From 38f04a0b9939cc33b558a8f2a361c30681733fa3 Mon Sep 17 00:00:00 2001 From: benjamin-j-powell Date: Fri, 28 Feb 2025 12:29:36 -0600 Subject: [PATCH 1/9] Adding verifiability proposal This commit introduces the verifiability proposal which introduces two new attributes: verificationmaterial and verificationmaterialtype This only outlines the format for sending verification material, and does not contain an implementation. At least not yet. Signed-off-by: benjamin-j-powell --- cloudevents/verifiability-flow.jpg | Bin 0 -> 171952 bytes cloudevents/verifiability-spec.md | 210 +++++++++++++++++++++++++++++ 2 files changed, 210 insertions(+) create mode 100644 cloudevents/verifiability-flow.jpg create mode 100644 cloudevents/verifiability-spec.md diff --git a/cloudevents/verifiability-flow.jpg b/cloudevents/verifiability-flow.jpg new file mode 100644 index 0000000000000000000000000000000000000000..cfa4b07f6ad38390f1c86d0a013ccc0771615e7a GIT binary patch literal 171952 zcmZ^L1z1$w_BS9RNP~cMgLHQ)(j_GfDKJBaLx+^8fOHHnG$J4%Al)DWLzk2^GK6$@ zeFycu_r3q;`Q|ypoH?^|)n5Cz)+X$kh9d5Liu))iD7eZ>Pqk4{u#!KeEisH=%vIy-WkgPkoP++L0^Z)>4QdWi$K zju1C8G3URe`v3==g>+D2#+pf8Vv%8xV1H)}c|9Slxr<<+Se|vIr{W~pSf;_js z@bGc-^8BZ5psM8UQ*mvGtFwdqZS#6gwre`@iL%**Lp71GILrwN!R;gSY^d|MvFJ0RR6b{dRCQG@7gfT{j6=-^ z82xQKPnq9ndJj<9WS(XDDdgH@YOzh_bI4yrd^je5a=Dp;t`zvsMHh)~T=L*bfL;E^ zE%#R@_pi*=?11W=Yq-Kk2MshrMU?sIFEO$R!sHznSYLr|l1;AoLT@dl4MVT!aU&5{ z49Y*3tPN)984h&oJyWigsn+^|#D@=fAuB4A`4eX)XTUUwfobg3wZ0w16^w;s<_}6R z|0YEjCYptG+q`}|k8-G437vmk@SZBc*TGEuEdkcbK^vP)ZktTO*tu($JvQ`9Ht(*d%tlR9bmt1D=>rB$k_)uPcwM0C*CD(s0 zLS+;h0T@cfq*0B$JXd6w1kO+OtEF=+V322Z^lu_2h5pVHqqeTzzYVjFpDrUS7;{VDUX`W>=6~ghF316B3oPhcr^m6LIq8A1i>M$$rRXakLk`rY zs=uu3X@4YipLjDnqJh2i>HiD@6pfNNbjhGqU_Jd*p1R8?r+0>sxt3_RjvfP`2rv{^ z+PkG1f2**d89X80Q)O685{@ua1IKw15oP%yWN)QwEigpyKQsnzCL?~g%SU)_O$iKX zbNIlcg8X(!lXnI~r#oDdsrkz0IyJK+YH3Oz|L=&>QPiyRcSneOt^DK1I#aZeZ7#{D zGX#MAXkE_4XbpK&|DCzg9n|DLf|lApJo<{;Ywq!;Y}4oZ!SVJ#JTk%D5oVVEqM#htq!ZarT#@%R3glKXuR+y zU)=)K^ba3mMmc>GOHIs>u5!>n`nV}}*K6X>yv-F*SOnU66bW10daC!rCCf`&-W`Le zrmP=S4f3XbqvHPefG~&xyEkWZ6te?7dYaFzF&0;HmFVPvAth$lGM-q-)Ebw0!%`w8 z90==Sp){J9vApdE6AtgsW_XDcH@`O0{r5U5qUE#fPAL>N5koECHJ`7^UlA9fr53a{9^Ad_K?i9mCV(MrnG|snz?cyM#Yy`4j}uX z1Cx?CJ{9H{x)YG%Sg7E?*~=6I!TKzJKStOSkeY#VMx6bxD-A0EU2tSX(BT{ne@7gI z!xVVROt{xeJ;~xvSbeZ6cM*|&3=cYpNMiWcoI-KX?1_o91Lk7=4hOru92&8ScGUtg z1O^?v+VRoY;Jt}iZ2b`bT?^v>;SDc=LAaV#e}x=NMM57$_2tgx%!_1{8Kyri2k`=Z zFQY9cZN_$UGP_O^NwOk%%|$_C;D0p|q{jM%6yBF25D&_exrY~s{`v`>_@kyT@eaxh zfLO3VKx+3nCtWah^Zt_cH*vo!FNlZbGnZ&s%Ye=ge+xu#H7ARV2zZUPqc!%AWehY! zCumuczub3!+R5`|aicWbkA)|^`yryVpjF|2X!(NiWqSK4kYJx z;ZZnQ{xLb7c!t9N=$HZ;m$rqyC3Oujt8XzVNnJQ?A&DgKF5`R02)ElyE4~?sV*HCr zfEswBDXX~GbFr_dzHGtYI1O;QdNYVS3=sToo8RA(p(tp|>{xrfj)Y__T{&lKtTvg$ zqtc8oQuayzyXpj@mtzKfWcrm^BcE{%m)~`H$P`15Zo}J4&=>0-i=I@3<6_{{zQpzb zQeB=;%|8z+)vpm+XH&&udbh(rU4xb3i$CuozAC<4il8rF<~3zG#Gp}~UD zMK_POk$;OF&^8sOu~wmc(Wg($cp={k?Skx4rA3yOR^NT`v7_SrD zlXoTRV}7@9x6>_;oirt>Pa3+G?cR-~=H*~#sQiymGA*RbjwIAh`xbG&a*MSm1k~y0 zYFqYSb&|!zr1KxXz7EOSh}du$X0Xd7S4`Faw-xC^pr_=u&rLo=bxueB7LRfrEQyVE zs)({tfOlBRYy`A($`IqV7I%J?pE)|!5k6LSbuktu7ow|{AzApU%8tFn$DPD1KdNy0 zV_2!v=yreV*d#Hl+E$^6-A9+N*R;yZnN{{<5MF^qiV3sQ4>|FE-}9rWbuO;YI=w{u zr}?}O3JZ_cbI&9*Vx+LrBwe0v%~$uk9dz_0>gBTQ@{U16Zb^eiA4BAML)BFW`kD5K zq+<}5{FIJ}hnb<|k{Y^f*beI?(9e)HCJ(MHmt5=-ZHMiJa%`Ma4R7~15b9?LRTa&B z5?}10%Bz1le`dWU6UxDp>Xd^x62gHlv$ex6)H+A%iQ`2uppdc348-xRnIRZQ*9OSu zc*(Gv^Wl@id8I|G`=CxUO8k$FoGOEvZBN@^5ENB zSG&$A+`K(9E<-~Yw@J4y8J5J&<(>ni5 zZ*~^X7*9{*6C>2;R@$(2(7YA-pBgB?y(o!q-2Q~S*ktu8%U#*W7V%TowS!NiWaKby z%6_@oq|rV`HvW=Be#VHbU=mQe?ivqobiRH;nBje@a;OC&|oLjT{ z6~7POCbe1eKJ5G5;FVWc4XmB0*34+Ec(l)*zr~ch%t^MqtAZTa34L<6AFEZT6aufP z!6?bA9qzspvJZQ`CDQ==`0=CLybJHS(g_{^r(k-M`cEzXS7UBfu?MR~_q#GW|M=iB z%$Q2t+F>o7R$;>*%?ZTxH2j^E?v%==W{AE*gD$6ra_FCrbtH}%5$NMRF`j$~T_$LU z)ora#wyA(!%#CgDEjO_EcEIEa^sgbW`CYD++F?Nuck1uVwO4QqMEV!{uiga0(LLhN z+IbAA2t4+}XE3jqq~4I(Wsc|f_z}INd%1`%I3NN@{h~kC! zHQ{b3NuowRdrTc6%Ky+$RPvZpzY2;}5%PM;I#OHGa;MBQfS-kVq zU_BF*_~@Pj8o4Z;w__PjEddYV96GO-_?r{zmxoL-b?D<)mlf;Ktt$W2-iRC%SWMQO z*P#~kjX=y>^w*DN6TwoI_DO52>&v~Zzf%1E*j)55*;>T>FndZS>5X<|K~K~e=PhbZ zbhL@#g+}Ea!%IR2<1283+&8kI$AO5o{JK6&t1)()H0NhXLH?f}3+Uj2VY!ejX9|Cf zba5iD5Xt!8hMcYqix*??lCPUxrQ5l7JB(J8+JgG;()KYtupN~M|6@_Sn&|Ic zF1KAKJTM~(M*xkCTNX)mKl0!W*>8hH!$YyE4XDsFBu<6m;Lo@}KAEf%rVgV=jmH1KJj z^@`2RmY$G(#bIBc~%y#Vbp~t@X_#g2V&O8=F-3sx!KVcJ~?a z+Z*=Qe>R|?w}I{RL?M=vGFC9YGYUm%*zFGgw62xxlN;5|tJBp`j_66Bu5=!e#hz`z z>@${peqYN^0a%)LSSDSGv7P-*M<@@0zQZv>p;SxO0fFYhwO*pl*aki59^wQNPt&>V{U}i|P0WdFsxn~y~ zu(3&#$cFj@N>LDuIJ+x25H%!T=il|pg$fl5Oatui_@n)P7?XeZYWqUYc~1om6!En+U1Cf>M`2Py?~9Gr(aOnu zk)g<(jX0@ULp4Q&10)lVx=`BZ3^Kx}uN`;pK0q~gyw|CI6tsD}f;!HBd7LipqpSBB zq@(vqOK!Oj#t~EU+GBu(bNF;{s!Am}>?e1LVU^nvbv$dd-AJ)f{W)ewcigbkG;M%Q zug-hW7q#V{LQenhI&UWP^olCE+0F5~4M_WuR_cz6a`e-qk$5TVXk7MW zIXqHNsIiWmyv8Yw%S0(^sej3t*3pv#JRmL*JNi#=w9`qe^X_sU)OyOi5u(||@j zF$NJrl>qe$x@p1(|259iNQCc5Gne*Vf=6(H0j#RG%PU5mQ)mh2Od_uDpT+nt(8aheb_>L<8O;CWSF6 zR+Vkirn8|LuMr?Z3hTQzX<`B(WFuPSLFOMZ;^t1Lu*MM_5T11yWUAm`%9*Wp91<;i znwxyLHz5cC5>BUJO?I40_yB$W8WFY%pDgtrgEhhKDm2~{DWxbc^w)T)rH7T{Q3$aQoyky;W5P<0>~?CXEb=x zxs~(rPq&k?Hrp>$99UpxG+IW=$>ne|M>!wA6}8m5z8}A0Z?5&Pnr&hYYrM+J47o0j zrvq`V6py!bh%^137aNs775Mc~VgS_@WPG$%iJekuuU#H{C*lGF{+yBUzmqS{$WKe<8##F zB!%krlefC1v5a~RtQjx$!-uuX7nH?(_dhn6&i``c)s#B!;aG1DxG|DhIvTTexHIpo z*%ax0h@EUA={xS%4BjHP{2_O97F}Ofe1+|pFD7jF^NAimw}!gUw%8GJv|wGu;={OE z$n_PhPsURDbcy(=Kbg<&Bu{1yjvbD!!+8p4z3_i6Hy}HO zax$9-^@-?$1PL)~L?vessd*u>laVt1N0#j>Nset^ek&WouJE#9#v4C$=<*J*9(TB0 z{U~=%y6eCzQNDw@*b^4YF;N%E>(e6UvJ7ljLTbzJEcP@=wZke1^fiVxhfOacH$rOn zg>}+5)o3LEZ&~n`|M%!h9IOiC)5ox%GnS;iu63yh({m^@XonRO=pUE;Wy3g!wiM;`$Nj)4beSec%1I*5&?U&nS;@yQGNY55aa=IHCTwmIbL`BKuJx zUCAq87sQ3IJ2}n~qLnxHo@$yujY5QSm_0ETBY`ecwZjx=JHc{l`b`SQfO|P$!lR(r z{hD=ovwPG)(|PFPe2#Z{b-KH~HhMM6CSxV~5}jh?IPVJd z+mbYS+x(7>_3eg}!bh{yLn1N(>d98q%$MU&D}k( z^;NBIk4NtsLaq-87NHe{vO9yP6z@;!^H+6iY)z_s51h94ZQ=TB%hru%PWK{ZMG<#? zimqfy@p?Q(yCyh2wX{h~(z(g|wc2S$R9_C62GkW0)VRaJ*I8+IH?l$#!#+(Q3;J!rnzPDY4oS5Fv~(wun1!-wspoE_ z>wUq2R~W$80^5-+DEB)ARz(7~)nm&7?Yk7KmP4Y>(5M?4zXuenw!w(WhZL)-L!$Xl zkZHi4^OHQX5AamT1P43{D6B*9a$%RN3VaTraByG4$sBm(`Sy&r`FpjoqtA{_TeOn3 z*scy)=Ldrj-WR!u)pN1EJ$Jo{5*`a0w?kX7ic+BI8SY`v><~vO(?*Jq%v)@^(neAr z2<3=Dr|_$Xk9vg(^?1FOL1p*ZFz8FBXDfqaER^ zvyQ3>k4onPZahz#p~<-ohgNcuSW8GUQZy7{`n{25!BafaN-g#Um;i|AO=V-Wp!o zIh~6W=P`U+I3W_b@u}HQu?Pd#(9TshaXMYd9u46-FsmWlzIl3zl&d_c966!#L2?;o zMK>Wa~AGhuZ$`;ME# zWt2IvTiI0#EUQ%%l$1pS;C@^y&<-42M<~zMVYUg{E_f;X^U1=XSwIzTm0{bvLjMY@ zY9ITKCclfRh!;sbCgs8h_BR*!($9$R;pwhwq`No-kYIdD54bK+I9bp2KVQTa!rbbm zr;IBze!aHxfIpMGH@3+)vSHh?`#Z$mp6{_T613BpGuK+4sjROpW3!$fnr(*>VF$n_ ziYC0t35UpRAIF!|j_c|98T{@omm##H=6wLP<& zs+3r;LG}6(>HBk@>=rm`fYKhF>@VA$&eT1D3Qyg~^oNC35$Qp-F0_k1OJ1Em{*R6+XU0*W%My7dNjG1ppv&a#umZDD z<>1*=55|%iu$@t^KS_L@L#LSpfqrw47t>KV=?K=3*a)lAnH#{2(}Z#~7~&VTHQ+Or zs9mYitCmFhxo|G_I6FG#KFO$%?B%kr25kCsd)K`g`Dp>Zj5IHLLMUWE$vSRwKp*R) zOuks9XRm2{q#S{WctGqU*R__DMb+)M17?A1$ON&&&cOg18A^R8T|dPmA;xFlPBM_e62r5*cR3 zc}z;-8$K;#lzU#Rs^O!v&zdHrq*(bh4d*usa$_I*G>##X+#xc0S413q^3^>G>$qS9mfTnb`H<)d zfDyeAS(TVo*NA`ftYT0{J#d@_zxfEQdOixf=m_1FY{#}FJSHU)kZ z^j#*gNs|IBbs&T*1YZt`9?+yTUQlKU_{|%Sk?pRD)^!kU!2#=dA&u@wE2k~!+TvBx zJXeO-&D;jNa0-!av`lAjq#<66+a4KA-5WL5wRCk+PU}R1EOouAT zi_c5mn4X~@_V{l3KzNhaPPjKS{Ej^wFMZNSHZr7AN0+(>Z54(H8CT#dt;%3rL20?7 zy51j|l|s#|pYvq-9#CXX6zFuA^KO*F5fN8i9@^jaxGd+s1{L#KCw|&#PJMH7x;kz( zbscnP+Wg}ygIj&M(%L#kEnXZwJd5payHyQp@2Fvaj(afr&@m)WJNEEUSIG4!_8OSpbjFu^- z44{u_Y!(=C%eYru9X$!dDLwqTu=UYl9MAJQi@^s&C&P7sQ_+|22cYqBlb=llUW<668B1FBLD#D@x@4*Zk z;kmEo74ljOyDC=;LiaR!Yn5E#tWQ6)2FYT*F`}YzLgF6Qfls~T+}9SOf~z;?E|!|A z#q;m~p;|$4P5l}&57@b8*0AJR25_F;fiA~~a^%~o;-}zYKo!eDkvk%D*3rE!X4@5! zI>8@{ltVdm1h_=2_{K>%bkwF{5EYKGf{*0ehe!+4IDmXpDy82|ll*G>DtRQh#H(IT zY+d>SSgmPZpTlf%H+HTJtGf^53UrgzC&a=VfX(VllAd}OzzhTqnjj&UKFMBaI{S}rpd!!0+uE7le{ zmbb-KRFiz1?!k1B4yI4wbT-M@v9KrVIjJvQ1ye>Oy??fQ;37t|pZUiVfI z#{y7Tq@<0ATsS!*lVP$sjo<&wwWO^7aBWERCJ7_*0N*A}6YzZQM+yWo<3>&#S98H5 z5YZ=cNMo8T1eRrgnWgQJXn3wonn7NrHef7xXV&EVq5QM!dMh(4O z{nr;lod(q9TeA%!3?oMCg_s&-ai6_4rQC}~=#A3B><-_TXqe%H5s)P%o18A*70uYa z!!2ybLr0q&Jt_N~?-RAqp)xKj!+?@jVE_twUna_miuHyN0G7V}GKY*m%T_0QdW?R% z4hj;*^r>37l#_xOcyr!^)y{`3KE&F0lJb;LR5}#A2Y?pg5`%0A8^0BG+@@vu(*;*r z|A%qe?_*bWICpHg#L61MQs9s{W=3Y>#NcIIp9X3YBAGldw5)d|Z_Az{Ng;}I?o+Z@1R8_^J%4H4&(`dm)vIc}mt|zg?P$Kt?WCJsIv&1haAE(F_YJkrFLxSlh^i93o>&oBNg10&B># zXGsw-58i4o&T9=}Sz{2ePg7`zoz71sH~PdzJdMXte`0)=W=b+T zp-RS0UvfD*Zat8k7HYdrU-J0_^ z_gfQzD2<9^AQz~5$ck6airwCJSZwk|B9(qrHN01)9VTl$i2{XSwZnkGLP~|ktDEbS zP>yMalFyK>sp?D)PwsY@5P?3zPBnsN*1p>&+*GAwE)gXKGCu&o$AYdYr23Hy-#O#K`$Bm z(V1wJ4wT`q(4@u5+B+El6+y*EXX1zkbcYMgnh8p%km{nwvPZKMN zn6sc31+6fSRrvYot?%QQ4INjxzHkz^ne2vPQ&{5y{b=YWK9uqqP0_-mSaq;TyXv%; z$=9TvC6Te=u0Go9Ed60f%4wi0WH)Nq9hb`Sye~NDk)A+2 zVq=15jQ@xG_T}dbV|bCqN_mPSX) z-hk^%fl945*Ti|oou+$^ZXdm)Qn}wzZyZ$8tV(0W1PY*rb)-jsNd#i&97I4q8;3OP zvk1$z#h}mN8^-&0(BhhU3KBj)Yb_9Gawq;Wnge#=Pdo+UqrWo!wcn~Hywqn^gMZ*^ zvKGwmYuoqo^w^2w5lN|^zH5&(;{0hXbh*@>X@>jOyokO}--qzd_}Ayf3CSJ&<&|&t zy6kx4m&uqpOmNgpw83>xK+;17g{_hX)h>|Y^^j=kaxUUYAoh2(u5Sj%(Q}O{R^wME z?@eMP#5W5r{SQF-il z{>cmMgsspGV~wT|w@<96IVmCoksioAoPR4|eaP;P2Wkhyb@L&QXCt+Rdn~%g6AjpP z)SlJ7IAlkU|Cn63^h&3-22GPuB4Z}n6zr`7s&+jn)boK^c~IVQoqhyfiDN(%^1Se> zNKDhPPSH-W;lrp@VUb$3M!X{2`j zH-nXe#%SWQS1UGm$iy_&-j~u-PWNw3t<8SwEOWEEF>=z9C~GV-ea_7E$#G+%h<(De zNMEew^^K#KhI@*j)^g!^>i=fl9YXy)1jBYP{fy1zq!X`^PyhhTKW!)Dn}S8tif1_V2}I-= z=GXz?U5nD?&m3BZUTR^d5g@2q#9}#=cCupA3!)`Q-`qqlO}s zT%JWp4A%IW8mSEbFi=y`Zm(pL(FU_A|7PG6V@bqB)Ww13mkSP~T+T&AVkl+lH#PLXGZUtxxxruD!``lU zWgVo?$bcAX2<6OeXbcvNM|N8&1+0vvytRLV7{m>w3?jnp^rEBcr22L6)0-*A3QZ#R zR%P7c=e+$yyuJ7f{0GQUQmgtc1+06%0jO@&Y+94W8WA%zKA_XAI zUupdV5p_RrwDB#9pa29{`UKfWyHS!UaF2pDu|hDBr{xXe>>S4u=Gb7PWs}C31%0kQ zENcG7=h_?S#fiK(in^O()$ioWsK~VC`X*ua#d960;~yM|k;}R3h2SKIUW-I7BYE}Y z-Eek8L9x21U#~3@hgz@a|B)`+-qFZiiyUpm%Q{1=I*K%{+Uum2>s#i3QGI@6=NqxqWO|RitJtcM^IaaeT zH}0s!eM7O*Bm0`wbNkg4QL>Po;5aw)V3YHFs>4oz*pHSQiS_1-IHWh9?|sb; zp+rr!H^SoLN90Ph7NfpfLN+-fHSs3JlGmb@!`DL!o)neCdP52|k12~6k|nP&mr<9kcTF^s09q!!fdn ztP2T_k0?NI?mu8ppto#!zbUWLtBMB~8v%32w^n*@^0}W7YbJNTy%FBsNE2JBr`zIk zzs2|0i&$LY#)XE#7`Kqm-L=ANPew$t9j;DGOoBkiLx>>cO4zd`E|(^^ zjrMJR&&}5aaR2xi-VF0dV%a6XZ}n7-dr?_W^{n@TY)zdS-pbp@J3q-xzf`IA@@H4a z-}y|?mOO0CG8@`jkQ5wb-&$!aUCKZ{&%!8Ygb!|NsFJ(q*sa(-#XR`c=6ynx)6Vw} zVBqz)VaDti6zPm1oAtdryoT@jGikH;d}?QhLhq@(6$Avo;}*FX9C(n>I?yY5?2X>j&d5fEqb zaGXlQakhAVv16TC;A=i-KT}_2ceLBa;-5!cD~HCk5HDNX@w3YmP$}t5yBD}on_?Cc zeB#!Ei#=%7=g)wM9n8wI$=JH9j~<}qXqES8Tp$1d5vZz7$Z2J*dc0tyYMtET6_-Kd zd&C!Cr?%c+J91GxR}Rn4H6C*b1|mMHU-+@bhtnfl5cdYUE{_GWMGV_7DuFeW4^MHEv#XJq+TN3|MI_p05g@ zD8x5CN4bGBAN8(I(>9wlowcRr(eh<@bC{TI+VLkT8+E@Qw|{e$L8hjfZbp7&dUBZ7 zI2(Ut@aPOw+HqA$2-q5w8_jooYEv`&xf>2Hgd$=yPIAv3rf)k**BP~ z3_^I<$RnTn%$fz@#vax(E@SH_r%ErM~@nB^*z`}9{1k9{7KWlP+dDvpNsn|vYU{8o)zDF6?B zG--W3#1ZnOG@|+!tVOQ$P4|G&8Wl>#!Ri)td#WlN_Hd&e{3&VLIl!RlYz6<8N)X+( zsUv1^g{p8;w-CfzHRnu~R&lv!q8<=JR`L~bcc14noBp#E*5STJ5eXM3sjEn-6In_j zptCZ`Q~>sF7#tC4KJRG|X5V5enqTT3D)W`?Y$g#uR`*2uL38HrngI!rRDd1u4E)AU z)b$NWP~^mxp~8y<9Hd4pQSxVTCC05uq^yE>6hG}~;HV(f6kM9@V_Q}FbTo3ekkLgu zF`zz!2=a)CqqW(&i$R$@?)KA>JR=dE^k&B1hfzBdJPWz}NB)gXEA1{(;|#rECr|}K zw+V-Q+^P0JqgbQ5IM+L0W4myRQn*UIZxD< zu9wovrZpe6`_-y0IBYnK7eSsRB^9`79A_tUe^rbGP8lqHDogSxErnd(xuz|~T(#7d z-=Mo}(STb|&6#C{xrC$Fq^G=UT#RkC%gZt*vfpqC)blDmu6*g!k=K`#^u(pc4YM1U zMm0|`E%5=otevq4{$L|5K^#t75wq8CShDB|KtueW=Tz)DJ0~}r+e#}cPF^y{8`PEld2*t&IWx7C;iB&9wzvi>@m4)1Z$vb8~=h_2| zV#>+t#Fg}vhN5ccAKP<@kxRATojwZ)sZ0_gQ^3v#ho3)!;*ZrG@(tCY-(?de`g`Ov zuCnkk=$$Glc~a-5b-Sahl&Y(PCGZMOC_UNuJegm`y>MKd@TbGs5G=6VFv^&)c7By7 zO?eG3G_K(<|295co-EYZlpTj-?@#h(ERJuepzHf*;(Ho`P4~cT8d5Zap(phl24c1(A|;5bg0HRpsWb|mo%TmJWIF2R8v zPKtbb;@Ae57R>Nm-+tdUMX#jlqh+$|m7)nXBJm1}S)!uiYqm*t3zXpMsMx#NjDddRUI` zNY}SMTGn}K!Fjn^A+jrAtXE>JuT04o-|Z6H@g4@HaOv7eLx8fM;7+@DbV0Z*6e>uO zJ5gJSb)1e6)Bcp@tVmP$A%(J6MKugot$>eUN%m#q$J_w&kKh1#->hgJ%K~W%gJriF zRI;Qj&&m?Td;_INaN;$c2ni?CtGn9*~gCg1KpJr?P?O5;rbzG-_@usKCYF5MN| znT4fee>^v{KpnLA+( z>JvS&0{0es?&pbXN@%QnDLhJV8H$%K94&fXOGH^<&V0SHy*ujn^~hQ?y$YW3K8eGr zw=mC4mfsZ?#uNO|BHwg*!aj)ME`fg3L6Kwgk5|Mg4s}JgJIjlE{dY6beaTt1wjP zgqhykdih0bLm`whzD|s4ypT!YM`QE~8;Dz5?Kj3TDhQ-w@p5XHhuTdPrKbpZM_n0u z?KqgVm|P6^r&yeCNPeoYn=7lc;;+n1FlHPqd3r_^6>>n*7vd#}w|Dyd1j-lPBgvsv z@&@V4_~Un4kMB!U;U^t~z0BUf)5XiVg5Hw=Kto6t^xT|x#A0}sG*aN6;J|$VX24tF zwM1}i1m8x8^O+yI^IsVZs%~6QRshkIy!^!u0AwgHT)R@SD&dD@LB(gH=MZaEvZyv` z$jedD10Z6}8-9yzj1Z)$D%79?achQ+@f0D_$O;z0f$!a!GEp>d5w@W5gGG6u3J{ad z0I<<-UQ|~?8Y1C#K9-cBL_#qX3NO{$mF1XV8u&p znNoFX@%*EbG8n#*yV3`DkRrL@uJXI^*-{j-R#|BnNWWLG(l6l?DMc-=s;_69CU#Nb z#?otG7(Q~LCUORvUcb=5sCbK=9l6+<>GHkP*l83~++$7U+O6Xj2fe)rs(}=G>}kc$ zpxX>TcQoi&AsdKDr#z9ox1L#5O_h=&n!H8?z&y`|%5DZfOm>OteyY7vr9;-0Z&eCf z&?Hw$l5{UJ_ljf$qpI;(yiDpHi}(l9x-f>(64ivt;|?) zGAn#?x4->hqO_%cBdQg%%65#MxipLyP96?69O=DwoIdOiG}H9rOU8VmQb)DW4ggNPatN`eg-6zw#}v;Q{sg9+ae2&{dF~z8!4cr#-ws^xoSjB)9+_{EwSw%e6Has5`^#n@Ij8RBLPAE)FFh&%{z8M=TUBLszxjtZ(B zUY+mBnvJyWu6brYmscUt5A{~G+TCds z*18{O%O&;#5x=P&l&GBx=mp1^Spd1<0FZ?t0xW0t79W5n@`Rc;=V<|G@QrmaeD@{) zUE8ux9WO|G3`SGJG`3rw(Ob7Q46z(ReZ?nd%otW7t4@4 z8bOX!+rhWIIj;scQSvW6uCf_UvfEu)qp{R%^7~>6X*LQUsqpL>w>EJaoznDKJy;tV zQiz@GvyE^m-d~p5_%UAgGV|}Ll5eoUD<1dSIjm0gTcrR+1U{^8e`#(q=d|($t5ELd zT3X$x<>oMcE2^ihas?b$CiL{JPD6V*S$c|{`+m#UflM(=aqiyxJ_1S1-d$15y@5XL zh8`TMd6n_fiO|ZFI>{sIO&<`;hz)Q2HN;k}yB5M;o4G zI7yZ!txKsPvtx!EITTnLl~RoiGnL>Ih+_cgs{0FWEyYkf3tQnI-p(M zqtCIERHv3A0UsjbNm18AU<2E=)kwXrX2Y2c(fE>-e%JGEYmH>2PLru=6{mWlnk{Rz z*Wfrr$d&v8d%2o3-c~TVy9x{tfC?Z0ZTGWWGEMj=Nl4Ympg=Pzm&s_Y{nS7YG}kuE zf77dBa7X6U)bI3rNK{iofw2ORsrwj9r#mn)ar5PObDxJj*2UYw4MkCdZn`b~XX?f0 zP#6*NSFBV&RyC)J#H)(g6{!^VM`YWiGLa$gzr8)uy3dHAXRo~-gs?-#*5@FM{-n=~M6 zF=@$n^hDcC3R0!&7+bGbX)`_{icMPC*{cw2u|9h`7kB1!UMYr<@x=3CR*Tl?u#JLo z!awVaS7~}~PWpXW|FK7YH0|s{c^1i;p*E8Cy9aG?9*3+@GR4(8;@pP)nQ9V7ef0QzeaGB(0Aw4Mmb4NUCCtF2=e+hVwNG=?VIuh>CE2g1928!BW7)bXS!SQoE{(1*U$jKCj zg2Y|(#36h_V|8a%BjqvWA9KLr@esZv?QARcBdkQrh(iVkri&DvJpOL~D(8*o#AtAR z2)pk9<|3O>q8o$jt7r&02#(B1jCM=8Ij7<=x~u99>bXtKF_H2yu#5Nf1aj#un@q_+ zpM)Q>!cXx)b9aCQY<>4s;W3_7|JjgDZ{im(gh)ZnM`ik^d`+20$U(J~kA^SAejFy+ z;FAk}pXM3-a~@lXc_<5VC$)9+>+zjXj#b8zMuDnqh-$~->4Sg%7XXf7#eBMBf!=z3 z;>6^-q+a_(R1Nihb>GK_KaG{G;(dYq<{7`P@8RQ%-49n1w3KD^`JHbA&b?@P6Uqv_ zVv6g<@`*W;wFg;M;&R8SQbRx>OM-=4)tXx#SPJGR>gu9wz2*2Mm8(TTq&hq#cF$#v z&%&B}Cmx{1*$(Kyj|MoWvyFCI^p3n6qHRI_Ta=R4;a}Vd+TWwSz5nUCiIJ_$_pR*N zkkNHo{UYXh&SBHyBtxM9m|`%zkFDEqHKAa09aa?Dc>=GGKgmhn{D^+hF~u8{hzTtZXm_;3HuObe9VTNDB@~Gy%SlO@9V}8<+wCW`ViK$iwo! zj}aq)WJs2(z_c%7a>4!}9$!4 z0oxQ3lIXK~>p_+gK9KOpNL;FhsvX5@Q9%yf)`LgSl&b8;^e$q#@u{bZpO;>1ae?+D zkL{ZJ3iS?VF$6X)R`-`xRrl7N!~V8AV$PCJ>?nKktr8`bb=AA$(lO;Wu1@&w2EC`CwTgOta^ zti#SG?hay^4`O!B3V+yB{n?bO!7vtrhrctKlg1C(3R!#k(>ilay-L43BQaJLPaHxj zfZH`s4OUaVO)MUA9h@96xNgI*j~V!G!`4!A4N>2TD$KrAULjm8ulMS7Ek6pQV$BlqiDbcn zvz}1BMIXu6o$#ys1q&x+U|oI=U!$es5c%rQ=}%0qAg5Ayz*QmuP`ZnuX{mVyWB8l- zVb4hnIuJtPh~jPS_YCi!^`zI7egBWW_l|06?e>Kgu>c|>7CIgoL};d!P5b_k8y~$NT+v$9TtZWGrN@mFJny z>~sDmO9dVGOL{_Tg+wdbfLuM$(kqzqetBGbq zM6G*q)Aq4ZiGyT(t9pd9#~cIzMM8=jsp}#Xd5z!Q)cd$tY*yiS-iTaUZmY93Z`e3g zE0a3{1YCD+>bnd=@_^dx&-sluARwySK8(aqV^~T|@{kUtak9M0-M3Pud?wrwF{=YT z$b!Qo9{__?wcO8;yWOQ-z#qI{9tU(wmD`5nQ>de_dKf3}m^3n@QE#nZ&nble$Vg=Jm5aOw&m zt8@xdTtz5m>(e1Y#lPUMvFcgI;&y3d05U=)>ggna8xFU7FH)Uh&z@ zHCplvpVjs9Y0^<^yc=tj(eP@|{HLYrZ_GY{REt+fIDw?1ow*3fTs38G2@*#hxr2SiZ(lm zZyM)O#xFcnEcrqqUo>}0@K2~wxaebUc?zg<>Ak?f?C0BKC%IPMf`W1Q#sGMM*K(wh zv|*GR=^p0CmnVCuG@w(xDri%C_zSOEt2WV}VA09eJZq`JwkV$a5_LYV6iVrZ z(iHT0MT#tf(KO^XW5R4Y3D!~-iFDJ|qBK2mF^!JunQ~iIu1(M5egeRU9ltVD>8kD+ zN^bt^8Vo1sVTg6-_7+pHt`{Wv!y5(u(@8p4yETrko!q2L(%yEH3x|Ptbf~nft;yi@ zYd`0Sf&{Voh>rEZ(=vyE4u-9<8w@j}ahF}G*YK-qNi$yM#)<~HRw_8KL6T$En6 zjC5b_`7$o3Zywe)X!jQKUJ_2>F>LIHXur3CgD&pYI5yvl7{@JUM~{#vTWL(!_~?iG z>h8@OxwN0gJwTS8ejqFK;Lu6Bfm>{&7Vm~!7u#Hwq@ZT1+sIQeIHStNS00RbcRkA%|uCF-JE;TP9`dh%^sg;Hz=Yg%QC=&q)7ZMQOS-wMwHD(=G6vus0jvejt`w#b{)n!oGz#eZ?ue6D z@73!u4ms{igX*o7S5cEg#;nTECh0QoGnN*zvSgUu*pbKr4Gv?_<8*rskLE{`iBXMv zdlJ{^#(Zz820fzY`*Ung$VV3D+_*ghBiHZ59%G(@NuRo$R#olN&_MSEkoaU1t#J)& zmm~)=E88h=K83$)_tl{l(LCe`EHwn;z?UnuQa~?0WIzH1!2ebUBy53vO5}B*M*3jv zfuc~C@{7X6N9PCt)O!jbXPS@R=A~V~2Rz5_Fe8CZwM3-KOcF8$iXOHma{H|&lSf4nS0-D5r3CTNxA)&w8~3}+4>td-m|f8P$@ zc5Ni>2SDaw5yKLzG=9cWL$U(hit6f&)H$gI@`U5bz(0E43Uw$(sSC`)c<$K)g)WkV zqMvze(3ej(5|X9cg#l&aHArP(kdPPkR|a^^ zDfUZbhOk|>yaHV#`P9Rp4(je1_<*94VdbDwUL-Az8{{t-t^av9hrgW9957x;;mR$$ z`I^#O740{YJBpr`^BW2a7*2Nv^(9lI5%79eT3DnsQ?N;(lxH4ixZwkJ1^!u&=sFUcWOsv-XNmJBN3%ZF5&9V?m1E|L?6s2d z!$)kEg(apyH;>JNz~20sp5;vsuJJkd@N8^JH>$r7s{>0-6f?PDHE&hrU?0jT$mDVi zw2m0A{^+#k!C3a)ena_Cm(AR%sCYZSw7I0I&HdB)5CjStG#G$rLW(1s@2p#-(p^K1 z_rA_3H`&Ms+j5q+KcG3PYxwoHj7wwM@?-s_<+NyZW1u-K@ZC#Nu%scG+7rgG$>$Mi zV?7>&k{$)N?3yE5PjWv}^KPel`KokX8AH`=gL!xRX1#Y_C<{V^9M#CcBSq}jFs89zcRhnd?81H)5{pV$&UnSr%Q%XR-8+! zs3hZR#k@|Mcq+G5?vLCkiSu(Dk=D9jvJ+B!P+lKNUGFEh@u~LUin9trqfiX!b<;3a z5$Vt*UNX8d5aEg?TU9cFUv^v7!$@X`?FF2k!+}%F zliAFa|1iPcT0%f>>L)%i@desAgpAkNwE~T{`ON|MX(&x&WU9T6znj5`+@^QWHMG{9 zehI$kupFsT zx$9RmRxwJ$-Ip#E_Bw!hX&+LBllNKyA2G)0TgCRgH#OU^EYfZbD1}IAwnfRKn8Bw* z0=i=7u4stU)2zVrj(XFb3BX-?U==Uw7*Ca!Ci%s!i6~MyS~m2RL+Q9I`nE_PBj6a> z&gN<96-7ORVWjv+ng@aXx4N+(nFJ0RFfyzPBdB6 z@k*ozJ@B3%X^5)v$IG4q^In?(YD!K-^Ig6j*4-{G`qA=xL8YEBIx(PEP7h9Y59r_p z&;n%d6_PJ?3%xB z>;tw@Amxx65#^`E`%+{i-1?wy`Nl>9N`A1gQtm26sM#m%i^98yh~)w9mxxN6*zl-O zGpu@n+2$VeHM&TP^7As1x-2;pA#ZEcku~B2#t{WTIqx`}9usoK%5_TTiudXytZ$#< zkn=OR^8M}7`FxHHyF3~ZP?L1;aj5oGY(X4pN0B zP$RwfD($ijxQ+<8{79Rj>}Akj<88`so=*lFXj^y&3`ltpuMkBqIr7c5`Nfku&*yY6 zHA!*~>E+JB_wv24&t1@MHU9i)bKjqyCD!Jtn{1cjlYgFQC0j@-MLdq9ak$eX)&8LU zTV`wmH}BK(M_sk;ve=wW5y9`g>2kBWNt4o+#PQd)$8cjEAX7%2(j*=b0M#E?_wY+^ zV4Q;M1V*iI=7T?m>o8>cwhu36jp(~hJmZDPPLCxegICs>+mq)WD8hc42W?i-8M>5t z{`_n3a8LRopC{xRlME z5uCdpIiQ+O&M*^Y4x^{ot)Bhmz3xw(BM_ArLW?TxGFJ9st3GVqlQz_9vzK!R+028B z@wMALbkV1n=7MKsmWf7te+@LS771CYb*ElJ-2ccee#H};(dNJ8nk5Mdk!SeCS+uQY zN~s^@VN{@1fuwqnxs?|&9FqLSG_Zt~k4GOp; z==kBQvQ0T+Tu*O$+||b?m~iMTnv0>{?J%{UjM;Il@vQx+?Kt1)Nw~GN|MTclD6Qe! z3eTTIp|sWsBuoCYBW|?brzux!yx_b!fGRNgTNOM}2!9&(Xqg_6F{?MUwpw;+FD?O2 z3F-FK9oqGdyOADDB7G@muLG`F-raWXx?oZ#0^nf)^N#rH_8lNbzYW7rs}9bqmX<)v zs>yP@ti1!5Vl7myBDtM}#h@(|NUC6pDQ4<(kCQt$i(|8tmv3ZL&Os9;MPs?kERS$R09T&(S$Z0jUog^r*gT3UDaS(?{Px zLEFPufn4Him?ndp_#LZx0Gr9Zznt&6bFES64JHgmh(O0R7P_xG#+trrtUo!$4tFY! z8{^#cjl?W14+@N3HWx}7*E8nWQE5R6C!$Bi`a4(EKyMin<2=6s=E1K%R|c3-~>4d$s1usa*i} zyJ+}L3flJSP(bJpJegs*d+W%mRz4BSv>i|2X628}WOa93?9*a&cJxUD*m~3NRxXXX z4B`RAP{aBwqG#w9OXQEl_fiyBRUo!k8QaG4$2SAPZ3Cc#c1{AvmI_TYY-DPu3ZJ_XHewR`8 zW2GybfY~lpox9Y8a2AL-;c5+N?o6YuxBgUjW%4SXGtO-XYCo*|GgVZhca>~x(PP~& zy(X9H8%qN#3lrI2DfKbtXY5VDxC4@7{OQA`hiCFb_c&hw=x4Hz+|ri=SSXr*2`nLk zffUB7KGTaW{YNH}Q-a*%e36Vsp-|h#Xarj@9-CjbtedG>L-g?(K+@Ry}BjNJ9G3Rf%;j2f7 z^;+D9d?WgtM(vC&Oml$-rZTRCr6GNJ0)0P_eTX!YP<>IL)0MeqMCXenPnXqwQM~?> z_4Cdf0`4d4^g(L&Pe`LH))vFQxDm)`IfQhuIt9AGjkL6|CwhE>;VXT+(&0wiV?dFqa|pc> zKOhnK>!I;oTH9XrF$rV80SQ6xuEVwbnE+wHG=6bwKgoAXeA_O0gO;N_=tIFuXROYw zmwt4X_k8hm;nsdfm_^Dsb@Peyz=Ah`2`PFSp={NzP+GJIGfTPT$2O-U>o%Ntdt;nkjBpvqa$$U%68KmfPYesh9aUmK)byzOl{!ly+(NXxZuVI5i|ay;k_k(z2z$lKu1+W2-glp#CbFiz zUrs37$t`X%(9PFm5T&2Y+1s3*_MXUpoM=fO3KA%^BzasosJ;iiQ6he^TNxn~-2Q<5 zzN7#0zCz7Uixu6}IiJkzM_P$|hoCD|9#b5^WDs7rUoqVRe2`~^`Xf0on_#-?r-Rih$?;r&pBH(5kQh_>hT_W( zcc@&O?4@lOg1^o4Cv1Pc0+Ec+awX zQR-_B3EhNqqsghQe|QR?;ub%0r=MkPYM}KEKf6u%wB6L#tD@;$G20T!f7iTE1^hS! zj3xkmYN@0~t8@5Ie(GB8$=wXpU?BHHL&h=oe~~`$ZEZOeVJ^|UJo@v^7`hp-qME?S zo%XWG=7c!OUj0}neakq9p{7sEfmo?|znOW$DGj6yNjl1Hw_G$XgYFhwc1yX$aN_e! zM_l7Ym8)3rQH;~;^7l5(KY=Pz(!-*5euh%saKollj{uJG1Wc+7rcAB9puL#RpW(9! zs>;>ui41{x$qjdJ-Li5=yoqUPKjdRax_tbV?Z&-rg6!dj*BuoAytu1lEc;9ZoZP zT8;?2av94ihrTQK4BKA~u>z94VGTezUPjT#0lzI5#p*D=zCgP!02on9h;f9?a{%|T zt+1SSA+jP)vaj=^RcuwG{5Wc~{ZnSza3!aR=GAv*c%c3knA~dgJ?*HAV?e@K?)~a* zGU*$SuG^W`1DLjJkyJK64sUm*trZ?_i<=3*PvG{6EX@sKNRnhVQklMK-P8M2xIXSFP&?7+R5aE-he-vW&$;n0YsnEAB{|!9mi~f=<8~eAz+vYu_ z_xM8C1d<$p9%+8$siZ~;Ka$tC&#Hs(QFZfJ_5H3!pKY;;{YHMZq-tjzzjIUfLB2ib zf!Y4}Oj2S{u`{TIg7LcZA;>P1SyK)wqM+XCOl{{|cU`t=>ChN(8o`?EnX*oTYQlf>{ zS)Z5=4nY%m{1>$B->Dmx)90G4oD$2ZaSDxlzw}k{EfErTn0=kiwPP_g)K5OPJ*fj5 ziIP9ltrvIJz8rpgaIJ=V`m~W_S>mWQuZl94Pf+B~c}T@3l35rVKp_Yz`npV8(9Z(x z&s^7s4FK5LbN5X9bhV^!J-eF8%svZB)GF+B=(t0iXtcOk7eGMsD{7VduwxTsvZRN1(SZ{E`4OO zi6i6c=qrDvrGbP>cSoqLN778{v*dyl`gh3{a2a_FyUDp?!9peVM{L zSSlW<8@xF1utrk;$o(K{vs#eYE#h)gyW)jeo1H?*RG%f+c`nAq^}PFuxIMh)*7Vl9 zA~|iCJ(%vta+0+UcN~qtqRHFpboyxI&>Y1Iwc<5vFebo`{Hgx6HNo znTy&p*B^x3ea`!s#g5o5qP^tqlT(pB4`dI3@u3|K7-*nDm;=CQr)lTk66yOq zAffibU|Hruqz54E!vhlB3d`^FVG0**QSq>PsaJrUvfHKE0{35IRU>I{zl$E3vBd-P zeI>-7EYAQ_yZ{^TnB}&nVH~i7dSIBYWcu)r*FRtNq#e^;iGbZ+{Y~IyZxLs{bB?d|nO_4sjr- zD*(D+W)lQ`4{B@R|NF#k)|*B|qqKTYWHL6Il+`n+F=FE91p7b!V>USNLc6PS^kqi>9c=znsgzpJR5sN!{!jFh+e%>A!s2KQ?l6kht~_n?K~u=IH;{tbd)u zZ+;S=pJL18zWV;PN- zd)xnaXa4Wg{ycN{Dauv1^{~AJvo$;_{|Ng z^8p9uF70^hH~HZUKu_MoO|MtKx#46J;J{YA$5{Wd#Q*l9tAa(-WvS*#RNw`VH2-m^q?~Vg(*O~QP(Oin zPJuw?il=Mpt`#qyZ$=a?i; zmWX)GtVQ<6Oy=XO0&EvC^g3@VQ{eYrnI;oB4{<_)I>x}(2*f7lYsj=N!HYy19-P;H zQ~sIHS9zf#h->aQEy9J1EXmj#zo+dK-Y5hEx1)Xb`F>NKCYk~2Xejvdh2Q*wtY%>G z1im@8|D$mIf4;P3=v;lBlmdSU_4nv=2&nh5`JeT_clS*LKfrvbo!z4e3U3U9?;(HJdTgFs54`?`-&_vy2|&(m4kr_zyCsJfO{_5;7uFUe$$zN0;g4dXnyg+e|gWp+Rg?*&Z6dUpWij! zhrnqi61Xq?-f}Jy;Q?~~oB970uL8^u!8Pyx$vg(PLp=HP1hyx)w}W4-VxM-f7!e=hBBGzC8^M@@~C+PXrl+sfP&n%T!?7#hV5LaMSZH zC7w`j(ee5@bZX$yBn*y9N6yTwu#3~wMJ7Zo4ka~tddzN{)l6Ce?U61pOq)63AgMR0 z=@7a%-He}Zp0zg4&Y6?hZNlyKM!E(pKi8|e4(Oh{+7^^0hGf2$^tb=iL!? z&I{|_FN<-ic`iqHG{dhY-ngj&;Wk+$ZPP>1{F8DNegLQyMa}n4fY!ArCN?`=x+l&b zjP0K8mB)5zxn$sXY)eN=oRThtu-!SHS(h7^S-41H_paQJMDAoT+IwC#W}7PG*ZZ{z zt7vEMY3G_f96G#1p0MBRKZnXVDK0Z>29D1uN_wxhY^>|M{28`?dLD6VmY6jYL^oM! zuj7%4n}PXG4QGsz`DBiG0KCSc?86~xq$3D#j*8UU>nV!kTxzVcM zkoncJH~-G80XQkAD4By!u?7BalP&Ee2Qy6Fc=1G@ke&Y=hr*i{88V*lqK+B()$~7= zKv9B%l!Wa5CoQLLuX|>%7h7g?db}oHhKXtgZs|ZE^QUWpN!z^sXj8jRNb^2j^I)Q2 z7?04e>|ktCu)U_l;`=o`GB~&*5O);PZMtnV?huX9Iy=!5)cq3@x z@;@I5r^V-<6d7Kjr*9PGLn7?rNuv*r(WSw&u7b$(*sw*4wBaD3)XD#i?T^xgA)h8x zIshbk{YS+a0Vh5WjP2An3i#U30T)a2ne*Mn)Ckl%!@94h70 zfq~vhmsZeFz)?k}v!>)KSWE#~UDN1{^T7r{*I!1GgJxIIO@R9*Uh9Nf>+PM#&(4b~ zF$H=W{tyNho2Yos;3Tj3R=;?%#@pJZ!PP{Wpwnfheso!<%wIJAmi>mZ$NTWty^BP`JTZtA*B}%` zIPHlc-~_cCT+10EXc1PlQk&0k%}7R1KRMXdgGW~xM&yp>{E^;uJz4=vRK3P?2Z=6E z&(4*MSQw+9oiRKuWA>ePZcGEZ*j098xd~~j+UKUtHH`FW#);adxheWosheZ7uFB@Y zM~huXHKB1?73x|CTl&p)#XtJrN&?tK`GziKiIiK`&$fK78;Un}0m3`OpvTP;C%g4L z+98)x%6PWCA~Aj1Q< z4%w1P$I`~B!JK+-jBjjgjxZ5A&wk+JY};6WCkWGghKFbesjX*494Am#3X9s5P_3tV zXiDR4i3U|~PS*oLz?x*guOL@1oxRy!Wpm;6Dz~|> z+l{{1KfS{cwsUj8Vtye^>u-ac{Kvu%Dy^COwLA$=Q$7ne7W?aP#SdLN384tEsPNhz zJ6i4!CZIHO50qPmv%t^43-NXuv@?FMb_W$8&>K3?bo#&5;yrDO=>U>9TNekr!~zu z1nP~TJpxomx$CNr;hNESo!;~lY|AAI9@nai_B5YBEIOOdQ)Eo`+>;#V2uC&IjjbTI zV490NAbx*Ck9FyJc*E#!>|~%-#6A7m?{`vPTj!Jk_P%PD(7lziwQ`1UKGP@AZ%amU z+M7IV1<|nWU1B;`FfNlH3*}LN(^5d(M1Yox%j1!mB@T3YW{oWmOe^$CUy_}Z_S;7y zK*@I0XB+Y^?UPIAdiG)We43|CS5&n8v^@};+0lL@4yJ8JcV@ie%vS*y}T5(G;LikIJzuv6P6L#mlCtQiz zRIe7g)uh|+2O%**u3-!15kwi3biSfK3AGgiW{DSZ16}GOQE}>G8t@i*o>L@K>KioX+we%BVskJa{#)@<*QsqFT>$cqRX-TA?T)T{Vcz;<- z0o66kf6M|%N&h^AGe0}&&AuU5i?!fjUT+|I=ew3{u~c+!%U!qT3F`6i`5;_zZ6mQ1 zn?hmEsW)h(B2wM!jbW~)Vg6U?;WvcIOuV6ZcZv(!ZIv@wW%z%_wy33>Zrlpct&JUpkX~W1h_-?(_a_*DZjj)-1dM0hU zTUqTYolU|sBg_^_(O)1Hr3?9kJJ@SjsRq6KcQbK@8 zV){Bc0evFQ&d0A=7~uoBgO#iE;5*$Lz%(qxJfJaxkJ~g9D-E6J6emkT z*KQ{B0*Q!be~*<|oTpT=3>fg5ev-#tEfc=YF06d>LQI1r((c{opCk z79NB_d5Wkqj3`2hy`gvch?(0Be4M+&vk3^4 zyR@GV)*rk+axcef?EDbD@AWHt(6k0T3oF@sYt{p90lbu*wQp@lTc_r@;l99jdDo4z z_>{La!onmE@CQlFGf|f2XXZ>E!c_bjXYqh*wJtUO(bY$qC91w`1y_-YcanaAtlidh z#7fw(zd84V(@$Q60xJNEpY>?Bt3fmn z67Pn5*VD%nyR?-IrOIv?Rb%k>0qe`BfM3*%-(%;$b#7pLLV-YUQi8($kwu<@%Rv+X zJ**yLCjV*A+Baf&?$$wWA7`SAYmEpdxni+OUx z{%AhhZMw`u`_ICgkHgdTG=i3sKyhK$?`1Cc z5Q5izf?&RT9+~ySlC$EdSlpY=uZJrRB+5uIWb5({r^qGgZl7zw|^N+)WcWkU3u z4ifO*gMmoEU*2VO3@ry-Th4pU>Ph#S<6x)h9>?eQI6c&2;KVn02sxFrZe?H=P`yBu z{&uSwKP)fWzpehs&0zg(nI!!TX}&}J!NvOLK~XrYRa{3Z5qyTMX+jrwXL8Hg{wRUW z9p=ui4!v%S-MrU){L}}NZ_O2AI4h28=oDNR#{lt<8?HXlV#+?p#8vx?x%MneV}tk( z*7fYj6%r=1a(~vU6D>*Jht6|r8^Zu0!|=U{qeAE2W?;Z#D(rMoClzOclI#5xEm_vp zX)|BC2>nSztA7#rkg3y`e;2ciApkd{*r9Euo*RtBo#-QvB|_^=%A$18Xd+ zqH0cSWTnPC7oE++OKA1SF8rEfeICGXq9yi6l!4qwm<~LX7F<_ zZ>H~|F3x-Foy&My(1}Vff6zWqf!Mm&xbd{NKghdFFn7;04ICxOw(27qLPVFaw%7QSc!ZwG@fd?bcNr`|eF+SZo(o(Oi|IzJzFhUy$Fl?1XO z)8{S0d|u`t)@MUq#lNlZV{pI2x%1sOAL67C1qg}0cug~Y7s3rN*sg9vK1KKTdBo_f z^m&d4`owB$7}Ysa)26N1#@{WsNTM}iKUj&O_ZoS=d+mcgcW0o}o;eB#*MdBUOQ}?d zq7Y)kdokYmGi0!|m^yr=u?f;|+_5GWGaQ?p<0;3xJ=O|^GH_>(Hj{xG6EcPcS#+*- z@OTTVzjB_6i%aqx+rg6;*QAs`Q?yi8tF7GO&B6xWLUnn;)cCf6Eyu1A=DE z)?EGkd6bHZ^{XMCCs*BUK`mUBuT|-oPJ1_!Z3B_akbxDAx!!$Oen#&q)lZ?yk?yHI zF4tVehR*0m^~*QQV(i1ipH9UhFoNr)Ij>j!A=RDWF72qEkzUErfYMN?TQh2M>^y#O zA*jin$A48~_Jut@7^jMu>sIGnOFZ_%0#&!y+js3IwK217Pc-0ed4D_z;Q zJ3rG2_2Iva*5z4YFVl^(etldw_{GPVgqlk{A8ublS35ir^qqvG@wMU*eS%gMER}r%LDMQ&I_#F(()#ffIR~BUosz+8=rQ;}G=-|Hu2{Sk8zQ z06tc8Tgp#|ls^BOnt*;YxFLr*Mh13M;Nj@H&9g@ZMaKNNbYuXmVKy-8DOVO@&6SXg zGed?S?x-|T5yui4=4KZTJ2X2kXGHtWn^8$L>!kepqIq8?S{5@2lgttRxnL?C?dZwH zoufvq&8dB67GeA;lNb6p|1e;BW3D?t3!%)aLetBZAeGNbH?}PsiG26AV47UxxWA-+ zZ%XDoF2Q7KtfZ!d?&>ZTfe#>ONkFhX8@fXLisLmu<`Q5JD(?S^XFARC?NFN=lyiC2 zLZ130YLEEW%o$(rp8t*<9gRtg37|N*LGQKK^0ahJOY)UiyYpUxup*=h`7K*s-P_>S zTdZgTrn$MHYS?41Oqk0}sw>TV%HH|Si^gZBn#nm0`qc@WE!unZVC{AlSTgY!=uXNF zHMY^azOJI6hVtHs^7Qi8iV_=1w<2PcoQA%QmRb!yTz>$n4_fVbv^rZFjNjfp1WjVH z!0z^pSovqsF;aHENGj%U21G!vheNvAG}Fn9aG>NV<<2-pLMvBCMgMAj4;&NjUg{%g!?29K+q7P#&b4Sui1(>2dUA+q8 zk1lsfPm*HhTupV;o?;eSTFHvyJCE}`X52ce(ti!VlugHOgXeRImvYmg;-k9)l3Fw` z1sR-yFWaTpDWS}lR>v8^UBIi_bE+_m=VwXuh|ctd$^*lU;VW_It-6sDRD^Y+UniI| zuHS@Al?&HDzptSb7nCpOik2*$kA5LViPwQ;d!^rErJk43R-)@5euc>elMIKjt;=|Q zMPt~zHBZv}>qxBm=F{nIOC0$F7RgYtf1HPc!ViIb))lSKJd_WK;31l&F+u>IY(&Q} zj&An$FRF+aTnSW@nG0#etO?8&@|(np*3_sR44`SB(B*Ga<|C9%*qGp73b~=BUd4`8 zvWo6cAf($XEFnbp2Fk9-GuJ6-5qN+ZgD0J)$z)_(ht(dC6GO}7#HY3VhT^9nqdaLD z4@v$&$ZchidcAw>SEQb*`pS@$bh9yzkpmvv+v~aC3-8=;=vvQuQ=A67{o0T2YKh-y zp?5{%LP6a<71HaQWf>l+fh&ql5s7!l4{xZ(yljkg;`tD=0?j#IsgGlnF_gRLAjxEJ zS3n0r960W$Sp@?*(b-u~uC=(cLxC>IUd)4zWbos0JP`PJW2HV?rOsD9?^6=5FuS=y zc^m{Az~?rf6dt*u`toAKJh@o*Ch~RRPB7SHIjqi7@~mI@b4M-box5}l26_i+&$YL} zZ{Q}vR7DAnMt@b6#}iG%>+)Mngt;`!+tn(GTZ;4 zFH$PC_oCN%&le&#v6J;lq}?V37KTF=Mla5s#MLiOMPVhR4Pwqz)GFY z)`>fVs^l-hXkT?(zwd2RQX_Q)Ck>(J&LZh)LR>a9ZVlBXcc&LYZ=VZ2es*A{y#*ca z(lb&I0hrk;-T!N}*V_cfDUu-hulT^p;InCp>mQBOKcq)J?hBVK-NV5N9x}mVM!8V}vb9M)$R0 zUwHcAhIP~i-DJG!xh{sqG)NIk){Z<*+N|%F;hv{n~S4UTBAUXx=X; z{<50vQDK((?l6z@j;101qcBd1u|`Ghhn>Fa_Z?-m4|J|3LBHMYKM7#dqPduLID_yA z?d~gA877nzd&-Tq{gk`=gjvUKZNI$ltXJBb%kGv_VpavZXeOPltIm==vdM8X#=cRg z2bag$3|~Gn>OVBMzg+?&>2oz=gowMk1ZQjeCUmr3Wt!2vB;XLlZpim&#!K}n;oF4@ z-J7GsN!GKv*GTvZ?=-Rt)Dunfoy>EJ2uH3ZlmtQ7_>^X$JPeWnx zyLp^m?%5H4n7Z<3<6S4qq0*%GB{guuS}bJ&m35rE{Z{BO*2~E2s~6+eI2!E)y-?xl zqG6#Dh)hrb*Rkj}I+xy4TWCNH?fp7AD#Of;BR$7(@tPO9FF_iQ>h>%dHa;rFzsbI3 zlE|FnnWGFliW{nqqb$^(&umFMl~<9~B=QydU^(T30Q7_Z$>n6IS);lZHZ1r!%=s$8 zNq+Yp`mCPVH`n>gb>$e)ErW!>9IL>C6kL~j$|OJ31^7MInTr$jdFE2{DzB^kyei}c zQO~V~1SRbQlPOQ3Z>_4?g4NvU(|Er+UNpFckL+}?NH@ky4qv>%_^H8 zDKS&*-8oMJqS!Et_Vvm*-CRZ>=5~pH)8bUaM+Uu~a1=Sg@r)PSsc=E1j4#9+%h2zY z!?z4(o&ndy4eeEGV@ph5eGfjU&nSO1%a~yC15CLMetsxKWTw((8`T)Vf1aL7ik?~r z1m9=k*?RQQQR3i+wwOkY@eb>GZZnwyC@@!e@U6UWxj{tZP~9V*ab@rJA6s(86K|8_Ejzr#VkNalsk|{@HP11IL4|<@?F)pT--vE{1Wtujv}wJWO2>)csyGz z7lZ52g+#Ms5)(uo`@10^=oe`MgWFMci_nHl+zB`q(fKfC4)pBJBp|h%@~{eZ75iWL z{u@acs+Ubjd!TIkTRHew9~Kk*%a=OqDClDrY_H21%VLoX>H#-L@zKD23bt9T8d z#6!aK{dOwb$Lh4kDn3Zl){9cEdfH9N=Kkd?$soPA#QaP^*sLM@)7m?^+-=JXrK}og z`Szg@xwnm^LAdVKWOD8#_6w}(Wq$oCh%pjnW!Oa3PIC3#4i`u~84nJ4vohyf5+aRf zx(p_Oq8N+eCNlkzlA%gJ?2z#{1z%_7AUs$Iy5z!^6#0{$Sr}5|&`wk+K=8 zqg-P7)gVz!dA>jGU5i9}f$fEIC+@RM4_6bS9@U!$$RItG&s+G`V5E-uIGsu2ZU>K- zA59T6r!zU$S^cIvLterlv;Vv9@_-=u;f%!R?QuhlN#0pO!V}gvLwF$Wis{;Sm1Fe! zytHLh-x%WSlf5&8KxxEuxhOlEY!$4iSFAmSNjTUWHYe6j{0bVG?`f$*X94UaU?mN< zn_H<5&DK&GKJH6$PFNpm(xotaCWlf#cf0BMzlrJRN6Pa_G7Dgc(49J)PY3;%^_eVO z6g)0LzC`NK5P<4<_B1!^<+xiGi9~_Tb8A3}P`VCMNXDA7RdziPa(T;MsGi&8)Up|W z0XTX{v3a8(GCmCCDxeILv^ji z{P{8vc11ptzmc;;msASN^T-k?JfNi}6-hr!n%ft3V(t%DudX$!KaXG45!fQ<lknj5MYjy??FVd*%G zIvlE>lL&@&IB*rJGVgtJ9tY|gd;|`8tV(^Mt|D8Ev(lF2+9*~}?oE7c~P3V+&QqwzRB^b4?1Cyv#K2)T6d;GL7pNvjn=%~{F$ zm7y62+kn%v)XE0^tIn`}naHQ0&*^^Va79~(FFBsCXu*0q?cEQ_+1P$bU-W)A6zSrb zT}_|X-jL&YpwgzX$9n>OwElIz96wi>e&D-jI+U0Ae0j_B&l1^TJSGusmUWbTShYQs z<1#sPcD7SMyk@cbNXM@4(OA7#7+YyLplMlx6>C*&hdd=TuJ#c#9Ojxp zgb|vIB-YBaziP96F)kGtWL=Y+0ld=ZZg`zjDy6DUX4>}XgB%dPIQeh}4SDP_0=b2#7VgtUl?CHo`&Fk^5D!75eU+J~{b#3IkYZvl(9MuXn?PzwABQtkH0hSyyl0Up77ft9ycbNO zS|EGtN0LYS$q(YK+!DSJkIkFf+FKWg#mdJx$CISzv3-F)@yxroEX3>(o9F!{^)9B2 zY3)8u^^4)=*1xW_f*QF9>_Fvt=NizgobGX-gV_6K9$hunNAO@tD3tinx^{M^D0kp_ zC_~>hb{Y^{qu3CNi~DxGmDRGo2g@js^qzWBi;fZ_#R;wbu)r z`VYK5JPW;J7OhMB;>s>}N5W%u+Dma;u{Zt3Rie>B`9A6D=|VivBn#3o&{S7>(5#if zhv*^hz=7(a81VO(q@NrU{7~TgWns_=nHZ(?v8DRNT?#2CbW_?R(iRFY33 zr1s2*_N%{td{lKudXj4YDBvt;ZIh;@ClTg-ZoSVy{9LI&EII>9-lLi+FRm6*7|r9( zE2+96Pn&Ea{rZGxRcSR&pq{BTBW~>3Q7eqH*{^d4{YFIWefdF|CO+{)EphG9>c#O2 z`6A`3MoBkRNG#~aB=c50fSi!_5u#dqu7GZ$`)GSz{kb7g&(J&h$dGY(pV!vYsqwbH zpPFP8uUQ^>**kUNA8RX8c3vBl?4Sv`zb;H3Nh1pLsr+;iawrBw4{O@YY*sh;NvKH=U4(`g|)DG6vsRYVCM$o5!-Y1n#p^FVI27xGe#)0M!O z8K5SqLT-wJy&}DE7Z{%ur`H>js4lyOA$PKzS<6A4+1z-A?8@%zs-UeO0cMIDz1yee zs>Xk8{>bRN2b9`A|j1|bQyF? zO8@p5yo&d8@8|mcJ?|gy_j%rbc+POn*?aBPYwfkySsf+eYe*()S6(L8BWa@(JZ&yo zZ+;|S^uy{Rd(x8Y+vibDQ`0F$p%GT+y`pGcgXF}N(8;yuw?7QjMuW8UE7>DCJ&XuKa+(|!xVCYG>mIYP&{{; zl#f~D`@)4|=RX`J&uqOarRS-}nnqc9kgq|LJ*`&yzWoqzX!=GLR1yL-7Y^O@9?w<9 zJYQ7Bh&zymd&VsLCS2=t<0maVoZiM;g&o)ZA4oiVbKHU3m9Uu*5Q> ztMgO><>|Rz4}+A$@Q9^KBJmr~Y@7PzGfUYgz+Rh$M;S}Y8hzut>&HVE^b;PHQ=N-T z457U#$#mZWWWxEwjvhSOFMg}4?y79ck(M?(_ z+a7h#rl@ms*vI;lu@#Q00_&A78=W=wXOC5HpRdKHdrU13ioT_b;_|$+->&t9dMR4X7ZCd*B>JhR$#m)Gr=H8=iHgsppNjuwA`t8Pn(VynL>DW z@%mYo#~+K5Y0nTS07v^;}s9=DH^x#l24-77jK6c}*Aac%TAnXd?X6v0!dKUT7wuk1hh9x8Mi zLn7g3_U`oB&-1?a7}|^6?A5y(^Frv`_1=x~5)9nId~*Ckm}8C{PEV9-#0?wR8cs_A z>MFd75U;F)*45*3HF=tzOT;+xrYxR8I5(w)NR;~|>_ah$x$wrsdZjUjxZb1P&REnx zTV19fmksK?R>$GB2K+AHguO(D{l$v0yl$n{ADiqd4DI5z#$0>K4=?LkCVcpER-R+k z1<}*UuK{c1Z;%reK$+x8x0{W+4aYk*v&W62iCl(`Ej&BO#{GEtkA=w9uFqw5_G~F( zL4`x2IIh*VoN49Ls(Jc(LYcspBy=i^=(SvY;;6z9L(Vqx0R9wlv$-D|qVAftcz$w9 zl;T#m=!ln~O^o_%9e?|JbJSKuf!10dR8U3Sn21ZW;8k$E?2o${Kt0R-Bo$Vb8fX%! zrX&9%qjsA9rf^D{=Bfr-W7U~$j@&cXUXzGhAZWF{+AB>{$3Iop6I+?ak7z~9 zA6lHY?0A$|u6BAu@kPd3=3$D@ye! zpzUl2dnZQRoGpueIi^dlzm!~DPj|pwwMVCU+@qeL21N#u7_!=rnSj~MA`~ruJbbI z`Bjf4pV+SLKI^z}2|snGZ%hYi4AAxM=cu$5ZOFaL*wy2Gvw1onXfZ#Vc^lGQGRL_-o$IdfrrZ|HN{#qaMb@Fp&dM zdBV*qyQLrnH9)ngO;j0CppVI`G@3A2;*lJmgNGnc4^cx?l(>ckEM9ptdMVVOUz`bKMbZ_OTBsbco(YX#sh~u#j>a(QJcQ#~Y$TAip%ti5T;*ZL2*?4i**Lic#Wv?;&N{0 zgcI_r))vX^8pflE!ZTuW*kyg}hhS>mmG(T$GjDX8lh2NRq+ym+M!}Y8%ksEgxUx&W71es6w@`73}u@5MeJ!$Fy6WNrNk+0QMgW&*)Pi{vD2;U zi`g|qdVzQgR8Yg`1B&>ShB~N8vac~B&vuo*Jzu`qWm*1s@OX=<82i1D0!5DF>Xc8U zl8;X%h$ZS?k9wV3Rp(r|R3t`?iTs<|B6E%b_f9jcLdtm(nrb?lH z&U)*({vdA)2oKub=+5(Ngr-JW(+!8W-3S}}L>psK++Kv*@&s;>C#=F|Fs-af+`c_n z+qLy6(fKv~*hHu%iA5{3;Si?p-Mf7;>YO95!`jR)Amw7HSn~uTIA0Wk@*v^2VHC z7zJ??nWqd0&wPV84F;8jYa~4H&cz0t^!@gtFwshADm3aoVKlQUw9~Mmyx|SXvImr> z^h6^@Paw>j6uG&%BXJ1cjpI!q8~8q08@;n#GN*4}r7L^k+l`ezd+clg35zEvNb2A6 zN~6Kdkdg>;6o#3{HY%ol166y;8x$ zSWPbT$$Fxk>yyPtDAb4DM+K64MmY(?mQFY1SB{K|VH)|TJrlwL!rD?c33=V6*PNav zwm-H5nY(gU^8r<@OC92dldFs6iPuK@hPGYxDGV}Km9Uw5lQ3mc*$K69|2L+Y4C@O4JHW+Gz8@-pii1jZ!fl#G;l$ZUe|EmEeZ?&- zG!wBO#^z-_t-Hm)3W%n>jFftDPGUs#7D&!l%(*I5y9^!b8g4pAibxIT@0E+W$kKi( zQjJhug8qmJIu`J;T}>KKIJsye%6_t0%cUpJ$g&$GYmSe(pkv;y^B=XCZE53+xSvIJ z>`AbNRcSrOAJ{@ilE%d&(JAqnisJEqtf#`yrd2J19k?B~EObLhiVrg%leE$C2r3G- z`gDDmc5^P~b1GS&I=^R6Z@E38LH3d09ihIjAQ zVm#4`Au%%yAWfua6M(Ws`DZIGM`zLyrFED^96S^AsEUEyuT^wv*>_;@31fxn4EY3? z=X{OJ;|aF#V4CGE_uCJ3ZeEgeu#;OZAHm2awflxIhHefmM3zjuZZ;CX_gj+n>ySv? z*#zFx!{zhI@aPXiNw$4x^2WDph)5)7-ol-AuZrF|?*jg8L#qhAVo}I@P?R&7A810k znh1bv7S*BXApU3d8cFLNqpuG6I&6&75Nod9kW-moT4xXxw{SEZJ0-2Q+&aD$%z;T$ zU@%$;i(1k*XBpDZd?ilkuh^xoE>lJ;G*dBGHK0|1(exx&pmpJ@W{J{-{B2sb>}DN3 zv~RQ9De+#SwDMuy+gH}P<3c?q6E7_DyCg1PII5ky8anbI%Zd&D_FwdkQ;_OpTVp@! zisxlr&BXb3I8O^vjK5W;->Phc<|{tz5;-4LofYmgZVM&)g6g%U|AeIO*G) z*-x2Ximi$;>(sR)x-0B_I-=HVSaq2Y6{0EUuwy9x5wF`qi|*h!1-kwE#J(6LQP@IU z#KDI#F)Zu}Wa~<1#zd$O*jqF5A0(~3uBz(w>=cPU*QwC`&>$QsmC_*=**v)=7&}}M zR(};GRMFEEt2h*ga?OE{k;{|th|LtWm!IsqKOn^F{q+m0WSL8|y=i*gbQBd^e1WQ5 zoxL1wacOE{i$q0b|3?v9*Uuf6v-t~0wxdVgd`Wv=l0aE^T_TWmpYpe%fwNEwFSTB( z$U>AZF0s*~)H4%JhczB1TJg)DN;i^_R)fl&`byLvv^X;Rv$un<6x#2&V%#@G$=eZ= z1xx3=>NOGz+WD7{PYgs}`0`Sn?;2(>HE-km1;v7#Z|ORqnnUKE=#9Lg{JA@w+;f)K zVifhY)k$fp(@QtA!2Y-EnFOw+M2=NZ@!qQ?aAqsV&LyiLW)!LgZx>mS%H6FWea1{;E;hyi%=7F1j7CQ#$piM1X$;PuiSmLL_ch+Mnd zJl82EreS?zh~#zIm5eU^%s0A~`xBcf5k*ftqqpE^yN-(9Sy?D+@v#ed&)42wo_qCV z(cm>q(oo`NZX`-gz5d3@5sYt()s5UcMFMo6Z__kCmhIXonen%a*qYu| z&xV|e=>mlzgpS5rPI8YP2hkq$7X{Mn1J9NazCoG*OLxX2J4jJ8A;TNqrk@itMWdnus z%-KB1%IB#oKd%kT61eRmH^EmCn#n_Bd89y1HbD_5m;Q>=YG-SemzUL3nf`{%2X+EG zl6YnMk(=r=iaGlQ`FpR)3`CB~4i`jWE;^M|h?jcwG)TOUiCnf$=wVCj%_K9b@LyjG z?Ged{xry<{I`OXh6J1EQ&zLDX-$7t*VGeyRuop)3tupvUvdhPq#IVeBwbucWVk0z9rCyuuD0W)A>*Ar_d!Ab z(rw$5;0%E?P0L&>RG&6GG;*c4KUiXYe8E!e9wPl^ytX`rv0Ry3UY^*kt<{NH!Rmc;Wn+m0*eMzp>8yg?=+Jz7=rHR z{WMX=)0i6)D=$N4ioVGQ(TMQ6Alji5Vy^PH1M{^rj`(YsG_iA(#j(9g82hz*ib z1?H~hTsI88=W&arQ0Q#RXPex)0xL!pRXw>idWnU1OmTxlV|f2Lozr1#W2kH`U}rsG zRBz5(+o?jb)UdE&bQ{UnK9H5OObTkzIcv3}9s=2_UoNrBzp9s4VkV!f6?5}!*9*~{ z4hLgivHB^4)yezI=fYCs`{Kf|&>6;ws)WqDe+2PhfPZwmN}yg!PR0H8VNvoIVnXAo zo6!Zjv?QWqEUOp8)7Segj&C*FXEMDTqkVOnDRx7bVIYY&aYw{T5;E(gwhvqB<3Xhm4+|sBorH!~CeKdgHRacDOxJPCZsbOTO zR4*{b9p>o$IqC)6>w^AW$9_&Ec_6p>WBXCa@ zgQC&V9qpEnRyQRf=e0cH?cshcSc<1mlHk*}&P7nJo3|x=hs^x=mU_K}i@1)_m=N!s z!|~2-a!Rw-?Ny;&%;d3-Ro)VHPNL$GsG%-bfTT3s1+g`QI>{FX)K@I?zv^cUulhvk=idsjggMnPHXmId-1j#9)g2GkH1%w}Kf z)Snx(@*V3En_I#6J^4&#!{B$+8XQG2f@Q`x=T~K(yV^3|FO@F!1a?&>u)fLOPNLze zZsyfvos0>%=l#N61lP-MF;E|f^kM1FQS^$A8?01*BIQ|=#xE{Z4FWUE3NEYGT(4`+ zlDZ?0m#X9tmnSmA2d6e>N{kCZy-~5y=d1~@iQ2h(HoY?Kv`;TI z9lnS;n`FA_ zc>DiwZ+~0>a!~1(jb`h-j(%| z(wbL~o%qZc^X>iE?_-G%nR^ev!&k6T?xA?>lzRBxf4eZ|Tq8B67LbIH#PRnX^AhJ!#1PkGO)Z z&%t83bw{GvkALy~8Ys{Ve4xd3k-}{AjdtZSOYZh}89~pAG(Z*FYC%eBM=j#GmD{_o z=1Y0PD}{~rzP&k3 z#Dg;}L4_rjFiz4`^;7pk&pBrZ>Crvg7`SY4iNsTW?jC=OH#R7v;I#Os!S&7(SIK5_ z>rs!Bk&f*Nl&WogTlkAR;~6KZiaHhMr@LVHi+gA07uBV5^)#(di3-k)S$%ClZt>BzMiCvYKWDAOu{Xm8(+bdf+ z+DxvYI$w5iuEWEvaX?TzT+TvJ2-Km%s z@6oFozGt3f4b6YW^kwhx1Z6IJablGHry+%aZexwGm$N!>Z0Wc*Ittf)4u%?hFtRl` zrWSlECGw0gFShoxpuy5?-nN*B0z!M1-7!I-{>C|yz%1F&?5?j+yOqZ*`B%HL19`%{ z=BQHRWwI{R+iwbw@ua}cIFz3=&(QI~swK3mv14``*cwP0n^6+&2lyI@*=ZBX0#ze7 z9;t6nyD3gMx7%yJESSF8;6BlaDsZFgm!}wHOo|V2UXtHGaI;;0WB}fm7R(sria0WL zE;>S{aByp^B8ie}GFTkb@GTC2vB>j;-^w>dpvFL)-%nJ8heNglD`Y2c8}e@=ctPb28k<8D>uP zuSpgXE$SQT%I-&$H}?CbhFecw&(QlL(IV0IF)kHW7PYxKCOL%OpW3_$?HV79lQ&fA z)mN8HY>uf`-=6Cru(0B!i&V#=Lfh2m!adXbSyv*DhG7HMD`P#MI$ys^Z!jz5r4h`% z+G@qR4)P;IGtYbMdj?&mu7VBSJ5Q(gx3t1b%rr zJ0I&PJ-N<*+I&JY*2Qaer~>2b7gC_?o1q|5G_;Vl*4)*X#l11|!3#*>fJ=U#~-Vodw$K}s)X%_|Ki7b$n>E}TA%MpowCWLFA{ z_;%ayli_Fm{hgV1?s>*t4X7?opTtK=2QuSL)15Af1)=smJiytX*Cvi>cRHv}Q71C4 zwA^GrXSucAydZL46Qtov>YgXk^HG#tb`E!rFVRnMM<75(L&`X~ zSSV+uLU49%d;p6jp*UvD*cB1@E_$ebFf(B?XQUAR)E69DwvugcB#zxu#|~xsHjsPT zhb=E2kDW4*(O0;%kUyp1ThaDBfiyA1`wNrURxqnE=g6trM75@cxai>l=*;HK1Fp<( zQ(NMBAx>#CoeiCN?fVPeP{jrcQ))VsBVZ%mANPzD^f}-hc^POC#*a(wy65QYL@$5G zrJfwa-c`}xZmAiCIvOm#(mnb}r}Dbn%XLwsu@v6{!&1+)(~BruaA;z_BN?SEOk$@{ z8*93{oyGn+!pE{>7FDRhFey|ne}VsnlniOp`AR|dzGJH%s0F)beHr$KtAy-%D+=tq zqlqjY4L*;dZIdfBR~emit!SG()7G<~Vh0Qw!SQi3eMO-8saVGnjuC=Zizna8e>XeFSMZ*FWBb7`jI#`yv$&_*<(@9 z_c`6Us>NPoCFv&+REp=#3bY}w2jBos4LpI%C zF4?yhQ9(}89V>R9R#BhlpmNOn>6{o{J7JBw1crgk8}BGSryMMi$WcsFePTozBgl+2 zs=EYhOjmmkxDpy^GgVR#}<+;%_&)Lb}hYRvV&5(OF`&^b0 ze|O{1#7I(sdKvYqzP)(8yA@8}OrFl^Q@B@L(DuV-@p_T5_;$fT#O1=k*WrH@pv=6) z1eTo^jr@>~Mq*vX+hp!;SCGx;t?g!w9r^T+rn(7d=<`VUEPA(uiWUS0#!Si8yOA7G z*5e7eHI?p))2o%NcfJWKL)MEon==ezWpl4oi+bdkY18=X3{2hr)cm4l`SfO0Hr=Z~ zfPQp%=|9!LY<#bI*)+HQP}G-xPFMr$u;kQ2!s5%2QjJ>vaPli7*91~}j`#JDPOL55G*yA8bGC8^Hjb*SI3IGADH$z4m%=K8j?^|$^Q95Payw~Q95z9tcLw0mIXQVb zEhYZ^gWgG4y#}AMB~rdPkZcD15$&iukL=?ovy^7AkW2P51Z@>2+dr)$KHL=qss%<; zT4mtKPZ(`@{o_%j9?iI<(EIGMYufn{WSQ%fqY0)U$<5*5Kg|1tO9zmi1(s84z!YfsCtO^>&t zfA#|SZxjcM0qw&UdR%ONUF6?S1fJ2o2Y}NW){FQ}*d9YUuh5oUv)}AhhvNW!7II)M zFMbyub3o9?-mdh=|4OHSSc3K`0MJo)?f>MBzhzt8X{i0&m%^#;Uzp$@1_#gNlLCOU zaD^Pd2@ka%*s?sGWLPWn&tvYTAW{od9O@G$YW;2pw0D5}sMn@N1%H$MvM&OFIOenE ze-oZ7Q2*Qi%f(?Y0{==EAOeEC3$H}bBNW|5R_%@_o~J;aRgq;B4u-Lh+s}jpPK?$k z=!z*5ci~sYBV|+`Cthoiz!SsFrvvjf9-VZq>%d%9dSA)ckFZ>YY9DWT6DIg3kKNsJpWFx>GJv5}I}VL+t2Rz4JU&abT=`iA z*1+U2jGQ!x8nY2=QzJYmdNrZ%xpsBr;s(EBttIHQlLCwnf1*pRBIuEMVC&q_n7yGR z)@5U5W~zWm>=a)HOrMA0O5UO$LODbV4Y5ly^?ZeqwL9iLEMe|*KdJ|9H#BK+BL&O1 zvfGZwLdv8eog0(~Q|0DxI9m+sGm&k<(FU8wnTzx@t1nj}5iq$(fXzGnS}zDkN8-G# z(yX;+8g$Gi5@$es?3E3Vaya;4$$!K452gbBrhuSh%fx^8c^;?%ON~{S-0$)+7B{*) zlm?A&@)8aTn6h{~2}J0?+gug6bfpHK;cvf)kjWjwT<;NaAz>m{fDPo8qpGVV&n-J| z;XSxsQXq8t#`>&MCM0m9TW@I<98d>C0c8P=-rTC?Zh0lD{tH~ua>&Cfn;nXy3h4lA zd~-0_6HjOD2V0(Q0u$zsdrM6Ge(>08S?^RQ*ez?(x{rwbp-^$RiEVn$NnVrTZqk{;h;`7EQj#t{-`ev zzg}#yUwHDXI>yP6K%E|x81TJJ6m^DQlZmvBK?mB6s1t8Hl}E;&RDY#Jk{>Q@Fyv{U-C#Od=1{$0QVSW(%Sa-L z`A_B8@DE$upVnLy7g_VuGzdif$|B8R4ea?IB8U3aAh*U7Mq~Iq%+fO!4aHSiO7Vx7{(3>J5BTJIlCkXX_6mOpgj`9{^2#r=@y`l^3k|%B8VPLh@Ae8m46Jip zbn_#C=o_(sOS-tL(-qc4mVN$tjz8T~Y88{kPxN6-rvcv9No;zHGRr<`<@Fj^lniv* zXRP2k$C|Ts%{J<2fP?;KuTsJSA3`d_%$#5Qv0HsVw99NJh{7Pi}&JwNhK4i&bU(e%wt3$TU8`mPE1 zbWId8V9xUy5}@^8B%J5GLQE*lFChJV_Qy+qUi>_R_b+G>~#{*k1c15QbO-s_;%SZ#I#zDRe8vUGlPG42BX z2;t9_<*UIml6=*}clAX3(bD~ASRXp`ceA1G|GGg|$^D%8~n z`V@h~@i~$U_;%Byn#0li58iO{g_OnwsV2be z(0G=nYbzmp);?W15RVsJBgD*W8fWf+5T*dPhTTNOVP>$~%UqTkgV1;;2arxJqSk?F z+<)=S(s?1Jkd9RYO{D=7jzT(NjSi1%q#Rr^RODf-3mCxRB@PYh?u=&&^eS_Ce~p>` zjxhP|kn1=XFM1ki8Z{vKqSyP5{<5~eeQOrH)tS(L5ZIwJkaO-VNKf{!Z?%Gh2iZDr zh5+J@T>?`b)204*TQsT+p6pNHrv=ptkr2nU^*s4^CN}8>0H$-_1Q|}Q2*5UJq5}ti zTHk-*Xs!g@Xqwn{B5-OB$xb@$`ymUhUoko8rE)7v5Z?v;I7hx!`~BI$=3kr&e_TXf zB`X}_2i?O2E`HXpZ>B)Jkv|WicKe8!6hN)|@E;|mSDZd&NPIA`#BOyu3Za!CIh|sI zlts?x!Rbf8LN(3h@abVv@0!vaL;&0i!eHTx14Az;ZSm3_sV?p{<{m6^U; z{pz+o?5KDNI1y{K>h@DBIrZf2!V_p|{9B_2dz=fAu`dO?E+L-p>&(rl+~|^S_fHg3TZI0ANz) zZo#pCWwBlD6{!SxrXb-~t%5&JlhAkj^GTsRPf+S*?=!-wF_0UCcLUy%7`Sh*efK7Q zuBMv}*{&j)S$7H8jD5%nQUiC>jM==!@4g7~D_k(7q%>{U)BZN*hRO2Scx=>RQ!)N* z^dqm2)mCU1LumwW0S+NvC&cCgPVazsqS=vV z!DXehbLK970xs9h??cG6Faj%SOgc>qI>|>8@_ZZN?VASmhPIJ~?DqJ1?&HcV6VAVF z`>P~@j$r5+o%W&U+>p~Cn?U&}MX4?$Qxr3#EM{xYB;s%X zHyR=dsetX1Vr_p4*c)n+-Z|9I@UL8gTs{om^6don76*fzN?iElUwpg2nG~4|$OeTxt8Oz43k zm@Rebk2Cykz#uk&ST%uA`NCHXG3*3AUK17LC}p2-=%0T^4&BD7lM=r-s&AJVl(rwJ z^4V~=*2SB(@9$du5{=NY4hZ6J;Nr<_dWsOalkp|49Fk-41}i_8(wKvbR3;qnw=jB3 z!WDx{i=1|+-y5rZ2Wu~Jb|-`W69{zzy3F?Y*CqV@vk;nkfa2%wqjjtNucPAefFI-- zWXT?=Qva@tTtEUaj~1A9C!vUbf%EhI`nV|zH0&I$G~T@aqObTYgwbwcBpGOXwyPNS zfO?$SVSR%2yvJ1tHa3uYTa-lh4^?!+N%0?5Q7LFU(JSePvDM!~?`oi0*jS=V=ZP_+ z&Ywhsa7hUVUylB8`ow)Rh%XvR;=OXqu`y!o{CIEJ=@iIqlnE>G%lYH7Ng=f+XkB4L zohOzxcD3p!0e_-;j~Ia^?)hxWIas4N$-lp`C$*G63ZvPY^b2?)bh{^3qYrFI{tLPD z34q)R?i=6%0&@b%f4gTC^a;Louzt4@@qd4v2c)z{vmn9IB1Y{KU;+ur_y3-d#5Dr_ z71yJ|WCr}VJAkwv!U_v`Y5%XFDstp|v>naCM^s9M8w_6On$ne;v{rh_h#)Ar9!ZV4 z8A1kU56s8e9Y#3k%0eqj?4d{U{mZe05@iSR3FA&xz~6MAde4EKdEWWE;Jo$PV2`Cx zSLxs~^^OS?guo*&4?p-EtRKeY68#Hkd|5Eo#BZ5;O|jlU`amOYykB9EBozbtvhM@o zEyXj8>C$51XAo-GCnfdQv;TkzSwq=fVC8$iqp#d2%dz^C_wor6{LN_Hy?({lSJ$Ad z$@f{2S|m`?BKPKgZQ#KT0MEkCtAOdxyFVWLhl^-V;8{4il$-yn^Y)!1r&xhz*~*^5 zCldaZ`v_o8%;5Q4<)}t{#QzUa?BQ{fEue~Wl8VJC8T0*NCnc9VMmwS^%?Uypp@71~ zgOKOK&gS<##?R?(P&m*>wc`su=)gG>@>J$)tak0H3?PK=u(-GS{cR0w`A}xB!M#5? z2FC_lEgL-_chYCIqRGo|^Yf^X>yQshi|Z1^BmzA1p#OGh)5ki?M3K)T5f}sopiKL2 zy6;7Q{sCk8+Fh>HhHf(_HGGeDE3%u`Vx zQX+xG@m`&J0%3=H_FxK(i8u;5Aq}46!B7-!&EWufA)QCM-$EM6#1z_N$nIz&L7Fc|?S-ihD#Pkr{&-D)pOwPy zBL5*0q3}9^@XP&Wr-b(RKk>Rm{G^{tg@ppW(TF3wLoTR0OsqpCT<{aP-5wzx~bHE|f|lVI?WjRHo@NI`+jUop_`>tWhCF&g3aPHdd7SX1fi9j^_>pz1tj{qRrf@7>jUl+rUe!8-ke7bzdjUoc)SAxy=DW#I1!=65~3ko{5 zJLJ#7|JxM`DEqTL0pZET}LV<577A^<}lU*aDUy9~MQ)@;CG5uVD!^?eL zA8F$Fi2j3Pe=-uavA=)Mr#PZpAsM%IZ`23kt`l!ovr3$55nms_KK;lCk7KSdDgIE3 zinFIwVK9S$D4cXM@gAVK?%}|R6Xuu4596tEi!e;icB6gw7l5=;iIKmgMz5TT(DC#} z@#@_^j+e6?v`7V#6Jich+qY^D_Bby#Eud%mc#GNc@c4&c9lj(qI4-}Tl2=8Stgg}F zcqD&np78@GYgsC*5!Y2jdiM9}RSgI#7}#d1X?(5A;?Ibyl-}2Kzq!IEiv(YcNwEuZ z!%S5>8HCs1slvlN|MZYj(bm>sTfZpBPv_y(mvFf?G-i_1`w8HWn51yo!oed|5mG)c zwPuO#tVaanzKuWURAdQfPq?T?1#u3tfm(Q_*E$MAF6b{63cu}2FOj-z$F4rmbKpCP z;TpJHqT7PE$PX7WX`dQtGFLyUuJPg_zyen;?xk7L7I&_&*QMbwnDpkRLmlbY)36aP z97W8CxAS97p&1cVolwCV3ko()q@w7|9_&2d*L1{~@j=&qX)dR)At&_lnqgNn znS3QIr8f3_U>Mk5f8QG%y`>z1ldDE0s68WR`@PcxPHRv^}gKd zv8vIwoX~KC*858aqFgJ1cxIN0A%%bSWQ;nTYg)gwb+z~>gUajsTYqhnkU$+o)&Y1~ z9?yHrBeUNLWq2cFh&A(p0FX+2)1==OctUF8@ns?7W}f+t+fBQYK(PSx_?oxOX=10%mgc&@J8Zk{%M{oi5 z3Or`KkdnQ<2*fmM8bLvbr+wsm;>skQDSU`xsuy;eM08K@5v^=hD<{@0XBYe zl21ITJbqb^2I+WMx3lfjiw^YlD`i?i>ktb?a1VQ&b~U?b@(_O8b6_ifb^bZ)V4=dB zw|3vxXY!D6S`@H#Wa%-d!L8~;UMZeyE$18KM|4e}5&}!`#txth3{*p%?<(25{V1n? zg(5o3-|$Xf@i&7mGY>e0t|;OEhmw`Re1#-N&O#?)jk91e~&WUw}UWXEfyvv3BFyJ+ln;R13vj}9*P6|dXz?2vu1 z$DC3Zyl!FkV@qnC$~In~mOS8n<@pclfh94sJ)tg}lWy@UfIk+@I_<-|idl(%qdfk4 zGule~I@jG@*6krq4G%MT+0@s0_zj)-wtFtqiOA2_TysrtyYIu>vt5lW)e3K`OU>>^ zH<5iA3rIHAFoHi~2Etzxmi=U=vU)M`-9zuPi!T(;@3A4e=LjmA4?31MCbLv&`Z~XF z?WX)Lm8eI!6lwA(+F`N5j|rV(xu&2z_p-=Ov8gv4R(p*Y@qLhKECRV0wJGH|7x_ot z2G~tHgW-XEK$ag428RqTH*ZF?;si%_wVBV06O+>P-*1|%z((fh{CHTC5`BX7cCG4n zZXD%It~P7)6*j)mdC7zXC;;wLzN&7RfyMG=viw6t#ha+(Kg|wO{c!%2bwx8zv13!l zg+uO#Hg&uDM3P+e{xnT6_I#&LLpxH`gS<;yt6q|AwFcGS82k4avwS|7*hzO>;mRcz zI0bPukb8gne0BEO{fVpRx2UG`6w)rBfFl2MRmf!0ZkJ+1V*rRogcwtdWa3SU#qT$h zH{oqz+bNEjS}aTk)u@J7sSMxk2}E=DC&~&v-o9*dCZzX3K8%7-U#j16$ob-z)uLb( zl$UtsNmx6{ft8i|G4Sz{FWt!f?cA@up?Q(}NY5N5fz06JGxL}8-p%o}RZ-gt&CL&f zy{znLY*a*F!1NtHT`Gc&)otmySFBOyV`Ta5Zk5$u7X#|Q&{+`J^nB?jtlFC4eK-(} zhxZZZ6UCc-NrT`QP`T6BHeL~7SZVxPrYV8hItBE~u}4SCg90wtdnJque-nYmLAB;}lyotB4*M$Hrz`{R~ zdXHb~UCDrc>H?Ge7HvIKGr;L}Y2SDM)`HMZ;gZGJQeXbeHJ6JPN8L9$G4-F#)+6$j z_2?y$B+!J(-tb_|N^Ex!36hYy+qUbyt2hR?p;ypkzlwI7qG>s4Q~=92`xAkx1RHLH z+Zf~41g=+aOYB$6mm7Fh ztjVKHy{CP>qaNaPg=IQfEeZoYyIf82^8VwkT=H}(gfz?(a=F+W9GUKy90 zGecMLg;WL!2nx0!8%N*NylyAaZ6RA{?h$jkSl!?()5t3cxd0qTAIdc3Id%~LNs!C9 z+^80mM++kSBURWp@r2qCHJ0l66ZqT6VbTllIWgGd{hwNLzdXF_KrSH05xK{EA6AE{ zEUn1*`1zI|*_U@pl?TjSKXNrvO8lI;pf7gJ=N#w41K(SMy09zHh>5wL`=8`XAu1$9 zSbY9&p6>Y@p6qieFyxi|n?~PaL zbe<)H=ey%4k3(jCB}cL5y8r_1O)YIwVyGdxa1~J;z;m0kLdrxA*eh-lFORt;U?gJE ze72pu@2d<3&!@RY@Bl7v8zSg9xx3IFl5Urm5GV`Noov{&bLOr*>~%BO1TI>PxVdNI zHKf!C@if}6WoBquKC|F{V>5I3>+_0fCmbdrUu@TNQdL9_xN_Teb=35;LE%^0VMY_Q z^9lkpHj~(ugAu4yA)=^M;VduA=2RHr(DwJ&t6}iu2*$sUvmtctUCuY8>0AD4qr=fP zg7)b1EUFFnD)v=DS<`3I>`sEXRaKkqp0%^8)INm-^abXO?rRfMNs+MwGc zjq|dnab62alGbD#6XUY-1ny&=_)evPPoFK-!GQhhHy`17hc6sA=C`vta2mUosnS%$ zmZ$T?|K7Wz@=KmUqN%GHOKZNEp}f@!8JDZy0>oA3qDMLAZ_K{WjeaAMa;k8(*~KvO zPoMJM;Z~ELsPM4OZ?5)UHHQ|(BNkFZM$50CT?@S52uMQuz~c(#_^iY*)8{TLzn z0-(GKP;eP zn}jxq0-izc3KH z?z^^e0G==r(IaqV4Wu{RJE!qRY}YS^P-YSg8>;uoN|(7g+s6CKzEdl&V}oZU4Lpcz68LDOU0)!zD<6<@8q@@FDbhQ1=lwR zoLu>~$w$wy_|pviRK&k?6&-@(E^o_N(iTXH*mc>G%?V!=nS-$5=YsK9CYf-FY%%nY zRKSf5&Rkagy`)0Y!nd`ITP9|n(nfwp;4xrAQu(5$_(#HES3Luxs=#bgt=R*aZeXrU zfnXo)3eUkulbR2tQZG)*L9R0L9>u&D4;lBHw>>P7HpGRI7!;d(S^SkJiN6p&lfn

p-Wy0pC}>=GpE6C%nBM{B zj9e$q_xr6mbyb1cAggb93-Vo!z+;bCBS_!FAeHAU{Ok*vJOM;1sw3kc_z}ylFW?O_p?EBf@;-^%d6E5-hj)=Ir3P1~ zL2%l@@sd;k=oNm&{k!Sq0)9dh?BNygKGF(4n75eM+V|DU$WjoZz7!v!#No#48aIDM z2$G+w6cadkQ44xWoho@I4;B0e;t^%A&2L@NF;GE6$=x5+79fs)-&N?D6=N!5gb&M!BXL>R3_!B* zFY*F1RdNF_e*`sBea5%Md+7FzMBK>8mz_7Zq%BtMSc$h56kG&iC4IXJV2^Ad)2N0E zC)Dc-jo}n*ZUoJFBffV*R0d!Ib-Q<|&9iKd075)JfP8oPe0zkN;myCY*IxL4t|Wp5 zax;U4m#_R8wm@n5-ykV64443I$AG)AQ~px^@YjbCP4MT9M~?o+tKgC7Vjx_48ZR05 zqT&a7e}cF7N>vXCKF5^1hW@X7{$FP_=>#uXDAnBFJJMf>^w*zK2$IVjS>+wnU}Uxz zxQQP*a?~TKTusu8dom7qc?Nzmy7rOyk|u~rsCE6(Si(On7V-0qfSrNt3n84vz}2py zEcLnNT5W`Xg<5Y|;Blp->(9K|E)Y0#f?fvJ$N1=mEf}bPnp=Baga5%I{+`_b%LYhe znK$Kr@?CuD6_Vw%%yz|cFU=$60s6n&qgh}uBQ_}0efKOB6)mOS@cljH0+qYg|Ia~` z_Y5+;X=GFz-uo-ZN*@_6w4w;1L&)qyG7>xZlD}4a7KjIgnU#X0j7p91f55o=kYN-+ zz^DR{7k`~)&&vMhMj9*NxTRnc=HC+H?`V|22m(F16Mv8*{|8)yN(3U@CdPvLGf>Af z_P_jL1Do>}%(srQ!T%?M?+FWSf+fL0hRm7{mXkOfD(&;A; zu9_v>&9Zx9vvP_zs>1MMS@G$oGTis7SYFw9$H($zkOx@Vil6A%xFqs5G16gNEKIJF zjh~N8Z2CNur%1jEo89cyW`5dAT{miX(4%L{(db4>qMzuShMu+M*HLG#^o~&3%3z1T zPWShw96D(3^i-T`!F2-5?scX4jBp9hdo|M%JWx^0s>&yC^N`(+08vg6p>mSM*6{fF z_*nJFc~3IKwWs`Kraet8JA-}(-}<>#U;D8T)oqSx6Ybpkxb>xWd(m0crwD`DDv9FO zU&*1$<+%dIuJQZETy3w%5>xj<&j1W;9@f6jo1uGujSbXPH{pT zX}C>z|C-A@Y2AH>mD4@Ot&0;%o)U(UA>lm_ul|2*y>(QS-S<8$2pBk^C?FspjkKgR z3eqLrAdE4d$!|_py_vIX}gFE!Z~^4N43=$ zV~6#=u-Af!Q758AgBNvGf4o0XYtNo`+Aw=|BwZ`+cuf|@TG?9 zh2hu*I7C+*c7s!yvhE;IA%5-a{k5JHi;kB6s}lT;Y4ne$%5$VEjAp4*puV%#ws#H0 zxwaoC*7zUsUzc5_jiN({KL`1@;o(@kX~Rv#w`2&yEtY#7-6PGOJdB&EB|*qGTKbLi z4yBnV83-yPeWmaKUcVa7??w*bK3{FiEX*F9b}r5+CpH($loYX^t?lnxxq2s~ zYHYoh58J>@Da-es(6ZWWvE3ZFY$gK)^Yz@CFpI}dyyt<%l}G(?JZlO<7&iH)`keUR zMZFuO-|&8khniubTY{RFzbdyvJby$n@hIo%sPJp6W9)3M`;pOSE@7Oi)zaEl^-QIk z5p|};>r}lfTd`H&#<^37Bcp>y?I2kaXI*Y!QxBDPuzBS82kI#E3}^=E?^C4kD#i0ck+QR2MrIHNwZI-*{JFt*5_-ifWQi&~LVc$STgUF?d}-n4RY+fu?%3bkd5P5^2cIVj}#vx|S;O(xsJP zwRvy+Uv|`Y-vI6;nVUAJyOz`QYQj8OtVz?D*nPrc+F^b;F%#hj|HXa(lLe; z#n+th?cjwXd-m%2V7*>TeD8|W==M8aL>J(7dtujP7|1(qo=^x?y*pTm=%n{+*4?=! z1PPYr(ypsJgu`bWg-;K+c@a+f{_g)lCP27prut-NaT+AnsIXZq{%hv>^U>saiD@=6Oyag zPG-x|&f!m%fa95&>s23%R5%@%E#Xt5Nv*(lTzCVXQfjcOp52to&ll=M`kQ<=bR9i~ z@5SlSBv;irIcG!RGP|J7m}y1mo!#ua4XA8&%Jb%K{9?`1;)QTC;mCFx2bEVhKpij_ zc^@Al8w{WV9@?_XI(3QgKlTsDW?UZ>79NDA$nIx1de!dwZ)1CV%I#XcZZ0?d7>k{p zK-u7Q)j2I>OH!SRk1_Lb;^;2cRb%7oy~joJ{)gCVD-^*0e*E0G2VrvUy6m~U()RWA zaBy&C&MWQny?=Xn;QL1(x{NG%gnwxe9;PwpGLOTJpDwd1|CC=+5__+HCz^l8I(Abs zmfCJ5Y9Q1Ui*ZrfW!Plc%=zheLY>*HiNT~-T$Ye_?~*)ZguV_`ccvhDt$c^h*ix2% z>;X}nT&vb(OrnJ26iYhW3R!f-eVk!vdJ6BRai!Ja zc~~yq>33MKC2rZK7@%pQQi-2329Oo3(kq%b zx9O@p%VUDSbo36ey&wnfOO>o^Mqggkvl~uKxN(L^~!zS>u$i zw#8TG#cKP#tD!^+T^4P&u>{r#T*lSAT2}(sLN9P+yuF({xQq$HwBRHDJ&WO1?0DlW z`=dmjugNca?+q~R#p*A7UC|q6U)4{h|2{CdE8LuNnR+qj-|g_pqRMVdo{6vA?6~j# zg{NFYN_wd`>vsMgKG{uCGW%6a?Pc4i5njtge82*hpJ(kqn@r4|KKl3!u_?yKQn$-h|z3NE_ zD%A#yFIgr_?R4(mfdBO|cgPaD`W})5j>~35{ zK!3$k_S?iA|>9Ka-BLqpnvL1l@ad!Y*nxCD+6^;2aPeT^#B)&85upR^LOC%DUdx zI{rzyzprApnUoAIcL^1&Ju<`PpRq{fCRQ`k))Szcgjz;2gOWM5;<^Lje`t;^6#Rbb%hvqWtE}Hmy0Q!A?fwEM(D?Tp?}p%PZbl75wU^Eon^0O* z6)J`x_{)(Ha;FRWO-&EGVjA^;{G<*5G$M~N-&EUM&~HP3 z#9$g9Z=Cf6DQc!;6B+6-;biV(o|)AU6KblUi|_*zJS^MrV0(F8wS6sLaGWq9y#7A* z!|~KB-dMhDr-!D^e#NSThK`p79%^KfA>Py4C=C@rrt|08o4@($vr6Ekw35Q}2@Yzs z1#Fwp{43C~D+h+l`=1=m6bl>PLm<+cve#sP3HdSybkvitH{qDx6Act0WvA33d)EL# z2hvU*jhGnPi}>=?Fn{uKqJP=NLQ_;v)gv67P1-1y1h8Phv|<9mUIkds>lDBCpqFv2 zZmYzR;x)F7rea^4ZdZ7E+)niT&OO&Ig|wLSoyIO^Bf%f4W{>-bQ}Bo{-1a*O*OprS zDh%7*@`oLj>sYZfp-@;)ZHB$w(YSiOVj`%0dS-+{m6()O}pCQ2ON7$zg77c5#h)sJ*tA!drR3Ba1jF0oGu<2xoD6*NvOs>!Job zqgV?njoKCdE*SNGJ|bBnoP2!JXk=`RNmNvny#$R*JGa@p#lH^=3#&?pM^eX~4K7dJ z%Yp%Cq3*j#8)5NFR=t5_@1HEqE#zJ6*;?zz@R0ETxA3O4%#1fMN1q1Ed|#zH9AGo* zqiI#7ru7TNo-~^A`bd~Z*VG)lCK;MWkk4M1n0IBO1}!%y0^miBtoy49o5Xi^nbc$I ztBF2-9{?R*Lby+=e&z27hGYNA!3o5G0_^9q ziVuJxz*@BVYWHWwm~^v6^=G{A61PcbvlGwFyv&tPje1HaFI|Xw!CfR62r_jkk`dLL z;7B+kgEW3sRiCUeWYBlFYR1lC)>hj^H`{knv94Lh(rk2t;^gz@pp{)(pAzd{!DeB- zc{r7c6D?ZxRZ`-+RtYkU@+#P-8KvI_aCEQTKt*OEOs{DlfP$F|OXJn`T;Jo6@zL+P zERmMvR*+wwywYs8ZnPZM>*uzfdD%|YKI5*LKA@c|m~RER6`z2q0O$pk^?kWn8KvX- zyk*|4qrQNi2GhC-?)u*}kQ>yPP2W&*fmTkPYhA$#S*i+Zn6s2nJY*a1$>Fq_9qgXCfwf*dP6fOMZ z>Jzv7PhZ!olcnrKOUZmR*kT07ZWv3+yP9@$kH#3VoJL8*Nnfw{H zr8@{-Sy{2xkR@TS)blgu{sVsVVx(*;0rkvD9%emXU|6L#84`+FO-xM8$&?exa>-U@ zxPoOiLcu`ACk9q=C$3y*wd7AjnL^%jY5(-PSEJ`=CD-3yqF&_&iqZYl=^xc}x}I#U z4>WK`$1Krgj`=0Lh2R%v?rrE-n!Ksnd1`%e$Lb3TTX*%D&UIvQIG;O{ufy4Gy&E zD8zx+?(z1Ro@ZU=IUg7wQu3)lijxv`)j+A)nEffct6Vqra(oJd>+3CNE`(^Vll%|~ z+QP+fbI~0ev3pdsE!t16Nj^y3xXk-NUGTGQ3_TV4eOX3>FkNfIzFgLY0VaX zUtJxp1$|$e!BtF87MG4%rl^6q&Rr?lU7NZManQF;U3)2Q?PP7v?8a}J%1Q!cgd__i zxYnBA`(W|?5T?VmcMw!-3)w7paXjbNFjM~4?6Z-_S{jJm`Fe#J&K8)s`}>r8d_rH%QfpHe%F|QRwm@CLXl3GZ9TsAm+`PE=c0WQcFgoU>$g0ixy9`_ z^=b@VANzW;w*$zx-XzLi|4#GhxzJdvTe;9@_7V&)hqB*toIf$AelfB9x~qzdWsywX zyfaO~b(?Cf=E`|~XxwhFb~cMoiH2ya$1>?v)_fF{8`c}%KG=O+sjw+AlCu7jiNbFG z8BA|rtZ%!*a6U(KhDUB44m?8atEB;eHDN$o=&?aVZ}^{7;js?j>RSb!Vt`txN(;K4 zs;Vkq)*3NL@BQ3ftfAG?{o1sCr2)xGZN4?{PlTg--As?y-6%)bn5JTfmlEVA_CCr? zH_8!g9<)PHbEC^|<|7hdzEaVP^$Gnjs~O|B~D) z0$;IJ!v6Q_iG1h8c&Aryae-|%n+!WN3)h}m$fY7!WoJ)Gd`?!$DeX3$E$JeaFQwMw zZn40OtK(QIW=?6{5wO8+nMp5@?(#N`w_N5-`BI5=L~s7ZM5o1fBhhnt~Ebip>mP8v5#yX9($oPkz=;o~gNOu!CD zLz9#x>g=TG%Ayc89PEA?Wiu(W`~9?pl%u*cjh>2d;lcP;$QnYw#+h;dM#oO?iZ*~G z99T}7mAOLR3SR!t-d|3kXB1sB9KCzl%Z0UxD{KFX2>wkQ-iINcCcKSj!NzL-wM>bE>+k<4i=A=ICt(giY+-~Ex1Pk8NCgHSOrEpu~o9bD6O zo7u8KxrwLKLqkDRcFfFjbzv79<1iCZiy1p461lT}Z(K*$A)UKny}LVa)>(io+C^0d zKoU!7rP|fsa;g z@69Cp-mw8+vA!+7K`(YdYNA#m5$8ss_!FI=(k}X(TL|HXdxKLmO$O_1HB2M|L+O4} zM@rVD^%uEz+mIhj9=S8yCl&|y*A5DtP3g^6nuKr9ojyH<9yd-lx-GSkuyb?&a-%pD z)giE!v2fX5Q%Cg%Kc&<8U8LvENJ2~;bwvDVw!yU$+oLwEPY10ko?{*c$~9|mo^C2W zhEho^jCmqsfIBSYCQ9|`fTrYV;0}Wi(#5IQW(giP*_ve+lo%F@Kj?Z2({euMl*3Tc`K_mQHVYexXapt0>_A!g1NQ=p;tf;q44TvL&db^!#@`UHV1j zoX26m-I}Vpd7c$ha}zn|kbAYw{O4xf`eU1?s=sgmTfbifR0TXT8@%<72akLOzd!pc z%>SPkpy%}sW{cq-oemdaj#%@0M7-ydIL<&}RAJ`f*HFDLI5M)pp6Q|G&Uh}rXmkMO zxYljcn*w?Ajt*)R->Zy4*+L*JI_q<^vL*npL20t@R2U#4j}C%{Sj3+H?Rm&yJn zNCnMT`dJz4oS+=V35aaMZ+dCzJ0}-cZCaO>wpMmdo%AvOMbal#J32Zl;fL3=1EEoh)+|hi@SU;ORLi_V(r&X_@a}_6faGc=EVF+O zl;2_yb7U7h99;jdnF4~svd1y=Oq%N>;FA9S0RO&l5yj8%(?la33}k}AVqP>CWtPY~ zRbzt2cv8s*3UAi~d-kNw_)XIgYP%ky<2<{wOns76itE$y$aQTQ6PJ@K6&f}Bgy-O|M zQIy;-Ns-8dUm>hL(@jD=+c`((6TrN6?u(qGBmk>g$o7~HnwB>2*I~64tkxpZCw-<0 z`HHk9uYee}YGqTe>aI5XJ1t$nbp+(jE5QCMU{Jv8R}FTY=Abzh-)_s6jpT8@@`!uR zWdGvjFY67hVHzn=ynj2zq)f8K?-5V!OWnKQu;vb$OR6$=*VhrV%D0&`J&;My*CyM$ zD=w79JpJD(zFGgzjJ6r7uNUJWTs>y@UwST^y<{{gj^QPJVXtB>xAkJ$W`w1!P zQG{qT*>3KxX4?znvyL$J%$5VWpC0fBEU}q*_ouMXyz9x zrvms5nNT-pR(pw>oqL=JlWh+8S#(?$ijsBub@J(SV{~v+F;;gcFm%P}f#$;aE2?%X zYx1L+%7mjR$ZSOhPkWsWcB98k8r7B#C@$vH;ulx+F+m0CH;xr|t zIt2)oxwbm&c^kFrm4G{rhWx2rx8POM$DSX7y3?rpis9d$I3`R)=uu>Jk?|aE`e&Wj z7QQdy!HLAD1{aF ze7HJTNQhUD;qqWFZjB^W`iB3(X9hG;KX8R(C0@3mmn=)TvyK`h_}9m=?%K7hXc+}z z{uFoUhF4*gGQCmD76s3&xG>T3%)4abWKM50?6{$gmL(wk=MJePzI7+h+?@dk7|Kaq z_u{OoV>UvJQDm-zCw7$PuCbHNR*qv6ax1B@x@K~+SU2;$V8V7bsD$uSbrz}s0@rJF zt>on7-h7<+pmwLuBKt%8$Kd@hSd%}qYHOu_a`r*azjpqx)A6&uyu7>P8iFb#7*?FN z6&E$u>J7!3i82|KmaZlmu~OOMZr5Th%*C9jnC9igsMR{W#bFcx4g)~gZ=~dhe;7~T zKmmq5he6whyEE`k(?6O#ls<(prb`X=WiHxP(rf=~pxCAf%W-$!mu1!F0YiD2^<=EiT+_&?B1Q`?Dcn(@$&$9nzV!3)T=UYS1FQ^#hWB8MTc| z>A!FK&zio>Lq8o7ZTf?nn!&950m!l+S%D_sIOEtVi2U}gx+u!xk~oe)1X5d?g6=} z0lM4UU2n2a$Hd%lur4l`fcB8-BwJa_Pj9D|SzuT+acfOR-Oo)a5}m#$goPyW3x)?9Ge^x z7adnM3Gq7oj%cW{h_9OWs<#}{mUUMgeU>~+=6#db?tT!szX#7kH+)U8WZ0zqzhi@7wvx_ z5jg6qauS~GN!%c>-t0Jg>TEy%>}DZ}?mtVzo(pbmI=z1))%tb!$r7`lGo9*fsHFdK z=hYX=j}@M7f!IjS+vixVX4ZIQS-`-Cm2p_8B+zfx}Fe z*^&>uk#C!LDqkZt0Z6MC3EG;J@k43FjaVUagB@vm@g^e@jzS^ln_FA)(ev{oS&bzC z2`vApD?fQ`nO(Wjgyzo*xlDUcv{GR^SUT*gK(YEmc4G{egHx{^Df=PRsB5*e)Z;yl zz)_6l42;=+(S1Rb5b|_$4iH{H2J%>df^R#IVgIKi^EPDwPT6)~{zQ^#v?sw4`T6mV z|DDTWJNI@w!CSMw_d`-D03%JV9) zS(&9*7Rd1I(Jrrr36t_N)1GcuDY{@ABcbvbE_Yp5={aw_cT3w%QRt2KO>wUCSy^|C zCrddl4N7shnD90B*P}F~BU*7$|Jdv}U&q?UXf6#wxRgv~Km}*_+PyZWAV|9ond_k( zuiKxzIge4f9q9Tx1QhG<@TNaT?C1yxbiK>%fvY9_yD=+W;cx}7gQ~etU26HIg@b`V zb$DqXX0DanO$h<)Ja|%66N)u_QIfL$@M-t z$vro>i5bfOlLFo5XiERh(bni}Gvrun94l?76TT>YIIS)}?pcpj-(Y*dF}bd7(#*KX zdw6YT1o8N|3@_iCJlZu`5S9S|Eid*70=@p&ul~w&XwwRzf!^?z-~8`<1A}GEi#Mlj zyTO7tKsTNuBCg7K9`W>ARNBjkTL7ZrPF-opGCEVJ4p32{rh~>dF9d$OafO)f_2Rnu zzoQ^rcl#Agx5j_H!q1-e+}V%=+h>|BzULFNR<@dhkB`*}ShxBG#f18O+{Aix ziv!AECz zzem(>d^;ixn7Nw-3e3-_)IvI1$*ITB<;`wL=O*i4olOd({ICC{moz@IR=Yt)1n+Ml z!+Y1v@~8jdYg!&?)c-iD$UH_3&Cjm9T&O~nTT1W9FVgJpTwn%|pZk_?;5zCT=nL6j zuo|-oes6tXr9I{}{%g#$Z6rg!*&8TO_}UTJ(y103@XlFqeI;08j+5YRcFrTYIol!; z7{6PYBqc&BC>58{CyWxI$E&+X9;KP(_ip8C|b{+ao3t3s#@!D;yIyl436H3-&s0M7u-b$L%AFe{K$nU zl1t~PZD#9K@rWfW6%+iYEvNblTy)$i`LlUT8Hk8TV{;vXdSe+&hZY9w9P6JD3GmPZ zoUEsADhaA0GgG&M*tjxc=4eu%HIok`*MG#4esB`C8-GOn*kYni<7E3}xqT!<)Bq-2 zBZqa|NC{eb@W8@#`&fvA1flFMdr12kl2+0z8~95nzq&~E*HA`by}rw`!u7Agt8MSg zdEtw8DmCYu!1!I|w&=$?eoVXeZ^1Oc7nHGH_z7rY8@`*po4o1=C65@_Erhn(uAg1V z9WVCmw39QN| zT$&)^!}Eg_OT)*xDVpPu*^vse@e)!0cH(bm-FFutH~DJP69-gYeKEJ$XL1gY&tASb z&t_4#>OTjuUo!f0M}?5_iv5^XiU!#WS2Uc!NhzA=DaJ!d$#^s$^zgbKj`bT z-ot5N(S})0qzw=BXo6}$I5_Yo&(hw9$jc%LcMgjoB&3oEX3FC0d=1508f*4qo?xs;9FWqx?C8oD|)K3N^ip9bO2%WUO-LK(hD0GX~OM zO;!lE*$}giG8JehdHNwJ84TSvLG5^&=G6hCZU8&3Ij`F~JH$S?5s%Od`W_Z5T$2X3M+!OXCP-}0~QtoHf$r&TdMXFaHlwCAfYVX_Q6(^cfHHf|T z=Kk~f!t*%Zn3E^Ru&RJ^V!HZpm-WMapu^dhouJHKEtle$R z>V+-g)BF??V!L*AmQe#WzG$aI<(`a*u_{QutJAQccyU4 z3>1($Dl#2}5>d-;2d53$YP-89V@-2!@QId4R5Gd+4K4JkNmmDqSw8QJTPN7q+MR3= z(Qy|Jsn_e(11eaI?$<56lPlBF3Rm5r{n}3};?oUl#KD`7lkWj_Lqdnk^#X!gqwOjO z({^DG^DKac1U`9b*XUVU{RZpdz8$6pFc#n;=C+RQ@UxB&wgFX}3vfT4Wngq)^Kxk=lE7dJi^7T|2}Pp^z7@68@E+|Q((x0j2Frc59G>& zw41^X^^RKgz?&V9WealS(e)FZ^?(Px(Fn z{N5Ef3RbvK!S)ifxsBKl9@<(15&N@^%-8>z0hpdm^$w-vc$N5YmDuQqQ=W4D$l21V z0%1O=>!<>+74@aJTNCBtuBVE``vg;UX7i+yp{l+8Kj2^Zz}iXxsAy3hO&JtUl&5?b zZNbjNS&8l@H2MAl@DO7fjW%E?m;^(QRK1c;ias_vYjzja)=u|V-wEdT-{L^HK7( zj46?-dhh(~p7dn1|1kO@t#)klmani7v;W6TW}<(eJQ=T@wo`k+Jt$$N_jf`L=k61r ztU*J2d)R{;XZ1pw&29nl_CiUHv$=Iyb=&i7VDSHCqyq^ z#9Uofj?9fwMmlsb8*NPsSqhSHkG4Us?2q>)olP4v)<}#juldw%P)Y8VGWD9Lr-sP) z#S(!v9)P<7&(ARabdnR45VpmfeMB-@kzFJ}%x+<6 z8o`b1XBwTXwwfetK2c@<_5EfL4$u+yv^)L%QI-{*;%%>^J9k?Ol0G>x&?V;VSNcfdBYS6PQaefV*zMb(QVhiY~F^{J{ z*kLdziU?;-A)X-z1Q#tMy>~Rjb&0b^s1r%z*necOBo|e)O%`Q%GqFLGwcIH~R6DCo zDnqxY4=b=UpjA~H=%+7}FxxCwVAkC6jurq5psCBc$e-vBKTwv}ucqL#deax&U%von zN`M?nJT*EvYxO%g^PS9A@B?37Ue2^@g;~y(y^YdjZa?7-cJ_X2{tY>nHsGb)z$irB zbyg829R}Y>Ln|NXVS>j!=Vd$s^;bYf33!iw%GfRaG2G`<3*m{2De23*Dxu94%rjH4 zspmG(ADR8~+BxlRjY5nk9tlhN;1OLT_1WORiEujQskA`Ui*_kSN&-MlkCy(5%cv zt4p>+2&hMKnjGk*&V3?qgF9DV_xxsy0*Wb)f+6#slc{(UY;jyZ8j{TU?Xv3*G|BPg z#>x(-Mb=c*R8&-M4_Y^>tB3e|ds zjk?z2+;^f1>IjI)wx9Bzz0VgsCe@rQ+5%l}UG`(wL@bAVZ!imz@d8}(lIRJZ@+!ml3m(PSAcvoP0#UqYh&%D{G&x-KwU&HSFR z-uji@IL4XMA*W`U()b}*rwz(O87GV^NyCZdsPPZX^`@OUL8*oK)UtxVxph#`$v*d# zqkO<}pcsZ(ePT(N28k!^huI4N0azp9ACcrU0GH;77!si0kIC@?y-g$!u={l=B`GZT zyW#FVoNi!}|H@}Q#<7*e6BqPA;r>~Lg~|Z|0c$fB)irFI)C9w9 zTGGeoRVkyVf`Wp4DkfUi^_Nz5m(a;Ngu>ra;7O25XC_{;Rn)RC$B2qP z4dbL$M4(2L^(8h?Myb7GyIWc9*mouZ4_6OfD>-6QPNZ*uT^b%8eiwWOByA7 zUO6IA7V{ABELyiY-PbE}pWc7#2Z7Ei4Qb1r(cW%pSNAg{`y3AwRpOKW1UXXcveOJ5 z$#0$EJxu|gd`#Ie-2t0;LVWfVZ1`Z0-$4dGd6X?Odlbx#YB#zJ@5v4Kl7@dzw(De8 zddtEIkmf44<+FB;v4_iy`+f$#cR7DDK9pxVtZ_Tn}xGb8tar`xEf)9XFit=M6 zBVd6!BJ%D|;Wc`#Km{qMwbTN@lmW>4F2w;QrBk~y#F1WhOSdQ|N4&1Ser+#< zY9v=wRj={1z(ZOtWQ>RHrNY(ku7f%I!TJnlsu}m`3O5i03hORkp`*!ZOe5uUklf^= zhXHlBa=j5Otb1#8{N4*_v@k2*iaC9*Pgx!urX|ZNzvcj)2OQk&KRVyg8S;LGn@d`>t3`IEjF4k*0j+&fCbFRy; z2KcYtx5m|Tzvd6ZZX%ICplutd^)y`2wESOF*En$jg$2b{7D%m z>l^4z8ZUIrlber6Jti0_OFBxLSe!(pHD4l~ElN#OiCGS*GYl)%*Ts?3mO4Pqnw5md zdMskvhm(t2a;7k{JVPj72qk4EFOZ+yEo~**IK~nZ5-%e&VG*I@lE?{jv5WpAjcQqh zXDs7(i>wkqFzfD<36pj-m8}^6w6VJztCm`==jRZ}saSpd`)v=4K9z;iE3+3w<7iy= zzswplk;r;JZkwx>=DMphYq{y+4vsEo;t(p}wys-1+?24(g93>Azaiu{j>zJbg=Z@t zrDYzRK&{Tm(z7h)SPFKIf*%f5+=DU(23dYrUYGF(Y?yYazjk;G) z_AI~2#oOOLsy53b6G3v|w?N+aCKR&lX747;xRO$%@%(1wkG-GwA*0}Ft?=T`5f^%c z|I4T0{e9^k&24~|`=1V}GT_ddzPLN7x|BduAm)LnvD?`+72UMuPtYf#;4fTdv7^iM z_0-RBHZCq$!EswuL4c5US6Jm1LTVR~jwGRW#aXxB@to2<+#1^Rkv)P12BB%k#mUs(=Q{ z<-9Rd1&CS>VAoP1IHQR#qT@#OBQ#Lwzd9?GRI6n-lZiQX;>K(>Gr3R3W^Gq%3y;sLk|`h7Z_Q|+&(lVU7CB1)tm<0b!dc6 zLl0VExYAZ8NdHvX!{19&Z%+rit}3Z3dpvf*qfA|vfEzRz2AZ9C#?6!wPnJ?0o~@tT zbY}JM-L_N!9sqCeUWZ;DvQiiL%kM$xSL4tH1%W=Z1g7G4gSv=#)Wf(DA9cRi$i9xD zgv?B%gUu#SfJT2O3O1Yc(`3)iV9^~6X!E!-5sp^Qm9M4XwxDyPCm|z?Gy%qu|9<{GmF`$YQ&#ajEHNXB8?S z0oF#pSNR3`(VvR7sri}4Rk=olIZKXYr96$If8XVuau(O?{|4W1*t9jW*s}31ZobZ4 z_(u8#{`CaMSQ+R@{HwiY?KuBx^>5e#bPe5~>Kdw@bJ#bgeWfpS1wJ(o$NC9LYNISv zFNzDV@)C>7jT^Mm_g@>i?BMw1>V0u}0E@LrE|;hn?#sIvFK><#Mc|mZXO`&H6nDA^ zL}QoUM9FB3hj$xlgVOT0=NyBR$(Jr&T_ro3P7@evxXs8%g~sP=@7TZv&>KAJg_s#x zZ_PTU+UJs^|F-ff+G2Bmcw|QOy3!A%VAdGY2=i{<;<7wcO?C|G3j#Eps3{{B4;ZAM zxLQfg9lx@bGP6AI(W6Jbk?j(zaoW}s8O+Jo-lzo(k#Cto=U0OR3&#}2JKAwfvpx!J z+y<6+X*>1;&S`wVhLxIEn_^D-^p}e0BoO|kLH_Y11 zQO4bLH`SsUv5}?~E6!0_$zMM*u%kTUU07F8SGUR2I6lrbs5X6H?NufTsoV?^2{%Sz zCf7%3*>bC)4(|2m*xt{NS{*g+VU&5&j-bn6PG-4;y{j_L`WZzvRbYpZC_3wAeq7L5 zoKv!}sjaPePls{bK(%O-im3O@C#Seb{$3G!hz_y?s0^pda4PW zc+;w^dR9EZz3f0U@dy+uGRGZspyaf)^n^d?@R)~N;6!5A`?`Hnj1n(?AGl@!?McEk z##nWsP5QKRo;e*l<;(wkS{aPp#ZglTC(i*EtERCT#@R!q;4!i7AF+hfjP?3v`f?uQ z0h#TthbD3z=Lfa<_DB%+f&sYrbo^0DeM2FFrT)`m7`GNdpB98!De~r@vlU~^3Fzmf zBYw!Yxa(cIqRvp0h@N0-x+P>|?+&kBII?h#&|^3HI*Td)#LjF4ec@pY4*-~Hd7M+S zAAH3_d-53g_$t4Bd9B@(pBGv3>gIuY@7w<9xWpFU+j#5otc}U~>FFP31?{_P_XZ`fC}F@RyEf5gmF&C{uyIv=gUp@`ak~hQ)iA_We>F|B@vrOPhy-W z5=~|*vSpaK@nk}}Y}cxSnD#WE2GyZ|BEkUcNHM=h)8Y&5A9%^KRsB_$9JV=-%&hgK zT5GJhshI0oyry6WSi|+v+Y%-`IP!0$<^7MhBR8hw6QZ50EOMm+0q~HtBkv z_to*MlH4xB-=(! zRp|=4`qR1Y=1|Zq^-GK2ZX@uQ5%E445Z8VB4;W$wKk-_y?{wbB*T@H6plhcIp_k0# z-BhgCI0LlvATt8V%H@*Ns!UQGX%>aOcnt>uN*q%O$lD%!WKhg)ZZDXnFXg^a=RE;_m}d14AWh#Y#PvY zGA^472rRp#g{^HPcPjh>`HQ{ZK;$&6tn{?ETGcOFLw3K3QT7m>Pv?KUS(S(opEIW; zWbF>96WEQQe}7t3p4_LsP@EF;H0^jJd}70Y-Or7(ezgAVQ0;-Tmr1bzyu`X@CXPDp zizap>Z4N_eOEY7VE zKrrwu_iVaQNns(BAgFurKM9=mZGp z6f^1KP|+*NXhCTLzG=MgqASWdBp7>bIG!h=E5pIkp1nuG!f1no0k*d2`(PbTq=8Xb z@ZO43%X-)pzXR-!l7Ibtp)jA+V(qRsflk4}D z2N4E6!lfIlJ`@GCN>AuP=x_B&)Kop|&rl;ZW~ws(J>0&$GIwSx1;>wLJgturmi=d3 zuLm>$WK(~>&p*C)CVADRV~ke9ya2JWaxd)Hf8#wjryT&BI;tIYos#wwVT)TgH}p_$@h%zxCs$jR11Oyz zSv6WFw@Tr@nV(zK*f_6NtYvnH7_8jf+91DiZ3y6OK88i8+c5 z&o*Vcf1vd^dVh-Oy;&W4633J3-fs#Y*D7q@>JU^X1-KPjSijSy zU?Gt!)xml~)Cu;@V`}7r(6fo^RH26?8M^l`+?}Ykh$iLL0+)AxHaPG9S(nFLFlUS( z=w%*!5=6R5R@LN75wxCEOsR#{I-94erY2rcP;k)T>Mu8;aI*smuYmqpjhjtLv=c2L zyRm|Qe3s`=1tD73*^S}o^Ezb%Rxgyc;&pn{M0 zV3I9c6dx3C78>|Gr2VdH{ZKqR6nKu@I1%)CTxx?U2>T-%ya(D9#;;+WI{5d0)(~s* z!ul+&tpTqOw5B|EjWw)?KOc|DH!kiBr8pRn{dR5S5X*f8Rx-1pT#eIaR_Kmd7nm zW(fu7H%V&Qi9_fsF%Q?L+fI=aDuMQ^H!u2~`hK2``l22lPXWViZ2N!9&PHZ|%@_mq8eOSNq#AL$y|Y&G;csaWHdrmwgm zXa}H$>N-|($d$o;&%+iT;4b~7XptA|sxn}Py(*VrP0SKa%}Tq{4a%%t+g7mo@Y*63?{rC34nP{3aw0cI zpy}yX`04*`#jPn+hTXwbOPJYuu~8MibCQQ&HG-3KmDap@iZa3XhO9lf+Bb8e*YQWl zIoebl$xMVZPD}|l%>IAueP>XU?G~-{D!q45iu58KDI%bP6p_$NfKUSxLX{@HgNih1 zDq^9A7J4rMf}kQ0dJ~W?AU(i+!S9^&opa{S+@JTynR#_0&Lm;K`&oPKwb%2!?muhW zj%kAA(dc0Mt~dZvT5nR>%$O9vdA!*7jPBQ2@tUJR62THow{^lNu_UgHLTc%gI@heF z(mkBVxt{Uv2YwLk)~sbd{TG*osI~VxSLj&pyAoFbo^*0mYkNLp$l_=-yB6-nciFZH z+Cr$H2ILIT$T5HXiMzJdlEo$rtg&Nvp`G)X<`?E>gtsNXcQ(C36nkJPI71ikAv)Ue zgS7;_B6R6s24cunRDRlhavSshWOa*ufSR*L)fV$w)CsqzqQA{c#`V_PX40k-C~G*x z6uqt`pK$fr2&-Mcu|^7Tpl$N`ibteH=>@JR7GtgCas9X7WDfEG1HS7ot#lG|#Oo>p7vE*-6sW2ODJt{sZ4`JE6(;>h#Cbe$af+SbgUQnDuFvMIg zL$7Z?m;fF%DgyGI9RdX%GC)!CQ0YDIH?{qm9uhI=w-$BeA(|b-=s*Kz5W715yo4!T z2@t?&ANPvVGtJ^}lel1Jkm!P-^X74nrRj+4={4$x^H#Xq+Sk3byGgbXq?vhnV5Epu zMbDC5e1FvOlOGp#l`52m=QY3>14yPy3k(09w5XEM&NjZ5lIe)#U(1hqbRCj6b!6Jm zuQzujw9OucE8_SYxsFo(jd4BxLS2;RLw@i?AV4fhx8<&*D- z!XPHpP$#Dzj-cNL4F}C98(&cz9h2IfpfXdpVIwLxFl+y88BR_NIX}_4$NE`$t3ltF zu-e}S3OVzl-5;Dx>Jl{Hm>PK(xJ}f}DEMq4AsyD0h2hpUah@?iA5>CWFwB#0QrFKV zynxIw5cSWq`Xr2Dp-uEq9^w+!_5zBjrJmX76=YXJ)oo!S7;{?al8b9G-l-=mVtP)p z;qeUIO?%L+N)o(Ror<)X7R!{0{HMhy&NX7-;yKS26z-<~Lkf7rW9VWUwlY5ztbL7~JT z-ey>Q#xEG(wydIx;ECuF&iq9qeP(nC zi%|M-O_kd3s8sYMGJ`(`t@MVuuR4w;2JNG25#=Uv!X;X12Vm~l$E18~_iz~+&hnFe z&&7&rhQ#Y7pUS(_giT$v8N`rjAZV|tA?x=P?`4{Ao)?Q{2J$jjL2SGeSq&f&Q)c8U1 zmou&=lbZ@Nkb!QK-LZ_xAFSHk6rDf@W$o?ln_6>je7v>&UH4=~FWALZ>oHO~wPt~3 z8$j23Pz;(!{Y!*Vv`{+CTt~2}_Q@D#KVxMW{T9PeNiI~(e#;5K0}3EpwQ5E9*2oqr zT;B*%*j8}IplSAd+8oEy@?CLZrrPkF60^GTkzz}`c&=hs7nk!@c|2TUv~TQYJW+v> zT-UVmx%ZnUVBp&_zEJj}(5&kE)2Z4M&9wyYsG{@-Myzon{MH4jd>3Rfg%@aJ?0Z*~ z{=p9za387mTqLaOJ*wGx+t6Qv3wpct^$jJJMMH(<^}rJjCpL`hF|`k6B$aHxI(;80HiZyTvPT^j^H4eEzz5_(rm^&B#6xBc$K+dQ ziffok)RG<9{Z(ZB@%%_RJS%7BNp#NCPHiHeR!M!DP&(LLC%hI~MR*^{ptI>=-d~jg z?bjk9H?#oh!p3mcruPEYIG_|YT@m_jH@iwCh94dFFpo7Kn z!5-3fQ4p|Fnd+BCbrTkUXNW@|GQJ3HF21h(!06!x+TFek_L{HS#XtUj-G6muSy*Dj z*Xi(Ckl#e~M&{MQDu4Rj9hnOtzlU1DGXy=J* z6&x_&lMR(kUDx%Q^1gL>M?&S*RB+nZ&vldfGA)N ziUGF$5WFovJ5vUxWrNW+#ov(7F&AI#?+EHJ$96YERgjSKG$s7@Ua&fOZ!^9PC{b>E58x``cq& zf?=s>!Er7g_`KvHgf4Y1u{*ZEk4rSXRd}pnMuA&&O^Ni4sXfQID$KNYoMl2PPC?^Z zxQv{VeamD;ckbq`A(mCGl9IZ%v@#PgI$f-C|7gRcu9(`~QxlJnZXi;Zrt&7SKaiEY z>X&@(MV+aU!QZgu5@dQFTp4;w$>!gx+_XF7^ZAu)@e6op9ozd~s|cf|yfS}a0{c_G zZ51LjP$Qj1C^L4o!M$~wD1#{C^@GcH(BT%2F6;eP#WfWN=|64DYcJx2-M)tkR}CI$ zsNy@Qgw7_*c6$-exmbpW1*FbohYDj}b$&g(UwLqt`Q$~a8w9oyRAXsa&DCt!bTDwlw3CUW&`#7}= z&0t4gWdg+ezA#-Jc(Fo~cqGbBeP0|TIwA9$yy#PsiJ_%DNYva}J6+^z7vwXBK}tk) zr~*=XK5a~1t3?i6|P4R&Sz@u%wIYLMV*Qcf}_Hh?-hP zw{M&OMc9KXSR)^Tgswbft0?yT!AY{in{uPr)&c3U?OE&*wYwiQ(RUC$rdeKL0=Wee z?LcNgCK;qmBS~J5ki#Nteq}aVT0Mn zH_$&+*%-Y67RQj<)07)nEiITSDJaQJq^Ph6&%pGV!m9{zVHa2oT5hymM3U&3Xx11X zx0K0PHk>%ow$wly(<2^XKiNk^U2Y;wRZKAPKvPpBH*UOn!@Q(m%fWTM@oOKNumt&O z%;nW;36yTW;;TXo`V}{qx^diaXE#V(sH0yWA;LG`S56lUD6BaR>t9MglsF;?jNQU7 zI_!2XnuWBCVm*y_s3*}WK3lnDZs@O9F?>>Bkq6#LhdmZ(VjbIrpA0_8)HJE&RtNoL zdz98}d3CL@FmuH3OG)j1_@#hX0Q*pw2K=7?cIk8B=#ZSPekofI&r)%c&GrvB0=pxa zY99OLHHGY+Y_xvC(eYt0d@*oQFGHQLx0bnkjyg{ZaBSRDUgii#=hwx5w1 zzZDbCOB6?F!b}m;d;|`^v)M$aF14H)05k(=MBd zZ`@SBmp_UI?rmT(Upk5&i{+dcOaBLh5MalhK5^8g?tJv4&DBzgre+&bj(|7^a(W>1n|v_oRyn^1Z|{Q>6rl%Cmv zY6`D_C?Es@5J8t_z$FXN-zdbBado0RJlL2iRXQ)ACg&Si$b_5)P7r~|Hj^mKn*$>O z#3!7W8_7AwtN#L*QU_-TUx)yzH>fWVwCUxh@i2gV|IQY=d7rMdZJN|rw(LGpq*J`< zzHh;tyBRXBT(b*LYj62|-KMlSj`5NWXtxGwNaQr*H-6Zc8W{#^4)9h>N;o9_OIQ)E zD?IuN_=i^Wig8tMsiI-L6>pwXPc*|DHpVJPb!`XzsWd0rJCNx)iHTJGx15uek84ZJYX;IpEW_ZF6U=wzA~Pv9 zz!x=KK;n{TrDH^jRxg72x9g=KPV>_!Ru=r-@S*xR=CVlV_KAZTciF9mG22g=&QEU= z2G_9(-oJfbcCSJ*#SUp7mk(ULqY*ClRK+ytDSl(Ylk|_%e*mNM=@mMfKW)lw{BL46 zehW~sh9cI>QJghz+PGsX`_shC9m0uKusx59TUurqM9i3C241naLeI}mM@C19%1sh4 zbO1S7Gmh%xdIjyUL5MZTEpZm-g=T0w_#oOR(?uarRiA+V$13C@s08q~xAqF;@Z%pWl-dyF=+-SbF zJSLXwRMin3LIg7{k{&6m1cEnFYRL|=v~**+~mzuyylOl;d%Lm(w@)iVFV(7z|;{hTZBuSPF)?DuZuRgt|CMZ}wn=IX}>2mV0$ z?B-^v!^R>89ywgx8#w~}$#l9g>?goZ)fxasNA3?SZdKjil#!y2R!Ac8tCOc#Q=+wy z@ey_B`>yBxr`yZey=cdFYo1=YSQx)FzY%L9!bSljQwce4SzO2R9;=r&eA40IGwKR+gaK|EkeLIs@AKsqp&_R2B0j+^TJ-c|DPcBE(g z!B)9b(6u{|-DfS7=FSv$B^4YNOt_V^k&!#1);3Y1(q@oY-5B(~QerClRk_F#ZVY;! zD(Y*kr>W$x8=~6Rqt^#E94DsqWXD=<@}$2T5wur^WBTCJjlf8jOtjS}?}S@8-ke4V zQQm~fmpVsN82S8(>%%|o?I%`H>VJSIRcJej4GZk?jMWKdBzep@Z_miJ3@Y|>a@w!V zvSvd83tN4S??6Cp$Olv*c@0(EY56@^QTd}F$tyH|)2lOP_ELLo`F=#)uNW0%EAet{OJjs%>jG|TF|M^C0Jv1l2q(ai2btDf$ z#wc9%e#yZ+u0(vo%-n6RJ#yr0IjXR*2q087xL2n>ns<;dI)tb7GklV}T;({xD#ru< zXwO<1(f@(Af9B-OKoViJa+gpYbZinHgDu}Y0;Hl}#)mtE=?nO^e#q|&y zS+7YON_KzZ-Nc^sJ$8wMqoLe+sojpDV6f#SSSsPt{CXk|9Km_n9E7H*13gkohp90& z01B^EaZ_#pC!Jst?$b=@<|2I(KZi5Lw-*DO%houV5L;6|0bGrREG1P}S#@jT#hQtW zV$^;{j%7TOj7;t6<6=;k4^`s_F-WA*$9Hip6;|gcBFBH7xglRSNt#R*H`Wio^)3>B z6VCibu(A4`!e@%9I1#C2mha#gEn}7&H9x+Fk4%;K)<>I(5WvO+A|OB~LKPJW2&}j; zGhrF~7Wvw?VE9jqteIC;M{ZYv=JY=FYh62om?>05LW`SFjR-$oYGAg&qQ2Y9b zx~lW@w0+oOF}-8%kBdOQrUOO~lz+6>%Kz40#bLOCGYekq>kAXg?t`vDxt8BO4W>PF ze+INSSM6%cNGiOL&7--vFE-uO9@gge$3q4Nz{%{tbcsw;|1rvtC-GQe|0A6p;eS+9 z6+w~XxWi11EE7|E)69XB>bPhos^P|n9DCjfYanIW=okB6%|Y#Dk=SPFxAV zSfRqo!At@Y&9{yc5uo(-8GDb~tX{pV0+KJPbgCl1UCyoDon#jHZj?qH@1wdDzFoCL z2UUg|!ofsb80N*<3DGlgR6*87)C$L@qF?l4G7t&4Ql%CQ@mDdADRXgPV@GP{4lFo(8}iE3 zz+bHbmp}Puasn^zr(8Kxu7)FqO2+~dy-^KtBv?)!nm2iNZ|&#Smzifv@802GWZV@T z-8_HXX{{t>Nl^w8Ka|G1%dtE_S%G;wNE{un6$`9*sdUxD{b!wm)*U862}Lh>Q=Z!h z^;QlB^L2u&L6%04-KA=Rw~_}HZGjf2La9&1g{j=i+2msC+t~%s&@rs1t81xd=HlGQ zOFL6d5eClgINQU@j5`IXS2>V76=qPhKc=2?1DV_QL_1APYm6l3n}Dc#W`1vLastKN zBn~vbu8l)J&-CsHWNg$e!pz0!Gg9PDkt zRREvuczeNfVySJ!qKtTlYd)yR?rre;;1$*X8yn}sEzso3)*)M-eBZE%A)a$23URQW zK7|C#ygGn1jZ;#ba$$6(45C_k`t}aqn+__)J}`iSBE!wSM|Vyc7k@C~#sMdU5{dx7~fQWhQEIb#K2q zA#69B#SC9)x1BgTBD@!1#YFl zKzjm7-(29mXVH>kcX*4ZUf_j;lq)(2qiIJNT{}Gc(Qb6MHFP!IcYhogU>lC@Rv4cc! zV3&528|K@dhwpdgSXY&r7z0A%c1j3p@zx^I*x!bL=T4eKmYhp>J~8(iJ`up#dO80H z{MUT~%n-<)ehtm-i$sjOa^^r8U>kK@q#xcj+~(IWwxCr~Som#!W8$&OQLkRfhX&L` zOueU{y&RRlM2Npe-BogO3~*G9T{I;p35b+zK!c~tW_Z|WWNgT_rRkhPC?0Usj6aEg zsS$SbJ-p$5TvzQi2Vn_l2SjM2$EINeGxaz+pgh%KSdh5=AyvlQs~&A_o{+jd+bpzl zL%`q>a=R5CM(E*PRqZ-5KJNWt>;pjqh=blA;uNnMpZnSsN_x$b3xQhSKM2V+tGLa7 z9uT#UX~^|6o^3$Gf_LjnM#rY2w~(s%zEGDhkWBgJL3HFw%3q_^XC)zfC($buA3hnj zo_Gv)@COp2Nc_fHbbW)~*9VgL=^g6Ob6@tR9xi~K@8eRtRtUs6g{w7|L3ZbZQ~$k^ zS~F8Uz2qtX#ljK%qlS3YW*D*9*5^P^<-J{7 zT1pXCDj6_)b|NBQi!yuFZfC4P`c=RozgC!9Z){dIZ!h@~M)k9HaSIm8TCpheqOijL z9R;nb(ML!|i_$m8^5@*d=m8{ugY4_(d#=tu_KXR=O=42fz}b!EpB-+}MG??y9frEj zsm$M=!HqPts3a zk;({E)KCT;`F~vFKEVzQCeH;vnRRXm+S*`XO^h_B%kDdVurxl$IpEIj`s^Z7@Wj>; z+G8UckJH}X*W5T;y|0U1|Iq(_816U^JZa{NOEd9Hn$X|4)+>VQFP_p{*NQCt`Vw=x zI_hgmGht}uvr^D@-%inYGa^RVVRvbea-K6}-B$*8dyF?-iE_R&jtlV6OeEPzR}zp- zZ1jGpnXs9m4%p0e0~we~Bf|j6tRu26&Qv(JbN>|#8p~YshB`tBWL^~{u_^%#{~BZT zGJQ^|KR*FlL8=%>|DABX?Q|JKo8$QA=}T!f3ncW26uMB?&mc@()0JSWsK?I^&m)+r z!}Vr%Z1i{voYi?(PWdjiS;mduelP22q!%s=wat4P{h8qP6xdYb@xGl7-CwS_f97iF zjcZiZC={~i2U@_oz1ymj$_MUY=+nkVFsE=2+W;9A@i}TlZ^RuLV`}z;(F%l$_w8&4 z9lH^B_nI$gDm>*%$oW`w{aNc?*?@}aBPEi zf-RTG(^_@Wpqn8I^)ECM?x$+fsNpvqE@FP*H@Ef=7cd;VPjkxWye5E?!`S8gzEE%| z(Y*uwVG1TwfXl8jy#-5If<%g%G!=7BK&E}q@sQqYGOl?u4*6eM8V(z)ffK8U1{UU% zFdVe#v~BG(e5_n2M7=|T7(I{Kkpyq!%lhQME}qmxuZo1iHMP*i^lh{ zTuIJmZNhgxq|C0+ch#sk~BVF64-{_0e!-|=~f zgPpfJsk+jY%W1g6Fp3qU%H^lDNMFCQsrmzuwuXM@!!dYNSxFLSkWLQEQ6Df8>3;z9 zn`IT$Iy***dqwW;$-&2K$yJ zLY2+U$}xSx$tB|XNVgM;wXLlhjd+H!Z@k)252qgBbYZfPFH3`D#*zzyj#Z!a9s|TN z+N~pM&%{~S-O}FqDCzsJfuVFChMo9z`W{#}XrZ+>Mzw<7SQ})=Rc%{~>6%Mm*^*<- zwJ-i@W;r(qpqa0zOs37tjVlv&$b0GwG){F#t_7eABVVh|b$!w@VX5a?tJeYVBPnqN zZsBhoN+r^M0j{-;jT$mhxj}|1vDQ`FYg8E`zUliz}68F(@3R5!*1^4hf%{lQRO>h;viwxs2(W(VgZ*ZSp;}x zUn`#~mRm_l$u^*#2zro9kIY|#uIb&hE$XY4miaz@zt{p9I0lTe83={aQ;i?tL*B&` zE4d#qm)b9(Y^{XQWSER+!Xh$cosb^c_qPlS}zPRiC>JI{Zrv(sTHM8)}AC+|5>-9Uqc>K4e z8xy{m+r^|loAS$M>Oq!VxPU2|VBy#J__$3ZfQnQv&1V@`$>G}l*E=0zfl+gHyFQ=eYfU%&2?vf< z-LdI`+Kn|GGe^#av;_-j3iAUKb#*&{!|y=QfWT}lN>HU6=DBho!3)?{{^tGd1^vC8~3zeRyPgDi2J%|Rd;6E-}o?i+* zua(_v=9U{I5|L~|?(8Q#Gfh5URbl}f(w@rLXcpB?vC6?75-uiLTXq|ttbh5e&h^xs zUR4~lj{`=OPPf_PVI7>UkNAx#uRj_7L6!HhKvO@254vy(0lq~YlZf`hi+VCKVA)V& zH^|ZOvyRcs$cPsod}_zIIFfRfK)CEY$wn-t0gTJKfIYwmTUU`olg;oN_OAO**5@-H zpm43^rkxi?NUz{qAk_{*r&#<_bcuMmrGpaW7T!HYOe&&Di^iu`77~7qDjQ5t5f>LT z3`#b8;GHNfBQxF}84vwBuOahzTFKR!q6-4%)lbnkB2;N|xH_<$0Fuk=6cI~?fP(-x zmOA-|(_b+XYUQHJI>VQSLV&OS9J;WYi#=~J8vd)l{>Lg8@WvJ5jv9BhZoLoTjJ)!e z+?*<+D6K9P?Wbcb__hpz96C?geSWjX#gq+PY8BPetAX9qEWNB%S*?=AU?jSk{OigI z?`+O&$+NQo{-2IHUlL%~OnisdPk;vW*@uchzFi$wKni_-wS*Lyeq^}dzBGX8d>-!j zdCWy+PL4C`{2|AIB&M~Nlv(B#Isa4K>eMU}(%opsC@?8X?(uITv8ML=`sDGEEo`!p zu`S^z==b0{SdI6-)&}pOse{mRfp8ps?{V}CVhsaz_`QfkTN_xY$}fryOH~}-VnZ;D36&|FG88NbBFYDplwU-d_swV=dz$ zY9{+3;;B9c2o1gu-?G0X48gK*{`j4hWp>9yx8e7r>+kI6;vT<22-9U<9mAu_Ic4mm zESLX$Hxba25wAIGrRy1hMx`SoZ!JWopUkd(VtPcVI zl+Q!hnk}$GG^mM(AGMhT*xPr4N=@8dM~mD0!1N69UAO1bhU^J~ zBP1pSm}xzWAAy{urK>TdmD4P&uMjS#>cGI$(C}KPgZJIC_C6OQP!x7%_Rm_<<7) z*MCTjUT9o=_qa;bi0_!t#TZN)ff(AtEVorHmhg>*l}&p4Nh-dDd&z?Iget?}^$kzf z=d?JGfdAOM*|q?1gE1Ao&=5&wY6GmAMD^%(4{KqnSRTMd37rBP z;5x)-)T@Fs^>o1i*k|fKJ!MX`e1Gf{Xtp}xcq~$MeDO>F?Ru#kYEXo5m3x>q>ckK9;f;oY?^h<)cT#8n%bo$;p&v4)vFT!5=eT#F>( zt#9pT7Q~COXQ%Xc93XZ)Qn=vr`*!EILqruvQQrpXeo>68i5~;-2|pqMPt%|leF(*{`gTCBd zi%LGFxBvP&9;769qdZ9G*1iEhpyhsQnqWZuvHkHZ3ae_tKwf^z{H))zGPy0K_YN0f z1GWMkCL$yIc-l5V(Z>`5slCsv0h!#d`1Hvix`rMfSAZs)(*Kwf1a>yP?iL!7|H@=M zE5BsX)UFU=E7w^t@jL_+H;?NZeEcA6nczJ6DD+Aw5B_*LnGnF%0A3DQMFYM(1}aKu zfRWLERFn*Fe1W7Vtal!+6|*ZcTZ9|=zA7Os`4P|Z;b0Q!u4~intl&sIpn#I8+!*lF zflt_ez}7H|;wke^@C=;x|+^Db;<1BJ)drn;i7v z7Gx&nsqFGp!KH8qIC1U*?A(ypI{l)yTnSYTr;7XNmqz<4F}1Z#&fEOZS7(R*2OD~x zC|jVYm^?%oZ`fFggAzIZE~B`*TBOO$v{L%!h&ek*@WN>pCkUWhw^3g^JZy|X@4NTy z94r~3loS}h=t-j;xv-P^^)I;wF$`6FJ#1LHktHr6(^@6&^x0#ox!#Mlr`k((IZm{9 z2N^xOM3sMbE5Os4U-zuDKo>!diW0KESJ&5VvUCO-4D?gA?KPR&u|bldCl5$ucWfT`t$XU z;O~27nL)w?4sV|NiXD$9-?K;~(Ytir0eaB|rIA`0(zgVXaEE3#Eo~Cl^JY7>U#;|e zbLoEe%BOa)y7+v#c%D*wNfNLr&o6UeG=PWf_>qR$tN12}I4z)kQ$DGm(fu`8 zCVhK9ydxn4%I^>BXGe;}kW=`xDe&8nG1jXEKBEI>i!NrQB(2vjy_vikK)zsLK)!sM z_^o{6M<)5 zXxn#d_P;+%-2j)ZBm@a3lK(VpRfM)YJ-<;%}+NSCx%E&al4R-+6AS^DF5SdEtmZucxmhV7c7a_5JwpL2W;%_gLN9F62wkt zV#Ki4@gz;DRBA7iNx0=6YlSlBWOa}w-#>7a`^-ej&O{MOc^E%wV^nkAy&b~sW6sqS zptT}nC=HMeISu@??x-(i!L&5P0aQg7%JCHX*WxJEIbw*9W&7C%h$1*oB3sbAqsU zXmo9;&r&VuEiC-5+UrCbt0~D$>a^Uf?JxcP+P#>7O^>8$_Dgm6b2XXHum>79S#Dvb zr-K*52*^0J9baDF&=1*H>H$>WG}NEjyxVgzsQ>#FnyEd@64Uppm_uc-8-EThj&oq4 zBT}kaOA;&(mFc~L5W&4pk?%u?#1m=YM5)~A&yQI_b-$Tx{bM?dI?b%f_5oiyta?HnQ)# z7jOSD-d_T$4N~c?_Lb^FflE^NU+vDn?)^Xh3!ZUBqj9%{<#v%2cv;P9PY0u562LX@ z9rDupIEIJng+XfoF_Pf3Kij_e_)&mjg102^tjMXJiO9c&;P2u1-|PQH;C~VLUj+Ua zf&WF||Gx-iIN&~a7PbDbZQy@vcK_b^0_KzjsJk(6Iv$ z;3bOCp|9VUyx<{tDl)#Wl;5O*xNDBlB;1CV)~Wy35*eEEz=l9nPC;W|Ou#YG7^KpE zDU2nzQoUL~PKChBjtFW@P9bd{U&0EBU+NjD32Oa&OYqO$;Q#&t&><9hcO8bDOPt7! zAH&_Hac}r?S>x-{1A3Y+y}zaL|LZ&6Pgj*KJiBIcU5i#%9cw1GfwGd5I#hLtNV;s= zlV}9g8|rSq%O>s@z@^D}uz@m&pU*Y5d2TV{&6=RClvZIL+b5lc>LN zU{EFkKuaioK>X-!@3O8zrTmB-z9PS+70sFYipPy7P!t+01dg|%M{FQU5TC_$YZF^{ z>b&p%u$Fo-vaMj5a*KI+oB2QsaaH_`e)ypYC6oxtzs`twfCwyoCUJAEM{?nawC}~z zu6%~*HEksA+lt|pgPvjE+qxQZxO>FesmilkH?|;u?7sxKfx*>!1{$1q6GlZt7ss`BP;rG->08^3#UIeZ*+%D4gG(^p`@{Qgt%8l1Q zU6eQio-JD~rA(W2@4t-Xx>k==-Nvx}PiwW^J=0eA@+H4K9+p z;TdmXh)?*|6A{G1d5WyD!Be>@VwLIpf)O|3;LAJ7qSNFlXgyWCRBYg15+-1O*LaF6 zCF?$?^v$pIJ8Ed5T5shdSo*{`E?O2d_hv{ovG8H*%#_qLc@A70jnNb9= zu1h0SqJubrP*-NE3b7opmW5(nVY-KDg;{PJH--n*_Ac!9p%1xR#l&wU^&RlOcSY0S zD^mu@CRo4lBq;slGiIfOYS6qYsbB29?Z^ClV0+UQd``5F%Vg}6SsXuqr}^ek=~GLB z6Jrbt+=19;Ta(Pq_eh#hcvb^H;Ql38K>d+!c zdff=o5*|b`gxcLS6ObA zlll2{BLb!)J)AT;$4U1~K@p5q{}yW%z43$7O{R?_nmv?$p;l7jT-9C-DwPmYr603^ zNtrZmWm;leR5mH!Q=?AtNtN5RU_yPt4m=OxO8LAEpJmEfX|O5wB?W!7J8Ik-X{G4! zX;%Q#dSlf&($tdlT1}E|Cj+zlw~XcWPJ~QkWa$qSCI+9R;23jFlB|V3=zKum5o-Z| z>mLsu4vQ}d6M6dlYKY2yE9vR!?Ga}fw*P)XOE$w5L9ZtOMCz3bNAbL5+=zj#(bR_5~h+V&L=s zC0+IF);`(!9yihhxQuU;bi%(aup-XahEt0kc;H5CyoK3S&OifXob74y(C zQSK-bR-5YSSaNH!0J8P_O#F^d zs{KCe_|o!}-qmU*R#y3N(0;~(B-TX91S%3Qo^M01pL69b^8cE_U%0gm!=P=jQ+}jK zoF%qQovx-cg_m&pbtMzpeqX(Xr`|T^3&FQF{VK>!`$0_0F1=Z9n-M`*eRvZ#?_qe= z1P+qdo_G3uDK8CSjYv8bNE>$5|K0!|Q~~`ki3y^eNmjwLGv}M<&{~QVZ#kbmA_D(V zL%Gh-Mk$YeDKj4=j

mbw1Ag}yxjIBmN)_t;lH_xK@>cd&Qf=SCfsk_#DoX0q|+yjvfA~WUGjRyd<2REMb39w032&cETclJj&d3jPW?~*E?jhz^+N@^}zzmjTx40 zj+(zLc9l2sg9jdTH4XSr54KrY?jB`pFE-e}7fRzs$G1&ZPbso&IWlU6unVUPY2j)( zi=J~j+6$)*Yc*9&Nmm>ZJ%8-hU5!$lG*=xfyURF#p7iTv`QeHf%I>unb%qo^pQOZ( z*Wa%p*q0P?DAM(Ln(-ZYcho+=b{SB&oIKUd!%KYV6IsQ-i(}olVKjA_JcT55ioG|7 z_cD`q4vnp}Y&MT-u7aC8la}RlfAfdRm4AH&d-%rM&mmi8rK1IvS<0UMw2h=5PihVMrJ}47Qnr5gL2{-SNq=K+A69Xx@PD#s_&Gz0=FL`r0i1;bF#1+DZYnj! z)8!5$f~p3(ne#L5{G9VJJ7ka&O04^kAk(f>%u~{m8%Ps4UqC-hORRr*IgeD}XC$yH z(l^k#y;XB10`Ydd#_5*CaOiTwZItTc?t9A1%52v2jPDTt8jTe;8)MYc&{cdpgChjhJJaJ*G)x`SD z;Gh_>5a?8&$tpxZT~6T|%a1;!_Fk-5{#8m7Z>~j>wSsLsl>y<*n@J%c5+K z^(d;jfr1du^%QYZ*E6DSnZuPp*S%}yI3pV>`EQDj96LCx2*X_8bgGYRZ9{mh*l($gfH7ETmxqWi)T!KCC zb3l1|a$bs9gizYBP*a6z`Ze+CEzZzwWq+2X)w?0IP@bf`6^4v5POy9e+(*9M%hl$r z+QN_TAYH9%57_a?bzT2wr#@d{Zg^XaEy{U)0w?PUzsaP&`S+CPoom?2Cdn&j zQ=rO?xOdIFltL_Y;?Y)}|Z$~z*(+*#g_ z`-FO!-7o*>Km%M_A;UFCipfOWUh0!V-&i^m@X0n=KZ25>{Rk7tG3n(kPGJwem$Z`% zhBpz9D1A+7!gfs#T1k)sEfTO{c=YX*yG~Wh6~Z&W@f?(d;PRtDl=9}4{>39?UIxX? ze8HA##-P%S(ZbWWH;f5Sb>6(pQ!zgLV8u)lG4qP|TFZp(tA-IusU1Y3XyUFTXCzE# zR&jsX{^!nBo_@!oE%)|N?GJcV;MZ#dUvRz+L2%fy1%ns-@LoF zZKcAkospN*Fx}AfTiU8oyM-Bsoy-!f$5r!4DNv=~GEaGH zF}B`cu1zfb;K_URzG8dx^<8+@y;Fz-tCuh?{FN#K!{iw!hz2 z)A1!tV8sMcmSW;xoUHrZ z`&&y~_nQM8OK!n_#0F5=c}s=0-vJaDI@>zHPIf8& zWZUA7&L5XjPFky4-Y?NxWW>X>VhyoUWtFN_n#&2%)|_{<8fRyA9)k72GEN%zd6cGi zpJQ?FzRT`|vAhmR04Y03abB_o(Wk;$Qa=8DBrnKP9M|0l2Ty zzH#PlA>)2UY7fX`ujkHrGqQCzm9=*g^P4vp7Z0LoVd-3z4HT!c%kr5s1oe&T#G?hf zR-0W?IsKk>dv|B0+ERCcbN*!go%?sY6TE!yzCSbBgNWjs34u!kk9V7Hs`U5^q$dx0 z&m8UfmE}F-#kzIYc}{N>lx@#vo@tAHrYs%k@#RcHW64)M@XvHJ8b%bqZ4cNTiEe-x zGrLsSVOXribbOOiV~B;)X$j(XOZq_^Ntp1cSUfoRoaO4n$LmLjL=xIJGaW2wapz5VcMHm?h6Q7y0^eqnQbZV8!Vbf zdxh;Iq(1ht2#=??M}g~BS5Ujtvz;;UGu7e2=A-PFHo&K z9O4X7w0?B4s6E&ocpZ?C0;qDkh&fVrk=v^}NVc=>HFA?;X|T*KG?Y1QL4aMVg2d0SQHV6>Nxrf(S?p zU8MI8L1_xot8_(CdhaCy0@8vY9qGL#^p=Dh{k`w`?m732Z=8GoVT^~2v7cSmoNKPN z_OmzYC|&f~s?78rwy+ybWvVbT?rWERTg%C--B>m_Gd|DY*@&!E|Cd5)g5U z=iIq0B$|>;woLx&6U$ZBi)RL$M5oGX$gwuKKGaJ&G)6578%D)gC}Lr9GI?!{>pIOhPuE!d^fnM*8EvuF_W1*6LzkfT zN0;t18&iSU3%2}*<_w8_#*2&I){h-Rb0+*5mmAUc+RGRntL*I=)4cHpGFFq8OQMB- z*E$V%r8T5aFnVv$-LAEbYNO%Vp5U?4&Afh9X4fS{{zUiH_+gYVn;1#fKLYzrkzN_F{dt2-GNRn;(1)DT1gtFwYK-7>EcYP1!hI zxz6=`(AA}qwkw3xY|M}vLKigxcAnyx#^0aSlQBPKo9HNiKA~YAaQah`&5I)XY;r;F zgp62*c9~svj$$b_;c2WpoGz@wQ8}dI(SF}*>AhvPs_XSA9*tqLC(At$=TE7_AsCS8 z*be1{2Aq~fx$ZJlEU3~`uoh?Ux`X~!2p?=XcX?$ixos^vTjT+YFri+8zjJ~_pU|?bCudLND+&c+2w>s=DzaAa)y7m%A8m4?YSuWB9 z&y2n{?J3&mHF08YW%?!Kg}-rwCn?tMJeN&L8C?KBFfV&G+P-cIY@$5Y;Pfdq5HWr7 zM+p*kN6`y}DUB-HlV&V2w<5HDeRm~t=J`y zq2!}w_tsSJ?44}}t6#um@ZI!POdK7q{oe3~E{yJx@tUN~u)!q6n~mDfoZWJyh59)D zs>dQ!tFij?$BX#`=mU z{Kq2;Mb1|ynXLjjM+~(ASB{m-@0;TlXsHW+|3;gH9LQ%HnP=@coLt?jG6fG>x)gUb zq<-~U8gOR3z*+|uSm5miH{+vzOUEHAu5xtOU_T^T_B-s3nl5XarhT&rHuH^b^c6|z z_Fq#nV6Wvo7EjAays!_I&FK`Izr&7hvsgXmbGw;(BD4Wm+X|wXCS961WfVP*_n>TJ zct*B_okN*xx4$=sg}YL}k8zK^1YGzNCU)ZD0F@5hWCuB9 z*0K|KPaiQOQ0NGe{g^6}Gn@l`v}NsDM{NhWYe1`9_Z~3Ex?v{hdh=C{56XO(Qp1p{ z<-L!sZ(nNn5RINQ`q@I(WqagUE)T~#9bJvK{48(I z-@)rbt2E-)@R8uC6JnMkjbqL#8zh>0oI+(qKCZaovDP}T#aoHsI^2==RGu$eNAU;~kfA8V@e;X}FBYgJ6CFu(hA?b=!E{ zEH@)C6Al*L290g^X>)qW)||LXfVA(h%DU>c$AZMC30;tyDhi4(r#U`nzS);9%`!X# z$^OcVW*|%c9%ko8E~K%X{6nwJ716mCQpkn52p2>k9eTfYsLA7en?^Qwp93N^7j|~W zf{)B0GpEis&OWipx8@9*?z`BH?tDbePSbGvU0<)(XwH`rg_l=zU^;5i` z1A|PB;381@pg9~RL}cKMT_u3Vi>#PKinbdPClmpFUuPqm{+jM{10h7{(S4Ei`2!Ap zu=(xVX#=b0!oouXNdKtxG~6~jbuhrX++mmLPNSRG)d1Ifd_h4uhx?-Ft!4$Yyz|wxN|a%LvN-b$wDWzrTWDD=R#eGtaO&I{JH$GM>KXSgA~n_W-6Q?&D!!^_ zhwdDe{GzpyNpS|&Zgp~fyi(|;8_{vIy6FYQtmN;Sjc)UkZ%QQoRM9A`>Wo#_P*8(e zcSun;8cQ4+sN_BGBes1btxr2A(L8L7(XiW-z3OzO34@E|XAUO#;1l@jk=Cfe8OXFr z_UDFtu<>zyP8=Hyq-&Ky%?lK6Qp|-B>3k+{o>JGhxcFBG;KA?RdH+bea?_+VziC4U7 zYviPDTSlH|N0t53@g6&BVW#_OV@{rEn-(Rsqw*gdxBLso_QmZmt3=W6WxZk#raEHR zOm}Og^ME;*(uq0!l$}y-@=oXD{okROJHMX}?7Z_f85?khuF=8T z;~|!K&eNEsLw>l(Tp700qyFD$b*FA)UY$C<8(K8%c+dj%_q8A$KYv4Nw(zN{n5$y~ zb>YN8?L|;znW(ia_wTc)Qucqyiy(*)Th7OS0*fm!<%^~O%UUW^Qzhqs?uwkI-8;Cp z1BxsB{cEX0m)hMwGKA8Njal_qdY8W+u+De!DxklcPHB=hRpNg}p_rB@CRPIV?}1Z% zhcvv;GEuH%YoxFUYxf|<*^Ha7nb!z_it(Y^uirZIKdT}+@$*IfNa5xvX8<5Q@Q>DCPv{@BU}?`y-OwwCw8zs@H-$^Rob35ST%3)m!lWjOyeeS6|)E1)9t zr8gV7$BOo^HuHq!g|t00!i5^8pqbJSn{)|rL;2xML?J_r>iP733^a_ujqeC5h9`Gu zKB=od4t~l&iT5B{fDqHhiQK&PbvPf=qoGP0$9eTS4Zg;7Fg$Ca+8;G@u^Z^TgEn$L z?%%fC>X)rTW%{Clv$hZI{h1uY^$9a;dFcmTLmsL$4hE9M|CccuyF4?v`dRa2OIGZ-a`vxW?Atrl+@?b$VWPTxU_- zmORBK$ zj?CZkj?r{YO$)trYu@6&XfnJP;tpym_TMuajNxi*=}hC&!*v#}jCUZm8~1Zraf`PW zvg?&88=k?J*Y=d-Q)^CSSbRr-_KA7H%!P6}PqOY%Mgqk|A)t>mRkqYn9mY2&1qF;O z2bjoF-21AXt>K$(DVVy_QiWvHlwoN}$$qrN{_4HP%i46$2}NN%Ii15JVFl_Y_v8c+U`kqOMSbN< z@7MdH@SRU#&ODdQ&vLuU$Iz$}d~>nuskpNqxYAVoc}?5SSlQgK33DeF({$Z%SkVk6 znYDf@hR7ob)0e;>?@A8m|LGmx3Pnb6GQYgEIKSUHM=~5rP0uwk_n3LwE$l3p{a4}G1*S*U$A1k0Xe6#!k}c*6;fxE8{ea@1p5I>fN=MQb43^dmHgccruWl?>Y03pxqK+cHbGtvjg18Hw-PrH3b%qm{ zUqdz^-&xQ*Ax(&9tjI)W$j%egvB1>X2S=%2u&<-R%^g(^aQfG&xexCW43h@rh*Bw1 z)=hP#Y}+~XdbSaZSz1SjZ~=@plqo`oDaf|?PFdR%f#;Glx1w&$nhg~Bzsvn8O=Bjb zKF!1(cqisYt<@PuZ0zXSak64;9nU@`@`Q>!ul6u+`mnB3Jjgsm&wKUq8H3zGxY zq@RAZP@(it18?r>S+sOB|J=YaOnEVzt(Zq!Yr^f}!ElXv2^E1TZu1l3ldH>kqVeLi zb|{ZTh;PEfgMj3+rtp@WcHA@tA`iJW$d~fIHnp?Svbas`xXt45V`Py#9I43Ls~>U( zKwFAuDV6*~f?e=M8 zRF&CyW4%6?Cv8)z@Qp4k20NnNLi)uTTJiF%^#wZGN=2JznY;4Vf`q+O>cSCYypwwx zA65wiOlH_nxdLSfkl=-N1!#SJrcM}QWXNX;mCLAz$rP>Ut(4q371m*p&%LBMHE00E z^)5Rl+b4=uaHM4LUgywp;ePLt+Ukcvgr#FBhK6mNqO>goU`8Yb9s^E55|8q*pb3D_ z4?26&j-!_F4?iCj)W0_k4=RmHeS&LrI9~NOY<}2d-`_y@u()CH1e)l#D%L0UN^MJ* zWjJ_FSUvx;>%^&7+6I!P++oiWC1k&-D$wbMtVMnXpkr?%$a1LKh}P#goZsAJ>RSEu zJ-lGI(+0uDkWgxiU}O3iLQmf4W_%AXD3S$>SO7=%?LI|yqCknAzO?(dyCd)q)vth@ z5EZ2g3!jOzgyksTC6sHgG2c40U#2%5bD?!=70y8NqVlx7#YDh%?eD1M@{itfjr%-J zSYYTwIi;c_V1;y|ABG{_@tyo9nc9nJ7-ny|dCS`?V!vH}&v&243 zxe`shDhsPU?~sm2M&tnUH6ZJ zX}bCi)ja6%gY?i|SZQ8}!fx-=1M%n>^>PN)(kA1o4YpE}L*S#;hL)X8lx zO;zR2{Eno|I7b2uphH~cnkwgU*i%m~8r{l(QtOwoZ8q>z0YPx5inQfb=avD#%cvtxvpc*v2H2q<_BM46vzl{lnHz_k z<`BOj^8~|$=r=mjmf{FfM_&~l^!qb$>qDUE`)*b*8AXjx!IhFOl$bz7B|8$Q5S$ji zp~q_vdvnxf5ZqFxgU0Je2Qlm&O0!^DbIoLw%Wq=zkyh#gZ2YvlY^DyZq?R*f(A;c& zz#wz)EK&+^!dXVL3os>`1=Sbmm9eMjiXP8qOL{ilxUs+{vO`u7v6*51DysWmwC@}E z=GI2+ok20Brl9vWarq^i`?DcIVNnHNXHG6{9^Q*S%hV}J==?(>Chf?j7oHpWD{VXq zO}AUpBK;zGJxL#Ju;+}OdVdX2(f`}F7=3QoAmZu0q z*UX&Q6Gs#iZVrugFLf1hquytZ<^;9^AD`k*UTHZFa*5Tyuj-n#71p|a?e;>e4Emj7 zNGl-hVB=J)L^Al+tJE>}uYP*zAxg>ik4bzfXAu3DHY_f#eph_R=P8ycRN}2#;{0tt zM$>=0`znfv8A9Ht4Gb4e=y4~Vt9hW+gLjTgG?R>?NcwT`xcBhK_RT{!DuowGN9|6> zO2+N?GY94NnV#9cFFbdR?_fz7EtptZ`*BnTm@zP7n{OZJFcJHHaz^v?Q4(X54gUuK zv#Z<|Uxo^|K&FO*%Q1AG9RZnq&n@w@=a(GY+ix0Knnh`Ut(uqhMTD&&PLaMfQ(9+T zmwl`U?6!%A?)%jLpq6p{xNVO#MKS{uvvRTGA)oZ96w5eBl3fR*i5*@qL=1HUlUk8s zNM=MG!obb{-d(XVPqeO5tk?7J`dVz_((hw{r_}9GefG6&SAVDv370v89gef~VDuel{?wgU3N4idA2#y@xhOBLrxm`DV$ zGOoPkau{+NHB~Kna={kRnHg}FIEdVVx?DMl0|7!Lvc9?Qfc_ZWh*c=|cJ8_mJlYNZ zzJ9-pMp-Keas`^SlbFB#zBBO!|H+}gKrqB7@KM0!W{X)tUZrBl0bqLk3LxtsG4~O1 zDa40mP-$1SMB{x$oh`@GL}e#R(e$-n=YbhoL6Me9e^RaZ`E0B|$DMlsHX!>nIbuNZ zOS-Cj;*ZBzn7u(Gl>aPpL^0=R&{jX|sn}Hla8t#RAbKM{#RrZW(Ih8Sti z&GI^j(w`j(JtCyR_N+G+UOkY9tY<7wp6H#ccO+JG&~TFVKU%Z{1~MkHK0e)!y)ma| zt(HjcD{z*Q>$a<$MV?79Lospw?Z{qO#W&b%=qxeFD`f~~C@WO;W+M~E*Qd%#q+m&Q zgL{0N>-xs!z0(MW3>)6>XDIJLT7L&qFgQ29{l}Of?Ztu;pTA zmlW7KNkaquKIvv0+}A6WDT{qj7(lTA1E5F5x47YE^L&Wr$4roCK%cU@4^LM%#-9kSbxx*WYKB=g3Y{N%ikdUdp+i&135Y`UOs$2nXe?uz8<~Bky`XYcVJVuc+b7` z9r!Z<>+`7FE)dBjvh>-pg-ump>V`*gs@9?3E8Yav5!ziKhBM!tnY?Ug42ce*Mrf%> zSb?vk>s98N4vH|rN+14F4Ur+Wwz(YHU$x~^QeP>RMWyNmlc~idW7<~CY6J8qTEg$4 zfUU$Xx|@nftNXgw!e%gH8=}0tR$TS!wh?_V+Lhcs_J?|AS;Ui?r$D*vO}Mtt4a&4x z`}93b)b-@!{EGS(x?+Fad)$9{!R+DmGOcs5P%lu8tw5Dv5RLqxqjSLlKPh+JS+rz{ zLAUjKtoRH>)GRFG!*i2U;5_I28UUI+LzE^Aw$_chLrQ?grkvYmGn20o(3wx_(Bv2} ztG!4W1Sv;VT(^ha=sIV!ycD{p-0OC?ZOF<DF8kz$C-7UMBrld{O-pcv<4R-LFPr?&Zld;rf%S~_%%@c49LP0DS^5u( z&-tN!_0{6&Xv2%Tiq)#En17kHm`jblFKpeu-sel{t5BYhzz}C5LzKEz;6o?x8(S)K z?cdcrxvsn5K4APsaxRkEP}Fk4Zts+lgnt`e_sO{s>{OLu`El&)`0r<`E(5y{--wOpbOErli`z)BVk7rqY%O*m=S+eEzP7`?H7o>BmgvJ_&U$Z#C0?LCK;T?~G~s1`)vJ z9#pXQHEP9rEKXWGyd;==^~SNE)mx!M@x$V~-_r;3hT}=UyECpbepf~Svvfs}Nq*gu zO^5u-e+7v`q~{R-fG0jI+K8r&Eq7_}4v|w(Hu#qimZneEj*AucdhooDTzazEIFj^s zgpUzi7jB89ex|z9%+#jZ^Bw2ISDo9r`iUgsi^v-w!Gzv-sYv8}4We2ioGOXjkc{z= z*}mYjcKG!h|#G2;D>i?%2LktdmSB#NzGKb2F3$UcC}^` z906)gVZwhHfO`ZM+p(l?lP|#T;J#436UsoTmk8S{aQkC_QkPFqcJS;03v z94@MI##YWjQ!7DacL_=x($7l1BckRbghcBzOa&5W_C(Ti67J@;#7mE>a=N{_xx5pZ zuXBE94kR=9SSf<|T!>HDR(z5nbQ)wtM5xjh&O!F6%Sl$LV)5)Z4Y<5tW{|O8uD73*+6wE4FH7#J=Ip8G&^(F# zrqQ|kMNn+WorUFXUeGc!6)Pyt9#+!&MwXFqw??yjg5Gk~VD?d28p|+Q`SEPTth73c zg74}`Z!{TYcT=<4t7g&jxT+(lv7Gs{%jqHiFp}3YT&0lfr#1=QRIEiE^0(BzHs<~G zQQ4m~KC#WBH!DeCzumk9IT+c-Uk;W(%CU&fX}%Ic34<_s;V^<6npK}n1ZIRQ0>X{0 z)Ea2XY^t2oSZ@r@rOB}6T3R`VQLChX?v1vMw6}bI`%{tp^f=M94TkR4zhwIYWwa{A zG5e}{<~6%I+f54=8s*|imK=oXGRlYgoM%5=D7YRK8kFAGB-InefvdE)XF9z5@&)|9 zeu}Y=a>HBbfTrZqvD*5fdrQ)atuBLwZ&B2Ew7r`mVNQy(33JkEFmCiie|4tXH78wc zmn3c%9U)1(h7%=$Po^UQSCd$b!#uEUlP)deCHIhEIDLpLJR;#CHDlC?=$pIFN7Y z1a|vC&4kmjIe1x97FtH(fI0?CZdxBF7+6OiNq7B`@h%G10m)CwtF}DJC~mh>89bkA ze%XcVjqM4*W6I-?!WN(*m2~dTWnTvNM9YIX6D+YNwyCudFYY!lzdYJ2yXW&pQaK$(_b-2KUc?tgwsuR1#7Z5e22%~i%$QI% zQyBQVNwbI=68B~xR@@!7r_GT$2!CMTK_0rB##Z;xamUwoYy81=6n7A8uiJgOKgKu= zc@p9OYz@=~h#}bp2H;mB{cmj9Ux*u?yI2_*(N{$$9J08#NN@W6s`*hXk8nrifGmNt z9b^3AkD#9fBZ{5D@EuBWHW$}fOB>q-I}v5glHO7L?F{r)t>74A7d$6afyf}3C7b*g zk8@t!Xovs2(!3Y)7-`>d|1{{OXA4*{sjxZp=!OVE6_SB_ohXyP6prL?x4SYG?}T6& z4qHj6hSJ6S<#>!m1zrO+Y-Q+r5*g#qxZ&1a#9bc!!szv@sQb#VBfV9d59YbNinoMX z;cxM5`Gy(e*UzGwZXKsWrxgq#>B~u{ZzQ5O7<>xeX+6!x+^RQwaE6e+F;c*?GzX%( zQkE%kU?|%T3$Tpw|&@&Ye&$arOwiP8WnRc&F&v-Nt@Y(M&)bjUNa92m_GS%zKR9So} z)xO334oTj-x80!~&t-+|7jh)1^+2Tq*TxqXV3W%1S zc-XqX5Yr~%e!A!>p1slWv#v%)T4N+%P=DZ%YUI4^7U9KHslZl^DT%j#fJC>1LzOk? z9g98ms5^k8r=2pPs%YKMR~=FS^md^FXAT27@O9*Y>hA3xJW629fX z-Qd?H3foMZ-^?UaoN;E^+@CxKtE33Oi`EBh@pLFwMNFM@6<2*)W{6IeXZ4mQp_*rY|CySMfU=~(XW zFxE)U9__`kFQMg{suk}DHNLO%|4o-zzKLat^ozdmJEkd0Srg4B+J3)}gK5-93`%}; zh>%rlH8Yg!h!=rrwkVg^wT!SF$d)L6A}D~ND%SPF7G=vodjS{_FPr`u^=d%m*_Rj$ zAjy~cLD6(U3ot`dd~=RvBT?hmH(dEgL^aypdfc2Lr$hf>&L;i-oaCW0PNrF_&5n(U zJQU*8Z1Ns2?4af4)yg$1ox${r<6e%p=c%N4b<@z~Cl1ji>B)mk&F48c-$e}gu%I*y z&8Aa-3`g*EOubLDULLmWKU#S*S5j(XuY40LwA~-!@;j}F02g~O+>v@e8FF4YIJjN4 z3p1-0)aU}<2FJL< zXMNYBPNPIFZPx9g7!%~B1LbI*o8aqCcfB^4RZ#R!g9aQk`JxS+Z$F{!-gt&X8XFDP zm}HN9rc=$=IJznW3+3>ZCc#{&jV-`(%e=#7w#AmTpv>{?4XNoyxpjfEcneE)54WAh zAun|Vb(XhME5awG+(`%(7v*|W$3~%o>9nxepQ{ z0VmE$nTE+~%bzOoD5yb@;!?yg<~7>-L6sj{Ad*sZK=MaTcdUGoScS?u>NnUxdG3`` ztdPX7m7jd*r9#GOV6TUM4BwfNptTz8}w-1@fTE{;l0jd)J41?-TBUaW|S`f@KA|q2{J9IXc<}9#Jbw z7o3sP2fl#oE`uDICq@dM-}qXTlDloHGkTO7xbOdb`C~S&j0Fcb>pd5&`!-hk8=9K| z-4hV{5m$I3bn>)hpv|`0{0Fn_^j?a=wZoIMCD~)^<72nC-Zm9xQrT*5(QRAXBB+Wb z`G`?wPSGMc}Lg?gu~?LcnZhQ|=6tS#HEZ?@cE3OZB0R0h|@s!Y8@ntdsI%-D~mF z#f)r}E5wMcveAtWy9dfp185IjsXPqS%6{|%(A^;5!b12ifvcuJ%+{F0_ad2@zylzg zp53JQ(=z~4@%~mu7>fJd%rQuH;Yhkkv7`UW(hOT|BVURzn`P2HZ$l})j~H*Vdk7Reig?*Y zEsEwJ6;!&{(67KLj1?* ziQJ*4j^LG$TS1|O3o6}Guafb*W=K=U`(_q3rK4IN2-yJl@*uZQ7GGk0^{|9WZpK%YbKtm!p@U4M zjnh=8@M*%|#FqvuOW4>>!->V4?CLFvqZiUzF{!Y%83px&`}ImVVjrle)B0QqNvInu zU4K{E>pYX<)1XqtT6vNQwslZGne;#@xHy(_9>g0KA@Og#OD;eduPh=+vcrqXVpfBo) z&&L<5<$6E6vTFlc&6a4)$R5y}&SfFIfkF}-=Q@Z~am!p-Csd^yPzHL&)!~f@Q4vs! zpWl%prP5gprtY1I@TtF_qT>*gU+J$dd<$5vG**Q_Ry$KKrFKiKZId9{z{_RE)Tfd~ zKHY$932qeybk|rrieqK}B6lnGaaqmx6XJ7kyM5W~=V#wrQ<4MCUpPMfO(+1mH`{Oh zJn zV@NVU31y#r_b~!xee6k!^lMUGA1NUpvR%r%vfmBzJpfvV;!H^i6*+Es&XVt+w{*YILco-=7$Xa@WCfiGYUyvA~YBZaT9{t>lz|H6vnSXTQjb(-D^Z<*uD z-+V;lE8zK!dpQ9Shph z__Dc<3!NyBq>S-TI zi|5g6c=_2mO@h+;k8rY~JX8(dk^Sz{Mu&^tC^BZOHrrCV_hvW9pKmO(l%}iyi~e_m7BjaUjP^{z9jifG#eB2 zT|eY8mgNQ4@flUVE2@3mTJEHE3@~gZKsOMx0Jgh#`wH%h%kN7yxGqBrCwOc(o1{x` z-0WFflYQ(?!dgbi^S^b+;<8Gb^Hpe51u9dmkH}YNB`6EZ7;#Yo<=GhroRrr?y~O4( zBsuoJsTjU#sY@N-^|6{_m%rYPX&Mxni8%UB09$jL+E+Q{!t*zJeV2?N@m7{uC_4#8 zaZPys268O}PcsZ9Za%%p@XBnuB;o@Eco`Zh#cJC291UtDpKWi&6JnD;MVLQH(m(p; z?*l94uPU*mCwjK~F4$`3mN&lP>a$&>{7vG|q$nFUzNh{wrXM@tLATQ#H50KpB^l!E zGJ*nVYq7;~Tu-#Uyk=y`tbMP~kXwx|jGXCkwlY+;k`Qw4&KaNPK=MwzK6|ir|MO__ zbD+SMbVTKO$3U;9&eYdW+IroWw$(YK${Lq2hkDl@O%V;tQ%7VUZ{%sfNZrA`p*pZ> zZ+VS4r7f@tkmqtRF}<=ej;swfxc$TDr;kMt9G+UZuj6JQPXA{#x57f6y!f7t!XgZ> z@8BPCyaBd?Ceor*&jE+;DzUYFFTV(tl+1k$C>e&3tn0esG>asJcK9YD@Qewo2{n3ui2Kt**#s}(8%iS~68ej2C z`Flgf=m8mcS9sCjNMVpg@_zHNf{bmZbr|!v@V4rmgR|m;VQBmaz?puN>)It8Ze!8y zBcQkDZjkdQpYi`$$UhG>qUC~%_^^`guE&oDx_{P~1X?R;Rm`^|SydqO7pgeTc_z5b z<9pPvXq9Is`#z7JNDY^QQa~{fVI1kYU8Mw_8MuFtKnIp)%p}zAXV}R1d@b=k16SSR zk8dBS=R5zEJ_-PrgQ0Va1@{L_pP9|N)EYR+Z0c;&47ppuy_LIlfTB57rw4AjaI&kK zn;Rn!o<2pLHr(*L73XzRwyqSALL#sPU;}jo0%025ZcNBVpZT8-BU0{m7tHf_ZEcS; zAqtP{`QrGnENwzA@^I_+xHeipfjF;$c;km}yCi6844P(y`xC$Q+?poH#v)9DZb{`| zjA+`z8J<_K&F0gUcoV8>(7PrSE?IRI5!?rZB&T`O+9E182DK@tY0bS9`|BN;w0$O3c_)W$p{V?~ z-|P~b&~1u;p9P@daiYs-tQ`Yr_Z*TbccF8rpVPe_bhEayCX`T`ILNh}1J!pe*PIaT z-v`y^0FQKaZh<)meHiCke~luwLy|+T88U)fo!J-|UCxxrdfm!GEJb+6J9?&mS3Lqw zJT(k1c_VmX_UwN0A2W1#2Y$yB&Qk*7Rh=61Z==39Nskx@&b4k}i%t*Q#zC9$N&+6Y zXe^y!Ww?lvPVGAFCfPdqm~k5_$Dj@9QZO_D*<;3GCKQ%iLVP_;m*! zjM(=@T$HDvY(3v^$8<)8P$L}-QHDqxxu)b7NwP~UUK9b_hy`ea0vby0%8b`HbU_P+{b6z5KH$lQN`Ra1 zmq<2*E}->l8~E2XtiX?f5#cxT^R`~8fXw**Q18>5W5RUurUENEf%eUQ-DhM1NieX2djqK`# zrFwBSox}bxaOA+Be7{0xwHR_Bu=auzd332hZ-~IF$oJR|{b1x+7n-=zSApp$$yWf0 zt-`$zlSf#J+Zp@3^yft13H{9&D6)JxQEZ+4=?;70i9kInJxK(X?%XNy7Zn)hZ9loZ zjW`pWx$nm@ZwmN^t4v1_8qymxtEIEQEPAQj8(Xi`CwL-++xSMBNv}`Jh+x-l+wL=a)#9FR4Jh|AD9RLQ`Jw^5UOeoBu^p z{f}PvB{AgWaZH43r_WYOLM;TP^>;0jJ6d z9PUJEdA2K->ht+W2 z>(rq2^1aK+1hZ*(!v!p6U;^j36eDIEwX?bX3T<7cai% zSFF)$X&&xgNosLk0|GOMuoTxRKrlcm5gKqj2&r*b-UkUf3R<7N7+Lr_{qOnwAm(!G z~teNJSN9Jgxs9MahJx9Jg<)3OkokQ$mIxJNehf2T--O_%l!8h zAs*n~ZOi;r>~+1MNq*x8TUWqZs#V8$@z3^+L%*K&&D0s?-p78|U;5sj_h5@L9~R;x zufeJ`YOu@Nnoxgr)ElE-m}Vww}ZO-&}j=qv!TE_Y+59mx(L)!h#?DGy3 zqfG9qaP*K-Ys;}Jxi21yzt3~dooT5Jv|b~9q@f{%;jDsUg_^N_m4v_V7K|DQK3%P|a_UQHa0XI<&(&q`ug&y2zKRyf^zB>dd*@m2t$}pY0+Qt9Hp+&Rou> z!b-woTY_co?`jNktK!#KSDEqwTeIHy*K|C88&VqNmAaP~ju104`&`4|zxl`z+-tm6 z=~+``B7fd1cEMg%>XilBtot*&xkao3Q{4hprhTxjsUm~bE1r%}wz+fl7wxlDe(h$W zLXFN1-7f+}6&NSjPRYt|4N+ju{&{(;&5knDUWnlJKZY72VhtC49xVH9MP2)}xRoP~ zdO{-ooCBGH_z{~oLxFjmJSnyu5)~Mtu+S!UNrhpd!QbcLd@N7CPG$8&tEZk3v-5uN zwIM%92xzENqX3=T0b%B|YPQsN%}hZK#0)=xqCVu9l^;LUkWgSRJ)mqPG1}^Zo|Z&m z)|QXe1bYL2AL&N0i&tWp=RT28(I-jh@toV)f;FduSn*kRSJx%uWQKooz1yYx^jx?~nykNNSJBN>AOephHPlD_i#O}rwcJEZNFRX}V848?9@-<0>2ALwEMdrQA99i9eK26~cVNVO z*~;wW+yWkdpI2r1<*K$Q)SDe$hxIRp97YApbr0#XZn9~NfuR@Y?#QkKR=x-S__f>> z*0d1LDT$!R%!jqnP|40C*XPWKPc)y|=JtD*&OWpsABt&p>sRV7E~+W3_T&G<$}dd7 zQmW(IS&EKaANvVpRBT`7oNoWCM$sW)i$9OdKX`)-(*JhXXm^B_3u-gue4^NKChqW@ z+gDi5-15g%u<+tX#;!ai0^txUKbY3xmfXerfXnkV#kux4i2E4fgmd10iX|@@^3U$1 zmkA8xh#{qDGXPsq9r?=m15(G4MTIX(UOmMx&y>EL6ea}vK)iSmx6Bm_fOdf=c3AH| zJVLK5skhMWz0OLv`tePXd^6^NJ$?P{?$F|$HannrIs5SS4 zwdJGL0{LMW3O2B{occ?+GoLC^l;D5XAk zGxRTx*u)>(w4|7g)iAgAOKwhaO0^zkdm)P>e~O8gdw)`9WUceT8%U=VgKTap5qoO? z;V#kCljQBQ{6b3h5WvVJTRN~WsU4HLX38|{qm$h zN`^psKNF>NV_+)INGphdQVyi73uJ6&0J&^WMXi}VI3S>BOO6%eh$*wg(O-q|0~Qt< zn&MOV^soLLKag7-CtAjOA&$-iM*O*dYv^eOn%MaTUndmsFD?pLZm#SP#6Xr*7it1P zqHLGr-Pq<{z5lc##lc2u3+}z8jB0pKX{D1cpfsm9u57Yr1 z+<6BW)4%?1YJMXkd>mX$NXP3j%KdKER)SzqEf4>qaHn0Rf6ctaK5)uLO~O}bNsa1u zgo9=llSj-J%XoaHlF{R4i7S2je@dZ}MI3WBU%EHdN)C$qJ*h9AOU)(*t{7OxZp?Lm ziCQ`*LSFc(!SAZHay7J#)N$7GU3AT ziXME(@6|^hZa@zqWiq)ooR4{68>l~gL1b{=BlU#l@UBVr*ESa^VU*bWr#De+`$mW( zG{gD~Kh=uC^)#vzaa`Wjsr{z76^Z4x5n}+RlKfgC(D{DWR()z==6Pe~VN{$s?$qcl zZCU(^k&okBjjjuw2UL;X;TdMdh9+Kp9kQ{=WGs8%kX z$n?4y#~O&}M2Pu7V-O0o+SE8eE<2^GJOvV1)c@va$ayIyir1QI{vn(R>8eQm_!!iG zJf3x^*`$3E#*^RPUHFV z?rx?S@>3R-BecKVa{nV@w9e3?E=S|SGodRt<*1Q1D1GbU=SFU~`nmSDI}78G-6zIW zm~umb{jaL`lsL>d)N6K`4R5~An_w>**RO6A#&RbG6QO~4xe+J}g)nvI@_v^JOo+Yc zD0M-ff?Nc>eF+LoC;0VM-XcS2d26)xrU_^v8L)P%8!w}x-sD`T+L#;+X>|RLlhC7NKCiw(R|Y(FII>)r zX@tnIuT$m!fM362Te0f(T>c>;s?YTopAY0!3U=ycS$+H91jSz(Z0B!CI0aT_8m%V1 zP&K$Ye-f9M5>FSS_I`4>K-`z~?WY45{S<|8%BqVLiNfdE_8&$sm=23=CB|WGN+m1j zDo0@CCU>gg96yA|xv|Qc)y;wKwQi9RY=$v?Y)(2a0;f2+;?D7T=N2-!L(QYq5>OOD zfMd0ySzm#+^$N@90mZ3d?L9AlF|oT7mutYP-%{WCU^l>Mwx;9B*ioG;%h<&$&bXQ3 z$N%?}>w3WBOtP^A31G2MnpV3J)?ZmHX$TNw~(Z0*D!Jsgx(46*WD##T3igoJw z%w^k4GbxR=v<5Qx%7LoWwP;eow_+k@D^iiC_HmTsb)*rzLDhvpoHa@(DBqwQp%8o(uTN5&ViE;i>FygyatCagJ!3g{7!&Cb#D6R+ zcu-dN2PO*W{p6}LFNpwa`<6}rSEKY*sEW;VNx4){&8F8A0Gda14HjvFnET* ztXq>*Z}90pp6_Xg{}*R(9TsKxwGERqlz<>5DIy?Ug4BQ_0+Nb!3?U%W(lrbMqI5_} ziW9W-skz=_is3^xvss}UU8o5TzkUJgH?XBoA|{9 z=(!%ss?s;{DxS4*>L3Nm>RZtA8GQ>^@TgFRF>_*PUa;b;#d(-6o!ngvAyJtf{igBy zLPBnIplP@au_doB6LxOkjk01MTkipZzF6xgMHPjq$IdjbSOEZ&aoInqA z{|MJbKRPV1ovvBEFJ~>=U98!Z9f22ib}pGQ3wDzx0qpQdeG?CL2&jcV3Q_ zQYhtD^)xagkU%_Vb<`c99e=Zz39J=Tgolp}7~%ybAo(&I>$Z3krs z{_Um2&Z_z~UyIZDQ!W@nir|9&lX}IZ5;WoV!EhuXd>Ca;>z@fAe;=%$AXr2AQX2Jp<|vU9HRESM3UMu_2`l z6JOqTL_J4(szD|pcMeYFvOC54D-L~-LMo{n_b`rr{_tkE+rd&v@Hu1P;Oh==xoeU- zN(54P2PGmuO;hf2E@kSzo%Cx&C8NDTYS+to0O={R;%AB$bf%*msulyrAitNjp8#VZ z;?C^OU^7?VmA`PEe3204syDrBiKefIAVmdQ)H{>uNcTyGY&b({n&nPqUB>(LhpP%9 ztJP=k4yUnAhg#?vy>JRU_b>jdQrpHezJGY8dyA)Kz@1=b zTZU%I6fhY|3gvoP4`tFXBJ>Wy2nH`g=9Um3+qi z%{jTVs1R)(E~5EoEn^VOuwxP5DTi%SIdLwK%xu%6mq_CgL49D450F$0Kf%nx>mt?<&+A-Li%;e<)YImn+ zCg5Zep(f7K^SI;6OR~lY2PAq8Km!pM=xFM2TvLl72XL7iHf`|%;9oO{P%G@GirS<6 z&eZN^SSl@c??QHWOFg$+LWVY7S)Bj4em=BCP3>7d>= ztpU2cGO=hYj%BjouKp~xXa{|kcD|u5>Bh<+sW$E_<)UM_P$e5nI5NkCl||jwwYVSS z9>ZEh@$)gSZ{!E_-*@Gb#{gq z#Xwoss5#2Y>omM3@D%-uAL8q+bbnq;3HWD2Q7gSWE;y&;EM{3*BmSn_D z{k^zGJ@LGR2GXk9(;a3$0=f@&^zR&MJ-^p#uR$)--aHqCc6NM!fA_r}aL15N=x|6@ z!g?zr6r0j%b2Q^~kG zpy*iSI>*+@ILsMMjl23lCU|#}{^E6}5S?WUcVcvNdLslDRf|jNKRT`vc?nL!@kr-q zqMo8ryl^>H&>N0oAOx__gLXxXTcfIW z>i7d|VGFY^^gIvh54UF4BNP|jpe|w})dyFeu^wkw&QVwIbopcue8e-|P?&9PL4srmF*DkW(bZ^f507|ScFmRwCI|l?M+%##63p` zn22sn7rvra-E4pnnHkT0G4Hmc>?7mQmpuuD@kM=F7gn2%&b{)o@#LU>zb4pIDRm{S ztPvYsX>kamf8+y(f)a?kw`P}R5G%*_OjZhwnfhS9p+3|5av#~77JT_8>P(*~c5N>x zrYnN{ohxm6nqJrZrYc5GB7r}O;msF7p<1~l7wq#r`j)1 zpF^QwJa4~B%(k<<#{9+Cj1Ft{S3U((U6-_O?_)Sg*?uvR%#^K1SVZ&}t?Rkm$nyHs0(jhy5@p8*X+bA~Hk`{Acq zeTIFSHKQ-+OS&oteueD6NCzpyr&AfG55ng*<}|Eba;{g_?c}AmN)J_S5M7asJN+OA zaqnI$zXJW$$Yr^W$j&2+sxcDCOTL9()s!83^m>Twv|g0(S@O02Km$vgV(n(nLrLl- zVH;!#lk`m@iKUkl0=s{?__BOFK&aNqv;g5v#DZw$a~8OdHJ0h&tg1#0S3RRkG$^w~ z0ZX@EpK^XT48VMSCoCQ78zyc&`F3eE67JxNetAQK)_LqIQ#hbG>b;Lk!X2G6% z@5K93|M?5AhRXG;t{_8BtbOnBRAQ2mOsmxuhcJNb9vi`Ib{c6i|Kevoa|?FijhgXX zY+e_b(fyBgH)9~JPWA?Er+pa)SYW73wGw97wg`ya`*_|?=-wQO1{19F8Rnwtv_1!X z%#Un$?erT?0+Sw;ldlK&-y5!Nt&XEg9hZvxd{((Trboby#E)>j zwGY&)3$R$7DipOEVl`gmTRgZJ{SmRK*?0&YcOjyF-@z($`7+8RnI;uU{1%Rq>3g)X zNV@Ne74ep7g%_LZ_>Uv$_r6j}2Gf2My+3=m_mYax?v zVE4;%zR#u#35#fgF2ISP;meiqJ-8^G5?Vnj)S!L2)}5!dm+Q%MLY(<#kS2$sv_a!E z>HOkJa&pI&MWy{m^@ukhvteZ(pS$KLh}|OgB$zy~^Dg8!?|tcxK?ImvP;E91?9{4JIj#Apie>+0 zS+siOb236tOHaL-oAFWv@nrP7s?9x@2;lu+KNZJvz#5f#g+oog??w3ZX*~(&f@lJ~)9-;}`UdNea{YOJ9QH|XX^RMe> z#1CkP+EZBAZC$ssB74-L0^c*iqs@(Q(4CK|XI$=Qyca|m=TFqJMjlbnK1q@kj}KB; zAoA|bCa+)1UoBr{r&UE2>OyB;MP+9C@lkvKC*5%KJVvW3)ngS5176$daLNH1f3rRC0C}_P4DwkY^vvMMRF@NL*S8ZC?d-`A!_nLA1S%(u2 z3$Wl=dgL_}!k>xEhOJN~I{PFx*gt=6uOa&N;&IB(Z+@IBs?strftRwKC{%>dt42Gu zNlApvC%{a>3=fVZ>~mZCs!<{v(6N!;oZ(VO>Q=gX=RhGtT6%jm^XDbPrISCaqpsV6 zEQsmYwAz*RIH};b9NmlL{%2%j(Se{ryC1VvCk7H!0#L?!udh7T%tdq0wVp`zqGdz z(6JI-9pg}t?JkcpW|yw;>aD36Eq5San{#p2+6w-yvC8iB&#SAoKioH#cOwI=x?DYwN^H@KKnbA@i zv^P%63-j`EnO93nM_Q6DSG(?108=z%ZSSi26B@B#vH0*`qa16otGu&lb-X6|W)wIN z5+=cxfu{owVAF=bk?AFwOjKBs1`kHMt@6HD$AM5jhnf3{1O;B5;1pdJ6A9B|p+8Eg zWIg%`jmM`o^{q=h0}x+}aDMNzB;|nE9p43(2i;#DL@tRH@#l>RF5`;!P2f!CJz@w{ z+d@lT0+G)lUpwjpj%0)$f38$p@S?6vB)2%ySajeMVlBTb4`RI;=K#VH*!sPJzFkS- zIx$!M({jXb9Gf5zd6khX^BC1X%e^+q4z5@0kUys18iVCEsH(6{MC4v$^ z(gN!1X2h8=rYF;wm2DX-C-jpc2s=~x6UWddClW{Q#R{zqfz{1S0uYUr3l!*DpQrn9 zcoX3R?d{bPs8*(YA88<>T)Fj3oAM0kfmi1l^I&nXPu@pIBXh7&nm;_i+mUaCG>diE zpYm8?>mb!xb4?*jqMQ&xWj6XYb8*J@4ShV)c5CYad_g7D^GQ#;bx_=SH4#|FjkRMp zsI0c=lpd*HEQ~On=Przx3?05Vw8J;e#jCJ=!`_wy-Sx1Q*~~$Blz>TgrD|OT^N5qX z3usOK9QxCvuC)u;s4@W3PZ!M^s8D{=6Ve>pMp3u6Zn`7^_kdHvhsWtC1@E6mg)@z* zh&?=hb^VP&j|e;AQD>t=?W9xMmgb|5>#x>Q0tv-GG(#!B;CGh%mVj^+RL;0-4CQzG z?U!-KC(NcQ}R&^@k&txNHI+kX-|DTcSdkINUTn+L2?2y%AP zmoqfLK&dNglB+6d>FO>_fhRV^vW`7xtV|~tb1t%b)_i0y;!{y(Y_*F;l9SyJe~jkO z;!iOzfjNmo7z2&)TYyqHjy|e?shar&T+GYJVGzk;q1tC8kjqr5x8 zI%mDbe_Yj`)bTHE_G<_@!Nv-^uzty1Z%^**2@qh&MX9^|=*;i^JWmO^bE4H5i|x>b zQ(QGt|6s1hhvsiz$lYG}c^ z8sc~Apa0zd*&xk)=cMI#>jBBNk%F1jWSH_2DEk>%6$d`7o@1S1N%bHcN1}vV#$>Rw zv3TmK?U`SXQ{uDp7>w1oP1#-Sqiic4;7Ms?1G)3$O&~u%Ohj42UoT0*ojTa=s`m(k zyY|-SoT}bDTDeTK(&lW^*&x{To>mC8>e2}xWE@IvNqJd@xX*;~``O#5<%qiv@LB}L zno$Jj<3>`xSKgf5=x%#(cN>_hn9f`l@{iZpC#%{yj@fCSAigjbjKX#}dZ>=lr>&pp z>ZGpAbvfqipug$Xmtw1mQmKEu5PGhG^0tK}79^D*6vrYha*k9Ok|pc2!+)DB=IQGQ z@GFpB$F1iwy9s1&PpOXPGltt1;IwdVGhX=jc}!fO-1(shAmQ|0PZ#4yS0M2wTj^D| zrm}6w75mx7g=T|T_dUTR^h5Wbnz_F-;FtOM^kf4-Kbmt=coT0bSDNP}o~gyK>cpUI znL%?b=Qe8=GmAi$lcFv1N{QvY(8Efkve9Mplk~|aSnd-`-%9|z*go3bofJR?qicGa z8fS3?(L-*{;yLB^x07y-sDnJOzf{l`XJNF44tI~YA; z$AYyZfQSj->u`q_`7j!%RE=!nsTU1gLBH&QEfapdr1WPSLgB}QKcsoDoO-5&dc`m; z_=mkJUkN1?mRVzxf%LH)N2po)`0uZ9k?t_(;cb=7kvFp92Ww%jc9i8L&fN0e)ICx$ zbd410w{*{MuipK&8153SL*K=u=pB8O)&o%a!$9PVyUF1~IuZO-F3r`19bg!TE1(fK zL%;Nd%NO@j`s5p-WSNH)sU>dnKp6m$eMn>m95_cb;t)NsW^HR|6oHW41XZKBeG|eQ$F==d%e=lU|zfaj!&gvXr(dmNjO<*hYiWuudrNw-9z>2>3gTB&DoJ* z!er~zQ7vgqF-AGqNr*~0XOoIqJ9V-M;E=C4?J0%kG})dqWc^2|XCX8aHLTF=h5_o6 z=;JQsjmZU?;E?!NAEq1bVBRKT=qqoqd&BiVEJ0Dpn!m8z7X4pFx0p8#tR3V00&l~` zH5sy(fu-v2hNK2{d%i>c?T_0sB^w!D0k%BA-H$&En$3gu4t{QPN8p+9~JylcSeu|*-|$&jQ(C!c=r;lQ`gJx{M!%ilo#CVAuL&COaUeeR!dL3L9!AqUO|C*g~C7YL6! z4ql>;ysf_c(;xB(K&}wFPjDU?IxL3@tHnK`uFtF`DQ6UtllNw&A1@rdZk3hYKYjTT zj~VBxM+pa{WUyHSx514sQhTCbjczIkx)!j)s?DK$W2|P25`fWW&5TbcqEI>9J7?Q~ zrSJ&(Ex8sv86rgL^k$$UP9G3jf=nlFjsB4a7^ive4d1N|Ot?UUE;ye-_NlWf?Pc3M ziH|DGUY&!9>Pt0&XZS3HU-^Z-Ged@49a&h&R@gfvyZAm&hZc+X<#jjQc&>^ofr`~f z%T0Yw@RO@Xk98h-R#le0*f9=OV@u(Ueo-M5T|R3M?}!LQ^%pLQ_FRrkle^aZ?0Pgb zjuAUqD2)_zXQC=OAUkHNsyYId6m4`kO8{DW*DtN5=$(pQ3i+PR4>uhO9K^t0#B>inDcV#btm&h@DYL|a0`-U6_3dQ4(@uBK{Lmz~ zeKW2ZP+bC$6p3O5!BvIMyJg_vu7s_fpXI&B=9ND_&1>jgDE{=~(zGgdrOgDTLxKl8 zGd8fW;^pIRunq>KYl8oa3#3Pcs+zkq9M=?UKACw>BK5&v2y?#&{*eBQ>_IbrI;$T& zcDfCkg54UaxFz`DP-UTKJCy5!FTN)FrFB!(Hfvp}|BF-q3(9(X3C)Qoc^3|Hy+U6! zAEhSCQcl4NE5LUw1;{-7%`>0lc~`KDNU|1VERP~ckNhx;LHw9FI^^%-{c7#L?ypJ0 zNY>uK(~Iw4Kx4HPejoAEA{QlAySrtUfm;mF@y;vX7sVGH4PAJ;a!9}!$BtwTQ$z`0 zyZ7x+AQ$~vS+!DAb=8o81zqqe1`%3==#o-y5gLw+%paQ zQIv!2$$fHwHK#{JzKV{<*q;GaU!0T)rH{V(*m$?F>VVLyQ9?hZ@1WNFDr zzaDO*fWbYAC=?8oc{iQvCNeMrybR|Zw*R;SD6{l3j2bZ zi#DDO++z8Q6&hmGXq<`gQuN?RC8)*)zqoz+no??AA3hTR6Mb+6lt?snt_jc-X52Y4 za7uh5S&SZ}-XU!ds^F1FRlud8(-{78=7XcJ%Oik6-oN!}L5FdH(e5q83z1q?9P%Ff#32xJ}nI$q5wx^-nx+vS2oUUw;-QuU^PE!+oS3Z zd0=aYjS$cKV_lw4GVUD>dDd8p+OKO5a&G8%>m*#Um$rNO|A56K%;Lw7=}!E2I|GWD4cOc+Ub)Z>dc>ASb(hK@&`F9^=Y@!EwCPh~?@it8OtA7UHJvTTHfDBG(y z`*{f!0=lM46D@tQ*}Ak@*EdyMnWfbhUIV$he59V4I-B~r+9pf?9yEctJv7#ndxU~0 z7pqHox$G`K#d#@vdx|y7kHw2xsIgZ~Ep|TELwE!?nSV!;bc#%WCRZ~gNdr|4Ou}h=PUgLMJl$h6{{cEU zxIHq63Ff(t{X%AjWT?jMtzkm1_%Bb$FIe6P+}ffV)D&Bo~O^j-ljed}vr{J4LPV-dj|U=|EnpE%Y02s)?9%z3JY`9l0@d%iZsz zmk=06NkllN;@ZEsVPF2zqeTWM{UA0QVVH@RJn#As5B(|7u|pmlvHl32;Y}Mw)>VhI zvV2YHAVI#%=kxeZ5%1rYPv$YXa)?!kQQdXLqA_qoU3f!DiIJ}T)+_sDj?8!B!k6qq z%|CYOI=_<6)?Jr_Pe^Hju#=~2(a_V`HsOT=@+;|w?iKr)o4;u+O}pj-IDlP13iXhu z`+S+%$V${bQ15yRx$NH6TY}L=caMApiO*QWUu4DE*&&>er`(Y3ZnJZx>no-FvUz+e zfg@*XXk-Hv$M(QzmHb1Cu+~qXDcYNWJ;#u`f(-Pv{9%t=(DaK30lm>)G<89J!fzRz!i*Ylr=*&LfKTK6h2NH zdKo6V#F2`Xf=It4w6u+M4I>~++)zeF8(d9X(BesG41`Vov!pGKq&ASo$IIpC5XJt>Un zTpSIU+WY|Xq}=rP7IKzxejtR8STA(lAB|$ARoCyDRezSodMCgMpt7~YcxUYpOp1_P z-dRR(WNNb9NW7O)hBuEnz8oqGr7E-yu$AIl6AY= z%R(@#w|KS`L9Yi6bx&FQ$wfV+O_u38*V17$CYvI2XK%ogT~oa-SXxonGeu?UZl?b^9MrYUI4^JUi1?m znq?qgfOFXCdsesU4=;*_`jaoC*Wl-mALcGL8H4r!1mcari@DTBhNUKvyLEta6axsz z2T1Pts#$zs2Cq%1!RVhbHS!e%4U3_EDdFeiXyP?T*4_pK5LB*?mp-}w=)B}tv6`(P z*Crnxk$kNuxTv9x;4Rmwxd93P;{BAdfh8{|RiXSH2FrX?hz{?J;;?~oG^aOV9E`{R z(^bV*I+a}F-iwHKHQm4?sipq>ZMxPC&A|EB9S?tYcP_dub!iyN`5D&LkA|ifvi-*f zGBOpl>*&|*H8gs`EVi{$j9_qqYh`fibJObx<+pTQ7*a+@PIU_VmdLtZE$-!Ip^0{U z3)3+2hxTNvz4B9`LPIrCc%$N--Hk_5W&n|!w6^L2zD{PS@FeP+P3`SDIubd3l#Tf0 zANp5o3Y|=Xmqwid#a1xk*=>>*Zt(-f$$GNdzwDaF>f@UzDsVj-7|^`7jUMS;G)(;4 z%G4l=5AI$|*rvSlf>-l+U)B}?QrEVH}>8u(YA5N4+Vy#y-USj1C@Nvwm9 z3azQBv5fJCaWdL$9nD{}s;7Xk5qAsk(dxO=+g!wXff&T|Wfqbe(fddcUg5{sjyv5jc7Z zd5XO+z&hRoj=kanx2E$t#;LM4rp3EfHimPz{TI&W_i3Y^dRM}7K6wTpwvz%Y1C|Ny z!ncC77f#??7dv6a1X=iqy_Ytbj<_H34c^}sDQ1#@AH8A1MlvPuk9~i66*pXbos64Z zXP|GC+d^eYFIdt!@5j6qC#%&EeK8t#Cj3^n z%C!58;(dd((u8sc3(f)%?NulTbPmYcMX_bRJ8P*gYXJZLRPRh#dLQ}K8t+=FCGs)y zMG}6Lr?--P84t|H&*;8gK}^l*z|E1iG{*F*b2r5-T`*DJ=<|N|w`SNzboj*;ALSXb%0HY* ztxc9mMriHI3;Q_ZNT>TUMXAOq))yp$@3;;ss-ChQq4ZQuHO~?(qtihad>GJkleBy^ zbRgRI!~}znK;T?qnbyBf>ck#^vN)fsU19-JK%5U^TZsA;?hk(1U(v4q1G!D1KPs^t zsI+e`drR!{Zcgv$D9>?)Tc|79Madf>_*FLr4olY`WjBKQ(Xit}37>&Y!c4}KhZm%z zPX7^I-oO-|=U7d$5Z`rcFhwAOLSD$9mu*9E!~bMKL!rcu zJ;x)J|5^F}h464>oD2a+>a(GD5^6GSmmifgko~J~kth4z3BCScU{X~W^IsnMW(z4S zmSiH_hu^^R+2>k-ktPZ>|8@TVpRe)vC$ml&mcYETxAku=1>mo=yx#yft%KM7nCj^M z8*T103n=ERBetDwi2{0+$ciaOzxW3e#Qy&O;zRzszxZ(DOPkMm6byu7W)&_*%Kr~l znAja>GiTd_P7|!1(kcAcYX1)}l$9?$Qj~v7fA#;hOoU{7(dYwQRlG7hBwi8@+Rpm_ zE42L|9{o2+{&ye#KP?trbV2QZW&!-4Jd7;?_bPngwc!`;|E+zQj|n6c${T*L>cg;H z$zYiV+)l;g#ru!+(hm0+@5?2WLaO=<{W3B7j49p6BqZ?paAfC5eL_6BhT^$j$k4`o z8O@Kqmx`C>Rqb)N13n=Z#2IBTTV%0R*ydRUoDt5EgxR9BIe>k27j#yP(GAG z=wW`wqpUBc;zxXMhx@**zt0`QMFDMn@&CV@`JY9S-y>uC$jr;@oN12)@phrYzcq<751Z8zhZH(B@h9=PaDt%h^<)6u#Yc)=D%WTtE*#yc z6y3@;Be_4$GX`BD^*4SC=cL6?hVvUcF1Od9-<#wUFzqZ~eeFzejGVV}% zF8n~rI%}XhZ0?P@dt?UVH7snBRCykk@-7nee9Z>vO)*Ly4jTBR2AWe*6o;^|tZCn#vsG>G7nbR{VLJ7!wHh_05 zvy2P(AGdh*?BJQz<(P?_RN`LmtmxsgNL})k%fSOuRF+$`n+Wt7xqb2$iBl0mbeMPR ze{eAFxx}Y0;kD2*yl5PqHBs(?b}Pn)7mgpAnc)Fra}U1ZTbn#>yc;iK8-XnN?g?>Y0=wAt7dQv(WNn z0M4wq`*C3`FAAM+C3T^%jOSkS4xfvu+K)Nop&V9KR&&%ta~+k;%<%raJ*|Ja0g03k z`SJD%;9Re#c^~CYc;bX3YI1kHAG(N#)=LE9dOZjY!(GUkz7H`%9eWxux>Mj0#SVK} zatmbd6NccZj7-fY&prFXTjuiDoExHWuT{*Ad}sVE^LF$H9P1+%s|ds7c1nXxqW_AU zk0sn^4EhkihE}x~cWjnq?^M^z6ZDhi`ddQsXO7lV} zw4{~n;-37dC+|Fv zX9>BTtD(j8{mDO-+>IYaj*I4-htUIrtk>`TFuTj18wkOSd7P=^tHV3K5FmC&G2{2C zV3mHhWovknw2;`-w1Zk}SBDp%cv{@^P`ZJrWpH4#d=jbVxJrjSKiSCPmNI1LxahYT6V%6gYH{tT9$Bnd2ogxss+pNE&b4j!r zxLr$Lk%|lb{N>s%hk=>)#~8-e8lnV^Zn~8@@k{;{G!7@<7lu3Go|cBsr)Oq7 zZvJ-p>Oer&MfdFh*8QD41JHJ4UFe;87kE8@hK}yU;&NAk%DtIGE?ne3BIqO}KRV#B znCa6OD0QQ?;CdXZGur`jy^%V4?{ zdMtJmZFzqYUF%bQUMRy>!CC%D2yf}sl<4i3n6d=iA%4^NPN+}tr1>K=UMSG|U4m|M zPW3{WRmLshO)1HBKlX0Lmfw8=tv!+_2GD@{+M*C7=fP*6gE9SMEM5IG9MPhMNNPL^ zZW(d=A*xR!bujtk2#;s!QThsx6uD1HK;0+gek5F~G~@U>v*{S8G3UpGT+E1081DB_ zj@OD|P-UlYbY-TbqtC+Vc=fMIz7-G&fBR-k*jmK?>RVO;-RrM-FO+WQzKErzYT)Mo z4ZU7mOfo315EZo<8b~`%Kj=3cKDI7vLeA`^%T`YAPA`5wF$pmc;QwuA)*<9v?9&&- zpvDqoTI*6#KcJ5X=d@9F9D#ST>0E`lUGeKLOUY(mPgR~A0;f4f9mZSES>!oDf^ z3wZ~jsj#6Akh)Mk+!t{g3a57$q9h~Z#Fu+r%hKoU5+ZN}vO7~+pK?uJEoxK83&kB! zVq3d^O&1Ic>S5BV@X3FnbY6BmM0M`e$L-Xjd;DbE`jTdwC={PB65RIFBlG>XjjGbr zebL#*?@7$pQ;HXKB+(?g`61`>2h@*~wKzlAY9H0JeUO+wia*$^=m_r)K+sHzD_VSpLkoAYWeBrOH;|MmydmsQvr zos%aK4-<6(QR{6UA9}lU5j#(YNv)NLd5TZ7PA(#I@`Viudu>60fo$Uor5^*4Qm$?ud&h&5y_=$qV!IoV z`DY;xu=I>u6B_aL8qD4G;*tcN63F{-k>!8H#0N$adj-4;h6+VT7B z#iN%AMvXGA8+0JPxqa-dWqA|U} z0dka5e8nZ_nN0)wI1c6#2HrffO+66R>Efu2!492gSi-fD_`Qa^%}y#DPT{2*jXFvD zQ|(eVmm?1NIrG>|{FB}T)EzPc{8o666%KHELc2|-`>}r@LwyeOK!)d0D&k=Gu8ENl z!EqxI9d9{9@EQ-qjtc}ZXF7h$`op*ga*SYj^w#x?M)qx5!=9;hw)Is|kI`WEv!7T4 zOAe(kSfL;XGB-i?72F?|uwf+TPP4{WxD>ofTikav+d{I_h5f5NKu= zEL`4*vTG(^zWd;cwFnmQ_)?b22qODg_8}OY0r_f=xCgT@{WN|3LMjyRdV92|65rbU zVBJaGzC?i4^d4id0v*UdCHuD|W*I*D>vOu`>Zx3xfK#S}QLdc!Px3BU3={@NoNjJ2 z1&j2qwjc5NMSfunfi?Kej8!blzuY?S`8 zI9RsqF5QA|64iD{pUaku$lU@tNNMW0D;*vXoUEG#Zn{z%fJ3exS@0L~g!ds1J|xuQ z59nU2C3$8%;4#)!-t3VuxrP_W>^}Vv7(0YBlqTtR-=FUn=I@!uuJX;%_vw}AYWbW5 zidR)vX}ceHt{mmDV#yKBk6MVpy?!Odf&G`8{a7$(%eZX!Eg7T0QG{$E&O{6kB=FPy zPQ5(0ku;yr{yvP`8cMMdO?n12Y*fyCWj17f2Qr7_{WPn%H|$j@m1)KUXSOYoWuHK~ z*Gqa(U8NfaG~wcDZ8OqxJ3noHhU+Frkif%1DVL?bVE-F?C8Dz775CEdNu9HJ18=;I&UL(1BfY7o^!H&;&m*zV zF74*|HPDSLgLV>7~^!WV4mi;T#dmX=qr30s#io+V&$-+yo>sUl_!}Gcq zS^gWy6}%5a?uN=s)1HCOmF3?N&&>&OQ`r18&c$L$UfDnls!trs_}csq&Oi>X8HSmo zh&YbrqOca7^BVZv=EZMKZ^K9vE(G86iDc$4*Oxr&M-i6$DSifhoBUMfLL;AXS(s8u z`0TF((-K#4dp=avm&cVuwRC8|EdRi>!YE9sncd#v=B?YzUgJEhY5o4*qyeb?{qcZkZi^U~s^`YI~C za^R;13kHJx^Ihut$glN0;McaH;w}RXDUG^M=Iw0PiR;N3Nu0Z{#Gfo(7xAd~8%eA0 zN7kUs{67o*HA+(vA&rDf_Xh_Ta=)er)TG*_YSXnm2Q4FwO_mh*-0>I{gSZ{eDverf z!-#&`xv8nHl@B>Qw7(xg*Ko@9r}RP{t?OQ?g&0ne8&KSEqc*o!zpDGOhg@aODUCKl z8dkfPIWtdCdEBwD%;PDW8c)dyEl8WU<8m8It}N+i)DhC?>X%ljMSc$pzVVtwW>A0j z{bLPZdb|FQO`r8h1*scirH1_{G<>gbZ(IZ^`oBHe-`%lC&6SDn*B}$nUQ*lVIJ^E! zjU&j0QPpdMa5T(J?#GX+>O6O8K_Bnv)@}lGqvgmpyO2Cc{*SHCRqN5e>b*Qu{8`l; z4_{Qf2aG(}kA*ZfRw+MuO@npZ{%@f8cWN@g;L&|#+WhCw^R@y90^5G=Cl#OA7b%OG z+f34M&p^W`ya~;f(BW{WU?z5b$b#?1outfKrLMbg*NF|fVc-3i@2jFI=l1siK$Q%yjaFS4PDa}lB37g|io>v4_k~a0B z`x-r$zRzA(MS2^$zwPcFsXM%f?4@aY**4VnI6KVQv3)Y$G+M(wZLM!HhCXxqXehq< zgLAlQj>*Qe@#a3UH>T!hFaSymkOq7su`II8(8|gGp9BJ};$#257GAa$n@caUK(y?XJGkB<-lWN1Nj!7a_1&CeS@~kU_m0w;Md|WKa3CJ z(;FydG0)_p2l0-cwA#0bd=Wv)xp(c^nP=BFm+gu+jL^mHf!e?XMg5^wF4)W@rqAoa z6um<;%*d9GM3bbMMPmhG2p8s|W~$00@+57RL5;T=h2+M|qLpf`xW(m7#-TiE1#bJXs)fqYep7iGE5@(cOQ}@ADN@2l4bV6hqe&z~OVEfZ~lAYKR zmtf3v_6MExEBsM!7v)?>xm1+8^pE@Ev!ZU%QvIhw*o?1*PgOHWk7wBnH-P^X zH&bWkbKBRaDZdSl7mG+ruxVbY#N^EA@cT&J!~4SE*NIsGB1^yH{=D$LW4Rv%nj{D(;*-3?yEVnAdR$wjr;fAQ{+{DHK&I z$x!${g_dch;tf{!T9xd-1Xxzo5NFbsQf-aV-@A!@&&ly&jWezeq}#CeOujk(^Gm;m zm2Q$^o1S-V!@(!s@Qoc6ybHxw$oj=dxvg2pqy4!J*OvV{2fl>>{b?#Avicfvy8Q%l zr%R#$T0|4t&kTd$Fqh1ZKlvJvN_R4k{MEu`A3xU1X=f;L{B03A_2TZ1L~sB}2E|y} zYgBU^`l&=kO@sr4va7K_Z8x&UGl>(~?Ioe-bG0wBsq;x6n}SCG00umx}Q0G5^cu4T1TiXf3Q)9^Gz&jRn$7SlR_Sr+g1wY(z7D zr`yX`*UCUnayI%*)mDj5wQ$GXPcZk`eVNG__g{=R zxqh}iLD6Ou{Our$)ul#HNMpteIowoRdh@=mF{fTCkp;duth$IPP?{cgLdv zTm)jA`MPuB`D00Pp}~wYpTomRpxigJa@C|c>U9cuyGa`fa%Mbc?A8dlFtd^Bz|Dy2utGjXsG=qeeUf8VX4gMB}?^0e~d;wS^n z5+F{KhgMD~?v0s9rX@7Sqx_8WD(m=@b-#4Z)+K@qM}Vld6`6;2 zlR));ZM}Hkpd*KqKp*UDV{^AHI()yiicPWZZ$A5FWZ^nJjj^QI0K{7%bpDqk(MQgM1~jX$C;5dB^4X1 z{ktMIzvwL8C(({q6B-Z>W}issoTcvc{Nsu(iKIKsRC4);m#HWhgX;PxGrDDq!e7tp z=1qA4b0?;)tkrhiGU?bnx4CFEM&mkQUQ(*@Y$)KNgNLntXsz&%HRtTHOME6{p5NY! zFMq~hKY<q`ev+$oU7T9BHhXx6)seX3dOwlJy$6V8`T%nXMOf17-}PP z#~Lg=+}k@}kARO?!4cR}V=%-I(ny)px8-PmWnq3tWZ@;6RzH z=+*B(?j8uZ2AqdB{yNzo?Ye4}sq+0fc_5&(={QArQ}0+n6?o2=mhmAxFjb>#w{6&F zs-J4u`qc;(=~Hr`T;}w#gZoqKTJJ>bQ$%EiveX{2`b%s(Uvk=u4bO`y{#AQjwWBjv zZ|^@g30?*tdxxO-)aULva?Q$1{iv_Cnth%U{m9cxRNwh|GjB9F`oMq_VYMgwfVq^i zWhlnUS4bhHSI&>RR%&1M=*P3Mn#VW>9GX1sGdzvDn^KL@jeW_U9_i#B+l383sIX!D z)+_u@X_KPdI4RxU!genIvFXfRks;6RlXYeRL7o1M=ZvmZ#n)AWiia9V-pL+U@QM9f zyV9}Y!qP!fW$qYF-g%UVX5g*fGEa}_FH;Ft?q9)Q)DP07khVt0RrY+|-u*m>LfL($ z*J{(k0d%yl48X)5>O_sQW*eI)IV$TmobHz%b)}%|!tcBC&$`K<34Wty{EP=h(D@{h zAW5Al#qUs-j$5^Tc*Zdn5>7}?eE7=_*czi zkGrg}dWILizKW-D??X^kM~wI-oG!GP618fjs8~u>3}TW&1vCk1nB4=b$a_%JQl3$s zZ^e?hrwJg0j*ci;AC9C(G-mY~_9_+KL4TFuT^DR)C1klXOT0teW6^dSk5n;3NKfPT zQiL5ExJ(;pcdQY3)H6%)=Zg6@ms1?12HOR_f#Vvu)1mPG7H;T4&{Ly|prTI@@Iy6f zaY|DzJ`T1^(thFt&Xw`=>XfRWjpZO%gL( zL6KZ-e+w&AC*0)S)wuWSY{8~PxlJlbB-&h^li>QboO z(@fKQ=;vOQ&LLVl8i~tEqN}w$#;?7k!t+}jjoV)5=hRFOClxi1h2$1Y5!;!@$`q3| z(%O$)R3t)7UM_R^TXqUk+naFteuTE*VTy~2YtI?Z+4G6M`z~-jgnTS7H?t6LLKu}q z!kir*T&w7JSZO3_1b9o%$(s#C5T+gw^%KR1$k_hrULQC3^4ti=dv zACmQMf;u&%KrxZ__t1*^ss(K!12=BVOrHKRXa{)7GfAXJT)gc>O-o04B0*X_2E%~a z=J@y?!d~h>k>@1Jqz0*XsKjqVYOl@4JZ&cT?p61?w)EDGK~8v^!4s6e8WJSCa{m`` z?-|w9+O7*P0qI5Q2#ARE4$@1OqSA}>UZjb1siBI1C@8(Rh%~98*AO5my-1M`A@okD z36Q`ST<_lFeb3qFjPvjNl@Y>7=6vS;-0ixq`>CE>CMtjQz~gghRWs7DQ@tJSXer`& zcM|6*3zv+`w%!S8BC-si?BH^tkiq;glu+t`JTW7?@Xy;KP=9 zp8*FVB)0N1Ze14glWpCnnn8;{KZ+O-Ve94eDO418#vmR7HJD=TGazhqB)-76&D2kF z1-||8A;2KD*O(C>E@lpg;4HHok2!x-KP-vfS?dIymZfX?fzZ`P;m` zydZp6Gz;0*t`fa&l@M&U<+DF-IXKR@0#tbsW$&K?+as7v)QmihsD4j!`DhoYamN^p z2`G5YfjD;&8%j=$Z$L2&GgQ)9ay=*~V<0o4At52;ipG-!%6o_yzt*6Se;d8z`YY}( zB^&*Uuk~RZ6JL;3%S!P#m4UqDruy)QGkO}0qxAuk z{#D!TwBNMAzpENNP9RIKYn@)7*VSf8^`1!a+2x7JkzvE7il@z0mDeXczm1IrY@&uf z2~q_LyP6NI8039fligCkBoxEe4ilO+NjaJ324pTWyPkA*)7apWC<1(}gLU@3x(yL_ zs1~1V1rSYIOW-U#68fs5d1z+-Q5$n7xBrtW$wd<#|L29riSJn1cXCykvGe9BCTu~| z74T=EqNbK50lFX(_>1ir%;Z`v@EGoNJKCKy-tja$XS%L>UC*Ab{q)XM+(cXfB}Q2}ZV*SgCb)-0D0+u{nDiZ^m7)`tM{ z>y#oZBJFR}VC-sDvDcF8uZx=mD$cAb@>-||{w-jiI?$&ZN2sg{kW)TZs{S#$H z2#ZPqSBv)Tj&lWZLEZtf)meG|7sCo#PExY1F$IB6JI&g1&=KI(gFVS$zoJ;l+)LLl ztu7XMV9iK{MfOrMT_>{OeF_!qxuRBvy3P^VNKIVV!+qU$>m=%zf`y_eXJF64w}H1Xl+D z!u^0W80aNIAhg_-$z=0*u;`7yj$zMwWk|mesBq&p`k7(qV(u?osfvmQ;z<0u()?_?`^Z-=o^^a(ub(xOnz$L1qPuI3-X3m${V z3wG|jil7Z*l#z;vNY7B;qjQT}+%(Di+@o~S8-h*JV&mC+QH6mr%6H3pSOh`tEr2`T zA2?g8`okUhXUxoM3%qFP`&9cy%-miloji#fx(j0z_pq6PjZZc;H&=kRh`6Rw%zbE# z&OEn(wqG9)Gyl2u@#N!6z7>mF$M~2h}>6Lcav&JF(4sJf-+kJsyyM z){8j{;v777nl(K}R+LwO(mp3Mh+mJ=u@x{k|J^-FnMDpfddZnN#QEt7GuCCm{hM=+ zW%q#ONQ3W+9psYu`CEwCXBzazyBJkwXGI@_L$d))@18-_X@W@bXaPl%M4^A^q1}Ma z^klZL0ez{H*&tXxOW^J6u{d1S(YQ%C_%*JZG~f$)Ia6NSOt`b zCaWR$(g4$0VGeLm1=oU~q2~Pe8zuH@d?KNeDL?hYEaaZfniUu5hA4E-x$nC~g@>MH z1%*yyv`iO3JG# zM;*AuYztrv^{FNBmsbKK$qfpmE$Wf*!g)lqJ*_5Ey5*b3xvtH=xw!=ta<*(~LSpNGj{1lG7?nMLFg(v!@yKJAmyCRDMQO|j&)n{^i^UEpy>zWwR=3%WxHOOoE#{@SqWI*F+*n0{wvPuL^c-Un70%C)ZAvU?YP4A{UHq#SNo#ISDaz(b_IQ*u1W8@{r zbvIJSmKuEUF$Lp#DHL9mtf3DF(C=Ua;%#ajPaXy_t^#fcNd`#?m-BNKr+=$5!j|ty zHCO)DMR^w%siSOtOq90sF4B}t$cWLzLCnOZx3$O#g=;d57S`wiVhgtke5H@w@X4|Hd|9YZg11!(Xap;{n6sc` zslOwSx|G>xkehvfr1#rXPgS9Z_uy}YLB>!Zt!3_3_>a)Z!n|u}y^*u&Z{X-a;NZcj zh{IVA<(>Q7%d1mkjRVVZO(&&qZg#=M>j1y4!jY*FzqGVUt=Bh3KgML;HY3YS0Jrf^ zeE@OKEC_tTlGtKptSBz6huF)oYi3KLKss&?C_2%F?3MB3NZ)vlO+cE~8`#J&)TW!!Ov-Nu9Oj~)&=5~GOA z7kunn_~Czfw#nz!*}N+2AQDNoY#7tY!?XYP2lnQ_JJ1&V4Po6cE$vKkTF*Lm%% zom-(TXPNLN66N@5hiBC!2O4TWV{tpHH$c$nRpz+fDK%$y4j11QJAwknXL5gKHTWb# zK(YJ@iwLvfg_R2i=p>E*{3u;)dR5u@V>ChQLzyNXr7eC^FkO1KG`r^7?@ByHYnSz9 z;I;;*5c{C83-3H{!O_~|yjKw10Ylr=%-#>Q>0dsi61-0h>KErx8SqLSIw8@cUH$>= z>=Qjtprs!WL)_ZQxe}Yx0!p_@zqE&iA7p3nrLK=E}^=5m!mn%Pz(I+3iKJu z0nsovpH@XTTi0YK3)T?tVFtx$&q_f)Sgxsh(^8apQRxRUKsdws!^%11V`qv7yb)}# zV9K+_0=jpWdx9PhnCT<>--l)l*L=9*#~&ZB8jMqSmHQcpjU6RpYkaNI)?{>5+C41r zrb_7om-5NupzN>dtOOsDp}fY;h$D=JhjIom?z8d4~R=;(|WP?J!AH2 z8!YQ~P|7jEIwBl4j(2I~!?|c-`O58aTkFa8)w>GWgB9Uw7E@eCIao$sh4Lw{O0P<- zs`SXWhG$NLr8QO795@9)oL6dyPbE*%4mVor+{fob$;=Gsj)!*OoD@|;ZM*}H?whn> zb=r1L1RgbwOTmF-cQ1=1;BoY4*6IV#wy zUse?DES3sg9NUiYIY@bunZNM4)deCt)oN2S-N11C7%Y(+mF@M!@J=c<`o8{i|B--D zhu-68?1mUzN_>woXv_o|yc)y+E)^46BncIsu03JgG9u13dwwZwdkMFzOYiEaRm)0A za#LO0+B~rt=%7XKb7kG+%I2y1e9#R7a5f~m3_IT<#SvHlfkuuq*>+X&wYH8 z_N4|(T_P5W`VZ$^^FJPqClT%pZxv*!jfOyN>kuoc6r~I((vjQOxdxLVFBd&VM!$ua zw1B#(cn&=Wcu25qI|FI7pUQ9i`W-@lkP!7Xq|48V4;!@4_I>z$sqX4P{o(wF2hXVb@!!b$O0?v6*hBXJ#%shl5X;>U@U9Vb^?1Jq5OWxhBB)S5dJ<7Fe`6` zxF%sp)KOYqSmPYSWP{(fL-fV0n6=ugj8Mt|xW$plmx-HSE+Ma~#6DeGk*u+ht!U&`$Ob)n3f(U?3f`FCXp3W&T373W}*Ig;vClGsaM+ zA%q2{;_>%sXrP5h3n)tUUJ@zYS>>7&X4(+(o+7tIHWY5XT5MGYewu4Dl`tGk$zzjt z?gt*pkz(@v>8d6AT*k$3r7mis4VeyhNioJ3Ru&NEQ);Hr=V)`ok3PxOo^a15?`gX* z8)un&`%?JkJAE*3gnro1)zkL?^E1fu^Wjf5e0}e0OreSP(9s&1K51S|iY4pTRFmAP zs}hs>L*&=XQlwcrOdF&I=N;bdweF>cZ6BakWlb+| zomY7e)E!?2j{;o;0>g#ivB^Z5bgCyExh^nkUM%%c2mGlRIl{tPoO7)JEv($moy!*V zvNJOW$;l{TTD=_BH^LV)Kit(?rVPBx%ZxlK2G_OCt}*(T>5Ye5HBl4A zC*aV#npV1^rEOiGvgho~(l0&faJ`iwSQUWxa*+ z1%By}!*4fF?B7qh=Z*6H=Vj$3&~T=}gHf7ywEM z&XP4`En*;;C>pD1Qg9Ec?_~Eman2nZ zetd6mwUu{bvd=bd1g=}9ds#fqv7yb82eKL%*;~sKGZvMDrIq<{iTtQ zPfCNB^rOb%nI7{e-O zzf6(&+}zfa7k4Hz$f$G!@X6w11NIxS`z{>im-7cxO%)*5$lXr)UwLB3b0W6wn{e3I zLv47xWrdT^#?M{L`fK4S8(|xE8+F7Nyh{US5_BdPW)$fjsToNmSpACe-z-Z%Ti1pj z*I?=VTL{11hz|}yufuGr!U-a*&aO}6B~gG4o=-l}ZI2ay9b0^HPfa7WM0cNhrFn#% zxJ@Y;LAd!8e=|fL*w?$~BlT_E5i*^tYr0yrhC|fG`NRDuayWXEj|~li@1fRY>XlMw z`@qIt-zXamX3j0ry)BK{%>H(J5fTm?HJN`;QGncw#=ea3rMf@%;s9VSzJ9?sbH`5) zEsn4<$+j-{c;}J6RJdP%@tN=3!tm~%rxg}}*b*3ePo+Au@Q^fg^+a+)&Vo~O<9pc~ zb-T zPYtthOp*b@DAwKX{X@5_z(meeuM<34KL8pnWWbr zu>h-nDuwfMwKMlL4}{uU04*6tHq3u)vA?4|S;Rp4QJ=Jh=h=4js_kX6<6PM)7dv4CO`!2MmFjbXB{Ub*B%`_782oL%~Sb;nCEV2{nm)V5L!pRYm-F zwF?RD_TmOh{-8%Y=zh|3L-FTLDoyIv2LahgS(`wca_hHw$s?u(4_0MR&k`G}mgk*I zkV2^Eh#jXFLugh$6b@l9%H1Fw$!N7Oh3jiu!tZ_ga53D$Rr#Fj^gb*}Xs8TGmOTRg zw!-L|#^hFk{6QHBEx^!;GrOJ1$xRy#?W3AvF4itRvp;+A9YrK<53JeOrGMaPG%Yy)3osm@u|oWc1b(|X<~f6ARf3uZNfE&AIKZ z5Po*IH>c3*H%Kk<73n zMXjl(#?wG`o#tA-trj_>?&0k1mcK9*X9=!8mMo?ZWKK)d?`^4y8bCqC zcJ{v_-7QX>$6lL{D}D{D1W}{{^qZ#%b0f8RSG!0KSb};3>)*L>vB(wpptK>agICiE zri&IYF0rEvyOcXO>E9zlV|Pkb+2lsRx~6o;2^*e$8eKQ>oSlwH6f)RR7|}1IOT-Op zlsY43I!-ldM89|eI*zc)KhGR!dUAMXEI}Bj!fObR$zI}u|HHt z`a$iA&R}t*J8qpzr=q(Y2jfsWDm67#frQJJNVYy_v)Sx?S5$>+@Qt13SZShU#s-ikBAHuxefY~e1AUHp+93TJ5r6iMGVpGVl;@%T+7cz( z&KX@3BKo4Jyt2?}Wxt3+-os-;qf&~K`^T*llpXh#SLtT@iI=13%a-;E3#k< z7A!w~0bNK@HwZetW?QR1;|OJ##vKi2eC#;&c%$8C{a)ydV@*pkRxpvKvY<}8`J}dR z1@PIBsVq$MZMgGz&rqvjxHtIZO{}b}a|sYKq@y|2GCMtOG5=HVG)ApzC^1wOz%TL9 z|E5x{B|o`rhMz1nSCIW4@NE3u^DSUHj@c@?x1Mzp99^B6e6g1|25QpMDDf9sKHE=!YAkvprh>hU=YYQ6qBlf}yn8Wt zfsQ5el?01(G6lm=!a>BA{$ME^_oX(N#M9z%T0<`3)r-zc5E`mX-$Y34s zSS#?(1QqDOXS?L#Ri+Og{EMsQoOu^(Bz)cOt!DEX8rVwQLx!|Ve5-$Is*p#DJV)K- zInIvnZ&Q>0ds^3@Z^(sragxQgL{8~9ddKN>z0kzcavI0cEe82nYR?@9^Vg~m{QiXV ztqUhTsHvUF#*iVs+@JGQVBE%lJfI~(tpf3g27K=v?SFw(_j*%yuHQ!p!~7!rNWlzl zwEYEY3&1r%!H+GW6^gOu>!<7Ngj{dRHLOKyyP8b?8f@6rAs-H(37-Gm3|8MDocpns z(I1t_f16+1KOw$fDg_6Y2|RzBAT}7AW=;>*m;UA3X6-va$d#pDeKLoGC**(3EKj7@ z$+*!w?2PnJ{{8a~_dtIxdk)otWjEguiA}1tZ^Rri*TNt}W#R8*?Xr%@D_QZ%Hr%m5 zJ8Fl=!`u1bh28|Qh8p@1Gbh_bHF^U~_K!1*;i3v>V6*eey{*Ac{U${?U3t3zB^QpA zGV=WWZ;Oq^*ZEW@9RHAo5!Tiu5^qNShDmtIj!tGax{lG0_)cc&dkhAHBsD2oJ|3h^ z*q??J6~szj%zS{`S!6GFdwk|>@d!y9L1Ro?s+RqlG0FuS=kMnDa~PynHvG4^Tr18e zP@0{yJV$0R7?quopOvwWg`x9e<{v|ci%RMvL+e`x+?};r`N)2|&9)fT8-sQrw)1=a zAojK!3=PLOYVg?`J&;A6oL9!8j8|^kBwWKMS@s^INLwV7-?A=VeZ6Oxm7h8jrO;mb zSW?1OD?5Gq+2fneQBqjRcIrYSQL6VLc6dLH)7M$1RhhaK*ZNm)lH3f;1*nWOkVrN# zjU5L?*93FYWq`ln>arCfQ=?7pKtU7<%XdO4;)VWKeAYoGy{4eX?(3+rHeuhKAL_TSV6$)_Zq_1Pf{^s3DpQ|Ah>EadRo}VN)Rj{XDmZwK>TnuU;DQIG>_L7A@B8 zyaS(Ov2P&*i&LJ{aSAB0>*|V2+i%Qz#qRVuXJ1(j^8P4AetisE(+^Na?7;$H0}%;) zCpk*D4(O#n#%~<+0EKKuz8v^o^Lp^SdLMt`u6FOJ0-om~pP<;Q`zBoCqjT52#3^ph z5xtuCF9uo%gz%)%H#4^-1=r)+Z(L;5FlIvYe+Hgg&ti5=-ej zdm=Mn;039VUoavEFOU;Nb4KrP=^6LovGuz&RQ%{j2Wb9IkIHphhjK$!gb~ROv9#m- zgr%hJDiLh-y{p@h2Vtvf&$#}#gBntgno9cNI}Rkss>rIAcv48$b>sNw51x`7LU%j_n%22V*yx%pwTZJx zr4^*5+v4%{x6C33BF!SFh^5U2pCxQ?JzWCH&58_;KN{$3Xfjr+B4kVHu${=Yv z$?$^OO+=cF`W*$nRaHoU_#B%8{E{qJ8)a*oC$#z2;$Vz6>gMG`X&`bkz_(3a@5ssJ?Jm}|h@hsIIwtUSbVU_d7 z=QSQWXw(9Xfw98*UZ9;H=~*>8aBK!3XVzq89T&TEM&G$8fowah-{~LG$C>Jjk=B9N zP{8)^ArAvC56X`UBa)z9v{4R6LcfGgR#ffRf=K#T4ej5D^l`lTD8aMJNw}Xx+D{P5 z1^{a!vcxYHtflRAHeQ>V|1fut>I)ef@A)jlANz7bBim|SQTDa19kBJ|D>Kie(?WS+bkIqAdKlUH>zI|a*&3N0-qAH94eN%R&y(jgx3~odB z$@ulB>p-sOn%+LqI{>z9T|^ua2A!%(K?}F?=c_)p*XR+R)>XmbiS5yF({*Lj_J;Vk zjn-Hp(!+%I2L++5)9cxWr-fshW}0x(S)`|{h(RS?gXRGp=4EThL3KA7OzgV-i;SuL zKArd8&(%^0V&p#e^z;C1$G&kmMlgaJ_sqhFJM?{i?Qh|$%U*^!q6Vm2>$6!e87*gn z_Wh2CDi(?khF#@xQ@#9VT575YU8WL{_c^}C+yP8Zbt2f=M#e$$LqeRcCrLNpC)@E^ zY3|E&TZWqYx_^lOfUDE;aZ1ZCm-$(!Pke#DD2iXx-r%o)?DXGX-i6WK zo@2B={;ILBQ#4aEWAq5{^21Ca(ctuV8GZlWne;tdwafad#CO?`jByIn_Y9PIo?iz; zr3dA#Ut}1O0O?L!(UQcxU|iCE*F}RK zc5CGlClxYW3NTh=6HjnkAMl?s11hr6_r2+tR#Kt5HO9Tp;`K4k-}h^Lc+?h=9%o8_ zLVrCpNJ%#I6R@R2)mNQ6=t+|*I$LMrh1m_$nofu&hz&9vRUb|u3Dk2kUED4Ubk~7a zC>mS+i)sxbM`AAX-f6#bCLghuv!0BRaCiS5`X#;+P!|~25%wM82u*CISNw4<5!q0t zwh+>=CN(<3`~DQ#7fIr@VmD*KJ?jlS}(9@M4?H& zPX4hJpZz<&zJ~ub3t-LLHMYPFN1eVTLa287KlpKdo%OCA`ti<<;c!HS9h8;%0#-(7 z`vPz1#H@6Eru`zV%5Oi<2HeVmu^AhVj@fzIvz0e}xm?gemb!k@}H9qytR! z?pjuY?-r4`_P#B(QwY-(o?Xp1EVgn_Qso!RUOB@zescGU+65R!(Zw8*jIX%uA}r5` zdAzJDj(k(WxXKSdJExd(n& z1%zS$w%Wg2L}pOn1auA$*v8S4PCGAfdYl_tQhr9*Z3$@%a}c}az~S?0;th|V5BgNL z9O;Jr;f%saqT4|Nm@E;&ak^x+Eawm>B?|{3&cG0vHzc>L_O;kg3sW9z_j#N*bp?aT zw{iK-d3W!-jRzx27^|zMWs*Ob?)$J(a`Gu0xvtggcXi6lX~29|+2KG$*=@>tACBF6 zg)LH#zX#4tCX=BpRq-9-aLNqzJ+%*6*O1}ZNeK!zTS!$Rj-A=Q9}?!=!-kS$<8rHrTew+;opi_;;(sdlndw{JPWQK~|KZO6b+Ik> z4{)cP4;WAXfl_ZC_kaJ~|FR6f?&J5Amexn2PixMkzhwUV&HnoxeSJ>Y-C%6=M-cRX z`l^5Z%r91aw!LBb^8fQHZVKPra(j@nb7u#nyF>LJvT)|>LHZOS+sYqW&;PgxU#ZCD z%On@qXMwX@|74;6x7+&v_p@KhgzE>kW~2K5%VPgOT$Kn9`DY_#%M_n=%SdstU`sOk zv3HHsT*T_6C=y3vZBllujkS$L?UTs~GSce_ki$la;pEus40x|q#KwoZ=Ie}tN0mQI z@g$9ijmW^Xh79pU5l%cD#-&H1@1qzk{>QNQ@6Y*vUV0|{p6}>(aSbQK-ya3rDgr_r zyTd%6G+ljU9qrvkKl7t-h#h1n4+4XHS-{!jbJc2cPnO<++8KriU8wxF;C*8+-r}TP z3Gxk_fmDo3g#Rxa=zqT`U`&|jz5Nk_kPO}eKXQSJ((|7JG$FkER`j2$+{r(0{Tkay zxrS0oapx9OZ%UF zy)#CMPxd|2V6KGk%@#X;YjcZxLdds{P=-s0IvdHG!NvrSlo!@)EAM8AA+I^U56Cx3 z_Fc%SBS6YJ@GU-oQj5mqMl0PSXzT7^Ux&)Zr|S{S9&8pyV8e-ci4d~M^vLr_(&2LE zNlIFJ4#PN7Dwx~p#6#1^tagr?qP~|!7X$}rM7mY#in#pQri>1R{zC5Yr(vMHt8oz& zcjkXS-S6FhU4CYk83(9swA21s@`SDq)9vj<6TkDwFB_ySimF?X#=`{KEPk9%R@4Fu zJ)j~U*ZJ_WyKK+Meh*&e@uEoi-z-*Gv}#y=J7`Mv`fCiX_xM?okn;CC>8^Lky$Q1R z_4*=pbh-B>SX40MpnJq2A;I^ovwNvaOc7%7Ppj%A`xa$SRl;jy$cA9UT!;P?3V*I5 zK>xR-E-;|E62=b0z8@Ne#Dj_zEd0OdJd$Pr+K<;M+xev+ZEdt|Lh>{wjf%i4r}o`K z2RUOi^R+cBzowOm|4DcsiHN++soR(uO!$S^wEd4w*Kr3QgGf2|j5v&{5EaD{uX{Si zw`&%9_&2;kmlp(KZCte+byV(AttSU6Y;H0ySgS&`nD&RCUH;25@CP~|P|K{%>|J1WKca=_J8A?8j#duuu{+63lI1 z3lrVjQo~hIFl=NTi9u*ialgVdD{Z>n^I`11g^D%!!_;V+z4OngdA={--xzYTca6`)ijUWyUQOSE0)<{7EdqAo~Ui}koCX9 z55s3`B=I9=At>Ps5;rk2)><->bf?|a1KR^7I;a?twnP|r8O--5jj+Z%RlKOUD`xhu*s|R2xfxw;Z3b8=Bd!@c7MQwAYFflXsT_q zz^F8lnz5MH+uP+Zz_G7HSo6_$@Gt{hS37CS51YZlhoe&OalU#wi4#2v&YFMy*^;F%@mgMj zDJJEo(=wQEZ^)p6X zknZ>@+CjwH8h0Ghxl5lGT6>~R7D(Dk(u;VX5@#jC{LO9xt7qTtKS3c&cr#PMLbL+` z3MQbun$BEOn#}Zy9E#BI=11g_w-1V)=U#|kiA+o1}FzvjgnCO$L7mx6Xe3%EA+;=YYLa#sQ z^r|mgUb$Uci&LX`W*|RX2Ys~?a^X%7GA9M>F14rGjO3LEM?Rb}VM-%5Y^2I??;%Nw zaEt8n`y7ey57mNl&oVY9#%j4= z@s+dxQDw{bcD%Y*8_I)=F3YMSLWt5NC3ADVRvCdaUkYvpeTCmMEXLO2Dt(Z;>2%^y zPFlewfyG?>-8cqa89fri4WLs|jMwtjDGaA%G(&@ihbK;HS~UeZxaakpM&vGw3)*>m zgcASp@>+zY<$g53p9D${vkVWvnEOu)vJkDRD<6vE_>3D6HOkQ4+3~jslIe6go*b+a z@c4yiXk5EOA9sJxOMU?HrEbr6z~qK35h0^qZ#Fr)ZR{I%Sw{Vt04~X0=Ojd4ODEfn zEY=`ZXIw$?E2!Ht4}P%yE+%?4CcB4xsrx%9C<#*%KU?e>A`x})EY;GnO?oV4<7@wd zklSey`^fk=cfBAEJB78X=cdCwY3 zu9@9=1*%R6O3!s;Q|)`9W`uzI@frPejZJZ8kz$qJ7g?T=an z+i*x+K^_;jTnz5+yQi>mQT;ac$}w%dXZ4g-e6A};kf>M}0aY|b+Q*y#`eTo2aq7TS zUvcV)NOC_g6eR9`^?=s%sq9V{{nOsR#5z{V|A{%4uR4TPSYXQpGO>=iRo{=& zD5WLm90{R8sroWYU_B3dV|n2_)2m`Vx42gy-ioR=n^C^4b!XT5p%125XHA&Uj{c^U z{m+N_@9)U5Ezj>#9CI_Jae01Av+M1PF8G(52fn*SX|TK6eO`XjP8`I5_|@SH3&4Xl zCU6j3@c^_Xb(eYZ;0pKeO2>P|RDDKjbwVpVM4|#hx&39d?^5QbBNaCJ5MVrbkR-h& zdwKkmC;T{JTI9ckY3QHTkpy<3HZq8XXVm8{%OGzjluEn#(p2&!9a`(B&4Y_;X2cMT z?rAQ>{L{^Jjf`u3Oa^Y!j_1*NqvO_;J$vUYUepymdt#q=WZmWW4)jv;PUMhZgndNc z(*%!S&Li0xln;S6LVpoZBA@ItEIx4Id5{fk(pd7KdJ4y3hZZdHhf`}jKSKpPg5&*& zK}=%~*Gd^)k*$%O5v-9C1a>9}Bbe+nzJ7}u+bho@LofT!j{l~C+qiH1(mvx@cw~F& z-F+4d;m<`Z0Q%CMzcKnok`F#a-ZwOcp_V?iijr z*;0A+onfh|`ItAt`-ZkuGP zaGhx_%NYtA{_vB8dka92P2D}Fzu9_<d=o%WwY{R$lVg#qoQ=aObr|^kXdOj`dZMCl}8oNYI)K zDthh3PQaZVkBgAWC_bA7g;q$*TzVt$^rBAkK-|h*_=L-=0~Hkq-DP)Op;7nVcM6U3 z8j(to406Ay59_#MKcK#v@%p?xxxqU&7cY4+{{k?ZNwlzNWpEZV$7nTi7q>e(aGaHP z+~ApcY^66QOdnc6Pz%(Og;Q%{pkHUQ3pFMMgm-T#JV+nX4lX)rY?gNsq8n=~dY*C? z^Mi6ucIRh;%xU)b$L(CavffRb>pvv1`(0N{0*+m#4Ih^x#TrQ@ud;%Qyn`%pBc@W+ z;3i)w+OK=khhoo;B6h4LgSaoF<73^43KtG`a}(W&(hDg2&M&66tC38Ftb8tl$jY$Q zp-8=y{pO{%CECvIYLU2FDo)=y9=Ep;TK>SClS09+NRW@@^jN!_eKx7FTm`zPTI1ue?fhD(Cn+Fv7338DwTC0lM z%NS2pPM2b!^posSMJ1lC@!1!R20DK_P;Mr)^wSYW7n&^isPE{tr?M;0jBJDgy zdX=XfEFN)_Na!z?MMQ}$O&DLw-x16qD*O~W&HDWri($4V3oF06w0e`ivC^iYv5V8C zP3P44pV<)+^6Xf1#FNgnVAI302&D+or;TF7@@-FY6s?x3lG&K2wplv0MAY|8h4e|v zjxD!1%i0GFL-&Jf%gM*U9Yv zm3coVY%w|DDm^|k&*IHth@m2DZ1o-p)pr8X%PI^6Hdi94`;Hkrnm$Ra*o8T^oF;j+ zc$B|m3oqxwXsAqiVxp4>j&M@V2nM0aA_fBZWN>uo6P{yyU&AX-Rhcq;OQxwuc`BKy zjx^3}2;ukjJ4!+FnCzhlt(tc7D=zer2kgVITX=6{IwV?BRKiZ)=F&c9>ih4|!H%yv z*?(C28$%;mncznTp#t!tC2C6nk?uz{?5CdJcitc>@IvCjSziv_R&|)n+5sHFCJ66a z@b0P0h-C(nK$09gS0)Vjoz>QkNO0y@+#Pz_=zE63R8U|-6d`E1}wJ&PqKZ96>j z>QxGbS+(AHi>;ed2fSxdxx1q?#u$my%e1*(LIf7qGPtkScU?>YXSTW~ML2b$Vm9st z#nQxj0`&@{5@dt#Cj&(+@f&w^H?9J}{MX6eD_Jsjr((tbxLAjG5_!A5h3d zmv@)OG^@PUGNkz9+GyiL6LqE#iurk_Z)U9Y%g6K)By*BlW=jP6Bz9Yw`rEKO93D~nznoFGPZNrT zR>}uU17R7m&pKv!@6l|PSsr1plgsF*{S&!Zax#L>L@-*5H+&R zIX@vrdnC#lIMA+rG5b{IPyHU=`?nM>Dp7Rgx{4Rp5}HAH>L`x9cd^DskoGE&Y)6dk zOMog)CJsIX_V4cNTv0#GMSjB#w>8X#j1yo!=tI9nXxaCL>ZB*r8$z7Ut4mj0^3>Rn z;0A`HhybXtcWG4pm5pOsUO=UZ`$aD_PFjooEcNEY<ZqeG-h{t6J zFZc69u0Y?3nKOvsc5$Ip+emrtxA@E9kr|0-@)RvAj6#F*t2sMLG?m++*IDWnFB-bA zJ3DaMakBAaF-;=4r#!YRXV0_JQg05~cCLfcn~FVUrvOsf52h+U4`6i~+jx>eqVae#L!EseoA#`^fzu-%VuN?dsW3e-0jGJ-;svlEGg(S7`7~ zkYZLSm_`?2yF32AvCZsoJmQ+}>Olc>Q3$*3U8rDJK54~$Ne=<6#ugXOU>YK(h`C9X z$&APp52$~(-leCUh3X+sjYEkW86epO9~*;lhrva zJsA7~BL2Mhu#<(wognc=u1O(D6>}*HA#u@gU$*V`D8hE#~@e5oyTEUs-z*`WMxezZiD%Bg>6~ z2G?#M>xYHEO;zrl)%*xQV#cBRs(8$g7xz_u>Y2PGDGzf{W?d&*q8ai4P9qWapRHj< zUs5<%m*{NMA66|c@}V(Vv?$!*37^gwcYOE(X_%&Hl%@G&rVfi23u?A3$=L2_-PNLYyF0yc zxR;@5xV1nGjl-Rrh*dOu#}Gt#TsXMysHSe8NPVAf@WUMd34D_{tc~zMFX5W)eOgh7 z_W03>eN!-CL^%W6AO@nBhcE2Ty!6XDPQ8#-9ltEs!^ZS4iFQh#2dRch$;z#B29|PZ zZgi}d_Ff&Q@iDUl-*wS=yX|<{*x3syWUac#aJ#W zEa7z?@9!1yfMXwT9e*7RFG3kLUjFp)j}^PIpcW?MXI*nT(^e|&QLalLauvabKERUb zYnzet(56ADR&UIU_Db1WnF)T24B4GXl&wjUEJ;*h8&%tL!w&Eqx+4gmzso4uon=1d z_mia^_Ui>9VQu?C!x2##LWbs`vwhjV0I{kIVk6Jn!+t<1HEq<^;KWFziJJK@vA3|x zWQRS`vxf-Qj$QPy!`mua^~U&vHX;&c65B{gyKKJd3lfIjl8HFxECVkWfs)Pp4{#gE z=jXusUEtM%lRMw$Q_2*<;M<`?yisuu=YuA~IQ-n%?Ucqh^I$~gG9}otz^fwILY@2k zSqx^O!eXX$BsY6oJ*iYty`-Q&sH^g0Tuic~`Qx^O;+7VzWJ@l9K~eqXs90Ao84f2K z?fFY9OW`kpRgU!?uMYtq#~|W9Zm~lqYPA7X_IK47PFa(E+iO?sFltZvLPWE&9UMHb ztMV-*xqY==JcFQo#_hx=zgkmDsm{L`RBwEu$UaT#rZ>Vo>O}F5uxmuGy}0b7VSZU_ z-o7PHR+y$q*Q{ApUC7qf=9&?bUDmbzupn5nY({$4WT{0zLEPT%6lv4S%p`2fuZ|Wn zN_XBlX1p#=e02m4I!4cvFxjU9i8!tL{g^n^ZLNW*1)n$c$SsKfkFqBi`M&Nbg4&;;F0t)xx zGVbJ!%=E{CaR+Bj*4Rtj9J-3P3?Y3p$iyr+LTKNb9s`sk%gb_7XVtB9w&u?DP=VF) zkJ*@iW)I>@{LLSKGdpuSH&z7FPaYN^T^_qocZhv}3j_q6WeZO7HY_ z7|=>Y#wxnrpgRRbCSKw3#2;KXK2kh^;T|4l6R`!H>ZdtkYwx&?&?xdkbiebj=>OV& zG?)bsnfE!kb>U|B&eR1g#koggSpAfO`Bdyy7Eigb_~Is$Tx6dPR#Dgi?ay$J+S1nJTu zHG)9sfdmL4?cI28&+&f7`+j45{~vzrLD@;xn)6!Myyo0%O+GM6$}I)(*O<>f4uB)B zSvfV^n}62GBGF8$?@xr~+|iE3D>+lXo&3J`2k}D+yyJb^iVdlRoWPohoL5{~7u_S;ny>7H6nhHH9Jjg5C+d?3 z%lo>oGR{O~)#5{=e?}f#ci0VQeR=Kg-R$b8_liy}Ofm*eOioq>^1>XmdU1|e9#7Bnjn2?7qech7E&n&L zJ6X|(ZVcbE@;-z$9)POM?o{(q-fq>u&%Bs2J^rar^u^_rt2R=hc)Ym|6TpI zTIih@qeFOC%ZTG)=-3w%3)@=N%c>SZeWfMPtnsgx$`dK#NNKr-I3s1b6<37xokJXl zoNKdX9^60Xv9?qrn*?;Mn}32ewo$nHBd133V45D`$wOMteBC895}zm#SyBWK^(fCf z`c(3K98G=s@HAJ~ilE1sOXk^FX#YIT)Cpa881`vzALpGj`+41z(hkzeSxfZLv(TOA zSLo2|gL^H$3N0qXKr-YCE^YLelQ&|+Ko!yfBZu+EdTafuPK@Dd=!4X|<0Hw6(=+#! zBWNz3E;izv*tM%qE;zxti@}Y+iQ->f6Z*JYylXf6K5Uw-I!o>-%;AhJar)Nd^r(!{ z)hlx$F867h)0~}*V(ta$l|b*tHRUq9_^Ue`vx^Y?L+fVv*#dmgO%Os-UmIyW-jEbNu!szK zda|w=-XX1$+dr?FI&{@e(&yQ-@btyj-bY|V)WWke-)i5-`eKerGYda;YA=gVRK~_t zuy-xdL70Vi1EU5S!Kv^o#ULfYy*fR>@|mZ1-X8d5nI%L=45838Tk~RX9*yQ>2~ z;LE>BpgVN$ZJCksmX^}|L{I!dD;noQtJVR1MK$f3K4|>NG6#JQQ(darZ=OA7FHk7) zQK&=^8yqNcg^ow-)~ynlbUWgccH8Rns@n_MTZ=)w@hUjlfgb3Um_a$-fdw;FSR+~R6DK> zquK~c?Zw${RxXCYCznGQDoe1Y*2T%fn04{hxp1t6fIZmmNW!@?`t6`Qa{IvxQjIRJ zz^3xTl~$idL$i}()w9^lW?4i6TRaRG#pzR5Wj+*6n@UrIo@{VRaW2!*+uG^)Pys<#{E=O1QhDIU8AW2$8(N5Nym{*K?zPB$H zaOLqMRpn;+;((TTfB!|%g2up&CN=?3R#3gPuF0`g;)x2KU^aSw6e^|+|1nhM;rhyX z5|%q<*U~=7KH2)|=#yU=E!#(u*c)7%I2t=NpJOu#r8u-}y#i3D-jn?{;Zvo~_RA|m zkLfw&asoAc3%q)DD>rMC!fHr!@=Ih;_FtL}suf8fdz)?w6-(1{-`sdX^co45& z>>k+gSAEhSd&EEcjvX_XztzD>#1aUZ`A~s}rlvKyQbo5A5s8a-V^_2Gf6I0}apwE9 zfXC`O2it~D&T|K>wnT|uN9L%BmnmzYC#~7quxY(Msw*!nr|Mg6V@OuMt~o2VN7W__ zM2%hNk0!_ZcqZ`;93TqJzvwB4XoAbzC#e}rU^5FH3vCPYIzuT)8f|_s)?{oA=hKVa z9R1{1y5g~qbO;;rT!@9LJ}dQct#&#rb$hAVCE>!w^yu=7b@*>vz^($UsQ>7VGfEb^ zjh|*b#lc6Re-Zm-g;EIeECF*#4Xjq;IE7%vf>_VkYS!6v zt@KvkUyl_4NUKU{tD0QlAdIyKcq^u zo@!lYQ3({kVDkJIcTJgp#P2snNMKP~p%G|giSmal#2PJllP)hQ0|go;8~CS7pDa*CR1q?)3N1M_+n#smFJ%_oe#Pcox;xvy*?)m1AGpSQhFTJX(EZ5+0T3_tj{2{_@ol@s$BeWt$)su?!eCo`pG#( z^5wZttkUXres_!LeL5NRo59{@jy!REvQ`RD;RWk>;CNgFX|Q&(CL*io8KhzS&&CM? zSynLw@pC<-@DK^XDc1dm{q1@4KdKrZ;4e0a248D?D}!!Pnk!4zoMLu_o~rox1N_$* zvom?}ai70olnUu)s&9(fG!t>LRLA(3wP~E2O^%sJak<}tW1TbEJq5UJG*V@9$e`s>`3g!Jh0SyXnd?Ju0rZel$8}|9?(G9ystlYQaCa8voT3|x^c+jzykyp$FDF4mPfOVl`!U`Ajps9vZf0OaXzRt5*`Q6&DKT7IhbsES!k*N`tUGDD3>O|vJSj?Mh!|G-I zBO?Q?;Hxw;i767FHry`oY9vK=*TYl)rL-_HR{((8jbBg;I(@q6jo!mgO;d}=UBk;i zZl&)iD{H%-)H9wgvSDS@hJ0=_PH6&R;n&dPJEytj^YV_nEAgdITynBJ1+@U$7wN&} z7mTmKP3D`=40!80%{BB;QpCy{Hfc6WrV6LqlP{+Gw9K*Y0OEILG1cl%uhN zA0fm6e{0XaaBQugwWI#xa$Rs?=^K_~N2SxYPj*f{e`O;q^novIDyV*EuhW9h=3p&0 zKjMQZu^AT)LwqaJ*>(a62LV1NNrt&Q#vOq`SjF?4#sh9Cw zrxeaQzkDn|X6hJpCR|yj@z#Zc?V^qi=`oAoNauu$Um&AWpsda*pw-Zev~XdtHCbOF zbjY36)+|X-a9Vv)sP)cG8zBSr|AfnLM}VYcQAo3L=(Kx%$*PMM4pCi5y>QjBgemOW z=r0wq&Ni^om2~{OxPsBTQ7!e7DS`JRRdHz+^+EFZPVVD~mr}RtG}Z;416_t0(%7NYKarX-0gat9hlu74(vyV%d(|ok6I)0ko4=m#k2(B+ zntrxDM$tLQCKPdHC%~n6hV5YdA={miftoNi?wl;shMLyHag3Avy#oj5d74F5H1eFt zQA?qEEdoxE9!EnF^l@94L+l*f^wk;obNUDIW69JXEey__-U0EQXI#zD3~I+K{@9gU zwt^lh!?f#ho8$#?uYK{A>)||IC)Zu%tFCvnhPJ|Edn)vDa(y(W@j#0M*1WK8LG}&p zHJ=Sp(Xil*yp9r;H|jLL;Wi3~if}ytX!6`7&gkP|d?+~R(8@QJg_+6s=(MYS(J8FQ zO3qz6-#rcCaP?!z@X=m>;91S{2}cWufr`9%;|kbA4=Zu#*h~TEgH_V#*@pMlK$h8c&9->t^E|?7h-LS} z(zzAt^urZNe<A?^%Ofnf;!{DV{sVo0|_mQlmkEYrA3N@}ZrHB?e!z_!c|i zcp3Ih^;c`*r?z#UX+GM@I*xVMyr8d=d%IGC_>IsRNC+i#?o{c`X*|NW2TO7$d_s}; zomx;24fO08f8>n2OMmV#f@@G&Yd}WFehFL#6_Jbbr zscRamaBp}LwY;^wM0friStu$dCbm2{oNa2OKx+^WKA*?nv>PiBc(jwbnTb>aQ#E50 zu741}?t5&9^1TY%l{Rdx%!xJTb!wY`++giO?Q23VwBO9QWt5+wW-v`9LJ_}4q2yj z0#iUfoWeL3XZ#Xw4mJyS708)-FMn_2MBB}_6j+@~4{03oJ`=&XD&r|o@U&`;7ser` zXAmrP+d8r|b&zC|X_KlqY%Pv+KfqxEMbD_VjRG%1C#}{pNLLGXn~TXtgj{)!Sj{=5 zE%&gpRvMb^cztBjGCFroDf>-=i8Ct9$pSbjRwp@BfB*eO_|}iwDm<;VGyG;VhSIQl zI<9XroV!`S-r{-9)}~aO{|koSox*l(IE8Pgz7^A<2Q(cV2D+OMZMJ~q+g+YT&?4Th zFBACNPO#TrsK!b5fNiec-Hnyi+d?c(+lYo`j&Kb0M)Z*~8m6}FdkwAM-fdr76l^nO zhwC>db%NPm3m9|45y)mQTvpdG^x9T4*pi}o1+SG@l+G{Exl7|26t%p&72F_S>d3#3 zWeg;xAAcM>yY_zR1?cSzYc|-!SkXuZDG7-!eQjo<1Lp6fJo+NAaFx7YX&6_57#fPV zL9QuzdphN92R9hms&?_ZIN3skIV<^*acB{vCIOgO=xc#gV|M4QaS29|#yDZqwUQghh3w52Vc zW2TGKmeUx?ltjp}dJa8uPOte8f>dLltXFeeAOZCh}JC!_+Hr(pTLhgz>AgS(aq)3s~%-;iGpL9>Tn+ zZwH#z&iIE4bb3H2^+%g7LA>)Zp3m?rnTp<_u6~^OO51JDE^3euA)rAZ@3I{DnFK|}|y~Lw}Z6lPxs;MVb?cTCdC%@^!zMH?A*Eh&OInI?1SL`j9<^u`)VOpNPIq;&_ z@9r*BRzX#+?M#(2RV({ekj;gQB$NE1G||wwVeWR}!kR>~OVMk1`M%ql~ zN35D{-5IbyI>`?*K19M=I(T`}uhAHMXz}WfSt={aN64 zXmj7tmX~6;?lt1zqg$JLM1CFMUkm7s%Wd4tTv`fjuD8yP$H;8}VBgBSACV?jqS@|l zBl^MHENP$fnS)OcCS*l{9t^NW6$FXMnwlWeT-C(|Zd52&1W?RP-%^iq^V{Ss?FPQ_ zXgr}(RyK7{H~hP)3HJFpG_Zjc=U*Id_wige8Rl=@Y)4>yXi8AG6I})wD_J11*K`UX zMZU;<$PXP0GuS=)O~5vOWCm=ZY-jc1=6*^+MY&`n`PeE+hl zVEtSO?TjqR896FNtZ8OSoSW>GXnYjQ#C$N}FI5n2^8V1s=Dlr_mhZfX%`$9> zrmp8ocHRlD5+iSZR6~Uxn4Hobm8kNREu}GQtgi6C$*!3|=lf3v1?pzkUjG1TC`6L( z)zW5{;ROl)r8b4+;ATo@^{WHQY}PnoWgqvMu^Y#jcCwRDYtw6yuHn+8&GYJL0hGeyRPFkFx%yGEYW4US>uVuHZHx9u*aQng|%y9HB zity29qd<*J)MYSF_p)#HQ*Lkb;1>0qoV)}eoDoyvoJh}+jmZef5@d>o@F|f2S=S}Z zrg&Q~tkD0lSso$Ol-r1Y;Ei>y-*l%z%~}T5_sv8^X7X25Ji3TlFIWwN+vWw}&0ck< zOd4D2Ba%!ea@Vg%jK#z83R`{?S%qO^&1=d(!ue5kDzEg%$xYC=4x#GCi)n?z!wj~b z0!o$FmVRwEEeF3r*+{Io({t35wEXj94%9L?!9Og1R;(Zu_h5Hl+Z;P@0l_r{NeB}# zO*udl*WCij$=0R47l&mQD0CmwS4op_s{q$GX89EqXI9#j_Oenn=+HivFL&*7k}fxY zRmLClYHz(tuOzG)RPa7whA&1a4x)H!N_CZ2q;SDQxa#UapR$E7;41&L8)BA^ zX|q?HYu~oJzxMibn;pTLmu5 z18b)A=av~1lweF)liO?~%Gv(Hx_K*iPiD;kXm}x?ISpu-8ju_{r(Myq_=J;XM zW=K<6ZSJ7UZjf7l?XkHD$n2tyQ(j2vFjW$|PXhIBorfQ3y^YYtGpb#Hi;r&g7oCJ{_@w{1{u(k%p!$-+aMyT^`nZVI;58 zM7Y|o0XupfIu+=?7e>4&9T>{)=2`WJT7y|BwQjcZ;&3F{Bv298(rZuYy47S_8NiWF z&C&DRxMmw!u&Z*abCzQwhjRoPiuK#1Ok$r_C{k63k&ZA|b)b{ViSZ?JjKdp#T-F1> ziD8dyHr-})^ZWf;HSJ$w?gJv?_(A66kw$c72x4Xt7B51WrT1a+btus-HYiywttr_> z*f#&W(RANzzENY+7E|Rb{=y6w5!*Lq8ei2$Z3a6VIQD#Kd^Z}b|m&Wgct({F;31_Cp#8Cg|!ySu7sF41$EU7MYyBJfuHrTlEPwQnZvocI$9R5mmg8QYath`%J0U z<=KMy##PV8=8&~F3^(lK(CPIiCotH2ry$iq%};@frilrj=sR6llSYVd?u>`JHG~vp zt1dQp!IE=%gE|a*$0cCeXuNT#Z4q`EX0aV_+3Ouhz|4A!a{hFdz~Q_Ki9nM>GefN# z!ZImD{{o{o;(eYUZl9jc*=Ol^R|Nzhgsy8B zQ5F**Bh#E0ARFO_5_;*WwGlfL2?ztgK{I+5h$ zIO%w<5jo%0)xPZSNxaoz6*CuMaWFA%-|$TEUGku&Zk57XkZf53;_3o#Ie1UfPN-?-D@W4Iodi_z!4~2@jtr_~4RKQs@+^#@S`k1Ic?h?mSMa zl=mnY9+n5smMZ3?N7i(b`Lgr~JPuQRG?;};Ei^LPbPOjFKJt^cbNB}QotL(0W-pTr zW{wf?V;}2AuFF3IL4>&l%Rnpkb*v+S{$HBnyyGBjqA)57K!_p7_8r^_!eW&o% z6NBf+y^%04qrBase4+OV0@m$Y7&nD{)2bhA56g8_BH<&HeRt0~&d(_U&i+dJD!s>J zOw6Xtx|=Dww)*wiAcKkb9hA{91%X(@AoOwwadRU!P?(8{PgL`^n#mcbJjK3#YLETi zqfbcDs{{3XW1ngwO*72J2o#*0CQ@ER6P!Pex_`z__7FaeQt%&E7Hm0WZ}o)sbOFMfl-ctKAAw)8f(RByb|XsbcHKU;c9f#P1U{woGc z*yn87bWMR_4jbo2(sFj~2~O;g&+{CyDZ@dTM+?Yqb7VkIY<_>jRh4zy>HCG$lCVI}EEVxAj(cF)iU&l{XPU4?r6 zWEt5r)c=y3d_IVTH5c7B4nBUT0o|-kG$r+0n(B~a>U&I=SlT9GL+znUp(|JsmG|$* z+O10{Wv$rq&z{P7ps&2BtckpY$!BSApLvtBn+-1gtHw8+iDRJZH))IKv7W%-w#du$mTn1sX)IdUZ*%(vz8|*bP`Wik}$X<>US5& zM*1++T+9@u2skjL&E*QunaW?Mefa|0sh{afP&4B6)T0P&L;E)=T_n32)UK`aIU(ac zE-+$oi2TGp|s6zJgml12md)huaV?iuSenQveYZ5Gri$_?=uIR}un;$->aDkZF?CwT? zlc}OPy?hK(6l|as(UV*3K%h0DjeWAh6Mf2CG1?4+&$DNyw!+O^lsXg)%<&$@fW8mCetiP2$sda&?Qp~L(Kk#|x&S}envF8a z{PgEP($bO-n4#tFK@*$yq}x9qu>8$HzfAM*<)!Gl?72FI#`{kkG0Ov*mW%NnNpb8a z|8s9bew08rLM00lak>Zdm)V71fZe-@gIWSs2v=tJIPGAw4nR;;J|Q_`|<9N1r&J zj*`uT$Zu@Q$1(g<2VpP?F1)F@VctU*_o?N-J$~@KR3$u91rA9|IT=o zv(8v|%EtGvnWTOyG!vpM9=h${76^j`NB_5F{!6#n%~b4!ie%>De##b#>IJFKJSZ;t+VJpcRMpWgXjYyAJQ zhSVCfSQ2I5!?1(r`_o$HMVmf2@V14(u5-(Y(u?aXHqNy^)03$0W- zbz*N(-_eMoyZGBajj)FR%hdL~NW?~%y^ zohW+2)y_AjRWG)y;H{Yb7%>OXLhGrYlUn$lgkRe}j`n&W05+=aJvj=_Pm}X2SrE$B- zx$1PZ?4f>8)#7lWmpeWDd>_29#3JUmlM)auor;C;xDafgnr0_ao?!5$3>)@UrE&-C zOZgTL^LrC%XMCd}zK@qs1}m_lS!j%4gsHD zW4;o-{Sc1n#Uz?t>^}e)U$#-JsoK|^`zP7h+w9dpulQp2BU`b;i{r8P+M8~%`13=3 zOqBvf%9yyiJH#T6H;I+yPr0j&DOh9&MEgK`&lj;)l@qGDJo|Rxwy*A>x=*+nO=0}4 zw(U0U=`)K9$Zvvwu>O@>QIy8O=H3ZhH8J4b@WCpzsE9X5QAXjsP`U~JljZMQ?HpLB zLKnS_UhyA^gpfg|JGgJzvPLV&os_pGbhkNFe)`wFVP$x<3lGtlug{dg`hYT$7U~J{ zwA~dJAcQ5nW}@|VG+k1@{=hw@!TdQ%K}ZBohOKhp4JS%Fy23P|d+Pt6aB~{6Z;d!c z9{Zp6nUf_@kt;VPe?wI28#83^8;&EYX$732PaHoTvsGCNxIfNxPL4O zR!DOluDF)4&$)RKTH1;}IKNF6dYyGQtMG-nPFqc8Y2N8eHt!R)QEE9rxmfMh=qW&) zY5~g!Ix4#fW-A(ng8d2!69w(FD%U_baFOOet^r0Iy}|uM#hZ*tr8LgzcBnB$e?5^4 zv7lFb-9rB`BT`+-m?Xa6GXpBuHT~bP1swuRjJr_!*YSo~HFF*@f~U9n)Wz1vXbkn} zg`|wBQj5-7^9r8tUXU{Czh6S2U_HVi zODQsWrWPhAwq&iq+ZFx`j-^ zl~+H0T1+QKRWzkxrQx{-$;jZ*D3rzu{^$$|Cx*?$FL;xVO z*(S+ugVWwGmV<~bD~0|UW}ho^fM*6Nr^vsl0$8q9RsfjUY{39>!ubb706x--ikRNl zCA)ptOQ8>*845Ds{0BIvnAsME32bO{5flbIDX;J3Ei$xWHivk{(a;GTxS%$hJjs{2 z-r@lsw!u6eP-L7PvwY*}8raajbbnmYbfA3`A?p6_Gy?v5Uf*#$T5E5lFaYB0VpY|Q zuM}FPSZ{hj3Y_#t&g|7?-al2(7^o$jA7EbaQw3&Vh(^GIYoa~s+n)ozPWH-`1ng>e zgmpe?`l>G=qzpi1y7pVpPGVGn?Z7$F%^Pic_oh87=LTj@I_;))OByKYZFsa5!qTUT z;%;%*if)?*8(=uOK*pbEW%&eTLSB3;+3AZQ@65ozSZj2_O&blr zX*XEKQJJPVM&QLAkxgv@XkFkOl2Ep_u!jJnf)A*i9^Z=!@a=7|{_vBnb)Sdz$&!~z zFQE_N`v1KKxPGW4QyMpvDiuUoj;EJ0(QbxPSkd!Jk(p~5eSyDy)RN9lwQWyfG<5J# zltwt&1E^9%hP$Sy8`X66Hwi9qngd>@(chyl1KUMM!+7b3K1Gz=4_TjI?-QP$u6z}Qi9+k>^ zr-e6~ZAYt5+)F2ckaJGpb0eWO{>5yLPK^s61E4m|qi%w}(b!l)V2mv~hx-}gSdOYD z#)d*=>5Pf`R6CSB{*So)B})@fK&0-%9`=RHHREn*03vvjb%Ey#3i5+&Od{r-1kBs= z`C#$2s~Vlrf>Ej`>n`-fE-u+Or;TcGv)kBoXy1$Ipl($?(@p+HICpPq-f|oD=2|wD zwNLaOg8nkw+!5-!(Q%D4e>{#{IEv>oqvk)W)w_@^z6V8X)`dt#$f)l^c{_M6A-x`Q}t_(rn^gIDe-{T<`GcrmRFe1Wa_}U=FQvIje{GXwNgW^7Cd1 z@kd>{R={U~OyC{eFOO1%WbYF|h0piAqIp7iixWZ5>wWj@jbi97aoo;t8TV{jG(?h& zm89+Ck;EWV>h;;Hf7h@7oHPv8QYn}JJ68IaMu z6jDX^lQV0pAqz_EsegMV{p5SzOZ)aBZ-J`o`R@&iL*`q-b>4>criY!hxAGm_5gD+> zvvE|Q>v4>8N`xlDU)&W;kGsmy($=8|RD|VPSY!Kg%QJRla?2%t)uG;9GFTE?i0nl5 zzuyM;8Ts`YdDuSKKGR7=h4J6B&^Yy*T7RXX1ps8TQSQ8Gmsu4Q@wy{`hy$FtkcCb6 z`{;fsi}>Ga>^RG5yHir>>UK9-==$yVc1@oLi81VLj*NWUt>x+55&CPHJ~TUKiC1Gm zTr~QXI0LWyVqjOEwCET2lMuJ2&&7Y+Oe;%-$OF^hF^jkhjRegWh%<~Z%Y!#%Cw05{ zqfWgX4-V=U?oNx?DmEy-xNIarRtwgNuxqyOK1d{f3d?Mg?~&Rof*oJb2IT6?B3)Xa z()CHSPK_n*g7|9DWHP1UEgZ7mU14#FO(NqC9$k3xCIBw=CP`V*h*s4IDbC@+X8H_{{2xnmFN)LL_ zCaD-owZ&cH2d>VE{6?y|Nn-|E)ZA8^njcuWm;|SEMmF_ubmPTeZGoyjzY-`)D|*3J z+g3AaVp`Tm6>{7P5m3?Ft5it20i>HvQ?=TK$M_4j(ZzZq)ybfR3l3lI zVBC*;jL`_0QSmM#J}Ch-D-D><>IzR`uTl=!^y{;Ka(bO-En)%1i~Bat54xP{Ca9Ss zBX9ymJ9#q)+m6DjBz5tIQ&(W=T0CWv_!L<4j@m)z$ph*26U^#k5R@^4d3<+DUYlGl-6Fo< zVb9~j2m2YDQye{kjLJk?v@NBx@Zk|DvBpCkf5ct8?mYw2rk+q5uihXl05VgU9Y|ve zAi~X2#u-PXiU#e^{a%z(_RQnU!I4GpLxin68Hi4A+n<2aX@EG#4pY;jKOtHo z2$ZNyY7cHuw&{ozF{+v*7IMxysJT<+>gxHd`Swnx$|Ha6?On;e31GGv;s=&vr}cFW zCpGr124(DX=JsZ;_#G{QDV&x8G<*XV41_IbA?0`=p{m~V?*h+~?d=2U!;58rDE$vt zsYaUybki$SFrrKRXCcTf0fXQuGaJ#P4VId`VV1s61+neiouTn>C7~1!5o*C_!fMlN zBbAmFl@g1KCEfW}u4D@A1{Xq+M-03F+fq`kfALseIT{9s z9j5?@h5?eMH{!z9iFZQ`zT82ZRvRGM6#SdIzAOaii%G$#mg2+x zpo9ptLC_088tBCb?D2N&p<;Ra_O59l?gmAlGj()t3t{KzCY*l{7LhazUN-}MjVYav zd&J+e)sJ-I;3C4uLn>yxVGt4e+XbPL($-{?; zGy5}7`0c;{{#`1kUDW8qOOF4uxb}B7?LYDN&zbD~!6Is(^J}*M`P=``w@{C+Z?l#L z00$6B#Je8zqoxzw^S_=f0A!xevJmO4l^XH~9)TN2fxN~$aAH(!kEsd)i@n?J?BA2z sf6&tZeNz8>%m3Qt|Amq-7C#vKG=@_);NH+{Ou(0>y58;5n|6=>55>Qy%>V!Z literal 0 HcmV?d00001 diff --git a/cloudevents/verifiability-spec.md b/cloudevents/verifiability-spec.md new file mode 100644 index 000000000..d863b6895 --- /dev/null +++ b/cloudevents/verifiability-spec.md @@ -0,0 +1,210 @@ +# Proposal: CloudEvents Verifiability + +## Goals + +This proposal introduces a transport protocol agnostic design for verifiable CloudEvents. It allows producers of CloudEvents to sign the events that they send—and consumers to cryptographically verify the *authenticity and the integrity* of the events that they receive. Through this process consumers can be sure that events were in fact produced by the claimed producer (authenticity), and that the events were received exactly as they were sent, and not modified in transit (integrity). + +The threats addressed by this proposal are those of malicious actors impersonating CloudEvent producers and of malicious actors modifying messages in transit. + +## Non-goals + +This proposal only applies to individual events. It does not give consumers any guarantees about the completeness of the event stream or the order of events. + +The threats of malicious actors removing or hiding items from the event stream as well as swapping their order are not addressed by this proposal. Neither are the possibilities of messages accidentally getting lost or delivered in the wrong order. Both can be addressed by producers through means of adding the necessary information inside the event payloads. + +Further, this proposal only aims at *verifiability*. It does not aim to enable *confidentiality*. Consequently, it does not address the threat of unauthorized parties reading CloudEvents that were not meant for them. + +## Constraints + +We have set the following constraints for the proposed design: + +**Verifiability must be optional:** This ensures that the additional burden of producing verification material and performing verification only applies when verifiability is desired, which is not always the case. + +**The design must be backward compatible:** ** Backward compatibility ensures that producers can produce verifiable events without any knowledge about whether the consumers have been configured and are able to verify events. + +**The design must be algorithm agnostic:** Being agnostic to the specifics of the verification algorithm and protocol allows for different *verifiability implementations* of this design. Different circumstances might call for different implementations, and the design should account for that. + +**The verification material must be contained in the same message as the event:** The design aims to be simple and robust, and so the verification material must be transported and delivered along with the event that it describes (and not in separate events or even through different channels). + +## Design + +Verifiability in CloudEvents consists of two steps: + +1. The producer of an event adds verification material to the message +2. The consumer of an event may use the verification material to verify the authenticity and integrity of the event + + +The specifics of what the verification material looks like and how the verification is performed depend on the *verifiability implementation*. + +For example, in a public/private key based implementation the producer of an event would add a signature based on their private key as the verification material, and the consumer of an event could use the corresponding public key to check the if the signature matches the event. + +The flow looks like this: + +![Flow](./verifiability-flow.jpg) + +*Option 1*: useful for verifiability implementations outside of the CE SDK. The CE SDK merely passes on messages and is not involved in producing verification material or performing verifications and has no knowledge about the secrets that the verification is based on (e.g. private keys). Appropriate for tools in a closed ecosystem like an enterprise with special requirements that are not suitable for the CE SDK. + +*Option 2*: useful for verifiability implementations that are directly supported by the CE SDK. The CE SDK has to be provided with the secrets (e.g. private key for producer and public key for consumers) and will create the verification material on the producer side and also perform the verification on the consumer side. This is the appropriate choice for any type of tool that is used by other entities, for example open source. + +In order to make this possible, we propose two new [OPTIONAL context attributes](https://github.com/cloudevents/spec/blob/main/cloudevents/spec.md#optional-attributes) for the CloudEvents core specification: + +* `verificationmaterial` + * Type: `String` + * Description: the material that consumers can use to verify a CloudEvent. For example, the verification material could be a signature of the event based on a private key. Consumers would use the producers’ public key to verify the signature. + * Constraints: + * OPTIONAL + * If present, must be base64 encoded + * If present, a `verificationmaterialtype` attribute must also be present +* `verificationmaterialtype` + * Type: `String` + * Description: tells consumers of CloudEvents what type the verification material is of. This high level category is used by the consumer to choose an appropriate implementation for performing the verification. The verification material can contain information specific to the implementation such as a sub type, version information, etc. + * Constraints: + * OPTIONAL + * If present, a `verificationmaterial` attribute must also be present + * Producer and consumer must agree on an appropriate type + +## Verifiability Implementations + +While this proposal is agnostic to the specific implementations, we set the following rules for verifiability implementations: + +A verifiability implementation **MUST**: + +* transport the verification material in the same message as the event +* use the two relevant context attributes in this proposal + +A verifiability implementation **SHOULD**: + +* avoid depending on canonicalization (and its [unnecessarily large attack surface](https://github.com/secure-systems-lab/dsse/blob/master/background.md#motivation)) +* transport the verification material detached from the event payload (this helps avoid canonicalization) + +A verifiability implementation **MUST FAIL** on: + +* Duplication of a relevant context attribute (e.g. two `verificationmaterial` attributes being set in a message) +* One relevant context attribute being present but the other missing (e.g. `verificationmaterial` being set but `verificationmaterialtype` missing) +* Unknown material type (e.g. the implementation may only attempt to use the verification material if it knows how to do so) +* Invalid material (e.g. the verification material did not match the received event) + +In order to get a verifiability implementation into the official CloudEvents SDK, the following requirements are set. + +## Verifiability Implementation Proposals + +A proposal for adding a verifiability implementation to the CE SDK **MUST:** + +* provide specs on how to implement verification +* provide test vectors +* provide a verification coverage table (see Verification coverage table) + +Test vectors ensure that implementations are consistent which does NOT affect verifiability. + +## Example + +To illustrate, let’s walk through how to implement a verification implementation CloudEvents provide test vectors as well as a verification coverage table. + +### Verification Implementation + +This is an example message containing a CloudEvent directly from the spec. It happens to be an HTTP structured mode message in JSON format. Our goal is to come up with the most insecure but also most concise verification implementation imaginable: one based on an md5 digest! + +Here is how a message containing that CloudEvent might look: + +``` +content-length: 209 +content-type: application/json + +{ + "specversion" : "1.0", + "type" : "com.example.someevent", + "source" : "/mycontext", + "subject": null, + "id" : "D234-1234-1234", + "time" : "2018-04-05T17:31:00Z", + "data" : "I'm just a string" +} +``` + +In order to make this event verifiable, an md5 digest of the body of the message is computed: `dc98e72d0f9980e89af5f8e7692d58d7`. This value will then be base64 encoded and added as the `verificationmaterial` context attribute: + +``` +content-length: 209 +content-type: application/json +ce-verificationmaterial: ZGM5OGU3MmQwZjk5ODBlODlhZjVmOGU3NjkyZDU4ZDc= +ce-verificationmaterialtype: md5 + +{ + "specversion" : "1.0", + "type" : "com.example.someevent", + "source" : "/mycontext", + "subject": null, + "id" : "D234-1234-1234", + "time" : "2018-04-05T17:31:00Z", + "data" : "I'm just a string" +} +``` + +A consumer then receives the this message and in order to verify, they must look at the `ce-erificationmaterialtype` header to determine whether it knows how to perform the verification. The consumer sees that verification material’s type is `md5`, so they will compute the `md5` of the payload to verify the CloudEvent contained in the message: + +``` +$ echo -n '{ + "specversion" : "1.0", + "type" : "com.example.someevent", + "source" : "/mycontext", + "subject": null, + "id" : "D234-1234-1234", + "time" : "2018-04-05T17:31:00Z", + "data" : "I\'m just a string" + }' | md5sum +dc98e72d0f9980e89af5f8e7692d58d7 - +``` + +The consumer can then confirm that the `md5sum` output matches the verification material and conclude that the CloudEvent’s authenticity and integrity are “guaranteed“. + +Now, since we want to make our fantasy verification implementation into a proposal to be included in the CE SDK, we will need to define test vectors and a verification coverage table. + +### Test Vectors + +An example test vector may look like: + +``` +[ + "input": { + { + "specversion" : "1.0", + "type" : "com.example.someevent", + "source" : "/mycontext", + "subject": null, + "id" : "D234-1234-1234", + "time" : "2018-04-05T17:31:00Z", + "data" : "I'm just a string" + } + }, + "expectedVerificationMaterialType": "md5", + "expectedVerificationMaterial": "dc98e72d0f9980e89af5f8e7692d58d7" +] +``` + +SDKs and implementors can then use the vectors to ensure that any implementation is correct and verifiable across different languages and systems. + +### Verification Coverage Table + +The table below outlines which parts of a CloudEvent for our imaginary md5 based verification implementation would cover: + +|Verifiable information |binary-mode |structured-mode |comment | +|--- |--- |--- |--- | +|data/payload |✅ |✅ | | +|mandatory context attributes |❌ |✅ |The md5 verification implementation only looks at the payload, not at any headers. | +|optional context attributes |❌ |✅ | +|extension attributes |❌ |✅ | + +Again, `md5` was chosen because it makes for an easily readable example. It is wildly insecure and not suitable for actual verifiability. + +## Appendix + +### Dictionary + +* *event*: a CloudEvent +* *consumer*: a system that consumes CloudEvents +* *format*: a specific way to format messages, often depending on the transport +* *message*: an envelope that is used to transport a CloudEvent from its producer to the consumers +* *producer*: a system that produce CloudEvents +* *transport*: a system used to get CloudEvents from their producers to the consumers (e.g. HTTP, RabbitMQ, etc.) +* *verifiability implementation*: an implementation that makes CloudEvents verifiable according to the design in this proposal +* *verification material*: the material offered to consumers so they can perform the verification of an event From bfba32ae439c86d8e112cd22dab9c058b0301f54 Mon Sep 17 00:00:00 2001 From: benjamin-j-powell Date: Thu, 20 Mar 2025 09:13:07 -0500 Subject: [PATCH 2/9] fixup! Adding verifiability proposal Signed-off-by: benjamin-j-powell --- cloudevents/verifiability-spec.md | 64 ++++++++++++++++++------------- 1 file changed, 37 insertions(+), 27 deletions(-) diff --git a/cloudevents/verifiability-spec.md b/cloudevents/verifiability-spec.md index d863b6895..fc87929a8 100644 --- a/cloudevents/verifiability-spec.md +++ b/cloudevents/verifiability-spec.md @@ -18,13 +18,20 @@ Further, this proposal only aims at *verifiability*. It does not aim to enable * We have set the following constraints for the proposed design: -**Verifiability must be optional:** This ensures that the additional burden of producing verification material and performing verification only applies when verifiability is desired, which is not always the case. +**Verifiability MUST be optional:** This ensures that the additional burden of producing verification material and performing verification only applies when verifiability is desired, which is not always the case. -**The design must be backward compatible:** ** Backward compatibility ensures that producers can produce verifiable events without any knowledge about whether the consumers have been configured and are able to verify events. +**The design MUST be backwards compatible:** Backward compatibility ensures that producers can produce verifiable events without any knowledge about whether the consumers have been configured and are able to verify events. In addition, transports MUST continue to work regardless if verifiability is being used or not. -**The design must be algorithm agnostic:** Being agnostic to the specifics of the verification algorithm and protocol allows for different *verifiability implementations* of this design. Different circumstances might call for different implementations, and the design should account for that. +**The design MUST be algorithm agnostic:** Being agnostic to the specifics of the verification algorithm and protocol allows for different *verifiability implementations* of this design. Different circumstances might call for different implementations, and the design MUST account for that. -**The verification material must be contained in the same message as the event:** The design aims to be simple and robust, and so the verification material must be transported and delivered along with the event that it describes (and not in separate events or even through different channels). +**The verification material MUST be contained in the same message as the event:** The design aims to be simple and robust, and so the verification material MUST be transported and delivered along with the event that it describes (and not in separate events or even through different channels). + +## Assumptions + +This proposal contains a few assumptions that will be highlighted here. + +1. SDKs will verify as early as possible which may or may not depend on the verification implementation. +2. Users manage their secrets, e.g. public key infrastructure (PKI). ## Design @@ -46,6 +53,10 @@ The flow looks like this: *Option 2*: useful for verifiability implementations that are directly supported by the CE SDK. The CE SDK has to be provided with the secrets (e.g. private key for producer and public key for consumers) and will create the verification material on the producer side and also perform the verification on the consumer side. This is the appropriate choice for any type of tool that is used by other entities, for example open source. +**Note:** If an intermediary party modifies an event, they are considered the producer of a new event. They MUST create an updated verification material and the consumer(s) MUST recognize them as a trustworthy producer. + +### Proposal + In order to make this possible, we propose two new [OPTIONAL context attributes](https://github.com/cloudevents/spec/blob/main/cloudevents/spec.md#optional-attributes) for the CloudEvents core specification: * `verificationmaterial` @@ -53,15 +64,15 @@ In order to make this possible, we propose two new [OPTIONAL context attributes] * Description: the material that consumers can use to verify a CloudEvent. For example, the verification material could be a signature of the event based on a private key. Consumers would use the producers’ public key to verify the signature. * Constraints: * OPTIONAL - * If present, must be base64 encoded - * If present, a `verificationmaterialtype` attribute must also be present + * If present, MUST be base64 encoded + * If present, a `verificationmaterialtype` attribute MUST also be present * `verificationmaterialtype` * Type: `String` * Description: tells consumers of CloudEvents what type the verification material is of. This high level category is used by the consumer to choose an appropriate implementation for performing the verification. The verification material can contain information specific to the implementation such as a sub type, version information, etc. * Constraints: * OPTIONAL - * If present, a `verificationmaterial` attribute must also be present - * Producer and consumer must agree on an appropriate type + * If present, a `verificationmaterial` attribute MUST also be present + * Producer and consumer MUST agree on an appropriate type ## Verifiability Implementations @@ -96,6 +107,10 @@ A proposal for adding a verifiability implementation to the CE SDK **MUST:** Test vectors ensure that implementations are consistent which does NOT affect verifiability. +A proposal for adding a verifiability implementation to the CE SDK **SHOULD:** + +* provide information about they handle attributes, and if relevant, normalization + ## Example To illustrate, let’s walk through how to implement a verification implementation CloudEvents provide test vectors as well as a verification coverage table. @@ -103,6 +118,7 @@ To illustrate, let’s walk through how to implement a verification implementati ### Verification Implementation This is an example message containing a CloudEvent directly from the spec. It happens to be an HTTP structured mode message in JSON format. Our goal is to come up with the most insecure but also most concise verification implementation imaginable: one based on an md5 digest! +The md5 implementation will only verify whether or not the payload, `data`, is valid and not additional attributes for the sake of simplicity. Here is how a message containing that CloudEvent might look: @@ -121,13 +137,11 @@ content-type: application/json } ``` -In order to make this event verifiable, an md5 digest of the body of the message is computed: `dc98e72d0f9980e89af5f8e7692d58d7`. This value will then be base64 encoded and added as the `verificationmaterial` context attribute: +In order to make this event verifiable, an md5 digest of the 'data' field is computed: `dc98e72d0f9980e89af5f8e7692d58d7`. This value will then be base64 encoded and added as the `verificationmaterial` context attribute: ``` content-length: 209 content-type: application/json -ce-verificationmaterial: ZGM5OGU3MmQwZjk5ODBlODlhZjVmOGU3NjkyZDU4ZDc= -ce-verificationmaterialtype: md5 { "specversion" : "1.0", @@ -136,23 +150,17 @@ ce-verificationmaterialtype: md5 "subject": null, "id" : "D234-1234-1234", "time" : "2018-04-05T17:31:00Z", - "data" : "I'm just a string" + "data" : "I'm just a string", + "verificationmaterial": "ODQ0ZTAwNzRkNzQ4MmZjODkwZGJhODJhYTBlY2M4ZjcgIC0K", + "verificationmaterialtype": "md5" } ``` -A consumer then receives the this message and in order to verify, they must look at the `ce-erificationmaterialtype` header to determine whether it knows how to perform the verification. The consumer sees that verification material’s type is `md5`, so they will compute the `md5` of the payload to verify the CloudEvent contained in the message: +A consumer then receives the this message and in order to verify, they MUST look at the `ce-erificationmaterialtype` header to determine whether it knows how to perform the verification. The consumer sees that verification material’s type is `md5`, so they will compute the `md5` of the payload to verify the CloudEvent contained in the message: ``` -$ echo -n '{ - "specversion" : "1.0", - "type" : "com.example.someevent", - "source" : "/mycontext", - "subject": null, - "id" : "D234-1234-1234", - "time" : "2018-04-05T17:31:00Z", - "data" : "I\'m just a string" - }' | md5sum -dc98e72d0f9980e89af5f8e7692d58d7 - +$ echo -n "I'm just a string" | md5sum +844e0074d7482fc890dba82aa0ecc8f7 - ``` The consumer can then confirm that the `md5sum` output matches the verification material and conclude that the CloudEvent’s authenticity and integrity are “guaranteed“. @@ -173,11 +181,13 @@ An example test vector may look like: "subject": null, "id" : "D234-1234-1234", "time" : "2018-04-05T17:31:00Z", - "data" : "I'm just a string" + "data" : "I'm just a string", + "verificationmaterial": "ODQ0ZTAwNzRkNzQ4MmZjODkwZGJhODJhYTBlY2M4ZjcgIC0K", + "verificationmaterialtype": "md5" } }, "expectedVerificationMaterialType": "md5", - "expectedVerificationMaterial": "dc98e72d0f9980e89af5f8e7692d58d7" + "expectedVerificationMaterial": "844e0074d7482fc890dba82aa0ecc8f7" ] ``` @@ -190,8 +200,8 @@ The table below outlines which parts of a CloudEvent for our imaginary md5 based |Verifiable information |binary-mode |structured-mode |comment | |--- |--- |--- |--- | |data/payload |✅ |✅ | | -|mandatory context attributes |❌ |✅ |The md5 verification implementation only looks at the payload, not at any headers. | -|optional context attributes |❌ |✅ | +|mandatory context attributes |❌ |❌ |The md5 verification implementation only looks at the payload, not at any headers. | +|optional context attributes |❌ |❌ | |extension attributes |❌ |✅ | Again, `md5` was chosen because it makes for an easily readable example. It is wildly insecure and not suitable for actual verifiability. From 0f9cf68b0bbd21e792a5f21870113f28c1d05ab2 Mon Sep 17 00:00:00 2001 From: benjamin-j-powell Date: Thu, 27 Mar 2025 10:16:50 -0500 Subject: [PATCH 3/9] fixup! Adding verifiability proposal Signed-off-by: benjamin-j-powell --- .../{ => extensions}/verifiability-flow.jpg | Bin cloudevents/extensions/verifiability.md | 294 ++++++++++++++++++ cloudevents/verifiability-spec.md | 220 ------------- 3 files changed, 294 insertions(+), 220 deletions(-) rename cloudevents/{ => extensions}/verifiability-flow.jpg (100%) create mode 100644 cloudevents/extensions/verifiability.md delete mode 100644 cloudevents/verifiability-spec.md diff --git a/cloudevents/verifiability-flow.jpg b/cloudevents/extensions/verifiability-flow.jpg similarity index 100% rename from cloudevents/verifiability-flow.jpg rename to cloudevents/extensions/verifiability-flow.jpg diff --git a/cloudevents/extensions/verifiability.md b/cloudevents/extensions/verifiability.md new file mode 100644 index 000000000..5617e5f63 --- /dev/null +++ b/cloudevents/extensions/verifiability.md @@ -0,0 +1,294 @@ +# Proposal: CloudEvents Verifiability + +## Notational Conventions + +As with the main [CloudEvents specification](../spec.md), the key words "MUST", +"MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", +"RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as +described in [RFC 2119](https://tools.ietf.org/html/rfc2119). + +However, the scope of these key words is limited to when this extension is +used. For example, an attribute being marked as "REQUIRED" does not mean +it needs to be in all CloudEvents, rather it needs to be included only when +this extension is being used. + +## Attributes + +### verificationmaterial (Verification Material) + - Type: `String` + - Description: the material that consumers can use to verify a CloudEvent. + For example, the verification material could be a signature of the event + based on a private key. Consumers would use the producers’ public key to + verify the signature. + - Constraints: + - OPTIONAL + - If present, MUST be base64 encoded + - If present, a `verificationmaterialtype` attribute MUST also be + present + +### verificationmaterialtype (Verfication Material Type) + - Type: `String` + - Description: tells consumers of CloudEvents what type the verification + material is of. This high level category is used by the consumer to + choose an appropriate implementation for performing the verification. The + verification material can contain information specific to the + implementation such as a sub type, version information, etc. + - Constraints: + - OPTIONAL + - If present, a `verificationmaterial` attribute MUST also be present + - Producer and consumer MUST agree on an appropriate type + +## Usage + +When this extension is used, producers MUST set both the `verificationmaterial` +and `verificationmaterialtype` attributes. Consumers can choose to verify if +the material. + +## Goals + +This proposal introduces a transport protocol agnostic design for verifiable +CloudEvents. It allows producers of CloudEvents to sign the events that they +send—and consumers to cryptographically verify the *authenticity and the +integrity* of the events that they receive. Through this process consumers can +be sure that events were in fact produced by the claimed producer +(authenticity), and that the events were received exactly as they were sent, +and not modified in transit (integrity). + +The threats addressed by this proposal are those of malicious actors +impersonating CloudEvent producers and of malicious actors modifying messages +in transit. + +## Non-goals + +This proposal only applies to individual events. It does not give consumers any +guarantees about the completeness of the event stream or the order of events. + +The threats of malicious actors removing or hiding items from the event stream +as well as swapping their order are not addressed by this proposal. Neither are +the possibilities of messages accidentally getting lost or delivered in the +wrong order. Both can be addressed by producers through means of adding the +necessary information inside the event payloads. + +Further, this proposal only aims at *verifiability*. It does not aim to enable +*confidentiality*. Consequently, it does not address the threat of unauthorized +parties reading CloudEvents that were not meant for them. + +## Assumptions + +This proposal contains a few assumptions that will be highlighted here. + +1. SDKs will verify as early as possible which may or may not depend on the + verification implementation. +2. Users manage their secrets, e.g. public key infrastructure (PKI). + +## Design + +Verifiability in CloudEvents consists of two steps: + +1. The producer of an event adds verification material to the message +2. The consumer of an event may use the verification material to verify the + authenticity and integrity of the event + + +The specifics of what the verification material looks like and how the +verification is performed depend on the *verifiability implementation*. + +For example, in a public/private key based implementation the producer of an +event would add a signature based on their private key as the verification +material, and the consumer of an event could use the corresponding public key +to check the if the signature matches the event. + +The flow looks like this: + +![Flow](./verifiability-flow.jpg) + +*Option 1*: useful for verifiability implementations outside of the CE SDK. The +CE SDK merely passes on messages and is not involved in producing verification +material or performing verifications and has no knowledge about the secrets +that the verification is based on (e.g. private keys). Appropriate for tools in +a closed ecosystem like an enterprise with special requirements that are not +suitable for the CE SDK. + +*Option 2*: useful for verifiability implementations that are directly +supported by the CE SDK. The CE SDK has to be provided with the secrets (e.g. +private key for producer and public key for consumers) and will create the +verification material on the producer side and also perform the verification on +the consumer side. This is the appropriate choice for any type of tool that is +used by other entities, for example open source. + +**Note:** If an intermediary party modifies an event, they are considered the +producer of a new event. They MUST create an updated verification material and +the consumer(s) MUST recognize them as a trustworthy producer. + +## Verifiability Implementations + +While this proposal is agnostic to the specific implementations, we set the +following rules for verifiability implementations: + +A verifiability implementation **MUST**: + +* transport the verification material in the same message as the event +* use the two relevant context attributes in this proposal + +A verifiability implementation **SHOULD**: + +* avoid depending on canonicalization (and its +[unnecessarily large attack surface](https://github.com/secure-systems-lab/dsse/blob/master/background.md#motivation)) +* transport the verification material detached from the event payload +(this helps avoid canonicalization) + +A verifiability implementation **MUST FAIL** on: + +* Duplication of a relevant context attribute (e.g. two `verificationmaterial` + attributes being set in a message) +* One relevant context attribute being present but the other missing (e.g. + `verificationmaterial` being set but `verificationmaterialtype` missing) +* Unknown material type (e.g. the implementation may only attempt to use the + verification material if it knows how to do so) +* Invalid material (e.g. the verification material did not match the received + event) + +In order to get a verifiability implementation into the official CloudEvents +SDK, the following requirements are set. + +## Verifiability Implementation Proposals + +A proposal for adding a verifiability implementation to the CE SDK **MUST:** + +* provide specs on how to implement verification +* provide test vectors +* provide a verification coverage table (see Verification coverage table) + +Test vectors ensure that implementations are consistent which does NOT affect verifiability. + +A proposal for adding a verifiability implementation to the CE SDK **SHOULD:** + +* provide information about they handle attributes, and if relevant, normalization + +## Example + +To illustrate, let’s walk through how to implement a verification +implementation CloudEvents provide test vectors as well as a verification +coverage table. + +### Verification Implementation + +This is an example message containing a CloudEvent directly from the spec. It +happens to be an HTTP structured mode message in JSON format. Our goal is to +come up with the most insecure but also most concise verification +implementation imaginable: one based on a reversed digest which we will call +`rev`! The `rev` implementation will only verify whether or not the +payload, `data`, is valid and not additional attributes for the sake of +simplicity. + +Here is how a message containing that CloudEvent might look: + +``` +content-length: 209 +content-type: application/json + +{ + "specversion" : "1.0", + "type" : "com.example.someevent", + "source" : "/mycontext", + "subject": null, + "id" : "D234-1234-1234", + "time" : "2018-04-05T17:31:00Z", + "data" : "I'm just a string" +} +``` + +In order to make this event verifiable, a sha256 digest of the 'data' field is +computed: `Z25pcnRzIGEgdHN1aiBtJ0kK`. +This value will then be base64 encoded and added as the `verificationmaterial` +context attribute: + +``` +content-length: 209 +content-type: application/json + +{ + "specversion" : "1.0", + "type" : "com.example.someevent", + "source" : "/mycontext", + "subject": null, + "id" : "D234-1234-1234", + "time" : "2018-04-05T17:31:00Z", + "data" : "I'm just a string", + "verificationmaterial": "Z25pcnRzIGEgdHN1aiBtJ0kK", + "verificationmaterialtype": "rev" +} +``` + +A consumer then receives the this message and in order to verify, they MUST +look at the `ce-verificationmaterialtype` header to determine whether it knows +how to perform the verification. The consumer sees that verification material’s +type is `rev`, so they will compute the `rev` of the payload to verify the +CloudEvent contained in the message: + +``` +$ echo -n "I'm just a string" | rev +gnirts a tsuj m'I +``` + +The consumer can then confirm that the `rev` output matches the verification +material and conclude that the CloudEvent’s authenticity and integrity are +“guaranteed“. + +Now, since we want to make our fantasy verification implementation into a +proposal to be included in the CE SDK, we will need to define test vectors and +a verification coverage table. + +### Test Vectors + +An example test vector may look like: + +``` +[ + "input": { + { + "specversion" : "1.0", + "type" : "com.example.someevent", + "source" : "/mycontext", + "subject": null, + "id" : "D234-1234-1234", + "time" : "2018-04-05T17:31:00Z", + "data" : "I'm just a string" + } + }, + "expectedVerificationMaterialType": "rev", + "expectedVerificationMaterial": "Z25pcnRzIGEgdHN1aiBtJ0kK" +] +``` + +SDKs and implementers can then use the vectors to ensure that any +implementation is correct and verifiable across different languages and +systems. + +### Verification Coverage Table + +The table below outlines which parts of a CloudEvent for our imaginary sha256 +based verification implementation would cover: + +|Verifiable information |binary-mode |structured-mode |comment | +|--- |--- |--- |--- | +|data/payload |✅ |✅ | | +|mandatory context attributes |❌ |❌ |The sha256 verification implementation only looks at the payload, not at any headers. | +|optional context attributes |❌ |❌ | +|extension attributes |❌ |✅ | + +Again, `sha256` was chosen because it makes for an easily readable example. It is +wildly insecure and not suitable for actual verifiability. + +## Appendix + +### Dictionary + +* *event*: a CloudEvent +* *consumer*: a system that consumes CloudEvents +* *format*: a specific way to format messages, often depending on the transport +* *message*: an envelope that is used to transport a CloudEvent from its producer to the consumers +* *producer*: a system that produce CloudEvents +* *transport*: a system used to get CloudEvents from their producers to the consumers (e.g. HTTP, RabbitMQ, etc.) +* *verifiability implementation*: an implementation that makes CloudEvents verifiable according to the design in this proposal +* *verification material*: the material offered to consumers so they can perform the verification of an event diff --git a/cloudevents/verifiability-spec.md b/cloudevents/verifiability-spec.md deleted file mode 100644 index fc87929a8..000000000 --- a/cloudevents/verifiability-spec.md +++ /dev/null @@ -1,220 +0,0 @@ -# Proposal: CloudEvents Verifiability - -## Goals - -This proposal introduces a transport protocol agnostic design for verifiable CloudEvents. It allows producers of CloudEvents to sign the events that they send—and consumers to cryptographically verify the *authenticity and the integrity* of the events that they receive. Through this process consumers can be sure that events were in fact produced by the claimed producer (authenticity), and that the events were received exactly as they were sent, and not modified in transit (integrity). - -The threats addressed by this proposal are those of malicious actors impersonating CloudEvent producers and of malicious actors modifying messages in transit. - -## Non-goals - -This proposal only applies to individual events. It does not give consumers any guarantees about the completeness of the event stream or the order of events. - -The threats of malicious actors removing or hiding items from the event stream as well as swapping their order are not addressed by this proposal. Neither are the possibilities of messages accidentally getting lost or delivered in the wrong order. Both can be addressed by producers through means of adding the necessary information inside the event payloads. - -Further, this proposal only aims at *verifiability*. It does not aim to enable *confidentiality*. Consequently, it does not address the threat of unauthorized parties reading CloudEvents that were not meant for them. - -## Constraints - -We have set the following constraints for the proposed design: - -**Verifiability MUST be optional:** This ensures that the additional burden of producing verification material and performing verification only applies when verifiability is desired, which is not always the case. - -**The design MUST be backwards compatible:** Backward compatibility ensures that producers can produce verifiable events without any knowledge about whether the consumers have been configured and are able to verify events. In addition, transports MUST continue to work regardless if verifiability is being used or not. - -**The design MUST be algorithm agnostic:** Being agnostic to the specifics of the verification algorithm and protocol allows for different *verifiability implementations* of this design. Different circumstances might call for different implementations, and the design MUST account for that. - -**The verification material MUST be contained in the same message as the event:** The design aims to be simple and robust, and so the verification material MUST be transported and delivered along with the event that it describes (and not in separate events or even through different channels). - -## Assumptions - -This proposal contains a few assumptions that will be highlighted here. - -1. SDKs will verify as early as possible which may or may not depend on the verification implementation. -2. Users manage their secrets, e.g. public key infrastructure (PKI). - -## Design - -Verifiability in CloudEvents consists of two steps: - -1. The producer of an event adds verification material to the message -2. The consumer of an event may use the verification material to verify the authenticity and integrity of the event - - -The specifics of what the verification material looks like and how the verification is performed depend on the *verifiability implementation*. - -For example, in a public/private key based implementation the producer of an event would add a signature based on their private key as the verification material, and the consumer of an event could use the corresponding public key to check the if the signature matches the event. - -The flow looks like this: - -![Flow](./verifiability-flow.jpg) - -*Option 1*: useful for verifiability implementations outside of the CE SDK. The CE SDK merely passes on messages and is not involved in producing verification material or performing verifications and has no knowledge about the secrets that the verification is based on (e.g. private keys). Appropriate for tools in a closed ecosystem like an enterprise with special requirements that are not suitable for the CE SDK. - -*Option 2*: useful for verifiability implementations that are directly supported by the CE SDK. The CE SDK has to be provided with the secrets (e.g. private key for producer and public key for consumers) and will create the verification material on the producer side and also perform the verification on the consumer side. This is the appropriate choice for any type of tool that is used by other entities, for example open source. - -**Note:** If an intermediary party modifies an event, they are considered the producer of a new event. They MUST create an updated verification material and the consumer(s) MUST recognize them as a trustworthy producer. - -### Proposal - -In order to make this possible, we propose two new [OPTIONAL context attributes](https://github.com/cloudevents/spec/blob/main/cloudevents/spec.md#optional-attributes) for the CloudEvents core specification: - -* `verificationmaterial` - * Type: `String` - * Description: the material that consumers can use to verify a CloudEvent. For example, the verification material could be a signature of the event based on a private key. Consumers would use the producers’ public key to verify the signature. - * Constraints: - * OPTIONAL - * If present, MUST be base64 encoded - * If present, a `verificationmaterialtype` attribute MUST also be present -* `verificationmaterialtype` - * Type: `String` - * Description: tells consumers of CloudEvents what type the verification material is of. This high level category is used by the consumer to choose an appropriate implementation for performing the verification. The verification material can contain information specific to the implementation such as a sub type, version information, etc. - * Constraints: - * OPTIONAL - * If present, a `verificationmaterial` attribute MUST also be present - * Producer and consumer MUST agree on an appropriate type - -## Verifiability Implementations - -While this proposal is agnostic to the specific implementations, we set the following rules for verifiability implementations: - -A verifiability implementation **MUST**: - -* transport the verification material in the same message as the event -* use the two relevant context attributes in this proposal - -A verifiability implementation **SHOULD**: - -* avoid depending on canonicalization (and its [unnecessarily large attack surface](https://github.com/secure-systems-lab/dsse/blob/master/background.md#motivation)) -* transport the verification material detached from the event payload (this helps avoid canonicalization) - -A verifiability implementation **MUST FAIL** on: - -* Duplication of a relevant context attribute (e.g. two `verificationmaterial` attributes being set in a message) -* One relevant context attribute being present but the other missing (e.g. `verificationmaterial` being set but `verificationmaterialtype` missing) -* Unknown material type (e.g. the implementation may only attempt to use the verification material if it knows how to do so) -* Invalid material (e.g. the verification material did not match the received event) - -In order to get a verifiability implementation into the official CloudEvents SDK, the following requirements are set. - -## Verifiability Implementation Proposals - -A proposal for adding a verifiability implementation to the CE SDK **MUST:** - -* provide specs on how to implement verification -* provide test vectors -* provide a verification coverage table (see Verification coverage table) - -Test vectors ensure that implementations are consistent which does NOT affect verifiability. - -A proposal for adding a verifiability implementation to the CE SDK **SHOULD:** - -* provide information about they handle attributes, and if relevant, normalization - -## Example - -To illustrate, let’s walk through how to implement a verification implementation CloudEvents provide test vectors as well as a verification coverage table. - -### Verification Implementation - -This is an example message containing a CloudEvent directly from the spec. It happens to be an HTTP structured mode message in JSON format. Our goal is to come up with the most insecure but also most concise verification implementation imaginable: one based on an md5 digest! -The md5 implementation will only verify whether or not the payload, `data`, is valid and not additional attributes for the sake of simplicity. - -Here is how a message containing that CloudEvent might look: - -``` -content-length: 209 -content-type: application/json - -{ - "specversion" : "1.0", - "type" : "com.example.someevent", - "source" : "/mycontext", - "subject": null, - "id" : "D234-1234-1234", - "time" : "2018-04-05T17:31:00Z", - "data" : "I'm just a string" -} -``` - -In order to make this event verifiable, an md5 digest of the 'data' field is computed: `dc98e72d0f9980e89af5f8e7692d58d7`. This value will then be base64 encoded and added as the `verificationmaterial` context attribute: - -``` -content-length: 209 -content-type: application/json - -{ - "specversion" : "1.0", - "type" : "com.example.someevent", - "source" : "/mycontext", - "subject": null, - "id" : "D234-1234-1234", - "time" : "2018-04-05T17:31:00Z", - "data" : "I'm just a string", - "verificationmaterial": "ODQ0ZTAwNzRkNzQ4MmZjODkwZGJhODJhYTBlY2M4ZjcgIC0K", - "verificationmaterialtype": "md5" -} -``` - -A consumer then receives the this message and in order to verify, they MUST look at the `ce-erificationmaterialtype` header to determine whether it knows how to perform the verification. The consumer sees that verification material’s type is `md5`, so they will compute the `md5` of the payload to verify the CloudEvent contained in the message: - -``` -$ echo -n "I'm just a string" | md5sum -844e0074d7482fc890dba82aa0ecc8f7 - -``` - -The consumer can then confirm that the `md5sum` output matches the verification material and conclude that the CloudEvent’s authenticity and integrity are “guaranteed“. - -Now, since we want to make our fantasy verification implementation into a proposal to be included in the CE SDK, we will need to define test vectors and a verification coverage table. - -### Test Vectors - -An example test vector may look like: - -``` -[ - "input": { - { - "specversion" : "1.0", - "type" : "com.example.someevent", - "source" : "/mycontext", - "subject": null, - "id" : "D234-1234-1234", - "time" : "2018-04-05T17:31:00Z", - "data" : "I'm just a string", - "verificationmaterial": "ODQ0ZTAwNzRkNzQ4MmZjODkwZGJhODJhYTBlY2M4ZjcgIC0K", - "verificationmaterialtype": "md5" - } - }, - "expectedVerificationMaterialType": "md5", - "expectedVerificationMaterial": "844e0074d7482fc890dba82aa0ecc8f7" -] -``` - -SDKs and implementors can then use the vectors to ensure that any implementation is correct and verifiable across different languages and systems. - -### Verification Coverage Table - -The table below outlines which parts of a CloudEvent for our imaginary md5 based verification implementation would cover: - -|Verifiable information |binary-mode |structured-mode |comment | -|--- |--- |--- |--- | -|data/payload |✅ |✅ | | -|mandatory context attributes |❌ |❌ |The md5 verification implementation only looks at the payload, not at any headers. | -|optional context attributes |❌ |❌ | -|extension attributes |❌ |✅ | - -Again, `md5` was chosen because it makes for an easily readable example. It is wildly insecure and not suitable for actual verifiability. - -## Appendix - -### Dictionary - -* *event*: a CloudEvent -* *consumer*: a system that consumes CloudEvents -* *format*: a specific way to format messages, often depending on the transport -* *message*: an envelope that is used to transport a CloudEvent from its producer to the consumers -* *producer*: a system that produce CloudEvents -* *transport*: a system used to get CloudEvents from their producers to the consumers (e.g. HTTP, RabbitMQ, etc.) -* *verifiability implementation*: an implementation that makes CloudEvents verifiable according to the design in this proposal -* *verification material*: the material offered to consumers so they can perform the verification of an event From f3bdeaeb91794d6e6f8c2ad51697407975f6fe89 Mon Sep 17 00:00:00 2001 From: benjamin-j-powell Date: Thu, 27 Mar 2025 11:26:17 -0500 Subject: [PATCH 4/9] fixup! Adding verifiability proposal Signed-off-by: benjamin-j-powell --- cloudevents/extensions/verifiability.md | 62 ++++++++++++------------- 1 file changed, 29 insertions(+), 33 deletions(-) diff --git a/cloudevents/extensions/verifiability.md b/cloudevents/extensions/verifiability.md index 5617e5f63..5c429e455 100644 --- a/cloudevents/extensions/verifiability.md +++ b/cloudevents/extensions/verifiability.md @@ -1,5 +1,30 @@ # Proposal: CloudEvents Verifiability +This proposal introduces a transport protocol agnostic design for verifiable +CloudEvents. It allows producers of CloudEvents to sign the events that they +send—and consumers to cryptographically verify the *authenticity and the +integrity* of the events that they receive. Through this process consumers can +be sure that events were in fact produced by the claimed producer +(authenticity), and that the events were received exactly as they were sent, +and not modified in transit (integrity). + +The threats addressed by this proposal are those of malicious actors +impersonating CloudEvent producers and of malicious actors modifying messages +in transit. + +This proposal only applies to individual events. It does not give consumers any +guarantees about the completeness of the event stream or the order of events. + +The threats of malicious actors removing or hiding items from the event stream +as well as swapping their order are not addressed by this proposal. Neither are +the possibilities of messages accidentally getting lost or delivered in the +wrong order. Both can be addressed by producers through means of adding the +necessary information inside the event payloads. + +Further, this proposal only aims at *verifiability*. It does not aim to enable +*confidentiality*. Consequently, it does not address the threat of unauthorized +parties reading CloudEvents that were not meant for them. + ## Notational Conventions As with the main [CloudEvents specification](../spec.md), the key words "MUST", @@ -44,40 +69,11 @@ When this extension is used, producers MUST set both the `verificationmaterial` and `verificationmaterialtype` attributes. Consumers can choose to verify if the material. -## Goals - -This proposal introduces a transport protocol agnostic design for verifiable -CloudEvents. It allows producers of CloudEvents to sign the events that they -send—and consumers to cryptographically verify the *authenticity and the -integrity* of the events that they receive. Through this process consumers can -be sure that events were in fact produced by the claimed producer -(authenticity), and that the events were received exactly as they were sent, -and not modified in transit (integrity). - -The threats addressed by this proposal are those of malicious actors -impersonating CloudEvent producers and of malicious actors modifying messages -in transit. - -## Non-goals - -This proposal only applies to individual events. It does not give consumers any -guarantees about the completeness of the event stream or the order of events. - -The threats of malicious actors removing or hiding items from the event stream -as well as swapping their order are not addressed by this proposal. Neither are -the possibilities of messages accidentally getting lost or delivered in the -wrong order. Both can be addressed by producers through means of adding the -necessary information inside the event payloads. - -Further, this proposal only aims at *verifiability*. It does not aim to enable -*confidentiality*. Consequently, it does not address the threat of unauthorized -parties reading CloudEvents that were not meant for them. - ## Assumptions This proposal contains a few assumptions that will be highlighted here. -1. SDKs will verify as early as possible which may or may not depend on the +1. SDKs will verify as early as possible which depends on the verification implementation. 2. Users manage their secrets, e.g. public key infrastructure (PKI). @@ -86,7 +82,7 @@ This proposal contains a few assumptions that will be highlighted here. Verifiability in CloudEvents consists of two steps: 1. The producer of an event adds verification material to the message -2. The consumer of an event may use the verification material to verify the +2. The consumer of an event MAY use the verification material to verify the authenticity and integrity of the event @@ -143,7 +139,7 @@ A verifiability implementation **MUST FAIL** on: attributes being set in a message) * One relevant context attribute being present but the other missing (e.g. `verificationmaterial` being set but `verificationmaterialtype` missing) -* Unknown material type (e.g. the implementation may only attempt to use the +* Unknown material type (e.g. the implementation only attempts to use the verification material if it knows how to do so) * Invalid material (e.g. the verification material did not match the received event) @@ -241,7 +237,7 @@ a verification coverage table. ### Test Vectors -An example test vector may look like: +An example test vector is defined below: ``` [ From 8bdae8ded134a593a469d0dc7ad348379b0c9dc0 Mon Sep 17 00:00:00 2001 From: benjamin-j-powell Date: Thu, 27 Mar 2025 12:09:11 -0500 Subject: [PATCH 5/9] fixup! Adding verifiability proposal Signed-off-by: benjamin-j-powell --- cloudevents/extensions/verifiability.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/cloudevents/extensions/verifiability.md b/cloudevents/extensions/verifiability.md index 5c429e455..c9d330a3b 100644 --- a/cloudevents/extensions/verifiability.md +++ b/cloudevents/extensions/verifiability.md @@ -263,14 +263,14 @@ systems. ### Verification Coverage Table -The table below outlines which parts of a CloudEvent for our imaginary sha256 +The table below outlines which parts of a CloudEvent for our imaginary `rev` based verification implementation would cover: |Verifiable information |binary-mode |structured-mode |comment | |--- |--- |--- |--- | |data/payload |✅ |✅ | | -|mandatory context attributes |❌ |❌ |The sha256 verification implementation only looks at the payload, not at any headers. | -|optional context attributes |❌ |❌ | +|mandatory context attributes |❌ |❌ |The `rev` verification implementation only looks at the payload, not at any headers. | +|permissive context attributes |❌ |❌ | |extension attributes |❌ |✅ | Again, `sha256` was chosen because it makes for an easily readable example. It is From 296a103d863fbc1576e7e43033b4ff59f5bff395 Mon Sep 17 00:00:00 2001 From: benjamin-j-powell Date: Wed, 2 Apr 2025 10:19:59 -0500 Subject: [PATCH 6/9] fixup! Adding verifiability proposal Signed-off-by: benjamin-j-powell --- cloudevents/languages/he/extensions/verifiability.md | 3 +++ cloudevents/languages/zh-CN/extensions/verifiability.md | 7 +++++++ 2 files changed, 10 insertions(+) create mode 100644 cloudevents/languages/he/extensions/verifiability.md create mode 100644 cloudevents/languages/zh-CN/extensions/verifiability.md diff --git a/cloudevents/languages/he/extensions/verifiability.md b/cloudevents/languages/he/extensions/verifiability.md new file mode 100644 index 000000000..71f243641 --- /dev/null +++ b/cloudevents/languages/he/extensions/verifiability.md @@ -0,0 +1,3 @@ +# Verifiability Extension +מסמך זה טרם תורגם. בבקשה תשתמשו [בגרסה האנגלית של המסמך](../../../extensions/verifiability.md) לבינתיים. + diff --git a/cloudevents/languages/zh-CN/extensions/verifiability.md b/cloudevents/languages/zh-CN/extensions/verifiability.md new file mode 100644 index 000000000..cba01dd18 --- /dev/null +++ b/cloudevents/languages/zh-CN/extensions/verifiability.md @@ -0,0 +1,7 @@ +# Business Activity Monitoring (BAM) Extension + +本文档尚未被翻译,请先阅读英文[原版文档](../../../extensions/verifiability.md) 。 + +如果您迫切地需要此文档的中文翻译,请[提交一个issue](https://github.com/cloudevents/spec/issues) , +我们会尽快安排专人进行翻译。 + From 5114289e5e961c772d53637c3917d21368bafa14 Mon Sep 17 00:00:00 2001 From: benjamin-j-powell Date: Wed, 2 Apr 2025 11:37:24 -0500 Subject: [PATCH 7/9] fixup! Adding verifiability proposal Signed-off-by: benjamin-j-powell --- cloudevents/extensions/verifiability.md | 2 +- cloudevents/languages/he/extensions/verifiability.md | 2 +- cloudevents/languages/zh-CN/extensions/verifiability.md | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/cloudevents/extensions/verifiability.md b/cloudevents/extensions/verifiability.md index c9d330a3b..06d0b8c41 100644 --- a/cloudevents/extensions/verifiability.md +++ b/cloudevents/extensions/verifiability.md @@ -1,4 +1,4 @@ -# Proposal: CloudEvents Verifiability +# CloudEvents Verifiability Extension This proposal introduces a transport protocol agnostic design for verifiable CloudEvents. It allows producers of CloudEvents to sign the events that they diff --git a/cloudevents/languages/he/extensions/verifiability.md b/cloudevents/languages/he/extensions/verifiability.md index 71f243641..2ba5ed934 100644 --- a/cloudevents/languages/he/extensions/verifiability.md +++ b/cloudevents/languages/he/extensions/verifiability.md @@ -1,3 +1,3 @@ -# Verifiability Extension +# CloudEvents Verifiability Extension מסמך זה טרם תורגם. בבקשה תשתמשו [בגרסה האנגלית של המסמך](../../../extensions/verifiability.md) לבינתיים. diff --git a/cloudevents/languages/zh-CN/extensions/verifiability.md b/cloudevents/languages/zh-CN/extensions/verifiability.md index cba01dd18..bae4142e8 100644 --- a/cloudevents/languages/zh-CN/extensions/verifiability.md +++ b/cloudevents/languages/zh-CN/extensions/verifiability.md @@ -1,4 +1,4 @@ -# Business Activity Monitoring (BAM) Extension +# CloudEvents Verifiability Extension 本文档尚未被翻译,请先阅读英文[原版文档](../../../extensions/verifiability.md) 。 From 14c00786d4dc32a1a8611971639e820d8e1e540b Mon Sep 17 00:00:00 2001 From: benjamin-j-powell Date: Wed, 9 Apr 2025 10:30:09 -0500 Subject: [PATCH 8/9] fixup! Adding verifiability proposal Signed-off-by: benjamin-j-powell --- cloudevents/extensions/verifiability.md | 161 +++++++++++------------- 1 file changed, 70 insertions(+), 91 deletions(-) diff --git a/cloudevents/extensions/verifiability.md b/cloudevents/extensions/verifiability.md index 06d0b8c41..6b7930cfb 100644 --- a/cloudevents/extensions/verifiability.md +++ b/cloudevents/extensions/verifiability.md @@ -2,7 +2,7 @@ This proposal introduces a transport protocol agnostic design for verifiable CloudEvents. It allows producers of CloudEvents to sign the events that they -send—and consumers to cryptographically verify the *authenticity and the +send and consumers to cryptographically verify the *authenticity and the integrity* of the events that they receive. Through this process consumers can be sure that events were in fact produced by the claimed producer (authenticity), and that the events were received exactly as they were sent, @@ -39,39 +39,58 @@ this extension is being used. ## Attributes -### verificationmaterial (Verification Material) - - Type: `String` - - Description: the material that consumers can use to verify a CloudEvent. - For example, the verification material could be a signature of the event - based on a private key. Consumers would use the producers’ public key to - verify the signature. - - Constraints: - - OPTIONAL - - If present, MUST be base64 encoded - - If present, a `verificationmaterialtype` attribute MUST also be - present - -### verificationmaterialtype (Verfication Material Type) - - Type: `String` - - Description: tells consumers of CloudEvents what type the verification - material is of. This high level category is used by the consumer to - choose an appropriate implementation for performing the verification. The - verification material can contain information specific to the - implementation such as a sub type, version information, etc. - - Constraints: - - OPTIONAL - - If present, a `verificationmaterial` attribute MUST also be present - - Producer and consumer MUST agree on an appropriate type +### `verificationmaterial` (Verification Material) + +- **Type:** `String` +- **Description:** + The material consumers use to verify a CloudEvent. For example, this could + be a signature of the event generated using a private key. Consumers would + use the producer’s public key to verify the signature. + + Producers SHOULD avoid relying on canonicalization to minimize the attack + surface. Verification material SHOULD be transported in a detached format + when possible to avoid canonicalization issues. +- **Constraints:** + - REQUIRED + - MUST be base64-encoded + - If present, the `verificationmaterialtype` attribute MUST also be present + - MUST be transported in the same message as the event + - MUST NOT appear more than once in the message (duplication of the attribute + MUST cause failure) + - If `verificationmaterialtype` is missing, the implementation MUST fail + - If the verification material is invalid (e.g., does not match the received + event), the implementation MUST fail + - If the verification material is of an unknown type, the implementation + SHOULD fail + +### `verificationmaterialtype` (Verification Material Type) + +- **Type:** `String` +- **Description:** + Indicates the type of verification material. This high-level category + informs consumers how to interpret and process the verification material. It + can include implementation-specific details such as subtype, version + information, etc. +- **Constraints:** + - REQUIRED + - If present, the `verificationmaterial` attribute MUST also be present + - Producers and consumers MUST agree on the material type to ensure + successful verification + - MUST NOT appear more than once in the message (duplication of the attribute + MUST cause failure) + - If `verificationmaterial` is missing, the implementation MUST fail + - If the material type is unknown to the implementation, it MUST fail + ## Usage When this extension is used, producers MUST set both the `verificationmaterial` -and `verificationmaterialtype` attributes. Consumers can choose to verify if -the material. +and `verificationmaterialtype` attributes. Consumers can choose whether to +perform verification and how to proceed if verification fails. ## Assumptions -This proposal contains a few assumptions that will be highlighted here. +This proposal contains a few key assumptions: 1. SDKs will verify as early as possible which depends on the verification implementation. @@ -87,12 +106,12 @@ Verifiability in CloudEvents consists of two steps: The specifics of what the verification material looks like and how the -verification is performed depend on the *verifiability implementation*. +verification is performed depends on the *verifiability implementation*. For example, in a public/private key based implementation the producer of an event would add a signature based on their private key as the verification material, and the consumer of an event could use the corresponding public key -to check the if the signature matches the event. +to check if the signature matches the event. The flow looks like this: @@ -102,8 +121,8 @@ The flow looks like this: CE SDK merely passes on messages and is not involved in producing verification material or performing verifications and has no knowledge about the secrets that the verification is based on (e.g. private keys). Appropriate for tools in -a closed ecosystem like an enterprise with special requirements that are not -suitable for the CE SDK. +a closed ecosystem like an enterprise system(s) with special requirements that +are not suitable for the CE SDK. *Option 2*: useful for verifiability implementations that are directly supported by the CE SDK. The CE SDK has to be provided with the secrets (e.g. @@ -112,40 +131,13 @@ verification material on the producer side and also perform the verification on the consumer side. This is the appropriate choice for any type of tool that is used by other entities, for example open source. -**Note:** If an intermediary party modifies an event, they are considered the +**Notes:** If an intermediary party modifies an event, they are considered the producer of a new event. They MUST create an updated verification material and the consumer(s) MUST recognize them as a trustworthy producer. -## Verifiability Implementations - -While this proposal is agnostic to the specific implementations, we set the -following rules for verifiability implementations: - -A verifiability implementation **MUST**: - -* transport the verification material in the same message as the event -* use the two relevant context attributes in this proposal - -A verifiability implementation **SHOULD**: - -* avoid depending on canonicalization (and its -[unnecessarily large attack surface](https://github.com/secure-systems-lab/dsse/blob/master/background.md#motivation)) -* transport the verification material detached from the event payload -(this helps avoid canonicalization) - -A verifiability implementation **MUST FAIL** on: - -* Duplication of a relevant context attribute (e.g. two `verificationmaterial` - attributes being set in a message) -* One relevant context attribute being present but the other missing (e.g. - `verificationmaterial` being set but `verificationmaterialtype` missing) -* Unknown material type (e.g. the implementation only attempts to use the - verification material if it knows how to do so) -* Invalid material (e.g. the verification material did not match the received - event) - -In order to get a verifiability implementation into the official CloudEvents -SDK, the following requirements are set. +The choice between Option 1 and Option 2 can be made independently by each +system. For example, a producer might follow Option 1 while a consumer uses +Option 2, depending on their requirements and trust boundaries. ## Verifiability Implementation Proposals @@ -155,17 +147,17 @@ A proposal for adding a verifiability implementation to the CE SDK **MUST:** * provide test vectors * provide a verification coverage table (see Verification coverage table) -Test vectors ensure that implementations are consistent which does NOT affect verifiability. +Test vectors ensure that implementations are consistent which does NOT affect +verifiability. A proposal for adding a verifiability implementation to the CE SDK **SHOULD:** -* provide information about they handle attributes, and if relevant, normalization +* provide information about how they handle attributes, and if relevant, normalization ## Example To illustrate, let’s walk through how to implement a verification -implementation CloudEvents provide test vectors as well as a verification -coverage table. +implementation ### Verification Implementation @@ -174,8 +166,8 @@ happens to be an HTTP structured mode message in JSON format. Our goal is to come up with the most insecure but also most concise verification implementation imaginable: one based on a reversed digest which we will call `rev`! The `rev` implementation will only verify whether or not the -payload, `data`, is valid and not additional attributes for the sake of -simplicity. +payload, `data`, is valid and not whether the other context attributes are +valid, for the sake of simplicity. Here is how a message containing that CloudEvent might look: @@ -194,8 +186,8 @@ content-type: application/json } ``` -In order to make this event verifiable, a sha256 digest of the 'data' field is -computed: `Z25pcnRzIGEgdHN1aiBtJ0kK`. +In order to make this event verifiable, the reversed value of the 'data' field +is computed and base64-encoded: `Z25pcnRzIGEgdHN1aiBtJ0kK`. This value will then be base64 encoded and added as the `verificationmaterial` context attribute: @@ -216,9 +208,9 @@ content-type: application/json } ``` -A consumer then receives the this message and in order to verify, they MUST -look at the `ce-verificationmaterialtype` header to determine whether it knows -how to perform the verification. The consumer sees that verification material’s +A consumer then receives this message and in order to verify, they would look +at the `verificationmaterialtype` attribute to determine whether it knows how +to perform the verification. The consumer sees that verification material’s type is `rev`, so they will compute the `rev` of the payload to verify the CloudEvent contained in the message: @@ -227,9 +219,9 @@ $ echo -n "I'm just a string" | rev gnirts a tsuj m'I ``` -The consumer can then confirm that the `rev` output matches the verification -material and conclude that the CloudEvent’s authenticity and integrity are -“guaranteed“. +The consumer can then confirm that the verification material matches the rev +output and conclude that the CloudEvent’s authenticity and integrity are +"guaranteed". Now, since we want to make our fantasy verification implementation into a proposal to be included in the CE SDK, we will need to define test vectors and @@ -269,22 +261,9 @@ based verification implementation would cover: |Verifiable information |binary-mode |structured-mode |comment | |--- |--- |--- |--- | |data/payload |✅ |✅ | | -|mandatory context attributes |❌ |❌ |The `rev` verification implementation only looks at the payload, not at any headers. | +|mandatory context attributes |❌ |❌ |The `rev` verification implementation only looks at the payload, not at any context attributes. | |permissive context attributes |❌ |❌ | |extension attributes |❌ |✅ | -Again, `sha256` was chosen because it makes for an easily readable example. It is +Again, `rev` was chosen because it makes for an easily readable example. It is wildly insecure and not suitable for actual verifiability. - -## Appendix - -### Dictionary - -* *event*: a CloudEvent -* *consumer*: a system that consumes CloudEvents -* *format*: a specific way to format messages, often depending on the transport -* *message*: an envelope that is used to transport a CloudEvent from its producer to the consumers -* *producer*: a system that produce CloudEvents -* *transport*: a system used to get CloudEvents from their producers to the consumers (e.g. HTTP, RabbitMQ, etc.) -* *verifiability implementation*: an implementation that makes CloudEvents verifiable according to the design in this proposal -* *verification material*: the material offered to consumers so they can perform the verification of an event From 1d25d4737ceec7bd75aa906ba50dac8248229026 Mon Sep 17 00:00:00 2001 From: benjamin-j-powell Date: Wed, 9 Apr 2025 15:40:47 -0500 Subject: [PATCH 9/9] fixup! Adding verifiability proposal Signed-off-by: benjamin-j-powell --- cloudevents/extensions/verifiability.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cloudevents/extensions/verifiability.md b/cloudevents/extensions/verifiability.md index 6b7930cfb..f4f00a8e9 100644 --- a/cloudevents/extensions/verifiability.md +++ b/cloudevents/extensions/verifiability.md @@ -263,7 +263,7 @@ based verification implementation would cover: |data/payload |✅ |✅ | | |mandatory context attributes |❌ |❌ |The `rev` verification implementation only looks at the payload, not at any context attributes. | |permissive context attributes |❌ |❌ | -|extension attributes |❌ |✅ | +|extension attributes |❌ |❌ | Again, `rev` was chosen because it makes for an easily readable example. It is wildly insecure and not suitable for actual verifiability.