From 5231e2ddb3dc0f6bcfd0b0f26b614856565d9e63 Mon Sep 17 00:00:00 2001
From: Rishabh Raj <120644626+rishabhatdell@users.noreply.github.com>
Date: Wed, 17 Jul 2024 16:26:42 +0530
Subject: [PATCH] Revert "CSM 1.11 Rebase (#1180)" (#1183)
---
.github/CODEOWNERS | 3 +-
config.toml | 8 +-
.../applicationmobility/release/_index.md | 2 +-
.../Backup and Restore/_index.md | 0
.../Backup and Restore/helm/_index.md | 0
.../Backup and Restore/rpm/_index.md | 0
content/docs/authorization/_index.md | 55 ++-
.../docs/authorization/{v1.x GA => }/cli.md | 0
.../{v1.x GA => }/configuration/_index.md | 0
.../configuration/powerflex/_index.md | 18 +-
.../configuration/powermax/_index.md | 40 +-
.../configuration/powerscale/_index.md | 18 +-
.../configuration/proxy-server/_index.md | 0
.../authorization/{v1.x GA => }/design.md | 0
.../authorization/{v1.x GA => }/design1.png | Bin
.../authorization/{v1.x GA => }/design2.png | Bin
.../karavi-authorization-example.png | Bin
.../{v1.x GA => }/release/_index.md | 3 +-
.../{v1.x GA => }/troubleshooting.md | 0
content/docs/authorization/v1.x GA/_index.md | 62 ---
.../authorization/v2.0 Tech Preview/_index.md | 78 ---
.../authorization-ha-example.png | Bin 121616 -> 0 bytes
.../v2.0 Tech Preview/configuration/_index.md | 8 -
.../configuration/powerflex/_index.md | 119 -----
.../configuration/proxy-server/_index.md | 166 -------
.../authorization/v2.0 Tech Preview/image.png | Bin 178897 -> 0 bytes
content/docs/cosidriver/release/_index.md | 2 +-
content/docs/csidriver/_index.md | 5 +-
content/docs/csidriver/features/powerflex.md | 3 -
content/docs/csidriver/features/powermax.md | 10 -
content/docs/csidriver/features/powerscale.md | 2 +-
content/docs/csidriver/features/unity.md | 13 -
content/docs/csidriver/release/powerflex.md | 7 +-
content/docs/csidriver/release/powermax.md | 2 +-
content/docs/csidriver/release/powerscale.md | 2 +-
content/docs/csidriver/release/powerstore.md | 16 +-
content/docs/csidriver/release/unity.md | 2 +-
.../csidriver/troubleshooting/powerflex.md | 2 -
.../csminstallationwizard/_index.md | 16 +-
.../csminstallationwizard/release/_index.md | 2 +-
.../csm-versions/default-values.properties | 2 +-
.../csminstallationwizard/src/index.html | 8 +-
.../src/static/js/constants.js | 4 +-
.../src/static/js/tests/generate-yaml.test.js | 6 +-
.../src/static/js/tests/ui-functions.test.js | 14 +-
.../src/static/js/tests/utility.test.js | 6 +-
.../src/static/js/ui-functions.js | 20 +-
...ues.template => csm-1.7.0-values.template} | 182 ++-----
.../templates/helm/csm-1.7.1-values.template | 444 ++++++++++++++++++
...1.0.template => csm-isilon-1.7.0.template} | 43 +-
...0.template => csm-powermax-1.7.0.template} | 167 +------
...template => csm-powerstore-1.7.0.template} | 31 +-
content/docs/deployment/csmoperator/_index.md | 168 +++----
.../csmoperator/drivers/powerflex.md | 7 +-
.../csmoperator/drivers/powermax.md | 22 -
.../deployment/csmoperator/drivers/unity.md | 1 -
.../authorization v2.0 Tech Preview.md | 366 ---------------
.../csmoperator/modules/authorization.md | 134 ++----
.../csmoperator/modules/observability.md | 50 +-
.../csmoperator/modules/replication.md | 4 +-
.../csmoperator/modules/resiliency.md | 10 +-
.../deployment/csmoperator/release/_index.md | 4 +-
.../helm/drivers/installation/isilon.md | 16 +-
.../helm/drivers/installation/powerflex.md | 13 +-
.../helm/drivers/installation/powermax.md | 189 ++++----
.../helm/drivers/installation/powerstore.md | 7 +-
.../helm/drivers/installation/unity.md | 14 +-
.../deployment/helm/drivers/upgrade/isilon.md | 11 +-
.../helm/drivers/upgrade/powerflex.md | 10 +-
.../helm/drivers/upgrade/powermax.md | 7 +-
.../helm/drivers/upgrade/powerstore.md | 11 +-
.../deployment/helm/drivers/upgrade/unity.md | 9 +-
.../installation/authorization/_index.md | 10 +-
.../modules/installation/encryption/vault.md | 2 +-
.../replication/install-repctl.md | 4 +-
.../replication/install-script.md | 4 +-
.../modules/installation/resiliency/_index.md | 34 --
.../helm/modules/upgrade/observability.md | 2 +-
.../helm/modules/upgrade/replication.md | 2 +-
.../docs/deployment/offline/drivers/_index.md | 48 +-
.../authorization/authorization.md | 8 +-
content/docs/observability/release/_index.md | 2 +-
content/docs/prerequisites/_index.md | 78 +--
content/docs/replication/release/_index.md | 2 +-
content/docs/resiliency/_index.md | 25 +-
content/docs/resiliency/release/_index.md | 2 +-
content/docs/snapshots/_index.md | 8 +-
content/docs/support/cert-csi/_index.md | 76 +--
content/docs/support/cli/_index.md | 69 +--
content/docs/support/release/_index.md | 2 +-
.../docs/support/troubleshooting/_index.md | 2 +-
content/v1/csidriver/features/powerscale.md | 2 +-
.../v1/csidriver/installation/helm/isilon.md | 8 +-
.../csidriver/installation/helm/powerflex.md | 3 +-
.../csidriver/installation/helm/powermax.md | 3 +-
.../csidriver/installation/helm/powerstore.md | 3 +-
.../v1/csidriver/installation/helm/unity.md | 5 +-
.../v1/csidriver/installation/test/certcsi.md | 45 +-
.../csidriver/upgradation/drivers/isilon.md | 5 +-
.../upgradation/drivers/powerflex.md | 5 +-
.../csidriver/upgradation/drivers/powermax.md | 3 +-
.../upgradation/drivers/powerstore.md | 4 +-
.../v1/csidriver/upgradation/drivers/unity.md | 5 +-
.../csmoperator/drivers/powerflex.md | 2 +-
content/v2/csidriver/features/powerscale.md | 2 +-
.../v2/csidriver/installation/helm/isilon.md | 8 +-
.../csidriver/installation/helm/powerflex.md | 3 +-
.../csidriver/installation/helm/powermax.md | 3 +-
.../csidriver/installation/helm/powerstore.md | 3 +-
.../v2/csidriver/installation/helm/unity.md | 5 +-
.../csidriver/upgradation/drivers/isilon.md | 5 +-
.../upgradation/drivers/powerflex.md | 5 +-
.../csidriver/upgradation/drivers/powermax.md | 3 +-
.../upgradation/drivers/powerstore.md | 5 +-
.../v2/csidriver/upgradation/drivers/unity.md | 5 +-
.../csmoperator/drivers/powerflex.md | 2 +-
content/v3/csidriver/features/powerscale.md | 2 +-
.../v3/csidriver/installation/helm/isilon.md | 3 -
.../csmoperator/drivers/powerflex.md | 2 +-
119 files changed, 1087 insertions(+), 2086 deletions(-)
rename content/docs/authorization/{v1.x GA => }/Backup and Restore/_index.md (100%)
rename content/docs/authorization/{v1.x GA => }/Backup and Restore/helm/_index.md (100%)
rename content/docs/authorization/{v1.x GA => }/Backup and Restore/rpm/_index.md (100%)
rename content/docs/authorization/{v1.x GA => }/cli.md (100%)
rename content/docs/authorization/{v1.x GA => }/configuration/_index.md (100%)
rename content/docs/authorization/{v1.x GA => }/configuration/powerflex/_index.md (83%)
rename content/docs/authorization/{v1.x GA => }/configuration/powermax/_index.md (73%)
rename content/docs/authorization/{v1.x GA => }/configuration/powerscale/_index.md (83%)
rename content/docs/authorization/{v1.x GA => }/configuration/proxy-server/_index.md (100%)
rename content/docs/authorization/{v1.x GA => }/design.md (100%)
rename content/docs/authorization/{v1.x GA => }/design1.png (100%)
rename content/docs/authorization/{v1.x GA => }/design2.png (100%)
rename content/docs/authorization/{v1.x GA => }/karavi-authorization-example.png (100%)
rename content/docs/authorization/{v1.x GA => }/release/_index.md (59%)
rename content/docs/authorization/{v1.x GA => }/troubleshooting.md (100%)
delete mode 100644 content/docs/authorization/v1.x GA/_index.md
delete mode 100644 content/docs/authorization/v2.0 Tech Preview/_index.md
delete mode 100644 content/docs/authorization/v2.0 Tech Preview/authorization-ha-example.png
delete mode 100644 content/docs/authorization/v2.0 Tech Preview/configuration/_index.md
delete mode 100644 content/docs/authorization/v2.0 Tech Preview/configuration/powerflex/_index.md
delete mode 100644 content/docs/authorization/v2.0 Tech Preview/configuration/proxy-server/_index.md
delete mode 100644 content/docs/authorization/v2.0 Tech Preview/image.png
rename content/docs/deployment/csminstallationwizard/src/templates/helm/{csm-1.11.0-values.template => csm-1.7.0-values.template} (69%)
create mode 100644 content/docs/deployment/csminstallationwizard/src/templates/helm/csm-1.7.1-values.template
rename content/docs/deployment/csminstallationwizard/src/templates/operator/{csm-isilon-1.11.0.template => csm-isilon-1.7.0.template} (95%)
rename content/docs/deployment/csminstallationwizard/src/templates/operator/{csm-powermax-1.11.0.template => csm-powermax-1.7.0.template} (66%)
rename content/docs/deployment/csminstallationwizard/src/templates/operator/{csm-powerstore-1.11.0.template => csm-powerstore-1.7.0.template} (90%)
delete mode 100644 content/docs/deployment/csmoperator/modules/authorization v2.0 Tech Preview.md
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 727eebcf08..c5168cc4bd 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -10,6 +10,7 @@
# Bharath Sreekanth (bharathsreekanth)
# Deepak Ghivari (Deepak-Ghivari)
# Sean Gallacher (gallacher)
+# Marek Suski (mareksuski-dell)
# MaĆgorzata Dutka (mdutka-dell)
# Matt Schmaelzle (mjsdell)
# Mukesh Gandharva (mgandharva)
@@ -22,4 +23,4 @@
# Shayna Finocchiaro (shaynafinocchiaro)
# Shefali Malhotra (shefali-malhotra)
-* @atye @bharathsreekanth @Deepak-Ghivari @gallacher @mdutka-dell @mgandharva @mjsdell @prablr79 @rajendraindukuri @rajkumar-palani @rsedlock1958 @shanmydell @sharont58 @shaynafinocchiaro @shefali-malhotra
+* @atye @bharathsreekanth @Deepak-Ghivari @gallacher @mareksuski-dell @mdutka-dell @mgandharva @mjsdell @prablr79 @rajendraindukuri @rajkumar-palani @rsedlock1958 @shanmydell @sharont58 @shaynafinocchiaro @shefali-malhotra
diff --git a/config.toml b/config.toml
index 919f68ed82..864d367c7e 100644
--- a/config.toml
+++ b/config.toml
@@ -172,19 +172,19 @@ enable = false
# icon = "fa fa-envelope"
# desc = "Discuss development issues around the project"
[[params.versions]]
- version = "Current(v1.11.0)"
+ version = "Current(v1.10.2)"
url = "https://dell.github.io/csm-docs/docs/"
[[params.versions]]
- version = "v1.10.2"
+ version = "v1.9.4"
url = "https://dell.github.io/csm-docs/v1"
[[params.versions]]
- version = "v1.9.4"
+ version = "v1.8.0"
url = "https://dell.github.io/csm-docs/v2"
[[params.versions]]
- version = "v1.8.0"
+ version = "v1.7.1"
url = "https://dell.github.io/csm-docs/v3"
[[menu.main]]
diff --git a/content/docs/applicationmobility/release/_index.md b/content/docs/applicationmobility/release/_index.md
index 69c92138a5..b252668f77 100644
--- a/content/docs/applicationmobility/release/_index.md
+++ b/content/docs/applicationmobility/release/_index.md
@@ -6,7 +6,7 @@ Description: >
Release Notes
---
-## Release Notes - CSM Application Mobility v1.0.4
+## Release Notes - CSM Application Mobility v1.0.2
### New Features/Changes
diff --git a/content/docs/authorization/v1.x GA/Backup and Restore/_index.md b/content/docs/authorization/Backup and Restore/_index.md
similarity index 100%
rename from content/docs/authorization/v1.x GA/Backup and Restore/_index.md
rename to content/docs/authorization/Backup and Restore/_index.md
diff --git a/content/docs/authorization/v1.x GA/Backup and Restore/helm/_index.md b/content/docs/authorization/Backup and Restore/helm/_index.md
similarity index 100%
rename from content/docs/authorization/v1.x GA/Backup and Restore/helm/_index.md
rename to content/docs/authorization/Backup and Restore/helm/_index.md
diff --git a/content/docs/authorization/v1.x GA/Backup and Restore/rpm/_index.md b/content/docs/authorization/Backup and Restore/rpm/_index.md
similarity index 100%
rename from content/docs/authorization/v1.x GA/Backup and Restore/rpm/_index.md
rename to content/docs/authorization/Backup and Restore/rpm/_index.md
diff --git a/content/docs/authorization/_index.md b/content/docs/authorization/_index.md
index a1b5c26051..04dc1f89d4 100644
--- a/content/docs/authorization/_index.md
+++ b/content/docs/authorization/_index.md
@@ -6,7 +6,7 @@ Description: >
Dell Technologies (Dell) Container Storage Modules (CSM) for Authorization
---
-[Container Storage Modules](https://github.com/dell/csm) (CSM) for Authorization is part of the open-source suite of Kubernetes storage enablers for Dell products.
+[Container Storage Modules](https://github.com/dell/csm) (CSM) for Authorization is part of the open-source suite of Kubernetes storage enablers for Dell products.
CSM for Authorization provides storage and Kubernetes administrators the ability to apply RBAC for Dell CSI Drivers. It does this by deploying a proxy between the CSI driver and the storage system to enforce role-based access and usage rules.
@@ -14,4 +14,55 @@ Storage administrators of compatible storage platforms will be able to apply quo
Kubernetes administrators will have an interface to create, delete, and manage roles/groups that storage rules may be applied. Administrators and/or users may then generate authentication tokens that may be used by tenants to use storage with proper access policies being automatically enforced.
-Currently, we have two versions of Authorization, **v1.x GA** and **v2.0 Tech Preview**.
\ No newline at end of file
+The following diagram shows a high-level overview of CSM for Authorization with a `tenant-app` that is using a CSI driver to perform storage operations through the CSM for Authorization `proxy-server` to access the a Dell storage system. All requests from the CSI driver will contain the token for the given tenant that was granted by the Storage Administrator.
+
+![CSM for Authorization](./karavi-authorization-example.png "CSM for Authorization")
+
+## CSM for Authorization Capabilities
+{{
}}
+| Feature | PowerFlex | PowerMax | PowerScale | Unity XT | PowerStore |
+| - | - | - | - | - | - |
+| Ability to set storage quota limits to ensure k8s tenants are not overconsuming storage | Yes | Yes | No (natively supported) | No | No |
+| Ability to create access control policies to ensure k8s tenant clusters are not accessing storage that does not belong to them | Yes | Yes | No (natively supported) | No | No |
+| Ability to shield storage credentials from Kubernetes administrators ensuring credentials are only handled by storage admins | Yes | Yes | Yes | No | No |
+{{
}}
+
+**NOTE:** PowerScale OneFS implements its own form of Role-Based Access Control (RBAC). CSM for Authorization does not enforce any role-based restrictions for PowerScale. To configure RBAC for PowerScale, refer to the PowerScale OneFS [documentation](https://www.dell.com/support/home/en-us/product-support/product/isilon-onefs/docs).
+
+## Authorization Components Support Matrix
+CSM for Authorization consists of 2 components - The authorization sidecar, bundled with the driver, communicates with the Authorization proxy server to validate access to Storage platforms. The authorization sidecar is backward compatible with older Authorization proxy server versions. However, it is highly recommended to have the Authorization proxy server and sidecar installed from the same release of CSM.
+
+**NOTE:** If the deployed CSI driver has a number of controller pods equal to the number of schedulable nodes in your cluster, CSM for Authorization may not be able to inject properly into the driver's controller pod.
+To resolve this, please refer to our [troubleshooting guide](./troubleshooting) on the topic.
+
+## Roles and Responsibilities
+
+The CSM for Authorization CLI can be executed in the context of the following roles:
+- Storage Administrators
+- Kubernetes Tenant Administrators
+
+### Storage Administrators
+
+Storage Administrators can perform the following operations within CSM for Authorization
+
+- Tenant Management (create, get, list, delete, bind roles, unbind roles)
+- Token Management (generate, revoke)
+- Storage System Management (create, get, list, update, delete)
+- Storage Access Roles Management (assign to a storage system with an optional quota)
+
+### Tenant Administrators
+
+Tenants of CSM for Authorization can use the token provided by the Storage Administrators in their storage requests.
+
+### Workflow
+
+1) Tenant Admin requests storage from a Storage Admin.
+2) Storage Admin uses CSM Authorization CLI to:
+ a) Create a tenant resource.
+ b) Create a role permitting desired storage access.
+ c) Assign the role to the tenant and generate a token.
+3) Storage Admin returns a token to the Tenant Admin.
+4) Tenant Admin inputs the Token into their Kubernetes cluster as a Secret.
+5) Tenant Admin updates CSI driver with CSM Authorization sidecar module.
+
+![CSM for Authorization Workflow](./design2.png "CSM for Authorization Workflow")
diff --git a/content/docs/authorization/v1.x GA/cli.md b/content/docs/authorization/cli.md
similarity index 100%
rename from content/docs/authorization/v1.x GA/cli.md
rename to content/docs/authorization/cli.md
diff --git a/content/docs/authorization/v1.x GA/configuration/_index.md b/content/docs/authorization/configuration/_index.md
similarity index 100%
rename from content/docs/authorization/v1.x GA/configuration/_index.md
rename to content/docs/authorization/configuration/_index.md
diff --git a/content/docs/authorization/v1.x GA/configuration/powerflex/_index.md b/content/docs/authorization/configuration/powerflex/_index.md
similarity index 83%
rename from content/docs/authorization/v1.x GA/configuration/powerflex/_index.md
rename to content/docs/authorization/configuration/powerflex/_index.md
index dd24f52ca4..06c0e803cc 100644
--- a/content/docs/authorization/v1.x GA/configuration/powerflex/_index.md
+++ b/content/docs/authorization/configuration/powerflex/_index.md
@@ -55,7 +55,7 @@ Given a setup where Kubernetes, a storage system, and the CSM for Authorization
**Helm**
- Refer to the [Install the Driver](../../../../deployment/helm/drivers/installation/powerflex/#install-the-driver) section to edit the parameters in `samples/config.yaml` to configure the driver to communicate with the CSM Authorization sidecar.
+ Refer to the [Install the Driver](../../../deployment/helm/drivers/installation/powerflex/#install-the-driver) section to edit the parameters in `samples/config.yaml` to configure the driver to communicate with the CSM Authorization sidecar.
- Update `endpoint` to match the localhost endpoint in `samples/secret/karavi-authorization-config.json`.
@@ -78,7 +78,7 @@ Given a setup where Kubernetes, a storage system, and the CSM for Authorization
**Operator**
- Refer to the [Create Secret](../../../../deployment/csmoperator/drivers/powerflex/#create-secret) section to prepare `secret.yaml` to configure the driver to communicate with the CSM Authorization sidecar.
+ Refer to the [Create Secret](../../../deployment/csmoperator/drivers/powerflex/#create-secret) section to prepare `secret.yaml` to configure the driver to communicate with the CSM Authorization sidecar.
- Update `endpoint` to match the localhost endpoint in `samples/secret/karavi-authorization-config.json`.
@@ -102,7 +102,7 @@ Given a setup where Kubernetes, a storage system, and the CSM for Authorization
**Helm**
- Refer to the [Install the Driver](../../../../deployment/helm/drivers/installation/powerflex/#install-the-driver) section to edit the parameters in `myvalues.yaml` to enable CSM Authorization.
+ Refer to the [Install the Driver](../../../deployment/helm/drivers/installation/powerflex/#install-the-driver) section to edit the parameters in `myvalues.yaml` to enable CSM Authorization.
- Update `authorization.enabled` to `true`.
@@ -119,8 +119,8 @@ Given a setup where Kubernetes, a storage system, and the CSM for Authorization
enabled: true
# sidecarProxyImage: the container image used for the csm-authorization-sidecar.
- # Default value: dellemc/csm-authorization-sidecar:v1.11.0
- sidecarProxyImage: dellemc/csm-authorization-sidecar:v1.11.0
+ # Default value: dellemc/csm-authorization-sidecar:v1.10.0
+ sidecarProxyImage: dellemc/csm-authorization-sidecar:v1.10.0
# proxyHost: hostname of the csm-authorization server
# Default value: None
@@ -136,7 +136,7 @@ Given a setup where Kubernetes, a storage system, and the CSM for Authorization
**Operator**
- Refer to the [Install Driver](../../../../deployment/csmoperator/drivers/powerflex/#install-driver) section to edit the parameters in the Custom Resource to enable CSM Authorization.
+ Refer to the [Install Driver](../../../deployment/csmoperator/drivers/powerflex/#install-driver) section to edit the parameters in the Custom Resource to enable CSM Authorization.
Under `modules`, enable the module named `authorization`:
@@ -156,10 +156,10 @@ Given a setup where Kubernetes, a storage system, and the CSM for Authorization
- name: authorization
# enable: Enable/Disable csm-authorization
enabled: true
- configVersion: v1.11.0
+ configVersion: v1.10.0
components:
- name: karavi-authorization-proxy
- image: dellemc/csm-authorization-sidecar:v1.11.0
+ image: dellemc/csm-authorization-sidecar:v1.10.0
envs:
# proxyHost: hostname of the csm-authorization server
- name: "PROXY_HOST"
@@ -172,4 +172,4 @@ Given a setup where Kubernetes, a storage system, and the CSM for Authorization
6. Install the Dell CSI PowerFlex driver following the appropriate documenation for your installation method.
-7. (Optional) Install [dellctl](../../../../support/cli/#installation-instructions) to perform Kubernetes administrator commands for additional capabilities (e.g., list volumes). Please refer to the [dellctl documentation page](../../../../support/cli) for the installation steps and command list.
+7. (Optional) Install [dellctl](../../../support/cli/#installation-instructions) to perform Kubernetes administrator commands for additional capabilities (e.g., list volumes). Please refer to the [dellctl documentation page](../../../support/cli) for the installation steps and command list.
\ No newline at end of file
diff --git a/content/docs/authorization/v1.x GA/configuration/powermax/_index.md b/content/docs/authorization/configuration/powermax/_index.md
similarity index 73%
rename from content/docs/authorization/v1.x GA/configuration/powermax/_index.md
rename to content/docs/authorization/configuration/powermax/_index.md
index 8032a47bb1..4003f65efd 100644
--- a/content/docs/authorization/v1.x GA/configuration/powermax/_index.md
+++ b/content/docs/authorization/configuration/powermax/_index.md
@@ -55,17 +55,17 @@ Create the karavi-authorization-config secret using this command:
**Helm**
- Refer to the [Install the Driver](../../../../deployment/helm/drivers/installation/powermax/#install-the-driver) section where you edit `samples/secret/secret.yaml` with the credentials of the PowerMax. Leave `username` and `password` with the default values as they will be ignored.
+ Refer to the [Install the Driver](../../../deployment/helm/drivers/installation/powermax/#install-the-driver) section where you edit `samples/secret/secret.yaml` with the credentials of the PowerMax. Leave `username` and `password` with the default values as they will be ignored.
**Operator**
- Refer to the [Install the Driver](../../../../deployment/csmoperator/drivers/powermax/#install-driver) section to prepare `powermax-creds.yaml`. Leave `username` and `password` with the default values as they will be ignored.
+ Refer to the [Install the Driver](../../../deployment/csmoperator/drivers/powermax/#install-driver) section to prepare `powermax-creds.yaml`. Leave `username` and `password` with the default values as they will be ignored.
5. Enable CSM Authorization in the driver installation applicable to your installation method.
**Helm**
- Refer to the [Install the Driver](../../../../deployment/helm/drivers/installation/powermax/#install-the-driver) section to edit the parameters in `my-powermax-settings.yaml` file to configure the driver to communicate with the CSM Authorization sidecar.
+ Refer to the [Install the Driver](../../../deployment/helm/drivers/installation/powermax/#install-the-driver) section to edit the parameters in `my-powermax-settings.yaml` file to configure the driver to communicate with the CSM Authorization sidecar.
- Update `global.storageArrays.endpoint` to match the localhost endpoint in `samples/secret/karavi-authorization-config.json`.
@@ -79,8 +79,6 @@ Create the karavi-authorization-config secret using this command:
- Update `authorization.skipCertificateValidation` to `true` or `false` depending on if you want to disable or enable certificate validation of the CSM Authorization Proxy Server.
- - Update `csireverseproxy.deployAsSidecar` to `true`.
-
Example:
```yaml
@@ -91,20 +89,12 @@ Create the karavi-authorization-config secret using this command:
managementServers:
- endpoint: https://localhost:9400
- csireverseproxy:
- # Set enabled to true if you want to deploy csireverseproxy as sidecar
- # Allowed values:
- # "true" - CSI reverse proxy will be deployed as a sidecar
- # "false" - CSI reverse proxy will be deployed along with driver
- # Default value: "true"
- deployAsSidecar: true
-
authorization:
enabled: true
# sidecarProxyImage: the container image used for the csm-authorization-sidecar.
- # Default value: dellemc/csm-authorization-sidecar:v1.11.0
- sidecarProxyImage: dellemc/csm-authorization-sidecar:v1.11.0
+ # Default value: dellemc/csm-authorization-sidecar:v1.10.0
+ sidecarProxyImage: dellemc/csm-authorization-sidecar:v1.10.0
# proxyHost: hostname of the csm-authorization server
# Default value: None
@@ -120,7 +110,7 @@ Create the karavi-authorization-config secret using this command:
**Operator**
- Refer to the [Install Driver](../../../../deployment/csmoperator/drivers/powermax/#install-driver) section to edit the parameters in the Custom Resource to enable CSM Authorization.
+ Refer to the [Install Driver](../../../deployment/csmoperator/drivers/powermax/#install-driver) section to edit the parameters in the Custom Resource to enable CSM Authorization.
Under `modules`, enable the module named `authorization`:
@@ -132,30 +122,18 @@ Create the karavi-authorization-config secret using this command:
- Update the `SKIP_CERTIFICATE_VALIDATION` environment value to `true` or `false` depending on if you want to disable or enable certificate validation of the CSM Authorization Proxy Server.
- - Update the `DeployAsSidecar` environment variable for the `csipowermax-reverseproxy` component to `true`.
-
Example:
```yaml
modules:
- - name: csireverseproxy
- # enabled: Always set to true
- enabled: true
- forceRemoveModule: true
- configVersion: v2.10.0
- components:
- - name: csipowermax-reverseproxy
- envs:
- - name: "DeployAsSidecar"
- value: "true"
# Authorization: enable csm-authorization for RBAC
- name: authorization
# enable: Enable/Disable csm-authorization
enabled: true
- configVersion: v1.11.0
+ configVersion: v1.10.0
components:
- name: karavi-authorization-proxy
- image: dellemc/csm-authorization-sidecar:v1.11.0
+ image: dellemc/csm-authorization-sidecar:v1.10.0
envs:
# proxyHost: hostname of the csm-authorization server
- name: "PROXY_HOST"
@@ -168,4 +146,4 @@ Create the karavi-authorization-config secret using this command:
5. Install the Dell CSI PowerMax driver following the appropriate documenation for your installation method.
-6. (Optional) Install [dellctl](../../../../support/cli/#installation-instructions) to perform Kubernetes administrator commands for additional capabilities (e.g., list volumes). Please refer to the [dellctl documentation page](../../../../support/cli) for the installation steps and command list.
+6. (Optional) Install [dellctl](../../../support/cli/#installation-instructions) to perform Kubernetes administrator commands for additional capabilities (e.g., list volumes). Please refer to the [dellctl documentation page](../../../support/cli) for the installation steps and command list.
\ No newline at end of file
diff --git a/content/docs/authorization/v1.x GA/configuration/powerscale/_index.md b/content/docs/authorization/configuration/powerscale/_index.md
similarity index 83%
rename from content/docs/authorization/v1.x GA/configuration/powerscale/_index.md
rename to content/docs/authorization/configuration/powerscale/_index.md
index 914e09a1cc..58c0f19c91 100644
--- a/content/docs/authorization/v1.x GA/configuration/powerscale/_index.md
+++ b/content/docs/authorization/configuration/powerscale/_index.md
@@ -56,7 +56,7 @@ kubectl -n isilon create secret generic karavi-authorization-config --from-file=
**Helm**
- Refer to the [Install the Driver](../../../../deployment/helm/drivers/installation/isilon/#install-the-driver) section to edit the parameters to prepare the `samples/secret/secret.yaml` file to configure the driver to communicate with the CSM Authorization sidecar.
+ Refer to the [Install the Driver](../../../deployment/helm/drivers/installation/isilon/#install-the-driver) section to edit the parameters to prepare the `samples/secret/secret.yaml` file to configure the driver to communicate with the CSM Authorization sidecar.
- Update `endpoint` to match the localhost endpoint in `samples/secret/karavi-authorization-config.json`.
@@ -82,7 +82,7 @@ kubectl -n isilon create secret generic karavi-authorization-config --from-file=
**Operator**
- Refer to the [Prerequisite](../../../../deployment/csmoperator/drivers/powerscale/#prerequisite) section to prepare the `secret.yaml` file to configure the driver to communicate with the CSM Authorization sidecar.
+ Refer to the [Prerequisite](../../../deployment/csmoperator/drivers/powerscale/#prerequisite) section to prepare the `secret.yaml` file to configure the driver to communicate with the CSM Authorization sidecar.
- Update `endpoint` to match the localhost endpoint in `samples/secret/karavi-authorization-config.json`.
@@ -110,7 +110,7 @@ kubectl -n isilon create secret generic karavi-authorization-config --from-file=
**Helm**
- Refer to the [Install the Driver](../../../../deployment/helm/drivers/installation/isilon/#install-the-driver) section to edit the parameters in `my-isilon-settings.yaml` file to enable CSM Authorization.
+ Refer to the [Install the Driver](../../../deployment/helm/drivers/installation/isilon/#install-the-driver) section to edit the parameters in `my-isilon-settings.yaml` file to enable CSM Authorization.
- Update `authorization.enabled` to `true`.
@@ -127,8 +127,8 @@ kubectl -n isilon create secret generic karavi-authorization-config --from-file=
enabled: true
# sidecarProxyImage: the container image used for the csm-authorization-sidecar.
- # Default value: dellemc/csm-authorization-sidecar:v1.11.0
- sidecarProxyImage: dellemc/csm-authorization-sidecar:v1.11.0
+ # Default value: dellemc/csm-authorization-sidecar:v1.10.0
+ sidecarProxyImage: dellemc/csm-authorization-sidecar:v1.10.0
# proxyHost: hostname of the csm-authorization server
# Default value: None
@@ -144,7 +144,7 @@ kubectl -n isilon create secret generic karavi-authorization-config --from-file=
**Operator**
- Refer to the [Install Driver](../../../../deployment/csmoperator/drivers/powerscale/#install-driver) section to edit the parameters in the Custom Resource to enable CSM Authorization.
+ Refer to the [Install Driver](../../../deployment/csmoperator/drivers/powerscale/#install-driver) section to edit the parameters in the Custom Resource to enable CSM Authorization.
Under `modules`, enable the module named `authorization`:
@@ -162,10 +162,10 @@ kubectl -n isilon create secret generic karavi-authorization-config --from-file=
- name: authorization
# enable: Enable/Disable csm-authorization
enabled: true
- configVersion: v1.11.0
+ configVersion: v1.10.0
components:
- name: karavi-authorization-proxy
- image: dellemc/csm-authorization-sidecar:v1.11.0
+ image: dellemc/csm-authorization-sidecar:v1.10.0
envs:
# proxyHost: hostname of the csm-authorization server
- name: "PROXY_HOST"
@@ -178,4 +178,4 @@ kubectl -n isilon create secret generic karavi-authorization-config --from-file=
6. Install the Dell CSI PowerScale driver following the appropriate documenation for your installation method.
-7. (Optional) Install [dellctl](../../../../support/cli/#installation-instructions) to perform Kubernetes administrator commands for additional capabilities (e.g., list volumes). Please refer to the [dellctl documentation page](../../../../support/cli) for the installation steps and command list.
+7. (Optional) Install [dellctl](../../../support/cli/#installation-instructions) to perform Kubernetes administrator commands for additional capabilities (e.g., list volumes). Please refer to the [dellctl documentation page](../../../support/cli) for the installation steps and command list.
\ No newline at end of file
diff --git a/content/docs/authorization/v1.x GA/configuration/proxy-server/_index.md b/content/docs/authorization/configuration/proxy-server/_index.md
similarity index 100%
rename from content/docs/authorization/v1.x GA/configuration/proxy-server/_index.md
rename to content/docs/authorization/configuration/proxy-server/_index.md
diff --git a/content/docs/authorization/v1.x GA/design.md b/content/docs/authorization/design.md
similarity index 100%
rename from content/docs/authorization/v1.x GA/design.md
rename to content/docs/authorization/design.md
diff --git a/content/docs/authorization/v1.x GA/design1.png b/content/docs/authorization/design1.png
similarity index 100%
rename from content/docs/authorization/v1.x GA/design1.png
rename to content/docs/authorization/design1.png
diff --git a/content/docs/authorization/v1.x GA/design2.png b/content/docs/authorization/design2.png
similarity index 100%
rename from content/docs/authorization/v1.x GA/design2.png
rename to content/docs/authorization/design2.png
diff --git a/content/docs/authorization/v1.x GA/karavi-authorization-example.png b/content/docs/authorization/karavi-authorization-example.png
similarity index 100%
rename from content/docs/authorization/v1.x GA/karavi-authorization-example.png
rename to content/docs/authorization/karavi-authorization-example.png
diff --git a/content/docs/authorization/v1.x GA/release/_index.md b/content/docs/authorization/release/_index.md
similarity index 59%
rename from content/docs/authorization/v1.x GA/release/_index.md
rename to content/docs/authorization/release/_index.md
index 489a70dbd4..7f187338c5 100644
--- a/content/docs/authorization/v1.x GA/release/_index.md
+++ b/content/docs/authorization/release/_index.md
@@ -6,7 +6,7 @@ Description: >
Dell Container Storage Modules (CSM) release notes for authorization
---
-## Release Notes - CSM Authorization 1.11.0
+## Release Notes - CSM Authorization 1.10.1
@@ -26,3 +26,4 @@ Description: >
### Known Issues
| Issue | Workaround |
|-------|------------|
+| CSM Operator does not support dynamic namespaces for Authorization. Despite successful installation in a namespace other than "authorization", errors may arise during volume creation. | Use the default namespace "authorization" for installing Authorization using CSM Operator|
diff --git a/content/docs/authorization/v1.x GA/troubleshooting.md b/content/docs/authorization/troubleshooting.md
similarity index 100%
rename from content/docs/authorization/v1.x GA/troubleshooting.md
rename to content/docs/authorization/troubleshooting.md
diff --git a/content/docs/authorization/v1.x GA/_index.md b/content/docs/authorization/v1.x GA/_index.md
deleted file mode 100644
index 21d8e269ef..0000000000
--- a/content/docs/authorization/v1.x GA/_index.md
+++ /dev/null
@@ -1,62 +0,0 @@
----
-title: Authorization - v1.x GA
-linktitle: v1.x GA
-weight: 4
-Description: >
- Dell Technologies (Dell) Container Storage Modules (CSM) for Authorization v1.x GA.
-tags:
- - csm-authorization
----
-
-The following diagram shows a high-level overview of CSM for Authorization with a `tenant-app` that is using a CSI driver to perform storage operations through the CSM for Authorization `proxy-server` to access the a Dell storage system. All requests from the CSI driver will contain the token for the given tenant that was granted by the Storage Administrator.
-
-![CSM for Authorization](./karavi-authorization-example.png "CSM for Authorization")
-
-## CSM for Authorization Capabilities
-{{}}
-| Feature | PowerFlex | PowerMax | PowerScale | Unity XT | PowerStore |
-| - | - | - | - | - | - |
-| Ability to set storage quota limits to ensure k8s tenants are not overconsuming storage | Yes | Yes | No (natively supported) | No | No |
-| Ability to create access control policies to ensure k8s tenant clusters are not accessing storage that does not belong to them | Yes | Yes | No (natively supported) | No | No |
-| Ability to shield storage credentials from Kubernetes administrators ensuring credentials are only handled by storage admins | Yes | Yes | Yes | No | No |
-{{
}}
-
-**NOTE:** PowerScale OneFS implements its own form of Role-Based Access Control (RBAC). CSM for Authorization does not enforce any role-based restrictions for PowerScale. To configure RBAC for PowerScale, refer to the PowerScale OneFS [documentation](https://www.dell.com/support/home/en-us/product-support/product/isilon-onefs/docs).
-
-## Authorization Components Support Matrix
-CSM for Authorization consists of 2 components - The authorization sidecar, bundled with the driver, communicates with the Authorization proxy server to validate access to Storage platforms. The authorization sidecar is backward compatible with older Authorization proxy server versions. However, it is highly recommended to have the Authorization proxy server and sidecar installed from the same release of CSM.
-
-**NOTE:** If the deployed CSI driver has a number of controller pods equal to the number of schedulable nodes in your cluster, CSM for Authorization may not be able to inject properly into the driver's controller pod.
-To resolve this, please refer to our [troubleshooting guide](./troubleshooting) on the topic.
-
-## Roles and Responsibilities
-
-The CSM for Authorization CLI can be executed in the context of the following roles:
-- Storage Administrators
-- Kubernetes Tenant Administrators
-
-### Storage Administrators
-
-Storage Administrators can perform the following operations within CSM for Authorization
-
-- Tenant Management (create, get, list, delete, bind roles, unbind roles)
-- Token Management (generate, revoke)
-- Storage System Management (create, get, list, update, delete)
-- Storage Access Roles Management (assign to a storage system with an optional quota)
-
-### Tenant Administrators
-
-Tenants of CSM for Authorization can use the token provided by the Storage Administrators in their storage requests.
-
-### Workflow
-
-1) Tenant Admin requests storage from a Storage Admin.
-2) Storage Admin uses CSM Authorization CLI to:
- a) Create a tenant resource.
- b) Create a role permitting desired storage access.
- c) Assign the role to the tenant and generate a token.
-3) Storage Admin returns a token to the Tenant Admin.
-4) Tenant Admin inputs the Token into their Kubernetes cluster as a Secret.
-5) Tenant Admin updates CSI driver with CSM Authorization sidecar module.
-
-![CSM for Authorization Workflow](./design2.png "CSM for Authorization Workflow")
diff --git a/content/docs/authorization/v2.0 Tech Preview/_index.md b/content/docs/authorization/v2.0 Tech Preview/_index.md
deleted file mode 100644
index 2da76696a7..0000000000
--- a/content/docs/authorization/v2.0 Tech Preview/_index.md
+++ /dev/null
@@ -1,78 +0,0 @@
----
-title: Authorization - v2.0 Tech Preview
-linktitle: v2.0 Tech Preview
-weight: 4
-Description: >
- Dell Technologies (Dell) Container Storage Modules (CSM) for Authorization v2.0 Tech Preview.
-tags:
- - csm-authorization
----
-
->> NOTE: This tech-preview release is not intended for use in production environment.
-
->> NOTE: Only supported on PowerFlex.
-
-The following diagram shows a high-level overview of CSM for Authorization with a `tenant-app` that is using a CSI driver to perform storage operations through the CSM for Authorization `proxy-server` to access the a Dell storage system. All requests from the CSI driver will contain the token for the given tenant that was granted by the Storage Administrator.
-
-![Alt text](image.png)
-
-This is the introduction to a Stateless Architecture for Authorization. The creation of storage, roles, and tenants is done through Custom Resources (CRs) which are tracked and contained within CSM Authorization. The underlying communication is consistent with the previous architecture which makes the creation of volumes and snapshots seamless.
-
-## CSM for Authorization Capabilities
-{{}}
-| Feature | PowerFlex | PowerMax | PowerScale |
-| ----------------------------------------------------------------------------------------------------------------------------- | --------- | -------- | ---------- |
-| Ability to set storage quota limits to ensure k8s tenants are not overconsuming storage | Yes | No | No |
-| Ability to create access control policies to ensure k8s tenant clusters are not accessing storage that does not belong to them | Yes | No | No |
-| Ability to shield storage credentials from Kubernetes administrators by storing them in vault | Yes | No | No |
-| Ability to create snapshots from owned volumes that consume the storage quota | Yes | No | No |
-| Ability to periodically query storage array to keep quota consumption in sync | Yes | No | No |
-{{
}}
-
-### Snapshot Support
-
-As stated above, all snapshot requests that are associated with a volume that has been approved and created will go through a similar authorization processes ensuring that the snapshot fits within the allotted quota.
-
-```yaml
-apiVersion: snapshot.storage.k8s.io/v1
-kind: VolumeSnapshot
-metadata:
- name: vol1-snapshot
-spec:
- volumeSnapshotClassName: vxflexos-snapclass
- source:
- persistentVolumeClaimName: vol1
-```
-
-This will take a snapshot of the `persistent volume claim` named `vol1`. CSM Authorization will verify ownership with Redis to ensure that the tenant who is attempting to create the snapshot owns the `vol1` volume. If the tenant does own the volume, authorization will proceed to check to see if the snapshot fits within the allotted quota and add a record if it does.
-
-### Backend Storage Polling
-
-A configurable polling mechanism has been introduced to ensure that the tenant and Redis are always in sync with the backend storage configured. This is determined by the [volumePrefix](configuration/proxy-server/#configuring-tenants) specified for the `tenant`. During polling, for each of the tenants and roles, the storage service will ensure that nothing has been removed or added by the storage admin which would lead to Redis being out of sync.
-
-If a volume is created with the matching `volumePrefix`, the new entry will be added to Redis and the available quota will be consumed accordingly. Similarly, if a snapshot is created from a volume that is owned by the tenant in the backend storage array, that will be added to Redis.
-
-Lastly, if there is any deletion on the backend storage array of a volume or snapshot that is owned by the tenant, that entry will be deleted from Redis and the available capacity will reflect accordingly.
-
-## Roles and Responsibilities
-
-The Stateless CSM Authorization contains the following roles:
-- Storage Administrators
-- Kubernetes Tenant Administrators
-
-### Storage Administrators
-
-Storage Administrators perform the following:
-
-- Storage System Management (create, get, delete)
-- Role Management (create, get, delete)
-- Tenant Management (create, get, delete)
-- Token Management (create, revoke)
-
-For more information on the configuration of the above, see the configuration of the [Proxy Server](../v2.0-tech-preview/configuration/proxy-server/#configuring-storage).
-
-### Tenant Administrators
-
-Tenants of CSM for Authorization can use the token provided by the Storage Administrators in their storage requests.
-
-For more information on how to use the token and configuration, see configuration for the [PowerFlex driver](../v2.0-tech-preview/configuration/powerflex).
\ No newline at end of file
diff --git a/content/docs/authorization/v2.0 Tech Preview/authorization-ha-example.png b/content/docs/authorization/v2.0 Tech Preview/authorization-ha-example.png
deleted file mode 100644
index 5b8efc09e467690cf7bf9bffb29050d16c5cd234..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001
literal 121616
zcmeFYRa6{7+b)Vja6$;~NpQEpHCPhdoxlWl2rhvzK=9zf-61#xhv4pRK?WamaM;ba
z&&BtjbuRYhx!AQ9tEao^>guXjpZBRS6(uWKy*=)lR~H%rPu>bP%I=rNg^OrMPuEYq5|hH9OZRg5D;*?pZ^g19E!{l5T5cC
zWF$2_j1E^`n7rCv5kE0L7T!X7N%LYuRuZ50XHgL&)
zLiTNouKvajFHWyCr$W83{)b{&ApTlQ)z{Np$7t9AI-4EBmzaF)FaANsR92Ey{Rgdh
z+&y1C~rEd8_p-^>Kr9_CVLWn
zPl9tvwUUzdp1_fx)2CKUp*r*|Jyaa{ew)^pWjPixD$j*WNAAIK)necy#fQP{-AEcu
zU)Pp~^e?|-!mkptkpsczuE`N(B<%FH?eu1~cU&7UDPLwKDo+#skJmO8Elx6eZu2=8
z6{$rfX?>{pDx59KUQtzKq?l|pH_v)0pE)<3^I-Qf9Dd~^=_Ps*i233q;WvW+%n}oC
zhw@5J&;wXUCiHJGx{ZI(TchSo5+dfH?!XHRLbt#FZCfTti|j1bI`ff(iJaG6gUypP
z2Eu;m%>)&zG$+jQ716{MzJQ-66yf`a;o`<8#~_fBkTE(T2fh*G)_~w(OgvgQgyP$I
z1(4zW!0>sL%UyHV?~A5R5?J++ZhO47A?3AKG5IpKc
zw}V+X{ja;@+4a??-4HjuuP5u0y6t|g%;C||Nii|_Az*Y|3QLv`^76YXiOI=~ot>Sy
zLvYv{heO*!@KZ(Xjbzadk&W2m8=h*y@TFSQ9z>`1$pU(bj*jlG9v&X9uYR84_zf3mk?nG$)4!u5
zV9;a2JJPzcvJl((-<_tUZ7dPh<@yaJ+&*I@U}K-tV4v%akP__5Z^uJXgJMtj=k?X6
zn|(|18+RkB3#h~fS#1oF)oE!IeAGVh1&cG7|I?DGuD!jz{z4*~z7X5c(2)88dZyoP
zG4R5Pg2OmvvAx>EzhQ(*3F#u9YDX;B*PGGcse(_qLrUpFGg|eY=Q~P6XXoddq5;uj
zxAKqYnNRca8%`ErR8&;p88KhI8HEm;e{K{BM6X}hCz$FV4FM)XEa>STDn8@x;p$oo
z7@wlCCGp2oJk8fcL~mnbWBI`zw#E>ssgY0pY?-G8w_&qx?Ojv^}5_w
z8gk6|&g~Nw!JXFq_wV1LvEdTUQVr74PeLp#%*^{LS_THJmFHHW+fyfSc}DP%!A`e&q=|Wnwlk4>y4qCc%z!7rKK}IaB!~=
zs3NPZpg=ZVZj%H99rEHtnK1J3n7EcruqfW&m+9rLZ`qNP`M7cRNRNw@?lK
zRs!|)a1k8@pPQBeQbAfj#mKY6Gx&Q24i4a^@UB{O%)kP{-jl*BRUt0g6yB$+>mm)!
z+%0pmq@xN)Lyov%oBaDPMl}(k-x#GS4@$71b|BeYzkl~L1`sdX_zjAY6z(+j4V|bl
zyirL+s3K!GbeOT*6FX}AI^rM2v;kzy9at2LDh?OdWjEL1<9!cUQCagj_NGr>^Z9Ez
zs7P;9Z0>pf@#p|W0x8sG$3;XA8q({Tm+SID4w{voKJ{667}~w#vQ;sfKLYOcY|K5s
zJRW@-0eko#`J0h|dmRYQVT5#aITWD8yZi4m$p`iQhn>
z9tNZYbb4e(>L-Js6cfpPkFZyU&CqR_upx)LjM
zAM~3;dOW+Pn%LM!^+6s5ML2@{J{iTVEy>8M*iH;ZdH8$-y;&7<69FXyvuKs6i0cTm
zNC)&Xc1Ihs;&oEGkdlBo+V87xC2=s`kb0U3KoGG3%@uaBipP39P5Hz3}YD$<+s
z7GO&qp26|opV_79Q&l0$$87WW%DH+_iU=KY!-J19auI4+NRJz-}Ip&P{&svHUC5tqDA1
z>JV=#It;e_3piyD6Y)${2!t&tmz!5M3p-K=jaScA>;JhB0sKPaL?+WagaTtj__AAq
zjbnnwdpkcCf|fD5BP|_-82LUuA$y}M0783r1H3tzB#n)JpAAGT_0WX_1PTu4XR5TMi`Jg%e-17zq+#_k)4D*USb30V0wM8^u#VGBURkf1m_+-V%^
zEr?){I51!+25>43bZ3E(#sM6N5z^5AbJGIo{!orI>J-pj0$^|g9jDDT+!R-ceeM)@
zst~gl)i2K-UPqY;4LXXTQw&iiY=EMJvkVpgdDX5Vt3bqY&tw&
z*}Mj3e3Na^@go|Ax08V^X;j@P&
zbc&PGm$c37VNf4WQVO)&Y&qgwdUJWw;7eLk&hVqb4DjRb*HDCu@!idduC%T;ba{vS
zTu@~605B^KNbxED!s~Zvz)y6Slv90_HT_-~E|ASxn25YZ`K4&XdiF`Oscgm5fa=a9
zg!LM#b@Q;(TD@)g?UlAoAGxoe96m%60i%-!1=5B5@P@nJ_>zX~)oVs+`oI~GBH?HH
zw}MVt2BOSb_AMqw!|A*R$IY(sA|Sikdm3=W$kCnNf_t3YfT;RU^U?R++lg44+qX{A
z+rLzuoNq!UovoxIK9Z5W-9*QWiRIe(iBHO0wIRvu5iFtQ5s-;ua}abXrBcFzGs0Ff
zH*2w2-t<$2_pECcnRz}@UyCi_5@&LJ%d_=QzZ(^SW7kYhqau-j
z!NZGd8)FEIym!s;#6gBaic?Sg4If2<+vW0cqJ;>t_WD=N*_pFHsd(Cv3rTL51}-TN
zE>1)>T+|ipUw4{hNi%GWzhsQHv{VdIu#F|-fg8JUBW@gL>T?18F%Uc&KJ#iG_Ao5V
zeDK-fmOCfa4saL9^jva$o7;qaE~vh<+tgUyR?2PmFlsL5lG3S~;^~QY?#D#}Zk${*
z5t%diVh{_n^xV0jND%a@Xu=kc>AW|{Eh~izc^O{FaFPI`GQQOD*fcr{J#?Wg&pb7d
zJI~hs4)l`?71D=nyYd^mSDK2!apeFUGZ?cL9)1T@GHq;7`n^ncwfuW?E`wfI2K}tGZ?X*
zJq&o=okQTmIFmLS!NVb&!M-V{WFW2iB*9;J-~hAA2Oq{7f5UjvN}Co))9}L0A20TK
z2lRCvGjU*~6zYH-5})%EYpHnfX?(VVzziMy+jScOgN$7HsiT-GhAlXwOrJlVbnJaf
zr@@Y8TgBjT-zX1Tw=<5YFEAemGrFWkn;(bLd~sT|Wl2|4M-weF#ulo9wUc-_JZvg@
zLOb_?WQ;<0-A+^ZNWf8vA>2NXUTTmr9}BRDVQxfdXg?{~4d-kx7RhsK#m*UKlc{*y
zYk0OWF;zkw$1{Gwz&fss>TgdX{t-3C&ut|5tXZEumgvfe7WUv+;BywYP<_K7(7zgsu1@#^NGJZbQsZrm1hiX#R!DLR3=V17ldZ(yt-I!Ue~oiV&J^UaV$2D5*Q
zsBT89%dfIVD5kF4nr8L!qs^AD-3_&bq7$NSp)ja#|&~L74RgWbcSOZ9R9RH-($G-{fI*t0|ogkYGAuamL?%
z$#|k}UO)&Rd9DfRW0XV2pM}{bZMdB_2n_ue^{^GEUX^Qc*Fi5ET43jy?PJ`
zr`ng?X9UzoO&0ntA4;crc@^!XYZQaEOIP}gmm_$+3TuysE6day;+uGvi9mSC%+Ift`3!i%9hD$lwN$p`jS~27-=%r0OX|*-G2R
zm>1s8sKHD`auAFih$N&`UUcTgPHZ?!+I~0SeWTWk6BVDPw3Bw|`k%nPmXq
zP8#aW!4y8l7Sy8rDE-ERORDUD}m(WJ5xQ5j5(Cw)=l60-zcvTd5kQ3d$pF|
z(*zZfW0%MK#NIEdSuarTZu*lYk++V++G2f^)6JqsvLWITeT6-8dB-x3@@2f*pKK(`2FebJ^t-BkE{6fp6O@B&2%gxEF0w84hnLWuAQlW^V
ze}VKwv-0=hPv)CjnXs024&|sO2eevH3Bp*u}ULm<(8S^VbtnOZY6F#%Gr*`aG
z-zOKa*Vue%65xhi3jpFp^&L-n@~a^1C+WlO+MPMG)drz0&MH
zG?>6L^MH!=y1&tB^P(8gtTg~S+#X7!^W-}Sy*HDq#{`BxvW@Wu_4c+1LEUjy_k?Yo7Hzvc>g|l`RkG$MN$BuCbJBgK6D3jl}Z2peRlhZg@ZFwh@UPvT?znA
zRnLkoXtmbnTm88Qb6{j70RUh0{%vkvGRerewyo0z>}c5_6tz|9T9g0ETbz7DM)%m-`vKI!$m^KG3bXZY2@ZE{5*bv(~5oSqcd}InGGR$7zrg_|Rhv
zYyE!Vz5g(IZ01w;<5m`MZW`WWsh6(ae$4p6p8IvT0jsJri+6^qYgwyLYSY1F;ffpD
z`J%*bs6(~90;&5_r5-kyS?&2CS9D+@nVFe?78JbW>$oM-HlRgBM7(_kDASmlni?Gr
z4$giu1hE7e*>eWBX|zb2UN%DI@&_>#pMb!vyre{NaA@c)Ev+P_u-WI&7tb?OPfHTu
z8a*Old|I#lIz3}@nZgjrpf*g|385RxEozj!;vP4*n&~$jYPrUzJBlvu9t;J+9Fbh0w{C2JmJ!Z3ZZlM+sstAfz_
zeUqZ%_20ee-~G1n54u@ipbG2qTLUcJ>S8(zIXqLPHD(m8Wi1=g?`6SCSKSq*e{LZ1
z8+(c0*wL7pokbu14
z6s5#Dc~iGmG3d?q!4X^MqnMhRmG!~G_f^h~Z*6C#Htz;0<6eR_J|_Q)9?b|G6dD+0
z`q=>A8uY$9%WG-N)((tX>AY6M5bA}X4vZsqmO!Vj=MlMS+0}ZnDYAM~KS$T|K>uGB
ziVP!l^Cdn(Y~k%zoU-}D?WLN5L0Oblc6Rpds~nyXuR8k`p;;C{Nf`i4TUo12hqkGy
z$@y|d`-6{9ix?2dcwwHBMZ~$3%9Iz$bpx+EI&e
z)Y|JE_2*m02Sh#6NlLmTBjwv^lLZne)}|;e;~&vVnMhPk9Ze3+#CMw7T*t&n>P5!W
zJpZT02^lcT7XJs3wQ}sFKh=FHH
zG|!G4{Pq2}TEIhz17^{p1>$sa%q%RLg9QR>KI(1vXCDRz24esIm1#Px9@=`mgC*Hi
zH1(QF%zG#|Mgv-Po6$$@Z}6JKs7!nxgGq)#IfGT(&@DmadOe8S=i1R%@kvcvn<3K|
zo>Hb;Bg@Ury|vyM^b&yMi;Ih$VXapst6}otR(OcpH|Nj~l9J!<0h~V`C{FCFKi9lR
zD@$%=2Zot``X7m~!w!cM79n4XZEW|s-;ymJ#^rRG>zIfBmHRFq_%(d)7;ozF-TM$l
znJm5p($CTu_@;g$vc~ke6l@FSi{dTVzv@m&5RqG$AL}g%&r0{V%stD~7%O8%jsS=w
zcdatv-@aGz%z9IP3f2RvKbtR%vHe6P%nRt*@^KEh*hdqLl#;ijmZ
zsDy8a3rn4suGNJ7;@bTWy#e-ewbmru^osb0;BD)+3X>)bHChrfaw^8Th#zsV!id=L
ze{_Pqad9NT)CVIn^a0h4?MQ*un7iZV%04sitdNbxIveobWPXX$UrSII(Z%k!MzcO#
zzO@m7HCF%YZfc<|arcmbIF_a7!fN^f`?@&`7Ehd}T%^8r}R
zB5^6s;+9dmR6OGTzL0b9+<+S3s$%a4^?akEIA2e0WviAXz3lCmtR%RQkW}QgQGO-T
z>nlEUKA;JDlKRp92l9nTM+zUQlhe)kP9JO)|MQoZppjm=8p5%lW^OfhD>@{k>+L?C0oT$U)1fh$geKbgm@~{W>UzS
zm46O;abxuv{tkuiauUVlj5hgpya+0FSZ-9sDT_j!otXbLtuAXO?|%q(+3F`~f@XMY
z{K7!-&&kcbWLl9%?xudamYb0eM2o7e|4BRjp!M38)m0$-q=uOS=`}En{lfrt7YabjrWnf{O;HZG)HSB<+!=T
z6!uB)u;VxERgzW`mO?gT>aq41s;jH>s;X2u-qKm{2?&&SOr%`TwLiWcO5)J|_GVdb
zz2DCkKd)C3c@od>1UbPP2CRa*cE=wq?fT5322&Gjim4c-fzMUD`7#w;`$S%fzl~y>
zPvLN_pwq&_!qQc)yDM0d|I^)CNo+&q(jT`{%;_u(;y~N>>mClk>rck`lP>
z-j6_?uaqWUc*FD6<@=tVo@(&WYqxt=HnwL$?kD)5UbByS2G0=jd^|@!yGVQ}aaT9h
zG}Qn7;-Q8M^3scY#kG_3W;CCEn?XA&>FLigT|(61BA4_s-8_nXIK+(-$n%z6OkRnMaVn8$B`-hwpekWS~-5|QSH5bPJ7(-Lo}i$m0xJ1)Umxr$3l!hmK^wrJ6
z#pzEWpBQXP{IW^0U&{~Yf=I26M*P9heI(YAI1*gEWV-Oh@=BCtwG#*o4X6GL|oD9;6)u)qgJiAo}
zTlz_P)69$k_@?5&wTEN({fAyxR^p+)gZZo1oU=FwZ7xtHx3}DIaeH}D9WAYbF$Hrh
zHyfbR45UfZ>cE$^f_H{fN{luM)6$(2^o}XQPYN@0-%b~6dpOzw&Ons8h_-2
zayR`gpjIHQ&CjI6K{rRyBfC}S&t{5$>gjf_y`&HLh%wgS)-z|(Nt^#E3R?Z*Vnu16w>S0w+EF;Fu$v2Zj%m#)>;>kc-QUccEQhw+G!3O
zEkoFMSa%~Jm}Di({f=I%SDjEF?>YqzRJfPKaCa~2#)-=Oc*Ne{XmQ~Td$bKIV}Z55
zl&284HNcRm(WhK6MNj8kmeZyxCX~j3_1L7jI`3qlr0w2fg0abE_zR!Dy%}60;%@O{
z*`t#)40Gqb<5mg;8za%XFe;{ftXV1}!zBe%1_xtz9^Y$3orQl)za2>57eyI&2WvO>yWgZPMZ>(;
zLA${Hb5y@1B!U-7(LWVks&i^aJ=S?fFfF-`tlj-jQFv?5J&&O>1kH{Wt5eUQDP*q0
z1{Do$-vtE88i5}z%{%~Nrh{tzCumN>3NzzKz7a(&&gyA=DlK`B-Md$UXZshjD!M-Q}
zuH~F#nUS~N&JgIrH1_)z^>#=aF5VnYgh4Dn9_ou|6zh;D;sDHCN~NOG?zY
zI|H~Zn)cH+hkvnO0Bs$ys)KaQdWuDcDh^&F5|NeB2{MUx{_#q)HmaW^(J_6rNRD6L
zl5{shh4cGvq>K<2p3@+5QTrHK)Tt3fEEH$Qw=2)g6~74ohs(MBI(~=MvI@|92eE0l
zyaE^3OIu|lJngH`KKTUnvi*QTEg>^J(Nix}(wq_wI_g=U4sasAe|VUAILC>UAW_Hs
z#@9k@$=L92ajMES%=GaacSR`o!T4T{(2
zn}Ou?CZQ&;kergEe7|4e3M|VlkUO-{2BG6=os+S*-#hc+w4ZarDH5Zh>l}fafLgfv
zWfS-UybIljORfdK92sjevL&_Mn;VbPj!6I%_=#F@dQ2L_HUy#q2MJz5Sqw&UxJ9#Y60+OW_XdwxKFyt5#MZj
z?y3g8atExnMkkHIhP6ZxdWCDxO#Zd1od`M*7K>gj=VpYI22kRVtxV0iB*Z@UQf9?s
zbb?SK#$(Jo0=6vQJja_}{uG8Ows_|o4}b4|WD!<$@CjgS?AxHkIQFpZhvZKCuiefz
zERxBd7&)d1?&Agyf(o*$YHQ*@$%uldS$LPL0e^30X{iD|-5m&=?!n;Cl8X>c3!w$4
zIm6*(!B1KNC^yG7#g0#S1gwC1o1BeOq=?&558Q
zVHYcK!OUqx5zY8VFSRxM;>8(O`6&I$Dv(XQv?haX;zQS&%@
z)J`zY8SSbKB%ij!`87yQn@*YxlY0PlPL0DZ1cH%gAW4H6Nd-`*ZeOt&_=a1-W9(5p
zA18QvDe`XppI}eLy0?+j>{4Dr|{
zI1nP#gAu6IF0xFAjBIVo$i7owB5Ug{@t`w=rG2{y2Njqe^1~sytDmP?e2lA%CT;?a
zq(Sc%*HjpssDh1nc5%*^)*fd~JJ5)|K!5sCTOAy$UQEslDt-#tyee;4Er}Xfs<*Q_
z*v3wVx59jt4dVlAy+G*FDwxp|%>$3~(XcOh``tZ^7=K6{je@C0bfN)&uwW)`f#G9H
zP45BW?U$d5;QENOyAkYS=z{kS0Cx7N@okyQ?PA*fJ#~y8&q5DHbW4=0FyZI1Ox-z}
zl?7|7BAVVCF{<(!H?b?pyZ4C1OdB>im0Iyyx=
z0wA)G4&B`^VHX~|Bj0)1o+H-n<7SxFo}$p^;6eI}yKjwS3>WXZJP<4yB{$V9EsLy4
zx*C<_vCJ~z6)f_Xff*+9#X%YxQL9&gc~Fgffhb>Ri3dZCtrk#~rT+@;2ssT&P!=IOujDTf^6bWxvbZLc;yL2}kREg{=f21G
zeNAn*DcUyxhHYRO`~W#kTJ?YOE!cX)@Tz~mSqLq$yrHRj@z%+W9(VStVn)wO{AUU+
z>8+u=#_uoo`VXGRx<_sLE#jy@V;9<9lSbPdTr~>A-sh}3{V6eeY@*kHtP<6C9xAz<
z{OSTI$bWJUsWFj699939y9e|x3~x)uq<~7sDbM9`shw?N>kYWtb(39C!*WSCyM03d
zB^H-yinHxUF1Z@fB>Xw|(M|6S*CPtJ*E?QLFCD6#0|%fN<$!)yVrO6{-r*G6nnY8-z
zs+Yo8hj)#V-~G6dm9JR_=!(s|o<^ROLD~EOkB=$Z>flP}$75)b19PQK%rH#ZG+U7(L^H>2(vF}R!B*^&VD`8G++{p!TXL@;XA;rytok7_DY()Ei<
zH2&YeTsXyrK$QhRI4dOabf;M^{+ZyR?teH5!j+`4pj9zn`+y0h=V-n7*>ba!YAxiY
z`*0fVAOGi%kT0%2Xsp{qH5rdM-9*gCeX~j1z$thtl4bV=pWnU53=6p=r3DSAJCGR_
zUHDtD$Om8cdFYZ59{}+ovoB3xu)KHZnx4FJgi|F&B)#Hv!o0Wt+r6LfQh6=|&)HmR
z>iPH1O178{c`=%r98{QO*&J4SA2-SI4bxn%
zJ*Qs{mpc3GzBqwayIjG&Z|Dv2CKe!GKW@XEmY4T_xS!d|whj&to44kOp?1>K`?5`L
z(>lU1*eN7`nCGoX!<=~Xdc6T|w59|ql<_$~!>p%4*tYaUM#EOwe4pL$DkFT1SWI8O
zE_`)*l#I_hUeVq2`oy%5{ja16)_LpYtp0uunFX?b`rfe!=6Eh8G08>_8Aa0XbPU-I
zpX1$$+*<<~3#8WYoxy#+Ax%R#_a&p+-hc+FeF3izgVvBie2RKfc1V;~y@P(%a^4E59GClVW$_1$%g%9(J2wj0%3$8!WvRy<9RJ8*o|tGi+#Q9*n{;glRZF4fu?`B$fr+#U#ICY$-z?@NvWD93PYgP`L&o~?P
zsxj2Q+fMP0%En!HEB6-`p*|oMH=eb5+Uc{Is`aff8hV$X@!+C;Ff?5#&yb|SPgOKjKvWwF&A+wmv)5PNZ=KefnPa=bJR(bR~V
zTtvyopJ^oYSZaO!@z<6w@Gj;G@nhjL?AeHI&V7GTn%tyXB7VG>E7Y+YVoR*7)iKV*dx`I2QSb-yW-;#89
z_>Eif`ecO=BB?^j1G(H++>$Vdv!Ii!t=^YRl(Z7xJ4kzFJ2X2Rh2}^tDV%G?CyKs*
zYafZ3#S79gvqin|sSU|c-YrM5oZc%_9SlHY@~O;{+ynLzd`*T_R#&UF-L1e%<_;Aq
znQ}&f@_3OM*?xQ>u8{I^Uy(MzkT(Ma3?2FbM0^9l5|r>)U8m$wYK%jZGC7w);fwW7
zo%cYRa8{G~@DWIvX|ageHOwT$9xkSw*EmGpN9zIR{+a)QwRdXf%0R&22Pyaoap
zmydbKvUpdcqn}iw5a#!1N@woRcSZ>P{h?%T__j5$@?hUUEXd)}YO6l#at!~NJh7!j
z&@PZY(GVND#{Thu+FoiDwy|uUYRu$X%Iectv=008D4f;Zt}OnMSG!o3+0W4QN{NLi
z<9T7HG8}MEzJFb~A9+q%E%NqLK1`pN4cH^YC6`*i@Gh&$vr7JUSV=AYledc2N-;Xm
z_^tzSvSlt3^?|v4M(hHOvDT47U8?w}9qO9|w_9@YM8U;BWtk0Kwd{+Fwu*$h{L)KG
zqVl;b3ndN~HV0ZM+#I9)IyD|`<{Y(3#ujr}LyAj}*Ee)_dsq!Wh5>SO7EF1eM0w7h
zRDJOZTKj&{%+B8$_F@(pu|A@2)BN!-{AT9Sc>X3?VLqzSldd$vH?BcZKco?U)i?Cj
zQ$LBe5u94V$p)?&9xpWWogMQo@_ne?9+`M7-gcMQ4LO?HpXN5Zx#7MVxmgsRP~W+-
z&-hD66JOoxn_8>?Xx);jQ>l}31%W@V6&FUj#;+>l#eY(@LU3AQ-qTC3E9cN_^;X-`
zojRLRyHy~QI|E^G+JPLU#01r75)$Fz_r9&I=4UbTH?v!B6h4u$O8U*NlFLlvLWv*S
z#7fZDBe+S
z9$-(8l_T}E^WQZ>c1451v=S0qm}wCvW&8lN+=j8)KyZn6kt5NnsI08L<}Ty=!pmUu
zA6{Og^luF43$!%34UvD(_&eq_O@|qZA%Ux;$_wHInoIUks}s=(gx8~2j`ruxYY$44
zu%iu;os!ZDwMwgtD5>8ig^sJC62wSG?yH`KLjG0C-eKXfzaPbKC!(j#hW$@_h)eGb
zNd@fF6wgB>D0y*MZ#FyWgY!nj$mnKf~TF;N-b2h
zNpXkOudCoHTJZM_mv5HfwI)sK+TTW*9p6~GaE;$R6nXpBD+Gt0U0?1Z!L_P)>Pyfa
ziO5C&1MuTeloUDY&sMqi((u-XQm(kNCDR%Q{8!U{{>7`Nw~qqtZMm+&E?VOAZPW!L
z;{}!O;|IgvhKab>zT910z4xCcL3iDNX2bRnzMt6^r+SC9sDbIMc+1@@7{-%T%i%TvAuhvQb8uDQ$YpxmU)o9
zGXPVebLb_
z6Cag3Ar`H0n!x22G!YwyeboD$mbspW-rDxN0%XAlf5DC-g+TU=o+qt)qw8H+H;3OT
zmfLZd3so5wJ4%;WuONZip{db-gm)3z3;#lH8_1+k07)WTs5UB?kDN0*YN~yduYc6R
z(<}QF$J@LfkDW^E0(+&fWNtSraK*U)(rdD|Jh$!&6X}cW4?z@DA(U~A5&@n&Cy1Ik
z8j{)VpLw+Q>bKr(Uhw3^kW@tn3ulX;Z}!|N2gGv9JO92}G8zA!2k!`7%$#-g+?i7_
zEK`QjXzj4o!f9$omkfnO55CT~guFvtSfaEIa%;C8v&Y+YgWn&64BF}+M5*^0Yq)Yg
z?%fKttfg1YCJE*qt_l*#^PtCr*oi#RfV$B$Umy3CmVA)aasiDvb(6RA&t*=(rH$fh_Ys*Q-tg`0l
z##$lsUIp2IqTAwNww!r)GERdzy$PuK&ghT>`}NvOruyTeO-8TUu0)CEyJi~a3|u0A
z0nFHFdTo<*g5|D+IuA-)Z3`xI3Q6g)ocG}xWQk9A?N91fyPWk1i9xcstnMSf_^i|T
zB0K})zFN>oTtxfdOY^m@|Im*h47T$>aiDW21ky$IU0br=pSDST!Va@ygzEw)v
z*}4b;H@t!$}<|yIcMp
zOd;qjQ}3`=fh50s`aL|40<~h?1#1s};%l0AWn$=9g$I9oyeUPM!2oqTe82s5vDa8J;i&hnLhY_8t9z?
zYo?0&eu#ro|GS?3a=q{$KQ7dA9@*R7X3{5xEZp4t
zewCN+(UtF!-b(lD&j`uw)K&~mQM15@YQz$Swd?E+MGH0G80!BdO)O@~X@17Y6{L(-ukX)x{xDkP`DaZzYOb!-
ziY#P^za56VAK;s^(pImpBU$kLqxB@1wO~#w}&`ZS6k!ZjOt;X4@^OtVK1Aa>o>8Muk*VR&V=-jq4!y
zw=?x)Gbi~DwU4()m3pQ7A(&!bHHOsLY{C$LSESC
zxSfgN#hMWVSbhQ_w!|@3CqjNCxNY|k92R>)}9{S`IKHx?s27Kt2#&sHES&hIko*Q
zj{joxQb5^UGb7^QsGzc_IDXlC3~8Q0{wc+l^qdzDg`K`Qw+L{e^=_{eu*Rm)iIt=+=x=oHDzCfc-v
zw34C(cleINC+S=xW?<7ljdt{pI2!S&B^lRuT}Th+8m^5pXm<_yGo|&sieD8Hcx^J9
zAOB*lq+Q$rU_8(slz?4`|B16Z^}914FBtgHUXc-n^?x#FC$4<8*V6$(mvo>Y;yegh
zs>nj0Bm8NO!W6a}@k(=UNZ;Fe+v0$Grjc7V_XNP?tM7N1xP4{HQ0{nkf!8Z(P4}-<
z`p`8iCji5X^RQ{BhrCA_x)V=h%0+{Ow?{8sJ?s(LwiLt8ikD#IrMJU(8q=e!IoIeN8>RU-1bEd(ZOm`1r^y3f9nwkDwIRGV<6!
zy_tyi`)fiNn>sKb|L!@ggd($3PTlS?ZQp*_=SO+ny0e)7_G1EX>P0Xxyci{zyi-1J
za^NRFu~lwHUX^z^VK4pH9w%s&T={7_cxn2LeG9Vk>omzy_46Bh=@NV4uM&OJm;A%G
zwzm2$GJW6a>gqC&pb`L#%E6Hl%|6};oX=G{!1(7#{ug6k9T!#CuB~DVQX&n4gtT;n
zDBa!NjnXreh!WBbQc8D+#DIvjG($^B$-saN3`qK|!RLA7ocEmb%^&`w<8RO2Yp-?R
z*L?+=nVUNv{kG>ChJKQpn=1+C>ksbSXI)IOmE67x^Jyt9+Q{Tp??RhVs<%Npdr!m8
z9(l~xO2J~1VnQh-K5gh$A+MdONt|o|8jEg*5TY1&adNJ$cwT{uHKod-XDSh6%?=DJ%+a)yte!Sp(T
zEDiZeVaAA>BVw~meEWt#@IQ@Y)Tj?X6W_2r%KzqCoUP4)-{{~PCnB=^w2>}Tf{|8d
z(amFF)4I}Onl{gGt@8VM!UE<)FRD68>ELKah
zvJLwd?gTadNa~a1%={#6K`lL&r2K>3cfKt!OHv7bo;wTQU9oZiqe4Y!=fi#TtgfBXy!T-
zr}`J=rD7jcwutooT$7uSvK$j?YFTbN2PVO+UbR#Q{q9E|wK`BkgYD&GMi_C@B%wF5
z(V=Of#-0*>z_A0{p(C!Xh<>s8amew2#r?={X8I&@w$VpC9bV(K=ZiBiU~Xrx27CPV
zU0t^l6iX04BNYWSB08$<=tw1dR>qsC3wIIvo*|tU(&w(!VPRqR54KiTEO+-dsUdg6
z08%b5E34XFn~-qt*3Fy4e||jR4g#UWh+qs&zeat3G2^=2Rwbmmyv|SccUgaJZ-0Hg
zXqVFn&t}aa3r}l-;{^47lKZs%jPfR%iFU7VnDFG~Tq@PTlzUZ1hb>ywqMdWP#^7Lk
z8_!sc4xze^)APb*Fwu99&ss6|XctCwNh%0hyzd!_@Y~js8RK@Gqz|aG-3ep5^r2N{
zqPNBD*g^+=fNF|GO#wh>=R-LbGr%+n!`FL?MYe*Zvipr2*~y
zYWR|g+}pcE)X0;1@fRmA$F`ked)`{weeH^LW#@Z8ZGG-qFYEcY
z#ycB?K07tlh(UDqHuuo){9R2Fg|1nNjt0ci_-86*Nt@eCGx0=qsH|s4qo%h7-dy|D
z+wN&nRR!G@?xf8Dukcez5<
zVR`%nKVELtf%CgI?KBtTbfnKnr)OcNMs$VqY(*E(tW$g0CNj0zy6)T`5&t3N1h?MC
zE4={57<7J~HfC!V(NrjouoTY`(JE2WkCd-6lGfQt^O#1S+~BXHgmMtd3{|Pz`SI0L
zxKoX?P7fDp-Qcq2VI(sYqjXzj^L%IDt*k~5x2$|-e9KsO-X7grw-dfSPe>$baQeFA
z%nWHXb#C-}-SePv19kSe-XZeH&8#eoZ*u|e<85A3Y9K75{cWMwOYoI)K9%moaS7Yd
z(xIJ-r9%C|H}n4Uld02;{5F@F!&i_1ckge`tq+@^3r!34+Y>{l#;nQ2RU*w6DNw(Y
zMEula|8@lcnRRVGO@6Xfqyml
z>gzxp!v{5Zcs-DZyk4TH;
zCT0x4Y3qYym{FlJSuw#s8cx$`(zX18E5Q6jsE9}9j!zD!>g+t@n53fUr_#u;`RE}7
zdM=LgXF-KpUMF|PG^|b#r}Y~K$$4`2Iyn7&K+N>i$;9?#c1FPdQ0&o+h|5ZUv9Q$I
zqK774UoTQu#H5;7zo4R-Ut5&XV~AP9UYOMjW@lp1z*xqHW6}E6m?L8cAt|gYxCj
zTB{7C_!ADo@#v5B*B7IF7%#wNgM|S;obF&TOC
zeVIBB!$&B`S%;JZr8U>EH2yrlX88FwgHf7Btw&u+PVom(|5imig}{6#YD8!Ubaka(
zsC~x3)gjrAU--<>LGw(1E|c%^?@1v-6s7f4NQ9P9hbD_gA`)3=;s*^c^
zLw{S3)d9M*nm0pbS|d}
z=y}PU*suklJ)I03#T)GQCVCB*n`L~?Y7-8QCy-w8HCgl_v(`r9d%I8lh^I=kj$pcU
z;weRJ9r-st%-8Hkks_M+4IO~q=q)%3(o7h@oFuMJII6!qK9Bj6WiXEq97pN+AuXcF
zf*xLdqM53+!w@mc0}7~MnKzXo@y(zTQNuE`v9gl0u*kXC_#m!sZg5VvhYz2z-VZmH
zUm?pewz9Ua24{qxRt(H&Wspv8l-f(dNGglnV1OwtpQdgaI$NvZRUUU^mW*A)vWrWD
zgW|?=?tA_~jQa+wmQJAM&d3g8#^-SVbzNWsAnVTU2lv(^dDW*xXIsyW
z@+vkx13b1UO}WoQxrYmj$qIL$7&y07ZAV?n_^ZW(*~o_prD0<4_sUNt03Q53t>8s1B;8~&x>rF>A}=4n8wD*9P*lYrj^)|0svm4y{QC_V{w
zQPB8SneQ-0?fyA&Rq!zLi~OkM*kQ7Uqd5OyD>c$X=C@($=42&ZYW9K$*%hPw!y65m
zho<&6;83#0IZY88`ZZ^_dFE(vsc&k>4)vO;&~fjZg~meDZ)ewyn%n@6luh9-ggk$M
zm#yO~IVjBjjt~OYyJkGy8oB<|=~+B51J%euJ9GG=v~aa!{a%TNwf@-l3?>?Z?I%
z5T_u-2MI~hkc5PgaAvJfz1YiqS`+;8YrC{Z%niC|e|uX5brB0dQ4>;93a@`wR#v_*
zE-nsEu+W~pi`f&XKi^)xdi4)s8(wQSrdtu(11lUiq9liDAbn^Q742P0HxrnMv`>AV
z8te1v1ZPv$6*;JFavMxIU9LXgHl#n|lep!u_}TxPW~D_LpHjeF{_NSR;tr+Fd*b-2
z?HMH_cm>S4fGI0|E^6>qY<{pKk>#);w&@H{f`LiHvyM7>A2{W{r2T^Q{@eJvJ^H~P
z^jwa?U*YrI7K)4x4}W9BXj(!}8g(`s6Fq!$4y-)qb4pkS$JHDzc@92m_EP43=dwdm
z>+#p~+X+LwvG7-+_yKnQvTn~*3;z3Yyi;RDI!WtWKG|17zFi%4obtV%?kB!ASw~!G
zTDyBra(R~9#=i}|u41sR1zB6HI;VUoWLm7i{K%g8XI;R;%;Af}1*LM|Bnp2SJA;?u
zv|sInolH#HY(L-h&aiW-<{q9K&Ay_90ShOKxF8<0_>lc?PN?NNQq-4jpH(ERaYEX~
zsR^c$Sm#<<`7}UMQZ#Vr+XtYNR<%v*%y0Uj2Kd;?H?#xT!}+&j4%>R;bLbP*o$L_9
z{goAeRVko#09|=(W#!|GXIHa$WAOj1QBG@&fkW3m-#14xSo1JnQW#SwDOoYP*Cw~j
zOiN`qA9|E-w|EQh({!==)(2i8;uRY{<_W;0ka@2>)VAAh*4sE5TRdfL)_DT@)#(#wuE
zKfp(lUzJdG6CHJNV!AQ(dcaG=rOk!Xr*}r7k-A-TYr!o|88?t_-}?Amyfwy0+n+Yz
zc!hlWMYSfY(!eoA1`s`1divUD%1{(y(1r42FJ#X
z%XlNj>E+_w3y_IF7k?EWWo~oi;KRxAI19WG2?)D!Ia4QHbz+H@Os9~gy$&F@4J4nmlO-5DM8!2uCm!3?1`N3PAUsBcEv@iry8)`Pc+NNpIn4=k?
z?4~IrEO)s;%tAwGKU;8i7Qv&%zcps0R>DWP}wv{y5=3sc}nI-VqN`?%g@B
zkvXq~L|a-C%lliEX-@FVKGUcXuphmPLdU9&m~lA(aqR*9!_{U$(kzk52(KhjTL^lh
zAsN#KWLcqEK~?X5!h$}z=#@#;XFZAqxL%UX{E@tvsQ&vd-OX??dapI>xXz1rFq)^3
z2Nc7Yh7QFl&^z_vBBB&!Een>q=rSAgJ--=3pAyuZX{q`%X9ML`D2Dp8~K5lRlE@13puSkkD)7Ejt*UH|vc8-rz!r%Q!
z7qZ_JhAJT?Th{e$O$8+0{xkC#Xr6ogp)8#r=V;vZKT*{ke*X*(i?830D
zp6kZ^n!5JBm@U%vr~8|hhMm_UCr6j{8iZw{68B-=A)xtpb#)zoG6jGb3{rT3ePqtf
z8G0!8_w?X}cV;IOGhbCn?iF
zt-+~KYMKp9eSU*Vt_yy;YkM#GAb6tQY7n4#NZ51DCpqCSteUdbnNqJ%A>JNGFhOU;
zHXY;&W*5GlUjT%)IFGyTk2*6OWyBf}k|}PsEG^9BumqqF4$g`eGD#9$;t2+9_xZ@|
zed;Mq?T05!9&Qgb#<|2d4f$t+nys4|33CdW957)+R+M~GKP-(qmrwkh+gh9#2!BK_
zdPL9T>bRryIMq!(4@hf{#5_>KQ}3@N72c6nQ78?{*|C^~#eVL+nTRVm$clc6@5433N5-etb^T{Q^Kj(XTt$pxKKb
zgDps->?pd!pjZev@W6aPLqmfCtQj{7Mp~hg=XKt5u_hUBx>UU4X!@y%^;W`Wz0K=b
ze>(=VBJy_^{5~{%1wg62s#po$$B}t!8?u;hN?ptSQdD~_=mWZ&Vh>4XjUEpSi?>n_
z(fd+=yq_ZCGOVFs^kC#&Gq9)d7vL=Z~JWj!_^O}i4W3p{u(X33u1IE^dxt!GPlco9Zxmtn&*SZo^YwieDCQrP-K9zr@*=zW6U^k#!ONMR&fS=#V=sD|sBa{e7hm)eVg*`XYjj
z#9ds%$nogzRJ5vEM?}S&;nNWOSbqo%Nr05az5Kz-t9eD)fH31QYAOLH;HVPg>pNBN
z^$02!scCmausY(vC=b*fVx4ZBi|%(}s6G}HaFUT%Q;RizD!Fn5n4^|Jaex9m(4IHM
z#+bK045OGp%oS8ts&dfKs=S(yzx#papf}g;{yl-o+Y_wG13K)e9%&1eO>{Py)p}j@
z44qeIj%hr?@8z!6pwaUZ9f+?AAHU`Jt+Nk3=~P$KeopU=FXjpFeR&!0k-<5r;c}S%
z<)flt9vt;`{iKZPqkOTJMg8UFPD4)fn6Ftv>g-ha>4R#!1F?DV8zVm#3t@a7=I7H&
zM$NP*`0KBQtpnqe>O-KndKTSP?+O`xaO>wD{*G8oQg~s7M2ww_e`-q&zs~%0
zJd2?^(hmq}<;iiP6wW$8pBUwE^CpJZgP4+DVID78&k8WU
z_E@dL+~V7MpMLs@Vj7y_q^&Xg@UO_U6cf$RvHTXohc}{of=1%b0gRwYcUX5
zt~;}Ea;lXBqe+0P81WV}Qm4-bv4MD%fTteZ_ljVK>
zYecAIl{PgCKGJpuY7UODTeo6_85w&I<7Bv}Bv)wgG|BiL=u*MJ^At0$lmvz!uD;de
zwL`+{*4C@{Of5{o!z{gkny_R?OAcfZ<2~;Tt^${EU
zg_B>?1vTI$`}^(<@&z&gCiDkX?PS)Waq3KZlA#;x{>H}rt1w=-&dqYTxv=D~Mpx(h
zNek0-hKk1O1
z;&Es!=b#Bnj0)tfx_i|D$~~qa5)H2M4^$T#YM4wLu5Vy9!gIDX{oK4xqzY65eGZ8e
z6H=~W#)^{T8enTeSt-Z194ciZj!gHxo(wTWz}*8-wqbX0)kPUXd)#z6C
z?tb4K07IYxG7^GEMIASKS07&Apx3^ktRvgCOG{*XAnE+OEFnJrA;wz3^8W{weh{y&W@Cwgdyz6BpK}+e)+ll6yf0|(|Flqll^Er5->Y@BhcMaA
zz;t3>o{(w<@S+ZBV^NA3<
zia`T!m%|K_Jm`#TD=DXba~JNk6JBK!fvlTPa;V4=t(OzG{cY^&>o;pPg>*YP+~$U*
z_h2o)>KuwD>KlyD19<*~f>iM98@*aN=Bw{Us`O#fD!2Tu;6o@V(im_e;~Z*-++P+I
zn5%iffbB{Qa5Wp9`wqF_pfG_~1?P1}dOEAWzdw`-47S$g{wH)FU#%^9*E{`d)<-Sg
ziSJ2m`j+RP*}GKrg-tSJY|ux0R`3i^_ugmijal8@lhR(_90Qa|Fx^HM9hmPJF_w{T
z%)s2IiwD}a=XE!)GA0u#Tk#ubn5vBljxc
z!@kY7f|6fle>})L>OgFOdq?kTv*SX4SwCKn1FjIwlx0msi`L8uVL_Yo(7Z6M*DE1|
z*(o}MsQW#wzO&fZb)qOrN1sbw-EGM#wKkANI+s>MD7+Kd2Xgny%s{O{7S}%KTcE-|q;@}m;XXbFg
znn;y7X27Mq!Ke$&bCgYz_jc#;(f4ylW?c7cDS+|9OxMA@lGuz(Ux{=VhIkLXg^#{w
z7U<7qy?80@UTP;CZI9g$ymqj2NoDCD+EZJGcnIQ!DA2H(xyLh%f;@ND1Ef2OAYERE07=Oa@CMN6H5oSC)QnDvB>G0H-wCXmrh%}BnO}A
zZyg^)&tlnfhfnr@*fA9rYlu>Q0$Zkf-1T1Is;0TjgO8?My6n&8iPvT6Fchn2XP4lD
z>dy^hLPHmVamYaj0`#`ydFd)&C8djId;C-Lu{$kJDuvt
zRhYHo7~YnOe;2q)l*W^1@v^voQH>E8xN}RzMeulh<5XXu8Me%A+vKxNq?7X^6HS~c
zGL{nxnY9=z>D}eRUSEMdbZyW2eQE>w@gYQ0e+%##`@6I2Wg75b8
zIeQybE9rhwq04Y9E?KTz^Nt*V7XB5{^dtqy!cbyN
z%=;)iCMG5Vyie4($Au%HyiPMb7_%hAp5_CyT|%U2()g6rvERco1A`c8w?7k}HRBCM
zeF1~2!*ltI$;bqWSva;{<|vI``kv<7W;EAtD~q#I3(~qVDvorH&19!UkHdW3Zd3hq
z=6-mJ6fF~XEcG%-XKWpNE+0|W{dK0En%0pg_Gj})(EC_ZaZ
zWz6*ce(MNmyO<|U0$}%ui8qVH3|4_OPG=0LCz&)3PPeiA+g_<>0rx$dBrLQWy&x$r?23s^Dn8D8e
zp!6l77`A)VocD5MS+w~1$8%5|yF6lLb&QOTcEKcGpb2PcS<+8f4eAvE^t_!9oW$y~
zv$N4a>Qx4TK*~U9hs(g=pmQ^REEc3he_a;3seML+&OC*?>06N=vZ8Ubd{J_npb#{$
z`I<5!ts-SzoGvG#(6f9KSyWLRe#^OzS;Kyyy%k
z#IwyQtqtx*o1y?rEC%==rPyKn>WNjRKtJ()bCcx_J-zEs@67SEF6+);N}L}8zau-h
zmA)~tvnRcJbtTc6qNp1wdN5^y@T?~hO$)wDIWu8#yA3|P-1l;?95`)x$!>a`AR9{T
zf?3KxX0yR5yWTZ{p3o^DT%rOv^d|Xm)t9FawLfoWck8H_3Lb3StTL2YHe}PSd{TA;
zx;c=-`7ANj$BXnZ(r%nLclg8acAHts=VH?*KDP`uku~7Y9Dkp(0xUWY+9sz3L(Q
zOD9L0&AxPl^~zX@PK7qkRa}vuFUk0?6#3%$+S}R=uhY?1=I_%cZ?IE}u7FHX$?q+S-EdT-qnpt)oo{ON9&ll@8Si1W?jsb?>5
z7WKV|x+>dllRM*fwLL2(g(Pj2_Hoc+KgL~VZMxO3`S!7CDp*+vLu|XlpN0?1vf4$4
zs;wprt3Hz4l*q({)i@=exqjUvshm%7o};)nbp;EH(wW8IpxmILybOD&TMT2_1ot%c
z`5J+i(0__e^YRGqQioVK&Y@cHClU{(S@`Ji94%YEHz6XSt%4s*8OHYC3-op(ZGrqe
z(1$;H^77AQb%|LF983sBGqVpZzt2yKFJnbs1C|Xs%QB~1HsTkSCxF>abu`h?O7FHl
zm?-GBR!EK?mMbzbZ(HDu&4(t4sIqK!A$80?zq-CXKR;h>GeiY{6o6WhvvYP%`jHYy
zKu%o&6(;qqJNk@u`lVwgedx~Bmv}z~P4Hf}U&|*Uza2#_UVcuiOGrUcdgZ3{&IgO`
zsG_!DjCX}oJKNRLN=k2kJG-J{YVU}7^)8W{*)%CZcX06^aY6Av*d*Xz;)aR~_TQXZ
z^4&%CbLd!+?A+SCeqf=oy-eg7d9;o#QWOK?0~b
zkj+mye&RW|HPzS*Y2#1+JN>3QgvB2?IQ9Y`f{Q~&wmlG5AD8Aq%Qfto6rbP$+
z#$@V<(r`4c5HxP&r>#T@Z>zR73_s@dKxj7p$PTys{w2(bpH_!vn3S5D!=>%49^fD2
z0UsE9Msj4}KWPjaoV5b4@NDNKbH2jISlZ3GZkEM8_I>^9xZcEl2QbZOF1Kzitz5mD
z4uXniUp;EnSS5Bqg0M9scQ4Gar3
z`akdGWM_{HEpf8*@T^JT;Sk@Oj@Gfdni-+#opG(5!l`8B8Fta-$a%G?`=#XW#3D}-
zA}tJ=(d1(rf(2ELQp{|TU_`0DEKt`$qO4dnxrv9C@oLXgNS4>qO8kpQ^||4K-q#VP
z1A#PR$^~0VX-svkVNrvJPx^dIB03-Q0-|3^9=G(fH-BYN!c_|h8oEY?yw7e}7?mY^
z^i0y7{ocKMg_%mg5h-9?04*mcSKPpPg=k0&2&aT_-i9Tq<_?WzVJWed0c%cmriMbF
zwqtmO=F1xk=$oD-8>@JV5-+c(Z+MK2%}ao+plGd^*D7}B+=hy(nKbeXJva-1)8xU%
zHbvey?$Iq$rURk08HTnj(Su4g0S`jhN=
z({UEV#xAIor1g)H*QSJI3_wSh$`CCZQqtPsIGr7pMM54F`ooY!6k2;*_Q4xAX#0bn
z*T(E?*P$lVF7O`5?WNZ*H9Vf>Ou75MSEhNg2bAdoidi9xRO}*;cieo|Oz(B6J{_X7
zc~EJ-ug?X&X=XIca;u$;yEN@gXz_~Hp6?puF~hhFwO=kG`ts#RhCG3g2q!-E6Vk`O
zQLFuMcNq#Nmii_1q{*a0S*0OsTg_?;X*;K>km&k79Rs>$?+-jY{G0T&G&6^v0EcYz
zFpwDRcg&dm?n%-GAb~u(;3?sh-~Y_XMo%ww<;s;mRNLD+<$!G%OG<_l!)dZf2ieUM`;O0d=dv(fna+L6>Gkcz8UB0rR`-P!SAl
zyql?%+0^wG3a`+wh+H+V9Qw+C!sB^!Woxc+j3LF`pK5es`f#}2B0>0_wSPH2E7vOt
z=|;#qQg%G9Asg}N-KH-0QvQhr>{%Pd?tzx5sEOtprws9c)&bY8!?azYsQQji?$E(@
ze^y||UOHzE*rmTCaItSC^vhrq1W*r=uwQ4X-~{&US&rBbv)!&SIfY=8(qin%
z44=1O;|pYX_P!$e3(n2^)H??Z2D#HhdTJ$5A^b++{c;(hXIFE8lF{R?MJ%)k~Z=x{eIee^F)yXd5
z*&8Ch$PvlyHQ?IG1wmORD&rMh=1jWp0Z7-0zJ9=|hy1Z}8qt-ZXVcAi=Zw8mpO72lBuLd6UZgNDtqczHc)RHD!miJ
z5lt*7hck2-CPMkj^&?V5jTZ2)5|9x3<9lk$4Uv@h*punL=-v^D0l@7A^E>ljnctbO
zUtjf5RFIQ1Tc$<>niZISM*>`XhKHB8$XJ<#`ig}#o?0`gW>Up4E`HKdQkZ+ZeOaQQ
zD(HqRKn#p&&F!3%fK7X0rm}4z1AwkL)5zW#nEs*ER42I1(w{gb*727UcAFdoU1;ux)jl?HA;6g|$^x&ft1>@@!W&{~#_W@9-
zs+Hu5U|-$Pj!Xz@HQ;xR3>CyC%@?{-D<5n3C3>U=KkG;^o?vzK7s>9yqMJ8Zs!kXh
z+8GFHn?70w`}%A#=W^iT)ey*=+#$bA7+s@wo&_6*RCn}Y
zUriP=xlXu-o^ZJeu0I21p{=AKrFgK==$?RB;(7Gd&4)km?-_aK|1cwe69iM=d5qAq
zwr1EQ0{4gTZFo3n!`TqO^z`+CzbbxXG)OMv4etLafwfOi@~uFAbu8yv^=}>yQ#x0h
zklQRE96}J)PU8_Yg?w1z1%NOp#hpH~))F$zuFvQCcx!s6NIb
z2N-|lHJjCh8sFamK4mFftJefj-EbdrRb1h9w`z}Usb-J>k-6Umr$
zX$LfI_>;_kBS4vAN9xsB7g@{zV^BI;+NZ!m?OiIjP4T}}ionDFm0R_HU$4abP+3wj
z*>Vz2U5=_gmWo)V8!ElW-vrfXhjWt&Vue%jh(Cz68ObS=Jc>3FmpeaPE8?=V&HZ)c
z?O%E8xJw&sCVzd<__8Iu9$=zDB@P_3eP>40fD3E~wD|uwbtj&i@N%CeF8z8e%zc;5hvvTe6sq;v}=j2<)FdK$gv=-+YwvN;$AqjDVVywn14oW_&3~
zv$9tN#_{~*r3OY^(ZhWqt~lxhSWqSlKfey;A7Jt?@7MojsZ!@ok#RpVq*5ehiw}{O
zvwd>%>i}nft$KHnNiP;6Yuqcux)b2`G?Lt{u=1(0)_C7WpOB!Q@k21!b*=rV&b&!3
zutqo{_#HU1zW|9>Wtmx?3#KDt4OVscL6j`gEs!DT-*?@~^E?c(-;RKQVEo^!lD{-J
zmRJ_>MQO=;b8~acaNmaW3iLo{m%>o0QBF?E(B@1q?
zas8FFvDJ$S&@oko_L{DMjdRlm1H30Rfgd1fQec9vm?5N<>3?k32!_mH52oF0#Jyq`
zEqagwdYJXT^Rp9-ue9o6+g`>_4@gBB_se!G0#o%2MzOuG+^(}u4VdF%T*J1t3`lh*
z>nRg;+JtCRyTkXvNG$ReS^Wr$Ji2h0ioC2>45
z{ru(*e0LADo*1+L!;nn;$w*4tL;C1A7bP-w42cEU+Gin1y25}EBvCcsuGUj`c8Cu|
z?qx*-FnO1aF*#YU)e|NLrN^Yr7y@X%FY0+r9YKHLEr^-7fk+Uo?%Ie5>?&PWC{wIM
z1T--kDL*i3
z=Z(b*=tO{L!ZTSg0UTqGGfn;hESQzjVGwUHuKDt%2Vi{gU2bM(4D${}u@nec
zJE84y{$uwrn~!BL4sri!(L+oY4Jj2-HdKowMjF=+cKltJQ*wK7R>AV+0i<)vK3E$`
z-Q_hJqPyt^j25lI+zd6Yp#sc&73f%5FGN}xPG8pF({e?yI>2FBo+{{;U#zpSu|Yse
zS_EDuJ&lkhX-VXBWj?!6ItXxPg73P4a9Ye`8sY)PRXHUkBd!Uz1ZKZ=9f^4a-eq`!
zK6wECdoF%&!jVP`aZfVkA#zaVw042^)pmvx
zEBw{2{{IyPnYir*9{_j8^0okG_XoVCB0Jkr1<=N|Lu8CB+(H%!pcK%D3&zx#Cy0sA
zjj_?zPU7L?!z>TUOve9V?^F|q4-Y>82rUXTPnsw*0Qiw))@V6+(fxEVZu_@y-~KiG
z_PFk^6?d$d@YjkPn(S7P#>LiwWne3@u~jp+DZVY<%+qUDkzBt!x|TRTUUCn5o!W&X
z3>!r(zSElOJBVz!XyR6YZ8exGBTbSp7shb0wt$yB-Gc{DIOts?)hfW51G?976-rU4
zW+r5f^ayw(GGM?J3Sm#htkLb^56@6*X)eW(b5wF$PZ%L1SO{k-ii#16Sz<<%;s9~L
z6jwtb!CNC(9hM;E27$Z^TK8&@9p&0roHz5?SXpwNKr8@a#ao;Vu%fXKu{6v?))x=$
zKh>`fV*k(jRRv?04cZ%!uFRJh=L@V<`8Il3SXfp!E83E9#ZOhwq<$9F*K23VkGCzR
zJC5ecp+N8ksQEC_M4;x&9GaXpVE7{4S9!Uez|#J!v!iot+4P(0hL=nq!v^Vn526ya
zOJ0m)i^=-g9g-pyj;-6+F80T4fAgLg8pKoB&!5kMJsZ%!aJ1EKthxiwuS8G6K!*Lb
zkE=-rmW!VPk2S#;5DJg^z5@A=)z((|#(UQx6tL(_w(jL$?+k{&mZEx@O<0X9Pj0rtJd|3zCFp~FgmmboeL
z&3A7A(}~}@bxTb&{jpf&67U#|gZUg5zZ{n$HlhRJ*d^FxJhFe?oXK*d>gP*OJx)ac
zk`J;*3U@#urONO{sx}WE)PmAK`aWd`;v6uGA2?Xn^+d(fgU3k2^T|XS2Yc-Nc-mL&
zgaA}Ht1Bzu{i~_27N}$c7hC(^JF_3KPhgz|ya^8O14muq6**vQwV)!K7eXE-{9~8L
z{fBDeJn!SjssZ=aertk&lvmXPe{Z;c-Jl4z#6%`>Jpct>{=p3J)Zan&$B&YQ^E8n7
zv4<8mEL}kpLb$cV(t8VQwTbfu^PA+6XxfSvX)#gt2c+G1^722(>Fbla(+ZK}Sz@~WE6Pf2
z$jb#kVlFk(iRt^XpD<&(Z(>2veOFtCy?*oNukIVnzl&Wd{#B>{55iJdM8vp4SYcax
zCj_)?@tCZ)5h^GjO(c~w91iC)|8mo#y#x5mbMo&z2lL~1XCZ6(=Y46
zp@kex-nI!}Q+W)7@7}y`qT%wkLn;v^PQ4v-c5PLCa;h|$K+UBO1W9Bt%4=~jy4gIv
znhwI#zEt35MeikFzbKZ~s9(Ufbb5g|PF_)w914XR$6*r9S4_=*r3Utzaq+95S^e_y
zCgexoE=I}Q^_=r27bRyeOT%M}0foAS4
zzmGtM_=P$h!v1gS^sd(bTs8dRnPbWZv`(_2YnXhMpySkI*q3)uLRcDuN@i&?9@<2J
zakkDOne_sni1myMEvz7;xKGD#gvX&nhZ9$5>Tv8-8!*YoQ#1~(04?`fS@HVEBS{#j
z_>Da?AH{wva0~!>?2$431Qy5pzmyga43aTp6V#XY4Uv(jC=A~uF)ghm%8sPv+uwl+
ze-+I|?vR^8Ms5SV(6GXUa#@-#O{k>yf6YKR&IBDFriOuN$nZRAhfjeaYZJ}Dd{68{
zbdlt}zk0u{_&>d0q07_Z4TJcQeoA8czBg6)d@z>2O|q3TQ9;y6^g)jfq*L9>Y&h(P
zVx2uT|nESZauOFJKcyvPdo^fFW&oNlL?V_ZbtH9$Q6SjeaF{<*RdmHdk>3J-47(s$v(9V
zWzF!b!bJ35e{*d^BeX|PRw?Y#HnsRXqtBf_%}aehO(vBRjx=P7YoUIWSjy{oSjv*)
z#GH#Dzs2lR(GCOzFIsiJB|3iSYNMp2qz>}iw{Kj#78V^H-L$g}cKsEAwI)wZ>B3%%
zkbhn?dB@?#_Jn~Ualz-+HE++K_&|KI9KRMUs28%8K
zgBm7t@!^hRd|=
zzOzXxnjbcp2>gQtRdqjfIUV;WovB;dX|^+jj*D>vrej~$x?%n+r8D~H{Z#*4FDn!j
z&eI)XgVzt9XS?-+QKxCt`xTsRK5B)(<)RalVw))85%_zI;xzdKU;4aI`6
zlv<+!d2*F2iIWHosgj_1S3UEHQ~R!~jb?L?6ZI?Fo}aK~i2BrvpvN_;0mvPFmk+~;
z4URX$o{74^TSy$Ujk(>{6oFC0*x2+h(1(oU{Og%vSqUC|&3LW^s;7={RSg+D4r%oi
zeN1Mcj{)&SP=h+CF%Ofz;)-aw7fP_(h>tnPUDks7hV(c}NDB@83>>8yn@bx^0nK*F
zEpZ-_%`USF&%eHZ-e`9EIF;Aaw(T~b#P1pXiz4gdk2tUsf)FltFOzh-fJ|Yf?RV+9
zP|j508#HIepbG_2gLFf_^(It?dyTB~mCrC->c%|y=y!(pg4<4%Z9QUTuPm}00{Rh-
z-TAZ#OdfVzo*xyJpI4gWRKU~Q%nn*Ej98;8^N*bieH})h-`d{{uzLjN;IGG@wVkeV
zU?QE=wX`sR0Y2oudxP{_U5bAdXg|oKLJ+ARBwZMyfEMxQV6P`~CU2B{`4
z-PhN50rZ{9%co40&ZqC6!X;f!&98Ya^D8rgd=+FQPJ91MAUoMO;<($Rk+mJ)W<`;p
z5`C}m#e1@MY3RlwwurPEwD*V8v;Gd$?$Q;Ai%Dks<2-&4QGb*D3|JeB)L6Coe*B%A
zURszaE&AiF0NbmN{1Md5{6-`k4=s*u>iPauWq%u{{3o5x8yy3+{}qEoo5=FNtx7E?
zBVqw2t$ooT+8J{K5&%LJ{Spj5SI_X~)ZOXfH)UoV5xw*%q?1>jC2#u&Sa>T_7Zh}VFU0o66Q
z3}!)(q;H7(N&+99)wlRTR_F8&tq_&AyPST`$AsW#(K9ggCF&S6{YL;EV3~hW%ir-i
zk^R9||0@cFkA3@29B2XhtEY+km-&@r9i%(u!C3{YrQc?KBT)g^Rh*GNn?t=#|InmO
zFUP{E`gyfg8)EnMuG8%jL~dhZq?K4xKykaZRZy}S75{v1buT1kme5vZ7@9&dn2L;hzdd~zH6yA
zEA_L^7@vV2!uOpdOenlLpfr{QQy6)SiZz2#c!w0RiOf@fd(FN9*z1u3Ma3<(4;yse<90SQ^GKx&%@X3#*GR19AwwfJs1QYyzq!>3;2GG9Dt8qoQ2
zOz_KJ#~Z$y4aswa56EPzc>}ipFmOg>w|)RAt+z`y$Gv%F6pHCKy{jx&?iEu>)s}`$Cw{8KX$PLwJzfxmSunKna
zYLFGZlAu+xXdNH>OoiX^N#$HIyh50Riaq&DcOi6sq0vts_MeanH06IrDsB_k{xMzp
z#~wqEaR=@m!n$$y2N?bpa^tt3b6F2xN)_YMUNcU3gsVu-cBdls0j`mtF>k#E*%j#n
zKcQkarDB=0_{CfxbTnZt1nL$Y5j~EeD{k^jR~5FaglB@Y_$XHwWIU
zIx?2<$?lab;i%rGjBc$y5fK*$&kqy=Ml@1zbjJ0xOB?5&nauFauav_YNf!Y59^`r5i#B5$_hyQi+Qd2Qw
z&EM?8j+Nr(h$G&SORUw42TG$|F3+ErNblXJQ=_@e>}MR4RRP8u;SI?;A;zjUSNhvg
zG3B@$zkraB4x{;d>|glBZgZtXiF+jp-h&F*iHp9Q6?a-JWM{5Y;D1XrJERdZvj;G+O-cW0uln!4bsvrUD7Sx
zpl-TDnoSET-3>~2cOyzFNF$xn-Tl8e=jk`T_hZHx&dkx-@w@M}*0rv{CR$*mxb>bg
z64@z>xSdeW;Uvbxq&&dvfceCMo)YWJY@}S-mjX%VtBE~pwSr?g%PF;RPtT8`AJAh`
zSUx0p=7mPeV?&PVS8SgmeVx>cb4KHE`SqZ|`dkzww3d1h{1%Vk&eks;-h8^5;80Xr
zH!c9u>|PbrPf-H;a1Fl-t4R%-YT<;yvBxHg$9mYX;nisf)+$HIKWagFK7lL)7zS@`cX^gM;(&z
zX>2bN%UrvM{C-gt6t;?ueQ8A88K2Caw{O#7&dPo0M^`du;au7z`XP$cF8{U>dzsQ$
z&MS0NmPcJL_yJ;aBP?P3f4!LGui`Xe%hLaOBL-pyUJv^|^BEgi2g$m)=MBr55=kP?
zfnGfBv5m8?8!}0GLg`LX+|Iwbvmi9E6nHo7>QHi$FI`rfOq1}!bA}vxo^!MKbiKz>
z6|ivkjJI*1A%SHR;&Y<+`k=4&gPr6UcF+JhJmpZQ%~^r!{h$k3bKuj~rgvYhi3W2G
z*t=1-%~tEh-*}n@PalRgt!yw~t(e2eAAr
z<^xRFm+#5W&dza92MYc43Fdi}UnXkzJp1R>g$91#Sk_yFjq~OxHRa%i&g8O)UZ0ja
zMZ*DprY5C$Ig1iW;Qzot`YcU=;U=?o{;02L73P#O(aN9Mb<3af3j1lIL_`Bv=)q)y
z4gr+vzDH}I0QfXrIf6_>oFoBy6|maZ&5%%9CIEw(+9p8izQuY-j1uOKZh0oEMhxJA
zUsCQ}_0p7)o&j{~RZ9{q^aUaAM`R-g{nan4&BJUl4xddK@CC)9yaFk|v91JF^gA~@
zmCMEjL`ECdk8j|-T0pJPrtOmKTcJ>Ky!ar-Vfh-kKfYmNgU|HR5dAa|I(=sU&*6r0
z6FFOyScpv@CeVk4E^^rJKLAg-8n_ViT&wd{=cW_r+T86@1TP0(a0mVBJtTs%@av(c
zvLwL#7$o;>63QGya%OO>U$Q;jc-n2gH{Y|)Mo5D9oZ`0C2Eye0y}Mr?+?(oq*s^
zeQ{Ke`)#nXS02+tR_b_^<8aRmDOhKn8kid1RC=9Ns(`WmnQZ8jxSrQO+`0Gxilq)$
zWPc0e1~xYLVcbHvz}*Ubc4SHe9g8jiD&71`r_Ec7*?@Ag8Gs=S=;Ke_0k|+**p2MT
zdm;qrk!Gmi7scJlPGrElaNUdlPaq+m_2t%C$5+RTGe0#j;&_4Fdj(k7PC+d!TSQVk
z(|9;ih7hEBQcJv-d#nE8+xy4z&*8`npGehb7Boo8Su!79RE!+{9vZ3SZh93~HTpS@
z_^CD#CN{0B5>e?K26YFpHH>b|rLEwyJaRt5d(AP-5QK0kTVBh=gwZli8Ssc2;O#lT
z#QD-lZRb1xbty>F9tLW%);~$mZ>Qrj))ffp(nzj3J3#eHt@(7Hc^>ssw^eEa
zzlGt^VKVA3rNHo~Z)iyl*Zgu~VEHfs9NMw6@E(vL3$(>xcm
z??`?rZh!XI{xFeTWL|d5V}a
z!1324Rp=)e6B7euj2E0>0&t?akFW4(Lj1df5UvLnp!s29IhVk^jio-{_FJIN|JB|Md`#l%<@
z-jlWG&D`d8B!7>8{>pvmK@AqX1%@(e%a9eneyRR4GlkfPez%3Gf+5p+qg(Qcs(U|n
zK&l{+5m?<|4*kX?BV(zXaSS=XJd_Jge=R2jdJ?tG6Cs5HX){#ti{dW04S+uI=OWS*
ziu`J3pdz12%j&Y{S5YY%TqNkiJv=*!dO&V>FlGxj-C*F!?E3gsTRf|pcz7R;@M*EX
z_6?!G{gtv-enrwPbRnCBsW>v4C}fm}y9jC*#GX*zwkuCYtIbMb20D+w@Wy{sSQrhkXI5jByQct3?M&4?t5aG}%v7zOp$9pa^I{V9G&z8}RyEL^PTLsLef#DIJ=i!pv{
zc}7*U;Wy=U<&S715@&IBpzRR1J#xBuJF@E7T&;^zxT(HSAUfR!+{T7yhS{I^u_vnr
zVMI5?V4Dm_J_k32##N+X0^nn?)nCHob{H6cyCWVcnGKNGzhv`$bgW_r6alXw-@scm
z{R_T>ZC<;%N%{c|ydn&^lxvZD?fV4=2KImyfNjl(4?q(^hM2l;4KP+a$8KM2fT--v
zF*9nFs-NLAX+OJXreR^K_`E;10~sQKH6j^xf2&))U~{9PBKrFmhBy99u4)2OsHvK2tX9U59#>z
zQjvK{1>If=U#?T(8qe3-q^N6Z_GxGt(1@IOU>Fai@?Gk$DBZUrC%8zhpVu&K*Adh;
zr=Nj_er!@%`cvVGy~=wM`qF5S?Ow2vTc>O%j>iw5_$vhIO)e+tCwMV9`2MF{TVcKr
zJ-7_8$e9!9(4rZop2VZRrK09|E}Da0efkx&_HQKqYD6663Cw^BB@Jx#uO)%^WHB5*
zOhAF(tdPhiX7H;!1m>{2ZY^HOAIc6RVFYyg8yhPmW>cfbPSer$fCNuQc{3v>pB4cP
z%~{vDX2CrM+ojDP
zKn!O=khiJeuQ(|Z@G@WpbjcTnhtDrMZ4&yn=37-^l#!|BAr8f9E%6!~X=OUZluH<*
zNulwT)#pN9=ihkBq@SWF@w&OV692|i4v6*0*IE|~<5C0ctB0+Fzd~R^@tQ69M((S)
z&LqswpT7djdP@%=bzO^T$zXUHH;}GN5%^%RA@CrV@?-}V
zYOW9#0r1K0-Wl1Chn=zPup(bzb9r%$y3%0*S=sIF9BZuy`wEnSH%9JfZzIEI5RO;&U*ZgQ#(J2A)1Rzczm*f3V9QB&vagqHd`2=6>5sDEZ*NWI7{_Um
zKY;&_&Um?riHl1;9_U3cE-ntg;~VvKllw49hm&A}O*k?JhE_)oIH$U>bXY?Eclq#$
zj*%9wnyRXq!=y`ZQ((butU_(}O7Tfa^gidEux6W;4Utd73IlT;lkYLp4
z`cFrFrdhHJ$WYLSSXgTooD~uikXXkpLm;gIPh(my=}%NcOB0MTqi(ET7B
zlKz~xbWuA9LKJQzQTnpws~h0a+`AGrX*}@#`}uxVmhQRBcW`UAA&|vX9T0@2=C8LbDpHL;{-hN`<7u&Sp!D%m)1i(p_l>A6~8T
zd7!^L)jjRsQc_e5yWX+$iGjs!c7>A`C8Yc0DQ9RF5ItP00CUx*x6#2e46P*amvUh
z`7*>2KEHbH+;aZR&s!L4y=b<&ZM_9&WvvKK>N)4`vR%0gD%$awQB=OCt6xq
z1R=x)hGz9_D^b#9D)nx*S=n7-
z$sHw=ZR=Qp51~#+bBSHfj#Odf{T>lKw!D$gw6MO
z`Gw*?_-MnoRzPyZ5H|;6bs)b%rIj;t2O>%s7zHkLaNxPXQ_TJJ#i5(0BR_C)0^%K9
z`qCd=>}Y7F3OC{{CVzi~Id9M~Pb{dU!(+jht(-I0S%CwAqj>H604J*IFVbV2CUN)R
zZKBd3X6Pc9<>+&F5WhPH5_2JdLcOL0g;c4Ja?1e67g$aZoOZNE}Z=uf}qfQ4qa
z{-BQzU4B1><}+=VG{wwVr`chnIT^t$p8FuhIK~GEQCO0<+XwZ}13Lw6?T=4ATq5In-L-*_Xrj@q2D_xjk+}wi&xXSm8d@<|&gv)5WztC|ASYTCJ
zq$fn9jH9e1#42@cn%M5GU%$R|PCx&_IoM-UH=CP~4&xgE>dL)v+^GEZLr=cn?%=*t
z=kIUYZInMj1bm^1QEsl@-cS5vdK(}TBek$t&5zc3WEX#86m?19=hWS=Wh5T1$)YRW
zBnP7_<)(QC!zmHYtRM1>wpT?r7*0w3U2K>Hu|(13gWrM_Of_FlkvFPb8Z)E(^Zmd+W^x*MEJ
zYnOD+xLUp|xAXUX{uyq`7K>&m@Buql#ZcfR?I&)F>=pw@y%7)3>E!B$8`*NK?VB4r
zwW|@p5}xJ?L$rR&J&UDhVJ(g&7M)*DT~Ar>>+f5+cX#BqM#9VaB*d5hQHHA_9p{k{
z@S->*9kfq(PiMs(8Y{4|RPoCZA!X_4N>$!pAwN18D?Tef48w@LJ$rP1lAbkL+lJJH
zGPu~eghImDR?Lw~eNOF1*UMFCYp$vDiaU%s-^x})M>?8xY;-E<&$x@TReIA?bp{ES`Uz`WaIiq>OY
z^w#QCgX;++Vb$NN)2K>RZT0#kbSicv!VA=dk5v-{UcAt}`3eZlJvx$7QiV>*#!VjX
z2MI5^xI(>Yk|ef4Du@IW6&YC!kQ4cR5FbC@Dltyvb)eKYFi-*dpSq`*Dt6TEN3uHH
zE+kA{xv9z(iy6}UOOK@wEN_vUTicNAppJNV{3^L!Z}>I65zGp=)XUc#A)Lv&(Rik8}1n>~47qWUr)#g$BdA*`*OnK7cCW~L+7aD=Yjq+wfu$v-Z
z5lD*t7*jdrcx%kpvP+FbcU92XsB1?7QmLaAsr|C9qaCkLVmK!c7m=?i*VJ%Bqbd@p
zUsENCV?|p0N}o1Ty%?AsLl7pjMcO}XCop0Syu5n-_A_f{cj(vZ$Oj6<)6i&DHx;q0
z(W9@Ayx44Gd0t*OKV4Zah+kgYK(}+{aWn6aSM|72nIHaCHFolx*XW~bc*4@zRmlFe
z=lk=vJKjK}<}-Tl6jud=(Yf2>P!v^M!}?;5eCiL9R0*B`bYNS*jAXZ=Ss4A*UI}h)
zQ;zg#_+*ByWOb>L+DCZ@Kc=rL4o`&6GiHOMoGPE-)`VI9$Vrze?jHH6fe=fLgtM^o
z#s4K13DMeK7_wh0gWEfK?Wb?Ex|Y%l-ni}OB5UJuBHy`ms|%9xpv`~Cu;spK8b6Jj
zEI419F{d6(3LKm#@w+lpYHv~NbeLFisHft9XUFzuXMD$%8wmf5!yM-;oEO{pAhB3$
zyl-q-t#GBGEl0Z=Yx4AzLq+bxJ&WnfwuWx?-gck)%ZKTgYQlyyYWZ-=G#WL9p+-(t
zcaLniyz1ZeJWoPb0Cy;$Kwi?+KPlh+p`*lMUmL3;r>Holm)`~syFZLv$=aI2W7m}}
z8*|Jj5kS{w`=hTpb^zU{|Z{64%iC!Xz*#XbIfe5KU4v!VRtA
zww0OZP)67SN_=1&2tqbJmtaF4Y|rGe6-G1Pi%ur^LCXlLF>BP|NK=(+O(N_?0Q_@a
zLBvaq+6?VzC^O}q70>gt;igfPmRr>D)pZ1sMQf^SvRcR!CJhYq+4}lPIlIETzKMzi
zUR*sBY$yJ5+sg0&M|cXqLpXi^)Lv~cPIgITv-Q;Dg56he{MJtA^T6Q%=@h^AfYae*
zCI1xELMbR{*bax)>*wR~@02HQ^1Y?DUCLK7<%3YrKh)Z)8
zi!#aF507ZW{j7Y{3eC0c&!6N0RzDC5czX*2fb&=r^j~Y>yk!npz&73(Zkb_4HyCHDw8j+a6
z6+-8EAFlaZdhuavVd$K;2HqfXN2?*yXzq|I+2Azx?HrkAjIpe&=jRt9GM?#zKA{;3
zQ(HAAJ&s)#{itaBVu`iZ$kvhw5noB8Ap7mbAI}d-)ecr#c$V+3t_81Mz8mxmj~`sH
zek*XkzDyg5%oZ|Ja*Nb$6~bDNw$7c(#fw{{foRBn>>$6r5Erbl!7v=#m2VIVKjGrw
z^=g;pKsSCi2xydUZf@%(;IbT`1GL4o5$fr&{(gBo8X}S`BUxI^E7*p7{^iS;k-!Xp
zAcF%2R7Wu*ho?5GXLUhTmvJrXe1shF$kQ4ED;d$uYhoT!FVoJFu_N|FXcs**8VK*4
z=Si;3mK4uTzdrHWIHlLd!_I*dbd?NVs{IIIV`O?d1i99DAOj~UOtx#^r1V?#P#7ya
z`bQx>#ciUHFo8o%*J9O3_p%d@^aASCi){0)>yvtm^V933^IPyq6nNTo@GR#o-zF`y
zJI$EKm6+H$)9h1U?FOjfS7d!AXzLXU3fuGc*E)K|syl
z8eKj9@WI?TX7o%l1h2qJ*TaLqe`6>TCI;NpA|xbavXcTG_2UaAJZ$W&KFj`#7}#Iv
z(UdfxI+X7_xPnSf?w3)4>sJ=nys)^g^!eiI?x+0+7FG>j4qJ?W{GGcLh>$Cs~W#i?BWV
zKYk`u^*kRJ5+@%FE}OX7p1l#g0(JcOs|i=F3xX7NHs!;lp*gZd;TNJNk4kiK0+@~D
zz6~aHE$JPZEtU3uDa@X=ry|r=dkMGyi#h6i=qum(?5C!KeiH|V^3(PoA3r=f>?DXQ
zSRH3Rr-rbZN8t+BzV-DUhb6q2AaKT{|Y5QGXo@ZN<@fWV$r*v|5U-uSQQ
zO>$Eh=B<-90-~#485oodQV^wXZ(EO*0fPq>zzwVe+`uTI!?fbhpC7>daMlJv0|-UO
z#0)cLw%OrzZ9p%ugN9buol#s(x{sO4`_o4cQLP?&AAP?#?_F}Q_xS@4f9YmW=jawL
z0rx6m?gjGQ(XXA!i*JxnBVWcq$m6RW
zVO!pR_`lsK=9ZO8-|2{+XBmM|nF^yJB-Nl|X?=Bz;@uGrEcJ_)yuFkFGy-e~H9*#3$A
zNCsMsGR^wCoC*Zbkp2VE&P0LU4c4S6<|=SF8lsci19F?{BloVZE*mq=30g$
zc{iQplTSoOxZPkzL6=2xnNTkzkb#4yUMjpOLSYtT2yrsNu^MU&Nkg-a-+hhqRq{e}MBRV>IR5aacqV#=R
z8;BzWv@ZRX{t1u~JIco_Bt#0<0+%G29sfAqNGK@7dLN}q%e&KGBC1vhDBIN!9lBUq
z#rWlsp^gwUEoJ;(*4~okdfDSz2^1;TKo_4TVg~#z2Pr5siDkVbsghXHm`n13ag7Ev
z21PivO+O+U)UHPL0Bl?>`@&2qArMH;jg~)}PWPLG11~bx)M_Gr#K>l6hgVfIj1=Mf
z`SKU6ot9~SqrKfte>NX-TwZrUTcY%OD@43`E==r4H=|ygX&HF}rs2e4K1~pYTdD(E
z+;`F2dA}FM_RkL2NtR{1y7>)sLK4o%IvG8c7xvz-RWIvjh36S3jlHPJZNzz?Lf;
zT~^Q_{gllbYt$jT~otr
zhvw5ES?g&ZT`Q3+f9$>V=W02>Q3kY@*1z}jLVK}%BVWhCKV#wHD*F5$zLNSG&7NI;
zv7OW(>AX?iml{(?Pq3aKpMVWH;WG2;(H|))4s!q?N@&?lO+L8xynb>$KlrmV=4>u>
zGXH5P=_(oq^amsIp{!;SN$}lXn)tcm96JfG)<-H6jY-#2tWz9=Zvx$N2d8vv=uCa;vu1{`%k#2-Tzb%4jn7*NNezObD^GBPrmG&m|vaGq8q<_4at21~b>??MJ@t8X%IV*LXmG4;2*{lBi;Bb{kmb*JGVu-?BEZHE
zC=y9Qyy_I%wjI`aMJ$N8kKv>4$Ox={vb~`l;D&22C%Sp45ZhV-7jLF(nBrgh0=YS`
z>;cE1b@!)_x&iPOOKMS3j1MXLIZjP<=K2q38ZHmtn+T6OX#}9%+|+JhjGTR5ChTV{
z$v>N!s6p@AGTj>lAg#L>I?r%GdB3dg~x0Q=e1$Jx3Pq8M9p0WYKq>-SZ8(&V%N}
z+0~Rzr43w_mU<8`Y%PW(`*|l4tQW~OE0UBbig_cQov9GYy?H3S*}%HXR|tpycu*r#
zaZVKfi_ls{!;rT7ghI^|WKs4>F1Kiv@yV%Dj>zo5H{;!syz06+gEf&qILMV<&&|7E
zo!0Z8Iu@OfHpDsA4Uq>Hg{INexm@{&xLiZopwnuDs)`--RQsG0NW=M}n8p6WE*oM@
zoP+^=*WQDQ+$DKzWsKHyS`}z6N#uI91?Dx1Y`xX3LoRTdJSdNpI)Usf73`d;3)-X6#dYo*(HeK5f4H}8;z>TAGi7n
z(aD-;S3+yXgtuc7ZX$#~XL9%#$VwD#^cB`jI4`Q8|efb87QT3naH{F|o1PKo8pFQlgeHLIoNYMV3Qm-D(-ojgE}yC`APQ0Hz2UZGAmG
z_W6z;@1Qo*wPS3GpRhr5%0`tH0Ue+LzjRd{$N;#I1Q+j=7OJy~kw5<(uM1h*yiuUh9^WUl
zJAVJWJVgPNPZf9DH2TFhqeerVA9>sw8@^7Apk=iPv2_iizA1c?&YBq@{l@Y`TVq_b
zt12F=L<;%(@<$cJ-F+8VwbjYXteO^sFme-?ES|m*(mLtDXMD6MBQN2qP1q;jmGrV-
zZy(ziH+tg5e^>aLrUGFXZr3__ND-_SUXXCA%@KE94WTBK^P5XY8V+wd#xyE1fD6#V
zE{wKjKxUHtrPhV)xp?!^+UpGan)ZwUplzCB1u?i<`~gw#oX>j!k_B2&RS<~{c9^%m
zH&o%vZ4|DCrlum);_MWHFyrkiWJ(>5(C9p(24RyP-86sF
ze$EOyM#6%FEe+8;wHY|$9*){%&QIG>l`bsy?&F(djcgKw<9n1uL(vDuedU`xH7o^_
zE!?PsIW&;pvmPw*wP{W@DNsq1_-@$jBrfCqjS|9QP;B#x=E!i$>B;=>R($2V3#w~x
zqbL;7-;6P|I!uPUr3|m0bv!~Qky((DOO}McDEN_?c+eq}$c2uY8$_{@`;mbl%JB-v
zOUSmdPgEBV`~Bc7j^E$_LBz$-GMn97Brw)}TVcPo{E_aE)vQr2=dS{+e2XKW1rdeF
z8e!;RU7t^-jXW)EIn_0uiiCPk9VFqiBer=^lZmw6X$roR4`i_7^{&Rq^p|=gC-cBG
zFuaR-QLNtPE!*w~l7RE|ibN4U956mpn!YS&2+8aEGkp0fzm2EMvisF#>@oB5`59iQ
zwS`@G9zILaL33*zgjKUGDdH!2x;mkX#)%?>Q^e)qVz+&C$CxWnUU?(4tcs=b^?!u$
zqLFmlXIjC2K?kgJP)kg~#_lLNwSOhGi;0d1WwHHBr4xPppMUj?W>
zT|We3O?7io1$u*|(&lH}U24fLbhC{u#L#WpBR9oQJKCz3N7Pik+FC^?Gq_Hnl0=?*$l@o*W?9
zJ&Y_`Ifu7i+3+VnZOqLrc51lN^^YRZPrJW86N$^gDNw{Rj(#n6oT$R!^j#HEJAErN
zoi&06^3^mO
z5&B6jz~CVFyw(Tm*SOc`JAy`$gPViFT~k{GDG2vJet4lgn@ncq8U|sx5xop(*5sHd
z<+6xz(er2^lZ@jA-3dZBi+)EQe$m*G2UUMuD7_tqYaoK#@?62<`PunKA~xAK_Vml%
z#k1&Z%p0%_rVtS^LVE`@S1dLzhw|n1PBJ)tNi=^>aKpgL8gXM8*x+@+G3Rp!b@uEg
zb$tzE%aClQ#a3;#r~jr$(!yuaF9vRRTN?YcR1?ny@`QZEX`@H5%B`)mY9kp;@;0hc
z(}|iaF#fm@XA~eQC-txP9yxLrcj*Im{0YnUu8GXJZA=17ISR>pp<2=$9Z@-n368MW
z*qwY_(HiRN&w&49nh0>1I02~LW(a%?%NY0DX}=M-OIGs5Zh^BRha{G9uEImeslTEs
z;vOoyigueD%beGBmD|P;JQ(NyEcSZZb!qLUej1!5@e5q9V2GjdsxIr}ingZfRV7?r
z3j>84-g3m8Tp8ZYvv69JoOO)lNW6M2Of8977ztzlyPFMR^v=7pl~;m-0$35JJU#1TZ@%O%387Y0cv)n2-T_h1?vx1{FAI#t~#Q_Hm)kqoCVcTbR7(DP6-5Qs^
zB+?rgjtXJI6y5GK&*kSMms#qD$#Tih@)uMRafv=OV0Y*L;MveKYIACIDTeI#1NiRt
z?CYVM^LCq?9+zqG$C8ckBpb;rQIIx#4&q(M?O@850&CrC$
zN^_YT3^`E5jw()AzdAMG)L`2ba2@;#<@|a=6Im7QP)BW^BgcK|QP9e5WBtH3g%|Oo
zTBrJ5%t9W?m7O{CuqmSf`3{_9x7gQl!70xBvT(|4tP@mgqX@8h^7^nv`Jh|;JFkIG
zkx0O{!?|xvEMnBZ!-cFZA$ZKHYtCjFo|q0g}R0G6Ovu8=FG)IAdN}
zml4oLpYXkFSuvGQYVN-JAxufxO*!8S6i4bhHheynsbrWcd&a4`%6)|gdE#dKMQ5lL
z^lNI@M{e}sf&X0689hXuuwl}itw#r6a6xMW~nIqJ5dY
zjeWdgA$H;I3^qb--fLXk=s0LT(YSQow_rn3m?77Gpy&GY8^kHA;?-6jz|RYB-;i||
z>0CV_VJZ2#cS@!OiL+tl4ZAU89Qrj==>1D_T-z-YHkbGG0=LQn-x1L0jIo{w2?>FB
z^Rri5&cmW{?dnJQeeqV}z*B`f6%pN;stwScZwLgJgEo#xZ+f(z?&*4k0O2)|d!4XndiJ*l$Z|`&>;*Jz6+OvH1UmE?NR$3bA_~_yD_aYf;G<7^GdY$Hxvk
zxvrJ5fBaAy6zT^v#~8@KY6c`!E4se2*GIv0k+*e^z!VvloQqdoTesyz!}$%tRWhOz
zLs)=#ON0kswu&}C^eMQrid2my1|&GrrNC%YoY#~o4i*b_&vyLu9QLZ&irBlTJIhKN
za5D_^H6h71jL%;-r1@^ktb*4J{3^hX<$la*l*R$nmsCk(<81!C@7>*<{UL3anP1)<
z7Xhx+X%S|2Ljxi3|FWE6(V}~<22Ay2vT-c_xsH{PpkAT83=g2`xje@?O=}5k{1ZQb
zCqZUw1+(s
zRC+0=v#KD>$f2B|Y)|BU#DMy`6BAss5Sy9T)A)IQ;Rv+(`6~G#${nW)dx1XD_!Q-Q)L4Qr>)Y*a3>L
z|KQTbvMwyP>#{o|>xMym?R;B~S*>KYi2@FxeU_KKp#1$Q7u67sFsF`m^nd~OH=ed2
zhFfm#DC)2)x~Zn6$K#OASj)hQh+a`@yzSx-|wD2j}(4=Gf-7j<$9_07Hoy
zSVp;)PHrU6Z(1p1)yFnV4B}_`kwqHq!Wq7pk@W|eQy;jvc2*`nKhcr-K=v3z&BX{R
zPYlq#H?yU1Bu#FTcBDz*EBo-j?C{Jj|LshG59a2Tii#g#T{+(t7gyinieL`OsLlQg
zZC-MO6`t5JaD%p3Js~o}a4ina2rrvq$E}kN?|9CN5%*@0$&=_~_WYGqhF`tx@_vA)
z*>Y*`vU-6m1%w~qrc1NfCgCAIG>TU^&)l>RJ(AxV6U+V?P_$z@OAw%az3Nq(YPzt?0++~sZHAY`7l_(G7
zSH>Q?Q9J%CjbQ)mY(fuq3PZf;b?%7-fEh>yj9W6qxp-kx<{Jhosz+jCVjhfObN8F-
zzV?)Zgjwg?RA4qI9Q?t2g}zZeq>WrC!r=Xyx@nAqyH|At-P^2}3(l-h-1_t(9=g+(r$IYoFg1>fmMz@Gb7_2;I0wsXqk$uPU{s0r5%Jj@9f2TNx
zbuKK>;#dIgwB@rw=dJNCxw%sJiwYJF(UVexCIIC#Got~35(ee>4h(4CFmQ9@Y5-fh
zzrRNSuapB`lJhMS6VvG0Q_L_D)y=KzIFFUo=bd>b<31@$q{O~7PMPYbh?plV-v)^@
zlCVB`<_2vr<7Jp<6kU(3US>so2g@`dLISVh`r50y`kmzT$J7qsgzvCbQdgK?#|{Nl
zw96TmVN>t$mNlWP?JCPnSyNNfI+LE`Z`jH(%*;n~@KRS86U`7LcJSw|{`r#$e4PGT
zt={j9z&COtE-8rs%X+;4)?TXMT@vvDhDrHOy9JJ6bExS^y&~XlxE+t1gSInMqYDx9
z_u8LL|7j|5u=&r^)5>3csrX2EOxVb*a8qhVTj{^o=lm%1%o
zuf{SC1)XrERZ#18ePhS{rUDE>qZ1RZEYi7vB>5V6bJV}vh`wdIg89{PV-D5)g=8HZ
z9PA%1`4+(_Hh@st?G4NuM==0XR|d$f*9I3BUc-=7V{;oTX-OMw7jH+rHI@n2@adJs
zKcAZDf|p>6PkOi5OH5A86C3dC&tTyNrgT2ikd+&noC=CAx^G$mQgNA_X+c&9syvM%YdNdt+H+Vf>Zhv~SDz)hE1|Lkl}|
zEyTcmxC-S3;cnv=3kk1%yX9PgTHdjz0k8|)2b9mRfc|AiNZ{TAUrmiVJ^Me2>yRaBMX-ki+?jwd(gAL5nPW=&dpVsr1-A5{jz;5oYgnbii5Ik+c2xBhO7
zog01X!<5QSwwMJ4Q`Kf!`2%t<7Z2X%+1X>f&$R`(-F>WCC22G#Bz*&E0>CPGYrI4p
zu%YMVR_dv#Hf9=}5&