From 7d897b040b6ab7055d8261638eb61763f83d3c42 Mon Sep 17 00:00:00 2001 From: Noah Talerman <47070608+noahtalerman@users.noreply.github.com> Date: Tue, 12 Nov 2024 12:49:53 -0500 Subject: [PATCH] Article: Fleet 4.59.0 release (#23401) --- articles/fleet-4.59.0.md | 108 ++++++++++++++++++ .../articles/fleet-4.59.0-1600x900@2x.png | Bin 0 -> 53752 bytes 2 files changed, 108 insertions(+) create mode 100644 articles/fleet-4.59.0.md create mode 100644 website/assets/images/articles/fleet-4.59.0-1600x900@2x.png diff --git a/articles/fleet-4.59.0.md b/articles/fleet-4.59.0.md new file mode 100644 index 0000000000..85170916dd --- /dev/null +++ b/articles/fleet-4.59.0.md @@ -0,0 +1,108 @@ +# Fleet 4.59.0 | Install apps during new Mac boot, connect end users to Wi-Fi, custom URL for Apple MDM + +![Fleet 4.59.0](../website/assets/images/articles/fleet-4.59.0-1600x900@2x.png) + +Fleet 4.59.0 is live. Check out the full [changelog](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.59.0) or continue reading to get the highlights. +For upgrade instructions, see our [upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in the Fleet docs. + +## Highlights +- Install apps and run scripts during new Mac boot +- Automatically connect end users to Wi-Fi +- Custom URL for Apple MDM + +### Install apps during new Mac boot + +Using Fleet, you can now block a user’s screen while software installs or scripts run during macOS Setup Assistant. This prevents users from accessing the desktop before required configurations are enforced, improving security and guaranteeing that all workstations meet organizational standards before use. Learn more in the guide [here](https://fleetdm.com/guides/macos-setup-experience). + +### Automatically connect end users to Wi-Fi + +With Fleet, you can now install a SCEP certificate from NDES on all macOS hosts as part of the Wi-Fi/Ethernet configuration profile. This ensures seamless and secure network access for end users. Learn more in the guide [here](https://fleetdm.com/guides/ndes-scep-proxy). + +### Custom URL for Apple MDM + +Fleet now provides the ability to set an alternative MDM URL to help organizations differentiate MDM traffic from other Fleet traffic, allowing the application of network rules specific to MDM communications. Learn more in the guide [here](https://fleetdm.com/guides/alternate-apple-mdm-url). + +### + +## Changes + +### Endpoint operations +- Updated OpenTelemetry libraries to latest versions. This includes the following changes when OpenTelemetry is enabled: + - MySQL spans outside of HTTPS transactions are now logged. + - Renamed MySQL spans to include the query, for easier tracking/debugging. +- Added capability for fleetd to report vital errors to Fleet server, such as when Fleet Desktop is unable to start. + +### Device management (MDM) +- Added UI for adding a setup experience script. +- Added UI for the install software setup experience. +- Added software experience software title selection API. +- Added database migrations to support Setup Experience. +- Added support to `fleetctl gitops` to specify a setup experience script to run and software to install, for a team or no team. +- Added an Orbit endpoint (`POST /orbit/setup_experience/status`) for checking the status of a macOS host's setup experience steps. +- Added service to track install status. +- Added ability to connect a SCEP NDES proxy. +- Added SCEP proxy for Windows NDES (Network Device Enrollment Service) AD CS server, which allows devices to request certificates. +- Added error message on the My Device page when MDM is off for the host. +- Added a config field to the UI for custom MDM URLs. +- Added integration to queue setup experience software installation on automatic enrollment. +- Added a validation to prevent removing a software package or a VPP app from a team if that software is selected to be installed during the setup experience. +- Updated user permissions to allow gitops users to run MDM commands. +- Updated to remove a pending MDM device if it was deleted from current ABM. +- Updated to ensure details for a software installation run are available and accurate even after the corresponding installer has been edited or deleted. + - **NOTE:** The database migration included with this update backfills installer data into installation details based on the currently uploaded installer. If you want to backfill data from activities (which will be more comprehensive and accurate than the migration default, but may take awhile as the entire activities table will be scanned), run this database query _after_ running database migrations: +```sql +UPDATE host_software_installs i +JOIN activities a ON a.activity_type = 'installed_software' + AND i.execution_id = a.details->>"$.install_uuid" +SET i.software_title_name = COALESCE(a.details->>"$.software_title", i.software_title_name), + i.installer_filename = COALESCE(a.details->>"$.software_package", i.installer_filename), + i.updated_at = i.updated_at +``` + - The above query is optional, and is unnecessary if no software installers have been edited. + +### Vulnerability management +- Added filtering Software OS view to show only OSes from a particular platform (Windows, macOS, Linux, etc.) +- Fixed issue where the vulnerabilities cron failed to complete due to a large temporary table creation when calculating host issue counts. +- Fixed Debian python package false positive vulnerabilities by removing duplicate entries for Debian python packages installed by dpkg and renaming remaining pip installed packages to match OVAL definitions. + +### Bug fixes and improvements +- Fixed the ADE enrollment release device processing for hosts running an old fleetd version. +- Fixed an issue with the BYOD enrollment page where it sometimes would show a 404 page. +- Fixed issue where macOS and Linux scripts failed to timeout on long running commands. +- Fixed bug in ABM renewal process that caused upload of new token to fail. +- Fixed blank install status when retrieving install details from the activity feed when the installer package has been updated or the software has since been removed from the host. +- Fixed the svg icon for Edge. +- Fixed frontend error when trying to view install details for an install with a blank status. +- Fixed loading state for the profile status aggregate UI. +- Fixed incorrect character set header on manual Mac enrollment config download. +- Fixed `fleetctl gitops` to support VPP apps, along with setting the VPP apps to install during the setup experience. +- Fixed bug where `PATCH /api/latest/fleet/config` was incorrectly clearing VPP token<->team associations. +- Fixed issue when trying to download the manual enrollment profile when device token is expired. We now show an error for this case. +- Fixed a bug where DDM declarations would remaing "pending" forever if they were deleted from Fleet before being sent to hosts. +- Fixed a bug where policy failures of a host were not being cleared in the host details page after configuring the host to not run any policies. +- Fixed iOS and iPadOS device release during the ADE enrollment flow. +- Ignored `--delete-other-teams` flag in `fleetctl gitops` command for non-Premium license users. +- Switched Nudge deadline time for OS upgrades on macOS pre-14 hosts from 04:00 UTC to 20:00 UTC. +- Added a more descriptive error message when install or uninstall details do not exist for an activity. +- Updated to allow FLEET_REDIS_ADDRESS to include a `redis://` prefix. Allowed formats are: `redis://host:port` or `host:port`. +- Documented that Microsoft enrollments have less fields filled in the `mdm_enrolled` activity due to how this MDM enrollment flow is implemented. +- Updated UI to make entire rows of the Disk encryption table clickable. +- Updated software install activities from policy automations to be authored by "Fleet", store policy ID and name on each activity. +- Updated tooltip for bootstrap package and VPP app statuses in UI. +- Added created_at/updated_at timestamps on user create endpoint. +- Updated UI notifications so that clicking in the horizontal dimension of a flash message, outside of the message itself, and always hide flash messages when changing routes. +- Filtered out VPP apps on non-MDM enrolled devices. +- Explicitly set line heights on "add profile" messages so they are consistent cross-browser. +- Deprecated the worker-based job to release macOS devices automatically after the setup experience, replace it with the fleetd-specific "/status" endpoint that is polled by the Setup Experience dialog controlled by Fleet during the setup flow. +- Improved UI feedback when user attempts and fails to reset password. + +## Ready to upgrade? + +Visit our [Upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in the Fleet docs for instructions on updating to Fleet 4.58.0. + + + + + + + diff --git a/website/assets/images/articles/fleet-4.59.0-1600x900@2x.png b/website/assets/images/articles/fleet-4.59.0-1600x900@2x.png new file mode 100644 index 0000000000000000000000000000000000000000..c821c53eaa9efca3094555e8bef565bd0d6a1702 GIT binary patch literal 53752 zcmeFaXIK;4_XawO0tyPKbP%i{h)C}cL_|fJ(xi%1snTmm00pE46i_;X0#c>-CLNR_ z(wj8ty%Un$nLzxV|NVNO`^|Ztb4Z!ld$0Dccdfm1&KqS#xihC3P6GgN=E42Dj{$%j z2>>Ldq{QGS*k{^8;Ga`3??1H%0GeyiKgS+CzPbv2c+CE>+#MjhooNnybHY?wK^g#Z zQDg@OCjp=<_`zLiRhMInL(<0pN&w&~SPj32yZfu8sn^gx0SyiP_j+pa_a*ou^g8mt zZ|hI7{`alzank?1g~bBL|MQlT4f&sUz`sY2wDC_(1h@F-68~J{A4(9S;UAbDY2u$t z{BwzaNs{0L|B~d9CjPm^KbHXhCCMWv_?ILJ(eTeD{<*}zBzfcm|B@sD7XG=!KbQEI zBni>*FG(J0;-5?We{hL}%JRS;8DBTVu{+x5#BytS8m|k7Qcf_(a=eNB9$9RlPR_6T z{2oV?9nbS;8EQT0V$sVqT$OVUsXe1NGnRr1#Nef~_isNgd?KK;n8)ECl}%jxQ?2fn z!Ts5(;8!kphU*o-GK;-gGP1kaDB~rpe1H9*!&Q=HZkB1UwIi3?ZDza;T5N&F`wfPXCWAFuvbN&G9?{(}ks%G7^_ z`Tvit2rVK2NR)Qij1O*K=!h4SE6{hmJ}BBQae+%hTdX5S^5+Gclq`_yl{?tDT)o_bKSY79{a<6rr~R>P8+(QWdWa+(-NL)@BDl% zE;Wb6ag*J-_3`p9`*YOLe%WM56{mSulU$**M>>tSB}<(DlHqwDRn1K?L?kp9hJE0UgdgD!d7Xn%D5PD*XRQQ!WHrLjA#bTd3-)$fEAeVH# zbw|r^{{E9y&y1DQl{{`w56Vl;uSZ7vnDw=adH08CWoa5NH@`#Qd%l1TBPi7D0@P_s zbl4Y+dviuVHn=yW0>#(B(7c?rrTeh?)5f3|-Tq>AfH5cW<&4XKD<&sCU@o_dHL2Rr zR=mtp&2n}wC^LX^Dl7pTC-8T9mq;PS{cJAV&kY5=aSd11)4OWH%88iFraM?7Ng@vr z2-UcVvwp-RN*8QtsATG4*d3gkDS)Ww2c1r7QPk)Rq5Mj#h-_bG#0i7zeY-F#!B~y$ zi5lFOdwR2KeW~zmZh}zLm&ssSuYyA7`W&mhO3f|qmEb%xi5&@j_qMpgg-NuN>=iec zr2rR)x_QlC!%W6s(>{xMV&*xYKh?H4SZvlNm_k_%QUq&d_QF_*RAd(W7}8+qr~iVd z#VwPR=!xBUy9#9lPXYJJn_%2NMeQk+o$qJ)OIhzFM`?N(m+H?hk0{@K&)?8*(Sw2o>`o>i#yPue z9TDMAsl1?Y4Pzckrn<1!l&Y>rZCvDGt9=kS$~j>w*JNmCa_ewZ07$eEkq$d|sU5O42PmoTQ%|5=WlwE?I%cGtrIezP7uZ<-Sjj`gQCFjk~O`Ar(?%Vm?OLj%{hkMSSP>@`oMGkL38W zTpb4~QKPqENeq{oq_DvD45hwj7Y|3fiFr;i#|L z6`dWj`?J&WukNYw>xtXa{}8-AI*;wc7KQl7;6@&CIeZDY96GC8%#&`p>U_~31P>MJ z;vL5(86VE1RzZr*`bf1Navj2Q8m~Z|-^WkOjRhkq;@+fl9)Ew?;fwd>15J1byo=QL zqKok0pjgu4z8Fo@``)aed&(Z|&;Pnw;v!Vz!5A7YHx6>ycd-X_8uz5OVO)pa@6`WZ z@epKac)J{5GUw%&w0Kdsnga@`B=(-=!@D5tPdJIW+z!`}+@PmHiw)rZ;qwIW83q15&O`K^`W&Ndkxt?As+wPT) zd-T)`EPa+`0t{W9L=67m=mJZ%iv_WZ%&0tB?EOto!CT zWgD#x=W<zI5y^egLfNwfVK* z9r{_3!CooTD>a%y`aCj=&OcM|Caq{}2QyrQ@WTvP6doYUWy8?S z3+OV}qO<1AQN~tW1Z6AJ;6=Jsmfb-wViYP6@-$E908C*)FDyD}wT4|}c082q#mWz71TXQ~ zD2Hr1f6EhRX-$q1(3|}{q~4bUg^qU%oJe7}t{Sp--vUY#gS@_j27YFMVWt6p5re;w z>y$|F#d}@3m8jp}1_!UiT^nihd2LJ%>vhm7DG3E>$^RAWcbe;Ey7dkuOASdLRzm)1TbG1v5 zntv1hP*eh8?eJ2T!Vi^}7WSpP_S<#SKZIY!B;JGoqsCas{qiorcZx(P6RFb=@+;}m zNA0I!M^6*v8kzf&^7~r~>QA{G$h<(oDx~~UxsW=|&6{72ZUxxM4%MZ=LWT4QjXJ-# z+*SW^{Fwn;Q^-BR<9=i@;#U7tEd@R*XfKD7#RyZ*eFqmz7UROF&uZ`T5U{)C&UT=ZUSpb8v$Y-^4; z-)Vd|8q*@PM{_HWy;nu?VjC@T(ba0 znMEjt6DvFGY3RQ*1mZm|rfx|5ZAIT^SPI=(f>6+2L;HK59kC*zmE-=M;|E3M+(%Nt zT3m*}B)X$#6Ls*pW90iI zS#n%((_7a`l4wH@1eWzrFzq@C#ry8ub0>JTPqMD8e_!n)%*W1XqXns2;2;)!0-bQH zsZw}-zOC>Y<>k@g?dP%Lpna$P%Lt=b1OdWBnIl9lUO(D4}kuIAPP@Ubop zSSErXkMVVU`t7eQyk?RbokSJkcx?Lj27>v#pKmf1^_pB%uhbuEGFI&!)ZHtCl7a>p zf`hUPK)xJ$C)YdI-C|NA=|UTuu{LhkxEwb_k=zx_#2DNsUxMXXd86z1+|KD1!w*C5 z6~fLjk{4fvyr{rV_RKGS%Gk7VQ4>OO#lQt-2}e5D4XladSDU2po! z5LX#$$*we6WU&2}8^2%l_=dOt`>GxWwPJS*iy%wRo&6?m_vy8j`j*_Tw7e@~dLexY zaE|neA+fWKqibK%@<5XocAPpIMEN9s6>(j0Kh_5IRoOyZaxhB8^~+g3`yOnl;6_M> z{O%s|(*Y&MGy0NLY8zWt?iOKpspCGx1?E)jI@`MJ|E-c#rR7a`f)PyM*ey(B8%{Z+ zd=7%?MhCFmmp^IL9NeCZD=LM^fr&=tn(V>a&z&kYw51xKh!`z5ljKF`P3NY(qWQZI zHrARL*%S#83sb}Atb#_p4D}O_>sfF+Qbi3>Q7LKZEi!e50-@=5SvS_?)}qqW&8eC_ z4suN^qAmE3go91uiOCnWYsbOj>6#waCX2^DscfyOVvqC_+PBusnsa6F!IgTJjr4O~ z{!&LzAvy4touj5|UR1ri;%j%06`f%HMx%O6Yi=5~!*MyZOIK_nz1Fd7aFoiJZ*Qk= z4Tn3Z7QB1Fle0(#;_BS453T1#n^ANPyq%20H27&VnFmFk5d zwh;^BEBOO+UtG3G#-w&ISV#W6ZqxS0j*y@}8UaC_9{Rv&d)!&vK)cUcD#AUHCWkPI z>eFt4451lM3lQUeixYd=-vTRC+NH|Ui!TCtP<@DDCP-6J=M`$jz*3<8hyL!vn@>m2 z4=@d^*)1Nlu|40OQe6$fZa1uT{toCD4_z@;&-CsI*TQ((FoSzt0PYlC*(ofDip@rIiK<2pridA+uccCS6Fp45olV}c8?_09GJ(ey{ zdih}2Y@Xix!gv!(kL3-UK2G*g`**_nV99vu6`}HqRYJz}`4Yyya6$fsQ~C`(oUJ{% zRNwQpNka}AY4u?b3!PGv+qXW0nikG8bg$U^8Tbu_dLg4^%0)aN{&H?I4(u|l?Pkm5 z!W}LXRLp>9@@b#47djeiY}#cza^iy9)l4Uzv)@65y^o$;Ei$oSc@N7y{j<_!HK~zx zqpN8RUOqvaV~rYk_oTL=d#tL2#%FjGVQeYxtT#A#jzuGP6YQXH=m~p>$J1Xd+$I3f zDhi)FrVF_w7~}d9g5zV_d%uMih1k!inI;!b9-w3z%9_5v@n0kQ!2{=?$Rd(m?J}C1 z_)^`E@yLF40u_ST|m{r6L0a`Xpwq;~85W}*7} zO=6dtn}2;lzIJfr3g#?}Y$%Jd_KzUK@Vs2=v2CDkYmXaqJ(frH4aJL=l7e6J+}XK! z2KYU>*Nr>4FaC8po;`!b8ZL-ks>X5S^;Of*%>bI{OeU#hKp{n|?52uj5=DC|sfaat zYM(B>;UYZO+AO$);A=FjP)Y)RzvYaSkmM=2E;t6a;M!!*4$L8FpCtq$764LyqDZ^9 zDJ#JP&7OVq9TIi8#Ze>sXzgf#rp7V={N*wrj6i)@^c+KC!e(IHGs zn{YTR>XRmVx0OXwQ;hJ7u$W06u!l@Ql0sKW z1>_+BprcF$7hj(ydCda7121JcJT(Q{7of!_h;QG|WSS*A{0>O0I((`^p31{x(n3GT zUCPno=sQ5X@yqQ5>i_D+8m|{* zzcc(6UFWd;Boj}8c;^c?y|8v7c7`>H}T7VL&4VW)EC{x=xa;b5oTrrIbPt%@@V z)FYAMP&(?3y$*N^4H6n3x_a<@8%PTU<(eSeoW=^FDFAzYFiV1x)#&?)zZLvfx-5S6 z%2Z>!$=tm(FaYaSS$!-&BYWlbioWoh(Be}oIp=SDO1jEFzWni83p_(W6m}_|B$^a{ z)4c2P&+Xx)PoGmYTyH#F*|^VmciHgdmzT=(x;#v!=CG>*s&GZUOt-7PiDurRrx^5p zOr3evB)*|t7fJaxN}?scvQH1aQJUQ&!MFH*)IDo!Of0v0W&enC_gpz#*s*+5MN}ZS zsL;`hk>=;{L6wF?=@;K7d^msjp_x4ycjfKt&Mbt=73O#f3EfkWOYUieS1vlD=;ZLgf;$4|21# za7&u`wpO?E$|&g1n<_HXK0!&|Hi>_!jN7Thr7pC}C7}E~_wU%2+hIa3(;ZiPx5VqJG`LfM=yhm(kuIM_<$ zNxA6$EY@|sX_;5}?GTBH5=T`BYxBg4^&4tTab-s(o$|>+LKG(EA5L)_ zTeG&-PG8Mvujsk(Ra??`M|d*eJ|!kbmU#R7RK0Xv zO|Bx8Z)p(D79Ji0_TH=o0!xH&>U2E;1C3RrPUdMO)`TsBlWPzwfa}j{C|V@Zr#(UM zyH_oeOX|s=v}Cx8lK9x4M{P8&t8~h{GqT`s0M1ZBUNflfE1CB?d7u_0@#Um6?}@jJ z?!B3fD7Pv5-2{Z>(<`J_Gnw&E|0fU;-g~TOnzOG=_}Jjy2~U@NQ4yrSA7#I;J=uuB zsAdk72-0;rb{<eAmHPpClto8*I;qd?&i%Cr+^{bAsRFTTwj}y%$@I76WOOLcG2@6IEMOcE zqB(H`uV^cS1Fy+RA{$Se++eAfIt4!DNRNXZoRqBLgVg;RoaBwFRWHLNbm%sFqWI*L zZNo;K+jp;H#s#ZBv;-E@88v8l90Z_QGkR>vb_M6;t2zYNpn~L#B~j^wJV<)b@d1i< zTOxiDWm|?eyqW6}I1inJJzb>++UoLaiH}TP;L?VCM-_6)mPUkMmY3RCY;IX`R<#dR zVOR7wO!cc)?$6CLu)MpjNarG{t>-E!(47)b*Qb-qiq{7KJk!9t{TE~Rd&KM^vHewC z412>;p0!N@l+DRXxT~VINv?AB2V=2xON%RLeHmYANo?WF@z&qot`a<@=(J}rVlnkh zE#2YmZ5#T*<{alUE(ICWoEmatf2`Kls-$1EF)B%r}LFoGFRn_;0Kdd&a~qc z3WRvL{Tm66#~w9?TiUbzHeOAm7Ev2XUZVPdSSs&Ea;tUeYTB%%(IXgVg@vAygEzUm z4yG$+Vzan{+q!f~{u^PKuVfJ3C93|3J?Om*Ja(jixmOc2#;Dc_Z=NmLkF86ZFFPyB zO7kN_kMqp55UA=868ZaQSc`}EKkqITR|tWFEg#7R=*dIa${q|sqdzE@m}x9?DwB}F z;0UecOG~Pd*%N$9!t9cp+vY-X%98m?IZnG*v?WKYe@B<>55@=(TF5o5_(=cRyb1!X zScbv4&&uvQI>hf?GYu9`^d(uM`)qrwu`(dIk`VK^mH*kgt7bJjazVl#$G=>TkR`0f z=TOTA?JYLJA~tRo4$ zx^DC1^>QH(ll-L8zHz|TNCPd9;9=H&smoE>6q|4N=M>47jUmxJt%y37jWM_@=<$C^ zk0jok+l|l^8>fmDsiN zuCoP*iU~|U+sUBt?CeuK?teDZ-e%-fej)WblnVfkrco8tzx_LouiZM3CUox`OEvGt zE1&)1++$b9!@u;H<4UG`xf|d+IRt$?8^ePQm%ULRm2Io-6Q5&X{LrQ*xM+oslw*aC zh3dxfIO^2g|KRB6I4G63W!M$$4DlG~`nrNQXru_{)!1phti@n<2=Yh#g3ju#-3n$8 z3Vp$*k$UWE9Sa;jM99Pa&WAcIkQtKAk9)bB(*P!3xuJAaPofxJV<@Q|FYny<*W=wd+UsDuWo_f}y zD16YD6l7wK>(3x>G=dQ`7!S5QNjm+%yfgVh5sY}Pq|8fxyzC2AQEr*rsLGaAxt)*6 zL=2zH(P?Sk)SMawt9H`iWtS&KE{=dwH-zcR-5q!&@u%k5O3FnmT&Hliq9o7Y2weVs z69~HC!1#;b7XqiwbM$u4RzhMmtAOTDJ_qORZjbnx0UvGk^u35f(UI8%dnVdGS^*zZ z&}eiD%)2ouDZ2dZm|yK9NtZ{kWCsmaAn*C~{L#PwgB%psW@WrZ+TlNT`yz5K8Rz+u znFYLfq7>v*>@hvx-&ua+=w@UiKE<+s1ihYOu+8>3FMso=>{DIK;668D%MjUk$kW)v zTAG-tm#iC#s|aueGdyH!;rE@L(IhZ8ccGI<19xgdN&$dtKS9$CKGh%V)dWNK=u05@ z8WcPHBSo}DBtApi--;3|Hzja5GP76U6!c4$KL-C+5B%|XJvj_{UK+j~&Q>hWY@9z{ z`rf;8p%7sfT4VzZln0IICsOF*NPbBdT79k0@EY^7iLLbTGVYknIF)J7r~0 ze^6?b_YCXNows=pBTlmrJ5(E=1=5pNvn3^c((T1dOYHpjHTqs1-3aubKXhb>x%O{= z+x}hH$^f)P21cMHSt@!l6gHp=ALvdJ9o_#->2P51)*_e9xr7rrksm+g5yO54$T^?L zDg5dAQM!zS5*YZeLmY;cNzc9wNlwvx7XrnrU8+aayzG|Xexp}%Ef9I{!!LnLgavKi z#Vaz(SZdd8)!dk(!Kk~TRqi#+X{*PtnBWXR&>=h<7gc`c>b2BiBzLiEdy;DoFJ(Mh zN{OSZK4Hk3`-e-IPpB>wrdyp}8DU)d-HR&~*^kE=hZ=mCN!}@?B}fR|i^gmD@c@u? z(x@g~u9|s?wT>m>X_bh7$+$(wN&cTxlOY5?jg-KtBuunBBtPaY3~77T(=n5i`tG;VugkE|;<{62;mZwxuizJp zJA^rd@!2)J7g6b~BEG+=l*C~^j)I77dYQq1eFT};O`QYPOw1hFv0tef79Rhv$JC3A zbk;tj)RRtqIuCM3wNqXo!&|`?2ixN6dMqpmCQ8KMv*c$%%Hw|RvI-UMRs0#tJWoj1zL8k<0Lg(&cBwD79q{4&l{Pe86EQ}R3{;BdxnAt(?U^7czD|Y%jhJ(mTUCbz0NfO>{o(M5L6kXv)QnGWPP0gN`3- zVeSd1fV5~P;RL7kHx01;Ulnni>q~8Q^H;b?`t940%`y}@DDb!dr|)RrRMtnQ!Mnub zdSh^h+(_PEVHT;m<>R*uUOlH{KW-GwS2h`P33Pni5x9v^@YM>A8AL`n4K9FK_K zuhe+WSK@ZhBoLzy%g;6^I5sY7V2YV^IvRb*eKR!+2U*2FE0Zbw;OKpV>wA*Qe{G8A zgHBWGrWBaC9p5dm$y_RpbQ6+%>Y)TTKXc3Ytpe}T%>+b7pF(B9B3_wG&wuf-#g_6x z2JQq?czxlFu3EHUD42273c_!??=IBFJF@VWk$U5KAw8I{+LE>=K~E0M`Pg&oL*IE8 zT>0y+_CM9=bpDB*q({1{2+=r#kls!81lswesw~Aal+A z)Xoj&sywL8S)yNIiDRRlSx!wSNr9zNN&;wPPCUt;sYKw@Zzu<7PLHATf&)s z7um~NLsv^w8%u{;aa*FerCe-q+Y#6tT^@(q0|jd{&Jxr@H{G*8OH44OedJlt;Q*Cth@sLwEuqNv0OgsupE1C_!rX=hs>n zSZ4G5JR#LT@=cyQh&M{m@nJ!ELqhefLFuAXvDnC+li|8&ZA>XAzB_*pAp4V`GH_|@ zBEiUf!m0X1?Z#Oq_PI;kM^ZR>yBnVABDXI?#6`6oEF&B8s=U-g zLEglDhc%VS*)A4jz0^Y>0qogw2T@J}>@yirZGu_1i60)6Nd5u@;>hRnd`fhT-63$@ z*ipm~e0BDN)AxmWtOR2`m|L-%v}>y!dj2`tBNq<=h>DBQ5=ZYn0X7W zD>0&W=yN{CT#>1p_r;n#-_35 z<0~{Y`eUUoFK(8to%LB@PAQ7FJHOvARi49^#fqO=`79oVBv2?AD`S?XZRkrAS zEY4lRwwFHtOgaj=p>NI8?6tLEQ&IQZt-)Ax9EDxgSrWN2bugkOyqKe=l$KQUWFCso>sXXd)5e$9kCf z`4b@51^}4PDbH~2i|?4Us>jP-d$U?4f(Ztk_uIsWr%KcL7L@fz&Jc!YvEXu98(23T z$xccQ*6(e&Kc9Q6L^FQ8b#5ZCJf)^Uk^FYVKD%z;$-H;a0Il$Tn zUZ)-R`O^lEM`OWdo=G?O{lW7m4?cAxiSZl>0O(T4J?K<(vMp~mKT|3y>trgt9Z}>z zKQ|w(%rwTBtv$PoH&%`3VR-=1`GOr^?q&V;2R`4KS&3LPs%*;*CA{s%MsqGDU5N$Z zhIG%Y4-X?qI6l3D+{I6evtB?$@0>%3__F+a58n2KzVrO*zF+blurWH$k`FrKmGul4 zgzw-3#1R^qxLrpw0cnRcuwb^W8#}{TUN>_K%aQyR1*M3(mFTlH3l01=aVG~eQ zWpxN#zvPJU)~#X9`^=i7$$cPwHfyYU>RtP5jIsri68rmLPePU`=*V5R@DvmP`U5Sp zbvmnc&ner3x;rk7PAghjr+LgpITedv7;+!aAOK)7CBvd3^7uA~U+?={dq%N6e4J@Y zf^%j{21>+W>nZzkjUHBP0P{-tmnQ+Ma%Z#Zs+vD;El-97Q0P~&i|S@4 z>nN3GKhr;ILDa-ELv42eV1BggbFcK7r;^7(+3T*BS5ju-VzE!PigVeFVt4ei+#fSH~&tJ!JERy^^B4K@W&jBaRBE9fq`#J0 zr@42>7bg0-6t?RV=2YiMX1M)*?$C&FiiZW+Ec-VWetBY;=%o{Ob&iNz2etm?TPYc_ zrufA;h#xH`+2c=22Ds2@awO<}Z0YmSoV4{%O~0R}d!eg)z5+o6-QKx&s9|JCSlxU! zt5W{R%aLynhp{W2cuEPAJBl0*E|Qg;(w{vO zFDl6uZyx-1Pm1gDzS(KMS0xE{gpP*9XC5&33_?&xo+U#M#qm&CDOm0Fo;O}wTcA-- zQahxo^GCp>+6yLK{!GQWf(6&84l(UVi8t+-A@Poe#M4=DgKHM-%Qn=AhAV)TX3~Sn zpi%_Q(l@uH%yv;jr>=DSHY?{QZ2wo=C&R9NKiS{qyO|Wj>sr8GM%UT>B1?Q54e7*s zB(b6%HI}z-K3r4qg$}3>s8yJ>n3>v0XHKc7-Bs20@+VwgV^O33*HB#M?st|Wh_k0uWF+ZnjJIwv^UCd0Q2F}rS&bQs! zRHBEiuLUHxE7h2%nY!gwnsOA=RyfgCNA;ZHzS1+98Oi9ro-m%JsT;k&So73oCi}R8 z_ExII4;R-8Ee;vN|EJ$4aHxxWtoOjKEd;yt+GXuc0*Nx*nDJaJ$fs?=U8+{)ZpFMdTCR@qOUy7wAC^j+p&*K)2`-Xi&BAv6CY+~D0X)TUj77tv0IZiDU|s1Q?IBNB5d5Q5#- zMmM)YE#!QlGgolVP2JJAo$bpO94M9SFMQ~}?#1p@=Y#0hjjby3k}d1Qgp_s}&s6Mq zhk3A8HbJNCP3sp%T~u`qP!g^qjHp}IeEg3$4vJXrKzpvc*#%j9tJwWjn*qF*Lop|el^F|$V1l2HnWlV3VBqrI2X=gP2 zCT6;5KWoTNPyFTN9dmb$rUl+8yM0H}WK)?~?M}a%%6>RXH zbvS?LHt(+ODogd2nga6=WilToj~4BT86kuW-@*scxC`&zA0+Us#qk{n%&J~9)6q4LZ(6oPI|s!jRx<`$y2hke zNs6UB_L83aSH7F-bfeet=yL6SBHR09zFr_=W(5R8M!YP_0uZ9ZhD4rCNZU4Fvk9KW zCIo6T9Q5mQk=oUd9i&cJ0Er@YojYK1>UscCz-uHu&OKjb7G^pumP%tg3=I4V5yQm} zvYX#A-4An8!!69Q<=iN3>vAzs>G-Ar6FhhWYIs;Ih_J*o|8A;%UvaI~{2L;gs>x$t zVh{!-KFBV$lXeIozcU5w_+g)`e1;}@A+x|zy8bruY?f(^Vrp7e>W;phLes0Dbw@pL z(o)-aJ^5tR(d`BDz1&GYDJXE{&8~&bk3)2zdm%P(<*@%t=7-sf>e^Z!3vqhq6=7R#|M*}N zB}H33ybg9tf*qf}CV6jRr;M(9&m915y`{FnyZClG0=%}E7PHgU&ty5@LCY<7XJl92 zfV%bmm(4bNK66g+3F)e}JX7N&QUh+(UG!rSmAI}Te(9`~ky{X>yF(EDNLdOu5)-jv z(17lzlrH?C-P^D|lMs}epsRaACf=>L+7!&>4EP=ad*zkvJtdy;IKCv^%H?3WCR zexg}TaD($kkzt6-=iH6C8TBTm1f5HiAYJ*Ia28~W$a5Au;HKEDAw`IxBqn}>1~3as zFGdX8ExaespqPl%UI~dWMQ9CRHsomIXn#0hSJcD~!VJG?K zvx9c5JKFtJ13OrSl+DM^Q=A5#;Z(uBqb{~(e{h#bgia@dk$L@~T|LA^LOo(giuYIO z%o}3=kMP-b*#@*yj}h5@>LG7rFFl`$2i3mt1{bc9&d9SnoGg%Ygh)BT))2+<&F&j3 zG}mFf?dPTU6`voEqZlqxg5q)%Bc@gzsY$-dJ>)u(XR@@P7TqS&-)98 zN#DH~&IQ5gSYKsa={s>u5G>?nbo5|>YaCp9=+`&KHi+Y&Fsx;&x2BL7T}s1nfD_^_cd?O>@Yce zne*_H4-1L@dhaYhNt}}hWSwIGITy)z2T1=^ADqoVXg-myGbXC<=^MSEW;;N7GGSC8 zhb=wD{LF3RQ1k|dEc*>db4M5%hs)^uo ze-A1HRIY)hxxVn?mC+LwwchS1iJsHvj-yS#e^}$efFXsCqE(sntx{5D;{jm($SJ-+ zKiHZT#(Q5|u*A}C(y8Pp#=A0PqyTxAxz)))Nn1aIEh_a0xK6Vn&jjm5EJNNLrqELOiX`w!7!J$=Ojl3?mg1Ahp?gxpUKOy^rPmk^MP=~MgkSGt1K`Mu10cCe;s8_e7lWD<*`R(8Gq#*@^$VEw)llop^P?|e&- zfnSMQ3znynuHpqYFAnzCW@vnBv(Hi}>l)rep~l3G4Il>t10MW=B;;jnL6Y0gz%6GZ zvS#U2j1~aosFxObD-BceYk(nGGF`+iTQ0W29DM4|4^gMWf$C&&A zBup*}+bBOFv|r3bPMo-(QXwgWz$wgvd%I~@@hUeyE4sA%yQdM?{@@r;p%vllz<2Nw zlPmyH;v$=4A`3wneKPtKQP7c8PSW3jwASgNMw(|#Myd=qYz#sP;d+~%x30|)198Sb z>u;?6>6XM7uBssrh;;Ivp8@xZ#&gcAv{iu-Y z$lL5R_H(+cy?y@0qvW&7dLpZ0rhnKbS7lCA0itSaPj4^0v;7{1T?T73@YEoFUKsg9 zx+W*1iYOGqBR-`{4o_Xi3!t{C@Y@TpOrVXB6SsVa;njLBe6iDE0c1>@mG1*7re8@4R#-oh;+O=^w!xzeDEqb$2kl$se zC`i~Q$S`#)W;eT)wYhNwYFk^ZT#w`^d~_`5l~iMpHSX&bkm-;@!Et!@Kt4#)tNkqcrgHS2pP1s( zMRf%|zl(1@9H#*0-(CvUm%icO^RTEX%>WCTLgicQ9K38+kNqwpXOI$MEo&1ps&n!8Kbi*_jhzJlJ`E|O0`jeAQOj?p< zsM(Bq}fh ztE#fBn2&$?W_rdU9l}N?&-(%llYm(qIRaF1YmypR2qrQg_02v%iSQcsyC|5cr_LxS zNx#HF^!Q!5pY!X%7i`72=)Cw=3oAyJ7#$^DU0+P%2!u6_peKQwX`~=~dou^RE4a`> z{7yR<0ixZC@#oZ5l^OM^tLNQ@Dx!=Z_q{S0!G(WWs!mY{H#)+flvnqu8Ngv|Eu4j9 z2%ys}N2(~5ln!*v@R3+$@H}-qPPjr!Z#a(dWVUO`K@*8`*U+Jdwd-yuGC1b)vo5CWVsTzGdk)I{?z;2=*!0ial<>Vjq843@p)Z5J$ zrzG8nVpVMSGrfT3ms1#fuy(j16cKM(^wpN?XH-q%Xg_(i0%i*EpugGsWl!XnB@#&BD(N~l@zky49xRE0z6z^gu zD~?&5hn(jqvU!2^pXa4eT}>C67NbJRfjCRMoiG*Zx)(2y;~zYRyBx=y2V2;PzdEa( zV!jiB*N*z1}V5!mI zu?=MHnVe(w(cZPB3(}>=tA}fonBT?gZ2JpFJBX8lbZ! zB~JVrvQ~lN9x%1#J7jSG4y&@BjpUM{w7oHrG@oDRjfCZ8e|c^T&s{@}0dLzDZxtS= zS21#}taXC8=^X9+<@H>9sf6S;Qxxbv@x&aUBRb$6G15gEFv@vl2x4*F3qho!K&(2- z+GpwZ)ukuOilDnS{kD2HecR>iXm=@iVt|*w#)z@m@8P=6y@ypryo)P3J9k)f1WYz} zcTuT2G@!+dd7(Xht!HQ=)ZGJxuOuA^XrmzRhg$zfN&3k7g(1OuIC-Ir1TTA`$x<26 zIt>+a{2FJIPz%V$liQgzSh{7AuZHgRzN7xZm12f1)c?&;-__gi4JZTy~Fi?Hwz+4jGOT;$@43jF zYHQmYqMNUjD)Wftd~SXUra>SBq%EqHsno<0!fPot8>@ zCmOVgnHXYAxZCvZcUN>;8PVxI(_2q(r`w?sqvgKEf6USDhBo!v(sj4dRXHIK9ly=jqIwI-xw7GKH#!da(4rJNWF}Hn>T*h z8WAF5(XX)IMZ5RG&~oR02n$SD*?XUjJeKHo zvnn4O+E~^6@_|IP6m$}{r)uc}pQ&uDs@&Jhbu7VWhdzzJg0)9woHTOQ0_7sOo%uqw zI33tJxaIc&9{-fxtH%}THloYwaY^wtKN_*{+vmnn(d1qpMF@S0Ydg6#p&H$gT;YeO z=Ir1J`t)(Pd~S0~tZjh$1!h%2*O3FonPzn(24;1(UQy-Ucz(5xv>d&e>eLvrBr}%7 zJai)^fx$7WG)79mLD&%Q?Z$1so=jY!{X(7~QfgS?Vuh++!Zm0taru_6u%WpGM}*&-2o? ztb)gp#{C{q+|v`JB=0#`{k`MV=tCjsyqfT*^&|G4s(Pa-l`Cssd7Lq9 zlGXkoX*i4K&&MQRuM?Ds;xSYmTAVQvX*2~fv-1w#^4}? z6tli>?-Ta^2aC)Z>{$M%J(*elF-Ap(GKon!)ZMns^kmnoGN<@V?`eM!ai7JE1QbP( z4~g^E+qPp4e1%SwH#erQ8NOaR1|WM6Pn})yq3jqr*qXf%BUQ~&1fJ5udxO!t>+y7x zDTi!Kv_YQNOGxniq zodNbM<-N~_2A?fGlM(@XFN*}P!|h9qR=#drS%Rtyif*4m`a~bA_t^#~(et&k6uc;^ zqlmi*4g(&QfLy!XUI=l;bFEGRti!Oob1Vo!kWcM_Q5IJ4vA7J8L!2mjR%%noJIrx= zSVfks_L-zRy1k5n)(jz2sPbuawD;sW^LYuD)DHj08L6K?Mf?yO*j{g@T)IM^_hqJH z?y4UPuS8=IJ+xE#1Ha)Ku1I`EkgFn}^r7kx?&6BobqlmB0J!(|6>}j!S}hMTfK^^& zums0-h1hdJvE-hye9o)r;c_F>12g|)FGbt7m%8k>h+)^2LLQ4{XV)kcs7iPxxJ5q_ z4JPIUV~H9cOOOAb_P#V6>i2znQ0QxH`I3D}MWUoowiyYnC_CAStVMQX6j91jwj#SC z`@S#LWY1dmW$fD+W8VhzzdzFN`TyQLFP@jrVcsOiF`wnWulrig>pU+_KG%!QHAIfQ z%bDFzHDI1SmT6pbCxwq9nJ1Wkvt1ppQ+(jjH-e{VlVf_)_AbHKJO-oY63z>|pCegm zGUFel)rgYSAgU1jy9opja^s=X^!taug<77;hu)<3EcZ`WL455R@0klV?G{B&DEU?Hr|>_=S@(1Bc8`rSo3 z4xJRM6X2wzQ)ip|KtLoxDd?zZxQFlkn4{@1!HakvegO=RFRk@-#Gb?6@79D%_}+`F zs3y@F^vviQ*46PQ1us<>qbXaud$O*FBz!mS@dMY~7&zz%!T!)q+qJyCS0qg_gQN

*9lG}v%?H$aVVtIr(}6!9?s zo*8D4BN;c8TA#9Kx0)B0B%Hs-uOI{f&0NCvWfmmHcBU(h0_lDihzcJSa<;~8WPb~o z($4N>qZg)8YAAieSmS-4ly~KFlIJp#sk!$_&XIrPQ0@(K`aBY=3&Q@ScvN{ApO4r4 z;IcdZ?#9G3(lGG)VJhjQ>Hx0DY1EdU9pym%7hyclmuy&rsGhD=ZE2oz?fZ-4pP87UtUceqU8LI)X~sq{D{)7-I7^Sz9pmTb8Qv=)PH7LOPGn6^nJ z@O?wRy6;eKHSjjHIqWIr1$ho|nC%cMFM@7t%oqU5l#(q5lqEvU7svN&=!86O4>uGn zD2$JRjKKQJVPr;Mc{4W}Y_W5}x-}VH52bvG?k6(+^m} z%2nRDodiZ1eGSTZ(>{Vwo7;PG?=%EIo`f%#hXn`sR4vV*{_!)fsE69?m5U9Z$2R^! zfi_`3Xp8vNL9(T%K*xggoE_*Kjt>B}@)7vMd3m`Q_Sw#6N{8ES#a7|e?8bFp7@@L@ zk(})jo8M*wHdrXwpt$7neM+QQ??s)*CrJZWr{4tD8rd#Xjnfk z?(;j@z*mCbZm>5QxXJ|GKP%c?96V@k%@+z4q-Mb%3hNOoW2%xT_(FifwtyNi&)sWR z0Pe<4lOW%ZddX>}Dp$|ew3(+&8T1yj96)=~%6kPQS?kAX>q;^Pdlba8-uxU_x`S}m z@Y+@nvZK%~wzVYT*ko*%ic6F`IDZXr+y$u;aX3@V-nNXK_i6AGvlr~p8QCvPrJ62y zZx%$=cnHIMmOUz6)uA4pl_ltH1P=$rkSl$E9PKEvsx>b2Q~W6ZWMUDH!sFr=!!Re&Tay|}pSn)x6PR5tA56XS;Y#u|fBun_5@8%bK=11t0iBTAG*{<4e6Q8K>M_SnGu-n4G4rE10`Y#(B=sggteo zzZ`leo{{$LvyiRnkU)9^3AauD4JL4R(fuk5RGYDr8CuHBACr#y9dAHtIyexGUb%oy z9M|We9{hwoW>@rnKACBngr73^D^OmEUK6{Vx7ix|WYUP?xr?-np1$R$4)B%Z`@JH#+8fkwN=lM2bQc!D$cuQN&^A0QG% ziztK}0ONV6K=?d^8|YrAWrsR>!bZA5qBM9B1P&e!(AcI--F zt6C$HrX?*Z=8g*sU*w>qCk z9}xyC^{L)dvi7X{05OmR$S<#;wsAriPKapkn){`7!I$=PfAx56Kp4ByyZ5B+^dB?*A=cO*Ij+^tEq+oc&tEwpQC)Rq! zz4B^+FSFd>M~1g>yJs(y(`ql^JR`3UWC*+zw`Vnpd8?(ms9XvM{%;NPf8YV`>s7cI zXngxXc+cE!-K>p5q$3joRq_*E)e9@2lhuAD%22|(-DHWgzovv-VZ~zgYyK3~aqdmM zAHG2WoS)aP>+Nu{@69W(6fvU2sq*t9H^fNRYn%C0BkbtR$!9 zoqZ07msud$7WX(OddFLZuDHoF|$w3mw|)(yseH}d)lEgsITsc zW#JEl-TJ5X>xl$Or-zp{;*?1}*o8M>?4u3eBR}{@2qvhbXf`Bb=Z=;BE{N|%uLI2j z5*M^jko7s^$mVMfQh##=MOiz>`5{XOtWz(TpmV+1oPl3~6~t2UnO%U+reC3AKTEYsD8FRd z6&MSlc2BIhL^z4tSGL$mcDg^-tNdu@9yRvn@!v{~V~G$evj6S$rnwYq{)3X?4@0yt zGRI3aeI%dWkhR_VoY3)WQU#VS$W*J1sW@mO=3Cae@Yp+D!eBo(7twSduob6zRWr1} z5IN_Jra7s-o2&j|b2g2=C#pD3X7Au)mmvSbPYcI@tRU{R^mzI?7nW(lx_tEM@``{R z=iT@ZEjH)AXv> ztar4$nxVLx8FaB@)4TB;&Oa+7yU(hN`+VJ#@?1zuA~P42d{E=mKI-1DPbuo*89*mL zfhKiO7e{0QM7nj%>!VyUTH09y9MD{EMaJz0hDKldg*OBQt8;uw0Jj`SxJxNrelLAg z5-KgYF!u=NKGkP@!G&4^7}4DWqGx#bvSybR?B)rhr-s7YKe))UAZzV7(>{dKD6CjP z=P1Mcf^*kLo$a`iWs}3pcKF|mon)cWGFWb%$N?nN^(@pW9`pke9<(oH+PI{*+uBkKmITJ?L*_kW znns-q&CS(5+s?UHjn^qX;?z=xUGM$hr>oP$3csBs&OdOee+Z(0l?<+*7U3=YtsR*y z*jnr2y0;Uj^K_iczv)Y53-jjB_s-j^dqw4!ja>&^Z3Ce!*fY|%m*9>aQ6L z?5|`7N4|NhMiZO4XNVV&PVSg{^x3UAMLrGw49=3-uz1H_`W8cGT58bs5nDp>zB(p) z!Ux(@m|z|;@_dL;Lq>un4Rv9s_PPAHPQV~!RdcRlroP$&2&cxXhF&)XT|_P0fNi(C z(Y?k#MvYV9&!+P9bj)8YzJB+3kcQ0(wp$Jk;hl9-aXnDY2k#OKYho{aB>vw4+6BAY z#ir9X^`db|`DkHNbdJ@cOK`^`KL{ z0NCBnyPM6HKEz~ubhSbB3c%!lX_Kv^*7$5vFGEFhVyQ`uIjh75G)CB9W#~qMqt5I1 zn7eJVf6+{>9htW#2H#y8yWO=#cP-v3yjk858qm3MCN8M8YiubvDBq)J9)H?K+UkN4jA+{Hs-^ zFJ~1tt#icy&z|t%AQ>qRrN99f`6(^hR=9L3@Tk0#xq`d|^L+Ej7GR0{%gz`+G&1O? zjJnPJS&#LbkGs?S?M<@{Lo`HR+-vzQAnl$(AvMw?>J|)bbPQljJm-l*A zevoP1n?!0U)_pBYcsPuhcSZ;M|ZDiwlmD{#%yah-aoDPx(i6?-# zQrm^em>S!N=KyV^x+K8P0f69RuZh5;L}t2%(Mj9$4Q5>n^)?V~Kawv+=*v+WNb1;B zL>X~2PO@b9>6&*=DhH4r71a{4BT$To)B_rjJc7e@xTui27-=ZJ3nEkP`;Oo4ia6R**0O7N(&@d3;WnsxPzSJOJLo zuvkkK63%ef*hxX8?|j&FukrGZbt-Dewm%c>@52M#PJf+(O^-H^i*`L1@lQ}zTEHs# z2Q0hZm0L)I0+F5U4=)sHC0=%=9PEJysI#y3jXZ9Nh`OFU;n8#^RL1ZcnP;(S*Ty*} z7|=U0#Fxzq;lhlzX2Y7t*Xpe)(%p@9!+{sVzgbxLM%B%;saN!zimgykUkxO53MH3h zmK*k7P>R9SBFEpiP1-s6R~u0Z_0JCK?~Wju8jQi@7qf}(pSiU^brs@`%5wS&;1{hS zac4CCj|;QnznW{P8ANxMK~ee}ZI1}&+ui7(lWbxQx$+fFNKH+uTpPa7-A8F7MG(JP z0i?!#MTHcww^fFY? zEjzicySI1y0*B@i`lbddfl~cnQ{lr^y=vUh@Gzh9K z2coUQ2u_`xW#+LLNOl3LH$d(ba5C-Uec(g(PRHBg%v_r7i~`fsUm%ySas-{L&9vbctwonW_AuHHcL?4|H(A+;A(w-@KZZSiX-3nmV}KoMAGs7Qz8PPiY2Zs)vYL~cUhH!UETbz(%un7C2TB_& ze>i34b{#&r@BH?5ab0v#mo?eVt>LTh_+icYtziXKLrRA|o=2Q5#VsW`SA{YZxCKT{nmza@ zgAL~bnYH;12%_ox>lIdBR77fd7|X^2akJ@2KWugJx86V5fT?a(%o*HPZ{Hp2l{{hW z9-)uCkFRXtrC4ib=!b#_5RaA5J}Z=Y2n2MF*Ey8?TePFJ3Qmvu<5;9xf2bDuw3~Wb z_oo$^7ADb}1E9|N1s~L3@)nN&Wm&cEtcq~v-4QEzg|?ep2rgZ$S}O{X$<3_dIJ;1a zn)#{{=fL)Z?d+PrT_GB74_v9@OOO*J^eIsRi+~|xzR+e)M_@8CC19v7WrtvCf*w2k zd|QC+o|T2uEfK5S879|%^(z`!LbV7LZzJo^_`>lnwtA<1@9@;vo7`5g0z#}n*sYBx z%JoSc2<@#AtXgD_hiJM`h!eMiO@Wgv;LnWTCChOGe1~fcYn$_UX|pbGKVBDyZ@s_J zXw1#zzzXV1IafngDqR)d zWF#-0q`0tgIrr^JqiN;6;_4OQjc=f-$TVi}fwzVf7~i=t4_+F8Bb9#thD7I0MR_W3;PANjmEVF&VJTnUaQ*Lm+i5ZrGol)bA4F+aA7B0)hY+P zf!_Y`4v^v92GS#KKf=G$ZG^Lw`E5Xh2~R7so7kuMNNj!VpMCFqD@|y!3=GXmFQKMY zrbIZRy>J}yK?SYvnJv_%AA%yq{%L-WaMpT4Vq1CZ`X*C$ipok5*NJ;ZB#e(9Lkde^ zgU^q>CX*d_!~-XMn%ls~?Y%qxRO=v&8r4rMY!l+;{rYXZF*ozD%Nx5Dyj&;u3gHF1!^$YD!nKr)UYN4fJk;jwFCzuM0Hve3(|Mo*Et& z7_Y}kUKeQEXbyRhmtduImKZT+Q!kvQQzX?i|Kfx<dT~h{OIV1sP~=8V>Ip-)i&8BYwtK9)FpNbTEi$e2 zYdI|{$38RWxi@cLne~%O4SN*Gma6nrm0N~;>1+N=F6pGxAqFcWzKk56X7QE3N%!)% zzj;;OQ)D&2QZAtU(WO5vNptiElaivg_K)`$8QV4pAtwShUpB#%{FSFFQ5rjYfOPWv z5e2%Kn~i&uh+Dq^e_KBH4r8n0$7P7XpV!9W?yafoZ792BUZmd#qLbsVeZQf0oE@3g0TbJ){|E}u_Ynmg!g?PlsxoC5= z670U(>~<065iTTbRE+rCqom##ue)2@!BQRxr&Ee2H^$e^jDnwTCP&cniuWNwO`9CJ zE6y1-JYBS66IMAHDzP_@>mU{|rlo-6nYKT+28O&z?E@zKiFs9VNIFk^^|)J&p12xD zFN&JWv>v(52%B>c4tj0%- z=4R!1S23aYUm%QdU*e%ltMk;Tz!k!7G(A?Nn;^`iXP8uaH;~tpCvhB&qdPpZ$MdWe z7dCe3Yc5~&XS65&Y~7rqZtIQWgS}h+c$>)dy^n{@YkPt;)cg2eMApu*@@p0Vc=>3t zaY3O1W@iuCJS3%sGU8a_05gZpiWjv#WvXItoIv_*cZoA5F@$C+meF$kr;vYF#ypgZ zTgF~I2c_93AK#PUsrI@jY_LpUdvR97oo*_!<)nLyLv3k(wh55Xr@okF zK3k%aJ8x0jB$PQrE6Sd?SRx@#ze|CqqS?tA8lW(3Px-#-R9l#$r1yC!WqevLqY^f~ z@h_h*TwTOy%NSAyW&#JC2`I-+r>MpY6z9MM5h4F^>DgUTBOD-h8fK=dSe+uybxv|| z!1@gGl#J}D`V6xB0MLzI>x&99`Ld4ci0&d`U&q@G7WNEUIxD1t|N;A-@v$w1p9eQf(&InR~nynWk%s0O%w1PyvG z5!1DeXeODaU6d+mOZA zidIO{Pds+ZPPFA}@X-VgA*TGZ;|ywj_LtdQqd;BZUeTnEVn;7D4dGTv9J`2u*_IyL zgY3S+Xn@5@M7!9)g~Co4^?yFM*=&9_+JsP5g{`3%*U1mONb z`+wi|Bi>>n-7WTP$xYf^>@MA?paWf|ZNRK%E(zJdPN4^;>l^T;$${TiZ-$-umzJkr zcl~@weI^*lxvzfq<~hceu2(+6BPEwsAX#Q)O_uQ*iyqGLjsr?#vtn9v>ckRsv&%ER z7^J-d*YwU1#6Z>u8719db!D-mK~*);s@~#)HSTP{Vg@^TW4oF6)UjPPO+BPwGG}C) zOCaY@9?A1#J*rJwp)VI2leZDcX7Q6q?_!iWt}Z=dlA|f7Y6?U5+D(CE6DMcJ8=i}> z6J&FQpeeUS&yLQ7+aD&qw|=Zq5O?hy+E6uwX9#taMoI&btn0Ky1r|R0RC1wSGb&qdrPsJQ6rhF2tRTy7#DnH zHCK>wonG2j;|&+FKlFOBLCP?#v>7q@B@aT3!QYB%OD5j^D*T<;o5wSw6eU|8D@Cao zI?u_r`QD4UIm^z7m7lF+uHm!d(<_?=M<-?5?#tEJx=v|Rn1qg>p`Tw_Sh!ca6)|lX zXCq$L7Vln;jz?4!l;ZKs`H%d-!RHFG+vx$DFGvA3_CdjLe>r`oPcL_K#ov@8(Q28R zVzwpJ?x@An<}BBG(3Q!0Wb9{db?b3@Uf@WlKsx%xlr5}-{942#vcy>PhS4sC^+`JB z%hxDr95Y@Rv$`u%PqPs#nYBoZzkq*HW1-sjFUZ;nnB<-5~bkX%fCAu)=uMz%984w5cGo`V(d%r8n{%Ar=>nsom#ZCSCkIQbeLqb^kz2ZSFdVsFtGPF*6#$uB{h6R+wN5dhN^Otd7?>_RR*Z?8V zrB8NCvEn^cu*;Ybo*HS14QKmOFuhk$^57ZxA2{P%@<0&s(Q1a(2JDRyl4C7?eTS5U z?bhz+&v$y?YbU?fB@5W|Ivc%URTi{0uogRejBVj>Z7E;i-|EK(xGdBK{f3QF#+{dP}ABt z0i|&fObsRr1%L8{)+!RHhj#dOmh{S0S%x;te1w|64cd~E`6z8Kjl0&D*DpYn?fe6W zFBQx{-QvgiA`7d%AU!k0CmV<#YP7N54_Ypoc4jr6)8wB6~v5!-Dd6x9%=c zj9vpPaF^N#yakxOayB5~1=7l2<(M+{Gto{z#N5W{-rCGcP&)Lysc1%98_2p(VO8t|{GUMtBb*f#<Z*drcOK%@E{)t+K~Ph3MlsDZnCOEHw40O6o*%jZECK$Y`@!pnw1Q*i zavB&Kpp%}PQ+a_`L^^?As@-!7-+!=GjD81aa(%fpNX>2rvwIvelN8PN9+a*z=V z3Jek5-O)ljUjaw4YN3muNeTN6HcSKo!}d8pZr!L_@?dS;o6D1qU8g?c^9{@|q{8iR zfY!Q|5jiioAQ_sZ=G0E!2>{rGc_-v^n)<4G=h&w~5yMiK#1Cdq z55xnR&R3g#7)|qFR7x&YG)1urD32iK6T`p za&NU+7#NZK0)%)L?9RGT-MH$eG;qgivg+JOQM|SXZUl6mraXoy{M~hvfQ+nE_^B%=qH$oilaBcXt36oT1;>@! za6^?0Y1vn4VX(v&S^}>7XSM@)+*G&^7$He{ZAQkucE|Q?yI}__bZYVtS*fk&vPD{y zd17w-N3NxAek+$YU88q6PtFI^z(NiwGHbI<5fVotyAF;LT!Bu+l6s=G0^Z^hsCWC> zqU!kMp3JTY;aB!A`OH+uMuwMb%D`%L=qO0Kw&-C`dZeaBJ3-neJA^+*&Uoa zIkU0JbiNy0N8_L)@>Op8``D*i&3W2O+NzX{%e~fTt+?%YyCSl9`YxNuMrdbOY+NX< zTS_#`+#79KiVeu_p(Ix$>)U=yz+rbbYJ{IdqqsE>z}Z|LN1b)hYD=j~IO(V+OO;sg ziFe>1t7<)thFI4!M+atTg27k`c6qqeDQ{fYWn-x3+KqtV<;}WJwYj+x3_k0cHoJ?4 zz<)hGe(;`@X+A*!PsM(GrIy=&$W-hSks@e%tXl%u~0pgUts@-)a z`q(o$|Hf+vk>(^xY8=!^j*e~MOP-4Ty%_YeHSBTXrNi9dQaK*+&nSH7ChzO3KIg?J z7sp+`Sy-|IcY@EJx+=5N<*;MoHJyk%Di6CQ?8^h4=gm1uZ0Z^~2{Sqn!40@s|K`y? z+i)E)x8@1xL?(DSszJ>xLHn~M@aGdxnu@{)CKi&PJLbiu3xrs-4I<9T)t|4P8T3(E zgx-1m^Vt)1OZ8R!bzBoGlnKJzXwyfGd+nRhGfUC(LU(}ipUU|dmvy|)IMjrp$)v}h z95aXK?@`Z+Kw?zf!EQqokL zf{AizvxWG&qbr`7SEZEb*en^$hsKQp&4NF238-#S1o6V|E(0eH+V(>Reh5D~@a%u4 z34mB~)7lqT#+GCk4EG*%9Ebw5l0Hj0%A%mLIL<&k!;fARW1=Bgm66lI%KCzp`yw zEm>p7YEP8Zj&nq@4B$d=K){Mp=7gxZ2}@Akv$NXBywuBd`}KwqbgTV=^59lStrZIU zjMZ$8CO#=-dK%g90i@UAn?Sf;6vr;y)1e)eEvWbO$d?<>d7q~1F_;6Y;#e=gWo`I) zTh~A2x$*h<@g;$U5P`S{Y^n$x)&X2v;UIokC30rAis;LW!INr@v6J2p@~n%BL+FY@ zs|lG2g9+KQ+P;PEr`K#Rg1;(KoRLn?w=odwDk7fJnqlr{ z(z6zBGYkImfM15c+I&gH0+`kc{c{;>X z4^Gb?neTr)C%G{AL|KgRV=u&etP_`3oibiP`?T)+C-Flznx~C|^ZURy^-k<@fCbE9 zA95I?b+cv_W_&%M?$ql+FpB7bdh|b(6MJP2vyO@M>?hk&ZAWjG)q&}G>X~KP*-K=x zyfO0J*wVt@`x4L1874+v3BbLEYJ%A8WMN$;Ai+>I|5G8-+^1OTVV9I zb8RsM+GB86)nZIS`%+a2@1OPCo^Bvp14Ga2wYMEsJbO=61jvK=O6u|gMa&c1jT_-` zuZi*|6gfX1g(5{_l48w2zE+fpzb3jCoIJgv;)B>ORZ~AV*KgSL4HmX{x?NM=#YrBn zA>m%R+1WjYgI7&PVjZwc=C(MJ6a~)~AT+_0_Oe-$hkPjSP`|!&Q zC?~ZZrb!rC7JJGRx>S)lEB%b?{#E!zfQ2kW2m}`|;kLSu5xX{Xqt1GARX*-N;hki#qsvv5cIRb%M}fC+IM&Fw1KPeu@KlH1 z%>q-T4u&dAO<%PLc_TYkufZD3I0Xgf8X9dHu4^Z2H}hwX7_~RG+C7PifE<_IdF!Ym zO6WfALI<&y`K>}x*^nzK&}cVP;zwLb(P)46tMM3iy2k0kG6#JCW*96v6Pgv~z}VkA zy}q47(U)8viQMqiSH1dmIFrTKpywBut)bYC@c`4|R{A1v=Y07<^Tba9x{FV+#N2zP z));!_Do{uCKcAOO$p8Edei%ElUsfLc%IEN_2P<*7Oot|McybPG;LuC_ zU5G=I_`4E^f#YB${@+Z(c>mjWqyfhX%ru*DkPYIRWOVv3IN|GmBN3wijYRzXZzSUIs|OZyxJ-YK z&Y?*hn#7@(IIw|3XZqJI9Gb+TNgM{rzo+3aNFJ=jp-CK?#9@&9YXgTt@?a$nP2$ib dVE^|ZdE(-t<_~y59|Bsbn~Eyev#%LH{~rhjw