From 4984674453beee7a55173d2eb30e52f759669a61 Mon Sep 17 00:00:00 2001 From: Lee Fine Date: Mon, 11 Nov 2024 15:26:07 +0000 Subject: [PATCH 1/7] ab#65482 --- F5BigIQ/F5BigIQ.csproj | 20 ++++--------- integration-manifest.json | 61 +++++++++++++++++---------------------- 2 files changed, 32 insertions(+), 49 deletions(-) diff --git a/F5BigIQ/F5BigIQ.csproj b/F5BigIQ/F5BigIQ.csproj index 0546c49..5484e1b 100644 --- a/F5BigIQ/F5BigIQ.csproj +++ b/F5BigIQ/F5BigIQ.csproj @@ -1,9 +1,10 @@  - false - net6.0 + true + net6.0;net8.0 true + disable @@ -12,19 +13,10 @@ - - - - External References\Renci.SshNet.dll - - - External References\SshNet.Security.Cryptography.dll - + + Always + - - - - diff --git a/integration-manifest.json b/integration-manifest.json index 02f1d47..306df84 100644 --- a/integration-manifest.json +++ b/integration-manifest.json @@ -7,34 +7,23 @@ "description": "The F5 Big IQ Orchestrator allows for the remote management of F5 Big IQ certificate stores. Inventory, Management, and Reenrollment functions are supported.", "link_github": true, "update_catalog": true, + "release_project": "F5BigIQ/F5BigIQ.csproj", "release_dir": "F5BigIQ/bin/Release", "about": { "orchestrator": { "UOFramework": "10.4", "keyfactor_platform_version": "10.3", "pam_support": true, - "win": { - "supportsCreateStore": false, - "supportsDiscovery": false, - "supportsManagementAdd": true, - "supportsManagementRemove": true, - "supportsReenrollment": true, - "supportsInventory": true - }, - "linux": { - "supportsCreateStore": false, - "supportsDiscovery": false, - "supportsManagementAdd": true, - "supportsManagementRemove": true, - "supportsReenrollment": true, - "supportsInventory": true - }, "store_types": [ { "Name": "F5 Big IQ", "ShortName": "F5-BigIQ", "Capability": "F5-BigIQ", - "LocalStore": false, + "PrivateKeyAllowed": "Required", + "ServerRequired": true, + "PowerShell": false, + "BlueprintAllowed": true, + "CustomAliasAllowed": "Required", "SupportedOperations": { "Add": true, "Create": false, @@ -42,6 +31,11 @@ "Enrollment": true, "Remove": true }, + "PasswordOptions": { + "EntrySupported": false, + "StoreRequired": false, + "Style": "Default" + }, "Properties": [ { "Name": "DeployCertificateOnRenewal", @@ -49,7 +43,8 @@ "Type": "Bool", "DependsOn": "", "DefaultValue": "false", - "Required": false + "Required": false, + "Description": "This optional setting determines whether renewed certificates (Management-Add jobs with Overwrite selected) will be deployed to all linked Big IP devices. Linked devices are determined by looking at all of the client-ssl profiles that reference the renewed certificate that have an associated virtual server linked to a Big IP device. An immediate deployment is then scheduled within F5 Big IQ for each linked Big IP device." }, { "Name": "IgnoreSSLWarning", @@ -57,7 +52,8 @@ "Type": "Bool", "DependsOn": "", "DefaultValue": "false", - "Required": false + "Required": false, + "Description": "If you use a self signed certificate for the F5 Big IQ portal, you will need to add this optional Custom Field and set the value to True on the managed certificate store." }, { "Name": "UseTokenAuth", @@ -65,7 +61,8 @@ "Type": "Bool", "DependsOn": "", "DefaultValue": "false", - "Required": false + "Required": false, + "Description": "If you prefer to use F5 Big IQ's Token Authentication to authenticate F5 Big IQ API calls, you will need to add this optional Custom Field and set the value to True on the managed certificate store. If set to True for the store, the userid/password credentials you set for the certificate store will be used once to receive a token. This token is then used for all subsequent API calls for the duration of the job. If this option does not exist or is set to False, the userid/password credentials you set for the certificate store will be used for all API calls." }, { "Name": "LoginProviderName", @@ -73,7 +70,8 @@ "Type": "String", "DependsOn": "UseTokenAuth", "DefaultValue": "", - "Required": false + "Required": false, + "Description": "If Use Token Authentication is selected, you may optionally add a value for the authentication provider F5 Big IQ will use to retrieve the auth token. If you choose not to add this field or leave it blank on the certificate store (with no default value set), the default of \"TMOS\" will be used." } ], "EntryParameters": [ @@ -89,7 +87,8 @@ }, "DependsOn": "", "DefaultValue": "", - "Options": "" + "Options": "", + "Description": "The name F5 Big IQ uses to identify the certificate" }, { "Name": "Overwrite", @@ -103,7 +102,8 @@ }, "DependsOn": "", "DefaultValue": "False", - "Options": "" + "Options": "", + "Description": "Allow overwriting an existing certificate when reenrolling?" }, { "Name": "SANs", @@ -117,19 +117,10 @@ }, "DependsOn": "", "DefaultValue": "", - "Options": "" + "Options": "", + "Description": "External SANs for the requested certificate. Each SAN must be prefixed with the type (DNS: or IP:) and multiple SANs must be delimitted by an ampersand (&). Example: DNS:server.domain.com&IP:127.0.0.1&DNS:server2.domain.com. This is an optional field." } - ], - "PasswordOptions": { - "EntrySupported": false, - "StoreRequired": false, - "Style": "Default" - }, - "PrivateKeyAllowed": "Required", - "ServerRequired": true, - "PowerShell": false, - "BlueprintAllowed": true, - "CustomAliasAllowed": "Required" + ] } ] } From e8620f0d0871923571665c15cdc742840c882d62 Mon Sep 17 00:00:00 2001 From: Lee Fine Date: Mon, 11 Nov 2024 15:35:59 +0000 Subject: [PATCH 2/7] ab#65482 --- .github/workflows/keyfactor-bootstrap-workflow.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/keyfactor-bootstrap-workflow.yml b/.github/workflows/keyfactor-bootstrap-workflow.yml index 6d8de53..729a5a2 100644 --- a/.github/workflows/keyfactor-bootstrap-workflow.yml +++ b/.github/workflows/keyfactor-bootstrap-workflow.yml @@ -11,9 +11,10 @@ on: jobs: call-starter-workflow: - uses: keyfactor/actions/.github/workflows/starter.yml@v2 + uses: keyfactor/actions/.github/workflows/starter.yml@3.1.2-rc.0 secrets: token: ${{ secrets.V2BUILDTOKEN}} APPROVE_README_PUSH: ${{ secrets.APPROVE_README_PUSH}} gpg_key: ${{ secrets.KF_GPG_PRIVATE_KEY }} gpg_pass: ${{ secrets.KF_GPG_PASSPHRASE }} + scan_token: ${{ secrets.SAST_TOKEN }} From 73e8eb2dcb6f82c550a3d0489cb41d9bed13bcad Mon Sep 17 00:00:00 2001 From: Keyfactor Date: Mon, 11 Nov 2024 15:36:58 +0000 Subject: [PATCH 3/7] Update generated docs --- README.md | 325 +++++++++++++++++--------------------- docsource/content.md | 16 ++ docsource/f5-bigiq.md | 20 +++ integration-manifest.json | 256 +++++++++++++++--------------- 4 files changed, 305 insertions(+), 312 deletions(-) create mode 100644 docsource/content.md create mode 100644 docsource/f5-bigiq.md diff --git a/README.md b/README.md index ccded26..1a29a62 100644 --- a/README.md +++ b/README.md @@ -1,270 +1,227 @@ +

+ F5 BigIQ Universal Orchestrator Extension +

+ +

+ +Integration Status: production +Release +Issues +GitHub Downloads (all assets, all releases) +

-# F5 BigIQ - -The F5 Big IQ Orchestrator allows for the remote management of F5 Big IQ certificate stores. Inventory, Management, and Reenrollment functions are supported. - -#### Integration status: Production - Ready for use in production environments. - -## About the Keyfactor Universal Orchestrator Extension - -This repository contains a Universal Orchestrator Extension which is a plugin to the Keyfactor Universal Orchestrator. Within the Keyfactor Platform, Orchestrators are used to manage “certificate stores” — collections of certificates and roots of trust that are found within and used by various applications. - -The Universal Orchestrator is part of the Keyfactor software distribution and is available via the Keyfactor customer portal. For general instructions on installing Extensions, see the “Keyfactor Command Orchestrator Installation and Configuration Guide” section of the Keyfactor documentation. For configuration details of this specific Extension see below in this readme. - -The Universal Orchestrator is the successor to the Windows Orchestrator. This Orchestrator Extension plugin only works with the Universal Orchestrator and does not work with the Windows Orchestrator. - -## Support for F5 BigIQ - -F5 BigIQ is supported by Keyfactor for Keyfactor customers. If you have a support issue, please open a support ticket via the Keyfactor Support Portal at https://support.keyfactor.com - -###### To report a problem or suggest a new feature, use the **[Issues](../../issues)** tab. If you want to contribute actual bug fixes or proposed enhancements, use the **[Pull requests](../../pulls)** tab. - ---- +

+ + + Support + + · + + Installation + + · + + License + + · + + Related Integrations + +

+## Overview ---- +TODO Overview is a required section -## Keyfactor Version Supported +### F5-BigIQ +TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info -The minimum version of the Keyfactor Universal Orchestrator Framework needed to run this version of the extension is 10.4 -## Platform Specific Notes -The Keyfactor Universal Orchestrator may be installed on either Windows or Linux based platforms. The certificate operations supported by a capability may vary based what platform the capability is installed on. The table below indicates what capabilities are supported based on which platform the encompassing Universal Orchestrator is running. -| Operation | Win | Linux | -|-----|-----|------| -|Supports Management Add|✓ |✓ | -|Supports Management Remove|✓ |✓ | -|Supports Create Store| | | -|Supports Discovery| | | -|Supports Reenrollment|✓ |✓ | -|Supports Inventory|✓ |✓ | +TODO Overview is a required section +## Compatibility -## PAM Integration +This integration is compatible with Keyfactor Universal Orchestrator version 10.4 and later. -This orchestrator extension has the ability to connect to a variety of supported PAM providers to allow for the retrieval of various client hosted secrets right from the orchestrator server itself. This eliminates the need to set up the PAM integration on Keyfactor Command which may be in an environment that the client does not want to have access to their PAM provider. +## Support +The F5 BigIQ Universal Orchestrator extension is supported by Keyfactor for Keyfactor customers. If you have a support issue, please open a support ticket with your Keyfactor representative. If you have a support issue, please open a support ticket via the Keyfactor Support Portal at https://support.keyfactor.com. + +> To report a problem or suggest a new feature, use the **[Issues](../../issues)** tab. If you want to contribute actual bug fixes or proposed enhancements, use the **[Pull requests](../../pulls)** tab. -The secrets that this orchestrator extension supports for use with a PAM Provider are: +## Requirements & Prerequisites -|Name|Description| -|----|-----------| -|ServerUsername|The user id that will be used to authenticate to the F5 Biq API endpoints| -|ServerPassword|The password that will be used to authenticate to the F5 Biq API endpoints| - +Before installing the F5 BigIQ Universal Orchestrator extension, we recommend that you install [kfutil](https://github.com/Keyfactor/kfutil). Kfutil is a command-line tool that simplifies the process of creating store types, installing extensions, and instantiating certificate stores in Keyfactor Command. -It is not necessary to use a PAM Provider for all of the secrets available above. If a PAM Provider should not be used, simply enter in the actual value to be used, as normal. -If a PAM Provider will be used for one of the fields above, start by referencing the [Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam). The GitHub repo for the PAM Provider to be used contains important information such as the format of the `json` needed. What follows is an example but does not reflect the `json` values for all PAM Providers as they have different "instance" and "initialization" parameter names and values. +TODO Requirements is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info -
General PAM Provider Configuration -

+### F5 Big IQ Requirements +TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info +TODO Requirements is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info -### Example PAM Provider Setup -To use a PAM Provider to resolve a field, in this example the __Server Password__ will be resolved by the `Hashicorp-Vault` provider, first install the PAM Provider extension from the [Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam) on the Universal Orchestrator. -Next, complete configuration of the PAM Provider on the UO by editing the `manifest.json` of the __PAM Provider__ (e.g. located at extensions/Hashicorp-Vault/manifest.json). The "initialization" parameters need to be entered here: -~~~ json - "Keyfactor:PAMProviders:Hashicorp-Vault:InitializationInfo": { - "Host": "http://127.0.0.1:8200", - "Path": "v1/secret/data", - "Token": "xxxxxx" - } -~~~ +## Create the F5-BigIQ Certificate Store Type -After these values are entered, the Orchestrator needs to be restarted to pick up the configuration. Now the PAM Provider can be used on other Orchestrator Extensions. +To use the F5 BigIQ Universal Orchestrator extension, you **must** create the F5-BigIQ Certificate Store Type. This only needs to happen _once_ per Keyfactor Command instance. -### Use the PAM Provider -With the PAM Provider configured as an extenion on the UO, a `json` object can be passed instead of an actual value to resolve the field with a PAM Provider. Consult the [Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam) for the specific format of the `json` object. -To have the __Server Password__ field resolved by the `Hashicorp-Vault` provider, the corresponding `json` object from the `Hashicorp-Vault` extension needs to be copied and filed in with the correct information: +TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info -~~~ json -{"Secret":"my-kv-secret","Key":"myServerPassword"} -~~~ -This text would be entered in as the value for the __Server Password__, instead of entering in the actual password. The Orchestrator will attempt to use the PAM Provider to retrieve the __Server Password__. If PAM should not be used, just directly enter in the value for the field. -

-
+* **Create F5-BigIQ using kfutil**: + ```shell + # F5 Big IQ + kfutil store-types create F5-BigIQ + ``` +* **Create F5-BigIQ manually in the Command UI**: +
Create F5-BigIQ manually in the Command UI + Create a store type called `F5-BigIQ` with the attributes in the tables below: ---- + #### Basic Tab + | Attribute | Value | Description | + | --------- | ----- | ----- | + | Name | F5 Big IQ | Display name for the store type (may be customized) | + | Short Name | F5-BigIQ | Short display name for the store type | + | Capability | F5-BigIQ | Store type name orchestrator will register with. Check the box to allow entry of value | + | Supports Add | ✅ Checked | Check the box. Indicates that the Store Type supports Management Add | + | Supports Remove | ✅ Checked | Check the box. Indicates that the Store Type supports Management Remove | + | Supports Discovery | 🔲 Unchecked | Indicates that the Store Type supports Discovery | + | Supports Reenrollment | 🔲 Unchecked | Indicates that the Store Type supports Reenrollment | + | Supports Create | 🔲 Unchecked | Indicates that the Store Type supports store creation | + | Needs Server | ✅ Checked | Determines if a target server name is required when creating store | + | Blueprint Allowed | ✅ Checked | Determines if store type may be included in an Orchestrator blueprint | + | Uses PowerShell | 🔲 Unchecked | Determines if underlying implementation is PowerShell | + | Requires Store Password | 🔲 Unchecked | Enables users to optionally specify a store password when defining a Certificate Store. | + | Supports Entry Password | 🔲 Unchecked | Determines if an individual entry within a store can have a password. | + The Basic tab should look like this: -## Overview + ![F5-BigIQ Basic Tab](docsource/images/F5-BigIQ-basic-store-type-dialog.png) -The F5 Big IQ Orchestrator Extension supports the following use cases: + #### Advanced Tab + | Attribute | Value | Description | + | --------- | ----- | ----- | + | Supports Custom Alias | Required | Determines if an individual entry within a store can have a custom Alias. | + | Private Key Handling | Required | This determines if Keyfactor can send the private key associated with a certificate to the store. Required because IIS certificates without private keys would be invalid. | + | PFX Password Style | Default | 'Default' - PFX password is randomly generated, 'Custom' - PFX password may be specified when the enrollment job is created (Requires the Allow Custom Password application setting to be enabled.) | -- Inventories an existing F5 Big IQ device to import SSL certificates into Keyfactor Command for management -- Add an existing or newly enrolled certificate and private key to an existing F5 Big IQ device not already on that device. -- Remove a certificate and private key from an existing F5 Big IQ device. -- Add an existing or newly enrolled certificate and private key to an existing F5 Big IQ device already on that device. Optionally (based on the DeployCertificateOnRenewal setting on the certificate store), the newly renewed/replaced certificate will be deployed to any linked F5 Big IP device. -- Reenrollment (On Device Key Generation) of a new or existing certificate on the F5 Big IQ device. In this use case, the key pair and CSR will be created on the F5 Big IQ device, Keyfactor Command will enroll the certificate, and the certificate will then be installed on the device. If the DeployCertificateOnRenewal option is set, the certificate will be deployed to any linked F5 Big IP devices. + The Advanced tab should look like this: -Use cases NOT supported by the F5 Big IQ Orchestrator Extension: + ![F5-BigIQ Advanced Tab](docsource/images/F5-BigIQ-advanced-store-type-dialog.png) -- Creating new binding relationships between F5 Big IQ and any linked F5 Big IP devices. -- Storing binding relationships in Keyfactor Command during Inventory. + #### Custom Fields Tab + Custom fields operate at the certificate store level and are used to control how the orchestrator connects to the remote target server containing the certificate store to be managed. The following custom fields should be added to the store type: + | Name | Display Name | Description | Type | Default Value/Options | Required | + | ---- | ------------ | ---- | --------------------- | -------- | ----------- | + | DeployCertificateOnRenewal | Deploy Certificate to Linked Big IP on Renewal | This optional setting determines whether renewed certificates (Management-Add jobs with Overwrite selected) will be deployed to all linked Big IP devices. Linked devices are determined by looking at all of the client-ssl profiles that reference the renewed certificate that have an associated virtual server linked to a Big IP device. An immediate deployment is then scheduled within F5 Big IQ for each linked Big IP device. | Bool | false | 🔲 Unchecked | + | IgnoreSSLWarning | Ignore SSL Warning | If you use a self signed certificate for the F5 Big IQ portal, you will need to add this optional Custom Field and set the value to True on the managed certificate store. | Bool | false | 🔲 Unchecked | + | UseTokenAuth | Use Token Authentication | If you prefer to use F5 Big IQ's Token Authentication to authenticate F5 Big IQ API calls, you will need to add this optional Custom Field and set the value to True on the managed certificate store. If set to True for the store, the userid/password credentials you set for the certificate store will be used once to receive a token. This token is then used for all subsequent API calls for the duration of the job. If this option does not exist or is set to False, the userid/password credentials you set for the certificate store will be used for all API calls. | Bool | false | 🔲 Unchecked | + | LoginProviderName | Authentication Provider Name | If Use Token Authentication is selected, you may optionally add a value for the authentication provider F5 Big IQ will use to retrieve the auth token. If you choose not to add this field or leave it blank on the certificate store (with no default value set), the default of "TMOS" will be used. | String | | 🔲 Unchecked | -## Versioning + The Custom Fields tab should look like this: -The version number of a the F5 Big IQ Orchestrator Extension can be verified by right clicking on the F5BigIQ.dll file, selecting Properties, and then clicking on the Details tab. + ![F5-BigIQ Custom Fields Tab](docsource/images/F5-BigIQ-custom-fields-store-type-dialog.png) -## F5 Big IQ Prerequisites -When creating a Keyfactor Command Certificate Store, you will be asked to enter server credentials. These credentials will serve two purposes: -1. They will be used to authenticate to the F5 Big IQ instance when accessing API endpoints. Please make sure these credentials have Admin authority on F5 Big IQ. -2. When Inventorying and Adding/Replacing certificates it will be necessary for certificate files to be transferred to and from the F5 device. The F5 Big IQ Orchestrator Extension uses SCP (Secure Copy Protocol) to perform these functions. Please make sure your F5 Big IQ device is set up to allow SCP to transfer files *to* /var/config/rest/downloads (a reserved F5 Big IQ folder used for file transfers) and *from* /var/config/rest/fileobject (the certificate file location path) and all subfolders. Other configuration tasks may be necessary in your environment to enable this feature. + #### Entry Parameters Tab + | Name | Display Name | Description | Type | Default Value | Entry has a private key | Adding an entry | Removing an entry | Reenrolling an entry | + | ---- | ------------ | ---- | ------------- | ----------------------- | ---------------- | ----------------- | ------------------- | ----------- | + | Alias | Alias (Reenrollment only) | The name F5 Big IQ uses to identify the certificate | String | | 🔲 Unchecked | 🔲 Unchecked | 🔲 Unchecked | ✅ Checked | + | Overwrite | Overwrite (Reenrollment only) | Allow overwriting an existing certificate when reenrolling? | Bool | False | 🔲 Unchecked | 🔲 Unchecked | 🔲 Unchecked | ✅ Checked | + | SANs | SANs (Reenrollment only) | External SANs for the requested certificate. Each SAN must be prefixed with the type (DNS: or IP:) and multiple SANs must be delimitted by an ampersand (&). Example: DNS:server.domain.com&IP:127.0.0.1&DNS:server2.domain.com. This is an optional field. | String | | 🔲 Unchecked | 🔲 Unchecked | 🔲 Unchecked | 🔲 Unchecked | -## F5 Big IQ Orchestrator Extension Installation + The Entry Parameters tab should look like this: -1. Stop the Keyfactor Universal Orchestrator Service. -2. In the Keyfactor Orchestrator installation folder (by convention usually C:\Program Files\Keyfactor\Keyfactor Orchestrator), find the "extensions" folder. Underneath that, create a new folder named F5BigIQ or another name of your choosing. -3. Download the latest version of the F5 BigIQ Orchestrator Extension from [GitHub](https://github.com/Keyfactor/f5-bigiq-rest-orchestrator). -4. Copy the contents of the download installation zip file into the folder created in step 2. -5. Start the Keyfactor Universal Orchestrator Service. + ![F5-BigIQ Entry Parameters Tab](docsource/images/F5-BigIQ-entry-parameters-store-type-dialog.png) -## F5 Big IQ Orchestrator Extension Configuration -### 1\. In Keyfactor Command, create a new certificate store type by navigating to Settings (the "gear" icon in the top right) => Certificate Store Types, and clicking ADD. Then enter the following information: +
-
-Basic Tab +## Installation -- **Name** – Required. The descriptive display name of the new Certificate Store Type. Suggested => F5 Big IQ -- **Short Name** – Required. This value ***must be*** F5-BigIQ. -- **Custom Capability** - Leave unchecked -- **Supported Job Types** – Select Inventory, Add, and Remove. -- **General Settings** - Select Needs Server. Select Blueprint Allowed if you plan to use blueprinting. Leave Uses PowerShell unchecked. -- **Password Settings** - Leave both options unchecked +1. **Download the latest F5 BigIQ Universal Orchestrator extension from GitHub.** -
+ Navigate to the [F5 BigIQ Universal Orchestrator extension GitHub version page](https://github.com/Keyfactor/f5-bigiq-rest-orchestrator/releases/latest). Refer to the compatibility matrix below to determine whether the `net6.0` or `net8.0` asset should be downloaded. Then, click the corresponding asset to download the zip archive. + | Universal Orchestrator Version | Latest .NET version installed on the Universal Orchestrator server | `rollForward` condition in `Orchestrator.runtimeconfig.json` | `f5-bigiq-rest-orchestrator` .NET version to download | + | --------- | ----------- | ----------- | ----------- | + | Older than `11.0.0` | | | `net6.0` | + | Between `11.0.0` and `11.5.1` (inclusive) | `net6.0` | | `net6.0` | + | Between `11.0.0` and `11.5.1` (inclusive) | `net8.0` | `Never` | `net6.0` | + | Between `11.0.0` and `11.5.1` (inclusive) | `net8.0` | `LatestMajor` | `net8.0` | + | `11.6` _and_ newer | `net8.0` | | `net8.0` | -
-Advanced Tab + Unzip the archive containing extension assemblies to a known location. -- **Store Path Type** - Select Freeform -- **Supports Custom Alias** - Required -- **Private Key Handling** - Required -- **PFX Password Style** - Default + > **Note** If you don't see an asset with a corresponding .NET version, you should always assume that it was compiled for `net6.0`. -
+2. **Locate the Universal Orchestrator extensions directory.** -
-Custom Fields Tab + * **Default on Windows** - `C:\Program Files\Keyfactor\Keyfactor Orchestrator\extensions` + * **Default on Linux** - `/opt/keyfactor/orchestrator/extensions` + +3. **Create a new directory for the F5 BigIQ Universal Orchestrator extension inside the extensions directory.** + + Create a new directory called `f5-bigiq-rest-orchestrator`. + > The directory name does not need to match any names used elsewhere; it just has to be unique within the extensions directory. -- **Deploy Certificate to Linked Big IP on Renewal** - optional - This setting determines you wish to deploy renewed certificates (Management-Add jobs with Overwrite selected) to all linked Big IP devices. Linked devices are determined by looking at all of the client-ssl profiles that reference the renewed certificate that have an associated virtual server linked to a Big IP device. An "immediate" deployment is then scheduled within F5 Big IQ for each linked Big IP device. - - **Name**=DeployCertificateOnRenewal - - **Display Name**=Deploy Certificate to Linked Big IP on Renewal - - **Type**=Bool - - **Default Value**={client preference} - - **Depends on**=unchecked - - **Required**=unchecked +4. **Copy the contents of the downloaded and unzipped assemblies from __step 2__ to the `f5-bigiq-rest-orchestrator` directory.** -- **Ignore SSL Warning** - optional - If you use a self signed certificate for the F5 Big IQ portal, you will need add this Custom Field and set the value to True on the managed certificate store. - - **Name**=IgnoreSSLWarning - - **Display Name**=Ignore SSL Warning - - **Type**=Bool - - **Default Value**={client preference} - - **Depends on**=unchecked - - **Required**=unchecked +5. **Restart the Universal Orchestrator service.** -- **Use Token Authentication** - optional - If you prefer to use F5 Big IQ's Token Authentication to authenticate F5 Big IQ API calls that the integration uses, you will need to add this Custom Field and set the value to True on the managed certificate store. If this exists and is set to True for the store, the store userid/password credentials you set for the certificate store will be used once to receive a token. This token is then used for all remaining API calls for the duration of the job. If this option does not exist or is set to False, the userid/password credentials you set on the certificate store will be used for each API call. - - **Name**=UseTokenAuth - - **Display Name**=Use Token Authentication - - **Type**=Bool - - **Default Value**={client preference} - - **Depends on**=unchecked - - **Required**=unchecked + Refer to [Starting/Restarting the Universal Orchestrator service](https://software.keyfactor.com/Core-OnPrem/Current/Content/InstallingAgents/NetCoreOrchestrator/StarttheService.htm). -- **Use Token Authentication Provider Name** - optional - If Use Token Authentication is selected, you may optionally add a value for the authentication provider F5 Big IQ will use to retrieve the auth token. If you choose not to add this field or leave it blank on the certificate store (with no default value set), the default of "TMOS" will be used. - - **Name**=LoginProviderName - - **Display Name**=Use Token Authentication Provider Name - - **Type**=String - - **Default Value**={client preference} - - **Depends on**="UseTokenAuth" - - **Required**=unchecked -Please note, after saving the store type, going back into this screen will show three additional Custom Fields: Server Username, Server Password, and Use SSL. These are added internally by Keyfactor Command and should not be modified. -
+> The above installation steps can be supplimented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/InstallingAgents/NetCoreOrchestrator/CustomExtensions.htm?Highlight=extensions). -
-Entry Parameters Tab -Entry parameters are required ONLY if you will be taking advantage of the Reenrollment (ODKG - On Device Key Generation) capability of the F5 Big IQ Orchestrator Extension. When scheduling Reenrollment or Management jobs, some versions of Keyfactor Command may show multiple Alias and Overwrite fields. The ones below will be used for Reenrollment while the others will be used for Management. +## Post Installation -- **Alias** - required - The identifying name of the certificate - - **Name**=Alias - - **Display Name**=Alias (Reenrollment Only) - - **Type**=String - - **Default Value**=Leave Blank - - **Depends On**=unchecked - - **Required When**=Check Reenrolling an entry +TODO Post Installation is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info -- **Overwrite** - required - Allow overwriting an existing certificate when reenrolling? - - **Name**=Overwrite - - **Display Name**=Overwrite (Reenrollment Only) - - **Type**=Bool - - **Default Value**=False - - **Depends On**=unchecked - - **Required When**=Check Reenrolling an entry -- **SANs** - optional - External SANs for the requested certificate. Each SAN must be prefixed with the type (DNS: or IP:) and multiple SANs must be delimitted by an ampersand (&). Example: DNS:server.domain.com&IP:127.0.0.1&DNS:server2.domain.com - - **Name**=SANs - - **Display Name**=SANs (Reenrollment Only) - - **Type**=String - - **Default Value**=Leave Blank - - **Depends On**=unchecked - - **Required When**=Leave all unchecked +## Defining Certificate Stores -
-### 2\. Create an F5 Big IQ Certificate Store +TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info -Navigate to Certificate Locations =\> Certificate Stores within Keyfactor Command to add the store. Below are the values that should be entered: +TODO Certificate Store Configuration is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info -- **Category** – Required. Select the Name you entered when creating the Certificate Store Type. Suggested value was F5 Big IQ. -- **Container** – Optional. Select a container if utilized. -- **Client Machine & Credentials** – Required. The full URL of the F5 Big IQ device portal. - -- **Store Path** – Required. Enter the name of the partition on the F5 Big IQ device you wish to manage. This value is case sensitive, so if the partition name is "Common", it must be entered as "Common" and not "common". +> The content in this section can be supplimented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Certificate%20Stores.htm?Highlight=certificate%20store). -- **Orchestrator** – Required. Select the orchestrator you wish to use to manage this store -- **Deploy Certificate to Linked Big IP on Renewal** - Optional. Set this to True if you wish to deploy renewed certificates (Management-Add jobs with Overwrite selected) to all linked Big IP devices. Linked devices are determined by looking at all of the client-ssl profiles that reference the renewed certificate that have an associated virtual server linked to a Big IP device. An "immediate" deployment is then scheduled within F5 Big IQ for each linked Big IP device. +## Discovering Certificate Stores with the Discovery Job +TODO Discovery is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info -- **Ignore SSL Warning** - Optional. Set this to True if you wish to ignore SSL warnings from F5 that occur during API calls when the site does not have a trusted certificate with the proper SAN bound to it. If you chose not to add this Custom Field when creating the Certificate Store Type, the default value of False will be assumed. If this value is False (or missing) SSL warnings will cause errors during orchestrator extension jobs. -- **Use Token Authentication** - Optional. Set this to True if you wish to use F5 Big IQ's token authentiation instead of basic authentication for all API requests. If you chose not to add this optional Custom Field when creating the Certificate Store Type, the default value of False will be assumed and basic authentication will be used for all API requests for all jobs. Setting this value to True will enable an initial basic authenticated request to acquire an authentication token, which will then be used for all subsequent API requests. +### F5 Big IQ Discovery Job +TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info -- **Use Token Authentication Provider Name** - Optional - If Use Token Authentication is selected, you may optionally add a value for the authentication provider F5 Big IQ will use to retrieve the auth token. If you choose leave this field blank, the default of "TMOS" will be used. +TODO Discovery Job Configuration is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info -- **Server Username/Password** - Required. The credentials used to log into the F5 Big IQ device to perform API calls. These values for server login can be either: - - - UserId/Password - - PAM provider information used to look up the UserId/Password credentials - Please make sure these credentials have Admin rights on the F5 Big IQ device and can perform SCP functions as described in the F5 Big IQ Prerequisites section above. -- **Use SSL** - N/A. This value is not referenced in the F5 Big IQ Orchestrator Extension. The value you enter for Client Machine, and specifically whether the protocol entered is http:// or https:// will determine whether a TLS (SSL) connection is utilized. -- **Inventory Schedule** – Set a schedule for running Inventory jobs or "none", if you choose not to schedule Inventory at this time. +## License -When creating cert store type manually, that store property names and entry parameter names are case sensitive +Apache License 2.0, see [LICENSE](LICENSE). +## Related Integrations +See all [Keyfactor Universal Orchestrator extensions](https://github.com/orgs/Keyfactor/repositories?q=orchestrator). \ No newline at end of file diff --git a/docsource/content.md b/docsource/content.md new file mode 100644 index 0000000..48b64fd --- /dev/null +++ b/docsource/content.md @@ -0,0 +1,16 @@ +## Overview + +TODO Overview is a required section + +## Requirements + +TODO Requirements is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info + +## Post Installation + +TODO Post Installation is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info + +## Discovery + +TODO Discovery is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info + diff --git a/docsource/f5-bigiq.md b/docsource/f5-bigiq.md new file mode 100644 index 0000000..d53d056 --- /dev/null +++ b/docsource/f5-bigiq.md @@ -0,0 +1,20 @@ +## Overview + +TODO Overview is a required section + +## Requirements + +TODO Requirements is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info + +## Discovery Job Configuration + +TODO Discovery Job Configuration is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info + +## Certificate Store Configuration + +TODO Certificate Store Configuration is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info + +## Global Store Type Section + +TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info + diff --git a/integration-manifest.json b/integration-manifest.json index 306df84..7b29036 100644 --- a/integration-manifest.json +++ b/integration-manifest.json @@ -1,128 +1,128 @@ -{ - "$schema": "https://keyfactor.github.io/integration-manifest-schema.json", - "integration_type": "orchestrator", - "name": "F5 BigIQ", - "status": "production", - "support_level": "kf-supported", - "description": "The F5 Big IQ Orchestrator allows for the remote management of F5 Big IQ certificate stores. Inventory, Management, and Reenrollment functions are supported.", - "link_github": true, - "update_catalog": true, - "release_project": "F5BigIQ/F5BigIQ.csproj", - "release_dir": "F5BigIQ/bin/Release", - "about": { - "orchestrator": { - "UOFramework": "10.4", - "keyfactor_platform_version": "10.3", - "pam_support": true, - "store_types": [ - { - "Name": "F5 Big IQ", - "ShortName": "F5-BigIQ", - "Capability": "F5-BigIQ", - "PrivateKeyAllowed": "Required", - "ServerRequired": true, - "PowerShell": false, - "BlueprintAllowed": true, - "CustomAliasAllowed": "Required", - "SupportedOperations": { - "Add": true, - "Create": false, - "Discovery": false, - "Enrollment": true, - "Remove": true - }, - "PasswordOptions": { - "EntrySupported": false, - "StoreRequired": false, - "Style": "Default" - }, - "Properties": [ - { - "Name": "DeployCertificateOnRenewal", - "DisplayName": "Deploy Certificate to Linked Big IP on Renewal", - "Type": "Bool", - "DependsOn": "", - "DefaultValue": "false", - "Required": false, - "Description": "This optional setting determines whether renewed certificates (Management-Add jobs with Overwrite selected) will be deployed to all linked Big IP devices. Linked devices are determined by looking at all of the client-ssl profiles that reference the renewed certificate that have an associated virtual server linked to a Big IP device. An immediate deployment is then scheduled within F5 Big IQ for each linked Big IP device." - }, - { - "Name": "IgnoreSSLWarning", - "DisplayName": "Ignore SSL Warning", - "Type": "Bool", - "DependsOn": "", - "DefaultValue": "false", - "Required": false, - "Description": "If you use a self signed certificate for the F5 Big IQ portal, you will need to add this optional Custom Field and set the value to True on the managed certificate store." - }, - { - "Name": "UseTokenAuth", - "DisplayName": "Use Token Authentication", - "Type": "Bool", - "DependsOn": "", - "DefaultValue": "false", - "Required": false, - "Description": "If you prefer to use F5 Big IQ's Token Authentication to authenticate F5 Big IQ API calls, you will need to add this optional Custom Field and set the value to True on the managed certificate store. If set to True for the store, the userid/password credentials you set for the certificate store will be used once to receive a token. This token is then used for all subsequent API calls for the duration of the job. If this option does not exist or is set to False, the userid/password credentials you set for the certificate store will be used for all API calls." - }, - { - "Name": "LoginProviderName", - "DisplayName": "Authentication Provider Name", - "Type": "String", - "DependsOn": "UseTokenAuth", - "DefaultValue": "", - "Required": false, - "Description": "If Use Token Authentication is selected, you may optionally add a value for the authentication provider F5 Big IQ will use to retrieve the auth token. If you choose not to add this field or leave it blank on the certificate store (with no default value set), the default of \"TMOS\" will be used." - } - ], - "EntryParameters": [ - { - "Name": "Alias", - "DisplayName": "Alias (Reenrollment only)", - "Type": "String", - "RequiredWhen": { - "HasPrivateKey": false, - "OnAdd": false, - "OnRemove": false, - "OnReenrollment": true - }, - "DependsOn": "", - "DefaultValue": "", - "Options": "", - "Description": "The name F5 Big IQ uses to identify the certificate" - }, - { - "Name": "Overwrite", - "DisplayName": "Overwrite (Reenrollment only)", - "Type": "Bool", - "RequiredWhen": { - "HasPrivateKey": false, - "OnAdd": false, - "OnRemove": false, - "OnReenrollment": true - }, - "DependsOn": "", - "DefaultValue": "False", - "Options": "", - "Description": "Allow overwriting an existing certificate when reenrolling?" - }, - { - "Name": "SANs", - "DisplayName": "SANs (Reenrollment only)", - "Type": "String", - "RequiredWhen": { - "HasPrivateKey": false, - "OnAdd": false, - "OnRemove": false, - "OnReenrollment": false - }, - "DependsOn": "", - "DefaultValue": "", - "Options": "", - "Description": "External SANs for the requested certificate. Each SAN must be prefixed with the type (DNS: or IP:) and multiple SANs must be delimitted by an ampersand (&). Example: DNS:server.domain.com&IP:127.0.0.1&DNS:server2.domain.com. This is an optional field." - } - ] - } - ] - } - } -} +{ + "$schema": "https://keyfactor.github.io/integration-manifest-schema.json", + "integration_type": "orchestrator", + "name": "F5 BigIQ", + "status": "production", + "support_level": "kf-supported", + "description": "The F5 Big IQ Orchestrator allows for the remote management of F5 Big IQ certificate stores. Inventory, Management, and Reenrollment functions are supported.", + "link_github": true, + "update_catalog": true, + "release_project": "F5BigIQ/F5BigIQ.csproj", + "release_dir": "F5BigIQ/bin/Release", + "about": { + "orchestrator": { + "UOFramework": "10.4", + "keyfactor_platform_version": "10.3", + "pam_support": true, + "store_types": [ + { + "Name": "F5 Big IQ", + "ShortName": "F5-BigIQ", + "Capability": "F5-BigIQ", + "PrivateKeyAllowed": "Required", + "ServerRequired": true, + "PowerShell": false, + "BlueprintAllowed": true, + "CustomAliasAllowed": "Required", + "SupportedOperations": { + "Add": true, + "Create": false, + "Discovery": false, + "Enrollment": true, + "Remove": true + }, + "PasswordOptions": { + "EntrySupported": false, + "StoreRequired": false, + "Style": "Default" + }, + "Properties": [ + { + "Name": "DeployCertificateOnRenewal", + "DisplayName": "Deploy Certificate to Linked Big IP on Renewal", + "Type": "Bool", + "DependsOn": "", + "DefaultValue": "false", + "Required": false, + "Description": "This optional setting determines whether renewed certificates (Management-Add jobs with Overwrite selected) will be deployed to all linked Big IP devices. Linked devices are determined by looking at all of the client-ssl profiles that reference the renewed certificate that have an associated virtual server linked to a Big IP device. An immediate deployment is then scheduled within F5 Big IQ for each linked Big IP device." + }, + { + "Name": "IgnoreSSLWarning", + "DisplayName": "Ignore SSL Warning", + "Type": "Bool", + "DependsOn": "", + "DefaultValue": "false", + "Required": false, + "Description": "If you use a self signed certificate for the F5 Big IQ portal, you will need to add this optional Custom Field and set the value to True on the managed certificate store." + }, + { + "Name": "UseTokenAuth", + "DisplayName": "Use Token Authentication", + "Type": "Bool", + "DependsOn": "", + "DefaultValue": "false", + "Required": false, + "Description": "If you prefer to use F5 Big IQ's Token Authentication to authenticate F5 Big IQ API calls, you will need to add this optional Custom Field and set the value to True on the managed certificate store. If set to True for the store, the userid/password credentials you set for the certificate store will be used once to receive a token. This token is then used for all subsequent API calls for the duration of the job. If this option does not exist or is set to False, the userid/password credentials you set for the certificate store will be used for all API calls." + }, + { + "Name": "LoginProviderName", + "DisplayName": "Authentication Provider Name", + "Type": "String", + "DependsOn": "UseTokenAuth", + "DefaultValue": "", + "Required": false, + "Description": "If Use Token Authentication is selected, you may optionally add a value for the authentication provider F5 Big IQ will use to retrieve the auth token. If you choose not to add this field or leave it blank on the certificate store (with no default value set), the default of \"TMOS\" will be used." + } + ], + "EntryParameters": [ + { + "Name": "Alias", + "DisplayName": "Alias (Reenrollment only)", + "Type": "String", + "RequiredWhen": { + "HasPrivateKey": false, + "OnAdd": false, + "OnRemove": false, + "OnReenrollment": true + }, + "DependsOn": "", + "DefaultValue": "", + "Options": "", + "Description": "The name F5 Big IQ uses to identify the certificate" + }, + { + "Name": "Overwrite", + "DisplayName": "Overwrite (Reenrollment only)", + "Type": "Bool", + "RequiredWhen": { + "HasPrivateKey": false, + "OnAdd": false, + "OnRemove": false, + "OnReenrollment": true + }, + "DependsOn": "", + "DefaultValue": "False", + "Options": "", + "Description": "Allow overwriting an existing certificate when reenrolling?" + }, + { + "Name": "SANs", + "DisplayName": "SANs (Reenrollment only)", + "Type": "String", + "RequiredWhen": { + "HasPrivateKey": false, + "OnAdd": false, + "OnRemove": false, + "OnReenrollment": false + }, + "DependsOn": "", + "DefaultValue": "", + "Options": "", + "Description": "External SANs for the requested certificate. Each SAN must be prefixed with the type (DNS: or IP:) and multiple SANs must be delimitted by an ampersand (&). Example: DNS:server.domain.com&IP:127.0.0.1&DNS:server2.domain.com. This is an optional field." + } + ] + } + ] + } + } +} \ No newline at end of file From 9deb55f2d835d11b9a1f10e18ada1f35d20ee31f Mon Sep 17 00:00:00 2001 From: Lee Fine Date: Tue, 12 Nov 2024 17:02:02 +0000 Subject: [PATCH 4/7] ab#65482 --- .../keyfactor-bootstrap-workflow.yml | 2 +- docsource/content.md | 23 +++ docsource/f5-bigiq.md | 1 + integration-manifest.json | 20 +++ readme-src/readme-pam-support.md | 5 - readme_source.md | 166 ------------------ 6 files changed, 45 insertions(+), 172 deletions(-) create mode 100644 docsource/content.md create mode 100644 docsource/f5-bigiq.md delete mode 100644 readme-src/readme-pam-support.md delete mode 100644 readme_source.md diff --git a/.github/workflows/keyfactor-bootstrap-workflow.yml b/.github/workflows/keyfactor-bootstrap-workflow.yml index 729a5a2..a4649f2 100644 --- a/.github/workflows/keyfactor-bootstrap-workflow.yml +++ b/.github/workflows/keyfactor-bootstrap-workflow.yml @@ -11,7 +11,7 @@ on: jobs: call-starter-workflow: - uses: keyfactor/actions/.github/workflows/starter.yml@3.1.2-rc.0 + uses: keyfactor/actions/.github/workflows/starter.yml@3.1.2 secrets: token: ${{ secrets.V2BUILDTOKEN}} APPROVE_README_PUSH: ${{ secrets.APPROVE_README_PUSH}} diff --git a/docsource/content.md b/docsource/content.md new file mode 100644 index 0000000..1aec2d0 --- /dev/null +++ b/docsource/content.md @@ -0,0 +1,23 @@ +## Overview + +The F5 Big IQ Orchestrator Extension supports the following use cases: + +- Inventories an existing F5 Big IQ device to import SSL certificates into Keyfactor Command for management +- Add an existing or newly enrolled certificate and private key to an existing F5 Big IQ device not already on that device. +- Remove a certificate and private key from an existing F5 Big IQ device. +- Add an existing or newly enrolled certificate and private key to an existing F5 Big IQ device already on that device. Optionally (based on the DeployCertificateOnRenewal setting on the certificate store), the newly renewed/replaced certificate will be deployed to any linked F5 Big IP device. +- Reenrollment (On Device Key Generation) of a new or existing certificate on the F5 Big IQ device. In this use case, the key pair and CSR will be created on the F5 Big IQ device, Keyfactor Command will enroll the certificate, and the certificate will then be installed on the device. If the DeployCertificateOnRenewal option is set, the certificate will be deployed to any linked F5 Big IP devices. + +Use cases NOT supported by the F5 Big IQ Orchestrator Extension: + +- Creating new binding relationships between F5 Big IQ and any linked F5 Big IP devices. +- Storing binding relationships in Keyfactor Command during Inventory. + + +## Requirements + +When creating a Keyfactor Command Certificate Store, you will be asked to enter server credentials. These credentials will serve two purposes: +1. They will be used to authenticate to the F5 Big IQ instance when accessing API endpoints. Please make sure these credentials have Admin authority on F5 Big IQ. +2. When Inventorying and Adding/Replacing certificates it will be necessary for certificate files to be transferred to and from the F5 device. The F5 Big IQ Orchestrator Extension uses SCP (Secure Copy Protocol) to perform these functions. Please make sure your F5 Big IQ device is set up to allow SCP to transfer files *to* /var/config/rest/downloads (a reserved F5 Big IQ folder used for file transfers) and *from* /var/config/rest/fileobject (the certificate file location path) and all subfolders. Other configuration tasks may be necessary in your environment to enable this feature. + + diff --git a/docsource/f5-bigiq.md b/docsource/f5-bigiq.md new file mode 100644 index 0000000..0aa5d83 --- /dev/null +++ b/docsource/f5-bigiq.md @@ -0,0 +1 @@ +## Overview \ No newline at end of file diff --git a/integration-manifest.json b/integration-manifest.json index 306df84..87aaa5a 100644 --- a/integration-manifest.json +++ b/integration-manifest.json @@ -72,6 +72,26 @@ "DefaultValue": "", "Required": false, "Description": "If Use Token Authentication is selected, you may optionally add a value for the authentication provider F5 Big IQ will use to retrieve the auth token. If you choose not to add this field or leave it blank on the certificate store (with no default value set), the default of \"TMOS\" will be used." + }, + { + "Name": "ServerUsername", + "DisplayName": "Server Username", + "Type": "Secret", + "DependsOn": "", + "DefaultValue": "", + "IsPAMEligible": true, + "Required": false, + "Description": "Login credential for the F5 Big IQ device. MUST be an Admin account." + }, + { + "Name": "ServerPassword", + "DisplayName": "Server Password", + "Type": "Secret", + "DependsOn": "", + "DefaultValue": "", + "IsPAMEligible": true, + "Required": false, + "Description": "Login password for the F5 Big IQ device." } ], "EntryParameters": [ diff --git a/readme-src/readme-pam-support.md b/readme-src/readme-pam-support.md deleted file mode 100644 index c1144e7..0000000 --- a/readme-src/readme-pam-support.md +++ /dev/null @@ -1,5 +0,0 @@ -|Name|Description| -|----|-----------| -|ServerUsername|The user id that will be used to authenticate to the F5 Biq API endpoints| -|ServerPassword|The password that will be used to authenticate to the F5 Biq API endpoints| - diff --git a/readme_source.md b/readme_source.md deleted file mode 100644 index 7d16972..0000000 --- a/readme_source.md +++ /dev/null @@ -1,166 +0,0 @@ -## Overview - -The F5 Big IQ Orchestrator Extension supports the following use cases: - -- Inventories an existing F5 Big IQ device to import SSL certificates into Keyfactor Command for management -- Add an existing or newly enrolled certificate and private key to an existing F5 Big IQ device not already on that device. -- Remove a certificate and private key from an existing F5 Big IQ device. -- Add an existing or newly enrolled certificate and private key to an existing F5 Big IQ device already on that device. Optionally (based on the DeployCertificateOnRenewal setting on the certificate store), the newly renewed/replaced certificate will be deployed to any linked F5 Big IP device. -- Reenrollment (On Device Key Generation) of a new or existing certificate on the F5 Big IQ device. In this use case, the key pair and CSR will be created on the F5 Big IQ device, Keyfactor Command will enroll the certificate, and the certificate will then be installed on the device. If the DeployCertificateOnRenewal option is set, the certificate will be deployed to any linked F5 Big IP devices. - -Use cases NOT supported by the F5 Big IQ Orchestrator Extension: - -- Creating new binding relationships between F5 Big IQ and any linked F5 Big IP devices. -- Storing binding relationships in Keyfactor Command during Inventory. - - -## Versioning - -The version number of a the F5 Big IQ Orchestrator Extension can be verified by right clicking on the F5BigIQ.dll file, selecting Properties, and then clicking on the Details tab. - - -## F5 Big IQ Prerequisites - -When creating a Keyfactor Command Certificate Store, you will be asked to enter server credentials. These credentials will serve two purposes: -1. They will be used to authenticate to the F5 Big IQ instance when accessing API endpoints. Please make sure these credentials have Admin authority on F5 Big IQ. -2. When Inventorying and Adding/Replacing certificates it will be necessary for certificate files to be transferred to and from the F5 device. The F5 Big IQ Orchestrator Extension uses SCP (Secure Copy Protocol) to perform these functions. Please make sure your F5 Big IQ device is set up to allow SCP to transfer files *to* /var/config/rest/downloads (a reserved F5 Big IQ folder used for file transfers) and *from* /var/config/rest/fileobject (the certificate file location path) and all subfolders. Other configuration tasks may be necessary in your environment to enable this feature. - - -## F5 Big IQ Orchestrator Extension Installation - -1. Stop the Keyfactor Universal Orchestrator Service. -2. In the Keyfactor Orchestrator installation folder (by convention usually C:\Program Files\Keyfactor\Keyfactor Orchestrator), find the "extensions" folder. Underneath that, create a new folder named F5BigIQ or another name of your choosing. -3. Download the latest version of the F5 BigIQ Orchestrator Extension from [GitHub](https://github.com/Keyfactor/f5-bigiq-rest-orchestrator). -4. Copy the contents of the download installation zip file into the folder created in step 2. -5. Start the Keyfactor Universal Orchestrator Service. - - -## F5 Big IQ Orchestrator Extension Configuration - -### 1\. In Keyfactor Command, create a new certificate store type by navigating to Settings (the "gear" icon in the top right) => Certificate Store Types, and clicking ADD. Then enter the following information: - -
-Basic Tab - -- **Name** – Required. The descriptive display name of the new Certificate Store Type. Suggested => F5 Big IQ -- **Short Name** – Required. This value ***must be*** F5-BigIQ. -- **Custom Capability** - Leave unchecked -- **Supported Job Types** – Select Inventory, Add, and Remove. -- **General Settings** - Select Needs Server. Select Blueprint Allowed if you plan to use blueprinting. Leave Uses PowerShell unchecked. -- **Password Settings** - Leave both options unchecked - -
- -
-Advanced Tab - -- **Store Path Type** - Select Freeform -- **Supports Custom Alias** - Required -- **Private Key Handling** - Required -- **PFX Password Style** - Default - -
- -
-Custom Fields Tab - -- **Deploy Certificate to Linked Big IP on Renewal** - optional - This setting determines you wish to deploy renewed certificates (Management-Add jobs with Overwrite selected) to all linked Big IP devices. Linked devices are determined by looking at all of the client-ssl profiles that reference the renewed certificate that have an associated virtual server linked to a Big IP device. An "immediate" deployment is then scheduled within F5 Big IQ for each linked Big IP device. - - **Name**=DeployCertificateOnRenewal - - **Display Name**=Deploy Certificate to Linked Big IP on Renewal - - **Type**=Bool - - **Default Value**={client preference} - - **Depends on**=unchecked - - **Required**=unchecked - -- **Ignore SSL Warning** - optional - If you use a self signed certificate for the F5 Big IQ portal, you will need add this Custom Field and set the value to True on the managed certificate store. - - **Name**=IgnoreSSLWarning - - **Display Name**=Ignore SSL Warning - - **Type**=Bool - - **Default Value**={client preference} - - **Depends on**=unchecked - - **Required**=unchecked - -- **Use Token Authentication** - optional - If you prefer to use F5 Big IQ's Token Authentication to authenticate F5 Big IQ API calls that the integration uses, you will need to add this Custom Field and set the value to True on the managed certificate store. If this exists and is set to True for the store, the store userid/password credentials you set for the certificate store will be used once to receive a token. This token is then used for all remaining API calls for the duration of the job. If this option does not exist or is set to False, the userid/password credentials you set on the certificate store will be used for each API call. - - **Name**=UseTokenAuth - - **Display Name**=Use Token Authentication - - **Type**=Bool - - **Default Value**={client preference} - - **Depends on**=unchecked - - **Required**=unchecked - -- **Use Token Authentication Provider Name** - optional - If Use Token Authentication is selected, you may optionally add a value for the authentication provider F5 Big IQ will use to retrieve the auth token. If you choose not to add this field or leave it blank on the certificate store (with no default value set), the default of "TMOS" will be used. - - **Name**=LoginProviderName - - **Display Name**=Use Token Authentication Provider Name - - **Type**=String - - **Default Value**={client preference} - - **Depends on**="UseTokenAuth" - - **Required**=unchecked - -Please note, after saving the store type, going back into this screen will show three additional Custom Fields: Server Username, Server Password, and Use SSL. These are added internally by Keyfactor Command and should not be modified. - -
- -
-Entry Parameters Tab - -Entry parameters are required ONLY if you will be taking advantage of the Reenrollment (ODKG - On Device Key Generation) capability of the F5 Big IQ Orchestrator Extension. When scheduling Reenrollment or Management jobs, some versions of Keyfactor Command may show multiple Alias and Overwrite fields. The ones below will be used for Reenrollment while the others will be used for Management. - -- **Alias** - required - The identifying name of the certificate - - **Name**=Alias - - **Display Name**=Alias (Reenrollment Only) - - **Type**=String - - **Default Value**=Leave Blank - - **Depends On**=unchecked - - **Required When**=Check Reenrolling an entry - -- **Overwrite** - required - Allow overwriting an existing certificate when reenrolling? - - **Name**=Overwrite - - **Display Name**=Overwrite (Reenrollment Only) - - **Type**=Bool - - **Default Value**=False - - **Depends On**=unchecked - - **Required When**=Check Reenrolling an entry - -- **SANs** - optional - External SANs for the requested certificate. Each SAN must be prefixed with the type (DNS: or IP:) and multiple SANs must be delimitted by an ampersand (&). Example: DNS:server.domain.com&IP:127.0.0.1&DNS:server2.domain.com - - **Name**=SANs - - **Display Name**=SANs (Reenrollment Only) - - **Type**=String - - **Default Value**=Leave Blank - - **Depends On**=unchecked - - **Required When**=Leave all unchecked - -
- -### 2\. Create an F5 Big IQ Certificate Store - -Navigate to Certificate Locations =\> Certificate Stores within Keyfactor Command to add the store. Below are the values that should be entered: - -- **Category** – Required. Select the Name you entered when creating the Certificate Store Type. Suggested value was F5 Big IQ. - -- **Container** – Optional. Select a container if utilized. - -- **Client Machine & Credentials** – Required. The full URL of the F5 Big IQ device portal. - -- **Store Path** – Required. Enter the name of the partition on the F5 Big IQ device you wish to manage. This value is case sensitive, so if the partition name is "Common", it must be entered as "Common" and not "common". - -- **Orchestrator** – Required. Select the orchestrator you wish to use to manage this store - -- **Deploy Certificate to Linked Big IP on Renewal** - Optional. Set this to True if you wish to deploy renewed certificates (Management-Add jobs with Overwrite selected) to all linked Big IP devices. Linked devices are determined by looking at all of the client-ssl profiles that reference the renewed certificate that have an associated virtual server linked to a Big IP device. An "immediate" deployment is then scheduled within F5 Big IQ for each linked Big IP device. - -- **Ignore SSL Warning** - Optional. Set this to True if you wish to ignore SSL warnings from F5 that occur during API calls when the site does not have a trusted certificate with the proper SAN bound to it. If you chose not to add this Custom Field when creating the Certificate Store Type, the default value of False will be assumed. If this value is False (or missing) SSL warnings will cause errors during orchestrator extension jobs. - -- **Use Token Authentication** - Optional. Set this to True if you wish to use F5 Big IQ's token authentiation instead of basic authentication for all API requests. If you chose not to add this optional Custom Field when creating the Certificate Store Type, the default value of False will be assumed and basic authentication will be used for all API requests for all jobs. Setting this value to True will enable an initial basic authenticated request to acquire an authentication token, which will then be used for all subsequent API requests. - -- **Use Token Authentication Provider Name** - Optional - If Use Token Authentication is selected, you may optionally add a value for the authentication provider F5 Big IQ will use to retrieve the auth token. If you choose leave this field blank, the default of "TMOS" will be used. - - -- **Server Username/Password** - Required. The credentials used to log into the F5 Big IQ device to perform API calls. These values for server login can be either: - - - UserId/Password - - PAM provider information used to look up the UserId/Password credentials - - Please make sure these credentials have Admin rights on the F5 Big IQ device and can perform SCP functions as described in the F5 Big IQ Prerequisites section above. - -- **Use SSL** - N/A. This value is not referenced in the F5 Big IQ Orchestrator Extension. The value you enter for Client Machine, and specifically whether the protocol entered is http:// or https:// will determine whether a TLS (SSL) connection is utilized. - -- **Inventory Schedule** – Set a schedule for running Inventory jobs or "none", if you choose not to schedule Inventory at this time. \ No newline at end of file From e04453b5f2b0e367a8fa138da53ff1680a92a144 Mon Sep 17 00:00:00 2001 From: Keyfactor Date: Tue, 12 Nov 2024 17:04:15 +0000 Subject: [PATCH 5/7] Update generated docs --- README.md | 132 +++++++++++++---- integration-manifest.json | 296 +++++++++++++++++++------------------- 2 files changed, 254 insertions(+), 174 deletions(-) diff --git a/README.md b/README.md index 1a29a62..ca7b069 100644 --- a/README.md +++ b/README.md @@ -31,15 +31,20 @@ ## Overview -TODO Overview is a required section +The F5 Big IQ Orchestrator Extension supports the following use cases: +- Inventories an existing F5 Big IQ device to import SSL certificates into Keyfactor Command for management +- Add an existing or newly enrolled certificate and private key to an existing F5 Big IQ device not already on that device. +- Remove a certificate and private key from an existing F5 Big IQ device. +- Add an existing or newly enrolled certificate and private key to an existing F5 Big IQ device already on that device. Optionally (based on the DeployCertificateOnRenewal setting on the certificate store), the newly renewed/replaced certificate will be deployed to any linked F5 Big IP device. +- Reenrollment (On Device Key Generation) of a new or existing certificate on the F5 Big IQ device. In this use case, the key pair and CSR will be created on the F5 Big IQ device, Keyfactor Command will enroll the certificate, and the certificate will then be installed on the device. If the DeployCertificateOnRenewal option is set, the certificate will be deployed to any linked F5 Big IP devices. +Use cases NOT supported by the F5 Big IQ Orchestrator Extension: -### F5-BigIQ -TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info +- Creating new binding relationships between F5 Big IQ and any linked F5 Big IP devices. +- Storing binding relationships in Keyfactor Command during Inventory. -TODO Overview is a required section ## Compatibility @@ -55,15 +60,9 @@ The F5 BigIQ Universal Orchestrator extension is supported by Keyfactor for Keyf Before installing the F5 BigIQ Universal Orchestrator extension, we recommend that you install [kfutil](https://github.com/Keyfactor/kfutil). Kfutil is a command-line tool that simplifies the process of creating store types, installing extensions, and instantiating certificate stores in Keyfactor Command. -TODO Requirements is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info - -### F5 Big IQ Requirements -TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info - - -TODO Requirements is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info - - +When creating a Keyfactor Command Certificate Store, you will be asked to enter server credentials. These credentials will serve two purposes: +1. They will be used to authenticate to the F5 Big IQ instance when accessing API endpoints. Please make sure these credentials have Admin authority on F5 Big IQ. +2. When Inventorying and Adding/Replacing certificates it will be necessary for certificate files to be transferred to and from the F5 device. The F5 Big IQ Orchestrator Extension uses SCP (Secure Copy Protocol) to perform these functions. Please make sure your F5 Big IQ device is set up to allow SCP to transfer files *to* /var/config/rest/downloads (a reserved F5 Big IQ folder used for file transfers) and *from* /var/config/rest/fileobject (the certificate file location path) and all subfolders. Other configuration tasks may be necessary in your environment to enable this feature. ## Create the F5-BigIQ Certificate Store Type @@ -71,8 +70,6 @@ TODO Requirements is an optional section. If this section doesn't seem necessary To use the F5 BigIQ Universal Orchestrator extension, you **must** create the F5-BigIQ Certificate Store Type. This only needs to happen _once_ per Keyfactor Command instance. -TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info - * **Create F5-BigIQ using kfutil**: @@ -127,6 +124,8 @@ TODO Global Store Type Section is an optional section. If this section doesn't s | IgnoreSSLWarning | Ignore SSL Warning | If you use a self signed certificate for the F5 Big IQ portal, you will need to add this optional Custom Field and set the value to True on the managed certificate store. | Bool | false | 🔲 Unchecked | | UseTokenAuth | Use Token Authentication | If you prefer to use F5 Big IQ's Token Authentication to authenticate F5 Big IQ API calls, you will need to add this optional Custom Field and set the value to True on the managed certificate store. If set to True for the store, the userid/password credentials you set for the certificate store will be used once to receive a token. This token is then used for all subsequent API calls for the duration of the job. If this option does not exist or is set to False, the userid/password credentials you set for the certificate store will be used for all API calls. | Bool | false | 🔲 Unchecked | | LoginProviderName | Authentication Provider Name | If Use Token Authentication is selected, you may optionally add a value for the authentication provider F5 Big IQ will use to retrieve the auth token. If you choose not to add this field or leave it blank on the certificate store (with no default value set), the default of "TMOS" will be used. | String | | 🔲 Unchecked | + | ServerUsername | Server Username | Login credential for the F5 Big IQ device. MUST be an Admin account. | Secret | | 🔲 Unchecked | + | ServerPassword | Server Password | Login password for the F5 Big IQ device. | Secret | | 🔲 Unchecked | The Custom Fields tab should look like this: @@ -184,36 +183,117 @@ TODO Global Store Type Section is an optional section. If this section doesn't s Refer to [Starting/Restarting the Universal Orchestrator service](https://software.keyfactor.com/Core-OnPrem/Current/Content/InstallingAgents/NetCoreOrchestrator/StarttheService.htm). +6. **(optional) PAM Integration** -> The above installation steps can be supplimented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/InstallingAgents/NetCoreOrchestrator/CustomExtensions.htm?Highlight=extensions). + The F5 BigIQ Universal Orchestrator extension is compatible with all supported Keyfactor PAM extensions to resolve PAM-eligible secrets. PAM extensions running on Universal Orchestrators enable secure retrieval of secrets from a connected PAM provider. + To configure a PAM provider, [reference the Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam) to select an extension, and follow the associated instructions to install it on the Universal Orchestrator (remote). -## Post Installation -TODO Post Installation is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info +> The above installation steps can be supplimented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/InstallingAgents/NetCoreOrchestrator/CustomExtensions.htm?Highlight=extensions). + ## Defining Certificate Stores -TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info -TODO Certificate Store Configuration is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info +* **Manually with the Command UI** +
Create Certificate Stores manually in the UI + 1. **Navigate to the _Certificate Stores_ page in Keyfactor Command.** -> The content in this section can be supplimented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Certificate%20Stores.htm?Highlight=certificate%20store). + Log into Keyfactor Command, toggle the _Locations_ dropdown, and click _Certificate Stores_. + + 2. **Add a Certificate Store.** + + Click the Add button to add a new Certificate Store. Use the table below to populate the **Attributes** in the **Add** form. + | Attribute | Description | + | --------- | ----------- | + | Category | Select "F5 Big IQ" or the customized certificate store name from the previous step. | + | Container | Optional container to associate certificate store with. | + | Client Machine | | + | Store Path | | + | Orchestrator | Select an approved orchestrator capable of managing `F5-BigIQ` certificates. Specifically, one with the `F5-BigIQ` capability. | + | DeployCertificateOnRenewal | This optional setting determines whether renewed certificates (Management-Add jobs with Overwrite selected) will be deployed to all linked Big IP devices. Linked devices are determined by looking at all of the client-ssl profiles that reference the renewed certificate that have an associated virtual server linked to a Big IP device. An immediate deployment is then scheduled within F5 Big IQ for each linked Big IP device. | + | IgnoreSSLWarning | If you use a self signed certificate for the F5 Big IQ portal, you will need to add this optional Custom Field and set the value to True on the managed certificate store. | + | UseTokenAuth | If you prefer to use F5 Big IQ's Token Authentication to authenticate F5 Big IQ API calls, you will need to add this optional Custom Field and set the value to True on the managed certificate store. If set to True for the store, the userid/password credentials you set for the certificate store will be used once to receive a token. This token is then used for all subsequent API calls for the duration of the job. If this option does not exist or is set to False, the userid/password credentials you set for the certificate store will be used for all API calls. | + | LoginProviderName | If Use Token Authentication is selected, you may optionally add a value for the authentication provider F5 Big IQ will use to retrieve the auth token. If you choose not to add this field or leave it blank on the certificate store (with no default value set), the default of "TMOS" will be used. | + | ServerUsername | Login credential for the F5 Big IQ device. MUST be an Admin account. | + | ServerPassword | Login password for the F5 Big IQ device. | + + + + +
Attributes eligible for retrieval by a PAM Provider on the Universal Orchestrator + + If a PAM provider was installed _on the Universal Orchestrator_ in the [Installation](#Installation) section, the following parameters can be configured for retrieval _on the Universal Orchestrator_. + | Attribute | Description | + | --------- | ----------- | + | ServerUsername | Login credential for the F5 Big IQ device. MUST be an Admin account. | + | ServerPassword | Login password for the F5 Big IQ device. | -## Discovering Certificate Stores with the Discovery Job -TODO Discovery is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info + Please refer to the **Universal Orchestrator (remote)** usage section ([PAM providers on the Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam)) for your selected PAM provider for instructions on how to load attributes orchestrator-side. + > Any secret can be rendered by a PAM provider _installed on the Keyfactor Command server_. The above parameters are specific to attributes that can be fetched by an installed PAM provider running on the Universal Orchestrator server itself. +
+ + +
+ +* **Using kfutil** + +
Create Certificate Stores with kfutil + + 1. **Generate a CSV template for the F5-BigIQ certificate store** + + ```shell + kfutil stores import generate-template --store-type-name F5-BigIQ --outpath F5-BigIQ.csv + ``` + 2. **Populate the generated CSV file** + + Open the CSV file, and reference the table below to populate parameters for each **Attribute**. + | Attribute | Description | + | --------- | ----------- | + | Category | Select "F5 Big IQ" or the customized certificate store name from the previous step. | + | Container | Optional container to associate certificate store with. | + | Client Machine | | + | Store Path | | + | Orchestrator | Select an approved orchestrator capable of managing `F5-BigIQ` certificates. Specifically, one with the `F5-BigIQ` capability. | + | DeployCertificateOnRenewal | This optional setting determines whether renewed certificates (Management-Add jobs with Overwrite selected) will be deployed to all linked Big IP devices. Linked devices are determined by looking at all of the client-ssl profiles that reference the renewed certificate that have an associated virtual server linked to a Big IP device. An immediate deployment is then scheduled within F5 Big IQ for each linked Big IP device. | + | IgnoreSSLWarning | If you use a self signed certificate for the F5 Big IQ portal, you will need to add this optional Custom Field and set the value to True on the managed certificate store. | + | UseTokenAuth | If you prefer to use F5 Big IQ's Token Authentication to authenticate F5 Big IQ API calls, you will need to add this optional Custom Field and set the value to True on the managed certificate store. If set to True for the store, the userid/password credentials you set for the certificate store will be used once to receive a token. This token is then used for all subsequent API calls for the duration of the job. If this option does not exist or is set to False, the userid/password credentials you set for the certificate store will be used for all API calls. | + | LoginProviderName | If Use Token Authentication is selected, you may optionally add a value for the authentication provider F5 Big IQ will use to retrieve the auth token. If you choose not to add this field or leave it blank on the certificate store (with no default value set), the default of "TMOS" will be used. | + | ServerUsername | Login credential for the F5 Big IQ device. MUST be an Admin account. | + | ServerPassword | Login password for the F5 Big IQ device. | + + + -### F5 Big IQ Discovery Job -TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info +
Attributes eligible for retrieval by a PAM Provider on the Universal Orchestrator + If a PAM provider was installed _on the Universal Orchestrator_ in the [Installation](#Installation) section, the following parameters can be configured for retrieval _on the Universal Orchestrator_. + | Attribute | Description | + | --------- | ----------- | + | ServerUsername | Login credential for the F5 Big IQ device. MUST be an Admin account. | + | ServerPassword | Login password for the F5 Big IQ device. | + + + > Any secret can be rendered by a PAM provider _installed on the Keyfactor Command server_. The above parameters are specific to attributes that can be fetched by an installed PAM provider running on the Universal Orchestrator server itself. +
+ + + 3. **Import the CSV file to create the certificate stores** + + ```shell + kfutil stores import csv --store-type-name F5-BigIQ --file F5-BigIQ.csv + ``` +
+ +> The content in this section can be supplimented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Certificate%20Stores.htm?Highlight=certificate%20store). -TODO Discovery Job Configuration is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info diff --git a/integration-manifest.json b/integration-manifest.json index 87aaa5a..9703d43 100644 --- a/integration-manifest.json +++ b/integration-manifest.json @@ -1,148 +1,148 @@ -{ - "$schema": "https://keyfactor.github.io/integration-manifest-schema.json", - "integration_type": "orchestrator", - "name": "F5 BigIQ", - "status": "production", - "support_level": "kf-supported", - "description": "The F5 Big IQ Orchestrator allows for the remote management of F5 Big IQ certificate stores. Inventory, Management, and Reenrollment functions are supported.", - "link_github": true, - "update_catalog": true, - "release_project": "F5BigIQ/F5BigIQ.csproj", - "release_dir": "F5BigIQ/bin/Release", - "about": { - "orchestrator": { - "UOFramework": "10.4", - "keyfactor_platform_version": "10.3", - "pam_support": true, - "store_types": [ - { - "Name": "F5 Big IQ", - "ShortName": "F5-BigIQ", - "Capability": "F5-BigIQ", - "PrivateKeyAllowed": "Required", - "ServerRequired": true, - "PowerShell": false, - "BlueprintAllowed": true, - "CustomAliasAllowed": "Required", - "SupportedOperations": { - "Add": true, - "Create": false, - "Discovery": false, - "Enrollment": true, - "Remove": true - }, - "PasswordOptions": { - "EntrySupported": false, - "StoreRequired": false, - "Style": "Default" - }, - "Properties": [ - { - "Name": "DeployCertificateOnRenewal", - "DisplayName": "Deploy Certificate to Linked Big IP on Renewal", - "Type": "Bool", - "DependsOn": "", - "DefaultValue": "false", - "Required": false, - "Description": "This optional setting determines whether renewed certificates (Management-Add jobs with Overwrite selected) will be deployed to all linked Big IP devices. Linked devices are determined by looking at all of the client-ssl profiles that reference the renewed certificate that have an associated virtual server linked to a Big IP device. An immediate deployment is then scheduled within F5 Big IQ for each linked Big IP device." - }, - { - "Name": "IgnoreSSLWarning", - "DisplayName": "Ignore SSL Warning", - "Type": "Bool", - "DependsOn": "", - "DefaultValue": "false", - "Required": false, - "Description": "If you use a self signed certificate for the F5 Big IQ portal, you will need to add this optional Custom Field and set the value to True on the managed certificate store." - }, - { - "Name": "UseTokenAuth", - "DisplayName": "Use Token Authentication", - "Type": "Bool", - "DependsOn": "", - "DefaultValue": "false", - "Required": false, - "Description": "If you prefer to use F5 Big IQ's Token Authentication to authenticate F5 Big IQ API calls, you will need to add this optional Custom Field and set the value to True on the managed certificate store. If set to True for the store, the userid/password credentials you set for the certificate store will be used once to receive a token. This token is then used for all subsequent API calls for the duration of the job. If this option does not exist or is set to False, the userid/password credentials you set for the certificate store will be used for all API calls." - }, - { - "Name": "LoginProviderName", - "DisplayName": "Authentication Provider Name", - "Type": "String", - "DependsOn": "UseTokenAuth", - "DefaultValue": "", - "Required": false, - "Description": "If Use Token Authentication is selected, you may optionally add a value for the authentication provider F5 Big IQ will use to retrieve the auth token. If you choose not to add this field or leave it blank on the certificate store (with no default value set), the default of \"TMOS\" will be used." - }, - { - "Name": "ServerUsername", - "DisplayName": "Server Username", - "Type": "Secret", - "DependsOn": "", - "DefaultValue": "", - "IsPAMEligible": true, - "Required": false, - "Description": "Login credential for the F5 Big IQ device. MUST be an Admin account." - }, - { - "Name": "ServerPassword", - "DisplayName": "Server Password", - "Type": "Secret", - "DependsOn": "", - "DefaultValue": "", - "IsPAMEligible": true, - "Required": false, - "Description": "Login password for the F5 Big IQ device." - } - ], - "EntryParameters": [ - { - "Name": "Alias", - "DisplayName": "Alias (Reenrollment only)", - "Type": "String", - "RequiredWhen": { - "HasPrivateKey": false, - "OnAdd": false, - "OnRemove": false, - "OnReenrollment": true - }, - "DependsOn": "", - "DefaultValue": "", - "Options": "", - "Description": "The name F5 Big IQ uses to identify the certificate" - }, - { - "Name": "Overwrite", - "DisplayName": "Overwrite (Reenrollment only)", - "Type": "Bool", - "RequiredWhen": { - "HasPrivateKey": false, - "OnAdd": false, - "OnRemove": false, - "OnReenrollment": true - }, - "DependsOn": "", - "DefaultValue": "False", - "Options": "", - "Description": "Allow overwriting an existing certificate when reenrolling?" - }, - { - "Name": "SANs", - "DisplayName": "SANs (Reenrollment only)", - "Type": "String", - "RequiredWhen": { - "HasPrivateKey": false, - "OnAdd": false, - "OnRemove": false, - "OnReenrollment": false - }, - "DependsOn": "", - "DefaultValue": "", - "Options": "", - "Description": "External SANs for the requested certificate. Each SAN must be prefixed with the type (DNS: or IP:) and multiple SANs must be delimitted by an ampersand (&). Example: DNS:server.domain.com&IP:127.0.0.1&DNS:server2.domain.com. This is an optional field." - } - ] - } - ] - } - } -} +{ + "$schema": "https://keyfactor.github.io/integration-manifest-schema.json", + "integration_type": "orchestrator", + "name": "F5 BigIQ", + "status": "production", + "support_level": "kf-supported", + "description": "The F5 Big IQ Orchestrator allows for the remote management of F5 Big IQ certificate stores. Inventory, Management, and Reenrollment functions are supported.", + "link_github": true, + "update_catalog": true, + "release_project": "F5BigIQ/F5BigIQ.csproj", + "release_dir": "F5BigIQ/bin/Release", + "about": { + "orchestrator": { + "UOFramework": "10.4", + "keyfactor_platform_version": "10.3", + "pam_support": true, + "store_types": [ + { + "Name": "F5 Big IQ", + "ShortName": "F5-BigIQ", + "Capability": "F5-BigIQ", + "PrivateKeyAllowed": "Required", + "ServerRequired": true, + "PowerShell": false, + "BlueprintAllowed": true, + "CustomAliasAllowed": "Required", + "SupportedOperations": { + "Add": true, + "Create": false, + "Discovery": false, + "Enrollment": true, + "Remove": true + }, + "PasswordOptions": { + "EntrySupported": false, + "StoreRequired": false, + "Style": "Default" + }, + "Properties": [ + { + "Name": "DeployCertificateOnRenewal", + "DisplayName": "Deploy Certificate to Linked Big IP on Renewal", + "Type": "Bool", + "DependsOn": "", + "DefaultValue": "false", + "Required": false, + "Description": "This optional setting determines whether renewed certificates (Management-Add jobs with Overwrite selected) will be deployed to all linked Big IP devices. Linked devices are determined by looking at all of the client-ssl profiles that reference the renewed certificate that have an associated virtual server linked to a Big IP device. An immediate deployment is then scheduled within F5 Big IQ for each linked Big IP device." + }, + { + "Name": "IgnoreSSLWarning", + "DisplayName": "Ignore SSL Warning", + "Type": "Bool", + "DependsOn": "", + "DefaultValue": "false", + "Required": false, + "Description": "If you use a self signed certificate for the F5 Big IQ portal, you will need to add this optional Custom Field and set the value to True on the managed certificate store." + }, + { + "Name": "UseTokenAuth", + "DisplayName": "Use Token Authentication", + "Type": "Bool", + "DependsOn": "", + "DefaultValue": "false", + "Required": false, + "Description": "If you prefer to use F5 Big IQ's Token Authentication to authenticate F5 Big IQ API calls, you will need to add this optional Custom Field and set the value to True on the managed certificate store. If set to True for the store, the userid/password credentials you set for the certificate store will be used once to receive a token. This token is then used for all subsequent API calls for the duration of the job. If this option does not exist or is set to False, the userid/password credentials you set for the certificate store will be used for all API calls." + }, + { + "Name": "LoginProviderName", + "DisplayName": "Authentication Provider Name", + "Type": "String", + "DependsOn": "UseTokenAuth", + "DefaultValue": "", + "Required": false, + "Description": "If Use Token Authentication is selected, you may optionally add a value for the authentication provider F5 Big IQ will use to retrieve the auth token. If you choose not to add this field or leave it blank on the certificate store (with no default value set), the default of \"TMOS\" will be used." + }, + { + "Name": "ServerUsername", + "DisplayName": "Server Username", + "Type": "Secret", + "DependsOn": "", + "DefaultValue": "", + "IsPAMEligible": true, + "Required": false, + "Description": "Login credential for the F5 Big IQ device. MUST be an Admin account." + }, + { + "Name": "ServerPassword", + "DisplayName": "Server Password", + "Type": "Secret", + "DependsOn": "", + "DefaultValue": "", + "IsPAMEligible": true, + "Required": false, + "Description": "Login password for the F5 Big IQ device." + } + ], + "EntryParameters": [ + { + "Name": "Alias", + "DisplayName": "Alias (Reenrollment only)", + "Type": "String", + "RequiredWhen": { + "HasPrivateKey": false, + "OnAdd": false, + "OnRemove": false, + "OnReenrollment": true + }, + "DependsOn": "", + "DefaultValue": "", + "Options": "", + "Description": "The name F5 Big IQ uses to identify the certificate" + }, + { + "Name": "Overwrite", + "DisplayName": "Overwrite (Reenrollment only)", + "Type": "Bool", + "RequiredWhen": { + "HasPrivateKey": false, + "OnAdd": false, + "OnRemove": false, + "OnReenrollment": true + }, + "DependsOn": "", + "DefaultValue": "False", + "Options": "", + "Description": "Allow overwriting an existing certificate when reenrolling?" + }, + { + "Name": "SANs", + "DisplayName": "SANs (Reenrollment only)", + "Type": "String", + "RequiredWhen": { + "HasPrivateKey": false, + "OnAdd": false, + "OnRemove": false, + "OnReenrollment": false + }, + "DependsOn": "", + "DefaultValue": "", + "Options": "", + "Description": "External SANs for the requested certificate. Each SAN must be prefixed with the type (DNS: or IP:) and multiple SANs must be delimitted by an ampersand (&). Example: DNS:server.domain.com&IP:127.0.0.1&DNS:server2.domain.com. This is an optional field." + } + ] + } + ] + } + } +} \ No newline at end of file From d88025bb039c69002fd5671a30e0f4bede3ba18c Mon Sep 17 00:00:00 2001 From: Hayden Roszell Date: Tue, 12 Nov 2024 14:21:28 -0700 Subject: [PATCH 6/7] chore(docs): Regenerate screenshots Signed-off-by: Hayden Roszell --- .../F5-BigIQ-advanced-store-type-dialog.png | Bin 0 -> 41691 bytes .../images/F5-BigIQ-basic-store-type-dialog.png | Bin 0 -> 51686 bytes ...F5-BigIQ-custom-fields-store-type-dialog.png | Bin 0 -> 42465 bytes ...BigIQ-entry-parameters-store-type-dialog.png | Bin 0 -> 35011 bytes 4 files changed, 0 insertions(+), 0 deletions(-) create mode 100644 docsource/images/F5-BigIQ-advanced-store-type-dialog.png create mode 100644 docsource/images/F5-BigIQ-basic-store-type-dialog.png create mode 100644 docsource/images/F5-BigIQ-custom-fields-store-type-dialog.png create mode 100644 docsource/images/F5-BigIQ-entry-parameters-store-type-dialog.png diff --git a/docsource/images/F5-BigIQ-advanced-store-type-dialog.png b/docsource/images/F5-BigIQ-advanced-store-type-dialog.png new file mode 100644 index 0000000000000000000000000000000000000000..2b71e8ce6f47e0b32fe97f5ac26c1e77f438c5f8 GIT binary patch literal 41691 zcmc$`bx@XV+XsjRDxfGJ0s>;tCEchJam9Ha@r&caTT)yA{XX7(BqStsA;AyQNJuvW;r|79k>L|ROm`V1 zq~}ONAKrbmkKUNHv&NFWZr(lC?RVO~@e3*5!~Z}nNeC0;_M?|0d>9x+PB*Y68@_to zq>zpL{psfu;Ut{Zd+8X0g2dHk5z|Bt1&?J~en}F#O%Jm*&1vj`993aRUz<>xfo@^z7o|m-2Gll-^zoMq>pcJG*uF)b#bcCh?gQBBfP)VX;d_IeM}vwg0SD>wFjJdeGzKBO46xcI7moJ)#XguMB5j06Z21otQu@p?31}?AE+s;m{#n>BY3!$DwuXIa<=ft#Ox&g1Nj|8zW^@WIvPU z&%GuF69o@abl1)m+Bt&k7fIqeCjP|7gk{KH@%ZvH*c+pCbX*^o$U+oVYiVeFNlz!o z^F#iF@yg63u!`wzC_NKXV_jVW|9Xyvh_*$1D1(5OcYrAJOv}_=>BkJ)`ig`1J}>Ig z=bRj#L{ZthyksC!mm_(5Gl@iJx6`wh!RFv`-8E}KO4*SziH#Ch>I1&QgL%oT37fw? zXX%40tUJvPy4*ECl8HQj*}lw7suJ%`ukUrxnKu-c+rP@@!WubDLPLxB{KlS@@5qiStHj}DG&K*w z3!c=K*a0DkLHnM;bQ#YG20cw39Uc44p(m|AH(mpd@K7LQt?J+DZNw;hG(d4(CocXV6smn^v6z9C% zh0a&v+|CvRX0C@%W6l`U4?}YY8mMZ{?NJz({C=yJ{@O{EPB*tGt?z8VA;CjRMb&{s zM$u!wYJKyxoX>e@^0p&a-(yTn>^EV*^m``oodk@Gjj6Y(KFbFskS*vg?~g}n6>ZAJ z5#IW0l)9ZjgchN|1=FfmMKJ8zl5?f z_ZJHT<4;EfL;Lr}zUS%E=@e)`Lk^=D`TgD}iD#0oUD)_<_>=9Q^;SPB+8)9nWvLWi zmW8Z~esSPHBsk|x@-5j3u`;~Ka&mrk5cN%VYHQUqc z=iT&SSy8ORuk-R*2)X?m_$K~zPorbnoYGo~<@;A{+|1gfdQ+MSW3o_;?mPe54GH%7-4O@mr~XQJ;AOo$7fd8 zZwITi+1i$-TC}qlZ4-X4PQ*UMbDWTh5$zmQ7?;akRm+ucX{TwZYs;E=Qxi0AW~$-i z86Xp}sO~3pDQeRTW7NK}@Do~*Q zD$VFby2peTSgv^I*`)mA=hub$jAF{eT2oo*&qncEXDnJ-%SJ-iN}{p&A69E_fb(H;*GVlz-M~(6!w@{N-6S-{MA?MHKP))rjJ~|n4&$M4BfgFg*h_P zF3C+y67n!5r?IZ@$4}f#RtLIBGwzA51_PJ7=Z9$b@(qxv!iyvB6f!edC=ro}Z}K*j z-=4DH6F?3y>;8`8^r&L@HmdrxW?Fp`cigR=(e9w#?DaMjnc=w=SGtzZ4>-q%36|@;Yd!DSZ{Ts79T6u^@`jGz? z9eon!Br;>FZ1b7N&rI^6-SxG4XHJt_g*g6o?cEWw>hAHws}5GZ3eLAw{MfIU;-M0i z(Eb|5l<%<;q@%4pzT35Rq|=7Agj1+7`mV-)U0&^K<`Mg$X$NT`bHdr0C zfJSR5&-bq2qX~*&+B+}kQQyn3{5@1tEGT&*i_<+Nxa8Rnj2lX=c-e3X#S)*m>L|G~ zHnP{1#LRa7jBBG>Z`ty)%#KL5EWEF{FZOiWr7E#wy*7*0c!firHf=4GJe$9Jao_t@ zL(<+z;ba=-jMQS-JWu^w1GnmOnc*OeAmQrg4QaO^p2a&X%?GhqL2n zb;HL^hBqe+aGForTdAD)!z@|MgNJn1Jb7_U5R@#oB}C>tTco#S%n1EoBcvkcC3-PjC|4HJ)pP zV6UP#B$w!16Uil}w%E6%V{akzdEe3a>Pg3x_T7MFW@?Ux6dh0dtL%3_94n&Yv8x7} z`D2e+-5#Xu$pdqHf|SDmZtqob+hgETG4{BzXzW*ZOb?2m~|~( zwLNBTJH}Wmf%$eST1W^72Ij{ln^d`71n=I?|8k4e*v;9lG z6K$`aemlMTdwDJC6Nl9sNNTRvkIwvz{bH(_hI5m4n^R;i%FOK|Y*wrtyPo-K9Lj6h z58Esy9}~u_4ts=$hhx~Rvg6lswB)E?RhXzU@hLsdO}X`&n&HV%lWLAwMP%0+ZGDe{ zO@})6dx&|uQbxYaUWO>|M znS%B~2GYdO)RYe`^p{`5gEY?59wn&VdU(L@UhChqGgw(WyP@l=Wb!qloP231g>ygd z1}A3*bq?Xt!txW#HAysIo{_HI%dqk@dkR0LlQ%|JWXJ&~-LQ*26(Y}r)HXd6ebL2p zY!|ejN^IaujA+PPw&c7Kq0rM z)08G%>Yn(})TzSlvWXMgJ>HlYRM}Iad<(BMO-rB6+O{yWLLB$C4LcM);($`U4J)pl zL%YN>$$IY{vKm)6d>*O^u}j@4>$S-w6&HTaLGM^zrJ3bzkEm2$KmY3(bIaoS_$j}U z!*=y(&ZlDYPi)Yxf2YNilL!b9Ezo_qPTjcVQVTU#tHfx1$c%_z;0s zUy_6d692-r$UtoXyCJdEKCaB&r9SHQ$S~@0e5!G`9^s1CVjJ=G2qpbgPTN zZ+T8#9?gyj2Pb5r(Pc}YQ!8$}EAL*+&W=UhSl3tNPUmpOY+B;Nvk*lASKCJdM<0I1 zDK{j^pZA%(wR)yvoM%;#V3T@Qb@7+Z@j>||IyQTD>_zl1*Bd2Aq5SBRiGcB}7(I4) zXy^?sp&S`%uYA)tOi2+-MTRoY0^2n+x0 zO%}N(;k+Kgh%BPGM^y44)Ouqw+^nSLZS5nIygd5)`eARyeStT-AvGswm6~vp!b+|f zN0#_)FS%E0LZloFL=09koX*cIj&1)8_1<^VGpcfq*@gA!P!TiMe(Y3o(fD(B)8V9- zd4x?7ca5lL#J4$iUEEanhCuxb@|Mi9%A22)i`nW)ZFNs`F-~S*XHf9^9j5v&}+vXJJfGUTD{co=|G{xM=a|KcOF}J758UgF%Py_CB$`I zBOI$vwmzwyeqtqXWUfn%MI|vDBp|xx(9z9FQH*kAG*J$FsqyHQdOMwHdnd)r$dw?{ z*zw)Ev8(OSD>>Dh5hudxW3~ofiJ8>4{&LnUqv5T&TxfsF=XaA*7bSlxH+<>YpAhX@ z+Qo5tJTNhAex*3B*yAK90?o4xzEbfMD_^&}LM8s5R^GN%m$Q+xIc6?EES)-tX~Fzu z{+y;CqUk2S6MoJ2jTmG7{^A=*0>}Kn914>{lE~C~58OW>joBC}EVV!U(@}@Tfs#p| ztCO;9xhi@S{hN#a)KKk&7@C~i(#V*6V#o(~jVdlbe!YR@xvvwNG_k@b+a-!Yq0yZ{ zF+2o>rBmYFsg|T4^SR^ISBaaJjEqfBa-@nFFga?{ybiQ~9mA}OKXVpvWoB4>Pu$ej z1K$>_x~_BJ*^o_i+=*S0?`QFZt2-MG2)>E_=JpW`a4>ol>Np1P9yN;`K?9C z%}PT`P2C)3w76f^Oax;2C1c-MjTrHGjRsL@v$6|}ZTY#`J1783(rXWRfav20_^74Vs_v;JQt`8D0+V#OO@OB?q}cBcFv<_H zHT+V69v4+F_6ktF%flOd>ub_2r#3pAfw|!BsoW(d6qV0a%VvBVs#cO?d=fWWs3()F zR?VSS+Dj}gg_YBgWNvLHqFJ9d*1sH|I?|1nCb`aL`O}|!m@2f+9)kP{QsVrm{S8G( z8%FqjRG-X?Iob}&rJdNjk8_h4w5IMN`+&p=9 zqN8pAW5G{DM@zi@!Iv@zc4?I?o$I506^~V!5zsKrPR}UQlG6LZVkIZ<( zMCqVj?!dM)@T10qW8+#VS$cMM^SigwR?ib?IcRV0SxJJ-p%_h6z>;&4jw) z>5w6UTbbA|22)7vPeX2FK=D=L#`-)@;BONi5!&AC5?HhJL+|#9lX~LJJ@3{r&D1 zXk2Xxe7=&IgCSF_Rz^Pu42wl$AXw1x2J|QS-SAU@9BG>g{W&oo#XP_r%cv9a5R&hY zV6nP2>!z|W;mzuNIjN7ef%<2A-M{~L`a>K1GW?o941Jbm&RdQVIwKrP{b}w*D7>_J z>tQlF$l7vP?hW6q6KF|fGpDw={ePgXcAR3$pIFSA`uH;ba48Xp$lrm^b@%)dEv}{{ z0(z6$wKF3E{aJ|cATc}Rh*x_M7Huh9Z~y(n#18P3FIl>GF8=cx`tIKJwo$d(jbv@y z3_MrwOffP2o&ir=F1*JTTd%U&hf-yxNj!!!I*L@TCS1OR60B)$D?EM$p&t|&s!YuT^~-ZxMA zQ4-9hroFB2qD~Fx(ZVD+V|<~_&+|3%95*y5PNpHA3uiR{>J_jI4|U#*EOGRxQv|jG zzVIRDYzxg{W1FLC{)K6tuEkSt`9256B-AchG_QxR=RJnbc5_LJ)9?8ypY+0S3^`X5 zk)666L!k<-j3Rozrt;#RMY{b7EACW~!>Iel^(B?wgXTBR(gG?I8+k>{sRrW}8>5aM zakX5ZD^p({e!U_*qTosON<4qDW45BW`NRo?$zzE^-Og|(qbEyCOR`tN8gJhs<#{!?v~^zWae~|N)Syo- zpM^wao$K(_dr?jG#ow0) z_*2M;DABOUOaE( z5SjIZv(8TC`9^6WG~$%*9XWuPiLm@ulBit-zNGLu0!cgyVwcK|M^VIecsAwYeL3FE zpkYW$BDU@sqt!?~2ATljvq5xso3(-TVjDc{7ljOatax&JcdjLm_v~t>+B)8gnV%y; zvo*JuxZR6`>5!)PGB);<4q!V0zW83FaxGq)MC>J<%~~ZcGKS|bbE(>NmVO?*F1_6A zy58zQkD71*+_?LI-8XAK>>YL(4o*+>1=rLo&(9fj|6;4P+R}F}w;+k)`4|9#k^V4K zi}`5Z)M(^x_ih*u|A^>ACuLC{vq7H&TB^Y9 zMoRmgmN^)dfIpkHlMhT6SLZ);|NTpK^@(G;3%zk{=<5;J*PYC5{%H-9yrP1c{?Vv= z=bKa-wK3ET+Y7@)uk!-!lEXwhsl`?=1w}wjR6J}Xtbap($rma8t*Jz7qmT=25+fr+ zCUr_IywLeY`_lDaSQH)CKvHcv9)9t&=G_cUx8bGTT3H*9uKYauMA=j%sO*AXLW}Wg zetEe`X6ev@D$tFaLgOBUt(wjO3_A$mN2D09NV?f)N*SJ~9@Rli%5Lm+Al$T5WuE`m zJs=uIj#~TS`W$50>({cz##M9M>JI(O*`PZBdjGwGy|Iy|^&TVL~fvyRRzF8=^pJ{oZf=uWn5BP+_GL4Z_7LGp)h6qlN7mx4k> zU|^`PTw;B1W64$z8eriV z(!F`}_wT3&`;9GVA~ZAuzhXnb3Cq%(Tl2BJ1tZ{*-6^u%(9+3iT+@dW8Fb;0~KiF@6JCL|-Y)`9G8DH1HW zoOeyIAiq+VoAND_oqaoj#9m2--{h-2b|RF)DGJSpCyWL3dkFg4+5Q(p7)as1E}?uv zP-{2!P2sbmGq{TlQ~AxBEbxqyGFM-bOi-0~QmWZRw+BmMxx<<*EMsdJ>AAJsWMrLb0x%8q2@ zlHHeD#ys6wEFNK3*p2IMn!%q@N)cV{Hda!MVlbK_%QETk_7+V@d;2Y<_>RqbrMx4W zk8hDmfXK^5ei9|W2Y?+}Bv39cCJ9?=Y9Xb!YRgVCu@;u`aRA&O%K@ZWujTj?wtdkw z@X(WG(X93nNtw6^jn3mQchUNg zq!J23d!}2!7xF^+kr0f=TXb@{=~0s|A-d`3_H&u*^zbFLp#*mD^>&dgEef^vHm<_c z#O|7|OF(-J@&7)vV%)wkOxOf`ygG6BRs|4447>Md|Js0FhLoF_icT+IB0hcZbO)4`kkulPWP7+ zhu6`&O-xK2R^mPN$4gB7LZhOiMb*>@Z``=Sl&zWFvwo;j;~cR*oZFwJ$iN9w8&zCn zr0|Cix5c8E8%IY^2?zJO$bH_cs5~PlCoj_Py-7)#=~OaBz+r1X*Km)Xo_=K{|0S2x zQN!TiVQf|{^D{Qf@0aJtVNR3H&7QmS&6tlKeev`}5f>LPRUOKZ&Aj{I0SPN>S>0-U ze7u5^QeUB7H{Nh1$<=8MEtBJc{>A0xwjvkUUW(&dJq9`*5N>GV=7X>e7 zb845f1C8MvRei=tigwc1uiv;`IZI1RZ%LsW@#hX(U0pcHWhuOKb-m(J)RUHej5vDc z&lkkmH#UsboOk&mnN8Ztt(FaoHnf`k-{^LPD`glA*45X8dFVgOC3)uM?~nZ3Y`Vtz zbTMpDX{aw*gbf}hx!>*bQ2sqH?;PW}>3?PcjFP9Ap!d0~CbBP!n-E5Q|9)GyJGL{< z?W(mkh;+2Zg@f1gfzF@LHx`zbhT7P-Lbq$LV__$!w++Fw{L5wLefy-_?W+DKF)vcj zsx=xBceFby&Jfw{n&T;_W2%k`{{*rR0s@6r%i>73+f!oGH7@PN{7-OjfRmHitzi(k~{s+8Vm58}H&4R+h{F0KUv9XE{#u#w{ST~=9nVFf->FEX$rv(KC zd3kw%y1E{O2+QhDU0gU@T3Ny2%o$xw$z=D5iHRGU5j*`(QW68n-QAt@XhbVZvCt!c z`)tKO3<9bxp4Zbbv!Zlyd%OGWaGf&xsF}!ZW^vJ`d(AR;;;e?HX_A$h=VIqueB*V4 zH)fI1uzydFB)=b?Z035pSZ{AH__CA#E`ZB6X1ZLa!9W_2%O_+8vu9`PxdvlJAzb5Ht=2VWwLf)!ZtiPlCZz<=CF7enZ&s|?yJET8y&kh`}fOhkvE)+qgu)D`-Ga+W(^A|ip4Ai z(mm}X1*}^Ams==k?TQ83_heGV7n8%(>ZYb*;cH7scL-DyRvH2SXXS||mk0e4=wX#M z>;(JE-K2DMu%eCM?_svIw4|AHSF3fyI`8i9*TXL_$2$2#9@QUsdEF%u4gU<=^6uR` z=bgVOSU5P-QUpdp{E6`}c9Er2>@!vE1a7VUL9YPJfe5=dFOB4D9c)cT4Q9&sC-9-B zh(^?Hj25<2SzTXU7MV@Q*45RG=hT{vmy}gjS^>r#cfI=l{re7-fW4FXfc*)pZrRL> zDu?~2%*Ib4Lg3jRV`DdlztPGoE!7*z(@085!E1xWoiy*V*%%3gJ48}*+GKh{tJYDV z)2`p2;x}8ERIrCVh)r>Qf%V>t!$SSNwt~V_qv0H#!?nSVNG4y{n;nS3TNpSv&11zz ziWS!65H!|n1Ktqy3H__At{1HRsS=feN~{Y}Zo zujc0FUa%jF5zc1TGY}vtzEJs_OmY#{v|yj##d!t;tHO zjgdDcCgc42`ecZZ$;I6 zG!zsW9buLl8pL|tv3JrAE>?%K@gX1T;ehR$bAJ#p^58!C{hzfmbaV24{D{@feNHu5 zX{UF*HTkyn^r#U>y$5Ecj<%-*{QS^2$BOGaJN;BEZD&_j6c%5v;hKILO~=@rkdzn znttH2va>_mfrIhAe0*Ne(&k1A{9Y2CJ}%{kCI@XYn#(B^3hiDO$F}*wiWFi|19+|! zX7gLy+qJf*sJJR{8)>Xg1z0l{;K$vn~f4t`FH2636p-R%N9p z{#I_ynPG988?-FW{SF4il0(Hq?TDEmXoW`UuhO>npR z(=}YMj5>P@t!M=7!Nj~CJDn`kpENb4bxwWOlm?eUE_zDI!$YL0H6P-1PZE#WIL&%% zLUDDXyiik5FBKAn5}utU817pJb~9yTtXRa`-(L>tH3|a4aGP>p4 z)yJ{)rW34uQdl}uRSrHeF)`8~KUzzaib-MdCH5lXKn@}=^8+6rxl*>=>3jfBFd>&C z84j)5#{s zSm{MvV{bXmjpC(%|3^(t&9;HkygbR%)zr9Pc{K;Va)`n3(f3Wpii9HQb$ot>hT0AvuS2B?8Om0kE>QvO5Rxnsh8G*hZXbTs__7U{;o)6`r!u=)_Zarm&4pCnOjhhnM02Ajm;yy^kB0nlL zBR>0#Kn?cm*`;m9-}n=ykaRjDnLHe9*kk6_*E1m)YA244R(cafW8hlv-@gwAph4l2 zK$fjsD(CT#C?}f3E~oF(uJmHxMI8Y?#n)dPVjbmN?(?kkxX*E1pIyl2K}6auWM3JWH8|Lx{^2 zJjNA`szmyDhwc=91h5|6&duS^+Q3H)*VGGCJK@BZ#Zq$(U_62 zprBxcj;!oeoK5!H1dX}d4GX{Y94XOHwGa(!xL zweM7I0E3VDcH3%SzkVg7pqN`5%v4ZRgc&|W;f3A|^>7w|4B&nZ?qVfBZ=u%NH04qn zs3P+_v-OB->2~dUcCh*_Dhj{ZpCHlg`l{+|Ewk$S>KswTp`Fl&g$x?nl-EM90}#y0 z%KAx9PcPim(9lOb^(8U!mu{ZxXHbEGmKqjE*0`Kop6=<;GcX8=iY5Vi^>C1-kd3Gb zwo?wHQH6f{(T}E9?)c)%uPuzrvqQ>#B?DB8bmh|PIJ?y8oI6yktRp*wWG;xy>$JTh zA-PEh=?Co|0L7p7c3+75kn$om3RnQOYR3?V&W?_bonrvjbPNoM4*S5WPj>#<}&t0vq>5N;q;e3%(x_=J~cyMKyMzaum7gg9vZ^7 zY$_YGS2{EpzOR0l*tEH$9rxkkNnkT^Jc<`w^mTP0GI?5M^wlAI+1@?qgB6cBA zfKUV2kMTrVAfh@L+2e-@y8{ksZEc0%35n2!z4Y}(?dCdu2DSAyGxN}nLbW54tE(%7 zQeaS!){3%2uFY!So!@npGL#kHRRh;zd60kvQ4Oc=LY@v}D<6xq{ME0isTmm^&DZV3 zL)4Rpd{XxNoh2-w5wW{HMmB`IH zPHDem3?jgZwKXFw@;r=#j1oCJa{^*9b-#X&{*3kK;rg)ELdzp?OF8VewBhlP^oy0$>}T(EMYDYa z7#_oJQ`gnC73;TsPiOi#IbaPfbH7_l<`FDOtlO1ClRtsTyLUGbEQw$+KchQtj7&X5 zfXF2nT1^4qbSUZ&ptI1DN!i$NPn>w5Sj7(-nkiq!Wt^YFJoTWB`uhdwkm$Ew@tiIM zS+5WIL3KrNDH7}Nr1|r2h4152M8x;&{YKxaD*Z*1^`&o)YNokOR{ZzJPLvsZ>!7oY&8{t zmsRn)v`lHuwg{1Iadha}a(;RT0_cj1Kgg}x6HcDIXIi?Qd3KTRw}%~rnXDt=ht~)J z_(4$cuAH14A_HdY?(oK-pgsKqQThe?6hwHX$*Eh$76R>k45MIXR@*(UwF_IxpnU!M z4lKH{v2mMNdsi2KV(-k{oaOi;a8@V+_7X}emX?-4(*Crzrcbz?_#~L`FNr~*Sy)-s z4-5o@5ES(DCxW7>si|Q-c>+v9GtJ1kYZsFN7qa04T#WL9K6m4ychy>3 zTRV7_@b{o0y!TMo-o74dHlOX|;{zq+@A!D7Xxy+5906a$Gf}dLrS=B~2Y*jZU3Qry z)RMI}zFLL50r28+a&m%a$B_mlmAOrx4|Jf*Gn|wuI+Lr$QmfUhy+$Fx6KAA3$ef=E+8^V`npOO!u<)RyS|37|50u;h>j&o)?KI*b* z*%NuZ=}%3UIbRX4Q5e2`zhJWAHELd)xs&_qAK~+4S}qX-7soESWNr7YFr#-;PSEvb zPE&1P?d1eQ6DG7~x@@eAbZjf>Zn-2|Z4&b_l!=S@od z=He%J_1oyvC>|=R@42d<+iQW%+VhD=bJJ~oZTBffPF1kp572!mF`Z0+i+wh{fmS;m z^3U5H_A@OQJaDn^82=w%5BZ;pqrbw!NdH^^O_u)8izrPNmPKLzc^Bos5BNX7i}F9c zn66{#lPafn1I?GFA6cn?2a>vY6jvx`KKbXt?G&?1Kai+a3tc0dPnsVCwqH)6wyO~ z@<1WcIyn31B^|?zA>|hgeft?U=@s31a@tAD^6V~K6Xl?G#eygcsH#I=-K7zMO1!<} zf$OKsq+0GTRU5TlEJc~In$I8w1_mNXF<|r0-k7A8(Ei4|oOb8i6N|`2bc8 zvsq|p{99TCU%Y&Y5S5^z&~tXTwN=b-B4Y4+nzxdfHzxt1)`!uR`|7n8^T;3!S6!X0 zBSgB-@VI~)y~DzA@ccaBj8ZBpDwH-kIZ&Iw0tUrjV*qf>Y&y{bO)xW>mVqG%#Hi_B z_EfPb-IGf7TGt;?oUbm=r+W*)d4McwzvW<8!k>8KZRQ}JT47<~{ONKWDHm4^U^2qb zKoi|TEk^$gV0Ec0rX3{KmEl|>0ITW5+J?nSvCex!AUK7y+fYDeqs;Wg^8!2Qfpv{_ zSi;RwDVN@49~&L*Ew|DGihKJHtcv~B>GJAWG387CAD=)EK>F_Pp8x6ZO=%e!hrL!( zkXLU1hNT4wi4GbVs1Wr4^ZdpH0Gq>d7l1HDpPQ>(>JPvkx8(GA+D#8=zxC!=2xuHX zV`ELpqJo0zFHZN-&y5E&WI;AeT>IBziQ6*tnkYP^wKZc?UCP&6S1*m}hNcK|3_|-x zfDg!3!!qm5wY4@Vhd1nJ-Ek1A1Y8&*$^t4O_vL|1&Dk2Irj}L&Xho8b%Yaj#?6uQ6 z0GeKzC}#i&I#)cbrZv~#Z46itz+^NC*qE3y)u98K^0@`T$Zp=c1?8Gby(U^Jkv|`y zJi-ccUtd_kNey}v?j#BXH1+ld!WCzimr>pVC4BJUf%DO*9vUHMI4FXFQBlg9E=HP~ z?*To+Ihm{ER8%_l7Tcl6GaK)NlI#HYeFD_FrL%Jp{y}~#g*9bAj}9uqDX3{6t`L=( z&)&3J?#i|$Kt#aq^{^`b9LlGo2JA&One>m(+D|S@_92wQKt(_Rh_82074kmaKmc#p zj@x(c+~|SH8)yrxc3aOt)zEJA!5+v}Cn76H;{;Rz$Q6JK(oA9iH+@GX;C@1fg+~=O z>&OV6vND*7Gdnwb8yQ(nAr-`;rvd^3Kr?_BHo#t_#yZ|FR_X+x-wK@8+s7vXZZiuu z8;H=^@wNnDA_N)%jmkskaAPzmU#t1%%;sh%@Gfs(Uj)}1oUBGH6p`!67f3LmzX)P< z1L%lne8;$1tr$pzNVGL4F9NuZo&s3L!oo5?J1_tk{28zy5^eRtW38qi8cQ7!(2nIQ z2@&ada=o16(J~+5yJfFdtRx2d+v-#`2ao~d>6#djzxqIg<=vqSiH`me5)wlE_9i?W zygt4$MnWRM3V>9FfZ<3`qwb-hHFR|Rn3zxj z0pTmSJYcIJ$Qh&)1uc5!pke(qjJoh|MASOi+xKKEv$%qhqT3bS3h9CSM)P)PXsCzC zDG7-i3-kHO$;`@13+NJgB_+t8AU_sE@xh7!!GAkV{NHDqg=gYO9$qhZy{wq+%XN3Z z1Nk@uIZwjQUZLW3aD1E!gbb?H?D{(DA3*iwfPotulk034jfT)bcz{bQZaOl7K2)dS z0Mefr=%@&z0E#dq9nc%e&BdVxkP{-9P4Ix#&jT^3+HJxQ2^A9&dC93y zn>TOn?C)!h7U(Q2Ec}d$Y6pRO=jbTsV9y*l@9E*N`aM+C#Imw*ux9|ANG&x5ty!9z zBhejt|8NeHA2-2!3?2M|`f=rv@GpqN-P6eTEo z_b4eTl}e1gYioIc3OgST%6n+|Ah}=zCPVK9P=*(LS#xk=- zAWZ;ku7?DLn(sY(2!)|PQQ#r4aZq)aq2_|x!(FxC#X+T370xncUr+Z+GLhd8p+CdE zV?VevP^c#{<-9Kj)ad2?`}fguCml~qD-bpu6x|3qjhoPI>RVgyF)%RH7r@6piHR>k zTBM)YuuA<1a?3K1PXwz&h(|#ALn*f*bHGnQ$}1?)gf0i5`c@t|HB%1D1cYuE7Fk(Y z;Bb{~nj;|DcMPPAkrDgG=~~llYP!`mvDl4ETxt$vjFE=QI{G&_n5XOJR6H9I{_-(C zv@Bt5&}x7GM$*$;w!E>u)ETu%BMfUc?2;pKpR^(l5G>ms7WnuBA+UZyqJOB`K0%K$SeSJmTiP>0K!V(e^glRAT zanOT(d~1cluG}pB;5cY88<57fF=ZJUE+T{-y2_DY6T)L>Px%iApfJtPB0KoV!Wl{r zBN>yElW7hVTHpqkX)MMK7}{i`v;+rZJs{%lfX>pLnOmb|K$)SG-PGBc-M2V0Hl}H0 zq?~E;{K#2$|32#L|9UleK0G4wzd_j>CRvgHdQ-UR|K?3$B|l_*b?oBb zCI56ez|Qfz=(+>?uK$goGo?hd#W1t}L7pemuc-f5UQGUop*0!8L{L5CaVcgjs|$sH{AGu3F7;1X>$n{XYLo z>~fXYQKu}_+6AJDI-Z*P)Mno6tP*35OCzP>>#kBSs^V%2t`XZZ^tg;O2cpPqHr0`* zQEzTx0c#&I6p0^wexw> z9T>ZMz_%{g@o~rYV{dv5o`e&&j2zakz7x}BmUTaC}tD=zNA*JEXB?X<w5xxM$W=QlY^-2ul1-`9fTuJfo%ecGAeI|>ltSI zgIVxtAWaHkoPdQmJZ9;Ks5X##nP^H#m?WZ~KuKCyTnurj&bT}Pcf=f^jZ*qDzFE~@ zC~KC4No zM$1oPkYFZDCbEl^r~!|p0K!DWrT-3afljaM8RU1l?Is>H)i;I?Z?g#n;CT~D1|1n@ z!YY|y=Y;ud>MrgDMLhh^EP$9&(O3boRHl@|j&JCc-yj^*hEvH@#W65Jrvy&YYesrYmMhQyyZVqf3)49_c@t5)_g4BS`mo z_EL^k`I{HN?Zq(O(W+q3OiUA9mA$NgA^$FWs=Ilf`@ps9G}?-Ld5W-xBW`hN5hPj3 zm-AGcsTHP2Wk|rnTRJ+l!F8|(v9t^?Qsmq0;fV3|X;(Ik1Aty5RqN^!$zmoxSz(ju z@X8;-2(HhDYZag~9#2?31c0@WT{@)+;yj3r(~?mDf->^Er9ON}N*T2OdL}P?uk$j7 zO_w5m$0xgvJ(LsQvpX1L;!ni4REh^sTWOy9@t?Q1wt9mmjgXHRV3UtF$6?INTT6%UqHK5b6kB5QjSNfwkBW+xC;jD77T=- zX@;=x5%>&njHIOG9}uBV#;33NL2%{uK+^z8=Ex@xbaf0tv%Kt1izk0Ce06aqH&$@WD{V_1(KpPeHSX zq+96bOWOQ{lnQzUCPkI)xU|PU+kI*vp2569K`o71l^{%)fMB|SzyUDqg7BX^Iz(Yb zxDeD4@aZ4G7_ghVKv#=Q#zV`>SiukKMobrg92z38_7_}-VRg3{r>$~NP&gl9VKspD zTnES(+`IcgOe)x$81w`sB=mOY8o}^{jK&2EMWND`8ir(O!AsWxr5d3RBZNE9JPo^p zQd9Mc;eG|}vxV3dr^@L$D_=&o1>Iw?_4^@)?Ln0Xs9z&;Z(##)` zFwxV|3HNNA|?6y?SpYHGNZA>p$ZdLe7 zfJ+Tptv84X6t&ARcu?HhxFWqzOwTgi6p->*i8-rc^*Ilzs~|0L?(ez5Hn8Ksg51dM z%X_2W^E{Ht$m8#)PvE97noUK6<7u_GAcO#BAg9wsh=R`8TV|nEbA9E6*lD035cLi9 z^|xT?1vF^{R}&N$*M;g0@^4?YlU;?~b{9y>oAXb(oms((I68)>X@toDU}F|AR)Yzi z4~%;O%Sziht7%i93bl++r3cp|oAI|CvqUn2db?ii3IGWI6U}C|v%8yaJp~ANwA73U z?yebnAUps&hz(;CYT1(9~B%2Vd0c`8hF3dF4wr!Vtc?p`(GBYyUt)lDoDGK6m1h} z(!EuS%ggh#vlcSLaYF+ZH#qlNUS2HHx)DErKI363YVjQ;c)85t4(4xv-)d;YyTl?P zd|%UPD6K)k!3{tl?%uy&U{*S6tdk>8ZL?`p*45Poc{e@{veb=WT#?mf4aU&R?&6AR zt4EIl$0X+|1Kn2V>#F?ZE;wVt4^Uq6YmK^n@Z%>X5y0QIwVLx&pqzJ=cXdyza6H<8 zwR!-lf@rn~cQb1G!sE}Mw?K!;$jRg3L-78;!T$C@gQPzX8-l+H(+DXC_l2YG{7yk( z1U(?V0;XXa5%@sX4pbNriMCTAQgy znVBR3ncxsWygv(S{g|VMVCE5`+Io6gg`*UzE>>Vg{QmvBqmwxqF>nVEK8#kKgoY+Z zg$NwN25ov+a8yXM6;SQquh!_urQCp7vZw6UWNOtW#F`ZyIDAqVTgjntTx%F@d z=KF#WRpkDCg;G-j2txG;?8UzARTxeIhx-L7sVB4q*>fkF7cZpo4V_>2O^iLiM3Q&nuSv9VMtWk1Pf zQbx?eSAgipaM(2s9>lagJ-`?A9yhlQon|8kXNnOIg4|bVf|B zoUJ5=3^_rT;&R&4!Py=h??O?xf|(9rpa|mzG(v=#4t*-K&mjtQq}=KwJaEux&;h(0 zL^dkhsKB|RSuJipeE9GjofO*9QU4^kETE9&_RS1{lml zufD^iSQxq4NFFgLetOVVAv84TBkaL&IqfuamC1?gO%#}4UTzklt=6u!Epa;DLg1yg z<~xV0{hlCj(%bKRg7DWL%EE>6LLt9Bw$1Pd#-!eXOP_Pjh4bi9I(6}pFVlE{LPYh} z8tu?+7W0%z)vk-5YVR#|@0m3yIl$spj}LWdIYHNKY-|KSA(#@t$KU?`{fg@}HLx-v zB&YUJJ`iy^27{`AiH*$%Bo!?A1<(hyb#)62`bl7>LB)ttB&1Ur-j~xYjDSd;G#@Wr zE9=l@fEAT>HPtOFhrcJX*G9>CGV{%Pdy1fN^ha*4S@QX~F*DRyFZl1`8X~yuy7BSx z`0YLzYXJ|hZ0n^Lh0{+5n}13?OQxJ#e#$^2C%*5zFROjVZCX3hz5B-2Xtuf=yey?R zPep>l!UQxmUjQ?)x3~Wp7bgLd8)RKgJa!95V~n#(GI0SIW2H9FAd-1lN?(2OnMenF zixi4Fg-Z1kNb5E*KgRd#2Vayb&Num)9b>=@rR$Jsx7n4qmzP&dcjWsd_}7b7lvox5HoEuj*fpLf%}1-$ZK zv8D;GT(x6s?-9=rf`OijYRrw7TU(|{Nh#9W#g_7)-fkW$;`?1$bAKz;6SH@47~@h$XbFgd;5%TJ9M$D`yv}&lA&AZ!&_= z#59@p&w{r!H~SV9F%;h}*D3h#X2z{H1-d|D5>$-<`~A;!Wz+{|(~_DN)#n z5J4F=e*M(1Ny(rRz9|jEk<0uiWLh?Li=WJIZpzMYF5zGeIC~u&?k6WDmHp?puyMj9 zb7Rf?O4l{5(@!xRV80iZ76+{h5sy6gd!mXnlF3AAeiJN+$cKSlUE<$8ib%Q>p8vb_ z3yOPXEJf(z;>G>0*%L97X;Qpf73(w|x>hEPw1_jvmKihm7pvn_%1uyGoUtXgzW&25Kd+!0}6_^VUy>!6aTg~h#c2YLDDMhtJ?Q+o)0=10fx z$@{`XPM+FY9$c^Uf3)|WQBiK&wrIIbOB69-Km-FOP)rDtmx?H;pyXUikPJ%BuuPyN zK>-l~C1(UACljJXK?@`&$w_i3!tK+w&w2aayZ7Daoc7LZ@5gOzuib1ERDCtSImhUu z_ddp#wk=+suZi4+Zye!OZcs=VS!y~KZtO4|++-CfVwk%WDnCrWD|q4ulgRu2*j$yZ z^WSlh{-eiO%a~_&O6S3cq=k@g5o65$ElqLjtGws^-%3x!c@B|X7vWE{ahs#3icLD2 z`__uucx*O?U#|Pxh6{t;eJKcG~uQ+2zH`e+Crk+qZ9tL+j0(Hp~iXzlfqgyp$mw(dbLSAAS<1$SpbPn6x$VdUVf}6Q72a7q?3T4)x?z0 zeEWO96&GCakw?4kxzvx)DY9q%C-vI@t|Hys#$=Ch6qw18yQ+cG0jeN zai(&vpSl>AuC)#qldXKRU_;RO^BBahu`7elHfr8MfoWji6r9n<XUE(QF31?=I(OpH3e6;`FxDX^&Ac`4D ze@OWZ-XDOZ43`Cm{&xBmaxNAM=WgFdSYH*yw7#(STA<>)uCujG!@!7?xyj7J#8-K! zHHg2T*v%K|g^TZNYXgYTwQ19`Kfv6fYhfvHoYv$(9Wh*;bxoSIhxS1vHaIma-~%B@ z4+PmVq*e+ll>6|gz`<1V;`E)8i6%I%zzjfcY6b7n4ssiWRzs<|nVC)dgZ){kR-yH1 z!A?Y~(8H=3aGg}*J1-$Prx#p$;FNlf#mk6@yV!Psiv!M!KORfl45Sp3yF5KrxL6JY z>);rCSR5eoKR;yV>S-wy% zK_SjwLY<-LMnh0E02l?}B^bDE4EFpDtgLI^q*aQPvM){-Gtdiw2?^FkS-D3B|E4b0qZGt)7a}+^0@q zM$}eVE6>5MLKrv@(K;r1*){34GR+BSARz(?U`5~yW#Vc=3xU6Gi0yrtD2eYs#iU7q zH0fxO@a02|799P^;)15HG@L^6o-mNX`~$4(3VLRPsi`TJdxZne)DE=yxL!rhAX6i%p$tHNo4M64AP5J71|nKBcFWc^DV>8?tq%RA52_`usv}D(rqB% z^j3whB&8gJ1?N=rdSWNVVM4L#h1Qh?Fsap8O?nDc+2f|oLZo=s*5&|5p(B+>_H^Tc zXxV5PV+7^+log8whkWK+LbS_P`-$Gn8{c9mAo6`Qr%-9BB76Mf$B*w67CPU%o}87n zHLcF5P$E)5Qc{wL>2UUC<>V;X7cMrp6c?{#V)AC_hi!AcqM{;^5dAPr6D;q%WQ$@z zozX}50>i>~!&e@NaEv{QEu2<%3WXQvj_6;j9T^d_uSFBMYt^gCK{4I}#R*eg(c|rz zG=@hq5OpiaQOC9szjkdWsP5fRmtk=vRdVA{8`k>Mkt>P!FJxO1`m?>GR;7rF9_*<003)ZH3iU0(_Y8b7)X^LeWFXJ5hHE_*pRuBfREd=Vk-k9f7sd2z~l zrfJxz80mu_9gd6>p=k6pGaF?bR8>b@BIZ%3`2KYZb-JM`=%Aw@b&*CC!(S!eXz4W` z7L&_vLf{@jZS5l&w?DbC3)a{oM9-PgPSq+$KSG{E1Bg=>J$B58aLQJ; zqqKH)-N(_eZnE5hY`gT0_VE!wE3(O34O-{Wi$;vUpspbbKS0?^=pVRAD`4TdX>J~$ zn((?DOmiEuC%mq`Xj!G;6upEuo!H#rOr#JIm>j>)+U;OX+W{uRK=}|!9sv&V7{b$W z+fi+>m1|vGT~`vuA8ODW8s;1Y3yfepQV7iokya1B77*R-;EHifU}W}0l7LpU;*AmS z38%Sf$zqe^fuxZThfo($i4fd?XQ>7>POz5SM4f~X7P$DPHoM>Z{#^-@+GqGjiD$lW zaelaz)==myN+HMoJ(H+5vL#rkuV7KZev-=qddeG`BYQ9T{bA(?YZw_LL6CWDJ$9QI zx$$Ra@MlpH6u8iOF`0vm^7PU^3c5Rq`}*ze<%H8AkrvH>^2)?&1Dhn6z4ph_BG&;8 zF9jaIhg7%ZCg^nJF6BI%V^CF=T>I?17e<*8(g+5`25|vqmUq{VKH>L*hZA2ks@ahpHXJBojdUwA)RKu8$lP#mpFMYv=E#HxZ93iC$mO{c;@h`PiTW7*`279 z@SOdY^|xgyKD^3j#hpK)g{0l;5C?#*%dmGs`g;=1k9bLC!!#f;`3Vbe_y$*uS*7?}p*T-=4EZ>TghBY1_ zkzeUm?Iv}@9VQXCDm`>fGlPypcuW?Yba5e4BP<ju`7G^YWy6wFVm zx=vbKT7n=|P*%thuo~nHgq=7$JG<7{87NZ-5CFUs!S>*G6{8w~brlj-S_UmYt`zj@0v0Z(9~7 z`9i=W+Ku;|HZX|GAFvzSgBVuG1}4b_-Xh!(^T`2aBi`*`WI*?|c6Sq3_`mb4r%;dt zI-*zN|KV4?L>y=3ls9kPN>m17Do#}J_4S=@cR%v`>ecZU4zNtVgdK)-6rl~^C_)iF z@Pecyr{WZnzb@JDu*L&#%RBDLgRt=N9S2;!rwad5w8no>z@BUy%+ zrOnL3;P?nCw>qnpTmoKsu$Bim^%*eP2?z}fq*~z(;%e-Mwg(512Wg*eahxJNaI3-5 zq>6t#q1h>2xNnEizT28o%(e$jdoD14vDx+PTC-v)?ji9&ii(P=WSXeop#HDyCpFUu zU*S@SP~cx8mIGN{(6m?Dz9ULWL75^-I8=$enXVv^59`pwjE$*~w1B<$i7Pqp9lC}{ zGZ1BmfWnT0lbLqxF4u?I*PrEX*56jP_8$;1S84L z^X{M<6$B<1o$fwLGpEh80Cxhd`*W+K3(U>Y9wBN5Ew9i%GDAZahiBYS&OrG10llHG zk4$Voc<9g%$nW`oJD+#H#>&QKU`d;NE3g?L2$NadTRnBg;(wuuw6fSn;?qRC*(1nC zTD(Cc6BCIF%CXf2N!Cl<@H@aHSvj0=Dd;&<{osWH3>-L}A_rRD*47qY$LL0py1F{@ zkFuwd@9WbW;sht_VQ9JI?Jb?Xup^NDSLTtB5WZYcWM-(a`yxL-KLIohrEv^$PX65Zx);q*pQ` z{NL!(HBaUJ2qk(UuXAqj-@E{WS%&EOEUV&wTV*w)E z)AoW*zo6Hg5kIDn85lO_)fsPp1HBmSOJr~X2}y`$C~HZ`Moo+gqdvpfzTu;F^w&9g zlLl`EjfQJF?R&(Z(FM&-T~3HTlf3Zx!1ZQvt|M!CMspttwl9X0RpXVBk$!BN(%8Jt z76lxXvP#I&oQY#_bymm9?uRI8()P)T&A?y*I|cU?C%1iIt~Bf2b$kTx5LZ|5dXqVe zx{no)i=LVpEt?joN{{^Wqvi8y=p=I^OP031Wbj2upvklBHdWO;8dMGuRbiV8h0SsN zYE3d#8Wd{aAie{jQDS5NC!alQJ&7`orspRO8pw`-5@@+}xJO64_CzgX)*u}s^clam zgXO(vR^7}}a4y<6=PbM3?ii zV<}}BzP=ksZG2i&Gi+X7mdhX6(Ur~44T{>S*Hi#A&v9pAK0#-SY2L^RS0?rwFd93c za&nj(DF*mBVLST6U`H{+Cosg47jUJ5CuvT(6SMbXyZh5=HydX;5@9bz-src3r}a zAiGS{>0e=(Jg!9m1L}yqf`UQV*lhL#$2`RM5afC7D11h{q_72m&C0-Ss3y+11cesD z4??=;0bx*OQeMCtc_~yR7z`rO$NHx`s>3lpe81}=WS^_z;cb(NVs>_R8(=L; z%zINf9x1k;w*NvnaY1&v$`4gq^x$XlSiVm7X>r z3L#BuHS9gHNOk?_Q3p*%M(M$$d;``?&_*Ac7qREy%GO4LPEbnu&AmwT2r}F-A*5g( zX#*$J2?z_n$Oh6HfDXy0Cv?|h59r_xBBG;PQfCAKGtmV-Nl`ArXaczZU%~Q2XQd>l z=lX*;B6SM6kpR*X*zk|{T@C}30V@gYeE>!m;8%j6(YQ-s3Yl_&^fWLCx|b9HFuo{d z7zNHhD|_|oD4@&-T#POFJywBxj)(u*>H^FP* zi&aHk-cGs)FeYP=j)^q{HPh*^VgWh>tA(RR8EDGQyu=QYFcSBPfM1{$1Wer{bhI20 zPKAeO6Ywyb)AV(FW$2XPLP_T%nVUd>Eow}ASjA6)oFE4k6H+j>A?_sm&9Sj==xc=> zt%ZJ1o;=Cs#*a7PtpT)uXJSHt5e7$h{pi-8<)P3=C9G%t402V5YElsi^+_ZT*t6vU76k`^op> z4T`4)Y3f_5prK_^qkuzsiZ@pGC3~FSM2)-ZA(vSN~ zIsW*|!J@al)gxZDsFuafM&K6p(TUH2doA>?It{Vgv@WShQZI!tf49yE!=S#4bUhT2 zji*VX(1~nW{-XMeMqpflC@xxlaxb*c1`}1c0kl$}do@X+3AHKcv`~Z0CK$?*rM>Hn zx-e^obPwRz$*DNQAM=JLn>aEua`*my|AWJDT@bU`^hgJVRm9=DMh!d#Xnr9b#JoY} z%?kR;XaWX{PWTf9m@g0}SZqBi$}2)qxFZRWuGPt}JqTc=D-@*hSnD08`hNeU-60~5 z&oG;%A(?)Nk-xTCnf0HPB4!>~pclAspzud{dw=DFR^OJ_d=D_%K5$^TEx36oieBXJAgs5} z2Jn)Tvft%n`{-Yh(UAIa7NcR~hnJ%9lN?S^}Ev~(xz;J?{MnW-aAqBb;r|iZtKBqYwh%@iO)2vm?-_=VPD)iW15A^#03s{Q7 z45$M$z~mRm5pQUZPS{Txp^2Xf%set>)n4?cIHox;aIu+(8(utnukwL|<^;0_Tl?)~U7EGH^z&0b7%ozc{lqEy zb^RXkpC7lIet{%|^PpcdAX-Uv#E_+@;Ar7EegXE}FUg1+A6Kw29xY1xs6h9iT+eXc zhxm|LV!T-N3|S==b7u$-^yS48l%&D$+!`x|N+h)Jz9^AF$k?-%}$lCdLiFgrb5~(8VC;!3@Y)!nRVWEyvr|CuuNc z+f5jdX74(q&UZ0&MoBkCD8zUN5~(y@IS}BEoC>Y6*Yj?Eb^S>TnwM`b)va&pEMw~3 z%c1N4Q#`>hz%}bjuJOdj$reufC1c+0q+d5)(Hm{)zXz3nL{rP3@z$f=ot^x1-(zqt zw{WWw3{&{j^@F?Hr{H0)>7r*c038T~Xd3hY3pFz{1K992*V@!oVW)GVf%$^u*&pT4 zH41{cyXur!sUP0T?zPDl^ijMPuJ!7K7JJSD!;kV=oT`$$uzL7VZwqpYl?0=c`5r>M zhxk0ti*V#gw9F>?G3((M8X|ebIJaH!gOS)N*Y#(bJgTz>;bnM5C46-(Du@4e^T@x@ zymtX>|INL!bxXMW-;66C^>_~aWpU~F7Z#TR|GThJUjp%U!}*@8YZ{;rScg&?nu)ZK za=sh!y3#?}k`{us!+bYe{~){sF<);5eTb%vc1F)O6-?5ArTJy!By4a#&T}2?e6-2* zDCy7&L?B{~#e_Qw?ind%S^9qoNh;uC{GU9bkYP-y2;Kr_5Ems_wF8QogjFA?+Xz>I zD;>ZBrrnaZd3+=VJCC$Ffk!z3T6sIm`*hCLFTtbm(T1G4f?KLZmk`4@=2RKJCZ)BH z%tzI_Kn&ZUB&wvhJ1=xQlNn_D9zOuBPpCX}E6kKq7f{^&1~`uSX^&w~qbM$|BaQ#? zXAxH!!eJX|Y~lta2p*%MFp`hNC+Jezs87Hj5uObdqco@?@WtWs@d|!kkZ+nh@OOFh zlMP6ZOMp(U6ImEV6T#m=W$l;=bSa28@lrni;A*mlFo8d=T^wMu@f+-qKZ^nAlO8X^ zL;pj}zxoX#lP!29V5o3FM9?R(YPsOFo+DX+R#B*{0kfu@ZomwJ7la;JXME@_V3M9w z*ttJyJN-2_28M)4AuAE#AJYaRVY~vl1%>%6R1h%lZ+=;d3F5}LSqV74H0gf!>(@LW zipqh)2z~+Y(m`0Rws-d?=T*}Uif}XknWZ}RrV+s1-2AXJ`E^LT6h-OxBsQX^N0ZrR z0qdbMU{F2G+(SuB+Q5jQ4q>@?DU;BZq^5`n4z$avc3EOQ?QM})Q6zMPF3#y zG}Dxt5)s9i$`C#hj<#vkydfY}~Mc7{?L%JL@MVCL$qW>1cp?&j^5Q{tViqD|&Y! zp{rlo_c;HMkPs`==ikb}9fOEhLnHruI7+iXD%&AvZ0gd+_I^==jTCGDv z6~oSp^!^OOp#GLQZ7~U&ct;#NCfgAMBNRV?A2PMj1%(#69p1re@EwBpJ-UD(wY+$< zdyx}MKE@m^TeeJ2X%XJnH=ucmtP7w|h6`e$APwLa+vit*?MHw2PBP-};K2tlZK7@F zDMN!X5Np2O1ZUb|5fL^QfRTODAxQ4#Kc}X;F|H)pf?LviKj=)DI@hc?8)=!`U7ukR zwS(NeiJWlu5i)EPl`nDY6K?<{6v`at_04th6~07?2*RaYqXkM1lphGRFidjn-06Z` zhKc|nSvW>EdM#@4q*q7q0V>$sKxX8SFF>4+s2R&a_6#%twMwCG#@FnI2BV1s zMxZL><8?cBl%ttLzD?_1(gc#o;*o>LXd^XNIC%VK}+0f_~y~o_^}|T z+YNaUA5V-WhqryUg?o|n-NKRoIF{F*Q zJjb&#(@&Z<4_JA>zm7YNCXphijhABKcqVCPSv=bAVQ;);X_^1B;4c#PLv3wlS#JyW z!C0~Af)Cm%6B(laKIcadW{6+^B3{5k40Fqne zg2-o=`uW;Db8zph(b%Z`7y|~m*4zW7+F0^DIeGZn4p0O?g8426Ibtqr4C^Q~uS%=EqgH};;|Jg)hIZ8z z#V+Y2$c(BL=Vd$EikTkcB6j=D)Fq2Go1k9LwEz7i8B_R|R!nrW%Ca5KTAuiqTchp2 z$kPA9{djhCHN)TD;TX60mcLQB9#wi-C!7Rf-Nl@hKMV{w;qk>ugH!J`x~4`ZCkvY1 z=XU5Xa0d9uetLIVpY=k{r5&bQxVtysat_MzVE?jdQ6MSP-UeSoR8=ZkDzYBg)v95| zO)#VY{TQi7!8X{xb0?e;V#tWte%LhkK|nQUj5PJ~IQ!9!T9)5P68Y?L{*HdthdWl~ zc{95X2gr7h2F|~g=<+Z)*Wxu{I&~C=JSR*o{I3zPZE22MrpFt`@&vh`gr=^ZnbhOe zO-ov*)Z)3gY9u@*lxxrC`A@BEp1loKi&jjENPD{BJYvlmA0V5c?J4m%WeM??Cr}GR zfNhUApv@OHFV*Z?WF%IW^N4Ujp$9VaA@7jU6F4snQ=s&Skky$Hin+b`JprEk+i#_f ztt7Ku;r!^uP$DQ{m?i9u$pTm9J}TXep3XE$A3nlDRV3QG8SAHVDKSu8WM5cI4R>PWv zU3>Q~cOk4?funu#+A#k^^-n(HE@wYg{g6PDP;xI>@jC3?2923kj_l<{Wm}z?OiiS? zWK9rYSFhfKv^YI&L*h8X)+t0WPw(`9$9&O22Hgsd!@wt!^Fh5JnWlKay9|E7E zQWwV8R_VPiL@o2FvQig38rs=5ZrcVz%Rw_)6kT`(EkKNiF`aS^{jBuL;yKcTG3-!GFN1-2dky|IR_vAn)*P{-kZv)I5aST^Z(&5hHxD#s}WO~ zpJNp2EuqD^F=D`grI8HfBa~fhUpHpEvDwoBAUd%-h+hh`qFeh6hH!&yF!yQ(Nh5Bc zAHXgTq9^H8#5ykk#kKr&Aoadm!)B=3!mED&Jw~Ak9Wx-?I1j1*T_4^j*a1&D&ho@7 zB({6T@u5J14vm2dQTQi-b!(-#br^FP8tJ7Afpzy&WW={^K= zN(QasIntWLi)g@`be>a0>qn7hN&vE|HR+c`()|fy!3<;Ez-F#eVv_od3wR%ih)b9W=zEis$X!4X+VAeJBD0^JF5f^NM`xWTdMwHCfwjT!3KS4r>rak# zwd}j-HzB3lW!};xVq>3!Mvn6GBJJa7!LI=2gBGMNw38-}p72C>5f%h~EMgyonK9d8 z=J?Htv4Tn8+sKZOLqol3273<=_DRMdQz0giUMkG*izz99$bjvSnifzVl%LPc7I9GbH9?!fYyr3&$j$HuwuNhEKp0H8;O# ze&QT9AIc2eWwgo`-0p1!jE3oUp@UZ<| z_uOdcI;(#~qozU2un&ey4S<`>*#^Y{1%~trf|4a8brAgs5cAXUwi6C8cb`U5vj0se zKB4yYpDSHu%YUepP?y3za1{*CCr~NMg-*h#0|{J|cZ$MkCev`CZ^JOS5x>^<^E(}2 z5xfwb_KB&d8i-beF7DG z9|pzuJBKXkfyN7BMS%)A9LN4i-HjBbfq4JL!$*!V@$qFclwzO>85p9OaxFy(e9#Td zRA#=^^zE#*NRbb!*EAR`4MB{w+w^?`~RgCF1p@$3LSJn z4G`0_QOH0aBg&6oO$&-jOyp7yxQu}cgd9iGvJ*gWGjR?tHeS$rAW%$Lq zAO#O@sk~ERdz**uFV;5C7uTxsEwDR>1gDkX(BdiLP%}Sv_NtgHk3q?CQG*#j_cIUr zcdx%(%O}S5Lsv9u&Wme9z^z1S8PCYn>La1+(&r@4W&|ddSJWk&i#SgY{ZOMzqZA3E`l4)MTQFj>}@pXbMG*frfrG zm_r|WdeQ)mr5U#!k9ao$5iAmwLP<;EsO;lzSm8Yos$*dql@ze9w*kw;oD}No8wNS? zz@9y4k-uO~Z4ho|TD!Iea#Sqhc?kw0?r{U6w19EF3C5{7#pDoh34>0UJ!K-`G?#_^ z8IItLE>T0Ek{mR+#0dpFRC60P1r}FHyWvTUBNDz%CbjSbCPDM=hnr->l~`Fy+tMX{hbm=sUKf#Tl6Zzug7h?GWqP&*yZP^u3`d$0$Sp^=7ZL5 z=e-2o?&_sW9^jq7WsMxUWmmkzy63_EkS`!#Xefsnyp2MWQyqn2B(=i`sc*<8%a<+7 zTHJ?a=A*J6*67ci4Y8kO%i)M0);J}=?hGsLPIRD~6p)?1mFB*7kikFWFj zkt0W>H@lyM&nw|(FnlM_n+~8uyUZTS!RXY~)Tv)&?gcQVcwCTI-LkmWGY-z&0T+?N zK;@6RotGHOt->E43@DY~Cl2|pbY6txAQ#s~Y;*3k@`tB_rBENKy&CRqN<8yLsAO}+bp8IajA<==yH_@Hz8VfwtWdDps=)ki=kvN#&d&Vgq`RSsAuiW24)tP zIEcF2cKn$qqh27K{Qk&m%ix{zE9e1&zcx{YkmwwS^1vNOx?*e$QZl1=3~44#$zr38;K}>@4p8 zGmP`j%X89ih2hx%0Jo3KF;`$Wb0N2%@xmgGV`$ixiUi3vD z6>;0@1CV2f1kr`vi`o}FXa+QJt_&)u-6CzudTg(JmN>rM2#w;6TPR5c!TIVDN5hqox2<&qzr6Vg($&; zaVzL(hzE1jY0`p0`ZvY4GFsZI8-tJf<1=B_}7th#w2Xhan0hP;~)d z;ggVW4WW*69yoB**#ssbvXaFaNCwPXwqQ)a0YscjaA(OcG+@s^ANCd3R#AC|VN$O_ z&gTQXvPCO(mj^||Oq)x^7V?e2FpTpkmA)ZCo&-rJDJ|XoLLr55$jr41w2m`4u?K?r8+D0Ke(;0&o+<7g|L-}ina*fKhI_>h7DQ^HuEJ!?KqTj z^(k7e90x^3sW6{MnH0?2n6d&E1@?~yh~+$X>?)jzwIHdV1P9NnE5#OG4cknUqJD_y~N6B}C+Mi<7yMUd0!ueynqH33SUM0ZlYhlj_v z!&A zeDJ`BgApVAK^yyXK(w%bcIs9bV#*N-2rkuNuS?5fL28qg2jq{(QW;{N2@4*lfOpyx zPveBY0tcxdDl85AjhUI59Kcu%4Z!|>X)lOU>IzJ_m@=4*VIX3@n>K6+Lo=CqKH}fe zRP^3l-0lPIBJpQF=;kN6bC866GBYz#jK#xuc?C#)=m1?BnS=%)F6__Gx)$~Y31Dyr zfC{)u8%eiOKU|$OOtU64@DGZJXpkF}j)QcME3v}cO$gKx>X^?r~&$3J&MV zB4Vi&IAq_xb4Pghz+C?kwA3_RoehOIzO%nywQcH_2v!wzRvf+&u*hT7>1tgoo&%Tm zgUKde3-dr@P?p-~QSBJ@otz559`2RElmUiSt75B3pq3N{w-hk7#|g|m*{4{_%aAG_ zdV7a(7law~l>B}< z@c22r4Prp39L5}-G-*_V_c%4jqBjgXsvplQ_@Zi>ABiiy=$m6T7>5&nfR9fRr3X3t zWJ1YM76fj;M~`;qHYH(KPU-iJ;oj-PFAM)<5Y7$uXgcHpf=F;op>Ys6nXQ&uX9P?r z@8FO(V3kYenWQ9Qr8zk`#H6BSAyoyCk3*~?yI6jK8v!N4AS>nL2Vg%Q$61T==lrr{ ztWbn`v{kXkHp~z_h5Vl(*?^}k`GkdspM>`sUUxNsK|lwd8QAX=;JwyE_`(X%2;|Gl z6FLl?8HT)Susq*#EDfh(CxI7YvFRBY8U2bhuWD;YAWX?AoQr5J$JILtVW zqZSqvcRZ+=f~)TU&>{-h8Zcxf`GOc|po$?bwTN3$WOHD^KRWjs$VE%Y;3!W3P4?g! zMZO&HK=#8*gJn2uK9yrJl=BsLH5O9_Nh*fO_7aXCPDgLt{q8hyXy0hB^*j35iq8dL zOmI+n6!>bJLq`rAxB{?^89>7R-CbQJ#l_Jj(a#sh(%=(uRM#cXbRa;-d zc)5Q4#Qa}i9rewH!NDQ@)nQZaue)PpmpE<<~>YF>?M_p@NJ9b{+@ThXXUO&LAHN!0Lkj;)6$ytlhel z;!^tFC%jl2ZnI{$#++oOpn?Nc?bi!tdvyb3*82B|WnA2Kdhs z_n}sGFIWSg;YcQf#VM_<99EnvgsUze&k7^Eo;0}5Oiyq1Tm-z57ZbaS^PdjxvI)-? zOI1mfUvM~c<~Gj0>h(V)Wo&G+5CzlGfsPR-(Pea)aceL#>NSWJiSB|s0A+FD3dPM2 zPN;TaDe9Z+3PHwZ_dzXt!xNhp>UTogWY@0W1A+T2h zj0YCq7mt{Z!&&x(Pz^j&n6n53sE_zYa^I~#Bz;RKN^LM)If_i9tl{QDL5U`fS=t0C z9x(?hnBV-P)(na_9&jy|Jzq|f=Ld;Qw=NY1tqP692V9TGN149NvZa81fpLd-7mBpY zeZ6*M$Eh|sO!{xM9IecG-F-g#Ouw!E)OFqLej9uH(%M=@>>?VeRuROIJ|%pggoGp^ zOaYL=Ja-*Y$dBXl)1#+B_f&%&Aa(2xA)70}wFCl^JcryT;R|nHI{K`p3IJ%+F?+>( z9vv$(zT@aa?*(@$AL5L_9+#IC8X5{4Z*PhbN>e1`Dugr`BljcmAk62ZodN~2Mx+)M zh41|}+rlvB$q>38pxl8IObFe;WL%t_k`PF%u?3nMScL6f1EoX(dg=o>kGc)sM6yg zugixlhQijwncM(r7A>5%hZ=INlTC65GZ;i=tG<5)@I^*Q?dBg zl|$798>LR>=8W#*iPNfT=83KlC=pee2?f?dc}0Q?82vab-YodtCw_jBU?K*a^HuQy zqZ1SIfTcR=Dl}a7-u?UgW1~aJSEXMSl)q{>uhW|m*9Qlayv7ue3TA(q1kU@1RP$ZU zwKA5d_Skmf$@Aw4swUaz$aE_qzyY#vNr{R`OIQ};*8ia;%Jq*g1#2e zh=KjH+d+XqYjk@K? zbbDv!rL0`B!T^Exp_f+;%DX7Q$;uA5&Y6lrg>OWmwZ^eZQloA5aqb^VtP6T5U)&P5 ze<=O)jj=TnLFHi*^F|Cm)Agjzq_E|F&21dS7L0xI;tvu?K(hP!`$wTOlL}lShwq5x zCxc8Z2kYg39U7A!R9CS;T{#%&BrLTaokhfy;8)rybNck3h!L`F4!B<)x5u6tCRIWB z8IA8BY|NI09qdvU{sU>oUHc$5J{Dk5f@GUtLt~L zGC=MG_saK*??leiiOD!Ww``@-xP@~N3G#cHW;w$G(;K_RywsFmY`c@k{DZnsRRRVi=e zS1~dlRTl<;kYGIy3v{VTCgHv8&_H2XezG0H!lK8O2?5ZD z<8;TN$ncFIWg+XSS7oOp3(t}Th@GS+*bWD23XgSVQxjGtc1QBo+Uc73i`d_+$+=Qud%RL#-f(daZ2d|y88zB ze9~e1C)IJQorJ^#pia+^AwfZ0FuTmm&MF9aqt2-_%HR~X-$+?nDcP?HKp%0vJMAHc25+kTif^?vUq%I$1DVv;xU%;f0 zDRRBCF<%WZPwUj*W0-$H{jAS@fBF|Y97xq}W z-uZR4{J*}j_?*GFoxjK^ufKzA|KRKXXPB;kz>R&L;Sc!xk2R=e;Q0UGWB;pM-9PvS z|M#u_vxMjWUBv%5IsE_6wJK9+LN2Fl`S_{l+-ys*D=21KoN@P+!;ba|#i?sgcf{%Q z1bA1bZPEB?OqlGsw^?!a6xs)w&-TWGixPvT^J9Crmv*+72Cqz~cesyX*|Od6TJ+g9D>=KPFs_j{nHj zSLv)M*CVSk@-Ejb+sXE>{nhIa!p?+NySQ}=i_kURDfX@7k#a4Z|Ex9BBXXp_$&;G1 zn6Fi;F_EhuwR^jCjqxsNJ-Os9mOK+rIC`^-TjX3{++s^EoU}jZ`;C6Tch;`9&Hbe1 zFChSrBQyM(r90d6^~cgahw^1bYND6-dj;2A&g3;u{@Q-u(9-h4BZk!vC%%_8`$kwU zPG8wuBqcn%7$%%CRU4cCBvkRmkIczWrJ7aIpIiEBR%~oa4r!C7R?o;s#Jmy<*VK@4 z()crj)kZv2_sBP{2U@QWj~GUB3|c2=YL&9pIV1?!9=d2RD%!3wWEQfz{K1`o&rTV0 zdpsn9towUi7h_YtYK`l6ISgJ1N^}!c;anKulb0EIlJ+6?{9?0gsCJoo;pQavPPUfL zyX1zjIT+fMYNmV&p~k=h6f9&V&eWXp$D&$RQ+~yFUCk$c3uy|6FUUlH@=vYLlam>c zE6JFD*k}FNUf7g9zP_bKZ86Oxz&;Rf|C_xJU0&&mgG9HY&*6Si+3TlMZXDVXXUAx8 z(f3(8L)9~;{jp=g=$B2TPWrG-t47SO8I17cva&M@Z%TX_XK(3p8=fVrg(69KoZ^*%3p_|dGmOY;&mQf*b6lB+udf=bQhD3llVKf1pAy|&HN zTwz^ZA!|NSqN=rNJ*|4az&rW!ps8V!rIVLbCnUCkn*3XaZ zn#e1>GrQ)&mj+XZq=7P_DY}RVuW+tWjBiVQ_=l6Bb`F!@MotKr3smm8P?{z@Vp#qx zt9gF5a!`$%XjNCl8(-CKq759(AMw_{ml2bEum8OM_@e0L`PRFFon|@XvtfgrhYr*P z2o~15xaM9E*rL4OTStF-qcDfW{CTS?J}R5MiC0tpVB>R#!G#}>=;_1m?A-IqO0T}h z6!!Y!QI3TA*xcbliPLYF7_cZ%`5LR`ObcfMiv?gwseUp~wmG!FE&oCeVCmZRBvGvmY?foF!7G#a)^DQfR*XX_@vm#gYOk>jiy=`Ha-&` zq0){;N?P{RtBpk))x;dEVzZ9ORpUnQ8UN_&iD6nOXHVQSyXlZ~z7ZSGr@eOie4b@m zFQPcZq`yjq$;0#8#B z-+5{S6g#0t);cxz;HTjlcTD{=z2(arc;w!Hd^^kEkhI;@II3Qe_N`i3b>iLQ#p>14 z3l}TB?9a|*FQ09Ay;Y+6BlAH{&O=qVExiv2o{*+GI(*ThV;?%q=QSmlNU>8TcbFI^ zwXR4XAAcY3ckB3hUkklOiKdobe#hwwjlJ{snGTNm%!QgUA1`}XW%V9=NadH?@ARp< zo83wAhJE;A^Tj3U20d?v*qch(9^|T~?KhDdRi(y9d_Q>J>7_={VgXy8d4c3ZC~>}; z(GT4v8?n=U<-S8EPa#`(KxKAL!MpNxR+|bVt7R^}g8a23GNX$Qi7`%m2Jc6`ON|OU2CvUf z|5!cbtgGAATX92Ly-`B`G@~>7VHHuyu@K2Gt*W~HWxYbQY|cOC&s$a*Tc_82F)^n( z%WX-|iG5JqJuAHFFQW9iR(8WoGPP3evNc%8K7#G&hRFNv-^ce;_SNyRrl$MtGrh2zQ) z@k>Kj8TZU|bZjw13csQgS*Y~>KlTCtqI%J=wbhNcUxPQD4*pas7|-H#@`qpWSX%Yh z6LI!J_;FTQWV9|Q^z*0F4L_TWMu)2HmyU{$h!Ddw0#uu{u*z?AVlWmi)y_87=}vrS e$6(^((z}}mCnb7sG~@3n66d7ElFnSa{XYQ7xQWF8 literal 0 HcmV?d00001 diff --git a/docsource/images/F5-BigIQ-basic-store-type-dialog.png b/docsource/images/F5-BigIQ-basic-store-type-dialog.png new file mode 100644 index 0000000000000000000000000000000000000000..6782c14758c294f5c4d871dd3d2b4455e0138958 GIT binary patch literal 51686 zcmbrm1yEMe*FO4!qDY5=bSWrEO1HFvAl52YTcxhJnry1A>W&tKiPf6x12WhxBsPL)ld#8|e%1Mw$M3jM=ULyGjO zF*jd^U}A-Y&@yADp+6(NgU;IZ3q8mVig{dWUkkMuVMEFA@($xfAs;&{!B+|jOCCHhCVZ2VbC1T^>)+#O8aq3Q zUO&fpL+vd2?}OA}y0^#=IIRQ^ksGg=hTNiue*v6QM1+Kd(G550L*a6}5l%F6`6U2vDp?$En|jXcqlL;RXCsGF-_*$$mf}9rmR+`r{r!M1 zQ$qstUF;p@C|&e$os*AAPKMX$o*3x75Ym>u)5{(#^QX?I8m5IC8x`e`jF6%7;L{V@ zd-rf2K72UTsgBXUyZij>kX4RBP33^d+wjfM>k>1oG%H7af5xLcS+UvA%(=e^kIx z+J!^|O!>3*5r6oP<=g0;A?%z8tIOq4B z@|HQQ4vM`i^LXP$RLA5%X))iM$Di>FVsT@lU9Zxxj)wjW&Ku4?rO0M7-5WIEh(7xh z5gQWnJ~Auo?wj!NPbyg`anf5`o6*%m;u@U1ysxsdEYlArms8rYg2*|QJLGEOFi`wn z_o&CnFmS(Ri=q`AhvBgJvh3q&RG$-*2vO88%Co_4jgjM#5Cqzc*0*JA^d+ z65wH9llxH*~8qp!f>&nUqO%DDEh2vYuGs~%OPcIL3Gd&dQ12F*^=jTlz?9?clOrCO3N^LMz5JY=XfZTEHC#$k z@SV$A3zg4Aclpul&h7C73+Js7qDvC!N!~PLWmwy1mGiJ8K^I=;ILG13nCAGpcRJt6 zDRoFUPu=t``^}Gc=6y~7-dwYFJBgxtpfNoMDR+!?f$4HKqpnaJu`W6g4RH{ z!Ra)MIXbG1j=Duu|DzM9l@WjBFgPTHTG7|nSF6D2g@INM)?1>`&#fr!@$!d~+{{u| zgF3gGCmY8Yc0BuJslsIYe9;P=-i{pW&|U6)9ouh(kz>>C+&5Gq7EY28gq4s$-ZZhB z-?g~E?$5%aOn=(uggNbqb|&jmk8L0R%HCSDMt*o>UAMk2S4dCTCYs2P!k|`>C1 zYZX(dfQ6lX>@sOxf}SCbmGC}EO{fi5-~wh-?moIQt%HC@Dn15FvFv>s(&aH7N+B%eMs7D$WGywc96p(JyX zCwk;QtC%d}ikqI={xUp3y~Hu-#v`8dkVlOX`%I1|hLrxDoW3yl(A@TAzQ?@OXzzPUf~Yw`qn}`; zdj8fxiE(R`5*jM?lpi~Vm9o%#^RS?#thuq^VP!uC3L*;Iv>4juh9>z zUZ>};8ejEsefp&paV^y95F_1XyUZnq-6xb0XG8(m(V-~+Hi>|K_RkEJdv;ma72mLM zea|*=M3c*i!!#eiOo|sN^`S<~l?f};PzuUSO@FXd$H`63nigr;G?&R|I+Gw?ecG!v zDx|v>tNc#gXz7cb_rXEFyT@Ox%eZ!7ktFArOCAM;_8l}VV)GT4O5Q@%cTHbYHC&E_ zMA6V7U6+EDLGDPZQg~Q(=k!3I8}(7%&=1Gs`~8=}F8jPz+=)K#N$ehi`! zSxALkm!K87O`%LUGEf>uD(L*@MQ|j8C$3Gv{#NjOW0utSm4%FvKk484X-({Lrm)U5 z^7D#i=d$OX~CcQ>j&#Rvrp$TW-9J5Yd_Wm0DIX8{n`$NgXsI=0hoRjIqqvG_h8`nej=I zQZ?V)ct}@FGpSyAD6V2FqAAe)nD)?>PV}UYy^_|ijHZ@9boU2V_1?j<=f-{T%k22| z2TzZljS6TPFTC4quh0*qqM$DX6OrU5hj1$GedCdPbjv>`8~1d)VsiR@vmx7?-#&A*t_q{< za{u<9X#$lj!qf4}PksHRA)>xicduy|xV&4#Se?kBmy*^CP_iaBi}&tv-)Q0Nt?IMnnW@GHTP5ck6C9RihR*A=*zy%*)E}lOnDCqD ze)9P>6l1@ld#d8rZrg2qP$pm3%GipTICyFD_OZWf zS#8|wWp7K#&2&8OSI64$g%#+M(zGDU2s~efZtx1nqwYQndBUk}`SbmKq&we72okhA9e93UDa{dlZP&oMvs>h7LA87>YY_8U%OlEB z7iya7qDx+WA+2vbn!aJ!($jnL4{?WndGxrrlp?!fl2ITrh~H;{`Cg8~K(4(!WJ#l^ zw_Yg8lkP1~V-+fAmG8>Fw>xkQDtb=h1`hwFc9bSk5&vaaFx9<A}&d zl+FD?%gB5!6VIUGvv$KW&)0A}oV3Ew>ys~aj60pq2*`ZNG}$Kmb(;!pN!jn|ict}p z?L82e#dkmAudfNZM5%9sLLDe-IM~mku9B`r<}JfMspfpYw5@Gd_ni$+i;)a2Z>_O}Plq$5M|1J<95xbskk0E{e&S&_ zG0v`NzH0nALI}7Y0yl$&gAmS#ehe~8k2}nF0z$iQvQd{hxR$+$%@xSmV4eAGiBF0z zl+gZJt~M?--RrzQ!BT|N#DuSXquXWU(0c6^WGvZ-4+PTa^FCF7|2>O^f-~N9lzB3< z)|9{8YkB^G$mVn#l|oT*MG05ug<@uS9HyK8Qp^OW0ZE_`W)W z<|I#MLwRq&@2RZtp(iHfu@GT`;JKGv;4IpL%S?=DG-3zrw`KMgcX=*&K6FJjAKAwj)r+H1IMg?^q*jY!wLrjL# z2vPo{PFd|;tTG;6YIaj;l<~3&?H( zF}lxY6alJ39`N6)<$pEz^4A(NeuXOq9K2e&P?FC-mo$N#!xB zdKI(zP0kL5!@5a@oPZ@Jgf|GeKj%(~wFVNDM<<6nF%fY%DA1w{x-Xy2H%&-r*y=yb zDkOy8KaNE4mdCygJDo6DSiH`#DM3C_y+L=Mr*$LguV>pkzs$?L2XP2{(9Npow?c?J zwV4a+yz0oVSoqM#uCW%3XO&X~N@B9_;_o=J>_^yD<<{Izp0IH^Smt??;!1JQJNzU| z?atkM!Cu&2qocZm*?dow4PHRb=C2wX^wO|>tngH2a`!G|m5<+^jCc{6$3Dtf%hfsm zap)4q+Q}Xuvv0JSmo{Xf{LXMpkx4U2F#h%rD;9Qpb}vUEt{=<+Q-Ho9F2*}!zo)3| z>tVq&{qwr1B(CH;Z$MGCFIv~A6jtgm8v-`k%=TJJMxEES{E*Ccsm?B3BJvz0j-+1fv+(nf!LS1gQ_{Z(Y7Qoy0D0|LWX?@}nYF-tDESx3xQ@w8d9 z()gST3Oet+Xl}=pQDOMX%w1WsyD4pTFG$Vma)!#}SKaAEpiTL?6sQ^Rr|2@m!)GZm zj^A#c4cVa*DlGVax$Nihpt@|kX+}So-XaQRcwY{dZ~oc;*jpDJec2Z+Z<(i@M={8-;VYA8 zV@nU7c|=RP&mjrs`mE;GV$gRTR<#@CH@iM_@WwTce%|$3TrdkTU&0^iDYy^{l|m%2Tt}oz+Ifu`KOa_7=Xixil)oa3 zbP1>`yF@u@6BVN!A~Yu5Z*}=|tIGwywpL=}z!3RLM+Fj-3DO?KzsgWy_`bOu`oa{Q zaA!Pq^hA>TOCQ-~is02xGU}fi64NyiW$0tW2JQX(1CQehoQfJ5&c=n`mEC+tPSG%* z@5H`J-)8($T)njdP^6UG@;~WL$2mBcWR*@nviqW&CZpRXc4yO0wQ*7R4lDDBb&Li} zRANf-ptbh4-69T!P?(^YD*o=N?znc^$j8znTU~BnF?TX*(FlIGQ$Yz*yq{F2KG$!& zWB6l6O{t$tS61jh(Mq{Fbx`iZKm$|_6b6^#>A4t?b7ZnLauKBrlq_ZOO8wJLSg}l;+|PL5^DD#V1LUj9gsi?+fMpD&Ds8xFwCSn?3!2K zA1t35TTBkfYbt@7mlpU#?FgQ7s;g4(~+3LQA}GQk59S|@-~KE=;DiKlU{rHUwM;gP(&v8 zqf*{p0u(XnR`gx&1@Xy+RCnU_H>m>@c#6*f%=FiKVN;&nz9N<?ypjvo2?Kqr z9AqvwpR)nR{_J6lII85_o%WBz$o{8A=u4)4+8`YLNt*uUpuTpiZ`N#;>dl7(%<9wR zCn{z>Doh74HX`{(@4iqn%ssM-!%@qz@Mpgi#^F4i(RF42=aC z`_|q1Ov_36?7iOjRq{Kywz-yHA%*Hq|KFy8+wC-B z-X28bb^M?)-JK9#SB}zr`BOGegJS$nw49NdF&2yU{bUhO+|8*>NcgX=DILBjtGiF_ z$97XbbvokE;G8fM-%vVrcEiYwO%jCI_2X4H1U|1>gx06{@*KE>>NomJx1q69&EB?W zChC9#B93mW<@%m%f2HK2&D^hF3yWKUOiMV;;mwpeo<8_^8nGMn80Eu9qQ9S#n9P39-|4QV+Xk4~ zc&d^t=s-qTcXkbc?@g{+>;+ens7K)(4r)xzGMV&qWnzREZI2Za2rt8_yZ$?Vt~)xL zzmOg8=Mr8ca0J@2+zQzw&;Y6Taf7C&rXH6n1xP$q_Pv`%&+IotvtsD;du>udAp>)L zu=Px(=7Y*~3%dyt&fp(_EcaQPb{4)$iUqmi#HKwqd7n*lzPac3|zJ0Xr3&}tt za%R}wwSmK%$`zCSgH9&PJczcLb+4!kK( zpbLRa;QsUph1LjH>0nKe$Z`0(KM39f6n1lvX*IW3S?O&wZYVP^j`sn8=0Tn97PKV#y01RF0h(o8{N zv3OVI@PC)?Z zNo?;h>42?Vw+z+3!=jA-mGbB6;@V{|bB~&~A}C8eoobhqIsVYubxL%t``%NBedH$F zl29R+l51b9rH!6@Gh*#NGQP$0GBc6^fcbtWJkCAy`m>BjS{*%fW!bfOnRH8awU4lF z0HO&3mU*DKOYXHFL?9Q^RbR#KhtERcRK3$NzrE))$fD|!^wycO1ctJ&>WYXj3+ce?UW~^f2P*RxT7Thjv9P@r5PXNj&C0SU}>sGX$n3J`Mk$<8` zqCFUBC`2)3#Xny4+`~57q9r60;XVqJ+KVDgdrp?-(si)X`bCt-jl)~FinnVr66%Ai z0d#Md=@w>gwdJ%lfej>#+zcUS=DFOytn0x=fEVxvnl{7Mr)!rdD()X_j9)F$nf&P4)zwvK`IFK6 zXg2uHJ#T(H^*e#}PJJT5En%edVeGZ#=6}IZ_jJC?krrHBGch$Sv>N(mHg0HU#`p?{ z>}52A>|A3I_8n&C#$*Af{#qZe=2l{6?79E$1!(2{wz<4)A$)!`|9J36xD7_B8{8gZUm-QJBs)28|Y*E0vhC zv9MGvStspIe9p`?-I;4SIy;2W9hCV?B1qD|p zap>tkm~9o^=jCk$({ng4KS6|GCZ?;_BY7<;B3}L3n(X`n0uL}>{P>~rE;hEIwe`xE zFJC-eu9K1iT5N=085tQlcz9ZxLy27$vtf20KYm1UCE^SZ4~MU=a1SQlH+MKYc2P(b zrGiB?yuB^|jq2)9DgpYZPoLx-KbH3P7S<`V!$m#0b3K9U8CI$NbOgTW(Z`1UrGOsD!L0T(@T)lvh;n=<2@jqOh-i!D-rh^R)8B(XRIIZ;H|J@k^-Q zRIx~E5l>oSVagcB$5ubixHFoYr51kw7F{+YAY2jN=8Wd$<=x)dc_1x~0VEV0xX^A= zuzm4)d3pIq@Hu|xWdb$k8?VE{3XPktxVyX8cXV8f6gjvF8w<|;B3(Ap3c3}=IMokp(L`0Og4U%SWMT7+#SHurO>rJv|Q7Rvi5;TQH?e1m!hg&+P2%>yuTQ z`MAM&R1%qrA84cHIG!)a-MV#)d&Ns5K88t&9t@;gW;cW(hXTae1Y7Nl#>LHj-Rod| zz_!kFpBYB~eBw3qO?`Pdmm()Om(!#fQ?JtbnvmOO^PfJk$Rs}dG?-Dj`wl(I2n+&W zOWLITAnc){*%xo<8wzZ4?&5sw!pPP(98S{w>EAzE)$WCxPB6mQ6{@w)SQeM~DjsrN zu+z-e7Cx9}+qb3Pkn=pcr(GnqK3!*sY!VVy8h`#&g}xQZJJ+$06U%Ad zOX)aMkLI}Y<94A*3l^vMkwbJ;6m0~x2=gm^8n%P2Y4+X^LQER@2CSvFN z;I@2wliMQ7&P!T42on>NpeY!i)bIRnX2_d2*F`+{2vAZ61}R!aPeYdn(u4D=B|Z^6 zuh6p@E0Vs&$oN{+=Qso$Av7@X^3Lg>KI{rTwn3{B0*R2B86&#*t`;S+vs-g>bIqoa zB8)Es0)hx6EV#)BGL>kM|Bjmz0)!M4EUn=bOui7*qCb3KU3gxhRce#i4(&xty&s6t z(9q_x^J|GDFcA}=LZrh;Lf1y}!&3duwc*$j-n=>b@v!|#s`qZFgR5(;c?FD%9No!j zQg(yus6YY^1)aaT&xJBs*_di+CBWz; z<7M_EUdh59MZY+!|MUvc)6$A3i}@K$)cWY&(=AnS_w>XHl2FcF2S33;?QE1yzXqq? z88c74hC=$8Brxe@!pU#{?oMPVDlV3WAreG=D%-odtlL*OZlXBtr>d>mlH=oC)2D0#j2{-IqSNSqbyCMNko=q+t6o@$pHKtw%L~5OQ-qp%C+}M$+!L zlKJ(qV$Wwh;LRw&- zU<2Ls#4b*Y+k1L$RJm=DfG;#RH-~`DIBkD%bDDMEB)oCMrEiy~q@=V@j4=AsTh$-U zS<~rK#lh`SQ3TLUFpw^b58YgJYRs`uvWMvJ-&ch#3X_j#3;mg?6sDXm6N*jB7Q!GK z5%M75N@$JO;cKw#S|>~FBmI!>t}bHTQX4|}#`V8{|5o~Bt1$_Mbn*phO-{ zz)rUKqg?_wyJuLd2M!5sQhTL*njv}+?UsL)tci3D-Js8IY(1RzV~4}JZ&2p8WdQgn z>%{A5d)DOiXvgzeYa|W(7o}9Tz^^!N5S)i?v9YmJxXpB}{-I8|41=(U$Un41wFQ&e`*kaj0P<@k!B~m4Ca3SIdrhCd z6B;c#I{G&%Clix2HmTN@mX*#r#6@r2lEPFzo1heORoE*2I$(jg($U^eCD>;G64)qu zLBUELp>GmT#l`(CM)E!&ZjNd`+L?FRpIkdpFG*#7F$LDY=dnfrj$W-d*}%X+K~WJp z%4VvXOnh<1w?Z!hk4kX4B>#1MJSpSj_kj=uE}@2Vv;zd3e%CiPqQ|r8zs$(EjeN4b z?Vymvi;LPbtDO=#_&GeRaX5YV?p^RC*lp_)SEgIHXaxkw?Ck6+KlBJ-*8;?Z%xRL&R)82*G zsBeLKPiWw?ukL*?W)2YN2y{W@yzW8lA0A=TF1n1M<=XROYrTr+7;yey6&5}lY=BW*KUfEFDc4N0yU;1vo5Ia@ka)W-o5Z;oCC5sa@|Gd}!D@+#al z4_iA_>ay|!1A5-t+uOxqP#}I!)YLB1UGDDg?yvE3OBVGZm%zL<9sOmX%-#_7)zQ^T zLgM9AdC{-d1~M`-qrK3>TLOvMS%*i{Vw)0ps1 zGqIeaqKvyc|8Smu7@)9<-d!-SF?VXv$<1$sgOiH4Eg zHxq|W+4O8)?3r=L+uNS|dt1{qko|A+SY3y_lc_7;H!wg5 zj#8PS{PykJ)yYygv$V9dDEYX14}d>Dl9zYs`hY{hi__83p;hZG@Z8A>3P(FVeABeB z3>3%Hc4(UMAWq`7eW{b%8q1>j-lYP-2gUlY5^VdLeG5k7 zKtqBaWi)=04Bm$5hK3rn;xX`CxeZyi9*)9;2M-|F40%4;%7jA>6J8ZrEzaqk?tA=r zeSLjYe4qUV$F8v<(9Cn^B-qPMiP0Lmf*Cq|tf`g}e1 zor17DwEvfh-YVoO5q+x9f%ehK334Bn>VMY-oVRmK#VjgSq%L3-7)~}(iJ11PblVi$I!^g;Mmw3diwgaGczAG4d|n1 zN=6JM9UVCV9i@Bug6}#wIR!va{#9llSzTpzfKU79>XtPEn}a~8RcwX}P#z5h#~IQ-`;_;e#|a4uMlYR+TmTEMx0ZlYR*wPB`6RV{2u}uU1)ec zdD^%2&ktj^0b$Ss^MmYyu&u?eco$o|Yu6fpoX##R1dfi5dc|E-Rf=9fZ#>;YU@@Sn zIE5-^sR0MN${hRc`4Whj-Q7m^_V_R_7ELWJ1Pb1yplE{mF~?$+mX;QL{|*ovHsjRulaVe>&=wctCp@13z?h4e%4$9BBuW8kuWW9YG_wY~6fCaal zl2UMHW@f`Yc5!jBv8ClTdHJp@8&y`A;*YnGAPJ-I4Nv5#XlT3wb_#uO*$+-^nIB~k z0X}qaamg)xjQIjIpz^A!kt0(B2-&fZ)LF}6@P(zNwaGJ?Tn&c%_lY54 zW8gF+KDE{{sj2uSI=Dftq@CA>akH|r!l_-2 zmJhQFr`xK4y-rlRU@Iyr4mCPhTHXyLsB|1YWHyZXh1hUE_O0h73=HWW3i=DnO}CI+ zX|1Z+L!;Fm_iImg<&gkt=(9f*U`IqaaPj>c!QXnOVFE%P8D(WcAS}TUt4;S;hwv*w zY`q}ANM6&HlHw^SD;uejhgiddfAGKeszr`+adFx09E)$R!tZpxc{Y&hF(I#REN_wD zpvS+pVS{|mDBvNy%!s^oA@UAB)*b!Jt1d*XNY3#2^JkG|4den(Me9^-zA_ybt5}Az zkl!dqXIIo)&-n*@0r0S|9U}b%0`)!$>8|I{{9WFl@$Bql(gUfzevbQm!4-)s0d`ji zMJ~gm&9BrBscq0ADyAO++YYol{(pUW_?ClX!l*L0G=jeVYjY((a zO*!R5*rZz%+D+m1-t!PKz#z{1YNp+vWd}wNMw`73xT(jSuBFzNT&3}$(3uBUD3ioQ zLvir&$wD>1|C>5XLSiD1ON>jNLCtG_f0SH?3Z<|+0r304y1EOWaT;V`G4+^3sozVn z!)q%0Fdtg6{G8zpL+>37#T4OCh|hG8CG%?z$Xg?*!a%1TsbU3P3Q_D<)p=Q1u#3(6 zWE2!|P%|TjemoY2$RsZqA5Rf`tf;+3dq%uAaSoyElTxZE3I*K+JxP4?f0t6*05}0f zckesK#=;^XCDqI?1)uB`TI~e?C%7 z2F_rKPb%O+WLY3Sa9R)FgK2a3JwV14`Mf#4ZiC`K?xLx53|9wEaV2tXVn$H*&CM5} zL88dRuRxYe;ISr2ai6|es(F|JU z4s=K!Zo(Hc0znB_c(6vcw2BH5aQ3P5PSBE{b`Vt`uVy3BJWs#s6)}?{l6P=Lulzd! zl_%u%q+&G{znq9dFAw}pe{0=jyd#tP!J_`T5QtGj2;TQSo)I*4EbF?Wd_BaYCtZUsMsMyV!|&Yt4V4fH zQVaneI6FUo$A|ch4yGSCr8}|NDp*?3Ni`0Rrj$Ls;N0))%S$=OTEf8SzjZJq7K z289tbGc$O4zT4T28&GLv{^o*?hXj(k2ai^9-^IuB_=My51Gs0gJh@vXnWzl>Y3ru?A!A!IrAi?+mPjcg25_2HD4+{1^K5&Fohjsre}U%kvJ ztN@d_|LNgFibn}aNo%(93JT4jLOATNs*jG1%?@cAwlG8rzXXvVDnnO*k?}kI#-a8* zb%e5m(b{mXgM&l;xP2Y2y}dms!=PLe!udx>RquAP+!S_qaH6J02CI`PjtE8Ay0Nu& z7&LIHkGq2Y(VZ+nd=-zfzPL{`OiA?bWz-XZM?jssKM0W`LOC2vBrrfCX&Mnt*`7(eEVt0;q`~v?x<4)vmXR0dc4ii(vvw8=E(Pg6BZ}8LjiHn<|B)1J}^) zYyUEKc6LTZM}HbWXlID5Z)&>4s`K5yqC(&m9u*c;=is$WLRcWm|I$^wdKeJoWhNqG zVkjPlLtf!snnm{W%$oaT-NxM9{GNX0bsFz&v^>MQJg;*oHy{oUv@95eWY3}7(QST&p!(|uwW!c*?^xb9wF@Xjf@ z-ZT{aLXhMDkuU%_@WkZg?AjX0bzxs@c#$=rMcrb`#4?;F!LOu3`M-XRbtm>w`{M4E z5oHaHE8#LfzX~Gm`PJ-h7T*&Cje{9adTaWa4hRV3>Q}v}kr!k)^PdO3EEDhOvp|h#mF#JH>YXvj(ir5=DwhI=s z8@LP%9W{o7a)&%pQ@x!s-rne^XFkAX&?;h|r8D&+ATGKVCV8DSKCQZ%l1cGA!qxWD z%-o!};i1R01f(>Q=T2Kj;uoTa)})Ai0y}TmQBpodt^S|UjztY%JQe>g<$QhONJaynrUm;eFjm=HJO7E` zL1y=VzkfXHQ@3Fp3q+V4UP&qt2ciP?i>W`5eSiNRVp;~B^{d*&MjSLKL!HyMi1&SB zVne%}m~MPr96i7y#Lv~3ZQuGJGd_#qkyrXG@yS0U<5@{C$dV`{psPcr73JlFS|f-; zs@V$^9*Coivokk}7E&q%dua^~jeuY7Q0Ky`Ty&&zV+*Q6c`T&F#7K5f_#k)#-Ym2Yhsw<0XqaV4wq`y( zNQN(7ypWTZmxT2}!N6gCloPTk8dgx6^8P;%7Q-{XXoCVlEg&XFHGCZMob}{^8&{%& z<}h$(C^j|&S$v|bj0OS**yJXKCbbTzE~0-Ih!IH@bQ~$5x>4}lBiS{`E?ih6HF!==LPtl(N?Fj{?Q{X7oc~F^Fajk6 zDXG~_Rcl*|z#*;_L~aGVa~;IQ00qVXm8@nU%K%`Y_YV-T#%ur~3LAmv$g> z4vi@S6a~e$db<((-!9Ms(}fC&^%2Db7<~_aBu6A#^^3v_J+_gvNvO>ufmkK$I%t6{ zyNg|%z||3rc-s39?%e#mvAMZsZpwUHB*UFMnBvbqUiJqONrQ!yj0~v@&4Ea@y}OH! zf+9dNzhhdjDWtyInrajTM{k{P|OSS^*mLY$bAk}@BX9vplXeh8{;`enqi zz1zhelaL?>W{)Vnf=f<7LL&40dC`!QCxCXqW2K8uYHHU(%6!_Lzf{H2jfs+aymV71SIxHqQ??kD_PLxweQ(6AvyV@isy^&CmUsnqCSEk2kmW) zALffZy8{ghBO~!` z)Lw7Cf9I|}*%W#d%Nztb%i)jlA|4(dRMi|7+6lj@Wi>*1#sc#1r{72YlK76$&j41> z(#)p@h-(V9f9PU~f+z=TcO&(Z_&13jFe_KrNSRFZjR~^qu!9ZsO$+^)4k;-2!&dyg zqG;XH+NzSJa$7}31thU_s2g!x{s@F>I%(yrF&jqsa|%jIN+>+Q(sgxy(LKuW)X(J; zk9oVg#@d}e-wZFU5jt^&HUj91xLf48va$lg-%pV3-g8?vLSw*ag%gvZ@81k{m*nK+ zduT)-J^uWb=9PtL7hRWra{S~y$a)Zzz8KVa!jlo1-NeMi0=DL%5|UCE>^D*biL@!< z9FTFENIg_S`29j{vI-L50kHQ6_JzYHI-$NiF~rk9T`N`K%Zrg-XD^i@6#?v$gW65BDPw$qBd zxZtXz*SzOu?&aYDmX%gaeiDT|p|E70={zi6^R}=E%Z>4yEeFYR_UuZ)_At+%@s(Jg zsQl`=5ztVhwMl@$K#!=z9y2217!GpPqx-@ygDHkthEdmAP755_`yRP#e3N^+;K8Q% zhLMx=TCqSbe=stF#|*UFz{*rXoBdUSd#6-&w2b+HZy3RgYr4Xu&d3_&I{GQB!EjQ| zR#?$+=IBj$g5=<4!ov3wpAj2qJ*HDZuIGFqxQkrZPz^yIPMCdH>Yt5rs`*ofpH557*96x0qFa|cxBAF$I15k-0`I-VjuPJqJJ^44T!WS&FP)9ad_ zn}cowqpmnsfjD;UqCob#)7`wb8!!(K0)bJJDClc3>rL*c_W1MFuuc@J^$U<7mmrEF zu%qLq*Wu=E0f9si5SFx3^e=$Ve}U$iqvKwmN zE{j9E4y3M5p5R)a6E5f_0frxvooyXa3aJE^+XHlZdwbgmYGU6l23`U;IM|$&myke* zDQAEnu9l?|1YIVopCm944fva8eniJpL^?*~ZhvGtAnlusry{Gk-NTq!42@mwKb6ED z1FJr3MFh;E!PaaTmo`Ud)Iz5@b_zewoNPq<4{3Y<}LP!@V(0v|3 zgV$E|A3PwjOBwM7X@KdWb&R`D0O1SoSTrM`RWSCG#U;RKaF(7si7 z(Hla@08Jj(STu5Id3a)h4y{AYz?BggL&~Oys&8ux24X+EyetQUhK7cs8J!$#KyfD(b`0XQ zh=KbohVRJ+pZp}$!&K8{aFJe|=g*-tgN&3kUU+F{W~LrIqYwP2@yp|+=ii62RD;3j zjEc!20~WUg1%Le*PLsxl=qeFT&I5|?B4n=SmX;tWdO^Z!=NN)Gpy|mJI+`ku-!aEJJpv6W?gA8jIHo%hZHIe% z3(!|*4r)9UA+_WB67OHd$H#|})R&LpTLPj?OiZTSlq%^ZkoXdj`O2m0=q`f9@| z_{gxX@sulDJbnkk!N72DqdjYJ=6v*kuZ%&(0jxUNI9)SgcXSKGq zT?HUIF)@*ohXB`IHzQI)!opz=m$oHDfA%-mcy2 z;cRY}SH<`4cW=z8tkZFwc59oM%)ycxCu_KS-8}yM3!e+`5)zs-mT&&}@pC&zEfgXY z$w@*B3H^O8E`En?Om%POpOr(VEj(|KkU2rmyejNna(qZ#b}T$k^EE6%MlR5|GjO;gXV4 zy+AU+T}!q+HofpVje8|w!cvTkw~-|J-wC&2M$yDXrErjKmtbXiIi$*KC5?>*v5W>+ zdDZ;#vev(w465Ru4BkdudI9f-Cht#ceB|feu8P2Rh((ozO*n-^Wj;Co*45{#~ zuBkx-s{SO87rHAYMvBVH%$q|9p}7x@!(~-X6e_6_J-McB5zsQyw)+=qoJb=rlzLRF zTx}^SDWQ0*mKTMrVwbjfWn~@Y8xSe2{|a~=PWs4z~J1JX$bTd6Xl$65*V48v5LpK&(BWA01p9|N>E_Twnp4xBGSfHkOCx+004c9 zW4~8d-`kIGSk;{Fb|GLC)Sa2%Sq>mG$WMb3TI~JzIp8Sw#aPYJQdYguk=Vqyo}eGMBs9a^hUfIRw%HhGmvM)+N;6X!_VO$E{?jd_Xgit&VgvL1=X~dU>pN$!wb$Cac%J`o55H^pT{rad;>-=(F-S9% znkK?aQN~_F?NL#K@1Y76wq$|od^%jv6Wiw>uriBfD@^1X`_j@9DpmovAcb#}QiKMX%~CiV zHtf@P{8>UmpGeman9dUtI1e8_3>VG)RqMCE)+tzV>(;F?jXZeKQ_Wj~0eHJj#;2$I z@a*q|mk88Ie1NZxCnoO66JoQ``}jZ?)@%^OZRI=!U}r3gh>0{$+1j~6PJW^OjtdOZ zhpH-{CVM$qSy@s$VA&%wGUyR~Jmd@$`~JE+a2`Cw!>Wbi(_0f` zDY|M&6@&jNNCXJRe%OG?m;v&w>Wgvnh3t*L;F?OlitOPO2>Uxktaig%rw?0fs>QdtGeVkVk;uLBXYG$GT{leI zc4FR+%04xzOdm`Ti>2j=xGQy)_S5+Ihtbi#adCS9mf%F zH(HF8#Y9DW-g{>e@FK>C=i#51;>>k?I}vhVi2|J|jr{{2zDPXYpovsm`thZP;rY#L zKV{e$iDA^#)su0OVM#Z;%9Vws$1C%9sofgeRc;70QD0XlCoj+Y^DS90ufTM^x30d< z`>CD(JvonpsG_3yf7ep^)29n{tp0%@+=0`(|2yQOe0pDb$n^UgCE{nh+3M<3ww@|G znWT}S{`u)|(DSgXD@jN2Sx3Lxn@c|#Dgsh=3Y#3A2}{}GBgRh3{41s>{Gho&kbxsSYvTn%&8g3or3Y8o9f? z0|NG}_7F#LTr5OL^iq%gr~`2)mA!&o&d%ph_8W*t^#g(D2p z|7@Ru{Hv+4^?e`KV!~n<@xVCXH*7igQRnf40v+#8@06HchAh_0%Kz^$$^QV- zsNmuK0YScT9&vwgP)R{SuD*;uN^_WZI1ZHIO zz&d;apGARMY6NEw$eDGds`g`1^xn?1X5&Uf>{dl3B`L7Z!jP4Z-jBba!kv0*FBBKqm75wM5J|J)!NOB#oQia=_+J(-EYq z#dhe>LjXJc1`YA`p~J%v7A3)}pB~FC|E}H5toNcfA`ttu+KO)NrwIw$=;;k+&4eO6 zeSKH!0175Hr9)^deC@P!UMX{fK*|nH3E0Dk&$hf~;uGK8XurHGu9;Mmc(Y9t8&no95|@yDdq8 z@u>_yvi`keU^-?2_WJ-_EtM7MG7!bj0ayy$M98XUpTCc-uDJMVetp_1<4=#N;1OfQ zOM8Ona^cmbEzoUn^SF=?wYC1R^buJ(T*%xD+b98?zc4z>mp|L^-=n+Km0Ip@3*T7*`<0V4M6m;}fj0@|BX)BDCvdTxA|jy> z)zp(rCq_qO;n9b`;MZVE4fxs*DBmoyEa4%e+OL@@Xiy$V${gbRbcc1I4!upd;PrVa zWOZFvwvX-YsepYzb=QE@cU7b$k8_uz52O&rS5I$mP`>w3lJxvM|M!IhAj=NML`6m2 zjF1&sul)Cgwutt(1`5Ei=^7O&ed1`}kdTldrRPn13!|8QHRa`3P*UB#dzT;PRxZ^f zv$YQ$uU)^+!NwMwpV9XeNPPi|259s!=yCPfZ(f>W&fcfHt0)s+pwj^~f2HvDT3i~H zu+j+J8etIJ?(!RyZ)Rq$!kxgD(1okauZlS1I@`klR8|7>>yNsp-Uf@xPvv#_Ni#*) zn-Ug1)EpY`t*8RZilAYmvVGGd7xfN(1m)oQW-wn5hn?2f*M}M}Qxh$Tg|ZW{vBO`M zrJ%lEpwV~)kJ|4TJYt|7i;-;kSwSf&cRJwAqIAqkm&B9Az*l9L|w2> zvK=%HmZ#@xDf>{O8et;9Z}81}+y^%)cP<6+ltLW4D51%sg;nbN&!6&OZ+rI|IcN0`FyeKPKF<5$C!u+N`A@2U{CXqCf?j8$u&lvFgX zs7J&g8l^uT^ysf&r8ck7VM0D9tJt!yVevHxdpv?-czDcJes6+>B0C*@>EdebWZ5l) zv`gnr&sOvf4w_|Dzj?egJDIg}YHG@{x&jgqTyQRp+}gP=N$5ikDi=Q5n|?-Dzs3@# z9kZ4+A3r$oeSiKQwii8jd1h;C=D9}Uy`#=o&|g5~hso#X{v&aLqzo9o=*fbgpzkrB z5cgj^WJ@;VF2j^Y7J{cr7r);W+X|oWsm~eX8hO!jaBmo$d~v z8;<(?{Bl6$Z!4wvjGdcK-_PE)t)jo)O*t!#4^@6ahgN3(PCfEnOT54L{4%f}zXmLw zubyq+#FyNaBm4d48vhX9Vym8Vm1e2h%=iSd#3^?Jn>{~Uu=dwu6BSla!;cQ;XYKIl zzTu|W-4l8#Ny{hUT-<67NkU?7iMTppMcs8JdGofNs%Cnvjco7-2Gl1kcX!?!2${G* zzTE6@{CK1UqdXM8H=py8kLh3dENap?#nW$0o>bud=65$pZFcb8$iQaD#gki+KKrLQ z*?O+IDri910z~$_*ztWF9J*F~n*Y?G2ezP0^YlDbtURB)(cjP}oaH-_=rMu=(yelFkXc(N?=tn?e9vS4#r&*swV{31pj7ePv9*W>w}89;89u#1%q_8}t4rpE zvb|l9dzpS=K>-!by-2r%uxrEGd=|tXmgAA2yfIt34BlP=oIQP86O+tvgLvI7sCEu>djR{p<>s$ zVqE8pV|yEb1Hnq`&AOoTk9aJg+`rJw5(3~rM;@1IDS4%DIAm#LTiP!LxO^xYxT!7h z>qXe$dZ`WF%)5;ax^3VL=@LJiY2G3PXu=~6OU}F04UGJI+tY5DXlB}af=UyBzYI-z z8;)Y1eQ`NG>C3qI^`CTL51s+aq88E>if97Rzyh%sf^0yU{&ht%^q+vtw4Ap$;+r+$ zT$ZF;l^-fK-Y@)w+S_O-b!BO0l+{v$TsjF#s{9evJ?-DSi#Z{6ngkS^G&q^fDmX-*z;b04q zsrfAn?QfDezH!Gl&t(?Tk~Z^%LlJdqzna_*npd^V9Ui~ewdo-Ri!fSiE=y$*9?H&~ z0<9-h!jT_a*i*=9#3ToCa5C*3=0a2M4RKvvUE*nV$NZ-_P5dYTFYExTN`HHvGzbnu zFrlDH`0yhfviDCbDH);I#s19JcnQs)L<@t#nTu!^a-MG-ArRShRB(9gm>*j)Wg%{$ z7R|i-gOXNv^OwEq(oL@~_0?wCThiWL{&t}4weB%c^4>W)k`QJM%L5MphexAxa1?&} zYjYFE*q+zD3JMKfa}@iW@z+Ds3kix5AF*kMqIRX+n42IQo@ySTH>G>02Ke|gFuAW< zbjaIczrem}XU)b(e$r~JrH(7DFC@DK*yhY6Pm7~<7_0H?1=7Caj!gzUXAMO29irBI zVQJ$O5(?IKTMQx~ePqNBwGUdos#UnTxxLZqMyzZKXR}qXl%r5hb+Nm4t<1&(+sS{W zwKiyuP?Jj$Hwf6=uP!!yS?{e!_dq}vzuxT2;PYP(oV1BvH0O|%lq}gIi#i%hF!pj? zIL;4VdhHG}V>2CHVBZ|d@u%R!z*-<+4VS~I6n*fsM6_csBQy^4*mPi^GeCJgmnC^&j5i`K(QdJP*US+*_xBZzHWPenL64Ek#-Q)) z?fr;u^Ao7mNV(A1C@kAPC>|dd7x&_9ECFTUIv;}Ve(NyWrSUGyw!iQmtE(I^&ebn} z)1webk6f|*5-_R`+C0j3($X+GHPs8xdM|82B{emEkZ86qek8;p-6K*ieF$RY);9Qf z``vBkJh_W3$&#rlDIb!r(Hp*Uq4$t&+cd>1KP$P}1t^1d$07H7EKX}E9tHW}Rmh|r zPyB+awZg6OZx!!NQZw!lo!xiY8|H!d2Ago%;(pj6-4&}n*koe{?|DjtJ|UM61_31( zjXUTTX#DzMeF%jCo~^y?8M&_3BU#wh4r;eEaY*`Ic_ZM!Fx0ZDwKj8KfG7555S$}3 z8w3gaE%V$e;Pby;08nwhzP=(NBCjpmrO>%|-^YjNm%j|Qec0>F?Necagf1WM zg1y4gzghu%RgwBSe<3Z`zV?)^>UtvBC140>1)Q*v9lRl*@H^^^GnL?L=)Z7>iu-; z1~Yp_AkQ(_EdP;(=W>|b?#c#E2$HQ-z9^=1%jf4>IhRb@ z8`<7oI3UjSdHQ=1>m6t9clg56#jY98(|kFchc*~(L(C2>{Qtj+?{GK*!}(cGOP}V|0YOM|9M8Gnl=!wbgUB0n)p*q zcb+v%cx^eEe_M_MeC~3?yRS=`Ok0{V)DyqiBRa|d8{rn);2*74%y*;jAGMd6hQ|5N z??wMF3ckm#(P>Hvhko&%+RC^+z{puqnr{V-#2JKpdFeUeTDKe^ zly^T>s#BDT`W0Lx4XD-Bes#TG@X&{G1D$|S$hJWC0hYg0ptJwyfp!w1aW5cXTUGcG z?$_<`I$PP=#zR+3PjtkBPc%~WZU*{g`r0=b`DhUHuyiVcht~=7sTD3YX>?)t^g(qrKK7q z=UpGT2$YQ8|5Y$;a6q;NLkpM7x})H8usrSEz1tnuET8Ak_bd271-tm_(qHIdL+nTw zI-U25iq85@ss3eCm1Z}jUXkXyyf`g7Wv&bR%r-i@Z8zC9$J1aRF5ZWVNTMIg7L z?!|ddklKWgx0&F%>PA=}gK|2e1A~(&wQs+Xu!o4<)32{=@E31j)|+pR6LqzFC2rR; z2^xR|63)O-utUgf2VAe;v6u!=;nMInJ<9ao9?ZJ-eKi_zSLEySUxSMVO~kW6%d_xK z&w%-WZO19L8Frs?yu24Ew+YokEJRr8u;ce!a>Hjr2oL0pcDO|peI#@g3CwhQQ$3>7fiNcslWZ$J2$=o9U^-+tb3$;wy(Bw;nyed^ii zutLD7DpUrchxP8Ne8>Ckz;=fZI#^No;R86pXHb*~H--(4@bWlbg4`n{{VwU{*-iQ8 z(EXxpSQsS5m-!u}v*-jcXZ zym9n>}m7RZQqCx>dC5vVQo)#N4 z+F}>}a9&CBdduQ9=%8p#K-*se+T9`al>NLxwwSc@uh_k zfZ%AtdkoG-VzxWrVx#Hj=UdQ-jl6}Wv>~t%saS($^G)jF*W#a|qJRT%=9Y4Mj zn_JB_>eE2%SeWA6mY49@Z=#p9`x5BlIceX*>LcPu4bv0wni0kU*m~~A8;DmQAgNTN zpY00lF9qfd3OlvHm16y^|V(0ddX zX1w-rQ=_PpgF|;F?;$?aD~F(uTX&BqGYMN%g6IMPBpaLF*^q%e2c{0+-te46EVb`U zG+;=81X6{UjE(?E^Y>t+?rT{_O#sS+D!rW*1V}f!Rp7nawsmV^)<~`b#7{@?g^A&D z7>Zv%N;-xTmW@H%#UJi(n0pwpmVX3ad>STJpd0wK)}l4kZt&|($TbHK9&8-na2{?O z5K8#UUi7n*)<;2$)=;d9-_jPrMD1Z?y9pnWe{k?e;3hS6>!Q;C*wiFiBPuQ`x`lzE z1fL5*sh9_KHjAG!dRh_w)2F_=Lpp$jm4Bo|tx|0C6IS$5Mo$1T_9>daZkw_TgtdSo$s z%*+(LFKTWylJl1cY(%Yg8iYR;;j@Y_I!7;#63&~Hra7htoj1mp}@ zd0=qdgJdB+s9^b3_5HBLl&9EXjVE~6YJ7DFmYpxw=DNClPP1bM6_X*L$b)5PTdTE| zIGvrG#)uPTAURKcN;3_Hn=x3E4(k@KtdKxMgI?3rttnZM?~GVxl9G}r;FEdU7s*uR zsQKem{MA_et$Hk@U{@P+^=tcaw+@G?o$&c4o$uIbN_i9zfD@HsU1rBJRw&|8<0%F5 zX-k!i0R$bgXcfWm^#VBn2f+`UtSK`!H8qVKCwhDPX_=fC9MDv--S3i}0lb85a~&ST zhqAH*jbiu|5SOh}&vn3$K`90yeYj-Or=ju)iW0aGU=*>);#uVgW9xI+vwR~W!59`n zizeW;F{A172yTUfcr!LD2>9P?q8)W+2fr3Uz?r(dS-iA61z9 zu@-(Q;umPq3e9L6;@*R}vND(puvF>x*FBw`;{Kstack;cPR@;+^YW+}hM9}4^{Tu- zG}CkK#$icHN)^VR#f?L<@7%j*gAg6ip{EFKnR>+R>siY*6mE|0bhG_tq=d_GGl;3q z`ZvnHfB*WfU4!)hm;;^u2j0S=q_#`rW5L@`93det zTi(QSD2?R3oE+gg-Zs>MVZc5%9bex>{^Ng_E%9Fo(B}1*qrIPPt7AOBJIU~4q+~P? zq4VxW>3To;)k(!1){Ei(;jUU~;nDZ24D|Ki{%rZStBKjSEHKz8=Au$VUyMidX8V3I zh2FuA$?44R-DWA;m;JZCGp%4X({>IVXnf$9rkd1S@ULi!m#>~u-rkFRi`pW7W)!DRL*u7si(eF z;27a|oN`Rl=6=hc;*hYMzL3_x$?nx+l$+(QGd(|nYSMH9ET7!wJ{7+=VpcZc-ugj% zQ}>ncx5wyv_j`Vg6g?8oq`11PB zJAW-dZolt4J9SE_;x%mEFAod9x0TXjQ!YAbW~~^1fMWyDOGV#t*Uf;c3uLFA!Gw4jicldqE=EE2jBm#nAy)2)4H$)@8v zXB5+2mQ3AkZQu5JKczNq$UGBU5{gO#wQz6@(7!bnyC*Gc{O2R9EMJw$)pX}u#tts` z2&(EOQ9IJef$}`}GdS<41*d>O%B9}R4prGOey^DuZ2UHKvxU7HZ z=Ke}K<<^%;;#@`bMykHH?2Pv{f9haqKm(VFyNwU1dh7q>hDgBF}ter z4b|#utnuhog=*0S`(Zb1ID2_`Moa@w?B$HmzI0t^0?W)kYOB57w7ITrksGpHRH??2 z(UVFDLF{XwS87v@&qIF5hZpkuX9f9gy0D1>h=#ymO#)g8zXOEazIIJw4 zeSIZx_`|PA8Y%IaR8W5kvA2f7M6NlkIV&!f-KTVshn7mGjWfd2PeFggxBkS|-Bd_D zIF7>o2eQ-9j}d1-(nbRKHnXr)8^zo>2}GEv{;ms@P4FZ#{i>0^g|C34q^;+oS1Y5Q zG8e1g%+1QmgCO#Xe@HEVY>TC1yR1aDy#C?x4}DGdN<%cA!dSlA<7Qv9voCrjY_L-S z%@^U5h#XGAb`cLjj)K6C2Y6AW$qurd!*?IyOIdb2Agnjze@Ag7-=7xbe0 z{Py>b7x)+SZT(lv5!WnAF0u^*4RIbg;0Z?ndUk5?>@ol`DJ6caoLpR9sNfC(Ey7<@ zgQvlWFcVmVkjip%V!{@IZt{N&zA!O?X}OC#B%3)Y0sue2j}e50J@Z4PQ#c8LbLFtHMMzWuwZvFXVl(hCmeGDa1BtbHTAZz*9Y zV&Dxe!kx;Zf<2|6@Et-{@D%YM$+F%E#Ev&!xSkI$a3je1E{{!8I;b9qE_oqIW0p7V zY_$h&MkeDCfDd0zgYc8AsFlQs4PM6qC(fgy1u`g)Z)@q$!`0ZO1 zNK^Xvvp3$se!${9c$i=YsFyQHADQV-h5pAKG~b6{3@ zSQ*T`J7BBwd+S*zDN_b5cnRPGMk^7C+ktKF7$u@&qv!z6!oTi~7D>1jeoajo z0;Irl@EtNTUNaS%BVtjoiinAg;gM`(X7&NO4D}HNUB}O#MeUa-KgHCW(jcjE!)Xn zhyU0cb|_E{B`6d?LqcVv&IeIX@+pBYO7L6&G(jY9%E#(p-0+GKH}CSmpK9pRqJ;_2`9LgOsMf^{6WhcH3V;X-|qqaF$Rp!Vc@LrXWoXyle=B%55wxXGjsD z!M6aTL?^TwxZtn0Ws6ElNdW~>tE#G^dK1MJ5GTirgy<)5{$)?pDNrD7*CB)y%Hk?w zc0uI{(`~fRWRmOkDt7a z(Lii|s2t1jgeyS|TZ$&KZA!ZA(VZx}TiR_vc4^^z7xNblpf=Q=SR=i#jHcN1ok8mB zd(2gU1K3l0XO_)`;%c#{RcM;~$(_qQBG=}$(z?pt`D<#|C+5Z>h!&VR-;qpKTwTpu z(moGDHF)GU06{IxJ2H(`QlB0sqPl#ak>MX0cpQiX1`*()2N*cDcsvTMkbD^H@#-Lz z^s5_WaEgk2ZP|CcS-hKNpSawdq{bb?#GjYW=o;zk_crA{$20f9OXf#aOq?=d{07gJ zpRU8pK!d~>BHG4Lr=NXxn(-&NW*r`E(tyQf<>hZb6LlWa8w>+)Kozjun5dO#yfK{7 zM}w+Rk&=rkl&1ueN)ktq4??J*E};Qidtnmuu>C|E;5yhpv^t)`^m z(gahz>kc!~JLad)RHY=p({dg<0uuuy6=6RUOoCt#+6eKf0nC7Jl*UhDOfGf+?t(xh z|6y}KOr#{N_*j?Y@Z7M=)Wf+!`VO&Z9Bki)2FwnuIe`0*V4yww@*)q@5tG1?g7yB7 z3158V7 z-9^CWvr{dWqX@T%50wuWXS)%e$UU zuvn~Vvhykt|C~243VoAN+EoI@gcMd0BSf*GF*FEZ5otsZ@CK2MjB(m?i7z>W3PiwY zF@yFmd?&SV&FLFRaE2|ELKsev1tmze;9+}%3Pl553)tPaW2Jv^au4LIXP}hqb8fH~ z7yJYLgqQCzGX$Al^NgHZl<-`8U^aK^)7k2vImN#_&y}4W94}J>>jFmyl!0OGG;D7$ zIbfn6MK2r3imGwJ&cuO9bmm~i9auj{MUU#7H9I#j&bhkVVd-0U%w}&nd|&ji1HB_DAjQ^gIVDnv#X( z+?<{E^Wtb#{|lD_fuly)YDon+6bl11*4Elk_Tr&GO$K-5W@Er-y|wLE#-k+^rS0FO zCvQpU?Xh?kDU}s4j*>1HP!$*5VXybkat+r1C6i}kWR@u2L*iHoYoEtn9G`ul1Q zI?s2_b8%HSqh||@*Z)AeFigox*_O2TjdcO<8CG#6!;2S_rj+gMKEE0`ktZyEHt9)L z;xi8AD{w`tO%7T34sI;bm#;|iGwOLOA$^FFcT&YnLfrpR`u{X~+Z=|0V*1VSe2yIl zmjmP25CbFAhx`Piw=UBnks1>dY#DhsgbX>{mW0E_HgM_XAE}Xg@l5cpZB$j^@`KNN zT7aMEG@6>idt$PYk4O9_05$1QqDDzpqJcoUSDr1 zK58EIFv{5B7)0+}(w;UV&E?ngBiBkjHPK#GZ{Oa%I)`?^znS+^4AUtxy!s>SMt-+? zD<;90=XBbIV`3_vv2Gfj%hEI#B)8eSEaRa2N&1KI6TRFUb@lvc%T0Q;>X}6BtgXr&OkhfSpeYC&F!$TTZEnjq>gvXFT@|~v0>B|c!zOJR zh|Z!%jbsSh7BS0p3=Alsyq0$eW?wa5qjZmPVdCJ&+-!=CiBmMy*f7-c!d_?Sxy&3BRC0s5Sh3ywN+MlA|I%82B-I{V7!AS$s z3>Zd6gh_yMet;$pVlH!CsH*>o`rimXQY2G*0^&YGBN}`fOL%g%FsT7+d_=Mm1#-h7 z3VOWPfn$W9g$VEckg9wiH97dNz*a|id5~Oa=G~OzH2FJG8%JzU9fUKKqJ#34v@sIv zYqHy-_vg8YME8X(TYq8vFc+3 zTD6pm7RZq0`MhO4vPr;Q2)h1qGi;+IWoKW&i?7o`tOA}qQQ#uHEW12Zhj%+ zFke*-{qE)3vP?=?6=Vb&8XDTw)HRaRyC@-i+PuG(laXccfK@sgEGN+$W@Xht7vnOF zuxAn%D(Y4n=qMe%=aykI_|@h-GKzYG`nAayE;8B>aY}M%Z5G-VRP2WE6Q3Y65o6CE zAq%cuki%4TA|tvV?vmfEN9-opbn+4(&SxpcAKJydYb0hfBP2dNyXVRrBUzW~>+3}k z7KGwdw=Vt^ngkESk%=c%iaP6R?UPl&W>o*Rhqe~HRjOO=;X%U`obUO)Gpy!l=G zQZxJh{p-3;obb8AAn5gc|Hu8F1x&?T6$WcfvxJT(_k??MY~Sj`QM6T@eg6*A3lCP& zZ*V#ybcKz}G;SU5_0DM;X(9F#7q=*mxklgX8y!3#U?eFp9t}}Vn=^FsUoQaA9S;aX z+~)=`%8vjCfKlX!BJViRgM!^9?HUOJ0x6Mr;H`OXG4S+!2dqa`cnt|M`T6b`iUPP# zbW5EFdO8MV1FfumccZHJMU~k?=+6A|}KFC~*poy9cy1CJuof4!Bp)n2wU? zB(%7%Zw=OiZ=;a21@PX{!PVAmzpstuynx&Mj(p9nv&ge$ahvXb8p{aGTg`Sy+6LxKBhS7}9NQ zY)H%iBL6>rJn5W3h85NV$B7?Xv{z3v^OTA0Kszt#6~#2sH8VR6)L;zF3QJ81eAM_u_&(JjP;TmO ztwfAQ0ABv?K2dJ;2*JWXRyS6MUMk|HhR%NS9Rj0Q9Xoc6T(bPrx@SGZ!=zn@e51&NOj zzNT=jyK@Uv2{KuxYAPz$yAx~(iRX~xm_D4;m8j3wDNcjIYF-44zn_v~Qx+At*)ku4 zo9HBW@7`^$sjRA6yJpQ}SXa>hI}XlZ>&~6tGO_z#)BGx~nVg(FeB=n}GzWS$-r0=j z>ohg^;#-nP&j}?ZKP;|WcI~Rf0*t3pP|!Kq*06hNA$rr^n30>U?>gz`7i#jxuF-5@ zD#CQ@$5{#Jcl_GiY|=y~YO6O)tUfozC%*_}{wPSwfD zkuzy~LL_~VFq_xQ3rXw-jB&!5lHG#02*ht`xjgS8kJ6a*i(shDrrBFt%RE&^K>7y2 z;?tnrpeU?^wX`{Q6j}lR`>miLmFOGjMJlbXeumW%Cq9r9M}P(1q^81(woj}NY*FZb zpX<$9YA4f&ViIbvk~rh1%7j0|9h3lOjF};)qZCS?)wOE{@K(a1#vEv6@R7S!yF803qWmBEaY-W=wsj4OdT7n2aMK^o-O={7c@H?8xSgH#!l)$v( zE{t2!cra9-Vp@njZOnGGfr+F7&*~H$(g2`9;>OOaw7(3bDrA^PY%W&e8u7HXt#<5@ z`E>XEh13J8KkSrP_VqStsgh)xy1GZ;Y^+AwBm?C+u#UoSc&MFwDk(pt$~@TtRkKvpsgL_;(VKvty3>oqesM{{J!=g$*C zV|+_emE~cdIu=a^zu5(cF6Rxe2Sz#7{q(AYY-X;tI=1^&$m_d>tAB%#WSC&b%>p7L zAHYurkcQ+hCc&#Pr-}MZK(;FeHhd?^0dW$yz|>sBmcUSqc59pQNY-tn^N1+Z+xDIQ zH0AI^S?jc-B0S(a@HoED%$*|-J(%?~$6$i#g_kM^w3T*tFN7;%Nz|3rjO(Gft}QN! zq%H!4Vc>Uw^TRt^3u`^eL?;X<@)$t?si$6zJ?})qxlr$*`e1mfd;*N@+@!v-Dahyge{JLag}^{V!2 zY7E2YPYm(zdkl~=jl?_>3jghl%)$#Zb=Q^Gt(mBoW~rX_x@p*lF*0peT-zb{YuQ1) zw1y@4onVhgl26#23Lh=)c;n>HctN2=ky|gq4pV=0{Utxk{nJTNPL2dY?}<|#S*xg^ zu;<7Tm3a;8Q;tD){l#gD_X}G+GZnnlHJ$#7-z-BX3r{2n^e)t{BzX-HV(C#FqpRt+ z9}m9$XbtML&v00ZEF|px5gf+1OVVCxh z|6tP!!*$}!h0QWXTaT~%{g+XvHX|Are`vdpJP!Qjr~j=#6d(Ug{@-uZyQ;JQ-!JvK zc~j<=+&|YVz7~(2TuSv`9Lh_sS4_ZR8_l;guE58W37%dq7dqyCzDw*MbyS#h?VQ^8 zh~f7SSzhv_@o%|!$9kzqal6GrB-6&A^{u^AlQgd)r}s29eX_Kzz1a0`584m1De#RZ1V` zAS8`M!5p{4JwARf(T;k``IeI?IG+dm|9)GND1oN_AhVCZU%`Jj0Nhv{V z)OJTHa8(r0t|rm~!oo&q7iu;@UMNh{NS(zNL83HBb2R=ApNr%~Z|r>pwUPoBh3C5p zl%1qfB9%BAB5|fl6$+d~f`Z*}t?gi9B2^s9+l@!9t@*+Bb->MYNnL#mwFsz(RCg9c1t%Mc>z_AgbiR6SQocOo~W&X#JKqXKN6KEI$0?6D!g#y$9VwlAClIB*l9qK_<0&AB& zv3#0LX*WL0RL(lnPjfCY;K;YIj9l(^&G?Xt11uptPQZun5Qn2YgK_#Yv09@4K&>ql>qKSsHRr$zeKzT%v9mgvlbfu$W!DdrYISF*#KmvhvNyrb^HOC9oiZ z*q{>4@kUx68~U6ukf{&3%=~gGfdJ=pvxN6@+Cl8wl-ArE5vW&9IERm(p$v3)7hxDt z4hac0B;f=sLqvC=o&ks`BPyx=2n&->@6*2cv-^>W#sjj4gNMfl^WrV6d$6^=+E9m6 z2Pzu1mq(+35`X0_FZzKV&z_iB^)v)b#>&$E3?FZA>c?2=9Mgma1y@?%Z9+#ja?Yet zu@FxWZoclB;?Ah?-MF{=c}ezTVR8U+NCqM9G&SfU2!WL@Or zvA4QkG3Rv9jWzVnB@9dnsS=5s8HuJ$K6i0WLAGrkN)s$!h@PUhUQthob%?*9+GlY- z*jcV1!nVUyNXN~WT;ANwgosc8+2B5vQyDepD~LP4tE&(;&9$_&MQFnzYAy_=!r}kC z1jp=@yh{Q&)(!UjG6YOy;DrNu0y~~)*`tO=SQLr)Vm-+DtvSvN?%>ej-BW%gh&2)o zvTW#9{*9TA;4w5#HRL=esI$3`5o+csd3h&eF=RHAzzD=jk;8J(D+>g*3F84ZWo&YC z4Fq8l;WX2}yhJcFa+t{|Y}Psh2pBElh#|Ow$!A}?^)<{OnBmHy;=ny8L^ukR_|39w z&=zzFzG&Ew19>h7L->wE&UAe}w;hg1VY@vuz&#pWik&p$#$thj_PEXb9QEIgX}k*} zUtW?1^@~XwWmryA17yO5EvsQ+eU7{g3Nguoz97efU=F@{bC_7^yiSV?@5ad2g9?q5 zB5h|El%5ll>wOb(>q^j!h(M3sq6FtM96Ri(V49_YveV!yh11oBx?{;i zh0}5jtJ5~rw3r@fNv*XQ7#yqwY9(=B5Ljn}z4uIKV}q%{pOFMv`KOOyL3x6+m=5vt zlc+>e|KsX#E(NM^6oaXkjLD+YHS*WU)X;M?=XnzjyL|JPGP6D1iYJ$|elhs=EnV?B z|5BZAv6!jUaj^8A80daUc=y3D!8^VbTjvy7>Y4 zkW7|TRf19Y=Iz_M*!0=Y?Jv8Wxr_^lB}6 z7|bC%kLL!Yq!dROT)85HjjYX1h?EzjoKq-cxBuSLMtJ{oF&3~JH7I`Y$LW77Hi7?( zAKJ@tWO7nVXsPMuc8(wh@_TE}c?o63+(=y1=DzRpt>|~DQ554>S9JVt%0GqQ@P8D3 z|Ifbbf9it%iyxwu=Z?J{s&D7wc58rP1WCD3mN~i6EQ=+XwW(j67p#8@TWDk|{>T!u|Mb{r@*lfa(+D*64m_IHT15s(9j%GuA(M-~MCaDe;*hFE8~;EZKf^at&Iz*|{`@V(oHOSTzrQu-QnY+ed7ka?#@cglW@4hXy6tLc9#TST zWP?sl$rGO~b_|?_l0Ee5zWpU9^?lCiF&`}3MShB^aNB0}QOmhMAMkSs4)pSWGvT#n zRLrYIiz+oqB5b{pMctFAV+XnilTS1kN#_+MoO(Kbx_g@n``nyUbB~eI`HZDJXU888A@EiHx)? z5}{aBL$10OX_wT`7{w<=~|h`(43ev@ac7Z05Hg)(-RluIbMU>g)!=}|nRoDZX-s&1WHav3d4cgfq|*Zcf6 z<*oeWIx%K(xNvbHXq_pCW3?a0YJ!ab%v87>EbjqV43Lg%za5(Y+4jVB^c|zZZb3T# z;dzRG_RK`OhPT5pt?t5w4(_Ggb=-QEnS+wr!}i0ir{Hh6gqWqBisLw0z%yA{D`vU6 z&CYQ->ws!Q_Jl`iRXb8rXWLIHRp~2hOE*-uhj6;Pbde^2Jp%1)vK{Sc6N8iGiy1u zfzM5q45Xm*glG{*I}J`gRVL{&IAWn6&TdkU507_UcSMC}&PPI!XHd87z%gHF9qmRR z6P3=)ugEQ)Y{%|yrVm=)!thR=L`#A%2Qz66@DdU|Pr?)dJy7j#fZ6IhuA73U84uF& zN@|_E8=2*y7e1`7@V~s|;o$)*LOh-xR4@Oqu(d~FVnWII1b^}X_C(aNLr)#IJlPE^ z5eXOs#Wx1S9fY~nbgn~p?%W|TfOP+&G6i3L?q*39&oqv4MNFFwBEEJfw4#a+LXBUS ztSt?-+`W-+8(~J!3Q96I!D;7~3T+`Kk7lusS*_wH%~waK0-ZL`&gO~LjeW?ZV0Mlz z7J4|YkZT`GW;rTz=9r$YZUHmHUjuSv{r1WyW7MK|CNV@@5cf~K zBdDvcj=U!YBRq_777$e}_Sn5K^exmOsuD%)%5K3|XhcasWGJ3WUr?UX=#-$TW`uv6 z+v$Vre~GJIq1u~|4^V?6ku-9VOe-i>vq_x@3yYSV*Lyz?2t{GzTE*w8^u8#Rt07e!)*IPGle#}GtP~bC^_>d6^WNOQxuz^tY7(Lw3 zcDFmW!E#FSMka>8MGzJqg|Yx@BpiSQ%!7{YZRk-LuYtU1QZWb(&k+q_WZ(t?&I&p5&d6WACc@jt4|Cx&cFp$)C78SFb*yEnz-gZ~K!KO_U9C4T39bRX4iI=7i!d}F z*|^%xn>QZ?34_JzFX~f((N$i#yokcPf9K9B zs0buBU}jV=uso9SC$e%5yw;_qrH#j^ppXC+yl-pVlgzm5(t;y89mu*5D*nsVEmBZo zOS>9VCWa##vC5EV2{8>b`6_&gfEqZ|%p0AU==9G+3QGyJf6Bi;Mw}pyb5y{eTpAp? z0Prc|5|yO^fJ4C^EsM@f%%tP7XXzY=P{aE{irTtkha4yt6s%l_s<6xpAO#Z3;tOmr z&;dAMYKFOu#F3&6323|+U>tBX*Dj1g4&}yg9>b?K?JH!xeiYh0xjtn4@g-UowTxeE zQ+T*j?#$Al^O@i=8^D ztgRh`R2TCMNCkR`hs0@(AlKa?j-BZ{u;hw!3xIurHaV2~5cItgp6H_1)=1DO7!B|y z?0{S33Rgg_4I zHpE5@iV}`lW(5TWgqq7B!X2}L1BW-jD&L%Dt^hR|9dsMvYUMb1@N`Sc=t6ub#BRJ; z?0X~}sJZW?H9AN@cvxYMx0}sYg$rR z$X+Axkg!=t{S8)IJ8@YKp0qpsuNR;#du?}M0A?k<=?cYj>zoV)L_~H#m?6GFoESt- z%S5SzbP~ztyQ3!%Awb3+2u{-LfGr5-%>;{Yk+oZ}W)Vjt4XcZLY%Cjii$1uuKUVSd zm285>Q-H~I&Cc!_?%qLaKVY4Im%{O|CUhXlP8K95(6d;iKl03L^n-I zIfjNB%{LyoQgmM;KohxfRcI3+*6xoVKceQjf@T67)&loaaYcnU_$-trchN5k>u7#? zIoV85p54Piw$b8QD2z!vIf^QX+p94;D+6-zfJpWi;H&|*ilfzs+93jJW4ay)l1F;h z-{yjB2_@GN(h0i@3kDfpKa3;?1UJ)C1MSB=L!bEKhbJ==99UVdsHR%ulSwB9}L4VP3H|Go($|KNU zcO%pvdARI5JwxEBCz<1@XEa-^AbP!lQGzse!}5~a0!253ycO7iR`?m1n^*l&5N}4Z zFu=qKVf>x3dDGiF_&I7(;h2n?Gb_l8M2ie+qq|teP(NV*CXKsN^MeB0`Ls@hQh`iY zKhjTakxoyyc5v50kr=9>YeU+9o zre7C0EfVR5Qwy+hg2I1%W>yW^%yNXWktjM@Z#FW$Mv`3L3v&C)cu4GL5fILqm2POkC&Uj-TdTu z)7P))ZYfNU+5qaqGL#5~Td{^AaQaL8Z@ML0_x~>~?tiQFR}dlcBTXfCWumm=h3>c& zjjGA!ihebh>!#PI3;Sn-1Y*1G@IhYUek)YHaZZc3R^R(RTRqq45WB(j-tG??R zw|?VZ)L`;BXvZ!CP+icp;Q`EZA-2KoUT8%os*d#1sGrLKiegMY>>9KX{o!DfgrVi! zemagvQz&Jh!-3(+tVAd)H)#&3NaoZfK|RA8%2z3C&whyIk6T_`nP1LOpY1ArLEJzsjfh^M_@)s=oaAn&8_I?-1^<7j1$VectLp#qEMs%Fi zOk8d#7BLgZftDwIca>qka)7^zbi!HRO5#umCZ|8btbtD^O)Q}OajHNm>G{C=jRRof zQSy_&z+Omsjo1Pf2?zI^H>uzxB>9Ud#|g2F55-a+t=I! zbrK0)Rp@p=hZHGrh{xfMOaUSua8kHF2=@h?hz^xQyk-o#lN$O30Mqk7e!PoZCDMH0 zx;Uu{ciwZAm)r53^{yf4j3Z4?K(W!NM(WWAf=2lQ>@O&kkXvo@;}aXPrs0Pf5fp`C z!#lhFD0y)sfx=?q^K!pVY#hmb*f%2gt5{X60pScJ>6`TI1A7t92Cv{P&<;!@?$D*M zIsq~e#sMIt6x{RLtA<=%qs$_uhG$7ec^+UlO1L zJh6vhz+6FTM^FJSZDO92abgW(Fp?W*02>}60#pT zLhlZkOtQOblQhMN#EXzKGFm7omr3|IR?6JDpWFmkL1cM zNQ@(c6mtkO_(HN4^X?jJ?3}rRB``T5HJw5zFh~$I)=v5=T=e*W&n%`ybipie2d3N2 zxf$yQ7g)36IX8N&rA0CAJ2$Y`aJVe0&pSIfT#e~LM5F|UXVIrm523abA_?>$%uvLA zOaWZbwXmoLm4h&EBj8CuR3d7Ud=1h!3eE{|Z69PnBwRcMD8f&lf%QeiacnOzX#ubV z#J3J`d+Le3zdApVa}Oyf#_mDr>n$?^DTTh80J|n!>ih_p4+><&NF!FF{M5AImod}o z(aVFTB|@2z^I(YU7sph)g8}Pn8G%yOtb1MaM}NQZvbmw*v&CsV47|Z+%GRUW%YM}Z zfTiP*hytK3-$Z;s9dch$Zblh7V^GN~9LcG#Io^=0&5DCdTw+)e4hEg*El&8P5Y-I4 zO6q{7h6a3foiG%FY$2&Ixbj25Qb5t9^|2fH3_2F8o0}Vcl@zJCr$Tsm@jNy|M1&yb zi)sUGLL6Wy1u4bum_DCiDK~e*TmLe(E*DK=@;G&n7&+6^-TFnP;Z}oIiGSQ9JBZN& z`E()3|3R_|RX)ObWMRdK$)6B|C<+3#6D-ZDTrW8wL8J^IIxYiL3|4e ze5kCft=Ty^?!a$J0(xN()kEb64gx29zgQf^@P}sqxb`ZV%diSlyPzj&Rj&%rCrB~S zKpR=4U0*5gNtYcxfmMXW+F)`$QGVe7su%Xqm5;F%z(0>@ni3dWQj^zYB5N5Gbh93g zCLixE+Xl^Zy#{X**5NBKxsu0#V<-UHoAa4F03Lv*k*|6I7Sq$%xx6JkG=A@;7T8PG za?*~VR&eMyb+yoTJ386ikQ_)%(ZrrXEC*mJ8mE3?X@dW(2&4H27El~34qQMEG6oJI z?(^CwCt%LR;dNkh;;~dwaGq~1R5kc9$QM$j<~+8raLeBO4MzmP`+hZM=k3T?0}_KV zE)F&o8`&v9JgOh987XNAqbC423NYaSNpUg{r91noq`lCQe7v48oK*%aC;Q?8Ok|OL z?_>dmesCS4xACcI2ccgrkUS2@5<*UE&8J3nY zea>6Ryw?tC8)`Y%G&S`_e$XA}r?HB%hzCpdoqW4$pkyXoe7A0~IJ^sR6UFYzr^;cL znwZ-tl8ejBx!N;9p#kjPoTm>t8OH_+Zyh}s-F%2PX34FvFts=Jko7^-oJG~Uq7ir+ zctAHnCHsCD9r*-hJXGo;BYQoJ@bzOPCM&i`XW+1_w`rk-6{XMd%5*T3+URN|IV} zX23b_ulSh(GOz%CTeIvpLElYD5kMQ;SXK*p6zzfk;cm_G1m$LZ@ow=R#y!w3J#m%#sp6khyb6=X1@sDCE_WzA!`5!kWus`wk)+>*i zMiA{QCyi>R%~}$LNp{XT*|VM~5?N0nvV=&MlRep<&u?a)_j>1j=DDu-kN3~_pRVe- z&T;Ph{(ZO4^0hf*GoLoS2AkX)72zv+F^= z&P|V12_adYW*|-BfL+xX&CL?MBDp`oN(8=3e0VnS09(&&1nwJR#3dS=ysn{H)_Q3o zgQ2bQO1_=tHFgEG4abOZT`>SBXApsL2nYO%;)r!Uh-U&KBC+cj_v&KR>X6ULyq5xw z(%j(5#WGB00Tk7v+EC;_js%LxlU*GF@oN zk|mIxlcE{*3rH}hFqnbD0#S$X<}fQW@l`CurWFiT$XZ6S$_3&9QP5d1!GdzY0L2HU z1*aaK1*(+cJ#G(T`XT(pJ=k&rP--o5u(t=dBLKtnuV24n=`vYKK!L1f)l-a0ycbwWPb(|0;c+u0`^Ugq zM`g`%9GozG7;$pKumIYo(m1V~Skj7>%!HG8+Rm;VgA(jQWS;kWt~;+TwBl@NzH%ZcOqXw0cx=17nmJ~Qcu(0`3!iYMIdbrbj`@RzoL%BJPh&o z7U+VYlJTOrt3pN}?=6M#05T~w&>Q~c2n=pbZL{7EoPDj?>Iuz0qZAVmC9&6_6a@xG zi+$)F(f$yB1#rQ15ZCMKR$szc8lc1Sl`GEx5rUJtzHgqepkQ^Dga1k~RrI!KAaK=l ziZ5d@g|tR$Ih;7-GvUj>kcZsJ`Mo!WCH9(T5mK_oJ=OloRLmu9hiDVh6F*1 z97ahSH*N$jxC{cceD85_huR0Ekoq^cOGxSb73?boU#bGhIpgu;ry!}Jav8&yAf|R; zVF6g+=)#M5B2coyiJ}7JJH#jA^@yII@T@2({|K7a%03M(9q}_j6Nge|F3K!ujsIrk zLE;aA{*d$_1O`JzrXKTk1zH;`l^+CgLBR$jyZ(q<4IV_a>4kU(wn>&t<$?9^4ITn( zQ;EJ-)NKUdTmW}55?ObbDC zrcO=iI^Zw^Dtd^8D|7v7i|-Lqlh9_9W)H4*9Awi5;wjlHf)500xE4-0K%fa#6G01u zQKA*W_F8~^WY?Ys>g#abay0K`MF?2o1eC!*196eGf{>#;Q1vyv&xEhJ4Z;9g4b;nJ zSg8g84;UbI!JoIAq5IJATaX0F9VVn_SQeqc0{vt$VYZ;K5E%G=4EqM4Tfw_((OC)a zN{$DwPtyMfZ~_7mvKGQ+PYP2kEG!7oeD`kR&5AP$I)b>kIG$%mmhZmRU~^O;a^ZYE zYH-9p&) zr|95uiYgFb$=)?`L{I^v#>G~JGW1rYRwhk3W;&qMHev?{+186O&pJXvX%Xri0< zn`}g;8<**CqRJBa3zS2!nG(mm0Y?&NC1!pX370#@f5t2}5dn48?4q6?mnp;kdX1~x7%xJdpR&vTPKs5& zu+O!lh{%8lPZPgX92gW7cr%=bv;dD5iD6Y$H*l`cqq;zT{s`cYWMs;`@7tPU;9R+MnL}g(;W;9NCJ4sxS(UcMhdv$H zx?m`+8X8oaLs{PX;|;(%-0dSTpFQ8(#tedFfIwIo$OlBQ3@8L??7t|ZJ6lAkEZAMr3*TiSOP^e)(a zkfpI0Xpsdec%;fNPKF}rpgo4IiHXW6@f<>yf(sS=lAx@BbNmvr6cOPI*dnO3VaUT| z{VM7#pk!Er%ZVo#aRcQNQY+kW^v;=Md6W&NgXtD|LHOyCFWoCJyBhxhgPQ*axP|iE zUBeD*OkRyyp$_okSpNkj=xr&)of8lk6t(DZ<#89FhUhDNco>eLh(G9@4MBQ`Y0P3H zwR~sZXKmFzn2iys?V0F%&M-6ZzRSc1Vti)xai*=UjaN_*7uqVjE?%t;0xbaKm}wbz zNg5oD-^bUzI$`Xl0)_eDYoJ|6;q@XutFHEkF)_k9g2!y)3>2eseb|A$TS0omB>^Nn z?iUjsO_mP<4HtJyO0){ya zU{=w@EMK>kk@=(zfQek0;_nM_vAFO?d+mn6t%wJX03RdV986=iGMYX}yX5~=BD}*T zI(Y{~!Dv$+QhVS!K%^9~NMN}8rK~RRJdv_+nn#^w%FdYSmr4k?{COo0&-hYmh_TIv zDfK*!hxJOAWTbc6+V+UXmcBY>xRj?iO~^e(hFhg?aOC81VQ%HcZl82a31|>oIn-)4?;W?PgEDnG_+{5^2ALRmdgon3vb=@Mq_z<@08}h zL|r#_DqfqbE|&O%AzbABe}ip3U(E4jA3b`POX!8a{L@PZb-ndy$2MrtitdCZe$zT~}^JYv!wJb0>jtp}RUX>FwM6i_P$?Qvb|lhmL9Q*a&9HD;`S4wL=sNW#cwc4hrSet!w|FP%g=d zuET%**9+}5aa#(7%T7mgzsZ06q5ps3->w_EBr^4#g1DB{p3o=mKixI%VxRkRY`WyV zd4beh=Uvh=pXd@q@-i2(XjV}kja96 z=bX)cO-{;>k@?3D&l}-2Yg-AP(dj*(+QVMg?7MlWgO>{*WUILyf8JUfia)ZROZf5OEYGTTX>K(;FgMQW2Dr%yXcu88*NKCw? zLsWC6^gS!r=}F@U<-2M&F5dM~oV|RS5u4ibS;~B$Yuerz5oTF&K@|=EF32-TZO-@i zpEcIHn((oHL#Jl$)t6t>ZKLGUo=j z-l#w@kA;j*L1CNw@XVJGhD-bJ-?r%cfFpS75kA6egPXENtx0>9DOUPkVPPWhl_sF7Iu&%IpfQyqHsg zTNMwdHP04?e3H%!TW4*WpJo*KjlE=ZWMa8s#o%Qg-|QXEOzOK|BYoF@TyEI#p0_n( zHc)|`qRJb^yDlQ7`}It$%_|>?ldOuOl->cZR;wa)kp*Y^*Of!*Zw=_-`0$(&^T7Mc znj)M1UkaSvq|>w@u#VgXFRoQwVKw%~THfKQY44?%lC9Bkz1rZF6^E&l`!{tjQSM#1Z{wTo?ali;{VcAS_8-o!xHGYK()aR)&)yw*H?Ff&w`f0I z8Z0$8mOSRk?^yX+lIN$#!Fy=6;aM$qsv|%C!>K9rXjR7(Gr^A5Vd_YOe?)TcHxXtb zF?G2-zPlYXeoZ-UO3;m8yc^@IQ!k?$E0O1jRzY} zHs+b7IQKDAa~qnKsX2Wvm^*#6&fm{s zQPE3yYoL%d`=`CJd1iedYu~H#HSIOotZenjC68L4m=o)@nUy+x%;)`NXq3{$9PX(N zC&o)l_lHf~Zgw0`OM4@hTCC8jl|2{f*=xZp3bx>&T+%Z#8fuK|-{aJ9K``fh+id~m zu{}Fu@^z;7zBZVm+{Yo+3*&nyc_^q$ojUNwdUoHg*QwbuM;@qI7LR;Pwx>lojvd%h z+@$(s@min$@%~_og5=~*O{dac&pW%7Y6p1-goCyB+&_|3oi;I&+Rp9lakb)I_%0n~ zBQK3jdLAE3+~lmCCk6d(3m*zyLnxYg=|v~wQ5a0SJp3`01N=IArL>j_m!Ib5Z>_tJ1)LbhnI% z;6Y;(<{<^wc1>1AdgExEk&aR6f+!DrJ}%d_BPrc;e7%rR{M%}6DLbD4qeKbEsT)U? z$A-B+xGau6m=ul{VBjk#hb%@bD0(zTN2%BpXDW__;v|tvP!TY#;8V|;@9ZR|GZJO~ z#-xzu=3yP?jQ=uU61-a!Ugq}=Unw=tS>H{zri*kQ zX!SiMvC~{pKkN?QbY`;x$wJdBzCEMjo?Op*ctC}D4q4-MpmulTxHJL`RB^)vu1X05lcZxF=(Dv_}?Y7 z(e-K+N>^sy54EN{?`OT~YiDeRBqok&X!+;JtpLd2?rxB7q&oyf6bb3>?(Xgo5d>)wr8}j&OS(Z)x;xI=&-=cAzH`2D z#&^aULw>Ni@3mK4G3UIlW#s#Ja_A@|C=dt){q-vuWe5Z|0sK@VBZ5z2aYI!g5Gu%P z8A(--^!+7w4ZN9Uq~jxk7LUPIWLolad9(#7m^_>XjD6O!$*~rj-z5YnL zbMlwO#6c&g(`-|;ygXB?5G*NV>W$X~1Y4_T9u6+m;jc^}hE7f-BBG6LBO|rVd$P#X z;F(P0n;T_1diq>#e#K)p)*&Vd9PnPqNBX(BxsHzCu+Q^MSJP5cYu$bSdAu(xBsG<( zaO1;jo%_pwe}WnM3i=AxH-40af4)`59*^c3bnu8}Mwx$x!)jKFp!?@4}@4s=Dp;a0QzWCaDc>(s{}` zg@q`4(61y%~L~^)8j6+UiKi z@Ke3|N@}51;wxQWF)`pEw{bgBGt0z5zrUf(3Tk)!G-rs2dAyGu&|;JJGNQonb0+S+ z)Z5nM=i=$QPL(7Q&LwQ}b_p1h7>ld1N!^c;@@d%MEPc4l*4z}I6M@4uy9^E78FeoP zCzDAoEiH{4DwVIw3|S2_IUwkthp7yE&lr-EV_0;#w440OG>OEWRwdz)6BFXFt_*ux z^+v0@WDCCS7t3Gudq*$oY5#kkAss-JiZ>RCPCh=s8n*)f<+7wQzOCbbrS zCC6k~kF4(Ac$8kKl>A;DXb@mctsxbjNe_HcSN*F=Hd=co@nkAW9|qFmDZRQ^dh4SL9KPuX+ZNwg+31Ct#ESh`Q6U%{2=gGm zKobkBecWQmy10&Xp2CU3t_(0jks~3Ooq*?WlG|oyQ@l&uqD_2Ze)shuLoKW~j$FIu zNR40r_1S>KK?h|C3)fn|hr<&&`Lpek#Da1z0r(8Rtv#9UL zZL+5<5|Z=+%6S}Ts}A{#{jR7UkM`8Z{blO->~EO+*t<)4%}>VXnUG0T$savLC~Wq- zJ_=~HwNIghg@G6nsuPM-N10Qp6ZoM~uebb*SHS2t^`<0-h);%roh7UaPi`{8v6)d! zPE#=s!=+r#Og1|a_jK9tRl-v}JW{Q$>}{vWz44|D8p%4Uu=yL+56s7mZ==Q%-A^Wx z2d@uiZO_pz1Jb@csFbN_SGtzBF_7v9YJGUH$m9x3iJ&Wf?3F|#TOhY*BZos}0kJF| zDdj7%q{Xq%k~q{T6b}y%H7ZRa-)R&-`y@h9whWnj-}>6Onpp-MCtbH_Pb}&)p)xr= zd5I&*%<@kWq&i=?!sJt7wb+7FL$R;4a_=TAl$5j(;H0Tz-unCNEDs^p4>%!=+;fna zV{{uFdr&r=`Qxr`ZDybK{YrC{bGdX2YOZ?z8^>vFmmWs{{Z+6|-emSS1q|E@Y?-iO z;m`qQUc3*5;=2#0c<$g>6&UymLJ^O|Ax>x` zdg~6H50TPzCY>WE5Yl7z4KbMB7;Q7}!~3F1PA;CHoC?XRxPl7bU7cKdiyE}}-zZq* z$svKpjmDFc5(4!aF!_F;ZEejljwr~-yvqrP*kZ@~Ct6;*;zYr7a#`z5G^-81S5iZe zHVzh=seeABZ^9VTT$MC($)j=#1KCQZcW|i*ODfUiiO;tLli$EcNzo+Y--~Z3lz)!r z^r31HR|?s)v2L z&3lNHaVs5-{PBc5=Zp`LXxEmfa+cqlTG#}7zre#Zgf6$lY|5-WULo`O)SRaI%GFD2#gS)m&ER>%hUSg-r{eth0Br)y9*+ogO7KEs2vVXf)|U8iglfc*3ADj7z@{42_eQDhUM-3=&T6l4cIM(ya4)Fxwpa3TcZ01{9@{lH~W%mI7rx+YaBU(jAAuG{;yJG{bY-9_M+)_QN5bk3B; ziGP}TNB5Fi+1?5XNi2cV7fPcWQg1GoZfMqJwuFPZY`%%x?7Pmss00ZJ zfXU$cvq?cDFo1+ns-{>InuaCyYN3$h)wIPPup}B8?w(^tHp+yY$YTtLP(=d<0r$$6 zD>=F+!-VEoxCt?(kEKFv;>>x7(9L<0@*A6*2Hxzd#bf>Xi<;rn<@b;2!L z5k<}x5)o?9qTO|(nf7&oR}br6>*V;+R#GHg6c>&q)u*o>E&aVxK316j_c3E0q>O_E zQBIwdC^Z5LYmpd74ppc1970QfF?NGBpwQp@i}+cNnk5!_X2g@94_dgJo+Og{vvi^Po#KUt zG}<4nypR@2J5GGkwauBkwShSeo7;23rUnzdo_9wG6`@=)nI7jXFR+aE&#B-My$z1S zRvb8($=}Sp4Gxdz8De|;K1E;cXC?q+aYv0|)~%v#`2{d37l)iKr{&>loem7#2>MTV z@Ws!~z)5goJ)_2XREq^TFGJ)>N1JH;du{+z~H4d&NvqtV}Ae^WTC z_@`OLVlv@`j1R+e4J?gOShTrJo;%&2uDgb0MfU#T(Cg_+^`)-m4pSTacuR$}pqAD3 zXlr=>qRU*`o!9p5X>fa$G}xFG7rKe$g}J9@f_V7S=Qgg`f6Q`9)RYwcR>`%Za1Z)7sMRr1?PF18{wD zoh7=D0vgr3w{;;&B}Beq?%g-W?pU~)X!cJSis<$TXi z*LMF?yiCN;gRJ{YNRkR~RnNuh;-V=%VkK^=gS3>^z=XLYxH0wGZ~Y}a#(vP1SQGF9*jCl~R-jNF?X%l7W!GR7j_98SimZ?jvXJ@Vzby@p@JM5i}mqe&+$;-Ur zU-|*54GDTGSNR`E7Go78yBh9N#O$eVG4=*7B=Ja)v1V7`%GilQj(JY%{e@M`G31UQ z>OPmldnw%fM42rkAkxGAjN>b>se?c?-VCiyjwAA2Zn zJ68q(7l>es-3#G@CO>Da+dWY~^)B+}Q2&BV-TZ?wx&1FnuG8Qkt)yqsd6k3Ttq6-57vrD;` z<-APy&uaY99lAMNv&Bjfvk=sZt{t!M*My;2aews~iax_6NKHx@zw&YnOL6GI08hjx z-Oz?P2y884{8@KUeD5~^8IP+RKPIW}POdNcE4JMg(dQnGl|uKZC1B>y-ik6J4U7-0 zaE^CbTs`*JfTm(2J5A35G9^Py7)W!tM|;TJ*;RD43@FO`WmHc@m0al<>BxQD#l8Jm1`>#wpRXR$gNF56;m;2bv<$hcL`vTpnQ z0jnyR8DrcJleMi2B?x^Ls}&vM9gpQJh%Ff`IyScud56Va$Nh3u0uv&!kr&R$RBZQL zNwx4JSr$43nPj8jYz+y57$z0L7UQbN!o=Jg+!(+5cN=X*&(0N*i-1v3)5Izp-_xzqP`wa0OBI7=VVL2BKoUnK2!9U}xMkpzJ=)Vb_$)kk$ zc-#u)9z~RTq|?8wP!0PAOZ>-(dv&&*1RxlvswmgEg8FhYg6SWx{8Pev|0-MXLizfJ z=k)9gvDmjy6IyIu>1-?o8(Pvji?-Ap>Z^dk)h+&>#{(&6vHlth*KE53m_Kt8%4VLE zfNOPFXwB;?Ex4i$`97A<<<8X>m-+LzL=o_d=S+gBFW)mw4QF;~<|#Xtd?EcX!G8v z@zL!WdNMCBe~{F2Q^4~VSlNkRM4^avcM-;e=ngr&r6K67_i%N_HvySsKa#?C&pv9# zs#>S7+Lg1+y*#>L7P;1K>s8EPSkt${@$5ytnUy|OaOAoU_ui;7y6-2 z1@>+SbF50|O*%Ml^1h_Plb~9a&Us(ATXckm7V2>21`k<8Q|w47X#PqTqZ0h&-3+r@ zVwyW%VjhkNS3cWOztkca*1PT)SRh|&a~|AUC>6O!hzqsl`001;^~BB8wfDJ{>s$U0 zzl&icYpw+S%&@`~j;%S}oSfIM?Mk@a}4VPF6zhdv=%#!mPc?v=x-0iK?}I}xkRZWu|D za_}DEk+fcp3`o9I+}x{(Z!}&HjhQ>lY@f0qB1nm)`^vvKj#5jpbnK;hEYBZ9r&5?fqgvsE~fE! z4<2RBXtBX*T=036++z_U-yH88#$;1x3OI8j!aV%Se(JN+vHk#bJavw)T)7o?&bnd@ zoH^o`jLFG+@LsW6s0~erkd&{^-_t_6tlQVs;|nh_9J)tW^g_R6p~@;AbYEZ> z->~lwZTOs%9xkooiK8^2w34@mx>Ax$u3+n8pN=zn-28G{DEQ3eaPY@BT@(+Fg_P%T z;Uh_5;?H;|TmfPNllj;zi{S|_!{TLbrRAR`UEPWSJ;WoPM+1`o* zEH&ja*g3LUguA*hnEXe-tL*knSJ^W-31u5Tiah+b<+-Rv29|+BEVo;VLp{aLjfMvU zT5KRBh5*O<^M}Lzq}9H(ZKNG1qv+PN%!mdL4!uI9Ub9(a(zHMDMno zVBSxEs$8{J0Pw?+eTxwSoaeE5iR&siVYcy6Uq!-x2)LE^Z1CT%B{r-W_wO%x+{CsZ z@2n6rCm{mDkLAXU!Lx-a(3C;So{gw-I&)5 z(mcX=Y32mO=jTJ#O5PBwqyqObOSi+dnTVGc0wkG$gvk8yXL|^+ehYg3qOZx=utX|J z-R;lGw-DSF!@Wk00X9z_Sq>JAmTOyDz|QN&j}Rb@2hk27UJ_b*BncZ+*ua4Job?B6 z(xf=>`9}u^RF$nuIR-`V&jjkLx1mVL!ua7cgy@}%-MLh?#jP)aIM8>N+mKT(9gbmJ ztJo}MqUnf0BV8oEdWTjjd|JZ?Ck=D&)tC!1ZmGV4#OZ_0Iq^KcJsU9`z;RXK#>Z3Q z{+k1%+G2?0zh2cp>k8a;7|(0O6}uiaxxZRBj%YgnxEK8wOb_g3h&3Sv)sf@ts$C9l z9HWhm%yLK0-ndakT0ZXP5s^e7?NV>#DgkcVEn54cj<0<`w9~-KETZhm7bo2PjSUI*r;xr7bI;lM%0Le z+A$Z@GCKJ6(*q+@sl6~yf~*Oj$+nOo(;7?LX!zmfFdR~!cZp`WZu^R$XEX}&UiYb* z&~+Vu@oMWHCJ^^?O=zU&U3sNqd_P1rh}16md(4!S=Z zBfG|7DeuiufU~V>$?GoKR#;38a@KLTbBHgtfjN)QO|PDa5sC6*{TNPt2mmLH8VRZ- zBa4e9cDKcEsnv5{F~d!8M-0C;Fq^wR=LK5NO9a!g{2ER^-jL85Ccv6D@a0YDwm&F7 zH!?+$Q@2jh{+eC<9p@C~W%B|%Td{M{OqftwH+&TX=6CNH-kVL0OWdl|Hull zkn+ql?~Rg<2F4FlfU7#Dmto!BC8NjLOj}g<`RfD~qcMF3di0HthDO@A;Kq!RkRc#} zMt$c#_L#zzo8gCi19bw+$OcY6?Dna*u&AUefVwiW6omA>M}D)g`?{UiiY*Go1k`oP z%lS5C3s^Ro@d%S=8Zmo_qE1cwUiHg;$io5ogg}jcXSQ390gth0@|EAmSfhgdt7!=p zK%+siC`Z1u@K9X62wy&La@Fw{9&n~|_u8PY@gUUaFWDlb zHIz&2=7`0?v2Kb<<%~D2hn@x+2kC#%d>0uClqwCXh@=*BtFS&MVZ^r*d6!5dUIz~( zLf9M#4iakpuh*G_Ev(QhOr-Ga(mU)6^X1zkD1>gAjI4CNLVbPAZn8b9qV z53m|+md^QZrpW+H`%cYE{pl+SvL^<#sA1+o%wZv z?dd&&dlFG_Bzb7Wz zi6%77Oie=%ml|nVSWvgNwj7+Ctj<$5oCNI_>tTe2g+08zgGXl`(%zS-(Ta&t_=r(1 zFE3-EWZfK$c%HVDaT)iZ)i*SNQBBOvjaOQH7mq-hI5RVoh}UW|YpaDeGld7G8Wn$1!%}~6_LLj6!?NnPkS)~N+gJKn zS~4ZGX(Kl1Jfd06@EI8!S2(WsnAf(Zr<3_y&Y2VO*$`on3x(w8Gd4Zm?hy$((b3S* z04SqXt=mG-yZ4`7fF2^dm6ljh@5}7^`ubSwk~c+DG~C=c#=UXf^^WT;oq&>$IQZ#ro+$7 zj8fKgDxWsFKAtP5(c&Xms@EI^mY6Q&ijqkGwqv%!SV>QBnf}g0tL5QRyI8xfw7EzU znL6Fg^6T|Rq9Ui`9~sCL8&4vGVoy&jsWv{Wda2G_G3Iyk&D)E;R|*PUdu6S0Y}&O3 z-BI|QFJ9OjSv^?d6B0rT;;-c8JC+*V*Vfm8Z^wW8Mq{&3i@vtDc6@dg92)vEap6_(!<>di^fiOhIjEsyD9v%YVYksQKR#xJ0r=l5E5Yf}qyVm9@7ra+ih6Od}h;Ac` z7bKsPlRH2u_Q#JO=+o46bnyCqH_vTsY<6vq5*5V)laladXs`ozKWaCQ@RrSlbA?q_ za)U}W5fRa(W~o|H!|m79RMCm)h54&yF%%ROhlBYVzLG(3)=1XY){r((=*Pyx3*j*z zF}OYdYx^s!_H%kVT7l~P@)YQyc-MFpiH8ioGhf33sA|A&^4AjWx^LcBhpQ(Z$5&T! z78Z=^e(OE4$Y^LG4Gn@lF~q^ZTHqj1;{w~^y!mH+oy%@f;MhaN!_#x^Y*f6gu4c<} zuEv@$C^)zR_*$O{ce;S1l)0yq6E}Drjv_w1txY0b*d0US;sldYj7%<$Y@DgpuoJQA zVp{ucX4c1#ST=K&2w=j{Z$v~R%C2h4&quazz985?I54!gk8g0^{#IR$2l@E%V_OD~ zy1IJ0h^O*TjMj%s())*p_Vp7^FeAF>&ujh)S|b~yT^+5+X=o57bLeB}>+2tmm(|H2z?Le#P{&Z02YM7<03D()!8TuQr{nddi;FN)ZfxwP-X38jWaBv`y!DP11THA$k z?<+faL`0{V)|}IeDSV6TCq*e_%Y?~EmrGU{gJ?nyv%9M!bLiByD@~r^Mt9qQKo`T+ z^C>Y=)4_o=IwHd0_3PLB2X!lEMinUqQ&t4{_}!55G=BTa`+J{S>lyaTiy3{M9wO}q zr{~@WH8VuUF`HXk+!Y!_1nfF}U@98G98fVZ%nAw$yrydMwq==^$et&JDRWx&>XHL`R-~hwno1Pp)@XI#5eEWnGtg6ndHjF zoBdSGG8-Qsw*f(IKb+Ff;OcP6m_@zRL{d_6zbz1sRa7)1L)bkIolM~4!Afh^Qj=$* z?b5HLhWh&QD)Z6GfdTni=k0e}fBtk_9xe@n5Ii6yB?a9CVYht)^)fwEFtG8PFYKnz zpFbCJRb@`vZ#-%-Zf|dgj=m34?&2tjNt$+c?Cxl$rlvMvQ8s_NBKIc?R9Kmrqe^re zliy~Fq~?A9zC%`~!*1UCc+2AK=x7L>(S(bO%VsoFbf~*K)ONl)($w6%>T20LzC^G2 zYj;;y`NU7fs?EVKRT~={KYeeAjDKDE9%O-7t@hyqFpx}9@5=IWP6A@${>7!GIpDj{ zNi38b!c|pO8H0RZTwENZ`^zN~#sFk1Q}dB@L+D;XGz<-?>stF08L9-Gwce9mv=v#({hG-CAyZbxix%ZxBBa@!|Ll+T0y33~92?njlNA&k%a(uNOYC@{Y{lbhS!`Pru|&~z3*S&c^E$or}0 zO~m>6`9?dL~xDCn87={2Q*oXW3JT7c!b)`0-^HMi4^ z*U4#VgR0EaF(F}Zl0Jw(q{42jU?TzK z;3gy_w42L&^TlO3nj|)?p|P>*Z5kh_(0QNlV8gY2`}S>jGM8S)%gd`0z(+0s1`z|G zj<5h~hU&w9Ry)q(apc0uz9-#;i%0e?H}pV|;i|KFyuT4zzl4H zz>nEVQ`C`k!C-*C;PU;3guTu!?yp*(x(h!PQ4vIQ8Fs)gw)(e@Tv}7$^H00)TN=g~ z0&{{QL4X3V@$nG=q=vMCSP7%*en=SIeSC7VHeDp@G(9zi4_vdCf5it50{xO@-z(je zl#~}JFy7_7MZY^<-R*((qz;%E7^*?Tfx&WO{nKkm;tAU}a?` zRl=)!;}phP5<$n9a-Ie3{juLWchuM;T&0Wu~w>Swg@!xal5>Xlv zK0X2v7&i{Zy}i9bn$q4r@vt3c(r+vset1g6lKR@&CNcTwOY@QjI}D9D2xNVLHjO|& zMaIDB0q0x+aM%6)*{F^tK(!!uKuHHkIarZ0$j_b?R1H&zdQq{m7VFA>mz9yB;^M;Q zw_9wBz^3Ii>Ozho=0Sv%+b-~_e)vF5MFjzX$<2yY){rKfeH~_VrJq9KwApk6`&DU6?hkg6` znh_5QMWM%ju{V>WT;P&SNI<}6ty+_ifZY>E9u2U{I>0LR-dF4Z$f%p^CcJ`w^X3g6 z9-f1*D=!K9cV#A4Hnyxe2oo+Yu7I%cdS3$VtJkk3t*n@pRa6p^lfys_YZomY8zmIL zeHl+r&*qtk-t`<1{xv}K`u+Pir|AIRP=+ue$ZNhod_%L6XY{<$0c;R(-a@OjTZ#hN zr)>NbN^ZbubNbzT00QS+w&(3%v*qWb4EPL}|D(_0i!RTv#_%Py+G{DrjD0WMY!k)Fi$-TWyB}D4a~(j|@cW z;OJ;nv8Q`yRaI3g4h~Efwc@e4k=6F#wZDHOPu6>l0V-M4@rupJ`f+`I-8M0S3!ad0 zbmRhoxBl-t*;ta$$w}2>tr`^N0z9i4k`>=8a&XWv5L($72{knWx1(kB8m(A>;KV2X z%7Us5r~9D}lw^W5AFRq8s>9w3ux>eU>SFy?3V?Swd3dB{Wf8&R5)u=G$Hv}+sRB~8 zSnmi2aws^Kt^gP~=pcaefX|WPVZj5RKYw=UZM0tzlaZ6l1ylgwnZ-6tXXi6>ry&ds z3@G9}Tx@`=&_H8gVCdU)0wh?14(D&R1&}>*fJx2P+LF@H(kcO74-oX>EkI6d00Z|8 z4od%gm%#~GcGLOqH>1_hD=&TZ&nD87O#xd2Tbu*1A1VAL9Y{B#$@_XiM(P{4u1Fvz3Y+S=4I zIDCmnNsU2bxdzOr!tcTB6&((U{%wG40JPN(E#Yl!gh&P>8iKh(2{fQwAk22zO4H#O zg6?z>jIdBbQ^ftndg3WD0jYJ_8G`{C_xSR%2UskZK^tT!Q}m zW`?unhPJ0fPyJVNz5tLDuxda+3;-FU9Z+omQbJXkOD4Q5Y;0m)C(^esEs?_^q6LJ8 zA^?sYtn%|6On%Gd%a<>YPfuavdxJAF$l+mOU}0gue)v-R{;s9$CNeJ0&Z)V@_pSpF zJ3c->0gq#Y;7#baq$-46t@yXLM|P$Osrepp_zuooEf+8e16px^+=&UoYG6eL*U<2A zL;s(^-RTK{bbwR@C3*d)idKhE%=cTT36P>%0HSL(5CIFAr*46^|3sEkR z0sa{k6*X32EH}Hb5Zt>S$Q8D~Zv((?TW2R+TwI(%j3jds4N$ZI#VxO?*&HAsAdt!( zZv*211*^Ne8)QWAdFXpa8K5$ONCK$sPiI?VV@76X(07nug_fV$tHhktF*b$;7%t$9 zV^%eN{r!@9dK3UGBZD&srkFov1=ipczv3xEF)%oo0A!2?9SlJKLF+yU3$wGc4wBpe zMgSz^;Ou-i;qxXMC~qKi+1T2WvO4cgvjNsgBPvQxE?j%qGIjN6b?~5(rdHIw-WyMy z@M>2lD=G?wv&ZFjgiozS?DqZ%T;#ZT{bp3=_3ODaQkpCzMPZ&o`n#+uPvqXkIr8q&d|C5mhVVAH6g? zi5l!iZprS64l@(e!yu)x_g{<6>E#bpY%*8y)FJo0)tA~gT7)zcJlZv9;=zAD{k|;i z&{qzlDS-~cSaMqCzk(~(7oDvu{XH+#v&ikSX&n`Q%nIBziEaH(-4S`9i||`2dAIe_ zSCPcr#0Jfnw)3(Sk$OXLtPpFi>ZiZ zakav9;f1G&-kua4L_kom&J7p(9`y$CK!3mG)U8_b)+EEfFZIO#k2L8Tuc$2XwDa>9 zKzRnCuiE`XW+ZS)P#$vG-I%s$ICUZhY(1odaGedRLv5cKn$g=;lVuP>OBQ|{Jq*Td zAXV;6mk3|q6aK{JV`s1J=a$by0Z0-!%V@UjXgJ^x^n+ub(3S39{h=#ZnX0aCdNpa~ znrK?Bb%2WhIbhe=?j5lZ2YBF>E{EDznt#@28}z>|q>j+eV0gk|?OxDkz8a=Ty-YGb zAaij~xOFZp`U`v8Y#%Z}&2Da&DSQw3@CX+$5S>;x{JrT1B%o(QAkL_7(8#&bINp9m z3zQgR@BK}1xDpS59szui__7{OB)piIUqnPbY@XCJiYz2>QvrxZ9$sFKxq)X+&L;xG zs7t?YR&OtgAdn<^1W-l^lt2!Y2#^d8s~&XZmCaNA)6sp#$;}N5`IpOgOmyNR(qKb& z$h^_x*)ts+U0=#{;a}fetS+PSl4!{>;{B2A@P!0OTy_~->LrYe zduOX0KMiUWh#;kfuF=Y_?axgJQR6_&hHpvry#AU(B&_7Q`RsJ!zja8(Q1D5fM=*W6Fw`oBOxpLl5uyk$6BFP5##G z#rT*IMqC^u;P{vmC|9^fj;<1_Oi4nnz%YJ`jE^hz4fi8L78~6OOH0WOOid9W4lWKh zFJxq2E=d52RYfA?- z+DvS0_&~z(*v@drKHXY*ucHIc!m{Tz_{;q;NKs5Tu>0rtbz{seE=Q-Zn@AC!+eI?D_eE;Aqj$4TK9@fjS0>X_D2>rYCkVFQ*cAy&q{w4#WvqbK=!vnoO@MOT1SC^ZGcP9JM zff6QXCaOsN9Os$Y1BFPIDtqFZnHt`;@2%0}z5B7i9T&#_6E@~yuQ;JG1EWkWC}I6P z*)6IXD`~{M`Wjuu0`z)a25>LsW6CvF8egegpZ3|_1N&A`5bXYJ3qniFBS1w>=@9|Oeqi)fl zvaR^x9mU$3ArYqmmYq&(Sar2(^Ib2n;m)ZVxUCUiRLEFEG!l{VY?CG23zD~uqZ?Ax zm7&U?5QCQ z+p#kcRmBq?pIKyud*2sVS(;8xG{1i_CyxP}Qx8&?uixd$RI;g26?2Op;Ra+M3} zd(nZ|0?_2nLRss`TRrD}UaKG1o=&N+Od?iSVcwQbr2m@CX7U3|GmVLjHMFvd>goy? zilvB*#N_fg9uwLGaW0NbFa({Huk+z*^}6%QTS-aj>0A>1&AQOUH-HpLyfl4Y*P@`NX1|j-xLNNnUb<}O z&?y(w)&6wQo5b>k%VE_3P}BRPRloCHd{ukO0rP*um{+)FqkeG0ZZ_SEf>qQ6(K)J2 zCx3rF1(n!dQ1!IwNnV3K%*FWlPQoY6@YdEw7kx5C@Hn`a3)o8UtueEzXi7I4})+pH}XZQ z6PswZD7NU_WvRir@m*F}>#r@cDplr9yAZ;c&T*+D07-qE|1AI9gqs*tDBp>czGrMB zTJNATMgwf=BDv%(`xkz}`Cs3^6NQ0Zcs^!f`Yrk}bn@A6t`om`sLP7KC;xMo`r{T( zqzrmk2g9~!@r}^@j~5I?V)0ceO%Axd#3UrU3PBI*Ki@O%HWlpAVj*WM7i3DtW?~K> zd{o$mUXm_YL7l<*ySf^Yl9HD1BN_BPvVh6Q_u(t6xs?@cK{doG>6Uo1@ZlMH$nfpn zN9dffl)p3;?slUl0Ki1_!opz!L7$T*ftrjwW4@7Ol>FbI2vI7S@W>Ig?t<^IB+q#- z@t+&qWgp_JN{UO~Qw`e}{rWdpY#aD>k=v||PxHoPv%IQE*m3JjDo?F5JM$=?9y)+$ zg6P1ASF?hj)BulAgso9ydpQ%4Z$knTP(AfBh`ne#nsc9Z3FHdk{BG2vR0YH>9e|(o4 zd{F@k0z$CO3EwMTlmx~6!cVj>&XqG}5PV<|F-Sskq{9J`1-pQUjlJgJ=x8}b$|Z7- z0+P~#fQ)Q*aWR@y4pv}bbN$TO*%?TF&j9WN94ptz$c~0(PpNqj+^2p;{i%ub>s{&? zUV~2D)58%2@bq?~;P`m`=)KQC%<9W0B@!`Vl$Vckygg@%A>u+QEiHW-UCs!9>6#f! z`BaIK2KS8<7M7X$um|BA`Zrp3M)rtti>0q!UpH##624c+zFkS-D|t;aTr@7@ucorD z7E6L&8Yxj28yoayGJ=Xo6MoK=(qQWf$q=PdptEr6QHPMwVZ<}jIg4jByq61|H$`#~R%!%|xU%zI`5OTFr<}klj5C6N^z{C9Er`H!I4h|>? zKt)9b2cTgtlA1~kmIjo5a7}4Ms%UEWsqEX7Rf9J_IZ(-j++3`b_rKY)X`O$2JaT=i zBXCAV)$_8fP;vzbI35UrYa1J?dj=e~FGZ{<&Qss#H8rJISHIY|v30aq(GwTt;(`fi za3)*@vg?b{la}i5pS!x?qoS;&edx7BH$q>$Znr*NC?3*6t! zLVl}t<(9OJ!h=E-C`rvWTmO7anXi&lG#k#8R#k;pQc8gM-2O$J+#LrHrEX;1cQkVu zYNr50@EG^-oFD1W88`SpiGi0r)?-a?H9&b=%H!G)0;-^wUGS0`VetLd4AAo^!-!?yVCQ+8x)y*(WeE@`D#m5(?_cBf)l|+XY`{InW{UFQE zaZL)1Rxa*awQ6Ti?B1Tp78()fM@%sdbXAPAUmhp0{@0yO@5sb^zyUkDyZ@}N{;Vr3 z&ak#kx6-i~lsY=}`>N@2b4eU@s7RQZ(VK3XLifzj2uo2+Fy{2s3E=c4oz_QMNHRh4 z(ANiR(6plDzV3DJ%;7CkO?e9y-O%Ze^0Bv6(U>~?@LT3yShT`bQ`%mPgN@`s{|ZYqlM~t|4j0`9E}HSR{6bs zKW4&R#eH+Tm&lv!=wLC*Gdk2WQH3gg?~wZE6Aqx@yvw4^g6@yrpvuR{!LeOstIfs3 z1F9NK3h4sRfL*v9-ZxGA;l9{gaM-UbCY=&n*$p`$3H}W|5^ewqU{|U z4H+6jb342y19G?7kVjYotz5$A&s{)r2JKR$&3^CX!_e>WfrMRh&_!s zv7Yw&4X1F5B3${?=llDtFHA{pFZa~V70p`x9$;R*eLJOCw3m|j}W zlEIJ=k+&-?4@3gT&mcj;KgWM6>ihWV9W^(30}^-IWoKtsJ2k*$Irp>s_K%k2kG=UXL&L%-y?%?cjFID+NmU&m?=iIB*?MP5z)hsH zvA=D8JS{sr)biu_=Nz5w zqzXsrn*J5}F|J|N^jN$5M^|@+m&r&=1wq``3}^To@!TH$=EH9_aLRg^$91;3_ne%; zzC*mcYvX>+*bY=3SemX`rN_$7+1vAV<9?y-Rgvdi_ntKs+~Br4OwJwkFy|{^;Iy=~ zkCjxXs#3c@>sn6qtPKqdJ;uiID&zIexL-wmKiW4!j_|5FB1*S#IrQwTPFMbag_=iib+$Dr)%S?EeCtT7;#yRV5aSmqwk!nlr7u6fR2=$HuWHWTUVe$kP4r%Z^3kQd zMUl^m4tcxzRB@tW{ie{%i44hV!w|VC-itO0GfB!qbkTUGW#$oqW*?t)RqDJ;QWv+d}+?c@WJW%cAtvOId z>=5(Hh0%qEUkMiR3iErN#&sAFH%;CgR~hr(wv0v@ zPQF1wh6P@aZ;W@iO!hpXPJMXmy^%jm+Z$zY$g1C2907sUR6-gh>T*MwO zT-7HRdGr<|Jvce{oG6uh?mbJJESDIeMoCUiN~(wypsz*5NlH%gc)#sQPR`meft+Vy zVU?N2P2ejHEth(_ry{fVI4z@$W?NcW+Kmc(P;dz71s5as9v@0%^#f?2lwKyItoM9| z_J@VJ`9Y4cb@n+qnJM4h9(vEBW)}1!*y_mGI*8=Hd~NUgUO6XFOrz!{#sRej*V9x1 zY`2b%j-?f4eeUIfLrsMuC^C{Vhi?s%$wv(gYHRD_;^GdT_(3~R9Z}b0R&nPnJG)=T zG|vJh)rswW*%uE#R*qx(tyzUui?I<{kVo*=v$nU6E}05|O-!xnRqy1YVXG!JX1aui zsY0o}eXsrF7ks@a&h;dIc4x&^SS5X5g3h&5TtX5&@z+#m%FZ?GgwH!@v~ZFgv!}&7 zVuxR-Rk#^0WsAB+-(Oy$ISCMkQk(IK@vg29Pph*>QVUK4Mt=HoaEW`vrM0bDOWGox zO#{;FI-1VO%E;{D6MjbE-lbe`RyK|V%B@S9nwoicC_OEiiNJxp!}^Ix8l*l|+ARe% zfc1vTq#c|15ZP*Rq#zht!b(H)(Z=H`hJ-Rk})OLv;{=65U!@97@*mWws6mAxj> zdWwrHoQayX?|{n#UD$ExV#V`#16 z_;6u3)?10@=lo2y-FSZCRb##K_6Ye)O*c!Py>ztyNir*3dM?ZoH!8#R-KuM{|I)kM z+y;Bi95&3piU{gHNb5_et#748+FQy(ph{_YN5jqISYa{J7EGjIL$wkFUhFC?&fI%S z|LttVow?EU?=JJQj8|>KS%%1#<2^pbMDq_2M}DPBlFEdh$-_USKDHnB4=}6somfbf`WXlAn*Y-x+*g znrP~A($YT!I>Mg*e$`&dPLcLpx8$&7XAK7jdJ78+Y(CopE=nNwhKFlUchY|TT-eh# zOYNRD`}I;yRI`8PN9$z`jr!d64yeQ$8QCht3k-GsnwYS79UV=4rRX(jd;7Jfrly%$ zsZic|dcMCsHu@Bmco0gjV`FRL{hlnVxT+;GV*$CjxnT>8Z9Mj8&1o!wq1Q^hxsDLg z0FY;zepXc1Ov>dgMX-dl`Uui40^_S`24o#>5!LJ1_|Ta}1=&yca05GJ0FYH|aq7YL zBZOM5h3)KLor=BZix>UEo~rdS z%5MkoZHlcXw0_6f>+0zvE<-Qakf^S3Sp&jEbxTVta~n0Ncr-^&v2k*Gv#UEtfzlXI)L*q8iB3a&j!p%zH7rpqMdkdt3EPPfl8TJy7jlRD@E; z{o0m?j*hl85BXgN^d@4PPq1R*D1KZf>Ky~RfikjwA`pAfbZ;v$o@Uh<@r{N$F zKV%fQ^iasITY#w}SJpz&hso!}kL5)&uiEwNtJkmRgFf=LCZ4(6K!9z);Sz!szT*X6D)*$G-HYKuXehVC{oBX5ZQSTLa)$ zc;{oDE-mCUKRX$HROwN1n4{qaMd^->qAKL4v-fjyf|-0k*gx3%$<9}N!wN4KCB6OF zO5xIzMf&v$6?Zb^pWbBn_c!s*H#gf3+jlK~{*dOh=q?~k{OuztRX@KA(P6SyUuq6# zXc%9-c&Sxj)5d);mY9ZeiCJft@Qax?fZp4r6JW`1aHzLy7hE zZYAQ1UbzWo{p|t_`TzdCf4{iKzKzD7(G6t&y>wqQzwO((a~HizQB~t};SQm_XDyjx zVti*;?k6KtP5!XFq=ZkXgL|-Y>{SC}1BKxGpH@GW61U`Ldptq5-YCVoa=#3(8~jR) z)A)k8ZgQJ)aI6bVQ_nhLo)IEMQ|QmMa!Eah{u&;5xN*bAwDe5g+|XpN2nTFECQgj_E$ZgBm&sE&?~m(grCq0ED6L;Au6($%5b zXy`NfjPfggoaf?Gvl`XI#crXIK0FSg^D32@pM=02+H+JW_d@)JC?=bd&CkTd^jD#a z3!FAm=g+SK@kHpC2vY>~DSK3#?u_RbV`Z))G-1%Fk-DHWN7yr;`YyYA&6@QaHjr=U zrR!HhuEHb0A!d}>A`q+InUbZDFAF_0);DA+Nm@DE@7}#j%FEAhJzkJ2$f{2aqHl=< z0vp5}NK~Afp=!mZJ__aCUC2ctM#bL|1G{lI2kBW*(1mm7NYHblX1^U45fB*aiDREW ziHeGe;eDv_G^S{8ggl;xJUusbTLAY`3=xrT)GzAtIQ1?19uR&Ns83O0heXr@*WT9F z2Js9C(oF#u-7ZF7hbn&It+TUp(v|deW@cviV19>bR@l=BPtL$_Lt-eu6?zw$hr2A> z6V?LAQlt<$-DwZ3X1l|xYu`@?@iq1$!qcf9b+qnoYAPoQ@-*zu z#+!@OZkGBo^Y*O1T<9!>2gw?65zdMW78YqAQ*SodoWGgc30daE)Rb7f%G(>Iz5?a@ z1?{$GYRJmT$>pc=eSrUMVscV6T4`dY)r@bCJ7il>48hpOg;{jb#rah&q{4N53DTx4t3pfD^oj{Ibmq(+j4ec)#8tt1 zf)1;&r=77L-U$QKkrOAp3?iJK<1s=7LawL4#{$XwrQ5f8unR$87XVYjj;&iih*0O{ zQ5RbKVW=*4exjIhFZYcLUXw5b96EF6UB~54hmjM6!u$5nc0%S4LFGbSG`7JnU%%qQ zJ`%GH%Ak3;&A@`Nz+2IahwaHI5-zel;aw5L3;EH5+_0(@Tp&A-o6Z=&bxgNF~d@84g6`k38Fa`rS=yUT`O*A$88(481kDm!DGnmx_wfdugjOdj#x$9(=Ov#P#|(#dlEelN;C|^fa12Hpzx{2Ccw) zd@o3LStTW3=MKo=ue`as3O9~ROZ?ch2${VngHQJ_2}xlig-d1s>4>uz?kg(BtptZE*3EUfM=3T z`V>4*PCb;?&gHC*C;CWg$rN$Xo3B)s#uM0+bnUv=!Yxq*0cbN6*$`7Es@i;duzs|& zu(0ur1PB0dQY7HNzJY-?KNEGAHUwO}IjY~3=rF2E_|(E3C#5m)bHyUdHCOHR^uV7b z`c$YT>qgbUZN9H}`Hv;SKG)I`0+3n*3V)sMIHtyR<1bL+dan)7^203hF$xj5JAekGC@`h*-)JFg;I^3`; zkO(!WxAzuELy5l0X9NTqADch{;z(&w|Ao01gS`v%C-ln`KYw-ssS;n|>A5M~{`=nV z)e+usqIPx`R{h{Xp#m1fFgb(2oP&j(1dJP#4jnz}jz5Lm*-I_49}cI_kh8)*EFhl= z6=qc3(59!!4qA};4UD@`&te7c#NMS}NiXTS=jC{RQVJeak-V5tmNh?2u!OG**9S2( z-<$)@AAgubBM(o{78P0%!$&ArzIpS zqYHvYj6bU`8ZRwSKnqyFTVwO1MdIAKb1%L?^!2L$!uBiP3CcNy6XWB@d+^y^H#6Jv z0lr&EW!IoGg*iR-b+<0zO(i6_uy&wBG?!5=lkmb|6n#FoLUXICmX;^b0MI%lTa%FU zjtsazd}uj8c~i%6;;Vq(2-Fe=)#1c=L_tN1dd1J8eP%xq<9fThKf+)q4^#`)3_|@x ztjJP)2YdONHEV*;+H$1k&uAputLEQ^dUK(W@Y5koPp2{RTRtEN>dC;ut=qTXFDw)( zTx=gF*Pk+J;mNi6QMOyx@tXOqhF*v7!3IG>cTR(ikHi-fo1IB(Rzr>u@KhS77}dh$ z45)CTnCVdW^AuzCYDv1MXPkCrcAktX%bUvHvR->mkXGdAjfZ9L1FNYf9TjCwpEP)c z^=|0vUx)b<)?X6HSP<7fFgN;!g?WXAX}iX1g0D+^^Cr&v;%!7@xSYrC32Bm055^)! zI9t@1f-N9EF7Cs}k1szGaxTVq6-yAHL#h;K5t1{Ub;0_pB~@UP$B$)hWP6yHH7~_z zqOO~8%ocX2ZfdW72m|L|vv05^gZa4x3Ygw2rs~=sCdmb-H$4jvmjh@ZJ9)rvUo#Wp zdxRNz1q^8;-X0n0naqWe9|oD;M!tzul+QJihG{;@R!2Mb<+!?fZQ6~}?Fg8qxWrA5 zKen~yRlVLEi2%K>p(d!WxZr7%{7Z#M1=dX(?uXLab&FbBa%FeKFX)(w&88nph<@fj~MS&o+YgnB-{?lQN{HNwrr z!1xm5c(~^Q{aT;U8Xhb z%BOpW72C+X4iG&rZDgeBzH$u{mmO~TUHE-rmVdtrzu&2X=$_<;h_K}U)A`An2Qv%* zqy_j7ti8m^YrhYPNbnhp!`Wt?rk2{TZmMR64T~%< zFC%Z@iPr&jK_-(=Ng%0wbwYZ(Jv88tvuIyFhYJ@Ny1BsVEIF@|1sr~ zva;3iU-y!Q&>*I={CFCh6D8PqcA1o;;iKCMO+d_ic1$wr>;2?ol=_2fB z`$7%=1V#piFLqg;VkB(*ReAPPXOJq8U<@1pFo((>O3!j6BgjnV=I6IDGNyL!e);kx zuEh^s1p?s#dFwcD38e&7{l~Ao6)!A+k5N%cN%Z>l!{p2my#7il9tOC6#Cw{9M~=9{ z(ZA#X7y%7qST|>=;c3*zu{EHoUi9YL=V{&38#ZoSzj?DnybAvC@_U=)0vWL%x>yXo zV!kEoh*%EI=>$C8R&cCxb8|m>@?;GPAa~$R`3Yp=gS`<^j^Ac$EM9exgX1aARY1oIAcSj({CP_=t!?>t0@v?gsc-J(L*4=N#s}Oru$Tez z1?&tWc-Zi11Pj`8cREgO2H%Vf&Q~>2Z33EqB`qx(aq&NZ!f@HXp`jHBFcPS(qR30M z+gNa#Xf}wL5TQku#W>G!iw*Q(jpAO&De`c z5DOneJO{dV1Mz9OFl_`FO-~hlEJ=7i@hotY>FBM{fn7feZyNg z?r5@Hu=KsRNFUy3-t}P>va`7HV~%4v1LTS=n>M{R>ns2@551!u@(|g71ULC@MuQ64 zkf4}bTlatQ*a2{$42}zp5(qMzg(apjhzt7=?EI1!FK!_6Of;)_Ddo)or4QekYK0v~ z<@#_tgyjVq-eBaDUE|}`!KVy}W(lyGli);pfGp3CNXn34A_a*{)$7Q!_oV0DfQU=_ zUJ(pQ&ko=c0yQI-*BJSML;`;bK)-$G&ex1)*|7RQ=g@u(PbUKd16Evlm&vwDV^r`2 zk$_=L^XUt?B$=R-_rUf|z+20WMif|{K|Ds=H|{!4v=wQ~v#;w~NSyI{Sq=$GYSHoz69ZV) z;4utDL?awnggJIe(Aao{-esV#Z%@O@WwzilKfq%6E!UbIkN^{>V6Nv0&2yyDuh5tQ zUb=Abm>gQ~KA;E0pMU-tmzkuI%yQ_^z2&9FsWz+XZCkgV!yaZ~ZJnIfhT(<{sT&jk zf-UCdMGyg1RaKj-5?|FAqF4|Gya~LZVL?=6dwV})9U*JkL?XHeAmJsRCsv=IudgTu z4nDV7(5RmK`D?$m8@)jVEDcQ|V7bLYBRq8{vN&qqBxLzLe_jO56@j5hFxfgz*GR#o z|12b=3}i>}$!qr&S5|zKELOY>T+i^P)+MTQqUHwsCr?}(s_xAhMmrGvum0@%2u8+N zF-o#QqY63~T-NrjTki%2?nX_i8;Mos^Nr|s1NSiDDI=3F!iEW}+qK4|E5t1-u)fL2 z_)=Tz3yEuPRS*E;1{EE{H4rkH5e47!*})pufe4py7*V-ylx#)X?y@I?lU@%GFDN9W z7A7c!K0|OmPm(Y3BqjU+nFIrCF-+2=Ik@>)IXH@HYPRw5@qs9{U!pXv`rKNGU@!GT zTJ+Ni?WUA)FSh*_3&+WY*CYe%2h13^=l--{6>0=wIN-`d(N+7&ZZPulc1mfsvXk>LH$)VM~X$XU(A2I9s+9ka3?=ZW+D z+pXL5U67Gw9;YL2#?Ux9Ts++K@nL=n?WtI~k5!FTk=$$D*6#Oy)OSN=XK%ysuBQsb zEr|+VNIdG(blvQvUfGQ{Ev-!)da1Xhx(s>m&^jOcO^1IGi)^UgynE-a>jrRY@@wwX zbd`4@B)FoFo-?o6G>))w-@`*Xc?fe8z%8Ma!X9uD2#>rZE+Ns7gQBM(7)4pYe&P{> zodCaQaWC zEYv8%am&5q_8WIduy{ck9@#`iG?R zBaLKzKugfe=uR}hyf{9RL};xrUg==fi1e8tJD2i+*erX#tY4y{zl9)B;^(HO-Eds3 zv%m*$J)} ztTw)5ft&I}6T{}cTl%oqPDaM+&gB_CaH>+bZXHKQ0gTTxG(7=AA;{7kbOM0s^5Dsn ze?H47t0D+83idN1mUCfmU@DiX@ztS)|MsoI!j9k*tpdV>UJ$mxw zGhFyTKxJZKBOU1mTU=?j=p!co8nZ3bBgkKS+p#uK1oBiDw0MK)iLia%MUOP6Y8~Jr z@R)=I0LF!%z1||H*^02|gz$CPxq=f*L*qGo57Fm{M6-pVkLYIv&IPP>S8p$2!oaS2 z6O1vS4{@O&LZJgorZZ@m;mIiUYPK!>0~8Jm505|iL3BST)-=ms`{9LIfiwmNK^B#i zbn6i{%-vfGn!7~*oUnVw^p;^Z;#KlOA@&FofjFR_;6}$8fLsXQ{s8+=bWT7P1Cj&` zE|=ji_5T$#bPh)AlUcMB2*vJOi#q1NNBTxa9t4+yQcHsE@mBE4bM52KG#^e?3yPu3 z3byHpOFe?v$C7VE31D59nS;UPQP zbFBNS-no4GbV_kE#H$2*hFI!|#v?@KYr&pS-z-;^mU59hQDd~rKvv5LsIFfT^ih|( zppIOjw7Pl#F8zMwfk^id0Ezq&$eQRgKy;}=h5vtn9-X=b^7HZtMjwkM7B~_0tv7(- za6*&JZEO&f?r#yEy9-hgMUp5^qCwI9wHt%Lnf?vAtuq_J8Yn}{1n_J}h%y4&UM$r4 zqLm69w?oBiPzN89XIDSQ!D0F{VW_Cc5C9Ihmz)ctkf^eON+mhY_Xh&EY(H?o3+ygZ zBo2Ea!-aAt_@8Ey$IfWWF(PFR1eS&=LQNhXm9WW^NtXrA}vzxou0(_ z5pzM;aYDj%#7M?dUWl?29N~A&@+2-Nys6>^AL=O%U1MWa5mfZi-MG;nq&HCw!dwG% z_IdGQ@xz&Y#9*OKJreTYFgCWZvH>BHX!wD0=E9-1sfEh|zsKpA%=Yc3L%BATTPod; z>I@VYH=jzVIP0?b>@T++*jqPybhOcB^d*qb{MxmWM|}Woyc}v}mA~@H`plkoAqP(^6!9Ao4%4=Pvur%)}B}Y zhry@yln8TlPEc_0t2ZiwcIOFr_UAQ!f?%8#ni;>QsH9Qm&9{Be*r~W=v26rIv>O%7 z(mR~IbHl$>P1NeW_$|wL^!&)bRbwPCkKTgvu{4e~*s*H2NAz}{y>SFUg3AW*8#ll+gK z$NVg;EV$lz=D$5~FREdbe=hoO5|AzT)I|8S6fQpsOHQuozh!c3v+&Z12Zq8cykhPO zX8s~3xo%IRSX2#cWpMRHe!K~UgN~B4q}D7GqW)RAOCCH9LOdxFP76dbOOSDr4XQ#_ z*e>6a8xr(AxR{yOLbtHw4K@#d;eWbrNnqb&3by#~TU_SE{Dx;ICwsvEBy;^BI)o8; zHepsV6Rl6c@eLuPo0*vbEu;vaany;9)OZtRg82p6<*;Ai_Mhlr1j!>mI$@o^*>PuF z2pKvu)N}Qr1gFJFos%LFtQ30FVugAoBszqm;G_5D(YDI%dRRH6=;&x9Sa2tNZPInA z#C97Jz5MX{2~JKk%O#YIP!>tUe=JRuI0*9z{D7uukRV|d5H&3<6?&5iXIYaMc2Ai2g%Fr!*8#!0ymSxGeLN@L7LjE`iHR zOG-$DNCfl-BnD6fBd86Iz*W`TZrd4+po(CcjxJKzm+bNJxbNd)4>#4MX1{*@2Z5x3 zT?vgu0~ySQB>EWvdwwb}-v~&JRR0)+igW|Oc4!v2i3EKZASrA_@X91O5(u2;KZHwH^s>ssx4p>++H7b!FPg9%_GAklP z3MG@EHCb>P85k%=k1R^Lh#@uQx6T6O4*6>Vdai{#&0KNv)z(I<6yV>crbQrLRjNQ@ z19_=nk{qH#5ur!` zWvXE^vFxPLa5{0O9Ktf(*4)CvCnt(-aCMI#}0&bbNHE=T)NHXS+fL5V%SV_qR z)LzS>`=|yz2m0g>f-GH7{;0sOa~yOmLE=I(fx2_VNvrQNBx2yfI}_vq+U5b^uKwAm zX@>SH6-W#SWPq~q5kbNIcR`>c&RLV7ETK(FEm&Z~WAWU_N3?ZCQ<*(T|DkTEZ^}lU745+^k2Dg*w2I1? zEh4`@AZ0LSa@x{T2!;T}F@Yo5XOK-zxQqO{2ZnmX_&!&RyEaNhI1YCM493Sbvpmu3 z>US<6gI0kM_5jroH35)DJucK)mwA-k*Ab-XJa|ri$OBNVK78twALtsvcjvS2UHkkn z4NaEO74#8Gm$*14bk_vI9`{KbtO}m5Ir z=w}FR;kv6>veP3?-Y!ccx&(O%Zp)&tWSf(Awb1N-D2oZo64iSpG+h8g1T^rixgqaF zEqY$=<+}a{zVS0k{3x-UwCuZp*2M5jUIXt#uyCu^tOGHXEYO?u_8-bP;`lhcB$WpW z(0}?cE9)bunj#Pgh(=E5FjjWU^8;Aij-bhamL7w+?j9U0!AxI;{G&T(Ae?Bu44%+@ zX~7x~uo$3KTkil7V}QB7qB+@?En5I~q9SG^m)>9hx&g3##OZ{3vW6P~Mlx42`nRGF z@HWUZ zd>i&jX`)VOfDHo4*hzz`{e&RJVS4a9yar(=X$4L#$(nqS&tdSHaFY)n{6RwL{VVPR zx&rh_f^$hfvn2~vEkg!Ezu~T}sJIPqtq7VCN_F-Q@EH$KhUQrJ`wVEhRYF|nbux~uBqIR?y z%=GA9m6MZ01P*9rLQs+=^k{~LhFhNOnKD9aRV2r6L2 zZDM!C{B*dg4Uz3aVP!=HwBhx|H!)_Ac-0Ku=6!xA2*TFMPa8Rj1A5T)s|=9NZa6-c zUR9l9V+HkWMP>ibBgo*nhdlDCQT=_Bm8B0bP{le?Gy(zw^o)#* z0=8o^3JO~}B-=)IvfYX4?db_Rd2KbZ$k4=bAU-zSfptd-?h;ytPau~td|LSq0dPBl zdERU~usImb<4_%9W@jh*|Dnj(=2=5fvYUOyI}C^!0%{Wva@Zx@VfYw&%`ii4K-65wz2tv@j|LFECvAgM71qqdHN`_J^JHy*=B@LZm>Rn2ev#v z=UjJp8iLS5`2uVaT4G#)c?T_fp(r>74jjuty;n3~p@(Q!_iqU9%^kKyaSYjDV}Z(v zfDIwdnt*(Fz!Svnhluy}Y=zh&@jn!kqEUw7)p0Kx?aY-4=5|B2Ge~v$pHmY}gPaA1 zO6=(}sLBzE5+D@#W@(Wx-Pd-Yn>jQnM60~|dVkb6c3?0edmJ`-Qgj*JT_GSLH0kK5 zw=}|me7@$I?=$mDO__-XQ5&Q}g`c#T1u5R_m~VA|z~RV1bLUP}S$})^0QIz)e!uax z6Z8=;iR-kqOyCtlIzdB2<2qbYT^;-C)u*n0gl1H7lP&1qJ%%9t$dRZXi7-936B*`mqf?J)FQPP*ukean|kPX#sV^dFPGL!QVgtx->~5c zu=prpqO;Eo6VkR|P(MS`;ToPg}3aK}NywGm&&6OVTI5lr#`Yw26oBD-?wJ+!$ z{&CBsl#}(OfX8vx zP!a)KZ1n8h)gcC%M6(i=@gdw zO-wudZ^ajG{jR%zpAjKxJn6=Jr8zSq`PZAl;hOoEPvwaZ=}~OxW2$XwN#O4>+_oaV zpffq}a7C7(7YkX2SEe;6`_cc`$S?i_l8YCYu+Rmz2P-(zc%wm=|v5rU^n%1sJ0>HQ`sHlje&pS?W zL@#vo{+=#}nt_nuAqVpsoA5x}<}&|d0OY3}=YCQd(Ae!Cz(@ zZ#j>2di@^(S{I5xrVe@@yK>sdBSy_x_C-42b}0*ocKKqJuzY$IsP`WQz9Ac>+w!5jL&K@fO>Ohb^8(x1K+WL(8r zF!#!s5Z6BT_704Qh(HM|h1a-|RZvh1L!<$9uCeoY-qceJQvbj}ESNV9?51kP?g^?j z)(53gwzpVHcHg{@CARJg*-4Q4YwBi-D~|mjT6)uS-*~j^goX-*hL*%y=ipzBn5<4jm%Z)mVVMS5z1K5xw7DUj{lK-QAJC^$SpBKVXL5O5U*0YHOYH%3A$ ztD_Sh%x4x3UNsCa03;DFAYYKd3qy^`FRo-5`rrjL9w2nwexaeaz|ma=b~Z%QQ!>sC zF%z&JzJW3#y6Llk;Rj+Y13V7nOGQ`OVC1v`xx|SXT&M!0tM-oFyA4pUx#`KJk1~xu zFzWZw=5)d-r4Lmo%h997I7_e@9U(&?RS3d9*>QmzZ3$9JD=Ka;MPDPI{4jS%Aslr22#hIp`<^Pw(ZG;})z=~WYNHe@2fc+M}7 z>;^$``2rbF$k7PL+66P$1mzm*Hvp?U_UthvZr|Ct0NMO=X<1nzGbjH{T4-5hRaE>z zQ0Kq~8dnudBBdD78NJqx-v0|Hz`d_FXPMkj>n=8)KO2rsoCh0pB@6}Fd@st$HDa%( zL;r8|=R{Y04b-Dra;##}J?XGCy}<1_K$pJW-Y6vN#;B;diby?(lw2D<}Xci z`gfT$zm-5LpoUUJKv2+N3l-v{o%{DYe#{BB5^jSyv}eH_>HS5sA zb-o`hq+^qpX!;05N`VNN4R_Sh(SbFgjzpC?K!@>WvMW6=xun~?q^SwVZRj-oI!+>S zJbZLq%-sA9gY(?AA84J80o2GO2f%^l5B)b}TK(vzLa+Hb55c=Pcv$iQAJVvjO+sym+wzsuiG-1aa<)v|PaUr_E z%l}$l_bp`&@}2p)Ie+6;x+^rKyNNX0?4KgJRe&s2z`X0OCszwJC1`C;w`WfrXaJm{ z5NAEo=+JeKrXC_NM26A(2DArg-HBsqFo?R~#fEF5+?k9%+{O9zldsoprtfozxMnYW zZ3**T2LQMZ;&{+huTeB)KXm9kHsR+?IHExf)dG4x(@-54M+lZ=!{*JZAikjwM(h1E zoA;bNXFXi6h@h4f?gzXZhb)R*ALoNIhIY3GvQJ8_x5#oFlCqI|Gz0>{%pWv2>xM>)pB`L9@l(nlvEG%PK4TUAReIY*OOkIDSb3hTKMz>~3HBo<6Q_&In5|(g1q)fcG2Nk4iamm)7H}l0o;1eQXoxma+ z!X&Lx=$ubvp(w;5*BC?$QpB2Wu$ug)=WPV|gBY$NF8*b0)H$W#z}IMThG7bYq@RwS zJ^_Xibrg5itj;wg3<^B*@@l{lGjzLl#ekBKjS$x6-#zEt^d#98V>SdgZXGm03DZHV zNH%RsO0>Z&vh?bP=CzHSbj>+Y4M77sceE#tFsR%uENpmJaq3D4uS-FA_{jpLfmwDv zPsn~^KnIr9)lKDf9zfQF$_qQ?Z7OjV49Y(22M>NAYvIDt=p-3YBqDnp^$Ip2A#HeR z2E5K%5Br1sR2>VXuU1u3g3Vk`+q|`3_3~xb*gE?wtt;0L;jn_7+*5K>ic`&xz)adu zxmZdIiR9ne&r|zR%sn7HT!#`Ul%$#-^Y(3e@)7Q{N8gL8=f<=0@nv)CW?5TVDI>|@ zG+u;8g^qpz+M|WYPdWQ(rGoFNA#LCAV_Y4RAnCYI-m8s9R>jl^5%8ZwQUt7-AJe#QQ6Lt|qp;XXdYd-q;xc)yNB`at(7 zHhmR|bk*z8A0*OU-orTBhSZoc^k{nGdkZ=Wk^;Klid?o55bC{H5v9bF^Rh-&NCa=} zOelX^LeI-)v(`TWht_hKrCxIB=ED0&wQR(7)T4?5f{N(^brm9=7L{)sEVd@xVZ)0} zp~f>pKEfRxWt^;WV@CLmmS0LU@y+M@4;}vJ%gDrGJT}tO9;a`$ydHP{mO2_5YUve^ zk=DpGOo>a;?jMtzT}>jXWV3mfY<_Y27^Ot<>vBp2xgkk4g{zsrd4b0$iuhaHX@H;@ z@ii9%r21?{Mw>o3J2kvH?`r8iF*~K2YU-mgnH?a`gmF-fEYsarRaL5(9KxGi+>n=| zpQF26poE@5H$CHPomQ*wYg|R@618*fUW*Er<_V1q1>~tjaEF=;#hPr5ft~d9Y$*OW zC8NQ<0LZ1xs!~ZA8Bd~{e|z0sw_yz$g3-fv#qK0Rx?3(L9uDg303v%6EG@(|MDdU9 z$PqF0I%yC{g`*Bfj7TGk0+AenoUyF>dbe z@3WYt2}*)k{%vhqUW_6-h>S3{*7`DE((*>zs`L)K-p!eYH9hwY9IT|3Nn2#R4>c_y}<;tUNp_&`hRxI4_#; zhsgmq7G+k0kq+EYFU4Rlj-6K(s}IeK2(X8$du0$;R7H*pn5>k6Ayg(@k@s0kEDOic z(`nQA@_@*~MpT9y#5UiV@RTZbcH>>NW(<}STLwp;I;D4kPoo&8?#wp%^)}~^Qo(!3s09^|& ziUKU0oYg2yR%aMDRpA9u(fh;;C}sI1KdbT34jOqga>sK5UA>fdX%JBMKPnxE$3eoQt2p3)J0#~J%x%ny`Co_!mGp} z%AP-eZ!a&|-@eaBN~;wo$HW3{q8b2cqCTGbRU9>T6}*$IgG26>+}rVZ5!A)I?>N}x zCTbAGui>NR@~uEg2(k=48DO+#oQDEF_vv_chOC{EyZwBai32|{^7NKlke6*LQmD0GvX-$nzX zYcED{-+YXniStZ0u|%=M>J@n^VteL=Ohj4HHqteIgk2P`+6}b3@F{5L^{_a==O{eD9AkYMO!(TP`h3gDFysPAV{7 zPR`7zIXdPcD`JhGUSKso0Af%K7#SN0l&lHg4OWrNxx{bmC5&{S>Wy*FD2dkrb@p|4 zzXS?^Tp-63dX3%tJ8{hbPH2aw?SPfTi_vQu=RS2xyLUWygo6SWS<6b}?F|p-xo#RK zyuksr6P5QiCOBej7^y6=x8n?gSD3W#7zzRN^D#F-o+tw}Q&1C(M*t&mI?R3XfjSP- z?eA>^nc4vZV6yVg!25|shk&DzXP2gyq7@I#cy87eOm8J>RY}Pivv6RxNeU(4vtobe zK{xgan*-=kP*PkRtJRt^D1fki;8BScAqIKu;ZcJ>zTsH|%n}e1l7M6PBqSx-fV&|Q zZ(OrQFcP#%BB<%zf>wj(XLz7hZg-(Bl~q-#0fRG1L(2Xao(k~MLEs}9#I;=LOV|ZF zK~`b7hN{kv*UR#?zeZi|;zGacaUgMJU}XxJU_)rIAub6VS+gDUumS$eOyFW9v2jQ) ziOCjj*R!57-l+>vO<0zAa7s#3a~X76;jueF}&f#d9 zgG!H8L_~KpJ&yurB$57v2|ML}n%azM1P^2!a55XxZbrwS_n401jVMzpVL`xK2$0GF zpVbg5jRe@nZ>$LiFFqTy_BqqnqM`(#yIf2YOraP&vII<#l)xjpP83yWc;it@Ab)%F z5~wu^5$@OhDI!&an&&0(Cf1rfa+dL7@pl3$w-0FH$#%Lt)@n~BOxxy+nKV@#)7B(EsLDu>n ze7rJ5L|0yZk8b?bVgQ#UHeO}$0{ufn_8sGJj-)tHhD$$xjuLIHE-O=l`5ST=HlAfI zXfh_Jr|YeowAF`~^YR3-8I8ay$Z1VQfTf7akNW@A6wDsVX6>Mi^2=ogQXH!Hhx zb5ssu6oFrL8)uxHoH&ht<@_qQ6E;Rb7QB8&bS$6WZlEUjw9%|BPVGd9`s66!k@+!N zcPSuEm8O)IH%5NXQ)Q3OX1+0QNQ%c>*oQ?J>4DA8Q4%H}-Nt;YF1bMQ^h_GoUPB^v zZRoCR#wWay6bB&tK)-E0{$bp7TYSOJ>W4OfVwrg}V-kOu^KzzN>MmJR!`rIWTkvPu z!y&>u?8oR%6W@MQYbLlvATzaa+LidHY)(uy@oABkTYdh`M-yO;l(g-??uEYofgLNK z);si*X$6B8cmF)N@`Lxk#Key-;EOLG`4=elZ(#Yq=Y@d0Uydta-3E_%Wl%=X>}UA> z!+(BsfGK~Ewb;sIY=O>g<+i@f_cBs1to-gN(XN1ax_5p*0$447e-D~0jQ{@QQ{;Nq z-`6yEbu-?{_TWD;fTiWtM}H50UAOe_Z~WYSe&q*--?Qq!{L%mC$LZhx1-t$H{O?h> z6A<(u=EygTGlIVd@Bf;~@(*SzGp9(z%F_{Ad17khxw+pDQEFw#|F)3-%ZL0%c?tD+Y&OwEZ=Bu@VuEq}q3pr|o8# zN1hKcUUR8m?)={p1OCBd{a0!Hf9sh3|6l&ke8&HWA5^7c`wlD;^&+vF^o%>L_lCnI zGs&&TRHmAq9<$b6yqng*^CGd>W}t$-Ko%?guCZtQ*m{*6*-w6@n8e29=38A3sO%@F z>1n>TF-Z=krV%^uyCSXQG0U3m9sDv|*6e@bhOlsww38x>PfZ0xXkLzAjFTZE+nMTTbALKH4@xkP-BD|OS{NfgD-x^L&FAk> z(J~%Ges2|HdTU!BeR?~;vh`}GOG0BYHiufqLgPycvdN`^ei`lj>GeO-*Ho)FTWCL? zQppN;nijK8Iwd#zK(At!b>;YM+Rg)I@wqpLk{ngR|)Jo%JX*og+K=N9n+B8#HD)StGD7?2ZQ*1Uw38( zCzusnj878FCJ@(MrM$cY^ozG#oPsmt!|t=hbtb#i_&OWn;X2X6qjc5$?uLz3 z!)Zo^eoQBv@1#Gjer{M_R}-DZw-8)VR>`4IJ1k^rYgHF0-I-|RTCANdoV=_RU9A56 z)u-!TqkNh<&1)~V%_e1?H6T|dNKw31I|m~ooCX})V!jAj+Sv~dcHee-zZ5y*tUP(i zP*}K68&==BO}z##tqnAZ8KVmuM^IyuwbB?4i@D0sRTvBn&5@-I(OwSwbU2tYT zcjWX`uTRRnwk#1a6dq@L$D$pSf1qX@F5rMr=*w;)eZ%gGYHjbmQ@2E-BhEz48aT#0 z_2Dc1+?~>s&b%-nQcx$v)typo?_fVT!%>;3KcSwoc=7Qim1pXGxpccilWTj~FZC2t zm9BlfBE%;mN1>m)*>(!?>29;&dlSzb!$td<|#>rr@Eo@mx4&7wYQ|j&#Szx zX#cEDE5D`bN7G{JY4w35pytfdvWhxlIGn`<$gLAiJO-4g+>!7XT7|QdHY*ow*P)+3 zyRa@N=e^N4y>@2l^yR#Zykv)XDQcGQ>&2qmknQu#=7=}VwT|72@y?RH-Of@?uaZe~ z`CQ? z_Mzs<2sw)S%Xrkhx)PE2rYp(j)}o>-^>+4a-NPf80zz}*^590?#~M2hxcdhL546~* z>8IE@S$wbt=_jJPv`Xi${N_}pai_dz{o`iJXK^w{Hs?lYS>uc9 zq?P{`BfQnA*KEmER>r(PKXO>kn%BiH#$NKxGqx)$Z++Ql+ZJb5DDZlVzH^L6>eu0? zV<%LOmdMKs%{j;aU~#b(=M*VO5}+M=)naRs!WX{qLQH%plZjcQ*DD|yq7NITv_{=dPzjO_NdEJ?Bfkjc=aYeTZWf4Rwb84 zXN`B82ik6yZ~AealTkf-Mmr?YbdAW;ygcJzUyY1(?Y;4*Y+1bRxwm=Qd_%%_Xw;Zr6}E;I<414!4rX*1XbUv!UTvrryQ&CgH0|k}{+5?nf!d zW^FvVh$lv&IC3s^Z9x2e_Wu0~+*Cq_Q^g&NuI3iL!wb8l zV{&5^lb!8pFYeW9~WK1sYIj92#Bb3i_+a)N_Tg6cgF!0lm@9ogVNodBHi6_q`SL+55C`f|NnmD z-s>2QA)L+LPpmc9oO3;!AbD9aRAfA4I5;>|32|XXIJl>g;H&%v0{BT7`ZpywxOZ?8 z!XK60lXn-~+%YDue;*w{tvwG=#XtMwNxo>hcu!5OOPl+`Fpd}**%jVOnLdt&TDt@u z9$uj_{g;IKXvnD`HyKG&+yM0I?oCB`_75^adDzg&s>gH!3(G;mj0ud-X%JV%bRC|I zg$1P|U0zu^^!29~B>t~`SNHe7Yi7M?941Z~d}X7kNd4xG&Ed(3#s0Ma;}z{Lv^+d< zV>!{A!z53u8XA&FfBgHs<*3_RZ~F`ToYGvJs*n&Tr>+nGuD>VM)=thV%oSdk|MGbM zPk{o&67RqLd)NSJ5XQe>W{)OS{P*Fsbd>nxMK26k{x=uhuf9b`mynZdF|K1V8??VZ z-J)@n-ou;;`S%!etgdiEqoqIJ%vteFhf-yBCX04xT6p8Zsv)@gx^WDqv9e=6Cl|XJ`I=8ogDb zqX&k&>_|pVUT(ki=_SIm*x1yIFs8q*}N<^uSDIb74a~k^>#oN zyU01|4R9N4wxXnt-Hz&_W*Dh(o1>a6njad15m(b*pgM0<=iT9OH`CC~UjI_n^VCyQ zG_a*=*_R;6j72lpdpc~MzoVzB-BWLOezG220Jq84Na)7T8=rp5eEXGebG!+YJ3zoU zqkN|DhbwnT3IFULx3t}IS~tfsvw1?M(7GnXy@qN*s~n3?N(MPmPa?Yk-Ht(23VfCO znQt{tZG=r_V|Q2E)L=Pg%W7)G3MLF0ao}i!Ry*jTuql49Rcg|mpP$QcyGCohFQ5)1 zSd9KOn@0=hYA5@SC*!dEd?NmN>A7e%ra&6Bi^r+O;9Q4Ti|hv+SAvK);{%21{5=WJ zBypR(%bFIsj3^7D8+qC40H@E4`~2uN*tF^Ddz^}c>v%G|&PcCcx%G`b{jE9@w>upV zPloH%XuR(hIHQvX@LAN3&kOCuxnhITDb;urXA$?N8uO^g!G3oNGgg z91#)mF}nJobV<&;(E2TVT_nW$9{7qTGT#EB^SGY}@m&v@&&|^iu6R51|W|)pbfeL9_f2PgGyLsMZ zdsm0r#^;TZ7$UzaYmd41nXlu54rju1vp*AV^3jow7L} zvlQRpV*a^-@drz0!X=Ep z)moJ^DY31&DCi~5SY%|4DEjMVBxP9d`LR<5WD4t)03#?V;6u^-TLv2PB3Zv^sg=b2 z0n=~g%aY(OmO3kab@$v}boZ^Psy71B$*7-`0?@zw(sjSCWi1ztQ&q9ZOqY%bX)wz0 z=~scO{VHK(t#1UNx+4VvnO1E46iG(huj{Sk0+ND9- z`6eC9Gn&Ft{3{nZW*ULn&Pn2kClioca@jpO4+|B(t~}$e??$wGjo+dJ2A?t-ND_Zv z7_U;ONyZc*AtUj7j2x9r0i{%ekM0ehxudDQ#CUA$8_+&a#O3uElk+hpofV)RP9SPg zF-)M(&c-p-T<8x^4_4X|n^XC+a|L*?sOlf+ca3X&;40+{LR)|6Zej^Qe`sk-mg#~2 zo08MA_V~4!&{pTxY5z7nb*=7(f8~3F7xPuwuXad98obk#x?w!?Z5mwT#o06e%2R{I zP)v7st`p~7VX0C0A1Mmm4EPZhR{^#vdz=AysPJjHgy4L9Sa)Lkn z-~pofSpp5sc+}4i$#!kvn-hE^pBLubO1Rec`2t15ra=BPxh`4K(r?)E3z+YG_6$_- z%mT8k+V;i}88^QVItL-O7#rr7umXsnxcJ0$HPdkk@1fr0=6tSs{ptX2I5!?cWa-b$ z(`q};&h-N{Cw;HCa5b`feZQGfwkC7J$a>h66E0zK4en0s)a$hI;`+JRdbd186+QhY zCM}l2~AqEOdE@GIL!RP6uNb97z8*9m}A#e3a{OH9z2(Pd6^DGuU}aW zY03Hejp#2|-`qId{>D|MpLr!{Zl$;H?*3Y+%dK?|<|&}!`JwAoX4!ck-|gX=E?oVY z-N0c|1GBy{#nVrGC6*{PAc|-TiiOKNV`bm{LXvnaRWbvna<>+Pw39jJmfS`>G@08mmCUZa z%=L92gNCgqunD~13g~^IR~!y~kh|_C`Supw>&2*U zz1;$|Y6S(=jtqwR;asC^3e$?i4mRrup75L+6eEhWcN?FWXyUBR)}r=!Pxfs>TPoa| zf-)uHo1g4g?!WHt5i+}K36iRP*n0Dl5QYg8bW1|V6;Tl9kL=-bQq_v;!YdG1?AeZR zJMKnViRZNWnT6TdnZ%-|aZkwi6V?7|>cP>R)l#ztEfW@azPsR#be%c6+|i z@Vq@O9pui)-K>62!95P~LUiW{pM~lTPf~K*Ttzd9&)%C<&pWI?b7~LnqiQ(nHJ$<| z#5c&fvP6ELnx-4pSj#F@D{MBI{#`T+&zi>%u=T#4o+qd+raEoCsSZ}=*u$>rfAe;Hbk1^alJIE)XOTdP z(I0zPm%r;hkm>4u$_MX#ul+Q>C?<5TzuWtPZN#>BmV1?<2{=N|E!Ez~`v~E?GAmot zbLMkYI2>pc$K@eb9U6-At%)W)Gj&U(AMExzbs|u+RJ45i$-n7cke(dG`Tp*kf)5i7 zOOXwc%~@+T>tggYMDxB~pkydo{X1xkHFOgR(UNmoFD96EL0a3I4w|lcvdgF!-Oh3od#FuE8ufy90~rRz5% zT=9QZ7oS(1c6PxC;TZI=ziN7}>>a2Uz)KaWE^V!R5-g=CCJN`|+&V;Yq{z*}2H#Xg zF@e12N|CsI2p{%UMkMku;3ceAp&+K;e|3sGnTpoz8xvV0Y;<5A;2TH*D#hyJ1O7+x zc(hlt+>N*Mn>>ZjKG<%FihA;Qd|R8|s=P$>`is399un}uR#*1Ee8)1^;2lQ3mB$ zQsa7^n~0zx(Cd41+lAh4dgjmNn)`2OT`@5~T8FG&p|fy)rIHKJ1QAM*;!^9y!(wi2 zMwHC+9nizMDZ-4*(s}CeF5TuY4@n$f7KLWt%=h9~iMq@H{F>Qfbq=-_=^~<=AxsmT ztb5v5KbnqwZp#NRIMf=+S$DTM3M=xp+P`agbGk|VB_IL?tkx;fXeweVF6!?Qh{fs# zR9+$9OlzL$xIDOSr;J3{^;KEp1K50A_GX$IIpW`-1}97OG;e=+05XtO2a-{`gI@(9 z(^h?J!JH_;=?H~r$)dC5(iP1iYBc-L^QHt54P$-gOOjKFS6h%wXW;nZ%=_$f{FgVX zdOmQj=bG9Jghf!y^*BdBvfrnF-J1VUIQb4iOpK7;Hq4w%!63nINS|@Wxu7<^G8i3k z=w6kB!m%QlD-CLP)i+36S^0x3tzTHrqSSh4Yv*go+yo()PMbMnv^R5f=&5%)Vr9n$ z+8vA)k1e&i82W@KSc8Ni$Ny0t-DO}guAHN3+`$Ml$#hFeXM!~>7{AnB#`8bf$G}!q zPf6;BY5GF^79_Y+KUz5K>4{=jj9F|Fpm**(G)1U*rJ8i!CLN*{%GQp_nlL?-m0TYC z4a8tfwh(8uN^j?(fIJ)V5-0WfNTj+`<%;({#&Y`ROQ8Hs4^>K!>0l=E*doz zQpkODMIJiI<7(0b{wKCBuUs8m zU4C~Bg^hJFgG{q#RIn}HIrv-n!BY@_(tCYykuGP8FOzSu_|7t92J){#d#?X*E-VV0U5WB@u*~%h!PlQ<$=Doj5@|vzEod;R z;Nud_Qq*{x-5Z>b&~i!Bmp^^x^b~jNs^9Ylt8;M?T`dB3!$j}Bbt8)UqW&^|Wk1m1 z5LMxfd;_GD)O$M=F*8CPubNJd-+uYjAGCaVJL|@^xi4Nc7)yh#bgAaXMJb#so`)|vdoNrb)oWFkz=}^H2TNGhlap6a6#-Rum}^=C zLCXEQe%MOBVdwabAJB(?Vaw7I-I?W$$UG@VDJEy0&*~CHKruKX#Bg8^nVuv|RY(?Hr)n(qWO_ni?_XYr9WC5iU z%FQn7U;v-6aeRbi-!`#;q~<0DR>EOP`U#M(LAW>`1H?yEz=-KJpR1;0G40p?XMQDm zA`WUNi{pifn)b(koU67;a<)!tL9Jjxo@uJ%ZjFC9;(OVWr(5rkM$!4w`jT)1{jbN;+j;OxQ>MF+5*gR* zM1nhVCb#zPD_^aPr9k+e+y)?-xuf{CE5BM*ot9!TlwUuL833N71eX8wE4HS9 z8l&yPNKnwKc5@nqhX&K+N^RGk@HXkt$_eE&WCzN&3Zt2~0evu<9!9)EamR1S%eM5i z54$TmGIhvC>1Ji(xBsO)pWP;A%Y9hpNWKM(ECw(z_4|9(pVwFWOn&bz!`2bSc@tY_ z#tCly_~_DlfG<#e@9f{!pqRjzg|^sS3~0*cbOxD#uWx*b!0dOu&xl3uebdhK!FW>X zko-lSv(|U$z911k*&5G7mlL>S9D|X;j@=U!2G+dH6-2`J+3|4*Y*E?qo}Ff zI=kj&HL$g@S!e|0J&2QJhI>r8<+7K+Er7QZ;26x=I07y}kNA+?IChF?Mz+=gJMVq3 zyKeG5JPnqeNyl`tKQhEp?EvL{Z^?lH~(h!iM5_vV?COl0(^}ezIzY1wxm7^ z1Nr=1fLV@r=Wc_*`ns3bSdpF8O9XTv@5|1*jOO_va7t!j=~}Q!@3SR#sBbAeg__q> zzb49l29u5K=&EaWKhstODw(M} zBE1uJ`Q54@HoHZu`mljbpyTX*$q9zsIEcj%EBP%T4h7(ms*}|#oUu2Eh&%-r$+pS! zA>FbQ89_TCRFzc>ZhY+iED~I_@eSWm3(%O3CvA<*Ff{9RLmR8`+ibUk{i2Iok#^Yd z&SIPH*^g13b6|n5phKbuzass`o{xJFIWdR0U++IS!upp$Wys9^8A`Ylj{ea02GCq4 z?@t`sd?~}`<1cZizGZlg1wJgjKx#={0b0cZb4gC&BW?qGit$cFS3Iu~rIKlQ`$Wb* zmJRT~`ndgGR3aqZupR?4>68>wxXmbeXPqsoq9U4+ieS0h80XHbkg8 zT_#3*WenEaIEBGl`IZ}z?gP1V7til7G`*W3pd>5@SZ08Cn>~mp(f?Vz&qj)afnwjs zm~xQ*{Pt$8>Jceaq}dZP0LVSX8W2ZLA8OXBd?V9^U~ zh~vHRi{{`by!wYs(3h}+Ot|MoY%gkfi569VeH!sb?|0Kk8MmYIp>fVci zxU1M~XkAHFZZ+ZhRNOY@IACYu_f>P$)PrGI0(aNqNVqMe4asJ&Z)TOi6V)a_iw`2@ z2e#MVnqtzsxi7yV2yigDW(Sl7&ziEznD72Kj7EzCwI19@cN+~?n`fK_5L953D%6Os z%*W55feyyUjwya*NkRLk*GvN+!a?h>o zuZ3zBrKcALpJo^oq;% zrZ+01DPLHiqMmg04ONXmG{O+j0hjIJOj3g+>1F+Cl@J4BviS>96~aC%2D-Aqdqy&n z=s&m2<9KW&Mcyy0mrPVd6)=L2dnp;lR+hH|3(WRBIBn|g!&EetB^(TJUAgIWn~Pnl zw`qbu0XSV3D0_iqQALECh<4-$+IxarDUj~13fowtw#${yFN^W;qEsu z(U=^zKWjpy7-Zk41*N!)q$WQ0?#6S-gJQA~NQ#B92Qf>1Z!DOHFiKa$IDy0h6oaJ5 z@6p=FKMo^pcM(;{&mqyg-Hw1Z=Uw#Uh^ia^X7jj?1f7x*oG4*r2g2iXmo?DnkhdBa zK6{ZNg5Tn4_UZ7@ap{YhXohNm{Yfe0liR;Wnt0lO`hO$lY>@XQ^Znib`h&}MLjPBN zLI3|{hmnesGUmUX$j(A>smy=T)F_>2`)OX`nZpkSFHw@KCc%I)z(>%lFO_JYjl{o8S3dV*cePvqn?*SMnN%J>y33O)@t$L`|{<>6fM*WsKmF}*j?R` z9~2694n&l6b!9a)aQFB3H=VgLL`Wzo0`}%=SX_723(8F^5~8Bs?(Xi|J33lA(*n-& zw~N>}Q>VdISw+QRwfjw~_pyZQ{(R2>2P{-H<5yu}=<%`R{KCS{?fmwcXK!DhgOig` zk*Z#~w}=Ql85vn^ef{$0rnrd-SyomS_-2w?4?Nz&f{LD=9_pDeU>X%2O+`m%(jNFG zj#f{v5HIXI7{I9~9~j>B%naLgBN9nFF`HMKc$lbAgX)AQ>vL36VtvqlA(~NEG#Bg;dAHtv;MyAJF3yy_Jryh40559 zEtBNhbHd`Xt&Byd*-q#-|0O92|L*3ZMiT_(P^HD#;l)K443FZkZ zx9{J}UH3E#aM-P<1>@*-$4gLvgObL`8@%j(tE31nZM+uPgg4Idh2vsVK~t5rNw zZ8JxEb9LB;mcV3$5Fv2S2^Pb7cRCV`51iy6xV^jEnyH{@a64!&tZ%;AZ-CA%kVgjr zOwz2e4U^0=JYMa=z`z)B$6N`{7p)8!^8 zM@L7eyED-s&c_PW7*gGrkrsV!Z2BU^D`xtkbXqt(uCzI_DVB%R+$rIQhxXjAyW#*H zudc3WbsKTi)YST1=1UEp0er>Og+6eviq{S>QmV!0?(ppFF~lBGjWYOatNuHB`f%HY`lW*dxft5~Jp;t~@N z1!K}&9``YLTyN$4+W;Ondbqs2yh8P|uVhltAMx?xux7|3h=JtaovVoem>Bi=L2`1x zP0fO-1z+#rAUPc!YVJPqOpYA!pFe-Z#l`ivMzh*GIwDh3ePp)d;^Mk;(tLVPx5kbx zF3gtOgS-!05us;bF&tJppV))k#G=>k26u&%FPJzzfTh(ediE*mmQ0-h2xPSX`x{{h zP0-Nr{Se;;LCu0IK1inb@7{fm)AdBky?1On>cp227k|w5)r~aYY*0&V=Bgv3qlEy* zg8f3%(9rO{Sa9P#8&`t1^HNa-DP)K;nfBuVTps{q3JMErBHuv&3nKFJ>T0CM4u;SN z4)TEPHuBKX(CCT$AO^P$d3Z^{`2+ZN%NrYAqghfGz)=AQh*l=G?ABTliAkB5A^{`^ ze)K~qvlt`)d3|?Y;(HhJijce1Wk)qRB_${*sC8;8E)1Vzd1;&vPSmi(4 zb~opHRojQNRwYMi54Qmz_8gb~z=IkS7##emWNK=5<9MylyUa%$R$)5ur>)Izb=6q4NK*u?5U9psjZbBaSn+16tgsy%9H1>SN$d{bb^t*h$!)J> z^W`#%>+bZIrY1h{`D1}p)AjfkACCjj1PKjIEK3pWnrwk;(dF&Q5H5!;0dR;ueE9Gz z*ERwC5C0kBt43qJRREojSPF6p>BWoEO6L--ns9(z4q%H87rhP~&UZC_UbDocrVg?U z@wR13M00{_3!o(be6;12xcGKuZca{NIJ4PH%aZU>8?CRYca5kFia0$#E< zXVB;+pKeWJRIt6{DU~_Vo1h0{bKrt`{Uq3;_6oyJk?CdsEyN^C*MU8}H8N zf(r@?(x-NkFm~2blSD$Ws6H!dYUYCv3-wxbpTzk4KNnHJFagnm{F8vs^EBNkOZ{4S z@-%|i{_p2>%HVRxHOY>N2^A_D8YPUZ`;!dH3CJq{?V(Vg4~N}iAsnCsy~R2W7=kk` zzP?5AMn*=l0ALF4EdbwALO>%b1W)Qu;*fK2aZ!1R;5Tt?H9_Gxn9L=4vA@8eu^$0> zjz+|5p64rckXB_iMNL9N0-eeb4O1kSj@MT){o{|+3$O@NB+sWsXFh>i zae)FOmDat#&_IJuE?w#g(?K~q3knSklt15JC`jgqXeKZkd@Tp`uEUz025^sF01f$o zM2Ynb4XI6*=#|U^x+iIBnr+CO5OaCyZZeuF(F+m}Lqs8_zh8O{z`v4ev34G)>Qof6 z$?~0{xEZ$qz=A;xw2#QAbx-Mf$voZ*6#1xxguLB_1~o3{%^&4X8?q+zwGO?%gaTr~ zAw`q*{)ERprA>RL)r*aZNj1cOQ&{f2r6^J|MYFcH)~jXLltrsvD%dkPsJcFwQs8|$ zA_nD;z{JGtMI`qA*?2aoCF$eSTy8${el3h+QNFjgHzqwj9icCc$8B(Xnmk%!rqUvs z*?CjmWN)^r_Ztc}hF|MXoUl%-Yh56`*)jpc@;WDyPs}1a2GL{yPABe8m-)@lYuh$o znS$K`!9l?7{KCx43{-4kZEb=_9xT7`lo4bB$T2>Ud;tXoG#vBx&%i?DRy`zYb#SNb zYpS6FVqIze=7VVHU%=YH0$_uGaQs)R=x~Fnd?Da>Qn+2pt#c;s7x~y&S!06GDUL_P zh@X^#sStVXG9@P`hA1pSh&I2IJ%*=d^gJWJdao7DJ zqST}hi<*Xp%W3^3;Gku}C(FKiHlS>8063MYznh)DKvQ-Lz~OStoG1q)Qg=bEt-TKq z4_7r|U>oJ2rtbY0SZ5PzMZM#dg$o`VDNw7oI5^$lC}yE;(UiEPq#+1G)jsDY15S!=oE6P z#*>8_wG9mwZU?%eVR#)%a(o>HCC!omRJgp(3sq>@91;gilX?r3sVg;$RQRlxX=rFZ z@bRU9*mw=j00O)Pv*f)!Y)j_zs#fiD^6>ERTeIS)VCzx@MQ&#*LZiZz34r3$r%&B? zifX$1`>j_o!8uq^v+LIn(DTN&aCqGr!CW(Pa|2EKpd*0rO%`c&0b0<<0rNJZDo`y* z;Bq4GiXf(7VtSJz+clo2WVKgeHC1fAP(R@qa-lg}W`vj{mu3op;1LLy+5%WSPtD=5 z7<8opt6ivf$;iy~A0Hq0yf}H>N#mZk)poGK^SwEbzh4mHKnTQ*<|$D~N=k0;Qh-Nu zfLhbj-TjV+CZw>CHaH|i0RtY))bn(+bufiz=gzQY_WI%gO@4#!wBFWWDy!^(_)*o3 zZ;#cQ4H0QpTYJ>0lxm2JzW~8RtJgg5C*LeXi2V@JKtqG+ zB|dv7P$a*`wsQ0Hmw$hGHt)U?R;beewQIimzR=({#RG{cTEjQAvx}&y;W%i%p$AJu zPDb`ECI&-MNhtyFA22@l*pjOyPbM%ufG=&GVfZtE0|uZGle4o|FY;G|{uI?flrZ=; zhto|3DdH3$FIjBoIeB?`508#WSXjnJCHT3xX37@;?RGyI;Gkk)prEA<&CSi#e5m{6 z5~2h`5Cw}?uw=?w|EL<;U+;;{yTQU-?CCBv~GtgenD=(n+<$nCNX;`%v5^W}TM4P#(4JVM0ltcy!@dF13cE(6Iz+TI(91ibGd$5CDfI)?hn6I`6p-)xHWi~YM6sVP~ zUu~pq^iZU&0&$Vd;}#Ag@eLuN4VN!~5W|Ul6$~t_sK`hIHp7Nr7ZHF{fPnoVAdr@x z{+?Vmx!WuaBI@nUE1D4rkevT!m*sJ$1KWkF1$7sTULIF#aWl;j9&jcP3hnG;Xwlw4 z%PceMdaQ`9psKg(>jMen4XzS&NoyA)hQzc5psoD{raV>to(O>-$!LfMPB}Q zxk;b?c^_qEU+L=V*4EaRdYqVk{rdF<8rlZP3RL5q>cc>fh1-EwNTemSf z+03$nMV#7HPyA!e?(}eXF;?$l1rQ2w*c`K=RKOg6wrXu#RwaVsDG!7@AlX;zNp`d> zT-yDB)G_~f1dHd-pR?k~=}h%4E~Wx_jQ;WCcSZz%ua4V-2&i^F0|P})#MMx{K-Ge( zTYUnc@xanlnvZ-1SfgnRtFfF2zJU3rEjD?b0K&-(mK&%pk({xk`J_yF4?#Z*h)}9K$l5XEeK~P zwxO^d<7Hr|0fsd_Z#g=AWf7XFrS8IqNk&71f`}Nv9lZ}&`0?>^@s^V4HXxwDw#;SG z0Du}A`VwsPwlvnZ*F(HCIWjVGp{*F`_cF7vAiaFqm<N($)ZvQw|(ExEhhilO69e7j*lKDkRE5)w$jqjUH2 zn!54*q@eHy@CoxOO)y+WoR{wI?)r9ia<;bg;1vPzjruuk`WW~+fD(b%20#>327l7k zC6Zq#Q7Tf^+D=VP4KFES09FxnM@L0P#LQ?ce$>Suz~xnbo-yTdivh||KfsM zB$Xe1dDa3<9@i|xH~%d8DM1GZrjZdH2Co}HE3(NVMLNhhxf)na9)|}GLEzC)(_4(5 zQ^)38NRSH3%iAkGwi>`^#lQOd`^jw%wwA~t|MN!D-v926B&%Z#0bh0ti#$+C0C!I0 ziLpv=Y$T}Clqpa(K!wuK(Y0E$XH4AlExrZ*GsvZo5G%j6)yBthx!ibpv*>14R>lCc zAYJtVf@csx$m7|=tfGRz%f|=&ys3BTJ3>A__hfzD9*#beOu zv}S)OdP|mD>}1sYpDQeHyiAn-Gwa|V|7~RaKd)3(v@HBiEHD`BJi9$fJ7D&`PjcRy zTqyVM5evEUI3Xt>BmgcSa6+8s+I?T6kD+|l;qfJ5KS!OPpNF$|y3p_b`)l5P>^Uo* zOvU(`B&WkNCob;Bu(^+~*VXkkAdDD1uGSfndfz0A9(!%;>!QNKnI^3EliyI1hd9Lo zUZqS|?O?-!ccd(Cs0dy5jV<~us#%f$M*^k$ojrQZ*w33N>s z9nE`etcns^wSHCS*F4s1Y;432q=@5y#RoL!2TvBwm0GNL4uUJkhIpl%okLOC8n{V= ztkcKGF#y5$xLoRr_k7^Pz*q&OMa699aMH&8ybe3z$~S_=c{)&Yr>U{g!*Y^^_qyBp z?OR#E0B#BheJX&$xkP-f&xi-Cz<1=?W=;Xl9RTHlSt|tW`>idDO526(I-$3KMk7T= z?ztajdB9mO;0q^#{i2IF!-5G(sHJ8OUw+h2$Rb|1*plvgBM9(i#EB$s$Oe7 z*daE{m#<#EdWpmM19)7F4$GOIeTWDMOKWQ#Gb~#!#Z#75&U>?AO1{UW$A7*_19?tc z!pFylgp6EVQCLz!jMTD_cvk?5-UpVI#x)m7$+xbqEwFmPvs)JyGFlj7-q5R^5kOORCbj(>miLm~H62?@B*5fGTJQf~so!wn7=7l1)vh z;?*mIwrftG%O$Vllarv(P~$&z=v(t#`I9~{&l5IoF&Bf~Y5YQ{mxssW8*Ztoy5_7F zYE`LWWD>^cfCZL9ZrHJWOP_yM$mjxD+BfeyCxDl%HEhiM%Tm9%SE}fN1=QizuDPz` z*^v=&`Y|{i&Uc^=2eZRkh0V~>7Oy1ZenD}NS7ID~#f8uc!djD$P^TMh*%lF|4)F)D>-ZcaK zukgy2&1s!Kq96$$uL#TTV4FW2=sDh_c4-iwQE_p7m-u$3U~*J+RIMEoobu^j@9*y!lC0Akv7rw#f_8+?a}6+2sy^M!>dU^O&F3m;T)ULuStDuG_jFDK== z^;crxTo$^Caq>p>+`U0nq12RZq2`%O%34K5g@^0D^=zeu6lkPrwD7-zt1!G#Y6S{g zB7$gQ1p(?^8D9hQ469l68Ct*7wulne&0ftErq{0hjk;o2zHNr}`t|Sen*$OC2DHzB zr6=2|m4Hsu(gE@BN<^YcNk+6?SQq4C5lLC@h{bx-zVm@S@n(pYYKt{5j|w`)rgRIp z3#*y33{KN+@?6>79o7D&%LHuW%geMc+f+WFH@mrzQ!?Q!!{$<=z|t{9JhkO~4!n$q zs5w@0C?0c11Zb!76B855QlzFoeEtG80owXcSHr$)Yntz(ATX8VSuQ-_fL}CI>2PPK zQ;RnQj&(vJPPgXL0Om4eAgHC1M#km2BvsSumE})5f-r8@xD$ZO7Px#dM(mxr2mzNy z*tKYRO&D6!10Ot7C?MRWcn9XIpVDUqFlW3Tb?zt~y0{Yy43T)L`Ec{x{j;Km@vEme zjQT$Y%0S629SDpxy3{{v!4bGO^@czIZ8f;5rsKUFHWEBzwZmLn6FgfGL-a!I_3=WL z*VIIo--r)V%6WTueB3!THD!4fzBi}daPCFqYe?SOO0v4TTDsm~7Z_^oR+Vpo{y*<4 z)BjQ{Sp<=---#aacWX<+$A`ZL#vcTN>*;W|j25U?N;!*dm3e5)mZ$2VDbpW{8}arn z!B>Dwf+=*7#6E|1=@~|~UdK(UeIVQ9Bqf=L22*6RbmcTGs8V>un4H#k3-p#m<+Cy~ zsSFI_ID$^rFZYDSE^7af=;*ZEdjTIVmY5B0|p3}d&u;21?(5gxU!L7iJtUDv z$qo*>42D054Gzk#uCME};*@+;9+0!ju^BJn{x=I@8_d{P-xku*v9V|%zIE#V!a`-u z|>y%+IGbwpZ0agGBNo_-QlmS^SyiidlrE9 zg~FaB1na*OVvja^djHYG1Nf7><&Be;mB7A4pG}7cl?A%y*^~+j>2Q-5tL53+#`0W^ zO~(){t-IS*CiupX$L;H#OZU317d7x#p#Z}Sdq2m8REH;wzl#HH%P~N zw}|G>H%KGAcsD7-IKX^dnJ&u!C=Hk*Is?N&UoaIL+c$L3wf1fo-`(5Wp>sQ4MFQPD zQf_Vp4vw9iKF~O?whil=nfaE==QYs~QE)^^b`LnmtzU01^70DDlxDGl6%M2QJE89{ zfeldRVs-lfOjrk%SdWJX7(V+u#3yKh>F&$MZ&S&n6pwzyYo;nnjWHMG^;nGFgzM$8 zO-MV<%}28(W{+?&cz(jVRJj_w&zlPkthP z|EejMqM_Nsswpo$ucE3dmz@jCsp1sCSCn?vAP;wL+ml6Jd;#4>+`jjXz`O$fhEbZ& z_BfTz%yH3d<bWt9+eE=4gu@O~vurIHJ^uh}G$h9Rte*6ObJ32Qvw;5~p1y8FQ z%_-0nD<<}x&Hm!|-sRl7n%y>ZV)&O^4-D4w#~bwTX3N*Kz_qAEyp?~9f`S4nP5Nr; zPX?c`(eG#yWZ0j)6IL|>6daF}QW3PTCFSI%r4P*oJq^Gs@BRCIHc$%)LtzD>;Bil1JRx!%+M+!X0#LO(Ov{bxEtEPC2(rkAF ze;l|tSJ&0WuBoG=iYBJ1(CFxB%}R3(6TXCm9FvNf)s->HsF+w6Q83nXSReR92jGNp zw4=Sfd>@qGC7&>Cr>x7z=)q$Iw)kVBM?#MGNGpRMFwByZjiJ7-uAEVGq&Z|;RyA(& z7!d3#qN3k<=NHx%3KJlnl9J`57Te=nmUGobnb#go4AiuW;Ah7tG-)f7RaUw4+6$FN zUFVVpZX1JyQJII$*kUAo7gM13*)uaUQycEMJJ&+*-%SHffG7gHXYJsiB=pqT=6>Dk zY{#tuSZ1edarhHOT5gzFSetEVi&IX1o*zK5hZXYSvh`gN=p=@)8uLIH2lBX9tf6Zv|rN{Mymc(V3FuBcJDaA%-X&RtUG-cHv0I!9+qK%k}A4M1l4c z9n4l$U;YQVoR1*rEUT_3NJCBrrZCr!&TX>+S5yO5{n?Q3zRE{~Uys+2w35s=uTYqn zq$mJ`;J(c98v!99o8>rP{ms6DqqFmP0CBV4mPdQop5$EmN=tRee4}<45u~IujF7<% z&CO=^G)p$MUtg;gb;B|O38diJ65>H045oLnz###e@rss~`OVkcQZC!$8anr94)!fR zZn;KXvJ=gVNry)kS-N}-shXo8=D&Sk)U-(DZ@Q6G{AM&*oWf&VF*D9_%bt}ulF0= zLGtCx!R!eod5v2bO}oO=jH8P>(bI3vQPn`qobTP_fR-2yB=d5(En@TXh!r#%B*B3W z6|k_e2?-hosSYdT-FIWVF%(jf#;` zJZc zC@cE=-Lb06pU=w`?b&B_Re1Hmx`|2lTT&7M>)TS7b zSNc=1$@5}lX|=7lzn_)c?LO^czOVU?MmUhwe!1O20vmRhm6J1ya!bLdo@4=RB6&wdl|ab6bvFW zLk>O*eX8$nYZKyevz{ud`EGG@o`!+*T77K-64$(g&tdx&i@`?;-$+2MJq24pwo;vz znu=}TZHt6fF_0Ar z5`;DZB?6K&sHkL+EV1lX%!r_X0*ZlL1PMik(ndg%AW$G6ppq#v6cVf6zS{HNZ)SSt z&2P=jn_08oAF>3CTerUZednCL&)!Eiec?Ms+|9n0c=!r1-D$jGwWylF#2B8$)6soA45Wc^*#r%y*x8#N*8sMm}-ffl>)@thX>*7?cW z6)Tx>^COW0WMj_2F5-#B+5#*Wtg-kKjRj?74E(5@0}7{jGok$5sZnS#TAXP* z?(950u=#nA)I_!o*FCseNT_^PgtL(0JEnHfJ#%c%BKs2TG7OKo##99`-cx_x-D#LLU4IgesWNzD=+d7o|uKv>^0WS?Te zNyKH{?F@fLHDHKpU}~gYWmBct?yXx7))Yoow6&R__;DKk*D#lyJ@H z@Nf!Ohs9a?TdOM7?Z%(Vgj(FO z7$^{JZ*Sj->1hy4~Rj7wh?I#AY(@a*|jI*j>XwpBbE5|K=VfBEI{9~G6@r@;kR3;bFko;-H^xGoe>JxnGQ6PS{~15A5f zO;3-uo7YqtREl2Y2z}S;f&+gyGgBuv^6{n(8+LEsZdP2JGAvI)o{^A{Xe{ z+2|U5-~iAlX>PaVJV&C4?22N3s}emM@7dsQdgon^(*}Hy!B-Wljw(+TOjPTs%DNo? zZg%$aYrElzd0Pe%QbO)>F|VeWFrKMsw!4nr_fA?XQ;>hpQ;}41N7xUI zSLZr5UEHGQ7ohs)dSRKITmR!;QQOap3E^_S`^hGBj=4h{t--A1+29k2#~!w=Kbe_E zF%ot9Y*i|jkYuj@{>LHZZNEjDp%on~zk)Oi7?ZL8ru0LP@*3pAU z^0%AsHeI|qXle1>nD++^%p>hlx%MrIbaC$?0eo|7-L@qp(#czEf511EmsRogXX>P< zRlLDuz-aTO-kJ!rW)@!YK4Fjtox%5m&u-g2O|I4pIC?bD41@PxsK>wATAx`f~u@HdooPm3XglA8&&zA#yr+y~-$<`NgP+oQEh95?OTlFe8Up0TO`BvqHa8Q+3$$`&VoOQqAAbC{ z#CF4`O;yd!2GGW&?eT*Ge{R@`B22ykjh4N={ljobCgc4V=MuBBbfIBD?wO{*;(!(} zby8w*o1h>WKMfH|<6xw?hQHPz36BQr>er>;rDqukTldor4Elm9NH{`^71B74$Jw@ zJcrn(RH)4;MPL1qf>BMRjMIl3OGv8&*BXI{^;UE3t$u46bRZ7O7(Llqi1I?CqD08Z zCMo%zqhgwxnn#Zu*^Oli*|22`6>6Q?`FT4?5A<%=iJ0b|;8L7$5Aq|Nag>U2ko48q^--O)6>tHN<7TyuAk> zSUpP5xqj_h9WvZTI9QM-zz8Aq#K6l_I z+g)o9Ob1=n(b18DG#VF6LNmOz$R|fYaL10LXnbQogr%jWL1Dpa&{VQPo7@}192PqJ z)?he7!%WN`GFYC8eUE%J_U_#~-KiP1{|Qu}R4fZ9i5x7xVV4}o7*Ye(kO-7PK#DJ3 z{F-8zeh48o0-8{G0OFveP)jQ06}2cfMT(bV9{|yw0+D#j=WuKnOxrsem|aXFxn6!P zL|9uOV2+S;PvZ0HUYBB;r;V)?+N%cCidsg13|Y_|B+S4JiO|d2!22E&gCURBxX3Ye zbw*c^k{FftiFO<@hSi-s1*=N4m5`jH>9!9cnXlW zNZZ#z@{tM!3KQ-W6z+}Cs0~StbkZ%N{pS+b@F^t7bX+LmJHLMY`q2CL6M(K?18)*O zo%83Pui;lrhKr^jGEPRZ-+YqaBXF4RkdmSDCBqZYcx&@MN%%epYYz${rG>Fe*vF6e zT9)lrP%wqJ$hh!AI&Q>mZpsG78X6J}_=HXX3lf50$n&kC>-B~~iS^Dh$OevxjbTO| z7JBab&7HBzw|;)YnM>nj1RYPs>ceypjLI1`UmW11sn^okjs4AO(Q%s5sd#*LFD@=I z&UZ`Hc%+bs$5jN?)*yo#4&TZSz4y0KTHV8Eg9n70!$-)G0dXN8jOS8XI6>@RWo2c{ zR0-0HwOcb*U{io*So+o!ljv%M^3}FJ z=6dmL?-tYzgHDwBNWx{}(}wqJ&Ml_@1aK#8klHxjRW5b5azhb>=Mdn4AG?94&<)VT z6-4QLO7)e`H+823F{lQ@a&pGNUj`^1q`W4&mzl_reqH?K2xeX=S>R#J!8f#F^X5c2 zVu%=l*vxoj5FQxHAYbG`vVu1lKvJsD!eLrhH3W?3$9_ zLN*1;$Y6G6=5<4Z4nTvDh={I+#_h#UC{=~Ypg45R%^&&Y1N1^gZF05&S~@X~g1$tcDG3bn!PV=5~vn~!hYt3-3GKfL%YM9jQ8-LYMcHQZ)EVNXW0U`uMN zT`sce=bsb6ohCxV`G*_2!9>I%Vn1~68?lZsVIXALfR5mnICBm9Kh%%$2?@JlC9#En zCt|PV6?kJBq2Yh#^ckj!6NuZi3*)Cl@7=S8K$p0~E2}o2o>`^eJ_@b4Bt(RP{7UBF zZBL|`7unkPefaPg-TPxXVTnO<&?hHD&#DZyo@s#Vksuz~r`UZFDIe4aFL5c>dGuMjln(2%{uyXQ~%sLM%`-yZ5d3vqCA z=i-Rx3NEf34zrU^CpIDCabczO!Gj0AAx3P3Z;gdBJ6iPlkpQ^k6VZOt577T1=o2039ssOQ>-380k><`u<#uZz(;+0@gj*}o8&!)?g*&EcZpxb z{)-0tBWc^1VBG#wKLpqH@V*Rhbz(2fa!Xp*>CtG0A`HcBcx*(CGLFEpH32jV-D)z{ zmV2JKU--4$+8lBib`L`uQCHMN$?D*QbIW@q`^`ZO%IvY7k9>)c%>bHY4YlY%LIA;S z1C~tEYvK$HZ^YpR9p3cznTj2QgQ(t(m50SkXxp|!AbY5NQY4b8U08Sb_H58ejY;ES zDQz1zzpYKE5vKT=Wu8;q<|Hou%%ks3U%%7dy%9=Q(^4sEV#w))mhM>J_{I$z5}rSQ z-nz60m48ove}dA&M=k@?D>dgDD(>#;>FUxM=xRkd^YDNV_#|4=;xSb@uZb9x?OLP! zGUv{ns|10A_>q@1I|)wd(znsdz@%^g#U2jaFOYwNAJQ(x*jZM$M8owGQKXfA}vW$wKBr<+HK ze!_&Wl9g4T+;Ua&1d9cW6&2BaB57%iKwd#Xv!RN^;BlntESrX@@p67n`x$`Uza*($Vn}D zT6wPip=nd6Yzw23s|=LMNN%5q?>f; zZWAC7eHX8Jf6q%ri7R%aGW6NND{FX@UcEYkV?d`)91hmj$%-=&JwXChJEyKsCA5hxD=%5?XffK2m(AzA!XU_>}6bW?k zIE-82h}{1D))&siptP5sdWzEigl4YX7QmFU@4tW<|rw`LA+efeNC`qYAQ=h zrASyrs9yYPh`Uecqd+rE8h@eQ7k6M+#`T*wSKPe8U9bumB(h$83xS!=53l`O=(L*M z-hvj-oSdTh@*md-%7~99wO;u11Fz=Uy?nWgIEnPDrQO)tSpb!KjTpO6MW0`nw09-7 zcK7xSQbnDKUoF|bJ-xn%)*S94? zP@xY(RD2gn22DFr^qX-~)k;fC1C0&b+_GS8+d)RLh>nKLh$WI6QP>iGV1iww*VUbX z?bDNGmXS`_s$rneBdlNFe3Lpm0m&@QrXkLoIeN^U10%Kf!gx8;!K=9vdr#P&A3L3> zyU;awILBhK80abtCLY7GY&)X=k=RMa9JUXEEu%~X{~pXFvGw)!%2d18ceVl! z1q&3x)(g;1*P2JVW{!O<8EnanC(1n~aHK+FVmN?du&6#oi(A_Jgcv`o2s6eniHzcv z-f+S*Q|Q7BUOv85Fp>R)Yb)oh`N|%q77hra2uN#m`*hHJbLy@nk(yT`#zUm~n6l8t zZ=8895Iq_JGoAxRc`mVpL%^Z4*bK!!u|7pL#KrL8$sus!C&8EiRA37Sm7L#PmVgcH zBN0+|VQ8@=AmdVj7Ak9N!v*}{l8TUZjVq$VD5{;Fo(|m51ZSQKP>?lBu+~DaOtisR z)%$AuZ;BV!p%$BhT3Rgx5jGAPVg9#b_>1cEOJBX}zrO3ybIwSA|87K1DZ8d>#YKYJ zudQu{DjK|xF!bvw@ELdPl#n%?02UK@K39Gqe#0_|3M2Nr>hn&MpMeh)>yqo`ZyZ%&F!9@De%aWL6q0y zcQ$O?xPweIu-W55lzya(#`k%yFuI*p%4IK(QkppnwVd4mz0gn-6+iLe(W!>V8hsIY zbkiOa5CvwHB6u^orS0!`!2e97?Z1XXLMd&J4*0mCrg}$F!iK>knX09*b%;tIOjI&T zwjvljfxH^Iq)Eft%Zw z>n4LCO2)B-9;pGag}B^N6%}xezY?{LH)}9YYCUYHsS+@BvBkIbAms7ILWK%YY59v9WWHt zZ+=>8B7#I3+_H5-0?iGEzkm^F2ju0N`+E2$+h#SORc;EFPXiOU6;4pD>gL0yc=5 zgW#l-n zz*F$sX2E*jz|9fE`+@N|fzbm*G1pGv5G1V*VBhewA_l|E5#=_1(17g?-M^q&?)ih@ z4_!Pw!mg_Hw5gjVzNwloSkS!)ubmALPDl*Gh;`lLgTyt_Pt1Z*guD5(w=)n1GrP^P z;o_2|-LO1Tx^&uI@7}u?Q{?k`5MwTav3htX0uT0MAK76rChaXbbxt2#}%0cIR?lggIJHO+`g8WIX}{FnOj-9Qsj3rJUQ&!`(e)%+(={ zJI7FDqkmeGV?*n4W^yVWMI#e|w+`T+hCRI4BTm_C?r#|ho@KEQ0s6r7J4{P-4#3bL6idQgh3MN$NUy&Ybi|tj0vDH zG(#l)7cPKPGrqf19gX6KZgdfrEM2x6M<2KyQuTj|zivJ1BIqE@4$<}S$kqV2g&7~xotl^uYCwCOO{ff$%pR`bf~)|XCd96o%wMn5$eJS#OO<_OrE zIe22+u;xVu(=m%LjVfuy*ZZAb$)rNzsl(MFeeSLcJRZjzuCj5D#=}%8l3z zS_q&ZY@dOy8w{c>JOhY?Xai1X45rxz3I+5g6Wp5qsZ$^I4y5(4=jj|1wCZg;3iCkW zQV~h|mDpWMx8@R#sk`1BhG~iI+o!|F#|Qd`Jba_MbnanP zRJZxf$lB(ZxO^%x3jj==Ei*ywA=*(o2s?0O#v&MyLx_n(7;Rt%;!Sd7)LW;))peqq zjAQro50y63Mdo2M3GK>YOY{+JXM$C^JUx55d%1I}YN}EgGVP54z(|-X5P0b%?l@mT zKvrJfV9PH%22u+~LSm@J^fTa+sjE+;m`K*Scu%a!qH~FMQr<|CVM-G>Gr{3uRk(OF z3Mv+suytuS04mYo)%jL6v9}LG*KpDgBpJb7RGktF!v-koy3bUQ0Qq zVg5+Ev^3F9bxbOCq<sIT674DGTY-!iHRx&65++X|cqd2sC1y?wlnP zDPZcV(!!IMVV*^aHcI>dm8Or^1K3l@+DIG_@N57lh?!prpqoQtqM~?2%?k~Y(^Ii| zV>q+XoWweRgd_rM;0E;0a?*;XBj7dOh+qrrb!%~<3kX#P<~qb<%FMA4P;`)!3!q2{ z{CV#o;F8QBH!+j!qp z9iw>JKJZCZ*NX#EJz1C80|sRZlUH8jwHOFOl-&th&$uink%dW>>;22=SVqDGk?1+kdNVB~=*B{(*;yzk+Ku=esjlyxoZfHY4~LP8rO zo3b_M(T0(NUl(#2eLMu`qTBu*s!45J*nN_x{`eM9NF9Y%nA`YhG2jcf=DW@zAbJ>P z|9Rty9P(#Nh(NXL)~$=cbOjJNjn>SSL?gKHI7Ye<+$nSpW`O2(@JqWRrp|X^M{A)N zXoQ#e044#2uJOejuQ_nLEYMGFOO5klVgwdhX%q%g%mLh?EmK)hk@$xKCeINW)Nc-H z2LoW9;&lY~2*3;7?qQ-HFT(UCW4eFQZP2h7QGyPkW(cvm5Z0?JaTYQO_)N@&!EBWf zqF<7cAwl45piC{06ZX=Puv)<;u_|FaOTKvdGfz8=G&>c^~4h1sgikj{y=ZW!17~xP4E;R`f)d38h zYeHv4SR^w}4i>RAq=$YC*3g9z7sElQ0FUq5j75H0y;&F}64(#f)G79)zBL;R4^G@vjf zSbBr~X{l&8hQvUJW{aN_ox8I%{lZ@r(L)0TH{F?o9wRt;T<=RM=j&UD(PA_V{9*OK zJ-nQYuMvHqjXXTbXcLqFC2TXTXjOfGDmT^@oQCyo%&6C{Y##|JNU zLxLP`;cvw6Kl8+|V~`lT2YfOJntCLkDTZ3z2=%QN@-+UM$IT2Advvq^A9bc&+}%SN zwt9F)&(M(RDKCSheK^vfAqdn10!a8FRmQSx6)Iu^x)YxO+gA#QimZM9{8*aw5&ax~ z@F}lBcfNV^W@2pSvuOU;UKjn?q8r{H8rFNj2I!&_9Sm|kmU1K7!?+3oQX>?+TrQ<- zAwBkAyN&u04GmE3rcf1Pp28hsoC9%miGzUADMSy%XSB#51m)Pov0)Wl5L~N1nnumo zr#r}m+>K0ryFEzZDeQWQC|pC8Edc+)fLn9?X2w1eyBaedVxZh#&H6X3Q z|EOSVN634oF7lKD0JZQJblsMB12{5B8n5rsWf9uHMNh;{a{lRSg(1QWKN^b>2iQJ2 zIoYt3OW`rv?7sq56O2_67d99eII4M0q?X?NK?k$Bg=i&8as8Ivq!)n!U|fh71H?7} z+C%W3h4Bnv(GvBj`h?zq$TdXmkEW{e^OL{nCmWvPugHHdoL0CE)iQCeL)?0+H#@ZF z>tSshF=41NPJIh6I)H~F!2+Niq(5kfN-=*pyG_z(+8!8b}anZqx^J36lhp`~AC> z$d%8qwvCDhaEuV}&k0|+n_#1qFyeITG|-VZ?5)I2!wg`szXnvWCHjQtFsPEK+P$ZT z1Oc^(<`&35Zbjc*V*HZTBQItAe{RzhbZv-ssD7HcS)w@67Bk9J#sdx&Ao>>|{B$5Y zK+1E+EQbV)+}has?egVzn9QbkyIRyNUzbSA#S0T^|EvMD8*5GuVNZn9(JeWFvR?}X z7^_@~o&LvnI}9v|6~tr>G*eQKmqHrQbmKpa3CU>n;e#Gq-Ar&oFr zjd9GsJeI$ITOpn(LcnI0duD>8(tQQ54BTL7aPSl2N~nlwgOrX!udkK{(T$+~P^>d1 zxk;qdJfiED;tLbtq^mEA26m={bU5bAHg^ z87r$c7(l6hh4}c{=-Txr&0)4p2FAN&RF=aT;Z*hJO{!jC4_@Sen#g_dnUEC2>|sPx zteAUPSXk@tmo7P2P!?%^tsrC_w@6x_NSP~mpqs;wDSz(}2khFNF!)4NT)Z|cJRC|- z`)uT{R`kIJb%jYE1{piH?}+E24Zq84Yx=M~m~UjHvZ6-HF+4KdgzA)^D2gsCA;`=3 z&R4`(hPK)QDyHrgYWH}B>0yKk^kXSWzR940C#I)~yMzanf%$cEEUnOp!Bh=(rgobg zhPO##vJfhEGPtH}O$(e8bN|`1U2I2b6nf}fkGQ|%Z^m#haDoI;uY+>s#*G`;;xqYS zD@oSBXz0gZ;fxHWZhblTsZEqy(fVx2vP7JFsrZ}A#JZ}Fvv`Th6SLm?#6vSj`8D_p@P%hohDkB`p@ zcy#GeHf3KefQIc`J75yx+A1K_2%%H}a1a$CCNysSFKIru=qpSW4 z8Qou8;cK(%?|Re!m|ux`{QS-rz1=m8^6Ta}Fe#UCvgBF(Rhz2E5J*LI~PP434pZNuAtD}VeizR$ndklVit2>80# zXcm9n+-0`z0$qGpy4B4kkSA1O=g|Qb)|9m41X!@J$E29ek`r=Ic z7KuM!JpO9^*B5{M1Nnv2xZ>}*6~WyiUq8UDyNv5!PlG;n`Mws;{6D|{Pg~RO_p>}-x6Rl6`>HBa@V~{wt~PF7bDKwv8YG7; ze12(SgX$S1yFuz2d@Ffp?)7HNI?Ekby`ip@3?@g2cF&XPW;>N}} zIi7u5#`;%z%PIRxsvrMYnrnB4=h|_ts^-+sNzt{kpM&y7 zC*SuePBwdXI9xov?MKr8|MLHS4b0?xz||%>|M6mcw&s@X!=gY9S{wU-#Hop~q`Z!H z6}NiFCZ2tfWhoO|-eoxRF-bg`l(>t4;OdqJ2 z7w)lW>8jEzKkm<7sJ7=0PswSEad}f6=iG9#OI(*Xr)0$B+_{F_sV!M*BmTB-=cEIv z+&X=x8LcDCyOK3dZ@!D~2=|>?p?{8n}D(f3`v)+lSHBd17V6$|8Yqj5apg=`z zeCI=~sczsXufJJHcVxk%Xsbv5dCwe+?xQwNl9cqQxVCall}>~CYj$K*@XLaz@Md#A zd7r5PBiVBWX7qc3GNX@rs*EQVZx%lg$YbtmXlShuyUVdT$?)!!_dF3MDPEODu8qr% z+o`EOZ#HKyoguNzwP2oRVI?=Rh%fd4e8}l$?sUE0zxwJ2h@7=_uaCcX{qJ`{8 zx?pXb+F`TaqWoWKYZffe78eaK*73-8mx=g!_SEjtD57}0ksXiU?9cw7AjKI}nC=X> zqF?fOy#t@BDJ(mSmfh2xxx72v$xLr^*UmN6At&{1+m>7u3N&Lv>VG#@EzAn{Q0?P> z>I$Emy1(4W+seHq;y*`y=Tv;RE%iZ!-`wz>d@-7hgH6?4`US;BuFhvJrhbRbria>u zxjI;GXH!#XqE%t33AeBW`piYYdxGmJq4>MY$ID$AZ_hDzkiAE8y+-b{FAY(~Zija5 z?3lT5TQS9Ajl5&@d!NZ$Nm9kF@hZi+&N-&iE}xF2InQqX+?{N9yZX1zcRSq8Y%@J_ z%6Q~IJ$^s-VXV>JOR371Y12AjHP_HmIzc)b2tGCQ1{XH;lyb9T7&X4si&@jl%$%3_}|m9xy?Dbskh z-l(7HgL%iu;KM=hwzta+g*jw*N*0V1sPF7tq$XKPx13%yb!$k^8*7x`*Ej1GI$KsY zCoucU&Ys;Pey*>>#Gp+7fDBuBG{Mr3t?2k2$yaD)pG;q?>#iQ+PqvC??WyvSNTyg+ zloM~K49#82tGo2(U4cM5M*Nd>HIEJ-ro!i`_wN-QZI#Wuj!d)XJX%iPb$4wV&(TYn zub)ionF#*uRwn9~+(Bs*Hi&koTzM$-+B>Tqx<9ovv6+Y8v!;ts(1ufga^mtv-v#T#||2+8G#B7Jc`X5NTEmVs%1$L{FRo$H;?amY7=JHO#qS>u`MkPgSM*O_b z6|HWnxLn2eW}{N!E`x=!N2Us&-iR0#io`#Z*-v&Et&&xg$NiGp0`ovD%$ZZbwU3panpz&EcsLAtcc*{#3jE6&&;Z&e&d7b5BmlvGb6J( zk&kBT=6v{b{T|)-JlfM2H(Mi{+jswVQKIG(X6x$BO3sF<+^!Z^rt%c9zu(MlajOb0 zS)F3I@qXGNyCtbXnnX(G-nEJ+y0iLz=CS7Y8Rg1eRv$w|jK@ZV%yOO$WmAHV z-&ZKKP4)b|ZgwQ$unRI?wD&^{7$vgG+!nu&ce&WYq6omPtr2c!1y4#+olD+bl{ht2 zLY0)}?ElOVG0S+hFPQW~WxgRQN6u&E!>4g^afg>mkef!D-aTP@N{)iFc}ygWzy6Xo zvxKBL=~y@v{Qg4Ac4XVy4eNd&MXy`F=Di@<$I9uMP7y~wVY*%Gs@oqLit`KQ0D_7% zF1BUhXQ0Ou$N%mx$=P|c?Qc4kl1Lm)Nf~-%s-3&KL&H(5U Trb0wYB9V`397#QN^7sD*WKIF= literal 0 HcmV?d00001 From 548cba9fbca0c035bbcf435dbd4ce24ad2a6d11d Mon Sep 17 00:00:00 2001 From: Hayden Roszell Date: Wed, 13 Nov 2024 09:33:25 -0700 Subject: [PATCH 7/7] chore(docs): Regenerate screenshots Signed-off-by: Hayden Roszell --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index ca7b069..509272e 100644 --- a/README.md +++ b/README.md @@ -92,7 +92,7 @@ To use the F5 BigIQ Universal Orchestrator extension, you **must** create the F5 | Supports Add | ✅ Checked | Check the box. Indicates that the Store Type supports Management Add | | Supports Remove | ✅ Checked | Check the box. Indicates that the Store Type supports Management Remove | | Supports Discovery | 🔲 Unchecked | Indicates that the Store Type supports Discovery | - | Supports Reenrollment | 🔲 Unchecked | Indicates that the Store Type supports Reenrollment | + | Supports Reenrollment | ✅ Checked | Indicates that the Store Type supports Reenrollment | | Supports Create | 🔲 Unchecked | Indicates that the Store Type supports store creation | | Needs Server | ✅ Checked | Determines if a target server name is required when creating store | | Blueprint Allowed | ✅ Checked | Determines if store type may be included in an Orchestrator blueprint |