From 2860e518bd43d827aca1e7262569176aa631dc81 Mon Sep 17 00:00:00 2001 From: Tim Buckley Date: Fri, 23 Aug 2024 20:05:06 -0600 Subject: [PATCH 01/12] Machine ID: Documentation for Terraform Cloud joining --- .../machine-id/terraform-cloud-variables.png | Bin 0 -> 138889 bytes .../machine-id/deployment/terraform-cloud.mdx | 255 ++++++++++++++++++ .../provision-token/terraform-spec.mdx | 39 +++ 3 files changed, 294 insertions(+) create mode 100644 docs/img/machine-id/terraform-cloud-variables.png create mode 100644 docs/pages/enroll-resources/machine-id/deployment/terraform-cloud.mdx create mode 100644 docs/pages/includes/provision-token/terraform-spec.mdx diff --git a/docs/img/machine-id/terraform-cloud-variables.png b/docs/img/machine-id/terraform-cloud-variables.png new file mode 100644 index 0000000000000000000000000000000000000000..cba8e494f4c078fa79aef19af19b2da6bb1b9cdc GIT binary patch literal 138889 zcmeFZWmH^Qw>2CH1Ofqy1PKt_6D$OG3Wop%L4&(Pu;3ajxQ7HwApwE~cekL06b^;E zOX2dJes6c*d%K_S=lky+<8Vd|>eyaq?X}mMbFTUfQIf&IBE@>}-~o=DtfcCL2M@P_ zKRe7vz<)4a1(ZK{K=nXQQe4ele>WYyQB9q=i#JL(FDTF-OV&;Hr>yMbd=~{-H#fI0 zRP*y;@@}8}6XhdhnZA#Dd!_e~n}>KfETf-XOlbHXnhyz|&)wI(IVh=EkqjewbN23W zo<^=Y?N=dt2p_p{s3Izz*grS+r(t5yq1iw*S^s}-H=z%L>+c89Wx)SD3AhXxI+Xga zGk|N{gaIc}Dn1JRPbU#&(JD{~!L3-$U?M5^xM2HI1o62*PkjagAo=+BJ51F1) zq5N|@e2BWFpa02d;)MtOpx_q0HQcfd?0L}QN9UKZJDP7aZ;0&pB=_(4-KzP=w9mt_KCsX#1HdmO{P8P`#$gbcsizOHO!FZFV^WSTCb2$iVY-le)@!JW>49BZd3Bhd1WQyTMnPlMa0*QO|$X$i~qs zWCb1F8aKAwcfG(nqrGFNKQLM<0hH>!t4 zlkzd;ljz;WyQlQ>RB<%InW2SOq}|aXO|K31F&wVWYpOFooY%Z=Acd6(W6+7;xF7Ee z7Tns`zS3}r1yioZxjU|0%ujif508tMygH}_uCglDQ0seJFXVnG7EiBm22QQ8@QdR` z$kMzv={|MG3=`U!Dyz7&w`Fi>zBG^R8B7<1v3U9&wqdZ%)_E!C zqYHg*F3P;G_i9G-ltt@Ycam|$ObP20zi}l4W|d3hL&5WX_~^;04iu3Mouw0#d_XK?MWok=)wWu_NlqsdIZ z`klQZQ9p7c^~$wuk+nDdO(9IrpxH_NY+sOturGrlp0@+!aDY)NaNf}k*to-}g(Ii;-Nx_P0z`a_D9ff>huv6NOyxy=Nh8wS zsf8?+{h{aKB6N4!Px5%9wj?}%9QuPW%2(xz6Z zZ_XF|REyu^Y)zKN3QcV3S*AN*EtyS(ocgV7c8_tNDn2Y9Z2wJizZ z;ye2Hm6q(fYIRP8rd{D?xTOotJ~~%tdyEN;ezf%R-ZT#}aAVa9RQW59+@QE9DcmR5 zzWkpNm=);_c)tU?Ugb)pGVq{aLq$Gpx)(sIgO0uh%XEOdPzi5*ysG_}J9^q%Gkn|+ zVe5;8ZrmwxCV8^SZ%J}2mu}Yg#%=s!kz_myC{bbg#~%DAGtCcW25ja9st&I_8|x?= z_vc`^hanA_IJdz|ko?g3C)D!WqicontO_Ai%2*Cpf(MPSB8XVy=jt+LSfXC=%U9dY zGAJao;8uw@JX_vJ;8g{bnfw(|0ywA_6CgdmL0D5Y4h{vnb>$sm#lvoz*?8N+K}`}x zp^06Spi$La`QF`WXInj*PT$L8!ehX$4Z=}An}R~y0gsWCynC?;d9c1o9GkBqZo4z= zGBLL-QQMl6s9rHVwY3YVf4R2~rYz|_S}Epn01OXb>b>T=aS8;2aE zUG}e1MtO#j@m8x9=qi<)4p9kTA=(B+FQ)xf_tIy$P&wOn!jai;6ANWj`_IG9Z7gD*L9rx*7D|9ec|g)qu+gi>F_mX zAjN@>2}UMz!C|D1$z-4TRXb`=7Q1AbxBk()I*$|fuiOrwb!$INbKF#}%EW6ng-@hu z7C~m_FnH||@lUo8ug_o2w6*$-jE*x5(m;O{s|{bXS45MYm3m@ruxe2=DrLlN3Y6S< zIFmMqO|?G%u&_um<|kj0rk&&cRe8Yc(AIcqGtY!kQ8esl{`Yg6oUi~d{=JP3vVHNW zl~gNd#Ve`aWhuq;igmWv=QuQqs0|0h`?Dn2aO}Gu+FErkmu|gDv=QEFMc?0MRzXT` zd=*6n3vzw;UOpA}VOTdosBp9z`h^q(iU&>Y1CdEzA8$IT5Tw;p<< zn;W&|(ix3M(*73DC(&U1C66f#y&0#x;OzSKG;hq=lk2ORITn;<^`;xm@^13Z=LKhY z_rGeD8P_)k=(YDqR@eH8MuDo-7NRMYwaI*U%F!HpGn76X&u$<>!fl;{ zSol1rC$RAM;_dz!&6{X@A_e~&ujeU~PuOo${bOQi2BWh5Km{$%1{e~rGyU$89w%7Hiz9uB?|;R9g0wiFQ<8Tu5rVtuQ^RXM zg+}*c5qb#MS8}$OXcyX#R_Kt)#q&WskSox-cQpZ=o?7hBm`8G?ENC%b6+j{jJqqq` zu1in%MOC}>NqXa06Ve23BSebWug$z(jGZ;wZ^+sgtx}TZ8(;%)H`cX zx9&x2x-+TLmgih6c7QYIrbs$b8AV=q5sbaY9YNK=WsM3Zk08)$ZKaVC7A9JDJH2qA zPeM4D$@{Sov)|gIne7l6$h{pb>`7x(PKIOtdR{8^#e)=jD7%quwIXmVN&GD&I*m>W zdu{UY#-+a2We)RBMZ${=(IKtKbJ?t=b+L0WEA2uw`I?X=R%c>!d7#WW% zR9%@t^2n{e_JL!}uY0fagZ@OTlgbh?YUcwFW5fqM>lc1^9uikL6tv{rqiC7I9@v`l zHAAd#ef(SZ1u^x*7G}Tw@ULs7LEC>bS9qb@GmH+!&u+o@cJnS;CeOU&w((0Wznbo( zd1n3it*TP-w{hO{Uri8EpLNZX^x@4y(qrjm$-oy!HUiz>N9}y)D)lx_!{HO?qAZn* zC*cPy-l2;kHj{OwPblXkd`Dp8rh5%Xn%rxOdTCSTJ~jB`7tyU7_>(~bSeuLmz8@jZ zZBMuJp&a(hPn=^GuV7nl6Dg0!6jw1yyr#pE>-y!*D}nVuv@kB)9F8+NR&TQYCPC2! zPiVK?N;q~k8*i)!oE82^&P|e_0`^Y$4jA<%sp?+-{#6E zX^86^ba_11uClJ;azKFD44Ro#vZc9O@L=iJirq1krCEaM6KP?LatRDy22*)^y$+fR zw+zS!d`5q&D^xUD^~UF#9W6`6i~5PscKTf`VazL<1ro67%C5sQ9Y#COcBhNE+2Z*y zk!_zse}~|ZnQp_GrPC%$^kn>CNfTW`6ZL!_#E9W7!|1_w=C8k7!1M*8FY0r*`#*~~ z^`sso{8dw-fiSBfHDVft8sqLyNqKB-!+Yz>f1T#9+z`G@JYNFWcN@+CwP+a14q<0Y3QZo zp78b|m)(4s%=;bV0JGnIA#QKJ5{YbQWgH)6Uyp!2Rka7_zhlli|Pi?Z7wxM`G<&yCEr%o9wp9VyB1QeT6T=h zX$AMCGV8Of24%ekg&wxjjJB$8HqgVfUsWjSVf;?P_pzPyfn+~#9@D*5+WSV@EFN_b z-0O1GjzU;cfRNuG`6Mc&4^p(#;ZZH!p)7Zv6rl~tgS|IJBTI4Fsm$tcsgWm!aXko*gT;tz^jrUf%_Se(;JUlf{IF|Mo-|1*^BR4L9P=u9 z>8Y+3S#vTQ$$!x)@(`4T7L zCC^3ZuLZBDA*gQ+lucAw`O)W(ARpWy6g3(7;Q;&CcM)kj*Qgil>+_5i#Q2frs#M z>{L;iNvJyrbO@RKCZ=Zr4)uAM9+KSDKyV%8(dI4*{yxS@6;Dd z{V5k%@ZUSrX7U$CUe@ zJGgg*;6#CXENpHr9IMSKeNM}o&yzlzR-ETs^e5{P=k|~W;C*U6n69Y7-_WVCPud>0 z`8k}Khd6D-bza@uh}!!bL1_mn_Q$SINHPMRkc{^KP$bjS4=B8GEu?Nl9QuY<60%$b zc!*6mdBubm>q*-UBt7Bz}w#V$Ze+iF@i-d&62J3t3 z4eo*G=nERu_?hvYf21lNWLw~ zm`o~c`6B8t$6<`F?;14kr&TEy3%*VEbhm)%yu95#o}~VOZ;pq*ZSTFmFXvw4wkJ&I zfou~EA48Qj>`_V=F`#8cObjFY&Dp{U`WP{|D#@3YJh%x+BUo9RODwQBjZw^gl}ng@ zGGm=Z!n;yR;T3nA=+(89i*lhxuM5)BsXl3bJR0TR?h>&hG7TqWGsO1kNt1Aw(A5cP zcLOFTR|LJN?OX}!&MF_eM#NANp&h*S@oPq>$S zFkN*qY-R7+-lK6<@7>h0^VrQ>?PJ4_m<-OIeJ(s`Xh5`zz@)f1(awdM*>%;w;)M_D zd;_lz*>9d7^4}^A#f_hQqm>B7O{lPdksf?pAJ86LNM@qowQn3qdHt?s!GW|}>j9$5 zCiF*zDHr&*0`^jN@Eh!a(F@vaHO9coGHKv@y_Xh#Jc&G5Fg;upAFXwyrR}URA2e>< zOXjwQYrSe~G5e@j7UY>NjpM4q2EBaC@b)=~*%i61{tW%(d;vvD_qB9Tb9TPX)@bfq zE$`8s=$40bjw{!H*YidSRFc60A<@Owqd9UWjd)s3HN2YO+ndXi(JC9>1VIYY5btJm z?DfJ>lTyWeSf;3ExoPiHV=y`D3%nM0_rXGN$IGW782Um&9bS*2fy;(dPjRU85Lm8Z z^6o*!#r2@=Ca1wiNcn0P(Dv^*QI`wG6{xG3hDhaFLB$Len#V#w2aiK$1w_X8)QONB zl+Lf3kWJF6$PX1QxAqyavzhSRGy#NMjHnyKc3?S2{hJfmfl$jo#$)dQRCr1z+5SkR5tY{?wml8G4&qH!P_>^=6;fGE$qW&F5(f`@HmD;k{ zw`}`_+>KhJ`R9e`9(!M6{ciMdcI}BTMb_h{N}TV{=NUH!+D?~iM-1h1pDUD`GIQnK zc-4S~UAJr0UGh}%g{7~V9EjXsspT_uMfll1+YSpSd2L*4my#>*^HY7L@SErv1@d%j z;Y*#fg+jG03KAFf4GY@$aA6|#w1{TUzQDb|k=XVSu`p~TI2g-H{rv8Sn9^uY?*I?i zgm2jy^Z*n81*c?Jg6D{eHZKujbj*8zLKJ1eMIQITU?9#JA4I}rI zo=>8ZG@WRF1o~|yOdvCQmDA$0(~S#$kTIFO=PBE7j>C0uW>>NJ+IH2{S?@5Pw%xEb zwyYc5!p_1xGdtQ6Wp%fs<3?)5@5}C}UQAsJT_Quy67Y$Y`Gv?x!P_~q`mJhvQj*{+FnWQR@K?&vRTY+d%*BjYkw`=T&^! zO%NHEu6Q$>K^i6R!EEVoPa03O#6BqLlx+mHCo&0zN#RTGEY?55OEp9@y+@$n<7v5k z>LJf?gG-2UbqJ-?VtT>(FyH2zc=607ux6tOA}6;@?Sn6DdeY7?_FiHGZ>X!X zz_%|ow$oXN*U&N@?g029VWFVJCuU?H(fUBm=iJox3 zILCT?dwuCa(iD)MLD3^hLTBhhU0(Btsd{}{?EbVTjnt*lCBbU~9e^k>w}Qe1K4mGs zv*;gVR8}N36^b;_EKOhslk2|=l5x0jEPU)HeZ-AvD)d57(t^f^paT8wD2 zZ}g19MQAfiYYa)oJ4oM_s#D(?T5UbzKB%3)!o4beFlHk)#TP_@r6f+3imF`y05nxq z|E&EC+~j;N?sPpw{w}PS)13_eM+Aq_DvyjG>o@#FWp&A15^WW8=@fAlcjyMii+v-{DKkY=k?e>uOH67)dANJ}hmzBBjwb zOg_?YrU?Cg(^Vyj-*V^F$oFt%Im((B#J{S{XzePjZX+Aw<-DM4CXr-9JJMxjzFLW?+B3k0YK!b*9;cX z1MAIV7b22(Hl*SznlK!ga5p6!`KXH!8#~`Ph9>-icmMTjw@$%>=3i}9(9(1-TsaCo z$@Z)`ULLo7p+P(c)5a}_7V^cdo~Gz}7Errv;njBGqaPpU0Jod>gsZ%@zqxq)qgJO# ztE`gLTj`C+YMTyN*sSj-9;(b=T7a6!{5#~Nfnw#1Kg#X+HN~%BV1oB7Kkp8hb9w%< zFIz+bAoxxzTy;R4Ev`E}dMR>-L)>P4rtjvWrT^jv7hBN4y7|N`T9AnnJ-Y_upsi?9 z?)U2hUu`I?A+BeeBiT?TI%o)PHdg8FnQfKL!Xs!*snDw;0)SSJ$6?EC8 zf$0tL$(rE>#}uR5581^zhyR)dN`-pz89n5{9vrMAg|%KGyhs!OVD_i>Y#KCSQNOSu zKx}m}1Isq`Wn;|tj)oEU#vKGnNio-&QY+YUa?Q6eG>_rqd3e62>mGYahr25f*dd(n zi00b-eP7V6@u=CS9=n9Me!m1Xu zX|VHaiJcdSa`6D+U4qzGUaf5O)ModaSxn9E^s$Yv8(W9aKZbF19CWunsardoYIwua zd|N2!()szMF(cUZ$-V)mC#Eau-vrzJGfYQl^srlhw!Pow6z*PvvixQ;Ps^1kAvx6N zb=?uuC@$xySkr-2$S+395g=zVUcCv zSUt4jcH^THI)e^U3pvS@al3P;yXj)uX|Nai`86VFMbqJl(LoG*fq(m!80y_yf3R@u z^bsR;AI3X;e?0~9c%jqP6}jbQ-El7{VNjAe=L79FVY5*T>ikB8yl-y(Eg0|@&E9(d z7?S@k|N3695C5NZdh0!Y0El?|F&CZZsbw*yZuJ26^D>NGV6|vR*Y|{Xba6Sx{+*ov z`Qfk+A9w}!`0dTVXl0@aY{gAToZ$v_*P+Ccf6a!!l`o)nG_Yd6N!nD&5B;WkfbJun zZ{cnRIIzRrvcDIKzpWdf87-ENm)d`( zU5iPyAO^5-Wr5KwM;vB-soU@L&tTzIt#Zb{7NNhdjRJez_!K;U(vK`!vw5xmWpu4M z(JCR->*E8RxWDkQ|JD(RVd7&>g2|&#V^6bm-oDFIWc*sOo~S+69Sk!6DDkghilJuw zal9TK)v7QZ4&wA_rbcp1_-ev8?&c@GCDX)zdGG(YQ7t{FBv`;{j5a7%K^R~z<2jDV z;sqV><>Hy5pOC~Z%h-Cmyt4F7`iEa%1fV3RR!ia!1`5nl%q1NS!-_Epc zhhqE<@BR01{7cc=n;;GoS;cdHbgG4(W^(Dndpx%|_#ga-gE83xKCr??OEr|6e`-n`ul5n?;tFN_<$eD{UUC!ohcv`s z!jet`<6|!GJi9$T?!UEARCJht%0~ZBDV6L8L&|?TAmCk##DE6m)|iwJ^FKWh6`*7K zZ~yb`FedQ4~c4Ia<6MfQ{$90cNj zyq>c&hr#K*(sDdGA4)ySDEOEJ)zL&MX@;_yp{XU3)c9nt|2Gr-kD2{$xE2h_iGjw_vUfGdQ2io5Os9W3}!`Q0MFyby6xQ*F7e&QZSC|J6mdo}+c{ zXS(p!>nXFf?Pm~kxa9D?C3|M;yODbe(O5=2dxd}}uTAx8p0{N<7?g&C=QW*#qW{-R zyh(Y0wv^kixw<)GqFM_16faj(1+uDri%VAQF$|DwxZp%72^*@ws>C4u6E^7kR3 z8=d^=MLmY5w%XDYhJ`5fk&N5wE!@1#$|vM= zWh(g?U#MdKCg%RntQDm@JY1sHuJSBSysXTjjArx3wHn`c?W;(X{QPt}54$z3v()z; zO^@vE*pU#E?PH;<^KWx$^@xI>oA@J|vkJ^w3I`%^ykm$?PBG2PipPztAKXn^S9 zE%Rpr=6Gca*8#akYl3ZRURvnvv!JVD{v)4n2aC~>|9Q}uNSPRlv22R=6JrlJt;`t^ zos~9K@RsBrckQ#p)UyL4GWw4rq7{Qu2s{G=JKftVO)OVRiy!iX(wrW1RFpC6Mt4e! zE%$c`3x4-5{DxC`9cH?t_jKYJl_}UtgFi9+6_G*37fLanmU9>c z+feawzv~>xxuZSc?P$bGxU==Hg^6r>-A0wX4*HYExGL?vgh81`xMV!Ko@cveWFLUU z%B&~aZfOIRPxbEzfPo5ShC9sFGSf;&CuK&bb8HMGZuwY^FWbn)ik+kTbwz=12{R4z z`m=#sH8cO$t+F9_4WF|hc!Co`&;E3fAoPIYr`x;^i1o(!ujGAC^`*u#mq}nShD8-smm}r1XGX_bO&Us{3F%sEs&u|+fW+kJR4_)pa@z8c zUQsYXzD!F2&-Z8p=E2wH;|JdAE<-r5(>i(kXIumkp@9|hHS@I;u?Pnki{JCO)<#ly zNcSU}uFXaQzZyAu*uxyx`VO3yJLN7nv$O1HJ;z!Xf;|(IB?S_n$xU~r78=jC{-FwW zcewZj>G@(9go*Fnhm2dTMQ%Fc()5^s39zt)0 zMY_jA{s>|F1s^;fGbX);d9pz9DM`8YxOLr!rN+5>kKl;CM!&>Gb9$xK$@aN>& zEOb5uX92+QQ&*?TR<1Tuz6*GEM;>5f`LFdQDfAo#_ji2)1WAHwDu6DnIg#n;^T5|P zny@!2N*O{{LrL5=8e20}6{fI^`Hu)zo$B8}$OOV>=D_9gTK_9_Y@);voR+7NV+aPN zG&<3n!%us;-j~O6sXWDNS4gtaQUlTHW}k*M;p+&Z7jlN(b2)OfdV4pU!40isP~YXw z$6qt=U2f{hs-2@z{O!kmtQKUt)-ii%9&J`@r7MDQ!TZg$(QXWd za6G_UY$9@FY)j8~rzJL+vLzZESGrR@DvN-Kq}t*u9LiH0Jzl7p%71makzjs@`m&rc z0l-}q2ETE;4msD~pw)eIn4<*b5Q)g0mW0_FhyHl_h$m#qK?3`?$*ejg)yYP8^==32 zAMSwh^$n#9u3a3h)W_deNJf!LMGTlu)D6*fg%c*>0pkrmvY)M1l#Uv8xVIn@{P^PX zY?e8MTEAxl$N2@fwc3exhpQ$)O5VIkfesG>mbJ@Fcw;e?B7gQAV?E1htuLO(?i*E$ z&;CLS`zwv2*gEHpejw&NxhG&&l^sgs$8pnDsCPL)pAKbTAQADUKj!!|M*PCZw1WCx z4QOwP8s?{o`n{IzV_xul2XLHJR;n#~A9csaN6Lo zW0G z#NR0?GU@AlLJ_N3Q+sVpr@YiV9A*#&l?;!cA>391U80AI`$^Nw3G0Wn8HX64`LcU8fBY zjUJ`|2hKjXVcF<)PEnxO5Utzn%|Be$8J;WUz@W@IdCzgW~ zM<>iAJl>Tq+r!et+dd2X=l5;dcm0$!Ye>hMKoNaP5n_(0WC-jh#rcWfqeczt8rg@) zmd5Ouz*MAT)ir9|!u?aZbV<{Uz6jLqeveZvx^R(WyB*e1=eXZj7BS5ae?D?wXSDs$ zsEAM#UB?oZX_%&ILY7@*$%nGbgzs+Bj=G2c9yvkTORySjA19Z>LW1hNluh+4;>vcU ztO=g>7K~lb=2_I7=Quy~gf~eOeGt>~gafGI&kSvtvFz~%jIsX zzTrF;pZ1i^%iO(H)cfLlkM&uJ1 zssMa_TD+4F8~Kgf1{3Wm(F0wQGZsp2>!3vD?4vj0TJ!a;mGdVy&P3aXGns;JO2TJ( zfxCH{r5U63uCH`}_~E%TVdtU(7OkRqj%Iv+cPnH`;*xNVP+-?A(JkYCUv2wYLb5gG zwMnk?#s)TvDDz)t)nTU5jm*t^%+=I}Yvss5L z4#;n#C6@e>4+cwjI8^A1{_f4w^!7*!B0pDJ{{5_Z!mt^ndo;n zrA9+~`u89K-j)-c>YoDT%EHf!`rl%!PtbcrKD&=3AA&*^H&FJJKZ>R8bv9b zZU`DcG3;kHH?@QdzMZQ(8LhXoup0aMmD!#6#R)GI(Grd|wJdHhvUe|e>_%9(D;~ff z)a;--;-hdIzghDOYsu@XcAEt*Doae&EjUQXUl7w}U}G;N`B84r*gZeS5HsN(yw-+- z#9#N*G))TM-b$645jt5Tr(hWcQ=-?P?H*cG)F4$Z7OCQdEgnkVkPyx=vVGS5niGLh ze^#Ms5ZaUkSq;03)b-X~I9j4PcTH;|j?itP9c?c9O-^_?9=MeUBw$BlPc^`|+vA1t zf^PaNuPb+N&lkQ3xLT92U)|zug<^?e7YHx3fm+D@b%~tQ>(&5`j#X9$= z1(WHA5?5P}(2#~?LYlHu*OsMvJ}?9wVMGe&g~VBmaV%$=PL|B$ZnTxP+@3}3aa%y` zn^4$&px|J&NCwro^IL2LfD`)ZHRa3Dsbop6gWSO6OGv_(YA(;QiO^rF|DJIYGbR?wF%HTR% z7HY6^y=c;kr9k@LUiG&ITt!_D(8xp=VXG*hM?6dxhX8e;Gn5n%B~|=B8Ihsvud?y8 zye9m1b|`fJ#0t{_mQl_6mJi$YdIy{+Uu~<6yhE6)GNjq{#&`AYn9TMkz4EgMU$aVB zURh-Nm=h6J+fM(??57X><=!9L{NZ@@u}&Y>g~=Qc^qu+C15hu=ukQ*%Zqg^EzR-K# z3ouyPO_%p3vps#fK!QMgu~q&PHaSBBOXN57DZ2gGS1j>_fNw2a4=b(b?DIc0V3BWDU+uxrBv~WWE9JB#iK>=^8*oDPDS)n5g%K!(il_Bo*2q^IVt7= z>uPNolAnBI@@qtrs@rJ%o3z2V63AA{N-sE4GGBR~iSuUq3dF~vc5h(qBjhR)>V*Z< zf#iEh^q1IaJ$4Nv@QRD$G?OO`Ad9N4+KpV_BY1TN{e$|r-JE6Gbm221aPqz;V9A>M#R--yVq`|-JS1D#^ zf!s>XdnZqOF#V5s7indpU7$*jPGNlgfyJVf0qu>@3 zu4tF&YrqQ*itq4CGh8aGisG&mXKa37@rs7S*=STxZ~aa1lMzav=<@tnRh5Ldv~*1ciSFBlz;B?vKm{njptupE1nS~9t<6I8^j;Q8c^*rA%&iri=;;h@`*#)(n%vJb8 z=i_<1Iz0_6TwIcO?@q#BL7P31@)&q5Gq=Ts8T?MGoD|0W0v~s&^y<;P;~vq&9S4Ap z2a9KImVT$3MuffWL~M>j=mx(Go5kQdCSv%aZjY3G>Rsx&@R6boMq!JhEXM&2PG*Vwzp)0SJ(C8jM&O) z18LzpFwEbIprzc2_ z=JN0G0&t)>9mcpp_4J1L%>H30&yVX=OhF-#;|OBdtmLcq5}-idiT`|ic-W71VrZa; zxSL7a0E%U4PWQtT(8ufMv|s^5M^>DVJMYhp7;?dGdTLFT2l*Y499g4x=@fDFm^C#) zKzCqC5YT<3gLFPyp5v3DHOzf+qf0`e3fc<{-@Ay^@_Y2e{Z1@krAXK3X7;Nn*2^rz ztO}^ZwG;zEkA#|pte*v%lftptpM@)CyqFdya`-f#awI*Z{^Jg<0x_(NKW`}GR-KgF z$_Tu09Xs21i$aYIm{!po(C9`$@r8$} zc{Y(IJTq}Lg(#E=^(U0|>Og%UlodeYv`T#y8-crI6s(3Zfk=nQjGvb_U-d10uwXX= z@(eW&2j3+Epy7|ZZYLR?9$uC-8-fFK4%riQ#>JOL5p-ua5`XNfxzwLA1e-MA9T{Fl z`B7I2CO@%gQJe*Im0Y^@L64uw)biQ(B|1cElDFeMg0Z#lx8YFe1>JX~T`u}ol)4R< z=*<#Wi&c~mBD}6?e9k7V88S#+t5Lg8cKOb<_=<=beTZHe*1hu(}#1V$?mLY%wEJgkV2do=cy`c6GRD*yiPG zelr)9`IqwA|4qO!Xgh-_A(h*!S?0QcR>r3kYde}eV^Xc%wNr%=uiDLSsy5ej=(HJL zs@cC=5BFQ-c(;@9rRh5M6Nf}VKJzooQoxeY`3crEIiI_hxl$&bPR-u0y=>e(=?bDf zx;O!9&vPf1i=Dmnl>;!j(OOcazW&BW>W#bW=QIB8i2&wh8$_LF*V5~nAWv7t^8*!r zDn@ejm0!8Dw#fS=l}u3M`mfin<0x62Sm=m#t6`&}&2Kd&&GEnMty&x2YxMeNe%#Rw zcLSkaR24Or^uZ_hPGpYkQL>$a=<0EYLe%>Q$xD1M97x)?_k^qRrTo94 zl@xtg%5nl!inBU6q;OuHsy1D_o{dHh6Y|Z^kWkBzFSGI}AGj$_AC}o42pi%2r3HA6 zX=@KM7cuE}Nd>tPZ8I5%C1PvhKMkW3_ib)kat?u!`Qn>|qF)mbDDUHWLHBX|04+qf zTL|N1E6<;Jtf4YhPO!jn8+EeqbOuhA$4t$$IVH>>0q|P-;LG=JKsO%k5I_;x5M4NL z^s%K2RL5%yeG;)e#EiO|dv(s`Cu}A^-_fLip%@H@OXTfM``+LFttaxc zls@@;$~LF8V7nTW^xi$!1d|_3!a)}*RhihXjUnFdt67ZU#lbg~^4{!(t8X51ibNT; zEs`Pe&4vx%+0H)tM0^us4t}H&CCmZ6%Sf&RJMyg#X7lMAAnkC+A)Z*s#UXbla!MjF zIrVyP0){QroaFfPyIlFLv!9FNL7`I!ND$Vn{dB0}Y)gy%{Ch%bbp1_1z4|A(USQe* zQln*bY~SyfyGM%9C#&N#8#>n!5SeIh$--9>xgV}sYav~}<39<1SV6$#Uao$Zx%)Ck z7T0I|8gh8HfvtTn*+RV6(go)oJVFT`TnC!U>bai`CRYD)b`MvvWs!KqYEclfhotH= z%Jk9bRjUi7c6mX8JllJy5oomFQ={L}aWd^2f*Jh0iX|UC&9qmQZ`H?bZ$>Jc+rUfhy#FB zB?Qq)+)X)!O?{ibbo6;T_D>dV_YWLO)bB29I`k&bMCsa!Uj-J=pHOKx_LiKmSHf20 z?)o4@#7pvHSa-$23s;N%`3CmVmJ-5F@U*@wbRSzpEhzK?7h3}9&Vp5Y+#T9|sr`0H z=BE)g{B>mwLVoQR_iT~&8vscDeoln98xPsVky>Dp7%4XJ9dVDd2r16_xIec<6%m7 zZEdZpOuE5Zv~zb6?5H1!FiRi{Eqd&@01S{M?iL#BdtHeI z`11(;;+pM{Al1}KfktutW3QS4b)-j7yGdM^h-;^Q{$#$&m@T7)w&4x1`u^xbaW#mu zNanG7|5ZfzJEkF!Q@Qtj{Y#kHnjt2O?K+ABP{Mcju8aW5!M9)p1ooz8%r*T=%K$qv z7MlwYS++!tc2v3EM zrtF#ZUiCI{O`WW^Y;0Ib6MuxNdve^vm}@Me7tm-&3emd+{0gR-8mqAr>mw~DFo77N z5!N)C^in-p^xnI<)P1rfoxAb=60!aq*7-TX#TT{lmV=-WXifKjNmCN!39!;GlYx7< zbsJjG+a|2e2xs?banm{`fbT1YfD%qd7<=2{2+I1Px478y$sYK<$9lTMxpFu6>Zox2)=Q?oObTP(g;9VL4$ogoSEfFLT*SgAba zYy@sYBlCbj6sSI)b)}d1RIIcFq3m^DHdyP*y zS(BKbU+--D$#^AU70i921Z^! zfq}xS4z2yZIHq*02#rk=mU%>nBfGN$Llnf~UD>lar5n{T033bTm+;TvaI+p^CnNlb zIvGN~)6cPuZ$(~0U7)yW=kK}0XExz2#$hsBm85ZfN}&I()w7=C2t9ExIJ`mh5291c z4fS0l*l@fP_^|{nZoEANUg|y{DW;G@;LFn{i`XC;Ync^Uwbs$$2K15&=yL*8QgJ!LO|H|S zC&0M`&b@{WAteZ#ai$YN<{bbm`+1j?Eh}MJ)B^JuLQ~(}ff($u-`P*1c1$cLP{1&u ziSe)SuC*&=Rq1#jx5npWIiKD-NTUKkv}pw&0*rO{u^cA6vc>~HYYX2Ka`<%Npmp^g z?giwl+d}>-g23VqNH+A^78>iNn>Zfn9spEyG{EPI(R}3NzJTJ%9z>>EdPJIc=eEFL z^V+%%E?%i(h%-azlZ;e{vx-Is>G)TflqQ<)*uLrVyBt4DKL#YJbJJH0NiiDf$Kk*sPG@l(*;*x z9*^cgMa}`=r5#~JIKWD5mB-BoPGEJlCyL6PD7AUe2NK0AP>xd7)yk$8^DX`HK2jSa ziZz$rdhoRJ}+pHOrJG-z0bW8Z`4>J{Pi^9SSgqb2oZ z=9twkeQeLwmi1R23AAUi8x4qGLaQl8%@ASEqS;C89;Fr=n9g|#Tl*|cd*M)O@e-05=LX1B2XZdC6%X>;Br|miV z=asK*0-yA>p1_}d+hEjepip7BDMJ5P>yBYLk(goXtg_4NE=?v9y8BS2gY>@0Vo$mo z1}(JtV76VAcfiTINB%cPkeBxzKTazoE5N>VlMMb-CP?xQ4$Uv1wZRpJ%Hh76^Mv8Z zyYQ4|+C}Eh!cpODmE^IxnslnB(8SrYTvy_e&gJU|jE%GrI^W4!j`H02aCNQQzh^_G zZ}vXgpK)hZ&=QYlpFQ4v0VqR~;av(jheQZ$VDG&pH+c9bTNBP(G)&Q)+w&Qy+NvX*WEsBr-$`F#>yC;h8(+56zkyxf=!Tz};bZrIZ12IDHVm zO#>X9|KWs$kZ^|^8l!Tx)YfIYGsDV}4O1?`M<3vVyM;^^#>j@ACF4^{P<(M3#}2Ez zN<30O5;C%CqV~GMJbKKx5E4`PL6U@jJ4e3!9m}R7sa^?qy(?d3Q5pD&Zs6`-!qvE) zgzh*fW>x3;U}7WIkiFM)d4^+*i*!eC^4{O%VXONj2)d_RfJarucNcDPk6!zGiM@qDd$X^JQ7_`k-X@V5{NQ>em@13p{l-q zMe-K$@D6%wjgwV&f3k+Pa9z3Tk3?rK{8R`p%ld4r9AG60gmnGQ1O1DC`uZ6pT3}i}_X7Yc2bgyVfEA1AAv2Ao2VF-O}ledHysF8?87L z;l6Y1kPywIr_=6p4ksNigXrE-j#`<#|Juw-FXaDi@b@M1_fHa8@bZY}2*|tML}2oz z*t|RI>GI3eJCiTdpY)7pa*GfO#F6te)D*vRl*pAW@@)^pp8SwJ-5%eP;-wu6gLp6+ z4_=aCGiXL`ey95Qi~<4ncuj~i=A>ZOyHEH*A;?{WvHr=>_Pu`>$pQ5lFL0>)X$)L8 z4vYdbjue_g+?Rl%H{_?-S6fpmZAiIP|gOqmHS z^F1%|p6@q9JJNDPiGXvllgP#BFyFcLsHobRqV3?Lp*VvzwwSME6_%Mz5^avw&Lc~M zQtfjKb=D}S1#$8qEJnoL5Bf-mS2K;*^;tFn zr@JCK+Ct2mq?v9Ft1N3Ax3>a3Ii+s4`#=RLz$4^Yhi3h`sJ46Chzyj2FVFq2d0uCT z8b)l$9l1^hnD4BK@0tJW%=ktP4ik7mKohI`^2)GEDDa8gZ_;QF;JHy|*+vEHjFm6d zel=V!@JukgSf^gGu>rd7VWgrsr<|`X)1*-?RRo;h9H6W*R#YJo;8Ltmqa}*rYQ11et5N%yO>*D7R34z(7EEBp$vUw+I^CJ`YZA{inZL0B6^CZ^3m!^u+!vD`~++>qEoIE|+}%8$ryx-9$m1>NnDu*N;CKHyiB~XS~^gij2+9 zzV~iho!ZBYB=z6~j9&mp)M>TNNlF3&4_@j*feE>IW)NITt}LX%rqI25N%U-~OPbk0 zR)>5HfaqlR&QDmhc$Fs|Mo=YtG7!@NJUTyi8DEP5MS~>=^E}%q5`dr|^XBJv^E`#Z z?&WI5a%6VLyeIws_o4c`WPwESHg)u##7wY?nDn|a8yCvfnm;r0-t_AOgNgG*H3ey}pX)05ayk=*YI^78=6w@{oeF$Tj<31m zsP&zku66|=vqM;C>!J~z9m3}-Hk0^&dszJu%DuyH&xpIT3pS2Ia;dE zPX5{d@g_A4&z=6qU{Wk=ehd!d=~|x(kT-2alJL8K_wpLx2+LhKUWfJ^x2sq0P>iIB zL{(WNeBmv40jdz?32pw52r0cb$iATs;OjIRHTEa)=w!XYr7qR$WYIktNT?itaW+j; zpcAW6&wk*hs~5eqXI!F?OrBJ1P21f8w`a0Z0n!vl_dd zySwLFeoZSl7kPX0*nz=n)XYsyV$pEBuB-oE{beBU;aS}5;e|fCjCtL-W>Wce)_6@) zB5|se!1Y)phn%3nAQuU5P+NmWCGRWIA$n(2h^EcdgaucI&JAguiW_%rcI~oNmKei) zontuQ__|uNlCfLPJ@GBxn|FE*%r~=^4%sX3Xrh}yiZXksQa*cvHd!QIoUE0x`0(rlK|MA0p7^-a(MykVvC?3&hn|MxPBJxRDF2AE-M1Mj zM~v>w_jJ*))iA!I%?WcGLV?ak-1~v${2A2B-l(XJ>>u^z%o(b_`}o%LhNpXOP3Rb1 za0EC!$qfQhi262dXUJr!U`{oC`fRty`tyu-(TsR z_gAn-4<92cz?n^WX6qg~Ri0{gyx=KzDEr6rIk&JQ(F z^M5(Y65YlFv?pJFN$-CT7eG1y<^{Qz`{6&w4-#unL6FG zLxR8l=I;-Sq_+tae<|*N`JKM-AX6{-+Hdz?t_|<~Z&&604x_(+)t_ZX3LryxHrD3D zJoJy0^S6KS|HuP=t{zC{^`PmCDUJ-|rK2g;@3M6{{gfipo5bZrDYKin;7GiEtWtEz z&=r~#zTCn0$WiBd;#=RU>r$&QhwD+C`?-mDO6m4=y$;|;Q*hWB9M+-|{aK#)W6se$ zZ=(W})2%)QoWhGOb4e9$#RTdi8tLOS&Z%^x0-LIG&s=%br&n&|m1Yt(w9=_w<~ zMcH;PV8mpA>=<#pqh808jPj2lrOgA$kRj=IxFhDZ)p z#fPyvo>A%!c)cHCeUu`>I15CB$NyM8#U!_po~qLFit0e=YKGbN=>FzhX^6pK;)vrB zv6p64=?Ycf_0>bljxRl#4t-gpUv*zT4C547+W!I662R*(om?cC0-K@kI0u!ONm)Ka z%(CI6L^vq6CzP<>a5aE`-PpIN+5)1K<;5k}SR7#ptu8m{o7l1aact2O|FWLt>YVly zK6{Y~m(e!GCqV87L~~&_i-jzYN1x3mukC;45cAo{KS0GL)#9p-y-nV4qwN~)L^s6i ziXNyhK37?&ivc8M6eE`7(N`J%>aFSG|!nn^fVgf4EGyJ}?_>+Ya17>kIRov_dC z{!_NhcqnaQNg3ni`qui@Em=+(VIOG5^PbSEi{XtGr!Os_4_w@)cqZSC`y$A@D75OF zGL;8tB3UKZUmN!lPR>^Eb=T}i8J;A2M2Z!snop0)15KEQm$z1aeJMaZgqv=3qY&j% zSdE+FY5S*pm9`8v7MrqeI;GXc$Md4sF80`=XD5C2dl{^gQ6Nj0t~4utgv-|3FFcxI zC3b!3lA#n-Y`C0}ivirfa~10AHdjE9W%f9ywZ9I_$?ufA!(*J z&L*nAQK_uGOTJRV@YB;ihh9JIYVI$;2-)r+Hr&6xFbdr4%(<8xIGCwb>Uq0!S;Sms z!c8Dadjhv>m%U1yk&qf7$^d4lZcT~29urh!fXYXyReutJHGtm-?DEL-75jIlYBiV* zT_K=QxlGv?5{}PS(TuBmh_$miyp&$%zR4{fPSRAManlHlDwL^$iAf<+@eB})Q@OT% zd~py)4c7}?4uD{-XG2a<>XpMD?>)oGU9;u4Nq=$yJnCM_3V;ikMf>vgy@wV8SJjX~ z-2Hj}j-!XftC+zKi(i*Ui>;iZc&%>)!eaMg|?E` z3m}$>5kc8P97Qf6IoKB!R%*dkW@?tfqSK^O$PSJ&pfO4sAe;meMzJrBS`_l_0rDX8 z`{vUdo|>Lv7V9XV^VXZBczj+}rBK@#i{I8@hz4kvVyYD~S?pMhcLm~E^~-Qg&xZ2i z5Q2N7dnKz1)K*2Go*;y!usJlePjp0ixS@)jBwra^PAx^ssx9L^d_+Jsk}mr4l4NJb#DOBy{Ls4tP7^}E#?J4@J9yIZ<0(%={dDlJ)r*#tTZr%# z{!d#0MMrs=^JyK=XrqCd-oQ2F;1@jS-)&6B>(UYZtC6|@dl+0;wk$BA^coH?;2Lex z&)0*|!X37}=z+Y&;rUqUi{Ts_WVLFeTyFPMSsD**LEGGH0)hI|u8y$_9(kbAV|3V3 zj9sSemAq-

WzI$l9xSx``N~QI1ZfIe57xa0j>~^$PkQm1`A7r}LVwzBQRC2ywr1 z5L}u5D4oJIi*WI2MHDaM>~-Vvt)v!sRCiN7s(0FY*QuLSthZ*$`7s%)HDub(=9~4j zw~@cGMJ55k*D!oRuS6^jgxfDsuN9u?7)&P z2}tC2{HATYV5>dfM+<~C)N0*R8;;fO?JgV6g2w9`RYXE?2v#fW@bf9hCP9K7*!*q6 z>!b}?fG1^8&HuR2T;FP?7x#2q=gwxDhMp;Sm_93GTd5=T# zoHXz=%jjs*=={9PCPRcsc#H_A@O^at@NijKrq^{(Zf^FHw$ui-98b1Uih?c%4^I)c zKXEk2zcgMr({ltRaRuryhoqaOBaQ@wp8@+tC0K7t-bQgKh}iW5ec$R=2Ap7G_ST_= zfwq6d2e?nSEh-A{%4wx3!kdhj<lue8 zYAlQx`&Qy~V0@H}b*B(ltkHmHSb#@fjiOPaiSzO?#ML_h0oov{&L23c3p?&iy`9@s z$rYX+>|MC8`g1CK>0UIgU)^PT%MPDavL*&|#?8ILwf3hIW^|@g#V6w`I$t`l#=0iU zIme$0Tt&$!`@3Mt2oNU2?O`!4=W*$6$k48Yf4d^^bA@;cN_BfT?lj5LxxGrwuW7#5-XN5~8#0wI%cX8XOm+Y;WcHVAnP$k_cD6!EiV7XGEL zHP$*qzQ{MUyD_9*TlO3kBrsL81khm z1{cbP62#$)r`NvK4AEq>(llIdEQHHv)k{Xt- zB#Aaj>v;Z_h%hBuEb+_JRHmQL7Vib|%`J5WCs6=-Cp#G*Z~?bfT!ECnxTE_h*0bGA zCW(2F{0z%AAl#Q(ip9!3 z&X1hkl(Xy3X~#6S;7~O$3gN=wopnh*xAdef6uRlS$YF~ouoUfa-n?gEvEQ7L#5Pur zYq*CXJoR%E$%RUp&aQt@E2Srn3G?~bm2zSo3O%?lKXwYZDX;c|I<^lj$XXfBwi0rJBv&Ff_)FxCH(es_EcWW z%O`4C$|?xcNqDiL@b7=Hn4O`VHxw!Nuye-4s%S`~++m-D`bcW@{{NIe0587rwa< zk26my=HoF{Dg^fy?ipsTV>xTCj1?~LxE>qxfGXI~?d+m!So(1*4I~B3#9IL1@#O5vgH@iZ_$Hc+3vU6S(-{w zswiY*+NR@{&w!(Bv=eKe@+4y9Gxp zHEV5MpF*2+-h1e*Or^L`#eCWmiDz+15GU{#(k-z~e*yYK538HGlCq5>QSto|h+39Q+2*|Asz2f*QZUCmvYk0QZpqCoOp1Y78{y|S6>iU`UokM!FgVY0-j@oPZRw%*JCGay*Hfa=%fOb?c` ze-@;|CBF_`hWXP;&yQQkHu8V((PmSM(?`#?1;y>1G)uj}D0OQ89 zOOmHw<-2nKmM`1IQKD_!m(UR%Y@UMj(~+>QCm59)v7H%=riH&P_{%xqQ&VmpLD2b9 zXp|%l>p?>TCO$JByc}envI%TCZ*J?KFDloGS(NvLJ|(M|xlohS(dz~jtN>+xEG?ef z|-|NoqT^2f8F9!+-^Y=cSP5gEq2LF_fnPOP@0Y%f{@$d6J zS)?{V*H6O0n`*QzT6JMtC!DBM^8Ul4>*=ya22iSdL_TKoh4?$?Ol-8uPi$3GwpTscHz9SD%k4x(hZ zO$xe`k(kHZzTDC1=XmN>v+NmWhH!5g+}yH_D~VSWRjgob$L4@7$|QcjShE(|Yrp5o z?aZ&JF}=d0wKoIXA`-+*oLa1NtoF)YIpg|eMTECBOTHJlf~?(i&(BA}pG3F?yelZt z$`M_$aH0Jhzq>8Rd5gw@fGxPPHlVYOZn=o&ZA{67+ ze%ze9zppfY#f^ppZU0CADYPk23bL$wcwHvfhl;l6P0| z3Ox4IPTS1COFZ{+!T3qcta%y!{n&2-^n|*7totXO@%O^;Z$Ev4!T7^jUlGUtvM_&p z>=IBSc<6Xh;`s0J^NWD-cjG07{R&3k{=@$(UR(OtZ^fF8REO(~QG0JvSXJEC*03{` zVMrM4gLZP(4%)zQs0H7<6f;}0vUiO_eA(Am2u@C9u{S#37TS**$zzuFte%STKb)+V zKs+NNQYQ)pbf~%`VrF$9cc-^n?It_mi@18&6l0v?BI4>`MhgVUp{s<>b$s_3G*6Y* z`*mm_Nl03B`-&iFs1IIV~?t33R<-uM5>W zUQ?GC%^RuJ8l_7mp^;5m&3z8};?#Y@ml$jJ!!wfa=3EkkQtIo<)s}q5Ti#FTD?P8h z2qwb*eE*B+pn)4vkH{C^EqxB>jR5quPnbMbMaO-`%{?vQ`;j}a;L)#^<6;Zm*%yLe zjUl?WK(E*Hg)5sot9799a&NEMuxpp`{*6ooS$xB}1m1InvHA<2-bWPdt$JwxPx*L-zw-q;eM~*57+1KmzQWh>Yn}Nw1z5*7CZ#SX8@A4r2NU zt5AYi-4AX;2alU%x(xOKG#bgU(-+Ysqo|D>&0%+(=!!Q7;IUDWI?FfM@88nGEJ>fM zWYtUxsuY|nP82}&sAiofJ~L9p8i->`?x*d=@s$e&x7=Kx@SW|}D@49nI>g}fybREy z@G+kD<7AMNzi7E;Y>r95bB)yYi*EdyTz|41yGA?N*B!2n-k^V!bX@NG$=z)`BSRv- z^=MkOajwomgF&-~gs~x9pm3N8?%akhHB=(YYey+pAw7-z#(k>Ei%^r|7E0cPCglSg+ZYp1`Y?v)b=oQv$wq%r&^WvkV>vxe#!ac(2d)qr` z%z9~w6Q}a|uUG9YA^kOFtrExI+Eaa2Few7Ev5s$Y;jftxafb)=pIQ?X?8dASYGbO6 zE2Np{>K&{CKbfkTu*)-mX-5LjfcyY)5`YQjulAn-V1Z3~S|sf43B}kXRPT{QR`BN0 z6|LFwWa*2SUQ5()Hhw<5i@E*dKR+cwU6yjW_uDanvC!f>lX8e>GsV@zunC;a{>ZJu zZB#l=AxX;1nx0}P4~yd*#dMQ?wGC7l)Uhg z1Z`h3cC8DUIa!5*Syd4%E ztwu=Ro?mg~O=&uCgrNaGEkF)d1*}p`lq%*T4%TSJfYGI4f85B(LB&sXwGwAPU~V96 z$EP|*pBmaM_*N-jQ@I4eka5Ac?kbLc*0IkxWiK{aYgVYQe9Fq_!n4k%{%C8QbY^d7 z4~5-gfhJumm-S~g zV6gfktm_9NMe22WXvo!rkQf{C3sIW;?Xj}NOnMpam-}61wrfcG(#=IdtgL1eF)Sw9 zk0z(U6=iR>`%l-RAQ0{e)yJP7<7R8@57{IK(R;X79OkE-(gFphmId9GO0gC@);Tyy zqR9LXaLu>_>z@)JhA9`%(*aT)ljZ#0Y9D3oLjP_arsfDXqXxZbX!47R6oTpUZZ{}H z=%<{E$|}nnsmD2P`sJOK@cYeti5DXQ^HGqb2yBJsuW32faZ~*kT*uwVNhy7XNvrF9 zS6QWsH)%w0BNlQe6L%s2CDZ{#1FCul48E^2)Q2)}G}$Z{ay5@P3}9L4m#nN(aHWOM znr4tEAgEbh6jyFe_BjK?j*tI`zsSQUZbvjH-`LR}Pd8wI>Ud7i!QM zuM7%pMw&e?ssL$7MerpO&Q^AD({dr>S6&=O#|<}^^$WX5jukWcY$IW{42PMUHPTPm zjG_DIJ>l2ietxFcaOw_>&NtlN&@D3Jv_B09CSZM&CG+K3{$xSyWVr$JGOd@l6Y$Z{ zMMZF^sc+UOYmiFfR@Qdgx#l7H8J6K(C)0?2WYEP4s z-csV1=3@rs&wPb>WIA+GEi3iOL)>muA%ebqB);i@|3u}Tq?FjH9y}r$Q;beWMll-x z#MyFfY}Ls>jNm2L=azeSiZ0cdGh?Ajy?zX;=NpqhDO3yeA9bcsk45DOOk0qmYKq`yoQaTaUUzsXZB%nCAX-hlh|L7ezztTY?A2pWc=}^n@%1$Ya%{n8DipIV-)&ZXLcEu{b@87`Bk$?k;& zd>bd|xb&%xftRt{lJA8e})l8W}VMrlmY8{W4$3~9SnRRmfQT7{{&-VE? zGWoH#%Vx(rZ0Nm@!AxX`9ky;=Dd|9KEKTz6OD=5zpQe!+0d1(q8*I(RG*^vzU^3zk zk&5xC#BQbjm^+-n?HQ0C+d5k3vc<6CdXcXlQ5t?@PFov%)kwv~u{a zjue0*PGPl*CcD> z9r^vx(6G3}m&RV<;>7(Cb*!{z=3a2*Q>8T@(H;e`)*!+qB8& za6)|04^pSmG@qFTjMlgPFa!%{R2%vdC_lVqdVGS*S}=5vn?a|RY;7T*=5YPZq@VAT z^%GEE?9L4G5`*yS3JNzM!kSqGUH3884Bv@)5we%n?#h+QOGoi|tWhKLR0-}ieK@LJ zk+^WA&jjVj5r#1)%ckg;^=jc2*j7N&c$(SRji#lVHCy z)moAIT{XzBZjk3ePkmiW6s6q*4%cm8z>Cs;0Bv0^FHMO^ha|Hgzejl3DuB{ymF*eQ zk;RBg#HM|3=$)5O&W#*4#!~cZ53JFA`a}vxs#u#x>y$(jh!2XFU7B6z8_r+Xllwj( z^Vk?hd)i?`L17TbaGz*oIH9N$=5e?_AfGNmAOFgxq2W{yk9>;n!aR)VFr+}eQhf$s zJGIPjYFa-dJ$aU)dR7rJ#Iww3 z0PnWz0In$5ZM2);o3nx*DD*GmHUum#jid@b)UrR72Eq+$9rse1w3c&!f#K%eBG#=Gmm@H6PFE9`jr9S4LFH#b; z%jFvnoXpZECO;Z&I+w?>L6KynnvWY+GtBH%OXj?4tT3DJrf|Y%G75Y|I3}niC%AGS zz0YI&)TtBtPHn8*xR1_`Pn~85mY6|vDa&R)Q>3?2WB=~^l*0~a^p zuDAA5BgVRulr_n=?!YI@AkMi|nS3;X(z%8G9|2&W=SUV2yshN{P-1BoTb_z z+P4B1A%PVPgb7~|DSZ1Xx7hpd&!rq6h~_wLjg3~WB`V-^Rj!Ct4!6w&`Qd-o;ACn% zndE6cpbRGF0^i+qS2Sr{VGI5n9Xil;q!ODc>HmOsOXS5LMl&1G@H>mJ5}M4UAr@V;PIR$ zoxrZ}U{bHzq8#`#X5(V3`>i;L;eq0apPGz-$I%88O%8Pr=wYO&*!)bze&nGp6NnEg z=nWFUE{ymi?Sdb0SnTnECl((`OFh%}yn?BqUY{91y)5o2 z)fa_9F!CHOo~kvu$D>0|=>!(A9g|kDMtMLAI`mV6F-qX`Vyg#h2vi zE`VUst5blMtudfs&2PH$Llu0$RgcO4ee>*c}}>Dyfm2bV~4#J0cP^@2Y#Qz8d9c~jDup~{&ypW z@DWoc!O=9r`lc7k)-vz{ghjgnLqZK6mPtA4hDWEU(hp4C9<8qz)~`8KPE`!kmvY(@ zex2Y?`fBiIkMm(qeUWw}){eluMwEzRPSmR!*AEiZM%q6}FnAkPRWVKrF zFzTcd21aaq3f}7+ZYN76ya2xrW*F^f_pebX%iwaua9c&#sfisOczjMasYlg;i zlvsC{1(wo@XD7Q?7MfG&2YPBHW}5=bHP32^fk~FV&&FbACP9gm^5&BHU z++{p@*@+j|>~zq^hryqXl?q7DzBIn&PU5ymR&y4Md=51Kh&1Zk;0>W!ceI$mq=45>sLg>0lP4`F*UrM~z%+>&-rAa%~KPNBII?um0v zSH;PQ7j5{BMVJ6#EAVMl$Ac^9FC5ui1LlLH<;JKE(!?b7jyvuxX`Y}-fCI`vZU-SRu0#HVAIc~?bz{My?i2>$U0~dw!(sjSm+NyImIPg4?QA1R^FC zlvSm>GvovlWnox2B11f?-uIlgI73P0%tk(~y}qdE4(*i_#Df}y9hlSUUsptu+w*-< z7ZGNIX&guYtv9y*hDlT@yukct$$lp*;KC$RomuZND3a{m6Yv-v_`|q#kvtTXKEWi`H84CtYQv4A(E7cr6Jv0JxMGWfUv<%Uez?| zlVW_juaNnu-ho``oI&gKZkH<_nXO=#-)^ISf(6lze(^=4dc_VYeZrUr3Gtl<&12$M z=0eSti*S7n9^Q|V8E`bveU@1!mXipJm=1wyF%bvTB9C9`{1@;rlYj=y5~PDUW_I62 zy1>VYv^exbG97e+saw}u6ALJdUs?d;M5C*!%kvh2p;SSC3af=nQ{iSbk=Jd8jc=0F zMZo57(u8-Cd^*!XVYen52A+-bu8GZoD8dDLh#9F05l^^urHp%nxizMV?`QcMH zL4HgC@4}+($uah_QyUyi=0YCv%$ck=0(gzro@c93PepQu;$Kb%z!;lO=NtkJr>iv~ z3RzP00J8cFIwaMG;&M9&5P%+)!Z&(e^(0|`meP?NvUz`&_;PAK)0GxX{MtxzjWdC2 zmY@6+!NGvhzt3rF{Y1;0-C{ZuvEVVTBq~*mzJvGM)nRQ@(#Mqut+1!N^?<_962(!Y zHX+ydDw4b-jCitLIsI!B8vg{OkW(M-{)r3$Ds9^Qnv-v!oAW)P>aF@}Hdqx8eyD$6 zX|~?bc_>6T+TX$PE#wWA_SmPO3)ToJ^O@i?&P_rRKs!F1)<)|uQJ*d}n|gTtzABqX zWS(I#apqM6OgN=QXrVDheaKIoMvos5)A7+Xo=yAJDT(&Y>>L%<-|RAs-Hf8WSKe`z zkkM)>+at7Sy!Q&Cle$Z!_ZE@G3d=$ zOP$}~WvWfhz$Yj0RzDaT$B^RN+rQ5CB~+&5jqk6#xOou7U4<@)QKI%T+qW8*-2RfX z^7>?#T|nL}n6ovMn^K{Ifm_WEg@DgS{lP}ud+sL-NS$petOjYCn|ivBzmYxaRCjh) z-3jn}LaX~sz>?DmKgWeUFHV#EjXr&=1=_+}o$#H4C6r8-h8|16b#5p|A9{0zx5R1f z(ZzmWm+6_4gH4{+kEXgs)!uaAuM&#;GN$t*1X5=)SF_Iyd;}c4AQyMYR#Lwf?R{ah zum@zWT;%&e!Xa0Ecx`0NL0(gVx$A-%(#%Hs3zj# zHha5cmLJm7h~<_}UU3m~^o3Z{3LOh9WfH;r{gdb(92QIBj?M5h`swL1Yq& zQtXBgysg>gJI_zJTPD&6cCD%qGzBxtJ)|&Me=%HUcOUW7!x*Zl4=o8VTw>H+0?j5i zG^v_Ud-_1+;Oz6?{C}GaZDDYsY=9R<1Uvi6v`# zvH*yO{mOkmziWf|2(oDM0)vuP((hbYZ?gtYyW7oLZ8x+_*5vn>DW%*ux+BP2FE4v( z8EE{p z4@~dQd%^z!hD71DG|8lKv5ZMpk!!Ws^|GSQ-6c!u^(y2W4XB^JFoIaipWqs^wwM*nQ@_1 zoI`xp9Fr=0jf@3iolQFx#UTfTJ{mr_quoZ%sGiYYhSZ$<`QO;b%ijO_X*V2S9UneTBCN_F81WLvBY z9!<5}dV?Yu<|WbL3;vExz-}qYQjM|pQYWz7EMKQ*W6F!WY#nb5w`4TL z{;~v;d+NF9(nieX$GQW9#rqY&UVcM&!oLo7bCoX1@uF8bJM1 zr@eK>zqLQoBbXHNK+g~2$t(QCRfQ=aV&2}^T9-^ACqQnRCYZxj88t3)+H8Y3-ows} zrP1@Xp)$5!w#%kOqV-U>B+#NFo{=H0e`wfaGA#e(ewhXNLSxgLu?XLxlw%)cPO1|C zypP~4`%?8Unpt3j(^T`j3jT_d4otW?j>9Pe(ZgA@dh&xZ`;A0K!|q#N{k=Y~2x*r)sEW z5;$iYB++=$q@5=l5goFd4qo_i76b$KMhq}Smz-rw)-Tx+xGD%N6baFgXl~-M?|NT7 zW_X%#v_-5pH;+D>tVq8yCCFp7P>u3Zb)+jKrJ!fU2$z3X`x;c)U0?g^GhuQWtqxy4 z0PbhZ$aJdrJM@T=I%O`f;+i;Ft4uXdHnCP1P`&;4@5I>CRp8(}_Vs+x@BLs&h+q~Y~2%BTAVZsRD3TU-B zws~kzz-3r9PnW4-w|uTz0iziEhHNt}#_%b_!dk&;V?0-3s3u4M5&tqP zg=xNGZW=n2+McT!nD>|!oIEFAEqygrqMQCgz+)(RXgon{t|nO}NA{aTzRMwRBoU8m zoD zmy$A7v~iu9TBaYw>MWaCQ>%d z59cN$PU!)SmWYRmd*3JfF_wM7{rKIkmb#FgS#FPdk^{4e0*kUTeVdlXOW;41AW7z} zuhp^+0xWcY-#yNX8KcYNXhf8z4x(T~R7c)>4ok`VSq#Kg9##!u+iRem!OhHLoal>i4@Ho#V%e=Ye zY-l5{4iK|#s(t-BQ@L_Iq3SK4os;*lfzlC*l`!>jAgW7VasEfMV-g=LMJ8}GjpT7- z%azaU74+bC_5#fcrB0Oi3YH8@*LJGy#6iK82+HGP^BXGdy?6_xC+-Yp|JAMJFV#81 zt={?W%!>l7f3r2L!HJ4G==ek7-z}H`evSmYV}YX_^e0;X7nOtL)h%1Yxc)HrzmQZu z1CqykwnzE@k_=IxCEk)$%ID9<{y+`?QsTUZyDI_a={5exak9UJN`HPpcmu}&ZF<+; z^lt$EPaWPJO7PfUQQA!Z3rXeH(q+-yiI?@?kNy7kv4=nER{lZ+{GFr{b*r(e;z~*Q z_hY}lee8E_CF=hk|2J_k{#Ua}GSdI%=6tv;eD!~YJ+e~Ld}|1Y-vGlKd2e;(Ve5vnd4-Msobr8QQe(fRUu zWAz8y%y%-Kykl5)gXC zgVsaH-NQ&p$qff)WCqSWF6;p@2Kn5f5SC&Y>HXnjynY{$j{>st{uVdUe{d=Pi1dqq zdRr%mdIp<>WC&y?6s7ZCzV!jJC-pF6t(u=fih1(0u-X32s5Ky?2|eJgvAhz&WpS>l zwag6M6Q5-pAa_Saf+3`@eEMhR@KYAt1uncRfd@Cl zC+Qua=1RBLtAa^kBdAvMHYP(Xg1bK+ba04bUZbfG^=2hhcE~3*);u+4Rtz~8>L_k#-OCggyrg|uoc>2b1`?8-P zimA=)05qrhn2QX(m`-L~t>1gogZjhsvw?V2+(l#jOMi-SzS$t^)Fz9IH)rm9p0$oU z39Ihp^{cM5KkofF!%Pn~UI2jh<o3m^!~oZSEnc;>Uj}eTG=XJ~;dLSmMi=?g*fIWiiSF>kT&=wO)P~#u zmH@+Gw*P!q9r(0YqP~h=E7tGT?xa_MW`pylH?^SSsi#NX)^dx7t`#=4(akZUkfy+C z7fI`W3HIE*ld`}l*=n81EA^e(%Fjq^dpgL?#9W^8t}r4JzWf{~MgX@a=AL}9T6bP# zzrOeDYrKPaIeELzrqj$OEyBMEio~UtgD#v=RK7@t`9~Y$I#pH>!|Ry>6Tw`y^uV*j zpXmDI0!^KlxOxOX7Dg=wKyxj!|HIZ>hDF)6ZT~7FT~bO)D~*)2(nu@ajkE|u!$?U9 zNH+*5-JL_1bPkp#ezXVgsznKH}UIzc#ygQ7%ax2LCZM(&Pwqdp0+dCi*+d2?l>Ff|K_c z%u!UJCDl_i+f(=EpS_Q|fE2wUH##n;1t}^txh!D#|2p zD5Jie3Td!Ed-6?hv(n^vx}$t^rgR|>-(y)ac$uefvDsbqeNw3z`^8HDgi8W2nZ*0F zKBL-wbGA3>)fVFhKu4ld=v(lA&xE(dz?vLoKeq>UDzNh=P5NX|YnI&&*y*R^(HT~` zGC?8hgz=ww`ouRZ2Q?GY>KzA8VTWSgGa6y!f@MM&hkJMw->mGwTPfBSOR2wQaTkJx z{Q~zqqYpC}vzwyyd(vclXZEB2cI{RVn?_R1#5I9zlO?3=-QnY-mam+aOR}d5XqtYk zI$m;WRyEX&v!Cc_G?Wa$yw0h9O5Xht64=CfWzlhyvNgIKbOi`}W9tr@lFflYO6JMD zD0imj>$MPDsiu=r^1^DNVKHcgPGdEw^KPjb=KvshZBQ0LLc*RUt3N*1E^30t=}7`TPiN2 zMU3?lfU+CXsZh@YzZusV0vbkPEHv5=+lE4Qy@3`g_-fahAwb>8?~;l1Ho92_kfubt z9xV6Wh^ZbLyypAWc3Ev$(3UKmFqF`Bk zI7Ly5yRM=gpH|d#tw+6fJL4XRVJHTCHx0dz)E2jR$4639Pa0rRxX5kr&A`oh$rt(f zm!{9iZgBpe?|ewE%t65Ge}G3ujs0%`z*MYV&I@*g<^^k%=p6bNcluucVs;k+-?B71 zZ+yds?QwR52j;8LumK<+0mGEBdZn1%Ry;=8CY$V%@C9;(E49IiF|iBf2Cjo9#L!eO z=gQ*pgvBCv3lpBw)Y?o9hGvA)PH|tug2Ve z^hV_c22)i|UEF0rBw znL)y_1Io{6Daf6;AVF6XmTZ>Ga zpmfuWkjcs-0A@3_`krxP@2z-~3rOqI0HdfWP!H|2WwXMh0P_qby7N}3P@hmG|G+%P zq@-cHdX8j4bQ%x^!J%hWhEb0MG?0mWT&;j80pJp~>RlHc{7#vtIB@Dko_5#kZ{t&q zDPp(8jTWnw>t6c;?QEB=r+6#n=Ie(Cn?NeJmGcIW&c&PP!WdQk2Wa700*(q*zI~47 zp!(RsHFwN&NNaQB)3HWq4EX<_jSDn}?y!Mw!soibWlLF#P{-C`U8ZFYTWRDCdc^R` z5|Dql?OSqqz&qqrp|RoaZ39FhP>Hy8-h8wO7B*{COf35J6#9;e>*CWlg)OTDv8Hmb ze9r6{J3uw2J9~{hIDQaQG`)vKMy>Wk314Beg(;2_SUi;Iw~bSYcyDP$Ca4mtbY_Pz zJY25tiy9o#J$($48%TeZtCYznED7CE_}8MM0B~T@kS;R+j~0NyT9Gb_B4x4M=DTP5 zo6&y+%~`H+Ckq}qW{>?#hlI@5C;fE?BE!a&)X(cotFaB%*%s+A`V9 z(buSG`A1xzsA{FO(LXnav@}MNw?jklLo#!(Cl}z+zSC^lrRIKJon1N6Qq}X-|Ek5{ z1fU=DSdWZnJCwMd+?yG+w_<9O1+bNudy24tF1%OttDgW|hySIno8)^;YU%K6zSJfB=Amg|XLDO!XIGD?=ZqaWEy+i>J%0!v3w$M); zG%f#-M~j!GkKRdmX@mlP7?O|mzUTkzmgh_y`X0iYRFbzfR}^(NS>?592KZ2K zp=nFm3$E8i7rm$tVtHCnYqO;E1eb!<*w1q;otP9j*%V%Pf1p(<=?6uPsy`LadYdZX z@NyuIDPfB>QyoxP-a9Yk1YucTgjUMh>u+!WLF6%iE4GVW)9pzDkW3a89~JNAAeNb@a+#p{#Sk``=~Y>*Gh6z&q3~NW}JEemnPIoYH-( zwXpWGYlp``z1@d-2%Fq!XLtyA+pTK{=b|I>th;s5o19zRm<#{Pet zKQVCrCbkaZZ2!LO_In=ig4qoH-{&6yI4yW_*9v6)%Pv&@#p->l)rYt;;NR!pac}6F ztd}j!IgKeUU%Sv~Wr|EUSs!y+w; z^nd4mkH^5hmv|J}%^Lgm1)sk@uLp|=IpdxT4mXK8cN-oXDC z%KX3X{c2!)SeDHE$kRC&`u%shA0q7G-ghfaT!bkt?-(~v>9;vQ6x?ZxkY0CzYb`Gg z{`Xp=9|1R1E<542a05`3{vFHCJ+b)CvRRrwN0Xf@2i8RTUe*Fcmq9F}3S%3}PeCQ? zQhYU~L$CFqKt54}-YGxQ&q}B%e6fM!gGgIHaWoKNaYaJE`Q_W~($ifB#jx)0bWcwd z&ae>o>+UMw?d@3JzP*1w%-Md%kxPq1(QzxV5})>?)_}5E<$@%Sm4NG?oK31;+Q+ut zUMafy)~PQ0u{G0N*YugUiGZ{KN{eN80z$Pp>CyUhC zBGfPG0wE)uNVKcoaoT!7->UjsEk@i`<_rtu!<||SV+N3%IFf-laW#c0bkG+r{?jm} zPlQ65)wR(|OE0UuzxJC)%N*+Ye>v}!q95&fI)EtJra=D!esi}m`r2H;Q z2BKCU4UX{@xUS8iQsFZiv$^q@)vN@EbWVc1K5~hgOZWiFzxc(*FG1THF6_$*zSjh) z=oKuPV+23R@^5)vM(90H23UT%MTW0IR=Pwxpze33%ScnBYar(#R)G3ielQQgD0Ov> zhAeQN{0l^9Pn3RCgdV6CI-AY*54^VWFb0Z+RYURS)ZrRr6}dr6CSqNo z1F$#z0 zx$!eKww+S_GTm$2PflUf*K?mUD8FM|vrQe?=Q%!2X=5u%b9b%m^6e}ASbXqvr)eV) z>Ce6QLFLz;H^J?U6tsxhmvth$Mt&5$Wge5FuZNyx~}7mvO& zv{fa1_qzSvw5Wu_Pb3ET@@@fe+AF8~Q0Vi@lfjz|TuimQ@p6h*dWX+Xnxd%-od$hv z$0q8u0J~1k-(C7@@e}DL;0o|Gls~>1eEaG^1QFLZydZkF zmVxO++j+RgjDl{9hx2g4J?XXR3cg0=_!K5Cxs_53^eBS+$*=KK&7rMkwFO_2>81;}T~(9;&GwYe!Wdiul&Fv-A3 z357hg;HB#>qY5#u1JW>Z+}gU_7XmH&YB6hGk;^zz8$IN8IHju9W_no;^cX4;B)*0g z_N`;WzB!%3DMsMWpcu&%8hb;h&Y`8)LpWO?q+&k~ly}#Oy5I+~eVa!2C55*aRMN_~ z&TA^sLP{Ji&h>?cyiJt(I1QWZ{jSev-GLsJWTAR(IxdYsN50GwAny#^t~K;)W3Kw^ z5~K7=CUwssU*5_x_aI2Xz?Aqhiwzm&B3*Y*I(JlySptiQuM|87FOJFJw)V|9Nv{`J zi(g^45YycCJ&LZgxh(5nq^7^Fbyyx|ooEWGb2z#7eI@F!UF@U>N}uJfQ6aAx)f^=D zYV&9s(KZe0H}VxfGe4XDO)YKo{%M_MZk5D7AXr_EU4VcXpvtQPq0?8HhWdjE#ZZfm zPEsp_P=u1w2ERq5rIvA_5kgG2%05yQurQe_)K&i$naVD9wrFkE^Lity9%6-sz;~cX ztK42}%=$a6Jt-gjg^AI#YAnQ!oB`7NimJ`|RE4+9sLk)A(e!b#72*UiLQV(lc}P2E zFPb^4dObPoF7eL}=8RSYT5X4APmLBEJlW3D)U#_uk)w}F@||Q;$!n|U!^^jOOaVzu z4Gu&G6Q{j?yG(DtYS;bO`<{t1o`t2HL%YQu!F-*y8|JB1pr6dBxOH}=LjKuP%%sEf zFu?N5)(}Cj2yXU+ie)d>3t1sVSOJxU&(bKZiig{GV|>Rh6OLn!Sg>QFJn335l5dX3pZF>fLT(WO{PIw)^WrqvSXoC}CWD;i zeRBKMFtqvGO2)-ys*A|*y90X$-mD(_{*fi`-=Nbce#6#&Z5{(>edbo;r!6Vve%vSq zo24B8l#pxI%%G-n@xQyip@1=BipyMEZfPnMStOEka&2joIh0})H+_XCTcC6RBOUUN zbbert-%Ghe;jvv2^iN-fW=-MVJ@GxWQp#`I+$yVydgoJoUmLEpcO=yKj;9w7wuVu8 z79+_j8+jj-qgkFDLnk0PXnXpx1`<{kWA2AM{XQnuJ4JKj<}4PM;Q&ja%EDlvvh&#O z1jFT*V&B$N7B_o^pR^M^8xk5sN6GOM1b>IqSm!l^w)+!hSX=U|ojEd^30~7a@zF4r zj~Vh=RLjckQ=u@;*y_=!I*Y6Qq9F6}eW^B<*kO&zPi`B;mXWCAI<5N-W!%4~^>hJ+9TTq=SL~wG_Lv=cJkb3b1oY=tPj6+T*suJB=+f%;`G`U6 zZ!d(QttnA{-jd9(q5Redi1Kh7Y{2j>Rm$( z<8fIR2}hS?&FgrJc4X~6HwuMgB&aAx4U{53$@kXX#ozk2_=!%VU&~O(NvL&1{c;G= z;C`nuyv$s+^%eWFmtH|rY0p3z8$tf6d`(r;RRy%;9piW^W3{{P;Y_-c4^}@e=h<|! z)p^mqRLuI<89aqSUkTQX$p<<7n&XRPf)W~G-o&QPn9OgDU8hepHIS=z+OK|yi7A$u z-#tZWxx15qId*s2FbJr5;sDbbZb@u7rq(ww>LBNAUu4LqeLShmsM*nvOM^R_gd={m z8%HXXF7Fv}yWQ1wlWP5r4_L)!jITF>EM&WQ;(~Af+ z@7$Io|C;$Ry8F`M5c&J4CZil;gCG!P>3r@tjf+B&MevO`@{zIpAjqB+HEd8sSO-DO_nt)ns+Jf%PI{XCC^$w*G^&^PXPeFi3lay8Bi%9EdgI5acU{TbleR;yQUNa|W2HmlT}G_9q0?>fL}h;Db8mnN zvPr+vI}I`kfR?B`FqBE?A_^BFF52^TJ`%WXZMRL<(mlz?lS;JTeuli&$?gN+_Go{Q zLC1wbw5}18NG%+E-#e+?9pS+zV(rOTk}Z|YG4Pvp|Uk=B1ja$w&nZ~`b4Dzv8Mt@&|y!O zI8nkzNcr_;7uIN0LvknjNpg>CC{{XD@mhyIlDr-Vgh}dsXPBEVe(lqyFz(k zfg@qxihq-vEgKyT_bwJFM~oq#;NY^TWF`WxAo2!=-E-AQ#p;HTBgwPou#eVh=%wTz z^Z5{Sxsp}ZNi%@ow`eqcs9t!qGDvt?%AhTZlO!D&T6P-owRD~>;F|FEi|yvFcUVu^eqcaN=@ zn3T~RC-d>g5#=hU&x6=;pNn_2d}N9U8F2?lO2@5*<*oU1D|d33if{j<;A5dO?(HhD z+_=E9tDFxWaYPZEoR5GkptNF1><>O%5VE;B2(crZSKqGs9qwfy?drvHyVnLpLFERE zVS&08AO$n{xcx6HsN5z9+#;AkhMmt6ok~)5(P>pN5#tmh7Cmh1G7!IwZ_lSn0+O(a zTMV461dAtIuOfe7ob=u6k?sfU;Q9>t^TSR@24o+Y6Hq7Njk> z@)qXG=@siDZtJekONoux-f2gROa1;1;ch7RcBYs;;^}4;6qkQl@3@laEo>T0N{cqR z#?Ut$G{s8HJj#djnjK@ec3e)j*5~54gq=-I4JZ`2xoGA~D12MW!lx+KNX#(G2)=ST`RpFHMyXI$GUeN<`O=oN?y zgZ3aytG7LL3bh_8O>sMi)RN+;e^M7H%s)Z zV~fk*8t9Pmxo2+_m+MMWOLkTEBCw4OjJzaMP zbHFahhCkv6t|LpYHbh?Qt+ZlYQFr{B_v6TSCO7A9DJ=;$Fu+L^^VxgxR=;M~v>UCY z^`*|&i0nrrA77?O_|miX5f~#+Lx?k}$r!v#&M{H4=Kgu}KsnB1Ub<&;3{gg6`Rn&jasCK_~#>W%1P z-?g5+E_{bJ@P+5es_0)(dkb2G!RFv@-$7QuwtP8U?Umt9PfIT@nn-UNYKop2)*P|A%UkCZHZeYST4gA zQ`0G6yz4sIi8;u#*sb-KO_yHN1vzXvtjCGO=Tx`zUi~Q-eRM`-x0n<0 zyyf-$Q}6cR!BmpXNw{3G-u?v}Dx;$%k^E+g3Bv7PQxe?&y;V(0lzY7W z+W*!GzCtLK{PW^HbN#K!r#D|)f2k8ZVgK>d@M)2I)h3?5`Hyx28Z7xY^(OA0%sN0z zGEwQ;Pz0UcT_sE*I};07re}!F6WlrMdEbrHAHwLrS1td}B+@c|uFf)5{SaO2hA;Jc zdzCw8O0VyJnjrB(DC_jmO%a6?vG7@_Yk{A`5}b9&L)7T$rq!d@3Q90i>MBYpuH|(9CeJn_va-k zkuSQOE3my-Z_obc^N|2G69&u&I8*W_wxl{txfu*RWxM)53AePq;q%VSh!YU_q{COpydCnqJlf3g`@Kk|_slkOy-t~M^l5m}$E{Q3HpR_+-~wzv#$XIJFy$66D8^a$aBDNl=BFBywT zKHNiJbfjWwdAVTrVevu5>UyzLr*~H?xCHe+4!x-Px($f9^}E<17(a@qX6*(;e^8cW zcFFk67AU~1F7s1n`yz?u#5I#78>9q37RN|PE@>NA2YKBsQ%4q;X|85G6jb>;R)GTo z_r7AMIM76b8V=1Qak(BgPXdau0kcPe1Ko7&N0cpJX0NE-k(M3jd3T zmw*$k=DtGoP)o5pz6prxrPXRe!yp*Uc7h}XQuL(>PvbBPM(3kHKSOBW`#LXhDc)Q- zN4gK1kX`|^OAIH>^0im8m)VY_(L$8(uxMxIE)|W=3K+Z`s%|Vv?LyF!pRph)cuEhw z*w4KmYkR0b#XFw$wALC3Mc6TJYS1&*%IART~!JST1mgbF~NvtwEkq+YU{Zn8s*`_jFL!M_j(3lb(DAEKs z9j;F50{M5I%u|EUBA$@I2p}jDm`sj3wT@`q&Zyp#Rt-iQBRf*%PznX#<&HBrbXnp7guav`498EW* zFw1FMY;w?G@M2Y{H!%PCL$`WUU2Idn4x?7n=3}pwgX;ev z>+F*+Ix~n983%_+1NqsNF1~s{H9ikJuea6o|51f>QW76Kgs{UPu>+nbuE6^$YD|sL zdYNY@dzAXtzOhz06EG9@wX-d0w)F3-tr+{L#=D-S&4sDcko%#a?Pr8E1m;P^ETSS;u?Y-MMgv=3%j4qI-z!y6^_n6G6E!-E6}JiT=%Xacs0i$A z{3IK;Un3u*(2N1&4Q<9S$(M#~$_<+~S)lGsK%Mx9eP;vJ9WeZr&Rj`_7E_H4j&_*z zN=i7cWRx{j7lVt@1`sY(zVttObwi6nGb0WgTa54)^R36tFq1K+;JIdgu zyOQtyt}B^%Y-#enXzv1a5F1zHDQ6w_#MTjE$!(I<#mj7be)ZnliK%oKLUHl|2{L*9 zHpAq1r&&+UbJ|^2dv;Jpk^MzSPqp6W7pu)9S zSYxp%YhZ&Gs|PS(;w9ecs_$Y2K{98?za;lF24SLifRYT%ECkaF9ne2g7ZANW*d)YJC2 z`!gYZrffnDYnz@T`Qh0)%mc$3AgQ2FfESXv>MW#*l-`VNO(lHVdmkEs70Q(j(T%%M zhGgk1iat8WRxRO#-(rH;gT7C2Y!jw_*4P*<{eGY#No_=ieii=R*O5RC75bECW5A9VSoG@DBMw4*we?MUkmk@${kk676S0rJWxnM}HFRnA@K8 zhT_2dC-qq}wDw=Gw^;A5F zfcc-NQXrw6Dz$PWm~C-LvY%}*l+>_ThJgB<98I1*&&GE=5Jn1yJ$5OqB@@E#WSClG z@-Mj!#R&=R^`Opi-Z?60cf>nHr(+M)Xg7($Y*bYH@xZa1IXtj-`H%I(h`;o;4Rlcw znnfhcLkBv-dA`yn|7vVhkx)ayC9yr=w#v85wS5pcYp1IWR#B1QAqXxHw zZ_Kl(tbt`(qU^(|5TFRCG@&7)!r|n>O?`#_D|hnQhk~ri-J6!QAjbar>;=Bn&8}{o z&dx8CNWkA7?Xu(Sl35morKuppcgoKm+V8cmP>?&{w);ZN_q?y^!*#9@OKzDFq@31^ zZREfd6Ex-0!p#28hcUM6h4;ugwbr=WoAId}Fp*xkUb_tD+$5LN{)GSVP-$ zscumF-FmIFaESZL$RLW!C)wH#@<>U8JLYAwM19FZ#WWZ2e$p8|U#B|$Oo*Sn3XtJ_ z`D$`4HQw)%JEfJ`_oLP10vfgXLDI@%eU3J6PXTzolV~hY{>?KfVmz`5!!JL2?oz-f zl+v|o$Z0`TWdXyfcf@W}@oa)L6N_ji9tTO0YeZ;Njd%~g+Mr^ zCBJ*J9uiY?Cl_vaQIl&~b`LPzLca_mOJOTSz3HMIj0z2`&~3;@sFSN0DWY3=o>P! zng-T}wMtV5iETx|s)F1M7V39bi5X3ey;}PX_wwc18rk#gDDRFxAvc1%e3jH!?>vHp z+4E<8pKSN3#YB5zksX}=ojKrYA;DDXuGCk!_~Gd{6htr_g?m19#*O{6+{~ZFIVUKU zqp9K8O4|7;?9CH1VtRZWDL}Y>uB)0~=jwG=u@i9Koi4lN&Y1gc$5j8#U@F|s=iScg zs_6zuy)tiLa;?-vpUt9+b{1NfUqFM4hQAIy$i@R&yNe6daOf0)l>6iMoQQg!v8TYC z_-#pq`%Rx>^o(#aAL z!A$-Z6a2H@!#E@+UE#t8m6ulcrS$s zv_5yc_uaANx=X_!77NFE2U{1*12&j~e4hIZ+N+Q-f$$-3{~(P|8~rWX<5>8|8}e^4 zDru;hs(gv*XbRwMhA);0aqJow0h;{wjGrn{T00RF)D%+gj2&mpXymdYJiMDa15a*1 z{eFa}brwnj&V=qZonw()Yp{#l`@{#kwZTrPw9v z^w!bkr zKs8X%vG-4R4esrYutUH8^wriY1l0uSpphwEwC=Ztr^cYiqF zs(5)W`$WQrQjTKZE@Lxl`^mQ|WKC3%1^HC`_(~20gm6jTWc)YB0SF}zfh<0R2xeOS zJvr`w9roao;>0m?@8!8q;z@nEZ)>xQB?q{}C1n5I44MrzPJX zV)may3;}(pUsC&N-9Lwv-yZ_i*SY^C=KuXACg7Loz5+(uP3gj*twf2or!WwwF@zqx z%fdzD$@mVlwzW}8b;q5CfJT^}OFV01i}Q1I24ZQ;;Y7NKB$nMK_N8yt!tnE~N0%qX zcqcw1_9sVO&H+W&GjR9!6TiZkEW`T(gl`uwajJZ;9X(%cq17)M1CD>Jdoy4buC|MG z(X%nBcT0Cx1Wj?sFU1?>Z75Ff^Vu=En&f#J4UhujoHexJw_u_a12++%~vfX^& z=y80XZ&xRJwUe7|_!pn{VC%|Hc_krP^$6lqD=*$rpMa!&!|v%K!By{aQ)*bRJ|S@( z&ls7b`YU?`@Q%Ay^_3kEZxhXY-MC75ba@IXIE4keH&|b^EtM@@GkSgBiG8;a9{jj7 zq5VMbF8HJ+iOV>V*ZOXX|C3o5fB?MA|AweUP73d6Q3gng$p;K-m&9lqm&9Svc(k{e z{7Gcx1o9`H#jgLXfCpoL7hClF;reZHOn>4PrtQ-g{DqqR6SGPRN3+}A3!XCw7Ok&z zQQJo&AXb*lqEt%aJ_h);_wt9`xmry%7IUH>Jg7;)0o{X(Ine7_QlPLq?aLk`j%S-I z&+!vn3J`sgjgEl=6NQFxKZD(~9x`kO8_fMy^IrrUOFz~>1WfuxT~r{VT#rFfZGj`k z4KJ1T-C~xP7Lxs<;AD4hH$i{BIQKXVp$8V*tvNSO9&(1_rIv|d47kiyCj&OrTpD*c zlBk{W+*l?TX5A+H#=iq`+jXE2fP(oWqPZMH#-V@JDz_luU;%_4erS7#1_THC$Fpf0 z0q%XE1sDk_xf?O;WBzDdtHgfN_8Il%)}D+dN-%Bcn)q}aed%jOG@_sYt;}Dj9A|4U zCzuhbC?o}8-wK8c_&Q0KB2e3^)|@}sw99t9>m~c4&6F%}wv#-ZX%kHu`V=>w)G}V0 zE5KzFx+C{46nH@#q*6s%obC&IXLH-ee~S2x6`}aUuI#90tQPOl=+{1H9=l_C$A;!E z3$(WaOYNn~8THs($qO2-X-y>ysSHI>FxodC3jvgowxJ0Z_~tmj=F@_dm#YmEkO|Kx zaj*cE-{LZGgf!Ct!ih%L-Kx1Ac9a!QSYa!?5|G>w5CLk;M(FX2}O3G_-w#~u# zP#}5ETRBsp&wjCybjUOJ+j+|?09kWwD-D#~+z`!_6vGUl6mX0IyqOfPXCfI*JLUe$ zQNNXv{hqKDxhJ1GRY-5Rwr%V;IRFk2MOaXDM5&*bJol9pi{D$#0Zgf$y6$|Vo#8`s zx!kt1$iT01E2T{J_ZE3y@Tkf;V&p@vp3FcZ)5bx;h+&(RhU(M|TJRqs4Z?c;g02rU zdFD>fXY+Hrr+ZdQ$?`pnN^y!2lmaO{aSsU+F5t7ILAy#wdm1is1NiX9oaa+W^f*=UT2WP6F@D^!=vL z#PU&bv;KYBo?+ujy(>)o?MX{KTP)pXqLW*e!HZ-8yshNVott%Ap)iDTg`{t^_AS7I>zQgPU6n4*=I5Po1_?pbU1 zX5^z02$BZu{9?RoTlqO|>#X3!UaWO#ag#6mv&C?2SYErG^I*kReKhZp@9J3eW=j6V zmC@sD1B^pA1Vw$4*06YdjSam3+Uo0-JSiuaQK~uK=9wFPK=Y=19eH!I=e(h%U!_B| za#_8_E)aOrJ@Bzgmt$L*V(J`aWjOTeMdd3V@8zd1tw4CH!Z8&4xw|cUofm>Sui4X@ z(WoT^!~$2hS*U_E;w}b5F21x@hFZzr#cPbAr)|~|6g#Xv@|@zhrd)b;qxlVYXZ?x_ z@Q+1nPA{ZU%_g4N>(zX=d6rUrvilv~stYiL)alL9zlwx@*B{H{SlC>ELz4FAUJt}> z7XR%?=7|hu{E_es+3^bF;myOc!5q7Hg%dh(sSw{V78dGM28={k=yKp-|qm71gW+ zT^I6VMTFl5#OSj0!$dXwa~m1xtX$V62@^&n#X)Jg!p>RTb|V}sgW9RgvK*gC_~w#2 z6|IPMptv(yurV|jp(Mhn60hbSn#D(!|Mnoj?dH?I#_oJ&V>HHLtKWuI;ax{_o`kNJ z!2X3_p#vaKTFj+5d>E0=OM-TQD+tZQv%4 zf@FpvhC$% zk}*ge@4$P}`+Pr!Gecys31mFb=(7E{FBoQ;^hP>aVvngbH&(dB;7QV$?{J;khw^- zJJT9+9xUgxjY};o?RK!p#PmKfz9SGL<(d?@^t?SQtUrL7+j3|}y~=*>^`t6bfXSKL z=ffB+LDOh>FltW@(@|O%3qd}*jY28|@i3Nqb%wSBbDsn@GP_;H$tCxg&^knsL=G+!rG%yrwbQoqB7w+O}sf3Gl!L_wn033e~xxK7A>$ zQu>HMWa_s?WhVs5wyZiRek~bJ@~0TdWwK1&shZ^OHlCjRX<*q!+>a@`3pz-~?OS#ZghogCN>QH@+`|=JGmN9&FT^na%sz^c1lP>=3x!{(f{qY=C1Yn;c>F8c zxW?0@lv?^3j9pM>AQE?r2)y^xWb46ps}qRYwJYL<(j5Q^Nq4m~ZBmn3xD_8iHEe)O zc<4|}dym3N)9(wY$;83fZ{uG}zKfX9pkg61oRKQ;QSs+IRyjl-6=z+M@HD4-dGCy| zH7stoPS?{fe~P)b*;6w4J0GL<8SOuM$`i}6fZ)c-DzW8RX?4#U(yuURa<`?!0`Z)l zjb>wai$I3)jNZX$hT;o5B4ygarW@B(BVO*=FvbzrX&AEU4!M2cnEidqj!Eb~^ zmYjIFLY??b=zZ$;?9b7!)D1>U^U3JS@LPuON8p2mN4*Ca>$sBQ^@mX#zrz(CQ!){5 zW8l;95KEm1AK*0&5si9C?tNQ!9Bmut_`Vu^)C7P@>;lL^O6v?we)zWpP&&yT2uWN)gdh->pqa1r`yihQS5z^7T0wWy(!mlI`Q z`$F)co6PY9-q{f0lFoP2chSKFWM2o*e5N|G_C%PW!z*y^0}{FG2SGcdta&RhFN@aB zx3ji2eeifX#k5CCsy>=yYnR>r2{lo={X9tVdr^=7PHnxo{e2Ekwm&SiN5v3iVWgZ;{Lep?~xBgZ0XCCc`ak6;APnHD5Z|p zJ7k|9@>V#pKreT-dexwrfy2xsw;@$7P=eQ{f0TBi)hIk3S4T-|vkHf_nTcX|+6;!+ z>!2%tG>q>rXkNP}i=KYJeiDc>P2@6W#vx~qH|vQ=yI5#+*-E`QB+UYI0*1e_KFFo| zlko6qWmefNKjC#Rki^B?>r2(D&*NrG_99%y;8v9=+B-ua}?+{SfL+&L^6msvT*~2aPW|X$=VjZV;)i4ohI}@K%-pcIMib%W! zjJQi;>1Ddp&o0ABzo5X--)6zsA4>K3JyDUN5X}NLQ_rIgjNui)liWnQQPaq0&69LO z$YMy2HbtWK#99y64fY0c`3oHhQ$B>2JaOu#e-?i;y9p!himsJ1dGh{_s!uXg-OCYyX-^6(l z@*T)`boou2L93glUOn7$>tTy_g(;8e341k`e`Ex(ica%<{^+AS z!U(&Q;oRVN?D^oWR|jld@5B3IpLeV}WgLB8d{bty#u4fl>E+QX60`EtcN@a2R1oAy zW}@Pc`O@HJw9SG^1k*^d&4tOGf39!N(%!9+QaV!5j*#C`ht726)5@K!;IGP*53);% zL=<6=%Pk4GUdh5u>AMo7fi>w$G>W+CD`H52)E;zOS)_*y>9?IJDkf63nG`i$9!Gl; z&EreHr%mF~q4}{R{wk~wRrh>()4vyAU~H-PJ@>}IUh9^{F2WK2>=29oV2x!Qo9&U~%obuS*LDUbE@#$-&k? zYKi{35ea6~?0A+qCv!U3zWVT{e0Nmmw0Rf%^OfH!$G7VCzaOqnTkCI%g#U^+bdt&=C3#Ur6JqX^N;tk zG>7;W?z0XtG?2cm>1dr z;(HEW&_axdtsly?0+|zql<)ZQ>fesy;$V__6jUd?!52x%mB`!&jM!7u+rpO1Rrs?& zSe-2ij(<#YA4pPPlDZWONrQBkNO$)l7ah__hm@2c z>Y^JKvFL7*?nW04E;`QS-QRxQ-@DJh^XpvK_s45a=VD%S&N0R_p17a;UV2Gs7X&Aa zQtN$MV_F>t2q5BkZ~b~U>`&KInJlD~OI>IP=e2u=KzQmLsa2>GYLrT!ddU?puA)_d zZtCIw<89NbS>{jEZ{N8Y`7^dU+ZPI)9Z!AFkWPG;yu2v7e zQHL*B5|{GrbB&422bpLp2T!lJm?lgOX#ka%N|5&V^gV$1S`J{LwmjbGAJ-}!qMa(X z4z+-wbqHBTZHzZ4Y798*dNBJeB+!(N~n&9(J9Y3Tbf<{a|B(LKx~2bCSLxf9_8W8~00zYP`K8i7z5tK`MqTEACm z9;M(tu(&McP2GEN-Oxh&RyD(;^l1-Ej}_7I7o_i4#bwi1BLV(d(boQVFlJG9e6yJk z{-3*wdr)vXikwD0L=`!^dhq>eaVaN;y$($lNQdsK2uhxx`~U27;er@jo9B6qaNyGc z8e%wx4!`G5w$hb_7I_{?L)HUQWfP|b+hdCjA-*u7Qfa}ZrYS4tSHh<^UN4ir%-X-y z+uskob{Xlq)SFT$zgms~`a6s;LN38vJE$c$6hE&>_6Jg*F}%7~udq7O3t16~xYaXo zI}E(yV#s#WK?X?<-kR6>jrn{Bc% zm)(ncV&qn5N|zTmJp1}!Nv(%ze`gdyO~XHfFB?Q^!-shD?#Z?~FCFT~rjjGmKqd@( zFRm^%j_5wOkaPrt*+gYf1Q;CgDt5?6RLuno(Fr%?Q-&!6lrSEz>GS7L^iGmnYjGcu z>D+bx1o(#61VN3+JMtyirMzQ32X!BBBex}8fI#1T>?2Cny){Xg&LUt3Vt(HmR6!1d zvBVfOP^(t^r|>V+Eh`>I1MCx$FkBLJufjMgLerqSf#<}=&f@h_B{w-bRP8X-;3?*c zcam>c8Do&puxVKLZ=-&UMs;46x2bg**DE06GOIusZ!b|X)Y26|8=q@M zBIHr$CEn2}*w^irPy?z|T$Y>AZ{c`#Z0Erv|gU@!lm|(l&zm{_2=4$BGYBVx8&ox%RtmF&)M~Bbbgk}i|jLurg^Y$$ORWtpQoGMh@ zlB>g8pM%AEWdus8_+d`x)x)P~2m3iU;gse0^$pg0jW|7Xv2|TmuAB7(kap`T9?j9_ zPWa?$m{ISXAJBWQ!}5?qh>w0E#JgNzeta;W=I0{iz)Y9_4JIPL@d>Vz^5c^Aoe3w$ zOEFQ5|IZ?M+sVt5WwvEI%VI*aDfJi{;!YR5c5 z5|*W$EZ@Y={O#Ft;?2fk6lhP~Y)v;|DqIto(VJV=CPVQ^^XK;AM!Vk4X99mEaMsC( zX|kICiSZr}EV%H+e^J8=ZXvLT7dgiB^+;jw*q2hITpP9jx}+HZj}>MXjk)S|`PjU9 z+*R9XISX27uAVI&wIS-C@fLO6c(#s9T%^|9k)I19DR@f?hQ90olF}Sq19Ry1i=|Zx6VpKQ7<0?<#b3&nLsO5U9f=7~h<$DG|G zSM9NnQXgV~yD~b!x3PqGR?nn`M8D=1h6tqsX00|F=+tI`!+H4{ThIaA8@HJo))Rur zNzuX%OcJc}MlVcosD?>o)>lNbLEd3oCTr+V3Ftg*BQ_S ztK(|`tVll9hr9Vx&VeLm+fwtNWj%?%`twZrM7~#z|MrCJ;$%Dd%x;ov+6DMt`QKEt zxylZ-Fc~KFZNoiuuH$L0`s+=xRNv)@_@;B>E6AJz3m9UbeYUL4vL>nvyTs0>n zsd@cA)qBSfJyU^%v1N(|1{A7){#u}zrebB&>~mlQn?Tt}=TM=R@L%u2p@_do+405J z$_Daf{jRat=D>mE=Mf^^3Cy^C{xZ9TODQcg9Y~li*5jq z*Q+8-I35Z(v~V0xy{=JRwEY<`t0rmcwLaI*U})FVPtNUuY?UjPn3E=~@Re`|V8e?H zk!Iz3CHv6!n!dzaEB}!&DGAR^0fvml%slo`#URee^Qn<+u{@9%DdvSJ4WBZa6CY8N zyIS%UooDXXveVsYp2~R zS%z;x&Rx|Fx)YUT@zCYg_gIxj-wQ0QlMBf?&>ap}EFbMe!*m>fJ%(3oJuIRpA+4Cv z&o%DkO@lxe^8K@Mzl>4>zZz1$?M3fRnU>7W~7fl-xa;~Ce&`KB| zcBr67A|=oFF;cK(b)fOm(ziWu2*&4$*o~O|HGl53GKBtxem54yGeMJg&Bp`9@R5&G7^{Hth8*Q^WXtRI5x1?V3KJgt zskc^2xuDQ*8U_;QB&<4eGI11^af^+X(YH*c=lyctXxh@elJS);WpLZ zauuGDb6dqQOqj;@)_(ODG)%6OhVtuKo*$Zi{9Rhg1X(CpWw*DBLv z92KKI(v|8OUU$;358zN`X8BOhOA;_!^##bX`NC9kgl*>@<|f-Oi<)V4mo7x9#g{+9 z1r{;D)rO~44`Pwe(4X>bQakfmp7nn6kb2ZEFwmTR>GFo1`0=mJNKnjE@^pWi-Zk>f z6a3VfE|_LsT=P@GM@ln9Sg&#_Q{~T8V+2|2S+vSxe|t}fUy8~+|0tHXU#n6fm7QI@ zh@i%tMurJ3me>O5U)cUZcb5Q@1Toym9^ZgA=fmL}DHWtpc_=w&iO)(jcHc5exl)O4 zyWQYawoDeiFs2Mn`73NK$o%|7KR_to-aMT(jqw}gv8C2`x{t_};SRJa`Gh zL_F@N#kSq=5CJl$Gr}R1zL_LAPrEbd58C(*4?OIayGjCY3`Y+v9Ix76Otf>18SIW0 z?d`HaafLnc_w5iGF_;_f6rX6~pN{~3FWIB1e442Cr(`m#u8+ce@Y#Ye(cgENR7(4i zw)DRzGqR}Yu^u1$werxm{_9$mO5Q#=8zmy{=h_ZSvJDo8<*osT{!tjuR4Dj}mx)r> zmIIF4NK6SY5losGn#k7cN*6woQdsX0aqJN$;={3bfk;rF$-YvuaO(}mdcXSeQ^MOp zLb!9e#2ZWuYNf0`nP@NFM{l}{?hZSVls|BNKYP(+5-PYx{>{!~;u3C_t!2!d$s_Qv zWT}GUx-^&&G_R%f(yXUfIo*^gG?M@>M}ulFkv(?+nQ3L$;9Vj~RR?z4nX}G_z;WMJ zd$acM=qn0S#rF2}cD{v*6iL-ENdHDf8$}uB(SQwM(zQ2z5@yUQet38gc-rq0I( zKp*bQg-)oWtz~crqWW3+trb-_y5~Ddyfi%uGkDmCwabw~^(uDE+J3sk%-}&{H}%wt zE1dd4Ufgy&Xm6faA)|nwpCnpXC*R~d7z;d@y=2^Ek~pVkSh=bfe=gT07f&XleihRg zFObwP4(Zf4g=`7Eizb)AUs!{+5oI#UWko1@ zYi$>_U8N=E0Vu@>sboyG1TmHMAnmrXWXe-{?DG-yoB}!YMbg$PIYB3!wH*VTMFbIR z+uPL&Z6wVFzG{iM4!)T=L^`>Vi8Dq2$XZ=in5U{)sJf-oa-Jp^_Xv|93hK~hJ+BBT zM_2;2B0vH8?P8ZOi^yb0obm%j$okB;aS>a>ueElIGO6r_W~@VKSdSwaCXP~Y9r)W8 zn>6jAG)x~R3V)>Ia9MZGM%wA9SVkk*A-bKytRuKVrn+ z7SyKRVjwUJ^G$n1D+;J>eZ2xS{1)+}Y2_fFb8Hd9FS%UcO=st?UY9zxORA+!ce!Dc z45g`13w;zswO1GOzx)tGCGbWejs0^6YeR`8Du1F&RkEq` zq0=6nvhI03^F-xJx8B3dIJvDTZxY9Mo`CY=j9;e^^}!qHbf?>+%yS44259aO$D zkGy@v{v#QP>V&w*oCQ|6(b<{Vn!~zUSmQJW>U6I!?i!A1!i`Vu*_CKl zrAhP|>809!nkyFTvGezqvK`9M@Kp*U$1TQ*#W}z{?2(n9eLSHES{f$f05@uQuZ9MOfIn3qao#N!1t0p zx64V(<;zrP&E+p#CDl-BK@F5xw14yl(iXso`Ee9(_^LexKOgEzQ8VZP4ZLF87ddo`Qyex z2|WxkXs+W7?_x?8MyFFLhw_Xs57z~m;4DP1BGHsGW8401sR?089vzD?SJj$c%P>ew zlWGSL<@yyfZEtQGN-f`vy0R2L)L}FlvrJHq=MtyG$3P$C94eG3mKP_zl3uAXB%@IC z^P{DX7%bc){CWLCDcwRl#b`*H&>X(d@wrny83L$83qBRa&;2Go^z4$!;Aj0WP%Gen zSI`zp(A?m>H=sLQ#Dcb;pi*L-T37|a*B--7!n?R?V&Z(O(bkFMJPfc3x-{y?sIc)l5h{I561( z*ly*;a!H;{)E~?gO5F8$`FF+DJA7YoVEPn8Ei@8o=POR-(;Jt4ZS^67<<{oLk0NPb zptTp&T`JkP&g~3na(%CO*WRPwUc@r8T(L^2J$=!Zvsu%HBga+U*H(7)gWX+l1WI@2#UI)3x6e~OMJntfJ05`+(bK9kTxflN7# zfhp;QzSMpTw4v;vKGSYe>lHzP2?6oml>D9`f_DdnMW`jY3E>2^oPh&5m_~fVm?vOU zbkLTR7_uGqP@0F#UZZ9>AwwH2qid(Mwo?p!93g9yRz?zwjwR5^{@Hz_1Kw@k=A~hy z`;6Du`H!7I^ge7jvW=+)Sr;z(wIYE#iosAC`*nxCMofaORH|Q{Z30C^wSojZLG3mm zHOYQ1@xb5+dvnw=Chji>yFl%m8Xo_z*+8i}hvtovQSsTplWnXWk0Z765P4#WnH>Mc z;&Hj0hu;Z^(K@i!hV)pWhD1-hUnrT(hE2AS=Ta+Vo9xwbWz3Iu-c*cXo(dHiorQXZ zXtw8WP6db>z0z?OFf1=I2Zf0kk!Wj@HNHJ z7T2LI73@tqGm2+qRhE8f-dj`5!j0S?lw-^ z_qjbrIauPQfz#YWkZ_+WKEo50oq;JTwwj?#!iXe9lqweLCnK5j0+x}R zL-26(a1ZhTB!q$)&QY5+$=w)7Hjn*VS(x&*FMP3``B)1VS?(1&9=gLEfYD{(0T8IZ zY4_05`8q$YdsJ1vLiO*F2Iz|Z+BCMI+PG9irLOEkbnHU3E zGkWr^c|hM;SLIjShV@aGw~;^YFePZ4drjrk0?1aVCV&{NS4i0YmrxUw@RRh-(gE3H z_*nqu3Fg1JHTQ7=#A;J#w&y)DX^=0#4tgoF+;u6P06n{vJpP{_$*r&hyr`|%W8RAQ z&j$s%vLMS>rAm1L2lbq}{~{n=*}wmZ(1N%2U%=qMIY9q9a0XbCM&iW(i+l4mvgtiB zXADJ%=HIB>e`%Ba^)D9q^nc&yU)M0`f%h_;S(D~ilpF^`^7H2uMjH81M2F2&CcQ>jn*LESox!jq;*UnkFhx7Ae$%3a32-68Ng?<81MG|F3YGr?TpHT*2Y$Cc z2G-UfdTsH;BUI1*gxr8zO}dA!B59MJKSsP#wXp{j8$aRI2Vde+3K&uFK^XgK6)7rw z^y~H$W=~QTM$1aCX*{3hAbw8=$(-)Hw}1#C-&XyiXnq?Tn+>3Dxe-Vjle=e`Jdc-}N&is7E?@#t_&X$ z5n8Nf4BN8TZ8c4KSJ_2|LEq?^ULL2q37D08Z>=Uy7!n%ad{N6Hu@V)t}=7qVG+4z&1 zzrT3NQvP%GTmKwHQr6-%CPB+0*qs4i-6l5rOi_OsN9{%*yay zW#Wp9O0QYwp!xI3)^Y{h&9_=GVzX;=;<{-fVOp;hq!%YvoXY^uJR;@#da(Q$G#TZ3 zIi!2x-h+Ih&emJG-jzh^YI(-FTw~efceQwy^yEgPYPXuBKrXMjXD+7BX1X!2>piv5 z%0;SL`LPFi2B&qR0e_%)l~q5TleX6n>sb$w0+q;VHLG6Z_yqc>e!dQYw~RCoR_N~- zU2MzwxJ5z{J@@_#0}=q=6zVM+h}O%lTc@{^BinLomCWO)BQ%}|G_>EmQ_ePQI+JhG z!a>FY2kwzVjG>c6qfssAgXO)9@@rCWu4^TF92c3zc7;sluKK>`GK7SCZj3K~9Zo-} zhUAL+PsL=4w6wfY@HwU4pUxMxA2EARd1m^<CB(2gX?LbUJJn9eTm!}NX08}b ziI_HX(Y~Qw~p4Ki;6t$>R z1nB(8TC#4Fb94M%n%xwb@Qg;)bWXrL{M+z>N;{=ZiJ-U7Fj0_B2(|>8N|rEV<|Ji- ze8`;DZN;?6*o791Rx$Ohs4+~-tkCyrkYh6`sT(WPP7sJ#_(cI36{TDEGAcp$w`;xe z-;8K3hJ-h@kYmm3U%6ltNZjc)yQf@xtt1?!wl`mnV-pyOO!F55YJ1` z0nl#CpYO_K=xPoYw8y_Fvq@uZ^G0{{{tgU@@XtqP{rG|PD2n~^ZOu-HfOTBSn>u%w z3{Ky?EFn)od>dk6_paNwdTOyiG2*L?P1_<(8Dey^@9BKqLF)Hhr9=Rf^`tP@%V1ri zm3M8w@YxTtyg0Pu1OoHe8J4_gn+fYE_DK7;zJrlV%c@z8c>yY8Y}BBz(rZT{Nj zx*YShpjx}PTAnkgGOxv(ZxPdsFK)K%llavobX&|~sWj3~T14hPS{vu*<7l1Nv!o`W zn{_2*3}7Bzco|vGHaeyei26?~PPq#0PuWN6hMIq0Zo0#$*6Crw=pg>8lKYH!lJKKG z+QWr_%0rdAA&n%l<>;ifN(+kXC*zI&9OMwtw2S5hsvxa||MiA0JRn=iX!@0O#^Z*%+L&)95w)d|k-^f|kz7+1_D5!sxD?%IYI5y^-UTAhVmS_G3W{0+Uk`|N6 zui@I7r4eP{7t+clb0t1kqbheR%%O1dYO%og8%bhUP^Mb$@h@S4+bhiV8-l+4{i%RT z%^FlV>4=ZSLXE?8rvsPeaFRNo^=W@I+Mu#XvP}ybMgd49qA$8pJa}g720gAXD#dtU znd0Elw5Qjj*I7@u$YVycg~~A;vK9V~1;}JB-uziKAJAHX9awu3R@u+r1Q}WT- zJI_|ym-mdf(&=)E6nj5?^Rc0;2=HF>mH+`3Z7thai0IMPi;N;x<_~On=6hc#f$TSb z55Mx6h20N6x_mL3yFwl(1KFI3+g;Y6o;>}`*K+gN$27kI$epBfRmL#?Z`z6yjp8DU zVStPBnb~KIn-$ePYqxEVz9Q@d3^SL%~IP**-|X)M6zCeFp6?yXC^)sMsPMDB4u zKVt4iwM!>k{I&F6l@?Pvat3=9AL9SZ|2r~it&L7=Z$hBJCsWOPA6Sm8_ z8c4aslaz+1Nw6m*(0gzJHV%oW#-5y zl47rrsgY^XqGd5&>##hTz@xp8XFD`62rS2K3AJHyU&YuFWGzeWtD7FZm@z_x@jl8V z2r3J*zjX5-jY+?)VjOmizxiG4zQe2I<7rPHUzF}NQ}USyqA!`_eJOt;L~>N|20%C5 zJS-L@)Zw+CRQ~wWtz80V$G%C$zrgqaSH@<28I!OpnT+{dok=y5emX@PK-u_9_^Y*! zwCqS^0g5M|PM%Cunj!~1{ zo8>nt>$UoAqq}^WAMNMXY!xOi+rWBxrpCLEZaU z<2yysPLp=4vyaGiDGk9kAVf|>tR>zW^fR2-t^atkF|k_qN?m0606%mYbh(59)+w*# z9Fyg9Dd}?2Z&`lvdGcn#I7SflMH2GV)u+Y=rW|rgZD<7AHdikvOrU0 z#VUC@(%r_B1Dk%M6UM!w9e4_b+V24XN9-hJ@1}a|NhqnkbNfS+P9K8Qz{kFeun}2U zCFj&{(}&QA-2+M8B6y$G*`4Oi3cuEcZn({!t&3NCzYACnJha)1*c)mN4#vp^ zx_J0HXuR3Rf6jzO%CBdiB)T= zSf0`ElJ$Ch0tweEKsKEKJgu+bZ+ zC8#smPA%SJ@V$!`4$ZuuK$`V+cs#18W;l7E?O=N$K62#jc%NK>lL$YZZy(F`W~6o| zokAZ?EAxaxb^15xE@3@KT`#Ip9d8UyS(9|xt`Ciz^*Tx^(I_JLdst*{){lO~kcPr? z_m-+hb&kG|mI(OD-LW&VVpuRSP*Rd~ z=al*ZOJWF7*g;k=}#r19UBXnrMI<>>(lz_1kSwj!dOyxhjJ zZxdJfxD_%Ihq@B}UFq+8DBE+)AB>8MOH-jv3{39C*f;nuwEg&`UaiuO4X*u&OGTjz z@jMWjaCmGY*{2DyKku9;c5?Ucbwe{(FNc^?oN`dpJ)~Viirr}?1=#I?$-;VkyM@Uy z1!S{!{AwsmmVPE{wQotL(S*2nmStjUR{%ZdXGZH}l(t$FXGFwy&)WDqdkRyWkXubhI=&Vo zzz?Ryhs6HKdc01!w<8ZWNj`(bh5;%v{Ma$F9weC1r5OpZqeS;8<8ntE=p5>7ZU4Av(CZ%+hQg$Z1HG66-XpPk)3&yN-x^RwmS zL*&-1Ncq`P@CXycpL3`wa<_am@$7y0jA1iaZTWLqx3gP)Jmqhv8aKM>GdU749`G)= zl6WFNudXSMx!Znh-kdQn<9`Odm#ASgn^9jdSgusJ2>Y7u#>0w~_X6XrLVp6*Q=}hw z#;594c}fU3+Wx#W^LS^jGQ-Je_Hd6xw_tDbvtqGa*}>6zH?}R6WX##V*n(G58+VUU zb5EsyCVxZw$;Qg+=a$gG^F;?_+aZyK#l*F^R38kr z_R+r4IU&?x9Lw6AD!Zoq6X&AdtJp~0K>?zWV)nH@Q%%;-pvp)Nns508BxWo}WFQ>V z2-anwmzVYhb}c|Di9@Bu+vU>f8fD=sH-?7I9xAvWmhNOxBJ&meq41*;ZeWC>*Gq}T z;+A#;l(VqnGqpv(cRO4Lk_4SpauE7_i^9i-ul4BN9!C8Mw$+ zupAai6sIyG(7D#%v+V}x^4cla_prVwNeD2!33)dN^brxQJ-}wTMCXE;OKz^aXiVbp z)mfFtp9j>#=;|m(%@=zwamu=WShJ0F`Rysag6k8*M@}V&{9fM76yX_6CyKN<4qhT3 zg)`{mE6Y8`$iu}$!Qgor1QmgR;Iun@6N$19ByOr2H9WPV*~mJxsXzyEb6#@N+HWxt zUj_)xvDg=1XfW_0u9QwN{nW0gwSl^#hl8jIE902MCS~iQk7SHs$zbhLDTAt5_LSGS z(p13rDqX|m_%`mqvbB|qG@ZTOA|oT*y2M28`%_sw7nXn~TT#4o<>#6!2( zkR?*~^94F%QCCS>5cZGLe_S`5p&!9lpZuK%JLA01oKW0Zg$lAqLr*J-zENVE#gKj1 zd?{*gP*AGlK!t)7&LDd;NfGDedGF}mzA_YB4;%Ukw0Uz*AuQwxDP8RSb8vKFiM&+u zaG-kxd&`%Z%Eb1OmIV;{RZO?RWaDydO0FxI)`)a~XFr0hGmVVR9McYMNpRix=>v(X z^CaO0UIJF5L!NiFg0iPWEs_;^NG@JCmv=mFeuBy3%dX3aDoCfY(AdS)_G}a}n+ews zbI!X0tV+S!qI0ftpXxB;4sU_G33{;2^igj4RrZ%r>z&H5Ir3eYJcK#pdN zo;4?ua%e3N-c_O>e7+VuW!-@RqFmsYt!73Y{F7Z2N%DL$_F931emw+eC#QPKB@yMG zbUYZ8ic`-xkA8J!P{d8Z+@jxkKfA8wyHoj-A_iy`KHrYS<IGZcYL^kHo+2P-2%|!9JOIV#id!!1juZ1Lr(BKjHK3X!4d;xM&5iK+d zw8wVnR|k>)z3IQVYgd~|F2gb*UE8xOra?G7<e!vFEL~lsgJ2n27@Ku}aJBjSpJD2|Nlz9o(A8Y=%hMO9s8t?CuKL@YL?$yUW_n2t@{iy$OAd&6=56$_% zPCFt2R!uVAhs6?qM)L1x1l|+n?~^|V_%eX+&e~YF+i~+LfyQA z`OgFY@rCn7ME{)pdE@^tRgM1}qW>GB|64`(Yw7QA7pizJD*AHt3mo=%o+M?=~f7p?;7l2X1r@RHy44Y%CovsKt zuQ!(?1yCx{iqwYsN8AA^T<>poYz_Gm{^w)2Ndj&?@A$5c2f^cc8lK+2zsqj?uw7?V z*`28`clBHyxVu`u+knj>ES6ht-W+tEeHowM3@JnFx=D}k$yhgL(UZ#YW%q4!1B#_= zq$9=&zklT>a(!9GxD*xsFD1#W`ud%l6koLurAJ zuw{aFqkjaDS$Ox?z*=03Xtc_#B0g;vJxk=!&sBM$aby;qoxB(m{03@ODEJiUC5Z;S_0 zy}4H!z6><8eN)L!z1I`2FWU=g!NdD6HA*Z*=1-Jon(roWDk`rpcbrpm~|J=JJoRR9AjSf}o2WQRfu0Idpcj z*wZ^u2*a{ukoo{_TLSw!%0$ig-|=^O6?TrB)~~QYl z#{b#_q0<=G-@<%W^PL8Q1(Kb7Gi&S?)mw~O+o5qB#)6~JD1FPd0$YG6LR9`E>w6yC zx1(ogApp;Ce)ph7b>qO@QEzS%n?A{l1djN}FW!uKKI*#55xHWJj@o$Bx^%_m&_xC= zy}M@sVwA=rO*pgDivF1);Cz@+IH>V!Tp@+oNj`NbV~7`zT96gygLiE$ znb!y?pQ}E^r2v`16D{_E0(X+T>erNsLJfI9q#kw3Q)fc`60rwj9p$zf;k^URtc1vM z?gM{2wnLj3`kp3bNu(*=9O!@5Uo6p~*RKO5>-g+Z2~^3yCoGr$8uQC=9+d_|IkTR( za=~_7_=)2@&lz>S+ctl|+d zc!1hq8WpI2eAJ>nm~pF_W>IKh<|uiy>EP8M%K&+=zfNnR!98WjV48kW%SoL8d-{%G znBbgEQXS%Gy*0Crwa8_M19skAetT=M9AX(NIGWC@ic7`+Jg|5$pz+)IKymrw)M-VM zroEd?zCT{cUuXpk4&*!AJR<<2cMPOF>$7dnX#8U#(zeTGU*y@XNOwlCsIGol7wXqn zX5FmEQ^Kc8Y*CD>DrJ=Q2DXNmDUq=19WVlX3$<#KnvI*nFEpHL7dW(5rYtKo%Z+z=oGW+-!@DMg|q4lPN%iuzMp4O&0zmNsbLy4g?86^*>r&2ft$q$&=el` z_tMAc_xS`At zLcf1KSi6HtzEO(2-x>bbopy*-O*cGn#|ffl(_$t3O~cU zk00lJ_Oy)^=RF9tEIvpvKhD+I;bbiaI1*E2Y2H&^85FwW1nC4mom?MREFG0kVj$F6 zN^HhK4!oX8WHMSHgs1lT6`Kjn0^;*A8pSWAxI<6#(YRx6SdM(Whj{`umr9MK?O@uA zk=q`6-)`)Jq-BoTv*(uRCQi1zXS*gne@!W})kY}!H+t?sQW59?YszCj3^0btpfXMB zj!SL~&uG(aX6$&CCi=-TeFWZzE_p)56wf8@+@O$1=_=kxF9#ckxn@lo`GnUbL%F7} z2(m0YdkzY`qdm4pVZLBQchB_r?yhg(xjG;w$1eF0k&!_hA&I32Ww)4%+(@fJ0+uXD&=|U%Ppx_zhGI$$U{(Kc8W8 z!`IDPmG^G%F}(HpnF;x1;e20>(433OUC!6|mTQKm&iQwdtBYp3a9X@S zbzfkr2VKPh&VGV&96uuQvuNsI8i%YPO6qbj+KIdncs<-+z~J+srq}kvCs_6`x~N32 zCLyMVg=#G^su22L^VWk~87HwAj+0B!l+Pswm1@bIh6#YWd`2LBvM)+(n5SaQRt==} zQsIePTq_y)8_-hX(K95#<#0~swzMW)9rF`lYWOhpQACxGijdM2>i}7&M;#yQ-9g1? zDgjreqPMXX9jatvdWI*t%|Yy_HRZ?vvM1exeE(&?YXoCxzo*(}&|6daIjMo7@I>Z@pPTYTpOiMUv15e>yJC zT*&izjN3k!OdHu_P=-G<$juG>$BqOQyN@2mMk>tK=hrFuKuM1Co_+6$p7~pE4`%9@ zZf9>s^V-KMLN)0EO3fNvBwu&(E>=Orj-;3~UNLr{QEw(!CQrN(?!G=7?{;GdxCW9w z=1qJ7P5qvaM!eZ&wTOBj4T>tf#Q+Oy%pPmT*z7M9#`gG-axGhl`E5Yj)|Nj7P!pYr zdKyVNG~Ha3722O?a9a;AuUg@Hy48=@FPrE>Z3-(7RWk)uv;r%&1mR~3tGIZ0$if^0 z-#_}l^Zpt~71sg>(~E?NoH z5~sD9&MUsKz6%ghDrp2XnmYPgOwBlllNhTXGk-8XE))tJO6N2bIFA3v#(BmBtm8}v zZH!qq{W|&HkwxVN?vgc@)X}t2?SMSY#fRy|UzIau2yKNMH0eA{*~0WMBEa@np+0&y z!gCw)v{!MIVy00s)O`Kd^MvqFP93m)WpW;qc8+=7r)YvD`Uk;%Jvy**NZnyTg1Y4(;UUmnQ&!OQ{BMbvII%|0PkqOZuTUG%eQHymeK z;Utw{S>Yfr4;78)8tD0uw5&1fW?pR8`MTV^Txg1V*V7@EyCcwv`bg&=q31pxkQJcW zi$OJ$gFZa^@IvEZti}lKuNYvVLnz&)rj8h+tp;Bx2WTlLf69AAJ7rvDJqSO;O_dfQ z%LBDyyn1M2Nc$Nf2>6c4i~$WyR#&FWw{ra(S!D;#r8)ef9i`OW!wBlYT)x1>M`Zj% z(8kts30MS^pkmH7X9h35*@?+W78;jLA4atR(zM@>?_N7D`Aas9vMSTCP$wdut*iRw zxJ)J20!*ZTV*!3gqRCd8O||=ty)ze|(YK%zJOthHr3>DpzP{ zsWwF3E4)fI%mv_JjM1-4k*7ARO1F}eMTU|Z_c8ikxpPmcL1AZFibA(>{B~VB=qwYf zML3+%Z#1hb^~?6PN_gP4UaLyUF~d2CMM5}&k|*t;-jOeuBGnf|@o}KU&F*ZqjF*`k z@*2(ipS!v%F0>d%k98J`wTm5YDLV*f=M!t2)j#7g-c+kzeG&5NlWX7JD%t6T`5txX zGVKTq>^QxBse97y{EkUSQhdtSqE)s*H;-l)oZY{X&|Fp#z~z({AX5ele`V0<-fvN2 zT-Jb=@U6{O9WRw&E?;rl$ki}!GvEU4h5nZEiC?jHVBr!4!4jGr9G&A4$^UW@0W%x| zm|^_AN7~y{jzXCwJJ0cLIC(qyS?8bkftJb~6_bDBpy`g!*X&t@f|{W&j43^4v=dHQ zk_%5Hg+*h-b>Ki>LRC##v6?2`r$lG=rk(=&7nEEjpLKGTPPQ*a-DjSIGjq3n$A>bw zDOgGYv^`2DkG*+|EGPwYT_(c;t`(GqG$Px+y-COr$su;@)z(#KJ)9&Tjzhij5wR#p zyR3Y-(%I9pqsw_aMN4NyAoDKR!tq??s_@6RN#ffm+lYV9kX%2mSSn$!^YEPDgSO6Y z+U~s*hjuOr8UNqp7QUm9~Ugr4~?|wISK9DC8ZCqWtM){N7xlaVO!4v^VMPFSv z-^eO*fE-#qY=zspl*ffawA7MAj+xK@(!qQ)91@PefcQnCb4pfG4lzVc=; zov#9CUa(SNaa957WxYcfSO*MrPrGf8$OnQgd&4_{mOSMwfwf^2Oa!B%*h%-CzWj0) zFOigL9$0p#^qTDi`oFlkf@bVLvxu{#B;_p4qN>clHMlcSkd zFP*KZSuRn-J8cB&j-#XP_G=oBsui-CtwvSpZ~eC&m+2cZ!PjJu=%G#P(a3|T<-h&K zsB^z`ZX-VOI{q9iqP5W8H2sGSy>kIf#*V)WD?v()sda!fk$h`cDkx0V^K5?)O)?FzQ=(% zLbNZMu7?eJy+?)(NK^g1)ETNQkMZi*fnk~QuOWEFRMF7+k5r%Y9gsI{y_?HYRr-?= z`=4jU@3~L)L0xos|MwjJ%bSP?z{fY!TYhH$eeER^knQVqp^ ze^3qo{!!?CdEq69N-Or?>Ab&lmMgdP0Ojsotw3)2e_f-C!31_~m-Py}e|%!#^o$m` zq4?jE`F=j% z0J-0rTYEQA&i}ghnhc-`##`?(o&1NT1WxzGfLop!XUfhJZ67dHt=nu2iX`e-=(j#^ zLgSG7=dhen-@j8?|L6UnZGV>IP7Z=;%CoS(_hR(7S3~EJCiL?E{u3ZhL0pw~OL{H& zw?^^g&>auA^gXjwW;?dr4!oN>)ksulk$S^ODBuw#A%fZ^{NbM;8FUXDl=ueqlHNEx zcxsyz)#d#%l*nmy%q>ld$^XSMNIWru*0pskl=tZcccgH}E(vJE)ox_!De3Q9&6DV^ z$lC)X@;6Z*d_>olQ{|it-Y{q>B`%#D#Hiivony`hu2gIc->6C>3k$|IdF*`@zETpL z2Ke~@lg&7Rwog4eRa*o3UTZTXBCaobbQ?p6#(vuI!|zd1M)~BQ`x=iQmy432)vqvu z65H}RdpFj)TNyNZtU*T#^>@FW)2naKTJQSPj2#oU-K>)Da~(iXmi+TFzwgsJQ<1{k zdU^g)0rl=(qlS^apQ@fA!vGYfFVS2~afC{jLA^uvz>9c)%fRK=xa9?W$B8j;i4^Qe zTxoNQs9(N!yf)vzeX&{SZoAJP?+jgSI3cyTI$b<|J%m1V`K)M~QvE0j_iWj`c+Enn)uVadz!neH*musrppRSGmt+Gik<&%r%DFZP- zHb!&{0s>0!rJ_mLRzd;=-GU4nT%`e4xMNuHK(rM0D&3R#>se;Kc~ zFRsXU-@63=8u$P7m_<*{weZz->>qPo^Gt)U7s|sEJo7PQ`)545E;ea zKM8~aINy$aQO;I~YSB}xvQlxn^?0@eKXnF(^_W_JJv|PY)07N2)fYjc3_BrZOA8R0 z&%D_EmK#XS`T>B_^Ezy^#w0i5%%uzP1FYB<*995JZ77@tcAKtWN76rYe+|?lWNh?y zAymjz0w{wQew3O}#Zk;@bbv=1CU4z1at?M?^MuW>M*KI=h~P`xZ@8?y=DkBT1yke=ft z3YmOY4UWf5o>wy}ix1_l&yO|$?r6rd!3K~mj6idAEvsBo*E~WG-5Qt(*H?R9Kv1mL zyhfKOyB7J#S9K!~UCKnaTukfk&NA^=YzXxAW16a+XNk?sL-BEh?@3v(ICfoMU?8-< zNa>}u9QAtqkd_Hx8s7yco)YYEi4R?VVti`fw6Nq8<^$$Pbmud+$P*oexnIK?ZEi2p zmJ1Z)#kt&HYXdC{9g>~Jc;RzptIsF2%Z#3}Xcb+>V+{kiS{WY(3Vp2G4T)@$Mjm=r7oQF=La2fMLnPYVhzwog|jl z&8o;oNib$aL&yKa-dhE<6>i(Yg%)q|BE?+`6e$kHixe&HR*GxzK#RM(7Y*(Z+@W|2 z!6kS~aCf-rzGv^dk39Yl|HFC8L$Z=@WqseYG3J=wpU13ofsaLQyLl-kcMS*`b=gI? z{kI4LViKZai%o{9_RctTyl>h3^$%5?dtX+vm&_J45Q(cv8`VB`bjxe`0 znmU)Zk1l-F-5Z7-ANn0}Yia^geU%HLlJWC!q#)?3|2A|FSgTk#${zpFC8IOpqebMU zCW>x4&bg{#@yRMa`c5W8negVO0lluAc(jUWpOx0}{I`xvBZzpIT|Gb5ftGOk$?=S_ z>YX}$ZtLJ2dm-sUY}mPG`IUFH@MOGfaMPR4Q;|LFo?KNAy{W(t%n0eyggGM?>V>+; zwy$>xt=-KSBWkGPX#vNU)ucXc*S)tv0=+W*fH9ke0jt`Vaa}tDHkE%+%Q2SYAN!i@Vc>Y%c@QzccH%mYZ42~-_`^2 z*l_o{!vrcJH^@HXxY6g<=CmfWAqwJuX|ivjM}*+KqB&Ub0E_#+jtl&plvH4guC$Qz z1ko2k(hNqWnvKJTf*T_UgH~&1|wub?mw`LZmhHiYe6zXy${wL*`ej zta3944)J+SR1dTx`SB-S$(Ibw1Kt^)9-jw{vD3kL?kCq8IkKS7ePJ8@9*>* zZT!3JQ`?`6UQdS}tKXk3d!1eV6=>GRge8uVt_VLpvrjd%IS3|msx>EPFYnJ|HWy^v^t2{qmhM7&mfdx^pjdsyt#n5f?;m#ivh9Qbj$112}k^gFhD z@>G47$E1*uBTmjRs|(>z9$2MNuc5(v2<~`}zEbg|9`%t{CCPB*Zx%?URqw?#f{MRA zn(|T?(bY(5bkOnTfPWA`<|^O0%=xk5&+jd8jE6rF06Y-*+Q7xUY}8D-(LL~W`wQe~ zR}r?H`mgc#jQu-t-jWvM2@*!rkHKQm+;05>JcF(llk8Y-?7pRdHn*EPk+O&F@wv!V zTuQTX-TAHVc`^5WVz1lX26Y4{T0Z_BN&@<@Ik!-~HqwdcGvV2(egtZ|d^Kh+H|H4? zH^NQhJihn2JWMT=Cn&#WE;4rlPv(nx^l%C{m}DLbQdMzyVV>iuZ!>0-My8zTuBCEi*kHBf!4%+S@QLyWq7Oiq$z+8~V+rK})wYy4XOaV;zTd>oLXlHP_KzFNh zi&e_SMB$ZQUbu)Z%xN{KuOC|0f3RtxmaY8uLd zs0|$4Zc1y}5$qOiw16>9tbA`Tp2Cx;aPfv-t=}bj8%U_emQm15;F)9N#k$%Ot0Dae zXq#4gePKf?XZ9XkFJ2Im_`{|rBroT&@h5tt){&axBg@0vNCz=W5+dh^8DUMQaz3Cn zSv+AY&9~@){kJl$T7+I2bNBYe;aMU~rzhe^u6EQSE23Jr<_-$7{d1z(A zv1qIQ_GzFORM-F){!O)5o>$g$KWG;jDM_1n8qxG%%c!KYnd09mE7a_0v!Q_CKgTzC z?YRS4iuv+y`;SU2$~cn#Ha~Diq&ncj!&u0~yaQT~I<1L1a;x>q6QR1+rC7Y|AcW{H z?QV{eJv=h}-28Qz&Ii%-_mW(TSUH<_2W?S0(++0R!c`cG1O{ho`Dj1X3!RMWzYaMf z#vkzIHw8J+o45q;8ARJSrU%#8uUTTo$G*Z1J9~~6`xBw#U-T*RR`zQj1t~ISBDc}C zu%<X0x9bG$$}a)NnR2bT zuE$%&!B1JGRYrnE;MU~LZElCDm-RZqUk8y%0imjLz#8h^-&Ua3r!N}LIa2;lGQVQs zkTRR)qS|MHcf2n+iN@yfWd8(QAZK!Ur8v0t^K;Tc0CPFO)3Q~xT9^)(9YUaX-$ws% z{?fboU|y~!&0l$CsDor_vJEsDmdb8a_=giLE>M8eOFG86ZMw;3snZ(EQ$Z4_Yw}M+NN1H@nQgQi-Sh{q*3)XQn zlX#zpQ0B`MC?TUw!Q!pjQ~`N>ChjJ7b486jQ8j>e47O|g6y(M}T0}ViR(a^(WX}7y z!10s2Dyf}=f{b3zWc9|2<>l=|%LC6oSg-tOcAMi0bn$2NNaKlwB!hc2`ObtqbS9bm zX+B+v3+ThnClN8IdCA8-!?Sa8dbjn$2st*v>yZOffQ|8f?>ikdXV_;0!X~-w(J?5fgUey1o+*ExRkN;;Zh8OgXwNf-lz#wk)9_+{L&@{8Xs)oH zRevODVd^5$<8sAErPQ-mtxl@tfVbVbC6VA*N$@NxajTrO%bC09l9kOVhFe=T#-Yf{ zxG$^)ml5t^9X5%@*>O0_f*EuNpg^F#>aYdrF!YEQ6Ut6_*0W?6#3 z@sF7uFRN3b7Y{_AAltm3=SLSk4wrfD&Pof*jjKg9o8-H; zUt*FHZEj!jShTtQ?{FwLUy3t(5dp6{63s zd6ku;mSFrz&?ry|$u5J9sH3RnRui!__4bfW)eps3;?gPw;obscV;z&39Py3ZAjbkK zLNDpcJr9=f5Rg=!xccaO=j|j{$a6yV7+b;FgEH@{YahB~rBvqY2cE_Z#}d@#>KU7( zaBosRZ`qbkwD4OtDkA1rt8=ZYQ_x!jBvK~DI}qCE^*sAlCR}`_`#aON$cEB7R$Mjd zhcsoIVeR1O?{+&2!#`QoOZ-A$dXjyN$A30)2Y2d}D*3zaZ_5cteAi7Rsr$W02GMFA zXTjax$`}r`@<((gc@+E89hLP#YLq_Y(I=5He?oD%&C1+0N4by%QSj$wG5(I!Suvdf zdofv0{TWf3VhNfxvyne_n2?~yyN@7#f;AHx`x#Q}0=*kX?Lcuh)iV!&HYc-^eVn>D z(zn=f%JZLnKhF44c7yR6TkPjvSdS?8$*-@cS87O^mzxpyDV=0dYLvhOdaK~7ivG2p z&|IfCTI@H3L3F%XV2r`_Zc`FIj`hnQEX9s-q$Bt<#hi2fm^#8V@Xe%O*i_4g3ZUS0 zZujNrx`i(c5J}B(3Vd=ndTi%6ijlCC2$VNREk|P>dKMosLP>k^(5NLpAet2li}h-b z7xOCP%2VF3$(c^@IKV(K2Rt@&_nJ5>*>VC>X}sw4F2RUcF(A$PL1AoWuM`by{;|E@ox z^{1%x(AG~hFQ`94z(&UrCK{xUhC;cD5aX1ZE3IQ!f>;wU>?@=<5N``HI-kA!mwgNB z_EtwWHH!)K0@v_QPLY%Mp#oefS#i&b-?j;G2g6>V^h(ieedqfw+27V@Hg2){P0)(2 zKdttAmRjpMNyQyJJ-syms^WSG>ByHI)ChEx0=+>L z&1c7F(%HZspStTyYPKJ~CFf+kgW2VNs}hX0ymZ<@imIKalzbh?~9M9??W)}E*Ar3!@ z{}@DjW2gFM)7R2rOA^v|MjQ*8DpLHiCGFx}@vHO3sr=ZFBB^$I1k-vFeB2(ENKmhw z^y&{99bE9```KM4hzzhb0U8SF^-E?wK($`|!J^RLGFY*0{q*^AOk}3XmR8`9Fcbvk z^4Xq0xa5z#KiB_0L&1ML?Hzs(y2!0gIpl$C-n|&F4#I!dn}elRf`WU6ryZ6BGTLdB zjU+D}p2%cXDH8(cJ@mL6U4`l0&IJ4ENi$m*M0w*j@k*~a$~JPe{c1UN@;v-ec;$we zOe=6qZD{Ow(O4f>&$50Qx*ZUWGtQ>>)i@yYK!`SdpThF<=} zy-<_#`BFDN?fCvzUgY{c3KbDpcvpD6_e@3PB5S(vHb9szWktv)n5wv!uUE51>^8ui z(w5S}&(H^3Yt)6`$tS$1kA-1FGT=f6 zc!f`eQDoi;!g;fge+Wcnm| zBjq_08%bO~0Ejv7-;1j+9jx3Pg)`r<5=vO>r0V-XK=aiBLy%%+Q!=i@XTD z(&0j4gP|KS@0VInl!7}87qok&MN>ru!er7wOpPm>1byKT>`oby6>c+m{F`4OI6^zGQ!q8ITvvJb4TnU2r&6*^T))X9VNPgRA~36iB$#5> z#b5wPv%5zN0G32Yu}!+tjr5>Vov`vkWe6R=Jfws zL5YdVJAq5UZl;rDH20(yrXSThf;EL02GsK!`xkWdYw@89g~Yfl#M!ua2oB*{mZR8je=2W%Cj|+g>=nIOuIJm?IFbZzH?7FV2((k9b${zI-)_)gD~ntu z;Xwjd(W_A#gfs(1$`5*~F=H{-*iQemjZk zY#|yKc`_QagfY00u^9ernyUHN_Zt)fvqN; z-EyA46Y%HP4%JbNiT~!T;AF6Ke}oK~Rw{^K=euGhrw+I$TLf2rkAMDAWyUfmj*=a? znlN;<|9Z$;3<1DuYYLKPv3U;h&b6e>=I8JZxl$x*G8(Mm$iIX4WHJW$D65m*yr4(X z-l@w7+_=SN3&%n z@NzAUSVrj;c$a%yvK#nuQ1n>hdX5y)iW>8(=4tKs zgr4szRDMi^<37awO{!Pdt}CwjgUrW>sU#_Hr}3?;wW~UycsPje#W&$Mr^!S2xsP$Y zICG3)LZQt^a`@QR;oiq>Q7DDqYE@|AxcpVrXBf{*L&r9@$hr?=B()5K^m>_V#^{vJ z)g^)o-N3Fs{J#tPcto!Hh%O9*q*WlH<#+iWEU_cEl=Od()x7Lc{zT8gQOUN)3k*VB zu>w2tn_!XH-v%$GZq1X~!iG)lZeNlVN!oDo6HlQ-Je6uDQOu{rpEhh$jZJDM%n2PA z%piflk-t9hrtoC2gP?~O(Sq+ggh?d>sbwa>=d$>a8dWYNNO=4xVDbbspA!U*g@Wpv zXnNEJj&!%~sZld}DSzu$b_BKKawj$T1zyx?^Vu)x3VD1z6k+i_xtnOS*_Oe;&0;f> zAdrKc=p8$(%Dalpy$gS_b0of_2uWQ0cmatHCCtI~-+j8N$#L>=VSt-nsrZX|<|{wM zDT{Q3k%?XHPty)dFS>@Ra_1@~l0cel4k{~+xO5hD#G$@zKXs3QJp_@iiO1Q6uB@e; z)|bhAGKeqEL7eCy9&m8D5ct~-X~{#jwN5V0mux;cj%2=15Jg+{ZpJr$zpFIqi2XlF z2u2p=ZUyN44$qZ!zn~0@b8+EWLn3YD&rc#1cg{$7GAj4<*ph zO92viXQle@8Lx(Sgq@-KFvx|XuF}8mV_~h)WQdb@^BbyK1?_!SmpX4g_iKG5;CS?# zyMnpqPuhrbEC^bja!!=t8`F9@*I(P8p8H#W>s7Qqj12MHMZPMH2{=>t?`HUF`R4`@ zf0-d|iZ8({|5DxBZkb$U`4S`Ufkf3qjZfa%iir@z;*(48VCZPP!ZC5VkKfzMKxub1 znGU+_y{B3Dc+|F7soUILsq>8R<2)UAx*&~2|8^W{T0a}TqtsWXQnfevIp<=LkGkVc zzGZqGg4D!sZzY`YL}ibD?l`?90C4jV5WMJN)B--<nP4kCSEp zz*m+Hd*Qu2BoO9&g&jiScEt0!@^WB>-*@(p0J*@{G%ldR%~RfFUFw9(Z)4p1ny^2Q z2@kNis57Sk zvMH6ogFPGW?MW9!-Jq86!e;S%GUq<)a2q-SSRKDP1xL;5aeej^yBC=LA7?a}1c%D3 zPVF3*KOBqI2wkn0`2@;L>8{234gMxT3j9(h@fXHAqeHgbdYXmWkOH52at8R*<|TQ9 zi$*TAzNVN*i$00g@7DU2<)30Ne%zmlvyLPhTy(>6D(B~EdS5AL%ad+xqt1<4kKN~P zWcOM73D+qYNL%FU@Bjv-@>#NfFp;gM$W?e4`Bz**Tkj9!FZ{fqCBEU_>SU!S2$;`aMIeB2Kn&)N9xEM*h_VS9v$>6P=6Ctg3anrNgkF`&n+v3>OU6#y_ZR zBM|h8y9o2vedWE&L}TJ()xPkMC`zE*r1MpT&Bh8wo6rB|<{} z5zV^J<~7jYICyEo*G$nTNHnP7%v2fHIY<+lTgvU-PN|$~W{DNj*{Y=Y&9}=6TO?@$ zUag6lB5F8Ca}s|YXB?JVY$AcS;5~o0IEk9dyFUi;T8>%h&ai=G63z#W@Rkre<vWvY`5_rBhj)Tv9KkzBa!0%x zi59-M@>8elPP`e}5{NWTb<(J_cn_e)B{M(|SA*TY+6ejWO;yg3Y8{5~rE&B*3m=0s zVGtQm8a`8n2>2E4v9#f&ELrZ9g{wswj7v)3BK@~~0H20A)^AWb#b_geDMX(kFk9|A zJ)cPKg-_L<}mOtcEJ^@N6<=_vlHpbATFN^?V~LuOqJ=u2BpG!%ELn=Dboi{Zkehw;X2 zS*YZoMGvBTWv+Q`MzsZRT?0r#U{~xPg?#W_O@&`sNmvs^y^YrIGF4J*{ngbBppxb4 z3kb4|Amd=}e=j+K!MR{?C7qNURANB~M_=*)^(Nk}pB#VW8QL6tF{)nT@SH;aO8!|r z1@8_11+V=U>8WB(iRsLU7J`T%l`~idNbbOHb|nOkZBnaQMP>YHT{C#uS`@kzhd8XI z6zRF?ip-zUDNgxQj}0e8H(-L|KX?3-jL-)8J4&>d{}z@Cfx(XzEcwbS&i0dk+**I|^qKEqNv%)4c2c8!7JV&|9g)Ghac_Z%s2uAD^MacFKiUk_$il$qLoRi|>HUTf#pnGPvt83ck8 zJ-6E?%$G`nR#;4(Do50>IXu>H?atL=x9j|RUKjw~uQX@#{jl0M772aPxN#}_z=D+g zj0=+AT(XU=b7F1jOi`F^e7}CmxSbN~(?#l3yF=~el;_sxZDBnX`o#-Vjti6Qra@V+ z#ZGu-7Bb8dZ|@i;T!P4Xh+_F}3{10XZ>sJZfyF;w-fO%T*ZCcYvYn@GblXLMEpzzd zXnP1sQ(@sdX?dh1oFacFqQ3-u7}MRcg+#xxUg~z;M_Rb-DSW?mn!Q$!dxL@)^JWxl zbn|IyIM_zlak|cQM@{^wy@zf5YCbZR!!QG5IMSQRrVCrFnb9(MCYfN`y^P9}MbEJ8u#x%B`7kHUkXE_4iL-(H|L)YVT%%jmNUsY9` z?_jI&GMYcQZH7y=1Sez^<^>f2%d`M4g=>5y9(N;MGh%lWU9sQrF8rxn@A44~LZm4l zULr38?%VWazyUuaXlkmcKQK=)Ww33g6<|lVYdL;uI*T95nJwgdqg8Svs5LZ-Sw1uE zJwrWLV_Bczx+F`M7Zy%kaFz7v!-^3FxPJN@gV16XxIQ zBz_Zy_qyX@0+~gb5 z`vO@OawZMvj;nRqT1OilW}?irdWBL=qbhQF%`;W0p}6psu7e)%HmR`l*Wkm|iel5M zcX{KlR(~hf{r6))pH92hUB)^XW!skn?d$Y8BY#DQwoSj?rTP`UKHBT`i50XFe($+2 zpBMbQItpbH%P}jn_w=AxmFBiB`SSb|anbx7tc@HUT=h&ZV7IL`a)sZSQ{9Wx6<2(4 zl6h2wetS_Eu6xpR$7A^+E5G_jA>5UA&#YkeG{HGv^ z2kC&8qw?u$z`+XNySceWF~p*uEb}|7qSr&DA$_h7XPli0l)#YTpERP`X0s9h_f&nO zIX0H)4)czP*X#6c8EbzKlK``qrBq{;Wiiy}`noej-ZJI-aa=7wf!ePgB^LmxPs0mV zIkY}UEt%!O-8xHd;LZv+tkR?Kr>x9YjTBB2)}*+8cj+n1FTAeM^T6gKuZ0Io(@n!i;C)epoj&u!+B#F7UG|RL1cf7slb|e3GQ7Saf z9J1)XL~+G3=s!Y(mYfP#Xzh7jjtRclUlh_{+PqqhtX4=2(f*0327?`m-l~5-Sysv@ z-}YLvZ!#) zEk~te+g%rYOu(X9R+!~Jg5j{wOi4UDo9jQ>h~e#i1#9~yDmQ}basJ8bOEXS2HmRzPeG3IuKFwQBHUDxVWAWhNQ zY>B7@cm$cEcdE%;JXP&Y8yIKGdD@!h zJbww4UiESOakgsqKmoM)&Mz}{i?wl;cu4U))QBy6kv|bf>|Vzq!@X@uyEL)mA^{F# z_(XiS@=sTy!-UI~pJPUXYi0!8eA{xJ&svv`seqe4nT(#Jf5QvA?esk1oI7cyUBl=lTpPMql%AB;)8a1XW;kMqZQsiD~Q)e-ZpDth-LhdtW>VkmuMzJ_M8F9o; zgWQgMquDi(e>wj8%HUD7wa>#U$o+U+pkkwR&P0l2+qzkWc5`#ca~->$w?kmF^0*v5S_xU0M-B@u8ex;Jr0p%xlNry4`T z)5BshAy%L8LCZn?)MI;_SXc)6Amk^vw&$Z4#S=`^tNV(^82wL_b8;6e+(#XX}mK4&|_!KHy!_oU4vvw+ifLy;7~4sSF&e?EhcO5cv$etTaMlO6zOVynz##XLZaXdz$4Ma+ zF~AKnUOo7#D(>{|D0{m7%cMQDCHE!8{HMwO=&S_%qPJGmR%}*vum2g-t#y4vgrh-f zdOs{m_VdO?4ncMlApMZekR%A z55b-z2~hvkZGR4rl#@JMF~`Td7@e2<(=40$a``M_xx_WNAlxyL(%@x&$CXd!@p~hy zJ_m}yyk$lC`n4hD`AnrkQrJQO`K`R1sG3g*_8#D%nC!GsaoHpf4jRXT- zlp!a1Z?PDV4=tg?b7Yzq;4b`>%EwEh4{21z{ch(qMyI=0#)J5P#k4_9k&z2v7ACL{ z%_9{*(*fQpgrKY_mpTQrnu*HFX034;f!BvZ%3WNZ*4p>GTjx z456+!Mw-(YrAaLO(49yBgHetVYaEQ`*Omiu>zfuPP-Rj@GLqs2%?M||+-Ja#rXyB;%0aaKcBKM>VKF^n7jM5$fK z0iSfz`IISr2QitFq1q1P8(Jyo=~xl|e70rwAvcDtF&?S|i_Y{&V2rME>;Hz_!&02$ zfUo{tQR5++Pxkvyb2W0lisrs}ZJb>Tpgftki|R_u+zDFVPP45n6-?Hk&Z%wfn) zKr8}SWY_)S8s+sWyzMX~Gb;ceS)m83*b2I?y!$f^CER0APg`DlI@TQW`;;;*c)_wd@zqoo$poGo`2edl&~FXi za)M5YkK+5V1-VMR5C_i_IepK^(|y7JKcdZh?Z3{3OWnA1yV16qro6uyFx^FyCIz7h zjZ4#j3?7QIm2k$k|93^ zcMpSo63;&ra0NEUPQ8s@k{4{8NO@X%h=W>V(LcjdQa8?DL&wUt7dm(EC7q=+u6YK0 z7;lbI4OW~wyTJz-I0VYCP*X~OpU77xJ7a+JK&A*9M(|IcIrkM&B0s0W zmxfZw@IifmSPA;)r3O<(XElG;ongqq<~0 z)X8aF)b6YvHWAxRc%$XQ0|}>x6SeTtX?)9 z#DA_ir)E#=f=3T`zSC2eoa~+N3zQZe7kPP#i=ek< zv55q~yqtDy8)D(;Nq>(z_b_?uQ0^{j9`0SLt}npJVw}KbHBsP;&3M;#mJ>?;PWBzS zJ1};MY)~a@r(&h&=+3=R*I(j33IubroA3LNgk_Hlk*E=%!Zf1g4=Xvm3T9l0+@c3p zlGtW&@zF~8NSk|I5uJn@OH_)f@`BMU;v2^S*9Oa=+K4f)GYVqim>GQSKY31(qwg#z z*b+HcF-aOgp(tfW4S`WceZPG)OA5K(C}#)vO=G=Q=o>U>VK z9?MzIGeMwDz1VIg1pi>ID;!_MU_ac{C>Uh>ey6D{>qMF&RV8R~h5_ENovaN_a<6<+ zyEidKEx4>C6OOd2p*Au9-M^?j<_4B#c!qVE?IrrLazpqK+)-arEV3YYdwFFRbs*qRJ~^jH_=A5QxEZBd=gSDivZCNd3$wqacHDp{n*Vyvv{; zbVKEAH>MNj-#b`Kv)A8^YiUpEFyaA9n8}2+q|{Rc%WZeni?(PQGd5 zbnv*(AF*e`eVZHMd69B~XI9P}#7Cf2abE|pr}gA0CbS~z$-v71$2;@eBHL}@J= zZ*VA%n)cS({N1}S#Lxno{LT-Fp3%R3QKW7?#_5aAS1(Ap6l7l=G%6^Gy*v1%@2*As zaGTDym&Q}wb<%|Y3z!YyRhIuA_c*)k;ZslhSi<`@eKc#S*I zL+L;Cci-?G1<)|9;-^Q0(4e7TFR4Tpy}Cb(?R^eagkg_spGu-v9nt6KR60~_s7Z?o z%=M+%5UP8Yt`(0hzA60is-JFpr_ep*-N=9J4*bwpWPC;lNsTrfyq*GN89W8Cqg&-A zMcc2>gM*BjZGFE=#vv%@w(@9>89+{J9Gt2<-ZQRtE5;eB94gOLljKWNlC^Qc?#>OE z^ZWeAD(|?p9ZG|%hV&ME*e#_|=3h^xhKq7$SQ8>oEAJ3b{YCyPd>PXd7k6qM%Sgc= z?z>=F^0ducU5|IM?yYrg;Un)l=*R!BIuHt?E>=Pk?EFSizIX)@Lb?_@h3IY9fDJ)f z8eu~8**c4FW+q(adp(K1qiCN`^Tp$9aj-{Oc!#z}=X%z+vJ>_5h6X!*6mf{rS@M6p z(f&k#p4xsh+g2JbM5LckL9>NdF6RG;_U1}#V1Ogx`t9Gq3O7=*j%OL)xv~E=7K`^? zoA6P4fh$wa`v+{Rq5&6D4*AK=)nR_zHD?OOQoO3TIAIk?pZy1?4#18fNBgto)Y8m@ zSBZ|!&aL2CNuf;ZpU>7Y`b7vhg?Cz679T%xOH=d^n}rj9upU39DEf>c-Ul9v*Gv-d z6jc@p(C@7g$`2K*PLG1oK zeuA*72w*4>?T`~)(A)I^X}%NAUZY;v2x$Wbk!-yP)rJCpn9n`Bc#TIIqZ!hcX-s_(vrU#B^XA zB=AADzNLrhz(?N4GtR9zJ#_t@Qkl32N2T!j)Y&F_D%nP+BXJ8bvxEAT+R*dDwh*cB zZ;5OOjp$)p?*k0NyzzI&ZY;}ww!tG5Evh@*T~~!Q056xCXrruP$p}c!w|BFmdX-C3 z@)Q1|b7W80Zvwy(C}G$UulX_H8iDwGHrOpqGmwhj{**FU7N(KNn(kR5P!B`C4EtA| zteVzDS`=j&H_Ms8!KKiHZk%>h)1rS}a-_oqJ-lVpVWWY#Wq+@~-mG*RN`H~T3kVrp z^gF8iwNWNdUM)|Seo>|9woK>4J>H>}_gq1+uo6B(|gUe5gGeFS- zet&o3vGn)y!^4&%wbYj{CE*y1P$tMT{D5N>G7PD-0*?IE3yO6o1Q0j;qnkehJv8_G zw|+c8r(%Uz`h&PyB<`mCyoBNFFSR<`3XqOxkqKeft6==?k*CT8D29f^49V>zU#T`8 zgTkG_oEeoZMHS8-o$JMT^G=J>t%=J_a;m^-*4C$QAABEztR3u+-<~pl$oYAi9Riw8 zaRfxS{{^)MrqtxfH>x=A)#cMBfw-aeU{3H-jHU|CEIsD?7l1Ik_mM)nD=i^-qYXyr z+l$dI5li@C%{c;=t=_N4JTRXxyR}G8GMy>Zfre%%7~$(Jlrj)!PR1KbBazkV;76uL z9-Bw$nPlD+dFkw<8mjyX-P#S#@wl$gHlu_Wz#LG0%!J5;bgD$Ig?SrWi>=d)WqLV% z-(3B`fvt|6+CJ_jzUI`vkF$@b=ONR0A4rs^>d`4P{YrzExaX*~7_7Cw6)`mO97jAS z0;ECgg+vWw=2A7v|3G>Rwb@=t{acT1Ih^&0l-gc9a9i0mnh*PTXR(3?EY25X$ADJgww=O8c~+TE(oYm z`^+Oy5I?C^vnGM*$zk9(UA_=uZ(#R2)%=M(d=vLiix`$VESPwiM81{qH9z^BFFT8l zOac3V^(}rC88SiVQl^-F@hXzF;__LXbeOCGu=ABfemB%}uB{twDZqz2g}G{ML@WO` zx%fyPh`Jelp3!7iD6k8B@@c}2XgE3}ca5x#%t%$c$TRr{@@d{S=nOV{fudRU5CWN= zFiDVHK37}zJPPukRq(bW^{+TxXTMswC2V$ZS}FDy%XH@eAKMwM1iyp%Qj{+#8>@7h z??SEY-^Fei#8|WKi5(b3_Tr+v#6T`^$VT7D_yUbw>gzL4Y8WiIOli2d>tI`=%=vN{ z4~c7`0-zRpLB$Dzy;KDU-V|iZGmQI2*q*`1Y>&5Qk-BgQ2Rkz$#{X7RqxcK0V0+uH z8CIF~o%+SKe&c++v4UOt)wMbjjM{8dy~t{PLkbhpmZWg|^{C#YM4Ddm^pN<) z#&M?oyX#4l8M=kkv*umJvfSKZIeaCp8fw~^ZvsE{;%o#|ApmumXa_*D0rMcT#0{NsMB|3Hf-|yZ_cJ$ z4-whi>b(%pRf#1BX5ZhAR@WVM`Y6tvO^%mf`Y@rrc)Z=?EY+{BW!E|GLQKzC^p+Dw~Sj_u+_-05%!HWgOLj@O|(mcKFPM-#v@h z$v~=QrhQXHdR|gp0>2pK(*s6uW!5`>RuPC;AHd^q~r* z@d1R8a^_$n_qW?=F6Ccg-K@&}^XRh`CgJjj28|(BHiBuQTu-X=?$Af@rZ8fv+zLkM zI8Rp|*gaJ=y48NhnUd>&BQqfiW4E4bvQ(bg<~CaKIZu?M@-b*)H`F`qu==75Wr+&) zxgur85jzKw`_0pE`_6w;N=8V^&b5djQeW=Ahf3d@2aDxKy5+8}2lsdbz4{n--P1c( z+dQsC3&4L40Z5R^Xc1miBg*^YP2+YXXJ^ui`-)8Qs({$p;Mme(93EXY;K{HqN0?Jm+Izccx><+v@hyj5CvYoAS5Q z?Fn9tsV91w(!hzV=0fLbWClncQpa|hd5qiBBfPx2NdHRgv`Oz4h=C7yoUMMsZ8>@j z{mTrA*DwC$;=1}T(!swT#nxYz58?bP5&@;dmMf%%uLaQv&8DNIafKu&N5DQrD#!a) z_v%RWYTl4hrIkZNe+G*aFgsWS;2waPQ4I%QR~|O+Kg`Hc|6^Gz`qRzxX09z)hv{`E zgJi;!(W5pq$;P}8WVWZj2#omSwK+qi5PHY;6x&o8Kn_josZ(_8dNWoRxK@GsU&0=f z=dyo^5j{f`r1&x?4*UHa+G1C!7%zwEr_e2=4CgmLMUx zdvNywoPmj9#BmX8h-35BT1HF!b<+QAVgde>xMd%Mf)Irg%-Wmw>RuTEko zgdldNmXmaj|LWYtxea2fYi!xY0tn17GC?maJs!RHtWJmIr>EYB%ne>`v5W@6R@3C7 zI+9F53x?PtNALRc^ePlkhR@3~LA4JzQ|hjpk%KBZW~Qbz61Ush9(L6n3N#)e?nl3k zAOauRLxMuMAfu^VNmCP|<~L8bAt+W4m*MwCX=W*QMj+>>la=zQO!rN+(#40}3^yvW;^(he(ibm{ znN^CkIWTG=y5nNTi;cDk1jGSt>^g6{Le(X6gNp!+sMbYY)Jjf1AWDoT=6+BlH(Tkk zFsm?lm6et;8Ye+KCa{Zq@zNM5WbxMOl;VT^%vpQ5SJ7n_yI;m|{S&&^x;8X}D>r?M zh5vNYdXa^{KfdHNe8=^_X6WVf#J^J%o#30VcYKFPc1}EK`12&uf??pzd$TGNp>%P} zR0e*o@8*?yzm#0Jrj1RmPf$);O}`Rz(F<_5Yl&;WM?W~8Y|d&Kfim-bSgq1KYBhzg zo>MbU^fk;i-Ow+%O^6j9&00UNBVmLX2vM-z4$`+xJ$WV{@^|YWOcv?UR{%h4cRgKH znv-FbRL+FOG;_!z`2(@u!QE9=JdpC1I%zvJ^OoZC*5+<6{BE*Rl5O;5Er~gB@TJVI znnZiz=2@*t!8RP^5h;F^oK)ls#tte*aD2kmS}tkzwB-?jUP{cVzrSOfi=$w>hk~n3 z^1uD&4uBSOPc7O1YxY{mkZvOxjN0Z5G?Fq*8FT@27Hplt{SW1MAy+@1exck&;wPXqnma6 z8{MT`-(VORark+n!)vH_@=ZWh7<8}`p>e49%R2mcR7i!Jc%OpBoQJF0mWRjgyml*A z%;?1>^q?YM+|BPd5jE_6|aUv@@BFAI)fTQ6zfdnce_o_knXi0x2 z=kk)B2rG^Rud&ZH1p0^-+26j{8jiw&5m0U&#q7F)th+pc>tvGMsj20;jT~ zT_*UBHs@C?%IPw6u5`%gd+#og@P51aO{D)i876U~p(at8sEupIvGE!O2sZ}%*2o%8 z7eKJ*M)?BTPTRh@9LA_6NT-Y4D;<<6EwZvYj=zB?>jE;URYr^L3)bAi{iWhoO3(dn zHMIC2W8b{PqbYUc30)>b>`cE&>qIg@yuQ55Vg2dYy5MbZ@UL>pe|peg9{#3$@xjG8 z-fF_`M<>|>4QX}@&Rp5A;PQJ$0eU+anZB3ppa~5X7b;Lz8cW%-z)FL$6RZmCd_VDi zxGx_qfk8x+*cy6AE$0fq{-DBcqNxXex0QlXx$>4!{*GoHj&w07227Cs|H zP(6#b^{7t!2lk>$>lwP20l~gz01$p@7e7La*~o^Pzytq?<0DE+86ptJ9Y9xnE@E54cCWX&_tIG2*;!> zrUCr&k#?Ba{^nO2?|ts(gWUtN{BhI8zGM^?LQS6Leqvth^EV5x-}P@BRT>vhXw|_B zf2!RFiHJGw#$VHFb~+49r{E7>{UJR?;U~`Y6uUbW`~GmEvbU?Y%p2O_)NE}_mq67| zaP`i-J<6A`4?y1<@r*dO9z&9;I&h8E>Fe8Jt5eM@3Pg!JS=vS4RcKL~2YjMQ5KgXP z%L2U(6yQ642W)(glOHTLk~JZbK8rr3y>TRwmoIQ06kcugAgl45zH2(|xhS;07%0cR zGI`}=ce2E*UAZ+O_LO*Ga*DheGs#GSkn{3PKAr!T8FmwGTs(v=Voww4O{uvT>yh}N z`Qt4)i|@ye;s1w`6k7Mxg){Ryts>fFF?M|OZBX)&r=z&re>G#`b+>qyx)9 z)}$IiPXgIe+6%0VW|1rtzpw$2?NuDoO z-I;q|fzst0CdH&vky9udd*pddDglGI_hv)-jZ@W+j0$Ch2%#d63^nfT6@n`qaRb(d zYR(8UoYoV!>IWKSTF{b%e#{aNB=JmBK8~Cdg+_-iJb~3~+8C~`4|ajb)H*k|R1vhQ zpS?O%au`o3DXvU=?Uf%p_>3CAJ_)}KocY{?u?)j_+P|mAJuSMuBBR%qr)&#Q|6Hu1wG1O7(Z5WsfTt=&w*7ffC@ z?(xwVB6@~HJjfgm={DxHo$%|7pGHZSSew_Uy>Uttt4Pay;&`UNN2nC0{o&%C*}~-J zrfa5w@>$%GDVv9mKzHnR z6?Su|Fw7g1QeBp z6W^1$)`9TWoCCfP>L{MtD=!kS{BbDmUDe866I6zj4%XfAJ}*330`?F^4qN+W5p@5k z_WkxjhN(KW?)wvJJIJyF*wi|R`NC&!1vHc8UGI1KXE64q zc7&MYY`rFPug|Hm30~OYBL+{~_K?Rd9F|lLne|-QXPcHff**sHw<2CyWgRZ>j-?+) zc*mDqJji@9%_^OnXfM_SMZB>(+b@WXzdo*VaoO%TJ*iaY6=P<775ipWV@_>zI!PHS zj;=P+v|352uu0e@!KCsvf(MwXNOh+>eo8mZ`I2vB-!y#!$<(rcr z0VIMHjG~+L;tbq66r?P^Q22&>R_ZAel7^Oc2Auwu!A?wIcp=x59aBUs;$eDyk$H3LWZ82_7 zn}?BxUKJCxcsS+fJNaH#{tnvtq)EiLlbI&>y{G+T`Hf^o(+q7I=|ygMcOS(-3*%?K zf0_>eQmxPi0!G_j+)Ci%FUCW7U`O!mmub|0cwh(C9wwy06CUx`J7N0Z_-41Ygs(nC zCTrp=lN}!>$o@OqAV~~-kyDp;Z^YdT(HlI|z3-A$7>xQol~c@vtL-P|fsg|m0hlxn zn`Y3P8#E46ypQ|;D~R+zTObbjYLkn%VrxKc!ER!OPicNOYTS^;RsI?H;r2W9v-CIu zs;?Fu-pXc9;2*2c8BZK}luF07YyXuW`ErE-yupXPtVT5d>qq}XqeB5aZ?&L|E!F?p zJ^l`k0S#bVb%;mjU;VdR`473!yY|1+>cf{ji}$}~9QcR-|K|UnhCNmO>=;C>n2;}L z)#-oz*1r3m#*YyQo~8L;uQHr3NIX4gXM3Mm3+KGZCkeYUU_vVQH=zk z>Ob#+1M$Ilz~@(Drw&YxRXLmaG`bidWQ$#Od`&a}dph>eA$2fIJ2aR&^z*p?3sV~D zXnAsM{WTk@`|pCONIy^2>NudRF+NTLZh|ecExFJ#rWbi^I!B|pXdHa}o(EFz`mQ!l|BQ9 zKPLT+Zjv^pnWr;=$C|WXTtVsOq6iHS4qBo92CI6~^LeUUnJ9siF??2AF;U8uDm-uf zV5wxFVW9fH$n)2ygo(%VLnl|&CF;pe5DMGRnbgRu$`d4{u;>&990>z8@w0gyU5`Tn zSs)U2uqw3C#K4r+QG6%4p9k7&XPHyaWbS?8Il6Z>CK7)%NF6BO;_-=%!l6Fl-&I;I zHi^zpM;AQS)ALG``3Jgn{>={hj|gc7ZCP>h{OfWzRwQB-p04B919$;yZ-fcVM)-Z6mo>E{gcqEng-cE7#xR_uZA5 zW0jjsbU}8kY#|Wi1c|Gd_Qk`P@a-aGJjIkf9AwAJ2nD4cWF z0ee)ie)OeLF5kVn@LpLpRQN}^Ev`x$SJEs{-vSp-8%EfH0rS8u_F|Zgg@%VkSM);+ zwoM}LjT1q%NyHs!4Ngnda-Eik)G|VBY~La8a-Kp$tcfFd{a620Vf3@i)GPM>U~K?y zj=(djkhr_PXm4!c?<)fgRS##Hk5T;rx4xN~DYmfllZlxzOSUS0-R$UW;uNNUr9Ka_cHy<$}iesBxN(};(s+=)){riqlPw_oC=hl@%O(lzU(wE=~1V{ zlkLk+jt5ITiq6whmZ26wXFx1$xE)87+2H-7$#pTMtA=-TE@Xi$?%B|VPQ!0blbgt& z?m2+MX`CKc*SR^z``*82!%Ro)8Fz_m>R7<}LJB7&r$l8}tgN{J@Bz*xgzm?*t)OC{ zq`7IifB^^C5KQ8M)f&uQP<7ubQvG=e>O(sP(>L?gHuJf~5;9owS__VA?wm@^Z4ftx zceFQ!PMQydXaw~VfdRo+bbZMM?0DLN1{q_gb}$FnetZ;+UYGAZQh>WOEm@QSirY3< zL#_n;=pXtyUcXDMajcGy3HfEt^KZWkHY>kgstCET`k43Bu?Of-qN+Pm+ou-;07*;h z+2cWRKdJz**A`9N#rcqmEJ3NM^H+%EFh zYmaX^fhT0+Ei~MJar!{9154|1%g_6RFeNaM$FW|%Anbq*WP*zVRz^c^rF_Y9%x6>` zI{jhEpGYzpn4a_sWq-|)nE5y`RmTqI_>H%(l>~6jffcBIjk5jjyl;2X)~tA_?nk*x z*^N`Vnf|H8nl5)MT^7D@ywz$rj{Xy>%W){mv$dEyt!{GgVKtx{Bc1if20?h~Rb&9s z?NV>3x0-Lw+vbjsE5?q7!mi>4UajzP6q6+vKvLDKboz-+^ZiuH>>tD#>CUTb(NfS( zQB`&*jsNCLhqad4WX|T$dt(XHrx{(_pMxi@R;Ew&8A5K|w>H*`z2awo26LL>jA;$~ zg9+_n{)iK?BQ3L@OCBs1R2w7yzt%3k*`!wka}=KV`NQ}kNjSj>Seb=-Z{T!lq9Zx> z`1{DWLuL^t{8jkH#Lnc;HRooH`;Ex!%cYZ4-m)fP)jj7MIG&7;)$Fa(C*+gj3%7(5 z5hfMKDl-XVrNKs3N^09d?$SVmp`S73Il*bHf7(@Hye5MgX8uK(f4n18Cj{ruNKo^R}sS z8|SY8HTwbe_Kp))RT8Jaw;Xvyw(1F19zjre+^{bVr#rPMOSW@8B_LWu`8@c!SzHE2 z*AqPc=1NxRJR;b7L={|Wcgx}^(E=G!p>MDIHb~*rR;yF#x~uGe^AN?e^VMj^a)PIG z5M@baKY7hK>H3*Er;v8>M2kYej7Awc$_a}=neK3iPiW|R{l$nyk~8&(@+kPm4_mMZ z=NW#fb60>Pj#}9Sl2@9~wis|Ln8agzrF*Q7(4PC=Ds*pA(tix-2<;>-sz2h$^N9BhQO_DN$!$gc_VaeEc%Vcg=-Bf>0{zJ>NWRt&dB6C12icbx*OF1~i(AL-+2cG29*^!M-qg_>xyIn1z-yK~Nm z(rv*e$d_=7f9FTK7SLJ`Y(qO`T^{9)I$mkaKZHp`_d;;hFT?%Q948;F$8t0f0D=`Z zBy&`6WGW@@1s{*u#PnymY1&}fST1^yg>JN*3IZW1c?9}5cP(t=?3kLlv`u~&$Dqk3 zDTkPFGg`~)PR&o|dcP7Fp1Xt;J+=!s*|5Crm_dUN9?E;>8ts5qZ54=8Pk>$=5sFJ{ z{+YiGq$*XRW5%?g<*VGwlUe!3KQ~GtUHayM+Q=6xl%qt@86WGDgN#xl>yaR8Ld7 zu~Z~PLLb!b#*wo-bO|&X+Lz+(Nf_$IDW`Qyc`GJ-Z>s=+Pg_bkH4?om-%nLt&1ij! z;xY*gq5%3ppiZFZ&achDy2EKkD@34k&OyxF%=}dWLlP7+)g27mB@8$&DD!|>$cZCy zSI9Yq#65DARcpcdU9jq~C9(#ajRL^uChHaT1NvwPs(P!Q{(opD8NN}DQ|1``fL!qH!^FEn)%lKgsu}QGXG~gZl`!1#V$ynFY5fKlbzf zD6Xu~-izM1&d%j4nS$koK{TvSOD?{}e$uqV1T#uI}Ygcg2HP&KZp5xr19$h^^9EUVcHEvD70CL#KA4mg{x=S=Ou&b7C0uKR3n3m}J@Y>{y~_*0akEvq?i8DRAAQ~NdJ z#&n}4&7Ar!j%EMj?=n+$g^!w#HL>BCG{sgItfi&Or0Cha0Ge@0ePy8+S|EFRnCX2D zWa)<2H|Cl>5G@!w<+L(_wyvWRe>Oe#|J_`Dj~b&gwGO<%p0@#mRY=e4TuTQ02iw&} zaO-eCscH1YI6v+#gMe5-j`Ka?b3w)F^m2xQxAF88M4Cm`OkkY#mRLlb_cUO$om!c|nOh)xmAK0lG9P{V_wyct%iG(^R@pY$ zzDm3MCaZ2RQ-;X9&R74lv33+#B<*E}p8MK>nLG4vU0G7*CMMnRteJgjM-ELUs!yr= zSEDTQ47Y^G-w=T(fNU-F)`Ok#?`_0 z6Xh)FNNtlFH>5&pU~E9M=g>7J*oo>E0N@ZJb%%sG(>W)Og+DnKKbgurQP9Q75RLu> z9m}^ytP4xx=tZDWP)k!sO{UQrn*Kl;00fSZ>?>r~;0CHF)C{B`t(+4FzORU!-3E-b z2~t5)RKJWoQhvl#CAY&CS9DRx1~&x&YIZS^{c>9p|DQGgp17Qp2g0de^hYfyN}nd{ zqD)rS&!cBZHkZ{>(BC1{h7nqNV-IvicX%c)?Xw?-g%h``#C7u;bz-IGhC~V@GKCBc z-dM;jDnxSjah5*bCttP$Y6y-Uv}Zh=LjVY?8`QO4%j@S1QrH!7KY(t2K(p)m{tD1I zD$Lh9K93YW9^Y+5PDSk{e7{ID^K^B%Af8wv!*Bd)OgPlVX|*MTp+2A@XbO+l0BGuo z$zAUdI^MpRW?DZ|A$K7J%etK`+#qtC3cUGKoH;{;j5dPY!~dyF;4_rJU4F3sai^}6 z`jl|j2{>_dy)_37Z3}kGS?I@LrGgW#sm6gHbKBC(M{trUP|sM=6={b|E*a7KL)BmO z!wl37wlod;t_Xg;dhR5dqo!6WxzUv=_~fq;G=xx7Zj_wPLD;b(KSzzupQA#HN_>&# zy}u`17;ZuU;Ngv}sp!@P=4z#CUn}l0hVva#mNQ;ps7Pm|Vp+~fe2vmOMu$k{^{)Pw zx);|#?*BEzz;J9-h{G`WR!6HTSVs&>Q_gH>EkUKwW=9+D#gSR{l?q+1|?;bN8Ztavb4Tzh9+2)F`j#C)3zJjX$IW(e9OD(Gaj=193_CRflf`g{>A!x z&>Uv=>xxik3)5F|r5K}C+BzN->!KsCHOn=YZ;57BPglvoD3Y9X&oe#Z-Oy`S;>l^W zi0burc&p!RZO*>aGPQv16yEhTeQ@(19EId#u(uALIUfKGxLF@ZlNWeBJGXE7tDsvt z&0S;>yjg!~_~SB1fT4)LlWu>AyGg_18{+mL+b}cAyYP>lWPk(%Qlq(L9l_q~Z>|~d zJWy?LroY)HN5^lkAqc9H8p|jX?W1-c>PBf&&&&Pc%*-;(zR@Vx+)5XB4}eF9Nxs`tF6G3%v_N!sf@-o7=NHJB74@tECi;r?mS z{QAjJR*dNmxk@`Ka|ZWt(x9OR=VVQ2%k?>1km&mL_10$pr{nJoVlyqF&Vyn4Wz)pt z_`50w5po(KAN@;DranG?b8foJGn7Mp*a**|w75n-kI6+w81NWpNwVY%O3ovL^?BW% z6ODTe*dgA&{$4GEBmNt2I+!DQg7sODb39>TIdc%k;93GDwjHf(mQ2vMQ*E6g7%~&$ z_Gc^}EX_c`D=$C~#>gU0ME`SLVW#vOl1h-LoIwUM%rUeC`xAvv_lp zG*QlR^~LeX*}{^qUB_k6LxM{)Jo)~)p}|*qpg#s6cq3Dq*4*`)cp?1Ok3lb{1oH~@ z1tqb8XpNO5rY0(FUkJwH!k4n>Zl5?gilCv)WtH}qq+6a@_rlhw)Ts978?XA6krF<< zE!gF7!v(pZk~?|<04~39m`knbO)iqV8C5)9iI@~Bi?FPV`#c>{J#jr#1KY@yOIt+|u`CtmF*fj%>+KS3(!s1~&i7ZyDlhFYyHV|M z?qAG`g>*^DR8NVOMO|+oZ_80->}*R$!5KhEG1qh z*yFkRouIO7xa<@8eG9SI4o5{Mc^W;%I5jC1zw^|f23ex})}nG%dU`p(uzRbTh*tY_*Zt>%P> zS$}1BVN3py9=Dw^g{B02`YYK48>&Vy^YMyT0smWJl1bbvGDyOP*kc!=6P*=0VS92D zoO4N-^NsPQb=+y&i2QP0R;iL5hshIA`KY5tek|P#o$2*gU4sBuTfb@?ogM;EvP zc0`iCQ7JtIvfSxd*CB2*yMDfz!B$p1nE6VOwKy)pbW;nv7*4e2L8C zbzfy|p&NHuhsm7vYtFgdwV0A(*&H;Lir?`FraDNMpN(ept#}({Fe5K|E2*MLo_n_p zd;kdN@fA|!qiqE(nfPl_JGk9EfI!uU!2Bp`ZCe5Bc!#)?1!8dG(%uUpo__a~hcfE| z;f;~c4yIA%?29U&W$lv-wOkN~A7RYdBqK<{gdlq(yb-vm^2?kPV)w~!mu~cgVxU5s zr@>lyS2egOo}HhTDP_e<15Ccu);+gm!OLbT=cT96+!nn4=5g@b zq#gMV;=4lCtfVp>%t(m!sMv7+fdOI>ij|tE%tFd$eCk2mw7%59T6J$iu4n=9x2}jFQ|qqO_^Ti_@6G zD;$f>))2Z}vO$m4aGpZbsLM*Z!xKlGXM*M@dKmkIpSnX|a%qwX4f#nlw22kTIwqix zuin$66|?5YNWPNXqsd)#W>YmH@R;hvv&oKj?s^7%U)7 ze4hnU+HtBtS+vL4oOGG&=70XXw&OMkVg4E<9L z)YMdRPaUu)R&fL-06yQG_qn!dT3w{V_u=;Ro3UDpH_npS>8^;+uD6ou0``LLWfd1-r!&}L0B;o z{hdc&-X2?))CIYKN z(skIW*G~nyBsv=cGvYqhQtnww>Hz;4#jbQ2QiKg3C8k(F%d8?^Y2vLq{T*%OV&i(Z zWgu}}$g1&W&X9*Gvqj760KxohBnWOMf%=<)emZk1=gLs`8W#dSm9roVqx^9?v^?}g zJVla|iq-ts_-UZIZZz|o{U4<6{w%4rwkk6<>O~Fni#g4Np&!K2JNm@xV+{i zPy{RzQ>neUpBYNJIUBJ=2#q_In*C=j07?- znowk>zf0+t?{Vv;n-D&#pd=|%$5X@HUQ0u-@ToV~Um`!sswq#Ys;04<&QlkcqX|Hs z^_JRPEv7;>>^nxOp2BQte-SDCoNVs>u8#A>uh%@mhfE{ViD4xS@%|-fIGXgg=le%C zCXNKxP*zN!J|KYlXKH#>@br0Xxb)<0itKdKwJ`K<9EK`z>ibMtm&S~k5pp|LZg2Op zlv}-VNVl7sf?LUsJRe(}Rl+ZF1p7ErxLJ1dS_Sg?;l)I$b4Gq0(9FtbGC^wX?)sbPOk}?N#&(bOCr;^xm{(VB%4@)@2Jw)+?$!}&^Pf|^t895yvT>8E|p~` z?mim+IrlS%k^5GrRcE0`hU_%Zl_dhXx5$9UU}G!7hnsgA5({#6@;}AHnu<>N*$Y<% zj(uMluQtOuaS6Og!{NEj_NvM0{+0o^Q-Efr+dFStdQuk008yG}K1R~Kuv7)wr~yvr zeRI_)YqO=p6OdfNX861=^TG9fR?vw;lex@SasVh@XcM|zp@&v6V;d3m5r{pd)dHO`a&L~%V1oTfM_Fr+~2+76c`cPmVlW1v&gokx+nwAA@hv6 zpo&wHvIfHZaf{#= zP4W#FCX+9bm`6F_6zj4!1JK-Tz5mmMG|*8cLxLAoFMgSj0~c|zQUpQ zry;8RdMc3<NXQxF(jlXq_fz1IvE8>J(oFbP-Og7un4@ zRmFoy_VPrBMvzG9gzStIdP7 zR3ou8Efj)Ir5YzfclVa+C0n8)3Y{8xw=1pnvok$-uU@LiP0&7{34yoVJ#Go3qRHy& z7t((tB=&m$aADdf@{F#$L;`_Yu{vGEDPdeC?8^%*jHHyZH|y=bIQ2HusB-$5lxQ9y zXY}BfFkb1NVDwS(9uD(z7-bJc6;BovBHXj58G*L35Ha99!{S^0L1D}7b#+yUFs9h} zxPnB@P!Fu6c4Q+Ih2(9AKGa_nspRS%5#;5Eo>PV9 zzTfW{rNr5yaX$pSeI@iHs$bO+Tvc`TwmnYRovP%JFgIdtYfv42l_lSYO<#lC5=}@= z`k0C4LCTTU&ePp<4H}u1gesS`UWmJ0in%vlzYNnm1zxm2kZl119pj;Gj4~jy@lh zPL&(8+}TK_@C%$k{WW7i6`VI8m0C5~sc-|AdL>l&egnR*Sb}opC*ljf1GQC!w3LH_ zkNu20=M0|wBvy)1nP%BeOfc4j3UxLFN&0cmswBN0jT*MFXYU&27+eDPQ46Q@<4YUp zK9P8oX2R8)eQ=(K1EV8i0~I-3gBG=~t*<{)gtkb0c*dilgC=(c`Siryy|3?-WCgi%gM`A@Ta{xeN_We>LL^>w-%Gv5jN`XKonjh^CNi8KTwK!MWVykes4 z7Azu7HAugM5+>Xh{z{^M#&=#;2{~0maN-NdyOeczd_4OGe-T5fsGTfw|>cGp+SUvAt4zbIuuGuf7AjOrKQR3pCz?{W6WnFqr*e8QvX0yhm5B;)^3#kg& zJA%(X-}beIg5JD&lFy@#xTKR_XRFg+na*13l6mH0_qA(51cfJ~=9Bpc-`StwfI=Nb zzA9UGy~Ti76Y940ZtqtvXY;hL=o(t^LligKsIBKLIX2b-D?l;ZueRq#fUd& zvo(7==Un!@mNByJeJxT>GNDJLobS!b(mETuW?M}NFg_Nl7`V+BOMi|@^4E@2w+V~NZ=;V5Wa&OJ|7Is$^ z3x>hbqQ%<}+gg0ZS7mO*TP}`1B9$-x__dn3bl=hRes6padT!t3=C3f=baB6Pba&E* z6#pX_xx94!xUBQhyUK*>@W@S6Bx1Af@w&Aoy8-G&60X~TvF!cBIa{P+^$G+ro#p$+ zVq=H1 z8kzC0$Pu~cZXfmSlJGx;)*{?yT};3xJK<;}TR@-dMDA);#JtSU3{D?Db_XH9`P$fp z5sMf-8>;`&qRS=m8Cv`^v?k`y8Xsg;d!~fFB=sd;uqmuc&*|^rt*SjkrmhY9OfWXB zaen=(_UVKmR|Awo6vv2wf69VjAO8t?jd_5_#a>OTnqvID%S?6zmhCrs`;2UbjBgxo6{k+z3ZP7xOQt^BG>aJ>EG}E zSp|41ZoIQ+z~d@BS2H29m5{L-MC(-8R%EIxeF_Xby!|-@DwoshBWS+C2^G#^{g2<} zEdN;=PL&gv0d^cEYk*lRF8SDA%w{FBS^6k_lVsyyIo=sftMj-w_Yp}@OrT#7JD)yq z3vwvq4TwLXvJGFIN_*l;e4U_}x}Dum>jX+rP?sYoCP5>)?(DEuW7ayB$$5HB-|o+p zFoY)?#`Qx3R$*x6^mktVd5Ok63%wH=AIfe=v3|^7+sXK{vU;W*s~&i>U;EJDn?uNB zwBCLs2ZvnQk-hYaPUbOIMkg6NbT`>I2GW66^Xt_3f@=1ygO3k~_}-5X&HRoUEJLJ1 zEvKmtt&A!^F!6cJGGPJGt~QHXI(h+&2>z!xFRSlP=DtqJ7P=87mUu z|NCt|KNn4U7TQ8_;d(!Adh5N4FXRoWkc}iaJl`8-nki3CdTG%Ufd|R)HbD#Ya|?!G-JQu{T6&)~!F4@;N$m8Qd%s5HD8 z>gUVndPG=il2_lRL$~F&%bhF&g4$L)$J(bCnVA+vb2`AXk%Ba?fby8zN1}~g33#2N z56Fq-G@i$#O>2!N50b8f>eGAIz^I%&bUtw`!u#QYzZ9nAk>2SX+80Hkuoy5SD_`E3 z!lSKK_u*DDyVGmq)Q@3W#DB#k72cu8ZPrFl##@;1eTH3el964{Sim^$j$tP>r}JYd zrLdpL`@z^E2IQ|q!%%1D*@`9ljK-t*a2y(yuuI$RpFRSNo)zEjZZJrA4)5PPY85MU z6OE>&;!MBVpZkqRustgQVw8{mII={e0OaK_X2ockw+3;&?@YGCujtWctSQn6Z4C$Z zG`6+%sknLT@)Xy+#f4@sgjwTG84|=HopaQrIpuETX*bYwl<|A7STGfdRLaHd zj;uJ_!`dE3$~$;K<p;M`@FtX59E~jZ5nVpcDzQJ(n?yfV9^Iqn0xj`Q?TSfn;KrUtN$$)1f zTZ|-P$$6t^7@YJ&<<7k{W$0lDEVy!yIrAQXZ`^q+A2)cbYw6Xyt<#3`3bYBxN0b^v!M`{Ow*})4a*YBCGr^FdY`t|8+;Zzsf&@ zXZsNz&g(Vrpk<_1+|Bg4_x$ZtR6RRKB3&fvd9_{K_3&_*WJh72-(Y%~ z!FOSl{A-A*NBbjvitemrJ3YPcID1?j{;FFiFTlY>9tANBOe2!7MnOO$HMh5O0;mX9Xw7PJr8GxxPVIG^FQk`y%0 zTP;wbP)ZUG<-sb~0C{%cL0%#zvu|wi2ApjcT^`Rq=Q$BU_QuV%R_{uAKYgSj za>+GmFRL^I8~V;w;vxKC7}c-R&Y?nX6t`ar;i3@9~lksYg4Qb zZmA z8p>>>r?G+EQuc`2DJ0P4+@W5faS-u&R9mOkq2fO7o2QkDOScc2B)BD|C_I|;cVF%T)X`!t$xhYaf!$$5Hah$zvTdY&^y215usmOmR0e-vv-< zk2~pLy;84#=v~MwB)EN6OpT8J9U4oi|yEmqX%%V>;5L#);{tUJqDi=Q1M{aq#X= zjiA?&W#xhfXm-AUYz`?D!mwj1=rBUQ)BX6?dnCoC^YeLyxdtri3<`ICE5#I$k$R2? z5s+ttHbV-o9^Z6IbJJ9d0r8caO7Ha*-Q=$JL2P9<*`mhX(kG^R)Wk_hiO*alq*vwYRx5s?Ym=%u2W6A=FBLQ&ey4+xg)4 zn8eqr%C<#q+qe+7K+_7bzS&tRUFoO%v*Hl~8trf!bxIKfdfJVfwb#l!xeRGk)XuHa z?O=5OYGd8ys}c$CJDrx2Q&?WG&(H^J#ikC3XxZ(ys<#MeQB-+Upqm)B4uy$b1!&0 z`P$|b(rB&~bia(1^BYvI5zZPm=<{ynY23TQb-94uV(CYlA_LRuR5`0}xx#`lbHviQ zvJS~LTFq~)J%%<)>N|Y6TotRjL?bU>WfQuclg5}ri9R{I>w1u){*D+pJI;4jD`kUj zy4XqMy_xAC|9146_ddfkg_`?vXE3Cti9~v~*SOJG<_SV_HT(xm6;<%wb#{w&8t%Fk znD8IgG2dV7I2(tMjY4F@m#ng9zCiZc#pUtM7D+pg*9DLG1(rX}ttt=K$RCZH$_#V| z8u7y7zGyttMfd#zX|QqWdmHh*oi`-;pEp)%5;i?U$|t7*)cDag!ue|5V^C8VqzT&U!}})kstOre?0xfFy~u;-jqSkuUbn7^dTL-f(Hpc)2*0vknSf%eEYAJn6j% zgBAnz4{=iLbAiFJ)RK=a4TjaodDy{njysXyIo!Jd`AC9&e`&MWn&CDbdL z4-XYEh@-}Y4WBKcgzw#D`gpl~hPYd{No#;Mk!N{v=r#WT#ok*-Rn@g`qm*=P8l)R( z0YMrz-5?-HBPgN*(wpuskyJ`bx>Q0sq$Q^J-uL(Vyx%#0pKqM=jp1Od zG2CnKwdP#wp7(uS*L}@Iux&|_p2$FLx ztTld>6!^PBj(l2_8Jet^r;Y;yAQ_o=rl4KwisdYRY@fhggzYVrSVPD892Z2lIIO^s zn4jp_K^-|)xe+~!hyo$|nP2^89BTt6k1nMq&aS&v;U5j~XeLb}or5}j4f8(;5q%7} za{Kwbu=3YI{}`R5$7i0mp&SUm7Qqd++-me%8bn!Om(Gv(qe)eMpYj z)bT4*#LMJ#P0M>pAb!xZE$Jgq8ckJzU3ahCxqV48cwr$+@r4*i^Wc1m+=*9a+F^r@ zSH#qV)5k}$?mGtsHz9-z0USKSCaV!lvrWnSAvv*EdaEv&E@6j`;C3fuWkhs8**}z7 z5m?=`Git3;oYT88R3jGg)gc|#DZB~S!@SXbR(tw*wS(@FCEwz1h@}tdCttJRQOh*; zGVAh2kL`FK2yb0Ce&VK`ZT?_Ja#hi(xelrK)98nbMj!qtq5ROG0?61d!q0t&NA!x` zojrHII*+#MP0`SMtVvHmD}G42aiEuYvj0rAKxMPfg`w(eQOc7@Ua6mnOT)W0H~k;- zWos4}6?TL;%2Kr)F!!+F{X^~x1t_t$Q`N8Gd6AVe1v#y#G2D~WjZi{f$mnZhqywWVP zxgYbqUSj5mN;q+EN&nlM#dq_f_!&36lI3joEjd`Me`%9!6P*``j zW%21M(1O9bwy|7{mlLKRmyQuI?j{u98?)H_nZQOpQ=fHJ3C|xn4=&JKZe=v+PDO51C8R5$*2^aN;Ug!taO}The33WM zN|`a8Nk4GFJr3`Zn6=^43eukWn#I^yjLw9{(KK@qv2486A5*%}GHBX<`M%9#e2`(3 zn8OnryIF?5-SRa@Ui}8Kr0=P2xD87TL+5r?{mbT~6ztFka`PUur5KVK&&3MQ&ZpU5 zL3(_Uf}3!UokAz(q`a%=;ZJU~0kF{< zeaiR0&!_i?$ooMhD|1*{+9$zmscx zQ}6PUWwAZIodpeY2+2wK(B;imA zdUJPtEEuvskj3?;?EPf+h+2P?{Q~(J%#-2OxV^UNkrKbNmRmmD7uUZ1)As&BxoWOU zWam2pMKWHB`}ImF%;qf8Svz+I0|__Mo9uXGLp0xp#?mTh?wG00)>gV8ES_Dtv^t8o z{7Pe1PSfH@;AENl^8DS{rchr}saT%r+{QZ=C-kZcPexfqjf5z=+<4&K@6p;lC4ajP zV9ufW7}XjBsB>vkLfG_}dW!$Ha$gDYxVgF9d@AB}93U5cSKf1=NcYm9EeMP0aqM~Z zwr@|-1FAgb98G514+)M-E0pg6e53ogi|mxICL{_TwJqkl36I#?IL{m}WF^!s;HJWQ zE4>S$kov7C;Xd^J(B@}@uR6}-_?6X)Wm^`L4s7bS~b+T{KO{31_w=DA0| z`)20M#)p@U?&l@vh=-4iDG7FOUcmHe9>R1vl5Ug$OwGC4mz0pxrO}($H<4>SAwS?~Zs- zgI+Q}7q`9CEGhQ{^;_1x%$%)We7Bxf;I6m(gV`Rmnih5@CQeu;5$ z+lEs&d8Y5(IyS!?Hh**Gp~4ILaFYAkUIG=V_PnM|UMwd&a}#YR{i(tud20}w@fbrA zqiV!EBS6B`#$ByWA5nd_I(sSNc$mAQeUJZCT(SBG{zR04bquwb{6fcIxs#lm*$L7=*b!jywvBW9%LBpSwdV#MJ;)w%qr1A8swPX)=4&?h^5MJ=|_QcO7vq zH2hYgTc$N_2BqmlqPPRmpi;Pkr;%)?>-C7*AGYc@jPJAi_jP(ae;LcTGR< z#h@HfSv%(5I!5YX%)FP6`~7lr!rp4{vz{nQzG`UFI|lC$HBfkZDWz%>JM*^K$;75= ziNNp=Ph{v-4AHuQeVb*hQkr5ct!kGYDoZkUAuy7UqsW?X>Q5GpAl?R<{fKpo(piBO zA!(M5-Z=qnPBabxzp>G?8(6Slbbmdk0!*W-B%JJE6P$MsD=n38=4tfo9?5YxtPL1l zjQq3k-hFGrtT3v*oE z1M;LMgagTkbIX3#Z;nTGyj)?(EasDcER@-9p6N4U+O-!}O#=v;gn;qQC=V|2yomIas8?=OqNmMY8+7&g|kDjaQ zeJ7&z_*&N3q^%Hu$zNbbZkB~_FFEo?t^I*nv5)KP3FC>0f?Viw@jYuI5J~)Aft90- z^3DYzWCOB>>23JcDzU`4Q6`jw(Q0ofZh1N|U{@~a-Ul+)*A&}#?pwrz4N|k^F8B*| zia#fu6&O^+hSU7btG~PFqs8mxWHrc@S#bDi#%-tf zg&wRoLrd7bly9N!Z6rhw)}pp9##l)!)c>?2{a*cLo?w(}Z{9wM`)He6~wfouh4 zd4lnE+jl4Fz0)sMrm9U%W|pP=tJC=Ff%f;PfwXONKw%?3k7?~z{oE@LIyd9Gm9rDC z=HYC^RGzrzxjVEMP)7mTn6RH8*;FrKQ%&Y5l3jKX$3;=<5u|l7%4&k@l_+NZ5dB(H zRGGjpKXO74@5YSG%Y3^~087vF>!l9WXM5De?cocQihH%DSBmREwlcc34VFQ}Zhf73 z5|UHtFhZ`3ZfmHlfu*<}Qc(2YRJ9o9LL;p6k=H0(#%oe?O9EF6Oun zAyFiu5Q5UUM6#;CFO*&>ly$akv=kUk(NOHye-3kE7)hdEYQ9`5DBVk)|gSCrYyX_RX zd0>e6F24I*cKxYCOq>otU)sSTFVA?&c9#@Rb$Us9a@|f`TSdv{)BYZw8?;ZCe2T~H z_M#CA3~2LTGku=q>SQmR@jTA;;~BNmENH)Y;LwYk2={?9a`IARM`X98?G-Qyx{Pb$ zSe;~C)hXTM5ci$`7{epprGUZ=@j`n$k0LuQ^)gjKa4U2EGIEevexJEcq2oK^`TDvt ziKncONKiH5MuGj|+}9^{8QMIn+V(}R-Yu0e<58zOmW{CEOZlDx$7P1kd+@MzIeGWZ zZ?IVNWUQ48%kAGv1v!JjcV#TYousiu=ZoWR>q@$EOCJF3J*R?1Hg{z8CYe6>8rAHS zUa$Ptd0$FyhLKxYMD$~u4>}a&#C{tOK4Oad?m_cKzb&6BAhT~Z(wdTHewpxUc%jLx zaQMPX6;y~aXn@Blu2GdERGtZGb1E=eVOPI1oLHSXWhB63a9JPmoup8Ak%^`?P-2#@ zXnRg;t=mI#p0Gd^!NHAw(&&5R&!gg|N_ki707ZjU2xKKEx2!@}&#PGeI{_8>tXvf( z^P5#VJu&|g9Z0_=^gE%|7Tqn$k%QF@2%rA6|{9x@o+RK zC#a1fk_TOyX^$DA91dx>Zr{`Y{96b^s`ixSV96FBE^HitceDl$UG^oH|CacHRzt5+Y1J6?+YoH0kKSdgU#TINAN!0)R%)d{$9W3@yi5L8nr2k75 zjtofEHG%*6YtJhOaGl8EX|8E8mW`-6)I&jitx4I@tve6olF8mMF=U)SU z0S5ET>L1kN-^jZk#%%`wvBzBhe?%UC96-|t{{-m&eGCIQiVML9T-V@#AcudS2!06n z|K~r{LX2tL&#=OMtqg=JM4-hA^hf!$ON>rkn62sMsPGo$xYzY)t#s5^^xc2Mg`=t9%IV2?M0 zNC?gUersu==2s!=fD3!6oWx~QalGCZ9O-y8?Q+jBSF7Tfsn$*-i`IC>-R!?#&Rsr~ zNHX5|Sk>f&?l>llSAz?B@P=opx@EeO1{Z|J!ueVRJo~LMI7r}n0Q%2j*%?K|01Y}B zj~BL|@2<4$N^s$M|2>NGpmA{>p{k(@OMA>rMxryZ8eZU5_9s- zrNj6a>%o;SI^P6^=)1~?>%&(LpR8%lCEvS`cTZ7)tJ7qycr*N{@X@ybMQ4Yp{lrIK z6!c=(`!06Sg3m8lcLp!|GbD_7<*2J<0@0Nb^No4ttpT5%)&^?uH>bYj<5Kd=-FW}} zq&`xt&pTE1D!Bo+2Q}&`(k*1v`J@(C>#!`k{UlS;+iG{AmEZT;t5B~vNzxS*4Eu|r zbSi=9cxYFG+j$3W%ICkPnhc$IAE=MHE}F4=!y#l zAgRIqKqZz|BG>u%$a(F~Tz%i}V*9i95WGj9t(327wr6TK2fsY)W2F+d8=Z(HVu?s# z*M{EIG#;NHy+Tek^S#oe;vO2w*W}IgK7N0=IiU%P(dD(Tjh-heKnHLLKSscLMI2Xl zuP%T8%s=<}6pTmp__OsOk9-74+^_!BVn%9_^v@6IK5VA=T!3vdf8Bsx4&DMrN9J*< zAqy#o?ps#%58a2qe_kD8EY~^zem7g|AUl}jn;}eLHY>806Dv6)-kZeD>3g{sinuB_ z{+3OC6i&qQj!7}5HXY-E>z2Xq$;zB2{ESs_TNkEZUQLwoJFX~QHIVa~&YmEAua1&e z1~bhJYwWm**)*JAX}};Lk-b3Moo_!Ww`dR9$vi~FVc=5_h0KD1t8?M;Q3d2rIW~>S zTatT^YF#w6sJ}X{s@TFhFSzNqO;YZx_=tzzz8UHkj1s*P_iSCh?hHPS^N zHT!tGgKF@{hX<-jJSH6dA0EUP>g1mm2PbgG3#b)jHL_pj1%rWTJSG$smi~--YQids74VIk2R!#CExnw1;f$WS}y2 z&wg`ycDBEI{zUHL@?h{8a0dMhTt*5XmwuRmlTw74vqRe_dlNa=Jb8laW+>e0vCugD z-3Zf(S=AtyK3Bls&+e#42ed^@fXh3+GI1_GND7<}e(#IuSO!?s|A1c8fG7@3vj1pG zgMu?3qMf6loUf67X*`4Z0F%uVFGC)d!SI~HQ7y2BhSpsl`upr)jfhQy+Lol{!4Q26 zeG>*}q%8xtSQ|+faBFU?ek)dR3Ia5@qP^#w3eN}%& z--Q-`pCD23bx77^8?t2}ySx+2sKrMlg2S5=xGy=ZWq9FzFaxpza`6PU8VCY~cy}OY zr?^X_usNDJf)oEZ6o#XR^LkFqqqa<_TP71@mqx)JqXpWlr+drO9|N9~Zj4K!uedw8 z;x`<>=YKYGA_3d|_zROjIEv!cc!@)B*NGE_^+Ir{KFy#$co?fDg`=T!wh7`xs+jcR zceUwH=a0esB`0mMNQs?X;nCZ129wXOwf`oX|5V|)Y9rUQtML} zwl|k5Wcxv=W$6Mdkhv^WDecy@Q4zJZ7Cp8~gciNKy!qNNhE}3zknaA|pj^F~wU1K~ z0}`Ic>nB1xnY?C_S5)TFj`vUZsP^XE;5~r=PPnjW@k17^!$O#*#R3AH2Hl(@%tE)C zZIs5L%^U0pP}CK=x8NNHr#sA7d(Ypbi40rv;ft{zNPA*f{ko8;a|q%cTxt0O#I&Ed z<7FnrzPv+puoDLpx#v?t4RCY%uFFL?B1BnRFwO;kJN2Srm}onK0(XC*Lji?;VFTD| zLte4S=`Ec=;NIfR>0)l<+Amp)h$ij|JdXk@cKFS;VlDGR0uXsvi_?>AWZWmPJ7T17 z!y@l|iV-OY8>p=PEEM+B^JE9>JJmJ(38z^Ta5V4QgVaEF49t%Za5LWV>1x|zaxa6R z1xd&=0|V|SpXEGf7u{=w*R%3a0wUIF5Wo#a8PHZ}< zgU6*Snu?7^)OiR;h|9PX&jzW~uxcd3Cn!9}cD~_B=y3Zoe%Aa~8=c070yx~(C$c0c z*@Wg%NW9klCRs7BCQT)7N571G5%dw*K#t1i|pnFY`r}km?#yE^L z%@V(0VQyg>#^i)gPIp?huw_8U(y16OI;^X$1(z`LeoJlSNn=&(N2KMQ&(He2@K7O5 zFte7v7)-7xQUovNvj(Zx!F8M(d`KXf9oN)c%`Xl$1e>CASU=1uSFFk& zZW>END6Pa0Ko7mE8A--1$TsTf-`#1?d5-R2Wdy^zQcHVS*+h=pszlmGy&z0@Pscn2 zt{X*aY#!DkMyNKa)RMk-caXX%5{rm=Xp_+kw92*FGmUF15!{ctb2-248S_B zJtvSsfbBAvf>GnK7^9_#Us2WiGwh8mm)y(I0tVKS*;1-$YBXMaIYt!q5DB0LD#h2&k)-qb6oOl$mPjCtr@2{099(%K_-TK%L|`SNW!uu^ZEcYkFa| z>*lFfx2kY|BEZJUvS)-QsMn~pW9Wpr@Q3MVE4!ii!qAn<^)|R##+NS_{&;1U{e^Dd z=cS-?$8`z?vM{5A&HEa#?kGhX9AgUH3azdH$ibOpuxMwP`}YHX>+asEIcuV|W%qUz zszCv$X6fSPEl;rGFfWZn%a5rmXMwfvO28V1LJn2(63^Gn4aQmFpWxD=__)IRl+R)6J$ooGSkMQ zpY&5oEtH@z8H7oK%F&W`b|VL5xhgwBLU1iW_tYmf`Ud40Oa|HZUJ!XIogHqWayVwhj^<=pw); zi~aO5<99h{7Je)?Suo$jNirnE%BR7mD^D51HyM|Zf{!b@1%iK9JPg@uA?b5+m5L9v z9b`A}oA_&9LukZ*jE6k+PC*5FpJdE9d;_`moaj*$9kl_EGO@u_+oIqvPCu$FQe>KU zOX#EK^m6^HG=EVBDI%eu;JAuo@EtDHy&&1JYt(?fO@{a_;z4I$1_i$r`Ylg^-u9Ux zW3LgqjrUWF7qx?mp>wYZ3KN;PKQ-ZNqe3|9JfQh44I^I`3ko@5Xy}4Tr7YV<)+~C5 zT`V;|CEZx(^|3eC6~wy=!JtDp&phWGRgb`l!ue#tHs4i18Zcx+L0u6 z9UpNf8;Wn^kMFY^wJhB8b*xx_vpJ9^NR+Wm%@)@w3XG2||NNla&g}5K2W-uPo)2A* zFEF1L;Vjsovu6~3k%IEcbid$ps*LpQds|5KsS_tdpyY{KE+Zq7#bmn&I{bbEf%zrK z{Pk}INrWC!nK}i{bOZj5$$pq@PL@HuZSg4gZEbfuKTh*NcNQoe#@|RrRJEcaBarrk z;?}Ihk#;eqy<~G!dlwb7+74nmK2=$0hXudI!V!K-EX8L~VxEODh#J)NJC$%__dB$J zL6atuedReNQ!r;%jFw7Jm1Qf&U~QEJ14f^qxLlaDU&@2v!PiqMjL!#ltZ_*p2?G&F zi__PH8`Tpo!iO}pE?fnKN!YG@AEntXk)uSas{O?6cQ9RGZEqtijF9KkdBX`8k7GJq zEGGTQacTL(2$!FH-`m}i30j~Gt_+VxYw$-R+t`&ea;o2J3|<_gxEmLN+WOkny`>i7 z5Y#NgzC?p=5xGW-z;1wVVYzs*IhZhwR(=fC{=qT2x6^{~vpLmhwTyE6qF2z4gWrC4 zBu7oQS(}=;)A)8Swobj7a0N18Zi;)=RI&=VkOx$+HPqDrNa!SrG8g=De^X43OsMgzt>WA=%dbL8 z_kl1Tl$6&!jKbi|DA!?>16;>0gl*Qmx#iAQ3Zb6((+ z1@DGrx8Q#$oeUyG8aKa`B2#`*J@dt4F|dQuQJ9b{d>t7y<|&|t=?0NLy^lE@=DI!2 z>HhuYzqJ4lOvJGmEY}9of0{a9egw*tj%c-3W|#*(8X=Tm7_sids@F0l>XM3(JcDO+FRj%abvfEaOgfi^{u%Nh4jBWhM~f?!5YxVTQE;(!dS<*I z8$?==a30R5@gW2eu-DB$tDibg*B#*__U>PtDnhhR=nsv#{~re;Bpdvz8!=8X*5+!8?ORCj)PipGuI{RC%xQ4uA{G>nZ)1#*mO5d*a|2+JD!P-ypx zQ>YR%=;Y2fk6Ko2x~UmO8YnFz9;rs<0)GH`B-@OH`>>laMzFrt9=WLx1=WJKLS_X_ zo`TY`X(1fyL!OOi9$hU2Gu;iuKoH%93iMx@f0s68A}c(lDq2a!-W;GsQ-sc?Z{Brf ze`lSpxDxmQsxdh-2pd(G`jKQaPd}<&V)y@>`fz(WqwIb-2@yZ%XlcKc?v9Wt2wD8TE3EAxyCYHUo9-E~_;L+*t z8VYV>9qrgc@tNTzZ_qvLDQP*`m8Ws58tqFc^GIQyTvlp|(B+eXQx9bGH(cn6y&jrFb3c89(|2GN+jAZ4k`NOVitaP-#T_`w_ zLR>F~`FLh=PNV|~Q5in4n$3A|bEPf5_piBQSuszrEb9w##cs8y+DC+aVal?LadS2C zJiB^07}PfXt046iVY**O&X>Ze z1Ym26jUnszD7Y+;1nTW3BQ(NvbBP$dvD&D-L)It}{Fgf|6=8$syYg^tF;sNSFo#)G zkz=KtwhNp#>fetcJbXx#Ga3DaY(E|ZiOz3BX8Ek>v2nYMip_XU>U04%@#z9>ndLlk z7bXZMP{E3VZuh#?tEC&sl21<5hl!6Th}QBNvKI_DA=wY|rvyb_YEyXYPksHtD$Xps zN0w?TX1h@VZbw3Z!^^mD`Bxo-s3PBe2z_HI;~$JV4X~p5>AL=E9Y}7$XWF3oM&+>%ffz-H>9`Aju;2{E#&?vT>S37Zc`2Me@cK{tPr zI(A08VK#K{$Vt7|W^(Kq&4!T^jcd8TUUfg&F##Tf>FB83)lvLoYyBdp>VAa%)AX+y zR!S{{7zokL+z{5W@eh*88R1XHUPbli%6$`%q_%WrXl>q(#_1$_}QjfMiHr-$G8 z&4#YMMZ!GQFUS=0l@aNyRw{hgq4!k_8_!{QX?4Sd=TYN_K@H~P7>Cf~&#Rny&!dZW zsP8VtfTz|$=WYdZYkjo%Yim4O61(4od`-{cPKws;#d!8=FKkzc4XrblkI7Ju9j6=f z5bOE2!`${8Vizj6uqGna&o}sdP2H%7BtP;UkL}&F#fxymuLKk;I>c5Bex{E~URc;% zy5oF%v-b{heNMK$lOU+vkrffcY}~ps81w^yqA~z@7Yne@9JQJmz1Np$PH~_ED$0VbM7Qxt@mw z#~C~}UhnSD=adg86?2Xd6S68Kyd2eCwPF~ziTr*Az&<2iLnmqe3uG;4T`sg(&pW|TSuPaQ!Gy>;iG|BHl$CI%=Y^GuYv+oU@M z<2c}dL7~%;f;}oUkwGD@hV1!YGD~Tc44KO{0!U>r| z^p7M8L@$2zQ;E24r7)`|sXgtCqSUQfywxiG2RNr!!qO_hxMy0!tC6)MRJ0&g@i&00 z0msi(j#t1Y=izeM7>xsk?b$WJKzI1PPTy3y0RxLCpL0`gs<%as<0M=*62!gFb+hHd z8E*l;xq7!v-_-F+OGQdC*Ai+;F9Y8g*VSH9o3WzA*R!?SJMd;+fJ7#Go$dD!NL|tc z9DAaxwk}^F0$`ZBMxwdSFeR{~;j``ODjtMIr(U)k)|~##bIBUF9Pm+9fC|soDFQ@@ z#rOJhBuf^f(6FiqQFwEC5DRuY(En^VC)(QF9*o2G&1o&kZmv!ld=LBs)j=p|=~V`x z;zu$l> z$p!k2M_*rPSJ5p!`8`pdNmk%{b5+w6O1KfT^ZWHj09d~R=)}6LIi{aqaEiRy&^rKv zKI=_za3^pJ_5d@NXFZtVQy1irr=B`~Lc0*)konL7`n>-G3!o(uSX7gg0NAy9ezdv2 z*G1PC$E5i6A0VmiLW-n!ouJ+9R3Hn{8zuKHPw*xU29+l8xKz^bLXh#2A&;b7KKL0DSdj1tzH9RdqYf-U! zpc0pE!CSIENa(Jd*nR=kqMawP(I5a>`|=*;shsl}WzE;vn^6kBcpF72px~LP4iMT@ zvTcCMPtd|N|Gr>>6;ZjSMN}CiS1BYN`PSu6(+?$l|&+$zWK}u8ME}(4eIl|JSLR997GVy=|t? zdEt*#Va?FbOnR*uT2jvIZ#5_j9_2*<=rI8*@upd*;qD)yK^h5U8yHB2kThr(Et(eU z#k-gwQ8W*LL|5sP2h7DO(tKONOc&a|r4??W>5wL-LGQ^5i)oz8VMV$gfEa+%WOtH@ zYX%lZ6Fq#`IxI2wY&k}8Zmf2;M_X~Hriwun`Of0&C#H=adVqjnl)5^Mx35Ev_}#i} z8;b>jkaMIvc?CaFYyMQv-<#X?n^fFQO?@gX>VQrPy7J7$0!h`-ew(5 z1m7FI3g(32yE2aw`po4j6H`k0G<V9*&& zmES(irk3(iqILYK<1RCkE|vRA_0qUX2j(Ni6X)cQ0Du^)HO6w`Ykg3H_id?Q+KxLS z`Juzpbe$M2*B>1lW5q627t|t->$5JNYV;e5(RcGA;aQj&IgFk;im}K2tu@DiS%@9U zd*U&F#ymbOF!sRqTv7NJHIdl{6J!KYPHfB2kDi!ozg>p=p4@T;ketGFHrCi z*iS?KkYfk%sReC_E#R~2_^2bs-xnd+t%R%xsJYeR^lk5c=iH$K;JL|Zzut9ieeE3K zMwuhR1k1(Eaa7v?zhfm^KJpXiHj}la$KkpMMW*ldHy+GT(98AI`?SRPo1@`S`wYHN zNFQJZswNS0^)(Cd(;JVYjmF?$=-eDzaMz#BUTCcT>Zvs0--JkfHZMJo& zINH?VYmz;M=Qa6?r3fk$B z+L7c~zUSF=w<}0i=j>kiEgg}77mmWuLH#|yyuH3PF3t0j$s#=YwOdjQFd!4Y)#+4n zY*xJq%Jx0zS@u+Uzz$-FEp+YA>ubRA2g^}UM&m`U++McfD>TJGVef;a(tV4jh9b$w zZ42wr3V1wJVluzQ1tUsJ(cm0>+zRlA9%e4EmN?BA?!K*X87BNnxCiz#QUPw$2AGEt z|ICovfr#U$RAKwFo1d6RV7Yj)7w+A&s8?oCnVlx-ZD{{Hgm?G)>VgHVSxo_>!xAR3 z<7=31zy`^IMKi;AW4v^8EeQ}%qg)l%4UK~!p7ScTpx@y3=bSE;HUWU&LQvLEF06j^qXilh#& z!_l>$G}N4H zPi^3LO%Y#D#?vqy@KMm`(Lenj)?|{c<#wXH=|MBFT%Vy@s+J^R5 ztQu)bBcGJHPvJwe?4z;=TNrP)!1_6gLfbJ}!ID~!H&bgn^||Bs;vH;~x4FuJ!gQT; zdj_$xWs;8P40V3Tgxf@=ukF= zUMFG_GAiw5-`RTSaO7^jFzdSzW?bi`CwX0v0>s_JgDi+SUwWy5Q+Z$r#SEy!FP`<0 z$z{F%fr^J~%JIzDQ9L464qK--Hd7`3K{(_*-8;)0ZR9+rae<*RD)X~bEDlRSW%z4r ze@-trrquu`WINmX`koH|@eCqQH@xjpx!r@gnTc{U)leQ(Wm0+m5?vR>sI9nm^x>0Oe0zS5eTvyny{L{L~VQZQxC*(LT<$lh^+2O5{ z{`DyHJ+tZrU5=Z$xf$D;>*ODoHcf)B49$R4RDiFJ8F(lpfp@ytot+uT-X|vHqzLFl zcmmJe;tI60CnY+Yg`3~(eWnH-){d*)*~js*YvaFf#ivtF;w%9hCIk3BaWhQNHoiY94sUZh>-z0LsN~ zuw*>j3iBaiRip5o?^%1J51swjZ4Cs8;(H(bivGEGCs->}@Y$y=ebe*39CW1w_Be0P z*V~afmY3~T{pZ~KGXWq3M=Ge4Si5ZMV!PDv{SHKFo46`IQ2NJ1k4X(K&cFS>QaQhZ z`(G`v@EFr- zx1O)s1<>Yh%lLwp)r70sT7EfW=XLF7pw(47vxp(#d}r2MFa#6CTz{}x-97e7_$!;J z{C+OK+x$~0+N0*{dEV5Tol%A(8`40>hz^Y3Ki3Zyqb1$X(*$h{^nK23!)NPHq_IhV za6VHdpUA$PQT{o$X1zM~Wo?@MotX9G!Y7RZO&F-5cuRJPjB+Qd%>i> zf^uP(Wid8d<)08cD=vhl?Dw%n;+Y zJ)bZ8tKQ9yJDiy1tzNNkZyO6|)yEhrwrXHoV}zqv+(ixbxo#tUlw;^#_z~JaT$0)B zb@u3F_3-_{qlNZa(Ai1BQgNc9!on<8V}B3OpKpUB^?N}h#%jBlNTPWpx7hV8w`Kx8 zokU42S*wCoX9T5e_~qekdxou5ttX;sZpe*-1fAgGF%^wDM4J6ln2D9WkX*qLNS%f4 z=HG!9hMu|l6R+U&*7jRXv_L`}W3ZK8_L)74heZPt&PqjW=3x%Dg;bVEo<^cEC5=X( zR1M;Ve`rD=Y3~9u?^UUDZfS|Hc`Lz9WP^^EeArP-xQ7xUHjv?$iQm*3cc z8C+ic9k*esI8mBf>~kjBKID7gxl0^Kjg{+TysON2hV!Dy!dNF7oeQ(4aqPd7MRc|r z*?b^es+~wcSiiDw?1`=+-B658PpBmJ8OrX3McrEF;206td7p2&yXQ4*K;FLKqiqQr zDs$24`6PGHV&B;lO;wZYn;AnSWoo?I-^A;U5uF5z&pMXTHP90d7O?};RX&9%V6E}S zEIvol>(GkjGot(LwMo?;(#iVtCKY#^RH@FGegTy%rudDC2W}GAdjWP$L~4e0PKa0exEmEZH{ zC6|i^a1LW-;UjDY%WPNlNq0Oij!h_q zYD3dRJY~p@i?zxU@NE?Xlj~eAOhrj*fzwbEv~f;fh0nTwU9mv68#>xzDe1DrCv~>) zIJR!@Q1%COG`m$*^yv?`M}<(E!pGlAuBo7Fn)k}Z%5b#9(e3%#4riR#OC`GIM7>vM zLhac!C$jpEBYLJhM%4{lzE=iT@yQBwB7rMQGy3|w>?X!H6`k-sk2(kUi)clf35vd zSvEM7$qOz>tY`5{g0Iuw8y2lqBPljshZQ1_&A2PRAo3%Q`-`+ysuHG?M3|eK#0KA1 z?cKiYyx!vSN3xKtIF(NcjP-~ULiK^q?jK*TiDDN}vCg>93{&|@lG zgDMHYHVBdSn5VIc$+K)L50ky-D`Ez$=_GtU;Fl_dRoU#qSTz!~Jl&!vH-^gITRmo2 z`y>-4tCc!l;lrIyV0SgE8>~2ha7>J!{U)mlzqDXdv(PFq`SR{Z%2n!X{ly(VerDAV za>46#XE7}0?HYln^zgFocSRPxs<7TqzW2zULb~xhrvjuaA!HZk-k5d9)#HtXCep7;pGd{77%K zfj)Q6^b6@bzND|)Ly9BCULKq|Sn)Uc?Je3hNDK#$vtnjlNoeIHP}ArrmTQj3=D!5q zy~FoG8p4E)ig$!%T2SGO`D>j+9yN0&rcviahC@&y+bq^Yo%H+~VO(m`tVfyU1%>aW z)!oHuBKAc{u=^Gwy0H?WeoGOz9gsUFhN^N^+w{S8b6qjMe?HYffJ(AKE5r~}7dUH3 z!W+2Idc6P{dZD9N$&Yyus`A!r?<`-`?R+nuZKTP`cUwJZf*4Pv{|X~^IGbuslz4+3 zCRAZ>O{lCcA6@J;hg0_hpOod>#??r#c!XVjtSEM}dgfX2w9wW&{0_}LG=pVy7w2I4`w9h27@nPJaI08seTB@*Z3^)$v7715B&{xq1(pt2MJXjm{o25L zb^Wivfu)N}+u|G)G^338Gl``4(#%MEii@HNfCrJU?)|!{m(=;ALbmQsYj0VjH=0;R zw`nYCc`2TlzphjV`z>F#KrXuJw1dwf3NhI)Uhut;e#>M_4_ankUetO$s#lP|dcS@A zI*d$O`vK-0*idmD#Tl5MzLKJm5IcXLdKOux5?i`OA7z1gKWi7}nqRc!$d}+J=1M$S z;ZUDRf(jd~45lgzwr0;)Vahn2Lqei?t1Ks@8|$at0UI^xXUUMwH8K}Q5~O&u;cIB( z_E-9?{>l(=QjSt(^;OH9UVM_pqV z{Y}9A4gGo*hYK) z(n9|a{0Y6KaE7kY-dxJ4AO-)ZaCuVqweadS0ePE_1>@hK1|~m<&N3lM@$l=(y0`|24n^MAx_rdaysS?0@yhB!U|v7blpopMB>Kk4n7dVSYvZ z&I3-3{v(_3oqXbL#azW29#6!SGJDsJ;!D9l+a~|WsFybMnv#w@TCkgp7Xv1okNA8u z7Iv`z*Iox8Hi2_IwnF-!^^=7V2z>NzeYfB;OS@ ztA#!3jNU@*?l`S+CxHfHrE)u47QNn;rmjWt*|qOI0=HnqJ!AIF+k)B`*y8PM!G7k8 zKH#*`yjFJUA1!>O)PYT>TqjuQh4^+`%zk#sPiubj>ivB7(S~bCga=O-H zL*RN{r60Mo%%-6lv-O?@6!W5r-mOdU)z}BA%*z zzig+sEe&@F(8T9sf4CHeZ>lBy(_p z4&Not(MWP`dc2J>XAu=o+M|xX>!JBWkn4=2qfnrrh|IN3qOrtu?n%PlAw#?9=-6l)R_4+=W zU&#OUvYJW*v<`>0=W#(MC?`UqKQNQ_CXQrnzrYLz*=jOAiz4AeridBuG2PG4`qv#3 zj)Trmm8D)1hz3>JV5%ynKD4XYnys49yf32PRSvIE_dJURa++@r2Xrjo6_w)J=u~8% zY57fR#BmimZ(b%MBrN=-*RO&q16P*vIHz+=%ha$6^%}D?9RLcR_MG;QBK7t{7w&+1 zsL}i#;5^$FfHg0xp59^&D7=qpWI!RNJLw5cx3&xN2zBju&V%XqXK2yg|0O2ka-N3I zExhf&|E4R9R-Hrt)PQ~(WCg=#}%@6UM8K1{B!F4gdreQ z20Q^<0mNpC#~r6%ywVgA|MjAKc?WES%X0{7hEi$54bZ_Jf9oR{#vs8`&0!Uao^`!7 zC7?$sxnq=tD2oy9L?zCM-Mspjk%%HXJ=A_om?Be z@C}Ukd`GFED}qvoW?~BG`9Imzzk>K}n_=TZPX$nu?t_Hc3K)iPl-Gw1(3yR)i!`ox zm0ggzp_iQomj>xz>eA4j&}3cJD>w@bCD4;RQ@QmOao#)}GXkX9oRM& zs3zr{I*;Oqo-a*~0(T-j&Bg*?xV5P@*K2G$>?= z?8`Km5+RJxWY>c1*)s^E(nF;ZvQO4QOt!|p)Pu?zBkM$ueK6J`#_+rJyuYWZ_kI6- z|9C&2-~4fZW=k%89q#r4SmsJWmhxo)}H?KCahPHp;8AwwtN#rhLFLHM5v_nsJj?`?so zVQ;_q?bbUv63+noi9cM^9$D#M_5x4Z#jz6A%~5=lHN<%3-?Bpl89ju7Wicpeto_C9 z|8R%*?f`EqbT?8}^S}G||6KO(Smqzy{2!@AI{W)Y8bdUyLo5 ze#j)u#G$3Rf7(EAO2VEo>lB)Wd77;&Q%?{>&O7L7Y|OZyzbi}kk7iyr@!8hK>X=iy zHV4j;1Lp&y=Z{^Q_zGQ4_z0;}_MQ|DWnf|x{CUtsIPRtU`QyZhFeAD$N-aF^_Y?p5 z^ZzH+@uhf9cZmqVP?xBy0-d-V!vIg#3!4Ul3M<;Nl9t*RB8Ogs#F%x<UT?0Z^E9fYa*Og$vmR;6GzhQvG?ziKGXdh&BK&h>JPr))5Pp3EQ0^-&5WQT2Mc3T=2RVE=}RnC1a z1>^= z^=5p6Sh4fY@wLs3jjHk_W=g&~IcNi|gjIGKxZ2Rr(2Aw{7+ntdFWz<-91;hz31OR? znq)J`?Vd?lWqL1-J5p0HsaXOIZS;beFrwAqM57453B@Q(YQS5oBmb6hhfZsD&-#+J zed7yUM_3NZyG93N;o&O%qN1S2Jv+<(2Z<$8jPGB$VMtWjyJbZMWf=D zyuInpZ`y=n3=wNo_}w!8i-@{`bSp0U0T1lqCX}4P4qA^JrKlBv)F@erV1N|z`IHN0 z^lZa{{tvNI>|2mdTWFC;tE$aJPJyb-5Cg4DG7gFCwT|D8T%(bxkQM6ub~mgi-vL## zGpAs82kSYy+oY!Vb4GKiW5-&aZJkZAy~fs^l237x8J2nnjVP$;9T{-PCWU?)u+UIt zCT5D%UXn+f?M?K?_2A8GnaaVjt{_XTJ#YMmk;Loq6C{cc{vgiYadAf3HM^oDCl}OE zBc-5@WF`T%Agv6YeQk)EYSjSiu|SIoiFX7?=e+ro!=>vyZON*jDz063wMzi1QP4bi zFZWtFwWcDt@)I|qyRk`^9tQm4lPlBms6Ht;7YE0eZzqtc#`s5FZW$Q?o zyZpUpzOd)p`#P*%tRCreO^kb`xWf4mTr1Y`VRQ_=hK1*hn;YKaQmYSq}aP8GH5@I#|wL?4^x zjh!BFLerjSNh)-d_8+g=*h?^Y^~#x8dH)Fn`U+{AmYoymXPmKn1_}>;cdysdSSv?M7@{Qwrre zGGwGNKZx6+rS(LP?}rUcv^SnZ6K$4?UMng_2#CU+mpq+SzH?JU zGQda@QTLMUtj8kZw7(h;m$3z&i?KPLvo!7zn^NR4SQvFBF>s7Vl+-ow}WoOshcgB|a2DRnA$2ojQP65|jZfJSxeSU8P6bTpgm zzzQ|O2k<0Igc?9|;hTqlq2+Rdfd(#5YLKe1}&^36fJ?oz_@ygR)q5_S&d zVo8&2HJl__Sy|9L`08iAbhGYz%lsbYHu~`e1OZ<6-sOx4Re12yi|O{+;J-$nO}Htn zfcKvpXKW0kD``x^i}F-HX)6Rs-Zr3-F9t@?0$AZNqEGTedWhQqhzF}+2NT??J`U6~ z2Ez(eZjXdkuI*L6=J#xMtGYvq7vh*|YdaPoI;f6^*^PLoV!rk=k6MVf4j>anj?pgl zNh202Z-%3+tg7Exlyygq>OgxfYF)!h5(d$DKBzu5r*<)N(xPCXv^U1hGEgzYT{)fq zW*iA;Q*m{5KSSUnfwki6ZIa`&@$BsS!|^hKmaiNFs$sKy90id1k+bq1VA~Lw*Ey_7 z&fDcv@ORhhLW>-ZsIrlcd>*x;bDi854M5CvA5K&+*?QK`0xR=Rv(1h4`{Pd38!<%` z0Z~#~<@H=xKy9@%BU;J${R1wQ4v)dM!CCn!zy2!DwZK|x0}o-?y2Nm`W_q;gk!gjO zeaiTB$z-c?Nq5iXpy-X6m|;RHY&ieovm{05G4FQToE#-!`H(Y-fb@A!VM%ElJXBqy z6--@OkibF|TE?M1q;FE*bvY-{e)c+Zy=7$M2Q)xG& zf>stqmyeblX>amuXn^Z}>KCD`s(M08Xro4fDYt8ftJT}wPdTRPKo)Vbx;7mS{+=Q8 zwC$#!q_+MBd?UB&%2(9KChtUwzqv@Ht2!G zyN|!P_IM^{UkE43N#L>H4Ls--ljxr*26j|?i*R05cBz~l@iHD3GBo@WsB`ot$4DXz zeXLv5^WD=#I?^;kiYEs*v~_G(q@EegY5OUL1v{u`w0xZlW+UY~EeF!0=)*%0Gi#zz z+N|u8qP&7wdEvif+P|Y)L3t1`FjHEO+1?FsLs#1RNj^UJ(`3{u0v^$oF02_i(|Z`Q zB2^ zV|=R7j{HwcjVz*xy*pn3rz)H?@EbIfua4$(a*d^O^(H<9Ai3 zt*Eyx=m}aXsp=1fhlj%;RQW(|LXB`HH=RD%GU4D#rZ~>=)rZk_XRGc`U#^yaFI_aI z%6X%eE3#=@HT>>+!U_h{BA)V;yxUrzhYnV^UjfX;8tSsmu**;Ti7I|`l%6%pd%@16 z^mK6E^?<_{_UVMsRuTGXt3RQMSi64aB=d4h*kj*$o2Tp6&;AVVxKugpE5k_-NizT( zr0?!nIGwft?AUw&W-!qV1JU#|!X`K(0UkT#SB8K3?Xd%MC19~rhhdIxt+qq)b}Wdv z&4_S&I&pSx6(;LY%<-ucp{pn8RtaFJay_tI$s=Rr=m8A=5+<#Q;9A+QNu?JO(6IvZ z>Tl+cI6^l`V5l%nu;|;p!G@vzMyK$AAhs$Girq^;H-e#>7_f5M70ldu_g6ZMNOo?5 zb&r54>(5(p=bKD2$P>JQuA Y)d?DHvA;(= (=terraform.version=)+](https://learn.hashicorp.com/tutorials/terraform/install-cli) + + ```code + $ terraform version + # Terraform v(=terraform.version=) + ``` + + To import existing Teleport resources as Terraform resources, you must have + Terraform version `v1.5.0` or above. +- A Terraform Cloud account and project. +- The Teleport Terraform provider, v16.3.0 or later + +[//]: # (TODO: verify which Teleport release will contain the TF Cloud method) + +## Step 1/4: Configure Terraform Cloud joining + +To start, the Teleport Auth Service needs to be configured to accept join +requests from Terraform Cloud runs. + +1. Create a folder called `teleport-terraform` to hold temporary files: + + ```code + $ mkdir -p teleport-terraform + $ cd teleport-terraform + ``` +1. The Terraform provider needs a role allowing it to manage Teleport resources. + Create a file named `terraform_role.yaml` with this content: + + ```yaml + kind: role + metadata: + name: terraform + spec: + allow: + db_labels: + '*': '*' + app_labels: + '*': '*' + node_labels: + '*': '*' + rules: + - resources: + - app + - bot + - cluster_auth_preference + - cluster_networking_config + - db + - device + - github + - login_rule + - oidc + - okta_import_rule + - role + - saml + - session_recording_config + - token + - trusted_cluster + - user + - access_list + - node + verbs: ['list','create','read','update','delete'] + version: v7 + ``` +1. Create the role: + + ```code + $ tctl create -f terraform_role.yaml + role 'terraform' has been created + ``` + +1. The Terraform provider uses Machine ID to authenticate, so a Bot needs to be + defined on the cluster, and needs to be allowed to use the role you just + created. Create a file named `terraform_bot.yaml` with this content: + + ```yaml + kind: bot + metadata: + name: terraform + spec: + roles: + - terraform + version: v1 + ``` + +1. Create the bot from the new YAML manifest: + + ```code + $ tctl create -f terraform_bot.yaml + bot 'terraform' has been created + ``` + +1. Finally, the new bot needs to be allowed to authenticate with Terraform Cloud + Workload Identity credentials. Create a file named `terraform_token.yaml` + with this content: + + ```yaml + kind: token + version: v2 + metadata: + name: terraform + spec: + roles: [Bot] + join_method: terraform_cloud + bot_name: terraform + terraform: + allow: + - organization_name: ExampleOrganization + project_name: example-project + workspace_name: example-workspace + ``` + + This token, named `terraform`, allows Terraform Cloud runs to authenticate + with Teleport when all 3 of the values allowed in the token match those + of the job run by Terraform Cloud. + + Make sure to replace the organization, project, and workspace names to match + your Terraform Cloud project or projects. If desired, the fields + `organization_id`, `project_id`, and `workspace_id` can be used as well to + specify †he exact resource IDs. The values must exactly match those shown in + the Terraform Cloud dashboard. + + Note that each `allow` rule must specify at least an `organization_name` or + `organization_id`, and at least one other option (workspace and/or project). + If desired, all workspaces under a project can be allowed by leaving + `workspace_name` (or `workspace_id`) unset. You can specify as many `allow` + rules as you want, and at least one must match for a run to be able to join. + +1. Lastly, create the token: + + ```code + $ tctl create -f terraform_token.yaml + token 'terraform' has been created + ``` + + +## Step 2/4: Configure Terraform Cloud to issue Workload Identity tokens + +Terraform Cloud needs to be configured to issue JWTs during runs. This only +requires that an environment variable is set in the Terraform Cloud dashboard. +To do so: + +1. Navigate to https://app.terraform.io/ +1. Navigate to your desired organization, project, and workspace +1. From the workspace sidebar, select "Variables" +1. Under "Workspace Variables", click the "Add variable" button +1. Select the "Environment variable" ("env") category +1. For the key, enter: `TFC_WORKLOAD_IDENTITY_AUDIENCE_TELEPORT` +1. For the value, enter your Teleport cluster name. If using Teleport Cloud, + this would look like `example.teleport.sh`. +1. If desired, enter a description. For example, "Workload identity token + request for Teleport" + +The end result should look like this: + +![Terraform Cloud Dashboard Example](../../../../img/machine-id/terraform-cloud-variables.png) + +Once this variable is set, all subsequent runs in this workspace will be issued +JWTs. + +## Step 3/4: Configure the Terraform Provider + +In your `provider.tf` or similar, configure the `teleport` provider: + +```terraform +provider "teleport" { + addr = "example.teleport.sh:443" + join_method = "terraform_cloud" + join_token = "terraform" + audience_tag = "teleport" +} +``` + +Critically, these parameters should be set: +* `addr` should match the public hostname and port of your Teleport cluster +* `join_method` should be `terraform_cloud` +* `join_token` should match the name of the `token` resource created in Step #2 +* `audience_tag` should match the suffix on the key of the variable created in + the Terraform Cloud dashboard. For example, given the variable key + `TFC_WORKLOAD_IDENTITY_AUDIENCE_TELEPORT`, the audience tag should be + `teleport`. + +For a complete example, consider this minimal `provider.tf`: + +```terraform +terraform { + cloud { + organization = "ExampleOrganization" + + workspaces { + name = "example-workspace" + } + } + + required_providers { + teleport = { + source = "terraform.releases.teleport.dev/gravitational/teleport" + version = "17.0.0-dev.1" + } + } +} + +provider "teleport" { + addr = "example.teleport.sh:443" + join_method = "terraform_cloud" + join_token = "terraform" + audience_tag = "teleport" +} + +resource "teleport_role" "test" { + version = "v7" + metadata = { + name = "test" + description = "Dummy role to validate Terraform Provider setup" + labels = { + test = "yes" + } + } +} +``` + +## Step 4/4: Run Terraform + +You should now be able to perform a Terraform `plan` or `apply`. Both the CLI +and API/Git triggers are supported. + +Assuming your local `terraform` is authenticated to Terraform Cloud, try: +```code +$ terraform plan +``` + +The workflow should successfully execute, depending on your Terraform +configuration. diff --git a/docs/pages/includes/provision-token/terraform-spec.mdx b/docs/pages/includes/provision-token/terraform-spec.mdx new file mode 100644 index 0000000000000..cd6c23953f29a --- /dev/null +++ b/docs/pages/includes/provision-token/terraform-spec.mdx @@ -0,0 +1,39 @@ +```yaml +kind: token +version: v2 +metadata: + name: terraform +spec: + roles: [Bot] + join_method: terraform + + # This must match a bot name, created either with `tctl bots add` or by + # creating a `bot` resource. + bot_name: terraform + + terraform: + # Manually override the expected audience. If unset, defaults to the + # Teleport cluster name. It is not recommended to override this value. + audience: '' + + allow: + # At least one of `organization_name` or `organization_id` must be set. + # Values are case and whitespace sensitive. + - organization_name: OrgName + organization_id: org-foo + + # At least one of `project_name`, `project_id`, `workspace_name`, or + # `workspace_id` must also be set. + project_name: ProjectName + project_id: prj-bar + + # If no `workspace_name` or `workspace_id` are set, all workspaces + # within the specified project will be allowed to join. + workspace_name: WorkspaceName + workspace_id: ws-baz + + # If set, requires that a run be using a particular run phase. For + # example, this could allow a particular run to only be used for + # planning. Valid values: empty, `plan`, or `apply`. + run_phase: '' +``` From 9b7b22fcd0a5b89db7ed7eaf31a2958f1bc761da Mon Sep 17 00:00:00 2001 From: Tim Buckley Date: Thu, 5 Sep 2024 19:37:10 -0600 Subject: [PATCH 02/12] Various verbiage changes; include Terraform Enterprise Also added a troubleshooting section --- .../machine-id/deployment/terraform-cloud.mdx | 132 ++++++++++++++---- 1 file changed, 104 insertions(+), 28 deletions(-) diff --git a/docs/pages/enroll-resources/machine-id/deployment/terraform-cloud.mdx b/docs/pages/enroll-resources/machine-id/deployment/terraform-cloud.mdx index 3d3ea55ab6047..1489c82ae3910 100644 --- a/docs/pages/enroll-resources/machine-id/deployment/terraform-cloud.mdx +++ b/docs/pages/enroll-resources/machine-id/deployment/terraform-cloud.mdx @@ -7,7 +7,7 @@ When running the Teleport Terraform provider on Terraform Cloud, you can use its built-in Machine ID support to dynamically authenticate to your Teleport cluster without any shared secrets. -Run when in this configuration, the Terraform provider proves its identity to +When run in this configuration, the Terraform provider proves its identity to the Teleport Auth Service using Terraform Cloud's [Workload Identity] tokens. [Workload Identity]: https://developer.hashicorp.com/terraform/cloud-docs/workspaces/dynamic-provider-credentials/workload-identity-tokens @@ -16,6 +16,11 @@ While following this guide, you'll configure your Teleport cluster to accept join requests from Terraform Cloud runs and configure the provider to authenticate using the Terraform Cloud join method. +Note that this guide applies to both the public HCP Terraform a.k.a. Terraform +Cloud SaaS, as well as self-hosted Terraform Enterprise. This does **not** apply +to Terraform or OpenTofu when run on other CI/CD platforms like Spacelift, so +refer to guides that apply to your particular environment where available. + ## Prerequisites (!docs/pages/includes/commercial-prereqs-tabs.mdx!) @@ -30,12 +35,13 @@ authenticate using the Terraform Cloud join method. To import existing Teleport resources as Terraform resources, you must have Terraform version `v1.5.0` or above. -- A Terraform Cloud account and project. +- An account and project on either the public Terraform Cloud SaaS or a + Terraform Enterprise instance - The Teleport Terraform provider, v16.3.0 or later [//]: # (TODO: verify which Teleport release will contain the TF Cloud method) -## Step 1/4: Configure Terraform Cloud joining +## Step 1/4: Configure Terraform Cloud joining in Teleport To start, the Teleport Auth Service needs to be configured to accept join requests from Terraform Cloud runs. @@ -114,23 +120,59 @@ requests from Terraform Cloud runs. 1. Finally, the new bot needs to be allowed to authenticate with Terraform Cloud Workload Identity credentials. Create a file named `terraform_token.yaml` - with this content: - - ```yaml - kind: token - version: v2 - metadata: - name: terraform - spec: - roles: [Bot] - join_method: terraform_cloud - bot_name: terraform - terraform: - allow: - - organization_name: ExampleOrganization - project_name: example-project - workspace_name: example-workspace + with this content, depending on whether you are using Terraform Cloud or + self-hosted Terraform Enterprise: + + + + ```yaml + kind: token + version: v2 + metadata: + name: terraform + spec: + roles: [Bot] + join_method: terraform_cloud + bot_name: terraform + terraform: + allow: + - organization_name: ExampleOrganization + project_name: example-project + workspace_name: example-workspace ``` + + + Self-hosted Terraform Enterprise installations will need to additionally + configure the `hostname` parameter: + + ```yaml + kind: token + version: v2 + metadata: + name: terraform + spec: + roles: [Bot] + join_method: terraform_cloud + bot_name: terraform + terraform: + hostname: terraform.example.com + allow: + - organization_name: ExampleOrganization + project_name: example-project + workspace_name: example-workspace + ``` + + This `hostname` value should match the `iss` parameter of the JWTs issued + to your Terraform Enterprise runs, without the `https://` prefix. For more + information, refer to the [Terraform Enterprise documentation][tfe-docs]. + + Note that if `hostname` is not configured, it will default to the Terraform + Cloud issuer and join attempts will fail. + + [tfe-docs]: https://developer.hashicorp.com/terraform/enterprise/workspaces/dynamic-provider-credentials/workload-identity-tokens + + + This token, named `terraform`, allows Terraform Cloud runs to authenticate with Teleport when all 3 of the values allowed in the token match those @@ -139,8 +181,8 @@ requests from Terraform Cloud runs. Make sure to replace the organization, project, and workspace names to match your Terraform Cloud project or projects. If desired, the fields `organization_id`, `project_id`, and `workspace_id` can be used as well to - specify †he exact resource IDs. The values must exactly match those shown in - the Terraform Cloud dashboard. + specify exact resource IDs. The values must exactly match those shown in the + Terraform Cloud dashboard. Note that each `allow` rule must specify at least an `organization_name` or `organization_id`, and at least one other option (workspace and/or project). @@ -178,13 +220,14 @@ The end result should look like this: ![Terraform Cloud Dashboard Example](../../../../img/machine-id/terraform-cloud-variables.png) Once this variable is set, all subsequent runs in this workspace will be issued -JWTs. +JWTs with the audience configured in the variable value, i.e. +`example.teleport.sh` as shown here. ## Step 3/4: Configure the Terraform Provider In your `provider.tf` or similar, configure the `teleport` provider: -```terraform +```hcl provider "teleport" { addr = "example.teleport.sh:443" join_method = "terraform_cloud" @@ -195,16 +238,20 @@ provider "teleport" { Critically, these parameters should be set: * `addr` should match the public hostname and port of your Teleport cluster -* `join_method` should be `terraform_cloud` +* `join_method` should be `terraform_cloud`. Note that Terraform Enterprise also + uses the same join method, with a hostname as configured in Step 1. * `join_token` should match the name of the `token` resource created in Step #2 * `audience_tag` should match the suffix on the key of the variable created in the Terraform Cloud dashboard. For example, given the variable key `TFC_WORKLOAD_IDENTITY_AUDIENCE_TELEPORT`, the audience tag should be `teleport`. +Be sure to remove any preexisting `identity_file_path`; it is replaced by +`join_method` and `join_token`. + For a complete example, consider this minimal `provider.tf`: -```terraform +```hcl terraform { cloud { organization = "ExampleOrganization" @@ -217,7 +264,7 @@ terraform { required_providers { teleport = { source = "terraform.releases.teleport.dev/gravitational/teleport" - version = "17.0.0-dev.1" + version = "(=teleport.plugin.version=)" } } } @@ -243,8 +290,9 @@ resource "teleport_role" "test" { ## Step 4/4: Run Terraform -You should now be able to perform a Terraform `plan` or `apply`. Both the CLI -and API/Git triggers are supported. +You should now be able to perform a Terraform `plan` or `apply`. All types of +triggers should work, including CLI, API, and Git, so long as the run is +coordinated by Terraform Cloud. Assuming your local `terraform` is authenticated to Terraform Cloud, try: ```code @@ -253,3 +301,31 @@ $ terraform plan The workflow should successfully execute, depending on your Terraform configuration. + +## Troubleshooting + +### Extracting a JWT for debugging purposes + +If you need to view a JWT sample for debugging purposes, you can create a +`null_resource` that prints the JWT for the run: + +```hcl +resource "null_resource" "print_token" { + provisioner "local-exec" { + command = "echo TFC_WORKLOAD_IDENTITY_TOKEN_TELEPORT: $TFC_WORKLOAD_IDENTITY_TOKEN_TELEPORT" + } +} +``` + +Once applied, you should see the encoded JWT printed in your Terraform log. +These values can be decoded either by hand or with any number of tools, for +example [`jwt-cli`]. + +[`jwt-cli`]: https://github.com/mike-engel/jwt-cli + +Note that these JWTs are generally valid for 2 hours and can potentially be used +to authenticate to your Teleport cluster, so this value should be treated with +care. + +This may be useful for determining the exact issuer (`iss`) value needed to +configure Terraform Enterprise join tokens, or if you need to request support. From e306701c5b59e8711be3c7674343da69838003c0 Mon Sep 17 00:00:00 2001 From: Tim Buckley Date: Thu, 5 Sep 2024 19:47:26 -0600 Subject: [PATCH 03/12] Link to new guide from existing terraform provider page --- .../infrastructure-as-code/terraform-provider.mdx | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider.mdx b/docs/pages/admin-guides/infrastructure-as-code/terraform-provider.mdx index 54dc82d481a11..6b77550614408 100644 --- a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider.mdx +++ b/docs/pages/admin-guides/infrastructure-as-code/terraform-provider.mdx @@ -18,6 +18,9 @@ For instructions on managing the Teleport dynamic resources as code using GitOps, read the guide to using the Teleport Terraform provider with [Spacelift and Machine ID](../../enroll-resources/machine-id/deployment/spacelift.mdx). +If using HCP Terraform (Terraform Cloud) or Terraform Enterprise, refer to our +[dedicated Terraform Cloud setup guide](../../enroll-resources/machine-id/deployment/terraform-cloud.mdx). + ## Prerequisites (!docs/pages/includes/edition-prereqs-tabs.mdx!) @@ -154,7 +157,7 @@ To prepare a Terraform configuration file: 1. Create a new file called `provider.tf` and open it in an editor. -1. Use the Teleport Terraform provider and connect it to your Teleport cluster +1. Use the Teleport Terraform provider and connect it to your Teleport cluster by pasting the following content into the `provider.tf` file: @@ -207,7 +210,7 @@ To apply the configuration: ## Step 4/4. [Optional] Import existing resources This section shows you how to import existing dynamic Teleport resources as -Terraform resources. +Terraform resources. If you already created Teleport resources using another client tool like `tctl` or the Kubernetes Operator, and want to manage all Teleport resources using your From 6aeee36410c7769f142d6e75d0e65f17d6ee94cb Mon Sep 17 00:00:00 2001 From: Tim Buckley Date: Fri, 6 Sep 2024 18:49:00 -0600 Subject: [PATCH 04/12] Move to the new Terraform Provider section This moves the Terraform Cloud docs to the new Terraform Provider section, and rewrites some things to account for the new changes in other terraform provider pages, e.g. the new builtin `terraform-provider` role. --- .../terraform-cloud-variables.png | Bin .../terraform-provider.mdx | 5 +- .../terraform-provider/ci-or-cloud.mdx | 3 + .../terraform-provider}/terraform-cloud.mdx | 282 ++++++++---------- .../provision-token/terraform-spec.mdx | 5 + 5 files changed, 131 insertions(+), 164 deletions(-) rename docs/img/{machine-id => infrastructure-as-code}/terraform-cloud-variables.png (100%) rename docs/pages/{enroll-resources/machine-id/deployment => admin-guides/infrastructure-as-code/terraform-provider}/terraform-cloud.mdx (51%) diff --git a/docs/img/machine-id/terraform-cloud-variables.png b/docs/img/infrastructure-as-code/terraform-cloud-variables.png similarity index 100% rename from docs/img/machine-id/terraform-cloud-variables.png rename to docs/img/infrastructure-as-code/terraform-cloud-variables.png diff --git a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider.mdx b/docs/pages/admin-guides/infrastructure-as-code/terraform-provider.mdx index 4f4919dedfd78..f92d2000df778 100644 --- a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider.mdx +++ b/docs/pages/admin-guides/infrastructure-as-code/terraform-provider.mdx @@ -17,14 +17,15 @@ is executed. You must pick the correct guide for your setup: | Guide | Use-case | How it works | |---------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------| -| [Run the Teleport Terraform provider locally](./terraform-provider/local.mdx) | This is the best way to get started with the Teleport terraform provider, write some initial Terraform code and get familiar with IaC. | You're using you local credentials to create a temporary bot, obtain short-lived credentials, and store them in environment variables. | +| [Run the Teleport Terraform provider locally](./terraform-provider/local.mdx) | This is the best way to get started with the Teleport terraform provider, write some initial Terraform code and get familiar with IaC. | You're using local credentials to create a temporary bot, obtain short-lived credentials, and store them in environment variables. | +| [Run the Teleport Terraform provider on Terraform Cloud](./terraform-provider/terraform-cloud.mdx) | You're running on HCP Terraform (Terraform Cloud) or self-hosted Terraform Enterprise. | Terraform Cloud Workload Identity issues a proof of identity and the Teleport Terraform provider uses it to authenticate. | | [Run the Teleport Terraform provider in CI or a cloud VM](./terraform-provider/ci-or-cloud.mdx) | You already have a working Terraform module configuring Teleport and want to run it in CI to benefit from review and audit capabilities from your versioning system (e.g. git). | You're using a proof provided by your runtime (CI engine, cloud provider) to prove your identity and join using MachineID. | | [Run the Teleport Terraform provider from a server](./terraform-provider/dedicated-server.mdx) | You have working Terraform code and want to run it on a dedicated server. The server is long-lived, like a bastion or a task runner. | You setup a MachineID daemon (`tbot`) that obtains and refreshes credentials for the Terraform provider. | | [Run the Teleport Terraform provider with long-lived credentials.](./terraform-provider/long-lived-credentials.mdx) | This method is discouraged as less secure than the 3 others. This should be used when none of the other methods work in your case (short-lived CI environments that don't have dedicated Teleport join methods). | You sign one long lived certificate allowing the Terraform provider to connect to Teleport. | ## Resource guides -Once you have a functional Teleport Terraform provider, you will want to configure your resources with it. +Once you have a functional Teleport Terraform provider, you will want to configure your resources with it. You can find the list of supported resources and their fields is available [in the Terraform reference](../../reference/terraform-provider.mdx). diff --git a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/ci-or-cloud.mdx b/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/ci-or-cloud.mdx index 9f9602237ba08..be157ddd0abc1 100644 --- a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/ci-or-cloud.mdx +++ b/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/ci-or-cloud.mdx @@ -23,6 +23,9 @@ join method and token to the provider. - [Kubernetes MachineID guide](../../../enroll-resources/machine-id/deployment/kubernetes.mdx) - [TPM MachineID guide](../../../enroll-resources/machine-id/deployment/linux-tpm.mdx) +HCP Terraform (Terraform Cloud) and self-hosted Terraform Enterprise are +supported but require special configuration, so refer to our +[dedicated guide](./terraform-cloud.mdx). This guide does not cover running Teleport locally or on a dedicated server. diff --git a/docs/pages/enroll-resources/machine-id/deployment/terraform-cloud.mdx b/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx similarity index 51% rename from docs/pages/enroll-resources/machine-id/deployment/terraform-cloud.mdx rename to docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx index 1489c82ae3910..a4e219e0ab8ce 100644 --- a/docs/pages/enroll-resources/machine-id/deployment/terraform-cloud.mdx +++ b/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx @@ -1,14 +1,21 @@ --- -title: Authenticating with Machine ID on Terraform Cloud -description: How to use Machine ID to authenticate the Teleport Terraform provider on Terraform Cloud +title: Run the Teleport Terraform Provider on Terraform Cloud +description: How to manage dynamic resources using the Teleport Terraform provider on HCP Terraform, Terraform Cloud, and Terraform Enterprise. --- +## Introduction + + + Terraform Cloud joining with self-hosted Terraform Enterprise requires + Teleport Enterprise. Terraform Cloud joining with public HCP Terraform + (https://app.terraform.io) is supported in Teleport OSS. + + When running the Teleport Terraform provider on Terraform Cloud, you can use its built-in Machine ID support to dynamically authenticate to your Teleport cluster -without any shared secrets. - -When run in this configuration, the Terraform provider proves its identity to -the Teleport Auth Service using Terraform Cloud's [Workload Identity] tokens. +without any shared secrets. When run in this configuration, the Terraform +provider proves its identity to the Teleport Auth Service using Terraform +Cloud's [Workload Identity] tokens. [Workload Identity]: https://developer.hashicorp.com/terraform/cloud-docs/workspaces/dynamic-provider-credentials/workload-identity-tokens @@ -17,9 +24,10 @@ join requests from Terraform Cloud runs and configure the provider to authenticate using the Terraform Cloud join method. Note that this guide applies to both the public HCP Terraform a.k.a. Terraform -Cloud SaaS, as well as self-hosted Terraform Enterprise. This does **not** apply +Cloud, as well as self-hosted Terraform Enterprise. This does **not** apply to Terraform or OpenTofu when run on other CI/CD platforms like Spacelift, so -refer to guides that apply to your particular environment where available. +refer to our generic [CI and Cloud guide](./ci-or-cloud.mdx) to configure the +provider in these environments. ## Prerequisites @@ -44,159 +52,109 @@ refer to guides that apply to your particular environment where available. ## Step 1/4: Configure Terraform Cloud joining in Teleport To start, the Teleport Auth Service needs to be configured to accept join -requests from Terraform Cloud runs. - -1. Create a folder called `teleport-terraform` to hold temporary files: - - ```code - $ mkdir -p teleport-terraform - $ cd teleport-terraform - ``` -1. The Terraform provider needs a role allowing it to manage Teleport resources. - Create a file named `terraform_role.yaml` with this content: - - ```yaml - kind: role - metadata: - name: terraform - spec: - allow: - db_labels: - '*': '*' - app_labels: - '*': '*' - node_labels: - '*': '*' - rules: - - resources: - - app - - bot - - cluster_auth_preference - - cluster_networking_config - - db - - device - - github - - login_rule - - oidc - - okta_import_rule - - role - - saml - - session_recording_config - - token - - trusted_cluster - - user - - access_list - - node - verbs: ['list','create','read','update','delete'] - version: v7 - ``` -1. Create the role: - - ```code - $ tctl create -f terraform_role.yaml - role 'terraform' has been created - ``` - -1. The Terraform provider uses Machine ID to authenticate, so a Bot needs to be - defined on the cluster, and needs to be allowed to use the role you just - created. Create a file named `terraform_bot.yaml` with this content: - - ```yaml - kind: bot - metadata: - name: terraform - spec: - roles: - - terraform - version: v1 - ``` - -1. Create the bot from the new YAML manifest: - - ```code - $ tctl create -f terraform_bot.yaml - bot 'terraform' has been created - ``` - -1. Finally, the new bot needs to be allowed to authenticate with Terraform Cloud - Workload Identity credentials. Create a file named `terraform_token.yaml` - with this content, depending on whether you are using Terraform Cloud or - self-hosted Terraform Enterprise: - - - - ```yaml - kind: token - version: v2 - metadata: - name: terraform - spec: - roles: [Bot] - join_method: terraform_cloud - bot_name: terraform - terraform: - allow: - - organization_name: ExampleOrganization - project_name: example-project - workspace_name: example-workspace - ``` - - - Self-hosted Terraform Enterprise installations will need to additionally - configure the `hostname` parameter: - - ```yaml - kind: token - version: v2 - metadata: - name: terraform - spec: - roles: [Bot] - join_method: terraform_cloud - bot_name: terraform - terraform: - hostname: terraform.example.com - allow: - - organization_name: ExampleOrganization - project_name: example-project - workspace_name: example-workspace - ``` - - This `hostname` value should match the `iss` parameter of the JWTs issued - to your Terraform Enterprise runs, without the `https://` prefix. For more - information, refer to the [Terraform Enterprise documentation][tfe-docs]. - - Note that if `hostname` is not configured, it will default to the Terraform - Cloud issuer and join attempts will fail. - - [tfe-docs]: https://developer.hashicorp.com/terraform/enterprise/workspaces/dynamic-provider-credentials/workload-identity-tokens - - - - - This token, named `terraform`, allows Terraform Cloud runs to authenticate - with Teleport when all 3 of the values allowed in the token match those - of the job run by Terraform Cloud. - - Make sure to replace the organization, project, and workspace names to match - your Terraform Cloud project or projects. If desired, the fields - `organization_id`, `project_id`, and `workspace_id` can be used as well to - specify exact resource IDs. The values must exactly match those shown in the - Terraform Cloud dashboard. - - Note that each `allow` rule must specify at least an `organization_name` or - `organization_id`, and at least one other option (workspace and/or project). - If desired, all workspaces under a project can be allowed by leaving - `workspace_name` (or `workspace_id`) unset. You can specify as many `allow` - rules as you want, and at least one must match for a run to be able to join. - -1. Lastly, create the token: - - ```code - $ tctl create -f terraform_token.yaml - token 'terraform' has been created - ``` +requests from Terraform Cloud runs. We'll do this by creating [a bot] named +`terraform` which the Teleport Terraform provider will use in a later step. + +[a bot]: ../../../reference/architecture/machine-id-architecture.mdx#what-is-a-bot + +```yaml +kind: bot +version: v1 +metadata: + name: terraform +spec: + # The terraform-provider role is a built-in role granting access to every + # resource supported by the terraform provider. + roles: ["terraform-provider"] +``` + +Create the bot from the new YAML manifest: +```code +$ tctl create -f terraform_bot.yaml +bot 'terraform' has been created +``` + +Next, the new bot needs to be allowed to authenticate with Terraform Cloud +Workload Identity credentials. Create a file named `terraform_token.yaml` +with this content, depending on whether you are using Terraform Cloud or +self-hosted Terraform Enterprise: + + + + ```yaml + kind: token + version: v2 + metadata: + name: terraform + spec: + roles: [Bot] + join_method: terraform_cloud + bot_name: terraform + terraform: + allow: + - organization_name: ExampleOrganization + project_name: example-project + workspace_name: example-workspace +``` + + + + Teleport Enterprise is required to use Terraform Enterprise joining. + + + Self-hosted Terraform Enterprise installations will need to additionally + configure the `hostname` parameter: + + ```yaml + kind: token + version: v2 + metadata: + name: terraform + spec: + roles: [Bot] + join_method: terraform_cloud + bot_name: terraform + terraform: + hostname: terraform.example.com + allow: + - organization_name: ExampleOrganization + project_name: example-project + workspace_name: example-workspace + ``` + + This `hostname` value should match the `iss` parameter of the JWTs issued + to your Terraform Enterprise runs, without the `https://` prefix. For more + information, refer to the [Terraform Enterprise documentation][tfe-docs]. + Note that if `hostname` is not configured, it will default to the Terraform + Cloud issuer and join attempts will fail. + + [tfe-docs]: https://developer.hashicorp.com/terraform/enterprise/workspaces/dynamic-provider-credentials/workload-identity-tokens + + + +This token, named `terraform`, allows Terraform Cloud runs to authenticate +with Teleport when all 3 of the values allowed in the token match those +of the job run by Terraform Cloud. + +Make sure to replace the organization, project, and workspace names to match +your Terraform Cloud project or projects. If desired, the fields +`organization_id`, `project_id`, and `workspace_id` can be used as well to +specify exact resource IDs. The values must exactly match those shown in the +Terraform Cloud dashboard. + +Note that each `allow` rule must specify at least an `organization_name` or +`organization_id`, and at least one other option (workspace and/or project). +If desired, all workspaces under a project can be allowed by leaving +`workspace_name` (or `workspace_id`) unset. You can specify as many `allow` +rules as you want, and at least one must match for a run to be able to join. + +Once finished, create the token: + +```code +$ tctl create -f terraform_token.yaml +token 'terraform' has been created +``` ## Step 2/4: Configure Terraform Cloud to issue Workload Identity tokens @@ -217,7 +175,7 @@ To do so: The end result should look like this: -![Terraform Cloud Dashboard Example](../../../../img/machine-id/terraform-cloud-variables.png) +![Terraform Cloud Dashboard Example](../../../../img/infrastructure-as-code/terraform-cloud-variables.png) Once this variable is set, all subsequent runs in this workspace will be issued JWTs with the audience configured in the variable value, i.e. @@ -325,7 +283,7 @@ example [`jwt-cli`]. Note that these JWTs are generally valid for 2 hours and can potentially be used to authenticate to your Teleport cluster, so this value should be treated with -care. +care. The full encoded token should not be shared. This may be useful for determining the exact issuer (`iss`) value needed to configure Terraform Enterprise join tokens, or if you need to request support. diff --git a/docs/pages/includes/provision-token/terraform-spec.mdx b/docs/pages/includes/provision-token/terraform-spec.mdx index cd6c23953f29a..2660faccf142b 100644 --- a/docs/pages/includes/provision-token/terraform-spec.mdx +++ b/docs/pages/includes/provision-token/terraform-spec.mdx @@ -16,6 +16,11 @@ spec: # Teleport cluster name. It is not recommended to override this value. audience: '' + # Specify the hostname of a Terraform Enterprise instance. Overriding this + # value to use Terraform Enterprise requires Teleport Enterprise. + # If unset, refers to the public `app.terraform.io` instance. + hostname: '' + allow: # At least one of `organization_name` or `organization_id` must be set. # Values are case and whitespace sensitive. From 54f9726ca51731885abef2b683f77fd7c60411fe Mon Sep 17 00:00:00 2001 From: Tim Buckley Date: Fri, 6 Sep 2024 19:08:41 -0600 Subject: [PATCH 05/12] Fix docs lints --- .../terraform-provider/terraform-cloud.mdx | 28 ++++++++----------- 1 file changed, 12 insertions(+), 16 deletions(-) diff --git a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx b/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx index a4e219e0ab8ce..e73fc86b6d156 100644 --- a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx +++ b/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx @@ -15,9 +15,7 @@ When running the Teleport Terraform provider on Terraform Cloud, you can use its built-in Machine ID support to dynamically authenticate to your Teleport cluster without any shared secrets. When run in this configuration, the Terraform provider proves its identity to the Teleport Auth Service using Terraform -Cloud's [Workload Identity] tokens. - -[Workload Identity]: https://developer.hashicorp.com/terraform/cloud-docs/workspaces/dynamic-provider-credentials/workload-identity-tokens +Cloud's [Workload Identity][tf-workload-id] tokens. While following this guide, you'll configure your Teleport cluster to accept join requests from Terraform Cloud runs and configure the provider to @@ -47,15 +45,13 @@ provider in these environments. Terraform Enterprise instance - The Teleport Terraform provider, v16.3.0 or later -[//]: # (TODO: verify which Teleport release will contain the TF Cloud method) - ## Step 1/4: Configure Terraform Cloud joining in Teleport To start, the Teleport Auth Service needs to be configured to accept join -requests from Terraform Cloud runs. We'll do this by creating [a bot] named -`terraform` which the Teleport Terraform provider will use in a later step. - -[a bot]: ../../../reference/architecture/machine-id-architecture.mdx#what-is-a-bot +requests from Terraform Cloud runs. We'll do this by creating +[a bot](../../../reference/architecture/machine-id-architecture.mdx#what-is-a-bot) +named `terraform` which the Teleport Terraform provider will use in a later +step. ```yaml kind: bot @@ -125,11 +121,9 @@ self-hosted Terraform Enterprise: This `hostname` value should match the `iss` parameter of the JWTs issued to your Terraform Enterprise runs, without the `https://` prefix. For more - information, refer to the [Terraform Enterprise documentation][tfe-docs]. + information, refer to the [Terraform Enterprise documentation][tf-workload-id]. Note that if `hostname` is not configured, it will default to the Terraform Cloud issuer and join attempts will fail. - - [tfe-docs]: https://developer.hashicorp.com/terraform/enterprise/workspaces/dynamic-provider-credentials/workload-identity-tokens @@ -195,11 +189,11 @@ provider "teleport" { ``` Critically, these parameters should be set: -* `addr` should match the public hostname and port of your Teleport cluster -* `join_method` should be `terraform_cloud`. Note that Terraform Enterprise also +- `addr` should match the public hostname and port of your Teleport cluster +- `join_method` should be `terraform_cloud`. Note that Terraform Enterprise also uses the same join method, with a hostname as configured in Step 1. -* `join_token` should match the name of the `token` resource created in Step #2 -* `audience_tag` should match the suffix on the key of the variable created in +- `join_token` should match the name of the `token` resource created in Step #2 +- `audience_tag` should match the suffix on the key of the variable created in the Terraform Cloud dashboard. For example, given the variable key `TFC_WORKLOAD_IDENTITY_AUDIENCE_TELEPORT`, the audience tag should be `teleport`. @@ -287,3 +281,5 @@ care. The full encoded token should not be shared. This may be useful for determining the exact issuer (`iss`) value needed to configure Terraform Enterprise join tokens, or if you need to request support. + +[tf-workload-id]: https://developer.hashicorp.com/terraform/cloud-docs/workspaces/dynamic-provider-credentials/workload-identity-tokens From 7e57d5837b6ccefc152926a717f72f81d31ed427 Mon Sep 17 00:00:00 2001 From: Tim Buckley Date: Fri, 6 Sep 2024 19:18:20 -0600 Subject: [PATCH 06/12] Fix more docs lints --- .../terraform-provider/terraform-cloud.mdx | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx b/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx index e73fc86b6d156..9134b47bf0155 100644 --- a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx +++ b/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx @@ -41,8 +41,10 @@ provider in these environments. To import existing Teleport resources as Terraform resources, you must have Terraform version `v1.5.0` or above. + - An account and project on either the public Terraform Cloud SaaS or a Terraform Enterprise instance + - The Teleport Terraform provider, v16.3.0 or later ## Step 1/4: Configure Terraform Cloud joining in Teleport @@ -273,8 +275,6 @@ Once applied, you should see the encoded JWT printed in your Terraform log. These values can be decoded either by hand or with any number of tools, for example [`jwt-cli`]. -[`jwt-cli`]: https://github.com/mike-engel/jwt-cli - Note that these JWTs are generally valid for 2 hours and can potentially be used to authenticate to your Teleport cluster, so this value should be treated with care. The full encoded token should not be shared. @@ -283,3 +283,4 @@ This may be useful for determining the exact issuer (`iss`) value needed to configure Terraform Enterprise join tokens, or if you need to request support. [tf-workload-id]: https://developer.hashicorp.com/terraform/cloud-docs/workspaces/dynamic-provider-credentials/workload-identity-tokens +[`jwt-cli`]: https://github.com/mike-engel/jwt-cli From 5ab2ec76b9023a397ba0c4fa6363c01e5fadf63b Mon Sep 17 00:00:00 2001 From: Tim Buckley Date: Mon, 9 Sep 2024 17:59:44 -0600 Subject: [PATCH 07/12] Fix docs lints --- .../terraform-provider/terraform-cloud.mdx | 20 ++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx b/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx index 9134b47bf0155..9f391b680ccd7 100644 --- a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx +++ b/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx @@ -3,12 +3,22 @@ title: Run the Teleport Terraform Provider on Terraform Cloud description: How to manage dynamic resources using the Teleport Terraform provider on HCP Terraform, Terraform Cloud, and Terraform Enterprise. --- -## Introduction +This guide demonstrates how to use the Terraform provider for Teleport using +HCP Terraform or Terraform Enterprise. + +This guide does not cover running the Terraform provider locally, in other CI/CD +environments, or in short-lived cloud VMs. In any of these cases, refer to a +dedicated guide: + +- [Run the Terraform Provider in CI or cloud VMs](./ci-or-cloud.mdx) +- [Run the Terraform Provider locally](./local.mdx) + +## How it works Terraform Cloud joining with self-hosted Terraform Enterprise requires Teleport Enterprise. Terraform Cloud joining with public HCP Terraform - (https://app.terraform.io) is supported in Teleport OSS. + (https://app.terraform.io) is supported in Teleport Community Edition. When running the Teleport Terraform provider on Terraform Cloud, you can use its @@ -79,7 +89,7 @@ with this content, depending on whether you are using Terraform Cloud or self-hosted Terraform Enterprise: - + ```yaml kind: token version: v2 @@ -164,8 +174,8 @@ To do so: 1. Under "Workspace Variables", click the "Add variable" button 1. Select the "Environment variable" ("env") category 1. For the key, enter: `TFC_WORKLOAD_IDENTITY_AUDIENCE_TELEPORT` -1. For the value, enter your Teleport cluster name. If using Teleport Cloud, - this would look like `example.teleport.sh`. +1. For the value, enter your Teleport cluster name. If using Teleport Enterprise + Cloud, this would look like `example.teleport.sh`. 1. If desired, enter a description. For example, "Workload identity token request for Teleport" From 2513032c0586746e912a6aeb311d9c67aea04851 Mon Sep 17 00:00:00 2001 From: Tim Buckley Date: Mon, 9 Sep 2024 18:10:03 -0600 Subject: [PATCH 08/12] Fix even more docs lints --- .../infrastructure-as-code/terraform-provider/ci-or-cloud.mdx | 2 +- .../terraform-provider/terraform-cloud.mdx | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/ci-or-cloud.mdx b/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/ci-or-cloud.mdx index be157ddd0abc1..a4403974583d9 100644 --- a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/ci-or-cloud.mdx +++ b/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/ci-or-cloud.mdx @@ -291,7 +291,7 @@ Copy the `main.tf` file on the GCP VM you will run Terraform from. -### Step 4/4. Run Terraform +## Step 4/4. Run Terraform This step shows minimal examples on how to run Terraform based on your environment. This code uses the default local backend which is not fit for production purposes. Especially in CI, you must diff --git a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx b/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx index 9f391b680ccd7..a9c88d9570bd9 100644 --- a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx +++ b/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx @@ -175,7 +175,7 @@ To do so: 1. Select the "Environment variable" ("env") category 1. For the key, enter: `TFC_WORKLOAD_IDENTITY_AUDIENCE_TELEPORT` 1. For the value, enter your Teleport cluster name. If using Teleport Enterprise - Cloud, this would look like `example.teleport.sh`. + (Cloud), this would look like `example.teleport.sh`. 1. If desired, enter a description. For example, "Workload identity token request for Teleport" From 3c2c7cc1e9674300f73c9ef65899fa9d38e1a697 Mon Sep 17 00:00:00 2001 From: Tim Buckley Date: Tue, 10 Sep 2024 17:20:34 -0600 Subject: [PATCH 09/12] Apply suggestions from code review Co-authored-by: Paul Gottschling --- .../infrastructure-as-code/terraform-provider.mdx | 4 ++-- .../terraform-provider/terraform-cloud.mdx | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider.mdx b/docs/pages/admin-guides/infrastructure-as-code/terraform-provider.mdx index f92d2000df778..4c4aaf964fc8a 100644 --- a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider.mdx +++ b/docs/pages/admin-guides/infrastructure-as-code/terraform-provider.mdx @@ -17,11 +17,11 @@ is executed. You must pick the correct guide for your setup: | Guide | Use-case | How it works | |---------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------| -| [Run the Teleport Terraform provider locally](./terraform-provider/local.mdx) | This is the best way to get started with the Teleport terraform provider, write some initial Terraform code and get familiar with IaC. | You're using local credentials to create a temporary bot, obtain short-lived credentials, and store them in environment variables. | +| [Run the Teleport Terraform provider locally](./terraform-provider/local.mdx) | You are getting started with the Teleport Terraform provider and managing Teleport resources with IaC. | You use local credentials to create a temporary bot, obtain short-lived credentials, and store them in environment variables. | | [Run the Teleport Terraform provider on Terraform Cloud](./terraform-provider/terraform-cloud.mdx) | You're running on HCP Terraform (Terraform Cloud) or self-hosted Terraform Enterprise. | Terraform Cloud Workload Identity issues a proof of identity and the Teleport Terraform provider uses it to authenticate. | | [Run the Teleport Terraform provider in CI or a cloud VM](./terraform-provider/ci-or-cloud.mdx) | You already have a working Terraform module configuring Teleport and want to run it in CI to benefit from review and audit capabilities from your versioning system (e.g. git). | You're using a proof provided by your runtime (CI engine, cloud provider) to prove your identity and join using MachineID. | | [Run the Teleport Terraform provider from a server](./terraform-provider/dedicated-server.mdx) | You have working Terraform code and want to run it on a dedicated server. The server is long-lived, like a bastion or a task runner. | You setup a MachineID daemon (`tbot`) that obtains and refreshes credentials for the Terraform provider. | -| [Run the Teleport Terraform provider with long-lived credentials.](./terraform-provider/long-lived-credentials.mdx) | This method is discouraged as less secure than the 3 others. This should be used when none of the other methods work in your case (short-lived CI environments that don't have dedicated Teleport join methods). | You sign one long lived certificate allowing the Terraform provider to connect to Teleport. | +| [Run the Teleport Terraform provider with long-lived credentials.](./terraform-provider/long-lived-credentials.mdx) | This method is discouraged as less secure than the others. This should be used when none of the other methods work in your case (short-lived CI environments that don't have dedicated Teleport join methods). | You sign one long lived certificate allowing the Terraform provider to connect to Teleport. | ## Resource guides diff --git a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx b/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx index a9c88d9570bd9..77d80a127e277 100644 --- a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx +++ b/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx @@ -200,7 +200,7 @@ provider "teleport" { } ``` -Critically, these parameters should be set: +These parameters must be set: - `addr` should match the public hostname and port of your Teleport cluster - `join_method` should be `terraform_cloud`. Note that Terraform Enterprise also uses the same join method, with a hostname as configured in Step 1. From 822f80d4893a5bd2d466458d4db9c0cf4044ccfa Mon Sep 17 00:00:00 2001 From: Tim Buckley Date: Wed, 11 Sep 2024 18:50:16 -0600 Subject: [PATCH 10/12] Address review feedback: include in join method reference, add links --- .../terraform-provider/terraform-cloud.mdx | 6 ++---- .../machine-id/deployment.mdx | 1 + docs/pages/reference/join-methods.mdx | 19 +++++++++++++++++++ 3 files changed, 22 insertions(+), 4 deletions(-) diff --git a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx b/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx index a9c88d9570bd9..16132cde7e4ec 100644 --- a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx +++ b/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx @@ -60,10 +60,8 @@ provider in these environments. ## Step 1/4: Configure Terraform Cloud joining in Teleport To start, the Teleport Auth Service needs to be configured to accept join -requests from Terraform Cloud runs. We'll do this by creating -[a bot](../../../reference/architecture/machine-id-architecture.mdx#what-is-a-bot) -named `terraform` which the Teleport Terraform provider will use in a later -step. +requests from Terraform Cloud runs. We'll do this by creating a bot named +`terraform` which the Teleport Terraform provider will use in a later step. ```yaml kind: bot diff --git a/docs/pages/enroll-resources/machine-id/deployment.mdx b/docs/pages/enroll-resources/machine-id/deployment.mdx index fc3e238ffe743..0b133249927fe 100644 --- a/docs/pages/enroll-resources/machine-id/deployment.mdx +++ b/docs/pages/enroll-resources/machine-id/deployment.mdx @@ -73,3 +73,4 @@ integration and continuous deployment platform | [GitHub Actions](./deployment/github-actions.mdx) | Teleport job available through the GitHub Actions marketplace | GitHub-signed identity document. | | [Jenkins](./deployment/jenkins.mdx) | Package manager or TAR archive | Static join token | | [Spacelift](./deployment/spacelift.mdx) | Docker Image | Spacelift-signed identity document | +| [Terraform Cloud](../../admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx) | Teleport Terraform Provider via Teleport's Terraform Registry | Terraform Cloud-signed identity document | diff --git a/docs/pages/reference/join-methods.mdx b/docs/pages/reference/join-methods.mdx index f7a9cf17214bd..1862eb4486ac7 100644 --- a/docs/pages/reference/join-methods.mdx +++ b/docs/pages/reference/join-methods.mdx @@ -123,6 +123,7 @@ Delegated join methods are: - [`gitlab`](#gitlab-gitlab) - [`kubernetes`](#kubernetes-kubernetes) - [`tpm`](#trusted-platform-module-tpm) +- [`terraform_cloud](#terraform-cloud) ### Renewable vs non-renewable @@ -426,3 +427,21 @@ to contain the new Kubernetes signing keys (update the - [Deploying Machine ID on Linux: TPM](../enroll-resources/machine-id/deployment/linux-tpm.mdx) + +### Terraform Cloud: `terraform_cloud` + +This join method is used to authenticate using Terraform Cloud Workload +Identity. It is typically used by the Teleport Terraform provider on either +HCP Terraform or self-hosted Terraform Enterprise. It can not be used to join +Terraform runs on other platforms and dedicated join methods should be used +instead. + + +Support for self-hosted Terraform Enterprise requires Teleport Enterprise. + + +(!docs/pages/includes/provision-token/terraform-spec.mdx!) + + +- [Run the Teleport Terraform Provider on Terraform Cloud](../admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx) + From be79184aea1009eab47545e55a1f3d3510d103fd Mon Sep 17 00:00:00 2001 From: Tim Buckley Date: Wed, 11 Sep 2024 18:52:06 -0600 Subject: [PATCH 11/12] Fix codeblock spacing --- .../terraform-provider/terraform-cloud.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx b/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx index 16132cde7e4ec..2087c14fc51cf 100644 --- a/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx +++ b/docs/pages/admin-guides/infrastructure-as-code/terraform-provider/terraform-cloud.mdx @@ -102,7 +102,7 @@ self-hosted Terraform Enterprise: - organization_name: ExampleOrganization project_name: example-project workspace_name: example-workspace -``` + ``` From 5b26b0d2f041c5fd4937da9036cdbd7d1db0e003 Mon Sep 17 00:00:00 2001 From: Tim Buckley Date: Wed, 11 Sep 2024 19:04:41 -0600 Subject: [PATCH 12/12] Fix broken heading link --- docs/pages/reference/join-methods.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/pages/reference/join-methods.mdx b/docs/pages/reference/join-methods.mdx index 1862eb4486ac7..e4c1ec1dd90e1 100644 --- a/docs/pages/reference/join-methods.mdx +++ b/docs/pages/reference/join-methods.mdx @@ -123,7 +123,7 @@ Delegated join methods are: - [`gitlab`](#gitlab-gitlab) - [`kubernetes`](#kubernetes-kubernetes) - [`tpm`](#trusted-platform-module-tpm) -- [`terraform_cloud](#terraform-cloud) +- [`terraform_cloud`](#terraform-cloud-terraform_cloud) ### Renewable vs non-renewable