From 95862328d41b26dade8962fc3cf81e4e1e56b2fe Mon Sep 17 00:00:00 2001 From: Noah Talerman <47070608+noahtalerman@users.noreply.github.com> Date: Thu, 9 Jan 2025 19:10:53 -0500 Subject: [PATCH] Release article: Fleet 4.62.0 (#25255) Co-authored-by: Luke Heath Co-authored-by: Drew Baker <89049099+Drew-P-drawers@users.noreply.github.com> --- articles/fleet-4.62.0.md | 111 ++++++++++++++++++ .../articles/fleet-4.62.0-1600x900@2x.png | Bin 0 -> 53319 bytes 2 files changed, 111 insertions(+) create mode 100644 articles/fleet-4.62.0.md create mode 100644 website/assets/images/articles/fleet-4.62.0-1600x900@2x.png diff --git a/articles/fleet-4.62.0.md b/articles/fleet-4.62.0.md new file mode 100644 index 0000000000..b82d33db17 --- /dev/null +++ b/articles/fleet-4.62.0.md @@ -0,0 +1,111 @@ +# Fleet 4.62.0 | Custom targets and automatic policies for software, secrets in configuration profiles and scripts + +
+ +
+ +Fleet 4.62.0 is live. Check out the full [changelog](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.62.0) or continue reading to get the highlights. +For upgrade instructions, see our [upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in the Fleet docs. + +## Highlights +- Custom targets for software installs +- Automatic policies for custom packages +- Hide secrets in configuration profiles and scripts + +### Custom targets for software installs + +IT admins can now install Fleet-maintained apps and custom packages only on macOS, Windows, and Linux hosts within specific labels. This lets you target installations more precisely, tailoring deployments by department, role, or hardware. Learn more about deploying software [here](https://fleetdm.com/guides/deploy-software-packages). + +### Automatic policies for custom packages + +Fleet now creates policies automatically when you add a custom package. This eliminates the need to manually write policies, making it faster and easier to deploy software across all your hosts. Learn more about automatically installing software [here](https://fleetdm.com/guides/automatic-software-install-in-fleet). + +### Hide secrets in configuration profiles and scripts + +Fleet ensures that GitHub or GitLab secrets, like API tokens and license keys used in scripts (Shell & PowerShell) and configuration profiles (macOS & Windows), are hidden when viewed or downloaded in Fleet. This protects sensitive information, keeping it secure until it’s deployed to the hosts. Learn more about secrets [here](https://fleetdm.com/secret-variables). + +## Changes + +## Endpoint operations +- Updated macos 13, 14 per latest CIS documents. Added macos 15 support. +- Updated queries API to support above targeted platform filtering. +- Updated UI queries page to filter, sort, paginate, etc. via query params in call to server. +- Added searchable query targets and cleaner UI for uses with many teams or labels. + +## Device management (MDM) +- Added ability to use secrets (`$FLEET_SECRET_YOURNAME`) in scripts and profiles. +- Added ability to scope Fleet-maintained apps and custom packages via labels in UI, API, and CLI. +- Added capability to automatically generate "trigger policies" for custom software packages. +- Added UI for scoping software via labels. +- Added validation to prevent label deletion if it is used to scope the hosts targeted by a software installer. +- Added ability to filter host software based on label scoping. +- Added support for Fleet secret validation in software installer scripts. +- Updated `fleetctl gitops` to support scope software installers by labels, with the `labels_include_any` or `labels_exclude_any` conditions. +- Updated `fleetctl gitops` to identify secrets in scripts and profiles and saves them on the Fleet server. +- Updated `fleetctl gitops` so that when it updates profiles, if the secret value has changed, the profile is updated on the host. +- Added `/fleet/spec/secret_variables` API endpoint. +- Added functionality for skipping automatic installs if the software is not scoped to the host via labels. +- Added the ability to click a software row on the my device page and see the details of that software's installation on the host. +- Allowed software uninstalls and script-based host lock/unlock/wipe to run while global scripts are disabled. + +## Vulnerability management +- Added missing vulncheck data from NVD feeds. +- Fixed MSI parsing for packages including long interned strings (e.g. licenses for the OpenVPN Connect installer). +- Fixed a panic (and resulting failure to load CVE details) on new installs when OS versions have not been populated yet. +- Fixed CVE-2024-10004 false positive on Fleet-supported platforms (vuln is iOS-only and iOS vuln checking is not supported). + +## Bug fixes and improvements +- Added license key validation on `fleetctl preview` if a license key is provided; fixes cases where an invalid license key would cause `fleetctl preview` to hang. +- Increased maximum length for installer URLs specified in GitOps to 4000 characters. +- Stopped older scheduled queries from filling logs with errors. +- Changed script upload endpoint (`POST /api/v1/fleet/scripts`) to automatically switch CRLF line endings to LF. +- Fleshed out server response from `queries` endpoint to include `count` and `meta` pagination information. +- Updated platform filtering on queries page to refer to targeted platforms instead of compatible platforms. +- Included osquery pre-releases in daily UI constant update GitHub Actions job. +- Updated to send alert via SNS when a scheduled "cron" job returns errors. +- SNS topic for job error alerts can be configured separately from the existing monitor alert by adding "cron_job_failure_monitoring" to sns_topic_arns_map, otherwise defaults to the using the same topic. +- Improved validation workflow on SMTP settings page. +- Allowed team policy endpoint (`PATCH /api/latest/fleet/teams/{team_id}/policies/{policy_id}`) to receive explicit `null` as a value for `script_id` or `software_title_id` to unset a script or software installer respectively. +- Aliased EAP versions of JetBrains IDEs to "last release version plus all fixes" (e.g. 2024.3 EAP -> 2024.2.99) to avoid vulnerability false positives. +- Removed server error if no private IP was found by detail_query_network_interface. +- Updated `fleetctl` dependencies that cause warnings. +- Added service annotation field to Helm Chart. +- Updated so that on policy deletion any associated pending software installer or scripts are deleted. +- Added fallback to FileVersion on EXE installers when FileVersion is set but ProductVersion isn't to allow more custom packages to be uploaded. +- Added Mastodon icon and URL to server email templates. +- Improved table text wrapper in UI. +- Added helpful tooltip for the install software setup experience page. +- Added offset to the tooltips on hover of the profile aggregate status indicators. +- Added the `software_title_id` field to the `added_software` activity details. +- Allow maintainers to manage install software or run scripts on policy automations. +- Removed duplicate software records from homebrew casks already reported in the osquery `apps` table to address false positive vulnerabilities due to lack of bundle_identifier. +- Added the `labels_include_any` and `labels_exclude_any` fields to the software installer activities. +- Updated the get host endpoint to include disk encryption stats for a linux host only if the setting is enabled. +- Updated Helm chart to support customization options such as the Google cloud_sql_proxy in the fleet-migration job. +- Updated example windows policies. +- Added a descriptive error when a GitOps file contains script references that are missing paths. +- Removed `invalid UUID` log message when validating Apple MDM UDID. +- Added validation Fleet secrets embedded into scripts and profiles on ingestion. +- Display the correct percentage of hosts online when there are no hosts online. +- Fixed bug when creating a label to preserve the selected team. +- Fixed export to CSV trimming leading zeros by treating those values as strings. +- Fixed reporting of software uninstall results after a host has been locked/unlocked. +- Fixed issue where minio software was not scanned for vulnerabilities correctly because of unexpected trailing characters in the version string. +- Fixed bug on the "Controls" page where incorrect timestamp information was displayed while the "Current versions" table was loading. +- Fixed policy truncation UI bug. +- Fixed cases where showing results of an inherited query viewed inside a team would include results from hosts not on thta team by adding an optional team_id parameter to queris report endpoint (`GET /api/latest/fleet/queries/{query_id}/report`). +- Fixed issue where deleted Apple config profiles were installing on devices because devices were offline when the profile was added. +- Fixed UI bug involving pagination of subsections within the "Controls" page. +- Fixed "Verifying" disk encryption status count and filter for macOS hosts to not include hosts where end-user action is required. +- Fixed a bug in determining sort type of query result columns by deducing that type from the data present in those columns. + +## Ready to upgrade? + +Visit our [Upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in the Fleet docs for instructions on updating to Fleet 4.62.0. + + + + + + + diff --git a/website/assets/images/articles/fleet-4.62.0-1600x900@2x.png b/website/assets/images/articles/fleet-4.62.0-1600x900@2x.png new file mode 100644 index 0000000000000000000000000000000000000000..e90bb1c3f3c9ae7127115e58ccae003d6d32a654 GIT binary patch literal 53319 zcmeFYby!s0_da|O1QaBs8|6`WKuSs^W)Kk@P!MSm3F&SaLQ-KsQBYD)I;0y!VhAOr zOG-YwrnDzpr}cH2Y})0M6XHdHn$Z zQ2PM@1tldp_zCujo(%Zsl>JQ|Cjel+fd5Bw>%l+k;D;nm4^*!K`JJ4L-~*Yt(mf>r zD1=j?jZXqV*VwJ=N}BE@E2Byz0385`m#oL!z+L}Yffz7xNm`WR@Yk6hYvL~? z{zBq!kR)Q@Z;(9J#9v7Kg#_?7NFIaWZ;&Kf!(T}Jg~Z<=d5nR-L6Ybe{zBp}B>o0T zqBZ;tlE<3(3yJ>^kVvkre)%Kk%a%NLPw%W;VS{+f#Vb*C(_9IHVeh`bD>r^bEvfnR zhTwZg@uyF6wEDB23fpfpTt5DSY)7B2{vGlyMB>!jY z!SMvRt?}pbno7q&zK&XFi`TjWMvhB-Bocg(e~PQ zxfEHq+gw_}ViYeUE5Y)n*h&1dkKm2;`^{5}eTC-U2V;ZgpcsV9Z;LS5w_0R8KJlF` zoAJL>%@?doToWSTme%G@uj&RkP39we5(A>{e5O?N9JC1)vSWR%K6j@WHFyXzZBHpS}RG1;bty_J5K);8+LsxJ5fxxvW^I+93E>+_EQhM-ZCcoPP z%!&gO5RQ%zk$c;PQRm6neDmkVdN|RRBe8qeaX-piTEKFoV_$}qcq>CStgm4VaVlKubBexINV(a* zr)#ow^WnO0&RXSKk*KdX-MQAF@rgk$Bi-`L2cs-1%+2Rp-yGg}x{Qq`D%64zUujEm zK9EifJ7bg(F%Ve;muO~hUCrAuxZV0`Ys8=RV5L6XREYe1&UwHCQ;-zCSlGjxT5sYY zU*)T1y|DNyH=J%ZIvJZN^+&vOlz7GUwpJY!MuBMDz}58+tXuI4!DjMV(MXC^>Tszj zZEl?HUCyhl5!NPZ=H4cK5rw%@uqH_mbZRSCpPeD5Uzs)UI#)SxS3r4RFE1!?)MNYK zj~uA#T&mkdmcA}bmO*6AM6mdml)5z)*zDIn-Vt4kD6&x4Q!w)CNGx5RIdoOw^K?gs zyE`{7J^neyY5FDev#c*>N$9DLo)vnfRgbt7>RNb3@Yd!pPewxCez*zTvjf9!2qX|%99u6`+2vU$j=9}W#i%_PI7gnArY zU@>#!*GBh4HeplEzEBt)afw)MIjcPQvQG?>cw zToB5ELaFW2wA)SZwEC&_iQ=^I;VZunbgE6I-_a(9Wec5%J@1?qa31~Gr^}~@GML-_ z%E*XZ>dJu}Ga_~%@6`=;@6M-xpq8?N&+(w_&F5Q2gq?Z>!n;lTGdeIHqp^EUzt+5^ z*_&UlCRHr@hor7>8`KNp4Jr-wJDtNsNAJ$D1VGGt!a~oyF^Uhn@$ga-0W zUB;f9;mvRG@;{2F$PYiGkO+P-WZJP*M{Ft}fiHnaefyedo?6>TZJ*vV&2}JoVN{%-rcG zRfE(mZ|5U#xQ=tVy|p~~DS8m{+h$=gmy6iU^dG#wm$LKtp8o2T=vjD2`_}5@Y;g73 z%Nv6u6B^k}Q6U4;u4wT!<2~Y13;atMNgIq9lIR0Ojn>{flarsEn%jeoaB*%1VJGN1 zSnPyW8;i=`5l0c=IBH^59>eEZ!5Pk)Zu1<=YGxXi8geJ^G0CEc5_Pf1uj~aoBgPt= z|0?vTos71=9cHFBzjo{Hv%zXx<@LyZw@H>^8}5Zu6Am~*eBXpiU6J4kZQJSO^ldRR z^L6~S$wQCzYJYJh3X!J@ZzwFTJ?7-_yc*~R222OF<5qsX^nT#2OJDgdVAHT8r1Sb{ zZ%vLst?~e5B8T$nyFAv=Tdsv@HMk(g^CTf^ObOvl3jrsoN&e!72e8Xn}F*IxOmxALj!rNz}#69sMt6Q(gz z23!q?d5e~CQyXETvelUhQxd7l?_!gE79|y_Q>2duL)fe5R$VN*W9}-d+vTFCJJmRe zAulEj58up}`OCt7m;SNh?DJ`S^5x5`WdWaQI8~L#pQ>O?=<$16C!(mHul;a?T_&e_ z@0`yXYE4GNVn#yr-U1AG_1X`Yx?C@DrG$$7W5U}f0#v5F^8XGl@DpPU7c=;a7{cYZ zN#_UN#2Tosz5n%XWP~sA!gxnukSR5Ez*)DVA_}A>|94uyimVLSz5RA4ys3EekWT}s zp4+HBMjmwrVwnv;b)bS$H+Gil**g)-Q_KUCbpph%+ppp0@|B_pt8u?W_arazbFFiD zHUA?0abFE|Ye$zlgwR!HW^`6x!?%m(zlpz!Nx6h~7++0gyw0NliBl9ZxqkXXAiq+o zyxVyidfb{gukppK^k3i7;lHa@LFNTctOgR2A?&B$+Pa-}{3;+ob)>F)JoJ9vQSTY{ zS9_X1PCYT^M?~I`J`q9{FK_cd)zT8Ig5`V^Rs0pY#qXfNRPpW-M!Zh$w*kjfhCJ9)zuoF zTL!;JwzjvKdH839mjuMcH;&4`t{L2pPG_A=mU*?`+!-6VCs!u3b|SQU3SCw$dOQng zoBJpjd^6*XD4`SPl8d0HktxSWx|g>pQ_O%Ytu>pH3qK1tFXP$AMD@pnmFEF~UlrT< zFlX^Yk3o?oV_ctb^zh2ICZ}4Bs|Kx|Jnl{FYTKY{fSbI8Jo_7oRMz9RDf)!iG5-Co z3N1@9RCp@dP;Rbn&W|LMMPN4wFR? zwO2NmI!Z6lou3%neVQN-t`CzH%cv@UKxp)0-zpK2>bECKK)ozwKdxmRUF>;waPuKG z?%ti4=7#w^KgL~!L(Q1xnQGdT^Q(;_|8uJ2w(#JW=ihkuL>CQZGG=P(Il)YIBt0ygW> zhUUVE^D(_h2){$Mr5DUHKBUsWbs?GiwFTp12nkN3XWCGGKLGj7M8&JO2fxlYq9|>Q zAp%rD3XkQeYlQ)YURE;-sf-=`rg}J(X*F)1HmxUtlOtmAP6bwcEzBU~siUh1`wtV* zHR8^(-(^A;^1KE+Gr&4Jd(1RD%~;Pi-2*0eYbH=Zn+jr zNH|MpKSM(c?R%NEoIRh)-&c!N1p|%71r_v0?_QnOp|zHTtQ?Cdry{r8wi}|TZ0Y)~ ztqlYR|9zsxLbV7ntE9y+=MmY1CLY`#q^$Y<`}EB0Hs!`rsi^GhyjvTp8}GBTE$Lgm z(S_zUAFL#gCkLG&5R)ve3n#$j>4G8FE>GMkwQ2)VvrqZyFu1|OR%mVH7GD$3R`yx{ zP{?sBKS9FEE;7-#u4rCg3wFH0dzfq+rd>a&yEq5m6FeW)V<0!3-QdzQGC^-DvA@^2 zfy1HerLUvK3s&eszq*JDWbx&;OSr;z+#{exAS}11P)Wa8hX>Bqa^SsC}4S z#JHYb8hv6CE1XZR4AH+V{Z8E+7t~ zsnaKwBQx)71^T#O^5niwB4CEff~>9NejeTrAB2r@;x+Z2;a-Crm%wPyY(*Vo$%(J&;jYEE2nNpeDj(N#eg9!yj| z-dW_t?Zd#t-Wq3UWrGO}GALdgsF+$keDH!7v9}uT1KZK$lyfsP#`D_{3hnDghpCz6 z48=|x<{;uhwGpj7C7OVwUZHDIrFy?X=6LXeR|QqL-1ctdJ#EHg(nU;DaK-BGWcD4( z^JtXC5?cV{6asF@6UJ|ZQ@PvuohTnPjX=HLYP{f8P&R*x#5k2M-+Atu{jVX;!HF6& z_;h2&M37nO(U`ZDex;e1$Y)T~SBgx$YW90yeuKlGE326clMl<=FU}-_RfY{zzH*_D z^Le6**$GTO^HctESIbwsPL-~L#E4EU^XaDo*Wl5yA7<9e%&d4~p@pY=Yt7bETX?s6 z5F0+#(<}wH@ZmQP8=Ctj>nfN7$0lH=*79zKBO_;dvs?@Hty10q61oo z6Jp0)sjvb^;$U(_QhevYx2Up6r+F>&w9*+gT)DXl@jWbbgY<{EkK}Y7smglKv&EUq zLQkW>v^*7WKYG3Nci!#&JRiOF?=^7vK5>VIC!pJW*(O8Vf~s5wEwo{-I6WtgIbgd~ zG?Jsh0uB~@N|%FP-AxW}(_I(m@|ygR9mM0+W$;oF_2m)Gwo3ooIf+Pka%g!Azttc` zi0TOdg$l1HZAb6j-`H!&kvop$EQG|?!a{|!cVuICXGOE=`>AMEHnbz9l#vla z?p$l@&n&+nXBXiJp{jSyRq?i=Z%HxY_Q-yRW~PqL#7Pg5BKmLe%ZCt%&jsJTJ?=BW zubKTm9QvmGm$@W?93ERAX)LlHCrZ%Q*XBNUaEZ?3QYwa*(zdH?Ybd7Dc4kn@+8)jx zux2-N`xM$*L{t#5#>|TkNx-kyLhlq5#Y-+qPx@F1ZwutVEFfy1ClXIA0KYraWqJdM zykze~f&Am|{NP7h9A8x)zTj?dN7N=)34^*JhGBaLJdObX^|-3)UCTUV@BN5|K5<}{ z*s4rm`cPpMYHJM}Qh|K8LsZvnA3mx8k|pO4 z+;_9=UJ{)(uQ(Mi{);m!U|)~r@VDUQH+Ce#namuk=iXbO3>3b5Nk`uSz$U@J1CnuX zNqsgjYrcdPI{wnnk&q4mk{~NY_0V$XBoY^8(}D*74toHKC~o^5g1Fs4(;vOq67=F1 z&Hy{^54w*pnE`;{T{Lkj{YTiy6xbkgUrjuX1*>7H*x5qW|8+)x)Y)mz*$&zkoAO*D z^+;hqnjO>DewR-=vmd^H{MAq3+dyU%IIn5q%bC1*Zwf$z&J7V!lN3$~Nq7~M)_L(CcofJS38$`bf){_sBxco8 zQi1N>B5FMIA_+db@;i+h+xg#zB1a#-j>m1>dHQs|kf>A6b z@85RDZO$z$Vmy%&q9;pU3PF5t5r;u4;Q^3YlEr^NvYZ>k;RCl*Ts-3s_kYGZ+ZF-I zvB^n7`Q{FPk!CeaRDBg*%nuK1LvXQ6On5$CE1RP}WHz~LEq3%UJz0mwm4Ul9|Rue=^rHM^IIxf;m(5@%zTyWq3pYpe}rvcMgW;kSDp z4=BxVL&}Jj!*rbCcSYoQpzS{ESQpzvs@U0G9+k+&$ow5cJrGIRf<1F5b-=2?)ltCaSwh-bwO>G*IY&YNg zj8xC0!}hP?mt>*OVd&gO+a4!!p~4?t8p84k;@_#>CEIG3wCDWaaqMtQ}8P4Ont9a4Tt3m2$gyIv=iZi z@es2gam>g4Ko98&av86DG@0RBL#x|xcrC;U1XBBXuR^dm%ZLleB|hBf3)GToB)pTa zT?6Vd@Z7|*%WZQbgq*Pl4L3MT?8!?IK?b_D?t#l_hw+oz2t7D9LLlC|bC`THs{nR2 zY1u<@q^)$GOKV{Oj%oYSE`#d}+c0;7@E9GI=aHyfet4+bIN%03tU|1w@qz1kmZ_+9 z?T!rY5A_``%bDT7hQq znU2xa=q`*C3#^R!goooyS1Q+~n)M&zd*uk#_n6p;!6@UXE}!Kfzw;HSZ~1XU9@gFb zfm}k5^70j2_iWilS_}55-DCPU-{z#5ckH6ZCOiMQK?c0aPUoBkwF?^az6-<6eq~-Q zO4v`Ir@Qo}s^{p!e_>c$RpdJC5tuu%gV%UU{jRqua~~^8>@nU!K+kFYi`LMl_4nS) zfzjhZtfl#RUDY5MT4m%eTeoYcN2+__XsM7FmAQ>-4;$Q{EQaeY5dGK4djbq^!aP>d zw}T){yVfVNbSY=wtjVT2f`Z{3r{Ya8RHBG>emC-xZ@Cg9Lg;849-RH5Lg{))I&m%w zPB%fZ7{9~NiIp1zX)wNQ!9Za)`>fa0zRw=scsuS1W_}(`nSPJlaX|(>G?!N#kmj~w z5)(U96+62HR77}x{&a_!@Z-uj~qfgW$D$ za1#*bX}OB~Nqm-Pc#*Sjis7Mc2p;zCOKbICgt9Gt_KJI?=GCUL6x#S8iod!c_=u1~ zXO_IX8i(0+Q>||M+JSdTF&g9$k$9WYj)icX~&L?}4lT|6N+jNQOaa`Paqr-G1PKYHcO-F}2;x3$nt5m%H|o*?ktNF^rC zc6W4=%Y>GT!!#NcKtx&0Tur1)HZ37N!PQYSY@Ns%IIj?zd>*OAn5eDAW4$!UM<9ky z!?~wO8b7C*=zsqpE}T6(vTU0b^k-rX1S8NDj2B(ls#~0YmwNJ9{yL)Ihx@W|?dXEv zl$eWS=?KKO7P;(z3lsvKIpMk@M!V8e$IW; zo52uI&obi7?0*rk^zL8fQI+D_orTFzeDqDdx-4nK;ru< z!{GF1B78VG2}-$ec~%T`)eXyd{nzX)yh+V8JAHMfPv^}^6INX=t{FT_z_a4%OUpE+KlCl-`` z_(7u2QS7e8Z8TH)-M#W1a_+Ft;{`cgaHpPNH{gitWgU^0V(slikh;s3r-i!9Qs zb9BjF^OZh++3!d->QFp-f4T&9jb#WjQ9x2h)Y9r}H|fL9-&&dZ=CFWqk2yyr_S zW`6A^#9Kfhs{eOrXy)^tNwf#rP2^E|qIG9ijNmhkbpLt*&oBpnP9z-ndPlxoi}Djh&DL8m{CAI0 z4dcqB2?VG0RsBkhiFJ(59yuPIgo~AiAjTc}eeaDEG%AId&s;&)fR50w?t-2AF(xs_ ztDv{NJlgxPW>56EN#=74th^IXsA z!-l#%kfMZJAiIoC?;z+AD=s|&^w`vx^u-+aR=0?nY!MR>^enm_j{d|txr`a&Pjtg`b%HqS$g`2m| zMJXt(5A6~=^_#j#u)y!Tv1N!4XRHDhyKH?rl3YIV{} zhTF++{t#dg<{g0$`>`NoFe!8+l_&o(@_Ii4Spx5#ZPeTJ{qa!HhsQzb3@?5t3z=bT z;Yy*MDw`?Fq@gxGb=IhZ-w449#xqM$F+**3KX=@bka7z{+ym`fK+Q`&+hK)nmn*j;4wN zdPBc!OG8UW#OtHuxv2e@$?#GL>|ehYXXjUcyz0V{&ff~NB_AA^3-*xp(ts>2`vtUU ze`XK69PGYcxKvt76cOCWMbV-|Fh}?u^CF z6!&1hh6&MT5m|_AKsU% zl#WuA<>9Y6KrMYau@<)&h$-jP?`jF84$ggCI>IX#q)vP9M{ZumL;=5=`;6Cr0CD#4H+2B_c_06R8_-F-Ih+udcV@ObMb># zWvM1@ko*^Cl{H=6d5J0>EtD54#VP}=PHeTx>p20jjEVS&ky27*Jd@^z<`F+EaYNuC zC`=V#4STNYJrjNCS#G!Mi;Vn;X-kiQR3GkFI1Ez>p9!G!1=Jtyd_@c!NLU$_R}Gs~ z%vyCIQ!5Qhjpl*F@V7ZL{xBV5zr=IVR`YvRX3gK(`YapZ+4-M!h1A!qz6&GSD6?c% zkIV+#BL znFiWjY1~Zg_2|3r<^OHB-O$d5Uv8E5$EP@csU1^D>T3y@iT4g0W5t4UpA@4!d1p5} zL^AUxsRPG$CSy+riV0Nuiqx&=>iT7Khg!&ZQC!RAC&(kfLWr`LFGod>f~%Gvq-0i) z881bA+y>)a{|TO*hdAl6VQ~ z0%W}X$~-IvLt2Yw0i;r3Ehg?tdCmaMQ};xFN}ug6PXZj!THLhc@rHqBcWE1 zTMu00eW)fcJmI-*_p=NnfzKBX@hc)iI){3z~u_nka7!w>b{n`BqGI9Yd)&NkpS$ofF86WC_iN<9r2+SNr zdeyEJQh2cMEl>3)=JcW@b`u2xexVx#-}m;Ne}tAA+RA3MFG(qiI&5~34b_TC9z8%8 z)Tc`oW$~4ZV!MRvv9(~%*#C|9Uyf^6Z}6N|kTc2(Qe2AvLIIe*30#ad@>I%0@`V)0 z+IygF(WCpN1#7xBlFSp%84Wwq4~^6+Px){r)DFIRbVOkU2t+AGSfO&mT&eO|h4NQY zzwB1mfS11YLY=Z!@050o?R#>B$z{LzHr{h%*Dt7`7DD&%Bo!!_$LW`73$+@!i5~gz z6e)bH0k04L1oCM6uDl-MYZQfV<+2TO=obhqXH_oc@oqtU!*-55ps*u8u?7IKTt}!6 z2&w{`;Qsgm#frKmIkzSi7T1$=W(uY6j$h6rqygZ|cd4^k?)ca%bgBB@tDKcBP6}71 zJL>NP!J`7elh9MXjCx6LICbkc4)z0hFLZ;x`!@{zdIbNrc^7Z!ai5KZn2m4n6RZa% zi=s5nviv}Xf4*azA4DaP-XU7cTep`eDyw=SY7G{kbtG)f@f?GpG?}6Xn{K7*By(VJ zSRF*34IX%zHj!HVYe@)9onut%D1KK~FI-y-I%@dyxFO9onrsNl^5qMqoz3iWmP@Fg z^7Dm3n?s@%o=MD!uX9SzVQh>zUO!aTK?*`q2vh@|Nd0zzyM5aa^7o@qa_A$Ud761o*119-b>-`N6&AMI!n0`x zN2wD{0-lI~@t1TdkB%z8?z{z$$3(11rL0KR7a>+%w)FOkiPk?qDp(8>@a-2UahWik z1?`DKtkYoEAX!iP)vGPd5wKA=EQ>F;^Vcts3PkMl;8F(Q((g#3!uYv42KC+UY;Rj1 zajX<^b||5XgJ|KC9th7VT1N{^!v&dYW}0iYB-c=ZFMqrCvp+fZEEdP|ef7Om;c2+$ zssbGcbw?IJqmCJxNqJA-LF_s@Ry^^1{@%?Z*|wp-}vCXpys1+YW&Eu zamUMU*zd-Fuw2U6{e@bF(tl+VtcS}gN`But%9Su2M+BAF4 zO@qFkB+&TCQ+&k|JOu#Q*e%W80t+cLd5!+9A9p$#;1OzurD7un`DyxUmHEG*l>P)s zzt(Xb)gNu{q5?lUZj9yQtNCe(r(j~5m&qQ`1`yr?e2&EQD+7J!<0;x;O}P;03ka*_ zHD1E^>x4`WTyMRz*e4YwCY0Avfm5$ZqF#CqG7?_k#RnEJPygtN;^Q&C@{ID6!3Qd^ z16vtG$p5OT-K)f5&ZCuzp8=n^uJOtk;>^GCP*;!IR<^j1<2!+l5(p#!jI^`ZRo*}a zrndpDDo)j@+06P1qM%PQ`)a?uz&elNz`yNR#(z9^1m`0+3Xc!SmgRZv&8iOj4!mh} zUt+_y(t(-mQFY$WmB70}Nl!K|l|1PGK!peW$cF&44zd0KwI4?&VWE1o&d|BUKB>Mh zSB14c{|*=du>IO(CGE{l)no_wkpYW4$FF^!`-KU}85d3(==jxyhWm)M=W;*uf7G$J zqa%@iRD3OAI5OmvUS`9MkB$yqTErY#m%0w# zT^hTb&d41!Ra~zV+hpqfv7s<$e$C z1F&{sspqS((PWZVyceeia*eAk@Vt|p?Y{E|Q?C1_^9WL0QH{OwyjO7&`Zwx>!lnPYGFJlD&HJ}fzu&*IpWyeX8r@5U zH^T;wIl6-nrOVU)H4m}DMn3~60@?0P9(v7{Del4$7|zFCQ#WLIs31h_0 zw&xDeKe%ehKB-?-bKzrR?Vx5-n*Kxcz5EOv^Sf4uQf~*BF>LnB$Cam)aJ&)wwYS+L zh9uM?9Gub-@%I(VK7K*e)hzy;v4pd+XL)TLsx_C{$)A;jt!vigULXTbn`03o^n#&a zt-pK%yK_zI&a6{g!%p4QPLM;Vj)av`)JqZTwcs#o;fm$e&p{lz6ANu*1%nTGFz(>z)K85J#R{?!gQ zcwi-IAtPIYtz4c*jM3^dsTeER6r9X-R4|>nq4Tqmw=xpD&`V{h6y>V-a6UmQXV*7% zkwAg`1dsNxL<4z3VB6ybR!bJao~*O$LK95&`rBMebb!T2PW!q|kW9;E(`K{eAx*?~ zt;Ji(16`>DX1{uB1P>JNG zT=HtCyGdgU+sqCsJ-6%nT6tN;e*ZJeV>KonwJdNb!+MZD`VvNh_7iFVpPgD!jnkn* z6I}dQqu6puRAIR%-RuwCKICT|Iq-px!bkMOC=+rvzdH7jqq>h8@@k21Pf%X%yDi!8 zcE!8!!`S@Ld|B9o#hn<(dp|H=wH%g_d)MV!m#>Uk6UIroO@PybwgEV`FQ;#Fb!uh{ zCS=h8Jqc6ipadk_z(}c5-O78N#vV4^#q!7#KZtY*b}^^GVzJw^Y_a6!foIi9_(>av z%k6_6;O0wKP);`XgWT1Y{t@C3H^9IGy>%D$m96xbsbj&+(vnX6@A+fK=Px}}WoHvgbz zFtq4GT6=^jUT0$?hjl&q^K1g?g=z4JQ!{Fj8fh)fagC8-;6<`#pyF!5+{bubJ(Wud-{E0=IPJY z0Vy96&RlQWoLcx9I?d4{7lRe|jmn`44;Nw9O|%&<2@Ghgf&@dGs`Y4qg@Q)LZMu{G z5dM+@SI}W~E-E&8-xQRPZxoU}MizZ}J9-LEt=OHBVXl{V=95>W=u<30k(G<9pCk4A z$DNuwJJ9o4yaOYpRvm_Kum`j_Qw5|cexGP&vso`cA`2{jXZM^qA^DJ8F%n{CmNzwn zGBG>l1=v`9L)|JxqGaj^hAKCL`Zu=bA5p#l70CHX8KfgAU)#B{nH(P9rto0;vP%h2 zM`V}7@T+_#XK!X;bTtf*%;A|W)mTHiAI?2%+H&Y<<7`1AQ3@e=hfXabBm9TJ4l|wK z)aGx#jOOQWu)Jnn=mLiUIh-DPAWOSR@BYGBEXWv!tB-@~2xxj+aTMn+xgU&~hW|&;Ta@e!X za|H}%=tvKnw5Y7sAX;yPd9|#mPUxEd%q%SJMhveV*p({%E?2AirKd>?X;FH?n@Gl zK6kmET|IyHY${dGs3R$Lf#)b9Vfdw0W1A|^6wMCMcp;FdUctrpdy{JOlczNvC3_e>jxLl)z;&JgUXT%;2zr zJt8#q(*~tqsetYZYoW|(pkN)*o%xhav*kiWmUB``85+TQ>G(hen*Q|AXJt=El9$v-v4 zW{XIs!A;7r>gi3V+3C}Udn%=$&Gn!F(7T z@fAe2({~>BvhN}W4}}scJWWrTqrojyr;WRK|8gtw1E7%Xfk#owKV|R!SO=Lbb8?NP zv1WscGN<1`+MOJU6-xyv)wctE%}i8`CjyJjmqV&sNHrTr`3)XW1-Ki58S{ugLFxy{ z39LrONiyKz2*8*3NVQM?DD<9Nx-F@EH_>}Ds+9TeBF2y{J3Bl`=6T=qcVH^_b{zb9 zz*iFX*uVx|2#}q%%MIE3eFd~fd`Npsuz6vrRiC~<#o-etfR#~vBohSdj#wdQ1|hRIAK4qGg~_-TvOZ}+k>`jh*-oT3mJ7zQ+tAai+U-U2rie}fTl zPb(H;1hT#vY;|Ox7UpG}xH2T2pu=Q|>rU^x%J!@pwzw%!>{Jz;u0bJ?&xuM@nE8F> zfYM*o&sFR2Qk;hqC+t=IA*dMe1R&Ub$t&_GnXAvx#~djbkS^_0>%GkaOv}A3zDwk)+gI}e*asof5+5FO`;2x2V|Rr z!SEXoP}5+S=&6z*y+{l82L9R+3Oem~SMIhN*H1WSlbi%H<*KdBH2up0rYok>9Vr~Z zqfXoumY`LF-c7n)WUv=QD?+Pl*PQ*D0&1qo|BP}wD+q$E1&=};?(W`-C6pCD6H@My zCeZbZ49QHf0`5Oz!b_O&GkHj8yPIjH67U zW|rw`cVV=+<+J_9NPwE>9NyrL`{2t zNOyHhdUv1c4^AU({!7W)*qzDJZEWx)Fl=Ms+U8`M^GoHxC5L{IE zS$61w49Jm5fsyf_ps3G=QoctpXqBWkkuE=Pf6kBakJI(Pkx0#f-(VMrWXfr;O)|42 z@$cul1t_HYtP@mx>1Wa3Tc8-^qrESUg>^FEet@lf*se4s?H0%o4dgC zIN1?UinRW@xFCQt=;0CY@VdkFRsnEK@fS>Cy%E7KgeLh)a+vpUzWGI@<(N0PP!>E# z{Y6|gzSdn25(Rdkd-bArN*?dqTAS4HBBj*td6yp2q;Q!}hxN0*GALXMQ7X*UIlLY- z924$60ImMua3BS)KIaz=K19o_MeV~&pp>@>`#C9oc!dH`Ik0HL@{m6km%qX$*%~pe zQ@0r{kOS^$H9h%}Ag+L4doZ^Rc)AEC*J*#*SXS|cDTR&APkVAd*-U{a!mt{u6BdnCE0@L8g+2nYAH7>4T zOp3Md)~Br*?%z1y3^Iu+6HcI@jBq18^=#9 zC^YO|-s8%v0_jEdgIdNuP`Ng_Qt)h**v|>aYudt3z?h)!jNjn{q4eY`#jvfqCS36% z@IZ698b)s_y$`1IKSo+~S+aZWpC~YCt96wL6n8S@Y`iB$PA9IRtY5KbRfcR{S;~~b zPIM;H%eh`RjbLLC_uS@y)h`uP4};r#GB&4a)XAyAUvP&MepWr?1xM7!uNiQ1yM2HK z#MN+2-~C8I0k4khZ+EQ6xlN@V=+0$jy~!y|Vn0*U?Y%4$14c%{WZ7<-bkIQaNM8JI zBiUk*+rv#(SM#~DFBG(y?8IkWPjGAxy|UCgF(d6TIR#hfhfmJH*YbTZeTWXGsG&it zPUtl(7CXBia@47Wofz>E_Nx6o)pUN5|{DWOLO zJ=n;d5h=!dj!q!ot!}1R$!SjA-L@vZ zSYjH7&KUp?i)qpZcpnsm@Ta_)lo*w9v@%8U?Yb+%_Os~U)^l&U{NCvgH%WpVhI{Z? z`twX!^xk5zNC92z>7z4MVX@%xojX^^{aj_@%t$S?1E23KNDk4E_9~ui-hRhWMLi*{ zLlc;6MTd5A6u`}BGw0A>NWK#c4R*A^eIMr2WxmFGGuRNH*f{CDSY95JJx5kV3nmj0 zFqxfpJRo03gC4j0gdDf0{4|8(aDAFq(humK7z^TJe`A~l@-WgBlT0r5Xr(MEtHG1% zmon}h1g2CvcGulh3VGDg0*80Xeffx5T@6i^ualFuS;0(RbGrfB@!p~8F88E(8einq ztJ6)L^tCu_7^}iXnwvC8w_RVjsLyk^l`(pXXLr}S>SmQGCT)wd_I6wf)_fAwrnSh_~45N6Ej~vdbzC(^|-A(G}QLc z-(pou7;?)ybHh+=zxGi+<*q$g9st8YMsv%L9Q;aB9?=SS)8&^N;5vpkPB=VR_mry_ z1x`S{mRSo($k?MJPLiI4UUcPV`1;j*m%277Z}bGsjbKO#Oj27K##o5?sC8BDFn~UA z12sdR!!yB^^XP_+80<+k3{!0OJv>g)rzs_5HzSdIBbGt6Y2I!Kv&;)kqe=Hk<-Yc~ z@~InodxN#9Yt`$AN1ka8;??^It{G}+?`^nh(g+4jw*_( zx`Rju-!%zO_{R755k}ft)FaeE=(`8`c=oAIhj-=Bjv7>8@+rTS3(DebktBYu>4iXW zC)x5Ti)jB7mfgwJzBO|%@>4t<)zLMw4LO_cv-a3Hay`MKag&WfR|Fp|f~3v(u-R>{ z%&WU0^k7S2OTlN-M9gh$dVd8#LIb77%yEkCw?bKxM+t1+x5EE=CFm21VG*g z$busuky?Cjx-U$s{ttiRx*?M1-aBEs8Z)sxR$Adv1CDo)?sde3V=J!1?YjP!cC{6f zJ;HNAPuv1$LI=C3Oer(*rFuYev%4se3byjE^67nrHG|$ED}^oKnvjY_+*hq&nN1Y6 zGAe(;Rq5O6%rn&KiKFwV39NK&l9 zj3Nh<)>agjvO>C}{9Fvd7qV6CVuBEpyzopcm79#s!U7U_KAxR*Wpc3VG3F+&;U#)_ z=NFWNl?QJXnStYS1oWYMZ(S%FZMeP-=zEpzA?&fVfvgOEYN^n*vo>SP%Q^LO0D#dHG02~4b^3>x5%Eta^wI7WVr2`(>RGpKDS`qGvSb;TTier~W2O#cAJqfFCL!AOS|J1M_PG;{i9dx zpPz$7#)7avo-&6oidyTUpd~rNMmnFtU!wRa>46(u0Hc;_NW)EX{&+~F;!|BQbdmp) zlrN3JtD#J1sHe15XewlSgJ1vPh(CSyl?P}NpNu0^j9P!GFn(K7C7;N!MoR5_Q&`5e z`DsXWDH(PMJ))`U>=-J$oPf`f`4hYGoAh~v{dUH0ks-dEqQ1B+@U)dK`!Rwf`QPw7Z@#5}75aEVDkA?10{do^cNmDnsB^2+_^L9p+DC$p|)UOEq@` zRD7Ha4bkf71YhuE8x6yqzM^x{*`D6i8XE(=0TK>qlVI#y+s|w=dR?5rp!9onm5>PS z!q;R6)v~U|NbNi_dni=wBV}TQc1Bsv!d$y7@I#;$Qg~MB_H#*=x{ZdYx~aNE z>SBs)l@{Kx>%W2chSHw5A=gj^#sD9h858(3G}7CnU-3o6=X}nv(_RH-$nd*Ym3s(M z((H#5rB8=eTNOB&%xY(LtE}piPSPLBk}&J6Zi4qHNU=J2_Ev9hjq+xd)!xtMc#>dE zFZLcAlM))s0zHYnHiEgC4!m8}#zMgzZN$#nx@r}3j;%L9M4Cut&1KIHWKyJuq=ar| znLLS;vAXW;x>BWq;n3?q;`zH9gz%4Vgz_znamPANRS&&X4n}y} z{==$pkyTzA>rIT^S#?Ks&+3+(?PGViE(T=_H#0pRoKH%=vHP8*C)^I>dk**S!c#3 zc)T&d!J773d*=I**SNd4&g{`B=RJVu^03N}HzV$#VUsP%f-@nf?Rp*w=Q#~}2MNUv z*s~o`cXm^~$l=~zz3J@6*jFjs=hIW|LhP1)WRlTOD-7;_|JmrB1UKHdBwoI@okj^` z?GnVXRfkQ^g4JST{e{;F%<#~nxZ{r@6O}mpnEeI+#fZaPqn_rGusa(4xxn9~`J;Lk zqq+Kbtn2y8y|uy*^Jksb(C2+wpr{8FI*i*1TqSe9o*_lJjN$r$7ZU zUl?)(3|qmm?2t6w`XLNP=U?!RouQ0A#k*x>2O{(1xi={NV0gjqDDN08LaS-HjmAEj z@0Muex0h5^QOVD8U1uPdG?_}LW>fEJiU|c%7jR%M>>U_pC<4j)k`(HI_no%L8@rTg z^Cc3V3xfqu6BF}b)W1-gHm{H;VTV6%o2|vlSbg&g=#eDii9?tZybR?U5`K6C_x{^4 z^7B3xNBlUtktWG}6k+uAvZ1Xh0Tt%&L99#scdzQY3r_spw+-ptUA+R8I~Dol)F-Yx zhI#8%vbuEHU^rfo3J5aWXy>?PTL4?(%dVksVtBO|6Z(qG-E4c9?Xn6A{4J>|!ajO} zZgKAIcNa>BbW&*Nk^F*{3}4n4(XE4ooCuZAS>$Yfjy-6?D1=Ay&2>siuX@#in4I=3wY>6my@UWmPhosyq#^02Ok*+f!012Bt z^=1{_DDDD6MUb)nP(N)D#ZPv6d_zvLc=Og)IOx6h9hg){A9A;tzLiH}XRPZ4tMRIh zJVkA=Nz)hes}B325(hd2Xaon^B#>P6ds(j{ko6QBJAGy5Zb@u3dZ|vszzQPo6R38$ zw&q{x1aQ#sRuS%qiXIY9b`6=GmeaYUbG;Y!q2huC^5bQ~{6y;=ei?RJzX+1Jc;nCr zv1hZ&Vz2XS+8bMHU87d?DVdPL+5P-Ct+s1GP8=*4dq=>kqE@r9Fw~aw$6y_p3&3F} zD7lTU6BO_`xIe8Qa($Wh`rXHYZm3<>o8C1`+jDONmPpKe6B;~9GcgjRs*C6KkBNMK z^m~Stg=}&ozO8Ea>+HmANQ2Ch91ok#&tiug5w#Q4Jt7-r&Czz_A^xkP8!TqPG%9erkAR`*I_?LqnSS^;kE z(lQ0C27L=eTTC+;UnK*M53C{83SFYW$P2g*6D<=pUJ~@Fp~lk5EH}FnnqnHnr4;(u z*nbYJ&RMCQ33cN!eI5|0Fe0cRp6oiCUy+)z=pu3a<3&KWv^j@rSDRKT5c}nkLSa5o z`&u62)kNYYTIN%k%CcAwHq5U;AdPgBotx~=1}%hI zcVNB0Aa+BgPDXq^{N6hNqtt1FsZk1Qr7JQlm>Vc&_ zhl0VL7p&yDq%!)+mbw}mc=jjz-Ji}@gN=fnk_`!ozfxFC{3JyYmL#m{^!2y;7+Re# zNRAyzbiE1Z-wOA2ZTn5E3e1|@_86ZvE|TSNX@4QLm|ofW3hoTQPknwdcDKoRj%cNH zqdQjG^ZJ~`ypQ|of$6IstGzx#`D!1}#eAD|d*+nNCv|`uN~Gf6>s*USEu8Z zsBeKVaQ3$JdA2CuS!kp%Uifp-1&m?xysMm5ON`MEv_3ufcoIBNiNd*dO2BD>@9`i( zSbCHpw0sqC=_e*wGxPkSKpkqJ^<}i}HVcd*Jxn;TM1SK;{b02_6})Aj$h^pZ_DonX z`}Sd#{J4kvU1Z{DNjLWF!?B=#+}tjxg<2n7Qj6d1E)acmJXOm<y1FQf#SfNIptPuY98Hb-y)+4pu+}7u=%K#V?RnLuX0_ofBnr$HiHtP@dnqMn! zJq-{uv)r{i1G>Z0zDtAvM&B8M8g5^w{#m`S4|jsas+qMhhHUP$*=7yqqv;TV=?|+0 zJnG24CFwK#!D%sA>r7;=T zy5X|3t}`#rEa8hbo^s2uuf?a-!8s1`Cwnyqi^Ua(#5g!p1z(;S0DBNYMZ}5IDG9P)w1kHVSGxU})k`@pbCcK`;WE&_(z`Z9g!Z+9iIxEREfI}0MPXeeswZmh&8q|6Q zm&!?6t=8L}I*CWnfL;kgEZu;@!>V9r>!ptzv5c5IqEr$Hkq3pggU8e){9bdOc<%ap zrnZKQkzD!P^OECf$zQ{FCA7WN!9^_g;nB>$7LSVgeRwtQdKjw*rrZ>1X%SSuT(b_!qRQQ;bz$f9hLbF)=9UWYomB~adF{vGFV)>A*I!!?x{rx_ zjnH?XbFD|O%1osXKXYR%!ARI;+*bqR(ZtvL{`XZ6>{tM874{1x<;2JgJnW65oOMT% z;a2{ry6!z*G|WH1Wj2-xr?|1>H5oER-^^HaI>6Racl*(F$YTsGr?1!GcD`K--(qyr z;4dV>KEq~>$IgCGJec$J^T+MsRC6O0mbMNZTsjTWpp>YO8E-F_7GB<@bm5_FBT^HO3Q*t@Sj?F?FQ8l%*bJhJFtt(dO_iq z&*EBj7M=1DKlp{M@S&&-jKWwO_eDH4KGDn7;I7tDy{VT2nd*Su@rrO~u$cJ}*mSnX5Dt zd`Jk>hM}h9GgDD*G+az#qL&PZW(NWa*-g3DOVyjq=MOoK-r=F{vnqhq%dh_f;!5;B z%AF6p$@RIp+N019C6E}|sg z-$r3nLXDY1oOoJHm*4vbt_HUCy;AwM+{WJPwqRIhW+5IlN!?!IGnm-HS6> zugc>e<%%6qP5=a;|4EdEULA~=M04W>xb^6Q&^vXRzV@Ie0abg+@)$^z+k@97H zK8n4c9$UnmL}9-CzA{T;UC(uvc11BA8j^g3M$;hJnUMX-8Sqd`^cTZjZ)iH&kcnE7UBEG>=eVi7il&%@`1+s)%*wJkmx`VPXO1eDo1b9G+M#wR$moX-F`t1 zp0Q};yy9uK(KkYG70ZgtqnEW4)kr{$I{F>PIyh#geX{9T@4MBIs#v8(K0M_+C|DDl=6XJ)mo-wT{& z5f1}L1dO(bR43UvcOdjSh-R8_u&&y0*;Hl7h5-8lTAJDeGlm-4)*Uz8XT{W+Rpqws zIKWEmT5)!**`l$fmyS`EJh6Y*B1as2r{6g6NR$KYr>Zw!Biab8LVdmOg_X7qf=+^f zsY_M=TfNoUs@Yz4YXP6XLg)J-K~{cV-a#gnj7|xM)o%o4{hNeU$^^3?{B=rh=+=-! z-eh1jHrt$Opg-39!>@gUno_4`GU6T$Lz38WOKY8L0GojnJ>m!580@(Y&Y$cIfu}zs z+MafH59E3n#;2s-+Q|mkPsu)KE3F&Zsr*HSfOwlK@(-?x{6<}-ga}A&2zc`beMfQ1 zG9;-|O>~{vQbuNun(U0w!?EKgKAC|_GN5e*9b;L_gM5MEH;m$)dU;7Q!(hg&zxiW? zDj~+YEhUw>Qs}?>Ne|tu*^`gc+w}y^x2EmB%`R%$naEk7{bh!WYLQ^mxvEc&li@#g zMHisdZsMjs*xE5=*aRE!BBC0?>X4iLg%dq`JhZ|3d5hucPi1#cSyPw_vPle?mmxssy9Nsju#bwGxomYXm#XS{64seO-;hgHZSgzAXz%(j*IHMlL%=!iUm z{Ow)^Q0tUa5|z1E6C*`n`POaKo9YS`E;ZoZ(%@T5l9KaR8EXBXDM-*SIq|=;ZDvhB ze2!g8@1&T`=y-Ov%9-xmuHtShKup0K?620(LDWar)%lDPz(Go}nl98`TbBtKdP@Al+s;X#wNhLgdJ z>kd~?tlY*m?oJzwx}%Tlm+}h^+p!>ur7ZlG!s-gkWH3$diG-b21(qEtR0lDoxa5LOuY!54AeG3gO75*Z!Am+ThF05$%SBKTrmrnIt3<6By}aeHpG%S= zM1CAg+2fUVLz`6)E06yG0iJCtjPeeew-~VBY8(v;?wnJiMo0i)hL*Mqtc;UV`aR|- z5e3){7_qH8?*zDSz3VfedpfTYDi3<5bA)k-zrtUHuyv2dbbhV@3Bcp$pAoESq+X@S&aK- z!K&pg)+^oc$0GyHp@$QqPn8p+aT;1zKD&U3wppI?``>ZQW5?5M&c;+toM6_A4~&+K zO~~KoQR3e2F1KEzUS1kckS+r)n^)j`9g^+H)ITy6dH5F1wZTA|%6L(Z)K-h#{O_Q7 z`yWqO4}|cFjs9JLkfh@DMG+{X(b;@?ZArf~E`14&AM7NOwK`bB&K+``2VwF7-MuED z{Stj9fFiTfDbT4fa8EA74yT8_Tj|DNr55T45Z>Kg`8W@PgixTPx#ke|l+G%qkv*KP$wj-xfRleRK&8#;m zz=1g}|C)0=6C9Z3YLBbqpC91-(Ny?=dkzvX=E|7!PaglC`SM(0_T+I?mpA<(SCRL^v38=OmJ+T$INxQ5 z#zJ13Gb+%H?$g@N-{aD4kqOj!;0@b|Zn+#(2FNDMf;oYeIXTeof&6n70uU1h@NhBebi3@TG#PjHpZ`p78IA{SV#?m89NU5G(e zde!0MM+|gIDyiQLoh5N?dwK-;rhw`)E9sA9H(x4;u0x>dAjgY}1&49MY*;qE`GBJ) zL{ubDaw{JZ0;HF5tth8X1_5ptcYBCpIc=@rNZ;?;h{JK;yA#q1NMSilp9oMvK07-_ zw75$6*iyQJd%R@hb|>u^v?BzYp+W}D6^o@>W1oz?c~$wAB>Ua^`5))$ zB{XEQ|18z{H<&2%K#yhRuvR{kIo~L`Lv4-6q8RM*cH>)(K+40u*zbaG0&>3FGlx@v z|C&K>ZtQHTgHIzChW7%}WHM?|I&v}=cPpKL4EOd-SVj>oy$UthRC~?I7zcsajZnU) zUb+)x_ma*`$alBHG<-E&uk5X7w#IPb!9p}n!SpK|4NGNr3zLl5jgJ|CahINz zITYz&5$#z;{U>~v15aU_`oAu@ShA}zSQ~HttNeKP*H~-FqSVjbuJbs>q2$bj0xtuQ zrc&ysk}{weLOM&h%McAwU?AizO6SxnXTT-TP-O)1)+ul{KE_I1%m$o^!XuYSlm5ij z?TkQ^skxYf=J%bO@y=GCa~@3}$ysenn|)cNar|cr*->h@mfe-`^mH)R)BMqJ02e3I zc=OA(A0uEq%3jLjI>Wlwq8`I3yuHkXquBnk_Up7#Z*y47*hl~>x~oLgCZ|a4z5)k; z&!mPEZWh|cN?HxpM#|;nb%ZV(nKimGuIY)^JJr7aVr-1KQmRqV==Y3;;_uECAp8Vq zik9q$Naq609Q2*l?M${YF|)QYUm)V)cjc-9Z3v_@r5FIEV0_I_5=+KS@`ZoPSOo3L zOqWCsgX(6ELez7BF{m;gqf|LyHGiI6KjTV^lRc?eqPHXaT@hh6-3Nd_DD?ztP9i9O zbUstL#(gnxIW!s}Y-Txt^ktZ^dT&0Ls51WT1yAT}Oti#`1?Y&-L;gw5KLXhqeLsM7 z#i55PRF83e#}9iWf(oyzXmt(kTm9MXU8g{$!fsSi>pJ7LEw9RXGT>^0ON?>FY@mpN zmh!qg`KJ^AT@Xb&rO)j>@|%|fO?%1B+lUwSU&wtT2AbMAo^j{lzU^aS+rQ3Bp4u_6 zNY6MuhQmPw@?b(sC_vOJYg;_xrn;fvu{OKbmq`+{h-i^%(dp|`II{XIQ83iFxvFHjgW`Wnf=1x+D zM@jUa44=mF4wbe1U__`RqeCYzo|Ee~?=Y^Z-C(*z1M+c+>5_pGoxF=ObjUKYvNFWf zAR@B>w(WM7I8^nK(sv%bOQ0+2cT@+=&?gnaF*=0V&kV|sb3tx>Q?tG<`%EF@q7rvw z6e;BXkLgW^ol-A){;ac~!PE=e11)sGt(9=xuOhE__AK6>_iRw?;s{Z9{|8d6=&N#e zUtW$d3lpLFB?yEYqyS>rf|6^~3F;%Ht(sl~Z{i0+gzUUC1k%+ z8k=_+vXB(3%g0Rn^zpimR#C*Sxb*Q-3s+_iCwmEj#Om*z?C=Jb^vZk7=f)#~qe zvp8nv_S4(fDJQSI(!Rn1AeflMOh)K3&FXIZ)`3r`x6klTfA$;z)j_(Rv>(jLV9Zhd zx$DAe{yn4PIs1z&#`N*~WPBZQQO~e+^mh*~hT`MdAJgVT>c-jPk=Qa>jT7Up9oMK4 zAN2rUwiu9K!6fDcq=?1$hU0a@RrkA)`UP%i&DBHUCm~uutt8$tv(%QtngFXO+Muy+ znKai{BG9h4S_+MQS6mz>JU{PV-SyO%^Uc{NVysp-$7yb@jSg-tfAV|?AZy>!!%6Jd zKD?jRKb~jveYSYChG#h9-oq}7>AH$rSRd@$z{-<(U|}r0n*74LEl`qnc;l)NByQw) zc7I&Pe}+b?0A~Ue6&Q`?a6)PWnl^=q%f`6UNvaw0(DKDJ^`L*Pw(ie4MH4&ePkaLE zb&zY3-b01%HG291k6yXQptHvr3Z*G{N-~Zye3^_S-JIbVmNn+iW1I?DGqs&5AkIBZfBO^BS zTs;p~1Y7EWAPU5b4+bClT^3$^Tb9{2G&p0 zS;4*Bq0HfiG3%%a4cUngLTcX6?lRo0%ym>AAU|rq10@CGH2OM+yB0@Sc_rsuMfUyd zzS9cc2J<7xZImHd|2KGsj(?xw*a_cws%c3&b}>{7#ftZjp-F#C$0~=GWSGyRAm$x4 z_nlM3<*~iCa3p{7;~lc5THI=OQh4xXZF|@asIi~(Eb6?Jaf41xxUcAg;2{2}aV1Yt z=hn=Z`a+C)4#QL$Jiysig~P@9Texb-i&nFkH4V6cnp?B+&KNx^E1?MzwaqOh@9W=;-&*V@;q zCpI-zAp9Yj_7_BvZ`_nyI-hFXC=M>>WA@Cn-v9O^zgTE^&_|G zv-BQKE_GBXIZ61TD3Th0X;sLUVe%wIhRIqxrD{d*RNxYj3bEAN9;t%pXvtE4as&Sb znuidN&@aE)1A>RBf5K-y*zRj48ipixTS@+*t z{Z@PGJ`D`pU^cx2&?T^->whAC`UlVgEQGt$VOca$(#6~1?g=3x^#FBzmH9z-T5{kg zObxxHwOV2ioJfi1Uq@ig(sBiWb6?({i&$6-Bu->k%tqbq2MS9qea9PhN>9jqk1)+} zwXInLBxpTkIu?re(MSLZa4lc6-9p7BLhm5E{|>1ZXhj(!Q~Yq_v`9`%{`#mk9evC_ zsgga~8tEn-t@dhHsSG-x7>2)miEHN{aP!Q2Gzst??$WGYkj5iaM=esn71;_`r<0TG zr3xDC?5!lOC|220v^Fb6l04i!w@jMoDPT?WZE15a1>{KVSHSclXb%$uMvim@gCf4p z&)#PfJ4BERFBNtL?^t$YACX*&4q^3-UeV!<+ra~#f&kOg@uj=~oMSQ4&ghHfgDiRT zk0nvim4|tjSlTgjN!p7WF+l#4zcoHQn2JO!MWU@!+$(Hht(4a~6)B-2VR}`_tmL4>ERKoCu_J|5U>(JqV==5Uzx6P!zG78YrXT`{SCXDZMZLnFsWk@C3*9~;=f&aZB}5Apt+}M2<)KWXgUm0WZ9#hC*9?`?@*-j z8sd80pY!;2=&R=O9VwwAqN~Pb<4>pkZ5qGym!r#$(ZXmRl0#X(M`i7VfVYZx^{2zY zuK-V~`3^qA^Nm~&8AhWb{iP!{yaVqjXP3BO=a__K@EfaJrQjmPL1( zz~DDxe=G+CO@zeYnN=5*xQmEB8rA-bm0t7tk>fl|@`iLD6(a%OXKZ)-Uoaws!AJ94 zc3G$67ahQiHZk_kj0a}aAz8kgX4l_W?cazGG$j+tRz!=wK}1|3-F5j`Q~v46!7C2fN{$QeYR*AmnAzOhZ z>FV^$?S|=Vo4@8E+VFEEicZEA;=Uo9KmlLpR<(NyGA09X4Xu6GKq>%afFb)$BQR_A zEB(vSrxV8)b1cpsk2V!VsO82-^D1$#cT;P>I}>KnxGN@6Ip{%y(m@>hi5#qLk_SpD zepCDDiWOf;7e>kb7YExKnwUViT=77iL%F2L_H2tZ;4wSaq%@+%p}GK;A)Bw8K&=8+*W{pr2q_7Q*l6;M?( zdW|!pO^?AcEI?6;R;)@(cw7L2WMa?0BQW4~P6=l9eMhPM{Ti_B$npjB&#` z(MKkl6}nT?H;#Rf1%JN1UNUC&-bqd7$IuW>Llk_ua35JfAQ|zW^U<9K zYfF3~q~-v=l&%C?72E-00)j7JU70x=#7ooRP(0b(!}C2#5sVN^q8wv@X1V6&&U@t1 zl9}kGG+av_q_mQFTDHQ}+Rk(H!>!>DCkEKf7?#|rG?_IN3a~6Yct{-^D?`t{cZr&F zbFuMR$Gc6!OpgVbwqPi0rpCgjKM`*xnx;v8PP3T?Y+%4;j_Mij0-env>?^LUGSN!# zXj&yvpP3FNri!dBRJ-j80Vkq{LV(}?E=yvI|ley!EWu|E#Ph+#lN@8q!K34AR|n?F05Q@2p}GYBx3{Z)?n zT>u;5m9@!xtLxAJ$TCwG_o;bh9D-iFDiq?cMN0 ziYOg2cRhsX10eF(H+bW6P97TMw&<;EYmsFIOezsj`p*H1xgP+X?L7&sCd2*ls4Q*- zb?d`NgNstxx;VXFRd#)lSiPW=D4tMq-e>Of1EBpqmyvaeI)}Itj=mWdwB0RA`>>+* zHkdI;_-wSx;p_lS_VKTmbDwZeM+q?aKagDfVDvRie<= z@KmNRHhaZIA^=j@kQ!^#qel^D6zL!8RpsTg#ApU$!gG1>;TWF&Il#y-=IKK{ zEtfOwz-lw7pv-c`z5t$6l|fuSv#iJi)Mwr*+mnUVvM;J1_Fh~AO?nBQM(J!$n(fey zl3F0VmRa~4EFY+`0k+ic9yQ?M<};lO;0_G+MGp`vdeg%@0q+`gRfQ~zUHRmfYZh}C z=7FyZIqx6#qd>aZ1!p%jKKGeEXB=sVQM8N`&a$JnDTw5zY1jE|aC%_I`=@b@f0qpW z&Gf~XqdlLpxCt7SY374G1Z~a}tPBXgDY}yaTQ02EMQKSF=3Enc+dQ|30I&(veQfCv zo?XJYy1rjIT;hSS!;$Kopz654c~!}wWGu&R#_LMqs!yDM=$0I?2yDzCf+G?wR7Y3g1m|0{l3L-bo46bH*t?0vt!8Bkj@fheM3c3b~y6m z%oa3|kch4HsS&iH`pPDcdcNV2L37QK)UI^@o(GqVhHT*~fmb!WgV44yYy7PTr_uhD zi&BfZi8z!gr%=|A-w9m@rniR`1QGwNW4Z(+!?Z9xkja=gZsuKFXtve$5u>yyZ3ncm zAYH7@(#?)DWFQ=SW=7GpBU*F?C7`ycuOVGc{LB&{M`(+Rx5Fg{lCS?OzStc(eJS7! z;5$B3g0A9MC^5WN6kj0&eS<3Du!Vdv`KSECI9))1B=lQdCcb9#rEm;FbI^drE~iJ{ z!6^V@TpVi?aI6NtocoAPS*+YZkEwQ{%UW!=(AO2GED4UcK-$6j&Se)Ywxeel(hfrTVyP34?(d1 zU&na;{?`v-2QS^X#(|msy2XJ@9Js_ml=yoZ4ua{vB@SEy7y^{bpvX9Zg#P;bHGF6f z3B3QUpVWVTe>LGohTTxUeLee{ H$SAKRX literal 0 HcmV?d00001