From 68e61e618fc0f1a8ad5f0c35a405b20ab563874f Mon Sep 17 00:00:00 2001 From: Jack Meixensperger Date: Thu, 28 May 2020 14:28:34 -0700 Subject: [PATCH 01/18] init commit --- inventory/environ.py | 1 + roles/splunk_common/tasks/main.yml | 3 +++ .../tasks/set_splunk_connection_timeout.yml | 9 +++++++++ 3 files changed, 13 insertions(+) create mode 100644 roles/splunk_common/tasks/set_splunk_connection_timeout.yml diff --git a/inventory/environ.py b/inventory/environ.py index f1563ad3..e8242b32 100755 --- a/inventory/environ.py +++ b/inventory/environ.py @@ -250,6 +250,7 @@ def getSplunkWebSSL(vars_scope): splunk_vars["http_enableSSL_privKey"] = os.environ.get('SPLUNK_HTTP_ENABLESSL_PRIVKEY', splunk_vars.get("http_enableSSL_privKey")) splunk_vars["http_enableSSL_privKey_password"] = os.environ.get('SPLUNK_HTTP_ENABLESSL_PRIVKEY_PASSWORD', splunk_vars.get("http_enableSSL_privKey_password")) splunk_vars["http_port"] = int(os.environ.get('SPLUNK_HTTP_PORT', splunk_vars.get("http_port"))) + splunk_vars["connection_timeout"] = int(os.environ.get('SPLUNK_CONNECTION_TIMEOUT', splunk_vars.get("connection_timeout"))) def getDistributedTopology(vars_scope): """ diff --git a/roles/splunk_common/tasks/main.yml b/roles/splunk_common/tasks/main.yml index 5d519d47..e81ef823 100644 --- a/roles/splunk_common/tasks/main.yml +++ b/roles/splunk_common/tasks/main.yml @@ -108,6 +108,9 @@ - include_tasks: enable_splunkd_ssl.yml when: "'ssl' in splunk and splunk.ssl" +- include_tasks: set_splunk_connection_timeout.yml + when: "'connection_timeout' in splunk and splunk.connection_timeout" + - include_tasks: set_config_file.yml vars: conf_file: "{{ item.key }}.conf" diff --git a/roles/splunk_common/tasks/set_splunk_connection_timeout.yml b/roles/splunk_common/tasks/set_splunk_connection_timeout.yml new file mode 100644 index 00000000..e311c263 --- /dev/null +++ b/roles/splunk_common/tasks/set_splunk_connection_timeout.yml @@ -0,0 +1,9 @@ +--- +- name: Set Splunkd Connection Timeout + ini_file: + dest: "{{ splunk.home }}/etc/system/local/web.conf" + section: settings + option: "splunkdConnectionTimeout" + value: "{{ splunk.connection_timeout }}" + owner: "{{ splunk.user }}" + group: "{{ splunk.group }}" \ No newline at end of file From b7696cf1b0db4ad9b843d8ed78541be1e5bdb012 Mon Sep 17 00:00:00 2001 From: Jack Meixensperger Date: Mon, 1 Jun 2020 10:38:39 -0700 Subject: [PATCH 02/18] fix empty arg --- inventory/environ.py | 2 +- inventory/splunk_defaults_linux.yml | 1 + inventory/splunk_defaults_windows.yml | 1 + inventory/splunkforwarder_defaults_linux.yml | 1 + inventory/splunkforwarder_defaults_windows.yml | 1 + 5 files changed, 5 insertions(+), 1 deletion(-) diff --git a/inventory/environ.py b/inventory/environ.py index e8242b32..70fdd280 100755 --- a/inventory/environ.py +++ b/inventory/environ.py @@ -250,7 +250,7 @@ def getSplunkWebSSL(vars_scope): splunk_vars["http_enableSSL_privKey"] = os.environ.get('SPLUNK_HTTP_ENABLESSL_PRIVKEY', splunk_vars.get("http_enableSSL_privKey")) splunk_vars["http_enableSSL_privKey_password"] = os.environ.get('SPLUNK_HTTP_ENABLESSL_PRIVKEY_PASSWORD', splunk_vars.get("http_enableSSL_privKey_password")) splunk_vars["http_port"] = int(os.environ.get('SPLUNK_HTTP_PORT', splunk_vars.get("http_port"))) - splunk_vars["connection_timeout"] = int(os.environ.get('SPLUNK_CONNECTION_TIMEOUT', splunk_vars.get("connection_timeout"))) + splunk_vars["connection_timeout"] = int(os.environ.get('SPLUNK_CONNECTION_TIMEOUT', splunk_vars.get("connection_timeout", 0))) def getDistributedTopology(vars_scope): """ diff --git a/inventory/splunk_defaults_linux.yml b/inventory/splunk_defaults_linux.yml index 781d12ec..24957788 100644 --- a/inventory/splunk_defaults_linux.yml +++ b/inventory/splunk_defaults_linux.yml @@ -98,6 +98,7 @@ splunk: cluster_master_url: search_head_captain_url: deployer_url: + connection_timeout: enable_service: False service_name: diff --git a/inventory/splunk_defaults_windows.yml b/inventory/splunk_defaults_windows.yml index 6921beb4..23a22dc6 100644 --- a/inventory/splunk_defaults_windows.yml +++ b/inventory/splunk_defaults_windows.yml @@ -90,6 +90,7 @@ splunk: cluster_master_url: search_head_captain_url: deployer_url: + connection_timeout: 180 enable_service: False service_name: smartstore: diff --git a/inventory/splunkforwarder_defaults_linux.yml b/inventory/splunkforwarder_defaults_linux.yml index a373d415..357d2563 100644 --- a/inventory/splunkforwarder_defaults_linux.yml +++ b/inventory/splunkforwarder_defaults_linux.yml @@ -84,6 +84,7 @@ splunk: search_factor: 3 replication_factor: 3 replication_port: 9887 + connection_timeout: enable_service: False service_name: smartstore: diff --git a/inventory/splunkforwarder_defaults_windows.yml b/inventory/splunkforwarder_defaults_windows.yml index 46e8f1dc..a87341a8 100644 --- a/inventory/splunkforwarder_defaults_windows.yml +++ b/inventory/splunkforwarder_defaults_windows.yml @@ -88,6 +88,7 @@ splunk: multisite_replication_factor_total: 3 multisite_search_factor_origin: 3 multisite_search_factor_total: 3 + connection_timeout: 180 enable_service: False service_name: smartstore: From 075686f002add89c2287f4507660472ec85d06c3 Mon Sep 17 00:00:00 2001 From: Jack Meixensperger Date: Mon, 1 Jun 2020 10:42:32 -0700 Subject: [PATCH 03/18] add condition --- roles/splunk_common/tasks/main.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/roles/splunk_common/tasks/main.yml b/roles/splunk_common/tasks/main.yml index e81ef823..78b7611c 100644 --- a/roles/splunk_common/tasks/main.yml +++ b/roles/splunk_common/tasks/main.yml @@ -109,7 +109,9 @@ when: "'ssl' in splunk and splunk.ssl" - include_tasks: set_splunk_connection_timeout.yml - when: "'connection_timeout' in splunk and splunk.connection_timeout" + when: + - "'connection_timeout' in splunk and splunk.connection_timeout" + - splunk.connection_timeout | int > 0 - include_tasks: set_config_file.yml vars: From df2c0f38342b073f4a4247a136c39c5d1773eaeb Mon Sep 17 00:00:00 2001 From: Nelson Wang Date: Mon, 1 Jun 2020 11:08:27 -0700 Subject: [PATCH 04/18] Bugfix/always add licenses (#479) * Removing first_run restriction on adding licenses * Addressing changed/failed conditions * Linting --- .../tasks/licenses/add_license.yml | 25 ++++--------------- roles/splunk_common/tasks/main.yml | 4 --- .../tasks/set_as_license_slave.yml | 3 ++- 3 files changed, 7 insertions(+), 25 deletions(-) diff --git a/roles/splunk_common/tasks/licenses/add_license.yml b/roles/splunk_common/tasks/licenses/add_license.yml index 05e9c8c3..4e03df28 100644 --- a/roles/splunk_common/tasks/licenses/add_license.yml +++ b/roles/splunk_common/tasks/licenses/add_license.yml @@ -1,15 +1,4 @@ --- -- name: Check license source - stat: - path: "{{ lic }}" - register: lic_source - -- name: Copy license - command: "cp {{ lic }} {{ splunk.license_download_dest }}" - when: - - lic_source.stat.exists - - lic != splunk.license_download_dest - - name: Download license get_url: url: "{{ lic }}" @@ -22,13 +11,15 @@ retries: "{{ retry_num }}" delay: "{{ retry_delay }}" -- name: Ensure license exists +- name: Ensure license path stat: - path: "{{ splunk.license_download_dest }}" + path: "{{ splunk.license_download_dest if lic is match('^(https?|file)://.*') else lic }}" register: lic_dest - name: Apply license - command: "{{ splunk.exec }} add licenses {{ splunk.license_download_dest }} -auth {{ splunk.admin_user }}:{{ splunk.password }}" + command: "{{ splunk.exec }} add licenses {{ lic_dest.stat.path }} -auth {{ splunk.admin_user }}:{{ splunk.password }}" + register: add_lic_cmd + changed_when: add_lic_cmd.rc == 0 become: yes become_user: "{{ splunk.user }}" no_log: "{{ hide_password }}" @@ -39,9 +30,3 @@ - splunk.role != "splunk_universal_forwarder" notify: - Restart the splunkd service - -- name: Remove artifacts - file: - dest: "{{ splunk.license_download_dest }}" - state: absent - ignore_errors: true diff --git a/roles/splunk_common/tasks/main.yml b/roles/splunk_common/tasks/main.yml index 5d519d47..1b27df89 100644 --- a/roles/splunk_common/tasks/main.yml +++ b/roles/splunk_common/tasks/main.yml @@ -129,9 +129,5 @@ - include_tasks: set_certificate_prefix.yml - include_tasks: clean_user_seed.yml - when: - - first_run | bool - include_tasks: add_splunk_license.yml - when: - - first_run | bool diff --git a/roles/splunk_common/tasks/set_as_license_slave.yml b/roles/splunk_common/tasks/set_as_license_slave.yml index 21f648e8..0ea179ba 100644 --- a/roles/splunk_common/tasks/set_as_license_slave.yml +++ b/roles/splunk_common/tasks/set_as_license_slave.yml @@ -10,7 +10,8 @@ become_user: "{{ splunk.user }}" register: linux_set_lic_slave until: linux_set_lic_slave.rc == 0 - changed_when: linux_set_lic_slave.rc == 0 + changed_when: linux_set_lic_slave.rc == 0 and "licenser-localslave object has been edited" in linux_set_lic_slave.stdout + failed_when: linux_set_lic_slave.rc !=0 and "does not support being a remote master" in linux_set_lic_slave.stderr retries: "{{ retry_num }}" delay: "{{ retry_delay }}" notify: From 064cc26cb9fb2c469778fefb99c9cbc1aa445074 Mon Sep 17 00:00:00 2001 From: Jack Meixensperger Date: Mon, 1 Jun 2020 13:50:03 -0700 Subject: [PATCH 05/18] address environ.py comment --- inventory/environ.py | 2 +- inventory/splunk_defaults_linux.yml | 2 +- inventory/splunkforwarder_defaults_linux.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/inventory/environ.py b/inventory/environ.py index 70fdd280..7c064436 100755 --- a/inventory/environ.py +++ b/inventory/environ.py @@ -250,7 +250,6 @@ def getSplunkWebSSL(vars_scope): splunk_vars["http_enableSSL_privKey"] = os.environ.get('SPLUNK_HTTP_ENABLESSL_PRIVKEY', splunk_vars.get("http_enableSSL_privKey")) splunk_vars["http_enableSSL_privKey_password"] = os.environ.get('SPLUNK_HTTP_ENABLESSL_PRIVKEY_PASSWORD', splunk_vars.get("http_enableSSL_privKey_password")) splunk_vars["http_port"] = int(os.environ.get('SPLUNK_HTTP_PORT', splunk_vars.get("http_port"))) - splunk_vars["connection_timeout"] = int(os.environ.get('SPLUNK_CONNECTION_TIMEOUT', splunk_vars.get("connection_timeout", 0))) def getDistributedTopology(vars_scope): """ @@ -419,6 +418,7 @@ def overrideEnvironmentVars(vars_scope): vars_scope["splunk"]["allow_upgrade"] = os.environ.get('SPLUNK_ALLOW_UPGRADE', vars_scope["splunk"]["allow_upgrade"]) vars_scope["splunk"]["appserver"]["port"] = os.environ.get('SPLUNK_APPSERVER_PORT', vars_scope["splunk"]["appserver"]["port"]) vars_scope["splunk"]["kvstore"]["port"] = os.environ.get('SPLUNK_KVSTORE_PORT', vars_scope["splunk"]["kvstore"]["port"]) + vars_scope["splunk"]["connection_timeout"] = int(os.environ.get('SPLUNK_CONNECTION_TIMEOUT', vars_scope["splunk"]["connection_timeout"])) # Set set_search_peers to False to disable peering to indexers when creating multisite topology if os.environ.get("SPLUNK_SET_SEARCH_PEERS", "").lower() == "false": diff --git a/inventory/splunk_defaults_linux.yml b/inventory/splunk_defaults_linux.yml index 24957788..3767e6c5 100644 --- a/inventory/splunk_defaults_linux.yml +++ b/inventory/splunk_defaults_linux.yml @@ -98,7 +98,7 @@ splunk: cluster_master_url: search_head_captain_url: deployer_url: - connection_timeout: + connection_timeout: 0 enable_service: False service_name: diff --git a/inventory/splunkforwarder_defaults_linux.yml b/inventory/splunkforwarder_defaults_linux.yml index 357d2563..94f874f7 100644 --- a/inventory/splunkforwarder_defaults_linux.yml +++ b/inventory/splunkforwarder_defaults_linux.yml @@ -84,7 +84,7 @@ splunk: search_factor: 3 replication_factor: 3 replication_port: 9887 - connection_timeout: + connection_timeout: 0 enable_service: False service_name: smartstore: From 4a14ac1b28d1f0975024554b72e6c664e2ccd028 Mon Sep 17 00:00:00 2001 From: Jack Meixensperger Date: Mon, 1 Jun 2020 14:01:45 -0700 Subject: [PATCH 06/18] add docs + update small test --- docs/ADVANCED.md | 1 + tests/small/test_environ.py | 4 ++++ 2 files changed, 5 insertions(+) diff --git a/docs/ADVANCED.md b/docs/ADVANCED.md index a48e31b7..7268d621 100644 --- a/docs/ADVANCED.md +++ b/docs/ADVANCED.md @@ -110,6 +110,7 @@ Splunk-Ansible ships with an inventory script in `inventory/environ.py`. The scr | SPLUNK_ANSIBLE_PRE_TASKS | Pass in a comma-separated list of local paths or remote URLs to Ansible playbooks that will be executed before `site.yml` | no | no | no | | SPLUNK_ANSIBLE_POST_TASKS | Pass in a comma-separated list of local paths or remote URLs to Ansible playbooks that will be executed after `site.yml` | no | no | no | | SPLUNK_ANSIBLE_ENV | Pass in a comma-separated list of "key=value" pairs that will be mapped to environment variables used during `site.yml` execution | no | no | no | +| SPLUNK_CONNECTION_TIMEOUT | Configures splunkdConnectionTimeout in `web.conf` with passed integer value (in seconds) | no | no | no | \* Password must be set either in `default.yml` or as the environment variable `SPLUNK_PASSWORD` diff --git a/tests/small/test_environ.py b/tests/small/test_environ.py index 21ea2237..88bface7 100644 --- a/tests/small/test_environ.py +++ b/tests/small/test_environ.py @@ -610,6 +610,9 @@ def test_getSplunkApps(default_yml, os_env, apps_count): # Check splunk.kvstore.port ({"splunk": {"kvstore" :{"port": "9165"}}}, {}, "splunk.kvstore.port", "9165"), ({}, {"SPLUNK_KVSTORE_PORT": "9265"}, "splunk.kvstore.port", "9265"), + # Check splunk.connection_timeout + ({"splunk": {"connection_timeout": 60}}, {}, "splunk.connection_timeout", 60), + ({}, {"SPLUNK_CONNECTION_TIMEOUT": 200}, "splunk.connection_timeout", 200), ] ) def test_overrideEnvironmentVars(default_yml, os_env, key, value): @@ -631,6 +634,7 @@ def test_overrideEnvironmentVars(default_yml, os_env, key, value): "allow_upgrade": True, "asan": None, "set_search_peers": True, + "connection_timeout": 0, } } # TODO: Possibly remove the dependency on merge_dict() in this test From 86425542c1fba38aa64af4a336be34ec950c3a74 Mon Sep 17 00:00:00 2001 From: Nelson Wang Date: Mon, 1 Jun 2020 18:38:42 -0700 Subject: [PATCH 07/18] Large updates to default.yml spec and keeping it current (#482) * Large updates to default.yml spec and keeping it current * Adding docker variable --- docs/advanced/default.yml.spec.md | 90 +++++++++++++++++++++++++++++-- inventory/environ.py | 14 +++-- tests/small/test_environ.py | 3 ++ 3 files changed, 94 insertions(+), 13 deletions(-) diff --git a/docs/advanced/default.yml.spec.md b/docs/advanced/default.yml.spec.md index 4406cace..ab0ba875 100644 --- a/docs/advanced/default.yml.spec.md +++ b/docs/advanced/default.yml.spec.md @@ -18,6 +18,10 @@ ansible_pre_tasks: * Comma-separated list of paths or URLs to custom Ansible playbooks to run BEFORE Splunk sets up using the provided site.yml * Default: null +ansible_environment: +* Map of environment variables used only during the execution context of all the Ansible tasks. For more information, see https://docs.ansible.com/ansible/latest/user_guide/playbooks_environment.html +* Default: {} + hide_password: * Boolean that determines whether or not to output Splunk admin passwords through Ansible * Default: false @@ -34,6 +38,10 @@ shc_sync_retry_num: * Number of retries to make when waiting for sync up with a search head cluster * Default: 60 +retry_delay: +* Duration of waits between each of the aforementioned retries (in seconds) +* Default: 6 + splunk_home_ownership_enforcement: true * Boolean that to control and enable UAC on $SPLUNK_HOME (recommended to be enabled) * Default: true @@ -94,18 +102,54 @@ splunkbase_password: * NOTE: Use this in combination with splunkbase_username. You will also need to run Ansible using the dynamic inventory script (environ.py) for this to register and work properly. * Default: null +splunkbase_token: +* Used for authentication when downloading apps from https://splunkbase.splunk.com/ (this is NOT required to even be specified, unless you have SplunkBase apps defined in your splunk.apps_location) +* NOTE: This is ordinarily generated using the dynamic inventory script (environ.py) using the aforementioned `splunkbase_username` and `splunkbase_password` variables above, and every token has an expiry. +* Default: null + +cert_prefix: +* Specify the scheme used for the SplunkD management endpoint (typically port 8089). If you plan on running SplunkD over HTTP, you should set this to "http" so the Ansible plays are aware of the intended scheme. +* Default: https + +java_download_url: +* Java JDK URL that is dynamically fetched and installed at container run-time. For example: "https://download.java.net/java/GA/jdk11/9/GPL/openjdk-11.0.2_linux-x64_bin.tar.gz" +* Default: null + +java_update_version: +* Name of the Java JDK file used for installation. For example: "openjdk-11.0.2_linux-x64_bin.tar.gz" +* Default: null + +java_version: +* String notifying the Ansible plays which version of Java is being installed so variables can be parsed properly. For example: "openjdk:11" +* Default: null + +dmc_forwarder_monitoring: +* Feature-flag to enable forwarder asset monitoring through the Distributed Management Console (DMC). This is disabled by default. +* Default: false + +dmc_asset_interval: +* Cron-formatted string of the frequency and recurrence of the query that builds the forwarding assets table +* Default: "3,18,33,48 * * * *" + +docker: +* DEPRECATED - this was used to signal whether or not the instance being provisioned was running in Docker. This does not affect playbook execution at all, but the dynamic inventory script environ.py will set this to setup host::vars mapping as needed. + splunk: role: * Role to assume when setting up Splunk * Default: splunk_standalone - upgrade: + allow_upgrade: * Determines whether or not to perform an upgrade (to the splunk.build_location) - * Default: false + * Default: true build_location: * Splunk build location, either on the filesystem or a remote URL - * Default: /tmp/splunk.tgz + * Default: null + + build_url_bearer_token: + * Bearer token used to provide authorization when fetching a Splunk build from a remote URL. + * Default: null license_master_url: * Hostname of Splunk Enterprise license master instance. May be overridden using SPLUNK_LICENSE_MASTER_URL environment variable. @@ -153,11 +197,11 @@ splunk: * Default: false admin_user: - * Default admin-level user to run provisioning commands under + * Default admin-level user to run provisioning commands under. It is only possible to change the admin user name at the first-time execution of Splunk Enterprise. * Default: admin password: - * Default Splunk admin user password. This is REQUIRED when starting Splunk + * Default Splunk admin user password. This is REQUIRED when starting Splunk, and can only be set during the first-time run of the playbooks. If changes are required to the admin password, they should be done through SplunkWeb/CLI and the new value should be re-entered here. * Default: null user: @@ -172,6 +216,10 @@ splunk: * Determine whether or not to enable Splunk for boot-start (start via sysinitv or systemd, etc.) * Default: false + service_name: + * Specify the service name of splunkd when running through sysinitv, systemd, etc. + * Default: null + opt: * Path in filesystem where Splunk will be installed * Default: /opt @@ -254,6 +302,10 @@ splunk: * Determine the port used for SplunkWeb * Default: 8000 + root_endpoint: + * Root endpoint used when serving SplunkWeb over a different path + * Default: null + s2s: enable: * Determine whether or not to enable Splunk-to-Splunk communication. This is REQUIRED for any distributed topologies. @@ -297,6 +349,10 @@ splunk: * key::value pairs for environment variables that get written to ${SPLUNK_HOME}/etc/splunk-launch.conf * Default: null + asan: + * Feature-flag to enable special configurations when using debug, address-sanitized builds. This is not used externally and not recommended to change. + * Default: false + secret: * Secret passcode used to encrypt all of Splunk's sensitive information on disk. When not set, Splunk will autogenerate a unique secret local to each installation. This is NOT required for any standalone or distributed Splunk topology * NOTE: This may be set once at the start of provisioning any deployment. Any changes made to this splunk.secret after the deployment has been created must be resolved manually, otherwise there is a severe risk of bricking the capabilities of your Splunk environment. @@ -355,6 +411,30 @@ splunk: * Determine the secret used to enable indexer discovery (for any forwarding clients connecting to the cluster master). This is pass4SymmKey in the `[indexer_discovery]` stanza of server.conf. * Default: null + multisite_master_port: + * Specify the management port of the multisite cluster master + * Default: 8089 + + multisite_replication_factor_origin: + * Determine origin-level knowledge object replication factor when in a multisite environment + * Default: 2 + + multisite_replication_factor_total: + * Determine site-level knowledge object replication factor when in a multisite environment + * Default: 3 + + multisite_search_factor_origin: + * Determine origin-level search replication factor when in a multisite environment + * Default: 1 + + multisite_search_factor_total: + * Determine site-level search replication factor when in a multisite environment + * Default: 3 + + set_search_peers: + * Feature-flag to disable the automatic peering from the search tier to the indexer tier (cluster master or indexers directly). It is discouraged to change this to false, but it is exposed for the purposes of testing and isolating the groups. + * Default: true + shc: label: * Provide a label for search head clustering configuration diff --git a/inventory/environ.py b/inventory/environ.py index f1563ad3..c8bb9773 100755 --- a/inventory/environ.py +++ b/inventory/environ.py @@ -315,11 +315,12 @@ def getSplunkbaseToken(vars_scope): """ Authenticate to SplunkBase and modify the variable scope in-place to utilize temporary session token """ - splunkbase_username = os.environ.get("SPLUNKBASE_USERNAME", vars_scope.get("splunkbase_username")) - splunkbase_password = os.environ.get("SPLUNKBASE_PASSWORD", vars_scope.get("splunkbase_password")) - if splunkbase_username and splunkbase_password: + vars_scope["splunkbase_token"] = None + vars_scope["splunkbase_username"] = os.environ.get("SPLUNKBASE_USERNAME", vars_scope.get("splunkbase_username")) + vars_scope["splunkbase_password"] = os.environ.get("SPLUNKBASE_PASSWORD", vars_scope.get("splunkbase_password")) + if vars_scope["splunkbase_username"] and vars_scope["splunkbase_password"]: resp = requests.post("https://splunkbase.splunk.com/api/account:login/", - data={"username": splunkbase_username, "password": splunkbase_password}) + data={"username": vars_scope["splunkbase_username"], "password": vars_scope["splunkbase_password"]}) if resp.status_code != 200: raise Exception("Invalid Splunkbase credentials - will not download apps from Splunkbase") output = resp.content @@ -640,13 +641,10 @@ def prep_for_yaml_out(inventory): """ inventory_to_dump = inventory["all"]["vars"] - keys_to_del = ["docker_version", - "ansible_ssh_user", - "delay_num", + keys_to_del = ["ansible_ssh_user", "apps_location", "build_location", "hostname", - "upgrade", "role", "preferred_captaincy", "license_uri"] diff --git a/tests/small/test_environ.py b/tests/small/test_environ.py index 21ea2237..e7014567 100644 --- a/tests/small/test_environ.py +++ b/tests/small/test_environ.py @@ -508,6 +508,9 @@ def test_getSplunkbaseToken(default_yml, trigger_splunkbase): with patch("os.environ", new=dict()): environ.getSplunkbaseToken(vars_scope) # Make sure Splunkbase token is populated when appropriate + assert "splunkbase_token" in vars_scope + assert "splunkbase_username" in vars_scope + assert "splunkbase_password" in vars_scope if trigger_splunkbase: mock_post.assert_called_with("https://splunkbase.splunk.com/api/account:login/", data={"username": "ocho", "password": "cinco"}) assert vars_scope.get("splunkbase_token") == "123abc" From 0f9f2233e9a08a5f3975bc07495c2c41bc500f3d Mon Sep 17 00:00:00 2001 From: Jack Meixensperger Date: Tue, 2 Jun 2020 14:05:03 -0700 Subject: [PATCH 08/18] use module permissions (#483) --- roles/splunk_common/tasks/add_forward_server.yml | 4 ++-- roles/splunk_common/tasks/enable_forwarding.yml | 16 ++++++++-------- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/roles/splunk_common/tasks/add_forward_server.yml b/roles/splunk_common/tasks/add_forward_server.yml index ae1b8a7a..ca6cde56 100644 --- a/roles/splunk_common/tasks/add_forward_server.yml +++ b/roles/splunk_common/tasks/add_forward_server.yml @@ -15,13 +15,13 @@ no_log: "{{ hide_password }}" - name: "Enable ssl-forwarding to {{ forward_servers }}" - become: yes - become_user: "{{ splunk.user }}" ini_file: path: "{{ splunk.home }}/etc/system/local/outputs.conf" section: "tcpout:group1" option: "{{ item.key }}" value: "{{ item.value }}" + owner: "{{ splunk.user }}" + group: "{{ splunk.group }}" with_items: - {key: "server", value: "{% for fwd in forward_servers %}{{ fwd }}:{{ splunk.s2s.port }}{{ ',' if not loop.last else '' }}{% endfor %}"} - {key: "clientCert", value: "{{ splunk.s2s.cert if splunk.s2s is defined and splunk.s2s.cert is defined else ''}}"} diff --git a/roles/splunk_common/tasks/enable_forwarding.yml b/roles/splunk_common/tasks/enable_forwarding.yml index 3aec9030..2ab6d197 100644 --- a/roles/splunk_common/tasks/enable_forwarding.yml +++ b/roles/splunk_common/tasks/enable_forwarding.yml @@ -2,13 +2,13 @@ # Configure forwarding to indexer cluster master # See: https://docs.splunk.com/Documentation/Splunk/latest/Indexer/indexerdiscovery - name: Setup indexer discovery for index-clustering - become: yes - become_user: "{{ splunk.user }}" ini_file: path: "{{ splunk.home }}/etc/system/local/outputs.conf" section: "indexer_discovery:splunk-indexer" option: "{{ item.key }}" value: "{{ item.value }}" + owner: "{{ splunk.user }}" + group: "{{ splunk.group }}" with_items: - {key: "pass4SymmKey", value: "{{ splunk.idxc.discoveryPass4SymmKey if splunk.idxc.discoveryPass4SymmKey is defined and splunk.idxc.discoveryPass4SymmKey else splunk.idxc.pass4SymmKey }}"} - {key: "master_uri", value: "{{ cert_prefix }}://{{ splunk.cluster_master_url }}:{{ splunk.svc_port }}"} @@ -19,13 +19,13 @@ register: indexer_discovery - name: Setup tcpout group for index-clustering - become: yes - become_user: "{{ splunk.user }}" ini_file: path: "{{ splunk.home }}/etc/system/local/outputs.conf" section: "tcpout:group1" option: "{{ item.key }}" value: "{{ item.value }}" + owner: "{{ splunk.user }}" + group: "{{ splunk.group }}" with_items: - {key: "indexerDiscovery", value: "splunk-indexer"} - {key: "clientCert", value: "{{ splunk.s2s.cert if splunk.s2s is defined and splunk.s2s.cert is defined }}"} @@ -38,13 +38,13 @@ register: tcpout_group - name: Setup default tcpout group for index-clustering - become: yes - become_user: "{{ splunk.user }}" ini_file: path: "{{ splunk.home }}/etc/system/local/outputs.conf" section: "tcpout" option: "{{ item.key }}" value: "{{ item.value }}" + owner: "{{ splunk.user }}" + group: "{{ splunk.group }}" with_items: - {key: "indexAndForward", value: "false"} - {key: "defaultGroup", value: "group1"} @@ -65,13 +65,13 @@ # NOTE: If this task is called or used, it will disable all local indexing! - name: Disable indexing on the current node - become: yes - become_user: "{{ splunk.user }}" ini_file: path: "{{ splunk.home }}/etc/system/local/outputs.conf" section: "indexAndForward" option: "{{ item.key }}" value: "{{ item.value }}" + owner: "{{ splunk.user }}" + group: "{{ splunk.group }}" with_items: - {key: "index", value: "false"} no_log: "{{ hide_password }}" From aa568e6f293a091af4b21efe83d88a9d2de13796 Mon Sep 17 00:00:00 2001 From: Nelson Wang Date: Thu, 4 Jun 2020 16:26:36 -0700 Subject: [PATCH 09/18] Feature/remote execution (#410) * Supporting remote execution * Adding docs about usage * Adding localhost to wrapper-example * Updating docs per review Co-authored-by: Alisha Mayor --- docs/execution_patterns/EXECUTION.md | 39 ++++++++ docs/execution_patterns/remote/Dockerfile | 22 +++++ docs/execution_patterns/remote/README.md | 93 ++++++++++++++++++ docs/execution_patterns/remote/default.yml | 65 ++++++++++++ .../remote/docker-compose.yml | 67 +++++++++++++ docs/execution_patterns/remote/hosts.yml | 38 +++++++ .../remote/remote-diagram.png | Bin 0 -> 140552 bytes multisite.yml | 2 +- site.yml | 2 +- .../install-splunk-ansible.playbook | 7 +- 10 files changed, 331 insertions(+), 4 deletions(-) create mode 100644 docs/execution_patterns/EXECUTION.md create mode 100644 docs/execution_patterns/remote/Dockerfile create mode 100644 docs/execution_patterns/remote/README.md create mode 100644 docs/execution_patterns/remote/default.yml create mode 100644 docs/execution_patterns/remote/docker-compose.yml create mode 100644 docs/execution_patterns/remote/hosts.yml create mode 100644 docs/execution_patterns/remote/remote-diagram.png diff --git a/docs/execution_patterns/EXECUTION.md b/docs/execution_patterns/EXECUTION.md new file mode 100644 index 00000000..58265e87 --- /dev/null +++ b/docs/execution_patterns/EXECUTION.md @@ -0,0 +1,39 @@ +# Execution + +The Ansible plays in the `splunk-ansible` project can be run in two ways: separately on each instance/host of the Splunk Enterprise deployment, or through more traditional separation of control nodes and managed nodes. In the first method each host asynchronously sets itself up using Ansible roles to form the final desired topology which is most clearly displayed through the [docker-splunk](https://github.com/splunk/docker-splunk) project. All execution methods are listed below. + +--- + +## Navigation + +* [Local](#local) +* [Embedded](#embedded) +* [Remote](#remote) + +--- + +## Local +Local connection is the intended mode of using `splunk-ansible`. The dynamic inventory script `environ.py` reads environment variables and maps them into Ansible run-time variables that determine how Splunk Enterprise is setup. + +In order to bring up the most basic Splunk standalone instance on a local host, you can run the following: + +```bash +export SPLUNK_PASSWORD=helloworld +export SPLUNK_BUILD_URL=https://download.splunk.com/products/splunk/releases/8.0.3/linux/splunk-8.0.3-a6754d8441bf-Linux-x86_64.tgz +export SPLUNK_USER=$(whoami) +export SPLUNK_GROUP=$(id -gn) + +ansible-playbook --inventory inventory/environ.py --limit localhost site.yml +``` + +--- + +## Embedded +The embedded, or wrapper, mode of using `splunk-ansible` involves treating this entire project as a package. See [these instructions](wrapper-example/README.md) on how to install `splunk-ansible` on multiple target machines to bring up an indexer cluster. + +--- + +## Remote +The more traditional and familiar approach to running Ansible can also be used with `splunk-ansible`. This fits the use-case where `splunk-ansible` is installed on some controller node (ex. your personal workstation, Ansible Tower, or Ansible AWX) and this controller uses the ssh connection to setup Splunk on a series of target hosts. + +See [these instructions](remote/README.md) on how to install `splunk-ansible` on multiple target machines to bring up an indexer cluster. diff --git a/docs/execution_patterns/remote/Dockerfile b/docs/execution_patterns/remote/Dockerfile new file mode 100644 index 00000000..2fdc4ed2 --- /dev/null +++ b/docs/execution_patterns/remote/Dockerfile @@ -0,0 +1,22 @@ +# This script is based on the one availible from dockerdocs: https://docs.docker.com/engine/examples/running_ssh_service/ + +FROM ubuntu + +RUN apt update && \ + apt install -y openssh-server sudo + +RUN mkdir /var/run/sshd && \ + echo 'root:screencast' | chpasswd && \ + sed -i 's/PermitRootLogin prohibit-password/PermitRootLogin yes/' /etc/ssh/sshd_config && \ + sed -i 's/#PermitRootLogin yes/PermitRootLogin yes/' /etc/ssh/sshd_config && \ + echo "SSH login fix. Otherwise user is kicked off after login" && \ + sed 's@session\s*required\s*pam_loginuid.so@session optional pam_loginuid.so@g' -i /etc/pam.d/sshd && \ + echo "Setup passwordless sudo access" && \ + sed -i 's/^%sudo.*/%sudo ALL=(ALL) NOPASSWD: ALL/g' /etc/sudoers + +RUN groupadd -r splunk && \ + useradd -r -m -g splunk splunk && \ + usermod -aG sudo splunk + +EXPOSE 2222 +CMD ["/usr/sbin/sshd", "-D", "-p", "2222"] diff --git a/docs/execution_patterns/remote/README.md b/docs/execution_patterns/remote/README.md new file mode 100644 index 00000000..d747e734 --- /dev/null +++ b/docs/execution_patterns/remote/README.md @@ -0,0 +1,93 @@ +# Remote Execution +This folder provides guidance in how to use `splunk-ansible` from a controller node, setting up and provisioning a Splunk Enterprise indexer cluster on a series of remote instances. Or visually, the example shown here can be represented by the diagram below: + +![diagram](./remote-diagram.png) + +## Configure hosts +First, we'll need a few hosts to run these Ansible plays against. These can be bare-metal machines in a datacenter, cloud-provisioned VMs, or for demonstration purposes a set of containers running `sshd` locally. For more information on what's in the container image used, please see the [Dockerfile](./Dockerfile) in this directory. + +Additionally, see the [docker-compose.yml](./docker-compose.yml) file included for how the multiple containers are defined to assume the roles in the Splunk deployment. +```bash +$ docker-compose up -d +``` + +## Setup hosts file +Ansible's inventory files are used to define the multiple nodes or hosts you plan on managing. For more information, see [how to build your inventory](https://docs.ansible.com/ansible/latest/user_guide/intro_inventory.html#inventory-basics-formats-hosts-and-groups) on Ansible's documentation. + +For our use case, we will be add all the hosts used to compose the indexer cluster in the [hosts.yml](./hosts.yml) file. The key things here are: +* Each host is added to the respective group matching the Splunk role it expects to fulfill +* In addition to group membership, each instance should have a matching `splunk.role` variable defined +* All top-level variables, including SSH connection parameters - for instance user, password, and port - can be included in `all.vars` +* Host-specific variables can be defined at the individual host level + +Given that we are using Docker containers for the target hosts in this example, the corresponding `hosts.yml` file will look like the following: +``` +all: + vars: + # These vars are used to access the remote hosts + ansible_user: root + ansible_password: screencast + children: + # Configure individual information about each Splunk Enterprise instance + splunk_search_head: + hosts: + sh1: + ansible_port: 2222 + ansible_host: 0.0.0.0 + splunk: + role: splunk_search_head + splunk_cluster_master: + hosts: + cm1: + ansible_port: 2223 + ansible_host: 0.0.0.0 + splunk: + role: splunk_cluster_master + splunk_indexer: + hosts: + idx1: + ansible_port: 2224 + ansible_host: 0.0.0.0 + splunk: + role: splunk_indexer + idx2: + ansible_port: 2225 + ansible_host: 0.0.0.0 + splunk: + role: splunk_indexer + idx3: + ansible_port: 2226 + ansible_host: 0.0.0.0 + splunk: + role: splunk_indexer +``` + +## Test connection +Ansible's `ping` module can be used to quickly confirm that: +1. The `hosts.yml` file is setup properly +2. The target instances are reachable from the controller node + +To test the connection, run: +```bash +$ ansible -i hosts.yml all -m ping +``` + +## Setup variables +The playbooks in `splunk-ansible` use a series of variables that drive how Splunk is configured. These are known as the `default.yml`, and the full spec can be found [here](https://github.com/splunk/splunk-ansible/blob/develop/inventory/splunk_defaults_linux.yml). + +To generate a template of this `default.yml`, you can use Splunk's official Docker image as follows: +```bash +$ docker run -it splunk/splunk:latest create-defaults > default.yml +``` + +If you plan on running Ansible remotely, there are a few key variables you must make sure you define: +* `splunk.role`: the role this instance will play in the Splunk Enterprise deployment +* `splunk.build_location`: URL to dynamically fetch the Splunk Enterprise build and install it at run time +* `splunk.build_remote_src`: this wll be `true` when `splunk.build_location` above is a URL +* `splunk.password`: default `admin` user password that Splunk will be provisioned with on first-time run + +## Deploy Splunk +Once the `default.yml` has been setup to your liking, execute the following command to setup the indexer cluster: +```bash +ansible-playbook -i hosts.yml site.yml -e "@default.yml" +``` diff --git a/docs/execution_patterns/remote/default.yml b/docs/execution_patterns/remote/default.yml new file mode 100644 index 00000000..b6bc59e6 --- /dev/null +++ b/docs/execution_patterns/remote/default.yml @@ -0,0 +1,65 @@ +--- +retry_delay: 6 +retry_num: 60 +shc_sync_retry_num: 60 + +splunk: + build_location: https://download.splunk.com/products/splunk/releases/8.0.2.1/linux/splunk-8.0.2.1-f002026bad55-Linux-x86_64.tgz + build_remote_src: true + admin_user: admin + allow_upgrade: true + app_paths: + default: /opt/splunk/etc/apps + deployment: /opt/splunk/etc/deployment-apps + httpinput: /opt/splunk/etc/apps/splunk_httpinput + idxc: /opt/splunk/etc/master-apps + shc: /opt/splunk/etc/shcluster/apps + cluster_master_url: null + enable_service: false + exec: /opt/splunk/bin/splunk + hec: + enable: true + port: 8088 + ssl: true + token: 2c8cc23d-c523-4e78-a937-ecc02ea74884 + home: /opt/splunk + http_enableSSL: false + http_enableSSL_cert: null + http_enableSSL_privKey: null + http_enableSSL_privKey_password: null + http_port: 8000 + idxc: + label: idxc_label + pass4SymmKey: Dt0HeTXc8/u956lRqSLO8Rry1Gx00zQ/ + replication_factor: 3 + replication_port: 9887 + search_factor: 3 + secret: Dt0HeTXc8/u956lRqSLO8Rry1Gx00zQ/ + opt: /opt + pass4SymmKey: null + password: helloworld + pid: /opt/splunk/var/run/splunk/splunkd.pid + root_endpoint: null + s2s: + ca: null + cert: null + enable: true + password: null + port: 9997 + ssl: false + search_head_captain_url: null + secret: null + service_name: splunk + shc: + label: shc_label + pass4SymmKey: KRvL065Q8cfU39wnk57EtdQQQrT9Zf1M + replication_factor: 3 + replication_port: 9887 + secret: KRvL065Q8cfU39wnk57EtdQQQrT9Zf1M + svc_port: 8089 + tar_dir: splunk + user: root + group: root + wildcard_license: false +splunk_home_ownership_enforcement: true +wait_for_splunk_retry_num: 60 diff --git a/docs/execution_patterns/remote/docker-compose.yml b/docs/execution_patterns/remote/docker-compose.yml new file mode 100644 index 00000000..9556e48d --- /dev/null +++ b/docs/execution_patterns/remote/docker-compose.yml @@ -0,0 +1,67 @@ +version: '3' + +networks: + splunknet: + driver: bridge + +services: + sh1: + build: . + image: opensshd-server + container_name: sh1 + hostname: sh1 + networks: + - splunknet + volumes: + - "/opt/splunk/var" + ports: + - "8000" + - "2222:2222" + + cm1: + image: opensshd-server + container_name: cm1 + hostname: cm1 + networks: + - splunknet + volumes: + - "/opt/splunk/var" + ports: + - "8000" + - "2223:2222" + + idx1: + image: opensshd-server + container_name: idx1 + hostname: idx1 + networks: + - splunknet + volumes: + - "/opt/splunk/var" + ports: + - "8000" + - "2224:2222" + + idx2: + image: opensshd-server + container_name: idx2 + hostname: idx2 + networks: + - splunknet + volumes: + - "/opt/splunk/var" + ports: + - "8000" + - "2225:2222" + + idx3: + image: opensshd-server + container_name: idx3 + hostname: idx3 + networks: + - splunknet + volumes: + - "/opt/splunk/var" + ports: + - "8000" + - "2226:2222" diff --git a/docs/execution_patterns/remote/hosts.yml b/docs/execution_patterns/remote/hosts.yml new file mode 100644 index 00000000..e9a6cf2d --- /dev/null +++ b/docs/execution_patterns/remote/hosts.yml @@ -0,0 +1,38 @@ +all: + vars: + # These vars are used to access the remote hosts + ansible_user: root + ansible_password: screencast + children: + # Configure individual information about each Splunk Enterprise instance + splunk_search_head: + hosts: + sh1: + ansible_port: 2222 + ansible_host: 0.0.0.0 + splunk: + role: splunk_search_head + splunk_cluster_master: + hosts: + cm1: + ansible_port: 2223 + ansible_host: 0.0.0.0 + splunk: + role: splunk_cluster_master + splunk_indexer: + hosts: + idx1: + ansible_port: 2224 + ansible_host: 0.0.0.0 + splunk: + role: splunk_indexer + idx2: + ansible_port: 2225 + ansible_host: 0.0.0.0 + splunk: + role: splunk_indexer + idx3: + ansible_port: 2226 + ansible_host: 0.0.0.0 + splunk: + role: splunk_indexer diff --git a/docs/execution_patterns/remote/remote-diagram.png b/docs/execution_patterns/remote/remote-diagram.png new file mode 100644 index 0000000000000000000000000000000000000000..69e3752fc69cfb283d8a3a5da5729a8cd8afe7ea GIT binary patch literal 140552 zcmeEtWmHvL+bAh54GPkmE@|nGO?QXVjdV9icY}0ycNsKDHv&qh$fo-)Jm)>f^S$T( z`|iKH$8e10nrlAu>G>34it>_Z$OOnxP*7-KDKTXzD7bhiC|Cl-C%~KKQfm+t6soj^ zsHh@XRFqWF!Oqme+5`$pDlAC@K~rTAFH1)mZ0@gE5VRtOSs;UyD~=IMH;)J=&Fx9W z5IbNPrfb1d75nh6Dx9VbPiQv0lOeoQkfEfaA_AU}&Q4iq?rz0%m3Niv;-1@a)ORS; zlMU8So>77Bi?}oNK*GlG8ij}^w(^u_K|d5U&1)F?Z++{-g$FGy=1?X-?_J$JiL^yq z*UC1ow{LxM`TZ3~5um~XUx|`#Zwq&zLv;i(CvCzCo%(xZJik(=%z~@+N2NlnRSm13 zZV?M(n{JUdNq9Eq?}h+nOb|mo3?tMIzo!L%%P^4djcv#kCd2?O6oP6`YS4o%^aAPl zXGe#HH0q(BQ6Cqdmhbw=v$c)mx_32gcuBFMy$%*kc3Te%(GQI7t>GV^oxdFys~d1L z`BG!Y43>~(=()z|#z#>-$H-TWBWDHM#H1f@zL;mbd=I@x^(|OJ*!qcm z3y6zKJAZ5dC&ZEL9X%W)&bA{qM;A&kqy`SntkPQB>wt7L(SDv_RU%6kSHr?rBrc(6 z_U9@NQfuI?UAR~n?cRG9OaE8gPYi8B(;)AIXd2N>bwF!9sEY$Q$3wR^Warq@95~NrxO;}_LqM8ideWpV94e!9MFf4J`#eW{3WJe>SP^j#(nMi zLPxFrp4U$i4769II5mDS(Wo!cjA89P6&%rT3$u_A_();3gb;N((uHGiW+LJAv4t=% zvB}9|(XWC_OoMZv_5{%_W;8TnOVb$@-8cNGF}D3_Vo`kQRrTX@%?H1+Oou*TW}-WO z2^QtPP#_|-%;O;FC1sW|8;^e`fl4WX^*Kzwg_bz6nteHPBHaVKZNfv=nVc+FA7-l9f{v2OtRf3`DWnt9%QOc^5bDh7oy) z)c8VfYiO@~`(6ia)k)7t(mp>2heG;g@3E(XjhW3D8J>wk_hBs0Tx4#S!#mTin6ay( zDHyky>lG}W(8FGNqyC!udEtuZH8m8PC@#>v1wEqWJGGX$Xc7?`n+dS)JrAM%Q$4CK z%0Fhm%^seE`BRt~RDDRG&C;EUWZzQ`nbm$zF&J2rzNC0p|8@E6GL+(dOo^aMbz0d2 zLXi89@~TTTDChuxfB!%O=ZT-0D;E?{)6@pePeZaJI4AFcH{|)5G@VD@CQ0YwAnzp*M##( z=YFPdFKb15&lxQuWg+f4z6ziQB#jzA! ze6%qcmYDyDgpbfr9C87{Lg+L_H#tJA(STL~Y-=!|P+OeFfFzEnMG3TJ^kP1R5=ml| zL~huQF*{0TG+r*{4pswlrKoF;+z!hrp9k8ZSa!bmvkwg~sZ4`g4F#SdMD$M9$jZL^ z(mPZmUGdbaNBg^DSAer2|2)F`P`0;tKae%vg0g~6j(0D0y;$_4>^^7w#JaKX_MU}@1(YhV;uak@z#MrON5C^BfdES zJ%KqPJN|~Y4Tm?Jgff{tXQY6k(7LEWnMt{g=1!Hr43@($UFu5_Q;xb4VJUT~YiV_3 zLqkQQS7V=5SmTzJn#JKPPyU(EKCE2!mhAdC)dWrhWkY2{euGZKoDCpzczJ>BWuiNc-5eFrD^ zHb-YGC-j|_@xv*jov6u(nc*p&ie|l|iWN5R_^wW$)GncJG2euH`#VY0$Ty$Ay}XPh zd6w~<`nlc{F<1oHD&Z#K){pXmE`j=@-k&Gl4ZaJ0$MG%%l{f9#RMw!$7HbOY#mj0o zL4q{G+NdCjh)9AcCc;iOV$&Da4D3v7D<)oFF7uIwK_j4k<5qC}Aiv7j=>?~bUDPS( zB5FC$ch6BzNcu?BIjzTPmP||1>a{u+80zIr@kg#l7)K~Z3b(9AVlpl?Uor+T)-kGU zzi8TNGS+;e9nPqsO0cOavZ?8`k*qzb#a^gv;A3r1_qgbbE$+Vd_|5P%HNR6+|d79qU z%(cri>P8K{O|qq*F9t6rC0|bhMY5XEdn(~O_vi`r80XlS{)#?pwM4b8oz9Wdk@gXx zz!L#`fe7!>ODr!@uk9=1)4Olmn<+=l{YT8c8V@fX4)4eMUPWR?FYs+C`8h)|zcvyw zBc*@I|5o(1S*#ica|zSVn;N+qQa72ODoxnD8J&T55!7Z#k+qBCdzMKS0y=Abj4_{;B=cx(}hk3lgp_)7ykgrQ`Z_ z1?rbrMO4-bZW+(wTiB1~SE)*wx-I#!E=c z$S=jua0kl&%`Y+|2w(eqsjk6x=Ld47I;EJS~lAP+jC+w!1Fd?X06&z~d&*X0RLN z@*_M)L6+=|2}gkUhv$GlG6Rjx>y&8F(006>a^K2JQ;7H!;gc3Twl-#&VZ-71@c_Yb z-jQ=ue9LsiCc})a+E{ENk>oG zaoZm*Iqv56J@d{R4$l^rTE=V*4t@IW>!=DWOjYdaOIqtG8w=Mz%){DL-dEoE5*{zj z2C5@iJ$+8B?UCxyvhnjnTpoqDWTB*IvtG-u=C=rK}%b=EWAygTFRLAK&g3Pgfm z1iUw7Kcoek-Hj5z+IFnE>X^GKLdn8EfB12AbMI1pUKFu{ufueuZ+ZA^%Kp+}eA7rn zr22i^P^ZVe_DEy&K6uVN@T35p2tn$-cNq zyf3{lJ4ETnzqv=g-xoOwTB%B@OM$J%>*jRtJo~c4W#et{eX+XLdFZQgzOr%Ggf2iL z?<;$C+2GqpJy~2fCZDa-E#}?I8_V^QbaT+HtP<)8LV6m~hw@6OaTVy-x&b#KVSA2Q z(imq8s=*(8Kke1$NOwS)2XSq>WIE#bEx(-~3;FsHil%ul>?73K&u0V#ab_MZ<*nvF zdqmv?U;bQt0i{e2m2CnGduN64M8NLd;0nyQ9jCJ^Wm+*e&UuUqvAIb2laHA^6?)uSQ+#a3JT_lg{r2LrkpH~k(~|G8)G{|6DBvCx4_p> zP<(DYz@v?c(;HGZ8*5uf9yfmSUtjP5&yTN}$w_~G;$+27t|_NTDr)CoLdwC!&h(O8 z0GX7Ol+VG~lt)=i;?M2C|MQvlBl#`Qt%<{r}Zbn~AlSn1zjrts{V%0Lx2` zSA4(D`LCtFG5u|;=5Jd$IA8w0^|z(pwm#y*qu^j+0VW7&+qw|A360K z=l&4OueX3)1d#cd|B|r)GP=8h3KWzO6j)4H)eZU}6TvT2{H$wi*4m@GfErFpL<9_z z8@%FKtC(11n0pJ2i-{{HeuqS-UPB5)2P3VNev0Q2B4iHs!;nHR)p^*?Y zK3egXIJ#R*WE=BpKj`3gq^cfDh$Dr9MihdA!SI8E`~9&73Fa!pZPe)B)_@&wFo@s| z#Q(YJ4^U|2ezDV}vc>`bg!tzg9@I!A;ofEn1yo^KV4I~)!%Io%72y&a4$T%rMQ4G2%*71B(z%{3cn|*!lK~+ zLz#v6;Z9>FIz2C%tgj_^`Ld^LX7jRy*D(RQ{F6x)_4RH0iCo`%Uw#i!S5}T!dmu9p zyH`T^2i4;aaG;qAgYK0l=)~4@dajwcc&0HViszb>4jrYB#wetY<#slsak!acFe<(D z68RtYIUoR&K&>#!lMm2jEAyN-jM}L%HfH``zzuQiu(4fN(cS zLm%k@k!Ty^OG#C41Uabjl`>rr;QJJL{fCBzehQIKZVNuR508yen<^icw4nUvZT#iI zLbb8%b}iR?<$2j9qDvVSPeA9{{qjtN{6i~(`d|Ipq)Aq)L45vwJVGgMaBgEjI$Zq#vh z;BdKh3ED@zqo`ud+@qL8|Dx(oj23|F?@!hEpG$yd<2{OF?c+!Ge2xz>BIlSWBordG@(uXA}gMGJ= zV`k?=9IWKuWcklh01Dz^UHTj#MyMS#HYXMbH;)WULtFbbEraY`vDlfqy81f>>*~sw zI&qht`{Asuf)PmC0c&-}l)6k}lu>S559!o>vUwoSZ^Gu`0=O{Be}7607(NS(5?_3d zBJdMspR9*KAU_Ak?9!6HI7n!BdAV!1&@wSK{a9|Fqcd#ev<%}ZSFfxCe&covlZ{q$ zR9xlPZBDybdz0=s#j0;GEa>PeJM#GMItI}iUw_1Q zdEYF)LnHijwB3YyrLBkx#7ZdIL2`YWnL=E;@<87v*! zNMh2)*lfbDoFd0SID_S86M5oIfEZ%M$@P>=mOS<=59_n9v zT4QN?9)mPB=}fh>q^d)}ieq-thyXFxHp7F zc-lZ{*TLeZ{laNn_~T~@;%D}G3>1xtl4n$%9_(S!c}fnfMAWBgnJV5avNZoWaSL#^z&%!LZ4>hu8fQeNgzLgZC}RpI=D z?8h=PK4Vb_U90jj`(VBy!u`a`W4>qK4eB^N{CD}H)jEp3YTsWM@JS!@Bjeu}-m=(g z?C7L5tM!k`=)LGAPm6Eb^_gs%SMMO%`@sc@GQb6 z0Ge<5UpPkUxh$BRuXr8>3*2A!3pN?t?PpV;DJnkd>uFV0Cv<%jVyOh^}v1yTtYzIXcuE>m(`lyXQgQyN_mTtXfva|~@u zzKX8csJ&*s(0jl`FD<*S5@o%2S+wAE8W<-am$lhUxWLKLt<7;tyhCncR65L9y)E*- zXkSGm4}z4Bl^J-)mE`Fi+IF6)w|{>}7(WwyqTlHO&rF3RZKx7!fU$VFtKdtJb=0yR z{hg*A@C4rpHeHvUHF(daRVsbE@71-EAbq7@BB)topHWsfT2*&)hVpUHouGsXJ%;Ua zsV~Xq8SPmXb31%**GU5LGvFv@XzeXlI^123d-03Qua{Qu@%HXNqWi>lQQOOrFOuB< z3_0b`)OGtF{AR>NWvhNYMsOvX4>B+=f%DGz!T0`z|a0{jX$BkE+p&L!FC0++8Zced98 zP?!(}b(BD;&#!)yb)?Yn!Nb?VoC&>OR{{Ar&r|S6oG?5{Styv-68N&-VagAsw}{ zEd!Uz&S1~!WMzhY&P^h$gdj%BWet7zG@3zmcTTWa{42Z!II1%x5e=N;wR$&MWQ+&E z<|fG}!>F^&LtZ$95@I`Y9?&dNqJm$Kx5D8fy@mYXx&8S$kZ6t8?l}_L5dE>Jp%zZu z#)R|z)%H>twT}Qh9r`o9?yJ5GVfHu-oacl4Qsjwn7-3T37KN{Or5D{5E^J#jlWX7@ zl9AA{4c2IRhrCNuUFzF`%w$Rdo$u!dj5)AKW<1}!QSR**o+n?pL{~xYUjWqY-i`@A zcxk(-WbUFQ!SeuK@lw_8;_AHgK1bMvStyDvph?MCPq|SYJGewsC(_;`-qbudU zp+sSa?an>OD>1yq{;`VL0*g4oT9&FYyMsEHl!`w>Ul8j_1C9)_G*-;U8)twiOM0%$ zxQh>8?0m43slZO)+2S^k%fOQ`xQPrfOYZ4}xAz{_>paFrqM7KS-nzEgDt&1zl7%U3T94I!z0v8SwrVJ)v}r5f*P|AY=7N|wP#jE;Jp5dltm!)qO z)LHm?PDbLN;?jJ|5jpl`-)vZ1&Fu4Beh#hgnXDD(K65m`#&( zKFE37iHLgrRcr%7Mn6gAr>Nw5Kn%>oUnT!8K#vtvNBR1Zzfdm9NkB=-zcUbkJWcn0!g$uzXTha*5zvlJzNFD6AfLxKJhi7P1ym#iwb z!#8m{`iG>y{BdI^%)>VH20G$&7oly6@7M%A+0`Z% z#9Ds}qz5$(3Y#2N(sc$b`H9Be$*UF&No`KFNKN!qsqt$BVa^T07a%CGpK6U$r{rF> z7;{*zG*%wyZKnp|_bk)ZHyI~=#66jYs*YKiT!#zvHHp5rJt8-W}#X&FMmf2HyQA{(?`%KqTW)n0*yQ>SnNZP>Oa7EjI)G zmBo%fN3y=9?`AvC5)cLI69bqq>8O&qLfGDnatY&kCJKO4u-*XzTh!qMP?33SYEJ>P z&vC??JYwo8?WzL3rj4t-Yj%rS$vn{tV9utXUBC+h7e+f}ByrfwnM6$sqOGR70xQY5 zQ_AklS9&&o`<_R%vnL(ipZ|(i8jHL~WGy{Fn@a;R7HyCRasmnDiddZV=1;*W=A^Ww z8O)Ft&fAx<2WyPve;9-0Ow{#kXo}&nWcP7VkyN^AZ?hoN*Kzpt@GVd;t|q^4}iL9`^*EX zkh-bb(uIZ{C9(D0EeCGI#&Ai%`V{G>^qNgnGmDeD$My}@bn>yAGoV~jk8&|j)#e}l zIO6_pneM9h1+fL&ZN&vm5M8e@n>~GpHIkeB8)>k;i1PsF0+x;3X4w_d{tA#E2Zk0E z%7n9lo-8IYAmebzaNJ8D?)XAzlqVaL-3Iq1R@f)@#kU~`3x*MllTkF)J;?){9>~3@ zZOlxy%*S2PafPE+o>e!4iD}d)+Gmvek?ZB>o0!f6xgqm5%`134lJ1?m-Vs^0Sm~gz zCbQ3bC8B^h$2@~CYueT;3ozBSJM$R0LcpOi_Vh}3x^MtUf*<$Dj`3+8G zKPljdpH@^p@j_JTgT0XT_@l)$8(yOCb)3(ZlxNDe0_lgmPUSY zH&gAyF`tY>9&bYE$W$vU17F?#qwQNSr7iCvJDV!m(Q_m>7K>K3ug-GbSO`e0(rw8t zg$ggw8E@j3Ayg{-9(et_K>F`cwNDh`To&1brzcreC;B3R!6*}}Z93+#c}V~fOvmi0 z&R~!`6+2BGrQv{jCIk~7zo*OA#h@~3 z9m!vj?3A>m@ZdAq3Y#nAg@j+c`l~GIKPpX%i&4;YN z_4Q){OH3Ue0rpo(UtN1EbmYv29 z1spT#zS9Xv3lH^d6@O{9c06vvkk!Kby_8O5hDyB;hREbWDJq#*2=OAyBiPYZl8H$v z@GPQtWz2&&QZlCveAbH%7G#glyR#>z36m|3_kP*FE zM!%(pd^OFmS!0~CHMi7RFXvG$PDY}mQhH(Fezwy&?ilq22)0DuzEy+ll~*sKFc&4` zO2;M+BsK7I;`G1t(CfV!%nwpn(9}`xj4Op1>@RQwYoFuy(x2%B=tMp=n%aaLjZ|-^ zfiH|x_QJ9pofmTJ467AvoK0rGaQsy@8gPbj18rU-P6;9kkrpGFL+I^Iv%Sx2fl}78 z#7&UF$I$NMD7&ELRvc2DycjWLxu(Xzv;Yz-m`c5#jWcq43i((gzwKeBb_VM}CNeRY zz&-W&?RRUa7W$LP2?ntwE^Erq7Ye=&V724agAXm1JlxSrec%h^!?myw^AK|( zX{FNo%2|0|(#F;s4-#IJk0nz?zaobtPN_Ma%D!iZi=5>=2JBvyzg8ejqE1Vn;aVy& zgWuD|t)dOo5Y`@)IUw;q5!52Zu1xe;jJnvsJU_Ja<$X_&(Gc{(IGk9dPUHRbyB_r3 zHs$!8{Nt3@Mdu1v?A3LpIYbyq>%GS{n@X@d&Px&!tcfys;$D5q%X(2^X6RS}~W+gDSish^t%CU!(?0t0uhU4F$S zWFN)}Mh|jvCJ(ByD#3@VG2z7NOM3A9L@P{wf5&%!UvZs1Y(2v)O{z4F?J|{5`PVm< zcHYBGtsC*NXZYQh;;*Dj5+qaN#R^VFd6_q6QYAfEmk`si4YZ?6a8f3A`OX!LsxQ^A zwG`WKA;X{Bm!3hh;%uP&U7y2%PHx&9e?1Ab;&L3Z#)Gu5z1>sI(`JyU-(z&dTIQ1- z6|jx*P5IoPWFs)+Ck@NCxt>l)0?A)iDqdWoB=*gb&qceiB4Wac5@& z&wY0~B{v+uL760LaQO*8ASDbEoT#~6aNTfVsbZlLpn`*C+zgR!QI7AAT@$l#S1&qj zYJV&m8`xAjUc|WURC}i-4~a2TuD;99qmdZ1eu+$PQoktuO|ilR}n+l2|;{ zoHbB-1X+tsiR=lX zu^w0wGxUSQ*i<2=)Ek!B1!COC_CSb^DkNNC4)|fMP&$A1jlMOjFu{uLDCKQJoAbPPO##P>1se&Bz_Tyn_9z^>Z;2^{+{8`PWQX# zY~4z?I_M*`LnYpe5x6#w>aNvk>+GA=xG)%xstmjR)nXj~0moiDTcCk$$XFh4CN6u8 z9>0bHhEo=h3w35rV^^9J(_Zu2n+Hnhff!gr9{T($((*+K`jjjN74>;}tfA1_LsUl@ zm%3*q_XUcv4TS{}o@J_@e7&r-qx0QvL^hL+aOvhcrrdf6Ix{BKyeIAz%*1L6b#})- zkZ1d$d`3$wF;yl86*7iFLFk2=oEE+e#YP>~`F-M>4T-W~ll2qh4Ck}%cSNHuJwGvX znU)n6$ygY)viqcLB3jodz+#j9NfXM=Be!*OoBQj!DN%GfbG(>`s-AS!ls@Igy)v&>AiNzTIMFUV2vpQ9hq2q+$2w zu^VjxbDbGW-;F<+x%Sw87Q%iURe~lEf9w;o2Mg)AfjD}rjGy-^Dnl9d=1!0dr~5%9 z9pe?3GB0+g`Zvgm3Uv=zo?5Ed*PSZK(i54DzPFevlB)+wsf8($O+=X5mdMai`72~d zfj}yl;|>Qp*eB7wJTg3arAz>Wv2*#@J-B~12@5O+VwhXS6uf&qLGoF1J{H=+rj~EWzB@3>)natspQ|?b85_=$ zyEsI=Xh8rCl=?)^=Z#{5Umu3+6?%T8tva6xma_^~ew=f-ZY(Ex{%}|B`&!AG6KU`E z>BtOpu>rsVQ6Qn>uESu2>oim2A z5a^Xe%K@`pMlmF_K%7k!D#XcbBNGmXN$U%e#Io@mc@c5`B1HNSqLCIp142HukXecr zv2DQXFPDrV&K1pmK{8Rc&pzK{2_sH{M3H^D%GdJM)C*FuBF{?2!(>K>mI^f5L`p+sml~Qvd4XDuG zkL;vMAE#z`7il~qKp+iBF1KI+=o$*;q`_UzJ($82yn-Vg7lWD6$MG3=XzK8KP|fD5 z6$uy4!N&OMxA@&mT#%u*eK)}^km48qVA5`t^K|)NDHZ|{{5Qfnr9TeP{HLD#n94p5 zcB~b!J~}#Q><<*Bww!#xY>9RP)UdsF0+X{V70fMzbJ0XmHK4Q0fEn$Xe#ZW*+7b&3 zrx~398z_Ze7XT$Fqs4;y3>qMl7vQ7|2@L9EeGvr+uAGzOin9M;>K_f^0X?Al(8}9% z3QW-qu);9d4A((_eDN39NBnXofWru)BL520{wkV1E;?cfN$tH~m#_Y-HvJn}Livxj zMerQ{FG7VR$v?=e5Lqc>13KtUvSz7+}HVeH^LcVTJZd=7H?I;ROzG0K}#p zP08_Bx%oFZz~mJ$elhh~W*a!wnp`Ndz?uNf`k$jr=^_9!w9_=e$dynI5?pB9G@Lok zKR>AhrXQ5m(GdFnl`{vABOaYbfhPaOQ2-)oIdJiq%)EV#`nwhUM^6Uy0kvG<<EPr4E+_>mVBnD(HN2WNRD3bWQpoE$*OUfKp6oCKM> z52^3el4w__Ze7fIm-_N*&kOoTLl~K>5BsZX&*Mn|E()1Fs%@HNcGq9_;Lk};n)^Zd zL7_Qy66LEwJ-idFnt`I`>tJ#C75Sv3B=yUWc1>^gCL3u&Nec@%)z!Y+G)r|WkH_;{ zfNgC;i${ytWeJ)^NV>y^r0JIwC&-V)GSMJ^SW!B_rc$j-8q~ivRFN5)mXxUk2Nze{ z$6qWzu`O>2@~yO_q(SaYIY+X~6Q z7GAah`IqY(AO+L_I!NYkKj@!Kh5=8EBw^Qm?$7As+v?q6SQ#Oyrmm}Oe)r_O?oB?z zykBl-z>f0nMFu%>K~Lx{DY^H$ipKo6FV~Cc)x0xp=R1a*CRiYC4I8C9EP+vhwPxtA zNf%j0%bw0>KFM6AhfQmg&m%i4@+w5EzNTw% z1F^)T?A0Fi0a=|c_%Bz3K?B*8hG4W^td1?7b$4~Eldd-r8)6qlHc-efaJXS6UDeg} zAq&P6g1Soh3y)Pow1xeTXs1v^auk(}y1s@EvPmuu*W$i10a)tAqB)-pv=MyKzFvOzQIH%*LL2_ zN}iXW*wxKtd5*d8yVV`q&o|AM+qv$4U*ReL%4Tu=3HLnZp?&H{%MY+l*QL?Tka&pB zSl9BW_-0u@tnfVt#W0UJ2u-7tSAq7Dy3X^bY=!&7A~$mCH65cx4*Q#5Eg1^Sdj+0r zSQ+Ha=ofMJoh6krX+MyCPF9%Se&NiVq^!txVyxf)^~E0?JACw;{Eol`<$pX5kWcW7 z+O>1)p~RLPf2FX4!?fsI(ODeaCQ3YiHR(|F1%j|xV3E(CHU7GNEl=m*xP5!xrQO;V z;YE9Xk}VC2K6vp?7A7F*Qse@n#7*fvYz3YRuTIR}4&o#1hA{ldQx`Q4d*1Q3YY$?@ z_%Q<9-c_pK7Ii~!?Ep238o=~P=o0C|SD2r_V0J_lXtj&_DIo#6LlETdxjEg)X zqM+P&*%|HtUq9O!MVol6DNYv5N|;Ss9q?L%7NnA=`GUl*=ji4#)XH6u;n;Tyj2@K6s*>l=~la4w31vd0A&c|h6&mTsd2wxU7 zd!ODTd!CM_RDOj|(R(_-*yi^0hZ(WQ=Pf=iW;isB+x)Z}`MO%{5O-9nFxE2^R4h5- z?roEdBb&3G&uh4C@KWmL>xQ@3J`P0=z^XI&!B}3&__Zdfj+0~g6 z>|+=i{TON(MH8w6UYRJ?j|$;ex6MW&$J^&(V|yC`9dvea)xT1s6(WlUqZH|1K-MR7ul6sgTj{Wb_#wG@9E%;=o<+k6KnywXVKe?F8Ube|-eM$LI8r)rd z)V=u}zj9WKYt{SEb+w)2Yj*3H`uX(3N}U6JqwoDW^v&6!+2T)oSi$dUIIJNaBW-Sq z#~}|l@pq?@zM4l_%Li-S*~-PC1rBnXR7W&nd=M{f$Vcg;sm${amCR36T)w)>TwHqS z;Vqzb`;PnA4{O-;Tz>p`BI%v<`t+Vx<{*Q(L|5i%Qqd6$S*TL8!A*hQ#fj&^Qn%nr z(NUKPL1xc;E2hq+r@R)_p0mL%2AK~>idAKF%x_g+o>4}q0}iuw^~ZI;%J&6gNoynD z&Qss-jw2~%3lj$KH-+aSV2&4~ql^%;)r7s%_f$FG<~&&ti&2uk3CiY@Ac# zE$1?aC-u`lcZDX8_eLY&AImaPTz^eyyz>9HxVqM;{5Y8HFNbOF$&4HZ6HI*R@oD<| z$ChFe?`7N8JSX zDqJ6k)xQ=FfC}EbOpr0x`yZz)yVII87_W`neGN^p5QP$!c zA&id?&hoxQyBU1$+f0^!z1ZyQ84$JNAcY~Br?(3;W0F23cWA-AbnR^7vb=c#hq+r| z_k)D5xXp>Nj@hSp5^v;goQZGKl6Svm6%NySV=FK~BeCPd{o7+3VKJVYNh51WB+Hvt z1AkAP!GsZ!+&%bw9KE|LwuU%WPYu6t-CA)u$tGzc^ts46JD6hZz+S^i!4+7~k_zsstK%|rck*>bMKqxj@N;~k8Y>GL$b zzr}72DSl#Dj3|UJ8)7n#*C{HzQE?ih|-DBH~eQvH7&N#FGo?nheIJ0{G%4;e1?2sE}8D+re9)xn; zDu$Wl`{q33d>OkMSz)aGcAk{n=51~#!}uGv@BuK zWqtUUM_eTu7#>V5YnQLbWE47xl4HRw$~h-r`kvO@#bny*$P&E?^|~S6&A~OBX6^)&-v2He176AoI>+h$kS~^9ugua_bCI(({95 z4mY1KU(Fm!wpM)kQwV&K>}N1Em~Q3;PLlX-Dm+Whc31f$FPeCxT#pLuo7^UlFJ6~t z7&JsZCeAg=YSAIbrgeGXo4>Mt7IKB2nx=`4jo^@k z^~9?F`@86*2Y>aUemTEMyqZj{GAdiz(O&e%2Y2YoxHu&%UTQ*iFdwtgaB1QL@v5xOOrinx> zXpc#d6ej6B=i@Xx&>1U8uDo)f$46;ea&{!#mKlF~cRQ-Cq=dP4OjB}#64PmN;@vtk z*6ovT)A{)s?+LY}77j6axxROM$fgPwSKfS%BV*~_M7`C>>}md-nofMCG?uc+TQhux z>Ed~2etLS9oSmrB5m-C=&g&7c_LJ-W&#htwjQomDKMNLuLJMGO??KI??{zk*S_W@q z{JRBHyV)Dc*O$3yniT7NyKd6w>OaE1u4Xpa-o`pq{*>JFUPIq)F3^#=zR`;764E|N zN(UZr-%N8A$;4&aDBL^A{HY6yd=Sd3Rpfw_(7mlK8G%g^bXua%mCg2Ha!`xOye^6q z>1s{pzgA+YP##`Xc5&LDm`VAvsUwbP$h1}Z;GwSOnMix-LL`c}xc*1eN;@0KfA`sn z;2%APztC+U;fu$_aWPrQGGL|2rbs)%F9+PccJ6efwYH{kLHY`ngm<7JVX4+keE}xM z-{~{%#gfX!=vn5ZejSDUG9wYQWFw7yT+sW(kXQ}8csr7#fY3d3+7)@d!tVW+OrNTR zmJtRvy9(_9@Bn@nTNmrNG)`Re2=mxoN~KP>fU$Z7DH0!etT0krz;1xC(o ze(2h+B%u`EF~12>dzA6mGvU>nZb;SwrcUl3-=NO@dT##nDo za=Z!CQN;$4&rp4WgDzn?x#oFk&Yh|}q*H{)IkV|h(#$=ksH$py)OisXmC4@ol+U*4 zZqb$X=3`1#t-;E51ydUq5C7YK%HItM>3*AXwP(n+b z;o@yBZ6$=bzb^=WqtUfEUj*MFw$PB-xEz7L|E&MA#X071(QV%)YVq;1XAc0Bg5q`D zc!JK^=(rM#Q4BXV4>ZIha&t3`3pB7u&{49?}~hw>6hmSbca$W zknZjlk&=>@8cIT>ySq!eLqOoW2lRdXegCys&yrb>_ndp5y{~=kYwvU91(CC!uf0_g z%P(wbw~s?|J~-r?nG6vXr7)p8fg5cgNn`FtO@x+k(-}YqOhwZD+e=?Wxq}?{lgCokulDjEwoE+lVv%j^B&#ZE|ie=ATWC zoPSLs^Xjnqwk)i3b$ChfS=CaDi_sRT8sk0hq<-9t`iO+4?ZRt0^WH?!7A4{83Abl7 zr*;h;xZ3ruq6fdVE9_I5KUI$k9%w?2a8y!zJT6jWope>So754M)eKpbwqtG^arT&Q zV))~Ii&?&{N!Bdod%YAX+nq18oV=E+PI{(In4Vix-(2;5h4p&NH)ZGdO34$x_Dxd7 z)cf(d4FVvRc-vnX(Sj%dVK+D?9wzLLfJS`pr?kZ2Ye1Ypl%kRdLgn2v9`~9rX?J?V(O$+fDDn+OLss(Jx8=7W&aCLaj zowPQ4YSO$o*Tjzl_DRe<9-S3MipIyrR<267(aPgo+H>q8o%i>U*Z%BFp@c>`p~Q9c zVc)JGhX1__;Jnd7VgC4I!bu4pyK8w{C4HVUK;SlO4JIb)*DlFHyG$#WIU?BcPrS+yEeKvKip#7@)XtqvbnF0ps9NxW z>&Hu+SBz>EQ7esQ{qfDC(T9_ofgE?@kC_~xiCfCmjRGekz!bvX1X9QZpMW-6tz0u{ zC{Fl=iow(m^L;sTQRCaY-Nk*yByb*#xZZfJHe*qbY4rGt3g485NW3&Lp%Ex* zSf(!u2fWFgn#(wL+NNx$2KpQ4AGq(Edt9D>t^WC}a^~i!Ce^Mh#_8hXwwx#Z`guHZ z`+K9YOdN5vF2W(kvEq}x8S)(Yf~L3$EU|7~MZ!ug@~dHIw5p1z-^F^K^G)uXTC6E` zBkL>&qvfr|gtMd0$nU3xcXxUsp^xQ%#a;ih^s4ZSOgGA^CL;P)Gk;8=%JX}Va(gIyr|pE^0~(3f~QM*>bv&MCLgs$Hb3g-U9S|_2{LFLZ@kSZ+~qKE+!MreNK3J; zHaIq+f7{AXuN@^g=lfnQM^iIxl@|A95b>DCkR@}&C$`gQ+xzW81a#wFxKz43$p?l! zV0rAfv|xm`L8a^66LK=3OM02xu+q|J$@=W8*X`jDk)F_E&1NHsCC7|WX>m(AcblMe z`~2omUg7njkHb!6laP&u?n%0$)4|5PQ)dX@v`@z#ffL?{)A5o0ma?)*J!xGPD&Y|8 zGd-1ciujs?!?iH9svujhc>$BX5}T%GPp1`gZmScxYRfdoUG-N-^s)5Hi!#MH29Q_4 z5aPV}Sk8%V&$5%CVJs@aI8!G{ESSb~$D@@~r~Iwj`x5t~{+Q?NMq5brze=CZFlz|y z=qoz-B5@2pq(f%m;(z<`JF{LA55LQ$*;OB@>GXqYLDNz}o`D-TYv~##eEAoqtmfytKXwdn^wKhF@C_ zA37}}k65q8R&Cz2+bhXV+f?`Mwg{!0oiF?jzuuH|_V0KQbY3Z{Fx}-e@3q}bJE>?Q zJW9lyTN-6rIyf)EB}LH(O?x?h`DAO|$vLd=?Vaf6<3ttx^VVq4>k4w05(Yy--90_l zKU1BdPt)CpBZ0XHz9oNb3wbi_GV20>odTV}>yU{Y8T|UQY0Dp`TahXCdEH9inP`}K zE7^&rDC{I!d=p(5L)s)bpOzTB*q*jPLb7AD()$W*o%)LzO=_`Te?DR^xu+F)Va z+35+)t80oaF($^q;XtdMiJ5S)JH^XPq@i&q(Mkea8sY&!Cl_a^w)H97U~Qu3SWIJwmi3KzJZTE?I4N*a`be6H z|63{IEDO38C!Myk=9*|Wt;KwwqC!DaevMRF$*Pj9>YI>`F72Je*wMzsr4aGh)E(So z0z^iwpnhtdHZv6cSILChzqI$&Gdmo#mkzU7_^#;OmJWG#eyv2IrxU<62Bc*3!XgA{ z|C7G!U^;F&k$c+>k;lH6nTmM>Po6Fg-sMMU`Yf4LgKI51cwnC|-0Z!#f#agM{j zWwA24#1u6CAroCnNOVLIx z59@b`{tJ&s;ZFv}Y&0d-E>50lNvyw_e@s}=WMSQrKBgv-+c|F->{Xb4N-H35r$T56 zSFJFPH>n=4Q|6{>UDg*IEld^Onxguo;N$Ce3Wq7}zt~?)JiGHI_@& zq(UYyy>lkrZ(rzHWd!6ab#$((=48foW{#)#+Sp@+zu9!MjX#b0(r&ME&B!`bIQlR% zdia}4QrEs=dK2TO6FWg+$>Q}|fU<|wSb9+w^!S5D{bVwz-b|D^+1Sg{MRlJ~S?6ZF zcH%}zrg((a0;cZ|z5q}yVny5rwu5qX6z5(re&qvw8m-sl=Bqh~6o+$5pHLv6Mx?|Y z=ZL}exjg3Lc}i)+z)};X+)jOB3>W7Zk6@p$hCu^rRq^#P*C*qvnb3!@t=5k6=6f7> zCvjvjBQ3^^;>DXk02n+jLg*BS%O%0Wnzf>1(!ryygt8p+`=BjD2L89Q4)kqcr~yq3 zI5mOBsrdl~DAkGKT}sT5Q=p+ui_+Gz(J1buEzhb_)L>@5BY|L`X@(+b!8eb4c1n= zeo;-mCR5A8G$leUj%e95Uuu#bXhyG+01fm{#LB$DpMg^5>!}@-DCqv0hy!EA1LvZ_GU9?L)mcMKc}H zzOhEYh=RRKB@TSLcBQJ?=v}836ZBTV98?so#@D7+^UHofD7~Dka9rnHpB8#PG*XlS z{;b?LO+$o>i$9Hh-d~1K=GJq@Yp+8rtW&GDgp&IY?k z!87WNyU-81aI-Qc{N0Efpq0ijT50@1+8J=99oh_`b*a1EjlKqD<4VbDzp%~MbC|kq zQJNqmQZAtO!~x)0LEzN@p#feSzr! z<*oj9FaGF>*u>7YdPx<Ob9ipgbM+*0qhn$ij*GURH@l zn#*fRkB_3}m2YKaBs|GxJ@;`q{yomtm-3RidVkZk*JP#i#)P_d6I4uk8gDGeOOoKn zs@Als$@JUB3(JR(h}a@&2yid4>QT3)e{kT^A2`*YKRe{^DVjaLk1XJh5n({Nr=?f^ z?>3iCZ3HF%PVEPL{zk+0N58Qn$3)`%bHLSTt-@mVLz2QJ=`L?eI+R?;(!Q;rGF2#V z3w^03bsdg`4&>$PMCt4Cpooq+vbvjw09=3jY$KI*rcj{|J)F*lr~6FECQvT*Wxwm$ zZX#YW4V9zal9bG$P5nAs)Yu7>`NLJ_uFEPn_ja_k)$&QH4N)QoqHK+8vdQ{}AwFZ0OB= zy8Ej7dJXfcqm=wB=E|cP%Jc<>Q3EA?a~|D8@bg`cynUmf)EXJhZuP~o*f*rW1vPeu z#b=YLrIWoLbkjwm)yO@2<0bQk)p`OmJ*v|o3zGwAFPwt5G^H+_7VY>ZZ~1;#CmN6x ztQKm4mYcZ?u~1-w=f(l75d4iX47hSe7Di{`vH?3^x2Dlkki8E$cSV-vBwy}o@uP4& zDqcf$onTGR6EKj-GbHS}pJ2K^Bjo8=y6bd+vpv@ol%Nrh7-P0g+A%rK(XLgUw&%FI z%ZNG+bocBR$Ini#9jv=PCwzYtqRW(2g2vY#G5N|H(1%Ac+@$Q1;-QmovQwRwD9^4Q z+diK7d*tz>3=jsjAO;vLWMqN{V~C_f-2rIEMgk2{Gm`7;&x|p7I%pr5iKM1NgFOwl zRr-#XZogGZ;mlp)sQGTk!4U>;hw~4okiljqiu!_e^&b(*S0-x;f zJJt}WF;i_O`xgRD#DJfF*Q*Vaa%2>d52V^KJ} zl3!3h+?Ercr-Tt!a9paNfE7z4rshhgBdJ#TclKB5?+xV5~76P+@ui$KUK;ZT^x52HJ1(%!e9-wpcwumYTC1@l0_ zgEwtR6CfABO$E=@V9p-S)JgC{=j-M zHc>1YB5>OLiGt=~DRtG)2Rh4#iSg<^mR&Rb&cwc4Hwiyinpy<1)R`69-l7m*SWv-x z27g3~d<6tUB*0F)%iweP?i>!tV((-Tu;@82&efzSp-PkH^QBe%#Vu`_{9eE2xA;@G zmxmbfBggB!D+e2*6E7;-((;-H?5-|`q3q|7>AqB5G*TUNGUbl(B#sN~5FRQdyGVAq zic1=jVICD`sa}Q?pPd5u162T{{esRN70L*x&5avBFN>g$r`qOhyFV9b;QHzJcGfPv z*y{IcUy*6Ljj*?N6O^-6*41l1_COaQQI#24rQymE{k-yt{G%;B<=6~0RZTN;*RKa{ z`?=q;lofvcNxqz^Ksb#|DgC_!2-rFTcmshonY>k_c&sRHtG8vHRRJ1$FSM6r#`JY! zOv%pZaltb>3F?D$;tvcO-aODPjUFufE}oO-d9#U(3r!A_LdgRzZzyK0{E(BHM|)$ZB^Ux)>3)vn8{KHZUfU#$Mk&*`Og+!*ibV5V|q9#%#zFUuO?>Q zua37boR*j_occexr(7E~Hf&NUqu&-5M}^5X{GJ>U;ztwU%{8*l*;2t^5jn7k%b~)C1Al z#d1}T_RKP1RL$ZU+YykpYNddhV3tI~_3z*!7?E<(RRQVaT=AFgn_Bt>*IyB2C8XiU zlYJ@m&N1Jjvkg>(7B9p~TSmt@o*fV5uP|D_@>)33+fwGu=ge0EfyT<14L(gfT3@^} zz@rNvPO$i%zhkLhd~AD;-~ca$5E<)hLw=wY6|p)m?A7#Ju>SBIea0q89-7urH&fnL zXmzINV3m^EF@0#dkN+*S+kJDU_nL01BC5Aa^5)9^edGDi%(O-6)nUCs1$O^b$Jy;p zq|>}5no3` z7HW|XzQ73rm`Zz{^U!;ybDw8S%nEL_30E0rF4K{23YF{w)!RNZpdpB_(t?jbgOv*^ zYc2|YCZGUSHAH<}-?e?+aoeQKbVfRN`D6pr*R0e)!y-k2&}M}WwZf6iHotXysKnO7 z;rFVM@YiXhQmLi7>M;2^wQYTX8axox%m5d9zd z9OMR7zAH}ekWG8}W%%Y?xbgI~X?RP!pDv7ss$s|Og97mq)i4HrjBar3k0(^I85>8{WD<^JME=dEY1OXyzzsRr55GG$Zh!2*LfgR%5@J}--1SQZ%uFu{2+FGx-$7Kw^cyOs@E*R|8`HE%FNdhOe z3#_NbY-rB+9FxOwJ@uI=Y9dgNeSevI6)1SVO z@+=V=WzQ=S7GvZ{nXc}3vLEV7H55s!qxG#ze}9_IO@|@=IgqnH|C1 zgGGGHS@GA>rHp*D&Sr6gt4nqkt5PPVf_?Fy1(W@N3=I}VI;a@MkX{AmZS7&*;Jqj| z0YL05_xE15x|1PBrJEm8?RE>=fD`ndm$jggX}m^^C@DJB5iLv}uMHk83=4x`Gm7%l zvML*!s}wsrVE?aQR!ISD2%f)`8Vp3Xs51 zoadL9HS~>N4p$8|^wM3NKGFya<@a-PWMU{OAF$CkzZRgcUS{h!N=;%E0EWx&1)pNr zL?oBp^xs<%GgPn?t*ApFuUVc5R6QT?ytHa$*50;@{$0w(Y^^fft~-|E5U|}KsXlGt z#e$hXDG($0GYw*_XNW?D#i(r9ivQPftYy3nXRLct#{Zgm!ylA=QFJmlkyOHSwORO( zGWyJvr|{&pMLvP#P!&BPzt*zyZONM}w1P^>q_rvYy%5fJahee6F87r7kmX8qiHM%e zGV@sit0JM$Ksn~7vfR1>Uk}&b!3orSDFwJ`8Y>)Nu+cse*noai2GaW>N5G*{kj#_~ zcD(Ea4&F5CHO=l={$R3x92LO%Rj0cG(hsSUQ^39bGT9Jwc9c4mi=JQporN*svTq!R zqC7;0ds=zTFF8Hk_95A+?uvRoK_}Mz(%}jTK+rwZT1MhZ=V(y@(Rhp{Z{#RR@Vb2Ys~@v6t-uy z2v+n8%#MYH3<-{;&2_(QY(ztqW#-w%{pz~yo7Rva9~kJLeFY?j;!(uXWkw4YhbloXgnewl?k1_lCq`xb9crdI{>lTfz(wnadDEyr(G70TZ@no zs1%B*D85U!DB_<3h&jBI?r>}!(jkiSO8JyT-@)Z&6g`&&j`CbY7dg?F!+>DL2a?z< zGzeYTcbZ+w?a3EXw{d-Lj{#;s<;jDE-NxSDnZ4<(njt(;OsB!~DYl=r51rc1Z7W95 z>t^TO*F2bxlH>sH?R#>v|#1C)G0OAwHaG|rh{LSA;_l7l0tUVffUnuW86E2 zh1|d-f?WjAys&7x?l0yxzoh3oao`JBd!0b`lm5m=Loh_{@K|bzjtk8-P4);+I;rb@ zuDiaqrbM-;Uh?&Rd*1GBmZxdOzAKk%%v7Ki!?D>8tk*Nb`m#m;{fTw`xxoO)N2)AU z6+izajLo45bi*2*qQDUb=l0mNI|&yiMz@1F+0GR?ofdw(U;SQrsJ=MyG^()DLsCtv zDOS~rCO6HRpPqSEH_Z(pq5j43!ZsN?7x`(M)_9d0J`-yx5|uKJX(<2ax@9u+&16Aw z@qESX!;7cAM~Ii_519p2Zm@1QbZunHWTjiXE7W=>rpdj2kzdU@+g1&v)<=`SeYbVm2II49W~ni6&rY>OB0-r+=^h<7ZhhF$ znzz9L>UhSb4-_LS|DH}wEGN2(` zP*?B^FR*7+z)Ki6EMMW4%&9lYxtcu9DHZ4=b2u&Ypgj+HWhOTd`?Az?kdMDMmFWKPfIK=wJMZ#IBHus0hehB8yRPLm8h1x7< z)5pi6@?SD4yfax~>h6os|mln^fzbPCmVSx&4*Fsa2|engBnDvEYG; znmK89UX(^j#mw!Q|J<*uAZ4C{rt_;_PQIhZ6;=mtJalF4_o>EP!_WU9Wn4{!Mj>pW@Zlc|b`^1i1)0pd4pv3IzKO%wfSRKxQfR;C>1$tKtQ zlcz)rFRk|;Ki(-7x=I&#-xGEgrqlGsxSGU*SXY)2oi%hSIq3KF8`APBkNv3h3Qs@R zx#5G4QF36D6kB6copLYcBdVZOpws z8*Omd?PLYoT0G<={;BTdR@d?qSmjUm(~SjO9V-+(T+oTxY@)3-HHi3wq0>&;xcK-} zEf+FYQ<8;NpWJ8zRIfkFe!3G_7Z+(&x5(t@bWa%G`and6-E6%~3N?zWmsuW??L!KO zetX&bs0_bVPY>KaP;&?$^S9a_%1Z%80w*bGnDr}Xt)0YGUt7Le&_p#&p@6HAgIi_; zc2f$FW*uXFa)IL__gsWC(%T;t0vUMLU12%jRn5>)xU-6xz-VDN7e!qpGpshlF`;CHq=VD`S|F;y*KZ~9+2qa#Nx0r6jQkvoJ4lkn*qlf(Cy;M zYStdsZ*@2a=sRsIzmiOC42vKVYK6|*6(zi5mUrV0__CW;Xu4lw4$tseNvEuVpyNwz zR^HrFyn3moWeyo~V|EJSxjkz>Q7ZDwU(=jE>yhobIux*Oh)*OK(1fYOvAAJZu)y45 zkP)V>bC zjZQO6`8q{}QK?y0%Us`mb@U8CDeT?cH%b38*;5R~nvb|F6b)7U1C7TPjk`a6Dx+q; z4PPc@x6*D(d<-{TkheO07b?jt*^DTJ0$E#A_OYOIq1{B?9IomNjNGynl|)DKU2%=d zI@zJNoy;-49`A_?7kRH|zZV`X;w@9-0@y;C%bv)^pt`KTSww;?}+U(F#o8AD@ zT93xfyCMQe3Q-J&kQF2Lz%~WO3Vv70Qx=}bTBMel^(6@xu9CZ>x$hw;<;Vv*Nma%N>l$ zO^z*r9;X3?kV{8e8Xy5l0V|Xu`UGoXz;-mc0>t@Hb|C$lYN0Jl1OMmD==_@*x97Xe zv&2$p)S+S7$ZmVtpSEOE&}BTU_&$nJ?l$KpL0-u!*<}jYcgUQjTas5DV)Il`E2O^m zKswwtjfD`&&h@#X9hxSi7;^C#ba`hE~*WM1%<3MmB8XS zn8Li$`=ki|G|>`L3J?Wu51tuk)Ad`ypZ&=Ve93cG>1Urz&Y&t@Kl_;nzWo%aO^%I8 zW^v?|9|<+iG}Ep82^ESSi0%T*nlQ_$-+m%)suviqLm?5_4+F6(LH_B-Zr zCI?>xd9#Sbax$Kf&S|K#%v%UzL`L#Cd_Ea5vid-}n24?TSU%6aUK$>oEyIeYp=YI1$~Kjua7{ABEv*n5FoKkVw}|qvGaE4k0r(C0 z$(Mv<-7#mR`aUs~$R5R??HP^2;d}J@)GxkRbb4p?r@E@NfQXfyC33T`*#RV2lB#E3 z`)L*(+9>5K^Y(KLcPdmRKySVM^^k#2kwIsCFY&s*XUsWPA@mA&s|<@_OD{uR95pf_ zdj0f=kby~H=h}uMN7KhPty_tM*Q$dY8lLVmN#ULG`8VNhzPlJ zN|zWFLU4g6dost z-@(|$8W%-KIr1|+_V&i3k;LH=M95|YuGz)#E4OD4N2hwi9QNd^g?$*0OTd%_n(r5E z^LUWu=k^thuun_Y7^$-^Vu?o84~WPGV+=zyiba>w+}_5#e0LcjDf992UCRM)U?j$( zb3XOSheQyB!Ud_B7VZIZG#qj?*coH-*wk6^4Iu*rj&)@Z-`;&}ltL^`6*E7tzuD=h zYSSk^I*K2o`A{7(X<=0>dp;!aL08v6{D7Wgtkm`F^<&Xj5xh;~ai|CiV1;MDRE{Js z#8AM&5Ar7W9JqCv`vzX3#UPuOV_V(OXXQjWHm0VIsuBb2>-*rexDxpp`3sVrW4@`Cu2z}=|OjsN!FvHQH!lPNsd@L~$h3$8$_X;=Hyk*yA40su%`7u8z`vI>%DwUE{ z$qF`dsVl0htX?lcA^H=C$9;=wFCw-_KWc{*t8mCA_fiZuGa`%r=x;QETHTsN&ARV; z(egc2dGm?0Jy`M(?!f|L`laEthAV{ZVwIc zzC5y$jhI-(A`C(S_v#5LC7cY|FA>I_gr`Z@8&*}ayiuR>3aI$(49`*Z}alAt{R?2#=JtkDP+{O}N*TmHn!YM@~B&kCRDy{clWIUB3 zPw4wOPDMNzsI+)>V*yWvLw<(`k0O;S9(w_E-1|=$;Dg29?jccb3T-ziYwyO$JVG?F zZ^|$!bd0^Ed_&>GLJOz#XgLN%8l-bbKTHs`@Fk0};83%PWtZZO{2dGpGK1)893Q{I z6M_9oVDCL)_z1w@ajfP+&Q#R7C&m>O#llS8N<(JzNH5UvHshEP$RVe$-ieUDn6;|B zm+ZS!wynu81g8!fo*P7-aYmX)f&nO}hFdlQ9)kmea&g{|eSmKV3&7v7lUxZJqGE-C zb5SI?EHp6(6>?k&u5f$OQMp~b|cnBNPnyp4GzV~h>oWs z?Rx_lvNa7nSOXvFA)xsHE7%!9--B1Hv4h$`Yb#DUHNkrRYlgpWqkkb9TNjGVQmQVH zf`D(n|JkrdAekOt3)Z@`{Rc#)4}_jEP{c(EL*)eT9$;wa03oL$P|&?P#Jh3QSSxXG$hy(;1Et?T95A@Ul#&A z%@NxS54#$4fRdQ|S@C0}k)`6H*^*Nff8#V0nFmo>sp(+2VStG{l@fR>yOE|-9-+%h zISoj23|=T0fMvWX!C^G_Prl1?dh*Sokf3)TrlIUnv$aD^YK#PWoD>uZb*z$Yv}1|k zYFI&KjxNq$;r=tU84uv-yAmD#e=Gz>D5iwNM5Y_Wh$PednQ*&v*6H{*TaP4Ou+}0q z`wBCt>9jhKZsk8CgRKBC2xaz4y!UY+_ewQ~N~%+|ux^ndn!2}6>8&)0>24gLn?TR@bPkE~oAsph9ZL+oBBC}R4`?*fy=YGN~% zDmLc_?O#^|kns^b?~Hu7=PTwvTSifW+`NqR5z{}j=v_?27UE_qGntgef+R*F##e7| z|Kur*jmKR}%}xJ%S(<1F5RvV_+!RG zRTrSrq#}po%AFoCPC)v!d0)AMkR1_-e-jEI{s~=UtpBXg$A-dNgZ=}1-u8%SgErCk z%^2Jm6b`XSauQC_S)x&@d~IDKd2=;P64^;c*>EugNt)*UVN6Um1Rz^WV=N9r z<2T-L#{!5?h6IWzTzdZnc^iyi{S=OgrngSLw8!y^|Hv+1()|+0s3?w;@5Lb6D>~>S zOfy-WnCbqSZDq5cuxNaT0PmT^3r|%6vls$kvDggkDG;#YR*FS7C~=6A#&|4<3fb_C z3rVbWOV(;ZdpRLhEsgF~%ylZ6=+us@3E6BUF8mp!sIy|$gc^9`@>BX5Q3RSnK^RB~ z+Q^FE!7CVnL45IAkIcosLPOf#*Z#cBb2F2pd~6$o`w}djKjIxh`xjm);4`CJ?0Gb&ROlIP7V?fjWbZ$p@rkDZlS?rS^;yyUaRE*RI4Uf6 z3YXLTjBL14)lt=gq_6@FV(q3)YCA(-rNdML}!estl1gU{TShj_c)VvzozBeutkq~$z zUU^szz+r+0{N*mNx9Ci4CjJzVjP49%Mh%Z7D(LaF;0ykgKIKuVqu^AbXOyP^3x%I6 zXcJN&!B3d_H-dp&901rvb<-RgclQ~^8uFwt;V(H-@?XN;a`;+hGfY2E&^wDfg}X+d zJ|OX9rTP0c_g@xF1GsH0QuW^mMn=|rOv8zafQ5iZ@ZD)E+8gIhen4yqk0Cd=8ekW; z|Bwd&KrjsuJfSo#*07atP$39!zs(IhGKJD$M0h7h$f0L%lip_V4ht$4QYk@bTM#}g z$Am&&2oRr$3PFbG?aBWO!)R|>FlATlBH-+II~^MiCr0^VIB;!fojvNeeSpUN{4&>P zED#;>b8KRS;%E}I-!gx^4rc#Bet@G{rlCf`mIuzmIym5JP;p_eNJIwX6pR^JTrmn9 z?YxQNcO0Z%AR&mi6L=7LOPyq~s%`xexQz2Zx5R?D00E+WgF^vew9g(@bEfs2I4@UE z*&_*coEE6UZX~((evIc7m9s1|r0I7?wz)sAW48554qdUTWt9M*a`BuMEAl&TSj45! zA5;HdjPe1|fWxvuJC&e(_Q3p{fJcSILXz6H-}X$tXrDxcz#ncNKuH=_Cb+)@XI~XZ zWrNJg3Z?#eOAJZC=h~D^zcRwyM$Q{gs%x&P%t|j8Mf_?kgj>W&qSG8&BC6Uguc0KB z#KlPEVjgHhkh4QBfc}gR> zJ3KHXMmEf?;&sfu9_Nmlt^2{GkqBDLhUX1uK1usAk;;uA=d`vkJH_h!#&^sMEB&EFZatIQJ$sA}J%f~Xmbnh932T!2O2=j=nQiVy zy=nI{v0&LS59^SX$c16vNb$#g3AkOT=6(|3g5nZ(>Dq2$wg<6`1hJiX`#6r0wdZ%P@}QO}lu$EtP3>m6*D2eC_~j@*p?DS^X$f zHCzs6n=VP9fId29&;cxkkq0uQ8vt;h)_bHqvY?sJf1%GvHn!0DAWY&BEfWX*wLK|0 zzV5AT90?_r~PM<;sZq@p2mj#C4Y_s)H#fCuhChQKBS}EI;q3Dy!`W%kj67$p7BPXg;71 z#?1RUj|uiKaH^_L1YAApus|n`t?1|12}CEixnxan z*J^WXx_F1udwF^J)~n6ILyPAQXQY7;t&3$j2G#<@FdrujZ)=gj{?@=H%N$&){V(X* zj}#OIIi3+f<$XV>;sMR@C{n<`jNPZsPc0z&mPCXi zAo~ql+bS4tOW>|r&VB*#G6qkCuNS~>%t?CpL+hg)sggjL$cd6Os^Dq;rI_@R!|tw! z!WSnLRU*UZNzZUUU?5Tk(9PKs^)~HNdE*-d<73dg%cOLFR6A}xK3>vC+Cf$!L*mf! zqb?%q#Tmi44zZPMiiX<}SZlAYw#UZCOJ_x_-Pv}=QRjTU+n?5`+1)C%^EEh#f{g5G zY((Dzi#5yMZsIuRf}Tcw1m~WkGf92q%FuFcPlcVf4seN4IEEIYbK2R5;(CEM+ric| z?d>&Z^*=02*4hBh1}?w`qI}B~ZsxAmronJPh$v->q~2w$;&gqLr6E{=S?l-;{0P55 zEo8pznvo{p=}f3gv6hb*m0_{=Cw!x;&*6AA6LZWKHeMz~!~-mIE|st6Qs*1y6ZxsO z*X3tE^6OydF}p|%3}7D5UQ~Xwx#|yD>mMnZ$?5B8nEU9MZ7Ij^{Aqod6ThQj0r<4o z*_2tQdjc?tb8^hp4zwaWc=b)2Be0*UPl1#)HUI}rzt3pvpq9p{N;(2gc**HJG?Z@h z%NuryYl`pWSb=4S;&khJZ7Ba`C2%+FJ&*F>;O{?s#{ctr@-~NpcBl$x+9SD>yf}@(ke1poTrYU?`G!tlIlAZ zqVz>?Z_`VQnJ*@MAA|K|xy^=?#*c#)($G;y2pYJ@GkAgX60YH~z*H&J_}MA2j~d0XYq$MS1hDXma^|H!WQ_TPg&=wF~0mCT1%2M}iOHcXMg8(9_g!pO?=FVwqpWKtvb%&oMbXV3kMg~e$=n$P}! zl;bn3z@-;xbG=szTDjnn#6CozijJOXgz*m7lo$nJJ;2>{rY#KcMs4^ICD_(xa3Bp%IhiVkTa#f#lv84vb8+vTcS<{EMuXlI?k$<7Ap}{_T~4sZ zC6j#S8=DPp7yc!iNz)YO>;L=l0g8f5>#p%EEA%^SgOe}@V=Rt*v?;EoO^x{&Sm~Yn z&SaFJkcN*>YdvTkrIvc*{|PuiRPzTY?2An#b-#Ou6GU!qLHaRvHXi&7aK88t6g8K_;p4YBe2&<9z2Id|NHg-fDjHjn-|Do`JRuyUf%`XE6^e$ zGM%^t&amT?*M)0rSfkI1d`G@W20_$r2D7BHe%88upi8R2DO!+r$9Y1Ser4O>Z{U z6@lK6NWm>DCGZXiYOclLSG%qbd63oGn1I{Qo=E#enq-YB(XiS44wP@|v>`Pbk)rNOf5ZLPt6kSdEM5jJ| z_&=2j%-6ILDj^ok4DI*s8f=MhU>Bb&6lG}k(O|;J8dR7iTuX)CdnBVC2q~FAwHS-x zHZ>00E-_jA*V&doz%j=z*Ene2=N}(x?5}u`mzz|$r&O;UBR}}Zzep@`t`n&OOKTYA zYX{X*g023KcmkN&j1O=SYtwcdn16r~?8M-HOc?r9n&e5|+{9?;&+TyaR~1uR2TOgG zZ5b9&(IMgTQTtaVr10^FiJnGvp}6-oRIo&bd{99HAib38Y$wEAP~|;Ac_BKX`$n>4 z%uMU;zx5u>s!Yg(lFCfNY=4~NH^%eG%G12)VT+jb;)AZiqKsL-5!NVb`=wPr-B= zjsE7}l9|GX022Ty0w2>d*tSG(fhfobe@+#U`YdMt~P9w-KBX3F(Ed6a`botP~8vu>5*@Pn#%*{Sq% z-G2zo{S&gE15aR>y|ChiJ>eZK{0gF!z+ujI>ZAVh?Neia8fH$FASmgGkXb7&NuiQm zSD4@5rsUtSu!ChEU1xMANmww4NW!T@2L0Jj(flZ_$oJ1Wn-OBZKNL0}^m`GgHHA@B z1z>Fu;%zKg1LI(DN>jsdS21lPF7dLBthxscx4ku0nj)AO|NpIpXaFRs84zsf^*xXZpd@5k+(5Qe!5eS`Lpy@r9%3ad z9MBA0dRpmrZ%au*F&@9Z(-UIIu;EQhxF$O^?6rllC2F7;d-nyw`(1b+`85-g?dzM{ zp$unbDr~;Px zkKj*xhETnoTC1ML+|a%-u)-ME`1i+tUcdG*Vk9skk0NR65|U zcjzpJr$(f&a6|Zs#FxVF04KB~l36HQ@Wf<>3mY~&hb`RI{V`TFU8f-`bLHf`r3SPd zl^Ghm5a6YTD})ecMKb3^-~AK9gW}v2b87m*;FdhL(#)t}?o_V$pxgHE!!*IfPJEg+ z*WV4t2fMb;u6~L?{qRy%G7M_K<{MBxhkYa>>mY^$+*Z3F90zRzU@h{}!0pA$3k*a+ z-JeLN$KnHbK+2Q}M+5UOkQYn#YBEaes;Rmq}TjV6t!w!C8F`VEd zneZa!p-ZJ3dJs9(1aQm7O^1Mf3P7%PlE6x3KDuW6H+P+x?26L zi5-giq{oR5|D5>Z$$~$s23H+ijQ3XgCe!Kn9blqJ&I9pd~iq zVN?YE1h`(mTMRpQCl;HyF0O%?LK&BlJ0b$j?Jow~O%16g+if;ht{E&0K*@rKUuOWn zEyD~PUVJJYjsPU7J=TnMB$=XK3ZUP-MxWFrlM0crqs;2mIzbP2H!HG+Dg?fG$94vriFAVy%Z zF`P-981V9Kpw8K=0b1zMOmOD-&-|Q&)3&cmB#y{CeO?clU)EbL4h|)`PT`gJBoP$Q z`7dN*(iLgvVBFp5lxQX#7%W%tVEsFHQ}~n~Bv^Vn+0$Q{CUp%AYpTAy!vwY48c2fX48CZo$ zGPy5)<=^p4PNy@?S70MyZPu)Dy5MQu)m*E_`eF$$zK3oEXVCkR%goF5P~=-2~j$87=V*gQ4(vvOelbb&wm zhAphRt4oxLDB%R`S#p{&SMNhFH2}nK)EKGI0V8@s3bc5#Ju>;%8i>Qrt&09oASpCQ zWm8$)qrmB#yf$5B5FrtWXL3maq8P$h*g0xJs+vR#QtwjmhESFRt^Uu>>auLs!WQHfqaEUO%}RLW2>J?pxaYXgZr1ENqh&4i{V z`7}pqwGW)KG8K~xZrfe&@LI0%}b+RicS2x28_ z*d_Cuk%7!k+ZCyrAex2_Ue@1lqmp64=iGu6MD4HtpFIadNaG>q;4_yWtsNC`{u5fN zmOv$`!wX zP5E667}@v@gB{>K$r>swv`=pvTJ4!@u5`N4(1D=KZqO3T4BdUAX=XO_Z~G6CxZ3}3 zh>jW$<~t1P%H@D21^`uclyZx)k$!dv%ba#nY%Vc6pf)+eW+Y&p55PdbvB6TWyy9Hs zgE|-V>ay7=U{Q$|1Wz>aE&d^RqW_Eb(t+Y*<(q^++t;>lX|6Gkj&XHKcJCN(uaWs+ zGM@h>E-y&`?7uJ|aHNb2j!*hhy9$BDLP7?Fhxm&Agrr=JXYZYL=N%fXj=8bZra`8@ zgv9@imV&=ajJj5A5j-wl3<5rMqI$)m31$x#sx>?}gm3xeDGyC~`^!0OV$&~GeV#(@ zQ=`=R)bkSvZb(=m2dCjyyo)`Sz``WUMjs5Y%SZ{>`JN9v2;|;?UUO4w5Ww~Udk;9ZWleC5A>UlU zGv@4IJqdo=J0ONMKw@7=u|NHj{LyuZJ<^g zz|eo@{FXq4!dY>yD~o&vOx=rSJi=v<*7P+Dvme`sJT3R&-sm{#z(Sf2LSW{Yx@RHwm>*4fE$suz3b{!#nRegl|Nd z{VT>ZpS5T)U!RzS&5Z@GYaiT$Oy?uyC=+Bw_ItlU6Rd1lb_m0L?#5}&Y2I&oa{dtphBnOpco z-^s%Q_?MLbyyG2OVs{^X}mjQe>1*OjoZ&e42WWw0& zo39AeXoPy4h3nz&Y{t+*+AZf(wyJfyO~W&+doW)PE(lnwj}{Kt^&n$&eUuu1Y9H^9 zIS}j7|8@VoEs0TGi70<(#x{PZcdAEB{vv5wNcHPAJBVTltb+uC;ST%TT1hn5hIuq7 zrC$gkqDj~u212Z+qI9Y+uTn8-Z2N|b!68IAhS8q?cn~pOjqQxO{gW)SgI1*;DxU;P zMwo{0uSgO-Cb8z54dXel;%7&=pBmQF;|H(a3yZtE3#j-7H-B8TNbYwJW!8;)$Q7VC zQO}q)$0?ei@5NiixA#L9X|W}!GnjXGSj=TuIVCQA+%!atQ9QLkm|gAdnM_^T+2=md z?31Z3K0;J|J$Gn$WEm@hts`=)*O!r|Ty9)7=lL<#Wa#{Sj5)NmDV(%!Uarf(*a5*G zrJShpHLn7B;#Bpu@~`eWQYASlI?kb# z;W6={^K&dx?#ug228(z9Dqc~%>)%I>A9=O$Jzd*B6vRWM@q^_BY9wBPl%8*f7qHpI zAW%xYwRw&7ew1<{TnQNsj%!9mC*r>taEN&7^uVB0Yp*T@s$Nb`Ou*A~ffsFcBCp@V z#Lm^RM8<3%#%Xc1mZp39z?!FrecCX)b4r7uE|!`vyzum^IyoJ8v&zel$K;EuvSknp z&kGW^%@hO!B0_XUd*NGjl#LCwaDP9<>1{pn3VH3S;jZ1li81!QGCDPO36J+T9!sSX(?wpkAY6wz@9EV&|cca>4 z-Ck2=882QX-hu;ob@f%Q*D|ue_lj;Dn+R3et7~b(SWv!&0yP&WLj*%@p080$ch`^G zK#g{3sfR0t^Xx;u&nVXp$~|WY%T42H#vakXv`9yms%1j;rV&r8X(_hr z0j7&5Bl3Ri=y!fvSi@O0!aLXd{Sw$fun)kR(Dn(_xlB3l+TSXVMMiToOe5O+zP3jGmUPISDWQE_7a7Jg!GYeu*}`U zFyv_UOzQY`$oTXDZ|+BbOr%zf8U9xbJKVCu{ONU-hs_*#`Fs>y!`Yds~7}FMrhvy2Z%L=kUasKL43nG?fYLlu#I=72*Y?uU06-KeddX$=bwBHfj@vjQ+h*_xLk z_iwp=R1;835NvH3iSdPN$d{Jz!~@dZ}_8r&>ggXtRey1svv#{lny8BWqD1| zY1s9ut^mBuIV7FZ8jG z%`WZX%3D+$SJ=${h_sroC(|55arA!jtL>9&w8Bz<#3zi4OZZBI^q=U;!_U4c&JzLX75aJfQLVx7dO{U!aP9(_?%tO>m7?69|nw zUA++MWB-P-(HOqD$b1sn_OeCEKy%pG_ML?EO^5;nWwhtZ0b7AWx|7!Z%f6hf66x4d zlgx^%dnn~9Irhah&KUg$mLEYKp&qf{3ooO0mHE{A3r`C%9rs65rn$ujEf{{Sr&wpFQ7YFxAaBDUg~Zz}R@O#Upm^1%=I8naAn&Xjb`j zjC2u8kV2c@VjH%Tqa;HmH{xmN-+a4Zs(Q9zIxRSZICZS>zluU(2{(T8C3OW`^+ta@QUX5e?wQQq^9!3a$OHX9x-B zoMvHInobs6dc7MV7pIn{~k!D*xG5n8#kj{84`x`Xrn0ASb}6vAilzMO1ghc^(qUX?M+P{)+-fS$682g3?mbo`vAx4xHq4*Bn@`oVj5bSL~ z;x$se?Eo2wSd!JHT;nq2as<%^E6icgC~s(BS2{jj%6DqfIOsK zwD%7`z}75#a>6i2dt>cI-NG<h6lP(i)P>b$-5U~#?>sYpJd*C&t+~Y)$ zgz}47Rv+3t#o9X6hTu-k;=AQ~ghT;bdPsk_JTXgx;g% zUVS{AAL94F{A|*^Q?b;j6;Er>Pa2-lk{zMza6v?=x%oQ5&FiQnsrHc5Ts5c-Cc8*b z>7WUJ@>*lDm!?1ML>6sz`QsQgz(YOW#tgtTwweyaSu09&I{qGh9%f7|p5anjtApv2 zI4ql?C6x?t)KS4IP8F8iCqIlkowCKn=!bpJtOFBYi~p=B_)T61c1CEYHRIUF+D9gj z0g(kR6TTgDoI3n-Qo1T<~3I@OZUcKy% z-c`T%`Cfr6&aqQnaWM!QB4J?ob4Pl>k>3w1cJ>S%0=n|A!DTNlEPQa9rbm#fasJJ|tlumZ$%tVA-Z#_#iqCQ}V@Bqo$`OucZGz#XX`bs#L>BJTspK{4Swf)tWH+%kq|EN*Gsm6^Vj6=ZI z-D8IGa7XP^=v$9ZkQv~be(g+m?j%Xd?#qO!Fk@v2>SpU5tB12$Z@#om(MU+8^)Z?L_u&4~p>}JZ@lwz#X*_==1 z17jb}m}QtP5lbP=(#5X7`FZW{sKblSleG2seX+eGfA@{d#K>JtVp6tfJK1Bx|H_=|2?SzheH|;;hf^igFaS z-Sg?ldA_bnf_^#>HNcZ;W*HkfE|*xY=ECK!c6RGP-YV`^Q>(<{=ZjPL1Be?c;7~QJ zAMZ+6c!8|4}iT9pkQoqXghU3;QM+3IuWFYn}fLoK>m?od|^7xp4|BP~?NINpX-xZ0aH^&lE!EI`GWm%!!Le>@4k|W3#BC; zusff4`(Mmd5hT$Egi*@&h6$B6iS=W~iMwC*eef$B{3MS;!Ih8lgyP=372Qh$k3FMH zJ?%L?^yOuDm% zy7tpKLZ5bG0H@8UTk&px2nwB&mY8}HtOpsLD?Ov3MabTc!7%ms$gzRV-*Y?_2zRpg zt~WHnev~m2ZWZNaYQ*l|#07O_e2qr7M%%v2}1SO;82DGe}bvsMA z;ZQI~s4E3=`h*Je4)JqbktJ*2)b6hG61DWJtM`%O;isTaSfv4^xMIL{fJGN&tIgUQ z9q8oBLNFjIhV5u4+4U&ii@7Nr)lv(a90_8n+#JH(dz5U_L5(1uI>qIV(oPrUyAGI>nt`cL0EjGK8lmS8uYrUxl1lXE|z=| z3~s}Gp~Q8kEMjkV?J<{427Pj{=ZNNVYOd%x?*B8wHekw{<&gjTB5v(Pj-pfY@Im1t)lmLP8;Vw7HqCFf#l)xWP$_ zZF@a3xf~dljQ6IZ$K#ZteRNO=_@;3lU1e}lk(I6KA7gjTq%V-EIY#&3Nj@+}`&u{8 zq^(ak-?~!4+H&=nHz3RIi`7kph5%OTJZB8 z5&MribJ;wIf#+@HF3J6bzhi=(cZ3#x5YDMFK5YN{PINm0R~|l2KMX4?Q%0RhSVQ&O z#Z8wG`rkA6@#z$c_OQ!;ZfO|f__UtVqe(#wTY^i5KM|RDC46#5r#3|f#!g=fmpl)L zDxXS_b~d|>A8r|2c2i#(RC~kGpxF`S5els@M;WLk1q0z|qMGUN6Cx+2@lttQPl+!9 z7~iY-d+T!d;~$3E{<_io5LHK-5QV2i2I1D{rm?}#JWdL6Z7mbHIBXSd$i9m@Gv~Wz zv#FG%zAj1Zc|~uIDHj5zm+r%!&KF*j#+;RL$+aFQ=6gF2>cTZ>Ut2bj8ZP6<635EV zsn+%*I_=qurC{C-+I!ynNThIacH>Ib9ZIlSk6N%p@OX=$tx1r)fPMA9XMU*Tz9lvN zZ^9KsVlQieq0JzLQev&NIl6S@ahJW@t4yTlGis`UjK_3cItkfEZ=0e2Ykdn*+Yt>C z+5I02(vx*^L+BQ@h#no|akMy_6rKXh8&Xi1#Us9ZAmHGv552au23(&OJw&u$^Wu-iFm+sn?bCd$Zh{oPwI1rMp zmqM8pHT#%1tdG)(H~!=+PvT=!dAV2_`t`#USA_FvT(;~UBj5ihmWNGQRbn>Nhv+ z!HwBHYF@92mgnZ~?vQHyQH;f*<4_<1ifB@RdcjQ9e5ru|FAf-|P+jYmVz8#e;?JpkY@ zbhuOdlW?N&RV};;z9;BS2;eG;!a>z*Bomn~EOcZ&z<*+lt4ine()9bUROtTb=gC$Q+<jx6D?_f*n1S36<1C%T)wv}7Ng>0=k0ejm_TRCNx7}A;d*U#+Qzyx>nVw}(RRK;TdN+{PDpf@gnaja_2WK9y(h--9*DtI}D{rNXY0 z+X^_SUzf%|B8mt;n{$hX%s;*hKPj?+PiXy$vGI=%**gKuuwT+@zXcAuFhK~EVm z5C9QEM7=Xdq);E2;QDjLF@guGwre9`elv&(2oDU0+*iGQEugFD6qsux@udoh9`@qq zg1Ow^M-2(Rx)=-7FS92Y9@iHJS>RX>v^ z^4()awMoRvmG=!E>*1?)J9{_JpY+C)Ac;|(qbm0;#k@6V_8&MtO~_IbyHKUM zO17h@3!Z9GKsXL4Js{Xa0J_qc3zGAMr_DGk<#o!`WIS)8t~8PK&lH_tSkfivEOJ!) zAJIAx$aV+b!G)DuZxz*DQ!D5409pwj-{<>`=i>@~vBw`l-v?(Z%_NaPZ_{S-*lbs8 z$mqJiHMa(poywW9G2nxP5IbftpPcGQcVNyu3>G6M!}$f~`KMW)qetc*f~Hq{1k$nT zcE>(_`WS{<$A!|dyhQTxudv&Omv92Vb}F+5d2w)HB+Baf!EKZE6Q&!Y7ElCd4qdeR zRL#1<1_>k_=g4`Qc$mz8Y%rTp z!j9XIT*j!O&o@d!i#QvqzOSc=MK4Y)rUj2_1TP01Ng7J319Qv(cxu73>kU?9W{m18 zej`kTU5hsi5?yq_i%I8v$y{o=$#`;IQMsQ?k8+t*~CYn^3LQkgyu>Z1g!3(CERkR^G3`vR$D#0BF<&Zl* z7_An~Fnr&PI}RRy4G0>3d2>faRVdGsp^HL84LD04Q#gmO1Qyy+*h?y=-nnTq$ZJ^Y z#AW9dl~4I-%9MFL0a5F(ODjQYib0baQhAZXUsw3)E7C2ReV!TcT8PWv0CDR{_DCi0 z^EcvoH^(R|3iS|J4pbC_w*e^E4j+=iPm*9}$n;>lCMOwpY+klfgi`}KN&%_K;({|;1t4N;jula7*eyf9-zKW(6&_w&zhI8?`Cfq9ZvZaq3 zJllEktDx8C#pJNPDZB?CCAbacnx9%Z>L~r*T!F(5{Rvc+!AmFTP=V=~-{lY)z<`N2 zD><;(3pgyBZC2ol@!?27-e(N;R083&bA*^H7r7}Qh8|nWL&rx*TI2`7bP%X9Fs zR-H0!+JZEGB8Tur)g&N!W8@kM0Gkdn$mZX=Q)PH1f(Rp{**IKu)CpI#`;=TRcia9j zm;-*;0@GI_n@!c2ur$~%uM5o%@y$1P^w{jRg8tcZpyq^>@8^+u%7KF&8jzeC2jdpzymxbsM}<9=wsh5lclr3@Cpi{+kc^5=fNY&|D+N2S0q+6wFUWHw! z!zv$F*U0YQ3Uk1u)&sg*+dpeS_79*8$tE&jlAcZqE*?pf7-8k&l4QPGt(^99%W<*f z9+KQmz+sVr>)I=r__$vnJg0Uu!`^V&yQ_cahyMOF?v#g$X}acur;U9K_M0ZxH&cZm z{&~mOlO8f>oy~=09y;M*4UctngLJ1Y5;x{N6gRyt1Q#2k5WfQkmFWI!U~FCXx#u^{r&VmK#+M}vEJy(l(BLPsv|vSZ|5 z<^7&HNHhr3V-A@>vIT?V`;UW~l+VCnW{d=hXp*c294ynQVVoDupVEF&Ar6W@UkxE0 zTq_8YV?^7v)ay>6m3E7@q;-$tdcWdmyko`q-EbgkB!meL8hRz zP(HF3P-s8LD1l!=0NN zMB#olP>kFeanco0YyP~|X)Nf-IOV)Wm&_HFwJ2}5ryi_Ej$v?!TCdqyx`AF=C%UQl z6@EtY&d<(g2VoaY0HUj!=woOaYrnabMvZ_wJkl4QgtasW?J*+fM}Lf{lYt20nmO;c z@~jj;>>@-uUhi%~LRsGwr4goRn5bwPo5`zRJDLeYdhX1z5&kl5zmY!^`7CswE&=CW*;3D2Qhfq#BJ?i9k+@6PvNC7 z-%ji1tMuTv9sMCte|mx6M1bRI*LJ9B;TV#DS9v6CPe;f7fg&5ZyNszUe(z0{=r|v2 z$RTc|KXe+YSNv0kj&)r4OQ-amn{^t2ji$D6t-Mv zw6?V=oT~bDg>FO(*j4!_aieH=UOEAz1w!=wDlJ-PAd`?2ACL5n{xY@a+_ z+Sa2%$YKI1C`AK$oE~7hy-&!zhT!;r%)bB8Qh~-Fxjai5T_5WCJJ#TEeH4CMrEk`O zM=--Wm7gOry|sy8=G`<_5_Ak?1-bg>#<{kquPB}55ho>MuxXmfmn|eB@jv?e?1K{| za=D*6{;0R)TH3oDCHQ3g>VLmKi@?yq7EF8?Bd?uMnTZUh;XbygXG=RtSrKzrf=XYNGP}`KZ{SQciUTb`& zy-HsHLLidkWO%dG7gE>X7jnulVCZ4`3)gc;5F~+wuQ+K(@m;Vt|BWD}pMb&iMahp> zT(qqH9gmvQ%8r+IRhgI~i`n-gRUK?S{{}Ii(Slkcww7+y3iX=8=Hp$Lkht($zOqNj zHC-IY5WCC4-r;QZz?_a#syhx*rngD-wcUP2!4J`LR^wK?3rMkhiP!J;GcoPeDETdz z)f3gE5ya#%vfJSLTDUXav^5-37Kh&=ZnuNf$GL!4S2aWQAt%RZud5=-)r{>gs#qj}_7fvvt{n!wmkow(H8`*E9FT zueUVVUu|55Rjad{Wur5SCM>BxSxg3wa+~U=XCVt%^mjG(b_|6nk4bZW082Bo-+7;v za5Vou?rk9wyA(LBlMGvPLBpPH37ue`6IRpETk0#vzd%_^$U8yAc4j;gU|+T>mCVm8 z<(RD{lkLQr@WYA0z?K;e6I*&tap~ZZrNh&m5#X7zh2{T4gy9f(d?uQMEK-CNEVAGD zdZhyix*_B`cvG=I5~?{bMhm1?qo z9_CNI;w_2AN^k_@d(ce`@%k8oN>d!U&gYm0u4yy382}lRVs- zcYPsYbAC&II5pOvKOl1WhJQAgc4VDl4D+GdadxcD;&+PmiT{I4NMLxzDEvih^Huw* z!Op-g7UX^qi)HB94Fk%+JIULEG0jhdc@0q<^;+r8fBsb26)tiCIxI1a=9L&}rLr$= zPS-U1vVk$phHAqA0-O|rL}H%Ch!SnimP3RpnRm98q%Iu;c?Md1Z* z1yuD898I|YYWLHV;7b?p()qUgrE-d@2K;j7Iz@h!C2cDw-5c1tut|s>M zQF$HpcvzLaY=ug-RE5(rn;F?%_Zs4^sn|sodzJ494ERW2Iw?xd`k4rv4Wf|W7R`3& zi+i8Ej*>j{3H>4BiSZ6@Oj}%wCBJdjmq|j#oYXs=aoSSudNb(?;h|!(1vSe=ePhgt zksxEVg?8-|>^2?j5RM!E!7Qyw!Kw4}bR~bKF(eHt%U#5mw#ygB!n&joAi51q1Sd|I3=!fu}Qb~5hdP=${QUrIMub_O4S~r)C^v4{% zE0G~id1-m=J!y(YwnSMN^F_N8r&@~>_x~yR!U8$Fnd<7eQM&n-C1dn0e$#VZN?0Aeb-y|0Uft$s4Gm%)7j23$fRJkp%=B`uh9UEJ!B%)=n7)2YspO90bW)Hm^j&qCXurMQ|NmlF8J#Z&a$pYlI)H zJIpS+d0q$!=v+Xi)i74Ad;wv}H1Vs}MTp8FRMz2$76sv zmd=xV_NQp*wbjDpXc@u}5^pC$>$|$f3MJMV5K|9T5GaNWmKi`Grh%26{=0J_#yZhQM@frm& zExZ#5Yf&WD`kqTIBZE4Q{JqWf=jv3)l;UmXG7hrK7M{KMAMq>!(S;1P*XaX+elh_( zG#(NE6oP!zn3F$9OfdY2Wg=Rm_WRv47@-I(Obm}OTlwfCD2aQmA$D5Q76{#6xAI;k zo1riwO67>)XLxg^SThoJjFU&+pA*rK%rG08%pca2S{=etnepmxW>P@w736SKv?;x2 z48LhiSpiWP9ne_%x&$Fk+m|%%!?eMRI*tFhCAiSBMuU(*O0Yq?J$iSH8pJM=&bb2n zEksk5QZqmC6B&N!E@B(E=beUoP?-Hgt9e^etO@I3R92`bNQIS1tD8>VXs(=@->VIj zGDbni!6Lu5^ocl5xh)?xb=;fO_ve;R(N6yLj}p%7GDjw<(90*(Lb{8NOTWvMOrC?i zflMCA!CL!AgTnx>$s(&vZpVWG|EKC&CriJ6KQFt4{gL9$?0?Jscr&AmQW3$i$Oj=b zF3Ura=0ZHxTmg8P{$h+Gk%$ubHm}z!@J@v24DC7 z7?=-#z!Ki+C^_f6GIn=&k%G2CHf>Y4gmj1K8Sf{2WjJa*-)AC)Y-B05uL#B@=8-BzKcR@yD&%Ftu zbjz%ks})Cw2^?uPgB6e3=08v68NG$A7}mYq&|qxN*=Pir3B_=a=oj1t{|`}D85Y;F zEpZ7B!5sz&E`i|g?(P;WI0SbcoWX;J;O_1WPH=a3cjs}=z4v>+=I6}x?%iFrs#YyM zUBew9R}p2Xu`Qij8N4GA)P%!r_E#xJXR;?UGJ}u^hHFl*yxdRo))s;|G^i+2ezT+U ztuF8k?#YRsJ4yQ17$x(!dah)(2IZDahq!UgL4@L@;hO56BQ4H<4Au$NCMH}K>5?}- z`4t~siPLqYmbNEHJAGoit<+HB0380wol&+{o>pYE`Jq3diSEP_e3Dh%k~*9T}6|;-3q|^r#=R-*-EhU8@yKqk|CiXET26v*RvVKm- zwtiN}w*1uIMpyT~LFc~wY_8=z0*a{#lJ2?V{KGShDfM>Fdwn*tvkTipf#|^0#`*O= z%j>LtU2bjVaWBJ}mK0hWlLeI?#DL&I8APs2zkAAEN=2d!Z|)orGQBVDv4BpRa=v8D z&Fb*ThuXfU)&F*Z)5~hsOJ_xez}Zr)jD|IiR-WAeQH5zXC0;>^P_020`;;GP23ZJG zrI_gGQ?VQ~y>nQ5{)E5+(O^Lwd`$4Ht#w;g#U*Rt?T%TIB*lGxWD0=21X(r*PpdIw zY&OB@%}A*uc>n#3g6n|E$B_Owi|O%nhL&2+qqBi#<)xn3_5>bavv|ThWUUH9CY{D| z79OK@q@aaYk=+koxUaB1DybLPim*kV(+4Jusc-q-r8qi0S7xQaeoc|B{C&z1*8ozT z7)V-P^ZZ`Y?`geGr5GA@R$&|L#X9un$*+X*%m#xDDcXh30&_&Zk-juX&wIhr(B1N*YOI08$kD^XV|hqmw^wP-AZ@MBKqU{mAyQ7^RRD>FcAB zGLaeSf(cI82`z*JXylr1ne`8x(*r-l$`&7=`$>oYp>$ag*yps;Zgyf_X%0VM4u8KX zRSg{!Rn?S69wds1e5IOHEzwGLPh$DH8C+ma9VF4esW%}KWnai@C7Rtx5vumtgpI0K zJ*Kuo-bR!Da^O-KcRZ+NLb#)*P0sXllHF2KT%s*)y!^2SEu<9vZ?=ri;RvU;L)m^X z6NY)|Enoh3Gy1m~(XHYVr}Q6M?NC1b3<7bO398s%b>cXpyhOP?=i$eV0aC&(a2h$4 zN_qPzJTtZBa&9P+?nZc8ygi^(p05xJEj^r)u8tslcPMo~Y@QJ8?*XgJ%73$R|;j31BZoh7Spe zM%-A9bzIu5vy@I>2HMmgv@PLt0VHVeC-8y*OX^-a3nnSjij_XGl>7`Z0sbUGXVBpE zrHCE>(ffL16IwvdZ;`v8Z2FcH2ke(taUfp)O)hKP^V38);hzLo+u-RJ1B$-aN8A~=jQZ5>f{>!{?Y z_BDjZSWVJxQ5zbFX$0@y>VBdhmVgX7IQ^EOzSOl^jlR zYY)TTNFE+##--OzN(GUf^F7!5ek-GmU+d-ZuaZgp7#*2@)z5i#)tg;3cJjhLO58wc zCQ5X(H^Q0C7#t&>y3E!lRByIdV7&@S8M*sguoL*G*^JCzK)6Q)Of{9T_Hr|P&pm26 zP8#8e-FDTG$;fX0?8(^by^INYpJHqIaV`6kJ6KXq+=xvHJn_$^lQU?|Rq91R4B8uu zM+2xBq`)jbZ)@}_D_-b<#07Lixma-MB$H%cs5@@*_})@%cHLq-ip8er(blO*+b*Oo zhPkkCxCb&{P36dRzHAC*@@|Oq35^(fU$nH{p9BdnZjX10@Z1wq@MB2Q@O;w%qJci6 zt-r`Vo|L~2>D&9kj}$@05iBe9(~?3t1+qUJ^)~J_j3^|P1Bl~1QTb(1c{kzNcA5}* z95)}13c6UYW@kUydcXAh?K(Gk_&gU~UTTzTT4ud{Bo^VvDE zv4bn-Py?2vWh;VonRw-EHpcp0-p~E0OL6`tl%74rBJ;ngJ#KWy4*77tsJ%UmhNYf} z58oD&6g0jquctyfUs6yVB{Qc|87g?IX0`9~ME}T(xNtpL6pZgxWQ>@-#&B49Zjt{4Ep`lTbzk>TGtd2VOF5y4d?taAFg{(!)!*@ap!&` zm(vB}l75X(47&drv~@4uz?slHOzzl}qB0;r}dAfoslxc#I6~8wvl$0fLjoqar6ek;(>! zCnb(Bgfl(Hc94?9G%yrxq-=+x3%-aO-O^&Vpb5NKiwZ zi^NHmJMtfJ3v=%_kMC6Yoey@ng+NqOes>Wx)nPH^-uoGVgan)M^%ifzAPaPFzBAN5 zyZW~s!i=A@kZw_{U>@d{rRpvkErW*B;3oWKH=%KXUbyV(u2ZR6UpayE_rpZ zzBV_W^QU!~*`8N^s#bMJvXdWj8Ev=Ot1Z?LcYyUS<9GOR>Y=tqw_FvQ5x;s1@LDl< z%g0YKrRk`V`Cqhw8~{xkP(TB^o6L-uW7jkOG1PW$Mi8DiUHKH$Qp1Yw!VDAQ``#S3 zn-}Q^nfnEWb9@PF0Dh-N#U5X+f5`*oOb405XA;G&$aQ?$?akory773nW_R#%-(+fY z@pGI|%XW#g`ee~Gb23zuYq?H~kb%zuD#{?==GFQz5LX|urpv2GtNn+z?VnVq3H3-E zW;xQ%w+uPoTYP-Dts>cVp+n2+l|ehG)FYaz3LHMoyvkm~fa1DEt~!sh5I`J7Vt zV7EdJcVsKY{RdF5RxPlE!}$wvB<5ePxucHp1-W->%L(FI7uQ6N- zjDcEO*-|;!%K3TwJ3~#R20(QM&_zKRCK_gH+;7F~_Sc#f*W1SuH{`(r6PVmJl|U-T zO*Xgp^UAn4$xJfAw@yF0O-b^tZgAJy_?k~b+as8tZLckR%U1vQXeO(ALEBZ-%VwMD zF7x}VSOoe34`lF0RdwOei+!ODKPcE|(oo0IkwmS^38?~BTuEYp%3A^4A!+& zy_61@^DjMqJOAMeZ!|8aGMzW?=f$wA{_Xdfad}0>L{$E#AgSv?er#0V5WS`V(X4Yi zEs=I;dM-BsE?-Pz**$Mc=2gGayM0MKUg*l&$}*WqhJrLhxp?UhT>zj$pt1XhDp^t> zxUO)j^}UZacUmn_-GT(R`tfb$_Nvrz)!ZnI!8US#iCOb~<=nSbgVNt0nsleY>*1$S zD@7RgxbQ&`$A}2&&(&rVA74Fg(jM(SMTSBzWfoRwkvh1`5w>)&cpRTl=v_W!X4&yk zZN*$K>V2AnG_8jyF1;k35{Y~lU4b2mG@yTG^OJ@yy-{C~DM+mR5`7gdIJ_1)mkJIs zZ{9-k=qKT4Yp(~MdQp8%1`xMlH^qJ*2L>p5EKW}=Sg;v!F)qjkoqY3QK~ZO}Ed=6k z9TT0%dK38R8+ddP*=Ej#h3|xua0@STgCrT#fyQLjS@?v-l5IeUdkR;bErvSR+dnbyQd|Zi z-|LM^YDwHTj3IdYFb`Y8eulrB)4pVjQ6bP9I`i0<(ZU=k!p533e#tYa`tr1&E|}8i ztT6&=E~RQ$k8mN?0@Qtp=s`Qy79^$mqj1V>lWY(Ac3Q)3e{f(ob=qrVb~-Fy(H$K>JTH=ObxJ;`Q)4|PKAHXD(n%iY`Z(oi#Zmx!nxgE($r7( z8AoyYI|3dQJROw0BH$Ey$9b~Jhe5a*$K+%xwAg}dee02 zG!u-p(`Z3L``&yCS3ejLcAQCR3l-tg`whR%fG$h_e31j}22kv{u zmYs4f7G5ce)r&zwmTr*evdPYbJi$&;;!Pw;h5YH7w$%-S{xBW7$ga134X-A%h1 zD5NP)BH$^$YJJ+OuQR&i^c1+_aY-7ndu#ms^XxYa$@sRhsUMk}flvI)bE9B)`UuHX zg_oe5oK1E=o^y%pd+*MgbmWX@jCoQOg7f@A#nQSuccr&LlK`)IM;ot2d6{0VI1`=$ zpnd7PrFxcP!BQtWKi@&8`_JC!wE5spx%&X+A_iu(;W=q^r;0$P_1Va>#R?q8r|BST zJ{oV9dm2n8fDcq5Knpxumhq)AaXXn_z8ZSNUe`A!SJ)yFva!~IhR*yI-+ zUEN1tQ8&tYp|Dc86dEdFB1gc}5YXZ(qcQ?P-hG=<* z)s#~?bVrHr#Rd!GG;;?VI=D6ifFs6QDAXoBJF-q+b^<@&n4C7`I3Pu(2;l`+$AO`dFSQod5GWXL@DXnue&rdY>s^0 z!42%jyhyupDX))^R2_OmVG@_-(>V1i- zN-$9i*ZMS^I3_Y|r_05p*7;xk91~nl5KFVW+-C!6c@>8~_p9sh?dwLfCS^!q_7aYN z(-OGH9SuNrd z6F+AzSEzR-+m4FQmm!AUsJCkOlHVD~vCLhi^rXPJXz9AsZ&>47p7GFYxN&M~6Aihm zT^CZ9zvT9A15e$koXV$=RV_E>Zd;+Z{#Ewur7u1lUiDpP!RPeWrpaJFD_;ly{3;(t z)`kkwI8%*YGhII8-ql*_kAY@KKSA>KSf?WUi5&`qZmNuK-cYWJLHCDu;2bU-rIQyY ztO?)mY=m5tQiRG|sS>tKpQo!Y1c2e!?Y?JO%!Vx-s~MPMyav@|GTCt&{9=8W9`f3y zNK7hGSdR60N>rnYz5y==W+fA0ItmV>z+{c1;_k(6rY<*++e5I8EETQ)xE1M^?#B?1 zC>*nKxUro0YQ)sHcw~dHVYiWuQ~cgqq9to-umkbL2@_4X(hBKuvd8sE?pw*;#>lit zX{9B|Ki4q!`(GZ*i4oE?puNnhGQ~Yylsg5Oo;8a6Nc+)bs*EN`M8oUWT5x9c2f(dS8-M8XJXI06pv}auw`6tMh8*FUQu6MFwE0c(ELv4 z`y1h4xU=vVR~3_R9A>@HtUO5jH<_B?(JhZ6te~!KiGAPR8P}NVa4D{dzd*=je917e zDIKuS6*bbEBr=!+%Bt35m8WTjapt$#E^dzR=WwQjZdH}r7#Tiy>OYjqI1?=e8Bd9#C>t1ZMhHl}k`etGD30(WB+(!oSbjC6(SZTUuD^{O! z5VFp?tUyEzHhlYqqIu}{0;Us{r|vpH6*i8xTm14V_Qw_xeble>bOT|Vl<`$PC0{GZ zM(2(r6C9SG0$q2HQqJkZRuN~%HZNLCwglFvD#W590Wizbp;m&|3wE&7^9dG}$+!8- zM)=_CFnC_?Tf1~x;@X7URGu%q7V1F0x4lN0lcH7_5(2i(F^A1b{hZo6i-zw5--ft$ z8*3W$1w9~`v`?0C;$($OiR!w=N)utL2AeH>0U8duUh2_50&me%9_-Kz5^mj1Jkp$J z%T@SNjJg@)csSTTvAVgFEOpC-fkTILqtNn+mG02>%2EqS4|W5+0UlamrklxtiDHN8 zEqB^527UPmI|G1N>VVj59UPrp`3Oh}o~$V0;RFP)$*MVztpdNRzr{paaHzBQI@^L- z=~pjl&>2{vRq+S?qJpq9Z$30jH|5l3+WfJx^~+r(+m*9=>9_eXTV#wSj>HKP??NGL1`pA0ig{HrtpcW$w!^PaK|U8=aw8-Qeb1qhYd0*0MAnKCzt0P`B( zoGUM;pD#=?;4S@Kf@BGTtO|SBXf2DeEX6qkn0*fRj{N{|FVwU<{5Y%wlt7&vV(OM} zzk6HGI~H7Z-W}Ad9;XGSPX_Fp4SO@wq!?w;F>$&s(>255$_!*lB3v-ne-yw58;0~ATQYXKjV7es#y3IN0 z?jaV)T4))NuVEjzI=!<|+#NH$wNe&gd~~MBIKv*qy~*l&D-sEGAI)kjRna82Snl4d3kw$@x}!TqSA~jrAunSLV{Aw#Y&1Eg5}TUGp)Rc*B4?;i z{l}{THBNx!u^#(7cdYy`W~BK<86t)G|XH9D%KMo-*QP*y@;Ha!`F=fOIdV`j@F} zfUpeT;jh^qOulH>sj25F({kP+AlYAN#>3B8&%_lShW)4W@kr`B!BETkpTne2Nl8%p7e&vnNM~ z-A>j#e$7XpV=l(mc92i6wA0J#gS{ocla|ZaaXkp$*t9W@u9eWQ&lswm9=NlT?|YDu z1L#WG&Bm-shyGBGJqu#`+4YUVxYPBzAN}`J*jRZi-WMRIdt5a1VVK0RCc=(bPyWR3 znVh)Fu1M&OP4rRJqVdtcnohKJ+?bGvRS2fmO*F!`w?FkxN~fYrF$j^~*h~6uf4P$j zh|FhAb$I#d^D7J-N8DG*`_X)=oz8<&d^P-QNTa%6mY9G>pIl~!u7j=usM;p!&`ik(&dBTZ68c7HDsSU+b zgJHkJ+oeC)Kp z)iovgy0_KlB|Ak5#?{?QPkqa;yi39Zo)rT`G7H%mR~K=!dU7HwGyq>LPgN$WOK*rB%UYNx%_HdT+TRXVul8jX zk_C+qAAiOzLe3W~Nir&iwfulxv3ZC)=5M>AjUB43aX_o9^WT~_)-U3#0pc)ohY*`x zHX05uYIZP)hoh(i)q7_`-7(Pc(An4=O2W(vKeK#-WXW8(Kg{sBd;)9x^)11cdNBEL zPrdHW@A=Md8I9e*g+YQDcX_cyK0jZ-q3#GKJ{oX@f)cZLgOpuXi(ZYfUM==X&sF*I z?iwrct|S2DUT#feoK#z{GUn|TPn3zlocS?a4A>dZp=A)>EpF_F8yBRGyfVN(bIG!#2t1C55K`9!r}%t<+!1=Kn#)|2_Tw`GEiWZ>0*hC1!8~bg8=j zR!QXZ)aUdxZs$+0YtohZC5H&jw65YKf)}XgwIt<%FfxwDWnG3zN$-mlw4k3hTz*|vk2``zbCDW*XE0SbhMPQjxF93Cx~dH%S@r@h9FlPsS6zKbWj;S=&6vRz|cS-NByOH7zc#aiT!i>L5oQ*(;NjOi(d4qu zw*#I`)k7g{w+i>QCnIq}-=9ebM>t1kI2EYR7)XEejYJ5SG=IGMm{odoa5wPKij5_C z%){BtQr`)(v&N>L(!rWb?ZE}F{?v3WU-`gx$N~J4WH*xb;~d)Zq8k$uU2n;#r`Ps> zI6u4^VM41ABuw`Z3s;b_Xgj(a5*$7e7SUkr8NBpxpt&*`#7&To&Wu?DQ=EaQq@{QK z?zIKHR7^iwG5`~Z-csvxv4!?ark6BS{}}5&w(HD?lH^B1pJxkoxvlM5RFCr1JA0ezN$MMA zlHXkZa`ON-`!LcY>F4w1MqK8$ITLv+-OtbZC8%F8QI$ucfd%lNA-u~KXE}$n5DpGx4 zIaD>@de549kd1;DSE+zq7W(97SC@lf2pMiRoostGgYUDmJKZv}p&{)6eI4lKwc!40 z(D1!hEiqA+z3lH4x>+H5h4mlL`gr$>-!XY$DIsHp5%)MLzAzWUNMvt48@ja(-25VX z_RSd&MBSLh=U^F+s`+Fu7^Nz^a4z*HL4d$30E9JflWP8^*rbpPWloG^cYL!j_wNRQ zh7Vv71j8%rmw${_{wngZLw-#TRaJa&Y#}TPhb~NMa1`2u-tg-#yj@aT%xX2%+?Tko zT3-o^&w2|jUVFnflm(llMg+YN1+C3{;l-&w#g$&l*0EoN6soK-HC<`xIq}@J!ylrQ zCXevXzegLlB+~?>dl17 zzBH4-4N`0UF_I%`--w3-luy+<@3yV4lmw3ZBj`3;W;G~&{7YSWdp_S-hL=5O?n97G zRjytIE;`}VW(5{zvfN1uW;9tS9I0ExUi(XzE!%Bo$}JCNcR%Y``en$9!xKXD_HeEF z>#(_udoBfUp{pLDXH}S?dX*F1unegB6=^45HcVzfk6|_hOug`VI(IhzsuuqHpre~N zQ~NucG|%c&Jl_k62KZVb0h2B9kNX4y5dZlLZ0Lv}LSG-ox8Fy!`$_Q=n*)TBMMSa6 zYWr9U1;y7=Ji7n2e{o%)Zx96}SFDg&9txd32ZYw&&i}j5L}4M%X&)en7)j}xkzZ_L zSIXOCLu64IWB9g0V-s(&^b_$E!>zXbNE0wv;IpKggPCi<K_e6yiX8P6fxeb9*gg~nSCIOM%R z(OY|jPxC9fpcb_N2c_y?S>~`jtD%Q1Xw^vAdbUAM4qt=2ZAo8qu zLLg(H9gR%lQ-dj5DR71M+Z-foRlYpjj~%%}j*w>)u)PRMTb3AyN7_mN?dGnpQNK6c znRx6dcFrhjmVKAhtTA`)m}~)*M0la8l$ISdaZ%}Nv6xQj#@s7&lT;}(u{`zHm&Tp< z70U!78S{dJe<6%yFAI;dM86NYI^E53S}8e_Xgc)q65F4GV*zUS!eJv;nkzX>;f5XW zzg&b2@oFvSW@5GELt}YmV|Z?%fbvpGPN4lC*PdV^5ffy(J0RBAO2ORMKggyoyIt+) zjcA=r?{067PRrxtATzC@dPwfZdb0$EP!7WBB)1p%(iar9tH?S1F`j5!cJH5c)_*!0 zV3P-iMXGGZJP;u?JtqxQ@%N#N&XkC7pb39Y z9+!_#J?1o(TwkY9YX2qK>@NVRI;hPizk%1zoPCe0N9}hdHuugw5mOi+I^2J_9XvWz z8;yi%7C!8}D-)AS$g`!h>2^)gQLg!9$r-g-S^QAnuje`4%D1m31 zsr+>%S}|`5Ov4jStlO8DvHdy)6>Hi0L}MjexNE!E2Ilu`pPG%vHf->*%rZXW?+g5V9t$3FN>_=i&kw(k17%u4=yy-$)6Pb+r4~W+FVm*09Hum*1 zit(W*M`Fd6n#jJ(4Us&y_b5f`>GL~ z1KM5$j%yn@5>tmIty%pZV|QilO6harz5R0N{oy(++p>Kv$6cE;FUVY;Wp$9g0EY!q z5TD$dYn6VuAY(HR^gfky$86VDT|a^MYk3nY55zM``0u2A+X?l!eWL@%?c0@xP$a75 zg7l>ip%AIEbFNCjnSL`KaI)l=`tphm!;mc~i`N^upU1B;$NSbclK)YxJks>Yz{E^! zyYv0IybXe7OT3*_K0VL!(Au2A)ySNKUGY}6D@goV8xUU(T!yFO$_*eFn3HkC)Q(^c8f`S69oR<_O$OK3_yBz?JFGSxDMhb;HacJ7`qZ6i!T= zORancOvi$7wB3hIt`8fl`Cv88ajJIz^$6GrlisC~{$xdT9Dh6rq|`+Nc`N093y~(; z6I|g~Ct@ADv2J|{qkR|Rsi%_3bgwPcXWf-^Sy;J7LZg z=DNzLLeq1sz`HCy_&Ff(G(P*2=xc|H@AKG{&4RLwUA+4ioo!uIshAhv2jE*C8m5n% zLzq!;vT7VlB2kJqY#DpTL#4XPf_ ztDjqAPY9P|WBN_lN;yZ|vYGn>>5|wEipEk^sZH$qu~n;$kcLMZ)CNhJeAPl@Pss&4 zjEM}ar!d>Tm36(Hwbonwhafs^{Nv38d6le)GK@4IVM|lJLC05>f(g&R#gXd3a~cVZ zCNxbDvK@sfe8RgAEiLi5s#rO8@z5>?As|Xu?f5gf3P9rvd(=Z+^5gRo*O94cYtc3H z-E~I>e5M^DOSH7gH~U0drM#zDfqI+6q6Mx_7$u_>&Xu^$k!0`Im@2?nfJuV=S(LDY zA&qquwd-_CM8g88?s1nITgo@kALLH6EE~na(mITRkwtNtD~8twc_MQu$oy8ocUDpW zN$3xYjC~zI7PX}snPBbnzw%V@(1*D|ofq61wFx+#6am^!2S(wk!V5Bm%mVM|MjTHq zdDrT9Qryn0k+aUAim}ECwhnnoXUe%KJ5m~s>7AeM`jY>U^W(x_zfgMa482q|U!Bd5 zn2koR5BCf;Mr_YY%CXT;Z$Gg2n)vEJP{#I>1e)80Wh54+Q(z zU(y(so)kdEM6dW4w4G>mES<36p)rzkkzIXWCJ6R&DZSh*hpXFbsniGE+q+CcUC}%( zAN~sSSO;LZztz{lGU5l8OW{s({dx| zUxdgUHQ%2XYRnac(o9%|Nv11>a2o%{xyQ-M3BTMRurX4YuXHs$Ed~Rxr#PrU5Zatj zN4c=mzy9t{6{=Pcg&}^MUYVs*3FOSlyqdn@qHrib@5;N+YP1-BlHX;kB2!mE?=4pM z1m)2T$a+$ka0R!1%L%~pWWIbtJXz}h&jNL!KV+ekU5hJ9D7- z%N?iFyL=@%uZ+`jePR;QH`wRjHD$4Ah6uOB22pRgL!EZ+(n~n|T|F%j%++nM#u;U{ zDF5l9Ko01qP?}%KudbJ?K!u7Snh0~?Oemt9e1I-2z2xYT%0;X9^sdch$&DVrI$T+0 zojX+A)?FbUYVYg7sa&9PC0?vqSmL+Es_%)%lRq^T_lqie2ZOHp1Fzyx$q! z&Q1%z-cGKtiT=}>2>u(G{qS*|_Udwl0|g}YV>FX={@e&2wTd`0-o-zY<+y^}VS;SK zcM+^ZxEbj$9T9FlF-Vi+R@oY{8 z;PdKksv3!hcl98bq+A8l?J2@RWREQIJX52Krq_PRc#;^;Esf-$;98U3RBhXAfI9Fz z@?O3n0hC2XqtB%$`*uG8SZqj|n>;%^DK%+9eyX$ACOk*oW%)t0~}hrITeJ=ZN@ z)Gmpxa{KRThI#t#aBTAMI^6CsbN{{i>)2EgY72?&255!b8k%<6mt>? zE8#R-9)-d-+J$uQ2eYV>cCn42b?BPz{V?p3#&3&=V>hHUUz-)QOnGLS!O$IBL)nahtPiyh)^_T`|TNZg`E#EZO z8{ffdjqM7&W^KHCc6d_yUzqf9?yw@T^T+S-hkYxkq&EFH@z$ZCVs?~g zAp^gV^Qe4K3^$LRRqm^8dc&l7-xWht(YP}+IXyxdz1wnkJ!WtjX0yv8byF9&P2Q5= zRek=l+2a!96g7=H8)hyQt$@T+PyJXnlz!aG4j#VYj7o<=o3etJMaN(UX0x$ez{^`% zz|-D*yLA4~eV+Y!EW7Lk`+_ABkAdgoWq$vY%DXb+f8iV-%&#NO^Dc1qed4FK11&DE z5Y!ymP7#JY%u*O7fI+xr&tL0)8l;`jYtpG+@&T8m#2FZmtC;&6=hx0LQ1_n}@_tGa zQIV}(8UfIhYmycipia_xYkRm-h=QXnoxqv>q$jw|jL!rebHFg4<(Lf?>l-fm>NNuX zkUf&8oXXhSBtz+ehFW!zr=sZm1D!{<$4LuV!Lf$ ztnr=w9%qb)biBAbiSA;2g;K_nqm}#tC5ZwN*k9C|I=dEzqV4@$yO&r$PJT2ScZm#=t zHqf@E0XHDk^Qv7NGXb3vHcfg8(cWISF)Br_OlI4~nraT|L`g7V-ff(KUdfE`-{nUY zfoWTB3vw`e_Lj1ahUxkK);O{o;zeWZI>#qHE+@f94mQcdX38;(%5DCdObeW;uxZfq zS;i-`!rZJ0Z3@IC3B{fwNftDC3jPRz^_Y4OS7@=;Q80iD&r6b_cs&}M#;7c6?>8fI zdt-U*qkRXx^YdwEb>34p?~Rd4F@sGa0-u-TX>OCA-)|!NEeSkSNXr6sgJFf~ZnJ(( zu?Y{6`xN)2r?qx-_#>RBxd2D3w%gmZ*}d|A2(5^=w6T&kYEyAQ=(YcN)-8btn*VdF zlLP(xq<8>|ttdz$y6y~hhue5Jj{&88ph76 zK7acUFXl?b*x--44^vqYO@$+w)xNqg34tuV%?cpI0;XtYKZuQtcYcrBX|&I`v#fRq zJ4V(#A9;6=NM_7v|3tsw2|ziwmHU|Bq69}gi+$DPwizNxI796ArnG3F%xF4>{{>p| zXS`XQn2Y}LN}&)O@v8cArn0OXNTg(UKUpYcHE zzi}KRoOH&!Pjf=*Bme!S|1=g(+~7z@x4zFFH~qW7_hAt43|87Z@=P`W60D`}zD1JF zpv5oyy@`t|)uJF1e%x=I7`tY(=__;Rq%`|_1f`3EG+o42P_KwNCsbQHc?VMMhl2uy@C_HuC5@(c zMa0!L?}k*e;8%cTW6sG#9O!L+Y=P4}BWl`s`1SxP9&(1vtAIbG+2k~zKccM@wGI;# z0HQqmgE=wfd;wjY$CFcEx*W(uRTFP$O9-8T369jG^S^1d*D@RQ?EG9~7}ne5B^nh# z=`=UVb%Ci}V7{D%#!JPy#rF0z5w?xu|IzBbSbwH1e>;#=iF}(T@W)z}__wm$K9y6S z$j3Ir2_0ILNKrGB5LHa!8BtlXMgm<(1{-Nqb@CzZPlty8(jX%Qc7lI9NA`-#CVSb1KaQaVT^K0uD23di)wnwR zkOd6n!PUF7p{tW3RJIz6th}C|=xPdJ=RD)|mU=?t_(mn}7V6kFdP_Rm-5!%${!moEGJ ze)dw;T73$O*v0?X3pa}1g~oGEBM0zlYhMzO=&eaEM!1a6wItt3*kA+(l)I@3Lp;}k z&7B%Q`nS`_4H=<4Ul$E*C$U%SnBUUl46EXw%Sf=RuGFDMI3@<4sQ+=f|BI5)|5+fB z^Rb@>|Imj;$}U9Kcb70z4^v--7w_sQuRB8gn@dcOOG!~Gcnz_P;DiIj(Y~Mr%l8c; z+MRLdJeBWGWfxx|?4WVC%}+fUQciX<&vuU+25*{60fLSBb#}YuF!NAM&>tnqt>GR* zZC|~s`J+W1@nqw)JHjh;yZnyx2*;%1gj5c^^ALov1G?n9F=S4DtxX%vCd6k_lrJ|XhOCzdw&M9MzPh0+j|t+Kh1Ib9-x@&tvj#_NUZ;8gQnf&c zcb81qal}_7bMC-+CY^R|oq!i(r{K8sbCCbyV!BrO&hu0=V+R*77S1stC?}68J|lN6 zsfv!^dQRjJLepP3?Q)8m-vE_)47B~!h=QqICaQl@X;Hp&`}fcSawL`La+a`Lv2|Nj zS)H+SU4xdssz#pAgpRd%K-eFkTic;_=Iv8pW&x04)yT04O7i*i6$`-nO~?FkcS*yS zp3Ug>Gk!iydN1{tAH4rQLp&(?SP0*y)yT-xDyFMW*o{{jNF=^I^Sr@`$MhQmRY|f5 zFC8jY)&k6PR$&ThXTta0GsURP&)C>h>fz-(RPB+lKdVW(%--GCcaqc249WtPB(_R1 z?>VS(8>P`sM*c^g7EoYTMjls-OmhGIT6YA8+`r9qH09+O3@(=YdQ>_u4?l_*n9Re` zgfW5O1kUDL+2Hm4ois6|n4+c#bEx*@hQ)DmV)B#W}m-@tr#2@GB)>>5$M(4uH@GQ>KKYOL>hd{7Bb2yqhWoOVfm z?VO4&tE|#YJ}1uQ=PnDKST`qIC*F+{_Exr_#O;l4=2^OKI3Y? zy(*UHGw;1xVbIV`X%_d_XwJne{qhhhZDL!(<0$*wY82pOjNw^3xfK1L%K^gWMZ8CC zOLKs1lZLz8E;FT_hZ;a0KBb9p7X+l$*Sne#J3plvOL#ay*OA=H}D9;-I2vMTk(*-YWXhUtBtXC*6l& zJv@#F{y(n1Iw;O&`5IYZad(HsC0KBG*WfM*?he775ZrN!>+09(i8|sWTfBCtJrzf)Q(-%u{7`6)%%Dui!ra$sC=ez2V^p7r(u^F? zhC6)AS#DtOTFy(Fs`URzBSZvF0B$|-lS z%NDWg17kP)tRDjl>3lz*bvf0ew*BDe7oIc`pO0*EA1AKEZ(hg$c*lj6xy*@=5tAe} zBD~s5)^8v-6eoPTik>JYWHl1|rQUMmL$vpBeYNaL5hL_xKFMOU9*vVQU2JCjJG!>8 z9Oj4u>d+lExK&9C!S9R-s9W)xu0a{!V}TvynJK@4(=i>)gQ zcPjX=1kVr~a(@q6em-j3HVBCoXBu5Dts5 zf5X!|0K(6^LDM#6)|Pz-*b3pf6Q{Hjj`=9P*B&CfdcNB4Exx44<23m*CIQaQSHC^g z1Kb|>fUbqkBq`{-r~B>C7(EZT%MJgti)NV(0;2XZ^eppQS=*%n%e~*UaTS6|cnQKg zQL8h_RiB*i%g$n^HlS5I3)@d-_>jWAQ50k-gPK~;O z+{2i_o>it*iN**$hD<4ref%^tA$d6>dt0j9e)fOMJ0o{A779!E2{vsogj#SwWkfl5 zXJp1P`U!aFM7?^IEI+;SHys}RW_ywfnh6~2)3U0af(0xjr+;?-enLEl&>$a`WbWtH zSk|Mv5yEni9o{aVStBXwG8CuPSiwUbk*G|yJYnJk*^>EDy}Z8Jn>iYGV7Purx`}@d zwf}1xOJn)6SKr#lMO^lez3}Ek`|w3FR!GT_C^H*qow!4OyOOdL^(Si9AR+i>qq@Xk z+=ca)!&sRzoY9F3K7f|d&_4;xNC}NhMcjnCO`UDU;r&TGYy4`i~4 z={O0+0kBozYDD64MxWHenNmcM*hf_epSQUM)b*IuTv%$RhyW8JFeR@LJE1@2AXq4nz5fV&`(yk?81 zsIgve6=XBhEt6|1_%o%bpS9ShYc=f#-<{xP95I4^%QF})Y?o!#cDDa}-Ud>DB$<)8 zDy1+R`WuB|2XKq*0ytsq`C@`@ekqrob6Ow34k^*7cSpGRL&6sqF&@Om9t&G;aq^X> z!%u~iRse9BZ6PLIp3-Z~q>sccGt;RBBH7+osB&xnEUKd-8W~^Qg%)-NrIP0#&$H1f z-W{^(VX8PhHdD@L!BNtcFAc4Wz9J6RE25w=qzl$g^9^i)P#Z zRkd!hAfK;K{pl=XAWuH@$e}94G5ajZI$5={+}F3bUvT|7uWB=!cNEyZuL+ZVFHIRQ z5}}1&i;ygB7xG@GAS&I0@MTwCAM>>)~eb{j) zvj0G<@pgdTkwxK{gBZE!u2FOFe{ca)Mmh}qCqiqRJ4_90V5WvuRh z0=y#-FK&iALw*?S6SruPTpNWqD)g(qDD)Msf1K3xi+E`fKlQ@QxP5#wDV?_Y+yviH zL*&$KioO=uFHO_YhL$XIwUZJ;r<$0+m_jtyhLS7ZJ`yMSnzWvg6#HR>VVQpq>&^kt>;o+hq?4=Kbpr{n6o@Qwl$G}u9F4^vAfIkU76yo z)DX1|w)5wMWSHcC=lzhZbInQz1KV{hN$njm`L9>&@A7{<1c7;{uG=2U+A1OT&p2Cs z(3nS)#9uW8Pr0%m=m)%|@VMCG6;EvgJ5cHTTU;{6iWiRRQwsT>V}66TE}+L? z42Y;tSki2x^b~~(_qj-rj>eJ=9O?SH}-$axZln)}r6Ep`DIO zt1$qwZUszeKqekaWE(wrQmq3alwUqDBSm1%po{Wb<|+C~<1eXwk9=skuN0~RUXPKj z$E@8(UlS}ENJbr%n<`Tp&BgvtrCky3WQ=!%X2g6CM)5W=VVaI-1etGIzp1Mvf?Zy= z!Yd^54GNyuSjk5|P_h zs|7K1@!)Glpc1uQ^{1T2Du0JT53)%RxTNfN(qX7mDveY8=HMPQO7Ea=Izj-@pahZT=CB!6VIf}93ADp9^aq4@mjZ@EBrXQ!)Wu1gt zPdzNZeap|+PruWe+ir>XdK@0cQEZOQUFQ+`v%&r^pM-QWe$>3uhldm{;CF;S zD=#STl1J=#RWt>jj#so*14!2f2Vs55(kn_`b^B4@KWV8LP-V9YsHslJZ@YufL4YCF zExAdIlXl&(dX9TxdQZZTzyWrEApC&B2I=axt)Pd;>MDGw7IFVxn4vU00L|e7r`YMs zhB6N>^?eCT-yTP1f`|F!mf4G)Ws8jwD$G2NWrl;0O05=ep*!JAnUw!&1iR)?B=X02 z@ikTj111;!VWT#zFs|;&NhXluKDAUJZH5Mu)wO1hH@%WOcRb&y^N%K_(n2CF@;W&B0PV&AQ}yjV=a2A(wY#B>Lb}IMnuVM1g)?yy)^CN1&xE+s+IF7 z5)xJA#XqVu2O&W8H9TFRBh6jvIxC1&)=5$-YZ;Z{=gsfm6Vem+hIkw!D(h0;e4@Hh zpTjZHMhQ#%FIIcVHlH?0W*7%r4S7F;H%r5OvhD?E(KLa#7Sx3^$C?i5vY^n;yRZIV zvc)xmFqe&A{g3Q+V>8TY?`0pG^viH%eK4Tc?gF@gXg^F%CbPd~B@S zLBG84ic=bwIpr2dr1VYYfrIi#V@Ul=rywL_jccbi z>!ij$7ZiWwIS`1{bWz)``r48Q`gE(yX1?lDLZ=%ftKzzflA=Mei_YjXSlt^`=GYrQ zUGuYkaSiR`C}meI^vS?F8TPECw#@q}ffh-o7%07z*-c;AK-UIg(mng|SeiYlVHiX4 zA$My^z!!WNrUVZ~`ka`0O;Gm!&47o(xlygzf9m&tr3~<7u|TD+ayeQJ({xgkG{1kF zzZOaVV2q(JZe(#4*%MOKNY*s=KJ8j4Ek|meyJe?N^vP_|>u1vbIp-&*IuE|F>*+=q z3am!j^eOTf4_1XU@_0(O@a1zBok!(Hx+H0YbdC;O42tD(M7^}b;!)q_%W5U9$^D$d zp3-7eeD1&d*6D~E)_!U4_Z(HD8WUq zSm6uFX-$?h{??)O6I)3$tP5MZ83y#{ns*X-s(`_tCxfPbdhd^av=B)>UPnqV1grf< z0H`)3|7L3!0CH@rg${LiW%zxzTh2>O1UuI_*o?HyT+@%C!dvK-9R>ZS zALHLrHp}0xg%=Xi(YX}xn%%rP(BrdwFa{fv$6_6sK-sBmB|a!$63)M=dbL97AzYo z@gquCgBOi3U4NK-7DjDcgA8cn^XKM;fr@IWgUUH^dbHCQm{pEA zJQ;}wDa!NrSJG)Lal$2?7k;}E!(~k9Y;0{hiy%a4+&H~n_Q(MLX(`W@y}3L2`d|!c zn-)b;(s}oO=|kZ6sG+Y(PsbFEprIb_dX0!>NZbw{;I{lG2+K6wE!gq zAaw<=)L^QV9PJxkRLuemSD0C_wHA6KmyK)e$j1W0I^O(p4<*tXZDheEbc2WoNERU&< zo9)iA*eX=r;s-B?fBddK1dl?W~i+eu0=bv;e^;Ci5sam5=DiX zQhV-Ve8dZHtrguKd5^AYKums?BsECc<_?jdBVbbmYY3{afR~T}%@hxpr4XgngSqFw zT?7Ao-6FmD)@|9E#$RnNzzY~FY&7gIw}c9AQS$jR^|5EysSHnYj}An$PJH4nSJ1Bo zf@#Ka6Qc+Ys90gqG15BG^)i!Vu|qSXz3bitdfKVyXC$dp3T#m05b9Ef0HYM-sDyZW zLTP_(UwcVCouvcNF++FJ!N)f{dFuGTyN#RGFg0%KJ^2(XLvxS*Q(gC)covEkYf9bbqVhK01rJbLlG}kBVDpXGT8l8yVJap3%VPP8iKBs&B{G>r#f9 ztC#joA!@;#PDe^VSQimbz0XUQ&Sl2nlwDNT?6i`)x}8jQmr`)B>B@YpTM_lSAPbIP z$4EiN!}@oo1IYIi(N=Ur|#f6wdmi0^<&hEEsyEo_|RXN$I4Sjbj2C}!VL zvo?#2NBkr4Rech=6{DsZXsteR?_{|d5z&a7Z_652P;kt@5-Q(#(SJ<&oCL;$`NG8cpax6H$*{dzm(#B-c{_wjHPI}#E;GEF)Ar%%*)d!@9M zP0Bu05ssvp{P~bP8dany{C7`6%5AA>${n1~)L@cskM3Q}0h)Nflutn2a1)(&n%;nt z#V!=F?bXAUCA+%bm>r6}(VXw>+R~gXNhF7q=+M_l1vK&Xbgk@L&FJt^6AkGNU7_hdy@AVk0iqSNmc#D{zB)JAQ#a%-UmXf9afUiv1#ynU6OEHz`gG*Zs?*QIIW$HN`?-oFNaSWh+5ek1<3U zFQ2B|ZymtK#Ja2CkdWR%Av){tAS;>4;H_zGLp998IvyXdG2ahOa|jOh*4B(D8q2l+ zn|=c#APSolGHgDr^wM;uaRE>S0MaONpzk{>rM2QsPpu*dP=3*=17UubQsZnx&YnT0 z1edqeKBTPiw}nDPC^D!R#CA5d?Zy)43YJkuG1(LD9>DQ)zd6XIcC>necCK(zi zf<@2Vvp1Vkiluzz1GSP*wKOx4cGS*JTehsG8w+{9P*?k!u@qSoYrJx=)2M^GN@^%KNr>F+tqbEVz)bk{OOIr za&*p$B~umj5fv=8xrzGl1O**&{Y@1r^wf(ATl8-V)gD8_F+wBPj%deTfL^ErGeP)ew{8L5oDQK`fkr0Nk zg;=Z6tAamO#KcC2^NG(fR{*4(LN1a~uD8n)Gq7<7wl0_F@#KEk+kL&Zk!X-E!+{&2 z(qWl&8nJ(nctAyqvD)1Q9-s!6h|xPl{ZPT>YbJceTyg*;SfgquBL%Do`*Re$<=J`f zw~e-EtQ^Q-KXYIqt8`bAc!Gj_5?IBhO+$J62Pt6e2NR?M`NmcspOs0rX0c`@G2v78 zKNq>9Iw)#HAil-q&t^0t4n zQ+ynb2YzdSJPq{iihapU3JK@@B8HM498Kx^oT=Ik_eruh)Cqi(i@r!}ow$)5hVrO0 z9i(0Gw@SN558L33E7$yt8_UGc5k4IT!_$!wo)_)dTNx<-lxF|mcFrflfY`gNrxwrJ zy=-+Zk*nGKzj974kR=pjC?C{Vt1nm|7DcE`tE8x1Y-jJQjY0O?NXfzzWBkX^yOEdv z!Qfd-#R1lbi~_l4>4D_mPF?lDUUiHndx`vvbVDW>7Z}8n-g&uEN?&HOx{j~A z9JebcUkK@k>Xe}(nmvvPGr}PDXw8hS*sDyI-Fnq!qizCy)Iwb?GdT#wmqCDgX3^1t z)@_2XbBV}^MapIKg`$zf&7%h=NpsXm|J#i5FEHMszm+K`c>$>ef58R}jm%_R4H64< zmq!WSFr6yviK*1Hd}J5&`@+d`q0>;(j8M8O)@BFxIJbI z^cc^h#2zkH}`^YCpzVh=|s7`Njvl^e5g;7aA`-bUHYjBM zh%h#4PB$^|f&n-I3y6#zzLmsXVZt?_`1{$_Cp3p=qn0%rE=;$9)6c=XSKJ@^haMYV zy(*&pHN z%Sv$9rRiZxIMUs((p;=mEDCe7Tl?9QjT;%nU|oz{6t>gy<7jRp7T9qB0U>gjs@r3TpPsNmJhojJCFi#Y+drCv%4Y`+b;! z@fT!5oL$JL5@=-34V|KNh&RHFJP^d!%p{mMamBn^s^`4$r!&O(HJ0kNl$C4-I#JRZ zILm9XN+v_E)JAHDIU5ki;=eb*}?MeWAnS$}kP<8oR@g~bvk<@$7 zy`U3K<1Dwv0A*DYOmobrMPB~r!NJpa`13=LH{y0i!`@JWDeus|h{T%p6I_r}|0OvO zR*caMJ{eyHL{%?;ygVpI+Q=cU^&6qMpm;`sDVh?kK)d93;be#R+z86M%FGjtF1&Z@F+kTB=oX-uOh%5)rAoJs!521^LqKB3LB!$Guirig=M{x-J!H}?@WzabEo2gdyPH`b}L1!t6%8e>W>062lbT^<@e z0RzwUzj}u&DMiJ7k#ddOf~!s9Dq>E2u&%ervFq2kq!Aok^1Ptjj3Wg_56b(K{*XdK zXK()au^VA;AtW660}h=O<@_~kxph9fUK@dIMgA$ih4f?R@LsAYbNM<%MnSTUeL%2v z`XM%}Mm)nb5k%tbcS+9U@K|#ksX^Q&$_*1u$_Doz$S>YHZyK0 zXnNjcXJguZYhni*JXpS=_STFHe z-Sg?KWiZcPo`r!gdAdvq*{!j0kM9`kKMp%|bJY_P9TBT?#Jk_oTbW=hO0Rx>aTs8Z z(e+DLEV2&TkYE!;xKdz|)D>^B)T?8Fdiez1BK%MGWB1FB?^AgySM5H^ec*R6YU!=vC zgKD7m*Hn2=VB{)6vRnyS(iA#M)XwR$3K!-P&uE>(=K~G7lTu6cO7_Xxd)*^ARH)kq zm-7rc!iYEiiwvcp2x@{`y**hPG5qtW>22D=0SKlPHlw)ZbWk`=irFyAUx9$9>a_z~@iI7^>-8F zI)r$qHaU+Ra&uMOAVUD%n1cPUIP;>PaR!;bP?#|-==q;^Ai28>57;75b%-aYLPQ!Z zVZ^?7PvS9}Ba!M*5Fm?#U+ z&%B*M_`5XB4T0u>IyO$gh)+#$m-*X}`Lsi{!q?`DOVg!BiR=$3bc~HABVq_st3zhq z%^p_4jlzou844cYqCRB5rF_WXV!1;A!wrze0pB&8rYI~~UcNTN7@=s6frq<8%n_MO zHeO~4eIU{f#VWk%1>o5 z?W?Di9C9x!BwTq)YUD>)mZFh78Caqb$=2(q&@?!r#mWqQ>f(dOl6mjk$6e7|B+^a3 z7q1i51U)!o<^1jcs74kDU^A=`X37=7M2veIZ65MZDGrm-6zhXX#F!p6y3f0w9?$Y} zB+}{!e?>$zL6;@5t5bc7ag3;biQfT9>sFKHzx!IdEZMp5#~8pPD-ohcu1t${;VL)p^x(XsWm?_!sPJ*cyYw)N_ij0-DskyDBLf)j|DVx0 zj~+{Ac|6Zxj*b?A{&pYfF zCLM$ZaM+;1(7X5aQjwm7H=d00)aHXp&NYM~p9%;n$tjpY>4MYb7?D5@{GvZ$a2Q;O z+!|CLkI2EVU>k$xU}x6Hd9o;e`itp75pqw{w6C$p|AFBAERV|mUMY~(_44LC>dzJK z)NBw-jgh-00mrD8J0?Dgr6>2hfTCZf;CmifNHlcO(IEdb0w&+gaCyek1&9j+LKTdR zjM58+<+r)_3ugO=SLmLun`_(ZD6Lb*$L9GNy|Y997(XNTUP&)ThePnFrp_R4h^Ioq zbp;z+{bsz6d(YX$N(6(S?agNU745RkL}xbHlt2S97*7vg@pK+=S*N}Ci|MO_l7H-Y ziJHUVv)CbUWHZ-gy`$7k3#&?C?(`zbQ>uF>i?CY2%muT;EjS^yY&W8tRYo z|GazfBnYDerDHz;!evF@o?BAZKWK$z1z{@cm;B)T%DckjEv5JKbv5jqMFQ6BG)S|F z_?Ci^xac`(l=3Ovobmx9#8T#YYsxgh`$A9cC8&+Q6+YG5q4$<8z%x-~0TUdcywcyN$E%Hagu290_2@ zeXdXGUVYJVt}PuOj2g}~_i6AghAnfQ=zfaaY69_m|4W-ZG>x^>-XL~Z{jk_G@x_kB zl?5#UNt*Fxh--%#ccH+CW`0t4l5F3QO-}=ocfS0~K1vrTAZb;?H-89V1+D+wRfwflnKnTWmNGX|ehyK$eCkc4 zOp{}zFf@En9T9QAyzxeQmrGxR@*L_f-Cy);ROj6X-SNKaJNtmReSuV1sSQA#K0kek zbOzL%Xcx?@9vMb3NL{9oKg7)!n(WGKBx%EI5~e@s0aP~3g&W9Epzi*4@2h9Ox6`1Di>OyV5X_nMUyzqQVMbuP!P4p@vHdMWI{{;7%3@7Ge2{o*gZ6zE^ld z7$Rra5VrTgEC)S7q~}Z@V_+_)y9CDq6CGvQVUAH7i?qnX>;b$9NSH}}m@Aq_bI3pL zjnHlZb{EwrmwlDGH+x}0(Vr5!{B0jEydF$i?`jpJLMz^t$u}&_%~We0zmT1k44>xX ztxWpvv?$q-9s`X$>MqmV{o9L`*rKAiK!yLe>QBI&seLsOi2aD&`m#O9Fb$x(#p`#+MAmjvFHykni~2yIa3;#0XAr$_rZca?U+sXW4UP+k{_|(CTJ|y9u;ULaklsl7QO*1=Z0B@K45eapz;w=kqrE6hzX=Ke zMfr?nB9W`aq8|dGW^_l-7Mq2vwueVE1L>3QAWkxKnUVDXNfRdVYEHi=?+#CCi}LhXaXTtN`^INnl{) zoHFQxK+buhwD2eRcH}q9^D`WpfjlWGJiCWMg$tln@p4Dl7*lgmcQ&pnAs5*hrm)La zM4%6@yNtvt-u8PTQa!uTU1T?CmM%o)N5^Ngm|yQ)AgjeW*b1P*x^=-C6kcUE4;?1Q z<7%ufYXv%Is$S=S#d49x^iLzqFKM#QIc+nm8FdFNNQym2G6S{vzlxSv)gIN;_&it$ z06z^Ix@Lct)=ri1Qz#1nTHmQFMX0O3Wp7$!Ncec!9`%yQH^U}@%J&YyX)nc43JVHq9vx>5?K3 zBc`{Ot4Ia~zgpTa<-9at^v}BA6qeB>RR5{}zV>N5xFHMfhX4?c&gDBxM2%tVslZs( zs*~6F^TX9iBtu1I1SZXQg?`;7t&|GIE2+$U)}KxTP84L|&^`m)D^k%w{rwvjDv!AH;8C6XzAcYo964aV#QJpj>O|*w_#Y*OGG67ActZ?T&Pqw1ii0Kt>t$YXv&GCsx z4hyQLUG#yt8Rcec9|QtcUVz=P9!I1sz$Yz?_{=>MdDxaX7Tf?$4UBs z_#jeGTDXH6b0jefF!*V>yr6O;yOmyR!yj0X)~4&aEWF?j!x!ad_~n`-xc#nhEYeSM zx?F)?x;1V$tu|T#7i3fCuX~5Eod zLCn`zrnVAb9LgbiGbN_3!ul;Tb)W=aPr4do)k?TgzM@K!Cse9yWm=7ITclxY2Id8K zZ>gVzXnJ-9O+d_bUhp585EM#J_7$m12%>>(l@`V-Clf+mveZ~#PO!>Y`VX8kU~zvA zD4+e%9nhFzf)RA7_}K5eD@y)&#eZZ6Q%K7^kf?^>(jej-;WpZzm!-94po#Rj77|`Ptfa5l7_9=H&x^I!pit4lIEd zWQEoPL*^DuXR{L|Oi}gZ1M8i37}6Cip6Z^R#N z>R$1H+!f8?vv%qq56Wr4)d_rgp|iFS&PU_>}@El=4B_O z*_C|Y(=+^%NB<)3|Hv%{8aUkpl#}xRA|nhW3T??G3$|py8Zza0ihH`x>q0H@vBFY% zvU$|>@@HXQmV2Tvf%Lz~;qP7O7ne7#B^EWlhsw2%YsK)9nLYOPClY@qw>39KSl+yi z8Vl+S+`ymJpC5>sYkRWR)q@g)cU*2)%{)cb{Of+ldEymQ)W3kXXqjI&E$J%6*JEcG#!s&ZnB z(k(7oS&c4Y+32E0+xGN?_L>Tvo;~y{T57(r%zs9x0@$UD^Hhc30;L!QN>G|V3Uc4f zg0@KR{I9D`a=LTWl6LCDmSnc)UCQN)P_@ z`rG88Lwh7?2yEFJjd82Dbgra>0tSyLl zamFN*70HJd&!&rT8I`NZmUP@TCyS3vzWEj)ZyHig9eVdlv__#7u7pgjE@U(q0Y=up zBMN+|s0?Lyq4Zm1I6MO)Z7C15sMd4XD<&~ubI$qvMRt{p#3IsAej27$9pHI5!ITK1 zXv8EHk82`9elSF%?b8f2^+B~DHqM3$vwc!^qtrlpy7>gePOo-j*1*@DQhef5$!y69 za3u}K4)3X_P5fX6T!w}i*s(bfuKvO6WfZ6_!t>L)>FkU34 z2=f%yQ~jhx0+7wl?oMc7Q9zKJCiNHI7`J8FjpAhSX5;u)+!Wu!p%`G@Nm@5o{2Rno z4-jozA2`}8o)W(7v9t+o&Olw#LR_qlTgQ7X^F|0Q4sd}QC+@$VJ(|luHl7i}eBQ41 z@YM*<<|I4^8uijlgLOH0;Bg}4V#>!R8Z}P5iFZXL=;;8 z#k#pNI(ucPqqaOXt?I#63V>9x5ihSfV5;P=pXe&nv$Rb8M1OSGYpJa}|E*55a~Goy z<>^Uv7K43xjDs8I@_?Am8+MvZ*U=7ABQ+i2gi6tG=Y{Mb74^lFemf$&QUP|R>OTdn zu)-S;r7l&+rFxs25P0SFPWAjo{m_CfA&9ZWOfASV;%R-o@ZNbMJ=O3|I?j+_tPtnP zZ?fc_kb+0n^2!xfd20 zOFQCs2U@OBfEG;%ku7so7H_weW7&vJ?Jyw&>n_SxBjH`hP0MK3VrISfB+05Ebg2;Y zs1D`kKu`^xBQGNsUe8MaXUcr&_J4!;FbEtBH!8oHW#6J0PrMTbI%9Drcye8SUM3O| zhx>dPA!r$sOz(S_oniZDWeVP60w^pFkIcMbfY}?RjGRp~l0y(MNGFnvJTNO;l&Rh!Z6qjWu`mGW)qAYkm*(dKR z6QaWIHYm|P_{x%<4Xt0bUA2g}sdoA)^$9FV(P;_^X*Ksj7xo!fmE;@qO07-U2$+Z! z`v2lHS^xqKnTTqLW^CkN?pOd4-T=4HUIb*J;+^Sa*Q?`k7@$D*z~h-sg(AQpU=Sr% zOUh=uwFmIO&@$#j?qa7R^mz%|Qrmp$3zojN4lueX!Bx9O3s#`%G`bsNSr$O|wGm>r zi8O?Kx!S=+&3m~-a}Y7fT`sPhg(JtPizzgfU6Pj%F*Dqok)EYwh#&ZhhDR)_`@nmO znvU*E7p(9_XY6(4Qa-;AZ^YlT`qgKIGyZ30?{|y;rqUdQH~9l5DWBpm``3my+Lk&A zasKq_c)h>&Oe$_xWc!v>dVk zPM2E|(;ZwwwOav;!cohi#nQb`$GzjlD=b9BJ*tHLMUu^aE*c$4l4LWezVi(}^q`kk zeTQt(oQvW=?is074W`+)AE$jSScto|Vf{@%BY@m{sHbBpdCh153g!x5IS8k>syPLJ zrPC}SY=wZLL4Di*^CbFM;j95qm}FH6jJG$q6C2m&Y9@>*Eh3UP9(f{^QO1! zyR|QfNKSutWVF)}#a1q`yJ2Dd)g5f=?9KhTZ`BS1gtVIg1@*VS6c&Q=6bPxbqt zQ5?%H@IGsYlEXFFD+cjGi1dJfB()gJRZW_zz}Z5?*!Ud;C{Zub9Da1ymZ~D z;ZF3m8s?Bp9UoOj>hq0BkpqV7QGcLoE z@|MNIc^C_9aTjZ`wRRt-27d_#E9re?0XIucO-od+dk}4!5_X_UnBOq`7bj4lFhEH` z)t7&{2R#T4*5Q8RI>~WfF=*Xi(v#=hS;}}iH)9rFsW(I(%sv+>J0U-(z5)U;-pgzf zSP?y_HBLYh@~Ig)?BSO|xsA+*8s$H=A+o#i0uc2=S3@8a!=UINH#+pN(P=*z7Ax|F z-*(Z(Z#kajTw!m`yKP>ethZMq638*+u1Icdoq^j7{^-S5v73v#rG1~DYzt$vUOe1< z3BAk9Y1@XZebYex4q8Mo?H&%){`Pl5ZZLpqiptN8mHt8Ei?Uuer3-##3QM}5oJ%}_ zC^<5n4o-DS{(%s74FTl4)DrlBnr@DBx4|dHP+M za0_WP+W;PCIqNi-9Wc50DWgL=UUr;iI1O-%a=0f7+H=8_qM&*>#UyWIE{>J@ z!ecB8nZgU$rOC89joS2N(|Oyimq_L;`|Ui#|K_4Nu;*BUX0W8*NYY_!r%E?e6dJCm zmIIH*!()f_RQ+*ZSsMy;_jHZ~8ZOQZIlVp`FqqC^LIaVZtE+J8GK1BQK@WCLHJ8zR1#1o!X=FR4FiL#t_voG~r9B=(BNJg6T1 zjPg|LZj8Hw^tQ3RmHH!L&WVeO^DOf|i}&wMq{1@5Ltc9N|R-_;~Yz6=L3l{yp-;ai9)9U{CdLa?e-hJMMbNa zW2Uj*nPv@Oro{-u!9483l&H(|cDxMi^#4#e3jF-6c#Hoy5Vs&y#e30!siZG8Zii96 z*4@%JdZYJjYEjm?M208``iKBn4si_J9!UNoYJH@xEvl6_LfC&y6r&EQ>3GfoQ>u(8!69!J*6AWdgw=bAtkm=jrcfwi3I#Zj`yL3=NQ6afD zeay;UOr4(8_{;rsR^I^2{(Z&KU&#^!eLaUB2#6Jg(;;$ktZQ(68hyPufPD%&NWFw5 zl%1i?6~O%bOo|t4tXUBa9~{8r%UyZa=bt?Q9ppl!d_NE0Gn|t5!e1v~duOk>kXJhG z1__Y;shbF2@7gM$@>C94??M}n5adh5F3_|{8T-@VV8G3+aX`LT_teay^}??ARveNm zLP}r50CltXU&}h-1Efp7~qS zf0lq|2*J7Lu)N>3?XUBTLJ97h;4JU0w9R_DW9d+78WT+Gfq&;ug9i8c zf;);vvjZ@X0}GJmLAu`h0IC4a!`sG97fLX634Hyy$y1yS5D7rN$4{wub|d9TUxM8l z<5mj5fO{gkANdUz;Goonx-{mmz@+EZYFi~x`O<2Pt`XKFWTkK#ENm&IG`uUqP6s4M z4-?Ik1X7U4qW>-gi05zsxPeFh zWF^jSvx=R=`oE0N|7_4q-I`BOGy$Os?jhu$E2d^d%JYZo#k(l~6uY{7!VUYw(=$5n zl>NFyF8=srPH?OWgf2Awv9lR1k9SUEyA>;khC`;Lg7c@3CriXH#_LHOohJiC4#cL%nz@=kOp?-s zEpVIqySn(?^+$rAW(2h%C`U-OXYGF-%Pzr2-JbP)XymkDd)a{hmIEWjl!S)5p?i+g z%UvnK2{-F`BKl$ zy4tKf^l(!gUph{RR4MCzHq??FH~_I*Xq972g`hUvg0d^eoF8oXQa5l4>&7y|Ltvby z*NP{%yGJbu^k4&H@ZCTd5aE1V`%&6b}n|X>Iz`WL zr8C>gmMRce$MqF>ftTnVq}zLx+6O6bF1^eV;ul(rw7>(qHU84I?d5|0dDj6>7=vv%N$heve+xsf0YUJ} zMlSRK8D|<(&pRf%7E857l9hxy>ty75Yj*DBXz}%VKY}w*(#DfV%yo1vK z;fM`=e|!Km8gKbZIznJj6B>d8%Nm?W06=!&lVJ>bYa7gx!w3Cgp1Zx|X?k-p%+uds znF#aO*8DH;|3}$dM^*K1ZNoI1Zs}5K=@6tr1OWj7K>=0wbp&#Gp~8gxm>O1ALgFeXeU-XgQ89J<*7xP8ua@F zA*S7HDp5Ph!T&ZM#HoP)>|-pxg!`jR1V6LLA|$4R#ngZ_>D$ARyhTo(Z*@XPu#erM z#_YG4qlhhd!Gd$=EH*(_n^QvapC9b-^%wSKTZ~##`dPsEFM`bNIc6SH-ueUjK}WTM9yi@p=p|H$FEaBKQ>~8!?L{$vnBPp0|dH5ml0j zsl$sBHLdI>78{H7nX6`HUI%SaHFqWq70) z(;-c81#v+S$Gnsx#K9^NUis)_`qn*!^|<-^|MIJ3yh!7lN!&y2tUS0ChPPP~7}qh; z_6=agPtrDnBb}^rIzpiVPB`D9^w(D%78~u>PQF%Lzme`-*!*N>vorj10q5DEC_dMF zg@%~oq-aIUxC;g% z53i{z+uo0CM&0}_ua7$l-d=2L`CU&fKaY#zK6F^xX0I#2vrSESMg{>gR^k8zXyMJI zVQvB6>r5?pWWdg!Xa6^qr6&0Ka(NBCgM=&MPoL@J^#&N{I^=@K8FE<~IS~5-l)nE} zxm{svwYI3}mqwYEamOR<1l%2nF{a_0`>vcBMbLJqv5lbKg5s34Hfpu2eo(x=i&H$5 zsPe*zMZ;G+0)X?3Dptf-<5Z;il?RNKL)X z%O`BUbbAOuVY*j7u*LLCz?kTY7k_%eH2~`eEBku6K0d&lAMSP*vSq>#PuF@T6e+~S zf=UqqV>vCsuuu3`EoeZt2>dqH^8=&D4NMIMhYKZ>*O54%pi?a52ff6&6cQsZ8;j8e zTHoNlzB6nw8o+INxIZ}9s%G1NRglTIblbvyqxn8a&4BegLP78IAi2wywP4CH)n(F{ z!Ot>p-vU#4L7UGi9rskVtG~S69Y|SEi2nA+A|BApIxV1!A8x@5C6T7?eMe-+UZ;p< zt!Q*v5BtKRdv~0@SCn0+>0)v?L)8{`pS<{}zqEvJxk*gDIOky>#sFL5Y#-$l!Mzd1 zzKI>_>FaquDc}E=#=~{x+|$#i@Kj`=bz^M1a2ijR57=TIR| zHJ;(djuQ_Z<;ji44qE8U#RV|W`4=VWlKFaXXuZiW#XAO3;gy1VS`73iW5Q;IZ@lU{hXDz+}eMhn{`aum7T)G|X-$ zT-<{3S7@gkhDv9g@=wRsJ;{3WKe0f>!Ayf_LGvE@qY}z~G9VIHI?!fk0BNZvJmu6i z9dkanLfO zN|l7hE@zN9te9O>rVgj%ThL+Bw1wW5S4y{+i`CE-^X|>TY`r^(c)w)Y0hP4~M4Sls z5nDx5f0cpGuXTSMRr;W}3iKSEPGp%kUDJ5oV=UwYLly?on*;3kP$4!CY`O` zkhe#7SDOiF`cdXuV<{o>@OD)_LW}t`#bIJ?)pufw_mt*c{;2#f&5S*Cmm-~;NrWR; zF%ciXk3{5+d2bvgui;8|Pkl|JvAR3le36}xc3<>4v0R3A%M)czx#{UbFb-v=D3gJz z*qiebWw<#pZ96E27ZWoXG4vx0(78`n>F$4*m$IK6HVo9~l_Kv`k%a_StYAx%931TdRUEG&2HF7Ceb1m z_BlQ$RvHYI2*s!r7Z4DDY!9a%!A^WS?rLg#=ULqd3NhiarVM}4H$WfiBqY=p2Gzo; zTpbX;1AS*ATO3J2e&lax`C5;VEu-cOo4WikGzHdIdq?97;_h-|m|&?n%Loreoa8&v@!uj6qO<(zZrk}bpGG<9ygwB& z+@mg7e%fCtqBj(kg8NWFy1rj*j+-7JZDb6+?&58D_YE6HnBu}&$}4Q?Ihe2i`{H}D z*#f>;U(frW^0J7ch3D@liQ%-zRop-&zdd?(C_uGX4^-fi5*Wn__RH33r3n$h^IEtn;< zSj=A7(T#|wixo!)lHC*dtrLO3IO1kuS!Y*LUwZ`(!QY@(H8o7hZI(jTQ{OO;y7(H0 z(dTs4B)_7p_z4nMKDd4u%$IU~g+rlG)4ySa_~zv>zCa(U;_oP=eEdZ8DiJqkCM0Qs zu^I>FSFbcH;PtZElvyWuy)4Z)0-Q*F_nzFovRhJKIRCxp?o@89=yD ztqIXqBwL;-*A$RK!+(I{{3Xn^t!hvSO;dwjFxM_9fkN`7#+1477ixuVawh5dyuK97 z!$i#&5HY4(6H2|#H?i}(ac0^#E(I|YZ|VIo8Lu*f_DlbQqJD;Oxte<&pZ*U-Ekm^0 z8H5Z{$`Hgs-tXhm@kFc@bk=W9#Zz=eY^OzA0}Z*_KUFD0nbQsEmzk6Fh~)ox?10b? zg19JmkDUQ?rNE{yjlrynm#s(;#i23ud;HNHE|IzmGNwypDrl2@n|FN4HK_8a3eleO zxMz-WfgV+w)S!96ywRtliS+0Rt4r#QEK&|WHz|7k-jRXXKDghpiJT~_DUiiU?M%{- zt?SGU-{p6>m+wQmUaNRtkA>b}NE9B-Txnf2Tf;pU(YLCj>Sy96!9ZsMDspISWv+Xr zBoU>G%2=ZlYp zj;s_Va)}sZv7K5>1xXS?5pM#%vC^nOpQ^k;a!YainO2s_MyBNNcPCIgOKkP^T?Sd* zyndXp=9~Hzn%WKiB^D2pjCp!ce0|sTgzyuSLmjiztL)*H%0hxs6s0!HwKm$b+W|4U ze=<+oKwu5BAI+5i0mDW>DqNdLxwjHQ&^9tb5&sVXjm-GLkzui+isU*n zZu+XeFA}47mN$)Fc}ER9ShK>$Jady|9aK<5#EzKfXTHnH?*^MFl#5$j>9QXR( zPmbmtg_)DLxSy?dy>`-xmuCSo@Lu#@@BW2{h+iKqsQV-JxI0$rr5%ir(WW=JPxBF2 zX`;I|aJy5_1m^vVWcc(;StOLy7UZ9;f@kXztIawt9oCp`=Dn5s)OTX@RiA#T$0_L> zFIN?YJPLv$rJ(&qcCKQFy-lezd0_L(hPXP8@;?|pm~c;YW+txf=h zip7Q1>gxZP)^ozup$Cx{(y*x5Q-1fv`EumbF1n{H%$dF}Zdj#@uQNd??paQ~UHs@H zyaqNV0%(K8O4$@4}F4IvG(o1BuwR7_?g+9bthH7!?a0c83PEHp7+dC|rV{z!nDww{SccJ-@84!f$6JV7q_)j2zmRANRR~-?)a( z)%|3`TRW`1`{Fo>rhikiv-i?9%KK0NP@qs0sf#|m1-6r;v-&|VOn*j6g}tjG-kAW? z?k#kJ7qQi(Ee>E>za%v9cPFFb#Q@7mXZ+A%zf5xql=8_+L!kEAOFfxSm+-JyaPdG! zz4y29$_g)h$G^v84f@BP1`(bnx=}#3)j_1hXEGTSl*$14%$m$bl<3;XtoN1<4TlQR zwH34N1&IPmuuP_kaQ-8<;?`QGD+WsGY_?75O1K~IJqmg^O|*7-u?(0|$;T)oYuu1# zAn08WYXnj#V82|2l}r>KPh${|Tty(4ugy5@`WiXNcJpTlGVqR>9U+k!{9{_~hSBrO zVskV-7NIA)nD4{_cWU~AWaj$h!(tG^U;$olAqq;W0O{XP9-tJdGE4^#KK%#ss6zQp zL2N+hhbWDQBAcO;RzGV!1hIT#0>;I5aFB7LFlXlj70rdKcfDQ}1l_U*8!!lhLX}b| zFhV>nC>zR7eTX6Qv|eK1lY_xID(uE4B#oV0GlthF5QiRy)o4JJpnat0(yOksY1J~Ip+A`V58E#l^1 z?4MGRhMDB^=U!q8r5jQFL;2(Y6gfV;_MG5v&96`h$#tcHx4HWIs@~fJpY4z5YEkXy zh4ebC9aAe-v>}6UDh`@uScHCGeeqI+zUE!OPO5$q&~w4}v+axg%mcNv5zR_W^$EB) z>|==9b&L?XM_=n99T*!o@N>?uNhAAozxM2Z1tB9^oIn248ufhGn< z;0!_$+1&ooVF&}h?!y@`j#Q2&=O83B4dyJYahCkGz)~==#SyOn(e9`o_49lTVp+{9 zLLxw<+^V5YA>pO}0u+lpQ_W=2c62CvdK{V;B+ab&q}2jS4Efih12!sE6VN9#P>R3# zVtFtN@+e+y29F}&>@e6pZUO9zu2QQpTSx>6QGP!7+0R-+#S8hiq<#f zM^W^-cMbUL*LC&_|J88UWje;#&!ph^)kT41HAAXb{fR_=7WDWKHgC*&Z9XdqzGWbn zlR@hI(@SJAg>~oeu8J*+TB*5GgJx(b4Bb#b$@aX^y7A^${-eS1BPW}rhqEbYD66lB9~8Ko-?-ci&UVbWh4(z zbUH=%B?HggPRDU;&^P~137=;2JJ5 zBzE%|AW>qh=l?D+5a2UkPQ2?`5T8$~7S>fg)3sNl?<4aR88ec-fyJ3hh_i&_|UkV-Hd3$%) znHcsDm+M@sR~ivH^+6RVJN+FcK>>p-K*aoWR+(%$=dW%gn-jJC)BGH6~@v#AQpY6SxEIB_a3MY7HR?- zK5aRC&Ud5C!WxQ=GZ$`yfhegbq$shJnAu*JfH*sia3%Zs7s!>RYZD(IuvP6$3O zd!Kp(IZ-xeyDkDPmxDwn=a7qJz@B64Sw+{-qf3Uu!on%Zr|#zkd0=+J)2`Fbsq{G+ z_YSjwwPVhVNgM6!0xRl6R@mfzEqlm{-jCp-9MDOFRxqB==}@Nlc*dSPO;xUJ?a*bR z(9hcN`0cNl*>X+_zDHin@$~gB5XEc_+JdN&^si$6a(_A{>Ei})j>raPZRF-DKo$iX zO%8+_i5?s45yKL#x9E7m#uUioRnniHT)=sHg|zT9RQ`M*51e6tl7#%TNbYjKs-g4` zqoilpy1S$esa_zoCUX^jvb_-!tPle&KWN!9*20q()fs<82{xs2U<$N&hVp`TR`OJ6 zMZfi`$6>j=P`Jb$hHdHK^rA@*{tY&EnC5RTkF7rsTr}GVi92@#d)BEp8x_LFSO%@B zY+d|M)0JZ><%bL#HT%q+(Z>pe7@}b@ch$5*p%M%Pwpn-uRae<<6Q~9%wUm5OT4OIc zGBWBkM`Y;!tc35`DzD%56xl83voIUdHe;nIv}7*zve?(qf3fJ2CA@xl%?^0EKN}#T zGerSN?hA`cYz zsCf(r6oQXnq;=5cnAV{cB#NEBg0RsW&V2=@ub)EM>`dP4O{3)e|1B(P!6a82kr;~l5S=_ji2C^j@=yjFO*oJ*Kjp$i zYLY!+R#o{YGKG`542VuEdT9JO=QmEzAD-s#>f9(oI0lA<(epVakj zSU0|GgoH`t5lY13d{3zCvp%2izE(8&{T4rkqno!Fc+Bi&zSYZo^Jp9YF^rwLXtE6d z)X!XBAB7d;4?06)gvKy8E$n`*4?o0=o_!KrwfC}Lbqy3&{GJj}as9KCVWt(8Ln`IzdRFY-_GBzImM>{Pz*pL+~0A{uWltZhzZ{t zliR%fn2>1jCU!vO?%)S#>J{L2E!u*eyx{o&Q1+Je4OrG_-R0<1xN|%tb#KZunVH9|v;%?Z`tRMMG>^qDK%%$#pIlLsFM?4Cb z@=D$VlG8c@eLX|*)tax9Z}z@JM5j2k1o{p)M-+FpJ#e!-B!&`Fk~RDdCw8xlPtQV0t?@n(-eC5M@*5r!^b7yvk1SDsbUBM zHif+Bv8q}83m>_U@I*)&VEvlQiM#?RfswA+^V$MFTIAV<`douU;((d*p8_&|tLIPrni=qE>F%exnG4C-ka+ul5Z|dkG`bHeK zzNL0XLaHm13Fo)6{Tw0vN3PeLDA!hVkN)_Bu(_MlkVjde{CBC!!s7)QA=j%f;sVyJ z2V|2L>XX|{O!{@jm@Lc4aG;JaO*Y-A<1z)h9Kho2=*8W-wU5MWyiSfchuX3l73iZ3k?t71reuAaM&#H0Tq5hJcTv9q;KQY1 zQ*u%LP;DGyr@kqwbKGc-OA9KpEZePck^JUJf%cR5aKf&K`<$xvb4R1Nv7Vpv1RK}q zV;#jJ%aD45tRnjeHYTJxIbSJSv7y4N4W#Fo0lR+|)fErC(IcFAv70|sk~X51uvd5F z3aZL@zANHS*0)~VL*dW0HkT86fNBlh$~f%&=|qCPy@EnN7W+d39dUei zZDnj9mL zWZwHDC_W=N;F_*r>v<0^OK`z~)DNdIo%=&I9B0)037xM+e6=vCL{44DHyuw^^ibwV z|B(D@$Wrd-I=wXp7!gli&6XHAu*ANd&-ZdwT2CfjujG81#Ta3&X&BUB;8I|v>M)bu ziJro6>M$(H`0LM{Y%0F#s}a%RX;Oj*L(un;q;w3l3l_ocTJ_*~ATSb4fdhfOG12g4 z#|27+5h4o_$l>dktnPCYab0bt)j9?4@h+UjJKBhA_;uG)?&LomsT*q!T4#-6u;)6?;n6F}doD-+28kzHRAn{&)ssX|MpDpj?e@;{2C zoUE@Gwj?!R9ky4L*^>C61hl1b`R!r|%tgx{S`r`fJ?nH;v{W!K@8$S?vRw?o{`557 zxb(jnMPxHVwkNDbWVtVdFZuhGU)^&byGDE!`tU~*6z7c>u$b7h`Y>cFEsR0yJg4lH zqQlc3C6k#B@8uhJbqT}g1+y{OwJ9&{$sp4mi8EpPu5cFp847mj#MO0vl+aHc#48|&<`O~LwLG-p z%oacH({~bqE^`^$i|dom7C@D@jnk4G~-D3q+?n-T5S9gAz!xtlvvdXD&tKM7S#e^V0A@*@6~oDI0aBrDB zEl$%45uv5cbx*r<-W74I*FkYzd9l?Ndt=hH@vPH3*)fi{s)Ks}-GY+Yf&FyjVh%UC z;}~~c>@K5WAa;$y^%eieE`rf{4$q{lgEv}l2VRAXYsc<5i3p&`FKG^J7qhZy0{L=@ zm^uYKlmR+9-o1O5q#8eh5qoQ&*0JmPOL*CVWRWVk_D{MEMT zRC^*jc|R;iJ?anR#kq(`U_tDV7&cc=nCix-gr6=L0>rFsLRgZ7C<@wm`mB`d$@SD$ zRXZ;H^O16;sQ0(uM1u&5@jSJ(v?6?P$Z%TpszuK1JwAOmzO25V>0#LDj~2DcDogBX zz$RT$?!RzYoZ#lX*|77>7&u;kIP(&xUFnBY5=JgA1%t|GH-O(j6T1C-LKJe+yK6VR z;;%;R#~6lAychd>P6dx$M=GXoL`8b;np}Sv9eH?iPRdQ_)99vu@!nhoi@A+NWA$yh z_1pNWyLc#ffCIe}%p+Gp^eT-*fUs+S2$QC`Q^q%9CToE!+UY%W`lwvcB(>bj4CyW-^gApSZ`FbS`iQrr`gjfhF+fbZ@)Y9f5Q{w%?| z-?PEW<~c9L%Vqb58?uhjfsl$g-m~bonq&uSG_@Ll1!DXG=`g=c`*B|oMg-tnAO$c?nzl*b&8 zS4e4vX~q?;7=poxg>dE7r`HEH7-}Z-T>%G8iaK)H1uizO<=$%-dZ2;(q8CV-x^8)& zJ&x+$L~?uoiLru18N+cn=?fI^utrT; zsO~vu)5H4W_&7ni)tY}$y*p0nXo_+o>jkQ&lXGju``w!PnU$A;2wpy(tf&#msIy@$ zhB`H0pXNTf>=t#_A5~GKFnIp%W)ifP1gl=o;%?N(ydSZ+Xy5cIN$N99;q=;5I2xCw zts5z#u6G``eqOP&cg7o)9{d<^@djp@Wvu3w7VsGh@1f`;bRV&-L3K;BWiR`B zB63FL=C{-1eox2wzPlS&biy%p{&NT`l<)% zGKN!P-06bkcTfKf*88`?YusrCU9c}nxq9svcim&rd)rvFHwwo);X4N3wS(Wi3Jz^q z1E6@1Pol?F>u!S9Z8~qoX*^!hFn(%xO>*@-W&*n6&bg%TJlfAH(>XT!0IJ;a`p){E zYm%pTkI;^R=fR$<_hqzRY>0!n_%&F>8~=G$g<{&cNlALI=CM?a$a!JId$bKE{)I3H zQb?RR(OFP>@dJQFosSPxa08815g|f^ypRjQ&839naJgD%ko? zER=@HE%G?SW{7WBWJG1)%t3mKTAVab>~?mPsevZ!!BIDVclT$-fbe>(4<`*ry2*ri zx^laNo%nX#iJ-2(tNU?A#KuE=WQOuFuVOo2tQ~oDl);Ai*l4tnAoW1kUcGh8-96L| z)4Fgf2S4Y2m|=8h-<EJ>!LePIIo$Cgs)|^o%Q=Y1ED4 z%+`B(l-t^KrH6)12Z$exb#5B;GptwxA(e&1H_Vr_~LjRR3Fe{51wiG>Z<^`|} zVS_+C=*{zu4VnMv%Pe0uhczO?_&MTkf@F=uL+?N?&8aK~Y)v;*% zfHTG#AiGN*&lR6&q^I${xiRiu`KjO|!kx?p7BO-kkRu*0LLHr~O4r$N}!%f;4UqH>iasfWJy1R#6lY;gRA zXt_xVJD&%rxcK+jP^FQVG`U}(zf(u2g6&{2ZDoX;o0`PR?uDk306B3bxgYi&nx0rd z8%+enOyRTxJzEQ-JEU)ixZ@Left-t^4siiHhy&wkj@2_ws^;4^`=Wwt76rV`~C!8;#e`J-jC??L6JZymS z*qeJoZkt4zw><-UU}N)c)2>~x=Zex?>scfz=dA4nnG#ukGIpX!)Q<3!w}>u4FBNZ>3~<)`!~O%VSIXe)Zq8Penq!@4Fx@WSD?}=^$=PUfyM zHBQ5o$ZS(egO;VrqEl7=MR4zVPjB=FRQj{2h)z4q)BC-KyafhFqnP6@fOqg< zD0z?FaFpDQWo z_|IN&@gaImlcz+Fgh?GFe8Pxp;fxpVsP0xbfv1N1vUv#XlBz6)tndCt8q##eb*D19 zPs-_)w|*+149aIN!U`Af;z{y(hyY-d*+q}l#oPFGQR(YUEBLaWD~3!D znKX@74s8_HbRdl;(UW1#gwu-f3vnWIwTf^)hkzm&5WT3W748SMQHn!+k4dK0Gy&@H z6e)li@0YYY)%{0;on$2f#+ys*Kih_a3OVCJrQhN8LLR_&fA|zs1Yi08a&c(@QcuBl zJ_wLFGLJ!1!I97BEel(MOR&ljk@g$-RYIEs!vLjICz#HZ`r2tnpwc1Aq0@u?LUMvj zk|hbg%@GN{R?j07GS>kfU_^v({zgPZs$rvju<_aMP(! zQoJ=nQ2GR@ZNzuq_Wmfs%8QdawEaS8)Dw2jCwG z7I+KBzqQ>W!52Gn=C6>*Nx%yKYLPlO;u2eNOq*QTPRbB#jQvmJb@j23LoDmM;HGW9Ha`Dm>GmITzq7p_;sh%7#yS1u>Mto8>5hx zBsPD75Gbeu5(Y1*mU_Z zMXMyQfkhI>)Blg!7JfpyFIKDhP=Zxr02dIQrsmpeLKQt$Hfv)>BpF}>w231^Uq6?V zM;On7uOu!^0;~w0)J#*Y!^_iFMj3>umUwF`mnqC@$^W&D?V54l(r5=4HiaLx#cW_lRM z|0dsbNLz4wDrC;~w}-6I9Z9vO;+}O1^Jx0uKKi{?#+KUr2R|7R9?b;Now&-5M0Rl5y=;54k%O}{vZ9z0gBxd zW*Dphk?=of{$Kx0VZc>9H`^&0_??k5U1}Mskx!j1j?u~!b$@rJe@yLuo3|6JP9byA zt7!3V+Io0z5a?yNf6ro}_dhZZ95gF~k&jy?U}fR??|-h$Ft}*T#OG!IN9d-I{Oqyf zhtl-er(((_ftIF!%YfJ{81#YGyinQNs*p#emJ|xawH=l>7gP)rN`Nr5Ww|WJUKYRlge}T&Re#z z0Qau)8Mn20B^=4p14FOe;*C1z=J+^39X!kqdU`%Z+#d|?a|(a5wrbgUoMn@?PzwlT z5A)};$Nmazrx-1nf)evI@V%7UO|4s&_R1LFY(5!q8JEP#-~Hy#ilbpb!Q zhTQ5Q*Tadkt7;yapW~e|QaR7IvNR;bb+Msmh7>pA*G@RN1c7omEDH@K1NC4CwXR6P zutmf66YM8$)!0#YrQYspt_DBq^o#2vY^wb#8V8ca3C^~X6@M0R#KZalVVv%O#(C@JVH=pgOJvXY(Dbc>vt zTex56SZJvk&|(sxgj!I*T*k~AUvmk%icC4oX_UE*Q*e)^wwXZ+%R~0u^tRd}kdNlr z%gr<;w?lBRA;BLOx(6@7c~mo#F73{~sRk8l^lO`)})z%yb_s;;JF zd!o#X3uC6q&P74O3onnVM1^m(6)aj zWS7rnQiUoe#U6$&%bcW$YN_9dpNeWo-l{4X%sExSX7Mi-8ocHh6)mckAH;M<&!!Q3 zE>Lfp1_S~VccS)Ut$zKgk%ch`xZ#vi;_gDTM6WI$8)v=m>spQiGFk^Yd=7+WqWyZ# z5`>ez!PK;R)KL$Rp)^|gi0e+VUdfH(0)hGRBj{o0gS0{C+^hEae8to+4s?#mTultM zeJ|n--l+UGI~5+GX*xiKF6u4mS9si@UPm2p^!Qed3nI|GP3hShZl&ZtT@LG73R$^D zJ=isC;9Ne-`tjr$I!BMop*Yp%@q$C=j9AOOd#A-iHTevG1JTWojguScEh=sW?U(2G zQ|Rr~#}1FTZ8up;+c_Llnjwao4_(Z{eP?xfSwlXTpX$+HZWS@pR5 z`i#oS`je*0RpoBf^gKcG&+L|u-A`lIl=W_!zV(Vf>_86#dAAd`n&iz#8~fit`)*De zXuZ!Gu3zdsNDJRgTxWI(PC!w_uMg*{Ne?LwH*226DYAu*jt-oB20#9Zp`Bw}aZG4? zw9yMe=YYI1Pwkg0Zj#!FSY1=i(o}uh_nofjyM?szKh#RH?+6{YY8R_f8KM@mKHG_I zJ?ZD)@9J-Jg{~o%9Gycp9{AZ*75L9un>SD+@5b4+xSzGEBtrAReG1$2L^q{aYR>1n zhuk7Uf?HTT{K>~HF!ENB74uoo+jszI@wDSC*O=(Eq~Q4>V(iI0?`jsZ`|gG;UOi!Q ziyB-xoX3Um`D!Zsx`bBD?B(Z2Xsf2%LrKEITT}Mhp%wcme(8;JpI*qzPvMXh8E`bJ zFQr+mn*(PQ6EtaoOZ#l1sYyh(n^LO65rRv-TX*8MHhVoMT5{y$bM#rjbd7JZC)-=+ z2jPyYBmv9w)wW0^hvkEASaxCZl%e6XqJ_b&&R08eMKBLMNLz>dptn10ss8@guq=sd zf2)A-RV%|a>*e&8>F)sFr0(Gyf1IHJ*j7X$XO--+E;$NN;83rXn5Szsv41Do3Q-%CpM0a$|1!AS`F9fW(xQCq@J~NxlO=fQb6l)L z3XBH;B3B?ZSRfnk!6GUsw$iCtdVtyZSVb?lK}K4vnm*f4C(kSkjWgEQNiCRkfafcR z9*#JDETUIxW}MgA);u2X@w$aFfZ>wzO^GX>C+-i1hbN{q`J`%H>zpC<)Y;6ZPmj(- z+9ZaF*uVLlD&@M6sVP6*iE#*-+Z^8bxmWq}8x^J$n6>%zoa)+MTrQ;ufVY-h@x@7R zHXc?h$v`0p<9wiFd&tE5k&B+t+YehU-uW4$E0fqe=o}MXIe{DI(B!Q0p3yu0yQ%^9 zV*$Oru+*N_sdGsRs_aHt7LW7x>1)kdPlo3n(>`8BWr8m6$E3154PWxPYKX(Ky{=BI zt5zP@lj(Lnhxs|l@qcouwpzDQf1{{)Zbg*131%;6Cpd1J&jRQ7T^O`G2K@Qh?OB3t;*sD1xuxpoN}yWm#3H(R2S zHv+Ge!yk~}ZgvMDRMC!#Z}TU8`h#-gutyw0ii%N{-mbt{#mG+L=Psyy#cWC9_5n8k74iHzQGt@`{>?+}SZj+y;b zIv(GVj-6usnv}uEF59PaUe%Xt<>Xe1bfU}Kb8P>8_C;lK=LKrx;XNI}VU9x&Ly>5h zo!D5OIFHe*BKi_h&=+jr?%SqLJDo2c>&zT-A;`zUIn$psio zq?k{Ef6^zulcPdhoC(?K5~PxonT_VdpP&4)be5v9(W;;K7PhOd;7lJ-{ghK_bbsFE zr}g8R^x9(TvQJjqRWv7t76M1@$FE!kSvDgn;?rVh4>t3&4{J}fy@9U=+#RAi<0C6V z%*^#uzqE|hk=y+I9dOzD4wqG8oel?ww*ExQEAVRM-Xuk=5&J00?wiJL$=oP^O<~Lg zErFRrVP*IT_vd;}9)m15(O(ZP>J(o$k3^FL8Z31^n1v^3Y(c+IX=Y*Q@qX!FyUhca z@!Z($28j2ZL|{LmDq#r+V8A|QKj^hEU`wV_yX+;JB$lP>Q20m z1zNUR@aCdB?uDV9EA2E|Ay$fJ3Z4nwRn~5LBP)8@9*&@&86sqDN*Bu>F(1roeuu!A zXRW0dq=VOVySRexU#I^;8~nat@V)g3VZp_Yykp$sEc7A8I$vc12393i8 zhP|G!Jsjp|h<8Z0ZLUv<>$(8L)2!jyzYDDB5(teyyhiAWVPyqxk;HTI{COqsa@@z% z{q^F@oa`%nUC-Ubt(|v`3ux*bLgc!l808w$|1x zGlSEG1Ikua z7aT$aQk5K~V{Z)P8{_=NJ>A-Fq6)yU3+({AwF?f^=wz^vHlFNL+IfZNLFe}P10?x0 zfwtDv6GCUDZb{9RKWW-8+&u2r>YOuozKtggpYv`n>~U%vvgkfLXGp{+?QW8#{YWHe zz0}C&*(G+drC`wMC{NakH^{v?ka&rh@@{&}vWsUXqjE#u2bwRu{gh-lfR? zP@#I=l1kgd*S{p06G3%Hs4&2zQWAD(#_P}aF70tJ)@s{-MCDEOLbY{)=-q0HKC{>C zjF;a{cC5+#U1Hi7_O6i+QyONP2ki?P^-RZ~0|XF{1juyTHVUExYgg`eDsX4jt)P4X zjd4er`U=eU7=owDA(G5TCu3>ei1)-v7jx)8eiZj14mFuw_`v!s{eub7OVIUeQ{HT8 zidBst-~P&RhM!^I=Ita}zbSw;XswdDS=)g_#c1tHtftrm$(_4?Ao zdRd1t+^DHoov2&YZD#o!)o4u$9i}1}j{#1&DfRHai#wWMroP{8+AV4AUxV0OATAzL zFI{(5WXPoc9{}J$AHUvX7rpLO+{Y%{{l9+3Rzb6ij`xtWFJ5koPo5P`TZJFvk}Ko# zT3>{bVQQDmTQbAWx^P(}jLP+^kO-OyX>vfy78CDB)bN}DqsU}`4)WntMD|5q-*0~M zFzjC)wgt<(z|Wk0deL87Fm-l;o%)hR zp)cfK5soebe7vtb`{?@6S16b{?Se&U@90ml4;*AuV{W&c^%3`FIy-ML&ug)aUby@fd#d`W@DU)gbvnjPEsG9|PI3v%;~DA3Si_ zo_%VFb^8~_GkAtJi940oH3^(+z+SW{Uc~(qWmoL3r}veU;p@# zFoluYsCVD`IR2ir*T4IvsFV5Og8}=sTy+zWAgQ|RPo)lO#!DC5!!Qy|_wCQ#ZlAyPI-@|# zzuJcru^+zda^<*te(_{5lFL({{qdjV6(Yr=72GAabt|{vOY^UTVeFrM>u&q%r*47q z(>bgYYH{=(F#V?=z8}VgJ3{&tUVZGn-wXo5 z`AcWmDd#T=FSiZ&g3f`@Z9jU@ZvNJN_O6dy9&BMTFA54CyXS?V)H06zqm52dc&}6Q_nuOE_`8Mcv4poAl>xMdqdc_VQ{J!U8gwQE!qYuoYOt# zE|~_KE6;=h#i^(}3U=5J*nS{u3IjLV={oD;6WBaLJTAx0I-$^)S`QQ3S|H@y42`8* zA!MClYo6UQP>}2X?kd~^(7zCw{UYvo%s~!UUHtJ^FkNT-I0z9>4qY^4hQRF0dmv!> z=4XBp40JQ0(7(}tzwzl??G;y@Zav)x?MolK(IzyHw*@PvK{y$;+vgwOV1M-2uMPK~ zc)q?L^2c?sShxJgeRlo-`K7)5$`y7A?iUnBCBNQ#ykl+exba~KJ=fZj6|-PR>2?U) z9=8?eEeL{8#{Kp`-xlr%3nA=b9%RtH?|}W_i@&j-eIv3{Ma{39u8-RI|NE({AUvIT zBwLi1JSof_x*wf|e)O6k(4{>z4irE1`p;SW^oh1``3Eq#oD%NC9GG%JgwOu>9|VEZ zUw`Qun+%~H+sOXChj0&h1blA_`A=?}V3Rsp!-|hT`qFRhk3aT080tS440GCHDBG7l z@iWWxW^KWVUG}-ZxFLK5U}Oq7po)S$1d=;00&Jr+d{1}l_a3k}{MVPG?@qUa5bCn8 zk|^(kG@8$FSNxZAL)b`TEF%8zfAiDeHxnAdpZPOBSNm--+UN^UL_*G!&zW!6{oU2! z-p>36IUe%{fbCs3KVgskeiZ~Sr-#1i;lgR$JAQ-q@+8{-*$^5r4*e-erQvLTEc)?R ze~Uixn4N)V$8!&CwEYJoVfNpC^__UuF2zR&pL*&kM_URjDTrMSn{HfOgYGZ??Hxh8 znb#Q?K1VTz`lT>E1p#zVu;ciq_g!ee#|Nu_yzaYU1=IFv6YxxnxV#0n$=>|Fi-Ulj z_Y4YaC@}x%HD4Xb;A9BFzyF0hAgnn#2yl5KiI5*$e)6^7*^S?f`uHL|%T_%V*}38~ z`IFy%PY_1&-Q>hG7laR8OtTGwK-#Cn#QpFN#rreuR(<&sH`xWqkNuC=!sq=9&lG-k z{{XfZKmGmpg?Apd8{T(#5C6&6?h1KqUcb}+{cnC2uIXjC5AuAtIffb>xK!;_Apr@J zs<6^jWDyX7>LfrRhup{rgqJJ`5SGG7G~Io_ecEn>QP5Yt`JC`_8-zt10ny=w%wKW` z2?BEG*JHWsJAU?9(1e%|4IoZ^;n%ld6D?a+m0`+6t>)a{eAYfKe-62#hhf#_;Sb9nf~+NZpYX4N1-uwpS||FoRefEN>C9+MKNH`;f!ZKcQ(xI%FwK3-3QaL8|H1@Mm1n zOBc?%(bxadig*Uq$G$&JikB{G8}Y-358DPiryG7NK&F4EepJVdQA3OF z>AOdmmJ_t^`km21hnw{Jpbq$nC&rbpRdW$Sq`rfXk<0&bit!bMG*;J;vSjuX{S;*d zu5FI3ZvyeA$JCPlesznEDaCD*|CNp%BVW>JIisWwKw6h9bfddLuOd! zJ}kYxb5AQ83bD%%{Sf0e=D}KxD$ANBn@t#V`lUUMx7_&WN`SZr1GknMs|JeSuys`x z3?5V=(g%8**lE(ScQey|*|>I_3UVi^Cdz#6o8QS*_noF=K$<5*a8>uZsr`cB*qooZ zFJ4*g|8R~+_095u-?Rw}wGWk3`%O1X8P%LacNni@J_IRmtFRbH-l0Ji+D$MXmC$*0 z?Xu1C(4XE0DY^H*7n=5}T}WX*+5Dq*Dpt%JQ!pn&hy)>OgBCSaScFRm*2>Edeh_74^YKE?P391#BD3lmH$?9@xT znK5(-)!`l4v!q?>KPj57hL8KjYQFqfUdj7sq(zH!&f#4bRmM&N;&+52Z zyJ2Oy;_g#S2!!~%)DU}AbGHf$q1}lxxi*4!=?`P($vhyW3Y0|MBX)8z~SEO@b~g%IHShfbG+yN<}PC&tM$_l=PMJ@J(tSzD%ypxt^j z0#^$|s{vXO{!O0CdC9M9<&GzZ+6D#mpr+qlRprmRy01l<`1voYIkd}!A4S;EKK+^#WTYo;F0Y3f&$j-u-r@25IimO?Kx#&83olsm9Sd++1_+_5E~_s;cwq0H15SAIJV`e&^oM zS57>qv(+E@;ATCj{$KFt{<;}hB)|Q-$~Nr>^k@Q(>D>ABP?`Dt@AA#ZGpt>4wCB0I zM;WctF6n8*#zIR8?zYFzvEvU=w?`fjbe(ZUZ`BBCFTx$7;fXK;jZ<<(MI~P z;Q^kX^3^=K==S5~SQYqItySK5wV4XCPrbMslA0D{Xuc4lp(r@Q_sz%|^1N#7b?M(+ zF1=%*3A~{Z5Sqq_W%@@6YC(|>$H}0PRJ~pWIbVe@5TsSqjal7B)pP^tX^N~~y1|a( z;Hy851ARH%(^5bgnyS#PqG}C6Xw&()7Bb|TUb1iov?DwL7;L9t~0`T>B~xJGShRcKsU2kgNMh-R`kC(h6 z#x_6jMhTr;uG8b-a9^nnq<`P~j=cV_&*hUhC(EyTe0ir{WC4D~oQ8SKHHTL|2y6?> zhLzjoyc_!&f8v-iK1Q_Z+EC8Armtz?ef9oy)h=9b{2qxPGYFX-are}=4;StP7HQgd zkyk?%)|6MCsH*cykCR$UwYp{X1H)Pqwz{~EB__Pn2FmYv@?7H&9Ph*BAYJ-3mlK9`HagIH1fCG?F3@9n8?_8WZ|rMp z0?es6o>pH!Zk?`t_uHJcmIi;255^f>YJj7KU5;;Vf?XUv1s`EugX4bp{`Ue)gJZBL z8II}USnieg4l@6DRcMPF``|zN?J4GWt@efLwJVyC7VDfJzn*LU;pT39bi;=so4fUh zsvTeU0k?eK2D$IW3$!fF)y`HO`yh~$qk>id{z*6l@QH?w2oM1xKm_7|0KWJpzjMo^ z_}2uBNE~bGdwK^`5uY?>u6+B^OqurW;tYj>AmFr1yX%+xMs^iAzM}eF-R4#7>^}rk z*zm#~O*^W74W&-gN+z^`8b3BCdD&v7&aHWMRJHpu6-t^xVk~S66*_Fk*-(x`g*8Xt zzQMiXi|L|YR>?i*zk+D;ulKK2jgPu^^G)dD*dhe}WYt<&z!rt!O?ABnwKc&FY$KuK zzztS?AfzV?tkfG z6-HIEBa5(^1R>&=?@W~@?P>_LUqBlh+#+VM`)EKb<{0^Q?Dq6J zwUzZN9Gi1>w*sZaAM}LyIP?Sb34ED8_qu+1%(S*lP~p+HAI%CWK$>p!n#&*+%rsPi zK&djt)wYgz^u!4UI`wU4!V+i)f&a0&gXS4*0YSUW1h3e%fKl?Wis-i>iz9g`3pD;f zzLaYJ)K&XJaN+n4f*6cZuo3gj-6QRY=$~{`Rz)OAS{GvB!0)GhiAQ%9@o_0wO)qt8QAHVjURMCy>$X6#C z`LnJ*&a@GLW2v&mWxd)|Tee_>TySfDJF*I`G~DLrnh;~iC3l>l+9YGm4qWpNs)?$7 z12%6K&R8YqT&Kbb9W$WKiKY+N7J-Vz;NeOc1Je0K61)YW&wo_&?}xAEnr7Sb1sgMz z2Dh{gIJc92bZM=9ubjtoffh?E>h((q3(ya7BO4sXQ3yLv9NJMneSJ#0O~X8c(9^0# zUhR4`vCB8mC%`KQv<%?8I*n?mkZY%ZT19kon0H|N>xnx)RD;fL(mBMMoOe+thSF7!{1Kpe0_yEmlILuAx({@ZupL=yY zg<$C93%V+A{%rFq=s-(xv1;MM!9EqR#+ZOMK%2sldIPn21&1SZ7&jmk2Or{N$(>K1 zE06v81DSKi5-ZoZ5i{iC+fP*ca}7+0gfd_boveKVE_Cij8KCXizE@KVpEqr}&Ex*# zvh`Y4H9J$t6YB)DjT_%BQQZEZ)8(Q;<5te(%7}ubA{NaSuWhR=)pouDtS((X#lL)pGR%dNfYk*UE~BaDhjO5+%%rl;@fL7dYeS8=M(! z57f&E_?ot>W1C%Uf}CG^>STWlfD@-`0BaK_Ra8T>Y8MFhtsv;zugAKUs2!3ysWb=y8U}%Jl%;LAhH}fl&bCb-Z7oo#{^j9VayI^@WKwDxnS z>5C5}_z+}#g8q+TL*uwI;I=m;fshGWwQyLYfInSb;D<8RZde7c=1@QI+}_=u9jM>b z9u+>$xQ}3ng!H?%?^By%)zsMkZtqB$rbF8O`mqdJi6@@hQC|A{XKK@Er}P=z){crp zYY;qGIMA>-jtUoP?uLPGIA}JZ4ZJ?!0ob5Lb<*W0xzO|c| zCXbmTgVi1m7G=)iMiB@o(sU!@+63YbESy2#TzYhuEb1o~QE;Io9BC({2)nEa@x(&0 zM%{|?f*z6Cx_PJ3g%AXbGRq(&zD0=kj}{OcWVg73W{%b0M-#7s>X;@0>aA4&x%Gq0vak(=*Vf*m8j(?MY)*3z zY^GV~Q($Osj88GpPtkvHL<0tx(MFB*=*e+|+Nmv-!DjSz_;X*Iq4ie!6}+8(nGf=y z77;hVnNY;nCsA@Igv8BExpA)VWS|kq3pW;qhKCd*Lo)o>vT=vmFT?u|Jr0DUd)Oe_ zAO+8yIL#E}6#Ay)Rg5vfGF*8|>&6`hz2Tf73HY1Fk1+{SDMfvUMh4mif+VyP%8Jc3 z+y>>@X!*#-JSA{Q$50%NJ@2M|YR753YMULa#}XUbrqqby5Aq2J;c#idn0KcJgTlSw z#yKloU@So#6DWnNd^iGm?w3Ejl;_p(5ky}=*TB4rBjGqog}#p)+}!ar7*GCGk0avf z+k4M{BX>Q0eo$EAgd(n89ceTX!i)#>-J6GV)^MJ1!cqR?6M`G`VZXyq|9IlUTzPPm z3&Kt~-0q6`))U^im^ptsUWLXEur-;C>pEI6S5^qXFqa)t-m|{0S;7_?()b<96%@#6 z80bUrw0emOfz=JyBimWIJ-cy?&I1W;QBuc>(=X{MV?UT-Nl!kno7o}68pD+z0XTkF zs$8)s=kAQR&Z2H;8`w(=J78s1Xoe>=0u&@Abn~!qM1TmS5&{rbB)`MzCjaUIZ5}Ly zu;7D$!3_1HM7qd={Sd6a+UxBs&{UZ6D*8js{%(1U@rnj zbkTmUFM+PN898cSO+A}A8m!52RA_@fTeWUfw3cg(x}Qz~U=9>TLB7loAhHxZ9uf_`cvIe~o{gAg~4g=nwV}8wqvb)skv- z9#HqwTMajF*sfX*W9)i(80g0BN!IX)j7TUt8p~G&Y^vaj1PrCyk8J-z*)nPX`bmUt ziv3}c-sk?bOpZURgVa`=TsVq3?8&e7HpC%zQyIprP{C9rI^q1mXYLrL_tpOouvju2 z^Ta=3@8Uyq2$~N*2#r@EXxhAPyO$lHR$R-eRuLTRx%}yGgR|tLVB2VZX=!O@QwKsM z+~9`W;UM&dfbakWYH-LWFgW%ebc}_2n@q2C2twJ>^ca({c|MA=tAC)`EzBd9AAkKQ z=12Z{pC`s!9L0hLEQBlv_CpiZYbWqAI!*&M$c>|_5F{;}qqclh3k5ffT6<sz3TXK4O>)M*;qhBsglq54m zLp9t7BOI}VgI|Uc26zA$a1>DuL4@OYD4b~D%&>v#0fi7y10j6m903ZFa*iES5& z(F93t)piwZK)8*yVW@HJsEY0sfg{xO?bsTQ;HU={xJ&1+H@ir4e_A3hJvdrw)~#%| zCqT#V@a4DDam_qT0%iB|z~bK9)PN?mnb39_unWZZ(~Hf!hizkMOodFY><2>u(lsi{WePf!EcWo46Yw7(esvubrrmb0(z zYgz}Wx8o<5PgGAWEBdY*4}d`=hp`X#gAfHrPvMp=SZ6}BLWLltOBWKr9@^6R8!Qgu z18a8`Jn{?WBQIiLY*Qdn9~|35c`!CXL*k8peW60*@^a(<4Uu6_ePvgf<94}PdMpP= zZ_oga=c?DOpoWKAm|Yh)URurckNrj-CfM+7ut6g-|DBaEj>U*!eo7kc3}NDm#T!fz zQC98uVeECnTC^=Rcn|7@3+R8&{vD3G)lnnw2zTw`@oG9WD0zktKH)mQuX@Itn#Mgr z3H=gt12p_*eD@o?!aIK=i{T?2lEMjjaFgJ`^SYW1pTC^3hUoT|3YtSxnZgu^Y1a5$n2 zVH@bA_Ybs>j+Ox_FXmMfbO(N0LjFlv1QKCHPFZkSF(N<&h=3n~oNP?|=@aAKt!m;| z8Z1#|u5WSWMIuClPvz=j4-d{u=i_0H{{t$`-(YNZ?84ix>@ zpI4aSYTSZ`1rPo~oqvs9|GRkBTB{fqu5jUM>(;{9EZag&V}S}CMv<>t#x{Rq! zOGt5sv0P|ezyW7$M4;&dK^`#Jshi0KYSRhMQN*IOYK;o!H+SkXTZrQ83Bb7rVG_{PfGZO9wUTdFsX8jn1?8e`E`5vpHpX>sNIttVV#B zsW#egwz%D^wD;*(SA2QJ;um?~h{jgcnDW{V3+;^cG~zM;6Yo6ZnO`Bp|86x5k6YRx z6ohaC{R5jH$E)BuI2=WUtKYo3-AssZ=U|fqN3Fo?rok5IvrFcCe2N>8B8{t{;x;$I zzO9XJ1w-^twam2V;zEWw`;wxbW>`lu-dDUS7Y&Hcprn(i>;&^3qo6b2?mZ>rA z)wU6Zz!-dlf8e8KdVCmsv@0;qf`_p29`oK$vS`+7Iq!z!1%}db)EMrww|}r>b{HR! zzZ3M2|9GZdg^oONoCf(og9Fc1OE=oBa}Z9UtSFt^yc*Gb`x8%ILM3C9ANogOZI5kg zJ7@S)W99Exy=6A!&^8#;{qri?7lH?jqqsx?uBsZcHX)K0&uR9}{^9pv8$lQa9>)!+ zzXgm)gD?KTYp#0wL>_QXfQ&Mrns z4}GS$N^aG)gqGDe7Fl36{y4#?6Wl~f>f&J@tEPfgxJ>~qLDbW&E%xm_AiwQPvX37LJ^G9vl* zCvtztw<4uL#uOx_KqImWM1TkofmB8S3mGgZ>ol&aS~-oas<6=jqrF(jmM&M)j9Hda zTLb&|9#Vsli{;J7##p?zT^rdE4G4We2d=u_DE9pqv(3&AHmJCXX{Q=^o;}4|q(Ma- zMt<#xS|E*WV31t%!y>G;-X6AO&U(A%8k-}08N{M<`gaRuiW(0tQe4Z7MW|c5=rgzp za(-5tjDL!Rd~tUIEiBG}0XAF%&e1QZt!wD@*;C}Far0CYAUfsZKvisE?sA2nTgZaG zx!@|@dkL0X1Az(bt-vM~+_;aX+eRNZLP7gss~YV5$Zl%#Dv3=#aDlc0zWiDm)h=53 z+Xh>xmnvJ*j=kXs%cwWLm&spq4`ge=uv;X~I8x8bR@CmeKaC8C!g75S;x3?c3XK`D1ZeZcT zeyG0lCa;m{6BpWs1!=L-gvKBI;Q9`3Z$cZ}@MY-WXj>fp@HBF!O;~7~*^){Fez=)z z!lyG;km3okTv8(%=m^+MXXe~^;*W#PGyZ{J%c;TKi*7y1f}gwhW80)-yzvXl{AvB~ zj_1-#;2GY9Fc;41>rdc&H|-Ej=*G+j&Aql5KWdij+jT(4OT|Ei=u36{{GVc9u8OCn zg!-V|;G-MoE*)hBuR@40?1^zQ`0^go z^Q1N=aDwq>TnYchu%G3}u{thl`5}lx|2Xrio;rrFmsvk7mfdO)7{_kVJ{ZSwP5d?e zAD0WeJgj!7c6wu{@~RW0`Krs;93p`BhHw@)ur<|d+2P)N>`QHr-}D&NA!`R1iN^ej zffDmA=3Tg6r?gh1+|{g)VM2jc8Vs$EdGBXg@!NWvBVqdo{b{~lY5()Mh0^2XR%UYv z?T;}xoxcL(u+o9nD%{j>7nsH<@`msUw*!vVEAGoz3-ncs75Jm+Jm;P+@Q?GC3vt3{ zJIbeZ!?WXY%~cbpn+if#$rtbZXmcIrc8nvLxd}vI<0i z2oM1xkh}=s%NVqc&b#q={erqv7c8^w-+4Fnwd>}w*2BVV-t^`2r5-1NYpk~}!Kg1b zZny&8x!MgY*~Vthk4xl?D{)g)nhBr29XVSCB-PAjM^V^!fgmWbh}^Y(uPuxqNP)ej zlP~Nlzv|JQ7akm?Uub(vMb(U0x^S(G`0w|6Q`}&A3S9a-#zpa8AI4<*6%` zTdQtZ>m7@;i27%v?>83T2lvD9bVa#N4He&c&P(#-og?%*-wI|B)fVXf)v2aW&jYrH zJQaH^?hy@P*aW&wE50%Y3uFcGN{5?R%xNKQv#E<(T#-Cs)J*w)^c+pEN6B# zKb$TNTGf#2{_j-z?_WO)F2b>?ZJ}R%alP_WcYP!`ocy$0_Ll*=aj0Mm?zvN!SeqO> zprxwl*RjPb1V8UQ<853n)(v?LJ<7IEkK$l6itFFcxUz?Q{OV-A^0|uL3NZmIdPghNu-{qX^`$!uV1fu?M zrs<+jPk@0sr=x~&y66#bn^WAX_Rw2b$OD(YZo&l!7_NTcl%V|`@X>e5!?RTQ05{~C zUS^~j0>v~Hwm8?Je*^7DpDJH3(_>c6O}ptE6<*GtzS0aiLzBQcY@p!0jjH#o*R-0P zd37)O_?1cW#$#Vd9~}?Sf2K{CuYGr+3QPvc^J>UGs5Jn-0N<ko*d(96 z@ne9Lcf_=};3qFu4`UII#;#Cp(TA>m+h`0J z+SNA2IN}0B!zbzQNqXtQ6N*7)wYvm?VG$Jw4!Wqj%u^x5i+}q}W=>ixJ=B&G#$sq* zJahNQM(egG&Xu})?fenlj00C_K$vrt^?vbh4iT{NT>ELyfo)~|%B?c$^~rM21+U79 z=X8`ddW;DI7YKZy4K(~oZ!AVuXI||(73QCmLV$v#lxj{^h6oS= zB9Nj8=sEFFrGjo~u}H$A z%DFOn+uO_E+^(7uljYfaMwxe!Vyfvgw37^0trrMp4&peDevQS(rgQ(Mwwb}A2{Hz3 zGrRO{E?3=mihMh2y1e?(7ml<%`rg$RckZ;`^-E$Y6_VhKCKi>2?W->gYZg2FRVwTX1z*s z&+`}Bk%$GeSIBpt&M_LD`Zblauj(V4RK*<*nm}-tpOWjVNAvKtbkdizb%Fb}h2c*v z74AU**HZ;lSkOZSADhcf8@9?tx1FGynuaDs0FGFA<5=R!7j&0xTXxCMDir9@yP0V! zLE{5Qit0D5E>qS2h5J7Z=FzEdQ+eQ}ixuZ4wmGmPK6;V@N0H#5sp4%=f&c{5@+G?n z6cX6NdhUyxRcNzNmM>l>ulV=`)T-4lryHd%D%5MFg2CpdSqDK9I=&OKbm-kgF44`- zbN7vuCvN}H3Q@Ot6%}IilatTaO_mBIu$cw_;0t`Sj%eqjba>fEoH@lm^;O)O6c$ba~1u3+LytB4S`fN9 zVRv)2U9)G;9>Y5rnJ>9Q0R6DMejFL9?cGX+d~<$YqQ}VB%GldyWT4x9U`uJxtfmV5 z+DN@-)r{|4{{>I{rpFz@@AFmY@%;VXyb1zcj&CM|FYPHUI@CAKB?yclWNF{Ku{3O5 z&3F|39)kP^dV$2f|GiK?QSH?CpPhi@=5G4unaW4)WVC9awmG)GrqO|0JH0orm9xGF z{&&3Mr23^X?*S1G}Y0}EmCbAICr&x(JY1Fp59@(vt9vN@S^WfL=IuFCyyrWNySJ1k=;HDGo zL(2Ra%gi1k;#90zR_=M~d@Wx^snxiG+9~pmnjsA90kqo_Bd<4Gf>XbnFQfDWi*x7e z4T{GP>10A&2_jkx#odEwt<7DL8Jv&2&o+XME*FEgdG_2fd&AMy4Y7o^)9PIBG^6f1UQ~SUt|P< z(7Kgd1ji-1o!HW@F2;gxt=dJxmAkm1sG4q?u-0)J2S|rJ?C6tb?EF0pfP>nX(6pZI zhC))aK_wGP0E5D?_^iY{Ef)~d_(}`q#$xUdQ!l~;$J&BvG#NHyaM+LrRcOp7J;D{IvoogLAHqq5dx1rSq2oaZRwKWN>@W+7+8kkOLbrs3tbisE?l}a6=f{ z2H`j&1N@=UfHs4G3kz1HF^9OIp+Ee2BMfnX4KTHE-Gl`FH4Vy)4HC37@KqLS`1SNC zhS|kZtb%!HBD60s2-_}3HShl*KWx|^z40BHrpLcJcj+wm-*>-a0~;cN`sYEmpjEth zaTzvjnEh+lt*PAh#94L|7O+M+V(DD}MK0UaRtoHOz_td29@xy`>Uq=_zBG;>fQz3O@f$7}?n`6*4gU4}XK9Znxu3 z;rPhv2pS>vN8a#5{+5R?Jm|0ZKybWT+jocF1c|n-qc+$O-_tSy70Jg=W9 zBLpAlyHDKqk<9*av0QY~MfPw1{{2?Qyvoz7?_v4J!~c+JQ>W>XrDk&Xa~Ie+i*m%$ zfxh)o8w*u9q3y9=k1g)pw%ghO0s@TD_z;4kIKDucG2h*L$xE_$=304u;$1e6Vouzs zeWrBz5}K~6&c8*h|M~0S+A_2+V_w<4bFZvhzC{g3?^hvj1*xtA6z~q5^&=l&1nFqF ze_nHWxp04kDXKS$I53^(prxZ_7Hmm815rSq4;wFCGLyZ`}wX`Q?9 z0SyMPF=vF1SD*=KFs5RR*{MS7)k`)i-yZR>(=it9sVdriohIRrrD4aiUfEIMF!sh(=DV4(#+i|VT$CUM*N`O+gR z#KXo6#%!@6hC{yi8i%qR!C5>%RQm2Mg#TC;ON?;MKh%Zub8(P=pxRM2iNnpMcTcP1 zAuWKf-YyK!aOtd$nm^KDpe#k7x(Kb-G5N5GDK1aO7c zLq)Z}cH3K7x70H#dg%)l7LpOCK&goF6Lc`lL5`Th+7t6K>qG zMBqn1--l4LbRoR#+5vorqk`?aHwlbaz|cG18IC6S#QZf6XlAwQ)WC8>d$@7VpS>SX zzrXRDmOFIbb$saZ_OE-w&fQ8h>^SMqEbi~<+aaAW?qx{53@J!Ty*6cyhyW2F0x?7& zaVBCcZm?LvLMgZpQa>!l+`=au5cUPp0c!!Nk&*%~G;p*|qA9*z_F_#Wc{g;8ywGAURV^~@N&(MAvu`gss#D%%?x!+km zvl~A%dO4uw@G{#l2b8$dh^GE7T~vIOgL0voE|1_i9w?jh&kPEN-{k2J*{)ht32eOd2F~CJi+Tl9HyWSWqHB1d<(r+%BvVqyEV| z5yLJ3jD_O36CDvC0*QzK?Cgjcx<~0?&&YjQPsGx)OhlkyBcR6*6@a##no6nSYdzsn z{>Z%wb~CW{Q6P}KYu6|$mv2!hNXj?pnK2O{0z`la!~+2c@SvuTTT&i*_exvr!X`&b zD2T-aK;{tx1meA@jdy-IgA7J+absfBHg)8kX)r!s*skhM4IzBaFkz}hLm=L~g!~dy zI)gbBbLk~_oMhUAxJ401NXf5>)@NBBA`lw{C`gJ8uB1u?hyW2F0ttoyHmRkc;h@el z^qF7r*x3v z5y8xm%5GS6ZJu4K1wB3mNd>(Ju>M4V2oQm6A;7OX*@7#J$XKWrE0LzQV2a4$!$$;H zU>7f0RIt#+^~v59%vli8^-(cRgH0mR9MoIs@?sMX`xnmAaX5N*oI&$Gu*WrH*|uy7I0vv@H(&U--ZPtoNTfpCcDmL}8ZB?6dN)6#G}HqC^n2lgGb z_af?txeD`aSjGt{1kx8tQ+tYfi{yd*nkF|c60d@0K*oVN7jt=$!fG2%%Sd}uxdA*h zE%-J7bZ8KN=NJJBl5z|k6A}R;Km-aR0-T8Rs?|-1RJ^Dxn7Le*Em|*i8&{PkYGiok zq{Xsz(=Mssw7S%7S}oHBuWd*V9+7#|ewU4_w@UqHHKcLtTDe+)qFfM4!O$_*U0B>6 z@okck=V9GMPxx$>9M%nV=e{kZblDQQ$}_JpC7nnJkZ&U)6P3Th2aVF7zL_W6ls8*- zsxK9)met?$ZDZQBZ5^pvv%K*|P>ACr3?3??0-aqu_R0L|%Vf{4{YIl&or)$b&aUPG zcoae@7&^9=^*1m0RX4ui*)+8?wSDt$D`%x@Wu;^9X1agY2>L%=P7&~fol_c27b^tZ zyt-!jCYk%wQYlxdw6yQhL{=BNby87zy-nAK zIsRB;{I3G3aJ&ju1h1mpMT@4%?8(2$n&q3d%#EdH{VMvQ=AiL>Y5g-EbL;#CM7!=0h_Re!&lIQOmB_&D~x38ZczdBi-xcx&}ID4gSUL%zY zi&JcG@r8Bj`1$hm-6Lhmf;G0ejFcuTe{4V@Kq{nPM3MinC&$Y4?-p8FQD!(i5NG%H zee%Q|BjnqUXXI!zoK;yEP6QGG0rdOA$`7-C_)Q+V=4~1C?o=sTv6SrJdr%&|@g4d1 z&F{&kwc9ODWC@KY_}RbrfV}aqG4kY{BTQHfJ_@i^)K#_eXgUakwyfVF-;JIvAN+TM z41ap8jC^IHESR;@w4;jX_yVn|V#U)`c(vThK3nSmZ3oB8QD@4CL?8(e055@8w{PAh z!*%X@_TG z`pxUM%earG$$QU#D{nvXm3;8Rcp3Bl&$52y7W;7H$^zl=3lDrEZ)^EckHXN1QW|tb zAQ2IuMp7cS3d=+Uh(JmrKx5k}*{s>F6gF{Cv4>W|@Mp$Z`o})JR<)68%l<=Ep} z1{cy;)E3fxY`-%*$fot%Q%A63jEZy(GbkAIIWA8xVc^n^7}l;^;YYoAPImfo<#vX|rSM$kh*=BDEV< zHQs}CCY<)5zqrK%^C<+!=Fk-Q7o|W6{9056xr={UCASZGSrZ;MGNFI&f9WFW+P|e8 zXKT}?q1^e@Pr-&Qaqnpy;?u>bJouX677eWh8uxyc`IGmML}E*(tq#^ahlYX!^MGm{k&<*<@JAkF7v0YG*$k&KQA@g z68_X!e8Uz~$a`xpfR*h zg}W0+&oV?#zqFSgH>oUpcJ7lh$+EZh*;9w9QLj z#d0~+>SK>#L^x2n0n4fGXm+jPwRxcR&`Yk=#0yRpk0XI>wOY>v$9C%{C!Li_NY9j5 ztIklS;d(Px2ArTvd{ofh>cjVE4BbjaY3^$}!#_{7$Gb>x$Y@x2$G*yaQX^)F`5I@R zMW3%E_1O`-qJ>PJ8Z?9!;)mwi+W#QCQzKBB?VAl7*$_2fLTlKYaXs_2tP6 z3Dc3*4|B3tunYIGV=DAG1#Lz)SDs6wv(EC?WpDOMseH6Z7I`w^t)ar$u_YOk>=g-3 zoix7#Q|`93qk}2dsfj=$auDAXA-P5b6WkQ9g$IxaChO-pyTwPNx`Xqb4`XHn=)|1fohs46L9)xF8+9MZLe;QxyLv;g z!{%4>BGHrkN=hbIc`iwKBVHn3%evz=?(wVZG95bf)b=xQI5`F;kBWe?M4|)v7kL%-%;-Z#P%C@GY_r=1HWxDk^{=FJ6vJE91z`i@spu3(^7Ip4Ox`RvWZ~}5?K5>gOTI~Jg~n;LRvVurb#j6|gXTN0>c^#}O$^%6Yec>~U3Cp$ok_=VqDy zPO43{I6RpF_f+3mJT`Rji7+%#=80b$^!JL@#SfaZ&zTwiu8nb-^Of|n__Qrw_GyDQ zEfb-+qSA$MPWzj|hH$-9|J~Px@+E~icly?uHP3$$DQVuo-!l@n6{#Gikz6KneXNcE ziWE4%uuP3tE^#psl@S#AX+E~`4s><)A2CrB?`vFl;GOd%)e*|gTD|#IHoxq4^Wc5w zT3^+-%m|gwu+v4JpDp?Zy9D(=x=sT90_t)kj6eM9ud&+Bi619S+~}ST35gWQtiUIR zbm(zEJ9oBF<1H=273yV{E@)Xy)Gok?hxj#zz%z?Y$5FPI4?-dpa=h;ffI^ymkAB@; zws5*}ON_zH&1?Oz;uXLK^q=+uekASJzPwtspJnDOJ5(}Ne$~LDduaA1t9L&UL&xph z&;vaOO>=~W!B~Xb!iG%HG_K=J{Q02;^=Gyn6H*PbLB{m>-Z4#*cM~Hbs;K%GD>;PG zsE?$k+;q9h>y>|OycP+`PqI>`KRfJY++V2`%vspVP`0y>%jYTCqeuAnRp@- z313eLdj>Tx^_#NE9xY-_;CM0R@S*ccYS(iqJ@Zuij-Dg!OOrbQ@hUO`x{dbhr%2R+ zp13^i;x}J3W@T$A<{xDtdz~@MdUyU(wum}Ox*A(u$F$^W_Ns&sib63Pv>Q!x>rN}> zd*>E(5>*1Cvr>t46r+2tKZM&3$}pz1W9kxg5Q2SjM;O?y7r%%537 zf2v;2B&{VQCu3GI^@B;ZlzH~Zfc}#V^3;IMmx)oMguAAn)1`k+5q>->krhr=%`m}q z(IK2z2~A-CJ$x1dlf+<_CS&A0VtX^~hJ-j5Vn z(hi6@{OT4xC0!G1esEks=Gpf{^xYzB`<>sewI#zO5?_2+9i3fq3kms3D(@&!!E_Uk zIZ!yA71vkWYp@?}V{l3T)S!@pv^*`F1ie#?{#V$WAC=~{TxCnf5Z0sTXT&@w@>j6n zxo!;ehs1Xz-wquTQ>?z78Ne_yXnAv^YvwMY7~~X*`);X8VAM-Ar~=Fq zmNA7{4+C0Z49oCUh+C}~8k(-TEs|cInKo!R?tC|OOKr$rpfR^5Fpgw+`$K*68)RKv z#7fMkeT#jTM4j8Bq9l#?bw-dB$I6{WtXFjhGRJ6M!j~;M)s-*Dm?s~tX^hinP2w-h z=TirJImvM`Vz8ec)%F|qlvxsepLBaJrFUgES)cXr(~=|Ni* zZQE9ccYV2I^J52#0Ap!_$*ZUK2sqkf=lb0>PJ>;xVy@<388O_0CVRkamv=cRjUE26 z%FbzpClJN?GHWWhX0UxrDN|!$a?b7IV>xXl-f<&l8eo{Q3Jx=Mc6 z;JQouE2*^YUER@DB|V>yu3G{rK?%;H+Go4oJMU^tw>&9ODh3Rleiav{_nVlnRJ{pi zZ)nvBr1|L_p-sin5(Da`I~C3HTFR`-0~Hu#q8;O+ErG}U;nQDw->XfWzAk;2Nzp5M zKJqwBXVm|Ia{o0mQYMsc&s%zNqW$jWv!rp=?7vc zctpru-nLKgZc$fNbaF=Q6Uh8pWnIdbfpgh-oN`k<|FkG_(DJ(Kg;Gx(l=xDuQ2Ha! znWw(N+Ugan-wLwmZ141VByTdsBO5oZf=(48Rc^Bkm+NDBJ7%=}! zB=>4!y|1Eyl>B=BhZUG^Pn;IXbc|E{!V@R5isCtJ^h(*SqSzvC+dA}t<M=#1IRe=4e5ep25eC&E#o?1^;q z6}pBBkxHL^=CuLB@+nBvp(NVjMJX7i+)VCUvBQt1pA-5KyqLkj7aLa3Mf)xy^|>&S zSLvzlY)Ydi1StgxM~~qyjiVKIDhTQlnD3qdMva9yqqGdukr02bjJZ%euuv+ z-;F`Qi|_F&uS$80mB#(L_mW~P`4hZmFceMq{yN!R;q{r!>U(^RrF?0gT4W{HF_}LU+n&Nd6zBxM)tqEOr zR~1h;7)czaTPBT=){9Q+y*dB;ta=AI6wu+8tK$47J8#9TJ3%Q&PCZmWB>^{@z3Q_N zK4kndkH?)N#Jul^b|i524)Hkge@2Ycd{dcsi<_}&&fV|rT6daOQ;OwVRjFS3Zj)}Y zWSYVA)2l)1E`@gmoMhD9Y1h9JZcy+pHhd_)#GynNS9Z zxQA9SS|0l`N@3i=sJ{(N6bm)6!1aZBT{(Dg*D&6D?-&aOA(QsrGhXy@o6X%RYAli| zzc+TdjUJvdiA40$M;7KP>>Y)NA}ySWJ407onKN0aRw4`>%0fC>q!&MPKJj))im2<< z^Vhg3IHPwvAZmDUvf@Ey@7Acdqe;Gz9Xh+~CIoyOGhq{^sWlZHdw2%d-|$=40lP*_& z3L=uu_LZl2APpcLGnp$co7S<#?lm zvQxt%zQ#QbqC~Eg^Gem6ep%CWPq422J=GNohBL!KMq!DnDoU%Pn^LRLJXPqUH**)J z>n-HE8tNKqtu=`QYLq5NbVSfb>o$Z?`o;WG(r7(YcZ zL3W{52MdKxO!|ew<}lp=5?o`)c&**NO-k43_rY#0UQ%qq_0O!nj$H48s9El8RyUbz zlxkw(?3C_(t}_i4JL?>`dY#dwSq23AYll`|0{t=Pc+P+u$gm21s*JG8(B0^VjHo}${q^8sZX=RBh9^lK06DL(R zFSTN}>NP=uc?%C3V2*Xqt~FABk`t8Zj$(QkGJoChfbNJ*?J1=H80Xn??%CpmMmxzv z^S!Nn?`n9^y@$nqfwGHU?u|drIK#qZ?&^;{WF}r0`PyU|GPhsm>TRFU!B*GIduqK= ziFru8LH}VYeb(Ry@9^?hF1lFv@7)WePOq8Ul2f=OuZ~K%4vE!yo~~+2hK$0We*j0f z^2+OY7kx1Go!0ayP#@bJT#rWr7nzp~gAFz2@WeWLPh}lp3P<}C>yIxnoIM5}d)dVK z!SOqDA8%isn(s^}_*WCyY?gSxSE^;~T?A5egi~^IOXvr*#tV)@A>X1#msa>k9Jpru z+kcHTHDK5&UEn&V9O|5Xa^{OSH8}bVDWeeWB!Hy{pdrsAk;vM104;@5Ph}PT9{Bw} z{^6UXJBjq5eq;&zM;85fk$kxB6?L5MYvPh^Z++W<%sbe7F33oSAN>_ShTNx)rh5Of+dku})-bBr0x^L+@#S_*+AU zOhIOd9!|vF6|pwcawci-ZUbhw(_vhXcM?c(c2-(9!5a97A9uBmo)aiKs7rC?%~-f> zD7aHvD;hRpe2Qk9`swJLXIckhp(1W^JDplkP%kI6vKe_hejKGM?@EJt#L3|G`6l6W z%1BV6)}Hp{b7E5S0N=HW000{vFu*`^ky9A)Jf(QmLYRy6l>M5FrO zi8u8cTpW{kH8G_g3G>b9_@=?I)Ey{|o9@8-p#dIT&nU{=;bb?T3*jMdF`{d-+PXH6 zR+YJbl+$%7sX-_fzKq!?kcFrSusVpecotDsL7lbOH1hMcitHE5F!s{?DiDr*6_n?4|}E=1@_{w zi`siYB?z&)BAXI4Vvw= zWW1x|%#yrLr}&XzdA}Adu6Vm4)4nLHfA*%>Os#g-fq+zN7oL#p8l8FbM4{%;lCJXl zf~?$6Q582Ruiemy<=^!>{u4^zRC^2vscy@y<;Y8HL#Q zm8(zUhjy7%~fSKTh@b5cgC3ooIi z`r480S3;uS3DSV#FnsXmou+B=(cP=!&dL%UV|p{KO3ky`r`NpB-Ih-jp5e#YA38h; z3&p;nbK{W|_+;as05ou!+Nb-WM{RIs)7c9=8@UH^+aIHy%$3yeUmsoK9X%BYE^AJ- zla?otCn&MjS&B37XoTyY;P9EZ7z72BEM+`07HEzflP$pF-6Z)UdFZx?rCN6oK;b9m z=O=(|p4>g!-Gj&99pu=%Dl*UUuCctSqqW-xg00(-1N*W!?`Gi%e9^vXRc}Ids^DOs z-coMNaXa)r)0;N0dN={tO^DQno@`aY=pgUr0l8U0dqS|yH=PBR>2aL>M|`j5Sbo`e#Tg9fFq5g$t14c9#|15? zku^t&Q_oFBp$grjL!^m;6)BVm{Ih1@o{NaHPSZf}{*m+WN?Ymkc(hh6e$OvyW;vlc zare4#)G$GKM*D|RP~YN?4a>WjKrM+%*M-tujY3ye~qN? zZ`M<)liVbSXvM)ggy>Q0bsAS%1e1|aF`4Fd>zfT%Ve`y&Tg9eb>Rfpi2P7}sh^Rvq z!C5R+qxXy_i<2U96*ROir=vgQk>nLBDxLjw*Xqf@CXp(ob0)#$4hNxvjfoG*CL}UG zRle#7ilLGr%446K%^)4#k?fEBMfqGaDu+DM`>8TeZ&?;bcwIMy(vTy{K%YF{YhfWm z;f+ZdS#YJ^l@d_fouxuAQ{OQP>;n@~%Nov%qaqiI)#sF&!!wI@D5%_kVn_%9wf(Ct z@aVgtAkNL2mtW0d?Q@HWj$EhdJ%(f;mTk8V8 zV~8kLC90qNtn;ou4ILS(KFzt1k94~^<9A#>Ul?+e;$?hWQw419`W4cZ-y#lETb}1? zWD77XV4s_7TuagE)8Mv=>`jf43FBI=?S913qTxJV%{Do6ao$!7`w;YDNXAmu8*Lac zsb6nqjy+c23U4s(u*6pO1vhEXfaFo&{>X}KQ`(vB=IqNtR)IHGsN5V6HlF1d+~j;GIKk$~ziSp= zJaHU+;Bc&+a*T5)wVXupC>R@#pZ}a0R;>Hw{ZK~5r+WS@Qr(eg*4GgD#Mi_qq4D;; zXw&jXFAnrcvT!%OL0I+vO5McT?t&?wY!A{z15dhD9+{`{Iv~e){<;=W^?n&(u&^1q zKN&ChLWLh>GfZRj;siOrH|n+b3xg3MJ5+o^OVxVuf;!6-ijZs;f>8@xi?5(U;ZRg8 zT5xm`BU(snAI2%^UO+TMhD*K+8cTNQD(d{A)4_SKi^O@k!o@K~=;WhI(}9w>kzsYh z)JS20Ub%ju8AwrSe8S!V88R6S)7zSuJ#^nf_2RdvlBTv=XGk^_C>bB)6$yU$RcYRr z?0?L=kY!wnoWERHsPQfC<@@Dd_L-Po;-UrX59`q=(pq5qAJ(2rb%-#67`_N zQ_XZdPp;K;NCb6kj(tLC{z;80rNh+c-r#Kg&gG`YETD=->ON2#@**NihX>gANjahz z(=e{YbN|BF@Whv>m_9Mqv-Zhlp9O45j=9%Rb79!5oLM?3p(Vo_#hg|hwt-d-Be~13 zD@9*l;#`&qHSsbDn}XVOLrL0b0F5^iRQZ0 z!;B&ZL_@xgsS(P<{n{TXmwG%h;ky)~6v*SiVeD2Pe6Yzln?vZ$_+b)j zOx-B~PEsLX?Yeo!kG~E%v2X{fQ@+xl-g4%MliINNkHqz}p152ANJda=Qo z$-OvMlx}23DQVvQb8qAei>dBi%rC*OSVB~&U>(FDpJJVkHt}QEZxodt&>umVz-frD zsUheG3}2tBCD9;pHf^Otf{#f?)Iyx)BP?=+C+a?F5+qS@Txp$)t-s z_69aMI1u>`xZc$KT5|?*{P$e=8 zaEP93=r(jy`_)qRpgV2NA_Y(SY366f6G&YkP46QYGd-WS;AHOb7!4k4`9bQ`W;2BZ^^XWD+~H@|1h!8MpurS#`kV0}J?2dPzEXC@%p= z0woJl1b-1VKI)YmRw^}(pOns>Ez0RVV%7S>clH^)Oaqh*3Q7Jh{{U9?HgsgOSJwDy z04gxm1-<3115y@>A?X`ne|;w+dK-!L~5DULiS!>m-F3I z2CEA_sh}o79Z8o!WGrs35M3>-PG{s}tknCl$@P47G`Yk$Pz^iRb+N;)JXZ#_Z$Ntnv;>qYfNC{S>=ScWPif}ofb2qh&zB$^bZ2-=2L?&->ZHGRX% zseq%+^<(p)?yylDB=(&}ro_(PQ(XSr#F<^#xQ~2W>O#)k&RUKP zi)vj1Hh_j&Ejn`Zpr;m#3{ymC|@N3b-kqjBp z>R+)3KakcElB0h1zGC?tCp}3`+}SmeustxHJjOhoHy(Ks_I2dTz0HakPKBQv+`%h) z%3@GDu#QcR=P=MqJDSFDaTHa?Un0bnS;fdcSnI6I0-uVEAFbL!uHK(}lZP#?NQ!sd zi&wwNZX$yxYl1S6i9;#CT=n2c-VIpJ$+-F*2qX&k7U;r4KImz+%jU}v6}&-Kz~OcE zcWQFgbw&U7Cb!gTizMI}_U|Ej21wIjG=-D13{H8yr~0?u1$L$&7(-VF2ZkAM6CrT6 za&7i?m^~Brri4{7>6-~@zD7tTD99<6M7wiC9QK3c6cSqP=k;*dd%G%F+p z%18ufXT04x@q!&Hbq(mnsXN-Y{j}}&OAM^u2i)JcOaBggh~yFeYxuk3cAZ&m!tnkS z@7j84{FAvegGv`aa>^^xPD4H_%Y9vR4?NBct7WCnR77rzv)4d6kZ6GR)lk~=LJF+D z-0!7^&BXdk_u}{+{S$>)D6<(*IPjiS?_~zTW>PxK5T3gS$OlP<({XOui=&@P*2UB8 zu+5StDill$0+BI&7{U0CtzHr>C>cZuR4H)~{!|FPkEtmA72)wi(2z-}v42NpfrE85 z#5$4R8NP->plk%bhK3ITE8c|%RP2>_`QqNjZGZ0*g#Kk-fFXoX5If1uySIpNQ^7aC zw=vcd8;Ck%v4f)C`3c>_h0b?CG{RY5fkUG)6m3dN7(J2BI0><&g%y}zJ(NWVsSq)W z!jduR=y@v#OTDj@J$#UN{=^zQPa(0p<%7PoQ@1^Q+|rOjKz{FrD;mjoTAZ z#OZ%ea;aJY1t(~`V`8{q_3_zkwVMHvVIk6fMivUy| zh`fO&tn!}VcG;jTUVY@4J6qw=p_M|xL-BApPyo_ykeIjk0Nn5>fcfJ!_^Ap37Yb+| z5vN5lc#%@EtnL1^OhCm<8W2;=+iLlM?~(Tx#Jr7uE9%fdaA=6$py_?uc97B#Enjv>419AY}?6xnZQ1-Eq_syA8 z{z!E}4RGOmbrI%j%FMw4l8a!@QfiQNAb^?vSULgs|)QAI5z;LkMkBM?l>0tkF~#k%S)iio?*{eTVt=HD4U z=sl3+LxKihmJMi92}RWXK$TnZrz8pn6hw9pLnp1YTMT*^ z5wt-zehDlWLSzUtfDL_$iI89<2z-$9_zv)s4`ngmkaFj8qE8H}g!@|v70tQEa&>3` zG{rC8{G)xLCE(p(#@(DOOoWmsi@lP7<_Eue!bA;G0j^|#s{)-TPk~RpBM6KX=Lu6y zc@c*|*&{;SUHc>O1WoDgYqrz#o%>F@u1* zniAO_|MbV8<>~tt8pxiriraciB2_+k5^{K!GYmN#e z$QY4tY8>D4P=^{JB;zTAv@gIOK5<}7KJTw>w~7#k%Rrl*@+}GDqwkEwJ-|m621JuG zAr=!?$_|BFnbsMzVL`N0SI4L&k863Xevh%1B? z8AITzxL7X&MFC;HM5yO=%u`8(Fe8*(+#HXKB0x(Au-=3d8Aj~~#DFQLxbxzJ7!(^2 z1AXKt|65G|Z4#j5$WuO2ot~CrP%c31K76Ja23QsP93dai&A-R}N$-0g#a}pxl}QL2 z5RMfj4mv8pa{OsV{!`KrxHBX8^taOg^#~psGDW9!OoondI2kaFzdH;lr~rafAWJ{_ zo1p-fQZG>)$mrRpz0+R^pmfQ6A2(!1^idQG0WAGn|B!Dr9{BH{?+GI|y3G;>k^h7B zyF~+niD;Af+o=BA%fBx??u!9H?wctp|CPA-&yoHoG<M_V4e1F-{AC1Ebf}P+unoTp z-&_uUyW=7Z7*oy>UL8r7<@x+4G&d;ox0u(oU*bcrLvaV7Fe(bJ3lA6p5G>y zZ?xgKbWPp4F1vnyeicSXqUJhPz+9cWp1ELL`=NS1mjB9{rrsz@KqH0;zlDs>b!yk% zT7&!YvX4^mkbF;s-Nx0GWP3LKWS?(?UqdG$$s6TNZO*~4i=dHu!QGd&qOs2v#QMpY zukCwaK{DE$rc<5di?w|bGVYrlkocS z2j%`Bix;gT^P=lDPEGUW0fMr|E+@PiWT(wM&*usQw|-u>@V5@$BVtQP7R-0H?+-oQ z*gAcfsEx}d(ARU371gZWV71fN&;MGWu9YY7N_W@3QIqeqx!Nu`qAwuwdVEm&1pQ`p zA3gooNx#1`%xaDDMNeegD0-vjHS3S$F>fBhw!L9n6Ok*?CEn-Pr>wHDA}MQ{!Q+dI z;q$Ajoxx>F62Yf6V4IJAoQcU=F#7?|JLZC#H?`tjr;?v>@7(-c^Z~5(UTYlBtu0o- z^JwwLkPd6{h811&s)^CNT_p~BUrS`o_up*Gub-SWUM!u?Us+%747T~*pHDyXF*@4D zk#xGTJlRePcIA+drpqJ7aLV&(%JF)i0Q^2SHK$3xwQjiE`GMWe_IgO>PB&-F_$K8lr_J_*(+6pH zxd~m=s-za&q2CRb`{(O@1aQaCyk*vKaDvuwFhALsT>`C^R}0(x97z{jNxo}t_Uo7Z zQVV_a0HgPPywlckLJlcdHI20Zfjv##6KNH3<9)vUAZ~7FNB$Q;L7$A1OzWN0y+k+T zsR4)7Mw;}43rVMwVgEx4I&*gwbCx(=Elm7qEyphaXB^QUqTg}`gAR1}m=dTf!I8=a z`UVD?TPvhlW2B14#Gubniu(BTM92vk#iOC)#dR((B3S7zPRJuZbr&v=YJ7eHVhl#| zsy7i2=+a7@KHlboWaZOG1brN3=iD5235bC*j#Y;V;7VDbkQM5&_&;ORbV1lm0q&G?p9)6F%P~e;`$=VM>s#YycDwJ)-QK(I(#-yGuXu}XQ&(Y z)BF6w?AL{js8ocOBeg0y>faN zv#YYM>y(9ydopSNQ<)w4c-W4btTD>gT($fd+Z=fo$_5$lS_dc)i$*Js`1JA8E_N^1 zeYYFS8)xGht45%Ukt`_hvSkIgj}0$T%KGXWur%C0nm;YsINrPZM_{jOY6UAR_iuLe zOH;g!q$+Gl%af%IwOSw>uCRb4P>xX9s-o8S0kcs+fa|QjcOU-xg2JI$f2cX{k1T1pb1JGR@ zr@DyJk++#2^qYsgbN}^!)ikH$_Ru-?+SNe3H{ysKs#MoN@@;~q6WlgT{epssU#f4? zPFhCh>+_ErQnhwlun#NU&&7YSlV6=KHC&d`B4JTO#G^9*S!RIMFa;Rh(O!k+%$t)mcBUqP$uNd z)r}YJ6qq421!}U38%G4v&~Q_IEbK)@G|o>WhUr8@k5G~psWJD0nMoz0ewnC;XNa#G}1(liYh2M5C;F;Ed9 zSXtQR)w^$g_$2c;)AhCIlHcySaSK|oVqJ<3dw1AdYx13lsR4_~k2&0N`JO8Y62w~P zEa_0?aDAyk2HU%+wLcN7tFw(A{HW`2p2$RVsX=~aJ=)*<37%ay7gJ-c^K&3|ope6* z@~XYpJrmRFBL<6LORIOa?R91=6&aQr-wDNw@iQNRtG&w|-?f_{`{+tc8-o_h#sgsJ z=&?cDy~IYqM6n7I36dpRnP@(j?Bu_?zP2Z#*k11^UAVTrE|S_|#Y&2eoKFXgTR)Dj zm8;-QEm7RZssN(%dy<&e34%#hZ%13p{bbhCF|PSPEc-@0QtBSd@xd9kGlInMxu!xH zLy#Zx+}ep88h2Cdb)e`(+#dY7EmY%QCy5O5ndGP8^RLXj}bn~cDMo+GK8{4xD7 zOcOkh5y>WWXZ`lv6zv9=vyr>u&uBsH5=eC@0_hOO3L#))r0yb}cq`}OV27_|6vn(Q z)9eZ*9&fX&XpoZpBU|<2fG>J@)Cs%S#c^?mW8nI-fX>fozZ{sF^(2vv06o>gc6y8m z-v=2*L6)>BK3Tu=OxA zP-KV{0jV@P(!&7265j4y|MoJ41Q6b$0CKP~@AQsw0^2Zz%qCK}(7_4qH8-xbD9}>7oaqbkoCQ zS^nLL{RfqBEFcgOp5Lyj_1~Z@<0JGQfAViUUmpeX$pDoVd)r$O80zZfJbo(GDkDa{VmqI3i7Qh5OA*!; zT_Ng@C$6;P)v5+;Eyw{PN}B_k`S=j6t5T zK{~^F6!1MJ9m%1hv{I|v*M7f$jSdd4BLGJE*KogoVB#kg*EWD#}i~>g$Ma901O8Xd!#kncz#DK?kVVBOX6cWA%#l0N9lEZ#A1veEG>Kj{c{~}U(fZHpivUX2 zG@}q?P(8*(*vPMUc>#YQEQ*RE?eoHs9H4rNx^YSs+=XJArh{QycGIkEY}1CN>(`>xW++os|Dy9ic@u}MdEWuHyDAYf$Qsmhw`ISovC-1r-roEy^ygJ0mbK^rz}vq-c?6@*_2EX@d|4S>I`f2P zFL8yY<3d9pT7CL7YhhtAwX~#PTVLO6D#!H?ZeTK5oyzI@Bwh_oP4fKJVhmZf^(azX zGMP8zz_2bfyO)=jPCV0GjmI4Sf&=_$xbNWPWJ*MIwRva5=%Mxp$8bQb9)NnD_2J;) zm<#S`TNH0iPd~}X!TcLJWKcP%C*7icmhF2mY$`Ta?hhi~j_iwDM8jwpK|&>zVvnqX zcOpRbi{>ASBsY~XWoH7k$TU&KLOUcg>Aw&DLz?kCWTlnF|3mpu{{J9Ze@c|l w{~MzFe*pY#=>CxH|Bubb|KY*^E)U>14UQN=J_dJGkbpmFaXGO95gpI}3s?ltqyPW_ literal 0 HcmV?d00001 diff --git a/multisite.yml b/multisite.yml index bd8f00ed..093bd151 100644 --- a/multisite.yml +++ b/multisite.yml @@ -1,6 +1,6 @@ --- - name: Run multisite provisioning - hosts: localhost + hosts: all gather_facts: true environment: "{{ ansible_environment | default({}) }}" tasks: diff --git a/site.yml b/site.yml index 81657c0a..cadf0fc3 100644 --- a/site.yml +++ b/site.yml @@ -1,6 +1,6 @@ --- - name: Run default Splunk provisioning - hosts: localhost + hosts: all gather_facts: true strategy: free environment: "{{ ansible_environment | default({}) }}" diff --git a/wrapper-example/install-splunk-ansible.playbook b/wrapper-example/install-splunk-ansible.playbook index 5d23b9ef..f0d88ab9 100644 --- a/wrapper-example/install-splunk-ansible.playbook +++ b/wrapper-example/install-splunk-ansible.playbook @@ -35,8 +35,11 @@ - python-yaml - python-pip - - pip: - name: requests + - name: Install splunk-ansible pip requirements + pip: + name: + - requests + - ansible - name: Wait for splunk-ansible updates to finish shell: "while fuser /var/lib/dpkg/lock >/dev/null 2>&1; do sleep 1; done;" From 5f12f7c317d31f03ee1062d23508c5ae33d0b6b9 Mon Sep 17 00:00:00 2001 From: Nelson Wang Date: Thu, 4 Jun 2020 21:10:39 -0700 Subject: [PATCH 10/18] Adding connection_timeout (#484) --- docs/advanced/default.yml.spec.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/advanced/default.yml.spec.md b/docs/advanced/default.yml.spec.md index ab0ba875..e67b8c84 100644 --- a/docs/advanced/default.yml.spec.md +++ b/docs/advanced/default.yml.spec.md @@ -353,6 +353,10 @@ splunk: * Feature-flag to enable special configurations when using debug, address-sanitized builds. This is not used externally and not recommended to change. * Default: false + connection_timeout: + * Change timeout value (in seconds) for the setting `splunkdConnectionTimeout` in web.conf. This triggers a change only when the value is non-zero. + * Default: 0 + secret: * Secret passcode used to encrypt all of Splunk's sensitive information on disk. When not set, Splunk will autogenerate a unique secret local to each installation. This is NOT required for any standalone or distributed Splunk topology * NOTE: This may be set once at the start of provisioning any deployment. Any changes made to this splunk.secret after the deployment has been created must be resolved manually, otherwise there is a severe risk of bricking the capabilities of your Splunk environment. From 4796ac41ef530919d27e640f2c8ad3f9406743fc Mon Sep 17 00:00:00 2001 From: tod-uma Date: Fri, 5 Jun 2020 17:26:17 -0400 Subject: [PATCH 11/18] move splunk_launch.conf to before first launch (#486) Authored-by: Tod Detre --- roles/splunk_common/tasks/main.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/roles/splunk_common/tasks/main.yml b/roles/splunk_common/tasks/main.yml index 4012fd0e..d723c69d 100644 --- a/roles/splunk_common/tasks/main.yml +++ b/roles/splunk_common/tasks/main.yml @@ -58,6 +58,10 @@ when: - first_run | bool +- include_tasks: set_launch_conf.yml + when: + - "'launch' in splunk and splunk.launch" + - include_tasks: pre_splunk_start_commands.yml ignore_errors: true when: @@ -68,10 +72,6 @@ - "('s2s_enable' in splunk) or ('s2s' in splunk and 'enable' in splunk.s2s)" - "('s2s_port' in splunk and splunk.s2s_port) or ('s2s' in splunk and 'port' in splunk.s2s and splunk.s2s.port)" -- include_tasks: set_launch_conf.yml - when: - - "'launch' in splunk and splunk.launch" - - include_tasks: enable_service.yml when: - splunk.enable_service and ansible_system is match("Linux") From bdf4d732a792655b849ff1a4f93f427c3c614681 Mon Sep 17 00:00:00 2001 From: Nelson Wang Date: Fri, 5 Jun 2020 16:24:48 -0700 Subject: [PATCH 12/18] Reverting this change temporarily (#488) --- multisite.yml | 2 +- site.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/multisite.yml b/multisite.yml index 093bd151..bd8f00ed 100644 --- a/multisite.yml +++ b/multisite.yml @@ -1,6 +1,6 @@ --- - name: Run multisite provisioning - hosts: all + hosts: localhost gather_facts: true environment: "{{ ansible_environment | default({}) }}" tasks: diff --git a/site.yml b/site.yml index cadf0fc3..81657c0a 100644 --- a/site.yml +++ b/site.yml @@ -1,6 +1,6 @@ --- - name: Run default Splunk provisioning - hosts: all + hosts: localhost gather_facts: true strategy: free environment: "{{ ansible_environment | default({}) }}" From 9962f95168b7ec3dce9654e1d4230e8dc3f3cd9e Mon Sep 17 00:00:00 2001 From: Jack Meixensperger Date: Mon, 8 Jun 2020 14:10:13 -0700 Subject: [PATCH 13/18] Hf windows (#489) * test forcing owner/group * change play order Co-authored-by: Brent Boe --- .../splunk_common/tasks/add_forward_server.yml | 6 ++++++ .../splunk_common/tasks/enable_forwarding.yml | 18 +++++++++--------- 2 files changed, 15 insertions(+), 9 deletions(-) diff --git a/roles/splunk_common/tasks/add_forward_server.yml b/roles/splunk_common/tasks/add_forward_server.yml index ca6cde56..28d06d8f 100644 --- a/roles/splunk_common/tasks/add_forward_server.yml +++ b/roles/splunk_common/tasks/add_forward_server.yml @@ -14,6 +14,12 @@ - "'forwarded-server already present' not in forward_status.stderr" no_log: "{{ hide_password }}" +- name: "Adjust outputs.conf permissions" + file: + path: "{{ splunk.home }}/etc/system/local/outputs.conf" + owner: "{{ splunk.user }}" + group: "{{ splunk.group }}" + - name: "Enable ssl-forwarding to {{ forward_servers }}" ini_file: path: "{{ splunk.home }}/etc/system/local/outputs.conf" diff --git a/roles/splunk_common/tasks/enable_forwarding.yml b/roles/splunk_common/tasks/enable_forwarding.yml index 2ab6d197..9369c459 100644 --- a/roles/splunk_common/tasks/enable_forwarding.yml +++ b/roles/splunk_common/tasks/enable_forwarding.yml @@ -54,15 +54,6 @@ no_log: "{{ hide_password }}" register: default_tcpout_group -# set up forward servers set by get_facts -- name: Add forward_servers - include_tasks: ../../../roles/splunk_common/tasks/add_forward_server.yml - vars: - forward_servers: "{{ splunk_forward_servers }}" - when: - - not splunk_indexer_cluster | bool - - splunk_forward_servers is defined - # NOTE: If this task is called or used, it will disable all local indexing! - name: Disable indexing on the current node ini_file: @@ -77,6 +68,15 @@ no_log: "{{ hide_password }}" register: index_disabling +# set up forward servers set by get_facts +- name: Add forward_servers + include_tasks: ../../../roles/splunk_common/tasks/add_forward_server.yml + vars: + forward_servers: "{{ splunk_forward_servers }}" + when: + - not splunk_indexer_cluster | bool + - splunk_forward_servers is defined + - name: "Get Splunk status" command: "{{ splunk.exec }} status --accept-license --answer-yes --no-prompt" become: yes From 1af3e1fbc960cfebb18f918754c8386003079afd Mon Sep 17 00:00:00 2001 From: Nelson Wang Date: Tue, 9 Jun 2020 11:04:23 -0700 Subject: [PATCH 14/18] Handling null passwords better, with tests (#491) --- inventory/environ.py | 4 +++- tests/small/test_environ.py | 22 ++++++++++++++++------ 2 files changed, 19 insertions(+), 7 deletions(-) diff --git a/inventory/environ.py b/inventory/environ.py index 1ab3a485..443d4e6f 100755 --- a/inventory/environ.py +++ b/inventory/environ.py @@ -349,7 +349,9 @@ def getSecrets(vars_scope): """ Parse sensitive passphrases """ - vars_scope["splunk"]["password"] = os.environ.get("SPLUNK_PASSWORD", vars_scope["splunk"]["password"]) + vars_scope["splunk"]["password"] = os.environ.get("SPLUNK_PASSWORD", vars_scope["splunk"].get("password")) + if not vars_scope["splunk"]["password"]: + raise Exception("Splunk password must be supplied!") if os.path.isfile(vars_scope["splunk"]["password"]): with open(vars_scope["splunk"]["password"], "r") as f: vars_scope["splunk"]["password"] = f.read().strip() diff --git a/tests/small/test_environ.py b/tests/small/test_environ.py index 19906240..9a362132 100644 --- a/tests/small/test_environ.py +++ b/tests/small/test_environ.py @@ -221,12 +221,22 @@ def test_getSecrets_passwordFromFile(default_yml, os_env, output): mopen.assert_called_once() assert vars_scope["splunk"]["password"] == "worldneversayshiback" -@pytest.mark.xfail(raises=KeyError) -def test_noSplunkPassword(): - vars_scope = {"splunk": {}} - with patch("environ.inventory") as mock_inven: - with patch("os.environ", new={}): - environ.getSecrets(vars_scope) + +@pytest.mark.parametrize(("default_yml"), + [ + # Check null parameters + ({}), + ({"password": None}), + ({"password": ""}) + ] + ) +def test_noSplunkPassword(default_yml): + vars_scope = {"splunk": default_yml} + with pytest.raises(Exception) as exc: + with patch("environ.inventory") as mock_inven: + with patch("os.environ", new={}): + environ.getSecrets(vars_scope) + assert "Splunk password must be supplied!" in str(exc.value) @pytest.mark.parametrize(("default_yml", "os_env", "output"), [ From eb235cc05e87b1688f3cf9464378867902ada6bc Mon Sep 17 00:00:00 2001 From: Nelson Wang Date: Tue, 9 Jun 2020 15:07:46 -0700 Subject: [PATCH 15/18] Correcting stanza used by rootCA (#492) --- roles/splunk_common/tasks/s2s/configure_splunktcp_ssl.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/splunk_common/tasks/s2s/configure_splunktcp_ssl.yml b/roles/splunk_common/tasks/s2s/configure_splunktcp_ssl.yml index c1dc615a..1824e3ad 100644 --- a/roles/splunk_common/tasks/s2s/configure_splunktcp_ssl.yml +++ b/roles/splunk_common/tasks/s2s/configure_splunktcp_ssl.yml @@ -42,7 +42,7 @@ - name: Configure SSL root CA ini_file: dest: "{{ splunk.home }}/etc/system/local/inputs.conf" - section: sslConfig + section: SSL option: rootCA value: "{{ splunk.s2s.ca if splunk.s2s.ca else '$SPLUNK_HOME/etc/auth/cacert.pem' }}" owner: "{{ splunk.user }}" From eb74b3aeab63f838a30140fd5f34e36484a13403 Mon Sep 17 00:00:00 2001 From: Nelson Wang Date: Tue, 9 Jun 2020 16:47:03 -0700 Subject: [PATCH 16/18] Feature/apps v2 electric boogaloo (#487) * Support copying local, but not local/apps; adding deployer_push_mode feature flag * Adding docs change Co-authored-by: Alisha Mayor Co-authored-by: Jack Meixensperger --- docs/advanced/default.yml.spec.md | 5 + inventory/splunk_defaults_linux.yml | 1 + inventory/splunk_defaults_windows.yml | 1 + inventory/splunkforwarder_defaults_linux.yml | 1 + .../splunkforwarder_defaults_windows.yml | 1 + .../tasks/copy_installed_apps.yml | 4 +- roles/splunk_common/tasks/install_apps.yml | 126 +++++++++--------- .../tasks/set_general_symmkey_password.yml | 4 +- roles/splunk_deployer/tasks/main.yml | 16 +++ 9 files changed, 92 insertions(+), 67 deletions(-) diff --git a/docs/advanced/default.yml.spec.md b/docs/advanced/default.yml.spec.md index e67b8c84..1f21b20b 100644 --- a/docs/advanced/default.yml.spec.md +++ b/docs/advanced/default.yml.spec.md @@ -461,6 +461,11 @@ splunk: * Determine the secret used to configure search head clustering. This is REQUIRED when setting up search head clustering. This is pass4SymmKey in the `[shclustering]` stanza of server.conf. * Default: null + deployer_push_mode: + * Change the strategy used by the deployer when bundling apps and distributing them across the search head cluster. The acceptable modes are: full, local_only, default_only, and merge_to_default (merge_to_default is the default unless otherwise specified). + * For more information, please see: https://docs.splunk.com/Documentation/Splunk/latest/DistSearch/PropagateSHCconfigurationchanges#Set_the_deployer_push_mode + * Default: null + dfs: enable: * Enable Data Fabric Search (DFS) diff --git a/inventory/splunk_defaults_linux.yml b/inventory/splunk_defaults_linux.yml index 3767e6c5..4c873ff8 100644 --- a/inventory/splunk_defaults_linux.yml +++ b/inventory/splunk_defaults_linux.yml @@ -74,6 +74,7 @@ splunk: label: "shc_label" replication_factor: 3 replication_port: 9887 + deployer_push_mode: idxc: secret: pass4SymmKey: diff --git a/inventory/splunk_defaults_windows.yml b/inventory/splunk_defaults_windows.yml index 23a22dc6..324edd08 100644 --- a/inventory/splunk_defaults_windows.yml +++ b/inventory/splunk_defaults_windows.yml @@ -74,6 +74,7 @@ splunk: label: "shc_label" replication_factor: 3 replication_port: 9887 + deployer_push_mode: idxc: secret: pass4SymmKey: diff --git a/inventory/splunkforwarder_defaults_linux.yml b/inventory/splunkforwarder_defaults_linux.yml index 94f874f7..2c2ea758 100644 --- a/inventory/splunkforwarder_defaults_linux.yml +++ b/inventory/splunkforwarder_defaults_linux.yml @@ -75,6 +75,7 @@ splunk: label: "shc_label" replication_factor: 3 replication_port: 9887 + deployer_push_mode: idxc: enable: False secret: diff --git a/inventory/splunkforwarder_defaults_windows.yml b/inventory/splunkforwarder_defaults_windows.yml index a87341a8..4301c883 100644 --- a/inventory/splunkforwarder_defaults_windows.yml +++ b/inventory/splunkforwarder_defaults_windows.yml @@ -75,6 +75,7 @@ splunk: label: "shc_label" replication_factor: 3 replication_port: 9887 + deployer_push_mode: idxc: enable: False secret: diff --git a/roles/splunk_common/tasks/copy_installed_apps.yml b/roles/splunk_common/tasks/copy_installed_apps.yml index 3c1e6e96..8f1de907 100644 --- a/roles/splunk_common/tasks/copy_installed_apps.yml +++ b/roles/splunk_common/tasks/copy_installed_apps.yml @@ -1,9 +1,9 @@ --- # TODO: Might be better to use synchronize here, but we'll need rsync installed -# ESS requires installation on the local node before distributing the bundle out, which contains local +# Copy everything over except local/app.conf because some apps are disabled after installation - name: "Copy installed apps to {{ dest }}" shell: - cmd: "set -o pipefail && tar -c {% if item not in ess_apps %}--exclude=local{% endif %} {{ item }} | tar -x -C {{ dest }}" + cmd: "set -o pipefail && tar -c --exclude=local/app.conf {{ item }} | tar -x -C {{ dest }}" chdir: "{{ splunk.app_paths.default }}" executable: /bin/bash become: yes diff --git a/roles/splunk_common/tasks/install_apps.yml b/roles/splunk_common/tasks/install_apps.yml index 7973781c..e0fd3622 100644 --- a/roles/splunk_common/tasks/install_apps.yml +++ b/roles/splunk_common/tasks/install_apps.yml @@ -20,72 +20,70 @@ - splunkbase_token != None no_log: "{{ hide_password }}" -- name: Check app source - stat: - path: "{{ app_url }}" - register: app_source - -- name: Move generic app - command: "cp {{ app_url }} /tmp/app.spl" - when: app_source.stat.exists - -- name: Download generic app - get_url: - url: "{{ app_url }}" - dest: /tmp/app.spl - mode: 0777 - timeout: 120 - validate_certs: no - force: yes - when: - - "'splunkbase.splunk.com' not in app_url" - - app_url is match("^(https?|file)://.*") +- name: Install generic app + when: "'splunkbase.splunk.com' not in app_url" + block: + - name: Check local app + stat: + path: "{{ app_url }}" + register: app_local -# Some premium apps require installation via untar command, while others can be installed normally. -# We'll need to verify the contents of the package to see if it's a premium app + - name: Download remote app + get_url: + url: "{{ app_url }}" + dest: /tmp/ + mode: 0777 + timeout: 120 + validate_certs: no + force: yes + register: app_remote + when: + - app_url is match("^(https?|file)://.*") -- name: Check app contents - shell: "set -o pipefail && tar --exclude='*/*/*' --exclude='*.*' -tf /tmp/app.spl | awk -F'/' '{ print$1 }' | uniq" - args: - executable: /bin/bash - register: app_contents - when: "'splunkbase.splunk.com' not in app_url" + - name: Infer app filepath + set_fact: + app_filepath: "{% if 'http' in app_url %}{{ app_remote.dest }}{% else %}{{ app_local.stat.path }}{% endif %}" -- name: Install app via extraction - unarchive: - src: "{% if 'http' in app_url %}/tmp/app.spl{% else %}{{ app_url }}{% endif %}" - dest: "{{ splunk.app_paths.default }}" - remote_src: true - become: yes - become_user: "{{ splunk.user }}" - no_log: "{{ hide_password }}" - when: - - "'splunkbase.splunk.com' not in app_url" - - "'itsi' in app_contents.stdout_lines" - notify: - - Restart the splunkd service + # ITSI require installation via extraction - others can be installed normally. + # Verify the contents of the package and check for ITSI + - name: Check app contents + shell: "set -o pipefail && tar --exclude='*/*/*' --exclude='*.*' -tf {{ app_filepath }} | awk -F'/' '{ print$1 }' | uniq" + args: + executable: /bin/bash + register: app_contents + when: "'splunkbase.splunk.com' not in app_url" -- name: Install app via REST - uri: - url: "{{ cert_prefix }}://127.0.0.1:{{ splunk.svc_port }}/services/apps/local" - method: POST - user: "{{ splunk.admin_user }}" - password: "{{ splunk.password }}" - validate_certs: false - body: - name: "/tmp/app.spl" - update: "true" - filename: "true" - body_format: "form-urlencoded" - status_code: [ 200, 201 ] - timeout: 90 - when: - - "'splunkbase.splunk.com' not in app_url" - - "'itsi' not in app_contents.stdout_lines" - no_log: "{{ hide_password }}" + - name: Install app via extraction + unarchive: + src: "{{ app_filepath }}" + dest: "{{ splunk.app_paths.default }}" + remote_src: true + become: yes + become_user: "{{ splunk.user }}" + no_log: "{{ hide_password }}" + when: + - "'itsi' in app_contents.stdout_lines" + - app_remote is changed or app_local.stat.exists + notify: + - Restart the splunkd service -- name: Remove downloaded app - file: - dest: /tmp/app.spl - state: absent - ignore_errors: true + - name: Install app via REST + uri: + url: "{{ cert_prefix }}://127.0.0.1:{{ splunk.svc_port }}/services/apps/local" + method: POST + user: "{{ splunk.admin_user }}" + password: "{{ splunk.password }}" + validate_certs: false + body: + name: "{{ app_filepath }}" + update: "true" + filename: "true" + body_format: "form-urlencoded" + status_code: [ 200, 201 ] + timeout: 90 + register: post_apps_local + changed_when: post_apps_local.status == 201 + when: + - "'itsi' not in app_contents.stdout_lines" + - app_remote is changed or app_local.stat.exists + no_log: "{{ hide_password }}" diff --git a/roles/splunk_common/tasks/set_general_symmkey_password.yml b/roles/splunk_common/tasks/set_general_symmkey_password.yml index 3ee2c63a..65a38a6b 100644 --- a/roles/splunk_common/tasks/set_general_symmkey_password.yml +++ b/roles/splunk_common/tasks/set_general_symmkey_password.yml @@ -4,5 +4,7 @@ section: "general" option: "pass4SymmKey" value: "{{ splunk.pass4SymmKey }}" + owner: "{{ splunk.user }}" + group: "{{ splunk.group }}" notify: - - Restart the splunkd service \ No newline at end of file + - Restart the splunkd service diff --git a/roles/splunk_deployer/tasks/main.yml b/roles/splunk_deployer/tasks/main.yml index c81f4d0f..b6b63adb 100644 --- a/roles/splunk_deployer/tasks/main.yml +++ b/roles/splunk_deployer/tasks/main.yml @@ -18,6 +18,22 @@ notify: - Restart the splunkd service +# https://docs.splunk.com/Documentation/Splunk/latest/DistSearch/PropagateSHCconfigurationchanges#Set_the_deployer_push_mode +- name: Set deployer push mode + uri: + url: "{{ cert_prefix }}://127.0.0.1:{{ splunk.svc_port }}/servicesNS/nobody/system/configs/conf-app/shclustering" + method: POST + user: "{{ splunk.admin_user }}" + password: "{{ splunk.password }}" + validate_certs: false + body: + deployer_push_mode: "{{ splunk.shc.deployer_push_mode }}" + body_format: "form-urlencoded" + status_code: 200 + timeout: 10 + when: "'deployer_push_mode' in splunk.shc and splunk.shc.deployer_push_mode" + no_log: "{{ hide_password }}" + - name: Flush restart handlers meta: flush_handlers From 47a664b3b7740978b938e5de50b578f9f8762c0e Mon Sep 17 00:00:00 2001 From: Nelson Wang Date: Wed, 10 Jun 2020 12:22:35 -0700 Subject: [PATCH 17/18] =?UTF-8?q?Adding=20auxiliary=5Fcluster=5Fmasters=20?= =?UTF-8?q?to=20enable=20search=20heads=20peering=20suppl=E2=80=A6=20(#485?= =?UTF-8?q?)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Adding auxiliary_cluster_masters to enable search heads peering supplemental indexer clusters * Fixing errors with search-head state upon initialization * Adding documentation --- docs/ADVANCED.md | 7 ++++ docs/advanced/MULTICLUSTERSEARCH.md | 33 +++++++++++++++++++ docs/advanced/default.yml.spec.md | 10 ++++++ inventory/splunk_defaults_linux.yml | 2 +- inventory/splunk_defaults_windows.yml | 1 + inventory/splunkforwarder_defaults_linux.yml | 11 +++++-- .../splunkforwarder_defaults_windows.yml | 13 +++++--- .../tasks/peer_aux_cluster_masters.yml | 20 +++++++++++ .../tasks/peer_cluster_master.yml | 14 +++++--- .../splunk_heavy_forwarder/molecule/hosts.yml | 1 + .../molecule/default/molecule.yml | 1 + roles/splunk_standalone/molecule/hosts.yml | 1 + .../molecule/hosts.yml | 1 + 13 files changed, 103 insertions(+), 12 deletions(-) create mode 100644 docs/advanced/MULTICLUSTERSEARCH.md create mode 100644 roles/splunk_common/tasks/peer_aux_cluster_masters.yml diff --git a/docs/ADVANCED.md b/docs/ADVANCED.md index 7268d621..346587e1 100644 --- a/docs/ADVANCED.md +++ b/docs/ADVANCED.md @@ -10,6 +10,7 @@ * [Apps](#apps) * [SmartStore](#smartstore) * [Custom splunk-launch.conf](#custom-splunk-launchconf) +* [Multi-cluster Search](#multi-cluster-search) --- @@ -246,3 +247,9 @@ splunk: OPTIMISTIC_ABOUT_FILE_LOCKING: 1 ... ``` + +--- + +## Multi-cluster Search + +See the [documentation on how multi-cluster search](advanced/MULTICLUSTERSEARCH.md) can be configured. diff --git a/docs/advanced/MULTICLUSTERSEARCH.md b/docs/advanced/MULTICLUSTERSEARCH.md new file mode 100644 index 00000000..1346aaf9 --- /dev/null +++ b/docs/advanced/MULTICLUSTERSEARCH.md @@ -0,0 +1,33 @@ +## Multi-cluster Search + +When configuring a search head, it's possible that enable multi-cluster search. This enables the ability to search for data across a series of indexer clusters, whether they be located in different datacenters or different geographical regions. + +For more information, see [Splunk docs on multi-cluster search](https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configuremulti-clustersearch). + +The Ansible playbooks provided in this repository offer this feature through the `auxiliary_cluster_masters` option in the `default.yml` variables. To enable this, modify this section of the `default.yml` to include a list of cluster masters responsible for brokering the indexer clusters: +``` +splunk: + ... + cluster_master_url: master-primary.regionA.corp.net + auxiliary_cluster_masters: + - url: https://master-secondary.regionA.corp.net:8089 + pass4SymmKey: secretidxckey + - url: https://master-tertiary.regionB.corp.net:8089 + pass4SymmKey: newsecretidxckey + ... +``` + +Note that in the above, the search head being created must also set `cluster_master_url`. It is only possible to peer multiple indexer clusters when the search head has a primary indexer cluster to send its own internal logs and data to. + +Each additional cluster master must also be given their own `pass4SymmKey` to enable authorization for this Splunk search head to connect and search over the various other clusters. + +To confirm that the multi-cluster search works after Ansible has been completed, visit SplunkWeb on this search head and run the following query: +``` +search index=_internal +``` + +If successful, you should see: +* The data from `host=master-primary.regionA.corp.net`, plus any downstream indexers that connect to this cluster +* The data from `host=master-secondary.regionA.corp.net`, plus any downstream indexers that connect to this cluster +* The data from `host=master-tertiary.regionB.corp.net`, plus any downstream indexers that connect to this cluster +* The data from the node just provisioned, which should be forwarded to `master-primary.regionA.corp.net` diff --git a/docs/advanced/default.yml.spec.md b/docs/advanced/default.yml.spec.md index 1f21b20b..505644c7 100644 --- a/docs/advanced/default.yml.spec.md +++ b/docs/advanced/default.yml.spec.md @@ -158,6 +158,16 @@ splunk: cluster_master_url: * Hostname of Splunk Enterprise cluster master instance. May be overridden using SPLUNK_CLUSTER_MASTER_URL environment variable. * Default: null + + auxiliary_cluster_masters: + * Array of other cluster masters to support multi-cluster distributed search. The node must be a search head configured to peer an initial cluster master before the masters listed here are added. For more information, see https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configuremulti-clustersearch. + * Default: [] + * Example: + * auxiliary_cluster_masters: + * - url: https://master.us-west.corp.net:8089 + * pass4SymmKey: thisisasecret + * - url: https://master.us-east.corp.net:8089 + * pass4SymmKey: thisisanothersecret deployer_url: null * Hostname of Splunk Enterprise deployer instance. May be overridden using SPLUNK_DEPLOYER_URL environment variable. diff --git a/inventory/splunk_defaults_linux.yml b/inventory/splunk_defaults_linux.yml index 4c873ff8..d164b101 100644 --- a/inventory/splunk_defaults_linux.yml +++ b/inventory/splunk_defaults_linux.yml @@ -97,10 +97,10 @@ splunk: multisite_search_factor_total: 2 license_master_url: cluster_master_url: + auxiliary_cluster_masters: [] search_head_captain_url: deployer_url: connection_timeout: 0 - enable_service: False service_name: smartstore: diff --git a/inventory/splunk_defaults_windows.yml b/inventory/splunk_defaults_windows.yml index 324edd08..bc73f3e1 100644 --- a/inventory/splunk_defaults_windows.yml +++ b/inventory/splunk_defaults_windows.yml @@ -89,6 +89,7 @@ splunk: multisite_search_factor_total: 2 license_master_url: cluster_master_url: + auxiliary_cluster_masters: [] search_head_captain_url: deployer_url: connection_timeout: 180 diff --git a/inventory/splunkforwarder_defaults_linux.yml b/inventory/splunkforwarder_defaults_linux.yml index 2c2ea758..b052cf30 100644 --- a/inventory/splunkforwarder_defaults_linux.yml +++ b/inventory/splunkforwarder_defaults_linux.yml @@ -69,7 +69,6 @@ splunk: cert: password: shc: - enable: False secret: pass4SymmKey: label: "shc_label" @@ -77,7 +76,6 @@ splunk: replication_port: 9887 deployer_push_mode: idxc: - enable: False secret: pass4SymmKey: discoveryPass4SymmKey: @@ -85,6 +83,15 @@ splunk: search_factor: 3 replication_factor: 3 replication_port: 9887 + multisite_replication_factor_origin: 2 + multisite_replication_factor_total: 3 + multisite_search_factor_origin: 1 + multisite_search_factor_total: 2 + license_master_url: + cluster_master_url: + auxiliary_cluster_masters: [] + search_head_captain_url: + deployer_url: connection_timeout: 0 enable_service: False service_name: diff --git a/inventory/splunkforwarder_defaults_windows.yml b/inventory/splunkforwarder_defaults_windows.yml index 4301c883..35fb137e 100644 --- a/inventory/splunkforwarder_defaults_windows.yml +++ b/inventory/splunkforwarder_defaults_windows.yml @@ -69,7 +69,6 @@ splunk: cert: password: shc: - enable: False secret: pass4SymmKey: label: "shc_label" @@ -77,7 +76,6 @@ splunk: replication_port: 9887 deployer_push_mode: idxc: - enable: False secret: pass4SymmKey: discoveryPass4SymmKey: @@ -85,10 +83,15 @@ splunk: search_factor: 3 replication_factor: 3 replication_port: 9887 - multisite_replication_factor_origin: 3 + multisite_replication_factor_origin: 2 multisite_replication_factor_total: 3 - multisite_search_factor_origin: 3 - multisite_search_factor_total: 3 + multisite_search_factor_origin: 1 + multisite_search_factor_total: 2 + license_master_url: + cluster_master_url: + auxiliary_cluster_masters: [] + search_head_captain_url: + deployer_url: connection_timeout: 180 enable_service: False service_name: diff --git a/roles/splunk_common/tasks/peer_aux_cluster_masters.yml b/roles/splunk_common/tasks/peer_aux_cluster_masters.yml new file mode 100644 index 00000000..8ef9472e --- /dev/null +++ b/roles/splunk_common/tasks/peer_aux_cluster_masters.yml @@ -0,0 +1,20 @@ +--- +# Restarts may be required for the node to register as a search head. +# This is a pre-requisite for using the 'add cluster-master' command +- name: Flush restart handlers + meta: flush_handlers + +# https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configuremulti-clustersearch +# TODO: Should we support 'remove cluster-master'? +- name: Peer auxiliary cluster masters + command: "{{ splunk.exec }} add cluster-master {{ item.url }} -secret '{{ item.pass4SymmKey }}' -auth '{{ splunk.admin_user }}:{{ splunk.password }}'" + become: yes + become_user: "{{ splunk.user }}" + register: peer_aux_cluster_master + until: peer_aux_cluster_master.rc == 0 or "already exists" in peer_aux_cluster_master.stderr + changed_when: peer_aux_cluster_master.rc == 0 + failed_when: peer_aux_cluster_master.rc != 0 and "already exists" not in peer_aux_cluster_master.stderr + with_items: "{{ splunk.auxiliary_cluster_masters }}" + notify: + - Restart the splunkd service + no_log: "{{ hide_password }}" diff --git a/roles/splunk_common/tasks/peer_cluster_master.yml b/roles/splunk_common/tasks/peer_cluster_master.yml index c223249a..8e2b70ba 100644 --- a/roles/splunk_common/tasks/peer_cluster_master.yml +++ b/roles/splunk_common/tasks/peer_cluster_master.yml @@ -4,16 +4,22 @@ splunk_instance_address: "{{ splunk.cluster_master_url }}" # http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/SHCandindexercluster#Integrate_with_a_single-site_indexer_cluster -- name: Set cluster master as a search peer +- name: Peer cluster master command: "{{ splunk.exec }} edit cluster-config -mode searchhead -master_uri {{ cert_prefix }}://{{ splunk.cluster_master_url }}:{{ splunk.svc_port }} -replication_port {{ splunk.idxc.replication_port }} -secret '{{ splunk.idxc.pass4SymmKey }}' -auth '{{ splunk.admin_user }}:{{ splunk.password }}'" become: yes become_user: "{{ splunk.user }}" - register: set_cluster_master_as_peer - until: set_cluster_master_as_peer.rc == 0 - changed_when: set_cluster_master_as_peer.rc == 0 + register: peer_cluster_master + until: peer_cluster_master.rc == 0 or "Cannot edit this searchhead" in peer_cluster_master.stderr + changed_when: peer_cluster_master.rc == 0 + failed_when: peer_cluster_master.rc != 0 and "Cannot edit this searchhead" not in peer_cluster_master.stderr retries: "{{ retry_num }}" delay: "{{ retry_delay }}" ignore_errors: yes notify: - Restart the splunkd service no_log: "{{ hide_password }}" + +- include_tasks: peer_aux_cluster_masters.yml + when: + - "'auxiliary_cluster_masters' in splunk" + - splunk.auxiliary_cluster_masters and splunk.auxiliary_cluster_masters | length > 0 diff --git a/roles/splunk_heavy_forwarder/molecule/hosts.yml b/roles/splunk_heavy_forwarder/molecule/hosts.yml index 8e2883db..8cb329eb 100644 --- a/roles/splunk_heavy_forwarder/molecule/hosts.yml +++ b/roles/splunk_heavy_forwarder/molecule/hosts.yml @@ -31,6 +31,7 @@ all: asan: false build_url_bearer_token: null cluster_master_url: null + auxiliary_cluster_masters: [] deployer_url: null dfs: dfc_num_slots: 4 diff --git a/roles/splunk_indexer/molecule/default/molecule.yml b/roles/splunk_indexer/molecule/default/molecule.yml index aa761e0f..02df0c34 100644 --- a/roles/splunk_indexer/molecule/default/molecule.yml +++ b/roles/splunk_indexer/molecule/default/molecule.yml @@ -50,6 +50,7 @@ provisioner: asan: false build_url_bearer_token: null cluster_master_url: null + auxiliary_cluster_masters: [] deployer_url: null dfs: dfc_num_slots: 4 diff --git a/roles/splunk_standalone/molecule/hosts.yml b/roles/splunk_standalone/molecule/hosts.yml index 8e2883db..8cb329eb 100644 --- a/roles/splunk_standalone/molecule/hosts.yml +++ b/roles/splunk_standalone/molecule/hosts.yml @@ -31,6 +31,7 @@ all: asan: false build_url_bearer_token: null cluster_master_url: null + auxiliary_cluster_masters: [] deployer_url: null dfs: dfc_num_slots: 4 diff --git a/roles/splunk_universal_forwarder/molecule/hosts.yml b/roles/splunk_universal_forwarder/molecule/hosts.yml index 7d54aaf9..34a5305e 100644 --- a/roles/splunk_universal_forwarder/molecule/hosts.yml +++ b/roles/splunk_universal_forwarder/molecule/hosts.yml @@ -31,6 +31,7 @@ all: asan: false build_url_bearer_token: null cluster_master_url: null + auxiliary_cluster_masters: [] deployer_url: null dfs: dfc_num_slots: 4 From 8f6a054c35cf7828d63af6cabfd65ea4ad257fb0 Mon Sep 17 00:00:00 2001 From: Alisha Mayor Date: Wed, 10 Jun 2020 15:18:27 -0700 Subject: [PATCH 18/18] Updating changelog for 8.0.4.1 and 7.3.6 releases (#493) --- CODEOWNERS | 3 +++ docs/CHANGELOG.md | 37 +++++++++++++++++++++++++++++++++---- 2 files changed, 36 insertions(+), 4 deletions(-) diff --git a/CODEOWNERS b/CODEOWNERS index 63e8ffde..590854fb 100644 --- a/CODEOWNERS +++ b/CODEOWNERS @@ -11,3 +11,6 @@ # Docs-only pull requests: /docs/ @alishamayor @nwang92 @bb03 + +# Release changelog +docs/CHANGELOG.md @nwang92 @alishamayor @arctan5x @lephino @jrigassio-splunk @jmeixensperger @hendolim @jonathan-vega-splunk @bb03 diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index 756df16b..219c078c 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -2,12 +2,14 @@ ## Navigation +* [8.0.4.1](#8041) * [8.0.4](#804) * [8.0.3](#803) * [8.0.2.1](#8021) * [8.0.2](#802) * [8.0.1](#801) * [8.0.0](#800) +* [7.3.6](#736) * [7.3.5](#735) * [7.3.4.2](#7342) * [7.3.4](#734) @@ -31,11 +33,28 @@ --- +## 8.0.4.1 + +#### What's New? +* Support for setting the [deployer push mode](https://docs.splunk.com/Documentation/Splunk/latest/DistSearch/PropagateSHCconfigurationchanges#Choose_a_deployer_push_mode) to control how apps are bundled and distributed to cluster members: + * `shc.deployer_push_mode` in `default.yml` +* Added the config variable `auxiliary_cluster_masters` to support enabling a search head to search across multiple indexer clusters. See [Multi-Cluster Search](advanced/MULTICLUSTERSEARCH.md) for details on configuration. +* Documentation on executing `splunk-ansible` remotely, through a controller node such as Ansible Tower/AWX + + +#### Changes +* Apps copied from `etc/apps` now include the `local` directory, ignoring `local/app.conf` +* Set custom Splunkd connection timeout using either: + * `splunk.connection_timeout` in `default.yml` + * `SPLUNK_CONNECTION_TIMEOUT` environment variable + +--- + ## 8.0.4 #### What's New? * Support for custom SSL certificates for the Splunkd management endpoint -* Support for custom ports for [Splunk Application Server](https://docs.splunk.com/Documentation/ITSI/latest/IModules/AboutApplicationServerModule) and [App KV Store](https://docs.splunk.com/Documentation/Splunk/8.0.0/Admin/AboutKVstore) using: +* Support for custom ports for [Splunk Application Server](https://docs.splunk.com/Documentation/ITSI/latest/IModules/AboutApplicationServerModule) and [App KV Store](https://docs.splunk.com/Documentation/Splunk/8.0.0/Admin/AboutKVstore) using either: * `splunk.appserver.port`, `splunk.kvstore.port` in `default.yml` * `SPLUNK_APPSERVER_PORT`, `SPLUNK_KVSTORE_PORT` environment variables * Java installation through `default.yml` with `java_download_url`, `java_update_version`, and `java_version` @@ -43,7 +62,7 @@ #### Changes -* Set pass4SymmKey for indexer discovery separately from pass4SymmKey for indexer clustering with: +* Set pass4SymmKey for indexer discovery separately from pass4SymmKey for indexer clustering with either: * `splunk.idxc.discoveryPass4SymmKey` in `default.yml` * `SPLUNK_IDXC_DISCOVERYPASS4SYMMKEY` environment variable * `outputs.conf` is configured without REST calls to ensure forwarding is enabled before Splunk starts @@ -75,7 +94,7 @@ * Added support for auto-detecting the `service_name` for SplunkForwarder and allowing manual configuration with `splunk.service_name` #### Changes -* All HEC related variables were revised to follow a nested dict format in `default.yml`, i.e. `splunk.hec_enableSSL` is now `splunk.hec.ssl`. See the [Provision HEC](https://github.com/splunk/splunk-ansible/blob/develop/docs/EXAMPLES.md#provision-hec) example in the docs. +* All HEC related variables were revised to follow a nested dict format in `default.yml`, i.e. `splunk.hec_enableSSL` is now `splunk.hec.ssl`. See the [Provision HEC](EXAMPLES.md#provision-hec) example in the docs. * Fixed HEC-related API calls to be idempotent. This supports changing anything in `splunk.hec.*` and having the change be reflected upon next container restart. --- @@ -131,6 +150,16 @@ --- +## 7.3.6 + +#### What's New? +Syncing with latest codebase - currently up to sync with 8.0.4.1. + +#### Changes +* See [8.0.4.1](#8041) changes. + +--- + ## 7.3.5 #### What's New? @@ -170,7 +199,7 @@ Syncing with latest codebase - currently up to sync with 8.0.2.1. #### Changes * Removing unnecessary apps in distributed ITSI installations -* Partioning apps in `serverclass.conf` when using the deployment server +* Partitioning apps in `serverclass.conf` when using the deployment server * Adding support for activating Splunk Free license on boot * Support for cluster labels via environment variables * Bugfixes around app installation (through `default.yml` and pathing)