From b2ba330c96ce960ca23117d33e8b638f4fa6f31d Mon Sep 17 00:00:00 2001 From: Per Goncalves da Silva Date: Thu, 2 May 2024 14:07:00 +0200 Subject: [PATCH 1/2] OCPBUGS-29729: Updates default security context behavior for catalog source pods (#3206) * Refactor security context configuration in pod reconciler This change updates the logic for setting security contexts within the OLM pod reconciler. Now, it differentiates between 'Restricted' and 'Legacy' security contexts more explicitly. The 'Restricted' security context applies default security settings unless overridden, while the 'Legacy' context clears all security settings. When no security context is configured, it defaults to restricted. Additionally, the related tests have been updated to reflect these changes and ensure correct behavior. Signed-off-by: btofel * Add checking of the namespace PSA restrictions Signed-off-by: btofel * Fix linter issues Signed-off-by: btofel Signed-off-by: Brett Tofel * fixes Signed-off-by: Per Goncalves da Silva --------- Signed-off-by: btofel Signed-off-by: Brett Tofel Signed-off-by: Per Goncalves da Silva Co-authored-by: Brett Tofel Co-authored-by: Per Goncalves da Silva Upstream-repository: operator-lifecycle-manager Upstream-commit: 9b2802151528e556d78b5fe55bcb8c89070efe58 --- .../operators/catalog/operator_test.go | 165 +++++++++++++++++- .../registry/reconciler/configmap.go | 38 ++-- .../registry/reconciler/configmap_test.go | 44 +++-- .../controller/registry/reconciler/grpc.go | 54 +++--- .../registry/reconciler/grpc_test.go | 42 +++-- .../registry/reconciler/reconciler.go | 44 ++++- .../registry/reconciler/reconciler_test.go | 163 +++++++++++------ .../registry/reconciler/configmap.go | 38 ++-- .../controller/registry/reconciler/grpc.go | 54 +++--- .../registry/reconciler/reconciler.go | 44 ++++- 10 files changed, 509 insertions(+), 177 deletions(-) diff --git a/staging/operator-lifecycle-manager/pkg/controller/operators/catalog/operator_test.go b/staging/operator-lifecycle-manager/pkg/controller/operators/catalog/operator_test.go index 27535f5c4c..e95458bcaf 100644 --- a/staging/operator-lifecycle-manager/pkg/controller/operators/catalog/operator_test.go +++ b/staging/operator-lifecycle-manager/pkg/controller/operators/catalog/operator_test.go @@ -13,6 +13,10 @@ import ( "testing/quick" "time" + "k8s.io/utils/ptr" + + controllerclient "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/controller-runtime/client" + "github.com/operator-framework/operator-lifecycle-manager/pkg/controller/install" "github.com/sirupsen/logrus" @@ -59,7 +63,6 @@ import ( "github.com/operator-framework/operator-lifecycle-manager/pkg/controller/registry/resolver/solver" "github.com/operator-framework/operator-lifecycle-manager/pkg/fakes" "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/clientfake" - controllerclient "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/controller-runtime/client" "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/operatorclient" "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/operatorlister" "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/ownerutil" @@ -838,6 +841,160 @@ func withStatus(catalogSource v1alpha1.CatalogSource, status v1alpha1.CatalogSou return copy } +func TestSyncCatalogSourcesSecurityPolicy(t *testing.T) { + assertLegacySecurityPolicy := func(t *testing.T, pod *corev1.Pod) { + require.Nil(t, pod.Spec.SecurityContext) + require.Equal(t, &corev1.SecurityContext{ + ReadOnlyRootFilesystem: ptr.To(false), + }, pod.Spec.Containers[0].SecurityContext) + } + + assertRestrictedPolicy := func(t *testing.T, pod *corev1.Pod) { + require.Equal(t, &corev1.PodSecurityContext{ + SeccompProfile: &corev1.SeccompProfile{Type: corev1.SeccompProfileTypeRuntimeDefault}, + RunAsNonRoot: ptr.To(true), + RunAsUser: ptr.To(int64(1001)), + }, pod.Spec.SecurityContext) + require.Equal(t, &corev1.SecurityContext{ + ReadOnlyRootFilesystem: ptr.To(false), + AllowPrivilegeEscalation: ptr.To(false), + Capabilities: &corev1.Capabilities{ + Drop: []corev1.Capability{"ALL"}, + }, + }, pod.Spec.Containers[0].SecurityContext) + } + + clockFake := utilclocktesting.NewFakeClock(time.Date(2018, time.January, 26, 20, 40, 0, 0, time.UTC)) + tests := []struct { + testName string + namespace *corev1.Namespace + catalogSource *v1alpha1.CatalogSource + check func(*testing.T, *corev1.Pod) + }{ + { + testName: "UnlabeledNamespace/NoUserPreference/LegacySecurityPolicy", + namespace: &corev1.Namespace{ + ObjectMeta: metav1.ObjectMeta{ + Name: "cool-namespace", + }, + }, + catalogSource: &v1alpha1.CatalogSource{ + ObjectMeta: metav1.ObjectMeta{ + Name: "cool-catalog", + Namespace: "cool-namespace", + UID: types.UID("catalog-uid"), + }, + Spec: v1alpha1.CatalogSourceSpec{ + Image: "catalog-image", + SourceType: v1alpha1.SourceTypeGrpc, + }, + }, + check: assertLegacySecurityPolicy, + }, { + testName: "UnlabeledNamespace/UserPreferenceForRestricted/RestrictedSecurityPolicy", + namespace: &corev1.Namespace{ + ObjectMeta: metav1.ObjectMeta{ + Name: "cool-namespace", + }, + }, + catalogSource: &v1alpha1.CatalogSource{ + ObjectMeta: metav1.ObjectMeta{ + Name: "cool-catalog", + Namespace: "cool-namespace", + UID: types.UID("catalog-uid"), + }, + Spec: v1alpha1.CatalogSourceSpec{ + Image: "catalog-image", + SourceType: v1alpha1.SourceTypeGrpc, + GrpcPodConfig: &v1alpha1.GrpcPodConfig{ + SecurityContextConfig: v1alpha1.Restricted, + }, + }, + }, + check: assertRestrictedPolicy, + }, { + testName: "LabeledNamespace/NoUserPreference/RestrictedSecurityPolicy", + namespace: &corev1.Namespace{ + ObjectMeta: metav1.ObjectMeta{ + Name: "cool-namespace", + Labels: map[string]string{ + // restricted is the default psa policy + "pod-security.kubernetes.io/enforce": "restricted", + }, + }, + }, + catalogSource: &v1alpha1.CatalogSource{ + ObjectMeta: metav1.ObjectMeta{ + Name: "cool-catalog", + Namespace: "cool-namespace", + UID: types.UID("catalog-uid"), + }, + Spec: v1alpha1.CatalogSourceSpec{ + Image: "catalog-image", + SourceType: v1alpha1.SourceTypeGrpc, + }, + }, + check: assertRestrictedPolicy, + }, { + testName: "LabeledNamespace/UserPreferenceForLegacy/LegacySecurityPolicy", + namespace: &corev1.Namespace{ + ObjectMeta: metav1.ObjectMeta{ + Name: "cool-namespace", + }, + }, + catalogSource: &v1alpha1.CatalogSource{ + ObjectMeta: metav1.ObjectMeta{ + Name: "cool-catalog", + Namespace: "cool-namespace", + UID: types.UID("catalog-uid"), + }, + Spec: v1alpha1.CatalogSourceSpec{ + Image: "catalog-image", + SourceType: v1alpha1.SourceTypeGrpc, + GrpcPodConfig: &v1alpha1.GrpcPodConfig{ + SecurityContextConfig: v1alpha1.Legacy, + }, + }, + }, + check: assertLegacySecurityPolicy, + }, + } + for _, tt := range tests { + t.Run(tt.testName, func(t *testing.T) { + // Create existing objects + clientObjs := []runtime.Object{tt.catalogSource} + + // Create test operator + ctx, cancel := context.WithCancel(context.TODO()) + defer cancel() + + op, err := NewFakeOperator( + ctx, + tt.namespace.GetName(), + []string{tt.namespace.GetName()}, + withClock(clockFake), + withClientObjs(clientObjs...), + ) + require.NoError(t, err) + + // Because NewFakeOperator creates the namespace, we need to update the namespace to match the test case + // before running the sync function + _, err = op.opClient.KubernetesInterface().CoreV1().Namespaces().Update(context.TODO(), tt.namespace, metav1.UpdateOptions{}) + require.NoError(t, err) + + // Run sync + err = op.syncCatalogSources(tt.catalogSource) + require.NoError(t, err) + + pods, err := op.opClient.KubernetesInterface().CoreV1().Pods(tt.catalogSource.Namespace).List(context.TODO(), metav1.ListOptions{}) + require.NoError(t, err) + require.Len(t, pods.Items, 1) + + tt.check(t, &pods.Items[0]) + }) + } +} + func TestSyncCatalogSources(t *testing.T) { clockFake := utilclocktesting.NewFakeClock(time.Date(2018, time.January, 26, 20, 40, 0, 0, time.UTC)) now := metav1.NewTime(clockFake.Now()) @@ -1165,7 +1322,7 @@ func TestSyncCatalogSources(t *testing.T) { if tt.expectedStatus != nil { if tt.expectedStatus.GRPCConnectionState != nil { updated.Status.GRPCConnectionState.LastConnectTime = now - // Ignore LastObservedState difference if an expected LastObservedState is no provided + // Ignore LastObservedState difference if an expected LastObservedState is not provided if tt.expectedStatus.GRPCConnectionState.LastObservedState == "" { updated.Status.GRPCConnectionState.LastObservedState = "" } @@ -2012,7 +2169,6 @@ func NewFakeOperator(ctx context.Context, namespace string, namespaces []string, return nil, err } applier := controllerclient.NewFakeApplier(s, "testowner") - op.reconciler = reconciler.NewRegistryReconcilerFactory(lister, op.opClient, "test:pod", op.now, applier, 1001, "", "") } @@ -2028,7 +2184,6 @@ func NewFakeOperator(ctx context.Context, namespace string, namespaces []string, return op, nil } - func installPlan(name, namespace string, phase v1alpha1.InstallPlanPhase, names ...string) *v1alpha1.InstallPlan { return &v1alpha1.InstallPlan{ ObjectMeta: metav1.ObjectMeta{ @@ -2175,7 +2330,7 @@ func pod(t *testing.T, s v1alpha1.CatalogSource) *corev1.Pod { Name: s.GetName(), }, } - pod, err := reconciler.Pod(&s, "registry-server", "central-opm", "central-util", s.Spec.Image, serviceAccount, s.GetLabels(), s.GetAnnotations(), 5, 10, 1001) + pod, err := reconciler.Pod(&s, "registry-server", "central-opm", "central-util", s.Spec.Image, serviceAccount, s.GetLabels(), s.GetAnnotations(), 5, 10, 1001, v1alpha1.Legacy) if err != nil { t.Fatal(err) } diff --git a/staging/operator-lifecycle-manager/pkg/controller/registry/reconciler/configmap.go b/staging/operator-lifecycle-manager/pkg/controller/registry/reconciler/configmap.go index 654484125e..2e47c56507 100644 --- a/staging/operator-lifecycle-manager/pkg/controller/registry/reconciler/configmap.go +++ b/staging/operator-lifecycle-manager/pkg/controller/registry/reconciler/configmap.go @@ -109,8 +109,8 @@ func (s *configMapCatalogSourceDecorator) Service() (*corev1.Service, error) { return svc, nil } -func (s *configMapCatalogSourceDecorator) Pod(image string) (*corev1.Pod, error) { - pod, err := Pod(s.CatalogSource, "configmap-registry-server", "", "", image, nil, s.Labels(), s.Annotations(), 5, 5, s.runAsUser) +func (s *configMapCatalogSourceDecorator) Pod(image string, defaultPodSecurityConfig v1alpha1.SecurityConfig) (*corev1.Pod, error) { + pod, err := Pod(s.CatalogSource, "configmap-registry-server", "", "", image, nil, s.Labels(), s.Annotations(), 5, 5, s.runAsUser, defaultPodSecurityConfig) if err != nil { return nil, err } @@ -238,8 +238,8 @@ func (c *ConfigMapRegistryReconciler) currentRoleBinding(source configMapCatalog return roleBinding } -func (c *ConfigMapRegistryReconciler) currentPods(source configMapCatalogSourceDecorator, image string) ([]*corev1.Pod, error) { - protoPod, err := source.Pod(image) +func (c *ConfigMapRegistryReconciler) currentPods(source configMapCatalogSourceDecorator, image string, defaultPodSecurityConfig v1alpha1.SecurityConfig) ([]*corev1.Pod, error) { + protoPod, err := source.Pod(image, defaultPodSecurityConfig) if err != nil { return nil, err } @@ -255,8 +255,8 @@ func (c *ConfigMapRegistryReconciler) currentPods(source configMapCatalogSourceD return pods, nil } -func (c *ConfigMapRegistryReconciler) currentPodsWithCorrectResourceVersion(source configMapCatalogSourceDecorator, image string) ([]*corev1.Pod, error) { - protoPod, err := source.Pod(image) +func (c *ConfigMapRegistryReconciler) currentPodsWithCorrectResourceVersion(source configMapCatalogSourceDecorator, image string, defaultPodSecurityConfig v1alpha1.SecurityConfig) ([]*corev1.Pod, error) { + protoPod, err := source.Pod(image, defaultPodSecurityConfig) if err != nil { return nil, err } @@ -288,6 +288,11 @@ func (c *ConfigMapRegistryReconciler) EnsureRegistryServer(logger *logrus.Entry, overwrite := source.Status.RegistryServiceStatus == nil overwritePod := overwrite + defaultPodSecurityConfig, err := getDefaultPodContextConfig(c.OpClient, catalogSource.GetNamespace()) + if err != nil { + return err + } + if source.Spec.SourceType == v1alpha1.SourceTypeConfigmap || source.Spec.SourceType == v1alpha1.SourceTypeInternal { // fetch configmap first, exit early if we can't find it // we use the live client here instead of a lister since our listers are scoped to objects with the olm.managed label, @@ -311,7 +316,7 @@ func (c *ConfigMapRegistryReconciler) EnsureRegistryServer(logger *logrus.Entry, } // recreate the pod if no existing pod is serving the latest image - current, err := c.currentPodsWithCorrectResourceVersion(source, image) + current, err := c.currentPodsWithCorrectResourceVersion(source, image, defaultPodSecurityConfig) if err != nil { return err } @@ -330,11 +335,11 @@ func (c *ConfigMapRegistryReconciler) EnsureRegistryServer(logger *logrus.Entry, if err := c.ensureRoleBinding(source, overwrite); err != nil { return errors.Wrapf(err, "error ensuring rolebinding: %s", source.RoleBinding().GetName()) } - pod, err := source.Pod(image) + pod, err := source.Pod(image, defaultPodSecurityConfig) if err != nil { return err } - if err := c.ensurePod(source, overwritePod); err != nil { + if err := c.ensurePod(source, defaultPodSecurityConfig, overwritePod); err != nil { return errors.Wrapf(err, "error ensuring pod: %s", pod.GetName()) } service, err := source.Service() @@ -400,12 +405,12 @@ func (c *ConfigMapRegistryReconciler) ensureRoleBinding(source configMapCatalogS return err } -func (c *ConfigMapRegistryReconciler) ensurePod(source configMapCatalogSourceDecorator, overwrite bool) error { - pod, err := source.Pod(c.Image) +func (c *ConfigMapRegistryReconciler) ensurePod(source configMapCatalogSourceDecorator, defaultPodSecurityConfig v1alpha1.SecurityConfig, overwrite bool) error { + pod, err := source.Pod(c.Image, defaultPodSecurityConfig) if err != nil { return err } - currentPods, err := c.currentPods(source, c.Image) + currentPods, err := c.currentPods(source, c.Image, defaultPodSecurityConfig) if err != nil { return err } @@ -460,6 +465,11 @@ func (c *ConfigMapRegistryReconciler) CheckRegistryServer(logger *logrus.Entry, return } + defaultPodSecurityConfig, err := getDefaultPodContextConfig(c.OpClient, catalogSource.GetNamespace()) + if err != nil { + return false, err + } + if source.Spec.SourceType == v1alpha1.SourceTypeConfigmap || source.Spec.SourceType == v1alpha1.SourceTypeInternal { // we use the live client here instead of a lister since our listers are scoped to objects with the olm.managed label, // and this configmap is a user-provided input to the catalog source and will not have that label @@ -473,7 +483,7 @@ func (c *ConfigMapRegistryReconciler) CheckRegistryServer(logger *logrus.Entry, } // recreate the pod if no existing pod is serving the latest image - current, err := c.currentPodsWithCorrectResourceVersion(source, image) + current, err := c.currentPodsWithCorrectResourceVersion(source, image, defaultPodSecurityConfig) if err != nil { return false, err } @@ -489,7 +499,7 @@ func (c *ConfigMapRegistryReconciler) CheckRegistryServer(logger *logrus.Entry, if err != nil { return false, err } - pods, err := c.currentPods(source, c.Image) + pods, err := c.currentPods(source, c.Image, defaultPodSecurityConfig) if err != nil { return false, err } diff --git a/staging/operator-lifecycle-manager/pkg/controller/registry/reconciler/configmap_test.go b/staging/operator-lifecycle-manager/pkg/controller/registry/reconciler/configmap_test.go index 7e6b1dcd76..9635a5b59b 100644 --- a/staging/operator-lifecycle-manager/pkg/controller/registry/reconciler/configmap_test.go +++ b/staging/operator-lifecycle-manager/pkg/controller/registry/reconciler/configmap_test.go @@ -186,7 +186,12 @@ func validConfigMapCatalogSource(configMap *corev1.ConfigMap) *v1alpha1.CatalogS } func objectsForCatalogSource(t *testing.T, catsrc *v1alpha1.CatalogSource) []runtime.Object { - var objs []runtime.Object + // the registry pod security context is derived from the defaultNamespace by default + // therefore a namespace resource must always be present + var objs = []runtime.Object{ + defaultNamespace(), + } + switch catsrc.Spec.SourceType { case v1alpha1.SourceTypeInternal, v1alpha1.SourceTypeConfigmap: decorated := configMapCatalogSourceDecorator{catsrc, runAsUser} @@ -194,16 +199,15 @@ func objectsForCatalogSource(t *testing.T, catsrc *v1alpha1.CatalogSource) []run if err != nil { t.Fatal(err) } - pod, err := decorated.Pod(registryImageName) + serviceAccount := decorated.ServiceAccount() + pod, err := decorated.Pod(registryImageName, defaultPodSecurityConfig) if err != nil { t.Fatal(err) } - objs = clientfake.AddSimpleGeneratedNames( - clientfake.AddSimpleGeneratedName(pod), + objs = append(objs, + pod, service, - decorated.ServiceAccount(), - decorated.Role(), - decorated.RoleBinding(), + serviceAccount, ) case v1alpha1.SourceTypeGrpc: if catsrc.Spec.Image != "" { @@ -213,11 +217,11 @@ func objectsForCatalogSource(t *testing.T, catsrc *v1alpha1.CatalogSource) []run if err != nil { t.Fatal(err) } - pod, err := decorated.Pod(serviceAccount) + pod, err := decorated.Pod(serviceAccount, defaultPodSecurityConfig) if err != nil { t.Fatal(err) } - objs = clientfake.AddSimpleGeneratedNames( + objs = append(objs, pod, service, serviceAccount, @@ -242,7 +246,7 @@ func objectsForCatalogSource(t *testing.T, catsrc *v1alpha1.CatalogSource) []run } func modifyObjName(objs []runtime.Object, kind runtime.Object, newName string) []runtime.Object { - out := []runtime.Object{} + var out []runtime.Object t := reflect.TypeOf(kind) for _, obj := range objs { o := obj.DeepCopyObject() @@ -257,7 +261,7 @@ func modifyObjName(objs []runtime.Object, kind runtime.Object, newName string) [ } func setLabel(objs []runtime.Object, kind runtime.Object, label, value string) []runtime.Object { - out := []runtime.Object{} + var out []runtime.Object t := reflect.TypeOf(kind) for _, obj := range objs { o := obj.DeepCopyObject() @@ -297,10 +301,15 @@ func TestConfigMapRegistryReconciler(t *testing.T) { { testName: "NoConfigMap", in: in{ - cluster: cluster{}, + cluster: cluster{ + k8sObjs: []runtime.Object{ + validConfigMap, + defaultNamespace(), + }, + }, catsrc: &v1alpha1.CatalogSource{ ObjectMeta: metav1.ObjectMeta{ - Namespace: "test-ns", + Namespace: testNamespace, }, Spec: v1alpha1.CatalogSourceSpec{ SourceType: v1alpha1.SourceTypeConfigmap, @@ -309,14 +318,17 @@ func TestConfigMapRegistryReconciler(t *testing.T) { }, }, out: out{ - err: fmt.Errorf(`unable to find configmap test-ns/test-cm: configmaps "test-cm" not found`), + err: fmt.Errorf(`unable to find configmap testns/test-cm: configmaps "test-cm" not found`), }, }, { testName: "NoExistingRegistry/CreateSuccessful", in: in{ cluster: cluster{ - k8sObjs: []runtime.Object{validConfigMap}, + k8sObjs: []runtime.Object{ + validConfigMap, + defaultNamespace(), + }, }, catsrc: validCatalogSource, }, @@ -481,7 +493,7 @@ func TestConfigMapRegistryReconciler(t *testing.T) { // if no error, the reconciler should create the same set of kube objects every time decorated := configMapCatalogSourceDecorator{tt.in.catsrc, runAsUser} - pod, err := decorated.Pod(registryImageName) + pod, err := decorated.Pod(registryImageName, defaultPodSecurityConfig) require.NoError(t, err) listOptions := metav1.ListOptions{LabelSelector: labels.SelectorFromSet(labels.Set{CatalogSourceLabelKey: tt.in.catsrc.GetName()}).String()} outPods, err := client.KubernetesInterface().CoreV1().Pods(pod.GetNamespace()).List(context.TODO(), listOptions) diff --git a/staging/operator-lifecycle-manager/pkg/controller/registry/reconciler/grpc.go b/staging/operator-lifecycle-manager/pkg/controller/registry/reconciler/grpc.go index 4981600256..30cf12f1d2 100644 --- a/staging/operator-lifecycle-manager/pkg/controller/registry/reconciler/grpc.go +++ b/staging/operator-lifecycle-manager/pkg/controller/registry/reconciler/grpc.go @@ -10,6 +10,13 @@ import ( "github.com/google/go-cmp/cmp" "github.com/operator-framework/api/pkg/operators/v1alpha1" + + "github.com/operator-framework/operator-lifecycle-manager/pkg/controller/install" + controllerclient "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/controller-runtime/client" + hashutil "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/kubernetes/pkg/util/hash" + "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/operatorclient" + "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/operatorlister" + "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/ownerutil" pkgerrors "github.com/pkg/errors" "github.com/sirupsen/logrus" corev1 "k8s.io/api/core/v1" @@ -18,13 +25,6 @@ import ( "k8s.io/apimachinery/pkg/labels" "k8s.io/apimachinery/pkg/util/intstr" "k8s.io/utils/ptr" - - "github.com/operator-framework/operator-lifecycle-manager/pkg/controller/install" - controllerclient "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/controller-runtime/client" - hashutil "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/kubernetes/pkg/util/hash" - "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/operatorclient" - "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/operatorlister" - "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/ownerutil" ) const ( @@ -134,8 +134,8 @@ func (s *grpcCatalogSourceDecorator) ServiceAccount() *corev1.ServiceAccount { } } -func (s *grpcCatalogSourceDecorator) Pod(serviceAccount *corev1.ServiceAccount) (*corev1.Pod, error) { - pod, err := Pod(s.CatalogSource, "registry-server", s.opmImage, s.utilImage, s.Spec.Image, serviceAccount, s.Labels(), s.Annotations(), 5, 10, s.createPodAsUser) +func (s *grpcCatalogSourceDecorator) Pod(serviceAccount *corev1.ServiceAccount, defaultPodSecurityConfig v1alpha1.SecurityConfig) (*corev1.Pod, error) { + pod, err := Pod(s.CatalogSource, "registry-server", s.opmImage, s.utilImage, s.Spec.Image, serviceAccount, s.Labels(), s.Annotations(), 5, 10, s.createPodAsUser, defaultPodSecurityConfig) if err != nil { return nil, err } @@ -203,7 +203,7 @@ func (c *GrpcRegistryReconciler) currentUpdatePods(logger *logrus.Entry, source return pods } -func (c *GrpcRegistryReconciler) currentPodsWithCorrectImageAndSpec(logger *logrus.Entry, source grpcCatalogSourceDecorator, serviceAccount *corev1.ServiceAccount) ([]*corev1.Pod, error) { +func (c *GrpcRegistryReconciler) currentPodsWithCorrectImageAndSpec(logger *logrus.Entry, source grpcCatalogSourceDecorator, serviceAccount *corev1.ServiceAccount, defaultPodSecurityConfig v1alpha1.SecurityConfig) ([]*corev1.Pod, error) { logger.Info("searching for current pods") pods, err := c.Lister.CoreV1().PodLister().Pods(source.GetNamespace()).List(labels.SelectorFromValidatedSet(source.Labels())) if err != nil { @@ -211,7 +211,7 @@ func (c *GrpcRegistryReconciler) currentPodsWithCorrectImageAndSpec(logger *logr return nil, nil } found := []*corev1.Pod{} - newPod, err := source.Pod(serviceAccount) + newPod, err := source.Pod(serviceAccount, defaultPodSecurityConfig) if err != nil { return nil, err } @@ -273,8 +273,13 @@ func (c *GrpcRegistryReconciler) EnsureRegistryServer(logger *logrus.Entry, cata return err } + defaultPodSecurityConfig, err := getDefaultPodContextConfig(c.OpClient, catalogSource.GetNamespace()) + if err != nil { + return err + } + // recreate the pod if no existing pod is serving the latest image or correct spec - current, err := c.currentPodsWithCorrectImageAndSpec(logger, source, sa) + current, err := c.currentPodsWithCorrectImageAndSpec(logger, source, sa, defaultPodSecurityConfig) if err != nil { return err } @@ -283,14 +288,14 @@ func (c *GrpcRegistryReconciler) EnsureRegistryServer(logger *logrus.Entry, cata logger.Info("registry pods invalid, need to overwrite") } - pod, err := source.Pod(sa) + pod, err := source.Pod(sa, defaultPodSecurityConfig) if err != nil { return err } - if err := c.ensurePod(logger, source, sa, overwritePod); err != nil { + if err := c.ensurePod(logger, source, sa, defaultPodSecurityConfig, overwritePod); err != nil { return pkgerrors.Wrapf(err, "error ensuring pod: %s", pod.GetName()) } - if err := c.ensureUpdatePod(logger, sa, source); err != nil { + if err := c.ensureUpdatePod(logger, sa, defaultPodSecurityConfig, source); err != nil { if _, ok := err.(UpdateNotReadyErr); ok { return err } @@ -340,7 +345,7 @@ func isRegistryServiceStatusValid(source *grpcCatalogSourceDecorator) (bool, err return true, nil } -func (c *GrpcRegistryReconciler) ensurePod(logger *logrus.Entry, source grpcCatalogSourceDecorator, serviceAccount *corev1.ServiceAccount, overwrite bool) error { +func (c *GrpcRegistryReconciler) ensurePod(logger *logrus.Entry, source grpcCatalogSourceDecorator, serviceAccount *corev1.ServiceAccount, defaultPodSecurityConfig v1alpha1.SecurityConfig, overwrite bool) error { // currentPods refers to the current pod instances of the catalog source currentPods := c.currentPods(logger, source) @@ -373,7 +378,7 @@ func (c *GrpcRegistryReconciler) ensurePod(logger *logrus.Entry, source grpcCata } } } - desiredPod, err := source.Pod(serviceAccount) + desiredPod, err := source.Pod(serviceAccount, defaultPodSecurityConfig) if err != nil { return err } @@ -387,7 +392,7 @@ func (c *GrpcRegistryReconciler) ensurePod(logger *logrus.Entry, source grpcCata } // ensureUpdatePod checks that for the same catalog source version the same container imageID is running -func (c *GrpcRegistryReconciler) ensureUpdatePod(logger *logrus.Entry, serviceAccount *corev1.ServiceAccount, source grpcCatalogSourceDecorator) error { +func (c *GrpcRegistryReconciler) ensureUpdatePod(logger *logrus.Entry, serviceAccount *corev1.ServiceAccount, podSecurityConfig v1alpha1.SecurityConfig, source grpcCatalogSourceDecorator) error { if !source.Poll() { logger.Info("polling not enabled, no update pod will be created") return nil @@ -398,7 +403,7 @@ func (c *GrpcRegistryReconciler) ensureUpdatePod(logger *logrus.Entry, serviceAc if source.Update() && len(currentUpdatePods) == 0 { logger.Infof("catalog update required at %s", time.Now().String()) - pod, err := c.createUpdatePod(source, serviceAccount) + pod, err := c.createUpdatePod(source, serviceAccount, podSecurityConfig) if err != nil { return pkgerrors.Wrapf(err, "creating update catalog source pod") } @@ -506,9 +511,9 @@ func ServiceHashMatch(existing, new *corev1.Service) bool { } // createUpdatePod is an internal method that creates a pod using the latest catalog source. -func (c *GrpcRegistryReconciler) createUpdatePod(source grpcCatalogSourceDecorator, serviceAccount *corev1.ServiceAccount) (*corev1.Pod, error) { +func (c *GrpcRegistryReconciler) createUpdatePod(source grpcCatalogSourceDecorator, serviceAccount *corev1.ServiceAccount, defaultPodSecurityConfig v1alpha1.SecurityConfig) (*corev1.Pod, error) { // remove label from pod to ensure service does not accidentally route traffic to the pod - p, err := source.Pod(serviceAccount) + p, err := source.Pod(serviceAccount, defaultPodSecurityConfig) if err != nil { return nil, err } @@ -612,13 +617,18 @@ func (c *GrpcRegistryReconciler) CheckRegistryServer(logger *logrus.Entry, catal return false, nil } + registryPodSecurityConfig, err := getDefaultPodContextConfig(c.OpClient, catalogSource.GetNamespace()) + if err != nil { + return false, err + } + // Check on registry resources // TODO: add gRPC health check service, err := c.currentService(source) if err != nil { return false, err } - current, err := c.currentPodsWithCorrectImageAndSpec(logger, source, serviceAccount) + current, err := c.currentPodsWithCorrectImageAndSpec(logger, source, serviceAccount, registryPodSecurityConfig) if err != nil { return false, err } diff --git a/staging/operator-lifecycle-manager/pkg/controller/registry/reconciler/grpc_test.go b/staging/operator-lifecycle-manager/pkg/controller/registry/reconciler/grpc_test.go index fd505fcf6a..65071feda5 100644 --- a/staging/operator-lifecycle-manager/pkg/controller/registry/reconciler/grpc_test.go +++ b/staging/operator-lifecycle-manager/pkg/controller/registry/reconciler/grpc_test.go @@ -2,11 +2,9 @@ package reconciler import ( "context" - "fmt" "testing" "time" - "github.com/google/go-cmp/cmp" "github.com/operator-framework/api/pkg/operators/v1alpha1" "github.com/sirupsen/logrus" "github.com/stretchr/testify/require" @@ -26,7 +24,7 @@ func validGrpcCatalogSource(image, address string) *v1alpha1.CatalogSource { ObjectMeta: metav1.ObjectMeta{ Name: "img-catalog", Namespace: testNamespace, - UID: types.UID("catalog-uid"), + UID: "catalog-uid", Labels: map[string]string{"olm.catalogSource": "img-catalog"}, }, Spec: v1alpha1.CatalogSourceSpec{ @@ -101,6 +99,9 @@ func TestGrpcRegistryReconciler(t *testing.T) { { testName: "Grpc/NoExistingRegistry/CreateSuccessful", in: in{ + cluster: cluster{ + k8sObjs: baseClusterState(), + }, catsrc: validGrpcCatalogSource("test-img", ""), }, out: out{ @@ -116,6 +117,9 @@ func TestGrpcRegistryReconciler(t *testing.T) { { testName: "Grpc/NoExistingRegistry/CreateSuccessful/CatalogSourceWithPeriodInNameCreatesValidServiceName", in: in{ + cluster: cluster{ + k8sObjs: baseClusterState(), + }, catsrc: grpcCatalogSourceWithName("img.catalog"), }, out: out{ @@ -149,8 +153,10 @@ func TestGrpcRegistryReconciler(t *testing.T) { { testName: "Grpc/Address/CreateSuccessful", in: in{ - cluster: cluster{}, - catsrc: validGrpcCatalogSource("", "catalog.svc.cluster.local:50001"), + cluster: cluster{ + k8sObjs: baseClusterState(), + }, + catsrc: validGrpcCatalogSource("", "catalog.svc.cluster.local:50001"), }, out: out{ status: &v1alpha1.RegistryServiceStatus{ @@ -162,8 +168,10 @@ func TestGrpcRegistryReconciler(t *testing.T) { { testName: "Grpc/AddressAndImage/CreateSuccessful", in: in{ - cluster: cluster{}, - catsrc: validGrpcCatalogSource("img-catalog", "catalog.svc.cluster.local:50001"), + cluster: cluster{ + k8sObjs: baseClusterState(), + }, + catsrc: validGrpcCatalogSource("img-catalog", "catalog.svc.cluster.local:50001"), }, out: out{ status: &v1alpha1.RegistryServiceStatus{ @@ -252,6 +260,7 @@ func TestGrpcRegistryReconciler(t *testing.T) { in: in{ cluster: cluster{ k8sObjs: []runtime.Object{ + defaultNamespace(), &corev1.Secret{ ObjectMeta: metav1.ObjectMeta{ Name: "test-secret", @@ -301,6 +310,9 @@ func TestGrpcRegistryReconciler(t *testing.T) { { testName: "Grpc/NoExistingRegistry/CreateWithAnnotations", in: in{ + cluster: cluster{ + k8sObjs: baseClusterState(), + }, catsrc: grpcCatalogSourceWithAnnotations(map[string]string{ "annotation1": "value1", "annotation2": "value2", @@ -360,7 +372,7 @@ func TestGrpcRegistryReconciler(t *testing.T) { // Check for resource existence decorated := grpcCatalogSourceDecorator{CatalogSource: tt.in.catsrc, createPodAsUser: runAsUser} sa := decorated.ServiceAccount() - pod, err := decorated.Pod(sa) + pod, err := decorated.Pod(sa, defaultPodSecurityConfig) if err != nil { t.Fatal(err) } @@ -376,9 +388,6 @@ func TestGrpcRegistryReconciler(t *testing.T) { case *GrpcRegistryReconciler: // Should be created by a GrpcRegistryReconciler require.NoError(t, podErr) - if diff := cmp.Diff(outPods.Items, []corev1.Pod{*pod}); diff != "" { - fmt.Printf("incorrect pods: %s\n", diff) - } require.Len(t, outPods.Items, 1) outPod := outPods.Items[0] require.Equal(t, pod.GetGenerateName(), outPod.GetGenerateName()) @@ -450,7 +459,11 @@ func TestRegistryPodPriorityClass(t *testing.T) { stopc := make(chan struct{}) defer close(stopc) - factory, client := fakeReconcilerFactory(t, stopc, withNow(now), withK8sObjs(tt.in.cluster.k8sObjs...), withK8sClientOptions(clientfake.WithNameGeneration(t))) + // a defaultNamespace resource must be present so that the reconciler can determine the + // security context configuration for the underlying pod + clusterState := append(tt.in.cluster.k8sObjs, defaultNamespace()) + + factory, client := fakeReconcilerFactory(t, stopc, withNow(now), withK8sObjs(clusterState...), withK8sClientOptions(clientfake.WithNameGeneration(t))) rec := factory.ReconcilerForSource(tt.in.catsrc) err := rec.EnsureRegistryServer(logrus.NewEntry(logrus.New()), tt.in.catsrc) @@ -458,7 +471,7 @@ func TestRegistryPodPriorityClass(t *testing.T) { // Check for resource existence decorated := grpcCatalogSourceDecorator{CatalogSource: tt.in.catsrc, createPodAsUser: runAsUser} - pod, err := decorated.Pod(serviceAccount(tt.in.catsrc.Namespace, tt.in.catsrc.Name)) + pod, err := decorated.Pod(serviceAccount(tt.in.catsrc.Namespace, tt.in.catsrc.Name), defaultPodSecurityConfig) require.NoError(t, err) listOptions := metav1.ListOptions{LabelSelector: labels.SelectorFromSet(labels.Set{CatalogSourceLabelKey: tt.in.catsrc.GetName()}).String()} outPods, podErr := client.KubernetesInterface().CoreV1().Pods(pod.GetNamespace()).List(context.TODO(), listOptions) @@ -581,8 +594,7 @@ func TestGrpcRegistryChecker(t *testing.T) { { testName: "Grpc/NoExistingRegistry/AddressAndImage/NotHealthy", in: in{ - cluster: cluster{}, - catsrc: validGrpcCatalogSource("img-catalog", "catalog.svc.cluster.local:50001"), + catsrc: validGrpcCatalogSource("img-catalog", "catalog.svc.cluster.local:50001"), }, out: out{ healthy: false, diff --git a/staging/operator-lifecycle-manager/pkg/controller/registry/reconciler/reconciler.go b/staging/operator-lifecycle-manager/pkg/controller/registry/reconciler/reconciler.go index 77b5096038..0b0402cc3d 100644 --- a/staging/operator-lifecycle-manager/pkg/controller/registry/reconciler/reconciler.go +++ b/staging/operator-lifecycle-manager/pkg/controller/registry/reconciler/reconciler.go @@ -2,6 +2,7 @@ package reconciler import ( + "context" "fmt" "path/filepath" @@ -29,7 +30,7 @@ const ( CatalogPriorityClassKey string = "operatorframework.io/priorityclass" // PodHashLabelKey is the key of a label for podspec hash information PodHashLabelKey = "olm.pod-spec-hash" - //ClusterAutoscalingAnnotation is the annotation that enables the cluster autoscaler to evict catalog pods + //ClusterAutoscalingAnnotationKey is the annotation that enables the cluster autoscaler to evict catalog pods ClusterAutoscalingAnnotationKey string = "cluster-autoscaler.kubernetes.io/safe-to-evict" ) @@ -114,7 +115,7 @@ func NewRegistryReconcilerFactory(lister operatorlister.OperatorLister, opClient } } -func Pod(source *operatorsv1alpha1.CatalogSource, name, opmImg, utilImage, img string, serviceAccount *corev1.ServiceAccount, labels, annotations map[string]string, readinessDelay, livenessDelay int32, runAsUser int64) (*corev1.Pod, error) { +func Pod(source *operatorsv1alpha1.CatalogSource, name, opmImg, utilImage, img string, serviceAccount *corev1.ServiceAccount, labels, annotations map[string]string, readinessDelay, livenessDelay int32, runAsUser int64, defaultSecurityConfig operatorsv1alpha1.SecurityConfig) (*corev1.Pod, error) { // make a copy of the labels and annotations to avoid mutating the input parameters podLabels := make(map[string]string) podAnnotations := make(map[string]string) @@ -190,7 +191,7 @@ func Pod(source *operatorsv1alpha1.CatalogSource, name, opmImg, utilImage, img s }, }, SecurityContext: &corev1.SecurityContext{ - ReadOnlyRootFilesystem: ptr.To(bool(false)), + ReadOnlyRootFilesystem: ptr.To(false), }, ImagePullPolicy: image.InferImagePullPolicy(img), TerminationMessagePolicy: corev1.TerminationMessageFallbackToLogsOnError, @@ -200,13 +201,26 @@ func Pod(source *operatorsv1alpha1.CatalogSource, name, opmImg, utilImage, img s "kubernetes.io/os": "linux", }, ServiceAccountName: saName, - // If this field is not set, there that the is a chance that pod will be created without the imagePullSecret + // If this field is not set, there is a chance that pod will be created without the imagePullSecret // defined by the serviceAccount ImagePullSecrets: saImagePullSecrets, }, } - if source.Spec.GrpcPodConfig != nil && source.Spec.GrpcPodConfig.SecurityContextConfig == operatorsv1alpha1.Restricted { + // Determine the security context configuration + var securityContextConfig operatorsv1alpha1.SecurityConfig + + // Use the user-provided security context config if it is defined + if source.Spec.GrpcPodConfig != nil && source.Spec.GrpcPodConfig.SecurityContextConfig != "" { + securityContextConfig = source.Spec.GrpcPodConfig.SecurityContextConfig + } else { + // Default to the defaultNamespace based and provided security context config + securityContextConfig = defaultSecurityConfig + } + + // Apply the appropriate security context configuration + if securityContextConfig == operatorsv1alpha1.Restricted { + // Apply 'restricted' security settings addSecurityContext(pod, runAsUser) } @@ -332,7 +346,7 @@ func Pod(source *operatorsv1alpha1.CatalogSource, name, opmImg, utilImage, img s } func addSecurityContext(pod *corev1.Pod, runAsUser int64) { - pod.Spec.Containers[0].SecurityContext.AllowPrivilegeEscalation = ptr.To(bool(false)) + pod.Spec.Containers[0].SecurityContext.AllowPrivilegeEscalation = ptr.To(false) pod.Spec.Containers[0].SecurityContext.Capabilities = &corev1.Capabilities{ Drop: []corev1.Capability{"ALL"}, } @@ -343,6 +357,22 @@ func addSecurityContext(pod *corev1.Pod, runAsUser int64) { } if runAsUser > 0 { pod.Spec.SecurityContext.RunAsUser = &runAsUser - pod.Spec.SecurityContext.RunAsNonRoot = ptr.To(bool(true)) + pod.Spec.SecurityContext.RunAsNonRoot = ptr.To(true) } } + +// getDefaultPodContextConfig returns Restricted if the defaultNamespace has the 'pod-security.kubernetes.io/enforce' label set to 'restricted', +// otherwise it returns Legacy. This is used to help determine the security context of the registry pod when it is not already defined by the user +func getDefaultPodContextConfig(client operatorclient.ClientInterface, namespace string) (operatorsv1alpha1.SecurityConfig, error) { + ns, err := client.KubernetesInterface().CoreV1().Namespaces().Get(context.TODO(), namespace, metav1.GetOptions{}) + if err != nil { + return "", fmt.Errorf("error fetching defaultNamespace: %v", err) + } + // 'pod-security.kubernetes.io/enforce' is the label used for enforcing defaultNamespace level security, + // and 'restricted' is the value indicating a restricted security policy. + if val, exists := ns.Labels["pod-security.kubernetes.io/enforce"]; exists && val == "restricted" { + return operatorsv1alpha1.Restricted, nil + } + + return operatorsv1alpha1.Legacy, nil +} diff --git a/staging/operator-lifecycle-manager/pkg/controller/registry/reconciler/reconciler_test.go b/staging/operator-lifecycle-manager/pkg/controller/registry/reconciler/reconciler_test.go index f86aac77fd..976d92a9d2 100644 --- a/staging/operator-lifecycle-manager/pkg/controller/registry/reconciler/reconciler_test.go +++ b/staging/operator-lifecycle-manager/pkg/controller/registry/reconciler/reconciler_test.go @@ -3,6 +3,8 @@ package reconciler import ( "testing" + "k8s.io/apimachinery/pkg/runtime" + "github.com/google/go-cmp/cmp" "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/image" "github.com/stretchr/testify/require" @@ -15,6 +17,7 @@ import ( ) const workloadUserID = 1001 +const defaultPodSecurityConfig = v1alpha1.Restricted func TestPodMemoryTarget(t *testing.T) { q := resource.MustParse("5Mi") @@ -79,7 +82,7 @@ func TestPodMemoryTarget(t *testing.T) { }, }, SecurityContext: &corev1.SecurityContext{ - ReadOnlyRootFilesystem: ptr.To(bool(false)), + ReadOnlyRootFilesystem: ptr.To(false), }, ImagePullPolicy: image.InferImagePullPolicy("image"), TerminationMessagePolicy: "FallbackToLogsOnError", @@ -153,7 +156,7 @@ func TestPodMemoryTarget(t *testing.T) { Limits: corev1.ResourceList{}, }, SecurityContext: &corev1.SecurityContext{ - ReadOnlyRootFilesystem: ptr.To(bool(false)), + ReadOnlyRootFilesystem: ptr.To(false), }, ImagePullPolicy: image.InferImagePullPolicy("image"), TerminationMessagePolicy: "FallbackToLogsOnError", @@ -167,11 +170,13 @@ func TestPodMemoryTarget(t *testing.T) { } for _, testCase := range testCases { - pod, err := Pod(testCase.input, "name", "opmImage", "utilImage", "image", serviceAccount("", "service-account"), map[string]string{}, map[string]string{}, int32(0), int32(0), int64(workloadUserID)) - require.NoError(t, err) - if diff := cmp.Diff(pod, testCase.expected); diff != "" { - t.Errorf("got incorrect pod: %v", diff) - } + t.Run(testCase.name, func(t *testing.T) { + pod, err := Pod(testCase.input, "name", "opmImage", "utilImage", "image", serviceAccount("", "service-account"), map[string]string{}, map[string]string{}, int32(0), int32(0), int64(workloadUserID), v1alpha1.Legacy) + require.NoError(t, err) + if diff := cmp.Diff(pod, testCase.expected); diff != "" { + t.Errorf("got incorrect pod: %v", diff) + } + }) } } @@ -246,7 +251,7 @@ func TestPodExtractContent(t *testing.T) { }, }, SecurityContext: &corev1.SecurityContext{ - ReadOnlyRootFilesystem: ptr.To(bool(false)), + ReadOnlyRootFilesystem: ptr.To(false), }, ImagePullPolicy: image.InferImagePullPolicy("image"), TerminationMessagePolicy: "FallbackToLogsOnError", @@ -360,7 +365,7 @@ func TestPodExtractContent(t *testing.T) { }, }, SecurityContext: &corev1.SecurityContext{ - ReadOnlyRootFilesystem: ptr.To(bool(false)), + ReadOnlyRootFilesystem: ptr.To(false), }, ImagePullPolicy: image.InferImagePullPolicy("image"), TerminationMessagePolicy: "FallbackToLogsOnError", @@ -375,7 +380,7 @@ func TestPodExtractContent(t *testing.T) { } for _, testCase := range testCases { - pod, err := Pod(testCase.input, "name", "opmImage", "utilImage", "image", serviceAccount("", "service-account"), map[string]string{}, map[string]string{}, int32(0), int32(0), int64(workloadUserID)) + pod, err := Pod(testCase.input, "name", "opmImage", "utilImage", "image", serviceAccount("", "service-account"), map[string]string{}, map[string]string{}, int32(0), int32(0), int64(workloadUserID), v1alpha1.Legacy) require.NoError(t, err) if diff := cmp.Diff(pod, testCase.expected); diff != "" { t.Errorf("got incorrect pod: %v", diff) @@ -426,7 +431,7 @@ func TestPodServiceAccountImagePullSecrets(t *testing.T) { } for _, testCase := range testCases { - pod, err := Pod(catalogSource, "name", "opmImage", "utilImage", "image", testCase.serviceAccount, map[string]string{}, map[string]string{}, int32(0), int32(0), int64(workloadUserID)) + pod, err := Pod(catalogSource, "name", "opmImage", "utilImage", "image", testCase.serviceAccount, map[string]string{}, map[string]string{}, int32(0), int32(0), int64(workloadUserID), v1alpha1.Legacy) require.NoError(t, err) if diff := cmp.Diff(testCase.serviceAccount.ImagePullSecrets, pod.Spec.ImagePullSecrets); diff != "" { t.Errorf("got incorrect pod: %v", diff) @@ -445,7 +450,7 @@ func TestPodNodeSelector(t *testing.T) { key := "kubernetes.io/os" value := "linux" - gotCatSrcPod, err := Pod(catsrc, "hello", "utilImage", "opmImage", "busybox", serviceAccount("", "service-account"), map[string]string{}, map[string]string{}, int32(0), int32(0), int64(workloadUserID)) + gotCatSrcPod, err := Pod(catsrc, "hello", "utilImage", "opmImage", "busybox", serviceAccount("", "service-account"), map[string]string{}, map[string]string{}, int32(0), int32(0), int64(workloadUserID), v1alpha1.Legacy) require.NoError(t, err) gotCatSrcPodSelector := gotCatSrcPod.Spec.NodeSelector @@ -494,7 +499,7 @@ func TestPullPolicy(t *testing.T) { } for _, tt := range table { - p, err := Pod(source, "catalog", "opmImage", "utilImage", tt.image, serviceAccount("", "service-account"), nil, nil, int32(0), int32(0), int64(workloadUserID)) + p, err := Pod(source, "catalog", "opmImage", "utilImage", tt.image, serviceAccount("", "service-account"), nil, nil, int32(0), int32(0), int64(workloadUserID), v1alpha1.Legacy) require.NoError(t, err) policy := p.Spec.Containers[0].ImagePullPolicy if policy != tt.policy { @@ -507,52 +512,88 @@ func TestPodContainerSecurityContext(t *testing.T) { testcases := []struct { title string inputCatsrc *v1alpha1.CatalogSource + namespacePodSecurityConfig v1alpha1.SecurityConfig expectedSecurityContext *corev1.PodSecurityContext expectedContainerSecurityContext *corev1.SecurityContext }{ { - title: "NoSpecDefined/PodContainsSecurityConfigForPSALegacy", + title: "NoSpecDefined/NamespaceRestricted/UseRestricted", inputCatsrc: &v1alpha1.CatalogSource{ ObjectMeta: metav1.ObjectMeta{ Name: "test", - Namespace: "testns", + Namespace: testNamespace, }, }, - expectedContainerSecurityContext: nil, + namespacePodSecurityConfig: v1alpha1.Restricted, + expectedContainerSecurityContext: &corev1.SecurityContext{ + AllowPrivilegeEscalation: ptr.To(false), + Capabilities: &corev1.Capabilities{ + Drop: []corev1.Capability{"ALL"}, + }, + ReadOnlyRootFilesystem: ptr.To(false), // Reflecting expected 'restricted' settings + }, + expectedSecurityContext: &corev1.PodSecurityContext{ + SeccompProfile: &corev1.SeccompProfile{Type: corev1.SeccompProfileTypeRuntimeDefault}, + RunAsNonRoot: ptr.To(true), + RunAsUser: ptr.To(int64(workloadUserID)), + }, + }, + { + title: "NoSpecDefined/NamespaceNotRestricted/UseLegacy", + namespacePodSecurityConfig: v1alpha1.Legacy, + inputCatsrc: &v1alpha1.CatalogSource{ + ObjectMeta: metav1.ObjectMeta{ + Name: "test", + Namespace: testNamespace, + }, + }, + expectedContainerSecurityContext: &corev1.SecurityContext{ReadOnlyRootFilesystem: ptr.To(false)}, expectedSecurityContext: nil, }, { - title: "SpecDefined/NoGRPCPodConfig/PodContainsSecurityConfigForPSALegacy", + title: "SpecDefined/NoGRPCPodConfig/NamespaceRestricted/UseRestricted", inputCatsrc: &v1alpha1.CatalogSource{ ObjectMeta: metav1.ObjectMeta{ Name: "test", - Namespace: "testns", + Namespace: testNamespace, }, Spec: v1alpha1.CatalogSourceSpec{}, }, - expectedContainerSecurityContext: nil, - expectedSecurityContext: nil, + namespacePodSecurityConfig: v1alpha1.Restricted, + expectedContainerSecurityContext: &corev1.SecurityContext{ + AllowPrivilegeEscalation: ptr.To(false), + Capabilities: &corev1.Capabilities{ + Drop: []corev1.Capability{"ALL"}, + }, + ReadOnlyRootFilesystem: ptr.To(false), + }, + expectedSecurityContext: &corev1.PodSecurityContext{ + SeccompProfile: &corev1.SeccompProfile{Type: corev1.SeccompProfileTypeRuntimeDefault}, + RunAsNonRoot: ptr.To(true), + RunAsUser: ptr.To(int64(workloadUserID)), + }, }, { - title: "SpecDefined/GRPCPodConfigDefined/PodContainsSecurityConfigForPSALegacy", + title: "SpecDefined/NoGRPCPodConfig/NamespaceNotRestricted/UseLegacy", inputCatsrc: &v1alpha1.CatalogSource{ ObjectMeta: metav1.ObjectMeta{ Name: "test", - Namespace: "testns", + Namespace: testNamespace, }, Spec: v1alpha1.CatalogSourceSpec{ GrpcPodConfig: &v1alpha1.GrpcPodConfig{}, }, }, - expectedContainerSecurityContext: nil, + namespacePodSecurityConfig: v1alpha1.Legacy, + expectedContainerSecurityContext: &corev1.SecurityContext{ReadOnlyRootFilesystem: ptr.To(false)}, expectedSecurityContext: nil, }, { - title: "SpecDefined/SecurityContextConfig:Legacy/PodContainsSecurityConfigForPSALegacy", + title: "SpecDefined/SecurityContextConfig:Legacy/NoChangeExpected", inputCatsrc: &v1alpha1.CatalogSource{ ObjectMeta: metav1.ObjectMeta{ Name: "test", - Namespace: "testns", + Namespace: testNamespace, }, Spec: v1alpha1.CatalogSourceSpec{ GrpcPodConfig: &v1alpha1.GrpcPodConfig{ @@ -560,15 +601,16 @@ func TestPodContainerSecurityContext(t *testing.T) { }, }, }, - expectedContainerSecurityContext: nil, + namespacePodSecurityConfig: v1alpha1.Restricted, // set to the opposite of the config to catch possible errors + expectedContainerSecurityContext: &corev1.SecurityContext{ReadOnlyRootFilesystem: ptr.To(false)}, expectedSecurityContext: nil, }, { - title: "SpecDefined/SecurityContextConfig:Restricted/PodContainsSecurityConfigForPSARestricted", + title: "SpecDefined/SecurityContextConfig:Restricted/RestrictedSecurityConfigApplied", inputCatsrc: &v1alpha1.CatalogSource{ ObjectMeta: metav1.ObjectMeta{ Name: "test", - Namespace: "testns", + Namespace: testNamespace, }, Spec: v1alpha1.CatalogSourceSpec{ GrpcPodConfig: &v1alpha1.GrpcPodConfig{ @@ -576,45 +618,33 @@ func TestPodContainerSecurityContext(t *testing.T) { }, }, }, + namespacePodSecurityConfig: v1alpha1.Legacy, // set to the opposite of the config to catch possible errors expectedContainerSecurityContext: &corev1.SecurityContext{ - ReadOnlyRootFilesystem: ptr.To(bool(false)), - AllowPrivilegeEscalation: ptr.To(bool(false)), + ReadOnlyRootFilesystem: ptr.To(false), + AllowPrivilegeEscalation: ptr.To(false), Capabilities: &corev1.Capabilities{ Drop: []corev1.Capability{"ALL"}, }, }, expectedSecurityContext: &corev1.PodSecurityContext{ SeccompProfile: &corev1.SeccompProfile{Type: corev1.SeccompProfileTypeRuntimeDefault}, + RunAsNonRoot: ptr.To(true), RunAsUser: ptr.To(int64(workloadUserID)), - RunAsNonRoot: ptr.To(bool(true)), - }, - }, - { - title: "SpecDefined/SecurityContextConfig:Legacy/PodDoesNotContainsSecurityConfig", - inputCatsrc: &v1alpha1.CatalogSource{ - ObjectMeta: metav1.ObjectMeta{ - Name: "test", - Namespace: "testns", - }, - Spec: v1alpha1.CatalogSourceSpec{ - GrpcPodConfig: &v1alpha1.GrpcPodConfig{ - SecurityContextConfig: v1alpha1.Legacy, - }, - }, }, - expectedContainerSecurityContext: nil, - expectedSecurityContext: nil, }, } + for _, testcase := range testcases { - outputPod, err := Pod(testcase.inputCatsrc, "hello", "utilImage", "opmImage", "busybox", serviceAccount("", "service-account"), map[string]string{}, map[string]string{}, int32(0), int32(0), int64(workloadUserID)) - require.NoError(t, err) - if testcase.expectedSecurityContext != nil { + t.Run(testcase.title, func(t *testing.T) { + outputPod, err := Pod(testcase.inputCatsrc, "hello", "utilImage", "opmImage", "busybox", serviceAccount("", "service-account"), map[string]string{}, map[string]string{}, int32(0), int32(0), workloadUserID, testcase.namespacePodSecurityConfig) + require.NoError(t, err) + + // Assert PodSecurityContext require.Equal(t, testcase.expectedSecurityContext, outputPod.Spec.SecurityContext) - } - if testcase.expectedContainerSecurityContext != nil { + + // Assert ContainerSecurityContext require.Equal(t, testcase.expectedContainerSecurityContext, outputPod.Spec.Containers[0].SecurityContext) - } + }) } } @@ -638,7 +668,7 @@ func TestPodAvoidsConcurrentWrite(t *testing.T) { "annotation": "somethingelse", } - gotPod, err := Pod(catsrc, "hello", "opmImage", "utilImage", "busybox", serviceAccount("", "service-account"), labels, annotations, int32(0), int32(0), int64(workloadUserID)) + gotPod, err := Pod(catsrc, "hello", "opmImage", "utilImage", "busybox", serviceAccount("", "service-account"), labels, annotations, int32(0), int32(0), int64(workloadUserID), v1alpha1.Legacy) require.NoError(t, err) // check labels and annotations point to different addresses between parameters and what's in the pod @@ -868,7 +898,7 @@ func TestPodSchedulingOverrides(t *testing.T) { } for _, testCase := range testCases { - pod, err := Pod(testCase.catalogSource, "hello", "opmImage", "utilImage", "busybox", serviceAccount("", "service-account"), map[string]string{}, testCase.annotations, int32(0), int32(0), int64(workloadUserID)) + pod, err := Pod(testCase.catalogSource, "hello", "opmImage", "utilImage", "busybox", serviceAccount("", "service-account"), map[string]string{}, testCase.annotations, int32(0), int32(0), int64(workloadUserID), v1alpha1.Legacy) require.NoError(t, err) require.Equal(t, testCase.expectedNodeSelectors, pod.Spec.NodeSelector) require.Equal(t, testCase.expectedPriorityClassName, pod.Spec.PriorityClassName) @@ -876,3 +906,26 @@ func TestPodSchedulingOverrides(t *testing.T) { require.Equal(t, testCase.expectedAffinity, pod.Spec.Affinity) } } + +// baseClusterState returns a list of runtime objects that are required for the tests to run including the +// target namespace with the assumed default configuration +func baseClusterState() []runtime.Object { + return []runtime.Object{ + defaultNamespace(), + } +} + +// defaultNamespace returns a kubernetes namespace with the assumes default settings, +// e.g. Pod Security Admission security policy label +func defaultNamespace() *corev1.Namespace { + return &corev1.Namespace{ + ObjectMeta: metav1.ObjectMeta{ + Name: testNamespace, + Labels: map[string]string{ + // catalogsource pod security configuration depends on the defaultNamespace psa configuration + // adding restricted PSA label as this is the default + "pod-security.kubernetes.io/enforce": "restricted", + }, + }, + } +} diff --git a/vendor/github.com/operator-framework/operator-lifecycle-manager/pkg/controller/registry/reconciler/configmap.go b/vendor/github.com/operator-framework/operator-lifecycle-manager/pkg/controller/registry/reconciler/configmap.go index 654484125e..2e47c56507 100644 --- a/vendor/github.com/operator-framework/operator-lifecycle-manager/pkg/controller/registry/reconciler/configmap.go +++ b/vendor/github.com/operator-framework/operator-lifecycle-manager/pkg/controller/registry/reconciler/configmap.go @@ -109,8 +109,8 @@ func (s *configMapCatalogSourceDecorator) Service() (*corev1.Service, error) { return svc, nil } -func (s *configMapCatalogSourceDecorator) Pod(image string) (*corev1.Pod, error) { - pod, err := Pod(s.CatalogSource, "configmap-registry-server", "", "", image, nil, s.Labels(), s.Annotations(), 5, 5, s.runAsUser) +func (s *configMapCatalogSourceDecorator) Pod(image string, defaultPodSecurityConfig v1alpha1.SecurityConfig) (*corev1.Pod, error) { + pod, err := Pod(s.CatalogSource, "configmap-registry-server", "", "", image, nil, s.Labels(), s.Annotations(), 5, 5, s.runAsUser, defaultPodSecurityConfig) if err != nil { return nil, err } @@ -238,8 +238,8 @@ func (c *ConfigMapRegistryReconciler) currentRoleBinding(source configMapCatalog return roleBinding } -func (c *ConfigMapRegistryReconciler) currentPods(source configMapCatalogSourceDecorator, image string) ([]*corev1.Pod, error) { - protoPod, err := source.Pod(image) +func (c *ConfigMapRegistryReconciler) currentPods(source configMapCatalogSourceDecorator, image string, defaultPodSecurityConfig v1alpha1.SecurityConfig) ([]*corev1.Pod, error) { + protoPod, err := source.Pod(image, defaultPodSecurityConfig) if err != nil { return nil, err } @@ -255,8 +255,8 @@ func (c *ConfigMapRegistryReconciler) currentPods(source configMapCatalogSourceD return pods, nil } -func (c *ConfigMapRegistryReconciler) currentPodsWithCorrectResourceVersion(source configMapCatalogSourceDecorator, image string) ([]*corev1.Pod, error) { - protoPod, err := source.Pod(image) +func (c *ConfigMapRegistryReconciler) currentPodsWithCorrectResourceVersion(source configMapCatalogSourceDecorator, image string, defaultPodSecurityConfig v1alpha1.SecurityConfig) ([]*corev1.Pod, error) { + protoPod, err := source.Pod(image, defaultPodSecurityConfig) if err != nil { return nil, err } @@ -288,6 +288,11 @@ func (c *ConfigMapRegistryReconciler) EnsureRegistryServer(logger *logrus.Entry, overwrite := source.Status.RegistryServiceStatus == nil overwritePod := overwrite + defaultPodSecurityConfig, err := getDefaultPodContextConfig(c.OpClient, catalogSource.GetNamespace()) + if err != nil { + return err + } + if source.Spec.SourceType == v1alpha1.SourceTypeConfigmap || source.Spec.SourceType == v1alpha1.SourceTypeInternal { // fetch configmap first, exit early if we can't find it // we use the live client here instead of a lister since our listers are scoped to objects with the olm.managed label, @@ -311,7 +316,7 @@ func (c *ConfigMapRegistryReconciler) EnsureRegistryServer(logger *logrus.Entry, } // recreate the pod if no existing pod is serving the latest image - current, err := c.currentPodsWithCorrectResourceVersion(source, image) + current, err := c.currentPodsWithCorrectResourceVersion(source, image, defaultPodSecurityConfig) if err != nil { return err } @@ -330,11 +335,11 @@ func (c *ConfigMapRegistryReconciler) EnsureRegistryServer(logger *logrus.Entry, if err := c.ensureRoleBinding(source, overwrite); err != nil { return errors.Wrapf(err, "error ensuring rolebinding: %s", source.RoleBinding().GetName()) } - pod, err := source.Pod(image) + pod, err := source.Pod(image, defaultPodSecurityConfig) if err != nil { return err } - if err := c.ensurePod(source, overwritePod); err != nil { + if err := c.ensurePod(source, defaultPodSecurityConfig, overwritePod); err != nil { return errors.Wrapf(err, "error ensuring pod: %s", pod.GetName()) } service, err := source.Service() @@ -400,12 +405,12 @@ func (c *ConfigMapRegistryReconciler) ensureRoleBinding(source configMapCatalogS return err } -func (c *ConfigMapRegistryReconciler) ensurePod(source configMapCatalogSourceDecorator, overwrite bool) error { - pod, err := source.Pod(c.Image) +func (c *ConfigMapRegistryReconciler) ensurePod(source configMapCatalogSourceDecorator, defaultPodSecurityConfig v1alpha1.SecurityConfig, overwrite bool) error { + pod, err := source.Pod(c.Image, defaultPodSecurityConfig) if err != nil { return err } - currentPods, err := c.currentPods(source, c.Image) + currentPods, err := c.currentPods(source, c.Image, defaultPodSecurityConfig) if err != nil { return err } @@ -460,6 +465,11 @@ func (c *ConfigMapRegistryReconciler) CheckRegistryServer(logger *logrus.Entry, return } + defaultPodSecurityConfig, err := getDefaultPodContextConfig(c.OpClient, catalogSource.GetNamespace()) + if err != nil { + return false, err + } + if source.Spec.SourceType == v1alpha1.SourceTypeConfigmap || source.Spec.SourceType == v1alpha1.SourceTypeInternal { // we use the live client here instead of a lister since our listers are scoped to objects with the olm.managed label, // and this configmap is a user-provided input to the catalog source and will not have that label @@ -473,7 +483,7 @@ func (c *ConfigMapRegistryReconciler) CheckRegistryServer(logger *logrus.Entry, } // recreate the pod if no existing pod is serving the latest image - current, err := c.currentPodsWithCorrectResourceVersion(source, image) + current, err := c.currentPodsWithCorrectResourceVersion(source, image, defaultPodSecurityConfig) if err != nil { return false, err } @@ -489,7 +499,7 @@ func (c *ConfigMapRegistryReconciler) CheckRegistryServer(logger *logrus.Entry, if err != nil { return false, err } - pods, err := c.currentPods(source, c.Image) + pods, err := c.currentPods(source, c.Image, defaultPodSecurityConfig) if err != nil { return false, err } diff --git a/vendor/github.com/operator-framework/operator-lifecycle-manager/pkg/controller/registry/reconciler/grpc.go b/vendor/github.com/operator-framework/operator-lifecycle-manager/pkg/controller/registry/reconciler/grpc.go index 4981600256..30cf12f1d2 100644 --- a/vendor/github.com/operator-framework/operator-lifecycle-manager/pkg/controller/registry/reconciler/grpc.go +++ b/vendor/github.com/operator-framework/operator-lifecycle-manager/pkg/controller/registry/reconciler/grpc.go @@ -10,6 +10,13 @@ import ( "github.com/google/go-cmp/cmp" "github.com/operator-framework/api/pkg/operators/v1alpha1" + + "github.com/operator-framework/operator-lifecycle-manager/pkg/controller/install" + controllerclient "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/controller-runtime/client" + hashutil "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/kubernetes/pkg/util/hash" + "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/operatorclient" + "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/operatorlister" + "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/ownerutil" pkgerrors "github.com/pkg/errors" "github.com/sirupsen/logrus" corev1 "k8s.io/api/core/v1" @@ -18,13 +25,6 @@ import ( "k8s.io/apimachinery/pkg/labels" "k8s.io/apimachinery/pkg/util/intstr" "k8s.io/utils/ptr" - - "github.com/operator-framework/operator-lifecycle-manager/pkg/controller/install" - controllerclient "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/controller-runtime/client" - hashutil "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/kubernetes/pkg/util/hash" - "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/operatorclient" - "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/operatorlister" - "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/ownerutil" ) const ( @@ -134,8 +134,8 @@ func (s *grpcCatalogSourceDecorator) ServiceAccount() *corev1.ServiceAccount { } } -func (s *grpcCatalogSourceDecorator) Pod(serviceAccount *corev1.ServiceAccount) (*corev1.Pod, error) { - pod, err := Pod(s.CatalogSource, "registry-server", s.opmImage, s.utilImage, s.Spec.Image, serviceAccount, s.Labels(), s.Annotations(), 5, 10, s.createPodAsUser) +func (s *grpcCatalogSourceDecorator) Pod(serviceAccount *corev1.ServiceAccount, defaultPodSecurityConfig v1alpha1.SecurityConfig) (*corev1.Pod, error) { + pod, err := Pod(s.CatalogSource, "registry-server", s.opmImage, s.utilImage, s.Spec.Image, serviceAccount, s.Labels(), s.Annotations(), 5, 10, s.createPodAsUser, defaultPodSecurityConfig) if err != nil { return nil, err } @@ -203,7 +203,7 @@ func (c *GrpcRegistryReconciler) currentUpdatePods(logger *logrus.Entry, source return pods } -func (c *GrpcRegistryReconciler) currentPodsWithCorrectImageAndSpec(logger *logrus.Entry, source grpcCatalogSourceDecorator, serviceAccount *corev1.ServiceAccount) ([]*corev1.Pod, error) { +func (c *GrpcRegistryReconciler) currentPodsWithCorrectImageAndSpec(logger *logrus.Entry, source grpcCatalogSourceDecorator, serviceAccount *corev1.ServiceAccount, defaultPodSecurityConfig v1alpha1.SecurityConfig) ([]*corev1.Pod, error) { logger.Info("searching for current pods") pods, err := c.Lister.CoreV1().PodLister().Pods(source.GetNamespace()).List(labels.SelectorFromValidatedSet(source.Labels())) if err != nil { @@ -211,7 +211,7 @@ func (c *GrpcRegistryReconciler) currentPodsWithCorrectImageAndSpec(logger *logr return nil, nil } found := []*corev1.Pod{} - newPod, err := source.Pod(serviceAccount) + newPod, err := source.Pod(serviceAccount, defaultPodSecurityConfig) if err != nil { return nil, err } @@ -273,8 +273,13 @@ func (c *GrpcRegistryReconciler) EnsureRegistryServer(logger *logrus.Entry, cata return err } + defaultPodSecurityConfig, err := getDefaultPodContextConfig(c.OpClient, catalogSource.GetNamespace()) + if err != nil { + return err + } + // recreate the pod if no existing pod is serving the latest image or correct spec - current, err := c.currentPodsWithCorrectImageAndSpec(logger, source, sa) + current, err := c.currentPodsWithCorrectImageAndSpec(logger, source, sa, defaultPodSecurityConfig) if err != nil { return err } @@ -283,14 +288,14 @@ func (c *GrpcRegistryReconciler) EnsureRegistryServer(logger *logrus.Entry, cata logger.Info("registry pods invalid, need to overwrite") } - pod, err := source.Pod(sa) + pod, err := source.Pod(sa, defaultPodSecurityConfig) if err != nil { return err } - if err := c.ensurePod(logger, source, sa, overwritePod); err != nil { + if err := c.ensurePod(logger, source, sa, defaultPodSecurityConfig, overwritePod); err != nil { return pkgerrors.Wrapf(err, "error ensuring pod: %s", pod.GetName()) } - if err := c.ensureUpdatePod(logger, sa, source); err != nil { + if err := c.ensureUpdatePod(logger, sa, defaultPodSecurityConfig, source); err != nil { if _, ok := err.(UpdateNotReadyErr); ok { return err } @@ -340,7 +345,7 @@ func isRegistryServiceStatusValid(source *grpcCatalogSourceDecorator) (bool, err return true, nil } -func (c *GrpcRegistryReconciler) ensurePod(logger *logrus.Entry, source grpcCatalogSourceDecorator, serviceAccount *corev1.ServiceAccount, overwrite bool) error { +func (c *GrpcRegistryReconciler) ensurePod(logger *logrus.Entry, source grpcCatalogSourceDecorator, serviceAccount *corev1.ServiceAccount, defaultPodSecurityConfig v1alpha1.SecurityConfig, overwrite bool) error { // currentPods refers to the current pod instances of the catalog source currentPods := c.currentPods(logger, source) @@ -373,7 +378,7 @@ func (c *GrpcRegistryReconciler) ensurePod(logger *logrus.Entry, source grpcCata } } } - desiredPod, err := source.Pod(serviceAccount) + desiredPod, err := source.Pod(serviceAccount, defaultPodSecurityConfig) if err != nil { return err } @@ -387,7 +392,7 @@ func (c *GrpcRegistryReconciler) ensurePod(logger *logrus.Entry, source grpcCata } // ensureUpdatePod checks that for the same catalog source version the same container imageID is running -func (c *GrpcRegistryReconciler) ensureUpdatePod(logger *logrus.Entry, serviceAccount *corev1.ServiceAccount, source grpcCatalogSourceDecorator) error { +func (c *GrpcRegistryReconciler) ensureUpdatePod(logger *logrus.Entry, serviceAccount *corev1.ServiceAccount, podSecurityConfig v1alpha1.SecurityConfig, source grpcCatalogSourceDecorator) error { if !source.Poll() { logger.Info("polling not enabled, no update pod will be created") return nil @@ -398,7 +403,7 @@ func (c *GrpcRegistryReconciler) ensureUpdatePod(logger *logrus.Entry, serviceAc if source.Update() && len(currentUpdatePods) == 0 { logger.Infof("catalog update required at %s", time.Now().String()) - pod, err := c.createUpdatePod(source, serviceAccount) + pod, err := c.createUpdatePod(source, serviceAccount, podSecurityConfig) if err != nil { return pkgerrors.Wrapf(err, "creating update catalog source pod") } @@ -506,9 +511,9 @@ func ServiceHashMatch(existing, new *corev1.Service) bool { } // createUpdatePod is an internal method that creates a pod using the latest catalog source. -func (c *GrpcRegistryReconciler) createUpdatePod(source grpcCatalogSourceDecorator, serviceAccount *corev1.ServiceAccount) (*corev1.Pod, error) { +func (c *GrpcRegistryReconciler) createUpdatePod(source grpcCatalogSourceDecorator, serviceAccount *corev1.ServiceAccount, defaultPodSecurityConfig v1alpha1.SecurityConfig) (*corev1.Pod, error) { // remove label from pod to ensure service does not accidentally route traffic to the pod - p, err := source.Pod(serviceAccount) + p, err := source.Pod(serviceAccount, defaultPodSecurityConfig) if err != nil { return nil, err } @@ -612,13 +617,18 @@ func (c *GrpcRegistryReconciler) CheckRegistryServer(logger *logrus.Entry, catal return false, nil } + registryPodSecurityConfig, err := getDefaultPodContextConfig(c.OpClient, catalogSource.GetNamespace()) + if err != nil { + return false, err + } + // Check on registry resources // TODO: add gRPC health check service, err := c.currentService(source) if err != nil { return false, err } - current, err := c.currentPodsWithCorrectImageAndSpec(logger, source, serviceAccount) + current, err := c.currentPodsWithCorrectImageAndSpec(logger, source, serviceAccount, registryPodSecurityConfig) if err != nil { return false, err } diff --git a/vendor/github.com/operator-framework/operator-lifecycle-manager/pkg/controller/registry/reconciler/reconciler.go b/vendor/github.com/operator-framework/operator-lifecycle-manager/pkg/controller/registry/reconciler/reconciler.go index 77b5096038..0b0402cc3d 100644 --- a/vendor/github.com/operator-framework/operator-lifecycle-manager/pkg/controller/registry/reconciler/reconciler.go +++ b/vendor/github.com/operator-framework/operator-lifecycle-manager/pkg/controller/registry/reconciler/reconciler.go @@ -2,6 +2,7 @@ package reconciler import ( + "context" "fmt" "path/filepath" @@ -29,7 +30,7 @@ const ( CatalogPriorityClassKey string = "operatorframework.io/priorityclass" // PodHashLabelKey is the key of a label for podspec hash information PodHashLabelKey = "olm.pod-spec-hash" - //ClusterAutoscalingAnnotation is the annotation that enables the cluster autoscaler to evict catalog pods + //ClusterAutoscalingAnnotationKey is the annotation that enables the cluster autoscaler to evict catalog pods ClusterAutoscalingAnnotationKey string = "cluster-autoscaler.kubernetes.io/safe-to-evict" ) @@ -114,7 +115,7 @@ func NewRegistryReconcilerFactory(lister operatorlister.OperatorLister, opClient } } -func Pod(source *operatorsv1alpha1.CatalogSource, name, opmImg, utilImage, img string, serviceAccount *corev1.ServiceAccount, labels, annotations map[string]string, readinessDelay, livenessDelay int32, runAsUser int64) (*corev1.Pod, error) { +func Pod(source *operatorsv1alpha1.CatalogSource, name, opmImg, utilImage, img string, serviceAccount *corev1.ServiceAccount, labels, annotations map[string]string, readinessDelay, livenessDelay int32, runAsUser int64, defaultSecurityConfig operatorsv1alpha1.SecurityConfig) (*corev1.Pod, error) { // make a copy of the labels and annotations to avoid mutating the input parameters podLabels := make(map[string]string) podAnnotations := make(map[string]string) @@ -190,7 +191,7 @@ func Pod(source *operatorsv1alpha1.CatalogSource, name, opmImg, utilImage, img s }, }, SecurityContext: &corev1.SecurityContext{ - ReadOnlyRootFilesystem: ptr.To(bool(false)), + ReadOnlyRootFilesystem: ptr.To(false), }, ImagePullPolicy: image.InferImagePullPolicy(img), TerminationMessagePolicy: corev1.TerminationMessageFallbackToLogsOnError, @@ -200,13 +201,26 @@ func Pod(source *operatorsv1alpha1.CatalogSource, name, opmImg, utilImage, img s "kubernetes.io/os": "linux", }, ServiceAccountName: saName, - // If this field is not set, there that the is a chance that pod will be created without the imagePullSecret + // If this field is not set, there is a chance that pod will be created without the imagePullSecret // defined by the serviceAccount ImagePullSecrets: saImagePullSecrets, }, } - if source.Spec.GrpcPodConfig != nil && source.Spec.GrpcPodConfig.SecurityContextConfig == operatorsv1alpha1.Restricted { + // Determine the security context configuration + var securityContextConfig operatorsv1alpha1.SecurityConfig + + // Use the user-provided security context config if it is defined + if source.Spec.GrpcPodConfig != nil && source.Spec.GrpcPodConfig.SecurityContextConfig != "" { + securityContextConfig = source.Spec.GrpcPodConfig.SecurityContextConfig + } else { + // Default to the defaultNamespace based and provided security context config + securityContextConfig = defaultSecurityConfig + } + + // Apply the appropriate security context configuration + if securityContextConfig == operatorsv1alpha1.Restricted { + // Apply 'restricted' security settings addSecurityContext(pod, runAsUser) } @@ -332,7 +346,7 @@ func Pod(source *operatorsv1alpha1.CatalogSource, name, opmImg, utilImage, img s } func addSecurityContext(pod *corev1.Pod, runAsUser int64) { - pod.Spec.Containers[0].SecurityContext.AllowPrivilegeEscalation = ptr.To(bool(false)) + pod.Spec.Containers[0].SecurityContext.AllowPrivilegeEscalation = ptr.To(false) pod.Spec.Containers[0].SecurityContext.Capabilities = &corev1.Capabilities{ Drop: []corev1.Capability{"ALL"}, } @@ -343,6 +357,22 @@ func addSecurityContext(pod *corev1.Pod, runAsUser int64) { } if runAsUser > 0 { pod.Spec.SecurityContext.RunAsUser = &runAsUser - pod.Spec.SecurityContext.RunAsNonRoot = ptr.To(bool(true)) + pod.Spec.SecurityContext.RunAsNonRoot = ptr.To(true) } } + +// getDefaultPodContextConfig returns Restricted if the defaultNamespace has the 'pod-security.kubernetes.io/enforce' label set to 'restricted', +// otherwise it returns Legacy. This is used to help determine the security context of the registry pod when it is not already defined by the user +func getDefaultPodContextConfig(client operatorclient.ClientInterface, namespace string) (operatorsv1alpha1.SecurityConfig, error) { + ns, err := client.KubernetesInterface().CoreV1().Namespaces().Get(context.TODO(), namespace, metav1.GetOptions{}) + if err != nil { + return "", fmt.Errorf("error fetching defaultNamespace: %v", err) + } + // 'pod-security.kubernetes.io/enforce' is the label used for enforcing defaultNamespace level security, + // and 'restricted' is the value indicating a restricted security policy. + if val, exists := ns.Labels["pod-security.kubernetes.io/enforce"]; exists && val == "restricted" { + return operatorsv1alpha1.Restricted, nil + } + + return operatorsv1alpha1.Legacy, nil +} From 096fed55fd79beb57f42c9d48551f7b8dff840e2 Mon Sep 17 00:00:00 2001 From: Joe Lanford Date: Thu, 13 Jun 2024 10:13:18 -0400 Subject: [PATCH 2/2] remove default value of catsrc.spec.grpcPodConfig.securityContextConfig (#342) Signed-off-by: Joe Lanford Upstream-repository: api Upstream-commit: 5d2d3fbe061b7b4a942747877efa58958fa9889e --- manifests/0000_50_olm_00-catalogsources.crd.yaml | 3 +-- .../0000_50_olm_00-catalogsources.crd.yaml | 3 +-- .../crds/operators.coreos.com_catalogsources.yaml | 14 +++++--------- staging/api/crds/zz_defs.go | 2 +- .../pkg/operators/v1alpha1/catalogsource_types.go | 13 +++++-------- .../crds/operators.coreos.com_catalogsources.yaml | 14 +++++--------- .../operator-framework/api/crds/zz_defs.go | 2 +- .../pkg/operators/v1alpha1/catalogsource_types.go | 13 +++++-------- 8 files changed, 24 insertions(+), 40 deletions(-) diff --git a/manifests/0000_50_olm_00-catalogsources.crd.yaml b/manifests/0000_50_olm_00-catalogsources.crd.yaml index a40c24044b..8abcbecc60 100644 --- a/manifests/0000_50_olm_00-catalogsources.crd.yaml +++ b/manifests/0000_50_olm_00-catalogsources.crd.yaml @@ -613,9 +613,8 @@ spec: description: If specified, indicates the pod's priority. If not specified, the pod priority will be default or zero if there is no default. type: string securityContextConfig: - description: "SecurityContextConfig can be one of `legacy` or `restricted`. The CatalogSource's pod is either injected with the right pod.spec.securityContext and pod.spec.container[*].securityContext values to allow the pod to run in Pod Security Admission (PSA) `restricted` mode, or doesn't set these values at all, in which case the pod can only be run in PSA `baseline` or `privileged` namespaces. Currently if the SecurityContextConfig is unspecified, the default value of `legacy` is used. Specifying a value other than `legacy` or `restricted` result in a validation error. When using older catalog images, which could not be run in `restricted` mode, the SecurityContextConfig should be set to `legacy`. \n In a future version will the default will be set to `restricted`, catalog maintainers should rebuild their catalogs with a version of opm that supports running catalogSource pods in `restricted` mode to prepare for these changes. \n More information about PSA can be found here: https://kubernetes.io/docs/concepts/security/pod-security-admission/'" + description: "SecurityContextConfig can be one of `legacy` or `restricted`. The CatalogSource's pod is either injected with the right pod.spec.securityContext and pod.spec.container[*].securityContext values to allow the pod to run in Pod Security Admission (PSA) `restricted` mode, or doesn't set these values at all, in which case the pod can only be run in PSA `baseline` or `privileged` namespaces. If the SecurityContextConfig is unspecified, the mode will be determined by the namespace's PSA configuration. If the namespace is enforcing `restricted` mode, then the pod will be configured as if `restricted` was specified. Otherwise, it will be configured as if `legacy` was specified. Specifying a value other than `legacy` or `restricted` result in a validation error. When using older catalog images, which can not run in `restricted` mode, the SecurityContextConfig should be set to `legacy`. \n More information about PSA can be found here: https://kubernetes.io/docs/concepts/security/pod-security-admission/'" type: string - default: legacy enum: - legacy - restricted diff --git a/microshift-manifests/0000_50_olm_00-catalogsources.crd.yaml b/microshift-manifests/0000_50_olm_00-catalogsources.crd.yaml index a40c24044b..8abcbecc60 100644 --- a/microshift-manifests/0000_50_olm_00-catalogsources.crd.yaml +++ b/microshift-manifests/0000_50_olm_00-catalogsources.crd.yaml @@ -613,9 +613,8 @@ spec: description: If specified, indicates the pod's priority. If not specified, the pod priority will be default or zero if there is no default. type: string securityContextConfig: - description: "SecurityContextConfig can be one of `legacy` or `restricted`. The CatalogSource's pod is either injected with the right pod.spec.securityContext and pod.spec.container[*].securityContext values to allow the pod to run in Pod Security Admission (PSA) `restricted` mode, or doesn't set these values at all, in which case the pod can only be run in PSA `baseline` or `privileged` namespaces. Currently if the SecurityContextConfig is unspecified, the default value of `legacy` is used. Specifying a value other than `legacy` or `restricted` result in a validation error. When using older catalog images, which could not be run in `restricted` mode, the SecurityContextConfig should be set to `legacy`. \n In a future version will the default will be set to `restricted`, catalog maintainers should rebuild their catalogs with a version of opm that supports running catalogSource pods in `restricted` mode to prepare for these changes. \n More information about PSA can be found here: https://kubernetes.io/docs/concepts/security/pod-security-admission/'" + description: "SecurityContextConfig can be one of `legacy` or `restricted`. The CatalogSource's pod is either injected with the right pod.spec.securityContext and pod.spec.container[*].securityContext values to allow the pod to run in Pod Security Admission (PSA) `restricted` mode, or doesn't set these values at all, in which case the pod can only be run in PSA `baseline` or `privileged` namespaces. If the SecurityContextConfig is unspecified, the mode will be determined by the namespace's PSA configuration. If the namespace is enforcing `restricted` mode, then the pod will be configured as if `restricted` was specified. Otherwise, it will be configured as if `legacy` was specified. Specifying a value other than `legacy` or `restricted` result in a validation error. When using older catalog images, which can not run in `restricted` mode, the SecurityContextConfig should be set to `legacy`. \n More information about PSA can be found here: https://kubernetes.io/docs/concepts/security/pod-security-admission/'" type: string - default: legacy enum: - legacy - restricted diff --git a/staging/api/crds/operators.coreos.com_catalogsources.yaml b/staging/api/crds/operators.coreos.com_catalogsources.yaml index f467ad49b7..bd7ad79f55 100644 --- a/staging/api/crds/operators.coreos.com_catalogsources.yaml +++ b/staging/api/crds/operators.coreos.com_catalogsources.yaml @@ -989,19 +989,15 @@ spec: SecurityContextConfig can be one of `legacy` or `restricted`. The CatalogSource's pod is either injected with the right pod.spec.securityContext and pod.spec.container[*].securityContext values to allow the pod to run in Pod Security Admission (PSA) `restricted` mode, or doesn't set these values at all, in which case the pod can only be - run in PSA `baseline` or `privileged` namespaces. Currently if the SecurityContextConfig is unspecified, the default - value of `legacy` is used. Specifying a value other than `legacy` or `restricted` result in a validation error. - When using older catalog images, which could not be run in `restricted` mode, the SecurityContextConfig should be - set to `legacy`. - - - In a future version will the default will be set to `restricted`, catalog maintainers should rebuild their catalogs - with a version of opm that supports running catalogSource pods in `restricted` mode to prepare for these changes. + run in PSA `baseline` or `privileged` namespaces. If the SecurityContextConfig is unspecified, the mode will be + determined by the namespace's PSA configuration. If the namespace is enforcing `restricted` mode, then the pod + will be configured as if `restricted` was specified. Otherwise, it will be configured as if `legacy` was + specified. Specifying a value other than `legacy` or `restricted` result in a validation error. When using older + catalog images, which can not run in `restricted` mode, the SecurityContextConfig should be set to `legacy`. More information about PSA can be found here: https://kubernetes.io/docs/concepts/security/pod-security-admission/' type: string - default: legacy enum: - legacy - restricted diff --git a/staging/api/crds/zz_defs.go b/staging/api/crds/zz_defs.go index 8d7b58d404..b3dc2a2492 100644 --- a/staging/api/crds/zz_defs.go +++ b/staging/api/crds/zz_defs.go @@ -85,7 +85,7 @@ func (fi bindataFileInfo) Sys() interface{} { return nil } -var _operatorsCoreosCom_catalogsourcesYaml = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\xec\x7d\x69\x73\xdb\xb8\x96\xe8\xe7\xc9\xaf\x40\xf9\x4d\x55\xac\x5c\x49\x4e\xfa\xde\xea\x37\xd7\xb7\x97\xf2\x38\xcb\x73\x75\x16\x57\xec\xee\xa9\x37\xb9\x79\x2f\x10\x79\x24\xa1\x4d\x02\x6c\x00\xb4\xad\x5e\xfe\xfb\x14\x0e\x00\x92\xa2\xc4\x4d\xde\x92\xbe\xc0\x87\xee\x58\x24\xb1\x1c\x9c\x73\x70\x76\xd0\x8c\xfd\x04\x52\x31\xc1\x0f\x09\xcd\x18\x5c\x6b\xe0\xe6\x2f\x35\xbd\xf8\x0f\x35\x65\xe2\xe0\xf2\xd9\xa3\x0b\xc6\xe3\x43\x72\x9c\x2b\x2d\xd2\xf7\xa0\x44\x2e\x23\x78\x0e\x73\xc6\x99\x66\x82\x3f\x4a\x41\xd3\x98\x6a\x7a\xf8\x88\x10\xca\xb9\xd0\xd4\xfc\xac\xcc\x9f\x84\x44\x82\x6b\x29\x92\x04\xe4\x64\x01\x7c\x7a\x91\xcf\x60\x96\xb3\x24\x06\x89\x9d\xfb\xa1\x2f\x9f\x4e\x9f\xfd\x6d\xfa\xf4\x11\x21\x9c\xa6\x70\x48\x22\xaa\x69\x22\x16\x76\x2c\x35\x15\x19\x48\xaa\x85\x54\xd3\x48\x48\x10\xe6\x7f\xe9\x23\x95\x41\x64\x06\x59\x48\x91\x67\x87\x64\xeb\x3b\xb6\x3f\x3f\x17\xaa\x61\x21\x24\xf3\x7f\x13\x32\x21\x22\x49\xf1\xdf\x6e\x8d\x76\xd8\x33\x1c\x16\x7f\x4f\x98\xd2\x3f\x6c\x3e\x7b\xcd\x94\xc6\xe7\x59\x92\x4b\x9a\xd4\x27\x8c\x8f\xd4\x52\x48\xfd\xb6\x1c\xde\x0c\x17\x51\xad\x64\x64\x1f\x33\xbe\xc8\x13\x2a\x6b\xdf\x3e\x22\x44\x45\x22\x83\x43\x82\x9f\x66\x34\x82\xf8\x11\x21\x0e\x52\xae\xab\x09\xa1\x71\x8c\xd0\xa7\xc9\xa9\x64\x5c\x83\x3c\x16\x49\x9e\xf2\x62\x28\xf3\x4e\x0c\x2a\x92\x2c\xd3\x08\xe1\xf3\x25\x90\x4c\x82\xd6\x2b\x04\x09\x11\x73\xa2\x97\xe0\xc7\x2e\xbe\x22\xe4\x67\x25\xf8\x29\xd5\xcb\x43\x32\x35\x10\x9e\xc6\x4c\x65\x09\x5d\x99\xd9\x54\xde\xb2\xdb\xf4\xdc\x3e\xab\xfc\xae\x57\x66\xea\x4a\x4b\xc6\x17\x6d\x53\x31\xef\xf5\x9f\x83\x05\xcd\xf9\x2a\xdb\x9c\x42\xed\xc7\xbe\xe3\x67\xf9\x2c\x61\x6a\x09\xb2\xff\x24\x8a\x4f\x36\xe6\x70\xba\xe5\x49\xc3\x44\x2a\x9d\x7a\xba\x99\x46\x12\x90\x64\xce\x59\x0a\x4a\xd3\x34\xdb\x18\xe0\x68\xb1\xb9\xc6\x98\x6a\xff\xa3\x7d\xe9\xf2\x19\x4d\xb2\x25\x7d\xe6\x7e\x54\xd1\x12\x52\x5a\xe2\x83\xc8\x80\x1f\x9d\x9e\xfc\xf4\xd7\xb3\xda\x03\xb2\x0e\x9d\x35\x3c\x27\x4c\x11\x4a\x24\x64\x42\x31\x2d\xe4\xca\x40\xeb\xf8\xec\x27\x35\x26\xc7\xef\x9f\xab\x31\xa1\x3c\x2e\x08\x8f\x64\x34\xba\xa0\x0b\x50\xd3\x8d\xb9\x8a\xd9\xcf\x10\xe9\xca\xcf\x12\x7e\xc9\x99\x84\xb8\x3a\x0b\x03\x1e\x0f\x93\xda\xcf\x06\xfe\x95\x9f\x32\x69\xc6\xd4\x15\x42\xb6\xad\xc2\xcc\xd6\x7e\xaf\xad\xf0\xf7\x49\xed\x29\x21\x06\x30\xf6\x4b\x12\x1b\xce\x06\x0a\x91\xc2\x51\x1d\xc4\x0e\x9a\x16\x59\x98\x32\x10\x91\xa0\x80\x5b\x5e\x67\x7e\xa6\xdc\xad\x72\xba\xd1\xf9\x19\x48\xd3\x91\x61\x08\x79\x12\x1b\x96\x78\x09\x52\x13\x09\x91\x58\x70\xf6\x6b\xd1\xbb\x22\x5a\xe0\xb0\x09\xd5\xa0\x34\x41\xba\xe6\x34\x21\x97\x34\xc9\x01\x81\xbd\xd1\x77\x4a\x57\x44\x82\x19\x97\xe4\xbc\xd2\x23\x7e\xa2\x36\xe7\xf2\x46\x48\x20\x8c\xcf\xc5\x21\x59\x6a\x9d\xa9\xc3\x83\x83\x05\xd3\x9e\xd9\x47\x22\x4d\x73\xce\xf4\xea\x00\xf9\x36\x9b\xe5\x86\xa1\x1e\xc4\x70\x09\xc9\x81\x62\x8b\x09\x95\xd1\x92\x69\x88\x74\x2e\xe1\x80\x66\x6c\x82\x8b\xe1\xc8\xf0\xa7\x69\xfc\xbf\x24\x54\x39\x60\x1d\x0d\x6a\xd4\x40\x3c\xdf\x1d\xb8\x59\x86\x1f\x5b\xc4\xb4\x1d\xda\xc5\x96\x7b\x62\x7e\x32\x60\x7c\xff\xe2\xec\x9c\xf8\x19\xd9\x7d\xb3\x5b\x54\xbe\xba\x05\x42\x7e\xb7\x0c\x64\x19\x9f\x83\xb4\x5f\xce\xa5\x48\xb1\x57\xe0\x71\x26\x18\xd7\x96\x6b\x24\x0c\xb8\x26\x2a\x9f\xa5\x4c\x2b\x44\x6b\x50\xda\x6c\xe4\x66\xc7\xc7\x78\x38\x92\x19\x90\x3c\x33\xc4\x1b\x6f\xbe\x72\xc2\xc9\x31\x4d\x21\x39\xa6\x0a\xee\x7d\xef\xcc\x1e\xa9\x89\xd9\x90\xde\xbb\x57\x3d\xfa\x37\x3f\xd8\xa0\x7a\x42\xfc\x99\xdd\xeb\xe5\x26\x36\x41\x2c\x4f\xd8\x76\x26\x90\x16\xee\x60\x1a\x8d\x63\x09\x6a\xcb\x83\x6e\xac\x33\xed\xc8\x7e\x6e\x91\x6f\x29\x94\x41\x02\xaa\xc9\xbb\xd7\x6f\x48\x44\x39\xc9\x15\x18\x12\x8e\x04\xe7\x06\xcb\xb4\x20\xd4\x9c\xb9\x13\xb8\x66\x0a\xb1\x52\xc2\x82\x29\x2d\x57\x9b\x7b\x6b\xda\x4b\x21\x53\xaa\x0f\xc9\x37\xfe\xb5\x09\x0e\x21\x24\x61\xd9\x77\x87\xdf\x64\x42\xea\xef\xb6\x7e\xf8\x8e\x27\x2b\x33\x78\x4c\xae\x96\xc0\xc9\x59\x01\x19\xf2\x6d\xe5\x8f\x57\x32\x8b\xb6\x0f\x7c\xb2\xe0\x42\xfa\xaf\x0d\x5a\x9f\xa4\x74\x01\x64\xce\x20\x41\x42\x53\xb0\x85\xab\xb5\xa0\x05\xb1\x82\xdf\x9c\x2d\xde\xd0\x6c\x57\x58\x1f\xfb\x0e\xcc\x0c\xcc\xa4\xaa\x62\x4b\xf9\x50\x0b\xa4\x28\xb3\x78\xf3\x4f\x1a\x5d\x10\xea\x06\x4f\x69\x36\x51\x48\xcd\x1d\x80\xef\x07\xbf\x63\xdf\xa9\xd9\x91\xf2\xe7\x13\xc7\xa5\x07\x43\xa8\x0a\x84\xc1\xdf\x96\x42\x59\x27\x7c\xdf\x6c\x3b\x53\x7b\x8c\xb1\x90\x59\x74\x2a\x62\xbb\xec\x5d\x77\xf1\x55\xb5\x13\x02\xd7\x99\x50\xa0\x48\xcc\xe6\x73\x90\x86\x73\x8a\x4b\x90\x92\xc5\xa0\xc8\x5c\x48\xdc\xda\x4c\xc4\xc8\x26\x8a\xad\x5e\x93\x47\x4e\xc5\x16\xb6\x49\x06\xd1\x00\x0a\x2d\x16\xc3\xbb\x70\x7b\x2b\x53\x22\x1d\x3c\xc6\x34\x3a\x47\xf5\x68\xb5\xfd\x69\x0d\x74\x47\xee\x65\x8f\xe8\x4e\x14\x75\x1c\xee\xb1\x32\x20\x79\xac\x8a\x3e\xb7\xaf\xbf\x73\xca\x7d\xa6\x6d\x1a\x17\x31\x1c\x75\x4c\x7f\x63\x09\xcf\xf1\x8f\x19\x28\xfc\xbc\x98\x2a\x0a\x36\x71\x9e\x20\xef\xcb\x93\xf5\x5d\x6e\x5a\x47\xcf\xb5\xf4\x5d\x8f\x7d\x0f\xe6\x20\x25\xc4\xcf\x73\x83\xea\x67\xc5\xac\x1c\xe7\xb3\x3f\xbf\xb8\x86\x28\x6f\x22\xc7\xc6\xa5\x37\x20\x7e\xb5\x19\x85\xc3\x41\x02\x24\xb9\x62\x49\xe2\x66\x64\x58\x96\x7f\x60\x40\x82\x12\xa0\x81\xa0\xb2\x07\x8b\xa2\x9a\xa9\xf9\xaa\x73\x00\x03\xd1\x02\xe6\x70\x6d\x84\x1b\xd4\x16\x91\x90\xd8\x9c\x41\x4c\x66\x2b\x27\xc7\x18\xa6\x3e\x26\xb3\x5c\x13\xa6\x51\xc8\x89\x96\x42\xa8\xfa\x21\xba\xd9\xa8\xdd\x5a\x9c\xd7\x25\x13\x28\xa3\x12\xc1\xc1\x70\xc3\xd4\x48\x26\x8e\x5e\x2b\xc3\x4f\x71\xe5\xe5\x67\xac\x2e\x58\x6c\xb6\xd4\x9c\x78\xc5\x76\x79\x8a\x30\xc3\x5c\x31\xbd\xc4\x3f\x16\x46\x5d\x32\xf2\xb1\xca\x53\x33\xe8\x15\xb0\xc5\x52\xab\x31\x61\xd3\x2d\x42\x53\xbd\x19\x04\x04\x1a\x2d\x2b\xd3\x4a\x01\xb4\x22\x34\x49\xfc\x12\xaa\x58\x6b\x25\x90\xd4\xc8\x8a\x64\xdf\x0b\x93\x9d\xa3\x38\x41\x70\x5c\x48\x30\x75\xc4\xdb\xba\x5d\x63\x02\x3a\x9a\x8e\xc6\x9d\xdd\x47\x22\xcd\x72\x0d\x46\x02\xce\x53\xb3\xb5\x4c\x1b\x1d\xcc\x0a\xbe\x52\xe4\x0b\x0b\x29\x48\xdc\xc4\xbd\xda\x62\x4f\x74\xc3\xff\x68\x1c\x6f\xe3\xf9\xf5\xb6\x67\x81\xbb\xe7\x35\x13\x33\x1c\xb3\x40\x42\xf8\xa5\x54\x47\x4b\xa7\x2c\x45\x42\x4a\x50\x99\xe0\xa6\x67\xfb\xe4\x45\xb9\xb6\x7f\x98\x77\x3a\xc7\x33\x9d\xee\xab\x51\xb9\xd9\x4b\xb6\x58\xfa\xbd\xa6\x12\xf0\xb7\x75\x1c\xe9\xda\x72\xcb\x4a\xa8\x94\xb4\x8b\x8e\x98\x86\xb4\x83\x91\x90\x1d\xa8\x9f\x90\x23\x4e\x20\xcd\xf4\xaa\x82\xd8\x15\x14\xd3\x20\xd3\x02\x90\x88\x85\xc8\xf6\x94\x05\x02\x4b\xb3\x84\x45\x4c\x3b\x34\x27\x4f\x7b\x8c\xb7\x6f\x28\x81\x30\x6d\x0e\x0d\xc2\xc5\x44\x64\xa3\x29\x39\x22\x3c\x2f\x18\x4f\xdb\x14\xb8\x28\x66\xe0\x3a\x32\xd3\x52\xa2\xec\xab\x9b\x1f\xf5\x63\xdf\xb6\x35\x0b\xf9\x9b\x6d\xe2\xe6\x0f\xbc\x07\x11\x9a\xd7\x2d\xd4\x3a\x5f\xed\x7b\x90\xf8\xb7\xfd\x1c\xfa\xbc\x5d\x3f\xed\x2d\xe5\x28\x48\x20\xd2\xe6\x34\x04\x99\x8e\x09\x55\x4a\x44\xcc\x68\x85\x25\xee\xaf\x13\x94\x5d\x49\x37\xec\xc9\x50\xf8\x93\xc1\xeb\x27\x68\x78\x58\xa7\xef\xbe\xdf\x6d\x40\x23\x61\x46\xc7\x99\xd7\xa0\xb2\xc6\x77\x67\x2b\x7c\xfa\x58\x91\x84\xce\x20\xd9\xa2\xb4\x37\xb5\xfe\xc4\x5f\xb6\x9e\x6c\xa0\x61\x41\xbd\x18\x42\xd9\xea\xd8\x50\x59\xb7\x33\x71\x14\x78\x62\x8e\x2a\xa3\xda\x53\xc6\x95\xb3\xef\x8c\x09\x25\x17\xb0\xb2\x76\x38\xca\x0b\x53\xdc\xa0\x29\x60\xc7\x12\xec\x81\x6e\xf0\xee\x02\x56\xd8\x61\x93\x0d\xa9\xa5\xab\xa1\x78\x67\xdb\x10\x0e\x50\xb6\x89\x99\xe8\xc0\x2f\x76\x00\xd0\x70\xd2\xb0\xed\x02\x5a\xc5\xe7\x6d\x6d\xc3\x4a\x8d\xe8\x8e\xfb\x81\x9b\x84\x27\xb0\xc7\x07\x9a\x65\x09\x83\xed\xa6\xa6\xf6\xd6\xaa\xf5\xb5\x35\x0f\xbd\x1b\xad\x6b\x20\x81\x98\xf6\xbe\x30\xd7\x59\x7c\x7f\xac\x2c\xbe\x1a\xbe\xb3\x64\x99\x35\xb4\x28\x40\x36\x32\x1c\x69\x6d\xfb\x89\x26\xac\xb4\x65\x2b\x14\x36\x4e\xf8\x98\xbc\x15\xda\xfc\xef\xc5\x35\x53\x46\xc6\x7c\x2e\x40\xbd\x15\x1a\xff\x9c\x92\x57\xda\x92\xde\xeb\x9e\x7c\xb9\x6c\x3b\xef\x81\x5d\xdf\x7d\xef\xc0\x11\xb7\x4c\xd4\x40\xb8\x6a\x74\x55\x53\x72\x62\xc5\xc1\xc2\x0b\xc0\x14\x39\xe1\x46\x29\xb0\x90\x1b\x3c\x14\xda\xdd\xb1\x6f\x37\x64\x9a\x2b\xb4\x9a\x72\xc1\x27\x28\x46\x6d\x1d\xd3\x6e\x90\x19\xb7\xba\x45\xb7\x38\x7c\xf3\xd0\xaf\xd0\x46\xf7\x5a\x8f\x2b\x1f\x0f\x1e\xb7\x32\xd8\x92\x5e\xa2\x68\xcf\xf8\x22\x29\x84\xf8\x31\xb9\x5a\xb2\x68\x69\xb5\xc7\x19\x58\xe7\x40\x26\xc1\x48\x0c\x54\x19\xe6\x6f\x7e\x59\x80\x1c\x8e\xfa\xe7\x46\x35\xb0\xe3\x5b\xd7\x46\x42\x23\x88\x49\x8c\x2a\x8b\xb5\xb2\x53\x0d\x0b\x16\x91\x14\xe4\x02\x48\x66\x8e\xfe\xdd\x10\x7e\xd8\x49\x6c\xdb\xe0\xf3\xb8\x3a\xe0\x20\x0a\x43\x99\xe6\xa5\xd1\x91\xee\x49\x9c\x41\x7d\x2c\x88\x33\x41\x9c\x09\xe2\x4c\x10\x67\x82\x38\xd3\xbb\x05\x71\xe6\xc6\xc3\x07\x71\xe6\x4f\x2e\xce\x5c\x4f\x2e\xf2\x19\x48\x0e\x1a\xd4\x24\xa5\xd9\xc4\x4d\x59\x8b\x94\x45\x3d\x7a\xb0\xf6\xa6\x1d\x0c\x5c\xff\x65\x0d\x95\x75\x8b\x16\x0a\x57\x3e\x34\x63\xdd\xb4\x65\x64\x86\x33\x77\x10\x9c\xa3\x39\x8c\x59\x3f\xb4\xa4\x7c\x01\xe4\xd9\xe4\xd9\xd3\xa7\x43\x0c\x5f\x0e\x75\x7a\x7d\x31\x77\x4e\x77\xc6\xf5\x5f\xbf\x6a\xfd\xa2\xc9\x94\x7f\x3f\x3e\x24\x47\xa8\x85\xdb\x60\x4d\xa2\x6c\x70\xf3\x20\xd7\xe7\x42\x93\x14\x34\xa1\xdd\x22\x4c\xd5\x22\xcc\x52\x18\x17\xfe\x58\xa4\x52\x17\xbc\xe2\xfd\x55\x31\x11\xdc\x79\x05\xcc\xfe\x75\xef\xcf\x4e\x2b\x88\x80\xda\xa0\x8a\x19\x98\x55\x74\x7b\xa9\x34\x51\x22\x35\xb3\x66\x5c\x7b\x9a\x37\x4b\x00\xbf\x31\x64\x1f\xa6\x8b\x29\x89\x73\xec\x96\x72\x17\x8d\x33\xb2\xab\x55\x2b\xa5\x21\xed\x76\x53\x99\xb3\x43\xe2\xff\x0c\x58\xb4\x5c\x99\xce\xe0\x12\xb8\xce\x69\x92\xac\x08\x5c\xb2\x48\x17\xf0\xc3\xe0\x21\xa6\x55\x2f\x48\x0d\x90\x3a\xfb\x4b\x9a\x93\x0d\x22\xeb\xe2\xe9\x43\x04\xc5\x8d\xbe\xfb\xb0\x8d\x35\x0a\x78\xef\x56\x32\x6d\x54\xa1\xb4\xe9\xd7\x7a\x14\xf1\x9f\x88\xdc\xef\xde\x77\x3b\x80\xc8\x60\x76\x3d\x80\x45\xef\x26\x89\x38\x5f\x8c\x90\xce\x2f\xb4\xb9\xd2\x2d\xde\x18\xbb\xf6\x35\xaa\x11\xf3\x9e\x03\xea\x25\x58\xff\xd9\xd1\xdb\xe7\xfd\x20\x46\x9c\xdf\xfa\x5c\x64\x22\x11\x8b\x55\x75\x7b\x6d\xf4\x2e\x4b\x33\xef\x5f\xa4\x44\xe5\x33\x27\xb1\x1a\x9c\x7f\x5b\xc3\x87\xe0\xb5\x08\x5e\x8b\xa0\xe6\x63\x0b\x6a\x7e\x50\xf3\x83\x9a\xdf\xaf\x05\x35\xff\xc6\xc3\x07\x35\xff\x4f\xae\xe6\x07\xaf\xc5\x96\x05\x05\x71\x26\x88\x33\xd8\x82\x38\xb3\x7d\x5d\x41\x9c\x21\x41\x9c\x69\x69\x41\x9c\x09\xe2\xcc\x5a\xfb\x12\xbc\x16\xbb\x7d\x9b\x89\xf8\x06\xe9\x2e\x99\x88\x5b\xb2\x5d\xac\xa9\x39\x12\x93\x44\x44\x54\xbb\x1c\x54\xf3\x89\xf3\x6f\x28\x9a\x5a\xeb\xf9\x98\xfc\x2a\x38\xd8\xf8\x7f\x83\x49\x68\xc3\x16\x7a\x09\xd2\xbc\xbe\xaf\x46\xad\x41\xd7\x21\x5b\x26\x64\xcb\x84\x6c\x99\xc6\xf6\xd9\x64\xcb\x2c\xa9\xb2\x78\x6b\x4f\x91\xe6\xe4\x99\x0a\x4f\x3a\x07\x99\xfe\x49\x73\x67\x0c\xba\x3b\x74\xc4\x0a\x0a\x25\x4a\x59\xc8\xc4\xce\x95\x0c\xf1\xe9\x3a\x3c\x9c\x06\x8a\x8b\xa2\x71\x0c\x31\xc9\x40\x4e\x2c\x8a\x0a\x32\x67\x3c\xde\xb2\x56\x0f\x9f\x6e\xf6\x70\x87\xc9\x2b\xeb\xeb\xe8\xf5\xcd\xdd\x64\xb0\xac\x4f\x64\x07\x5f\x57\xd5\x61\xb7\x76\x08\x7e\x16\xf9\x2c\x43\x95\xd9\x09\xd1\xce\xcf\xf5\x43\x4f\x75\x76\xb8\x46\x8a\x7a\xa4\xf7\x8a\xed\x68\xa9\x19\xa4\x35\x1c\x39\xd5\xf5\x97\x1c\xe4\x0a\x33\xad\x4b\x0d\xad\x28\xd4\xe1\x62\x2d\x98\x22\x11\x55\xf6\x58\x1d\x22\x55\x9e\xcc\x6d\x9e\x19\xcf\x93\x64\x6c\xfb\xa9\x13\xab\x67\x73\x88\x07\x5c\x98\xe7\x83\x8d\x47\x03\xad\x19\xbb\x99\x0b\x76\x77\x0e\x92\xfa\x3e\xd5\xbb\xb2\x66\x24\x6f\x65\xb3\xdb\xb2\xd5\xcc\xb6\xc5\xc9\x3b\xd8\x6d\x6b\xdb\xae\xb2\xfe\x4e\x92\xfe\x8d\x55\xdb\x16\x98\xdc\xc0\x04\x87\x2f\x0f\x9e\xcc\xed\x98\xe1\xc8\xee\xa6\x38\xb2\xb3\x39\x8e\xec\x64\x92\x23\xbb\x9a\xe5\xc8\x0d\x4c\x73\x64\x37\xf3\x1c\xa9\x63\x9b\xd9\x21\x27\xf8\xde\x8d\xa5\x8e\xdc\xc4\x52\x44\x6e\x60\xb1\x23\xb7\x40\x58\xd5\xf1\x2b\x65\x8f\xee\xce\x84\x47\xfa\x9a\xf1\x90\xac\xd6\x2c\x79\xf7\xbd\x2f\xbb\x59\xf1\xc8\x2d\xed\x8a\xb3\x6f\x31\x34\x1b\xdd\x97\x5d\x8f\x3c\xbc\x6d\xaf\x75\x0a\x6e\xf8\xde\xc6\xb0\x9d\x46\xbf\x81\x01\x8d\xdc\xc8\x88\x46\x76\x37\xa4\x91\xdd\x91\x1d\x65\x91\xd7\x18\x82\x74\x03\x89\x66\x30\x96\x57\x86\xb5\x27\x38\x56\x4e\x9a\x93\xdf\xcc\x41\x8d\x9b\xff\x07\xc9\x28\x93\xca\x68\x10\xce\xcc\x5a\x7d\xe6\x4c\x64\x95\x6e\x06\x4f\x00\x4b\x47\x99\x73\xf4\x92\x26\x46\x90\xb0\xf1\x9e\x4e\xcf\x37\x73\xa9\x8b\x69\x63\x72\xb5\x14\xca\x9e\xfa\x45\xf5\xab\xbd\x0b\x58\xed\x8d\x7b\xa9\xe0\xeb\xad\x4a\x3d\x7b\x27\x7c\xcf\x8a\x27\x1b\xb8\x5f\xc8\x32\x82\x27\x2b\xb2\x87\xcf\xf6\x6e\x5b\x0e\xdc\x41\x06\xa9\x96\x18\xdd\xf5\x88\xdf\x09\x65\x6f\x1a\xb9\x4e\xd6\xb0\xef\x07\x58\xed\xea\x17\x1f\x84\xf3\x6f\xd6\x46\xf4\x42\x2b\xa2\x99\xd1\x8f\x0b\xd9\x04\xad\x96\x56\x2c\x71\x76\x20\x6b\x12\x62\x49\x32\x60\xb4\x19\x10\x4d\x2f\x00\x1d\x0e\x58\x71\x4e\xb1\x18\x8d\x5a\x82\x5b\xd4\xc1\x91\x0c\xca\xf8\xd2\x68\x89\x10\x17\x79\xe6\x51\xcf\x97\x33\x1c\x30\x24\xe3\x91\x48\x7d\x38\xb5\x0d\x69\x34\x54\xe1\xe8\x65\x62\x8b\x30\xda\xdf\x71\x60\x64\xb3\x4e\xfd\xff\xf4\xba\xaa\xfc\x7e\x22\x54\x91\x4f\x28\xb8\x71\xb2\x8f\x1f\x8e\x3e\x0d\xf1\x70\x17\x00\xb4\x16\x4e\x91\x23\x67\x29\xca\xec\x55\x6c\x6c\x05\x6c\xdb\x20\x36\x60\x68\x5f\xbf\xaa\x0a\x0c\x5b\xa1\x8b\xec\x53\xae\xd9\xa8\x2c\xd3\x45\x10\x0f\x50\x12\x8d\x05\x7f\xac\xed\xfc\x3c\x5f\xf3\x1d\x0c\x71\x82\x17\x70\x2f\x1d\x50\xd6\x22\x6f\xb7\x3c\x86\x39\xcd\x13\xed\xca\x61\x1a\xd6\x87\xa7\xe9\x80\x11\xce\xbd\x4f\xc2\x09\xd5\x73\x21\x67\x2c\x8e\x81\x63\x74\xbb\x9f\xfe\x4c\xe8\x65\x1d\xdd\xd1\x01\x5b\xdd\xe3\x21\xc3\x1e\x25\x4a\x8c\xeb\x3d\x46\x45\xb9\x4c\x43\x45\x58\xd4\x6d\x6d\x00\xc2\x94\x01\x6a\x43\xfd\xb6\xe6\x15\xb2\x42\xe6\x4a\xb2\x25\xad\x18\x79\x1d\xb3\x55\x04\x38\x9d\xa1\xd5\x79\x7d\x46\x27\xbc\x62\xd9\x20\x73\xa0\x3a\x97\x40\x16\x54\xf7\xb0\xa3\xfb\x76\x2f\xa1\x30\x37\x67\xba\x09\x53\x7a\x27\xae\xcb\xd4\x03\x30\xde\xfa\xa0\x81\xf7\xf6\xe2\xbd\x5c\xe8\xc0\x7e\xbf\x58\xf6\xbb\x81\xf4\xb7\xc1\x81\x37\x3a\x0d\x4c\xd8\xb5\x2f\x88\x09\x73\x7f\x6f\xc0\x03\xfb\x1a\xac\xf9\xcd\x86\x95\xfa\x29\xa9\xd2\x32\x87\x59\x4e\xbb\x59\xe5\x7c\x0e\x18\xe2\x10\xf6\x10\x7b\x97\x6b\xce\x5d\x3d\x76\x5f\x31\xd8\x0d\x6b\x19\x56\xdd\xb3\x3f\x60\x4c\xaf\xba\x09\x0e\x0a\x0d\xf9\x50\x44\x71\x54\x86\xc1\x5e\x87\x2c\x05\xf3\xc0\x4a\x23\x25\x8f\xeb\x99\x61\x65\xdf\xe8\x3d\x48\x81\x72\x45\xf6\x7c\x20\xc9\x63\x55\xbe\xb1\x37\x88\xe0\x7d\x49\xc2\x62\xec\xfd\xdf\xfe\x18\xad\x95\x21\x2c\x87\x0e\xde\x9a\xe0\xad\xa9\xb6\xe0\xad\xd9\x9c\x44\xf0\xd6\x34\xb5\xe0\xad\xd9\x69\xfc\xe0\xad\x59\x6f\xc1\x5b\x13\xbc\x35\xc1\x5b\xd3\xdc\x82\xb7\x26\x78\x6b\xbe\x54\x6f\x4d\xa9\x6a\xdc\x87\xae\x5a\x55\x0b\x5d\xc4\xb7\xbd\x4c\x8a\x6a\x16\x95\xa9\x90\xfe\x2d\xfb\xaf\x87\x52\x5c\xab\xaa\xe6\x4d\xd5\xd6\xaa\x12\xbc\x61\x25\x18\xac\xb5\x36\xea\xa8\x85\x16\xbb\x31\xc6\x2d\xa9\xaf\x9f\xab\x01\xa7\x12\x43\x7a\x1f\x78\x7c\xee\xb3\x49\xdc\xc5\x72\x33\x28\x53\x4d\x62\xb2\xef\x2d\xa1\x23\xb3\x53\x5c\xe8\xf5\x87\x5c\xb3\x49\xf9\x46\x11\xa3\x8b\x06\x5b\x5f\xaa\x6b\x08\xb4\xbc\x40\x5f\x5a\x06\x5d\x8a\x4b\x91\x53\x51\xa2\x89\x61\xdc\x20\xd7\x66\xcb\x94\xbb\x78\x0f\x13\xa9\x64\xce\xb9\x91\x1d\x04\x77\x89\x14\x03\x66\x62\xcf\x04\x6b\x84\x75\xe4\x64\x35\x0d\x5c\x23\xaa\x1b\xe5\x36\x55\x62\xf0\xa9\xb6\xd7\xf8\xb9\x6a\x3c\x82\x3b\x13\xb6\xf9\xc5\xf6\x33\x60\x12\x05\xa5\x21\x3c\x59\xb1\xa2\x21\x44\xf6\x02\x89\xab\x3a\x59\xa6\x70\x1f\x69\x92\x88\xab\x21\x07\xcb\x40\x54\xde\xb9\xf2\x5b\x6f\xec\xbd\x1a\x5c\x22\xae\x16\xb0\xde\x57\x90\x0d\x75\xe4\xea\x2d\xd4\x91\xbb\x9b\x3a\x72\x15\x47\x63\xb5\xa0\x5c\x37\xac\xb0\xe0\xdc\x9d\x16\x94\x23\xe4\xbf\xdc\xc5\x7e\x12\xac\x77\x30\x4f\x34\xcb\xca\xb4\x56\x65\x77\x28\xb1\x2a\xe3\xdc\xe5\xd4\xad\x13\xa0\x99\x0d\x8d\x96\x9d\x43\xd5\x08\x15\xc7\xc3\x34\x59\x85\x0c\xd1\xe6\x9d\xa1\x7d\xd9\x56\x71\xf3\xba\xa4\x4d\xde\x63\x0f\x9d\x93\xd4\x8b\x85\x3d\x77\x57\xc4\x56\x9d\xcc\x8a\xec\x9b\x03\x2e\x59\x39\xb7\xec\x1a\x2f\x5b\x3b\x19\x7b\x0c\x60\xed\x3c\x97\xe0\x85\xc3\x05\xbb\x04\x5e\x1e\xa0\xfb\x6a\x34\xf2\xf2\x68\x5d\x04\xe8\xd1\xfb\x4d\x84\x84\x3e\x8c\x77\xe8\xe1\x5e\x3b\xb2\x7b\x8c\xb0\xe5\x50\xff\xa6\x72\x50\x7e\xd7\x7d\xac\xf7\x18\xc4\x92\xb4\x4f\x72\xac\x6c\x74\x79\x9c\x77\xf6\x72\x87\xb9\x64\x43\x12\x96\x86\x59\x7d\x77\x48\x54\xda\xb5\x0c\xe2\xdd\x26\x28\xdd\x69\x72\xd2\x97\x53\xad\xf0\x81\xdd\x5b\x5f\x40\xf9\x9f\xcf\xc4\x9d\x15\xea\xff\x34\xb5\x87\xaa\xff\x73\xe7\xee\xaa\x2f\xae\x0c\xd0\xbd\xba\xa7\xee\xc7\x35\xf5\x85\x95\x01\x7a\x10\x57\xd4\x67\x5e\x10\xe8\xee\x5c\x50\x7f\xea\x6a\x3b\x3b\xba\x9b\x76\xc7\xe0\x07\x75\x33\x3d\xa8\x8b\xe9\xe1\xdd\x4b\x3b\xc9\x05\x37\x75\x2b\xdd\xfb\xb5\x15\xbb\xc4\x9f\xef\x86\xcf\xf7\x97\xf0\x73\xcf\x01\xe7\x9f\x47\xa2\xcf\x03\x45\x99\x3f\x54\x84\xf9\xdd\x46\x97\x3f\x40\x62\xcf\x3d\x25\xf5\x3c\x60\x2c\xf9\xd0\xf3\x7d\xd0\xa9\x7e\x33\xc6\xb9\x4b\xec\xf8\x8e\xc9\x3b\x3b\x32\xcf\xfb\x4c\xda\xf9\x13\xf0\xcf\x9d\x92\x75\x02\x0b\x7d\x20\x16\x7a\x7b\xc9\x39\xf7\x97\x98\x13\x18\xa9\x6b\x37\x66\xa4\x3b\x26\xe0\xdc\x9a\x0d\xfd\x6e\x12\x6f\xee\x3b\xe9\xe6\x0e\x12\x6e\x1e\x22\xd9\xe6\x0e\x12\x6d\x82\xe7\xa1\x67\x0b\x9e\x87\xbe\x2d\x78\x1e\x9a\x5a\xf0\x3c\xd4\x5b\xf0\x3c\x04\xcf\x43\xf0\x3c\x04\xcf\xc3\xe6\x80\xc1\xf3\xd0\x38\x78\xf0\x3c\xfc\xe9\x3d\x0f\x43\x93\x58\x76\xc3\xe5\x87\x49\x5e\xb9\xdf\xc4\x95\xdb\x4f\x5a\x79\xc0\x84\x95\xcf\xc9\xb8\x31\x38\x41\x65\x37\x1c\xfd\x5c\x12\x53\x3e\x8f\xa4\x94\x07\x4f\x48\xb9\x69\x32\xca\xed\x24\xa2\xf4\x42\xd5\x4c\xc4\x47\x5c\xb3\x9b\x5e\xc8\x53\xc5\xa1\xa6\x5b\x79\xe8\xa5\x60\x31\xc9\x72\xed\x2e\x02\x09\x37\xf3\x74\x6e\xe3\xfd\xdc\xcc\xb3\xb6\x79\xe1\x7a\x9e\xb6\xf6\xd9\x5c\xcf\xd3\xb4\x67\xe1\x8e\x9e\xf5\x16\xee\xe8\x09\x77\xf4\x84\x3b\x7a\x6c\x0b\x77\xf4\x84\x3b\x7a\x42\xd5\xb7\x50\xf5\x2d\x54\x7d\xeb\xff\x55\xa8\xfa\xd6\xdc\x42\xd5\xb7\x21\x2d\x54\x7d\xeb\x3d\x7a\xa8\xfa\x16\xaa\xbe\x0d\x1b\x38\x54\x7d\xeb\x3d\x81\x50\xf5\xed\x5f\xb6\xea\x5b\xb8\xa3\xe7\x8b\xb8\x27\x22\x5c\x12\x31\x24\x5c\xec\xb3\xba\x24\x22\xdc\xd1\x13\xae\x87\xa8\xb7\x70\x47\xcf\x17\xc4\x7b\xc3\x1d\x3d\x5f\x32\xfb\x0d\x77\xf4\x04\x26\xbc\xbd\x85\x3b\x7a\xc2\x1d\x3d\x9d\x2d\xdc\xd1\x13\xbc\x35\xc1\x5b\xb3\xde\x82\xb7\xa6\xbd\x05\x6f\x4d\x57\x0b\xde\x9a\xd6\x16\xbc\x35\xc3\x5b\xf0\xd6\x04\x6f\x4d\xaf\x16\xbc\x35\xc1\x5b\xf3\xa5\x7a\x6b\xc2\x1d\x3d\xe1\x8e\x9e\x70\x47\x4f\xb8\xa3\x27\xdc\xd1\x53\x69\xe1\x8e\x9e\x70\x47\xcf\xdd\xdd\xd1\xb3\x96\x55\xf3\xe5\x5e\xd4\x33\x7c\x19\xe1\xb6\x9e\x70\x5b\x4f\x43\x0b\xb7\xf5\x84\xdb\x7a\xb6\xb5\x70\x5b\x4f\xb8\xad\xa7\xa5\x85\x9a\x79\x3d\x5b\xa8\x99\xd7\xb7\x85\x9a\x79\x4d\x2d\xd4\xcc\xab\xb7\x50\x33\x2f\xd4\xcc\x0b\x35\xf3\x42\xcd\xbc\xcd\x01\x43\xcd\xbc\xc6\xc1\x43\xcd\xbc\x3f\x7d\xcd\xbc\x70\x5b\xcf\x67\x79\xdb\x44\xb8\x6a\xa2\xa3\x7d\x3e\x57\x4d\x84\xdb\x7a\xfe\x35\x2f\x99\x08\xb7\xf5\x7c\xc6\xfc\x33\xdc\xd6\xd3\xdd\x3e\x1f\x16\x1a\x6e\xeb\xf9\x57\x66\xa4\xe1\xb6\x9e\x70\x5b\x4f\xd1\xc2\x6d\x3d\xc1\xf3\xd0\xd8\x82\xe7\x81\x04\xcf\x43\xd1\x82\xe7\xa1\xd7\xb8\xc1\xf3\x10\x3c\x0f\xc1\xf3\xd0\x3e\xe9\xe0\x79\x68\x19\x2e\x78\x1e\x82\xe7\x61\x4b\x0b\xb7\xf5\x34\xb7\x70\x5b\x4f\xb8\xad\x27\xdc\xd6\x13\x6e\xeb\xb9\xcb\xdb\x7a\xe0\x5a\x4b\x1a\xe9\x63\xc1\x35\xf0\xc6\x44\x94\xbe\x18\xf9\x62\xad\x37\x73\xba\xcd\xd9\x22\x97\x4e\xc7\x5d\xbc\x3f\x3d\x26\x11\xd5\x34\x11\x0b\x72\x2a\x62\x6b\xc3\xc5\x2f\x8a\x9f\x53\xd0\x34\xa6\x9a\x16\xe6\x7f\xa3\x0b\x5e\xb2\x18\x99\x5a\x0c\xd7\x84\xa5\x74\x01\x86\x79\x34\x4e\x22\x57\x40\x28\xb9\x82\x24\x99\x5c\x70\x71\xc5\xc9\x25\x48\x55\x61\x97\x9f\x44\x96\x7e\x22\x0a\xe4\xa5\xbd\xf1\x06\xae\x33\x83\x2b\x4c\xdb\x73\xd7\xcf\xa4\x3a\x5c\x19\xf6\x7d\x6c\x9f\x9e\x61\x98\x6c\xdb\xe5\x31\xc5\xda\x71\x99\x66\x4e\x4f\x8c\x10\xfb\xc4\xd0\x65\xae\x7c\x8c\xfa\x9c\x25\x30\x99\x51\x05\xb1\x1f\x57\x19\x72\x11\x32\xb6\x73\xcb\x35\x4b\xd8\xaf\xe0\xb8\xb9\xb5\xf1\x36\xed\x7c\x8f\x03\xbf\x5b\xe9\x9f\x90\x88\x46\x4b\x78\xce\x9a\xd5\xf5\x89\x9f\x6a\xf3\x4b\x7d\xf4\x77\x3f\x4e\xef\xcb\xa1\x8e\xdd\x07\x5e\x43\x8f\x99\x44\xfe\xb2\x22\x4a\x0b\xe9\x21\x9a\x49\x98\x44\x34\x89\xf2\x04\xb9\xc9\xd1\xe9\x89\x1d\xa9\xfb\x7a\xa7\x0e\x86\x5e\x2e\x7a\xc0\x8c\xfd\x27\xed\x73\xde\xc4\x02\x14\x0c\xd1\x26\x77\x93\x69\xa7\x90\x0a\xb9\x3a\xa7\x72\x01\x37\x26\xed\x37\x95\xbe\xea\x84\xfd\xef\xaf\xde\xbd\x79\xf1\xe6\xf5\xc9\x9b\x93\x73\xc7\x72\xbd\x37\xaa\x4e\xf2\xd3\xd2\xe3\x41\x94\x98\x6b\x37\x45\x92\xb0\x94\xe9\xe2\x2b\x4b\x9b\xcd\x6a\xa3\x65\xc9\x98\x6d\x96\x73\xcd\x52\xb0\xae\x27\xaa\xb5\x11\x35\x0c\xdd\xa4\x00\x1a\xef\x93\x4a\xe9\x05\x18\xbe\x49\x16\x39\x95\x94\x6b\xf0\x5c\x9e\x69\xfb\x51\x2c\x88\x12\x4e\x99\x65\xaa\x74\x53\x29\xd0\x36\x41\xe7\x54\x34\xb3\x1a\xec\x61\x49\x2f\xed\x85\x3f\x73\x61\x58\xb3\xd9\xd4\x54\xc4\x6c\xce\x22\x6b\x1d\x21\x29\x8d\x8b\xa4\x12\x27\xf0\x83\x2c\x4e\xb6\x72\xc1\x6d\x54\x59\x07\x33\xf0\x4b\x26\x05\x47\x45\xe6\x92\x4a\x46\x67\x09\x14\x0e\x38\x05\xda\x8e\x57\x2e\x88\x93\xd9\x4a\x43\x33\xbb\xb2\x23\xb8\xdd\x70\x37\x45\x35\xf7\xf7\xe8\x51\x63\x47\xe7\x65\xfa\x57\x29\x88\x98\x0e\x98\xcb\x0b\x88\x41\x31\xc7\x15\x25\xc4\x79\xe4\x61\x27\x74\x26\x99\x55\xcb\x68\x81\x32\x8e\x4b\x53\x45\xd2\xdc\x9c\xc2\x46\xc2\x51\x8a\xcd\x12\x18\x1b\x39\x86\x35\xe7\xad\x94\x7d\xcc\xc0\x80\x19\x7b\x42\xe9\xe2\x12\x0c\xc2\x19\x44\xb6\x32\x28\x80\x11\x72\x04\xde\xda\x44\xad\xa8\xe2\x9d\x96\xe6\xac\x8d\x9c\xcb\xfa\x64\x4e\x56\x22\x97\x6b\xe7\xc2\x92\x1a\x44\x46\xf2\x6d\x9c\x88\xcb\x35\x43\x26\x34\x26\x31\x18\x89\x9e\x71\x73\x44\x2d\x84\x88\x8d\x60\x2f\xc5\x35\x4b\x71\x14\x47\x01\xc5\xb6\xcd\x56\x24\x16\xb9\xf5\xfe\x21\x9e\x98\xb3\xc0\x1d\x63\x19\x8d\x2e\xcc\x1c\xb0\xe3\xb6\x2c\xc1\x03\x9d\x66\x07\xf8\x96\xfb\xaf\xfb\x52\x4d\x7f\x56\x82\x97\x6e\xdf\x62\x59\xd3\x7e\xdb\xcb\x14\x99\x81\xd2\x13\x98\xcf\x85\xd4\xff\x30\x1b\x9c\x73\x24\x1b\x2e\x0a\x08\x7a\x14\x42\x1f\x3f\x82\x1b\xd3\x3d\xd6\xe9\x5e\xc8\x2d\x2c\xa4\x82\x7c\x4d\x4c\x30\x33\x14\x2f\xf9\x21\xf9\x7f\xfb\xff\xfc\xcb\xef\x93\xd1\xf7\xfb\xfb\x1f\x9e\x4e\xfe\xfe\xf1\x2f\xfb\xff\x9c\xe2\x3f\x9e\x8c\xbe\x1f\xfd\xee\xff\xf8\xcb\x68\xb4\xbf\xff\xe1\x87\x37\xaf\xce\x4f\x5f\x7c\x64\xa3\xdf\x3f\xf0\x3c\xbd\xb0\x7f\xfd\xbe\xff\x01\x5e\x7c\xec\xd9\xc9\x68\xf4\xfd\xbf\x37\x4c\x88\xf2\xd5\xbb\x79\x2b\x19\xf7\x4a\x76\x9d\xf4\x39\x91\xd6\x34\x67\xc6\xf5\x44\xc8\x89\xfd\xe0\x90\x68\x99\x6f\x97\x53\x8d\x50\xdb\xe5\x20\xed\x7b\x22\xbc\xad\xf4\x55\xf3\x9b\xb8\x4b\xd7\x9c\xd1\xce\xcc\xa6\xe0\xed\x99\x95\xfb\xe6\x66\xdb\xbd\x4c\xdf\x7c\xc8\x9d\x6d\xe9\x11\x85\x75\xf7\xe5\x63\xe5\x83\x0f\x6a\xfd\xd7\x12\x5e\x2d\xcf\x6f\x1b\xab\x87\xf4\x34\xcc\x38\xd2\xb9\x85\x99\x64\x42\x32\xbd\x3a\x4e\xa8\x52\x6f\x69\x0a\x37\xdd\x90\x93\x79\xa9\x63\x8d\x0d\x41\x9b\x13\xc8\x1d\xd1\x2e\x1a\xc4\x0d\xd9\x0c\xf0\x93\x39\x2a\x19\x95\x7e\x3c\x50\xfd\xb7\x05\x61\x7a\x12\x17\x92\xfc\x0a\x52\xb8\xeb\xf7\x24\x58\x45\xa5\x71\x04\xf7\x59\xfb\x3e\xb4\x80\x4d\x41\x94\x23\xd8\x8c\x84\x74\x6d\x74\x8d\x39\x5b\xdc\x14\x74\x67\xdb\x3a\x25\x11\xe5\x66\xa1\x78\xa1\xe4\x9c\x7c\x4a\x60\x41\xa3\xd5\x27\xb3\xe0\x4f\x12\xcc\x14\x8d\x82\xf7\xc9\xaa\x0d\x6b\x8a\x81\x0b\xbc\x61\x8a\x00\xc3\x3b\x46\x19\xff\xd9\x6a\x83\x5e\xb5\x6e\x9c\x89\xc4\x74\xfd\x4c\xc4\x53\xb3\x07\xd3\xda\x6a\x91\x85\x16\x0f\x0b\x61\xe2\xc3\x93\x8f\x1b\x6f\x3a\x3b\xa3\x16\x56\x63\xac\x12\x87\xcc\x91\xed\xb7\x49\x36\x1e\x20\xe4\x28\x4e\x19\x1a\x47\xc9\xfe\xe9\xd9\xd1\x68\x6d\xe5\x46\xce\xb1\x07\x71\x2c\xc0\x87\xbe\x98\x81\x54\x69\xe6\xc4\x43\x14\xd3\x09\x2d\x09\x63\x3e\xa1\x9f\x8b\x01\x30\x5a\x3e\x5b\x52\x68\xfd\x64\xcf\x8e\xc8\x27\x23\x23\x27\x8c\x83\xdd\x83\x4c\xb2\x4b\x96\xc0\xc2\xcc\xa4\xe2\xce\x27\xc7\xb9\x94\xc0\x75\xb2\xf2\x37\x42\x6e\xdf\x5d\xa6\xcc\x79\xb5\x8e\xe8\x0e\x39\x1b\x27\x53\x18\x14\x0a\x64\x30\xbd\x28\x88\xa7\xe4\x0c\x7b\x5a\x59\x07\x84\x7b\x0f\xf7\x1e\xa5\x8a\x26\xe4\x21\x12\x94\x21\x22\xc6\xed\x57\x2c\xb6\x82\x00\x48\xd9\x66\x68\xc3\xdc\x72\xab\x46\x8a\xc4\xe8\x8a\x85\xd6\x6a\x0e\x70\x34\xab\x20\xb0\x51\x00\x73\x31\x4b\x0e\x90\x5b\x36\xb0\x19\x46\xdd\x19\xce\x4e\x36\xf4\xeb\x6b\x93\x1d\x4e\xcc\x1a\xe7\x39\xc6\x29\x79\x9d\x1c\x99\x49\x55\xe4\xaa\xc9\x9c\xd5\xd9\x8e\x4b\x2b\x01\x65\x0e\xf3\x95\x9f\xa2\x84\x59\xce\x12\x34\x61\xb2\x02\x1c\xcd\xf2\x2e\xd2\x21\xad\x9a\x06\x44\x96\xba\x5b\x6e\xf3\x2c\x13\x52\x97\xb6\xa7\x68\x4d\xe7\xb7\xf6\x9c\x2d\x70\x34\xd3\xcd\x24\x64\x54\x16\xa7\x9d\x02\x12\x2d\x29\x37\xb2\x56\x0b\x5c\xde\x08\x4c\xd7\xb7\x65\x2d\xcc\x6c\xe8\x4c\xe4\x1a\x31\xde\x71\xa0\xb9\xc8\x79\x4c\x0c\x73\x3d\x24\x4b\xad\x33\x75\x78\x70\x50\x9e\xfe\x53\x26\x0e\x62\x11\xa9\x83\x48\xf0\x08\x32\xad\x0e\x3c\x2f\x38\xc8\x44\x3c\xf1\x7f\x4c\xa8\x27\xe5\x83\xc7\xbb\x32\xdf\x82\x7d\x1f\x12\xbb\xe1\x0d\x6f\x01\xcf\x5b\x6e\xba\x9c\xb4\x7f\x6c\x5e\x28\x81\xbb\xf5\x25\x2d\x12\x17\x1e\xd9\x78\x02\xaf\xdf\x7f\x5a\xbe\x5f\xdc\xcf\x5a\xe8\x18\x15\x96\xfd\x58\x55\xbb\x6e\x3f\xa3\xda\xac\xcb\x1d\xf6\xe4\xfe\x16\xde\x73\xcf\xb5\x8d\xdc\x5d\xae\x02\xe5\x2d\xad\x29\x5e\xdd\x6a\x54\x33\xfb\xc4\x30\x5c\xbe\x22\x86\x34\xb4\xbb\x47\xd8\x5a\x36\xdb\xac\x08\x4b\x23\xa1\x61\x65\x8a\x6f\x0a\xd7\xdb\x18\xe6\x73\x88\xf4\x77\x15\x53\x55\x51\x5b\xa1\x70\x6d\x7d\xe3\xff\xf5\x5d\x33\xa3\xea\xe5\x85\xea\x17\xee\x61\xa7\xd4\x6e\x42\x1f\x66\x3a\x7f\x81\x3d\xd6\x24\x25\x0b\x3c\x3b\x18\x9a\x12\xd0\x17\xec\xec\xb1\xd6\x33\xe1\x24\x50\xc3\xb9\x2a\x2f\x77\x06\x3c\x20\xd3\xae\x1c\x38\xce\x92\x5b\x7a\x04\x81\xbc\x15\xae\x48\x0d\x8c\xc9\x29\x5e\xa7\x5b\xfe\x82\x67\xff\x5b\x61\xcb\xd5\x74\x04\x79\xf6\x74\x51\x74\xc6\xcb\x0c\x83\xe7\x0f\x65\xf8\x8c\x05\xcc\x5a\xf8\x4c\x49\x58\x55\x5f\x58\x2b\x60\x2f\x60\xd5\x09\x55\x17\x86\xe0\x42\x77\xd0\xd7\x34\x2e\x71\xd4\xeb\x20\x36\x32\xe1\x1f\xae\xa6\x81\x48\x67\x8c\xdb\xa9\xd8\x81\xfd\x3e\xe3\xd8\x7e\x3f\x78\x8c\x7f\x76\x4f\xa2\x27\xb4\xfb\xc5\xf0\x0c\x03\xf9\xbb\x01\xf1\x39\x85\xf7\xb9\x0b\xa4\xdb\xe2\x70\x2a\xc1\x37\x2f\x7e\xc9\x69\x32\x25\xcf\xed\x49\x80\xc0\xb3\x3f\x75\x91\x9b\xed\x62\xc3\x27\x7f\xc5\x92\x38\xa2\x32\xc6\x53\xd3\xb2\x1f\xa2\x84\x45\x1c\xea\xe5\xc4\x8e\xbe\x3d\x03\x2c\x91\xc7\x5e\x74\x4d\x32\x2a\x35\x8b\xf2\x84\xa2\x50\x00\x0b\x21\x3b\x82\xcf\x7b\x6e\x66\x89\xcd\x67\x10\x09\x1e\x77\x78\x0f\x87\xed\xea\x79\xbd\xf3\xea\xf6\xa2\xf0\x0c\x92\xb9\x3a\x29\x2c\x85\x3a\x79\xed\xaf\xe9\xdf\x1d\x63\x89\xb9\x67\x76\x05\x6f\x19\x5b\xc9\xf5\x8a\x29\xa8\x96\x73\x62\xca\x87\xf6\x8f\x2a\x07\x4e\x41\xed\x53\xf2\x9f\x2b\x2f\x1e\x74\x85\xfc\x30\xed\xdd\x59\x68\x30\x72\xf3\x75\xa4\xe8\x76\xb2\x64\x23\x73\x21\xe1\x12\x24\xd9\x8f\x05\x7e\x83\x65\x99\x46\x53\xf2\xdf\x46\xed\x6c\x73\x05\xd9\xc6\x61\x61\x0b\xfb\x38\xc2\x2e\x32\x2e\xf0\xd2\x7e\x74\x33\x3e\x25\xfb\xb6\xd6\x13\x4b\x53\x88\x19\xd5\x90\xac\x46\x36\x82\x1a\x9c\x05\xaf\x0f\xd6\xf4\xa9\x62\x56\xa9\x5e\xf6\xf5\xdf\x5a\xde\xc4\xc9\xde\x26\x52\xfd\xe4\x4d\xdb\x25\x60\xad\x9a\x52\xc3\x9e\xc2\x19\xda\x19\xa8\xd0\x18\x01\x36\x2e\x79\x4d\xc5\x0a\xec\x79\x73\x81\x5b\x3f\x1b\x04\xa5\x44\xc2\x02\xe9\xd3\xd2\xdc\x0d\xa8\x93\x45\xdb\x8b\xb8\x75\x08\x21\xed\x5e\xb1\x09\x31\x5a\xe7\xd7\x7f\x8b\xa9\xa6\x0d\x2f\x58\x94\x59\x65\xdb\x48\xad\x4b\xb6\x29\x3b\x6f\xda\xeb\x1e\x6e\x1e\x37\xfc\x4e\x3d\xa0\xc6\xb8\xed\xcb\x3e\xd8\x75\x82\x66\x70\x1b\x9b\xe8\xd1\x60\x22\x61\xc1\x94\x96\xab\x8a\xb3\xc3\xb9\x51\x05\x61\x5c\x69\xca\x35\x43\x56\x4d\xfc\x9b\x13\x67\xe7\x37\x5a\xd9\xf6\xfd\x7f\xc7\x93\x95\x35\x22\x63\xda\x8d\xd5\xc5\xce\x57\x19\x90\x6f\x2b\x7f\xbc\x92\x59\xb4\xfd\xfb\x93\x39\x71\x0c\xd4\xe2\x26\x8d\x63\x09\x6a\x93\xb3\x6d\xfb\xba\x15\x7c\xde\x2c\xb6\x2b\x04\x4f\xbd\x59\xcd\x65\xfe\x28\xc5\x16\x46\x49\xf1\x85\x1b\xbd\xdf\x68\x4d\x59\xb1\xaa\x26\x7e\x68\xbd\xc3\x90\x16\x27\x26\xd3\x5e\x6b\x8c\x04\x57\x79\xea\x33\x41\x8c\x8a\x9d\x01\x8f\x81\x47\x2b\x2c\xf4\x94\x5c\x42\x83\x85\xe1\x47\xd5\x80\x12\x84\xfc\x1f\xb6\x58\x9a\x8d\xb2\x93\xab\x4a\xce\xde\x43\x5e\x9b\x29\x53\x06\xf0\x73\x90\x12\x62\x9b\x29\x63\x84\x5e\xdf\x43\xc5\xe3\xe9\x2a\x4f\xf9\x20\xce\xfa\x64\xb1\xfc\xdf\xf6\xe9\x9e\x17\x65\x27\xbd\x6b\xc4\xc3\xd4\x72\x20\x03\x8e\x85\xb0\x11\x05\x99\x50\xcc\x17\x79\x2b\xce\x85\xb5\xd2\x95\x62\x6e\x0b\x4b\x36\x8f\xb5\x9e\xd2\x86\x81\xcf\xb5\x45\xa3\x75\x21\xe7\x76\x33\xa1\x6a\x3b\xf5\xbc\xb0\xa1\x38\xe6\xf9\xe6\x56\x17\xc1\x38\x98\x07\xb7\xbe\xb4\xf2\x2c\x93\x94\x5f\x40\x4c\x12\xb8\x66\x91\x58\x48\x9a\x2d\x59\x84\x25\x0c\xad\x5b\xd9\x68\x8c\xda\x86\x51\x35\x63\x78\xd3\xe9\x95\xe5\xb3\x84\xa9\xe5\x76\x07\x65\x2b\x71\x28\x88\x24\xe8\xad\x9c\xaf\x0f\x6d\x9c\xd9\xcf\x4b\xe1\xc7\x07\x98\xbb\x7e\x5d\x7e\x86\xc5\x76\x9f\x45\x4a\xa3\xc8\x10\xb6\x77\xb6\x82\x93\x04\x2b\x44\xd4\xc0\x21\xb4\xf7\x68\x99\x5e\x2e\x00\x32\x8b\xcf\x18\xac\xa6\x52\xb4\x62\x2a\xc6\x23\xc0\x92\x8c\xae\xb4\x26\x80\xf7\x36\x68\xc9\xc0\x4a\xb0\x80\x0e\x46\xbf\x8b\xc0\xf5\x76\x89\xb3\xdd\x88\xd0\x62\x40\x68\x87\x78\xc1\x0b\x3b\x81\x5e\xe1\xa1\x5e\x28\x30\xff\x36\xe0\xc5\x27\x43\x37\xdb\x56\xe0\x3c\xb3\xa1\xd7\x3b\xf3\xc3\x1f\xd7\x7a\x71\xa1\x60\x8a\x2c\xc5\x95\x1b\xa0\xce\x31\x9c\xc9\xd3\xa3\x41\xcc\x54\x64\xd8\x4c\x83\xe1\xe8\x58\x70\xe5\x2b\x6e\x52\x6e\x8b\x64\x5e\xd2\xc4\x65\xc3\xba\xc1\x32\x91\xa0\xcb\x35\xce\xbd\xbe\x6a\x53\x7d\x20\x9d\x41\x1c\x43\xec\xe3\xcb\x57\xa4\xe1\xd0\xef\x10\x38\xba\x64\x02\x7f\x2c\x9e\x8a\x24\x69\x3f\xd3\x5b\x0d\x2b\x7d\xcc\x2a\x1e\x00\xbd\x63\x5a\x3a\xc4\xcc\x13\x0f\x50\x67\x17\x37\xd4\x51\xfa\xbc\x11\xc9\x8c\xc2\x52\xc0\x7d\x06\xfa\x0a\x80\x93\x68\x09\xd1\x85\x2a\x43\xf5\xb4\xa1\xc3\xda\x46\x3b\x63\x6d\xbb\x80\x58\xe5\xa0\x85\x60\x6a\x36\xd4\x65\xb4\x03\x61\x46\x2d\xe4\x70\x55\x8f\x0b\xdb\x3c\xb8\xe8\x25\x65\x09\x9d\x25\x1d\x0a\xf3\xc9\xbc\x7c\x73\x5c\x9d\x3f\xf3\xd2\x51\x96\x27\x89\xf3\x7f\x63\x44\x8c\x96\x74\x3e\x67\x11\xc6\x3a\x62\x44\x50\x19\xd9\xbb\x75\xe9\x3b\x45\x01\x29\x4d\x75\xbe\xb1\xf5\x2d\x78\xd3\x86\x2f\x46\x0b\x65\x8d\xf6\xd6\x3e\x18\xf2\x7e\x5d\x83\x35\xb3\x03\xab\xa2\xaf\xb9\xce\xa6\xe4\xad\xd0\x2e\xe2\xee\x0d\x28\xe5\xa2\xfd\xc8\x7b\xa0\x4a\xf0\xca\x51\x80\x9a\x87\x64\x0b\xc6\xe9\xf6\x92\x04\x76\xfd\x55\xc3\x7a\xa1\x68\xd2\x15\x96\x24\x66\x0b\x49\x75\xc1\xc1\xcb\x25\xba\x43\xd3\x89\x05\xd6\x63\x31\x25\x47\x7c\x85\x68\xe3\xc2\xf0\xb6\xdb\x54\x19\xd7\x52\xc4\x79\x04\xae\xf8\x72\xae\xaa\x1d\xdf\xea\x39\xd0\x8f\x2c\x8f\xfd\xe0\x65\xae\x41\x0c\x9a\x32\xe7\x32\x17\x1c\x08\x55\x99\x51\xff\x3d\x19\x58\xef\x59\xb9\x41\x78\x0a\x1e\x9d\x9e\x90\xf7\xd0\x8e\x8d\x93\x49\xd3\x24\x30\x6a\x44\x69\x99\x47\x78\xc8\x1a\xea\xe7\xb1\x3b\x2e\x2d\x01\xd8\xa8\xcd\x4a\x8e\x93\x33\x1a\x5a\xa9\x38\xa3\x7a\x49\xa6\x76\x43\xa7\x15\x70\x12\xf2\xd2\x1c\xb8\xd7\x34\xcd\x12\x18\x37\xba\x58\xfe\x0d\x0f\xb6\x97\x42\x9c\x59\x94\xb0\x33\xf9\xad\xe9\x6d\xf3\x9f\x83\x83\x3a\xc2\x8a\x99\x51\x52\x9c\x0f\x01\xf1\x76\x2e\xc4\x63\xb5\x0e\xaf\x26\xd0\xf8\x3e\x7f\xc0\x80\xd4\x2d\x2b\xc1\x19\x52\x09\x87\x64\xef\xc8\xf3\x92\xbd\x31\xd9\x3b\x95\x62\x81\xd9\x29\x7c\xe1\x72\x48\xf6\x9e\xc3\x42\xd2\x18\xe2\xbd\x8e\xb1\xfe\x82\x59\x4c\x6f\x40\x2e\xe0\x07\x58\x7d\xdb\x70\x54\x6d\x7e\xe1\xcf\xde\x6f\x31\x17\xaa\xeb\x13\x23\x1e\x19\x19\xe2\xdb\x94\x66\x7d\xde\x7d\x43\xb3\x3e\xb3\x39\x2e\x89\xf1\xc3\xc7\x14\x34\xbd\x7c\x36\x2d\x51\xf9\xd3\xcf\x4a\xf0\xc3\xbd\x12\x7e\x63\x91\x32\x0c\xfe\x5b\xed\x91\xb5\x45\x1c\xee\xe1\x2a\xdc\xaf\x1e\x18\x87\x7b\x66\xfc\x3d\xc3\xf1\xb4\x98\xe5\xf3\xc3\x3d\x8c\x8e\x1b\x3f\x1b\x4b\xc8\xc6\x46\x4a\xfe\xb6\xec\x7b\xef\x53\x33\x62\xb9\x95\x59\x47\x2f\xe2\x6a\x93\xab\xe5\xdf\xfe\x68\x11\xe6\x5a\x8e\xf1\xae\x90\xdd\x09\x49\xa8\xd2\xe7\x92\x72\x85\xd3\x3d\x67\x69\x13\x60\x27\x24\xb5\x0c\xb5\xf1\xb9\x44\x26\xdb\xf8\xd8\xa2\x6d\xe3\xe3\xc6\x3d\xed\x16\x44\x36\xd7\x70\x1b\xce\xb3\xcd\x5e\xcb\xec\x5e\x23\xe6\x7b\xd3\x69\xb1\xd7\xe6\x60\x76\x6f\x83\xab\xf7\x6e\x18\xa4\x3b\x49\x30\x7d\x0c\xb7\xba\xed\x3c\xb6\xbc\xae\x30\x7a\x5d\xb9\x2a\xf0\x24\xe7\x31\xc8\x04\xe3\x03\xca\xf1\xac\x77\x38\x9e\x3a\x5b\x1a\x2d\xcc\xa2\x18\xb9\x8e\xc2\x04\xaf\xf8\xe0\x6c\xac\xab\xef\xd1\xf0\x64\x57\x68\xdf\x76\x83\x32\x4b\x14\x41\xa6\xdb\x85\x96\x5e\x26\x6e\x6f\xa7\x34\x32\xf7\x44\x37\x63\x95\xc3\xa9\xdb\xd8\x2f\xd7\x95\x0d\x26\x5b\xe6\x29\x35\xe7\x3d\x8d\x31\xb6\xb5\x78\x66\x4d\x0e\xd6\x44\x60\xcf\x31\xeb\x2e\xb7\x7e\x4c\xbf\x7d\x9d\x3b\xe4\x64\x00\x5a\x54\x8a\xe8\x30\x3e\xf6\x82\x59\x4a\xaf\x5f\x03\x5f\xe8\xe5\x21\xf9\xeb\x57\xff\xfb\xeb\xff\x68\x78\xd1\x1e\x25\x10\xbf\x02\xee\x8c\xae\xb7\x01\xbd\xcd\x5e\xeb\x5e\x83\xa9\xcf\xae\x98\x2e\xca\x77\x0a\xff\x5c\x89\x95\x57\x14\xe3\x9f\x9d\x18\x94\x67\xed\xe0\x7c\x89\x29\x3e\x4a\x53\x1e\xc1\xd8\x48\xd7\x5b\x87\x61\xc5\x49\x99\xac\xc8\xb3\xaf\xc6\x18\x9d\x8d\x93\xda\x38\x0c\x3f\x5c\x7f\x9c\x6e\x59\x0c\x53\xe4\xef\xe3\xda\x4c\x99\x22\x66\xef\xc5\x1c\xd1\xb4\x65\x92\x68\x45\x91\x60\x25\x1d\x6f\x53\xdb\x94\x74\xa0\x58\x49\x17\x26\x74\x99\xfa\xfb\x99\xf9\x53\xc6\x59\x9a\xa7\x87\xe4\x69\xc3\x2b\x96\x23\xdf\x06\x7a\xd8\x9e\x4a\x29\x90\x1a\xb6\xbc\x90\x34\x4d\x31\x89\x91\xc5\xc0\x35\x9b\x33\x0c\x56\x2b\x48\x0c\xcd\x62\xf6\x43\x1f\x60\x59\x00\x1f\x63\x2f\x0d\x1b\xed\x45\x74\xa7\x56\x2c\x96\x28\x3b\x39\x27\x78\x54\xe5\xbc\xab\x0c\x2c\x55\x5a\x2d\x9c\xc0\x75\x66\x15\xa3\x8a\x3b\x36\x05\xca\x19\x5f\xa8\x32\x4e\x1a\xf9\x5f\x9b\xb7\xc9\x7c\x76\xb5\x04\x17\x89\x05\x55\x67\xbb\x2f\xb3\x65\x34\xb3\x32\x3f\x00\x73\x46\xda\xd9\xc7\xa6\x6b\xc3\x28\x31\x29\x24\xc7\x54\x41\x0f\x37\x46\x25\x88\xda\xdf\x3d\x52\xe4\xb6\xdf\x1a\x03\x7a\xf6\xf4\xab\x56\xbc\x2b\xde\x6b\x7c\xa9\x0c\xaf\xfe\x70\x34\xf9\x6f\x3a\xf9\xf5\xe3\xbe\xfb\xc7\xd3\xc9\xdf\xff\xff\xf8\xf0\xe3\x93\xca\x9f\x1f\x9b\xa3\xa2\xb7\x2b\xa2\x65\x5b\xc3\x61\x77\xd6\x7a\x65\xc4\xe3\xc7\xd8\x47\x61\x9e\xcb\x1c\xc6\xe4\x25\x4d\x14\x8c\xc9\x8f\x1c\xcf\xc9\x1b\x02\xad\x3d\x58\xc9\x48\x36\x7b\x66\xd4\x26\x79\xdb\xbd\x82\x53\x6a\x7f\xc7\x4d\xb7\xcd\xa2\x73\x0b\x84\xee\xad\x78\x15\x2e\xc9\x2b\xe8\x69\x13\x32\xe7\x42\x4c\x9d\xde\x34\x8d\x44\x7a\x50\x3c\x6f\xc3\xdb\x66\x05\x8f\x60\x69\x56\xbe\x22\x25\x1b\xb7\x2a\x4d\x9d\xdc\x14\x26\x06\xd2\x48\x0a\xa5\xca\xeb\x26\x48\xc2\x2e\x80\x1c\x95\x46\x14\x73\x38\xcc\x20\xa2\xa8\x15\xca\x19\xd3\x92\x5a\x7f\x92\x57\x0a\xac\xb5\xaf\x65\x36\xb9\x82\x79\x9e\x90\x7d\x05\x40\xa6\x18\xf8\xbd\x71\xce\x8c\x9c\x2b\x68\xc6\x12\x86\xb9\x96\x24\x86\x48\xf0\x79\xc2\x9c\x9a\x9a\x66\x42\x6a\xca\x5b\x2b\x8c\xd8\x54\xfd\x05\x5c\x13\x56\x44\x5b\x99\x8f\xf7\x63\xae\x9e\x3d\xfb\xea\xaf\x67\xf9\x2c\x16\x29\x65\xfc\x65\xaa\x0f\x46\xdf\xef\xff\x92\xd3\x04\xe3\x7f\xde\xd2\x14\x5e\xa6\x7a\x74\x7b\x12\xc7\xb3\xaf\x7b\x90\xf2\xfe\x07\x4b\xb0\x1f\xf7\x3f\x4c\xdc\xbf\x9e\xf8\x9f\x46\xdf\xef\xff\x73\xda\xfa\x7c\xf4\xe4\x00\x13\x24\x0a\xba\xff\xf8\x61\x52\xf2\x80\xe9\xc7\x27\xa3\xef\x2b\xcf\x46\xdb\x38\xc2\x66\xa5\xb7\x94\x66\x93\x8b\xc6\xd2\x97\x8d\x7a\x45\x53\xc9\xb8\x6d\x8a\xa8\x4d\x58\x7b\x43\xb3\xf7\x30\x07\x09\x3c\xea\x36\x8f\x1f\x6f\x7c\x42\xf6\x63\x23\x4f\x61\x9a\xf2\xc8\x6b\x12\xb2\x78\xea\xa4\x8a\xe2\x3b\x7f\xd4\x16\xb7\xac\xd5\xe3\x0d\x7d\x16\x5d\x61\x9b\x72\x72\xfd\x16\x43\x64\xd9\xeb\x70\x6b\x73\x97\x7b\xdb\xa8\xbb\x2d\x8f\x30\xaa\x7a\x07\x23\xb6\x91\x0d\xac\x31\xbf\x4d\x9d\xeb\x81\xe4\xfd\x14\x11\xde\x92\x40\xd1\x39\x48\xb1\xce\x9d\x7b\xf0\xac\xec\x27\x6b\x53\xde\xb9\x9f\x9c\x35\x6a\xfa\x7d\x4f\x80\x1f\x4f\x9e\x5b\x9c\x41\x06\x8c\xe2\xfd\x52\x24\xb1\x22\x39\x67\xbf\xe4\x40\x4e\x9e\x17\x95\xcc\x18\x8f\x92\x1c\x6f\x1a\xfb\xf1\xc7\x93\xe7\x6a\x4a\xc8\x7f\x3a\xa6\x7b\xd5\xcc\x5b\x6d\xcd\xd0\x77\x6f\x5f\xff\x5f\x34\xda\xe1\x97\xee\xa2\x1f\x5f\xc9\x92\x51\x6b\x6d\xb7\x92\x90\xe9\xd5\x86\xc5\xe3\x8c\x22\x9a\x35\xdb\x4f\x89\xf3\x49\x70\x9b\xea\xb0\x84\x24\x53\x98\xc4\x49\x54\x2e\xdd\x6a\xcc\x80\x36\x97\x0c\xcb\x6c\xb8\xa0\x20\x9f\x97\x8a\x79\xbf\x3b\x65\x97\x44\x82\x73\x88\x30\xea\xca\x68\x04\x7d\x38\x44\xf5\xfd\xba\xb6\xb5\x55\xbd\xa8\xa7\x89\x94\x63\x7a\xfe\xe1\x9d\x3f\xb7\x4f\xe8\x86\x22\xdf\x39\xbd\x0a\x67\xbc\x03\x55\xbb\xb8\x89\x9d\xf1\xdb\xcc\xc1\xc1\xed\xce\x59\xc2\xc6\x7a\x77\x1a\xd1\x3a\x64\x30\xd0\xe5\x7d\x87\x5f\x6e\x3d\xe4\x7c\xc3\xcc\x54\xab\x1d\x80\xce\xa1\x22\x56\x66\x49\x15\x99\x01\x70\xf4\x55\x59\x9f\x04\x70\x87\xf3\x50\x7a\x92\xf2\x6c\xa2\xc5\xa4\x41\xd9\xed\x80\x5c\x37\xd4\x5a\x6c\x39\x6b\x6b\x3b\x1a\x6c\x9d\xb9\x5a\xae\xb6\xc1\x40\x95\xf7\x8c\x15\x72\xe3\xd0\x85\x35\xab\xc8\x6b\x73\x76\x0e\xa4\xe2\xd8\xc6\xbf\x36\xa7\x74\x65\x58\x57\xd5\x0a\xa8\x05\x86\x4e\x74\x9a\xf9\x3b\xe6\x68\xb7\xf9\x0c\xe4\x25\xeb\x21\x7c\xbc\x5f\x7f\xbf\x17\x6b\x79\xf5\xfe\xf4\x18\xd3\x9c\xcd\x07\xde\xf7\x8a\xd8\x5f\x95\x2a\x86\xb3\x95\x2e\x96\x10\xd9\x30\xca\xa3\xbb\x27\x68\x23\x8e\xef\x3c\x08\xda\xfa\x23\xd1\xe1\x50\x6f\x4d\x3c\x44\xd0\xb6\x65\x6a\x0e\xe9\x63\xa8\xbc\x61\xf9\xd8\x5a\x6e\xaf\xd2\x42\x1a\x72\x5d\xfb\x2d\x9f\x15\x6a\x55\xd9\xbb\x53\xc1\xc9\x6f\x7f\x3c\xfa\x9f\x00\x00\x00\xff\xff\x0e\x0a\xc6\x9d\x2b\x56\x01\x00") +var _operatorsCoreosCom_catalogsourcesYaml = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\xec\x7d\x69\x73\x1b\x39\xb2\xe0\xe7\xe7\x5f\x81\xd0\xbe\x08\x4b\x1e\x92\xb2\x7b\xde\xf6\xbe\xd1\xf4\x11\x7a\xf2\xb1\x8a\xf6\xa1\xb0\xd4\xfd\x62\xc7\xe3\x5d\x83\x55\x49\x12\xad\x2a\xa0\x1a\x40\x49\x62\x1f\xff\x7d\x03\x09\xa0\x0e\x92\x75\x91\x3a\xec\x1e\xe0\x43\xb7\xc5\xaa\xc2\x91\xc8\x4c\xe4\x0d\x9a\xb1\x9f\x40\x2a\x26\xf8\x11\xa1\x19\x83\x1b\x0d\xdc\xfc\xa5\x26\x97\xff\xa9\x26\x4c\x1c\x5e\x3d\x7b\x74\xc9\x78\x7c\x44\x4e\x72\xa5\x45\xfa\x1e\x94\xc8\x65\x04\xcf\x61\xc6\x38\xd3\x4c\xf0\x47\x29\x68\x1a\x53\x4d\x8f\x1e\x11\x42\x39\x17\x9a\x9a\x9f\x95\xf9\x93\x90\x48\x70\x2d\x45\x92\x80\x1c\xcf\x81\x4f\x2e\xf3\x29\x4c\x73\x96\xc4\x20\xb1\x73\x3f\xf4\xd5\xd3\xc9\xb3\xff\x39\x79\xfa\x88\x10\x4e\x53\x38\x22\x11\xd5\x34\x11\x73\x3b\x96\x9a\x88\x0c\x24\xd5\x42\xaa\x49\x24\x24\x08\xf3\xbf\xf4\x91\xca\x20\x32\x83\xcc\xa5\xc8\xb3\x23\xb2\xf1\x1d\xdb\x9f\x9f\x0b\xd5\x30\x17\x92\xf9\xbf\x09\x19\x13\x91\xa4\xf8\x6f\xb7\x46\x3b\xec\x39\x0e\x8b\xbf\x27\x4c\xe9\x1f\xd6\x9f\xbd\x66\x4a\xe3\xf3\x2c\xc9\x25\x4d\x56\x27\x8c\x8f\xd4\x42\x48\xfd\xb6\x1c\xde\x0c\x17\x51\xad\x64\x64\x1f\x33\x3e\xcf\x13\x2a\x57\xbe\x7d\x44\x88\x8a\x44\x06\x47\x04\x3f\xcd\x68\x04\xf1\x23\x42\x1c\xa4\x5c\x57\x63\x42\xe3\x18\xa1\x4f\x93\x33\xc9\xb8\x06\x79\x22\x92\x3c\xe5\xc5\x50\xe6\x9d\x18\x54\x24\x59\xa6\x11\xc2\x17\x0b\x20\x99\x04\xad\x97\x08\x12\x22\x66\x44\x2f\xc0\x8f\x5d\x7c\x45\xc8\xcf\x4a\xf0\x33\xaa\x17\x47\x64\x62\x20\x3c\x89\x99\xca\x12\xba\x34\xb3\xa9\xbc\x65\xb7\xe9\xb9\x7d\x56\xf9\x5d\x2f\xcd\xd4\x95\x96\x8c\xcf\xdb\xa6\x62\xde\xeb\x3f\x07\x0b\x9a\x8b\x65\xb6\x3e\x85\x95\x1f\xfb\x8e\x9f\xe5\xd3\x84\xa9\x05\xc8\xfe\x93\x28\x3e\x59\x9b\xc3\xd9\x86\x27\x0d\x13\xa9\x74\xea\xe9\x66\x12\x49\x40\x92\xb9\x60\x29\x28\x4d\xd3\x6c\x6d\x80\xe3\xf9\xfa\x1a\x63\xaa\xfd\x8f\xf6\xa5\xab\x67\x34\xc9\x16\xf4\x99\xfb\x51\x45\x0b\x48\x69\x89\x0f\x22\x03\x7e\x7c\x76\xfa\xd3\x5f\xcf\x57\x1e\x90\x3a\x74\x6a\x78\x4e\x98\x22\x94\x48\xc8\x84\x62\x5a\xc8\xa5\x81\xd6\xc9\xf9\x4f\x6a\x44\x4e\xde\x3f\x57\x23\x42\x79\x5c\x10\x1e\xc9\x68\x74\x49\xe7\xa0\x26\x6b\x73\x15\xd3\x9f\x21\xd2\x95\x9f\x25\xfc\x92\x33\x09\x71\x75\x16\x06\x3c\x1e\x26\x2b\x3f\x1b\xf8\x57\x7e\xca\xa4\x19\x53\x57\x08\xd9\xb6\x0a\x33\xab\xfd\xbe\xb2\xc2\xdf\xc7\x2b\x4f\x09\x31\x80\xb1\x5f\x92\xd8\x70\x36\x50\x88\x14\x8e\xea\x20\x76\xd0\xb4\xc8\xc2\x94\x81\x88\x04\x05\xdc\xf2\x3a\xf3\x33\xe5\x6e\x95\x93\xb5\xce\xcf\x41\x9a\x8e\x0c\x43\xc8\x93\xd8\xb0\xc4\x2b\x90\x9a\x48\x88\xc4\x9c\xb3\x5f\x8b\xde\x15\xd1\x02\x87\x4d\xa8\x06\xa5\x09\xd2\x35\xa7\x09\xb9\xa2\x49\x0e\x08\xec\xb5\xbe\x53\xba\x24\x12\xcc\xb8\x24\xe7\x95\x1e\xf1\x13\xb5\x3e\x97\x37\x42\x02\x61\x7c\x26\x8e\xc8\x42\xeb\x4c\x1d\x1d\x1e\xce\x99\xf6\xcc\x3e\x12\x69\x9a\x73\xa6\x97\x87\xc8\xb7\xd9\x34\x37\x0c\xf5\x30\x86\x2b\x48\x0e\x15\x9b\x8f\xa9\x8c\x16\x4c\x43\xa4\x73\x09\x87\x34\x63\x63\x5c\x0c\x47\x86\x3f\x49\xe3\xff\x21\xa1\xca\x01\x57\xd1\x60\x85\x1a\x88\xe7\xbb\x03\x37\xcb\xf0\x63\x8b\x98\xb6\x43\xbb\xd8\x72\x4f\xcc\x4f\x06\x8c\xef\x5f\x9c\x5f\x10\x3f\x23\xbb\x6f\x76\x8b\xca\x57\x37\x40\xc8\xef\x96\x81\x2c\xe3\x33\x90\xf6\xcb\x99\x14\x29\xf6\x0a\x3c\xce\x04\xe3\xda\x72\x8d\x84\x01\xd7\x44\xe5\xd3\x94\x69\x85\x68\x0d\x4a\x9b\x8d\x5c\xef\xf8\x04\x0f\x47\x32\x05\x92\x67\x86\x78\xe3\xf5\x57\x4e\x39\x39\xa1\x29\x24\x27\x54\xc1\xbd\xef\x9d\xd9\x23\x35\x36\x1b\xd2\x7b\xf7\xaa\x47\xff\xfa\x07\x6b\x54\x4f\x88\x3f\xb3\x7b\xbd\xdc\xc4\x26\x88\xe5\x09\x9b\xce\x04\xd2\xc2\x1d\x4c\xa3\x71\x2c\x41\x6d\x78\xd0\x8d\x75\xa6\x1d\xdb\xcf\x2d\xf2\x2d\x84\x32\x48\x40\x35\x79\xf7\xfa\x0d\x89\x28\x27\xb9\x02\x43\xc2\x91\xe0\xdc\x60\x99\x16\x84\x9a\x33\x77\x0c\x37\x4c\x21\x56\x4a\x98\x33\xa5\xe5\x72\x7d\x6f\x4d\x7b\x29\x64\x4a\xf5\x11\xf9\xc6\xbf\x36\xc6\x21\x84\x24\x2c\xfb\xee\xe8\x9b\x4c\x48\xfd\xdd\xc6\x0f\xdf\xf1\x64\x69\x06\x8f\xc9\xf5\x02\x38\x39\x2f\x20\x43\xbe\xad\xfc\xf1\x4a\x66\xd1\xe6\x81\x4f\xe7\x5c\x48\xff\xb5\x41\xeb\xd3\x94\xce\x81\xcc\x18\x24\x48\x68\x0a\x36\x70\xb5\x16\xb4\x20\x56\xf0\x9b\xb1\xf9\x1b\x9a\x6d\x0b\xeb\x13\xdf\x81\x99\x81\x99\x54\x55\x6c\x29\x1f\x6a\x81\x14\x65\x16\x6f\xfe\x49\xa3\x4b\x42\xdd\xe0\x29\xcd\xc6\x0a\xa9\xb9\x03\xf0\xfd\xe0\x77\xe2\x3b\x35\x3b\x52\xfe\x7c\xea\xb8\xf4\x60\x08\x55\x81\x30\xf8\xdb\x52\x28\xeb\x84\xef\x9b\x4d\x67\x6a\x8f\x31\xe6\x32\x8b\xce\x44\x6c\x97\xbd\xed\x2e\xbe\xaa\x76\x42\xe0\x26\x13\x0a\x14\x89\xd9\x6c\x06\xd2\x70\x4e\x71\x05\x52\xb2\x18\x14\x99\x09\x89\x5b\x9b\x89\x18\xd9\x44\xb1\xd5\x35\x79\xe4\x4c\x6c\x60\x9b\x64\x10\x0d\xa0\xd0\x62\x31\xbc\x0b\xb7\x37\x32\x25\xd2\xc1\x63\x4c\xa3\x33\x54\x8f\x96\x9b\x9f\xae\x80\xee\xd8\xbd\xec\x11\xdd\x89\xa2\x8e\xc3\x3d\x56\x06\x24\x8f\x55\xd1\xe7\xe6\xf5\x77\x4e\xb9\xcf\xb4\x4d\xe3\x22\x86\xe3\x8e\xe9\xaf\x2d\xe1\x39\xfe\x31\x05\x85\x9f\x17\x53\x45\xc1\x26\xce\x13\xe4\x7d\x79\x52\xdf\xe5\xa6\x75\xf4\x5c\x4b\xdf\xf5\xd8\xf7\x60\x06\x52\x42\xfc\x3c\x37\xa8\x7e\x5e\xcc\xca\x71\x3e\xfb\xf3\x8b\x1b\x88\xf2\x26\x72\x6c\x5c\x7a\x03\xe2\x57\x9b\x51\x38\x1c\x24\x40\x92\x6b\x96\x24\x6e\x46\x86\x65\xf9\x07\x06\x24\x28\x01\x1a\x08\x2a\x7b\xb0\x28\xaa\x99\x9a\x2d\x3b\x07\x30\x10\x2d\x60\x0e\x37\x46\xb8\x41\x6d\x11\x09\x89\xcd\x18\xc4\x64\xba\x74\x72\x8c\x61\xea\x23\x32\xcd\x35\x61\x1a\x85\x9c\x68\x21\x84\x5a\x3d\x44\xd7\x1b\xb5\x5b\x8b\xf3\xba\x62\x02\x65\x54\x22\x38\x18\x6e\x98\x1a\xc9\xc4\xd1\x6b\x65\xf8\x09\xae\xbc\xfc\x8c\xad\x0a\x16\xeb\x2d\x35\x27\x5e\xb1\x5d\x9e\x22\xcc\x30\xd7\x4c\x2f\xf0\x8f\xb9\x51\x97\x8c\x7c\xac\xf2\xd4\x0c\x7a\x0d\x6c\xbe\xd0\x6a\x44\xd8\x64\x83\xd0\xb4\xda\x0c\x02\x02\x8d\x16\x95\x69\xa5\x00\x5a\x11\x9a\x24\x7e\x09\x55\xac\xb5\x12\x48\x6a\x64\x45\xb2\xef\x85\xc9\xce\x51\x9c\x20\x38\x2a\x24\x98\x55\xc4\xdb\xb8\x5d\x23\x02\x3a\x9a\x1c\x8c\x3a\xbb\x8f\x44\x9a\xe5\x1a\x8c\x04\x9c\xa7\x66\x6b\x99\x36\x3a\x98\x15\x7c\xa5\xc8\xe7\x16\x52\x90\xb8\x89\x7b\xb5\xc5\x9e\xe8\x86\xff\xd1\x38\xde\xc4\xf3\x57\xdb\x9e\x05\xee\x9e\xd7\x4c\xcc\x70\xcc\x02\x09\xe1\x97\x52\x1d\x2d\x9c\xb2\x14\x09\x29\x41\x65\x82\x9b\x9e\xed\x93\x17\xe5\xda\xfe\x6e\xde\xe9\x1c\xcf\x74\xba\xaf\x0e\xca\xcd\x5e\xb0\xf9\xc2\xef\x35\x95\x80\xbf\xd5\x71\xa4\x6b\xcb\x2d\x2b\xa1\x52\xd2\x2e\x3a\x62\x1a\xd2\x0e\x46\x42\xb6\xa0\x7e\x42\x8e\x39\x81\x34\xd3\xcb\x0a\x62\x57\x50\x4c\x83\x4c\x0b\x40\x22\x16\x22\xdb\x53\x16\x08\x2c\xcd\x12\x16\x31\xed\xd0\x9c\x3c\xed\x31\xde\xbe\xa1\x04\xc2\xb4\x39\x34\x08\x17\x63\x91\x1d\x4c\xc8\x31\xe1\x79\xc1\x78\xda\xa6\xc0\x45\x31\x03\xd7\x91\x99\x96\x12\x65\x5f\xdd\xfc\xa8\x1f\xfb\xb6\xad\x59\xc8\x5f\x6f\x63\x37\x7f\xe0\x3d\x88\xd0\xbc\x6e\xa1\xd6\xf9\x6a\xdf\x83\xc4\xbf\xed\xe7\xd0\xe7\xed\xd5\xd3\xde\x52\x8e\x82\x04\x22\x6d\x4e\x43\x90\xe9\x88\x50\xa5\x44\xc4\x8c\x56\x58\xe2\x7e\x9d\xa0\xec\x4a\xba\x61\x4f\x86\xc2\x9f\x0c\x5e\x3f\x41\xc3\x43\x9d\xbe\xfb\x7e\xb7\x06\x8d\x84\x19\x1d\x67\xb6\x02\x95\x1a\xdf\x9d\x2e\xf1\xe9\x63\x45\x12\x3a\x85\x64\x83\xd2\xde\xd4\xfa\x13\x7f\xd9\x7a\xb2\x81\x86\x05\xf5\x62\x08\x65\x5b\xc5\x86\xca\xba\x9d\x89\xa3\xc0\x13\x73\x54\x19\xd5\x9e\x32\xae\x9c\x7d\x67\x44\x28\xb9\x84\xa5\xb5\xc3\x51\x5e\x98\xe2\x06\x4d\x01\x3b\x96\x60\x0f\x74\x83\x77\x97\xb0\xc4\x0e\x9b\x6c\x48\x2d\x5d\x0d\xc5\x3b\xdb\x86\x70\x80\xb2\x8d\xcd\x44\x07\x7e\xb1\x05\x80\x86\x93\x86\x6d\x97\xd0\x2a\x3e\x6f\x6a\x6b\x56\x6a\x44\x77\xdc\x0f\xdc\x24\x3c\x81\x3d\x3e\xd0\x2c\x4b\x18\x6c\x36\x35\xb5\xb7\x56\xad\xaf\xad\x79\xe8\xed\xb4\xae\x81\x04\x62\xda\xfb\xc2\x5c\x67\xf1\xfd\xb1\xb2\xf8\x6a\xf8\xce\x82\x65\xd6\xd0\xa2\x00\xd9\xc8\x70\xa4\xb5\xed\x27\x9a\xb0\xd2\x96\xad\x50\xd8\x38\xe5\x23\xf2\x56\x68\xf3\xbf\x17\x37\x4c\x19\x19\xf3\xb9\x00\xf5\x56\x68\xfc\x73\x42\x5e\x69\x4b\x7a\xaf\x7b\xf2\xe5\xb2\x6d\xbd\x07\x76\x7d\xf7\xbd\x03\xc7\xdc\x32\x51\x03\xe1\xaa\xd1\x55\x4d\xc8\xa9\x15\x07\x0b\x2f\x00\x53\xe4\x94\x1b\xa5\xc0\x42\x6e\xf0\x50\x68\x77\xc7\xbe\xdd\x90\x69\xae\xd0\x6a\xca\x05\x1f\xa3\x18\xb5\x71\x4c\xbb\x41\x66\xdc\xea\x16\xdd\xe2\xf0\xcd\x43\xbf\x42\x1b\xdd\x6b\x3d\xaa\x7c\x3c\x78\xdc\xca\x60\x0b\x7a\x85\xa2\x3d\xe3\xf3\xa4\x10\xe2\x47\xe4\x7a\xc1\xa2\x85\xd5\x1e\xa7\x60\x9d\x03\x99\x04\x23\x31\x50\x65\x98\xbf\xf9\x65\x0e\x72\x38\xea\x5f\x18\xd5\xc0\x8e\x6f\x5d\x1b\x09\x8d\x20\x26\x31\xaa\x2c\xd6\xca\x4e\x35\xcc\x59\x44\x52\x90\x73\x20\x99\x39\xfa\xb7\x43\xf8\x61\x27\xb1\x6d\x83\xcf\xe3\xea\x80\x5b\x50\x18\x21\x37\xe3\xcb\x7c\x0a\x92\x83\x06\x35\x36\xf2\xc9\xd8\xcd\x5e\x8b\x94\x45\xbd\x3b\xbb\x95\x6e\x50\xce\x7a\x69\xf4\xb6\x7b\x12\xb1\x50\x47\x0c\x22\x56\x10\xb1\x82\x88\x15\x44\xac\x20\x62\xf5\x6e\x41\xc4\xda\x79\xf8\x20\x62\x05\x11\xeb\xde\x45\xac\x5a\x17\x29\xcd\x86\xf6\x60\xed\x72\x5b\x18\x02\xff\xdb\x1a\x74\x57\x2d\x7f\x28\xf0\xf9\x10\x96\xba\x09\xd0\xc8\x31\xe7\xee\x70\xba\x40\xb3\x21\xb3\xfe\x7a\x49\xf9\x1c\xc8\xb3\xf1\xb3\xa7\x4f\x87\x18\x08\x1d\x3a\xf7\xfa\x62\xe6\x82\x13\x18\xd7\x7f\xfd\xaa\xe3\x8b\x1d\x76\xa5\xc9\x5f\x72\x3f\x8e\x3a\xc7\x79\x0a\xdf\x4c\x4d\x44\x6e\xf0\xa5\xe1\x31\xc6\x85\x26\x29\x68\x42\xbb\x65\xb2\xaa\xd9\x9d\xa5\x30\x2a\x9c\xde\xc8\x76\x5c\x84\x90\x77\x0a\xc6\x44\x70\xe7\x7a\x31\x9b\xdf\xbd\xb9\x5b\xad\x20\x02\x6a\x23\x57\xa6\x60\x56\xd1\xed\x0a\xd4\x44\x89\xd4\xcc\x9a\x71\xed\x99\x98\x59\x02\xf8\x8d\x21\xfb\x30\x99\x4f\x48\x9c\x63\xb7\x94\xbb\x90\xa7\x03\xbb\x5a\xb5\x54\x1a\xd2\x6e\x5f\xa0\x39\x0c\x25\xfe\xcf\x80\x45\xcb\xa5\xe9\x0c\xae\x80\xeb\x9c\x26\xc9\x92\xc0\x15\x8b\x74\x01\x3f\x8c\xd0\x62\x5a\xf5\x82\xd4\x00\x31\xba\xbf\xe8\x3c\x5e\xa3\xd0\xae\x43\x6a\x88\xe4\xbb\xd6\x77\x1f\x9e\x53\xa3\x80\xf7\x6e\x25\x93\x46\x9d\x50\x9b\x7e\xad\xdb\x16\xff\x89\xc8\xfd\xee\x7d\xb7\x97\x8d\x0c\x3e\x7f\x06\x9c\x39\xdb\x89\x56\xce\xe1\x25\xa4\x73\xbe\xad\xaf\x74\x83\xcb\xcb\xae\xbd\x46\x35\x62\xd6\x73\x40\xbd\x00\xeb\xa4\x3c\x7e\xfb\xbc\x1f\xc4\x88\x0b\x0e\xb8\x10\x99\x48\xc4\x7c\x59\xdd\x5e\x1b\x22\xcd\xd2\xcc\x3b\x71\x29\x51\xf9\xd4\x89\xe0\x06\xe7\xdf\xae\xe0\x43\x70\x0d\x05\xd7\x50\xb0\x5b\x60\x0b\x76\x8b\x60\xb7\x08\x76\x8b\x7e\x2d\xd8\x2d\x76\x1e\x3e\xd8\x2d\x82\xdd\x22\xb8\x86\xd6\x5b\x10\xb1\xba\x5b\x10\xb1\x5a\x5b\x10\xb1\x8a\x16\x44\xac\x20\x62\x05\x11\x2b\x88\x58\x41\xc4\xba\xaf\x6e\x76\x75\x0d\xed\x34\x85\xed\x06\xcf\x44\xbc\x43\xf2\x56\x26\xe2\x96\xdc\x2d\x6b\xd3\x8f\xc4\x38\x11\x11\xd5\x2e\xa3\xda\x7c\xe2\xbc\x50\x8a\xa6\xd6\x4d\x31\x22\xbf\x0a\x0e\x36\x9b\xc5\x90\x07\x3a\x0b\x84\x5e\x80\x34\xaf\xef\xab\x83\xd6\x14\x82\x90\xfb\x15\x72\xbf\x42\xee\x57\x63\xfb\x6c\x72\xbf\x16\x54\x59\xbc\xb5\x47\x63\x73\x2a\x58\x85\x27\x5d\x80\x4c\xff\xa4\x99\x60\x06\xdd\x1d\x3a\x62\x3d\x90\x12\xa5\x2c\x64\x62\xe7\xf0\x87\xf8\xac\x0e\x0f\xa7\x56\xe3\xa2\x68\x1c\x43\x4c\x32\x90\x63\x8b\xa2\x82\xcc\x18\x8f\x37\xac\xd5\xc3\xa7\x9b\x3d\xdc\x61\x2a\x56\x7d\x1d\xbd\xbe\xb9\x9b\x7c\xac\xfa\x44\xb6\x70\x2a\x56\x3d\xa3\xb5\x43\xf0\xb3\xc8\xce\x1a\xaa\xa1\x8f\x89\x76\x0e\xc5\x1f\x7a\xea\xe8\xc3\xd5\x6c\x54\x8e\xbd\xfb\x71\x4b\xf3\xd3\x20\x55\xe8\xd8\xe9\xe3\xbf\xe4\x20\x97\x58\x37\xa0\x54\x3b\x8b\xb2\x33\x2e\x22\x86\x29\x12\x51\x65\x8f\xd5\x21\xa2\xf2\xe9\xcc\x66\x4d\xf2\x3c\x49\x46\xb6\x9f\x55\x62\xf5\x6c\x0e\xf1\x80\x0b\xf3\x7c\xb0\x45\x6c\xa0\x89\x66\x3b\x1b\xc8\xf6\x5e\x58\xb2\xba\x4f\xab\x5d\x59\xdb\x98\x37\x1d\xda\x6d\xd9\x68\x3b\xdc\xe0\x4d\x1f\xec\x1f\xb7\x6d\x5b\x05\x66\x2b\xf5\x65\x67\x7d\xbd\x05\x26\x3b\xd8\x15\xf1\xe5\xc1\x93\xb9\x1d\xdb\x22\xd9\xde\xbe\x48\xb6\xb6\x31\x92\xad\xec\x8c\x64\x5b\x5b\x23\xd9\xc1\xde\x48\xb6\xb3\x39\x92\x55\x6c\x33\x3b\xe4\x04\xdf\xbb\x31\x3f\x92\xdd\x94\xf3\xed\xcd\x90\xe4\x16\x08\xab\x3a\x7e\xa5\x88\xd7\xdd\xd9\x25\x49\x5f\xdb\x24\x92\x55\xcd\x3c\x79\xdf\xfb\xb2\x9d\x69\x92\xdc\xd2\xae\x38\xa3\x1d\x43\x5b\xd8\x7d\x19\x2b\xc9\xc3\x1b\x2c\x5b\xa7\xe0\x86\xef\x6d\xe1\xdb\x6a\xf4\x1d\xac\x82\x64\x27\xcb\x20\xd9\xde\x3a\x48\x76\x45\xf6\x5b\xb3\x12\xde\x6a\x57\x28\x27\xbd\xc6\x38\xb4\x1d\xa4\xad\xc1\x14\x58\x19\xd6\x4a\x17\x58\xa3\x6c\x46\x7e\x33\x42\x04\x22\xe6\x1f\x24\xa3\x4c\x2a\xa3\xdd\x38\xbb\x76\xf5\x99\x33\xdf\x55\xba\x19\x3c\x01\x2c\xd2\x66\xce\xf8\x2b\x9a\x18\x21\xc7\x06\xfd\x3a\x1b\x84\x99\xcb\xaa\x08\x39\x22\xd7\x0b\xa1\xac\x44\x52\xd4\x99\xdb\xbb\x84\xe5\xde\xa8\x97\x79\xa0\xde\xaa\x94\xbd\x77\xca\xf7\xac\xe8\xb4\x46\x97\x85\x9c\x25\x78\xb2\x24\x7b\xf8\x6c\xef\xb6\x65\xd4\x2d\xe4\xa3\x6a\x31\xdf\x6d\xc5\x8f\xad\xc8\x69\x57\x03\x37\xa9\x61\xdf\x0f\xb0\xdc\x36\x10\x61\x10\xce\xbf\xa9\x8d\xe8\x05\x6a\x44\x33\xa3\xbb\x17\x72\x13\x5a\x54\xad\xc8\xe4\x6c\x54\xd6\x5c\xc5\x92\x64\xc0\x68\x53\x20\x9a\x5e\x02\x7a\x78\xb0\xb6\xa3\x62\x31\x1a\xdc\x04\xb7\xa8\x83\x23\x19\x94\xf1\x45\x08\x13\x21\x2e\xf3\xcc\xa3\x9e\x2f\x1c\x3a\x60\x48\xc6\x23\x91\xfa\x98\x7a\x1b\xd7\x6a\xa8\xc2\xd1\xcb\xd8\x96\x3b\xb5\xbf\xe3\xc0\x78\x04\x38\xd3\xc4\xa7\x9a\x62\xfe\x89\x50\x45\x3e\xa1\x50\xc9\xc9\x3e\x7e\x78\xf0\x69\x48\x48\x41\x01\x40\x6b\x7d\x15\x39\x72\x96\xa2\xa0\x65\xc5\xfe\x57\xc0\xb6\x0d\x62\x03\x86\xf6\x95\xe2\xaa\xc0\xb0\xb5\xf0\xc8\x3e\xe5\x9a\x1d\x94\x05\xf1\x08\xe2\x01\x4a\xc9\xb1\xe0\x8f\xb5\x9d\x9f\xe7\x6b\xbe\x83\x21\x51\x07\x05\xdc\x4b\x8f\x9f\xf5\x16\xd8\x2d\x8f\x61\x46\xf3\x44\xbb\xc2\xb3\x86\xf5\xe1\x49\x3f\x60\x84\x0b\xef\x2f\x71\x02\xff\x4c\xc8\x29\x8b\x63\xe0\x98\xe2\xe0\xa7\x3f\x15\x3e\x21\xa8\x44\x77\xc3\xd9\x6a\x7b\x3c\x64\xd8\xe3\x44\x89\xd1\x6a\x8f\x51\x51\x98\xd6\x50\x11\x96\x4f\xac\x0d\x40\x98\x32\x40\x6d\xa8\x94\xd8\xbc\x42\x56\xc8\x83\x49\xb6\xa0\x15\x03\xb4\x63\xb6\x8a\x00\xa7\x53\xb4\x88\xd7\x49\xfa\x94\x57\xac\x2e\x64\x06\x54\xe7\x12\xc8\x9c\xea\x1e\x36\x7e\xdf\xee\x25\xf6\x68\x77\xa6\xbb\x75\xec\x17\x53\x0f\xc0\x78\x57\x07\x0d\xbc\xb7\x17\xef\xe5\x42\x07\xf6\xfb\xc5\xb2\xdf\x35\xa4\xbf\x0d\x0e\xbc\xd6\x69\x60\xc2\xae\x7d\x41\x4c\x98\xfb\x1b\x3a\x1e\xd8\x0f\x62\x4d\x83\x36\x8e\xd7\x4f\x49\x95\x56\x43\x4c\x75\xdb\xce\x62\xe8\x13\x01\x11\x87\xb0\x87\xd8\xbb\x83\x73\xee\x6e\x3e\xf0\xb5\xb9\xdd\xb0\x96\x61\xad\x46\x1d\x0c\x18\xd3\xab\x6e\x82\x83\x42\x27\x03\x14\x11\x26\x95\x61\xb0\xd7\x21\x4b\xc1\x64\xc0\xd2\x80\xca\xe3\xd5\xf4\xc0\xb2\x6f\xf4\x6c\xa4\x40\xb9\x22\x7b\x3e\xc8\xe5\xb1\x2a\xdf\xd8\x1b\x44\xf0\xbe\xf8\x67\x31\xf6\xfe\x6f\x7f\x1c\xd4\x0a\x7e\x96\x43\x07\x4f\x52\xf0\x24\x55\x5b\xf0\x24\xad\x4f\x22\x78\x92\x9a\x5a\xf0\x24\x6d\x35\x7e\xf0\x24\xd5\x5b\xf0\x24\x05\x4f\x52\xf0\x24\x05\x4f\x52\xf0\x24\x05\x4f\x52\xdf\x8f\x6e\xc3\x93\x54\xaa\x41\xf7\xa1\x47\x57\x55\x56\x17\x29\x6f\xaf\x94\xa3\x9a\x45\x65\x5e\xac\x7f\xcb\xfe\xeb\xa1\x94\xea\xaa\x1a\xbc\xab\x4a\x5d\x55\xd0\xd7\x2c\x18\x83\x35\xea\x46\xfd\xb9\xd0\xb0\xd7\xc6\xb8\x25\xd5\xfa\x4f\x6e\x5c\xaa\x84\xf0\xde\x07\x39\x5c\xf8\x64\x1e\x77\x4b\xe5\x14\xca\x4c\x9f\x98\xec\x7b\x63\xef\x81\xd9\x70\x2e\x74\xfd\x21\xd7\x6c\x5c\xbe\x51\x84\x48\xa3\x4d\xda\xd7\xb3\x1b\x02\x74\xaf\xb3\x94\xc6\x4f\x97\x61\x54\xa4\xb4\x94\xd8\x66\xf8\x3f\xc8\xda\x6c\x99\x72\xb7\x78\x62\x72\x9e\xcc\x39\x37\xe2\x91\xe0\x2e\x8f\x65\xc0\x4c\xec\xd1\x62\xed\xcc\x8e\x2a\xad\x32\x85\x6b\x44\x8d\xaa\xdc\xa6\x4a\x0a\x04\xd5\xf6\x4e\x50\x57\x75\x4a\x70\x67\xa5\x37\xbf\xd8\x7e\x06\x4c\xa2\x20\x58\x84\x27\x2b\x56\x34\x84\x56\x5f\x20\x8d\x56\x27\xcb\x14\xee\x23\x4d\x12\x71\x3d\xe4\x7c\x1a\x48\x11\x5b\x97\x47\xec\x8d\xbd\xd7\x83\xeb\x28\xae\xe4\x0b\xf4\x95\xd5\x43\xb1\xc5\xd6\x16\x8a\x2d\x7e\x1e\xc5\x16\x2b\x8e\xd8\x6a\xd5\xc5\x6e\x58\x61\x55\xc6\x3b\xad\xba\x48\xc8\x7f\xbb\x2b\x46\x25\x58\xef\x69\x9e\x68\x96\x95\x79\xd6\xca\xee\x50\x62\x55\xea\x99\xcb\x87\xac\x53\xaf\x99\x0d\x8d\x16\x9d\x43\xad\x50\x39\x8e\x87\x79\xdb\x0a\xb9\xa9\xcd\x19\x44\xfb\xbb\x2d\x75\xe8\x75\x6d\x9b\x78\xc9\x1e\x3a\x9f\xac\x17\xff\x7b\xee\x2e\xab\xae\x3a\xe1\x15\xd9\x37\xa7\x63\xb2\x74\x6e\xeb\x1a\x23\xac\x1d\xab\x3d\x06\xb0\x76\xb0\x2b\xf0\x02\xea\x9c\x5d\x01\x2f\x4f\xdf\x7d\x75\x70\xe0\x65\xe2\x55\xf9\xa1\x47\xef\xbb\x48\x18\x7d\xb8\xf6\x50\xc9\x60\xe5\xbc\xef\x31\xc2\x06\x89\xe0\x9b\xca\x29\xfb\x5d\xb7\x4c\xd0\x63\x10\x4b\xd2\x3e\x41\xb5\xb2\xd1\xa5\x2c\xd0\xd9\xcb\x1d\xe6\x01\x0e\x49\x36\x1b\x66\x15\xdf\x22\xc9\x6c\xdb\x5a\xa1\x77\x9b\x5c\x76\xa7\x89\x65\x5f\x4e\x49\xcf\x07\x76\xff\x7d\x01\xf5\xa8\x3e\x13\x77\x5f\x28\x48\xd5\xd4\x1e\xaa\x20\xd5\x9d\xbb\xf3\xbe\xb8\xba\x54\xf7\xea\xbe\xbb\x1f\xd7\xdd\x17\x56\x97\xea\x41\x5c\x75\x9f\x79\x85\xaa\xbb\x73\xd1\x85\xf2\x4f\x0f\x53\x61\x73\xa8\x1b\x6e\x7b\xaa\x7a\x50\xf7\xdb\x83\xba\xde\x1e\xde\xed\xb6\x95\xac\xb2\xab\xbb\x6d\x30\x99\xec\xea\x66\xdb\x26\x67\x60\x3b\x7c\xbe\xbf\x24\xad\x7b\x4e\x12\xf8\x3c\x92\xb3\x1e\x28\x33\xe0\xa1\xb2\x02\xee\x36\x23\xe0\x01\x92\xb1\xee\x29\x11\xeb\x01\xe3\xff\x87\xca\x1c\x83\x24\x8d\xdd\x18\xe7\x36\xe2\xc0\x96\x09\x57\x5b\x32\xcf\xfb\x4c\xb4\xfa\x13\xf0\xcf\xad\x12\xac\x02\x0b\x7d\x20\x16\x7a\x7b\x09\x55\xf7\x97\x4c\x15\x18\xa9\x6b\x3b\x33\xd2\x2d\x93\xa6\x6e\xcd\xae\x7f\x37\xc9\x52\xf7\x9d\x28\x75\x07\x49\x52\x0f\x91\x20\x75\x07\xc9\x51\xc1\x1b\xd2\xb3\x05\x6f\x48\xdf\x16\xbc\x21\x4d\x2d\x78\x43\x56\x5b\xf0\x86\x04\x6f\x48\xf0\x86\x04\x6f\xc8\xfa\x80\xc1\x1b\x12\xbc\x21\xfd\x5a\xf0\x86\xdc\x8f\x37\x64\x68\xc2\xd1\x76\xb8\xfc\x30\x89\x46\xf7\x9b\x64\x74\xfb\x09\x46\x0f\x98\x5c\xf4\x27\x33\xb8\x0c\x4e\x24\xda\x0e\xcd\x3f\x97\x04\xa2\xcf\x23\x79\xe8\xc1\x13\x87\x76\x4d\x1a\xba\x9d\x84\xa1\x01\xd8\xbe\x25\x9e\x67\x22\x3e\xe6\x9a\xed\x7a\xe9\x55\x15\x01\x9b\x6e\xbe\xa2\x57\x82\xc5\x24\xcb\xb5\xbb\x6c\x27\xdc\x7e\xd5\x89\x03\xf7\x73\xfb\x55\x6d\xf3\xc2\x15\x58\x6d\xed\xb3\xb9\x02\xab\x69\xcf\xc2\x3d\x58\xf5\x16\xee\xc1\x0a\xf7\x60\x85\x7b\xb0\x6c\x0b\xf7\x60\x85\x7b\xb0\x42\xf5\xc2\x50\xbd\x30\x54\x2f\xec\xff\x55\xa8\x5e\xd8\xdc\x42\xf5\xc2\x21\x2d\x54\x2f\xec\x3d\x7a\xa8\x5e\x18\xaa\x17\x0e\x1b\x38\x54\x2f\x24\xa1\x7a\x61\xa8\x5e\xf8\x05\x57\x2f\x0c\xf7\x60\x7d\x11\x77\xb1\x84\x8b\x58\x06\x8c\xfd\x79\x5d\xc4\x12\xee\xc1\x0a\x57\xb0\xac\xb6\x70\x0f\xd6\x17\xc4\x7b\xc3\x3d\x58\x5f\x32\xfb\x0d\xf7\x60\x05\x26\xbc\xb9\x85\x7b\xb0\xc2\x3d\x58\x9d\x2d\xdc\x83\x15\x3c\x49\xc1\x93\x54\x6f\xc1\x93\xd4\xde\x82\x27\xa9\xab\x05\x4f\x52\x6b\x0b\x9e\xa4\xe1\x2d\x78\x92\x82\x27\x29\x78\x92\x82\x27\x29\x78\x92\xc2\x3d\x58\xe1\x1e\xac\x3e\x10\x0c\xf7\x60\x6d\x6e\xe1\x1e\xac\x70\x0f\x56\xb8\x07\xcb\xb6\x70\x0f\x56\xb8\x07\x6b\x73\xf3\xb7\x48\xd5\x32\xa2\xbe\xdc\xcb\xb0\x86\x2f\x23\xdc\x88\x15\x6e\xc4\x6a\x68\xe1\x46\xac\x70\x23\xd6\xa6\x16\x6e\xc4\x0a\x37\x62\xb5\xb4\x50\x03\xb2\x67\x0b\x35\x20\xfb\xb6\x50\x03\xb2\xa9\x85\x1a\x90\xab\x2d\xd4\x80\x0c\x35\x20\x43\x0d\xc8\x50\x03\x72\x7d\xc0\x50\x03\x32\xd4\x80\xec\xd7\x1e\xde\x01\xf7\xaf\x51\x03\x32\xdc\x88\xf5\x59\xde\xe8\x12\xae\x73\xe9\x68\x9f\xcf\x75\x2e\xe1\x46\xac\x7f\xcd\x8b\x5c\xc2\x8d\x58\x9f\x31\xff\x0c\x37\x62\x75\xb7\xcf\x87\x85\x86\x1b\xb1\xfe\x95\x19\x69\xb8\x11\x2b\xdc\x88\x55\xb4\x70\x23\x56\xf0\x86\x34\xb6\xe0\x0d\x21\xc1\x1b\x52\xb4\xe0\x0d\xe9\x35\x6e\xf0\x86\x04\x6f\x48\xf0\x86\xb4\x4f\x3a\x78\x43\x82\x37\xa4\x73\xf0\xe0\x0d\xf9\xd3\x7b\x43\xc2\x8d\x58\xe1\x46\xac\x0d\xed\x4f\x66\x70\x09\x37\x62\x85\x1b\xb1\xfe\x9c\x37\x62\xc1\x8d\x96\x34\xd2\x27\x82\x6b\xe0\x8d\xd9\x46\x7d\xd1\xf9\x45\xad\x37\x73\xba\xce\xd8\x3c\x97\x4e\xef\x9f\xbf\x3f\x3b\x21\x11\xd5\x34\x11\x73\x72\x26\x62\x6b\xd7\xc6\x2f\x8a\x9f\x53\xd0\x34\xa6\x9a\x16\x2e\x11\xa3\x1f\x5f\xb1\x18\x99\x6a\x0c\x37\x84\xa5\x74\x0e\x86\x79\x35\x4e\x22\x57\x40\x28\xb9\x86\x24\x19\x5f\x72\x71\xcd\xc9\x15\x48\x55\x61\xd7\x9f\x44\x96\x7e\x22\x0a\xe4\x95\xbd\x55\x0a\x6e\x32\x83\x68\x4c\xdb\x73\xdf\xcf\xa4\x3a\x5c\x19\x9e\x7f\x62\x9f\x9e\x63\x38\x73\xdb\x05\x4d\xc5\xda\x71\x99\x66\x4e\x4f\x8c\x60\xff\xc4\x10\x75\xae\x7c\x2e\xc1\x8c\x25\x30\x9e\x52\x05\xb1\x1f\x57\x19\x5a\x13\x32\xb6\x73\xcb\x35\x4b\xd8\xaf\xe0\x4e\x13\x6b\xf7\x6e\x42\x9b\x1e\x02\x47\xb7\x21\x64\x4c\x22\x1a\x2d\xe0\x39\x6b\x36\x61\x8c\xfd\x54\x9b\x5f\xea\x63\xd3\xf0\xe3\xf4\xbe\x80\xed\xc4\x7d\xe0\xad\x16\x31\x93\xc8\x9c\x96\x44\x69\x21\x3d\x44\x33\x09\xe3\x88\x26\x51\x9e\x20\x2b\x3a\x3e\x3b\xb5\x23\x75\x5f\xa1\xd6\x41\x62\xe5\xa2\x07\xcc\xd8\x7f\xd2\x3e\xe7\x75\x2c\x40\xc1\x14\xed\x94\xbb\x4c\x3b\x85\x54\xc8\xe5\x05\x95\x73\xd8\x99\xb4\xdf\x54\xfa\x5a\x25\xec\x7f\x7f\xf5\xee\xcd\x8b\x37\xaf\x4f\xdf\x9c\x5e\x38\x7e\xed\x3d\x74\xab\x24\x3f\x29\xbd\x40\x44\x89\x99\x76\x53\x24\x09\x4b\x99\x2e\xbe\xb2\xb4\xd9\xac\x4a\x5b\x7e\x8e\x29\x85\x39\xd7\x2c\x05\xeb\x8e\xa3\x5a\x1b\x51\xc7\xd0\x4d\x0a\xa0\xf1\xce\xb6\x94\x5e\x82\x61\xba\x64\x9e\x53\x49\xb9\x06\x7f\x44\x30\x6d\x3f\x8a\x05\x51\xc2\x29\xf8\x4c\x95\xae\x3b\x05\xda\x26\x52\x9d\x89\x66\x56\x83\x3d\x2c\xe8\x95\xbd\x54\x6b\x26\x0c\x5f\x37\x9b\x9a\x8a\x98\xcd\x58\x64\x2d\x46\x24\xa5\x71\x91\xfc\xe3\x14\x0e\x90\xc5\xb1\x58\x2e\xb8\x8d\x2a\x57\xc1\x0c\xfc\x8a\x49\xc1\x51\x91\xba\xa2\x92\xd1\x69\x02\x85\x53\x52\x81\xb6\xe3\x95\x0b\xe2\x64\xba\xd4\xd0\xcc\xae\xec\x08\x6e\x37\xdc\x6d\x6c\xcd\xfd\x3d\x7a\xd4\xd8\xd1\x45\x99\xa6\x57\x4a\x31\xa6\x03\xe6\xf2\x37\x62\x50\xcc\x71\x45\x09\x71\x1e\x79\xd8\x09\x9d\x49\x66\xd5\x42\x5a\xa0\x8c\xe3\xd2\x54\x91\x34\x37\x47\xb8\x11\x8f\x94\x62\xd3\x04\x46\x46\x08\x62\xcd\xf9\x45\x65\x1f\x53\x30\x60\xc6\x9e\x50\x34\xb9\x02\x83\x70\x06\x91\xad\x0c\x0c\x60\x24\x24\x81\x37\xa3\x51\x2b\xe7\x78\x47\xae\x39\xa8\x23\xe7\xc6\x3f\x9d\x91\xa5\xc8\x65\xed\x5c\x58\x50\x83\xc8\x48\xbe\x8d\x13\x71\x39\x81\xc8\x84\x46\x24\x06\xa3\x51\x30\x6e\x8e\xa8\xb9\x10\xb1\x51\x2c\xa4\xb8\x61\x29\x8e\xe2\x28\xa0\xd8\xb6\xe9\x92\xc4\x22\xb7\x1e\x51\xc4\x13\x73\x16\xb8\x63\x2c\xa3\xd1\xa5\x99\x03\x76\xdc\x96\xcd\x79\xa8\xd3\xec\x10\xdf\x72\xff\x75\x5f\xaa\xc9\xcf\x4a\xf0\xd2\x15\x5e\x2c\x6b\xd2\x6f\x7b\x99\x22\x53\x50\x7a\x0c\xb3\x99\x90\xfa\xef\x66\x83\x73\x8e\x64\xc3\x45\x01\x41\x8f\x42\x18\xf7\x80\xe0\xc6\xb4\x9c\x3a\xdd\x0b\xb9\x81\x85\x54\x90\xaf\x89\x09\x66\x86\xe2\x25\x3f\x22\xff\x77\xff\x9f\x7f\xf9\x7d\x7c\xf0\xfd\xfe\xfe\x87\xa7\xe3\xbf\x7d\xfc\xcb\xfe\x3f\x27\xf8\x8f\x27\x07\xdf\x1f\xfc\xee\xff\xf8\xcb\xc1\xc1\xfe\xfe\x87\x1f\xde\xbc\xba\x38\x7b\xf1\x91\x1d\xfc\xfe\x81\xe7\xe9\xa5\xfd\xeb\xf7\xfd\x0f\xf0\xe2\x63\xcf\x4e\x0e\x0e\xbe\xff\xf7\x86\x09\x51\xbe\x7c\x37\x6b\x25\xe3\x5e\x19\xcd\xe3\x3e\x27\x52\x4d\xd8\x63\x5c\x8f\x85\x1c\xdb\x0f\x8e\x88\x96\xf9\x66\x21\xd7\x48\xc4\x5d\x4e\xe3\xbe\x27\xc2\xdb\x4a\x5f\x2b\xbe\x24\x77\xb1\xa1\x33\x64\x9a\xd9\x14\xbc\x3d\xb3\x72\xdf\xcc\x6c\xbb\x57\x08\x9a\x0f\xb9\xf3\x0d\x3d\xa2\xa4\xef\xbe\x7c\xac\x7c\x40\xc6\x4a\xff\x2b\x89\xc9\x96\xe7\xb7\x8d\xd5\x43\x7a\x1a\x66\x9c\xe9\xdc\xc2\x4c\x32\x21\x99\x5e\x9e\x24\x54\xa9\xb7\x34\x85\x5d\x37\xe4\x74\x56\x2a\x68\x23\x43\xd0\xe6\x04\x72\x47\xb4\x8b\x90\x71\x43\x36\x03\xfc\x74\x86\x1a\x4a\xa5\x1f\x0f\x54\xff\x6d\x41\x98\x9e\xc4\x85\x24\xbf\x82\x14\xee\x8a\x4b\x09\x56\xcb\x69\x1c\xc1\x7d\xd6\xbe\x0f\x2d\x60\x53\x10\xe5\x08\x36\x23\x21\xdd\x18\x5d\x63\xc6\xe6\xbb\x82\xee\x7c\x53\xa7\x24\xa2\xdc\x2c\x14\x2f\x6d\x9d\x91\x4f\x09\xcc\x69\xb4\xfc\x64\x16\xfc\x49\x82\x99\xa2\xd1\x0e\x3f\x59\xb5\xa1\xa6\x18\xb8\x60\x24\xa6\x08\x30\xbc\xc7\x97\xf1\x9f\xad\x2a\xe9\xf5\xf2\xc6\x99\x48\xac\xc9\x90\x89\x78\x62\xf6\x60\xb2\xb2\x5a\x64\xa1\xc5\xc3\x42\x98\xf8\xf0\xe4\xe3\xda\x9b\xce\xce\xa9\x85\x55\x37\xab\xc4\x21\x73\x64\xfb\x6d\x92\x8d\x07\x08\x39\x8e\x53\x86\xc6\x59\xb2\x7f\x76\x7e\x7c\x50\x5b\xb9\x91\x73\xec\x41\x1c\x0b\xf0\xe1\x40\x66\x20\x55\x9a\x59\xf1\x10\xc5\xb4\x4f\x4b\xc2\x98\xf7\xe9\xe7\x62\x00\x8c\x96\xd7\x96\x54\x67\x3f\xd9\xf3\x63\xf2\xc9\xc8\xc8\x09\xe3\x60\xf7\x20\x93\xec\x8a\x25\x30\x37\x33\xa9\x84\x38\x78\x67\xcd\xe6\x3d\x65\xca\x9c\x52\x75\xf4\x4e\x31\x6f\xd9\xa2\x75\x0b\xde\xba\x93\xdb\x45\x9b\x54\xec\x7e\x8f\x15\x4e\xcf\x4b\xc5\xa5\xc0\x50\x7b\x0b\xd1\x81\xcf\x84\x8c\xcc\x71\xbe\x01\x8e\xda\x25\xf6\x1b\xd0\xb4\x8b\x9c\x68\x18\x2a\xf4\x4b\xaa\x0c\xed\xd5\x3a\xbc\xa6\x95\xea\x09\x13\xf2\xce\x20\xe1\x35\x53\x30\x2a\xe4\xde\x8d\x5d\x78\x0c\xbf\xa6\xcd\x92\x62\xa5\xdb\x73\xfc\xe7\xd2\xfa\xa1\x9c\xa1\x06\xd1\x1d\x05\xa9\x26\x7a\x21\x12\x94\xe1\x1b\x8c\xdb\xaf\x58\x6c\x65\x1f\x90\x52\xc8\x89\x2d\x6f\x60\x35\x64\x91\xc4\x2d\xa7\x64\xa1\xa8\x1b\x99\x05\xcd\x50\x16\xbf\x38\x72\x30\x87\x36\x9b\xc1\xdc\x80\x1b\x75\x81\x55\x8b\x62\x09\x6d\x12\xd1\x1b\x81\x45\x11\x6c\xe5\x11\xb3\x0e\x3a\x15\xb9\xb6\x08\x61\xf9\xc7\x4c\xe4\x3c\x26\x86\x35\x1e\x91\x85\xd6\x99\x3a\x3a\x3c\x2c\xcf\xee\x09\x13\x87\xb1\x88\xd4\x61\x24\x78\x04\x99\x56\x87\x9e\x92\x0f\x33\x11\x8f\xfd\x1f\x63\xea\x09\xf1\xf0\xf1\xb6\xac\x93\x10\xe0\x79\xcb\x2d\xaf\x63\x62\xd7\xdb\xf2\x42\x09\xce\x8d\x2f\x69\x91\xb8\x50\xce\xc6\x93\xb1\x7e\xf7\x6f\xf9\x7e\x71\x37\x71\x21\xfb\x57\x58\xe9\x63\x55\xed\xba\xfd\xec\x68\xb3\x3a\x77\xd8\x99\xfb\x9b\x6d\x2f\x3c\x37\x35\xf2\x70\xb9\x0a\x94\x83\xb4\xa6\x78\x6d\xb1\x51\x99\xec\x13\xc3\x08\xf9\x92\x18\x66\xad\xdd\x1d\xda\xd6\x5c\xd9\xa6\xdd\x2f\x8c\xe4\x84\x95\x3d\xbe\x29\x5c\x72\x23\x98\xcd\x20\xd2\xdf\x55\x4c\x48\x45\x6d\x8a\xc2\xe5\xf5\x8d\xff\xd7\x77\xcd\xe7\x7c\x2f\xef\x54\xbf\xd0\x14\x3b\xa5\x76\xbb\xf8\x30\x7b\xf8\x0b\xec\x71\x45\x82\xb1\xc0\xb3\x83\xa1\x8a\x8f\x7e\x6b\x67\x64\xb5\x1e\x0b\x27\x19\x26\x49\xed\xe5\xce\xe0\x0c\xe4\x38\x95\x23\xc1\x99\x67\x4b\x4f\x21\x90\xb7\xc2\x15\xf9\x81\x11\x39\xc3\xab\xa4\xcb\x5f\xf0\x4c\x7e\x2b\x6c\xb9\x9f\x8e\x80\xd4\x9e\xc6\xdc\xce\xd8\x9e\x61\xf0\xfc\xa1\x0c\xf5\xb1\x80\xa9\x85\xfa\x94\x84\x55\xf5\x91\xb5\x02\xf6\x12\x96\x9d\x50\x75\xc7\x9f\x0b\x33\x42\x1f\xd4\xa8\xc4\x51\xaf\x1b\xd8\x28\x8a\xbf\xbb\x9a\x10\x22\x9d\x32\x6e\xa7\x62\x07\xf6\xfb\x8c\x63\xfb\xfd\xe0\x31\xfe\xd9\x3d\x89\x9e\xd0\xee\x17\x6f\x34\x0c\xe4\xef\x06\xc4\x12\x15\x5e\xe9\x2e\x90\x6e\x8a\x19\xaa\x04\x0a\xbd\xf8\x25\xa7\xc9\x84\x3c\xb7\x02\x36\x02\xcf\xfe\xd4\x45\x6e\xb6\x8b\x35\x5f\xfd\x35\x4b\xe2\x88\xca\x18\x75\x2b\xcb\x7e\x88\x12\x16\x71\xa8\x97\xdf\x3a\xfa\xf6\x0c\xb0\x44\x1e\x7b\xc9\x3b\xc9\xa8\xd4\x2c\xca\x13\x2a\x0d\xc3\x87\xb9\x90\x1d\x81\xf2\x3d\x37\xb3\xc4\xe6\x73\x88\x04\x8f\x3b\xbc\x8a\xc3\x76\xf5\x62\xb5\xf3\xea\xf6\xa2\xe4\x06\x92\xb9\x3a\x33\x2c\x85\x55\xf2\xda\xaf\xe9\xc5\x1d\x63\x89\x99\x67\x76\x05\x6f\x19\x59\xf1\xca\x08\x72\xd5\x72\x58\x4c\xf9\x34\x84\x83\xca\x81\x53\x50\xfb\x84\xfc\xd7\xd2\x6b\x5d\x5d\xe1\x49\x4c\x7b\x1f\x15\x1a\x72\xdc\x7c\x1d\x29\xba\x9d\x2c\xd9\xc8\x4c\x48\xb8\x02\x49\xf6\x63\x81\xdf\x60\x59\xab\x83\x09\xf9\x87\x51\x07\xdb\x5c\x34\xb6\x71\x98\xdb\xc2\x48\x8e\xb0\x8b\xec\x10\x09\x68\xbb\xa7\x8a\x3c\x25\xfb\xb6\x56\x16\x4b\x53\x88\x19\xd5\x90\x2c\x0f\xbc\xfc\x6d\x2d\x6b\x7d\xb0\xa6\x4f\x09\xb9\x4a\xe9\xb8\xaf\xff\xa3\xe5\x4d\x9c\xec\x6d\x22\xd5\x4f\xde\xe4\x5c\x02\xd6\xca\xd2\x2b\xd8\x53\x78\x38\x3b\x03\x18\x1a\xa3\xd5\x46\x25\xaf\xa9\x08\xbb\x9e\x37\x17\xb8\xf5\xb3\x41\x50\x4a\x24\xcc\x91\x3e\x2d\xcd\xed\x40\x9d\x2c\xda\x5c\x04\xaf\x43\x08\x69\xf7\x56\x8d\x89\xd1\x06\xbf\xfe\x8f\x98\x6a\xda\xf0\x82\x45\x99\x65\xb6\x89\xd4\xba\x64\x9b\xb2\xf3\xa6\xbd\xee\xe1\x7e\x71\xc3\x6f\xd5\x03\xaa\x35\x9b\xbe\xec\x83\x5d\xa7\x68\x9e\xb6\x71\x94\x1e\x0d\xc6\x12\xe6\x4c\x69\xb9\xac\x38\x21\x9c\x7b\x53\x10\xc6\x95\xa6\x5c\x33\x64\xd5\xc4\xbf\x39\x76\xf6\xf7\x6b\xa6\x1b\x42\x04\xdf\x19\xed\x1d\x8d\xbb\x98\x22\x64\xcd\x1f\x17\xcb\x0c\xc8\xb7\x95\x3f\x5e\xc9\x2c\xda\xfc\xfd\xe9\x8c\x38\x06\x6a\x71\x93\xc6\xb1\x04\xb5\xce\xd9\x36\x7d\xdd\x0a\x3e\x6f\xae\xda\x16\x82\x67\xde\xdc\xe5\xb2\x94\x94\x62\x73\xa3\xa4\xf8\xaa\x99\xde\x9f\x53\x53\x56\xcc\xaf\x6e\x60\xeb\xb5\x85\xb4\x38\x31\x99\xf6\xfa\x60\x24\xb8\xca\xd3\xd2\x8e\x10\x43\x06\x3c\x06\x1e\x2d\xb1\x50\x56\x72\x05\x0d\x21\x3e\x3f\xaa\x06\x94\x20\xe4\x7f\xb3\xb9\x51\xbc\xdd\xe4\xaa\x92\xb3\xf7\x5c\xaf\xcc\x94\x29\x03\xf8\x19\x48\xa3\xfe\x63\x56\x8f\x11\x7a\x7d\x0f\x15\x4f\xa4\xab\xdc\xe5\x03\x4e\x57\x27\x8b\xe5\x13\x37\x4f\xf7\xa2\xa8\xf9\xe9\x5d\x16\x1e\xa6\x96\x03\x19\x70\xcc\x85\xf5\xf4\x67\x42\x31\x5f\x24\xaf\x38\x17\x6a\x75\x43\xc5\xcc\x56\xf5\x6c\x1e\xab\x9e\x7e\x87\x41\xda\x2b\x8b\x46\xeb\x5b\xce\xed\x66\x42\xd5\xa6\xe9\x79\x61\x43\x65\xd2\x8b\xf5\xad\x2e\x22\x6c\x30\x67\xaf\xbe\xb4\xf2\x2c\x93\x94\x5f\x42\x4c\x12\xb8\x61\x91\x98\x4b\x9a\x2d\x58\x84\x25\x20\xad\xbb\xd7\x68\x8c\xda\x86\x57\x35\x63\x78\xd3\xe9\x95\xe5\xd3\x84\xa9\xc5\x66\xc7\x61\x2b\x71\x28\x88\x24\xe8\x8d\x9c\xaf\x0f\x6d\x9c\xdb\xcf\x4b\xe1\xc7\x07\xc3\xbb\x7e\x5d\x2e\x89\xc5\x76\x9f\xf1\x4a\xa3\xc8\x10\xb6\x77\x82\x82\x93\x04\x2b\x44\xd4\xc0\x21\xb4\xf7\x34\x99\x5e\x2e\x01\x32\x8b\xcf\x18\xc4\xa6\x52\xb4\x2e\x2a\xc6\x23\xc0\x92\x96\xae\x34\x29\x80\xf7\x02\x68\xc9\xc0\x4a\xb0\x80\x8e\x3f\xbf\x8b\xc0\xf5\x66\x89\xb3\xdd\x88\xd0\x62\x40\x68\x87\x78\xc1\x0b\x3b\x81\x5e\xe1\xa1\x5e\x28\x30\xff\x36\xe0\xc5\x27\x43\x37\xdb\x56\x30\x3d\xb7\x61\xe2\x5b\xf3\xc3\x1f\x6b\xbd\xb8\xf8\x2e\x45\x16\xe2\xda\x0d\xb0\xca\x31\x9c\x5d\xce\xa3\x41\xcc\x54\x64\xd8\x4c\x83\xe1\xe8\x44\x70\xe5\x2b\x96\x52\x6e\x8b\x8c\x5e\xd1\xc4\x65\xee\xba\xc1\x32\x91\xa0\x2b\x34\xce\xbd\xbe\x6a\xd3\x92\x20\x9d\x42\x1c\x43\xec\x63\xe1\x97\xa4\xe1\xd0\xef\x10\x38\xba\x64\x02\x7f\x2c\x9e\x89\x24\x69\x3f\xd3\x5b\x0d\x2b\x7d\xcc\x2a\x1e\x00\xbd\x63\x4d\x3a\xc4\xcc\x53\x0f\x50\xa6\x0a\x8a\x2c\x7d\xd1\x88\x64\x46\x61\x29\xe0\x3e\x05\x7d\x0d\xc0\x49\xb4\x80\xe8\x52\x95\xf1\x77\xda\xd0\xe1\xca\x46\xbb\xf8\xaa\x76\x01\xb1\xca\x41\x0b\xc1\xd4\x6c\xa8\xcb\xbe\x07\xc2\x8c\x5a\xc8\xe1\x7a\x35\x5e\x6b\xfd\xe0\xa2\x57\x94\x25\x74\x9a\x74\x28\xcc\xa7\xb3\xf2\xcd\x51\x75\xfe\xcc\x4b\x47\x59\x9e\x24\xce\x2f\x8d\x91\x2a\x5a\xd2\xd9\x8c\x45\x18\xc0\x88\x91\x3a\x65\xc4\xef\xc6\xa5\x6f\x15\x9d\xa3\x34\xd5\xf9\xda\xd6\xb7\xe0\x4d\x1b\xbe\x18\x2d\x94\x35\xda\x5b\xfb\x60\xc8\xfb\xba\x06\x6b\x66\x07\x56\x45\xaf\xb9\xb4\x26\xe4\xad\xd0\x2e\x12\xee\x0d\x28\xe5\xa2\xf0\xc8\x7b\xa0\x4a\xf0\xca\x51\x80\x9a\x87\x64\x73\xc6\xe9\xe6\xf2\x09\x76\xfd\x55\x93\x79\xa1\x68\xd2\x25\x96\x74\x66\x73\x49\x75\xc1\xc1\xcb\x25\xba\x43\xd3\x89\x05\xb3\x1c\xa3\xe1\xc8\x31\x5f\x22\xda\xb8\xf0\xb8\xcd\x36\x55\xc6\xb5\x14\x71\x1e\x81\x2b\x5e\x9d\xab\x6a\xc7\xb7\x7a\x0e\xf4\x23\xcb\x13\x3f\x78\x99\x83\x10\x83\xa6\xcc\xb9\xb2\x05\x07\x42\x55\x66\xd4\x7f\x4f\x06\xb9\x94\x78\xd4\xfa\x0d\xc2\x53\xf0\xf8\xec\x94\xbc\x87\x76\x6c\x1c\x8f\x9b\x26\x81\xd1\x1c\x4a\xcb\x3c\xc2\x43\xd6\x50\x3f\x8f\xdd\x71\x69\x09\xc0\x46\x53\x56\xf2\xb1\x9c\xd1\xd0\x4a\xc5\x19\xd5\x0b\x32\xb1\x1b\x3a\xa9\x80\x93\x90\x97\xe6\xc0\xbd\xa1\x69\x96\xc0\xa8\xd1\x79\xf2\x6f\x78\xb0\xbd\x14\xe2\xdc\xa2\x84\x9d\xc9\x6f\x4d\x6f\x9b\xff\x1c\x1e\xae\x22\xac\x98\x1a\x25\xc5\xf9\x10\x10\x6f\x67\x42\x3c\x56\x75\x78\x35\x81\xc6\xf7\xf9\x03\x06\x8a\x6e\x58\x09\xce\x90\x4a\x38\x22\x7b\xc7\x9e\x97\xec\x8d\xc8\xde\x99\x14\x73\xcc\x5a\xe1\x73\x97\x5b\xb2\xf7\x1c\xe6\x92\xc6\x10\xef\x75\x8c\xf5\x17\xcc\xb8\x7a\x03\x72\x0e\x3f\xc0\xf2\xdb\x86\xa3\x6a\xfd\x0b\x7f\xf6\x7e\x8b\x79\x5b\x5d\x9f\x18\xf1\xc8\xc8\x10\xdf\xa6\x34\xeb\xf3\xee\x1b\x9a\xf5\x99\xcd\x49\x49\x8c\x1f\x3e\xa6\xa0\xe9\xd5\xb3\x49\x89\xca\x9f\x7e\x56\x82\x1f\xed\x95\xf0\x1b\x89\x94\x61\x50\xde\x72\x8f\xd4\x16\x71\xb4\x87\xab\x70\xbf\x7a\x60\x1c\xed\x99\xf1\xf7\x0c\xc7\xd3\x62\x9a\xcf\x8e\xf6\x30\x6a\x6d\xf4\x6c\x24\x21\x1b\x19\x29\xf9\xdb\xb2\xef\xbd\x4f\xcd\x88\xe5\x56\x66\xbd\x91\x88\xab\x4d\xae\x96\x7f\xfb\xa3\x45\x98\x6b\x39\xc6\xbb\x42\x69\xc7\x24\xa1\x4a\x5f\x48\xca\x15\x4e\xf7\x82\xa5\x4d\x80\x1d\x93\xd4\x32\xd4\xc6\xe7\x12\x99\x6c\xe3\x63\x8b\xb6\x8d\x8f\x1b\xf7\xb4\x5b\x10\x59\x5f\xc3\x6d\x38\xcf\xd6\x7b\x2d\x33\x91\x8d\x98\xef\x4d\xa7\xc5\x5e\x9b\x83\xd9\xbd\x0d\xae\x5e\xbe\x61\x90\xee\x24\xc1\xb4\x32\xdc\xea\xb6\xf3\xd8\xf2\xba\xc2\xe8\x75\xed\x9d\xed\x39\x8f\x41\x26\xe8\xc4\x2e\xc7\x8b\x16\x46\xe7\x8c\x27\xce\x96\x46\x0b\xb3\x28\x46\x94\x3b\x57\x7d\xe9\x83\xb3\x31\xa8\xbe\x47\xc3\x93\xdd\x45\x05\xb6\x1b\x94\x59\xa2\x08\x32\xdd\x2e\xb4\xf4\x32\x71\x7b\x3b\xa5\x91\xb9\xc7\xba\x19\xab\x1c\x4e\xdd\xc6\x7e\xb9\xae\x6c\x90\xd7\x22\x4f\xa9\x39\xef\x69\x8c\x31\xa7\xc5\x33\x6b\x72\xb0\x26\x02\x7b\x8e\x59\x47\xb8\xf5\x63\xfa\xed\xeb\xdc\x21\x27\x03\xd0\xa2\xaa\x45\x87\xf1\xb1\x17\xcc\x52\x7a\xf3\x1a\xf8\x5c\x2f\x8e\xc8\x5f\xbf\xfa\x5f\x5f\xff\x67\xc3\x8b\xf6\x28\x81\xf8\x15\x70\x67\x74\xbd\x0d\xe8\xad\xf7\xba\xea\x35\x98\xf8\xac\x87\xc9\xbc\x7c\xa7\xf0\xcf\x95\x58\x89\x51\x1d\xa0\x9d\x18\x94\x67\xed\xe0\x7c\x89\x79\x3b\x4a\x53\x1e\xc1\xc8\x48\xd7\x1b\x87\x61\xc5\x49\x99\x2c\xc9\xb3\xaf\x46\x18\x35\x8d\x93\x5a\x3b\x0c\x3f\xdc\x7c\x9c\x6c\x58\x0c\x53\xe4\x6f\xa3\x95\x99\x32\x45\xcc\xde\x8b\x19\xa2\x69\xcb\x24\xd1\x8a\x22\xc1\x4a\x3a\xde\xa6\xb6\x2e\xe9\x40\xb1\x92\x2e\x4c\xe8\x32\xf5\xf7\x33\xf3\xa7\x8c\xb3\x34\x4f\x8f\xc8\xd3\x86\x57\x2c\x47\xbe\x0d\xf4\xb0\x3d\x95\x52\x20\x35\x6c\x79\x2e\x69\x9a\x62\x72\x23\x8b\x81\x6b\x36\x63\x18\x44\x56\x90\x18\x9a\xc5\xec\x87\x3e\xf0\xb1\x00\x3e\xc6\x44\x1a\x36\xda\x8b\xe8\xce\xac\x58\x2c\x51\x76\x72\x4e\xf0\xa8\xca\x79\x97\x19\x58\xaa\xb4\x5a\x38\x81\x9b\xcc\x2a\x46\x15\x77\x6c\x0a\x94\x33\x3e\x57\x65\xfc\x32\xf2\xbf\x36\x6f\x93\xf9\xec\x7a\x01\x2e\x5c\x08\xaa\xce\x76\x5f\x12\xcc\x68\x66\x65\xdc\x3e\xe6\x72\xb4\xb3\x8f\x75\xd7\x86\x51\x62\x52\x48\x4e\xa8\x82\x1e\x6e\x8c\x4a\x70\xb3\xbf\xbb\xa5\xc8\xc3\xbf\x35\x06\xf4\xec\xe9\x57\xad\x78\x57\xbc\xd7\xf8\x52\x19\xf6\xfc\xe1\x78\xfc\x0f\x3a\xfe\xf5\xe3\xbe\xfb\xc7\xd3\xf1\xdf\xfe\xdf\xe8\xe8\xe3\x93\xca\x9f\x1f\x9b\xa3\x95\x37\x2b\xa2\x65\xab\xe1\xb0\x3b\x6b\xbd\x32\xe2\xf1\x63\xe4\xa3\x23\x2f\x64\x0e\x23\xf2\x92\x26\x0a\x46\xe4\x47\x8e\xe7\xe4\x8e\x40\x6b\x0f\x56\x32\x92\xcd\x9e\x19\xb5\x49\xde\x76\xaf\xe0\x94\xda\xdf\x71\xd3\x6d\xb3\xe8\xdc\x02\xa1\x7b\x2b\x5e\x85\x4b\xf2\x0a\x7a\xda\x2c\xcb\x99\x10\x13\xa7\x37\x4d\x22\x91\x1e\x16\xcf\xdb\xf0\xb6\x59\xc1\x23\x58\x46\x96\x2f\x49\xc9\xc6\xad\x4a\xb3\x4a\x6e\x0a\x13\xf6\x68\x24\x85\x52\xe5\x75\x1d\x24\x61\x97\x40\x8e\x4b\x23\x8a\x39\x1c\xa6\x10\x51\xd4\x0a\xe5\x94\x69\x49\xad\x3f\xc9\x2b\x05\xd6\xda\xd7\x32\x9b\x5c\xc1\x2c\x4f\xc8\xbe\x02\x20\x13\x0c\xc8\x5e\x3b\x67\x0e\x9c\x2b\x68\xca\x12\x86\x09\x94\x24\x86\x48\xf0\x59\xc2\x9c\x9a\x9a\x66\x42\x6a\xca\x5b\xab\xa1\xd8\x14\xfe\x39\xdc\x10\x56\x44\x5b\x99\x8f\xf7\x63\xae\x9e\x3d\xfb\xea\xaf\xe7\xf9\x34\x16\x29\x65\xfc\x65\xaa\x0f\x0f\xbe\xdf\xff\x25\xa7\x09\xc6\xff\xbc\xa5\x29\xbc\x4c\xf5\xc1\xed\x49\x1c\xcf\xbe\xee\x41\xca\xfb\x1f\x2c\xc1\x7e\xdc\xff\x30\x76\xff\x7a\xe2\x7f\x3a\xf8\x7e\xff\x9f\x93\xd6\xe7\x07\x4f\x0e\x31\x71\xa1\xa0\xfb\x8f\x1f\xc6\x25\x0f\x98\x7c\x7c\x72\xf0\x7d\xe5\xd9\xc1\x26\x8e\xb0\x9e\x3c\x9a\xd2\x6c\x7c\xd9\x58\xa6\xb3\x51\xaf\x68\xca\x42\xdd\xa4\x88\xda\x10\xd4\x37\x34\x7b\x0f\x33\x90\xc0\xa3\x6e\xf3\xf8\xc9\xda\x27\x64\x3f\x36\xf2\x14\xe6\x1e\x1f\x78\x4d\x42\x16\x4f\x9d\x54\x51\x7c\xe7\x8f\xda\xe2\x8a\xbb\xd5\x78\xc3\x5a\x1c\xef\xa8\x94\xeb\x37\x18\x22\xcb\x5e\x87\x5b\x9b\xbb\xdc\xdb\x46\xdd\x6d\x79\x84\x31\xc5\x5b\x18\xb1\x8d\x6c\x60\x8d\xf9\x6d\xea\x5c\x0f\x24\xef\xa7\x88\xf0\x96\xc4\x86\xce\x41\x8a\x75\x6e\xdd\x83\x67\x65\x3f\x59\x9b\xf2\xd6\xfd\xe4\xac\x51\xd3\xef\x7b\x02\xfc\x78\xfa\xdc\xe2\x0c\x32\x60\x14\xef\x17\x22\x89\x15\xc9\x39\xfb\x25\x07\x72\xfa\xbc\xa8\xba\xc6\x78\x94\xe4\x78\x53\xdb\x8f\x3f\x9e\x3e\x57\x13\x42\xfe\xcb\x31\xdd\xeb\x96\x00\x75\xac\x6f\xfa\xee\xed\xeb\xff\x83\x46\x3b\xfc\xd2\x5d\x94\xe4\xab\x6e\x32\x6a\xad\xed\x56\x12\x32\xbd\xda\xd8\x6d\x9c\x51\x44\xb3\x66\xfb\x29\x71\x3e\x09\x6e\x53\x10\x16\x90\x64\x0a\x93\x2b\x89\xca\xa5\x5b\x8d\x19\xd0\xe6\x78\x61\xf9\x0d\x17\x14\xe4\xf3\x45\x31\x1f\x77\xab\xac\x8f\x48\x70\x0e\x11\x46\x5d\x19\x8d\xa0\x0f\x87\xa8\xbe\xbf\xaa\x6d\x6d\x54\x2f\x56\xd3\x37\xca\x31\x3d\xff\xf0\xce\x9f\xdb\x27\x74\x43\x91\xef\x9c\x5e\x85\x33\xde\x82\xaa\x5d\xdc\xc4\xd6\xf8\x6d\xe6\xe0\xe0\x76\xe7\x2c\x61\x6d\xbd\x5b\x8d\x68\x1d\x32\x18\xe8\xf2\xbe\xc3\x2f\x57\x0f\x39\x5f\x33\x33\xad\xe4\xf4\xa3\x73\xa8\x88\x95\x59\x50\x45\xa6\x00\x1c\x7d\x55\xd6\x27\x01\xdc\xe1\x3c\x94\x9e\xa4\x3c\x1b\x6b\x31\x6e\x50\x76\x3b\x20\xd7\x0d\xb5\x16\x5b\x4e\x6d\x6d\xc7\x83\xad\x33\xd7\x8b\xe5\x26\x18\xa8\xf2\x9e\xb6\x42\x6e\x1c\xba\xb0\x66\x15\xb9\x36\x67\xe7\x40\x2a\x8e\x6d\xfc\x6b\x7d\x4a\xd7\x86\x75\x55\xad\x80\x5a\x60\xe8\x44\xa7\x99\xbf\x63\x8e\x76\x9b\xcf\x41\x5e\xb1\x1e\xc2\xc7\xfb\xfa\xfb\xbd\x58\xcb\xab\xf7\x67\x27\x98\x7e\x6c\x3e\xf0\xbe\x57\xc4\xfe\xaa\x54\x31\x9c\xad\x74\xb1\x84\xc8\x86\x51\x1e\xdf\x3d\x41\x1b\x71\x7c\xeb\x41\xd0\xd6\x1f\x89\x0e\x87\x7a\x6b\x42\x20\x82\xb6\x2d\x83\x72\x48\x1f\x43\xe5\x0d\xcb\xc7\x6a\x39\xb7\x4a\x0b\x69\xc8\xb5\xf6\x5b\x3e\x2d\xd4\xaa\xb2\x77\xa7\x82\x93\xdf\xfe\x78\xf4\xff\x03\x00\x00\xff\xff\xe8\x3a\xde\x8e\x59\x5f\x01\x00") func operatorsCoreosCom_catalogsourcesYamlBytes() ([]byte, error) { return bindataRead( diff --git a/staging/api/pkg/operators/v1alpha1/catalogsource_types.go b/staging/api/pkg/operators/v1alpha1/catalogsource_types.go index e44261b5f6..dcc0aee44c 100644 --- a/staging/api/pkg/operators/v1alpha1/catalogsource_types.go +++ b/staging/api/pkg/operators/v1alpha1/catalogsource_types.go @@ -133,18 +133,15 @@ type GrpcPodConfig struct { // SecurityContextConfig can be one of `legacy` or `restricted`. The CatalogSource's pod is either injected with the // right pod.spec.securityContext and pod.spec.container[*].securityContext values to allow the pod to run in Pod // Security Admission (PSA) `restricted` mode, or doesn't set these values at all, in which case the pod can only be - // run in PSA `baseline` or `privileged` namespaces. Currently if the SecurityContextConfig is unspecified, the default - // value of `legacy` is used. Specifying a value other than `legacy` or `restricted` result in a validation error. - // When using older catalog images, which could not be run in `restricted` mode, the SecurityContextConfig should be - // set to `legacy`. - // - // In a future version will the default will be set to `restricted`, catalog maintainers should rebuild their catalogs - // with a version of opm that supports running catalogSource pods in `restricted` mode to prepare for these changes. + // run in PSA `baseline` or `privileged` namespaces. If the SecurityContextConfig is unspecified, the mode will be + // determined by the namespace's PSA configuration. If the namespace is enforcing `restricted` mode, then the pod + // will be configured as if `restricted` was specified. Otherwise, it will be configured as if `legacy` was + // specified. Specifying a value other than `legacy` or `restricted` result in a validation error. When using older + // catalog images, which can not run in `restricted` mode, the SecurityContextConfig should be set to `legacy`. // // More information about PSA can be found here: https://kubernetes.io/docs/concepts/security/pod-security-admission/' // +optional // +kubebuilder:validation:Enum=legacy;restricted - // +kubebuilder:default:=legacy SecurityContextConfig SecurityConfig `json:"securityContextConfig,omitempty"` // MemoryTarget configures the $GOMEMLIMIT value for the gRPC catalog Pod. This is a soft memory limit for the server, diff --git a/vendor/github.com/operator-framework/api/crds/operators.coreos.com_catalogsources.yaml b/vendor/github.com/operator-framework/api/crds/operators.coreos.com_catalogsources.yaml index f467ad49b7..bd7ad79f55 100644 --- a/vendor/github.com/operator-framework/api/crds/operators.coreos.com_catalogsources.yaml +++ b/vendor/github.com/operator-framework/api/crds/operators.coreos.com_catalogsources.yaml @@ -989,19 +989,15 @@ spec: SecurityContextConfig can be one of `legacy` or `restricted`. The CatalogSource's pod is either injected with the right pod.spec.securityContext and pod.spec.container[*].securityContext values to allow the pod to run in Pod Security Admission (PSA) `restricted` mode, or doesn't set these values at all, in which case the pod can only be - run in PSA `baseline` or `privileged` namespaces. Currently if the SecurityContextConfig is unspecified, the default - value of `legacy` is used. Specifying a value other than `legacy` or `restricted` result in a validation error. - When using older catalog images, which could not be run in `restricted` mode, the SecurityContextConfig should be - set to `legacy`. - - - In a future version will the default will be set to `restricted`, catalog maintainers should rebuild their catalogs - with a version of opm that supports running catalogSource pods in `restricted` mode to prepare for these changes. + run in PSA `baseline` or `privileged` namespaces. If the SecurityContextConfig is unspecified, the mode will be + determined by the namespace's PSA configuration. If the namespace is enforcing `restricted` mode, then the pod + will be configured as if `restricted` was specified. Otherwise, it will be configured as if `legacy` was + specified. Specifying a value other than `legacy` or `restricted` result in a validation error. When using older + catalog images, which can not run in `restricted` mode, the SecurityContextConfig should be set to `legacy`. More information about PSA can be found here: https://kubernetes.io/docs/concepts/security/pod-security-admission/' type: string - default: legacy enum: - legacy - restricted diff --git a/vendor/github.com/operator-framework/api/crds/zz_defs.go b/vendor/github.com/operator-framework/api/crds/zz_defs.go index 8d7b58d404..b3dc2a2492 100644 --- a/vendor/github.com/operator-framework/api/crds/zz_defs.go +++ b/vendor/github.com/operator-framework/api/crds/zz_defs.go @@ -85,7 +85,7 @@ func (fi bindataFileInfo) Sys() interface{} { return nil } -var _operatorsCoreosCom_catalogsourcesYaml = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\xec\x7d\x69\x73\xdb\xb8\x96\xe8\xe7\xc9\xaf\x40\xf9\x4d\x55\xac\x5c\x49\x4e\xfa\xde\xea\x37\xd7\xb7\x97\xf2\x38\xcb\x73\x75\x16\x57\xec\xee\xa9\x37\xb9\x79\x2f\x10\x79\x24\xa1\x4d\x02\x6c\x00\xb4\xad\x5e\xfe\xfb\x14\x0e\x00\x92\xa2\xc4\x4d\xde\x92\xbe\xc0\x87\xee\x58\x24\xb1\x1c\x9c\x73\x70\x76\xd0\x8c\xfd\x04\x52\x31\xc1\x0f\x09\xcd\x18\x5c\x6b\xe0\xe6\x2f\x35\xbd\xf8\x0f\x35\x65\xe2\xe0\xf2\xd9\xa3\x0b\xc6\xe3\x43\x72\x9c\x2b\x2d\xd2\xf7\xa0\x44\x2e\x23\x78\x0e\x73\xc6\x99\x66\x82\x3f\x4a\x41\xd3\x98\x6a\x7a\xf8\x88\x10\xca\xb9\xd0\xd4\xfc\xac\xcc\x9f\x84\x44\x82\x6b\x29\x92\x04\xe4\x64\x01\x7c\x7a\x91\xcf\x60\x96\xb3\x24\x06\x89\x9d\xfb\xa1\x2f\x9f\x4e\x9f\xfd\x6d\xfa\xf4\x11\x21\x9c\xa6\x70\x48\x22\xaa\x69\x22\x16\x76\x2c\x35\x15\x19\x48\xaa\x85\x54\xd3\x48\x48\x10\xe6\x7f\xe9\x23\x95\x41\x64\x06\x59\x48\x91\x67\x87\x64\xeb\x3b\xb6\x3f\x3f\x17\xaa\x61\x21\x24\xf3\x7f\x13\x32\x21\x22\x49\xf1\xdf\x6e\x8d\x76\xd8\x33\x1c\x16\x7f\x4f\x98\xd2\x3f\x6c\x3e\x7b\xcd\x94\xc6\xe7\x59\x92\x4b\x9a\xd4\x27\x8c\x8f\xd4\x52\x48\xfd\xb6\x1c\xde\x0c\x17\x51\xad\x64\x64\x1f\x33\xbe\xc8\x13\x2a\x6b\xdf\x3e\x22\x44\x45\x22\x83\x43\x82\x9f\x66\x34\x82\xf8\x11\x21\x0e\x52\xae\xab\x09\xa1\x71\x8c\xd0\xa7\xc9\xa9\x64\x5c\x83\x3c\x16\x49\x9e\xf2\x62\x28\xf3\x4e\x0c\x2a\x92\x2c\xd3\x08\xe1\xf3\x25\x90\x4c\x82\xd6\x2b\x04\x09\x11\x73\xa2\x97\xe0\xc7\x2e\xbe\x22\xe4\x67\x25\xf8\x29\xd5\xcb\x43\x32\x35\x10\x9e\xc6\x4c\x65\x09\x5d\x99\xd9\x54\xde\xb2\xdb\xf4\xdc\x3e\xab\xfc\xae\x57\x66\xea\x4a\x4b\xc6\x17\x6d\x53\x31\xef\xf5\x9f\x83\x05\xcd\xf9\x2a\xdb\x9c\x42\xed\xc7\xbe\xe3\x67\xf9\x2c\x61\x6a\x09\xb2\xff\x24\x8a\x4f\x36\xe6\x70\xba\xe5\x49\xc3\x44\x2a\x9d\x7a\xba\x99\x46\x12\x90\x64\xce\x59\x0a\x4a\xd3\x34\xdb\x18\xe0\x68\xb1\xb9\xc6\x98\x6a\xff\xa3\x7d\xe9\xf2\x19\x4d\xb2\x25\x7d\xe6\x7e\x54\xd1\x12\x52\x5a\xe2\x83\xc8\x80\x1f\x9d\x9e\xfc\xf4\xd7\xb3\xda\x03\xb2\x0e\x9d\x35\x3c\x27\x4c\x11\x4a\x24\x64\x42\x31\x2d\xe4\xca\x40\xeb\xf8\xec\x27\x35\x26\xc7\xef\x9f\xab\x31\xa1\x3c\x2e\x08\x8f\x64\x34\xba\xa0\x0b\x50\xd3\x8d\xb9\x8a\xd9\xcf\x10\xe9\xca\xcf\x12\x7e\xc9\x99\x84\xb8\x3a\x0b\x03\x1e\x0f\x93\xda\xcf\x06\xfe\x95\x9f\x32\x69\xc6\xd4\x15\x42\xb6\xad\xc2\xcc\xd6\x7e\xaf\xad\xf0\xf7\x49\xed\x29\x21\x06\x30\xf6\x4b\x12\x1b\xce\x06\x0a\x91\xc2\x51\x1d\xc4\x0e\x9a\x16\x59\x98\x32\x10\x91\xa0\x80\x5b\x5e\x67\x7e\xa6\xdc\xad\x72\xba\xd1\xf9\x19\x48\xd3\x91\x61\x08\x79\x12\x1b\x96\x78\x09\x52\x13\x09\x91\x58\x70\xf6\x6b\xd1\xbb\x22\x5a\xe0\xb0\x09\xd5\xa0\x34\x41\xba\xe6\x34\x21\x97\x34\xc9\x01\x81\xbd\xd1\x77\x4a\x57\x44\x82\x19\x97\xe4\xbc\xd2\x23\x7e\xa2\x36\xe7\xf2\x46\x48\x20\x8c\xcf\xc5\x21\x59\x6a\x9d\xa9\xc3\x83\x83\x05\xd3\x9e\xd9\x47\x22\x4d\x73\xce\xf4\xea\x00\xf9\x36\x9b\xe5\x86\xa1\x1e\xc4\x70\x09\xc9\x81\x62\x8b\x09\x95\xd1\x92\x69\x88\x74\x2e\xe1\x80\x66\x6c\x82\x8b\xe1\xc8\xf0\xa7\x69\xfc\xbf\x24\x54\x39\x60\x1d\x0d\x6a\xd4\x40\x3c\xdf\x1d\xb8\x59\x86\x1f\x5b\xc4\xb4\x1d\xda\xc5\x96\x7b\x62\x7e\x32\x60\x7c\xff\xe2\xec\x9c\xf8\x19\xd9\x7d\xb3\x5b\x54\xbe\xba\x05\x42\x7e\xb7\x0c\x64\x19\x9f\x83\xb4\x5f\xce\xa5\x48\xb1\x57\xe0\x71\x26\x18\xd7\x96\x6b\x24\x0c\xb8\x26\x2a\x9f\xa5\x4c\x2b\x44\x6b\x50\xda\x6c\xe4\x66\xc7\xc7\x78\x38\x92\x19\x90\x3c\x33\xc4\x1b\x6f\xbe\x72\xc2\xc9\x31\x4d\x21\x39\xa6\x0a\xee\x7d\xef\xcc\x1e\xa9\x89\xd9\x90\xde\xbb\x57\x3d\xfa\x37\x3f\xd8\xa0\x7a\x42\xfc\x99\xdd\xeb\xe5\x26\x36\x41\x2c\x4f\xd8\x76\x26\x90\x16\xee\x60\x1a\x8d\x63\x09\x6a\xcb\x83\x6e\xac\x33\xed\xc8\x7e\x6e\x91\x6f\x29\x94\x41\x02\xaa\xc9\xbb\xd7\x6f\x48\x44\x39\xc9\x15\x18\x12\x8e\x04\xe7\x06\xcb\xb4\x20\xd4\x9c\xb9\x13\xb8\x66\x0a\xb1\x52\xc2\x82\x29\x2d\x57\x9b\x7b\x6b\xda\x4b\x21\x53\xaa\x0f\xc9\x37\xfe\xb5\x09\x0e\x21\x24\x61\xd9\x77\x87\xdf\x64\x42\xea\xef\xb6\x7e\xf8\x8e\x27\x2b\x33\x78\x4c\xae\x96\xc0\xc9\x59\x01\x19\xf2\x6d\xe5\x8f\x57\x32\x8b\xb6\x0f\x7c\xb2\xe0\x42\xfa\xaf\x0d\x5a\x9f\xa4\x74\x01\x64\xce\x20\x41\x42\x53\xb0\x85\xab\xb5\xa0\x05\xb1\x82\xdf\x9c\x2d\xde\xd0\x6c\x57\x58\x1f\xfb\x0e\xcc\x0c\xcc\xa4\xaa\x62\x4b\xf9\x50\x0b\xa4\x28\xb3\x78\xf3\x4f\x1a\x5d\x10\xea\x06\x4f\x69\x36\x51\x48\xcd\x1d\x80\xef\x07\xbf\x63\xdf\xa9\xd9\x91\xf2\xe7\x13\xc7\xa5\x07\x43\xa8\x0a\x84\xc1\xdf\x96\x42\x59\x27\x7c\xdf\x6c\x3b\x53\x7b\x8c\xb1\x90\x59\x74\x2a\x62\xbb\xec\x5d\x77\xf1\x55\xb5\x13\x02\xd7\x99\x50\xa0\x48\xcc\xe6\x73\x90\x86\x73\x8a\x4b\x90\x92\xc5\xa0\xc8\x5c\x48\xdc\xda\x4c\xc4\xc8\x26\x8a\xad\x5e\x93\x47\x4e\xc5\x16\xb6\x49\x06\xd1\x00\x0a\x2d\x16\xc3\xbb\x70\x7b\x2b\x53\x22\x1d\x3c\xc6\x34\x3a\x47\xf5\x68\xb5\xfd\x69\x0d\x74\x47\xee\x65\x8f\xe8\x4e\x14\x75\x1c\xee\xb1\x32\x20\x79\xac\x8a\x3e\xb7\xaf\xbf\x73\xca\x7d\xa6\x6d\x1a\x17\x31\x1c\x75\x4c\x7f\x63\x09\xcf\xf1\x8f\x19\x28\xfc\xbc\x98\x2a\x0a\x36\x71\x9e\x20\xef\xcb\x93\xf5\x5d\x6e\x5a\x47\xcf\xb5\xf4\x5d\x8f\x7d\x0f\xe6\x20\x25\xc4\xcf\x73\x83\xea\x67\xc5\xac\x1c\xe7\xb3\x3f\xbf\xb8\x86\x28\x6f\x22\xc7\xc6\xa5\x37\x20\x7e\xb5\x19\x85\xc3\x41\x02\x24\xb9\x62\x49\xe2\x66\x64\x58\x96\x7f\x60\x40\x82\x12\xa0\x81\xa0\xb2\x07\x8b\xa2\x9a\xa9\xf9\xaa\x73\x00\x03\xd1\x02\xe6\x70\x6d\x84\x1b\xd4\x16\x91\x90\xd8\x9c\x41\x4c\x66\x2b\x27\xc7\x18\xa6\x3e\x26\xb3\x5c\x13\xa6\x51\xc8\x89\x96\x42\xa8\xfa\x21\xba\xd9\xa8\xdd\x5a\x9c\xd7\x25\x13\x28\xa3\x12\xc1\xc1\x70\xc3\xd4\x48\x26\x8e\x5e\x2b\xc3\x4f\x71\xe5\xe5\x67\xac\x2e\x58\x6c\xb6\xd4\x9c\x78\xc5\x76\x79\x8a\x30\xc3\x5c\x31\xbd\xc4\x3f\x16\x46\x5d\x32\xf2\xb1\xca\x53\x33\xe8\x15\xb0\xc5\x52\xab\x31\x61\xd3\x2d\x42\x53\xbd\x19\x04\x04\x1a\x2d\x2b\xd3\x4a\x01\xb4\x22\x34\x49\xfc\x12\xaa\x58\x6b\x25\x90\xd4\xc8\x8a\x64\xdf\x0b\x93\x9d\xa3\x38\x41\x70\x5c\x48\x30\x75\xc4\xdb\xba\x5d\x63\x02\x3a\x9a\x8e\xc6\x9d\xdd\x47\x22\xcd\x72\x0d\x46\x02\xce\x53\xb3\xb5\x4c\x1b\x1d\xcc\x0a\xbe\x52\xe4\x0b\x0b\x29\x48\xdc\xc4\xbd\xda\x62\x4f\x74\xc3\xff\x68\x1c\x6f\xe3\xf9\xf5\xb6\x67\x81\xbb\xe7\x35\x13\x33\x1c\xb3\x40\x42\xf8\xa5\x54\x47\x4b\xa7\x2c\x45\x42\x4a\x50\x99\xe0\xa6\x67\xfb\xe4\x45\xb9\xb6\x7f\x98\x77\x3a\xc7\x33\x9d\xee\xab\x51\xb9\xd9\x4b\xb6\x58\xfa\xbd\xa6\x12\xf0\xb7\x75\x1c\xe9\xda\x72\xcb\x4a\xa8\x94\xb4\x8b\x8e\x98\x86\xb4\x83\x91\x90\x1d\xa8\x9f\x90\x23\x4e\x20\xcd\xf4\xaa\x82\xd8\x15\x14\xd3\x20\xd3\x02\x90\x88\x85\xc8\xf6\x94\x05\x02\x4b\xb3\x84\x45\x4c\x3b\x34\x27\x4f\x7b\x8c\xb7\x6f\x28\x81\x30\x6d\x0e\x0d\xc2\xc5\x44\x64\xa3\x29\x39\x22\x3c\x2f\x18\x4f\xdb\x14\xb8\x28\x66\xe0\x3a\x32\xd3\x52\xa2\xec\xab\x9b\x1f\xf5\x63\xdf\xb6\x35\x0b\xf9\x9b\x6d\xe2\xe6\x0f\xbc\x07\x11\x9a\xd7\x2d\xd4\x3a\x5f\xed\x7b\x90\xf8\xb7\xfd\x1c\xfa\xbc\x5d\x3f\xed\x2d\xe5\x28\x48\x20\xd2\xe6\x34\x04\x99\x8e\x09\x55\x4a\x44\xcc\x68\x85\x25\xee\xaf\x13\x94\x5d\x49\x37\xec\xc9\x50\xf8\x93\xc1\xeb\x27\x68\x78\x58\xa7\xef\xbe\xdf\x6d\x40\x23\x61\x46\xc7\x99\xd7\xa0\xb2\xc6\x77\x67\x2b\x7c\xfa\x58\x91\x84\xce\x20\xd9\xa2\xb4\x37\xb5\xfe\xc4\x5f\xb6\x9e\x6c\xa0\x61\x41\xbd\x18\x42\xd9\xea\xd8\x50\x59\xb7\x33\x71\x14\x78\x62\x8e\x2a\xa3\xda\x53\xc6\x95\xb3\xef\x8c\x09\x25\x17\xb0\xb2\x76\x38\xca\x0b\x53\xdc\xa0\x29\x60\xc7\x12\xec\x81\x6e\xf0\xee\x02\x56\xd8\x61\x93\x0d\xa9\xa5\xab\xa1\x78\x67\xdb\x10\x0e\x50\xb6\x89\x99\xe8\xc0\x2f\x76\x00\xd0\x70\xd2\xb0\xed\x02\x5a\xc5\xe7\x6d\x6d\xc3\x4a\x8d\xe8\x8e\xfb\x81\x9b\x84\x27\xb0\xc7\x07\x9a\x65\x09\x83\xed\xa6\xa6\xf6\xd6\xaa\xf5\xb5\x35\x0f\xbd\x1b\xad\x6b\x20\x81\x98\xf6\xbe\x30\xd7\x59\x7c\x7f\xac\x2c\xbe\x1a\xbe\xb3\x64\x99\x35\xb4\x28\x40\x36\x32\x1c\x69\x6d\xfb\x89\x26\xac\xb4\x65\x2b\x14\x36\x4e\xf8\x98\xbc\x15\xda\xfc\xef\xc5\x35\x53\x46\xc6\x7c\x2e\x40\xbd\x15\x1a\xff\x9c\x92\x57\xda\x92\xde\xeb\x9e\x7c\xb9\x6c\x3b\xef\x81\x5d\xdf\x7d\xef\xc0\x11\xb7\x4c\xd4\x40\xb8\x6a\x74\x55\x53\x72\x62\xc5\xc1\xc2\x0b\xc0\x14\x39\xe1\x46\x29\xb0\x90\x1b\x3c\x14\xda\xdd\xb1\x6f\x37\x64\x9a\x2b\xb4\x9a\x72\xc1\x27\x28\x46\x6d\x1d\xd3\x6e\x90\x19\xb7\xba\x45\xb7\x38\x7c\xf3\xd0\xaf\xd0\x46\xf7\x5a\x8f\x2b\x1f\x0f\x1e\xb7\x32\xd8\x92\x5e\xa2\x68\xcf\xf8\x22\x29\x84\xf8\x31\xb9\x5a\xb2\x68\x69\xb5\xc7\x19\x58\xe7\x40\x26\xc1\x48\x0c\x54\x19\xe6\x6f\x7e\x59\x80\x1c\x8e\xfa\xe7\x46\x35\xb0\xe3\x5b\xd7\x46\x42\x23\x88\x49\x8c\x2a\x8b\xb5\xb2\x53\x0d\x0b\x16\x91\x14\xe4\x02\x48\x66\x8e\xfe\xdd\x10\x7e\xd8\x49\x6c\xdb\xe0\xf3\xb8\x3a\xe0\x20\x0a\x43\x99\xe6\xa5\xd1\x91\xee\x49\x9c\x41\x7d\x2c\x88\x33\x41\x9c\x09\xe2\x4c\x10\x67\x82\x38\xd3\xbb\x05\x71\xe6\xc6\xc3\x07\x71\xe6\x4f\x2e\xce\x5c\x4f\x2e\xf2\x19\x48\x0e\x1a\xd4\x24\xa5\xd9\xc4\x4d\x59\x8b\x94\x45\x3d\x7a\xb0\xf6\xa6\x1d\x0c\x5c\xff\x65\x0d\x95\x75\x8b\x16\x0a\x57\x3e\x34\x63\xdd\xb4\x65\x64\x86\x33\x77\x10\x9c\xa3\x39\x8c\x59\x3f\xb4\xa4\x7c\x01\xe4\xd9\xe4\xd9\xd3\xa7\x43\x0c\x5f\x0e\x75\x7a\x7d\x31\x77\x4e\x77\xc6\xf5\x5f\xbf\x6a\xfd\xa2\xc9\x94\x7f\x3f\x3e\x24\x47\xa8\x85\xdb\x60\x4d\xa2\x6c\x70\xf3\x20\xd7\xe7\x42\x93\x14\x34\xa1\xdd\x22\x4c\xd5\x22\xcc\x52\x18\x17\xfe\x58\xa4\x52\x17\xbc\xe2\xfd\x55\x31\x11\xdc\x79\x05\xcc\xfe\x75\xef\xcf\x4e\x2b\x88\x80\xda\xa0\x8a\x19\x98\x55\x74\x7b\xa9\x34\x51\x22\x35\xb3\x66\x5c\x7b\x9a\x37\x4b\x00\xbf\x31\x64\x1f\xa6\x8b\x29\x89\x73\xec\x96\x72\x17\x8d\x33\xb2\xab\x55\x2b\xa5\x21\xed\x76\x53\x99\xb3\x43\xe2\xff\x0c\x58\xb4\x5c\x99\xce\xe0\x12\xb8\xce\x69\x92\xac\x08\x5c\xb2\x48\x17\xf0\xc3\xe0\x21\xa6\x55\x2f\x48\x0d\x90\x3a\xfb\x4b\x9a\x93\x0d\x22\xeb\xe2\xe9\x43\x04\xc5\x8d\xbe\xfb\xb0\x8d\x35\x0a\x78\xef\x56\x32\x6d\x54\xa1\xb4\xe9\xd7\x7a\x14\xf1\x9f\x88\xdc\xef\xde\x77\x3b\x80\xc8\x60\x76\x3d\x80\x45\xef\x26\x89\x38\x5f\x8c\x90\xce\x2f\xb4\xb9\xd2\x2d\xde\x18\xbb\xf6\x35\xaa\x11\xf3\x9e\x03\xea\x25\x58\xff\xd9\xd1\xdb\xe7\xfd\x20\x46\x9c\xdf\xfa\x5c\x64\x22\x11\x8b\x55\x75\x7b\x6d\xf4\x2e\x4b\x33\xef\x5f\xa4\x44\xe5\x33\x27\xb1\x1a\x9c\x7f\x5b\xc3\x87\xe0\xb5\x08\x5e\x8b\xa0\xe6\x63\x0b\x6a\x7e\x50\xf3\x83\x9a\xdf\xaf\x05\x35\xff\xc6\xc3\x07\x35\xff\x4f\xae\xe6\x07\xaf\xc5\x96\x05\x05\x71\x26\x88\x33\xd8\x82\x38\xb3\x7d\x5d\x41\x9c\x21\x41\x9c\x69\x69\x41\x9c\x09\xe2\xcc\x5a\xfb\x12\xbc\x16\xbb\x7d\x9b\x89\xf8\x06\xe9\x2e\x99\x88\x5b\xb2\x5d\xac\xa9\x39\x12\x93\x44\x44\x54\xbb\x1c\x54\xf3\x89\xf3\x6f\x28\x9a\x5a\xeb\xf9\x98\xfc\x2a\x38\xd8\xf8\x7f\x83\x49\x68\xc3\x16\x7a\x09\xd2\xbc\xbe\xaf\x46\xad\x41\xd7\x21\x5b\x26\x64\xcb\x84\x6c\x99\xc6\xf6\xd9\x64\xcb\x2c\xa9\xb2\x78\x6b\x4f\x91\xe6\xe4\x99\x0a\x4f\x3a\x07\x99\xfe\x49\x73\x67\x0c\xba\x3b\x74\xc4\x0a\x0a\x25\x4a\x59\xc8\xc4\xce\x95\x0c\xf1\xe9\x3a\x3c\x9c\x06\x8a\x8b\xa2\x71\x0c\x31\xc9\x40\x4e\x2c\x8a\x0a\x32\x67\x3c\xde\xb2\x56\x0f\x9f\x6e\xf6\x70\x87\xc9\x2b\xeb\xeb\xe8\xf5\xcd\xdd\x64\xb0\xac\x4f\x64\x07\x5f\x57\xd5\x61\xb7\x76\x08\x7e\x16\xf9\x2c\x43\x95\xd9\x09\xd1\xce\xcf\xf5\x43\x4f\x75\x76\xb8\x46\x8a\x7a\xa4\xf7\x8a\xed\x68\xa9\x19\xa4\x35\x1c\x39\xd5\xf5\x97\x1c\xe4\x0a\x33\xad\x4b\x0d\xad\x28\xd4\xe1\x62\x2d\x98\x22\x11\x55\xf6\x58\x1d\x22\x55\x9e\xcc\x6d\x9e\x19\xcf\x93\x64\x6c\xfb\xa9\x13\xab\x67\x73\x88\x07\x5c\x98\xe7\x83\x8d\x47\x03\xad\x19\xbb\x99\x0b\x76\x77\x0e\x92\xfa\x3e\xd5\xbb\xb2\x66\x24\x6f\x65\xb3\xdb\xb2\xd5\xcc\xb6\xc5\xc9\x3b\xd8\x6d\x6b\xdb\xae\xb2\xfe\x4e\x92\xfe\x8d\x55\xdb\x16\x98\xdc\xc0\x04\x87\x2f\x0f\x9e\xcc\xed\x98\xe1\xc8\xee\xa6\x38\xb2\xb3\x39\x8e\xec\x64\x92\x23\xbb\x9a\xe5\xc8\x0d\x4c\x73\x64\x37\xf3\x1c\xa9\x63\x9b\xd9\x21\x27\xf8\xde\x8d\xa5\x8e\xdc\xc4\x52\x44\x6e\x60\xb1\x23\xb7\x40\x58\xd5\xf1\x2b\x65\x8f\xee\xce\x84\x47\xfa\x9a\xf1\x90\xac\xd6\x2c\x79\xf7\xbd\x2f\xbb\x59\xf1\xc8\x2d\xed\x8a\xb3\x6f\x31\x34\x1b\xdd\x97\x5d\x8f\x3c\xbc\x6d\xaf\x75\x0a\x6e\xf8\xde\xc6\xb0\x9d\x46\xbf\x81\x01\x8d\xdc\xc8\x88\x46\x76\x37\xa4\x91\xdd\x91\x1d\x65\x91\xd7\x18\x82\x74\x03\x89\x66\x30\x96\x57\x86\xb5\x27\x38\x56\x4e\x9a\x93\xdf\xcc\x41\x8d\x9b\xff\x07\xc9\x28\x93\xca\x68\x10\xce\xcc\x5a\x7d\xe6\x4c\x64\x95\x6e\x06\x4f\x00\x4b\x47\x99\x73\xf4\x92\x26\x46\x90\xb0\xf1\x9e\x4e\xcf\x37\x73\xa9\x8b\x69\x63\x72\xb5\x14\xca\x9e\xfa\x45\xf5\xab\xbd\x0b\x58\xed\x8d\x7b\xa9\xe0\xeb\xad\x4a\x3d\x7b\x27\x7c\xcf\x8a\x27\x1b\xb8\x5f\xc8\x32\x82\x27\x2b\xb2\x87\xcf\xf6\x6e\x5b\x0e\xdc\x41\x06\xa9\x96\x18\xdd\xf5\x88\xdf\x09\x65\x6f\x1a\xb9\x4e\xd6\xb0\xef\x07\x58\xed\xea\x17\x1f\x84\xf3\x6f\xd6\x46\xf4\x42\x2b\xa2\x99\xd1\x8f\x0b\xd9\x04\xad\x96\x56\x2c\x71\x76\x20\x6b\x12\x62\x49\x32\x60\xb4\x19\x10\x4d\x2f\x00\x1d\x0e\x58\x71\x4e\xb1\x18\x8d\x5a\x82\x5b\xd4\xc1\x91\x0c\xca\xf8\xd2\x68\x89\x10\x17\x79\xe6\x51\xcf\x97\x33\x1c\x30\x24\xe3\x91\x48\x7d\x38\xb5\x0d\x69\x34\x54\xe1\xe8\x65\x62\x8b\x30\xda\xdf\x71\x60\x64\xb3\x4e\xfd\xff\xf4\xba\xaa\xfc\x7e\x22\x54\x91\x4f\x28\xb8\x71\xb2\x8f\x1f\x8e\x3e\x0d\xf1\x70\x17\x00\xb4\x16\x4e\x91\x23\x67\x29\xca\xec\x55\x6c\x6c\x05\x6c\xdb\x20\x36\x60\x68\x5f\xbf\xaa\x0a\x0c\x5b\xa1\x8b\xec\x53\xae\xd9\xa8\x2c\xd3\x45\x10\x0f\x50\x12\x8d\x05\x7f\xac\xed\xfc\x3c\x5f\xf3\x1d\x0c\x71\x82\x17\x70\x2f\x1d\x50\xd6\x22\x6f\xb7\x3c\x86\x39\xcd\x13\xed\xca\x61\x1a\xd6\x87\xa7\xe9\x80\x11\xce\xbd\x4f\xc2\x09\xd5\x73\x21\x67\x2c\x8e\x81\x63\x74\xbb\x9f\xfe\x4c\xe8\x65\x1d\xdd\xd1\x01\x5b\xdd\xe3\x21\xc3\x1e\x25\x4a\x8c\xeb\x3d\x46\x45\xb9\x4c\x43\x45\x58\xd4\x6d\x6d\x00\xc2\x94\x01\x6a\x43\xfd\xb6\xe6\x15\xb2\x42\xe6\x4a\xb2\x25\xad\x18\x79\x1d\xb3\x55\x04\x38\x9d\xa1\xd5\x79\x7d\x46\x27\xbc\x62\xd9\x20\x73\xa0\x3a\x97\x40\x16\x54\xf7\xb0\xa3\xfb\x76\x2f\xa1\x30\x37\x67\xba\x09\x53\x7a\x27\xae\xcb\xd4\x03\x30\xde\xfa\xa0\x81\xf7\xf6\xe2\xbd\x5c\xe8\xc0\x7e\xbf\x58\xf6\xbb\x81\xf4\xb7\xc1\x81\x37\x3a\x0d\x4c\xd8\xb5\x2f\x88\x09\x73\x7f\x6f\xc0\x03\xfb\x1a\xac\xf9\xcd\x86\x95\xfa\x29\xa9\xd2\x32\x87\x59\x4e\xbb\x59\xe5\x7c\x0e\x18\xe2\x10\xf6\x10\x7b\x97\x6b\xce\x5d\x3d\x76\x5f\x31\xd8\x0d\x6b\x19\x56\xdd\xb3\x3f\x60\x4c\xaf\xba\x09\x0e\x0a\x0d\xf9\x50\x44\x71\x54\x86\xc1\x5e\x87\x2c\x05\xf3\xc0\x4a\x23\x25\x8f\xeb\x99\x61\x65\xdf\xe8\x3d\x48\x81\x72\x45\xf6\x7c\x20\xc9\x63\x55\xbe\xb1\x37\x88\xe0\x7d\x49\xc2\x62\xec\xfd\xdf\xfe\x18\xad\x95\x21\x2c\x87\x0e\xde\x9a\xe0\xad\xa9\xb6\xe0\xad\xd9\x9c\x44\xf0\xd6\x34\xb5\xe0\xad\xd9\x69\xfc\xe0\xad\x59\x6f\xc1\x5b\x13\xbc\x35\xc1\x5b\xd3\xdc\x82\xb7\x26\x78\x6b\xbe\x54\x6f\x4d\xa9\x6a\xdc\x87\xae\x5a\x55\x0b\x5d\xc4\xb7\xbd\x4c\x8a\x6a\x16\x95\xa9\x90\xfe\x2d\xfb\xaf\x87\x52\x5c\xab\xaa\xe6\x4d\xd5\xd6\xaa\x12\xbc\x61\x25\x18\xac\xb5\x36\xea\xa8\x85\x16\xbb\x31\xc6\x2d\xa9\xaf\x9f\xab\x01\xa7\x12\x43\x7a\x1f\x78\x7c\xee\xb3\x49\xdc\xc5\x72\x33\x28\x53\x4d\x62\xb2\xef\x2d\xa1\x23\xb3\x53\x5c\xe8\xf5\x87\x5c\xb3\x49\xf9\x46\x11\xa3\x8b\x06\x5b\x5f\xaa\x6b\x08\xb4\xbc\x40\x5f\x5a\x06\x5d\x8a\x4b\x91\x53\x51\xa2\x89\x61\xdc\x20\xd7\x66\xcb\x94\xbb\x78\x0f\x13\xa9\x64\xce\xb9\x91\x1d\x04\x77\x89\x14\x03\x66\x62\xcf\x04\x6b\x84\x75\xe4\x64\x35\x0d\x5c\x23\xaa\x1b\xe5\x36\x55\x62\xf0\xa9\xb6\xd7\xf8\xb9\x6a\x3c\x82\x3b\x13\xb6\xf9\xc5\xf6\x33\x60\x12\x05\xa5\x21\x3c\x59\xb1\xa2\x21\x44\xf6\x02\x89\xab\x3a\x59\xa6\x70\x1f\x69\x92\x88\xab\x21\x07\xcb\x40\x54\xde\xb9\xf2\x5b\x6f\xec\xbd\x1a\x5c\x22\xae\x16\xb0\xde\x57\x90\x0d\x75\xe4\xea\x2d\xd4\x91\xbb\x9b\x3a\x72\x15\x47\x63\xb5\xa0\x5c\x37\xac\xb0\xe0\xdc\x9d\x16\x94\x23\xe4\xbf\xdc\xc5\x7e\x12\xac\x77\x30\x4f\x34\xcb\xca\xb4\x56\x65\x77\x28\xb1\x2a\xe3\xdc\xe5\xd4\xad\x13\xa0\x99\x0d\x8d\x96\x9d\x43\xd5\x08\x15\xc7\xc3\x34\x59\x85\x0c\xd1\xe6\x9d\xa1\x7d\xd9\x56\x71\xf3\xba\xa4\x4d\xde\x63\x0f\x9d\x93\xd4\x8b\x85\x3d\x77\x57\xc4\x56\x9d\xcc\x8a\xec\x9b\x03\x2e\x59\x39\xb7\xec\x1a\x2f\x5b\x3b\x19\x7b\x0c\x60\xed\x3c\x97\xe0\x85\xc3\x05\xbb\x04\x5e\x1e\xa0\xfb\x6a\x34\xf2\xf2\x68\x5d\x04\xe8\xd1\xfb\x4d\x84\x84\x3e\x8c\x77\xe8\xe1\x5e\x3b\xb2\x7b\x8c\xb0\xe5\x50\xff\xa6\x72\x50\x7e\xd7\x7d\xac\xf7\x18\xc4\x92\xb4\x4f\x72\xac\x6c\x74\x79\x9c\x77\xf6\x72\x87\xb9\x64\x43\x12\x96\x86\x59\x7d\x77\x48\x54\xda\xb5\x0c\xe2\xdd\x26\x28\xdd\x69\x72\xd2\x97\x53\xad\xf0\x81\xdd\x5b\x5f\x40\xf9\x9f\xcf\xc4\x9d\x15\xea\xff\x34\xb5\x87\xaa\xff\x73\xe7\xee\xaa\x2f\xae\x0c\xd0\xbd\xba\xa7\xee\xc7\x35\xf5\x85\x95\x01\x7a\x10\x57\xd4\x67\x5e\x10\xe8\xee\x5c\x50\x7f\xea\x6a\x3b\x3b\xba\x9b\x76\xc7\xe0\x07\x75\x33\x3d\xa8\x8b\xe9\xe1\xdd\x4b\x3b\xc9\x05\x37\x75\x2b\xdd\xfb\xb5\x15\xbb\xc4\x9f\xef\x86\xcf\xf7\x97\xf0\x73\xcf\x01\xe7\x9f\x47\xa2\xcf\x03\x45\x99\x3f\x54\x84\xf9\xdd\x46\x97\x3f\x40\x62\xcf\x3d\x25\xf5\x3c\x60\x2c\xf9\xd0\xf3\x7d\xd0\xa9\x7e\x33\xc6\xb9\x4b\xec\xf8\x8e\xc9\x3b\x3b\x32\xcf\xfb\x4c\xda\xf9\x13\xf0\xcf\x9d\x92\x75\x02\x0b\x7d\x20\x16\x7a\x7b\xc9\x39\xf7\x97\x98\x13\x18\xa9\x6b\x37\x66\xa4\x3b\x26\xe0\xdc\x9a\x0d\xfd\x6e\x12\x6f\xee\x3b\xe9\xe6\x0e\x12\x6e\x1e\x22\xd9\xe6\x0e\x12\x6d\x82\xe7\xa1\x67\x0b\x9e\x87\xbe\x2d\x78\x1e\x9a\x5a\xf0\x3c\xd4\x5b\xf0\x3c\x04\xcf\x43\xf0\x3c\x04\xcf\xc3\xe6\x80\xc1\xf3\xd0\x38\x78\xf0\x3c\xfc\xe9\x3d\x0f\x43\x93\x58\x76\xc3\xe5\x87\x49\x5e\xb9\xdf\xc4\x95\xdb\x4f\x5a\x79\xc0\x84\x95\xcf\xc9\xb8\x31\x38\x41\x65\x37\x1c\xfd\x5c\x12\x53\x3e\x8f\xa4\x94\x07\x4f\x48\xb9\x69\x32\xca\xed\x24\xa2\xf4\x42\xd5\x4c\xc4\x47\x5c\xb3\x9b\x5e\xc8\x53\xc5\xa1\xa6\x5b\x79\xe8\xa5\x60\x31\xc9\x72\xed\x2e\x02\x09\x37\xf3\x74\x6e\xe3\xfd\xdc\xcc\xb3\xb6\x79\xe1\x7a\x9e\xb6\xf6\xd9\x5c\xcf\xd3\xb4\x67\xe1\x8e\x9e\xf5\x16\xee\xe8\x09\x77\xf4\x84\x3b\x7a\x6c\x0b\x77\xf4\x84\x3b\x7a\x42\xd5\xb7\x50\xf5\x2d\x54\x7d\xeb\xff\x55\xa8\xfa\xd6\xdc\x42\xd5\xb7\x21\x2d\x54\x7d\xeb\x3d\x7a\xa8\xfa\x16\xaa\xbe\x0d\x1b\x38\x54\x7d\xeb\x3d\x81\x50\xf5\xed\x5f\xb6\xea\x5b\xb8\xa3\xe7\x8b\xb8\x27\x22\x5c\x12\x31\x24\x5c\xec\xb3\xba\x24\x22\xdc\xd1\x13\xae\x87\xa8\xb7\x70\x47\xcf\x17\xc4\x7b\xc3\x1d\x3d\x5f\x32\xfb\x0d\x77\xf4\x04\x26\xbc\xbd\x85\x3b\x7a\xc2\x1d\x3d\x9d\x2d\xdc\xd1\x13\xbc\x35\xc1\x5b\xb3\xde\x82\xb7\xa6\xbd\x05\x6f\x4d\x57\x0b\xde\x9a\xd6\x16\xbc\x35\xc3\x5b\xf0\xd6\x04\x6f\x4d\xaf\x16\xbc\x35\xc1\x5b\xf3\xa5\x7a\x6b\xc2\x1d\x3d\xe1\x8e\x9e\x70\x47\x4f\xb8\xa3\x27\xdc\xd1\x53\x69\xe1\x8e\x9e\x70\x47\xcf\xdd\xdd\xd1\xb3\x96\x55\xf3\xe5\x5e\xd4\x33\x7c\x19\xe1\xb6\x9e\x70\x5b\x4f\x43\x0b\xb7\xf5\x84\xdb\x7a\xb6\xb5\x70\x5b\x4f\xb8\xad\xa7\xa5\x85\x9a\x79\x3d\x5b\xa8\x99\xd7\xb7\x85\x9a\x79\x4d\x2d\xd4\xcc\xab\xb7\x50\x33\x2f\xd4\xcc\x0b\x35\xf3\x42\xcd\xbc\xcd\x01\x43\xcd\xbc\xc6\xc1\x43\xcd\xbc\x3f\x7d\xcd\xbc\x70\x5b\xcf\x67\x79\xdb\x44\xb8\x6a\xa2\xa3\x7d\x3e\x57\x4d\x84\xdb\x7a\xfe\x35\x2f\x99\x08\xb7\xf5\x7c\xc6\xfc\x33\xdc\xd6\xd3\xdd\x3e\x1f\x16\x1a\x6e\xeb\xf9\x57\x66\xa4\xe1\xb6\x9e\x70\x5b\x4f\xd1\xc2\x6d\x3d\xc1\xf3\xd0\xd8\x82\xe7\x81\x04\xcf\x43\xd1\x82\xe7\xa1\xd7\xb8\xc1\xf3\x10\x3c\x0f\xc1\xf3\xd0\x3e\xe9\xe0\x79\x68\x19\x2e\x78\x1e\x82\xe7\x61\x4b\x0b\xb7\xf5\x34\xb7\x70\x5b\x4f\xb8\xad\x27\xdc\xd6\x13\x6e\xeb\xb9\xcb\xdb\x7a\xe0\x5a\x4b\x1a\xe9\x63\xc1\x35\xf0\xc6\x44\x94\xbe\x18\xf9\x62\xad\x37\x73\xba\xcd\xd9\x22\x97\x4e\xc7\x5d\xbc\x3f\x3d\x26\x11\xd5\x34\x11\x0b\x72\x2a\x62\x6b\xc3\xc5\x2f\x8a\x9f\x53\xd0\x34\xa6\x9a\x16\xe6\x7f\xa3\x0b\x5e\xb2\x18\x99\x5a\x0c\xd7\x84\xa5\x74\x01\x86\x79\x34\x4e\x22\x57\x40\x28\xb9\x82\x24\x99\x5c\x70\x71\xc5\xc9\x25\x48\x55\x61\x97\x9f\x44\x96\x7e\x22\x0a\xe4\xa5\xbd\xf1\x06\xae\x33\x83\x2b\x4c\xdb\x73\xd7\xcf\xa4\x3a\x5c\x19\xf6\x7d\x6c\x9f\x9e\x61\x98\x6c\xdb\xe5\x31\xc5\xda\x71\x99\x66\x4e\x4f\x8c\x10\xfb\xc4\xd0\x65\xae\x7c\x8c\xfa\x9c\x25\x30\x99\x51\x05\xb1\x1f\x57\x19\x72\x11\x32\xb6\x73\xcb\x35\x4b\xd8\xaf\xe0\xb8\xb9\xb5\xf1\x36\xed\x7c\x8f\x03\xbf\x5b\xe9\x9f\x90\x88\x46\x4b\x78\xce\x9a\xd5\xf5\x89\x9f\x6a\xf3\x4b\x7d\xf4\x77\x3f\x4e\xef\xcb\xa1\x8e\xdd\x07\x5e\x43\x8f\x99\x44\xfe\xb2\x22\x4a\x0b\xe9\x21\x9a\x49\x98\x44\x34\x89\xf2\x04\xb9\xc9\xd1\xe9\x89\x1d\xa9\xfb\x7a\xa7\x0e\x86\x5e\x2e\x7a\xc0\x8c\xfd\x27\xed\x73\xde\xc4\x02\x14\x0c\xd1\x26\x77\x93\x69\xa7\x90\x0a\xb9\x3a\xa7\x72\x01\x37\x26\xed\x37\x95\xbe\xea\x84\xfd\xef\xaf\xde\xbd\x79\xf1\xe6\xf5\xc9\x9b\x93\x73\xc7\x72\xbd\x37\xaa\x4e\xf2\xd3\xd2\xe3\x41\x94\x98\x6b\x37\x45\x92\xb0\x94\xe9\xe2\x2b\x4b\x9b\xcd\x6a\xa3\x65\xc9\x98\x6d\x96\x73\xcd\x52\xb0\xae\x27\xaa\xb5\x11\x35\x0c\xdd\xa4\x00\x1a\xef\x93\x4a\xe9\x05\x18\xbe\x49\x16\x39\x95\x94\x6b\xf0\x5c\x9e\x69\xfb\x51\x2c\x88\x12\x4e\x99\x65\xaa\x74\x53\x29\xd0\x36\x41\xe7\x54\x34\xb3\x1a\xec\x61\x49\x2f\xed\x85\x3f\x73\x61\x58\xb3\xd9\xd4\x54\xc4\x6c\xce\x22\x6b\x1d\x21\x29\x8d\x8b\xa4\x12\x27\xf0\x83\x2c\x4e\xb6\x72\xc1\x6d\x54\x59\x07\x33\xf0\x4b\x26\x05\x47\x45\xe6\x92\x4a\x46\x67\x09\x14\x0e\x38\x05\xda\x8e\x57\x2e\x88\x93\xd9\x4a\x43\x33\xbb\xb2\x23\xb8\xdd\x70\x37\x45\x35\xf7\xf7\xe8\x51\x63\x47\xe7\x65\xfa\x57\x29\x88\x98\x0e\x98\xcb\x0b\x88\x41\x31\xc7\x15\x25\xc4\x79\xe4\x61\x27\x74\x26\x99\x55\xcb\x68\x81\x32\x8e\x4b\x53\x45\xd2\xdc\x9c\xc2\x46\xc2\x51\x8a\xcd\x12\x18\x1b\x39\x86\x35\xe7\xad\x94\x7d\xcc\xc0\x80\x19\x7b\x42\xe9\xe2\x12\x0c\xc2\x19\x44\xb6\x32\x28\x80\x11\x72\x04\xde\xda\x44\xad\xa8\xe2\x9d\x96\xe6\xac\x8d\x9c\xcb\xfa\x64\x4e\x56\x22\x97\x6b\xe7\xc2\x92\x1a\x44\x46\xf2\x6d\x9c\x88\xcb\x35\x43\x26\x34\x26\x31\x18\x89\x9e\x71\x73\x44\x2d\x84\x88\x8d\x60\x2f\xc5\x35\x4b\x71\x14\x47\x01\xc5\xb6\xcd\x56\x24\x16\xb9\xf5\xfe\x21\x9e\x98\xb3\xc0\x1d\x63\x19\x8d\x2e\xcc\x1c\xb0\xe3\xb6\x2c\xc1\x03\x9d\x66\x07\xf8\x96\xfb\xaf\xfb\x52\x4d\x7f\x56\x82\x97\x6e\xdf\x62\x59\xd3\x7e\xdb\xcb\x14\x99\x81\xd2\x13\x98\xcf\x85\xd4\xff\x30\x1b\x9c\x73\x24\x1b\x2e\x0a\x08\x7a\x14\x42\x1f\x3f\x82\x1b\xd3\x3d\xd6\xe9\x5e\xc8\x2d\x2c\xa4\x82\x7c\x4d\x4c\x30\x33\x14\x2f\xf9\x21\xf9\x7f\xfb\xff\xfc\xcb\xef\x93\xd1\xf7\xfb\xfb\x1f\x9e\x4e\xfe\xfe\xf1\x2f\xfb\xff\x9c\xe2\x3f\x9e\x8c\xbe\x1f\xfd\xee\xff\xf8\xcb\x68\xb4\xbf\xff\xe1\x87\x37\xaf\xce\x4f\x5f\x7c\x64\xa3\xdf\x3f\xf0\x3c\xbd\xb0\x7f\xfd\xbe\xff\x01\x5e\x7c\xec\xd9\xc9\x68\xf4\xfd\xbf\x37\x4c\x88\xf2\xd5\xbb\x79\x2b\x19\xf7\x4a\x76\x9d\xf4\x39\x91\xd6\x34\x67\xc6\xf5\x44\xc8\x89\xfd\xe0\x90\x68\x99\x6f\x97\x53\x8d\x50\xdb\xe5\x20\xed\x7b\x22\xbc\xad\xf4\x55\xf3\x9b\xb8\x4b\xd7\x9c\xd1\xce\xcc\xa6\xe0\xed\x99\x95\xfb\xe6\x66\xdb\xbd\x4c\xdf\x7c\xc8\x9d\x6d\xe9\x11\x85\x75\xf7\xe5\x63\xe5\x83\x0f\x6a\xfd\xd7\x12\x5e\x2d\xcf\x6f\x1b\xab\x87\xf4\x34\xcc\x38\xd2\xb9\x85\x99\x64\x42\x32\xbd\x3a\x4e\xa8\x52\x6f\x69\x0a\x37\xdd\x90\x93\x79\xa9\x63\x8d\x0d\x41\x9b\x13\xc8\x1d\xd1\x2e\x1a\xc4\x0d\xd9\x0c\xf0\x93\x39\x2a\x19\x95\x7e\x3c\x50\xfd\xb7\x05\x61\x7a\x12\x17\x92\xfc\x0a\x52\xb8\xeb\xf7\x24\x58\x45\xa5\x71\x04\xf7\x59\xfb\x3e\xb4\x80\x4d\x41\x94\x23\xd8\x8c\x84\x74\x6d\x74\x8d\x39\x5b\xdc\x14\x74\x67\xdb\x3a\x25\x11\xe5\x66\xa1\x78\xa1\xe4\x9c\x7c\x4a\x60\x41\xa3\xd5\x27\xb3\xe0\x4f\x12\xcc\x14\x8d\x82\xf7\xc9\xaa\x0d\x6b\x8a\x81\x0b\xbc\x61\x8a\x00\xc3\x3b\x46\x19\xff\xd9\x6a\x83\x5e\xb5\x6e\x9c\x89\xc4\x74\xfd\x4c\xc4\x53\xb3\x07\xd3\xda\x6a\x91\x85\x16\x0f\x0b\x61\xe2\xc3\x93\x8f\x1b\x6f\x3a\x3b\xa3\x16\x56\x63\xac\x12\x87\xcc\x91\xed\xb7\x49\x36\x1e\x20\xe4\x28\x4e\x19\x1a\x47\xc9\xfe\xe9\xd9\xd1\x68\x6d\xe5\x46\xce\xb1\x07\x71\x2c\xc0\x87\xbe\x98\x81\x54\x69\xe6\xc4\x43\x14\xd3\x09\x2d\x09\x63\x3e\xa1\x9f\x8b\x01\x30\x5a\x3e\x5b\x52\x68\xfd\x64\xcf\x8e\xc8\x27\x23\x23\x27\x8c\x83\xdd\x83\x4c\xb2\x4b\x96\xc0\xc2\xcc\xa4\xe2\xce\x27\xc7\xb9\x94\xc0\x75\xb2\xf2\x37\x42\x6e\xdf\x5d\xa6\xcc\x79\xb5\x8e\xe8\x0e\x39\x1b\x27\x53\x18\x14\x0a\x64\x30\xbd\x28\x88\xa7\xe4\x0c\x7b\x5a\x59\x07\x84\x7b\x0f\xf7\x1e\xa5\x8a\x26\xe4\x21\x12\x94\x21\x22\xc6\xed\x57\x2c\xb6\x82\x00\x48\xd9\x66\x68\xc3\xdc\x72\xab\x46\x8a\xc4\xe8\x8a\x85\xd6\x6a\x0e\x70\x34\xab\x20\xb0\x51\x00\x73\x31\x4b\x0e\x90\x5b\x36\xb0\x19\x46\xdd\x19\xce\x4e\x36\xf4\xeb\x6b\x93\x1d\x4e\xcc\x1a\xe7\x39\xc6\x29\x79\x9d\x1c\x99\x49\x55\xe4\xaa\xc9\x9c\xd5\xd9\x8e\x4b\x2b\x01\x65\x0e\xf3\x95\x9f\xa2\x84\x59\xce\x12\x34\x61\xb2\x02\x1c\xcd\xf2\x2e\xd2\x21\xad\x9a\x06\x44\x96\xba\x5b\x6e\xf3\x2c\x13\x52\x97\xb6\xa7\x68\x4d\xe7\xb7\xf6\x9c\x2d\x70\x34\xd3\xcd\x24\x64\x54\x16\xa7\x9d\x02\x12\x2d\x29\x37\xb2\x56\x0b\x5c\xde\x08\x4c\xd7\xb7\x65\x2d\xcc\x6c\xe8\x4c\xe4\x1a\x31\xde\x71\xa0\xb9\xc8\x79\x4c\x0c\x73\x3d\x24\x4b\xad\x33\x75\x78\x70\x50\x9e\xfe\x53\x26\x0e\x62\x11\xa9\x83\x48\xf0\x08\x32\xad\x0e\x3c\x2f\x38\xc8\x44\x3c\xf1\x7f\x4c\xa8\x27\xe5\x83\xc7\xbb\x32\xdf\x82\x7d\x1f\x12\xbb\xe1\x0d\x6f\x01\xcf\x5b\x6e\xba\x9c\xb4\x7f\x6c\x5e\x28\x81\xbb\xf5\x25\x2d\x12\x17\x1e\xd9\x78\x02\xaf\xdf\x7f\x5a\xbe\x5f\xdc\xcf\x5a\xe8\x18\x15\x96\xfd\x58\x55\xbb\x6e\x3f\xa3\xda\xac\xcb\x1d\xf6\xe4\xfe\x16\xde\x73\xcf\xb5\x8d\xdc\x5d\xae\x02\xe5\x2d\xad\x29\x5e\xdd\x6a\x54\x33\xfb\xc4\x30\x5c\xbe\x22\x86\x34\xb4\xbb\x47\xd8\x5a\x36\xdb\xac\x08\x4b\x23\xa1\x61\x65\x8a\x6f\x0a\xd7\xdb\x18\xe6\x73\x88\xf4\x77\x15\x53\x55\x51\x5b\xa1\x70\x6d\x7d\xe3\xff\xf5\x5d\x33\xa3\xea\xe5\x85\xea\x17\xee\x61\xa7\xd4\x6e\x42\x1f\x66\x3a\x7f\x81\x3d\xd6\x24\x25\x0b\x3c\x3b\x18\x9a\x12\xd0\x17\xec\xec\xb1\xd6\x33\xe1\x24\x50\xc3\xb9\x2a\x2f\x77\x06\x3c\x20\xd3\xae\x1c\x38\xce\x92\x5b\x7a\x04\x81\xbc\x15\xae\x48\x0d\x8c\xc9\x29\x5e\xa7\x5b\xfe\x82\x67\xff\x5b\x61\xcb\xd5\x74\x04\x79\xf6\x74\x51\x74\xc6\xcb\x0c\x83\xe7\x0f\x65\xf8\x8c\x05\xcc\x5a\xf8\x4c\x49\x58\x55\x5f\x58\x2b\x60\x2f\x60\xd5\x09\x55\x17\x86\xe0\x42\x77\xd0\xd7\x34\x2e\x71\xd4\xeb\x20\x36\x32\xe1\x1f\xae\xa6\x81\x48\x67\x8c\xdb\xa9\xd8\x81\xfd\x3e\xe3\xd8\x7e\x3f\x78\x8c\x7f\x76\x4f\xa2\x27\xb4\xfb\xc5\xf0\x0c\x03\xf9\xbb\x01\xf1\x39\x85\xf7\xb9\x0b\xa4\xdb\xe2\x70\x2a\xc1\x37\x2f\x7e\xc9\x69\x32\x25\xcf\xed\x49\x80\xc0\xb3\x3f\x75\x91\x9b\xed\x62\xc3\x27\x7f\xc5\x92\x38\xa2\x32\xc6\x53\xd3\xb2\x1f\xa2\x84\x45\x1c\xea\xe5\xc4\x8e\xbe\x3d\x03\x2c\x91\xc7\x5e\x74\x4d\x32\x2a\x35\x8b\xf2\x84\xa2\x50\x00\x0b\x21\x3b\x82\xcf\x7b\x6e\x66\x89\xcd\x67\x10\x09\x1e\x77\x78\x0f\x87\xed\xea\x79\xbd\xf3\xea\xf6\xa2\xf0\x0c\x92\xb9\x3a\x29\x2c\x85\x3a\x79\xed\xaf\xe9\xdf\x1d\x63\x89\xb9\x67\x76\x05\x6f\x19\x5b\xc9\xf5\x8a\x29\xa8\x96\x73\x62\xca\x87\xf6\x8f\x2a\x07\x4e\x41\xed\x53\xf2\x9f\x2b\x2f\x1e\x74\x85\xfc\x30\xed\xdd\x59\x68\x30\x72\xf3\x75\xa4\xe8\x76\xb2\x64\x23\x73\x21\xe1\x12\x24\xd9\x8f\x05\x7e\x83\x65\x99\x46\x53\xf2\xdf\x46\xed\x6c\x73\x05\xd9\xc6\x61\x61\x0b\xfb\x38\xc2\x2e\x32\x2e\xf0\xd2\x7e\x74\x33\x3e\x25\xfb\xb6\xd6\x13\x4b\x53\x88\x19\xd5\x90\xac\x46\x36\x82\x1a\x9c\x05\xaf\x0f\xd6\xf4\xa9\x62\x56\xa9\x5e\xf6\xf5\xdf\x5a\xde\xc4\xc9\xde\x26\x52\xfd\xe4\x4d\xdb\x25\x60\xad\x9a\x52\xc3\x9e\xc2\x19\xda\x19\xa8\xd0\x18\x01\x36\x2e\x79\x4d\xc5\x0a\xec\x79\x73\x81\x5b\x3f\x1b\x04\xa5\x44\xc2\x02\xe9\xd3\xd2\xdc\x0d\xa8\x93\x45\xdb\x8b\xb8\x75\x08\x21\xed\x5e\xb1\x09\x31\x5a\xe7\xd7\x7f\x8b\xa9\xa6\x0d\x2f\x58\x94\x59\x65\xdb\x48\xad\x4b\xb6\x29\x3b\x6f\xda\xeb\x1e\x6e\x1e\x37\xfc\x4e\x3d\xa0\xc6\xb8\xed\xcb\x3e\xd8\x75\x82\x66\x70\x1b\x9b\xe8\xd1\x60\x22\x61\xc1\x94\x96\xab\x8a\xb3\xc3\xb9\x51\x05\x61\x5c\x69\xca\x35\x43\x56\x4d\xfc\x9b\x13\x67\xe7\x37\x5a\xd9\xf6\xfd\x7f\xc7\x93\x95\x35\x22\x63\xda\x8d\xd5\xc5\xce\x57\x19\x90\x6f\x2b\x7f\xbc\x92\x59\xb4\xfd\xfb\x93\x39\x71\x0c\xd4\xe2\x26\x8d\x63\x09\x6a\x93\xb3\x6d\xfb\xba\x15\x7c\xde\x2c\xb6\x2b\x04\x4f\xbd\x59\xcd\x65\xfe\x28\xc5\x16\x46\x49\xf1\x85\x1b\xbd\xdf\x68\x4d\x59\xb1\xaa\x26\x7e\x68\xbd\xc3\x90\x16\x27\x26\xd3\x5e\x6b\x8c\x04\x57\x79\xea\x33\x41\x8c\x8a\x9d\x01\x8f\x81\x47\x2b\x2c\xf4\x94\x5c\x42\x83\x85\xe1\x47\xd5\x80\x12\x84\xfc\x1f\xb6\x58\x9a\x8d\xb2\x93\xab\x4a\xce\xde\x43\x5e\x9b\x29\x53\x06\xf0\x73\x90\x12\x62\x9b\x29\x63\x84\x5e\xdf\x43\xc5\xe3\xe9\x2a\x4f\xf9\x20\xce\xfa\x64\xb1\xfc\xdf\xf6\xe9\x9e\x17\x65\x27\xbd\x6b\xc4\xc3\xd4\x72\x20\x03\x8e\x85\xb0\x11\x05\x99\x50\xcc\x17\x79\x2b\xce\x85\xb5\xd2\x95\x62\x6e\x0b\x4b\x36\x8f\xb5\x9e\xd2\x86\x81\xcf\xb5\x45\xa3\x75\x21\xe7\x76\x33\xa1\x6a\x3b\xf5\xbc\xb0\xa1\x38\xe6\xf9\xe6\x56\x17\xc1\x38\x98\x07\xb7\xbe\xb4\xf2\x2c\x93\x94\x5f\x40\x4c\x12\xb8\x66\x91\x58\x48\x9a\x2d\x59\x84\x25\x0c\xad\x5b\xd9\x68\x8c\xda\x86\x51\x35\x63\x78\xd3\xe9\x95\xe5\xb3\x84\xa9\xe5\x76\x07\x65\x2b\x71\x28\x88\x24\xe8\xad\x9c\xaf\x0f\x6d\x9c\xd9\xcf\x4b\xe1\xc7\x07\x98\xbb\x7e\x5d\x7e\x86\xc5\x76\x9f\x45\x4a\xa3\xc8\x10\xb6\x77\xb6\x82\x93\x04\x2b\x44\xd4\xc0\x21\xb4\xf7\x68\x99\x5e\x2e\x00\x32\x8b\xcf\x18\xac\xa6\x52\xb4\x62\x2a\xc6\x23\xc0\x92\x8c\xae\xb4\x26\x80\xf7\x36\x68\xc9\xc0\x4a\xb0\x80\x0e\x46\xbf\x8b\xc0\xf5\x76\x89\xb3\xdd\x88\xd0\x62\x40\x68\x87\x78\xc1\x0b\x3b\x81\x5e\xe1\xa1\x5e\x28\x30\xff\x36\xe0\xc5\x27\x43\x37\xdb\x56\xe0\x3c\xb3\xa1\xd7\x3b\xf3\xc3\x1f\xd7\x7a\x71\xa1\x60\x8a\x2c\xc5\x95\x1b\xa0\xce\x31\x9c\xc9\xd3\xa3\x41\xcc\x54\x64\xd8\x4c\x83\xe1\xe8\x58\x70\xe5\x2b\x6e\x52\x6e\x8b\x64\x5e\xd2\xc4\x65\xc3\xba\xc1\x32\x91\xa0\xcb\x35\xce\xbd\xbe\x6a\x53\x7d\x20\x9d\x41\x1c\x43\xec\xe3\xcb\x57\xa4\xe1\xd0\xef\x10\x38\xba\x64\x02\x7f\x2c\x9e\x8a\x24\x69\x3f\xd3\x5b\x0d\x2b\x7d\xcc\x2a\x1e\x00\xbd\x63\x5a\x3a\xc4\xcc\x13\x0f\x50\x67\x17\x37\xd4\x51\xfa\xbc\x11\xc9\x8c\xc2\x52\xc0\x7d\x06\xfa\x0a\x80\x93\x68\x09\xd1\x85\x2a\x43\xf5\xb4\xa1\xc3\xda\x46\x3b\x63\x6d\xbb\x80\x58\xe5\xa0\x85\x60\x6a\x36\xd4\x65\xb4\x03\x61\x46\x2d\xe4\x70\x55\x8f\x0b\xdb\x3c\xb8\xe8\x25\x65\x09\x9d\x25\x1d\x0a\xf3\xc9\xbc\x7c\x73\x5c\x9d\x3f\xf3\xd2\x51\x96\x27\x89\xf3\x7f\x63\x44\x8c\x96\x74\x3e\x67\x11\xc6\x3a\x62\x44\x50\x19\xd9\xbb\x75\xe9\x3b\x45\x01\x29\x4d\x75\xbe\xb1\xf5\x2d\x78\xd3\x86\x2f\x46\x0b\x65\x8d\xf6\xd6\x3e\x18\xf2\x7e\x5d\x83\x35\xb3\x03\xab\xa2\xaf\xb9\xce\xa6\xe4\xad\xd0\x2e\xe2\xee\x0d\x28\xe5\xa2\xfd\xc8\x7b\xa0\x4a\xf0\xca\x51\x80\x9a\x87\x64\x0b\xc6\xe9\xf6\x92\x04\x76\xfd\x55\xc3\x7a\xa1\x68\xd2\x15\x96\x24\x66\x0b\x49\x75\xc1\xc1\xcb\x25\xba\x43\xd3\x89\x05\xd6\x63\x31\x25\x47\x7c\x85\x68\xe3\xc2\xf0\xb6\xdb\x54\x19\xd7\x52\xc4\x79\x04\xae\xf8\x72\xae\xaa\x1d\xdf\xea\x39\xd0\x8f\x2c\x8f\xfd\xe0\x65\xae\x41\x0c\x9a\x32\xe7\x32\x17\x1c\x08\x55\x99\x51\xff\x3d\x19\x58\xef\x59\xb9\x41\x78\x0a\x1e\x9d\x9e\x90\xf7\xd0\x8e\x8d\x93\x49\xd3\x24\x30\x6a\x44\x69\x99\x47\x78\xc8\x1a\xea\xe7\xb1\x3b\x2e\x2d\x01\xd8\xa8\xcd\x4a\x8e\x93\x33\x1a\x5a\xa9\x38\xa3\x7a\x49\xa6\x76\x43\xa7\x15\x70\x12\xf2\xd2\x1c\xb8\xd7\x34\xcd\x12\x18\x37\xba\x58\xfe\x0d\x0f\xb6\x97\x42\x9c\x59\x94\xb0\x33\xf9\xad\xe9\x6d\xf3\x9f\x83\x83\x3a\xc2\x8a\x99\x51\x52\x9c\x0f\x01\xf1\x76\x2e\xc4\x63\xb5\x0e\xaf\x26\xd0\xf8\x3e\x7f\xc0\x80\xd4\x2d\x2b\xc1\x19\x52\x09\x87\x64\xef\xc8\xf3\x92\xbd\x31\xd9\x3b\x95\x62\x81\xd9\x29\x7c\xe1\x72\x48\xf6\x9e\xc3\x42\xd2\x18\xe2\xbd\x8e\xb1\xfe\x82\x59\x4c\x6f\x40\x2e\xe0\x07\x58\x7d\xdb\x70\x54\x6d\x7e\xe1\xcf\xde\x6f\x31\x17\xaa\xeb\x13\x23\x1e\x19\x19\xe2\xdb\x94\x66\x7d\xde\x7d\x43\xb3\x3e\xb3\x39\x2e\x89\xf1\xc3\xc7\x14\x34\xbd\x7c\x36\x2d\x51\xf9\xd3\xcf\x4a\xf0\xc3\xbd\x12\x7e\x63\x91\x32\x0c\xfe\x5b\xed\x91\xb5\x45\x1c\xee\xe1\x2a\xdc\xaf\x1e\x18\x87\x7b\x66\xfc\x3d\xc3\xf1\xb4\x98\xe5\xf3\xc3\x3d\x8c\x8e\x1b\x3f\x1b\x4b\xc8\xc6\x46\x4a\xfe\xb6\xec\x7b\xef\x53\x33\x62\xb9\x95\x59\x47\x2f\xe2\x6a\x93\xab\xe5\xdf\xfe\x68\x11\xe6\x5a\x8e\xf1\xae\x90\xdd\x09\x49\xa8\xd2\xe7\x92\x72\x85\xd3\x3d\x67\x69\x13\x60\x27\x24\xb5\x0c\xb5\xf1\xb9\x44\x26\xdb\xf8\xd8\xa2\x6d\xe3\xe3\xc6\x3d\xed\x16\x44\x36\xd7\x70\x1b\xce\xb3\xcd\x5e\xcb\xec\x5e\x23\xe6\x7b\xd3\x69\xb1\xd7\xe6\x60\x76\x6f\x83\xab\xf7\x6e\x18\xa4\x3b\x49\x30\x7d\x0c\xb7\xba\xed\x3c\xb6\xbc\xae\x30\x7a\x5d\xb9\x2a\xf0\x24\xe7\x31\xc8\x04\xe3\x03\xca\xf1\xac\x77\x38\x9e\x3a\x5b\x1a\x2d\xcc\xa2\x18\xb9\x8e\xc2\x04\xaf\xf8\xe0\x6c\xac\xab\xef\xd1\xf0\x64\x57\x68\xdf\x76\x83\x32\x4b\x14\x41\xa6\xdb\x85\x96\x5e\x26\x6e\x6f\xa7\x34\x32\xf7\x44\x37\x63\x95\xc3\xa9\xdb\xd8\x2f\xd7\x95\x0d\x26\x5b\xe6\x29\x35\xe7\x3d\x8d\x31\xb6\xb5\x78\x66\x4d\x0e\xd6\x44\x60\xcf\x31\xeb\x2e\xb7\x7e\x4c\xbf\x7d\x9d\x3b\xe4\x64\x00\x5a\x54\x8a\xe8\x30\x3e\xf6\x82\x59\x4a\xaf\x5f\x03\x5f\xe8\xe5\x21\xf9\xeb\x57\xff\xfb\xeb\xff\x68\x78\xd1\x1e\x25\x10\xbf\x02\xee\x8c\xae\xb7\x01\xbd\xcd\x5e\xeb\x5e\x83\xa9\xcf\xae\x98\x2e\xca\x77\x0a\xff\x5c\x89\x95\x57\x14\xe3\x9f\x9d\x18\x94\x67\xed\xe0\x7c\x89\x29\x3e\x4a\x53\x1e\xc1\xd8\x48\xd7\x5b\x87\x61\xc5\x49\x99\xac\xc8\xb3\xaf\xc6\x18\x9d\x8d\x93\xda\x38\x0c\x3f\x5c\x7f\x9c\x6e\x59\x0c\x53\xe4\xef\xe3\xda\x4c\x99\x22\x66\xef\xc5\x1c\xd1\xb4\x65\x92\x68\x45\x91\x60\x25\x1d\x6f\x53\xdb\x94\x74\xa0\x58\x49\x17\x26\x74\x99\xfa\xfb\x99\xf9\x53\xc6\x59\x9a\xa7\x87\xe4\x69\xc3\x2b\x96\x23\xdf\x06\x7a\xd8\x9e\x4a\x29\x90\x1a\xb6\xbc\x90\x34\x4d\x31\x89\x91\xc5\xc0\x35\x9b\x33\x0c\x56\x2b\x48\x0c\xcd\x62\xf6\x43\x1f\x60\x59\x00\x1f\x63\x2f\x0d\x1b\xed\x45\x74\xa7\x56\x2c\x96\x28\x3b\x39\x27\x78\x54\xe5\xbc\xab\x0c\x2c\x55\x5a\x2d\x9c\xc0\x75\x66\x15\xa3\x8a\x3b\x36\x05\xca\x19\x5f\xa8\x32\x4e\x1a\xf9\x5f\x9b\xb7\xc9\x7c\x76\xb5\x04\x17\x89\x05\x55\x67\xbb\x2f\xb3\x65\x34\xb3\x32\x3f\x00\x73\x46\xda\xd9\xc7\xa6\x6b\xc3\x28\x31\x29\x24\xc7\x54\x41\x0f\x37\x46\x25\x88\xda\xdf\x3d\x52\xe4\xb6\xdf\x1a\x03\x7a\xf6\xf4\xab\x56\xbc\x2b\xde\x6b\x7c\xa9\x0c\xaf\xfe\x70\x34\xf9\x6f\x3a\xf9\xf5\xe3\xbe\xfb\xc7\xd3\xc9\xdf\xff\xff\xf8\xf0\xe3\x93\xca\x9f\x1f\x9b\xa3\xa2\xb7\x2b\xa2\x65\x5b\xc3\x61\x77\xd6\x7a\x65\xc4\xe3\xc7\xd8\x47\x61\x9e\xcb\x1c\xc6\xe4\x25\x4d\x14\x8c\xc9\x8f\x1c\xcf\xc9\x1b\x02\xad\x3d\x58\xc9\x48\x36\x7b\x66\xd4\x26\x79\xdb\xbd\x82\x53\x6a\x7f\xc7\x4d\xb7\xcd\xa2\x73\x0b\x84\xee\xad\x78\x15\x2e\xc9\x2b\xe8\x69\x13\x32\xe7\x42\x4c\x9d\xde\x34\x8d\x44\x7a\x50\x3c\x6f\xc3\xdb\x66\x05\x8f\x60\x69\x56\xbe\x22\x25\x1b\xb7\x2a\x4d\x9d\xdc\x14\x26\x06\xd2\x48\x0a\xa5\xca\xeb\x26\x48\xc2\x2e\x80\x1c\x95\x46\x14\x73\x38\xcc\x20\xa2\xa8\x15\xca\x19\xd3\x92\x5a\x7f\x92\x57\x0a\xac\xb5\xaf\x65\x36\xb9\x82\x79\x9e\x90\x7d\x05\x40\xa6\x18\xf8\xbd\x71\xce\x8c\x9c\x2b\x68\xc6\x12\x86\xb9\x96\x24\x86\x48\xf0\x79\xc2\x9c\x9a\x9a\x66\x42\x6a\xca\x5b\x2b\x8c\xd8\x54\xfd\x05\x5c\x13\x56\x44\x5b\x99\x8f\xf7\x63\xae\x9e\x3d\xfb\xea\xaf\x67\xf9\x2c\x16\x29\x65\xfc\x65\xaa\x0f\x46\xdf\xef\xff\x92\xd3\x04\xe3\x7f\xde\xd2\x14\x5e\xa6\x7a\x74\x7b\x12\xc7\xb3\xaf\x7b\x90\xf2\xfe\x07\x4b\xb0\x1f\xf7\x3f\x4c\xdc\xbf\x9e\xf8\x9f\x46\xdf\xef\xff\x73\xda\xfa\x7c\xf4\xe4\x00\x13\x24\x0a\xba\xff\xf8\x61\x52\xf2\x80\xe9\xc7\x27\xa3\xef\x2b\xcf\x46\xdb\x38\xc2\x66\xa5\xb7\x94\x66\x93\x8b\xc6\xd2\x97\x8d\x7a\x45\x53\xc9\xb8\x6d\x8a\xa8\x4d\x58\x7b\x43\xb3\xf7\x30\x07\x09\x3c\xea\x36\x8f\x1f\x6f\x7c\x42\xf6\x63\x23\x4f\x61\x9a\xf2\xc8\x6b\x12\xb2\x78\xea\xa4\x8a\xe2\x3b\x7f\xd4\x16\xb7\xac\xd5\xe3\x0d\x7d\x16\x5d\x61\x9b\x72\x72\xfd\x16\x43\x64\xd9\xeb\x70\x6b\x73\x97\x7b\xdb\xa8\xbb\x2d\x8f\x30\xaa\x7a\x07\x23\xb6\x91\x0d\xac\x31\xbf\x4d\x9d\xeb\x81\xe4\xfd\x14\x11\xde\x92\x40\xd1\x39\x48\xb1\xce\x9d\x7b\xf0\xac\xec\x27\x6b\x53\xde\xb9\x9f\x9c\x35\x6a\xfa\x7d\x4f\x80\x1f\x4f\x9e\x5b\x9c\x41\x06\x8c\xe2\xfd\x52\x24\xb1\x22\x39\x67\xbf\xe4\x40\x4e\x9e\x17\x95\xcc\x18\x8f\x92\x1c\x6f\x1a\xfb\xf1\xc7\x93\xe7\x6a\x4a\xc8\x7f\x3a\xa6\x7b\xd5\xcc\x5b\x6d\xcd\xd0\x77\x6f\x5f\xff\x5f\x34\xda\xe1\x97\xee\xa2\x1f\x5f\xc9\x92\x51\x6b\x6d\xb7\x92\x90\xe9\xd5\x86\xc5\xe3\x8c\x22\x9a\x35\xdb\x4f\x89\xf3\x49\x70\x9b\xea\xb0\x84\x24\x53\x98\xc4\x49\x54\x2e\xdd\x6a\xcc\x80\x36\x97\x0c\xcb\x6c\xb8\xa0\x20\x9f\x97\x8a\x79\xbf\x3b\x65\x97\x44\x82\x73\x88\x30\xea\xca\x68\x04\x7d\x38\x44\xf5\xfd\xba\xb6\xb5\x55\xbd\xa8\xa7\x89\x94\x63\x7a\xfe\xe1\x9d\x3f\xb7\x4f\xe8\x86\x22\xdf\x39\xbd\x0a\x67\xbc\x03\x55\xbb\xb8\x89\x9d\xf1\xdb\xcc\xc1\xc1\xed\xce\x59\xc2\xc6\x7a\x77\x1a\xd1\x3a\x64\x30\xd0\xe5\x7d\x87\x5f\x6e\x3d\xe4\x7c\xc3\xcc\x54\xab\x1d\x80\xce\xa1\x22\x56\x66\x49\x15\x99\x01\x70\xf4\x55\x59\x9f\x04\x70\x87\xf3\x50\x7a\x92\xf2\x6c\xa2\xc5\xa4\x41\xd9\xed\x80\x5c\x37\xd4\x5a\x6c\x39\x6b\x6b\x3b\x1a\x6c\x9d\xb9\x5a\xae\xb6\xc1\x40\x95\xf7\x8c\x15\x72\xe3\xd0\x85\x35\xab\xc8\x6b\x73\x76\x0e\xa4\xe2\xd8\xc6\xbf\x36\xa7\x74\x65\x58\x57\xd5\x0a\xa8\x05\x86\x4e\x74\x9a\xf9\x3b\xe6\x68\xb7\xf9\x0c\xe4\x25\xeb\x21\x7c\xbc\x5f\x7f\xbf\x17\x6b\x79\xf5\xfe\xf4\x18\xd3\x9c\xcd\x07\xde\xf7\x8a\xd8\x5f\x95\x2a\x86\xb3\x95\x2e\x96\x10\xd9\x30\xca\xa3\xbb\x27\x68\x23\x8e\xef\x3c\x08\xda\xfa\x23\xd1\xe1\x50\x6f\x4d\x3c\x44\xd0\xb6\x65\x6a\x0e\xe9\x63\xa8\xbc\x61\xf9\xd8\x5a\x6e\xaf\xd2\x42\x1a\x72\x5d\xfb\x2d\x9f\x15\x6a\x55\xd9\xbb\x53\xc1\xc9\x6f\x7f\x3c\xfa\x9f\x00\x00\x00\xff\xff\x0e\x0a\xc6\x9d\x2b\x56\x01\x00") +var _operatorsCoreosCom_catalogsourcesYaml = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\xec\x7d\x69\x73\x1b\x39\xb2\xe0\xe7\xe7\x5f\x81\xd0\xbe\x08\x4b\x1e\x92\xb2\x7b\xde\xf6\xbe\xd1\xf4\x11\x7a\xf2\xb1\x8a\xf6\xa1\xb0\xd4\xfd\x62\xc7\xe3\x5d\x83\x55\x49\x12\xad\x2a\xa0\x1a\x40\x49\x62\x1f\xff\x7d\x03\x09\xa0\x0e\x92\x75\x91\x3a\xec\x1e\xe0\x43\xb7\xc5\xaa\xc2\x91\xc8\x4c\xe4\x0d\x9a\xb1\x9f\x40\x2a\x26\xf8\x11\xa1\x19\x83\x1b\x0d\xdc\xfc\xa5\x26\x97\xff\xa9\x26\x4c\x1c\x5e\x3d\x7b\x74\xc9\x78\x7c\x44\x4e\x72\xa5\x45\xfa\x1e\x94\xc8\x65\x04\xcf\x61\xc6\x38\xd3\x4c\xf0\x47\x29\x68\x1a\x53\x4d\x8f\x1e\x11\x42\x39\x17\x9a\x9a\x9f\x95\xf9\x93\x90\x48\x70\x2d\x45\x92\x80\x1c\xcf\x81\x4f\x2e\xf3\x29\x4c\x73\x96\xc4\x20\xb1\x73\x3f\xf4\xd5\xd3\xc9\xb3\xff\x39\x79\xfa\x88\x10\x4e\x53\x38\x22\x11\xd5\x34\x11\x73\x3b\x96\x9a\x88\x0c\x24\xd5\x42\xaa\x49\x24\x24\x08\xf3\xbf\xf4\x91\xca\x20\x32\x83\xcc\xa5\xc8\xb3\x23\xb2\xf1\x1d\xdb\x9f\x9f\x0b\xd5\x30\x17\x92\xf9\xbf\x09\x19\x13\x91\xa4\xf8\x6f\xb7\x46\x3b\xec\x39\x0e\x8b\xbf\x27\x4c\xe9\x1f\xd6\x9f\xbd\x66\x4a\xe3\xf3\x2c\xc9\x25\x4d\x56\x27\x8c\x8f\xd4\x42\x48\xfd\xb6\x1c\xde\x0c\x17\x51\xad\x64\x64\x1f\x33\x3e\xcf\x13\x2a\x57\xbe\x7d\x44\x88\x8a\x44\x06\x47\x04\x3f\xcd\x68\x04\xf1\x23\x42\x1c\xa4\x5c\x57\x63\x42\xe3\x18\xa1\x4f\x93\x33\xc9\xb8\x06\x79\x22\x92\x3c\xe5\xc5\x50\xe6\x9d\x18\x54\x24\x59\xa6\x11\xc2\x17\x0b\x20\x99\x04\xad\x97\x08\x12\x22\x66\x44\x2f\xc0\x8f\x5d\x7c\x45\xc8\xcf\x4a\xf0\x33\xaa\x17\x47\x64\x62\x20\x3c\x89\x99\xca\x12\xba\x34\xb3\xa9\xbc\x65\xb7\xe9\xb9\x7d\x56\xf9\x5d\x2f\xcd\xd4\x95\x96\x8c\xcf\xdb\xa6\x62\xde\xeb\x3f\x07\x0b\x9a\x8b\x65\xb6\x3e\x85\x95\x1f\xfb\x8e\x9f\xe5\xd3\x84\xa9\x05\xc8\xfe\x93\x28\x3e\x59\x9b\xc3\xd9\x86\x27\x0d\x13\xa9\x74\xea\xe9\x66\x12\x49\x40\x92\xb9\x60\x29\x28\x4d\xd3\x6c\x6d\x80\xe3\xf9\xfa\x1a\x63\xaa\xfd\x8f\xf6\xa5\xab\x67\x34\xc9\x16\xf4\x99\xfb\x51\x45\x0b\x48\x69\x89\x0f\x22\x03\x7e\x7c\x76\xfa\xd3\x5f\xcf\x57\x1e\x90\x3a\x74\x6a\x78\x4e\x98\x22\x94\x48\xc8\x84\x62\x5a\xc8\xa5\x81\xd6\xc9\xf9\x4f\x6a\x44\x4e\xde\x3f\x57\x23\x42\x79\x5c\x10\x1e\xc9\x68\x74\x49\xe7\xa0\x26\x6b\x73\x15\xd3\x9f\x21\xd2\x95\x9f\x25\xfc\x92\x33\x09\x71\x75\x16\x06\x3c\x1e\x26\x2b\x3f\x1b\xf8\x57\x7e\xca\xa4\x19\x53\x57\x08\xd9\xb6\x0a\x33\xab\xfd\xbe\xb2\xc2\xdf\xc7\x2b\x4f\x09\x31\x80\xb1\x5f\x92\xd8\x70\x36\x50\x88\x14\x8e\xea\x20\x76\xd0\xb4\xc8\xc2\x94\x81\x88\x04\x05\xdc\xf2\x3a\xf3\x33\xe5\x6e\x95\x93\xb5\xce\xcf\x41\x9a\x8e\x0c\x43\xc8\x93\xd8\xb0\xc4\x2b\x90\x9a\x48\x88\xc4\x9c\xb3\x5f\x8b\xde\x15\xd1\x02\x87\x4d\xa8\x06\xa5\x09\xd2\x35\xa7\x09\xb9\xa2\x49\x0e\x08\xec\xb5\xbe\x53\xba\x24\x12\xcc\xb8\x24\xe7\x95\x1e\xf1\x13\xb5\x3e\x97\x37\x42\x02\x61\x7c\x26\x8e\xc8\x42\xeb\x4c\x1d\x1d\x1e\xce\x99\xf6\xcc\x3e\x12\x69\x9a\x73\xa6\x97\x87\xc8\xb7\xd9\x34\x37\x0c\xf5\x30\x86\x2b\x48\x0e\x15\x9b\x8f\xa9\x8c\x16\x4c\x43\xa4\x73\x09\x87\x34\x63\x63\x5c\x0c\x47\x86\x3f\x49\xe3\xff\x21\xa1\xca\x01\x57\xd1\x60\x85\x1a\x88\xe7\xbb\x03\x37\xcb\xf0\x63\x8b\x98\xb6\x43\xbb\xd8\x72\x4f\xcc\x4f\x06\x8c\xef\x5f\x9c\x5f\x10\x3f\x23\xbb\x6f\x76\x8b\xca\x57\x37\x40\xc8\xef\x96\x81\x2c\xe3\x33\x90\xf6\xcb\x99\x14\x29\xf6\x0a\x3c\xce\x04\xe3\xda\x72\x8d\x84\x01\xd7\x44\xe5\xd3\x94\x69\x85\x68\x0d\x4a\x9b\x8d\x5c\xef\xf8\x04\x0f\x47\x32\x05\x92\x67\x86\x78\xe3\xf5\x57\x4e\x39\x39\xa1\x29\x24\x27\x54\xc1\xbd\xef\x9d\xd9\x23\x35\x36\x1b\xd2\x7b\xf7\xaa\x47\xff\xfa\x07\x6b\x54\x4f\x88\x3f\xb3\x7b\xbd\xdc\xc4\x26\x88\xe5\x09\x9b\xce\x04\xd2\xc2\x1d\x4c\xa3\x71\x2c\x41\x6d\x78\xd0\x8d\x75\xa6\x1d\xdb\xcf\x2d\xf2\x2d\x84\x32\x48\x40\x35\x79\xf7\xfa\x0d\x89\x28\x27\xb9\x02\x43\xc2\x91\xe0\xdc\x60\x99\x16\x84\x9a\x33\x77\x0c\x37\x4c\x21\x56\x4a\x98\x33\xa5\xe5\x72\x7d\x6f\x4d\x7b\x29\x64\x4a\xf5\x11\xf9\xc6\xbf\x36\xc6\x21\x84\x24\x2c\xfb\xee\xe8\x9b\x4c\x48\xfd\xdd\xc6\x0f\xdf\xf1\x64\x69\x06\x8f\xc9\xf5\x02\x38\x39\x2f\x20\x43\xbe\xad\xfc\xf1\x4a\x66\xd1\xe6\x81\x4f\xe7\x5c\x48\xff\xb5\x41\xeb\xd3\x94\xce\x81\xcc\x18\x24\x48\x68\x0a\x36\x70\xb5\x16\xb4\x20\x56\xf0\x9b\xb1\xf9\x1b\x9a\x6d\x0b\xeb\x13\xdf\x81\x99\x81\x99\x54\x55\x6c\x29\x1f\x6a\x81\x14\x65\x16\x6f\xfe\x49\xa3\x4b\x42\xdd\xe0\x29\xcd\xc6\x0a\xa9\xb9\x03\xf0\xfd\xe0\x77\xe2\x3b\x35\x3b\x52\xfe\x7c\xea\xb8\xf4\x60\x08\x55\x81\x30\xf8\xdb\x52\x28\xeb\x84\xef\x9b\x4d\x67\x6a\x8f\x31\xe6\x32\x8b\xce\x44\x6c\x97\xbd\xed\x2e\xbe\xaa\x76\x42\xe0\x26\x13\x0a\x14\x89\xd9\x6c\x06\xd2\x70\x4e\x71\x05\x52\xb2\x18\x14\x99\x09\x89\x5b\x9b\x89\x18\xd9\x44\xb1\xd5\x35\x79\xe4\x4c\x6c\x60\x9b\x64\x10\x0d\xa0\xd0\x62\x31\xbc\x0b\xb7\x37\x32\x25\xd2\xc1\x63\x4c\xa3\x33\x54\x8f\x96\x9b\x9f\xae\x80\xee\xd8\xbd\xec\x11\xdd\x89\xa2\x8e\xc3\x3d\x56\x06\x24\x8f\x55\xd1\xe7\xe6\xf5\x77\x4e\xb9\xcf\xb4\x4d\xe3\x22\x86\xe3\x8e\xe9\xaf\x2d\xe1\x39\xfe\x31\x05\x85\x9f\x17\x53\x45\xc1\x26\xce\x13\xe4\x7d\x79\x52\xdf\xe5\xa6\x75\xf4\x5c\x4b\xdf\xf5\xd8\xf7\x60\x06\x52\x42\xfc\x3c\x37\xa8\x7e\x5e\xcc\xca\x71\x3e\xfb\xf3\x8b\x1b\x88\xf2\x26\x72\x6c\x5c\x7a\x03\xe2\x57\x9b\x51\x38\x1c\x24\x40\x92\x6b\x96\x24\x6e\x46\x86\x65\xf9\x07\x06\x24\x28\x01\x1a\x08\x2a\x7b\xb0\x28\xaa\x99\x9a\x2d\x3b\x07\x30\x10\x2d\x60\x0e\x37\x46\xb8\x41\x6d\x11\x09\x89\xcd\x18\xc4\x64\xba\x74\x72\x8c\x61\xea\x23\x32\xcd\x35\x61\x1a\x85\x9c\x68\x21\x84\x5a\x3d\x44\xd7\x1b\xb5\x5b\x8b\xf3\xba\x62\x02\x65\x54\x22\x38\x18\x6e\x98\x1a\xc9\xc4\xd1\x6b\x65\xf8\x09\xae\xbc\xfc\x8c\xad\x0a\x16\xeb\x2d\x35\x27\x5e\xb1\x5d\x9e\x22\xcc\x30\xd7\x4c\x2f\xf0\x8f\xb9\x51\x97\x8c\x7c\xac\xf2\xd4\x0c\x7a\x0d\x6c\xbe\xd0\x6a\x44\xd8\x64\x83\xd0\xb4\xda\x0c\x02\x02\x8d\x16\x95\x69\xa5\x00\x5a\x11\x9a\x24\x7e\x09\x55\xac\xb5\x12\x48\x6a\x64\x45\xb2\xef\x85\xc9\xce\x51\x9c\x20\x38\x2a\x24\x98\x55\xc4\xdb\xb8\x5d\x23\x02\x3a\x9a\x1c\x8c\x3a\xbb\x8f\x44\x9a\xe5\x1a\x8c\x04\x9c\xa7\x66\x6b\x99\x36\x3a\x98\x15\x7c\xa5\xc8\xe7\x16\x52\x90\xb8\x89\x7b\xb5\xc5\x9e\xe8\x86\xff\xd1\x38\xde\xc4\xf3\x57\xdb\x9e\x05\xee\x9e\xd7\x4c\xcc\x70\xcc\x02\x09\xe1\x97\x52\x1d\x2d\x9c\xb2\x14\x09\x29\x41\x65\x82\x9b\x9e\xed\x93\x17\xe5\xda\xfe\x6e\xde\xe9\x1c\xcf\x74\xba\xaf\x0e\xca\xcd\x5e\xb0\xf9\xc2\xef\x35\x95\x80\xbf\xd5\x71\xa4\x6b\xcb\x2d\x2b\xa1\x52\xd2\x2e\x3a\x62\x1a\xd2\x0e\x46\x42\xb6\xa0\x7e\x42\x8e\x39\x81\x34\xd3\xcb\x0a\x62\x57\x50\x4c\x83\x4c\x0b\x40\x22\x16\x22\xdb\x53\x16\x08\x2c\xcd\x12\x16\x31\xed\xd0\x9c\x3c\xed\x31\xde\xbe\xa1\x04\xc2\xb4\x39\x34\x08\x17\x63\x91\x1d\x4c\xc8\x31\xe1\x79\xc1\x78\xda\xa6\xc0\x45\x31\x03\xd7\x91\x99\x96\x12\x65\x5f\xdd\xfc\xa8\x1f\xfb\xb6\xad\x59\xc8\x5f\x6f\x63\x37\x7f\xe0\x3d\x88\xd0\xbc\x6e\xa1\xd6\xf9\x6a\xdf\x83\xc4\xbf\xed\xe7\xd0\xe7\xed\xd5\xd3\xde\x52\x8e\x82\x04\x22\x6d\x4e\x43\x90\xe9\x88\x50\xa5\x44\xc4\x8c\x56\x58\xe2\x7e\x9d\xa0\xec\x4a\xba\x61\x4f\x86\xc2\x9f\x0c\x5e\x3f\x41\xc3\x43\x9d\xbe\xfb\x7e\xb7\x06\x8d\x84\x19\x1d\x67\xb6\x02\x95\x1a\xdf\x9d\x2e\xf1\xe9\x63\x45\x12\x3a\x85\x64\x83\xd2\xde\xd4\xfa\x13\x7f\xd9\x7a\xb2\x81\x86\x05\xf5\x62\x08\x65\x5b\xc5\x86\xca\xba\x9d\x89\xa3\xc0\x13\x73\x54\x19\xd5\x9e\x32\xae\x9c\x7d\x67\x44\x28\xb9\x84\xa5\xb5\xc3\x51\x5e\x98\xe2\x06\x4d\x01\x3b\x96\x60\x0f\x74\x83\x77\x97\xb0\xc4\x0e\x9b\x6c\x48\x2d\x5d\x0d\xc5\x3b\xdb\x86\x70\x80\xb2\x8d\xcd\x44\x07\x7e\xb1\x05\x80\x86\x93\x86\x6d\x97\xd0\x2a\x3e\x6f\x6a\x6b\x56\x6a\x44\x77\xdc\x0f\xdc\x24\x3c\x81\x3d\x3e\xd0\x2c\x4b\x18\x6c\x36\x35\xb5\xb7\x56\xad\xaf\xad\x79\xe8\xed\xb4\xae\x81\x04\x62\xda\xfb\xc2\x5c\x67\xf1\xfd\xb1\xb2\xf8\x6a\xf8\xce\x82\x65\xd6\xd0\xa2\x00\xd9\xc8\x70\xa4\xb5\xed\x27\x9a\xb0\xd2\x96\xad\x50\xd8\x38\xe5\x23\xf2\x56\x68\xf3\xbf\x17\x37\x4c\x19\x19\xf3\xb9\x00\xf5\x56\x68\xfc\x73\x42\x5e\x69\x4b\x7a\xaf\x7b\xf2\xe5\xb2\x6d\xbd\x07\x76\x7d\xf7\xbd\x03\xc7\xdc\x32\x51\x03\xe1\xaa\xd1\x55\x4d\xc8\xa9\x15\x07\x0b\x2f\x00\x53\xe4\x94\x1b\xa5\xc0\x42\x6e\xf0\x50\x68\x77\xc7\xbe\xdd\x90\x69\xae\xd0\x6a\xca\x05\x1f\xa3\x18\xb5\x71\x4c\xbb\x41\x66\xdc\xea\x16\xdd\xe2\xf0\xcd\x43\xbf\x42\x1b\xdd\x6b\x3d\xaa\x7c\x3c\x78\xdc\xca\x60\x0b\x7a\x85\xa2\x3d\xe3\xf3\xa4\x10\xe2\x47\xe4\x7a\xc1\xa2\x85\xd5\x1e\xa7\x60\x9d\x03\x99\x04\x23\x31\x50\x65\x98\xbf\xf9\x65\x0e\x72\x38\xea\x5f\x18\xd5\xc0\x8e\x6f\x5d\x1b\x09\x8d\x20\x26\x31\xaa\x2c\xd6\xca\x4e\x35\xcc\x59\x44\x52\x90\x73\x20\x99\x39\xfa\xb7\x43\xf8\x61\x27\xb1\x6d\x83\xcf\xe3\xea\x80\x5b\x50\x18\x21\x37\xe3\xcb\x7c\x0a\x92\x83\x06\x35\x36\xf2\xc9\xd8\xcd\x5e\x8b\x94\x45\xbd\x3b\xbb\x95\x6e\x50\xce\x7a\x69\xf4\xb6\x7b\x12\xb1\x50\x47\x0c\x22\x56\x10\xb1\x82\x88\x15\x44\xac\x20\x62\xf5\x6e\x41\xc4\xda\x79\xf8\x20\x62\x05\x11\xeb\xde\x45\xac\x5a\x17\x29\xcd\x86\xf6\x60\xed\x72\x5b\x18\x02\xff\xdb\x1a\x74\x57\x2d\x7f\x28\xf0\xf9\x10\x96\xba\x09\xd0\xc8\x31\xe7\xee\x70\xba\x40\xb3\x21\xb3\xfe\x7a\x49\xf9\x1c\xc8\xb3\xf1\xb3\xa7\x4f\x87\x18\x08\x1d\x3a\xf7\xfa\x62\xe6\x82\x13\x18\xd7\x7f\xfd\xaa\xe3\x8b\x1d\x76\xa5\xc9\x5f\x72\x3f\x8e\x3a\xc7\x79\x0a\xdf\x4c\x4d\x44\x6e\xf0\xa5\xe1\x31\xc6\x85\x26\x29\x68\x42\xbb\x65\xb2\xaa\xd9\x9d\xa5\x30\x2a\x9c\xde\xc8\x76\x5c\x84\x90\x77\x0a\xc6\x44\x70\xe7\x7a\x31\x9b\xdf\xbd\xb9\x5b\xad\x20\x02\x6a\x23\x57\xa6\x60\x56\xd1\xed\x0a\xd4\x44\x89\xd4\xcc\x9a\x71\xed\x99\x98\x59\x02\xf8\x8d\x21\xfb\x30\x99\x4f\x48\x9c\x63\xb7\x94\xbb\x90\xa7\x03\xbb\x5a\xb5\x54\x1a\xd2\x6e\x5f\xa0\x39\x0c\x25\xfe\xcf\x80\x45\xcb\xa5\xe9\x0c\xae\x80\xeb\x9c\x26\xc9\x92\xc0\x15\x8b\x74\x01\x3f\x8c\xd0\x62\x5a\xf5\x82\xd4\x00\x31\xba\xbf\xe8\x3c\x5e\xa3\xd0\xae\x43\x6a\x88\xe4\xbb\xd6\x77\x1f\x9e\x53\xa3\x80\xf7\x6e\x25\x93\x46\x9d\x50\x9b\x7e\xad\xdb\x16\xff\x89\xc8\xfd\xee\x7d\xb7\x97\x8d\x0c\x3e\x7f\x06\x9c\x39\xdb\x89\x56\xce\xe1\x25\xa4\x73\xbe\xad\xaf\x74\x83\xcb\xcb\xae\xbd\x46\x35\x62\xd6\x73\x40\xbd\x00\xeb\xa4\x3c\x7e\xfb\xbc\x1f\xc4\x88\x0b\x0e\xb8\x10\x99\x48\xc4\x7c\x59\xdd\x5e\x1b\x22\xcd\xd2\xcc\x3b\x71\x29\x51\xf9\xd4\x89\xe0\x06\xe7\xdf\xae\xe0\x43\x70\x0d\x05\xd7\x50\xb0\x5b\x60\x0b\x76\x8b\x60\xb7\x08\x76\x8b\x7e\x2d\xd8\x2d\x76\x1e\x3e\xd8\x2d\x82\xdd\x22\xb8\x86\xd6\x5b\x10\xb1\xba\x5b\x10\xb1\x5a\x5b\x10\xb1\x8a\x16\x44\xac\x20\x62\x05\x11\x2b\x88\x58\x41\xc4\xba\xaf\x6e\x76\x75\x0d\xed\x34\x85\xed\x06\xcf\x44\xbc\x43\xf2\x56\x26\xe2\x96\xdc\x2d\x6b\xd3\x8f\xc4\x38\x11\x11\xd5\x2e\xa3\xda\x7c\xe2\xbc\x50\x8a\xa6\xd6\x4d\x31\x22\xbf\x0a\x0e\x36\x9b\xc5\x90\x07\x3a\x0b\x84\x5e\x80\x34\xaf\xef\xab\x83\xd6\x14\x82\x90\xfb\x15\x72\xbf\x42\xee\x57\x63\xfb\x6c\x72\xbf\x16\x54\x59\xbc\xb5\x47\x63\x73\x2a\x58\x85\x27\x5d\x80\x4c\xff\xa4\x99\x60\x06\xdd\x1d\x3a\x62\x3d\x90\x12\xa5\x2c\x64\x62\xe7\xf0\x87\xf8\xac\x0e\x0f\xa7\x56\xe3\xa2\x68\x1c\x43\x4c\x32\x90\x63\x8b\xa2\x82\xcc\x18\x8f\x37\xac\xd5\xc3\xa7\x9b\x3d\xdc\x61\x2a\x56\x7d\x1d\xbd\xbe\xb9\x9b\x7c\xac\xfa\x44\xb6\x70\x2a\x56\x3d\xa3\xb5\x43\xf0\xb3\xc8\xce\x1a\xaa\xa1\x8f\x89\x76\x0e\xc5\x1f\x7a\xea\xe8\xc3\xd5\x6c\x54\x8e\xbd\xfb\x71\x4b\xf3\xd3\x20\x55\xe8\xd8\xe9\xe3\xbf\xe4\x20\x97\x58\x37\xa0\x54\x3b\x8b\xb2\x33\x2e\x22\x86\x29\x12\x51\x65\x8f\xd5\x21\xa2\xf2\xe9\xcc\x66\x4d\xf2\x3c\x49\x46\xb6\x9f\x55\x62\xf5\x6c\x0e\xf1\x80\x0b\xf3\x7c\xb0\x45\x6c\xa0\x89\x66\x3b\x1b\xc8\xf6\x5e\x58\xb2\xba\x4f\xab\x5d\x59\xdb\x98\x37\x1d\xda\x6d\xd9\x68\x3b\xdc\xe0\x4d\x1f\xec\x1f\xb7\x6d\x5b\x05\x66\x2b\xf5\x65\x67\x7d\xbd\x05\x26\x3b\xd8\x15\xf1\xe5\xc1\x93\xb9\x1d\xdb\x22\xd9\xde\xbe\x48\xb6\xb6\x31\x92\xad\xec\x8c\x64\x5b\x5b\x23\xd9\xc1\xde\x48\xb6\xb3\x39\x92\x55\x6c\x33\x3b\xe4\x04\xdf\xbb\x31\x3f\x92\xdd\x94\xf3\xed\xcd\x90\xe4\x16\x08\xab\x3a\x7e\xa5\x88\xd7\xdd\xd9\x25\x49\x5f\xdb\x24\x92\x55\xcd\x3c\x79\xdf\xfb\xb2\x9d\x69\x92\xdc\xd2\xae\x38\xa3\x1d\x43\x5b\xd8\x7d\x19\x2b\xc9\xc3\x1b\x2c\x5b\xa7\xe0\x86\xef\x6d\xe1\xdb\x6a\xf4\x1d\xac\x82\x64\x27\xcb\x20\xd9\xde\x3a\x48\x76\x45\xf6\x5b\xb3\x12\xde\x6a\x57\x28\x27\xbd\xc6\x38\xb4\x1d\xa4\xad\xc1\x14\x58\x19\xd6\x4a\x17\x58\xa3\x6c\x46\x7e\x33\x42\x04\x22\xe6\x1f\x24\xa3\x4c\x2a\xa3\xdd\x38\xbb\x76\xf5\x99\x33\xdf\x55\xba\x19\x3c\x01\x2c\xd2\x66\xce\xf8\x2b\x9a\x18\x21\xc7\x06\xfd\x3a\x1b\x84\x99\xcb\xaa\x08\x39\x22\xd7\x0b\xa1\xac\x44\x52\xd4\x99\xdb\xbb\x84\xe5\xde\xa8\x97\x79\xa0\xde\xaa\x94\xbd\x77\xca\xf7\xac\xe8\xb4\x46\x97\x85\x9c\x25\x78\xb2\x24\x7b\xf8\x6c\xef\xb6\x65\xd4\x2d\xe4\xa3\x6a\x31\xdf\x6d\xc5\x8f\xad\xc8\x69\x57\x03\x37\xa9\x61\xdf\x0f\xb0\xdc\x36\x10\x61\x10\xce\xbf\xa9\x8d\xe8\x05\x6a\x44\x33\xa3\xbb\x17\x72\x13\x5a\x54\xad\xc8\xe4\x6c\x54\xd6\x5c\xc5\x92\x64\xc0\x68\x53\x20\x9a\x5e\x02\x7a\x78\xb0\xb6\xa3\x62\x31\x1a\xdc\x04\xb7\xa8\x83\x23\x19\x94\xf1\x45\x08\x13\x21\x2e\xf3\xcc\xa3\x9e\x2f\x1c\x3a\x60\x48\xc6\x23\x91\xfa\x98\x7a\x1b\xd7\x6a\xa8\xc2\xd1\xcb\xd8\x96\x3b\xb5\xbf\xe3\xc0\x78\x04\x38\xd3\xc4\xa7\x9a\x62\xfe\x89\x50\x45\x3e\xa1\x50\xc9\xc9\x3e\x7e\x78\xf0\x69\x48\x48\x41\x01\x40\x6b\x7d\x15\x39\x72\x96\xa2\xa0\x65\xc5\xfe\x57\xc0\xb6\x0d\x62\x03\x86\xf6\x95\xe2\xaa\xc0\xb0\xb5\xf0\xc8\x3e\xe5\x9a\x1d\x94\x05\xf1\x08\xe2\x01\x4a\xc9\xb1\xe0\x8f\xb5\x9d\x9f\xe7\x6b\xbe\x83\x21\x51\x07\x05\xdc\x4b\x8f\x9f\xf5\x16\xd8\x2d\x8f\x61\x46\xf3\x44\xbb\xc2\xb3\x86\xf5\xe1\x49\x3f\x60\x84\x0b\xef\x2f\x71\x02\xff\x4c\xc8\x29\x8b\x63\xe0\x98\xe2\xe0\xa7\x3f\x15\x3e\x21\xa8\x44\x77\xc3\xd9\x6a\x7b\x3c\x64\xd8\xe3\x44\x89\xd1\x6a\x8f\x51\x51\x98\xd6\x50\x11\x96\x4f\xac\x0d\x40\x98\x32\x40\x6d\xa8\x94\xd8\xbc\x42\x56\xc8\x83\x49\xb6\xa0\x15\x03\xb4\x63\xb6\x8a\x00\xa7\x53\xb4\x88\xd7\x49\xfa\x94\x57\xac\x2e\x64\x06\x54\xe7\x12\xc8\x9c\xea\x1e\x36\x7e\xdf\xee\x25\xf6\x68\x77\xa6\xbb\x75\xec\x17\x53\x0f\xc0\x78\x57\x07\x0d\xbc\xb7\x17\xef\xe5\x42\x07\xf6\xfb\xc5\xb2\xdf\x35\xa4\xbf\x0d\x0e\xbc\xd6\x69\x60\xc2\xae\x7d\x41\x4c\x98\xfb\x1b\x3a\x1e\xd8\x0f\x62\x4d\x83\x36\x8e\xd7\x4f\x49\x95\x56\x43\x4c\x75\xdb\xce\x62\xe8\x13\x01\x11\x87\xb0\x87\xd8\xbb\x83\x73\xee\x6e\x3e\xf0\xb5\xb9\xdd\xb0\x96\x61\xad\x46\x1d\x0c\x18\xd3\xab\x6e\x82\x83\x42\x27\x03\x14\x11\x26\x95\x61\xb0\xd7\x21\x4b\xc1\x64\xc0\xd2\x80\xca\xe3\xd5\xf4\xc0\xb2\x6f\xf4\x6c\xa4\x40\xb9\x22\x7b\x3e\xc8\xe5\xb1\x2a\xdf\xd8\x1b\x44\xf0\xbe\xf8\x67\x31\xf6\xfe\x6f\x7f\x1c\xd4\x0a\x7e\x96\x43\x07\x4f\x52\xf0\x24\x55\x5b\xf0\x24\xad\x4f\x22\x78\x92\x9a\x5a\xf0\x24\x6d\x35\x7e\xf0\x24\xd5\x5b\xf0\x24\x05\x4f\x52\xf0\x24\x05\x4f\x52\xf0\x24\x05\x4f\x52\xdf\x8f\x6e\xc3\x93\x54\xaa\x41\xf7\xa1\x47\x57\x55\x56\x17\x29\x6f\xaf\x94\xa3\x9a\x45\x65\x5e\xac\x7f\xcb\xfe\xeb\xa1\x94\xea\xaa\x1a\xbc\xab\x4a\x5d\x55\xd0\xd7\x2c\x18\x83\x35\xea\x46\xfd\xb9\xd0\xb0\xd7\xc6\xb8\x25\xd5\xfa\x4f\x6e\x5c\xaa\x84\xf0\xde\x07\x39\x5c\xf8\x64\x1e\x77\x4b\xe5\x14\xca\x4c\x9f\x98\xec\x7b\x63\xef\x81\xd9\x70\x2e\x74\xfd\x21\xd7\x6c\x5c\xbe\x51\x84\x48\xa3\x4d\xda\xd7\xb3\x1b\x02\x74\xaf\xb3\x94\xc6\x4f\x97\x61\x54\xa4\xb4\x94\xd8\x66\xf8\x3f\xc8\xda\x6c\x99\x72\xb7\x78\x62\x72\x9e\xcc\x39\x37\xe2\x91\xe0\x2e\x8f\x65\xc0\x4c\xec\xd1\x62\xed\xcc\x8e\x2a\xad\x32\x85\x6b\x44\x8d\xaa\xdc\xa6\x4a\x0a\x04\xd5\xf6\x4e\x50\x57\x75\x4a\x70\x67\xa5\x37\xbf\xd8\x7e\x06\x4c\xa2\x20\x58\x84\x27\x2b\x56\x34\x84\x56\x5f\x20\x8d\x56\x27\xcb\x14\xee\x23\x4d\x12\x71\x3d\xe4\x7c\x1a\x48\x11\x5b\x97\x47\xec\x8d\xbd\xd7\x83\xeb\x28\xae\xe4\x0b\xf4\x95\xd5\x43\xb1\xc5\xd6\x16\x8a\x2d\x7e\x1e\xc5\x16\x2b\x8e\xd8\x6a\xd5\xc5\x6e\x58\x61\x55\xc6\x3b\xad\xba\x48\xc8\x7f\xbb\x2b\x46\x25\x58\xef\x69\x9e\x68\x96\x95\x79\xd6\xca\xee\x50\x62\x55\xea\x99\xcb\x87\xac\x53\xaf\x99\x0d\x8d\x16\x9d\x43\xad\x50\x39\x8e\x87\x79\xdb\x0a\xb9\xa9\xcd\x19\x44\xfb\xbb\x2d\x75\xe8\x75\x6d\x9b\x78\xc9\x1e\x3a\x9f\xac\x17\xff\x7b\xee\x2e\xab\xae\x3a\xe1\x15\xd9\x37\xa7\x63\xb2\x74\x6e\xeb\x1a\x23\xac\x1d\xab\x3d\x06\xb0\x76\xb0\x2b\xf0\x02\xea\x9c\x5d\x01\x2f\x4f\xdf\x7d\x75\x70\xe0\x65\xe2\x55\xf9\xa1\x47\xef\xbb\x48\x18\x7d\xb8\xf6\x50\xc9\x60\xe5\xbc\xef\x31\xc2\x06\x89\xe0\x9b\xca\x29\xfb\x5d\xb7\x4c\xd0\x63\x10\x4b\xd2\x3e\x41\xb5\xb2\xd1\xa5\x2c\xd0\xd9\xcb\x1d\xe6\x01\x0e\x49\x36\x1b\x66\x15\xdf\x22\xc9\x6c\xdb\x5a\xa1\x77\x9b\x5c\x76\xa7\x89\x65\x5f\x4e\x49\xcf\x07\x76\xff\x7d\x01\xf5\xa8\x3e\x13\x77\x5f\x28\x48\xd5\xd4\x1e\xaa\x20\xd5\x9d\xbb\xf3\xbe\xb8\xba\x54\xf7\xea\xbe\xbb\x1f\xd7\xdd\x17\x56\x97\xea\x41\x5c\x75\x9f\x79\x85\xaa\xbb\x73\xd1\x85\xf2\x4f\x0f\x53\x61\x73\xa8\x1b\x6e\x7b\xaa\x7a\x50\xf7\xdb\x83\xba\xde\x1e\xde\xed\xb6\x95\xac\xb2\xab\xbb\x6d\x30\x99\xec\xea\x66\xdb\x26\x67\x60\x3b\x7c\xbe\xbf\x24\xad\x7b\x4e\x12\xf8\x3c\x92\xb3\x1e\x28\x33\xe0\xa1\xb2\x02\xee\x36\x23\xe0\x01\x92\xb1\xee\x29\x11\xeb\x01\xe3\xff\x87\xca\x1c\x83\x24\x8d\xdd\x18\xe7\x36\xe2\xc0\x96\x09\x57\x5b\x32\xcf\xfb\x4c\xb4\xfa\x13\xf0\xcf\xad\x12\xac\x02\x0b\x7d\x20\x16\x7a\x7b\x09\x55\xf7\x97\x4c\x15\x18\xa9\x6b\x3b\x33\xd2\x2d\x93\xa6\x6e\xcd\xae\x7f\x37\xc9\x52\xf7\x9d\x28\x75\x07\x49\x52\x0f\x91\x20\x75\x07\xc9\x51\xc1\x1b\xd2\xb3\x05\x6f\x48\xdf\x16\xbc\x21\x4d\x2d\x78\x43\x56\x5b\xf0\x86\x04\x6f\x48\xf0\x86\x04\x6f\xc8\xfa\x80\xc1\x1b\x12\xbc\x21\xfd\x5a\xf0\x86\xdc\x8f\x37\x64\x68\xc2\xd1\x76\xb8\xfc\x30\x89\x46\xf7\x9b\x64\x74\xfb\x09\x46\x0f\x98\x5c\xf4\x27\x33\xb8\x0c\x4e\x24\xda\x0e\xcd\x3f\x97\x04\xa2\xcf\x23\x79\xe8\xc1\x13\x87\x76\x4d\x1a\xba\x9d\x84\xa1\x01\xd8\xbe\x25\x9e\x67\x22\x3e\xe6\x9a\xed\x7a\xe9\x55\x15\x01\x9b\x6e\xbe\xa2\x57\x82\xc5\x24\xcb\xb5\xbb\x6c\x27\xdc\x7e\xd5\x89\x03\xf7\x73\xfb\x55\x6d\xf3\xc2\x15\x58\x6d\xed\xb3\xb9\x02\xab\x69\xcf\xc2\x3d\x58\xf5\x16\xee\xc1\x0a\xf7\x60\x85\x7b\xb0\x6c\x0b\xf7\x60\x85\x7b\xb0\x42\xf5\xc2\x50\xbd\x30\x54\x2f\xec\xff\x55\xa8\x5e\xd8\xdc\x42\xf5\xc2\x21\x2d\x54\x2f\xec\x3d\x7a\xa8\x5e\x18\xaa\x17\x0e\x1b\x38\x54\x2f\x24\xa1\x7a\x61\xa8\x5e\xf8\x05\x57\x2f\x0c\xf7\x60\x7d\x11\x77\xb1\x84\x8b\x58\x06\x8c\xfd\x79\x5d\xc4\x12\xee\xc1\x0a\x57\xb0\xac\xb6\x70\x0f\xd6\x17\xc4\x7b\xc3\x3d\x58\x5f\x32\xfb\x0d\xf7\x60\x05\x26\xbc\xb9\x85\x7b\xb0\xc2\x3d\x58\x9d\x2d\xdc\x83\x15\x3c\x49\xc1\x93\x54\x6f\xc1\x93\xd4\xde\x82\x27\xa9\xab\x05\x4f\x52\x6b\x0b\x9e\xa4\xe1\x2d\x78\x92\x82\x27\x29\x78\x92\x82\x27\x29\x78\x92\xc2\x3d\x58\xe1\x1e\xac\x3e\x10\x0c\xf7\x60\x6d\x6e\xe1\x1e\xac\x70\x0f\x56\xb8\x07\xcb\xb6\x70\x0f\x56\xb8\x07\x6b\x73\xf3\xb7\x48\xd5\x32\xa2\xbe\xdc\xcb\xb0\x86\x2f\x23\xdc\x88\x15\x6e\xc4\x6a\x68\xe1\x46\xac\x70\x23\xd6\xa6\x16\x6e\xc4\x0a\x37\x62\xb5\xb4\x50\x03\xb2\x67\x0b\x35\x20\xfb\xb6\x50\x03\xb2\xa9\x85\x1a\x90\xab\x2d\xd4\x80\x0c\x35\x20\x43\x0d\xc8\x50\x03\x72\x7d\xc0\x50\x03\x32\xd4\x80\xec\xd7\x1e\xde\x01\xf7\xaf\x51\x03\x32\xdc\x88\xf5\x59\xde\xe8\x12\xae\x73\xe9\x68\x9f\xcf\x75\x2e\xe1\x46\xac\x7f\xcd\x8b\x5c\xc2\x8d\x58\x9f\x31\xff\x0c\x37\x62\x75\xb7\xcf\x87\x85\x86\x1b\xb1\xfe\x95\x19\x69\xb8\x11\x2b\xdc\x88\x55\xb4\x70\x23\x56\xf0\x86\x34\xb6\xe0\x0d\x21\xc1\x1b\x52\xb4\xe0\x0d\xe9\x35\x6e\xf0\x86\x04\x6f\x48\xf0\x86\xb4\x4f\x3a\x78\x43\x82\x37\xa4\x73\xf0\xe0\x0d\xf9\xd3\x7b\x43\xc2\x8d\x58\xe1\x46\xac\x0d\xed\x4f\x66\x70\x09\x37\x62\x85\x1b\xb1\xfe\x9c\x37\x62\xc1\x8d\x96\x34\xd2\x27\x82\x6b\xe0\x8d\xd9\x46\x7d\xd1\xf9\x45\xad\x37\x73\xba\xce\xd8\x3c\x97\x4e\xef\x9f\xbf\x3f\x3b\x21\x11\xd5\x34\x11\x73\x72\x26\x62\x6b\xd7\xc6\x2f\x8a\x9f\x53\xd0\x34\xa6\x9a\x16\x2e\x11\xa3\x1f\x5f\xb1\x18\x99\x6a\x0c\x37\x84\xa5\x74\x0e\x86\x79\x35\x4e\x22\x57\x40\x28\xb9\x86\x24\x19\x5f\x72\x71\xcd\xc9\x15\x48\x55\x61\xd7\x9f\x44\x96\x7e\x22\x0a\xe4\x95\xbd\x55\x0a\x6e\x32\x83\x68\x4c\xdb\x73\xdf\xcf\xa4\x3a\x5c\x19\x9e\x7f\x62\x9f\x9e\x63\x38\x73\xdb\x05\x4d\xc5\xda\x71\x99\x66\x4e\x4f\x8c\x60\xff\xc4\x10\x75\xae\x7c\x2e\xc1\x8c\x25\x30\x9e\x52\x05\xb1\x1f\x57\x19\x5a\x13\x32\xb6\x73\xcb\x35\x4b\xd8\xaf\xe0\x4e\x13\x6b\xf7\x6e\x42\x9b\x1e\x02\x47\xb7\x21\x64\x4c\x22\x1a\x2d\xe0\x39\x6b\x36\x61\x8c\xfd\x54\x9b\x5f\xea\x63\xd3\xf0\xe3\xf4\xbe\x80\xed\xc4\x7d\xe0\xad\x16\x31\x93\xc8\x9c\x96\x44\x69\x21\x3d\x44\x33\x09\xe3\x88\x26\x51\x9e\x20\x2b\x3a\x3e\x3b\xb5\x23\x75\x5f\xa1\xd6\x41\x62\xe5\xa2\x07\xcc\xd8\x7f\xd2\x3e\xe7\x75\x2c\x40\xc1\x14\xed\x94\xbb\x4c\x3b\x85\x54\xc8\xe5\x05\x95\x73\xd8\x99\xb4\xdf\x54\xfa\x5a\x25\xec\x7f\x7f\xf5\xee\xcd\x8b\x37\xaf\x4f\xdf\x9c\x5e\x38\x7e\xed\x3d\x74\xab\x24\x3f\x29\xbd\x40\x44\x89\x99\x76\x53\x24\x09\x4b\x99\x2e\xbe\xb2\xb4\xd9\xac\x4a\x5b\x7e\x8e\x29\x85\x39\xd7\x2c\x05\xeb\x8e\xa3\x5a\x1b\x51\xc7\xd0\x4d\x0a\xa0\xf1\xce\xb6\x94\x5e\x82\x61\xba\x64\x9e\x53\x49\xb9\x06\x7f\x44\x30\x6d\x3f\x8a\x05\x51\xc2\x29\xf8\x4c\x95\xae\x3b\x05\xda\x26\x52\x9d\x89\x66\x56\x83\x3d\x2c\xe8\x95\xbd\x54\x6b\x26\x0c\x5f\x37\x9b\x9a\x8a\x98\xcd\x58\x64\x2d\x46\x24\xa5\x71\x91\xfc\xe3\x14\x0e\x90\xc5\xb1\x58\x2e\xb8\x8d\x2a\x57\xc1\x0c\xfc\x8a\x49\xc1\x51\x91\xba\xa2\x92\xd1\x69\x02\x85\x53\x52\x81\xb6\xe3\x95\x0b\xe2\x64\xba\xd4\xd0\xcc\xae\xec\x08\x6e\x37\xdc\x6d\x6c\xcd\xfd\x3d\x7a\xd4\xd8\xd1\x45\x99\xa6\x57\x4a\x31\xa6\x03\xe6\xf2\x37\x62\x50\xcc\x71\x45\x09\x71\x1e\x79\xd8\x09\x9d\x49\x66\xd5\x42\x5a\xa0\x8c\xe3\xd2\x54\x91\x34\x37\x47\xb8\x11\x8f\x94\x62\xd3\x04\x46\x46\x08\x62\xcd\xf9\x45\x65\x1f\x53\x30\x60\xc6\x9e\x50\x34\xb9\x02\x83\x70\x06\x91\xad\x0c\x0c\x60\x24\x24\x81\x37\xa3\x51\x2b\xe7\x78\x47\xae\x39\xa8\x23\xe7\xc6\x3f\x9d\x91\xa5\xc8\x65\xed\x5c\x58\x50\x83\xc8\x48\xbe\x8d\x13\x71\x39\x81\xc8\x84\x46\x24\x06\xa3\x51\x30\x6e\x8e\xa8\xb9\x10\xb1\x51\x2c\xa4\xb8\x61\x29\x8e\xe2\x28\xa0\xd8\xb6\xe9\x92\xc4\x22\xb7\x1e\x51\xc4\x13\x73\x16\xb8\x63\x2c\xa3\xd1\xa5\x99\x03\x76\xdc\x96\xcd\x79\xa8\xd3\xec\x10\xdf\x72\xff\x75\x5f\xaa\xc9\xcf\x4a\xf0\xd2\x15\x5e\x2c\x6b\xd2\x6f\x7b\x99\x22\x53\x50\x7a\x0c\xb3\x99\x90\xfa\xef\x66\x83\x73\x8e\x64\xc3\x45\x01\x41\x8f\x42\x18\xf7\x80\xe0\xc6\xb4\x9c\x3a\xdd\x0b\xb9\x81\x85\x54\x90\xaf\x89\x09\x66\x86\xe2\x25\x3f\x22\xff\x77\xff\x9f\x7f\xf9\x7d\x7c\xf0\xfd\xfe\xfe\x87\xa7\xe3\xbf\x7d\xfc\xcb\xfe\x3f\x27\xf8\x8f\x27\x07\xdf\x1f\xfc\xee\xff\xf8\xcb\xc1\xc1\xfe\xfe\x87\x1f\xde\xbc\xba\x38\x7b\xf1\x91\x1d\xfc\xfe\x81\xe7\xe9\xa5\xfd\xeb\xf7\xfd\x0f\xf0\xe2\x63\xcf\x4e\x0e\x0e\xbe\xff\xf7\x86\x09\x51\xbe\x7c\x37\x6b\x25\xe3\x5e\x19\xcd\xe3\x3e\x27\x52\x4d\xd8\x63\x5c\x8f\x85\x1c\xdb\x0f\x8e\x88\x96\xf9\x66\x21\xd7\x48\xc4\x5d\x4e\xe3\xbe\x27\xc2\xdb\x4a\x5f\x2b\xbe\x24\x77\xb1\xa1\x33\x64\x9a\xd9\x14\xbc\x3d\xb3\x72\xdf\xcc\x6c\xbb\x57\x08\x9a\x0f\xb9\xf3\x0d\x3d\xa2\xa4\xef\xbe\x7c\xac\x7c\x40\xc6\x4a\xff\x2b\x89\xc9\x96\xe7\xb7\x8d\xd5\x43\x7a\x1a\x66\x9c\xe9\xdc\xc2\x4c\x32\x21\x99\x5e\x9e\x24\x54\xa9\xb7\x34\x85\x5d\x37\xe4\x74\x56\x2a\x68\x23\x43\xd0\xe6\x04\x72\x47\xb4\x8b\x90\x71\x43\x36\x03\xfc\x74\x86\x1a\x4a\xa5\x1f\x0f\x54\xff\x6d\x41\x98\x9e\xc4\x85\x24\xbf\x82\x14\xee\x8a\x4b\x09\x56\xcb\x69\x1c\xc1\x7d\xd6\xbe\x0f\x2d\x60\x53\x10\xe5\x08\x36\x23\x21\xdd\x18\x5d\x63\xc6\xe6\xbb\x82\xee\x7c\x53\xa7\x24\xa2\xdc\x2c\x14\x2f\x6d\x9d\x91\x4f\x09\xcc\x69\xb4\xfc\x64\x16\xfc\x49\x82\x99\xa2\xd1\x0e\x3f\x59\xb5\xa1\xa6\x18\xb8\x60\x24\xa6\x08\x30\xbc\xc7\x97\xf1\x9f\xad\x2a\xe9\xf5\xf2\xc6\x99\x48\xac\xc9\x90\x89\x78\x62\xf6\x60\xb2\xb2\x5a\x64\xa1\xc5\xc3\x42\x98\xf8\xf0\xe4\xe3\xda\x9b\xce\xce\xa9\x85\x55\x37\xab\xc4\x21\x73\x64\xfb\x6d\x92\x8d\x07\x08\x39\x8e\x53\x86\xc6\x59\xb2\x7f\x76\x7e\x7c\x50\x5b\xb9\x91\x73\xec\x41\x1c\x0b\xf0\xe1\x40\x66\x20\x55\x9a\x59\xf1\x10\xc5\xb4\x4f\x4b\xc2\x98\xf7\xe9\xe7\x62\x00\x8c\x96\xd7\x96\x54\x67\x3f\xd9\xf3\x63\xf2\xc9\xc8\xc8\x09\xe3\x60\xf7\x20\x93\xec\x8a\x25\x30\x37\x33\xa9\x84\x38\x78\x67\xcd\xe6\x3d\x65\xca\x9c\x52\x75\xf4\x4e\x31\x6f\xd9\xa2\x75\x0b\xde\xba\x93\xdb\x45\x9b\x54\xec\x7e\x8f\x15\x4e\xcf\x4b\xc5\xa5\xc0\x50\x7b\x0b\xd1\x81\xcf\x84\x8c\xcc\x71\xbe\x01\x8e\xda\x25\xf6\x1b\xd0\xb4\x8b\x9c\x68\x18\x2a\xf4\x4b\xaa\x0c\xed\xd5\x3a\xbc\xa6\x95\xea\x09\x13\xf2\xce\x20\xe1\x35\x53\x30\x2a\xe4\xde\x8d\x5d\x78\x0c\xbf\xa6\xcd\x92\x62\xa5\xdb\x73\xfc\xe7\xd2\xfa\xa1\x9c\xa1\x06\xd1\x1d\x05\xa9\x26\x7a\x21\x12\x94\xe1\x1b\x8c\xdb\xaf\x58\x6c\x65\x1f\x90\x52\xc8\x89\x2d\x6f\x60\x35\x64\x91\xc4\x2d\xa7\x64\xa1\xa8\x1b\x99\x05\xcd\x50\x16\xbf\x38\x72\x30\x87\x36\x9b\xc1\xdc\x80\x1b\x75\x81\x55\x8b\x62\x09\x6d\x12\xd1\x1b\x81\x45\x11\x6c\xe5\x11\xb3\x0e\x3a\x15\xb9\xb6\x08\x61\xf9\xc7\x4c\xe4\x3c\x26\x86\x35\x1e\x91\x85\xd6\x99\x3a\x3a\x3c\x2c\xcf\xee\x09\x13\x87\xb1\x88\xd4\x61\x24\x78\x04\x99\x56\x87\x9e\x92\x0f\x33\x11\x8f\xfd\x1f\x63\xea\x09\xf1\xf0\xf1\xb6\xac\x93\x10\xe0\x79\xcb\x2d\xaf\x63\x62\xd7\xdb\xf2\x42\x09\xce\x8d\x2f\x69\x91\xb8\x50\xce\xc6\x93\xb1\x7e\xf7\x6f\xf9\x7e\x71\x37\x71\x21\xfb\x57\x58\xe9\x63\x55\xed\xba\xfd\xec\x68\xb3\x3a\x77\xd8\x99\xfb\x9b\x6d\x2f\x3c\x37\x35\xf2\x70\xb9\x0a\x94\x83\xb4\xa6\x78\x6d\xb1\x51\x99\xec\x13\xc3\x08\xf9\x92\x18\x66\xad\xdd\x1d\xda\xd6\x5c\xd9\xa6\xdd\x2f\x8c\xe4\x84\x95\x3d\xbe\x29\x5c\x72\x23\x98\xcd\x20\xd2\xdf\x55\x4c\x48\x45\x6d\x8a\xc2\xe5\xf5\x8d\xff\xd7\x77\xcd\xe7\x7c\x2f\xef\x54\xbf\xd0\x14\x3b\xa5\x76\xbb\xf8\x30\x7b\xf8\x0b\xec\x71\x45\x82\xb1\xc0\xb3\x83\xa1\x8a\x8f\x7e\x6b\x67\x64\xb5\x1e\x0b\x27\x19\x26\x49\xed\xe5\xce\xe0\x0c\xe4\x38\x95\x23\xc1\x99\x67\x4b\x4f\x21\x90\xb7\xc2\x15\xf9\x81\x11\x39\xc3\xab\xa4\xcb\x5f\xf0\x4c\x7e\x2b\x6c\xb9\x9f\x8e\x80\xd4\x9e\xc6\xdc\xce\xd8\x9e\x61\xf0\xfc\xa1\x0c\xf5\xb1\x80\xa9\x85\xfa\x94\x84\x55\xf5\x91\xb5\x02\xf6\x12\x96\x9d\x50\x75\xc7\x9f\x0b\x33\x42\x1f\xd4\xa8\xc4\x51\xaf\x1b\xd8\x28\x8a\xbf\xbb\x9a\x10\x22\x9d\x32\x6e\xa7\x62\x07\xf6\xfb\x8c\x63\xfb\xfd\xe0\x31\xfe\xd9\x3d\x89\x9e\xd0\xee\x17\x6f\x34\x0c\xe4\xef\x06\xc4\x12\x15\x5e\xe9\x2e\x90\x6e\x8a\x19\xaa\x04\x0a\xbd\xf8\x25\xa7\xc9\x84\x3c\xb7\x02\x36\x02\xcf\xfe\xd4\x45\x6e\xb6\x8b\x35\x5f\xfd\x35\x4b\xe2\x88\xca\x18\x75\x2b\xcb\x7e\x88\x12\x16\x71\xa8\x97\xdf\x3a\xfa\xf6\x0c\xb0\x44\x1e\x7b\xc9\x3b\xc9\xa8\xd4\x2c\xca\x13\x2a\x0d\xc3\x87\xb9\x90\x1d\x81\xf2\x3d\x37\xb3\xc4\xe6\x73\x88\x04\x8f\x3b\xbc\x8a\xc3\x76\xf5\x62\xb5\xf3\xea\xf6\xa2\xe4\x06\x92\xb9\x3a\x33\x2c\x85\x55\xf2\xda\xaf\xe9\xc5\x1d\x63\x89\x99\x67\x76\x05\x6f\x19\x59\xf1\xca\x08\x72\xd5\x72\x58\x4c\xf9\x34\x84\x83\xca\x81\x53\x50\xfb\x84\xfc\xd7\xd2\x6b\x5d\x5d\xe1\x49\x4c\x7b\x1f\x15\x1a\x72\xdc\x7c\x1d\x29\xba\x9d\x2c\xd9\xc8\x4c\x48\xb8\x02\x49\xf6\x63\x81\xdf\x60\x59\xab\x83\x09\xf9\x87\x51\x07\xdb\x5c\x34\xb6\x71\x98\xdb\xc2\x48\x8e\xb0\x8b\xec\x10\x09\x68\xbb\xa7\x8a\x3c\x25\xfb\xb6\x56\x16\x4b\x53\x88\x19\xd5\x90\x2c\x0f\xbc\xfc\x6d\x2d\x6b\x7d\xb0\xa6\x4f\x09\xb9\x4a\xe9\xb8\xaf\xff\xa3\xe5\x4d\x9c\xec\x6d\x22\xd5\x4f\xde\xe4\x5c\x02\xd6\xca\xd2\x2b\xd8\x53\x78\x38\x3b\x03\x18\x1a\xa3\xd5\x46\x25\xaf\xa9\x08\xbb\x9e\x37\x17\xb8\xf5\xb3\x41\x50\x4a\x24\xcc\x91\x3e\x2d\xcd\xed\x40\x9d\x2c\xda\x5c\x04\xaf\x43\x08\x69\xf7\x56\x8d\x89\xd1\x06\xbf\xfe\x8f\x98\x6a\xda\xf0\x82\x45\x99\x65\xb6\x89\xd4\xba\x64\x9b\xb2\xf3\xa6\xbd\xee\xe1\x7e\x71\xc3\x6f\xd5\x03\xaa\x35\x9b\xbe\xec\x83\x5d\xa7\x68\x9e\xb6\x71\x94\x1e\x0d\xc6\x12\xe6\x4c\x69\xb9\xac\x38\x21\x9c\x7b\x53\x10\xc6\x95\xa6\x5c\x33\x64\xd5\xc4\xbf\x39\x76\xf6\xf7\x6b\xa6\x1b\x42\x04\xdf\x19\xed\x1d\x8d\xbb\x98\x22\x64\xcd\x1f\x17\xcb\x0c\xc8\xb7\x95\x3f\x5e\xc9\x2c\xda\xfc\xfd\xe9\x8c\x38\x06\x6a\x71\x93\xc6\xb1\x04\xb5\xce\xd9\x36\x7d\xdd\x0a\x3e\x6f\xae\xda\x16\x82\x67\xde\xdc\xe5\xb2\x94\x94\x62\x73\xa3\xa4\xf8\xaa\x99\xde\x9f\x53\x53\x56\xcc\xaf\x6e\x60\xeb\xb5\x85\xb4\x38\x31\x99\xf6\xfa\x60\x24\xb8\xca\xd3\xd2\x8e\x10\x43\x06\x3c\x06\x1e\x2d\xb1\x50\x56\x72\x05\x0d\x21\x3e\x3f\xaa\x06\x94\x20\xe4\x7f\xb3\xb9\x51\xbc\xdd\xe4\xaa\x92\xb3\xf7\x5c\xaf\xcc\x94\x29\x03\xf8\x19\x48\xa3\xfe\x63\x56\x8f\x11\x7a\x7d\x0f\x15\x4f\xa4\xab\xdc\xe5\x03\x4e\x57\x27\x8b\xe5\x13\x37\x4f\xf7\xa2\xa8\xf9\xe9\x5d\x16\x1e\xa6\x96\x03\x19\x70\xcc\x85\xf5\xf4\x67\x42\x31\x5f\x24\xaf\x38\x17\x6a\x75\x43\xc5\xcc\x56\xf5\x6c\x1e\xab\x9e\x7e\x87\x41\xda\x2b\x8b\x46\xeb\x5b\xce\xed\x66\x42\xd5\xa6\xe9\x79\x61\x43\x65\xd2\x8b\xf5\xad\x2e\x22\x6c\x30\x67\xaf\xbe\xb4\xf2\x2c\x93\x94\x5f\x42\x4c\x12\xb8\x61\x91\x98\x4b\x9a\x2d\x58\x84\x25\x20\xad\xbb\xd7\x68\x8c\xda\x86\x57\x35\x63\x78\xd3\xe9\x95\xe5\xd3\x84\xa9\xc5\x66\xc7\x61\x2b\x71\x28\x88\x24\xe8\x8d\x9c\xaf\x0f\x6d\x9c\xdb\xcf\x4b\xe1\xc7\x07\xc3\xbb\x7e\x5d\x2e\x89\xc5\x76\x9f\xf1\x4a\xa3\xc8\x10\xb6\x77\x82\x82\x93\x04\x2b\x44\xd4\xc0\x21\xb4\xf7\x34\x99\x5e\x2e\x01\x32\x8b\xcf\x18\xc4\xa6\x52\xb4\x2e\x2a\xc6\x23\xc0\x92\x96\xae\x34\x29\x80\xf7\x02\x68\xc9\xc0\x4a\xb0\x80\x8e\x3f\xbf\x8b\xc0\xf5\x66\x89\xb3\xdd\x88\xd0\x62\x40\x68\x87\x78\xc1\x0b\x3b\x81\x5e\xe1\xa1\x5e\x28\x30\xff\x36\xe0\xc5\x27\x43\x37\xdb\x56\x30\x3d\xb7\x61\xe2\x5b\xf3\xc3\x1f\x6b\xbd\xb8\xf8\x2e\x45\x16\xe2\xda\x0d\xb0\xca\x31\x9c\x5d\xce\xa3\x41\xcc\x54\x64\xd8\x4c\x83\xe1\xe8\x44\x70\xe5\x2b\x96\x52\x6e\x8b\x8c\x5e\xd1\xc4\x65\xee\xba\xc1\x32\x91\xa0\x2b\x34\xce\xbd\xbe\x6a\xd3\x92\x20\x9d\x42\x1c\x43\xec\x63\xe1\x97\xa4\xe1\xd0\xef\x10\x38\xba\x64\x02\x7f\x2c\x9e\x89\x24\x69\x3f\xd3\x5b\x0d\x2b\x7d\xcc\x2a\x1e\x00\xbd\x63\x4d\x3a\xc4\xcc\x53\x0f\x50\xa6\x0a\x8a\x2c\x7d\xd1\x88\x64\x46\x61\x29\xe0\x3e\x05\x7d\x0d\xc0\x49\xb4\x80\xe8\x52\x95\xf1\x77\xda\xd0\xe1\xca\x46\xbb\xf8\xaa\x76\x01\xb1\xca\x41\x0b\xc1\xd4\x6c\xa8\xcb\xbe\x07\xc2\x8c\x5a\xc8\xe1\x7a\x35\x5e\x6b\xfd\xe0\xa2\x57\x94\x25\x74\x9a\x74\x28\xcc\xa7\xb3\xf2\xcd\x51\x75\xfe\xcc\x4b\x47\x59\x9e\x24\xce\x2f\x8d\x91\x2a\x5a\xd2\xd9\x8c\x45\x18\xc0\x88\x91\x3a\x65\xc4\xef\xc6\xa5\x6f\x15\x9d\xa3\x34\xd5\xf9\xda\xd6\xb7\xe0\x4d\x1b\xbe\x18\x2d\x94\x35\xda\x5b\xfb\x60\xc8\xfb\xba\x06\x6b\x66\x07\x56\x45\xaf\xb9\xb4\x26\xe4\xad\xd0\x2e\x12\xee\x0d\x28\xe5\xa2\xf0\xc8\x7b\xa0\x4a\xf0\xca\x51\x80\x9a\x87\x64\x73\xc6\xe9\xe6\xf2\x09\x76\xfd\x55\x93\x79\xa1\x68\xd2\x25\x96\x74\x66\x73\x49\x75\xc1\xc1\xcb\x25\xba\x43\xd3\x89\x05\xb3\x1c\xa3\xe1\xc8\x31\x5f\x22\xda\xb8\xf0\xb8\xcd\x36\x55\xc6\xb5\x14\x71\x1e\x81\x2b\x5e\x9d\xab\x6a\xc7\xb7\x7a\x0e\xf4\x23\xcb\x13\x3f\x78\x99\x83\x10\x83\xa6\xcc\xb9\xb2\x05\x07\x42\x55\x66\xd4\x7f\x4f\x06\xb9\x94\x78\xd4\xfa\x0d\xc2\x53\xf0\xf8\xec\x94\xbc\x87\x76\x6c\x1c\x8f\x9b\x26\x81\xd1\x1c\x4a\xcb\x3c\xc2\x43\xd6\x50\x3f\x8f\xdd\x71\x69\x09\xc0\x46\x53\x56\xf2\xb1\x9c\xd1\xd0\x4a\xc5\x19\xd5\x0b\x32\xb1\x1b\x3a\xa9\x80\x93\x90\x97\xe6\xc0\xbd\xa1\x69\x96\xc0\xa8\xd1\x79\xf2\x6f\x78\xb0\xbd\x14\xe2\xdc\xa2\x84\x9d\xc9\x6f\x4d\x6f\x9b\xff\x1c\x1e\xae\x22\xac\x98\x1a\x25\xc5\xf9\x10\x10\x6f\x67\x42\x3c\x56\x75\x78\x35\x81\xc6\xf7\xf9\x03\x06\x8a\x6e\x58\x09\xce\x90\x4a\x38\x22\x7b\xc7\x9e\x97\xec\x8d\xc8\xde\x99\x14\x73\xcc\x5a\xe1\x73\x97\x5b\xb2\xf7\x1c\xe6\x92\xc6\x10\xef\x75\x8c\xf5\x17\xcc\xb8\x7a\x03\x72\x0e\x3f\xc0\xf2\xdb\x86\xa3\x6a\xfd\x0b\x7f\xf6\x7e\x8b\x79\x5b\x5d\x9f\x18\xf1\xc8\xc8\x10\xdf\xa6\x34\xeb\xf3\xee\x1b\x9a\xf5\x99\xcd\x49\x49\x8c\x1f\x3e\xa6\xa0\xe9\xd5\xb3\x49\x89\xca\x9f\x7e\x56\x82\x1f\xed\x95\xf0\x1b\x89\x94\x61\x50\xde\x72\x8f\xd4\x16\x71\xb4\x87\xab\x70\xbf\x7a\x60\x1c\xed\x99\xf1\xf7\x0c\xc7\xd3\x62\x9a\xcf\x8e\xf6\x30\x6a\x6d\xf4\x6c\x24\x21\x1b\x19\x29\xf9\xdb\xb2\xef\xbd\x4f\xcd\x88\xe5\x56\x66\xbd\x91\x88\xab\x4d\xae\x96\x7f\xfb\xa3\x45\x98\x6b\x39\xc6\xbb\x42\x69\xc7\x24\xa1\x4a\x5f\x48\xca\x15\x4e\xf7\x82\xa5\x4d\x80\x1d\x93\xd4\x32\xd4\xc6\xe7\x12\x99\x6c\xe3\x63\x8b\xb6\x8d\x8f\x1b\xf7\xb4\x5b\x10\x59\x5f\xc3\x6d\x38\xcf\xd6\x7b\x2d\x33\x91\x8d\x98\xef\x4d\xa7\xc5\x5e\x9b\x83\xd9\xbd\x0d\xae\x5e\xbe\x61\x90\xee\x24\xc1\xb4\x32\xdc\xea\xb6\xf3\xd8\xf2\xba\xc2\xe8\x75\xed\x9d\xed\x39\x8f\x41\x26\xe8\xc4\x2e\xc7\x8b\x16\x46\xe7\x8c\x27\xce\x96\x46\x0b\xb3\x28\x46\x94\x3b\x57\x7d\xe9\x83\xb3\x31\xa8\xbe\x47\xc3\x93\xdd\x45\x05\xb6\x1b\x94\x59\xa2\x08\x32\xdd\x2e\xb4\xf4\x32\x71\x7b\x3b\xa5\x91\xb9\xc7\xba\x19\xab\x1c\x4e\xdd\xc6\x7e\xb9\xae\x6c\x90\xd7\x22\x4f\xa9\x39\xef\x69\x8c\x31\xa7\xc5\x33\x6b\x72\xb0\x26\x02\x7b\x8e\x59\x47\xb8\xf5\x63\xfa\xed\xeb\xdc\x21\x27\x03\xd0\xa2\xaa\x45\x87\xf1\xb1\x17\xcc\x52\x7a\xf3\x1a\xf8\x5c\x2f\x8e\xc8\x5f\xbf\xfa\x5f\x5f\xff\x67\xc3\x8b\xf6\x28\x81\xf8\x15\x70\x67\x74\xbd\x0d\xe8\xad\xf7\xba\xea\x35\x98\xf8\xac\x87\xc9\xbc\x7c\xa7\xf0\xcf\x95\x58\x89\x51\x1d\xa0\x9d\x18\x94\x67\xed\xe0\x7c\x89\x79\x3b\x4a\x53\x1e\xc1\xc8\x48\xd7\x1b\x87\x61\xc5\x49\x99\x2c\xc9\xb3\xaf\x46\x18\x35\x8d\x93\x5a\x3b\x0c\x3f\xdc\x7c\x9c\x6c\x58\x0c\x53\xe4\x6f\xa3\x95\x99\x32\x45\xcc\xde\x8b\x19\xa2\x69\xcb\x24\xd1\x8a\x22\xc1\x4a\x3a\xde\xa6\xb6\x2e\xe9\x40\xb1\x92\x2e\x4c\xe8\x32\xf5\xf7\x33\xf3\xa7\x8c\xb3\x34\x4f\x8f\xc8\xd3\x86\x57\x2c\x47\xbe\x0d\xf4\xb0\x3d\x95\x52\x20\x35\x6c\x79\x2e\x69\x9a\x62\x72\x23\x8b\x81\x6b\x36\x63\x18\x44\x56\x90\x18\x9a\xc5\xec\x87\x3e\xf0\xb1\x00\x3e\xc6\x44\x1a\x36\xda\x8b\xe8\xce\xac\x58\x2c\x51\x76\x72\x4e\xf0\xa8\xca\x79\x97\x19\x58\xaa\xb4\x5a\x38\x81\x9b\xcc\x2a\x46\x15\x77\x6c\x0a\x94\x33\x3e\x57\x65\xfc\x32\xf2\xbf\x36\x6f\x93\xf9\xec\x7a\x01\x2e\x5c\x08\xaa\xce\x76\x5f\x12\xcc\x68\x66\x65\xdc\x3e\xe6\x72\xb4\xb3\x8f\x75\xd7\x86\x51\x62\x52\x48\x4e\xa8\x82\x1e\x6e\x8c\x4a\x70\xb3\xbf\xbb\xa5\xc8\xc3\xbf\x35\x06\xf4\xec\xe9\x57\xad\x78\x57\xbc\xd7\xf8\x52\x19\xf6\xfc\xe1\x78\xfc\x0f\x3a\xfe\xf5\xe3\xbe\xfb\xc7\xd3\xf1\xdf\xfe\xdf\xe8\xe8\xe3\x93\xca\x9f\x1f\x9b\xa3\x95\x37\x2b\xa2\x65\xab\xe1\xb0\x3b\x6b\xbd\x32\xe2\xf1\x63\xe4\xa3\x23\x2f\x64\x0e\x23\xf2\x92\x26\x0a\x46\xe4\x47\x8e\xe7\xe4\x8e\x40\x6b\x0f\x56\x32\x92\xcd\x9e\x19\xb5\x49\xde\x76\xaf\xe0\x94\xda\xdf\x71\xd3\x6d\xb3\xe8\xdc\x02\xa1\x7b\x2b\x5e\x85\x4b\xf2\x0a\x7a\xda\x2c\xcb\x99\x10\x13\xa7\x37\x4d\x22\x91\x1e\x16\xcf\xdb\xf0\xb6\x59\xc1\x23\x58\x46\x96\x2f\x49\xc9\xc6\xad\x4a\xb3\x4a\x6e\x0a\x13\xf6\x68\x24\x85\x52\xe5\x75\x1d\x24\x61\x97\x40\x8e\x4b\x23\x8a\x39\x1c\xa6\x10\x51\xd4\x0a\xe5\x94\x69\x49\xad\x3f\xc9\x2b\x05\xd6\xda\xd7\x32\x9b\x5c\xc1\x2c\x4f\xc8\xbe\x02\x20\x13\x0c\xc8\x5e\x3b\x67\x0e\x9c\x2b\x68\xca\x12\x86\x09\x94\x24\x86\x48\xf0\x59\xc2\x9c\x9a\x9a\x66\x42\x6a\xca\x5b\xab\xa1\xd8\x14\xfe\x39\xdc\x10\x56\x44\x5b\x99\x8f\xf7\x63\xae\x9e\x3d\xfb\xea\xaf\xe7\xf9\x34\x16\x29\x65\xfc\x65\xaa\x0f\x0f\xbe\xdf\xff\x25\xa7\x09\xc6\xff\xbc\xa5\x29\xbc\x4c\xf5\xc1\xed\x49\x1c\xcf\xbe\xee\x41\xca\xfb\x1f\x2c\xc1\x7e\xdc\xff\x30\x76\xff\x7a\xe2\x7f\x3a\xf8\x7e\xff\x9f\x93\xd6\xe7\x07\x4f\x0e\x31\x71\xa1\xa0\xfb\x8f\x1f\xc6\x25\x0f\x98\x7c\x7c\x72\xf0\x7d\xe5\xd9\xc1\x26\x8e\xb0\x9e\x3c\x9a\xd2\x6c\x7c\xd9\x58\xa6\xb3\x51\xaf\x68\xca\x42\xdd\xa4\x88\xda\x10\xd4\x37\x34\x7b\x0f\x33\x90\xc0\xa3\x6e\xf3\xf8\xc9\xda\x27\x64\x3f\x36\xf2\x14\xe6\x1e\x1f\x78\x4d\x42\x16\x4f\x9d\x54\x51\x7c\xe7\x8f\xda\xe2\x8a\xbb\xd5\x78\xc3\x5a\x1c\xef\xa8\x94\xeb\x37\x18\x22\xcb\x5e\x87\x5b\x9b\xbb\xdc\xdb\x46\xdd\x6d\x79\x84\x31\xc5\x5b\x18\xb1\x8d\x6c\x60\x8d\xf9\x6d\xea\x5c\x0f\x24\xef\xa7\x88\xf0\x96\xc4\x86\xce\x41\x8a\x75\x6e\xdd\x83\x67\x65\x3f\x59\x9b\xf2\xd6\xfd\xe4\xac\x51\xd3\xef\x7b\x02\xfc\x78\xfa\xdc\xe2\x0c\x32\x60\x14\xef\x17\x22\x89\x15\xc9\x39\xfb\x25\x07\x72\xfa\xbc\xa8\xba\xc6\x78\x94\xe4\x78\x53\xdb\x8f\x3f\x9e\x3e\x57\x13\x42\xfe\xcb\x31\xdd\xeb\x96\x00\x75\xac\x6f\xfa\xee\xed\xeb\xff\x83\x46\x3b\xfc\xd2\x5d\x94\xe4\xab\x6e\x32\x6a\xad\xed\x56\x12\x32\xbd\xda\xd8\x6d\x9c\x51\x44\xb3\x66\xfb\x29\x71\x3e\x09\x6e\x53\x10\x16\x90\x64\x0a\x93\x2b\x89\xca\xa5\x5b\x8d\x19\xd0\xe6\x78\x61\xf9\x0d\x17\x14\xe4\xf3\x45\x31\x1f\x77\xab\xac\x8f\x48\x70\x0e\x11\x46\x5d\x19\x8d\xa0\x0f\x87\xa8\xbe\xbf\xaa\x6d\x6d\x54\x2f\x56\xd3\x37\xca\x31\x3d\xff\xf0\xce\x9f\xdb\x27\x74\x43\x91\xef\x9c\x5e\x85\x33\xde\x82\xaa\x5d\xdc\xc4\xd6\xf8\x6d\xe6\xe0\xe0\x76\xe7\x2c\x61\x6d\xbd\x5b\x8d\x68\x1d\x32\x18\xe8\xf2\xbe\xc3\x2f\x57\x0f\x39\x5f\x33\x33\xad\xe4\xf4\xa3\x73\xa8\x88\x95\x59\x50\x45\xa6\x00\x1c\x7d\x55\xd6\x27\x01\xdc\xe1\x3c\x94\x9e\xa4\x3c\x1b\x6b\x31\x6e\x50\x76\x3b\x20\xd7\x0d\xb5\x16\x5b\x4e\x6d\x6d\xc7\x83\xad\x33\xd7\x8b\xe5\x26\x18\xa8\xf2\x9e\xb6\x42\x6e\x1c\xba\xb0\x66\x15\xb9\x36\x67\xe7\x40\x2a\x8e\x6d\xfc\x6b\x7d\x4a\xd7\x86\x75\x55\xad\x80\x5a\x60\xe8\x44\xa7\x99\xbf\x63\x8e\x76\x9b\xcf\x41\x5e\xb1\x1e\xc2\xc7\xfb\xfa\xfb\xbd\x58\xcb\xab\xf7\x67\x27\x98\x7e\x6c\x3e\xf0\xbe\x57\xc4\xfe\xaa\x54\x31\x9c\xad\x74\xb1\x84\xc8\x86\x51\x1e\xdf\x3d\x41\x1b\x71\x7c\xeb\x41\xd0\xd6\x1f\x89\x0e\x87\x7a\x6b\x42\x20\x82\xb6\x2d\x83\x72\x48\x1f\x43\xe5\x0d\xcb\xc7\x6a\x39\xb7\x4a\x0b\x69\xc8\xb5\xf6\x5b\x3e\x2d\xd4\xaa\xb2\x77\xa7\x82\x93\xdf\xfe\x78\xf4\xff\x03\x00\x00\xff\xff\xe8\x3a\xde\x8e\x59\x5f\x01\x00") func operatorsCoreosCom_catalogsourcesYamlBytes() ([]byte, error) { return bindataRead( diff --git a/vendor/github.com/operator-framework/api/pkg/operators/v1alpha1/catalogsource_types.go b/vendor/github.com/operator-framework/api/pkg/operators/v1alpha1/catalogsource_types.go index e44261b5f6..dcc0aee44c 100644 --- a/vendor/github.com/operator-framework/api/pkg/operators/v1alpha1/catalogsource_types.go +++ b/vendor/github.com/operator-framework/api/pkg/operators/v1alpha1/catalogsource_types.go @@ -133,18 +133,15 @@ type GrpcPodConfig struct { // SecurityContextConfig can be one of `legacy` or `restricted`. The CatalogSource's pod is either injected with the // right pod.spec.securityContext and pod.spec.container[*].securityContext values to allow the pod to run in Pod // Security Admission (PSA) `restricted` mode, or doesn't set these values at all, in which case the pod can only be - // run in PSA `baseline` or `privileged` namespaces. Currently if the SecurityContextConfig is unspecified, the default - // value of `legacy` is used. Specifying a value other than `legacy` or `restricted` result in a validation error. - // When using older catalog images, which could not be run in `restricted` mode, the SecurityContextConfig should be - // set to `legacy`. - // - // In a future version will the default will be set to `restricted`, catalog maintainers should rebuild their catalogs - // with a version of opm that supports running catalogSource pods in `restricted` mode to prepare for these changes. + // run in PSA `baseline` or `privileged` namespaces. If the SecurityContextConfig is unspecified, the mode will be + // determined by the namespace's PSA configuration. If the namespace is enforcing `restricted` mode, then the pod + // will be configured as if `restricted` was specified. Otherwise, it will be configured as if `legacy` was + // specified. Specifying a value other than `legacy` or `restricted` result in a validation error. When using older + // catalog images, which can not run in `restricted` mode, the SecurityContextConfig should be set to `legacy`. // // More information about PSA can be found here: https://kubernetes.io/docs/concepts/security/pod-security-admission/' // +optional // +kubebuilder:validation:Enum=legacy;restricted - // +kubebuilder:default:=legacy SecurityContextConfig SecurityConfig `json:"securityContextConfig,omitempty"` // MemoryTarget configures the $GOMEMLIMIT value for the gRPC catalog Pod. This is a soft memory limit for the server,