu8d&}8^l%#Z&8J`9|IX4EclGyt?YW#)_z?N4xa! zgRx1;jhp-**4_j#s_JYXzvnJ9lgVWECEH}*_mG5;uw)=W!WKdZONIcEecurgl}$us z6LCXP(IQgZP*Y8J|`Cj=Z9aS>)A)GC}_GQ4za7IzC1zfrv;&e+K{YP=Z3E~p0O>&{~K znQ8~TOnVj+@GQ+<$0P7N-ZiFAGh7e0Dqml4>un7(c58~z6ex7r9rn6lyteL9kjp9f ztRL&{x4YwgQ9es!i_Z?L))N&PYIwVHg%Z0#cN^2p_1X}aG;L$>=$Y3CL5&Gi4zJz3 z_GqixdF>&*(89Nt-IrMM)O^+`&U^SO=Gf6N8NwtX4=Jt3AqQ`k8%t$!KVs;@}*^7?yo==&0DtmcM_Xt6dhJ zedogyU3+x-C#U0yy6r02>VuLe3ZNSSE_A_bz|{1Lc+kOsiKbr&PS}SMHx}sD1Wc;t zoO+QtK02+cT_61F)E}Py_3vJbW7%JKvlR7{uD_}8NoT)*|M>UczIz&cvBE($S5C#V z|D$`-CMNvsJxLw~tik_yPhNa0;-2hUshoP}viBs(yId~s?66~TiyM9QK_gr#*hn#g z)n;L4+3e;wczk1v?1j1?d5P08>$$g}$O1*wBiw#+ZLLtdU-*)lPkeR-4#1Q5-uH*! z-1gKlHCNpGE{p$LH_Lne(1l!i;J#P?dFHLJ&fKT(6mhHUh6gDRh!yC!bwQ(Gwi>Ls z4y<;Q&7f%&x>c$RGLrn^-HMs=iCc>Xtvv`!D*et`RfW=l)C+%BlV#!4)tgY0Kv>%S zIrPFfAypUaJQkWZ-n!i%hYtp&FO3x(M zp+l;d7k;GPHg((H-A}YW`wlxUHg>)C`{(}fxHuG&pFtN8r0sZCFPqiIsQb&?tnB+{ zb=6!}3hOb(&ic>74RW%7NllJahTbrIWjK2Ksm*G0M%w@@;JfJ(n^n@HB(Muyx?N0v zmsh&VWYfftqKt~@yf9IHW6n2Gib-@Zx#lk>gURua>5`n%*Eg^e5aZ6bQ~LU=q|(l} z{Z;fgMgrYl8iBG za7NB(r^TySV6%HHwn%LT^UEz&ZZN_}nXY+!E6GCE9Gdv%-hMYOEKJWRSywk*y=E?} zFw5|J#G)qE$(wGlwpx#TD*f1bEWzrs4U_6=J*)8E*W$_Caz%jE)ML3ewqW<*(t|#Q zHxDVDdf??Umh0Q%ZJqCmhr6~(uIA=+XRwSKjI@6kqi-5NHo>dXHl<Rt za<~ze!k<7$URb|z|Nf2ZC)e-UQ$JaKR=MF$mit#-VEnEHU_Nf*^nNW8Sro|bLp}%|V`KCt zJSL1ctE`~6%z|^D-pt27y?f*OrZKnNGNx($#=Awc@2~2qeOvHCZCjc9t0KAZLzcO< z4L@($r@s237i0Z_y(`y2$@xHAk_v8soaT(-+LI+i7VqTr+q2tl`58wz$OCR%~c)zIXY? z#>(^q-Q8MD)UZ{|5;8DlMxX`%$|efFK#U|hl`KgVQxjxkCd;p=5a-* zW61XO@wj!VP*F|}hAb^+POeq%+~$GN_ul+i%_!)TabQnMN~e1MrxDT#wrP8h$RiD{ z6XnN>5H@#S8ZE`@BH|&fF%HA(=J3_s#e58|^*}VUC|RsD#wM6)ZLze1)>{7F@E5c$ z<*naiztUSLp><8NC(0Gkn#VN^H=%VOZRfBxXw7#{EbSa6J5`G6**WN+`)Lik@QHr< zC;V(GeL`ebB}-(ALC?W{9?KzODxF9GI=9LbZP5a;U%>8 zwDZOt-6z{G+y47-@27-a5xvJ}h`fdjZBCSD60O-VN?>>odYRwC?FYE$h<$gK7hLYVe8Sd~QCZWD3Fh3}cJE8H%>9 z6&MG3SdQ{Jq^raz>|zFe9Pt=OS%N>>5iy6CwyqWaiPo4yYTVKNS^H(%(;RBOp8}_= zwnFrQB!9|fdZ#(0)|kWf`a7brB)W3bwbtP|1hSVs$jAOC-hS8Xyl*BuvRIyC6vT*; zty|12WYLC3p3N~_8KB* z=F--+!k1``b*07~-LJM^wmrS8*83^p)rj6xym6Q5o!(Vzy_=s=zOLwBWGQKhT6=9> zaZi^BpNTIk`=D9pAl4*CnWBybDT7NA;A%G5ft=$>T%>$*3y(Z%nNqr>RPeL|@n!Yf zq>Lo>4C|M)Dv4!C4<>b`iD#3RxG5tFYP%@xmL3qda?g;D^3sW^ws&sb?3u%c&uWt%xP9K7Tj^Kqk-2pv z=FcB7au%L_sQWc(yK*fwT))s3D2;~I6dmnX;F?wxzu#RK^!rU-yD1({TAu^gBH2;V zR=?LR!px(Dh~g7?Yvhx`g9kf`z9VxFUr>v6voGvk$}|{}W0eKN*BQ#L%7%TV`PqHa z)+w7>fBWapUTVE^;k>n*rl_y&d;GDxPWH3B`l^G)eQ=5uroQ%K@w^(jbFF!}ROcO^&!M1C6!hw6@UGcMtbD80tAWM7heEPJ)qleWmgHNdMFKDJcaH#v3BrER-*|=M0 z2de#9CCF=v5%Cox6y|tjSBWpRKIrqgTzOaump?f^8A~A)mgMDlQcX&{Y%(im?l9La z0@y>e8Z>r&{_!n-$(3~;U8OCfYbE5X;nsL%M9ddnbRXJ4>%})(*4u*VPwrZ{f2V)yszz%=J7XP zdsk*#>2ry1=Ci*kLoYl>U((h)m#w{JBJDH8 zaiq85ch3}pff8o+OBS~qPGh$PVJHhyPq07+zd6br1vikHQWP6oGQ6?2#+F#-A{+JJ z7#Z4eAsd6@tcr#fBFiEJ_J!`C(T=#DSAkVykBu0*^Pvx3Wn~*zZrIiO`Y&&Lx*NX3 zvri5)O!FVT+RcJ;@la^V+uJ@o~>$$y$rB(of$TlqkF zjQa!gus0_Ja&z-y<6^TiO8ogLu_Y-fC9wz`dpzYfDa&6_ker{AVll|E$;nPyOQh)5 z;ExlK1t(x6^S`kPkwjuY(Z_xQPG9^D9a;Au3fzB4f0p&35R-&W$qj<2y&rIwH(1#RXIPc`YFum1sNykA?`*i~^`Qgis4d$Yraj-yru}%4 zO;hjx7d|8}R9`#uf%-evk3P_O)hiSGt4AbxY3mc2lJ&Yjib#5E9KH{B&;IVu4TOB; z_-|ozpvs@~axgvC=1=w)`vI)=$NFO-N1|RLc+X2gDL(&rOG@VPmiU0%S05ih!mp5G zPZ8ZxN+0|MI1K1_;m9y|laa|lX#@D5wof&?lS~Qx8kw5CpfCdKfyD?e zY>9}FoR+y+DQ#7c15^79>%+=fhdK&BeXFhk{LTe*_f~a{Vcq(Z>c=eo!}W6)>^Sn} zKOWw+B#u1+XGLH3gxa8 zU)Mr<4TtQ~&Z1A45-4>#UJ9Dwt$ryOZF2fdCLfSiZUIviBiP*@_wQPwnIc6&L<>%* zM~cB!N+2xUpFD>zEVeX(g}vg?fXMv3;%4PB0#})<%)!quqRHUF{B-F1a?{F> zdYV2It&%Kyy1wFHw*wfE+OirQ8U=JJk|lw|bPB)+!||zwvvB%pV`IFKb^4GaE+yop z1F=bA6arjRAX57R#2{5_P|c?oi@%oAk)Y-3`m5O5HKak^$WCaO>nplm33fdlRH{19 z;W`kSyN?5T_b%oy0a4Ns@Bx_<-TnkYGAR~Y8X$OSO5Bv7sJIgo{Bp9_nT+wfOkRRA z>yb&EM4%Pv(xfv87Z9Ws>}@_&arn5}POv>0_&vhy zsfVSVon`lM>|P$;s8u*^D3(qL9$?6Gg^7V;N5YX{iV*FU4Gu#ll2U~fZ?tT6TazAb zv09^|(%>|5$3EKPb|V?$(H8iR^l9gL&wK$wuSjo5S^~BVd6Tr8-$m{uO*4=Xqb9`w z7z5x8G?^j|ZF+0weXqWC$6xPk{Qc|$FQ2&MtCc%XuG_nB^$TC${MNeL?^^Rb^x50r zdg$&?)YH4}c>B=ZpRl#+`-eAQdsscia({XKy2Es;w0%Agr^*KZV~*8qjxt0Y3C1XJ zpGuT#3z`Ir1=I$XDCCqxA>WqLZplwa3MLjNl*O$t64ndy5vz4+5-x*q=t;!o`6p}j ztXy?=bJtenq0ne*aO$=I?Lzs!Zdqj5@?umJxFV2l81-n2iPB@ZyOTH~2p+`oK|Pr= z3LbMo%a-Z93pp+adNO8ygGXHQjQoI0G~f|<0z90+56~l&$Vc?)!y!lnK+>~d=tcBQ z7<$5mo@|(|`{)Tw7>NTw7|#S@d7!_=X0s}yC?zCFR$zObPAldZUOO`rr?()-z;2t~ zq8RX{AVfR8#p|+L?3So_7w~9W!~j<`C4YubY)DBVFcvvPIVcO$t;-xzdg;*e^ydnQ z9`5_*pky(~Cac@oYIS?7x&r|G9dNyGox{p9%?jM6m2Kh|<9}#Y+u7*mAI6JMbiF(@ zaY&j-?jpnk*CP4}+fV2h@Q0%Go;uVqW(L`1gYRF4a@7+=DWa+vt{zEA(=pOL z!IV~c{>Mirnp#`8-*WTg2&b%5eahCZ*Z%PAJCE^riU?kY&!vx*6G$>lr~D#gk{c;S z?l?s30osADAkOFT0ifcuIZ_*299}a5OJ?1TjA#zuD{yRvw)&RH3yWTY7@amElT z6$O6kpzFAB$TS>{Q(7yV)c3Dk?Ona-*T>eYUq5~CVV3gU3&RJWc=3yCm;dqysiJ5O zJK8*Fi2C0bPpBUCkFWmn0z0a{_=URXC%k-q@q6PY0a z7;rbm77hC+S~4gA!2uqo84MaPhAx~5U`|&G9VcXi(dJ8Kkj$Cl$*x6ma_3rcWml{8 zqnev8-6L%*nbP@a=N;sjM~qS#h$kBnFY#z7eQY{G!99UXp%^WM;;Dei(!9_YriA12 zQyuc@&fzoV^=hus`{S3!Pp{9^5p{LInMh2Sg~j{f2y*EGMXG!mc%XLPjq9PIGN z@VpdYe?6wSb3vOa8T;=Xfy+|Pw=gA|G&vs}^wH5yMM*pl9I#XQa*8wNe2eoeW|HPl z7ZmwgYOQX4k@m(abevgvW+it6V;eXkQD$PHoVmSW{*_Gl_|OekZQSys`sIpA4Rvid zizjxEnsDWW-({q{(b_gz{YEWiZT4Yfs)iq$Uq~ab7dwD7)U@>6K&&U~9I2$|055Z% zhuHjbiot@v`2Zv5K0-l}B7Fx3?>+X)J@>x!;zSGi-eZXI)UXmya^x%oi=J8|tr#J0AvF?Ubw~rgPWXoVR zowZe5v!HI~6F=VSYGz*-U^9Y=b-^WD?wh*v%)Z76cYUzshIbFGF9`;-*B$wA z+dZ9+Pn-1c#Ru2@@#u}kaHUG*!8HUC;m#BakXLwbU}AKVr@#Yh5s#;^P^b$Q7J?fl zgCJp9j?(&Ie7wU`*x2InWMyR{=$)0E1!P!OR;npAx3MMFo)m43OHA}Nwj|oE<%EIy z2~z$>}?%_)~5crf8Y8=H@>c8(Qdm@ z{q+6~yAMWL*y?ppqgP5`7$~fgH{58nN6yg1`Dh7DLCwSEv|!+t|GlS zL+$$bh4qI99$5_7$!k|XGDv-Y=7YaFHCkNP_3XU+e*HUX&W3 zW0h~r{Qmuit`vuMU3>yvbTjVxJk^tXK@_6#| z;|h>l+EQTW$)&pN*FuN{lkL4^SS>=&Ys3#co0~^QL%GcwM?|(u*Su&Y#loM10(jv_q36>bk1S=LL zHBT^4G)v2g6^kBp;a{@x;(tR@yesUL+r;(AHcALsL`aPwkjlG3AJ2GFuOcZzK8 zd_&s4m)+T{x=9Pz-mS`&u+>aL3euk?6ToCp1!b9m4u%VTj^~B+hj|QCas`lMW#V&V z)E5q(XGv^wlPH;+x+;|^)Yo$L3u!m*CqLqSMQ|nnH|g`a-GKiY{BF0+Z&QF$R22LU zSGzC4k^uBff@A@D1eRVe_f5z#NVg6tN}+^I?E*3yK{f%#DE$(0xiG9s9;lUer({0q zPkp3gM)JOE(lT@7kLF)7e|4&R-^#*FrGL!v&zrhxK72l=DTWOdUu*h&=dNgy?>{iN zTqE5MBRW@@8YpvS8xv(A+3dM&$XLovOG|vTC5__9X|aLW>_=OYVtdDtNr~$nR;KHo zES<{+mRU$eR((peV@9H;?egk z-%vWF@&Miq5d`^Ztce0!0Quxm%qCk|lmO}(YmW)30j{qCx}^so1EeD$A0f3# zG)xnPu5T?dCfGz~b-uK!zcT&8{r%;mX?@~+)$tcmgIriA9G7aO<#6Y5r{jL0pum^AAgLXP3kijVlYzb0A>g~v_BHEwWq`O;U zy5qwWG{>bi&^jbuIFR#=&3sgtw8;|~ty*OP@a=+wn z#3K7+bx#=U5pT)B0W=D=$ntHa$Q7^#h+K8HyF41&K#xfC_BDK7|}(v_U7M7xxD zWH#H7d~LJU*p}L$AKPrv@b9*@xSi2(a70TcWW<_e(chC`#3e#V-S2^XV}2?4f&Xi2 ze`-%AG}%bn7xYxkfd|}1#bb+*3x6lOlGX3LwkI{XYw)IB@Vq^bBtGx@Px>SEjCxNJb_HT`Mjvz+;?ye*x{8Lu$Igj_xL>NGXb6>%c9J5I zaw32#0FDJ;nKM!=i9~qFsV_eK*aP>xsD3b8UZuYDiQ2`SXZN2gkXN#dV{cvoRQ#S} zE;Ut0k+RN{-x54N7jA{TFW~(5BX2!d{nuBdki7f^TOG!g!sZb3!5n#c{w&Hx!9Nmx z7VZapWBR$4_($GS6qZZxiw%%k#Db9kuB`yuU<5yn2yQaqLf{fS5r2lLycqn6{OjcW z{Ug<#3-*l;6FOo?UbYuSKyJvt>7{-2x`pbZ5!cS^=>@kMexR&zNKAM$NpjX`K@@Uk zp4J~px8KjTdsgohy}T_Wp+bU1igDS!kF^MPyFJC;Xm7J0 zup6QzyFJDrJO2{sV>CYv>8o^2lIxF-L{H=?LfnvP8L3T(`%{XFQd08s)i`Op zIzazHnt|UH6r`jSsmDPdvN`kd@}F=%s0=|5sN6dK$amH5j^xi>sV6hY5a(#G)@$D>IvZQAqXh0HzMWW)B` z3Yg{Ch6Pt%bIW^~Vp7*BSr&7zozx}y6t);qO z^Xaow>HTqc!<9vMH~4B45auCkQ~=Q*gVVm}s%CrCFPV2ayxcuE^QE5_apj8=clXoB zHJ%xM^?tJw_bqPT(0xmvq&%C?;D1OJ1W0WP6jFAK#zf@v6iGzQgv1$#xJ`WwX)>7& zSB^_6&Q5c>GO`O2swY$?u*alFc*;!m>LW`kM8zOaH9+skoVa6db!X@aKjH~+G5|OM z1&cb=c*-K5-YvwrqP!Pki!|E8xT{=$jS;s9n^2LKuRVWlhhYj0Dy^c0lp*um$=j}8uVP@Qb>}>;@b7>ua;tYhf5)#&XMy*?*F2;vHV=t%y_JRN@ z52n_r3MG=MwMG~v90~+=uGZMNfg{?311kfSwK{2Qa%H8IOcbukKVfc7tF8__-BMj1 zC?EcGOL^RXNaG6KO`~$v{IWDhTHuMk(_93XlDb|dE*0tOLA<3bQv62#+rRz&Wf@<^ zFYbB*l&_CJbMx}88;J6?bNv4&4%k;7Ar9DmH*MH=_w~DWcdhyX2~nyTCU&F|zkd zbXDHFVQ0Aa-2&;h{FVUN5?Rd&9`Un?eI4}^L*UeY^9 zpc<)lKWzqCyVjZjsI0-}(D0|a^`W(<{i3x#1yUewzfkLJ2iP3*SnHJ-?aW*ZTAo}-}R5oKT-Bqnd5JFibX zp(tJ^J3ZS7VdWC-_Z(>Yu<*2e@Na)3GZCN6#V7AncEifa3fLWlD>phMw>w7K5XIr- z#qlt35mMK*BI=4e%W?U5(m9R^#(m!k@y;unhD-=l&Z%!}te;%lC#RpXd+t@ED|gRY zTi<_V9iB4~as#M@AYx4?FAGy^0N6c}Qq9mqQ6gPi9r6D92()v&%@C=vyfcwC`QKWKUGHVdj{j^P`mAi`HMW zbX4=CdW?m_^|I1GbdMlLk5Xfy@mz9`Je^#O1j^DP`Cvg>T6Q+lCrOJ$)SZ22aC4h_ za3CYfg8@dd7@$1Bx4nsgcsoGxm~0T86363dZ_A~zuHR~+n0~;NMrgRbL~8EDl`AGq zUcPFA4q2BE&K}=5kG@!8prRr$7zlN|PnFuhkN_w+z*~@Hj^2b!E3;zV6jUt69W7va zv)5b9cDuBr1$nA^WHJmI!HrD|fH~8!=3p@=^m&yAEUyQ~Ty5eQ^5<6XJ%TqMj@6l^ ze2jGr-HeJs+e+x#7 zMcfp$M9Di^qR>gmzh{3LI3H3E;X0xmX!1BzveF~XS$U;}!zWG{zjgj($8hJk`pO%s z(C1!^YOTKiWrN7oJ_2d<3GILI^ZP2x*#5#Z6Yo9HgwZs9OWEwhalDAvCd}WXhq0m(AOS#lcB>IAtj@1go9UxIV>~^k$Mosb#W$qp z&POgb)1Pz>p>uP#Hwz-KR|G0-aGQfL2(&4|pah>UbD)NU1Jns^Emj*GdP~7uBmps? zC%j1s=;IO`4Zhj}G&U9%8=$Cz$4lk+^53jDAS%xa~Fw^Eqs#x>$Yi zZ)~r+7z7z?QrCKM|77uydXIVpu#JUa;rZ3%u48N@XsKt==m|^zx$*_9<}6`RV4xL2 zR#}OOab$uo31i14naIYM{taaZq|dwXXi+>R z#IB<8uJ+u$;93>)>F#BA;SId}N0`UdfZdGhDPRafB^9LVq5z5zS3DIT3iD7ZH#9@?IR*={-KUBAVwzc8l}Za#mO^PWID>k$!hLPCt3C}vA#(>GJNv1&Oc*= z2o31988K}?vW=4xM8Dr-LLlCR+r^X!)Af9d{Vd86AOzpjJwGP=g*2;`!UcE^kFJGy zU39W#qbF5t?z-@|fg`dl_by)6Z(0AUU`?8VSoD+B!x*HQFi^XE8as($Fkr;RCxgd0_bTD_CVuW+Sm{?P~1MC9lLFhTwG2H?5 zjl+?sBzn)cB%W0;Xyv1xASWWap|i~gt($Q0RPo)*$)I)e!18nmD*ZyII1;@DQGJS~ zS@rXVESxxN`jpvU4Ig-FU)}7|=|$z^tCMe?&?4pcZLQ5NZmXHraJcc2Z52VEH>q-T z(E}B-YZYmsD}nPf@O6t3@`TlafjRcPyfkkbUc+LJwnR(bcw7p!oC=~CUcWuhmWLMu z>h(M*&zN++#n1fAY&m0&#aa`FQ$L0Tf(VDU`KysHT>l2Ir@IsM<w1`=>h`*7cg5%8-U~R!UKPMd$iLjxdD_q7mS<)>-iS1*X8#+&bP!75Lg5Z*zdN- zYV+Y{?te2Mv6vcKZH}oT@f0~NbTM&eBJ!|-U9Z>fjhr52Pk@dJO+1nTe6)_r-t#iF z3Gm*H!6m;C*wRvg=fXXdY-+_ps%oFcXvcOwex56DlCb-wv!S zFRLy)7p$%>%FfBl%`xQ`m6VuDi;D8k1&c!49qwNfrjGCTvi$QcWo0F3f4*gatvb0H zQ&L@BS`ZsP2+24I_cD>O@+1gC|@RIrdx%1YE1fR>T0M{fX^4>crtH2Qx zBS%^6Mmv}W;lY-1-N|<3)uQr&0>WY&$Pz6ENI(|M<_!Mu3xoxZrF?L+kq-p!VGF!TY`^Ht{ljQ{I}^_c`I&h`v{%b+~U$vy`VnBO$h>C4oUE&@7p} z9w(t8o$-PI@+H9&OHd@I6PQS+6U9o1Necu_LbN?P1-NVplv-e7iXcP_T|NLGQK&Km zY3Q|ma8v8_Xvo?kPe0UU$RMayAR_Bc%G8T(OMQZkZQZ){GMrm%W%Kdl%@<1}c(<^6 zC@C*B8D0{N0_+syYWybT8#Yi*FMie{!=yiIk>L+mQ1i`*9yp4OvArY1m*(PrAiSf^ zu9$`0=+Et)i`!paPCVh^zCV(-ptbeag2{qcC-MxuV1j_$v=TYGy<$=*52twgQYbHdH&m3(oO z3+zbjoeNAleUP6$%o;yUqxJJ)K=-SSQ3#>+tpy8v0$Qw>-6y{- zi|b_oMT()svPDWLEx35<)TyDocJcz?v;0YHKbr^EB4@x%uC(JOgZ>~sp9f)X4C1rT zpTqVGi}~zhfUJWl?O>rI<&`FlPe@SgDb_(Y!%>}WQ~8`~@U9(@vL8Qy7}-nySQ*E}(HfZN+EznJ#m_k1O_ zzR!VHUz0`Dx6PMunZ8LDX?>p)o{s3->WS;sx8{Kzgw~qJ_AL7zCsE56CLVx+em#3R z?Dy94g+In8n)ukyGL(1GKS3GBV}9}p8ozg+QnlOArH=gjI3T>8O?)3tE$~vy99)M`N+wKQ<0w8tMx$K zgkaD`YbuX}JC5Ce*4TZx3}gd;MeHjdZo*kgE?P~}T5(Got!|6WGH4TlRN~`Q9m333y+e&Dg4mUQ!FM$86Q|@4I3hd-ft%SPZ6m?ysfmg|uK@|Mj&6!oXxGFru{T5Cbo zSCRZ>6E11Z`!?Jj?)x-*Ji-%~5#zc{-~GdVpN7v>+ac6 zp;kbM*_*UOd}+QBDhx1Fe1P*RQ$+wti`)Qd;1aTdejO4>%XhnlDM5FR*_<>bXwJ=P zYst-3Y&KM?a}5zhed9~7fc7e>-@IT?7SH+an*jun*J zus}I7?^pl2`GFsQIWhP+lMdhZ?JuXy8GqaFuUU8Uu1Sr1-(J7|oqZEJ-()|CpFXdC z@_gHhS6I{?zhIu%S1dfH{_D{Le}AB<^~gVNzwO(@!SN6Nunb@xdY5mN4%q3*&@ij0 zvQu_EQgegBDxcZxNJ+tKr8vsqRmw(DhwSWr{oqiF&%&42TZFemNhPtLx1TpER*u3u zYNkmKK0=#D{<>P+wI}!AZI#o((pnM1_Lh~Awgiivzc)NmcxA>T{e%N9Q#$g;%)5H) z(6KWcHoUQW^rYL5uN*aV)P@tg$IKbD`l0!w#?Cvma!}XqQB!_#&4>}}9tbvw-^@I) zZgRhbci$be>&*>Y-?(w;fddV@U%Pt2;nf2>mkzx0VRX9W(Y4n+wxo})Hy#2i%#Hk@ z(Se-!(t+4Lnf>ZA&Go^|N?ZKEQYkMb57{eu_7o_NDPGS|XpxaN?MsvF=}Ds_|2^)1>;uL z51co7WXcceWqDa%Ilpz@+7Xj(o>Mho#Y2k*%^Xu*lx7pn8QGbZdCszal^$P)Ki2Ds zw#8dLIqZk2hu4p)+wjz)8T%JiSIpcoNgb3wW#^1}w@l3+zNupcZI`tE<638yrp;Qk zAh+~}T{|kLZ)+Qn8m%ae;I!hNT6s9G_9AF<4S_s&CYXfFi`{N>u^&1^eX!WvA9Y1D z@jF?Gi-S`(jwyl5VAQoO0F#{TcT5aGLlv~P`v#{sG&N`6cys>5O_Rpm&{lrMpg9|Bb7#$( zR$oxN?6#(+TNVe{8w;P@P*;ELFRxhg@J7^v9n?5`aQ`U-lk@!xJZW*(Nn?vgj%+M1 zS$f^hsgt%Zo01iiSzb5o>d{m8%qT0HNm(|O>C_)PWEg7HRCs_7^muG#WoCg-0M3c6 zuwP+600s+_3&$2tF9bn&VWAQq52#?g{n9DH9E6Mt+AKUYMTrYlaA^SQ+Os<EKWrJ~L(2BDP6db{e9Q+AnZeKrNgwX7ZGrWe4Vz6pU;u&ut3i3|)NF@U$_bhQ#`Z zj~tnN>-M^Z*Y%A~NliApyskd}j_0$QHnnDrA2%w=AMLV5m5f_FuwQF!zEL)1RX3D2 zEC?i+Z4OhL#pf{3ZXMK6U}FGQvU$r38mdz*E}sP#KIdFnEED%zKB91mJ_Rm(pU>v8 zrD3ZGe$H)cGiM|3D|A})Co|0}HH-y9$TKDkb$ID3z63X-9`mcIq+2Y5q z9^C($=dTyzPA2A+`3^6;e_m<7nKv~x-!QFAI-1?GH5I*8X;DeWNOQ=sS6uf-S}Xa3^BU zA^#i(OWPJJMR!7EW&-HVun3$C8#$CtUv@>ZwXfG-ZDnx^itG6tQI#fgr)| z23HtOqA^ja=s93~fR{p*_4pA#V4S!?mo+3~_)*fBICN1NEM zY#o_aH8N*GUPJ$k`c->J4c>I!w0#S!+sY>`8&FV_>#l9RbI}0SIs1j%rl|ec??&A8 z+OlTGV+z5mHx+NK6WjC&+P{taUrc@t|5U7NLl$tsplbX6dK!7Wr(5N!iFBe~j zXNc;TyKs-q2vj)W7($&%pC2{od@M@x`HZQNbO4e3raeqwq40=B@VWzR4DxmOwV)_+?QojusALOK(!6;FsyDvuyI2kuZ}vV|*O zaGnE`t<{8m3uFQ@+MaK*o{c)gomx6_6qk*5^N?49wkQ(k!jz?ysq7FZJ~-{_)`{ZC zd#<`pJi%_ic(l8-^4iNb0sDx<4Q;hBqt9Z zJQ6Mz1f&KFg9Z4+ffocNBK=U$am)mT-#3hmDCmY zYpcsG8Nalqc9T~7<;_=rw{Zj2e(5;EYA?JEUR3r4cu|u8`qH8 zH$TJa%C8z-)^Ae(AoK0W%_l8&E35NFVA$$O#Qp$oUvTA7&4Sd(e83g&VuSRz5+T%Zjs+1e zDCwJPf>Y1tbedebrd(5rt0c27SmFYl-&GF4ez|M`i){g}A4`Fy!0wdnP8s>gvaXNo zu5`Z7u(865D(+&cY!Sk9@^pFHRp62Yniqj3OiMa*QFf{Z)#yw4wEFjv?R?573zk20 z&*c6fU$sT#) z`t5Vau6ShguDhjK7Z8!?jCud+rPrTYzCgBAUNd+7>Hc$bCXC(GvHnJ$(<*^&cncVj z(ve@<0L|5sZ9(29%Yb}jsj0}^5K_~C2gt}sGA053oa8bVfS@sg#{qANH~`+BUmKxG z-~fb5N4TIUQt~dn_KYAw2S@ zT47vCRdN)2FuY#J*$8s@C87#3FTh$*79N{>3v3if_D=rQgjq-TC*K8GTZ0 zrQ??%TrMJiN05g|N3mO|%7%#Q;z*Ik^>BhSAQ1 z8_@kshuU@3JJN+Uvlg!CP`erHSo8bk7{xMnM4TfX;0UYSfX5>}9P~ul9tQEg1^EOh z1cm$oo@57lrqGtf$RbiAePJL&Ilzze_TDmo-rl`)>*vfFIb!x)=>WLR_TCDPv(aC5dNyqxF0^` zxRj84T5GNKO|zo)eVR?=>#2|YpY1jsbE~6HwBBi6wBAp%xq9#9p^o+I{F8cXn)6qT zO=zt}yiOtKY8v;(#be~l{3*TXoGM^&@3$85Iwjy*;NI_S^qrAc*el}2`{wJZ^?h0- z%q{r^sqcmU^vm>3^s1XBjXj(l;Y&V-diGEUx@~l=FMMY3b-WKbm!bZg+LP(;3d{W## zv34hJ9;ep`5_4l@Q4az{o~7bKxMYZrI}}SIDU2U@7CXO9K~03zfd8b}2m8}?W2dq` zKVR`feu*jS#f#g1zVHX>6Og)3a<6B;eqsZW`=`6z=9D9MKC}v{!+1Ytc9hm$c!NEv zMIqd8yT$cxW^)&V43XJ=@lj4b$yyWw5)Ymhr4ago3wfHW0s)`H3G|u>f;uLOPGY

({=6Nge%l)|fQii!eCA|G-Q6`$gh9Zsv0YF)r+~-4Iq@w4yLr7%P7d+FE#A`%ijXfM@u* zje*ogTRl9)eiqIY1(LUQj3gsA8k(r9~y0Wv_d^p@j-sBpuAy5 zPYE@;bc@0Gp0>Lpk@LJx%`uXkhDWs4-IMh>wP1|LaRz(EYarcFEe<09R2%WpdxSU8 znj$a|ZXMmPwYwY!EkLT>5eL;R5^B((eFKe{-P6Wf$M~rA^X;}6*%Fq99F;GvgyLlp z@&fK?$!wvs2Ap5C9HrP~ecx(kD7VS*En?#TL!la3P!qI5H6(KowTXyEB5Jc7<3~KE z9)NQ#bc$-NeXy}O;VkS_}6mM3l%>+YRnh6h|iSzBg-i+Ne z6R019_T%)KgOiBbyZBsu)b5F3CB|9rP+NGtRI09)#p^0YqtK~0H8m|5OpOJHe=z8^ zCxTMWCz(A?k;>g_ya*cfOOy9>xVfO$aBQhyJkn8Y6_mA)!m6;^;Rgq_*H=ch0?Op? z)n}^82b8T}*7;nF&m04sFBMs}COH&QnyI#+QtrKvNb(Ji42L@=*~JU4E^-wmqz{Ob zaV-*4RFK!nNfrVDK2FsBFj~D?!9f{UFTFT{u7A<{0jHDsD z=a@@cYkkvh*ZTf|{aMqtc*cBmQg1G1-Zz>HhZqA9e(3atY`=>XOzS*lz~D-*}`H zC+{fVKO)o$L`t7)PxkkUlw!Y86&j3%M@rc}nc6w!yX^wb>186N6o>6gyAv{FpDr^9 z>u${Yd93@X5>2X6oHQmg0_%?bfSZ?B8np>y0=b+L)?l`R)(vo~m?$&KmjgblVElrR{Cl(4ILiU{l;E@wk3 z0ngFrC2bBK>?vyV?YE(_HVi4bi9MBV)bq{in<#FBJ<8*}{66Z(*X})5t*;$Od6*Q7 zYcXO+Yw=go@ge8wz7>9>?K(!>=%U}%i=$iXo2(P9@Atum$gLBCl~YET6=f1H?VX<& zt@rnl=c!3Kbl%b3)$a0KrhmFiwf;X~Gcb0#Pk8^G?FixhqFfyhC1pzxf0Bm$MHMbyph$$Fn?2mQ(;l?DVnG+)B0tZeR&TSI7km*dZG5T0(rlT)ujdLPr@|+O3B=`wD z8adPdXa{uurxW(p-n|!|-bnZXUP@S>ur6qClXic!;>PcnH29G9{Pn9w4GYZmSKF@O|(%vpj}?lUONXp{qGY0sJ%UZ!17C4Yv-V+_g$i*y*=-K z<0Y+m-v+8vqK$nw>JaO7N-%n4^5$o1V-Mp)wEn4%fHwNwV9M4}D;U4XEI;{#cGhV8 z+F7d=-qYqslWO}ZTlA-AjozRY>t_&Z*F>DPyV`r@%P^r0+#bWYFWUYqaRZFc9?vz> zMAO^mT{{Af>l&=IpsbdfV9!zR2=e6-nj#&J4kK0>mzoxbQdX})TkIIlte+ul3DkR? zPRL!8-4qPQy6vLDj{l;~G0DkD6!5`dH9B2Lzmf%)-IW3&QI~)SRWu@0=ETI*=`D$} z)f{66B|D{Ok?|J_Nx@lA_Ug2$z3GfO$N;WtScKeri@&+A8rLuX&rVzuI{Q8`@bitS zGw?HBEto0>gL1!fKWO-Si1?-Jg3knth;*O0_#5%VtvVS$rffp@hw@c&z2HG50oVdY zAdf_$L~KsZ(^MCdEh~K}n8iJz-VQj&1?vStQ ze3@N!w0mb=+pLv$|5ZJ+{g%Ifzx#$Wn;v~^jp$T&t^FZ?M_>dS@{fPsbMO~;KEZO= zty51Sv1w)ZHwM3+q2Lz^p}%(o=8VaA^p^+KC)J+|CM8*8EQ4~+1qTi4*Ux<}hc zp3pw$N2VAz_tQex2R?*Yxht+A_Vq@!rx&m5S18kg^?3| zD`6N!`skCS-l-117H7?zGCieYXnN|fei@0edDUrY{R`tKj2b(BO-1wE(!v>y z8(&!8T3i$yUJzF>FeAUNEb)?@h?*hO(~_qQ%N>yIbY)euQ>o?YE_Y_1q(P$-{iD^r zLt6XC$5yrsZeEs^az$PB_`dP+f_1W`sT&ZgN&6O7azr?m?7CB+D7+ zg7U(a$t{zyUMqKVqxSSY*`xa#M3 zLR;I+bHT>88TFH~YbHnTin&3o`P}5W$gY_?w{1+@%=0a6Xa1+nF#dnB8G3C5ZA);M z+@*(H+YhJw5&eks*?U}FUU(Zum{w~ zJcZst3&s@u-*>>^VGHXs^C!mp{N*DG9}yAyXHPV%|1C<%gQh|{4C($xd4u1|+74(C zjs~s}SgA3!RvuIyAq$|I7KsoCl3YJ>%!m=A$Bd3#`-V}YN1bmOeYxe%t?D`Z^;Pv% zk>@@HGKi4ebnGK?q4~8BL5}jvmp}3U*X0F+Kg?uSMu+&5|4C$D(O7=PWkmMH(G%Gy zwXc}}e_k%uM~ZIh3&^spZeb_8Z^Frpc?v2JMO|^7g8+!)^d}K-xDsWHp)mgEEulko zo7g~|O*J#%)Y#G-wipX+AK~s$)ntGI@FcoB;hv9Vi2$3&*Xf0vIdxCN?Q^6s%hAO< z7|dBFJShJHSq!MJOiV`%I$p1u6@MxX&PM|{7J;OZ4~fGJK8_knhi#PX3OF35#6Gd0NSbnl4&Jz>k zj*Ipet8bSE=c!-gSMexk>5jGdiR~-gXO+7JMEvH$j$!w8S9MbhW{qf}#PJsS|E9%9==n{w$c9(` z34BkzRBOE$^j-ub*dgt}KEsbTM{6;Iw-Dn)&pCjZ-OisgKx?61)cUZ8`+)t&`(V%Y z>Vu_(`gpJVd(m(3iSTmsw>|KlAS4A4Sz~0Ci7Tur>XTJ0@nJ)qJNs`3)8QHCh@`?{i(`# zd=w?2QE+dwfxOw+w?pyANiHp^5GNo&7FxV9YWCZWd{iTSN8pvOYccpiyry7Nf zfa@om_1a7GBSFUk@6DrVAgo{7`N&K;P6N+}-;X#8&@=2w^z77D3GXr>;0F&sGnkF2 zl?11w#={@&yo7@vZxnVr>V^h9(jdI0SK%mC_LypwO4G&Pid#yibRF(m z$=^-)dtwBYe1^Hr$wvg66YowxSMi^*!WiLBSc8Z0?o=x!Q$XH2-24tltRXf5HXe^p z3MsA>z~NmkqurT?1wocK%02@G9=b<*gaudsq3-jW9QGP1^I?=G{Y-FoN0~Ibb?UxF z17-}~`270TnXMaN*ibXGY~Ee-T4%EF%je%a9|c|iHRqXaKeG^Xb|4D!Q5mh@20bY z=w>H3KKZyq-ckgs2^hs~%+v}h&YDg%AdJZ8>8DiuKqh!3o;8k#LC$U^-lHGx71s%rgiH65wG%Z z__q)y#D&zGe~YhMZ+6Ms;HQgVmsBrdm&97bw`{;(u zx(I&}$AR+yzYrP**S#SR&sKj zin9+u3`mn57{(m~9;-jLJ_Q z-Y~gj*otulZ1dzhmee>B)0}Fd^7-8T^D6qZtg9cqeER5k+1IpeTXXGobH_LvZGFct z8Q!<8J}5#O$&piSjzAVj!5gqz?zJdT=iMBeRK} z$J?;r`Y}ry*0c^!lt*8GML#CBfw}Xw8@q*z7dMrxShXOh=&FsI`Yri^Da>}`O&7j6 zvv}5@PJb{zF*nYZfbou2-$17K*SHVr0_ll~(WtC|e1v$on4$rEjL!1glN0?Q%<&6$ zkQCd27t>kU1xmmOAL;OWK%;{c!r=LO=#bb-ePerx#@nZJpuI$()$;uMMu{z-9LMa z`u$&5E6q*)w%_~c)4!QIVcmo>tI-jgQ8pZ#SK#LaIQUGVB9IWrArsaZ0Z>jMF4>X{ zFn+S#Wdk|_BuTvkk|Am82zf|ouL0JJ>G$-2AX*aw^BcxpGd`~sMQMz!k_nsvX~F5! zvL|esRDdJ;ZE#0h*^s##Yq}1L$CDeIo6>AWef!0Zm{eq~T6p&r7oiw&=4d$;xiBsv z4W6d4fkL-d>>@4QoDN7(8nVW1X~k(ZY17l72c)GT0Sr)68&h(^=O%P)2umJb1}&i4 zI|YpV$2oUsf^AmR{AoVr1>o$wLaf)$?{Y zPuMlLS`uGS-+N=;te05wv(K`e6H68ySI^%t{=n|5CYP2>ylVIT6Ph3EIykoZ@WqE{ z_79TW!Txs%iC_lC`8NqsHVM&SNl$?QViI?HCh^-t#nmqp-N>&EGnwl5vBz&?X0Y{G)lQJGHIf^@Ws|vHaT-h&43iE53I(DF{*fW-EMY5 zj618oA`4y5u^oB!9(cr^rCpxrflyzR=<65ZP~2bW{8!YpA`(qv`g|B zgJBlA+KKO1I)?Gb3b5m%qnu7iOW?IUwrEq7%|y!?DJ@A%T4f_?!Bo0NlZwZ3YbQ<~ zpRz=qHjiDKGI~s1WvbaS$7GV)njbxM_l--l!SgsRXa3r)J9Z80+mx3ALJKepsqLtD z^tCWtm=mZ-K-HP_bZ<&|0{(Lt9RurwjtnTN^+BVzyrLYbGUer#^h|7+#+G!!G6ZpA z50DMv#2&~)^635K4kJYen-L33yZr_S4ZX91WVNm+8Ijc(4JH$ZI+}W+e^NPkT4y2W(ICH$Ko>((5dE_-y=kA=8 zd8A@oV#?sGqygpm7E55xO%q0MU*6=hmDf!w8?|_JNsQ9mj6h4DAgMZANh}luLn73UOR$^FX4AzW5r6J!Wh~ zhLG-vmeZ@Rdit8HpI$ql`KG6)FM51kZCl@&J0}Hinb)sk)-6+K?wMZ1)P=v@J89yc z7Z=|A*7XDHw;f-<;^Afe23`5^k{JiD99+8=`YG2!HV|+A8~I2A60ez zfxr9S%$p@Mnaq}DvhRBWSqTX+gapDKAS@YzB!CDiAfi&WR1lXUD&mS8TFcL0wYGJc zD&1{GTdinY+k&F4w)WrJ)-DvSB6;)wo_pV$c{7R2Z~Om0Eh@=*=bn4-xo5feESG*` zYulO$E3a9$diRp@?B3<)bS$}cb&H&T%`a}A7c8Hcuc^udm;T_YnalS*wK{V5h0|wU za@P{=CuLLXb2>lwP4Hd>ytfH-*Gm(_Aul39y?J>^lq7CLc2;JF3muJ23>K$%d^VyG zJ(6c;rrA^$7|tpxp1FC!*|)EqIDhXCw-rvCJTar;@~#bcZ)}+m*|qqbtL7IFgXGO> zteaYw=X5XHzJI}uzdtzOaC;pa3d>jQ|Mp1#<&h4zw_z%hIV5f;qRe2u)D+Imhk=lv z@2qg5Bd@atDyznmjbMuGOqA4xRH3^tog4Ja7k%SfTZB$Eo*sn06?t!nJwG#X<*r4u zb`E#U>ROZ6Q0$v=$(M(>KDfEnBv|IK=g+x)O=I)=yEoj#@;^Um*Y!8gx$L_;yL&Hx z_-wYeuCvU;Wy|UjI^)$^v1J<8xl)=OE-J`X9Ts1Hx!tE0IPfx^hwMUR-)7iyC7f#b zIGk?&4_?LIDAdNFtSTu{Lm_$1Q}k%T{SZNZDwfJKZMFKD)54WM)HZKqFFlu4RbCOu z$#ms<%ez_|vk$YG>$P24`I1QmK~IrZoY%W;InrUOl_qw$xu-J2u}rb}>u0xVtL0gv zL!&=kvRYlDKq4~f0P^}aSexN7E(zC5rI78C*Nbo#uQy~5p$~G%?m%Ul(!64H&?$zP z_k|rE8Iv-?S3)m}%`lR>xK*t`Jb?9)a+uJ=aL0K59vAl9nUsItasGF%TR7aa?e--d zLmmCMUp#Ag@eSYJ*r64&pUm0+>l@e!t^BgXmrt>L@R7ai(!)FO_sScN@1LVh0`1#z z!-Iq{_y-HZ)y|swntICmY7e%9&D(=Tur!@@b=EFVt|tT8tr?kCxCim3RA3sZn?25+B;b22$4tse^^op64-Afzlmv&e6?Rw(;frI;Y zG`D~8wmbVqZd>2de9k@RGQalj`S-4$*s<}Jm3?>K_Qm$*9s4Ni_4i~AQBMPY_kZxE!O==pl4l;69snNGvqtS{m5T|8R4VK;6Ltl zb_2S6MsLvUqvB=(YxJKKn9Mn2k<=TfX>t);f_ivt_;aKMiG%wxUIp_0(6GuDw<<^_c z8}FyRqWMN_Ls&}$@iK~ysfN!_9z508S!{F2BG?r1Dwr$fBT#qi3f%ovW@lSV+?hGl z9oL#k)g3aYWuiSyW~PK<2?&t0NCmhBp+uzzLjllJJx@z)52h=M zdh2`N7`gCAOxeHXj<%_Ho^$yxzqHONe}6P=S$p3L=WTsrTJEgD%{d#s!)*6`n-v~8 zyTrdSuWHfVZ{9R?&)c{6)fWw?~FSt*y~zEfh`X= z$OT2sQZx1&Nq8A`brmZkbs0rXwBPs%DzFtOE<`uD{8F>2#4KqQJrWPfh0HA`O0n@L zaDG{cs=%s^65nb2=_a6ksqN(06ukQG>6lrM{=R z(wml(pP!%Sk}qeyOK&-U>ZDCy+Q4QtM6Oz%oCSN%>9VWq z0u9S9pFiQ6FMsRE3u{Jq*ADGJXX))*yV>oFF6=8Ay<@@v0@!(lRU6{ekl$V^ogHrT z7N`ZtLr_&`7J7I`vJfYU`~;^*@uJ}o!u{PSli@*4F~#k6xX>n61w&BCBxzO>jKmEh zrXN2@2?RELS<-07+DFFpTK4gV7BY|ME}WxG*Nbt zCL%vGiYB9@yX75xa$6G9;*pd{GI1A|fnd*!49VreWe_%# zy4_OLCpM8^An4X2wvtoKO=#Lgu|+)WQ$MdkujRqgd6zBMj;*1+N>TUPZb9!=1hFd?9;a$vS>GJQ`GDPr2Oc~#q(Nrlq*$|M%pI)`!DL5yfD?s1>1HSi3-P8-D?u)bI2mmr z8S(+Q0>$Z8Te0PpkN#ubMRTrMKTVO(eO~*OHlP$t2rn3%pnx8>6MtU2iS@H#Hhll- zr?m?82LsO@d+WEq8aDJn{8b3^_u+MlPJA)?h}UOfqfkAd2vJLDf@ZU26c?sv6eyk| zC;@8zm6>VFQoM@WXVcFJKjqvc!?_T*g(URFNfF`E;!Oz0n|J2peRU|tACqZr!<`D+ z+*!5JgVuD_vc_U_TSpIGFW)n|cbD8_^;+>G{8OH>YxH{gZu#q0Z`$ZY`Qd}wsY5wyy?MrV)alMcHaF`K`I4(pUg!p&{Xp-^>m5oCB#5&G1lS$%c2 zqYaH`b5;*}LeoOfXQ7a_p`m>BV1vb)j^@{6^_lK3^U5XSaeyBZUa6LQ2$169LYH6g zBJzyPJCYAnDueEEs4}l=!%eXA+i5$#b=mgsc2}RZW~6@YZEKslEjItee+0AJ{i|^@=*SXVD!O&1|nZx3E4xy=BEk;U$+XtQ@FaeDR!) zb+cN#%I7 zYoOq;-GY`*Pi-PuPW$8-)Jj&YOGPk;^LAR9<@I zy15&sZN2BL%IcwewoV&8TDj_;3#Z`+L)G%B3tv1i`0A_654?EM=4WnR`qWcPZaT8< z><2FnpV`!X+1KQn?o0k-?fH*fHl5^f>Z>a>HhgH(*ptHrA`4WKDKAu}b`_G%qByNG z%Kb{DH(ugX9;>uTTj;r+UaS41M@eTtX;Ruy1|%U5;l;NRV+Ey#aJB;#6dV$gxO|d_ zvR|BNe(6Nh1e~pA-o}<&KBS*WM3^qc!6R+d7ehI^^{s7ZU9-G;%{AAY^ZTu9?vPqzU(O89AqAHT2Thjblwt0+MLVClP zolfXvr&vy|i}B{}MrLi&fWp>}SWv*+Ovw z67C|5p;r7!wvep>VIga4Wa(qgV;G;QcCkXXkF_6E(ry=m&I)(Pi84ce%gP9JrIT-q z8;+mb?L?>t{9C6FVHU(0;`&Js_QhI3=j-Xk+)5EP{TN%`^0zhG1Hy7!JC4~#At8q8 zmP)M2x=hF0N^>~Z11aHgWU4UXRY#B#rB#@f2st+#5Tc21BbNbjb8-w-hA}xFNgqcJ zY8SyC-(`Iqu{CqURl#6kCRPl~hF8g808UYGS`elM8tIjlMXOjl47>u7g_X&JKq-|cVTGj!z}53H=p8*v2vuCuuSb)}= z#Dol2k38SRii_jJjo3uNN8QiU=Mulc*6&?yE7m;nm+S6+_kktaGi%qf>8{}i|9tz6 zZ+~g|`h_<>d+|lj?O!}^?~%`a?k6`b(rZ3$eU{np80~@Mx8vsb9$PzJ;YZ98kx!_S zdl#JeTIBv!+RKBOrzcqJa0H>Y;o(XdHF6Csi<%lKFAvkrQyj$RO>sv)>B*#-s^y4F z988CTQxPFJRng1WS(=NzO0oVh(%h^p`+3Kba8vg8E_fxgzHvf!c>B<#%=%etb}nR> zuF+1dy=F;i_?)YIPs>+OHv(;#J=@UJRFY)_XxcLUVhZoD6x`>7=EuD7PrRq$zQTro>d(x^&e;O-uzeICYM8ZlSN{cH z-PTz%|J-oZ>a`=dbI;41-B35OYH87m^IewA*{ior-*W#sP3vox?p)e+-cVnTT)q5@ z!vj|=tzqwUUbb!B+}h<|{_AaDXUbC-6$SFMyf$05ez>@ZWX84wWMM$FDVO3lm+mhn;09xoufUz<8dJjB>MDuM`9{Uz9RQj<79cTWGiAJJ!;c02&+Ny7n@B+@#bBml`;)z5`pPc305@3a__Jo@&68(#oEgv#TE2bWZ(e_87`%^rWL~jcrOGXs zbpR8d0=k2AUm5VEgFa5E#gU%wL>{}-=dsGN8*S0hxZ7h38ZYnUxAIC*Jivv!ta$v? z&ooctFU3m=>|gGul9Ouru2yInvS@`@%97^Y&Q9Pj?8J6014{RO%}IY`7dxe8v3K|% z*XSwGw+!^o!^=*mG#qYi%WbYIYVLz48VrINgH=_|w!GXt3Y*9)%v+eZIuDGPmq*@c z|6l_Gb4)J{;zE(%r-|3wWN*}9LwavW^+olvRbyPydG+i6^D;=7`MITwmJU>|+daRa zarut<*I#k_Ek)hyXAb;lZ~mO6XElvnyR>4<`e|!=N?CsA1WOQw^jVbZ?m^wwR1lc}&Z-Y*S?xAEvhazG+)}!S zIdI(c=mUOxkmQX**lt2yaw+9CbCeZnnd+IB@nZgHTEMPUpCOz2 z5KjNI)@S4j*@K}~+fh6p&`me8*qL0Esm8M`#d%TIgDw}|HgnQ!&UlFjhliyhWFt}L z0k3TFyUS)+IxvGdhk!MRG2}lGV56*@FXei_fc z9vdp8NFqH=-9AajkamFEw(GrO3s$po{q*G8_ti<<*|11f42;nzVh8qszCqj<5?7=g zzY-9_RAAhc=y4~8=C z$Vp~XAoIgR+EMvOdjIGF%z^h$L%z65`Jm8$%fO4Tz@DQTPVKxlPu47W*tK@d#BQ&x zMO~iSTJo^_$iqgt)f_yEXN7Y-fjX4v@i^NM1sO!qRaCX4d~AM?&u>_;!l9Sqv)4VN zIG1qekOx4k-ad)Tw!VPhi#k{4Ud zoL+CxDVn@~vWHD!O~S=)9C>tQ_XSHDR|T7wcaJ=}Xo!8kWm4t9HLKB!?b}^v&#sx= zz)phsI2T(<+VFb>3%1?Dy=;ndg9axr+e2P9rb+wz8NBR6L+lm$zcE2fl8>Y9wVuH^ zx|dC>>6D$Y8{lQrl5$G{Ys$TB^P+xcFWdT+(`WRtlUCSRWf^{;WXS~$CNG=lATJxS zD)6#lsHCazvik=e9u=K%QtUe7=g;b8TXNf0Z0XRpYd>K3vhq2XEUp{L?~F{*-etk? z%1I&Cyx^jF<;o)i+ECT}%`@v4bQEjzN~bImHmT(xs1#l{A}PtsM#WAGYDfDs{K(xC z&Ng<(jc6ruwmnW*>&_q(OfrtMO@@Hsf#6l(_8$II(v6~?wuq3D-LX#R+$q?3uZXy?EMK@+J_KL@D}Dl9{1{SyAw6$ zb&tDGc-%0JG7%1$nURr(Ib{@PEX-J)fjN=i?QsXK@LP-teY)R`w^cF;O&faQ0u&hqTLpk@7{rZbZA=%(S0g-uz)Do`G!*cM(JQkC{y0dm7` zg_;*BvcFod4Jm3qK;AZMI3tM9Y(h1k8O6}AMa9MWl?X_O%rAG8!{j1aRF&6Ih75zU zvf|=C9XL8c|L!6Ex#3>@q#GaE|rB=;~9vripPgS1&xC1Y7Se zbmQt25hWg%#}QOZguEkhAJnBhw< zfr+Jlx|9&q73Ma|=>2n?24(C#*+jv$MIaA`|uUW<}Z% z(u-Hrih_oU=1Rrd3%v@#fkuKsPit$1&(n$XrB_3z#e~x|yNrIy$ z>bGzeBWwwy01G336#agva$_JMYB$njF|Xa| z^=n&4L-Mm{vd%nh^?EZXOKjyFrNf5*wpwI4qHL{MuzAMJt^KuC^SAcRyKqjq#WHZ< z;@+NZcMM$kz&R5;&OdnOy#))j2Q2&T**Q6OHv$pTKe`n$2$wo@a zhl^y_Z_2r!ME%E2UdK_BSIQ zG&;i7z?%_Owo534_85pQ|cvFGY?hZpMqbmokGTbb*JudXUJy=+nZOzVo zdocTTYucFZ)kKKkBuX9Bg)tTT-vd(iSay4;CKKH5FLUbHTH1&S=ahJ-wYmw>>DY?oW*bJ2IfgB!CM)OBH6 zzEW?QFnL1g&B%laH8tv+k(!LjScVKqDnhlMdi*{g19|chI+35>THYFbd$9F4p59!AT1Ra?!so{=9&8aOe_V8}yB6SxEvK=j3Wu zuKdk%EzWKwDp(X{mp>fI4Q4yT&ccTyZkyAa_qD-5x)*Z3MW4TZ-PKdB9T>QF%GGD@z3Tkk^1(+h zy)^pxS(iOlE>s9DC&XtzjoGe zlu7rWxF@qY)H0_b7~J4+?7pn(>%)(o-nZiy2bT5U{PNDLe|3BR!drfxbKVbG+WlW; zS*}xl^X6Or{?O3i!~eSbz~3KS0aeE{ zvo5oof#1&O-G)Y4g)VDb8_gRxVpe3dSv|-m;`4^di+N{A6X6@_viH;GZ4@C%nKd3| zY4YiE@~kW5X_=*>+g_$N2OBh ze)S+_>V!)~y=0%ohsa8_3`Xp&D|hu^AnbyKl2OA#*0*<@+g0#rMsblBR*Co*4=RlB zsb!BQYq@LCi(pSrV&~H2DWea|VP)HyyEQlagR(77^#vP=Hq>0TTxL}u*%7tiXAC9- zW47#UnB>_um}0g7?t??&fJe6Cxdk?>HB-DF!bm`V8*U$N*m&;O<(`?H zoUxkcwd6xjGwG|AAF-#@O56@qg#9kXzSHMZ?J81srLZHt4`x~8k=iVnFGrgjLm5XQ zM*X}!hz-gQ#hR&JJWt&EXywTCzP|9}*2Ykk$6u*dE}S=guDxwrZB0dm#j==ZGBF$8 z9lspggWJ=rFxq49jwq^h1KO)g8RGIAdjfsW3tr-6v89ELjroNW8?=*kB_)-WB}EOO zccbMH`wsLG)#Q;SX(y@x@%la>tU0T6ZEt30?!ABU z8}%p3Ikvz5o%L&vKKVYK%XPrIK7kcHAvy4@;&h_z9m8J|SW(gN2q`Bj8Chv#m;>8& zqW+D=_us4CfXQICKnm24aJ;tw?=1B(>{gx>4i{zR`iOGVrGVh2o6j5+R3Dq?=}-sBx!BBrW7mb$T{{}L0&tRDw; z#p>I5H_pWyQ(k6nw#|!dmTW0A2mhr60&d0OP?VgV!E8=h6Kt3aEP%Iz2tr~w-7$1z z@b#dAN0s2NU@5OsOW|;>I%!Jr$l~s$;r8`?!~K0LW;9hz8qkS*`<&0sYu~r-(!S0) zvqqo(@sC-Rb{upySPscE)%(aNK)j|;38&-5*@^0yHWUx@I(LG}Lr2j9?5LmuhD-zZ<#x=yl?DSau_9T z)4XXmZ@Q!?PVdh2@y8VRYa=1sR`sQ0}e>RUcAcgyFm zI6pqpzfm!$lsdeHyjeSoiUJ5QciXZ8>BI)Ehkb1!tuZYL^Et!e@XAE_m0gp4(v z6>xBp#vT8BUz0@1Uy^yly3ZhsZAfJgIt>P2xN%$A9WD+Qre|m4_0r}J7J5rca?xB5 z6<@qXUd8KGZ0?<)725$?SH;-_rw?qx*#mr=L@zIso60GyIf-6*W-7;+NM34Unq-Ms z7WP3R8Uk^lv>I~(ue`WQ7l{8ed6-xiIxqd<{ITa{p?fvct50F9iLGF=k6XjFI!C zKE&bJwrGw%hxj)Eyh5ytkD|)6AEn%9UejGcJ*=-sYxH@FOOcT|Lv+QWd2l9ZH{x`O z{dij+MV03^>SIvRczI%dY3gbbFWDA}G2l-hV_voj>)gxgL0tu^4;F%{Xmbw7w6H6$ z1mnq4Fk1}EtK0J)Kb*&SZvpHR;gRm(`z3g-B%G;C0I$)OO{i}M4RUEkwIC&dL+sq? z_NpQ%*8l6M<7ep8&{!IoX-lOqRAXOg` zQk4&JICg!sSYM_17qkb*?C$s|%cPsIPJAXMG|buMsbkRl@o%|Q6*HM59WZ7xfzHg% z=JCeZZV$)DScF=FbpB;lEN1dSd^h5B@pxmE&J2wLsambCRwIq!HufV9&-s)~Rjd}5 zhF=m=m7i#w894|1N-O8c%%i=bPBb2$*d^1Mi4X^Ksfuwqo`-c#K7qf}nW+RP(|XpH z)nLcaw6aKST;j~oh0n#DuVE$N6!gcwkNHy9IgHP2SqMBd`q@b%fY`*j8n?KZXAjtd zUhdQIju*_dC3T0p8+Rng0vW;+=V!Ottrp~H=PWDyN^9#*fiNBgm23& z5!mD0L8os!KNkXjAF~5LKYb{JqR3B;`66|U+0wnbO~Z#c9NQi()aQ^iN@;u)oW2jl z>ElBjj@>u*3qA@zePSld*yqIQQ{)Dk$>7BC#;D_`Pt0VF^ao=mDAA(Gw~YBhj6tVQ zjIjuHNcag?&<+S+*h=)CWGVBYvqxj#>|LO*71vj}W8gU-@w0~!=**z!hp=d1)NzZZ z9Q;J?*0k?#Qm(0PoJ zDDa0l{tr^&IexM$1b%e95js()|Apv`j&W88_JhC=9r{Nz{l7_t2OrQ&i-8{&?Nb7N z8n*v%?Ad5ncQSrR6ueLv_#sjLq{CyI5650fg?|w6re0pak9lK#Sb)EA#iCw>nVTfm zKFD%YPcPsnOBK7za`4RM%FI)fI)#B3_Hc1eTXx~`W%;@Gt>V-w4p3{ zeW2;^G8Cu3m(3LL;&pUqw5TE(KXIm2G4O+PP*<7OzlOh$9*9=fC*hw0c+nHJi*rLS z_g3PZ`2lg}m~K*dyVc`&z{w8*zxOe;XJ@t1P?6rajo195eD!k9mjZV`s`86Y)x?)7 z_;L(p&X+?vUw##siRTNj^p5IKq9+_Y1df|~8XPxH_)o;TQ`^A9=#Yobfn%`q-g|^y zm5yI1a2El$RGgKJ8}HF4xGh3~`8IZsbcnGP^J@I^MMz23o#zm&T&h) zGiNB0h8%kp51V$hu|$QX)q@P(t5Kzy>fTr>ZCroCMw|*yZ=tsoJgHE$2yS9|p&uTu zN(qX&>^&`Q?Y@2T1J-GyzaAK!CjW3izIr7_Ex?8S0gIFv74d_nQITLFMx`u8(Ns`8 zoPU;4CDx@K8M@{gN{-ZSTuS|Vm$K&uFsct#1-^>8mP;GLlgjh+^6_Y&m*;Y!eu2vs zEK}r2L{ZB8!BWMYo9iqn51>j(o|38fd@i4230qJt41GWl%8v+yqe!5qTq{!sB0^^3 zF^nSS3Po<45x~fku6S0BNWntNS#tRtb<(!s`JbVHPDHCpTA6*mSfW{*`p%^Q^(J|)cUk`SWu!0)=cbKfNBo=eW+~U z_gK^IoKaO@ARItNrhw0_AoE92Q9OWHl&8RnT{0r#&P*CpCcYfmeC2r-a5v9cLN5l_YQpt6FV z>gLG^XSfk28Z@UMelkV0YI+_bQ6v9N%jCI;Ki{r}*tbRo*l7)Ey`t^3*29;D)`es_ z)+GnA*Ht;0K0jg;d@PzpNHkqC5R37?v` zlooO6JT_swHppILOWtA=R)~dM!Cc>EQ?&k_+61DGskB*{($LIy}O;maWOvZVP=eZG0EglN$K;WR;?ZWw0`RTG!H?He>SjXo=UrFyxXNY-06|7GPeMUg8J!YN3RS2p^&Ubl z-rOy0fj?xi<#^dy=V=q!3hgUv*pF8#pBtTD(c^C}k-vH7iz`vQ^T(zY2uh2?HBO|0 z1t|#^sllp>XbevfwKjt3sD`e3d`N%50acJL!)w%wgb)#uLqWQbs;Lx0o1&wEX}N+# zB$n)PP?@}JETTP#rQ1E=G%ucW096WU{ZL8pTUftrM01p7q1XyKR;ODW7N^hd^g<2b zFE*!Q^JRgjQH3Rmr+MNu1b&uDfbu+IK^HIn#)aq)wI>TRt+@r-qubfD+Oq9zdQPsT zl}+2GEoQsGG=K);+E>@F(SsFKG6CiFL7HUbnY%+p2nn(~MV+#LNjxPGrqIv0|biHO% zT4vh31&0=)Zc|ZTg;pt%jRj{bv2dn6j|&F>AxA+l_1q5 zVEzE~Um(qif}j=;tTami>JCzX%3tw7OFf{OOjOZ;kawo$ab;L%7D_IE1!=rp6u=sN zOZHL$tWosfg#-jIpbE`jVNK741eB%0*q@*~9+$j0Tc|7ymVm9eGQxb4e6tu)K0{=Y>+~XA zU0+QQZP3doMvo%rn|ugVEiI8-TX{5RTf5T#%)^fyy6?zyr(!Su;KgC};NF|QmnmCb z`P&t1wxYQ0=$qP6=K53hz+*>#7{!+1W{LNK^20}{Mx~$Hazw4KjO3Id;dW)jS%wN$ zp0a6WTgsF)rK}9`^o96=#fo}O<5Yb#(J89ph!nd-DdS8Z;{}=u5DbeDN0e!@KD^IcJnA2SjwOhrMFw#QRrOHK zrW|EC5k8xPav`3a!kmRUt8&%SI8wM>I2y!HqLTgfs08$YjuOCb!z)&$oycV1On;pWGR^`^! zhVmP0wOjM*>O%PqHR>{1T}qKX4|HZrJ$Ts;qEj3qFw-q*K`%lujTkHD&CVW1e3#AbMmU)ss6m%r8F{Op3=k?gXvn%$AIG76)Wg1I*g2GK~Y z@`k};TCxE4v)Ik!YV|llgbBvi4FO(=s@AicA#Le42zEBre&%UI2y0CZnyfUjpP3bv zqSOVQIfgI)ZCc*342o42>wSSfzop^&Pn@5amYbHJ#|(>UVfn?hgo*xtJ}c|KPo9-5 zRY5W+wyl_-hpGY7sS{$s;)DROcx2?5QM97DSfV)j=;>-&Zk7hV)wbyY?`i?-yFMQC zj!|&B73;tMmq$TpdD1A|m`j!IbwtAZsA`ilV|N6(M;513m2K!=YqOzhlQAD2N{ID8 z0#6S2Y{XHeN^@3wv&}rIx%ICvJ9z)%Q;BIc{o)sC@rgm+cVlK%>KZ;~eK>QxG5G@i zx5mQ+lgCqZ4S6MB$y{k>7{Ssc!?_6eQadM-=K+<-B_CF7F%0jjt!FDU@Kr> zr$5D5kt?L%zf-^52;fXnL4bpU3pn(X3RUS*JG`&1<~2uIO0ToXhntXjfliZ+*^DX^ zP`srG;@o2qjRV#gcuI4kxTuQG?FMPOJD#po^8>^Y8y0DspFBREkL|^Kk(j5u> z66KHT0lX)a!+EqxC)g~0->*=B8bu?PR!ipmYt$046!Z6lULF2f%!uBNDPAEPuhZsN z6N*it+kG87UX$JebTCR`T)_UvG1%emny}+_C_~3i@85DN_82o`mtK|LJx#CDN-@X& zYP6^%g?47fF1^YE9G-`09ge*lEi6u=ev`JqvX$OKU;#@~rSyi3C^W3mjdCT{s37c@ z5q`xlh618-SV@&V!vu}J zv3$VyhGWNC4*(i(?pgfJ`sZV?V=qnE0Wa&=X>X>cVvjL1cC7VGvDOHl1MLstT_}Zi zX2uTqJirrQQT*K0!r~O#uQp>xc_i`5DtkHh2cv#(GIqSknP_MC^4KWOwZL9bT$qBr z$c!CP9n(JiJod{adxC|*Mm#j|QBFhyS;i=<#C{i>M?qZbn;-6wa>G8^Q(9QsSgMp_ zu+EZlW3W~Hm6J~3cH0Z!GXA0`|6Fq;?VdbHcWqONoyQ_OKHrf4^t{0r$de3OW& z^M>+LV(L;yc|}6YP5MF~M)}k+e);KRpv$W%ViNOz?8D1x{)}o0HD)Loc>i=8p=S_Z zeEt!wC`m>hlOD%v^HoEw)W!m(0IODH#F`mj9oBA08tb_9y$|0JW4Q`ljV{H7vD8GU zqcPU?Nn;(Cp84=kVysYMs4=93h#ia&yTn+K_UgN0hxj?ZgrBe15Jz&BRQydD!F&u% zeKPDSE1;d4YA6A5lu6EVO~Bue@ea#z&{d}mYx)QL9kN70c%Q6zo9ZaEF0LKSvOrnJ zWdUA5@!bhFN4(2A`Md0gQMX^Un@)Eru6x#T_}KzpQUtt+0=*=fUEngmE8`x+@~pZP zb3}+P@W0Al13XR$3t@oIhw_AM)8pqN*y&@I4*)$!KudqeEa*HTj6(KSR(s93Nsc|v zX+h~@q8;UF1a5k?#-Xxsxu@ec?yM^4&Wg|UdV!m_X%1xNJA9^jk`$wE2o(~?4XHGu zLsOJ4OT`TtM)zSlZs?;w>d@GDmY#~6(|x0XTiVA$pxbmZW6@ll_V~%<)T{K3pnjk9 z9el&jSpZU-Rg~)V$G>QvUw~7#XG7G!dz$v_utwEGC zod)WYRG!i&iS~ROw-f035c*yEozCBGK-*I)*bv8xh#8I>9GeD;5HSJ03$Onq^lnlY zrbFP_ZJcL0cJS=|0^ZLfa{e66$V{q`b6AU+@#7>{o?c1#=|CKgouY^gvmJ0qi<$Am ziaH|T(>eZAh$u_r}Nq zCTJ(nOE$eql@3kzVuVW}+NDa+^0FSwOk*GhStb>NE^=~?+fU;#)h>qP1CrGh`z1#F znR++q!-#|yT@Ki0&TnP)dgSJHVu z#p&j_ao(@gp>shuOT|qZiqp+;<8-~QLsR6YG6r|dj2mbDkj`hB!0iZTCDRQaHsJ;j zkLu7Q-kttn3f+ZCxR1dnyLlYD3n&fBjs|9QFL8Wm^8{U={trMm{pk7n5AT4 zFeJYlg9)zW?>tZ5UiseFtf=89)Zm6K#Y9Q!C*fffn03vtcK-zd~5zFCZKRQWi< z=eP}A&IS7zcs_>hczldkSuVyX2sb-EWrF zU?LduS%hecDaCanV!%$y|H18bjEdWgSI_5T*WDQ}o+)Ha!RZLCB&E!dO=%3PYqec5$uv`V6jIM=9;xcXaED`mh8>c$lDv;9->Eiz zr?%+2qZBf@sG=@WmkH;K*Tdxdv`mM#VrI0GR0puEyfz7XFQjUsLKNiz-U(>fMAck| zy%SBvj`cFth?0A!ap)>exfV^uj(e9YY+JFXoO1aD>i~9c^MiDm&912s)WjthQU3!g zWnXgY<=3U}8ef2XnRQl|r+mRz$M$-Bj5nme7+>%)a?7hzzThjQuF=O(<=>DXW84mAyPq{wNUZup}= zqkV;t1&79N8+X2xu? z4;{eF?9LR-nh7(V4GCu{Gwfz4C0NO_{n;VVUF!wIcu50I!5xVyq8v9XcZxd_vtK8r zr5l3?otmW;%d6sXV9?B9lch~^)Sc}gC}>dq}NmPmZ{p!T3S*93LtW2a@^gT+Z_ zEMLzxiF5Nl?LW=gCivot(+c;KF&WC&j73ZIjFb2`4{H09Mmf&fK73bL7wLuRjp+() z2z`k-d|lph>tdg_KWVJv(ku9md#b3#-RM`yD+=ZNjU*IfPDM$h9b?6Yh3zZ!HTo3c z8;wT2ft1mTl14iw{im_+30sC`=A?`Udtnc^WhN0<%EvgDae0tS^1zNvdOoN4YM@3I za%#wuS%EKL$w1(9c%&D|%u<{s28hEW>jfD*R{~y)@LRfBCQAnXY&!RZY3bm2iedP7 z#7ANryFQLheiO9{4R08>D|y5IpgxxPh-?|$I9VQ1>DB~t4X5n5bcX9to*qOxF4HBa znRH?RXLv8a>l&olNXIvG=^5l2G?ofo4GsDT*Pt9b>|?U)~u>duKle;l4hDChJe_LkGXRqzbh6Z`c3xOqW*217c0 zP;fyOpTUQT)F9{z@MJgePve=F7zy}~VTHtW!y4{5GB&q$cXr-<_esmPYv?zO(UfL|u_0jM77Es$L~MANwbrE2`-sx0JSssu8-Ki8CkH z6Q{AOI47JymvXZ38C|{|j!ne2j!=Exn&!3aV_-1tO_+KFFQD37;zZ72#3aY*yJ$uu*VYMZ4}>&6Y8?Qyvjfv|k1Ae-tYi)T@&KC#zOVRp$ZHrX)$brPR_4%f23L}pAfQZE@W5V zyqQkjI^rvq3Olk}z%B)B*35x%V2Set-Znh5@RJP0GRv435zui?6}S`dGrp+9FClo> z%uj=F#|9re??wCBlCJ=zyj zaY=i$70O}0=RX#E4z?pNg_4MUbrt?HlY~lz9eG2*w$h$gw2T8wdnoX>y`!%&5F<6E zZnA)m@43L8fS>Vu9ln|1-4&k(PqK;cImcgA*ZC>{*^PpPvwPt~&9K8dGNpgxADQlLJD zr&6HC;i(unF9phwNiwU6^ZHmQLngs4Frd&;=oEXN^XKz?hLzf5(CW~+IbgcOv0q0+ z0lQf)U6TSoqTL|iq0j;U7~U|=@Uh&f$N5<_RGmDIq+py6OyBfq5Xju3(Z~65 zG?4O5>~(x|N+muN^O>aGsDHyRV-Ck2k2bU=k2B_*-uO4wVm^;Y^U6}b0spcW!M~M= zmc@>cRyCwzTxUWmrohB`7+ur7TE zjeUsybPSYXoykfm1GORNbE~ykYeI}P)P#EsTfiGqOQ$9A#SHitsB(x(3;uaUSEd?r}_dW?Kq0vGH z7fRc~%@XGc9Bq=D5=fzYk(Yf=5*KN{c zX6WHoq4UV)^UPb21S|YK!c6|5&9XGM3HwZPvJXry&+Hq=n>3(R%kT*SI}@;5X3b85 z6~lRb1L-k8G*S1;BA%FNw8;e8;~#yJ8P-74m9IjW^&wn zqJd0dG3mI49h-n3)*ct|;@u-?xKrVWS)sn~-S}YYjNT;Zh!#%Vk4Y7lO0=0!EmgSevp+$1 zYCwwH+El2KKbxR%mu7|{i3eT=uC|x~<&4UTK$gIkfSd8284fpRKsO#-yW0%+@%Vah zA0_5MZz+&mKl2@0Eg%!Oa9UXHvPQwPwLFrJcy?RtE`pWGPbRN3;R*Z{(49K; z9{jcvw&CSEG=wIHPTb19Fa|gI4FdNSV{jiEgPZ&Z0X-HsI9#2gQ?i#+LVA26r+c4{ z+jO%s2AX&_89MF{OWOe*w?{F@YO+TOGusZ#;9A&of*VsIN5~#CL&7FCLlQSa698wM z^sWh#I9DJgE)!T2ursLUZ5%7X!aUTuCl$6`dM^d`;Xc&+ zaO`&E+n5*cQ;C&*jhw9)5BR?qh)V>(CoH zbb^P!IR-a)*fvXtzL!HMc=(hKZL&$nKqq+EfKIVZDGq?!rj(7~21eKg3k;6ruU{0G zCLrv?JdZ00g4-8ly$GGV^e#h}j)9`6Sq=r=y%Kw(TOEmShaIMG=Oxi#-LKQ2T5518 zfEy;UI5pgMF@6teU-NepmN*oDt5Q$E*5hwgnCntDkMQ6J zzGOgHmTI-JyT}gkk;0}KaU3RyVQrOw2*e?{rEr(PAwgd7YVM4kw%j3qPc4)DlK)AE zq^3K(R&+l>0fA;}U&he2&Q^&cHw}vDG$wy9R6nIGx24Mwswv25tgh~~er>|iS?&Ic z!iAHWH@7TM(J~o_oZY5{<%iI{%q8WAJy!db5y>h$uOCE_FVw4OJi<%G@Z5T&)>pK) zHV3JNsr*pavhMJbp6Y7trv4=}AN}@>8p4&JF%NxO(xr51cf?F7FB0+JCYG@UmIsyf z*8QmBSQE~2OIMfq zVfY@Fcg_1;!__5z5BtsdJ)J=K7$!OlIR4)Ey7f!Av#dIsAeN54&QAw(>8B%xqm4K^ z4zZ3PhDT2ch;#!2w+hxw4pGY?#>J5YF$M>+u)>yjMi)PWA7NdfF)d$GW~w2{D+Lj~ z>%}otT>+m@ayhI%^pn7WY^LTzIFxArc9b{vGI2Y)9P=iCXunn}`;6n+JdFti+qQM9eqxR~f)`k6i)S%x_qXq&VtKU!KHlktar;hALi@(&7 zzcewjF?Hk)?MG}YMqXgK3+G`s=362)gfk_Ff~tT@NhlM6YUzCizEB8)h@=o&-W{#Q zv{5*L3Y?HYO7OQXnJTC-2c5%q9K@{5EO|@q)T-*bdVfWGnXkU}0Y_`=j0J1Z6|Qgg z=FNSxz1G~~vcj^-wRtUd#kO)++gGPlRm|=_r@f=IV=ZL~;illPTsP58fhxWB4bF22 zO5r>mdk4S&1J_La_x9nhCjb5``2D+TInDs$wEpXLn*NGE`2PHubhfvRsk5U=>-6GlC1`6qw=B zKL{9=!(i|GO}t(bP6wMiB$rE-96kk&>xt0?n|rbORJ+FLZ;57QS+)kH98AvoJFBZ3 zr!_meT5`*#)Q4Cz=kh6&TPmt2$j$Q#EBr0f=N}YYPU9I|j(kTjxPwLuD1Osuss<^CxhdQ$xh(+ zL!7(mHi;}RtKg`KI!6fz&fgruKFq7QgAp;di*&VBK9;OuH%}aOV=*X zrRa_?0pfZAagNX~Ul9=e(UH6aXctSE#}_nn2;V}4pr!0is^xC(3U-w>I&yD{IDjUNO;_<^;wu+rfRd40J)M>X?n`*xWA zPPDdx*2~Sb+F`KS?f$UW8^{anj^rt*kfR{qtN4aNlymleBCS-o%4n>dNk`I}^b_Us z+Co=O5Txa#iKwB^cT z>qU_W;X4INh{9bJ;F{S#DqtZ!ikHe}2@QIl(@&5GK~9YH727-8Ba2}UB=#{K$ai1#H*Jq!N%iaLyoNh7ZxOP0JNP-uik*51R=etoV5VK*v1?nG5aR5q1tIQGrx^ckNo9exFWwD&f@GAFe8 zmD$#}Xto*!z=)kxGvF`gpej~{H|zi9?!DvNEYH31XG*eUYcI>PrfqpIdB#pGZ^h2A z9VfA5JD%B_5VC=g1tft$AwUKM2rC2#Gz}?b6QJ}kN-3qAQcepmr!75{m$o5({QKVb zBiYL6dEb8C|9+(*ws`d1>$J z>oQPRfwp*VOI4z)pc-#|Krk~4Asy+hPGYo*MAKf@`c0R*Ar{78J>iAOy^e;Y#7JE1c&p#A@o?|Y3o;L;gC%#zn zkBR5QQV)Y7SKRpwpj9c9#M^;uTg-;o4uCl-z=CPF-g7c6tH}=lZ*O_(o({$rPbAmM;w4C1Cy;qvo$-1RaIxqb;*)?*CoG1VflztmfcLXljhTa1Br~C}Q zJ*89ngmrh470#6UnP)M!2K%R1E0qk3Z>j}W&2lQRLjr+G1|^=rQuJ&lhX4p{e|Zqj zy5O^T7n#f#`}cS3+XvYwj1REP_;(ql;*j*l*dX3t1e^9Os-Ke?!}m0-0%*}p(NCdU z{S>dNq#Pnp4pCKJe)hpl4SAU}o-d#K;3K95=@QfecDw=K{v*Dv!?zWTj#tON{m!|P z;s6zKl@`J?p&Is$taR4dYz^MF)$Lj3Cm&4FL=;KYD-I13nQf3H=C9*>vBS4Yi_b^# z$rNcX^Y-|+_~h5pFaP-&#(E6!@^i*_W2UAvj1mpB)!2W+*Uk}_1Me#@qZ~p3PbfFH zGrypDwy|CMdiwM!c@3S0A`9NxFU?}$2*5jkGY&s5K8eEakJ3**9?!wwkaiM~py?g8 zgw#}m@kO}POi@1|g(pRx33%kaC*~R@x>ihMt*#f-tY3X@(Hr{DxDsa>6O0yX~2n<#+ zi2yiiVV@@1@qt`riPr{$=kiJ^75=)^Q2jQ@T%;C5K;HHsJhtWZU+nC(U~7J)yu3HR zr8KR3;o6xihd1Q6SGt>;Top44w&QU=@T<0eV&^xP>ACNX-tT>ucYcP zzhpb4Q$!1sZef$hH(_6)h5Zxh2GT#qEfh^K1vs853Ep1?IONMAHAFZttcfR>qCms< z3oRk8YS=Ckoo6o+o&Pl{Ii!51ILTZDOQ7a88u{QNO>^q+Vk6Vg6r6`4m zSE8Tzx@7cLbRDk-2~v~iQUF@E>QbQDkpuu%LUF=)5O;D9q=@NRE(BVeP)~_Urv#N; zU@yGW-Hm6Z`O??yW8<^%?7!AzrLSd8wrA{@>GxpZty z1pV{u-vw^*le-%%re3ytlFe6}O zgRoijLAY_OV*&Rh|LTSB@$Gna&A5@h9r*cIeD?OS(r)f;@z6gvDsIGnO!D;9kj4O+ zXFyj`7T3P$T}tLe((vT~8ZR#^Q95r%E6eg-$9K$X0gYSVb3?)rEUs@atbg=WUYo%=4gjqM5rw zIyB;dpk@nuOkI1Y}N)NK# zlRKDUno?Uk#hh8{!W_qE3cq8XQ8YsmA^xI<5i4ktc#%~LN_D4hq6H$5@D+7Nc zuT^O@CY9By(()Q>%#0%Uje;fP_=$=Tpe}XD7mFF-{}5HmNJVv}!x5RgyvmUp?GYDp zfecTJXKLouR=!2U>>d)1kN;i#6Qyk)jbW%^jGN0t{TqS$2Xls~e;7cCA0rb_#!P4` zvQ5DufF+YB={>~{RWY0P7?nyVh1Z#RuwWq%LP@ZLG!TCRSRD-k#d$V!z65EC>_5iXlV@tYvni2Y3L=;?Fj z{9(=61`+XW2M?U3vC@C0uVOdHL0!Jpl*80&vZ$jPmvDD+9tdyPq5XBU5taN z3c0ythfXkC6iSDI1Bjf$ZZ@YN(5elq?Pxt>$6c32ATA}n@o&=`&j%{Ofh>OF;vv_b z`Z_=5UmD1+Y8&dRXcV3(d?EeT(M|bJ7M}LEwJzRR3QGNv z@K?54SqWK8u;b^1a%I$byPZJD+s#ZUNlj7Xy%a1yg%3ec^Jx@M9=Df*sRxT3F^(bI z@<9i}7Wi*0={|;orE{8`E1f8Rk((wKvjcBot1lJfU&c&)PaFyS<^;JeEsC4_?5X%q zgzvm1Jk3@q?!&5b&^5qsVccqGmfd1OFj-52$u7Gc>p`bN^7~~d@nG@^ItPL<|6&oQ zE3NEuMFgAQFgH|54kX;uSejiW9!XdN%P0Io_}rt?Dz<0*43mUj87T@u#V5g#<3&zM zG_db#4PkIT=tJm%Lj)d)oqz`hDj_v(P+}fEb&BmcbxJxVtvY^u{rrMdEn&PYNE^WN3yJ(Fw z*QsTFQ{~^VstezUucAet50cUf52!K;{3VIl+2`IS+={43Ss8wxp!6HP9us%(sPx3= zpG!}TuK1d>a@McKS9k8(wUZr`!1~#-r=(R}Cw5&ycU^=w4GWDc7FYqhej2+j5Gyc` zv^*hks&|5Ty(n+_*i-yhr%qkazAEoF#{^M1QwjN#%49JcLk$`)@3n-ZUR4shGO1L& zBSmiZ#%S$Ey9-?!tqKv{uM`?hGCE^wl8nX-bcZqOjUFJb=#v<^V`D!A0)zfiu_y+5 zjL{FOsiI&YTh6>wfF4ZfU{VEz;jUlg6djxEb3I{f15X z)yu#CD{A~cL8PV?`er6mz*I8Vgr=pH7nNIjqvhp!MFA#21h+ab&(j;tQufD%_ z`iAa;scY^VhEqp<;u&e>2S1#7U9?nsPpq3e7ZIVRl1Ni_@%+v0bt@wcCP7&l*$|E% zTsf6{ZtU3o2iY8M*Vuwn`_wDS?X78PQaBYKlsCVqQd40F7?z}4O8@sEx`)ZIj_yNVJ zhkz+yT0>bGMl>wSaHwS3R52+w8=4f^tSLDikrch4?0^r7BOM6oMB|g4AU|02mM`GrG;ShBB>5@*eY| z)2R= z$Fce=UTWyidobU<*iR4fhbry8=u^q0f4!^wu^BT?%(;hUo?Ei;nZMmSaJuK#nUTl7K63EO zha*1UQb*dz3({YnIwAe}wPh|ij#!Eh=~3(ig@!`D09u6wJRWqT#3c$bJgyI)7s^8i zwmiY_8jSc&v0Fs)!l(#vAR&xsAroOU8E944H65?A$rI1nu_6@x(}~i zd*9N>H#g3_@r58TE(OUZ0N*EF z5flv45TI2<4v0PAcMfO@&7lm&NjbmI2T|aooL>cApBCr!&dYc`X`7hH;IF{cV5Efeesb)aN9T`Sm&mxIr=$yyKOp`0Yb(XNZ_~Pue|dx(2IuGl z=QtSS(^Eno8~Vg5Y$^j|K%c*45S9pzA&N=K#v~Ow{2_Krt|Va{bh4x&5@ar{Zz^|) zQ{Ldk##fS4AU|rkzLt&m&Sx{mZs*>Yu3mEg%BscL-8=hOv-H)xozX(}-o>}|<#E2= z^NSkR9-LXfZeA(3)EB-AGegcV>5_n0jRzh50(yta5sngXg$ZqT(LAstVqj8Oji|9f zXV8o3Xz*u+dp^dViK2WCokOj)XUEeUB#OJ_767r0#`HlyqQ~l>zjZ7`AxpQ+4LbvQbeDM24XU48{Grl$HjBB@TX0aH%sK?u_( zLC6!~kCue7t&L0cm_P?pDTgi@V>-|=$%fmeiPTYrO^=3mK7aMdw@7g_3HWXU2voU96xUV&@am}4wUAM0can;LCUDp!c z_Sn#>$G7)5?Nh>$itK~);;L=I_o#}T>$5VMFrkvg$XTrHx{Av((?#mEXR$eD{(0HXL% z{yNz_GDxT^_U9(9Z|pCeaqM;O-Y7RC%GH5_$jDcNYJLvRUCH!@N<^=hDKZ+1lHfo| zN@A!w7R(=rh;E)hy*=XPs@Caq;40tCT0dB@c*`ASkdj!p(CT1CX!L}Hue z#4QAM3vMsUQ)A30XrT%}ck%PE+t|R6M^G76(Wof0$>^scC`r>$HKRuJP&LD2ljR#s zL@8CJv8W=)+vGme(2$8LSWvR`ULTFdRFt3P?!_h>$NnOHT2fG)vlvXSckJ2d*aK2T zH)y{1B=(%33wJ<96_L)XMUYKJ9*-+K+twS+24`nnF49QWgNBwKPksg!TKS=T^bpM# zGSUVk85aw!$%)C=*70^+?q5NMB}yhMo7fAp8(D6ek)Oq!G z=}Go`AAceJ>U-aN?KQTg`NoC>Nj7~JUtIkC?@OOZKRNk$H~Wj|*x_w&zR5PSEx-Jw z8F^_OlPbA{KVi>ZxbKajOvY_D3dw?ykG9%^D>;K`U#4{4%^2+hk_(dp1CbU{0lw9H#0CAB9#K>5I(L#RG$`*^PV{p&-s!G#>?InXt3~63N?${qz zvu~uBAfwHC_V>%iZnR`N4dvyIKx&FHJ!^gQ+B-^$J8L{wjrwQIZ1+b*|F=gnnmmrC zd|~+ffvm2sS-vSvW?!KrV|G^uP7_+OVibJ07;-Gj6=;pRNZ0jNz&4rDL^mH=TE5k% zOVKCk1vG@$Co@U1szwhE+;@VB#l0WY%u*^yXIi4Gk=WU!Hp~Trah_Jl@zb{L+BP_V z2Ip7*=DvsXI@h(!o%P8R5fO3M6pAqz`F}Dz;VjuLLsk4twft% z*fi*c9Yx$*7(mlEgoy`W>2Sc?#O0)NbE5m6Oy04GE-Qy*u|J5g9^c=0%PoETN&j^2 zR5y2U3^^}yXW&fnA!yL(PRgj+R5cpRqpQ0G%7g{2!8N=piB}ovKy`4|%O^p#KiU|a zL`$;bJ>>~m$sYR{>r%42xMO?AjvAE0$cUiOD%i66zHnVedY07^NVjB{gbKJX#;n|v zChb@W`Uv-F3`+LKIg6@HD%FCdByDypayMun;dOAXSeTlSTc_2SEua}e&|36bv&E>> z@F@mMijIRR1q4ybYw1jhyClYgNYa)`?=1yOB{nT~BSG%_4FS37-^kaWz&r6eM^8qAK>}=q9pl8z><<)2`uSSF$^ox(s zF^&*09iJgKH6dVm+hnGA#j|;Ctc827n|pl>r8X?Ae};cg{0iJ)YRIb+9BjJiR61Qs zgMoMP@L;70=$@|ah**dLIdNU6z$XhQ$Bq+&azfS`5CfUiZ4@&lAlWl*BFnFYOKZg_ z`yW2(&jB_)DcM)rRAeo(r54+2qOFy7)*O)jlRe2Fy0AzPhIe=Db!N0y`&D9(Ao`jX zHsXVCk(JCcPt)waLrfksFI4E)Xf;}Nm)7K_=CaXfZYs=kORC?&WM?Y|BiSYwn$WvU zsYWZ0+6c%F^1q9WvPp*v*){5oVC8!RW`$+pDCHmgvffq51+={1V=%C0XH9>7?edPI zVV0e?WJWH?uHw$cRfDrCwf5He!)4Mb@z4b!x?^5$#lX&4{8!(ONhivOZk)q^etyx3 z;UV9&d1Y1eYu)TILj_^*ee3r_y+VE;pR?4GvdndsQEmG=fW z|Ho~evu=HB%So|HZ%`?}E%M~1s+YaQs_%b@wf<oyVV0`FVp6x{7IvVA;WRC}SttT1cC)vpiMx1J=8pVEs0ouKRmydJOg*mAa zBs!W%3ev?+OF0dT7`Mb%$!-}*@KJ94`16MAzJJZTZ@>1Iw4bXRdnM7defy1(M>aR} z%vkT)6Ko^(>`6I-7jh^aeVOKm3Uva!^@0Fn3`SW1k&tv}Yc$=Nrg7-)c0chy>+^^% zlPH)bxtzTYN&*Bz+}}#OXG>nwd&e! z?|!yY=<6FAK6-R`I2t{8dT4k;nn^!~%Wu!_&!qAD?tO1;ouJ-+c-5-iH~#YFwQDyb zo&o>r_%hOE0lrImGG>k2j-FUB+T9w5tQREv1|#M)F-?TaFD*F@$^oOoMSB;LuA2JN zn2Cn>SQ*trVBNr{&y%_nqL09DjtVM^S*cK3tTq#ilOgNL^798@no?U6d1hpU&3kG2 z%1Gqc+|CcjEPsD+Xy}Ot53d1Z`FJW3 zR3VPaxbsc+x+;m*Eb|77mgmY>J-ntW*nh*UzKyNUoS7?|!gth#_RO1q`_d_S-CMib zH_tCBn7_Sy_LFV)@cg0F^8V}EdafPn$SIlCxuBt{H{^GwFR@yRBU{@$Hjd28&uQ*h z7_J>^&MMAZrgfrLiDed{Tf?hDDmVjHRb1>!afPEPe0Df$9bOA+EUx!HZ9#*T2`Hr+fw4p%v_R|meo2sE!Z8dbGa+3LOFAy+SCl| zQlrzPL4E)%N_2fCUM}`o>g9S^a&gzj?p0&R?@CXHGbTM|f~yTaw4>Jg^swHbBu%gUmSfzs%f>E~};Hjp{b$Lhta_v|(X zrWIsQ37Aq)mWpO>(m`&9m;)VteyAunwKb~GRcKq0Kd#_>K8`cCMmbkzN5rKyU=<;) zPJy*4bc`k8@F1`p?|@AtXpE@EqzVyniHSY~i9Q*iYUBSjbP>x_q*-(D;8^K7mX|9O z>@%O9J*%-LC)?0rLi(z)!#^wC*|2=Jz078tV##SLNi(?2tRB_?vS3sK5@Do|y2tvK z4Wt`yZrvOWDpft|Bz^gCmjTWeXhZNul0Fc)J>{Xa7|%9RcC7}ZX0E`f?&(*Op0oV9@AgMx|c!Q$nnT8gFzEd{oM5=<&X8s_hnhO_5g z)8?pP*zdwU7}ts4Jad>o^b`tKr>Mek?adQ8ER>2~wIQ8&yaNZ1rKsL2?N zWbzI;UmYf$(SV5x)Rjj<3WNNyFK75O)~JA69e6p;Q^(>hpekWcAa_K57 zD!t`gyL8j++uyx*=g;n%Bkf^-BOPOhho1iC&U^m()WG1tgVMd?p{VqQv~16>4|jJT z{>5(g5NnM_rN2qN_k8>G(1It=A9?rLvzthM60t0Ve~QQ98?OvGRVoMLNRLJx3{-K( z$=l)ov75BmQ&K}sj~YjQk<%M=7w6){HYHq~L{MNXP&=Zc!YJHbG-IGRv%+ggPxqMX zu3u6=>-GE#a=b0L1+g~L)x&-dAM za_;cl-z`1~TP+wuu#c)VRxTt6oDsfmqo86qq}Ivix@<&~^bWbOUcMQ`H6wdwE;gaL zdBf85)$A;jL*P;^EaR)2Qf4PXlmdg!lU3;Cykj48Zhp(y%&aD{CYSwZV^^M*#!iy` z4HaYu2@3v~LJE_OYy*c`t8=SVIwuqqC+z2JUewE1Cc%*;JCSf*h~Oq#vFx>*a358g zE}kO$fOBfw{PO&a%%Z7Fvb&|Ni`fjsHU-;9sl`=Ig~m*i!LLut$?%!pZC=vk)Anh5 zMt;Ko+m$l&h8S_$rZ5#-qz8+`VLnWirNHr|wp2e3Or477!$)jMQ+@Y&l6`X2}g> z@!Lmy^n!ss^)Z{uZocpde^%;c1?kmj)XnYh;c9x*#&#hIl_fn$NLK{RZDnYxs4{2; zr4IiHNy#jm495(eW(TH;KV+KtOX*h5Rt_iyd7{u7QJ)+kA>aRTqHtaq$XwyCCpLV1 z!a;e$a0kD~-Fe|dcINRnC?)X z$DLt!BVJD2)UYCuIAGUiczxc%2q4zd;k;thK3)wEsya>z#DU8|hohT^pP^|JHURR_ zpCeT*Y~0CqQQ*MuFPA6z;-PP!9_)Smo5MTb?#u06x-q=t$G6YyfASwk+*~2qV(viF zoLk@6y6vY&dR!TcU|p+QuYY>kn$y=d)pD=)dNBWGnEw-W{&PZkg2;#&y-^MY3|7YN zPR7|-GnDYVXJl{=hXK6I$?zQ9(MZ9G^D^1;qta8JHr>&fOTk1q7g9+l6au3D5L-~z z9V*Z9XD@uh6}pf7-odBO9~L)zddH^KHeGvq&9bMj zZ&hOji!xk2M}E3(>l?Su0o)7Ym%RL=pq32SIe`p8!JrRrII2)s-8_%ELr`U8I9La? z0n8maF&zsYmo_arvAL;c)qM*?%lc+#v^>4-+Sm8A z&fNRz)%<6v-DA(%%ZBzxI=4rP)fSg!(C?qJ>e#~Nk6hD;A`K=3Ge_hC9e##Gr3h+O zR*LyzYcxNYA58UCRQPWfK;xNjjt zsI5SLrnixe2conS84VX5L`-K@#^~ym=FQPE|I97(7hF5T<8K(O&FJiGcU2x*IODp$ zVBNBt+ak-WjgF~{XKrLG$KK%H<>q+n2c}gl=xj)HmR5vv0`-Lsjm2Xg_GbDUho&|U zwFGU>$|-djnGGfBtc$(1I~6<7g`55gtch%9Nob0w^11}2+Z}MEAnK!3vMK05W@Onw zHhl0Nls4fKk&9l3t1cvgBU!SM6f_XATonAFS1ER#$n}mZBxE1RB@dRfQ0l;uh;}DC zxXUYKkp*iBh7;=ESc})v#qQC&w9#X%i`vsz{tb)b#BJP);Wb^qrw>!=3 zhglbmrkPoA1~{9+7nDkak2hEcB8HgRL`ZRxDIjOa2(Az$x!YboE@Fu`K&1x!bO`$> zNpTmyeQc~Ly};*8-u&FQx~3g3ZGH5bJMS30YiXr4e{lQE@A4+GMM44{$5yXAIx_n3 zhK7n|GlKm)I@krt+&nVh-to`5r$Ci?%#2XB-IwGGM;!oLU>TCjm&B&S8JeCRum*6E z0@hTE6^ga>(hEg|8xajyMUdL3V6JhcnJNm%J}0xac#)<(nQK$X^#(V!Pw8*)d+Var zhWyepd-E19M>b$aG*AzE$9C-F@ceixEDCBpn zZX_W#1yW^LCJk2I*RT{yn9fjc4*WdXIXPKbC9Tn{EK^Zh8bZ5irZiniR!&w&q_7~A zqtn?TN@5nC;~h##NSGtsn5t)SWsTSfER;w%c4C$Ha!eQG1Se@BUruVPi1k2B2ewF? zGqbLCpfRH)dflx4UFB&l?QO1&JM5*iDx3PN?Pt&0imb$R;7u8|mF2GVs-}5UY8SWX z`TeV{8L8T#fsC49vBT5QHmBqv7!fL+3Kj(X2&4M$j}^?q>J=gQU;v2- z9HzlluIF{=fC_UiZnwf)N7!{t@5G%T<_>ij#EA;Fx2((Ih-3?hW%`I{xu$u}O(T^b zmfv{Kac*_qjK#I}S1;|)J^bzP@WKLVp7_xNnN2}=u=m>bkKZgE=$_8K3llrjSKXF9 zR#m+}5`CIjrDr8KYg4$9djW(%`FE~R;RY_?0E^NKWH91$oLmL8skQjr1inz6tWhBb ztyHO4K}UjgENg^MQfEXMScl&brqPm6jYiQ}1cuRS%P&j-GxdJomt z@o)8u;E&{6;_G+|{T86#FZ~v>EtD_PZ?)2~`h|M=TLQs?Bj3s;-^we>3M7t&$nS07 zO0>r}^4$w~1l{Bl5q_KS`Aq&L`uTCm&Ao=$qTF*^$;@Pr%gCj03`M-Rph7YDTD-F$ZArj#mRM89 zgzv~BothY_o7p-s5{?$*8N7yznivvlkh>U?KFMS?3bFfqd?dg(;X5f=Rt4?Aed$Q5 z=)_2Kn7I=p0iqAzVqr;8jQ50Z(UFu~d?dxt&*LLu-|!u#pybLUDJRyX7-nWoj3lo~ zuMJ#zB*ny<6vID>k0h_jXv)8MBpS2$j6Ve)Z$v(JQz*k=LY}K=NM#reGLnoY=(Z}O zQLECzZKt)W;OJ5%WFchWm-^5;3-PoI0`^u&E76qG^e4HT4( zJ&-$XqwgZ^v^{p(Y?Lo;Y{T(Ax$_&LA$o5WgJ2_|J3L=NJ8fGt{qo&SI3t-itehCD zi`m95WN2>-dAmK(8wqclK-Rx>lo8wo`aBTnc+NdB20;%Z^rnaCNv3_6Z=<*87wF7Q zdku1C+~aYxRnR8zPP|c^-S2iQ)0J=;DYIQ}WP)b8{c!*5+(UuqZvXEm z21sJfi%-A$gFU}JI{r4>gzkDRp z{bbJvQR#yoLbb@JTL7xfhR0?@C}cFcEUsV}c{KoRwjk1$6R>3KGOhkpe_=<&ujipj z^1R6ea~_ypsi{?Pwuh2*;Z$o9bj^734Yc7{gptZ};&h~u1>%X4bxca)a!NFD@9yAZyv57D%~7-Drc7HA?d)8p|)S`{ga0-u}*< zA3Pv!Xx!9S(YX2X#Y>SbHf418OhRv<2;p@qk#Z>o{f=E7xU#SxC}M`tHKm)34y&K*$FY7J4`Q;W-k3U_1lnj3-GyP%-=Eh$m`Ce`}CXBfxHwkVciU@^;x ztK+ps5ll;rF)fm-L)aB=Z!9!RY$_UDmW`^IgBv;lNjW3BIOS0^5k)yty6~=rg9iqS zFZ{>I2wy&&*}k@Y`pW4U!|b7j53H%3vf}U%8yM?Aj?)_Mz_(wuZ=P3F9JzKDw}eDp zr5w=)9;`!7GO?DDd!tr8aT6jcE-D!%(iu^$%)?p&r;W!h|FyM*M0+^7^(-S+WK>q5 z9*M*-VKK33BP0K03)eoiVVd+6APQXXv9qqbeq;IY-nmUXcHY=FMH*4A{r&mSrYBcP zFG_!r{xZGuhu2@v>JN0?I9Tp(Tsl2Q4Z_#-Mnb0s?KH9naEhQcs4<|mr%qe#7xnrj zH(2fp3!R!gPtdu^^F;MKJN`WBi9xlc7`4grv<~N@ap`z}>KUF$JJP@E=xHQB zUO}RYpWr)9@^{$#F$Vcgtb^5yr~NUldqN7+aTI@^7$=truzi?UOs5|^o$9`VPXGPb z7(j`ADx1(Q)#-h?#fdsSa|UbPpd@R^j?L#4x(3=EoAju8@-%z^YI1)k=0oz*Pti5N z<{;~4VcXC(ptUVo_lxLMtC97}xMqNxiE%6w;$kwgM0&EMUGglE zl?r+W<#?7*#A~rNxaBo0Ii2oTUflN@phDapx`w&2?-1ThP65}AoWenLzE;Y1MgkRK z9I^&^oZRtoc@61w4d+j1}lD?A}3KL z&xq@e-37f&Nw1vN#;nDOlaTF2a-Vx*t9U=Q3N&#it9bsjDP}WHd`BLKtU?|qmst|K z3&bMLwIJ~$L0-xukTsAIa1MW>=RlcKzQZHiI%EZqEov!;{}H%zGpe}roF&ny(^;Xh zSXhmw7IG#KU@L5T8(h6MTYY{#{J{0je1uf;@ z+A?@;SNqnUk|b+J+ES~_loVQfPtTlPi`yMZNevsGx@OJK9$CZ#^9k@^&^4w(gPzLF z4&^xV;DL1%CjrqpDXAhHP4Y3t7Mhc4$*QS=@?7K0LWDl+V$&~X4iGDV%GZg#h~+NC zCD!CtOeC#R2(@?xsxPZ3b6)Y97jB+eH20cTdu?4^+SSa$m@IHw>#>(q=NpW1kWvnWs$FD!Xl_y6%P5mHmyGIsQHmT%p&_ zDDCfRvMaT93pO^d`2Ox0in!!^hDyFXLY2(#Sf8wuB~!`wx6{y@C{LffC;VCZJhUtF zJo6@=CmaisjCETbll{<%1_O`jGoUgH@&?jKYCOt%X?`P3i64yU5k5>ZG6<}YT-msv zG-g1<ses=(5V70tLn-nF>l&86eYW zvL1!@i)Ry5WF|!Ch$_P#oEoW4D_Mesqv*9WXIt<9V(;#j?WRJ{xcJVUON~n^)Xh_ znhw9VwXrb}jy8(P$nz0PN~*)r62@mJGn642#gMPcpGHa>QW+KVKkrZ6ASN-^*!EOh zygwAUk1fmv7KMvO#I73)9`D(d%c;+}WUL00$zZhtdmBleR+AagW$5A1bP;9N zk-S0b{suuO#1z0}fPL#~9b|)nbS=yQ}{EQzZq2#E& zv^|*7o;D?1UBkIWPj4FLQa!HX?-3YzF3^7!3X>@X8MQoMZj@F;UkxFvMFB)R)L>6U zi5zrFAXv((Cqk46&5^-lmCUgz`K!4{N$h>Bi~VYHPJaHT?$iq_t;N%0GnxwPN7grw zLE=!omiZO?Cj3Mb`sP1RLqc8dL$1N|RHw!BkZV*|K+|GQnU#N$#wqI|YwsoE7?{9IyUimQGG-)h%sc37divO@8!7UD>46octUw{VywB$ z33gcaV0npR!usOFfDuv)5}GGQAy&LR$|y#m9xouw^IXPd&(qZ?$X?OaFu&p|Vk-Z}C2hJ^fb8N4OUd3MWw7gfuV@KbPIEI9`6KjEbmxLc5Sx zFu6}77>KTbD(9&ayA)rsjORTUW7N_a{et;c_Swn)ajjlJ{Fu55$c~cyoZG0+4t2Ab z|1W6Q6e20$ePx}t)MRV?X@+Ne(dT2n0`(=hMQMnGT0qPx${o>^)Kt?Bq*14G!0UkW z`7(MuB!@YD$g1BTQ49E^1{4)!ZVVfWIOFge$>orF54aAJVnhN{N*r=vEvVR@_?e$C z3G4&zyrOhRUcU6MJGU_1k)N+nb$5T1<8}qI+}=R^ZzzaJC_K(9FiQ<)Sq4O`q#aS7 zPY!9dx_uEXnVbfb(<(x8RC6`7NRK#F57bOtgcq6zcjlrf;1k0n7k9tWjiM}a=X zvw0Y;PjMbGIwLZ$Mnis)2Y#Vizay%)BGbYO6mzSHtS^Sw^B$g8^L&Wzke=)imugDg zA2BHb7Y4Vx0C=}q{V@B47qN9&Fs=P&JnqBt*| zVcY)r$FURfrYG^gv5qpVBTLZ{JKKhk7f8vhNvTZP5mlN@sXL-34j)+c*8LGdjXwe~ zLdl8J`8oj86gy6;RZ)0xe`SzQm{#Hxxk6xe^p_oRqQwCB1{{~zmGDkg76Vc*>D7`Y_1u3|Z zoQ-uwD5FfUTmI0c7(YOryCB}00PVAwAPaKL0oczsLn|e@`8~*eH2M9=wDA`(I;XBR z>P*)a>PT`;p}P=ebA^RUQ)()*Zc?qvY?NzFXr~P3LsgY(;s#1c&?j;L%DM$WJ2WLg zFN%7SQ%p-n$_=P`i@RAYmOlyh>CvTArmyeHmySxW|KqV^&d$Dp-1|h;vj zEpNNFuS{Ux3C^AB&7Zk!n)J8IBI(SHtE~Z-@wMlc=lI2}SBL#FNRnrKW_VsU}4Xj7NcMh!Bw8s&PBpK3LZA#fTy$HwtMft-MuKd_Eap6D;@fz(yq(_nz;vg;7fa8rO!Ulj6gkp`jYAbu-j+ZaH zcWLYPT4#MzlY8FQPIQ?}glQpV8X?=GRDb0rsN?11yMGlfs<*vm?deO1UE>CB*hRUWnmUT78M$5 zRc2+ys-I}4l_E;OI@YgRwS$0o=+iQ-RVS~mA8GU*+|~b3nbxG}RC>&f^TzE{o5S9~ z^lIONS);eGe<8>n#Y>t9o=3@GcY~>O*cEKfUa%~Xo!aUv9L%Ua_gk~mn50R~^H!B1 zh#^OyzDBl!m#HB1Xv+^rZ519-6Vf33r13JYWT(*?AlbP_?0``YoyHRCXoB-3J+cIl z1$phDM{y#3J*%?PPuP;2#7NO7t`JK4aA0wMK|#r_2RKf!&lp@YmBf&mx1L-Abc(*d zqWN2AbnF?eDvfS!>$zz`aqSbwO+C7weE48kuc+I2 za>cTT*4ET4+5=Q&a`vAI-^A)UutIAVtRz=5(o0db8)BR(4x zz_y4kK!Ijt*1#sz?~<}lS`!5=r4p>d7PJ6QlN3Zv6iD$~;+4I9LdnSRmKQc|xZ#HP zvAW*qJ@+qNx?sV|`>YsNXdg0FphDWz<`T2+I)~#51B*uG5 zq}#~^kjI&u?sOu=jbFl1xIF?)N5rfPxC4kP1Oj@69;FC+s{#uIfcNBTVp1ipbAet7 zXtqg)dYHUz@kBIQsSBS^v~t;zg@gC63$<=}cwpJ_aQM{F?4A8(g0i~zn&$Aj&H|pj zkhAW&?JcwRy>`v^AMKr95nNW)I&Iw}OS|XaJQOS)+zSVnd?FH7kc--=;ZV?uGW>8< zQ(UZes}cM(7}VLeQVmH752`gzn^UcJ+K`NA0w*--MU)mL$`cz&0Y(_tKy%PgN*z-p zX=GPk7RA*90R~u7R!BqoR$HYDqH_YeBA~Rgvel0yV*XUarpFe~y>YZo!@W{)@5(10 zJoei4=c-Pc16i47yGNT`;Bc20=b9rPsXDx4c#3UoyDDe;a`ybHR}OTSEWU3wyKcc^ zhfnz>szQc*pdfT2Aw)Bv}{(%tSMP4L7CUsS2cBIXK|7amCs~fg#Fl;Zsw{`NZyxb zvl&Rn?cr#BjYh-PWM#3H@NKkQwm+5TN^^ck2X?6A@*N_?LtR1ehsuf|p&R6a$oyM& zivC}3)I~&<6;Oh+PxuB4x&OOuYuvS>ReV?`HD7XamUmi@=fPla;lHzusWn64!-Vuw z6d=8}uDc3LlP=y-dI$M$u%jNPj${s&1MNRc%yNdKS?1y}nk8~t|RNSbecdV9kdlF zCbkIyA#WS5M!&qCQS(B}?wB z@zr*fl*}kk>sA=j^QY$akJerD_{!1a>qFhM_P@6Nx*zRpORrlLF7K>Oq%+(;8j0R5 zz^?&R5O^?CP~DZ1qE@5)Pa}rZCUpvGx%4S1oK{A6m`p3DyoU&gcjJ03<)@i3gc%g~ zkTh5PWAU?$bg;F(V+Jei-rcu*ce=#+2aDKy*fZVi7m}4^tCE}$BCj$bk-I|$uEH=% zwpEO=5RMp!NTb3zQFNh}Hob7B5~faQLC&$r|5pzm$Hvi)4GSFYkK) zrknov|2};92cPX39l7qh_dmG$>gCH16ORMU+8|tzMAvcKqvN0R@1XuXg9(Q+eLkf} zuLqrmqaG#f45c5!%i=m7l1aLZD z{+*}KZg}~oww7J5ZXJCv)cR2Gf+K6EHLN=v8Q7V9o{dbKH~ps9w=RC|u0EG#G(FI` z>9Ivi9$GimYi5V2#b=hf_`RSVA5N_~6ma;#uZ3c-;Lzs*{m+r-$W!~&g2r1+P%@B3 zZAnYg!5I;AQpZs;WLctL5gi$2%mD=wk+-lV8XbCBXjN>@ zsI(=eFwf(yYR&XFRr>UHB+@5IJJ{~h0!v1k-et6;Iju=Zh7*{v`t%CBCurtgyYN72 zWXY23+WA#!X@HzaYiMqsTB74ezpbk4v;@jL*(3SEva&L3ad81?RE-n57biqA#v`Gi z5n5xe&mvmHaI{zjdbJc6ThOT2$>dr@pAbk1K-~}M-HwikTc3hdrj+=J#i%s4ejC8w(u^JsHaQduLYH?{02xN-JwCENCruG&W~6 zgc>uNrZ$9o9&Yq?bk7Tfr%C0*!$bUCh1cy|_s5~ovKhHK?Mv!L|8q^_XoEL@z;pec z#*uoDM_T`br{8?@1Ss(UqHV`1M+k<}Owfo;$w1qHxsc2tqZ;?lqM10y$vBA2`f!4@ z)VG3yZ5YVy0`A72cJABxLs*TQK705{?Eh0|9((s?&UZeCJO2L9e#kAtn8!(u0xZM; zQy21@aKOYmaR!`ea2#Yop>$eofDW`>W*Hi*W0i&=_?SL-xm8F!SV$O&)g1$H<}xF2 z^B*61qHpKE`VIY+eV5sL?*WQvY!|oa%wuH>?-&{*VQ`YCOy^rbsvxqUo}e05bct%S zx&VMmfm~B=N=GDD?|^pVU`?`m9b=u73Msj+_%l(810W18#+Xc#vo*vQ6vKyrnM)SL zpH)l8T4sQ$GD2+TWLe?sYpZUVMlIXTe|+?$0AuNRGpk#^gB>BLH>;6wVlsj`hM5vd2gVQ5{RLjdgHE_4O%l8=Iu+0?p(jsN^(90!h!`@E>KFhAqlO1^2?cV` z?As^p+qX|(q8CmB*l7kjQjlD5WV!qayHFGI7*H%u`hAHClwD~Q7TjkoMzUxvTG5Eu z99=)*UK8u4(7hOj2o+Eqt}@lUZ5SQAtCBM}_4sr83T-pPEpyX-eT5mb!rb4h)nirM z-&0y5H7f3bvBH#Q;B%09Jd1e{U+UaYkqY-fWkecPD;h~7c*5aaG^j>#0guGxLI>fF zNF5YIqsGYTWhh%pR1=jAF~LBTllVPFI|@KS#QlGhi*&Aor~FO<&W#y-Rzl zXPWz1HIVO9vn#yCrI9Fie5{W&m%H-|%1Fqc+zLc~{sgrBw2(F# zlT22sF+&tHlE@p`CF-|9))v_f3#kA;-X~kZ(x>8|{`qri3T1b=&vjS-l3PErwE_5z0r^Hlwqcrtu_*Yu@yngMrr&}^+_bv~O9$Qt@wE4uM zP3%i!H;aFg%&BAFS2kYr$nu59R!#By2T|9jE{<&PjO-sOvvbogkQyrFK8Rm}mOTWi z$)N-KnDE3_UZm)djg2Xs^skGU zFidut8BQDqsXH!iT44G-t-2tBWd>&>jgiIf4c{ zbZ(xVF^~akGb00isF1Ov)-%u@wot=8f#}G2#ldpog_5jS_HnSpo#91Rf8E;C z+ZtPUJiB`3Q(GDuww-2;7yiLdS$IoNWbbf=bYu6;i>9e~QFAUeZYs9z{o%FOoV#T< z`_F;Ht81%Q9^t|ji|-tG?Op1}`a*0GtXN4Avo;iRSnc+7HiZkNVtb!p&|(>M_S z&^g?W*^U7R7UXbPfvZ63K=m+V^m;`;IJT9A5d#zp`5uwG6z6HONlg}sKQs}6QUF*r zXwwTC0$s+<8W_>>YCJD8O=%o}y8J6DQOIg2$jO-L-1_Fe_8I%$*qmHk+vH(?CtX8} z^&S`-zk2b|eOFDJvg*Fkyfw{ei>R1!^DFB&{qVqSUQ{W%r7hjkc0}%+jT;{s9ewzk z28}`X<9#lgVFfsmt2ZZ<&y>5%!9B{$lQJ_=ev_G0gxH21%d}e=FmSCFMk`{?Fj}!^ ziEE6(IMTDEvBDVR$n;;lzPKI02V*eCvCOR4Z`|`@?oCVDH_R#MdEgKGcm49v+}!SM zbAnx=(&h!rR$qU0Ze@X(P}HBt`yvU1M8=T~ohWpAg7{ZPsmXWjhT=Cv>E>sCr3{-dQ2t_z75 zHYysgexQHB(RD3KewV6g{ewggNeA`~15TkQk(?wI+!1ITqa~`KRjo*}06K_h!IWJA zMFs{OiR4U3T*5-r3#V;5j>=U3-J{h7gWmIhWIwsUe7gPyQiDw2j$Jk|z@sN%tf(N= z;pIB3Mya+a$+pE_4t+&_H_Flp^MN>zy?o=GuF1D=+xi**&Uy2v*K9Y^*+VM$Fnb4j z-l0Q1WP-z?uqf*)97Fm& z8Fbi-8L*#xdoHfZ5v?$X+k@V(1|~OT(a2(#(Ezf8tW%$)Q>I~+6Ot&-?Qxf5xpWXc z6)<|aJw;O!mdYO^BV7oKAH~=DAhb_1j)PbTRx2Q2^kl{OTVaxhjX`eQ^Tr;X!I1RW&GLs(CiVPCd7+wXv z6hJ`aCd8N<(K-`CDuB6-iTt&3?9=^(MsSdK$KM6~3cM=`nqktV@A6Wckr*5Vg|k+c zf^0gsj!sL8i~+$Lu~=O0^`Hnlw9gr#fZ5?<3@$@B%DNm#c??I@X5g`7styOE(Lklv z=+p_wrqFQWyC&b(xE4)79C_FeuqkLG55)O^EoZe6Y&oQk`T6zBHrj$U4H?G=+1AB=VE(q*()S0CXEf9VZ5x+KL*v`le#-r@sl_Cu?poQf zv<(%VQiCC<5tz;wI^JBdTpA|#Z#B@!UWDXt1R7aEO^s2-1PR|X8oh8BIUIQ^B=4%~ zP|{ZCRoRM*;jk~Z+7P9;C5AM}rc*gVTziyQWBMi`SR0LKkiap47NEX@#HcHdAm&O6 z$g%K=@XzYh#^y%He>*DX*0wLKODl_RYT7ZdZd2);8n3QkPE+SfS8Y+``i^S|;dzHfW$WQ3SP%B9Ig@k2KU@!NVGl^-@(7I}QXM!Y9alsC1%K57GgXvJeM% z;_Qgmdvb#Q6U z#5k_<#6(CBL#px_;0vVCdhoQBforbMZKz#3BmepKtlY-Ex4qDoCH^l{ZugeX3pYyX z3rxpO@Eawt6mI-pDVuu^BL)zWoF6JySzr!jXS+y72BUW{#UNCFIs6NGB>ZU6i6}W0 z#gsIES_(kk;sAii)*+XRI)UPBjeJJ-31>%og~MBAGnCO7F~NSem|Q$4G>gCmLyyah zxwT}iZ8)o8ezCVJyR&O^LvB{v3v7N*M@w4&eW8@%rk;wznU!vKm%qKxUXtT5d2#_K zEd8@$?i9DhEJzP@cax^V=RdWTSCmCQA z4mn{1rn4(4CB>)^i~{zX(TfHd6;P$M&@GQ$!XVH9K?0xvlH?#aXaeIfVf%q#hSMiC z0~8;E7=6k>xDKFy(2K3;Ritf1t2+KGpY+$Uj&A8270gaHr<*$t{6aDp8*mq^fk9%1 z)#gbts}Sx0l7%3^5D~PZ3eFRaI;7HZ*l{jKlriLy7(+k^n9NJ|ImscHNl3yZCYXTbsA?=ztUGQon3h|y5F1|lX2ZJZP~=p%8jlNbLP z6k$OxQLjmrggax@vPnrovQ7ZMiYvD``D#*b%OII3Uc)!(b&A~`$O__&@F4m^BSe(z zVjEeRLqXXn=flFX-${3F+}O|c_3ht37WOqSZ@VQDdF})Dt(I=~jMPT{bW3XXo1!HL z2Md=jdvXfd&#RF|KMN}fFukE7CX=^Y(s&DR$xO?H%-}MuX$EwsF?iro@mPW5N{x~j z8rVeoG1XHOOnWScWQ61X!vvvL2?M+V8Df^UT%;ZXtiNyW{_3?meL6s;+nOxow(eG`&e0O_N4l zBWcv@NV1A$b;~NFY8A`fxC6!w48{d)Y>I8b7(y=wf&o)PXdwY&2qAfpO6o7Y^AcjL z%lpo`Gt$U7khlKpt@VecYR%kp_C9CVZ|~jwi&GOP*Hx6QJvDvzPn$b?y1sXC>+1(w z7wvmx>%kAnjt(K~@H=RK7iKvp>2xlY3vo4<$_^Gu@gWm7V)OdG2EI6n@Nf{Q!?UxOynybr2dXdL~AK`B@Mwnn^QV3mUE&&!yi-t$IO za;iS+x>xG}g>COz9jd2>QAZRR>I3uUE zQ2PxAInhpt8X}TNTY`~F0cxKT*`^>{MfM`iN4^nDuV0npOUc{TG|KFm7T;DQZqD1q zXD0dg_Fsn%d=LNff|9FCj5p~TE}SJ)AXJ4F1YTyq8{iPbqzFDi;MA-IGeKoF1vQ|6 zB!y^}4-Y3TJ;~ms&V?op1J#GbV=Mn|PFC`oB>j0Xa;vzH*~;z{OS9{2zB)JaEj+7C z{E&B3inoURiB^Zr;&7<+AwAa|)+gBPxEXex7WRnN6tW<2fip&|DO_wifr|R-Qo(?P zfIE4F@7Y#TKe%&9L3Y@=ZtY>H3dZ|=p~3s5t0 zd8jrwJu5vcBPYibOxAF`73gmd@`)a61q`vA%q+wUG(j$zhg2@^97xa2MeH>(H!;_c zr89((XEMMu3`Xu7F?>lQM1ndb-_43S!Z3&g(xI31w1X;4h3|puV9DhoHil#tlOfg= zU>R+W2-H)o@qv+p;nHk(TZ*luw8-k|7~i^Z!MgS=U(@o2Rd25Ir5CSzVEquH{G`)k z)uyMesQyd$na+&HLT5@vTSjoSdx3grPmZj26RF@OS1-{HH`)VT$rW! zC6TX$2GJh+#L^;imLv&hix%avLLPZ?3o|;Dlwap}SLZoX>xN55?r3bfeY|DoaFIJ$ z=Pg>0re~E!eXUJ?PgB=udG&ZhN@dxqqTE3Enx2}K;r5i$u7(g0rLil_3E4=FHZ4tU zR70bx6Lo%z4j5xyr0XwH0YnQ)>!VSdsCNR!%u${6NJAj?MtxdCp|>vRCe69WZ*OY6 zW2AJrF4dV=?e^E@Ck-+GOb<15m8P_ZSJw1g6At7SttzWbX&A3AAMI-L_?ue$ie^3` zD-3-02lgGrQz#8nLBrHkqtwdHh$YJC5+iXqs->dW9(RL8lw$73Tpc9ws}S^^)~78f z`hqobku`RNS6pI^sm)j;=44@wVN`F{z$bJQT_@8~d`AqfBkFrZ4tT`0n;VJ{p&$BL zM;$t@V&k1F9=)Qz_4==^uUKDFd_`UOmR03N-yhsJf{pOUkgmZG#85y8nhS~+@7Gy3SC@2tgItW)C zBc#j+BSyW`Ih%v{Y>^R(v!fiWRwJG5NrBpCV}!Z_$v+YgK>|SWp86fnZd&`qwz`@f zFYUbI@ym)ve7#54P2M_@U%vcM&ypLb%f+kxh4FTe$%Khz@eVJ?zAS$D_VUTs7}xX9 zGwJ8nu6|Se)l)Zo`ofx3&z(QyKK+^O!S4P?#0M4@`;8t4cHl7@y$&78FGJT}LGsJ2 z3Kj?}TLKi~-zZmVkRK|^2ZBC7Kg(*30K_OVEX!;&Lov<+BBD_we6->(Lx#;!N5a?5 zqQXeRHJJ~>jUc2UhcFV{E-8xM7>PK{rz5wmC`G~F$i7=$1))%-WooSTs=k1){i=br zcP-D)ZW$}g=nkdVuHN6W?(Ck0p`9;Qgf`zhx#p2AHIu`cRoPC1yeF}!H9x<*(%X~Q zwWg|cs6I=L|6ltHAf8`72+&M4>cu# zVop9Fctnv(82&XI^S5&KV_iu>gCP(dVcB%|MZl#wSX0eqJhSDRd7~elsq=tLqHPxC zq=}r1v-DiR8p9mm1bE5C6d93$&clPDJeyVnGH|LER8wUFkOc`2m1eT#_;X-n`2Cus zq!QqflM-d}#RD=8jJ9`(3ZtqEcZE7f*ndERa;)3(Nc%` z&-=*{M_QQYEzdzLMDf!bE_RgjBv-okB7Zpn@!Q`)r)x-G?KlmKY9pD3Kq7$6h*NMX zi;#%gP2zvl)DQz*@<^eMsjp-r{xX3Yz#wMsVt!AmN5sHZ=6`1Xfry!$Ie$Kbdr?ee z{tDy*V#T;&)*{GhBzqk)a6acP|EK*3n83K&%|`VjGR`S)0jvt zwj)I^A^|sG-=+EzNhDXZMX}iTi^2UDL;GhT@c;fcd(%94|DQgO?T3!TX5WFG5I~hx zZn~d=9u6=}c6Ju(JF?@wLv8!x%Sb32U0BEZea z4ubO{r=PP;EbOUghCcl8i_H_}H`4NTUuvWvh(b}w3V~+U{Fp0VV?iRE!!!k($p{pg z(dg&6I0wTx;t<=8b0B;R#-UDI&!dqaabxsK0A7?<^F=+(Y0#92TI9~DpGIUXKBNRH zkuq>1QOts(zw*1L2}Y0+ycpZ6c_P*XmEZgc53PndxY4(7q&zvr}p&3 z%uYRgzK2_l&ga+9j!z}G(xWKEZYyP7vg4tya)+ZJq0C|>{#%z!R!O6cWss}|ngZAw z1)3(AsY|{yAQtiSJJKXpH-Q z3Fcf_bCFB`d3G=tE^ZvY*>z9<*uU?dqK73*$8;mxpc3ki#7cI*1mgMD1$)sS9Z|28SyB8%v zPTE90_bT!eshH)nGt{V006I&botg?Pq%IY8i>ax+)#Krn03^_uIq1eGLpCNSnE;J6 zF*-;NoldI=5j}xyGYB^enx~ejL_HG9ilG@jf~d=7m(86_adG_HbxvVSRHrqtJ|h%GVXT3Qi z|FTytK*{H#%9Nzs3U{Du;eu63C6x;@E*h?svoyDi4t$T+km?eAru449@rue}45nYS zygGMmsQU)9)1oHTph@Y8T2o5ls4dkIf2kQvDZZ*FuZ*oO9qFnurH8U@q`ow3VR5oH z(GQEoCx(RqoYNxN_E3Wh`0r$wD=8O>8|O03W=m6W+N31FWsLeXcO*I%g#L=ciCexNA6uB^P^ycIir@PU$a;f;wmaD=AL*n0u&YsO~TV5$8;8p@s z_rT-q2k#jTV>bH(kFnj%`toJ_J7&&sk6!3O3gfHYS9NES+!tmt{QMtw`Y36#Kkm5IedOHzB^W{_Hibk&_ z*T~(3x55XYWl4{XP{^%PqN@!C2&*}G9h_1vS0fOu6J&80nQF7<8DtI7cOdJNHhEijO5i@HM@IelNfQk?*#dW3QX>n_*--h660D)AR zUt!Q&1Mvr_VWe2#jgs^N@d-?GnFiCB{|R@~GmAIzDuuu^f>OorXnlHgm7rz?L80WX zZQLg4Se}Vjt{VKW{tAsdFK2Glx;@D%Rg%l271y!Xi(|%0;8ig3k-1k4>x+}(s@%+} z3xED^|B`TV6KJ{=G*!Td#Y{;#hiT99_;@tiBGtcW=b~0)uz;Fj`1m+XU61GE4Fo-~MVNO<#%*9Vh{YHg6*QhID#4>B@LaH1 zlGFu|A;kZQmKYJ#z+4E9w7ZLzC=zTEY5T;EKk>DSHMftx^mgI+{=U}j{dwt)<8Lk4 z*b}&Fd&6{tmnpvOp0~JC!TG@h1W@_c-?Ar0PpqxT8`$1ny=i=5Q)gUN|N78Xdkcnk zw#`h7*FAavgI@*R^ATfu1~q@R=q$V;R8w1B2a6{keqMflU2zM$FgA zj*zyZ0nO|fF24>%`PFrGPNfsRkyEG4CjL;2EkxZ|V)+vm0M(4o^t{tJ3wBQg3n+kW zj+~4klLAX9%p`?ZG(AcXGknyfMD>*)SS-kwtu@sz8SYv zBA$@j^u{Mp_)9w?=gSSz#za;CYNdvs$GVwvhp7bMwz)OdbfI0tz6& z+5CSq01drK@5b6h%x3coPovyR!Q3TY_-wDt{1nF3FlT29&bYn2g*I5K!ITAQC-S?| zOZjPROd&gjo}QP{9-3KF$I2g_$xWADAoYhLaqM|`)it5YFUPA&K-DNhl>%1v6vG-l zOi;bE*3kdok*ciBfWGqt`;Z}9M54CpvdS{J*JWjvl*Uja)NrE(*yQApB{d5vxVsFg%7kjLUn<`^WN za7$>(W)Z;4k#C8%mdlEk-7;D^-dbwp4doqEm19RH3KFwQoUYm}nd$3VgrT1#1T!3; zZb&Z4PRK@=z^ds*8ABN@%c`qav}Gk`mnJjst~;}{F|BS%ZqAar^yb}9t!}vHigo$v zwtkDZGk@I`*D!Y!UA}#1<7e*EAgEZ5EPrPDVL zg>UQn3F9tHsLm9Rd_1tTD-Gk^SlMobWk-ak;E80S+Be059^V#AqApPw3@7T)q*9k@ zRa?DmWONF9P|F8vhFRFI!)}eqqyfuUxtP z)$1A-UH?kM_`d&jq;>ScUtPQJ*Y^&#-~9c(LT}@h_m53{WpnLLS~9y=g1g4AJHW$C1Y69YgK=DYa)C|35%5jK@u6XTHI ziPJM4Al?`-m}Z}e3pD@w^bnlI#QcY3NF^YcyNhI3<-BcEBC86Ke+P8zax@;jd+s3UcLe`wEB=w z6BrC@9PV(~;b7S^*e3zA!kjufkQ6fWib8ZJSJ0-8STiZ;iD-Z7)l!QDOQ%_IiWW5@ z#!JJzbB!%w@JSb!CPM+R`F(Ecz|pl=zjL^?wm$Fj8&36it*UXb%wmo+)LpZF>8Y!i zr6%|+s*)?eapQ)QV-IT1gr|? z+RO!w!!_CAi8VEQUq3M9vKG{K7yEmBWWQnY47Y}V33{M5oe33;BSH^U=%zEfm6~qkEjUTYv#B-V<66#e{w5(SU0%t#Nb?j%DO5Dstw9 zcXvB#S@@WiP`)p0Ei?CUd?!im9|pILJo^PKe#TaCLg7c097wcwf1 zDLNVE4GRE>!>3gMvnyd{Rq^qN#K-GY1i>G@=ujEad;*q0is0aF5~CL(lOUJ*y{~?a zjhp%3z5nx@Z*z}6`?Xa)7oOlQ{QhrvRwHbL1=J2N0RDlMW5^^c$P_$>4+L-&3YRe%!R#-Vfn|L^1>(VY4(pZYw_;=Vlww404T+> zx{!~i>^#;?oz;qpG;1;9>cz!|oE)Tvau@@u1PswEe8h^z^YBdl>vU(>R^*P5^rR(f zL9!(!p4n#qG2)yB+g@DkEA;4XS(T}APIXdxu&*XX=P67H&e#{%HrX>vfo505ry2|U zs=aMBd2G>dCvLxLGP|TB=-~OzxRj<9jfJar+&+23ub*b(dds?kc7f{>6ln{WhsMQU zoVgbJ1A2tN8PeG&D+@W}l|Vgu2E&|AgQ7dF91uOgyD($e!K0*@@Ct4A2xf-%4kFY9 zDG_!hqYC_K3~3r9eU55$oFJPO-QYOxftu#HIMJQYTrgE+&U{qBIv2e*dDYLxmVL0d z<-m@0IfJ8D?_+Wwsoqd59;jgs)m&CA_Es|wHMNa&uIX&^)eID0A-?^b_@?+{oczy@ zi#BeHAfkgrAmmW%HAY^r3V^%_COsK8YtZvZT7efxEYihN&Pxs|@l#++2x&kN)6X)5 zK6tW9C|dc*g%fS7aAMznKWp)tI-H_&ILJDBqu>yT+UjS zAbk`ni+_lwDd;yiX%dhk7cIx5M~WvJrX*4(mWIF@$~~l#YSS8 z#J+Cs7ogZ7F_~5hS0Tb(Dz`iAh=AqU^XyuW#|s>>M~kqnHam#!P1$K_D1b;yLf{0T z4hhd@W#QP)MQf2hCzm}+Jn1%)@FOe<5(kSAi!?l;y+LS=GiYKX;aFNP1y?rmjRMVI zNKi6LPHLf+2!~d^v%aGpBENs7_{30U)isw7^pgVV#fyhd92XzSnx5=){{>=iJ7TS%0R4gj&_F}gW52I{IKP3)smk4iqe zT~hqP%z+|eQB@Q*L6Yt$kV~I_U`r^wb3>Co*KWzQm39{=Wc2MFS#@sx_;~5^6{}cx z-Ib56oVsU2m0Y<*kmn6vv$$*jR9Sg0`@;EU>>+!4vVp7^dSD-{mwm<>W*%M$}l$ zNsF}RB{36Hfvms^$@EUC^a8*6+*vB(&Em(?zXW~P|9s=fb$uB#Kei7n9k6*8CAymY zjwQo=37Z~XSIqo_$t%yDX+T(OYj&u7YHz!E`^*(U)@v0bO0`m@sNes+n@A+c3}n(D zc~Y;k2-2sftiY$_vxGPo1@*+7SX`A%wfGvPjMlD>TT#3&Ti2{;*284|S$l=JYt*{FtCN8PSpFMy! z;;_J-iH4ORnhA3ijG=EJx4*l^Q+Gpiad(Mx#=5aTd!pEtmzi#>Sk{`Io7w%!bk$g$ zFVM4L!O4e!f>4RPF!eEJaqNt!w&-to52-Kjs#-3Sr;f3w{^YWeP4o$=6 z+k2NBt(=^4S1t|~_t$u@@iryoh4Z?Z?lxb8;>I7yNz& z@|Cl=3G}V;MUxxJh$lfU&H2P7{KN6f?t1Uasi&@OZ`k$BWmg^RNvdD7zxgf2kX*>? zT2UI>wsvHJKV!vL_isHpmR>k@WOU`}-CbJdqbpzBRad&^uIcH0!&M2+yuzBC>dSfx zjwB@-J;w4SB?*ba=7HtqHA4%l+)0&fQ}s<(4Hj0cJ~l#bMJu9;Ti^kONQYh>P+U%A zDRfSqvqGrAajFo|eoxRj@+)MH3P*)k=0$~+S1&8R=u(qiBW`4fpgiYMB3h0fLk4RM z9pKZ>r$Z1EWuI-oc4lnIvF%YNA zLhV=f7RbkxjhpVYXSA(pXkXqKuxg#|R9k9KWA2pRZH&*hrq$#)$_6)-yQ@p`jF#-; z#z0Pcxi`CeQ`6Wj%P>)dl|e-C_u)LSbdGU`EGyHF86-Ty=q&GcbBsLG&O140%GiLD zH*3)`A6Dq-00#*%tGVg5A#x32a}vTwA18u6W*7l@_cYifgt^37JH#PJ|RBdW9X<3ZLJ)1S9cgZ@%T+mzO~q0%NmBbg%_S3 zQgi>@QPFR!(c?mAgj6uuAo5L9;vyYdt+!{%*ej1Hsl59#-i#6 zwys}%Lwuc!yRe+OGhp(jq&rkrrP^k4=Gzcx=*`S&wpf)WGbTBvTC)e(@|iaV*#GJB zseY78a_<1`17?aF;S;6Xe9SqLvpi9;kyvzYrZ7>$hXNg(TG|t{>MG zYAG6xkc6F4`UMON_SNZ!w=D>5eQ4#>BikE8mp{Us@U>={`&TSaS^MDDW-Y_9tkCr5 zr?$Rzw7c*4cdk6}y~7I^9RBDI=j6&UM`tZ}u5Q!Gp%tfhG}c{y|J2e4u4rK1P$?A( zMbR}seJI}RNt82p-_vp98(S}b`{?4qM?bmaW2W=HA^bb4=~>w|pov=e8)`=CFuyv> z8&`zZI7Jpqjw}b=d~1*auc;|7hhtMN^QITjl%q8rT|m+S)T3Oco=uFNn@3sSXpXF&NecC{=xT?OS^;KGGWKthug~5-NW1D z0>^QSPW<6iur=RNfA!b5ZF_BRGtl@PNMvNXnWEZJ;Q8+Y&YYd z(A5c(E)42$*dVhpW0((QHuF&SW~~|i5xLE=i5p^CNtR^vgb3&nM5I`dVh{QK zqH|n4mztlfVcB7U`!y37XMV}&fBG(;AMea{$0ezZe$#WL@Q%pc9PuW2_)gr*-cXJc z2C&nKo{F%5m0G34=RnIJhsPW8!khN$Eb(yQNMb{QB0H%aJ~)N|$2-y&smFXIr6Gkn z=sJm9MfL`GSz=Q~RtujSDGeYNxL)y5U-RmP6^pVA?0pN$Id%!pu3Gh#qzoH_H136K z2lr3ana7P~?Nim<_TpT#U1{`~dOI(u^h)uUbPu2Xntu#3C4{<^OeebES)IyKK(>@f z#3->dZGkmV5O5Uf(g0RT(>W|0z$;uNmQK$cOnBH%L0TP#{3B^!ORGeMIYS~E6s4Z% zto$TUfJ;P0AG2kpESReId@dZ?vv@KZ4_#X4^P1+xLk($h8l|Fg_04^s3xht(6dyWz zKaGQyOz!Vlb-HGL927GRko6UPh$1Gyk*+22IFm5|_63xfI+L8NL{su=AS|k_g)oN; z^{!+fE26Ok;`5PPN0kOSZDjiptHhw90VxUrCy*N=RwETGxg4!Oh)L0rBtI%g8+#`T zpM4oc8cT+*>rKz9U!30c+f4ZJb;?b53bnwP{prO zs&f+l_s@s#+FW0|>Ey83weHAhk=}!N9>)zbEQTO6N<*T>J$m!^Zeh}|`1+p4Mc2Q$ z{_6LRw1;YF*Gkx;s9iwUN4R-tglL_uwsmeQ0nde8suj!irCi$a{{wb={V?j}0mKbwb}QZ?V7p zy7-H)k8St{qq^-YjODEjt6mcSb>Y>vW52xh;Lq>u5v)t@{P}@fe|fA8cNgGdE{A8( zSE4JFgC?;KjmBY=I`&OH(;6A_oF z{Vd`C6^N7pz7e#rTd(}qjcslFzrOM1)8lt;s8_HxGp}iW^TyeQ`(D3l!`WR8J;AYq z{XMU}wS?TvPOQ*JSJ)BCRwx99v=vech|Uq{lTP7MbSOp@SfE0oPe?$SdxAxeW$Ndt zg6IN?JwpvT;$UJ1E<#+W-pfU62YesF-*clDPO&0$ph!t6QX-nj(TEfi z_!F&C3;ap{C(Nh-WpahIV6tE{;R2Aa)j~-yUQqb(Bgeeoy0Nb&kfNW|`}4|Mhb#VR z^En-H(Vxmk7FFb>8Yc89fttRJi^c+-^`-Vd9RKvE?|k^zBS-%B{>!hN+rn;Gbo{<& zRz!Z-bv+FWld? zq1iigTV4-<7%WbSjGFz_D z<79G(TGBy`TsbHjNxevo8*tmCOdJupbLmU6dh~*v-4ZQOl6Jz)6!)zw6Ss;VGnyf$ zO#CL3x^PQ(_L#FWTqXXQG1rF65}087rq)#c-JUn!?3uYCy=`q{PJ5Y0Z1q)j;pAW* zuKa08!W_)Fu5$p{6-HH+Ntuu}h-rQ3J~4&B}5(APjYm8pk>Z z7sojO{^qR4cwuZH{-Oc7b1_7!OK4hF;+K?KlVm2YG1fUlV)yCSr}Mth`Y zW-1N#4Af=V4F+)4U{IPpN+$}+ocauSAQ>4p8!|dNjG^eTjoKivV6jetNBl8IxlA`m48k+2-jAYeVC^H;rLTA?*iT5$DJWcM^88L)aVfHfgLq4cwLZ_p(p(-s*0tcg`1dC^&%NUhGufbgp zhgAk6XEYlfoGhNxD8>c?XwQB~gZAtyH6}AgsYybmw1*7MaFEO`H6)_hBJvY8LjX!&x@5G7&A%#2)6fXr0GPaBmIv z_%yhO&JD7OP@xlTLadg-uuq4M@$q3G19VDj60Az4Vlb?<7`6ID3~FT)6J^7ocarSTyeeie~5BVM3oImnSV*f4Q z+)=ArqpRBd+`;jK&uy;4_o40IyoLGejD-oREoQx-OtuLpn3;~eeb4;v@b&MV+MGSJ zj6IRP`P6&YAO77l`|{X6QLRt&`{EL6Nl`XpC^EhUR)7*U`IDhS#_5zLCkuKP?HHP* z*V|M!D|D0!wMnXYLlR20T}eq!y%X-7Q)jj4Eh_0&Q9Vl|;W72=RAN(4$XJFQ7SL>_ zhX5|IA?6bMm?-p|oq6?Yh$N)#0I`Yllm9k`BO^PZz_`RyCmJ-Bno$NWJwrwna>;Ihaad;?tcLSJ1QYVkOe zo#Ak%E*>>|5+760r^tZ7_0^7tH59xx>$Z_g?6+%R}|?KqH{=7-zgGoRXNR@PX0DE1;eRd2y@E zi`Yvd^jV@#2`Pr)X?g(aoF%Fp)YDoNkrpY^MV5#m;S`D06+P{Q4pEZ8WFf|I>~Wt* z1}=J3gr3;5U=4O&F*x(t&=6}De>;03{yuwh=AVb@yS5GaB6s}J$f=k+Jvbl5VkP&A z0+?gjgzUahe`QBFTv-{I80{_|U9e!ZmKknINP_+`u{02H!<9r8HJWY&TgM;vhdg z7nukcaiJxvP6EW2>0gH*0g{n0v=j&-DL|s{ebJB>9B2vAIR{Cj&JEJ1$SBjG1F;aK zphIMs2?0UdfXFJc)Yg@0myWF)FWR%KessBd!Z@zY2$m<63}@eTTUyJSCUaR;nPt(2 zR)6J&dzbGXA3eUh+~2yPb?Dw&v{x7^8aXl&JMX+k6F&w?W-88Pvv>Opm#&4`^t{Ao~-W8EoGAnGfVTvjc$joaBzF`ffrMG zdELa7Au?TBZf83G`d9EuDK>Gdg^ww(UJNa-?ZLR1+Tx`XqkUDQ3m1-7am8s4v=4GP zii=@`6{o?bP9x0HjRI*hI?@s9ud1x7gc(-ls_Lj3t%4a=Rn?*FXzU#5&?mv;MKy!h ziy8*603a^fr%?bdvAm4RNckt^R0xme zVn&2jQc4QkBVKAGn1UenJU&9Z6CQG_Gy3)|4e#n4 z`5pGM@r9Y$O@o2N!qQM$-`Xl$pl^HI!JW4rb=NIx?0KNU*|KD$VCmi^{&mZ0#uxa+ zYb7o+&Wg+W3ggWgRheCr874z_XJ(4UU^95@Cu^%ms$GI0_^aB|s=5ozJ>x4f8-q#N zZXmhL+MJfr{E4fLJeN^7!1YirGC+OHgiVmhK2%X;#2Wxcr&(gJS8lTW(az~O0!No5En&dL@k~NdT#7VWTTW#yB^o3Rp))DyWt$gl9B#7RJN^}I zcEi&8p^2g4$aWcT68&>94UNr;ey+etwW(Jf5gy?nAdrNuXSi>)H1_1fH_ zvd&vKH;r}Q@cfFhA;tYr7$a>q+2%vT@(j8Wfyd-cZgj_;no=k8-)%PhIBb*as?aBO3>dDk(=TW>M- zOy4{2e)A3SCGqyRzs+7%9xBcM%gv8J_Bc~y%Sbk||NH4@#E%L}%H1AAa)$lmLyuth zbj~ikHWTz+9oc;-Ee*Y@)AF4Zms0_q7DQX>ieN<$!7f1W(WV-Sq$mTwVE55bS0spp zb_bCZ8SzuGSF-(hRzYQTim8LWgEx*BGNm1*smFQ`PFKob z&Q7i^_2&5;nz)qGwnF`@pYLh?iYw8P;PVWjMM~v{uPnDZjSALTy88BsdPkDpsuh$* zr}g=7;4CAyB0MQP1+NL+ZsbPRh)ZZ>bqJuq&q0S(mSdz0LO^Q&8;vb^h|>md2i6-A zKP2}_b1Cf3mYI*&F?S`z@oE>d#hPDUpZ1_@QdN{`PftlP3nxC^-W&?{aqpD2=UJZ* zW}9=G3yB{M|Bc@ajyTCW6qs{~VsQ&=K!g#82y@cVAc2^dFdib=O6oK5B3h4v-=g{h{@1$iU}OzEPi z0y_WCSe}Ak%LbSsiq3aR==?@Zhh_}~&M%?!@fx}Z;pceGU!>PC_aI*Ec!p)%WIpuS z&&JOrr?BR^*N}TCE>mw7zJrsMD{F&iSe{?fke64`(6AsJZU`3SSk*qCkd$N?3?~V= zm_lvy=s>MLzjVQZKu{Mjt9=wblY^TXleVQ~lISEw;3e}L8C+5pPJe(^ilDqV+Ht4E zLZi(V3dAZR;)WOrz9O0vg5rVGh#nUxwYU_aIr*`FJ~lFP`urWn!+&{XbnMCV$FKd~ zEu9@l-`mYx_1$B=ok!l?#qv|j?iSZZ*rBv2e{anyoX-wn)hkTgsfQTz8*90O6<-to zb?Qm+*Ke#G3_tYoiDQ4czrSGY(Z3xz`j>}>&`{%MUQT(JP-AA-&f^`q-QqIkb9^bH z^98bI;>%POq%}9El$IiCSek;`(i9nsm?pznc&;kFbD#<%c5&e?MieU=^-3H*wEB<* zYH-#-M3T@TAJG5|CrMaSA@QDYw=Ch~eUPL8L@N(CM%Hz#uuS{*XC-d-& z`BX(J4q>VyaS&r(p&8Mx|`-N`)StZWGQ9q*iui1wh1ex)>v(v5;EB;^ME z2DKpvsx3ukK;#*+(Z-YS=!6;iosImC{4006r@YK7eos8Z^f6V5#YG8B9@8a0A%4$Y zSm+i%6@SRs&ig7Vy}%XQ%_XIY%yy=PX=Dz#Le+`l)#6*?Q{on(xu_^Xd`SGG_-FA6 z7ZBGdGP1KI2fyjFC-|56cHHC?LIKhSRECNJC#8T-WS#iqhG(A0w}}MO9U{Op*smt5cm@4_6>UWQ%`lJZ~eoY%9-zb zDyu!rb6Yok*Hc#ILhHlT-pXn>GocSvYr3yJvyS;~ab;zJnDWzu`?;@_R2Cu1yRWpQ zyolM!T#ir~$zdsPSA0jd5Ea+!WOsy?40iVqjkUI}7!6fqaAO%9modh<8ya8}G`RBz z!|v4Vv4K>+qBya5Y#`BO2*EBhEuR>h80s9D2&uHq6RXC?24x+LhU*CR^}$a>2%f1|;5ibFivmn|0(*@Vvk^#W zRC~lq(TqGSZ(Be?l=iY0wiK-ViWxYEhGvR4yxgzi@R%-em9uBfPX~ z{E3f`1|}y)GBZaeCId%5eqwypON?+LIGLBRy70Q6-96BI{Jm`j6Jux$7ap6;-}c_| z-hsP+CZ<)VXJqG?{3R*IoFZ;Vai_N1x^XZ#H8ojKR#LHId_?Fs$4|v+*1jqJ^7KjZ z-!CqYv%1V?mo;wri;UvrX~y~HT20&(?$+b~I(GE;_x5Q?2QZIa+jsBpj~@Hi<714@ zgZUZdSxJT2Ze^;bI02;{?Hjh{mge^0L$Ye*x5&qk&sic{A-gx!zofgnHPjn!Y@7&( z2b#j+urk|Qq{IKp%4`6kvX$_Vl(iToRBJ7Pms6r2?(G~HCfppJ3Qdi74uq$smMjc) zb!oLQWwm-Q&_a=Hx5T;#a|vf@@*eDs5tp+zj$j*E9Kk2vFE0_;dULtcxjrJ@PZjWHJH? z&Lc*tQ`!)u)B-231wIPtG855tQ58pc1|y5OQE--GZWx#&`KZJVE#bC~8D?+BSB@XQ zFM2PEgW?o(_1uXrTCrg4@lS3e=NXtSECCo>(iafAIh4p^6co#n6(N&L8*b}4K%zM- zLu)M}T6bS9N07mx4jv8C6|{DygnY1{YGhL|1)6JOa> z!;#fAKoq`6qw)(vP7}+?F;d8g`Jft=(x6Zp@V^>u>}S4pRm+vk{g=01&fF}vlC^E;f6YD)-Wg=BkXELO4*>(DlpP$1BWodI z6`V>qN7EHh6ZATGBrzxVF-BFbJ1fi0ELMfcSHWNFce|xe&`_MhF!t@$ZU`T0GCy`5=` zil*BS@UOOaxt&gLk3AV_BIdJG{B5!cc?zCqc{WZKFUMpIP8N6_$jYC*LEe{}6VNa* z6}jA4MMg%zkeumIRTd_uROKWHk5!cy`pqec2By5jxH;vObWJQ6W5*x1_1W$^ zDqa-AAd3y&ae#D;lr5Hx%8rG)U)5j$ z0h#D^K{C1|PAtP`Vjg||J8~V~D0m(J2VO5A-%z%oEi+YVR_j?orx1q_?d;w^W<06%%U9e1MyLOFMd^gI)};Neo0>V z=?&zKc>A`TJ1^XaPsA?wLrVPvyCZ0U{!o4l_5pxhKp(6aZ2W%@evtB=Bo9HuP9|Uk zNXI*=jt)8&0r*(h!*dh&-W!W~ILa;i?;#H?GA=T1GJ<%(tVarWAV3F|I^H0`9w^*F zi-@aMMH=t_C%^-_5EQ*3<;qB+2^S(7NF|E~oM(0?v1o@$3GHyj6+^e)`hSUZp!r+w z2jGDonrkqWZ?(kR;{>Bdqew!^FUcsCF~-MP?7U4Y3mIYk+JKY-;0)z0oD@TmEMLe` z3Fl}a?MNczr%b^4!$E_J^AKAV(-v%sG`WvM^sgkXgaD9%VMAFX6aLBXukmJF*K*_F z=6Ak5(6DXcbx!+~cmu#wuLvj3edAlZJ&teXzwhQ`GlQn53trb-haX~KI1o%<2JeCH zwV}3oI#g=#n3G)sYcy(8k?%=$$Y~#T&TL5b@NSbegegr{w_9zsLM2KFm5r=}XDEZLj@k zM?&(xmg@)B|Idb3Pj=SsS$MVCG=ApRr(S<%W~1=I`|G!f|M-pg*YrriJsWo-Gt;r0{_33oURTpk<~S<)~!6_lnE7+mV0s z08QvOBd3g+tPB7ZIz<8^$u3ley3D|`na!Av3QJs%L5<)-bg42>oZJC?%qAP5{USY* zXds6!5SZR*z`^VPD7d%rp))nRUcI_(h`oH~SIviia;&{#;{&TZw}^+wor&Lmb@ceE zaxsyY^@uk%qIQGyBCues+r-n{N3cseWcxx3wdRl+?PFTZg}LTjv$L=eUPfVIS{h8v zw8}~+1~%vBj1K5>YjV+t{!QCBuPP{*qcqXRNEGBIk0!#g@4I1pAQRp|QHNeYG7 zebU(?KauY!BW5oP!Y(v?fSW`cHh?ii)8o<*LnzuCsxVFNr9aMjf?t>b<37q8yKy)e zUX&6_a+KLK^K%p$#nu<=GDgOi=1kl&QSgPSu50_VnSD*yt!>vYuJ0Jus0Or}tnBJe zrX+KvE5{jM*uN>X_)8L8plvT`+lm|7Av+xEptNl!w9PZ;nO&f5GiZyJ)o6}ZS?OxY z3*-e5g~)T|b>xlaA%T^bS7)s&>l~=ltC5|L(ie$Z!C|!mSoHsZ#9mMw*%msUDS8?H zb8d=j^|kLDiX|~G=QF~6ZHd0FB|T}A*R&;naTbbk7ELTJkL#+7C9&G*(2bdr&2cFe z?U`Skcp`TV+LTX)Y_QA1&_jaNYLC~dQH!pEbdw9fFL5>)1Qt%KCrKx@8W0@R0&0L+ zk&#F^iLDYHg!_hb3Yi@h;xN^SDh*OY*+XW6;L^=$BN8bOBIbBv=1zlxpEz=4;=cQM zO+33`_sjwI4)(MuekLD4K>{3HYKdoe&n%pAVzmS*xDk5OOuC(zfC3`mpy&jhc%)R( z50Ejznl|X-kYb99Q<8Z)N+qY3q11&UGA_Mfsi7LVSP*WJHP5Y>03d^8z3iVwD?hXz zGXd@pCwb<*tzrVJWzLK82qdtT`L(E@`72ghg-k*d=xW5oAxxEyi<77+SL%&Ql$&#c zj#DYe22`_zoTVSBagT~wzyKno18mU{AsYXpL^N>%QwlGlnNTx0Gc-#utOH&&p9NVO zPu8K0SE(c-@p4VPoYAV#cvdI%N{rIyKdyt2gRX)y?tVfD@$1Z;u~a~7IJ9+^NPuS( zlvf965HD*CrOAK{Qll9@kN(j-%rrhuGd2KtG7C%>kjki-7chX`9nR@}Y7y|zF>&)*& zc#dKf^I8waJ(InQixqpZcUt|S@X36rPrC zztrOA6cx#|NVMh5F>1JIPD7I}gdleLtRA++XlPh=Yd-s}@CJPF3rrV(?$o>CPB8aRtDe-JSXf1eG_Iw zv?N*^Np}$OCK(vgA(hH!2?ixL8cQ5)GL~d6S|mB()rcEO$a<8|(p;!To?1=&8$|z< z|6_WnFvn(rKkYyG=f}p!zABz`zip##TeB{18BX+e;9;c7%OTQ&)@uu6xI(PI3 zf-nzuto*CHmcGE`ogl2ILO!ob6fuBLF4DI>$w#4U-V{mFCDyE!*k zFV~~pj$U8qks~!Aw{nPxpv^PQ5kz9)M4ikYB65Imc%)D`EmNksI!uvBiw%}u6!E?! zjY;1Qd0H%ut=x@)C2s$4@zkR`np>{>+QtQ&vr9HL4&Sn(EI4+cKP|(Q63S0XZyYVH z9Io{y=N8%H{AOQEQbOY!$wldQYi6ZCvns6G{Pu|KKiPTslo~9AX zTv+NE1|AaApf+F*0$5vNd92mWQeNL6KJv6(WP^YSU?=!0}ijj5`4poV}xF12T z$B{k`0?G{qMM#Y}3oIt|Lr}pyf`*lcwGPZLEyvkPjRdP0ff0rn@5!;z<9uz?~Jho?cA(Wen5#tDdpLi|GZN&!kL zvSOZg?xLqL5BKy8iRai?Ax9q+OPI}2+f-*^Z}J1!n+~ThorUp-Xmp$o4-bbmaY{Hg zXnLvzf=|l{tQs3sssUhvx>B`PRT)yJ^3-=H*;A3d$qjOCc<=L8xyB2sxYMdI0)h~L_`;eLi~QzYD)Cs&PCcsj9+&h z=_c{)7`rb!6dc~w&bns)a?K&yp@WhNt2-nf;4?rabaBV(Xpdc)Dj@+qR}xfYnj_33 z3|mLhg+&*qLm9waeHyJR{qI&s(i?Nj3oLzNuk0o8eWb%QY;fg z8FDS9ti?N$4T%#uM;6I!A>jg=#FCm?r4bL7Oz@*53P#JmEhr+O6l7j57~Q+%v9FwZ zZTy~1wM+{kk4m)^n>!OiKdE1(Yz#z201Nrxm{$~h?}$9G4vbFE+98~ z-tE!3E%5+w#IvXkrEWYC4KepAX31C?Sz9FQJR4i0COekS$OPs)TgBA<-#O4A1=( zDN)b{?V)UwiL4EkJ<&KZ9W$pyP6ZyNyhgrGzEh6MC>9Z7XeL5X8p!*v);H@4MIFqc z7+O9%=V@MOpQYm4uSy)>h2G>uU!e+{Wr+UP@>+d3tmPfZi|{4{90Zfe?r@-wHRAw& zIG&=1rJj*?^nayR15sEJe~suWawIRIueg(AhvsW5aToJLHt;!ph33CRSJBzAiLynZ zbP0)`s7gd18dIVQR8;Aq%Vie5-fFP|Xll1&Dq>Rw zxzA~;p`J^tDjD?tn~(@_L-=#@KeB#cov8d^!pty{2$;g^XBBoMuZWQ!D^U|aN#qA+ zto>GsCB}#{9MP-g{@?`;hEUOs~uq(xRuM;OAJ@lPJCWEOt_Q|NO}N z%Vme)eAB=88SwX-f^6yiXa8Og>4ykEYV^@Q3cJDUruq_LVbC`?9!LYg><=%lEf1pPzLe|2V2gOZ|TW?$2b*R%@cDe=-y@DPIAt(0)P zKg284F|Pox7k~CU?n6kP6!c5TkhxQmlRb9yd$7ZYuzNgofGtcn46udk3M-FOn@E^t zmj5)18F7)M_!gaXOu{R;%+`lb)TlkOV zOF%Pt|$qYg>W({IX)rgzTAtb^f&lVKraAgaaw*L`xm%^zt>Y7l6XdM zl*h;XJ!}`eKjDe={)d>xDBtk}mQiJ;O7B0*5&8tm5$OqsWXJFX!V^4#V5w)$xE#_m zW?utLqwuhNKV(Ss3~yxyBq?GihgeASaH@Idk=6l_r^vdcQ!hI$oi2_=17D6+eeM;~ zGq4l(UFj9fW@#rpmnp#L;L3urCq=qxypQhWJCSGHLwCZX+6^xtJ1Nc+FzhGho@|G; zyqnOAQo=>gz)9o-^z4ds*N0@^kM6@t_93LYR56%-aQqN% z#{tR-*zaT?n<5emXNpA=TaSv;X?7R59YUx425^p*p1^FBcENMl1>IBjhe|g874W~dV@=OOUd6+E4uldcDkQorG97V2VPgsi%VS=N+K5Ia zQidz4oJbM^?S5FPArw5N65=}{px}*Xx7TdGZ;EkDh?|z(wXS?R9qlX`v-tPkJ>gvD zh84Fh4Y1qKFDsosI=Ns|PaeC%+q{9u9-=iq5dH|w-Gnt$Z7NU4%2MGmV={@_pXf*1 zLc8B@^!X5n@fkA*!$w>B*g#5(8ht+;oHl@f%>N;w5mRIc9PU6_kuwrNLNy19P$^gnp2s34v)dor_P(lU?6uwYWT3SL&DNqV6 zos^C*(0=>n3&eWvh3??0^${C-e}%5 zr}Uen>}iB~Rw$=tZyzWu>{+M9kM$dHqgN<23yXsly5=-=qzIuj-0JgT%B9Z=XV|J2 za&mBe2UpkWG^YyYX}H=;7SM7kl3K29S#y0Sb!+5NH@U9?>zO$KN= zYq*^JQE=0|=@!}3yXuPG#rJM&?zsH1wI3{(hxzso3;U2cS+Gf-Fe6Xl|vaTYA@M@X>`D<#HfNIB65Lhj?jv+lvE6Q2au8Sf$ z<+zcs>M$mTYSF00uM&iUcmRrhYF zQ$D%-{y4+6yP0u0yLIJ#o2L~nfAEryEwc-U3+HU>YFydn4^(W+&#xZYJzM!JN`a3( za_DwcA^aDPs*r&l&zDn>4}~4)WhG@H^A(lkiAipxPNU7K+h;-g2Q>_~Sdg{`FEzue zL+Xuga;)Ru?>LX*7uawXAH0C{2pakV9yjpKQu%10N;ki97$LSbQoUUKH=`$M68XBP5*U$|vn)w3~_`{vV2 zPqMvT7tT?s)v&UwU@Eng-%xCpQwv^PBdC=}d$MMrZ766IZ`J9n@sgAxp|_osg-OY{ zT1`ku*QFyhC*4ZXX+*4|(P=caQ@J$4qa>r$T*D#=*IYFyuI=n>YQYv1-(NhihECjB z6hb#x9}hjUyp~x7@l%PT%WjxgOZ!L}|4_dZGM3^wg$an^XOoYdoseyCI#bX>$>2f% zZV%cqn9xoOwLKD#=tQKe3O+B?m^fbqJK_vh$W$N%tuwM~@X| z<>X$ySG;TA9-J6{ysleOr)wPhi}JDZj$yg^FTaznKJ)u~?xi!LETjWfvHHHv1h)gH z=n-NbLvbFD$0}Jdtkd$ z=9B{itg2j*CkCj1dGa+O^aid{bb$qTy}t9Ve?AiW(JQR_{jcBm_SNryV^QycS9h&> z;_?|vg;*u-xc}3K=dXE=nGUhux8CZ#Z1b`w{(0-yQNM`M^Scn$Kn(=?6aNpS3U#eT zUw>0BE;O-=P_7B3WhOuRTKoOz9EiDJ7OM_Ae~Rp%uyLkBPH}9QYUiki0_f8J)NQJ)?d&fSl?&O&>^Iv^UftRAweM}a>b2YY?Dngz715OPMxKuh=+=Yw5lWGvh9gl?}wP(oyZU5U|jVP%6Qag5(8U9N6`^HPch` z63Wy-&!o$?T{C!ycW)jq1%Ai#hAWiDEXc5+$}sJ|r#B#~}mV z0t*}c;~6s~81{w|Qd8}F5tc-&*nLByHJEJOk9PO?z~u#n##NO^B<04dRcpi!pfJ2z zM~T36MT6@Jo)oNoEiF)F_KnPgN^!g*8VfM2* zfGuDUajoe>_Huu)Fg?TVwq#@&CF5Sim@Uq|i0FGPZiKJgK}^tyPuf2u=B;-SW zZ)To9BeNj#nPJun`g=%7fj=Y-==(H$wgkQQ)V(3QK@8GJ^n|@3gEe_Sk}6~&C`l&S zw0}s({euQ4HP#?*<3iJY8o&a?Dwod?16nMYY}wkshVIeO$tol0?ECb11dEZ+u-{o6 zAd@vp7Y3ai7y}E6oWQ1F1Qy=QmcT%b4o^=9J<$yyQi`aTWJMm&EGzS5R+JLul+ohs zY`;G{s}%1j!aMHPcjMM3MQ9IZ8*C=T!Cc8fBiP27ybn%+!6rEz2|;6G7rOcz;qXWH+SOf4`??mk zRp!?zRyL+Pux5L2?SYj$x*EDW*YLaY@dtE?l1cYExTp*@Lk4(?L5#~Vm<=dNqRJt& z5iT9F)=qJLA%=FJu0)d)yxidPBcqCcNTyI?`3L3vBcyx%rS16NOM*D=m#-JTr~d|a zoFU9VX0f1`miq(~j-#EHnL(X0A!rJ*WMmaukg$G&iART$KGdc2FLXNL10=EWn;hZ+ zlp6BpOQ1j921ag0>^@9`=ZC4b7Gn^3l+|en7^wX-(DA)~F|c;lf=BOKKQgmr)6xFR z+scI}siC+(!-XZjjarEltQ)zmw0l7= zK7uF0K14~q;eF*!`N0J-I_D}u)st-Gie9I2W!aqy;c&vJKNdKXb#FrOnpOn~52a`Tf z^c8y=csJ*&%0RWa?Yf(`Z`*bKmN_HCeTU@hZ@%=Z+itr2vfJ4k>lcSM{P1N|eHG!& zZ|V;M^RNJO7ZbyIPoV6=UxQ(v$9GjRrgF}Om#5#|vMl@)kT6*>vFsyF+^ zs`V%Pub4ioUq0BsdmL>DpU%bX4jC{w<3_>q=(l9@u*2J*mK~ z1N-~CVIOKu(uJPGaW1?O=fIXYaSkkhML67Sc5(>JAL?*afb7ZV03MV&@IpHV04RC@ zNCY4ffb=22$U&_6d%rmClBE~zTED(r?C&3FeqgY@W1f6);i?-i-gQ?$n;!m0PxHLj zhE}hH1p^8k6y5}cHlg7Nbu9#hM?yw^Opk|HyhX6cfavKV%ZH}F8u{VWQamHn2TTNy zjmDAE_+|hDn4E9+U)tE;-!C?7dO|+P@*WuOQhpoG3z6f?#@EaHgoB0>7(l&;z|DHX)nJ#(MdIu|; zae3O;XDIJ4#+?Zpw_>NC;B1-&Xe;OlgZP0Ye8^Lbsdg4?Qj;+|?;K8M(yy_S16_%enT^JKnG;0Z`Z1eqb|ic#nTe3ik+IJ7 znO1lC&^`%GL=C=LG{VArYHNS}*rQ8VA@$i{S+n?wN0zRLOB9pW;eCqoaB4zg%EMz! zej+iw@Ck}eZk66)m{JE-_B5iCOqdz|8|xT<8Fq;6IFrh7;e=}G)0jecx}w}wCHeku z_QBQDlw5(a(@IeM-T3venNosC`_{!Hjg(>XZ`rAl)2Jsrg$JmiMIPcVq;G1)-%X$2 z8XRaZC{S+h8<_FrGi`-<-%9bI=+M0cS<`eR5yQbaJ43{BnhJ?FvrT>$FboMcCLN6* z6U<>kf~q_w9WG|0vrWp4A1|uEN_N`V&s#cL%Tv=ZSa_&$c!_wB^(-2wa(7iIr==3* z8|C#EZ&DtmeXDT%6n@G4BS|^AIsE;(Mq{cw6<$Vaq0j!rd8N{E7R*2H2Ax{-nm&N&Hg0UNb~TL z)|QT}>80td^7k88bmqnBTMWj`+MeR2B~2G^R=&f!7Y({Ad&(6A^~LcU*`301-5ub? zRH5#OF`h&LWVbCSxl#$xM8OHsU>Zsk^rWEmX8`bNZbd)`x?d&r3yzA>Qg$oor{;h_ zW$dwMWF|Q?Gc7-G6uHt$?N_wws?uD}G&d^d!j~z3HOF_`EU$`g6`SlL`Bliviio^C z9ukZui-oL!qeHNFa8#wkaiC^1@A?Z`a#sLMLnYS+m5dxoE_PA8-`e0WXl+fNU6k#S zFEyJRn=Vz(h(*IC(-Mh#4)I2oBfp6El^y0hbR5zqh@xw}Eoj8+Oks!(-9o7n-xklC!gz#RnPoaj@e6)c2T3)@z0bw~yOj#)1OT3?NR|7}f z^DWsB)am}b1$*w)fCANpRbc8*q@l{uXihVvCA!5#yk2-Zl$ZpIJ;{KtkB5@X zPQ4SNSPYtBP$#)9b~r$G0y+t)x!~X=P=lB^azU@fn29fVN-I7CO}s81hD)B$2j5ej z4W&myKg2e+R9nRoFPmPo@r%S9M|JbEg-2)f`08A(z2X~7swz*hMo+FOes)dwpjh}} zZuxCQI};?pF93f$YV(s!qCwKd<7P&bWOJMawZ@>?Q%vTkegyO4sQyT6$nKN4XvOe) zdzF|!efzc3AL+SjU-{*`x`2@*$}F)^X=X3d2fc;e$G(t%01hb)#>ZO{Y?#PtiI=Pi zw0}v6BU-_$(9SMif{yvzli(v#)QDd#BrM+bab{0LYMRHLR$;4nz5CIpy2Z-wZc~T3 zB=17eqg1ieXUSDn&Wf|SoIS>GpeN++@hRV{a#;I4Kuf?tBQAuw45oI6Y<}-u>mj#k zUmwfgXUFtqke``Bt4+TrWHSq97Ee7*;vut)g^qKQjnRHlv#j0 z?HaGQrc3^QS3+8mC%w>}(3M=$QCiwj;vx!7yu%m7y@c5;>9eX+B3BUJ75mFwbGjDJb(aw&(i#GgIA_U8TPI@?Y-Fswi>L|LUxTLP=dWn;b4va$Q6qvEZ~md$J> zTe(@;LOilp_yUos#{q-=I4VvnY?b`@*evM?fLI1Aq!32vE_7PK42R>KWwfILu0TVV zDzeEh|FoWSelL+o9C4|@|oalQEdKK^|hSw5^#$z;1=&!84EXi}Fd19(E&2+ii1 zSPp--o_5?c9uTMTzqcKyX+>xv0{H=+L}1m0NJA4F`w1cmcylkVSMD3%EE%Yu&F6ar z(@~)eGg+`Q^|-lS$z|`3Z^CZ@*XO(WZ^`V!Zz0_w9oSwu7f=~MT|t&mWe5yWy9PSf z)C>cW2D=Y(cW)>)^y;ff`^-Ik`pmnh3C82>M{KWnP?aJQe@>Mmc!up=m=+QbzV;em z_?TV7j){K|4f?AEVeIInpIk#f!CDWni%=8r0pRcjtu)6M=Tiimuze7mLK%+bL1W5<=3!u8iHPfX-^2x;+A1gNGF*9k4dlB?L%NTj^agdkjqXNsYR?r9`5bqwv;I9 zgomj1PvCE$m$3c&`}Xa_JDS+II87V??#`yKU8OG@2Z5QeU%W;vmA-|zh(Bm|z|3-3 zbZ9g{m7hsw^qJvmg_nBMai9~4&W*KvhG$OHoqV?8*=M8|p2eq=btg_Xoctbm&V($r z&!Cavy&-yPcG&VIU#i`nswY$USO}pXADKKsOQ--DZ;pJkoMc7zIvHDshcallWG-m$ zR)ad~ziI&;#>7z!0yBy8P)8?0qe>8k{3=2X=+{bbI_ya)aJ0?3#02B+?>ss4XNHty zt39j0>F{USZLXBKSH)USZmuV>*pZTI%FOYJJC#jnN>ZIzT2tf9u7LfNRgs-s6DWyi zl(x7E5qrrgG*Poi3g>UF(i0mQ{r{(I{7v9N$ozIKoL2Z{-`i@ zI&%!<6FiOCHtvF?0`f194izX#F4Z64BUgC5hm;f5@2fkea57#(S#5m76cnk2a^e+C zsv4lXcy;&wpbdep#0#sY_qDjws%LlBbvBhZB&Ox1<~Lii-4!#6`x+#J#bq^)WR<4+ zX4UxWokiZ+WtDzchRYFe%d_RwW!D#`6ks2)s@Ts!!$h*G43b%p<5;3T4pPP}>nVaG zJtgY7RW;e6WOkn)zN8(#q>GF>$FX@gICl0w`}CZhPUls9(!PM0mli{tB8-7zeixoD|RXF#Ui^wx?t?1*e48v zJ7~g9W7jK}N*5^GL6v37G_iC12IMOKcKo%^ z4^Gi4f;=qsqYEo(m7-v>0UDbWm;ky$Y%!ePw2a*){fls60`~NLt*T(E0roAb#PFjys3Qq=aRv#s_Ar2(QC1G& z&b1I>NekIUq6G{>oVEs!0-*69XM9=)(k8OZgCC8G2gC!T zih+Ip|7#W2DZM=!t`%R2StX9nl7N1i0;=Kpb~q@UJ$+{bf|EGbEgdIZ!$RTMh=W$K z>QOTyeC?}%xz#`^GLwCYv&!sX<@+Y1T3RRdh~#9*{6N~iRo8K)Pi%@U}jLIJ|ihBUs5 zp-%rAP96DF_$T5YJMjB;p)!GHnZJ;wywrYrr_V3p>v&k{?o^Ja0P9T?0C);J+yr5tVbJbaFloGU>$# zjm}M=uB|G8){p&Ko?bilYsnY0hLKM7SMn`pxvBC6>&#_Mph|cvt@8u%`ln){F#-#m z&=Fkn<9s%8vCLMMfgLF)Xqi1MK|M*4U7gQ)hU|^PbntV~g;pw%-j0PQ4zd^L$RO*v zVx(cBq)Fj5)*>5v;`yWRs?VSK&2PX2oICzA+Nf`TMXIHz-BH>QUb&#-T!BmEFF8Mr zmtaV3*Qjhg^NDU>>6uStl;upU6UBxIxk5fsWTA)#ppzJ(P~#3Zk2QiqV}-QTE7H@u z&bgN1E7po&24JmY#UN97E3I|2xQPsg=>DQ`o!44B*luP6nw68ZRvVM~`HA4lK$Oyn zxXzzMDKECh39Y0n*x7^s7{$Y1{9d(w@GPei#RjGxz39m!F*p4p)<+MXc~8y({H+>& zxMc`wFUtZn8szM0X!odm^D;m45{I2sj?HCPB0)VvIkAE5AZ$ifFbWw#L={0|tbzJM zz6exe88tqPQpeAtYW~R{c8@A@tCd%=7*}Mm>p`k%>&5ZapvNZ3qv%=>DKB*KwICMO zE5F8C;TOf`Nw8^a!GrrZYu%*$N`(tL{|@B~tTpzAR1&k6ruSuij4t33j-y!@1!}kQ zXLTX@wa>81nGZ1emhVoZ6Qlzf;wqvzt|LhDGj4@{w}-*DbtvD*(|9ss1Cc(&L6VVM zPbgM(`-J(U8VPSH_oz04pu9C2wc|A#Op|a}0T+Fd6(TP`+Yp0Z?i^L#R;5w|im06Y z(p94R{Un1OM(Q1QnA9?5Cy+?+MJ9IgW#*Ig)@Zm6qF{nQ;<%jyb~EUss6gAmD9=t< zOed9gZzSIFMW&1CtS! zIPzD>_CgFv#V!&U$uraNONZF2u6DPwS6vMV9$l{7$8~Y!G({|ysGl~m1Xkb+ggt}6 zDG>X|RpG4=ATe-gvObE~SXm#X%c>ss^zR_h*yu`SwlYt?PFrD;wEwdAlPFo)#RmEF zBg*6AHS~1EBH?EQOsYeF36-|M!Z|53cLa^{=Z?xy#!_cf_)_W8*ma^(l@^MkGX@p0 z(!PHL`k1^&U;|6Rw&7l01g7X(SZabaQ`U;m8Eb8T#YIY))|$au#5FPd`;X`hn`?x9 z4K^1fN_Rup1+_c{Q#b^&jON^2+;h2m4%LiB9wd_s@Qi)%8C0{n%6U@@nC|C~w*t%D z!j51@lPEYvszQws{IQ2;2sk9#T#g(c~ww8>giW|6}H?fjt7aL-L`m&SVzn)zd(aF}5Gp7)s zkF{yJex$&;#Pq6Ko}g2#V#YG}emttP7M@uS#mwm(tCyqpe)L4rVWz_b>~`Qe|Cmo+ zis$nFQ@#AudbU_>)MbRX_KEKjZ$wt$9tYQ>27?~zPgOWoP^LVmEh?E9bi5|#-cs&Z zk2JGRoF(Q9-!)5oSJTZCYeHhunlb7$_9R7DI-wj{&z=Ugp_v2Wp8z!O5XC}wo-2Jr zc|~0bCtyMN^DgmS&2o>xr22`dmW){ckysHd+$cN;l{eL$$-9-*4)I-XUUF!nRD#%w zp;E-b({wVhd}367Cj9nnAbCO;MQtAm{R$|Nlhi6io^_Js_eUiEN#(>KyOON}ewFX7 zVLQ0r9g+N8PI27EuJk3?Jvpe^J+LKT39dP%3EdYrX==q<|WqVl@ zadX7(_zLSsBGZNZn2(ets)u)-VgTdCJROxSUuv~PPk?Gak;^?w;iy;`&U=+eD2qd* zyrt^s*qxlO^}}r^DCh}})9@fom_DHD*};fagUrLWjmj5|y}?E=P<}4m5wk{gA6P|Y z*~#{G)RT%DP^4RFoj1g1enl9W;91Rr`tp?`G8+()*G!s~R(h1RPT|=9%z_%^xWzxC zXmrjsYXl}ekI%^@v2{}=_Cz3p+fd>kR>P~~8a0+nDf;!5_Rk;$8@;+8Rsz2ZjFm-X z{`?z_+I0adW-GWxl{U`|-zHxGoJQ7&QYS`v#h%<4>R_EpHi82)Rw!-m#ku|HlF1rC zqt2JF6rs+{3phT>%au0whlj++*}o>iq)|twV{t&NP|8y{$h3>q^f9YZB$xbL+FvP~ zCfyUW+WG2K0CkHpiWSEG#C0k#6qVNSbz`KpCX6CF6?lO?xOq-^f&4Ju>x=4C+c9#z z^dzRqJ5|q(PjhlVR+e7Ko}s&wv4SoPn2&jq+kGUPA?GI?N$zxL`_G-wH6JT`XdSXh z|1fq_i(IMvl_gJJ?L2kgPn3t%m7qn%vEvPLUHC7eYZ6@Nxe_Fjx)QXgZtP5x9MH6A z1UKiUMW0Y!x{y5!5ii$e4fC= zVAJr{cIk?z@Ep2>X*U#ro`j(K;&aerT)ChJ0p*cV8Ol}xVT0le1bJiy10X;5o4Jq( zZ|xC(#oxS1d{5P~ktfeV$(TqIk4Q!2%*h^DQ^Q=RAiB*p{#UFLW0S>D5=7`>x2giY zOF6NE-2tKgQp`@YlOaYmF25mEBdAeQ-mm<;husD`kbb*>eKU-hgSy7Qp@U}k;9>q~ zh~2Jw)UnnA&eXZ0K4;rK)^P18*M*U%qq^jrb`M{G$4qg$qA~4Jss28q8gv$b3C&lHN{Cob72zHmyOQfw zcF$^MOnxrr`N$n)9Fh`o;~H}sVx3gYa3YmTOZ-_LzT~{uh_EHrsAh{mPZ&*DBcq*xD~Fp3tdHjXA6qG6`+xUvUk3ed<7jVSkU{TZ=w z^zHUQJnu!cF_W)IR9~`9!n^{Wm)I9O3Z=&rE-_L3PkgNpSc>#gx?pv z=Lt>BIzLn%Ro8)Z{_M<)SceCMW8hJvZ8Gj}IYzLlvz#JG7j+Seo?r=0V@^cvIZtZ~ zOz^bkb)LAKof?&M&b)^w@!p)t(plseqp_5TYRh+(-firprY*+`E2aNsw-E*+D@1)w zx+_-cIq9yLn?#%uKUdbPE76Ill!Izad14*S{)ky-g0wNn{JnBOU54}}Ep(T19gnR2 z$1A;~+_?=*(u9K{9-x&z3wKC8F?-YG^&}hoEV{g^JhY9SX4POdtf5OE%i?+y&}i}+ z`3j^rRm#R}DXKZQv1hc0^Ooc75etIuVIZZ@T9NZaOjsH;g&h;#x<>qTRDS5pqB*(^ zG0#O#h#^9biFb0Ua$-b{AaYN`Tjz-1VUNPJoOt`cqpKH|gI5(W+zvW~xE_hAIpTX~ z-w1Q_Wr95>0E(gOC(7~)q)?ob!jkusHgrSHZ-biUMB!+yXjR9K|J@HO(S>KYm~ z)H@TMMvmA}o?i>2aZ848MH+;OjHhQ$J}tNaokEf5Y5ASf--RY+t)sB7Ey~HuSf!j0 zyF!FE(wESNtI+>dR(G)jTzG}I(jukOg0Vo^yyU9FZ>eEmqDo&}Hm$ z<+S{%hLwMNMl`FYi`}d}eeKj32tOqT9Yd*g6=ip6zSvndjdXmhn-aZZ?GfOSbVruIbWVBN}4UMN$=1>(SAOEL&LHYLHkxMqRqu1TWX6pTyT{Uv;6FULNTI^vrUn?h= zq^^Z(666;eX-RbqAy3H#S7AGnOev{VQ~;EFCtDC%Qh8c`m$oEw}Q1Z)-^_Mvw@t)>hFZwU!Kag-U9L>g>w=$~k>Ql~!j)olcHR zitD6lHTn5NeM9-lNsWC&Zg+VSM$VUwAXAj;h1I%5WRao`kXq)ZR<$Apk23Mp;%?M( zVq6NZ*TPUU(KS);Km}VUc>r>1^H6$sRx>P~ii+MI)PE;iFY!+(KI1L2@MGz15yg{v zySo}g_37T`k%qdh1+vkg>ywimzHB+Acj*O{;|o`Rv+^&WQ$EpZgpcsCZ8;@}}pfCA3PZ zXLZn`nQrCcN1%ZXJ+wl>ic&|w0i;)&$^s@YzA&NxsHvb*NR`v`N=x(d&^22?`%@_| z-GW|4$#y}lj#g1gy|XDLnelHa#}Ro`DpqwdeJFt@-b3t5vCPiG!thsN@gI|RsXzFI z3$9!4*5o6s&?5^PCNq5is!zIIG(X%g!4Tjch3Q>v-FGi0i3$(LpXnwkOu z+IRpP52RY_UAGB?t+gVe)9YgB`R#|I}e19%EB{m{Q7kGmajw_u;x^Ss-dB(if~s2+*K6-VFk$^ zw4_N7dMwT)bf-hlVmhXna88F6ljx=(FOn@wXd{MlotvR3B^5^$|HmLb^pX0CGt5>^ zMc;`NW>U6rM%Q>#%_;K zjYsZnTznc@^`u!7OjhdZY)v+&sjZxOVV2tRfHxNh6OpE%bbp8z zphk-gUcIkn`*1DzVdn?mdW^B>y7LNKr>~n;%KQ&$T33WXU#zaCPc5Y5li3-$OfJ}2Ifu_OL;LGoAVw_mD7=ZoH_OQ zA^Sqh&)+0HeVy`vm^pp|6;m0(L=;RRw@GhdnW)X8@}3cDZGtLls=ca3-8HKI2Dc9! zEj@-Z_~(@mS<0jp+`)MG*m{eYDT+L~yz2Cb_O#uH0!g3$y}@IpM+de;)ut#PK2Pue zk+O{acKkEEANAXMR2Jz`C`PuSYVq zed7Iyv$mn~=m>t&$d-$X#QOz;U~lN6X7@GpYfk$vs=Vl#LMxMUygr1 z_TTuM+Ym7e=#FC@%o<>a0QH@6E81~WWkMQt=H3%RGaVV_LX=j2nxr0Tps{I6s`rXX z$~yyWr*56{4kiaod6wHX!Kh(#D*CLQKYJ(JIiS3wdq%mA`3ckLe-7I%XhAw-MfDA z!Vt)*{6l`58TAV=doC4S&HOgk-Vpk+p^S^HRv`g2mP{y&3!+3;3K|j;9EpzoD7@D? za8R{9F%3SbwG?l2N36$t0=Rrs0grLGF_rkrKdiTH+I)*~P`_eU`#R&(S|cUh#*J59 zzNKeyLDwD8Zc1!?mXaBkaRvPK|)vJgoe9Q2DVej0vm;@5L+SH}Mb65x+Rtjyd5bQzFAmUaQ`Y3rtk1 zqJ5KKM%Pa(%55-sGt)fByu>V9teI8}sln_xtAP=a28--uXy(cQAK6C{|D}wqq>*~g z^6I55>>_Sm@(EI0_IUv{pWH;#o0!eVSqZ56hzP=>kKS?ufz6=R4@32Z$fry?g0 zeNA;aCFqw|Qj(jC_JiiQ3~z33oYz~>H{?xDO;3lhke-}aO@;$?u7b;E#g51|^&-T~$eHhdYDLsu>pO;^NH~0|9Ey zOPv&QYp6()TwSUErAHq-bpNUAepV)5!^DG+z5G4pj~_pC=Y!9F&>~-{j6eU=rTY7B zy!pB0r7UjruB$d)_hV6h<0H)Ex#K$Kd2rW(L&kXJ#%niiQWR$TYr){*Q!gGJjMHt{ zzI@BucLH}M;5!5aA<6R4lX_RM+wbTK`TcH};Kd{v$t`tZ;1rDK1Q^Tl2?@qh7{sOV zE}?G-W~dom8{;$M=fp3G$4K7zcw=H>3GikyV)!5NDYuhVOlhVvA&Z0`D$1gR&3Q*k zv@zobW3pNg30(>+S)I?WH&i)eXPcAX3O<2dDe0&${(2AzNp5<{^VIRy=BAfBKD_2_QSl^P<8u8@8FLLX4YgW zTReeoG2Ry}_n<9L?F`ru)Vmv#?Qmje@DutFF!d{7%7k*Wf?#rzt_u^xFp3LfFTnK{ z0Y`)i(fFQK@lG4UCb9%x;wfPwH96mTzK2*2gW~JH{>4jw`oflnw$%RmJq)}Y|KE#W zxS>bF)V78#-&pg`t0Wa5E%`eWVaKe-6my$faAUfUTehMbFVfisa)9l;63$9`eU7vQ zy)z^UK^q~)~2{8c5YIh0zoh8saD6V`6ngR74~Mtc?y(u@thQQ&<(OwKP^&3yqDYu25rR zem*2aKE|S30@VSWcAC01C$J;{Kmq}`&Yg?!OtP*ONTlOW4qp^~{437Hu_v9R0TgHx z%6+x=6V8liX|p;t8fUsx_7$S24rPxR<4Kj!6pKNtijK5d3m4^I@WATw;_ju@1#?^S z+c(`XBYRd)Yl>$^_sp!@Z}isA?3)$h+H!!y+L;8c+ZZVe6 z-PBk&+*X7V@VsfWD`u|`!Z)+UEsb~COsj?qnuWU*OFy)`?@JV3-gX|2un>zhi1esOFZbkvN8)L%iJzRfIko4%SsRJ{Drz zl%2Na8O$O+iBow9C*neAc|BW$Q^|xDjk^*s6)7h!p5Z{E44z>kv|vUo&ZLWzjk1Kg zR`^#qp%Lu_*H5iwq@Ff#c|be(f|0PA*JcRN)V^G&4puo>Yvsxit5<%={=x2He+v4BoJ;X8QUA{XLi0*6x_Q?(puJZ9BiS zZqAK0`}>2J99p&V+dJE{v)87i^xyKMi!VKOW3SH#nlHtu;#;LZLFfC?x4_}U)J2~T zvjue~$P1H@0ii(#l-9nGfPsq~Y3rh~w?vJrBC$h&C+^t(^8VSgZ+iJs?emUx-@3S| z@#1f9)IO(oTy=EwmLpfTb?iE_dGnDg+og3it8N|&-Mp#>pF<-zui*8f%a~ohP5KPs zRba>odOAfo_Xs814458eP=hf1f}G1Oa3WZcIst2^4&l$psd748-k2 z*Q1}z^6d1E%f7RE`8O{L_A}Sk``3MEXIt}SM=vVwY^+PGy=>I6pQ=&zH z{!2+AxvMtngldEEK(J9mC}b@)Wl%9%Lwy+{L0nk=1~i0FhxTELx;_`q09*swk&58v zhMVed?>M}kklZ|Nf8FgJPlaD6EYG{CE`04;_R_rlwc^goYW#>JeAS_*s~fJbtR|$d z{ASbF8g8r%us&hbB^7AaN8hAq_~tP9qf-9o)k z-x(@Kus|<(D=Lz@LKR+LSIAqE??JQvY##)r$E?rJHYR(L12}E40F2;cu4H&OG^8BE zOp53nLINq9$lwC{5*B(j+8<<7pVBNlnMdf0U^VEekEp1V< zzG3_?@&fh?^?gn>6L*@-XeN$U0T@=GwGf~BzC?-7M5$6^`?Y|#_v+)DHXXaVS6U*s zZoGM5-fbI$GW*2^$9Hvf?K!$BbZ}$C^bH5e-{(4~A5@QrmxgGH&CnG>gHn+}DkZ`Y z#ux!fLc@5;LfR!_C#XghCo1SkVI@+SiJ}j7AfJ4|gkcsqcB*Ljz{+3#iJA9Y$sSP_ z%EGPtJ1^=l7A0lwZ`Q%X711MD5XbO#SmeS$u+*4tPse8MDR9j?LoC57dEuj2yqVrP z-X&hyD0#g?GR@gbwveUTTp0m~Ti{yvEY5Z>Yi1N8vt)rtK6_1VfEcf)$}8D?SzNe_ zW5cg_s>(`I_OHFaW?B8R4*#j=Sjq6~%I~s+!wu{ao4=`8`2t6;NHzz0m(*N88XjZc z{Y80SL)H}7+k)B7tSrEsmFST@T^L(va-=v?`i2~i%;W?M%bd{8RGk?yvN)6^GN?hJ zm$$M;yRQHO$yIcpg~C(DPl30}CXOj@Ja@|90WfRsU%Nl0q^!#G%CPcy!*DR0WxhUo zea({IfLShD#qyLdiktj4U|h~>=qvvP`!4D3G+-L@n4!y4xvo9{UA-HacR~|6oS4Yq zjH3{^(V}q~_?laW6I_kEBFL;fig!meqm(mp^2Pr;Ig;J6p?l`Wj%-;7Kl#BQ{`e=c zFZ{!`2bY$XEpNV7=R6lws#$ zesVlo#NygVHrn7qp^YxijIqqvY}{hJ%BVwkcw?3=3x_$&p`ttzt>bJMxqcN$gIB4z zS6Pzwj+S2&*w3Pto}hx02;<-#5<#BTV)l!pKf5>lkyyayzy5IeGwGQ}U)sHH%Vo;a z@afJSdv`oJ%;YN`#y!Y}*Dkm}z5K{JK9>2eW ze?P)GwhtUj7Pkxcqh)5R(PFXd?OimnQI8>zRwI~6Fj_HG8~aU8NQU4@PPV8sT_Qqy zlDObrBK7*<>_#3Ac3TVQ1>BbB^#v%Iz{$vG2iy1UxaQDf@ye+V)~v*dE0q`DeBuv3 zywAB}`b9fl>0lQR_9{0e+o{6q1(urg{f-8w%pu_C*oE98M7_jp{{`S~uF zzANMsJf7mDVz^<&)+9KJNs$X2)eR$6!dZ+1r+$g!fFLZjIOjIA+G0~{D-~!uSA#$U zJKB^>x!1JpC)=- zzPTj}7sjV}o$HV<(7L$3qNl0WGmutVQI|V=s4#bJR+_hEWV*MprreIW6QAoM=i;s^ z4gJc{MmRxoTJWDS%_zHQM5tAd@PR&AOoihc*&^Lh(bcr-mEcR*iewAX2O+;U&&Cf7 zOeFeF&Rw?WuKoLN-@Rt@MH^TC-|^9Vp7><>=B?}N`mVfk*0v3c{>c1?e*Tk(l%M}$ z(Hi2KLy&WKaybW;Nf3gIDE7$v7|TXMXR;urD5j4wnlbS3B13RddThD!F^?@Of2Yu* z_!0#b!$DbFS;7=uNYLb{Hw4WIhj%A`6LNOtM7+t4-eM*3@H%iPB^*lGfB-tQssYA> zA<2?pvA`v=#K*&Wh>w@zED|YJ&V>jcQE*WcxoXgYs811es}5>52fm}tp~F8p5W{k! zvTaz|whStZl`IoSl_y-vX;zhlY~uCGwV%d`+r!tz|C1qWL@k^R>WV^EPx7) zYSHE!I@Ur8*23xJR8>5M12kivprRaMIEvBnKuI>Q)HAHCF)X?}uP`g4rK?DsBRw8| zMY%G*KVds67;l7bq~53db$1Eq(k;{kjSQE7308DEKfzcqX-Jp2MYsyn^&~+sCZ0(! z@^)Q#7cNBT&1%%w?v?WL;4T=L-)o@2?~fVVWQr3-v?Q+k>C(>ywT zMoRdR4?mQou`n25{8KbOtHNv(3DnpZ^hgQg6jHK{hcMd!U&L9G%;uyxgA$4p(Kwc& z={uT`v!Hiqi+C04JtRv)W$btO}E*RA({I8 za-xw9sObs{2}dqL;L6!Z;j6dhL`PhB+5#A&FcA}WvL~F+{rsQX22l(96nZZ?l)tlS zx<2I+RjV6(GwCp zFnQC4K6luN?Ti(@gRy-p_HphwkScwMEZoLI zGYlRHLf8y`3fX(n&*Y-2U31~vyfi#((QR9=8d&hd$6qh)33!5)Z3Ds9^|}G&)84kr zlFy}P{@F&t%k?@oSNT-zX}t_5iD>>Z zr#X5+2jk<|cqmQ>cGekH5*p9M5mRCSMPw`5+2vpob*wOWVSsP|Ut0IzFAT2w~)NV``9?%XBI|+7IYvp2|>JySWFjTC-i_U({0gR zr8}SlS~08um%bdW?2MqY(>c&ePyvCsfyFEn-k&fU-*j$gmw@k`%HLQ6&aK?3{B4Hv zCvZFyrUROnI5fk^oD%}{D58>p^2_|J`>OBbvT#tu5`sDGDJ}VRN zJU*0_C7Mjch)0J^W1`AqqB4ocI4fz`z**wgC#3rj=+PP|=Fuf7X?hpgBDK`XQ@rzv zEALyrZ0-6dSFfyJSKhv<&|frr*52}d-;-nFYaJUledoIuT~a)d?kO)R+1Yvby!m#= zA3IfQir?h;Ya?pP5}h6#s5tcV*YIb^G?W>(7_KrLz)U}bQFjJLJgG-if~o!SBD@db zg#l|mC?C3$7Z)lUdwbdKJ)qDUr$W9W(SsXFG3kNGV5ku5u^z|%UdM>?c@ zpwsmvuHMZ4SKIMYtY{J{f+_D8GG7^$KvauOH7 znR9y&E2eFS+ce5Z-FV)LETl{s_e(+??n4bk8tXWs)1nTxK_WDbz;#S?K0<^VU>#c( zxgfS$SS~IC-0rHigD{G${KKn!B=^q$)%1q92O&S$Md2I83%7;Gu?5qux3W(obP|66 z2+Z)xlHLL77>afpbxGDM`>oSbq8qlh96#{Bd$YF}j&Z&2oWx*OS{ED%&2C<*Vv z_Kuf}JMjXI7U~-cgHGC;E)G-F2~~7web%z>#3AcrGz04F4)>Q+bM zPo<(XCH~7EX?+R@atP|&+Z(lN@QD&n=Mp|!{+B4I{8zi~>eOowKy z$da9ivQbR2in}rf?Gh3jW&?#YYcn$f-Ni*cwVB?!Zsmo}&f3b1zMPce#=O~!@@Ctu zfx6b&MLlb$H?8W*mzz_|+lvZ2%8}aJUR2axo_f4%i!VJ?8|iXr%SUzz?PbxJGFS}isKu4U)-^)tLrKl9mhih_bOYIUr6%S zO`B)T&|sPanBs&?M4nQa#R^DNGb&T3gGe{((lEphg^VrFoe5j#K5tQL}Jt<_F_3-vAZ?61`-u5HUOG3{&x? zy0@x+Be~`yZ??Akm+TAZ{WkHrPLe{K#T&$ZSStb1O$(R5GLESnuR9~EnmnSsVxpT? zOjyPl#h?fHAmTpdZ_5Am{OE-q={4nhtd9LsDgXQ*?3Y;Efirs&YbViNhea|;nAc!} zb*8h$$DP642}0u3!3Tas>Ja-PLB{_Pf7$pAW8xDHe;T;YY5#8VH*Cpw_F?-ab@gG; zGW?50ePV6+C;f{=c%!1wh#tr9qsK8iM+@tZV(6|D@)%QuoTfZ{J{C%eH>JP@5reiN zA;p@Km4dsol$5-T?CdnP+i^B#vE=1ht?&sjHo{7BgU4F=C(_j#{~<@6xDc8`Ro|*t zj>vt$29Je;u{e7;fuzWJ&wiTNV($x1tL~~S7c&;t76eOEzCS8XuP<9%n76z6zp6&2ndMSfkvH{Vfr%6B+ggY6)A8S`r{eu&-cz zNbn;)-0$_ebTnh?NJvK=p2c9|kOh|F^7Nm)5L9{lL(p&TVYKPf3Lw!8D>Ef&QD z?<4F?dPa*eV1S9!7QNCjK%9_`;-p<8G{}nbYqKrWs%KX4ZRWR3-R5zU8 zU>WDwC|gaGM7L@&4?9i59p0S7>FV^H^d!H!-JGNxhu4*t=k@B;eRx4PzaK-zIo({7 z>87S&pj|kp8Fr#wORE#Td^G`QlxB3(mh3`u2KxgDkXz7Rkv7u3pqybdOQu!LYxd=J zjMUZidD^5uChHf{^l&i?z%g3{csb#3ii<`m`RH-+CKZw=fiZNwh*h(WXn z&mXVPavG4cLt8LoX1g2z1rvgha^TEhRenM~|0ol%t_%CT_40PoTJ%U8OT6c9UlV&IThGh{Nex3rL%|sH`IyPkFtZprAElu6H_C~R}wsNq%U|~(e zLTAUW>bZ3uY5UwILkpTA<|J68fk17yckPzm-e5;-M{7#q^qkp?bovEDc?GjQInx?0 z&h1>;oCW?_1^(&Ly$Hzg^BMX5j>+y1+`M z9c3xszGRx%(3Z8jAuu>CGq-hE+B2)RCMUS4wscl)Mt1E?zw*-3eyK=#q&$$Mg0Ml1i9VCLM{#m?KUXON1^Fb08XKAyFK0rc|-Zxsd0zt3gsu6(@UDKdYr< z1hL7*^A;>$w6t>ha%~1IXXIZppdsuojK0bqN zOl%;-fI*O$%%(SF3K}PkzYsLyQXw-l)sjlb^7v4yLOW1@ZHXMmXwD7a!z6tYIcw3= zrC$DP2k9#|pdOWTYyjH08M^V8*g=c19Ya3L${d-QEsk6Oe+)OgCQ~iGIvz4v3d;-2 zi4@KuOJQbVSs{$E!l1*|Rals+OU-_s(Zn*)1a8lCIw?A$$VC27kt$aBRf4J=N#^nx zJGoctJtZYH)Y4U)n%97d0gxilpk$3h_#v8-J@EtlDf=a$s&q9isBuJ)3Wq9pMVeLSqVlE!RzNlvO>@5;<~ z6*uHq;DzYBtjT4?8B_znT3JPnGcV0*Feg&Ao=^!){REh55_TN7l$V<_Ye@YZ3)R%* z<`T6bJ#bZ#X#u7RHB^;nmY0Rpw+v@K586B7*lxNH0URKxG+%9_Z3UagQk}W!E@ipV~7rYTCq{Ooz*zmYnPn?+gEeELq%`BINKd zO!Y7cO+n1#jYct44LNWrOGQ_6zlorr<)kYBwR8sN+EgFtOXAYO$kmDFd!q~n4 zYH$B@-~TWJ7Dup6DhZ!qlJdDil@ByWMCt_B=Ll<$(EM-C@)?-SLZm$&f;;9ENOwLR z5-_0K>qYntbn^o2w6sK($J4NJrIkn+< z+?G%+3a3qyrUmOu9Io~&GpZZ~?d_sxW>x(>d-}qflh{Vj(pi=6wmjuIHs{-EDYbKz zm&C$gVNP>pO~W6R$N0Y3Nzs9QWeNR9+{vzFz8j1-cO{Sn$5~Erdt50g9*>diB%=LJIh_E?Lo=2 zsD9Bh@xe>Bnaw>m+rWGlI8l?I6g^YY*F1H^y#;2@j=X zP7zdCQvhosjd*)%C@~_4RU?Hsjzxqj*=uJ7IC?@GFbk|~WW|aljmz6}{GBVNPhZlO zliR*rzG>&C^8V@GOE+%0DEvjytaZ)pn|cfKdp5PVZ0O}Z`KCicz5(bmgwn$<(&WcN zu8hQZ8W4PRC|(iMRepfUrfCPR1n3Y%jU#^97h^#gn%W2JN7`}WOM0q3 z?(&YpIi2!D1qD58n%cI^DbARkoScKRSJe~-DQiB1phlA@5|4 z^eCbk^@mL~rS(Y2Byho(h_HqQ5e2-J@^yfasE(Za&d6M#Dz5ly0^%ItzL97#LnVy# zDB+v%4{BszvXS^=6}w;T;gZ)c3?5ArTq&xavyvi}H3YUE02Xe@1R%u1owz@?C5scwNc^LFL<3C8k6`L!PxoegXbM^I<(A zAACBJ9!@o!H+*+AWD{uEq;$j~%MkE@Lnc&`jB7?{go8o04^AD|Jv>Q|@44`<_k5V_tddNdI zBEA$?6BNpetXhRad08w%Az>__DrTfsU?xYn@MwlHp41!Efzjx*`*6D=1QSAn&+0?9 zj4#D*r|GswLiRMGAck?Kk)}vaR+YuEA+O>v;fz8kR7Uj!_%FuxRn12R2bKGvU`Jl4 zS__vGN{o*dRVSKqB-8CM(fgZUsv+bTlw+!fU~S4_t|3@s_^pVBV1uL~Xrk2rVTW-7 zBKbP#S_#wN=z2st%tL9=qw1_NLS!U5#oW{0>i)Vt`L1q+qY9OcO+iLoQyjP>+9CfG z`4H2C2??$=Cv0sw!6oUFXdI^q(-{&H6Qw8$_0*7F;~`QpJSU>cjq+4_4faKzvz8D+ zS!+D736822cTAtTboQJ@Gg{l4Ys#+NJTkoT%JQ0)pm?;Xp`mD2eb$znF1cvy#rwBq zV-^HSj0Z%o?iIl;R0}sAP04cR5s@(bD=#lAE3GVzgyykOS{Y)p^mD|Lcw9Eco8`?S zDmr-jU72@__bM+^iM(E`&RT?D938Tb=_>KXks%{_0k6fl0Wn?x|1z5WnS$O`8f6)m ze_Xgk#4f)*reYXBPiP^>8p@QLyrMUwZf%R2g{_2mOF_-)F6OP%$D_33F9?fES$GCe!`vzw~@#%Xcs1vS33QlF!L zNbw|P4-f|k>@Lv?4)6(eM^j=CrhIHhD zP=VRRd>3RbdpY|-gQ>DWm~c>mpjXr+$$~^W58h34W^i0Ob;Y< zu(1t<-a<(*gdQLS5(p$A2`PjSkXHZi%-+euCVBI|pZ^bYy4C1zcjlRyXP)|f+M8|R z=|v}QB+e^(Pv5q&u5#UR>#Gd`gUW+>>;;Eft#}17ZLQq0{Wiw#^%-MD9NJqP{fyI| z9>~NsHFO$b;HZchjZj4BBpyop+@p#{Tuq!tG=iCBc~#{syG(2Zx1e!3l#k`kr^(uy zW0JClY%Vre2IPUrjud`%tY>9g^YZRkEHyiBD=l;d>ZX@fEhsD*j&^iA;_YSg*LC}= zI-PFB&@U|Gw?z+t;!C*iiIrs zd6vmV7cDgn@xKmtt?Kl2I$BpwEwToR9kX0z1@=he)Tpbsw`#C4*zGB)^A{I-%KK{l z!oj-Lvy$I@Q`EPvv$Vgf(dljJ?29)I)_KV0_8BG9*EUzrZt$0fq>IBXY|ZMSgH3}Z z5aFhw4w=%GFRDGBkXmiFQH=`4ux&PFex6HIAwEJlsDdy=hq@o3b{G{E%_+x$X2L`> zs-m+>iWpcdhG1FhvzV}5JDpG;m{Ee-d3nDlRuHxi9iH*e70#eliAWl&rnteg;I`?n zo^6SG^e(lV>@`N)5^qSCpx8lWSWvX{VnyQ%BqCid{i?WJ)vQn=QfqL$jeD4%g4EAf zkPm++T9%KukrT*PUZp%a+cG?!M8?z_eCCmCiw2+hCu;#H5c}2&X(}J$j~7&`CuxhE zcTclqvU&FksU2txYw-7{I0gPrtCVK{jAsr@oA_?B4S#+0d%xX3iTL}o?C{CZ&nh&s0EVOdNi05d=`0zKf+o z7ZNq^P_9wM4>d08h$)t8>M}b922Prt)GSpLG|y`g|5ngAy|{MOKt;vCs@me|jRkZM zz`x5qthk10p@|3cQUYAbC_#>mpfiqPDF~?Jb)+adbHcNo?m-=*$tBSR9I)p=AGJa+ zt?5uy`=Ho)oVLK&QoeNTP5Pu^@&extS=$0W*}dONcNPRr&I&i4)h{0(kb?~_S!6@p zIQ5Mmbw02?MUMk|F65X@G=^%Z^oYxCAjq9|neBInrz~!2njY*pb<>pL7JrYcti2>L zrP%78-!OZr@JR3R{lx+ADEZ4-S0rXGt1g?-5Q;R-D84ydeiG&D?J&bXt#|~gIFRxX zZh+V?8Go2EIVk2bgd#u*WN^4a{^RQv+}NJA{L^&2h>%v^h&awtu9iDF)vgcLhPfaD z`GUbRTUop}qf9|91=dO}B5Rd-#@awFq@dc`SYE6W5FMtl-V(AKEnXVkN%KbXCIvuJ zn|jWM2};OeZ*(itV)f9EWjlwgz_Tb2X2@h^MZ>c5jdEQ0n}9(8gFN#r+EI*|>Ypm% zjwMU)y7$(bpMBxvxX;x+a`IG!N7D%Hi__^LqiyHmCs(cj4jWZcoJaB_k;IuZC(7rOf&WL<;&Wz`e@ZLJ4(Uwt zz}Vkb-??o{->%0tZQW3JLVM0KYjNTTTXuY^4S$D z3Id(m@1{PSS|xS!$zZ>d7GMWba4Gf}P97Rq-vR#=>tk+jcgO&V%R z?MRwa#8pJZaZ>d>)Dk#epd!fcrsuKcnYB;Ok)mR`v#yH%gb_4`SYu489dch3z67`r z*-y9_EbzM20dB?#3o5~jeT#dv z+No;{A=^D)4inWaw-CdNr|9>L?l|r6fLLx>fA`0{{o75hB9r(Qg1)d4jvN1-=u$ku zCAo#EM2V_MmB|zp>1?*}!i>%9)gh@Q!4Icl-NZo*Yq)M6+z2%{Go;SCdU%&ouOb8d>LusQi6|7(im{K#DPz|NmOe7C zZrScRV-JYjUC$P@&a1w(nV7yLi09u0o*qS<{<-k$=flnshTK`h?N5z_oS950RBdy6 zQq`!OYPR5I=BjnY8Je7+Ma62hHv^GOG$6z%lM&5AwMW5wu{=UfwYR{b2^0s0ks_)s zP6*yevEEo5DCWJz-eN&72o{_PK12@C_ifOn^Cvsm*h)HN4^~V(;#mi z`+~l3De3s$KmF-X!9XrTpe$oH^@2TQ}soGXa#S%IEZE z>ZkTXVXL=?^4+G8X<>#7)#G1Yc|MXoGMT)oL zw2qyj*ju}F_naALt>`j}1@}sIing)6WplRm?cV#%pEo)pZo{lu-tyv@(_Pinlc-$) z1<|v#Fz6_*FYqUdV-82Wp}(Ozoq}ISMRU>=?_dt->W*Q3S0Pul1LzT*wQc2s!Rd3m zoob!V;1sMvJQmIe4;W6TTsD)gsVV?q6V-6KC=&Fln~l2Kay5mJ;B{)9S~Lpcch@np zwB>c2UA}B3=dM{A0Brd5pIlu$6czv_B4EA7@IsJG2r)8v30SiTK@JsG)nVDj!V0_- ztXLcwVMX>`2qUz!Di#%2u02kAam(6Ge|)#*wo6YuZWHM`bzl>z+OT%(U60lLRT>*T z_n|rfKX(vI)t#j2?xghBu`kTXnRS(2%HNH0+oCOg-rq#t5kD(tJ!WlZ*Y_Y6_n-bW z_O}Je!VS+pyFB4t_bUHpY5I|ep||kd8Z7g}$bhC+(!o@Dz=V81|kTu~_Hc5Y_v2X~rq;c6;saTaEGh$Y; zDyj7d%3H|1hMdzlSmR#R-XQ&!2qeFueU%$_OGI~m9ck{5kNt+%w@)2i&3`?%y0=r% zjs7Oy-yGq;rh79ZeIqUgLZg7N-xBVM)PUXY*Xbg?8D8fXJ#Gii1cyVkB5m4gW$9Rg z=(Fd;m4X~%yB(5|!i=0HWKVO5H47SHz%!b7g3Oq_R337xW%-cWX6YDnCKO;~LM3Ob zg0eSU$i|f1Ps;1i$Ye$wm0(-3nlLqs;fUmL7=ju#K)Pa#O`tYiIaH~(M)*CgbiF~W zd~W;WUl7I5KV2$H`$_-Mu3bZiuD#{;$FIEqDe0TR2Oe2+JhA=#Yf|+%*)sUjOM~Ag z`Hg#C_~$R){OsN9aW3L45Y5;tPQ=g^JFFJH#cj7Mof>^6qfx5WN~I!`Q949$DKK|^ zUY?m+RKbf_cyX3*Pv`_-Jh;YiF~Zp2DW6}<-=|WIb@Go5^1H`Q#9z)BJ8^KV6a6g41g>ZO>`H}AIvs-1R8GLA zYVtA}o5i5vFij(A9oz+Co?XbJ#|;!>daSV1gOQz{FxZUPkRUXLPq0%6g|JysQ&@u+ zCA6J1!!aS}g2!iO`{FlNMaN;@UC1qzZD)bt|qL!;5^ha3RjqI%${sTjeH1 z0!P4UW^`I+|k+4)VoL*|lbPlI8md0wwaJm`;!m3KJ?L(IraJn!) zNEzVoFau==>N!kZmWQEtpc1Jpgy5~xjH$3vQG?le;JR024L-Tx7u6AOHPd2&c!YYu z^gKYF5)%j9R)x(VvOm$Kc_bjiS!=1o{{{h(M6p%@cHTPh0Ob7mg@1UGQKvIf?%H`` zu(_#0@uj`2Gf_2A=W~^%idyH^I9Hh}W*$GgaY=Vk$?R>@qrFWf>g$(|t*+WJ5ScN! zuyXUEi&nM=BU`=OXVRt*isFoEKZkn<2 z(A8(PYBb8On;&>?P1g-WO0A;pq?W6Hb9EnySwa=QU}b@Mk2@Z;#9~t$!=+OfS61}b z2kK`p_SbD$)D-Sm+SYwaraHg8IW+c1ao10!H;?m_g>0Q$uDSERej<{vvwHjG_q1l7 z`tgrWo9c*G zGSBq9Od&gAa6pM!%)6z*L}%CpBS0<`nprCm6pT4Q^Z}iUa$({mmm^T9qLMqsVUw<- z_DvWqFnyRZ0dKs;UL3SJW3>TG(4n^m<5Hw)L*s0v!DvugN}Qrbrx8P~6<&XRf3mDS z?lAj{9BQY!bXHqo-SUg(i2`4g=}Y>OQ^LkjK~Rr;x0O0y(63YMbCma0*KXW=LUYHi z?Q3HQKel}{aQf$`Nk6wFtCHr1y@M*7!>&%9cIv6E&C7bCp_chI;q~X=IM-NYntAKp z2N$PrJh58^yS}!2&91)8t=C;Oz3PPH*Ok<7t|4>$eKThSz{qHhG&I}2kN^t7;gj5< zRLUQA^4@@VVa81oMFDe+inV$Aa3%w|DDaWIq%43Hc%TQ5q+?EV1rK1ek#yLvPeKGU zBhn!i238)YCkVyV^>Rs5lGh7neKM&x3zj@fbR=z&84lfvvYJboKT^o3P|JQm#AWYU zPRV#am2Bm+fN?0<114Jx>^SX}OjZNqqyjG7K2AsiNK--*P^>xz9$HK6p=elu4WTY% z7uP-SPoDYtE6Z-ceD z3&jiGU-0Rws_6@gN_*S3SC_tDM|NFs!Pvqfr*{vf<@JzcH$yknL6$8>F7J-iOdIq= z3M~MZ%iH)`e{D3Asr8p6sWC%yRYd++}e)xWBL`OEj; zm0py-c<#AppCwjefA+bbJjeG+w+KJE{)(oJ^J{poR92LlQyQP!QT**$zjzPdsr|*f z@4hP?mR^4MUB%Alo|FEBZ$JCobHqd}KY5Ny8KB$OkTR&9e-2``I$V$|T&`vTDf)uY z+}zfaX>OiooCdjLnz6DsW8_4SLktubcTq^+KtDx9c5^mBmDx<1IzYBKc&ctPT2a~Q z2+`IG;3S)!@RMT3+QY|!Y|}HCX_^e|p@3@UxnluF%$leZs8AEM#h--t#i3)d zwZ-}st4~?7cWpz*Nq4OLO!`IU+JRlm>nk&-PMf!DQ5COP!q+U?Iinu{9*KFU^es4l zr24@JkA~D9o3gp3wfoE;Z`t|AHG{$_%iB)6XZ_kAZf>eydd9R5&VA~Zsb?*1=sDxy z`jNfIHMOn1P?q0{m0!c27eg+_0JkyK*4z(T3e1LwoIy%nU1w*gH`A#DU3CtlcPh~G zIMHPl%_=hpYBojN2GUWL3S?FB`CJ>bq#q$Di&>f^k;>$xyOa@>3Niq~%bkACDk_$J zhn~lvmRn&EIuc_Fjf)ZVcxim(hD|L!r`@~qlcgYVj+|4r-MRX+!{zf%>z}!6Swk|t zy)UzSQN`m+Zs&l@(a6`U5t`=*R75{2f zJ`d!~5AoT<$_hRT=>`EAs*mrcxzz1w{fMzwR3t!1DBV2|f!x12Z0+fYhj0OC2Xn{=u0Vjc#;zbaiZzUE+_$1FzdCbr z=UKyBPNv$ev20G~tmFL6iTS5YH(S&uU%nFo{O!JGr?a8BtgF7UXd8N~khpfCP z>!)VO!*v)a-TK*qMyV}2i=gmo#ndS+5noHkw0QAMzpuM?)cY9bkf6$HoEyT?K1Srfgt~})=uq_j!v*~=)sN~{Y=8?3E zY7^96D94V2=&fc($u!ByRf}sU2RRp!gJ+h{~!? z9tZAl$M{Q-TVk+M45yMVO<_DpgvI*7Wt&sF7G&-N&x0^HeHzO)*2P_3Qfj*3|-@Rb5N32&u`#e>Ktv zsj|{ks&7Ww*8SS5neRxu2o5kQp0hE%iP=Ziy7>B%U8IvxxH zZZ#<8J9Kg)Jrs9%zI@mjK7|5~9b}6+fP>|5=z!;;%YocMc%vkxkPg%m36TyuElp*W zb#+;zq+5s3gBC`}i6{ulIUrTT(q^AXRWZxwDqxk)KD%k-Eh|pGe{<~=9C=MkXLooJ zR6u@MvGCk^!)MJYbal;N)i7t*aJBT-$jBi7=aZj2yLJTqa#4z4!QiduEV1q>xmQ4V`Oh zq=f)ben#5bi#>E4o(oA4+?}2UD(-#0dh9UTv;EXb< zKQ;ULJ4PQyHtiQU`e+r6TC~sSev(@6^Y;L3#!icAxb3OAFm3c?Vlz8ucJ^du&eUk~ zP)`HsS&aa_ZEWN!lRcTr+7wp{zlFmz4Iny|UbVJshB&RpCDZ{NBvCgF|4M7^r4W8f zO$7sh#WMwBHlGnyCa7ph?eY`yCDSgc1sS>vwH+`I8096@9uMaxvs>YJ%BAIB=zgG= z_&ee+*x$jv&GK=HX`)_Dr3x1;wg$+RIcG7xRy( zYHJmD^vrKqv3Mvk)O^~Om4(52*HGFpGcP@7!WrV~nZLA}476HitLOB5J(QxZljila zD%#d8nm>BUNpG)}MjMvTNGjd6h-^?B9R{h9d~EgGw4#8BZCf)ow`@*mz+DZ(dITN?}~@2$-IiWC-sVeKjG=@i3^!j+QeOy>hl7| z$?LVb;8=FqQVFXKP>i;wNKdAzNx{W1M?lF3e3rrv@I82$^DB%_A+H_~LWTZBeSOFp zDgn~7$!k0rT0wh-H}wN#GxVWOx2PZv@*)=_qUtxm%i%QGQS~DJNKgQ zWLHCVFwdgqPn)$VA7!5|BxNNfMTCsK!WV?s&O5;}0CrCxP#{F?5db$Cjgcn6*s{1$i&KMtiT?o zIouPN5X=RNPyi}jBEpQ{mx${fdCfx$Z@F@5&D6dcCQQz6TsgJ5rfGP|1yr0|(b^g- zI@@3C3|I1}b}V#gEP1UfP8sO$-dOJT$bw^G@vgoROZSq~X3T)-SW`1+YI%91!J}7n zwo&?iHU39_g`yaAoS&uFVM<46^D;75l%vR8;85H!=t%4N1n7J)yzM!u5~b42j!usT z>385oT8F`A2vbZ!!DfSi>2le;0)>FjN#2w?6nUJz<-Aht7^Q3h2fB%ZXF}A*zNa2f zi`~Y7a8OmPGz}ytg4{MrG*{g4gG+%pc=Feee<4Y4{AMMV;6s<+`O4$h{qQ;RM-n2s znIjn~b>8FqWfSiBc^U`at|NiakupTZZUkMSMFj}tu00qrpv17o^U|}^f zbOv%CC|HIY=R|@Tv#HoI5y?vJ4U?cUJ{kK%D#bfeJv{));t8Wn}9d76c*K}M5B43>x$jb`y!v-%9IdE|@u)TQ;8t5J#C z3tO?Ooa28~x?uT`R~vF2`4PIh)JpC=yc5JwaS9h^<@>Zwh3nfBPZBRz?EPk?VlP(i zxA?+8fz1_FY-B6+-SH>JkncYJ&G?t(E6_WiYflv@@;o>TEf%FG#e0A$WCy}Oz`Jq4 zD{#^yc^v+x3GWM=Unqhe)5|o5l{(}F>N;j_V`dMZQ1WVOly?n%^_91%)a(fw9C35~ zK$VO9VURo{wGMt=-x1L&6a#8yVaMXeuP~YrxY!NYH6CclW!zb*X$F0%9>D&gu!8Ly zJ`OBSw;MS(@Rfx)SAKzsbuzA3hhGD;*ei7`B*fH)QfYbHz}L1hX01lCzNUS@&{n_JID^A;? z-+0<9pKcI`9$#|f4NK>0$ENVBGFKf~IxO%{DH#dg*t~t$&bJ2Nz3|3Y$F>MhOHXb% zck99Wy?pcLlTNtqUb-hZ$Ui2`kqx;oi&IrRfrSf4p2cJKX>d9kbQ&|%b+cYz*nS*^ z>O$a^UaztOiWapGR9RL`-53}$8?EeGq9doAguOBF6zcP5IXtK+$7U0O05l-42Ac(w zDx9%r4+Xf~vu6=szew6eF)qhmL@X8GI@m~oE*sgTl4nMnDAZ**OhGT{7ziR`ekMp< z0sO}sQjLPvYc(5e#V9|JSFA4amcZfZj+jL z>;J?arvqXwlN?hM1Cq5Kw$D`xL{S5%k(qtv>4Pt=26I{`WT()PA?GCKc9es|g+C&@ z{(iuF_L+(uXMg(P&eO=wGmWbk>Q^0jWc4ET=s#7$U4#9e-i4dnvBXvl44(Vx;KvtT zcFCTP=WaRBHD=tgedA9arS_ZKq^l-NwCaWYrwl1CgZ8Q;60LfX0Op6!Yox0tOSI}m z++*3#2NWk^M?|@4*u63JBJmdNXO((HX#I98P=&O@##+)=O9F_u;$SgYRFi$Wa6Nkp z3QmG=EaHDc?>7F1bQKw5?fr5)cMf|BdaE2^(!+q zFVAOYX!gVmG z2$vPOgdi0Q^T92X+;OP}o1qB*RLLY122;{#wYpV6@KzaYHuTsJ*hzrs`OT%JC=FvQ zMRrrERR)9wo1q$87UM4~!7>LFRTRK8kAxX8*%pT%l~uE*=^RvQ&NT?*MRv?giK`Lr zKCtH67|26@ zU=qf|0YoPp1@XWJ4#vqeB6+ajr;s)O9m0d19*eRe@&AVKz?Y^c0X)Ezglx)pFb+SL zJir-LazdXa<>VXQMf##ed%S$K?Rv|Ud;fQJ}m=3Z~ z!-xQ6}#41B&VrbC%sqLIDvS?v$gtC=gP7a3RgyA!cP`NBDS(WH?y4nNQaK5Qj zI)q%(=GM-ssj_J`KDWics9{>);I#5NK7~qX6-;>raiJ*eGaD6JtHI?wxqU-_nSW*} z!X2whXFH>nt%=%Zi&Y;s`D(1e)r>Od@d?FK@Mu4&^V?4{CDtR|#SmHM?>Wc=ew zYt_@lVm_6ZHpcXNS1d*|^bVzClFv06%L^gj*l-iWW_yes-?BR%9O^*^BRKD7D9(H|1Xx=!!3Q*5u#fy=1{aIJK~$c~M)iuw#*k zypg$;Yfe06&Bv+yaGk5awkyBRXN-CJYr2-av#f31j5tzH+S}L9h*PeT!$4>Q%BZ#? zZZfsSgTXcr62CA;k4LShSw={)sW2gyi4GTd5h$9KFaZR?L_rWtrf6d$-D(HZjZ)Mn zC!Ouww>L7HK@-Vr+B3XrLg+^D04VxZ@=I=B-m9W(@(tp{e&hXE+N5hr6LR9fO? zW!8l=hlh+lodh&~35_xob!~yU|UYjLQ9!hPQINca0^BqOwTQ_ zv%oFbUEsvW79hSte<+f^_~Ooy5m&rX@l$=D>y-YKWGA1e=9G1oJ87>J2 z*iUn5(JQS=h2&A%t2|Yn3cWJ3d<~kTY0#v!hF%y1bu>c}DpoE@2+m?^r2F390qlky zWm%z_Nzn$r_dA^<7s;I?pG$VRb2!Da$PvhsyPut2!{iF&-O|1`@3+%@Qh;?CkhQ`x z*idUkZ%J7w(!jyAMWTRkGe#ZL1xD*w;o3zobkv;zKWAr77Y>@4%+in6j_00Ng4&7 zmZGAnf6AQUEV>KR7Mf0D8Pxz(lJyK0XUwUvp8_AWO~mTS&@{5TA?qFVP+=1Z)e2$8 z0&}3Sm;~jDdGk8v%?oGKZ?LK~^?&$7JuqNz%%$OAUXi0rbmB9}b&nk|pu!=#^Z-ze z1A?RZq?k9^>V(HpA|UdSCW|ob^cPd=J9QSD8kQJ?k3X+}3b{*~>j{|Q$7oRj z$5o~So}oqUSq)0+Dp7BXDCxu;LitC;y2u+D*b@hcLX?*>g^6U+1N)iX%2Y9?-VH0& zkD*!NWxr$I7xU(QA?}ts>+8v5_4SjUXXUo-H?oW(BTQ}@lUl8@DwTplgGYeR=ro+s zO!>?MX$mz9eu{t)111Fv!(dPYj9ECKK(I6W1Ovilb`iRMnOKt(Ww4l;nk)B?8R4vS zGUzKCDkFCk{hWvY(Afv-U$4ji51_lSwLeI1CTp|nq>9^pFr4RMsfAc6Rf5qN55%+C zwef%_ToJ6muH#bxHUvCOTLnVdD=LayL7IqnC>;zUSAuo82-s9YN~=WmQ#n=Fa)=-FaI4(E>m|6{WTd>02} zT4RCD9uKVRbd;Aw4b`*5d8ja+U(@a=Oy(P67DWw^vhqDZCmFrBCZX1Z{5}u=(b%0j zug|L;C~2~Kl7-Gxy}u%4$)m=T734b7hKx7F_wF}hgMj-O)jGOT4y1LI>&Xr}Sf$W4 zX0?-jSI(I@84QYxn?l$%e)U9IFj?oYU@9cUO7WEE=y*(G*6 z76UHrI`VBE1zP|#w+x2DP&w9_*d$)h%V$hp%+qKg4=n(CuhrH(P%Wb;zTMzvw06?5>A-=arIEf=5yLS9>xdr z(jHIHj^ZN16NH1F7X%MPEl3PIU1-b8v*F2bAWudqp@CskgwO6ota9pm0rnT#8E6T0 z)FNV!g-FwblwBc_403G_b;U;Isw~=&AU3u&l-Zpf41uMq%hO+3KilS;U;pEq3_g?9 zn^##X{APG2a9Co%VHuEdSf1hIeMJ?G74?-LOILp;D%#cJY#8Ig#mFtd6L97N0rl|x7Gx-A*4RfsCOzn@wXQYE8Gd!;Rjwrj|m$QN3LgikvCXQ|X(3h`5Uzrj!Q6wKhI``I~%{YH_+ zu}3&TE#f#59#GNamRjDakA+f?ZE@yuCFbQ*NM&cE^diG%m_ZJVy-gmGx}oJW9klFvw{%KAAKckOubR$ww|* ziRcAo(nmI)yx%55zGSV@8e(FtfSnhD^}XjP_?@$*oq{jfRXT6!gR@s@$WHYV{=B0> zc!;vJx5l@cEMBp2@lu>ikgIOwZ-H*2fpie(cI@{B*{FOzi$WfsLSeB`>HR_2yR|6a z#)j(B7P60N4N4zX)##z*Phr&x2jD=YJo{j}#6m%14l^;()#jmKR$0Y`4Rd0zVeCxU zq4NNN!)Zp)H;_hvhe%l6C3qkp0>~x;mHk|A&9rg~@k8ETxqRtr>F=rK-G#C4<*gm9 z%X^}QT`N+;kC4q_6!YixB!Ra9X;n5k7Y03m>;#y7-MDsS8tmq!?vY;IYs zv0+{rAD8(G^H^h)C}cfhHOA=Z>_H`+h>d2kUktyFI_I+bS?q|=#RA?_rdTYZ-%{0F z4182yvLo8lFtxd&S>-G)h&P%;o@94vG^9s9y*6w%2lS=Qg(g91aG3HI1-6%<7JQiI*J(sF>f0K1oD*~5dka#r-A6s7#UG?XTgE;2PT98m9w;v;s!xm z2mKj;+s|XVry#`De9a$Rk*=f+goN0 z)^tVf(!XYxRsJhK^$GqA7<&PHGkF%HP#^~E0lLZ{kp;|lt;|HV9%}Y@ zFzt~H79$mc9|X8JjI3FZOt{zNA<2;<@*oI1~>4_+;n{c7?y!19LVS>peJTYB~deutZq_9M_4m;sfYo(=I?S(C0^-+%KkdPw{D;sB%oMRRpQIA_q87~82ovD zxd;9{+47g?l@(sEWRcYa4)jAup37}kdC@b*i#bL&CTt=y*0g-eV77-l_afNST~-_@ zG=`k9`a(-VYEjdB;*)?v3b&a^q0 z4=ClMmPW6^C_}YZAMrk$A(BZ=P^-tmxIKA6a1_h^v zUlQ?uLY_jEMQa9{*8x;apo>2%I@86S(;g99#w4=c5h`vNkLPo#}X`d)HeGg*03%>UP{5QPPMmdiG=Y6xh03Z!JxuM`2|G|vjIEO z<}=WEV>Uz%tdyFRa}au*#!rU|sbsuo$>3wWhK;!^xUtET=+dWPIDoUR0%cVk^91&7U4w|nWVQXFkA5^Zy1 zsdi(}&QTo3GV)-~)*lEl-i_(;1cBI&KW^4DJb{L{3(K6tvoW zHigHwtGe13 zxA>$6;;-&5F7B@Kk;f{gB|U_kNi6YRG5N~-Z@jqt#tn^)>#o@`_q18Dk~yc&BBxf* zKfbMH%lsNxHd+x?`;6iZjMWISzc%GXcB~+p9HK^rQ=K~5_vmlZi+Z<}=dB#}hKVBB z;3vgVk(0_05us2OPA-5r`Fbtk%O#0q3f%4j`jY;ZyHdRIS>`Gf`EH-e zQ!eZsUUZl=C^Tn8-I_hBn_#H35=c5#hu>UODfh)p&8S!iidZ4)V8{kGEQiV0*Px6y z;iWfoJs^hMmEsokr77Eo-4lHwrLM^slK3i(xD z0a4uyNC}3?!yi;aR6dNjFQnKZ22t(?)w*$NP=SQLJ5^cLfX3cX`>q^Aty*qvh(zKB ztK9`?5sTeobmnVGeoc`Z*A~0k<#U;hMwhs&BpOA)hgN4*t8_-E*<`nvv|1x_&Gn+r zZZg`;My^*V~a_+?DhywwsEhp8TTnqI}>qB#XVZeFJXTcrTZx zkQ&96d$6bWjbi7M*mdR-x9RU!?$oBphVI8Ai@s_PXaeQo)CVo9KgvCgSY0?RJYOYC@W8R zRfxOG9UOBA@xPq#T zs(Ow}zGAj@#nsCzr=I`J$>!PS>o=#)npH>EEPQ^GT{<;9ecRyrWj7qxKpyJ4v_bkZ zp>@3WYwL#lKELD+qI+zm@c0vXQ%*?KsKzcByQ8s^e|E>K*RQaP?<*Gl@V8@%aE!b? z_G?0Q#e77Z{t0nZPFxit4=QChnXE>yPOT7~8idii5IpTtSse)cR;iRD!1%>WYXruP zQL9C2qgSgpY6DtcrB!M5f=ClED%^*B*g*52*ZA%@+tm-E-Z68L{SW^C`Lj9 z(kOy~Jw!7TtpunWR%EWL@b_p`T>Qw`6OSDCdF$Ap@Ft1;;QQpy&PI>)7AY>M#0j(nwL@<}YB5Yu-cc!PyhfKxqiJ2335PXJ$W$Fk*BdJVtU8iTxQwoV3kiruTqt6( z5HdVPMaM{5F)90yMSDW+mql6mCmS) zPcd+pBN7}dD+hAme~?J#8&n1ncDj1zE=i_u*xF&U&AztugkE>KLn`3s#uFv8PMp4H zM{0L!=?%vFFwhj7t5+NEq;`9@O#P(DnGONn;CM3a% z9tP(U7ExIb1&@9XsG-?-?u2QGYmSfjoC+_Nv&X>Z>(w&se9 zHs5?hqC@fUpzU#aTBRo(@DPh9I&~ThoqlN@87j6U%`hlo_6kaezibr z4yw2a5ORsg(L;q-DHKLj4&;&LkvNPa?(ia-qeD;PY^FcIdh9(uN?+u**B8G2Tf89U zjL(#=;@;t?R%kv1=vW;P$8a>_czhYD63kVdb(+0%>&fkL1bjUG>sxQPF7`?99{Kj3 z|Nh&1?w7xP`;l+g{P*9knJa&L2K{z1dj0_X{j}#ukw)RMBR$WBa^M85so9>5R;igG z$EVDtkvS=Hu5dnoCaAb%eA@Va?6y|%Hoj5(8kF^w z85M6E9K;`KwIK2yG!Fw;nsRbl6lzlvgIcLoae_$nMnLKz<{R^{NX}!&gkWD`PORaW zN)@&WRZeGJT@~>kn!7uH%j`!V>OaM9-#H-sNczi%iG9ef^*mP)%w<>n2q5-RlECQ{ z6Kj#3{3(qiA~pCunF=AQZpnYE-^vzrT0K|L)!$~|+};Etxr zzrFW=)o;4)a`b*t=1Gj+^2+PUQg>P>s5`B5GIi<7%g))6d(@4;_V4b|@!#H~WBmDl zbC2@&|MniB)4#jNzwHO*N<>wV+lPGj_%q}@#MzFFzrei?rm|;z?fB2R<5N>b;fo?* zp%7ycDI#Ck$R68GHh!aRr;Sh8h|xxD{1GXlQwt1n-91XZrdJ>|_H3nZjLt{*tp`~g|9|(*?)+}w_WgH#%kr0KeAN0@e{J-@tyN4+K*goXD zxi93on`O$mNuVrPN}GKLX4fcQlpd9sge>?3V`{e66(FVV*v`$!)| z+GOAKLXqp6KBcLU$DY`Ca7xqvrElHbYm@uNy$AZ;#bMojw{I2XLrOZr2-iQ_Xei@$L<}w?v9z)9@6{&qJN3x|D}J>Ob$xP zyg#beAkxjjp~gUHnMz?cDs7 z$!4~u^aiV81NHQx??9b8gfMI~TyNulNm+1dF_CMyt zhePBrt#LSMYzh=d2i_fW=8qYVvIIC3U2uCGGmzg6Do)-zblSJv;CFf)=BA`VdaK_G zdb(6>kI{9eg|87tuTmJc%D}MC+Y3r}N?!q(Q{7@P}gvDfvS0GEc z+2xA+EE^C(V=Rcqqq+^5INmS{y9YE5hJ#`HmI$^5hl66CP+q(xZ4Z{02kk<3XfpU7 zN5e&E4AZ1lMFaa-f-v)Fe0QjY)Daqy%Vy<9iUgCKjXP#{R8>a4XNC@5MVv3(wd)60 z?7Hx>m!4X>;pe}8?%qppyZq)?iFh;tZn^wvqu5Wv*E~G1bn)e9TzTu@Z8z=NzhupH zq;h?C*Z6_oS>gg(mJ{pF>9krM8!~3AnJz$w)oI1nG2{af+z$NC?~K}V1Qj5=k=RIO zbJXA(33-B>-Z~&hQ{6@U!e}dF+;jI`WuxoQso zMx?T0)_3MJ!p%yR1nhQ9r`6-ZRMOI{7=#T&FuL$E+6oGMThg`yTfyXoDMw|pIN$6z zsFhE4+DzU%m^4I3QFur*MP{b%95zw4$4*qiA3iQy&litvKRHA8Jiq_E-5am_?CYav z=$RKjR1;}%Y@SZ~!7a~BUt9alcW0)6E62=~B6R>`F_-#EH)Nu|s1GCZ*fAQcOmom^ z^aO)gl%Aj`c-~c=sg_JbLsnKYV=bYtl(BO)d>ft%F_k&Ju}Hp9u|R7 zDnzP|otgQgH}iiOdt>?0y%eu?4}S9q@a~RqR@N?avPlH0`rDUK|yILrotJe z+r;aw+>n9w*-KX#X25NT)I@49FOfu~ErPyAP!2GVz;eUece;)-PD;@F?gSw^fzA=$ z82dPC7nut2h%7vh!Y<0ed4f%WM(UWdW<87)eDm0mw@CX)=qESa^FA?2PrkG77k}6T z(CWY3dg94fC+@lC%6*sJe)kWLCdx^~c8a*`%RLXiaOH2$Qk*CK_2!?wF5LO{#?5c9 zz2uzH?I+!G^Y$ILbvE94?7E$kDs^GqDl(Q*1(>TPihm$f5NAU%7O%6o7|6L;!9lzo zOPtBemLe`3yKD(NmgUONRrH$fM0#{*bBVrp+4g?;)MNkn<-W0H;-5br*|KUav5=57 zc+r6;&ffFDgGY~@pMpi(C4Kwm)BpTTx>35ac10oCC%o|cAD{d5OZVOUI%0?)h8_Jg z*wLMc00|>^Ey3NJS{&Cd1ZtC~sEk7Bb0N5*LLroQ1X4P(4}h(XWJnm(EekWA!XO{a zWO#>fB<--M$|&NEq0k#B42-19jfF_+L+k)AL|}JM0o5)zlID1LXc(xl2LLO%RfIjw z!GlF3sV0Ztu=NAHklbpL*VLq+$qFh9&jr~8O-WMW-CA2?Dm2%!5KKTUqUa<| zVM4=Sr58xU@Z}4apR?`Cd$w*k_)bQ8^?a%QZQ+d<4S!tx`RvzTQ|x{4A@%HqSDp4y zR5bi}&!H{rRIia!XI)A7g0Uav@$<%R=12H*#@^!NQsKb)zwwTJVx{}PiBIrr6?Y*% zz|Iw?9A?EwsMDtX2yq4cCu!TS4C+tPh7Yq5eGuE|mZ3pBCOI^odQ);MzbeRE9v)e< zZ1JLH3$8x@^gUNzOmxC$Wb5Nk-1YFI4}b9KFJJlH@97ge@x;}5q7^%QN~%DU@FzaX z_+vKChNo63K1o+qxx?X-PtxIExs9Ks-MOb{&kEXsiNg*(VLqQp2#UGjBIfKrf}YMY z@%=n+a+G$I6?ay7t?{0!5@dcYi1jXOp0cVpnjAiVezZ5=*B$Iw*H_F3H}%ybkU^MM z)>j({Rd*H?%s|DZx@k43_5Gz)%Pt$<{P0=5dd&iZv3A8JnQ2ptdY9ADHDGi@7@Zkj z?rEtacUhU{qfA+$1!F7J7k!eBR06|Pk8<+P%1Vs2@>kBlCu!$VW5nTsVak~~^gx_E zOo%6~ypxSG#z6Go@`le(_K3A2O9g}E@+&%uXvOJy^U9`H<_}d4pErL-n=u?MGVBa;?~5Rwn(61W@5qmP*tkrlqb&UaAs5}{9C>B;&fMcaqo)e z_Ty&66T_Fl%dm+58Goq=q(Lr`a%ecD@Z6PADUiUEA_}GA-n0g26Ny*Y-k>q_(AQaI zLF)WrfS5=ULG})R>6bJ9{`VPQ3QvAXFX(-RCvaaaBqTF1#yH_#BxJMoMgtLWq$~oa z)ytw5-WDF8EyHJTz-LulJmpZrNFaZ~#L7mBqUzo>Tu0cKrst`ANU6y(QgI&$;PSob z{e)9ykWDl2^q0vi|1-XEsKPI@|P;(cslax*|Qdjf8Z}w)S>0liIy~4UP8-d z*_N02Z^%a~4_YqIw(LgBjjZL0Y)cdJz}E7c@fnP3^aW63%eawWz;Bnw&RS-oWspbZ zEJ`ufvH;&o(r;0Uv6eVKvz1>WQ-igP;4_`91=L_IooHFjo&{>KmiBRxKaPC{)L<=j z(kS|aXHjafmIi!lh%(E@6)mY1a~ z$w&Mlw166{Wj9)GWG$e^=nGhH4@)}~yHvE6bS-y6swDz6LSQm0lqr+R8N~{7o?cVq zbXI0E70$RX5>wE$RCw?a7=!dGZADCoSgM^VXVq}pc?2MimVU!_dk)*J5P=E@-4MC@w9Iq zkxIy!bSK^>?GWcHp1|2ug33&-?m|y05)rj|s8Z9D0XhsPrbM8LnMFL!ZHxpWAWI~W z3fL}82LL5w)*18cJU#>b8!?A#hblD?5*k1q8YM}|Lw(`!)wA*{APuDnC`Q93Ddb`y zjqN~ei%bfc495^moR3kSgCbF5*G?Hy>QwyFY0|3iC(|GuoUlOaP>#MTa-;jSHnmVZ zIw)RyG>O2+0$3Sp#I;1A{lvqeU?k-OD4@?5F%}d+sLo^}#t;gQ2Zz%Ui;tjUlb{8F zs5TeMF%eYG(#EL7Lu0LT0|hG#0Sr>9Vrg{Dk&h_6Rz)3jQ#xkRA~l+eN@6B+MemBP zV7aBJx~#J*X4blWKA%^|Z>KYRp`zs+=@aSe-%Oi%{;FoRa=ER1-u4+4=id6`=YG00 zJCST0!e1fvxw*bnkrlYau<2;ss8Q|UQk)$Sa8>|0SdA*66(O96;{bUB`G?AJNF|z( z=GX*P0r-usUPwJSI+Q3p8lK4O0`9)tcY&AQGS{Wg95M#9>WH>ud2iB4-lhE&?)gNz z;me&0VYZ++?eAp8XQOOBKx?`SyFhCrw=k8Y5LpmZjd~rILg8~xi$Xs*MG!BfYEuE$ zMx_$-6sUe;K>u|B`OfV-d2!Kb09j&~wBzKhhCUE~UiHvk84TzbheAziF3+d}?P!!oziLzM1CgF{BmUp$w+JeuC5#S*zC)@iY(xs+PoGZ>bVqg`_9va* z>N_EH z!X{|pfNBbcQ{lisI&637IKkjG8kGhHOGt;3P2tEPo75}*@^LlMFd8=^Q6!Fq_;FKt=_O;1F6@#wR+6C){{rVo9T$o61MjGQ_ito{$V@t z{9~gRh}>9{Yl=S{2^aWMF8-zLG+|w5__**De-4x5c>I2E8WwuGI;k87+dxLRo{wXy zcy2^^mv6z0QYkKw(koNq>3j;S{&X7I-d2f1z9iu}?D-|Dvsh(Cyu39$vTpnI#j8)7 zs@N;Fk*6gDAqd>f!fV1a+52cA4_ehJ&FNxFc{*~{G)i(h4S>P@=nW_CDBqP}N6=V0 z`XYlPgDG-%?gt)FM_$UkaD%tFr^FHAH@H$kQX5G%YgN2jID3XmL z4hfS8(9=8tm-ixPgZza6W(S^tP2_a4j{uRMfFjgQw;6kb?p<6Q(QZ&^i&YT^si-N1 zzTOfp7~Lwrgo_6U$0`R0$vQdaht`iXA}Y^E@7RG-@oz&Y;ZG z=rC}v@2mZWv`*1@Y^k@d9S^L3>9WMJwcRfH!w)lkl#3w_bs1c1ge0jls5QX%?MoV$rxRjot_NrWH!O2 zR1z1m<`V{DAlP+@MU1IUFcDc5#Tf@xo#ACq^gGKu*y%0SEi?q2(jN<@PqY@JF>m2A zQs6DOMl8fTENlo&iAWLhOKZR%w0-lK;%zBEnTd7;$!8E<$A2lU<|4|svF3ozMDETY zG=?b_m`UIum?OQ)xBq#WdILULh)=$cPZ}@}z$Hh0NKqs@U{Vn7?hG;T3ZQW4g*@m< z$jErPGRFp?7s1MttrY~ZLk7+UND4r-BfaM)@4h>E*Io4IxzcJ?$9c&+@1VcjacA;8 zxp(A#JX6C}r(Ai6c*Eh&DHV4E=75MPm3UuT14M*GA}jhZp@8MwfZbAc5D%k=Qz%wP z?teFVzVuZunSFjzG5&V)%&#w0J$hymvDUM)6wq*$DW^J5pu<8G8^)v%QhCCCX;mH_ z(qSfDA$XlK8oJ2X6EL6<27=*)BE8aA=O^FAV~_^3T6Myi$+zE0o(URrZ;z`GyLBBj zKkNU;-FwGJS!Ms@&wa|&OwS~fo=Gz4A!SlXC>eUBg@gpiP!a+H(mPTF1Vrg7RX{;S z#jY$OmbL7<>aL4ri`}*CTGril*Tn^q%#+{y+~=7jAnxb;`Mth>eb)`i%-p%px#ymH z`aS2A!Hhmj5?aB(j;UTcLqY-WjfyfV(!uKc_3hnz<x4dxUg_(dRtr8bW>ej z%t#>=k_S6WN@C0Bu30*LoCZ`j4A3f9-PPjO-ch8MWCAh5pg}fhSO- zM-lyx{7Lxlzx~7bcR=6TH~vq)f_=nI_lojhS&shOqyLWAe@8zzUiLcre)RX{pBr&+ zo92yv9=L4&=<}pMl$4j3?4f_o2TOycS@f4$RfhjP94svjijDMdB$3__H+GGUJW^6# zR+hy|%gamIEA*i{iT=eLrNKS)m$VQ6l;D;64$k+-c)|ALk8w2HYW%}~URGQYsl#7; zOG?VcbbXLVL*WN2HDer|pKxM_kHt}_(1b%JsNf9j_A^$|1H$T;uiX7ksWQHf? zF@Zr}fv|*IQFpa*eGbHoY8A+U)hgKhbVYt|&>Ma(p{O=Hy?;qcVBqB5Q;rNBc6;0K zb(1U7g99@v24y?`x~=K?;!%S`{*>Cf=3v$Me(6+|zdXNT*@)_C<3{+)hV-t;daMZ? zhkP(!f>(MtZLbOq2$&~^1A&;7_;@JfsBNC&_o7ZM{HV}jV*IgwbpP_f8`Rc<2%WRtI`8+d9)4DRgAJY_si(U9 zqo0dUtDjBy`mVh!kKCe1w=j_`z*N-8qi$?&*bWV$Jg36}!vOajyjGu#`wm95-;8%7 zrJOSPjYiRCMrL-moF)0zqqd~BAoAp4UA$1e)1U4lW)juNy_pPe_`Obfiz=!~H{H}O zrM2I56RHty>G)La7kNMoZJ8k68ktW&6C$^=&$p~rZSY^fZy=vRWj+H#X#%|7*11r6 zSovPehBq7)`Q&|Qt}+Ghht*TkZY$VlSLcMyMh~hoy!4%aa$PNN=a&1mq6LA!<00iy1L01_q0*d`V1P?}|R< zTUWjJUi;z0?3>61M_cS$ADx~c9*oRD2|lq?R?`^uK_washf3m8h9kUVb~$a%Vc{6G zhcZJFo0Ztau`RLokOyrd$F!hhl+o@GjcEFptSL8ybAk$b@9RAv)8OOo>VOU&db(=3 z2Xs;oZyFQSeRadfjAZiW&6757E>7)LoRU`DD@7GE+lq1V?o<=|T8(Rxpr!lsax>C< z5v9yi_ZyO-dBwtuGAfi?o|fhfhaG8Y`HA_;#BhFMg;bti94JOT{bD(QJ0Ag0iVqeu z_eyF?865;f54z zks~%d%08YjGq0qmRQ+?t)$8_;-Sp1>#-`gp-ZpyI%69)WWkT!2-`=|WpZ8Cy+xNwh zDF;8@J?w|SJak8Fn}gl=*@$KJ`Ey=m)}s%y_?PGAjb1PmH+HDT@>hE! z(Ca2wMmrt#nQ`MNtS$p*$p9*(>cOBwt3Tdh^c!)v#qUGdh@t7Oz?jdP9G8p>Jt&fh z3mG5)pTo^nY?v0LV$;#*XM=WC=Vr88?da`2_~XLoYx?$SIWcYDh4Xh$or<=u?};zYoN@fntXZkNMJqdYeNj>5 zdU2ijLge7M=KWhqvxOy0wNwS4a8)SaHdw4EzG*Vy`k_@Y!=%K;hlKX^9n`%x2?_%y7F`w8LVt8!V6#xILw`wZua4 zj=`;G7!4e;-FKo0qgnGJqrjCas+-wQ|*3w|e~Ixb}-5J%00oo$POW=iK(d zyXs+gl5EesU7aKPBOi-tEHZ&*tMAj#1ogG7p@Bh+SH+A~(|AXp1W-nOC^y~ejQ83N z&Uha>9L3w+NoYs!wi71PtyG8I>EIREb#6phBR?k>;o83%%=iG%!dbxU)MLM^E`>VN z@6mh>?2g_y%_+*vDp@_O_3dMucFx?&_T4&t|Bd%gQ6JcDk!3~py|s0-eUklwKZ_+z zY^l1Pewx(HNp_E82zdTz+|&x9{;R>bI9m5rs-=3cxVr_}Abh~CjTn23%cgPkzVJlE zg!hk;T8wJH257R7EuG(>o-B0>$rhiYai&SaQT{%v0#la{)R}!+e_yK#+z)kDYkAdJ zNGTdG&EjzQ)!kA*UVn9>_P*HC8Ns7a8(6O9=MNDx$>p=)Ka)4nW{L;Hj7PV7x-#b~ zwzgV#S#be4)&^4pl)-DpUs9VI7g|VF;)v#rPq`V1tPx}|k{1WRK*9_qvrnbPDM_j7 zV=LJG>Nd7aUA%$~NJx?^SnU#Z9$TXBM5&+5U};rRJ)W#k=SdW00Tc`_YKkeTYt2 zDSw@YeOpHR#{NzFBd?c!9(`Y$!uQ#&y)WL&-|r_MlScDu^Y797sQJHyzh8s*hvWSm z;XUTUCkA2AH}w2|(&JLGd;z`!j7P|B5WA(*h8oN0k|9QGEDyw(AjaUk0+MntYG>zD zKN?jd&ye;jk6@-j-~0k&cM3m8#|oP9Lgz2=q=ESS2>*QNQ}p>D;Vl1rCwqy1zAjE*EwG%3ajUGRE$QWyS z-?HAra_wn-nks^G0_tPU>L13nu&iM$UHzb4n$jknVdtMXPOmJlOz$RMpNz5FBz z)(tbEPXv5*XwQS2mj*MAtl4Xz^V!1}N79>nEMR=Wla8zn$neQxe>IVPF)=c80=sJh zd!&PC`x2gu=Ouwd5YO}qGeea&=+?0ggh@Q;umn8d!Y?_L>HHj{rMmQgk zYXy@cYA$h(1|K2W5>%8z7tiRV++{97;y^}oGbw6Ykf`RN?$gwdbQ)_RDpl_jYcILv zI|YgjLCUt`w0eYVLes z^!v+~f=Noa<|XU0@5o;02`dCP?AA=zu`T%Dq^gzU z)GbAh%mgVDmfyqscIa+XLlv=3u2C37x9FCAKI8-Wpa`|KIDt5q-jCA^21G00XnlIp+ z7)}bp?Fhmt7%s8Pf3{#-WGSDeZf{&+?WN?emgrF3JEGsh3TscE4~ZRFrX`?egyKFx-;xtCj;gSn*GCrX{i zpg|nzbc-)?jbOa?J}c&u0)5DoYsiWfU&Q;oZLL7tpcX30=i*>g&2%h)V~$OVabZ^Y(sHT16p~vwIG%mEk+it z8l=-N>Gz!7!g;GzE_z40yR{=nn%?oLbUI86PgBw-65B%W&27^4;ObWLs!6>6tPzbO z1=O52qbm}YjfbH-5(VS6niJ87;UV0Rxb#VHh$qHIta?*TT9MX76Q>pQD!mG3VuPfe z5GpRn&lJ#)DKodC(3%1O?0LE6q&EqkoGDz3mE>r0$6 zPW@#@_3+%Bx=Mdq-{#7^N%^rkCWA52!cu0biw3CgThlW$9dN3w^<_w7%lbId%QExE zRadlUR5es2#upDMDjqqgf7-~0M+L&!72}g7u>(e~!R7H76Ov;G6eG$&(H`l0?5e8lyRf zV4wX(rFg*l=dSx`@iR9LC;ZROAKfRbZt3n312(Lka@(Amw({`{`xe&b#SWTuU~XU5 zarFy(CtkJnmFpV!ZJd{1x?ugSP0NnYFBku`d~3tauPm5#-?G}oUj4Ho=|fgQ$rgo| zr3+%I@*ntP9fTz&YzQ-pMcx>;*o-^KK?i^F84XET0&?d8JPxkZm6cf*Czduf{jne; zBPR!*E9nC3=oHdX$0fa_7v}$kq>48yzsCIWLLlUlm?z{hZw!0v@(z@RzGQYVvkyrV z%wh2Xy=Z(CMJ%rmo7qQQ>qw5X+2RnSPV(Ap-Xuw-x2M~@$qr|-Hzp=F(cw&uv(dU9 zl?%iNm3@3&`5~{-wlNG9F~nrcjux4PqNNTfXNEiV5^0g8Jb)bN;kkR1R+Cl?cU@^O zxuB`(4~66%E4xWX_&y?5=0+Beq7 zP56dcNJSF{atlc^Qif_kJah&b!@VF7yEFndN+S| zkC~XsBpPMW46TC-T9g$B2?)@(HWO(PNYFqHyTcv+wQQJSyn6Rq_8}&ljG0>H7bJ&r zKlHPbP=Zb785z8TW(awtMn}kjtP9wcAYnq*8Leo#o;6BE$*6D=s+U8>LeUg9xN?lG zF>cAk;MG@8FRQNVb4~jcrFq!s#VdOC?$v}J(zfPx)+%q1ohX!ZDIG?C6zUsez%3;D zJP4ES9Jqi%Kt3B@2M_}uigRob!d!}rHmY{ zsuyp;R?%P5bM>)Fdetu;JV=$~G1b$zH8$Lo7vFzKoxgU*Rk?jvJ+r>~rncbz4Mz`5 z8@hCV!?DtS}?^mE5_?GXAhq@ta0O{3VED0fB3@2Wy_D>e^Hgq zEAN_`*K6F0;hRt9DKSH4Z$od~&GLhtHO5)sYqpLMdmR`W)%lgOUpWc=^zu~-cahonP$Hk7W*v&>@hTSV;G%=hM6>|Xf~W;e-2=RiR(wvkJT)szOeG*B=Nwtd(@M%dU6j{ zE8o|74luQ8FiAqlU^Zhm!+OM%IY^Wg%VArd`a;Ei>T^C9tT%(uDtk` zj=~^^njK!=g-9KEIuCFI$froF74GNf;S0RJReFf?Arh0YsJi%&2Pfa_|Ds8n(9uM_ zZJPk?7s71$Nx2@L(!`JzH%mZAu}=67ctjWc3&r999VrSu$eaG`C5o>$-ZHngsd?*T z;mMEPG`4Bb;=R(v^7#)eS4-I&TYtSV6x#Uft@!)RWe?0lu@;Fb!a{kwTmua%9(hRp zLm3Y5KC}<;C;9hgBm-OJw{vLm` zo_{xI^y-z7QBorQQvXApqyMq6I3u&DC^Mrt`diA2{-t3>=`Htxy#xzB&XMZ%!9-P* zcvF2`Yn&JtheF*sgsp{tO2bNrgJBJ;=GuJKMKY^{9U9;%;{HFQ$E$H1;*mC2frioi7 z6@eKt;U3@wzD`I88!Gh@p@TAc#=6UYkJd}^hZ)*9<3#zPD~~grx-eXR=pya?7|gc^ z^NEy)4r`XnEKZl$a^{y7OBolQrFm&iHq}roSM#xm)?zfC&O2n&SeK#phZ*7-b&vS& zCG$E?VqA1uei+#p!{ClT@kuY4l}2JLCMCBQ=5#TdQ?8EWvbmUId*_#i3Camr;X!!G z?77K;-&+hS1%2v7>M8FpL;A?5)+a;!$W?k}JaB2ewu{><+HSn(xfwH_yXU5<6%|u& z!rwE0e$S0<6>Fy6_v!lPBU=_V6c#ot+H$0M{ipX$6@QC?H_|}*k~UDAfIcl8vvBJj z&Gelyg;S4ziewZh8uB}QZ{mqZ+EHxNWA<=vL`j{L-v1GuBzShH-Zm+7S_v^bzAOGF zQaL?$=;X?Z$y5z;az*9jp}B-3@l3^(p}Dz3r&Q>_v8UZskb*8^&>d1`Dc3C)S*1*5 zmll8YI{weJU&Q_R^MIKCvi>|dzDr6$@dTZ6(wUAWZMmHDhCh-QLi!{nDhl@sN2mT%a7Z)@Y)=ECIkjFBUUr;Qkq zHhkpBjP&Hf=CzHj_wL@Xd@dA=D0~Nn-a>B3m77~;Ksd3;n(6f>Tdjy95rpKGglXCZ zC4t2Qqgn|_>iMhPgu$()ee z^P&NDOB)JJj#%5^#gm4{Q%>9z;aXrg6Z{lZml^|a6Pg_-!~k^Idzy>^W;GRBHfHux zqTt4ZH%VXjS`Gg9#OYp(stqu8O^Yh{4aO5kg=wi#5$V}S+g9%)ei$>lJ}%Vbu525(~TP?{5U_X1YRR}5G)a@$(6 zGUP-jvNpZA+wUgt4MiT2Vta-b1c|3r)b{h_U@grLF{Lh(Jo*bM1LnAM@klH1PO%h(XB6ZfoP6L>NfO+B7A-CU9H%gs!8%2i{_;|3O8 zd2!*aZ7zQ+~QPBQ?c=+P4Ksv7wG1aP8oY zjBcVM3lW& z%w}kPyhw4icIMrAa_7ba?;dD4RF3poC?=qI78J{AavTNu?%VPHs+Xi@R7TZf!wiDVIsP%q-?2kYGx8Q#YE{789kVaQ_xJmnq3yiyi6l zBQ3y3smu6_NMECSkG~hHrvq0|jH#w99F1r=Lb)pZeNvIC{0qb!Q?L3(BR`i$sE0Fp z=Os!ny=t!*zq&c2cX=@7?83kJ`wVKRT=>k8m94cgk&ooQecOj-H#NC>53A3a)PH6} zUytI*s~J_Mj%Ryn!u`{la)(Xti+x2Nfb;?14eFg1E0|0Mg!?sLJMwbLdyJ|qAv^pY zW-~Lm8A3ZiCikt9qflQOt%O!YHXOp~UIkc&v&Y*{x7r|BSpf}u!PEb%~ML<~_Az56~lI)DNpt3-M_E=)2{09OZ zNoIPPdmt%#4H+dJ(xo=_nR`wbj$7L}=DKl3Q~NBwclNZ~=hpn~eRc=?fxY(Eudcag zVV}N>?_IX(H(Q1d+VH}4u#J;I4>JKw1|?U5%H1NHA4W#Uk`^fj?$H>B=+oSzaD)&H zcs`a1!9*IGm@#R{sz`RGm!!?A zF3TS=tAF#lsl)sA?l-)YPUjMJjI>@-95~RrlKl`IWNu|hk^!X zB`w1dR~%OxCt0PqIE5D)$#5z$OInm`yW!UgKe)NGUGpVzp^mpvTNthlzF~U9F0um< zIIG~1Zpd;hk9=rer-H*EtsHvYgIA9^Frx8L-S{o7WuLscVA_kX?%uxTmb*8TA4&cC zs#W7k>}`kU_6g+7DlINI*2|{qNo$DK%CN@Iu*Y@? z=yKHGusaY>HOlkDMi2)) z=c$}a+j9@!5{!Hx77X2c>y5J9F{Vi!!yXII`}RNIT+=Z|idpm7%g2f9992h2H^JBA z69$K}Y>rq%?EJ6=)NZjL(cWcR(!yM>cx$|b(h*kF7P2BlPS;j=q>ZW^kb0z@K6uaR z#KmbL(F`Nq+LnMhtuVyVtv5aPvbrd|v_Nc*MEo<0{`~d#U+h;m&K~)TJK2;N@qs2) zG=2QauYUkmR^tS|1})SB59E+gR<F%ObY^i=Ih+_3(9zR_t09D2H3duNENNb~=mSz`@U0PSSazbgZ<`s2Amyau*TD$0u z)@g_5RFByC=BDKnXU&=O;EIquyQAfn8NJ!b=I!m3eWtDnHSJwEpyukW(`G%kzOMP+ z?~eSOmA$ttv%PfAi|V-}-w(O=PT+f}IzxH{__o6rpR%$ zXq1W&i?!fzS0;k-f{7X6>SIZ1v$x+nDH1Eqy85wQvs2X>Pq7IoZ8hYcri`c5`_)I( z`;fRJ39~!@Dm?)#<{(?RUYHfCvGkoE9!lG*Bn%yzpjc#~tSohYxJ<|eS`(B3RRgL} zMP&e7vI7QWIx>rZ-2}%7yk)oqyHS5^lp|=$F~|UVGGK+#FYgwtlBMR}mPyeg0%4IiKFK8d_^9>$5wY+|FdsXlD&7&*Yng;oNquUo$ zPe=Lp>bbX19IDJSXcSV`L}7+HS~>+u z;DUyYJZZN*&6kF=ndSpC@+FzUCzFyg3ktx63RY$cK$jlr>v=dhdyZ0Jh7lqHp*%|W zq|zSQupvh=DxyWI7GOX^wP@KHo)j)zHf&>CNw08=n%rkr$>)Dp+SL=Y z7pz?M^A{E@y7gxDpL1qNzq)4D(T8W12HVP(4m`bV*+q9^5}VDYeYJY+^S|G;@vghn zr_}}TycZx@r^`0cV6NxB`!BJ~yTE^p<}t#0{*EpmFrtCK-T@A^8(i36ZcL;Zs`2`- z_=dqe)<~~){(1*E&_=bL0ZxwT@%FMoPFYeP008 z>e4q!njcQGp#+dE4!kHX!2vWoj5fYcF3sJ zBh-%|qiQCvruCM=j!uMLCc;NdukXQncR*hf1)oAY_Wvxm###~4!u<(adtxl#d+^j# zeD9HffX`u_owOvGI}wJ}()t*>L8&pjbt>JSw5M2B+|9 zhp2Dn6eaCXa0aI+zx)ZQieEo_&*{hRI`Vh|o69C5v-F0DU%ge`psXMoR)33n%MGkr zybbiY8!+F3PCMxR7($N^=#8QYiEg+NYc%4Hk*?Qq;{ah*6lj4<4M!+gfdYjURG{zy zR;S*{o?(NU6ydr_2YWd=#7;#YbYG{#1D<69dK?|Sa|vDZ((vhyqTPVr1TJNoe-Hf%q% zckXpB-@E5u=hYoD_qZ*uYY($QTBfu+~~} z*pP`4p9$?HGa=p$9VW^;x^5vwp@gcS<*M-{03^aw7K*0K{8$-`BVCZHHo=X(B&~&UUDyZ2td8wcz30XkNW7k594 zkdR2$tb{u}pcOZ?oD7#@Hn~AB2De+1z&RvAcFDvy>;@M+@3@K@)%dk5Mx1sCWNy3R zmu3SXX$Gc`7k)~*%GdD?5H0rUTi2S%ZebujtPf> zS-N5G!?nZ=D=3yRtBvb}2GRq&)W8I;2VSZZXi|QtOHVYo4fDfpGir+>Cg|{bv9(^K z1H}a$(L<$et!5YLdrE)-JzgmDqMrX13r9PuiwgcSiR?CrVY+}Jt(-ac4;SQX)W_cW z_L*OO%mU1`;$OR-IdSvWr;aPT+Dp|1>a*WRe*Sy)EURa=Y&H8uWcAw{j{p0Q$L@cV za7g@uYnKKq)NkbL%Yacf(81_x6$$#H8^errI<|VcSQLqq&@-`#I%Un%cnUa3 z8oc!Fp>k_nI?k`zXNK0{%ge*geEp+SNzzy!M9svBNs=L>-z8VPGgT9n~WZ=`lFT*lRO3)Zj3i(L0DXIKhGa?h^aj z25U;bmbXToPdLqKsuVOSDy2xfo8jrPyC;^k{rMYtTI8`0|MTn%AFCg$-^~7Y$Eg#$ zHa+*Vn5!$<9M=Bj`4|7d6!jVPS#`cTMp^N@qmTUh#m!Ism3V!h&acGT(lk^p-XREx z#+!e}1UrbXf=BL`z}GWDng<`&zxb!d6J%3qQT@^QtVx=Q&%XW9XA>}MDa}e%hIou$ zAdP^}S%B{?lg2V$eMx^J8UET6+wjf7{L|_meRD8Ao5f*86(aqcWF%?d9N2kIoX5Xe z6a8ivtW}-gV3mNCY7^m`R*Dw}_*bJD3gRR_^RBL$4RySd)zB!nmN8 zBxGed&xNz%(}nbNVZjog7N2$=7kQ8Z9(TTlofXp0w+MiV*GbSQD=HGYPYLf(L@z0K z+0VVIxQnV=HQEJKN~4YD)1F|}!xq=)&zs(N+K}wv2Gcm9dSTdJg&LPzRX{bqMV%N_5n+p>1; z)&);oKXlN_2WH%ReP&Y9=pDaWvGI@l8*?THhps=lVDZ3As{iR+ z_1dkC(x)8@|MfY0hSrVei5KuZEAHR+!k(jdA-wcvJWw&6M*?@6Qm?csyA;JLAvYcT zl|y0f0Y$fH?-G$Zk?~{;E|C1*6JnuS&K^+5u`lIdqdKEeodknNd;XvBeEp_?!9->4 z&Oxo92QjEn!ub~CSpz60nxE7y`#{wsgh}F2b{MK$V*WO<5c@l&L3QIf`p(K`?5rPm zDYMhkj42MN0_Vah#<+7~V>*b_5tELVQ!%ddEivDTN#|R{o*R9scLTDXN=MPQQ`}gK zBwo7fNf)tl>^4u5##?Yoa0nE%B3p#xSNpLKYt`W3r&#FWvyURk;F&4UxF zTZh%Hdu-PHM^=UUvGE*Q?1$9J_oFrxp#0)h^bvZSp|+|kA&ssuVnVxM0;qhX%`PdL$@keLB1Ogzg7 z*W4%XM`|N;x3ysa#yUFx!S>+K7$G@iw_vPAww@J@-S|SJ6QtPVax%WXNBv`AuhN3q zZLMsvy4pIuOqYeR=no)+uITiL9+Lo5S zEybxGqeYV1+Msl@->+1SVj@)U7$x#KR;aiv?30KZc|)hMPw^}TxdL`nyP?x`R*<@B zSaa~vF(Q&Z(Z=48gB__+`ovX+AasMwkjw6JyUvB(LKrUfh! z=8Kj!iUuxS@^Q3@f@!TTDpnVG-LhfwRCdhlH7W*&i`_m|{L((YCassN<6S8;w|`w- z#0WTk=7!##@0W%}cTBDTJn=$S$n653iglS3vjqp%Vm)i=MjTgE0T4$URA<5*kDz8} zR}ew`Inr*8bIOdhjTaAE6YQw5hEjvJ)C7yq-f;^a`>;JTHnGSf^~Ynum%tz8BREBf zy%Ar^bes!kDhcPpiY4}Zi{(2Z71)fPn{K|ObR7~c0@ouN&0SLBhE*?Z8!_tUGwYW= zzh%Uz9j`8KyL;Kdev6K_&pfuIKYn}0-2Cfn*T1#5p?>Gf*WU1lz4fwj=-NkT&wXU| zpnY1YA!_-4uTO45DotWx`q{1 zGt0p@Tc-YZq>U)fc=Mi=DB59iFHdZ&IVIki0s)?qfDq8RusJrtXax9z z5rIFdK4!L9d|1s{!3<0Wqo|DfD7z#8j)e1N@Jce1{5+aPEIKO5aUHw+GK_L0p|Dp~ z*5)=geDvD!#k)5T8}xYOuIIPhvUUUOQ`*mORSV=`?(iA4%MZm#iPx+5gS`)3vuN@{ zob2m5{~>-0ya$Eep%hOh4z?#5c^rT{)9foNgA6IV-~(y;zPn6z6MQcfQ~oyeSm@g1 z-a*bvFJ!WkAC)TEQc?l$c^dVmUKhG)Ty?nCpIS4%X6W3jvMVRA9x`Np<*Y5i=KdMU zeOm{Om^mP&q-9IM$bWSQrE*+FpG@y6y%-p)G z>Wll&9G-_&fW6`tCTVfVIp;)+noF_(Q|5e&5+zyfnm8~@JeH72rp%w))W;+N@;puY zw2{k?J1Nf)=HX0>vuj-b*D3*2f-^|3s}t1utq1SF zdv6Sre&6890`&H${$OJfAb6ER|!v>=s|^vNiv6O-!IakJP+uUVE| zHa2wzILf1ya8~=Jddz~h+X}cexT@m`gjvrLF+t{Nv+(=~#%GI8*PZ(zZ){f2#!8YD zul{SIdK^7^%{EyQomQ6Ik9jOH_}ic`-%P2vHal%FYA^;n9#1Lp*h?~``i{p_OWf9Y zyR?p0G5{;t1sG7(I%KoPS>r6;_!vt}l!@~DqMEK8RgwV{C2asGx-QJ56g6UtGt1UQ zoBG2dHeWry_@dQol?yK{Q14;W*g;Rg6IRe}5Y#rMZ`A6gvdOGd-B0SwL z_(M*8&+W2Vw8`3rM{}2=+uZ}V?0lwDu1OqMxnIwvPkVZvC-@p)ocM5ZL^%6(U6u*m#a{;wVyAbrU_(aFE z;{f{8dxo)?`c2S5Wo1G z+IIXJagca0s$WK)>Z`uWmQtd#92}?4YEUOPNFPN`X;Msi5Bwql6u2}r*b|=*37YS9 zxxD$3$!E%dp5;z-B%W{az*up3(meH^R?jXEAV$iEp{L!T~%llf)4Y$0y;`+Dtj&bWswe*R_GWfd3=FWR$^}rY_C}AQ56rETb z?yLn+<0S_B1BFt?C2OOEst*L@ zjEmW%GmRhL#`4v-QF`y*;&H`dRYW~D?wGn9I+P>~>pTP9VLmcfb3pffLaC(zf05sP zF6@`Vs^yZbgc|8JyWU#sFvG**V}89?rPq z;&E(;-PXH?w2R4i)UNG&-4N0+Rxf;V$gM0w`bAZFWJC47StLF4a>V78n~x8DVh$-A zWyM=7x77WLD;$IR-?^AnjoHWhMut@Nk)9y^qh(JY@nmjZ56#04K0-Ztpoqmf6BG);$+ss6BGz zK>ga5V%&rAty{O6E||k_z%53)mD?D~ccQdAsi(-Q6Ma5_;}bo&jB~!l2{$Ji#ga%7 zptD7{SyzU5v>ODgqZ)tcXAa3VNG0@lnU_Sfx{0}BMGqqrEd-v?4NdmV81|noTT`7p zMxDmZO(xvd`Hi$k9*Aty1)H{b*Idw%v&brWesSl_)UMwT;4Dn z-YxFAL3laad_Ba05!D2qhVKE*V!Z#!7EgEHcGBaOjnrrkom>Andv>RfrFvV{Yny zsO79bNgGXocSEjB?V9~V;UAr&ge2U46I*@E7jpaRihT@)Abo;s^5lX=+PCJbP2`Wk zw>BcuV-!AO#{~oM08L-K!0|?TLv=+193`fUTjPIDu(uXCZk zQVYJojL0?WG5R}<`8|hS8@;P@I7VX^Mdl>%na8G$kHXIVQWcy=;Nisl?=p`*e+K3k zGJMwf?)f!qk;4wJB~dpUi_xI&0?dB8^A{)c3KX>d=%Q|JUG^BilU=9HF6QA2xmO%b zYt?3dCkl($3!{aCUO%3jL#~Z}mu2g7m(l35+$)TxUDZbK68?eFoW9FBeOHxglF_{#gj=RHUJF5@feBJyQxbK}H+EWW~HzT7j*Ap|D?E$w7?>JX*_ z!l%x>g^+=n)xL7_GE)&HVxUQlC2wqc>&b zUNSd$k6g`9LT(KYvXBu z*n{10@^xx_@RLRj-^5`>`=vaS&bgVxcq7Nj`?%SpjV63g&CM|Sdtii*<}+)f-(jix z=v<5*7s$PIw0Z;ic>y0E%?>jN4#9eg6=y}Kh5XPUpjB&ge!%{w&q;jj>OjFIb7Bvq zP7c9M9Nu@L6wHN!;Bce*vd+bziH*dLUky#$16{B!REAnw8LP+Fs z8sedi#Zg&HXgF5X{*8xE(A>k73o8f}BFHY&YCr0lI9JH@GBo6BB=;_Kvx*=LHK>nJ zA|?0)xT|-@40873-^dd3_)4yZxA4D)j(>`yfB8#P2zdxnG>PwnCW+qNsO^FsIAHJv z_LLQ$W96T6I^<(bZTD$oNo=u8Wme}q82is2^S*zg$5_iH^9mky5%X|*!n}y!e*78f zIeRce2|r^RWFHi2GmzL5jJi~cQY3sG?s^k(y3(z*8-v?jH7dD`qnY@0``< zAcnlx=}}^$dq(<%dIQaYvD+}#$PQCpmSBGh1(#nw8S6H=Xe^B*D~fX=WF=wFouG2) z2Ab@C=A_Yl$yvs%WOHFwKAIiAN}u!VlO}^UQlIlLa=AVV&jvmo!2M(fV$dRz{Hf7- zaOOT>iz4H+Z^{)M8ciDSWcTP)oPae>OGvsz8Uq^g8RI#8G}icibdCQ!nW#(du2~6h z+N_^&*#{ky(X2vZYWJ+LD^IAuR6p;?muSnN^x^xKQGYk2C-bz#m87JxUgDZ(y8CjN|+7;0( zytbI1MjP1Sm7Kc7&flNR^lKxv-Nc-#$@13kH*PezMgUBC+9~Dmm7ojIX)1xN^fv>Lj>D#&bw?8>)!Nnx~ zgp(!|GRdv&e3>x}GC=aXk!`v%uP zHg-mU1@24c`?jA`?mKLc4rw;6D>K`Y)`N1j(PVdPqX)5jF&g`v$@h8BNq^>l9lukY zqR;Nf7jC-JXs&;2v+rW_F`DC{kX9uW=V`NdtxD6s=_HZV7!s_FkfY z^U-{MZS<}(&E`y^$!UD5PaA*P{IuSvet%YnpY;2&m+ALaI0KtG7dXgqxs&IJ zYPHGc9=PPAxvbVkf57_bqsiuswRwI#n(q^h#`%KZfMg5JoE77|WGuHc44(mN*cn2O zzm9z79Xv z^9^JdU_E@7`FgN#`udQefb~HqhIf}sQux%Vrcr?~Dbyzi%C3}SP62?(DS(d4(wK-U z*-WIr>RBt>g)*&gpgO07d=k4I@kIM~at7FCG=SWdQnF|cay5?C$tQGNBKFB(W+#O`*-!#q#Mh(;;qdjZN@ZIJGL z17IqaLh&qK8uzPu_P{Llq!trXk02(7w5kRk73+9ho10=Pm>U^y+H0=28Au-ke#hXS zL7)SzC(htdj#0v;5)*|9FH6)hF%wdBOy3jw5f18^ZAHNe;57JBaq#8t%bJAQS>i7v zr`TJOJH)dTO;ls?V{K?4Nc24hWYB0dn&w$5Mge_rv>X*g8R6yT-eoQ4j0YHrwxhO+ zUrR%gMoFJ_q|(}>_(bF$GvCZ-F2WioVvSVM4vn7C^v7U8IVTjd1GOW00{JHLS%wUy zZj$c~UTNYK7h^c()0+IK;^8e~zf{+WuS9;uu2!ds2XaN3{jsc39jRtDU~OFPa|j^! z_1B2Z0U~fr;5yv-o%}p%%%%w07&|Rgk%>|$SZ&a2GC5LH;jT_~AdKP2EVGoIZ!uUh za$^z3@WBo5j1?`hmRM8VcP3D_7T&tNvM9$ADZtngt_DB{=Dup)y)#Pdyoo2G=SIqn zrtAb3jZO!H^7HlUk2Tk{)y%$sMQz=h|CH>{lv)|8nOrn1F&$!MuCF^ zd{=hEvV9Y~l1Ww01*91wcH?sS48A197Yqn87=(0BI>^xDab*}2&bla`%S)O^Rh^#e z)Iwp5N8Ks(j1UgpspEk$dX3^B$ixvp8!~EDb5UF6oFmr^nL1?7(b?r~*$r#P4VlVr z$h>NCJ-c3A)wFGTm3oE+tEO*jVw=@GjvW><&By^X`~_+l5&T4KvOkS@QIzVMDHedfCWZHZCqA>eM7*cbs4+tJh=^_xsPj z%;QF~rrSGC{_a2N5}CX)H9z)u!@EIqYu=5WXv?U{WEwru=IHir0FwWeKU(7$d~VGK z`tKfHO$+L&r9^d8(o&i)(^B}}(%hB=Y&BU+jC#5cVhXTCl&3p~6(un>-heHzg;V;w4uC4}qn6&$pze z#wVsEBqIMN@ofC}3M`5qVK0;?rd&jgNRg(<sAtw@BTu-(=TkClxZ_QkV{urQU$9#oacOZ> zRccq<^Koy)K`TK0S&Id!1DBj@vDv-z{dQYMR=^>q zTo}4$Qe|=YhH;E#44FObckc|IIV4m1Wcph#-c!|Q)~G^*(qb~E_L)#q`QYn+nXhK1 z51Buzc2RRFE9nPGD)R4BgAqe5QzIyLv2CwskEb z!@HM+T+%MsMLE(zuh~Z(kshny**tO)R^g?)GgM_9d8{$U7-Zjgv3qs}8m`@Fu^~^B z=gv`rE9K5zeuOFiCAw8y()T>GUYGRx(wn|&Ljs(jKKZwXbuGm#ZPl8{-}uqIA#3#N z@#>#6nv@Q3&dWWT;En_J(@A!Iy~nHhG<6>;_>i=j?0m~$ewN=Cp43N^L2S)VcXwIO zr1zP)NG1ghnI*KqmuY*VnP%FSa9t3Kf|REp@rEhtHu6-f zpRjZ|>r$o9G_CLwn@Xb+sTKHjLJLC|d(q;uz|ScAoIa$-%kj_&WvAeTA>sU<=k;Ey z@^TibQwE&_x+&j-D0Rs0qDlvfDTaif|4DrD|b(g}X{N>wk=jvRo+XBR{E6DYtxP~7c77`OUb;lWzv7MflmTq)7 z6}#W=JZlG(l)@L)!J{=!G>0y!cbXAIiEPNA!|v<#m6`mx8mFMC#za|(k=59>VxnqT z#{MAN6nUZ~J7o6e3RMx4MNx?{MLrjkD8*Y9OGHUcR~$xmQB{m6H2+B?5_uCOjC)T1 zkgA~hRS5G!{Ypwxp_^yLm!_tc#%IYUq;Vll%~XQs#Go3pl9lW5rTOZ8tv=+KKse>* z`p>uIe%CX@L}#b4n|^drSla;o$X=3R(tTZ6`wOLEp)_iImS1I&sw!q4yn5QT^yVpEY{q%BG?vt4D0AsM^pndR1e=y5(0bxGKPM`Yj$`o|oPp?~k+k`!tlS zSuiTCW?a?y_WZ2LiFrALr&P|`kt``C!za-hh32bei06j9ZUUQ(^`k}l2z{}fs!`A~eRJLV5KdE_N(Nkj5UKLeGaw__;QK{@uqB~p&S=C_7O z^5ch_l~$Q>n|^Cu8nAx~JcW9dieAF;y8} zF`(w~iRUMG*`$}-;l%YIqoF5botId{`swGNTU=4CfU?ms9yYBup69X{C?<{9q+gOh z+Q9wPTo>fInzV8>hI6Nx+^$3=)qS?7#s@VAJ_TMq3&;IZA&xVZiULBsmYC>FAJRCz zHmiSJ(!ivWx<2K}>Z&;`QI3hhd9ok|?6{hF2hAIuZ!=G^yVLrNtCV6QC(J0VV2#U3 z5+?vY-QpDumN*XY<<=mifV>YoWff{dsoeTApyVCAQX(Z5qALDbv&OoJbG=NA>k4v! zIF=>_f-bpt$0`y7`@7`;u_QXp(6gjXcvig73tdlf5y~vkr3YNrg+74xOkSj-6J-Q> z=?;*ER$H8iLr=BDQ+TO@O3GH00^!HnMlY<(X!Vwk>C^nggjV)tW?Amg_8PWdU79zn zBCRN0lt2c^RRh<{i>{K3H~3n(tm6j>rR2`ywp8>MiMGfeNjrX{L|^A^ZS2%kc6zEN z=yYL+=cu13&*M1`VOS_zBFzD^jT(J8Yz`5A1sfJ^vlv7NR6d*Idz5g8bSo><5F5=g z?TVrCk{}vh3BS}!z#o0^z9|=bcR!pk%+g6ZfgWXiz@;ndzeqj@#41`bx?HgA5yJzg zM2|_NXu-h0l1u5wnkEWC^$@T)Bp3EZXr z`g^DX3dHG&wx58NEudRb-Qf06Y9j!$hsHwi;zkOGR)_LZ7`eN!hsv(Q_tSv=Bv3yA z5S^lhkcq#7Oyo9LY^)_tlY^-iFPt7$B^7mu)4cWGR_`wF^WHbSu)$C?BO?Qs;WGZ4 zETrSc5vpB^()em;mG-^#snCKrHreP`u47HQUcv@?T*x1v+US=0AI0D4t4ffVK= z`9#TZBFWNC9;97?KQd0G7mbHO?gKUX@S zkLHCuX(p2-%Lad}kYGn$Iio|OP8LCQKS!wzs1qEwdj~Yu13Z^_ zI5sb__Ua*l|NIBAl}^5)DYdvDH%_@z(w^Vc129|{`XN?>M$QH_rNXFCwqP&>^W1J~ zH|tdL^Ha?hv6yB0m=#rKQOer^-Oy_xWC2^$4w&F02zj$Bs)ZGOyQGvlQbrq6lA+NP z&~7~H1(oFN?BPFW4)xnf>cJ~xbw)$us)6~+wiNXNzKR|zxdg>0?rLiC=vbET!@Bxm zT{#&xo2e!ckm6+%{)Th!a-_JK+3GNP(Se39j26UK7o`SDt*Y)`mqr!; zZADsDt)9dpj{vd!+PU{{BF~-@i1* zVK5h%2ZJ-l4Cs$Krj@ak=UcL}QVUc4C?oZqd=(EZM(qa}sMHw>PO|PIi(3CZZc7(1 z-q!<+5&ieHyE>I!w@!5LJ`7ke%ODI|{Ke=RL02$g{DWoyU=V#Cuj)Hwab9FhXkv9za&fSx5rZkjQGD9^jf2gwLx`tl$HGXeqFX;8BAy3d_9F<)mK=jw>=Z4o%S@0V1 zYw0fKAae*oIjkIf0sZ?>b3;OPW-TWl-U&B;JH8`|^b0H3cHf9=Ne*YW40c0GSSzHN+t8$Gm{20dbg`fQ8% zY+9Djjp&22P5Bw1&n76fXPZ3wvj+lp>XK?8D79xxJ) zrY=kaCix-$dA0nU%52(b@RJX|^%I4fYwZ6-y69KNX|6ncKB1Im+}d z$hD=?w|V7cVHa{)H9tUcr->B^f5vMEe>Ofxm#Kf&@3RMWJ5C(=aaEO)UvNGGmaG8>iGWO~5Z7u2M0ICVgLa(+KH?pH^ z%ec0!w={`r-DE?+Ig2v(IoU2}Ri!^2r5O>(LN!ZbrBz;y9ZM+cXz)7Y(6gz0pkk9o;dNq1FVeI zJoq3;P}l*=T8(uE(1CuSusSrPib-i1DM{IBife!%4M1Ng7aFm<N~ucgYss!j zlH+31((A$n=!q6nQ5Q}th>0mkLra`MV6e&5w=QfVLBxaqdi)MoU&*mcw=U_2tP;W# zeyDUbBsg_4%t5_MR3C8$^vjS@vBV&h#2?8d5=rO@LJ~>-`-{I;zn*>XlD=%@T@_QV zABDO(1-VTd!uwdpT4S5(j&U~yJ5EnnaaCGIpE139PaKdbj=S%#L)1S)q>uf}vwy6a zxnnHz?0x3Y(3RmJ38f)Rrj5@#qWssIF>^b|3B8=1hB2E${T<0Y4Il6k|j%)yh^eq zd6g}BU*#>1?bwbJJBgglS(>fQ+NOKj#OVUvY3V{JWrhI;3I&`vv7M$saax8B?J!VU zW*7#(`QYCvw9E|4z(*VV|2y}-_w?jAZ93mK85-yMyt|xp?z!ildlo(769o}>7v08j zR8}%SF`mR9+!<;J1%v|&yj7@LuTERtrn56+UxQrFMtn@4^q0|)T-1iN#-oc)u}b&? zR6+YpR=UH0CxW!lt1o9Z3YOO|R#!Rc;0Ch+iLlI4Bx%x7XE5Jt&-OS1f$iBP^@T6k zf+c>d-IA7Gm|GB~8id>lP@qo!gS?jWem=W%`WlxM37rU$`7g*60vXX)?^B#5}O4)H%v%DNfHeHqQK*)k5m88rt z6Qe#~0uk=%%LsIYBP%QH_Z|P6Pkiyz+R5?Iwbz!n2W`1DaUV**Jhm#bdS!2E+0f8% z#m$qqUAqq{U{@ZUSzpxNv9fZ(rxHyP4(m-)D>x(z`kx;eSBkRAbRb-s#Zr;ucX<4v zpMieXMhpFgH>QiIlLccad0|j6Fcda6X`17bCaHA^Vt>2j--ZLrptpRPHqd{`EX%Tr z(sh`g-{Yx>a~TlKn2pa8)g6{{8^>(|10G&7sil+DH!L%uWhV*#e^_r8`wgE4E^RaE zSsaZFe{jQJ7HwkxlHm;pml+N{-=;T-b&N_j>@4b8*;&-{GE2Q}Nyp2sBXQ4Wp36$t zbR7D>+p&iiol+~41yqSAop_1SDvfA|(h(O?jx6#j@|Dwnmz53w18OZNK9(aE&hl}b zF4>0v##!DAG$f^dQCDc(A=nY$Tl$I8Qj4Wnst}=4iDg!bMj;((-0*n`6`DD;IBK*C zjw#VGyZE~qheNL~7VY{t{O2LG>RIo@9A0SWy^9(5W@JzxDbo8Zy)V8EJqMZ@<}$LH z=JMzwJZ`9W-|XTyW_-RBI055krN9gO7Yt0V_mhSpVD92IOkWvaDA2uWgvYkfk5MzQ zrtj(-zAXsk4_%*LAGW%RrP^AnU%;YhVN9PxU!-69VcTPU!MB9kKfhqmU2k{??L%@q z;~zxYqo zi*xZE)JY+#te5fjV;OJ0-}!uIJZIruOU1+em?LTZerO1+j~&#ZY`Zl-=+v8B z4IP6Olc9p#!t^wY-Rdt1+K{oW6(IwEUVIEvV3{4oF0YAaptw{}E>tfk1h5A5Ocf-s zUflNxXSXt(VZDup60`zm)cPx0-yk^fdlE%3MyG7av!Xs~azqh^VRfVnx*XlCn0zjl zV>MeWX8bsXvfJ#2PX0|?6%9e&qpHiLZ$ofta%CX)Euc*bAx+wQ3p@7o1xg3@wtef; zU+4WqY#*wdxO>RoXO(h{ra;H~stD4ZPpmT*pBQaBJQgt<5D&K-vvZ)ru0Qo0CTlcz zP78v0Moc=66ux2`@h4Wcc;n*lq+$j&!=dIGl;t>TW*HSIc(MrM!KAmXp!GG@in&nhFR1m@;xmR0)+baR zHueY`TkM$c=txRZ`dmDZmHeK;Fkzq0wVvfNw+4&xe( z&(MCM`eQO&6;Wf|{JM23S8_OT6ui-e-x}V5E@_<;BvF4_$4YLAp?BHaiSN|tsNo%E z6+K0`2Bb+SK>1Hme>RFROwq&`4Ivq%T*Gm}jqeOTC}}YCld>$nW`F$tQAf?XX!^qs z=zsp+rd1PlcEZcTtHu%OEat}~l=+-=_rlZQj`MItJ;B<62ZSn~6Z({PX%B11y5sHC zPf`PGXOc_l2kU=F*Q^JP(r}f+`ezUoxJIxLDpOm z^4G=@-K;w28R@JppXLnA{0D32w3`tQ=<;bSNp#I4fvGwcK_bH`^}wm8fy|%J&zI@P zXZ7o(1_sI3H6wkT#=>kd2mJwc4s*Pn&w;h`In1#+WJXirv!a~@`sTA>uzVI;SnV{_ zc`#T$4|zP`-KMX@ZNs1X3d7nt@s-7C!7?RQ&o2ISx;iYRG6Zvq>g$L?sejKYCqAQ4 zRR0`n$EGEU@^;qqN!ByAJm`UT-gC$7;#<=lofbD|UhpoT15WQvGr2jToRHaXm=z5( zQHMDPb%q46W;7)h3YA*@o>C9~bv9ONhSL*%nvR96q7}88*iD^@NA3qoUVpf=gO9nV zGC7hP^@=SLPLQfOv#y99df2m%?3CivEqr_7Utio-ci?XiUH9VX@XOcT^UA&5yT2)> zeZKj+eb+YTcSf6?b$8USe*BZ4S}W;1H$48ejjN7tuJQTCiv!Uk&urO!@e9WalTAfF zSCT0sdEA~`-BJtJCy^*dIK<6lWz^7U?0${OFEU)($L099~i6Z9a7FsS`&Jx3t}L@7>Y-u8wA>bXRJoIXSDa*y9k#&8znwnP{(excu#F zH^lsg6y$KD#VD%)#f2te_ncr6lcElHw93@vHksT_I$Mz~WO7@)X0|BM&1CW#Yyoe8 zEiud6RBNbBT-ZfgUz}>tI*D-H0$`1}EhNF%QzI4$BQuggvvSgbt68vjh3~Eh?Qke6 z(FG?CoqY1^J8A7DyPth*^3Ib3S6I6t&-K*jC&Cl=#~giYM|;YEg<$7sY@Jt&1%`5e;IWkazQpuL}ft;;R&TX-$l?-)xlVgWF zT%Y>iPxjXz_@ai(cRVkeo?V8^C6pAr{e5m!0=O&#oPkRhCN1>3YY8qi9|{=^32@IbI7k~UT+2M(yi_<&9X75a zeIW6vKRU0Qns|Sti7oybrE_nBUqZFdz`tSv6SKIQhhL z*KGUBlXo|tdc>3}kNvi8KdNDk%n9kD;k3EH4%R_HTGX6sPDTDqcQ)}&TFhODLRsm8 zp_osq7xUzs=fzB%cdaIFChvw75Oe9%P*h%?T#aa3(EHurjnm zxab_D{GN_EsA6dX+Oa09;=nHj7~0{Y4ZKILt?xfNQr6kL(_NZpY1sA9So_UY3v-!S zWjp`orW2y){*H$pc_@1SOLsK8>|hxhAE(kDSZG(x;opWcMMZiGso>_Q$AheQW&?^M zrSh$t>dMW^WfRJx>aX%%Bnb?>6VjoDzZ;H_l0|-;9LxTI*XUasb07u8Ke@sg$wgI- zxrT-gC#oCEQ&s0L?dkj4hU$T^Yr^LjAAIRpqsu-XUj;DAFh{yX>KihqpJciOTM=u2 zQ*M6(dJCPa;pFQer+b7Wr=8ZO=S4k&KdqwvjKv(rF{(cY_i}T7Ku5pm6iP+?Of(<} z?Ur_0d^9!I9xP~#6uIhL_~)5esE)RR5)Kr48Q5S4k_Z%pura`W7VzF1?^@oq!e)R} z;L5unS$c>GW%40C2T$lvswJl(ykUuyN&KHU#OlT5jI`2?4_^~|a9fSbxfXr~NDDH# zC$hGwaP-(s2X~H^4jt$|e6LSmbmxwt!#+dT?Nj^Tc-vxmtMf=?%YEbJl{-Ft-J1D* z?m%(Cy>TqJX=D38{p8Lg2X7H?TR1s#>zb0aJuB9f`^5Xdd%WeRKW{wNBcE#q=z_Ql zubD!?F_h?#aka3=)noL_l|#)*JykO+}|QhOjWQoHW$$vPp9OwM;@Vs?77AW)(> zBm9T0{NT+68;`k-{yWEr;8(H!%7xGGSU=I-+#X$vEQbjwV7nq^Eif=7Ok!7bX?H~< z?TXX+ky1wJ0QN>8->j>ENYY1Bq64^XthB6To5K`a87zo4MJkG1t+YL+V|Afc+8-C? z4MJjBvqiuT96>UEKH@G}25A~8b5;9=ka&BZ!G8xsBHuL-LRYW!%lff z8odXS>7SVdnlp4s|Hw~u!whTxDQ}k^QrdB=CHQ{cGR2KzG(OMT0*tLIm*E+}A!Ii6P~l6au)S?FZL!r>`rjY{0p7V|KU)^pir{Aux0 zJ7Tm+;``16el^jPv~LZj-L)hHv=B?6o&~^23{icl8t)jV=KOP@%8S2qnD84Pxv{Pr;zfatCQNpTjI$2MV{PD=gh%6tQ1u1shHDwE3a zr-)8&$i$kW%C`I@uH{e199~l+us0RMDNgnT_0V931z9X&C%i%DCLIikSds!w(Ql3k5e z2U-`tybLaqV4Z-6L7%XX+mq^as0rGbTT;^JND5bk zfr_&+Pj-c=I{_(*q_Bdm)KC#FK$pc0lzr%MKnC8qAJc4N+pZ70W< zplfi~RiG<68n#cYX!2DRq>FK^bu??RHWZLKi0#IAfwdLFI$?6k*{t1->#!S7XIFR` z`>Zl&uUeID)&*oq+Z9-`!V--#Nt+UjHdO?&*M;!~#B518Zv;PRHl~6``D!d%uQby3 zs??PG8#3Rv~b*VmHNv>xcW9z_NO=KL`Pk= zq3SQY5`+bln}&T@XCACPxM5Uaoh}z!XKrp5TW4C-mz5{wCRJqH=ze!5W=jfc7fDAA zgrvgB%dgNQOUKJscnB-}^t8Id_rKH)E%B{Xg!*XK_UvPgm#q!*&(Z4CE~)#jZ{Mbz z1$wM0h+M^+=7a{Usi=r)j{zrJlC3fts0>tE3$4L`l+@s~`tp5@fVTXkh<0uAZdI1Y z&H^s;mQqo>Bd=<)i5u_zzdS+9PRmWd;<6Jr7*_9WbT6}d;#}hhRv&_1v3*Wx$LbL; z297;l=}ITYwbw=~Yb$GQep{K}U#U-V*!;f&xhz`c_Q*EHGG6o*r&0l0S)$L*Nx z=txP4TXq&~y0>*d$7|ftvpG^2*A}v^q~zm@3nZG!!hDV_%;B)a2vpCka;dR!eZAEe zDD~kI00R0x#L(QRX6IKleB6F&v*PGk4p}Bok{jP^MRE!n}HdJ*YwRUHtcWm4KX7RP)p}QaJA3Hf7@)wSK zOWTe-Gf{VV|E|)=1M60v*xr!aj2w1T_B}uY(jO}U~|Kzn;-!?t$YE`3$qAh#Jn$5}X;&36? zTA77C2wm;SIbT*)HUEk7S)BQOda5F z%oGNM%<89Z|F46eeAL&yv%@*E|L#?TxBPTGy!Ytjz!qR-P)xt4Xv?ONZ1Jxn6RRrs z?Ad#9G`D|jlXO#l;rKvc+unVlG+TP|L}gXB&uIdB>T`D-y*a$_vAo!}&EApKc0zY8A#CaX9{*pVm2XW8iMhfR9gxslJTW% z5fx*UJCtM91yK4UCNZsDG5w@+Gci%sJ?<>*LojbSs7rs(GHqen9h#1l`QqqdH zO;GO9L6S1e%K1Akjf5FkIbmmRm_%J0pH`a!9NEEt&*4Npw?{`NBN3NN3n$ybDN_r* znpH77xYRt~+^o|naGa*Bzdy=w)vP~hV18ggYX@Kab&{Fv;DW<)?g=nij;kK!I+~kr@m-MyZuj%TN5(~4T778|| z#aevbCDkn@Ek*TxMYCcmEUCC8nst3p)$q@AvAVkK%xsdWcwWe4W@WxB@3Xk@D^6f9&cmDVqZ%b!Jy7*S>`i7h&TTx!5%+qt-K+|xw!>k$N|K7fx_m22do!;!y<6ElsR@|4FQ<$EVVRc$^BY8RX zRsPh$&k2GQE;W;-yy|JkM>4iVNf(l3rkNwlB?G0JK`1kaX(_PrIuCC?gdrxh-UMkwR zVClK#x*eNi6@UG=%8cK}jLU>wr#*g>l9)4!B-*od)*Pf~FVbiH$G!{ z3l^VI;qIwU7|fDR*Npb!uQM$*c_4-UoTUbT=#54nO^=p2Du-)YdTV+^oug2$Qm131 z9UYyV<2yPseff?wAF=tFShkP&oGZRub0A)qPYIdP*=0_CM7T1yE04db5#(ywK2n~$ z>Xzwy9-Tj0J$l3SxuwHhVUsR@^SyJovJKGObyXW+a0lA}IqlaBU<2$pannRrX?tlX z8pve(;Kb(8zN_8`xH*4Sf0Er40~g2`iO^PysGp9S^RmeFaXOZT$P32tTnxy&A6J6J zy|37R%O@V+d*qAP){J)E{mRGofA!{ei$&ZfzlVf&p1RJ^`GqGm+cpfF-&Rr~rH=V;NY8&(hc@PBI@ zkGhzP9=Ex@i@l1lF{xM$w)+XZNd^j=$DDfic;_h^eKNLYbfLO4Xq~94s)#_h z%Np9Mf0w<1ebtbM83cv)sT_LdJ7YFy5&xcz7H0(u3D0L^h3+gTpNvy^S;ZEGq>=5F zA@-c1=p?e-Rj0?zahDOn7HIP4mG#>6X?-W2KemJ%Rl7fT#8CTQee-ZQYof@v`LSK~ z3RNUw@Y160qC_v0b;5eGl<24Na_LR|CRijWSPS6g33wX?9oo&YYaX;!k!R@HX}Zsy6h7(|m1h(FbljbF{H;<4w`# z{i9)#OjSuxZNfFE4sXe{bO6}8uyM=`3Ls*R!zi)^CJIVN!5fZ91Xk5+lp6j_+w#x(BZBfuB{zyE_^_~k(|WZO7Z5l zd8!Ns1H0wBvDxgPP$w83)AC zdcr{kEGUQPgaA+wEUUyWoQ9dq4o5EixjHa=T?TF)^qf$Z5v&w4BH3g*f~i-&m*&9> z*qUuxi}&#y5b<`z^yE`$ThHxc#yXAQIc}*eP!UrY%DYX1;YM__8w} zx?@rfe?Jo+BKn+0_i&Ox;wscFkG|wj=mK)$HIYChx$`J zcw`?b>e|v&x2e;A)1mHN$fx(c(ZBhtXNFfFk5z@%-`wAM&z(1hQ{A~ash2LaY-;y- z+BY^I``5AZ-3M==2sP5!^K`!g&vn3y{h@O!y&092)vd&I{_@U>9>!_a{)+1A3ct<` zfue_~S?$)3jE&R{me-LQqyYo*T-kZ1a}w+_Sg3WH`1vTDr}zvzq)Jt?flU2TJZdR?@etO?>k2 zI@+B6P`0zSHeBq?Y2N(b>6X?8&)CGSh%>i*^p-*0ukQHgZ+>BAXnkie%~6=;_Slk> zlTyPz7`mlQyRPHY6Olu^hONfoOP$U4j-jrb&l#v~=_vGfMx)|aeAhIseWpD<+nVC) z^;dubO(+!uJs)-l4F&R53V2IZ3V4YEULE;cF$!dJ3It>d1Oi#Y%E7_>O1DY^<|7IA zV?H@dbx;UE)|vk)1(;d`=gBz!VZQ=RK8yyUJCO#(-J|=5?sB=pr#9SKEMwn4;QxsD zcX{l|InGL?IaDx@m_U2L{t>VbE#fme6aYhvai4H_IxEB7jQgs7x=1K8!H%PkTDqgv z-9`A58O&_9mKB$={oP_OF6h8dxWZ%<6ck9Qx`HIo0{dKkgP|)bGz-~|t=hqut7e#l zE?#G#z}2@I_{%r)0%Re_AlOzB0s&ctL#h~HCb743tg8%m4&n~S!smc;&r zm&8CzNmgFnVAasWhgKL)IdgKH;)$l~MkB63b#`$3c&|xUGj_1Oy|;4p!RVT;-}uzA z@#^w5H}oF;R*O-bFlM#%t`1g>G<#N_oIT`rIJ-P5{{LuU;LgQs)SC7|kz*P8@CFzDuvBrEOz)3F>}?a5eb&9UaBh$%^|5gFde zON{RCFzmCWa_m}zH!9ln+?Ad=;??pah>1gyxkJ@kk(c!=>#hE#5=Yf=V?o8uJ>3U} z%36;9-Gd7~2M+bz=sons1NFL(U;0Yt`kJf>Z~KNidv0Ot`nrx=u32SYcw}&0u2p3(n@JZ}ECJq)#hC3hDsg(T>1Yw&T!@@9Co#a8nA2Q~ zzo%km&25|CSy8Hk$nAcYdAwPPV36kVl~Ac@MXce)K5p@igk2qd!-4S=>nf8rbA!2cFmJj(#=vy`|47EcTIt}ZC&KR!dyyvnxSOV6Z>shWk?m# zddo!1_BCr?+QvQkq^!|T?r--;$0|bub$RlNb;DS3nGhwrLLF9YE5sudH2oH{Akf-q z$w6B3nOHEJ47_J!*@eyNq)?oW`6%#>6bY{S(@$)*5qS8KgP*coSaFntjMkfvRC8If zSEY8v5oEz&iyk;IT!YG3`sdaiA1jkrZO^l%h_~O7(zgHUJ+$^UmXhlFJX*W2b4$zT z^{E+r`L6m{hpp9LJ+ilvuiqcrvN=`~Uz0sYE8I2iUAp<|EN4a9|W>zS6qKBbp zhTdf+D8!`GWd{jA;tqb5M#jn9+=R0#U6OA5{cp<)hl;$RYd(G59j`nzm|xxA(O#Y3 zch}5;y`SD4sTtfjShMa6|GE8#-yix?@5m!7*WEc=9=UXb2c~=i@IRQ05hzFcPa$|%bQs?+HmF%6DD2~PT~;glrA8P;$&W1 zhzOadC9!UHv2(hvP8;WfD4y3yUnERJUz~xxTaNBYh~h!~3$+WUF1<~d2Rx#c2wwb; zODGq#cm^Z=Cg~@F5>fU|{FcSlI47Nmbs?xxHZXsEmWN(k>Ff*fh z8^wGr{s67oNU&`zR&h{&m-t0k$teCze`$eM4e@gpHU_>rw2QV&3lu|>H@o=WbRMJ= zTOdKg@+mP$iY*J6o5a@`4U{jWO8TO*Ql1*V7{u>?oOD14AV%#ihLek6a`dgA6`Q8@ z`gq@iu(h0JkTZ#pxN$a3r>DpJT!r~&CG`1HgvHz09ziBN^;Q87?xj7xRKwtMAIZ&C zu*dcrVwvFQ;}c4zgt#SqI%@GLW^RP&Xbf2trhb_n+i29&4v`JnWT}S9Zu6r*eC*ku zpR5^ee`eti-+$tbC$@RWQpb$ZWQ)tUr@5N8^@@iUp4xKnx}e!z>?~zQIG~DdMIz(` zvu>p_4~(cSi9&5oLzU55w?tlbf!np%t;8yxC|`Y~XUJQGhq%Vkh8*ea!V{bCTH|*) zoi2CN=1%dDJOb?lTw<%HOtO6|C&yqnhWBu@0H@P2bPl&mj z)x`Zh!eZn2Eqhk@7=Hzl*ge~BSLGAgGxsn^j0oAOfh?FTC|DZz#~}F}2t#G)R!%i@@=z= z?@zb2$#Jm!z044gdxTVaaq%_Og(GQC@sEZ0CWLRI>7kI(*rwMt&Lb0xEVB^{EcXzP zhg`OY2G&DEgT;a#$i-K|74HG-`7ceJq;}qjmt?0?AI-b3FC#;thD^`RD!-hU9@LpR zUx>fcQ#+^UdEv0mEPD)-K|~>_{8k8x5-g{v7S=!M_bbx`Eaxi*%W*D`hq(t6XnJ1S zBhxOJaC)AH9gNdDm_XC>!U36f!33Jh{mAQ_RM&Yy!?%CXQ#)Vh1>t(&3Rx2L2o@y^ zk-E_MN(q{;^n!3h99m;1LZT{ltpv^2Dvyb^>Jrv^0c-ss<6oWl9~%C>fHleO32T+x zsh@h?&4=&v1boj)pOtyYDgIG|?>XTHr9A=Pay!0GU2{h@K_WbEdwsM;^&Ug{~5%cR8+SPV#%)8u9{Uq!GxgUAIe?wkxlDSXX z^Zx79KTekyM*6da?0(`v34E-F1NFOPO^Sp)%GLzpRD#j zE1uBNEdlF;?+aq$sei1G+U59r@)eXdPFa@epJR|b3RDBxGO5OaGC78|oHWo_d=Bzh zd=5H^&jDlM7KG?@Iv*1Q-`QvjuO>vk&!E_rd<#m5e3#q#x>?^Cll6TgO_C&s_o6b7BpbYdAWz$X*WHT39W* zmGx-xEsvLoZ_Mw!_}`0-Y@NY`b)Hw(8BAEG+@82j;P$+D|014{&S2V55T2jzQ}PPP zu|t~ZV*!!@-c++oM<*{O#?kb9iaMrV6>MV`?Dxdkm;Ij4Mu{?3`q#_~hr}SwYH)>| z?I1oYh4(Pp1@K-y!-XyZ7Z=3ODQ9Q`F68#haB)F=aIs8qOw;iXPW#SuN549(LK`&} z8{>jsHTzD%0=19nu9f#=eD!Mkl2xnyuy!pk&xyZW+`SAh&xubi%gb_m;<_+T@X+D_ zz35z8&^wt$yH{8%Ja{@e7q2-Kb+yc15m-;nh79fR=u4(x9!Y$(kx=sqx9zM?6dE#_?*Y6#{u z)Kpq7EgXGw?{%+y>GEV07N^~o<~j1z^ZV-d?mO5j?w52BYL~>$Zg+W8VP$7o76Kil z6=k84h^w-@jGZbA#}l~o1$=OvQTKQPcd~XtPt?Nun*=L*2do$yg|kzGc=1g-Qx+^6 zdR|OIOTCyB&FD$VE!)_Wo7=OoOs^Zo9old@5Wq7qryrj82U`Xi{aV7|mF$P|@H$Ww zcFT3ixp}#;X(vb1W8tCP+@Ub4t}aJPxik=Wgn(6V8G42-h}UH=btt^f{8Q;6;{)g# zr)oW?Dq>AEk$zGFO<^gQ@A@A=UYAPRd?Kyx0|+bbG?jL&Z)_gy-n*(g^~z+9#Yw#Q z!4#JIIyW}DCPHI3u0(|+Wv2y%E<{qUMeeGvVYfAY6J+ZZR*OcY5gQeaXU4{ciKJ(P zWo5cv@@T-;BhsD2&Rer?3=vx?XJg5Exr|8XV%0Te!)@>?gQHkmO%38JQ=^txc}*_< zVBd|5$)uaYE@XR<-k9iB6@lesi&ZutdtafwxO69iVy}~l`s&DbRhtp1-IMUYtD@Rf zY)H|3;J{l44qO$%K5S1eJhgZ4UO~Tj9t9LAr%WGSxnsg+;q(Pz9VoP37zc$mZXAQ( zUecNJl5$vslA_kZXkYo@V0oX;6lphY*tBsIXml>-aFvhw#z2tMG1qFMOGeD)^Hs0k z*lw!Gtmdg)Sbm!7YI+Jh8>{Z?Hgw~sE99p^4i^v)@= zbTz#Tgk{#{(lJ0AOzY4RPj4e?1gA`^#Edu1hi`vy{W4P0j4d|y%CY4$;fQ}!MW{@% z#N0RoI}cX9xkOeDV1HHmL-2)Jk}>D~|4^jp!vBg>jPmEK6SfPxgnhzyF9c+GGSi>#R zg5NJg=bp+|5rkfn6lf`-k!e~v1I@@OF^m&$tFS}(=Q*Jk?rrJm)`{mq^=-l?P<`{} zjrBzJp@E?&QGG349HQxFN9oX7b7`r0?U3Gxd=totg-TA_w`|_RXy4F0w6SL+qkS`k zZ7N=JhnstxrDdh`+8ND+!*p_K5B{VVr*GTr$t}hkHr_sqlj#j~DweD~@G?@%q80*| zKYC>&Pp|A)CGTF+doDjCnbbuM0eTSAoO4&whvMg^&ARl+WExbW8SwG~ZAnU^LQ4pS* z>I1zY1AmGxngAMgIlyO!7Ar61@m;lr7L(pdTEos>N$XJz@w--+Cd z=^+(ra{W~uz2e)s5leG&eo-LP=|JkF&NNe6OJ#1Pv@lgN6@GvotflQ6CC7S7;nbez z%q&}ZVBP+Gqc^OM*sAKCfofOrifpC>U%ET41LL0evUv2*9rPO4PuH#fe%S~^bOxlF z6;BJfo*>t+_js5Yo8M|=J(;xR3sa-Gr6ir*xN$J|qf&KfXk9K-jb~!(E~9XNxvDLH zWD3gy0S`q>DE%*-(j+s;OZ@)@z3VkHWc^$WjZ?UWnruj$QG&J6}S z(%UJ|cE;M@WKH*c`mh7H)BatH)PRjQT4&Q6xisy?F*%ya{w;{5s zsr|huZo_zFPc52Vd~&*|$l*|VRZwAhpK(~cGd?*T3T0)*VX>|^H2qR`QHgBcIYLg3 z+$ZfrIjbAS=Y6Vhe!=gT`(tpI{+B*Q+5=w=dEMe~|8xyWaQE!u1JiD|+$HtMA=MuH z6v$$NEH0KiefEcs>r#tmm93H0^-Lo1YASL736NQ#*&(v`c3- zJcK>Ld5GRq($eC*K^gZnJfy<;=l!Twq=l1ysiF0E(BC4_CUwhXM!2XeU~=GV>^xw6z(mj^q81XWGJh>ND*3$h4*WUc~qGd+Z~rbH1}vvo4lFi@_t?78?)a5Ih?f z@T2piqjJhE+D~}PQ%7%6t zSM7)Q&$55<^|Su*do{z@0>)v#=j%T&J;3BF-cjZC2jiK>upZWq^>Da&#xWTMvV9(N zQ8JF<8#X4sVPn$UuhF32G{0$+nt6=jfij@gs(84NkO7U_IUX)3^P*Tw2G28~v3BL{ zp8O-!331CkFfk~ zOw3ZH8y-e9>?_k6bi-?|vcF~wozg$zn->h#`Z~U{-t^v;1>2PqiC!rUGwch_aWm3` z{0r%Jb7{lfSR`+~1!nJ?PX+uBoO$`{~z(3^e1ci}R#TAjXnq~KcZ7s=Nd z!Ycp0Y#6-sEq>ob)+K7^{P(i-l+un^Uux(3P;TcVvv$4@<$kCgJVp8f?L+7thCJm> z8g!&~-ap>3m3HtHwe$YvcHTd0=l#q5@OCCI{*CoNW7I414f2BI2(ndS+!@`l($3$` zDLWNwA7c6>VGcRR0FP``)Xw{n$0d1>{uxi~oN;Q2e|#3tSc_>uTVadsei&U1|X27U0k&0uaLTsCQ^#yJ;R zMn(b2XEuW*MCUoAc48bdo@a#ii8vmgmnN^s44W6rvZ0-pGAnko;=<@Pd0rYj3&hd?G7>Bq?4*Db6$TV#tyBY1w-pK&-s zcuUuxjVxuWxUhpDu#gGYBuZ%RKyM1Hlf&5_z(bpAJxQgvO zgSI`H;;uAycftjWt_cw;Sk|y&GMQ2wi5f|zK9NZE#fi&4s4TOpw7Ti``TJf+==ME1 zZEcNC(UG{y31v-PP4{=Mz9UA@RP@0Ao23hqWATTvqEgg%*cDC5YiOt~6Kn>SJE6>% zjo2`9DmMtWhHSrwJC)~w#;JH{67motn-_I^Qt?)Sg{E?%N8GPc%pkoY;5AoXFcF@D zH7NyDF%@)*FPcTTveXZnM?d7Y(X76%PP{3M%0-;aSbs}rroV2esc_;`9gSbV{uD4V z)pw0UOpoKCXLzfldBy57M%%8Y2YOcARIY=k%tW@^Lj_TXR?kJpG@Z%r4#<@%^K8Wr#d`Tt5<(+6#}`4m8hZaY`|q=z^z8LLa01zPllV5nVOx#o)_Z$~#ltH8dTuU9 zD$EIoJKdg<6yGFq-+l?`#g?jmxI{s0=RGZX2O){zzap+!lDxNdA6s?Z!Ccg<; zsBkL5A4_RRY~RlSU!-kk{eV7bhb@ZWc|W{=mVJu)ha^s7O1EjJ(1=Hvs6-Kt5}lGY$+?V8j7 zNq4P$)@i1$Xd{^W^8&*e<~%37sKRQdt-xa5)GzS31XeR;rV%mTXRyF6!D{B9nJ$N2 z2qw@|V+BZ{=Xo(*u>vH}Q*H;{g0$aMddmIqvq%3ADn2f-xxmxiAgfC0%r!1kJIMFp~tdFz6+GK4a)p_&EVDsA{FO zC*VbHzl_i2e$ehr!26sbqIlLN^gkzDQrZ*xm)luCTD-G2Y{PU+T{UIZLD9sc;@ReInoITo{7)I<~ z59h&?$ikWJ{wETY!-OHF{Lk1ve!_g zDMJzPgCl^)(vyD$e3=Y#+6*3ToW-M!m*S~jry$A^q0nR9e-}%)&s1p%KSnkk$`^D8|eLV7b+jWRLjxvd^$>T?o zSeha`tGpKt>RycJ6oEw6lA-I=)sq zQr19zYe*0U3Y`2SMCvP-yjT#`+i;Z!VJqa9P;6jBDMh?WLJo$+z(&$QchHbrLDvBOc(&t46o9wZB^K>fW4A;nvU_mex)TQWx!TP*<^4U2PtIvZU9}*d4zI#c*Gn-Je_BxvBoZE(xc#gxV82idz;J zFA|Rc3w^=?%21&{>nZV+=ukNVSa9efuoJn* zfeY+-BYse_7jOol8wdAKp`Q{FBWG769}`6T>e-HB_+j~pmO~KTJOgdRjpsXh77qurnV64Eec<)G#YAwWfzy(pZ2 zC3G1KdOh$3j7bWr#)RDPdga5XN+Nlz|z z8RZ4#p>nWid3m3w$_OvzEu;ETAz=bT{zsP`(S=l z(8c@xGa#{L}YGZu#1YiFNDi3nvUl z9c%+1&Y%hov;Dwed}mK^Eg3H!@P0F)J~i$RFY0#~zQ^rv!|vf>7cc!u+P89!_~{%W zNYSo9Hs&@q+TyX-$_eAA6DARIMed3f_PEc0eD+}Uk)@-@+_6|1_io_YJiX-dhp^9ZkKF#Yk=p6hQ`>R+;RS)U8{~e6 zc)w%UjEz}4lz!=y5S@b#g6PTE8L%j3Sm z=|kyYIQ*M{nN$pr?V*i*A_0Q)c_y7NJTw1TT|6#r^M6;@V z$L7PM>tBO64l)jF)&*}Iq958xYl*LmwX^#Ww3qn&d6Yid@!E{sABZxdIy{H!;-H*bbq z6*cSCd<}Xe$vhoj^Nj9k<9>n9`|;M+y7~`TGrnegqO2Kth?H*wj|T#Uo)1_veM?en znQvn@u+Brb#2(gb#L4t?3&k+p!Jmr#Mv483dkjjff= z)1*Uu&Kj!CK{^)-dC^R$DXp89Wj4(Y!}kem!D**{9oV!iyQyElO`|99oA&FPP0KPI zeJ$@YntLM0Y3JU%X<3%z-!FXCus3M|+-_uYp-(r2e9FKPMg6CzE3%4NWOg&SBqq`N zRxzlY$()>cl^qQfmHalEWhn2Y*BiH+gSV71k;WN3rH)A<IboQb{$>5})IiLUu^Y%gipxU+S0*3h`ZJxRotY z?AolYKEaZoE5SPWn+jPjmyQ1O2M)Y+;J~&62c*B%#RLZZa=29>rb+FleV2_2WRbO zZ9lw!@(E2-`ah<=k|0|=+Liv{7s0sYRmw7scBOyT&iiNWO8=}M?4k(r6VFNk%DOGC z!+8Nu40xB*O5_FJd|)xbe(d!;@-aGu>lY5Im`f=R~S6c z8bldq3JBi&X|GpK|3f*d=N24@{h38&xd`f%-7-}LOR4cpZFMc>lA8|Matz7Ds^zu# zV=e$6!ZMa)u0;%P%9&VgnAr4eEF8+uMt~P3GtD$-Aa_MFEJVofRwl5lt+c0kDobVr zdq?KfcaWv`^><)6eTTxOk;T+ukK0Shpv<$rrK4`OyxnX3A>vmn{--ZWN;fByWh$>` zAXLz^C)eN{yzb!`Rp184#tV19cL4tI{%O3mDaX^LOo@Z2@`fA`LoWoCsLuo?XcGb$AZPV3VJdhjU~(m{mHbI}XJHZ}7e z+GT#G=oQw^@xl6mc7y#Q_k;GwF5gis*V2pP*Mv_Z9z-W0|JCu!+Y)#CIAWNByRSzG-Puj$^jl#@KFaMD6E3;qh+? zWr&h&6}s@>TA>#kZ>3+zA=+AnED^Qh?AF?qR_n@IolvMperM#s7y4FW%gx04qS2=M zD!g){np0JMNqs$8RL{oh{e@nfurSkm?Rfm;nM5dP5&^bqxTIWE1qpR|Vt8H(oZk9a z4E2)dPgFjRAaOR^gp5&q2$*Em()i;k+@zF%X(|k5LjdL6l0CRKDZ`wcSGS7qQ{RIJ zD&1vGg}&x8m*=_j;=lW)uo623T z@GAuNJXIV7ex;+i3+=tctXmN^{ArBq9TpQJUfB@NH1u_bI{?C zsf>Gl!Y7B+Jz1!Ni@yl6&l)fQbR_AC~SspqzwOIl%njM#%E+HMyGX*(GpS% zv5N&$qGNXPt*F`Iv{&Hsij0a-g~U6s)>c<(deEHT+8*+z#C+C6z9+X1J=A5?h3eEE zlr{W`t%2m?(ly}w^4Z0Ii<-+Tgf4vFmC;qub=miI!B$x#kG$V-ezGz(^WPV?AescK=Y#l0YfQK6tHz>E0H^#Y` zJ(_10Xjh$ybrjNb7~4&9GI-?)QRAG!o}5{s1M<(1i+99J9ymQ&9=oRG0V|*-J1}ZX z9f+^yjc*#Z8Ittnt5%IveMsShf4fq}gLDZmitez(VAP9L{2*3cF>*Z>KS-L;>9oZU zesHD22ebnT?-b)oc*m*UFXd7!E7?Gi_mA3ve`*(Nc{|ZTe+liN1Gp6JmpssNbpw+F z1M%BBrw_rIe$3&dy&R4LFXWJUwtE&?6&lbrQLXM=k*f1XvZy{5O4yQi=J!(hD6Sw!Myoq23NkEt z-m=1pvK8T+-G`F951-ny`R;Wk6OU}IGN$3VH+Oa24OFmVO|mt|?&#QXxOe@t&ph06 z@LuoHuODrii0ps%#@v*S9e4Bwqo^;Q?xgw@SSh>&&gkA2PYC%!=^WEGqsYyI69X*j zge0O%X*vo{yv&>cxX6dM5cC2h(x&OMT3+N07N6t75mW zYS|te9pBxaUePt&RS_CJx}wUFZ&>rm10Ae^aReyB-YGy4P?$11F3>%Ooc81Q9zIjO z3l!$@X{X*M~?M!WIsu;Pa-0ASpO5=pAay&FaG%b zR~YOY&*DFnbV6}_w!m**3XbU zUMT0DKOl`{l!hDgJZ)7t$<{^kDg#9}V_N#9FR`K>s}Bu^EJ(@y-v(perq0gm*Hu>z z?QU#2xUQyj*H5lS}#SYXi0A4`lfaMu@VakmmKKq zxOGe8$fxY%%CH5z{v9k-y~6P+KT1)c2zOVi*9ohHyAwi40Zb5$-~v z#t`bylXsy~)?`^+$Wk=Fp5}wCSWV@nuzO_{& zYuK(}ki16?Wbb@$uO@#7+i99UyM+@hK3-~=Z)mt|jwB6uk1E`o2}$6>bG;J}+G}yLUsXLE1sWsU~1lOqn#+Bv+YUHXxx|8v6e zIJ~BRO*{Jkg-X+li+{Xygif3Gq4xI6)<1^e8lP~yevx_u~smc?w;P-s$&W->6%#8S<07Zk`9N%4Lo2WzI;Fz+{|fRC!< zFtt@%#s}tvTBKRhUj8mG=A#pS|Jy99|He&+zrM=n`|yfBHHYhxvuz_zUq0cB z4Wwc}Y8r<4&6r6<*x{B(%-rdz|0w=v`;qqlVPT)( zU@$zw^&C`xVwyTQ6g#(1e3fbHWS8Eqe@?v@_6fc3QS>@R~iX=*orm$&nN(0?$Y|MP19!GvlAa)kwYPfF-tQ+Xkwf4Lv%jfBr9 z+5Blf{pkOB6+hol@yYNAeD({2Od{(DKXJWM#wST+{w~1a82+!7U-(fyL=!#DDp+ao ziE%kTX+HYT^7+vB;%j;Xol=rmv%aP#uDj8Q2|4j+s5XR3arT9#hA6YBvbPIFc*}E) ze?c^7UuaEjL|u|+q@fel`D~z}Gsyn={(g-v&+#~>&U;S$9Olj6SG5zD=OO+QWoh?pM@dbxd&=FYz1_{H4WJB{`mDh-ujCuFmKU7h`$_!`|W5Cw}=;`4od zD_3&$mftVnRmScG*jJcKmwr3D2ZaOr4elKQy=;FWIPq?#|BLi)uH^^1pD;K+ zUskO`125G~*3>BPL^7u5*}Z~ey361p?PN+^KP!$Ro17d3%y!(@5~_Q>C?yMDXSb#y zvWE}BuS{b@H^g@#MrUwvdc6p>>|(=gUul$UImO`#rFgY z>vspi?${BHDszx`*sYv1u){724=tGF9k#}B>t#FaqVUrN6C{w1%*k4e5(gNlAC6H5 zhp}gbLwtw%U`ty@_Z?={t^z*&KK}}zPsjk?TYsczr&j$AtDT)qZt2X z@$Em?2<~ZdHS#tiyVeX_T?pF8W-_-`R}ro+-7TTO6~{GwBXl6Ep?zAc7OLr+>FR2> zQozg5s*Kh`HwjG)x~U08egx{Bc;V8`ammW&Gllt}@9n~N2EBbdV_raGPPl&?f1?Y* zfnn$js+@7_cr?e7lbmc8B#(q6{cOzR@L8cIK@GAx9NZ4>V0RwNOLWBZ+_e-F!c8Ll zl9-M(?7UuKVG#l#BvxyTtT{0A=zLB4ckiekT+wjH-#;eyi0{lE`Q`5y{`BORe)Cx8 zo_%$@wrwnz-l|#^ZOX6O*%;`o%CXtEnk*^0qMlt{Yo2H;Y-#TbkoIzFq1*UbVGW)u z8>R}NpWzzkO3z4VQ$;~#9`a*nmYb;<3^%euf@$-a;xY^C4JN^^u&Zm=$|a zQ%rupVG@aY1pmrCvVBWEmU+s`F6(it+9TlJ`!9kE%)?uyAU-ltUelkt&pJFE9Ussi z;CO#@OUuva{mHf8YCwx5)P~T*feA$5I44vC&mMZ;j(Cu*@B2RA3b7{L?Zh*bBp8gh zOJdR_tjbA3)(om(3Hl`bBNTZpEQTVl;=*i$W!H-T8N~M&;JLD(H-2wWG!7zizQs5q zzLuPhr{Q{`DeBe*oPn~UNQS%4R#jDyq6-);mI7O;U@}4@eK{PtNVVG=sUQG~3WP33 zE`|{hPr+U&I!rbT`fn0`ru_2ps>Bp?K}DePc1)%YmN?bntP`6pUaPap+IYzC3cE}$ z)2AYv>XWmQ3kz~8TRcUr6|U&&w1SjOYpyrb7x5P!HjbnRtx1LkSh%xIPSX>ey$DP3 z_7xYklxOEwbr#o;=cl=o|0TQFogOLibh&-7v@ib5xLqnuE`(oMv#>(wkNO-1I$cVe zE!g0z>K0NQI$ev<;>yh}@cNq5DH z+S49)x+7e7mRG5h8-qr*Q)8=9k{i{*c&$}b$u)^ksMZ>73Jz=wmHxGMer-!G8R@2! z&#*>(4v3;VK&VS1iv=E+aE0Lsa0J*j{XKCh!;l0pqzN`2ArXxVRv{T`R5_ygydjzuPl69!s%q84M&WlVYUbHt^ls7aKeKy}EZMQ?Tz9%3WWWjtC~?brB~ z|6z~1^;$>B9v`&milDYP#oc^BaUWJyQ#5NbnOLkz@L9v!hK8hrGhjVHfkt3DpdulI zSqgtBZzb!1SP75P^HwS3gzjxVXB9=frxbv<37k{>ig}iJ#G?>R#kyc2X_xWykyWO3 z_|5SgkA@hT+IU9BEAF$#^xJoqu-Wa(#htwa zj(R<%{1NeTazybuX954V9d^il1~+Ggvj7ujvj*@P=~43`%M;@(m8vQF5g{?B-s`QO zlSs{}N8{Ex$wEg*p}DI|@w&IZCl)W(dpz~Uc&w-1Tl)8|Tw}4=nCk-M4v6RQYZW5r z;37o>r*&u?8l|DAvJ4t%1VQe2EttY5vX^DSwq9VmDSbGIUXhU6O;FCjuZ=Iw*DYDH zv@TTi)y0?8*DqN#nyu^fi9f8Xar&HgM>d+kPq&Za>OApUa=+p&^tVnHO?nt4wI-#~ z$_awYpwZAC$mUiMCEY1g?uFK@kv=vaFP}?jV-d>dW@@uI$OSr|(US>V`?@xkzIHZo z1iiU|+CWJ0SwW`v#GLiHkpa1-BNlG2bJMU??hWxW(xjAuL`+BUUa_CRahE+#SZrYg zk8K(m!H`c$)Up%Ql0Y~{Ggnu%`W+d;5HibaIdv}Qar+%MbsW=uwY3%0!gy%zD5Vt4 zmokf)s3l~D<{Ci<1qb*@B|M1kAXrW~kCllEqS3o78lx*@Hb*?BIi)MoTbr61O;JZ) z71k{1ccr_c;jXMV6eKo#&E|T=T`FHVX10f&TAeFmubb1aGpIo{HA=t6x2hG~*6pZi zi^k`Lkw^s#4c6TuUW!h%zd`oAyQp>wMwLa>YAK}y#0=Ok&@e1IJIeWIf`EYcU6^Tt z{6HaYJa5f}C?8hv`R-UQpwlUS6PXh@?}C*poO!=5XU#VmV{J9LAu5gj7N?j(c^BmA zrx3e*8J^FH_wpX`k00Pr^d#dwQ@<1cxPXnijQ1#B#k_2Xk&I1bJYu@DjmIk#U=eZ_ zOHO$6&81HqUiy3N(`4yS#9X?Mt`N_e`7Ayu7dSajF}U(sVu=Vs#6t4FUwZh7rEe-; zE!~HY{)tS2_J+iz{7RghQS5Z4Xfq>|QA~S{F_DWV8=cO^ke~@rP_?p+K1Of(>d_p+ z8>Ew?QZt9;vsxQL*pw`=-4W`lQwYq5M+=KnEPjY?>7c6)TUxC5^$?v$pIKFBsO~P zC>!vbg41yIMVnHk;*iQoIJhkZAiSW`h$sR>Ss_dIrwDKyG)G@p5wQ_DqAp_iDhnAG zUtIdc#TSduk<}|o_p5gO$1a@3yW~MW1(>DLM`9hfvRKzYzeyPDU9-%nYQf8H_X#zl znM~)>!FkIYR0p#-ji$$mdw&Q4@}5fcB^qB52A< zCl6*sMdvaL&P&PDWqzEiV64Q#8RF8$Drb~es4z1l*d$_L=oR^;Ue2ep@g~Z?8|!Ma zVCg)+YB2-C6fws0@Yn{#< z(Veq75s62)t#T&yBynbmCv!?H$_65%75RrlrE7ffO}SYjScnQ>*Ytmc0MNg1Tr}?@)fL-msTmh!&cc>j8Hmk@YUD*8cwY*<5cMeGlmAz zP_;xXu(m>6Gb{YRpeA~3emq6gG5zo#SlE*@JI6TsS>WiS#YEq5ld!yJ&EhC9wSX5z z(j^TmR}S}eGz=~{6Ei;st&(wbwt>>=Vs8DvOoO^X^*mjsf%56vGctgG9&yM&gE%M6QEkoVDqkuQ&ol-5C|amO4DP1Pz5 zEJkeJS(>GvVUgbu(hx4dpFCz1)Y+mT<(mL6)v*BD83>gWN+K9u|`wzB(b>%5fTlC~Bc9_O?cbvI`Rf1HO)?9yg?FL2&3)Dy;-Q zoTNa@ig--{2b0bW+)PY+VOYt8>(dl#u-&q(TsHrmDu^mEV!(IC{)bjcF!NAVyk%gp zZ5Hx|9gQYui>-B2y`gb!3vnt*FyyQ6492_bVEPfwRhHMCiKg(QP`sN5R z!5Rpw;dHco4{9}}b`Z)J8tQ56FjM?)9l@x1Qzdf$^qSM`HOy86n+-k#GYwz|$T5y* zJPPafheJlP*L;A-y^B?P;?DZUs(r_^-1$#mY1AtepHu_a4U+9vrZ*?04YRK_&!e_<;fy`lD`uD3-06P z{J+?V9cR|LQu!Zj&8w@9u3EK;x4MAH*s>&4_{yTQ#UF z7RfGK(qZz2lAakW;3;Z*rKUOVHChsmlBUOI*BP`kM!^L$^EH?ZP8vwgonLxEd>ehS zOkCrWn4^r-((rCn&!c7(PG?jS8U!u5b6EBZD+Y($x__q$%JA$YXd}T8?0Zxl4vBBS z_r;}GMna?aEEbLjBTHg_;x4_Qk*`%N*L`o*#=~pzOkyDK@ZCZ)IF{~!fd-UQn}y|vBc9bdN9<87<=`|I1hp4O}nD?kQ6X_D_l7N+Y- z{3^pQBEq{A$YQ2xfG4Q6(_%Nncw&l}5M-2iFqRJ)m&kRtV69KS@19cW?Kk(9#>rI^ z_uq5xH-C5`g$hMS!tUApBqmHlq7;CNwy4vi7^fb9(j%{##)Kp5kfjAtSC^SOncN6% zr;tG+8GT+n&L=_wnR?b+=QpmSRG)OuA=BH(@UGbD%Oi?deQ9Tw(rMNTEVFru*=*Iv=Vk}TVoPGN;_}9pZ4JSBIgLLQ(rJtu(N^Q4E0ynC{m=rHe)VKx zBAs4cSGU+N*5z!&fd$i*1A;*)o;1}w;xWncgrsHr1Z zEVIE>DLEC&L`HqTR9ND-ZN7PV?Ec&4Y-`!GchQZT+7k;dTKv#wn|6Nt(yh0RCBFAv z{x3sUp1-+%+c{>#vf7#j+vhZ0bm=99uDh4Ep1XB@W_``lMe}^aw{%fndm;CtaG~rz z_!`n&=1Gb@T!N-d94MN!G;{U9n3i+m=S(Oe^-I$Y!%UGwAZ-MjrOXl5<309>TBkEI z^53=N%SKwm?VE32yy}*~k+GUVlewXiN9t)#r{E5h??FGVpyN!*^sqD9|xghL9oV zR5!>)8v49{3?7AXDbY@pD?jQ!fKspak zmfpGIl^^c^)}xb^=e&jII5;1rRXKja(+(;HBc;|xdL~QsYBpPP^h+;C$4Yr(@}eJ& zi7Sq6pUf_v*WW*om`n`x^$#y?knbz~bn4pDSIH{=GE#H(Td%$H=G1MUnSS$?SKruM zrekE&l%Hq7^NgGl&r=wcj9_M-N3etlmczcfErJAFavh9#Y@gFs46P1&Jx?h@wE>AMxP$cS+p1JdzmTbv)tp~+UPgi(1FY4B@Y>zVc#ryT_ zeVKFO{f3$M;A?ol5lAL+)`jxJTno4MF}b5w;E-1@d#tg=UEmjlrxzQaUI{(*iRA^6aIEdm4qpS}2zzI{-H$a=w|r0&vP9qX-55XHHQD zEARlu1gOV?GP#7rs1GR7wpk(f46i=7tESfsmrviG@qF!q?Y;ds4fWi%G%+%_%>ubx zp;O8kFPHE0H)iX-`DGm;t$b3cY+SIqwq_vb&DXC_HyPYvEAlv7S8l#$lJd6;uK(Lf z%ItwBpPGJ4W(Hmck;BpZBxeVAsO4I5!l;W%u4~R5!C*iYMDRC5yi1@-3H!%9)I~Xq z!_i0viDR59?~G8EQ_Le#m~qUpG$nA6a^40%7~bBQUeRBZ>>J;(r6IR^pxnn_hd*xjSBZ>Pr{)cI>$4yRYuqeec{tXWu{80CWHV8jM9_EpopPj}fC$?xr;wz%$EL z{V9pma&D*bIBR%7&tNHAg`x!Iq=-a`=NR4p@I76?hs^TJ z77Sjqp;N6Gmy2~HTRNJTb%sQhHEKrm4&|-jd7yx;6^fud3GcU6-cz1|_vg$|$Y;Pq z(%kS7iWx<xU7aH!Xu zyZ6??4fkwm9xT?5tT^X0N3UVn{i&bcw`cVTVp+PwP3u3i=G^Zrr8_=aK3R-h<_LH% zm7yS+>2**(j7Azzwtvhh$xxU%Hjou9cVq7gT{3eaXI1kGXlSFYWBrX`t9(gh;GB8< zHB&;%mhXM&=jp>P^42(850n+SvOR*j(4{ub_zNpwQ7yR1zVpe_w#Jh1_}k>SWbo z7)RQz8J9Nb)Z0}=F7_%64r9OGqEs67!I)anr%-D6KenH|St-6d^7q|>cMZQ?u4ql! zQifFB@Tg9&)5!#qUe~*QYxlOz+j}xAV12JmyV5389geIjNY^0><&#HH=|@pid+ja+ zAcf^xK#4-PKAX4W)mUguXPS{>0q7Q*H3$;|boYu5HGLZ)V+K9>W-18{Ts z`q{u`lznEXQmGa~9(rKU67MRfC9+51BkkfP@eX#IDu@ftR7=E|YY(>gjlMwC9_q|^ zx?6hNT&*j6b3JjrF5HnNU!DbCd3!Kd8#7133RSmUDHqJ)hCpIv&fgnxHKdb?p1Dd~jdN1(Pkn3;Wg0V;G4ks+S z;0K$2&&DRfgznz4?u^UtGu94nAN@dgZ=8VhOAjGd^*_<=WifZhqfQT`fCEO05xrjI z`_pYeAz9HDD;8tMbS#!O3Y?WIwsm(eOfCc>0YEX-KuuaLPFB5JGiGxp@zOLl_T$e7 z#u_zLgm`pJQ;z$jT#-_$1RCl|WC8CtgY2yZUPXD99;ho_=M zNUZ{pxLlA|XGb=RUvM@ycgE)2`XBdR|IC%0N_FYy8=l)>vovl;?}S6UT4gmGoBA(Y zR-ak0p)hYxoxx)>2*G@P##QAx6V}D|EZKJVnsj#Zvl}h;^unzjU6)LDjE(vRM;1j5UZ3A|_v$-072?IEnapsr z-wq4QK5*k{`3h!9({SBIHIGnTWI%~Z6;1q6a~jH_l`;i2!6-PTnzCkqNpejx;e6&D zbV-!cA^4J$9Qpn;&+zM?d1h+2pj&bBUD^B3oczNx6Y>@BeVtYcLj~2PGfy>e!$lo0 zXw;(gXswPuTF)8qXxKM7rA&qjWO!-yFz!~K4z#9rH>T0D>7WD$a|f5_5Su*@a?Uf) zoK#oM<(cwqgACFa3=Sb8ldW zERPB}ljQrEv62RD9mk=V6C!V{zjMwTB@-P>CdjZbz{c`adPemg%&$C_&;X#}JLl{Y z21-`)HkG|g50T%&!luH#MK)f=v^weD6yqb!<^uU$-T1P_k-@oNT*#C07k~BJ^QOq7 z58^DJdacx~Zkzrhx0<{8V2{g{6TS;DO;EK4ab? zc5wx>S7^uTxfQ4;zd~P(AqfxiU2L^pzkm)#oq2sgpVbRcdR;En7ByuPOYhvi{a?TP)ncf%&>BuJ%UA<$r%vPa#az+O)|SAcbvpIK{swzPD%TvWb*USQ zfuvov;Os(86|YUidkYtFm+teu}*mB^m8 zvuExn*7jzG5u#{fcO1BuOjyU*D6Loeih&*r4H2z`P;B%(pZ;PWcNRQgqsUe?C*{CPy>mW5sAsQT#D=k+fr=lx0O!2ICR@r{2 z`02fOec`Sp_WZKqp3O`C-h9RimEz^Bd=atawiSkUEw1fuU++$N4J{jQS=zm)o~%9i zU(}A#fRWEI+c=DTMvuqQs0=O4-Ry)ayFr7R0 z>y#>57*S9uah4p#nLBkHCyzr4ltn-)TY>oNWQ$R`ynAksQk~To8k{XIqA4BI>I23w z#c%FvoMRiy=NOrFHcioU4DqRNTruZ9oMYs_pd;@^CAm%kwcg=}pt+xLbnz}+pQLx; zpF~E>_4GPtnm*2_!8>l7J|U>(2VgWQaJ~B*>r8a_ymfeSsD?q6%n0XjB(r%=o`fuk z-AY!>!_+3siUXFn$%yHkD!9N5uZl<)iqBNkW4nV?dDaBAvu|WUq;<_eGQV);!n{JQ zmJP{N3R!;fs>S)%voG%-ysf`Hq2GhQ z6;k*Co+C6fOmYa(!vq$}P$ERWS9&N(E}z7njZ97R&!JCuTn(WCd-*i?v}ET%1*4;^ z!iiL2^l4Pvp_np4p5h;q#i#^$P|3*!2z}HiM#D+u4n;zdD8vd5Atx00$4b*rOx}F+ zsyE;W2MKmzC!vbjg*`#rRUirczO=SV<3*4}>p; z*6<8TR(WtgNk69&h$L|^F#{wXVdrZc)GjZNrJhs8NNP^8HzlZ(%|RWaS7Zw`dWACA z6j*ZJrzhIi4J0y?pWU?MGi%yy#)OLZuUsmJoIBocdkGE{ zUhB`rHQ{*D+`XbE9o_QC6@&GQ&uL$H&Kw`F)M}JbN2Wm|cejX^%y1z-Hy@4N5{4D6}vI7GHTpy&$qB_^XaUD4!brx&C7Uksh zm`ZhYw{!z=aDuJCkAq{G0e%3#JT}I23x+`QQ~*>Ze1d*RKjdt2QYr87STukfC>}ky zAk?u0Lhwxov@vLC6v7od9!w@D%0(N&L%~Nut;}`;tdN{F%&uDnX$WyNPop5I{F#|1 zr!$6M1jFFisvK7=8d`8Z^oQGvW}Uon#iwo^=)2&oY|pMQukF8N(_*ingy&Yd*w^Ii z^|q~OkLN>%!p2)y)GduAR@C=y9ZvSPE`I8wska)BT(Ake|p4s@<`8U&G6>VhQ+OcZ@_Z!ve<(N)7RlVDj+Yz0w-(Q=$6T%VlrtO^L#fx6MG1oVm z4Yk#{oVn4q!PT8%EsWT5vtr0@Rq|wcU29O=lxmyws$!|AVwp3m3E229`13ps{Wa-g z$}CfAmBiL;s#%i=HyUnK*~9Ka;p{C0v_Aco*hBt=)ug$WqRZs>J29I$xW3xy@q`g_ zP#adMtkBwzfxl5r3XUdt$C;If>VGT*kUBjoQ9R+qtOb>6FjqNk9pt-upQ+F@uXn8U z_x0JTb@b7-rt&eX&)YOF9f&Ay7Gwo<=NkzUd%iq%x-^fy*Bge_8+sD-K{3F4a4PyB z=@pAeRq*BW(X?o_%0&&X!nEiVeNLxOq)BFA(l5*e_0p+hb85N3{!p^kGnsL;&HWq3(cyjKBE}vzQ z)})d9^Fy_cTDPLrkZkM>=SDi}OoGyEP>G6RQQ`8tN$J;0acs2v!e(DrXPc{IWmixI zb}XB|4QqQ$c?3MZ7824~-27tXtlr@QbYV4K4c3rSnN-)+xoT?-F_&vmlYt2R-HWiu zmk@PDJLgf?GuW9`ZA9#N(V=jZ2*Aq%WDjvC83>qg?Kcueugy}?4t(N^zB zc#S-7O4xXQ;mUk}LtV?&9H->gl&(EJoW z&4T@!E5_a`(CCUbpp%bLbWA*yPqL2JxDERn1&_!8CT6T79#*J(HOqH^=og`m1pD(J|_v zmpDF!2LlQ$m1WBu*gIwaGuI(mKvO~39vw(u)S*XzvP+e3pdzb+mFQK#9G4J7!36z@ zBcK4F;yXJI3ZN`Ub13MbKOuc9fQY22!bKXJ6Zlo3sJcL!(14EKC`7-B3ejdH^s^!Q z4Z$X-J{q$lD>PPhLHYO1>kkNtL?IRYuhQG4KmAuQRY)X+1M4@Rx=yUbeCm2>K_(c? zWZNdN2OR|MS|veO_;9i6!h;TwzbdS`7Nn|J!T-^FOb>^m&~TkYQKj z1*7isFTKWZk#3U7ZQpK@=8-x1!&jdD?v2J&%6Q{C*sTe(6ypy0g$ELynzx{i#h6z_`-hhdB4wVmb+3m(|6&R z5h0iV zBtmsiKZ@uE7Ciz4L-lB>$RkC^Dg>m+NB@M&R2YHe%j)ChUUpNH@l@kc2;^`(vp-6z zHO$F0;hKI>dI4RDDTJs_^n7U$U(c21m7XI7au{FD>i&e;@`x0cX7C;roFue|LAxAPqXgJ?oO{v4X}Iv z2MN9R1bxmhZv7qUt5id7EbW^534H)@9xrV?K2C2vj$7j~?WvlYlyrX>VL8-CkbPdf z3H-_gtO-C4NR#YgE^dtTDnZo~VEBQu#888D_|Bu{JqiV&OQ3>_v3lYWRJT>Y=>)e1 z7esIr3J}1@s6dp53;5(SJ9t|x5)N98X0y>63`b%%-l3KuK1@&GHdP!b%4|Rf4LS=Z zVnL6~Vb-WbSt^yRjlh@&CsiDdLi}*LDX!_q43R*D4+)W?(KYC#0h2bBY0y?w83s}Q z)9H*yY%;xE4h0m5CMPf>Xe2eMTn9^X76NT*S$#mp`&qWt)~3qa2Kk4SxmHrpveM1qDc`-m<@I(5&;7BMOKtb8(-@og(zvY|w z{BQ3pxk~Pz-Y0CiZ}Xj{+?@o8!lf5V$1f+_Vk=7TuXyEw2fjM|7?Jby32Hx2{irlG zbx>GH{!p@?nEKR#1N@#751)KRh(AoOC|!jDwLiY;?S7zWTrei>K=O zpFnzbi9Y^y$2h(ouIjHSW`VeVY? zoTNEnX{2n^T#!Z(5rYsiQmGpP@06CDU6DR78)SMWQ9|D*i1N^q=ez1rMg&I zdW0?})%;-gENX>8kB}T;DjH?*ie)};ol;H(MY-3(gyO{`?w;*SMi-mH8p!jpNS%gg z(&1<(w(WwBRUF$IX9$A~)gRnWj!xVJz=mt3gRZ!6So05%l@Kw_Z6SASe$^I8X%7LOTLI5L zNNCGpdf!t_IXXMr779z2t{7_*mX0NpV@riLdA~l;I9ePUQjRTMI=;-P3@UjgLs-3O zP`OOGtfT16=dE4}XKxslp&6V3W(H$alaUT$@VP2zGjLNzR+hpm;YbwTunST-=3~KY z!Y-lhW;vR^Tr@#|bm+hrxxco_7OnS0x*S#;A(5_SjU&07me*$k(fY^-U_9jW0LEUI zJKEs5%;5AJH8!)Rr74c&Jfy8D+>Y+F2VtX8zq>z_EhbIwSj0=AEP(aTg0i+1P`)7@ zA*<{)L94+TFu2;>UQ#ncqmudQ!{PkCz#TP>Dnehd|mW7#kZ=<&%nW+=*4rDsho@~^*klIu9;&$>K z;E0pziyE~Sj%BsnVB*wjxk)RRLtn%mzQ8oAQ(`&@2*wPAl;uzzgqeCV$#_EVYR;jS zLn>A48u>;|W@N>N{+(&@$1+jQ7k6EFNq@;jG6nKfscY%Dk}~Lm=qL9p`v9pd*IV@0 zrNel^RZ=UrrZX87dElTwgaZNel2W3cKAni9ed9(krSyrOk4@7IWvH zt}#*6xpr_v(YI(Y+8s}IM_NXkJ^r5cb4{UG+GndXSu)nTj^@_XGN8r1`kGvuzo}iT z9nq`(x!y=}URQ%rkQw3TlaI)iPQRNky^ah)E+Jk+eyw!iH=0=8cEPvc=ZLG~F+uPNdq*{#_JyCQ9V6c3Zu|C9w8)>$9ne|Dqp_s`A%#Nmq`l4_jKs6sw`b$2#5W(CyO>sma9Gj{T7zp=xC=f{ov*vFYI$f*7I?5u zyp?=K@e`Jl@{iT`a4=0z;>|=JY^!xw8fUm_+Y$Z8x?d=M;;L&8SK4Br&V}o*m97|6 zKVOHs4_{GwncdWO*Z@nZnH2y6k}*C8gsLP+034R;C-TF~&ssSDtR)NTL*ZRiN)==5G)a&TZUX$eK^0VtQG!{39$peJ<e+-r4cd zDDfFweuK$lRyC$fG4Wche$G6((h|*w{2lcOfj8&cyL{(gq&J{0QghO2bo&jlupD;u ztazTFP+DL?e~9}cwUkePT0D>6j4L4ybxlGXXI8tokb!1pN(e6PD(s-tLMnlY@y+r! z7fx8B$*eC_gCODV^#i+~U9jb+6JPm4OHVSN3|SPfTLM1R#C1DuTC>-pHmK%nbqfY- z`-4`W$A<`I*o$dh73D6@j>;;)GKbS?weotU({0yiOm-8?#R4Eve5wk|NI9ZSVnAj4 zMiXm!LVlpzv3>n2)LBt=b`19Dip!TPe$zLw?fl6lD6`U@Xlp;jKS>=8n%Ol7INaTg&da;|_Wz?h}7RmMcC9 z&Omdf1nNOy87I{_Q~R1~YV!G-nkGeD`q_l%PCpNcD}~cE32hdqKS|W3;JithG~R#` zc?kL%C?`1Zsey-jEhGs_;?2Z_(qUBsCr&ZSip%mQ6ASVt3&s*fByRHQ^TFV@3)b%| z#s^0vF|xPC6|`zao%%Z?%GXMlHTUR6ncW<8sKgO^0#hlmp^peMK@swi-Ba)Kx~X?5 ztc<|;CfM>E(8Rq(jnm~4ksRYu30AE8RXR;3p;WN^Gz%Lw))~)WFMECYa`BQ68o~Gm z><_`oe;N4~@pHO5+_=l(egjj*0VmLrZ z-l^GQ(tlP6$i4B8ivYtf z{Nv}pb?PrXETZf@ilc*#C?@D}6bLw@eoGw;{4g6c13zOFA9os2(Ucz6(t-4$r_mC6 z0y$2dNK=3L(8I_{kD!?YiQ(^bg!~K3F|{K}iS2#OTk)9y$0x+g1*G~dAe z&}S6khyTqr@Y*s=r1{C@auwzW$fzW_8jGW<0LpdckhxWvABEA`J9hkh$Bvh!`2kQg zx`V=)tY?tYzy=8}t(D1iayV*KM6c24s^#?;DJ|jFcmgAJtA+m*2y57W zO#c?!sX$*S7nh(O`G5fohZ7Wn+Z|S0We6vsXF!fQdFZVh>Z!a3-VQz_u_~y@H0~@` zF)%=~@;ck?BSK<(N2E1r_w{TZZk*rQ=p?>eZ^GD;^t3c(jHA3jUMxLAdizjAFq|*K z@&Jp>T$wolK_94xTj?1VFYq2%2OD z%9#^DpwpwC(dtQ3>j$E$a4x{sXt$3<`(s+GHnDSVygg<2)b}M*eH~3sYr#!MTU+z7 z$u?iF_`EM56LxNP*R=&>y^TJT&E&B4cGkty_vs9jUO3s+wCgr@DR+=Ba=bwO!-g>f zAK(}A0_s3>MGoPP%5pv&&FP?4GU^9Fc!McVY-r+g^?KfeG$UI572S%a-+{TWvFL|v zB4|Xxr0mu&)bn}{rao)EwP;;rowSNL@>btAhCLWPhEnU3K z<4qz5qHSd5$Xv(jc9mPB%O?}LvzMOzsTgQ-a%!4j+%MZz}2HYG6VI}8@)N&L;GJ_2*7>E=+ zeh4YYf0JdGP@aQXUNyau(F3h4hcr7PQb~zchr?8H?6UwPQ|?Pkmi*_^r5L`c^f|JL z!qq45BNr)lfQrC#6i9VNo~r>dz-)oEpeTJDoN?uxgb=x?^uF4tmiLOtFd*ZKcyi&= z)rG4r&rfdH(TDrFaKB&Ueg&?t7%+3LyesL8#eDu~K9fONhp5?5i$l&}Xo#vIhl3*V z2v7~RJH0@iinNd^Ls)8Z$FrGKE?N1?qPTSI14}D&D*J#L`qH2bj3a@6A~8bz@jsIa zfi(_djjt#!fJ6fuf!Si=v@Vr57Lv(gl9p=2(aX!L}R9WVxyf|I)7acyQ&`y>>$>dlC0)Dwy7o4&`OJo# z8`58(G2fm{6tnI?W3i{((KFWKqLmv_JD$H^{4Ao&ehlOnb-nPAqFS!W2DSO|>CS^@bNL1sX~oDc z@mpL1BkuvUP(6P7f58heRzt^Xa4@k+VXO&bJIZ4bZI7|&@*<55)3ITc>Xg7sreCFf z@PMsZZaK>c-0!jC7?2&#c<@pMfR~8ZQrTp+PPk-%qNuinuFeca!zL%~FINtBm0G{j zycg;?rdBc|Z4eHo!E{bw9ZutN5P@VF%je^9M8Xtkc4#HyRp2lBL}5|RwWMajj=r6r zjL9OGZ@A-2!4-3rYI(<{MNeT_$CitD&o8bx-`lmepR6t2w(QC!H4EnrEPmwCgiHw5 zS(VB~OD`MF=0t z)#oeoomnTHZ`J2N@OMfDvi!_^pCtcN1s{4{ns4>>Q_n;17G6^|p2ArgUwz#tE-v36 zeLl#adD@faDe`Msv&2^#^bL*K`7?ZlVJ`cG1mQD$qC?-&*|vPvCwy{R&tBT&W8}%H z?^X7gU6 zwVh9M^!z$J#&K3dx1Yu*9vJgm(bX468Dv3vic$J8!+}o)s7k&tb*jQ&1M!XK*5iN0 zDoSO!F#IBjC!znrFC-VCq>Cza{{G%}D;#%ngw8b%<>!9u=u6v|+_t47wfVpekG}WN zmfjlM%{Cd&gN5*F*)PT~nHS8Qb-~>APd#);8+o19ztBc&v-XzxjUM@De{=Upe*NvM zM|Y3Jc)3!i?)+gQqn8QFn$j2T4U5`_&mT$7x%&H`pfW#&#vcI<8s)lCf<_*(6!QIs z2!%vZ-&M>Ty1EQ`!QbNNXs!*i<^Yta-!PaO#M^^o$Zn;9uQPCASvH7ysDP%LxqJw8 zW;hHrY*mBl9|Mv()|S%tooy98bJtuwUIy1qb~&NolKu7{0#hX% zQ+$-}2VMcbQo4tJ9@numxQ@?PU#Iv>`{tCNe*`_%{TzDW$OOJ`Z(m>e)~v@4+g&zR znnU&2k-Z}$v&PbSRMtg#A-|sWpRoEC(FV&9VV_9HiL{{H4|qDmAj zg$;{kpL>6D(3mVhG5h?yhBmKPQELRI>|@p9pVi_OgcbJ=OG!cFQmW9_V~|$a z{1`oy%JBaU=n`^m^l{RB5IrLV2CK?Q+HqVbjeLsxmavfZT0**3^T9%)Je2n0VRxlH zGs|P=ao3!%Gvhwr-5*0tZeVhYM*3d?FYdGPanV*OsF?A@5j1{OtG;sbjwY=ghtf=MG9tcX4eRJEk`u6(b-ecF^^!(Lb z7Q+IiS|L<; z22I!h45?@Pqb5Xj$_}6sLzZUvL^#&7(qEMO<$hgC*W{06{aIICypDlL$LdZ%ozk1) z90Vi)3ko=8Hpf`+`B@N?)JJGlGkq#)+j;81gl~0r9RSIcQHB|dUXZ{m3{$9yN=>Bo ztoEh*ml|ifRaQXPS%L5S6mIA$$t$!b?PAnYMsLau`!=5rzA8X7NHXj}7sxX9%pb&ZbZnkv*8XVe)And_O{O{p^!7eZhuwGwsK+I2K>bcQ--o6tUnIxG3N%=?v} z@q41D+F!SAu{mwc+rG5zmg6v#85Zc(4HrClE zo!=VjzU=Xf3)i-FUR1m73!8J@d21wA;|aB-oJtgW)L3+InNZt$rL$V{2%PM!vD%09 zQFTNyQip_8N*Lxk6|t!I+c)( z-}n(t-Go;^tgG83FqA=s{~fT-&*%Xs!Fwm^d5*yJy4l^@DE!#Sz!^uD`(jq^DWG3l z`JNxzuZ?wzqvNDI&WuYwolI7DGMyPG&2d)0w(9O)G} zZCcbP@E!F$U}J2-^(L;D+s$3VefJ2h{!mnPCfuDD?b)*tSs;r27cAILD=%&2Rujd+ zjrVuLawT z9Fv4E;j^X8LfQs^WB>Iu4OS|-gsy7L-iO>l9DB~}%Z=#taSR2IX#~G?0G_BA1asM! zpy{_##!jOTk)w@Mv0Ph`+6PYs&cTjNeG8JMx{$};Bw-V0s`Og{ZPF@*+%cHh6s1#w zH3orF!h8_3JA=?#?sDJmO@-wh!6grWZrP`jvie&l3hPFi6zM(veLEJ^c3kK=;g!xr+*`5vw0obj*zbqBs&+X0Ss_s8g5@xNH%|^2HQ%IDASu3vkD=fi(hDO#TzZ?-r{zo-R zD!CNp8hSwNA49bpNsGo=0KaiXg%%^~GM0><+DqK&O=zE8vNvgb@1r_OR7G{sZWJ9R zouHy#RTNaCPI-p?PMYct36T2EDAtx^u^6%zqz93v-J2YCm%EIL0z*8CKt7WtKv8E> z!V`EFLH9DPa6OBJMr}F|vVfhMcwE5o2CINY(1+OLok{#a@d~|D?-bFA4DX}_8|FcR zVV)(@;-Xi`(>yIW}UEDVyX#0 zAqGG3TdfiOq{||UOcH_Xo;uo%>}lY@DrBC52WC$+f>oMZSMA)nv!Q;~s-38kO}{GN zc1my9cU;_Q$s_2cN^zO4e&pS#~`?fswm1`TQtbrP$vcrIC zj61hDx7A0Mxk$k|;N)LX{XxaMltis0?<>h4l;l@Ra*uxlOjh?sug&7GS$^Hh*6piDTW4Ekraz>K|{u}Rof1IvvIxox1_hWV6EMC0KPk!$w&-#Dv=Vd;! z!MDrzZ@%C8{^FA__mRJP$;B?R)kTy}@^>eht0M&+iRp+{M;_3TyL9AQgIzFx? z4lVhlmZX%#tt8hgiAzCD;}+xidA2KUDC34arU_0S<2a9T(qc1vCe<v1h8dMe(JpM#zqGjkayNB}YK0SW2ru3^H%fh1vA& z3Ft{Sjh%OM88D0Qj-`n+O|DNrm*&UnNK4&d9sf!lN!1;x;~z_rWl0iGzMSNjC5R(I zu1y?Epga+YhmVC{4hx4uWZX}F=_fb%Ny<;0z7;RP~;BQcnHwE$_{}#{hy80LUmMpmC*q*81%Wj|g!$r^B zJhF7(FUY30J&#{;#p8S0dOmSz*9C_z?{%%Z_r;x;{PfPS zMz-3B(n|hjEhA`DM{GKBo$fB(*K|TbOKe(lt(HuvNK#2WN`fi?CzZr7ZZbte-U*HZ zEyQtX#ZksdhLEcyjHEyUPb#D2DP%ki6F&+I*L?&IzW*sZ{Q(jWGza*v z`HASZyZJ+I@-;WP(?y;)l9#pQ87+BML0%TgQt=s)R|{@|pGc6Q1nG|~jqq~=D z_x|1O#Y+$Fy6Dg)U8U=Vb?ZN~uAy<=?Q7u1OCOW(oBICb*`uF+=E9vvKRr5n`?D7c ztrMl%fy=(WcGZ{n^!H!SSs`MgqCsVtuWzf_Rt6=aLzbBYHQ!nlGS2Y(mHN}jawLr54w0YCmdr+>ZJ^0sqU*G(F zVtnvnB706+Ao(~XimUKRnkF1A{`_E)+?jkJ$>)>(Nj{z=hZE#*gd7T! zyTV@!^AGxu`1v;fkbj?Fz|nEUN1kw!XUt@|=~)y1yhxgpbCbM0X-meE!e5hQZi2)T z|C*d;yM50 z(yh{OQ+cAK2tN7MOXl|NzJK-E4_-cm{i*O0C(PP!7Qa4J^F$4wtZAv?kHpAOjHF_% zG5*dF=?{^3s5!)cEl3V|$=AH(P7is)M4mH}?-(iDfWUl|vJEnxBJ)yYZfseMSHv7K zUJTjsxw)ZbA^FlE=?jv0kPLcPczKnF{6b54jh!c8B$RKxrMTCNd&c7A>+u-?KNKT(GjQ9&WNwH&z~HS25i{s;n7C#uDL7<7Wd_ zCOyzkFncH6g4ztimsC2Y+^m{9%5)ounKQZ#g$4r`6YB*61{nhY;Fz~A2`6}qDf}Tovxsqdtm5jY*7b3nEOt~ua62fXQkm*ucW4rB6ZIhmFnk{y#V zqcX5#GYur56B;r-EM{yXI46SbqQ^yq2HT?|#-0P0bKqhQBn8x2)e2x%0OM>(m5mD? zF&c)%2~-i#5||*f)R5{42?CV5QYxcSl9JX%>JoLospHnwMg1ucFQNwt?;AYAD?@M2 zs2eJ@g@#I{c?GdjIgJh~DvCdNr{aSOR=}syUPy)K*EF@wN--5n7*}kKSEvvc=y+4(&;IW{6b4xT%>OyC|NWbkMu<+jzFFU+XKZ><>fvEMjOusj_vjhE9&9?u)4{_!nA5=y9gOKfAcnt)pODv8R;;iVkd>BXT^45`&p;ZT7B zyTaG8_|^xnv&}HsP;yz=L?;S;EY29Zm!4t>Y%RY3bnwk@rZ z$@b#))N)j9{Az0bLu=hqVUCof^rnKg(wf`Wgl#K#uI8FqH+JDn^1=1~*6FXcRt}gP z25Koje~)tWj<*N}hpG+sRupG;*!wgH2<;$3yjZ@1cV&sMkARSa`HCb*D9eC8 zY#@Tygil*6lX z7?8uq=$VNwi-=9&7ZAKWz5qTHz(v8k0C(*oEafJQ7g=fj`*@Gtz|^2sQF51(Mc zSc+Eq5T%lMi=7*}p;Z-`;Dz_xVk)|Lmu)E_|8PE$EZHBR@O0>BNp&hI2jj{S(l*%pN*9 ze%Ofi&=1*uc)<^S`1HXm6_8(EQci^B@IpCsdqCjT~i^EVR_yq@f)fHgSvP@o5q9*$}+YRQ}GD{69D z{;HhVaosyc#gMBEsx!F6fSSSTA^0WvJ^7e0Cp0f$^G=~Eg$Sc1CG|$U3GZ*bT(7sX zH03D(Nx?S?NP%mpFe2g#c|$qUvLTyBhcbvT|F8eb{&}ze%!?h2(z3TWB8GN*NCtCcnF={FDTm!+`vNf2BQJZ7cf#2+R3$GI<%&fT zu}NvGF45HZo?ZAi1V0{zZBP$p*zncDfFtkv*e44wLB;3T{V=fb&)MEJF&El2rVoiq z+y`Gmnzx4dx!`)l_a`7*Ve_zaAnfAwI<8NaW%i4k`+P1Z(5!>VAgt$C*03)?eYZUOywnOU9I$3G)E>!&(Ql z5O8i`cs+#I!{4o6IJ=%X2DaDW2pchcmZbmZF|_>iyk|LL&etPbx~WQ|(fqR__=*U+ z5E&IhPzWv|XoYY^2yYAFXF~X)5WXRVK_N8K`d&LPz+*n*0VaI*@-Sc6#3MEyv@#Gx zRGOhXVFp|bh?D5tWF^<4v&tRH;Q~J$7^E>9ijB}ANl&263%+Jfm@H{;CjG*lA70qG zFfk18!UD4m-dzxX_9(NBM6REp*Yr4ElLsYN#Ysg%O}Svt4djx?bKzhvOy|z!5(G9* z^I;$h5H5K!3zSKa%0Vty=OnY`k|E%7ISNFTSRV#a8#ZiVEfHOg2LD7>e5R(BgAg=N z8K5~B=I5F4WNvQ5@1};yd^#i{#_Rui&jTShdGV7m`WIp*f&PUa&Wn+Id~UevhW~KG zm>Vva!etX^wII~OCkSA(85XA|s3AHHWV4x;NzE<|c{LZ3;`8FS#7tZa-P!MEla_4w zrQr7h>_Vqy$R`ZEiuawsCj@>*pg1WjD$_r`ol4@YK9Sm@uIF}VIEuRUXhsYgQha|xLoJ~kU2_OHEX<;uI) z_j z>&|X>p;BEyCO>PL|M5%}9p%$F%1xP3PUV6tH-ufAnMZSBCKtUjIL3#wSs19o(JWXB zQI%?tCzXq%oTH${0W)wWi-x3T$!_Z7T3i_Kz88OqHH$qQ3&ex;(m$4aG z?pcgD9h_fA9>EN3s|j8;(VQCARE-s!DR6|m()i~6TY9))Bx+xmx(L5_1c2p^YAK>6GMd<8w zq*HNm;1}hA)uyJ!VZRa3;j)EG>XLS-qawf^E)9Dh9C-A~V=G5qfb63`{O(U){PM3K zT^;(;D+l@xc*CXZ`wO*smRo-c{D;2@d9P2mZ(6hAd;dAV|NXyTSER|e!PD0tqL_0A zA=2O-eIqi1nC6pK2w7S!#K|U_Pgvlv1zIhjD#VNki{m#NnPWykP@iuAg!I*V=+?n= zIyk0-s19CJzO5wVN_unq6?iY6gsjXx_AQ=`aa%I>fut%T8X~?-H|?LA>3C8 z{l;-4>DP>F<~58{4LpTP;a5Zz+=ms|Qd=b_=&3%;fS*JOQ4+`^@G!P`NU2o07C};& zFXAV2vvY>{`9nNDKUY5_VRES^rB3ay(M1#w+*-o?SJU>x-3$MVUix~tf8)0{S8XWjx_4mVeaP*(H|gfuHas*~{9_7+ z?cg2p56|~EO~xJ9e`JW>LiGjB-rj<9F#*2FFXOEcYv^krft6rg3E6G^ZA8-wr<W zaXiwLXd+Eb?W_G&DPMWHHnp}L+I_yd_nReuSOcX)&aSOQK2NVc$f6 zIK9Gex(z$KGAEKJ*~&8vKe*^LansF`C?f$EFiJDC9qE)j8BlbNO!QS{r?}kWXjf+} zukFqOUtr|H{`-D3Q;BO&&g^MW_DoEzsTS~3T!E)8)!&}ic4XJe;N+3vKmKR)ZUpVJ zG@h>8``rOei84OcV3jeZhT-~-TiQw`>c*kFyW=~O5vM|E2qf?7S6Ayb0cGoWtXR!A zG;i}^Z52=+(j+n=Ah8Q+b`zyPV)|hzD25nS|y|Q%ef7%Apa#lotoS*F& z-ul}Od-n`Gd*{|{`}e6-3e88<9XfC?kzN1ym3Iz$BPCSVVPiz@pK)#q(KkB~N&Qj? zb3*79f?pUFk}EuTfd>MfhDY8bAQE$PIKpfuhr<(daYkm-_(#kYC$W7JcBREeB{`g& zBziho*z$+Nl?bx1M|YNZ2tUVRXwZ4)oij)VK)>1R`8gGlz0%^nx1W&#(iHd7JqbS0 zw`7F_H#Q5ly2Pj7l+AGeym?{r`o+y;-NIe(b05Xd%XdQyH2<8KugjPa$x2@TCdpce z!i#hcX7Do^dYitK6s}3(Eh+q53O|y*{#_GR}s%9#}R)bk7PqU z8~6xKL@Kq0*k%4zJ~_xg$|p^H>z)>#t|HMaU*$r^2G!iJ$@%^^D|CfeCXRY5WY^6HyoqTLizqei1>Va2l@;lNf0P z?XF1*s4Ys?k8#AboQER=NU1uMcPx+W&4aPL={(XT=n@dW0PGYgPz%T@1d#Y(%K~(T zKjp&vTsY5ti%a6%elB^Hc@yI{sooF+ZAwZ2v!Qy4Fe%~;A*{q^gIx(h0kJ#C#)y?SNof>Aa1#|yuc9p1b8&OZ0>uyOUk zI``^3*VM|$ndDRdSUvUl#_J!_q;PrMtu9Y~sXe1hr|?P(INyz=Uem+j4Cg?n2TWQ$ zqN6DUZ61UWuU92i6RPtn?ol~3iQt0hKSUpjm}4T?A=)D%mvS!WT+LyQ=D=JIY|nuJ zAGY)1LKf^nr!9pvgzrZRC2^@HqDg2NTv5g-lab_Fyw@_tkTh4p8RAmT*gKdrr$8fB za_q1cr^l6!D1G27tKHZG1&*kXO{^Pg1V?!%q_rE^(2XGiyRqXoVwTR7Q>81YDwDhX8-c3!R0{d z-(Y<$<9y``gyJ$iP;2I61xRJ4~zk61f(OCAwbN{PS){(kDilgi12uf1UY~=!YfQove7yXU)d32 zH|%U=H-O#HEm&iM0-FZ3xy=ia^$U?<7S85Ium8fjAb~%rhzlkczC$r>m_)yR)#vZ? zHsEy`IVGGL&U~alB$caT=K^pt0EYs{0;H!5qGb>$gEM7tu`txnP1U390PJx zrP9S@D@tVMs?zRrG3(?kat#mmcBsA>gm>>!?s_X zuif<3?uGYA^QF~A*OM>SB*O*yfmJ@=sz5#%S8i{&+1j_SY~Io3 zW@;aOWZ<^u{EJ;A73vJ=7TP54?(2Va)OVG-J8CSJnhrOWY4oz0ySW_fcK4Uam#-om z=VY&z|7Qqumr;5m&12#AyUF@kS9m9Ajyz4UhoL>Btx>vJR#Sx z%r0grjp=mM@3vq+Xp7FG^X5on_X%NKID>lM$n#((D@Q1_N>mAiYti*y?UPF0pLv6WXXz{gW>qA;c*PgYOI<-E}D9=+=7@9^JOs0mBCSPYP($qe(kg>&DPYg}UNKxkgh6~(OpxM<08z7uCO(=4Fv^FY^8b}j z8u+XEq&cexTcNdZxGh>?%$0E6>LOZ~*5xjY8I>Nyx@`$b9^oc9`h=Dz#enmJcc?8+ zV?UVwpmZIU;E7XzNog-P$atC_vRXVnkJyh|o3|Lb~a-2BaP zA0<6)Ke;;+y!F`TvYS{>+)w`Nk%gZM`wskIGo?LsJn)mLEiXOLC;Z*QYk$prN-h|= z7OsX9#&y6ZBA=&LOs*iUD*&It6>z#8o@|GGF*p%>Ax46+c#MojVXg`MO<-?=lTC1} z37VQ9&;)ah@O&dYf!jKGq7H1e{#tUf7LL_Iv=#!jaLEU!d@$AgKamuQlt)S=~h)xuAq@; ztAHNGn1bvO?-7%$V$3fiFXdek`9wes)vE%ypHj2_!2g8L1o?43QODZkl2{2Yu#Nv# znZkh>hsUdrc}!s9gsT%yx!qpg{CpxmzdRwtQANrcrR;h?pxyp%1ROZN>;lDUT4{RR z7DpM!lpd!?G(Gz=60kVF=}~7tb2E7m`;^{1>gk?vnU0HT&TqP~YKi@}SCGXMl=tjt zYTDUbkt4+L=kr2M*0;G@ z^zhdcP2_XuFq|KT;4l=edu1Kb3_|uGygCTZf%riG0OK484!k1pFWz41zl72okN&=_7BILcFxUluVSsm6B^Eq_rej@>U7sEQZk{xKISq zBA9l-B?q)PV5bE}EpXX#)j}>>pxFY`W*9ZY1vBP(pvesPnxL-$?m;(D4af7~xC*LN zppo^-$YCjbITv>2!iwC%T#}s&pGI(VS0ik1gvRfG{)@Kjquw>_-P~L zHY)Cq!)zR!@nC#B&ctJ}wcRn#Yz0hKK(YeD6>SwHy8^CNKt;R&LM*GTz+;Q8_29qJ z>X-t%3nDEg7Pn_XRt}GoXw1z?CR`Pj3Dkp*0>A~Z5{W`8!5A424kGe})Q5`euVW<5 zit-Y_2V-V@e~=|rO-<1V+T%sxMTCcy&|)gj_+YIJ73)RmX5XaRixqMDl6lfs_EQ;g zr$=-jITC1iuyVJO@?k2}nZ@BSggh zer$N~(0H(F^63p64OOM!ECpRDE@A=KOJSm9 zwuJDUDku5S345K8RRqX+oU?${; z9d$5L2bXK1CpZ?I4l>aooC{tGlB23A(4Q9R8ar_a)( z!9gt4r-<58Fp9lh7hyDZaxaZ5dY=5nDvKqD=U@5Qp(ZoB)mtCmxT&`?Wk zeYJk5q;F4u@7+Dcg^e3y14y3Bj5kjp;_GrXI)j3aclG)^n>r6{40jpoH@3Rhw0X)` zja01Mvo7Etydxf1yRur&74_Y=zpm#ycdVe}uPL&c6&PtzRA-*|8P*I{a_ZrM$e*+8 z;Z1zj0k;O;t$_6L7dF!~($BnNan_>>190qA3X8kyL|(wN_G zYYfK(k>Z%5MPf7Bh^;J9n8(p*3S%55QCn+ID8B#sZz4ivVN8)HtxAZ2W&9VT<@unZ zIPDUD;7#M>X%yqetVgrJKGMR(3Ko^4v?OKrsFl%qn@n8RNr%2(69cpuo+G?!{KJg zj%uU*QRa9Qj@O^ACv6c3MzHo8jz>;MNGp3(QU_Vp&DG>+^~q`ypnFeLL31TUacQwi z*yD!Zy8-3rTq!(P3eBa*N--pXN*m0ZsdOYw6DIPG2~wulOyqPSr1WrJ|CXM(bfDLP zN(0?$xTuCRYP!>t2fxgtTP(mrLL6>g0(gWE^L*GxAWr%T5fU9C_xfSfzr#=b$fL-y z>#+u8RI)>|2ephc)>szf6{5q#Yvjd)F{8m_AO?vrVW*-Y%QnUA#l?YyMauE}YZF=; z&7xnzZi>?|SGvf722B-H6;o+1q`YjIPN7o3O2*<2RYUX?`()J(eLH=^R!dioW-I0X zhD&{;sT_YfGa0|Y8*1z-llwP3yso6Zu0pQ0YsEFUeQ*1Y@7`8jwe=r%j()RR>}wmT znf~EiOkX?P{Mo@%KX4@vjIMiNtp^!d#r_@B+x=^vyt6G=r56?UjcpE0{p5j;)kv7w ze)hrDWgcOnF|YT~Yuj26+;f|c`Sq1|)*YLPMsNGh;P8{XThb^6H;K~X1WDxORwsmz zYg+`b7F{X2R>Ztm1Wy;yQy~XvEii9_`9iqY06m5=!?b~EGQb|1ft@ZOyaL#(fkPU) z-J^!>Y%wfXjr#}H#Et-k0&*03#V!T2PjN&+iWIO<4)gNE=n05nTs$KtNPe3Y?Gur> zs9!WLV)FP9V8Di$4f%+`IdYj`YZLem!HgM10fe}gSWGG{E;Jf-F{90c8UkSpV__cR z7OZi>rkPmvNS#pHKc9{~j_l&-(ILfQqXWnOWVVav*&)W9^456#nSk5N3lgQ8imdKJ>#5e0l(vvWPZt2L2HvP{t<7*5Qpu8xL9;9F_rV;;)F|4KeH&L0klH zimr&rgy_78#6*1}lFFfc!)9DNY)rtEl&Tyt6PkRq_Z6{1>Z>)PnXj+r)R&gzC6x8} z4{dxU+IaIa8;^Y#uqP2~;Hh1wG!V4yv@|ti+|wh0Lqf-bPAYsXjsrV7^!)!|+Wnca z`u||k|9@EWuK&@5v!hs(_3t>FHj{?P zye~}R;r=i=9EQ0{sH8cNPYtHno&cOc+P#z(cwQDD2L^0>KR?Q6viNy4MFeB~Y5p9a z>E%On7PPUnBprjiI81)c6PP71P9Q}fxH-nTXEm%_J++!Nt?pV)%&RL_lhvJ_eU0mf zT@n1B+^$*|k+_U5@|x>y7jb#+k-=6OAbGz+238qJW$-5%{D%y_D}!S)xK{={kQX4_ zuZG(x$Tq1at!l_t!xc4Pm^K_+zarN6Ods6YhZuZc-+B(SMHutoa`%nF^|hNfuV3G} zI&Wj5b}$i()$$U^nUTu!)Q&{HIbky8tMf5yfMF`TzBty7)7~I>Q0K*fl%_zaPfE+@ z*_g)_3sR@P$|5-hQ2V_A%9QMA)?oEGJ@7!MAz%-baiXN7!8&{?Tx zzeGQxNzSk>lqwRfb#7}VZ!c&Maw^|q*MRa2#0UfGmzW%gFNqT5!NQpdJ7zQ(7- zUsqhRGHf2o{9fW)^RsJ-3Zn3M#`5&PZ^u(I(cIRYP)vDhDFp`0k6T zZ6|lv8v<>mrELL2=CywJ$!#khd*ncEUCsXe_f}?pRpxaG(fthjOxMC&kEtC1gSZak_K@%Z2ERbmqYE z9B>MQLULGmTu54lNg)XefrrL33mjR{lXWbMM6;kW3!Xr3A)x8(1`+@e#~dw@U?NCR z14p!&6JTP-a!)xa4^s3~;7^8=j*_45R+ov~7%KI2?fT4$WjBIyENQ|f-qi6T zm8Z_7%emH9l&}9^`|YQ~$O9d|lbVUCh~=9U}N0 zT{0-zb4#zSxysyr#}9T~|75v8HM!=8BZoKoQ4$|S9!x(*Ycfs~)JMKQUj?%$T2MYOG|w`4Q3l7c_D%*tSzJbri>Z!2VW5Q)8uAztY6V+$>87;s_Cu4&=LT){AeLm}+_ zE%6)u9zWxkC(1yWu;pPA`4^{9EHs>io`v`@%BrIoM^u@?L0T7ynh*VI1Y;KU9`&zo z$i)pgNRN72Ug%jm^nVpSArAM&2#c*>Lpx77qKgS78hMf3H^om2cT~2!RbPm)JgYW_ z%GRzM@fXzU3?Ev*hXXRJl@RvrZ|? z*A!?LGkn|&Xze55j6By=1A!Wd2LVOlJ|E0iz+4e@6~Vj?Qaacx!FCB)wE@liMeE6y z$!V)#e-(^Z%~TPU53+o4$O*@ao-aCA#2hR_a^3T~b2{cATQ`qcB<#6>1#9~jGvQjs z$&fqCV7P2+8R;kkYniXC38Av`@_;E4;}pjNoCoBvS$?~mtdT>pJS=aMGjbU&2O3jz zFa>NPCK_(*&?bKcQxWz^L>^Aqd6aEW%gfq++@@iJ!u+HFKfGflf!+(W(ibge`|Sd>&AM+a^v*h zn548ND(<^)jjexp0R<60Pub5h{ zOz!q2oZT%j9{GGWf?EjHwbqg1IuO?B>c~tTOw_?_Elk!zRyZ$AJ`BTX7^eL&;)iZO zH2UF^AI|#WIX@irLnUs@uzn-YX17h-xY)ELZh(*h{$TjTK>Bsis-v_24h3vdU_CO7 zBad2xv=yfu_F)DQfw&nNb69pwM$k`R43gk&5wwbu=%zEt9Jnf=)l}3;Cv$wL@T%@| zz_0_l9N@r=@BM|)RtSZbwBKHp_S+lcb5`(Ko2j!jE^ChGXF?*IKvgppsgP0_i;RYjV>if`{P33|8K}?@j@>D+PJM>L< z@5V;)-ywHgMpL(KsNZncUE3T@*5vxJq3$}HF4$kUYPQ3*9Ik`kF5z`G z>%SD~d|;xcOY2>UKtaG!TvdvVp>0M>NnLNXu{ByH=1Ti^&ewH(^UhT_0K27_jf2f1 znyx%nezE^qGf^kPia>ixUCdsOQ@G|%KEaE{N4ilbZ{x}avpg(51!A1 zIrNRG4?nC_$FfCmO+-rzuVH~9c7xy})0X0DMXr{(0T=j*q1r0YNaFF%P+iPNb$-w% zk%of7CSgJ$ks75$s*ox;O$kr_{jD(53KJMov_h-1fRivdk&XKfG9T&qPAv)q=9{T1 zU?V$LNzfKUET}@?zz%yT1{`Ya>A&Jdfmj^-j37{{V1)r`RkV_ajx!6WRW5ej^U)$7 zRQR}D2YptuO!zbuM-Oi%7GOsMEPCZ<5p1s_(Ur6g`6BD;P02M0Tb*0$)E3x`F1LM6 zNw_QDq$n|)FLnok88oMoz{{|8iZj362cR!#H2(}EuiJ7KM=s9 zHw?=pe;1OB*y;{yV}cBWiN)c@t&OCk5t!BVGJQp|*!WAlTU{UzrGoo$$63oP}tBUUkBYPS|d^*Fcbr z+r>71;TqsW16(w~*9>P2gl)FrG+5lcgx4FCS}pjOG%mAI)Jow31}s;XiYN+I@nAZ) zNF%i=^jlf+U5w7&p@=jKA;-J83VP0|(HA4z&PZ60%G>kRqAt^-!fN51hPz5d( zh*bG1GOvVLCG1nuNM9wz?i#Qo8^#3CMIBbe9ImpaYYzj{)M14tri&qdY_rMGb&BvT znImMBfEP_wi6~~HlBGb$)n@bSTF@!=N_CvVgo5QP)gdJ&?T#WphF01yJy@-SM~knl z>Y;#HC357siDfdJ;AH8xjtVhh^MQ{uBZ|OQOP(ZDd}wTQuTLLqKe*03#eJY7f*k z*U{0T^0m}dYU#_kLuual!u~8OlC*BgXchK#(HFvf$hbdCRxM-XZjcsOC&<8CvXNv8i>A5=DNgRGwR>(5ais%2rpK+Zzh~Hf3SB(_6YK zY*yI(X8q9Aj`Kzm{2d5@_N2P_O zhETK0TB=bL+qFzejfpOesZ^IE&B>8gY2;FEfv?3`b7zghAFe5I!~!O5S^nPvkh+`nMvNB=mnYcYR_nU9_w?6d7f#Kr^wsr*otDp?> zP=(&(v`H1NVr29Kry6I-QH;9Qz(bKslPQR&`cq_QFO2p=b8k;CnQMUU4Y0EwPKMz~ z<%vqNzY-4mkNRmU33-#Z>EU?=9FiZClf80Ep&8@Dqs&tbnMb`d03Qy(RDQYqYB@88ghETdWyZqH z6=H!dB9zzEYGC4#|Q19t|-@iPY zPX-3()8QRO6CHJl?nIr#6l`||cLb^({SJ-OD6`kB>R44{A55hNsb##rCF9t!8G7?l zz(5HdX-%E=Bb39noNdG%`Fz(_Xx$3ot)SfsFKmV5TVZwzv{U0#L^uV;#A?dI{# zGn<*yn_*xRv~7aWCeUtz6PsSxM1q^*oBB5~-5ViqWAjFGaw7!rwPz!_!zA1bu3pghg0L4Rdv^5@UZ<*)eAo%2ojW?o=xXR( z0Zl8Qd0|v1d1e6UlLJ2|G+9H-* zn`~{1s={_>Y)cf$CW#nQOdz>MBH5B;c8tcn6A3qGZCfiQpWJJe%C&9=^H1IRLy4*? zyD1Tlp!}z4B`EPMjE@c<=Axvmi;%|ksWwN-c|`>>)!4VvEmlydsdi>3Kzd6L)2>2# z2hXx9oqiT>uM4jsDn@KACWl<1IL&{qYj(jo0bu)B^eSI!2 zm-`zm7E9Z7S72SDM(zzozx2%b#5232^|w7Wnfi9MxN-gNmeIpwzQ4t5S@`bCy(1yt zy8XRf_m5Rojve?Ph%OS1UKDw9^VIWqM4RtAHMRZpT~TkD&|IkgpVDT`yl3R=o7Wwl ztO|}F8XSIXb0`y8qyJe2MW|dSw0cfWke`;VfNKhv zRqRuc`!F*qhih_pQ+$ObKh0oImc_K_ZkDjd=0#CR@wu26{Yx3ltKmLuGRwyT;av{$ zw&RZu;&8S|Mr_+{q|=6d>cD3M+pHY~b||xh-3}bPl(w|gTO<;1Xp!(%CGi?j4>R67 z?a*b12dwa=h`|b*t+3V#)G~Q_NCWSR_oi^NSV{ z8*BuQQ8>CaUg_%;l1Zy`>doBXSSteFifxAcI13?Hnt zr#I~J|Hz`tQ_J`c_(I%%6O+yq8@|D$8@RXPTM@_!EDz7Wz@{@SXVV3}r0>Cc;9UE+ zjK03Xs7vwMQA78^|3MV5XI~E)?}6?hR91k!0xng+sR~e)?nmn#+62$Iz5> z_m#ppOOO1d6#8+$WWI#FTJmNI`F;tEIp!SXoa2&%U_;4!?Vz%c+R2A@=(U5;tTPh~ ziQ?vQ^A$65#RRXI-oOzO0< zC+f*e{d_&C$3^jC93vQAz8I&yU4rw`6$#gO2&tr*)TWrwDbXRC;?!EZIugz8iMF=p z`h06b;z{s$5~^_7Bx*XbiiiHD0?y+Kt`}Cn$BycWQoqsbaO6k6TE4iAi9NZnP8i)nt z@<2RQ72Q2pDOBjCePWGFSQ70kF6nJ987gV+Eh*`ZmMF`6?m4xqZ|}B^RlcqhFTHX1 zP5D$x5+=Uo8PD+cXSP+PI#v}II^u1s%hwzjDyPtMCe!Jkz4M;iCW{KnE2^v!>Z;#J zo>ux+TrHOH{$4A-d*YRRky{;Z;@#~muHT7y|JpvNkvj_P}2)P?YU@hf5y z6v0Fe#B=&{NC-2JSk)$gqXPJvfMQlV1t5=ANF)^%`B6?02In;>I=om>BV;#f8_7W9 zrpDck%!)>+MG&d17HVtF$R?5G8?kp)MVSUg5vk|GgxQ3&gdZb=OB$;*RhpzF3CziN=F+$=rQvXTk> z)2vat;Kw2cN#m>KZfUx6JX@oUe7F_joa|g}-Q?17g z9f6JwhOUX>Nihsyfq0>=ASR^VAZ9ivbAYY%4G2Ibuwkb&BpVBkVMimZf5dWMY?{zb zm;iyt@*-B)pGSF2yjW+gA!baa;xS35Q6e#RGJ|es%;WKaua?S_P-cqNHo83?V~Xau zRSHuq#Yyz_X@!ZEc~%Umw24NV=SJ2?6ilV-~WmWEg4 zFCF)fh5REA^!GlvAyhr_5QJ@Y9mORbb+#egDRH+23J~xX3}$EXvh8hCZLZa^kX#;$ zt#(Csba@)T^xUmmp8Zl&#wwim0Gz%rB_E>P1Ai?@7`2e+T_u=$G*Mo`W;iJ?}^3tyfC%>2YX_ZYfyr* zZx8eREW!zJnxQaqni5l;(V6Icly|KO-oqL%Osdu9)!J*Bnb3TQM19@9Q6CfVL62|R zM^1U+m=`v9_j(`pGEaC;dB`CT?DfF32R68&)s=KjxEN$I1`5GZi0zhPRu6spje2Cb z--n&Vb#P5byOiXKDC~qVyDzILi&)qOH}_`2R_WbRG9-oPq-QW6l6@cMS7hewm_}ob zmB%U@AYg8>HY5T8E(a@gQH zB9qkAEiS~777~<|MJdXN1eG6p61>ac<1D^|k{~ifQx#V9`f9OJ#3H(!27WMiuByeJ z1l*bv+gIP!=T;aUsqfU6ce8_RV5zO6OC;VZ29#l8Ze zuPbOIKN#N_+4k+>(0FQPVOv$5uOYu_ReyPEuCF+9%Y%u9Ztm0O746ObLPOOG&#E0= zxV*`r!sE;@YD$(roEvCfo%Z0lHRyY-g0DtCpNYa`6bZ<1Jo;wzT9nZ>g_>xE1NYu~ zP}Kvs9;WMIPc>?nv1&3M23r7>0kHewYB}sFKUz)#WzA&-J^c}Mz=|mvZKrnW5$r*a zOF$IvD)huJKeC=4I^&&lN;Pc z-q`IHn6$tjEMO@z7;0k)*^um3?3Ezv*uM%kueyB|xv~mY#W?pmAz~TBJV#NHh95J= zJTVdrR^=t!7NY*YMiIn?ibDdwE%lS}$*6k;a<-kiH-?5^KM$tE6J{(=)TL zJg`z^u;i6`nUA}tD{epd^tx|fIn+WymCoBcU0sHn!MgIO&mosr>5S%TlR@W~s(jH@ zji;wIBv!1#n&rnxg32^rNM4l0l*$x9IA-<8 zp|VAewN&<2Zm48hu<xH=!h9t?hPMFpz(DSh+|W)?j-X^V08O3z@lL)#e)eh}1peqNzLhc(?7hJ{cy zSbLzA($gQL&q}fFIbEBA)%|oJ7x&V`_*YR4rmUz*2(YU}E><|Dix60- z9o(sn2Z!7l+wSd~ZgNG`dX+-1RfesV{dMMyM_`QY?6Y^TZqgm`hgx zpp}UKf~d|~&aLolj*S!6gA1YnX1BYhcD}XKLrs&G5lY1?*vc2xQn}q06)zFdo7t?kieatM+%n zEf`C8ckk!G3nbt|D8I0mg%^vAbhrCH1*Sb=k&wJDenxH)k}0UuU(Q00)(Agsn<-=J@?qU1oq%4A3vBcYo)7(Q%b zcXjpd(Yn&6l})AIEp^zTyr>A9y4G#+F1)lJ8ZAMkMiG^1lwrF)tklS^zf&41 zQYeZdrPWhD-xRbP%ms1#ljW_A4T+J)@Nj$3E*I%N%|msTCY@1d%+uvn8k+k3Doev~ zU3GV3b<1Gmh5~E8x7Fim^X1zLi1NQ4x!z%q7nqHeW^3UJr)#AVyYY6Y%r2$UWmfrJ zCC&iVY?K`uMM=-Y{U>bKyt6z}Qo>P0hFe!}!L3_)-h}w(G!HC^&Y1XW#up-kJ?_y!Wr` z;rhb&#mh^pxw`A~e^ow>Q(b`h#$Tf+y9-%fKcBI}MkIZ&y}XvZycXgEkQD)S4SZZf z`-f~Ogx?o_Tu3VOLCeMdtkB+p6|lATSY`FSZrFitqsLR-k9`Qp07+F3));H62Mdk0 zCJvC4iDMe99&F*5u!+3MR9$UMkyJ~qQCVxOt>xT49NW2*vw71dj#L$s2no4s5Vj7& zdJI1~Pi=Z}6WO=v$R@IB!{*HttlOH{u%V}|{aP)wAjZ;|NcH63R*i*yQ0;amJQWo> ziIngYMjdrIuUGu6BAxiF7#yUBgM;je>#yU&ffSF!3J4q>uZK2qrXQry3`JPdgNTuy zcQ2Q1b4Ht+aR%9DXZQ^%Hu0ffN$VJD!&v2l{24U>tz$@MrhAsXbqFgwgqcarBEkYBAkcUL=7= zqL!NVGP_ppuo{J7>qN*NbSRW&PyY3PgEcvNqe)(1rr%5O^Ax#yPp#P$!tX6SvCyk1 zPztTp?G97OW6pMD8|)=&mCKT+ar(O90iu%IjmlzOuGw5D^oeYxKAokuRF_}k*IxfK zJS56Dnq+#jNUjvL=eu;dHp$9dHD{(w9kb+<;o+7Rk97&x>y^vz| zC1E@{lO(M@;Oq(Zko&tq+YLG0Fx$Pan~ZkAhaIq^V^0UkO5`P`6LSe}x+>Haf$3@( zsfO-qI9Lr2ho143Ai`i2n>=N```DP*Iw%bMIBfNcR72|!N(e1WC_ z!Nl}0B1IZ~>~{gU5P+XzZdw?O_5ByyqxUB`7lhmYAIjbYu&wIK8`rt-J?*QtS&|p+ zw&hipt;MUn$db2MalFKGoY)E39JY`>l$HWXNCGW|5+Dqe0tpc4MoA!{WoVlKDTQxl zTA)DNum84CmTog_1#IOz_dQ9LLty&1iS+cO0J`_wv;59EzvH~lNs#ZN9COw5!@VYJ z!dX<2NSUGE3@v7;#uguBh*~ZZ$>mD|365L7d{ys~L|1W9QKAd!D}qx=QH>%gM{+;8 zd0Dc}R8(wEI-SLWBc_XFph6z5iJ;X(Sw;y)j|=4&#h8CYd8UP{eCa9;mMHBbU)P9F zLdJxzAHr7|<48Y?x`-EO{t_Q@QCT^?^J?M^1UYd1ca zV;op0VZ3g%!o6(oYO=&w-r}umbE~Jd?&hk}D!Wmw6e}Fwa(%q0#%X3bb)n1ORpo1` zaTh4zAh1CYW5T8!Lgip8 z_tH^a!n7~046gCQ7B4>+YMqBU-~gFpmxCZ*1vc6sQ^g$?ocMA;N~WYRAcbZrRPj?_ zzQb2Q?vm1RT@UkJ$g>PgFgQ#NDhWJH;4r~B0$H^FyB2<53;$IMPa_?u$#=C2mb#+T zn_XD6>NHJXTW}57zS@E^ zy>;?p!~`HQnY{SoT2s;(k|z~L{1vTF4mn+}AsmU;!B@5MqRVGf1cByZB}}5A7*otL ztC*2Ch*#Xa#BQc48--fPtO!^^Mtn0~T~3Y#6-^~NBi&h%r*)K>H>uc9ZT4gd6*AIJ zTsg51EfV;gex{{!S(J*ElyFQ2+my6%TdZ)x|X(BMlV6s_GeAmM}2Ik>$JYdW0fb6|q1GqYGiBh@;unHr{|H z*g3uEG`Rg6YgtRbO!Xn_8xb~*73m5-bbJN&zWWS-g4Ds1I4<=uiwyL zUo0MZ?2$XSb+hkM%xmz5(>pm+dCTZ#dM=Q|f&B;i3IXgKSRGAoi9t^czSIGI9h6}w z<%ew^3KfhpFoN@idT7Vy^F6QkkSF*ieQB&PM$X3I2?~^fw4<{Dp>nOklo&X-q$?_k)*#bqsh3yg}ebA6)5!Yviz14svV6$JXj}T%xV5w;@sM za@G3Ev1smH3~A}%d(8(M@v=OLlee8om#ZMD(~U%~i;$iOG)BN1fe#|EH*z#`BJxax z#l&eu&i{4%H}ij;(#C;YnY_|^&`K`0g2HOElE2_w0kf$q+lEbL2eUFLM3wkRU(xcT zjJyi>GfkF!K$8h(&~2a^mjC62jtZXehn5~u5vA{CJOGJF=n2Y9Jo1*&=!1e-nb{D? z>_cle0o_DQ2l9}HnjzP0cw~21Y5a=e%KF}G>znGU!*zR-{Z~gKU+r6ZU0t{uZ(Y+@ zSH0|tp3<(}kEB0xjor9u_G@FV`c?bK$M>(QXDuXt)ps`Z-n?(CkFjWRx~V~3v&@DIq5u$@KGUV;rbj9aX`5PdW>2p=bkNS`fbBU=k$Z6UmmT0d(Woqlns=`f4uUo5e!5?_3*LJ9|Y(y7jGh zolEce3g0Ed7a=TI&(<|pMJH~YX(%L4%)Ch4jvo4=1;1BM?E>3&qa&65#EZP z<1rEM2H-Zpo(4j(%Z1H zfusVkJMd0`Y^uMqp7hnj);c<}hNalZo3-SQ(uYdPfl_EL0bdEs@uQbL)KfcsR+aEN9HPWv zBmvSyAtLK*%e)1;=49(6ot{1}VI-}oRI;_zzc!f!Keo0}_=I97C{<_^1KN37!7Ic$ zsFYCTsJvy$5O|*uC5#ucta;^I45(G*V;dp=$7>@&+W5~>$>aawg^+*97fX6g|LBF% zgT)B@7s+Wh!a?s6g;|J$KLY^%+SSy*WJzh)&gBhR*!^<_c>%Pq9=fEx|AtM`m;Q6x z-K%}P#7i(i=pNWP+OusENLt{JPo0m%U%*#fjOKUMml+CM$G0!N_Xq9k z_Xvbn7zwE>t#rUvamy64A5o8zMftA~HHrFR9rkwj!bC3?cSBzyl^};H4dhri#Jb_u z?&IBLv}A@Ptc0gm@PP*Gh+6d+iA8UhK+h8wpKk}3{k74O=h!P#df}d zRS+TOn19qyj{D(|pO*Oa@fm?Ts$mo52%V@R$I9RU64HBNlNTQHBI*neIRTx?D;;pm z0oN777D@pMM~Yyt2DWM7ehnN|Q>cHp?0}3MlTk$PAr5BQ-RuFDd6)$=CP+lwul8%JNUFxoNGwy<>B%;ukq=`<27S;A7OHH*&<@aeSIvc|yt zU~JQ>cs&`Z8R_tPJ4R}%$78;9zb`gk zoxMY4CS5AI31tQuL`AFM@#wjAt6=NYbyH;R6pT$ld9SABW(PAw+4Re+Zg}V0I9$>_6B~X8U2H9}@j=5ZROByW?ac4lzvoc7nST?xz<$ zonxI$tQBIdqpe3;8EpDJ6h0azqkj0A|CfI9s2|q(;Y1xgRt5S>BoKg?D&ce`9IvD- zIv+aWjPoVu8&2kw6&|v}omSfL`MmyhJ(<;?(vwqIe8>-idtUXriu_0gK^eTme!`Mh zDYH48WZ`w3NE7ru;zDU}u`O9*hcU{8^dC_f zCXc)o6)j2H!X35K9&V#{NitZ6SHVD_J1M1CQiZ8Gk`xitkf_=y5jyI)O2nFT7nC#U z%$Z+gNT#*(c%4l-36jS9XLy;Fwag`bGxvk<2_MVd!Ca((Pde)|9<)>>0+*N zF|EMdc6@zg_afdUwD*r+g?`QV7}xQ`t2!5$y61z%awiGH#A|*sx zQdok84;CwFvVhED!OA^mrv=80P^p0H6}KzMm3;DSgFKV6+$pC_ zvmg9Yr?a3a`C$P(PypV7v4TU`i(aN}PD*)`Of4=o%RKtR%LwoHQN)I3)Oc%+?=RS0 zDn7hiQRxx{jK^y-GRNP_NSY@fcfs7X5CLRzWt2YxH6Lv*&QFMY%b0Iyb%9OyUAFe_ zizC6AJxiAF#Dr}3y6(2MiL&*PwFigC4^9UvmR&V6cvZ?@J+gCP*_VdPHR_~mq^9e} zExqBHYx*p_PMWCjbWMf(zdRWTuDqsy=*t_H`@D(K*+k1ly%oWcjR7xq z=%N>R6H3K;SgRr>^P|xnD?8L5V{8M8zhZ`@Ide5y+oXVqlps<5=%fR0rGAimdhOI zW*_Q4*-g>0NH^^7f`__Jc9H$qve$mHog8R`iMEYx#M{^lwh$$0f**w-h5rP>=LcVDQz=39?@=}?$x$U884^+g!kc~4V^R{9 zLTwZ~1{AfBu7$tW!i%+VW9?nFgpN3BxY`6)m|%?whE33A0`|het1k1D`7r-(1Oq0Q`PuRDvK1 zIQl%l9OCoJyBCCkMo`Qn80|>v*L-tk-OX4*Ts!>L<6r8%cygq!q5a_fXLf$3n!9P& zsjpu7!)*~-L4nHCZcS9o-hX)$rS=P7vH7yuHPtqMW0O1TNBW7p+U*(E=z)1ycM>c71#M|p-d`_r9 zu*m?kdRVRpEWNX6E3`zeg}1dIYY7f1I;({~EmUYDTFRXNh6SgC{S{K6G0u~`8LjYKP_=&#^n2;wG48~tlk1~bF}i?Y#L{*`edl_~hS znZ|_kXpG>iEn{J;Ei~HHGTKm>{*I%vQ0BdCS$tF6a(JdX}Y{A>ICFVM52r<;0oSon06_VhmWY3}rC9kvW&Efn76-=ZMP=FOaNqA@ir zmT=iHAsEuTLJo;1yS!qF#1+CUG5;Y3RXbhaym!SC@|aPlE_7HW8hQFUbA!=QWm8Jn z`<~T6c_F->yP=peG6DR|{6FsCpW(~&txAi+WwexDqBk1?#a0_bMmUMy;WHOh>&T}= z8#ZNL`3#|pw5mpiY?%-1l=!?1->_GjYX*xQMbyK??q#+Dr^57sESj{Sbx&9mz668l zTxGmDPONb_83#*Oq>J3y1qZs|lTP?jCr+{$Z6kYH;dCn;Z-s5;fW5}c%Ava)?k`6& zI^bNem(QZU6-^<)KjvJAQ%js!tPD3G-$x=AvlQdjSuF-DMge_T#WoOZPRJYKlSXK) ztCMSVy0~0vkjrs6vP!9xN0DaTW>sQQTd^hC*B5NmVJ?QF`}o)T7b(>`&bj;*4ratn zT-ZP%^*@DZKlR-MnQi6oqLQMggm1tQPE1y1)8n%l+aVEsrT8q}Qij@Pe)IGJ{+cg0 z5=db#4B;Z>lBT@eEf2Jb*?XVWf$Jn80f|=*A3wJ01VhX?ugN^P`?kKsOXED&k;^gDego$Kh}sj(5SHPWV$N{IV0ybi(m!IKhvK2$ex)qOXrQOH1P% zF>o9SbLe*yEx{knaC0;vYqB(vkDH*Wu~Ac?(`i)(y;`qU$2D4mMq8-GW^>r7g^gMm z*Me3POV$-}GFtwjN*WAWWd3my(xld4+4|`haXWzDGI04B^+Iz9R-aRvW!w!j8>I>!8WsumE{f! zJDZj~w(93}r%muf+Fy& zSULi(EHB5sBXG+ITsH#SkfUP+yh&J}1kVtx9fGkT2oHd@3$E+}YbRXU1{Y&B&+_8l zwl+A`Mx8)?GjbBZYJ3dBnjkzAd^t!S!@*pQXBuB>WZd;&s)yH1aMlD@2^=gfMrMx) zs_Np2>v0?=lEh+N{%i~;VlWVc<`~2h&Jr{?-Y_Dr_#0iR(#Dli>2RVn3emx2V=Tsu zA|=>B6;qzHxLi!Kz@k!F_-YHDUVySb@kJNtz6n?*iV-RU-lIpAPAiD$@yB{1>^0?8 zJBo;4K!ppQbAZ1i`1AB#{GpG6MCEAMgP~ABl2sHJv;h*qzt4pMs9-Sqr_D3?cZJbL zm^Vb!xB>CqjP@6^%8d3Ww|vGRr2kOKkg}#8`#^H}xBqm*splu}|HEEO3Cr2VTYj{s z_nzB#occ=Fot#oE<_!Zi1-uD3l6Ql*4T%>}${cm&F1_!zOZI*Ab)M1yUgi~yW9qsyU-01H|%u7MmLNjCgiddCrORgfjFx>S*GDkCa23Nw_&B;>HHJF z=)7kRJ5}YhxIj4Ov^E*%UrHD?F&OnOIv|B#)z3NGtXj-|8wlt|BrIVV0u004^|>dQ zxeGP$+(%qNfrg}=JJxsQaep?v)RewqDnY}M8Zip zr$(Ykw&4KTYEMP7p-Eep3}|%7Da>*;wMG-aZofLMi?ZQjc zo7&%G)8C7=DXu78PgmXw{%dP%G$P|XHhYPm5wqV*{V=nt+`a$ua>J>N<`mZb1aqmd z$d}Lk_rJOYLCG3kb&5#(_vikH`5S7&UaSfFUi6}Mldw|*Hj5=bGHe(bwu~U+t{ABt zAtRz;7#{Ym>FAC}TU)CY%BhvBrseYKY4kY_zUmEhGEJnKRF`65!iZ*iAn6)TCT+#V zSZ6o2JgGF`u!o*%f3ic)m)qlbZDDF9-#qizdeka(STvd~VU^XVsZ*)WST4acq3>!% zKiS7ot40NSvwp!4q06}N0=>XY#`L9UL zG~#PI_cQTPHX!O3&43|#@9e7Gs}8JU8b?8louo~$A0v8ckv$Q_sWL7|IAOVCgM(mc zWdi4q(sKJ9GJ?GPT{g>-8QY8{zGTL*WXa5unaJ4k$hjqghKOqZSWn;1~4^n-AD_5zykD1t%6s$OHQd zwUxYppnO1peuf4i!jDiA$RAlWK4!C|4DCtYrqjTKzgxB-I(qbb%F04m@Sc&a%*lnk zGoSN$gW{uN_Ey%oreb|m{*COZKE&T>l%>0JjxPV1b(kLdapoB3&hy+f$_JI2wD_CC z1=bMphkU+Mr!Z@JI-(T=>RNI#bKd7$GIt#Cc-eeN zxR}P8We}Akm~jLnn_5wSwA|ptkkAyjSqwIt1=WC`5yx@9d1ax+Xe&+Xyh*7^CrUEd z(*4)p;Sr|i7So%E2MNWQ3)Y7B6ti}I;b`XR%Z1Yz{Ks?X5?Y0GQw@+qm&cf+p z(C^#HpM#FvIhqfU{}#Sb=B!9 zo|r?(`s6tYY!Ym?engD3K+$Fs{PS2w#?CY6z>xG{R*Nmo3SCBO;gbnePK=BBPEQI`0AvL*5UU} z&^J7CO*M@WHldE8rk^)QRJjNm2gl81JOe?!@NRD2W}tXqSZ4^)QbxxhguTc@@g!RU z?2)gMzLwpX@2xmN^~eR4Mpo&R*hy*mBGWX+K*j{AvnGhk`U;oLeUF*_97RF3NLJx= z7#iJ5X}(!$QMI~p7%o{`28A|5e~kc#BSB>86&HVwh6 zLm*vJxP-jA1j+|D43g~{*sg{K)m9bp@Q`Fs2`NN%rLaq~UqUuXpih#L5G+Rl66@}6 zH5#T?OqwP|eeG?nfHMc;rb&azG#NI5X>w9N2u)z{xm8^%hEj)bATo6*H${YjBdtFvPdvG$Egm>f?c>dr$hQ|+_@ z4*3U=DuwU+-OQUeRGPmLkYE%)9&?$>QxvEcv;wARv-ZH9-Q)XK)P~l7 z^VDyzGFKaWGJ?6Fma|SzR(W$=SL=+kyx3Gy?p)RKXBT$z(b?F=FjZ25Ta!Q=}cIbi^{OsZeiOP9Ql{$ z*;1r5tN77P6?TwSiP^Ti=mERHnlc+CJFyZ9&3EPbua?P@%zN<;)c|}yV;^`gBmE+( zd|fVrLxOoFR13Ru>D+fY&070{x4QLq;f>XX=JZ_x4nxTWsW<-`;N2(;TQFpu3zJQuOjX zXYc|(q0u0qUs=F&SXfs0jm`uK|LGv<<+oV(#XmE3v( zzmB?q^Ks$tT+XC;5ANL0xD%Lb92DIa9pUE_h|7_R3N|r-sIXKlj&m#mkSwQVS=&%U zC?2S@^~K}y5}To<#3n_eN?T^rb z&sR)h_BKMQCFHUTtTyjHKdq2S)ht@L^W&}sMKm9#t4}@WbOpceqoQv{M`wq3^WLSj zt+1^eX*@BKFKBs8R)*{6MluQ2Q9pHB{t98DQetr_sqzwm# zsIxFJ1phQZ53Y1q%+M8!b%hXUbCi_Ct9^#*YG1Y17sV;l=W%$w!H}^L5e(4lODtMRzT7N0BX$P^CN()Hd-98x~DhIO%$#{Ubx;S2sgoVjeuMzvKmWGMGb=t z3%e=1;l^sxZHGVD;a7I}nH?Up!>#rsc7hDXdrKi+3P<#C8*;ZYpv8<*f3Kk*$6NGb z(??k^hW9buLs;?0ryVgXz=xj@${ zrW5G{yz;UcS>}=Ny4PHMakZgp0f?hYjBYI+FRIn(O@wCAms;4>1>Xq@5r)IU0Gtb-QEm8f ztOMY!z6UEa^KuOtb(N>Jva#~{zSP1IMQ=BYil7|)6Ak=AP687XIS?aHiJhn8sE75V z>?yuK|G-isq{~ZK7;M+0 z>9S?BGi#Gvu)494L&T(8s1V4aApE(;&8A129$EU!W3hr%(DVHZ9J-75vc`Qv?eB0d={pePW|`6izaw`QI3 zM%nz=HQ7WL3KcUch)bF~!jZ-f)qLVYuxt(qBcBJj=Hn<)NArR7NH#S_C5_Q#T==;U zi&VP|A@+07S=0&a5bA^>(TV8VUEcj(GRspDcgC@is=fx*chHO#B384I^EEr&9iEof zHXQFVXm*?1;)7z*!t- zG_2@!*7AvARNcs!NRz`t6FybesKj$9yMR+5MKJ#2rqetz)dkrrKZV~vFY}vsu+baM zHbv#v0xfo5^`QPtvKIyk$y#85zkfFK`}>E{0m?b8EV-Yl$V=+-IPx;3U7EAYVx7Dt z?*l^CckXFUZ(4|p3vER*rhxi1E$4p5=Xc9RUyBa+Iv_6}qEqWcYOOk{X4Gn%ucWxR z$YMvP8ml#KD>B%M3X4F3BMpjRyl6eGytH7p#7?~0qGYKCb0Y|NT5S|wpeK(SR>8N# zvqyIz2P_C>9f&sY)Kt8uDI`6u#=c&sJ6li>Y1_B+vg)$6Wk9L$*H=jw^ z5$)JT*_ZpOpjux5wYBk@0?Z#3)D%#IRZvjk_qbefdx^nrFTr^S_7Z#2Ra>K>X{nCuGg50kwOu(km{2*B1r zhQgXb+QjSXU_COXSNW=%s+j#%u&WYUD#2Rmt0am_2>Zb5^ZCdDAFOxpaFYWj*kyuQ z6F3vi&1RamEi_}9pSdtYo&+~H4k28t9aJTlH4zQFa*R)pn+B-wf}zF&i{_UCyDOLEjN`GsJ| zQ;Vy>`T)I#J#`K+E0M;;O=-hjw9AI{`!Dg9SFp`!O-1} zle<_JmIK_55n^|sJ8Ub)nrNrLqB;p`wN+!(azbE;tBF38aC&*&Idy(QNXTvTO@TQ} z%Aa0p(H5MZd{_8_iOa=K)<5$-95{()P^hsw|Co#JSuFn;#2jDb$TXP#*J$tk3ph|H z{WPliJ9&;M4mfrz=%Y<-NxypiVSczuJR9!Y%x zNqrmYy=GK6)*^IgimcwQ=JsTLS+&Vx^>~d9p-@329(NbnlQD(DtSr#-{9@Tyk#{dM z`X*C>lR-l;pr8deSp}4FI0T>;A(c#K1Qih)hHRWcJBb9!5=q`^$;&h|i?9-O8W~t{ z7U^;0#LV9_S<}UU$)i&lWkl^_K2);Td>5(F&F|eOSP4QNBryNe4(>16bm?NeWG+{w zvlt{H+t=E6!VB}R`Ajv(Rz|^@6jx!3RxXN&i_S*3Z0m$|op2pCLeu^+8Y*bDSjtg~ z$0pt!F*G+v!Z;Wp;;X8PSJxV(?x6k|8AXg`WGuj$J;r6vx7y)g8_2M&y@|H^ zNSfffrf)WpZB5{bG)Bnvl*MJ2kED=l&pRo2CpB49fL49P#;S8tEvWMoLVj~rrzjMGOn%nTZ;z1BouZ6@ zNcN2WpIwtTZwL?GcxK1CBU{>Nb5V-J7O|@FYsc2yyQQsWWJhny?#ov>R-Ig2#mqa& z+4K!f(d-k#yG!Tq?is3IdHvYB#}6!Z_iq_8RTUWZSl^{~>HJHZ?cG~%AL-xJZO3U@ z)y$G?Ni#~A39aZ`d?xLGqPJ~rzpkB(wy#CLgmy5um$ir58Jty(!|4l4%S(x@6h0}1 zcT3?S-BukL)j^LAUedwObZ|lkt!OY`7D0zd6c2_C!C*KMhJS`394s`OgF$z9Rb^!v zIyrJ|Cy>Y8Wd?WI^=0sQ*|RtX$L{V3hg(`(tLn=P_(1z3+YE&xctC)%oLO2xST<32ul^^PGe!*pq0}A zOoa4LMK*bH(rD9&u_uPFjA?&y{=$g&E)d%9Phj8v=-|zsp-wsV-XPqg#7W1G=U$?|1o_l+(Z)aFkhV=7OJx?&FOm{dK}LQ#^B=D@tnjk z_p|a-h> z|It}(4|m6mp6cpAh0kZl{C_xLayd2BMruGN({N%j_GVyl2QSA$$@0(j1$G!cwqp z@2c+#*<3zHRgqC&nsn4vB{gc$=K`#GETTbVib7Nwbc$kAi)!vNiic;W%EnlN!r`U$ zyg-ZE5$Z@{<3S)G!7!GRL1HF~Hm@;@qpS}}Ug8J*rJ<65UnSA&bz&^h|F-^H-X;Zy z4QHI#Zk3qj>6`zBU`wKDZ7k{S>oDpHM;hIlf#u7LRws5d&3#Ukg^YE~J&3i`i|&qI zvcC>?^L6s4>V95F?x=gHj!gJ)qz1h01B42AH=`1HCvchwNu2`m!QWvwDnOBe{NJ5rnst0Ic^$IBy0NtwH@uH=N zetAuKqOH+b?`?KfdpC7%IJUdf5*lx38mLCl+Ohe~i%?$k%3ZBre(hV6YIBL!Q`=wd zEb%Yd|Mpv8o-XDXe*zOoH$8kOgR!4BeRDduEaT^G7`nt=>a! z&yrUN!DB>9-R|0Wb6Z=yw%$-%TaUg+eW)Iu#i2*F8bX@!m9|aPnJmDM`AlY;m_h)k zB7~|?jCt@1SBggf76Vum&bx{SQH2O6lPRWROi>md++KhJ&Trnh0FIuYNg?MJr8|C* zS0V&hBlP(xlcS7g5fsp9n)@E7H|8T?Mq9Dsf2mEOx*2U@884%^L`SYyJ*XlZmGC9y z4N5Yr1dJT5XptOlhaS5awQ7S_tKO%D$1$=|JMh=vz;ImLFEaT3B2;BaQ=-Q9H^1Ac z_n9mg(&Y zaf=0?hMSw54ttBer6oQrHgN37vSIN~F+3;!wV0fsBrp$(iFkNocre-5(q*cxGmedn zG}Q-_gk`JC@Ms&#wFz_^Y)P?-c7!2~NBfHbEN0`S7Xx)_-l&UDB{(Opx!Q(or6OSVElH)9VuKC#s-IN7w;zWZ9}>EGiX!6kUfyZz_twS_G;hm@9%iiykf_cw^KGJyr-ox)FY1gr|%!VccjW&BlHs7W~BYgn3yHKhp!z zKXLBCXs@AnnSPC)H0ZnaM68EU0Vq`PDIMqf4nHRIA=OD0F|r<(NKzuXR!-yvq%>7r z>?ll`O3aLH+Mq8W(;8U;Rs1v;fx$l|Gr+;C$SH+-idXjZp>oyK)T&GzhZdH<&s$o& zqR(KUjLJrrFa`;&o5QZdm_f@wv9HQ{FKRDZsd0Bza|&)%IywK|YIq8Mu$r_cW6(IZ zDR|{qoQZZXqz{uQvt{niG*DB2S=~?(oDt#%lg+%9%1$yC)v?{%i*3Vxe5^;_A9Ze#S z==;&HG*Up|gqu8WhsII}mYyg@YEWplL4^(OusviuY5Um5HrZgp3jeeMa+dXI#xz8% zHmS$dOiVqhKBHz*ax7!D$jMnbJST%*Zh||@F_S!B*+v%n*c6L^eF3t1Lzy!rL7r4F z8b!s^N>-Hp)~Dys2(oZ`{sqcuN7X9bYT=3BbUuDZb~@e*$gnmcrH>1%r88v0G`?eg zmA+!f54JbAUwM4njuX4v&YfHBUw!ioD0>)>zj z)YLs&J3F`EJM;SMH0MIsr;C??!_key8qjM%q=A<-Z)nI*HShxsFendXnFdfkQYv}` zURS|)R6ka|pkh!UdZf@Og%6}~h`(qS_wy85pNioQF*J)oC&GPa^(X_PX@WS$6bQ*h=Uq!v46WthHJ*j|d1y~gDt^!_Dz%LZ=lmaFcFo1*iWN=0XkIG<~3}P}^ z!GfG^V#zTUy2%K3w2($ZJ|J*EfkOlu33v%;L@A|ChY*KYG_BRB8D?6prvOj;Jc={A zcqq~tS*Cj`9B3-W!k6KN7zcz1=NAbG!3&3A|LQbJBQE_z=4krs^oaHb=8w?>n_icq z`*beMakx)@kVl^!a{z)_x7op53a^xc*ai>S;8q*#wZZ#VIAewDkd)ZuGZC2yKE(nF z)6Y%hAtT&rg#AV^Ys<9c87;hte5D#3B4g4JT$GcFR~2NZ0(^>D1;KTaMf?dl zoil_~X?+~XxClocB2b>HsE`i3LGOn5v97zec(N4+VG0-}!1EY`_@&Z7ZOUITsn`1} z{IvxIDmP5m7O18RS-MO#Uar;tmR9`b*v@d7Ff74G!HHYEYW&J&){lR}(?J(Deq&vMud8nE_iH9g`&Vwg>ASOEeQtkz@Vf6#Z~u=wCzjpy<}Di@`TDli zOWohNxw1D{@*M8R6X(KgJuh92(PEhfKGp!oDJGRlk)9E!MBFr^A&f#gP0##ae}T$w zv7XzEegdVQ)aCw1pIF0~=iY`FGygB#Vchq*sj(!_DGH#Xl7@c&nJLW(V0RmesKEDT_pl@B;f= z7MlRzTP&nlRMwJ|Or}$(h)gC@PID|CTKfObt7_q-qI55)X+fZ~yMvB5ejzH=3mW>< zcXJ9lmCD!7b01LceDvI3xI-w_c9iRi=&yM?=jIyNUjxg0(CCZ#$X*}BctCfL8>f+t z+DL;9er1E7*#gsnku;iHJ=aSbX z?5)fZ<_z-^!}1Z%5ndsbrR4U~;*{2*L2Sq&cLa##2!pL0Xos0tEH3_dzAjcblh9Mvr!;E@Fk#c28 zA^GT#-5*MAZEfE&(a5utrgx@id7BBU^m}V4J!y$0G!lu7glrI4f{b64BfFRMTshhJ zcWOfC?i9A{)sgDnRCUer?uv@;Q1UXtPnpwm(^Dn%l;6B5j9ppWPAlvyV= z8qk!YK4v}BMpV=cIvQwh>G_+YmL_L$v$mFhrVmu5P=Tg@=rRLuZu6Jgq049C)Um;H z=h}9k*pX%2gs-KypLn)<)Z*3(}b8oJ>po45W12~rNH3toSH=HBg{ zom=mjf~TncrRRD-uB1lvP;_=g0YOENf_N0bD&PYJys3cW3bZY0{UeTkzvBZ zD)Y&hQ!;p128U&^Uj{x|lZ=eA@Foi{vG7wC#?gAQu!=x0fiVCsh2@SqP^Q#kv8q5m zjiWq&|G2R@0gRSkAAb-dO57eat={``v-+4D| zHGXf;Pv?*Q1;b{Pp!pZ@yYbqRIfYj$QAN}&Q@~q_e=3M%QYzIjDG^~1d(P;|jFLeW zBWTF18h>I9T%Xg7pFDjNuZQXSJ%N&_$A7aCJD0X|Mx&AZ$@spJtTk>k?lHb(WRdhU zC8G=1DuXH+;G#VugS%v4L2^gQh=e#L^%8;{+&4?^l@Kd{4B%b(6v(Rpv#=Wu0E3mI z1t~d~Vh|i=)MgznqGFmwo2F${1)^!GaJs2zWpzBy|B*e}^z>#=F#nA6B#>Yz+k*3zZ)>JF=S}UAw1z+oI>+V*@(h5IsfgiO1*94C>oo*sH z+Mt^sdGJyMwni|mwl+dc5%?$!+rzLv45M`HR8N4s9Dq-eQ=%4*)xJ|pQZ?{#4ZK5# zOukw}COy#Sf!93nln44flOAI6RCvgZ#qhBK-Zj7-2DrfhAFAOEH5^jIb!vE1g|m$T z`Qx6I!U-uL>6!47mB2d5b_q%W>=naW@isBB6@#)E-Yx#Lm^8Ve$_>TtLO&O*tdvhy zRdoa>3+<_r5)HC&Rg!66R8_|MOQt!eooSxd@w-8Z6lqA#^XmzGsyy%(LCs5#c4l@Y zf8H~j!wYvt!l?$JdO+AV`ilM~;S=<>hzB=KEKj&dX*lV;4-#^rPZy{+2i+78H8Kre zue%KK&rDMw`_pZSYks}_IKYuXN5{-H-=3NI_BAsdj^fBzlUBtIysvrVL(p%iYOKpSwMkx}Ewc3%cc|=tU6)9n;B_^Iq`B^a#QM1@y?EQ3hf< zJn*ROLm7h(aDxmyGMHfDZ5Cc*;dvI&Ke&tc4{!pt2fbgkmq5K=)FX8TC8$IgwWdI= zkx*URjt4;?Ipt4;AK|#%!U+q>KRR^cg&-Cukh5j`(jTOCt6@JJS`9z`DRS`j&VM^? zgZCbv6VY=XJJ-lIAj+dc+;)nS!$)#BA%8|rFzM4K1)CJ)a)nePP08d2nM|${bK;az zWl)MGN|jt8mdGXIltOM$$i)ieG?jrwrc}x#3@1tU3_tn@8trbTooTZnxVZ6)7H@7l9`1$=q_@>Kfu=Sx}j&w;Bxe#SOu=WXfF(5?O<&yPA8{p7az195V+ z2h4tW-w#Lqa4QzK`9V?#&(wju55lErREYU{}$}BGROVCpFJ&$Vv5CHL)su z3WD1CHN`uMPZW#~m%X{UGdLV1bwO|jQSAd0gss8rg1-vBA7r^;Z(wq=9s1g#-CkIf zc&8mUnBOv!c5|=RnzT+^zi)lo`g^O`Y8~oLsl1bAWg4ub;Mzsq(*;4ZsKATAEv3^n zYzr#UW@-R1BbuRrr|Aj4f;R66PvJeDRE_2@=$RBoJ5pOgPbHPB%*myvHFIP$2N&Pr zytIu&OwTKA^yP_=&B20f{D3)A7o9aNRMZk-Vk7OptHC@Rh8K8@*}1-AOHcL2^dC>O zUv*Ji?DDVo_1*B5E%oC|X=E{R{o1%WB%6^(Z6mwyznI1st5;UXEyaCv-@Nbr<<;vh z-xY1Wbj0uOnra;{wRU^fTv8ZW74MvBFDl&|~-FMHIgX@?2NACIa zE#FPQa)qbMS~}XadZaY$vzV(oDtxWww9+LTyK6*;q8pZ}pa9RM3jU~q|5CvZR6kLX zdsHxj&XWSv3iwn3zg58V3iz=CzN>&naZF5Z<)ef~F@hG*%z}@FPguBvUiY&^q)9~) z#3y*tWl|~O5WvuUCLEZWe}NANsD|YCfIiYo`t+H2fa^*>oQv8q9>@#X=l)DB+Xh4< zdeE8|;ar5DMX!I=1$|C<+X<(ffZn9V0a6Ft?s(AggoBxIz?c?3(!$GHFyb&&Ev(gi zpdkTOmui`cajJk-8C1ledS6A{s)`otfOUnHv0`pAvCF#OO5P<9!EdM4>JwIiDx)B! z#eU9`%8C>+co<5i4FzuNw2BlJ$)}~L*U)@WG?%)O8OBz=MLiP1ybbdFQOU&bn~99@ z`}6C8Sb04T;0YjXgUK-7UZAO`roz#v$BT@Cfa}{Mp=)k^VCwx3ulfDhlhiZ2;B#r}5xsp`46BWQBl#7KB2d^?DG` zp>g6-Uf;v2`Lr!fxWjWdQiac~ot%4X{%JCX-((6s9W8n~9WWg|_aN#St)?Kcyd8S+ zpEhV}14~;)8oUzEd$o2>`-nhPTMAxIPsK2! z9%(FzN)T6^wzr~@qLzw23-i&1lbAV^8ENF7=w4(l@QI2kl~lZ}oWkiWs1hkX97RnU z9ob8&`|_X_BFPO$M>YE6nyIf%ue)ioqI37L4e7_hx9VG4gO$lEdO9x~s-AA$^o^0! zH#apomu*c<9GtHAU-sB_*B-w-05j2xmsB+@-x?j?y~I6IHN34avZmMP>s=EW+mouP znb%20V{5u`BH4@ZCiUfFWwhJFW}sVC=W05l6^F~ZG{TnQNeFj@Cz0EJE}QU zb_)2F0v=Vsw=q@{Lz5V6Vvvgg$@~$H^og6qeTajw(8WR{3tkosEO0Em&%(Vd+{!`& z+szUW3$m0}QYVSxI2{S%*4Vr!qv}tO>QC4MTy3a*k%p5L$fpa*FQcFXGs`aAWf}!U zBn$V+VO0+6DvIGi@!{fQ#h(av=Cz3g=ioTl)Yqk%JDxqEpE+zbu*R4NP!qv)~l%!D^QxdllR>+}W4y|&W1PV3; zi{$XO9DXB*7v%7i9GE-haDyBOCKsCJ{c=(*hb|6GoR%%$NdjDi$`OOcJfau81m&=BoN{*3|kWk z`;Ef6l0vv>K`<|Ulo!mGug(f)+j1yezE0u$Lb=2|8|Oi}#8heYzdp3WvsO52Jz*uc zS;1)CV>(4z!{vO!5WCA_DETa~a*xm`(Cpl8XafmTpwqMsvj&dQNF z4({OKAWn78Fam`3vI)?2 z3uTn{wim*R<=^{#M{=B$dvE{G^S2X?<0GB#yx+TLtOy(9sZwLB@hE{WRcxyUXKydE(?j!^77+e8STyV`q7In$19-%ERjbrvRQ{3Bz2>pefc6 zjUpz~3cPB7Fc%|crhRr%`=fWp?rZ!7Ln1^jNJM$1C)qor=PssaNb%kAgbcht$)cw* z>wCk)7@n@yK&l2b%z6*0npFfna|#vgR>4;0xa*}Zx=&=}CFZ32i45?-R2gKFGSWzR zj2^rwJBK1qjA=Q}j2=5ZpYYk`B2z{6O(BYs=bgFj`Y{S18F3gT!5Bb)KkYX`e-gXK z*r(*WL!VvZ&Vp9{Zxft%{|&FA_wIcBb85?xns0v9OYaN!Z8_R;O<)f{7ife~17tOT zBMhqgo_f++4c}D5hZXP^oA=aQ(N#ezD&QEF>=ZW_4;3FMK3e={vAnzpI*SI2NOKXU zXvT8MI`n-RaNzn^URak7rKu2bfy(5d@uRh-Z6^LJjAEzgO_5FkS_CK;;D7)js_@gK z9o}K_^j6XkL|tX&TKFF=CDG zDaqL+m1ara?;c`yuIg^U#_jlpEkU9 z^OW>~B}+TY`-<9od#2jj_pYB_xpeRRPygP$;h^xO(i!Z!p{I3dN~V$bPMJS>=JNIe z(cUnyv9om~7S1ti)2sS!?r9s2 zz&_7m582~^tsYp2f||`z+>7N)P8i1QHV0s&yV?OK9B|M9_c&mwV~2y_>?-usf1>?H zOWwhlwz5^(qvX#i;S7#NQoxG}IH7=E#Ztw31s|R@8M%fGj$nM79N=LgzltZ))NVh) zwuJ$|!P{%HH#g_^rmMs1D2Bq+p{X^!SPEk>aJ`{`Uz|MI#M~7X!a#|+Vjxu_5N6z= zwtTs>g6h=R_74vyBLr*@6B|m|4c$#fAJXf@f#iB2H2o5KT*8s!K;RUxV*A))t=d-A473*ThQ4sa(^s#|44(cWocyAx+^C&Y>WX>&PpMt%F_R4fATKV`KKZ8G(+JrrG_)%%c(8+$DK5l%a*2 z>ZwPgb?x4n{EO7((Ka$GKj{KtG7fe3#pvTOaBIUYog&CY3+CeS=SBFl2+xSW70DEF zmPm4SF&$}^!+AOUMGoyUsH6_uD%nBVNz|rLVFp8t7zPMYqU(ZA!c-eQ5v|^!;i-Ly z$-j9BeJZO*&r0b^jG7q8QEFMe$+UtX4fdLa#qnR#EW7#hX{h%DC7B${BW8^6zJh_t z%wLcG3KRR7^jd-|cXPR11^4^#4}~&oS!Wr)uM9Sq?JgtNltFnJ_{-p}ARGw7nj#Pi zt%aS1{ErG@S0QXJ1b<ez|OCb}XCUp1n8wU^c%#8*;KMvq>-W17nWC zUhhFK*@?VAk!FB00P+8%8FEd40raE7hXO$t4`#^3L`APhEa|mXq>7n&1F7KVE3yW3 zI1z~ImZ)0N2f!J#*q9mr;iOqaO2j`zC;B5HV&Yx$Am#^PuumGL=<^}J84oK2%b8Y) zab0wwL6V&ZgS@+B?en)ypSu0jn%eobYfkN$I{mii*Oic#`jz+3t*-66e`WpXiR%9Q zudc@feYL{ggR^fxz4Gdp@9BB;(e8U*UbXzxot+0qYX%RDgfA?cvhFdGH)Zwy1y??{ zZZfq%uuxdGf?9lBA@`5)kGu0BD<5q6AmqcB`OuvW$Fjf7CQSh-3&4>8gaXY0(&mf# zNRF@4M^b#C_Q6T?GWjAttc!D`k(dYCJy3=A05c3)JunHU#3kyADpvO%W}4Anm|`3SSh~JEkLCtX~Z#a56(`d!S;(v zI+3loa97`+J>d;UR!x|Q3b$V}{}gS{BS&K7zLme+F`eaZ{QB1EOXtR)IQRSalF1wM z_g~wHP^aEHl&5T#+0)^jE<330@N+xF?0fB`#|HP>pvM9)SRmC5SiOIr`6)ALGsn!N z!w6<05F<1iJB+)GhmEr54bY{Ba($DYJg0}PSh9n03_^79g$~}-!66+S&_SmT8WEut z@Sy^pRp1fOkL=;ioLvcKrS;4a7;<1F8M@(2?ZTRW{S?q|I!PDAUze#T%N`+vz7De2ygdHf_}y>~Ooj|t6u&+G<~Q+QKr8zZ-u${zK@65EMfv;|wTmcOhp;$DD;SNDrTVt_=Phgx7+g%5~(n=Jw>u zFp@bf2de15wj6>%&9+Ra%xujh4vL_No%i}4^^vbqC129d9kADN&_T*9jTVCGTs8{` z7Wi)qJY<1AG{LLf(q!Qq%}{QJ^Jdo7%?$78;U(%`qGIu5mRHoJf)7=2S_N+@;fRuY zgrAiG)(@g@eiaYkkJ;qCUR!>z0rM%H#$H2-&1kgS{B}(#lyCvtfW}-pKoe*Xb*VoB z^}j?HTVy3cG!GvzxIae95_lugfX8UDfYT7j?0xp{H(ym}807aC{XG_TQe;hds!@Gd?hx2`Zl zgkipoN+nLVk2@o`pw3qxw(ZvL*B;UGtF)W6WKc^XcYw{W`zS1?W#F)H9lud6->Kks z>NxbzP%Om3hsk30#P~id9cXL|p6R;g>h8+s){t!9;Oyw)hH!a#c>H=8?>BOeuo{yQ z<#Me`z})2em(dG=A-J=sIG8Dsmm`5E2mhUMm$es!BBhnNxp@`B@}l;#)X;T(H&!ZLXMWiHomvfzy@i zA}SZGHg7SLqh@&644)g}LnAzEe8WhvT41k^#SD+~ynUlB&$m%cJw-;9KBDF}=Gko7 zI|a{9P87JJ-@QV|A)wtf`nx>zDog zUA?j9JV#MuzON=frL#f8m7kGbgo~W(2v=Y=!%wL1qg{TVoPQ7=2eJ|F1hN3RBIy9I zLKfl`t1*@%a`EVP;N$`ZH;UdbJxdFKm==uP92mK?djbV!YL)}EeFEQ(?gyjr)|Vws zkWR1sJ(MYb$Lg%h$@utpaQiV1)qfLa#uo1o*1}FA48rhC7dw zu6W+h!!8~+^Vr`+#16X(tJ&Cs#Q>sH)uNC^-4?4AXXM#!CM$YkX&+H6A^VILJkcgo zp9Qg~<#efmm9{W;mb_UeawIX$_#Jz1#*8ys^g<*FZ~79SdpKQ7}&@A=jJzkPtr8NDNZ@IMZa=@+bT?(N|ED{*1P2pt+N$Syy^V zZ(+O4u$KV?&|88GkEML0W@ru4qFJkv?~9+`^)&fp)P{F?)!z<04y7n%SHAOLT-kw5 zlHWS{+WTkYr>K4x!a_MWlAi|0)1cAa;a=$G{qB&PSlu9Z zLzBDHz2AMr{j6IEIUvgcHU|g}*zbT@4roN5h6b}CUsT~(6nIzoRQOilhlRBQS-``y zJSrzR3Qdn{r5C(jpDQ9N(iAv1P+@Tyqh_lpVt;H36Vc|4Xj7tU1Llc%qB7cA9PvSd z2m*%ACSpOT)1{|Nr5cZ<6qF<%0}y=xqfhS5z~D278FWF^<5;On8BMffeGIU*(|Xy} z@v&z<0rlAr=E?frd#~@w@BiS{r*)4sTE^f6c;2EP!afwz)p%3YYA4gg4twk z8Q|!+22Pox#YO;1o68(kSgjff2x=T@pyi`_18uIGxOdElpcugrqJQ-C*@OxpAq2Z$ z2_Gil0=r{|4+&g&?>)SeJc6ZQS+Y*_G(*A~{CbB0?rs zA&6Fyps_e2!Vvz`LoY@PSuV#;n#O{_DgYG z+GwW5F@28iIQ}puz;HkByKo);H%yPe@ST|c&2=4@;yEhXbZU=^>L-GrRB{>|Lc|F; zb%-Fl!VGC#H#M=OB<~>ZC6bv`gks&twu&4V{)&5a;gOCBoYaC*gy9h*bWvjkTav(G zBkVWAE+gD*gzX}15Mh}Jb48dY!i!itNaNETXnJGdnl>my28-NPO`If`@ax$dq$#~t z-lA42%`Kcxujiu%gH}{TaY7$1lC2U~hBAd!QlTDoQG`fXM>S{)RhnCo9TGboy#omurG#ug@&q4RBkJ%kww1uWB_~SGl<-?{3~9l01?27m*pg4D z&Tb08NC1Wca5?~c0!IVnT`#>CA4q~9BIl$GdZ)tOw49d6vZ)!8V!l+3`%T6LY+Ah*F}F$Kl5ZD$0_|C^Fd4H z4(Q46XWi1rQ86irlaQncin{CNObL0?#UZ5_9<`6VGiZ8{B)t;c>fph`8H*|_hoi;* z_7!a>9O+O0*cWo4~}Hqr;f?>zYJ`)mjP(DCu~Ra3LFrmmXaJkn9v5t!UjP&l*J z=c}Dr$an(Uimx)>mc>04-m1)id26n*0qimD%{v@mgp za*l~NP9YJfgm2^W4K;QI0K5GJ1Q?^E2a*IziySUdc@jt?(dM`BD^88ZsC>Ia;yWZC z^;nD1i@{H@^B~g+B6*WP?$*%Eh`{LIjT}z*mYY+}z?z6CGi5q&|(B_65 zccq&wO@%?{2&O&oQ=GG$#Cd$|?Ql9;HD5U4PG|B@hpn*R3Omhk&I~W1vxdr`h1lc6 zuL)_$LiH*&X;=0tNfqre1WqMjy7>LH_s}*aS*)aL^%4PoEIcI;RG-mx@H*3?2$$aC zk(&(K7QMYi?zN_ibgWhsTQ+by7s^}LMU^Q*!!-W(9#Stl4o)-1hbTp{DhXa1LSopK zXbiV9A%M#bR8zuOY7))~tqI=?Ka(weDSr6VT?Y~9eSh2f`1V!nC4sz;GRAS>KSBjF zX~cAU)Haa@hY^}itjn7f{vwhOC$iy@Y)}W<0;DzYXy8PEpA-ODCY1Y{Fx}h-O}_oU zBR(Dzfx0u`Xa+o-0bL$=*mKN7HoH+f#j-EdOpmx>AJt4Dyy1Y;4(Mbw8?aPZ z$Qx#O&W!22SqAb2R;U`F!q8$MCp54`33C|GW6Bqm=ahVmz`F!qCNOB&Y#_}BC^x{v z2H0YN5i?9N&oa+9^O@!{GclM&lgSpjR|EHy0P=ZFiS{ZSwV5jf^M;pOn$sfXp;P}P{w;~|lm?h;M0bahf8rTm z(JhpYG5&xrg=7kP5W7n&C_YPW0zMJ@yBO;Wkor|eHiRc%f8tt8Ji2XW7yJ^gjgQTX zh1VZmzHrxqlF|it&Rclr+yYx>LCT~S$Mo$_uUvh4$27=#zT*1$nT~0HxOL?-JE!x{ zHmunj?Z z>SPkXDS#-*Cj3xiKvF8ljl`rv$&^V{`0rr)JX?xj!;gBzbEuah*Xt>qdcda_)BO( z$mSAQ!%9Kgv!N;*b_Bo~$PKIu@b3gZ4iKdu)?{qW!0hrCFF{w%U>bC#!D0(0fx0}A z91{#{AVzZv+BM`}&7&GJBu~@{H?w(-?wrDuh#8$>EtAanTU8j*+w2jm#iGwKr&#PV ztJ`g}LNF@Bs&cBQ1(7}~>6kX!rH2v+P2Oa=oHRwAh4$FCvIokqk^p05ka&-KUGAgZ zkENmv>~?~6GuXqx0^_9#VuBgDUcXmTh>C78?ib!bm#j|CdHQutpyRNwQ*ZaTM{QS9`?Qg3v9Z{|E z1sl4TP6;oMMV!UUwmh^jx_WvbeC2J^C21nNky+c@!*iLn*vN$HCUKXzPvp1jV7(5O z=-{Qxg()h$F0>;FO46?hY)GoR79(vQYP&?5is)ZSSQD2C)X|q2h9S7d;YVL2eF&G> zjF;$OFI;XgUeI?)+#Ip&uNWC>gre|U+Z$kM15`D%HN+bDoCbKY0Zuf)k}2D#kjg1= zW(xF926^4;I`TywY^sBiI%uiwt|jMd;V-oq+=g{!-;|NXWw0#>?*u;%k{5z>E<eQz3`^@LobnB51Snrr0kKAGnnW{*2$oXkMT=*ejQJ%RMS00 zt5`^BlC64M!Pf=kTR<%t3LsajO>HSEYOapt78a)E7Uh!MwDk0FG|T3;YK>8i9112y zZCL6{)iYZ4mxLycPGRZ9$fyx7k;mZU%9RExR}&n0B7h|h%^oGdOFYROWJ6f(SkZ^h zTO@Hz{9;bWiFg~Tz`Qz|yWyj47bQ1kY*q2~cYJ?_GoUwUbtW+D@1iN! zKDuc1#h(?nm8F(0`^oxU@hju@#nEd!E4a$kviZQ-_r`(pYf zdQz!x)l2nV$j;GKIHK9CA(@(m8e(N-#^*J#idoIb)7ylYK&k~mR{<(9$j*&sbQOrA z4VgI(K#v+YC3XWL6WRHA$`Cqu5N#>SGSSEQIlj5*AxJQDnoc*7okQje)H^_;w7m7z zpUH|lzQHme7+V|9L3F|XFLn{|Tp_pl2bl@%8B5)Skjwi!s90h5U; z4djdg+QgVh&WN_fUgQ*n+NlnMjQkc zu_gyBvaGR?)h1YEf=&~(n4nvUDS^#Og2{lEL~7txC2UgcQV^urq{LK_O43Sthz#xg zn~X5uc(swtHbR(r3bKqKV=YyUcFgUJ?DWHRepu>CwD_ysPqfoGWaPq?cpNCf%MVxT0>r7wTu+4z6*y8|uauL`kPXv7Q6rPhQzsLLTVexuCp!!Orf6tFM?IF0;m8 zQ@FAU95wYFi|3|=D~nN>1UeV4ZJ)AiT3+6?WmBk6kLfQcb4=W}@WL)}wMZnHbA+03 zOzeCQ%O`J1Ypv3?=?KOzbrEZ8jt*8+*X3-Q;MPRFF0fJtuVW7z=5Sep{%v90q|+!` zl%^I=MU6S7q|)GCHC8;F6&F|w{iF69rQk$P(6E7=HUX|Ps4fZ zvbJZDrC3sx1;>4G!Uwnb?(vcAbo5Q)4R(vvcT#~)qeS>Hf)>|@N?52^r698vSfQT? zbZ4Tf)*0Ph-TYFt=TG4uE%nfN4=)9KvXk+idz{ebh&jl~6b$;n-V{0(cmvbbDQoZ1 z^E-9$SC-3*<~>G#F(7sWvd=F1P=3yIwbp#w_7&EXiwA2imX85`p z+MA)dp@nPDh1y)m&jod^Gnc%S`)=;1x%|OgSe6UDm#qvC8guTuea6x$sTslQ zV1`})Rc@rQv8^i@+0a{7(!aHP@WBnSv`aW_ZKy!ZYKU|c`R6R&(0=RQ;05p7bBZh`) zH~C^jx&OvB$N=0ea+%B!mgB4^Q@YJ!XfauBHcd3eU=h_ar;OkrStF08*6GhG`;%I2 zGN^&8atxds$azSOS3zOk^kq|~ zUpJ?SvGv*8=7%~uY9ELCzPp!J*Dc!CE;0C~^^Xn3pQbzuwWocknNdkKAH4=t&0MGF zvBG$g9&+^5HoB6rq;onNfky38&{#Et8eUR02Q|>8N$61pLajh{3ik`-CLS75-6hZP zsMX0$Eh1-7h}tMegNhhUqc*0L%fxPqp<&`4@##C%%-|(TCJR6%RZQmOl6Y@ISKbuv zjZvouYRbp;l7@^<4(!1rt+-1wq#=^x#}@3N8ZxdKb!1fjI+(i;9Um4GRhCgzHeOVd zlO`VX&{OXo#?hFfd~vUm+x8u956rDkMADe zJJKMS){sVy;xx-N*p#*_jcjwnIyWqJ!&x^x?MAFdgl@I>*!gTbOtoEUBdci6)S!h} zSRU1fmh%=eVu3EpkcG7Cd-bG74?ot!PW}CQvPlb9YoT1*sU=uMehM2h$vfqn<$ReO z(3#RCbP5WZor;zeZwuf=uv9+kF&G^p#xtx@osCmc zY?s0r(i0T1jLcFr+mb?t?YD&95{@$fvZE3x=_B(zV^0Tard{StN@_B44ukJk^vWdt zx}QOq1>vbzdfB4gqx&Y>C8Uu>U=to{{y5XrZVk^H7YmZleYdz@B&YWGVNQGIU?%w@6aJhD7_!OpR(pxc3qSTg<$c%7FZROM>F^@v z?WV&c>G0!J%rAmZT;I6JV=UWfsS7HdkaB$Nc=!Qt>w*-Rl>(Yl>V&m4eqQV7p?kf?PvxCS)d= zM+o+~z^0BClF7O}{wIOo5;#R*A%W+xfv1&gsjcDw-q<&D^A%-Nt*$-gO(A>tg!JorhSfBKCpaY;TgB8)>D4PAJoGR{e5~eqTQ?|^R@7X7P{nH`y z{Gjl|0W`>c>wP!?EX;6iAD{jbim$A&Fiqw|Wt*N{}6?TYly$CBA?3rDO}d%W5#S0GDEOSyQ55G8zn?sNN5?KK2J*9+l z>>Y_|YS<%)`u6wr$tupSKlSdnuY9;%#(OXPzHc9JzyAIMrw{Krbo!+184j8m zKO;EoEz4MLB!`T!&j_6?>7v{S-3I8!s0A8$wB;wNo*lY=?TP%)z5Es9135ft#60)9o?tbvR6d4Y2Ryv$NxA~NcF#SV9EiA;oZ051a! zXaPgNo%^@E!cKK*N+>;Nv zc~yDa^LSOBBahsh_h=re%7dId*pUn9m-@sH@A{$APust2%lbNt98G^Noph!{b2^|N z<#%Bh@p31@-r@=;9CgCiX86Pm@0vknc9?U_{5yt^4Fn6M*BSr|;#O%ku_lf-+RqWJ znk)^eP=j0zd(^O14eNyM0y!w0L{}^8PVkNlUXTGT+##*lKO-flg}AW{Ly4Kxg%M*= zcNMu2bCi`zeU3hxltoj5c21WQ%^)^u*cf`eB^ysFKkTPG%tFtQlOOb5dHANtc>4KW9evjwU0vC} z@$o@eUq1iV?it$`RVVY%(XabUzG>6xjmiA;-RovuJ=H(@7E4aQ>Ewnf3iy0tCi;xv z)JiPsd1|g?dk8k>xxFPkcg}=ZWgD%BLI;R|h6edS^M!`otU*m4O%2rDvBMGTKj0Ax z1#%yaRc_|VLgu%{9M`0W+i)>hiAc`m*SOlw65vK(VO~WFHwv}{`}h|RH%+R#L~nvn?S#8)>~GkI#>6;+CoHP=@Vs@8Xu3~pa<8%K}&U`8i&y3HGH! zdphK%SEUow{{)ZKljY&hdtepwxh!(SiIg)bq|Xl3_I5iNvO=a6Sa;74t>>-e8Y>K1 z>6Dymv0dyH`TIoJi5ZW&%{sD>iI`-9^GN}4w=tR_Wo2M)E5clZwGm+ANSEh=DrB&`HhmI3$co2p@($40x2#E=MEpznUx)q5+C?EE*8Md4knK zLK7kb-z=VJwaALcaW1(Ni*YA%AT@ldH+yL|nU)RJ*^r+NJF{Vx9|rvJh96G(X>fq{ zg7Cmpcb}V7yJ66^*+t|on~SV+!H^5iJE6}2)rNM=&oID3Jy`W1*TX73%{l#x?n@n6 zhg}5NRIX|z6ewXQ1`p)4f?~cLo|V5LCjw?&nJg(SI7lkZX7jeB{lN4a6N#GO@f0R_P|Q)!YFOQp4^9i>LNkY z5o`J;Y=i`QX_qeU1%1Uf2qUfExd&8<9goT+%u2y~*-ngSyh{5c+;jPUT#^Gzw<@6v zE6W*$D8eT@GX^tAFry)Z9LPADL3U-p_Hj7p_sfpRBuiZ~(^V|# zSu#iUT6K#n%`Ij-JC_l{LPf8!NzHaM70ij=d0)$z+OmX#RZPrF&35 zZp5?frWKd(0F3q~bIs8E&Nx#5{U){Be5eWoQ-gampe6(IGT_Awu%>TLC-QVSpAM@q zZjnxBLs0PdI{1^07ae5KK4K^K<7597UX3a-?m(A)$WE|j3f%!xV1yk;g#RXy%ws!% zX*1|ankoR+U*shtt#9&}5$i&}_^ z3HU$Ghae@sQ%d%xOz09;^wkF)msutgn2}@ws<$E5m%)|cvF*ihrWlH8s!Brv$OE@;_GiN`1BsPd!3!!XNS#JSY?F;R(J!YiiY-(Ytq1*7z?NQ zW)3A;OLP3z3+TyRCXhmG-9%m#;3)wfz^-WgHT=yy{}6Tk8CtwqK5dJbOE)msQsNcm zB_(pvD+@VWFgBH?iUtgZsE;dkie`(&hI?0t(!>+B*>o6KVVn#}=AuABLb{ZM(A~=f z%0()YHjeEerJBTlwx1G#F-oFmvA?k=w16&88T<|cLu;KW7#Fh$)dk~Ogz=4+$e!=c zDf}0zV@B!497Et1U`=7a@FZ7)b9%Sfe10Dhe6R((h-E-11B47~Mpg!o%x^O~H8UWV z254}GBp;1j9F`@XI0O=wzgnus@Ik233z)awe4EnR=(i&Sp2uK zSS+rGe^NPeC1!stLzqUPEc{N-bZDIh&S|;R$hv9UrxDdOsGJHZQ?sX%d#1v+sc`L7 zkWYc3$>690Wff$H;KdNMmeZMdImN@pWH=wz=E0v?Z?`QOm|T|h8lSVn2^%c6!5kaB zXoaI_n~KmSzA1hv@~naVQO$V`!I=6c1-e~eD`sq<(}hJBM|fCGwh-b@?@e_$CSf}s zrB3K=4=xRo+#o1}5S%ora8^rWZ=|hF*DGQ(sYoPP8|2(>rD;GJFxL)9tygGJ3xgjC zlLrYWk(^2MeDF`SUo#$|QAxTzNF3}J-?8`XnZBgE#-7=0Y{G(#e(4O=L>3PQw)}zM zWqrQK^8zrCMQb{7Z)N2A1qU}Y|NYbXdzV&DU%$8AHnpd>y+|qR6_hn|S1#$YOxe74 zcv^nN+F#z%bNj+jS>KKAw#e*`raYOfS2bzQl7+K{CuuC}`>*&7*)1!&yH+)O6!yHx zaGNER;;OOt+!PCW)aIOUY^1ew<3NL5ENEXobMpKtUf!5FWvJDXpAstUxvrxqMNaVm z6AEPYSZ}T3JYj74ucV6n0B@2H&|a;`S7`nOB6Ue|1#a;CswBLzr$g|o* z$~<68G&>pbZ1#{I=dhDt%herD*g&J;P>F?)4!Feu>+rP|ZlPUPTP@@p3l6NI?W_4Y zSnjBXZ&-81C1`4^&=o@S2;QVhCv?ac%30G4)=hDw1Z*WBl)&K<*i&+#gkYcTt4pA) z1TfvQBtI0+DS&A881O^CNbyp~0jy1**N? zl0ZqSGFoj5L{qU=86hp9D55FFR2DFwh^g4zlIF2UeajdMGK@`NCPh{JO)zl!XLgEo z3{jV1E=A?!OY_C_Gure32XT(`9X1T-lGZ}hn~Vi_p^A6)V)m>Jv!`C$QBV@Qerm^c zvvYz2JGy7>7_3|rhz!;>4mD<^Mb`98-#jl=dFA&9SNv!xHh+RIJgxrVa7QSobzx0p zMQoZsH#U4jw0+aONx|Oh+b8umWaYNapEPBtdsbmi_tGtM+BVLc)OyX%#=;IC+P*1c zAISz}9jyP(!-!k0plnTPUEIn)(hBN`Gg1|4i^xt!;L!-QMPdO`7k1OGk%Hx%!vm65D@LD;b52+hll#~JXC|F7({Ge3fxQH_<%yNQr z1YW}VM>XK6fe&in^%~exv!{mCR7}223oEoYXvuW#TrDZk)@n(b7L_{qOgpM2SadSt zhCOb$sQ@#Dt|}n23Se>p6c+$r0Dmg@XSlq8oGN&&fE2j3yx{kjMxqrrR@`2}S5!=$ z91$!Qp{Br}7frW1qZU!ja%Baehw!wN=WaA-l zWwfv9xZ&|-CBX%^_g``Q{F0Q$>z-Kd@0+)b&c?c(2X~&&QD#j`PQnb-&@|$u>5tXB3A0wr0&fGe`K-d z|6hES*tHmElK%odzfIr^zg!Upe;Cd){A{l7swNfH;ID?&RWMiu`>T#rk*!sCSCO`g zSOxjI0zN8%^ZD>WJ_Pc?>fh`qazA|NKkp}}{jd8;TShE{MAGM^lUq_@n+slaopX`n zF8GT9&d`Bg$O>EKJ#unJ{*IhHB?pH9Y5|aMHBFh~2u>=DSac3Y%cO|Thq+WbY_S}y zJs5<0f;6|cHwbM(NDYDpg|gD;vv{J%EU?=GSXFJwG1NwtEbf&MxHJ(#`bjW4#@LYO zu`W+ZX-pfTNl3>KGx-{^i@m1|tv^eug^;*Yos6Z9Ncxn*mu%0ENx0)O8hMyMz|WJ( z>TW!>Y0fSECBFKuMXPG(?H(+1P3owuTh>*jU1W%^x@%VZ$gI5P^#=x~-+6UYX7kXL zf!#ypGFi-6?CARO_O8O{(wc^=`ldJ3x{Kxxub-CJQs&NT=%3VneQz+kby5Am-5VB_ z1fuiT&nli#nHC<}I3=Y(k22DPvbG3AS}LwNoRuPA?Z1j^kqH)=Oi-#+sOQTx3b~w@ zsf4IP#EcH=wV?ALscMOo%fN-t(!_A+r!raLtpG1Rogll77v50ti$}4YomuGU@bTL^ z95^lgcwFRK#||*hVOm&Y#Sz=Q)?`BAe;hDh0(+5ASwm~{ONuAD3n#t?SAL#5EjQ1T znxCJVo|79F1Ku=$z>|iZmy)lr3M>9lT!g;FwR~I=&Z%e$dsMvF#pAD7i8H?gR%Wu`9HZmci`Gn({u9p;9Wx z=9EPghzv)#I1o@d_gM`Z%`cgbgYlQPnCUej<8iCJBV@ z9YTy<5no<<(TQ6(aRKz6Qq%Gzted!y@1UIVC1JLC_E?yEdu$hClm~YWI2(4_2=P3R zi49MxT6wN0ub(24ghOvrTzQ6O^^9fX983B+1?LQFv7rk#LS$Qx+kLuUT0MRyvAu7z zZKS(~pFA%7lxvk&|H}>;Cm?77n!-=Vm&#-8QUn-#1wUuUnxulTiSCfsmEzHwJoqag zhaYk+^mJ1~MiA2O4wr@~CK7^u!ZnX2AQ)enxcc72^91Honq1Gl$rltB$4L#>O3ozi z2-~tS23Jyi`5n3Qb4ktk2Vv~Z(J?M}YzxBPa0nCfku@2)dTcg>TW-coxZIA8(J|Oc zZKien1%9_|2+!2fGl5+JH-%b9{O$`MAiKM;goF62!Z9e3BlU5XunJGaE(#HLb{^Y9 zdODPh{*YWD9Amjz55|AR#f8uCeB%kcj_FCj1}m&{wX}rz+_~{zDe~E_HFK@PYyao2 z;XMk?6YlZ2@GS23tbgls&yIhNaJORosVEVDDttm^Jr3r>VP4dlp2qsF9!?7egfj=$ zCwdUvd0a|;9;C4DMwf2(L~?om--<_#9hX~i#Si^EE0$ZwS4=t2BIG=u|2v2DcuAfdvRmYARFL>3$NgDXp^sk zuHViV%*$W!P%ynbJ54uib!nZR3{&8W#aGwb6}fGT2M!q@zUHRIwF;uPbp+G9<_#53 zYw=93pM_p}Z=4@?#WH4Z8o+gA<6W%9yRdMjPsl73XVhViQ)|_FwMP95wqOk+ z4o8>E;EXG!AjW=RxJV*w4hX^GacJD|i>;ggheRvZ7aT4Ch z41Af+Rh>Z2VtP`SB9|a&He(t#=SlNO5KO~w(R~L5-^Z_nLZ|aQ z8HJtA#VNc(#b2}F8bKkKsnRDErBqi&T{Q+I#A{MRvr3#*_0`tVCi0Z0pu93YJzQOG z!BHl$#Qn&&BaH1_;m;A_OdKjD48Wj$8dqb&CLENkObFL{$_i2LIhl=!aAbLRG}RRQ z@-do`ZC@~H`JGGqPc$qjxc2%DrPrRgehT^f+6S&kx9YzAzU(JzlTI00b8-{HOZgef22ZrNv3?|SW~Yfo#k6#>bCsyW{M3Ykido%CgToc zdvO_(Gj{j1x@83OxToHdh{=A^V zIios5-KLjzZhm=3M5fd#yOmnC(Eh+bD2`$l2Y*ujAol8;d`Pc%`zfyYBs6vVeF+rt zBhWKJ%jr>kQ54ZrTB7S_(t84W$Q3-YO#D}YtENoTjAc%A@fiHUvD6-d*CH;tvtV*T z(e<0JD)MH{jKzGp;e40e19E@MP+eTR0CslmToB@Sq=wD$&#G5nIgk~=Y$%BFdZ*Ps zb?(v%Z2vvUU)NomK?>ppd7UGapCRvHw5H=yxJsO8ino!%*(u5srCEZw62%vXVO8lJ zow&|WKvF>@!pl;4lk`SQ#W6uoVf4zjJ1@)`r@15*;y8iWMXHk}2=OZl(;p)JosxaP z1-afQ@-mPk9q}Q0_$YcD4I2a5g=u++AxC=Be2zj#0>p)gBR*V`fQ;;NDnt>5z((7P z@drc@^vfZ}(oU6F<&?w`WErf{J30oK>cIZOylBXTWvA?sJC@D7qS#w7Yx2y6L8F*i z+p{iOv1)Kms@AkX?}%A#(0Xp$+7s7@;lzqNubXZ##6)Ao6&ud~)saF19rce*hrCsSq2 znB|)?&|Kh9#mK4YHxGn}4AYX7%8a^>g)6HNcPPL79M@vO`ofTeJ66ua*rmalSdAq7 ze3$NxB>Jdey2u$Nc0GHR;~yWsqIchaZYA9+gI+!Nv47k;^2(l0i*|Hu?k^vhKmVSS2#yTai9Z$HIDpPN%f#pGK<1Tr0L@Ws<400!B&BAR?jCNoNY< z>Sc-mk}Cvhg{mFHO8Qi>NYSlSk!Gz`a@mQ2lFKo;Kd+U|Mvxw>w--r`D? z-Tdv3e9;wm_LH4-PdAQ^$r{<7PC2C2f`;-EJtaldDfAjd`J+90y~Sx!NSxR*ffG;A z!jiJ)q6|beGD(%P#w7h=zC?WeI91}6|4Smlcy^3jH!ciuReNxEm*c7eT;Cy=%j`r< zds6L|c(vJ$Z*f^}x8U<7xU~zA^R@x{xQH{A68?!4t!Ezh%dp1NuIqpNB@_{U-#yc#ydm*pwBH`ix%Y{5uZe#~BN7pd$gWun-U3z@WY_k$|ASmd+>yD1?_wAf*DO-2r zk4EnO)%vOnx1f&QW+*o&> zrT6=F2-w46jW!EyW+cX}EKP|MHDn!{pw=Lrw$pr*qvyl;v^$HI_`t!UCb413Zt zGK7Q*kb&4EayE9yB4UqZ_avnrV>*>cwUUnb*>lVqqWhpQBKy8X6S%lDvcD|&_M_`o z%0%y^fl^D2*V7L)N=vv24juW1ZP z%WQ0nYFB(2?w?=G#X1{>m`hX~mpGn_#{*(6jNxD8BDUM3$4MY@KEB8E3+ed?m23IW zVHW0+@SOPx>NhiCLNGdN&!UQO7O9u_nPJw>=_`aM<5S>iq(wZREMey>IPVj3^pu;P zRIm>o=H)~|eY~_8@@HpXPk!E;{0_Kz{EOI^;i{7MfnUT%p|~mo+(v$X`EgL-5cmiA zBb?z0a2}68d)Vm|ggP$ISUxs3HdE4;iC-+i+fj(Vv3tjgINdSGhx}4sCOZx9|I+gi zIv7P8`*8exN7w-QB)?Sj)saassV?zByaa9bS@sFo6%3Tw~&A*|jeJY~rGc&+Z)yQy(SX z2kr}Eyq)04GrYgO@wJy6Pa$YTvE#j$9Jf$M1|CoP2>qg;eUA&i8ham)Cwy@D{Q(9i z7fje0-^9rPO zlBdVc)9=eQ=N6l!MdE#qosoPFcplOk?vINzLJGTX`o!!03ny{GF3yH`lf-L3#cOt# zkI}ms$L}QHaKRzGTgo@G85^MNg~B;uIpXz$323}D_7ompE?G->yj(iYeaqmVuw3wX zC~;pekNpF`mt<#W7dm}OI3+c6JP&# zKib{{KB_8B(eLNS%-#AmKrPB-9W>l9?nBk`P)TbdZjy^rkdH5LrcZ z?G#Zgs90C*x~{I8U0KDo?CKT;GB3aHeQzcN)ZP94KL0;qX5PHH@4b7^J@@o`4l@wf z2jv7@udKT$?$e$$`uv^R z1=uX~k2@n6c!*Vy+fATmFnERh1yq-Q4+5_u?8*YJTnYjn0uRd&P&0__PWEq^e$mz% zUNL(>|LVHBe#_pJ3ZzS|ozGX)u<_C3rmY!Iv{Li#h3$z0=iIPr5Gi6&O_v=W__Xt# z@snjAp-%P@YM2;N%fUm4WWj0;byLI5CA;Tdm;IYAkIUi7FGOak4mG-X@#Q&l z;4B2>LL5P+JTk_aq)xgvQ&0EIJ(21SGs?h2%j;=>o7BKl7$ut)%DCZRLF3V`O)_0` z-pQ8#;&}@@3D=RHQIdu^*|P#>pmfn{Gn)yc(b@!jngDJskw*jfHkd&$lt3Pn&7=4# zg2h`4QDhr|M<;7i3yRWfjPV62HU0AAjgqFRFej(5$(Jnlk5@G{sp9*K$qYQjLM!v0 z>M{gZ>g!AtO&p>qOpYiwT*Ztk7Uet;vYg2ca{7z!G6Bvr*NJ-i#5GP(ebgfzg_0wH!1oMo=Nm8OLh0M9tA{ z7@V4iXU_Y&t2hGNjbt}0(21&v=yI{wCHt%B8FX3g!k?!w1%Dgwp#K)j@2c+F-hUui z@EEtkBd0)vdgf_FiB%8xpEu`q>fM)b*4NY5_c-M255*1$t)Y?i39aCITJeng@C+rg zA`LUGR!6{Rz;RBe8FCVA#sE5ogS`rfX24VBm=QSVpzXXNowZ)o|{m|CgOxv&1hljupBqRx6aV$34+n~&sM`zlS@M>ow<&Lm;Z-_$n(0`4n$Yb=7tdqc-j5Rz{DSG4?4 zR_^d{PfUa zoQ%(xPhv$%CxDNP>UV&X<8ht`ptL%Gh@t|;F!Oq|dBd{jyE5wSXZulll@p&bDhImp6bJfJweEfLx@j%as6JRfFk9c*q zutF^^3*wiJb~|U%#i1fAs?h^oWU7GbZ3sg^G=yCxR|HbRwuL^S2lpR6x^xwbspO?k zg81^nZNI6RvDlhs)F&+tVGE^3lQ8!C<*{2%;(rCX|$D?ixyUU=z^cMQf;Ca)1MOtMXt|ZpFj_zv*~TJqeGvxNdkV19F!1h9r`Kw zNip@ZP)jZap%yFZwQ9i1pw>oPlcCK}s!aFIQg{Fo|HCNBrT@ME|D|)JryZDd2QUea zRuQ@;>OX2sDA)}1m%Nxk^<+i|(uK_r)Hs3dDY?i*C1)AAqk4kHt*faKqK)}!s^7KN zHwwaBvhs{dl~LSsE$_||t;la4hNSIg!6s@96*e2Of_Il`aCL5Q zixGG?wFg2*fnWD}7Jkz&ad4U;RKu+AsRVV25H(OCDH&&j!ooSwmh&J8Hg`VC$*h-t zc(O*))O%jB(;lU(0ujVp2pi=xewoBHV;>&+;NyZi$ryuujKvyJnhy?s6n(@C-1L&PWSrzsSI8rd)#Tf5K)hS>hpw?bVJuLWaurEUM*mED z0YmL0y*RFsUVc${VMyR1VFLI&l}f-@6{)0GD3N87b2*Te?Z41u4xr~&iZYDyEr!fL61 zw4iz2*gy&NWad#gpoYpemXJ;4lJq{+ErZXJ*T&)5YDMbCHwSzCcR0v)P9P#|5iIfSMh1m z4ssI{b{yLkl9_aB%cU*4)q{Im%wfJFlNjv@mRRK`XmfpEf>Hme$?|687;%o)C=z`X!DV3Yj2zFJ>xMa z`jaf-g8-+q{r_RBpJ7F`G*8A@8AG8&fA%%CS6qk3%6Ij;P(RtKol zCHJJTpF)gUKA24MuCf9^3ldacg|4J4fcWW^G7w}um44{k19tds+5;ybb59>^E$ewr zd1C0gp1;X6aDYBho`L4TziDjvV@S6eoTEc%@vtDbK=N^9d66ywANsTai)Y9`)vtwm z$G+cFkKRYZ_Q4Xfkc@XGE<#?Lz_IlFd^#I+jeM#e8M=n)>X}Mv>4*$LSoFY-j_mBi zLM_6YdmhHjqlG-D^d7)f@+YNdgDCb)41B8eT_5bb0&&&8&^?%s;q`91<{rvZYIuHHk9wZI7KY5`o-a*P;iF1sV1or8spGzuKZmJC%bydqvSpj8 zGi1p2s@s@T$k6ipD0h&$vk?keBHRjZcXc*`wos(iPYm+q|cEp={kh~-74Ly89$6%8r(4L9%t_BQ3q`~>=5@8(n#R_G1uRQ3&0-Yq~8u^X^9|qn1td4qJS{f+N`X8x`BlU6eDr~3{UzfgPVL21)nH{Q^(>s-HiEeE!Y zY#lQ^GqbjF`rwH-`Mv4Wi{l4R8a%*1rXnSCLeu;)Q}<2H(K(_t3B=4kQiGjG(%)+W zjWZ`FaYMsQL#E$2B=9iL{K@MZmTK+R|Ey8l`57zkUP<&tUNUk+XQp`WOrV`eu4xM! z7JvL89FlAg&u?J5)hC!}#7ztq4Ggxtnx(pWXRUf4HkWyJ$`-S%zICZNn{&a^R}j2$Z) zW(^tWnY(H(?6%qb9_DS;9z-j-usfbGTbaX-RaN}$wC9jY}o9N z^@G`>9#zhxQoFyDaz_stTEdg;c`w`+-bBK+;by+SRH~E$?7WY5!6LYf--D`2 zd*HS%7Zc6&;k1ud}uONQQ5rsW{k2u#6Uk>3Z47vrMg1a8Y6 zyB&?=6Rf82;vqVcgXw;}`$cu7>fLW8V6gNDoal$Uo1w32!@4x)E=GG%6YMDs?6Fx? zoQF$Jq14${V9T|95WaW#Zo6gNvd5w~ufWw$43Rb?5 zmU-_z+?~?8jZ8PNLDFYC+<( zU-7uBd|QPuD-lOIpko*X^2<v@E*}gJ_0loSFkggiw zL9*h!0K;|!c>@^r14To|O`SZhY*5Mg*|+SxVR()zKc%z5KO=K&()M|)4n*KN48Xtu z6VyzyXr(lgRq-m2GhX0>5CmBZ$HGuH)yN185y9<9t^PgBs76a8$*GYeskY()PJN=< z!>UyC0Z}4d1O<%<;#h>H3)-&G#RAU&Z8djMa}C`@q1`@wn*jo4So{FJ)-@ssrF>D8P=E-Bo7Q@wDJRin&F?6jU zq3cDsDex@%6h+LVHdgu+*jq6I>TC}EN!zRcjX!=*sQ(y)45P{1C*&^N-$Z!~MqudD zs_;i4MM(+6>HsRkwXni$nRG@|u#Hs9Z zles!|+w@t~DG4bQL&4Yqb?nT?A*i^EeoJQOZQQwN!RpO9_Uts5AtOa-tlY1052&d0 zh1HmCS^cesI+L>ax2{~Z^R4Iz)b?z=UvDQ|-I(Zz823RsQ@8RPNGH~dizyakNEd6s zpVbL!U}bm*P}%X72^87%CFRr#MOI>bF=1D^G?wqrmyz4?c6C=xyKm&M0mT(_Zr-zo zysT=Hipk4!>wI%E$0qMsx$L&#pdcw&u}`4~b|#jo7R{!}t}urVoDnq~!T6k~d(Iw5 zC0+U{Iy8<7r&F+64HtaYuLOul!k6S~$AVIljJJ{BB4L3n^vT%|DM$+o^JMuNTu_}) zcQe?*N}j4_^QVugyZ`o?O_f7tpQv6@mfcc1j^9(&R9&{+ll{!9JexK>v$l@X zJ2!g!nN06oj3|0kOqbP#<*#!QbjC%QfXfwzX!Hv{<5yuo^RN)f33BdW=jhf0-Gie`xS6$`Mxg9Ilx3zUnU{?*O)(C4KD<0c_%j%_j)-HK$LOlp@Q4 zuP6{M!w#Qv0JkDAL-kVfQgO1pgIr)vIeI}RnQ(sO73O=M*n-PJ(7koN|yMf=E)Futjhxbb9=5thN4XtN|L(3}! z`EICD8f*=#ggST}a$2<r%-8XQ!;H#a@&Z}6k zpyD4bzW!z34My*F^BYMAaL)>Ds8UREc4;~MMQMaCmAOld(qOr2G%EE))fWa(A;VWp zL?4<%^;KX28v6{?4-s~^#=Ynyq)jqMdR6DoJ{ z8*iTVIfRyJH-v3NzTl|nS6IOi2A-FFuP zpj3gz0=Fd5#hp)=Is9zl^_ipVBR+w|HThU!ZsW+oohPJcTS}@{l;&flXJ=Ip8yHVV z6j54+_5Q4Me0yzeNs&zhZHSdV2TsIdjnNDjL&XG@iNUxyR@33*>-r*>EhoviAG#Q0(vpHNa zngp#~%c+b&Q%ktfs6{nI5buiuqg8qpT<681g&tg2(C5s77qPVD{!yQ5KDvk~;=&X+ zSdWYIxLgGVe>IJ589#Nrq0W^vVZ=uA=EiB0qc1!$#)9CVJu_RPFJ6qCHf`3Fp{|cV zPFTKyoZOg<%){vQeDr#oOrzqN8Ddei9lefnb;UXib|Kd3j1}w#hsqpj(}HuGRh-dg zyx?=i+H7Wr0|ef2(Q;8MFlM>`xj_pKY&-G@XcSRo;3c4iOdb$k)H@8AUqZux_83Hv zzN0}Yx8QKh8L2>Vl6=!I4{6+-WQrT_^&J(m)=AIuKG;+fnJO_&6{*!msvy>AjDAso zhoaf1=A1FjKBtqjSQ46jkrs~AHv2fMjNh;>1t%h;;+&%tR~bbAY$4AR%yUQF!C;SaVBb{-E+@%jDd6 zmp|^DQoE?cnK7b&OJ{shN+~!8Q!M?SyB(|{30VgEsdZ`{6UA#y<)VrSQ&;)IOs?1} z?DDblR!@~L3Qk^Km5)aDt?aSDM$Q(fCO^!a)9I^U znK^mF&|&pUrjNX-zCN|6bY@PGoJ6R5cH5+}vy1GhLo)r-(i4*hp#LHGXE5``K^e&I zqf1w-({)kENS3NH`9%$z?22usLrArHnlXe_Z3dHpd107TK2_K3OSSSaIwCA5DAinL zfPF^@1UuJfa%lV-W!rKVLRt&^Kg>|RGL27=HDor;R4C0L+0t%l=C4c^rjtA^J;{Z$ zDGgD9+v@}SubVaRvN-mxJ~NlebczGHOkIXrouSLbxTDfED$F1qIGwvRt1@?K+Ds<1 ziVi%DPs22(Id~3}8Qf{xm-Amga3JM5FSUu#z&)yi2gjZJU&gHlt8kFi>KjB!I&jkd)2RfrH_R4zsz zW9RIqW}hALMsZkWHhE6HinW(2nlj%2iG#T;iCPh8Oe9QzSIr`FHAN~Bx^oJ-)j3a1 zdiTBU&pfq!&jVXltXlP#H*a|F^cphqp*^{=Sx?@!?$!BocP?wcxp;c|*^R5tuAaAh z<(Dn!U1!gi>@&!m=4SH5NXA*Ai>?sOf?F4DV{OJNpUuo-T3AFX$csLx0w7uflC;vX z|I{z6_(JxXS%>erbLrt5$9GQNI)BoREyr)zxn$;FhVIJC9I>UN^R|kC?G^P6Bc~VK zym0w8F}HorvbCU87T6T58o!G1izc&~Q)9xWprxcZx1<(af6G$-$Q9qX+M&Z`N^&>up9)H%+`n7}5l_B9vV2wfXhk?W z-v506)OMf0qj5lfcJcU^Tj#Eu&$+rUR92S`89*u3QP?FmqW|H{1ToFd7}Qp$-=xzK zwLc6)Ar6Dl(Co7sjbUaT4~nbPg_${mxFIX1thc4KI%{+sh3ajS!*Z%SFMa(_`hCk(uAF(J)mI)4;1EXrTfn%m`vP z^;m@1vdj%+;akR80&$GW+XaPvdWcPx^c)K0+_ksy*lE-w5t@h~U3u_$x)~SJH@a}MbDQ)Ibi8x3Yke_UYa^Cle!%;{t!)Veo;3L@cvJ zy7R}COW$K@x>}w zN}rPIAHS|lbY>M5)z=lbcN7l#;>Vka>Bzyq-w-kFnB$NY6DY3G5bFHX+JF0G$Gi7^;R}=E;CWgie-^5M$?d;*dV%?_^9}1Uz)ku$Hu0K8cRi5 zY+9^Mh~hK)+4?p63`klsSe_>sKx8JJj%f>Ndh&9R88=ZxXCB3FSb5tY9Zw>1L|7AH zaiESb9`k0!G!EhlUL^%5F(d%QxlF!=U+G@ zbshBi4wCpY=Sa>mj2n4L zHd$kiM3(F-UnZrs|HHVGFie#Bp}G%7iD3pEZ*-KDMc|CAQ_xh83`~>Dj@k<2&h(z`z~^O7U@sp0Gn_8ZLU6NPk$E!^k&?4$w0T6VdEr zm@tb4gxbP~!8c0DS}*&czE4?dktsLOQr3!sA|uil^mg2VMF$^|JEwqDkm1k0{q+md z!m5VEwA9Si>)E*vABU6Qe(y;x=H=6;zu^A)_`~)l^Bd0uIuG0$*n2l!Cncb5=Rn)S zV4)c##yNy?rV>mW&c?j66iPFg~8+vZ857qP`ver=U;?drP^Z*1H=8WHX2 zooWGS8nUJ#s%eavYH<3I%-RCA%z{86KRgQ#tO7%r4xwjO9mH@Q7v}5(OR5=DTSsqS zWyM(5F{#&yYVH6Ytc2(&)!Ai8sw^$iT>#`FsRbKkMx1@S9dP`fIPN_u?7!Sj4xRo& z7~Bw8_wv~w6ggNF7@-zW?9FsA7ZY zRqLYtyiH@%xHzYuF@fG_QD}=QIGl~>q5w^uO`wpqMK}9wLHtzAO4k{cKx!1LgJKbZ z#g)23D7&SQrQy6du=L{U=~gnol^m2>Lnte41yRXb5dwQ`I zD2qMU-+;%(EB%it=j|H1CY*DXGo}hLTjrRlBdKU4#nQ{YI4qs!j)qWN_~upc=D=1NjrljP^baC9W&o64Z2+ZrLOUxH6T|$m z*k9ei=%LjZ!XW2jQ?8aXSa~RxJZ}S8pcK9rMS_?Nb4kdgZj(tkZ*@_0h9gI&?}=<7 zk^$uuP&!VD9y|LmNqzP-2|uVNLt0y<7w(k)_~gsdC%3l~H(~Dle%-3?4&EbeVBh+H zR6lvI^yUlfy36hCQ|G1QXHJp{7o_vjkwYZq`BzE5Lr0`PU=*O+!d}S3cFeFrVDj03KsMe_rRX!EA%$sx$4q`E9wt&N0Lc(z$TUGBcsLe0WO4Z-sDC8_P$%R1< zONZd^e&;N*2{$%2N=LcQ*Vk`)y`%Y=`;I<&{Qi4iAkt676Znk00HptF&tGr6`5$-u z?qA=2_~Ezz3gW!#CEz@^$ul)#Ix^xq9Cm@{O**w-3^SQ6mN1PDT0MkIjh%(2VGlDP zikp|k%%H1J!S;|o1pxu}{GdDpF_Xgva$2efGvK!65&~B?PO0kd4%~Y8Y{CUDw6?OP zKTTp?fz!Oj{5_lc19?Uo%03dP67~n?vO6xf3o%1e1JhVpa=9C@Z3k@Qm<*;}EP`R* z;L^rdP)l1%T)AjtqCiTb%!D;V?6mcx+J}oZyIe@TW-yvSXauPBLJ-`tu?h+vXrL?> zD2aRSA7=_oytH=`plbc{<1uYFK+4NYOl-=0Kt{W|fmXsZD zyz_y;v=uX24*H}o7SAm?-@fM1y6x4Hi)W+~lN!k z*kcM*_(&PZ#sKU){wNLmn4IBN`uoVT{T52Z8`z0~-}29gr%7INv;h6EqcfXj3Qqem z1QvHa5{ek~*vUv3JPYRVwHW@zqYB_CkOSOt)}(G_5ZjrJrr zC7IjYy^-v#k#1)@_DU}w=GDe&m;5%+=^C<|JQ|-X{rd-O-{qOvpm1O_@Nq_CZ6z{m z#qwBI=ZEFrpC~dOmp;)MM@XDAQSb6FVJeGCYxEeKeX*Vx(Avp9HZswHoKQN>LpP6j zICLFgashBbV~89F0fd-5sR_N7MJPqkhbkTFJ+%l>b396oC>9Z?(~4b2DYB;+w!;D| zHvPK^@=F$~9q!~LL~eY;mrM00FWeA5J7Snr*CN#pjhr2R!=F!*zXu#7H@=@G!%XHZ zmX2OoK;{7H#}0T>`ul}1)=2wF`>Kmy5Yy>_Y@MXdt1B9L^rJ0f$882A`T-mxF(VWb zZbZs06$e{*qlYgSM7LmycL~l!vpLZzxZ+J}ht?4psWm0U7(wVQ)Huqi<1uNT_;{qp z(mG78DxWDRy~z1Ml!5o^W%2}GMI^dlash!HMUBMBp^mvRa#&3@q>B^j| zl#8tYSQ_#Xd5TvV?k6h`^r2kODeEXAL&_mg<~fFPXc4nUd+h>`?oafr&2BK*ZLD7I zHH3Qxc6FGkY;uQ9g2M$DQI$_?B9JlrE~}vICU>8r=T)Ms^xSr}=X9kh3oS(uyEi^B zEoy8e4;~M#w>y;OrYB!16bY=N&$=tZ5>J&6VhF^rs1etPFqT}ZTu`mpL*NgvaFx6^PI@+@v+7t} zo24#$SU>XGNLJq|-4?0irBqdYZe90NolQ?puARmoxZKWNst_+x-AF*q+;%`Rk|_|Q zI9Of?LG}8`2;|qaIUP1xLDD!0Ep|rbgKN43cM6;+@JWFa1^aYOr`V4gd6V(EtSMCo zVwyBwPkKozDXJk`rb#_EJ$>*GWr>n**`x>ak}9Wj_HKrKB$q-dPg=uY0F-EqOoZTP zS(VPuP`i^>gv^Dc{-oKbrKktX0W?yCaUy!CS5yIi1c#Jgd8b;q{MIXvNNZ38R=j)` zuXbq-o{%YR=0210hd!a4KB1h^!16?&V4_a|rcl!R-=2_psF7`K>^>rGCa-c2bl2d; zNSh(M*rhe9`!EIw;>;*9h4>wupSL@BRMFv#FgzLgFqOzy3>GLBD5#}TX_|ei;FxGE z8y*~tX2ZZ_n+Ww>D!~mjk_P z_)3(NOxDohlVR+~#NF_9AYXc$$}5@D4+6+vZ~w|29E99Z|H`lS4+;fRE24i8w}KG) zANyAj>Yp0L&kxmfzggp7w?oA>OM2;|bwdXm3t%0S4$)9k((*LFUjdQJw>A5JJ>beT9N*gC#tiY4(M4R!+l$)l&ap&^V29 z1F{oK4xd9oHHsogcI#2A70MuIPE#ysZin#0WE~$JF0t_v6Ydh!t&OZJQt~M@(4e&e{IdIE8hwGudH0MnqS_4{@o2ep#enfOpzFEM}7m1C9GW35Wq!a zHrrsDG-(l*N=t?I?HeXWj`N^#Ic|&6C5pRX>)>&8Vq6u{*Q2EOBeUw~kRnIkNaA5N zfY73+0~PG)L2J7qE(Hc=?tGGcl>!R1AG(cjKXe-(sW^-v`6|_`cS%yG>`(4 zO(vr6&}jHjRcsW;L*FahQ59GFUIn+d9@-3Q;s$X`aVjZB{_FexYqh0If_;zud5vju zF4SYm^DE`1Ast==VJ|a4jL8fEIT22v{|sl4-(YtUpVAlBwqJvFpZQ?nAd%sI{6E1x z)ad^X{(-{K*g^QNor&NWgOhP}jK4M?zdpuanUlT|S>#A?j4OXWKc3)E|9zeUJ-wq5 z=!|I=VogLq-|r85RwdIUdM#Xx-^_cx+99q6Pkw5HsEtfEBscp?b8?39YO|rJNNqRp z@fm73H5v6aCSEyof^LfFHS(VGetQm5$oZTA-DeEbJYo=dk20e~#ci`#M2M;~)+wQ3cPM^5r&W9iVO%Q(U zry)S@T)TFsLL#=UU93p z9_9%15c4GS67vqRiMzxV0~Vh)X`Z>!uePX<`VTwV*S7gLoZIl2|ACm~sDA!kZ|zba z-tfS#T@P$HtQPchXO2$rpU!K`nzY|9)>n_vzkJ4iX0mTV!xZs`DVtX(Cut69Ci_kv zoK`k&qBy&9;`!$u-fP-B*%udMDopP$mh@+*tUh?(#NRw;>hE;+H$C^8iT52`Jq5Wn z!tMOdoB5mJp5ps1gpf0e>Z-D`b{^>-6h#Mfr$}fxLstpDLz|-;5Q1yw9Nhk>VTzO$ z-<~`7Qpm4`%>V&p21FIS>kpK=B0@q+&_16591e!Cz~`y|QgY*_K7yv!~3T+v44{a?{WeI~L!Z5gxJl z<_(LznYRS~9G#IF6_b%pZi>oCjg84ne?B@rBPu2{LmC`BadWT*dz1W2M!NLp;4jkP zk#)6W$0GV>{K&fcF=MMI1ZD&eNHskegP(99w+R@oZyYgm=KeLaDouOlE!bx+Z(n=o ztXT(cnOe>txOvU(+{l@$_w%z;iiriKpsNnQ&b(a(-X`is(nys8{co~g8$JQLC|;>Z3%Vug8F zSBc0%d!wGak=OH#NXuc6VE#lP9^K3=%Qswt?AOh8=g6O)HHGap@GdcN>eP>!ONuF9DS%w$AHMCJP$3L8?#j7uLEGo&o8tYKVP*|-KyZLtYR z*7%0^4F#Ej!EXThLvLXAE<~gu`BJW{Fc)dRdXM{_xBbfbzHRy*_ifL|tZE)PYVxWL z%{3F6*Y`Olcdwj0YGm{34b2m3nxp&tAbr;7hbz&2zDV!&X_nIG2O;~(6)T>6W#h(6 zOP^f6{K=O$Y~WjiXS%<8V)^nXUfHmr``h3d?)Af=Z>LWpH7QS0n5|NrS1_8);-WB`4VFPeZ!l?NFq8sC^NvqTH(9XuhIp zYvX@xRyBllydQr=lE^jC_mZJ6G09T3`V5{71mg$4 z(9g>Q>3e1yzxfnxdg{{4w4u<^);+x~(028h6tuOqU3rb3fabiCeVD5ezLwX`;>VnN z*J*<6es-hPjHJ;FlER3L(PA+&98n8M53JXrW(j-B7pAj036dqSqRGc2o4gLbBm8l2 z0#N%7Jce@d)V?5s@&v#rFr?v?bg_N=B6VY=@Z1$AGr+ENPXYI9v)d1=AI zA6KmSX~BXYXFOU}^+;LeDKOEC7U2s@%mNC6k30u+J{$ zaV_$Zsn`4hL4oa#gP95W!8{O2P#ah`dxx$i{Dp0s9*bzvujPMO)VSv0-dmdI;f_5M z`OVA&!h_J7vqYHEk@nK8xlvTC>JbYy~^YofBSQRqFF}=Q26QZ^lNV2N|_F zlAXX%`v&YULM|eSv40EkiK%)&0xO*k8Y}LA$=}bL{U~KacN6NZP!&0&1G{1n{?Nw) zqwFRO*_N&`!351O7Hndnh9;ueVBVz`nET#rX0@+M@52Q1%03Rg2%29;v0spce@Q=G zJ}V`w&i)lxyD$2wU_0*xxBZRPzsSv7rlgQppPBqzxA@f8tNs7 zUcwUdm~4mHQ$rRWx*W8_!2Y7xU?64l|CWB}u8|J$PljwUo23*vW-bAmf0Q+*K_$9e zjEaWM#hc<`5so*R?9D#t{#0WPZkoL=WX=}c2c4WE3pK%D5Gql)XiNm1{LT9h9eZfu zxpSMod2!8}Roidxl2Nz3~W9Aa5HXUBU7;Lc>qFNp9HoM_IaYvcq#xnQjJBKzcZyS?CjevLZ9!ELL z+^==4GjCVHl4UcOZe8)%t(zy!@0`2Bzjoi!2M_L%wsZ~{cIWCDca8PEwEmH|Mo(}4 z&AQeDzV@fr-Tx-~wHzMU70}4?n3ZB#dOyD^Cd}{1^#b$63_c+|#=+<0@Q#@91eGz* zh>e>Ouv=t%(@lIrW<&(vKa)#}pX^KG_14MMkb$ygw6YNlu=GWDT+rBdSbk*5Q?`DE zL{;ii2*9NP#|qut>!$Wui$aeHgG{wNp8)N2RgX2O*5(*L-DA&TI zmv+jMy9^V61u&uU7@%f!^5ba)=g(n*$_PPFc!KbAa@?C|#vaQoIb23Ew;ozK@0J^v zFWR#6(DuFeFC}%27P5T_l6k+eR+?#Uls+sjB{92>^owpzO8;|hf z&Se0LrF(9$xeh!-o_@+Df}Z;GvXxDqXqjN6UWOckS(w~=gfqgktB+Rh9NF?*+gUm`M9>}Gj4mijonz{o!qbR*Pt_^~Zv@D~%k#S-h(Q=@mNlmDrYn1$YsT|J^*ytnDzxh- z^P9ZcCR4VT6YPFR65Lsluy;gq2^!RkYepQUtzSP-v3@phw9|&59tVv;IWMoP5H$;h zNnNce6yydkQs*V`iSDgKu(sNh?+UJ}UIRV$)nn<=0u~hM;5C-b^?B~8j>YS;qYI1! z#UX>PoRuy2?9ApDa}qNK%xGvHo)t9VOHUgeqX&~F))VK6zG}z6e0E1xkxp0U9abNs z`m~6lj9=v}PY@8FuY*ZKXR;+FCnZ;*qyZlh5nttt z;JpSl4`-%|2I>Fbjb9Gfr&e8R@xOM!z1zq=Y8f_^RjS>*yRaze4j`|L4Gy}0W26j~ z(G)1s*FoMi*d5#J9_X&w6dJWv*Bk;2uMKgk5@~{vh53)c-lk*?@r!m=9T}-+Io`-? zU_RGqSY&<^AZ!bq72awqW%qJk4_P?9&b|H;MDL*3jZL?7TykKeLPc|P5cR@%*pe2h zg*zm*EPRF}99-Xh_gx!z-TL<5q(A-0J|8GW{8mHYv;ER%&ps&qebk1aLrNGen`npPD|&k*k~c?Hb=)Ra@WBla-M^VZy{Zz-Jkpr1JouL`1G} z?Vw>Zrx5ko2WK<|CQ@(b#I_4v(!ciZTsE7$@*xzE)R`UQnrMs({CVZ!Yy7+S);5l; zlXGpCNKaEtVv`Xq4j)?BB({!8LH?&G>1jIeY%&|6oF}hBGX>_suiuV&!la9CqhGC8 z>lqFFe>TR>89=aU6f43Gv=$5Uw^2q&** z1sQL-<*A+)c4LNk>KHlK&>)Rmx4oCwA=WY&7g8xEk#e)c?9f^@pq^TtPHW?_Dv?tZ zX(!+%w%V)+GoW!Fz|l}7sN!@&5)j$_1?`SHZxrmK@g3y1^XC5c@y5ni zf3xebvMztvag)r_$TJ-$9=Hqy24vtL%1T+KWW*<1P#yO3QRTIjFFYzks6_@2_W%@y?O!E9E?sljvAaWWxRU?xu|_3LB3$#RXtY|qh+ zy8vR+e_n1OET*5TqF-Bgol`FVyOm9CW7FHl{=&)&E=qY}Vr+L~YzQ$!tWdL<7hCR7 zm-CUj@-PP<7RE!HG?piEa1n<`A(TAa%2?g-8evNp5l%N7T zMi-(fzpxOm(iOT|5gPg~{Vy-Z8oC(S8G$YGQawhOYH&SXw0l#GHPzaiZOSO8ccO%(h9H{d_wt*P42njr!EDKW z3!Q2(Gm5E&rScJRN=-k1YE!DUL0#eTC)OsG#`t4L#iptgV`CH5*iz*8XBr|JL?$uS z+Eg>DqO>-t7AAgcf;J&7B`!K?Tv=Uq-DDrO4UNktrlhzeZxW~HlCqPswJ>cVz)2fi zOfq{zFk4g5`j2U%|KP)s^Doe2nLjA(K~cqIFvxGRv0oM@@=|_51(vt9(4D;4-;H;9 z*J)54Mf4Z-{>UrUQ9v^@(Y*yo&Q#cY>~tl`WZadX$E_bY=(&#&dLP8`vl7Wz)dw$@aLo9W&_HodO6rGp60pwE~%GkK> z-y!22n{5~;XT78?`GP(zv#)PioO-pTu$@1_BUWYt{G(#fo&*Q&v?X^$qz4o5n*InCZEQU&EfA{-8d#>?u z7Ek48H7Zy3K9j;#>2K(|Yo8gsZeiOs*YzFeFlOzqKX1D4n(O+GF?8K8K5yQX&~-ge zO5uEiJOfZ{m=wclW?kS*IzD!K5VxL?=Zvo$K(9fDoF{=>eXjUfOLj<((h~KD!ozmb zdmCO>?oHlM?yWkc+*|cG<=*pJu3n*0{lXR5*I%)0X6T9@L3xHQTEVsJTCyD>4BFo# zDEAJwy#Ai-qN((rpyppPRft$>WHhMHpkk;|`5eSmq##780l{TU$tPcOBaTfcuM1%_ zx}SK68!17=Go)NzGlS(ua#Htc7Iz@$ zr$5Y%q`EhQD)&oOS$Mt;)?cT}tTH1Twj&!i=M0eD2HS`Y*|%x^0tiFI3rec+jQ-jA z#9in{u>*^SMM=sOun9uGlXe~_5_?>-2p1(Q={zp6>~Zq93i91?7N^Mq$s~LsS&@`h zIxcM`-y^nWNzZqj6Wk#jQM@_WQ=giay~mf9MiMbVxX)sZ6~0(Oh)tw5MN%{=nFo9+ ztVe?=c63XY+(NP5Ft{V+5^^)48!913KnMur2AzJXj%QGB#juY)U!jOn`1M(busV9k+bRj5ojK1?~PnJOIiOV(P zky?`2V|iC8PGv!b#L$$q%-mlGc23L{r?0zZWu_)`#VzZmi@6g!2NpL}7GgV0QDs9Q zJ+Ed)N2|xvGHd#Tyy)zq$pacHi=D2b%Esd4q1ot5dfiR_wg>m!d_!k`e&-E0?|ZP# ze^Xt0Z0?YRgdw@H(&4IYt2$fjl9TINJ6CP1Dyc7u%o;Vx>zyQ<4eMpAmnPd(3dA)zzgZyE%cRZNrI|Z zNQ7yJ@o$=RMfs!~Ub&vl#QcYe`zA_5>Dxzt+bsRA%`jp3}+v(M$)lrg^Svh>zxXC4Av*@llG~1e(pO7_XMA^uiyo54GU>NrU z_d_>yTn+PM&x>k}@Bwz@WikVp3P@CKh|yTXY-eIb>-4ovadTD--B3`MRN3D!(7cG2 z#-aHPsn(c+e5M#nAuU}ATRtu9gxCb2jfw=fJIXnxkh((N4C%1DsIGzV0NLWNgf$5A z7bhec3Kow3f-eQKBgiHn;#S!7>PZmjd3s+t=pjiyq#BE?2k^|11ydjE;AhX~XFfV( z;o-X$9=xEM-NDZ~(Y}!U!`pDMZsFsR%}aepmU?4P%-?*@8~@q1g;Ip?4*!mh(i0oT zN~7j(_3f#dIeOEhSF-E(jbC#rrghQg&(k7L&qo`t`|~|hNWs{q`u$BC7nD9qmd@Vc z-|ug%+WK(vz}ei4`CvvW~LP?>#MjI}#|oDHZgyzB77_T#hY z6m~o|b-|ItfZ;5@V{z2dBlSz0qfafUKj>fDx^UZP@!l6V%{$3vG>zSGqICB5bLR&? zx@q*x348ooUyJ*E)1uaxlWVK@)-RngWzU6pum29;{L|9%O^=l>TL0pvCTUbe@*`WS z8vO@+JJ>f4F9McybZ|3Iw9^S}KRJ`7ICH#xp?2!l%F;R88xPbskyE87H;ilAbZ*-f zZ_I^Fi>5}OT)6S2#ZwnlYoDR&9Q)bpEEM19c73=+cL`jhj>tyn4g^$+pF< zNe?dA_|lTZ&Otl>67Ov~IB~%f47_~!r`fMUen-S#=)tMzo|6nj?Bz2O%wb{spArA4Nf+8P*c*lT4!vmvvyok(;&6BY^ZmXDp$xs zK{Rb%#i;nv_SWKb--HRt{-h*Rv9?S%tU5V)@?aOz2#zi;8#dVM9Xzb8c(f|JJU4cf zDiRqevw;}7C^A9c`?%|&xV)O{eU)-Q=sGwk_P$zdewDhQX_|;xpN@oMpN+!m8=WV(2 zk+h23D6~tESdfBCL zv?fC?b5&iPB?WN*{z%s09DDig3m4vg`^zt-PIBXw*O%g%(m%M&qA3yf-^b<2VQ_CNP4ajC08vI z{_>ZdKl&c)il;LPNDhb9tp4e`k!Wm1mP7@T% z@+B7d;^KS-iM)FFQ)p7+K&mG6 zIw6Y(W?3m6Dn;NVWEnNc6x|Dug|7vLSzHQm2y7R+azU{IOAE zE+1L_UUOz;Ui72`FTeHL_|#XVGheJMnZ9M*koB`i=nFEyDxq-{>z1XFyAyK<@VUnEM{RulzKL z744Nbx8J(()_Hs9ExV(>a@n%VdTz_0GbD~V&WtB<$M3vz%M{GPV|({*Mz!ZyW(&ZN zBHTF2L-F%i5GNCfJK@Mke;!4}A@c~&J6;j`I|RYepG(ZcZr{gVe<$%Y=4fLcnpEDIDA+UdN>dU`vLaJTDm_iMVRdae9W#q&v^9G(YO2O2M~$wY zkYG-6RBvc0uy_iRb1SnPLsy<$xFoQ8{Enevr$=mBvtV+$ee~T&ZWjYBC7GEe^d*Ra z8!}TOGm7KliqaxXqil}U;Z1pklZL0nCkE~vyZe@fjYG_vqkXL{NnQT#IfL2@=FUy4 zU0Yk&F)`1-VqTiRdbq1_Ntsp~W`(yQ&QvinDZkiWmQY?%k(fNRfAk1n=AdMAME3CX zv{AzcM~^b)W_$eckoMD1R?HILKQ3`Zym{inTZSf$9x=!nUtZH*GX2;Rv3bhiEfb$$ zzcYG^N?NVsy+ofTt99>3a`GKH|a%T|2&==$`D_Ov`Py<|eJYfMStwd|?^@wu(L zrnEn_V?la($()7js;lP?kMm8;oHH;jr?W6HFQzfqHiM}5l&$#S(T!QPj+D%NPv-Ef z@bIK`n^b0~m7cK{jqeyH9z{aS4(MFZtre_DzU3X+zcwR>I zkOg;6ns{K*2y1dtGTBws?5p<Ez-YHf$I_WQY@|Zy*uOBz!Kw=L{gt zK^%|A=KvtjNgOBP*oIF%14Q~3oS6Qn9z$#Kw;*`ILnWd!mPJIrQO=Yj2O=fXR0^1H zs@a6N7RZ%6^{9~qW=GX?Me&i}`!rH09>oueb=Wn44H;B+mnmtG%#jd{1+(nMBzjK| zF$z~t{2%7t1F)^?-XGW1@|G>jvSi8Dw&kV0ELqF4Wy?#R@{pIj_qH>f#LjT`-kT(3 zk`P7$B&390C=e)Z8HE;TXg0Khc+O)TIn~dfC>`&oy(+&3RsHyED1(B`on`#f}{N z_Uit#Gu2FC`|=}AjYroG{N-e-rnOiuvQ%ptx3p^%zMUO;eT6Bisu7zl#Nu4Dq_-qf zTGW$Myv(Z>lY7HkF8P1`eA^2b4~*s{ar$`t@#isY%hq3wTJ@2R~fc{==6ZvW17$p8509 z#)nQGb*qYxU3hWm9G39%AU7d_tFIq1I>#&J%GxPE#?ERka17PwCCIiv@y^)f(`yS; zobBeqHgf`YnwXr|w){{-Tqn4Szhu2{E?|37cT;;S+=lko)jH z;dg|u2v;6GcpS*w(Pr~-LYeEvkvwzjE$LKb8&ERV;d5~d4!+A$@==| z(REAm;I(lz2VM6L^(1WUVe#ql@4zea8XP?)ktjA^&Y{8gRs%hL2HP^&J`CGP*n%Gg zu{r=!=mo$ZxwL`B;hgPT{0>QR$SH*Xu;u&|)lYpLckT$qz}mh=rF5hNBAgYlDlzHt zWENdR39v_;cg;(6`dze*Nc6VRDfm^58uWbwb~gxs`_eVZFcIeIS&HTaHADcb0R`w* zuS*WHMtqXch}ir#NZ0oslfVlb{`jQ0YxYP(oTkQ+U9O2&)J_$%v-mQ1wn&uimSw_r zA4Z(&x&9?no+$}exAi90c>+f!j0@oh_ky3yh2DF{+0>*RZgxh_s;kUGvC$>bH{_*~usRxD zWGcJe+PTkTcCI9S(*{dbV&LLSl$&$xTv{l%aHhlmUht7n2heGQg&+s05wx)Gs%?E{ zxEQ{2^CsNxu7@W**Ad5w37OrcsGTXR5nAMl5Z3eyQep-mjWl++#va0vi5Lvg?Z+X0 z5;GnaH$~yz=(_=QY)}o#E=1K0`32EbjONfmapqB!Q3nu^^2~)2v`puh@n5( z)!*+*CJ_lw1HB9a5pZDGyD;`+!=4IxD)IzLYuaHE5H_J6_+kzGRl=VI z$b$%5&_R(Jic4^u7;wHBP)lPzzXmFdCg#J}k(C1^v~Zp$f|*wj{$bp3hBy!lN_Zf# z3=5C^PxugS05`#;0QYoYyB31EHI20cq?OZVTT;I%poU5NDAppW3r zHArIeC@J!h&-SoVjiMyEIG&uF-f7FK%1#OMkJ_*oh2^yk zneAI!P5f}CFpViz(yJ1hY{qImmtV4?t!a6gm|EGot-pkO@O197!3MiT;F|PQ?ab2@ zogU~u)UC~3adj$IZL;TB6BAOBn4va7-HngF^;-pPW=;=r;5MNgxN$V6M$3!_epw-t za8>yk{vTIi?xQJ6Zg^&4Yj3|2+bL1=qxkVES+>MhtMyMeZ*5h{o42*!e7@z(FJ`^r z97Rcgp=r>gNs-i~DXatAt6Gju*awbH6lc=IX)%N|JrI`Hcjps@4B-RYg7LFe4QS#}zUIVLS=R51mwk&E9^vwO#JzgXc zyO(;s`$z4jiANSJe0U-&HnS)z)>Pz?g-AxPtSRJVw-&tDw7Es4YFguISl1v6VM=&s z57poQ@%n|&?HzQ9XdDsq?b2@&k`tmVYu_tfwb0a(mz?ZqHX54pQf`#?^!RUjvBp%F zUSR9nP^_uvrFIOC>3tVBRPqd^@|SM}=!lse-)WErn`dO(B;d zOBaO_9j4wr4T?&eMANvU)U&xW%ht2jCA8aYf~foVjeTczk+xykj$;+Ng;NW({%;(Z z-mrA(LUq@x_jlfuE}rGvTI}}jLTR$AhdhZQ+o^;m{}$RbNRu?e67YYW1Pj{hgryhu z+_(QK4D2?-5*XxejD6A9>K#QUg%=5r0J((cozvyL2rpCJ6}Z3)rZ6sNDf$KtR6sW2 z6i6eJiBOKXk6OLvN%#P~Xb4syP;GnT^EW_}1c0{@w`@WtCBX5|(So$e^H3T_civJ! zHn3=dPFQN=bEdPgeb|esj}_pMT@l zq$)a(j?KPV$;qv3GnPzwD9UE(Fy!$@~*xo*Ois5eR62*%IdYN&N97|hGeIQ1bp2Uh4d{VmXm9_^y zUfy%{;8+qTM`%ehWO7n$6`o3wUEb;Q@P*@hFLf;c_<=U^!sY(2*DU?;Oxya!swP*a zsb#S(cdE&tEb*z>_B@A1P`&%w!Xnwcx3%X1^_hSjY2hyvu_gEibT?0HV2MB&7kCkr6$5uRfdWt##v8r!z$6Y8bAZx- z@ZgvN;rg()DjZAo5-Slt(h1|kn-fw=+hevtIR(A{l3?{$?_Ms+IdS1)c_<`1hC0q) ze$w4C$+&r0yK4VAZwxcK|JsAAB{zPV{{3CVhn#bjzIT85`2yi4EN1TGr?zI?_%V4~ z6y=u{Re$l<`A_-3scTAU99v%{EGcy*MaIQ4BAL1F3dsy+{BGm2mywENuhwXSZbx9K7vqRSk4QMh_O0dP+$kug~*S1+I(qhzLp2uR9$AoVgK{~ zIRD8+s1tJy(;N!9A)!!N*9k0l$M~X!I=iB`r@baG?s^=x?&h;~kNW@gX!_wVPgI99 z8T<@3JA=;%ZYh6~25ySqoa_Iu&9XY3Bv$waGG_!(v6x=Ia`}=RCfs}) zjBh((TLNAsF2O>u!n+EN6(Gu?lo`BJ!F>dD4}%CM4vp<4kjifahY_GVJ{JJ80d_~) zA4~@{IX;j15OL?*9w+3yz~kg$E}+5GOVBI$I9MTIAwwY)00zW{xT{Xb!Z~pOwt=!hMDq+h>Oe6N3J%wza<+7IXC(6h_@mQz z|AqLL{AGNN|NDD6t1-rsoUx`nMi1$S6hq@wVc#bs#Qma{@l^$LFOpw?VC_9~eH~cr zSuBgaZ{pX#`suaH?u4THE}gDnS%oZ)+(U_={pmmtF^zONk|ktzB#L6GJs~`^?ozr@ z6763!Fi7V{SJx5iLO=iJ%^p$-{QtxDD0AJg&C*w)3%fDtKaJJpA)Hb z*NM~?{*b$I0lSIS<<>4*v#Z?ed-(8%?7Y@QY@xCu*T5vb;`REwyncE-*Gpog7LQdK zyS;9Hv3>E972A&cysLUV{>ma^+uWz*heYY@&}gAXvN7(sz^)a>r|N~+cGF4!UmEG` z=!&0hJK>jn>c^@+`pEx+zph}_q5*}xf6=VV|Gxha`D}SPq|lVl{kXi`|J(9%Wby5| z^>M_XDJZLj2R?WGlK|gG5S9Y6-9?yv3UCTCj`YE^g)LhLug+c5 zJxBpw01wp(GXvQ{BJ(1-XsWTI@flZRl%W|HC5nu$5s7M|Bgqjen4g@Br6eZ-K^vqR zg8;dv4)z6d$HLsW21q6bS-91~#h}o10m~gyQ&3zJlnsElz&@gMA>x~2#@%N?F-8*r zAr@G~8TZeD-ix0wz?T^?b?~IRAoIi^#SC7^&u4`hCqMx#Bn(!MLtq7hq4Dp^$zn0N zjLcy-b66PW58t?TweAa>7{nfsK>9$)58r~TyZfz@;A#FvP* z{ElaiBxduAlFKzUi^?R$88hF*d+hD}n4K zKqCnWsp&aUa55E$MgV`vnj8V!IN0LqFj9YU!wA{|_6gdJ3hHo^0i4E!P=!#XL156s z+8D|7c~dU1aNHmQp?P$eIS9Vueh)yK5Cj2(4ONcNUiSrze!2O3-}B%9#m_O@xpQ+f z3k)3y=|-W0BWjj)g-Ohmx>@u$!>u&L3S>=M3yvY+ zC{-5w+N!Fxb_=;}#Z@?M#;0Bz#<{>|647;102sUr5ebR#-6vouA_yGm73gRrw}K&r zNHig16J*hTOCAMg9MpP&X?8Eo!^|QfVFOj7gR=ui{!lUWUpga+8*Y<5R1GET#vflU zYlrFa)g<<(xkql#k*o*an^r=`%&y>E`)5zfyQp5DVx})W)t)xD8dmh^n_EmAxIIG< zBA2zhNS$|P+dq3&qL^I5t@9YRV0qd6QRKM`1= zZkKjO`UL)Lf{1(r3yo!3TYf5O78+y;$(nZ2p3_9 zH?Tlq!HpciE08z|$PNP_s8|C~JzRz8A1N@Pw!}lZm00{T9F~)C{Ta|Xe2@J7IUgx& z;^MNr!P6rq%&)^<^WRV9_|Iam`!#K0&$Z00Xdzj?srfQiKx^g-u|)})7IFTB(wH@n z<$Qg!b;}DmC%+>t5PW#OhX!;iuV4!u&r>vL}~sBCE#F87o*iUdhqJyH^b) z$Hi83PiEE1DoRSzMZS@#MZ>bRIt3}}&^JH0+~{hB z$yR+2>Bt`cXRBm}J}ogMJd#Eat%~V5_LFsqeJ9pTm?)6B7#2dbEww<+7s9RWw8tUu zAP$d06hSO`I@nP2flg-#s|be(4-me53IZp1gdK#Hh^9(+%$AnU?jRLy*$**47mpt9 zuST@S>}hTGl-<8@dgSE&lnD>KrW!gR5`%Y9B#KK#1SJ-85z}K6lHfopjYXd&=4IQ_ z)~d_|n?27SZOqRxvJ6gK}D!+5c&fe#ov&@CFU9((I8H|a1nTVfT*w0=kxFI)WSIA$N{M& z^Z*01s3cJOWySqj~ZRQY@T-F981yP%H%q7O)M(GzTab-tir32n44G zG>E%t7$;ps)1XlT1+##HLEnHA5YfiM;HOX#0niGlE)~1R#xe2*u^IZ@OxfH~;&ZKj z5;o^2`F}EZpoRF|*0~!*%G?b~y#Fbm|Cx~4#Z`+IhWH=Es-f5n`43p0ztR6p#DnuR zeoAcRR(r|Xb|ov7-YiUa?=B`$h%H1iv2QpuL28uVL-r6sw1PyXr?K|=z5cJ`CSRzwf`iI7*)6I8dcR69m&n zFhalnT;HQEJM;MSAmtC-DxrNseH*ldM98(ag15c#Q3C|G@ty#H0t!3?hajFS5(qGB za6G1NuZ`S&?Ek7AX6B4Upx!+PQ)MSRCl94sr_W`S`oe8 zwdIN2&o&m6G#0LZeo^RsP?X#@7vg_rS7KX!{?vb zbT#+?XT0YN-|+r+xF=tmm;A4Y_JkZDqJI>FRByb)<+`F93DFx+GBXB4-$g!67UAx% zCdWe-Nb+4@CGX>Y$`O)vc`jJr~5Xj{Mp`7xQ#=0Ykk}T=XRB)ds9;s`@s?Z_n$LJ8N zf>jmZDs=UY`+xM+?|*dDhVFsxMWHWyjd&?wgc#Cil`5T65|6CoJh zjN3n;+#a4~1M>rpq559X>4Q)T3^p2eQA%Lo|I@~uw3!a(dy6pJL5t3fro}|?vQkV1 zyj&hn1DWGBQjRGtjLqRhghhpsV?=R?Iw)8F{j@=$7q7F1MiiIw3nh|bu{ehj8C_ML zXK@y2Dvf+LJAp+cQ%T0IzNuoMA58OaAfP+EAdS!p@h_;Z@*#*~Jr7<>0+>|*Bmljj z8a#J=h`3peiGRkT{D*OSinwaj$y+(0tC9J7>?4&5zSU=6w=mtisogVCAlSc;^v=JZ zE{K0HcQsT=J+;x1PO->Zr%P{XYs*wG&Xd@0nEqe;Nr8cWW%B=agzv~_A*_Qj1d+-!gpFWXeH>r^ zf&lppfvnZ}@U3_jxc%WjxIv|N(s@t{{eK!_dn{hSW`x9NDzr&M6RyyJLwqWdRpU_T-eU-j>Jg!t-T{0nx5 zQ=%hTo>$w|9gUU3cVG<*CJSqW5x7{_z3)d z_WLit(%t#S)#KTb5%>G|Jl}lv;!%4fCxJsdgqev>$=-Os?uE@%ACq^(C z%*d2hGr!1PmQst+&OtRL5+VH7ucEF%1R)9h0a*myqYNQ(N{Jw(l6N6Y1S_xbA0rYu z=^|9EfC~=>K2;!7yz1uXF?ir0JRHog|2bmNFdxbv3~r%je)Az!M2-GO;sc9nngfy3ZQFY|%Ika-%YDuvu&@Bww(g&zM}_pDD}GQ3ok%Py^ND3V);4>e(@ zZ=C9Z^&P#}pCv7b&FZh~J-@Lpxir>NGram>UFT}I02@JNaq&pb--dqzdAbY;o2V!B z608?GWr!(05hsIJVH1R?@ChDhuM)O};LJv8I|SJ01qKAhBoJeb*dwrufbxrHZJ}^_ z#yzpoXt==X2F?aN*E*0(3votwsnYm*;Yfu>!PlW5H0>KSn+NwbHSHfTn+NtcjXbld ztZdUWBcso3EGygi%=I;etDhXLeRWaQku8hsR7`cXt;JlM#kKZtz5iV0$jhf^8&%m8 z=f}JdN#8#^QMsl?<0$u@Sy5V^KXuCIJH4c!V99Bp@6=R2>FbIeZ!BGUZAW?ej%!Po zzOkcXZr#$4pWCl>7x8m@cRsVQ;Ly2Ct!dsXmoHRp{^)@PMIv3tmdD;+wBoC$MqSGv zZoT|e?fy3xFaOh^bnPR^(}glqGoWWX35y|frUNn}x}e);q1#4aJB5mLT&S$%dun9Vg$&9YA z>3bFnKhp8cPH$pPuUp@$)VVTaYkkTbbt*Gws7#i-;ArFUeuHgaL*?>XS&G>uGLC7S zz4?+9SC<_w&v2?Z*+U0?M?c-`icPgr-}^g5&!C2dg;8I?T26l#6JBjpHf?B7wG_$2 zzBDD?CAbDPJ*G<3c(<>NU^n6XQ;CZ!|5rO3{z)Oy6>Ss?5;g= z@+|-FQv^^xjO(AM7bz#8no#xy2`3I5l@|*NXfDVGX5*<&cG&7*y!0^9!(qfAT>k|cVM1V0s#vK$I0Wm}-Lkyu#7-1Xu&F_Cd+SLQ~e17-o z^}W|CC=U}w`Ad4L1vlfU*?wllyX&*O@Jm?ct*@wZY9h=iCV~ApL`#$6AcTewv2sWv z;04Q}JK@$?9F2rW5krh99PR4qAs=8mSAF2W`V002EcUha)sh~fjP%9al@-5y>CD=0 zaVOW+z2S*p?;zSy{3_wrk0afbpTP47AOpZ;rxECEcnKnfLIH&$K!OMr9ss^~F;yys zMTg+$@dycc2iNm_1P%->9S{)#kA{H)=a_OR7h1o;ZYEnoz z6+538i51vtbS$>sW3|@m*}Z>Ww=K=pk-cUIEn?e(-V^J_v$7U#IoCh+{L!^GO~=^! z+E}?t8K-vtge}jPDe~nkmcl7-X~4(slklgZHf1iMmM~5jdfYqK-CZ}969`;P=tv zpbV>UP1b0rw>Du*Hc1MH3hQTU(<^rUV0po!Zf|Nu#jVG;e)&+FaqQffXG5one2YNQ z)GTm$W~$TDs%J1uqOmsHT%Vnom|btqt~Dlxu5OES_H3-r>vYLD;azcRkGw|7`inCQZw+A59*?LZ0pw<`0(2j-Olb1OLw-*m>*ffUawouWn~=cKP&S zxBK8Sx8IdJ-Ii@?U6z|S-D)!Vmca_3Etb_oz}|~1Jt>Axw|w$VjDMC0bxhGL`y`@f zexxP|{ZA4m0KE?PHudMk!eDhkkE3+Jf9601V`u+)!vtdXzm2W^r;b&K=kJ8!{__Tn z|35_OqI{p4h|egiA$Lavl{Oj)r8&_sk$6xGs}V-cO~{9Rl+#Uwtr%n;?+LaTUNNwC z8|Q+8Lqg~_2ChVr?17+0G>sr<#D*`a^N)s{Cx<|Q4l4R1qLF|r!L$QC5(VvqfYOKu z<;DVcqKf`Mg^zzgOyD#{#zuvamc6vQHf+?}lY$=O>TvPpWBr#EVg=WNwzn$kR&W zO$M9LkQ)Cvl6|0kg&zmmXN5d9_cMe%=s5!&2P+#4v%eBvX`?!i-BXhy~^dtdE;%5{S!69Pwh3S&}Yeca~m;Y*M38^P{0X| zNo<*1okJqW3B^(_TWiTr3sO?YJSDAz*tm0qSwu-dJQw#@d!k@_VSSL6+N}FM>#f%H zp8a=d>EiJR(w89pB3!d_RTjJmQ#d{C{Co6dRD-SP^?NA_nQ{NsG!-mtcrS6?RYxMc z!+#)1RcY@3j;h+fRqpVAPgOUL<=<7Ykh1r0(%7GWbEmSzKR{F8u4nkaqbdI%?bxa%7>xEhnUJ zDLatckFyBiHBe>_c*q@o4|-D2>WC0au&xmeuWKLB637M(Z@zdTd=>wGK-iMOABl51 zU`z&BvKs|;q5w#!#vmdlxg__Ne_rj$qTAHY-oJ@;)Gt;lRU z^Yi6+djG_|nfcf$&1g?OSH9t)Hz#U050&c@#MzLpQDRF|R`g|8E^W?FO3+%0RjDq6 zAW2&yht-?OL|d0jnqJ&(shFtAN#g4BYO~Xe^n9M$=CCD5I-4A(zI`oyFP>U15$T;0 z3)hgDm|`vWREhs`nk7wwr4ps_O@jj{v!Cz^MM*h^Q%wBRw+CJT1b|9L;I^~BGtmFQ zDEveH0Ig|(_1_MI4uov31d1pnV6qFUi9{+Dxmtq6gJ3T9=lb1)7VGHI_NJX(dh5u+ z2KVC1^pw)El8PnO8M4Z8cKu^m^b^lvysM4g%l=5p#dy(iurf3_6#ziWnOc6%{l07E65d-Dvnn*@_?k4xj_r zmx!OiT_F)26N*q3C}HqUcRdMli~j%%THM8nWhBK#`1_)n3>wx*?32bN5Z^^NyMA9B zKb*&gx(^uPzo1W8a8Fn*C=ZC^fJ829C%|D2mn#73ZkhIYWT>4zf zod-vEdKK=ZraTK87~JWu?n8H-za#M-zl4#*p)+{cA0r~st%yI1iXooD8?;@_nu|oY zgnPkCE2QSY$lNId7#9LwJMmp3bDhW_hLR%KaZ%XZyJ0N4mcipO=$wV5hse~hn7Bw1 z6}zdU$3#R^mY`n%x(?nqo&Y&-4E%Zj>aMVu^L3&n27*KGx+nI5Urc6$`R?1dy#6r> zXqHGg4$oePw--XSv0(oNl9_{inQ>defl>f4eTW&{SVp2{uu^GgSzcJUtWm3|7}_kh zd-a;eg7ox)MvdNU7n2%qo<*HPsts2bciDeYS7R~+sVGb%)MPQCc~oo^UuO4tu=^M(r?K<^Eq0KY*t`ZNNVjX?XfZ~%f1H4(QOvV!di=#2B7gYYyd(%jQrmtk(U3(Xm9 zl}3|bnrgQx+je(k?8FlbGQsOVMPp4Gp=` zj@~U^@4jIhlV2XkiXc_2yUqCqS`M%a3EjRIWTT58ZJqZm5(^g!+l+9 z$F?KqTX?AqmWWw@Wam0N96#I!MQUy=a8%0a0#k)r+1%JDSGTq_qcQ35|BCzuJdFVk z0_I~hQ^6fLPccXvgPsR3=WQGX`RcK8NsMq=(6?0x;5MP zY@U+IwH#{Wfmenq{3qtywh`J^0&NR8%uo-aO6PYq4yDBciO+j%kTD#ekYtU9dHXv; zQqoVWM)G-z`f0b=r{^VRrYBov2~wGAnX`cBbeNgBZ5i#S7UjkyTNNcf15;hz(b>R% z<5KB{9*ePgkrj(1u@vr3L&4G}eGJ1|Bhs3Z%_XT4i@5FO3Vm{0-=HFn;aqgADYd*b zpU2LvXwm1lIa1;%)iH|Ng1lBM5@UdoKP8`s=YjIxFe{PaKFBF?oC%nNsMDZY{tyv$ zufvZ;THmpyAw9jM&sMjoUFTZ;8APQpVr*Kl9mPwWvr~GMFz^)=cE7N>;Y$wXGZL z^j!+$na?ooOY@^n0^Wrv66d0~ou1Gwh#UjFm56h-J6#w;OfPN_*jsG*T@FFk;ITg6 z?oJ&~=%y#8RZZ7SJ-N)L_pK_enr%|C^)*&fmV8U2wyj7eFYh(kSM0ek(sg3ZkTRuS zspeQD(whGDjVoU}f2g`*b+gvkwyIFw1{GUyX+tY%OdsPP)xk{IxuJ<0E%ymtl>00#K z&dTa7-|1fX^0tbKjhCTE;(+7CLXQC5Fkmj?HWysA36jt}Tfe7A&eJ3clf=1uX*oUF zSUHdKf6p>0~+w+S=`ejSTYPGo&hk#bS zdb&WK2#a>aBr&&`XQl=!m5sZe^37a3IU8-zjE?r!*=b4X2~=1hgf7w+)afl%mdyBQ zZkk=k1q-E$M-vH?!c$`SDXP4BbN!YsOPF$KYBjVrm2i+^qHrNfk-&(Ly))yax6M=_ ziSE!BP&-w+famrt*mA11V^5n(;@Q%hB1+VkYtsv}1nR0@!`c_7&E}~~OS&H1I?-Hc zNTX4>+x%aB{@pF^>U9q{R2^SaAFe1Br55M~0#l{NT4&_89=X;(^n;Tfxf2H;dFqK% z4gi4!FQJ(9XXwRbKo>|oz=s=|*zo4y%P`o7v(RKUiP0YrvA~^!+$zRi7ifeYP-vO}EY1wnl3jtWsxGjJuo*YE}Bi#iT5b zt9i1ZWkX|Trgx*Sc*^HwN$(r2TvV1KbuTEhHWyhO(aO@1va(T^i02q^mkgDeT4OWp zO?k!|V-nX;lkIG=r{gm7Pvo~LkAfGs7@p`ZITK)m^YZdr>;*5*&brNJfUgsuUH{^A zwt42|P2p*3JBAjOBSx;tCn!m`^tv;#P#R4k%qy;H z9kyq9i#6mbrYM2daNxC(-VgrkvjvEDZhcC*3}XcDGwiM~4IV@S1R3OQD#DGOcahgT z<+0>HaKR$Ujg#^i%CdHi|9y2%O0=|i&{_YRHA8P6YcqCjIs5z@ zZ}+4h1Ml;jyUJ^~UTPJWy4@0GZB9z2vnB&ugE*QQq*5F_ivlVk5R!42IB%vU>gH|b zfw>!q2oeLV#RY5Nkqji?U5}A1rlsUL@{%(aO*BT+8DS)*%00fnBT8q_Gl-iKQdMd& zweIN7($$tCBSLs#JFzy)%D+p0kJs>bSAe1pUBzWR4ZX6=(P=R$YAB6-3 z+wbps8Wf*^yh%vZ#d$dwV{{G6@=hL|P-O=SE4db->!G4Z={cTr)g ztk~sB*B6#B8@6{D?j51lC@zb}mxR+JLt@hMG?5&dful||wH8Q2BCHbCnys6L^O)Ki zc-nSRIx{33P}Z^yPfu!FkN+6)S2R-l;AsI&CkGZTl-^m=a2}`yxJ5|dsc`f;Ux?^l z(bS|XQYJ=`awdF zF+&UW0wq5tPHIlg?kY~ttY1~zzqKx-B+lY0b=jC@Q@%0@$LJ`oX){XX-0*0QgqbE~ zq?H#t`6&&H4)x^iTieYTefwmGx_Z#W(kP^n6?yDb4VNvK#LFs19L_bpIn76YfH(%> zYtlY)^1PhAr|}{8$X(LDoYB2CwR=Z$ti$_|4q|PSRZY5z7F1>;n2|T(Q4%-S>>9S& zhIiF8?j6X^9@yLHSWvIic^Bm5FRD}PybEz^dYZU_5(m+bYLH+!$~4?VRB==$3I1S` zvjD)Q1Q2GtMoru>)JGvwY7(>C3)52anheGD3K}sQ3*&0iU(P8`&z8^|D`XD#eTz#^ z7h~*LwxK@9++-74TNh+SgQH?0B_brb&?*ljt*RXDOpuu+W%>Aszejo;TBL*a0LTqu zF2w&4We4n0I3fxnNmMX{v`5+6RF^8ys#J-}B2@xQU92lumg#8E73#Wn`+R2$b=A)< z7{0W!Ak{tUD%esfjnd{Rhb$MoM-t2SBN_WkU zq}2{4;O#m^dI8#%3$qUB3l${8WqD9h1Nys-$Wc=fj!VJUAF>A2J8)W>J6~wPh~Ka^ zrTUy|Wo$<6${LO_+supCRhL()*iu&YSYFaL{Wj0TCm*|X?$x42)$-Jq`zAe)HjsZH z794&+T@@LQBnfe>n+w%fBK2m7X`s}uEZwYkB<=L-;B z0hU?`EtewQ9T|#QL9P(+x1wr?U;&2CHDGt)T@?99T1j_!hs>u_#p>!|i)FAvDNZ|W z8E$aI)HAZnI?Sdvw}s_@aa#(Pt1VH>OY}SrENL|KG{3{5?oqy! zv;MwI!y_kFPv%&LW*=BMr#dI|h$OjMK3|(F5!T4?*$!afW%3tbPbUb2PRn`u4r$TQ z<47^Xu{d2rdbv5hx}n3Ezh=BKF>XF^d(3nthfl0#B)#k7{3YC`E zyRS{2TryGq_Ql58>QsKkmXWgK6^g_pW&QH<=FKwW=9=O~m6`FG>C%|aJ`WbnlM6)p z%;cCF3WNnDnrgEZRW?a=W?rRK*XdSrpmaI#%5R8%e4Gh}JBz%|$0gj2>p~WpW~K(K zR2*ARnWHfaO1W1ECCd7x#h&#(ZPmUX&l;6en+_a3?#}9~QcG9+&qdUKanw{rKn5>4V0R% zj#Osb67$zhk18zPB^e6r$=ph10nJMt}OxfHc#R#sKALN$KP#QYC`hZQc|fU zl)-0l{_$qA3gwOcp&p7UJ64(^j{KXgMwUD^X$yJFKWNGOqjS7kp{W@QSn{gIowa)g z!IHPDs&e;eu6=k9IZNBHq@a9dqgvg#vbNN`_piV5XZ!lvtuL$C(rXdh>h!iU9qE+ECTFKD zpLEZjZ*D!Zeqk2YQ8408%k)fFW_8pQa3f)fYZ9@TNK{k~+42U8rBq5-BrTpn4YBvF zFG}~6<#Q{ZS=70&OCzsYQVJuFo?EGc`24kb$oi+h%-4a&zaJ= z3MV+MS*+3apBlr?@--<;Vi_sfQLpuT>Sn5>kx4Qk$#;DNY6;LFIS1BNtik65)UgS0 zhJaphXM|Ivcj<4Sp#dU++EJ|dI2;Gu={5r?M&^=zC~}Ruo3?lAGK#xQJ+++F@?;UH z1-rKTc6Vs0@#&J%CAD&6_qG~cemb2ajK`AmnvI?b7hh8~U}TCRqkk*$Qq0~1{l5iz2y)a;TFGT-dWk5_5*oG_WQ#a!5KeExfbfAVc=lu2@Z z*=3`JqFNXugk)ZWc7wkXaLjG{005Uj7FdvG4W!qUzR?Z!jXS#yLaWyZYc#cLircQX zDyys#SUJK`Fws$)hUJt_H>!<2+iDBftl3bSw|aJUo^jTHeU*LbvX%Mnu_8%k`6wue zID#UJ;CD&DGr{=>wPtY+i91a3Ahw_ejD3Xdv-fsm9FPf& zZ`)&t$@l019fix!x3`}I-_r7P?d|867m~`2o$JfX)_0jqUF*xr*LNC;ms%g3DJq(I zu+?{Nc~Q~wbH4J;J!W&y=5qI@9t*5RihlFf7bGKP6Zm7nHiReI;ii`$#712$1&D}{ z_B{Y@?3!v8k&hQ&G`x(YF?6$lTq55%_|n z2)54vRyG*(I}{LTCZ1zPnjeaw>^jqV$RV`qWid&4P8+LaRjWbUGFx7`)~EBP_BEx&tJ_Vsfo&CM{8u(i|HwsF8oS-HjKWsE zrN2UvS<;1g2P6oPe+8{`!NIp}SEywGtnmgy9A2>R?%EAx#30m!JsU4gjNyTgAg9AA zQ8sOC6zAIwOs+k@P*UD+=QOaD1#(SgHoqZBS1faM<%xZz@!|v;mrGg{B~=&_Gm5hW zxf2I!yB=Fx7Mqr%R5?=V+S+m3jYr94T8{-*=j^xN_%)ej>nq6s|6ldl2V#??OqLPc z!U3DeBVehQ60&g_htvTuMS*e^V1Ynyu8^y{TB=qFT(v#+;VG%JQJY-r1>+B3UZA@n=m#*OYG6enl+rq{ zA0yO%XXF4j8EzvK99ad;sW4~AV)NwVm}Gjz>Wr!-3}#nKVZT#bUux&ZCo&c; z&L~iES!sH{QmyvRxOvyi->VM*Uo&^&NF~I{3#}+#4t4tLFal1y{n4c~%6sE<{ zX~*N!jABq=QezXlb*8SOjOwk=^k4EnzkJOsPH)im5omi3S`8buJ|IkkGX&Z{KW*+Y zgv`rXF}MW){spIbYjWF#`*-I%Te1^OV`m0CkByjVNi)yp4mnv@!-QyU)$q3 zhmjwC1f!m>sX6bz{>a(Sw%hI7KRbKo)2%k!)=yzZLg{@9onnUSvT}qelIOix^NTYCWE5c_j16CsMo0QD-(W`F8gF9R=23H>7wYQp^9D+YAAFPAeV|JN zfYI@#|1B)je@*Kvl5sLE&f?_CE)%nvb9S9)L7~8Z%XfZNX6o2Xu!9g^cPfe&20sW=DHH203ym-q1RB$iz!9GyJ4jde^~m?G<9>d)`-;?HF!+ z-}n3Fha_X`{r{i6pV{ZG!qE6q=Tu))p;+E{utU>XUy?%>lk^Q9iL|IrqYgWSu)MT; z^6@E0e$~*-yuF~^Bg`xA58#Hr>Y|9WP=_m`P()CVs})f?dOUSb1%)Kmy6VOPC5zoo zs?wt(5CqO@ZGMFn2AS6yy6@lWfrM;x^TGarMV3wCE6h@c4RJHqiwt@^nM@<*r}jVfxATw1 z{^Plp$_Ft?Hy1uU8=>hdZNdVRA|o36Z4?{aCLM74#wt}^PyNU7Q@?*=4ifg?!&rXu zB!>3pSSqgJdziA%cHABNWvuV3zsFi*KYFm|B~0c6#Zz_qoIFWRtb7H^%UYGjHgr$V zi?NU18ECxk*O+XK={kmpc@ATL{ABD_?4I}Ia3?+ha4!Zw2dowZ>Yx-6OvmGy5ENNQ z4T*7+8*p+5*OCB3xDOT-6(t@X$z4{;SXxTq7!)tWz9h-O3lY1u=1Ma&%CI(jzJ{_5 zoE-ZQL0CDFByt-ILaOW+9#?d19xz6lIklbrdgn-uPFp`y77Jk>boN)9Q)02NG5qp< zck(wziy%49<@f_|ZwV4(Kvy_|qYjfJ)@U4<8^jbDaLET7Zk;=iKd?J`X3sy}+nOY+ z4wZ4r$AdC$-Bd}uAHF4uitisC9LfO2VjB6T3yU6SPnTPzsZvkQtHd zEib?j(!EDaf)NTpd+|m0s9-hlK@DOPGRT5pC-EUct+3II~y!h5XOG`{#j9*v~(Q0el zVzIkMtA$(Qdw6w*vMtprVQ{X|I}yomdM5V8Q|4|h?(M&SiTT6sw-1!&NL@8U#g-9tOz8;aZ<%(EIn7TyUmosPzft(B1Xo}<9w%H zl5VXnkkL~Yr_}XOqOAJY|A|^LPg1x!sce;rQ63OF!!c2ud`n*}UVMG0c7Fdpn^f61 zHfj08zfyS8oNQ;Pu`$AX=3DyC6YYT~TE0mlZ6MyCv4c%r`rueVwD*{Qq0`y2Ld&4% z37Po!5_*2E1`C1J#%e%9X2a!=_AGvMPea2!A1&_r=yJpIL*vgcl$I_$KR)pS^7;a{ zb@9`OJ3Al#baC;M2Rb?)_ylvV^2low6YrdDY&`qU#KdbyDp8B&k3{6D5IGW~`T|Lb zuA81!5A*P@V}Y8JI|kJirafn_)$RH7&7slfKi^Y(-^m3?2SNM_boD&` zXP~tTH*K=;S5|0#bM*pV$lqY=%dkJppWe2m*#dJMn$OAAyqR=$hRG#PY2!f34ZI6$ocKCBqBD~tYsc)`F}SN?~jWWi8h zCHOoX?zpk{e2=Zaug_wYR@O#Mk?j$=p>f)?bt{CG-l&5YLQNivTPbDqf6 zxI`+qJU3VFR*77iJX{UGrYWlEJ2MjE(o8l7N83;=lNC2;t+ToeSO3{w_ikHKa#~iV zu0vbWA2Nxk$!Q#gBQjbpDE0aHa7X9uw+Md#e1xIPF`g%Yz=no^kTN1+P`?pXi12PL zWrEfN#+8Bvvt}$&atVJ(5m|ydPnC|IlAKK!SwrTgGxI&w9(EnSqIap0*W5dhpKF?% z9hGHq4@rAxs`B4lyRD!Nk0PF?;^un$3Kr)e_#Q`ZE&ms{1o&p6@3?% zt}9T$+}1hTy<)z9x)yUI)>yx_oO|IMuKCtn+rcJf>*jpFo~eYWH2!(um9Ra(wL)8^ z3AAdbwp8hB#|j3{+89oMi^J9(P_FRA4*&)GsRaS1oMBImG>d z+_3$8P21dY778Z^)d2=zo zo~25Gq$XsSPPWJ#b{J}1{D1LJM^u)^QLCfTlP_eXXUSYmMgA^3omtR}6zqUE z^%-FczzED$%=)gsco-y3@vBBZkUaKWOxd=lT3mneXS;X(^in;?7|=MY!lgT(8X9_P zS83toeVzE{1I8Uk&WDzMeQ#6v;>V{vi`$0P{?NNycD=F38#?^zMDIiUd-yB(8B5@2 z#oAhrAEeIn4*U?tZnb_LLAeEM=uy|rSN?C%gUA8!%wNYp@y+^WqYsIHz54XKb93*V zs;)lu-rVfFr)%0hvk&+8KQim_%s$fJ|M08_+p^=IuC=yb`^EhBf4tJteDBY947_-- zvhv`I0|PJLRa0~H74*hw`0v3pA@dv8E^8H#s8gJXSAdMfja#BcBJbQIefxKK_ogno4@%32T>)QSw#J^I2@z|ecC-`D3AK*-+O<}XrD z`h&Y#jP{H=Z(?hm%uria@_E`Jv`Tja=RnpG@$X{*W8 z?&2ss)$*!mM|&RI?avjN_@!=A)^fL^!pdi=Ymc!Ib8g1?3T0px9~U`A0Q zetL(Z0p>@-80%;N714+Sm2Rk)U28Cpd*rzL%Xc&z4K0h6VjU-4T{&Eci~vey$hp7& z56DNT%+*#74J!Fn(ZQXSfs4DUG@D%g23eu1T9cQ6eddU z1h}kNR;U>a_lC&qI@!63aF9#u_yvjK-l4}<{(6Nv2np-B0FUnsluG?WKBlhP&P(T6 zRYFH;M|qm7b5FG$rgfO+-#tf^`nro`HZdumlSRp3sQEeEq7F~xjwU@pRqE8!xmE=O znVaHj_lgD|H29Qcy2>S%7UeUmV<&sAj5(m{iJc!R(C~Ax-ii}mZ*M@K?MYD<1XbL^ zBA+NZJtY}G`pTiOytqzPIMwRS9(w&`9ZPPY7c}NkcsV&1w@;W~=aELQ{dy1NNK=S; z{&1zp*%wqQ1O2YP$MF&DyG}<*1__Q);xzNY)C2Us`1M?c6X_w5Q6Ib zqP7BCYjsFo;joR}7{&Z>xlZ747AtClY@=T-vKWlzd%rc>@r1|K=8+Ps@Y3>;KzeR= zilVH`=4kVYMOAy--G@q>&kQ)QKaWfYgl%Do*N~T#o`c9LWWD7FKoR!Uvjbx!v}PuF zNmK;;kTypcCGO6zAefK)VEMz~jz*oXcEY2mFIBNLh%cAV#1m+uT)qrnDYn6>ph$tjWeWIIwhoR*rAcb%gm&t84FDjJ9qE2t25}J(DI9#ioBgg zTtss~4)rvg(2CSmVub6BMRd3t>d7IhD*;_p;=&9tK9G0Z<%U>15x?VS1x*fi>C$)R z7T!JLPoc?+THKnDjmNWvG&HqF$4bIFwmdYl`O1iG_X4K;R+rMR7Ubt;6ggZq_!7hR zr2~aazq+@n{o#K*tlPeOuH7LoX)zigG)*LPnM_~7)H|o^!Uta&z4Dii?$|p$m>F+0Lm=5pQbo>!k~J5M}9zOi^ zW@$8usjZ%^t=h-iZnAq=}{@YVsolpJe>17x8so@J z!F}I_$Z`lcspmJ8rs^h! z@?u;2OR+yZ+w$_mM^xwuen*6YiA?~a4JUxu&Ps?8fz!Ifzz4)Ijwj{uuz544vzJKH z8P1NfqLuY{t9MU|m4Hl;LDE2`ezph+P!`BEyBL)Sii z^IOqNpPluaXJ0>j>pooT;n!!)fpec;j6C=4H`;|&?|%6G@Vl6-D;~0;sXP?bW>!2L z`@`G%$(fn)E=azklmyYUx7X|JmG%szh6MD>y2wDB_2KaGXcW|Lt{V93y3kS63;!8t z*j%P5xOr!wYG*_KC!ZHQ-d}NIVYE_B)kmDw_BtEe(!Ox!TD51ix6^28DiY;+27!GL5C0qYzLQs*>TaBYAe?*KQxm_z9C+60 z%JcM}eq+Au+7r(;DVkn>>Dj8ge)+(bGG30@CYAfEI|?n(n#rJ7W#nWe85(DOrK24U zTWYR7{_1Go={8l}g&*&zIJ$(W=1on@F`^@>W7F7*^@@g#Z%<--rRT~nt$#dt-#;o zX6Nc^V9K$F=__W6sB)_?Tibb}vuaB~M3Q@r)6*HkqQ29;Jy#bx%e9>Jv3D_|XKr9p zpYKF=FOw#I_Tvu*{)}n+?Pz}gjX%d;e<$+d>#sh3X2e~4;b(jP`IE4*X{I=|&|++S z;ERh-$L@P9B`dk^rI)`I`7Va_OijVqrIy0+_5efmukV)Kec{l68~R6|d*_Gmwqo3v z*D&mb(a&QGvCsQ{`RQk4E6^GtJiQ4rw_we#uv&t;S7|&Oi$#U&%I;VkMBd|Ig@%JQ z7FqWe;g(;E^!zO7uq_aIod$A_)l)8R-OeWK>=11j4JlP)-##TYsueVSt+jqvlZ~5B zGu9NS3KhB0G+EG7RHY$BNlL#>4Y{WjM!tkp_40S$Zuu^T^nf3Utys#GiTyQJ6?^|WAtf_8noA2EdGlW}=|^A1(4TFv?|AFbt%q^7hu@mF+qc8}2XXa> z-ki6Wod5ihs^?yO5s9`mK@R&LKmw4ESQaKB7UK$WRU3k)yhDj1iXDjp$8&p9%*O?T zm1?OsYP5Ei$tPoJn?K&W{~ym)70y07B+}(&Kv70@>5f)&VBgD=*Z+8-eE5aGA3FD& zdP0RfFj!R7@0ZES`wDlQgFZ=1?{oio^5n;N*Ai((;YLl#Lbub{vJl*SzDGauTI|cS zuf~4!YP-&aV(&Jw6wd92Q^!NEt1~=dsb_-8<5GT|^ooluY!Ym=E3G*4y&cACjk*Pj zh=y#~WUN=u1mWI9Ig>HgmeTS7%bUa>)5b;A@Pq{nWR;}G!1 zp^4~ku$EEVcmr9jX@nIrMPCx)Od>%`<`UUJKq2lE$L@e{yi&>16bNM+8jdN5$13HF9dv~Rh`OFSs2Qu)*iDw z?3UzG*?C`)#UneG3RDGqFFZHWccMkna`mG)B)`DFkNf<8X+xYGeqy`VyZwpb!N-u- z#|F25aJIJg><8O-{1|!tahYlG^5DRgL9==A$^g7I)s!s0JTv>s9-nW|E3-2%FRs*I zeL1!#G?@v#c?RjBh^yNcgbN#3_zus>nv8AaJ zpD~Z6FHy+AC9`fm6|FutRM2?uKOflpPxmzB*KezcoycMca&iQWti)@h;-$NWAKB`5 zZGCL4>qJ{VMN?`>#W6HRGEtG9!!eetq8CP8?wQBOx4v^SQg!^DnU=GYl~l}wt6#!r zW@Rz?2y~%t0RJrEQ zeH;>IWm_K--;n%haRzgGdNGM*Q1O(kEW9@@;8g2qcmi3>OHQUE(_0-1Do0-=@{EL) zWy+k*iVjvRIUK4dK(TnkHwrPhz%fs$Ieyk%8y) zsY;vkg#|V>hV1*|xzwXCLrnOKAEKEUJ8Cfj9mdwkcV zKf79UcHF}(8m_JyE@D9;Nvt99O}S#^8^x$rxP?DTSb*NHA&^rmKL4tlzS8Io7s}h< zO5u^xJW8B85~N^3gfWzrZGZq&0OOUdrw6wF_?{L^^A?w^z-pIh-O_Azc(^D57h#cE zoP@^!h=SEJo{wca8ZdRWx9eKZ4%(WoetM*RZ$ykE#J<=F55htkgBF->@iExJZO`s$ zTC7#1WoF*F3y4Ya8>6ivU^M-|!c8LCIIw*q3^8Z(On#Jz z2!z0ZCl5zx`Tqo}wf{`3RM)luCj;*!1VtO^r43qJH_-0 z(*|fSpV{yOgfC^czrfuB8g(OiqC4wT!CF~kHnb2PX)Ib(w+Lx&gzer0C=q^?2y(rZ zH6o;JwXlDW&p%a^Ylk|YX_iH=%#scSI_{tK`nEr^x%S*-@z;U1H31rg71NR2mu2|s z;K12-6_4&Yf9{A$xp`{Amq{y{dwOExmHic_?qh8mFNj!XpA+5(864RJrKf1t4l)vP zWe-HPB3CH?qdbC4JtDec9`v0Oi15BJytDaK4v(7t4HD*mBc6D9jQMR%U!B@W8khn^ znA&$N?s0DrHFf{Jl=AI92%rz<4cW=GXBXnt4Y2b?i#a zaYf?X$$xS5qa|Jz)S}-=0JuY|6i_@Al9zd$b_-js<75&$&-R+yAO6=PZHrYx9KHol zPp*tsNUORP}D8dYb$*=W|By2 zWeJ=njZB!$(TgdVTh$wB1s}6b4YilZdHI%nUSa1J<8nK;!9Cq<4sAVBC~Ir2VT-&b z9xAR&%)H9OFOO{g*8WP4p;Q^_b2GVGvzBWcI2HZsr@q@vU5-m zCmtL_%oyxTiyz(H&~W8f`*weHr8#=_*E934?DiDzd|~VCxA&Cz7GA_Z+z9`3-!CuM zH(vSW9ti6-es!_((90vk-#$_mx$BjoftLYd|scxj-enSokNs9be=2Col zB8=Ze`!!KR3D@rFE0Z|4KD~A8GqVNex*@Z~NHcnwYL`IdQZqEr*%UlJT3mVhCrhoD zceWSucxBUdv5)yG6`!Y4l{xpHycn*yy06|pccl(U*qEA;S#3j#2^cD;(AZX{D4ct0 zqW85kQBCFG>_S2H)hm}nn9WL_K&=*l>4VVKUvS?i)^yZ|R<=6g>AAA4*37W>9&5<2t8X$ez4d)A zzFmpJLtt02aBLBsoNB2uvzWRP)xfM?tCAMFiln~Lpn|5Y=s!?r?G0+Uwy;*$*4bxY z{ykOhx2d#DwJr9`6)+M0QKn-hlR08?u3VvE%6x(5*{j3%+g^u6%s7^H_h-?GVz81r_=7Vl9&_)N#K$ zYksi%o=a8r@`+swv8wg(?S_2W38D+4C*zyu5&c9=N=ncG5{CYoR{*d^QUiA?;Wz@~ zb-9StHW_e&L~|{o>Tv6Ud-#=C-mTwW3o#Lj#&2R5`212Ra;cpSAl$%EyF`4unvG?! zv+z{1VbF^70rKp%Myb!K&lUP3Q6sO&X_Qc%lQ#yO`=9Dpw!WvUQ)G)(Iu=zcV=$!} zNdl-h7jJ0v6kBOS-&{%0!`ppOL&CO9xhl_0mLR+%uq){ZIBCuz4@Xg_<;pnvVu_?! z$7aApSe8x0$XEQcSRhe{xyv*VKKz?G|a>rG?5vef5ATi z&>TZIreBD|6S64(pAcP-1;i-*@4$NpsGoT8`5YCy>(We}h4H@xwwcX!)O-!tr3b#Z zP$JhSBmh-bl+S4Wd=2hWfV(;Y_w8%&Kb)4yPLq}TBLjQu{@*Z=AD(+~{K#9!2Mw&; zfHomW)S`60-k1O1paVO&PDSVV+r;M=Z1`%DZf~adUwi9DBX4Sdrs$(?wD>KQLM*%2AdL z9BbKkjAyUZ>RLNC+oi$2kVg#jO|rA|BgI44W~+1*L-&bRiNj(Mh2t5J&!01RoE(cR-<Rh zAGQpf8Ln_U#O7T!38@i;YVVY6mXMsQP-~frvS4)k{bNV}`dnWcOU37_S!uOre>Cqo zao0kpBf(9}lbL#llkT&+3RUgc%j+=UT>b<85dImo8UdP|2&>tlL`N><@YZBFl?GA- zh3H!7EZ#bV&smFEAilwRa>rlh^)&go!o5_dimuvwkODvU)tU!-USK0*#-N}V{(e^rq zesgOzCy&X@FAxdbT6VbFNS81&bVHBLf0c~?&!MArLXOHn+5CeJ>C~>>y@j~H+B_+_ zd>TzaO-;(kxiz>76sS^l#vZ}H30B513?IJ$Q-3!R*2ibf(31wz7<3ydg)QsM5U`Nr z_8^t^P1+pdx}XFTBneH>Xp#)TWkKPJ!rX*Q{1{C~-=Y61#QDq=y1G~?^*{vyhr|~t zSi8%{nkqzfUFNPsHJC@;9UcKBRt&N-r;aRe6}Ux?N*y)dl8_LH9IskxH^CU!Qrnc1 z;q;UUeWPJT5?#A|;PGdmxt5Y+E%fAF=ayE4<>`D1TSQ6jWlK^h0;W<$=E{~oNJtTq zOs!+&fu3b5ZCs9%iA#mqeFZ|ZB)2szud1w4{FG}h?~lx%i?FDC35h1lBgslSY_&@U zLPA_1lHRxFT%>Vtqspux3z*sJ(U$?h3nG(bfR^Kh)2IYk1vMlXplJ-E>j@)kHS3SY z+tw7QbiI`LN%3%vOO|8qzu41%yh)b9cK4JaB@pGImP)_6`9O2aQk^`T;~5Mg;|{ZU zT7Gt&byac3O~wq@=B1OTJag|HtMowVK61UOa;8#h9(!o&C?@|Q-V3pp4$Ob|PypQ3 zXzjx-t;aj{#j_7>E}b3j(Hja9tX#YPzTKGTVCKh#6&rkAs1#A|(hW8_=8MQ=IbRx_ zfQ)}Y%rBd)ZamR%xAvWCsW~y=g83-~pMUGAa+o3mtIy6x%TI0f*9Mku4sH3?F0U76 zTnyb@3P5I{^7bKI5j+#}yzxrVcq$i+{CFN9>~Y@tz7*DkV>D$YTa-A|5%3 zr(iZRAiHg>9iA9g$coM2^H`%(vy&<-RLxzy`f#0La=bsR&0-3r%3MihRalfSZD{K< za0{$jVJ>)evs-l&KYR0uQ&Up(G^cSV;WW_ANI(ia(P#w1Vkj@Iq*(7rMM9(kXG>!# z3R)H#^wnSk;c-~5&1&TdDiqM)E>OaxOmXwzT(Q36!c4QUb|xs)`lGNF)g?+Fta|#9 zi_^ZWoOCjYl$J?O#gRzb?w&49dDNIgRtN09iaL2pe$5u2Z`XK-)b-GtAA(RtV0IX1 zhEqb*80evIIvi>b$At_C)VNxM6e>cEYd0Y#{gc3=hYC-PP~p`wSURsl(?8U&k<}a= zi%J&{w6y6wa&o4rzqxk1IxK0QzuZkzQ+eW2k!MWl>hg)XzTuF%(u5mJ%T6U=letc} zS7P+Zz!)vUS*1c)3{xjk`7of2E{SDBMs@okR=KUl_m( zx9YyVg!>cR3aNS~!q^mq-HgzKh(rp|pd3D){6yA?A+5Z~RaRu10rw}^MyYA5udwoP zM1s1zHB2K@Q*mW;_dWAs9Wj&G_JcQ`*b`!j744e`3`QFzIh9p1(?Y}k6qClYx9pAP zD0MKBi^|GO%M(g-r~mq|KY#9^m?@?S4}be#FnCPvL0c=8A!BE!r4=k6B`Hfiir#&0fti&5Y+`fiWK`vQl7r7Yj?FGv^Y{PaI}VtIKEDgl#+yL zz+$k3sfkfmSt%gVvr}<|2hPQQ68l{&_L~<=BF@Kt`uF{GF(bp)f8y!)#xl7D zyyCm|&or43Kce=@Ye&(V#LC-$g|5yENFN<^wys7IRuv5n#8e&xmyl>aF!MV92rnz0 z(<)jj^h`^=t6;9vRXBN1%hXeQnw_H57Cecqa8>m$R_R8gE>r!O-O^qv&yVh{W7vEV zBmQ%RoN8?=w}cBJQeWOU;)`CNFK@s8i@#y;bD5z>pLpcb-cE}yx>RFpt|;WNJT*fl zzL`b?K36J0>G-bz!TUEsZ4xFGiwIB{K86@psHczCR<9^GJe2k!XD5?$@XzDZh3?_| zCJPrzS;D%20Vao*IGVg#AuXkj?Am-`1W9K@*_hc(&5+2%>EN)MxtRpQ{jp_egnId3 z&Xm!)2G0}k{NqR|EL}7<&mKHg#<+L+iD+*&p z)BU(@a8l8oaslP*$^Z+`1&9Vs_8H6u4?~bUgQuZVh=w=?Wb&FP zA7_PxaEzC7q3A~X&8W0}**Oq;+WYt@Ff*Ac*VA)F91_*u9n5Ln6%yodWfZzrOv_ia zoEWLlQYhqE-?f^<7%?X2-=FJe$_)%|o@n#klO7mZ+0=aZmg06@ z28Ap~4q=$BM<3q zFd%L6$TN{M2nydq1uwC$!DrO>Z{(m$+F{(sB%YI)hI`U3c= zV|fsE)hCtCKzSYDmFK82z&760B$-dgM#`F@Q3+N^7b8=nD*@g&0p3oea&cYGea< z*c)Uik$M*_GJy<@m&Yf}C2a_rV=$?l6hp|&;#n)ys(_7GG<|<>bWfv+ot(zEx9p2f zUmGwdbrQ98J8CaIcq@uW$%u_NLN~j!-zml;Buo#iOT&(b0xLk{0(RhBm$PgJA z9hAo=;#dyvzFJ!egMfbV6U^98ew@NF{W}xtTyyw{lY+h?k;WP5vwoQHcbJ9U0{22- zN`z}9>KCP`!b3xJ33Gm}m>CbL+?8^ujUiuLB~ef|-E`^VJ$LJdn;gZ4G%8*R#nRAF zp05mA`9#>e&Qx*9w*Hfi9S2&>aB;4+d7*LiLZ=2BJGAkxcs~?=Sbq57@+Uw2fTXSS z8LFvR2(znYeyf0MERp7_)rxGg&TOXpCxS8r3IhtPUC}qVIjk$$dZ{jE_}a}88bdJJ zi%R*-LIWI5j`k3)sY>)CB6vQ*r2d zBqHA$ROScGc}N5SPfY`!AUm3db%CiW#l=gZ;c|Iu>`xmB=rRB94y!J_d9Y7`xlcYg zG7vE+D!2IQcDs>8QmEBAu!5Q^u=-_czbOx!CRFJerHwkWs{QO>tn0%cD$2X?36?qfdgX~ zA5qoJhC26Fi!d+tKeFAc_P6(TE3m!tp1!V%{K|!EHJRmyhCM&}$?{JI&$K8UBX@Tq zdH|Usv<*&>0yekUKoZjkLK2|~^Gqhj$B0#@$DSfc-}rL-wbEY@jv}Eaq#p)11-}nP z2{|Ogx`lO!0;dQOcOEr$P~DwG>5f(&Dd{}ZYb+T(QsU?dD5Bb$2~Wwc4*T7w)wLCF zD!v$VPrX@b-h8^X^7x(^TYhI(xAx_CUE@Rj2FuXI_R`bW!A%r=fIJ&|q+sggk2cX^ zMh3=!D*zb@td)qdB;lNx-w%G6C6x-(I*zqy+Bx3wNU-5=gdZ*M0^=E9FmxgkQ(|tG z?`Sc~mXRrzNQL$wd>`B$zAt`vOgC1#2jio~B55%i;YVMdzFz(jq2kLQ#5oF?{Qo1E zQvqe47%19}mwajB#0jm)cT}#Ca9sxv8lnrK==l*BGI8!t(by{$P;;rSnGNcjeR5ny zWo%;esaCaZ^!iZmya_Y`BELZ1q^{x^U)`c#+%xlUui<>3_4 zL`4i5Cc$+@|AfrAbB&yjh8CiRg9oE>U$Z_qTcb9%?5x1Q$5ViW+&j!MXYqBZWg z7YM%rFSi{2FcFbKZ1L4`yKC|u1rwUufI)Q$ie3?y7^B$^#!`9NY`wNXTTmRzgC9VpSM>Ws{_RZ$edBx}bU<6=ywPJH z?~bs!jr~*3=JO*31*7MioYVdFTy{Qvw&vXpyRI~H`AwI1 z)a`1v3o_bi#oN2vXS@tr@oZ=Bb`KT%_Rwor7o)nN?_jd-yNt>H-UL)sUVp9s_`g5i z(f#D-M^63u!D#fsKLh8Cm$yNFz|eNEzHYWcNYjUH zVm0=!SuP$!kw>D6^64VKQ)1~nP~CX%Y*{6EOHU2F{nV*JCm!FOOmOrZxb$H4^-qqt ztzG*m(#F8Yhq2$SZ`KFe70#VLVobY*9k|1Vo$0 z<VQ$qZ|IsOI}3vsZ#y>?km?M%5gTvEv67kES3 z^646N)6DqzV$QsoAZ@!oEs}gsgAg8G_xBB-j-f#}$4U zD1BzrVYoMKRGt>ZYKozNOFAvlz_N)lGT=moyr3<)g2kr+B7)S}+sz6(c1AQsM3~ zi6JkYV-9NbgO)r(1~t2B+)Yj8I}OX0jdmR2kLhfgP1zRiwo%B1mC4JT2Us|tYZ5cu#CdekaYiJonq&fM@IWk zx2dJUu`+8@0iTqoWHF&1%8I?rgI>hVFcGZZxIeZcS^xqhLD$`u;k&R6^*%HzVUTAk_2*OGu$6^ zFOoe^*zb45MqmrUhM6{NxQ&Nf5ug>|k?~t513pPySliLBFB)p_sHjwtnkKSp6%?vk zXBDtv$6}tYPyqSDTt+rWPG`#5nH*b*ieF+O zQGt=AHlu&`Qnh{SSf_+n5e^E%vk|2Vcw+`OyY!)USv~>{4VVM*)-bRr@US}wiTywT zVWkHOm&~!&m|YzKvoKrY3M+hl75cpNcCy^lxu>?U&8K0dK^~wvG!YQvjz(|n3V6p) zUb(My{#)Ce74uhaT-G zRM?bUkwvDjF4FO{>1;wWiOx(RvN@FEv6EG%kcmeo;x>0YcI`@}>BjD$F;E8~ovbug zR$Zxo`b=;qrs4x(TW?ob=bO6l;G@C9yUQ~fX{otcDej@WD&N64e?Fn98eKew+-B27 zyc2E%5d@_A2MO~bmIS;ppth#jf|fKSU`?gnd6^X(4S@sdPa={BZ!sh03ErueDjKZ< z7f)d&6G#|hPIfw$@H0b+Dkn!`lUTNG9g663NWkG_COZ|1jvk#VV+=`3m%R>*AeS4Lr3CoUOwOcIINX_zN_FV8g#Or;8P;gbbKCJDDf7jbyula<9)Vrfv5 zO(m1lk~3I2|6NEh!z{jyiMu4IBYrhzKq{S_%o&6j!{K z1T5en01-4CLquRIjXOBl{TUnQk6w2 zb(vkoqh=6cj}MbT$fm-EQ+ZkY*o?z=`r4!S-8EF;oqMRa_pO`Py^!}y%OGU1X{Tdv zKNCK<*=cFpdFIODI{w0iaxCqvioDOuAE-?6w<<+tj;9wG&k2Rac8V;nH(nt(4o|uHg;ZicPlafeT znfO#1g`;7oGALQ8q}-Hb8k3cdpQ8n9LX5ND8COM4|8Sm^lZs2G_@->z_xh&J*MtU} zT8ffr40=i`373?Wk&I0yWl6?rCx104sV*_5q~vC&f_;m0)*-k!4);Q4za?Og(sO+H z1&R+;D#4W#rYc&w1e}Z-NNCXsVoD(h0)|F^nUb4JrDDAdXRf){&b4zOuPToU%$OqNM>ZD<-izwJZbXTe>-^i-yZ8U^j{r6u_UuP$my^+K8+-F z6xTX=b~Y=Y!Qy06xK@i(n36??pcZoLFL2l4*4^+S-ifzLesKmy>oZnGSbY9EDy@)0 z(e;p6F(*-Z7!P4U(;@CU%h^>X_v%?#JRV0#$>!?>4OIlXUX9Pnrc#J0xv6=2Va~w? zbB!%81@_tCuo(;yP2&`1(DS|Z{jO}KMxD*bPD-Z8ybbwN&(0TOA9+6ZpAUq20lCtm`usZAZN-KE^tc?!N@1m6ahUWB|QcHW%EQ&AI5z*jhIc!&=|hj zj|V6blZkv|F+UsjTV<5D7;}i}q&N*@Z^8MSkn^KQ24X}H4rhc4fK{ms0vMGj$WKwv zIR4wK<7(rEAYzi|&+-*urPfkzAXXeu=a+=)2EsDA&6r#Mm$0aT_ zh*NP%$;2E|2CR)NL_*m1zPsvd^-gZCK*LDROwBW^GVqwg1R9N$giT6I&rYGU*cp{@IK7UT|Lg-Ng_`uF4{$q-B$cnNFuB@+cG|-7KcrV2e0_TN_m2e14!ku#_x8~s?iU494-WNTpLBip(MP`r7$dPJ zHav+Bk%l{fx6&#NK}QV`3o)tAyu&y4$dt2i{^nNCh)y@|8adadkTu-3**9&${hGt6 zIQX5d3*SFnPNg-`n7+A(y4&xa@~~kB{p}}~hjBi5Mt+j_PYmYAC@6ja|q5rwqUwxeSEL;Y%H$K|Ptqwbk|=fAz%Q*!VJd-+b`b^FZpgqi6e zD@w{vojByC$>bW=B%9&e_Fy+;qdYuLy|d!b8vx8hWyGYnOLw(f3HZ94(EOz!%WgAK z5Y7gOz5wS!#saSM1rXk)0FxtA&!Bp64a^W^eJJoqebd-Zm zM%qTN4fZ{-wUEa_<;?Ohp%qSp=um{msCP#AR-2rF_b6+@jf8)`mIQ#X_AMN)#L3c2 z=}bpUacR`TCUz5f&Zfe$sEL9OsvoXYvC8-K)2kY)nAx7{W_ibAC12#OGibs#J^>dy zM&gn^zHFJ#gxk0E;Sr;}w9V}7@QO;eU2Ew*)$7XYCi~}a?izdJcqC0;U1kgEs1=95 zJ9lf++f~SA>Y>J1m4Vy|{BYcBNuB71Lc|~jtA&(Hj$3i4-IBP-YNsSBTN3sF5-%pj zJrRKYGdp)4e`Q?53g0zVx1}UcXe$#*tGr5CSuX^$g@Rgx+NYrlEM*dDwO6HXKRa;b z$u5!m;4d$GcDRW@v2?u_`}NDQUp*4L{ctVcR-u#?nl)6a$=BpWraY4~t1?MUWCoAR zlux7CO6yH99$we;CWiY0Ch`VG{rx^lJf}ZQ{4QV#nMJeCAz6(p{EuitL@Xk4qz2-* zaRk0CtTEKPh5uKGqD%EGX9*717(14s5^4i_CbzK5i#zgvgQ-~)l#=;8WG)H86Xdk; zcsvvd!Uu%#VX89OVt~3U8r(;UWzws=Moq(^J%bU>SYBjcAv98WPmI){Gu@rU)( zw_&Dn(vBUmFJoWc-ZWkR;m5y2T4hoGdLCef%q2ig00}mcYhO1l7Tr%BCw5dwBF-L4 zB0$JjEjt{?|LJrE>?!O&(J^x>!kIthX)sf5|C?yGir!iUDN!9C)z)b zef!-u8XY+=M2*aZFVS3j0a_@9lt3U(=UR&)iarogt2Q~R;GIf`IGd1`oz{^G#d>^u zSY1buc^WOv+k*mO-SJV+pk6oPnR#-`X70bcPu>tI!_~T{r>5O}qee-m$kbLz*L{b! z*|lLS*8?>&-4AZ_F&ND>YT2RhFYJ12pO37rfCL;G)3y*_U){_#)J#Of|FKksZ!QgdZ@XDp?cU1Q6a^(V_D{iealqx=Iq}ZtE_pL_VydU z+_C33SEC&_el@@6*H@$M!2>UkjlaA<7&`dU=*%lirNq}ePj=`?%5tlC%zk!t0ISE=|65ygG9Ht;sEK9;>Q3{w6{xU&4Rt z;9fYGMSpR^Gu0jPi0^-UsVFDPKS{_Gp3eZfr|M?ovdQmXW1Tc?+6CA zY0Vw-Wvrwarq?xlWw61(XlnLI_FLr&t5qSlE`KlaE^OADttK7UR4l@K)4j0P)w8wP zY;KwJ6^u1HQ*Rj|=w&b%q#{DPDOxO*6i3ab=3^ivDb_saXdFimb$Q{HA9jObyePvGs1S0{`Yjle35#%-nL^UVfi zI;%aFYTl;xf0^Ey)&cxG`WKnXu3Z_$H&+M`zsw z4J09h=3)9gzA+j*7mc~MVD2f29mDiQF>hc;mycsd@sZe231;e6H^v@&3!$PJ=p16e z_aNzG_-n-Yjyq>i`;{<(P`yqvU=NhUj%&tt9`--*kiLGVgj=||T$<JU>4IV+DGlq4xbq2Q`mGhwXJq|9@2mPJKRZlhfYC` zTiGiv6W_!K8ym9MAXd@;t`sY5hjVWN{@MooWk9l|>zD^DAj4{CeB~zS7T!4PfuFO%vRvaJpH2I94r1F1OBJg; zgpEmxn@sC@h`4=?W4?On>l}mofz&1@$9d+bs^FyNC*cRbY9_0W9Tj-9YgMu6{3u|;=Rg?F|(QakX1 zf~afPe21-jDHMYGG$eByTI#m36YRTuCh-pQovufB`^$Ge*0cB%AGdb%mV)B>cAKqz zzSuFjxshA?;eo*Z%`VsG{eh}OeGX^eA^ekHlL9!%27g9)5u`w3Dkq|rpsFxV;VWY{ zRy0APS^$hg)0%`_*Y}BJwl|0b!i$i}bz)fzlW*6}@$Y;OLrhPz?mB!n-1E>}iGTN_ zUEX6y_S(}jQ}956u=H_fN$K`xQ_Lyo*>S2We6ZJH=~}A19>YAhkv0i;S^Mf->D?#Y zyZ84$b+{+5!}8ll(-Z~^qp;CJS5-}xB6VkUb6o-1=yd1d4YgZ*h&VAuw=a7YVV8t! zuhQ!xF5v|B4;x7ssr~p2FDE<=mJ3WlU-9u0$xnQaAali#hJdyN^Gy5h5TE7hIQr6T z@l2DEW@|b8?aLMOy_GHnGkxb`=lKa}zuC#Cn7_AX@QWmi$DJCdIwi6HO{@^v#V)zXAJMgV7cT}8$>#`E;NX-AZ)2fwr3qn;9>A=xi zAxmLqaqRhd=B@(~UX@x{B7xQ4YP#H<$9BMEjd zY;E0BBf%4E33$4t$>VOTu23l&TiUh#_l?-nP|F*!Wl8}qNE8w6f?un9DF6!;6vrKw z>Z&sgac6vKuA#Vb>P+kC#SWDuI2Ce)wYi$E3&Z}|Xc4)aq%Ur?R!;hbN?66#cxKpT zX&See&vXWzYBKi8(2aYJ4iprPpRRH59B*cEN<#Jdp1D?=%-3R)K}J|v(wJY;>l5K? z^=$_lqB}wY2q_-F1lA1(t#>GmS7zt%llZt*PZ|jgBO2Xe0P!6UU96TkLL@Xvh!Gya z&EzgW)vZ6+plc|WX3?4SES0Um#~{^bW=b7Z*6x;U8jF^lB`MNN8mc@bQ9#s)p}kMI zP#GheY%EK}!fzj$?5kzCZKDHap5pO{rnx&iGBh{dOqaMdOqL;_eKPjI6R?&BRYo`_i6SUDa?Qix=M4EAANCIyD+UDV_}!8n5^Td6BsqsDvyS zG9DpL7~tyOQ6z(xLc%Xz_>0^C6U(X9!`xPywZ2~;Jw8##uccc`>V}shn@_c=nMw;A zsc6p<3J_1RFzRFrZ2oYVony3Gl&nx0&!%J$(kZwbRl6*bP-R5jKJFmZ9ec5x@_$Hs z@3=PaYk!Beq-olu zO_R21()M=U^fqa4Z+m;&+r-Gf^Jrj9^1HXM@BO0{*s-4ToX`23ecq??(9W@1u?*UX zv|T|LgKjAIY0Acw+Lm%Ar#vW?xebD%^m+`;mT}dL$_6qFCZ_YH3Xqm}ZvP&)5u^p} zF2aId2P3b}i91Isb&h;>HV+hk4sPSCMDyUi)47d1n{+u<@>YLkfx5>nNygVU_#mIE zaSF+vre@AC{@kstL$9A|OYx>y`VaV#8Y(jzSEzDIS@t|+SGXfX1O~b!XG4Lo1e1YE zt>^Y$4Et&NoWJj$EwB%BVJURD)Lr$;j?N`eNXD+C zuW!}#_)R(gXlrgb`qI1a_&SH(9KLVa^?74rlS>)<3rPa5!3$Wr_ z-ywS&8>mXaeShjX>|a4re}tst(r|5%twZ1LjzWs$&eqSzVJ2)-eu=z(GP-xyKWVK$ zISPAsPx`#4Cd$oYr*Wx@#@R~ye2YreGHy}L48e1R%dqM|f+`{+KVpJPkkk(94HE%{W#ou!>%+Z57PX2< zOrn(bT^!wZwXKAybFhU@HMLTSZ74L?G{`GP92~B1dwt`h4_@;RUD@6%75R7)hK`ZX zSKIrJbnf`prCk<#hk*IdmWzigSEC?WC zFY5bR8uLI)axLI*WR)U%m*VnkZGD;SxY5&~D2Z zRWX}_>WsT15Ac71-qjEVd=?7K^v#QH=5l_`kd2y7X64f>%vu6Lt zH@AsKG88eUEA9gC0)Gpq#vqoFLk?A26(6eHHgu$vXKzzEkBnJym=+vX*S*V8wbY?Q zRvwa7`Dn7Bh0QWI$Q7`S5PuG)a66xS=v;-gduY;FJz7&D^o&{bqXRuM%aO~Ewo*7b zL^>gO`S>0){Qh{yhO|^bhV+WEsNfSxT0$X_ti81bJrg~g$u)Qz@I*if#*I!yr$;0P zElvRElSFu+IeLp#>d$kFa#DoeajT@(EKK7uR8kb6iA+Lmb}l7=OU zUES)+t<9>;9Akj4(6RJ29HxQM@$Fg_t7BkToSOp++nPBZX9Xp{ytY+U(P1gc#rt6n zuF~3WEJWX@1|;VsypI8Xxm#;Q^gLuOF-keQ!k0*a5Y!k^VDWb#V#m7}aQ;RzAMtsNa8P%34Su zwV(a*Vf^He!moaQQAV$()eKkAB!MZbv}U1IrD)&Zpz0B8AN(9qybVvi7f#&_x(g%{ z>SOWv8+|aa1r^7rZe2Sq8Br6MUPlwv+-j=mu~0R`_YSn3>{e1}uB<|?Z(CsY`FWG7 zZPDplYL=oQ16CtC6jF3l3q_uOoq6Y}r^b4&E{{k`f)ZJQfyoXG?hP$`_t6Xf+FdOQ zv=2wt(da5hJ-DTWYq%ENcVgCNT`UA$Fl(zT7;KmeyU7PH_Q-@y`9(z8iL z88~y_t_uB-PXhgD`8gaKAu*eV`z49X6&9*?9KEkWI65(02bmNZO;|3-!)-{$QwGlh_H-Jva+u~7$0SSzVAV+-eRpO$7XAH;# zbPMhc4R`9qlkfg=7L$m{H&;~CRr7Nb^$HkA1X*oVWl=?iYGqPp5#f-2`|OZc5<2lx z+xG9>zm%btkB|4mkWUehl$e^Fm_=7qHmD3fgCH-1%rz^?fVe89q|<3dDJ7Z3B~oip zA3W4!NS2Ju?gDBH63*iVcrsdDg1y;yZX7gpqw*B@SWvSW`#q7}M{%`nK6I_U>r{u7 zS$C+vgkGrfD0o#Gs?67~-uQ3PqkF3x#@WFk?>#s_|_qpf6wDhzAMYY z6tR=esZ>#^Icy=OfTb=}qUpJJ$d6fBk%O0&@FP z=n)@;GlHNFxhtc8r&)4UiW1p?M6pJ^VrDc8(@GI#vWlU}NLVb?G14=N1VyU$mNs=u zZN=eFPL4i%d@5vzw6dLE6&ySH`qtTJr%R#phQthZ4XI6DQ8w?k=ua&>viQ?e zp^U7YWGq4Ao;=&NQE9fS8OI7Imy|4 zE4UhIK0wf!1Vw2*A?T2gL1`egb=BzELJyf%iMCBJtD#UqMoHsS4 zxU8o#hmlSvNZpg?(6=ksFfeb4T-8+^p~G(Hsj6xSO-Fmw>rbeCBbk_9%uLBjOM=Rj zJgp#IT_7vewO6u}QjJXM^5FxcR)Qh`Z`(=d5t35C&6?l$$|gnom5)Kt5;nm}eE@F@ z&NM6PF|$SBI7fZxn4=ak4k(D@s^hSl4Y^CDVNWTmC50QYWt*;aRP5g|>J^iiob+5a zHHXi^+c%vF^u2kyiBflF7GGFC*<9XXE>6y&5H?h)sFLE$T(+JAi@bS);9~vY;Rb$9 zuEFlKn+WdNHaD|CYjFfRv`i5>C8K~z;IebL9*3>Cq-pv>pY_b{-kk9t-QOki59^3> zF*~i+3ZMYwd=WEGSUYC1E%%qTT>bz~c6Y*mV&B5CVs>_&K3<=Q#lBSr%be>^kChom z&!91gu|w$FWUt=r6`*d0b*fH+*&jGDYBG(U2mtm;X(?czST+Zh%ErxQ6)+mEY}^9R zynXu>tP`ILcme?4fRA)usn-crZXy8-|3jS-h^Zi4M?K6uxeV(Z8Gw$XKw)WT6}QCN ztab#&>6i>8nJnjhyUf8WWoCtHg_itFGtLJbNPc#{I#{M}Hqngjn>87Pl$9;`)Ff7w zQIw2b^p1CvgnFhMjobTg{}lUcpa^hS@ZjXeJ#h5Iqw}s1G~JakKsQSfvEP!kH#cyo z3aPYEQY|GBWe#QKyui{~P6Gs(wzh|>l>XN?kKSCUxa?V!;ah6u)hboptlL_TcJj6dQA2r z;ldq{93>U?<4V>RmVoGv?r$|An1AHUovJdwB%5Eq5Gc@=>M40jzsD=hXA}Js)}kY- zBXy78|IE$n?^aLyMV!`4o9doy!hOJ?UVMn*u<5e%O?Ed&(^FTLlg}U%QtH9*8zdNn zz!VpBnoHA$2WGeV3so+ezR6HrOocN(1{t^)fO2*uc2CD9LDBDyxrbCCuo>#1pf=RV z8h;nnAJ`YNER7@j2RICwf7DTcG=!bH%G^=?%Gsl7+HE~%Zl{6u#V0wR}>d3 z%9*qPq@RdvB38|m=SNS6mi(OJ+CyXRE4AXn zB1v$Er{$nfdobXb_6lGDJv*~|pbp8Ph^TaxfR!1*C*d)LFlZ_EnV5co)yr0PyCek# z@D^{~{s(q<{#zS}f^cJg zWb5LTjd{fq->}|1?v><-Bw_+jHzrXCnYwB=ikw-jb_x~U*w)N+A>hnbz-B{naKZQ0 z_fzsoq|^YNQDMT?-CxnBCo_zGsj0D)jJDAvyZ{t&fFjN6{bNUDC?Z04@^_%8?pStI zi=j6T$0^@s(hoLPlEfqZCcV)`HBZ*d)x9U08D&Kn3@#C0Xe>VR_MBQjbgEHQvaLrB zLooUIJcv@?z&K1wyT2*L);(YDhQcHUo1BuKmy5^NY`@m%J2vUfeeT@7nMFWh4^TJ< z6hiG6<|E^o3U)LF1Kuu>f_hw0+jKXbca$yrA=%LEUU%)Gegnf4R5AS2Tyh??9+M=6 z6(coVN!_%aE-l2scDTeM3v1$XwUA<%RMD#>Zd z(A11^U@&6uh{-zSU?<{})6(;D5|hjWd#ibM?h114tJB?QdgP+OoD)vI65irGyafrZ z0OmldK}|%~LdK!nkJxCn6U=VhJKT=^*Y$PxEm&p6@>=#$Rsk&! zL1#wlrtHOX-;kETDDCiL?McZSN}iRQ**W;c0(otz#8XNuw5O(K(lwmYnj~DYzO5op zDpwUG3vI3Xs!n5ZA~rK0cGqu6N!*aVfhMG6;gbsZ7KzNMECdQSf*hFPUGD=q5Thtv zkO_#0Z!~2QV}8WLj%~exI2^~01r0GfcZmSYZ?@Fz>~kr}7%UFyxLV}^s2ySbPG85R zF}>r^`%4{XCjEL|CiXW3v$H`|+ET`Vjg>t2{n*sY;lID!FY-<7Ip@jJ8r7M#6^f3- zjn?^AZTCCjAHRL#tDC*5u7i)hGyJ!<10f-^ysgwdUPZ5mGkOl_<^tVl)#Hw1sE(+t zyO@vTO4`Qv1w#PvOfxoW4a!1F@?Gm4nDR2*4DyO>Yxk#CFTS%tuJ5pb@yu8n8 z-LfzrS7KUVgGuQs;4TF>Yko5I!F6s)oI1A~4I_jdAkO1(F8kemAFWV%b&1DM-_GE;}8&I(4R@ zBef5PU)Z=WvL{)ZpRE@Bgi+B{Uo0aph1K4j|IXq_Hx92yQlDr()#D;g`n)r%Vk)Z)F& z4UO-sZ#p&^pmlPClc%~LK3z6)$klYLM-6?Fj@kpW17eI$11Mzdn$b$zh>J_D9LJw& zJTyOPteBhMPnQ|V&2u#ON>o8J6ZY_mWIe6EMXJ5N&pbNIwuKa|`bJ3pAPI9I zcaH)eAc-nh%4N*x6et=Wqovn1jt5+rRSzZNS;en5+!-8WZqu^}bKA~ceBYdB^P)km zx1(dRilEa>&MVB>GQ+Qwl8IbZu|y_o-0teXJg7Rp_i*^eJ9V3MCw#R{E7Zu9g7-3@5v=SE=i%=KBx7I(Reu#*XDBRNi3j5%(C-UWV>r zL8%Az8F%$i^|lJfu`Ur3v$Kqd8@5_2xyb{c|w$@UTZsNh=?t91d=|$;EtD9Zg zsHZ^xsoa0C8|LNT+_e4OgN|ZLf0g6HLoW?=rLv^DVzax5FD1|oGDcmF*kdqkKYU+X z^R+pv_PXP5j&ZZL6Jr16_ zI1K>LP!jshpUHVC4o7K1R@Yu zq80_o!WCqNO_RNqOD{~8%)Ec9?w<3=X8g#?5C%gU3?G~Q=<&Tmr|9h4e_DDHsn{NN zBF~~a@&;sR4S0V%e-zydw>pvp#(aGa32!h=J~%Y=z?5D;^}x{3gOi3F~cLU=b2n zjZg4;*f%dieTw*&v)HHwxE64_Su_A(TD^-{Xj#R_7OFy;6})HMV{OCyhULaW_rY=f zKqG81EVd5SV1E7&PVc!MIXH}#KZid;1mW)~+Ny;G0t0N;@%HElEd>wnsoPvd4c~5i zbkWJJXc-t+sfL=$QZWQyxKh=z*VlAn#GVd%>-lh{m#puo6t^_gXsL#=OYIyyOdEr{Xo~`t4t>>0U`ohj zDU(28O35hxe|xtjpyv^?SQ0~E%u%t}rO)GA1b94M@0EyaG!(j_PTqBGivGA zhXp|F$a)>TX2Za>zbQAHXc7{$Z{rujRB#zf*FRB`MawLIG75-VjyfC@_ zsqh8lz^#(R5^I-L>N7HmHEv16S@cM7zYjhc{_n?NZG5V%ajwb%Kyu>R;jK&N`w_~A zGq(;k>~ELzY(a^kv$DjEdNp(5TZuDx33LHOb_TAUnYt5>!Co#1fPwso_Zv~HavGRH zOk4-4(bI|l5|>sSJ%gfdf}Y5UHj}(*r)%rGN8BkXpNB%XImcf6?W}U7Cs$yW5|?JkPrIYj%aQ7^!9$eG-Wu-Ma3VNZ>7T-PC~GKIIiKoO40zgiqY~ zO!%))sk$WCcmDAu^2N?~_EzSw4gR5Wb)$*i+W#|za?4*n>Jb<>JvfkCqQMrymob^> zmqou6`qEjq|CIPXoRBr49`1jr~y-bjMRmqClZER`^l@E>hG%h}jtAF5!es zU@T%qIl)3j_1Xfmars8g&Q@hINx<+BnWT-|kJ9wAk~B@7k&~aYxJg)V<&p(|_}`=z zd6H0^lTs*9lBygGy*tc|if`qM<%@4@m(1_kt!4B3#wOKY{DDAa=Va<#!Jv=&%yY7i zV{MKnn!iaStrOml3!ROfGUu3sx$6i3)9Ra}vYhZbT8YKIAGhPzlQr5tQKq?R?`6a13lJn z?q0w#XzP6aLCp8Xn`ft*)cWBwO+qR7_Et@Ed5NWOp=|O87eb|7i-(U}R-~9;D&2~L zLQyFNUFWbNUsMYnLURv|H9mT{JDWOT5CkiQ9B{&|19n!+wcqTTcy@1xp$NAtg`+aj z*hav%5gTX)N;x_zi=g$(8^ARbOFrhv0{r=E0`ac;5Gv$xQvyFjo5&4C&)IHme_x+k z!}ipLl)kM#t~|KevSkaTmAJ(fqaKzG5?%88n=MVd8~Es!XPsM`hg4d&b?P&idZ7(% zQWMv-h|Ai`XfC?3K`pK?=VTP}3e^s)vSHH1aaWfY=2=|mPUq7gS0{0wfn0${zK(aX zuoj3y%|z4@LdQkWItdt%i2sUW}$^eRjlhd0-s=4V=zbuPmks@aki$w;ez{JhX<(dRc zgNTCl)BKGgUf-z^S20nkEiIBXlyf-c4HC_abfcmFbdPDLHVFn7)1~c_ihh@p378y3 zyi(t26}{4Cqrp2GZ@-QIBbZ#g+YtLa$|Qk!}P#JS43nNdzg5m(2f zaS2H*d%xA%W-Oc^<{NmVBz#7(3VQt+g()k);yX*}1fGFSHOr~*tJ>^5WBZg!5cJsO zMbi4|BUkG3dS1G=Up{>Q7I(fU+rRw$X8eW?NqDwJE6r7RJA}fjkYwUiNkMJrm{!o@ zmS+nb8cZ^drt!#`7TB*Ku}h%;0ZF(3_vkS0dDQy@4V4?K z9<=zC@GiXTGCUW4LG4M*=R>)Sn$Tz^4CVCd^TDjVi*${?ubL)f+XuARBcA!%M0_j?gEYMyQd)QQM1c8S+c64R9+f&r6l;Zv~_GZz6>DUA>OrnNy-&>v4i(a(5 z3=P~jG>x%(29ZQwR1LG&^~aCFJ#f%Vkt9--S7;6wwb60TCC2`BtSXA;@At}>36l_f69AZ#STMgf?4ws^KR%J70py)3_2 z!y|F+U8U&ysKJNiHhy-#z`$aci3_~pc4J=9tymW!_@aV`RF)x-{Uxf)*g^^D`bWFQisfZ>Vpk@YqJg}vGN7>P-_$1Ffe|&cX3x? zMjluUxt_QVMP0H;5FEW|C|jYl8_@yLU~o0hha?;}qqfEC;?|UE#~v6(zP}Qnm+H%TbBLx7opHb(g?~+@!P|R9F2DsP6-b(5=!A z7h|nAg03NouP}(VC&dn!hU;7T$hi&Ho77EMc=eS6GK$_|5*Og`L}o6WTBmO3UZsCP zffhj6l^uEvLE10}`?TsUML8n9OUBoiWMwin>>O%(Iw4hIR{C_syEYp-oTUV!xU8|v z+EG>v{5=dB>@}cJgZ5P-jJs?mq))!i-H665VJm4M-qDB!a`B0{hdwqomKIhne`{{x zy@S=sL~dELN#xQ36pu?p6pEzeBuwel!y~XG?)iOxe_ippQ9k> zsWfU_1zF*g>E~7Xuw#rOE2DEOVJ&N}lzSJy)`*7E5GySg5nwV_tc8178; zLhY1^cJ#rWi`iCmR0X|$@H|=+e;cF&3pM{}SecdR{i?>&W-2Z=wOL+!re$v0WjysX*eLsq;=bg~UY2GD+nYc7}_rYq46IOA9dHI{EjfIy;{F?~^MA z%u~)&yC=M2fqP{4Ip2y4ZqmfZ`g- zXos$Q`sQK1weNlOUH5xP#yys7d1I9; zBuTHi9{%DT+2r)}cqbI!F$q&Ze__%)fFIBe_at)BW8)cU4+&5oK}d^I9|Nb1Ybuy# zS#|K&7VXif3Xgz=&4opez1tnN+Z)8c{fqJO{+eS8qaI+S_hcH<}rw{MwB< z8f^7C_ML1M1kQc9t>(}&YMK-3SHg*!q;}ZD8}(izY2$P(>P05T z)!G_}k;ol@)Ns^P$IxRV>DP#nM;VzIPa)@Jqxr2Qe1IjRY^=Tb*~ykC&hHG#lZk9Y z-T2X_;NFn<%q0oEy4zHkEA^Yum1DN@0%jgp!^o6$9P6l^axk;FR>kJc8yRJNCwscD zEOb;!iqgj3LzvGzfTTR%kwKF)vnD?N@PmQ>KwAHGRNVi-e}vz7*Z1NZuRVTh#8h|g z<>!3gM##_jjbj&@&EstjlHd>T*)N{k zKVX9S(Hrl6|GgH(guIRvE{y&qyb%6N-!DG<-57Ao2;B1GpGGUU;LS#Ju3#IY(!DC< znHWq&xyDf1u#kC=vh}X&`MTTkCR0Ys5Z8_vnO40#J4a)wVzq27%$DjP+c4_l3&vhO z!B7Z!L|L7ten+FWIE|?A8wF-wZYY)Gw3O9~vO-z>YON4zPst>4NmlL4-+rh0+ep@f z)o5--ZRclq*8}QHX6?)2@BTLYw{UIv2lwNX(>H{2iLQfh{Q*fk^cs@?Y=dsw+xu@_ z$JQNqdtRs83O_%Dt>6FFysqNxUmmHw@#2e+Z9!5XzT5>GAPdc9-JP{7S+$1XhumdE z(I#lLVJlkOV`GjR2R%ZzHKfpV*twJ8)ZX9h+VjboS~INSWJ)O;p((=)i zW6id=09vdO=@t zL0@&D(JjObac3kFXGFP)+9L3lBbs-eSlzJ*F)@vNMAJavag{_`=Hk^rFss-5i7>4y0QbN7rkOQ<$6f%V+~L0@y48ob4PZ>1`u5azk^U>sXNuE3=u z7n5?RB$}wjA*jVSWRxvEvmZxAzqB0J%OjcB+s1k(EjT%hTkB@J8 z_qeb2=)2R+rzbsm$V01NLMzC~D4?O-{V8OA^6;O*#(~br{eoN^K;Yeh%)5iVNW8nJ z`_B7D-PJr8%YsC0B*w`?A`KxiON7W5r;(GJ7n8_x0hLeAz*$ordZCnv!)LRo8#d(g zbTn2eFRw^e#&Kmdz5)!clvd9{3|S#31XM3nS%_k@?V z<4sy^)3_G*;4KfIO68^Ik~67%;Khfx|AH@qQ;$}|awC@EP6!c?YS;X6QViM$y~1%A zx|~>RUOZ=u$Q=kpStVdYTt$&v*}?s-QlWoym9VOmm!8Bb^(xB8y&{05uWo5AQ2Vt^ zvy_Sp;plQRt<S*Qg3;`S|kHtcF@ zNEiYMh(-OeI1Ux{wefs36CaI7aAQiHV&lbPt!s8N(=3v665I@W|=qP;F%GA&0WFtxei;dQjVV<+ForyL>Dx zKK$4948bn|vbtk)vyD{foPBnwaj}kWMNckFBKU7NuwdCP8uD zhNSEbfvkdz>^a*8PrwEeh2UDS{=!0~QJv-~4}Ms;2)`3tQT{o}Wn3`ai+7vq49p ze9SCL&o|h8B4E@1ndw6hFLtoe>ZAApQP_tIZ+zXlmKMJh$B+(*R`{FQj= z5h8gooRQI@I|dgO&9CuxFwRT#MwZZXtsXxU?OZkYFWIU$mF4Q7)n_wVE#qgf2ORC! zW~{cYkM!1^nJoW0x3lowEU$WzA`v)x=ldMx12q5P|5Gzv|vjomd!mqG4aZt z8rVwS`t>(VFo5oP8uYL)wiN^*0^{+^9o<6sUv&~x>rwSBUvGTyPcz)xn@;3V^U}US z$^0`Kib^5P&o+K_V!d!6MpU2bwkDvMsHF62s! z(i1yQ_bA)0|KVWkVl4xUYsTS)?PmtI{OI0Rra2(b?rRb_$_;u0El(<-C9!$zDmDG< zLh;*(P#BsFH5a$nitS#z81}6jk{r{QLtEcEJ;caYlz9|cCAk}!M8}BVNGhz~@z|tu zbAvwX@-a!JuTlc5jICK@iG{zOF_?q_@J)8%!hko4u1t==L`B#^Kp5C~T6WcIyi+`l zYOJX7it^=aGO`Ov&ZWw%BC=d65(@GPV52;;q4|#_jV++Ih17Yec{C!H29pD*$}Up7 z<=$P*a$aDeUgEK73zC=;4VkW2iZ~3|gU%u#x4i3R1sB$C8fvTHQpIX9)!Z?qSZTvF zm^L@5Tw4yBIjt@JLZ($ojVSC271eX#<&oa!_IQfqm3&v9si0V*k`!wPPK3UC`RiP{ zc>B+IFYbD*hO{R0hl)rJh(X*QqhSK(_Tr}(8yfEUm)$!*y{9R3<(Jd*uk5sxZ+~IS z%&SWkwuKjQ*MsnvyMJ-HK6uYBmLRnk{OY`C|H~u8uO6)R9e!nK;H3jz)OJ3fkc3yk zQ%&g1{kl35S{V8NbD3bq8x69N2-+~HE$BYQzG~^Sm*}@Vy=BWYGe%WlNL8XBDy#(n zs>L)2Ng|kTavmKm_niFka?9oIZDuOfzBv&74NV}RQ3V3Ke$Vmq?wTvR>#OJP34jPI zQZ}Z0wP-^DNuXyaTJ1dZ+*1=hub&EuJcBa}M(>q-F1wIkK9w#M(oydRF+nEsiNpZp zQmybVU$^?PyB6uujzg!xEa#e6z#%jpI9@S|mF;`$cD%B~#0s6As-JH(v!RS_8+G!ClA8X#0ZornRIGJNq^%u&x|QGO zajUfgNr6xs{zZ&U_)j=e@`mgpR(39zCo16B98EJ25<(2p9x7I;kgdnO`78-5UY-n_;n{lAGfh06AX*yvchE$k= z%gdGzYS39gs;*AKw&`WLjA~yd(<{4<^c z+#E|-NH~;mF3L|x&ix-bx>nhsZt4HT-n&>$dGYxiL1E{GY1oqaPcmCoSX}D=8nY|+ zerKVAD~oG@JWiRI)bf`*d}jmSg>k-by~Fa}SLleEaC2 zoSX{?_c666WTw$%Hu3*(9GLmlgTW@u!nte$Eiwbh2*=@6P@NISOSxN@uaR2Zn(+oS z{ro>Fp4FOEPQ+=6Y5p~0kNlOQ;!_gMYF<^RRy(dTnjpBBNy~XT22(zhEu=X{?aUm$ zec(v*?juy4MO#Ic&+N<|ema z`O(zCso@$^DND7(AJ-aA==e^~Br~#ec|u76&+ZIuy*75}Z#Vi<$pRWpNKUOg{lj_7 zvBL`;rSaReGMO$b)#uwZ2D6|Ib9v1P{9xq^d@=5sNJl~sWG3Pjn^hzRIFER&iB5Zi z7Ky}RchYCk@gZE!oxBC=1FjW!{GlJ zLAAAd(7Cs zX)VdQG$N6nmy)zG=homVQ=n7z>F^_XJ$MTm!zW&C#l0E)BFX2wrrOV2vBH zDvo)?c=qCMhj4AB5r7C*6?%lP=wB+8t4N)ZlJs5n?^`T!L2|yZoX@sE7eP@LjmabL zw2w8`Faw>c&i#JmQB%8x4#gEY$F7%V(+x%wvlL)_#p<|*K=pX-a+^}$m%KgQaHEwPijZnxWZ0IR0NhZ(>_=44U?b)eex`vn-fKo0a=bVPe**yRaQfh0S3n)!yZkoKnvVj zM|F(>Wv|r|H_C_o22PHu|9p4<(MHb3LQ}ULZG)(CHG8UsO?#V~mjm3)BFmr)g*=4y z=(Nm$X4P;;UB-=u-sR&bEOYN3@mL^z@4LUzGwork#va~u2oXO_eIfkP-uZ9ucR;)v zs=MCYau(wZZ12ZI`E_0 z`>}7sGg0)G$P5h{3$3pOqTV(x2^mmt9`CLZq!3{HB&ERN_gT1ER9-=l1SM`o-SEUP zk5jIKphpwhG&3pCKsHUToAz7`YJE&1{iQ zeEilECpMu&!U>PuK8gJk&;v7#c(lzkl952QROB{A8vMcWUt5r*0Osb&R5H)lywD)? zieS1Kiz(J>G*o&G52oDde89_OH4V;{%i7OPH!`)b#8WY*v<}tGiQF1&i;pg$|vqCcsS=`=@NS9pmk6!^3ZV1ZovY`1JMx?CU@! zIy&~v#6>*fsG0$l8Z~TCNJSmGJ8uG5^L=!+3>rN}3_z$Qk)>9isDG$m#PRPN3$YjX zHn&PG-0XB^e^cF7p}VAQ{&E*lm`7z*GA(0#L#K^ZY#Vk7Jxc6YD(vRKY$(>7tR)KA zeo`c}me|cMUiz;2nmtZ}(O$!(ds>DK=F3e2nBUbx4lFr^Kqz+k10@p30dLHNx7u@i z8J7cZh4wxt(!ox^g;T&JBAP3RB<66@5-7~eK&NT+y<6fEq|eCEYKVtQih_uhPB$wg-I+Ik1%3N2wn3b|ssnTYubl1kMz?+WGcr2x#8 zM@~IqBb;-sZ@CzOE|1F2w7Fdu;36j!^1e#%b%aJ=NHQ@PrUod zNaaj}RM9lE?}VLn@5&P)=j5{1e)i0f?S0I&j3jL7(hm_4aufmL5+1+32m42$lzF#a zh(y!TTon;}DTS`7ojlzx_e-!?d{Ux#+pg_0t$b)`NFg*A)SsAZw+mCIYu|Y5xkG`h z+?14!xj7?m-oGf+N~iYR)0~R+?7R7cPtl}M!nbbk1`PCw7K)T@va{m}>-bfOb)7(Z zEar)(W6-IyJmP1WIgotX_4p{<!GbBPkAjwYt}Joc}* z6T*L=4W31}LF;e-8G8oX6SEnsRxnEL`rcpc8O!9QP}9Xp3jkL(HeH-5Z<7Y+s_nDT zXcnBcSIq@w$o0m1rz+q5M%A|DbS$=Mpbr+fazApIEYV;vJ4RUl?9(^WC z1Kn7ULPIBLR{kA(0ow%_C<*u|A|58b^8ymJ*b5mfW9w4=)(3ionASwTe|w`1z|z`^ zc!Q%b!S32|HQ?RTq0)@pH-H_1Z>wKf!EOcGVb}wD2=CAi=L%{9)oBzs#^_Bz80et- zqXd0*gS2Y49){Uwt7X9&Js~|SGb^po**a=yx-eN*HgO@8rRE`H{o$fiLfTiHatS&9 zPK8n%Cn+T*HBs&_rN-YZDQP8)Ik}OB;*qYQ2OP*Gc;s3S9r7>WoZbnFPe%r+QyYZ3??b5 zavGZK;9RMtetBYQN=g#PCM`spn_*l@Lza}I*wHHB_eJ1$1Xcg8jejE0`w_v4tmH$x zUScPK7Ca%t13X+;bopIMQL@~nB2zUrLV-g|E!%vpC$tn)7H&wT>6&+kHeVf3C3Pf9 z0^8~?JapnB*H=^CvVK1wW-kU|>Z(}0YISk3x|$a}J65@up{O!{(2Dsh%_2RoJw3| zNjNGP#Pum(EGLm}-`sfN{H2T1;l|Q(d1@Yx4-L~WR4(Q_HL!A-l3ySw&erxH54P`Z zR>6B0Ynm2FA!WA|4_y)S#rLfjXvV>N*RmcHX6WwN#mE+Wu4xMalI?=BcT0K^wPFErW z+^_I=1#Tl#WOWsr=jXTW+-)zPs*|FML*!=5J2s(WXBawO=Q_ABvw5@LQcLD33eX&| z0gy~i1AW2>n$)WCL3_s0iwM%cHug$_3M(2{!CK2HUZt`~+Av#PIs^c_wn?v$z%{T9 zAw#ik^Mydug((Z&+@xK(wZU1vk&v-r#G3DH9aL2>b!h3819lAH+!>3jY`RQV-|Uhl zcmb5+mMd+Rg~{eZIy^Ndgyj$K|R z@?!rZTdl(Cww^8?ria_z*I6U>EL`=cSM49R{P4#sKOQ{Q%qtza*nwJs1AvM62v7hx z4LK}%7K?~yWZ@4W&!i(ZQrMdoehSZi^UJMQD}RPRgr=U*{1f&n{P(ayBPUB9TTB&^ zC-7tmj94-r#3-V+2**R7gB2a8dK49-2P;au9lVglKVhlZ(XP9AQdn1G%EOf-m+Dn~ zRqx3b&(Wo6t+=DJOY-u2hVh|(xq4_~YvsxNAxxxyfIb_bKCu6S|6xKt;A9|jY|N;{ zb1X^N2ITjHA7!xFjMVlc&7!s<>$uO^@OS(VS9XBwj57`$^M(1y&8lt93eF0OWSI|L z+QsmF@b2(^(RWAkG3+J8MhyE>!$kZKzdU(=)u;HHFTaQ0sCwYlFX6w>i{LIn<8Ex? zHY%Jjj(k`5S{632Z=XE0;0m1`F`%e(e+q?Pse!&rp?}6HYqD{%HJA46WHAnTnzB&<=y4TQ<0~_TmKR`9(gLDLB=#qw9pSnz+lI_Vj^i0Y#{U} z6z9$`ayH~z2+8;D3vq2tGUtq6sA%3^gW0VezT7i(|EN~ja-ugp;qf3(!K3KBz+$j< zIe@M~OZYK7u>;;S3C@^?&U_)XA7gsMT;$fuQRMwF0obz50~JtA!Z>i`+xTBWlv@S= z@J^xzZMFaxCL$Mi-{DBx2EaqcB{~*)B4sKaxJp&_nRLT*=xT_q5%T8+S2hmYlrymW{z;|tx<$wy`Z?`ceIEbV1Ws)a*~u5G284b zhF}rY)wGa7jd3_@+1PR%|L%_QcjEYEV@g3$+^}j;M-ScrY*<=2m%3R>bM#C0^7|*3 z&Yd(e);(t0qH=7rtsF3WcWe2=X+d}F2%LS={pAC5HVtcB8O-zJ{hMLe=kfNz*LD;a zw67aFWZCGf>@iEBGsFSSZp3V&joK;v3NQtI7d8AWY8-zxe&rk0-jdd}W7q5ry1k)2 zt46PBEsfW7*s51_bu6iI*s7OKoV=pS%Dy`Dh5hT=a%a9obocBb`qS57uJYa&rfvJ@ zLle4={k&zzPY2uD4*moU`Vanox+A*|e|!J(zZmx;zC1F&O;aOWTm}N`7dxrDD`dB% z`!LyWac9J8yaR&8O$&x37R}r{b?U*z0bkwpn;)NTYw+mOsuL&eS%waQzx{?Wqn8fx z+47o75;NIfbrl{*TAaa}kZn>%J@kanp$4zNPie$d-;zfA#o|8Rb0RC6|;<+H~i^ z5%-?kQb}K9E5*e$J+(UA&6KF60o=3(L$P8f>Vw5fxd?BgRu_elSc)A1xD?lb02)uj zRp3baKwToOhSL8t@+62@RZCuwTkciL?U_jl6-9+*)v1{+BS&R9lO1X-=Z|rh6=WE6 z$^HRJFiA3ZF@D$=iOqbK+#6KMq`D@Y#=ESSJpG(Tb zvZ#`{5`U%v+#3q+*&zRXx{--;FO2*ni~-<_a>geDTtv9u4@6@Mv*rFiVzWjqX~=1+ z4S2i*YKG-BENaONEtxlOU1;4kbC>mzNZ#ysaPF?oZR4|azT%XWVxKN+{IE<5r$u+s+f1R~&)qt-&VHl-x9c)ypSaOnJ|{D+bK10=AyWs&W^~*-ZGF}JmYh&= z>!QjXvu_&i)}}WNObK;N$m(2O?{sEW)YN$!=M716BYE+&>rp^ov%@{LoYQ>~=L*sHs&#!8nH?)`bp>?*0 zYJ+}r>YNvMTdEcf$^lTw8#22#-Vj(jH_0ETjx8LTlRdO3PNK2uL-Q)FN^iNpr|4=V zC;3tBN-0TiZ|W+s7z531ZKJ$f!YtCUDV;Os6x1#ljzGC~C>W#%gY4N=Pi58&_2kc; zGd**bN*7`HYZaR|EKbv9<`vqL2baXhmo%oTeTj)$l3H37Gd;dOkgpLIT@CmM^DTJ2 z9K0SS`o(ab5P^1xDB`$G_=yuSd`7J#Y(13g)U8}01@?XO;DnNJhJU znBfEx&fy9_$&bq_^{VHzmJH1?|6g2VQF&szRpu+`-rVOaqycS4!2r*tqKO@`xdRh< z{%R-K)6n0U{CuSs?Dh|y!N2;L$P zA<`9yE)pxk7K1PG zvDzP7Icxif;N4guoSKgb&}1w2QHAlP2Iboo=wy`FrNH@PF)z5$0ezqae(D8K zc|oGkuMg^%U110!BK)6NbA^ksa`)&H%dl$%>#Z=5=`v&4d-^wh!A0)>s)Rtc}o_34wnRN z3qrK^0~i#!3B~2d7Pk~uOlU0h>60p&(gsZ(k{74$Fs4>bTt6z%J}AqnLLZ=Y*foub z+)ZuwuW78Acgx;;>Q($#`61l-1qma5{E!A^x8D21~z+;qhQzjfeuy zDx`jv6Ec(2g2nL_p0r}4#6YAby_%JL;IGXvnUYG9ik2;&IWpH|fQ1`lTuKZc>x#y$ z+Hz}Md8opjT3+Kit4;7aIA@N-gjrsvkyC2bPOFaf#f%%=+-9<=Il0zkl1lX|a%}RR z<*o4rb!o=Hf_q;6Vrl)fM7KiADJ%wce#^|_&4hgR_}V(U6S?%3TelPl%M?l}tMK?M ziZhiyi3|xWs>ftCcMg157M7~Wg)rU(mO;HSnzHm0H-#}`rv5t_N3JT09e{Azj*I9; zm|xtv^y=Y>$wRaBR-;iR*Emhz<>yHB?wGiWfrFA=Ub{)hnM``A8c*Eh#2YJ$a|RbB z*_1IViOlSDDWqnTPVLTbo;_HZQBY{f8ds81nq+jQ=2>5ktMJ*A+)gbgS12U_A$oR_ zqp{AffWl%;#}%3L+eW{gh}?&dURZ<l4xU6OPi-wRZR$Z5(iBj zAU8=A7PH1|oV(bXJ}@J*zBI#Q)kyK0PmDyOw*n=n)_2TZQdY9_z>#~l&Kyv){Ltjd zr=GaC27N!3Mxt@qb_%aP+H}K|ay)u_^KIML`-_(?n3^opD$%Rg;>?edN!)sz85`|@ z-ug)w#thSqmK_IhMSX{*+6^m!1h7lky-t~8jG zoZK>KVabZ?1})s(GHga@+(4PlVOJ;(oJ^;YvvPwjY3```pUp@bQJb$&nDt8FTYA54 zD`fEi=xPOBQQnLC9A1GT%0u)@AUO(Eqjjf9x`A**D-l#cFlh0cEoQUT%CvT-mGjBl3$hD!;2{lPoBRm;S4N<5xyw(fJOF_LS z)*Oo`8W7p^I#cGz1$B46e_a_?5vuOn@#}Nf`HT*Y%7kV1ykY)hKiqKR4@W2Zr|qA& zeM3rdnNh8g5|zPMRz0fRQ|fYNJDjmvi@Ug}+^5hPQPv{Nb(eqPj)Uqhd=kFh*sFeF z0~RMVdROh>V*%?kw-DPp!#wvOLd86nbxN{Mg|VdtN55 z(_1Z4g;^Pw=QG`KZDC7EoC2@faID6WV9P4^Y3$iGW2RN;)3Y-54!ulnNvRo|z3{P> z0rv2d!harU@-!?N8&g#ii1Bw74x3RO`_iBDS8UojRA!ONEhddon|ke@N85h+HD}C< z#=^OUF@b@V_NLBabI1Lkt!X`c+v-+7CsWB(@>H+PY|IZ+JNDgPe#bX=42w<8&`A_3y+NuiFV7lzgs4t@MhadST|VW;rm`*D zwv-xER7#CXC1;hiesU0~?NX6N{^6=jP6}|~{4LpGU8J%M8zyKH+jim? zdjCqA>m*)P7v$dYl?+MEz$AyKq&X+KWyIiOZ`1a(tI8&h9+up6WNyd7l?_s3oUrfe zoRu4vIk+%3u5fS$-MwSUs-LoPRL_RHFYIc-QXWHBT1v^P*S4{>@uNl$bNw#oB$A%l zc(pQy?z2w}$M7ga3i_*BG9m%J8ekD4UUC-J1WQU*4Oww$T4wr$Jqw52RJml|%IDTr z)!y*Nb>4E{y`@VQT~ioSW=yNC-?4pjr7a~j%Q@fW7_{tQ7g|zPp4c(vLpGlTJ2%%$ zWv|w)=_r=)qfNtB-Z|7+T2f$vu!syi9fyC{_auU7#|mdrUYW9kEo10G12Fak1Sj3g}vzjxU z4eO`bhmRc|qpup#nmS=!vp1n~v_Gq<#4F*1n+jy_kUdA451B0q=*cUcK$vd0Eb;tqVslsEzZL z)F&hluSrj-pNxvOFMgCib5NE&zNkJac|=V{X2-7STaI-mRNnCEo~l)q()WrwUl2Zj zM)>ToaQVSe-jX5dDS^T)tF>TIsGRP5Hfo1!4KZ{ZPennt%~n!3rT~lLb0@t_+)t5_ zCrRe(Q!VK0UtS9-or9F|y(e&N&6MhOM75GInm<$m!P(n^8D>(g+7PappH)y)$OfWo$Q=ty(2q6fRz7 z7L9r5t8eI)S<$}Qz$?0;K!gEFEG;L5y>JBB78Z#wRfm-w8WB$TL>0l4LbXM!%C>#7 za|m86oVI{&2@v!gFWZZFX?s zG_>^&$wjfFPBRner#}o&qnDT?K?6=Ia{O>XjN6x9mZ+Dg^r{I;%g^Mb^`B~|9OG;*OQs+IJmzCx; z6}zi2C)0Is*&v6b)n={V{Q9+PPHh}y%p8KI7_$j=?Ge%!d*5dbd#B{cZ#XRVpnjtW zK}?ZKPPA%wb<;&Mf=eEFl-Foh!~R0b+FFDk);b3%BSeh=MOKABOM+0 zf4XY@7yH{L-2d6i^`Gx=>lnJ}nYr_xxqj%d8=juC=Mqp1}$p6v}?6)veQTi@I`KRcrqkDkt=FU}NH6Z-wBq8l)Z(7g(T|!6^9qX#a@_^h z34D#Z1`oVeEp9C=9JhSXfVshPWp_RbUw*$oIYFW>Xsb?6s%|SRXsu34u5Rs_kXju5 zDdO)m_TLW#Qy~3{3E*yHzgZ8l7Hji+Xk|p4RFL}6oyB5*nsvaE`YpOi4qH|n0Btu3+5w@xr9yxw(+u4R`HP|aRC##{oWX8xmZ1-t= z^=i^3^9IhwqZq+ubqy<9{dD=;*J;BlGZfmi!hwk^HuikU&NXM$`pc@^vPMN>ePvE% zlHPX}#jv{`c%M%pZ=)!EaqB&L*)qCv9xp)ipSB6NwF#9A$lbNV&16y=ImyoH*~ZS{ zM+!4*$-?d~QYxIH{w5YT^`6Dgp-p7`-xPp{6Ew_!g)s*hMco@TEUQ-7mNj?vje{RJ zls9HctvfKKAvvycVol|enIW&s12o!tjU)>{{!&uYbsdEd-&J?rysJDc|% zdTi2&t`}yEh#!GB7Dr5e;`kF?!vh6vOKYxXJi{`%u&)PUUw+yt6=%Z2#sdW8?=6o< zC=s8544WQuovW~AZl4JaD#`i13AsuFb!oju#0p8(p@RNKBwf*GGMAqIy~%KIB$p%_ z!$x!Qmx8t$Tr`UqO%0M8p12@^=cQ{z&q#emB;TQDr^|DrlZ8co$iZs8n*0CFHSo{Z ztvb}%d1z(*s?~T|CZ3l=q} zo?2Eubu)kLcYc6lQX#G5@B@{RZC}*xF&Hc>0!7*U|Yid*SE-#{BY1+)f|0U=VdE`E4tDYSNl2lH8@k^KwU4_^x69cC`|VZ;=t& z>qYFa!C#zcw@Y5TScnI8g~Fc8JMwzJ!}h;^ zhy9Pg{A?T4zU4i-KE6P-$$|0X z1JU2PL)#}$-rmxI{ow4ay&uA*!B! z7Jqv4AN+L4;CDZMe8Y?x4RiMGnrmVI;Q?!!+%Aq4s3n0_}ig9FJ1wKgD; zC~-GN$$$WZ8meHZG_WdMmC>Sl&O+|2*2q+zq>`snhR~_VsjThU_&i2`CNCE^sJ!tg zJJ6&C@fx9(Ms5DM@I*;|xqsP=?$Z z>t+T9;vE*Nr7ncW)vX$)E~If-TrNX%(51IA77M3r4sx!r4pxS>kRAm8;uvAwOB4ZJ zxc(6tTNbA}Fcn83p@lnf%Z|9gv7TD@^a&eoSpRBU8^7%92M)9EzhyLZ*zEToVP_vZ zaQ6A0(~|Fd+TMEq6?(o3!7CXKe#JA_1S&jshdmThIN}(_5^u$6triETcj_U1z1!)6 zt)Ql0ZV$%WJT_RChw*4!oZTqZv;~vTSV|1bN_yI0eQIR>_lNAcegN+ zJx#9p_N6yIjPp&-N<4n|z9$T9L-!_0WoxT&3!Of+310r7Boz}{D*}O3g+1P07fOnc zgYBnVt>$?A(kJM-`j9@|mXMgxERqMaV>GFWDJh9M5A4okRcfTLMUg;|1P?)V1(b+# z3DfA05=n_Sz#0sG{Yir#($k-$s%!l(bkYKdSPe25fMgBy)hhOme-Vf9x9*k4Y6m^C z_SN&kpO=#7dZtx3mkz88e0AbP8|No`b^m_jwXb}>j+C?~?>TbT&NlS4O>a*e9Z&S^ z!!1PV7T%}S&%68`_gC1lj~N@t@;Qjjrgb>XTC*$^GP||zcxQZj(8jk1nHV2hXf~VD z$!nAbWqZ&-eW6GzXf)bN{OR;F(C80aJJm@_BPbJ>K!qzgw62BhBcUKap{Rfq5F{z| zPbHk$QSJEP*Uz6D`=_yEpB?+X@Dpa|gfepLmV29OpPnwf$t8@E$d2#5^P#em={Z>+ zzWmZhEKkavBquw4VqPI$Fk^gzm)pWSeoskVl#*sp0?GAKqNkKJ2Mts$|9_)|Jq1cW z`uCU5Q%as3`=js!arOw6WILtg@oB>AWNAn$d-C3WCp>u_sj*+Y_WI|bWU!r-W~X=L z75)UzUyEtva>;JS2#+u*5Rc2dZoSE<)sj$1YjC^u?Lnu}?N%8%xr$eH1obV5>-ziR>>b=!fa3d?I_)Phm6 z`_dhIkHR;Y&2yK`ZseZmZeb5POz}F6BgSv+@zcD_E5xzC@Ep$TqUVM0a_La&7X6pr z<VN+>alKg3p|64)A858J>)|tv;X5%Bgj7T}LoU4o<@@Q3Iz+4;W5A ziLvY7AW(ZhtN`vy^j{GqKvz1Da6S`P{@#24O#YC0!|ja!1@r+V@8^lGzW19NG>NJKrgc}kq8+M zkbMynp@W7Eyza(+D&&(x!sre*gZn}lKU~0*YBb)hy!-?E4}K6j8D)W3uS#XB52=hU zsjEIDwMn&ZH`g3=TeW83Ehf7U4u;*k{v?gZ`jfdiMPl^@70!f6tp%PArC(Y)6Ez}v zW#IbJbJkA~&MZ2)bshhgiAA51v({~)3xhXMm(#VF{d#<0d=oY=cEq!X!w1pG4 zPG5Nk)nnWomUkfx3sO-Yeh zrJMum&Q$vSB7`xPP~kzC5obZU1MS5>05U$#%lU|(&E$lUQczK*6dri7D{ zsnfuB^?l5rnRB3L`+-?(?07OyDpg8&1vu|&>g;6A-LnLK-$gxFm&MIN4_E;RQ{>Hje}F&%keH#~k0 zcv8!(2~;Txn1b4Zx=>qWhq^lx z6RS0u`r_)iYQ%;(T(gJLh&%}+Jp?tVf0#=&meJ@&^<7jc1aEMSx&VBE3LIUpqC`DJ zOxHeAtc7?DMp4@j|3*`A`VG-Pmq;T0jlzP&z7M%B->ME$_Mf5KhYr1C=z;s&`21&P zExFsx6+bn5(<2W*fWqt3tvApe@)l!=X$0JU*Egx+Rok2kuMX9blGHZ zWy75E+?Su~nS5r>;+czQFT890#{Dt)`t@@Pi(YzqeyU^M)baDr@9#>r&6(LT@BDu1 zIm#|ykbeLyUiDU+mA^SiN^K^Us?@17>61(O(&nI-x5CJ% z)!lu}{v@V-p3| zA4==>A-}mwU1wkHzR)L9yy7*#dwcAlp>uQKxj+DMHWy4b{|YZvn!?qOgo$nQ-|~y@;>p zNK`)X_0$l_(HIqv;Xv}_^q#jHsi@eW`gw85?Uz>8R>coY=GRi!EmX0NEBtj>I$lVJ zdY5s5-1s!C0}3U^8I7{KkkP1*(diBHxFn?brntCF&ISnqoLO|bc+C1hTKXtV?+xq_ z3w6o(1(8tMgtIABU?L9K506_ECMe>Hdwp;}QM^)lqIJ(lI(Oh{uJ z&kN@BVi4Al9mFzSxbU^`Yxg&ZxW~z%<6`(FpM|BkRyfAa?AZZNnaRH0liA81Lx>eD z(pnI0&z`xswcDA%K6;+Qyjj8mU3Pluhw=;GZesuWZ! z>^@edlIYE5ElN{*Nfr#t%7}F6HugAXbE0AAK7b9 zev_XAvgS;vvp~ej9^}r{rC=SAoX>men(c?+T+etdt|155Av$M)^S zr`a!jE&TJ^&fA|AW%u+`_w5UZL>IYMSk=<=9-AiIq6vB~Y`?K%-p7X#6<}3@Ta;xy zHgPlr60=enx!cDXY&Pu5k2hv{JA!VxGmT_rIf;eVKV15-iHT)G8VUPiA$5(wStY<( zqP7{ z0l#FfSY5s>AK}jn344*&sd5kiZ7LP7Gtqcx((^^YREU3J6c80M{j8GOspu^uBBq#% zN;vTkBcO$&Oo66{(UZ8%A52Q>7yjhD|4E2B68<3NyN(jxuF(>{OVE_xFv*l+F=v=7 zI}+QTeOCDC@x|A6o|(C<*H!_7UVKu>8u8bc0aUo1N#kHU_9Q`(4 zzQAt=9j}$${;2(_~5yC0i z*@*Z>(9$sKfi6cOPcnmWFP4l^7Tvh#d!oqs?C>C|nZ=f1G?D7T94>|Upd@wz^MJdtO)02;k zo*YuM(vzd0+Us5ahm&Jo1CWHCJdY94NwTru$w$n)u>_BW5!cS%T@2NQMkNTzL`$0?lU#066kJRL^i%j9wQ; zP6OrQ6F2wVWsvcm+qZY#doQonvNdaaHnT@f+MZl~=h!1h#tIWGT6S$u19C!)CUNso zqct-vfee)l)j{MGj7FPA{*L`f%}xA|8(9 z&sQ80FDQ$rqnRmn41l^m!-0((+sFvvC{Ny6EX1&y>jW#$zu9v7bW6_=a$eB){6sDa z=mMak-OItMK!SqNDD@^@ZBWbckSWJ#krtw4%Wx`%)gVE!M~6xcPUW{Dp{Gm|K^kQn z^-OR~G}RF~WHMoYkdMd;ibNKk=!`PyAKlNBIh%zK9$R*q0S6I8+QOU?{zWWn-vioi ze0AMM;-##l=R45LJ)Dm&$?Im z;uPmv$ zoid0eA4F`Ck76M=D#|`ZyPAzx=-XASyi)Q0h@E}9=wfCBN)!r7j5DS##A=*cvkkYr zWOxEWrqjtRPM$HU)ka3A(AX^!mC0$5gLs5uOiZhE9Ft9pSP``h^BO?P07i>NET|_{ z2eG~b4FRUQLP4+Oz9F{1ruLUXe|^0|4*Z)q4D^;mvIhIk54d>LH+f#lNfn`x6gDrB z@t^92xYL9A_(g#_#In3VRYl?5S*y>zRR{54|JXB|o4# zlo&AcfSEi?z$ykmmS-glOCgE)Lq#`Df1uAG{ zL^T8at($2JWV?-eV{3@$9d}LA@?CQ{VTbUl@V2mnEG8Ai*u575 zB}7Z|gm-WsLHO+^{`A1v^?|~%#;kG)+uX5#)uz|f$ti#>6Uc5dfQ%t`UHVnHolL<0 zmquC-32z*GncX$Lb!JCZowUsb!M~lxNf$TiAb+ zq@~4GTb3?-LH-#UTM2)E{gPz*thEh|dv9YkwSZQ`^Nb1Q@WWd9ylXMC`CW%WzzQIAp5dvuf6~RIxh2hehNF*XV zk@CKvS5(#>;>V^!Y;Ca1U@H)HMOMrmuMO8Tj6D0zY5$% z;h9UR{XR!Uj%%LvRqi|vKwK?S8=00 z!i{>$4bcIt^oKj_}|_G3@JDt@$LH%a<|FvNZR z4NG^U%J!r1{*K4~MQd#TeCMs7e|q=hZ-4$PMd}WSo^IkZGBL32EHjZv(Ud|-K+4JO zc3o@8F6ZS6q!xI40aFzUv%)M@sZ6N2a#BQ@upg$QC{*fE6daZ}z9{-(u>~7$dC&&3 zm!=vF@>fcw-b9nwgt$a2ld`OZ*yyNv(UKK8LOi$~H zL!=rfjuldQS`Bajx5FA^%u-AQ)P*>Q)nO$b4@}cTY`B+&%%5c)u|}z0sgI@RsPr`l zm3pANes$s!JHYXOJ2wt)qbCMv4;MuB$UXq}K#Rp^q6t6V;1i9K206au%+eP>?mly2 z7EhXlV{L6O-F5d%kL-Hv#UEPu-EYrdD*XJlAP6Vl6ppog$8EavuSEONb6@?u7Zl|I zJ%1$TA0BFVF*rPi8CX^w7iVb=#i`K?S2Mhh?+C`|Fz2FU4PxP&W3LcEZ!@Kz;feeY z!wTv<%r>9c3;LZ9SXbxV;gihm*6r)A5#=EK7?nfM3vA`+QAPQMHM2Hxoh2|c~S zz}Y2`#y60L3$+=z24#VD$)ILSnER$ml4iTYvgP;nO=rD2AQ5j zM1ioK-6sWco+;uMqxzHBPX>&SHqU(Vebmqw!NPJNGurrySC_r`vGChZ!h3CIA$Gj! zkzGqj&goYl+4bm4A@07nmt7Fbd=qTOQIVp(Hzvp#i3jlr?=~ptt`S=B0y>^Ohz;kT1mlZ7kbbDCVxO1?XUpDg0%2Hmk4ci zLtB3{q9O#TQK_-t&p&eexOR7mqp;}4o98T9+{S0Tw-Q49Il#+x48BMg6fBg8p%JryT<2tq2G`}eOSa-4iwBH0f)IxvUYg?b@6i6)1UP6aY!$ww zo;(Cg91lyhgXZyp9F_%S2P{!p?PlcPXi6H8kLjcaxmHUJQI8$rC>5AFj)|9BMG>Fr z%g3U0qvIYfhGL#C3fLfG3=zNxrQUc}3|}@BHpB)z7dAuc8Vd`!<-#%2#9t#^e*Qb6 ze*N4;9*IEPu|0Rc{imIeJS(Jr*Fr|UOJe>Gw3hPReV3-Re8*SZ_R7CLe)GGJ_kf0HtFx#8Iioa1n$i(W zNWevXh>%w1#c|1~5c@+f8x37_WP&QL@AonUD5XYPAeP5uOysVMe`_Pl|#l|?AgE29B9j^nQ zP(W4dr7&}8Z?!bcA88n2~{pj%;)a z>jJxJCK-Q)Dm=Gw?2ZNGo);!A6~5?Gieco$<9#~Oz3d-{9<8Y#!L_if=Ztx6r?6Wn zCN1o@y;_3ZeZVhoOCCkfxH{m4`^H3)vK2~iG4O^~B*3}3NaccW*9!;Q#$&`&g0H0c=|Nqgiqfkf8W3k zcO;#=@8*XdxZ}jvUp)Dc@N-5Fttw!u7!x86oT)0{QK;37UZs@kF(;yD5Dgi%LW3lp zQ*ow9Q;CTru8|{&$2yfKcK3T*N%USbxE@wVBtQv?f7-C~$y2+@q-DZQ$KKsAb;cSO zdw$#gd)KdcCPkP>?sLWLpEqH_;%PWfEqK%|c^LW2m_R0P2q759#fC!GI3B+kr$veA zZ2`D*5DPBy5|rtiFNfpGb|MXa{x=a8_Q zpz}eP65$~C5;*Cm*i?%F7~En;6@`&&@k=RjyUj|8*-nVkZpV8;O(j4GX!nIE$rd$_k{ZsYCJJD8DbywypV?5lHXh|;x_YdU2zsx%1TkD zpod`@6PgMv;F$junt zJ!RKiQ<}+=W~rJSQzN`==Xh496%LOOM$aL2lmO1CB@^?=AeDjVd8L_DNN)da=cbL} z)=bMceAkHaUj-ZPtX`S zsT3Y6#h!qHBAZ92u~~RPEdGxu3)jBGbfF1Ht2afo0q%q4({U&hr3!5W`g?wnNzx#! z$=o?JBOx)nVn*zcPb8dNqEucSExbPYMW?u$Ir{bqc=yNJu}e$!dzEaSvFc{^s2nW*6NQK1Cm^)epL zndsDoLQaob?QRdM;uQc)j2gRe)SMdY5bP-_TzfEuH`?2SMsvRk7LBoVXuU5(q#+nm z6(cVu`b0krq0*TJaZcB3iH==IXE5Ph=+t$1ZXfwFJK7WU&tH0A19?lh>sw+FzWL>? z2SUeYzw-5$r#6!=;q!@Ki~)(Yj&&;+q^o+`BKG`F`NkoWzrR?|i^O&ON{P z&PP>hDz{8b?taYwh_2&;Ksj)rM-}hEuOyd6nk2^N4NEXe z^x!{8S|BWxmBrlOgc*S;fmDk|A?7+#R>i7#hXY+k2T$XI2BWANKA`3$ z$afSH$%)I)2h=Kky+vY?u(EI(D!PmGa1KfbQpGH;42tHPk98R@^-N{K^gU@=&%g$zAfqSeD#D=VRxVtj~XI8n41ogAau z+k1Rd`0Qev?24Me@9P0#=Pc*Fr7wRd)&%Fn;>A!r#9VO9DOf`xgYRl1ytL z+oI`TmI+HnE=onipmt1e5GevgAxH6*m(#M$DYQ+(gTWCzM-A?eq(R$}*w!4Wa$F^i zd+(+4xKbLE#_rrXmOt|26~eem8eM_>{?!;-p|SUsWbCmt8Caw=P3PK~F1s ziZC4QD+(Y)`y+$>qCBFN88iwD>8RTOT$#x~i)=DnnSna>N#gq!>H405vsU+(W{$V~ z?FvcIyE>`dencw`lNvCo)M_0MhY<=9Y)etG9D$poE#OEa(?AE_q2uWA(hg>LhJd)b zx_AjDCgkLwGkTT^sj_*O#%Xo2dIMj7aVqsc2M{YChbk(WFLLJ z-Fny9<997ulaV zDiQ#vEE3QhOmaDl%|XYN&6EBF0A`63X8`>G*1dy`(EeyG;%XXbJvKSjGs1KH(uoh^ zv$j3IW#yo2E6cAR{J>K?=H7h2@Y?(FLw&*~rSg*p?!A5Fu}zCNrTW@D36Jib{jyi4 ze)X=?!cTwz)S@8?I?F*bH`MqNbPhyP3`OIYDK=Ia3dNeVa8O8FS=K5uSm|J^%!3Z_ zmEwpZ@IG4(V{j-PQu1(&pq%&7amO%>C@@8dvslP(;Y$*?a>dd$`!;t8x6!L%*ROb` zeR^}`c5W}&g?H(V1t^98F3jTk}@4o+j#p-2C z?%6h8xV5gaX(-|UG+}=2u;wQ2Ldy-?cWzm_WMg+p&t>0)9C8Pr85%xp!lap-s3u`M z5O=3oO{m3$f35l>D-(IbVJIzS zje8EAiFdcfy8iXjyMz}G2!9e*2(2dLq!>GyjS^1+NyO=^g<;$+$b%9w2NXGdefaeC z^z`Vdi>F5l7-2GY#MsC+q>IFpbe!J9ZX&-)=-Wco0iRvs)$D|em?%EPRuoTgb@FY9SOe2SK7;8!AONc1uNp;8z<(w!5_3d?4$Tsd{| z%DcD44tBcgJhSIFkEtIqYH$pm-h0opan`J@PaQjRUZZT#nx1)l`}U6EBPU?|9+n!q zTrC+4J$J%u&JL8OC={4(uqmW6hA3oMrlR0bT8OU?8F-}@>q;1{oiRhr&3Y|3ueGu< ziWta4VUeL49EB9Lmm4mu&_-VbSwyQU)R#wEpne(RvCLN#8QjOEdD;!cpJP*km|jQ5 z4EdKvPrLoa;OO8JeE!L$&-|V6Z+(sO+Pcpkzisc^Pv82`^Cb6^mS>)Ms%s80{qi5; ze}=vJ;#Ago)2sjf;N7o3yc04xaJibL^F$h^G7zUy)A*#8Vw?bXd>M%Z-=M~j0t0Z1 z3)|Tunm`4R=BeSTP$Y$>rBCs6MbVQVXj?ZeayH5L7pHzgk0Hjm%hfX47f)m61u9}4 zF%EQ14fJA!A{DbZ;H@#tTqDoNpxy7monl|ChhY>+9=%g%jIpq(ic~lgiGs=Yqbw^9 zxQnrumLllqQ1VDlA>M$(&^!4ZTl=<*!##%YrJ}bJ>A!gl2EX*DC}WqdTYS7t=w5jr zu6Ip;bIx8@`r|W5^SUr&*{RRpb#_nB1MD0!`mOtVj`Pf+m#&>UeT~r3gRYv$T}e8q zbuq1h9JAh_2c6C^oe>@44ZIm!eq=TqtkTg7sz{WHN zk`zijSB4CmC^@~uBzAQ4j6r8&^%j*<9$+!Aho%Q@`ZB=!XK4MR@)Q&U9H;X;5QHcK z@r201EttFaVZkZg?k@Jyidf6YEK8CxyR36$+vqtMWQkqe#NWD(mCGi2h;V^OQ_epx zxOwKQuH^=5lh9Vai>Fg5Ni;|EsnKp{oGy!1kBcEbm(}X>aWaP+{c;Rf=-d)F?qXTo z7B?f8$Kf^>_6^uf49aaW2u3IYiRuG&jzE188H@c4N>Tq(WOSroGb$<}QC<-n!KF0u z9i1z0`t}DD{h~1Yvry7^*_XVsV)c?``?im7@0{1rh){g^cQ<_znl~<8d3|>a&$Nwd z96xm$VlsRAJo3*<#AG^efC|44*Z4DAL&+NSW)e6~rcZXsl4Z#@m&=5kKWN0;1Got7 z=Iu%w21{&4Wm-p2*)LApN}!BqX`u*mCE|Vr#0*T4(Ogu23Xrd;&{&k*w*@r3Tw3Y_ zauUUd4vtI~srZYLWY)5Sg$Xx|**JCb{EVdQ*8S~eVKjMY*U<@6vlfR&lk6DxfP#u4 zBcFPil&|$&yJN`A>$c1te!OGlh1Ex13~s-6`csppe0uB6oNmb0z~He>bwwK>-$G22 z96~-p=kf~!7-F_qB&{Kf3bVb8N)G%jH_;VX=(nRX7kYi{~t1ueT-7+GKshkR!gaV^>Gz3Q`7Q|o?xw8Q`CDxrH*D@pB zejEFOf8g5VWU;Vm;zT}a|IG3{Nw)Vt-*kV6Mw@KjXY`o)?t+K(-PTo-$?f(2`&(gt3(fStTC^4?V3{sVoMl0y z9H`nM+So8HfLt=s%(<}4)8)dLpo^p!QbHj^qKq}0(^+jg9n0dyY=hRHBU%(38M1_m3OwvOpM`{%W1&VBmALBh8=2W5=id8y?1 zJ#|Z_;_+#PRyO8?-Mfxb8c|Enf}CBLKtpen;bbwPPzq<0rE@Z@I!;eVqn=IIx^Y3> zCQC_S3S`$E3W8A z#T)<(cP8Nd!<`tinXTyV{$Nj;f583giQ@bRgg^HQXkGDU#hh}`D%ZdA)>{t+gN@BM zjmaLBoVDb|IcL85_{D>QFkYmVKXrUx-QpSPc@~9C3u0dy+PHd3W`WJ19rga<`$bgP3Dak3;3#w>&ZhUFMjKq20%V;S-G z9R4plcaJe`rVUfr)K1|kB&(r8ap*d@?Pd!UMuR$zMkBMx>`JFo-w|~3RxFU_lxP~C zx!OI_jVly+mLINWWaA1sxX|QL*i{y_#URGkxHJfwoGbanTye#x|c1m}V>`#8Y zGOwl5 z+$MLbFn>qy2-pNfAE!x)ueOsAA-weaU! zy+SAZZ+}nNiTC|&>?Z0yfqeU1XLo(nZxTA!%HImzi=nsd9U6_1jgc8;tsx_;#*h`Z z@R+z5CMKea5%&?!GANu7FJIGOoM`dJV>Fdc@los~#$;6fuxsuZcV5_czi{CIDZhMj z&(UY-*vGE5MqQCfctNt8v>p-OI4b-o92nYBPi`V*M@eOeM&$!SMS&63qP6e<7N#WN zG#k`v>}xfkfsD04xUK*`a25s;7+_X(Y~p`uNTVk^C04np$>3zT>W^3}f;tACy2uye zl7)94{`~brcg&l&=Zw&O!{lzBX%Q|z@$xStI%-MWCr8eei1q@HOLr70m>g_5z(^p= z(6M+%f?EmMl6Gtam*6r!LnqMuCE4OaB6|5zG(12_OfunLzPWoU-8#fR%zj6g4PBfJ zJy8mJE&)bKQQwq65hFLt>p}@$v)Rcz)9OM_bm=qgxO*wHdz0gETb_%<#E~5{()Kue zoDvu(x-vyfsL?}0!5CFNNQkDvBHTZg`VP|<*~Wu6vpQ|$B+Q_~k@bo&LJ zcDzD)XfJozY*{mT-29wk@%q^^6`RKt1bZ zoS3H88)a4_F=7!IV^k3&DWb2YTfX#>%nG~>Pt(Sn31{7OL4rRSCQg$ST58jTmX4bZkU+42U)Irs?|pBIwI8h)d}lCN=_E{zxMZZkg` z9>_{}QW4CE5rRXri6XYgU4|)&4JVyq9&~&otl;|IbmgT}$%El5%ow!L%CTA>oJcskut< zk)Aq5tBsMVbuj?WBnEe4AZZNVz_84Cb&XywmMO$`a4&kMhow%lPmjd|Ba0C)!1(Eu zf7prA9hS6yEm}64>{E_35&Js}XU|@D|No=yI{?}`l7`?KvYTe z-ob#V223+xY}|3fy~Zte9NS5p#7=RVQ|&l$s?&RNm+L8)%O$y#yUXQLZ1nhNR}x^y z&RuffABWNE>Aih3yR);ivoo{54@K?FP25+G;}QPG6swv}eg}nF`tv`yzy7I@@gR@- z0JkrKm52n|S4|B&Gmt7AocKe-`Qd!7KuQI0L2cwpWsx#4g$l6yFBrmwC{(~-Q`0`@z>aSHD#0MS^x#2t#A=fGDG%*9}` z_wGuhfbQv$M&e_)>_vC5SAKW!SH=bHYzWGI`_H}X)?K?UGXK8z2D9qq@)PF~_u*^q ze4WK&UUQ+RHobNCeqD<~njZ5lN_p%S=AOisME3>eede1=`gd!0zI$YI%c{qjw<0ZM z^?-mKaqMFR=+^Ddlt{KvB!um)U^wK%pM$-<{X!yO1rrsC*f92j1!3Xrh@c=iXTV<^ z!J$J%VSM7kLW1RHH3ZH_L^>TBh43&Y-v&2$0{g_;a1Qut@IY+wP&ll~_2~3;aNkl| z%S5A(cQ83mb)QC(bv3kiKq*QX5gq`p9sVH@rpw{8!IlCM;$e|~99}4h78Y1+ ztt1}HLkJjkaG%bQGEE7ZMm~kmgrfnq9EbyCO)yK)>P^huhoOVK5rGxxb@$q)dN$45 z#;ix}Da>yWcr7Nfw|asDE04V=Zvw>OJaCFL3Oyl&6*tZgl@`ec11U_rVPTZkKgcgg z8wAT6u9ouSa-t$>FwUVsojxQ~$fW`T{AK=>3cIl2N!bCD2Oxe)cg!S;!FKfNF2VRC z>;Z)tP>ndyA>h~^F3{r1WO{<(WUVSkpQ01pt5y{>OM|-X!NVY_XO>je3EvBft8eAYjNLCC;W;zfij_s=)tq^ zoO>|wnuG7aIaAO>c&v0l56NI3#zc)e?Rq&R9E2VcsH3AP$g|}a#0ye``6^aTg~}xo zh==0yV*NFGS}TLiT?y=VOC+rD=r9~LgZl~3o*?kC1_M?qyjH`)gU}Ee`mVP!{ z#}AMK=11&TOtx3C5mKo3879Tpq>`eCGfT7}I?!o!%{4C=j%=ps2XAVq`Ss|Nnai3U z=>Ogs?o>tKC_u2Z0u3Ai1(JXVQ{NU^}kXhbsZM@}#n;RTn^_+54dq?;8kFH;{ zX7~07zt^MNm?sYm{p0!4lch&)xbvQl+FquVZeKcdXyn$HO#SJ*mmR)Ia&5^*AUZ2(w8;-(+ zA^f1|XcbP&$%EAw?~>^VNFl=kgaGWH1npiJC=7%HR0NQ~6=KG5#H|&^M`$Fb!Q)7UISF@^Prn3yf>k~&G(h*oiu+7( z3&=C}Dad%LsOc8Xg_xF2WDNo-PaO^3NS5iY7mxvP- zB#08TVee+jC3GTzI0P2X&hTbR91595S%DD8LInxj5dpBV0KYtf_bs{fML_#?oRki- z)=iIXjI>qqI#CITF6UX6U~4suYMc~6=}im(HV#Y;2P|#shH`XmSwlk^GgRI{r!Yh8 zsUz@Tq5Ds$kGY;!FI~D6&l*m8E9(#J*THfS2ie0nJN*R${|H)b4NwQ1LDVBIwOSS* z?+?WXUGXvld_L@wS#%2B8ALzOY=wJhXGn9Xgr%@L{ep`j)gD)I2C*Itj+4Z}Zx1#L zCCs#jheeeMZ;Q-IC^fq`pr-^xQ>BOpCbl-r(o$z-A+v^gT}JTg)Z_KXLx-2h>6qc- zp2f^!x}(0atEInSfrKSnTD5fVwJVytdz)PI`&;O8ZbeQ(TM+y8yaH$OuJww+;qr24 zZmy%?risnR+!t01kB+V!?p}o=YC4)5VNC4?E%)!Rl2%YfPAwl|nE8B#NCCo2fs+7) ziXx;`5JwK%MUnCdQMkYl4D*hpByYG25Og`y;SM7kB{-cD7*{|Fz^5+(6Al3p>~1A{ zhlo9X2N)mbzYcqci4P1gr`VMH5Z*SVo7{VulW*KXS5A^`!=W|k7+~6kyAwDO$D+fL za4bI%uh<~Q1#=kqkbqqb+`HfwGHc+TAVY!dSK$CU zy66%-*G@qFw?O^=uxL+qN(Fv?e8{8Ag6WDyL7+863HXI^A&v<`-!FNE_cb6vAQBba zGcbp;z*7u|^w0}GXD6s7x`?e> z*pP+ISNLv7+{oVocUvi=GeTpQz=5EKV2#AgVN7xDNtT8s6i^$wP-(HfhH8i#*q2f!t zm_u=f0n|L7X{}|R_IW$A(?i8^NzzcDGW6mLr$2am(RvhyOtT%DW1V8~i-hclY@65N z88V@dO?}I4fG7(c1+ML&ojy+A0z~uZ4A!UaM=9O|bVwxSNWr<(#~@l<_2WDFyIIe> z&rp63vS@7--0HiR-+1}GQ2Rev%iND59)B0-OL!*u5jIN~<#_`YrM`+k-#gO>um8!a477=SiUO>q{t{uG8YX(?sq(OzG&f zE8fYH`tHPS!T&Ly{A*apyltV!w-QV{$-TJN^x3t}x;JO~-Z28F%ZWimHB}w!jBcLrqm#-X6@(@gWqhm0CWO{UWa!^ zHCAO38#1_s^0-R9!j=l+S}i~dL8v%FX%()4!`<3D!L1?Pq|#Dn8~}CM_+%{b>cRZMt5D5vOjj;$h>&l2{zuy zCOL4hCJ_L8_hxF2GeHjvX}z9`i2j5!F5$zbP;GIulw#dkDEK@tHtDg`uB#3EK^ zOcE>y$SMFP(FAW8Ea=QL8V`21nIVZ4?mI_Mtp-nOLLY1T&>6uQ)HhAl-&ZWSe>}&z z^3>?~haLiV4`0`AjE9rwdpU=vDdRXEvku-my5NolX^(q|oHUr4x3#rxYKV2)V3%g5 zrwnlVMLE?>ZFiQb>RVjprZj1q%T*C8Er5tTm9(Hhs$#LTv!MgC*%8oz<;}9@j%J&z ztV&xO^KN*srWgC0+VHXprp(E8Xe*NO$(pmtJCC z#@0?0bn?!dZ~6ZGO`O5v=U!l*Wo~`@9WZpBegq{V?a4bU0Eb~_o!3U|a7G3|96rRB zk+{2nAU>F8`D`)lQ=CEahngi(FuWajeePR(VZDOc4n5cv( zRxrz41_|xWp=O1dC1aW6u{@xHLW2}R@Y{bB4A?&&AFn|^eP4XaAh9`mmV88p{2Yma zhXn*Y!r|lUaNAYn$cFWA?yIWU^XA4)UOBR9!y}85Eu*Kmj&3NOUlK3o^Tcr_^Gi34 z7PhBHMW%NYf=O$Ze3_fG{``hDFKjRA@(R&6ipEd0wcWfdf37yGth_KXs;HtoOFQ%g z9R8b}+)-?F{~OOlm&%w(S#9nGzs<89-zaV)MRmq{jYBO)B^ z`}B-2-#724kF#Or?GaO0niG4l$2uk42CEQqY&;z8XN96yh-qiK z^1l~tn>N0=r=n`#o9j1p&2+g}v^lQQW$jcwS$VCygb4(_Qg#w)DDj6b)Aei(KdjPNXRg%RVU0O1@sSgMG) zko^V@iv`O*-igIQm5@ag!BL3TxahWhZ|^_({)Xgw$BoQ4uO58&;9O;9UPv(g+NTX? zPdEIPmTFtA72PtSToe$MF}Db$(xLV(b7F%eTCs7WEnzVJ;@?px^A!qXjsYf9XBmIG z3@{PFJ`@FqFTgRiUZ-gfHZ1SUC*rCX6;!G;8dXJleVR1f`?iOfgKZmYbx~q*lq91q z7mZ$QxV-j$s9gptIym18CdzO^7%Wg`UW3=g)31rLH90K0!Yp$jJ8IOm0Kc%aueZLz z^F9=qSQsDCDO4szrxoFsHg=;sXT6fNEH4e-XoejeOiu)UBdmzL2QGT8ShHH3og(ly zFt=vG@|eywa<-yn-@AvWTefDp*_WJJ*N`M~Z<(gOvAeOeFi(@J4V!7+ndbKsYi$)t zmoy0*dS1v*W!Hkhz}Jv}#d6c0)KRbj$#;pO6SGp-?rj6CBLf2icoxGL zZvc!PR32#MWf)^F5990U%M|c1__^4#`O#UT07GS-ir>62C+hl-t}C^T+%}7n?#EEz z$tzIuS3;_0YC(LgA!_q9fJvw#%$il@doFUmuCJvtYcz05vMwL1G$f1cP3$yGS zw`_9C^Kvr9bk@koCmxJ9`iBMa!xdU(1abvc4=n0*Bt}H(9Cc02I*y-KE5*$}dFuc> z%G2%y!+QY349ZUB;`PxqhPeF+UxSGFx!9@-)f;z-s+Uz6Sh1a>8?L*r2P1CiJGp=T z+6`s@5pj+z>d^7dq|P195hZo?1tuUNHn+Zcj_SuGfOE#w*PPR^%cg?7MX5jsj7Q($ z$DWf;*?PU41^#h10rE{fnBj3-V@w+?R{A(J^R{gmQ`pWi6n$@_p`tdf+A8Q zIhG5(5sB3qWs53e^EN!Sns(y`XHT64YzG0`Xt0l3sN~DBReE^h>d1})vPT}8Ms~6X z+VvBE`6XDM+@F3mETJVMvc9?8};U-o7?xeUhlNFhgyL2?o5y>5{AAjd_4u19&HR zKXwf!N=!%%om-@2eR(^AnE zpSvz65YB<6H^P9Z7`PBNKyk4YqJIN4$9UyrHkAV|!+09KgvM!!N!zqnr4fhip#?sg zEXKr)RnKn!6%3QjQoB7}j3TZ^QrpN#rw{+Uj2*evYnl^)@1Wc0&o4)Q)im-R>{(TS zy>VKKmIC(JdvykTE}X>cQ4)w!;*tDt{K+gbQd4Jl6(M6;Qf)?zr*nXitlThNYGsC^ z^ZK0h`^F9fN%xn`i$K9M1Qk@x^bnBK5s_I~Z6Y0#m$9>;a9JFf@KI-^Bq|CBW7A*w z$jaNCDO*6_I8Bs?3*QEs9AHDMqZ+{i*8$StQiA9t4@IE$%u*yh=XQG)O%JPHok~nG z`^{MtN;As3a)yCIMf;+S1@BICqDMa>OnY*yARM8=W#}_PxIJ09a?5POF>9iQ(^MBM zj|0Kn86gQ4h45zhaYlopp;3T)6L%YY&5^q~>yqXGOVeSulKl5 z^fHV?1wNOHw1FIkC#c#U{mP@g_!KKb_A%pNvSV>maza&qdevB5oGO3!`$yg1galUx z1SXB#wQ}O&C7HCrQEk-aC&#GlbF3rplhMb3nk5m2n=0o!vsZLxb=B5AH+ReVb#`>d zv9q#lb!z9XmN;YE!RPC*9d_uP4d#ThR2h-*Kfnyc@s2gltg-e>MjEE%=Z`Y(&m3YG zUi4xNz9tKw@K?Of6=hQgm}1!Gf4D7r&qdD9FW^S7J@_NVMM`jx}1q@ zEFTxaE*FRlpP;~>tiR7$*I@E8kw_-=U%EW7VB5R1Icd#^{dG{_f#(`QH3fLp%K>l zY`Xi>H_=jf6E=E!-vlGwqhMUN;Jo~eLS2Slk=Y<-OI*2!@tfB-*IxGC1&O(_f=-Ji z-WsZqhF5mbdwj3)?1TL1}&Z7f40G&1V1tw+L)-;9!3h z&sCTjeS(oFDH)=Y&PCbIfik1IXnt|p+~#_NCQUC25Jd&|NTmzWZ+k~n=_PtgQ&CcY z+HQ9S_>_{J;}0%LPis+1Y@B!TA5K1U$yU)4{@yDhG)#HF6+;c zTjne)v@fVnii)#qtDF9N6EP(c5H-#!`IhYgjLjfK0^rVoj0afG>^D z0x?U;m>~fibgzy&dxP+_jT0D`U1_$=bydmJws#1D9FeJ_$VX0pO(GiVoBRN%XtK;u zadw)DUC~y(7~|bo<0YuHKUbdUT2tBDeSi>>T$OqWAs)^ll*G@h{iiu+_Q3iv3lSY- znu})l1M;%aV3{G@Tw;x=8H5O?(Yhb8(y!GyPKRQKonG>hGR;X@RSBZb%+w^ukJt%e zChG3-vJ^e)=^1Rv=;7qBAM{#Y8lhiEdVouGf@Cun%Y0inF>7EWH|-k%#Qg-DN#I0LrAC!7@5s=am#?XiCpvN*iSm+-r$+{k^jVWDS}Ky~ocPC1LIkrU zNERwJt3>(sUgq`=BvwRQi%c=fuD4&UyrZaQPw||!^#)T(N3zOlRBQCsoVdIN_36Pb zzB#8#Z^}rBBQ-Q1teJP(9%_OaN(Qf;KgT2aIiW@%NKaS|?GFEX#8e*vx7!!?@7 zr7PI>yyJt!GhC4{beY*tO9=44GXC_BjDeGp7(>HVF{JweLmBLX!d@;&PHaZHntkxU zK=mr7!zO~W>B=}?(V+MfXk&Yr`!nv1;Cts;0m6O*vEO=C%49R!qcVWK&al}CjWmfcq#0btVej7Ts- zo$>O!;lJc}^17eo?76U}x{_I(a4~+hk7rpimsu_T2cE@f{a-D_I)!qylZno8@fpvmKdBfxvrH|}sVq|ztUrFuz0ZA*dy!f^%% z>h?PYf}E@#iBT3R4o`1UGp{+&DujHq2Rm5J_QTGEooEC)y^4z+wEz{~Rd9u$Kr@)0 zcL<^^nv<3zrXeOm(6qFJX2mitDyO7M@0yrn<{9Uw+Q%AaR@E7! zC+62)XQ7v0x|U|Z%FjIN7aYJbv>qJ3Y&pH-xiy(lB07Bb5_*anfSotMlT`(Hnuyj# z`S1jT?QBHB-t1Y(U52V}?MARI8>vbT;{>qpxpe*JhgPlevkxEb$4J+P8oY}(b#8ms zakhU5v&V;bl&v{On60~f?Y8{nP!iz&7gMokwT74fuwKhy;y^w?=BAab9QsdS#V8|| z9ZDMv0qel65gxr9loH6AHm!7c%!|Z$h23Z2AQk8i;Uz{Zthn&-Nd0%DvmifOp%X!x z&qf|6!cuMvw1m+ueY4CvVMc={Fi52-ED8nvf7NWu6@O&pxsee~0Ho9j2vnPrq>ceg z_K-HSvnaujW^v=!HBOs!3YW&iIY=lfB9Rvi?t(tE4Y6Xm-+(y-OCwBaEl_GB`$^yl z_TN)V)Pw((%AOnl4@m618iBAI%*~<0ct>$0gb**NU?&M=4`jS1*~*9mdSKw3nipcM zepTL2ZjMw@R4rG81)HGIAc+wM;oaFkbC;qocwfQl9b$g)zMDs)>4B;7Fif>g4?%KN zHxI7EpC`XEiRVp4UxcZ{gAG}gNpia_J}5Xcm>;D}QmU$BqEn0#kv2&#OVZ)woMOLG zKF27N84NOklt**@I8i30P!JO@4TuN`R)F;)QlPS`nCn7HKhbAeN3?9(*BN1El*>L6-91&(mR^&ZD3BCEe!! z4LlWOoZZh&d zc>+sBNVqh?sa2$#K#*3Zvmu)(w}>we6eosmi%r*r8g=n-ngWct9_DN6?WvYov@l;2 zT9~iVA#(jkw7?BsTHK%0`l-SHpR~9?|F3DG!QXBvodqd*Sm4D)3AJJl{^O$0BN3-!Ax)Huy7;+&&f$}sF`my=2iM^mrRfx zZx8;QXHb?{Bam35tOE&b9y?*4B^(@uo5U?E`%zgLJiWCJoNO> zyPw-2&#9LjvSF`PF3+m-Z}E#U9yBTW^SU`2Lshv^!)d-~2@R%?vqHi~1qqh00M0Qs zZ%w`~*{Un3s565pw0^!UGBq_)_N81NrdE68z*02H+wN&WoDE8g)vQT|jZ#3IJX>*> zM_ND1A3&+5OYmxA^*O)JPEl1`K49q=> zNBOLK5I#O8g@c65m#@8sgk0t*zUv6N%l!coPA&dXP0a6R)iiU@Wi>IYd^KSy*G1P6 zoInZj+!sV&@?PY;^!;t#hgl#+yI6C*&k8Pk8k0{eJx}^-a4&=g^HSlhrQ0KoyJ#h; z2Rhq}>+I*5`)8hm2cRb?ZUZgyN(Agz^$W%}>BaRwZ@e-m0Fj?LW}|V>S1@P&!l(;W zIp7M}>cQC$oMEg=-{!QOO)S~qgAVpa&>wLDo9n%+T5u2~USnb_xAkI3_cAqK#4+SK za}Dg`5T!(*w3QhRIW|jtyd)HcK}Eb#o=_n+rYSAiqA*BU9~o!2#KxuSvNFUfqcDd# z8^DpIg>raoT4Z&U#uc&qP{RI zF$^fd(IhyY0pvEqF<%gR!1~^;?(U}lM4y6K%ERtaxC>%AAm$4D=+4~5cYoj7O7qcY zjF?R^*>G1j-1P^jD**0-s&IAqkIwF5&UdkH?BX~sJk4=HvWI(^I#dfcQL*p@T)zAX zR#z+YCH^1oz6OaeMzjCIe1;bJqFcVf(Jbiiz9`xbl_^K=#hNb<3exrqGfJMkgHGbaqYWz0FKEoSN~?p~k>;=Yua zDe;;gqO_1263lxPdQXrr-VNZ`ln9guE5vajZWQxKs3d?BEDL5%ErUFEyN(EA4Y8pD zOYyt{g*nWa6rXR^3j!q3GFfyWibpv?QNe7qc#NqD5CA~{_GSy`u0>bX9Xw0r*nh&%yIM$I`bFihHut#ShXz9>VKhmpD=q1!_W&bI{`OwCZN6WSpyy( z@MH?dZK8%X(CkA1kn87I>@8N zc@V6)GVtc1w4{r}y>3Zj&zta4%j?<*6P{OZKx{TdYDU*|FUsz`elP#;tH)?;Xo?>GFy4 zt$kTV6Auk_9v;rjU9b<&EV&@Z!hw1?=o0va1eib%fa@RjL2^#V~cFe_ehr8Ar9F+n%rBHbh2x1;l$Z7Lw(bZ&ZNZloi5ZlG&j8} zNsPxe7#}>Rx8spGYh3GXVjCpp;OW7m=&8cW+=F=!GH=qXAn}NAB}ozuco|hK zV23doKOrsX@g;k|xXo3v>$Q!?wqLt%==MdKWjmf5U&zV+2~n}J`NZdYSO4xnK^d* zP|f00>z2Zk4?5O8vp$`5_vI2Jqj23LqYEBdTNobRC6m7LY{&KUGZ-v1K!Vrtjzin& z2}VSI6UT;WJT7akYDfWq(~n)bRp|5XEa>%(^eXpN+u%6U%dLYpxau1(ryS=MX{B3R zuS~3OMnumt*+mnlFQM}AP$m=Up>iGj0#F$RUj*Lqh9jNfA4vg@ljb1F!VkyVH#Zti zcRsplOW&Utbpa*I;+)pDb(KsePVPkuHeQoqb{9ZJn2VVmY&+0FWUp@wd+WqL0gzY) zDy8P0YRMg~OSrNA_Hb)s?%Y!~t-!yz$!Yrf%^epYH^>rHm^H7&m|G4 zUB)mm_txI)-bRC%oT(Ex1_(uX9%_X@Y;7U+^5{b5pRG{o8J4+XUIwoA{y_GN^%r-t z?gkHu^2HT;sPqFYcOep$UC3pFe9MR0rhQ~!QuZlikobZaZ?L}@?CtSjMgZ??kN23J zW)~K3e0=eOM>Z5!Z#dDQZ>>sAo437Y?hU!>%G!GUw%w*V>lJu@czTIfDFi5|{G#tuAK1q(mZ{hMyuL2_UozVMU_ zw-}t&PM-rm6(N~hye$S%j-Xt^vPpn`|9gD!A_nX?E+&%WXI^@#9u8xNXCX$I^)+V- zpH>Ds%8dC6oaDtb?SQj|u-2w!Iu;+FxBQ+3DdKoXO-E|6rJ*#_C{F8~C@x#m3a?{L zH2r>E?*kjlhaSJUyX1yrNB6F?<|HiJyl3Ao$NrCwR@>(7Y*_tj6@Kp~c<*-3zsP&Z zro6{_4<8|j_i`WzjabpbVDh0=P0Na7ltqhb3VL%D4rfYyo(Xs>vwozobN{^L+`hHh zocrqD{NTf$p674s&Ko;aKYqqmuWB1zo1eLItf$P>cg5K*StRTr zi9c#$GCSuc)nzJ+(-SN6?2v8m{pM>2GvkU{EsnmDSRw1wh6hfImS3-q8i_2mY~!QpzH3cUY+>8rLfh&Wc9s_Jcr`M%Y%rJkfphqi`{W>J zfqneZapqqGw=AnojA%dk_kB=Bhi9~Mo(65iiuck;$INW@*?~W>;-Mre3JhSp5s%%4 z!0(qRDx9a~Wpzz)HS1)Gn$A&s_bp4Dc`NSh#R`YpAFC!gBX!CAx$Nkq;>6f;M^cFU zl^Hz*W!J5$HOwE$X-pND?09)%!P9%{h{A!j5<}TgeuT2QIxV$!uIb-C4Fq^tHT4Az zXZnE+g|b1nz%(r&3Z>`NTawoeCkBDe)T_+)tby{lxblH4yE#6+=a8E1%jw*ybdEnT zhVC7EVBD$f3Y%E^(FKtww=+3=9x?&r(AfmMhMMtR^ymkqXJ993mOad~QNZ$QWq5}| zM>`fiv^uY7!|4UX_l@V~t$uLOwXZ*Iepj$OwbW!PO_d9}`ksF*y-=t&OVf+XqAGVi zyJYRlJ4;JUyTm4ZeKQQo%3i=?6?S9ClwaDlycwz^$jD_<7gCCa-zX}=( zc;7cGka-5U-ZLrqmgsU0-kc$sb%uvpN|w~cMdYpQ z>76Kx&KSLQ08W#Wn~ibl<*Bklu{hUQ+*|1^sLK$?T5;~DiuqMpF}kYGWtC-{y3-*) zl)kVtJ-w!^Ha)Yey(_(TTepp-WjW5wIH{k1JwG76xTU2|#uoquxy*G$j>&;9@L2F- zro*Z^J}M7#2!TYW)0Bnf4T+XUwW`X#_~Cj}MYSufj@2{yA?wWK(V^RWwb^lzf`HaQ zL2GM5o=FtLQM5=eydT^PZy25W3Q5oncwQ0X{=uUznB~bM^`b5*LLTFv1?Ojcg5n^yvm2zT@>LjRPKOFm&g3e%$nBBu4smx}T%3?v{1eH2IUad-idlRNU zMke$Ww)u$FLhI_vgS}Gp2Q0By0v=o0-$O01lDCm{qsP${;wROwcq&NP3-|A~s8sRs zP&0dg!HZpp`1u$;!MPsKpb!qoQnNTI5H9qDT%ys)nLna5Ip=z&ck-|Fd-4$x!kQ9F zr9P(5`<~E-YvCCP(mW|gY0Mwx8jXZJAsUgpRV)d40>6Vifo&UFp;`#95L$&=`aC?a zSkAnNG;)m`h0^myOfNbNkJ9hCRnTcPbsOq~@TGS^i^6e9U_`*|XY&qbj|znukj%;~ zk6p+PcYpu}&oG5+BvW+DxUqVyctL%`=sS^F{nf9)>hI}2QO@B8RgxkkEPW951qwn< zmDTl@yX$MW+51Wi+Rnts4cX}#+P1USj`|`xF=u;HiPNr)vZUAz`s_@s`BSth;A?sl z?g;^K5tL1kxq@5|VP>vF*>k;`8%7`SDFwVBEweq*p` zPU%jh+X?#m?=e4!;cc%2WuZh*$J#1Zemx5<9zF;XmRxq4eqG^c$@=I$WI1MOuxsjF zb2e;=&oPR40hT#VE&X;eb7y37t)r%Zc{S3Q0WCl^L%m-?y*OPn=!ythK<}v?R7#jt zXVrbQ_HjjaYt~=tZc40&x?397Z!$yOTm?%q`Pa|!3s{oN>ZhqDs6P?v4<>7ttJIvR zu(xJ?bXmO~oG-5uQBm;1olqlIQOz9e-XjK`%*-Msu%}srIXrM{hK)KN3N$(`YKhRV zE+{50J5HV@4}_zbxb;CX@pecXU&-CTnF=rSEllszQ2R}%CubdJ=yf%J;@RN(kEFhzw}9T>+C0| zJ_kByVe9cS^o-BT=?tHK5Ju07&_Z3l7Q$<#*`xf$j?ZDfQ9&F1sC_)odEfZc&t1|w zKjXPe+U93GcS*~<2rbj)YZ;6unUhmJEpsV-v)TpWc3}m=a~!;i#Ae19>3l}YYpVYq z&Sakc73}x8PV##P`WWB9IO;E)1BU;pdnVV^Pp3Rqz_+2l;o1i}? z>p_Kqb4)%9%;0uHoUW7FL)}iDg-6Iz5X9i@B_U`bpxa<=8y1VmXDcP&Ay6kp=`&V( ztwIp&0K3FE^@2tRkASIl+FS$!8Jr1WCnmzPD}yz_>1-J)o`?&o9##Q4o>|ws9ux;0 zj?dPGD)Q%-MHh@#$Hmny+YyDY|1g8F-y?;bwOJo)9;aAQu>!u*o?g(|sYZhmTOzKIWG2YMw5b{;#4b3qxSg`R zyj+=~F5hSz+kQh`{f#@8)Ft%Z^U<2R8@7)bT~Wrgn3Pr((_Fvz>EWTL_cb)^dwOX2 z>Am$#Z-Wpr_Zn(*4e^D|ruZs{B}7%*(4eWgd0kb@BPi&>yiF_nE8^lyS`*@0$}Fma zfkKw5xG+b0?E8~V**)v>3@vrJp)HYd4xK*R7?B1CL;HzCQ>#;=SS*>vsgtFdB$2T; zc}gc}XB?`OsSK>j@HW#H}xFCCwmA9@=5am;offVlK&>jT>+^e!&Jt;-|RS)k9+k6qS}!=$fk z7VS9J*m!K`!dedpaLzlP-d8r(kfsh!aV^W`LnE0p<`(FUrSr0y?l`cjB}o`xI<&Vv ze_5X^Hdt2MvoND(ZDV|tF(oY}T$3Fi6&0To8&{knV{>G2(SE%6>e0N6{>u26)Dok% z!VxRWa%H8rmuH%y`K>~2hTiCi6$Q&nwAyTw*joKkEqn3h-Fa~d?sMqcWsb92ySK%(i`|$o$bIClrRF~hHlGa|JZ#eMkKbUW~RNs7HqQj;r7^$cj zE>POqSLRz=stYqM!kEmAY!!qfM9FN`Ng`u7htH9vi*rY+OsbrY?4%k!J+UQ)MgCCaOh|QKrlbIgAPY8s?+8srUK8Fyb4jVVs?kjCL*@9ZQzd zcre=JV2Q(h>~qQSZad(PoYjq9Qvg}P3B4j?mWUwnqMija<`(uVQd4vYavp0>AE-@q zEIT4?4OrB=xqwDfB z=4~!l*o=|MH63vY%Qo!HXZcMJZr?z5mx>MeZ3eN}AP)wxCGpS0* zEV`W9N#W(qbfBOoo&nbApvWj^oBgn56e6oYV;3ty#~^E9k8~6WJ*F~PnUfx}aeUvs zmKd)oZTfcvetbmMf&oP5cm7pFaaVfv_1hNLC&-+ArD*EnSN-mLxME9Lirf?(q_mY9 z`H>2Jgc}veEgA`*ZlRB)lv%{EB3`sE53~91?2&z ze_e5uscONNBX!wrP9<_*c#3{JKe=Mx;zF@DQED1pJYpDp;NTjYtK!6oTgvE-?y6vo zGbwk?!p;JHV0?2qdUmo)C=>em38RG_S{*-3CfX0Vz4^G%jthQa(IVyp-=$WanhzJy zGD~)t+!$%egnjX;KTrM5{}t$^J}@F-z0$YOhHWR|YSJ&fa4$#u))#o^y z(-XZEI+b)=1m07Gu3?L}|MmW*kt=q@mW>qBnn|nwXLoXy4p&-+%dW`X_~NF~kJt8m zG(K?KqU;E3T~^VyGJ9`ntk~9C*m$5Uw<$TCO|vJ12bss*Ys{r7(F?}t0rwNZmD^vx zCc6E>LqXeDW%iaCQLW2mx71#@an#6B*19?^Mcan*tm!Uu2JH3a>nlnMV$@2J(j*Sm z#e}P)_48M*x69&0+R1xawM@Otnx|{;a*b@S#>NcrfAbH%j%R`RrebO%wV%2U_Hr*3 z+AxlRgTt`?jT1Zq6GMoOTE*sq$tEl!LW?&_FzZH$K`%gFE(9IG+cG}aYse3&!H%_N zP%%7$#te-MiA$j6Soqu|-+Ul|fkHo7l9AkXO-t3b-i+ckclRuM`OeL4iAC!kc=w;{ z_9Na4OZt*q$FI4*{4DeG`{Q{NkJ6iVtS=raQn$7hZR)r4=res!?rR!;lX?4TcTZfp zGB_}xEhr?~Ij@u+JBx%5HQ5*5+ z!CkLxu;(v1Jm>H^8GXRzUcB=_#duSKb^h&3PzY^xzXnP+K8-ElkHED!SuzDFHHi=j zSL1c1GMx2czq_uVz0!^D=;wUSab9=|MjHlrvw}xePkkD~1uyDE(DL%BCTcr%J#_g^enBvhE9qT-Z7p)xKi%A^nm2!CN!&|2=-0u|{k z>l!<*?M(>{?tqN`WedwXSC`76ch=kU7khihEy11Bn2t(!ZRpV``y z78!4zQ4FEr+_xb4|LjNZ=tb-kxcMkRqYN>muA5Z~mM*V0R$PKT0NcQ_?`7!vI2nM=$ zm@9dyNghEFOndC=(}7g97W}vHzLZ!wYwbYnp-Q|*;?Y86O0q3>NjC z$rD%Ndn-|8!3WbPb!=evm{x@#ka+qH^ZtHA2{^7>K zN4Hj$Z+UcN(b-KURa+nZ=36#5Zuya?mjv(o?4gZj^u23smBy6UU^Ld}86gj52-9ng zO_+CVk!!=ea#eIjeqBmxUAinx?})Sa4uP9ZdF5Dhp;BL1(VAVmv|M9Ox%g_paMoa@ z*<8|OR6CLlL4mPWhbn(TRa|VvNMV9q6A})ATbgveNG6G~m6`NeaWX$GKgMj=V;8sZ zgo^a<-ufRaVBH%UZk zy{fHj>!Rl90sX>V$6bcPmc-2F44EvWIa8WoPzJ4I{Kk(|Z@$Z&gOz=ycGgeqOQmhh4RiU9OsX$-8uq=B~ zV~W&h70V!uJX{qQ=_i{LpHh=56|0S5VFry@4N?E5@@#W(%m4N`M?s5pscL1CS|Cs- zDb=Yu(S;8JWq}%nULw)4*)v6mBkEy70|L2kQ0>%W>JW7|jA2-_!3;mG@Zjv0c*+K^ z1wGaPu;}OVKn8(G!eiD35{d?Aaj(z5Z{X~HvMV;vpMn!T{QHtQL7=u_ZipjRfLLwD{kSL(yb=mSe zf4kZ=@$2jAyYK(ko?Rc@Sg&_hRu@GYRvkEg{Cda5dvjJlx_sqp2kJ^D?jIO^{l@lp zDq3X>3w_Mz+E<-fS-r5rEan;Q^Q+<;^F=B388JBv4m3a}FIGrQT7!Mwfi6oBy<*_j zb=`WAS`;W3IUo(cB{f@I6QQ1F!8Iuk1b33G8Febc)8~{VxU&MX$OB{V}`q zF&n@}Ij#-IX?Ue3nU}n`5#s={7I@|?D0&n`B1}EYA*fyMHs?i&Ac`wm zRh*L&(kZI$?1@dUPK=;Y-;;OlNn3KZ=-bD$ZTUIcIoirKO_q$FtvBA?P=4L6wbnfI z+8a;L8-D%agTq;QV@I3Koi*wF%t}>eb-cCFt}ZL!TgzG!s>fZ~+EDA9g$}thn$OSe zTb)(1urfAKmZ%BvmnN4bSSoEYLqSVY!G>PD#9GGsZOQtSMbGW2HC8V!)w>cCn<|_a zAoE0qoMuH?N|PjkvV?-xtT3Zd7hK@51#C;U$dmOErh>+}Z#mgnS$1ctt&peUOJbAr zYAlwj^q7DkW=Gd&<74MGmxP9OhYDhIARnRHvT4sXqXoA1wZ(p1$KdudoH9EtOJbIY z6hX%k>MdHCn&8xj2Adm8g&j+C#Tt8UyfD?c?ns@qGT(h#>q<(mQs^QJw!Oan&_5oA zDJe1`&sY>&mZ33s?0=b=Ja*T2$0|fHRRlQFA&4$8L}}GpbNJ~M38EC&(v4dkEAAgl z3-DJID7v=PYb}-YQljly$#D3qP+yQ7qf7_Au_{%X)Uvk1(%DqXjEecX+BMDg!OHkx zQPFk#wjyU#UEeZ$h(?q)Z+BzH;-R*JSWaL>n6fS-y@B;ixSu3W6Q7r;2ypXlxp^7( zoFdS-r(T-+gr{ep1Bo~WqvvN23}1qRAC0je@iBePFX6WC;~TnilvihArufIq!Q%ex z4ovUae)EH^S7Qiw^yO`h_16K)9b5wP2M!jYc0k*~W-j8X^&s!zj59o05IZvVt5fT3 zRir)aGl_+JpP zrB1qyS>3FjnAj`DQRg!H3%NlODAm_zzH7QB&EWkdHme|d@*nLTzU%HLW(8xjGFIl? z&G;#h&G1xEM07ArB4I%hF*<=v93)hS#3xzBDyfV-|8{%F4z$sPUPZ5(&>uJ#P^{bC zUA9Okb&qM{BKbivDF!-68d&>GS-iq?eSTKCDP&F^y~=a-;uEapyY9Q=xM3L+>U#pt zC=K&x8`U}~j}s1CdDW zrEa30ralKB4KsqRNi^LRzJ{7^?U|lXVm;N{JtzhGK!96Q3@z?cjzI|HOocN78ux=< zYt!S-!maMn7OvV&#O4pHSj-TJZ0dmuk1Z<18bCH!V7lS4NIk@aFzW;XyuiQ_t7K^) z@F)!)XA*3(NcE{FFwMZab{0EL6X*@C=fSyq(@J?zyoW(9X9FL5u%7WThT;2*z!Ww8 zJ5ZCU?<4bIMr>)iiuMzR!9k9(A!2!mF-0C|ET5kPf+{tfc?D^i&u&JCOz6?8GY?0A znQPLH8O?okvKXb!U0;#9X6ueTIF1?x34)Zum{=Cak1O36C^5(xfh;yEph0Se7-FSG zrisr|1$VU5!svpm*b8@gUc(It@xxpiD)(|}as+VcG!b5|XTMmvzP}>U++1X4(JBde zX-Fh0_Tz+QFJny)!!mz=-^;%j-$TFoExiZWu3}rXGC-A^78V}JX4&N`0b3ZGWo%qp z6vGb*4|*DjZ!#=%-}Bb1X!}nvvil_$9v+C#yoVW|eWPpB9Ak7wV}>v~LKF}ZDGKuo zkJjo1QmI^6|Gf&SVpC&+_>pm%a-j;ZzE$B7adyMmx;Y`H@+{_YR&=lc4;o=qh#&jM z!-oEN_9#T(W)~=Vq59m!?{`IMwNX(xI*mgeoVuO+9QO3eZeQYXEV-k<^Tdh*mMN)i zQ+>mx7E59a{%lM9p_u*xd~7ss5gK7W#~A`1ViNtn;0=J)NCy6FI6HGFqLd0m3A~>O z4pGNDJ8Bgz2n`d?UTlYk!PcGt4sZk$(?h5QwW5#FUjVi;$KhWzBL#SZ%X#NjW81#I z-@o?EpK2Bs#%RjMs%saQsSm?>y+1G;kdpa^ehnUk$Gwk5<4>rjg_%NY(eN20Jk!dI zGZV}S=336Oy4!!a?a0@+H8vdo>JX|$wHI!w=d9S)I&=}Ih=t~-s0lupuGV%^RG{Jl z^ijhU94SQ2nK}yaF9cr15J~ZMBqK0}Tp1(fC8Yf8DK(s{ZHKZysllJr;7@Asr*IAa zqy~RdgFnJG_#<3{Kf*QmBV2<&sUd)>KwVS->H!!;X{Oi!xD zD^s6PDk%Q}{EvdBG69BAy#VC|>ZX1JWg~&{)NUvzk+N+{3FS0WPM@lTa>f+?HESvi zU^e9f*hqeDo_YexE>dm`t~^HS`Iyx6H&Xtb zJo_D~XOch$LljA%3gd&+q^u#3V2)yO4ai7f5xHJNU>$)C1a@P(&O_1_>j3L^9F+|(Qm7V0*U8H;sDeorbJ*2#sl=qRR_QO+JXt$#P zA0zPm)HWzTN8sP^6||nfeE@Zk^^XRqo4OmIkwDxdIyn6jU+E#RkHBTHFRY{Xk@Cr@ zN1%KkDW4+n33BC4QhtlTw+Z}?z)1ob3`q;?P!TED5LicG1A(phEvTKqP6BaD>JV;8 z9cc|c6#{&vrvwCQrrv3K@gZafk?Pb0KcsHrx z9&-I&0?#vF!1d<{e1TkfiNKFY%@;5PDxfx?0z)o-3zC!TD*RqlK(4pqw?NBd*hyeF z#tH>I-lC`+D=%RPG-AlcPXVR4%q8UlQZ6KA zOi?_@K>X`wa%BrCZ-ufMBvmFrIf1&VWl%N}7*B13auO*g6PO7-W(K*0@5eQpL6T!w zOkgR2wFK4^*f@0ter*OmG=uCq1+W!($qeJG2Vftma{;*%^SPN?NZ=v@#|T^u{ALF3 z!f#wbu3#Brrp5`xlEh4{CU76A?LGoe5qLkjewMuPJjh`)^&Ek3l3(8<@NEJ=CiQ<# z?);8i`JOyGNy=_gW=MGomtpq7Fo3`y0weLSD2kNTm}-!jfHTNU42#IGq?J%Pxu=rA zY65G>ucX~j9VwI6Lk*-nhunj?)J(Y4Ot{pHx^eG-yv6S&Z3wagmq{Ct;9s|s+IEray9wM&;C{F#feM0oEde45dH}*~15gK?lK}jHVLVtu6M!EM0!${* zHdPPhw5fLh;`u89=C4NpW`WGXu>!aTJbxts58ygoq@Gq7K?%SExXwOOPd}*v&u9rC zX>tAc5qOHgho%g0&yNXYeoR0Gq+CR5 zs3EY9zy<=laT`Lf;o3$CTuSQ1vt$BVPHJ08;3@*w5cvN%dl&essx$9@??b{(fkR#$ zZbspN2o$JtDdl3@>1*Utq=*D9rTr@j61jvB$UzX4ivh7FIf048Sl<5CMn^P26b#|g zU=5K*tw5}e(9%w*WXRYXR+fYjwc*1b$o+M*hmRO&|n2%XQM{^A^NHU zsF7s|BTGFvhFQ=Mk1s>eY08sjtZ<&Kj&Cz+WEm11Kw}RImId>MjfR(h673*)}J+IJN?eVuUwDMN!!Em5$uu}@O*0o*l|R*VKm z(Q8O*ND@s+=t2J-%y>ajtQmalSFvxWM=385bJ! zjf;#+jmwPp8J8PZ7)x93;8~BmoC>#MtDn2g_`LHRaC+VO7IGeRdcE^!CkI!fhCGEO$$s%J5~R{Cv@Pjx)g@oA1{ ziRS1cx# zegfXetYa9Q($y?uh4XK9e4BBva~?=;B2S(1pwsJ(CtO0a@<1`lfmXtvdKNM%?58}) zq%gx*<4#}gy9%AM&bWb;uQ8`u4{FXif>vm>>`Y%65u_*eM!KtweHh0_pjQjP0meaS zfD!0br3^EUfDR*An|>RV4D)yL3^)cIJR-QMr3$>cr3M^p9A_M#TtLbM$0zglrV+ud z#wkv@&GD&@XF5L3HMzra>E{vXXVv8UuJa7Xf8bWkbWW|LMxeJ<&)LR%T$4G*xyE_M z`K&=k1i6kcXelS2=jSdo<{K9o7n>&WU;=rT1kZr?x;{&Nb(!%#<8tE)Uw;gu=+7u(fKA=|}08 z89NxSR7=Ay#;&?I?B?_yPDwXj;}T-3Kc+V2zs}fS+zh{B%y6EuF2V8>PINhwjFXMG z`s!`QOydmkhb^Jc#3ZwaGT`__&PNl6D z-5BE(FLXWE86PrD*1P0~{S;}B5n+*YN{5UHOB|Ob84;E`zQLt!R2=I>7d*Q9Bx}J^ zW)xqi&n^M$gwUUK=r7DL78=)qBN=Pz!OqC@NJ^Ll_GMK*l3pwvlzbE%lKco9<`k`Q zMj|Pr!JAkMk7V>we5`Stae`4gc4Tm?af(xJb9}1fnU2ezGcvft@tJ;lmN7edg!I{d z?gHn}GsbE4Ncz-zQ2k;g{h|rn;GB=UK2Iiai-gwwKj~E+_T8oXe1!-h(+BDI+Y^1G8BZG5JX%Rws=n3V8tyMSX*w8Ax zQtb`97`v)Wui!?8lI@Z3NcqRQgjOl;gfAlJCScjXxu8uN{djMAl};QJjNOdl?)uHAI18pitDo7jmE+^4ZNDZGn$^Rx91Kp zvQj5L#PMOq5$r0BW@J>J*~TTlYlGtzE@!*rl}4>rMzdN`$%mbC#ModwZ9Hde5n?+M z#`F}VUGZCuw;3~yGgKO_7T#&hQaxE~D1V+Y?h@7$AA>ggGuRm$<{0EQ3ieIz0|yvo zr5QsTl`_mIZ8pZTJ%$;`5#l#9l8#{pA{=KN?>rM6pNy6mgH97pamsCuPjx)g@o898 z#-P)bN3-rRo^_9bk}nXS?dL9V{!(TXW6)iy&*Ogjljy54me?`qF4avl=P}5taJzF> z8lQIw8o|e~HdzPO88w$4gTx9CJLeH&gHgI`3|dQ1l-3%9)>3WHIi*F2RC6!#ENrb> zF#H&7tKqE42O%3bnvXYPjj1HQB$xxL*WXCL z*42|rcb#vgJdyz);se&6Xc=nLZm^_1~J0bao4gSgX|1l7cgg5QIp z$#`2(#|JyHZ;uaNbp9&GcR4OiIG!5@NGX<=_YJ-oy5>Bbop*{M&-H9d8YF8&B0Wj zzB$N*FHtZGM>5eTEui?4X})CIPMB#sVW#bbnb1i&Wi8AMCMVB=w;E*u%M4`u%0y#c z0p1SBGU1&{n{NERQ>5!MgCDpY*}gJ)OMpwZ2)uLbqJCK9G_C{IDXOQ!oV9Zx5 z9N*80@EP1S1*{W7pSIu<@Q29w@Zg7NnBklt(%#ujG)XT|_Qsjm8`pu_FPn*00nsX4 zMXQh#t)lo!LZR98xuzDA7#1ZESH?+lC!)Mm*tYPTymC6&T`3FE;);mOM)zy zoJGlsYnLi3)c#afsFJf8RVzU4F=aEJ3bn_S&B!9u4pDZX9inW;3!!$1vKiln+9Aru z4lK+y<{8(6vrN-j)Mo}KcVxSpP5lc%S?y-qUN<|C&22X06jvFigtE5HwzX|`C~Mnn zMkS@o&NiD7L~&WzN-6(}pp^2j2sXI<4K9C!%irMgH@N%_E`Ni|-{A5$xcm(+e}l{4 z;PN-P{0%PuNoboLJPCiV0h<+v%fz9l;v2wn^vs`wa_`2Lqiu+Lzx7$_wt~}|BdGtg z%sLgn(KrKHdNw%W_({d74|%Z0lLrf}P~+FL)JN$n9be;|k2qdzOc*yhy~6Qo<|NPg ziO(S+Rm5fMe$K6U&h>xJ&w9=!KZk5^)opnW*-%{e*yoT9p<4G`=rY6IjByp-U#{@} za)tMoE4;tF)snfD=l0@Efn_-d=DhYRkBk=02L~mXm zRAQwk9V@*srgSXuif1V&vlOKiI%OTW6MZ!k>}>4Q@&fTe==PnIxdPM*eWzFGI~lDM zpTNv&XE2R%b7xR`z80+Tz3)2ZjIVy?_<83~3d2?^IZQQbCA*WcKzNOEQcs>0X85X~ zf}ZCo=y~BZqwLQ+@vKn(xbqh}|2ku}Qkc=LXT*|TebE~DMJV5exZ3g}ZFvnGOF1vn z7U2Zr6yr4N^CC6@l_0(SBI|UeoblDq96#?8l0vvf$#6~BR(WWV@EYZGi(Z6xx;oDJ z{S;cHJkyK?&Z)M%2xpa3R-G4V#b`!c@q*oTMw}`*(i>DOs?3opx1!1%siGCiFFQ$< z`BLRpRMBhBk|MrT(F$D^U#iftDpTC4LenZP9#xq~RpwEZTU2EpRhdUsZc&waRE19F zF50EL{9M|lxM*0#ES=h#Q&r|vRVYqXh2m6|d9=$s+GQT?f=4OAE=%1mw{aJ?f|;b; z%qnJ=Te{2q+GT$2qNP#Nr}C6tw09C%%KBxOxwZ=}ahCW2m+-Eyii5joyKRsmJE?P}~w|WMnmP%I%_ZdQoKb-ohgAj3%fc+>#4oe zP$^@ba;xz+W2Q0Jm}k@~X)iTYeyxo5vJ*KU*kv(Fp9iSHG;j~9Kh_0`*q znZ_(VmpO^@Yv1`m824TGI{z}`a^wBRm3kJ|UEyjy(fiQ{Xq{4ujK#(hW5QT!+(7<1 z+Pef)d+TWLdQk1Hb9?J(uk0zKXjdKWReTK6Tj!S6xutbMvs1LcUq?$R!7Z(GOY7Xy zI$El$+J&$4{(Bu<=83da`SXlwX&rmDr$Du|E>uhFLbbFG-cbj)w2qci2U@CoA91=` zS_e0kM=h;`r;4kkb>Rl`AEb>Xphof%2?qVs#*tXGIgT{U)ecUlZJ^0_9oJgpQgH%Cn-$o)t|{-zi$g`q}m41Ivo)t~3^c9z9MN=TpiYEN%vO(D@ zo9IbGc~&$9@~mj$+b}|TRx}0jtY`}4S{-zi%Cn-0{;SfYhnvt;dX}_t z6a80l&F7owzlzJVqA8ST#UB`v*Mr&%J^_DMfZ7*0;Z^nt+u2Sq+LB@m+X-9PPT0bB zg0_&Kv2}FtJ~IcQ>|O68nTJ62p!bo?N>E;Z?_)bvy1f40XIHBPl=c37ETT%0*Wdea z^AxC+`}@>ND6hZwv40A+PJAEPCXQ?i)d%0VY`<^WejnLZy87Vz$hPA0{cE-*x!IQF zW@;EEMV91dWLqdpax=26xGc%d9`~C~jb>Ytn{7#Mwk5gQmgHt^iH+oxCAk?JQGZaD zNcBsbfV+zj2+7Fm*;=`TWAlA8lrlACQwZnh=4*r(?^s?GoNP5Of$StPFa$h z=?g+xlAGxZLRpfVktm^dzM5@GZnh=4nLeUCvLrXN^9A+1^VMv5Yqll18UCt#&6k>y ze{y=h)XcnYIP;-YB>JSSIww7|J&AmNlN4EXPBLRZ1&%e2Gmd8!c9Pkw(x(`w8gIwK zb23=qc%E^gG2ghzxYVd|_9PZOp+;M*Z$?>=PGZ4RitI=yZAUt3JJLxgtn~B77GqKv zrWjir+Zfv!yBTGDIthi9(`|vyin}eLtlTF`G6385S$L@0mbb4Z2KWk)>+#~Xtd z*QdqxX>om8T%Q)#r^WSYaeZ1`pBDO51$SvTxyAKqaeZ1`pBC4r#r0`%eOg?f7T2f6 z^=WZ^T3nwN*QdqxX;FO`Gw`bi*_#9Ls|Wi!eSneq3@OkJWbOoh-El@w;`r5r*a<;K zPms|Q#IGKl?l^w+#2-jL4&sXl;$08oT@T`258_=9;#Utc(t%hV!&bC~($p3(rl)Hx z1F_42uBXN_;&{=6*e5|~4nlK~Ssch{1>S4KYE2w_HF&=fs}6Cz7)4= z@giTv4oMtuc@S$PSn4=7N#c0RGy002sitSD>6vPJro!?*Of@A_P03VKGS!q! zH6>F`$y8G^)s##%B~wkwR8un5luR`xQ%%WK#(ipHN~W5UshY=`Z)ig{s4O2DC4clm31{s$@#$}Lk8Dv}r8J9uEWsq?he89NM$QVruV>HMZ z4KhZ9jL{%tG{_hYGDd@p(I8_qcv5kV&LBSdAXZ$EaT#P>1{s&b_VmpjVS9R(5TASy zpZxGL?Gu6Qtc905&*jc@x$|7^JRO{;gY$IM+%@c|xhsfQFo=}~WbO(wcLkZdg3Mh( z=B^-fS5VT@QFB+2xhtsN*U{3_QFB+~%w0j|t{`5)Aahrcxhp97>8QCYh*vPk+!bW* z3Nm*EnY)6_T|wrqAahrcxhu%r6=d!TGIs@;yMoMJLFTR?b5~G3x})ZNxX%w35ycLkZdg3Mh(=B^-f zSCF|Y$lMiV?g}z@4Ws6G)EtkR<56=wYK}+E@u)c-HOHgob<~`VnzK=JHfqjB&Dp3q z8#QO6=4{m5jGCKKb1G_1Ma`+GITbahqUKc8oQj%LQFAJ4?nKR_i9k*+JV{ZpVcVOOo4LA=L7>BFw*L*>ab;yq3r?{N_CaZuW?tGvfS zyvISj$H97|v|m?RN@-eygQ-So!mieYT|;TYu3CeGc#nh9id|``?!s;WvbP1|Jsx(W zExkc@$w79;L3YMLcE&+=#>4Kkr4k&ItONIQZ+GfIJnXJ?N>+RW*aK=rLH5Bx_Q65+ z!9n~JK+em6V~ym94xaH{?0pkw?>p?_5u9Pudgz%uQIQ%GOyFk>vZ!v-MmgWuhY%zbn`mhyiUiG-$vZ!v-MmgWuhY%zbn`mhyiPZ-)6MI2^E%zUPB*X9&FgelOe#~nPB*X9&Fl0)yiPZ- z)6MI2^E%zUMizZlyiPZ-)6MI2^E%zUPB*X9&FggYIz14t)6MI2^E#dNl%679r<>R5 z=5=}~UZE?Ahxvn5ZyiR9lcRDCur<>R5=5@Mxoo-&Io7d^)b-H<-ZeFLG*XibU zx_O;$UZ;oRbvphJLh(A?yiPZ-)6MI2^E%zUPB*X9&FibR@}g$gXTqMI%k_kh9}&k_ zAH-K5WH$}OS0BVzAH-K5#8)50S05Zfi+Tq5>Vu;k$5)>?zWN}(`XIjgAinw_zSbbV z`XIjgAinw_zWN}(`XIjgAinw_zWN}(`XIjgpk_@y8Cz8oeDy(m^+9~~L45T=eDy(m z^+9~~LHzJR{P01%vO#?BLHtEQeD6Vg??HU;L45B)eD6Vg??HU;L45B)e6~S+??HU; zLG`SjSXYWbeD6Vg??HU;L45B)eD6Vg??HU;L45B)eD6Vg??HU;!Cgjt?}=k?0r9;D z@x2G}y$A8V2l2fJ@x2G}y$A8V2eCYX_}+u3opQ$I<9kmEzV{%$_hC;)6G~t-5#nzT z;%^V)Zx7;c58`hR;%^V)Zx42N3SRfb(|s?V_QdhD2l2EA@w5lo6$SCM2l257@v#T- zu?O+72hDfp9*Udq%s>>M<~(@a6UXZw#Oof!>mJ1G9>nV&#Oof!>mD?JvF+%&_}hc{ z+k^PqgXW!ftcc@p58`hR;%^VKGYhga3*v7N;%^V)Zx6D!1>$cHvcm=9Zx6E11>$cH z;%^V)Zy)mA3d-pvFC!3dIuL(3Y*<=7#oXg!?r|~qxR`rf%snpV9v5?ui@C?e+~Z>I zaWVI}n0p*nRC-*@Juc=R7jut`xyQxa<6`b{G55HbdtA&tF6JH=bB~L;$Hm;^V(xJ< z_qdpQT+BT#<{lSwkBhm-#oXg!?s51aLaUg2T+BT#<{lSwkBbGIeBml5UqJP~n0sH$ zy)Wk87jy56x%b7~`(o~WcntV1^}d*UU(CHP=H3@`?~A$j#oYU1?tL-$zL z-WPN4i@Ep3-1}ngeKGgGn0sH0mDE(8rQR2F?~A$j#oYU1?tL-$zL-WPN4 zi@Ep3-1}mIdS8sWy6B_c7jy56x%b7~`(irt62{yIWA1}7_raL^V9b3m<~|s6AB?#V z#zOVMnEPN%r(KAv560XFWA1}7_raL^V9b3m<~|s6AB?#V#@q*E?t?M+!I=AC%zZG% z8u=N@R3D7F560XFWA1}7_raL^V9b3m<~|s6AB?#V#@q*E?t?M+!I=AC%zZHCJ{WT! zjJXfS+y`UsgE9BPnEPPNeK6)e7;_(txevzN2V?GoG55ikdtYz&zTWPAz1{oz(93GW zK05yba{dM6{7cveUXTtigq(i?IsXE3{w2JY+45!(pTMxMOX%wo`nrU^E}^eW;FX-@ z@9Pr!x`e(i;X0RaolEG)s%Hi36OEqz=uMR%e#oG-L_h71g#C~a;!vJ+C@;hV8DxJ1 zWPgOUjmjC|at64Z0WN2N%NgKu2DqF7E@yzt8Q^jTxSRnlXJC+mm0%!xX(Xtbz(DJz zf!0d{-MBF!scm^U%(WfGK0@zs6#EFh!_ky86O>Ia!*<;a+jTQ+*Uex&Z6sZG-3x2J4+(pzP!sw$x?VuA9LMNcI9*>N0H4$zTMmAuc<42ED8vl$|`o*0~I7-i5gA zu!dvyBYL;o@=W`20fJ8qFt3= z>zxc%^twxyu?$;xGqA%buJvq&t-Bev?q;A@l_EQNhVA4TXi=rePM(4OR9rUR4D_es zvXf_^KNXjaH^X-Fu~4rf91Hb?qT5*JA&Rpv1F|mzvM&R&F9Wg<0^Gwmc74M(o z^g$^9f6(!1j!$zui(Z^f>3D;K?EHfG7J|IJ1mx`{a6BwL=KA#mV zH5Q{QW68kVjNdobe`ok<}9xM2Dw^Bg2lD4ThXZRR=jQ^jR7 z&!L}YgR++A*wUC|8*C2L)?Koe=h*g`W7}hnZI3zb*Ew)OCCE;mV@qs~EwMSaM&{TW znS*Rof^CvH?(aFa$L81`o8$hTq zC}wStW22lGXP(=b=QifKjd^Zkp4*t` zHs-mFd2VB#+nDDz=DCe|Zet!Rjz&sT8}r=8Jhw5=ZOn5U^W4Tfw=vIc%yS#_+{Qe& zG0$zxa~t#A#yqz%&uz?e8}r=8JhyS7+qlqeT4CjSJnzd~8saVLo=JI_yf~ z<06lhi+Eef6~u=jlZ)_LISX>u032<+$?13nlQJHw+M?h#r{96zScIicITsk8bD84x zBGX|Jy;5<_juz3^ghz}G#zsBM6j;P6hO4Y%gwk4zLRm5wSqm+Se1m5#wk>Nh^jyze zRx9hcXRvY4VB?;_#%Wg<(q+Gjd$t_+3Oeo;G&5;d&~dMz<6h6ky`GJGl^XXdHO?6E z40&YdiF>6P_ewMFHD=sv%(!R8ajzodUPZ>eevEtl7>Dma;a*v9;$A<-y?%^)wHT+p z)DVsfyVI^X?NwYWuQ;QUP}YyQS6*?ip5k6T#l3opd-W7Y26UG!7;&$g;$AVup%`uV ziYZR-R$Nw#xK~VZubAStS}Z|hSEBv3O1jr;oO`{-xfcpA3Gbzzq*G6!R!R4IjdQQp zI7^YY&EZnyZF9KHB`k9Z%Ur@Tm$1wwEOQCVT*5M!u*@ag=MwI73Cmr=a+k2&B`kLd z%U!~9m$2L=EO!Zfnwa{ma0x41!u>AcewT2+OSs=9-0u?ZcM12qg!^5>{Vw4Fm+*i~ zScybUg4WvUUP);spjK@wb;2FwggeLycaSsM-~=P*vWasp8{~vL$O(6l6Yd}<+(Ayb zgPd>&IpGd+!X4ziHkfDR)HZQWxPzQ<2W7Ebi8O8kIpGd+!X4y5-vZ{&n~ zxDtAj9&*ARN$O(7Q6l30^t6CSYgqtdv6Yd}<+(AybgAbEu6+B%6YM!j@o{@-Vns-iaXR+(En(LA(<|yc0pq zQCBkuQylL^kaO;!Bz!ft#3LZ*+(FK{gPd~*$2$++iNx_v1o2J;Ip+@Ioe1Kc2;!Xx z;++U`&K=~OJIEOdkaO-J-iaXIi6HOm0P#@-@lgah?GECj2x?8S8Xc<|a@rllM-jwF z5yVFk#77a7)owNVb{)uRckrNda@w8vVdun0kvKkz;2+!~PP-F7>o}*~iQ}UP;-eU@ zM#8xl*%soX2y)sTEnD1!JXg7_$coZ|o`+pEJBPQgc!I6jIXr`hF+j_ zJQczFjCd*%$5Ro+QxU{d5yVpwWOov9^_0t$eDVOGxZ>6>Os!bgR<{EXx;lD z`;R5WIa3dErXJ)>J*Yi`2cge8kTdllXX-)D)Q1o1Og-2~d9X*4uJiRE=j%bv*Mpp| z2RUC4a=sqqOg+e%dQk7hcu;5RSqaDsuF%$!LR(7;(GQKJ$XZfpYe}J3{e`xc6tX%~ zy8N07Z7nHe_A4(6tDPs}zQ^s1$leS{TZr zQpo&D<;bE^$oxuiSyT#bQCWvP^a$6XC0c{BV61~*LRm1@QMbE6PHuuL>ACBmK}YZr z$BT^#@F8X?GeKFs)+5OUpw?pR(esU<)?(|CG^J=&#VH)+^r~S!<6|Qwc1r#TASLw_xP?k#<|9M#`(rv;{xB6XIyB^ zH!d>rh8CW+gnsu3`b5uNX1ve1+_=J6iaqlY<~FM5lUM~GVRTUb=Uji@hDUs>Yqibz zysy?6_dCx4=czLV4mwZ0@r?7FHztK)U~HwU%y4)jqk!VA9dGNaml-=4yBT}xDR5bs z;rur{zbT3CQpuBylZ~b-x=ZQPj59|rYd5Ylg z(_m+4#T!RhRTaU_Prz};2~L?}oa&SXj^{bP(3o#rWL)a2%Z&FKmm60YEBut_9X~)F zijX(q8K;~#CWX+GI-uc&ml-=4yZP!k<3y)SGEO$Sp3p}nOf$N+P(vvXgTV#{-}<+<4MTx@wRrWZfJ zRmpQPa~`4OxtMv5Q1V>Nc%eL!=VE3%$|HF$hW^SUc`jyb1uf6T%xAc2c`mj*7h9f- z;fwM}o{JfIg_7rD`~`T5<+<4MT+F;33NRMys^q!Y@?6YVthlLac`mj*7o+Q-gXOu{ z@?6ZkT{%rR%X2Y$NwtzZ7c;j}T=HBDe-ANwNuEnA&n1@U63cUm<+%iIp5?0Kqy%n$ z0!l(k;Ev*w=MuOhlsuQf5nYu$m%tIB=Y-`sVR=qio)ebmgylJ5c}`fK6PD+M=Y-`sVR=qio_TWwoJz3behid;PFS83mgj`!IbnHDSe_G>=Y-`sVR=qi zo)ebmgylJ5c}`fK6PD+M=Y-`sVR=qio)ebmgylJ5 zc}`fK6PD+M=Y-`sVR=qio)ebmgylJ5c}`fK6PD+M z<+;@ITxxkPwLF(vo=YvyrIzPX%X6vaxzzGpYI!cTJeOLYOD)f(mgiE-bE)OI)bfm< z9}-mx%^w3L&!v{G-tdedM{r@tLkemN7f|OVVfi zx%c>4bBuG1^U$sv=qY!DxlUQ&GV_cJjrqn!M&1fU&U^iorA}F9ywAAYxWah9^E_Z& zXxS#lBvIlX^b2h+D(QvD4zRkGZIV+9NyW|=;z5!mh1?!9lowMF} z*g20F8;pN2CEqoDPCMm{%Q@@x&zyeF>F1r^;&@VVWJcIZCDR9?6@5_g)~Y$Oq^p-1 zI~cE28^bQft||xVQl1`8NjF}t=kjI-_~qWZ!M$}uc&)EqXUy zTg}ZjgiD=%pK*oJTt+8|GHYGub&fw|Dy?^!5344T8&w*s`1@F=r3UidY;WuYPdCzo zR)I0J>qdISC!pqa8?84svWib3KEWwdj2aC$vTkh+E^u69;zsL`jn*L>twT1VLzKSE zc%N~(afPwM&wbwU{lVqrltpVJ(j`3O^z+7~(3)hUHOWS6l8x3R8{xIC_ELRV&k8jo z-Ds_{(OPArwaP}ciqc(wc%-=N59JkK;(H$^{)AVuPq5OQNnAVfPq5N#1hpgo1S?JA z_@W30Gp~38zk;dYPN(eReOpi9Swodm3Mha`1*^4miXqLwWks_{r$%mgMDNrE#b4s>b``Y5ZYy^(EhR&?VRF zDdDS*zivF_Jck`W;&=l#kf&)~J@_lf-*Wof#$!VKE~>(3!q)<|Ty}#k*bU}@R~tq7 zEkQY}&Ml_@7Sn%=>A%JF-(vc2G5xog{##7{EurYY#q{4|`foA)x0wE0@cmf9RndP7 zPgl-gQj;y_#TIINDts0>TnEZp@~kQUEahw_zL&e6r5wfio>BOmdG{Q3Od~Gd@g6F8 z_guIKo>nkFxe=8ARRuX`fTC&z&m9qNr@c3VR~rw|>h0_ogS2Z2I5>F+_*I^=9o`9t z7>7d7?fA(k<(Xh1SfLVVyYAW*+zIYc`P8-^-0z$(8*7bq?6z+=1-6IvPI=WOh#K3& z*Bw9P^drUwNLT{ZP700$f8eOFC;*MaiBt46B`r3tI;eOC=H_7LBK z&a8$4!kxZXy`b8Dch%73&%}9q5Ge1v>QLTy)uFuas^RQH`n)lgtGD8IYvP=0sSq5STu!$zmb`>r~a_g!@;@4ISy-|hD9 z#%}L!><+GmZoAnjcoKXTI_&mN!ERG#H#Av8N}Ujz>;t7~cZbrnyRB(=Ths2grrixq zsz{fn-3?8C1WGD)TPk)#6WuGC?6$t$ZGF2N&%yv)K_yEA?}iSFO9St=B&i)a#_5vAJ@mdFU^RXnduWAHq61Ow=V-Xs8gDN&R9qTwuXWvCDAtR(yf^n+r|qTh=&E$oUc3Q?ZyTkN_65?( zH69;pnBiPUT;pR+umx>U!;F^{^RC9ct1<6t%)1)%uExBpG4E>3yBc$?#$2m0*J{kQ zny>~M)|f{%w2`NnM>XbAjk!}}?$nq&HReu@xl?2A)R;Rp&>@?9#hn^+r^ei=F?aUU ze@}$_p^xx-;}GL8<00b_<6Gd*ZPER?ExIqG8J-MlN$CyBN2QjYRS&)ft!k;s(eMB* ztp?vj-s&j75tL76UHA**Ve-^Pw0e4lI+TFd8;2N&vc7l)PAOd@-7D}&aq;~Xo>dP1 z63y@mTvPfHqa@)KD4?rvIYpB23Vc)^$-_an;-Fhm?^e9(ar4z6n%o$^MxEDzwY23m zu1)}dNh@B1!b;Kn>NUz&ywP|R{3Z3T1+O;_F%C2CH@?Qxe@V|e3LbLGVc&Hm*+j}) zPI=pS41B|-z2VZ{Kw_1m(%ygqLY44_?|LIt{zK-%A#>pnW92$h2J?wiA``*L8_b~S!4G;U?!@jq{_cr+62H)G@ zdmDUjgYRwdy$ybDgJq+E5{`xqF5yjRel&cO_LhU!GbenLo`UqyYNZS_?l->VbV=8n zP(W9YBsYWd0e%x|DCKRVxcnxRDGz_;C%)x+zU6wp<$Av5dcNg)zU6wp<$Av5dcNfv zzU3PJ+7i;}5*l4Xqf2OX35_m+xA#F|q#JrR`iYG$;cegbw(ok|cfIYq-u7K@`>wZr z*W0G*QRhGE{70StsPi9n{-e%MkKrjt{S;bBOON@kW4`N{?>gqYj`^-*zU!FpI_CVp z4S&Ph;kV&&B>8yIDfw-%v+-HxhsPPgYrzVogug+zA1CL+@OK`we#dC_LijsUD#G7; zPWyY$X`8}7Q06s`-C-?g@X*E7<0$@8P|1mojdU}r|m6O4xY z!uJBr+u!r3@t)`H?|BCJ9_{Kvx>ii@(JsZcVtOw;$vbf03qRzE?}euv{}?^iXq ztn##Hm8V1PWuFeuLZ8#&XO5pkKc6vw&zQew$WsxX;c7+rDRmeLYS#CuJ=Q+;tnX9L z`abon?^DnEKJ~2cQ_uQ7^{nqx&uu>StnX9L`abon?^DWO7=B85H-euzevUcYr;$)8 zk=E4htYzb@W#g=6<1Ba8hi84)S?B!B^!d#6`3ycT3_s&3AAp*Ze-?hK6u0!V@ErGk z770l?XX!fU*~mF_@SJBO=gg6FaAZYz&d)l>vxXD@jC;@V#Npw2bMQPlZzQhM1n0w+ zWPL>6s=X0pfG8ze~)zC;QUv1^9t$ei=cSR$u zd^JTajijihAT0%HDM(8rDQYPQPeEE5Nl{B9ygkOKyHb5us_#nmU8%k+)pw=(u2kRE zCUQ09w2fS5?2tS{yc=b&WZ2o{2APQTJAU5!1As((kGQXA>)k~_QP&MvvLyevpp$(>ztXG*>% z(%B_FKa%b8iRLOcLLvN6I5y*%PG9rVF$ROiIovu7n9?_D&sDp%jx2By11M!E~ksj>0+*RGmpBNN8QY$ zZsf0zbTfCl!5ziLoo=*6*p2pfi*%=r-OQtI5%H*7L_F#)za0?29gsIRgLtQavE+IX z&pmK|a0STQazH%vBHel79pL53Q(&6oS32I+D0%44vvgI@>fyHcaNBwB0W{>j2hff8 z9za9hd!V@6-otJ0;kNg1+k3d}J>2%I%)6_2?up1%=Gs-XRPnCH9!AMqx}~nCu^0J2 ziu59Zz2glQ)CCNbl|ZaGUhr&fnYldpmz`=kM+Oy`8_0Ti3^} z(|4lRMfgrMEz)vZm~cSPs@gevD+mvgPlxz^=e z>vFDjIoGfaCt;u{#_Fp z$bBn7-g+Gw6uAxx3^sn%Wq#FV-e8%z!7_7$W#$IU%ng>A8!R(7SY~dp%-mp^85$YZ zaw_6)4uaA!!~8_fZw1#yMugI_Bea5u+=y>a4fws}A#gf8)%R15fP0*NAo&9EI^#*D zhrN`Je~xg8ah2}EXGT|x94|4J8aI;uJRV0gBG2OkGb4iaCYcT5r3vzVVelq;bQOD= zit}Y*@E)hkG0rveWnt3i8#&cNoG%N5d|4R88x!Qq!XRH3205DpayAF#%fcXE7LM?K zY-5Vd3BOcnUL!KNJg-2`sezog0y(D!;&}z)c?I(RF%Zuy5N?3C`zq(uh;vR2 z{5%1N;(rD5=C{@ZP1}K{>Oj+TAoN^E zy68DjzGtlmx{U)}+kvj(KqZT zYE2JK&IHi_t-pmlH-em$0XZoHaz+L`Aw>4Liqr`?;R5omGmsN5Am<=J&bEN~ae?c2 zV`0D-#J2^lf-t2W@od6{co!Yzo(2jCZ^wJsR)^tc&TL(NS@1J-kOGxSsF&3?+6; za1UQ0$>+R?&Wzk0EGF%L63Y+rjCYZ853$@}FjxLQn8$zK7DC$WAct#<{MRggXK_y) z%qHh;{LbdCSzOh3cX|dB|8mC^Un`)TySQT-f8}%cg=h5St3rdR*U(E!(EWohx&P9# z@A32RqWr~_au?5@70h?Jb4gQsbS202_**TV&0P!d7|r`j?kxVE&);{^;(NGn5%p0! z7n3%MFE@V`Nz?zqWJObQI0_F14TA)3sg7(+fxy zwN%>+t@=E7Pf8G#^SGYxr>ZuhGw)oX+`qOk16ognM?L+d{7bInxt-ZOC5wA|@`PM) ziJz4P{_W>psE6`q!L0&QS5I9`-Fe50>zQXhsurS{uIgF3N6!&G6q{v~1bw;Px<1dX z=*M0C$srETyx6|KMU4w}|6bk#o>DeXyp#b-&7IQqG~i{}5a?H8W@AL})m z+@DiGExFJZwOrDq{v>I?=VDv4Nm=5SFChH_P5&d`FVI=i{a2bw1|-=R@Pce#h!;@v zJh&vfs~^O9S{A>b^Gm&89yu;8?LTs;721n`yr+4|h1i!cP}Y^zoyeQ z#Cvw?MLgCiM!a{YKE$u>w3v87rvl>fPRoej*Xc3hKTi8i5T^Y$?USHY+UfssD|AYM zQleHQ=mULj3L=q=NJfwnxfxnTpwc3+Am!d5C1q*KQsVceJV1PP%7fs#lv3~?Qyv3< zobtc8`gqEd;7?P2N=kW3Iq|1b{+akQDbEsrE~O$!f!aLHbdIzcWvXVjxjl%qxuebZ zgOoNi+RPySVVjSL|9hK%4_7V7}v{P=KTG&4PW6FTw%DeLKni;H|nLB$((44h2e_rtC>{;<4VcXer z@`r@6+4-~PhH0}4h!4z}H8Vf_+T5J^`QfCwx!FU)o95lMpl5i;yt@|XhBN2Sn?EFc zWd4HO+2Nz}my+l41^G*dggY1CHLoCicJZuvL&9Gy&bjNJuwn5%GZ%-yT|A$Z8nkrk z-%t7boNMfPF;O5-afc8 zxaMN~vf%INI~Vd?9&`zMU5s~N)Q*|6x)%H;mg-o?pd0-}eE;IrR;(IA=Ai%a%3n)} zFm`wUPjf)$Ae=hoJ3Yy#@>6-=b%egzgHzuZ{%%9-(wJjh`(KpvpVi~9HTv7JzFBuI znic%3@dM*2^AtTMi8{N4Py^XG=AjAwx+dbMQp{~{Ja7Ovt>N&OW__}?MT zU6E5{h_qH*O+~x6L$)rHUjLhE5&8l>fVTX1e>*U5RsKtV2QdG;J6IV!#<$b<1g{3i z0^U^5`+~bOmW&D~gww-0;j-}I@G*Qy_Jps7$HG5j0lWhH!7%ja)X2S&ha#II&#=n- zMdaP!BHMjc=N;@_R3{`+&vlB3h$3#D}$b4gBW-sxAD{7t@S)jKI?Qd_6)OnoKw zSE>J+`a$X^Z6>yv({^6F_U-z#Z{L3MWoaF{c0AT8(RohVRcU?G^8W6fE@QfX`>HFh zs=DU=lrug1_MF%=zvuE^gL{3w*SCA-_Zru0ZLgiZYGUVlckJD@_u$?)^A_6`9Fof$MntayP9slOuEfNM8hH|e^E`VZ(|`IYGdgTY@L zymD~W^?gWRdqXiLtffZ&ckL$qr#$`-sZ8rT?B-$j4)6Z;>qoX8c}K6oX?;iLj?5i( z$LI}XUb^vX?b`RuSLo37#(Cd(gWBeIJoe2;zPaa{|DurA_wQpF^D>rY%=^1{dUsS9 z|N8jXC$#>~#P1Y;=kRyVPK-{RFmdt37kcK8x?^PS#C;QAR#~^uYW>n~{(oMpTjorB z;g**sHBb8UcO$*NuBRwWuAKaGTHjkIPaX346F&d#{_Uw>pZe?D|9r$@j@XX4${ z?>;;`EobUIci(ehPV20Jb1t8Awr76!^to5f9Wr;!+$oN4p8NFN*XKnhPMFtc-lTcU z=he(RkUf3gNAs^Bd~N<6^JmUqIlp-Rrui?=|Hb@<`R~vFB)8xE;@rWxQ*-ameJHm$ zw=(zFx#t#iTyW=tWeXl(@alr!F8GB1%N8ulyF4!~uTS2Pyquo-dHH!2c`xLBu<+`I zlNYY#_w|L%{Qu*^KjwXq_d(D6{IvXm`CrTbR{pn$-<&@$KR?S1fMsnO_hTjEa9NJ~Mt`$pHS}x#aF8mG@4FA6S}A*t2Z%vS~~1zHi*}_RF)E zzq8^c<f2&~BU;oEv`hKo+<>G(J^8e-UT*${$F8t^E=ehmNJ9)02>}TIQ zLH{q5v2>6AQ;X04Pg}HM{Wto#p&r@sj=*j8ZM`zw`d5@89=8WaY4x(^hV} z|4#7P`}eJUeO2pK<5o>yb+1!iUv)1jkFI)Y)v47ftJ@Rf|LUt&k6Jx%b=B&_t6o}t zjK2=AzG_X|H8-z1#owdWEMD_6smGL))V8Z$TJtZQa?Rx1bkq1|&AWup*#GarzGph& z8sdxiE#UVpY~kNXZf>_K*}dJGLMxb`zb4PifjzeM;s;bp?Bgx3hK6MjkfHP8JQewzsI z5R%F6?Sqz8?Zf1b_7UQ#gm%O)=Qqml-x0bIy7Twd{PraDO_sI)O3U%~H;^`*FoyUy zN&7Y-Be{dQ$SvW_Fgu*tzJIVR_zJeWlwc6wZoHW<;fy7WBTOJnAxtG~N#21kbT(%y zvYGz!C5>bXw!9SlptJFU&c=S1g1>V%zRlTqHfQ74%sZmkbLTsPSn^WvSqku23QXT0 zx4iLxq~E1+V6bzT>1 zal40uTiX3YvaH>sgnvxdw)>}Kyxn8L;C6fY{WaH4lKuhVL&8UdkIC~1;WXh4;ZyRR zC45FW$9?AsEvyLJK&j2Nelzk4RHVLJP($;9;?9DM~x zUz_252)z5Cf;S&j;0aKrcdO~mYP{2+0y^@w8v@@}HXZq{GW4o|UKP-*0vq)pEYyR- zI|*3heF_?S(4QOV&kgkD2KsUXZEv8>JLu01^ydcpYy*9^fj-+npKYMeHqd7qpvMmS zY6E?>fxg;6Uu~eTHqcia=&KF%)du=$1O2pte%b)t8lYPPbZdZa4bW)^blL%(cF=bl zg6pvAjMfeoz3q_fL$vFfq`Bo!RsIPnR-4J$h z4#}EM?>j{AJ0v^0-=TyJogR3I-gb!Ic8Ffq)b7X0we+$kv{VyXstGOCgqCVTOEsa5 zn$Si~Xrm^yOH=zGxt8^<&T#AOwoYzi<3~;gBM*alt57GTyECB=--_b>8vfqb2n9Y9`IfYzmK97{!gg{y;J3C zxE15gOd0$=gOmI}B-}~R`y=$0h&a~@xwekLJ5M-C(nuR;qoL8vXw)Z(|CCTpc#7~e z;hzcn2tOm#5PnVGWO6ob?cRP$(5d}xgsB9+cHe#)x}bBrRmi^j#$yD&V%_ei1in|@ z?kU34gnuUNBm9g|Lr`BiM>tPtAtbT+U#}fL?e9S=zQ_oz*x%Fcp7!>%v&UJ*Moua= z2JGo+M~{6}K+_ce05uaUETjp%|U=z%5ZfhC;p zYecUW;3IQ49x`{M6PD<$f#`%K=-JWe*aCFJ62>R#*(Hoo(zQz%ry3cb8X2D&Iin-p zyM$9Zjp*KLbgtesI~tw4gmJ5pQ#y^D(P`v_j&$%6#xd#PC5&a##Y-5^8owx+cy95n zR8HRW%+N9E|^a&&Pyda3-s zp_j`4OT9$D{gQ4fM>mzDo66Bm<>>Tsbb2{Dy&Rohj;<<4SCyly%B`#N{C!J(!Im$Y zAPJk1gw068CM4lez1tA|HI-5F&5NUC6}o@)C8K0E60jKwDAKzOk$^`7eYa90ChstW zvyZ~rM;Sf)<0UYO(X&4u0;Az_5jrpX5>7v=Hx|O_NAMdG)?QeU+z>a`Z(Qy=_qM8q}Kxi}}@C2KA1?QhxP*LB79( zX1USY^dHbej}kuT^pm9jlu%B1itseyp9y>6#6Et1M&SF!(!z``v*F-uI5-;)&i>Ch zh$gxbUh)16G*JPXh`9|T$%PR|--A7Ranxxzv~H% zIE>^+wS$ZHK~sNW)R6`{rJY+Sa}-S^Eu^`|(Tk%{+5eAGsEoZ8JQ3xGNUimCqEpm- zwBBgPSXquP-HhhZ8z1z(haxmj5t^q6%~OJojnbMZI(9QUb~8G5GdgxNI(9QUb~75N z2n|$(1}Z`W6`_HO&^$$Go+30)5t@hh;1Nn&?m!oBmKP*ci9(eq8mI`W@HHd8_QzY7 zpo+d!bPA1AgtjR{(-c9SDEfIb6pEssH=}v2ww>S(k}5t@Z}e4(lIZltx`ueT#T#P7qT>)ri&XFqSf zgW3boE@jMg%Fz8~XqPf(J7ug~_M=hCnCXZU0~iYiFcu78EEvF8Fo3aO05hO6WZ-;k!6L&fC_yC;c%c;aiGZP<^`~+D%1ouwBJv@53zLno? zguPrlklchUZi4D3p!x}9@es233DiCTrB8%C@z{`8HxTp%1bzQN zUq8^d5A@{&efL0LJAXyP%&7(9Z?IJ(N9% zFqbfoFrU>-F28(bL|;76_YU;61AXg&k^4A3bpoUJGy2AXzHp%L8|do>`nG|-Y@n}- z=&J_$rh&d_Am3lTV-o#epf4FP)6d2SSZCNig5zD_co)Wn0>*^`eYrqyoWvtoW5QHc z0(?WAyu59ax#UlfhAv1$7iIzlj1L8j4+Yq_`GP5VPZR%)YkZeLUnO8%CvMFM>jL|+8a_dxVD5Pb_oUjos0K=kc_biy^{)mzW>{Q-S_K;Qq+*FW?IOMUr6 zUwzTHKlJ4fefQ&5()6_tedR;%x76D$^=?aj*F#_R&^JBwMGt+?Ltpb)M4H}xwv^xd z2>OzTzT=_3u5WnoCOgKNsYr1bq_~T}8ldlX=&K#-_j>oG`o7+KskdJ0OC9=72Vd#X zR|1guaqU(U)+8@$_aMK8gtdfq{QVHW>j}~mKjQZhLJ^^uP{Q>Dzoqgy zL*I-;-(1#i3%}12o}&&GgssH45uPW!!1W!3orD(&RfJuXS54SW*hARMv-gqrXM`HU ze)7CT_&MQaLM>?r2z8YG3gIB}Ul8hvzsmL32(J@E1YNp>o={6qs6~=%k*->#s}^agWwkJy5uz53)xxn_I93bC zYT;Ndl&*!+wNSd2r`EDkm>v9_vAUkIx|}CWLWk9$!#F{id=wq_5jw2q;yQ6O<908` z?a_?eqZzkHGj5L#82f@-2~&vQ#_v>qGx?RJ?hbxuQf3w*J9z~C^bzCtXvXi+=$%36 zo%I*>iN1mU5#x2Q;K}45TMsIz&sOf+M%d1^O2YHpCu_n1=9zWG4|1)ZaF}aH2n__S zOJyNEO})<&$5Mz6k^YeG;0vjQ)>vWMq64mE?CnCp$M@peReE6(dO>=i20c)N9;iVN ztVa*5M-S*7Wsin>BWf=9g1QA0ZSGiU}oLPw-pH?*@K1GN&vf{J7;f{dFzi^w)CwEAv^(`5B>xu%GKM5q?g1nNUj^2MCRS5hTKei*`f3?{wT!-6Mqe$XuU?pYH1hj4;V9u4;Wvce5{?soNBBMA zU%0=C@DAY*{QWNB1mRzK&U=LS3I9fDCj2|$kAy!FP7(e$;m?F*awL83IDKxd=QWEN z(I+vlkyWR}qqeLfyh9ghuR_|ZkoGF1yb1}IrKbd`E@75h#4NRlS!xlp)FNi7Ma)u* zkn$>|yoyYTW~o&dN7_xyR;!q;Rxw+xVzyevY*l{1*+_p8(qCZd=Ut47Y2$S&L-WB8_pRF^)9Gk;XXE7)Ki8NMkJ$SBu2e zB5}1yTrCnO9Ti8y;z(E=39CiIYLT#7B&-%Gszr)wk)m3ps1`}6MG|U}1nIN5EFW;R z7LM)+`q?tf$z!Y_E6{7l(QC)iI;H5f0rgfuy%nrUOVJg_ z(G|y`;0@@6)p0!-~MRd;b`Cf$mxaE6z{X8mHYHATjXyJ@;3+h zn}ht#LH_3Gy|%P|pWbP!H`-p*z>Ub?g_RTUv4tZ0^bT9k;&^{8Gq`og;DuEb@2!PG z`=HQ1Yhd12dr|uihg$of);?sD@4piChFZO!R&S@(yJ@>6=Uk$F_089PP;(#D+y^!H zeM$RnM*H@MqWhreKD2NDOSEr)v@hRx)yj%z@Xpzb+IKiID(x#d?T+@1qkZFO-#9Yc z9qk)O`^K3?tz{M!NBhRnzHzi~9C_}J_KhRc-O;{rv~S#Nhcfd1xaC7+ygM2=j+}Q# z1IN+8aWt?jw*My$+#L-ZM+3(%(ZF#ua2yRBr$2P3KXj)*bf-Ubr$2N@1FuB`uSEl| zMFX$>k_PTh|L9Kt=uZFWjs}jSf#d%ld*1>dRdwxs&LJ=6oCz@^V5ERZkw!#}h~Xhg z5hKME0!b;2DRLv1Oy-sMfVtC^v;PrO2fe5D^h*pnxf*KoKD# zLZmT`H2MB(%}hulh}zoPUgrGP+H3YXXP>>-UVH8L+TAp;1sd4m)4&lZI}s>55hyzm z(7+aGU<)*`1sd1_4UBmMgnu0F3Ba3xCcy6jCjox|oC5q2a2oHQ0h|T=3IERl-U6Hl zybZVjxCm$l^zK)^hi_Z~Tm`fM-UnO*cs267D8Crl?L3ZF&~dbaj-wTH9Ic?^tfl** z{FbtI#>rGDvwB!XnM5{G&}XP)?M7!((TP-a9u=KNg|>NDdFzXE(;_^Fag&{Jf7985 z?_9-quHrja@tv#q&Q+{6z&S4H*)Bw{_B-gMeg{2MIw?hu9w}@$%3%}7b9_#1lZ*ztGr~B7i&_dp?0_r z=^=|6f8;cg_JpsSANw@Lq6Xit5oUpV zSci`k<8)ryfydnIJ~oY0T6ugLr}0AHwL{-|$Ek4&FSwcvu9gCqf~(2kYAKz@degD$ zn~hQ9+*Q=C*xN0%gWFr_yj5@;wn`AER{-bm4V<+Kj+gS-^oRIQW7ECIrD;rhC}ubw zz-S_!ruq<|_n0(|N7Gm|jYHEpxis!fW6pVakLPI^su)NtH5Z)k>ofAVSWcs#6a$7nuFAZAf_RRNf2TZgqQ>& zCP9cv5YI+Kn#9L>Hu}p52`wqK>Af?s9+anWl&5f%r~6T!mY_V{kMUU8K!+dpt%%sQ zB4W=9%2zm#*?bPFQ3y=O^r4ppyN zQZxQ%0xCK;qE`E2%#32~0rtRSha7UxJLiaXwkRq75o?+w_0D_Vd<2?CpM4|GsIh6@ z>(h-oYw^~n@Baoumo-6`H9?m(L6g3!M!Ei&X6XJny_H=`a{C=P{$ zEQC}n#2AW-aSZC;tLWdW=-;b&|LejvUeB;lxW?-if;7Rx7)^hSquzs7>LAR}423%! zb9MdkE!1k@4o^7XAW9@Nr1Tk z%oSke51p@5Dwg5C2SB?~r*u~Ib)b*z!f1#G;9UijhL&6!T5+@z=moUi($I2CLyHX~ zCV2KofLg$h0qX!i0j$Tp&44X{dcZFL4S?;q_rHK0fM4VPPQY&fy8!zEuLBMM-T-)4 z0;QqFl!g{l8d^zP&`R2ZR?-%5#ipmc(1~SUnVEzbO+t)lJ;DRMW#*2&Kt^sRFSOg+zY>DhmU&C` zG?d&p^jmw&O%if*F2*KaMBk8P=aFNeD6EH9`tX~gZ?dg&%Z?-x|w^=G#>Z?{?l0Cb+{d! zzwPRY4gyVUR-T5GJ_C9-AQA8lfEkbp$i;nsud;&nhx59OJH5&M==uGt_a?);)w{In z;gi(6)T5$$w`<0h>Rs&Fp#I`V>)VAQ^%-wb-=en?iCXVr>|>^NIZt%FB1EHKIsvue zL})kYKVdS;(HyKe`xaz88Gg<9{{d<{S_3n@;}xtuY{9CC7D#RdB)0;RixFyJ9i%rO z(wi?@@Js>j)7dw4=8Y9#hX!;2oH%`m*0)rH{tjRiyE^QHD)cw7iv*k)}pqo#rVN=%(hI&Y|C`awoJ!}?iP$6Y{B@! z7K|Tk!T7-zj2~>d$!tpmT4NDtjYXhVtwqn!y9$c9UD1u(SeF3q62B)yGu_}c>5Y7F z8f}jroX!WQ^TFwSAEzt8X|z9X%ITRtPUF-QJX4K%0WYU#`Zzt)$7x#K`0vAMItjOX z&+pUqv0R;3A#+!`2e<_8iva2gz67`TTGtx*tp=UW$l_J( zG}fZD-&vRS_g$Cuef0iry%q~I3%%B2{RPjr13m=MS}Vm{A3ziMMitQ(nS@cbTaPGW zjsaTv^IQw;?Gu0Y^}w(E{pJ`j_Ww!e82*{_3Eox6G|%<-nM=4ck3ciI|6cP5kKc5x z6Q>TMN7I5nXbaZE2cb8NwO9b0+J{l*5R53dU{<$9z?pqQHUMXAVm7S>vuQ1uO>4ny zS_@{=TF~=}!H9B8_i4a>w)!+&I{lE&KBTh* zF=HXpsfTo0Ae|LRCk5i1z?+W0_U~GCNvj@xD;+T=R?91dyz4@0F&A5lx!79F#nxgj zwia`-G^<~WIoDduxz_TEnNEyO(b^Ci8~f-C$;57>mB)Fsav?@6{rf*`pl`DW1pPhl z-j5WFAAOPcdd&R0>@c!nH_^>@8FkxX1de?CuA+anT}03R&78BL$NrDz8ul5Xm43^8 zSKKE3JZ2@nblY}>4J&3HfKRx$2=k#m_Z4+-M_^A8O1CP|c=@N_VKncyZCBb)aAT+4 z&G!)a_YU0H4RY%}0=L>5@Bnga1lIJ^Nll-0Ux0V_UC%uMv>%}RJ^K&@L#kQ>)ltTf6-T@w_zoEw-xC(=0UKU`&KK_Bd{8rSEFP8<5sKCd#^yp z4gicY<%!qF}XxU&-d&Pw#pb0vBoUT@+ZA(qI&)bg1&c>>nMbJkRdgvqCv9I)iK+TsnV@&W+lLQ>N(T zsCqoR73(N}g)xlnSV2SQjnQdizd?P!3-7#wvo+|fF*<3C&KaXq#^{VOI$`X$aOre0 zI$MlR7Nc{;=u|N}P3%ql$4O#XGn53IDbqE500DqNKoB4p5CZ6n-9j3;GC%=n0il3? zfH2&<3vM{zZa{y`?%x9#0RMs5`7j7`V)w$0z`Y^x8;X0w@P9bQe8RxNEN}((9&nb% zPtnKPh;>1AaDRz@)>gDeeuW*v+hC($2VAViM=Z}Ec4rWaGYIj_M?z@uh0xF|gzdf% zY7s&sLTE$?jR*nf3U%v4c*p`hR+O$H>+`&#ia2`&miNgTOrZB%DV)~y2F?}3i9ix; z!Xt+sLHx!7q5yRA)Ht}m2GGeJZ(wcgA<&1BYjlRt??9gbG$Fj(efc$fxt71&554El zZl8fxzdnG~uMc45Ev+{m{)Jh^7mRhtJuHaOYOk&pUiUycyz4<|pMrP&C|kJro47Fp zZ3>ztgry?Pz7zr$VFx9A{&L!}szei*B5aV`q@ z_AvIWlwvo@-(yDc(^z@vJ{EBpy9Gba!o#gba6V7#4*qeD+gNt!8u$1|T6GA(&Z|1C zZn`nT@c^%sjf8|pVLj+LtX3G0b?&qtbP`}1{?p31uVJlvBL2^V@3-M*0RA7|@!Ng) zAJEX$*s*jR`EeZkagGbevCf=I$yWdm0jOknZJJ;iYG|oD`>F5jrlQ85!cz)HTO3I^c(=q`(?oW=$v00=KR_)=hucgzc$SIwQ)`ObGZK96m6jY z3h3-?!`w~_)}^+HTEM;dKOGPcdL|$NfNx=KY8%$3wxOPC!#rObN@$z#>OW=fo_1yb ztIyw;Vr960)#jbOfd1Xs|6X(WC&fU{|ea~`Dwt&bE&?lR} z|L5-{9Dy45%h)k^s~v^CcM>N3&9l5;R12IRGYgFV!slmwGn9K@w9lrS4actiHg>d* z%Fw&5hPxQBwArzB;S0_Khq- zHK1MiAnb$GW3SI4)T4*cT0MmIGlx)*9zs1zmZ9ieG&&Wn9u^boVKJdzFak^fGav)c zWCF4P*?=4X_RE7C3$e!L5bE1QsBaIUzCDEcmgd1%32X4)TCD8dfdBsw-}hRbqSMnF zu>R%{MtBZk4bFq8lWiEwsKRb_Izg=gI}r|{93Mj6d`J`keJ~CX&{>b&>2#7>J<9eW z)YpelUmrq!eMlUJF@oWMr*S_H_mMV~^Fye=525}(g!=ms%K0Ib^FzqBg;>$D5PNVJ zqAov#y8IA!EIbI_H^6d2J$9$l8Eo~a-^sq`7uIq@=Q`xwW!u5cc5tp;pz~i75W^=Sd#PBBbOdX=k6?Go z4y^4yf)zP2srX!Hs36R?fklP86TN~td5#)9PI1vv{#Df#@;6yw)5f7P7777qX zA?PANF`xuc3b4Z82CxGhfETe=Y#G8|gRs_i-p8`M5$XCFzP$1B%_=pLpSZf zZs;70(;PuA$74PH5#)3{tUKh0x%g%tzDZ@M5dVt-r2y~{WhxbA%7!wPiZV3;YwV9e zI^v}#acbj~&SI3WJNtD09ro#rM@#QZ7@4J2Qmatv9q7AJP1D+?o4$sT{~7o{2SEDi zn^?V>0r#Uisud-&6(zD2C9)MIvK2bYfzs8AnnLN;duv6BX+>#iy@{S`74Jv=`~U!Y zv6sGTg_O5K!doH9t&rkYtk?{KRJPu9#pWPxKYa(~*lU5DPL(GM(3xV{7KE1jj{K8(R1>1?>=-r@kvTZD=~#h#@)z*b?V5Uj!2 zvnCJ_3{U|50Cxi-Fea_x5q}!(_mA}7YLtJ15CDs0cXd7py+wO@A4HtDBhK3~gK`;T z@3rEiojS~*Tt*riFoSX#AuE_iP>`POh{=mR%9M#ASPf|Bmy%c z^8`_RU04fy6kbd7dQf_-N=y}M(HHnz^6Yiw=NsS)@(yWhxn=$ZLnhhchc7>Bko#{U z_iOOxo0$FRmAm3L?A{JSYv@VHb1CjZYQX8&g(r}@EjS?nr4(Xi>E#DL*O?QF06r~yc5?y zYw6gH7O%gA^x`&RachqEVXplWX~kQlbFh}0EZKHjQw?rafLj&dRs}d!(IwfikOuBl zU{j3ZsoM>yi$v;Qg4FF6!jLa- zB3~#kmZ0>ep!BAQTM(yu_-(`d45bL=f@Sv}$nXI0&1+L&3wXDMSIqh6K_{?<(oa4Q znujmv-DVziAWHH;#3qmBi{?PLbzZ}Xau4^I2c?<1Pdf*C9P^)Fgn7_uU88S9u)1Y! z$6B<_Xa@N>&m8aRaADTig?##Wowr`7>XMG$dT$rX*%WCv`tKlSpFd6q9z*#e zJ@_Wx|3~V=fzTd$%s9P?v)sH^)yP_!SCf=>lh|66pi-99UqVv13XgYb3(^vPjc^S0 zl20R$=7r36*FmIzXtteZ+DYH|^$F>b69Cd764o&X0u(?5)-#JZyEhy&Bi-wzpJFci zv(!yHz~4_(FC9l-{4??-1ZDdzaPBSWqqm@s-hw`Q3*34Odgm?Zowv|-^4WBPHhc}5 ziP{Tq;uMv~pt+A=XF?#}JkE3E`_RTdOsB7)-xQ88m*CD4gt-LI#vt4!tQmg|*Q@z! zQG+GnTTAe*CBA$mUAKhu^#ojKdqLtlC#>_kLSKaA!MlhB&DZ1mji9|X;A?p2H9Y^C zpv9MWl7m~XcFpo@#V4uIArzlpEcBF;Lrc_`ksh&R;)wP@c^+(~|G5ogre;IX$h zs3qcKVbKdOLGg2HNzKv4w4%$fX3PTZs z9{i#icd{nA2XiE^z#8n^2>Tu3bv#jncQ$kQukmv|TUqa*7I;@!fl#XOTpq_D3*02# zbYrc}+bDCE|ILwg*O`#db)}hj6c>{04OKz74yoJ_P@1O{Tx@|HG%M z``eKAzaURPgnPa7nj{KON3}}Kx4R_4>-!9dW-Ji-&?TQ&<`cxu1*(nz$FEvr=XlEQ_d2;()hvc0P>zJj{26s<(BTwo=JB;#47bGM`wvhZ{%!rG0nb|akK z95agF?vH(csPFw0y#M4!-dAo_YLSZLzEtn#R1fB~zJ_vgqnvNVYO3kzWlqOxs_D0U zqbGM{aKOu%*Sc|Ls1(tQJ9nYf`Yp(j6{tz*r;`mKve4KcI)P6>LJa32v=;Dr9ztsY zZ(4kOZXrGk!Qdcq;4NS3-@+4bfqRs9uW|08gyH^WynPw>E+eg_QUr4CKF~ut8K0?kT*O8kKB7a~l3ZXs-+tJXgw~s%b9S1x3&_p-nhfXeoUWdeT-FZLG z&)Fe-3nR?QkhBz7o!N%}d!Qd)0lWjNGWTP|>j6MMz=3+&1;6jWT>^L!@ZHYevYpYt z;fw;L(`SvXhs~$g{uw73Nn|}zB0H1PFHy#0e0ux;rY6~NVb5%xGP`s{IBgguUn-RyDr zcf@(mo~yyV)qwSY&44X{dcZFL4S<{52U5Kp`wmy~ZcVbNeG$93FJc$>MeO3fh+W(l zv5Wg6c5z?CF7Aui#Z6q=jXj6EvFC6%_8h{#MdwBA`P@x=K7|lo&AArtj{s-~;?$xL zoLUruQ;R}iB_jkU7KPx%q7Xi@s1w`~5s%&ITXl;W&m>lYLqEVO*tLk+j{qNcLftVu z+sUWYZ4pKy7X83cuhnp}hwZlc9m{|ndwxSi#2 z*x&AHJsju9!E(3|hg_J4T)-|@+u=m`}YRTKNkH^DM)jJ5O(IyQcS9H(i!2X-6u{CszJ; zWTWj(qwibL{&qkn(jWyYTh9Ig&K6n=`bU6Tz>fjz06zh22mCK!2Y@V0ck=$@NLX~f zDtwtG+y&Y304kBzC2(H^EQd{ajz7Lx0Eck8T{}A6=i}!v6s0I8OunzDOz^$bC zWrVRE_x~5L18`eOMqIkv!G8zuUjm@l()Tjp&xltm-~&J#;4koN2Yd*?iC1Ljfg~Tf zafZ)5q!dRY#gRyHEmG{u8AxIaD3Cpi=49X#7J^xfc3Er&c5yts*F zDsb_3R;WI;#VLf@EeDadtC-8~hg`V}{kn~q)%30$@LK(?L>m3N=(~s^$)h)SygJA$ zgSR?^;pS(i_B?~(VOpg&QTkn>^5$NFFG@PeK-Gu9Ds$SvUhZXzUhWuMSj^_bT#!3(5<{ z`Nl4-{`gNa=>6smS)}-Sc|!9^2$#qG(){U17_~@uEn-rOFW2I(pF{qy+=KUq0)~^M z<8CDQ7s)LK8h5~$14aYWFdCSKQ9!av{1Qh0(lA2dO*7X!uxq?q^AOVYDCS}x2TTSX z1HY+&r}5W1%bK}2Yc7(Y^Q5_&9PflvfH^ye|(P2t^m@+D0i@)yr)5-{38 zUyeZfBEYK%-~nHbj=fZax&t1;g5S@{L9urdc5<)qnc?e&B z81!VgG59|f@D%<(jqgrJ$j^4Z#A6h!55S)@2;mGuID@+?`tCkWfio3w#us?F8~1nP z{%(8$+<``T817`aPr;?sJd68uena;@1lnoHX?la6egvUE3h8_t@C5$To73PI=X+c3 zA)60@^WHa9yrJ?Nli}xmV~cS2Ex+{;!uNi!5#MXX+l~BoG~CI!=lyP@|GS!*$T!NR zMot&=9O;U||EU0Q4D;5Ca027(wDW9I*J#^t*inpy|I@-?oUbt$t3D>+B#6maeKi@j zRR?4CHp+Lt#?x3!I2b+WU%^uF8O)AP24CoWjitWxHJ19$*O-h^8aiExPJ4*L`5J?< z%3}gn!w$yz8iTQB=~q~@^ee1c`W04nOu%UklVJ@u3g>G~#z_s6aZ??+1wLq8{Cgh9ZVz^Ks-Xq>4 z6p903@uWx`CXN!EVx$;}@$b>%7@=AmD~`np5K-bdVW~JloFsf#d|G@OBjnGBUlYD3 zJ}V{&tHe3t9AS-^Bqj+z6z7U_g|*^y;&Z}}#BYn=7HY-k#pi_|i~k}12khOxAnJsl zh$dJ_`I%_J3fW(X98vq&>jSH(BP!?4}oC^iXg;z{w3q9~pbaZaiDw%9Cc#7p93F;u*Y>n`!n zxWdH`#J`GnOBmo1Bcwi3pg33xmO{m$(p}PB;)BvX(mmoRX`nPv{EBq1^d&J;8YbN@ zJ|aCJeOY`|dQkd`I8GWZJt96KJt{paPLdvz#)*@qC!{CDDbkbDlVXhYbLr<|tkfVi zh+mbqN?XOL0hzc1gnVe*ATc*+(yboZwQJ^t3;0Z)l_Hy>3^WKN1@1 ztqoin;Nq;AbAlwpT9dF++fJDO#S8KH2P{b1A)WP|_1fxA9p)Nw_6xbtiSX0>lxWQc z#v2)LV*fgNQ?r?UwlHpByp{3x&cU67H9MI8HRD~3cQbyKLwKF>A;yjDf0Xet_Bp}0 ziG6<0_!Q$mGCs@U|B3N=#&0ujX8aE0%Z%S++(N0=ywC5pGW`M5?TkNU+(}rL824d} zRok8Qaxl{x#xmo6jKe8p`EI8BGaks#-^+9a<1aBDLcEgiXZiugUuK_3rbja#!}t-# zQH&pBJf86rj3+Xl#P3dFdMe|m7{@VwhEgZbVES3cGa1if|2a%2GCh~+WX8|2&wQqz zXF8Q>mKk{w(`o!&J<|rp8Jyl6#`%nk8QU1U7<(93FyNtib_y>&toAHkruj7!{ zGv2_MrB1G6dK=^IjCb(!I~nh1e1P#m#)laA(p~QcM zWlRZYnq^EG!1O>0S&3l!KBk8-J(TI;j9JE%kxW0xIFj*0j9JnYmNbQ>OJV6!Sc;Tq z_!*WQg(XLs#Xc-KN+Q!NIm$PgX8BQ`W18hhd7f#OALRw67cxe?5%YA$M#h3 znUm|8X1%Ad>?uFvXIKK2pELb3_33%flNm*eIL_9m}VK%vW#h2y0j1SU6wBGLrk-DX&+%air*T?m?cdc%`|qZ zAfABWqhd)lM?By&%Df@vm`}XrR>$>UY+gL)?N+m)y-b5ypOo0c(sLB zPk1$iS2uXI0!y^ko6p_z(93mB@ki==gnHZho}Ou-lxVgxW{uoc-_zY)?7y4hsQEPY zJw5+>e(MzDKQjJ2>wA1r?nAMa{q;ThaA}cc_U}h=khz?EuJt{Ah0BTj1b=ZNfBk0l zJv|x6cYD_N>Z-|915~J(J6! z^{ns7|LU+WuG9JY^lJRK9V;GMmjQXDN1jdsXKgl?T@mCo?#dsRy zrx`y(_;0B1Nh^QW`W|0K&z@RDy?gr+I}lRs+> zOz%cF=sPvAe5VHfqK^GTKJV1P|F>&k9?`#31OHt|1U_XAjK1@oKCs-M>r8(i z7(D5!fr-A;2mZY0+VAv%{~5FIcWPji?th^g7_sf@0}~xYS_^$(!u~!m(f&R#(f&R# z(f&R#(f&R#(Vxp4{QuoP@IQP^9_83Kj?ryQ{v+)GU`XU1|Qr^m)c_Gj3-54&%#=-(&2ZS9qW4J8SO#{np(5 zJ=y_~G>nB4W=X@WJkcy^n3X4*B@MIkM6;yHENL=J8fN9mpI7u?R-Wiq#vd?lXZ#`K z4#u5?6^SvA{3xuKm0A%!mIAtML9FW8sjuf1P%~ z=du=$IKU+rYw?KYl8d!?M03f-+&s}-axphg^gn(ro+R9-*`WD3HrF(2-V{RQf$|_B zOukMut8tWQ9H!`k0UxHYsc>b{k23l4x&3KzLv{_5j_D zT@Ih`59>q!?jOMFfgWM{ztP>_@7LqOPw>b8UiYxN)7^rgG52nNKSJK_KD|J)O3(Fn zX{?O>=ssFyw9c0Pv%l|o_Vd#p`8qs4F5b7ece7wV&hHbYk>c3x>I#q2=!-w6jnat! z{&+L(^W*z?k=*X@`2RCsz$gCSn_u(}@$Ob(`Qzpbo5S+G)Ab&`?~gCV(H|Dkk}wn{ z|No)nZ$kN(Q2u`>1Zj?Ijtd&io6rR^>jH(fKq$)puZ4c{F8NjAEAng51&^>Uh-F>y zRn`SlSrHMgwrN*+9Xb!#A%Z_Z4#$V;r=PaR$=LrGfc=nn;gU2z)%+B@csFV`3W4CrCgfzDrVjf+H)}S7 zFIzNQgiuX`rUCn-wraKlZ`Z&wjb?{t2k2jGevP}kG`m3W*1(#Y=2gwB2;p_j>%fOJ zhkzS3jY40|QO!}{W13_5;t9FtMU)H<_+=8`M zvgUow`v|{P(+c_n%?F^{H6H?ZYB~i`mSjl?mHWtj1Vs*#gM=VCSPq5{w$MTD@WV6x zUF2sr{iUy{EBdI-itwW!7JNA5l#KLGq?`O88u z>as{YGg=-EJVqV^93@8qKPEqhkjKm8K|dis0eYf55%eT^62h4xPXRquo(lYw{1ooS z$#I~c!HTgkd4@a#^t1A_@SiEq1U(C@ki+CT@*L2Kaw6!t@?6l#ax(C9@^kQ+FV6@4 zy!<@qR5=y&B6$&Tnw*9&>SaA>gKR*U8FB`=kt62-=gY8vE*Hziz&6c$d6OxJ%wE?*-m3?}yI;`2g@i`5^FN`7m&!+z5PBJ_>wH zJ_dY3hMdSvGUP-)B|}c+v+|#S&&zKEH_Pt;UzXnkZjs*yZk0a(ZkIm%0Oix=m_imDaI?}Z+@)Mn zE`h$RTn4_PTmf!TT7a)9*MM7$Tj-4COOVcKwQIOw}EdZ^V7&<+4S5Tl1$ZG<)g^nDmT)M|%o zhl3ue9SQs(R?TR&k=jVm4`J1eRy#&J2J|CXHKWx=X`_U2?Ktf?;PKk=z|q=h;Bsv_ z;#R4x1pbb8F>s?6b`i8kwMT)EX^#P)(4GKp(l!B~)Sd)Br9B0FT6-G!toAJMIqf;% z^V;*k7qk}yjka0a417s@3HY-1GVm4c72p= z0*(xg1Rfna8hA|T7~rv?V};PLC&Hk+!X|`G0G<>!3HZsdCxK(aVt~II_Eq4g!kz|x zChQs5#t?-~s6zxHOo+r@_^GgSJ{No7BjI}g7YS>8|3xi!up#bg7{^1aLYoc9K`WvU z{?&K=qo?Ze)C=%40&pIY*1|q%c)t64eYO9Idy4=D+`$eDZ6+WKkPSe{TC9{u=yccr z4|W{1FKAy71nqxnp)0jItqD(LXtRXA+8nI~Rt+Sa!A${XxkXTNkgdj9YcS1Io|qk#0T-#5Aw!~ zzG;YHS~3jtJwNhBob^L+e>5OU5DZ5FO@d$?-~~ei{sRyOyZ--vKl1nA^V9kf@Qd_) zFB;)a=>kDNR*;NgNb7YxL(h3ZGHMWhoAj!Fao#lRH2w0t8P*y4Re1^41pS)4xz@S* zb$Kb)6#d4$RBNh!bDqws({If)Th00%dAZhH{hqucYmt6`p51EKAI?*)s{UABwY6G* zGH;o6nf`3vO6yAfg}l|))%weMwbokwwY&}14f^)HI%}Ol$ZN1R7=rS)TelmOyj|8^ zhVZ<7)_sOSc?Ycr4MXydT8|n=X!)@yf&H3YzU*0FrS=KPU4$n7RHi8>F;ge#xV%coX z_2E{_R;G6VU$^YBm2}5Oi8u+1mzu-8ha4Qr(H3g z&v)CyjhFH(?SpQV9s3ZHQu_#FOa4-8iZ4&w@>f_@V@G}sr6_-`RW$|VueV2fQ)klT zZ?cayh2_`V^riunv!=oM_4e_m;g)Om$)-{H+bBMiJEk%DJMB|Vipy_=B%_qsXOcYIlT7jXC#(&oIr*pT$wn#voGsHdk7U4bis=DFo95>ySyN04 z^ONlhO#1w0(3wnI@~_wznM(3o?M9O`|GGWfRL*?xN-wx%FE9=xj+qu0NVW^6<@p76 zt7(;GqwS<=O+g4a*+P;)9I(4h>k2~cm8Oj>)!PgDTN6y1^B38dnzmBDn08RUpfu_1 zD@=O|BCH*z{op{2>2Sd?`&!enf|2(1rjrGu?VAiNMW(Y<3QQMBqD+^GhKxb3OxLKS z=yw!E+3P`v*|(Y63!<$>W}#q;EsV65eJAM$`(ATU!8H2;;=jESPY$-9Fe`b>?5Cgs zM%mAq!wY8Eo0-019>ns`Wy&;)Y0eAMZ1z^tA@=Jenbtb<5aPdiL_vbJ!5mpI7y6{J zAO(70N z7vwsIdGBVq3!sg=(^-}DR@PGTr?*_qMtebsZJjx(pvW=WoLpdcL}iRDobR}lF}iS} zqlIMHbtP*>-f34WWE*AHtD~}N@={#ajpn>Ix0JQkQev<4N^jQs;s)d$=c(aJ@pj^K z@h;+XUamWY`0NfP&F}6{I@TRwxL&-^R+6=eB$iU=9!9Bik2Fff2PxIXN8O_hLyDW+ zQCan@SI-rnc1LrZ=NX!d&%2|uwxRsaBS}^jl4Ld9yr4jJL}%CwH#)~r4W$mEQf4cs zw792Gd2~<9+F5+bJtJ!`)f!m`@@BXbh<49qI)&*}!?xlUx6WIeWHsi^b(>Mkw77G# zPJk}TItAKJW!bILGw$lFbD)>8|H`c9ycGB9tSjJ8Eo!S2_XclC&uT4hbJt~EFYa(R zWJ_EYSe~;(N&@UP*`XyG+exZJ-P^PKTQsig*%2iHR&(~Sk}#kDuI!N(je8$IbC7B@ z_fg`lSBBk9*`rGaSnb(SC4+4PvZM3t?$g;*ECbx;HAmBlh0$8>!5GWgG-lH#0`y|QGYb#?aYl33fA?Anqz z_l)cfC9!4mvg=CX%jRb{kfx$iQ?`&wO_`qQOr|Z_+e_xy4rlKwnO9b#Z!ekeYR%qf zi7Rs&YfBcAW-HO#CT1TjSy)z{eU$0Ck~w9I`FUq{Q%R<^A^UWRrEEFLjJu6wrfe0_ zWowvT$Mi;~H+y9=`#i}c(XJ~*mu)55d6MZJ*_TR6th=&XN}OeTsI5}AKfBE`uk3Jk zM@f0vv7CScbJ@upP2Rq;vpHdw`DGV!29zwe9?ThBvfMVOJ8fD=r8s9el}E$Ql2xQ> zOV-%t=Zq>@S9Y0N6lK?#ZqFHG$y5c(eKja&T*=0=<=&F+Ez8ExlFioBITK5^LJuq| zsJ3l18w-{>rkJw}Ryw8`)q>TI8Rmk5TH9f>wP1rI!R#)mbIdhY7Bo0g%u5TlJ5tRn z3U*oNnrjO7IdtZ=1qU5wymb_BtuJVDkH01?B;C+mmI2jXF-dj+Pt@* z&9TgUprFIC(%e`W;8<-wQK+%znokvmIcm-43I{kgn41d+JL=3=3Wqxy%&mo^9NW#; z3&%KiWk`kN9Q!gt3MV=aW`q{TI*w-aFN||EWkeLlJ5FZ|E1YB7YTi~j&vD+@KIE2I zMpU8R(UuWinCa-qm{MqQ24qYtEOAW9n2~eYsmVwvbUMQ_<`$Ma2V|raE_M#iNG)9M z9G;;oT;&{XI{xkb#l)9lC$d6oP{M9)ag0;lFRDMoXnDIYEq7+q+LzUDJd1y1zv5L zy<#HAmq^gV7>MV<`+t-@c=Gx+Nmglvp#++59ikh9X zrZikF$XQo9NVR&~u{j$H`m65j)l?@^c~>iQHkS-mm*#BETdA%fy{gtwO{A{K*@OXmu16dqZDBcwOUJ64a*mabSL<_5mQGf;8Ml{CwOzs*ePpB?N&1hZe)%o4&oNM_z)dM;0++rD15^vq$ZM}Hwf?R=WKyPiB8$=w- zRZ6qf#@z7I0(E`vp!|BPId@2@)p|5{M5$XnksDcBsh-LmTe?&|hgzV?ZKu3eo4sxF z-0>9i+{uaI14-#_EA)18|Md-`XNvkZ4` z&74>?)43xvwkXNAH8ZX#*|{e(zG#7Sf99N`Mb5*S^NNhlW0~`dvYjV07Zw#b&t~e2 ztiYK?Zs&zeOHrlsGUIERB}Ge}?U~M^6)wRXR8->%$}BHhYd?^=xM;mg$y{Ev$rYZt zs;J&ID05BGHrJ5MbwxW}BQiG@?R7p5dy@ ziY!iWEzKHRJl8oVYkYBvYXxwsZBEwYVx6ldYihCCwKi*dajt89*39A}*QTtbV!Nw8 zE4f&8ZOd9vTTcV_7d z^-6A1X^q;Nn_Rk9y`HD&=RDEWp&b^Y`nbULkmR@nT-{`S==2AGe`MC#5TV3_JjiuMi_T-+hO17=Jr>r5K zl-zSgk)G7t=DcW+E_Z3^PETm=6>F$_bZ)D)zsF21B2O-T*Hc7&YL7klx;4Uil3K_f zmD&lOYL3aWTsLB}GIxbPCZ5%tirPHMT<_VC7h;*`smlwsEc7&Ry0&}!N7T#q?8@tJ z9p>5RZ7JnNSVwve<_)us_8iU4F5TuZ<11*T=Z&;RdA8?`wnlrJ@}j6EoEL4K;yG2mTeq zY)=I(3d$Cq3I0ZKijWliZt#0TN=SUjEa7>C^(ZWJK8b;&X~MUK2w2B-2;*?xQ-zSk zHa5S35yl_FBIi$VeM|V6@N?Ma+y?8K&%>hTG2uU8PxHKx1sj_0!rtfyqJWd|`iKt+ z9=38>2P>CuVGG-(d|!%{o)SKkz9}UOol=IBEB29Wk}CFh3vn6(K|FNif*H85+N&)vx``9;jCtr;OT!BR3k4})QNSX|gdqTL-N>p=94v2$Ldk8q!_TaA~*@E{(vsLU)rjPhlYP?+sxPaUAD+h_F?A3Rr;+ zVF*Uz7$G%rVWK`UGtrV*lITnOc;^D+&i6;}! zCSFLqJZoR#wZt)r?MXsXP~x~GB`G{X?oJkq@={S zq~xRpNsAKWlZ<%h#x*X{dreIAUa^V(D=v|*r0m2wNd509y5E~?1{5uXUENspFL;xyxH?-FPyEP zojKbwyJYsp+3RMnn!RSWb9VXc#j}@#M`FOTfE7GGuj#?9Lhxvua2VI)Yz1^Yw8(i_ z{lADSI?xs95+($e2bK#H1HTveJ)ChVVzzAq!c#Es5eyTmm4Ky!n22$4xJ;{Y_E>+{KE7W*vjXKA=R-I>EugC-?ttZsQ)>Gp69mwOL(by`rwOwyGPg*VWBXSX*r&>JD3|y2sXE-EWIf z58H;R$Kal{ja1LtMynT?4pA@LqSR{)(Q3Ob$|KmOc!F%xJc@0GC!F7-cM?2ua#}IIOkQSS&mgKBdojFIAQ`a0wo;wXX`poY(n9IsG=W!?FScEtwYGigD(25Y@Eg3K z{Iu11mfBY18{iM+7x6M@m^z2}&UuS`qj!j3oHs{(Zj)y{$p-Pt@7hiyyz`z-emP-& zQCx{{mk@`j(#;%~7Ee99ZJuq!f99Rf<@6K(I@INypI&#TKkg($$lty80CkOB<2k@- z1b_Xm&6hU6YY+1@+6Q<}*av$~b;Z-42A@kZ-6O8PIQ#kFcS+`nFZSW;Jn-zYb*<-| zeUzu!y54gIGSCY5x-F_)LY}OJ8$$denYC^z55@ofR7PwhzW`2ulxGo@6-vK-OnC&k zEEh80{S^40r4moJiiU*6isl@D|7Qa3w8JmWv&?o)R-4|=BB zW6MX|k6nC<{ef;q8J$IZs&XuVic3FD4B`AY))nhKF8tW=oPr4R= zyzA$q-}QgT?{@jGQsZ4~)C;b4>KqCeWpJKrBjo&)*X944Z~XWBTh~`!ac!+^b?vCU zo^x7V=-Q*|UHjE`*I~HFy16ISOxM{e$#ntlWlxfe{$HyKVYj_>vs*yjaljMQM-0uI!R)xC9tE=3TJwx16 zeJ=jzx$(c7%lD^y^Ut4;V|RS_<~y!3W`@wOL<0e#bq7kn#!=dvV0iI_7wY^@@e*Y znbL?&v|CLo2zo&SE`EKtyOk^S?H4K z-Z}=l%1L2f_Y{;#RccvCRdrct)iVEkW&NvGmPJ&p_RFw84qa|99Y{K@Y*`&Z;l}qakdCgxMM^`ymeaz>b#11j>wAnq@x^T%eOnmS1bhR9g{0E zZPO|&j;R$Te4pN(?y)*%RyZ9=73GfPip7BC3=7KZ9E*y^IEqo87yEvjOT z!&ihTD)u;PD)u|pRvdP$uQ=oTwBWrz(RSbpKqX;%F{!BOW+fD+f8QR}OJX6?3?JgjSAl z_OFa|MpTY<4lCDDUOGotPIg9BPIX3CPIpeJoavlandF>Nne0rcT;QBrxyYGPX|xqp zW;;_W3!J)2t96s-gwtFx-vNYGsYHx^k^^S><}?%F0d7)s^+m z+RAOt4V61d)|?HMd)2`nK^L^py3uV>S0cFdoHLUZX=ZFVoE33muCy>6do~s^E zwz_(7S#9<3vJKUvNX~3g)njZ@^|-RS>WPlX>R1l1p*oJk+g=@CwySzh*}m#|We2P0 z6EFN>mmRHMSk_druTuZg3tgX7FtfShg22_`;nu>Te zta`CJpn5sgW7I}MZ=_Ga&jS8O5Q4uQ{JhX7_)72BOrx50#eK)ASZYPq=`pBPV)%JSsnpt z<`Iy;&e1H<8@R8@J^GkrVR}q3*rHf_tQuP#vw$ySj1i&IwTLhJw}4?0?f?)wF`x*!Aos|H zLY$B^4(G<$aDL4H;F`dF&xt~#a0I=}-{E>vED#HYDUwT4g;*Ms!g!b{IEC_V>0K{8 z(Jgg1(srAaAVSarVObWgw$ZY zk}wjND2&2|_4T;=;GCS%SW!0yr|JY^BrgiRiWL7U3(|2-TRjw%fHHcfD6V!k`PGbX_~syw_fYUXXSmZBzOv z4y!;{ty_kWYw*v=Kq;sMEX8wl8TqP5S|myV;=L(tMcN6x(U^8B?Oa+b;_lY1)U8gt zqMJd06fHp7YIPgZnn5?~>U0eVW0Niv>G4BE+BR@z8^YhD8wq~`3Vpk77w|qjzmtHz z#&A$~RM$k|`oBUUb^*l!pgRrsIzlCIg98k@^SVpA7Q{XUInt)n;j5|OPv4r}t{1xE z-aQ?l`QE9tdVP>y(TD2?`D57K)eq5+pl^2veWZS@emwZyE%ts|KUtTcpQ@kEsX)BV z{ml_+JEyEP8TIvP3m|jNx@r2E`Xqg_et~|G-bneT&(=-R7wD~eH{447Qh$8)EA%z` zwfgn?O?dYdB!zg-JlA{q4qCr6`J{fY{s8eGJWthy=o|GX^rzBx>dyh1^;h(*`s)Ts z*FVkb1w#l)1LcY#)X?7$VHnmuy-c4nj7$S~r3JY)Qg_}k+7Ly#W{5US;oKv7nqdaz zqJE|!!7$g5Vn{XU3}!>Fp~zr2sD^4kPf!kv49g5u8j+`l)rhA`Ks+LeGt?S380riS z3-;)8k^haz*?Qfy^l|AEfnx!2>GA1v(wfufrO!`an66LHOt++$q_w6y)63Hrr=6m7 zLjre_21s9?R*=3beNFnh^o{A8O`A+LkbxcPdtz3l?@vFRek}cD`q}gg^wsps>DNs4 zrfq4-rk$p}rURx%(+Sfl(>YVK>58e9Ws78*q!#&X8ezI_+|M~c(vL5itR^>sSu%&{ zQoJG1eRJry&q8Nx>yl2t)cH$ES2^&OML(C!!^|Tocg>@9)6zDX6mW;+o1O-r4BHL6 z4EuDd;h^EDp-Go8Wu@V?;e1-M;gX@n&}Qh+%{2xXHK;%bq-`?}HV!wAGLA`GY8+>r zXpA++nbsTQ;XlVXFKv@?zF~E;#kkO@H)a|w#uB5`SZ-WwTy9)tTw`2k+-Tfv+-lsB zzRz9aX;X&@t96Eo;02{UNBxZUNg3vu>RH*WKvAwra`75;7z3Qf@!R2ylHa! zD)4HmX}W2qDM>fQlnk7bw$vPDjy6v*tu-w$Eiz9t&p^sZdxb)VrkE4blA)awAm7l& zIvu!jo^`_}Q?_}oImMhhrPi!7RhrF)edb(qk=br4FstTj^D^^FDDKtfTJr{Tow>oh z-Mq`R)U?99&wS8))HK4}WIk;^Z@y$wxPGJa{~kc?_K%!{`UkX`kTxCW18B^80I(1} zND!l!3jL$$ioi82x;lC!uF=uUqN8xpZ%Xu(Cr&(ZB6=FG8SqQMH5XS3u2ftosL{x< z=v-Vy(JQ0v(W~(tDZn1!z&8SMq8?@ig|A`Wp$}#qW}`iti1|7hGkf30u3QnjSe9{& zhR`bfrkfLrH-2A{hf?k>PS0KG@=90VK% zGy&+|X~22FB|wY!Kc|P%MCqZl_~T0PqBz_PC{7fg?%in=%jap*R89UxRyLpefGa5BnpoewX7-eD4m#Z$D64{6O)GLU;qkZfw}I2K%-@I4^Ln}Oalg#X zgd{Xcl4cMR60-6ZyilGK(hS!-pjm6b}8td*=)t4UU^gw>l$SV^*y zB#D{lIF9=sjcMC{|NrxUp3mobKKJK)T*vu6zvuUSKd;yOy0U8_4gI3LYOk^_%Ah`E zS?Ypw+W=d(e{s1j>#!BVF~j~W+m@9*A3F9gw%Lua9RXqbvTa%265H(Nuxkxz|3f*; z>QJ`*QCXAVk9}R%4i&dG5yvr!ZFVPY*-mWdpW4<>#Ivo}C8Vr967|pS4n6BpR{yf? zPu0JyzCX2{0AGh7(;+8N&OX?d=_+o^Y;s{Y4Du1=K)LqfxGdMtW&Qnscl(p=Ue^9U zx2@RTWo`DqxXmuB_s?w4kFi9Xm$lQ+ZOi)LM_Y_xj^*r8*e-@7>U+LjPeF(I$o2Pv z?OBB9LL3O^>CbI{t{uzbli_O_q-?yG8|P)?{XcFi_Cwh?uedE6^FOi8Wt}z-nO$-F zqcx%}?1~{}+n?+2vURO&TQ;YDYFoC}{MjFXDv=11W%NV^YGwyiin zry%Yqq->j*ujkis>Y2W5%e83_g!BId1ap`3pL3fwTC)=4D!T~bi3ypCc#Ng&8Q3P; zD*GXXXG7*emyGQ~$P)0D*j9%;4UT@!UI|$PSs#yM-(40#i>17YNw{VukN zw#`0_@G;0q$eF|zx*P+Wn%D*)5l9NcsAEozxa4Bo=Pm}X1O0UHWf0Um7wd5DI><%{ z#z^i~$acu?_|@L4uiIk#DcvTfO%Kff(2TiLckekv#GbAG>AR`$d;w`9odAs*t< zcATq2LfE1W)P7UIQMdDXm-(I!J<6F=57H3QB$1{Cc$)<8fGyj*3nU{U{jkk~423Wr z?UgeeQUDnjU$=DZcnaZ3kZF*autVK)WvBW%aO4rR!l06|~mPDj40 z(MMAul_Aw3wIFp7_aNjE@CI>VpPfHmLH=56cE`&-q!G5T)p%Wo?M6s(Lbn}xZi5sc zya&R1qo0N}#};K6(i(B-lOgRPogm#IeGpg9-;hj%*FjL$ioSU~spByEJqqC#Wmj3Y zVv8{|Bo{IaG74e%V0#WJ0!JB#OpNPr24aJ)gFN5+|Mk^!JKS!@*;&M#!1ZR6eh_jb zA;+;TlT+n*nGXL^Wqc!?H%jolVVQlSWaz3wYC=*IcKAoN#C6QX8MlwccK3%{XqKR^ka>yHm=z?wQ*{r zBlsN`9%*z6KZef|(@&J2soR*IN{+k${g+*EP45Y;qvEy-HW-^|Ot>*n6 zPr+8lQ?N_TCEhY`8J>|{?yWGj^+ar{o`|i7Ct?ShYlGQ%F1C5_OFS2Q9iEHrVOk{h z#M80(2l4---YvcZj(3n?gsd@F8l7=2h+W~nOf~VZh3;tbAn>6%hneBht zmc^%`$J5Z`X=l)DCY~l84+Jw!I{rbOo|54B$98%hNIghHNRuCgBanX5&zh^#j;GB@ z{N`&rKW$Ok(zNAi^V3#A)=IY_ZByEov~6j-(%y$|e%fAy4yK)g#Tt2)Wf|KzRl-D2d##$)i=Zamhv&4c@{ro(=6UrWB+KM!E?0F z+E;MRrMy-5#PzLwTobCP=c+Hqv(&3`-RrOTU4>_)ZOKpKV|pnEtk*ZDcCfkC=GYuF%nq?b z%xyN$=9%I4R(q?t-QH$zGb1d1W~3cuN10K!z!sQ0>=--76xbqLWJcR@cAObwC)f$5 z&`z`yO%d+sO)_Kc6g$O?vs3LS*^ z*i6RL>W`QycD9{u?zVI695dCYiWpNbj@tnsm>v z*Q97}_qp|&6uw`SU$nS;x58BownDe8SA)W}g?n!~UbNztBZV6Zj}(n4TAdLn+*EiR zY+d1Sq&QW$sAyxa2JkYsXiUQHEbR)X!9!c<7WXYV8 zZbj3_hI-E|+)|W^(22rH!1~B*+ z$Ih4Zhcc_AD!~t>FX!(E&;Nn_58C(OuWgK)&Z^sN1zbPXtb;szVU7G?=5POd4It6@t#wy_H(Z#@$)b6P}3bu5C zW{lT;YwC_J<3T!KW z02<{xCX`VR`dS$gVBG>>*Iu`50B_Kx0N5zuQ+dU6iDP+har+-5)Baq&ex^pMOZi&F zOa9->9B;RH?(z0Xqza5aG^TFGj}W8C#_o>&4r}lK&UkXM-{#XTnMjX+t>9l3Sj%Hq z#TsB#HjG_koLHk+Bjd%ci(O~@*p0CpO(2#X%Q3;&kl0XDDV870hyCrb+f5`kIyM?( zyC{ZtjKPKgs_bY%-tWB%{xwx?^F}yi7RxMToye6!Juy^rn#|Z3qcsD7Y zrXF-2o(Nfrr#D7GkI^n)_28pYtikz`T9wpQ8NFBz%IK?%0hKXHrK_aUg?=J;`nxK2 zRifr){#bJlbA2?ZRR7)XJ-EQ>rt^xWhD*% z57(*jrWtboPd#hhY1p&l^vMi2yKNWz(`qJvU^AV$_$`ENaVN%gwhNAg5M#Rlx5R%) zr=LSk2MiCm8O~SI$;axTZ*?5 zZ;dCSs>a$$(?ggceJ}Ce!al-mVXiPwHn)lo6CW-l)>pCf-!oOn9BJrLe4YXzf@JX?h8J3;PJO*-)*YigBi0jr*gMwST#VzBEK@^!g3Drgu{<2B42#`n z>c&Rkh@~FZ+A%n885bL8u8K{-(MyBaL>#?bt@Wx7F!3MBOSc(kK=lEYp|SWcCssS> zZD)tE(PdG@;H_~F;@rXX$JL<$I42*F1i^9s09*|kfIW&N72Em{teMg`Ef=Paf-5!y z+Cn-eq+2;oU0Jvn_=RG#$C$WGz;+5`I^@BGJOcXxkZedk1beIjV;~bCQy|kJ4?<`+ z7qS3?W3d6tAS)oNA?qL;6Wd~Jw?eij>bx8I%!Mp~;JF8s#pI*B`FOu;KK$jQtoeA4 zt2oM#k22(A51Ic61Znb-S3c9A?D@zO>Ebr12jWdW(`19w9%WQ|lv!yWbc6ke4sO_g z_~0h}3kJ724D@o&Q2I|A+yT-ht8Q+f|B=C~C|M11Bha;gwCTTU@TC67 z2d|ZY51Nqk=AbD#JNmC3JgxsJ*i*GRUFq5t5_WLIzgPesEx|>;(hsLdYo%z$xT2vbPU>D0`!XykdBE_MU=gqKL)K>>MHvnaJO+Le@=Es6%qH0-nQd}B33;9D)0rI* zrjQTKshhber?rIqR8F7FvpKnt*5rfIa%K!_nKMs9-Z5v%0B7(j3i+VvXx9gG-W~Kv zcGW?1b3PihAZN#*qd8|NS&h&)$I-5ktme59gj2vbP!O)se;WE~+7Eq;e#?OLJKu*h z2WR!4Id~`}zFmdBO87(nPV2u3{gs5WK*;-VK{y#<2svzK!hVy4eAVDt;9Df*+hAW6 z_7HN!&q3Ta3HdI>*F-#o9P#rJw@X64YVacP_aSS=-^Z9c3r-=A=f4;6d&SqH45z>; z!CD4B5_nTcON5go6SCVP+*W)H^29ii zkjL#iBEF;e3e2C?kh$5tFsFK9I{@1Om|FuduDOlRu`>NSgf~KpAzLBaA-f@aAp0P5 zv$K&t8{2$r^9P*3oP^XZhzsWFn1saV?4j%l2v6X=y+BSQOeu*=x%BaLiTHsY<~t>n zkm}iw3~ZFWSVCSsdoI?3WmpTAi8I^)oI=j^pgGnB%70ob=%WGrQR4m{9M~GRlrsDF z;FPj(CvXbGGqQJMo!KfO=UOunYY!#9_FNeMG}f1uSZ65Yo3XZ>$zG9Zu(rIJeRSZC z>_eG>AJ&?I?;;#Qd5>zYl!ei?=I%OWu=`JC!7(Wi{=@zV`6!J+(Qx={EJ`=iG*lt5Sr7S$BoNhk&@SH}- zx4onQeCXggnVSZml91E)E~KZBFG8C4!71eB!%Gof4%v%1$|}YWUYhy-;DeH-;EQsa zgKv^71z!uBgRrG+0Ox+e$;pLiAE9s(!b#=A$p|N(4`*V3GE8zRC-X=9n5NjTw8cJ# zLY|iM5cW3G zKb~`V(AJz|gSO|K9JCwzz&+UV7-L@|d&HWVO$&m(?jZFrY2!1g(&`GX4}!}~8v$o#?M`Y#1v z9+!dLv93`1BqTF?^*~DZ>~)ep*v4fwwyOu`!j4jAKMb5QDj`MKQp(oAAGXEN6%U+> zb&)a=YbIn+)tpg~qCqvWt%+?awyD_G$F@GURdXgnrk2?aten`7B=$K7PoWMn{rvs~ z`;?*8A+;cN6TCt8h^&WlyJXFlWN14N{kag~8M*x+Sy@ZKpN6c2tbxqV9h$WsTgr^w z;gEu?188f?;e@d5%gNA2Lz@q6J+%GMPSuYO?VdfN|EfG3Gw0zL3j&@uGux5O%1+Ls z%*o!9H$Nfdi?U1dmga;c-~$fjEzetp@YiP3YM${>v3^5E*ao#a9Q4?LQ)~ zNA^1@k%Q4HPUC2uXlo}YIwv~EnG)Tae5G?Y-XP!1`52-n#6nBhGm7j`BdX61L^zA4+(;8s09_mq|?M#n6i= zCBNX|glp;B9jW0|yeFMs0|-R%4FG&6r4qgX5RT&Q|9DS-m1q?cL+R__3jmkn?fzAw zSK{sd7pYX$P^w1e;^?)}Yt1Do+f%linkhR|c9~04-br}}|2vD9#@h9EA4-ro+wGie zOlO?oc1Gztr$TUc+ZkuE5}e(3#@TFVoXtv)v%&LW>L@tN>x?tQ&Nwrb;4JSvr>-oF zv&GIAitT~3TM5o^d*H0F2hKiw;7n42v&qgQAULD!j5FNMIK%Bc9fC95&NzGQj5E^C zIIHYTJDhEH#u;vBoZ)uH8E)r|5S-n1#yIG_J+a-5?H@@&()2}MeVGPj?~6Q>`{eiO*e4sIX+7ukY1pSj zpEiAXm;8S^1DxoCQM3}im4I)27;CpU9Lo{g6#rZ>H`jsGgEWLRfwX|MNk|85yFfA^ z)b}eFrjC*Y844Mmkb-iYy0Y*%@QN}Cx@nM^kXev9kok~Bkfo62kX4YikPVPckS&mH zkX?}XA$t?sgV-K{9EY$@r;O>1{Cgw+-pIE%^6HJedLysi$g4N<>W#bKGW+8qK*qn^{ z8H+NOW-QNGm9aKsL&m0zEg9P~c4fSuu{Yyj#*vKU8K*MN_H^*jOLEVuJ!|$%?ODHP zTF<6ETlQ?*vm>6A`Pm=mE7re3iS_R?t$+2j{x!k+_b1Z~>)*%b`jk&n_L){G2T~4V zMLeAHxoMm7MasWT`;;$Jj+>#?y%agVJ%w)fcGV^5ELJr4Ca+T%oz z(>;p4_bdKTv!rO2_7ZEbPe@AHo3htLQue3pH_?<&Q$91vDMwQ9otBhiDaTAo%2z2T z@UNZ!oizAX73z$y&N#|cwdOA>L*f_ZRv%nn&QVT!#_@qFV2)M!WHzy9s_<{d(nkqv$Yg^ zF74l}t>JCJI^z*bPkC5P@w5@RQ#IHOST~pt91&;@o0CN6HQ|~dt}MEtz$j=!fj+>u zrH@hLz9s!dN_Eu3Ra$$N=+yC+(B3}=Y$p9WAAX!7>g{W?k)?fGnzQ~B&_5r*|LdI( z=(BW@UlrGX_xjjRyMJ+Kg8z{=?ot>3)N+&jg~0XR8R+lxCj;*%cXOrhO7zy@&2iS- zMQ&dfex=w|;&q9EUPM1t`aj9ryUOvPycPQM;PWH@N%)yTn_x_qB}9DZkyu|E*Zm5X zhuw9+w&L&mC%^}|Z=ps51GpdS?)N<4Q|=0s=Q0nyVyhF~JP*%F*>u_m9Cs2lFA5L4 zzXX5Z!yP?mfd>!HTK8*UBWm2cJskD;{fKUD;oV*Yycv1vY6En}ax^%5OHnqbi8Oo2 zZC&w*VllrFTTJeTWO*66{ZhP!VjonhrxLOBRyiJ9(iWrWE!?xQb_G+JGqSHD&&_CK zu;L?jsyzHnv99#{$&r@$2*)?51D*}D?i@S?WNmxKy2&NK0b;KM%dRC4gJbW8 zx}Q~S5iQ*&rXBE?B^_XMntG?Xyy0mG=pQ9o?1#YLk$s>P-*zhT&w?dPJj&Oz~r>?bnT^_&CH_a=8Pmc9~goX6?G872F9(zF-WwX2|SL5??B-UR-j zMPE2|9jtiJIWfWyTq6g zwv(SRw80xL@efM#h2EX{AoVs${x7Gc-Qg6#=0yjsXI~J0;ADYsCwE%ew~=-$EzQR+ z=e1)B5xdOdD_-^=7VCzK&p*Sm9W}5#4NYHnHt-&zt*p8Ko-`}Pe@XN%L62GY1L@~e z}-Dqa0cGTXkb z!3Xr|_Y_}4?oOqD_dVKp3+TaHp|tT;qLK8iiSEDLxxfzYC%}*V&r#07{&8{_wRYFI z*P$d;T-LfV=erHi#xHSMs-?mm?hCZnnlQ@?z{7ggx2anK{li)lGPD|074{|uTCrsU z$JB-argHmot?-hyV*HxxmGh3f9{Q`?!@!Z`c#{fS@>fLn1!~M`a{ID!spnzu>J9c{ zu&LvogUwj4CSpDAS?ooL{R_A;KJMa`Zck_)f~He~4`r;oSBQMEKbj^yO2oZcYw9E{ zp9YUHw)88atr55jn*9Nk!6p-NB9=?^?-g$&OqS*yAxD%66bO3>vxTge35+MQFTlCS zG(lMg`;p`MP3l_<+Y2`ngKNa&sg{ew-r{&11KtP$5n`)rBq{g0^kFmur+CB)z!;X&baSk7jz**^-G z3ug!FQWK~FTpqxY06eG-16Pp;iitRrCk}(n8m4mY53~nAOLQHg^O&%c@LK7si@!)T zpAqd&X_^Zg5#4^`?}$glTZ(()wS|?0Vd3M#QABs1czauJNOWEle?j=R@Du6p4^Bty z1Hw*0w%aGN=lsuGxo*iEu*6nF${%QTkR zJw+R{(^~>m>p7KFwiU9>691aqbyV{9NB&3w)>U}aznSEr?2!4YUqG1eXmV9)3dQ*5#D za(c%34lLb;^87Y6P8G#AVp``u=3+}(Hv290W&-v068~-G0*$>ymNCY<+IKil%3GE& zpw_reEn|dRiT1GS^{sO3ChR0^BL5F5_H;tSHoQ@_I4k|9!Y#tZ!nH)F8qw@lpWdh* z>8IE=)S$0vQ`I{_WG+~#t_ErhnA5WHmCFNa&##Hj@9D?Ag|Y4}s!O`CrSK}{bsass z1H5&xe@VH_mY>(<^L6p}#Fu(&P?FZPG24jtGwJ8ho4rVNkEm=*VFi zai~)55Pw>HopO0b{BQF1pzt2yWO++gjq0d`;{wazbC*20(#+KeY($MY#~Er@$lIH; zX~K4}qv^*VPwo#Ec2fIv@F$_}jWw2*l6#hV=Zx@KqCLYAVvlHa-K-p6)Qp~|8T}$> zwEc#qb((6NRMlLos@Qg#YnxP;O`7`w>D$YHK=yYFbA)xJe?YvA@M?Lk#8mco!F=?W zqjhGv{M6BG3Mti#(oE8N(ngx*EQ$SInuhdd|4F_5Sh0cl3KL90$tyF~y^i*7f7LFN z-rP*-`>PB)^x9WZ7PpF9hnra)hdjf@gC4h zJ4j`#sF*EBf&DRISoI2%+s^}2fIVf?SUG;6a^A!q z@z&`$^ILLrnCK)4hYKHNDpR60VF$TgDnD0fRPUCz*}}PsZAeS!a`DOZP`X)XPq%YL za#s+&&B8xQQ!IR5nghb4MEiH5lPpaZ(H%w%bRzm~gf*pqMLb3PAHpYzUR~jb!haKk z{l(`AX9*V*-P?Iw?Jnk8rE(;=BXzv}47nGP%|hDPQ9N33uNCjWSieNE>x8cf zj}g7XZOHw(!fS|ucpV3ldnv*o zExp#{PCL!+cI5U;qCZMDdx-8!elOtd!oLu4O_F=<4L;7Ez=2+Xdha4(J>ez1UKi-0 z623rAq&X&@B0h|0Hw5;<&obugT*X*hkBAmyyUitfm&!g&Z|>LP_2s!P zxqT;412&(^ah_l1Z`_}#vSRSDVzb=meJ;QdeU#dJ0 z%Krv`3~aQw^;=SpkqJv@g5MbYLwP<-&%yrW{$g_HZmuVRc+dWZW$^Ftu_y9=LH}MO zUN`o1oz{EEKMJ1YrvN)B_9Ixzr?hDEAqg7s?ndw?S7)SSXXYBYfTtMKkhs~LzYZiB%3-O+vF9NBBuYR9aoTaPd7Q=-bI>-19V+(_O4Kxk>FmPUShMS{(EaAg?g} z*x76)H?*vJh;J1E-IFZ8ANC#tcGbvx(sHF8u#i`}#%P7kiyJW-9%K zsgk~u&+mwV8=2Pcp#9o)#3V~iuoAhyo{0SddEYa;PEF}gOapVUUNprhea%vzAp0D?I0>_cN%Qz;TS+wzH zX?`tHj?*}90}bfGeVyF6D+Osoyt6wdS?p9tviC2&i%UAbC&2FEBy@k zn0P1QwM4hN^e>W|&xp3EVw(#a5#4^`2gQ?Q-%{L^oPf_k#lU&yAt@G_!3F1%Pa$t4ZpxgNRMC9F=3{hr+IBb&OycJfeHvAUmSXUI>6@T5>B zw=dA%Zj$9EN_&h~Yn>h9kJHk9mfVeyJ6B78nXc&W6t6|J-^sGKJnvRHTgm<+*)*cY znG-p?z&_6wqOw{m|)`cBeZrt82j zQ*WM7?puWQg`=haLOd-0U4>2L{~hYxba^wX#XYh-EzOO>u&}E1HE82HB}FL7a%tKK z)v8WAa`TzWvr}bjPD}f}@C{iuV(wUdCoY6lCX?e?) zW{d3qN$yl7H>XuLU#QVy1G4`;(e18OZ>wHcNPm_1P1L&s=&L8 z{!RX;3l9kAXk6W+*oj1Y1Jjyi;ypM9Y`h(Y%BNO0z<#-jx0IM1Q<+F!la0we73&)0i5s9#eT%KJStrtt$46JRFhb z&5G?Lyh57$b!X=rqSI8^jEFf!+(~pJ(zg>nE=-D}a=AwQnuIs(Q?PCToq#ko7294| zv$P)c?S*3%d$;s8gkz;|A$&~p@wn#WlPYZsVH@Gq!aAC#T4!uj-Zsk5i;8V3e37FU z^#Yn*n$cZoW51GR7v^QZQjTG1D#wu;vs3!Z=m+fpbTgTY+h3STOSix5H!AlX;!T7* zl(va*k4n;Bc(W{Trj30-mV;C?6ro>Xj# z_y@{ml+vnHSOGZRHWS^2vfM1}B%4pfo67S)@F6vUD7m**`V@KiR+fELszKy#RiblHSe<(NPsJu_B(&40 zI6x0}95ML3avwX!a1@u0*GnG}*@(!3y?O*HdlAD>N`fg{kY;Mu)* zE~z;%Q+Sf-7ZTkw!dImkA{J1glZjq$@qqYDVN4h#`klm; zD%eDPnoxT88}WyT?&IRKgjI=7Yw>|ZyN>8SLkujHzQ6ESMCS>j+e&FW7Le<4p`Q0z2*&_TK(OoQDA zuio?&>mH)URl9ld(YTD7Kzw#wNA4UYR{9GuN&OZ4PB!t@&{%RGP^{WKsP+%2uibyk z@>!xkmRLz834SciNTU0hP%Z4sk00-go2mD{Cpv2LV74qz3YQQA2Z&bf=KYS`t0w$A z(XT{w<0I`6X`UzAJ<^X5*LW)}!f9zn5#5el zQE}x9+#C`f7k)%^UNd+K&Yl!MCcIi67Rv@tvcm(OYzE?aXxP6_#C4pj;O$B6`wIEo zpm~LQGfjJeOxb5MU-ubuue)NmO8+L&*+ax#cE&y={TM!<<5gB{KGEX2dDvW{*xAx= z5zdolxcJj7ZRzQfY~)p)8k8Xwyd%+0WEt!-+3%J84kDhj0pdCf(5a-o=Mtiqs(t#O zg}a1+*f3ID=*`W-rm5 z&$P~1;d8QVu2fq~as9+?pEOT7IDIlik_9jsU#T{wTG-qo{J?gUxBr5dS@ zj#}GXSHgSE&r^?Utn?FP)ki&L)oPh~;|WLA7UCc(ZJpNna(7 zC3E3?PR4=&`mTNiE9M#=EqPE@5SXb9EoWD_HG*<2999_1B{B#ix z)T;6V%j|0|doPzO?`qxiG*hg~W3`?*{TORz5$$mCCGy7apIK);(e9I`uw)-B zvr47`TbA4k{b-iK6sVk+a0J>r>A{&ud)(Iq;%P>BaC?^qz}J`H2}b)uNjIeWQn7=D zY7Hk(tv!x&#L1xESx$5nTly{2IwMM|16xa9gEGne|Lz2r%$#9$Mmx1H#|tG3!j3_M7U|66jDlRlSH*kYC(SE!+}*(D3$ z`CXzD(=mC8N)^9q_oRG&AU_Yw&kW_2tvOOhqx5eUdqAunT*owqZJP4J|EQo}MsIEb z5$guf`Mvl8qQ8*n_K`-Opd|n*V6>-~+;2 ziB5f@7eBwy@s$@po?l75KS%yMlDlt^JK0M0pi-?x1zkDuM>eA7KhjbDZ6 z#@CI}Oy%gj%!{8(ZdL47=?%G!&-CupxKAmU?y`AGI8!#4$2nuI&du=zFVlWN4CuT* zP*pbS7eC(PrSf(+(fJKyy}OCdVp-~p%+YG##>arp=^VA8dq9>N6>dE3->39&`jLZa74_C2MaFTPW#mUm0YD?Q5Cq|N01$HGdo`JNcOml$|k`e{UanD+KP>2=;6 z7^v8>L~oXC-X&IgjF|K~F{lv|%p~`tL_1Ze_1W$qceGZxE6DNOHPDOC-;vV%ff$I1 z-$3-$*RFC8oTbLo$oHNQ|0mJWI1ikVChmDUxm#bFI>bOLi83BZDrwyM4VZVg8q>9=3nUuL`SWD z6={|VM@zq5xQ>V;K;nLBx)a@*#6VS|?+I5+Un>44(Ysrk=Y0gyz^~GIFdR9-_KZ&dEIH#lj9infDPEVry7%|Y4=qYzU zN4%L(J>q^t?w*h)ZuvO5uOnVB-q&gYcb;r+mVLZ!kI3>?>E9y;vWWJ5;Y&n!nYen* z{X4lIkbWC6@QO5jh~AaLYo)nQJl-<$?A%C=)0T+iQliGEuRiiMGQD_7>MCttVZ6R- zD@QHtu2tGUDE4ykxX(G#oFe)z(J2*vCw;sxJ|?$M6WuAo@xng~-yk}F70R>MUwVxk z@346MEFhiSzeQMs=*3$}dAacsGM9QMp08@*yey5{$4M1$C6phpCApVJbdL)c2%8Jf z3FG5`GP(1GaF_6T#cCFK8r5#TG`opjw)i@tJu2=Holk@sfdSBBS{P?l%u!?8o>r_{*lPSZixsOLcT@{!r!+4R z-4bG@M~O+BiNSvmef6eaiQM^K`g@51jT3(wIj%(z<70auxj&ZZ%_3HMjF|K~F{tqz z%p~`tL_1ZugXsK`=&lf|@4UCjy?(-x#DMDP-azhuMRb*8;H+%a!rl|&|0D)Zh{t_S z7jH;(>x@YSy z`?It}EUxXC@8oT%a@o&k*PTq2s+!A^Yz?*~CS6KoF5n^Hncxy>{!R=oB>J<&d2Mzp z-=YBA2X77Cdx%~Ja?E$1CVFkfI{=%w*9r$nvs{+=udCBg&$OrcUE${p|8Z<{*YgP#?Hhu~q2P!xc_D$KR_Go>jisOP7)%={kFK0I2bbjA8o8P2$+dr6ur7*q_$i zJWahh9Ym`Fp|_pY4%IY@y15(`-N>D6&B|MrJ18L7i+W^`)#0~e}MO_qmw?(5+53`fg6tt9i@`QprFp39b*XQzpy7G}OZ0PdEK1^=e> z4)ACxW1UitWY@e3{Tk`rQgVK&2&=teKW3KB1s{z)8&=~|%z9up@!U4xe&PIc?@9x- z&(a168=F>|Mm)DuxC@wHdM$8EX8;|lY*HG9=1gfr@U#+^ zw!JX-+^5u+{1KXQ=S~50nF};fu%Wft}p7fiFzPv;bhX%sn1-T z`b_I&(x)?vK7rKKFX!?aXa}xE8>N{;4ay7*?4h4vTl&GX%B;mK z;ds^Y5hBj2SjSB)kJC_Po)h<@Rw`!hxZ2P17puM}7>g$lS-U2s?5TOe+;}S5xKEUv zW?m)7fwOhrWcImlV3{VHH2O62O3^ZAOX+NKX|@oZ@ugU$o$&$+@xb<>o(#LmtOqeQ35MI9EkC33a!jAl4T1jjk+3liJFr2zs9y=($!z zxvJYJ?g-%+GU0OyxSPb;>hfq7$TiAUsx!32{zbJ;T1uX@K!{YPl=+%3lw*uJ+AElg z`BLv6I7dqxs#Fh}&y%_U58|t9)*Ma3NWkBphJznhS~sb>a)buCV+`0@N^63dusO@L z)+DWz4eRxt{47m6EBji|>{pH4k_a`t(`3Fmw-G!lbV^i5-OqB*?Lh3Bb6aT1SaV#w zmT)2Nw_}_;&jJ_nSl!OizICmC29}db9|C^F{TD_8xLxM%1#a^;qkn7R4jZmS;oc@z z4_=jW_7L5O{>{-ucv_f3bY~KA1c>tBJ!8cBfn;dbi%%rtNQ3%g;`_vFX}@2LJ96+Z z4>fciu~laWEre60nJ?~%emy5 zgh%7P(a727qMgCBVY7!X0mOi;(c6OXSDgW?hr+UO<9mCY%zgf*%^@1l%)^Suf?|s;`@G+YIvxB|IvPp5nmjhFIIC1hq50=*=#aW?AX` zNLv}-k+h}VksIDw#NH`wi9BuT2H6zLPyEjBdNT}V=qODau9(C|NcP5}{TG(wIO zyG*=TvD1m>xHM_fEEnG<+{b_MI31;-PCC@x^T?xPKVKxM~`zd3dc=u z>I|QdS8%73HQ}~`rp~kpBl1Q%vnGtppWw`&FdCY1rls+3>T^@7soSIbpj6YnN6$W~ zCcke+$5b<^e;?p%TrV%hJ0v|5GFOAwL!c%xW2g#-!tus57J(m&?cE=Ja5(lBfpzzWNIa}mGJhc1{ldV z;!T!~@qS>oFuhn)be>nn8#3!)*0ePpFb|CBZu%K~48ROU?~X79X6$)OYw$hHgonze zD!vwYEuL5Uh3O4{JxqTy$mEzja~s|&HQJ0nZ;AJtl;d}v=PuqRnrbSa4_h;_9KWj^ zpM(~({rcRJ%DIfvS25Mi<-n$~;;++B`OEywRE$ETI!_m<<+%klfl@fqd#{buH^ zO~>Er))dwgHWIeHHLqZT+d&4A zK-fswT-aLJe&qPV08#dD0C@dCk6>b;q7Vase&wawf!sEizMbP_3m?W$$tihuAslo=rCc>7&_QEdX z(O-TqVU}>1aLoA8w-))6gfoS6gp0Ifi1#q!d>IXH*FGlU${?rSa^K=o%!Pfr-dcNpeGECzq4q3u(Gha zu$Hjy1hh%8fv}OVg|LmVqp+K>mvDeETbM7LEu1f0BwQ+7AzUq7C)_A37H-9w;+l)G z7GmZ58D=r>v6uL-=wQ}yKT)=|nuR|`ei^bcRzBvLf>p5k1U!L#{shVe?u2*Rb8z3^iswwR?hO_@-aF(!HUN`ehPz19mVQi`2xo8D*u!wIT7bz z-*XL8{nXYXj(KxyVMTO>m3|f-?8B~v)lYBhV}Hc>pW4R1`OL3BM`ZWkw=VXJ>DU*t zE&m(yu=l(ad&SzY{5f6+Hda1=j5V<@ZHc{fYwUg7V6WO1`@i~FhcpO}F?4)>}5UrFbv71=**%^z>Av_D4Lw@BFkr>(`&0$cURh&PHu|6}Yc zZ&%?6iSfNJ2=$Y$k1$g>M9Ak!tKulAA?*8Lf8P(sBm=O=&%}{Q7WVtuI6le6-hU{L zQu1Nz$d>*GDg99CXhU6|u)lDCaG)?tn2n>1z2=xH!I$Cd*haRk&A`{yC)tPW0=pdF zU)XBjw}7mb3jSxm&|Bec@ZR+Hct^Z5e#o!sH}qTk-TW+n zlt0Cv|4bkhs2OM&XdUPl$O?=KObN^iEDWp&YzVv=*b_JsI1>y7 zYX%zzTL-%Zvx1|7Q-ZUC3xg|y8-i~J_XLmNh?FZplF$UJRtPt$5KgNQE+3C0#$bnX z@eCJN2=79;68a;Abr?6g@Xw7JiEW*7mROO(6E6%`IdNgQdM9~`mmGd-F1;{(X{4Mz zN^)sth49=8_Ny)o*V<%)xGci2Wmm;|qO#V0FuuKPT4FoP;HDKgTMuQpvL$?!g^}l# z^jQ{0ovul#5UyV?4Et-kl?%f@?ZAcM^zIeHOD+sIDXI|Ob7A<}CKraAdlkY?xiHFu z-QW-9XPDnvE?1xCt;>Z`|K{cEkMcL~S1z965f#EyD}?7%2rsJ;USA=+twMNTh49G> z!`CHM2v-;rSkQi$4XAGmmalAfpnliSFP9$i*Y8%mhcmM3IJ2rB9|hN+NNmr>w=EN+ zqh6b=xP0rw-wowQE5dEck9LL|T$sL1+X~_GqlNaPD#TB(5U$W0ZB|x@FRl=N zze4!fh2a~^&j#dwWBJj}aQWH8Fjt_m{=qVEWBKx<|Jrse7te6{{$#kILVWr9F@9c! z_~jMC8!Lo&R0toe5I%ijxLu?|IJH8!d4+J73gHUlwOvt#_?Z>L9IuryCldRbcI>b6 z;T09a`z{Q(Z&)F`Su6B;e>bhK5Z+a8bw+#MbQI~!`U~L>2H~>VjsEOVwOkne*@53# zPc~lk#%M~KXiuhMEn#hO?8W#>Ka><_ zPc2dYj+Mv2Zdm0);BA$QfWs?~1>RnH9B@SC@xYOlCjduPz7u#y<%vLC&4=ILsU_;* zieV9Yi^u!uGdG_IxfP{(G_)eL1{VWg4B>xEp}&S+G11Vgp<+`d^m=FuzQ*-N=uJ~C z^j2uQxj3{lw8vZ$`Z%=LToKwII$*90eHuDst_pn~I%2L4{X2BbTod{#bi$;Ez6qT& zjYHps&X{XM=Rzf>S=fdhb6waE2h8>1O5u=c6^@3J%?;ry;S_UYxH`V`)lT2}`b9Vu z-zU2{+#uY@bPrz}Zfg35uM4*@{ll%ot|Q+rv5GTr)D97tS|#gl`KEH>1NN!=p@LcyxG-85h9)a`?XR40Ct*f$)Rop76urS?1pGqv6@+zVNTZbItwX z--hR#2g1J#FEqal{~^5CJRJUGc&YhS_^I$7^Jw_v@Luy;cz^hSc|H7T_>lQ~`19}) z^G5jJ;bZ0>;jh9c%v<4a!l%sJ;qSs{%+Bz+aEbY6#6}$RPQ;G{%zKeak&yWy5{)FA z4HyCYNW zMUi_W(`~iL{gIjW;>a%}57|p1zluC!FO57FnPY25eiNBzFN-`LSzs@Z{64bCUJ-dB zvcz5)c`~xhUKM#JvfN%Bc`mZjUK4pCvf8Fc{v26r8%JJ>Y_QixUXHwCuZz5jZ`56n zZ`5tEts-wk-n2JF-imCuH%4|wcG-53cOviFn<5`X_Sj!UK8_lDGrtXINAlZnb~L{Y zXAALdxD-1!S}j`Lj*ngvt!eL!){fS(ckw%Mb~3*cXYb~B;_N;APMp0L--&Bw?~87Y z?zFR_CCMQ>FFBGNvwuvklAL0nO0Jq*!#$WmbIhHuFlW9C zox?owF+ZZ17uCZxFe6gKb;I?-^}|<(uL-APK3s=+a3jY5%^3GRFy8xPoabPC--dBL z8snMc_#TYk2QY3Q#d!TK#_1n0KA#Fd6Mi=QT=@C$3*kS7{~UfX{8IQY;lGAo4*xCu zYWTJA>*2qL-w6LB{8sqw@Xqi*!|#OO3x9yIydPuubBx`uFlN6CpTjuyF+QUhm(?&H zYhxTjEu)I zBA&oVcm^Zj1@!z&k-wnNUqxTPfj-`ezWpHbapaT8{>Z-~pGH25d>;8C^6$u(k*^|O zN4|-C8~HBsedJuE6g}>vzxfToYUtnE=+`UJpXunwX3^`S*GF5WyqNM*%F8LQro5i= zM#@|G_TM`x@1=Z@@*&p09a#TXVEtPeT4`)(RcMuQLaRfojjQhvdZBfpb;b{^$Lbge zZ4BWkA@mB?$fQs)*2qesEm$K%p*OKchC|!2Mn*!rLc6en?hfrX$)R^c@0wWX{m}cS za%d0M&MKk3SUXcf2e5Wt6gq^pvufxF*3N37V^}+@hfZMayf}0UYiEtn8LXX`gi5e> z)(ksXJ1-3fuy)o8hp=|m4ku&ntP@VbNV_b2ark1BsxKv89gb4#8$%G;X%wo8 zT=I}SNC~O5RGNUU;A=_A7ku@Q%7U+@qzd3`X{ieM>M7L#U%jM2@YP$Y2fo^*VDQyP zY7D;mN@3uupVSI`^_SX$uVthT;A>ea8hj0qI)Sg{q;BAAc_{&WtswOVUn@%ez}HIB zAn>)alnlOBkw${ARi&}uYc**i_*z|>3cl8mW`eIZrMcj1EomY6T3cEIz6MGeQU(c< zmP$)W9cj6=oYa+8N-Ie{X_d5!)R)#sYw*NaC#@q5r7S6n1WOyGjU+_cENv#C(pG6J zX(Vlzwv)!vPH88eD!ZlKq^Y!5+KXq)erZ1mlMYG;@q{@n9VRWLqta14XO2t9Nh|4u zbOKMCQ_?9CE}fCi;F)t)I!oG0=cIFZ@|>5>llIaDus=e&0`_;1Zh-xf(jBnBqjVqa zkCGmP{n65Mus=rn1MH8L-h%yc(nqkr6VrhGotX~o@4`f|zbgZ9NH=By`{S7t*x#MG zfc-sKL9jo86$blzvf^NWBJ%+IdoeGtzc=#*`}?r6V1Hj$0qjp=Rlxp!tOnTMp9O;b z16Vz%zK_k*quGPDZgr zmPkgkzN{}9gD-~;AY<7OHiV30!`W~$o{eUs$pki@jVBY?WHy;hV$<1lGMUY0v&j@T zpUo#zSqe)b(^wiyBh%SZwv^0ZE7?jildWNE$Sjt{vdC<*jBcc%w;>-PBM?} zWqZkdc90z;3)oS1lq_T?*a@lE!YZ8zi0G zVz)>JyTk5~AJ{#1k1S>P*?qE%J!B8ba`u=#CM(!e_LQt-&)IX5$zHOTWEJ~^{Xtf< z*X%V}!``yDWG#Eo-jj9gBl}3!^KX!5$y!-UHsEWfIjk1w!mMyY{Y>}O0 zC$d#`kzL3({#DZLa$&hJ*}=b+x>NR$J;*NEOZFnWWnbBs?2-Ltf3jCDE0-nvlnpr)4KOY}sqsOO99$S`Lz<7A)i#|Dx$}%Ncyp^he7% z%QCFD!vq7i|-{O zX(fZiB(vlw<&z3YHpyQqCsmTFNwuUpQUfVeYAUsm!lm|7M=4h7B6XJ%rM}VtX^1pj z8ZC{NCQH+$+0uL|MM{${N!O%X(mm;+^i+B&y_ViH!nDl57&9{mmWSnMuB<3?XQi2q z`LlAY6062)u{x{)3uR3iKAXW zTgBF~jchyH&Gxgy>^M8c&a(6DlB|&pGLy}+gPcdsFT2V`Wp}x>Y_nupwpg}Xc3bva z4qJ{}PFc?42{10_i?b@@DW|)J)7_5KUCZfi&*`q?6xVZ#8#u)UPH~Y_T;ddGoZ>R4 zxRF!b#3^p(6jwOKEu7+3PH_iLaYxQ?C(dtY&gMLv&3QSST{xTbaW?1YY%ajrT#&Q5 z5NES1XR{k;b79WrBAm@dIh%`dHW%k?F2ULC&e>d&v)O~QxfEw}Y0hR(&So#pW^c}B z8)vf*XR|M7vma-(KWB3p&cCvpe*v6-ceT&m(wVT)2JV(QGZUO0h~qyIgJK!8V%+&8p3Hbl+!4gQ)d{b&Tvkh z5u7?BIdw*H>Wt>p8N;bFmQx3{HS9~Bo5nqU} z#CPH+$xhNsl4Oz`Bp0cma!5mgf(ZaSv%GdOC0OUdazzBi49~!*$6gcJFSM+; zY_@E(?6T~$9I_ml0=VIcPU~(%i9x? zIW?-N_OxM~7(a6qa-{Ne`2+U<)x0S}sA^B1JJvelU{p(hYm%$UwInC(;nfZB&z$(L z7JR?lKKHj0D82d%qNCzQNsYo5CQN$CbEBuDI4+(k@)# z9%&EGx=-4N`*1)yfO8*`4iN!yiX$k&G3gkQ5Un_ga-5b<6B$v9pHP~g(JC_`cJV7w z5E;N26+{Q@i4_q7#8wd_P>3Vq1dhZBv4XtB8S#PwBoAT+ZX_?F1|^9LA_o{Di0FY2 z?)10!JO-tw@)`LVzvqSipIyg~(vP?f^=f2(HAa3lCVn+$el-?;HCBE#4*Y5y5%Z97 z9qKhX^J~h(uSt!86u@<;*OU*jkYXf1zp?`S$_nx;EA;uw=&c-Wj>VNV;hY3*vIEz}j$HGi zxz5GH8*oKSy99Gb8@m)Mjn=gv^GCb7BCCWJbyZdkZRxJ88(PslSOVJ5Nvt1Q&J)-~ zw3(-{sc0>$BpCu#b>8`wrN93H`Lw2cq3!)O(sWoOYIKF`jhJ$#W}LVNfQ`$Q(f zOVE&|@DmtW4qw4cR>EI!AgkarVl;5if}S@0g*(UL4Bmqr`XTehL~sD811 zyR3e(eZPEEK1vSDC*%|42x5{9Z9nxJ?!WSHxL@GkaKFgE;eLgG!~H7%hCA#Ry)1sR zANnH7$Yr3n0dfHP2FlCjarf1J7I!`_J~>AN;`lKK`>_}+-!1o;hRla&mj!E8^+5v< zZ#RgrPu!1)n5r8Fczee|)|28X#J^N_7&$x4oE;X<4hMLF4-w&dB0fcI>xKA|xWFTP z4Gz2$-;;vy3<Kr{@r^$;t3=8FbIY%+Nh6 zbAawSvpmqfd@Mh-PSx{?@O+CR@}g?{RIcsQ;RV|eXHj*2HoW0-h^?raKc8#x7tyYBgEh zYBs`;?oBpx+t~_#dJx$TpE{ZBgkL?9?1pbWmh9y=wV&J6LHOA-$zlG~KFXik$N5wH z1h=(Q{Hc8g{`V?!mfPJqZg=P5i*F|vxb|5Pm(*GQ zL;i#2kzdQNX+0lsZL^l!Jq_`yz?4bczZ*B(tKli4JNEG28mM!e(qAUQ$KVQkCh{K{dC=0E;DrNAX9N-J+W1E~*inW{U;Wt#2~m+890TxRHwAa%w!H4=+iC4I?|f2u}~BA+E#j&Yf)JI-aA z?nf@ubtkyY(4EA2mgr7lPpzNRT&C&HaG9?AiOUS#SxB`;e&#Y&caF<6-7j3G>&|nT zp@VmhbQiFv*2qOJQ+1cPOw(QFGF^9t%M9IBUL)7Ar`E`IE>m?kxJ=XC*qO_sk#?jrt4mEnW6g~Qmv6cxJ=c(;xbM5n#*+E8!j_+ zZ+VTp!=73r@3~CXec&=p_mRtV-6t+HFs$b9>&TZivY#9$XUQd4&3*Emyv0lNMLot@ z;w(!rm{OIgdU$$}X?iV}>3VxEGxR#OM)Z2@p++!sRF$cEv~nTS^dgt(dWp*nJyUB$ zFJliiqBnAxsyA_&rZ;n$u2;Csz!zwtF?uWZP(K(4tIAZpBbRAr<=?ZK@7Kt~+!`r>9Ml>q$YrV?Z697Eu3V<;-MGxq7v?om z1bb?Y6y-8iUyRE%%w$%Nr|Z#%hRo2TrH*SVi9NMOJh)8Nm*O%_Uz*Ewy(gC$dM{oh z-q=%X#KvW+-iOOHy)T#PdOt2R^!`Ylt}lZV z=pxaOZpbkFU|4EcW>{`mVOVL%G@v&dPXa55qoyfHm|>1#wqd4WmSL`8o?*UWfnlLx zkzoc!s{qf1>~szA#1JtSyb)#-P&yUI8R>@LfB{dI{1`!H1J7$=jD8D42cp$>)Fx;G z4UsupL57Zet0#^{m%PA4&?D4H217_@DOFa|j>+!8117_#tln8V4 z_*RgiFW*wrCFN`d88AmKr$m?`ms29lkIO01(44Ix^*&K=>Wv5e5qbpo=L|iAV;V%k zyu~77QL&g24TMNR!9?82&uwKVVST>SS_p(GKKX*matCPENl@r2@8bZgpWdsuuWJb92L$A z_k>--ZefS8Q`jf$7Y++Yg!94$;i7O!xFXyTZVI=BJHi9uk?>r2A-oqp2tNzkg+0Pv z;ec>ZI3yeseiV)iCxny2DdDtmM)*lMC;TG(DqI$>3fF||!Y$#h@K|^vJQbb^FNNQQ zH^L{8h*bDPcqP0R-U;`G#i*lTL?PArL`5-+hQgbQ#r&KpWGZG#Wx|gtO15EfCx^(- zn5}djOF42AOL=k|O9i}v+{aQ0Ue-h8@d`^7@`k*{jGXsas*{gcYEV0BM`}`g zYENoWJ=K%iRG=aWq!|7~>R|4Mk<_JTY9{rlg<42`>OdVx1L{PbNJE;3<{`nC0v^Hr; zgJ=+GMeEYKq&2Ni>yvQWkTxW3Xb24FiWK`Nud2`Khl#9paV!E9fY^m^rA!P5Yn3_(`3?zj-Vq* zUpk78B1v=%9Ygxj@pL@tPbX5uk?3SPnGB>;!PG&T%9_e#u;3!N!1K$t-hb6f|H}Gv ztyiPhU?#A}U*iw!-GukltJYhO6o#GJ!%kI;{L_N%V9~1O3g6hSYPnz7ZH}cY$Vm$> zVUh#gMfVaN-A^xIhIxP{0JHZrR7Zw<$A15@^`^pF(_q8tIaa(37P}JGn#t{TE$nq2 zEOsO8c{40_3oLvww{g|F$9!YK+4j3X$AbUI?H4r^l4HHKFwae$``rfnabzf-dSkHo zp*6G^(?r%{DND9u2|$bJ9BlXomh$lNZo!7{V5vxc!%~Snz*3n!!cv92#!{8M!%~fW zz*3!j!ZW)D+EH5Aunu>iHa@#*fDL1aAqk=ghrp6e)C5abr~*s2QY$RkkvhVXovAY{ zIWNr%OU_60!IBHm0{-i_jvlwKOV}T`irk!EQU1?WXay*TPCHJ5`V97mc zPgrs<+6$K4hxUObC($HWa(~(%mOPLSge4EAgJH=-=}=hmFggsDJd%!tC6C4zACl-; zIu@2Zflh!WPok4x$y4YQSn@PF4VGL*Q-uu1-Nl%7VGQmoh3}HRcQ$8F?U7N(cH7~< z8Bx$MY}F+pBF37Nx+2DcLo?LBtBe0?|BuM~NHA($Y{pYI5F6tt-dcjVE5@GlE%h(e zzsFh0cKlb{{h#|P3gZc(_U3fP?;8BNoe-gqFa*cG^afRraRS~1@{By!l+%t@%h@wazs)C7=qN-9(L#(6E5r$%gw8m}H~IY4xlqmyx#jtb ze7;KaSJxGSvgcgaUzYiEnlRk2?_Jlwa!jq05TQ3OLk+~n$BE;`3F1U?k~mqMB2E>j ziPOay;!JUtxLBMm&JpK|^The$0&$_ZNK6sa#SAe`Tq355KZr|FcUJgSTI6NILZMe` zjIb~kJCa2<;g|gc{c4;HBA)09k+@yUv?8rYjCit!5fh%5(L}+MvNN&bx!999;(cw? zi8Gx~=aW2iAzeuF;(1nuxM)^u)}W1`_9m*WhJs*}+MCHtwTZ@LHU(mhRvx#4Jf=Ft z&XmuTm&?4^f^Tcei`1Xze|Zsq6D$S4xSE=C>Bje6aYWsBgMyfBO6~&a`WOs_jhQfq!<3J2 zVdh58R-4?dwz*rF?~(Is``oRF+$~s1&aaqfk+X%q>YS~p+%5FE<{U%cV$K%&;&Qg) za<>r8%Q*(S&e?)>EVFXHQ>=_^Fy^gy{Q;}C8pZAPx(ysO!Y`1Q>ZDFxSE>cF1VRmn_@{Z zQzuhTJikC8lLuet#kw^9S|qOO`EgGXI{~2_5!+LxGk(_+#7}azH8`^qFF`PV$)2f9 z@IDl^j|#mwI94O4OxedO!0sqoirMANK2{oesIzQ7A5%+H3`Zz5OI@oy<#dDs-~-Jg|97qZRKkRzINnmC%$&(>pXm|GV*&lCh;8AwSv-VOcuVj^0fnB zJMy&?Upw=49=`so9Q*Mc)wP1_Q*%_;R=#%NYe&9z;%jHV&coL(xF6Ki7uzZ!mylqg ztI$n|7rF~Qgao0dkSO#LdW)mQF{V^gnrW43vuT%UgK48_w`q@QooTCSiD|WIjVa5t z$+XtA$h6J0(zL>qZu-HLVOnNdYFci}H0?0$G;J|$H!U`$nAU$U_kZ@7X(39O5ByVO zAEmK~xJ&+MO&%v0F@QGD8^oy9_J+b+3l`p5u=3V|18*%j(lnYzoaici1<#r8pgX|2 zYxEjeH&`&hQkQBkIx& zYaP6avRr#9twDN>vQGaqa#lRr7CBxqmlR^jE2h<9z64{+lzl z{VJ6QJX+81qzeBkRVm!DKg%@{v@oKi70`#E)>8-6OA{<%s147YE6|!d;%Ec-QgyyM z+6QlbYK-?u)InRP8Ma#B?>_&P$|e_c#8+qL`I#f3BXv;Q&5>gx{N^bu@JPe zOQJNTuxLZ7uTYuQfp9a?({c*tsYn3 z5c2gsZ~0X^8-Djjx^M5f+S2$_f7DdpyHBmZO63Exai)KB#&%z&Qp=0CqW#SoTYZ%( z0ClALz~7Y1TJM`w?%yqa%vY(@H*RVqK+)$gSW{3=xd@=~8X-=4AlSEvramSVx%A>M?gP55c;lc_`LV=4AXuw0W3$IQC-9Be3pl9t~~o zWA1BCGUHilt!}Mhtw}W2TGrao{XlDwwT`tej@P#~uwpi@HP{*gEtgRSygdYEXbBd! zHn&E;ZO!eFQv_^Zhx5e{1M==n81jaNBj4)8h+JzC6LJkCX5?6(D9A4uJ_c{4D9w~G zrMc2VX{oeQS}Wm78wI``@}Fs5#Ghw)UMg`)C#AE}Md_+^Q{t8GN)IK0r&(@ZpPQzg z(q4&BIw+A!M(RYse?XjQC~Fxq2#zN-w3i(nsm5Bq{xr{>lKJCd<4dH_bq0 zkTO^qq6}4%m0`+oWrTuyMLs*thjP=5QbsFdl(EV_$Y*aQWn|VG@&2MtkY*Dr<+m!9f z4rQmZOWCdLQTFmQZxywNI{RMiQ}!zdl!MA4<*;%@IjS5}j;m=Dts>{9`B6EcoK#LJ zrNDW%4Ow>a#gv;)8tXya?@N_ZYVdETgq+a zj&fJIr~Ibe=V=Nn@QSge-uDN}L*+_>7*#U{T-DLY3-DJ)Q;@Dp^(gS7(W$ zg~Tw%;{`@|{EqP*uQ0mf4aRo7!^n;g`1PM1)r#_Cw(1d#FgPY3mw&_ zxR$#Z$?^!}Se{@M%QKYXe_})_N@|qlkMbv@(P%QF>1xy%?TlKZy-{cMGwO{7qhJ&< zZIT(y>O5Yf74vuR91_kdmC!tu%MhWg_MGN0UJR5MSymBnkb5{=xuZpfE@njCd3DKF9z5!pAjr zM_WT}A7-}|jr^&lw!E^B1;I+P-{6K}!+cwPf~m)d%MnNi^&qzQ*pgj#=md|Ebw<9D zsa}(k?6L}nmTM^Wk!*s_zLe2U<6=*25jwGy4q?#b01efqG_f_ZmHy&L{v`#6Rbv9%X`0Ozu{2o^{^(cPYt^$+l$e zK3lTgiWEBy)o833aY_7cml&C9tmiRAEidu2$+@Ma_9#~$UQD}YTAfwXtcj1+rs%L^ zu!_widd9|ei%E>{=3}-Q)q{GgzHwB?uJPSE`V_R~SC5ER$A)o{3GqGSqZ3_g#wT=- zPl!m2!(X`B3aP)_S@Zn)d(*hCQJzf_Bf55X4Xs(-R?u1Y@w55)2Kd@+<$V2GVb|YQ zHh0%Hbp5}jWU@_COD0*h4MRd3`;@R1%ib;6t!7;J*r){8T1{%Z)@~A9A+U^ZIZwZU zfB?^O)dR}<6tfk{zM}l!y`m;j3BBVYqio5v@Rv1=o-4a#1h;Wq)Fe|%j$S#M*Hma` zSaQ4bHGIz+x^7&sd+(zGd!P&^f79Xx27}NBW zbo|5o;Y!lVRJX!i{jROLQmk6-sljrjq13p5%OUzsmpo3ITTN=-WD>GiSSnpaKif9LtY0nJ-@uRLR1`s?Uls}-tHxcUvDxF+TJ?P4d! z#|*m~_$XDgjfoHmDJAEpb%~~n7@qId!>rjCr z+B`O=Ar3|SU;o-Tu)FxE+PmKG)|XndugrRrt*QF=g|rQA^=)-if>LUatQnh_*u8?c zcVt2rudbgp(i#UecN9eH~nPP&Y6=@fq?%IY9`?r+s8<6D?+3qih{13r&Z*}+*SNXO3 zfbI7E2WLKh(0iqOld2UiRvWl}qTik7Rnr?e`ZrBKnKf=%)ujQ~JwqRraSDFYu-`>% z@6l^YKW!Pl?7{V4O7^;yZ$ycCFJ5~ttX{U1RPEi)id(mY_nPL^xc*VU0|9GZJQ%d} z_v((}hNuE=0Z&VBEi9SWniupbJYx8OkS+NpulYUoZg9%)M?|+9%Wu-MK_9%6 zI}Nq_eOZ}H)0;1NSO2Ur`C_?AmX9~j^-CPx@p^~-#k@RLEyz>ISa9Rs)kU+6q1&(I zpB7#>BWc6NiznW6@9$2BZ}up8a@R6@`|HK(pUV)##k4%U=r z5c{~RQUG{)$R*gwd|46%CF&t+4>=$h8Ns9>P>=g_2;%ms&Ok?@FFeH zR?Fv``{QTxQB}#_>fz^8rhJ)F{?QT9whjS4o)I1W0zCaABK$lf%3?R5Y==l&8DBqt z|A>xX0q~e|@93E)0PHv#X`0)^_+#YAvPc|1qd8j`~M1n&}C>cxYy2x zXPu9yug%BC5!mW8pMbz%8zA_39|)}S&mr(H@=pB5ayjpOe(C06Y3?`l=LH8Jys2=u zRzt(W$8E26YP~7xq-Os1-mwcOFP<;$8@y!vvxZw|lz%5*yFTw_o1&(C6Gl5$7;rK3 z#QGy$ww5nldtgzeX>pq@e+s&9r@wtGx=rc+3kobVzsf{A3iOLA|n!`T&wp=jEzr-OHATk8T>InA75Xe@_xR6nd+XY zyT0n~f0DER$hBIR&@w!)t>dl&bKASR)|k_~NtY`5&cz=;_UwM=kF%W2*REDb9Okmg zJH_|mrz?AF1Q+=^fm|%pTpV+Bm22IXPh(d$tUn=rM^gPB^MdpjJ`}sUpx5Y=%X`)u z{L9dbFLpdHn|36;_NCRCm9M$S&T{!7J)vjVGw12IK9rfBkaDhfyMldc4;xX==~U0w z_E4D#>FeUWFXWXzPE9O%qqld{%MP}dug^^A@Zs2zc7Z;jTS{1ORkNK;C~0;td?+Be za*A)|$v-YGryCI-9G2|vVeh-C{x2bsch7iscvide-IWINN8sXxr(2IN-sE1t<@KHi zo(!l|ZedoR@O0;e6OJj9!Yb`qDYUcu=`+FFf?%y|CY20UNR++UxH7qYwXhPiZWpt@_qZ-LnbGoAnk_V&Wp!;qw%RE*Q>u@w z`p>g0SKkw$+L6#~PO+w+sRfGFu>s1T_d&68{~X1#+cv7fsP=+f|CV1Gyn(oUmBGaW zS3iiaw$^t;rw2ywZcFRFdeE-dqXrc{f2o-%eLVJ?r%!5;;{!rx4{>X=va)xBtxJ}M z&A-`w+vcp-NgL`WysC1)`rxD2nRDE+^!cuyZ>7-vVLy7_taoO6_q$8wC3fjy*EWx> z-~9QE8uOpMc=Gt>$U^>=Hiyl9+N8(`kF@0c({4=H7kGXn`1Sb3NAFqFrvx9)cV<$; z438dN=efMj|Fp@unB#>%g%|j7$@m>5)+I%T)mqZ%$2Y&Fwg|gCPgA>=ce|GtR-H}u z?e;!xhV|BixVy`il-_x`l-U?Han8lxm%OzU7oy5df7Y*1y=|wjhuu5XcV?dOBW0Z0 zU7l8;?nKX>nf|r%KQ=qMkT#dgw01i&`;hQ>gmHXGSEDt!@_>?c<|mwf(dFo#huu?~ zPi;PM`h=8xb?jQbI++?HCZ?BtG zRU>1Eu}+@bdUqxTW@bKj>i>t+u%cT=pX{_W$j5u`rJFq}|3U_J2s(XY^pVYZ-Wn4o z>`AS>T2rmlr?`1DZwvjRd5=k`^$CF}Iy_mj{3c8bLaH2ll|pWwGGz~*lQvCH_` zRAug26>v%_u0FObgn`tNu+MsIp$)Xsi7=6IoFenm$uc>Xdb zf9d!A?~X2T|88*V;yp#09G&pCHU_=6U43dz4egRQ8C|Bu{NjEou*sT{r*69kdX-o? zGNf5!cFV5xyH1lQ+q#W<(bBfy?VxkB*57lRHR$yj>kGrCCS4n6)t}N{N!u zOK08sNjJ3Kk~hPDP=XwU|6ban6-?QnW)dl-j_vv$d z-qni3rY(-pY$zbFegA6SI(njT{idJZ*zeoxDt)H+3efw9zen%yHiW;Tw>cNWpf`9< zY(r#SwT_^ur`H`g2scD07i zx!kYXjpo}{x0sv%dI36e<+i@h$DMjukv_h$bCPI(ctV{UPn$Si4p}kv*4+u6ejc*t z&h+Ox?-6#tP4OsNxcj?5-rwpw$4h>tztMerp5O%&JBtZ3HZLweKgRPwBjf!J;Z>bx zk8`bhL+|4I=D1J2-aeH}B}j+wcdz_uglN6GSB#kW^q0-f4}!-HK2WAq+tghTwhxqQ z^gr7q!R@i_=(fI5;jO8&=wLi^!D06Am9|8;Snuh5_sxir#~X#+ThM)amzCukoc$wd z*YZ65I+T2}WL`;sT_2YYM=BTWS}6Icbg1;UlQq}he)DkPhMQ?i6U%H4KG36xrFd_t zQsePGS_Rg0*uH-Knuall7uEPQB*|^aLPuNly&9IbE{7Kub~{z`w^F}tds*jr>9gm3 zhcqbeQKx9TR`XgU5-FD4O-czFK#Bi9Eskspui|gM@?nV)h#D&zU6j%!;frMm0NY@0|GBtCcJ%k# zu*shh>6D=dRd+2XaxK{TurK1#TEut%j8{uOM%$OaI;zg#=Ref?z!{u6u}8DE-MU=w z5>vcl<6AqO2VK=au|WK6jAk<~kTIqfxU zeDU5F^X@;$|#U1{8C6+4j+#(D_pwHCfBXO%LgM zuJ5&U9d$nr=b|sW7{YR7S%`)m#4se;Ex_fAPYPa3u32)t@l);ldN&XA%*MZ#Q&Hd@cllCFSN3aEzh5&w)2s4ck~oGnX7g7J|^CO5a3hRC!ma< zk58+=(aF2*W0e83tGqgx^=qEYok?4|q|CYUrLG{@s_M!X)8%HH(oORkH|lSn`Dld{ z_q*WHFEi^++tFJtxNk7mE`1@okhUYu#?2~oVrQn#OJxc7hOz-vD@N!37+pG6_t=Kjo?QvU= zBE{zKnQ- \ No newline at end of file diff --git a/Application/assets/images/deployWhite.svg b/Application/assets/images/deployWhite.svg deleted file mode 100644 index 7ceb211..0000000 --- a/Application/assets/images/deployWhite.svg +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file diff --git a/Application/assets/images/lightbulbWhite.svg b/Application/assets/images/lightbulbWhite.svg deleted file mode 100644 index c1fef37..0000000 --- a/Application/assets/images/lightbulbWhite.svg +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file diff --git a/Application/assets/images/stackWhite.svg b/Application/assets/images/stackWhite.svg deleted file mode 100644 index 6ba1209..0000000 --- a/Application/assets/images/stackWhite.svg +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file diff --git a/Application/assets/images/successCloudNew.svg b/Application/assets/images/successCloudNew.svg deleted file mode 100644 index 18759d8..0000000 --- a/Application/assets/images/successCloudNew.svg +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file diff --git a/Application/assets/images/tweetThis.svg b/Application/assets/images/tweetThis.svg deleted file mode 100644 index 0645220..0000000 --- a/Application/assets/images/tweetThis.svg +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file diff --git a/Application/assets/js/dependencies/sails.io.js b/Application/assets/js/dependencies/sails.io.js deleted file mode 100644 index 653a079..0000000 --- a/Application/assets/js/dependencies/sails.io.js +++ /dev/null @@ -1,1528 +0,0 @@ -/** - * To use sails.io.js in an AMD environment (e.g. with require.js), - * replace this file with the sails.io.js file from the root of: - * https://github.com/balderdashy/sails.io.js - * and download a standalone copy of socket.io-client from: - * https://github.com/socketio/socket.io-client - * then follow the instructions at: - * https://github.com/balderdashy/sails.io.js#requirejsamd-usage - */ - -// socket.io-client version 1.4.4 -// https://github.com/socketio/socket.io-client - -!function(a){if("object"==typeof exports&&"undefined"!=typeof module)module.exports=a();else if("function"==typeof define&&define.amd)define([],a);else{var b;b="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:this,b.io=a()}}(function(){var a;return function b(a,c,d){function e(g,h){if(!c[g]){if(!a[g]){var i="function"==typeof require&&require;if(!h&&i)return i(g,!0);if(f)return f(g,!0);var j=new Error("Cannot find module '"+g+"'");throw j.code="MODULE_NOT_FOUND",j}var k=c[g]={exports:{}};a[g][0].call(k.exports,function(b){var c=a[g][1][b];return e(c?c:b)},k,k.exports,b,a,c,d)}return c[g].exports}for(var f="function"==typeof require&&require,g=0;g0&&(this.extraHeaders=b.extraHeaders),this.open()}function e(a){var b={};for(var c in a)a.hasOwnProperty(c)&&(b[c]=a[c]);return b}var f=a("./transports"),g=a("component-emitter"),h=a("debug")("engine.io-client:socket"),i=a("indexof"),j=a("engine.io-parser"),k=a("parseuri"),l=a("parsejson"),m=a("parseqs");b.exports=d,d.priorWebsocketSuccess=!1,g(d.prototype),d.protocol=j.protocol,d.Socket=d,d.Transport=a("./transport"),d.transports=a("./transports"),d.parser=a("engine.io-parser"),d.prototype.createTransport=function(a){h('creating transport "%s"',a);var b=e(this.query);b.EIO=j.protocol,b.transport=a,this.id&&(b.sid=this.id);var c=new f[a]({agent:this.agent,hostname:this.hostname,port:this.port,secure:this.secure,path:this.path,query:b,forceJSONP:this.forceJSONP,jsonp:this.jsonp,forceBase64:this.forceBase64,enablesXDR:this.enablesXDR,timestampRequests:this.timestampRequests,timestampParam:this.timestampParam,policyPort:this.policyPort,socket:this,pfx:this.pfx,key:this.key,passphrase:this.passphrase,cert:this.cert,ca:this.ca,ciphers:this.ciphers,rejectUnauthorized:this.rejectUnauthorized,perMessageDeflate:this.perMessageDeflate,extraHeaders:this.extraHeaders});return c},d.prototype.open=function(){var a;if(this.rememberUpgrade&&d.priorWebsocketSuccess&&-1!=this.transports.indexOf("websocket"))a="websocket";else{if(0===this.transports.length){var b=this;return void setTimeout(function(){b.emit("error","No transports available")},0)}a=this.transports[0]}this.readyState="opening";try{a=this.createTransport(a)}catch(c){return this.transports.shift(),void this.open()}a.open(),this.setTransport(a)},d.prototype.setTransport=function(a){h("setting transport %s",a.name);var b=this;this.transport&&(h("clearing existing transport %s",this.transport.name),this.transport.removeAllListeners()),this.transport=a,a.on("drain",function(){b.onDrain()}).on("packet",function(a){b.onPacket(a)}).on("error",function(a){b.onError(a)}).on("close",function(){b.onClose("transport close")})},d.prototype.probe=function(a){function b(){if(m.onlyBinaryUpgrades){var b=!this.supportsBinary&&m.transport.supportsBinary;l=l||b}l||(h('probe transport "%s" opened',a),k.send([{type:"ping",data:"probe"}]),k.once("packet",function(b){if(!l)if("pong"==b.type&&"probe"==b.data){if(h('probe transport "%s" pong',a),m.upgrading=!0,m.emit("upgrading",k),!k)return;d.priorWebsocketSuccess="websocket"==k.name,h('pausing current transport "%s"',m.transport.name),m.transport.pause(function(){l||"closed"!=m.readyState&&(h("changing transport and sending upgrade packet"),j(),m.setTransport(k),k.send([{type:"upgrade"}]),m.emit("upgrade",k),k=null,m.upgrading=!1,m.flush())})}else{h('probe transport "%s" failed',a);var c=new Error("probe error");c.transport=k.name,m.emit("upgradeError",c)}}))}function c(){l||(l=!0,j(),k.close(),k=null)}function e(b){var d=new Error("probe error: "+b);d.transport=k.name,c(),h('probe transport "%s" failed because of error: %s',a,b),m.emit("upgradeError",d)}function f(){e("transport closed")}function g(){e("socket closed")}function i(a){k&&a.name!=k.name&&(h('"%s" works - aborting "%s"',a.name,k.name),c())}function j(){k.removeListener("open",b),k.removeListener("error",e),k.removeListener("close",f),m.removeListener("close",g),m.removeListener("upgrading",i)}h('probing transport "%s"',a);var k=this.createTransport(a,{probe:1}),l=!1,m=this;d.priorWebsocketSuccess=!1,k.once("open",b),k.once("error",e),k.once("close",f),this.once("close",g),this.once("upgrading",i),k.open()},d.prototype.onOpen=function(){if(h("socket open"),this.readyState="open",d.priorWebsocketSuccess="websocket"==this.transport.name,this.emit("open"),this.flush(),"open"==this.readyState&&this.upgrade&&this.transport.pause){h("starting upgrade probes");for(var a=0,b=this.upgrades.length;b>a;a++)this.probe(this.upgrades[a])}},d.prototype.onPacket=function(a){if("opening"==this.readyState||"open"==this.readyState)switch(h('socket receive: type "%s", data "%s"',a.type,a.data),this.emit("packet",a),this.emit("heartbeat"),a.type){case"open":this.onHandshake(l(a.data));break;case"pong":this.setPing(),this.emit("pong");break;case"error":var b=new Error("server error");b.code=a.data,this.onError(b);break;case"message":this.emit("data",a.data),this.emit("message",a.data)}else h('packet received with socket readyState "%s"',this.readyState)},d.prototype.onHandshake=function(a){this.emit("handshake",a),this.id=a.sid,this.transport.query.sid=a.sid,this.upgrades=this.filterUpgrades(a.upgrades),this.pingInterval=a.pingInterval,this.pingTimeout=a.pingTimeout,this.onOpen(),"closed"!=this.readyState&&(this.setPing(),this.removeListener("heartbeat",this.onHeartbeat),this.on("heartbeat",this.onHeartbeat))},d.prototype.onHeartbeat=function(a){clearTimeout(this.pingTimeoutTimer);var b=this;b.pingTimeoutTimer=setTimeout(function(){"closed"!=b.readyState&&b.onClose("ping timeout")},a||b.pingInterval+b.pingTimeout)},d.prototype.setPing=function(){var a=this;clearTimeout(a.pingIntervalTimer),a.pingIntervalTimer=setTimeout(function(){h("writing ping packet - expecting pong within %sms",a.pingTimeout),a.ping(),a.onHeartbeat(a.pingTimeout)},a.pingInterval)},d.prototype.ping=function(){var a=this;this.sendPacket("ping",function(){a.emit("ping")})},d.prototype.onDrain=function(){this.writeBuffer.splice(0,this.prevBufferLen),this.prevBufferLen=0,0===this.writeBuffer.length?this.emit("drain"):this.flush()},d.prototype.flush=function(){"closed"!=this.readyState&&this.transport.writable&&!this.upgrading&&this.writeBuffer.length&&(h("flushing %d packets in socket",this.writeBuffer.length),this.transport.send(this.writeBuffer),this.prevBufferLen=this.writeBuffer.length,this.emit("flush"))},d.prototype.write=d.prototype.send=function(a,b,c){return this.sendPacket("message",a,b,c),this},d.prototype.sendPacket=function(a,b,c,d){if("function"==typeof b&&(d=b,b=void 0),"function"==typeof c&&(d=c,c=null),"closing"!=this.readyState&&"closed"!=this.readyState){c=c||{},c.compress=!1!==c.compress;var e={type:a,data:b,options:c};this.emit("packetCreate",e),this.writeBuffer.push(e),d&&this.once("flush",d),this.flush()}},d.prototype.close=function(){function a(){d.onClose("forced close"),h("socket closing - telling transport to close"),d.transport.close()}function b(){d.removeListener("upgrade",b),d.removeListener("upgradeError",b),a()}function c(){d.once("upgrade",b),d.once("upgradeError",b)}if("opening"==this.readyState||"open"==this.readyState){this.readyState="closing";var d=this;this.writeBuffer.length?this.once("drain",function(){this.upgrading?c():a()}):this.upgrading?c():a()}return this},d.prototype.onError=function(a){h("socket error %j",a),d.priorWebsocketSuccess=!1,this.emit("error",a),this.onClose("transport error",a)},d.prototype.onClose=function(a,b){if("opening"==this.readyState||"open"==this.readyState||"closing"==this.readyState){h('socket close with reason: "%s"',a);var c=this;clearTimeout(this.pingIntervalTimer),clearTimeout(this.pingTimeoutTimer),this.transport.removeAllListeners("close"),this.transport.close(),this.transport.removeAllListeners(),this.readyState="closed",this.id=null,this.emit("close",a,b),c.writeBuffer=[],c.prevBufferLen=0}},d.prototype.filterUpgrades=function(a){for(var b=[],c=0,d=a.length;d>c;c++)~i(this.transports,a[c])&&b.push(a[c]);return b}}).call(this,"undefined"!=typeof self?self:"undefined"!=typeof window?window:"undefined"!=typeof global?global:{})},{"./transport":4,"./transports":5,"component-emitter":15,debug:17,"engine.io-parser":19,indexof:23,parsejson:26,parseqs:27,parseuri:28}],4:[function(a,b,c){function d(a){this.path=a.path,this.hostname=a.hostname,this.port=a.port,this.secure=a.secure,this.query=a.query,this.timestampParam=a.timestampParam,this.timestampRequests=a.timestampRequests,this.readyState="",this.agent=a.agent||!1,this.socket=a.socket,this.enablesXDR=a.enablesXDR,this.pfx=a.pfx,this.key=a.key,this.passphrase=a.passphrase,this.cert=a.cert,this.ca=a.ca,this.ciphers=a.ciphers,this.rejectUnauthorized=a.rejectUnauthorized,this.extraHeaders=a.extraHeaders}var e=a("engine.io-parser"),f=a("component-emitter");b.exports=d,f(d.prototype),d.prototype.onError=function(a,b){var c=new Error(a);return c.type="TransportError",c.description=b,this.emit("error",c),this},d.prototype.open=function(){return("closed"==this.readyState||""==this.readyState)&&(this.readyState="opening",this.doOpen()),this},d.prototype.close=function(){return("opening"==this.readyState||"open"==this.readyState)&&(this.doClose(),this.onClose()),this},d.prototype.send=function(a){if("open"!=this.readyState)throw new Error("Transport not open");this.write(a)},d.prototype.onOpen=function(){this.readyState="open",this.writable=!0,this.emit("open")},d.prototype.onData=function(a){var b=e.decodePacket(a,this.socket.binaryType);this.onPacket(b)},d.prototype.onPacket=function(a){this.emit("packet",a)},d.prototype.onClose=function(){this.readyState="closed",this.emit("close")}},{"component-emitter":15,"engine.io-parser":19}],5:[function(a,b,c){(function(b){function d(a){var c,d=!1,h=!1,i=!1!==a.jsonp;if(b.location){var j="https:"==location.protocol,k=location.port;k||(k=j?443:80),d=a.hostname!=location.hostname||k!=a.port,h=a.secure!=j}if(a.xdomain=d,a.xscheme=h,c=new e(a),"open"in c&&!a.forceJSONP)return new f(a);if(!i)throw new Error("JSONP disabled");return new g(a)}var e=a("xmlhttprequest-ssl"),f=a("./polling-xhr"),g=a("./polling-jsonp"),h=a("./websocket");c.polling=d,c.websocket=h}).call(this,"undefined"!=typeof self?self:"undefined"!=typeof window?window:"undefined"!=typeof global?global:{})},{"./polling-jsonp":6,"./polling-xhr":7,"./websocket":9,"xmlhttprequest-ssl":10}],6:[function(a,b,c){(function(c){function d(){}function e(a){f.call(this,a),this.query=this.query||{},h||(c.___eio||(c.___eio=[]),h=c.___eio),this.index=h.length;var b=this;h.push(function(a){b.onData(a)}),this.query.j=this.index,c.document&&c.addEventListener&&c.addEventListener("beforeunload",function(){b.script&&(b.script.onerror=d)},!1)}var f=a("./polling"),g=a("component-inherit");b.exports=e;var h,i=/\n/g,j=/\\n/g;g(e,f),e.prototype.supportsBinary=!1,e.prototype.doClose=function(){this.script&&(this.script.parentNode.removeChild(this.script),this.script=null),this.form&&(this.form.parentNode.removeChild(this.form),this.form=null,this.iframe=null),f.prototype.doClose.call(this)},e.prototype.doPoll=function(){var a=this,b=document.createElement("script");this.script&&(this.script.parentNode.removeChild(this.script),this.script=null),b.async=!0,b.src=this.uri(),b.onerror=function(b){a.onError("jsonp poll error",b)};var c=document.getElementsByTagName("script")[0];c?c.parentNode.insertBefore(b,c):(document.head||document.body).appendChild(b),this.script=b;var d="undefined"!=typeof navigator&&/gecko/i.test(navigator.userAgent);d&&setTimeout(function(){var a=document.createElement("iframe");document.body.appendChild(a),document.body.removeChild(a)},100)},e.prototype.doWrite=function(a,b){function c(){d(),b()}function d(){if(e.iframe)try{e.form.removeChild(e.iframe)}catch(a){e.onError("jsonp polling iframe removal error",a)}try{var b='