From b4cfcc67a284419ddbdb2e7f6256dabeedc8a2c2 Mon Sep 17 00:00:00 2001 From: Noah Talerman <47070608+noahtalerman@users.noreply.github.com> Date: Wed, 23 Jul 2025 18:03:53 -0400 Subject: [PATCH] Release article: 4.71.0 (#30343) TODO before merge: - @onasismunro: Sprint demos YouTube video embed - @lukeheath: "Changes" section --------- Co-authored-by: Ian Littman Co-authored-by: Luke Heath Co-authored-by: Onasis Munro --- articles/fleet-4.71.0.md | 118 ++++++++++++++++++ .../articles/fleet-4.71.0-1600x900@2x.png | Bin 0 -> 51058 bytes 2 files changed, 118 insertions(+) create mode 100644 articles/fleet-4.71.0.md create mode 100644 website/assets/images/articles/fleet-4.71.0-1600x900@2x.png diff --git a/articles/fleet-4.71.0.md b/articles/fleet-4.71.0.md new file mode 100644 index 0000000000..d059365a01 --- /dev/null +++ b/articles/fleet-4.71.0.md @@ -0,0 +1,118 @@ +# Fleet 4.71.0 | IdP labels, user certificates, and more... + +
+ +
+ +Fleet 4.71.0 is now available. See the complete [changelog](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.71.0) or read on for highlights. For upgrade instructions, visit the [upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in the Fleet docs. + +## Highlights + +- Labels based on identity provider (IdP) groups and departments +- IdP foreign vitals +- Deploy user certificates +- Software installation status improvements + +### Labels based on identity provider (IdP) groups and departments + +IT admins can now build labels based on users’ IdP groups and departments. This enables different apps, OS settings, queries, and more based on group and department. Learn how to map IdP users to hosts in the [foreign vitals guide](https://fleetdm.com/guides/foreign-vitals-map-idp-users-to-hosts). + +### IdP foreign vitals + +Fleet now supports using end users’ IdP department info in [configuration profile variables](https://fleetdm.com/docs/configuration/yaml-files#:~:text=In%20Fleet%20Premium%2C%20you,are%20sent%20to%20hosts). This allows IT admins to deploy a [property list](https://en.wikipedia.org/wiki/Property_list) (via configuration profile) so that third-party tools (i.e. Munki) can automate actions based on department data. + +### Deploy user certificates + +Fleet can now deploy and renew certificates from Microsoft Network Device Enrollment Service (NDES), DigiCert, and custom Simple Certificate Enrollment Protocol (SCEP) certificate authorities (CAs) directly to the login (user) Keychain. This makes it easier to connect employees to third-party tools that require user-level certificates. Learn more in the ["Connect end users to Wi-Fi or VPN" guide](https://fleetdm.com/guides/connect-end-user-to-wifi-with-certificate). + +### Software installation status improvements + +Fleet now marks [App Store (VPP) apps](https://fleetdm.com/guides/install-vpp-apps-on-macos-using-fleet) as installed once they're visible via Apple MDM inventory, rather than as soon as the installation MDM command is acknowledged by the device. Successful installs and uninstalls (for VPP, [Fleet-maintained apps](https://fleetdm.com/guides/fleet-maintained-apps), and [custom packages](https://fleetdm.com/guides/deploy-software-packages)) also now automatically trigger a host vitals refetch, ensuring that software inventory and policy statuses quickly reflect changes made as a result of adding or removing software, rather than taking up to an hour by default. + +This release also introduces a clearer differentiation between software installed on a host (Inventory) and software available for install on a host (Library) when viewing software via the Host details page. Further improvements on this page, as well as on the My device page, are [coming soon](https://github.com/fleetdm/fleet/issues/30240). + +## Changes + +### Security Engineers +- Updated CIS benchmarks for Windows 10 to version 3. +- Added support for IdP-based labels. +- Added last opened time for Windows applications. +- Updated `GET /hosts/:id/encryption_key` to return most recently archived encryption key if current key is not available. +- Added support for ingesting user's "Department" via SCIM and added support to set the `FLEET_VAR_HOST_END_USER_IDP_DEPARTMENT` variable on configuration profiles. +- Cleaned up false-positive vulnerabilities on Amazon Linux 2 hosts reported in Fleet <= 4.55. + +### IT Admins +- Added the verification of user-scoped profiles on macOS. +- Added last opened time for Windows applications. +- Updated Windows Custom OS Settings including Win32/Desktop Bridge ADMX policies to now be marked verified after the host has acknowledged the MDM install command. +- Added support for "Host Vitals" label, starting with IdP-based labels which update automatically including after software installs. +- Displayed VPP apps installed on a host in the UI after command is acknowledged. +- Updated `GET /hosts/:id/encryption_key` to return most recently archived encryption key if current key is not available. +- Increased how often Fleet checks for new Fleet-maintained apps, from once per day to once per hour. +- Improved GitOps speed when managing software with hashes on a large number of teams. +- Separated host details software list into two separate sections: Inventory (software installed on a host) and Library (software available for installation on a host). +- Updated Apple profile verification code to disallow uploading profiles with the same identifier but differing PayloadScopes. +- Recorded installer URL when a Fleet-maintained app is added via the web UI or REST API. +- Added support for ingesting user's "Department" via SCIM and added support to set the `FLEET_VAR_HOST_END_USER_IDP_DEPARTMENT` variable on configuration profiles. +- Added support for the Apple MDM user channel. When a mobileconfig with a payloadscope of User is targeted for a host with a user channel connection, it will now be sent to the user channel. +- Added ability to add EULA end user sees during setup experience via gitops. + +### Other improvements and bug fixes +- Added user property `api_only` to backend activity details. +- Replaced email with user full name for login activity. +- Added a new avatar for API-only users in the activity feed. +- Updated side navigation styles across the app. +- Added premium tier messaging to the certificates section on the integrations page. +- Removed ability to upload a EULA in the UI if gitops is enabled. +- Migrated from `aws-sdk-go` v1 to `aws-sdk-go-v2`. +- Optimized database queries for MDM enrollment checks when one host is being checked at a time. +- Replaced own SAML implementation with https://github.com/crewjam/saml. +- Increased page size for software versions shown on the software view page from 5 to 10. +- Added retries in `PATCH` policies API requests to fix deadlock errors in "Manage automations" page. +- Added missing team_name property on `/api/v1/fleet/hosts/identifier/:id` endpoint. +- Added missing "url" parameter when exporting YAML on software packages that have a URL specified (thanks @drvcodenta!) +- Improved performance when pulling team settings on osquery config and distributed read endpoints. +- Allowed team selection and name updates when saving a copy of an existing query as a new query. +- Updated Fleet maintained apps uninstall script to use `pkgutil` to remove applications files. +- Added functionality for verifying installation of VPP apps. +- Moved the SSO and Host status webhook settings from Settings > Organization to Settings > Integrations. +- Updated software installed activities created during setup experience correctly categorized as from automation. +- Fixed cases where valid operating system vulnerabilities would be periodically incorrectly purged. +- Fixed details not showing when the device page URL was edited. +- Fixed an issue where the `fleetctl` codesignature requirements couldn't be used to verify the codesignature of `fleetctl`. +- Fixed issue where IdP integration page did not show the premium feature message. +- Fixed bug present on gitops cmd when importing no-team.yml with scripts without default.yml. +- Fixed a bug where Fleet-maintained app updates via GitOps wouldn't pull the latest version of Google Chrome on each run, and would display an invalid SHA256 hash in the UI and API. +- Fixed host API to returns empty array (instead of 404) if software title or version is not found on hosts on that team consistent with other host filters. +- Fixed bug with the run script modal on the Hosts page when running under FreeTier due to invalid teamId filter. +- Fixed a case where host software counts wouldn't be updated if the host_software database table included one or more rows with a zero `software_id`. +- Fixed issue where attempting to lock an MDM-unenrolled macOS host was not returning the expected error. +- Fixed error when deleting a calendar event for a Google Workspace user that no longer exists. +- Fixed `fleetctl` panic caused by missing SSO settings during gitops generate. +- Fixed software title ID + installer status filters to return an empty array with 0 count instead of 404 when an installer is not present on a team. +- Fixed issue where iOS devices were not refetching at the expected cadence when re-enrolled without first deleting the host. +- Fixed cases where valid operating system vulnerabilities would be periodically incorrectly purged. +- Fixed issue with `PATCH /fleet/scim/Groups/` endpoint handling duplicate entries. +- Fixed bug with calendar/webhook endpoint that caused an error if the calendar event relates to a deleted host. +- Fixed host details > MDM OS settings tooltips from flashing during a host refetch. +- Fixed an issue where `macos_setup` would not always be exported by `fleetctl generate-gitops` when it should have been. +- Fixed host certificate source recording (including associated performance/database load issues) when multiple hosts share the same certificate on user keychains with differing usernames. +- Fixed software package version output in generated GitOps YAML. +- Fixed truncation of the MDM server url value on the about card on host details page. +- Fixed a bug that prevented users from adding VPP apps to macOS setup experience if the iOS version of the app was also added to their team software library. +- Fixed cases where installed-then-uninstalled software would show up in software inventory. +- Fixed automation tooltip not showing the correct filesystem log destination. +- Fixed SSO settings page returning 500 when SSO settings are undefined. +- Fixed the linux uninstall script. +- Fixed broken macOS users causing errors during query ingestion. + +## Ready to upgrade? + +Visit our [Upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in the Fleet docs to update to Fleet 4.71.0. + + + + + + + diff --git a/website/assets/images/articles/fleet-4.71.0-1600x900@2x.png b/website/assets/images/articles/fleet-4.71.0-1600x900@2x.png new file mode 100644 index 0000000000000000000000000000000000000000..de62d1e777fca01cd0f4642fecbce694b6f1f4d3 GIT binary patch literal 51058 zcmeFZWmJ@1)IU5l(kdcSgQ5ZoA}LZcNGd3;(gM<5(hP!04GMxF0@95jC8>f8f^$*Z9OqalaM7K3Bt^#ioxoRrig5yq;EoJY@LLh}m>O&JU z2n0oOTV7V%lW1vBmI%TCfe03_Mk(UtyUS6%X0C|`;MRX1UE9CE0>4CD4*2iO`V*Z0 zed$b0`Jb2YcnI--UNUe8{O1+q-_m1g{1X$wEdH6qKa=lH{=@{+Yx-lYsn7lE+5yFG&)-;h#zTGl_pm^4JFcB}qb9_-7LTOyXaXBzVKW zBzY`}el~aHqHnqzs=cj(t-~9^FB|jY&Ost=lczsoVS`PnA{zgEIzHm`Yfwr=h$?J=hzQdM9 z|HNa#Q@pXM%DNZR)}*d2)-#!-qBjrQykwwbV{EH;+CE+L4A}7VCy@W^1f1|I`19@Q zfd9U{$PFR-&uis-|7$c65f35#&!?O>iT>9d!-W`_k^FrErbs#ez5sstckn+^|1+-t zPWt}2)4u@nFJ%5p693JT|MKxa1o97a{X?1mi3#w3xcXlu0soId{43i2m8t&<^Z)-^ z5q%thv)xVZ^$@#n=<{Tpt;6eQ>|7?l6l0#0K1?9)=D?{hU4>4?_4PUYg06PszMn5y zg@(84x#gV;ZA}{P&g$QLANK*-5qo2??|?hqY_$IOk1Yd&zdJdAB|=hB@K_3BvHzi8o$n@H zV%YXT|87!)M_I$4<~+d~r_g1lX9j!YH}V`?2klv!d>vsT_f9!7z7+6Gu8-diL$1hqOEpNWf!> z`w3z09v@#n{m@#U?QS_?%5(o#Fy~`*ioKwpHqE-pnGV#q-VZ5`o+{G&<;=l45h(&I z!F`E7_i0?7+RYoD*>N;D&3Y|I;en670gVFXdVS-cAI^M)v*JF2YRr6QI&L;8?ON!) zJ0TBM;k^~{CS!mpymxH2>ubdga)*jb`Fm+dg@a)F8kV&U33p#UI;p*fRW%#^W3yVh zes;zl=0mQAIE4_I*6GII^WHS;jU#pUfs4HOCm{V2*mt;-r!kI_Jd?xe<55g4JMz+W z&1|y3Um}0NTSeq8!xY9=d)N8e&kL^@2;jp?5ij{DiTh0BDBs+JDc{GMe1TP~dE4)0 z22NEC?n|O;rb3`-1xgqHvaOx^vtoH+Pg~93C=^nz&pqw<-(}d6uRd zv$M(7(L2uR4@vqfQwmj1#O79bUw;9^2qfFKJbJ7{%2{yu(@aoUhDn~LI~pZ-BR{02 zI_E;p1yZk7C4?pIU-GE%FK5s4Lff17-`|{dkiX(w&xDMEU4A`tF@Vkng)6=RUstbR2vhT3T_xHWB z`qzHbo}aL{<_v~e^|8~AN@&;sqj~oilT3eyQp%~a7kv$|T5L8?%6P&%=Ywz4YYz&L zsCnUrd&e!yfQ6F*fW))Ttf5+P{$kO_Mk{A44#dtjU*Z?Ux@>VpT)^(45)U-H^Vwbr zUA+(iIIH-6XTBA=agDR#kl*q<4U3!@k9wGX7b`;8`$D?KEXlC~lkR{B1g;mdrsR{y zGCDIVX@H@8EQo#B(Z#Cs*`{S6{S`cTck;At!K*8C3sxb6?D1e|o zReMpAwG3!_q&xo|MLpLN3x6u6VHH_)ZN#*hSr_ve=amU0(m&064VBF5?|QAGPY3;F*a?k!7Xo84 z^q3tk+}=hi^hkYnzB}}#29|9l=fPid-S_VCHV|#RSt`#qw6!Q$8oSq))TS^wch$z` zy}YKQL3+yXL#g~bTFgLo#}^Zx?1@rrLOH_fu6BRv_mMv}`EgIFkN0W!#Y^W3YgyaR zg>hjGcZD&{XV-MppFtPVRg!VvSF7pe0n2G}NGg@8`D|@35;WoJuwrN z5)^YtL|SM(yS6B!yV5oY`2Gw3<*p9C`UjpN}if$fmcX*2@IhHYmTblJna&9TDQK6GaA3FDyVQB%H{&;DC z5WX$TOEcnpSwe;FmajT{$tzHpO_>jIbmI=W5A{1A~~j8k5>UD^xIWdl-0cG$mOVTHvCKV zJCJIt@*MPg$EGc0V(D6f3)yvm*opP$DY1sG2dFzG#GStvp&?>B`PopyGV_aIJY&gD zVG{I2#acbddD&b->@ti(hgD=g-hdLR42b!V~#vzbwIee+#Lw zxN-$W)tD`6`@tV$)**U{3huCoJ~5(4G{0a)&}%>u-k)eooPBO4zf}43%0%M+4AP`G zn#a5RPw<(Dgj4m`2gwUw0YUG({(nV!yw0`1q!%_azaZHv|HSWu7=@!gZmp85(mtsA z`{0W1|J3iQfcADaVR2df6C2on@_4m>;OD+)>=MNzrVs%`Fa-#dl!Qy8zF<+D$^ z98L%&O>%f?$?r%IHSW1>Pglauk-SvB4}cFla)}rUmBIFpjwJ*_9`S;^j=f#XR4DEv z<(!QajF@K(h=0%kZ}{HxW%-c9pN6-A9Zw62&`8|iH+f_(_5d#0fy}+X& zo@%|YrmWi1zepgH96wA#TRT`t9DNfIU<2L&;R<2*66pwUX3K*78@RY~2kl({;N(;(trZz$GI?KXBv2&1f`7%g4AA(a~#I)fOsvtEJma3t>|p zYVdTYUoC8B0;*#ABllK1rpDhqvd(BgDu@xk-1s2D|9`d>c}6*Pc-c72ZN?%!DD7@d zf2-_Uxw!Ef+bBR3^pB0&Jszti9b@;ECdVRoLNU>6ovuc58+;eMxAXpc`J*jdAqvWB5z$|-|}NODdE z;Ln|=hQe!#uNDmeXs~Kf#^i6{5ISVrEbn5gs5#q^ zC*ZBqu^p!ga#z1RQVOVuWrmwL!sDDu1-5W*>m!WHzqfl_&UsC{8Q zs;ICVd7zuJcr}^*N)AHCOd7HIt?lifqC8oE_7%Iw-d3Bhk!!fb@`2`pqUF8Hv&ReJ zyk1=(shOr*roLrLk+CWKg6n9Sypp0o8dH~UOvKx~k4iS(O74#l2;M?+D~1!43qOZPOD|XlhgrDPL>);r zOSh1>P9oSm*Aeov!Dq&y!8DChu0R`y<|~xYB+OM4i4Z&J=9ze z_fVTJU`bq@rNs(YU%W*~VM*Pff5NGLQZAbq46qUYb*B zLtRyqVbWRKilO_7eLbI91hBHUx~oBa&dn<@pNrWuIg&elT(7T4+`Iub_TENMH2(fT(1kjgeU5iN?js;2 z<(c}LGViUC@h=*eP8TpybF*tGWN>p&Y>ODIPqi-*>xROD z+q89bLO?uqOhI*_qv_w!o~;a$67}P?U!Gva7yf;*#Mj~PG^kv=_}9vC zCDNb^ zbEEK}jpOxKt*-BbK-xxOjhrcDyg71#b>fMkfR9hGd{Y9wL`Xd4C|Kk)=ItRj{8d%A-nRDA6*^9l2W!<0y)* zMut>MSPibpN@~AJ&D7?}HNrk|VL%3gWQJZKooAOh&5DjKFg8{NHQ7Y3XEv2376OH8 z7E%_?r0Y+t)53ETNRqPvzW4FX8ls?PJ@m&3bkJFk<2vRV8yG^{yMx73tG9c%hTQ6xZog4Fcj!jx0wmlBW5n_@!(+Go zmVh)jkAl$Vib~Ti+PVmYh8LHC_%h%G?e#!g>fu3>fjo4YYk$ljIAXFFIl^4G^(O@; zM(fDnaV*+zr$AQ(P@CJ&B9zjL8}+5gQB8X3;Kd0`!Z!}MK&S*6OD^AgD zoL4d&hZBB32>H{B6BIuLGV8Y3a-#t%b@(WkeTnd4QsEJOhoKjCcZUmnWmfj<`H!i9 zOmQBu4fWj?P7J1~^)v<)M8IC0Ah-jbt+7e9nmy=5?+3@fA0_sJpCn}g{kKS@pWz{4 z!`Hg_4XsS+{nu*t3GYr_K6>{SD59O3^}X_)KJ?$cVEAL;k-Cz9prhEC2a{ZNtb{1a zLvi%sY2FDW8nH9Je-1nsczBRU6!5+xR1ry4M~vQu|D|U7=-f>4H3AHZO2msc=|?^E zXdj3=Encbt!KVoFhr5Fj4+6QeK+oZ?{&%x8cr*>kOajF;C_;7&W}Xirm_gIKj5 zlD}Q819wosDbhysZr;$8foSJ|tD?>w)5MK>CNtmgyl0BGrmn0( zN=kB}6|8o@c?7KAvYxmlLY86|%6aEcmGx@VFz)r$3qMAvANu6&t?z{jqV!m!Ka|YI z<3!Kz`OTh%+%a7V`%*;ymkVD~yfE%OT9|t6JUxAu3=|FUsNW;z1b<#yeXego5HC>Y z`Gdm}>F*f7 zkw4m^Cqt*SkM7!08C1ILCr6 z_8@mgcw@~y*@)+`0TvY>j!H2!6%WbsUyJ6)^T10Z?PBHoxD);JrWwqsogYfEGfVU9 z$0h57pwZYj&tYwK1xgabrZc0FXhM1dyvV}{RkapNg#umU01W!$<)p$jJa5wbKT{8gLp-1~CVg;$Lqy2)Ke z%FpXkPURy8PephjeD{75Y)QNAB=D;`XV%svb&Rh}%s4U*G^rcLzFJJ=CTfeQGMtLf zwK}LMZ<5e#9XgaOCV>&qH&tU!_o1NsdOfI0@X1yJU7zO}Xp?F+=*fPu&BpT@q`Z*z z=dfLzdDtbLtzS5Md0$K
    pC{@<29w{69Gtzj=gUOwWzp4^LN#+2CS!5fyUJ5kJHK~M zlX;4Iw4W`4B1RScN@JOu+$Z%Bs&o2k5h_1{|G8M_Ml}hCLdoO);JJ|^>6+EPFC<3- zgV=!KBw*-@+-{1++#5OnVN%U)2IX@?^~-X&3l>PIQT z?90!kYW#62Ys#~oe47Mjb?|X#suOXrx}^CWX0z=;%&Sj1B@C5FcLVmRjrI4<9X!6q1)e) z-BB7A)Yqg12ax9&+o_-*M^5TQ{NQkv@vw}?VAbjaE1?X8UR6LfJ|cVtP5CiVM3D+n z3}{Ij_=V zL;QzX+rwkV0*sC*dh-LyO;d2c?nloo7Am;e_(?-Maj#uamqhs;7%fbPekqZQG%ICz z$m`}U4luBH$(*5wRS>350V7AMaspixj1t;+sj9$mq;N8A40T3JN&ZaB*VT_iEkf=t zH(BBL^YtR1!!#*D-~&E$AMmVDXJJyZWrXJIoNwu`#i`{>&%U>k%#Oq5#{2GTNDqz$ zVDHbYqC$~|(Ba`hf{kS&!L{u!Sr{%+6YZXMu9uA0AV3_J+1Ia2X_~oPuyRvnBYsp+ zwCS>_KP4gUfBTMi0loaDWvJ+E)glR=Wk!I21x?DCL+772Ef~9Y3sX{5pTUl3gp9T0 zdF0pG+D2CU;d!&dd3FKJk!}M1W&(x^p2(XwMq{7DkCy}laf6|(Slg!N5fZ7o?{r=d zZb6AS9GL1tF7%UAY`#1(+0=tA1l2pP^fxa#S>gRA`sSzQ-S^jB3_ha(uIl?!Mp?af zI&eCW$BwgMtf$(c>G6gM+sN*HLG-o{K^)?4_Jjx1@F<1*=M{QqZ`Wy{Fn6b2b`mD*rqf)KIFQ>Y|_! z8Q66;OQz90K>1Ni{yj|!f0{~aMBTGDlYwO{-cu3cnDVX*1?iL$OMPCGq-IvRplq@+ z^*lk{e?vT*3=x1ik}f@i(eV|u@MO&c_JyV#aX196tn-<3N(xOeK~?ZcyoK@$noRw9 zgac#c1>|L0oOlvr=xw5NR#9taDEV_%ID*I<1V4fzmp785^NQ&66JB9lhElx!0bNGX z(O5-oZ=X(~iN2D1QUo|!CdqJRr1)q;NU%ueDDZ&%|hFD0X@l~mbhMQWx-s!*W9pS5~#>_X| ziXHqwJOVKo_*n6QDu4vASvv~&LsE18!`&s2J4ghVy?tGBV?|}z&n6w)|Gg|}zO=T2 zYi@Y^K^eu*PD~T-bUS5=VgiFgsY}lQxI6f;sDb&?s$#kJl*3$eL*9oAj=lE&{NkUl z9lRvx^(ATSwI{?fkp#RGyRlXp(|E_A$RqL!syNslmSNT9CeY=mFct8~9G%EbTpTnzo!HXz@WZr+;{eWU5 ziHH!l_Fv-3KGocZ<@{6oZt;NvN8bL=obOoaEcWN**0!vF`yW8b30h^n@P~x3<$@K; zk!uA+5#26@OR*0E%Y59nwgVKIJH!a#6taz1t<~%00tW!)Vx&BC7=wS=LN4m=|85;y zj_wx_QPu}62LJ&CQrbQ7p4iN1d=NC27Y*A$zp-rYwSn|M=$q*??b)cMvU+yXzK)>A zM~EY_=pJ^V$$>DTu4+^9a66QtafCy+TKZTJkfhq9koN`CvwQ@)!t{+pr)@WeA#eHo zEG$>kE2G^AnM}E|U&h~oX_`!ovQ2hO}Cdn(N z2x)-cAf7-*?C$zoe%X3^0Bp1?1NKA!(vV~E#WO{`a+Fz92T?%qE$T)f`kA*a(GbYB zBF7UjojpQaS7fAE*Y7QAUs-Fl}F?`$(l-A2Y;DGT5`>=65lry(Nm zj&l*w)CV;wMjarPfZ&`_g9`B*)2pH(YWTr8M1ZgNZ!Ckm9_79@wb5D_wY>H(T6$lx zV7qZ-X+uhmhy1&tQcqVm`w>FP18G;qYs$e6;qEhp6+oQT0ah9_vsQ*cJ!7k#%zA@0 z$fyy;{55MSc?AD}v>bt$rlzf&iRRHt?k0ydwb~D4@TR1LcYS8tm}y6c+vj7xjt&6b z!K0_03V+Os@5XD#9XomjUHhSZQ{O!wjAAXD&B#bR2*5I1QJZ&XA3 zX!@2A&}^HMnXn+5jq0%vxe;@XRLEyMq;TPE0l9i208k0c9XWr5e%2-Mum{1HBd$Dy z*)*LZzTEbUpu0(l$&(De|P3Iy@Ey>Q)D)`FD+|}ai=UZ5;;`RMn7!@O*5|`o($}Y7Y8SGS=ZIy`0Kj)!DSxRO zdT(oU%hgceF;bl@?4i=_2YoM=oQL;saQM`;_P#4Q^3->DM8Mbp^Fx?`zPjspwly3q zN4%ncT)}N(9P4i+?mp4(Psu4mWuG+)BSUyPR@Zu)} zN-JJ=4H5&A+C3%yZE;1>c)cg-;q`V4#Qu}QxJ~29Nc4dxP_EL;bL0W#uLG`i^k>7$ z*`QbXEd@W(7-W9=cD&g{ByRAPl_XevZE{$S;!HsV4S~N&BihQcR14LxR`wg3!a_O= z>S?NbWUm_4^VE{=5`VL8(XA}e@~PW4Z+VM0vHH~x3u)$fm*xp3;!gC(f&+A(q|*c8 zU^T^i!=4l95xg&n;xobwKf(d1{5_d0hz7anD}auGEvDS|SM<`&;sLPbK#h==47O`P z0>%`qQYCIiF@uofX5p1j^eb%gNNF3TgGys)3189AE zOr-tTg>cYzx9mn&yjH?LRo}kLitxsTI1f&=@Y4oT`a{&UOTMA@*tLpg^BlJ41m-PO z27jMp@9(n?@S86>v({M4C;IK4Tx!XN54)CG)6{F-)s$RYUR$z-y>ngBOYD?cqM%fO z=O-SkFdEqmDGve|ZGtOOh7IgSh|~eG#1x1ktU&gHuTF9)~m}A-o`dhBd!*di|g0& z(zuM`mKe#$lTx=_e{F6QL3H>TG(-=`Z{>31$>Cwb$7m5vPA+=@Y$ZOIZT0G-C_*WE z1IG8|o6>UI#A9$MK-RoEzjX7+7loe4suZ1V{j z+a-BtSk);LY`dgbxIJFxe9<=_(yoO5-{-lBJ*j05soW_J1REtx#Ie_1?Be~093Kw? z(7Joe4}>#7zJE_9ozTCTn~wC4y2SznVbQ_2zcT2<*D|WOS^>|2c|Qt;?XkNf65W9$ zpi{f6lj}d;1IRU0`a2vUdV8bbbpk-`&O8Vnv$;<-r)7eRBaK5A$AD zm-*st+Vl27$X6>L3oJh&2QDuW!8=mFZ(bFs6>mkqXF1&vMn`AJVpO|aU}@Qg*8g*E z!=bis%=>3|uhzgb8M?Nb#oJepkmghn{`lK%cKcrHe7r;F$B5v%sZRo9abLNvi92S? zZuwu|2xAHo`Ru>Ayu)H3@RjlY?j)>2+2xSALmlw2Tx5M#V_rI@B>OwQ=}mI%j;$B5eeDkK|d5J=2vW@qvLCm}cFGR=&=sI_`cqsm@O&3y*uy)efthBKX1rJI@ z1Z|$=Svs{mqFcK`vBDBX&yeSCuy@N*5{8Def9O>?jYzL}5;Mu$fmOVgwpVntZ9uX2vyb%3^ z_7*3F*iM7)Hod!R4fr7hjwU~HpdV1SqJeMwRRSZdOC7ypA~HU8x$keLaE(1WHd&`f zN9G5gzRP^$GBqOgle;*hwN)a$j_#aV@(H20`pExiX$JkQ|xtsmjS@zxhWbsC$b zaV@svq;a|V6YbblimK>O!G6ob^&6LF4$%g81;%=rJ&WCW_SgB?K0_+9XcLW zf)H&@DnzQu)+S|`_D}E&m`h}Ei|t%q{BiIjb~8E0>G$=io@%Fkh3^JopA7PUF$1Ou zM<7q>nBepGFgN>QFu%deWRog=j~wRBT+HJ(`Ui!6OJnJ9w3%C5o6+*wRg2 zx24+ozJb$7Q~ojk)sHaB-Hu2Lb9>Tu54JSGHTY4s?5M^Pl2cf zDEoOy-^LxOJt_Fe^#kr)&%Jk*|8QVdrN_Vta3xDysyP1VSu-Qoui_c{`^C-=5?;wB z?t0mI_7AP&sEddWSqrGF-lCHh65+#7>{oSE6)LdJV&BK_tp@6dx6_m4~{^JstqQP=xY z@U{E1#8<8E4WVjuw<)pLo8At4mIVBUnGsL%Qc%AI^ko~#d(S%p-ei84MOfyEpPPpx z^1|nY#vJO_4{;?6eB}q<#n~2n9bX-+phKm;CYjlcv)=1cAz&2NWjKcbtxv(@yt)$)x7 zH+FC3>XnG;E2*WU65QRcFB7MXJXG@O?YS+zxbTb__9RraC!{-j0~lFZ<{jMzQMUjU z2ERlrF+I2BJjRL?EpQy}|5D9TnSe8gOvjX+|Gs9Xgc@SCRCx1IXg@IEe&zalh}leN z_}FqM!#>alnRw%takwS$_qpYG1!^~aOxwh=W*0lY>!*F% z3b#&_n3`-K&CMWDS)BdVV{1CUe&%IK^!B^Jixf6RpVR61M9o1%EgV}pz8KVW2XrQ$ z60R4}GfD~Wrd5-_BfU#cPiF2UL}T;@_SbVVj2eFcxAs?Or3YPs!PC}Nq9~;ibU7Vc zm0RB-knmWlc>Q_-2tE+uEu8lG_5g>!oAtK4jexS;05D`}A^%fyXX&P;R-@_2S#(%c zVZul@Q__9|=HuFO>m~jZ%S)B%oq~647Y-9dMN2I2>QtY<__2UKBS8PS?Gzw{&l`8R zpG&^*U(IC}v)8Pe%sstG<+Ic#*($;7qx$Jh+ynnrJG+CK(}f!^+Zt^3Zb3LbER6lE zrzw&m_2$gJ57SR&>t3ji5h*ufHL4w};?-q-JhN$YLp8NG5HQc*!|fGY#Y%c=S)#Lx zJFvLQ^k}zMUq2Je(n~SF=K$^jK3-q30h%kWj^$VK-*5GUb_*d;X14017IMB8_@j`6 z##A{vzs*a}WdV4q$Nbo~jT}-u0-%1=na~CD6Gcu6vv2v7)uUdd=rLa`F-~O)TFkF0 zew)W>ZH1vO`yGA`S}C*s!+RisEK_rpOVoi;fuH7WZwJ)a-?BH5W@nF(d3$e==x z5Luh+nWhXEX>(`It)xr*AFBN{RJ*OG1r85Nb)4^}!F&4AIC=a5@P0gYBHIf8axXZt zc5_WU%hLAAu9+i=+D(b@4+jT=HXXQgbub}bNWhGWM@50&BTm|kjG53;FC6L%>H>WZ zn*TYxb8Oo(KQV^3@WE{sy|$pMc^RF#8L7dxS3cGPKtSX8Bz%H=?pnW^GVwk~hJg!L za8;k>@XrH&N|!@ptp7F}#47v>-TsIN!jhMwXUD>-+8u53jaARFHxc3P{sUUF<@Qs@_3CM%JFwaKw&B?4IZasM zvJ%?n0XsbXNvdFOh0BKS{^{2RG#4;sm`8h2+93fq41w&U$Y$@prj|&TKf_nP`1HMp z&sSC|y3|S^eX(LJF!f=eu6?4?tEq9nGuk?{Y&buaGS`GOtBBklTgFWfblj_oH%R#2f zC-y#*d)t2sH=ZZho7weOh#l<541^;=WKsI;*E8nNjqnP9 z{pFcNyi;ARefL^F+&PzPW1d9CdD{dz8UB%(>qR05id|Un1&s_ZIjx;x*V%95cM?td zXCFdkOZfHs>cbz1HKfNpc>F!$tnoHl7a&j(uQV6*?$=sqos1A~@B+K#M@G;rzA!Y} zw&8?;`_tu*y_K>)aK2^SR~|<)`aVMHu`2iNpT(y`ef_-`JYDVH618WCFporfA(N-vvDXN&gx@2!7y1psx2hL|2az~atRWTe{rx1zrBzCW~0=#z>75l7l{ zLva>nv*|5YC(g3QP(1_G&6dsuh>#N%%z@23=h@WZydHC{nS%(RXC=<14Ae1E-9q(4 zr@o*L!DX$qVHh|X?obuRxqhvK@~Z00Y)m_)VO)&bu)Jo%ck;+clWN%zOZCi>GxU@3 zyg05_pHWzSWn0CSd(vrgyCjdGStoe?6tQSD#y5U+!)q_`vO$dB3xEVCCosPQ(@vG$ zlyoNIo2I)OL=d)wqB6wqgNbUv*_l0AbkopWL@Trv-Sy9L>rt)YDFyrR zs2(uJQ)qq zN|DyHe7|2rA|)Hx7l`&%sQeFmpY=PpMoAXkXOIO-ynwQ!b1sQKW;@83Rp>AATUz3q zBZjb5E#4Wp|L7rR6~Hsiw>WueG%wF4N?zL6(j9~WMs6+5o_;g2Qg{$)-Vq8vqkgSq z47G=@*HwS@9~a%>wUGkYv6;a8e1K9+c?w|UEK6YqT-?WP9NZVk`xGHo>xKm z$$29@>mldFt8t~DYlyuAB1m^Zs682gju^03NsL(K^ARg6%NpdsFa@j@JD}HMN8UWo zZo0^hQ)}I~YiH)w-uk8Ms`4daUs9cnanv#4$(u0>_`RM$&eNmr??AM!ZjDDR*YE+; zk28A)fCEfiGEbgBAbu)At3Y2(wCN&k4nk2&wk{1LF*_rf!k538G1di+Yx|?}h%VE2 zVyjGhhj@bA*uSPeo0WFj4Tn83twNWhX4!9yntu! zZ1&JIysQS`kbn`45h|*4_^Y(&8Rq+FsIl>%bJQ#T*P9*zUP}wx(b_-(j-8@9sd0OA4WxjIw`DB8oN&Fzn;yv z$V-;k#B`aI?ye0++;W{=aHcqfIKY%e(AO;c=u-nDiFKMvJ+&5%^ewmBzlfiI``%x< zRcAO!)HH5rcC96lQ>G92>$ocnU{=%1UI50)dT>aRhp>uRt|XBEC|U}EixHY4a;nTX zDopaoCVgriQ0ct;SvA<)p{hY@EuEG(*D9b(LZ@CU!koKBk`!Omw#(~LZ=Dg(3J`0K zZy*$Re@3cOZ7TzWe#5@wg}97jKECMrz*i!N$N9DZ76O_-uNB|l#8mNw6i0*cUqtPk z9$Yg;JB3&W?tD07ebzka`wAVsx=|20UD#;cb;-*$i`l>lJa{8cGAB=PDTXu}X;L?8 zpfO<($Vj%EJ(+RU4XgZ>6?+h&CeO9PJno46i2A~+kxsm|)G?|c#H=WA7(*o_)vc>p)@6*yB{G71Z{2tQ8OM6(c zC<*zM^i(FchiWo2>=O2mL^u#!fY4Qwq!j%^YZ zor0OHImpYXdg$a)_~Btww-8y?IV`it=Uo#e$Uc$*j9o|f5macTyyQP4lxSdA1|dlc z4M^6Hw3RVWO9Kz*0B@uBU^?(rW%jU=4d0MVmp?}tFa_fO@ytx1qJ1|bL824G0=ry0 zt2j;%Spa$%wO#`XfV-*77eyB&N^hotH4Zo+?HxXh(_C#PI47zg`{Zfksynz*vv2U!Ya!$)X1dD59B`8Tu;H7;}jX`Vfkslnw9B?CQOLSeXpdT-}Zqy5bF)QYX=Y%h0fh zXz!8)$ZfBDvH1C_)MdyQFwsmpyr$;KKMGx#8wM^X(g1`yU$VNY96TbXp_nC`+?dBV zN&ku6vb)iRrs0|)Hj>jAxFW-a7dw)HD*TY;*HmLXwOeI?Sq=INR=9&0It;=e`$tt$i0LGH70pi6~H_B8R za9c1QhD)Zig*iit?@=LC{oBHHbAb6F{3IU!Lm*$ZqMr_NKVZGzmgBy7Ls26wpgVIr zs8ViuxA3R27SM&wyRuq%doe4oPRkpu@YY$=90S|re*{cKUh!oTju;~hL zlj3sI*e~MIGqp<#rZ{0GU0E%W=?$(kh z3OEm}J-S^45Y*)#u}to@HDyB-QKi?nb&IjTJjiO3N2TuRR+KStDJZ#dKq-1MjzkBa z$;fHDhe)nJR<4&E-P;b6iy?l&HSi3$KNaB1$_$V+)w-x}d;*eLv_>H~lwhgg7|Ziz zC2ugLQITC<8HhwKxfx)(*(-MND}*gJxwJgJ0y3pbLfH~Y{#&UOy1P?ZapB3zt6O)1 z)=|-qA7U-ll=4e<;^l%~F5!08u_GH7J{Fwj-dbwbAn`6uaNYSMy|@84^5&hG24+Sb z-2PRPy*pAXJac;X>5SLorREzRRxNcE+CC`6wE(Vjbd9#%tukTs)aJ@oUI95oyFcra zHN-1_jQ_NGY5v%Fe9(!2P^kW)~2f#_w4fZuRfGu2IF=?kiE$ zPw`S4RPLoW83h&?!y!_E#5yTu&DNFd1 zd=9%WNqIdgXS+^TTtZ>!}sSlKysHy^NbLg`TA*E%|SBhZHdYdW$2GF$jD@ z6IW0zZQAggq|Cp)(t^}-+ri?tYy>0a_%gO@chPjMNDY;52;MN`RKuSa?YX=M+_SCT z?a>k-g=qHx*KCM3SH@W2xx8~>pE;)Vsr*B4E+;2_O-H!F#V*oqWtZGfT_vUvSguup z$#7n-=8n588W`_96Yy|1Y`Aa&^^WQ2CsC!zq9%M-Z z$+qiO4k~YtIZ1I6aH4A{P<6B$Sih=`m78NUwt2f-fH;5XoT>Te%5v@f z+{#T$V^LeULFSreZA1K%LULe!!Rc|#fevIU;F%c^d7j9Xw`T-dZ+%WravaFuOa$th zx-t96G!rMe!|tmk_kX{?$(dh$&+PZ7I|s{gY)iGpE6?F04(;DQtpT;pS%6+IArMFD zJwlnODIJ=B2LAX+orDt7GjnYTKiBUVuC7M*G26WKPEG0tuMRcFfT6}JU*uK7i+$ek zkCMrkG__QzXvK}`hCjW4bqX5yompE~IVn(GTxmJDu_#BbM8okGYb4C67#1wP%~|Ux zkudKgV8pgGU2b-{!5MWg^sYbw;2{B0M_GCTaE|(`Fi)`~l(BsH6v(tay<)yr06-2S z^CN=;<3R@asDTeBLUUK{K*`n5Q?Epi4eRb)zn)gfRnWPL)%imHm;_VpW#{aQc;Oaq zu>G3IxgqwuNgTE#NZ(Zr#=h2`JX~0F)l{kAd!qEL{Qk&kZiV=bPekr7Wz*Z(7#1s@ zpxP4Xw%_L89z7~&j&Nq|1OHuDq6oiKbyX@91pdyNFQDO^i8PTqoOjoGftOu&BUN^d zIzu5Xm1v)x-=-}S)vvWrhe#!VWv-H9eJx&$(|?C84;mIh{2+2fYt&Y2Y?5_{-Is?; zG)St{Q%#wt#3yy~0g`cb4~;0PG+!3-N+kpE?XgWMl=^q!bc+h?M}027C9{ZFQKQdFHrPMd0yQ8% z4R_d+_kPk434o}J006WH+wnN-H7BiaBy@`{l96%_y^UntelO?>H}Dw_uyTZD;RPe|V3FqM z0YWmBq{GNq+>>MmTsUF(WK6QRk(c8(6JF6LoSsrP8h~}K;t-e+qL*&|QfrgL&Rw)E z*4(^tZgy?CTn~Ypu%mj6v>w;bM^I;26ZOY{oN>}0xzWIOn_4}PHfS%1A?DX0kP8EY zw1=`O#n#M2nsxB&F%<$U2Q|EA646j z0zgQDBxQr0hy$h5X|kI^?5i1w=`@U4e`jXSc~eIu{|Gw{Q}ATR_Ildfo91T;VZXEpR@?#3v#_9-|PnY^GAFK^*=qEQF-MG~808miSjPm)Qnm}?% zQE?GNjscj>g7quq1b=Vfviy&OV*kzQpxI47-x&VkkD_iOb#fv5Mza9fE8SYHA+kXt z{D5Baj_Wu;R;O}(4i;jbZOInz=<1|TRjb($tJec5_jMJy|)T&;F z8dqoBL|uBWs>wVK0OLpFewC9UWj2^hC5al#-jk`ypF%Beqdq4vMR>P1UpWWV`SDNg zC;-h$ zlT{HG5n~)&j$@UL?CHXG{C@K4@%WAHQHD2qFzkWxayW{K!aYtr3*9GjuzPunt?qUt zdHvY=??(5Yv;a)%;d{P~VP|pciIYGKQhaylg7rA&5=>oz*qB@7mYW^7R`V2EptlMt zya!=%{d8|qS5aj(TNZNiR1|*mtaL<(YNv0(u$BR`bT4l)IuLIjy2% z-+?nL<5#MU$U{IvdHA95lqQvOYIJB3&{S{R1O_vdkg;z-eMHuNW0?aIC0h|Bfw63i zcx9WvSnW499dn`P(xdiM3RbwW)zq2LngNfB-ev1?t2A%oN6RUJerz7Owg4(^_r-g? z!#i+r2|K!cKC%#X`Z5KEn~Y|kMW%MSw+4NvHkl^&TzJt+yB(`xx9nbws5;bK>>Jy6 z_p42>u10^;?4c9{z3_-oy>quX=c_Xk$KOGvSRwGygf1HhZI`(;QG_ek3*?D?)D-VY zs8q&IpH#7OrF@RT_K9Vvj*}w$`NWJxtI;{fd8x&m=kh=)Ov@rJqFDSD{0~BouTmOO zJFvsGPyh`upqmare}7=}aG+^P!y@qi+Pm&}s{ikQ%_OAK_*_I2 zNz2I0MZ>5_wosIrkQKts>Z39mC>fXRnQ_TZWu%O*>&g|9m3cGnwfUX*jqmUA{qOhx z&;3WY9^T`;&OXoQ3A+8XuI0)pCl)2C zF~z#hOD8E@5KAoS?K<{eB(^_xUXhV%UcJLp6PYX4>?bPno)PZiHA+LFEgoZbqGVE* z->gD=-oc+de0ghF3tkRUs*T&j#JG&kE?&TM>?JHx zhLV>Lq>G|}3J?bJe4^wZgcwr+9opzOvI3r9GFP+aBurC+yl-k35|CWTbm@z4(+3gM z``+PGZ@D<%T-k(`=SB40Aj;bu!!dm8=h8rwght^rT9|G6kil-T-{SWi-wLR(#`74v zWdo=JYe~ z)go*xfyF?mj)kV@H_~8eA*%liv_T3&YSkLITg7xN+EwCJ3(ksyx19{P&_UOcwxK#o z#P9YE$TpSjV-#F;oq5~pwNlJMKO7l))YVp13P(IpXV85ZIWCl0)r9wW>+_vls<$pA z(w;_N00RasVMetWz+9LY)0f2kFN%#vv)%JF8uugg4mftzbeo@a8_%mLgJ6j}H)6A@ z$}|^x1wZy9Pi`tP4ppB=xwtQ7seGs$fY`FX<`Fl-PJaj&H+h;)(YYmOK5BPs{)u|I zCV7!=Cz9Gj9yYb{y~r$fa-@|vpCSsNfMq)k;8mclpxFM_?PHFTXcdl^o4N7lO4HNx zrGus2uMZKf&#FB3+m(?DL0fxV;Fh)~Q++6(B$jCLC;Yl1GLu16=Nw&i@I=znqG%(w zn?FS^)Zw0A7@Mu?pgtBetUth_s9nH@YPpu4jVtpit7WtfpU75*6u-HpT8KI1sUM5C zq{i3PvaURf3oZM}int#^9J_2m8>8vK^0XIb3e*q0&2gM4!Kyf*^Fa47biZ-_?Q<^K zJ=`q9}81(Rq`da_Nc~N21O^Eq{V-&JIXhiqSpIB^(AgP_T+wUJ()XH zL7W!X{f1ku;XDeuGf1Bp0m;m&ZA3C~D;BPD>1&CH4<^$!;vnj7O;(Aa9Jfx*t|7TY zLa4iQK^(zQg;s3ZqMiAvco&P9j;6}vKAp?{56=$2n6$EGZU<;Q?$sKuB}U|9?Dx7b z-W}naMD=rnPf6pKldwmIp^=2Dc(wAa(x0Wct5nW9*5&?T&EZAY9;1F~rEi=&kqv3l zXA!|ddK~L&a{TPKOTZd~0+qFpT$&Sdg|)ACSJ_Us49fsJLGL|xUnq5ae5wr9!q1~TPGBx65ChuZrdQ2AkxnWxs;Ip?ka|ZuW&2@e5zuMCMLXzziYQ(wN9QhD~7H= z<8J{Gtv|gsOrGA2t(vKN!MMOeUksjuub*-TjM#a-*-`)m6QrG+D7X4U_HZR`bL3I8 zZRbwAP9>pm@Lh=bzKY_4aVi#cO9;ZJSqDyCYA_w53&{{jYj34&|ut?~!@4SBx5)H#5m*Vrm ze5&ID-rrWP_)wYi;3$9WxmM@3?HFXM)(VITArGaOZM5T-<4TF^kA>X}9nS_7gHLg% zC90DmaGULx-koHSXp(H_{OxKW&%(afh^O!+Z7Wyp&+4bVDtBj0;R4bp)-M$K0>^N$ zqUDkf-QF+HY~Ew^ZeIcFj9u7B}50 zaz^sR7IP%Rg5-}S%f-7#U7y2e+rK0+-c8_0$S90E_Uf3U9=2W5v{>&d%b_N?7_J8KR3O10M)_mG!U&Q;0@oIK zO!Pu#6QFpRG7^6`D)iNbY?cn^mwViEvF&L4wRW#JXVIs8t*?YLkrlriE8GaS=;@f1 zc`hX9&UPGhwJ;hgs7&Eb;mO|qncpZlKjQYEnEGj|p%RnFVEVCb{-oJl$(wZKKO!s~DO8cm+>CmbR6q+f3#= zC4ILq)|D9(&J2{!G4{J~TAK*^YzJX!j3+P_M2Gxs^!15W`KKq?{X}_e}yB)q~Vw^0!p>`>`a6R>rR0VO?NkHbv-5aX> zoPs8<%tjg3b)q@oH89ib)~=WGfJ$Uc#0yp-FwN$ZX!I>oS4FnfrR?DRcTJuR**tDL z?#bOp;@P>V9PbZCW6iW!UjJf^Yyoe)+EL?DxxL1G{bv=%1r)tJo6l3r%b`el(x8S) zg4Di8vr)ySZ#)1Er)`NwdYvegj2^GS@h^X@ZN=VEeBEk+OXjx(gZje8nC@)|Vk~R) z2nE%AdV+Ga(NkUVf-T7qrnpK7NaI6p*E5Cq=@PjYnu?;ZldS%5UWy5Aewk?asH{A_by?akh>gPb`CM03l| z7j4CIQIRRSLTYuFThICs0S&?$UN+b~PhI%c;u0aqeE0Jcu6Bj)!6@)kj;#VsX$LNz zxLF^U628(+h;NPZp9deM{%9~?(|Q%>P7OHRBwer~sOvkNxqM)FWcy9oaDJm~M9gY_vm*ZUDJ40i6&D-q;<`?Y)+70)^S8B!}tv&z8OnDw-WuL2h{!s(PNJgSDfvPyFrZxD@t_!))RTxdYRNo z2|1-^m;N|FQD| z!~1e;Dt5WES^rA1PWL1~^r02}L>1i@YhN`5Q|PBNav_IjyTxmuscrW_?pN`7v)-@@ zv*M*mFZJEW3?M5=H*$SOB=6U0L)*kAz13m&n4y-!QG7-#rS&{Nv>B7qcbxe{rBubz zbL{?%;^n@Ca}2J5*ru!l*l%X!3smnj?%AEKmLEFpJBp;-#tGIiBa@)Bd6E0V0A08X zuq{EC_HjpNcK?AQ^WD#)?JREEnN95!*b=iX!?sezP*Vi;%uhE|*Bc?eH0>3mP_d`I)bos;Pq{BmEuk?6Yj*VSt6 zfqAwdFok!0t+=7r!k3;PD7llb;paSXFE%Osj|VF07cregQW6| zJ&-a9%z~{>RR9)bvX!zo-KHf$R+KgnS<1`FghKnz1qG!iD}SoDQu(btp#o>P?b(4x zLUzs?f|Glz`?1dxdrhSfptp-d*DeGd4TUMTui*4o*(^s4+VpZG%do-D<$K9`v4zRp z+OLRyEQr|-8~INij6Ln%B{TH4z17~gA{AdVWJZZR>a`z${I*brhAI+DBw(DhBYYyd zauh#)(i->Ev=Ks0SN<-n_a)C}=(kb+1~|C|YpJy1kw@AsE7b|AL!ZEAeI}3|XWp;i zK`DFiaXk-GqRhyx<{wsU3LsO6zJ#KuQ^HS#^s~hV-g|0qDca*VAz-sAbxQt4Wjipa zEt(pq3(BTr$bX-|*Sx8d)YsF-S^^3wd?H#JJrsqsGmu-fp;$Iv_ zJ^SJL#g!yfMSC2g@r!u1kfBY!2njQkAN=Fv69y z;ygL}pQ4xY$(5KLi&4r?&=@dcOS%1Y8)655U6k${751~F%Z>m{Uc6P6a$}6=6if;e z)gNT!b6sy&7JS&MRo#g|ja6V3L^?|n0NY_DMzPmj*Ant6!a|HU^%leDUGA4tF@?U4 zkcwFh=U4jk>?S#dN~*JqCu?0bixlJJy54FDvnv#Cek~tRR%03!)sJx3(qc<;B4C|{ z601U9i7z?bD|9Dve3vixo!z=!*py+Q4#RP-7>w6Jbu`4B7*27#vg`M@N@6z77 z+XC>=nJfp@;$xTpA-vh+Hui(txG0jclyV>5{vDxYa;DY0Y9e2g9=}nCB+W$A%L*gCCNaZQwmDtf32sclmfW!vgCb*fcZB> zC42X)0oy(|^2}U&)I+(bo4rM+)azvU9qbB9O@Ayszo-BH^|8gXFmI!BzV{u7>&hz^ z5I<|P$M-J(KiVIsYMzIVTdihPP9Np(e7%xL`Ey>O$7=Fdms68W#cGLFOiAkI{>)jv zmG~0MY{g8U_v%+j1tq8hCDd5($t~=NQo|c5t22%2?qSX0#PpDUDUHc%_>Y7gD}8e) z8;I_H!ovzX2VUwXup}Mke?1V^W1+y0F;W5lAhhMwz%2n2kD7Dnr=D3*^qH6pRD5wU zdY$9ih94f-IgxnzPOQSY#Z4g*O%YL}Y+HbF;aiqaIh{+N2O^F6J*Sc=?PrP%aOuaJ z?Q-F$jn>L3;UtN-aT9E2I{~kMlc@tqDZPkfDT36EA1{F(828BKYsU5rbwbH=Wx-nx z+hq5M%sr*m%?hllUvo6&FP3r0C!a)+)`<;}CQc}+w3pg?O?bF#3;7oMwg_mK)#{Jj zrdd0Ly&EiL0AV@RYmZ)F_xbwLuxB*hNA{O7&yGgy)Hsxv*n7 zU%NiEHhXlMH8%wn4tY;@zoV?!a;c{*pI98xC{XGx&*U$dc^PUL*QTuN?C^4@?o*OB zT4MDpb=v%M{?049Q8Q!yqn@;L+sbul(Zma=Rzj_s&oC+O*lPs#Zr?@Dk;n1XWm5z4;y{XNsEFguQX}i3~jI zRu`x+WMD>+k@g9gb89-g|_(T3fG{k85gaQ_oKJ% z!N^(&Kix`=??n)UELwjqfO9o|RZS(PP1gCkT-oO*u$aNZX?cHa;o4SleKDN~V)RV_ z1sRsynBLE#NQ*qflyWidx&9y*d@k zePbd_zrOmjaq&F@OV2@_bs(%9H%A>*t4{E2E;v|0i@i!1-SjDxf7@sotuT1(`~0At zcA8~>TAJv)!rYmPJ7v1BFPRajBl95xcWyyRI5qw+-6;#dmEbULlbh9q8l3lD})gvHBsnPc{Q7N@C?@QQ6D%Z^;vu{_U4Mb`eBhofwVlZpaP75TQvn^jo3AC(I@ zs$@H-+PHT|Pk|6dyOYrVL11|lz@(pYOxo-ck>^uci)rOms0k@NhEbRl3_ARaP7^Jb7&x0MTC0k-uCo3=Vs+}{~Cm5WGfe&}15$rGgpiEtm_ zUH)1M6-nNFpRXRFP5?mg5TXkP?f89Dhw)gKV+);x0A{XpvYT2XKWx`%^<0RL4ct)KLej_~ji+=wd!6GSKTv7hR zGqi}NHX`}dkh8lbLyElG(C6~bs%Xgw9TVBh2={ZJKTir$e&2iNY?EbFA+;rbKn?vQ z{=}V&F}@QoZcA6H$3MhVU*xdZh?WryEi#8*Iu(t&W(A~jXF_Y^VTmp6sSf< z*Q$}^r$J(^vGZ4Vuq_t5zgEhhMR}o3%>ao*o4eL*u~4D1EDj3+9s`NS%76I4d5$mW zGld0w2C{nrh4h3@h*|Cy&`!&M>IHpD5nE_x%a92ysJZs4IFgQRXu7>%Aa|)}5%HLo z-40b_vpN}XN?|C0bY?0*A{&3um?O@>EsH47#L!PH4aZd`d zEl0?T^^fBf_$O)%kXhn}w8|{>nZQ6@6z! zcS|5~Zp`)xv0i(SHN2lf@zFvB5D1LVwx$RE%$ywy)w6Dkk5%T6k86vLmvPXZ!;L+1 zEN}I?cF)YSNQmRqU7eds;WQe<$$P4w!sG1!{5)+|YutZfFtjI~Ek}?YoU%!ah#f>dizY$)TJ?FHbu9f~uPoA0#SFV4IAW$Hx+$3Pe zfU&_L{751zZm7tQC!@hwZZltfdFOOR9D114`9;7bp%g%(Ba%%{D5KGmAvqv%MI)Ek zvS!CG0RG#Al!ut^Y*<7vYtLfya)ms)dRUM$QC3CgCg?t84Ab3Qrgh0K&ie#XE}>eE zWVSC^z-9V_*G$GJK1NdCj-e!ywOCPRwBQOetees);3|nEUG4s;v#hj*?UvP_U06M} zb{xN4AZ(HWP&NwA6aM!VQBEealXiD7ri~@@P0C#rijt#AwG4oCO35(it!>}!X3LO3 zl&UD-Z^y`hwIokA1kDYjm0)5e=)0D=YHNHP(Jen9KOfcfg_vC8v2mv0yC?X?@L*cVqUhn@AL^KSI6^-wj2b*zFVG%C%dSfzpbV2NnWT z#MTACN{q|D=m0yc+p6DJtsi1uQ#h>gF2|Z$eV%?}RPL~c5R&CVtA_6F3v{Z_RO>uQAzYtP5RnDu5VVvZ zBTOdV%7=PtLuRsDzqG_XMQ_UJF2&f{yz$5+q7qpG@{KD7yKkS^jav9JyRzI2ZdtH- z?I{|#851H1;hr5$RXnI|j0rn!Zybpqa-ahBbn_=I+cMM6IL^V83n=Ttotlkd;MA7^ zomfv_1q1q|&B57vZXDF>T}&j0Yf>mK{N4+Eex#lH^4mHQuIWX@hAG zKZXj)?~CA^yxOY__ZD22qx#2>Hvby11+3^rI0kUDEnk{@;}bt@7?$JkqU%xWU|mY% zhs(g!fb}!oRjVFj_d31ACDstPB;O7>DI^m7GeAiYKEjaawgNBr00jZ z(Q3e;0FFwvLHQIQo+HR;02Z@;{d>a zn*Xe%igx{YpP-Sj_2Ypz|F@S^nAFS2DEB4}l!^)6$0-SW{vUNgn{ZTGNh0gx@b|=>{-50|0-2&&l!D zpe2vTJgTarBHrDE)tm~SIBvEGXplaRx-Tnb@0QJ)mche(@xl8`$IFoIQ1IV2&^>R< zLy1D4ZqSktK^?$9xXaKRBV)7$14h*B1=5o-UgsXRbA`Z)dy$3UYKG#cLjROZ{}9C@yPF{kXKzMwPVY z!5ZKoT47823wb0ipfQ?C+@t9~vQqD>k7}|7WT?9P`SwpLHhd67z4!uDuY6pOb90#? zI0mgdYsdfaH>gKJ*>_&cWAQv^RqOOLl%}njL~@~?k3O80x}-kZG?}2TCoie!GuNL@ z#-P*%0fEp=r7SPTTPeY)3!6{J=)qix!^Xg^X=s9IsQSx}rx2{@V*9bsblbpymks08W~6vO5}r+WZFJUx!qfbkuPHYF zxviA^UJ0$E$q>N9oZw18m%@u1YO+LrU>+8C0>#ZvW&HL@r7cOWCbg_qajHTQ)<0+o z8X-@2WbNs!akWD)iz zDe-{nx&3U)y1)hlV8))*m=lKp+51$F8~gDE`AnSG%C~zyefi&K@_mtw2s3LVX!NFcKp*rD7dA%a34n?9+PX+^5M0nj`ZKCTb`hcy z%^j8Mbli0*DrAS*t{xlJ*kaY*z>4;(MjEgXb>FqNhqtS`R;@|28wyS*Xr>OZ*FYjA zM&TRval?0r5?OP@(PJLAtTGedgPj^CubQ9jv>q2kIjBAeoAH?c^+hol(qJ}kxH%tv z#~U0|j9NmFO#JJ3dl1@ZRvXUTs&vxKz8NJ2f~WeWT{fApScvj6G5sf}%_{7cJ^R}~ zNOkC{ZLb;u{kp?>d^>A`y0&<|^C%puT8N+s+ufNzt+Vo!4pvS+H0o9{WD$n-7GFsC z$uDu2eu8=b-OLCNaQ8MsR@LJ*)nvjCxnB%{Qb*qsCxzdh#6Sfa!>3}ey{+wz!Zc3* zB6KuK>6K?TEL$n1vpm{8n!il?1&7|$f zuPZ!MWgKk+%R8j2vIcWZR^ssKMPp5vIv+E6e}v^sWKwO+Ed@JUDq2jS@Kg7V@Qk2b zoMn5?_(TAhFzWrjHK!w-R?(^SOycZoRsdP>Pmd;$%eRtJ_ALqN=QaklwrBh9#7w@$<_+hrnaN$Zm|uOd%I^BYz zA#aKCT`NYAFYu`^`CDN9{f5F`Ta)$L_j;MXnZ^1)$87vFB8tCane*)^wm_1k0418H zeF%RGnB&^#-yN9sKO#SWG1K$2wZFnjGtkvx?W^Er6j;uGJ{!NfCW;L)t?R^wN^Gda zhL>2kh7D)BCW-%}N?_^HrEs(0x&V=%PK@*cz}jD7V*VEUYhSsAuxo#!|M;}=tAE9@ zA*OY;*ieZzNo=UZhDvNW({&x#2psE@*od!dlGsp*4VBmklIuFKkvFYLVnZc1RAM7< zTGxS%Ah|Ay|0j71)4P>KHtV#7