From a0a8e3a8dd9679b19d2c5bdf81502deba9c78eeb Mon Sep 17 00:00:00 2001 From: JD Date: Wed, 22 Mar 2023 15:54:23 -0700 Subject: [PATCH] Fleet 4.29.0 release notes (#10694) # Checklist for submitter If some of the following don't apply, delete the relevant line. #10608 --------- Co-authored-by: Eric --- articles/fleet-4.29.0.md | 108 ++++++++++++++++++ .../articles/fleet-4.29.0-1600x900@2x.png | Bin 0 -> 53197 bytes 2 files changed, 108 insertions(+) create mode 100644 articles/fleet-4.29.0.md create mode 100644 website/assets/images/articles/fleet-4.29.0-1600x900@2x.png diff --git a/articles/fleet-4.29.0.md b/articles/fleet-4.29.0.md new file mode 100644 index 0000000000..71e56d3d74 --- /dev/null +++ b/articles/fleet-4.29.0.md @@ -0,0 +1,108 @@ +# Fleet 4.29.0 | SSO provides JIT Fleet user roles. + +![Fleet 4.29.0](../website/assets/images/articles/fleet-4.29.0-1600x900@2x.png) + +Fleet 4.29.0 is up and running. Check out the full [changelog](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.29.0) or continue reading to get the highlights. + +For upgrade instructions, see our [upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in the Fleet docs. + +## Highlights + +* SSO provides JIT Fleet user roles +* CIS benchmarks manual intervention +* Critical policies + + +## SSO provides JIT Fleet user roles + +_Available in Fleet Premium and Fleet Ultimate_ + +
+ +
+ +With this update, you can take 🟠 Ownership of Fleet account roles assignment when using Just-in-time (JIT) provisioning. When JIT user provisioning is enabled, Fleet automatically creates a user account upon first login with the configured single sign-on (SSO). The email and full name are copied from the user data in the SSO during the creation process. Large organizations no longer need to create individual users. By default, accounts created via JIT provisioning are assigned the [Global Observer role](https://fleetdm.com/docs/using-fleet/permissions). + +Users created via JIT provisioning can be assigned Fleet roles using SAML custom attributes sent by the IdP in a `SAMLResponse` during login. Global or team roles can be assigned one of the supported values: admin, maintainer, and observer. Fleet will attempt to parse SAML custom attributes. If the account exists, and `enable_jit_role_sync` is true, the Fleet account roles will be updated to match those set in the SAML custom attributes at every login. + +Learn more about [JIT user role setting](https://fleetdm.com/docs/deploying/configuration#just-in-time-jit-user-provisioning). + + + +## CIS benchmarks manual intervention + +_Available in Fleet Premium and Fleet Ultimate_ + +
+ +
+ +The Center for Internet Security (CIS) publishes benchmark documents describing the proper configuration of computers to avoid vulnerabilities addressed therein. Fleet 4.28 included scheduling and running a complete set of [CIS benchmark policies](https://fleetdm.com/docs/using-fleet/cis-benchmarks) as part of Premium and Ultimate. Today, Fleet has added additional macOS 13 Ventura CIS benchmarks that can be detected but require manual intervention. + +CIS benchmark policies represent the consensus-based effort of cybersecurity experts globally to help protect your systems against threats more confidently. Fleet takes 🟠 Ownership toward providing the most comprehensive CIS benchmark policies available. Using Fleet to detect these additional CIS policies will assist you in quickly bringing your fleet into compliance, saving your organization time and money. + +Learn more about [macOS 13.0 Ventura Benchmark manual checks](https://fleetdm.com/docs/using-fleet/cis-benchmarks#mac-os-13-0-ventura-benchmark-manual-checks-that-require-customer-decision). + +### Vulnerability management improvement + +Fleet updated translation rules to provide better 🟢 Results and avoid false positives when reporting on the Docker desktop. With these changes, the Docker desktop is now mapped to the proper CVE, fixing the false positive where the Docker desktop was showing vulnerabilities that should have been associated with the Docker engine. + +## More new features, improvements, and bug fixes + +#### List of MDM features + +* Added activity feed items for enabling and disabling disk encryption with MDM. +* Added FileVault banners on the Host Details and My Device pages. +* Added activities for when macOS disk encryption setting is enabled or disabled. +* Added UI for Fleet MDM managed disk encryption toggling and the disk encryption aggregate data. +* Added support to update a team's disk encryption via the Modify Team (`PATCH /api/latest/fleet/teams/{id}`) endpoint. +* Added a new API endpoint to gate access to an enrollment profile behind Okta authentication. +* Added new configuration values to integrate Okta in the DEP MDM flow. +* Added `GET /mdm/apple/profiles/summary` endpoint. +* Updated API endpoints that use `team_id` query parameter so that `team_id=0 \ +`filters results to include only hosts that are not assigned to any team. +* Adjusted the `aggregated_stats` table to compute and store statistics for "no team" in addition to per-team and for all teams. +* Added MDM profiles status filter to hosts endpoints. +* Added indicators of aggregate host count for each possible status of MDM-enforced mac settings (hidden until 4.30.0). + + + +#### List of other features + +* As part of JIT provisioning, read user roles from SAML custom attributes. +* Added Win 10 policies for CIS Benchmark 18.x. +* Added Win 10 policies for CIS Benchmark 2.3.17.x. +* Added Win 10 policies for CIS Benchmark 2.3.10.x. +* Documented CIS Windows10 Benchmarks 9.2.x to cis policy queries. +* Document CIS Windows10 Benchmarks 9.3.x to cis policy queries. +* Added button to show query on policy results page. +* Run periodic cleanup of pending `cron_stats` outside the `schedule` package to prevent Fleet outages from breaking cron jobs. +* Added an invitation for users to upgrade to Premium when viewing the Premium-only "macOS updates" feature. +* Added an icon on the policy table to indicate if a policy is marked critical. +* Added `"instanceID"` (aka `owner` of `locks`) to `schedule` logging (to help troubleshoot when running multiple Fleet instances). +* Introduce UUIDs to Fleet errors and logs. +* Added EndeavourOS, Manjaro, openSUSE Leap, and Tumbleweed to HostLinuxOSs. +* Global observer can view settings for all teams. +* Team observers can view the team's settings. +* Updated translation rules so that Docker Desktop can be mapped to the correct CPE. +* Pinned Docker image hashes in Dockerfiles for increased security. +* Remove the `ATTACH` check on SQL osquery queries (osquery bug fixed a while ago in 4.6.0). +* Don't return internal error information on Fleet API requests (internal errors are logged to stderr). +* Fixed an issue when applying the configuration YAML returned by `fleetctl get config` with \ +`fleetctl apply` when MDM is not enabled. +* Fixed a bug where `fleetctl trigger` doesn't release the schedule lock when the triggered run spans the regularly scheduled interval. +* Fixed a bug that prevented starting the Fleet server with MDM features if Apple Business Manager (ABM) was not configured. +* Fixed incorrect MDM-related settings documentation and payload response examples. +* Fixed bug to keep team when clicking on policy tab twice. +* Fixed software table links that were cutting off tooltips. + +## Ready to upgrade? + +Visit our [upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in the Fleet docs for instructions on updating to Fleet 4.29.0. + + + + + + + diff --git a/website/assets/images/articles/fleet-4.29.0-1600x900@2x.png b/website/assets/images/articles/fleet-4.29.0-1600x900@2x.png new file mode 100644 index 0000000000000000000000000000000000000000..e4e811418ba9fcfb4f26bb117042a52f7e2ecffd GIT binary patch literal 53197 zcmeEvXIN8B*KQ~RN*6(Tu!0~WNE3tv5wOveqIBs>@0~}(xvuAh9rnzuS#z&@m6`ayRZ&u)KE-+p0)bH9yL;ym1VV*` zK*%X5$be6<2HIl4kCV1{pE^JwOqam_i0(bQxDI?sk;y}J3S>0eMSxmXmIGi?Wx7zUx8o3E+hZ@ zSbLJ|zmImr6#sdIe}WMI=aG&Z`JX4qzplsH_@^cUEdD{_A0+;<1i>2qk?FA}{z2j& zB>p)`0tWs$$zx6YgTy~bK>j(&V-Wmvk_2n`2Z?`>_~#^#G4Rhx5@_KcB>q9-pOYk5 z!#^i^tcib+_5MZ@$sYovc%Kcny`aDP+=%yKwWTE$ znKCtlN4=@(ts6V7194lfX7_#?Q4Dxv=WZp0Iy#1U{&83iy!m^-o%UFIuA4;v*U^JL zF>tK$w;^Xpx&A%?zcihM|M&4d1M=gnfdL{^zg%CjO`Df8c`u z$08vA%;_J2{G-f&PU1hD0RQJC{yB+%PU1fn0r?kY{)?;sWfK3Aw*PR#zclq{!AZ`s+3&zgRlYOIu!G0Ipp4}Ce5SMsBb2@}_n zTvb$#ovTaWkNFfA+ElvF{83u3YD`R;Q6N-VK&Jz^e0tQ(E`voD-gFA-gW~vr-u_mF zwa)M6YquDoJp-$K%wFF`>X|~iMt#Dzz5=g^+Pn?S9y%k%CW^T|ztIwNOI(LmhGxZE ziO!yrv08!NW29%Cp?F(gEmT@MwT{lXfBw!gYwR1bln`>lgeiqOMc%{YIAY)`E!W48 z$P~lTIBuhfgYd4xRpU>zb@%VmzgqSx;QvPRRz^DG`~mZTyX-c#u4broyT2jhOeba8 zRIphBz3-?{D|N%(gW-b2?ELq_AZ5a)A^XqBtpmWRR0 zbtc+2LGq`4$`Qe*VC`R?kkb1QBx}11W@ZtO8k)}^eh76+_z?OqKrU>qYLxS_zm|`S zHljiItmnpb1%*ue>MS;XZ)CPmP(_>R>6t*T&`P1xk~^VL+b|fQ%0i3bi~G!hoQk_^dxaD)1NK+>!QZ8 z8q+9bI1e|JGhY(K11>3p;>q{*hJFpI>N|~_v*1vyBFo#+vr0;WQMZ4X5mAC#e9{{aGX(Lbu)|(JM!0jVrl+mh(Tf18QdY zd6ugd7Qvx4IZb^g6XBkGA#0WraqMDnuDIRrfh)(O zt4M*BOs>N7*pf+DYyDEYXo*B ztcIAb*8w`#)zo7(DROsHI1Cr5*buv*U}Wzs{a5Tec(Dta5d|(9)5ZI{H0m(or$I1{ z?QMBR9mhI#Rqc{!S%K96UcRZ&(CmtfX$I;F+9S6*84%K*1E&c{RJno|@N0YJZ%QX8!zW}7qtvXD=DqwUL7vDoMt&}U}LGT+4hq_Rp!$81x5xB&l#dRn^J$Ax4m*Z znwRHSD9UAovCUvU9-R!V(nPGY^ph&qQAp$e^HikBc5R7Q+q zuIr;$0w#snow7yMJ2$Q{DTDIo4T-wmvs_pSFnv^eZMc7zKzs0yV5u8)K!wUJtzK<7b+JWS@{TRd9v zKbcKLD1I>?glcKd4*f)xCfplW$V$)FTQABI@$GuI_mRr+S}1>oZuPK+Q-Ry%<5}Pf z6mVeI{1(P}A#N$XvfRl=CS&RmmFJeAYigu|>3vl48rm9^9PKkv*g%335+CB#Eekq$ zE&Z|1&+iVhJJ31+I!=vc+H5(!>un>s?SEtN_b>-xF(&8nTWg3CnF{^tnB7tu^t;g1 zDr0_u8tCCLW)eX?8dqIrHJ?@YU(HeCHAgq9IUB?-)X3V9@q{1ySIftJo34NcE>p>H1!?sT0l_y&DP7#KGe7;gU1{fW`h}^^*EOi&4 zL3`1{O3#jzrMzl`=eib~QVHp0Tbb{T^QyN9W^o@+U^=!Oar7&3#9{eO%#8)To>vi~ zEN9_>Hcvdr2e%5}BHn`AP%iE{V{aaPht>YIV&9}i$ zI<_l(zPl<*Eya-E)HZZ#g%QLkWUPB+Ta7RoB=`cT7-RtJM+y3?R{tSqf*1}BKD*arZEb5#H4e71 zvrspi*#8Gy{zt1)dRRzmCgvqRej_IKBTZD)#(w!tE20@o`EQ|rdEhA?QIysPVUU@M zR*sh4Ak+G*I-lBF2PPZkCv2U=xvwG#VjXYSZBl#Z>1;WPZUs^&NWXwAA=0K-^SxlDM&!jojy}BDc=nK`}v&t1EwsZ$XboPQ2x52Xqy# zt+il+M+wDm4?g5boq=WN({+s)s>`Ir7EAwjII@G;wm7|eW6uv%9t5p*u+<-0?mASLaSTSg5Z#%# zH7&b!_W1ooV^1q^8Lb_pTx&uxju@jZHc15gVN#PXx#4W1xv}~y8XF}jt#?=V1% zc$>SP|Cqi8u~KN_2Q}Z>q{t&Cp$DjiWd(|4rGI>3BZ)mHpp<`pr`} z`n8NKi#5XyF-CjYE%eAUG`CDnd|3w~Rk^3P%6AQN*4cMlX$ZY;?l*(IO7gDie^NH_ zAj^iKlE3K_U1>RJNHRnv4MqzDph6q`Y5#(f1@D~v*hWWLYm`N8NFNoULT}R}$~S9q zL8cnt048s%BsRnl7>?%#sD-d!V;ok3V!fx^QZp!d$m0)MK8TC6x23*;H5XuWQ=dQv za}gI~x+*uWED>-A|9<2J0~muUBxBYXzdn(^GJMd`F^q;)o^3NVwG`Ilp9F*i;>VzO z3k+SBmE{il1l>n`1g-4ubT71^VPJLEP4Om2MT8iZhkdY^o8}fO+5B=D=e}vg;LNh8 zr%8W$*F(-RkLy6l&Pf=+1fS|W8bqz^e29JV)-(sLJiJJMcW`BYZ9EV_a~GAK+f?p{ zjGq;&tZ{ER&Atl)9qcHYD*@ZcM!#01_^BQ6aA+?*xJr>Rcez{AK}kEr5CMH1)=12v<`yP?oH< zE9PJ<>@2m}_8~UQR7IthzYMqhE;UAAZA3HlV%q$`h^Ob|$AtRW?gqj}B%T`j;hu%{ z1;)NRJKvJxfg1b#SoP9$HX|iBhpHU+<@)K`8P{#A%4=y~-oWB9JN=8h8Y1BiTN~T4 z3e!<9EC#JXYz9ufppdyUt##q!q|a$ItU8&y~%g-@TX-ll=so<7O<`=oiy zh%>ut>gs{;fW2wHj+IcrkO|H};g=u%VYLtuW9B_qFrlIO$*e7a{6kk}TLgm!o z!kMCBwSOVOh=;^B5UX1ACfPi=c_9n~vkW|2*{!#56qw2iNS}?i9AaMqW1}XV7&~nL zKoeY-aA2MS*M)BGsd3y|#m45|UpiOAM=m_ClLd+|=PlH!3k{KpKp+gkodk z1I|{W<6c*->C4}cwA)lWoauD+QZ;J1q??-|vWuI{UX!Ln93u478~6xYq26adcwkjp z6$2np+_zdkHZ<6!Lm^Y3pHDIOU}KS1%Lqq1Y`F8}!FmxGy<*HN>G(8urvuH6s4H$?^SGSQWmg8AE*+EAMf6lnka3DEnG|Fv%IE%|2 z&CFdIUO}N~qnro(*rwBl*Y4B%u#XmV>+J_NOf~-c_|=N7{Nn0(!Q}&smZYwbwzh_T z{abXQv`_*KAx-gYem|Q+M$|eXv|5{u!RO3m!ptk~bcjjS0r;)X(#AO=JHy?9zKX^{Vg9LPxIoWBheF7py6x|mfkjkn|Wg;mw zK`ng^dI$||a$gtZK##?w`9sl6S#r>FeG77Q@?x`n==5~MROUw00qW)CI|xL&d}BaRW)z z@6igOYm0h}vDu}(eKa(+6Mv%X<<4emiC1BWjBmVxn(TLjxx zsP!toSONLzrg_!F)7V_rvJ6x2KCh~C7D4y|bvXtq%tll1m7GlNJY^ z83Z!-kly_aAJoPB@Y@r~0Rlb!EX9Y+kO|p^RXvsj?}>2K|8#AaI_e6&o4d2|dc3UI zn=oj*z|mjUv~$-tI*Jgtu)QQW;Xaxjg3PwhKuAL%uF7(I8w=#pPhkNT;4{!Bew{{w zKW#PSwl^l`)))yH8Jq;9N`MKH!Bt>eG@(I-z8C`W3P*vo4MFOwkU|lAUpwmKpjCq4 z>p(-|O&kI_tWbunH@U8F?aI6CHXr>B0yzryAu6=e*ct6AsMx5j72!|&1^5*yX1;HY1@o3Xi6Uku+n-RyFLc$F+tJi{F`xbcT_Q1tq-}+|@5aYw6BVQ+(u_?0q-}cWt~;C32Pe+{dTk z8Bdog*HHU9{iB7K^FM$OIIVjauQdUP3caSTw_PR?h#at`auR`Cf;{yB=Hjg5T0Qu8 z;o(5&4|s_ao(C~s|9%*K^kEZ!#Z38!J}*ab2(a~D!f%m^AkLzTEYy;rdVorwZ>0?5iQns8lKH z`vCS=$V)4aTbtX-h1x^uOJTlA7KgagH$uF0SFjNqqSr2XUD%6da}PcT-%!avlD;QtdIB{3vub%J4CPt^iZRd z{YHqSxDw3m_EjuGaV-01L%fjq`(giC(;zM+AMU4zmh zXmQQ$65V@^!{MU6?TU_*J}NK%M>$(~<$Tqk^){Alcv<8Xq(-L5RK6cqxH1OydO&AP z%7p8i(OOStv4UQ}jfTI_F7mlrfw>|>cmE!mKy;3HL?spoZNKAZ&!q8QR+OT6e=clf zpiD!=TljoJ4el`fIjam$+zt2H=YLm3a}iuoM7yePc4%n%60K2R4~wcW%iX88o08K9 z2rT+Z@pG^1sldKZ8LdfNl@>?bKciUm@{_31ZGKYwZrsRe6-R_^^-Tg&9pin0@e=Rk zp{Bd%ywk!aLw_V+u9D7@o(s@oepTHUnvH{wzNSL-n85!u-w1uf)**TM2QAxK6}7=b zLB#6vv8Evsp&*=9SfTD{w8b!>?>j8UkeP1W0`9TJ)de-^fqqJDG|bV`5vmbF+}y1c zui{a8BScC(@lBNXO!?nY9^brd3s_l*=*GlbJJikS2DZ?{V4hgd_Cd1Ejco7p@yiHa ziKa+14%PX-P_L$(=6+o0_YLl17^D7vaVC+RkTP1KMs&x@yVq*`TlFwMW;m$|;j!X9 zwnOWQiNWneHiSfFWxW+N+5A#Hmyhc2NU@#`Vwg$`)n`AJAx9E4^u*3QsS6}$6cn%7 z1jF?c<2OE)yVb;!TM;kRSjOuIyKMwQ#5niaRMlB5n~)D8jn^;43Z*UAZ-s=c*3_RUsKGC%F{dFiq5PbZTLbx2 zeQXu)U)NGbk6(~Ub<W7CXxx}&Dse~!E^Pp;SE>*qa?NVeuQ zs)%OlV=Gy!Fd@4Q!D8d|1d%LGB7t9D+o|<0NuEDc-392RKI8k1q~*%P&(kj^-zZ(* z4fd~97*}8U#t>kJz0ymAFm7oe7pUaTDt9lfC%A29A3Ug;S+L?S?9D{3dd`d@n1Rh= zHbLdOaA;US7A``yZJ)G??@S;y+}4ufQ`3UIVw24#p>?CX8H8}(z#OD^_&Jb#awpo> zf|SBvM(?)nkMbl_d3)MoBj)db>w~AaCTO>jg*h#W_56ae5ECra?+7Tjix7@!yRA2G zge>yvZ#5~LWoOd$cbtXs%~fuMy|nWDX`XJsXS9L77Kp{J5c&$sgI?LZ%o5jlIY>!l zW8&mj%AdyQ1`mXVybRk(3+eC?C9pTgb7-4vo$wvIG1vO2012wXpc8N)Nhe;Z-ms7_9D-SwFQnV; zN~IGboB`O8WbD1DgAXE3^4HC$su`vt7{-|7Tn?J*XulWyetzRJX^`JXZspLl#=cOK z{&9lA{lqeW02`VGN+alr-hi<;Lc6avy1WJkCi=(F+TkSfHRX@TPOHD04E>J=kJo0^ z-09r)!sgbdnBi1)oz;N&im}yMk41@@#1H8D4Wc$t2YC@zcphfDh_Qm8e0FBMTKI)# zt^-bVq8HHOxiQz74OO)*QjVR)0u~=ZVNK2cFJOG2CR2m}w1RKsO88BqoDB8idvW9b z?lU8!`rK?vJ&V~~a&qDB3>NM?|8a4%c(WNY?CS~lt?&RmHNBkhH1j!suO@?s{pYZ6 z6}MV%xw)&o+#!J4oUlcEo6!hy}<`f5%k- z)tHC`!OIi2KVCx4<`ZX*{g{fUb~Pi=GW$B#pDrvBB)nDn2@ZG}gEM6+Yo;>y)h-iCLO2D8pFg zwtg}QkfL`cIuI0k1X$d)FJeidO1>7)e`Yc;T#*hk5ZiK`Luu@ zmAT*QYI1U`=+1M{j=+ZO;sTvmL0!0Z0@cnc=pN+?uy#aYUJD4U37TB5tN0$c3HU}B zeOKzR!eFh>N(&0SJ10Quv5Ry*6Z0kA0{EB1j@oiCK@N;LD8#y!95vFor7lJxo>p%u zp1hb`xF#a&En%HGVt7<&1FwQ{Z-7_S+p)LW@kz={M|w$-r0cX|M~nTy@fCj)1=_rGQs9ziGDoXFPLR(U9@o8fkc z!q{cp)z*U`_D}O8f-yx?4jYYrLscho7fUnlO6e?uBaEl7hA-Zm&Wk^uz< zpHv4!w5tI^B?}1ax7ay-8X>AJ&ut)@+nwJe;fTa4d_HIp%#dvReE4_%6z8}-# zK-4B|wb=E)#eGinc5evdQWuU+WTsi&+VJ?112xYTY_`Hj zbD&RcTnAy(AO!*7UZ_ySjSz1ZLL<^K$ywpra4;%y;}imFt{X|9`~H^>Se&S%>DS8)eFoi){Z z0bBkvQ}R0gh(e_RGmXYj4l6A#{J7?f_y6lg%|sAvtw$J=|!S-j`MEU|l|xV$T? zZaMB&`~(dGhrHk}n){v$Q?Bh_t>SCu)qW^(=}=X3hwkpUgFsy=Zr!1c5Ew$v)DHkX zd0v7`2NuGy0p>{&_sBG{3uVRqK3C%|%W^Ftuq`E<85fe!Ih%)DHxjm9<4SHG#Cr$= zsUzU?gRba?8*1%#b&0sGdoObCxw~{bqupDgth%aD{fLHzwQ=bjt3ZB?FCtza*0+0S zg-Jr@MxW~9(y&h1Xvsq4@XKtArDiQWz>p#M5GbM^=H((cvb(-JCD5+Ls-WoYb>^v` zIv|t&+w4&sYTkJFR*6&}Y~%LGo<~D%kdgjbx!rwS=_P5q{u@LP^>C888_Lq3MZ=^o z*rb%(qnmRM%v*?dMufOFfBMokkN|O)-&p^j%+JpE&y#T4%u9bOiW2I1XOZHuIAO)t z*R}dNty0m~f*{mUZW#d(EAFcFjxvH13|Eb+W5-$K3aq;iO0fD^X^^Ae08su4?8)!5 zP+i+6p7V&f)4KlbXXL^=>=ss(0a9}&gG4-~N$r4{I6rJThhpLGxy^YqCmu1TR7TsF zU^jHA=_NqkpTEK7doF!V+afIPcB=ok+1|eHpBR>I?bDmg_p_#-l5`m9+mFs1G^yOp z`dX=|+*kQc5JeV!zUlHup_aMvRi|zqen}7x@TWmHcY;&aP670NS|V);1*BP;XTDL- zG-WFHYTaM;TGy@~bApN%F_F5h*(ipbpGRQ-Xe~7;rWf_B%9h2IrE*JS#2zHKGF7eR zJpm5mZ4H_|ugz?9Y$5v^pRKd2bmS;_sZ^Y@H}}FE_)o8nsTUgD73KJ8-dyM)-*MQS z`PH3ghOHuV3k;S#S%* zXN&nM@<1>aqSsglDy4158D;(7E3zT%(U0v$D>@2AD9-N@!Jqb$KvQ;G(?@Mw@*B*X z`lE*5*GUy-J0QJ)sAeM=p=X7R`_@>vRVKA%G&V9=IH924|0t8ud_rV4%9-|651R|9 zB?xfP4|=)#0&HUTu|T9*Zr1+MuKA=*paz&=gN~riix#20ZuDx0%IA}`k)b1py-JX1 zHSJEp_WP}*yQb|QI8BPD9`plwaO}@3YkP2b*PnG~vU5s^-Ewi4jpvaZkDy9YboP_v z9p5v@seDIv#@%1bFu&7*&0UkoWJ*jUKQGZ1|B`O$$U8UV2{tu|%6P^Zh`}tLg`KeR zHd`tBh%d(cRKU2{87#_#DUa+w1af^ttJvLo*%(%`ro;wKtd+$`zPCb#o3Yu?)c__4 z(On=Dd@m;zX?=M>zxzjM$n!vt7b{$T{VXA!4V@X>`1SLg#gm#nh~U)~sO5=|uIsg0 z6vjZ9IUTHkmA8s@U4P~0-M(|yxfWo_j1y9TAgYScWFA>ofQl`w9ypAPOPg};{t!2r zC_;DU3T_SbiyS(LO7A|(!0ii6S99yVvB?;x_v)x%hNzI;{4}=%}`K`w`DkGA+6dT@D}2tGJtaPa!rG7m`dNnGbCFd9P5IZ>JAm8*}N=wGNtU~MvT|4-Z zfYj_AmAB5pyR8?+L6svNTXT9wwiQVkDSc_hK*4C{*74>K%_QQx8L0h19s~&JJ|3n@ zFV^$2#Z=mipMJoEBK>13RTzyra@s2wz?clkuFR6B+ZRKn%5EUv4IN(_pIoE zGN%vp5?GPk&N{T@*MSS_x>n!Z7_~uE3-Z47#4%(Xk#^TnsT0ykdNXmXY;*0!XX57M zbc^5FLzhh3K5(9qt&p2bYY|8jL8@@>bAD*BZaTmA8b4j9CFm1@M$SdvyXN*)?pLC_ zn~9MOXG6NQckc9neCb;Dk3&O#iA$OmvInu%q8F`>-apC@fR5;AyE0B~^u2a~b!CZ^ zQa}szR<}lW&+6Gat5EwkZ0CmnDG<h9DH6_I-mI^(LRFoJ@l{M?kBEi2# zZfc4DdHoB!3ht0v)7)oXMOQa`>POX6ElF&Pw1b7M0T2n)|9;Tkf6!Ge1Q7y4KfAhK zu{#Ld4!$RZHTkG+Z9p;j$hM=o;}k-LP0QsP`v-TDSL@^tn09+u4UX;H{L`@pq;;J3 z>qv&>h@1w=!imUamo8|IySPz)=cEAc^MDO*bi9t8&R!AK2Sn%y*`*3T7@OI4DVaq- zWw(%H^S)k?i?=m++eGAicGn|#%_7MXxaf5)pdg=nnS<3-3je~-&SP^c6pH#?m` z%TgR!&(3NhzT>>XFQ{-!X`shccmLI3rOSsh`NkAqI7#tyL&%Qpfx`j_aex=qx&7g< zVCJIdjxtMEk)x$2UO0)kt|cKzdj7E5yb03y{-wxK+(&`LPr{MPiEY$ore+~th?pgw zq?I2A^brhHOO7fljuOYiB=`9DzJ@Vdu|O7H(KR~t9|EingcdS8rs`PFpb&G2t@?Th-(&DdC)ATx=!jFhl!k49i zQv29pX+Cv&w}$$QYpK)|`rfMWvQK3t3W@mY12Tm0nikC%0z5BSiK>446?zlaoWW`Q z(zy(<4vR@?{E+h(k4OOiHFNK`Na1HE9v@1WtMm6*N}_HgoZ*pSsdbhHy1yVV+a};JC}v z?OmHtp`3W0G(h?NT29vG`yt|VY+_a+!`5rT=WiyPc`vXj0d?gNq4{yGkmJPccz5hK z)7GO|HBx@&-7^BbRVZI}<+*@%_ZK0PWRr!AD^*n7qoZX9$X{gXeHocna(Pn^6#9v; znM5{BN4R)$;TLOubh-pdv|}JMx3&KenDT_5gDmp z2AzrH7rO=ytuhXDv(;#ewhN7=Ky6?s?mTjlZzyb{HC*`(2({+r5{7mP^I}Q?aqg(A zt0(pN{5$)Ba>#fi-ya+IB&J);O$G+{xu5Pd*&UK5J3mFuCYBh0oc%K@ z{xzatyy02FQ)P72(%egOvD!s+A7`i5&||WDJH5uw6j!uGO~A7^yXiKUBXd=Y1ktJT zoLo`*B8~LIyzA)O1}aO1hI2NOl{;po)N|1=?<6KNH!K>)HozHp_JuwS3U@k#30V5s z_(y#!TF+i@-C|!anq(1m4yDnYbI;mkJpadzQ_t*Ze_4Je7P`MVJaZ^&e^@qkj9{`>FBb`4`!aV(ti)KCdcRWt@ z_q?BLjn>@mD{@?&iq~SE35s{?dJFQdI<$&M+I8c&kd$^8G@8_)4I4@6%ZKgv1Q({(9RXdv%*Ols*tR+aKf>=qKV*rBn3^ibCHFRMc^?QAr3= zyeCDP~1NPZt^29MutKsWaDiU}Qmd(crqHvWtnbo0Ey}n%8 zxDMQBXDGxxSc!eRVr6ISK26$Md#5`(zUDWL1+Jvb#cBKMVe zOnk$j>9Gakk1!+d7kL}6Pj?26(aVV}z*^rL!CWdu>45kVG(8D9vUB!GbTZ;c#&6%n zvKs|sz|F6B?I#gE{oUjOKhlhD%kN8MAI?x0+N$^JI{;CQRxI_=E;QjY{kK=vB)>8p zHj;%Ur5C@PS#fBoVubvh7k5!r{?v6tK%zQW%u6InSAWIN$Ll+7Ca$JUKbTSf$G5&m zs_LlED9dE?!jWtsuDHWJKZA;}S2UrxNTQ%_?b#$B$3{LTCV>(ssS~z4>;lf+P6}F& zeEDG8s4DnuV(9==uE;?1eRbRkY45S|b%kWO$aSO6Dtly{Q_@*lFh`0-yGU9GeQ*}T z2G9_)3m@7>{GvzLyE|5_6(?H?C=2;K;Zk6an`wl_NET3j* z<%>$_t_A|kqQmy2qk1*%MSrI|cL8EXx?*aPZ3?K?%k=ojkI(CJ0RA!HK3Vz@ODgeQ zmL2iU^+7;bw&}(i(}q_Y4Yeh?D;5XD;wt-`8Xi!#%c(^sOMU|zhv6IB`4$${VJY#b zwWolDrbmZZYbX$3+wnJ5HL@iaK72Sp=s%%+S-!m|KnyVtvBag?Gu&zJRPcid?fp!| zVyy~A!+@N<_IKzfsIG1=TT<(1)U7HTzzLa00uD*D5_6%yYid{5RBGkf=mB*hW^P@V zB5A<1pP0{MFBxwJxe1b0&Xf>gh2CNOS&LtI(!`cJ`2%;P%K2zN?~pXP3u$^7Y=g{rfZvzTb{l@*-GnEh|L4ZmskS1`y< znBv`i&i$&2mB)4mKhb}xVx69^NSy%$cz2|wbl#)0%fu#sQi!cV+88!>`9^Vlq^1C^ zpT-|~|65i0k;&>+>CG!pmKTj%cSvg2rQHYfhS18r#*}v%hkcMcEMnG%{M&X1l2{9? zu>H2~j&$7xPGtQVk?_n(LY^KxrJY3`%<8hVJYL4IO^=t0k981@RbqpU8= zH3$(J;^$Jg#^uBVS!Xe5?r8v@FBXkJlGDd_a&4;vhHN+A`Ip|7`f1)Y(O}c2#Y#Er zRn&LtJea+$YvCvQY%E(piLloK4n@&Q-%scQIz@xK#VeHIZE%1t2F`I=$iBbt9+wi3 zf2UvxFdNXbez2r?~C51r(km-in)xgos zYgi0V4HWugkD+V4N-8Z8I1gxz5tNdz0fV*AX}sT|h?onq>c9(W%^4|OG-^bDc4He7 z`1goZR8U-v%VPQ$LH!)Xwuy8?d-!coa%db52?f~g5(GK6--xB$)`&V5v){u~~Aou*=*qYxlx1M{lk8`<`n)?yjb?v>?9 zVqjRA>I2xV`9Wzy8+2=~J%qOu@Lf-olP|^wq~*mct$o)BqZ7YAU9T84$gO(@H#{uO zsKBX_*&&DIZ6OOAk0}&pYDH%NgF_Oh@mYkG7}lzxKjyjwP?#=2LVm8N^=ae)X2hxi zHBldIDBOv?Oq-dYntN_<*g9KjA|(}=Mrcp1@cOwNL>|hhdZeR%d%A-L()_%6hGA;E z7}qcEcCZGdDe#n|^MTb)+Nv880M5L%DJdXSpI=y=xOpe8rY9&1Ag+zvmMA&KtIzEr zi?r8L+jG)UJ*?_l%5xf5RVad5S2Lkmth6fBHu2ti{1j7Oz}=sDQapaOo!rq1aZGd& z=Arii)JxaA$4z7`0JbhV-A0#h`l+*^&*vivj89fwJ$KpNN+R?9(v{*o$qGYiarm_T z^(RZ@aFO1z={Yaa5ZLM{V1FtmN5d+*cYHEXDMCUZ9-3bvjaJ3GtQt1Cmj3f=xvNcMJe1M8ofd&FsRI)LfEk78CU3KfC+EV(+ zp|1M+`t8A<+hWDQ-4_QxCc1f^eB~cJV?sH946Xw=xiHi$2WWxYz|k-K5OZ#N&Q@76h9Xn z70f0kIEGz=F?NT-Bq8%xA754uEv{O5d>f>uKSyY};r4kaROnIi-IGgXfNq2 z18EnTwEj186~&wDOKEG6FLp-U^&`c4^i|)f0sjPCJp?t)Ur&ix?%qR~jYHsZMZ_^z zwBbVHDyBdQKL@U+PBw;{tcrrQK6WmRYOai*joXZZq?rMJ54gopUazh6gGVVI>j5Ie z`3M>8=Vx-1vn895#E_o2u^R$uaBUeo9S^TkUva<=-(p07%S^yAF0)Cr#lotG#)*~U zgUa{h@L3IRV+yLY*D!1aaNogWcXna!Kb``jHs;8D zWaCaVcX~_S*9|6d7{PSnUi7g6($HPDk}V1 zz;sF_c$NTs(-0tb^P9k#HHT-?=M#|BW|h^^igaJYr|O$8Q6JItGmY|bSy`LcsbDD+cul>eD9HCLc?oE8^YXG>oo0qr6~L0Vbmd{>iPT8Z-H161@P1&K(l{^kx%t zHf)V^DD5~6;7AQ$8#y(Pk1`zdva;?8TFCEbH^a zaE6{5o0t@fNhHzt=c5yB)X@LE5gH zY;J$>`Yi|IlnlfvFz6)yzD704rAl7!UQ}fHN0a;gU+AU0`+_#Jzk`<{>eP02fAD6| z&R=x<>I`TxW`()|)kEwDbe6;44F#@+ee-y=LMDg$=}XKdSD3r@mM5PDxT&$!C)W2v zCDM;%>3azfB*=YqQqHV5qj3xXSwhe{W0o_(?ANO|8`BqPV1{esh@Fpb%;MiRvn~SR zY+o6~VF17(LC%4)%Fcfc{eZAh#_l7HYi^*^kNFLdDNdiIMNL6g)RdDw8yPu{#0x zzTmw4W}qh;r}4&h{ahct&B4pTP8O?&c+Fz>F_>NI9> z+>6b~K!12VxEVP)0^A#{u)vDzdFGDbOaX|dJ-`FC^elAzG}X!_GzF4I%%Xlf)u-Y9 zn2@Ro+XK#amU|FmtrJ7kdCv?1bq|rXiJAm#oob!{R9g%BN3EsS*G5wruhCd+9G^>_ zE?@EmyhKAZJTVy0$Xg>1YEwew)i#~#du$IX~k#rYoOI33g=?{_!18A$&t@XS) zM8fcLF-_$v6_4kZ{ws!^ubg=|J26r&dZq38&Mk?PP2C-Vg)lAf!igNdPF66|qMbnN zw=>mo0uGti0co@7t?G#iKHN0};UME+N0(?A!zu=EWXIGamP%JTF?$}kY4Hc=jqax#l~%&`AKgt8Lv;if6#CzrMW+0g}o}@ z02gz1M^noD9m#=yxk(O7@~F@oTT@COxWgQ^9|N|bYB|7TEjT1%POE73(+@8B-qpE5 zvn<9RgV6}Ft=}asZP1250c)VDh&+Fj2as-P;%kG54%Hu^-g6!}fmU3IIrFnqUMOeG zM6o*T6)JH+XipHcm+#xxd~Tcl^qTNZWWr1T^ej&H5F3*{BbU-OnES$qA&2MDo-~M! zjlNefXIxxhRM7W|9VJQJCJMW+AL6}d)G@w)mZZu-h7w`+ab`}Lj1Dl|fFl+R)R(?E zks|;P-su*3m-cHObNJxBGOA`Ht;tp>8gksIIefiy~= zY=Cqw{Gguvl_URq@tI=vdV#WxV8vt!r*AQT6v@1q^90x46mhYVF;`0DxvQJiuYU9H9|$e~Ud6;cyKpY7pB13Y!?LH*WWXHnf`H-xQgmRW&Hp^sA?Iud zLZ5^J64$0a@L5n-mjUoY=>t2-#g|rR&2? zyD9kc2>nKDKFM%5$*xP~frmd-aL*$|+%w1O8N!&tcrHXRcZ#pfP}qcd@{qRnjnvk| zT4gfqc!d|6OYe^CYN%NPi{}a|!K3!w;Id#ITwyhvYW5JNzmkRtNoy)Bf=z~wRI#DY zi=tKnI3%Yu(Wbxls=WX`UjC+tMqzE#{NS5r;~q9Su@`7#ITSdhCF8xFtpKc?c?nkK zI++A)yrkoCW65?$G1uHK;3?)Ub;G&Iu9sV0WxfUx%0#C^{O0n>1GsCTLoh8qS+Y{6 zfP-}mmQ>IFu6J9EZmykCtui#gujV9+_k28)phx=$fTftDIGf6nRJb>PF?_Re+cJ5*R)F0Upg3E z=ZTopju#7FT`Dkd`T*Rqv*>Bh&ui}ZvWADjiE|Jj}8pnNvG;#`^2?qj^d1F?} zM7M9ic}j!|8Eni}N4ZnNS9bpb8&;sK?twfLHq~Ex6<3Y*zkYB)R!pTdvxbdxk-Pe& zbI%)wBk{Fj-q(q-y7=q^)%g+k7VHV3&8qz=ez*3Ov=cJ3?QB@o+*WhH_h@1AF!J~P zz%j`Kv}8x&NIwfjlb4r@M}FRKVnD1jO~C(kBc$`PcGWE6>R@+K_9zs9D=9qD zt$-D7^v%hF1u$J8d9uKn=f0y#)~u_*{eJR+%YR}`r<5;iZ!hbKo%R;1xcvv*&dUUs zI{noEGdA|+4x<7C8DU*N1gjKw5Z)Ce8sbi8yiXl`f_ltxYQB8Onfcyud%$o^e$|@R z;9hCe+^?r*P8wVp^n;*GDo5GJFj$Fs5qy@ac{X$fH{C!4iCgWwMzYj-6}Wl86AOf+ zF94w)pAC9@(!p~0!_yn^H37sR=hg26Hez<-(o%hzTZIPJ~WpMj~BG()uair}` za8YJZAC~hT#Z1O)E%?rt6M$#rA;!msnMIgg^z@%h0aE%7uhn59h%w|2359UdyTadA zsT|1nf;z)m(Kj?Fg%oE0Ki@JsK0SULx@JCMi3ykEYe{K*>&%NYJ0gyMYgsNFM z|E-~o(1-Qc0#vwz8;6hjOarLag!8KM-AsjdU99xSAFX&vX#v?P;8l)p5bENh`|hN) zaJ4=F&J}=t(}dw2vNC_ zQXwtF725Nw6)t-Qx1YvdnQeXhtY2q!txPMYYD*`5vyxM>fkOm5cpt*wMl>(u*FUfZ zAP_ZgjQ>gpQpx48$Avueo$S0BKl_2;%{OBw?dhcTm(JP@_U0wlsN}sg7I!Tdd>-^AEmw1U`DN`Vm39E#WP zir(0P=dJu@wyy6*o(s||K;jhi1U#-qrZvung7j2Se<_+q>P`H)SH0=ll6&Jy2#jVK znV!R$Uqfg%j}dzR2BL*{QBO9x@%n0w5RGQ|ZN}IuLU+3Eq80c$YUFoOpNh%KSO5}d zN9ZU6ODzb*pFB`VR_;%`Vm(6TQ<`SOu>xLz8VtS^ZQHQz2m)6>Xdpbk(;+cu3*?LF zs6^hx%g(znCZ0@=)aotie8b+1`1W!qvL^Hm$>ujPYTO5#vEg_+m7+Wskqs+I&gw0`@nzEgfbFDVkl$fN@F!nNraRAPhS=_t zAy#d2Fke4z?n(={+O<1amCTJl&&z!=<@yY`fte@;M)}BJja;>0?K;k|C3-b5Q{SQn zmj<51sBk^LoIuAw^*iLpNrv<7xSyS}I13Hn8j+9aaIVqbLo=kL3WBuMkR#ol z!_0i^Mtt}8{@BN{fA0f-s3UU6TIag*JTKTuD~JT_c3qur<6dgL~4$f`bhW~6eM$1)1zWSVB!9F-W;7HF#B69gzeSv|rXyV(j zOnF{rW3CR1AQho2Ciz(DJ+q9!{aQ&2=zK%+25Xl82f3{z_{*MGt}_=MTZ|60VQNj* zh|Iq$$mO{MrErH7L&s!2!s5{+xwub*GyR*>s#gWZ&hl9Twg+`jUV ztzHV{GGS6=I#dQRYdfqD-VJLe`e?mt&|2|%wx{PjbzT+Ph!hk%@%TYFETB!)5(7P(;$6b%)VI%Ba>Y2*aw4nkY3VjwVa zKBnJ_D7s+c3Kz%k^3&DiVP@~rl0IOkGJ1(tK4#pVLFO&9=9ppv!kPJl#QLe`Cx)9+ z{*<8B0%o6JoK#wAmD`6rg9p`fE7ACd=_(ACR>DPYaO%gi4^58UJ5=``4i7gV&T}9! zb{g<@?6Zboc}g*0tr!22M0J_3@$L?-OUerP?`*tf7{M>}b@&jvOE?d) zAO!99t%KdZ0Kv&)u9?W)E=1IN^Zl*Jur_tBSpXT#N}t%fNFvdAD)1ug_#Is1%+IMP z=_HvA)7(loZFML9au6@^l+(S0YtAIdZ` zC6TzBuE+?p3cFx%j5i%5FJat6{xfOMWVOl3Bygw(3i4#%^B?j===vj*l>BQdz0HI; zTcuvXnz1Uy(m9194O}h7&X!EdXGp*{1j|D$iI<>22hev&mPQdohFK8A6_!VXeM?bp z-oQ%tCj3|I2dfR7zno8ZH~k((!0AMBPp=MrOJUB-6CIwR6!u@uwbk!r3bTT=jfii( z;)n3Gnn?kiW17HXrQ`aA1|*!icrl;+(;Lb)!(xfE)c;~3fs7MKA#cz%2gu;W%k{m)Ax zrhcaF7M-HQzmwHovYxp}EFMWzwY{{l((3;_V+QQ6X`60;vPFb+1n+(f`(un%m~zmC z8@f@l?li=AtAJiV*YTeN4X{^QY*0qY9F2WpbcyI@m*@zZ|`Gka? zN^*2+YMU*uZA@dnPGDfkw#p?#@eNb)XEE4ttuUrGTaA^E1I?%2dY}Wx8ILi_7Dc`B-?Q-$@ zY4k8w1HEEqqy|(ls;G>jOV!^ieT!Rn1oeY}w3mo)mKv8QYxmWKD6jPU_BE%bPPN(O z;M3z9MU}YdfZ{RwlM2{r^@!xfY) zPxGVt9aCUU)aA=cjVwJ29=NVMv=v=5`#e z)aFva`3pFPE9$BWjcje-R#nJaV}xh{boRvDbB8o56xUT_7KKpu#4OxTrAm;Cgb{{| zMz5BE(Dh{njnn(`l@kAIi`HCS(T}#F)F`Ib$RuE~Y*FV?;wDwfwbfid-&`X-w8zB~!o{3sm`-$W^jm!UBdlXCe4?6Vv9yvj3-i+}f0b=(g%Pdr00 z)eih{@G2YU!=kGKSy+tToN{{IWa75+rH7(E>R9|T&q@EUPA*E<*+R-Ey2MHbht0iP ze?%x!n{_ukHlMP79P31UF(&x$LBO%b=J-1*&BA%(X>S9^i8Rnz(w(fj$;MFT%%mhYaIEX*x{|^uO`t@VmiUQ*omCbd zo|Dcadzj@(8xd#k){s?2ig*E1uUo~asUoz!G zC?xP_AxbpO+|QKj;REceufu|ZtR?O^9VBT$&L+ETyWl>tj(<_Zd6JslO6c*oMAer& z>wzhK!(X?TJhJNYJ9elTUyvsg`3cs)@@XY-uj-xua=Sp zigul+Nnt%=CRNcLgsZM~E5X~)y$LNVZJ%i+tZe6O?4C_KOD}{Iw~Zp7H*ip9e5A2| zPYe`;=kZ(Ly}UhIBbe-a75>uOf8qCIM*d`(^B@8;X%JyEuDBiW{1uzD798wm2Rnpj z@KAj6y`@(yS_QV5iR}hMC;#Gz`ytWs+XsP?c=$2}+wm4hR+k`1TfC5?V^z)hzC93^ zR-7#v6ayX!#I*kUZ8Pya9T$LwLCA=ik2x~{ zqJuEk$&=?7a5y&3G7aZze65}~-~OD7ke6!US)`PhSpK#0y~ysk#)8m(%nvn6-P9QT z`$hnzfUSR3+sF7l+IwV~HQt8EN>s&i*gdjinl7&(1?vJtUq`OLFL%6yvNI95BB!?M z;;sS?!w+`x!n#i&Y{@X-i?%e{{fb-1JUx++9+MH9Bnt-@mpbShgOl-ClZ+kN1qhVK zFenhPY-k$4+lQz~J(6OnCv9g%{NYW-pH;{@H~|3&^5s9rYA@Sa+Z&Ir_0#qZ-H&U` zr=%73vFpl8#s_w(ojkV%yGUJsvMC$ z21pw$9rj=P9;9ndZveVL(uajs`OB7f==^jw6zw;B8z-Snu}i?oFgpTiK5 zR>oO=8l%SjAD;E*M3(J~xJyb>f`bCwYPg_6wP3ZU184q+&=c$fMiK9MZrq>B2L}bI z`R};s`i|0%zwB;CEF{tLf;29-Bmr6ZAdTcK;Ii6j-Z&;C`o?I(A!QT$7)^Z ztEk?WILH4lM(J3ef!;n$ja;$t)7kc)<#6J4@9yWO*4rGh(=!;H z`*%Fz+0IWTvD4iZVZ?zO577D7&(QM9x{>1YHS&Sf+KTbtLM$yAFavh(y$5wbRseB0 z$ct~2M;G2rt;Ed;RGuRisK7!Z^9gmdpXlxZSf2rj-nsU>8w_WyLsa^@AuQ6%VmpAoJ23*a;-P_sAgr_kr=u%-hy7 zz2*XFvKaL%4~E|!_aRRPJSSrZx3c?t`EB|#F3)%y;O;1z<5LYR(!DQ%ChLu7s)7>N zz*NB&1>7WL*f!nSv96iwOCOSC$xG8Dx+*#^HjvrfzqjqmXuDkwMe_gb zx0O-#SLtltydXa;*)(Z!H_+nW(1e(NB$|ENfm1KzFK19Jw7wA0JToDyJJt3=#uwtv^fb*nw0*lM2E_=WzIX0j<2@Pr81~b-&$H59HhDW9dc(*= z4`uab31?zX-djX=-A2&~8hsLIDj}Ag1CD^1Y+@JrPFTQYo#cd1<=L9PE7f$v* zazHQpi1%00oS>0pNY);!0eLd7=dU(hnf>t)gtC2^a%^=q7Jh0`LLYuJ0fTJ$X~lss z*+IvimPQpP9>gKHOo8PA`&|pD;+kySt$-Iv&~t#eUjmUd{u5}kduo>e!Jq)-$Z$EM z@~@@h^B0U%q~?b_*0~g&%vMal$K`$=t^q`hZ^K`O@72^~uNk`RRZi~?jY}GOJ=R;% z9pDwyfANiP{ETq9%Zyft1uMdDr}2G7YC-RdH+8WzhzEDmu~Ee!mJ6Lx;SE-AC^6li zNE0YlX1}E>cL9iTUWin3P^K}-+jgtUy1lI_0lOqXPslF(PkBN0i5O}R~ zIis(h=K@8ax3(Yp)Wxi9Ks3$0^F_7UH1qKXnK^8f7rY4&==Xc}9uYS*c}brv{ozjW zuKFQ@ep`dJkf7;vi#~s6XVZA!%6`{7VOO6Harz=ZTr?sSQSH%^TOY<8o)NRDzTvyq zO`dGzzCA-x5$aC|;<^~o+nJcO9w;N{JA}_lwp4zyQs-^N6Tc2W&r1sa4a|9aMZmr~ z^-Qufx-!$w{nm5MJ{_eUnr&4x+`v=W0&9{NL;)QAv|KNnkoA|_ucu9}50;zGG)kPPX0_u_mhhpx z0W%v7VF!K2zxq$$RPq3Ad$yiF8O(lYqr+GlHO#p}ti$EznlBR_dnG{ZuldU6b2CcF zJlf)_+)^+>h3w3FZEz2(fPP^Xzp)x17c#0VU&;3;P_TP1KsmbfGOe*EAPn=Fc|VXIo=ka*`IRDeR@ZHqM=O z6DA&2!$9fnwKu>+{^o8d0^n;09RdO@kY(bq?jw@>3Wh}&Z>7ZmBEcXl?B~jVq3WSs zr3IWOiEjOci&&4<8xdLnMDvsZ5SU<}@~vAj&9phwqPC$(E0i*{D~@%p%*PkZzO=!`88ej3M`_PooM2>2+sHE;^D0r)UQM_6J$i4 zr)cnaamo8RI+yoNM_eA6rhVuXbst%&!4Yu5zWrc#!EK9Q9hv}k>5=`OtOVOjWpm>! zprT4kHt--H5j+ic>7_@<*QV-Dy;rx-Mq&ww-8T!IRlX_F)8gORVm&kxb&>45 zU%_~St&Jju7O*S5>`-nArYSjru>_c&hA&ePVDNgS-yvby%VZiypFiU)JnAyMVR1#} zyiuA1QQGLaiMM-2}wn9iS+Bn6lptD51;_GO8Tv!wEgXBtfTToK47)p&-ny zqj&pm!0b@*PBd+GMTPuPwa4u@s?|TZ$kL^$ikEf2gBti4 zYw}`fw4sww;K26iHw;QzFi`IYBon8vioIX*$c(mKwb?-`7fEyxRu?V@*GX(G z%}xV4DnQ1+^Lmb=_lwU{55DNBpCscWvHmQ#PeqL&J?T)RMQcT$6f6!vob5$7NBX6RlY5yq`xhFdmI`TRE4S7q}LYCaRmaiEl-u!akYd?8D(wW#CJ1G+ytj9 zXKVJC-I+6Pn4X=B;D{hMP`b+zV~)KF zLDCHYse-i$BwkSwG!q>IvcNy@7Bdd~t`X`~^qb|RbhfT^PPc_2PCc~N@_xoXsDVSB zN-R$tbjk!w1^AR;n?EAFC_ge|gTKm0(G#)nbjO?3pBVYC8+|DDTkBX6;=Qo_eTPac zd#)}eZGu4f58ht-T7GkZ9(do>19m4^m%6*7_=VQq!K~zs>d2!88)WeH{R=oRC$VoWBsI10WD-J$`e*C%rU5hze+v zemkA_%Owj5`ib2sr`<0}`vrWhCHy-1F~Xm5z{wy_;7d3M=l3VXMU+IDaoo_^b~QL7 z#9JXdIQZaqnoq2293InXA?lTa!ruO^*K?^uxKYvs7t~X;fwRi#yx8n6|glK7m z^bl+Btt_2y$y-G?UMekYS{K|liq*4R>o>H$zFFZ zRT5sr(i3Q>A*r*Y9`mGA+qj*bTW)4D&ZO$fSYI0vDWxGH1xrzyb4R_*051V5XvDI@ zFoc@}vA;VWp69>yUTn3T12l1xDvbX+$iAEr$^07{lL|ZEj3nKXC;iI)h=kEQ(C~9e zE)f-J28Azs*#7v&;&5eUw7fFr{iu!Edgw-f#t3*XD~iLw;sOXP_-WvM6sdVO>%49; zlc{^aJrBNx250f!QphaiEK;>1`P^da4AhGS$yWU;!(?U~S z_V%*9V`udf73Qz@b+_lbGP@p6>%{IP$({x|ZuuaiD%*MEZh1RVPAA|@ZKheDODD0e zcHZWo_cvori|0#mtHcXdT2FU4ij%&IxYXKDJbC_GEx~?aU)9L!$;!uY?mk1PV|1v* zRKEpGop#7F6QoikFO0i1M@8NDFup2MA80bHd@W>d+V;Hm%7EcBGaabsP9zV|}6 zyKJu~c&=@f0lmW2^ZCV<4m4HE+VZ3t{-f{xn->DNKkC`E^1FnlD0rz7IJo|L7V=iuc1YwNS8z z5euG&IM5(L%w#%{%aB7_ytJ@*S)m89b9co{Q8SBWChOu*i+h=5oqU8oygFG~se06M zLm+B9Fm6mX3ikAHC{iS8gZOTSYzv~O`8aD|! zlm4R*FaO8i(*C6}CC5z=gcjARX9BaC zvJ(%hAe#JqyzKp)l<*#i_}W%=4G%MJ82%Vsq zOWa<{E_t=k&&YKS$U8`%Ox4%nM{j}la`<3PmnY80Umib%=`ZLW1-+mDDZYW9CT?jT z0TPpP_8q~whIz)@{>V(& z@n2@kxP+aPnh=PhvZ0_9P_=k}!Pe~ltLfmwUt^&g4Vz|cCjbDj<6}&gmQA2)u)5U%Zw?mDV^u7uzc+Ji%<7kp{ zcA9fBVwp}5wIbm3A^I-zQOFdP7=uKc%5bsIB)Tr`x9#PJuA`W@^!a^Z-ImF6@(_hP za9ScWo#XsmZpHo|jDn6E9`%%+y?Ql6_78ZW(^3$wYuW-zi!Ao?l6s*()=I>S^^3|&uF}NXNtoNvTzti1gvli% z#Rv={=M+Og6SE?MmuN3r+)~%uCw3fba}>_jKv@_lwpq? zZOf8XN;M%h=q`J!`dVY>}xKTzJr*5QnCB&$Q;btiJ@{)n%il;Op zH5_oZapnxz_@05|g*Ic$yo}Bi3Qqt(>Kz6T2lfxjJhoAcNY>^A?JfL5sq(M**Msj^ z5qw*Tc)u~f;kko<6!vT<;gT=0OB3c7C+mCaAo-WDO*Pqx~Y-o==&jaabKjUyF z!cEWpIDpK9j4z@kBT>0WiO+SUGT{t|PWBM&6#+XXONz|8B*gnYT8Lqwt%J^}>Rf3r zehE=sCZAVyY45Pe_nlGYI_S|l{dvw9#-ngPQbzpI{!SL&(;!r3uC$%b7GeeZ{m7_( z^pt*Wml@xmhp!vk`p#-=_7kQ`?j%n03g=T_Tb)OtR5)zf*cLdLRNlV6NsIo%WLFc{ z+1-wcP?5$%x$0l`AF$&WJT*6Lg&wYcvI&A~+t5(KXHn61WH(%Z0PfrDa&k?3Gy}zX zC5<4BR!wSQ-;6zNtG3=RLpgV|Z&6b+X`t99;_K9}kzcb)qH&(sYV}^+*3!d`Lq9(b zd5`mNC7<~%&T0W+bjTr0+Ji0Kw?#2$~+;8R}sMt27IUla?&!p8xAhv zmCHKAVkRtCyF*o$pJk@#alkr+>FswKp$nZjyilQn%c>?QjTdtc5jwu7JQHtHbZ))M zq?4QZA?&kqLrI^_%~TA{$gvLLUAAJ=%zPoRM3)YGBIc8#E6{Yz)U4d9z0msxUlEC} zS}3P;Zs8Xi9whaLu1+$4)kS6%1FEo|4G`FAVOIC2b~?!w0Z}2a^VVxM_2=^_$j4VLglf_w_#yq+>G=!1q^BNDt|9d?O3c(pe8y15rAX@h}UHjSH>= z(EzPLIIwncQtv>8#8wv)^{A6dk8Jcr((jp5KXc>GUicn|ZrttzgyoLo2;YUs{;tt- z>?80H{f7?`=?K(mra&|R#|Xihz}%sl2=SJTr;uhpb@++AP`BT`bh40a$dMIbJ7tf- zlr^MO@hd7VP?D4N?;;&w)E~5*B_<|TadJecXmG38(rg@=St{IN2n0~A(X_n(^FqJK z0y@`{{P9K5c8DKthw1OIr%#bqVVw8#FuQRi415fjI^6DvFHjpF6MKMxLK@nsDIu7| zAcjXIic1!c2Vw>Rsl)G1XJyae%4Q{Gftni_Sp(NS*Vi2;ObFRt{o3SPxUeTe4zk86 zi<6WviEcHX$}>`OUMk@3Oi6$1G#yS)kWyh`2IrEr%0XQD2#8AWY4Uuvjc1?~x<{{} z=_${Z#oF#zppj3Xbw#fd{)s5E1-oTpD6GbwhxC3B53r1SiK zXIT_&j!KHdgJI~oGgD5w9UH3!v+87tdzPzzUJ#Z5>+sFNph3`cD+ocd+9jO|2f^(m ze0~laU~!Vb8gE;n>xO56XWO?D*Pmm?gkcL&z-B9~=&bz&ZqyRYr2s#1hZnpK45`v$ z@&|}}A8@>VYVn!=i@WX_Wgx?nu``x`d@L;QWLIe;FR)JEnV*vwYt2&R?@o2`wFACY#!oP)Qo9T8ZA@ zRd{c5aelUT(!0BGzJ^uZRS#{SB^gK=2orrnNR=N!g0@(Mp)HbXqu}!+23V_d8d^JC{LC@ zne1ty{X)+d)~=?v(|Amr=0cykuY9M^ZoJ!I_((uD(9#+^RM#x&0u>4@^~B+8Z1IJe z)1rz*JPjvy(}Xg_=6fAFUezm1dZzh4-tgThG{45{62c`b4M?u)>wj(!j?0eXiojy} zQ-JNrR)hh70Fojl(3OJ_jV`P5P$G}nRUCiPRHI@QDsRSH=Vi^s$8hyVD00bQvvGC9 z*#;ia_C~RmhExHc(+;kadiC&WLdE(wR#Zxq8LsL9!etq>qL3usEhT1tc~omKOxw^G zlrgb$^B3S$ZBKho981&qox4ZK^FMW9KvRos2P)FG*rH3pLunpjr6ZLlzzk@Bug%Co zGd)U}tn#cP!FfqXBT$)bX7VK|43tR|DjfC^B?v=9>JUKIf{am_`zG<84K$S?i~a98 z4q$9bo1_UGa;r=mP`&4Hfr0S2dMG8cY8;Mnz4~nP!6mk11%w$U4(?WyF+?O+yZ16l zRyNI^um5n#Y6FiDB!9?0?B=qjaq1FgQiNYb8K8f`oWDQ5U=_iMZ07}6vFp_ko7_7I z-fSXvtY&p_H1DY*EbA@s6MEEp@>^vuB*DA&9M+ujQ-D&n)Q#D@;aAUV#Sl5P?r~ie zj+?IL^D0tzAF6$ioo`!Bdz}ODze9lcS;I-P0&MY3+ndY#^C>++e$Xl%PM30oJ$bm* ztTvMRHTCopb$N=kqEEbo$F074aR6OrH1$xq*Bc-l7SRC9y{==xmJ-b+Y-hX%v-FMn-)cw6`%k7 zP5e&u@^jFzAM(1$cvsFPq3XVmp(KH0bl2C87k2K$Cb-s&*&)R5ZUCQE!=5ZzW=OaB zWyErEJUB z*M$PyNXfq$j8z3^a;x%lXkG<0kn8*F;5je@%x3ZJqZZzq+?o2f%YjVhs=%rF&t7W} zw=V6EL#d8Uig^bW_uy~6!4Wxpm5kq9rD;8%f&(o44+sQou=Ei;z{Ej3aImUip4VFQ z?7+nsT5>k>G*&kU0nr>o?(*b06e+t~c!O6q8k!@p`8LHAlCyVQ@GHjl?zGhq2F6kg zlowiJF&g5IvYSKMIlRN1gf#auYxx5t$aN^O+Sz^m zWxNwC*K!TGL)8Iq6091>?=Y*Py3~>5*Ve80XD)4SN&vyv4v@&BlM^oWbwY#CbzMk5 z-wfh)$p#97`knOgvh=C%8{_T0$B#J%6fTYzG%i1HOwm87hL|690GDn!7+L`8Yw4Uh zZ9;mA;xr$=8xtq}^nFKl?RdCsfe&5nL>QdX_E`(v8Sb8H^d_3B*%^pE*+fU_YXm)5 zXjxKZn2%5`G@YK>nN4^9jlS?YvvE~pRMUp+Ck{rVHUr>kOgs#Dm})^%Tf_dbRq(Ur zi#kx=HPG~BEg!Y7{Mr|NHSZPn>2RM$?x$_xImTReWxJYTKQ+{1gV&?8ZblBbMXrcU zC5aDCvv8TV^wJh=sc=|t7qLw=HCQ$}<)yG_RHy>x@=7?3&jfB#qn#j{>}QYa0Or3I z7^Q=zzLWwY zGAiE=CQk)(YPDubsM~7S>Ix`IGo%AFYoI2Hd0WVMHkda|)o*+ZA80r9aGoTqnycL* z_o*D()>p<)ET75;tgpnuj8d?5fq+n#h8Dv8LX}`QIkQ?tn?QQ!{tIb`J~0unHz#Q` zJ`XS5m0XAd0~pGa3qPm6#vFfwpYXm#uJFWQQX#N2I`BiCdS{{0Q$>m3j>l`(+vW1; z!4#m5E;vQ{6CM3Lj8n6+RR}+)}`p?#oc1qNTM$ERU@k_MKb1`Tc2W$P_;vPGLr+Nu2PF0ba= z#%$YPI+yb^xQ9|FgV8&#tY;0GEpobagO$JT{BhH+2kQ+pt~uQ8HxIsYogJjPPuDpG z!+}9e#JP*}H+XVd`SvNeeafWXS37l|EFm$W$Gx~Ehc+y)b{aT zkLl^_1}vdRVB)4t9X-j#aEtbpo~0B6a~&IS8&GFCbX@9;R~{q|g4y(ho|K-j{&g^1 zWl(ar&%ZZ&y5y6;H$lmd(Oaxe2Eu_aWb!%u z%{ejcx%x(IG_!LFXE_hdlS{E!WA*BW0R$lA;H2>&m{0dY90xoSHQf*}A<(otfppF> zeNbu-UhDUD^u-7^lx!N`OouOSh6YxHDGBx%eU9txSeHe(%PalM8iqPb-np4ot;@8T z)fP`^H|cZIpfOlED1H=w|6Q;Sh)ioEHEuuOlJG4sSpY0&@nOaaeE`3hhW>V;{(gcX z(+*er@H5ll=(~SkuKWM~j>DBW zg2WLdU`I~!5Clg~^51DVg2WLdj-2En29BKMKeKQIiT`&<)DD)KLS2#oMM7_P|2^)5 zmfOL9ul?Ue4AK8x#Q62Uix|%TtB7&*t^c5Rv`mL9aRiAYNWhM)#32ZdjOoAAa0H1X zNE|uILkt`_$$w_y2ogt-IC7HzPQ#ItJY0z*Nc{g45-inAGqY0p9zc}}gZ+0y^?L3# H