From ce8bcaa0337d731565b49ca14622fe124962e40c Mon Sep 17 00:00:00 2001 From: Noah Talerman <47070608+noahtalerman@users.noreply.github.com> Date: Tue, 17 Dec 2024 16:38:48 -0500 Subject: [PATCH] Release article: 4.61.0 (#24836) Release article for Fleet 4.61.0 Highlighted user stories: - #22077 - #22078 - #22075 --- articles/fleet-4.61.0.md | 101 ++++++++++++++++++ .../images/fleet-4.61.0-1600x900@2x.png | Bin 0 -> 52611 bytes 2 files changed, 101 insertions(+) create mode 100644 articles/fleet-4.61.0.md create mode 100644 website/assets/images/fleet-4.61.0-1600x900@2x.png diff --git a/articles/fleet-4.61.0.md b/articles/fleet-4.61.0.md new file mode 100644 index 0000000000..313415784b --- /dev/null +++ b/articles/fleet-4.61.0.md @@ -0,0 +1,101 @@ +# Fleet 4.61.0 | Auto-install software, email two-factor authentication (2FA), automatic Windows migration + +Fleet 4.61.0 is live. Check out the full [changelog](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.61.0) or continue reading to get the highlights. +For upgrade instructions, see our [upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in the Fleet docs. + +## Highlights +- Auto-install software +- Email two-factor authentication (2FA) +- Automatic Windows migration + +### Auto-install software + +IT admins can now install a Fleet-maintained app on all hosts without writing a custom policy. This simplifies software management and saves time for your end users by ensuring productivity tools like Slack and Zoom are consistently available. Learn more about automatically installing software [here](https://fleetdm.com/guides/automatic-software-install-in-fleet). + +### Email two-factor authentication (2FA) + +You can now enable email 2FA for Fleet user accounts. This adds an extra layer of security for your "break glass" account that's used to login to Fleet in the rare scenario that your Identify Provider (IdP) goes down. For all other accounts, the best practice is to require users to login with [single-sign on (SSO)](https://fleetdm.com/docs/deploy/single-sign-on-sso). + +### Automatic Windows migration + +Fleet now supports migrating Windows workstations from your old MDM solution without end user interaction. Once migrated, you can enforce [disk encryption](https://fleetdm.com/guides/enforce-disk-encryption), [OS updates](https://fleetdm.com/guides/enforce-os-updates), and other [custom OS settings](https://fleetdm.com/guides/custom-os-settings) to consolidating device management into a single, cross-platform MDM. + +## Changes + +## Endpoint operations +- Added support to require email verification (MFA) on each login when setting up a Fleet user outside SSO. +- Extended Linux encryption key escrow support to Ubuntu 20.04.6. +- Added missing APM instrumentation for Fleet API routes. +- Improved label validation when running live queries. Previously, when passing label(s) that do not exist, the labels were ignored. Now, an error is returned indicating which labels were not found. This change affects both the API and `fleetctl query` command. + +## Device management (MDM) +- Added functionality for creating an automatic install policy for Fleet-maintained apps. +- Replaced Zoom Fleet-maintained app with Zoom for IT, which does not open any windows during installation. +- Added support for the new `windows_migration_enabled` setting (can be set via `fleetctl`, the `PATCH /api/latest/fleet/config` API endpoint and the UI). Requires a premium license. +- Updated to only show the "follow instructions on My device" banner for Linux hosts whose disks are encrypted but for which Fleet hasn't escrowed a valid key. +- Added App Store app UI: Added different empty state when VPP token is not added at all vs. when it's not assigned to a team to prevent confusion. +- Allowed APNS key to be in unencrypted PKCS8 format, which may happen when migrating from another MDM. +- Allowed calling `/api/v1/fleet/software/fleet_maintained_apps` with no team ID to retrieve the full global list of maintained apps. +- Added UI changes for windows MDM page and allow for automatic migration for windows hosts. +- Bypassed the setup experience UI if there is no setup experience item to process (no software to install, no script to execute), so that releasing the device is done without going through that window. + +## Vulnerability management +- Added `without_vulnerability_details` to software versions endpoint (/api/latest/fleet/software/versions) so CVE details can be truncated when on Fleet Premium. +- Fixed an issue where the github cli software name was not matching against the cpe vulnerability name. + +## Bug fixes and improvements +- Updated Go version to 1.23.4. +- Update help text for policy automation Install software and run script modals. +- Updated to display Windows MDM WSTEP flags in `fleet --help`. +- Added language in email templates indicating that users should not reply to the automated emails. +- Added better information on what deleting a host does. +- Added a clearer error message when users attempt to turn MDM off on a Windows host. +- Improved side nav empty state UI under `/settings`. +- Added missing loading spinner for delete modals (delete configuration profile, delete script, delete setup script and delete software). +- Improved performance of updating the `nano_enrollments.last_seen_at` timestamp of Apple MDM devices by an order of magnitude under load. +- Improved MDM `SELECT FROM nano_enrollment_queue` MySQL query performance, including calling it on DB reader much of the time. +- Updated Inter font to latest version for woff2 files. +- Added better documentation around how the --label flag works in the fleetctl query command. +- Switched Twitter logo to X logo in Fleet-initiated automated emails. +- Removed duplicate indexes from the database schema.. +- Added cleanup job to delete stuck pending Apple profiles, and requeue them. +- Exclude any custom sourced "users" from the host details "used by" display if Fleet doesn't have an email for them. +- Replaced the internal use of the deprecated `go.mozilla.org/pkcs7` package with the maintained fork `github.com/smallstep/pkcs7`. +- Switched email template font to Inter to match previous changes in the rest of the UI. +- Updated resend config profile API from `hosts/[hostid}/configuration_profiles/resend/{uuid}` to `hosts/{hostid}/configuration_profiles/{uuid}/resend`. +- Update nanomdm dependency with latest bug fixes and improvements. +- Updated documentation to include `firefox_preferences` table for Linux and Windows platforms. +- Restored the user's previous scroll, if any, when they change the filter on the host software table. +- Updated a link in the Fleet-maintained apps UI to point to the correct place. +- Removed image borders that are included in Apple's app store icons. +- Redirect when user provides an invalid URL param for fleet-maintained software id. +- Added additional statistics item for number of saved queries. +- Fixed a bug where the name of the setup experience script was not showing up in the activity for that script execution. +- Present a nicely formatted and more informative UI for log destination in two places. +- Fixed bug in `fleetdm/fleetctl` docker image where the `build` directory does not exist when generating deb/rpm packages. +- Fixed missing read permission for team maintainers and admins on Fleet maintained apps. +- Fixed a bug that would add "Fleet" to activities where it shouldn't be. +- Fixed ability to clear policy automation that empties webhook URL. +- Fixes a bug with pagination in the profiles and scripts lists. +- Fixed duplicate queries in query stats list in host details. +- Fixed zip and dmg automations showing null platform for installer +- Fixed a typo in the loading modal when adding a Fleet-maintained app. +- Fixed UI bug where "Actions" dropdown on host software page included "Install" and "Uninstall" options for software that is not able to be installed via Fleet. +- Fixed a bug where the HTTP client used for MDM APNs push notifications did not support using a configured proxy. +- Fixed potential deadlocks when deploying Apple configuration profiles. +- Fixed releasing a DEP-enrolled macOS device if mTLS is configured for `fleetd`. +- Fixed learn more about JIT provisioning link. +- Fixed an issue with the copy for the activity generated by viewing a locked macOS host's PIN. +- Fixed breaking with gitops user role running `fleetctl gitops` command when MDM is enabled. +- Fixed responsive styles for the ADM table. + +## Ready to upgrade? + +Visit our [Upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in the Fleet docs for instructions on updating to Fleet 4.61.0. + + + + + + + \ No newline at end of file diff --git a/website/assets/images/fleet-4.61.0-1600x900@2x.png b/website/assets/images/fleet-4.61.0-1600x900@2x.png new file mode 100644 index 0000000000000000000000000000000000000000..0a70114bc296a0b750baee6764d43e20f3d42eea GIT binary patch literal 52611 zcmeFacRZEvA3uI0BNEEWJSeM>5Hij|Myaf1g(7<;dmbYr;*b?t*<>VpH>?QR8BxgI zdmQI{@B5(7`}_U(_xSzS{diR8ocq46>ouOQd0qFT7pnIZ$w?VV0RSMsrF2sr0M7UT z05J&(5%>${k)9~{&*`U1It~CpdkOl3cT4@^D)=LwgSw(DP}s>d2YxwaCUaK?0E$s$ z=*NTr&_RFerp$d;yu}e2Jb)4a1WQ+=6|gt^Dq9AO9a0XUssCO&R)0T&A0jw?{`Od{DZ{5AbDa9 z|AOSPB>q9-{{tja>S{te-o4+D#O&yulPLZq*vu&wK{>&k$onGpTWrPS2WN!u8!7O{ zKNB>1^iH!sPaM@+0n*(@0lfDEIoO~(k$mIrmD1#?sAi6ottIaYwIc&@XXlQqBy1=CXV-iZ9P20 z2e&o;UOrQ&V1K`WAHJSO{P*jt^FIImdXWpj`_Ff!d;ixqMnocT>OXh?E&NZ^|G8HejdTySkcR!TdB_^UT|uwSQ8%Q9 zDyz*BbFp<3qSR%l@fA{%bYtf8SL1Z7W3reqQwdl0#E&t38Lul=R$-WJd3$3mk4>j5 z;q}{1Wkqy`Z$!m~=%Pv-1h0AVDrDVj`aRcMZ05N?I%o!xfxCP*aLmSNo?`WS)7iZK zW;)Gm*1FU=F$`sCZRYT@et^k%CcHbzFG4w!MB07OCit=){mW$${}oaxZ_TKnKr6P^ z$Rq(WS^l@|yWB>ok^Sn)@cPS^-7Sh`E}nU`e%7o>!Ar*H?Oo^ZpIF&yd6v}!JIt&d z0&MYI>@DB4&ad9NvpMd`c|$Adh4NeN(>#6=KUK;b`=|t4TQqO79=@@CG4?jBY<5ze z`+-b&ZMD>x=bXG?tNe%JY#|oi8uo#Q-Bj(mdK2p0vJqy1ie1c#C;X*$Lv1FX+uXF$ z17mQ;_8|Vdo5d0Ar!IIG{u%9NLR${U?cBt6R5Uv^*lU&Y&jq*tnJVu7v9qYLHeF8V zZ+N$OyV#_^-yTcu6?bJ{EagjYwv}M(`5Fox!jt|KLo5_RxXauFSXVUj{T9cDc~9+8 zhBTqd8V-jlO?wN}RAeJ4iVS|Y>`{lpWKVixsZ==1)GhUNpR+m?&-Xe+-YO$UX^?tWfwems0+mn*5HQ?viAhV%v#kKtrI(gbA_SUEa1)~K_uIgtFOC4wxQ4CoA6T`5T}Dn8(xaD%)6Rs5L};;K zZSOGMpbxV)Rx$H5?hPx>7eO`(gP>Dcyzzwmr2NXMjqO}!#EOCRzFL@-Vr;RhQ`Un+Z5oFdwiI~hjjTUzGQSY)$Tr@bYx686DdYDdb@qdlo?Ve-IPp2OXBDa6(B z%e;2qD3i(ioJ?`=!}-fbI(k;<#a6u&Rj6u0f`HW(E{uo6V+**)eIAeW1TT17@tbBP zOzb8UJGO#+XnfXww8SCwE z`ta2e_!slcS1(% zQ29dU8p%A8PDQ=elKsGd#-!ZSUJo5Qc6q`~vBmhADgV)|0FZYRD%3MXSdpd9_a__n zcFt(R@#9hOSjU~4G>(PZLzGlXG!rN{`BNa=d(WLjYgKU^ubJUvCH5nt@6IE?U1pD% zOTR1Vo$5}dr01b%z3*T2fD`jt>n1D!5+Tjuo3}Cc<6ByaG2aAygAvE;`|##2Hza`v z(r>>DhD-02%{Q@b*zO+=&FX5_bvgGEP-yaFUb}pe+G%Q&SPsc^1NBgebTYi(olqFQ z+wbIc84kC@f35X`e)bzunxorfAt#g0>p zod4ytw(As|jj@{jXC9uA)64;Ne${nqOs>aLB)!PHj33ADnCr)m*7oZ1>Lv+faTOaL zmPlLNm!NHl8z^|Gpz7Ia^cQNWi%^Y+U}$1*9_DlC<_`I8(x2Ua=r$6!)A(z}^EyM* ztL5a%Ip3hPMHc-AUdW)*cc-%$jdk>tk0}76<8g|fj52)lLP6t7GWBm|or3y9}pjluY zw5}Fm=>ASXp$KXx`Yy6%!qxn#yl`63Kw*xT_X+bNehe^!sz{$TFsqUW5NuFrnW#s>}wbO7x65-qhqpT99&qHr^b+%$X9mUwN~3hSaq-{}t%b zI8m*Kc88O7g>@Tuo($I5%B_a?yNuHf*|5x>9<#^tLUZFTRcV|jv~8o5cxZblI#bV8 zm-0hfukIIf(q*DFzBQ@26>TO)_Z$8$V8FCjIUeQHL*)a0bn30R1*{vi2X)>Y>8X9k zT_-mHAA3h)6k9+aoPYfa-HpU9W-qOi7c&s?I0soh3p%u=Iybo>_xT#}6|Xr1A^KXw zmFlp_{-s0NppBvLy)?(m04D4>Q5)^uoj?UR7PM8p?5Q#`xiYtWdaTGrf6OFWM4$Q7 zLBX6Q%EX56MA)jdIF|UU3%f3eKZy_t*ZJ@e4Ti9n7FJz!x}&c0iklSzq@5~ECm}ET z1q9!m(82{ipDP!wn0mdwJbM5BIBL;W*tW)}c zAL8^CSK@zt9vb(#zzxT5B6O^=rpltzR$xSV16Z2b*GaQ zaXk8jub*?dS-(DKp{8pT!ORO}tQH=W&FAy5wRJQ1_)&nH>_}X9S*d(HBjV5REq6D* z{r%`MS4+6Ub^IW*Hc~n<6L9D+oR?Gz&)ULkENZ?XVJ}ym(y&{@O|7{89o9z2ghpq{tG#Q{Qz1*GCE0%G!~(dFsZW=9W9)qU)H7-0TLcm8nD_Y4ycM0TQTgSl zyQfxm)^iU2t`Let+?y{WlCNq9HzTv?$5TXK?lpDB`R_=Si>}}YfB%gxuMs%r0`b*# z1Ps18ZwyHgV`jp0pr;Y7I23lR_$o&{31(@nc_hpb7cL%;r?gMRAN``D004ZdFZ>*0 zD$#Ho^tzAue|O{B}qF z3^uIgmD?n7g0UwO1Dg(`TPLQ7>n%QaN>GmwwzB?hwfkf}Zbmy@NYo;nQGX*}>+foPjqnjpcCYkeDhDJ(cxtL?{x4n+@-33b05nJF4tRD9l{uWqiqh;RU26kk`E2LTiZ&(VclAY zeB=o~CY-qN`=hSxl4*8A8dZ!F-k)C^NapiFf$3B{skzH7S)w-OgpAhut-)!Ol>mcPBD2h7BrLVgy%S=m!}+bLMC0Fcw%j z**W&PhO0s>YB7@o^dm!JC>}dSfj?nz(w6Pz5dSXhMTW22T=nNou7jDS;dnV0!&gu= zU^S!hmrGNKOIXa(xK-FtZkG8e32a&>t#9xx?099Jnb^3S`RYDvUN!>{uYr}^3xx!tG4pk}|mkav$J-JX}%@7YI zz5QoMLn=*X45g_wH@0j%tRipHB)v`wEvnshv3K47TP59>Q8wENLo$JLe`Olqa4s4X za=f1R1dS+u+C!`9=x!u=PbFLt3^Zz&u$UEm7 z3_l*_!;91G91T_L;{BT|fzK3R2Pw8Mv>L{B=l-B}c-bSm^(7|qJ~?#{k5QQj?d^P7 z!(!15*KeW)ix#OszdE<;Pv^~Imne4Oct$`Im$2Oay_-BuKQwTzju8si+yS84clVHX zVL$cs(y5Y?=}{aK5oLiA#G?h863-ma7EsI3Vaok-i!S>N|j3lH-(oo4$-KQSm z`e{YPQ8F}_>$*ie4&OP%I0=8~HS28d3V%6BD{}o||Ao*52kcqwP^bS|Hqs-Nw&-M$ z`#QZM??h+3tw105OOnXjfgh|;>6YrMSS&*NQG>`)CP-58=kI=!084?!4#VBsS9HeC z4>1j`JzGS#a~W+<-CqsIY&Wfa{}u8>GGfK-LB6-AN6V)lLd#|+8W$$QMHpRqbn*UJ zmG;&g6Lt>?7WURy11p`%DrprjMcgHi%g3rr|+a zPR02Whcz=0@u1jFtUWanhoqj%vJqu^(_rSf{~RX2TfFc!b~v6QTbp3+uraW5d3!uh znS>p^Yd(L$kNS5D%7FC+mmyaEPUp81`Vi^3)GJ2qIZR5<%xLM*p=?3f!a0w}0Bi4X z20m!CHfhXDEAwE~)9PWB=~ezrP|{)_j6G`idO|;=P!@73W_(0Ll27L*lfW*++HRp- zv6mzJiHI3+nS4%0;X+sQN4rk>uA-!{PEE53BW_t#WL(1JYPqQuYaF7Ow5QH=HLV%8 z(cQAN&>pwb%G_jU+F&G{`$EsDl33gC;4a7VplP|E8ZJ#)x zRTM6E{3+v;VoVxL2}^#{Iq*56JltVM(=5Gg5{;5;s&4uAB6y9UL(ofjqJThtwfo83 z?6=^hJF>LXx^<_04?;>pOUP1>9l^E zWdh-hMdm25;ZwE{@bXSd$XDG}L1vHfguDP&k1qXC>D~7a&Th*0$NUirN2LT;G;>)E z5(g>b1G~E+4FqlIoqKCLpWaCvM{+t`VQX$K&(t%#w!O7@zwz7YNW}~2XC%+of0#!Y z8n#HVwYK)<`UE&S@r7Nkj%})bV;dYpa47h6so%bdroA(1+zsyo)o0YT13294lK0LI z3pwy>a<3PQR+4=GCz<;ltF6~{%u)kZ04J}HO}z}DipcXxq(jOm+T=IYq|+!mvq{8l z52p6%^O{(^ifzrqDo?OR3xh%u@axs(SSe}2QqJq+URHdY+=ZbsPhY}0GM|q-L zZ=j_h#q)r>@c5n&>S&AOqrAp*mZr9rx|C`@P&OxF_^CaFV*uFIuC9)4o`LVg534;q zS(q;6Xj)W;_Q7r&tF*Sn$(=Y{&j;|Ku<>4+^yS-WZ1eqF1M=h2A^>1Dmqv4kPe7bP zS7j}P5CC|nO64WF{)ae#75WBVs*1SO6zE)lh)+FG8lA&d=Z>WTLStBUOuBoB#`I4v$F8q0BIoh-bp^X2LS6h{|*Sh zjv??`J6!R`Y3TT-&of*(00@Iw;chnt%e$l#rL3Eug`Q#X+dUz-O&Le-ccAgFTx@Z2 z@d-JPJf07+2er%qfcFmigq8jyY~*mSo#ejvp)?lkhNWSqiWUDi8P(Bbr0!Gg6wNjj z`6sDID#H??PbGi24~H3UbW_6L9Ld-_hx;r%>;;HfZ9l6cs2 zrf*ZH0^{7K8v@DME(&>YdTbkb6m-p0KiElrY-YMrHh^4d#MCbwBZwLW;7G>%mMF+q zSh?tTLUPEhBRK)m$PM)0AC-@O{Mykl-$Os{E_-sL>C%yU8r4@h2ocA>`WT(ZS*E!W zSz!v@@sEhL(>~Bg;ap{YOO(UN2pCCm7kB+{P;08}=@hKYEhs7ea69qB8BES1rvCbp ztDtjTZH?Iojf$N&XH90YZn)SLT?LGt;9f?B$xcg{8dz_wuyvy{N%@rq%xgCfRL4a6-i0cMCY4bg9O;@g^+B+5H952Gv^wk!{jUU`0`Q1@aBr- zleQ>AoWuuQDj@1Ji`hL_mv8PfE2ey`LF|Wnn;SjbpXO#vd?Tpwb@n!q%{|%m=lhzc zq9{-foM9p2*n=N3gwoq_ejFADKfc)y4f2qD*j1D;a_h30DX+tmPyL%ox5-0F;C|j6 zgbJs)hpl@pGUr8LyGQ?H&!9{ zc&|4`j7xqg@(oK9VQN~Q=vflRBe9`=FyTu}e{E749|q#T_x4*<-)FUzUoF1({a`$& zUR^(%ZxF`XuhjJ$j8=N_-x}9-0Do1&i(%}N;9RcVY&4g$yooT# zoJPe9Wf30F19pobZZzn{bJ1pa!)-2=t`>yGuSStFfcbrmBu&I($C zg^S+ROY?jCe8}yxma{RjvE72Ui?7FKN+!c*Gz3l7pKCw;S$oWhj~CA9s$z$Q)O{v) zi#tZrB9jkh1oj@%;=8$T2&A2%HE?|RZEvZ#`x~ZyMkM2E>r6u(AB=*(Dn|-}_vY5n9(t;IMC*{cNRAd?A@h2I_kxqc?U>Auh$AxZXRIp9UplouS9Bx_uib5r#`5NXTKeaRx}%J7d$=lv>uWY@RrMuto))%2bbGvS@=U zIMC}2B7_!y4}=cy!`<|W6@eT4*R4G+J&>&9N~JPQ)+t<7v^?0&u3`Q5nKeQBn3mMR z$KZSsLdabShlx^SBu5A@p`QB3OeN66iI`9iCB-FE7AS_1m_H8{utZ%`dW>R(dnhLE zjiH*8T;Q<35$NDZA|?YFJ0^G$Y07wUsJa;rwNnL(=Ut96&xg`>GNZ1&>|rNH`kfdLDuzYXcPDp?|5$48_URzcL0-3G zzL!;u*9zc?Qt7(E%bDWnil~FMMcp6RNtfoeoznaT#ebsdR6Cq;@IyBGdaH9sekkK( zJ8?GFKscQmUFkVp$(;_dmug_z$!$u|Ixn*DVO5dT_gK2XAucpLV=F^O_Y-HQ(6v+u z8*Y5G zy@Zd{4_cZUq^`GF|CawFWtN-bFl?sKozYD3`-EV6F^KKd-)*B9HNl0Xl~Blknnn)8 z+xP<>b;gfMw!EAcHtBiJeeQolBymIDwvAzmiy&8PPBaW3d%E|{9#1Ya)8q~W!H}uu zH_NTEuw&vre#AkTJSIV4b_?|PBJyOdOutcs9b!wt$u>_us=mHarM<-JGPZ?~M9;3D zh=WKG^6BQUC-uTZbF=T9b%(f06#xA*(uEGYf)6{m;jy0M^Y**5sXfT`Ld)lo<&%*1 zXcdQwK=F-IEJLl%7^9l$9r_C(yeP(=7AsH(wnpD-vH))VMimz7pIFG5WGL!?zuNKL zS5TzpE#V5eg$stn0=hZI@LA|;vnKvz#Cm|eTxNb`t(04QUFyo2y_ zp!E|ZWTx?F52wH}XDQCwuD{r(C=&uPVD3!eawU{JN#KNSRmLOoGa?9xUC=+!gotM5 z-zgDZ7E-qfNXj<0@r8Xre9dURt#hIdW}`U>nf9+?TB-2LdUSn& z)^(b9CuvU(GY(_R>pyHGMbpP)8v>)(82D59v+g8QcGwPuXcoWS2sokL5(g7lkOHgp z4Rii%l2%oYN!{j~B_7W@s{cN7l%v5En^T_23fKG@$J(FVDm%*3A~*^PI#_|ZMNhWB z1fRoYYORs6v4Y*-s;ixwL4*BEBHs~-U=AiRJ5m_uLfDbHkcmYi_+G;Q?3$at8~k6o zyp4lL^~jdh??8<8aIyHh>6daXKmUbNWKLw39WYcZ^mk313z)an7z~veU;hDon9S7j z_h0w`K4?neWBp@Q_AlLBIF&VKG0Vcdz<4DTDXJokefIRJ%HjGTUfI(p?X%{lNsNCJ z&qv%x9%5}XbdOAIstF`{<^$f7Fdw;;>u5_m1Yc=6C|qj~EzDTM@fxWlN4Wk`YOL|} z5tIr}btlZ6LY&Q7$kbY5bqymrN%80zj-ZeaW{ST)LYawM>2#a`G4XbWGqq&~=oU`M zW(vkx86}joLb7vxS4)IYZ*Kx~NYb(S?rdkmzR#7h-6ux*6m~T6qPv@xWZfR!r#G3Z zcMJ$%U)QsDPT7@x_I|6NOG*h0ec$_k1@o=)&fYxoGMVtbd#k2y6ipdfp)@LFzKaWyATcLToe{yQ`!PuJWnAJlTsqmL zT_rtEeoRWGm5$cQ!yi>~T4b0vY-kXh-3n`A4KaN>h_pr(#u<>S(@$s4j+Tp_Jp3r< z*f}yFN_{qU_ckfgE@Z5>#KqcBu-hJPm;2~4Alpv=Kl1ouf%js!`8-7vn9Qc@nB&da zV71pa{}z}&?zjNUP`Jnkd*fV7KkhoA*L|nd=dU+`YGeeMdp+cKAX9Q*>gdC$sZG;H zG{J}e=be12arl46CgS5c`64LI8jL1Te%`?y0H^hIP>#MkQ?50!pkgE ztJjcgS@|^SXK1nJX1Mg`WYGLwNMEfn{fvW+arG`L)IWPtJh{kxsAUF~i<;2~q2r^k zWckVJtHe)6q*CE{9o=g_KR!Ri5|Re#ZWrwSGRc3Kn3F30^+qo(2MqkL1P-r})trn% zaNz8vDjNS>E_sGIc)yxh`h1PS7>&Hc;D@EPJv+P5v|Ddcmoa|=Abt8^!mKWwKOT)( zI!fBMDk%6~W{YCkL(&@vZG(`m`p!AvMz~ywhb|h0mYhhe0A*M09ciPTja?H0W zl_2H3LhffypTv6LnXxNKp0KZg*GhZw!k?dOP*Id{i?k4@FTX1$QL->A@4bb}HMDWs zR?hU^jG23<7P_6RyUNB6Kjb5kGBz><-&>4GvX*INIS(-NdOS3#aqTgIE}5 z9ld9d{xQkkrLO(QumQUTB78jLn#X3Ye)05P++-*Gh9GCkW_fFkz+ubw?l(C-d?19A zJW(ZHn2k{>CDFE}&iP>Y{l2O)!J>sSUL;qFE~`qRP8@k%(Y=bmVT*G-zt*+~&X<%$ z%Q9Oml_vLi=%JiS?Q-%Qj8_s)hV?y3x6Mlhletn| zlaG3;Z!K^I$oA;Yk5=*=B+TDuc({I1(bSo5vrz;-}RvPciBo2czLkA0yR?rpW0qrz$)l_zxKidQv_A$ z5CXFw%S7l4tc2T1uBmoy7bG7P(htY=m9ClXG|*S@{~Y)Z3;sn6bmX1e70a&Us~Mj) zMZJAxpf^0-Y0*`Gk6^J~D?daL<5h*{Y{_1bG;Wo0!A2;{X;b&8QQeikN`I;_vwQ;~ktI2lX9joPPe$ zelK8X|L)_61B_YFRT6?%16`Nsl9C8>czuIE48bXlq;T{g9B^43DF@-T9%r!9*P+LC z7k&=(^u9qx5=!$ngvx20_Vb*6qc^emHNB)@sg%Q#f#{YDst9YYC|PallJDxS^09uM z7Qj>DeT%B1E2FE9fAk)znI>mS&6Z$+gLA0wisSiQkPZNIew@es4Hb~F&RgYvFQq*l zY4PLT+cKcePir}t|L4umfDYLO%u{&C+`*W8;V!EjcYrYHh!x8(3EgA7pmEPzFLB6W z#C>Y@^|PLlJd8MFdEGh4bGXifW*R9{lkPAw2Kbmp1opO%Z3?O$P!tKEKi3s|{>fXE z{u4XUE0R(zOs1iu(qDWOvS3)8)yXRRhQ%ykg+{i^>?kh=-0V4|-c>@4gWh^@rI$W8 zm&3*o>}wPui?(v8bm%YMB4^{{pa?CLDl&bGYU5nQLzLX|pVNBi{CHqHGO*}EZ7J6F zux4-Q5KPq@!Qw!q(%@RmR`m6^D7g}>dk^VRDz^uNU>OYwoJu&3dYN(+Naa?S_%sSP zM}cN)q3T8Q&8wgZMxHZoMjF#XXWn&z-C@UyuxbSpj*~6GAO}Szu$;Q5 zzB-wpqMz{d+GdY;viPK_{{o?jRKHdx%@d4foURJ)@$aypBS$XBOP(WuneP}f)vm+v z`Y&8=@KE_ymm_6vJD_2#bNsLvq&M)AYfN>ozfUySyQZ{b!9Vv}M`e$VAdTB87hJOghl{1P@IfYh7?ENu+z z;;xn^v&PUS5e^#0i}-w(?D2SX!`VS#-2i9(KpC$80M<$*J*oTYMP*9#_w5W~w*3eP zI~m>?zgr5!__y9bwkMQJ6yoWon?m!Mp8C;XmIL!$79~o~x`{l{MySOnLBxg~f#^ z=5al{A#_L*&S!6B7rSsU*s3CVFD?RLl zTjQv_1V84fS_Ei6J&ciY%a|Mk1^3!R%|lg>=T1z5qk8(;KdJgS-wd4XSjCM?RhbLf zN@;Mb=L~*jX>s9v1x9~m&2Trs!(Xnq=h}^F!>z{!te0Z(VUsH2Y_^qi;j{C@M<<~W zPQpI8DK^>4s534PkRc-i2UtN`9ez{ZXMjD2zm~|Bvhq2$r&RZ2xDXfr+IN#0iNT}M z;8LL`VaRB!SFVV-k1x}CwEvzHex%Ni-nzO9Ry@B_d%nB3yc(Gt-7ZhPk$X$ggOs?3 z5q~dn>!{|_#HE!0@I!IsDHh)N?Lsg9*(@-*A1#}0evRzUlo{`l?#YldV?iO2YJDlM;ULo1~l#ks~FZ?ZR0OU2LpSx-zQ4^ zqZtV#uHcrqeP`ESx9Z6~4^PbWo|@@r*1p@MP$L$16CrSfnbcCyal+6tcVom)v7==Q zPW$3+e|&?><^Uk`BKngmk1@&3UH`YQ@L>)f1Jt+&a4rONBC40rk+zSyGbojG63Cvz z=`Ab9B;lr=uW4~lsX8BN1(8dFR2AR>)B`D73q-N;tHg54g%Y+;lW`QQ9_tQ~>p2(B z_#B?|h8lI|2yu=c8 zF16x^#f}Y{{pFnVc-^;rkfZy4W9k!V#ozln2zk(tr6TD-lkjHKJ+iG--Q#B;gZnA! zU*@Ool_bZ_xnxuw3HFuz?BQ8EN&~&_UztyPzA(2_@L0dMZpyQ6k7_cMVuRG%!OM&i8b3HX z;FRioBENWSt}?lXR_;41Ey8*!n9jax(`d$$3!&U!znCR;s+D z2l91N3evfHZMtsUUdY$AFw8D+(NFqOQW%cniQ?4N@KP$c0SOoC7UIwa$m0w$x+gda z_02Y@!C7x@K3qy_q`i2j%8*di(~a?5;x!A|E0x{`!X;5$iHzUPp@8}=sh6czlR?(7 z&QxFWRbh0)+TIn{s}Y|z50MXsuQz@ws!RcM+g10G_+Iz&IVnRGlCdk~1r=SGUK!S) zx296e4|U-x(q;UyMGu{ntSpc`O3&VNl3C6FQrBpviPNWa89RJ*q*gVYsRcOy_`xx; zDs(TnBFWpR%UPCbZCRsaC9?qDfSKFSp`XfR#iW^eTsP>f_vZ1LXg#1A^z~KN>PP{d z&?m+o4}AvJqBFUJ8l-PBmVPV7nHgqp`w3@w*&cke?lt}H(U}#|^jTn((al(@PUjM0 zYwJK_LXWwf;oR^L@@}Sa^gy4u)PluyeDCdste(C7r=*om^+&A^)teAH5x+B@w#@FN zP#K%5pemB=Wi=n82;4?4aG6%{2&=F4P$a)d8h2&iMz6-Z$}5uqQ=MoPect<&cF(1k zYY%)MiYRByydoO(2pXhot}?4Ik%_3Hi>Z0cUPe3Wf>c}%94N>(u#n0eNG$q^HD6B9 z?GfK7YhoUXeRwTfip)Q8WQ^9Nujd*k?L!xnhtexT$C|weB{I~_tu84H>E1gp={G*j z`JeULit}St^q%mtvz*Tfx=laTdU>3&L3dMMh7vGO75?Sfp&6%eL6fL|V_;j5@}QhP zgUJ6Hkxb7=cZ0wIjfJ4CzS;$zTUPVUU1O0pCJ!}uRGpwK8wU)XL%^KCm#JlGu? za&qs*qI0Ljmy3|_8VaCKkzq3l^vrEj^#>B9;yLw2AI=tZ)#Vh=Jaa$0p*(#pi$Xu_zA{kElb-O*gCY%W^fL`vWLk6+L8mpu!$Yb7pE ze&?k%OoJUuoj2sTC8)nbxrh0=Nohw@TC@^5%uUOJ;8w*5trr*I^Va^W{F1$`hhFrj zBo`@4(XmqQww!CF7!?;dB~;}MsH@$NdArr8pk`-c*?Vij;tl20#s4?0}p7AKZTkO@czqnxNQ~+(i2jVi4@6_RYB@StSRns$FHf(G&GGfNAL6kl_g6koWMrS3}xH=~#IW0hF~ zK5{W*Uq0*FDW$R;O6bbO_J4l1^Z@T3$@cb|JW{cCekQ>t310Ff|Wno}99+g%#t+6HEHG|CivA`3+ zkYhkK?ypYPTD2rZ@JluG_tXx0u&ZftN1#)dH9ef$7Iq=kV4K1}(S2QKXb0p->?-6D zU@pyGv){zPSI*?s>Xu%fFYzG*u8Pf+SJ0Fn%Iz9I4Pn5)MGn*8qFCy03?0QhmLfM8 zwu7P@_1DqRkdbEuX9{kQv@Gg`mi(SFMm-B~_j&uukF`O{$@`mSjg%E3)hUo6*UPx2 zwAAIAyOGY$)cWA-72o{$fsY@(&>zUsgU`HUO(-l((jmDRAQLh*0T;U*sIE2wU)CFa zEXAA#ZMl}ShO!gp^$@8R++Lkb+!>83^Lj}yeFMlrZ6?3bl~LyihJk+WIIpdG)qvqdORmntf^e03x%n-udy98=h(%I5b%S6QnEYRW^PuyM0OMBJ0V{Q_{`H37d!&@Z9cP#M1N*weX|n}RW|b9 z!623e7IkvJUxf~rsA@*u4~LgU%4)K{sYt!LV39+hS*xSg$=LQsRHY8FN&w5|m5H!e zsa2;0%MtMGG^7tYu+|1c44sKXV~t9fJ?jl2zz35lvkQi%3-Yf5`{4z-snhBNjbWlc zspRcDC<#;e>vN<+vdqb^xR$jw&xghz& zrSh~>LIL?$286fAJobmB9WW zZMALt0dI}Tw_6Tm*H0nG51US-r!>_DG)Sds`0kLLxo3I!T4Zwjwd*_~9>Re^)LAxh zBN-VE88*le_*MugQS(X;_*y-8O)SM>I4vbGE7v_t+C%BYkY#G_3Y#I1Y{Ljt zSsU`jz7!58rm-uwA`+Q0`r6DTxrQb(qN1p=><30hT00xY#BaQ+JpyOGW~0 zE=|Vi)5~9*ksBo10$L}W6gNvG zX7Yzmy&djMq?K2DepR;QtE}jbC~|iCAs!{ltf#OtJPQ`p=Hi}JIE_I6F3Z9QxloP5x?2^vaFN5KGjX_Zj* z!H}5@DEyu^%re-`pgwA#US&Xx&A%^J++2(sCjnBmK&X@=g&$brSvcDS(f_L4P21-7 z>jR5BkpZ~Ko;%p==-t@6Cg@`XPF=Wv7IDpJclPyKA>)K-8TeoM0E9>T&yC=b7Jr64 z!$n3Q=lcT$UnXq?HIuoi1}C#FERUOD1-seR!8&c>Y{4gT;BG0gQGw5$Y;Vj(iUd|^ zp|B)qF~JHUq~vJ-ZGwa?$RA7=iKv0piNx)4ZhRZUJ^OZ>4(3KM%-U~^2k zrZkqt+fnDcYrEEUH{gkay=)+&=n8tx5R7qR?_KWI-Y0?V!~F=*wV>bkCpaID=OcQD zM@jFK7q*0>HK^ZeKoLBEWd1;dQ-$6!*tjjjFF*UBAiK75V|m)vh)2DhdR1Z9xN&uw zLIVG)<8uTUtWA&ia95+635lVS=L0#=#!p_2vg2#+e^W*?1)Dom6zw#`Wpxf;Qy4QgtKT8a+nvR_j)8A zU?N%uvmxZM{{AiOynJcx3*vz&utIEnbcYX-evg#Vde)Pz74_%x8xN^63q0SfxX-LB zZaXs{^njcJyCi#)ME5r6Et>DvI7d`{-gb8UcQ&Ig;FEUdk2JW+-x_CfSNgrQ38hSU zUrujN4_ZqenelZ*FC=G(0On7AA8+rfQKLC{h=gdVqVqM~q;81)8rXtLl{}h{(SE%$ z)h;MZN)kw2JOR~ zfT<_Yfq(=HZa^lbotcu}i+;RSJN({WL--wa1jG1^_m}(b#rL7D+T7cUMDBW8_khS3 zTqN$81_KyuOnj{e05_jSosI5DOhR799OoiIz%Jj37Zwcp^_8=p*Sp*4x|>jYWvn29 zJGu`%RGJlAq)juWQPMC-^Vka!pK-a23<;=O*}7hg^o+QoaGk#**)+2s_dc7j~}BePV#%-e6PKBZjR9*AlZr{`lezb zwToO?eEEZ;HR9I6yr>FF>~Qn3{kLwZ0~@sO7uJKk#fCDgnvw&!q29MgN>*Ls!q58j z8d3~A+<$HgBq{f1?JTyheVJg+-XVf3gx%Pk)F64X5Ic5w&^Y;Xt)xtbM*ZW{=FJ7; zxe%4+vAT{!I|UGCl}9ieIT+newJTb76$etkL5YX_s&!Pw9qOS#PKuc`7lCUg>KjGb zeOCnwP41M-6ofI()cTpOg1N5oL@wQ_EvK=?$7>iJV(d!AnELXk_1m+?1Nmcb(Y}^m zd=EFmdxPpQb*1p$kC;5Jgodwd0kqQSZvT}xo4UQ?jlP*13x`rO1MxP8K`*xBSW?PM zS9-gYKBYO{E70aY)009ioG853qrDX+587FTBF@$Pw5XUJA2THV3aEnZP-FMM#$L{=#bV;KDcTPaUs{t7jA# zeyI3Hh&y-?oU?d@Y+5(JVS!B)t=T@vKGP#zGduBEXHv0X+i+jp;%=8YV=Q4Pi*8Ti zjAq>(&jZ4>(X2nkZVP!3z8G;KaakRhikb1I`Jy6yP3$V$1)$9uG$l1^0t*WtUwUNQ z3r)ClTgGWTriW^>L8?z0_O{7BP=cyYAW%Obwi7wjuluq`VDp6jo+@#uBK}g6R>zpI(0xpMw3X43Hfun*!&Gp(40QcdwS*7z z+TBt~p#Zqwfg98Kvm+lF5cxc_q3>Cy^hmw$NN)M1)~oNPv)~1pz9L!|IBb1?1yHw( z@jcvlHaZ%yt#ZSzwE4`vVPwkdLB_V6xIU6s_zIy7W6bYZD7K@dk?O!&t`qhg$h+G! zsHzhFSTsl~#`H}Y?#c-P2t0Cy7;h$r0qf3Rmc9$HQMMNC)E+p5<04zvn{dyMt!=~a&4)>JrKTq_*1Ksk#@!kEuIQS@f=@pm!Eg;VQn;vMhg>?|AJ|M8zG8g%A_OM5qaBmZYB>C8Y4g(Rq3%2_v<1PAK;a9C+ z>{4-Hvv>2mcV^kdeBx4y>8ou$md>IL(;&)LJShLiwD(!zL>LH0as%&~|S<*voC_4l$q&yY#gN8;6I9WjbkhH6Ym)!b4m9yxOy_vb&j~Jk!nR+#I-~U4)$?VM|GPm0bk3EWi7PfDaUgX>Yl@+2L-IBgz*!MFS#M~!wp__`!>m?5*aVMbhZ>wtrNMr*`2a#)HMStpU~DoJ#S zd_1SqTj8KQozP(h3 zyv|&)VYY+3mq`@qxQtyI?`zQH>?-y7AGlk??RJr|i*_@j$s_=`1RiA$a{-ZR(prHo z5lrQt)ZUdPRww6v5dy1f?&?x_o{g!iwS~*|EAStyEtsANtk&|2%HKuR#!c(XdDv0o z@o=^%Ssv_R(Q~+^3C#B$^_bEUKLI(ic57xcSwrug`HQc~<9lQ0x8uMr1Nce|F07ir zhWaN1t};b^=;8(Bp)i;Ygj)-~KUrZ1ki|qJcB;1;5EvUFp zhkq;V8qe+*MqaRz0)Q}F-74G{eu+VV*BQRud*u{9V3Lh@%Cg1XZ{ED!7cDlo8xLZ~ z9Cr7V$<^iIADq#)l&{*_=&y*2 z{`#^!hxd-q{TZ!Gr_}EvX3#^ri0y2!asgTia8C8DGiKyG*olwx54JHx+X8^aqo0)g z_l-TRuwRM?&fhm16?@FnO7^8}D{7cI&xV~lR2e?}+BDEoa(gMb;qXmGx#$`B14U9E zPouH-i%b`S3yK2B)Gvn+MG#07g{U^2M^P;8#dOBWyKJ(42OAW+h_O3hNp@mLU!1(0 zegjtsyC zJHIm-GgGb@fApqB+j5^qCnr51JNe*6?YpdawxuZdGc!9}0n!lkS@d)d zwow-YDC<2{u;f%dmu`zARG}-OY*7sC1KZuxk$wcBD+}QQqdm+? zNiy)By?(Ko_e#4dUW|R zvM0ONO4wHNi$t8#-2X|jiG5vWwZM8+R|jm!87p8H(yi~U$AdMIa0ISr!6<;)YG?w5 z5Pog1KW*jcK;Uh=i4g&kz_FL*V+8_kmQ^`HmI)VLl^V8jCJ`&g)vr}+kW3HgRZoVx z+*}-EKJ#&N?l6d(MfaT3VAb1|thgsrIb*R*V-XDR6j0RVU}QNu2+H&}ZXkf3Wp zFO564bPW&@^xcr&xBhucoibhR(>qPn4y$bfrtlHm4!)NUPH27#*9X$7uCKl}60!`! zs-=k53wOK{#8uRY|J$7x@C&r*3e4z+Y&NWdFs1PD%lJc4q3Ghnbfd22RzKFzmEL_p z?G;x=ENXA4i@_zlK)d_@wD;xlP`2;eV+mQplO(&e5Q?&tZ3fxH*tcvc!=Ncbh_Qqo zvQ$WvecyMoFNv118%rT2vS(js=Dlv|_xXO`zkmO{?}tAghVJdU&+A-{^El3jWSeQ& zW349%fyCe{>1%%w=_cezx9QhLV+tf^J2%0+xmy~u zQEczLuq!4w*_}-lprT$tPgr<4`S0_WTeQBM@qJyt;Ihl_e)Nb6PWBBCZ`$^n%@nnz zJMBZ!Y+?XCfgSK1->^J=XhZZdMW)(=ORYE-Ef|x*I88vM3EQcvcSM0=mqTLZF;rBD zKIrY<*e=`k{cNjQ3;eLa8;8DK?C0F}+A=avw)|Xn1YSj{z~T#*;sYj;dtNmVPz$MBv)rKbSTptHYf1*d}$daEJ7Au>c$ z!kb5XPpyBwmhv{i!+KvTlZLozHAn7=HB^w=CvC1KO}VX!5#X6+Wu%Spl#SI3ovU~} zkwX6t|2yEX!~^!N*io6rKYcpUvUNWb^CJ>8^2qvcpr+}_V4jk9=igb|*Zo*~0>T|3 zE(GYn_k8#?a^mfR`$LQGXf`ER7%^WSDZR#i@y)dN&d~tFRkM$FU~h^QwoS7ENVIcz_$%rjq%3H^b{NnN^LHUzwq>AkZ@OrVS1?KgoDawG*RERt#cIQxiV4>}X%^2Zex%rSx<)f3Un z1o$}#zowL{HK9${Ey;N~@*Z;Yt5WT%+kl$K&uhO}i~k7i2FcGv(j6ST=Q;>6KZ3S5 z+whH8ak@f))0fpd8pC|@+}}J{C{BcR6!A0Qj{SSex!&9gN^Hz4ujf=$8ufhUg|+ZW zPyHhDl%YH(Tc$(^AuYK_wPSFQvxKh2&J7+(>zoAIDbB~d{L!z^Y=dPCaL=2Q%4mWb z--%{M7+c-N@FU189MTfAuqdk^W|RoDNQEyDQZ(dSa6n7v)lRQ_MQP`4qo>!qt>xCz z3DU==M?W_+zTpz(>Xk?{)0p9}Z$^nu&PY*y)%CkRAM}|V=cb4}`nVdw1YLfeC!kT# zK33lXz~ zZmEm2j(wD9;a*n@X@e@TvD^|O(FhvPO+hcz)ok3;CSp%d>X7{QH}t&>(BlMQwf(9t6Z`;32tM3pB^G!!BYKj`8_ra zav`?zS4H0Y{1peGZtjZM5qZ5;HCo>~kZZ$W=(!JBcxt4KAmwQoIW9|+_j!O!DabrTGJZFC0@rf` z9m^!}%Mi!38!JMM(NGtm$#MQkD7&R*5O8)T&UcxoHm&T6y&`{}{ik1ZvUychla2fH*x)KE(>v~#q;UIwm?)4pXPbc^9 zsawxnb>zYYz9^{Y%&*Pv(F8BseEFp;N|n|(-HsU$>w8ah)z-K>2>Y=+Z1A}xU)$!) zf~To+^Yp8rQ-580TD&zkO3ff1-6N*DNs6PW;QMUP!Ftky(d zAz2ke=GY+%%@`a(e-RWc~7HiRCp+%{d)`u&TWK??ZcaQJP&zKj4blkX!tOVG(n0B6nrVG%;~; z(40Hsnw<%!&kanV8tnsm1KPcGTVfTq&!;K)pJcH|nIK78-{&&`d`sK?>_%8>jus%r z@G=^~D=vn9TPQdW#5ipaMUdeDhbQZPxoXGwiJZ*m?Ruw$ukK;4)>YZUch4~5h4e*p{&rZH6v zeFFgA9U)_7<{Ja#ipSCshA7mk)xY~t%AMZ%Irm3-6TWO02E_H!ku6d$DMRd4%*UPi zpce`9fBz8p#>*C7C?94$lVc>oAc`Q+^N5`TXPw>8T%gK zs$ObXn;1Ghs@r;9YO4|D@eUM5JZHXr>ur#aEBe~U1(MvMdKvUo31*W@VZ&hgifY6x zoQ9I(S*IWs282xTmXM540s&U(qMW(k`vA}_q@HYk0kH70gv*|a<>hR-sj`(G0Cq&- z6c;j7LQfHHKW%)QF5?*et$S^N2nuqc*!HMj^YaY94UUt0w$Ida^tWUKz#4`)e!$9d zaquK#r-Rx#5aE#BS!sGzmvXwYi(VkCkPA2dSfX&+l_~oTi^{LOXQxd|>OiHy-rw}J zl45DDZIi)bD-EO{pn#}heYuKqBm-ymyS&f32AW(4T)Z1N*Xse+Zu?J0#H*o*#uzW?k19X<=TXzQ8@-YB%<6zcv}PZm?1I7fi?{6@Cv84^hbgR>nQjsgymF@Vn+bVDYdvBGdtpWd1Co2lC=@NaxOpT1(eZ1>2p3=`X#G| zEFz8tcXtz(aLPz-tlHS3hRMAzX^!UWZ~t2@t27?o*lPKy+C%S7&x*&9l|aAaq?rgmxN>j8#2DN?`O|S znl(RAhL0&8mK9KN-omCflZ3a2M~LPpDG@7KAT}h%o9B9740PxMrj%R>ya4#}`|9O_ z+xdlF$xAW@7d&Eyu&>6r2}hm=yxdXbwT$9=Sdzap3Ozs3q>6!8>Be=vO;Hi@pY{KzeIN5*_`<4RI6|Y#_E()Y3AmOh4hs2lbPWovBH(upbiI~Mc zOxl_I+KoldMdLeymJMYi(c~g`%6HEuIs9jIsdV}oNq40<(F{?}IytzP7m9T{5M8DU z6qY2q2nCH&jvX5X)W=A>m-4%hE3QUacuO9^#Kgn&c2%t;-BljBs^5DeDOo*`hL7k} z52M83O_jYhx!DomCPsIjTYgF$Z6>3U0C2#%_#a)WOaA3z%jk)oezSYyr1>Xzgp7`C z1E1uO0EpZWX|g1xteQd===jn^=LG8``tw~u&zEWHSIfz6rH_hf5zg4lV-&DD{mR~iV+NlhA#t$-`^HU6Aa^9&IAn4TU?Rgj51)W;k zkp~5*=nK&7SIpW~TPuuuh$U{CBhg+*sU6DXE zrXUYu{_^@pqL@!5sP~rii9h3s`K_8kHd&}F6`N{-5^!VXrF8l5 z+C9m;uC2&j9NUURK5U=a&sN9Y`=yMjgy*iielQ+NEwg6eHLs$)wpLa_fKPE{N%=Y( z9ES}fizW0mYb*8#_x+8`V}pxJ0{u;1?4gOI97gK!ml16*7po_<#vK8<9hz@KSD0Yj z;r~-3Pg^(rM~tGO_*esg!!uwVX_|LW_Mb{Woj+KveF@A{u(qn*tYh-F66_pbvX>vA zLZ}$_JSL|G)yBJ6-z`$eEj~dy`ASXKydltcMBUhkQ?dAtIxW`^iMGhP!tqCU3(tk>FF z(nZiB;RMZ2v9rM`ibpp4;xjQjj<0RXS`Nd-^GbqPhxMW|Zs#5(A zE>NP{7hJ0-_fah&ZUWSvcl^K+WFpJ`*Uwb2R-g8@T{}q}+Pn`5Iwo3<01nb6gFNl$ zX6BD`+4&1zu*7QcMH0C^22(l8RG4zB9zmXWW~*y}yv0`%L%5INH@p&;#OeA#yuagu znVKY9XIB9_Kn3J148YOuGG5Erh-8WXUQoGolgE1#y+0XoKQ{!J2(2=wiB4;=Af=*@ zAqR2DnD*pXv*adi^uYEAflF6h(QsWVZatcuSJ33AiQzOz=~Z>pZIecBC4V=T33c`D zd+lq~X6?HYL3M1}cz0Juit<`TZm96|+DvPzE+{}qwMh?ewtfb|U{w(;fBy@pDhFT! zOK;N-81%rT{DPeh;*)1b_9LU>X{oL}l=sly^`jnLoqrZ_M^`*XG=OY%hwa9eEeW2- zoQma;wi37jyUeu-DKL_6tyUV6g@d~@uUsQl&n%(8-UGMNw@V_J=RM>SS3!6FDmrpT z;-2^gdjs5(h2c}hQoa(;yspc@9XCLo4d7H>Jgl}gbzlFT`u6(@T`Iu-O(2y;$_sMN zq_=m+_<|^Uf4iVBs^2_obD#o;SyG!V1C8mNARhsbAgXS}V3Pw)rREgAwScF~DRmQfq-W6~Hn0kS>g z6Uk~T>`1ku36LC83-|h}wV!2J8T?ol1zG)+&m&$UoBTzrwtuuxg5dl99oVbQ zJCkmWU(1EZd`l&hL)&9jd_ONPR(alPTNz^ww~O7_1`!eaHQ$tZ{N_Jy9%J*wFQ8je zfU)=UH!n%ul${g$789T%_*A#6xD9xJtgl>U|F)Z`;Ja*SUTbz$D+DIPlK)NjUr)_- zQ}gc_ISLs3#Hjhfeu3wTRDh0Sjr+@bwA5+qFVjebzYx{1tv{=NUc@*1kC#M7HB-1Hi$MN1D^a$92}QiMY4b zB!o&qy6fE9h0Y>7Mo)$e+?U4y>h;?>P>;lGu$x?3Iq^LRfj-Z`<{`WtBAhK|(A&KO z+!AKi)*a&Y=o%{W&Ro53-z$G(cLnf*pQJpG=Y#ZQCEsd1n-c&NuHl|dfzZXqrfIHM z(~_@lW-W8)rVjH5!R1$;?J!KA&mr&!A$CgL!pI1Ax>`sSz|80f{VgHz5z_YS7TtBH zGY*nDZNPOTkNtHWtAKaQrW{LkYpLc374AsLH*nq00jJj4_jKCxO#`VsHuAGlEB($W z@`gZ>SNMhmaCg}uEc7PZqu!ilK7hgSbigrmfc$y-W@ifhOb@5~k|$r~lEB!uma96& z;y}4y`ox}TS?WcwiSH7&r=Am&q_(31q#g5U=F+X-Bdc%*$1iH+9#xGQ4m01Mqq%+{ z;1PdQG&-*P%YS|HYZ=OpVvs7CIa!Qcf2Us(fX>+?sh1eZG70a)WI)}0jDN9?IukQqersesq& z#Q~vDV1Hy@E>0}uw7eZd_KQQl79xc4|1y{6(OXsJPtd=h5EulQTVLXVaXG9taG+;~ z(s`B2xDr&<6*9ZVWgAoY$|2q~EMqtIV`W}6zk^rAeZJ#6S7VS#9ttkM-L7VKD4>pT6Dg(f@`1}Se2A!a;#cTC8tFrxSL0)+S7`&xC0^iw~ zS0SnF!|8v*e|I!s$)5`L??cQNV5Q)-iZzl^6qkpw+bzXSUFtcxD&D7X3p{mg3gqzDm z2}U*F!hF)+;Zo1XQ119CN*^*4{U zzH^P5?kY%(k^G-D?&aAGClgb$#dSZwG9UfXw_3Z&y}*OJ00tC{>W(gJPOG3FUyF8i zN}e7J{W;pAOc<)ux(D(G``3T;X5HzFb#u*ITRc`K@p(a6gRe#qy-^$CNfs;+9qzKm zt_?BkB91C(wb12r@4~)f#OSD@NcCOIXuv0Q=-%ray!aI4jLN1Ky=9DrGs7owzb$Kk zRtu#>}o8LIm<0kds^uz@zsxKebYoc3D!J#-DmW^ z!qf4uu{PuUHk=)Ui_PhR*DNmLD-5A)w8o|(@5#Y%=$UpwDHcEbqkN6TInyIAb9TbC#_Gnmc~{jAcSRm zpBo8!ANBnKx^{xR_vglOT~xRG?m01!aBOht=_obMNU$nseu|qnflTvm(Ko9pq~Y^m z9MFe)PXy!o*v;;Z#z0!$Yv$(44pBg`S|?ntpNWrGm5x6k$KsQh3bP4*T;iJ!?w zq2?tahL+5Up)(6Ffb#zdRHYglyVC1r`mbqTl$PmqzzE&=_QSfcdN1JW=6ofTaM>zN z(>;^QIg)Ps0nT#nj40a-=M8gOO<|q68LYdwh3GjsQstGb6TV3KAome3OGnE={eq0u zdw>Nf2JvFk)*2pwysS(_y?qblN8dpdYF$GrZ&O^Cd#5tQNFa+-BUEa#e$%&PzAz)l#=Rm~SD%A8{TG5~C(mJeT z8!`Dg>GQq!+2KIGbt+vH42jcu2ZV&SIQ=a zr~#g5!7n{JHB$=S-A{P?E~BH5=YnD?ElJ|ENn z?Qx&NtjlK2WZaEYgAz)hR=Tr$8>FIBX!|W7HhJpW8E;x+t!=e|;Z|#%aA3&5`?C~- zITksEju#l}yJTI>ZUBm6=32f;`-Rf?vCCPnqiWX;90kQ=EronE9VMODk11tH#@jj4 ze|%A2G~Y|EcsGM}ztg^SRSsgmpyBCBRI4v9E<}(j#LF*7BcPk$4Lg^CBo85A}8_X-&b?S27!2}Yy z9Athzb`tgZS}kVU8sZ)ssM((8{JtDga|MnqDe(p6O2_Ug%>+tQzu3?`YwZRUnhiuk zd1mkZ8_pDhkGqGqe5NBAg|Lm1$)W`24Dn*tKAVV{S+|!%z6~^>-k44R-~d_~hLcVjJ=ARgC-E zYpd4pzie+Id$%hpr|Zm0Qe}J_jDFh|`<51NiMWC%b^WVo{W%NQp_r?p<1heoM>Z(b zTl)wMc}p_ccX zJRIv&R=+*1!&U-F;(vWT#XB=`spn< z&3rfdo%zf49HZVExlGad=i`nMqz!J|dxiCK!PbhkTM@&3uxdinOR9uml#Q5XM zT|kV+I*p;gcqj!|ob;rrnT{u;K0}cC-M%P9$*H;{$-2F$?nSwlN^pF`-{UhXz!iav zIevDQAmzIeVN%%=GxQ;gCG&zU$NNE64|}qdZb^(qj06x($u0QK1Z{ngRxk&62KKMV z(=0f0r|z`u_RG#s4}2vPfDEL&_}beS_&zWVEj7Q~5BWf+pjL|G-4Q=8)8#D`04aGR z4~}gCx(7&g(GeCR6E779q(3}>?PqS@%qE;pJMuX7 zOP!lxzV}o!&^1Q0XZh~^q0$=vJqc7DMdHk(7{-;-(pND++$wV2TLsN2;5|nko)JEU z)1!F8$`rboc~ApItK8YLqLOTMDk#dVi>YWhE}mUt$8 z2yj5&27UeSq-`fW7_CBpw&c4S)SfwDQQ2$%F(z2i4A&Uxc1{8ZTOG@eXg<+ye{X@@ zfP(5mJ!6(=%=&|0z21F))&}TEKgA;+BVZtV#qQmHgH3~O<)9y8%`=0Zad=|o3fNv? z0l+NC>$HAgHYpd`KyLo|f)f?cve4S<(gKKN@#Q0Kir+>pJm9@BAM9{WzbW$En9dlW zsl07c&*-qVH$R-j5|yIkz+i|!Uhz`C59k7!kq;DkVVoUclbwd9u(Is)XaE~WA>GEb z;27r(=}UUq3g$Q50N)oScON-Z*WDn#29$m&Of(tA-d%Ly=-V3&r9usxfsId4Nvj^b zASq(|v&~^U`{NJHQ1xDk9T$>+=fwz8t}>l{`rFu z`(4O@si7&<{h2tj|q@i9Um?7`VB)rQ@6Q#MM!Tf;!_%ev;haqXldI8W&QJUr0D zi-Kf_wW0MkQ{UAU9zSrZVCj#PjQXxo0Gw_M(4&+uUQDWLT22v%HpJfV59a0mFct)$ z=Pb>Q?{+nI1OWCSO!;7l5E#=_JP(#$$y-4oU143E=8YMxo;le%(2l=d@-?sS z>pNY~^Y1RJOrq!J@3c=r4+LURQtr1~TSgGDc;k%qR&Owa4|(oj$s~{tm$ud_=oq>r zb6Bpb10BX*gY|Ei3Ome5D?ary}pZ zUJl*godaizRI)Pvy1er{zj=KsifW+Ga7q7L6EqqL|AJR-H9P;j);~BApWti3(dz8n zzLT|BPWYo0Rs|+MPR-`XEIdI|cBMWNO#o-qaC`{<3+~g^;i0621~e!Mn&J}$cR&(i zzbxYJeyC!hRBsn7$S4oT$nkZYoXdIGTjG>N_%QD}56ue@2!tN`3s5GrXC=BAJ(X^m zW z`@uqKx;ak)G=5iXd*8u(X~>c1AzT}dooW`|l)oUWNMy02vOH0Kqy6N2pt=l50pq;{AEo(cyxy>Im2VXYtM~S3E8~zUU0BE} zZ_hcObfTSGLIjpwkNaZOc1cPk5|udDF@^GUA|Kqt)=(SW_&#w-`jSwg3frI{|jal z9$(>OqC@|#Va^$h2~z>HR37>2vO_}%4B@6PM|E(#5E)flzEI?S#f|P``?QwatdnCM=PMIJl$=<;I|y+Ge;C6IK9o5 z2#L<`?#+=2G>l%Vj|!5lTr%NloE@f=2ao<|6fZ~s+kxr5bf#;(hmovHq(bYn-G+v# zTtOz79qsko0h4~eo6A+rII=w@wDN*7H#6XJ#fkLw7i0Q*-}nIns$(sXj?l$q+fU5d zFyVNkwQ5FuMiNJ-z4=w1b_Vd~h}>RdZbwx)Xj(Q7aFS0NpjU==KX%Uh($;5)_|$uM zWeyFv!jH)JLb`o6=>x;nI?aH_I^Tz$h3gE5Ws;Z(5bz-5QbyLK^=sP!WrYKY>fp4O z13V)>I+GLNwwl^Y`{T+|QCe~p+MlQymQ~o!jIr1W_nHNw7e;G8#ry`=3S$#LFsgHg z4%F(-RO;-hS`_p8=hmr|dJ*1Z=8C;cM9{MC3ht9~dL+-mg#WF;Z-Cc7%k&(tefG9Q z#&jiso4pzmnLLe5bvUGxA|)L0sAfj83oCY{-vbRv7PwM8xC}s6_x~3MAnfw?BArKo zUUhqJJdeI4>&wS`&Yy;Q+!#XAr^^AG6B;w*-nd%9w~mrYI=R7HRXX+5$BgcIU_q96 zlVuTWpwD0*5W1Uow|b?%GF%;w!5h;CgV~2pjmMvxJGud?;FzwQ`MDB8QIS_q12AG3 zjQ+%*HHCf#Uw*F-hIsw?2OB&@z(|pgXF;m{-wP2w;} z9@xNPko@Zw{#Q%_Gadnm1TYxYwz-b2s^@+?K=i*sjL-j#f4Ke^{?YW`_{ZU)f8WmG zG99eMp-CK?#G#k?YXgVQ^k5|pP2$ibV245Szz7b5