From 54a7f7a570ea93c495b2bbf1f924ed174280b5c9 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sun, 15 Aug 2021 01:41:06 +0200 Subject: [PATCH 001/174] manifestv2: auto-save install settings, auto-load all settings --- src/yunohost/app.py | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/src/yunohost/app.py b/src/yunohost/app.py index fe5281384..c2adbd550 100644 --- a/src/yunohost/app.py +++ b/src/yunohost/app.py @@ -831,6 +831,18 @@ def app_install( "install_time": int(time.time()), "current_revision": manifest.get("remote", {}).get("revision", "?"), } + + # If packaging_format v2+, save all install questions as settings + packaging_format = int(manifest.get("packaging_format", 0)) + if packaging_format >= 2: + for arg_name, arg_value_and_type in args_odict.items(): + + # ... except is_public because it should not be saved and should only be about initializing permisisons + if arg_name == "is_public": + continue + + app_settings[arg_name] = arg_value_and_type[0] + _set_app_settings(app_instance_name, app_settings) # Move scripts and manifest to the right place @@ -2401,6 +2413,24 @@ def _make_environment_for_app_script( for arg_name, arg_value in args.items(): env_dict["YNH_%s%s" % (args_prefix, arg_name.upper())] = str(arg_value) + # If packaging format v2, load all settings + packaging_format = int(manifest.get("packaging_format", 0)) + if packaging_format >= 2: + env_dict["app"] = app + for setting_name, setting_value in _get_app_settings(app): + + # Ignore special internal settings like checksum__ + # (not a huge deal to load them but idk...) + if setting_name.startswith("checksum__"): + continue + + env_dict[setting_name] = str(setting_value) + + # Special weird case for backward compatibility... + # 'path' was loaded into 'path_url' ..... + if 'path' in env_dict: + env_dict["path_url"] = env_dict["path"] + return env_dict From 953eb0cc1d20fb2a711c24591929465d79ea7e6e Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sun, 15 Aug 2021 02:54:58 +0200 Subject: [PATCH 002/174] manifestv2: on-the-fly convert v1 manifest to v2 --- src/yunohost/app.py | 90 +++++++++++++++++++++++++++++++++++++-------- 1 file changed, 74 insertions(+), 16 deletions(-) diff --git a/src/yunohost/app.py b/src/yunohost/app.py index c2adbd550..64766f96c 100644 --- a/src/yunohost/app.py +++ b/src/yunohost/app.py @@ -32,6 +32,7 @@ import time import re import subprocess import tempfile +import copy from collections import OrderedDict from typing import List, Tuple, Dict, Any @@ -1929,21 +1930,7 @@ def _get_manifest_of_app(path): # ¦ ¦ }, if os.path.exists(os.path.join(path, "manifest.toml")): - manifest_toml = read_toml(os.path.join(path, "manifest.toml")) - - manifest = manifest_toml.copy() - - install_arguments = [] - for name, values in ( - manifest_toml.get("arguments", {}).get("install", {}).items() - ): - args = values.copy() - args["name"] = name - - install_arguments.append(args) - - manifest["arguments"]["install"] = install_arguments - + manifest = read_toml(os.path.join(path, "manifest.toml")) elif os.path.exists(os.path.join(path, "manifest.json")): manifest = read_json(os.path.join(path, "manifest.json")) else: @@ -1953,7 +1940,78 @@ def _get_manifest_of_app(path): raw_msg=True, ) - manifest["arguments"] = _set_default_ask_questions(manifest.get("arguments", {})) + if int(manifest.get("packaging_format", 0)) <= 1: + manifest = _convert_v1_manifest_to_v2(manifest) + + manifest["install"] = _set_default_ask_questions(manifest.get("install", {})) + return manifest + + +def _convert_v1_manifest_to_v2(manifest): + + manifest = copy.deepcopy(manifest) + + if "upstream" not in manifest: + manifest["upstream"] = {} + + if "license" in manifest and "license" not in manifest["upstream"]: + manifest["upstream"]["license"] = manifest["license"] + + if "url" in manifest and "website" not in manifest["upstream"]: + manifest["upstream"]["website"] = manifest["url"] + + manifest["integration"] = { + "yunohost": manifest.get("requirements", {}).get("yunohost"), + "architectures": "all", + "multi_instance": manifest.get("multi_instance", False), + "ldap": "?", + "sso": "?", + } + + maintainer = manifest.get("maintainer", {}).get("name") + manifest["maintainers"] = [maintainer] if maintainer else [] + + install_questions = manifest["arguments"]["install"] + manifest["install"] = {} + for question in install_questions: + name = question.pop("name") + if "ask" in question and name in ["domain", "path", "admin", "is_public", "password"]: + question.pop("ask") + if question.get("example") and question.get("type") in ["domain", "path", "user", "boolean", "password"]: + question.pop("example") + + manifest["install"][name] = question + + manifest["resources"] = { + "disk": { + "build": "50M", # This is an *estimate* minimum value for the disk needed at build time (e.g. during install/upgrade) and during regular usage + "usage": "50M" # Please only use round values such as: 10M, 100M, 200M, 400M, 800M, 1G, 2G, 4G, 8G + }, + "ram": { + "build": "50M", # This is an *estimate* minimum value for the RAM needed at build time (i.e. during install/upgrade) and during regular usage + "usage": "10M", # Please only use round values like ["10M", "100M", "200M", "400M", "800M", "1G", "2G", "4G", "8G"] + "include_swap": False + }, + "route": {}, + "install_dir": { + "base_dir": "/var/www/", # This means that the app shall be installed in /var/www/$app which is the standard for webapps. You may change this to /opt/ if the app is a system app. + "alias": "final_path" + } + } + + if "domain" in manifest["install"] and "path" in manifest["install"]: + manifest["resources"]["route"]["url"] = "{domain}{path}" + elif "path" not in manifest["install"]: + manifest["resources"]["route"]["url"] = "{domain}/" + else: + del manifest["resources"]["route"] + + keys_to_keep = ["packaging_format", "id", "name", "description", "version", "maintainers", "upstream", "integration", "install", "resources"] + + keys_to_del = [key for key in manifest.keys() if key not in keys_to_keep] + for key in keys_to_del: + del manifest[key] + return manifest From 56ac85af37a4161d947f8d4bb3d9432fff70e394 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sun, 15 Aug 2021 02:55:20 +0200 Subject: [PATCH 003/174] Misc tweaks to handle new install questions format --- src/yunohost/app.py | 78 ++++++++++++++----------------------- src/yunohost/app_catalog.py | 4 +- 2 files changed, 31 insertions(+), 51 deletions(-) diff --git a/src/yunohost/app.py b/src/yunohost/app.py index 64766f96c..35ad2be36 100644 --- a/src/yunohost/app.py +++ b/src/yunohost/app.py @@ -95,7 +95,6 @@ APP_FILES_TO_COPY = [ "doc", ] - def app_list(full=False, installed=False, filter=None): """ List installed apps @@ -161,8 +160,8 @@ def app_info(app, full=False): ret["setting_path"] = setting_path ret["manifest"] = local_manifest - ret["manifest"]["arguments"] = _set_default_ask_questions( - ret["manifest"].get("arguments", {}) + ret["manifest"]["install"] = _set_default_ask_questions( + ret["manifest"].get("install", {}) ) ret["settings"] = settings @@ -179,7 +178,7 @@ def app_info(app, full=False): os.path.join(setting_path, "scripts", "backup") ) and os.path.exists(os.path.join(setting_path, "scripts", "restore")) ret["supports_multi_instance"] = is_true( - local_manifest.get("multi_instance", False) + local_manifest.get("integration", {}).get("multi_instance", False) ) ret["supports_config_panel"] = os.path.exists( os.path.join(setting_path, "config_panel.toml") @@ -836,13 +835,13 @@ def app_install( # If packaging_format v2+, save all install questions as settings packaging_format = int(manifest.get("packaging_format", 0)) if packaging_format >= 2: - for arg_name, arg_value_and_type in args_odict.items(): + for arg_name, arg_value in args.items(): - # ... except is_public because it should not be saved and should only be about initializing permisisons + # ... except is_public .... if arg_name == "is_public": continue - app_settings[arg_name] = arg_value_and_type[0] + app_settings[arg_name] = arg_value _set_app_settings(app_instance_name, app_settings) @@ -1751,15 +1750,7 @@ def _get_app_actions(app_id): for key, value in toml_actions.items(): action = dict(**value) action["id"] = key - - arguments = [] - for argument_name, argument in value.get("arguments", {}).items(): - argument = dict(**argument) - argument["name"] = argument_name - - arguments.append(argument) - - action["arguments"] = arguments + action["arguments"] = value.get("arguments", {}) actions.append(action) return actions @@ -2015,21 +2006,19 @@ def _convert_v1_manifest_to_v2(manifest): return manifest -def _set_default_ask_questions(arguments): +def _set_default_ask_questions(questions, script_name="install"): # arguments is something like - # { "install": [ - # { "name": "domain", + # { "domain": + # { # "type": "domain", # .... # }, - # { "name": "path", - # "type": "path" + # "path": { + # "type": "path", # ... # }, # ... - # ], - # "upgrade": [ ... ] # } # We set a default for any question with these matching (type, name) @@ -2041,38 +2030,29 @@ def _set_default_ask_questions(arguments): ("path", "path"), # i18n: app_manifest_install_ask_path ("password", "password"), # i18n: app_manifest_install_ask_password ("user", "admin"), # i18n: app_manifest_install_ask_admin - ("boolean", "is_public"), - ] # i18n: app_manifest_install_ask_is_public + ("boolean", "is_public"), # i18n: app_manifest_install_ask_is_public + ] - for script_name, arg_list in arguments.items(): + for question_name, question in questions.items(): + question["name"] = question_name - # We only support questions for install so far, and for other - if script_name != "install": - continue - - for arg in arg_list: - - # Do not override 'ask' field if provided by app ?... Or shall we ? - # if "ask" in arg: - # continue - - # If this arg corresponds to a question with default ask message... - if any( - (arg.get("type"), arg["name"]) == question - for question in questions_with_default - ): - # The key is for example "app_manifest_install_ask_domain" - key = "app_manifest_%s_ask_%s" % (script_name, arg["name"]) - arg["ask"] = m18n.n(key) + # If this question corresponds to a question with default ask message... + if any( + (question.get("type"), question["name"]) == q + for q in questions_with_default + ): + # The key is for example "app_manifest_install_ask_domain" + key = "app_manifest_%s_ask_%s" % (script_name, question["name"]) + question["ask"] = m18n.n(key) # Also it in fact doesn't make sense for any of those questions to have an example value nor a default value... - if arg.get("type") in ["domain", "user", "password"]: + if question.get("type") in ["domain", "user", "password"]: if "example" in arg: - del arg["example"] + del question["example"] if "default" in arg: - del arg["domain"] + del question["domain"] - return arguments + return questions def _is_app_repo_url(string: str) -> bool: @@ -2306,7 +2286,7 @@ def _check_manifest_requirements(manifest: Dict): """Check if required packages are met from the manifest""" packaging_format = int(manifest.get("packaging_format", 0)) - if packaging_format not in [0, 1]: + if packaging_format not in [2]: raise YunohostValidationError("app_packaging_format_not_supported") requirements = manifest.get("requirements", dict()) diff --git a/src/yunohost/app_catalog.py b/src/yunohost/app_catalog.py index e4ffa1db6..575f0bf1b 100644 --- a/src/yunohost/app_catalog.py +++ b/src/yunohost/app_catalog.py @@ -58,8 +58,8 @@ def app_catalog(full=False, with_categories=False): "level": infos["level"], } else: - infos["manifest"]["arguments"] = _set_default_ask_questions( - infos["manifest"].get("arguments", {}) + infos["manifest"]["install"] = _set_default_ask_questions( + infos["manifest"].get("install", {}) ) # Trim info for categories if not using --full From fe6ebe8e66741d827398097526445219b315c4ce Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Thu, 7 Oct 2021 09:34:28 +0200 Subject: [PATCH 004/174] Always define YNH_ACTION --- src/yunohost/app.py | 22 ++++++++++++++-------- src/yunohost/backup.py | 4 ++-- 2 files changed, 16 insertions(+), 10 deletions(-) diff --git a/src/yunohost/app.py b/src/yunohost/app.py index 35ad2be36..c86c88747 100644 --- a/src/yunohost/app.py +++ b/src/yunohost/app.py @@ -408,7 +408,7 @@ def app_change_url(operation_logger, app, domain, path): tmp_workdir_for_app = _make_tmp_workdir_for_app(app=app) # Prepare env. var. to pass to script - env_dict = _make_environment_for_app_script(app, workdir=tmp_workdir_for_app) + env_dict = _make_environment_for_app_script(app, workdir=tmp_workdir_for_app, action="change_url") env_dict["YNH_APP_OLD_DOMAIN"] = old_domain env_dict["YNH_APP_OLD_PATH"] = old_path env_dict["YNH_APP_NEW_DOMAIN"] = domain @@ -562,7 +562,7 @@ def app_upgrade(app=[], url=None, file=None, force=False, no_safety_backup=False # Prepare env. var. to pass to script env_dict = _make_environment_for_app_script( - app_instance_name, workdir=extracted_app_folder + app_instance_name, workdir=extracted_app_folder, action="upgrade" ) env_dict["YNH_APP_UPGRADE_TYPE"] = upgrade_type env_dict["YNH_APP_MANIFEST_VERSION"] = str(app_new_version) @@ -868,7 +868,7 @@ def app_install( # Prepare env. var. to pass to script env_dict = _make_environment_for_app_script( - app_instance_name, args=args, workdir=extracted_app_folder + app_instance_name, args=args, workdir=extracted_app_folder, action="install" ) env_dict_for_logging = env_dict.copy() @@ -931,7 +931,7 @@ def app_install( # Setup environment for remove script env_dict_remove = _make_environment_for_app_script( - app_instance_name, workdir=extracted_app_folder + app_instance_name, workdir=extracted_app_folder, action="remove" ) # Execute remove script @@ -1046,7 +1046,7 @@ def app_remove(operation_logger, app, purge=False): env_dict = {} app_id, app_instance_nb = _parse_app_instance_name(app) - env_dict = _make_environment_for_app_script(app, workdir=tmp_workdir_for_app) + env_dict = _make_environment_for_app_script(app, workdir=tmp_workdir_for_app, action="remove") env_dict["YNH_APP_PURGE"] = str(1 if purge else 0) operation_logger.extra.update({"env": env_dict}) @@ -1541,9 +1541,8 @@ def app_action_run(operation_logger, app, action, args=None): tmp_workdir_for_app = _make_tmp_workdir_for_app(app=app) env_dict = _make_environment_for_app_script( - app, args=args, args_prefix="ACTION_", workdir=tmp_workdir_for_app + app, args=args, args_prefix="ACTION_", workdir=tmp_workdir_for_app, action=action ) - env_dict["YNH_ACTION"] = action _, action_script = tempfile.mkstemp(dir=tmp_workdir_for_app) @@ -2430,7 +2429,11 @@ def _assert_no_conflicting_apps(domain, path, ignore_app=None, full_domain=False def _make_environment_for_app_script( - app, args={}, args_prefix="APP_ARG_", workdir=None + app, + args={}, + args_prefix="APP_ARG_", + workdir=None, + action=None ): app_setting_path = os.path.join(APPS_SETTING_PATH, app) @@ -2448,6 +2451,9 @@ def _make_environment_for_app_script( if workdir: env_dict["YNH_APP_BASEDIR"] = workdir + if action: + env_dict["YNH_ACTION"] = action + for arg_name, arg_value in args.items(): env_dict["YNH_%s%s" % (args_prefix, arg_name.upper())] = str(arg_value) diff --git a/src/yunohost/backup.py b/src/yunohost/backup.py index cce66597a..1b6aebd79 100644 --- a/src/yunohost/backup.py +++ b/src/yunohost/backup.py @@ -577,7 +577,7 @@ class BackupManager: env_var["YNH_BACKUP_CSV"] = tmp_csv if app is not None: - env_var.update(_make_environment_for_app_script(app)) + env_var.update(_make_environment_for_app_script(app, action="backup")) env_var["YNH_APP_BACKUP_DIR"] = os.path.join( self.work_dir, "apps", app, "backup" ) @@ -1490,7 +1490,7 @@ class RestoreManager: # FIXME : workdir should be a tmp workdir app_workdir = os.path.join(self.work_dir, "apps", app_instance_name, "settings") env_dict = _make_environment_for_app_script( - app_instance_name, workdir=app_workdir + app_instance_name, workdir=app_workdir, action="restore" ) env_dict.update( { From fe6d9c2617d1e947d4f4946049cfa663a6f97042 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Wed, 13 Oct 2021 22:56:51 +0200 Subject: [PATCH 005/174] manifestv2: automatically trigger ynh_abort_if_errors (set -eu) for scripts except remove --- data/helpers.d/utils | 6 ++++++ src/yunohost/app.py | 15 ++++++++------- 2 files changed, 14 insertions(+), 7 deletions(-) diff --git a/data/helpers.d/utils b/data/helpers.d/utils index 453a1ab94..57d5de56a 100644 --- a/data/helpers.d/utils +++ b/data/helpers.d/utils @@ -61,6 +61,12 @@ ynh_abort_if_errors() { trap ynh_exit_properly EXIT # Capturing exit signals on shell script } +# When running an app script with packaging format >= 2, auto-enable ynh_abort_if_errors except for remove script +if [[ ${YNH_APP_PACKAGING_FORMAT:-0} -ge 2 ]] && [[ ${YNH_APP_ACTION} != "remove" ]] +then + ynh_abort_if_errors +fi + # Download, check integrity, uncompress and patch the source from app.src # # usage: ynh_setup_source --dest_dir=dest_dir [--source_id=source_id] [--keep="file1 file2"] diff --git a/src/yunohost/app.py b/src/yunohost/app.py index a0c6d55d1..7488a1646 100644 --- a/src/yunohost/app.py +++ b/src/yunohost/app.py @@ -1371,7 +1371,7 @@ def app_register_url(app, domain, path): raise YunohostValidationError("app_already_installed_cant_change_url") # Check the url is available - _assert_no_conflicting_apps(domain, path) + _assert_no_conflicting_apps(domain, path, ignore_app=app) app_setting(app, "domain", value=domain) app_setting(app, "path", value=path) @@ -1930,7 +1930,9 @@ def _get_manifest_of_app(path): raw_msg=True, ) - if int(manifest.get("packaging_format", 0)) <= 1: + manifest["packaging_format"] = float(str(manifest.get("packaging_format", "")).strip() or "0") + + if manifest["packaging_format"] < 2: manifest = _convert_v1_manifest_to_v2(manifest) manifest["install"] = _set_default_ask_questions(manifest.get("install", {})) @@ -2284,8 +2286,7 @@ def _get_all_installed_apps_id(): def _check_manifest_requirements(manifest: Dict): """Check if required packages are met from the manifest""" - packaging_format = int(manifest.get("packaging_format", 0)) - if packaging_format not in [2]: + if manifest["packaging_format"] not in [1, 2]: raise YunohostValidationError("app_packaging_format_not_supported") requirements = manifest.get("requirements", dict()) @@ -2446,20 +2447,20 @@ def _make_environment_for_app_script( "YNH_APP_INSTANCE_NAME": app, "YNH_APP_INSTANCE_NUMBER": str(app_instance_nb), "YNH_APP_MANIFEST_VERSION": manifest.get("version", "?"), + "YNH_APP_PACKAGING_FORMAT": str(manifest["packaging_format"]), } if workdir: env_dict["YNH_APP_BASEDIR"] = workdir if action: - env_dict["YNH_ACTION"] = action + env_dict["YNH_APP_ACTION"] = action for arg_name, arg_value in args.items(): env_dict["YNH_%s%s" % (args_prefix, arg_name.upper())] = str(arg_value) # If packaging format v2, load all settings - packaging_format = int(manifest.get("packaging_format", 0)) - if packaging_format >= 2: + if manifest["packaging_format"] >= 2: env_dict["app"] = app for setting_name, setting_value in _get_app_settings(app): From 859b3b6f128edafec363a06d41a4fe2042dcf665 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Wed, 13 Oct 2021 22:57:17 +0200 Subject: [PATCH 006/174] Yoloimplement some resources classes, not used for anything for now --- src/yunohost/utils/resources.py | 247 ++++++++++++++++++++++++++++++++ 1 file changed, 247 insertions(+) create mode 100644 src/yunohost/utils/resources.py diff --git a/src/yunohost/utils/resources.py b/src/yunohost/utils/resources.py new file mode 100644 index 000000000..42ae94d83 --- /dev/null +++ b/src/yunohost/utils/resources.py @@ -0,0 +1,247 @@ +# -*- coding: utf-8 -*- + +""" License + + Copyright (C) 2021 YUNOHOST.ORG + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU Affero General Public License as published + by the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU Affero General Public License for more details. + + You should have received a copy of the GNU Affero General Public License + along with this program; if not, see http://www.gnu.org/licenses + +""" +import os +import copy +import psutil +from typing import Dict, Any + +from yunohost.utils.error import YunohostError, YunohostValidationError +from yunohost.utils.filesystem import free_space_in_directory + + +class AppResource: + + def __init__(self, properties: Dict[str, Any], app_id: str, app_settings): + + for key, value in self.default_properties.items(): + setattr(self, key, value) + + for key, value in properties: + setattr(self. key, value) + + +M = 1024 ** 2 +G = 1024 * M +sizes = { + "10M": 10 * M, + "20M": 20 * M, + "40M": 40 * M, + "80M": 80 * M, + "100M": 100 * M, + "200M": 200 * M, + "400M": 400 * M, + "800M": 800 * M, + "1G": 1 * G, + "2G": 2 * G, + "4G": 4 * G, + "8G": 8 * G, + "10G": 10 * G, + "20G": 20 * G, + "40G": 40 * G, + "80G": 80 * G, +} + + +class DiskAppResource(AppResource): + type = "disk" + + default_properties = { + "space": "10M", + } + + def __init__(self, *args, **kwargs): + super().__init__(self, *args, **kwargs) + # FIXME: better error handling + assert self.space in sizes + + def provision_or_update(self, context: Dict): + + if free_space_in_directory("/") <= sizes[self.space] \ + or free_space_in_directory("/var") <= sizes[self.space]: + raise YunohostValidationError("Not enough disk space") # FIXME: i18n / better messaging + + def deprovision(self, context: Dict): + pass + + +class RamAppResource(AppResource): + type = "ram" + + default_properties = { + "build": "10M", + "runtime": "10M", + "include_swap": False + } + + def __init__(self, *args, **kwargs): + super().__init__(self, *args, **kwargs) + # FIXME: better error handling + assert self.build in sizes + assert self.runtime in sizes + assert isinstance(self.include_swap, bool) + + def provision_or_update(self, context: Dict): + + memory = psutil.virtual_memory().available + if self.include_swap: + memory += psutil.swap_memory().available + + max_size = max(sizes[self.build], sizes[self.runtime]) + + if memory <= max_size: + raise YunohostValidationError("Not enough RAM/swap") # FIXME: i18n / better messaging + + def deprovision(self, context: Dict): + pass + + +class WebpathAppResource(AppResource): + type = "webpath" + + default_properties = { + "url": "__DOMAIN____PATH__" + } + + def provision_or_update(self, context: Dict): + + from yunohost.app import _assert_no_conflicting_apps + + # Check the url is available + domain = context["app_settings"]["domain"] + path = context["app_settings"]["path"] or "/" + _assert_no_conflicting_apps(domain, path, ignore_app=context["app"]) + context["app_settings"]["path"] = path + + if context["app_action"] == "install": + # Initially, the .main permission is created with no url at all associated + # When the app register/books its web url, we also add the url '/' + # (meaning the root of the app, domain.tld/path/) + # and enable the tile to the SSO, and both of this should match 95% of apps + # For more specific cases, the app is free to change / add urls or disable + # the tile using the permission helpers. + permission_url(app + ".main", url="/", sync_perm=False) + user_permission_update(app + ".main", show_tile=True, sync_perm=False) + permission_sync_to_user() + + def deprovision(self, context: Dict): + del context["app_settings"]["domain"] + del context["app_settings"]["path"] + + +class PortAppResource(AppResource): + type = "port" + + default_properties = { + "value": 1000 + } + + def _port_is_used(self, port): + + # FIXME : this could be less brutal than two os.system ... + cmd1 = "ss --numeric --listening --tcp --udp | awk '{print$5}' | grep --quiet --extended-regexp ':%s$'" % port + # This second command is mean to cover (most) case where an app is using a port yet ain't currently using it for some reason (typically service ain't up) + cmd2 = f"grep -q \"port: '{port}'\" /etc/yunohost/apps/*/settings.yml" + return os.system(cmd1) == 0 and os.system(cmd2) == 0 + + def provision_or_update(self, context: str): + + # Don't do anything if port already defined ? + if context["app_settings"].get("port"): + return + + port = self.value + while self._port_is_used(port): + port += 1 + + context["app_settings"]["port"] = port + + def deprovision(self, context: Dict): + raise NotImplementedError() + + +class UserAppResource(AppResource): + type = "user" + + default_properties = { + "username": "__APP__", + "home_dir": "/var/www/__APP__", + "use_shell": False, + "groups": [] + } + + def provision_or_update(self, context: str): + raise NotImplementedError() + + def deprovision(self, context: Dict): + raise NotImplementedError() + + +class InstalldirAppResource(AppResource): + type = "installdir" + + default_properties = { + "dir": "/var/www/__APP__", + "alias": "final_path" + } + + def provision_or_update(self, context: Dict): + + if context["app_action"] in ["install", "restore"]: + if os.path.exists(self.dir): + raise YunohostValidationError(f"Path {self.dir} already exists") + + if "installdir" not in context["app_settings"]: + context["app_settings"]["installdir"] = self.dir + context["app_settings"][self.alias] = context["app_settings"]["installdir"] + + def deprovision(self, context: Dict): + # FIXME: should it rm the directory during remove/deprovision ? + pass + + +class DatadirAppResource(AppResource): + type = "datadir" + + default_properties = { + "dir": "/home/yunohost.app/__APP__", + } + + def provision_or_update(self, context: Dict): + if "datadir" not in context["app_settings"]: + context["app_settings"]["datadir"] = self.dir + + def deprovision(self, context: Dict): + # FIXME: should it rm the directory during remove/deprovision ? + pass + + +class DBAppResource(AppResource): + type = "db" + + default_properties = { + "type": "mysql" + } + + def provision_or_update(self, context: str): + raise NotImplementedError() + + def deprovision(self, context: Dict): + raise NotImplementedError() From 3084359155bf29c3cb69cc654cac0d19876e109f Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Mon, 1 Nov 2021 22:40:52 +0100 Subject: [PATCH 007/174] Typos --- data/helpers.d/utils | 2 +- src/yunohost/app.py | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/data/helpers.d/utils b/data/helpers.d/utils index 57d5de56a..02fd10ba9 100644 --- a/data/helpers.d/utils +++ b/data/helpers.d/utils @@ -62,7 +62,7 @@ ynh_abort_if_errors() { } # When running an app script with packaging format >= 2, auto-enable ynh_abort_if_errors except for remove script -if [[ ${YNH_APP_PACKAGING_FORMAT:-0} -ge 2 ]] && [[ ${YNH_APP_ACTION} != "remove" ]] +if dpkg --compare-versions ${YNH_APP_PACKAGING_FORMAT:-0} ge 2 && [[ ${YNH_APP_ACTION} != "remove" ]] then ynh_abort_if_errors fi diff --git a/src/yunohost/app.py b/src/yunohost/app.py index 7488a1646..ba4351c2f 100644 --- a/src/yunohost/app.py +++ b/src/yunohost/app.py @@ -627,7 +627,7 @@ def app_upgrade(app=[], url=None, file=None, force=False, no_safety_backup=False if upgrade_failed or broke_the_system: # display this if there are remaining apps - if apps[number + 1 :]: + if apps[number + 1:]: not_upgraded_apps = apps[number:] logger.error( m18n.n( @@ -2048,9 +2048,9 @@ def _set_default_ask_questions(questions, script_name="install"): # Also it in fact doesn't make sense for any of those questions to have an example value nor a default value... if question.get("type") in ["domain", "user", "password"]: - if "example" in arg: + if "example" in question: del question["example"] - if "default" in arg: + if "default" in question: del question["domain"] return questions From 8a71fae732212a28b215b1a20f12b49da9dc7958 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Mon, 1 Nov 2021 22:41:31 +0100 Subject: [PATCH 008/174] manifestv2 upgrade: implement safety backup mecanism in the core --- src/yunohost/app.py | 39 ++++++++++++++++++++++++++++++++++++++- 1 file changed, 38 insertions(+), 1 deletion(-) diff --git a/src/yunohost/app.py b/src/yunohost/app.py index ba4351c2f..05db1fa56 100644 --- a/src/yunohost/app.py +++ b/src/yunohost/app.py @@ -469,6 +469,7 @@ def app_upgrade(app=[], url=None, file=None, force=False, no_safety_backup=False from yunohost.permission import permission_sync_to_user from yunohost.regenconf import manually_modified_files from yunohost.utils.legacy import _patch_legacy_php_versions, _patch_legacy_helpers + from yunohost.backup import backup_list, backup_create, backup_delete, backup_restore apps = app # Check if disk space available @@ -556,6 +557,31 @@ def app_upgrade(app=[], url=None, file=None, force=False, no_safety_backup=False # Check requirements _check_manifest_requirements(manifest) + + if manifest["packaging_format"] >= 2: + if no_safety_backup: + logger.warning("Skipping the creation of a backup prior to the upgrade.") + else: + # FIXME: i18n + logger.info("Creating a safety backup prior to the upgrade") + + # Switch between pre-upgrade1 or pre-upgrade2 + safety_backup_name = f"{app_instance_name}-pre-upgrade1" + other_safety_backup_name = f"{app_instance_name}-pre-upgrade2" + if safety_backup_name in backup_list()["archives"]: + safety_backup_name = f"{app_instance_name}-pre-upgrade2" + other_safety_backup_name = f"{app_instance_name}-pre-upgrade1" + + backup_create(name=safety_backup_name, apps=[app_instance_name]) + + if safety_backup_name in backup_list()["archives"]: + # if the backup suceeded, delete old safety backup to save space + if other_safety_backup_name in backup_list()["archives"]: + backup_delete(other_safety_backup_name) + else: + # Is this needed ? Shouldn't backup_create report an expcetion if backup failed ? + raise YunohostError("Uhoh the safety backup failed ?! Aborting the upgrade process.", raw_msg=True) + _assert_system_is_sane_for_app(manifest, "pre") app_setting_path = os.path.join(APPS_SETTING_PATH, app_instance_name) @@ -567,7 +593,8 @@ def app_upgrade(app=[], url=None, file=None, force=False, no_safety_backup=False env_dict["YNH_APP_UPGRADE_TYPE"] = upgrade_type env_dict["YNH_APP_MANIFEST_VERSION"] = str(app_new_version) env_dict["YNH_APP_CURRENT_VERSION"] = str(app_current_version) - env_dict["NO_BACKUP_UPGRADE"] = "1" if no_safety_backup else "0" + if manifest["packaging_format"] < 2: + env_dict["NO_BACKUP_UPGRADE"] = "1" if no_safety_backup else "0" # We'll check that the app didn't brutally edit some system configuration manually_modified_files_before_install = manually_modified_files() @@ -599,6 +626,16 @@ def app_upgrade(app=[], url=None, file=None, force=False, no_safety_backup=False ), ) finally: + + # If upgrade failed, try to restore the safety backup + if upgrade_failed and manifest["packaging_format"] >= 2 and not no_safety_backup: + logger.warning("Upgrade failed ... attempting to restore the satefy backup (Yunohost first need to remove the app for this) ...") + + app_remove(app_instance_name) + backup_restore(name=safety_backup_name, apps=[app_instance_name], force=True) + if not _is_installed(app_instance_name): + logger.error("Uhoh ... Yunohost failed to restore the app to the way it was before the failed upgrade :|") + # Whatever happened (install success or failure) we check if it broke the system # and warn the user about it try: From 0a750b7b61f2d0c01a90d3049a928c6963ab0dff Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Wed, 3 Nov 2021 16:36:38 +0100 Subject: [PATCH 009/174] Absolutely yolo iteration on app resources draft --- src/yunohost/app.py | 48 ++++++----- src/yunohost/utils/config.py | 20 ++++- src/yunohost/utils/resources.py | 144 +++++++++++++++++++++++++------- 3 files changed, 160 insertions(+), 52 deletions(-) diff --git a/src/yunohost/app.py b/src/yunohost/app.py index 05db1fa56..8e05c37c9 100644 --- a/src/yunohost/app.py +++ b/src/yunohost/app.py @@ -59,6 +59,7 @@ from yunohost.utils.config import ( DomainQuestion, PathQuestion, ) +from yunohost.utils.resources import AppResourceSet from yunohost.utils.i18n import _value_for_locale from yunohost.utils.error import YunohostError, YunohostValidationError from yunohost.utils.filesystem import free_space_in_directory @@ -803,6 +804,7 @@ def app_install( confirm_install(app) manifest, extracted_app_folder = _extract_app(app) + packaging_format = manifest["packaging_format"] # Check ID if "id" not in manifest or "__" in manifest["id"] or "." in manifest["id"]: @@ -827,7 +829,7 @@ def app_install( app_instance_name = app_id # Retrieve arguments list for install script - raw_questions = manifest.get("arguments", {}).get("install", {}) + raw_questions = manifest["install"] questions = ask_questions_and_parse_answers(raw_questions, prefilled_answers=args) args = { question.name: question.value @@ -836,11 +838,12 @@ def app_install( } # Validate domain / path availability for webapps - path_requirement = _guess_webapp_path_requirement(extracted_app_folder) - _validate_webpath_requirement(args, path_requirement) + if packaging_format < 2: + path_requirement = _guess_webapp_path_requirement(extracted_app_folder) + _validate_webpath_requirement(args, path_requirement) - # Attempt to patch legacy helpers ... - _patch_legacy_helpers(extracted_app_folder) + # Attempt to patch legacy helpers ... + _patch_legacy_helpers(extracted_app_folder) # Apply dirty patch to make php5 apps compatible with php7 _patch_legacy_php_versions(extracted_app_folder) @@ -870,7 +873,6 @@ def app_install( } # If packaging_format v2+, save all install questions as settings - packaging_format = int(manifest.get("packaging_format", 0)) if packaging_format >= 2: for arg_name, arg_value in args.items(): @@ -891,17 +893,23 @@ def app_install( recursive=True, ) - # Initialize the main permission for the app - # The permission is initialized with no url associated, and with tile disabled - # For web app, the root path of the app will be added as url and the tile - # will be enabled during the app install. C.f. 'app_register_url()' below. - permission_create( - app_instance_name + ".main", - allowed=["all_users"], - label=label, - show_tile=False, - protected=False, - ) + + resources = AppResourceSet(manifest["resources"], app_instance_name) + resources.check_availability() + resources.provision() + + if packaging_format < 2: + # Initialize the main permission for the app + # The permission is initialized with no url associated, and with tile disabled + # For web app, the root path of the app will be added as url and the tile + # will be enabled during the app install. C.f. 'app_register_url()' below. + permission_create( + app_instance_name + ".main", + allowed=["all_users"], + label=label, + show_tile=False, + protected=False, + ) # Prepare env. var. to pass to script env_dict = _make_environment_for_app_script( @@ -2354,13 +2362,13 @@ def _guess_webapp_path_requirement(app_folder: str) -> str: # is an available url and normalize the path. manifest = _get_manifest_of_app(app_folder) - raw_questions = manifest.get("arguments", {}).get("install", {}) + raw_questions = manifest["install"] domain_questions = [ - question for question in raw_questions if question.get("type") == "domain" + question for question in raw_questions.values() if question.get("type") == "domain" ] path_questions = [ - question for question in raw_questions if question.get("type") == "path" + question for question in raw_questions.values() if question.get("type") == "path" ] if len(domain_questions) == 0 and len(path_questions) == 0: diff --git a/src/yunohost/utils/config.py b/src/yunohost/utils/config.py index 4ee62c6f7..b7bd4e723 100644 --- a/src/yunohost/utils/config.py +++ b/src/yunohost/utils/config.py @@ -1052,6 +1052,21 @@ class UserQuestion(Question): break +class GroupQuestion(Question): + argument_type = "group" + + def __init__(self, question, context: Mapping[str, Any] = {}): + + from yunohost.user import user_group_list + + super().__init__(question, context) + + self.choices = list(user_group_list(short=True)["groups"]) + + if self.default is None: + self.default = "all_users" + + class NumberQuestion(Question): argument_type = "number" default_value = None @@ -1204,6 +1219,7 @@ ARGUMENTS_TYPE_PARSERS = { "boolean": BooleanQuestion, "domain": DomainQuestion, "user": UserQuestion, + "group": GroupQuestion, "number": NumberQuestion, "range": NumberQuestion, "display_text": DisplayTextQuestion, @@ -1243,9 +1259,9 @@ def ask_questions_and_parse_answers( out = [] - for raw_question in raw_questions: + for name, raw_question in raw_questions.items(): question_class = ARGUMENTS_TYPE_PARSERS[raw_question.get("type", "string")] - raw_question["value"] = answers.get(raw_question["name"]) + raw_question["value"] = answers.get(name) question = question_class(raw_question, context=answers) answers[question.name] = question.ask_if_needed() out.append(question) diff --git a/src/yunohost/utils/resources.py b/src/yunohost/utils/resources.py index 42ae94d83..c71af09b8 100644 --- a/src/yunohost/utils/resources.py +++ b/src/yunohost/utils/resources.py @@ -27,15 +27,37 @@ from yunohost.utils.error import YunohostError, YunohostValidationError from yunohost.utils.filesystem import free_space_in_directory -class AppResource: +class AppResource(object): - def __init__(self, properties: Dict[str, Any], app_id: str, app_settings): + def __init__(self, properties: Dict[str, Any], app_id: str): + + self.app_id = app_id for key, value in self.default_properties.items(): setattr(self, key, value) - for key, value in properties: - setattr(self. key, value) + for key, value in properties.items(): + setattr(self, key, value) + + def get_app_settings(self): + from yunohost.app import _get_app_settings + return _get_app_settings(self.app_id) + + def check_availability(self, context: Dict): + pass + + +class AppResourceSet: + + def __init__(self, resources_dict: Dict[str, Dict[str, Any]], app_id: str): + + self.set = {name: AppResourceClassesByType[name](infos, app_id) + for name, infos in resources_dict.items()} + + def check_availability(self): + + for name, resource in self.set.items(): + resource.check_availability(context={}) M = 1024 ** 2 @@ -68,19 +90,16 @@ class DiskAppResource(AppResource): } def __init__(self, *args, **kwargs): - super().__init__(self, *args, **kwargs) + super().__init__(*args, **kwargs) # FIXME: better error handling assert self.space in sizes - def provision_or_update(self, context: Dict): + def assert_availability(self, context: Dict): if free_space_in_directory("/") <= sizes[self.space] \ or free_space_in_directory("/var") <= sizes[self.space]: raise YunohostValidationError("Not enough disk space") # FIXME: i18n / better messaging - def deprovision(self, context: Dict): - pass - class RamAppResource(AppResource): type = "ram" @@ -92,13 +111,13 @@ class RamAppResource(AppResource): } def __init__(self, *args, **kwargs): - super().__init__(self, *args, **kwargs) + super().__init__(*args, **kwargs) # FIXME: better error handling assert self.build in sizes assert self.runtime in sizes assert isinstance(self.include_swap, bool) - def provision_or_update(self, context: Dict): + def assert_availability(self, context: Dict): memory = psutil.virtual_memory().available if self.include_swap: @@ -109,37 +128,78 @@ class RamAppResource(AppResource): if memory <= max_size: raise YunohostValidationError("Not enough RAM/swap") # FIXME: i18n / better messaging - def deprovision(self, context: Dict): + +class AptDependenciesAppResource(AppResource): + type = "apt" + + default_properties = { + "packages": [], + "extras": {} + } + + def check_availability(self, context): + # ? FIXME + # call helpers idk ... + pass + +class SourcesAppResource(AppResource): + type = "sources" + + default_properties = { + "main": {"url": "?", "sha256sum": "?", "predownload": True} + } + + def check_availability(self, context): + # ? FIXME + # call request.head on the url idk pass -class WebpathAppResource(AppResource): - type = "webpath" +class RoutesAppResource(AppResource): + type = "routes" default_properties = { - "url": "__DOMAIN____PATH__" + "full_domain": False, + "main": { + "url": "/", + "additional_urls": [], + "init_allowed": "__FIXME__", + "show_tile": True, + "protected": False, + "auth_header": True, + "label": "FIXME", + } } - def provision_or_update(self, context: Dict): + def check_availability(self, context): from yunohost.app import _assert_no_conflicting_apps - # Check the url is available - domain = context["app_settings"]["domain"] - path = context["app_settings"]["path"] or "/" - _assert_no_conflicting_apps(domain, path, ignore_app=context["app"]) - context["app_settings"]["path"] = path + app_settings = self.get_app_settings() + domain = app_settings["domain"] + path = app_settings["path"] if not self.full_domain else "/" + _assert_no_conflicting_apps(domain, path, ignore_app=self.app_id) + + def provision_or_update(self, context: Dict): if context["app_action"] == "install": + pass # FIXME # Initially, the .main permission is created with no url at all associated # When the app register/books its web url, we also add the url '/' # (meaning the root of the app, domain.tld/path/) # and enable the tile to the SSO, and both of this should match 95% of apps # For more specific cases, the app is free to change / add urls or disable # the tile using the permission helpers. - permission_url(app + ".main", url="/", sync_perm=False) - user_permission_update(app + ".main", show_tile=True, sync_perm=False) - permission_sync_to_user() + #permission_create( + # self.app_id + ".main", + # allowed=["all_users"], + # label=label, + # show_tile=False, + # protected=False, + #) + #permission_url(app + ".main", url="/", sync_perm=False) + #user_permission_update(app + ".main", show_tile=True, sync_perm=False) + #permission_sync_to_user() def deprovision(self, context: Dict): del context["app_settings"]["domain"] @@ -177,8 +237,8 @@ class PortAppResource(AppResource): raise NotImplementedError() -class UserAppResource(AppResource): - type = "user" +class SystemuserAppResource(AppResource): + type = "system_user" default_properties = { "username": "__APP__", @@ -187,6 +247,12 @@ class UserAppResource(AppResource): "groups": [] } + def check_availability(self, context): + if os.system(f"getent passwd {self.username} &>/dev/null") != 0: + raise YunohostValidationError(f"User {self.username} already exists") + if os.system(f"getent group {self.username} &>/dev/null") != 0: + raise YunohostValidationError(f"Group {self.username} already exists") + def provision_or_update(self, context: str): raise NotImplementedError() @@ -195,13 +261,19 @@ class UserAppResource(AppResource): class InstalldirAppResource(AppResource): - type = "installdir" + type = "install_dir" default_properties = { - "dir": "/var/www/__APP__", + "dir": "/var/www/__APP__", # FIXME or choose to move this elsewhere nowadays idk... "alias": "final_path" } + # FIXME: change default dir to /opt/stuff if app ain't a webapp ... + + def check_availability(self, context): + if os.path.exists(self.dir): + raise YunohostValidationError(f"Folder {self.dir} already exists") + def provision_or_update(self, context: Dict): if context["app_action"] in ["install", "restore"]: @@ -218,12 +290,16 @@ class InstalldirAppResource(AppResource): class DatadirAppResource(AppResource): - type = "datadir" + type = "data_dir" default_properties = { - "dir": "/home/yunohost.app/__APP__", + "dir": "/home/yunohost.app/__APP__", # FIXME or choose to move this elsewhere nowadays idk... } + def check_availability(self, context): + if os.path.exists(self.dir): + raise YunohostValidationError(f"Folder {self.dir} already exists") + def provision_or_update(self, context: Dict): if "datadir" not in context["app_settings"]: context["app_settings"]["datadir"] = self.dir @@ -240,8 +316,16 @@ class DBAppResource(AppResource): "type": "mysql" } + def check_availability(self, context): + # FIXME : checking availability sort of imply that mysql / postgresql is installed + # or we gotta make sure mariadb-server or postgresql is gonna be installed (apt resource) + pass + def provision_or_update(self, context: str): raise NotImplementedError() def deprovision(self, context: Dict): raise NotImplementedError() + + +AppResourceClassesByType = {c.type: c for c in AppResource.__subclasses__()} From 6a437c0b4fe80149328bfa2150af4525f4a3c098 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Wed, 3 Nov 2021 18:33:00 +0100 Subject: [PATCH 010/174] Rework requirement checks to integrate architecture, multiinnstance, disk/ram, ... + drop disk/ram as resource, have them directly in 'integration' --- src/yunohost/app.py | 125 ++++++++++++++++++++------------ src/yunohost/backup.py | 1 + src/yunohost/utils/resources.py | 71 ------------------ 3 files changed, 79 insertions(+), 118 deletions(-) diff --git a/src/yunohost/app.py b/src/yunohost/app.py index c5d75b25b..d555b6872 100644 --- a/src/yunohost/app.py +++ b/src/yunohost/app.py @@ -35,6 +35,7 @@ import tempfile import copy from collections import OrderedDict from typing import List, Tuple, Dict, Any +from packaging import version from moulinette import Moulinette, m18n from moulinette.utils.log import getActionLogger @@ -52,7 +53,7 @@ from moulinette.utils.filesystem import ( chmod, ) -from yunohost.utils import packages +from yunohost.utils.packages import dpkg_is_broken, get_ynh_package_version from yunohost.utils.config import ( ConfigPanel, ask_questions_and_parse_answers, @@ -194,7 +195,6 @@ def app_info(app, full=False): def _app_upgradable(app_infos): - from packaging import version # Determine upgradability @@ -460,7 +460,6 @@ def app_upgrade(app=[], url=None, file=None, force=False, no_safety_backup=False no_safety_backup -- Disable the safety backup during upgrade """ - from packaging import version from yunohost.hook import ( hook_add, hook_remove, @@ -557,7 +556,7 @@ def app_upgrade(app=[], url=None, file=None, force=False, no_safety_backup=False upgrade_type = "UPGRADE_FULL" # Check requirements - _check_manifest_requirements(manifest) + _check_manifest_requirements(manifest, action="upgrade") if manifest["packaging_format"] >= 2: if no_safety_backup: @@ -814,15 +813,12 @@ def app_install( label = label if label else manifest["name"] # Check requirements - _check_manifest_requirements(manifest) + _check_manifest_requirements(manifest, action="install") _assert_system_is_sane_for_app(manifest, "pre") # Check if app can be forked instance_number = _next_instance_number_for_app(app_id) if instance_number > 1: - if "multi_instance" not in manifest or not is_true(manifest["multi_instance"]): - raise YunohostValidationError("app_already_installed", app=app_id) - # Change app_id to the forked app id app_instance_name = app_id + "__" + str(instance_number) else: @@ -1995,11 +1991,13 @@ def _convert_v1_manifest_to_v2(manifest): manifest["upstream"]["website"] = manifest["url"] manifest["integration"] = { - "yunohost": manifest.get("requirements", {}).get("yunohost"), + "yunohost": manifest.get("requirements", {}).get("yunohost", "").replace(">", "").replace("=", "").replace(" ", ""), "architectures": "all", - "multi_instance": manifest.get("multi_instance", False), + "multi_instance": is_true(manifest.get("multi_instance", False)), "ldap": "?", "sso": "?", + "disk": "50M", + "ram": {"build": "50M", "runtime": "10M", "include_swap": False} } maintainer = manifest.get("maintainer", {}).get("name") @@ -2017,29 +2015,12 @@ def _convert_v1_manifest_to_v2(manifest): manifest["install"][name] = question manifest["resources"] = { - "disk": { - "build": "50M", # This is an *estimate* minimum value for the disk needed at build time (e.g. during install/upgrade) and during regular usage - "usage": "50M" # Please only use round values such as: 10M, 100M, 200M, 400M, 800M, 1G, 2G, 4G, 8G - }, - "ram": { - "build": "50M", # This is an *estimate* minimum value for the RAM needed at build time (i.e. during install/upgrade) and during regular usage - "usage": "10M", # Please only use round values like ["10M", "100M", "200M", "400M", "800M", "1G", "2G", "4G", "8G"] - "include_swap": False - }, - "route": {}, + "system_user": {}, "install_dir": { - "base_dir": "/var/www/", # This means that the app shall be installed in /var/www/$app which is the standard for webapps. You may change this to /opt/ if the app is a system app. "alias": "final_path" } } - if "domain" in manifest["install"] and "path" in manifest["install"]: - manifest["resources"]["route"]["url"] = "{domain}{path}" - elif "path" not in manifest["install"]: - manifest["resources"]["route"]["url"] = "{domain}/" - else: - del manifest["resources"]["route"] - keys_to_keep = ["packaging_format", "id", "name", "description", "version", "maintainers", "upstream", "integration", "install", "resources"] keys_to_del = [key for key in manifest.keys() if key not in keys_to_keep] @@ -2325,32 +2306,60 @@ def _get_all_installed_apps_id(): return all_apps_ids_formatted -def _check_manifest_requirements(manifest: Dict): +def _check_manifest_requirements(manifest: Dict, action: str): """Check if required packages are met from the manifest""" if manifest["packaging_format"] not in [1, 2]: raise YunohostValidationError("app_packaging_format_not_supported") - requirements = manifest.get("requirements", dict()) - - if not requirements: - return - - app = manifest.get("id", "?") + app_id = manifest["id"] logger.debug(m18n.n("app_requirements_checking", app=app)) - # Iterate over requirements - for pkgname, spec in requirements.items(): - if not packages.meets_version_specifier(pkgname, spec): - version = packages.ynh_packages_version()[pkgname]["version"] - raise YunohostValidationError( - "app_requirements_unmeet", - pkgname=pkgname, - version=version, - spec=spec, - app=app, - ) + # Yunohost version requirement + + yunohost_requirement = version.parse(manifest["integration"]["yunohost"] or "4.3") + yunohost_installed_version = get_ynh_package_version("yunohost")["version"] + if yunohost_requirement > yunohost_installed_version: + # FIXME : i18n + raise YunohostValidationError(f"This app requires Yunohost >= {yunohost_requirement} but current installed version is {yunohost_installed_version}") + + # Architectures + arch_requirement = manifest["integration"]["architectures"] + if arch_requirement != "all": + arch = check_output("dpkg --print-architecture") + if arch not in arch_requirement: + # FIXME: i18n + raise YunohostValidationError(f"This app can only be installed on architectures {', '.join(arch_requirement)} but your server architecture is {arch}") + + # Multi-instance + if action == "install" and manifest["integration"]["multi_instance"] == False: + apps = _installed_apps() + sibling_apps = [a for a in apps if a == app_id or a.startswith(f"{app_id}__")] + if len(sibling_apps) > 0: + raise YunohostValidationError("app_already_installed", app=app_id) + + # Disk + if action == "install": + disk_requirement = manifest["integration"]["disk"] + + if free_space_in_directory("/") <= human_to_binary[disk_requirement] \ + or free_space_in_directory("/var") <= human_to_binary[disk_requirement]: + # FIXME : i18m + raise YunohostValidationError("This app requires {disk_requirement} free space.") + + # Ram for build + import psutil + ram_build_requirement = manifest["integration"]["ram"]["build"] + ram_include_swap = manifest["integration"]["ram"]["include_swap"] + + ram_available = psutil.virtual_memory().available + if ram_include_swap: + ram_available += psutil.swap_memory().available + + if ram_available < human_to_binary(ram_build_requirement): + # FIXME : i18n + raise YunohostValidationError("This app requires {ram_build_requirement} RAM available to install/upgrade") def _guess_webapp_path_requirement(app_folder: str) -> str: @@ -2688,8 +2697,30 @@ def _assert_system_is_sane_for_app(manifest, when): "app_action_broke_system", services=", ".join(faulty_services) ) - if packages.dpkg_is_broken(): + if dpkg_is_broken(): if when == "pre": raise YunohostValidationError("dpkg_is_broken") elif when == "post": raise YunohostError("this_action_broke_dpkg") + + + +def human_to_binary(size: str) -> int: + + symbols = ("K", "M", "G", "T", "P", "E", "Z", "Y") + factor = {} + for i, s in enumerate(symbols): + factor[s] = 1 << (i + 1) * 10 + + suffix = size[-1] + size = size[:-1] + + if suffix not in symbols: + raise YunohostError(f"Invalid size suffix '{suffix}', expected one of {symbols}") + + try: + size = float(size) + except Exception: + raise YunohostError(f"Failed to convert size {size} to float") + + return size * factor[suffix] diff --git a/src/yunohost/backup.py b/src/yunohost/backup.py index 8deb2b3bf..78aab0dce 100644 --- a/src/yunohost/backup.py +++ b/src/yunohost/backup.py @@ -2695,3 +2695,4 @@ def binary_to_human(n, customary=False): value = float(n) / prefix[s] return "%.1f%s" % (value, s) return "%s" % n + diff --git a/src/yunohost/utils/resources.py b/src/yunohost/utils/resources.py index c71af09b8..424e38f91 100644 --- a/src/yunohost/utils/resources.py +++ b/src/yunohost/utils/resources.py @@ -20,11 +20,9 @@ """ import os import copy -import psutil from typing import Dict, Any from yunohost.utils.error import YunohostError, YunohostValidationError -from yunohost.utils.filesystem import free_space_in_directory class AppResource(object): @@ -60,75 +58,6 @@ class AppResourceSet: resource.check_availability(context={}) -M = 1024 ** 2 -G = 1024 * M -sizes = { - "10M": 10 * M, - "20M": 20 * M, - "40M": 40 * M, - "80M": 80 * M, - "100M": 100 * M, - "200M": 200 * M, - "400M": 400 * M, - "800M": 800 * M, - "1G": 1 * G, - "2G": 2 * G, - "4G": 4 * G, - "8G": 8 * G, - "10G": 10 * G, - "20G": 20 * G, - "40G": 40 * G, - "80G": 80 * G, -} - - -class DiskAppResource(AppResource): - type = "disk" - - default_properties = { - "space": "10M", - } - - def __init__(self, *args, **kwargs): - super().__init__(*args, **kwargs) - # FIXME: better error handling - assert self.space in sizes - - def assert_availability(self, context: Dict): - - if free_space_in_directory("/") <= sizes[self.space] \ - or free_space_in_directory("/var") <= sizes[self.space]: - raise YunohostValidationError("Not enough disk space") # FIXME: i18n / better messaging - - -class RamAppResource(AppResource): - type = "ram" - - default_properties = { - "build": "10M", - "runtime": "10M", - "include_swap": False - } - - def __init__(self, *args, **kwargs): - super().__init__(*args, **kwargs) - # FIXME: better error handling - assert self.build in sizes - assert self.runtime in sizes - assert isinstance(self.include_swap, bool) - - def assert_availability(self, context: Dict): - - memory = psutil.virtual_memory().available - if self.include_swap: - memory += psutil.swap_memory().available - - max_size = max(sizes[self.build], sizes[self.runtime]) - - if memory <= max_size: - raise YunohostValidationError("Not enough RAM/swap") # FIXME: i18n / better messaging - - class AptDependenciesAppResource(AppResource): type = "apt" From 810534c661f5c57050c974a8bd8ddd2c7c46bc74 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Wed, 3 Nov 2021 20:38:51 +0100 Subject: [PATCH 011/174] Cleanup / refactor a bunch of utils into utils/system.py --- data/actionsmap/yunohost.yml | 2 +- data/hooks/diagnosis/00-basesystem.py | 13 +- src/yunohost/app.py | 82 ++++--------- src/yunohost/backup.py | 88 +++++--------- .../data_migrations/0015_migrate_to_buster.py | 4 +- .../0017_postgresql_9p6_to_11.py | 2 +- src/yunohost/log.py | 2 +- src/yunohost/tools.py | 23 +--- src/yunohost/user.py | 12 +- src/yunohost/utils/filesystem.py | 31 ----- src/yunohost/utils/{packages.py => system.py} | 111 ++++++++++++------ 11 files changed, 146 insertions(+), 224 deletions(-) delete mode 100644 src/yunohost/utils/filesystem.py rename src/yunohost/utils/{packages.py => system.py} (67%) diff --git a/data/actionsmap/yunohost.yml b/data/actionsmap/yunohost.yml index 16ea2c5d2..e63a04a41 100644 --- a/data/actionsmap/yunohost.yml +++ b/data/actionsmap/yunohost.yml @@ -43,7 +43,7 @@ _global: help: Display YunoHost packages versions action: callback callback: - method: yunohost.utils.packages.ynh_packages_version + method: yunohost.utils.system.ynh_packages_version return: true ############################# diff --git a/data/hooks/diagnosis/00-basesystem.py b/data/hooks/diagnosis/00-basesystem.py index b472a2d32..afb44ff37 100644 --- a/data/hooks/diagnosis/00-basesystem.py +++ b/data/hooks/diagnosis/00-basesystem.py @@ -7,7 +7,11 @@ import subprocess from moulinette.utils.process import check_output from moulinette.utils.filesystem import read_file, read_json, write_to_json from yunohost.diagnosis import Diagnoser -from yunohost.utils.packages import ynh_packages_version +from yunohost.utils.system import ( + ynh_packages_version, + system_virt, + system_arch, +) class BaseSystemDiagnoser(Diagnoser): @@ -18,15 +22,12 @@ class BaseSystemDiagnoser(Diagnoser): def run(self): - # Detect virt technology (if not bare metal) and arch - # Gotta have this "|| true" because it systemd-detect-virt return 'none' - # with an error code on bare metal ~.~ - virt = check_output("systemd-detect-virt || true", shell=True) + virt = system_virt() if virt.lower() == "none": virt = "bare-metal" # Detect arch - arch = check_output("dpkg --print-architecture") + arch = system_arch() hardware = dict( meta={"test": "hardware"}, status="INFO", diff --git a/src/yunohost/app.py b/src/yunohost/app.py index d555b6872..e251b99de 100644 --- a/src/yunohost/app.py +++ b/src/yunohost/app.py @@ -53,7 +53,6 @@ from moulinette.utils.filesystem import ( chmod, ) -from yunohost.utils.packages import dpkg_is_broken, get_ynh_package_version from yunohost.utils.config import ( ConfigPanel, ask_questions_and_parse_answers, @@ -63,7 +62,15 @@ from yunohost.utils.config import ( from yunohost.utils.resources import AppResourceSet from yunohost.utils.i18n import _value_for_locale from yunohost.utils.error import YunohostError, YunohostValidationError -from yunohost.utils.filesystem import free_space_in_directory +from yunohost.utils.system import ( + free_space_in_directory, + dpkg_is_broken, + get_ynh_package_version, + system_arch, + human_to_binary, + binary_to_human, + ram_available, +) from yunohost.log import is_unit_operation, OperationLogger from yunohost.app_catalog import ( # noqa app_catalog, @@ -179,9 +186,7 @@ def app_info(app, full=False): ret["supports_backup_restore"] = os.path.exists( os.path.join(setting_path, "scripts", "backup") ) and os.path.exists(os.path.join(setting_path, "scripts", "restore")) - ret["supports_multi_instance"] = is_true( - local_manifest.get("integration", {}).get("multi_instance", False) - ) + ret["supports_multi_instance"] = local_manifest.get("integration", {}).get("multi_instance", False) ret["supports_config_panel"] = os.path.exists( os.path.join(setting_path, "config_panel.toml") ) @@ -1993,7 +1998,7 @@ def _convert_v1_manifest_to_v2(manifest): manifest["integration"] = { "yunohost": manifest.get("requirements", {}).get("yunohost", "").replace(">", "").replace("=", "").replace(" ", ""), "architectures": "all", - "multi_instance": is_true(manifest.get("multi_instance", False)), + "multi_instance": manifest.get("multi_instance", False), "ldap": "?", "sso": "?", "disk": "50M", @@ -2314,12 +2319,12 @@ def _check_manifest_requirements(manifest: Dict, action: str): app_id = manifest["id"] - logger.debug(m18n.n("app_requirements_checking", app=app)) + logger.debug(m18n.n("app_requirements_checking", app=app_id)) # Yunohost version requirement yunohost_requirement = version.parse(manifest["integration"]["yunohost"] or "4.3") - yunohost_installed_version = get_ynh_package_version("yunohost")["version"] + yunohost_installed_version = version.parse(get_ynh_package_version("yunohost")["version"]) if yunohost_requirement > yunohost_installed_version: # FIXME : i18n raise YunohostValidationError(f"This app requires Yunohost >= {yunohost_requirement} but current installed version is {yunohost_installed_version}") @@ -2327,7 +2332,7 @@ def _check_manifest_requirements(manifest: Dict, action: str): # Architectures arch_requirement = manifest["integration"]["architectures"] if arch_requirement != "all": - arch = check_output("dpkg --print-architecture") + arch = system_arch() if arch not in arch_requirement: # FIXME: i18n raise YunohostValidationError(f"This app can only be installed on architectures {', '.join(arch_requirement)} but your server architecture is {arch}") @@ -2343,23 +2348,23 @@ def _check_manifest_requirements(manifest: Dict, action: str): if action == "install": disk_requirement = manifest["integration"]["disk"] - if free_space_in_directory("/") <= human_to_binary[disk_requirement] \ - or free_space_in_directory("/var") <= human_to_binary[disk_requirement]: + if free_space_in_directory("/") <= human_to_binary(disk_requirement) \ + or free_space_in_directory("/var") <= human_to_binary(disk_requirement): # FIXME : i18m - raise YunohostValidationError("This app requires {disk_requirement} free space.") + raise YunohostValidationError(f"This app requires {disk_requirement} free space.") # Ram for build - import psutil ram_build_requirement = manifest["integration"]["ram"]["build"] ram_include_swap = manifest["integration"]["ram"]["include_swap"] - ram_available = psutil.virtual_memory().available + ram, swap = ram_available() if ram_include_swap: - ram_available += psutil.swap_memory().available + ram += swap - if ram_available < human_to_binary(ram_build_requirement): + if ram < human_to_binary(ram_build_requirement): # FIXME : i18n - raise YunohostValidationError("This app requires {ram_build_requirement} RAM available to install/upgrade") + ram_human = binary_to_human(ram) + raise YunohostValidationError(f"This app requires {ram_build_requirement} RAM to install/upgrade but only {ram_human} is available right now.") def _guess_webapp_path_requirement(app_folder: str) -> str: @@ -2499,7 +2504,7 @@ def _make_environment_for_app_script( "YNH_APP_INSTANCE_NUMBER": str(app_instance_nb), "YNH_APP_MANIFEST_VERSION": manifest.get("version", "?"), "YNH_APP_PACKAGING_FORMAT": str(manifest["packaging_format"]), - "YNH_ARCH": check_output("dpkg --print-architecture"), + "YNH_ARCH": system_arch(), } if workdir: @@ -2607,26 +2612,6 @@ def _make_tmp_workdir_for_app(app=None): return tmpdir -def is_true(arg): - """ - Convert a string into a boolean - - Keyword arguments: - arg -- The string to convert - - Returns: - Boolean - - """ - if isinstance(arg, bool): - return arg - elif isinstance(arg, str): - return arg.lower() in ["yes", "true", "on"] - else: - logger.debug("arg should be a boolean or a string, got %r", arg) - return True if arg else False - - def unstable_apps(): output = [] @@ -2703,24 +2688,3 @@ def _assert_system_is_sane_for_app(manifest, when): elif when == "post": raise YunohostError("this_action_broke_dpkg") - - -def human_to_binary(size: str) -> int: - - symbols = ("K", "M", "G", "T", "P", "E", "Z", "Y") - factor = {} - for i, s in enumerate(symbols): - factor[s] = 1 << (i + 1) * 10 - - suffix = size[-1] - size = size[:-1] - - if suffix not in symbols: - raise YunohostError(f"Invalid size suffix '{suffix}', expected one of {symbols}") - - try: - size = float(size) - except Exception: - raise YunohostError(f"Failed to convert size {size} to float") - - return size * factor[suffix] diff --git a/src/yunohost/backup.py b/src/yunohost/backup.py index 78aab0dce..67b5cde05 100644 --- a/src/yunohost/backup.py +++ b/src/yunohost/backup.py @@ -39,9 +39,8 @@ from functools import reduce from packaging import version from moulinette import Moulinette, m18n -from moulinette.utils import filesystem from moulinette.utils.log import getActionLogger -from moulinette.utils.filesystem import read_file, mkdir, write_to_yaml, read_yaml +from moulinette.utils.filesystem import read_file, mkdir, write_to_yaml, read_yaml, rm, chown, chmod from moulinette.utils.process import check_output import yunohost.domain @@ -67,8 +66,12 @@ from yunohost.tools import ( from yunohost.regenconf import regen_conf from yunohost.log import OperationLogger, is_unit_operation from yunohost.utils.error import YunohostError, YunohostValidationError -from yunohost.utils.packages import ynh_packages_version -from yunohost.utils.filesystem import free_space_in_directory +from yunohost.utils.system import ( + free_space_in_directory, + get_ynh_package_version, + binary_to_human, + space_used_by_directory, +) from yunohost.settings import settings_get BACKUP_PATH = "/home/yunohost.backup" @@ -312,7 +315,7 @@ class BackupManager: "size_details": self.size_details, "apps": self.apps_return, "system": self.system_return, - "from_yunohost_version": ynh_packages_version()["yunohost"]["version"], + "from_yunohost_version": get_ynh_package_version("yunohost")["version"], } @property @@ -342,7 +345,7 @@ class BackupManager: # FIXME replace isdir by exists ? manage better the case where the path # exists if not os.path.isdir(self.work_dir): - filesystem.mkdir(self.work_dir, 0o750, parents=True, uid="admin") + mkdir(self.work_dir, 0o750, parents=True, uid="admin") elif self.is_tmp_work_dir: logger.debug( @@ -357,8 +360,8 @@ class BackupManager: # If umount succeeded, remove the directory (we checked that # we're in /home/yunohost.backup/tmp so that should be okay... # c.f. method clean() which also does this) - filesystem.rm(self.work_dir, recursive=True, force=True) - filesystem.mkdir(self.work_dir, 0o750, parents=True, uid="admin") + rm(self.work_dir, recursive=True, force=True) + mkdir(self.work_dir, 0o750, parents=True, uid="admin") # # Backup target management # @@ -535,7 +538,7 @@ class BackupManager: successfull_system = self.targets.list("system", include=["Success", "Warning"]) if not successfull_apps and not successfull_system: - filesystem.rm(self.work_dir, True, True) + rm(self.work_dir, True, True) raise YunohostError("backup_nothings_done") # Add unlisted files from backup tmp dir @@ -647,7 +650,7 @@ class BackupManager: restore_hooks_dir = os.path.join(self.work_dir, "hooks", "restore") if not os.path.exists(restore_hooks_dir): - filesystem.mkdir(restore_hooks_dir, mode=0o700, parents=True, uid="root") + mkdir(restore_hooks_dir, mode=0o700, parents=True, uid="root") restore_hooks = hook_list("restore")["hooks"] @@ -714,7 +717,7 @@ class BackupManager: tmp_workdir_for_app = _make_tmp_workdir_for_app(app=app) try: # Prepare backup directory for the app - filesystem.mkdir(tmp_app_bkp_dir, 0o700, True, uid="root") + mkdir(tmp_app_bkp_dir, 0o700, True, uid="root") # Copy the app settings to be able to call _common.sh shutil.copytree(app_setting_path, settings_dir) @@ -753,7 +756,7 @@ class BackupManager: # Remove tmp files in all situations finally: shutil.rmtree(tmp_workdir_for_app) - filesystem.rm(env_dict["YNH_BACKUP_CSV"], force=True) + rm(env_dict["YNH_BACKUP_CSV"], force=True) # # Actual backup archive creation / method management # @@ -796,7 +799,7 @@ class BackupManager: if row["dest"] == "info.json": continue - size = disk_usage(row["source"]) + size = space_used_by_directory(row["source"], follow_symlinks=False) # Add size to apps details splitted_dest = row["dest"].split("/") @@ -945,7 +948,7 @@ class RestoreManager: ret = subprocess.call(["umount", self.work_dir]) if ret != 0: logger.warning(m18n.n("restore_cleaning_failed")) - filesystem.rm(self.work_dir, recursive=True, force=True) + rm(self.work_dir, recursive=True, force=True) # # Restore target manangement # @@ -975,7 +978,7 @@ class RestoreManager: available_restore_system_hooks = hook_list("restore")["hooks"] custom_restore_hook_folder = os.path.join(CUSTOM_HOOK_FOLDER, "restore") - filesystem.mkdir(custom_restore_hook_folder, 755, parents=True, force=True) + mkdir(custom_restore_hook_folder, 755, parents=True, force=True) for system_part in target_list: # By default, we'll use the restore hooks on the current install @@ -1080,7 +1083,7 @@ class RestoreManager: else: raise YunohostError("restore_removing_tmp_dir_failed") - filesystem.mkdir(self.work_dir, parents=True) + mkdir(self.work_dir, parents=True) self.method.mount() @@ -1398,7 +1401,7 @@ class RestoreManager: # Delete _common.sh file in backup common_file = os.path.join(app_backup_in_archive, "_common.sh") - filesystem.rm(common_file, force=True) + rm(common_file, force=True) # Check if the app has a restore script app_restore_script_in_archive = os.path.join(app_scripts_in_archive, "restore") @@ -1414,14 +1417,14 @@ class RestoreManager: ) app_scripts_new_path = os.path.join(app_settings_new_path, "scripts") shutil.copytree(app_settings_in_archive, app_settings_new_path) - filesystem.chmod(app_settings_new_path, 0o400, 0o400, True) - filesystem.chown(app_scripts_new_path, "root", None, True) + chmod(app_settings_new_path, 0o400, 0o400, True) + chown(app_scripts_new_path, "root", None, True) # Copy the app scripts to a writable temporary folder tmp_workdir_for_app = _make_tmp_workdir_for_app() copytree(app_scripts_in_archive, tmp_workdir_for_app) - filesystem.chmod(tmp_workdir_for_app, 0o700, 0o700, True) - filesystem.chown(tmp_workdir_for_app, "root", None, True) + chmod(tmp_workdir_for_app, 0o700, 0o700, True) + chown(tmp_workdir_for_app, "root", None, True) restore_script = os.path.join(tmp_workdir_for_app, "restore") # Restore permissions @@ -1724,7 +1727,7 @@ class BackupMethod(object): raise YunohostError("backup_cleaning_failed") if self.manager.is_tmp_work_dir: - filesystem.rm(self.work_dir, True, True) + rm(self.work_dir, True, True) def _check_is_enough_free_space(self): """ @@ -1772,11 +1775,11 @@ class BackupMethod(object): # Be sure the parent dir of destination exists if not os.path.isdir(dest_dir): - filesystem.mkdir(dest_dir, parents=True) + mkdir(dest_dir, parents=True) # For directory, attempt to mount bind if os.path.isdir(src): - filesystem.mkdir(dest, parents=True, force=True) + mkdir(dest, parents=True, force=True) try: subprocess.check_call(["mount", "--rbind", src, dest]) @@ -1830,7 +1833,7 @@ class BackupMethod(object): # to mounting error # Compute size to copy - size = sum(disk_usage(path["source"]) for path in paths_needed_to_be_copied) + size = sum(space_used_by_directory(path["source"], follow_symlinks=False) for path in paths_needed_to_be_copied) size /= 1024 * 1024 # Convert bytes to megabytes # Ask confirmation for copying @@ -1882,7 +1885,7 @@ class CopyBackupMethod(BackupMethod): dest_parent = os.path.dirname(dest) if not os.path.exists(dest_parent): - filesystem.mkdir(dest_parent, 0o700, True, uid="admin") + mkdir(dest_parent, 0o700, True, uid="admin") if os.path.isdir(source): shutil.copytree(source, dest) @@ -1900,7 +1903,7 @@ class CopyBackupMethod(BackupMethod): if not os.path.isdir(self.repo): raise YunohostError("backup_no_uncompress_archive_dir") - filesystem.mkdir(self.work_dir, parent=True) + mkdir(self.work_dir, parent=True) ret = subprocess.call(["mount", "-r", "--rbind", self.repo, self.work_dir]) if ret == 0: return @@ -1944,7 +1947,7 @@ class TarBackupMethod(BackupMethod): """ if not os.path.exists(self.repo): - filesystem.mkdir(self.repo, 0o750, parents=True, uid="admin") + mkdir(self.repo, 0o750, parents=True, uid="admin") # Check free space in output self._check_is_enough_free_space() @@ -2667,32 +2670,3 @@ def _recursive_umount(directory): continue return everything_went_fine - - -def disk_usage(path): - # We don't do this in python with os.stat because we don't want - # to follow symlinks - - du_output = check_output(["du", "-sb", path], shell=False) - return int(du_output.split()[0]) - - -def binary_to_human(n, customary=False): - """ - Convert bytes or bits into human readable format with binary prefix - Keyword argument: - n -- Number to convert - customary -- Use customary symbol instead of IEC standard - """ - symbols = ("Ki", "Mi", "Gi", "Ti", "Pi", "Ei", "Zi", "Yi") - if customary: - symbols = ("K", "M", "G", "T", "P", "E", "Z", "Y") - prefix = {} - for i, s in enumerate(symbols): - prefix[s] = 1 << (i + 1) * 10 - for s in reversed(symbols): - if n >= prefix[s]: - value = float(n) / prefix[s] - return "%.1f%s" % (value, s) - return "%s" % n - diff --git a/src/yunohost/data_migrations/0015_migrate_to_buster.py b/src/yunohost/data_migrations/0015_migrate_to_buster.py index 4f2d4caf8..e71ee1d3a 100644 --- a/src/yunohost/data_migrations/0015_migrate_to_buster.py +++ b/src/yunohost/data_migrations/0015_migrate_to_buster.py @@ -10,8 +10,8 @@ from moulinette.utils.filesystem import read_file from yunohost.tools import Migration, tools_update, tools_upgrade from yunohost.app import unstable_apps from yunohost.regenconf import manually_modified_files -from yunohost.utils.filesystem import free_space_in_directory -from yunohost.utils.packages import ( +from yunohost.utils.system import ( + free_space_in_directory, get_ynh_package_version, _list_upgradable_apt_packages, ) diff --git a/src/yunohost/data_migrations/0017_postgresql_9p6_to_11.py b/src/yunohost/data_migrations/0017_postgresql_9p6_to_11.py index 1ccf5ccc9..67df8d771 100644 --- a/src/yunohost/data_migrations/0017_postgresql_9p6_to_11.py +++ b/src/yunohost/data_migrations/0017_postgresql_9p6_to_11.py @@ -5,7 +5,7 @@ from yunohost.utils.error import YunohostError, YunohostValidationError from moulinette.utils.log import getActionLogger from yunohost.tools import Migration -from yunohost.utils.filesystem import free_space_in_directory, space_used_by_directory +from yunohost.utils.system import free_space_in_directory, space_used_by_directory logger = getActionLogger("yunohost.migration") diff --git a/src/yunohost/log.py b/src/yunohost/log.py index d73a62cd0..4b064fb9c 100644 --- a/src/yunohost/log.py +++ b/src/yunohost/log.py @@ -38,7 +38,7 @@ from io import IOBase from moulinette import m18n, Moulinette from moulinette.core import MoulinetteError from yunohost.utils.error import YunohostError, YunohostValidationError -from yunohost.utils.packages import get_ynh_package_version +from yunohost.utils.system import get_ynh_package_version from moulinette.utils.log import getActionLogger from moulinette.utils.filesystem import read_file, read_yaml diff --git a/src/yunohost/tools.py b/src/yunohost/tools.py index fb9839814..4e0ae660d 100644 --- a/src/yunohost/tools.py +++ b/src/yunohost/tools.py @@ -48,10 +48,12 @@ from yunohost.domain import domain_add from yunohost.firewall import firewall_upnp from yunohost.service import service_start, service_enable from yunohost.regenconf import regen_conf -from yunohost.utils.packages import ( +from yunohost.utils.system import ( _dump_sources_list, _list_upgradable_apt_packages, ynh_packages_version, + dpkg_is_broken, + dpkg_lock_available, ) from yunohost.utils.error import YunohostError, YunohostValidationError from yunohost.log import is_unit_operation, OperationLogger @@ -171,20 +173,6 @@ def _set_hostname(hostname, pretty_hostname=None): logger.debug(out) -def _detect_virt(): - """ - Returns the output of systemd-detect-virt (so e.g. 'none' or 'lxc' or ...) - You can check the man of the command to have a list of possible outputs... - """ - - p = subprocess.Popen( - "systemd-detect-virt".split(), stdout=subprocess.PIPE, stderr=subprocess.STDOUT - ) - - out, _ = p.communicate() - return out.split()[0] - - @is_unit_operation() def tools_postinstall( operation_logger, @@ -463,13 +451,12 @@ def tools_upgrade( apps -- List of apps to upgrade (or [] to update all apps) system -- True to upgrade system """ - from yunohost.utils import packages - if packages.dpkg_is_broken(): + if dpkg_is_broken(): raise YunohostValidationError("dpkg_is_broken") # Check for obvious conflict with other dpkg/apt commands already running in parallel - if not packages.dpkg_lock_available(): + if not dpkg_lock_available(): raise YunohostValidationError("dpkg_lock_not_available") # Legacy options management (--system, --apps) diff --git a/src/yunohost/user.py b/src/yunohost/user.py index c9f70e152..348aa7c4f 100644 --- a/src/yunohost/user.py +++ b/src/yunohost/user.py @@ -40,6 +40,7 @@ from moulinette.utils.process import check_output from yunohost.utils.error import YunohostError, YunohostValidationError from yunohost.service import service_status from yunohost.log import is_unit_operation +from yunohost.utils.system import binary_to_human logger = getActionLogger("yunohost.user") @@ -597,7 +598,7 @@ def user_info(username): if has_value: storage_use = int(has_value.group(1)) - storage_use = _convertSize(storage_use) + storage_use = binary_to_human(storage_use) if is_limited: has_percent = re.search(r"%=(\d+)", cmd_result) @@ -1330,15 +1331,6 @@ def user_ssh_remove_key(username, key): # End SSH subcategory # - -def _convertSize(num, suffix=""): - for unit in ["K", "M", "G", "T", "P", "E", "Z"]: - if abs(num) < 1024.0: - return "%3.1f%s%s" % (num, unit, suffix) - num /= 1024.0 - return "%.1f%s%s" % (num, "Yi", suffix) - - def _hash_user_password(password): """ This function computes and return a salted hash for the password in input. diff --git a/src/yunohost/utils/filesystem.py b/src/yunohost/utils/filesystem.py deleted file mode 100644 index 04d7d3906..000000000 --- a/src/yunohost/utils/filesystem.py +++ /dev/null @@ -1,31 +0,0 @@ -# -*- coding: utf-8 -*- - -""" License - - Copyright (C) 2018 YUNOHOST.ORG - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU Affero General Public License as published - by the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU Affero General Public License for more details. - - You should have received a copy of the GNU Affero General Public License - along with this program; if not, see http://www.gnu.org/licenses - -""" -import os - - -def free_space_in_directory(dirpath): - stat = os.statvfs(dirpath) - return stat.f_frsize * stat.f_bavail - - -def space_used_by_directory(dirpath): - stat = os.statvfs(dirpath) - return stat.f_frsize * stat.f_blocks diff --git a/src/yunohost/utils/packages.py b/src/yunohost/utils/system.py similarity index 67% rename from src/yunohost/utils/packages.py rename to src/yunohost/utils/system.py index 3105bc4c7..f7d37cf1c 100644 --- a/src/yunohost/utils/packages.py +++ b/src/yunohost/utils/system.py @@ -23,13 +23,85 @@ import os import logging from moulinette.utils.process import check_output -from packaging import version +from yunohost.utils.error import YunohostError logger = logging.getLogger("yunohost.utils.packages") YUNOHOST_PACKAGES = ["yunohost", "yunohost-admin", "moulinette", "ssowat"] +def system_arch(): + return check_output("dpkg --print-architecture") + + +def system_virt(): + """ + Returns the output of systemd-detect-virt (so e.g. 'none' or 'lxc' or ...) + You can check the man of the command to have a list of possible outputs... + """ + # Detect virt technology (if not bare metal) and arch + # Gotta have this "|| true" because it systemd-detect-virt return 'none' + # with an error code on bare metal ~.~ + return check_output("systemd-detect-virt || true") + + +def free_space_in_directory(dirpath): + stat = os.statvfs(dirpath) + return stat.f_frsize * stat.f_bavail + + +def space_used_by_directory(dirpath, follow_symlinks=True): + + if not follow_symlinks: + du_output = check_output(["du", "-sb", dirpath], shell=False) + return int(du_output.split()[0]) + + stat = os.statvfs(dirpath) + return stat.f_frsize * stat.f_blocks + + +def human_to_binary(size: str) -> int: + + symbols = ("K", "M", "G", "T", "P", "E", "Z", "Y") + factor = {} + for i, s in enumerate(symbols): + factor[s] = 1 << (i + 1) * 10 + + suffix = size[-1] + size = size[:-1] + + if suffix not in symbols: + raise YunohostError(f"Invalid size suffix '{suffix}', expected one of {symbols}") + + try: + size = float(size) + except Exception: + raise YunohostError(f"Failed to convert size {size} to float") + + return size * factor[suffix] + + +def binary_to_human(n: int) -> str: + """ + Convert bytes or bits into human readable format with binary prefix + """ + symbols = ("K", "M", "G", "T", "P", "E", "Z", "Y") + prefix = {} + for i, s in enumerate(symbols): + prefix[s] = 1 << (i + 1) * 10 + for s in reversed(symbols): + if n >= prefix[s]: + value = float(n) / prefix[s] + return "%.1f%s" % (value, s) + return "%s" % n + + +def ram_available(): + + import psutil + return (psutil.virtual_memory().available, psutil.swap_memory().free) + + def get_ynh_package_version(package): # Returns the installed version and release version ('stable' or 'testing' @@ -48,43 +120,6 @@ def get_ynh_package_version(package): return {"version": out[1].strip("()"), "repo": out[2].strip(";")} -def meets_version_specifier(pkg_name, specifier): - """ - Check if a package installed version meets specifier - - specifier is something like ">> 1.2.3" - """ - - # In practice, this function is only used to check the yunohost version - # installed. - # We'll trim any ~foobar in the current installed version because it's not - # handled correctly by version.parse, but we don't care so much in that - # context - assert pkg_name in YUNOHOST_PACKAGES - pkg_version = get_ynh_package_version(pkg_name)["version"] - pkg_version = re.split(r"\~|\+|\-", pkg_version)[0] - pkg_version = version.parse(pkg_version) - - # Extract operator and version specifier - op, req_version = re.search(r"(<<|<=|=|>=|>>) *([\d\.]+)", specifier).groups() - req_version = version.parse(req_version) - - # Python2 had a builtin that returns (-1, 0, 1) depending on comparison - # c.f. https://stackoverflow.com/a/22490617 - def cmp(a, b): - return (a > b) - (a < b) - - deb_operators = { - "<<": lambda v1, v2: cmp(v1, v2) in [-1], - "<=": lambda v1, v2: cmp(v1, v2) in [-1, 0], - "=": lambda v1, v2: cmp(v1, v2) in [0], - ">=": lambda v1, v2: cmp(v1, v2) in [0, 1], - ">>": lambda v1, v2: cmp(v1, v2) in [1], - } - - return deb_operators[op](pkg_version, req_version) - - def ynh_packages_version(*args, **kwargs): # from cli the received arguments are: # (Namespace(_callbacks=deque([]), _tid='_global', _to_return={}), []) {} From 744729713d469f3ef94a9a40e9aa5013097f3c84 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Wed, 3 Nov 2021 22:06:32 +0100 Subject: [PATCH 012/174] Add notes for app resources logic --- src/yunohost/utils/resources.py | 129 +++++++++++++++++++++++++++++++- 1 file changed, 126 insertions(+), 3 deletions(-) diff --git a/src/yunohost/utils/resources.py b/src/yunohost/utils/resources.py index 424e38f91..64ec67b8c 100644 --- a/src/yunohost/utils/resources.py +++ b/src/yunohost/utils/resources.py @@ -59,6 +59,21 @@ class AppResourceSet: class AptDependenciesAppResource(AppResource): + """ + is_provisioned -> package __APP__-ynh-deps exists (ideally should check the Depends: but hmgn) + is_available -> True? idk + + update -> update deps on __APP__-ynh-deps + provision -> create/update deps on __APP__-ynh-deps + + deprovision -> remove __APP__-ynh-deps (+autoremove?) + + deep_clean -> remove any __APP__-ynh-deps for app not in app list + + backup -> nothing + restore = provision + """ + type = "apt" default_properties = { @@ -71,7 +86,23 @@ class AptDependenciesAppResource(AppResource): # call helpers idk ... pass + class SourcesAppResource(AppResource): + """ + is_provisioned -> (if pre_download,) cache exists with appropriate checksum + is_available -> curl HEAD returns 200 + + update -> none? + provision -> full download + check checksum + + deprovision -> remove cache for __APP__ ? + + deep_clean -> remove all cache + + backup -> nothing + restore -> nothing + """ + type = "sources" default_properties = { @@ -85,6 +116,21 @@ class SourcesAppResource(AppResource): class RoutesAppResource(AppResource): + """ + is_provisioned -> main perm exists + is_available -> perm urls do not conflict + + update -> refresh/update values for url/additional_urls/show_tile/auth/protected/... create new perms / delete any perm not listed + provision -> same as update? + + deprovision -> delete permissions + + deep_clean -> delete permissions for any __APP__.foobar where app not in app list... + + backup -> handled elsewhere by the core, should be integrated in there (dump .ldif/yml?) + restore -> handled by the core, should be integrated in there (restore .ldif/yml?) + """ + type = "routes" default_properties = { @@ -136,10 +182,26 @@ class RoutesAppResource(AppResource): class PortAppResource(AppResource): + """ + is_provisioned -> port setting exists and is not the port used by another app (ie not in another app setting) + is_available -> true + + update -> true + provision -> find a port not used by any app + + deprovision -> delete the port setting + + deep_clean -> ? + + backup -> nothing (backup port setting) + restore -> nothing (restore port setting) + """ + type = "port" default_properties = { - "value": 1000 + "value": 1000, + "type": "internal", } def _port_is_used(self, port): @@ -167,11 +229,26 @@ class PortAppResource(AppResource): class SystemuserAppResource(AppResource): + """ + is_provisioned -> user __APP__ exists + is_available -> user and group __APP__ doesn't exists + + update -> update values for home / shell / groups + provision -> create user + + deprovision -> delete user + + deep_clean -> uuuuh ? delete any user that could correspond to an app x_x ? + + backup -> nothing + restore -> provision + """ + type = "system_user" default_properties = { "username": "__APP__", - "home_dir": "/var/www/__APP__", + "home_dir": "__INSTALL_DIR__", "use_shell": False, "groups": [] } @@ -190,11 +267,27 @@ class SystemuserAppResource(AppResource): class InstalldirAppResource(AppResource): + """ + is_provisioned -> setting install_dir exists + /dir/ exists + is_available -> /dir/ doesn't exists + + provision -> create setting + create dir + update -> update perms ? + + deprovision -> delete dir + delete setting + + deep_clean -> uuuuh ? delete any dir in /var/www/ that would not correspond to an app x_x ? + + backup -> cp install dir + restore -> cp install dir + """ + type = "install_dir" default_properties = { "dir": "/var/www/__APP__", # FIXME or choose to move this elsewhere nowadays idk... - "alias": "final_path" + "alias": "final_path", + # FIXME : add something about perms ? } # FIXME: change default dir to /opt/stuff if app ain't a webapp ... @@ -219,6 +312,21 @@ class InstalldirAppResource(AppResource): class DatadirAppResource(AppResource): + """ + is_provisioned -> setting data_dir exists + /dir/ exists + is_available -> /dir/ doesn't exists + + provision -> create setting + create dir + update -> update perms ? + + deprovision -> (only if purge enabled...) delete dir + delete setting + + deep_clean -> zblerg idk nothing + + backup -> cp data dir ? (if not backup_core_only) + restore -> cp data dir ? (if in backup) + """ + type = "data_dir" default_properties = { @@ -239,6 +347,21 @@ class DatadirAppResource(AppResource): class DBAppResource(AppResource): + """ + is_provisioned -> setting db_user, db_name, db_pwd exists + is_available -> db doesn't already exists ( ... also gotta make sure that mysql / postgresql is indeed installed ... or will be after apt provisions it) + + provision -> setup the db + init the setting + update -> ?? + + deprovision -> delete the db + + deep_clean -> ... idk look into any db name that would not be related to any app ... + + backup -> dump db + restore -> setup + inject db dump + """ + type = "db" default_properties = { From 7206be00201799bd04af052a0dc0a6c94a7616fd Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sat, 13 Nov 2021 17:09:30 +0100 Subject: [PATCH 013/174] Tmp work on provision/deprovision apt and system user --- src/yunohost/app.py | 107 ++++--- src/yunohost/utils/resources.py | 542 ++++++++++++++++++++------------ 2 files changed, 398 insertions(+), 251 deletions(-) diff --git a/src/yunohost/app.py b/src/yunohost/app.py index e251b99de..409e94d2d 100644 --- a/src/yunohost/app.py +++ b/src/yunohost/app.py @@ -735,6 +735,37 @@ def app_manifest(app): return manifest +def _confirm_app_install(app, force=False): + + # Ignore if there's nothing for confirm (good quality app), if --force is used + # or if request on the API (confirm already implemented on the API side) + if force or Moulinette.interface.type == "api": + return + + quality = _app_quality(app) + if quality == "success": + return + + # i18n: confirm_app_install_warning + # i18n: confirm_app_install_danger + # i18n: confirm_app_install_thirdparty + + if quality in ["danger", "thirdparty"]: + answer = Moulinette.prompt( + m18n.n("confirm_app_install_" + quality, answers="Yes, I understand"), + color="red", + ) + if answer != "Yes, I understand": + raise YunohostError("aborting") + + else: + answer = Moulinette.prompt( + m18n.n("confirm_app_install_" + quality, answers="Y/N"), color="yellow" + ) + if answer.upper() != "Y": + raise YunohostError("aborting") + + @is_unit_operation() def app_install( operation_logger, @@ -776,37 +807,7 @@ def app_install( if free_space_in_directory("/") <= 512 * 1000 * 1000: raise YunohostValidationError("disk_space_not_sufficient_install") - def confirm_install(app): - - # Ignore if there's nothing for confirm (good quality app), if --force is used - # or if request on the API (confirm already implemented on the API side) - if force or Moulinette.interface.type == "api": - return - - quality = _app_quality(app) - if quality == "success": - return - - # i18n: confirm_app_install_warning - # i18n: confirm_app_install_danger - # i18n: confirm_app_install_thirdparty - - if quality in ["danger", "thirdparty"]: - answer = Moulinette.prompt( - m18n.n("confirm_app_install_" + quality, answers="Yes, I understand"), - color="red", - ) - if answer != "Yes, I understand": - raise YunohostError("aborting") - - else: - answer = Moulinette.prompt( - m18n.n("confirm_app_install_" + quality, answers="Y/N"), color="yellow" - ) - if answer.upper() != "Y": - raise YunohostError("aborting") - - confirm_install(app) + _confirm_app_install(app) manifest, extracted_app_folder = _extract_app(app) packaging_format = manifest["packaging_format"] @@ -815,7 +816,6 @@ def app_install( raise YunohostValidationError("app_id_invalid") app_id = manifest["id"] - label = label if label else manifest["name"] # Check requirements _check_manifest_requirements(manifest, action="install") @@ -829,6 +829,8 @@ def app_install( else: app_instance_name = app_id + app_setting_path = os.path.join(APPS_SETTING_PATH, app_instance_name) + # Retrieve arguments list for install script raw_questions = manifest["install"] questions = ask_questions_and_parse_answers(raw_questions, prefilled_answers=args) @@ -861,7 +863,6 @@ def app_install( logger.info(m18n.n("app_start_install", app=app_id)) # Create app directory - app_setting_path = os.path.join(APPS_SETTING_PATH, app_instance_name) if os.path.exists(app_setting_path): shutil.rmtree(app_setting_path) os.makedirs(app_setting_path) @@ -894,23 +895,31 @@ def app_install( recursive=True, ) + # Initialize the main permission for the app + # The permission is initialized with no url associated, and with tile disabled + # For web app, the root path of the app will be added as url and the tile + # will be enabled during the app install. C.f. 'app_register_url()' below. + if packaging_format >= 2: + init_main_perm_allowed = ["visitors"] if not args.get("is_public") else ["all_users"] + else: + init_main_perm_allowed = ["all_users"] - resources = AppResourceSet(manifest["resources"], app_instance_name) - resources.check_availability() - resources.provision() + permission_create( + app_instance_name + ".main", + allowed=init_main_perm_allowed, + label=label if label else manifest["name"], + show_tile=False, + protected=False, + ) - if packaging_format < 2: - # Initialize the main permission for the app - # The permission is initialized with no url associated, and with tile disabled - # For web app, the root path of the app will be added as url and the tile - # will be enabled during the app install. C.f. 'app_register_url()' below. - permission_create( - app_instance_name + ".main", - allowed=["all_users"], - label=label, - show_tile=False, - protected=False, - ) + if packaging_format >= 2: + try: + from yunohost.utils.resources import AppResourceManager + resources = AppResourceManager(app_instance_name, current=app_setting_path, wanted=extracted_app_folder) + resources.apply() + except: + raise + # FIXME : error handling # Prepare env. var. to pass to script env_dict = _make_environment_for_app_script( @@ -2519,7 +2528,7 @@ def _make_environment_for_app_script( # If packaging format v2, load all settings if manifest["packaging_format"] >= 2: env_dict["app"] = app - for setting_name, setting_value in _get_app_settings(app): + for setting_name, setting_value in _get_app_settings(app).items(): # Ignore special internal settings like checksum__ # (not a huge deal to load them but idk...) diff --git a/src/yunohost/utils/resources.py b/src/yunohost/utils/resources.py index 64ec67b8c..c9969f01b 100644 --- a/src/yunohost/utils/resources.py +++ b/src/yunohost/utils/resources.py @@ -22,14 +22,47 @@ import os import copy from typing import Dict, Any +from moulinette.utils.log import getActionLogger +from moulinette.utils.filesystem import mkdir, chown, chmod, write_to_file + from yunohost.utils.error import YunohostError, YunohostValidationError +from yunohost.hook import hook_exec + +logger = getActionLogger("yunohost.app_resources") + + +class AppResourceManager(object): + + def __init__(self, app: str, manifest: str): + + self.app = app + self.resources = {name: AppResourceClassesByType[name](infos, app) + for name, infos in resources_dict.items()} + + def apply(self): + + + + + + + def validate_resource_availability(self): + + for name, resource in self.resources.items(): + resource.validate_availability(context={}) + + def provision_or_update_resources(self): + + for name, resource in self.resources.items(): + logger.info("Running provision_or_upgrade for {self.type}") + resource.provision_or_update(context={}) class AppResource(object): - def __init__(self, properties: Dict[str, Any], app_id: str): + def __init__(self, properties: Dict[str, Any], app: str): - self.app_id = app_id + self.app = app for key, value in self.default_properties.items(): setattr(self, key, value) @@ -37,85 +70,48 @@ class AppResource(object): for key, value in properties.items(): setattr(self, key, value) - def get_app_settings(self): - from yunohost.app import _get_app_settings - return _get_app_settings(self.app_id) + def get_setting(self, key): + from yunohost.app import app_setting + return app_setting(self.app, key) - def check_availability(self, context: Dict): + def set_setting(self, key, value): + from yunohost.app import app_setting + app_setting(self.app, key, value=value) + + def delete_setting(self, key, value): + from yunohost.app import app_setting + app_setting(self.app, key, delete=True) + + def validate_availability(self, context: Dict): pass + def _run_script(self, action, script, env={}, user="root"): -class AppResourceSet: + from yunohost.app import _make_tmp_workdir_for_app, _make_environment_for_app_script - def __init__(self, resources_dict: Dict[str, Dict[str, Any]], app_id: str): + tmpdir = _make_tmp_workdir_for_app(app=self.app) - self.set = {name: AppResourceClassesByType[name](infos, app_id) - for name, infos in resources_dict.items()} + env_ = _make_environment_for_app_script(self.app, workdir=tmpdir, action=f"{action}_{self.type}") + env_.update(env) - def check_availability(self): + script_path = f"{tmpdir}/{action}_{self.type}" + script = f""" +source /usr/share/yunohost/helpers +ynh_abort_if_errors - for name, resource in self.set.items(): - resource.check_availability(context={}) +{script} +""" + + write_to_file(script_path, script) + + print(env_) + + # FIXME : use the hook_exec_with_debug_instructions_stuff + ret, _ = hook_exec(script_path, env=env_) + print(ret) -class AptDependenciesAppResource(AppResource): - """ - is_provisioned -> package __APP__-ynh-deps exists (ideally should check the Depends: but hmgn) - is_available -> True? idk - - update -> update deps on __APP__-ynh-deps - provision -> create/update deps on __APP__-ynh-deps - - deprovision -> remove __APP__-ynh-deps (+autoremove?) - - deep_clean -> remove any __APP__-ynh-deps for app not in app list - - backup -> nothing - restore = provision - """ - - type = "apt" - - default_properties = { - "packages": [], - "extras": {} - } - - def check_availability(self, context): - # ? FIXME - # call helpers idk ... - pass - - -class SourcesAppResource(AppResource): - """ - is_provisioned -> (if pre_download,) cache exists with appropriate checksum - is_available -> curl HEAD returns 200 - - update -> none? - provision -> full download + check checksum - - deprovision -> remove cache for __APP__ ? - - deep_clean -> remove all cache - - backup -> nothing - restore -> nothing - """ - - type = "sources" - - default_properties = { - "main": {"url": "?", "sha256sum": "?", "predownload": True} - } - - def check_availability(self, context): - # ? FIXME - # call request.head on the url idk - pass - - -class RoutesAppResource(AppResource): +class WebpathResource(AppResource): """ is_provisioned -> main perm exists is_available -> perm urls do not conflict @@ -131,101 +127,30 @@ class RoutesAppResource(AppResource): restore -> handled by the core, should be integrated in there (restore .ldif/yml?) """ - type = "routes" + type = "webpath" + priority = 10 default_properties = { "full_domain": False, - "main": { - "url": "/", - "additional_urls": [], - "init_allowed": "__FIXME__", - "show_tile": True, - "protected": False, - "auth_header": True, - "label": "FIXME", - } } - def check_availability(self, context): + def validate_availability(self, context): from yunohost.app import _assert_no_conflicting_apps - app_settings = self.get_app_settings() - domain = app_settings["domain"] - path = app_settings["path"] if not self.full_domain else "/" - _assert_no_conflicting_apps(domain, path, ignore_app=self.app_id) + domain = self.get_setting("domain") + path = self.get_setting("path") if not self.full_domain else "/" + _assert_no_conflicting_apps(domain, path, ignore_app=self.app) def provision_or_update(self, context: Dict): - if context["app_action"] == "install": - pass # FIXME - # Initially, the .main permission is created with no url at all associated - # When the app register/books its web url, we also add the url '/' - # (meaning the root of the app, domain.tld/path/) - # and enable the tile to the SSO, and both of this should match 95% of apps - # For more specific cases, the app is free to change / add urls or disable - # the tile using the permission helpers. - #permission_create( - # self.app_id + ".main", - # allowed=["all_users"], - # label=label, - # show_tile=False, - # protected=False, - #) - #permission_url(app + ".main", url="/", sync_perm=False) - #user_permission_update(app + ".main", show_tile=True, sync_perm=False) - #permission_sync_to_user() + # Nothing to do ? Just setting the domain/path during install + # already provisions it ... + return # FIXME def deprovision(self, context: Dict): - del context["app_settings"]["domain"] - del context["app_settings"]["path"] - - -class PortAppResource(AppResource): - """ - is_provisioned -> port setting exists and is not the port used by another app (ie not in another app setting) - is_available -> true - - update -> true - provision -> find a port not used by any app - - deprovision -> delete the port setting - - deep_clean -> ? - - backup -> nothing (backup port setting) - restore -> nothing (restore port setting) - """ - - type = "port" - - default_properties = { - "value": 1000, - "type": "internal", - } - - def _port_is_used(self, port): - - # FIXME : this could be less brutal than two os.system ... - cmd1 = "ss --numeric --listening --tcp --udp | awk '{print$5}' | grep --quiet --extended-regexp ':%s$'" % port - # This second command is mean to cover (most) case where an app is using a port yet ain't currently using it for some reason (typically service ain't up) - cmd2 = f"grep -q \"port: '{port}'\" /etc/yunohost/apps/*/settings.yml" - return os.system(cmd1) == 0 and os.system(cmd2) == 0 - - def provision_or_update(self, context: str): - - # Don't do anything if port already defined ? - if context["app_settings"].get("port"): - return - - port = self.value - while self._port_is_used(port): - port += 1 - - context["app_settings"]["port"] = port - - def deprovision(self, context: Dict): - raise NotImplementedError() + self.delete_setting("domain") + self.delete_setting("path") class SystemuserAppResource(AppResource): @@ -233,8 +158,8 @@ class SystemuserAppResource(AppResource): is_provisioned -> user __APP__ exists is_available -> user and group __APP__ doesn't exists - update -> update values for home / shell / groups provision -> create user + update -> update values for home / shell / groups deprovision -> delete user @@ -245,26 +170,69 @@ class SystemuserAppResource(AppResource): """ type = "system_user" + priority = 20 default_properties = { - "username": "__APP__", - "home_dir": "__INSTALL_DIR__", - "use_shell": False, - "groups": [] + "allow_ssh": [] + "allow_sftp": [] } - def check_availability(self, context): - if os.system(f"getent passwd {self.username} &>/dev/null") != 0: - raise YunohostValidationError(f"User {self.username} already exists") - if os.system(f"getent group {self.username} &>/dev/null") != 0: - raise YunohostValidationError(f"Group {self.username} already exists") + def validate_availability(self, context): + pass + # FIXME : do we care if user already exists ? shouldnt we assume that user $app corresponds to the app ...? + + # FIXME : but maybe we should at least check that no corresponding yunohost user exists + + #if os.system(f"getent passwd {self.username} &>/dev/null") != 0: + # raise YunohostValidationError(f"User {self.username} already exists") + #if os.system(f"getent group {self.username} &>/dev/null") != 0: + # raise YunohostValidationError(f"Group {self.username} already exists") + + def provision_or_update(self, context: Dict): + + if os.system(f"getent passwd {self.app} &>/dev/null") != 0: + cmd = f"useradd --system --user-group {self.app}" + os.system(cmd) + + if os.system(f"getent passwd {self.app} &>/dev/null") == 0: + raise YunohostError(f"Failed to create system user for {self.app}") + + groups = [] + if self.allow_ssh: + groups.append("ssh.app") + if self.allow_sftp: + groups.append("sftp.app") + groups = + + cmd = f"usermod -a -G {groups} {self.app}" + # FIXME : handle case where group gets removed + os.system(cmd) + +# useradd $user_home_dir --system --user-group $username $shell || ynh_die --message="Unable to create $username system account" +# for group in $groups; do +# usermod -a -G "$group" "$username" +# done + + +# | arg: -g, --groups - Add the user to system groups. Typically meant to add the user to the ssh.app / sftp.app group (e.g. for borgserver, my_webapp) - def provision_or_update(self, context: str): - raise NotImplementedError() def deprovision(self, context: Dict): - raise NotImplementedError() + self._run_script("deprovision", + f'ynh_system_user_delete "{self.username}"') + +# # Check if the user exists on the system +#if os.system(f"getent passwd {self.username} &>/dev/null") != 0: +# if ynh_system_user_exists "$username"; then +# deluser $username +# fi +# # Check if the group exists on the system +#if os.system(f"getent group {self.username} &>/dev/null") != 0: +# if ynh_system_group_exists "$username"; then +# delgroup $username +# fi +# class InstalldirAppResource(AppResource): """ @@ -283,32 +251,54 @@ class InstalldirAppResource(AppResource): """ type = "install_dir" + priority = 30 default_properties = { "dir": "/var/www/__APP__", # FIXME or choose to move this elsewhere nowadays idk... - "alias": "final_path", - # FIXME : add something about perms ? + "alias": None, + "owner": "__APP__:rx", + "group": "__APP__:rx", } # FIXME: change default dir to /opt/stuff if app ain't a webapp ... + # FIXME: what do in a scenario where the location changed - def check_availability(self, context): - if os.path.exists(self.dir): - raise YunohostValidationError(f"Folder {self.dir} already exists") + def validate_availability(self, context): + pass def provision_or_update(self, context: Dict): - if context["app_action"] in ["install", "restore"]: - if os.path.exists(self.dir): - raise YunohostValidationError(f"Path {self.dir} already exists") + current_install_dir = self.get_setting("install_dir") - if "installdir" not in context["app_settings"]: - context["app_settings"]["installdir"] = self.dir - context["app_settings"][self.alias] = context["app_settings"]["installdir"] + # If during install, /var/www/$app already exists, assume that it's okay to remove and recreate it + # FIXME : is this the right thing to do ? + if not current_install_dir and os.path.isdir(self.dir): + rm(self.dir, recursive=True) + + if not os.path.isdir(self.dir): + # Handle case where install location changed, in which case we shall move the existing install dir + if current_install_dir and os.path.isdir(current_install_dir): + shutil.move(current_install_dir, self.dir) + else: + mkdir(self.dir) + + owner, owner_perm = self.owner.split(":") + group, group_perm = self.group.split(":") + owner_perm_octal = (4 if "r" in owner_perm else 0) + (2 if "w" in owner_perm else 0) + (1 if "x" in owner_perm else 0) + group_perm_octal = (4 if "r" in group_perm else 0) + (2 if "w" in group_perm else 0) + (1 if "x" in group_perm else 0) + perm_octal = str(owner_perm_octal) + str(group_perm_octal) + "0" + + chmod(self.dir, oct(int(perm_octal))) + chown(self.dir, owner, group) + + self.set_setting("install_dir", self.dir) + if self.alias: + self.set_setting(self.alias, self.dir) def deprovision(self, context: Dict): - # FIXME: should it rm the directory during remove/deprovision ? - pass + # FIXME : check that self.dir has a sensible value to prevent catastrophes + if os.path.isdir(self.dir): + rm(self.dir, recursive=True) class DatadirAppResource(AppResource): @@ -328,56 +318,204 @@ class DatadirAppResource(AppResource): """ type = "data_dir" + priority = 40 default_properties = { "dir": "/home/yunohost.app/__APP__", # FIXME or choose to move this elsewhere nowadays idk... + "owner": "__APP__:rx", + "group": "__APP__:rx", } - def check_availability(self, context): - if os.path.exists(self.dir): - raise YunohostValidationError(f"Folder {self.dir} already exists") + def validate_availability(self, context): + pass + # Nothing to do ? If datadir already exists then it may be legit data + # from a previous install def provision_or_update(self, context: Dict): - if "datadir" not in context["app_settings"]: - context["app_settings"]["datadir"] = self.dir + + current_data_dir = self.get_setting("data_dir") + + if not os.path.isdir(self.dir): + # Handle case where install location changed, in which case we shall move the existing install dir + if current_data_dir and os.path.isdir(current_data_dir): + shutil.move(current_data_dir, self.dir) + else: + mkdir(self.dir) + + owner, owner_perm = self.owner.split(":") + group, group_perm = self.group.split(":") + owner_perm_octal = (4 if "r" in owner_perm else 0) + (2 if "w" in owner_perm else 0) + (1 if "x" in owner_perm else 0) + group_perm_octal = (4 if "r" in group_perm else 0) + (2 if "w" in group_perm else 0) + (1 if "x" in group_perm else 0) + perm_octal = str(owner_perm_octal) + str(group_perm_octal) + "0" + + chmod(self.dir, oct(int(perm_octal))) + chown(self.dir, owner, group) + + self.set_setting("data_dir", self.dir) def deprovision(self, context: Dict): - # FIXME: should it rm the directory during remove/deprovision ? + # FIXME: This should rm the datadir only if purge is enabled pass + #if os.path.isdir(self.dir): + # rm(self.dir, recursive=True) -class DBAppResource(AppResource): +# +#class SourcesAppResource(AppResource): +# """ +# is_provisioned -> (if pre_download,) cache exists with appropriate checksum +# is_available -> curl HEAD returns 200 +# +# update -> none? +# provision -> full download + check checksum +# +# deprovision -> remove cache for __APP__ ? +# +# deep_clean -> remove all cache +# +# backup -> nothing +# restore -> nothing +# """ +# +# type = "sources" +# +# default_properties = { +# "main": {"url": "?", "sha256sum": "?", "predownload": True} +# } +# +# def validate_availability(self, context): +# # ? FIXME +# # call request.head on the url idk +# pass +# +# def provision_or_update(self, context: Dict): +# # FIXME +# return +# + +class AptDependenciesAppResource(AppResource): """ - is_provisioned -> setting db_user, db_name, db_pwd exists - is_available -> db doesn't already exists ( ... also gotta make sure that mysql / postgresql is indeed installed ... or will be after apt provisions it) + is_provisioned -> package __APP__-ynh-deps exists (ideally should check the Depends: but hmgn) + is_available -> True? idk - provision -> setup the db + init the setting - update -> ?? + update -> update deps on __APP__-ynh-deps + provision -> create/update deps on __APP__-ynh-deps - deprovision -> delete the db + deprovision -> remove __APP__-ynh-deps (+autoremove?) - deep_clean -> ... idk look into any db name that would not be related to any app ... + deep_clean -> remove any __APP__-ynh-deps for app not in app list - backup -> dump db - restore -> setup + inject db dump + backup -> nothing + restore = provision """ - type = "db" + type = "apt" + priority = 50 default_properties = { - "type": "mysql" + "packages": [], + "extras": {} } - def check_availability(self, context): - # FIXME : checking availability sort of imply that mysql / postgresql is installed - # or we gotta make sure mariadb-server or postgresql is gonna be installed (apt resource) + def validate_availability(self, context): + # ? FIXME + # call helpers idk ... pass - def provision_or_update(self, context: str): - raise NotImplementedError() + def provision_or_update(self, context: Dict): + + # FIXME : implement 'extras' management + self._run_script("provision_or_update", + "ynh_install_app_dependencies $apt_dependencies", + {"apt_dependencies": self.packages}) def deprovision(self, context: Dict): - raise NotImplementedError() + self._run_script("deprovision", + "ynh_remove_app_dependencies") + + +class PortAppResource(AppResource): + """ + is_provisioned -> port setting exists and is not the port used by another app (ie not in another app setting) + is_available -> true + + update -> true + provision -> find a port not used by any app + + deprovision -> delete the port setting + + deep_clean -> ? + + backup -> nothing (backup port setting) + restore -> nothing (restore port setting) + """ + + type = "port" + priority = 70 + + default_properties = { + "default": 1000, + "type": "internal", # FIXME : implement logic for exposed port (allow/disallow in firewall ?) + } + + def _port_is_used(self, port): + + # FIXME : this could be less brutal than two os.system ... + cmd1 = "ss --numeric --listening --tcp --udp | awk '{print$5}' | grep --quiet --extended-regexp ':%s$'" % port + # This second command is mean to cover (most) case where an app is using a port yet ain't currently using it for some reason (typically service ain't up) + cmd2 = f"grep --quiet \"port: '{port}'\" /etc/yunohost/apps/*/settings.yml" + return os.system(cmd1) == 0 and os.system(cmd2) == 0 + + def provision_or_update(self, context: str): + + # Don't do anything if port already defined ? + if self.get_setting("port"): + return + + port = self.default + while self._port_is_used(port): + port += 1 + + self.set_setting("port", port) + + def deprovision(self, context: Dict): + + self.delete_setting("port") + + +#class DBAppResource(AppResource): +# """ +# is_provisioned -> setting db_user, db_name, db_pwd exists +# is_available -> db doesn't already exists ( ... also gotta make sure that mysql / postgresql is indeed installed ... or will be after apt provisions it) +# +# provision -> setup the db + init the setting +# update -> ?? +# +# deprovision -> delete the db +# +# deep_clean -> ... idk look into any db name that would not be related to any app ... +# +# backup -> dump db +# restore -> setup + inject db dump +# """ +# +# type = "db" +# +# default_properties = { +# "type": "mysql" +# } +# +# def validate_availability(self, context): +# # FIXME : checking availability sort of imply that mysql / postgresql is installed +# # or we gotta make sure mariadb-server or postgresql is gonna be installed (apt resource) +# pass +# +# def provision_or_update(self, context: str): +# raise NotImplementedError() +# +# def deprovision(self, context: Dict): +# raise NotImplementedError() +# AppResourceClassesByType = {c.type: c for c in AppResource.__subclasses__()} From 364a3bc70ab82be0c3d02d4f546df8e191eed30f Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 31 Dec 2021 19:02:19 +0100 Subject: [PATCH 014/174] manifestv2: fix many things, have resource system somewhat working for install/remove --- helpers/apt | 3 +- helpers/utils | 23 +++++-- locales/en.json | 2 +- src/app.py | 58 ++++++++++++------ src/utils/resources.py | 134 +++++++++++++++++++++++++---------------- 5 files changed, 140 insertions(+), 80 deletions(-) diff --git a/helpers/apt b/helpers/apt index 74bec758c..433318634 100644 --- a/helpers/apt +++ b/helpers/apt @@ -227,9 +227,8 @@ ynh_install_app_dependencies() { # Add a comma for each space between packages. But not add a comma if the space separate a version specification. (See below) dependencies="$(echo "$dependencies" | sed 's/\([^\<=\>]\)\ \([^(]\)/\1, \2/g')" local dependencies=${dependencies//|/ | } - local manifest_path="$YNH_APP_BASEDIR/manifest.json" - local version=$(jq -r '.version' "$manifest_path") + local version=$(ynh_read_manifest --manifest_key="version") if [ -z "${version}" ] || [ "$version" == "null" ]; then version="1.0" fi diff --git a/helpers/utils b/helpers/utils index 16e353dc4..a2484bb8b 100644 --- a/helpers/utils +++ b/helpers/utils @@ -765,12 +765,25 @@ ynh_read_manifest() { # Manage arguments with getopts ynh_handle_getopts_args "$@" - if [ ! -e "$manifest" ]; then + if [ ! -e "${manifest:-}" ]; then # If the manifest isn't found, try the common place for backup and restore script. - manifest="$YNH_APP_BASEDIR/manifest.json" + if [ -e "$YNH_APP_BASEDIR/manifest.json" ] + then + manifest="$YNH_APP_BASEDIR/manifest.json" + elif [ -e "$YNH_APP_BASEDIR/manifest.toml" ] + then + manifest="$YNH_APP_BASEDIR/manifest.toml" + else + ynh_die --message "No manifest found !?" + fi fi - jq ".$manifest_key" "$manifest" --raw-output + if echo "$manifest" | grep -q '\.json$' + then + jq ".$manifest_key" "$manifest" --raw-output + else + cat "$manifest" | python3 -c 'import json, toml, sys; print(json.dumps(toml.load(sys.stdin)))' | jq ".$manifest_key" --raw-output + fi } # Read the upstream version from the manifest or `$YNH_APP_MANIFEST_VERSION` @@ -914,9 +927,7 @@ ynh_compare_current_package_version() { _ynh_apply_default_permissions() { local target=$1 - local ynh_requirement=$(jq -r '.requirements.yunohost' $YNH_APP_BASEDIR/manifest.json | tr -d '>= ') - - if [ -z "$ynh_requirement" ] || [ "$ynh_requirement" == "null" ] || dpkg --compare-versions $ynh_requirement ge 4.2; then + if dpkg --compare-versions ${YNH_APP_PACKAGING_FORMAT:-0} ge 2 || [ -z "$ynh_requirement" ] || [ "$ynh_requirement" == "null" ] || dpkg --compare-versions $ynh_requirement ge 4.2; then chmod o-rwx $target chmod g-w $target chown -R root:root $target diff --git a/locales/en.json b/locales/en.json index fc4e4283a..cc5ad956a 100644 --- a/locales/en.json +++ b/locales/en.json @@ -43,7 +43,7 @@ "app_packaging_format_not_supported": "This app cannot be installed because its packaging format is not supported by your YunoHost version. You should probably consider upgrading your system.", "app_remove_after_failed_install": "Removing the app following the installation failure...", "app_removed": "{app} uninstalled", - "app_requirements_checking": "Checking required packages for {app}...", + "app_requirements_checking": "Checking requirements for {app}...", "app_requirements_unmeet": "Requirements are not met for {app}, the package {pkgname} ({version}) must be {spec}", "app_restore_failed": "Could not restore {app}: {error}", "app_restore_script_failed": "An error occured inside the app restore script", diff --git a/src/app.py b/src/app.py index a174d3eca..d2aa0fa65 100644 --- a/src/app.py +++ b/src/app.py @@ -59,7 +59,6 @@ from yunohost.utils.config import ( DomainQuestion, PathQuestion, ) -from yunohost.utils.resources import AppResourceSet from yunohost.utils.i18n import _value_for_locale from yunohost.utils.error import YunohostError, YunohostValidationError from yunohost.utils.system import ( @@ -790,7 +789,7 @@ def app_install( if free_space_in_directory("/") <= 512 * 1000 * 1000: raise YunohostValidationError("disk_space_not_sufficient_install") - _confirm_app_install(app) + _confirm_app_install(app, force) manifest, extracted_app_folder = _extract_app(app) packaging_format = manifest["packaging_format"] @@ -824,10 +823,11 @@ def app_install( } # Validate domain / path availability for webapps - if packaging_format < 2: - path_requirement = _guess_webapp_path_requirement(extracted_app_folder) - _validate_webpath_requirement(args, path_requirement) + # (ideally this should be handled by the resource system for manifest v >= 2 + path_requirement = _guess_webapp_path_requirement(extracted_app_folder) + _validate_webpath_requirement(args, path_requirement) + if packaging_format < 2: # Attempt to patch legacy helpers ... _patch_legacy_helpers(extracted_app_folder) @@ -881,9 +881,14 @@ def app_install( # Initialize the main permission for the app # The permission is initialized with no url associated, and with tile disabled # For web app, the root path of the app will be added as url and the tile - # will be enabled during the app install. C.f. 'app_register_url()' below. + # will be enabled during the app install. C.f. 'app_register_url()' below + # or the webpath resource if packaging_format >= 2: - init_main_perm_allowed = ["visitors"] if not args.get("is_public") else ["all_users"] + if args.get("init_permission_main"): + init_main_perm_allowed = args.get("init_permission_main") + else: + init_main_perm_allowed = ["visitors"] if not args.get("is_public") else ["all_users"] + else: init_main_perm_allowed = ["all_users"] @@ -896,13 +901,13 @@ def app_install( ) if packaging_format >= 2: + from yunohost.utils.resources import AppResourceManager try: - from yunohost.utils.resources import AppResourceManager - resources = AppResourceManager(app_instance_name, current=app_setting_path, wanted=extracted_app_folder) - resources.apply() - except: + AppResourceManager(app_instance_name, wanted=manifest["resources"], current={}).apply() + except Exception: + # FIXME : improve error handling .... + AppResourceManager(app_instance_name, wanted={}, current=manifest["resources"]).apply() raise - # FIXME : error handling # Prepare env. var. to pass to script env_dict = _make_environment_for_app_script( @@ -1000,6 +1005,14 @@ def app_install( m18n.n("unexpected_error", error="\n" + traceback.format_exc()) ) + if packaging_format >= 2: + from yunohost.utils.resources import AppResourceManager + try: + AppResourceManager(app_instance_name, wanted={}, current=manifest["resources"]).apply() + except Exception: + # FIXME : improve error handling .... + raise + # Remove all permission in LDAP for permission_name in user_permission_list()["permissions"].keys(): if permission_name.startswith(app_instance_name + "."): @@ -1103,21 +1116,30 @@ def app_remove(operation_logger, app, purge=False): finally: shutil.rmtree(tmp_workdir_for_app) - if ret == 0: - logger.success(m18n.n("app_removed", app=app)) - hook_callback("post_app_remove", env=env_dict) - else: - logger.warning(m18n.n("app_not_properly_removed", app=app)) - # Remove all permission in LDAP for permission_name in user_permission_list(apps=[app])["permissions"].keys(): permission_delete(permission_name, force=True, sync_perm=False) + packaging_format = manifest["packaging_format"] + if packaging_format >= 2: + try: + from yunohost.utils.resources import AppResourceManager + AppResourceManager(app, wanted={}, current=manifest["resources"]).apply() + except Exception: + # FIXME : improve error handling .... + raise + if os.path.exists(app_setting_path): shutil.rmtree(app_setting_path) hook_remove(app) + if ret == 0: + logger.success(m18n.n("app_removed", app=app)) + hook_callback("post_app_remove", env=env_dict) + else: + logger.warning(m18n.n("app_not_properly_removed", app=app)) + permission_sync_to_user() _assert_system_is_sane_for_app(manifest, "post") diff --git a/src/utils/resources.py b/src/utils/resources.py index c9969f01b..b0956a2d0 100644 --- a/src/utils/resources.py +++ b/src/utils/resources.py @@ -20,10 +20,15 @@ """ import os import copy +import shutil from typing import Dict, Any +from moulinette.utils.process import check_output from moulinette.utils.log import getActionLogger from moulinette.utils.filesystem import mkdir, chown, chmod, write_to_file +from moulinette.utils.filesystem import ( + rm, +) from yunohost.utils.error import YunohostError, YunohostValidationError from yunohost.hook import hook_exec @@ -31,43 +36,57 @@ from yunohost.hook import hook_exec logger = getActionLogger("yunohost.app_resources") -class AppResourceManager(object): +class AppResourceManager: - def __init__(self, app: str, manifest: str): + def __init__(self, app: str, current: Dict, wanted: Dict): self.app = app - self.resources = {name: AppResourceClassesByType[name](infos, app) - for name, infos in resources_dict.items()} + self.current = current + self.wanted = wanted - def apply(self): + def apply(self, **context): + + for name, infos in self.wanted.items(): + resource = AppResourceClassesByType[name](infos, self.app) + # FIXME: not a great place to check this because here + # we already started an operation + # We should find a way to validate this before actually starting + # the install procedure / theoperation log + if name not in self.current.keys(): + resource.validate_availability(context=context) + + for name, infos in reversed(self.current.items()): + if name not in self.wanted.keys(): + resource = AppResourceClassesByType[name](infos, self.app) + # FIXME : i18n, better info strings + logger.info(f"Deprovisionning {name} ...") + resource.deprovision(context=context) + + for name, infos in self.wanted.items(): + resource = AppResourceClassesByType[name](infos, self.app) + if name not in self.current.keys(): + # FIXME : i18n, better info strings + logger.info(f"Provisionning {name} ...") + else: + # FIXME : i18n, better info strings + logger.info(f"Updating {name} ...") + resource.provision_or_update(context=context) - - - - - def validate_resource_availability(self): - - for name, resource in self.resources.items(): - resource.validate_availability(context={}) - - def provision_or_update_resources(self): - - for name, resource in self.resources.items(): - logger.info("Running provision_or_upgrade for {self.type}") - resource.provision_or_update(context={}) - - -class AppResource(object): +class AppResource: def __init__(self, properties: Dict[str, Any], app: str): self.app = app for key, value in self.default_properties.items(): + if isinstance(value, str): + value = value.replace("__APP__", self.app) setattr(self, key, value) for key, value in properties.items(): + if isinstance(value, str): + value = value.replace("__APP__", self.app) setattr(self, key, value) def get_setting(self, key): @@ -78,7 +97,7 @@ class AppResource(object): from yunohost.app import app_setting app_setting(self.app, key, value=value) - def delete_setting(self, key, value): + def delete_setting(self, key): from yunohost.app import app_setting app_setting(self.app, key, delete=True) @@ -104,11 +123,12 @@ ynh_abort_if_errors write_to_file(script_path, script) - print(env_) + #print(env_) # FIXME : use the hook_exec_with_debug_instructions_stuff ret, _ = hook_exec(script_path, env=env_) - print(ret) + + #print(ret) class WebpathResource(AppResource): @@ -137,20 +157,28 @@ class WebpathResource(AppResource): def validate_availability(self, context): from yunohost.app import _assert_no_conflicting_apps - domain = self.get_setting("domain") path = self.get_setting("path") if not self.full_domain else "/" _assert_no_conflicting_apps(domain, path, ignore_app=self.app) def provision_or_update(self, context: Dict): - # Nothing to do ? Just setting the domain/path during install - # already provisions it ... - return # FIXME + from yunohost.permission import ( + permission_url, + user_permission_update, + permission_sync_to_user, + ) + + if context.get("action") == "install": + permission_url(f"{self.app}.main", url="/", sync_perm=False) + user_permission_update(f"{self.app}.main", show_tile=True, sync_perm=False) + permission_sync_to_user() def deprovision(self, context: Dict): self.delete_setting("domain") self.delete_setting("path") + # FIXME : theoretically here, should also remove the url in the main permission ? + # but is that worth the trouble ? class SystemuserAppResource(AppResource): @@ -173,7 +201,7 @@ class SystemuserAppResource(AppResource): priority = 20 default_properties = { - "allow_ssh": [] + "allow_ssh": [], "allow_sftp": [] } @@ -190,37 +218,37 @@ class SystemuserAppResource(AppResource): def provision_or_update(self, context: Dict): - if os.system(f"getent passwd {self.app} &>/dev/null") != 0: + if not check_output(f"getent passwd {self.app} &>/dev/null || true").strip(): + # FIXME: improve error handling ? cmd = f"useradd --system --user-group {self.app}" os.system(cmd) - if os.system(f"getent passwd {self.app} &>/dev/null") == 0: - raise YunohostError(f"Failed to create system user for {self.app}") + if not check_output(f"getent passwd {self.app} &>/dev/null || true").strip(): + raise YunohostError(f"Failed to create system user for {self.app}", raw_msg=True) + + groups = set(check_output(f"groups {self.app}").strip().split()[2:]) - groups = [] if self.allow_ssh: - groups.append("ssh.app") + groups.add("ssh.app") if self.allow_sftp: - groups.append("sftp.app") - groups = - - cmd = f"usermod -a -G {groups} {self.app}" - # FIXME : handle case where group gets removed - os.system(cmd) - -# useradd $user_home_dir --system --user-group $username $shell || ynh_die --message="Unable to create $username system account" -# for group in $groups; do -# usermod -a -G "$group" "$username" -# done - - -# | arg: -g, --groups - Add the user to system groups. Typically meant to add the user to the ssh.app / sftp.app group (e.g. for borgserver, my_webapp) + groups.add("sftp.app") + os.system(f"usermod -G {','.join(groups)} {self.app}") def deprovision(self, context: Dict): - self._run_script("deprovision", - f'ynh_system_user_delete "{self.username}"') + if check_output(f"getent passwd {self.app} &>/dev/null || true").strip(): + os.system(f"deluser {self.app} >/dev/null") + if check_output(f"getent passwd {self.app} &>/dev/null || true").strip(): + raise YunohostError(f"Failed to delete system user for {self.app}") + + if check_output(f"getent group {self.app} &>/dev/null || true").strip(): + os.system(f"delgroup {self.app} >/dev/null") + if check_output(f"getent group {self.app} &>/dev/null || true").strip(): + raise YunohostError(f"Failed to delete system user for {self.app}") + + # FIXME : better logging and error handling, add stdout/stderr from the deluser/delgroup commands... + # # Check if the user exists on the system #if os.system(f"getent passwd {self.username} &>/dev/null") != 0: @@ -288,7 +316,7 @@ class InstalldirAppResource(AppResource): group_perm_octal = (4 if "r" in group_perm else 0) + (2 if "w" in group_perm else 0) + (1 if "x" in group_perm else 0) perm_octal = str(owner_perm_octal) + str(group_perm_octal) + "0" - chmod(self.dir, oct(int(perm_octal))) + chmod(self.dir, int(perm_octal)) chown(self.dir, owner, group) self.set_setting("install_dir", self.dir) @@ -348,7 +376,7 @@ class DatadirAppResource(AppResource): group_perm_octal = (4 if "r" in group_perm else 0) + (2 if "w" in group_perm else 0) + (1 if "x" in group_perm else 0) perm_octal = str(owner_perm_octal) + str(group_perm_octal) + "0" - chmod(self.dir, oct(int(perm_octal))) + chmod(self.dir, int(perm_octal)) chown(self.dir, owner, group) self.set_setting("data_dir", self.dir) From dfc37a48c382c7adf6cb2e1dcecf63d2baa580d6 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sun, 2 Jan 2022 03:30:57 +0100 Subject: [PATCH 015/174] manifestv2: forget about webpath ressource, replace with permissions ressource --- src/app.py | 69 +++++++++----------- src/utils/resources.py | 142 ++++++++++++++++++++++++++--------------- 2 files changed, 119 insertions(+), 92 deletions(-) diff --git a/src/app.py b/src/app.py index d2aa0fa65..5e67f620b 100644 --- a/src/app.py +++ b/src/app.py @@ -859,13 +859,13 @@ def app_install( # If packaging_format v2+, save all install questions as settings if packaging_format >= 2: - for arg_name, arg_value in args.items(): + for question in questions: - # ... except is_public .... - if arg_name == "is_public": + # Except user-provider passwords + if question.type == "password": continue - app_settings[arg_name] = arg_value + app_settings[question.name] = question.value _set_app_settings(app_instance_name, app_settings) @@ -878,36 +878,27 @@ def app_install( recursive=True, ) - # Initialize the main permission for the app - # The permission is initialized with no url associated, and with tile disabled - # For web app, the root path of the app will be added as url and the tile - # will be enabled during the app install. C.f. 'app_register_url()' below - # or the webpath resource - if packaging_format >= 2: - if args.get("init_permission_main"): - init_main_perm_allowed = args.get("init_permission_main") - else: - init_main_perm_allowed = ["visitors"] if not args.get("is_public") else ["all_users"] - - else: - init_main_perm_allowed = ["all_users"] - - permission_create( - app_instance_name + ".main", - allowed=init_main_perm_allowed, - label=label if label else manifest["name"], - show_tile=False, - protected=False, - ) - if packaging_format >= 2: from yunohost.utils.resources import AppResourceManager try: - AppResourceManager(app_instance_name, wanted=manifest["resources"], current={}).apply() + AppResourceManager(app_instance_name, wanted=manifest, current={}).apply() except Exception: # FIXME : improve error handling .... - AppResourceManager(app_instance_name, wanted={}, current=manifest["resources"]).apply() + AppResourceManager(app_instance_name, wanted={}, current=manifest).apply() raise + else: + # Initialize the main permission for the app + # The permission is initialized with no url associated, and with tile disabled + # For web app, the root path of the app will be added as url and the tile + # will be enabled during the app install. C.f. 'app_register_url()' below + # or the webpath resource + permission_create( + app_instance_name + ".main", + allowed=["all_users"], + label=label if label else manifest["name"], + show_tile=False, + protected=False, + ) # Prepare env. var. to pass to script env_dict = _make_environment_for_app_script( @@ -1008,15 +999,15 @@ def app_install( if packaging_format >= 2: from yunohost.utils.resources import AppResourceManager try: - AppResourceManager(app_instance_name, wanted={}, current=manifest["resources"]).apply() + AppResourceManager(app_instance_name, wanted={}, current=manifest).apply() except Exception: # FIXME : improve error handling .... raise - - # Remove all permission in LDAP - for permission_name in user_permission_list()["permissions"].keys(): - if permission_name.startswith(app_instance_name + "."): - permission_delete(permission_name, force=True, sync_perm=False) + else: + # Remove all permission in LDAP + for permission_name in user_permission_list()["permissions"].keys(): + if permission_name.startswith(app_instance_name + "."): + permission_delete(permission_name, force=True, sync_perm=False) if remove_retcode != 0: msg = m18n.n("app_not_properly_removed", app=app_instance_name) @@ -1116,18 +1107,18 @@ def app_remove(operation_logger, app, purge=False): finally: shutil.rmtree(tmp_workdir_for_app) - # Remove all permission in LDAP - for permission_name in user_permission_list(apps=[app])["permissions"].keys(): - permission_delete(permission_name, force=True, sync_perm=False) - packaging_format = manifest["packaging_format"] if packaging_format >= 2: try: from yunohost.utils.resources import AppResourceManager - AppResourceManager(app, wanted={}, current=manifest["resources"]).apply() + AppResourceManager(app, wanted={}, current=manifest).apply() except Exception: # FIXME : improve error handling .... raise + else: + # Remove all permission in LDAP + for permission_name in user_permission_list(apps=[app])["permissions"].keys(): + permission_delete(permission_name, force=True, sync_perm=False) if os.path.exists(app_setting_path): shutil.rmtree(app_setting_path) diff --git a/src/utils/resources.py b/src/utils/resources.py index b0956a2d0..23c1a7a5a 100644 --- a/src/utils/resources.py +++ b/src/utils/resources.py @@ -41,29 +41,23 @@ class AppResourceManager: def __init__(self, app: str, current: Dict, wanted: Dict): self.app = app - self.current = current - self.wanted = wanted + self.current = current.get("resources", {}) + self.wanted = wanted.get("resources", {}) + + # c.f. the permission ressources where we need the app label >_> + self.wanted_manifest = wanted def apply(self, **context): - for name, infos in self.wanted.items(): - resource = AppResourceClassesByType[name](infos, self.app) - # FIXME: not a great place to check this because here - # we already started an operation - # We should find a way to validate this before actually starting - # the install procedure / theoperation log - if name not in self.current.keys(): - resource.validate_availability(context=context) - for name, infos in reversed(self.current.items()): if name not in self.wanted.keys(): - resource = AppResourceClassesByType[name](infos, self.app) + resource = AppResourceClassesByType[name](infos, self.app, self) # FIXME : i18n, better info strings logger.info(f"Deprovisionning {name} ...") resource.deprovision(context=context) for name, infos in self.wanted.items(): - resource = AppResourceClassesByType[name](infos, self.app) + resource = AppResourceClassesByType[name](infos, self.app, self) if name not in self.current.keys(): # FIXME : i18n, better info strings logger.info(f"Provisionning {name} ...") @@ -75,9 +69,10 @@ class AppResourceManager: class AppResource: - def __init__(self, properties: Dict[str, Any], app: str): + def __init__(self, properties: Dict[str, Any], app: str, manager: str): self.app = app + self.manager = manager for key, value in self.default_properties.items(): if isinstance(value, str): @@ -101,9 +96,6 @@ class AppResource: from yunohost.app import app_setting app_setting(self.app, key, delete=True) - def validate_availability(self, context: Dict): - pass - def _run_script(self, action, script, env={}, user="root"): from yunohost.app import _make_tmp_workdir_for_app, _make_environment_for_app_script @@ -131,7 +123,7 @@ ynh_abort_if_errors #print(ret) -class WebpathResource(AppResource): +class PermissionsResource(AppResource): """ is_provisioned -> main perm exists is_available -> perm urls do not conflict @@ -147,38 +139,98 @@ class WebpathResource(AppResource): restore -> handled by the core, should be integrated in there (restore .ldif/yml?) """ - type = "webpath" + type = "permissions" priority = 10 default_properties = { - "full_domain": False, } - def validate_availability(self, context): + default_perm_properties = { + "url": None, + "additional_urls": [], + "auth_header": True, + "allowed": None, + "show_tile": None, # To be automagically set to True by default if an url is defined and show_tile not provided + "protected": False, + } - from yunohost.app import _assert_no_conflicting_apps - domain = self.get_setting("domain") - path = self.get_setting("path") if not self.full_domain else "/" - _assert_no_conflicting_apps(domain, path, ignore_app=self.app) + def __init__(self, properties: Dict[str, Any], *args, **kwargs): + + for perm, infos in properties.items(): + properties[perm] = copy.copy(self.default_perm_properties) + properties[perm].update(infos) + if properties[perm]["show_tile"] is None: + properties[perm]["show_tile"] = bool(properties[perm]["url"]) + + if isinstance(properties["main"]["url"], str) and properties["main"]["url"] != "/": + raise YunohostError("URL for the 'main' permission should be '/' for webapps (or undefined/None for non-webapps). Note that / refers to the install url of the app") + + super().__init__({"permissions": properties}, *args, **kwargs) def provision_or_update(self, context: Dict): from yunohost.permission import ( - permission_url, + permission_create, + #permission_url, + permission_delete, + user_permission_list, user_permission_update, permission_sync_to_user, ) - if context.get("action") == "install": - permission_url(f"{self.app}.main", url="/", sync_perm=False) - user_permission_update(f"{self.app}.main", show_tile=True, sync_perm=False) - permission_sync_to_user() + # Delete legacy is_public setting if not already done + self.delete_setting(f"is_public") + + existing_perms = user_permission_list(short=True, apps=[self.app])["permissions"] + for perm in existing_perms: + if perm.split(".") not in self.permissions.keys(): + permission_delete(perm, force=True, sync_perm=False) + + for perm, infos in self.permissions.items(): + if f"{self.app}.{perm}" not in existing_perms: + # Use the 'allowed' key from the manifest, + # or use the 'init_{perm}_permission' from the install questions + # which is temporarily saved as a setting as an ugly hack to pass the info to this piece of code... + init_allowed = infos["allowed"] or self.get_setting(f"init_{perm}_permission") or [] + permission_create( + f"{self.app}.{perm}", + allowed=init_allowed, + # This is why the ugly hack with self.manager and wanted_manifest exists >_> + label=self.manager.wanted_manifest["name"] if perm == "main" else perm, + url=infos["url"], + additional_urls=infos["additional_urls"], + auth_header=infos["auth_header"], + sync_perm=False, + ) + self.delete_setting(f"init_{perm}_permission") + + user_permission_update( + f"{self.app}.{perm}", + show_tile=infos["show_tile"], + protected=infos["protected"], + sync_perm=False + ) + else: + pass + # FIXME : current implementation of permission_url is hell for + # easy declarativeness of additional_urls >_> ... + #permission_url(f"{self.app}.{perm}", url=infos["url"], auth_header=infos["auth_header"], sync_perm=False) + + permission_sync_to_user() def deprovision(self, context: Dict): - self.delete_setting("domain") - self.delete_setting("path") - # FIXME : theoretically here, should also remove the url in the main permission ? - # but is that worth the trouble ? + + from yunohost.permission import ( + permission_delete, + user_permission_list, + permission_sync_to_user, + ) + + existing_perms = user_permission_list(short=True, apps=[self.app])["permissions"] + for perm in existing_perms: + permission_delete(perm, force=True, sync_perm=False) + + permission_sync_to_user() class SystemuserAppResource(AppResource): @@ -205,19 +257,11 @@ class SystemuserAppResource(AppResource): "allow_sftp": [] } - def validate_availability(self, context): - pass - # FIXME : do we care if user already exists ? shouldnt we assume that user $app corresponds to the app ...? - - # FIXME : but maybe we should at least check that no corresponding yunohost user exists - - #if os.system(f"getent passwd {self.username} &>/dev/null") != 0: - # raise YunohostValidationError(f"User {self.username} already exists") - #if os.system(f"getent group {self.username} &>/dev/null") != 0: - # raise YunohostValidationError(f"Group {self.username} already exists") - def provision_or_update(self, context: Dict): + # FIXME : validate that no yunohost user exists with that name? + # and/or that no system user exists during install ? + if not check_output(f"getent passwd {self.app} &>/dev/null || true").strip(): # FIXME: improve error handling ? cmd = f"useradd --system --user-group {self.app}" @@ -291,9 +335,6 @@ class InstalldirAppResource(AppResource): # FIXME: change default dir to /opt/stuff if app ain't a webapp ... # FIXME: what do in a scenario where the location changed - def validate_availability(self, context): - pass - def provision_or_update(self, context: Dict): current_install_dir = self.get_setting("install_dir") @@ -354,11 +395,6 @@ class DatadirAppResource(AppResource): "group": "__APP__:rx", } - def validate_availability(self, context): - pass - # Nothing to do ? If datadir already exists then it may be legit data - # from a previous install - def provision_or_update(self, context: Dict): current_data_dir = self.get_setting("data_dir") From 6cae524910a508dc16ca67a735e72ea20d29906a Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 11 Jan 2022 14:53:04 +0100 Subject: [PATCH 016/174] Drop the 'admin' user, have 'admins' be a group of Yunohost users instead --- conf/slapd/config.ldif | 4 -- conf/slapd/db_init.ldif | 37 ++++++------- conf/slapd/mailserver.ldif | 3 ++ hooks/conf_regen/01-yunohost | 11 ++-- hooks/conf_regen/06-slapd | 24 --------- locales/en.json | 4 +- share/actionsmap.yml | 31 ++++++++--- src/authenticators/ldap_admin.py | 33 +++++++----- src/backup.py | 12 ++--- src/ssh.py | 9 ---- src/tools.py | 90 ++++++++++---------------------- src/user.py | 31 +++++++---- src/utils/config.py | 2 + 13 files changed, 125 insertions(+), 166 deletions(-) diff --git a/conf/slapd/config.ldif b/conf/slapd/config.ldif index e1fe3b1b5..249422950 100644 --- a/conf/slapd/config.ldif +++ b/conf/slapd/config.ldif @@ -130,7 +130,6 @@ olcSuffix: dc=yunohost,dc=org # admin entry below # These access lines apply to database #1 only olcAccess: {0}to attrs=userPassword,shadowLastChange - by dn.base="cn=admin,dc=yunohost,dc=org" write by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" write by anonymous auth by self write @@ -140,7 +139,6 @@ olcAccess: {0}to attrs=userPassword,shadowLastChange # owning it if they are authenticated. # Others should be able to see it. olcAccess: {1}to attrs=cn,gecos,givenName,mail,maildrop,displayName,sn - by dn.base="cn=admin,dc=yunohost,dc=org" write by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" write by self write by * read @@ -160,9 +158,7 @@ olcAccess: {2}to dn.base="" # The admin dn has full write access, everyone else # can read everything. olcAccess: {3}to * - by dn.base="cn=admin,dc=yunohost,dc=org" write by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" write - by group/groupOfNames/member.exact="cn=admin,ou=groups,dc=yunohost,dc=org" write by * read # olcAddContentAcl: FALSE diff --git a/conf/slapd/db_init.ldif b/conf/slapd/db_init.ldif index be0181dfe..adea0dd89 100644 --- a/conf/slapd/db_init.ldif +++ b/conf/slapd/db_init.ldif @@ -5,15 +5,6 @@ objectClass: organization o: yunohost.org dc: yunohost -dn: cn=admin,ou=sudo,dc=yunohost,dc=org -cn: admin -objectClass: sudoRole -objectClass: top -sudoCommand: ALL -sudoUser: admin -sudoOption: !authenticate -sudoHost: ALL - dn: ou=users,dc=yunohost,dc=org objectClass: organizationalUnit objectClass: top @@ -39,28 +30,30 @@ objectClass: organizationalUnit objectClass: top ou: groups +dn: cn=admins,ou=sudo,dc=yunohost,dc=org +cn: admins +objectClass: sudoRole +objectClass: top +sudoCommand: ALL +sudoUser: %admins +sudoHost: ALL + dn: ou=sudo,dc=yunohost,dc=org objectClass: organizationalUnit objectClass: top ou: sudo -dn: cn=admin,dc=yunohost,dc=org -objectClass: organizationalRole -objectClass: posixAccount -objectClass: simpleSecurityObject -cn: admin -uid: admin -uidNumber: 1007 -gidNumber: 1007 -homeDirectory: /home/admin -loginShell: /bin/bash -userPassword: yunohost - dn: cn=admins,ou=groups,dc=yunohost,dc=org objectClass: posixGroup objectClass: top -memberUid: admin +objectClass: groupOfNamesYnh +objectClass: mailGroup gidNumber: 4001 +mail: root +mail: admin +mail: webmaster +mail: postmaster +mail: abuse cn: admins dn: cn=all_users,ou=groups,dc=yunohost,dc=org diff --git a/conf/slapd/mailserver.ldif b/conf/slapd/mailserver.ldif index 849d1d9e1..09f5c64cc 100644 --- a/conf/slapd/mailserver.ldif +++ b/conf/slapd/mailserver.ldif @@ -89,4 +89,7 @@ olcObjectClasses: ( 1.3.6.1.4.1.40328.1.1.2.3 NAME 'mailGroup' SUP top AUXILIARY DESC 'Mail Group' MUST ( mail ) + MAY ( + mailalias $ maildrop + ) ) diff --git a/hooks/conf_regen/01-yunohost b/hooks/conf_regen/01-yunohost index 1f6c143a6..9f26e1eea 100755 --- a/hooks/conf_regen/01-yunohost +++ b/hooks/conf_regen/01-yunohost @@ -42,7 +42,7 @@ do_init_regen() { # Backup folders mkdir -p /home/yunohost.backup/archives chmod 750 /home/yunohost.backup/archives - chown root:root /home/yunohost.backup/archives # This is later changed to admin:root once admin user exists + chown root:root /home/yunohost.backup/archives # This is later changed to root:admins once the admins group exists # Empty ssowat json persistent conf echo "{}" >'/etc/ssowat/conf.json.persistent' @@ -173,12 +173,11 @@ do_post_regen() { # Enfore permissions # ###################### - chmod 750 /home/admin - chmod 750 /home/yunohost.backup - chmod 750 /home/yunohost.backup/archives + chmod 770 /home/yunohost.backup + chmod 770 /home/yunohost.backup/archives chmod 700 /var/cache/yunohost - chown admin:root /home/yunohost.backup - chown admin:root /home/yunohost.backup/archives + chown root:admins /home/yunohost.backup + chown root:admins /home/yunohost.backup/archives chown root:root /var/cache/yunohost # NB: x permission for 'others' is important for ssl-cert (and maybe mdns), otherwise slapd will fail to start because can't access the certs diff --git a/hooks/conf_regen/06-slapd b/hooks/conf_regen/06-slapd index 616b383ec..bb7c075c4 100755 --- a/hooks/conf_regen/06-slapd +++ b/hooks/conf_regen/06-slapd @@ -58,14 +58,6 @@ EOF nscd -i passwd || true systemctl restart slapd - - # We don't use mkhomedir_helper because 'admin' may not be recognized - # when this script is ran in a chroot (e.g. ISO install) - # We also refer to admin as uid 1007 for the same reason - if [ ! -d /home/admin ]; then - cp -r /etc/skel /home/admin - chown -R 1007:1007 /home/admin - fi } _regenerate_slapd_conf() { @@ -172,22 +164,6 @@ objectClass: top" echo "Reloading slapd" systemctl force-reload slapd - - # on slow hardware/vm this regen conf would exit before the admin user that - # is stored in ldap is available because ldap seems to slow to restart - # so we'll wait either until we are able to log as admin or until a timeout - # is reached - # we need to do this because the next hooks executed after this one during - # postinstall requires to run as admin thus breaking postinstall on slow - # hardware which mean yunohost can't be correctly installed on those hardware - # and this sucks - # wait a maximum time of 5 minutes - # yes, force-reload behave like a restart - number_of_wait=0 - while ! su admin -c '' && ((number_of_wait < 60)); do - sleep 5 - ((number_of_wait += 1)) - done } do_$1_regen ${@:2} diff --git a/locales/en.json b/locales/en.json index 91db42cb5..e1089684e 100644 --- a/locales/en.json +++ b/locales/en.json @@ -6,7 +6,6 @@ "admin_password": "Administration password", "admin_password_change_failed": "Unable to change password", "admin_password_changed": "The administration password was changed", - "admin_password_too_long": "Please choose a password shorter than 127 characters", "already_up_to_date": "Nothing to do. Everything is already up-to-date.", "app_action_broke_system": "This action seems to have broken these important services: {services}", "app_action_cannot_be_ran_because_required_services_down": "These required services should be running to run this action: {services}. Try restarting them to continue (and possibly investigate why they are down).", @@ -534,6 +533,7 @@ "password_too_simple_2": "The password needs to be at least 8 characters long and contain a digit, upper and lower characters", "password_too_simple_3": "The password needs to be at least 8 characters long and contain a digit, upper, lower and special characters", "password_too_simple_4": "The password needs to be at least 12 characters long and contain a digit, upper, lower and special characters", + "password_too_long": "Please choose a password shorter than 127 characters", "pattern_backup_archive_name": "Must be a valid filename with max 30 characters, alphanumeric and -_. characters only", "pattern_domain": "Must be a valid domain name (e.g. my-domain.org)", "pattern_email": "Must be a valid e-mail address, without '+' symbol (e.g. someone@example.com)", @@ -685,5 +685,5 @@ "yunohost_configured": "YunoHost is now configured", "yunohost_installing": "Installing YunoHost...", "yunohost_not_installed": "YunoHost is not correctly installed. Please run 'yunohost tools postinstall'", - "yunohost_postinstall_end_tip": "The post-install completed! To finalize your setup, please consider:\n - adding a first user through the 'Users' section of the webadmin (or 'yunohost user create ' in command-line);\n - diagnose potential issues through the 'Diagnosis' section of the webadmin (or 'yunohost diagnosis run' in command-line);\n - reading the 'Finalizing your setup' and 'Getting to know YunoHost' parts in the admin documentation: https://yunohost.org/admindoc." + "yunohost_postinstall_end_tip": "The post-install completed! To finalize your setup, please consider:\n - diagnose potential issues through the 'Diagnosis' section of the webadmin (or 'yunohost diagnosis run' in command-line);\n - reading the 'Finalizing your setup' and 'Getting to know YunoHost' parts in the admin documentation: https://yunohost.org/admindoc." } diff --git a/share/actionsmap.yml b/share/actionsmap.yml index cad0212b2..8214c8d7e 100644 --- a/share/actionsmap.yml +++ b/share/actionsmap.yml @@ -1438,10 +1438,10 @@ tools: category_help: Specific tools actions: - ### tools_adminpw() - adminpw: - action_help: Change password of admin and root users - api: PUT /adminpw + ### tools_rootpw() + rootpw: + action_help: Change root password + api: PUT /rootpw arguments: -n: full: --new-password @@ -1476,6 +1476,25 @@ tools: ask: ask_main_domain pattern: *pattern_domain required: True + -u: + full: --username + help: Username for the first (admin) user + extra: + ask: ask_username + pattern: *pattern_username + required: True + -f: + full: --firstname + extra: + ask: ask_firstname + required: True + pattern: *pattern_firstname + -l: + full: --lastname + extra: + ask: ask_lastname + required: True + pattern: *pattern_lastname -p: full: --password help: YunoHost admin password @@ -1487,14 +1506,10 @@ tools: --ignore-dyndns: help: Do not subscribe domain to a DynDNS service action: store_true - --force-password: - help: Use this if you really want to set a weak password - action: store_true --force-diskspace: help: Use this if you really want to install YunoHost on a setup with less than 10 GB on the root filesystem action: store_true - ### tools_update() update: action_help: YunoHost update diff --git a/src/authenticators/ldap_admin.py b/src/authenticators/ldap_admin.py index 94d68a8db..55359379d 100644 --- a/src/authenticators/ldap_admin.py +++ b/src/authenticators/ldap_admin.py @@ -9,35 +9,45 @@ import time from moulinette import m18n from moulinette.authentication import BaseAuthenticator from yunohost.utils.error import YunohostError +from yunohost.utils.ldap import _get_ldap_interface + logger = logging.getLogger("yunohost.authenticators.ldap_admin") +LDAP_URI = "ldap://localhost:389" +ADMIN_GROUP = "cn=admins,ou=groups,dc=yunohost,dc=org" +AUTH_DN = "uid={uid},ou=users,dc=yunohost,dc=org" + class Authenticator(BaseAuthenticator): name = "ldap_admin" def __init__(self, *args, **kwargs): - self.uri = "ldap://localhost:389" - self.basedn = "dc=yunohost,dc=org" - self.admindn = "cn=admin,dc=yunohost,dc=org" + pass def _authenticate_credentials(self, credentials=None): - # TODO : change authentication format - # to support another dn to support multi-admins + admins = _get_ldap_interface().search(ADMIN_GROUP, attrs=["memberUid"])[0]["memberUid"] + + uid, password = credentials.split(":", 1) + + if uid not in admins: + raise YunohostError("invalid_credentials") + + dn = AUTH_DN.format(uid=uid) def _reconnect(): con = ldap.ldapobject.ReconnectLDAPObject( - self.uri, retry_max=10, retry_delay=0.5 + LDAP_URI, retry_max=10, retry_delay=0.5 ) - con.simple_bind_s(self.admindn, credentials) + con.simple_bind_s(dn, password) return con try: con = _reconnect() except ldap.INVALID_CREDENTIALS: - raise YunohostError("invalid_password") + raise YunohostError("invalid_credentials") except ldap.SERVER_DOWN: # ldap is down, attempt to restart it before really failing logger.warning(m18n.n("ldap_server_is_down_restart_it")) @@ -57,11 +67,8 @@ class Authenticator(BaseAuthenticator): logger.warning("Error during ldap authentication process: %s", e) raise else: - if who != self.admindn: - raise YunohostError( - f"Not logged with the appropriate identity ? Found {who}, expected {self.admindn} !?", - raw_msg=True, - ) + if who != dn: + raise YunohostError(f"Not logged with the appropriate identity ? Found {who}, expected {dn} !?", raw_msg=True) finally: # Free the connection, we don't really need it to keep it open as the point is only to check authentication... if con: diff --git a/src/backup.py b/src/backup.py index 3dc2a31f5..1c454b7aa 100644 --- a/src/backup.py +++ b/src/backup.py @@ -342,7 +342,7 @@ class BackupManager: # FIXME replace isdir by exists ? manage better the case where the path # exists if not os.path.isdir(self.work_dir): - filesystem.mkdir(self.work_dir, 0o750, parents=True, uid="admin") + filesystem.mkdir(self.work_dir, 0o750, parents=True) elif self.is_tmp_work_dir: logger.debug( @@ -358,7 +358,7 @@ class BackupManager: # we're in /home/yunohost.backup/tmp so that should be okay... # c.f. method clean() which also does this) filesystem.rm(self.work_dir, recursive=True, force=True) - filesystem.mkdir(self.work_dir, 0o750, parents=True, uid="admin") + filesystem.mkdir(self.work_dir, 0o750, parents=True) # # Backup target management # @@ -1886,7 +1886,7 @@ class CopyBackupMethod(BackupMethod): dest_parent = os.path.dirname(dest) if not os.path.exists(dest_parent): - filesystem.mkdir(dest_parent, 0o700, True, uid="admin") + filesystem.mkdir(dest_parent, 0o700, True) if os.path.isdir(source): shutil.copytree(source, dest) @@ -1948,7 +1948,7 @@ class TarBackupMethod(BackupMethod): """ if not os.path.exists(self.repo): - filesystem.mkdir(self.repo, 0o750, parents=True, uid="admin") + filesystem.mkdir(self.repo, 0o750, parents=True) # Check free space in output self._check_is_enough_free_space() @@ -2632,9 +2632,9 @@ def _create_archive_dir(): if os.path.lexists(ARCHIVES_PATH): raise YunohostError("backup_output_symlink_dir_broken", path=ARCHIVES_PATH) - # Create the archive folder, with 'admin' as owner, such that + # Create the archive folder, with 'admins' as groupowner, such that # people can scp archives out of the server - mkdir(ARCHIVES_PATH, mode=0o750, parents=True, uid="admin", gid="root") + mkdir(ARCHIVES_PATH, mode=0o770, parents=True, gid="admins") def _call_for_each_path(self, callback, csv_path=None): diff --git a/src/ssh.py b/src/ssh.py index ecee39f4a..582fc39a1 100644 --- a/src/ssh.py +++ b/src/ssh.py @@ -158,15 +158,6 @@ def _get_user_for_ssh(username, attrs=None): "home_path": root_unix.pw_dir, } - if username == "admin": - admin_unix = pwd.getpwnam("admin") - return { - "username": "admin", - "fullname": "", - "mail": "", - "home_path": admin_unix.pw_dir, - } - # TODO escape input using https://www.python-ldap.org/doc/html/ldap-filter.html from yunohost.utils.ldap import _get_ldap_interface diff --git a/src/tools.py b/src/tools.py index 1a80d020f..ef811a3bf 100644 --- a/src/tools.py +++ b/src/tools.py @@ -19,10 +19,6 @@ """ -""" yunohost_tools.py - - Specific tools -""" import re import os import subprocess @@ -67,63 +63,40 @@ def tools_versions(): return ynh_packages_version() -def tools_adminpw(new_password, check_strength=True): - """ - Change admin password +def tools_rootpw(new_password): - Keyword argument: - new_password - - """ from yunohost.user import _hash_user_password from yunohost.utils.password import assert_password_is_strong_enough import spwd - if check_strength: - assert_password_is_strong_enough("admin", new_password) + assert_password_is_strong_enough("admin", new_password) + + new_hash = _hash_user_password(new_password) # UNIX seems to not like password longer than 127 chars ... # e.g. SSH login gets broken (or even 'su admin' when entering the password) if len(new_password) >= 127: - raise YunohostValidationError("admin_password_too_long") - - new_hash = _hash_user_password(new_password) - - from yunohost.utils.ldap import _get_ldap_interface - - ldap = _get_ldap_interface() + raise YunohostValidationError("password_too_long") + # Write as root password try: - ldap.update( - "cn=admin", - {"userPassword": [new_hash]}, - ) - except Exception as e: - logger.error("unable to change admin password : %s" % e) - raise YunohostError("admin_password_change_failed") - else: - # Write as root password - try: - hash_root = spwd.getspnam("root").sp_pwd + hash_root = spwd.getspnam("root").sp_pwd - with open("/etc/shadow", "r") as before_file: - before = before_file.read() + with open("/etc/shadow", "r") as before_file: + before = before_file.read() - with open("/etc/shadow", "w") as after_file: - after_file.write( - before.replace( - "root:" + hash_root, "root:" + new_hash.replace("{CRYPT}", "") - ) + with open("/etc/shadow", "w") as after_file: + after_file.write( + before.replace( + "root:" + hash_root, "root:" + new_hash.replace("{CRYPT}", "") ) - # An IOError may be thrown if for some reason we can't read/write /etc/passwd - # A KeyError could also be thrown if 'root' is not in /etc/passwd in the first place (for example because no password defined ?) - # (c.f. the line about getspnam) - except (IOError, KeyError): - logger.warning(m18n.n("root_password_desynchronized")) - return - - logger.info(m18n.n("root_password_replaced_by_admin_password")) - logger.success(m18n.n("admin_password_changed")) + ) + # An IOError may be thrown if for some reason we can't read/write /etc/passwd + # A KeyError could also be thrown if 'root' is not in /etc/passwd in the first place (for example because no password defined ?) + # (c.f. the line about getspnam) + except (IOError, KeyError): + logger.warning(m18n.n("root_password_desynchronized")) + return def tools_maindomain(new_main_domain=None): @@ -189,25 +162,18 @@ def _detect_virt(): def tools_postinstall( operation_logger, domain, + username, + firstname, + lastname, password, ignore_dyndns=False, - force_password=False, force_diskspace=False, ): - """ - YunoHost post-install - Keyword argument: - domain -- YunoHost main domain - ignore_dyndns -- Do not subscribe domain to a DynDNS service (only - needed for nohost.me, noho.st domains) - password -- YunoHost admin password - - """ from yunohost.dyndns import _dyndns_available from yunohost.utils.dns import is_yunohost_dyndns_domain - from yunohost.utils.password import assert_password_is_strong_enough from yunohost.domain import domain_main_domain + from yunohost.user import user_create import psutil # Do some checks at first @@ -230,10 +196,6 @@ def tools_postinstall( if not force_diskspace and main_space < 10 * GB: raise YunohostValidationError("postinstall_low_rootfsspace") - # Check password - if not force_password: - assert_password_is_strong_enough("admin", password) - # If this is a nohost.me/noho.st, actually check for availability if not ignore_dyndns and is_yunohost_dyndns_domain(domain): # Check if the domain is available... @@ -268,8 +230,10 @@ def tools_postinstall( domain_add(domain, dyndns) domain_main_domain(domain) + user_create(username, firstname, lastname, domain, password, admin=True) + # Update LDAP admin and create home dir - tools_adminpw(password, check_strength=not force_password) + tools_rootpw(password) # Enable UPnP silently and reload firewall firewall_upnp("enable", no_refresh=True) diff --git a/src/user.py b/src/user.py index be9b74641..fe2695a1e 100644 --- a/src/user.py +++ b/src/user.py @@ -55,7 +55,7 @@ FIELDS_FOR_IMPORT = { "groups": r"^|([a-z0-9_]+(,?[a-z0-9_]+)*)$", } -FIRST_ALIASES = ["root@", "admin@", "webmaster@", "postmaster@", "abuse@"] +ADMIN_ALIASES = ["root@", "admin@", "webmaster@", "postmaster@", "abuse@"] def user_list(fields=None): @@ -138,6 +138,7 @@ def user_create( domain, password, mailbox_quota="0", + admin=False, from_import=False, ): @@ -146,8 +147,13 @@ def user_create( from yunohost.utils.password import assert_password_is_strong_enough from yunohost.utils.ldap import _get_ldap_interface + # UNIX seems to not like password longer than 127 chars ... + # e.g. SSH login gets broken (or even 'su admin' when entering the password) + if len(password) >= 127: + raise YunohostValidationError("password_too_long") + # Ensure sufficiently complex password - assert_password_is_strong_enough("user", password) + assert_password_is_strong_enough("admin" if admin else "user", password) # Validate domain used for email address/xmpp account if domain is None: @@ -189,9 +195,10 @@ def user_create( raise YunohostValidationError("system_username_exists") main_domain = _get_maindomain() - aliases = [alias + main_domain for alias in FIRST_ALIASES] + # FIXME: should forbit root@any.domain, not just main domain? + admin_aliases = [alias + main_domain for alias in ADMIN_ALIASES] - if mail in aliases: + if mail in admin_aliases: raise YunohostValidationError("mail_unavailable") if not from_import: @@ -232,10 +239,6 @@ def user_create( "loginShell": ["/bin/bash"], } - # If it is the first user, add some aliases - if not ldap.search(base="ou=users,dc=yunohost,dc=org", filter="uid=*"): - attr_dict["mail"] = [attr_dict["mail"]] + aliases - try: ldap.add("uid=%s,ou=users" % username, attr_dict) except Exception as e: @@ -263,6 +266,8 @@ def user_create( # Create group for user and add to group 'all_users' user_group_create(groupname=username, gid=uid, primary_group=True, sync_perm=False) user_group_update(groupname="all_users", add=username, force=True, sync_perm=True) + if admin: + user_group_update(groupname="admins", add=username, sync_perm=True) # Trigger post_user_create hooks env_dict = { @@ -416,6 +421,12 @@ def user_update( change_password = Moulinette.prompt( m18n.n("ask_password"), is_password=True, confirm=True ) + + # UNIX seems to not like password longer than 127 chars ... + # e.g. SSH login gets broken (or even 'su admin' when entering the password) + if len(change_password) >= 127: + raise YunohostValidationError("password_too_long") + # Ensure sufficiently complex password assert_password_is_strong_enough("user", change_password) @@ -424,7 +435,6 @@ def user_update( if mail: main_domain = _get_maindomain() - aliases = [alias + main_domain for alias in FIRST_ALIASES] # If the requested mail address is already as main address or as an alias by this user if mail in user["mail"]: @@ -439,6 +449,9 @@ def user_update( raise YunohostError( "mail_domain_unknown", domain=mail[mail.find("@") + 1 :] ) + + # FIXME: should also forbid root@any.domain and not just the main domain + aliases = [alias + main_domain for alias in ADMIN_ALIASES] if mail in aliases: raise YunohostValidationError("mail_unavailable") diff --git a/src/utils/config.py b/src/utils/config.py index 99a002404..be8c76e15 100644 --- a/src/utils/config.py +++ b/src/utils/config.py @@ -1144,6 +1144,8 @@ class UserQuestion(Question): ) if self.default is None: + # FIXME: this code is obsolete with the new admins group + # Should be replaced by something like "any first user we find in the admin group" root_mail = "root@%s" % _get_maindomain() for user in self.choices: if root_mail in user_info(user).get("mail-aliases", []): From 767b5c3d7ecb141d5ce3e80fea3227443e71d4cd Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 11 Jan 2022 15:09:01 +0100 Subject: [PATCH 017/174] mail: Add ldap-groups virtual aliases --- conf/postfix/main.cf | 2 +- conf/postfix/plain/ldap-groups.cf | 9 +++++++++ conf/slapd/db_init.ldif | 1 + 3 files changed, 11 insertions(+), 1 deletion(-) create mode 100644 conf/postfix/plain/ldap-groups.cf diff --git a/conf/postfix/main.cf b/conf/postfix/main.cf index 51e35c85c..6a4b9f0b4 100644 --- a/conf/postfix/main.cf +++ b/conf/postfix/main.cf @@ -99,7 +99,7 @@ message_size_limit = 35914708 virtual_mailbox_domains = ldap:/etc/postfix/ldap-domains.cf virtual_mailbox_maps = ldap:/etc/postfix/ldap-accounts.cf virtual_mailbox_base = -virtual_alias_maps = ldap:/etc/postfix/ldap-aliases.cf +virtual_alias_maps = ldap:/etc/postfix/ldap-aliases.cf,ldap:/etc/postfix/ldap-groups.cf virtual_alias_domains = virtual_minimum_uid = 100 virtual_uid_maps = static:vmail diff --git a/conf/postfix/plain/ldap-groups.cf b/conf/postfix/plain/ldap-groups.cf new file mode 100644 index 000000000..dbf768641 --- /dev/null +++ b/conf/postfix/plain/ldap-groups.cf @@ -0,0 +1,9 @@ +server_host = localhost +server_port = 389 +search_base = dc=yunohost,dc=org +query_filter = (&(objectClass=groupOfNamesYnh)(mail=%s)) +exclude_internal = yes +search_timeout = 30 +scope = sub +result_attribute = memberUid, mail +terminal_result_attribute = memberUid diff --git a/conf/slapd/db_init.ldif b/conf/slapd/db_init.ldif index adea0dd89..95b9dd936 100644 --- a/conf/slapd/db_init.ldif +++ b/conf/slapd/db_init.ldif @@ -51,6 +51,7 @@ objectClass: mailGroup gidNumber: 4001 mail: root mail: admin +mail: admins mail: webmaster mail: postmaster mail: abuse From 66cd35d30446c44cfdf502bfaf709c6722c5d63b Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 11 Jan 2022 15:24:26 +0100 Subject: [PATCH 018/174] ci: Propagate postinstall cli changes to install.gitlab-ci.yml --- .gitlab/ci/install.gitlab-ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gitlab/ci/install.gitlab-ci.yml b/.gitlab/ci/install.gitlab-ci.yml index e2662e9e2..89360c8f8 100644 --- a/.gitlab/ci/install.gitlab-ci.yml +++ b/.gitlab/ci/install.gitlab-ci.yml @@ -26,4 +26,4 @@ install-postinstall: script: - apt-get update -o Acquire::Retries=3 - DEBIAN_FRONTEND=noninteractive SUDO_FORCE_REMOVE=yes apt --assume-yes -o Dpkg::Options::="--force-confold" --allow-downgrades install ./$YNH_BUILD_DIR/*.deb - - yunohost tools postinstall -d domain.tld -p the_password --ignore-dyndns --force-diskspace + - yunohost tools postinstall -d domain.tld -u syssa -f Syssa -l Mine -p the_password --ignore-dyndns --force-diskspace From 9126beffc252abf74c2ecd715c7d80a2213e9b59 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 11 Jan 2022 17:11:45 +0100 Subject: [PATCH 019/174] Prevent deletion of the new admins group --- src/user.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/user.py b/src/user.py index 7fda78a25..4ba3f4081 100644 --- a/src/user.py +++ b/src/user.py @@ -1081,7 +1081,7 @@ def user_group_delete(operation_logger, groupname, force=False, sync_perm=True): # # We also can't delete "all_users" because that's a special group... existing_users = list(user_list()["users"].keys()) - undeletable_groups = existing_users + ["all_users", "visitors"] + undeletable_groups = existing_users + ["all_users", "visitors", "admins"] if groupname in undeletable_groups and not force: raise YunohostValidationError("group_cannot_be_deleted", group=groupname) From 4cb8c914758967f0c3e57c109138f9f7c5e20cbf Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 11 Jan 2022 18:15:34 +0100 Subject: [PATCH 020/174] Draft migration for new admins group --- src/migrations/0024_new_admins_group.py | 86 +++++++++++++++++++++++++ 1 file changed, 86 insertions(+) create mode 100644 src/migrations/0024_new_admins_group.py diff --git a/src/migrations/0024_new_admins_group.py b/src/migrations/0024_new_admins_group.py new file mode 100644 index 000000000..ca9b45d07 --- /dev/null +++ b/src/migrations/0024_new_admins_group.py @@ -0,0 +1,86 @@ +import os +from moulinette.utils.log import getActionLogger + +from yunohost.utils.error import YunohostError +from yunohost.tools import Migration + +logger = getActionLogger("yunohost.migration") + +################################################### +# Tools used also for restoration +################################################### + + +class MyMigration(Migration): + """ + Add new permissions around SSH/SFTP features + """ + + introduced_in_version = "11.1" # FIXME? + dependencies = [] + + @Migration.ldap_migration + def run(self, *args): + + from yunohost.user import user_list, user_info, user_group_update + from yunohost.utils.ldap import _get_ldap_interface + + ldap = _get_ldap_interface() + + all_users = user_list()["users"].keys() + new_admin_user = None + for user in all_users: + if any(alias.startswith("root@") for alias in user_info(user).get("mail-aliases", [])): + new_admin_user = user + break + + if not new_admin_user: + new_admin_user = os.environ.get("YNH_NEW_ADMIN_USER") + if new_admin_user: + assert new_admin_user in all_users, f"{new_admin_user} is not an existing yunohost user" + else: + raise YunohostError( + # FIXME: i18n + """The very first user created on this Yunohost instance could not be found, and therefore this migration can not be ran. You should re-run this migration as soon as possible from the command line with, after choosing which user should become the admin: + +export YNH_NEW_ADMIN_USER=some_existing_username +yunohost tools migrations run""", + raw_msg=True + ) + + stuff_to_delete = [ + "cn=admin,ou=sudo", + "cn=admins,ou=sudo" + "cn=admin", + "cn=admins,ou=groups", + ] + + for stuff in stuff_to_delete: + if ldap.search(stuff): + ldap.remove(stuff) + + ldap.add( + "cn=admins,ou=sudo", + { + "cn": ["admins"], + "objectClass": ["top", "sudoRole"], + "sudoCommand": ["ALL"], + "sudoUser": ["%admins"], + "sudoHost": ["ALL"], + } + ) + + ldap.add( + "cn=admins,ou=groups", + { + "cn": ["admins"], + "objectClass": ["top", "posixGroup", "groupOfNamesYnh", "mailGroup"], + "gidNumber": [4001], + "mail": ["root", "admin", "admins", "webmaster", "postmaster", "abuse"], + } + ) + + user_group_update(groupname="admins", add=new_admin_user, sync_perm=True) + + def run_after_system_restore(self): + self.run() From 4c6786e8afe13ad703d80c6ddaf39630b3aacd70 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Mon, 3 Jan 2022 18:02:41 +0100 Subject: [PATCH 021/174] manifestv2, appresources: Implement a more generic 'apply' mecanism with possible rollback --- src/app.py | 34 ++++++---- src/backup.py | 10 +++ src/tests/test_app_resources.py | 115 ++++++++++++++++++++++++++++++++ src/utils/resources.py | 97 ++++++++++++++++++++------- 4 files changed, 218 insertions(+), 38 deletions(-) create mode 100644 src/tests/test_app_resources.py diff --git a/src/app.py b/src/app.py index 2e7c428d7..2f3f3e835 100644 --- a/src/app.py +++ b/src/app.py @@ -546,6 +546,7 @@ def app_upgrade(app=[], url=None, file=None, force=False, no_safety_backup=False if manifest["packaging_format"] >= 2: if no_safety_backup: + # FIXME: i18n logger.warning("Skipping the creation of a backup prior to the upgrade.") else: # FIXME: i18n @@ -570,8 +571,17 @@ def app_upgrade(app=[], url=None, file=None, force=False, no_safety_backup=False _assert_system_is_sane_for_app(manifest, "pre") + # We'll check that the app didn't brutally edit some system configuration + manually_modified_files_before_install = manually_modified_files() + app_setting_path = os.path.join(APPS_SETTING_PATH, app_instance_name) + # Attempt to patch legacy helpers ... + _patch_legacy_helpers(extracted_app_folder) + + # Apply dirty patch to make php5 apps compatible with php7 + _patch_legacy_php_versions(extracted_app_folder) + # Prepare env. var. to pass to script env_dict = _make_environment_for_app_script( app_instance_name, workdir=extracted_app_folder, action="upgrade" @@ -582,20 +592,19 @@ def app_upgrade(app=[], url=None, file=None, force=False, no_safety_backup=False if manifest["packaging_format"] < 2: env_dict["NO_BACKUP_UPGRADE"] = "1" if no_safety_backup else "0" - # We'll check that the app didn't brutally edit some system configuration - manually_modified_files_before_install = manually_modified_files() - - # Attempt to patch legacy helpers ... - _patch_legacy_helpers(extracted_app_folder) - - # Apply dirty patch to make php5 apps compatible with php7 - _patch_legacy_php_versions(extracted_app_folder) - # Start register change on system related_to = [("app", app_instance_name)] operation_logger = OperationLogger("app_upgrade", related_to, env=env_dict) operation_logger.start() + if manifest["packaging_format"] >= 2: + from yunohost.utils.resources import AppResourceManager + try: + AppResourceManager(app_instance_name, wanted=manifest, current=app_dict["manifest"]).apply(rollback_if_failure=True) + except Exception: + # FIXME : improve error handling .... + raise + # Execute the app upgrade script upgrade_failed = True try: @@ -880,10 +889,9 @@ def app_install( if packaging_format >= 2: from yunohost.utils.resources import AppResourceManager try: - AppResourceManager(app_instance_name, wanted=manifest, current={}).apply() + AppResourceManager(app_instance_name, wanted=manifest, current={}).apply(rollback_if_failure=True) except Exception: # FIXME : improve error handling .... - AppResourceManager(app_instance_name, wanted={}, current=manifest).apply() raise else: # Initialize the main permission for the app @@ -997,7 +1005,7 @@ def app_install( if packaging_format >= 2: from yunohost.utils.resources import AppResourceManager try: - AppResourceManager(app_instance_name, wanted={}, current=manifest).apply() + AppResourceManager(app_instance_name, wanted={}, current=manifest).apply(rollback_if_failure=False) except Exception: # FIXME : improve error handling .... raise @@ -1109,7 +1117,7 @@ def app_remove(operation_logger, app, purge=False): if packaging_format >= 2: try: from yunohost.utils.resources import AppResourceManager - AppResourceManager(app, wanted={}, current=manifest).apply() + AppResourceManager(app, wanted={}, current=manifest).apply(rollback_if_failure=False) except Exception: # FIXME : improve error handling .... raise diff --git a/src/backup.py b/src/backup.py index 1e16435b4..c2d921548 100644 --- a/src/backup.py +++ b/src/backup.py @@ -49,6 +49,7 @@ from yunohost.app import ( _is_installed, _make_environment_for_app_script, _make_tmp_workdir_for_app, + _get_manifest_of_app, ) from yunohost.hook import ( hook_list, @@ -1512,6 +1513,15 @@ class RestoreManager: operation_logger.extra["env"] = env_dict operation_logger.flush() + manifest = _get_manifest_of_app(app_dir_in_archive) + if manifest["packaging_format"] >= 2: + from yunohost.utils.resources import AppResourceManager + try: + AppResourceManager(app_instance_name, wanted=manifest, current={}).apply(rollback_if_failure=True) + except Exception: + # FIXME : improve error handling .... + raise + # Execute the app install script restore_failed = True try: diff --git a/src/tests/test_app_resources.py b/src/tests/test_app_resources.py new file mode 100644 index 000000000..d3abddc7f --- /dev/null +++ b/src/tests/test_app_resources.py @@ -0,0 +1,115 @@ +import os +import pytest + +from yunohost.utils.resources import AppResource, AppResourceManager, AppResourceClassesByType + +dummyfile = "/tmp/dummyappresource-testapp" + + +class DummyAppResource(AppResource): + + type = "dummy" + + default_properties = { + "file": "/tmp/dummyappresource-__APP__", + "content": "foo", + } + + def provision_or_update(self, context): + + open(self.file, "w").write(self.content) + + if self.content == "forbiddenvalue": + raise Exception("Emeged you used the forbidden value!1!£&") + + def deprovision(self, context): + + os.system(f"rm -f {self.file}") + + +AppResourceClassesByType["dummy"] = DummyAppResource + + +def setup_function(function): + + clean() + + +def teardown_function(function): + + clean() + + +def clean(): + + os.system(f"rm -f {dummyfile}") + + +def test_provision_dummy(): + + current = {"resources": {}} + wanted = {"resources": {"dummy": {}}} + + assert not os.path.exists(dummyfile) + AppResourceManager("testapp", current=current, wanted=wanted).apply(rollback_if_failure=False) + assert open(dummyfile).read().strip() == "foo" + + +def test_deprovision_dummy(): + + current = {"resources": {"dummy": {}}} + wanted = {"resources": {}} + + open(dummyfile, "w").write("foo") + + assert open(dummyfile).read().strip() == "foo" + AppResourceManager("testapp", current=current, wanted=wanted).apply(rollback_if_failure=False) + assert not os.path.exists(dummyfile) + + +def test_provision_dummy_nondefaultvalue(): + + current = {"resources": {}} + wanted = {"resources": {"dummy": {"content": "bar"}}} + + assert not os.path.exists(dummyfile) + AppResourceManager("testapp", current=current, wanted=wanted).apply(rollback_if_failure=False) + assert open(dummyfile).read().strip() == "bar" + + +def test_update_dummy(): + + current = {"resources": {"dummy": {}}} + wanted = {"resources": {"dummy": {"content": "bar"}}} + + open(dummyfile, "w").write("foo") + + assert open(dummyfile).read().strip() == "foo" + AppResourceManager("testapp", current=current, wanted=wanted).apply(rollback_if_failure=False) + assert open(dummyfile).read().strip() == "bar" + + +def test_update_dummy_fail(): + + current = {"resources": {"dummy": {}}} + wanted = {"resources": {"dummy": {"content": "forbiddenvalue"}}} + + open(dummyfile, "w").write("foo") + + assert open(dummyfile).read().strip() == "foo" + with pytest.raises(Exception): + AppResourceManager("testapp", current=current, wanted=wanted).apply(rollback_if_failure=False) + assert open(dummyfile).read().strip() == "forbiddenvalue" + + +def test_update_dummy_failwithrollback(): + + current = {"resources": {"dummy": {}}} + wanted = {"resources": {"dummy": {"content": "forbiddenvalue"}}} + + open(dummyfile, "w").write("foo") + + assert open(dummyfile).read().strip() == "foo" + with pytest.raises(Exception): + AppResourceManager("testapp", current=current, wanted=wanted).apply(rollback_if_failure=True) + assert open(dummyfile).read().strip() == "foo" diff --git a/src/utils/resources.py b/src/utils/resources.py index 23c1a7a5a..4e9876655 100644 --- a/src/utils/resources.py +++ b/src/utils/resources.py @@ -41,30 +41,77 @@ class AppResourceManager: def __init__(self, app: str, current: Dict, wanted: Dict): self.app = app - self.current = current.get("resources", {}) - self.wanted = wanted.get("resources", {}) + self.current = current + self.wanted = wanted - # c.f. the permission ressources where we need the app label >_> - self.wanted_manifest = wanted + def apply(self, rollback_if_failure, **context): - def apply(self, **context): + todos = list(self.compute_todos()) + completed = [] + rollback = False + exception = None - for name, infos in reversed(self.current.items()): - if name not in self.wanted.keys(): - resource = AppResourceClassesByType[name](infos, self.app, self) - # FIXME : i18n, better info strings - logger.info(f"Deprovisionning {name} ...") - resource.deprovision(context=context) - - for name, infos in self.wanted.items(): - resource = AppResourceClassesByType[name](infos, self.app, self) - if name not in self.current.keys(): - # FIXME : i18n, better info strings - logger.info(f"Provisionning {name} ...") + for todo, name, old, new in todos: + try: + if todo == "deprovision": + # FIXME : i18n, better info strings + logger.info(f"Deprovisionning {name} ...") + old.deprovision(context=context) + elif todo == "provision": + logger.info(f"Provisionning {name} ...") + new.provision_or_update(context=context) + elif todo == "update": + logger.info(f"Updating {name} ...") + new.provision_or_update(context=context) + except Exception as e: + exception = e + # FIXME: better error handling ? display stacktrace ? + logger.warning(f"Failed to {todo} for {name} : {e}") + if rollback_if_failure: + rollback = True + completed.append((todo, name, old, new)) + break + else: + pass else: - # FIXME : i18n, better info strings - logger.info(f"Updating {name} ...") - resource.provision_or_update(context=context) + completed.append((todo, name, old, new)) + + if rollback: + for todo, name, old, new in completed: + try: + # (NB. here we want to undo the todo) + if todo == "deprovision": + # FIXME : i18n, better info strings + logger.info(f"Reprovisionning {name} ...") + old.provision_or_update(context=context) + elif todo == "provision": + logger.info(f"Deprovisionning {name} ...") + new.deprovision(context=context) + elif todo == "update": + logger.info(f"Reverting {name} ...") + old.provision_or_update(context=context) + except Exception as e: + # FIXME: better error handling ? display stacktrace ? + logger.error(f"Failed to rollback {name} : {e}") + + if exception: + raise exception + + def compute_todos(self): + + for name, infos in reversed(self.current["resources"].items()): + if name not in self.wanted["resources"].keys(): + resource = AppResourceClassesByType[name](infos, self.app, self) + yield ("deprovision", name, resource, None) + + for name, infos in self.wanted["resources"].items(): + wanted_resource = AppResourceClassesByType[name](infos, self.app, self) + if name not in self.current["resources"].keys(): + yield ("provision", name, None, wanted_resource) + else: + infos_ = self.current["resources"][name] + current_resource = AppResourceClassesByType[name](infos_, self.app, self) + yield ("update", name, current_resource, wanted_resource) class AppResource: @@ -179,7 +226,7 @@ class PermissionsResource(AppResource): ) # Delete legacy is_public setting if not already done - self.delete_setting(f"is_public") + self.delete_setting("is_public") existing_perms = user_permission_list(short=True, apps=[self.app])["permissions"] for perm in existing_perms: @@ -195,8 +242,8 @@ class PermissionsResource(AppResource): permission_create( f"{self.app}.{perm}", allowed=init_allowed, - # This is why the ugly hack with self.manager and wanted_manifest exists >_> - label=self.manager.wanted_manifest["name"] if perm == "main" else perm, + # This is why the ugly hack with self.manager exists >_> + label=self.manager.wanted["name"] if perm == "main" else perm, url=infos["url"], additional_urls=infos["additional_urls"], auth_header=infos["auth_header"], @@ -499,7 +546,7 @@ class AptDependenciesAppResource(AppResource): "ynh_remove_app_dependencies") -class PortAppResource(AppResource): +class PortResource(AppResource): """ is_provisioned -> port setting exists and is not the port used by another app (ie not in another app setting) is_available -> true @@ -520,7 +567,7 @@ class PortAppResource(AppResource): default_properties = { "default": 1000, - "type": "internal", # FIXME : implement logic for exposed port (allow/disallow in firewall ?) + "expose": False, # FIXME : implement logic for exposed port (allow/disallow in firewall ?) } def _port_is_used(self, port): From 55963bef2309dd37566d8e57a9ea0ec9e5518bfa Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 14 Jan 2022 21:06:05 +0100 Subject: [PATCH 022/174] Cleanup --- src/utils/resources.py | 20 +++----------------- 1 file changed, 3 insertions(+), 17 deletions(-) diff --git a/src/utils/resources.py b/src/utils/resources.py index 4e9876655..b5ddb148e 100644 --- a/src/utils/resources.py +++ b/src/utils/resources.py @@ -300,8 +300,8 @@ class SystemuserAppResource(AppResource): priority = 20 default_properties = { - "allow_ssh": [], - "allow_sftp": [] + "allow_ssh": False, + "allow_sftp": False } def provision_or_update(self, context: Dict): @@ -494,11 +494,6 @@ class DatadirAppResource(AppResource): # "main": {"url": "?", "sha256sum": "?", "predownload": True} # } # -# def validate_availability(self, context): -# # ? FIXME -# # call request.head on the url idk -# pass -# # def provision_or_update(self, context: Dict): # # FIXME # return @@ -528,11 +523,6 @@ class AptDependenciesAppResource(AppResource): "extras": {} } - def validate_availability(self, context): - # ? FIXME - # call helpers idk ... - pass - def provision_or_update(self, context: Dict): # FIXME : implement 'extras' management @@ -568,6 +558,7 @@ class PortResource(AppResource): default_properties = { "default": 1000, "expose": False, # FIXME : implement logic for exposed port (allow/disallow in firewall ?) + # "protocol": "tcp", } def _port_is_used(self, port): @@ -617,11 +608,6 @@ class PortResource(AppResource): # "type": "mysql" # } # -# def validate_availability(self, context): -# # FIXME : checking availability sort of imply that mysql / postgresql is installed -# # or we gotta make sure mariadb-server or postgresql is gonna be installed (apt resource) -# pass -# # def provision_or_update(self, context: str): # raise NotImplementedError() # From 33d4dc9749a567c3526599109f020e81d6686cad Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 14 Jan 2022 21:41:02 +0100 Subject: [PATCH 023/174] apt resources: Yoloimplement extras repo management --- src/utils/resources.py | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-) diff --git a/src/utils/resources.py b/src/utils/resources.py index b5ddb148e..c28f09390 100644 --- a/src/utils/resources.py +++ b/src/utils/resources.py @@ -30,7 +30,7 @@ from moulinette.utils.filesystem import ( rm, ) -from yunohost.utils.error import YunohostError, YunohostValidationError +from yunohost.utils.error import YunohostError from yunohost.hook import hook_exec logger = getActionLogger("yunohost.app_resources") @@ -210,7 +210,7 @@ class PermissionsResource(AppResource): properties[perm]["show_tile"] = bool(properties[perm]["url"]) if isinstance(properties["main"]["url"], str) and properties["main"]["url"] != "/": - raise YunohostError("URL for the 'main' permission should be '/' for webapps (or undefined/None for non-webapps). Note that / refers to the install url of the app") + raise YunohostValidationError("URL for the 'main' permission should be '/' for webapps (or undefined/None for non-webapps). Note that / refers to the install url of the app") super().__init__({"permissions": properties}, *args, **kwargs) @@ -523,17 +523,25 @@ class AptDependenciesAppResource(AppResource): "extras": {} } + def __init__(self, properties: Dict[str, Any], *args, **kwargs): + + for key, values in properties.get("extras", {}).items(): + if not all(isinstance(values.get(k), str) for k in ["repo", "key", "packages"]): + raise YunohostError("In apt resource in the manifest: 'extras' repo should have the keys 'repo', 'key' and 'packages' defined and be strings") + + super().__init__(properties, *args, **kwargs) + def provision_or_update(self, context: Dict): - # FIXME : implement 'extras' management - self._run_script("provision_or_update", - "ynh_install_app_dependencies $apt_dependencies", - {"apt_dependencies": self.packages}) + script = [f"ynh_install_app_dependencies {self.packages}"] + for repo, values in self.extras.items(): + script += [f"ynh_install_extra_app_dependencies --repo='{values['repo']}' --key='{values['key']}' --package='{values['packages']}'"] + + self._run_script("provision_or_update", '\n'.join(script)) def deprovision(self, context: Dict): - self._run_script("deprovision", - "ynh_remove_app_dependencies") + self._run_script("deprovision", "ynh_remove_app_dependencies") class PortResource(AppResource): From 13fb471f29b57a024df04f8bfbd20e299c4c066d Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 14 Jan 2022 21:58:11 +0100 Subject: [PATCH 024/174] install_dir resource: automigrate from final path value --- src/utils/resources.py | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/src/utils/resources.py b/src/utils/resources.py index c28f09390..73dd98380 100644 --- a/src/utils/resources.py +++ b/src/utils/resources.py @@ -374,17 +374,15 @@ class InstalldirAppResource(AppResource): default_properties = { "dir": "/var/www/__APP__", # FIXME or choose to move this elsewhere nowadays idk... - "alias": None, "owner": "__APP__:rx", "group": "__APP__:rx", } # FIXME: change default dir to /opt/stuff if app ain't a webapp ... - # FIXME: what do in a scenario where the location changed def provision_or_update(self, context: Dict): - current_install_dir = self.get_setting("install_dir") + current_install_dir = self.get_setting("install_dir") or self.get_setting("final_path") # If during install, /var/www/$app already exists, assume that it's okay to remove and recreate it # FIXME : is this the right thing to do ? @@ -393,6 +391,7 @@ class InstalldirAppResource(AppResource): if not os.path.isdir(self.dir): # Handle case where install location changed, in which case we shall move the existing install dir + # FIXME: confirm that's what we wanna do if current_install_dir and os.path.isdir(current_install_dir): shutil.move(current_install_dir, self.dir) else: @@ -406,10 +405,10 @@ class InstalldirAppResource(AppResource): chmod(self.dir, int(perm_octal)) chown(self.dir, owner, group) + # FIXME: shall we apply permissions recursively ? self.set_setting("install_dir", self.dir) - if self.alias: - self.set_setting(self.alias, self.dir) + self.delete_setting("final_path") # Legacy def deprovision(self, context: Dict): # FIXME : check that self.dir has a sensible value to prevent catastrophes From b68e99b2c0e4d43f2cfad184c3bc9ef38ccdd37a Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 14 Jan 2022 23:02:50 +0100 Subject: [PATCH 025/174] app resources: Yoloimplement support for db resources --- src/utils/resources.py | 107 ++++++++++++++++++++++++++++++----------- 1 file changed, 79 insertions(+), 28 deletions(-) diff --git a/src/utils/resources.py b/src/utils/resources.py index 73dd98380..45c76acd8 100644 --- a/src/utils/resources.py +++ b/src/utils/resources.py @@ -593,33 +593,84 @@ class PortResource(AppResource): self.delete_setting("port") -#class DBAppResource(AppResource): -# """ -# is_provisioned -> setting db_user, db_name, db_pwd exists -# is_available -> db doesn't already exists ( ... also gotta make sure that mysql / postgresql is indeed installed ... or will be after apt provisions it) -# -# provision -> setup the db + init the setting -# update -> ?? -# -# deprovision -> delete the db -# -# deep_clean -> ... idk look into any db name that would not be related to any app ... -# -# backup -> dump db -# restore -> setup + inject db dump -# """ -# -# type = "db" -# -# default_properties = { -# "type": "mysql" -# } -# -# def provision_or_update(self, context: str): -# raise NotImplementedError() -# -# def deprovision(self, context: Dict): -# raise NotImplementedError() -# +class DBAppResource(AppResource): + """ + is_provisioned -> setting db_user, db_name, db_pwd exists + is_available -> db doesn't already exists ( ... also gotta make sure that mysql / postgresql is indeed installed ... or will be after apt provisions it) + + provision -> setup the db + init the setting + update -> ?? + + deprovision -> delete the db + + deep_clean -> ... idk look into any db name that would not be related to any app ... + + backup -> dump db + restore -> setup + inject db dump + """ + + type = "db" + + default_properties = { + "type": None, + } + + def __init__(self, properties: Dict[str, Any], *args, **kwargs): + + if "type" not in properties or properties["type"] not in ["mysql", "postgresql"]: + raise YunohostError("Specifying the type of db ('mysql' or 'postgresql') is mandatory for db resources") + + super().__init__(properties, *args, **kwargs) + + def db_exists(self, db_name): + + if self.type == "mysql": + return os.system(f"mysqlshow '{db_name}' >/dev/null 2>/dev/null") == 0 + elif self.type == "postgresql": + return os.system(f"sudo --login --user=postgres psql -c '' '{db_name}' >/dev/null 2>/dev/null") == 0 + else: + return False + + def provision_or_update(self, context: str): + + # This is equivalent to ynh_sanitize_dbid + db_name = self.app.replace('-', '_').replace('.', '_') + db_user = db_name + self.set_setting("db_name", db_name) + self.set_setting("db_user", db_user) + + db_pwd = None + if self.get_setting("db_pwd"): + db_pwd = self.get_setting("db_pwd") + else: + # Legacy setting migration + legacypasswordsetting = "psqlpwd" if self.type == "postgresql" else "mysqlpwd" + if self.get_setting(legacypasswordsetting): + db_pwd = self.get_setting(legacypasswordsetting) + self.delete_setting(legacypasswordsetting) + self.set_setting("db_pwd", db_pwd) + + if not db_pwd: + from moulinette.utils.text import random_ascii + db_pwd = random_ascii(24) + self.set_setting("db_pwd", db_pwd) + + if not self.db_exists(db_name): + + if self.type == "mysql": + self._run_script("provision", f"ynh_mysql_create_db '{db_name}' '{db_user}' '{db_pwd}'") + elif self.type == "postgresql": + self._run_script("provision", f"ynh_psql_create_user '{db_user}' '{db_pwd}'; ynh_psql_create_db '{db_name}' '{db_user}'") + + def deprovision(self, context: Dict): + + db_name = self.app.replace('-', '_').replace('.', '_') + db_user = db_name + + if self.type == "mysql": + self._run_script("deprovision", f"ynh_mysql_remove_db '{db_name}' '{db_user}'") + elif self.type == "postgresql": + self._run_script("deprovision", f"ynh_psql_remove_db '{db_name}' '{db_user}'") + AppResourceClassesByType = {c.type: c for c in AppResource.__subclasses__()} From 8bc23e6f595f3563eac0389c0efaada1e8d15296 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sat, 15 Jan 2022 19:18:21 +0100 Subject: [PATCH 026/174] app resources: Yoloimplement some tests for each resources --- src/tests/test_app_resources.py | 197 ++++++++++++++++++++++++++++++++ src/utils/resources.py | 16 ++- 2 files changed, 208 insertions(+), 5 deletions(-) diff --git a/src/tests/test_app_resources.py b/src/tests/test_app_resources.py index d3abddc7f..69e93a5ed 100644 --- a/src/tests/test_app_resources.py +++ b/src/tests/test_app_resources.py @@ -1,6 +1,9 @@ import os import pytest +from moulinette.utils.process import check_output + +from yunohost.app import app_setting from yunohost.utils.resources import AppResource, AppResourceManager, AppResourceClassesByType dummyfile = "/tmp/dummyappresource-testapp" @@ -43,6 +46,7 @@ def teardown_function(function): def clean(): os.system(f"rm -f {dummyfile}") + os.system("apt remove lolcat sl nyancat yarn") def test_provision_dummy(): @@ -113,3 +117,196 @@ def test_update_dummy_failwithrollback(): with pytest.raises(Exception): AppResourceManager("testapp", current=current, wanted=wanted).apply(rollback_if_failure=True) assert open(dummyfile).read().strip() == "foo" + + +def test_resource_system_user(): + + r = AppResourceClassesByType["system_user"] + + conf = {} + + assert os.system("getent passwd testapp &>/dev/null") != 0 + + r(conf, "testapp").provision_or_update() + + assert os.system("getent passwd testapp &>/dev/null") == 0 + assert os.system("getent group testapp | grep -q sftp.app") != 0 + + conf["allow_sftp"] = True + r(conf, "testapp").provision_or_update() + + assert os.system("getent passwd testapp &>/dev/null") == 0 + assert os.system("getent group testapp | grep -q sftp.app") == 0 + + r(conf, "testapp").deprovision() + + assert os.system("getent passwd testapp &>/dev/null") != 0 + + +def test_resource_install_dir(): + + r = AppResourceClassesByType["install_dir"] + conf = {} + + # FIXME: should also check settings ? + # FIXME: should also check automigrate from final_path + # FIXME: should also test changing the install folder location ? + + assert not os.path.exists("/var/www/testapp") + + r(conf, "testapp").provision_or_update() + + assert os.path.exists("/var/www/testapp") + unixperms = check_output("ls -ld /var/www/testapp").split() + assert unixperms[0] == "dr-xr-x---" + assert unixperms[2] == "testapp" + assert unixperms[3] == "testapp" + + conf["group"] = "__APP__:rwx" + conf["group"] = "www-data:x" + + r(conf, "testapp").provision_or_update() + + assert os.path.exists("/var/www/testapp") + unixperms = check_output("ls -ld /var/www/testapp").split() + assert unixperms[0] == "drwx--x---" + assert unixperms[2] == "testapp" + assert unixperms[3] == "www-data" + + r(conf, "testapp").deprovision() + + assert not os.path.exists("/var/www/testapp") + + +def test_resource_data_dir(): + + r = AppResourceClassesByType["data_dir"] + conf = {} + + assert not os.path.exists("/home/yunohost.app/testapp") + + r(conf, "testapp").provision_or_update() + + assert os.path.exists("/home/yunohost.app/testapp") + unixperms = check_output("ls -ld /home/yunohost.app/testapp").split() + assert unixperms[0] == "dr-xr-x---" + assert unixperms[2] == "testapp" + assert unixperms[3] == "testapp" + + conf["group"] = "__APP__:rwx" + conf["group"] = "www-data:x" + + r(conf, "testapp").provision_or_update() + + assert os.path.exists("/home/yunohost.app/testapp") + unixperms = check_output("ls -ld /home/yunohost.app/testapp").split() + assert unixperms[0] == "drwx--x---" + assert unixperms[2] == "testapp" + assert unixperms[3] == "www-data" + + r(conf, "testapp").deprovision() + + assert not os.path.exists("/home/yunohost.app/testapp") + + +def test_resource_port(): + + r = AppResourceClassesByType["port"] + conf = {} + + assert not app_setting("testapp", "port") + + r(conf, "testapp").provision_or_update() + + assert app_setting("testapp", "port") + + r(conf, "testapp").deprovision() + + assert not app_setting("testapp", "port") + + +def test_resource_database(): + + r = AppResourceClassesByType["database"] + conf = {"type": "mysql"} + + assert os.system("mysqlshow 'testapp' >/dev/null 2>/dev/null") != 0 + assert not app_setting("testapp", "db_name") + assert not app_setting("testapp", "db_user") + assert not app_setting("testapp", "db_pwd") + + r(conf, "testapp").provision_or_update() + + assert os.system("mysqlshow 'testapp' >/dev/null 2>/dev/null") == 0 + assert app_setting("testapp", "db_name") + assert app_setting("testapp", "db_user") + assert app_setting("testapp", "db_pwd") + + r(conf, "testapp").deprovision() + + assert os.system("mysqlshow 'testapp' >/dev/null 2>/dev/null") != 0 + assert not app_setting("testapp", "db_name") + assert not app_setting("testapp", "db_user") + assert not app_setting("testapp", "db_pwd") + + +def test_resource_apt(): + + r = AppResourceClassesByType["apt"] + conf = { + "packages": "nyancat, sl", + "extras": { + "yarn": { + "repo": "deb https://dl.yarnpkg.com/debian/ stable main", + "key": "https://dl.yarnpkg.com/debian/pubkey.gpg", + "packages": "yarn", + } + } + } + + assert os.system("dpkg --list | grep -q 'ii *nyancat'") != 0 + assert os.system("dpkg --list | grep -q 'ii *sl'") != 0 + assert os.system("dpkg --list | grep -q 'ii *yarn'") != 0 + assert os.system("dpkg --list | grep -q 'ii *lolcat'") != 0 + assert os.system("dpkg --list | grep -q 'ii *testapp-ynh-deps'") != 0 + + r(conf, "testapp").provision_or_update() + + assert os.system("dpkg --list | grep -q 'ii *nyancat'") == 0 + assert os.system("dpkg --list | grep -q 'ii *sl'") == 0 + assert os.system("dpkg --list | grep -q 'ii *yarn'") == 0 + assert os.system("dpkg --list | grep -q 'ii *lolcat'") != 0 # Lolcat shouldnt be installed yet + assert os.system("dpkg --list | grep -q 'ii *testapp-ynh-deps'") == 0 + + conf["packages"] += ", lolcat" + r(conf, "testapp").provision_or_update() + + assert os.system("dpkg --list | grep -q 'ii *nyancat'") != 0 + assert os.system("dpkg --list | grep -q 'ii *sl'") != 0 + assert os.system("dpkg --list | grep -q 'ii *yarn'") != 0 + assert os.system("dpkg --list | grep -q 'ii *lolcat'") == 0 + assert os.system("dpkg --list | grep -q 'ii *testapp-ynh-deps'") != 0 + + r(conf, "testapp").deprovision() + + assert os.system("dpkg --list | grep -q 'ii *nyancat'") != 0 + assert os.system("dpkg --list | grep -q 'ii *sl'") != 0 + assert os.system("dpkg --list | grep -q 'ii *yarn'") != 0 + assert os.system("dpkg --list | grep -q 'ii *lolcat'") != 0 + assert os.system("dpkg --list | grep -q 'ii *testapp-ynh-deps'") != 0 + + +def test_resource_permissions(): + + r = AppResourceClassesByType["permissions"] + conf = { + "main": { + "url": "/", + "allowed": "visitors" + # protected? + } + } + + pass + + diff --git a/src/utils/resources.py b/src/utils/resources.py index 45c76acd8..b4ec95bf8 100644 --- a/src/utils/resources.py +++ b/src/utils/resources.py @@ -116,7 +116,7 @@ class AppResourceManager: class AppResource: - def __init__(self, properties: Dict[str, Any], app: str, manager: str): + def __init__(self, properties: Dict[str, Any], app: str, manager=None): self.app = app self.manager = manager @@ -203,6 +203,8 @@ class PermissionsResource(AppResource): def __init__(self, properties: Dict[str, Any], *args, **kwargs): + # FIXME : if url != None, we should check that there's indeed a domain/path defined ? ie that app is a webapp + for perm, infos in properties.items(): properties[perm] = copy.copy(self.default_perm_properties) properties[perm].update(infos) @@ -210,7 +212,7 @@ class PermissionsResource(AppResource): properties[perm]["show_tile"] = bool(properties[perm]["url"]) if isinstance(properties["main"]["url"], str) and properties["main"]["url"] != "/": - raise YunohostValidationError("URL for the 'main' permission should be '/' for webapps (or undefined/None for non-webapps). Note that / refers to the install url of the app") + raise YunohostError("URL for the 'main' permission should be '/' for webapps (or undefined/None for non-webapps). Note that / refers to the install url of the app") super().__init__({"permissions": properties}, *args, **kwargs) @@ -414,6 +416,7 @@ class InstalldirAppResource(AppResource): # FIXME : check that self.dir has a sensible value to prevent catastrophes if os.path.isdir(self.dir): rm(self.dir, recursive=True) + # FIXME : in fact we should delete settings to be consistent class DatadirAppResource(AppResource): @@ -468,6 +471,7 @@ class DatadirAppResource(AppResource): pass #if os.path.isdir(self.dir): # rm(self.dir, recursive=True) + # FIXME : in fact we should delete settings to be consistent # @@ -563,7 +567,7 @@ class PortResource(AppResource): priority = 70 default_properties = { - "default": 1000, + "default": 5000, "expose": False, # FIXME : implement logic for exposed port (allow/disallow in firewall ?) # "protocol": "tcp", } @@ -593,7 +597,7 @@ class PortResource(AppResource): self.delete_setting("port") -class DBAppResource(AppResource): +class DatabaseAppResource(AppResource): """ is_provisioned -> setting db_user, db_name, db_pwd exists is_available -> db doesn't already exists ( ... also gotta make sure that mysql / postgresql is indeed installed ... or will be after apt provisions it) @@ -609,7 +613,7 @@ class DBAppResource(AppResource): restore -> setup + inject db dump """ - type = "db" + type = "database" default_properties = { "type": None, @@ -672,5 +676,7 @@ class DBAppResource(AppResource): elif self.type == "postgresql": self._run_script("deprovision", f"ynh_psql_remove_db '{db_name}' '{db_user}'") + # FIXME : in fact we should delete settings to be consistent + AppResourceClassesByType = {c.type: c for c in AppResource.__subclasses__()} From 011c2059a55b10a56ce78e2d5cb17bd3d128b47a Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sun, 16 Jan 2022 03:34:53 +0100 Subject: [PATCH 027/174] appresources: fixes /o\ --- src/tests/test_app_resources.py | 88 +++++++++++++++++++-------------- src/utils/resources.py | 43 ++++++++-------- 2 files changed, 73 insertions(+), 58 deletions(-) diff --git a/src/tests/test_app_resources.py b/src/tests/test_app_resources.py index 69e93a5ed..638f6b119 100644 --- a/src/tests/test_app_resources.py +++ b/src/tests/test_app_resources.py @@ -37,6 +37,11 @@ def setup_function(function): clean() + os.system("mkdir /etc/yunohost/apps/testapp") + os.system("echo 'id: testapp' > /etc/yunohost/apps/testapp/settings.yml") + os.system("echo 'packaging_format = 2' > /etc/yunohost/apps/testapp/manifest.toml") + os.system("echo 'id = \"testapp\"' >> /etc/yunohost/apps/testapp/manifest.toml") + def teardown_function(function): @@ -46,7 +51,11 @@ def teardown_function(function): def clean(): os.system(f"rm -f {dummyfile}") - os.system("apt remove lolcat sl nyancat yarn") + os.system("rm -rf /etc/yunohost/apps/testapp") + os.system("rm -rf /var/www/testapp") + os.system("rm -rf /home/yunohost.app/testapp") + os.system("apt remove lolcat sl nyancat yarn >/dev/null 2>/dev/null") + os.system("userdel testapp 2>/dev/null") def test_provision_dummy(): @@ -125,28 +134,28 @@ def test_resource_system_user(): conf = {} - assert os.system("getent passwd testapp &>/dev/null") != 0 + assert os.system("getent passwd testapp 2>/dev/null") != 0 r(conf, "testapp").provision_or_update() - assert os.system("getent passwd testapp &>/dev/null") == 0 - assert os.system("getent group testapp | grep -q sftp.app") != 0 + assert os.system("getent passwd testapp >/dev/null") == 0 + assert os.system("groups testapp | grep -q 'sftp.app'") != 0 conf["allow_sftp"] = True r(conf, "testapp").provision_or_update() - assert os.system("getent passwd testapp &>/dev/null") == 0 - assert os.system("getent group testapp | grep -q sftp.app") == 0 + assert os.system("getent passwd testapp >/dev/null") == 0 + assert os.system("groups testapp | grep -q 'sftp.app'") == 0 r(conf, "testapp").deprovision() - assert os.system("getent passwd testapp &>/dev/null") != 0 + assert os.system("getent passwd testapp 2>/dev/null") != 0 def test_resource_install_dir(): r = AppResourceClassesByType["install_dir"] - conf = {} + conf = {"owner": "nobody:rx", "group": "nogroup:rx"} # FIXME: should also check settings ? # FIXME: should also check automigrate from final_path @@ -159,10 +168,10 @@ def test_resource_install_dir(): assert os.path.exists("/var/www/testapp") unixperms = check_output("ls -ld /var/www/testapp").split() assert unixperms[0] == "dr-xr-x---" - assert unixperms[2] == "testapp" - assert unixperms[3] == "testapp" + assert unixperms[2] == "nobody" + assert unixperms[3] == "nogroup" - conf["group"] = "__APP__:rwx" + conf["owner"] = "nobody:rwx" conf["group"] = "www-data:x" r(conf, "testapp").provision_or_update() @@ -170,7 +179,7 @@ def test_resource_install_dir(): assert os.path.exists("/var/www/testapp") unixperms = check_output("ls -ld /var/www/testapp").split() assert unixperms[0] == "drwx--x---" - assert unixperms[2] == "testapp" + assert unixperms[2] == "nobody" assert unixperms[3] == "www-data" r(conf, "testapp").deprovision() @@ -181,7 +190,7 @@ def test_resource_install_dir(): def test_resource_data_dir(): r = AppResourceClassesByType["data_dir"] - conf = {} + conf = {"owner": "nobody:rx", "group": "nogroup:rx"} assert not os.path.exists("/home/yunohost.app/testapp") @@ -190,10 +199,10 @@ def test_resource_data_dir(): assert os.path.exists("/home/yunohost.app/testapp") unixperms = check_output("ls -ld /home/yunohost.app/testapp").split() assert unixperms[0] == "dr-xr-x---" - assert unixperms[2] == "testapp" - assert unixperms[3] == "testapp" + assert unixperms[2] == "nobody" + assert unixperms[3] == "nogroup" - conf["group"] = "__APP__:rwx" + conf["owner"] = "nobody:rwx" conf["group"] = "www-data:x" r(conf, "testapp").provision_or_update() @@ -201,12 +210,13 @@ def test_resource_data_dir(): assert os.path.exists("/home/yunohost.app/testapp") unixperms = check_output("ls -ld /home/yunohost.app/testapp").split() assert unixperms[0] == "drwx--x---" - assert unixperms[2] == "testapp" + assert unixperms[2] == "nobody" assert unixperms[3] == "www-data" r(conf, "testapp").deprovision() - assert not os.path.exists("/home/yunohost.app/testapp") + # FIXME : implement and check purge option + #assert not os.path.exists("/home/yunohost.app/testapp") def test_resource_port(): @@ -264,40 +274,42 @@ def test_resource_apt(): } } - assert os.system("dpkg --list | grep -q 'ii *nyancat'") != 0 - assert os.system("dpkg --list | grep -q 'ii *sl'") != 0 - assert os.system("dpkg --list | grep -q 'ii *yarn'") != 0 - assert os.system("dpkg --list | grep -q 'ii *lolcat'") != 0 - assert os.system("dpkg --list | grep -q 'ii *testapp-ynh-deps'") != 0 + assert os.system("dpkg --list | grep -q 'ii *nyancat '") != 0 + assert os.system("dpkg --list | grep -q 'ii *sl '") != 0 + assert os.system("dpkg --list | grep -q 'ii *yarn '") != 0 + assert os.system("dpkg --list | grep -q 'ii *lolcat '") != 0 + assert os.system("dpkg --list | grep -q 'ii *testapp-ynh-deps '") != 0 r(conf, "testapp").provision_or_update() - assert os.system("dpkg --list | grep -q 'ii *nyancat'") == 0 - assert os.system("dpkg --list | grep -q 'ii *sl'") == 0 - assert os.system("dpkg --list | grep -q 'ii *yarn'") == 0 - assert os.system("dpkg --list | grep -q 'ii *lolcat'") != 0 # Lolcat shouldnt be installed yet - assert os.system("dpkg --list | grep -q 'ii *testapp-ynh-deps'") == 0 + assert os.system("dpkg --list | grep -q 'ii *nyancat '") == 0 + assert os.system("dpkg --list | grep -q 'ii *sl '") == 0 + assert os.system("dpkg --list | grep -q 'ii *yarn '") == 0 + assert os.system("dpkg --list | grep -q 'ii *lolcat '") != 0 # Lolcat shouldnt be installed yet + assert os.system("dpkg --list | grep -q 'ii *testapp-ynh-deps '") == 0 conf["packages"] += ", lolcat" r(conf, "testapp").provision_or_update() - assert os.system("dpkg --list | grep -q 'ii *nyancat'") != 0 - assert os.system("dpkg --list | grep -q 'ii *sl'") != 0 - assert os.system("dpkg --list | grep -q 'ii *yarn'") != 0 - assert os.system("dpkg --list | grep -q 'ii *lolcat'") == 0 - assert os.system("dpkg --list | grep -q 'ii *testapp-ynh-deps'") != 0 + assert os.system("dpkg --list | grep -q 'ii *nyancat '") == 0 + assert os.system("dpkg --list | grep -q 'ii *sl '") == 0 + assert os.system("dpkg --list | grep -q 'ii *yarn '") == 0 + assert os.system("dpkg --list | grep -q 'ii *lolcat '") == 0 + assert os.system("dpkg --list | grep -q 'ii *testapp-ynh-deps '") == 0 r(conf, "testapp").deprovision() - assert os.system("dpkg --list | grep -q 'ii *nyancat'") != 0 - assert os.system("dpkg --list | grep -q 'ii *sl'") != 0 - assert os.system("dpkg --list | grep -q 'ii *yarn'") != 0 - assert os.system("dpkg --list | grep -q 'ii *lolcat'") != 0 - assert os.system("dpkg --list | grep -q 'ii *testapp-ynh-deps'") != 0 + assert os.system("dpkg --list | grep -q 'ii *nyancat '") != 0 + assert os.system("dpkg --list | grep -q 'ii *sl '") != 0 + assert os.system("dpkg --list | grep -q 'ii *yarn '") != 0 + assert os.system("dpkg --list | grep -q 'ii *lolcat '") != 0 + assert os.system("dpkg --list | grep -q 'ii *testapp-ynh-deps '") != 0 def test_resource_permissions(): + raise NotImplementedError() + r = AppResourceClassesByType["permissions"] conf = { "main": { diff --git a/src/utils/resources.py b/src/utils/resources.py index b4ec95bf8..1391e9c4a 100644 --- a/src/utils/resources.py +++ b/src/utils/resources.py @@ -216,7 +216,7 @@ class PermissionsResource(AppResource): super().__init__({"permissions": properties}, *args, **kwargs) - def provision_or_update(self, context: Dict): + def provision_or_update(self, context: Dict={}): from yunohost.permission import ( permission_create, @@ -267,7 +267,7 @@ class PermissionsResource(AppResource): permission_sync_to_user() - def deprovision(self, context: Dict): + def deprovision(self, context: Dict={}): from yunohost.permission import ( permission_delete, @@ -306,7 +306,7 @@ class SystemuserAppResource(AppResource): "allow_sftp": False } - def provision_or_update(self, context: Dict): + def provision_or_update(self, context: Dict={}): # FIXME : validate that no yunohost user exists with that name? # and/or that no system user exists during install ? @@ -328,7 +328,7 @@ class SystemuserAppResource(AppResource): os.system(f"usermod -G {','.join(groups)} {self.app}") - def deprovision(self, context: Dict): + def deprovision(self, context: Dict={}): if check_output(f"getent passwd {self.app} &>/dev/null || true").strip(): os.system(f"deluser {self.app} >/dev/null") @@ -382,7 +382,7 @@ class InstalldirAppResource(AppResource): # FIXME: change default dir to /opt/stuff if app ain't a webapp ... - def provision_or_update(self, context: Dict): + def provision_or_update(self, context: Dict={}): current_install_dir = self.get_setting("install_dir") or self.get_setting("final_path") @@ -403,16 +403,17 @@ class InstalldirAppResource(AppResource): group, group_perm = self.group.split(":") owner_perm_octal = (4 if "r" in owner_perm else 0) + (2 if "w" in owner_perm else 0) + (1 if "x" in owner_perm else 0) group_perm_octal = (4 if "r" in group_perm else 0) + (2 if "w" in group_perm else 0) + (1 if "x" in group_perm else 0) - perm_octal = str(owner_perm_octal) + str(group_perm_octal) + "0" - chmod(self.dir, int(perm_octal)) + perm_octal = 0o100 * owner_perm_octal + 0o010 * group_perm_octal + + chmod(self.dir, perm_octal) chown(self.dir, owner, group) # FIXME: shall we apply permissions recursively ? self.set_setting("install_dir", self.dir) self.delete_setting("final_path") # Legacy - def deprovision(self, context: Dict): + def deprovision(self, context: Dict={}): # FIXME : check that self.dir has a sensible value to prevent catastrophes if os.path.isdir(self.dir): rm(self.dir, recursive=True) @@ -444,7 +445,7 @@ class DatadirAppResource(AppResource): "group": "__APP__:rx", } - def provision_or_update(self, context: Dict): + def provision_or_update(self, context: Dict={}): current_data_dir = self.get_setting("data_dir") @@ -459,14 +460,14 @@ class DatadirAppResource(AppResource): group, group_perm = self.group.split(":") owner_perm_octal = (4 if "r" in owner_perm else 0) + (2 if "w" in owner_perm else 0) + (1 if "x" in owner_perm else 0) group_perm_octal = (4 if "r" in group_perm else 0) + (2 if "w" in group_perm else 0) + (1 if "x" in group_perm else 0) - perm_octal = str(owner_perm_octal) + str(group_perm_octal) + "0" + perm_octal = 0o100 * owner_perm_octal + 0o010 * group_perm_octal - chmod(self.dir, int(perm_octal)) + chmod(self.dir, perm_octal) chown(self.dir, owner, group) self.set_setting("data_dir", self.dir) - def deprovision(self, context: Dict): + def deprovision(self, context: Dict={}): # FIXME: This should rm the datadir only if purge is enabled pass #if os.path.isdir(self.dir): @@ -497,7 +498,7 @@ class DatadirAppResource(AppResource): # "main": {"url": "?", "sha256sum": "?", "predownload": True} # } # -# def provision_or_update(self, context: Dict): +# def provision_or_update(self, context: Dict={}): # # FIXME # return # @@ -534,7 +535,7 @@ class AptDependenciesAppResource(AppResource): super().__init__(properties, *args, **kwargs) - def provision_or_update(self, context: Dict): + def provision_or_update(self, context: Dict={}): script = [f"ynh_install_app_dependencies {self.packages}"] for repo, values in self.extras.items(): @@ -542,7 +543,7 @@ class AptDependenciesAppResource(AppResource): self._run_script("provision_or_update", '\n'.join(script)) - def deprovision(self, context: Dict): + def deprovision(self, context: Dict={}): self._run_script("deprovision", "ynh_remove_app_dependencies") @@ -580,7 +581,7 @@ class PortResource(AppResource): cmd2 = f"grep --quiet \"port: '{port}'\" /etc/yunohost/apps/*/settings.yml" return os.system(cmd1) == 0 and os.system(cmd2) == 0 - def provision_or_update(self, context: str): + def provision_or_update(self, context: Dict={}): # Don't do anything if port already defined ? if self.get_setting("port"): @@ -592,7 +593,7 @@ class PortResource(AppResource): self.set_setting("port", port) - def deprovision(self, context: Dict): + def deprovision(self, context: Dict={}): self.delete_setting("port") @@ -635,7 +636,7 @@ class DatabaseAppResource(AppResource): else: return False - def provision_or_update(self, context: str): + def provision_or_update(self, context: Dict={}): # This is equivalent to ynh_sanitize_dbid db_name = self.app.replace('-', '_').replace('.', '_') @@ -666,7 +667,7 @@ class DatabaseAppResource(AppResource): elif self.type == "postgresql": self._run_script("provision", f"ynh_psql_create_user '{db_user}' '{db_pwd}'; ynh_psql_create_db '{db_name}' '{db_user}'") - def deprovision(self, context: Dict): + def deprovision(self, context: Dict={}): db_name = self.app.replace('-', '_').replace('.', '_') db_user = db_name @@ -676,7 +677,9 @@ class DatabaseAppResource(AppResource): elif self.type == "postgresql": self._run_script("deprovision", f"ynh_psql_remove_db '{db_name}' '{db_user}'") - # FIXME : in fact we should delete settings to be consistent + self.delete_setting("db_name") + self.delete_setting("db_user") + self.delete_setting("db_pwd") AppResourceClassesByType = {c.type: c for c in AppResource.__subclasses__()} From 9ed5b66bb403874c3b8f18b84900950e6680414d Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sat, 22 Jan 2022 16:21:47 +0100 Subject: [PATCH 028/174] Fixes /o\ --- src/migrations/0021_migrate_to_bullseye.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/migrations/0021_migrate_to_bullseye.py b/src/migrations/0021_migrate_to_bullseye.py index f4361cb19..b2abbb026 100644 --- a/src/migrations/0021_migrate_to_bullseye.py +++ b/src/migrations/0021_migrate_to_bullseye.py @@ -15,8 +15,8 @@ from yunohost.tools import ( ) from yunohost.app import unstable_apps from yunohost.regenconf import manually_modified_files, _force_clear_hashes -from yunohost.utils.filesystem import free_space_in_directory -from yunohost.utils.packages import ( +from yunohost.utils.system import ( + free_space_in_directory, get_ynh_package_version, _list_upgradable_apt_packages, ) From d9873e085d5327147633525ca3485a0993cbd235 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 28 Jan 2022 21:21:41 +0100 Subject: [PATCH 029/174] app resources: Support several ports --- src/tests/test_app_resources.py | 23 ++++++++++++-- src/utils/resources.py | 55 +++++++++++++++++++++++++-------- 2 files changed, 63 insertions(+), 15 deletions(-) diff --git a/src/tests/test_app_resources.py b/src/tests/test_app_resources.py index 638f6b119..f53cf373e 100644 --- a/src/tests/test_app_resources.py +++ b/src/tests/test_app_resources.py @@ -219,9 +219,9 @@ def test_resource_data_dir(): #assert not os.path.exists("/home/yunohost.app/testapp") -def test_resource_port(): +def test_resource_ports(): - r = AppResourceClassesByType["port"] + r = AppResourceClassesByType["ports"] conf = {} assert not app_setting("testapp", "port") @@ -235,6 +235,25 @@ def test_resource_port(): assert not app_setting("testapp", "port") +def test_resource_ports_several(): + + r = AppResourceClassesByType["ports"] + conf = {"main.default": 12345, "foobar.default": 23456} + + assert not app_setting("testapp", "port") + assert not app_setting("testapp", "port_foobar") + + r(conf, "testapp").provision_or_update() + + assert app_setting("testapp", "port") + assert app_setting("testapp", "port_foobar") + + r(conf, "testapp").deprovision() + + assert not app_setting("testapp", "port") + assert not app_setting("testapp", "port_foobar") + + def test_resource_database(): r = AppResourceClassesByType["database"] diff --git a/src/utils/resources.py b/src/utils/resources.py index 1391e9c4a..b7d3c1694 100644 --- a/src/utils/resources.py +++ b/src/utils/resources.py @@ -21,6 +21,7 @@ import os import copy import shutil +import random from typing import Dict, Any from moulinette.utils.process import check_output @@ -548,7 +549,7 @@ class AptDependenciesAppResource(AppResource): self._run_script("deprovision", "ynh_remove_app_dependencies") -class PortResource(AppResource): +class PortsResource(AppResource): """ is_provisioned -> port setting exists and is not the port used by another app (ie not in another app setting) is_available -> true @@ -564,15 +565,32 @@ class PortResource(AppResource): restore -> nothing (restore port setting) """ - type = "port" + type = "ports" priority = 70 default_properties = { - "default": 5000, - "expose": False, # FIXME : implement logic for exposed port (allow/disallow in firewall ?) - # "protocol": "tcp", } + default_port_properties = { + "default": None, + "exposed": False, # or True(="Both"), "TCP", "UDP" # FIXME : implement logic for exposed port (allow/disallow in firewall ?) + "fixed": False, # FIXME: implement logic. Corresponding to wether or not the port is "fixed" or any random port is ok + } + + def __init__(self, properties: Dict[str, Any], *args, **kwargs): + + if "main" not in properties: + properties["main"] = {} + + for port, infos in properties.items(): + properties[port] = copy.copy(self.default_port_properties) + properties[port].update(infos) + + if properties[port]["default"] is None: + properties[port]["default"] = random.randint(10000, 60000) + + super().__init__({"ports": properties}, *args, **kwargs) + def _port_is_used(self, port): # FIXME : this could be less brutal than two os.system ... @@ -583,19 +601,30 @@ class PortResource(AppResource): def provision_or_update(self, context: Dict={}): - # Don't do anything if port already defined ? - if self.get_setting("port"): - return + for name, infos in self.ports.items(): - port = self.default - while self._port_is_used(port): - port += 1 + setting_name = f"port_{name}" if name != "main" else "port" + port_value = self.get_setting(setting_name) + if not port_value and name != "main": + # Automigrate from legacy setting foobar_port (instead of port_foobar) + legacy_setting_name = "{name}_port" + port_value = self.get_setting(legacy_setting_name) + self.set_setting(setting_name, port_value) + self.delete_setting(legacy_setting_name) + continue - self.set_setting("port", port) + if not port_value: + port_value = self.infos["default"] + while self._port_is_used(port_value): + port_value += 1 + + self.set_setting(setting_name, port_value) def deprovision(self, context: Dict={}): - self.delete_setting("port") + for name, infos in self.ports.items(): + setting_name = f"port_{name}" if name != "main" else "port" + self.delete_setting(setting_name) class DatabaseAppResource(AppResource): From 9cb97640b941867fde2b1fb0ca981913e915ea0e Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 28 Jan 2022 22:12:01 +0100 Subject: [PATCH 030/174] manifestv2: misc fixes + add test for manifestv2 install --- src/app.py | 5 +++-- src/tests/test_apps.py | 35 ++++++++++++++++++++++++++++++++++- src/utils/resources.py | 7 ++++++- 3 files changed, 43 insertions(+), 4 deletions(-) diff --git a/src/app.py b/src/app.py index f1abffd16..58ee7e017 100644 --- a/src/app.py +++ b/src/app.py @@ -1949,7 +1949,7 @@ def _convert_v1_manifest_to_v2(manifest): "ldap": "?", "sso": "?", "disk": "50M", - "ram": {"build": "50M", "runtime": "10M", "include_swap": False} + "ram": {"build": "50M", "runtime": "10M"} } maintainer = manifest.get("maintainer", {}).get("name") @@ -2301,7 +2301,8 @@ def _check_manifest_requirements(manifest: Dict, action: str): # Ram for build ram_build_requirement = manifest["integration"]["ram"]["build"] - ram_include_swap = manifest["integration"]["ram"]["include_swap"] + # Is "include_swap" really useful ? We should probably decide wether to always include it or not instead + ram_include_swap = manifest["integration"]["ram"].get("include_swap", False) ram, swap = ram_available() if ram_include_swap: diff --git a/src/tests/test_apps.py b/src/tests/test_apps.py index 2a808b5bd..6ff2c5271 100644 --- a/src/tests/test_apps.py +++ b/src/tests/test_apps.py @@ -45,6 +45,7 @@ def clean(): "break_yo_system", "legacy_app", "legacy_app__2", + "manifestv2_app", "full_domain_app", "my_webapp", ] @@ -115,7 +116,10 @@ def app_expected_files(domain, app): if app.startswith("legacy_app"): yield "/var/www/%s/index.html" % app yield "/etc/yunohost/apps/%s/settings.yml" % app - yield "/etc/yunohost/apps/%s/manifest.json" % app + if "manifestv2" in app: + yield "/etc/yunohost/apps/%s/manifest.toml" % app + else: + yield "/etc/yunohost/apps/%s/manifest.json" % app yield "/etc/yunohost/apps/%s/scripts/install" % app yield "/etc/yunohost/apps/%s/scripts/remove" % app @@ -157,6 +161,15 @@ def install_legacy_app(domain, path, public=True): ) +def install_manifestv2_app(domain, path, public=True): + + app_install( + os.path.join(get_test_apps_dir(), "manivestv2_app_ynh"), + args="domain={}&path={}&init_main_permission={}".format(domain, path, "visitors" if public else "all_users"), + force=True, + ) + + def install_full_domain_app(domain): app_install( @@ -195,6 +208,26 @@ def test_legacy_app_install_main_domain(): assert app_is_not_installed(main_domain, "legacy_app") +def test_manifestv2_app_install_main_domain(): + + main_domain = _get_maindomain() + + install_manifestv2_app(main_domain, "/manifestv2") + + app_map_ = app_map(raw=True) + assert main_domain in app_map_ + assert "/manifestv2" in app_map_[main_domain] + assert "id" in app_map_[main_domain]["/manifestv2"] + assert app_map_[main_domain]["/manifestv2"]["id"] == "manifestv2_app" + + assert app_is_installed(main_domain, "manifestv2_app") + assert app_is_exposed_on_http(main_domain, "/manifestv2", "Hextris") + + app_remove("manifestv2_app") + + assert app_is_not_installed(main_domain, "manifestv2_app") + + def test_app_from_catalog(): main_domain = _get_maindomain() diff --git a/src/utils/resources.py b/src/utils/resources.py index b7d3c1694..f64ad6134 100644 --- a/src/utils/resources.py +++ b/src/utils/resources.py @@ -45,6 +45,11 @@ class AppResourceManager: self.current = current self.wanted = wanted + if "resources" not in self.current: + self.current["resources"] = {} + if "resources" not in self.wanted: + self.wanted["resources"] = {} + def apply(self, rollback_if_failure, **context): todos = list(self.compute_todos()) @@ -233,7 +238,7 @@ class PermissionsResource(AppResource): existing_perms = user_permission_list(short=True, apps=[self.app])["permissions"] for perm in existing_perms: - if perm.split(".") not in self.permissions.keys(): + if perm.split(".")[0] not in self.permissions.keys(): permission_delete(perm, force=True, sync_perm=False) for perm, infos in self.permissions.items(): From 6316b94af4bade40c50012eddda128d7ab058a73 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 1 Feb 2022 14:30:15 +0100 Subject: [PATCH 031/174] helpers: missing ynh_requirement definition --- helpers/utils | 2 ++ 1 file changed, 2 insertions(+) diff --git a/helpers/utils b/helpers/utils index c1c8b9fc6..e40d4dd8a 100644 --- a/helpers/utils +++ b/helpers/utils @@ -927,6 +927,8 @@ ynh_compare_current_package_version() { _ynh_apply_default_permissions() { local target=$1 + local ynh_requirement=$(ynh_read_manifest --key=".requirements.yunohost") + if dpkg --compare-versions ${YNH_APP_PACKAGING_FORMAT:-0} ge 2 || [ -z "$ynh_requirement" ] || [ "$ynh_requirement" == "null" ] || dpkg --compare-versions $ynh_requirement ge 4.2; then chmod o-rwx $target chmod g-w $target From 05a459d4df6cd2b10d6ea5e9e13882fdfe80b1ef Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 1 Feb 2022 14:59:24 +0100 Subject: [PATCH 032/174] Fix tests --- src/tests/test_questions.py | 651 +++++++++++++++--------------------- src/utils/config.py | 1 + 2 files changed, 277 insertions(+), 375 deletions(-) diff --git a/src/tests/test_questions.py b/src/tests/test_questions.py index 5917d32d4..e49047469 100644 --- a/src/tests/test_questions.py +++ b/src/tests/test_questions.py @@ -23,37 +23,38 @@ from yunohost.utils.error import YunohostError, YunohostValidationError """ Argument default format: { - "name": "the_name", - "type": "one_of_the_available_type", // "sting" is not specified - "ask": { - "en": "the question in english", - "fr": "the question in french" - }, - "help": { - "en": "some help text in english", - "fr": "some help text in french" - }, - "example": "an example value", // optional - "default", "some stuff", // optional, not available for all types - "optional": true // optional, will skip if not answered + "the_name": { + "type": "one_of_the_available_type", // "sting" is not specified + "ask": { + "en": "the question in english", + "fr": "the question in french" + }, + "help": { + "en": "some help text in english", + "fr": "some help text in french" + }, + "example": "an example value", // optional + "default", "some stuff", // optional, not available for all types + "optional": true // optional, will skip if not answered + } } User answers: -{"name": "value", ...} +{"the_name": "value", ...} """ def test_question_empty(): - ask_questions_and_parse_answers([], {}) == [] + ask_questions_and_parse_answers({}, {}) == [] def test_question_string(): - questions = [ - { - "name": "some_string", + + questions = { + "some_string": { "type": "string", } - ] + } answers = {"some_string": "some_value"} out = ask_questions_and_parse_answers(questions, answers)[0] @@ -65,12 +66,11 @@ def test_question_string(): def test_question_string_from_query_string(): - questions = [ - { - "name": "some_string", + questions = { + "some_string": { "type": "string", } - ] + } answers = "foo=bar&some_string=some_value&lorem=ipsum" out = ask_questions_and_parse_answers(questions, answers)[0] @@ -81,11 +81,7 @@ def test_question_string_from_query_string(): def test_question_string_default_type(): - questions = [ - { - "name": "some_string", - } - ] + questions = {"some_string": {}} answers = {"some_string": "some_value"} out = ask_questions_and_parse_answers(questions, answers)[0] @@ -96,11 +92,7 @@ def test_question_string_default_type(): def test_question_string_no_input(): - questions = [ - { - "name": "some_string", - } - ] + questions = {"some_string": {}} answers = {} with pytest.raises(YunohostError), patch.object(os, "isatty", return_value=False): @@ -108,12 +100,11 @@ def test_question_string_no_input(): def test_question_string_input(): - questions = [ - { - "name": "some_string", + questions = { + "some_string": { "ask": "some question", } - ] + } answers = {} with patch.object(Moulinette, "prompt", return_value="some_value"), patch.object( @@ -127,11 +118,7 @@ def test_question_string_input(): def test_question_string_input_no_ask(): - questions = [ - { - "name": "some_string", - } - ] + questions = {"some_string": {}} answers = {} with patch.object(Moulinette, "prompt", return_value="some_value"), patch.object( @@ -145,12 +132,7 @@ def test_question_string_input_no_ask(): def test_question_string_no_input_optional(): - questions = [ - { - "name": "some_string", - "optional": True, - } - ] + questions = {"some_string": {"optional": True}} answers = {} with patch.object(os, "isatty", return_value=False): out = ask_questions_and_parse_answers(questions, answers)[0] @@ -161,13 +143,12 @@ def test_question_string_no_input_optional(): def test_question_string_optional_with_input(): - questions = [ - { - "name": "some_string", + questions = { + "some_string": { "ask": "some question", "optional": True, } - ] + } answers = {} with patch.object(Moulinette, "prompt", return_value="some_value"), patch.object( @@ -181,13 +162,12 @@ def test_question_string_optional_with_input(): def test_question_string_optional_with_empty_input(): - questions = [ - { - "name": "some_string", + questions = { + "some_string": { "ask": "some question", "optional": True, } - ] + } answers = {} with patch.object(Moulinette, "prompt", return_value=""), patch.object( @@ -201,12 +181,11 @@ def test_question_string_optional_with_empty_input(): def test_question_string_optional_with_input_without_ask(): - questions = [ - { - "name": "some_string", + questions = { + "some_string": { "optional": True, } - ] + } answers = {} with patch.object(Moulinette, "prompt", return_value="some_value"), patch.object( @@ -220,13 +199,12 @@ def test_question_string_optional_with_input_without_ask(): def test_question_string_no_input_default(): - questions = [ - { - "name": "some_string", + questions = { + "some_string": { "ask": "some question", "default": "some_value", } - ] + } answers = {} with patch.object(os, "isatty", return_value=False): out = ask_questions_and_parse_answers(questions, answers)[0] @@ -238,12 +216,11 @@ def test_question_string_no_input_default(): def test_question_string_input_test_ask(): ask_text = "some question" - questions = [ - { - "name": "some_string", + questions = { + "some_string": { "ask": ask_text, } - ] + } answers = {} with patch.object( @@ -264,13 +241,12 @@ def test_question_string_input_test_ask(): def test_question_string_input_test_ask_with_default(): ask_text = "some question" default_text = "some example" - questions = [ - { - "name": "some_string", + questions = { + "some_string": { "ask": ask_text, "default": default_text, } - ] + } answers = {} with patch.object( @@ -292,13 +268,12 @@ def test_question_string_input_test_ask_with_default(): def test_question_string_input_test_ask_with_example(): ask_text = "some question" example_text = "some example" - questions = [ - { - "name": "some_string", + questions = { + "some_string": { "ask": ask_text, "example": example_text, } - ] + } answers = {} with patch.object( @@ -313,13 +288,12 @@ def test_question_string_input_test_ask_with_example(): def test_question_string_input_test_ask_with_help(): ask_text = "some question" help_text = "some_help" - questions = [ - { - "name": "some_string", + questions = { + "some_string": { "ask": ask_text, "help": help_text, } - ] + } answers = {} with patch.object( @@ -331,7 +305,7 @@ def test_question_string_input_test_ask_with_help(): def test_question_string_with_choice(): - questions = [{"name": "some_string", "type": "string", "choices": ["fr", "en"]}] + questions = {"some_string": {"type": "string", "choices": ["fr", "en"]}} answers = {"some_string": "fr"} out = ask_questions_and_parse_answers(questions, answers)[0] @@ -341,7 +315,7 @@ def test_question_string_with_choice(): def test_question_string_with_choice_prompt(): - questions = [{"name": "some_string", "type": "string", "choices": ["fr", "en"]}] + questions = {"some_string": {"type": "string", "choices": ["fr", "en"]}} answers = {"some_string": "fr"} with patch.object(Moulinette, "prompt", return_value="fr"), patch.object( os, "isatty", return_value=True @@ -354,7 +328,7 @@ def test_question_string_with_choice_prompt(): def test_question_string_with_choice_bad(): - questions = [{"name": "some_string", "type": "string", "choices": ["fr", "en"]}] + questions = {"some_string": {"type": "string", "choices": ["fr", "en"]}} answers = {"some_string": "bad"} with pytest.raises(YunohostError), patch.object(os, "isatty", return_value=False): @@ -364,13 +338,12 @@ def test_question_string_with_choice_bad(): def test_question_string_with_choice_ask(): ask_text = "some question" choices = ["fr", "en", "es", "it", "ru"] - questions = [ - { - "name": "some_string", + questions = { + "some_string": { "ask": ask_text, "choices": choices, } - ] + } answers = {} with patch.object(Moulinette, "prompt", return_value="ru") as prompt, patch.object( @@ -384,14 +357,13 @@ def test_question_string_with_choice_ask(): def test_question_string_with_choice_default(): - questions = [ - { - "name": "some_string", + questions = { + "some_string": { "type": "string", "choices": ["fr", "en"], "default": "en", } - ] + } answers = {} with patch.object(os, "isatty", return_value=False): out = ask_questions_and_parse_answers(questions, answers)[0] @@ -402,12 +374,11 @@ def test_question_string_with_choice_default(): def test_question_password(): - questions = [ - { - "name": "some_password", + questions = { + "some_password": { "type": "password", } - ] + } answers = {"some_password": "some_value"} out = ask_questions_and_parse_answers(questions, answers)[0] @@ -417,12 +388,11 @@ def test_question_password(): def test_question_password_no_input(): - questions = [ - { - "name": "some_password", + questions = { + "some_password": { "type": "password", } - ] + } answers = {} with pytest.raises(YunohostError), patch.object(os, "isatty", return_value=False): @@ -430,13 +400,12 @@ def test_question_password_no_input(): def test_question_password_input(): - questions = [ - { - "name": "some_password", + questions = { + "some_password": { "type": "password", "ask": "some question", } - ] + } answers = {} with patch.object(Moulinette, "prompt", return_value="some_value"), patch.object( @@ -450,12 +419,11 @@ def test_question_password_input(): def test_question_password_input_no_ask(): - questions = [ - { - "name": "some_password", + questions = { + "some_password": { "type": "password", } - ] + } answers = {} with patch.object(Moulinette, "prompt", return_value="some_value"), patch.object( @@ -469,13 +437,12 @@ def test_question_password_input_no_ask(): def test_question_password_no_input_optional(): - questions = [ - { - "name": "some_password", + questions = { + "some_password": { "type": "password", "optional": True, } - ] + } answers = {} with patch.object(os, "isatty", return_value=False): @@ -485,9 +452,7 @@ def test_question_password_no_input_optional(): assert out.type == "password" assert out.value == "" - questions = [ - {"name": "some_password", "type": "password", "optional": True, "default": ""} - ] + questions = {"some_password": {"type": "password", "optional": True, "default": ""}} with patch.object(os, "isatty", return_value=False): out = ask_questions_and_parse_answers(questions, answers)[0] @@ -498,14 +463,13 @@ def test_question_password_no_input_optional(): def test_question_password_optional_with_input(): - questions = [ - { - "name": "some_password", + questions = { + "some_password": { "ask": "some question", "type": "password", "optional": True, } - ] + } answers = {} with patch.object(Moulinette, "prompt", return_value="some_value"), patch.object( @@ -519,14 +483,13 @@ def test_question_password_optional_with_input(): def test_question_password_optional_with_empty_input(): - questions = [ - { - "name": "some_password", + questions = { + "some_password": { "ask": "some question", "type": "password", "optional": True, } - ] + } answers = {} with patch.object(Moulinette, "prompt", return_value=""), patch.object( @@ -540,13 +503,12 @@ def test_question_password_optional_with_empty_input(): def test_question_password_optional_with_input_without_ask(): - questions = [ - { - "name": "some_password", + questions = { + "some_password": { "type": "password", "optional": True, } - ] + } answers = {} with patch.object(Moulinette, "prompt", return_value="some_value"), patch.object( @@ -560,14 +522,13 @@ def test_question_password_optional_with_input_without_ask(): def test_question_password_no_input_default(): - questions = [ - { - "name": "some_password", + questions = { + "some_password": { "type": "password", "ask": "some question", "default": "some_value", } - ] + } answers = {} # no default for password! @@ -577,14 +538,13 @@ def test_question_password_no_input_default(): @pytest.mark.skip # this should raises def test_question_password_no_input_example(): - questions = [ - { - "name": "some_password", + questions = { + "some_password": { "type": "password", "ask": "some question", "example": "some_value", } - ] + } answers = {"some_password": "some_value"} # no example for password! @@ -594,13 +554,12 @@ def test_question_password_no_input_example(): def test_question_password_input_test_ask(): ask_text = "some question" - questions = [ - { - "name": "some_password", + questions = { + "some_password": { "type": "password", "ask": ask_text, } - ] + } answers = {} with patch.object( @@ -622,14 +581,13 @@ def test_question_password_input_test_ask(): def test_question_password_input_test_ask_with_example(): ask_text = "some question" example_text = "some example" - questions = [ - { - "name": "some_password", + questions = { + "some_password": { "type": "password", "ask": ask_text, "example": example_text, } - ] + } answers = {} with patch.object( @@ -644,14 +602,13 @@ def test_question_password_input_test_ask_with_example(): def test_question_password_input_test_ask_with_help(): ask_text = "some question" help_text = "some_help" - questions = [ - { - "name": "some_password", + questions = { + "some_password": { "type": "password", "ask": ask_text, "help": help_text, } - ] + } answers = {} with patch.object( @@ -663,14 +620,13 @@ def test_question_password_input_test_ask_with_help(): def test_question_password_bad_chars(): - questions = [ - { - "name": "some_password", + questions = { + "some_password": { "type": "password", "ask": "some question", "example": "some_value", } - ] + } for i in PasswordQuestion.forbidden_chars: with pytest.raises(YunohostError), patch.object( @@ -680,14 +636,13 @@ def test_question_password_bad_chars(): def test_question_password_strong_enough(): - questions = [ - { - "name": "some_password", + questions = { + "some_password": { "type": "password", "ask": "some question", "example": "some_value", } - ] + } with pytest.raises(YunohostError), patch.object(os, "isatty", return_value=False): # too short @@ -698,14 +653,13 @@ def test_question_password_strong_enough(): def test_question_password_optional_strong_enough(): - questions = [ - { - "name": "some_password", + questions = { + "some_password": { "ask": "some question", "type": "password", "optional": True, } - ] + } with pytest.raises(YunohostError), patch.object(os, "isatty", return_value=False): # too short @@ -716,12 +670,11 @@ def test_question_password_optional_strong_enough(): def test_question_path(): - questions = [ - { - "name": "some_path", + questions = { + "some_path": { "type": "path", } - ] + } answers = {"some_path": "/some_value"} out = ask_questions_and_parse_answers(questions, answers)[0] @@ -731,12 +684,11 @@ def test_question_path(): def test_question_path_no_input(): - questions = [ - { - "name": "some_path", + questions = { + "some_path": { "type": "path", } - ] + } answers = {} with pytest.raises(YunohostError), patch.object(os, "isatty", return_value=False): @@ -744,13 +696,12 @@ def test_question_path_no_input(): def test_question_path_input(): - questions = [ - { - "name": "some_path", + questions = { + "some_path": { "type": "path", "ask": "some question", } - ] + } answers = {} with patch.object(Moulinette, "prompt", return_value="/some_value"), patch.object( @@ -764,12 +715,11 @@ def test_question_path_input(): def test_question_path_input_no_ask(): - questions = [ - { - "name": "some_path", + questions = { + "some_path": { "type": "path", } - ] + } answers = {} with patch.object(Moulinette, "prompt", return_value="/some_value"), patch.object( @@ -783,13 +733,12 @@ def test_question_path_input_no_ask(): def test_question_path_no_input_optional(): - questions = [ - { - "name": "some_path", + questions = { + "some_path": { "type": "path", "optional": True, } - ] + } answers = {} with patch.object(os, "isatty", return_value=False): out = ask_questions_and_parse_answers(questions, answers)[0] @@ -800,14 +749,13 @@ def test_question_path_no_input_optional(): def test_question_path_optional_with_input(): - questions = [ - { - "name": "some_path", + questions = { + "some_path": { "ask": "some question", "type": "path", "optional": True, } - ] + } answers = {} with patch.object(Moulinette, "prompt", return_value="/some_value"), patch.object( @@ -821,14 +769,13 @@ def test_question_path_optional_with_input(): def test_question_path_optional_with_empty_input(): - questions = [ - { - "name": "some_path", + questions = { + "some_path": { "ask": "some question", "type": "path", "optional": True, } - ] + } answers = {} with patch.object(Moulinette, "prompt", return_value=""), patch.object( @@ -842,13 +789,12 @@ def test_question_path_optional_with_empty_input(): def test_question_path_optional_with_input_without_ask(): - questions = [ - { - "name": "some_path", + questions = { + "some_path": { "type": "path", "optional": True, } - ] + } answers = {} with patch.object(Moulinette, "prompt", return_value="/some_value"), patch.object( @@ -862,14 +808,13 @@ def test_question_path_optional_with_input_without_ask(): def test_question_path_no_input_default(): - questions = [ - { - "name": "some_path", + questions = { + "some_path": { "ask": "some question", "type": "path", "default": "some_value", } - ] + } answers = {} with patch.object(os, "isatty", return_value=False): out = ask_questions_and_parse_answers(questions, answers)[0] @@ -881,13 +826,12 @@ def test_question_path_no_input_default(): def test_question_path_input_test_ask(): ask_text = "some question" - questions = [ - { - "name": "some_path", + questions = { + "some_path": { "type": "path", "ask": ask_text, } - ] + } answers = {} with patch.object( @@ -908,14 +852,13 @@ def test_question_path_input_test_ask(): def test_question_path_input_test_ask_with_default(): ask_text = "some question" default_text = "someexample" - questions = [ - { - "name": "some_path", + questions = { + "some_path": { "type": "path", "ask": ask_text, "default": default_text, } - ] + } answers = {} with patch.object( @@ -937,14 +880,13 @@ def test_question_path_input_test_ask_with_default(): def test_question_path_input_test_ask_with_example(): ask_text = "some question" example_text = "some example" - questions = [ - { - "name": "some_path", + questions = { + "some_path": { "type": "path", "ask": ask_text, "example": example_text, } - ] + } answers = {} with patch.object( @@ -959,14 +901,13 @@ def test_question_path_input_test_ask_with_example(): def test_question_path_input_test_ask_with_help(): ask_text = "some question" help_text = "some_help" - questions = [ - { - "name": "some_path", + questions = { + "some_path": { "type": "path", "ask": ask_text, "help": help_text, } - ] + } answers = {} with patch.object( @@ -978,12 +919,11 @@ def test_question_path_input_test_ask_with_help(): def test_question_boolean(): - questions = [ - { - "name": "some_boolean", + questions = { + "some_boolean": { "type": "boolean", } - ] + } answers = {"some_boolean": "y"} out = ask_questions_and_parse_answers(questions, answers)[0] @@ -993,12 +933,11 @@ def test_question_boolean(): def test_question_boolean_all_yes(): - questions = [ - { - "name": "some_boolean", + questions = { + "some_boolean": { "type": "boolean", } - ] + } for value in ["Y", "yes", "Yes", "YES", "1", 1, True, "True", "TRUE", "true"]: out = ask_questions_and_parse_answers(questions, {"some_boolean": value})[0] @@ -1008,12 +947,11 @@ def test_question_boolean_all_yes(): def test_question_boolean_all_no(): - questions = [ - { - "name": "some_boolean", + questions = { + "some_boolean": { "type": "boolean", } - ] + } for value in ["n", "N", "no", "No", "No", "0", 0, False, "False", "FALSE", "false"]: out = ask_questions_and_parse_answers(questions, {"some_boolean": value})[0] @@ -1024,12 +962,11 @@ def test_question_boolean_all_no(): # XXX apparently boolean are always False (0) by default, I'm not sure what to think about that def test_question_boolean_no_input(): - questions = [ - { - "name": "some_boolean", + questions = { + "some_boolean": { "type": "boolean", } - ] + } answers = {} with patch.object(os, "isatty", return_value=False): @@ -1039,12 +976,11 @@ def test_question_boolean_no_input(): def test_question_boolean_bad_input(): - questions = [ - { - "name": "some_boolean", + questions = { + "some_boolean": { "type": "boolean", } - ] + } answers = {"some_boolean": "stuff"} with pytest.raises(YunohostError), patch.object(os, "isatty", return_value=False): @@ -1052,13 +988,12 @@ def test_question_boolean_bad_input(): def test_question_boolean_input(): - questions = [ - { - "name": "some_boolean", + questions = { + "some_boolean": { "type": "boolean", "ask": "some question", } - ] + } answers = {} with patch.object(Moulinette, "prompt", return_value="y"), patch.object( @@ -1075,12 +1010,11 @@ def test_question_boolean_input(): def test_question_boolean_input_no_ask(): - questions = [ - { - "name": "some_boolean", + questions = { + "some_boolean": { "type": "boolean", } - ] + } answers = {} with patch.object(Moulinette, "prompt", return_value="y"), patch.object( @@ -1091,13 +1025,12 @@ def test_question_boolean_input_no_ask(): def test_question_boolean_no_input_optional(): - questions = [ - { - "name": "some_boolean", + questions = { + "some_boolean": { "type": "boolean", "optional": True, } - ] + } answers = {} with patch.object(os, "isatty", return_value=False): out = ask_questions_and_parse_answers(questions, answers)[0] @@ -1105,14 +1038,13 @@ def test_question_boolean_no_input_optional(): def test_question_boolean_optional_with_input(): - questions = [ - { - "name": "some_boolean", + questions = { + "some_boolean": { "ask": "some question", "type": "boolean", "optional": True, } - ] + } answers = {} with patch.object(Moulinette, "prompt", return_value="y"), patch.object( @@ -1123,14 +1055,13 @@ def test_question_boolean_optional_with_input(): def test_question_boolean_optional_with_empty_input(): - questions = [ - { - "name": "some_boolean", + questions = { + "some_boolean": { "ask": "some question", "type": "boolean", "optional": True, } - ] + } answers = {} with patch.object(Moulinette, "prompt", return_value=""), patch.object( @@ -1142,13 +1073,12 @@ def test_question_boolean_optional_with_empty_input(): def test_question_boolean_optional_with_input_without_ask(): - questions = [ - { - "name": "some_boolean", + questions = { + "some_boolean": { "type": "boolean", "optional": True, } - ] + } answers = {} with patch.object(Moulinette, "prompt", return_value="n"), patch.object( @@ -1160,14 +1090,13 @@ def test_question_boolean_optional_with_input_without_ask(): def test_question_boolean_no_input_default(): - questions = [ - { - "name": "some_boolean", + questions = { + "some_boolean": { "ask": "some question", "type": "boolean", "default": 0, } - ] + } answers = {} with patch.object(os, "isatty", return_value=False): @@ -1177,14 +1106,13 @@ def test_question_boolean_no_input_default(): def test_question_boolean_bad_default(): - questions = [ - { - "name": "some_boolean", + questions = { + "some_boolean": { "ask": "some question", "type": "boolean", "default": "bad default", } - ] + } answers = {} with pytest.raises(YunohostError): ask_questions_and_parse_answers(questions, answers) @@ -1192,13 +1120,12 @@ def test_question_boolean_bad_default(): def test_question_boolean_input_test_ask(): ask_text = "some question" - questions = [ - { - "name": "some_boolean", + questions = { + "some_boolean": { "type": "boolean", "ask": ask_text, } - ] + } answers = {} with patch.object(Moulinette, "prompt", return_value=0) as prompt, patch.object( @@ -1219,14 +1146,13 @@ def test_question_boolean_input_test_ask(): def test_question_boolean_input_test_ask_with_default(): ask_text = "some question" default_text = 1 - questions = [ - { - "name": "some_boolean", + questions = { + "some_boolean": { "type": "boolean", "ask": ask_text, "default": default_text, } - ] + } answers = {} with patch.object(Moulinette, "prompt", return_value=1) as prompt, patch.object( @@ -1245,12 +1171,11 @@ def test_question_boolean_input_test_ask_with_default(): def test_question_domain_empty(): - questions = [ - { - "name": "some_domain", + questions = { + "some_domain": { "type": "domain", } - ] + } main_domain = "my_main_domain.com" answers = {} @@ -1271,12 +1196,11 @@ def test_question_domain_empty(): def test_question_domain(): main_domain = "my_main_domain.com" domains = [main_domain] - questions = [ - { - "name": "some_domain", + questions = { + "some_domain": { "type": "domain", } - ] + } answers = {"some_domain": main_domain} @@ -1295,12 +1219,11 @@ def test_question_domain_two_domains(): other_domain = "some_other_domain.tld" domains = [main_domain, other_domain] - questions = [ - { - "name": "some_domain", + questions = { + "some_domain": { "type": "domain", } - ] + } answers = {"some_domain": other_domain} with patch.object( @@ -1329,12 +1252,11 @@ def test_question_domain_two_domains_wrong_answer(): other_domain = "some_other_domain.tld" domains = [main_domain, other_domain] - questions = [ - { - "name": "some_domain", + questions = { + "some_domain": { "type": "domain", } - ] + } answers = {"some_domain": "doesnt_exist.pouet"} with patch.object( @@ -1351,12 +1273,11 @@ def test_question_domain_two_domains_default_no_ask(): other_domain = "some_other_domain.tld" domains = [main_domain, other_domain] - questions = [ - { - "name": "some_domain", + questions = { + "some_domain": { "type": "domain", } - ] + } answers = {} with patch.object( @@ -1378,7 +1299,7 @@ def test_question_domain_two_domains_default(): other_domain = "some_other_domain.tld" domains = [main_domain, other_domain] - questions = [{"name": "some_domain", "type": "domain", "ask": "choose a domain"}] + questions = {"some_domain": {"type": "domain", "ask": "choose a domain"}} answers = {} with patch.object( @@ -1400,7 +1321,7 @@ def test_question_domain_two_domains_default_input(): other_domain = "some_other_domain.tld" domains = [main_domain, other_domain] - questions = [{"name": "some_domain", "type": "domain", "ask": "choose a domain"}] + questions = {"some_domain": {"type": "domain", "ask": "choose a domain"}} answers = {} with patch.object( @@ -1436,12 +1357,11 @@ def test_question_user_empty(): } } - questions = [ - { - "name": "some_user", + questions = { + "some_user": { "type": "user", } - ] + } answers = {} with patch.object(user, "user_list", return_value={"users": users}): @@ -1463,12 +1383,11 @@ def test_question_user(): } } - questions = [ - { - "name": "some_user", + questions = { + "some_user": { "type": "user", } - ] + } answers = {"some_user": username} with patch.object(user, "user_list", return_value={"users": users}), patch.object( @@ -1501,12 +1420,11 @@ def test_question_user_two_users(): }, } - questions = [ - { - "name": "some_user", + questions = { + "some_user": { "type": "user", } - ] + } answers = {"some_user": other_user} with patch.object(user, "user_list", return_value={"users": users}), patch.object( @@ -1550,12 +1468,11 @@ def test_question_user_two_users_wrong_answer(): }, } - questions = [ - { - "name": "some_user", + questions = { + "some_user": { "type": "user", } - ] + } answers = {"some_user": "doesnt_exist.pouet"} with patch.object(user, "user_list", return_value={"users": users}): @@ -1585,7 +1502,7 @@ def test_question_user_two_users_no_default(): }, } - questions = [{"name": "some_user", "type": "user", "ask": "choose a user"}] + questions = {"some_user": {"type": "user", "ask": "choose a user"}} answers = {} with patch.object(user, "user_list", return_value={"users": users}): @@ -1615,7 +1532,7 @@ def test_question_user_two_users_default_input(): }, } - questions = [{"name": "some_user", "type": "user", "ask": "choose a user"}] + questions = {"some_user": {"type": "user", "ask": "choose a user"}} answers = {} with patch.object(user, "user_list", return_value={"users": users}), patch.object( @@ -1639,12 +1556,11 @@ def test_question_user_two_users_default_input(): def test_question_number(): - questions = [ - { - "name": "some_number", + questions = { + "some_number": { "type": "number", } - ] + } answers = {"some_number": 1337} out = ask_questions_and_parse_answers(questions, answers)[0] @@ -1654,12 +1570,11 @@ def test_question_number(): def test_question_number_no_input(): - questions = [ - { - "name": "some_number", + questions = { + "some_number": { "type": "number", } - ] + } answers = {} with pytest.raises(YunohostError), patch.object(os, "isatty", return_value=False): @@ -1667,12 +1582,11 @@ def test_question_number_no_input(): def test_question_number_bad_input(): - questions = [ - { - "name": "some_number", + questions = { + "some_number": { "type": "number", } - ] + } answers = {"some_number": "stuff"} with pytest.raises(YunohostError), patch.object(os, "isatty", return_value=False): @@ -1684,13 +1598,12 @@ def test_question_number_bad_input(): def test_question_number_input(): - questions = [ - { - "name": "some_number", + questions = { + "some_number": { "type": "number", "ask": "some question", } - ] + } answers = {} with patch.object(Moulinette, "prompt", return_value="1337"), patch.object( @@ -1722,12 +1635,11 @@ def test_question_number_input(): def test_question_number_input_no_ask(): - questions = [ - { - "name": "some_number", + questions = { + "some_number": { "type": "number", } - ] + } answers = {} with patch.object(Moulinette, "prompt", return_value="1337"), patch.object( @@ -1741,13 +1653,12 @@ def test_question_number_input_no_ask(): def test_question_number_no_input_optional(): - questions = [ - { - "name": "some_number", + questions = { + "some_number": { "type": "number", "optional": True, } - ] + } answers = {} with patch.object(os, "isatty", return_value=False): out = ask_questions_and_parse_answers(questions, answers)[0] @@ -1758,14 +1669,13 @@ def test_question_number_no_input_optional(): def test_question_number_optional_with_input(): - questions = [ - { - "name": "some_number", + questions = { + "some_number": { "ask": "some question", "type": "number", "optional": True, } - ] + } answers = {} with patch.object(Moulinette, "prompt", return_value="1337"), patch.object( @@ -1779,13 +1689,12 @@ def test_question_number_optional_with_input(): def test_question_number_optional_with_input_without_ask(): - questions = [ - { - "name": "some_number", + questions = { + "some_number": { "type": "number", "optional": True, } - ] + } answers = {} with patch.object(Moulinette, "prompt", return_value="0"), patch.object( @@ -1799,14 +1708,13 @@ def test_question_number_optional_with_input_without_ask(): def test_question_number_no_input_default(): - questions = [ - { - "name": "some_number", + questions = { + "some_number": { "ask": "some question", "type": "number", "default": 1337, } - ] + } answers = {} with patch.object(os, "isatty", return_value=False): out = ask_questions_and_parse_answers(questions, answers)[0] @@ -1817,14 +1725,13 @@ def test_question_number_no_input_default(): def test_question_number_bad_default(): - questions = [ - { - "name": "some_number", + questions = { + "some_number": { "ask": "some question", "type": "number", "default": "bad default", } - ] + } answers = {} with pytest.raises(YunohostError), patch.object(os, "isatty", return_value=False): ask_questions_and_parse_answers(questions, answers) @@ -1832,13 +1739,12 @@ def test_question_number_bad_default(): def test_question_number_input_test_ask(): ask_text = "some question" - questions = [ - { - "name": "some_number", + questions = { + "some_number": { "type": "number", "ask": ask_text, } - ] + } answers = {} with patch.object( @@ -1859,14 +1765,13 @@ def test_question_number_input_test_ask(): def test_question_number_input_test_ask_with_default(): ask_text = "some question" default_value = 1337 - questions = [ - { - "name": "some_number", + questions = { + "some_number": { "type": "number", "ask": ask_text, "default": default_value, } - ] + } answers = {} with patch.object( @@ -1888,14 +1793,13 @@ def test_question_number_input_test_ask_with_default(): def test_question_number_input_test_ask_with_example(): ask_text = "some question" example_value = 1337 - questions = [ - { - "name": "some_number", + questions = { + "some_number": { "type": "number", "ask": ask_text, "example": example_value, } - ] + } answers = {} with patch.object( @@ -1910,14 +1814,13 @@ def test_question_number_input_test_ask_with_example(): def test_question_number_input_test_ask_with_help(): ask_text = "some question" help_value = 1337 - questions = [ - { - "name": "some_number", + questions = { + "some_number": { "type": "number", "ask": ask_text, "help": help_value, } - ] + } answers = {} with patch.object( @@ -1929,7 +1832,7 @@ def test_question_number_input_test_ask_with_help(): def test_question_display_text(): - questions = [{"name": "some_app", "type": "display_text", "ask": "foobar"}] + questions = {"some_app": {"type": "display_text", "ask": "foobar"}} answers = {} with patch.object(sys, "stdout", new_callable=StringIO) as stdout, patch.object( @@ -1947,12 +1850,11 @@ def test_question_file_from_cli(): os.system(f"rm -f {filename}") os.system(f"echo helloworld > {filename}") - questions = [ - { - "name": "some_file", + questions = { + "some_file": { "type": "file", } - ] + } answers = {"some_file": filename} out = ask_questions_and_parse_answers(questions, answers)[0] @@ -1978,12 +1880,11 @@ def test_question_file_from_api(): from base64 import b64encode b64content = b64encode(b"helloworld") - questions = [ - { - "name": "some_file", + questions = { + "some_file": { "type": "file", } - ] + } answers = {"some_file": b64content} interface_type_bkp = Moulinette.interface.type diff --git a/src/utils/config.py b/src/utils/config.py index 9ae75969b..eb5f9b683 100644 --- a/src/utils/config.py +++ b/src/utils/config.py @@ -1408,6 +1408,7 @@ def ask_questions_and_parse_answers( out = [] for name, raw_question in raw_questions.items(): + raw_question['name'] = name question_class = ARGUMENTS_TYPE_PARSERS[raw_question.get("type", "string")] raw_question["value"] = answers.get(name) question = question_class(raw_question, context=context, hooks=hooks) From d8a924353226360de5466f2b605d49e66c99d93e Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 1 Feb 2022 15:26:45 +0100 Subject: [PATCH 033/174] =?UTF-8?q?Typo=20=C3=A9=5F=C3=A8?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/tests/test_apps.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/tests/test_apps.py b/src/tests/test_apps.py index 6ff2c5271..76397093d 100644 --- a/src/tests/test_apps.py +++ b/src/tests/test_apps.py @@ -164,7 +164,7 @@ def install_legacy_app(domain, path, public=True): def install_manifestv2_app(domain, path, public=True): app_install( - os.path.join(get_test_apps_dir(), "manivestv2_app_ynh"), + os.path.join(get_test_apps_dir(), "manifestv2_app_ynh"), args="domain={}&path={}&init_main_permission={}".format(domain, path, "visitors" if public else "all_users"), force=True, ) From e4863830c90e23c89c044b5f503219c5444f7a63 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 1 Feb 2022 15:32:34 +0100 Subject: [PATCH 034/174] Fix call to ask_questions_and_parse_answers --- src/utils/config.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/utils/config.py b/src/utils/config.py index eb5f9b683..aa6586baa 100644 --- a/src/utils/config.py +++ b/src/utils/config.py @@ -580,7 +580,7 @@ class ConfigPanel: prefilled_answers.update(self.new_values) questions = ask_questions_and_parse_answers( - section["options"], + {question["name"]: question for question in section["options"]}, prefilled_answers=prefilled_answers, current_values=self.values, hooks=self.hooks, From f9e15ff8a39b5a44efe61e374de2378cff277dc3 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 1 Feb 2022 15:36:13 +0100 Subject: [PATCH 035/174] Add app-resources tests to ci --- .gitlab/ci/test.gitlab-ci.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.gitlab/ci/test.gitlab-ci.yml b/.gitlab/ci/test.gitlab-ci.yml index 27b9b4913..519ae427a 100644 --- a/.gitlab/ci/test.gitlab-ci.yml +++ b/.gitlab/ci/test.gitlab-ci.yml @@ -125,6 +125,15 @@ test-app-config: - src/app.py - src/utils/config.py +test-app-resources: + extends: .test-stage + script: + - python3 -m pytest src/tests/test_app_resources.py + only: + changes: + - src/app.py + - src/utils/resources.py + test-changeurl: extends: .test-stage script: From b6085fef8d2bdeb2de85d1e22f470fbf10995355 Mon Sep 17 00:00:00 2001 From: Tagadda <36127788+Tagadda@users.noreply.github.com> Date: Sat, 29 Jan 2022 22:59:28 +0000 Subject: [PATCH 036/174] wip --- locales/en.json | 22 +-- share/actionsmap.yml | 24 ++- share/config_settings.toml | 125 ++++++++++++ src/settings.py | 378 +++++++++++-------------------------- src/utils/config.py | 5 + src/utils/legacy.py | 25 +++ 6 files changed, 294 insertions(+), 285 deletions(-) create mode 100644 share/config_settings.toml diff --git a/locales/en.json b/locales/en.json index 2b2f10179..e50e0f7d9 100644 --- a/locales/en.json +++ b/locales/en.json @@ -374,26 +374,26 @@ "global_settings_cant_write_settings": "Could not save settings file, reason: {reason}", "global_settings_key_doesnt_exists": "The key '{settings_key}' does not exist in the global settings, you can see all the available keys by running 'yunohost settings list'", "global_settings_reset_success": "Previous settings now backed up to {path}", + "global_settings_setting_admin_strength": "Admin password strength", "global_settings_setting_backup_compress_tar_archives": "When creating new backups, compress the archives (.tar.gz) instead of uncompressed archives (.tar). N.B. : enabling this option means create lighter backup archives, but the initial backup procedure will be significantly longer and heavy on CPU.", + "global_settings_setting_nginx_compatibility": "Compatibility vs. security tradeoff for the web server NGINX. Affects the ciphers (and other security-related aspects)", + "global_settings_setting_nginx_redirect_to_https": "Redirect HTTP requests to HTTPs by default (DO NOT TURN OFF unless you really know what you're doing!)", "global_settings_setting_pop3_enabled": "Enable the POP3 protocol for the mail server", + "global_settings_setting_postfix_compatibility": "Compatibility vs. security tradeoff for the Postfix server. Affects the ciphers (and other security-related aspects)", "global_settings_setting_security_experimental_enabled": "Enable experimental security features (don't enable this if you don't know what you're doing!)", - "global_settings_setting_security_nginx_compatibility": "Compatibility vs. security tradeoff for the web server NGINX. Affects the ciphers (and other security-related aspects)", - "global_settings_setting_security_nginx_redirect_to_https": "Redirect HTTP requests to HTTPs by default (DO NOT TURN OFF unless you really know what you're doing!)", - "global_settings_setting_security_password_admin_strength": "Admin password strength", - "global_settings_setting_security_password_user_strength": "User password strength", - "global_settings_setting_security_postfix_compatibility": "Compatibility vs. security tradeoff for the Postfix server. Affects the ciphers (and other security-related aspects)", - "global_settings_setting_security_ssh_compatibility": "Compatibility vs. security tradeoff for the SSH server. Affects the ciphers (and other security-related aspects)", - "global_settings_setting_security_ssh_password_authentication": "Allow password authentication for SSH", - "global_settings_setting_security_ssh_port": "SSH port", - "global_settings_setting_security_webadmin_allowlist": "IP adresses allowed to access the webadmin. Comma-separated.", - "global_settings_setting_security_webadmin_allowlist_enabled": "Allow only some IPs to access the webadmin.", - "global_settings_setting_service_ssh_allow_deprecated_dsa_hostkey": "Allow the use of (deprecated) DSA hostkey for the SSH daemon configuration", "global_settings_setting_smtp_allow_ipv6": "Allow the use of IPv6 to receive and send mail", "global_settings_setting_smtp_relay_host": "SMTP relay host to use in order to send mail instead of this yunohost instance. Useful if you are in one of this situation: your 25 port is blocked by your ISP or VPS provider, you have a residential IP listed on DUHL, you are not able to configure reverse DNS or this server is not directly exposed on the internet and you want use an other one to send mails.", "global_settings_setting_smtp_relay_password": "SMTP relay host password", "global_settings_setting_smtp_relay_port": "SMTP relay port", "global_settings_setting_smtp_relay_user": "SMTP relay user account", + "global_settings_setting_ssh_allow_deprecated_dsa_hostkey": "Allow the use of (deprecated) DSA hostkey for the SSH daemon configuration", + "global_settings_setting_ssh_compatibility": "Compatibility vs. security tradeoff for the SSH server. Affects the ciphers (and other security-related aspects)", + "global_settings_setting_ssh_password_authentication": "Allow password authentication for SSH", + "global_settings_setting_ssh_port": "SSH port", "global_settings_setting_ssowat_panel_overlay_enabled": "Enable SSOwat panel overlay", + "global_settings_setting_user_strength": "User password strength", + "global_settings_setting_webadmin_allowlist": "IP adresses allowed to access the webadmin. Comma-separated.", + "global_settings_setting_webadmin_allowlist_enabled": "Allow only some IPs to access the webadmin.", "global_settings_unknown_setting_from_settings_file": "Unknown key in settings: '{setting_key}', discard it and save it in /etc/yunohost/settings-unknown.json", "global_settings_unknown_type": "Unexpected situation, the setting {setting} appears to have the type {unknown_type} but it is not a type supported by the system.", "good_practices_about_admin_password": "You are now about to define a new administration password. The password should be at least 8 characters long—though it is good practice to use a longer password (i.e. a passphrase) and/or to use a variation of characters (uppercase, lowercase, digits and special characters).", diff --git a/share/actionsmap.yml b/share/actionsmap.yml index 89c6e914d..d4cf2d590 100644 --- a/share/actionsmap.yml +++ b/share/actionsmap.yml @@ -1093,6 +1093,11 @@ settings: list: action_help: list all entries of the settings api: GET /settings + arguments: + -f: + full: --full + help: Display all details (meant to be used by the API) + action: store_true ### settings_get() get: @@ -1101,22 +1106,29 @@ settings: arguments: key: help: Settings key - --full: - help: Show more details + -f: + full: --full + help: Display all details (meant to be used by the API) + action: store_true + -e: + full: --export + help: Only export key/values, meant to be reimported using "config set --args-file" action: store_true ### settings_set() set: action_help: set an entry value in the settings - api: POST /settings/ + api: PUT /settings arguments: key: - help: Settings key + help: The question or form key + nargs: '?' -v: full: --value help: new value - extra: - required: True + -a: + full: --args + help: Serialized arguments for new configuration (i.e. "mail_in=0&mail_out=0") ### settings_reset_all() reset-all: diff --git a/share/config_settings.toml b/share/config_settings.toml new file mode 100644 index 000000000..61f0a5725 --- /dev/null +++ b/share/config_settings.toml @@ -0,0 +1,125 @@ +version = "1.0" +i18n = "global_settings" + +[security] +name = "Security" + [security.password] + name = "Passwords" + [security.password.admin_strength] + type = "number" + default = 1 + + [security.password.user_strength] + type = "number" + default = 1 + + [security.ssh] + name = "SSH" + [security.ssh.ssh_compatibility] + type = "select" + default = "modern" + choices = ["intermediate", "modern"] + + [security.ssh.ssh_port] + type = "number" + default = 22 + + [security.ssh.ssh_password_authentication] + type = "boolean" + default = "false" + + [security.ssh.ssh_allow_deprecated_dsa_hostkey] + type = "boolean" + default = "false" + + [security.nginx] + name = "NGINX" + [security.nginx.nginx_redirect_to_https] + type = "boolean" + default = "true" + + [security.nginx.nginx_compatibility] + type = "select" + default = "intermediate" + choices = ["intermediate", "modern"] + + [security.postfix] + name = "Postfix" + [security.postfix.postfix_compatibility] + type = "select" + default = "intermediate" + choices = ["intermediate", "modern"] + + [security.webadmin] + name = "Webadmin" + [security.webadmin.webadmin_allowlist_enabled] + type = "boolean" + default = "false" + + [security.webadmin.webadmin_allowlist] + type = "tags" + visible = "webadmin_allowlist_enabled" + optional = true + default = "" + + [security.experimental] + name = "Experimental" + [security.experimental.security_experimental_enabled] + type = "boolean" + default = "false" + + +[email] +name = "Email" + [email.pop3] + name = "POP3" + [email.pop3.pop3_enabled] + type = "boolean" + default = "false" + + [email.smtp] + name = "SMTP" + [email.smtp.smtp_allow_ipv6] + type = "boolean" + default = "true" + + [email.smtp.smtp_relay_enabled] + type = "boolean" + default = "false" + + [email.smtp.smtp_relay_host] + type = "string" + default = "" + optional = true + visible="smtp_relay_enabled" + + [email.smtp.smtp_relay_port] + type = "number" + default = 587 + visible="smtp_relay_enabled" + + [email.smtp.smtp_relay_user] + type = "string" + default = "" + optional = true + visible="smtp_relay_enabled" + + [email.smtp.smtp_relay_password] + type = "password" + default = "" + optional = true + visible="smtp_relay_enabled" + +[misc] +name = "Other" + [misc.ssowat] + name = "SSOwat" + [misc.ssowat.ssowat_panel_overlay_enabled] + type = "boolean" + default = "true" + + [misc.backup] + name = "Backup" + [misc.backup.backup_compress_tar_archives] + type = "boolean" + default = "false" diff --git a/src/settings.py b/src/settings.py index cec416550..0701cd906 100644 --- a/src/settings.py +++ b/src/settings.py @@ -7,14 +7,17 @@ from collections import OrderedDict from moulinette import m18n from yunohost.utils.error import YunohostError, YunohostValidationError +from yunohost.utils.config import ConfigPanel, Question from moulinette.utils.log import getActionLogger from yunohost.regenconf import regen_conf from yunohost.firewall import firewall_reload +from yunohost.log import is_unit_operation +from yunohost.utils.legacy import translate_legacy_settings_to_configpanel_settings logger = getActionLogger("yunohost.settings") -SETTINGS_PATH = "/etc/yunohost/settings.json" -SETTINGS_PATH_OTHER_LOCATION = "/etc/yunohost/settings-%s.json" +SETTINGS_PATH = "/etc/yunohost/settings.yaml" +SETTINGS_PATH_OTHER_LOCATION = "/etc/yunohost/settings-%s.yaml" def is_boolean(value): @@ -59,71 +62,7 @@ def is_boolean(value): # * string # * enum (in the form of a python list) -DEFAULTS = OrderedDict( - [ - # Password Validation - # -1 disabled, 0 alert if listed, 1 8-letter, 2 normal, 3 strong, 4 strongest - ("security.password.admin.strength", {"type": "int", "default": 1}), - ("security.password.user.strength", {"type": "int", "default": 1}), - ( - "service.ssh.allow_deprecated_dsa_hostkey", - {"type": "bool", "default": False}, - ), - ( - "security.ssh.compatibility", - { - "type": "enum", - "default": "modern", - "choices": ["intermediate", "modern"], - }, - ), - ( - "security.ssh.port", - {"type": "int", "default": 22}, - ), - ( - "security.ssh.password_authentication", - {"type": "bool", "default": True}, - ), - ( - "security.nginx.redirect_to_https", - { - "type": "bool", - "default": True, - }, - ), - ( - "security.nginx.compatibility", - { - "type": "enum", - "default": "intermediate", - "choices": ["intermediate", "modern"], - }, - ), - ( - "security.postfix.compatibility", - { - "type": "enum", - "default": "intermediate", - "choices": ["intermediate", "modern"], - }, - ), - ("pop3.enabled", {"type": "bool", "default": False}), - ("smtp.allow_ipv6", {"type": "bool", "default": True}), - ("smtp.relay.host", {"type": "string", "default": ""}), - ("smtp.relay.port", {"type": "int", "default": 587}), - ("smtp.relay.user", {"type": "string", "default": ""}), - ("smtp.relay.password", {"type": "string", "default": ""}), - ("backup.compress_tar_archives", {"type": "bool", "default": False}), - ("ssowat.panel_overlay.enabled", {"type": "bool", "default": True}), - ("security.webadmin.allowlist.enabled", {"type": "bool", "default": False}), - ("security.webadmin.allowlist", {"type": "string", "default": ""}), - ("security.experimental.enabled", {"type": "bool", "default": False}), - ] -) - - -def settings_get(key, full=False): +def settings_get(key="", full=False, export=False): """ Get an entry value in the settings @@ -131,28 +70,42 @@ def settings_get(key, full=False): key -- Settings key """ - settings = _get_settings() - - if key not in settings: + if full and export: raise YunohostValidationError( - "global_settings_key_doesnt_exists", settings_key=key + "You can't use --full and --export together.", raw_msg=True ) if full: - return settings[key] + mode = "full" + elif export: + mode = "export" + else: + mode = "classic" - return settings[key]["value"] + if mode == "classic" and key == "": + raise YunohostValidationError( + "Missing key" + ) + + settings = SettingsConfigPanel() + key = translate_legacy_settings_to_configpanel_settings(key) + return settings.get(key, mode) -def settings_list(): +def settings_list(full=False, export=True): """ List all entries of the settings """ - return _get_settings() + + if full: + export = False + + return settings_get(full=full, export=export) -def settings_set(key, value): +@is_unit_operation() +def settings_set(operation_logger, key=None, value=None, args=None, args_file=None): """ Set an entry value in the settings @@ -161,78 +114,14 @@ def settings_set(key, value): value -- New value """ - settings = _get_settings() - - if key not in settings: - raise YunohostValidationError( - "global_settings_key_doesnt_exists", settings_key=key - ) - - key_type = settings[key]["type"] - - if key_type == "bool": - boolean_value = is_boolean(value) - if boolean_value[0]: - value = boolean_value[1] - else: - raise YunohostValidationError( - "global_settings_bad_type_for_setting", - setting=key, - received_type=type(value).__name__, - expected_type=key_type, - ) - elif key_type == "int": - if not isinstance(value, int) or isinstance(value, bool): - if isinstance(value, str): - try: - value = int(value) - except Exception: - raise YunohostValidationError( - "global_settings_bad_type_for_setting", - setting=key, - received_type=type(value).__name__, - expected_type=key_type, - ) - else: - raise YunohostValidationError( - "global_settings_bad_type_for_setting", - setting=key, - received_type=type(value).__name__, - expected_type=key_type, - ) - elif key_type == "string": - if not isinstance(value, str): - raise YunohostValidationError( - "global_settings_bad_type_for_setting", - setting=key, - received_type=type(value).__name__, - expected_type=key_type, - ) - elif key_type == "enum": - if value not in settings[key]["choices"]: - raise YunohostValidationError( - "global_settings_bad_choice_for_enum", - setting=key, - choice=str(value), - available_choices=", ".join(settings[key]["choices"]), - ) - else: - raise YunohostValidationError( - "global_settings_unknown_type", setting=key, unknown_type=key_type - ) - - old_value = settings[key].get("value") - settings[key]["value"] = value - _save_settings(settings) - - try: - trigger_post_change_hook(key, old_value, value) - except Exception as e: - logger.error(f"Post-change hook for setting {key} failed : {e}") - raise + Question.operation_logger = operation_logger + settings = SettingsConfigPanel() + key = translate_legacy_settings_to_configpanel_settings(key) + return settings.set(key, value, args, args_file, operation_logger=operation_logger) -def settings_reset(key): +@is_unit_operation() +def settings_reset(operation_logger, key): """ Set an entry value to its default one @@ -240,18 +129,14 @@ def settings_reset(key): key -- Settings key """ - settings = _get_settings() - if key not in settings: - raise YunohostValidationError( - "global_settings_key_doesnt_exists", settings_key=key - ) - - settings[key]["value"] = settings[key]["default"] - _save_settings(settings) + settings = SettingsConfigPanel() + key = translate_legacy_settings_to_configpanel_settings(key) + return settings.reset(key, operation_logger=operation_logger) -def settings_reset_all(): +@is_unit_operation() +def settings_reset_all(operation_logger): """ Reset all settings to their default value @@ -259,110 +144,72 @@ def settings_reset_all(): yes -- Yes I'm sure I want to do that """ - settings = _get_settings() - - # For now on, we backup the previous settings in case of but we don't have - # any mecanism to take advantage of those backups. It could be a nice - # addition but we'll see if this is a common need. - # Another solution would be to use etckeeper and integrate those - # modification inside of it and take advantage of its git history - old_settings_backup_path = ( - SETTINGS_PATH_OTHER_LOCATION % datetime.utcnow().strftime("%F_%X") - ) - _save_settings(settings, location=old_settings_backup_path) - - for value in settings.values(): - value["value"] = value["default"] - - _save_settings(settings) - - return { - "old_settings_backup_path": old_settings_backup_path, - "message": m18n.n( - "global_settings_reset_success", path=old_settings_backup_path - ), - } + settings = SettingsConfigPanel() + return settings.reset(operation_logger=operation_logger) def _get_setting_description(key): - return m18n.n(f"global_settings_setting_{key}".replace(".", "_")) + return m18n.n(f"global_settings_setting_{key.split('.')[-1]}") -def _get_settings(): +class SettingsConfigPanel(ConfigPanel): + entity_type = "settings" + save_path_tpl = SETTINGS_PATH + save_mode = "diff" - settings = {} + def __init__( + self, config_path=None, save_path=None, creation=False + ): + super().__init__("settings") - for key, value in DEFAULTS.copy().items(): - settings[key] = value - settings[key]["value"] = value["default"] - settings[key]["description"] = _get_setting_description(key) + def _apply(self): + super()._apply() - if not os.path.exists(SETTINGS_PATH): - return settings + settings = { k: v for k, v in self.future_values.items() if self.values.get(k) != v } + for setting_name, value in settings.items(): + try: + trigger_post_change_hook(setting_name, self.values.get(setting_name), value) + except Exception as e: + logger.error(f"Post-change hook for setting failed : {e}") + raise - # we have a very strict policy on only allowing settings that we know in - # the OrderedDict DEFAULTS - # For various reason, while reading the local settings we might encounter - # settings that aren't in DEFAULTS, those can come from settings key that - # we have removed, errors or the user trying to modify - # /etc/yunohost/settings.json - # To avoid to simply overwrite them, we store them in - # /etc/yunohost/settings-unknown.json in case of - unknown_settings = {} - unknown_settings_path = SETTINGS_PATH_OTHER_LOCATION % "unknown" + def reset(self, key = "", operation_logger=None): + self.filter_key = key + + # Read config panel toml + self._get_config_panel() + + if not self.config: + raise YunohostValidationError("config_no_panel") + + # Replace all values with default values + self.values = self._get_default_values() + + Question.operation_logger = operation_logger + + if operation_logger: + operation_logger.start() - if os.path.exists(unknown_settings_path): try: - unknown_settings = json.load(open(unknown_settings_path, "r")) - except Exception as e: - logger.warning(f"Error while loading unknown settings {e}") + self._apply() + except YunohostError: + raise + # Script got manually interrupted ... + # N.B. : KeyboardInterrupt does not inherit from Exception + except (KeyboardInterrupt, EOFError): + error = m18n.n("operation_interrupted") + logger.error(m18n.n("config_apply_failed", error=error)) + raise + # Something wrong happened in Yunohost's code (most probably hook_exec) + except Exception: + import traceback - try: - with open(SETTINGS_PATH) as settings_fd: - local_settings = json.load(settings_fd) + error = m18n.n("unexpected_error", error="\n" + traceback.format_exc()) + logger.error(m18n.n("config_apply_failed", error=error)) + raise - for key, value in local_settings.items(): - if key in settings: - settings[key] = value - settings[key]["description"] = _get_setting_description(key) - else: - logger.warning( - m18n.n( - "global_settings_unknown_setting_from_settings_file", - setting_key=key, - ) - ) - unknown_settings[key] = value - except Exception as e: - raise YunohostValidationError("global_settings_cant_open_settings", reason=e) - - if unknown_settings: - try: - _save_settings(unknown_settings, location=unknown_settings_path) - _save_settings(settings) - except Exception as e: - logger.warning(f"Failed to save unknown settings (because {e}), aborting.") - - return settings - - -def _save_settings(settings, location=SETTINGS_PATH): - settings_without_description = {} - for key, value in settings.items(): - settings_without_description[key] = value - if "description" in value: - del settings_without_description[key]["description"] - - try: - result = json.dumps(settings_without_description, indent=4) - except Exception as e: - raise YunohostError("global_settings_cant_serialize_settings", reason=e) - - try: - with open(location, "w") as settings_fd: - settings_fd.write(result) - except Exception as e: - raise YunohostError("global_settings_cant_write_settings", reason=e) + logger.success("Config updated as expected") + operation_logger.success() # Meant to be a dict of setting_name -> function to call @@ -370,13 +217,8 @@ post_change_hooks = {} def post_change_hook(setting_name): + # TODO: Check that setting_name exists def decorator(func): - assert ( - setting_name in DEFAULTS.keys() - ), f"The setting {setting_name} does not exists" - assert ( - setting_name not in post_change_hooks - ), f"You can only register one post change hook per setting (in particular for {setting_name})" post_change_hooks[setting_name] = func return func @@ -404,48 +246,48 @@ def trigger_post_change_hook(setting_name, old_value, new_value): # =========================================== -@post_change_hook("ssowat.panel_overlay.enabled") -@post_change_hook("security.nginx.redirect_to_https") -@post_change_hook("security.nginx.compatibility") -@post_change_hook("security.webadmin.allowlist.enabled") -@post_change_hook("security.webadmin.allowlist") +@post_change_hook("ssowat_panel_overlay_enabled") +@post_change_hook("nginx_redirect_to_https") +@post_change_hook("nginx_compatibility") +@post_change_hook("webadmin_allowlist_enabled") +@post_change_hook("webadmin_allowlist") def reconfigure_nginx(setting_name, old_value, new_value): if old_value != new_value: regen_conf(names=["nginx"]) -@post_change_hook("security.experimental.enabled") +@post_change_hook("security_experimental_enabled") def reconfigure_nginx_and_yunohost(setting_name, old_value, new_value): if old_value != new_value: regen_conf(names=["nginx", "yunohost"]) -@post_change_hook("security.ssh.compatibility") -@post_change_hook("security.ssh.password_authentication") +@post_change_hook("ssh_compatibility") +@post_change_hook("ssh_password_authentication") def reconfigure_ssh(setting_name, old_value, new_value): if old_value != new_value: regen_conf(names=["ssh"]) -@post_change_hook("security.ssh.port") +@post_change_hook("ssh_port") def reconfigure_ssh_and_fail2ban(setting_name, old_value, new_value): if old_value != new_value: regen_conf(names=["ssh", "fail2ban"]) firewall_reload() -@post_change_hook("smtp.allow_ipv6") -@post_change_hook("smtp.relay.host") -@post_change_hook("smtp.relay.port") -@post_change_hook("smtp.relay.user") -@post_change_hook("smtp.relay.password") -@post_change_hook("security.postfix.compatibility") +@post_change_hook("smtp_allow_ipv6") +@post_change_hook("smtp_relay_host") +@post_change_hook("smtp_relay_port") +@post_change_hook("smtp_relay_user") +@post_change_hook("smtp_relay_password") +@post_change_hook("postfix_compatibility") def reconfigure_postfix(setting_name, old_value, new_value): if old_value != new_value: regen_conf(names=["postfix"]) -@post_change_hook("pop3.enabled") +@post_change_hook("pop3_enabled") def reconfigure_dovecot(setting_name, old_value, new_value): dovecot_package = "dovecot-pop3d" diff --git a/src/utils/config.py b/src/utils/config.py index 56f632b09..e265527e7 100644 --- a/src/utils/config.py +++ b/src/utils/config.py @@ -801,6 +801,11 @@ class Question: def _prevalidate(self): if self.value in [None, ""] and not self.optional: + import traceback + error = m18n.n("unexpected_error", error="\n" + traceback.format_exc()) + msg = m18n.n("unexpected_error", app=app_instance_name, error=error) + logger.error(msg) + operation_logger.error(msg) raise YunohostValidationError("app_argument_required", name=self.name) # we have an answer, do some post checks diff --git a/src/utils/legacy.py b/src/utils/legacy.py index 85898f28d..74e6c24c3 100644 --- a/src/utils/legacy.py +++ b/src/utils/legacy.py @@ -62,6 +62,31 @@ LEGACY_PERMISSION_LABEL = { ): "api", # $excaped_domain$excaped_path/[%w-.]*/[%w-.]*/git%-receive%-pack,$excaped_domain$excaped_path/[%w-.]*/[%w-.]*/git%-upload%-pack,$excaped_domain$excaped_path/[%w-.]*/[%w-.]*/info/refs } +LEGACY_SETTINGS = { + "security.password.admin.strength": "security.password.admin_strength", + "security.password.user.strength": "security.password.user_strength", + "security.ssh.compatibility": "security.ssh.ssh_compatibility", + "security.ssh.port": "security.ssh.ssh_port", + "security.ssh.password_authentication": "security.ssh.ssh_password_authentication", + "service.ssh.allow_deprecated_dsa_hostkey": "security.ssh.ssh_allow_deprecated_dsa_hostkey", + "security.nginx.redirect_to_https": "security.nginx.nginx_redirect_to_https", + "security.nginx.compatibility": "security.nginx.nginx_compatibility", + "security.postfix.compatibility": "security.postfix.postfix_compatibility", + "pop3.enabled": "email.pop3.pop3_enabled", + "smtp.allow_ipv6": "email.smtp.smtp_allow_ipv6", + "smtp.relay.host": "email.smtp.smtp_relay_host", + "smtp.relay.port": "email.smtp.smtp_relay_port", + "smtp.relay.user": "email.smtp.smtp_relay_user", + "smtp.relay.password": "email.smtp.smtp_relay_password", + "backup.compress_tar_archives": "misc.backup.backup_compress_tar_archives", + "ssowat.panel_overlay.enabled": "misc.ssowat.ssowat_panel_overlay_enabled", + "security.webadmin.allowlist.enabled": "security.webadmin.webadmin_allowlist_enabled", + "security.webadmin.allowlist": "security.webadmin.webadmin_allowlist", + "security.experimental.enabled": "security.experimental.security_experimental_enabled" +} + +def translate_legacy_settings_to_configpanel_settings(settings): + return LEGACY_SETTINGS.get(settings, settings) def legacy_permission_label(app, permission_type): return LEGACY_PERMISSION_LABEL.get( From 3fd14a420eabeb8cb7f97ee539b4f737a9713c5f Mon Sep 17 00:00:00 2001 From: Tagadda <36127788+Tagadda@users.noreply.github.com> Date: Sun, 30 Jan 2022 00:37:07 +0000 Subject: [PATCH 037/174] wip --- locales/en.json | 48 ++++++++++++++++++++++++-------------- share/config_settings.toml | 2 +- src/settings.py | 15 ++++++++---- src/utils/config.py | 5 ---- 4 files changed, 43 insertions(+), 27 deletions(-) diff --git a/locales/en.json b/locales/en.json index e50e0f7d9..98ca26545 100644 --- a/locales/en.json +++ b/locales/en.json @@ -375,25 +375,39 @@ "global_settings_key_doesnt_exists": "The key '{settings_key}' does not exist in the global settings, you can see all the available keys by running 'yunohost settings list'", "global_settings_reset_success": "Previous settings now backed up to {path}", "global_settings_setting_admin_strength": "Admin password strength", - "global_settings_setting_backup_compress_tar_archives": "When creating new backups, compress the archives (.tar.gz) instead of uncompressed archives (.tar). N.B. : enabling this option means create lighter backup archives, but the initial backup procedure will be significantly longer and heavy on CPU.", - "global_settings_setting_nginx_compatibility": "Compatibility vs. security tradeoff for the web server NGINX. Affects the ciphers (and other security-related aspects)", - "global_settings_setting_nginx_redirect_to_https": "Redirect HTTP requests to HTTPs by default (DO NOT TURN OFF unless you really know what you're doing!)", - "global_settings_setting_pop3_enabled": "Enable the POP3 protocol for the mail server", - "global_settings_setting_postfix_compatibility": "Compatibility vs. security tradeoff for the Postfix server. Affects the ciphers (and other security-related aspects)", - "global_settings_setting_security_experimental_enabled": "Enable experimental security features (don't enable this if you don't know what you're doing!)", - "global_settings_setting_smtp_allow_ipv6": "Allow the use of IPv6 to receive and send mail", - "global_settings_setting_smtp_relay_host": "SMTP relay host to use in order to send mail instead of this yunohost instance. Useful if you are in one of this situation: your 25 port is blocked by your ISP or VPS provider, you have a residential IP listed on DUHL, you are not able to configure reverse DNS or this server is not directly exposed on the internet and you want use an other one to send mails.", - "global_settings_setting_smtp_relay_password": "SMTP relay host password", - "global_settings_setting_smtp_relay_port": "SMTP relay port", - "global_settings_setting_smtp_relay_user": "SMTP relay user account", - "global_settings_setting_ssh_allow_deprecated_dsa_hostkey": "Allow the use of (deprecated) DSA hostkey for the SSH daemon configuration", - "global_settings_setting_ssh_compatibility": "Compatibility vs. security tradeoff for the SSH server. Affects the ciphers (and other security-related aspects)", - "global_settings_setting_ssh_password_authentication": "Allow password authentication for SSH", + "global_settings_setting_backup_compress_tar_archives": "Compress backups", + "global_settings_setting_backup_compress_tar_archives_help": "When creating new backups, compress the archives (.tar.gz) instead of uncompressed archives (.tar). N.B. : enabling this option means create lighter backup archives, but the initial backup procedure will be significantly longer and heavy on CPU.", + "global_settings_setting_nginx_compatibility": "Compatibility", + "global_settings_setting_nginx_compatibility_help": "Compatibility vs. security tradeoff for the web server NGINX. Affects the ciphers (and other security-related aspects)", + "global_settings_setting_nginx_redirect_to_https": "Force HTTPS", + "global_settings_setting_nginx_redirect_to_https_help": "Redirect HTTP requests to HTTPs by default (DO NOT TURN OFF unless you really know what you're doing!)", + "global_settings_setting_pop3_enabled": "Enable POP3", + "global_settings_setting_pop3_enabled_help": "Enable the POP3 protocol for the mail server", + "global_settings_setting_postfix_compatibility": "Compatibility", + "global_settings_setting_postfix_compatibility_help": "Compatibility vs. security tradeoff for the Postfix server. Affects the ciphers (and other security-related aspects)", + "global_settings_setting_security_experimental_enabled": "Experimental security features", + "global_settings_setting_security_experimental_enabled_help": "Enable experimental security features (don't enable this if you don't know what you're doing!)", + "global_settings_setting_smtp_allow_ipv6": "Allow IPv6", + "global_settings_setting_smtp_allow_ipv6_help": "Allow the use of IPv6 to receive and send mail", + "global_settings_setting_smtp_relay_enabled": "Enable SMTP relay", + "global_settings_setting_smtp_relay_enabled_help": "Enable the SMTP relay to use in order to send mail instead of this yunohost instance. Useful if you are in one of this situation: your 25 port is blocked by your ISP or VPS provider, you have a residential IP listed on DUHL, you are not able to configure reverse DNS or this server is not directly exposed on the internet and you want use an other one to send mails.", + "global_settings_setting_smtp_relay_host": "Relay host", + "global_settings_setting_smtp_relay_password": "Relay password", + "global_settings_setting_smtp_relay_port": "Relay port", + "global_settings_setting_smtp_relay_user": "Relay user", + "global_settings_setting_ssh_allow_deprecated_dsa_hostkey": "Allow DSA hostkey", + "global_settings_setting_ssh_allow_deprecated_dsa_hostkey_help": "Allow the use of (deprecated) DSA hostkey for the SSH daemon configuration", + "global_settings_setting_ssh_compatibility": "Compatibility", + "global_settings_setting_ssh_compatibility_help": "Compatibility vs. security tradeoff for the SSH server. Affects the ciphers (and other security-related aspects)", + "global_settings_setting_ssh_password_authentication": "Password authentication", + "global_settings_setting_ssh_password_authentication_help": "Allow password authentication for SSH", "global_settings_setting_ssh_port": "SSH port", - "global_settings_setting_ssowat_panel_overlay_enabled": "Enable SSOwat panel overlay", + "global_settings_setting_ssowat_panel_overlay_enabled": "SSOwat panel overlay", "global_settings_setting_user_strength": "User password strength", - "global_settings_setting_webadmin_allowlist": "IP adresses allowed to access the webadmin. Comma-separated.", - "global_settings_setting_webadmin_allowlist_enabled": "Allow only some IPs to access the webadmin.", + "global_settings_setting_webadmin_allowlist": "Webadmin IP allowlist", + "global_settings_setting_webadmin_allowlist_help": "IP adresses allowed to access the webadmin.", + "global_settings_setting_webadmin_allowlist_enabled": "Enable Webadmin IP allowlist", + "global_settings_setting_webadmin_allowlist_enabled_help": "Allow only some IPs to access the webadmin.", "global_settings_unknown_setting_from_settings_file": "Unknown key in settings: '{setting_key}', discard it and save it in /etc/yunohost/settings-unknown.json", "global_settings_unknown_type": "Unexpected situation, the setting {setting} appears to have the type {unknown_type} but it is not a type supported by the system.", "good_practices_about_admin_password": "You are now about to define a new administration password. The password should be at least 8 characters long—though it is good practice to use a longer password (i.e. a passphrase) and/or to use a variation of characters (uppercase, lowercase, digits and special characters).", diff --git a/share/config_settings.toml b/share/config_settings.toml index 61f0a5725..1b2a59bc4 100644 --- a/share/config_settings.toml +++ b/share/config_settings.toml @@ -1,5 +1,5 @@ version = "1.0" -i18n = "global_settings" +i18n = "global_settings_setting" [security] name = "Security" diff --git a/src/settings.py b/src/settings.py index 0701cd906..89321e296 100644 --- a/src/settings.py +++ b/src/settings.py @@ -148,10 +148,6 @@ def settings_reset_all(operation_logger): return settings.reset(operation_logger=operation_logger) -def _get_setting_description(key): - return m18n.n(f"global_settings_setting_{key.split('.')[-1]}") - - class SettingsConfigPanel(ConfigPanel): entity_type = "settings" save_path_tpl = SETTINGS_PATH @@ -173,6 +169,17 @@ class SettingsConfigPanel(ConfigPanel): logger.error(f"Post-change hook for setting failed : {e}") raise + def get(self, key="", mode="classic"): + result = super().get(key=key, mode=mode) + + if mode == "full": + for panel, section, option in self._iterate(): + if m18n.key_exists(self.config["i18n"] + "_" + option["id"] + "_help"): + option["help"] = m18n.n(self.config["i18n"] + "_" + option["id"] + "_help") + return self.config + + return result + def reset(self, key = "", operation_logger=None): self.filter_key = key diff --git a/src/utils/config.py b/src/utils/config.py index e265527e7..56f632b09 100644 --- a/src/utils/config.py +++ b/src/utils/config.py @@ -801,11 +801,6 @@ class Question: def _prevalidate(self): if self.value in [None, ""] and not self.optional: - import traceback - error = m18n.n("unexpected_error", error="\n" + traceback.format_exc()) - msg = m18n.n("unexpected_error", app=app_instance_name, error=error) - logger.error(msg) - operation_logger.error(msg) raise YunohostValidationError("app_argument_required", name=self.name) # we have an answer, do some post checks From 35c5015db228f8f917d5c9f0f7804021ba29efa4 Mon Sep 17 00:00:00 2001 From: Tagadda <36127788+Tagadda@users.noreply.github.com> Date: Sun, 30 Jan 2022 19:29:00 +0000 Subject: [PATCH 038/174] Update locales --- locales/en.json | 10 +++------- src/settings.py | 2 +- 2 files changed, 4 insertions(+), 8 deletions(-) diff --git a/locales/en.json b/locales/en.json index 98ca26545..e4e14772c 100644 --- a/locales/en.json +++ b/locales/en.json @@ -367,13 +367,6 @@ "firewall_reload_failed": "Could not reload the firewall", "firewall_reloaded": "Firewall reloaded", "firewall_rules_cmd_failed": "Some firewall rule commands have failed. More info in log.", - "global_settings_bad_choice_for_enum": "Bad choice for setting {setting}, received '{choice}', but available choices are: {available_choices}", - "global_settings_bad_type_for_setting": "Bad type for setting {setting}, received {received_type}, expected {expected_type}", - "global_settings_cant_open_settings": "Could not open settings file, reason: {reason}", - "global_settings_cant_serialize_settings": "Could not serialize settings data, reason: {reason}", - "global_settings_cant_write_settings": "Could not save settings file, reason: {reason}", - "global_settings_key_doesnt_exists": "The key '{settings_key}' does not exist in the global settings, you can see all the available keys by running 'yunohost settings list'", - "global_settings_reset_success": "Previous settings now backed up to {path}", "global_settings_setting_admin_strength": "Admin password strength", "global_settings_setting_backup_compress_tar_archives": "Compress backups", "global_settings_setting_backup_compress_tar_archives_help": "When creating new backups, compress the archives (.tar.gz) instead of uncompressed archives (.tar). N.B. : enabling this option means create lighter backup archives, but the initial backup procedure will be significantly longer and heavy on CPU.", @@ -492,6 +485,9 @@ "log_user_permission_reset": "Reset permission '{}'", "log_user_permission_update": "Update accesses for permission '{}'", "log_user_update": "Update info for user '{}'", + "log_settings_set": "Apply setting '{}'", + "log_settings_reset": "Reset setting '{}'", + "log_settings_reset_all": "Reset all setting", "mail_alias_remove_failed": "Could not remove e-mail alias '{mail}'", "mail_domain_unknown": "Invalid e-mail address for domain '{domain}'. Please, use a domain administrated by this server.", "mail_forward_remove_failed": "Could not remove e-mail forwarding '{mail}'", diff --git a/src/settings.py b/src/settings.py index 89321e296..e50fd2256 100644 --- a/src/settings.py +++ b/src/settings.py @@ -215,7 +215,7 @@ class SettingsConfigPanel(ConfigPanel): logger.error(m18n.n("config_apply_failed", error=error)) raise - logger.success("Config updated as expected") + logger.success(m18n.("global_settings_reset_success")) operation_logger.success() From 6428417aa0a73de7b9c8e1900d74be8feb92a45a Mon Sep 17 00:00:00 2001 From: Tagadda <36127788+Tagadda@users.noreply.github.com> Date: Sun, 30 Jan 2022 23:05:38 +0000 Subject: [PATCH 039/174] clean unused code and a typo :D --- src/settings.py | 48 +----------------------------------------------- 1 file changed, 1 insertion(+), 47 deletions(-) diff --git a/src/settings.py b/src/settings.py index e50fd2256..a6b65b095 100644 --- a/src/settings.py +++ b/src/settings.py @@ -2,9 +2,6 @@ import os import json import subprocess -from datetime import datetime -from collections import OrderedDict - from moulinette import m18n from yunohost.utils.error import YunohostError, YunohostValidationError from yunohost.utils.config import ConfigPanel, Question @@ -17,51 +14,8 @@ from yunohost.utils.legacy import translate_legacy_settings_to_configpanel_setti logger = getActionLogger("yunohost.settings") SETTINGS_PATH = "/etc/yunohost/settings.yaml" -SETTINGS_PATH_OTHER_LOCATION = "/etc/yunohost/settings-%s.yaml" -def is_boolean(value): - TRUE = ["true", "on", "yes", "y", "1"] - FALSE = ["false", "off", "no", "n", "0"] - - """ - Ensure a string value is intended as a boolean - - Keyword arguments: - arg -- The string to check - - Returns: - (is_boolean, boolean_value) - - """ - if isinstance(value, bool): - return True, value - if value in [0, 1]: - return True, bool(value) - elif isinstance(value, str): - if str(value).lower() in TRUE + FALSE: - return True, str(value).lower() in TRUE - else: - return False, None - else: - return False, None - - -# a settings entry is in the form of: -# namespace.subnamespace.name: {type, value, default, description, [choices]} -# choices is only for enum -# the keyname can have as many subnamespace as needed but should have at least -# one level of namespace - -# description is implied from the translated strings -# the key is "global_settings_setting_%s" % key.replace(".", "_") - -# type can be: -# * bool -# * int -# * string -# * enum (in the form of a python list) - def settings_get(key="", full=False, export=False): """ Get an entry value in the settings @@ -215,7 +169,7 @@ class SettingsConfigPanel(ConfigPanel): logger.error(m18n.n("config_apply_failed", error=error)) raise - logger.success(m18n.("global_settings_reset_success")) + logger.success(m18n.n("global_settings_reset_success")) operation_logger.success() From f3349d4b3d8a3b88cc4f1236676e735a5ca5a383 Mon Sep 17 00:00:00 2001 From: Tagadda <36127788+Tagadda@users.noreply.github.com> Date: Sun, 30 Jan 2022 23:35:32 +0000 Subject: [PATCH 040/174] settings migration wip --- .../0024_global_settings_to_configpanel.py | 32 +++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 src/migrations/0024_global_settings_to_configpanel.py diff --git a/src/migrations/0024_global_settings_to_configpanel.py b/src/migrations/0024_global_settings_to_configpanel.py new file mode 100644 index 000000000..b165b75b9 --- /dev/null +++ b/src/migrations/0024_global_settings_to_configpanel.py @@ -0,0 +1,32 @@ +import subprocess +import time + +from yunohost.utils.error import YunohostError +from moulinette.utils.log import getActionLogger + +from yunohost.tools import Migration +from yunohost.utils.legacy import LEGACY_SETTINGS, translate_legacy_settings_to_configpanel_settings +from yunohost.settings import settings_set + +logger = getActionLogger("yunohost.migration") + +SETTINGS_PATH = "/etc/yunohost/settings.json" + +class MyMigration(Migration): + + "Migrate old global settings to the new ConfigPanel global settings" + + dependencies = ["migrate_to_bullseye"] + + def run(self): + if not os.path.exists(SETTINGS_PATH): + return + + try: + old_settings = json.load(open(SETTINGS_PATH)) + except Exception as e: + raise YunohostError("global_settings_cant_open_settings", reason=e) + + for key, value in old_settings.items(): + if key in LEGACY_SETTINGS: + settings_set(key=key, value=value) From 2156fb402b560058dca4ffec87e10b26e6dffdff Mon Sep 17 00:00:00 2001 From: Tagadda <36127788+Tagadda@users.noreply.github.com> Date: Mon, 31 Jan 2022 00:57:00 +0000 Subject: [PATCH 041/174] settings migration --- locales/en.json | 4 ++-- .../0024_global_settings_to_configpanel.py | 16 +++++++++------- 2 files changed, 11 insertions(+), 9 deletions(-) diff --git a/locales/en.json b/locales/en.json index e4e14772c..8be16738a 100644 --- a/locales/en.json +++ b/locales/en.json @@ -485,8 +485,8 @@ "log_user_permission_reset": "Reset permission '{}'", "log_user_permission_update": "Update accesses for permission '{}'", "log_user_update": "Update info for user '{}'", - "log_settings_set": "Apply setting '{}'", - "log_settings_reset": "Reset setting '{}'", + "log_settings_set": "Apply settings", + "log_settings_reset": "Reset setting", "log_settings_reset_all": "Reset all setting", "mail_alias_remove_failed": "Could not remove e-mail alias '{mail}'", "mail_domain_unknown": "Invalid e-mail address for domain '{domain}'. Please, use a domain administrated by this server.", diff --git a/src/migrations/0024_global_settings_to_configpanel.py b/src/migrations/0024_global_settings_to_configpanel.py index b165b75b9..7283f168b 100644 --- a/src/migrations/0024_global_settings_to_configpanel.py +++ b/src/migrations/0024_global_settings_to_configpanel.py @@ -1,16 +1,16 @@ import subprocess import time +import urllib from yunohost.utils.error import YunohostError from moulinette.utils.log import getActionLogger from yunohost.tools import Migration -from yunohost.utils.legacy import LEGACY_SETTINGS, translate_legacy_settings_to_configpanel_settings from yunohost.settings import settings_set logger = getActionLogger("yunohost.migration") -SETTINGS_PATH = "/etc/yunohost/settings.json" +OLD_SETTINGS_PATH = "/etc/yunohost/settings.json" class MyMigration(Migration): @@ -19,14 +19,16 @@ class MyMigration(Migration): dependencies = ["migrate_to_bullseye"] def run(self): - if not os.path.exists(SETTINGS_PATH): + if not os.path.exists(OLD_SETTINGS_PATH): return try: - old_settings = json.load(open(SETTINGS_PATH)) + old_settings = json.load(open(OLD_SETTINGS_PATH)) except Exception as e: raise YunohostError("global_settings_cant_open_settings", reason=e) - for key, value in old_settings.items(): - if key in LEGACY_SETTINGS: - settings_set(key=key, value=value) + settings = { k: v['values'] for k,v in old_settings.items() } + + args = urllib.parse.urlencode(settings) + settings_set(args=args) + From 1d782b3a66c2ee866bee8391e40537eb37b6c050 Mon Sep 17 00:00:00 2001 From: Tagadda <36127788+Tagadda@users.noreply.github.com> Date: Mon, 14 Feb 2022 11:33:54 +0000 Subject: [PATCH 042/174] Update locales again --- locales/en.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/locales/en.json b/locales/en.json index 8be16738a..3973c1745 100644 --- a/locales/en.json +++ b/locales/en.json @@ -251,7 +251,7 @@ "diagnosis_mail_fcrdns_different_from_ehlo_domain_details": "Current reverse DNS: {rdns_domain}
Expected value: {ehlo_domain}", "diagnosis_mail_fcrdns_dns_missing": "No reverse DNS is defined in IPv{ipversion}. Some emails may fail to get delivered or may get flagged as spam.", "diagnosis_mail_fcrdns_nok_alternatives_4": "Some providers won't let you configure your reverse DNS (or their feature might be broken...). If you are experiencing issues because of this, consider the following solutions:
- Some ISP provide the alternative of using a mail server relay though it implies that the relay will be able to spy on your email traffic.
- A privacy-friendly alternative is to use a VPN *with a dedicated public IP* to bypass this kind of limits. See https://yunohost.org/#/vpn_advantage
- Or it's possible to switch to a different provider", - "diagnosis_mail_fcrdns_nok_alternatives_6": "Some providers won't let you configure your reverse DNS (or their feature might be broken...). If your reverse DNS is correctly configured for IPv4, you can try disabling the use of IPv6 when sending emails by running yunohost settings set smtp.allow_ipv6 -v off. Note: this last solution means that you won't be able to send or receive emails from the few IPv6-only servers out there.", + "diagnosis_mail_fcrdns_nok_alternatives_6": "Some providers won't let you configure your reverse DNS (or their feature might be broken...). If your reverse DNS is correctly configured for IPv4, you can try disabling the use of IPv6 when sending emails by running yunohost settings set email.smtp.smtp_allow_ipv6 -v off. Note: this last solution means that you won't be able to send or receive emails from the few IPv6-only servers out there.", "diagnosis_mail_fcrdns_nok_details": "You should first try to configure the reverse DNS with {ehlo_domain} in your internet router interface or your hosting provider interface. (Some hosting provider may require you to send them a support ticket for this).", "diagnosis_mail_fcrdns_ok": "Your reverse DNS is correctly configured!", "diagnosis_mail_outgoing_port_25_blocked": "The SMTP mail server cannot send emails to other servers because outgoing port 25 is blocked in IPv{ipversion}.", @@ -288,8 +288,8 @@ "diagnosis_services_bad_status_tip": "You can try to restart the service, and if it doesn't work, have a look at the service logs in the webadmin (from the command line, you can do this with yunohost service restart {service} and yunohost service log {service}).", "diagnosis_services_conf_broken": "Configuration is broken for service {service}!", "diagnosis_services_running": "Service {service} is running!", - "diagnosis_sshd_config_inconsistent": "It looks like the SSH port was manually modified in /etc/ssh/sshd_config. Since YunoHost 4.2, a new global setting 'security.ssh.port' is available to avoid manually editing the configuration.", - "diagnosis_sshd_config_inconsistent_details": "Please run yunohost settings set security.ssh.port -v YOUR_SSH_PORT to define the SSH port, and check yunohost tools regen-conf ssh --dry-run --with-diff and yunohost tools regen-conf ssh --force to reset your conf to the YunoHost recommendation.", + "diagnosis_sshd_config_inconsistent": "It looks like the SSH port was manually modified in /etc/ssh/sshd_config. Since YunoHost 4.2, a new global setting 'security.ssh.ssh_port' is available to avoid manually editing the configuration.", + "diagnosis_sshd_config_inconsistent_details": "Please run yunohost settings set security.ssh.ssh_port -v YOUR_SSH_PORT to define the SSH port, and check yunohost tools regen-conf ssh --dry-run --with-diff and yunohost tools regen-conf ssh --force to reset your conf to the YunoHost recommendation.", "diagnosis_sshd_config_insecure": "The SSH configuration appears to have been manually modified, and is insecure because it contains no 'AllowGroups' or 'AllowUsers' directive to limit access to authorized users.", "diagnosis_swap_none": "The system has no swap at all. You should consider adding at least {recommended} of swap to avoid situations where the system runs out of memory.", "diagnosis_swap_notsomuch": "The system has only {total} swap. You should consider having at least {recommended} to avoid situations where the system runs out of memory.", From eb747cc15e90436d3d0a1a3765b067287c39ba3d Mon Sep 17 00:00:00 2001 From: Tagadda <36127788+Tagadda@users.noreply.github.com> Date: Mon, 14 Feb 2022 11:37:13 +0000 Subject: [PATCH 043/174] Search and replace old settings, first pass --- conf/ssh/sshd_config | 4 ++-- hooks/conf_regen/03-ssh | 8 ++++---- hooks/conf_regen/15-nginx | 12 ++++++------ hooks/conf_regen/25-dovecot | 2 +- hooks/conf_regen/52-fail2ban | 2 +- maintenance/missing_i18n_keys.py | 2 +- src/backup.py | 2 +- src/diagnosers/24-mail.py | 2 +- src/diagnosers/70-regenconf.py | 2 +- 9 files changed, 18 insertions(+), 18 deletions(-) diff --git a/conf/ssh/sshd_config b/conf/ssh/sshd_config index b6d4111ee..eaa0c7380 100644 --- a/conf/ssh/sshd_config +++ b/conf/ssh/sshd_config @@ -3,7 +3,7 @@ Protocol 2 # PLEASE: if you wish to change the ssh port properly in YunoHost, use this command: -# yunohost settings set security.ssh.port -v +# yunohost settings set security.ssh.ssh_port -v Port {{ port }} {% if ipv6_enabled == "true" %}ListenAddress ::{% endif %} @@ -56,7 +56,7 @@ ChallengeResponseAuthentication no UsePAM yes # PLEASE: if you wish to force everybody to authenticate using ssh keys, run this command: -# yunohost settings set security.ssh.password_authentication -v no +# yunohost settings set security.ssh.ssh_password_authentication -v no {% if password_authentication == "False" %} PasswordAuthentication no {% else %} diff --git a/hooks/conf_regen/03-ssh b/hooks/conf_regen/03-ssh index 9a7f5ce4d..eb548d4f4 100755 --- a/hooks/conf_regen/03-ssh +++ b/hooks/conf_regen/03-ssh @@ -15,14 +15,14 @@ do_pre_regen() { ssh_keys=$(ls /etc/ssh/ssh_host_{ed25519,rsa,ecdsa}_key 2>/dev/null || true) # Support legacy setting (this setting might be disabled by a user during a migration) - if [[ "$(yunohost settings get 'service.ssh.allow_deprecated_dsa_hostkey')" == "True" ]]; then + if [[ "$(yunohost settings get 'security.ssh.ssh_allow_deprecated_dsa_hostkey')" == "True" ]]; then ssh_keys="$ssh_keys $(ls /etc/ssh/ssh_host_dsa_key 2>/dev/null || true)" fi # Support different strategy for security configurations - export compatibility="$(yunohost settings get 'security.ssh.compatibility')" - export port="$(yunohost settings get 'security.ssh.port')" - export password_authentication="$(yunohost settings get 'security.ssh.password_authentication')" + export compatibility="$(yunohost settings get 'security.ssh.ssh_compatibility')" + export port="$(yunohost settings get 'security.ssh.ssh_port')" + export password_authentication="$(yunohost settings get 'security.ssh.ssh_password_authentication')" export ssh_keys export ipv6_enabled ynh_render_template "sshd_config" "${pending_dir}/etc/ssh/sshd_config" diff --git a/hooks/conf_regen/15-nginx b/hooks/conf_regen/15-nginx index c1d943681..482784d8d 100755 --- a/hooks/conf_regen/15-nginx +++ b/hooks/conf_regen/15-nginx @@ -56,7 +56,7 @@ do_pre_regen() { # install / update plain conf files cp plain/* "$nginx_conf_dir" # remove the panel overlay if this is specified in settings - panel_overlay=$(yunohost settings get 'ssowat.panel_overlay.enabled') + panel_overlay=$(yunohost settings get 'misc.ssowat.ssowat_panel_overlay_enabled') if [ "$panel_overlay" == "false" ] || [ "$panel_overlay" == "False" ]; then echo "#" >"${nginx_conf_dir}/yunohost_panel.conf.inc" fi @@ -65,9 +65,9 @@ do_pre_regen() { main_domain=$(cat /etc/yunohost/current_host) # Support different strategy for security configurations - export redirect_to_https="$(yunohost settings get 'security.nginx.redirect_to_https')" - export compatibility="$(yunohost settings get 'security.nginx.compatibility')" - export experimental="$(yunohost settings get 'security.experimental.enabled')" + export redirect_to_https="$(yunohost settings get 'security.nginx.nginx_redirect_to_https')" + export compatibility="$(yunohost settings get 'security.nginx.nginx_compatibility')" + export experimental="$(yunohost settings get 'security.experimental.security_experimental_enabled')" ynh_render_template "security.conf.inc" "${nginx_conf_dir}/security.conf.inc" cert_status=$(yunohost domain cert status --json) @@ -92,9 +92,9 @@ do_pre_regen() { done - export webadmin_allowlist_enabled=$(yunohost settings get security.webadmin.allowlist.enabled) + export webadmin_allowlist_enabled=$(yunohost settings get security.webadmin.webadmin_allowlist_enabled) if [ "$webadmin_allowlist_enabled" == "True" ]; then - export webadmin_allowlist=$(yunohost settings get security.webadmin.allowlist) + export webadmin_allowlist=$(yunohost settings get security.webadmin.webadmin_allowlist) fi ynh_render_template "yunohost_admin.conf.inc" "${nginx_conf_dir}/yunohost_admin.conf.inc" ynh_render_template "yunohost_api.conf.inc" "${nginx_conf_dir}/yunohost_api.conf.inc" diff --git a/hooks/conf_regen/25-dovecot b/hooks/conf_regen/25-dovecot index 37c73b6d8..da7e0fa75 100755 --- a/hooks/conf_regen/25-dovecot +++ b/hooks/conf_regen/25-dovecot @@ -16,7 +16,7 @@ do_pre_regen() { cp dovecot-ldap.conf "${dovecot_dir}/dovecot-ldap.conf" cp dovecot.sieve "${dovecot_dir}/global_script/dovecot.sieve" - export pop3_enabled="$(yunohost settings get 'pop3.enabled')" + export pop3_enabled="$(yunohost settings get 'email.pop3.pop3_enabled')" export main_domain=$(cat /etc/yunohost/current_host) export domain_list="$YNH_DOMAINS" diff --git a/hooks/conf_regen/52-fail2ban b/hooks/conf_regen/52-fail2ban index 8129e977d..8ef20f979 100755 --- a/hooks/conf_regen/52-fail2ban +++ b/hooks/conf_regen/52-fail2ban @@ -16,7 +16,7 @@ do_pre_regen() { cp yunohost.conf "${fail2ban_dir}/filter.d/yunohost.conf" cp jail.conf "${fail2ban_dir}/jail.conf" - export ssh_port="$(yunohost settings get 'security.ssh.port')" + export ssh_port="$(yunohost settings get 'security.ssh.ssh_port')" ynh_render_template "yunohost-jails.conf" "${fail2ban_dir}/jail.d/yunohost-jails.conf" } diff --git a/maintenance/missing_i18n_keys.py b/maintenance/missing_i18n_keys.py index 3dbca8027..817c73c61 100644 --- a/maintenance/missing_i18n_keys.py +++ b/maintenance/missing_i18n_keys.py @@ -100,7 +100,7 @@ def find_expected_string_keys(): yield m # Global settings descriptions - # Will be on a line like : ("service.ssh.allow_deprecated_dsa_hostkey", {"type": "bool", ... + # Will be on a line like : ("security.ssh.ssh_allow_deprecated_dsa_hostkey", {"type": "bool", ... p5 = re.compile(r" \(\n*\s*[\"\'](\w[\w\.]+)[\"\'],") content = open(ROOT + "src/settings.py").read() for m in ( diff --git a/src/backup.py b/src/backup.py index bba60b895..10b876244 100644 --- a/src/backup.py +++ b/src/backup.py @@ -1928,7 +1928,7 @@ class TarBackupMethod(BackupMethod): def _archive_file(self): if isinstance(self.manager, BackupManager) and settings_get( - "backup.compress_tar_archives" + "misc.backup.backup_compress_tar_archives" ): return os.path.join(self.repo, self.name + ".tar.gz") diff --git a/src/diagnosers/24-mail.py b/src/diagnosers/24-mail.py index 7fe7a08db..4b370a2b4 100644 --- a/src/diagnosers/24-mail.py +++ b/src/diagnosers/24-mail.py @@ -291,7 +291,7 @@ class MyDiagnoser(Diagnoser): if global_ipv4: outgoing_ips.append(global_ipv4) - if settings_get("smtp.allow_ipv6"): + if settings_get("email.smtp.smtp_allow_ipv6"): ipv6 = Diagnoser.get_cached_report("ip", {"test": "ipv6"}) or {} if ipv6.get("status") == "SUCCESS": outgoing_ipversions.append(6) diff --git a/src/diagnosers/70-regenconf.py b/src/diagnosers/70-regenconf.py index 591f883a4..787fb257d 100644 --- a/src/diagnosers/70-regenconf.py +++ b/src/diagnosers/70-regenconf.py @@ -53,7 +53,7 @@ class MyDiagnoser(Diagnoser): ) # Check consistency between actual ssh port in sshd_config vs. setting - ssh_port_setting = settings_get("security.ssh.port") + ssh_port_setting = settings_get("security.ssh.ssh_port") ssh_port_line = re.findall( r"\bPort *([0-9]{2,5})\b", read_file("/etc/ssh/sshd_config") ) From f0bf8dd1fdfe923d7c39a85b679f728f731b3df4 Mon Sep 17 00:00:00 2001 From: Tagadda <36127788+Tagadda@users.noreply.github.com> Date: Mon, 14 Feb 2022 12:24:43 +0000 Subject: [PATCH 044/174] settings: use email.smtp.smtp_relay_enabled --- conf/postfix/main.cf | 4 ++-- hooks/conf_regen/19-postfix | 16 +++++++++------- .../0024_global_settings_to_configpanel.py | 6 ++++-- 3 files changed, 15 insertions(+), 11 deletions(-) diff --git a/conf/postfix/main.cf b/conf/postfix/main.cf index 3e53714d0..13b68cafa 100644 --- a/conf/postfix/main.cf +++ b/conf/postfix/main.cf @@ -81,7 +81,7 @@ alias_maps = hash:/etc/aliases alias_database = hash:/etc/aliases mydomain = {{ main_domain }} mydestination = localhost -{% if relay_host == "" %} +{% if relay_enabled != "True" %} relayhost = {% else %} relayhost = [{{ relay_host }}]:{{ relay_port }} @@ -198,7 +198,7 @@ smtpd_client_recipient_rate_limit=150 # and after to send spam disable_vrfy_command = yes -{% if relay_user != "" %} +{% if relay_enabled == "True" %} # Relay email through an other smtp account # enable SASL authentication smtp_sasl_auth_enable = yes diff --git a/hooks/conf_regen/19-postfix b/hooks/conf_regen/19-postfix index 177ea23e9..8a767c404 100755 --- a/hooks/conf_regen/19-postfix +++ b/hooks/conf_regen/19-postfix @@ -22,17 +22,19 @@ do_pre_regen() { main_domain=$(cat /etc/yunohost/current_host) # Support different strategy for security configurations - export compatibility="$(yunohost settings get 'security.postfix.compatibility')" + export compatibility="$(yunohost settings get 'security.postfix.postfix_compatibility')" # Add possibility to specify a relay # Could be useful with some isp with no 25 port open or more complex setup export relay_port="" export relay_user="" - export relay_host="$(yunohost settings get 'smtp.relay.host')" - if [ -n "${relay_host}" ]; then - relay_port="$(yunohost settings get 'smtp.relay.port')" - relay_user="$(yunohost settings get 'smtp.relay.user')" - relay_password="$(yunohost settings get 'smtp.relay.password')" + export relay_host="" + export relay_enabled="$(yunohost settings get 'email.smtp.smtp_relay_enabled')" + if [ "${relay_enabled}" == "True" ]; then + relay_host="$(yunohost settings get 'email.smtp.smtp_relay_host')" + relay_port="$(yunohost settings get 'email.smtp.smtp_relay_port')" + relay_user="$(yunohost settings get 'email.smtp.smtp_relay_user')" + relay_password="$(yunohost settings get 'email.smtp.smtp_relay_password')" # Avoid to display "Relay account paswword" to other users touch ${postfix_dir}/sasl_passwd @@ -54,7 +56,7 @@ do_pre_regen() { >"${default_dir}/postsrsd" # adapt it for IPv4-only hosts - ipv6="$(yunohost settings get 'smtp.allow_ipv6')" + ipv6="$(yunohost settings get 'email.smtp.smtp_allow_ipv6')" if [ "$ipv6" == "False" ] || [ ! -f /proc/net/if_inet6 ]; then sed -i \ 's/ \[::ffff:127.0.0.0\]\/104 \[::1\]\/128//g' \ diff --git a/src/migrations/0024_global_settings_to_configpanel.py b/src/migrations/0024_global_settings_to_configpanel.py index 7283f168b..977e1349f 100644 --- a/src/migrations/0024_global_settings_to_configpanel.py +++ b/src/migrations/0024_global_settings_to_configpanel.py @@ -28,7 +28,9 @@ class MyMigration(Migration): raise YunohostError("global_settings_cant_open_settings", reason=e) settings = { k: v['values'] for k,v in old_settings.items() } - + + if settings.get('smtp.relay.host') != "": + settings['email.smtp.smtp_relay_enabled'] == "True" + args = urllib.parse.urlencode(settings) settings_set(args=args) - From 133ba3f14f3c90dddafbcd457b99c1950ee6c700 Mon Sep 17 00:00:00 2001 From: Tagadda <36127788+Tagadda@users.noreply.github.com> Date: Mon, 14 Feb 2022 12:25:19 +0000 Subject: [PATCH 045/174] settings: backup settings.yml --- hooks/backup/20-conf_ynh_settings | 2 +- hooks/restore/20-conf_ynh_settings | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/hooks/backup/20-conf_ynh_settings b/hooks/backup/20-conf_ynh_settings index 76ab0aaca..0820978e7 100644 --- a/hooks/backup/20-conf_ynh_settings +++ b/hooks/backup/20-conf_ynh_settings @@ -13,6 +13,6 @@ backup_dir="${1}/conf/ynh" ynh_backup "/etc/yunohost/firewall.yml" "${backup_dir}/firewall.yml" ynh_backup "/etc/yunohost/current_host" "${backup_dir}/current_host" [ ! -d "/etc/yunohost/domains" ] || ynh_backup "/etc/yunohost/domains" "${backup_dir}/domains" -[ ! -e "/etc/yunohost/settings.json" ] || ynh_backup "/etc/yunohost/settings.json" "${backup_dir}/settings.json" +[ ! -e "/etc/yunohost/settings.yml" ] || ynh_backup "/etc/yunohost/settings.yml" "${backup_dir}/settings.yml" [ ! -d "/etc/yunohost/dyndns" ] || ynh_backup "/etc/yunohost/dyndns" "${backup_dir}/dyndns" [ ! -d "/etc/dkim" ] || ynh_backup "/etc/dkim" "${backup_dir}/dkim" diff --git a/hooks/restore/20-conf_ynh_settings b/hooks/restore/20-conf_ynh_settings index 2d731bd54..aba2b7a46 100644 --- a/hooks/restore/20-conf_ynh_settings +++ b/hooks/restore/20-conf_ynh_settings @@ -3,6 +3,6 @@ backup_dir="$1/conf/ynh" cp -a "${backup_dir}/current_host" /etc/yunohost/current_host cp -a "${backup_dir}/firewall.yml" /etc/yunohost/firewall.yml [ ! -d "${backup_dir}/domains" ] || cp -a "${backup_dir}/domains" /etc/yunohost/domains -[ ! -e "${backup_dir}/settings.json" ] || cp -a "${backup_dir}/settings.json" "/etc/yunohost/settings.json" +[ ! -e "${backup_dir}/settings.yml" ] || cp -a "${backup_dir}/settings.yml" "/etc/yunohost/settings.yml" [ ! -d "${backup_dir}/dyndns" ] || cp -raT "${backup_dir}/dyndns" "/etc/yunohost/dyndns" [ ! -d "${backup_dir}/dkim" ] || cp -raT "${backup_dir}/dkim" "/etc/dkim" From 6563ebb1ca147f0160e60f2e1f1d42715f55e483 Mon Sep 17 00:00:00 2001 From: Tagadda <36127788+Tagadda@users.noreply.github.com> Date: Mon, 14 Feb 2022 12:25:58 +0000 Subject: [PATCH 046/174] typo --- src/settings.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/settings.py b/src/settings.py index a6b65b095..45c077fa3 100644 --- a/src/settings.py +++ b/src/settings.py @@ -13,7 +13,7 @@ from yunohost.utils.legacy import translate_legacy_settings_to_configpanel_setti logger = getActionLogger("yunohost.settings") -SETTINGS_PATH = "/etc/yunohost/settings.yaml" +SETTINGS_PATH = "/etc/yunohost/settings.yml" def settings_get(key="", full=False, export=False): From 2bf3fed6e6cd04ef66065b964abff10999a5a5f5 Mon Sep 17 00:00:00 2001 From: Tagadda <36127788+Tagadda@users.noreply.github.com> Date: Mon, 14 Feb 2022 12:26:54 +0000 Subject: [PATCH 047/174] settings: password stength...what could go wrong ? --- src/utils/password.py | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/src/utils/password.py b/src/utils/password.py index 5b8372962..26f7adad7 100644 --- a/src/utils/password.py +++ b/src/utils/password.py @@ -25,6 +25,8 @@ import json import string import subprocess +from yunohost.settings import settings_get + SMALL_PWD_LIST = [ "yunohost", "olinuxino", @@ -58,7 +60,7 @@ class PasswordValidator: The profile shall be either "user" or "admin" and will correspond to a validation strength - defined via the setting "security.password..strength" + defined via the setting "security.password._strength" """ self.profile = profile @@ -67,9 +69,10 @@ class PasswordValidator: # from settings.py because this file is also meant to be # use as a script by ssowat. # (or at least that's my understanding -- Alex) - settings = json.load(open("/etc/yunohost/settings.json", "r")) - setting_key = "security.password." + profile + ".strength" - self.validation_strength = int(settings[setting_key]["value"]) + # Meh... I'll try to use settings_get() anyway... What could go + # wrong ? And who even change password from SSOwat ? -- Tagada + setting_key = "security.password." + profile + "_strength" + self.validation_strength = settings_get(setting_key) except Exception: # Fallback to default value if we can't fetch settings for some reason self.validation_strength = 1 From fbadceb72a5fb745fd26d1f914857c0f2d90d127 Mon Sep 17 00:00:00 2001 From: Tagadda <36127788+Tagadda@users.noreply.github.com> Date: Mon, 14 Feb 2022 12:27:28 +0000 Subject: [PATCH 048/174] settings: use True and False for booleans --- share/config_settings.toml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/share/config_settings.toml b/share/config_settings.toml index 1b2a59bc4..4274658c5 100644 --- a/share/config_settings.toml +++ b/share/config_settings.toml @@ -26,16 +26,22 @@ name = "Security" [security.ssh.ssh_password_authentication] type = "boolean" + yes = "True" + no = "False" default = "false" [security.ssh.ssh_allow_deprecated_dsa_hostkey] type = "boolean" + yes = "True" + no = "False" default = "false" [security.nginx] name = "NGINX" [security.nginx.nginx_redirect_to_https] type = "boolean" + yes = "True" + no = "False" default = "true" [security.nginx.nginx_compatibility] @@ -54,6 +60,8 @@ name = "Security" name = "Webadmin" [security.webadmin.webadmin_allowlist_enabled] type = "boolean" + yes = "True" + no = "False" default = "false" [security.webadmin.webadmin_allowlist] @@ -66,6 +74,8 @@ name = "Security" name = "Experimental" [security.experimental.security_experimental_enabled] type = "boolean" + yes = "True" + no = "False" default = "false" @@ -75,16 +85,22 @@ name = "Email" name = "POP3" [email.pop3.pop3_enabled] type = "boolean" + yes = "True" + no = "False" default = "false" [email.smtp] name = "SMTP" [email.smtp.smtp_allow_ipv6] type = "boolean" + yes = "True" + no = "False" default = "true" [email.smtp.smtp_relay_enabled] type = "boolean" + yes = "True" + no = "False" default = "false" [email.smtp.smtp_relay_host] @@ -116,10 +132,14 @@ name = "Other" name = "SSOwat" [misc.ssowat.ssowat_panel_overlay_enabled] type = "boolean" + yes = "True" + no = "False" default = "true" [misc.backup] name = "Backup" [misc.backup.backup_compress_tar_archives] type = "boolean" + yes = "True" + no = "False" default = "false" From 0bad639b3dea0634cb5dfc270fc9567088ad8a02 Mon Sep 17 00:00:00 2001 From: Tagadda <36127788+Tagadda@users.noreply.github.com> Date: Tue, 15 Feb 2022 22:21:00 +0000 Subject: [PATCH 049/174] migration wip --- src/migrations/0024_global_settings_to_configpanel.py | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/src/migrations/0024_global_settings_to_configpanel.py b/src/migrations/0024_global_settings_to_configpanel.py index 977e1349f..bb232ab94 100644 --- a/src/migrations/0024_global_settings_to_configpanel.py +++ b/src/migrations/0024_global_settings_to_configpanel.py @@ -1,12 +1,15 @@ import subprocess import time import urllib +import os +import json from yunohost.utils.error import YunohostError from moulinette.utils.log import getActionLogger from yunohost.tools import Migration from yunohost.settings import settings_set +from yunohost.utils.legacy import translate_legacy_settings_to_configpanel_settings logger = getActionLogger("yunohost.migration") @@ -27,10 +30,10 @@ class MyMigration(Migration): except Exception as e: raise YunohostError("global_settings_cant_open_settings", reason=e) - settings = { k: v['values'] for k,v in old_settings.items() } + settings = { translate_legacy_settings_to_configpanel_settings(k): v['value'] for k,v in old_settings.items() } - if settings.get('smtp.relay.host') != "": - settings['email.smtp.smtp_relay_enabled'] == "True" + if settings.get('email.smtp.smtp_relay_host') != "": + settings['email.smtp.smtp_relay_enabled'] = "True" args = urllib.parse.urlencode(settings) settings_set(args=args) From 2d92c93af155283cf16b251ca083cf1128126a03 Mon Sep 17 00:00:00 2001 From: Tagadda <36127788+Tagadda@users.noreply.github.com> Date: Wed, 16 Feb 2022 12:18:16 +0000 Subject: [PATCH 050/174] settings: use the yml when necessary --- .../0024_global_settings_to_configpanel.py | 13 +++++++++---- src/utils/password.py | 9 +++------ 2 files changed, 12 insertions(+), 10 deletions(-) diff --git a/src/migrations/0024_global_settings_to_configpanel.py b/src/migrations/0024_global_settings_to_configpanel.py index bb232ab94..25339a47c 100644 --- a/src/migrations/0024_global_settings_to_configpanel.py +++ b/src/migrations/0024_global_settings_to_configpanel.py @@ -2,10 +2,13 @@ import subprocess import time import urllib import os -import json from yunohost.utils.error import YunohostError from moulinette.utils.log import getActionLogger +from moulinette.utils.filesystem import ( + read_json, + write_to_yaml +) from yunohost.tools import Migration from yunohost.settings import settings_set @@ -13,6 +16,7 @@ from yunohost.utils.legacy import translate_legacy_settings_to_configpanel_setti logger = getActionLogger("yunohost.migration") +SETTINGS_PATH = "/etc/yunohost/settings.yml" OLD_SETTINGS_PATH = "/etc/yunohost/settings.json" class MyMigration(Migration): @@ -26,7 +30,7 @@ class MyMigration(Migration): return try: - old_settings = json.load(open(OLD_SETTINGS_PATH)) + old_settings = read_json(OLD_SETTINGS_PATH) except Exception as e: raise YunohostError("global_settings_cant_open_settings", reason=e) @@ -35,5 +39,6 @@ class MyMigration(Migration): if settings.get('email.smtp.smtp_relay_host') != "": settings['email.smtp.smtp_relay_enabled'] = "True" - args = urllib.parse.urlencode(settings) - settings_set(args=args) + # Here we don't use settings_set() from settings.py to prevent + # Questions to be asked when one run the migration from CLI. + write_to_yaml(SETTINGS_PATH, settings) diff --git a/src/utils/password.py b/src/utils/password.py index 26f7adad7..7b6c864ee 100644 --- a/src/utils/password.py +++ b/src/utils/password.py @@ -21,11 +21,9 @@ import sys import os -import json import string import subprocess - -from yunohost.settings import settings_get +import yaml SMALL_PWD_LIST = [ "yunohost", @@ -69,10 +67,9 @@ class PasswordValidator: # from settings.py because this file is also meant to be # use as a script by ssowat. # (or at least that's my understanding -- Alex) - # Meh... I'll try to use settings_get() anyway... What could go - # wrong ? And who even change password from SSOwat ? -- Tagada + settings = yaml.load(open("/etc/yunohost/settings.yml", "r")) setting_key = "security.password." + profile + "_strength" - self.validation_strength = settings_get(setting_key) + self.validation_strength = int(settings[setting_key]) except Exception: # Fallback to default value if we can't fetch settings for some reason self.validation_strength = 1 From dcb01a249bbc613a46cf14fadaac21068e2134b3 Mon Sep 17 00:00:00 2001 From: Tagadda <36127788+Tagadda@users.noreply.github.com> Date: Thu, 17 Feb 2022 22:07:25 +0000 Subject: [PATCH 051/174] wip unit tests --- src/tests/test_settings.py | 225 ++++++++++++++++++++----------------- 1 file changed, 122 insertions(+), 103 deletions(-) diff --git a/src/tests/test_settings.py b/src/tests/test_settings.py index 1a9063e56..5072f406a 100644 --- a/src/tests/test_settings.py +++ b/src/tests/test_settings.py @@ -10,66 +10,94 @@ import yunohost.settings as settings from yunohost.settings import ( settings_get, settings_list, - _get_settings, settings_set, settings_reset, settings_reset_all, - SETTINGS_PATH_OTHER_LOCATION, - SETTINGS_PATH, - DEFAULTS, + SETTINGS_PATH ) -DEFAULTS["example.bool"] = {"type": "bool", "default": True} -DEFAULTS["example.int"] = {"type": "int", "default": 42} -DEFAULTS["example.string"] = {"type": "string", "default": "yolo swag"} -DEFAULTS["example.enum"] = {"type": "enum", "default": "a", "choices": ["a", "b", "c"]} +EXAMPLE_SETTINGS = """ +[example] + [example.example] + [example.example.boolean] + type = "boolean" + yes = "True" + no = "False" + default = "True" + [example.example.number] + type = "number" + default = "42" + + [example.example.string] + type = "string" + default = "yolo swag" + + [example.example.select] + type = "select" + choices = ["a", "b", "c"] + default = "a" +""" def setup_function(function): - os.system("mv /etc/yunohost/settings.json /etc/yunohost/settings.json.saved") + os.system("mv /etc/yunohost/settings.yml /etc/yunohost/settings.yml.saved") + os.system("cp /usr/share/yunohost/config_settings.toml /usr/share/yunohost/config_settings.toml.saved") + with open("/usr/share/yunohost/config_settings.py", "a") as file: + file.write(EXAMPLE_SETTINGS) def teardown_function(function): - os.system("mv /etc/yunohost/settings.json.saved /etc/yunohost/settings.json") - for filename in glob.glob("/etc/yunohost/settings-*.json"): - os.remove(filename) + os.system("mv /etc/yunohost/settings.yml.saved /etc/yunohost/settings.yml") + os.system("mv /usr/share/yunohost/config_settings.toml.saved /usr/share/yunohost/config_settings.toml") -def monkey_get_setting_description(key): - return "Dummy %s setting" % key.split(".")[-1] - - -settings._get_setting_description = monkey_get_setting_description +def _get_settings(): + return yaml.load(open(SETTINGS_PATH, "r")) def test_settings_get_bool(): - assert settings_get("example.bool") + assert settings_get("example.example.boolean") -def test_settings_get_full_bool(): - assert settings_get("example.bool", True) == { - "type": "bool", - "value": True, - "default": True, - "description": "Dummy bool setting", - } +# FIXME : Testing this doesn't make sense ? This should be tested in a test_config.py ? +#def test_settings_get_full_bool(): +# assert settings_get("example.example.boolean", True) == {'version': '1.0', +# 'i18n': 'global_settings_setting', +# 'panels': [{'services': [], +# 'actions': {'apply': {'en': 'Apply'}}, +# 'sections': [{'name': '', +# 'services': [], +# 'optional': True, +# 'options': [{'type': 'boolean', +# 'yes': 'True', +# 'no': 'False', +# 'default': 'True', +# 'id': 'boolean', +# 'name': 'boolean', +# 'optional': True, +# 'current_value': 'True', +# 'ask': 'global_settings_setting_boolean', +# 'choices': []}], +# 'id': 'example'}], +# 'id': 'example', +# 'name': {'en': 'Example'}}]} def test_settings_get_int(): - assert settings_get("example.int") == 42 + assert settings_get("example.example.number") == 42 -def test_settings_get_full_int(): - assert settings_get("example.int", True) == { - "type": "int", - "value": 42, - "default": 42, - "description": "Dummy int setting", - } +#def test_settings_get_full_int(): +# assert settings_get("example.int", True) == { +# "type": "int", +# "value": 42, +# "default": 42, +# "description": "Dummy int setting", +# } def test_settings_get_string(): - assert settings_get("example.string") == "yolo swag" + assert settings_get("example.example.string") == "yolo swag" def test_settings_get_full_string(): @@ -86,94 +114,85 @@ def test_settings_get_enum(): def test_settings_get_full_enum(): - assert settings_get("example.enum", True) == { - "type": "enum", - "value": "a", - "default": "a", - "description": "Dummy enum setting", - "choices": ["a", "b", "c"], - } + option = settings_get("example.enum", full=True).get('panels')[0].get('sections')[0].get('options')[0] + assert option.get('choices') == ["a", "b", "c"] def test_settings_get_doesnt_exists(): - with pytest.raises(YunohostError): + with pytest.raises(YunohostValidationError): settings_get("doesnt.exists") -def test_settings_list(): - assert settings_list() == _get_settings() +#def test_settings_list(): +# assert settings_list() == _get_settings() def test_settings_set(): - settings_set("example.bool", False) - assert settings_get("example.bool") is False + settings_set("example.example.boolean", False) + assert settings_get("example.example.boolean") is False - settings_set("example.bool", "on") - assert settings_get("example.bool") is True + settings_set("example.example.boolean", "on") + assert settings_get("example.example.boolean") is True def test_settings_set_int(): - settings_set("example.int", 21) - assert settings_get("example.int") == 21 + settings_set("example.example.number", 21) + assert settings_get("example.example.number") == 21 def test_settings_set_enum(): - settings_set("example.enum", "c") - assert settings_get("example.enum") == "c" + settings_set("example.example.select", "c") + assert settings_get("example.example.select") == "c" def test_settings_set_doesexit(): - with pytest.raises(YunohostError): + with pytest.raises(YunohostValidationError): settings_set("doesnt.exist", True) def test_settings_set_bad_type_bool(): with pytest.raises(YunohostError): - settings_set("example.bool", 42) + settings_set("example.example.boolean", 42) with pytest.raises(YunohostError): - settings_set("example.bool", "pouet") + settings_set("example.example.boolean", "pouet") def test_settings_set_bad_type_int(): with pytest.raises(YunohostError): - settings_set("example.int", True) + settings_set("example.example.number", True) with pytest.raises(YunohostError): - settings_set("example.int", "pouet") + settings_set("example.example.number", "pouet") def test_settings_set_bad_type_string(): with pytest.raises(YunohostError): - settings_set("example.string", True) + settings_set("example.example.string", True) with pytest.raises(YunohostError): - settings_set("example.string", 42) + settings_set("example.example.string", 42) def test_settings_set_bad_value_enum(): with pytest.raises(YunohostError): - settings_set("example.enum", True) + settings_set("example.example.select", True) with pytest.raises(YunohostError): - settings_set("example.enum", "e") + settings_set("example.example.select", "e") with pytest.raises(YunohostError): - settings_set("example.enum", 42) + settings_set("example.example.select", 42) with pytest.raises(YunohostError): - settings_set("example.enum", "pouet") + settings_set("example.example.select", "pouet") def test_settings_list_modified(): - settings_set("example.int", 21) - assert settings_list()["example.int"] == { - "default": 42, - "description": "Dummy int setting", - "type": "int", - "value": 21, - } + settings_set("example.example.number", 21) + assert settings_list()["number"] == 42 def test_reset(): - settings_set("example.int", 21) - assert settings_get("example.int") == 21 - settings_reset("example.int") - assert settings_get("example.int") == settings_get("example.int", True)["default"] + option = settings_get("example.example.number", full=True).get('panels')[0].get('sections')[0].get('options')[0] + settings_set("example.example.number", 21) + assert settings_get("number") == 21 + settings_reset("example.example.number") + assert settings_get("example.example.number") == option["default"] def test_settings_reset_doesexit(): @@ -183,10 +202,10 @@ def test_settings_reset_doesexit(): def test_reset_all(): settings_before = settings_list() - settings_set("example.bool", False) - settings_set("example.int", 21) - settings_set("example.string", "pif paf pouf") - settings_set("example.enum", "c") + settings_set("example.example.boolean", False) + settings_set("example.example.number", 21) + settings_set("example.example.string", "pif paf pouf") + settings_set("example.example.select", "c") assert settings_before != settings_list() settings_reset_all() if settings_before != settings_list(): @@ -194,30 +213,30 @@ def test_reset_all(): assert settings_before[i] == settings_list()[i] -def test_reset_all_backup(): - settings_before = settings_list() - settings_set("example.bool", False) - settings_set("example.int", 21) - settings_set("example.string", "pif paf pouf") - settings_set("example.enum", "c") - settings_after_modification = settings_list() - assert settings_before != settings_after_modification - old_settings_backup_path = settings_reset_all()["old_settings_backup_path"] - - for i in settings_after_modification: - del settings_after_modification[i]["description"] - - assert settings_after_modification == json.load(open(old_settings_backup_path, "r")) +#def test_reset_all_backup(): +# settings_before = settings_list() +# settings_set("example.bool", False) +# settings_set("example.int", 21) +# settings_set("example.string", "pif paf pouf") +# settings_set("example.enum", "c") +# settings_after_modification = settings_list() +# assert settings_before != settings_after_modification +# old_settings_backup_path = settings_reset_all()["old_settings_backup_path"] +# +# for i in settings_after_modification: +# del settings_after_modification[i]["description"] +# +# assert settings_after_modification == json.load(open(old_settings_backup_path, "r")) -def test_unknown_keys(): - unknown_settings_path = SETTINGS_PATH_OTHER_LOCATION % "unknown" - unknown_setting = { - "unkown_key": {"value": 42, "default": 31, "type": "int"}, - } - open(SETTINGS_PATH, "w").write(json.dumps(unknown_setting)) - - # stimulate a write - settings_reset_all() - - assert unknown_setting == json.load(open(unknown_settings_path, "r")) +#def test_unknown_keys(): +# unknown_settings_path = SETTINGS_PATH_OTHER_LOCATION % "unknown" +# unknown_setting = { +# "unkown_key": {"value": 42, "default": 31, "type": "int"}, +# } +# open(SETTINGS_PATH, "w").write(json.dumps(unknown_setting)) +# +# # stimulate a write +# settings_reset_all() +# +# assert unknown_setting == json.load(open(unknown_settings_path, "r")) From 607a22de00da3bb4c756cb4c541e2c7954c4570c Mon Sep 17 00:00:00 2001 From: Tagadda <36127788+Tagadda@users.noreply.github.com> Date: Fri, 25 Feb 2022 15:51:14 +0000 Subject: [PATCH 052/174] use moulinette instead of os.system, os.chown, os.chmod --- src/certificate.py | 9 +++------ src/diagnosers/21-web.py | 6 +++--- 2 files changed, 6 insertions(+), 9 deletions(-) diff --git a/src/certificate.py b/src/certificate.py index 2a9fb4ce9..05c4efaa6 100644 --- a/src/certificate.py +++ b/src/certificate.py @@ -34,7 +34,7 @@ from datetime import datetime from moulinette import m18n from moulinette.utils.log import getActionLogger -from moulinette.utils.filesystem import read_file +from moulinette.utils.filesystem import read_file, chown, chmod from yunohost.vendor.acme_tiny.acme_tiny import get_crt as sign_certificate from yunohost.utils.error import YunohostError, YunohostValidationError @@ -719,11 +719,8 @@ def _generate_key(destination_path): def _set_permissions(path, user, group, permissions): - uid = pwd.getpwnam(user).pw_uid - gid = grp.getgrnam(group).gr_gid - - os.chown(path, uid, gid) - os.chmod(path, permissions) + chown(path, user, group) + chmod(path, permissions) def _enable_certificate(domain, new_cert_folder): diff --git a/src/diagnosers/21-web.py b/src/diagnosers/21-web.py index 584505ad1..5106e26cc 100644 --- a/src/diagnosers/21-web.py +++ b/src/diagnosers/21-web.py @@ -5,7 +5,7 @@ import random import requests from typing import List -from moulinette.utils.filesystem import read_file +from moulinette.utils.filesystem import read_file, mkdir, rm from yunohost.diagnosis import Diagnoser from yunohost.domain import domain_list @@ -46,8 +46,8 @@ class MyDiagnoser(Diagnoser): domains_to_check.append(domain) self.nonce = "".join(random.choice("0123456789abcedf") for i in range(16)) - os.system("rm -rf /tmp/.well-known/ynh-diagnosis/") - os.system("mkdir -p /tmp/.well-known/ynh-diagnosis/") + rm("/tmp/.well-known/ynh-diagnosis/", recursive=True, force=True) + mkdir("/tmp/.well-known/ynh-diagnosis/", parents=True) os.system("touch /tmp/.well-known/ynh-diagnosis/%s" % self.nonce) if not domains_to_check: From c4d188200c4a24dfc0d43700da3f3cfff9a661d9 Mon Sep 17 00:00:00 2001 From: Tagadda <36127788+Tagadda@users.noreply.github.com> Date: Sat, 26 Feb 2022 20:21:49 +0000 Subject: [PATCH 053/174] wip tests --- locales/en.json | 1 + share/config_settings.toml | 20 ++++++------ src/settings.py | 13 ++++++-- src/tests/test_settings.py | 63 +++++++++++++++++++++++++------------- 4 files changed, 62 insertions(+), 35 deletions(-) diff --git a/locales/en.json b/locales/en.json index 3973c1745..68174d49f 100644 --- a/locales/en.json +++ b/locales/en.json @@ -367,6 +367,7 @@ "firewall_reload_failed": "Could not reload the firewall", "firewall_reloaded": "Firewall reloaded", "firewall_rules_cmd_failed": "Some firewall rule commands have failed. More info in log.", + "global_settings_reset_success": "Reset global settings", "global_settings_setting_admin_strength": "Admin password strength", "global_settings_setting_backup_compress_tar_archives": "Compress backups", "global_settings_setting_backup_compress_tar_archives_help": "When creating new backups, compress the archives (.tar.gz) instead of uncompressed archives (.tar). N.B. : enabling this option means create lighter backup archives, but the initial backup procedure will be significantly longer and heavy on CPU.", diff --git a/share/config_settings.toml b/share/config_settings.toml index 4274658c5..f13072704 100644 --- a/share/config_settings.toml +++ b/share/config_settings.toml @@ -28,13 +28,13 @@ name = "Security" type = "boolean" yes = "True" no = "False" - default = "false" + default = "False" [security.ssh.ssh_allow_deprecated_dsa_hostkey] type = "boolean" yes = "True" no = "False" - default = "false" + default = "False" [security.nginx] name = "NGINX" @@ -42,7 +42,7 @@ name = "Security" type = "boolean" yes = "True" no = "False" - default = "true" + default = "True" [security.nginx.nginx_compatibility] type = "select" @@ -62,7 +62,7 @@ name = "Security" type = "boolean" yes = "True" no = "False" - default = "false" + default = "False" [security.webadmin.webadmin_allowlist] type = "tags" @@ -76,7 +76,7 @@ name = "Security" type = "boolean" yes = "True" no = "False" - default = "false" + default = "False" [email] @@ -87,7 +87,7 @@ name = "Email" type = "boolean" yes = "True" no = "False" - default = "false" + default = "False" [email.smtp] name = "SMTP" @@ -95,13 +95,13 @@ name = "Email" type = "boolean" yes = "True" no = "False" - default = "true" + default = "True" [email.smtp.smtp_relay_enabled] type = "boolean" yes = "True" no = "False" - default = "false" + default = "False" [email.smtp.smtp_relay_host] type = "string" @@ -134,7 +134,7 @@ name = "Other" type = "boolean" yes = "True" no = "False" - default = "true" + default = "True" [misc.backup] name = "Backup" @@ -142,4 +142,4 @@ name = "Other" type = "boolean" yes = "True" no = "False" - default = "false" + default = "False" diff --git a/src/settings.py b/src/settings.py index 45c077fa3..d15ab371f 100644 --- a/src/settings.py +++ b/src/settings.py @@ -15,6 +15,11 @@ logger = getActionLogger("yunohost.settings") SETTINGS_PATH = "/etc/yunohost/settings.yml" +BOOLEANS = { + "True": True, + "False": False, +} + def settings_get(key="", full=False, export=False): """ @@ -37,9 +42,7 @@ def settings_get(key="", full=False, export=False): mode = "classic" if mode == "classic" and key == "": - raise YunohostValidationError( - "Missing key" - ) + raise YunohostValidationError("Missing key", raw_msg=True) settings = SettingsConfigPanel() key = translate_legacy_settings_to_configpanel_settings(key) @@ -132,6 +135,10 @@ class SettingsConfigPanel(ConfigPanel): option["help"] = m18n.n(self.config["i18n"] + "_" + option["id"] + "_help") return self.config + # Dirty hack to let settings_get() to work from a python script + if isinstance(result, str) and result in BOOLEANS: + result = BOOLEANS[result] + return result def reset(self, key = "", operation_logger=None): diff --git a/src/tests/test_settings.py b/src/tests/test_settings.py index 5072f406a..d65ccc77c 100644 --- a/src/tests/test_settings.py +++ b/src/tests/test_settings.py @@ -3,7 +3,8 @@ import json import glob import pytest -from yunohost.utils.error import YunohostError +import moulinette +from yunohost.utils.error import YunohostError, YunohostValidationError import yunohost.settings as settings @@ -27,7 +28,7 @@ EXAMPLE_SETTINGS = """ [example.example.number] type = "number" - default = "42" + default = 42 [example.example.string] type = "string" @@ -40,17 +41,35 @@ EXAMPLE_SETTINGS = """ """ def setup_function(function): - os.system("mv /etc/yunohost/settings.yml /etc/yunohost/settings.yml.saved") + # Backup settings + if os.path.exists(SETTINGS_PATH): + os.system(f"mv {SETTINGS_PATH} {SETTINGS_PATH}.saved") + # Add example settings to config panel os.system("cp /usr/share/yunohost/config_settings.toml /usr/share/yunohost/config_settings.toml.saved") - with open("/usr/share/yunohost/config_settings.py", "a") as file: + with open("/usr/share/yunohost/config_settings.toml", "a") as file: file.write(EXAMPLE_SETTINGS) def teardown_function(function): - os.system("mv /etc/yunohost/settings.yml.saved /etc/yunohost/settings.yml") + if os.path.exists("/etc/yunohost/settings.yml.saved"): + os.system(f"mv {SETTINGS_PATH}.saved {SETTINGS_PATH}") + elif os.path.exists(SETTINGS_PATH): + os.remove(SETTINGS_PATH) os.system("mv /usr/share/yunohost/config_settings.toml.saved /usr/share/yunohost/config_settings.toml") +old_translate = moulinette.core.Translator.translate + +def _monkeypatch_translator(self, key, *args, **kwargs): + + if key.startswith("global_settings_setting_"): + return f"Dummy translation for {key}" + + return old_translate(self, key, *args, **kwargs) + +moulinette.core.Translator.translate = _monkeypatch_translator + + def _get_settings(): return yaml.load(open(SETTINGS_PATH, "r")) @@ -59,7 +78,7 @@ def test_settings_get_bool(): assert settings_get("example.example.boolean") -# FIXME : Testing this doesn't make sense ? This should be tested in a test_config.py ? +# FIXME : Testing this doesn't make sense ? This should be tested in test_config.py ? #def test_settings_get_full_bool(): # assert settings_get("example.example.boolean", True) == {'version': '1.0', # 'i18n': 'global_settings_setting', @@ -100,22 +119,22 @@ def test_settings_get_string(): assert settings_get("example.example.string") == "yolo swag" -def test_settings_get_full_string(): - assert settings_get("example.string", True) == { - "type": "string", - "value": "yolo swag", - "default": "yolo swag", - "description": "Dummy string setting", - } +#def test_settings_get_full_string(): +# assert settings_get("example.example.string", True) == { +# "type": "string", +# "value": "yolo swag", +# "default": "yolo swag", +# "description": "Dummy string setting", +# } -def test_settings_get_enum(): - assert settings_get("example.enum") == "a" +def test_settings_get_select(): + assert settings_get("example.example.select") == "a" -def test_settings_get_full_enum(): - option = settings_get("example.enum", full=True).get('panels')[0].get('sections')[0].get('options')[0] - assert option.get('choices') == ["a", "b", "c"] +#def test_settings_get_full_select(): +# option = settings_get("example.example.select", full=True).get('panels')[0].get('sections')[0].get('options')[0] +# assert option.get('choices') == ["a", "b", "c"] def test_settings_get_doesnt_exists(): @@ -140,7 +159,7 @@ def test_settings_set_int(): assert settings_get("example.example.number") == 21 -def test_settings_set_enum(): +def test_settings_set_select(): settings_set("example.example.select", "c") assert settings_get("example.example.select") == "c" @@ -171,7 +190,7 @@ def test_settings_set_bad_type_string(): settings_set("example.example.string", 42) -def test_settings_set_bad_value_enum(): +def test_settings_set_bad_value_select(): with pytest.raises(YunohostError): settings_set("example.example.select", True) with pytest.raises(YunohostError): @@ -184,7 +203,7 @@ def test_settings_set_bad_value_enum(): def test_settings_list_modified(): settings_set("example.example.number", 21) - assert settings_list()["number"] == 42 + assert settings_list()["number"] == 21 def test_reset(): @@ -218,7 +237,7 @@ def test_reset_all(): # settings_set("example.bool", False) # settings_set("example.int", 21) # settings_set("example.string", "pif paf pouf") -# settings_set("example.enum", "c") +# settings_set("example.select", "c") # settings_after_modification = settings_list() # assert settings_before != settings_after_modification # old_settings_backup_path = settings_reset_all()["old_settings_backup_path"] From 61d7ba1e40178bb408e86b1c69afe11c03889183 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Wed, 27 Apr 2022 22:06:50 +0200 Subject: [PATCH 054/174] manifestv2: fix ports resource test --- src/tests/test_app_resources.py | 2 +- src/utils/resources.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/tests/test_app_resources.py b/src/tests/test_app_resources.py index f53cf373e..820ad6cb7 100644 --- a/src/tests/test_app_resources.py +++ b/src/tests/test_app_resources.py @@ -238,7 +238,7 @@ def test_resource_ports(): def test_resource_ports_several(): r = AppResourceClassesByType["ports"] - conf = {"main.default": 12345, "foobar.default": 23456} + conf = {"main": {"default": 12345}, "foobar": {"default": 23456}} assert not app_setting("testapp", "port") assert not app_setting("testapp", "port_foobar") diff --git a/src/utils/resources.py b/src/utils/resources.py index f64ad6134..3d3d06cca 100644 --- a/src/utils/resources.py +++ b/src/utils/resources.py @@ -619,7 +619,7 @@ class PortsResource(AppResource): continue if not port_value: - port_value = self.infos["default"] + port_value = infos["default"] while self._port_is_used(port_value): port_value += 1 From d5fcc3828182cc09330be72437a37ab90e7fbd73 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Wed, 27 Apr 2022 22:18:24 +0200 Subject: [PATCH 055/174] manifestv2: fix backup tests --- src/backup.py | 2 +- src/tests/test_backuprestore.py | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/backup.py b/src/backup.py index a4be27eb2..bfada89e2 100644 --- a/src/backup.py +++ b/src/backup.py @@ -1513,7 +1513,7 @@ class RestoreManager: operation_logger.extra["env"] = env_dict operation_logger.flush() - manifest = _get_manifest_of_app(app_dir_in_archive) + manifest = _get_manifest_of_app(app_settings_in_archive) if manifest["packaging_format"] >= 2: from yunohost.utils.resources import AppResourceManager try: diff --git a/src/tests/test_backuprestore.py b/src/tests/test_backuprestore.py index 03c3aa0c7..17147f586 100644 --- a/src/tests/test_backuprestore.py +++ b/src/tests/test_backuprestore.py @@ -355,13 +355,13 @@ def test_backup_script_failure_handling(monkeypatch, mocker): @pytest.mark.with_backup_recommended_app_installed def test_backup_not_enough_free_space(monkeypatch, mocker): - def custom_disk_usage(path): + def custom_space_used_by_directory(path, *args, **kwargs): return 99999999999999999 def custom_free_space_in_directory(dirpath): return 0 - monkeypatch.setattr("yunohost.backup.disk_usage", custom_disk_usage) + monkeypatch.setattr("yunohost.backup.space_used_by_directory", custom_space_used_by_directory) monkeypatch.setattr( "yunohost.backup.free_space_in_directory", custom_free_space_in_directory ) From 3675daf26d26059650b015e798a648a55627858f Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 6 May 2022 16:43:58 +0200 Subject: [PATCH 056/174] Fix broken test, having install questions is mandatory --- src/app.py | 1 + src/tests/test_permission.py | 1 + 2 files changed, 2 insertions(+) diff --git a/src/app.py b/src/app.py index d92e3c5ae..d8e0086a9 100644 --- a/src/app.py +++ b/src/app.py @@ -1984,6 +1984,7 @@ def _convert_v1_manifest_to_v2(manifest): manifest["maintainers"] = [maintainer] if maintainer else [] install_questions = manifest["arguments"]["install"] + manifest["install"] = {} for question in install_questions: name = question.pop("name") diff --git a/src/tests/test_permission.py b/src/tests/test_permission.py index 4e7f9f53d..f2bff5507 100644 --- a/src/tests/test_permission.py +++ b/src/tests/test_permission.py @@ -78,6 +78,7 @@ def _permission_create_with_dummy_app( "name": app, "id": app, "description": {"en": "Dummy app to test permissions"}, + "arguments": {"install": []} }, f, ) From dd6c8976f877c289ffc7f785e5be265d9999c09c Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 6 May 2022 21:14:44 +0200 Subject: [PATCH 057/174] manifestv2: drafty implementation for notifications/doc inside the manifest --- src/app.py | 51 +++++++++++++++++++++++++++++++++++++++++++++ src/utils/system.py | 2 +- 2 files changed, 52 insertions(+), 1 deletion(-) diff --git a/src/app.py b/src/app.py index d8e0086a9..7d6efbc0d 100644 --- a/src/app.py +++ b/src/app.py @@ -23,6 +23,7 @@ Manage apps """ +import glob import os import toml import json @@ -174,6 +175,9 @@ def app_info(app, full=False, upgradable=False): ret["setting_path"] = setting_path ret["manifest"] = local_manifest + + # FIXME: maybe this is not needed ? default ask questions are + # already set during the _get_manifest_of_app earlier ? ret["manifest"]["install"] = _set_default_ask_questions( ret["manifest"].get("install", {}) ) @@ -181,6 +185,13 @@ def app_info(app, full=False, upgradable=False): ret["from_catalog"] = from_catalog + # Hydrate app notifications and doc + for pagename, pagecontent in ret["manifest"]["doc"].items(): + ret["manifest"]["doc"][pagename] = _hydrate_app_template(pagecontent, settings) + for step, notifications in ret["manifest"]["notifications"].items(): + for name, notification in notifications.items(): + notifications[name] = _hydrate_app_template(notification, settings) + ret["is_webapp"] = "domain" in settings and "path" in settings if ret["is_webapp"]: @@ -1954,9 +1965,49 @@ def _get_manifest_of_app(path): manifest = _convert_v1_manifest_to_v2(manifest) manifest["install"] = _set_default_ask_questions(manifest.get("install", {})) + manifest["doc"], manifest["notifications"] = _parse_app_doc_and_notifications(path) + return manifest +def _parse_app_doc_and_notifications(path): + + # FIXME: need to find a way to handle i18n in there (file named FOOBAR_fr.md etc.) + + doc = {} + + for pagename in glob.glob(os.path.join(path, "doc") + "/*.md"): + name = os.path.basename(pagename)[:-len('.md')] + doc[name] = read_file(pagename) + + notifications = {} + + for step in ["pre_install", "post_install", "pre_upgrade", "post_upgrade"]: + notifications[step] = {} + if os.path.exists(os.path.join(path, "doc", "notifications", f"{step}.md")): + notifications[step]["main"] = read_file(os.path.join(path, "doc", "notifications", f"{step}.md")) + else: + for notification in glob.glob(os.path.join(path, "doc", "notifications", f"{step}.d") + "/*.md"): + name = os.path.basename(notification)[:-len('.md')] + notifications[step][name].append(read_file(notification)) + + return doc, notifications + + +def _hydrate_app_template(template, data): + + stuff_to_replace = set(re.findall(r'__[A-Z0-9]+?[A-Z0-9_]*?[A-Z0-9]*?__', template)) + + for stuff in stuff_to_replace: + + varname = stuff.strip("_").lower() + + if varname in data: + template = template.replace(stuff, data[varname]) + + return template + + def _convert_v1_manifest_to_v2(manifest): manifest = copy.deepcopy(manifest) diff --git a/src/utils/system.py b/src/utils/system.py index f7d37cf1c..2aaf0fa35 100644 --- a/src/utils/system.py +++ b/src/utils/system.py @@ -57,7 +57,7 @@ def space_used_by_directory(dirpath, follow_symlinks=True): return int(du_output.split()[0]) stat = os.statvfs(dirpath) - return stat.f_frsize * stat.f_blocks + return stat.f_frsize * stat.f_blocks # FIXME : this doesnt do what the function name suggest this does ... def human_to_binary(size: str) -> int: From ddd10f630c8a3dc20087f5b2a497e062b808c035 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 13 May 2022 22:14:20 +0200 Subject: [PATCH 058/174] manifestv2: implement test for permission ressource --- src/tests/test_app_resources.py | 28 ++++++++++++++++++++++++++-- 1 file changed, 26 insertions(+), 2 deletions(-) diff --git a/src/tests/test_app_resources.py b/src/tests/test_app_resources.py index 820ad6cb7..3640adde0 100644 --- a/src/tests/test_app_resources.py +++ b/src/tests/test_app_resources.py @@ -4,7 +4,9 @@ import pytest from moulinette.utils.process import check_output from yunohost.app import app_setting +from yunohost.domain import _get_maindomain from yunohost.utils.resources import AppResource, AppResourceManager, AppResourceClassesByType +from yunohost.permission import user_permission_list, permission_delete dummyfile = "/tmp/dummyappresource-testapp" @@ -57,6 +59,10 @@ def clean(): os.system("apt remove lolcat sl nyancat yarn >/dev/null 2>/dev/null") os.system("userdel testapp 2>/dev/null") + for p in user_permission_list()["permissions"]: + if p.startswith("testapp."): + permission_delete(p, force=True, sync_perm=False) + def test_provision_dummy(): @@ -327,17 +333,35 @@ def test_resource_apt(): def test_resource_permissions(): - raise NotImplementedError() + maindomain = _get_maindomain() + os.system(f"echo 'domain: {maindomain}' >> /etc/yunohost/apps/testapp/settings.yml") + os.system("echo 'path: /testapp' >> /etc/yunohost/apps/testapp/settings.yml") + # A manager object is required to set the label of the app... + manager = AppResourceManager("testapp", current={}, wanted={"name": "Test App"}) r = AppResourceClassesByType["permissions"] conf = { "main": { "url": "/", "allowed": "visitors" # protected? + }, + "admin": { + "url": "/admin", + "allowed": "" } } - pass + res = user_permission_list(full=True)["permissions"] + assert not any(key.startswith("testapp.") for key in res) + r(conf, "testapp", manager).provision_or_update() + res = user_permission_list(full=True)["permissions"] + assert "testapp.main" in res + assert "visitors" in res["testapp.main"]["allowed"] + assert res["testapp.main"]["url"] == "/" + + assert "testapp.admin" in res + assert not res["testapp.admin"]["allowed"] + assert res["testapp.admin"]["url"] == "/admin" From 9902d191aa7cef5fc615697135fbc0932347c9f7 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sat, 14 May 2022 00:15:42 +0200 Subject: [PATCH 059/174] manifestv2: improve permission resouce test --- src/tests/test_app_resources.py | 35 ++++++++++++++++++++++++++++----- src/utils/resources.py | 2 +- 2 files changed, 31 insertions(+), 6 deletions(-) diff --git a/src/tests/test_app_resources.py b/src/tests/test_app_resources.py index 3640adde0..4f7651067 100644 --- a/src/tests/test_app_resources.py +++ b/src/tests/test_app_resources.py @@ -344,12 +344,8 @@ def test_resource_permissions(): "main": { "url": "/", "allowed": "visitors" - # protected? + # TODO: test protected? }, - "admin": { - "url": "/admin", - "allowed": "" - } } res = user_permission_list(full=True)["permissions"] @@ -361,7 +357,36 @@ def test_resource_permissions(): assert "testapp.main" in res assert "visitors" in res["testapp.main"]["allowed"] assert res["testapp.main"]["url"] == "/" + assert "testapp.admin" not in res + + conf["admin"] = { + "url": "/admin", + "allowed": "" + } + + r(conf, "testapp", manager).provision_or_update() + + res = user_permission_list(full=True)["permissions"] + + assert "testapp.main" in list(res.keys()) + assert "visitors" in res["testapp.main"]["allowed"] + assert res["testapp.main"]["url"] == "/" assert "testapp.admin" in res assert not res["testapp.admin"]["allowed"] assert res["testapp.admin"]["url"] == "/admin" + + conf["admin"]["url"] = "/adminpanel" + + r(conf, "testapp", manager).provision_or_update() + + res = user_permission_list(full=True)["permissions"] + + # FIXME FIXME FIXME : this is the current behavior but + # it is NOT okay. c.f. comment in the code + assert res["testapp.admin"]["url"] == "/admin" # should be '/adminpanel' + + r(conf, "testapp").deprovision() + + res = user_permission_list(full=True)["permissions"] + assert "testapp.main" not in res diff --git a/src/utils/resources.py b/src/utils/resources.py index 3d3d06cca..5bde70e83 100644 --- a/src/utils/resources.py +++ b/src/utils/resources.py @@ -238,7 +238,7 @@ class PermissionsResource(AppResource): existing_perms = user_permission_list(short=True, apps=[self.app])["permissions"] for perm in existing_perms: - if perm.split(".")[0] not in self.permissions.keys(): + if perm.split(".")[1] not in self.permissions.keys(): permission_delete(perm, force=True, sync_perm=False) for perm, infos in self.permissions.items(): From 8b1333a83747d52c1c7478319b6334d78f4e8071 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sat, 21 May 2022 14:23:08 +0200 Subject: [PATCH 060/174] manifestv2: iterate on notifications/doc + implement tests for it --- src/app.py | 10 +++--- src/app_catalog.py | 2 ++ src/tests/test_apps.py | 75 ++++++++++++++++++++++++++++++++++++++++++ src/utils/resources.py | 1 + 4 files changed, 83 insertions(+), 5 deletions(-) diff --git a/src/app.py b/src/app.py index 7d6efbc0d..0eb06d33b 100644 --- a/src/app.py +++ b/src/app.py @@ -760,8 +760,8 @@ def app_manifest(app): shutil.rmtree(extracted_app_folder) - raw_questions = manifest.get("arguments", {}).get("install", []) - manifest["arguments"]["install"] = hydrate_questions_with_choices(raw_questions) + raw_questions = manifest.get("install", {}).values() + manifest["install"] = hydrate_questions_with_choices(raw_questions) return manifest @@ -1978,18 +1978,18 @@ def _parse_app_doc_and_notifications(path): for pagename in glob.glob(os.path.join(path, "doc") + "/*.md"): name = os.path.basename(pagename)[:-len('.md')] - doc[name] = read_file(pagename) + doc[name] = read_file(pagename).strip() notifications = {} for step in ["pre_install", "post_install", "pre_upgrade", "post_upgrade"]: notifications[step] = {} if os.path.exists(os.path.join(path, "doc", "notifications", f"{step}.md")): - notifications[step]["main"] = read_file(os.path.join(path, "doc", "notifications", f"{step}.md")) + notifications[step]["main"] = read_file(os.path.join(path, "doc", "notifications", f"{step}.md")).strip() else: for notification in glob.glob(os.path.join(path, "doc", "notifications", f"{step}.d") + "/*.md"): name = os.path.basename(notification)[:-len('.md')] - notifications[step][name].append(read_file(notification)) + notifications[step][name].append(read_file(notification).strip()) return doc, notifications diff --git a/src/app_catalog.py b/src/app_catalog.py index 5244d4d81..d635f8ba4 100644 --- a/src/app_catalog.py +++ b/src/app_catalog.py @@ -232,6 +232,8 @@ def _load_apps_catalog(): ) continue + # FIXME: we may want to autoconvert all v0/v1 manifest to v2 here + # so that everything is consistent in terms of APIs, datastructure format etc info["repository"] = apps_catalog_id merged_catalog["apps"][app] = info diff --git a/src/tests/test_apps.py b/src/tests/test_apps.py index 76397093d..2c6deac7d 100644 --- a/src/tests/test_apps.py +++ b/src/tests/test_apps.py @@ -15,6 +15,8 @@ from yunohost.app import ( _is_installed, app_upgrade, app_map, + app_manifest, + app_info, ) from yunohost.domain import _get_maindomain, domain_add, domain_remove, domain_list from yunohost.utils.error import YunohostError @@ -208,6 +210,32 @@ def test_legacy_app_install_main_domain(): assert app_is_not_installed(main_domain, "legacy_app") +def test_legacy_app_manifest_preinstall(): + + m = app_manifest(os.path.join(get_test_apps_dir(), "legacy_app_ynh")) + # v1 manifesto are expected to have been autoconverted to v2 + + assert "id" in m + assert "description" in m + assert "integration" in m + assert "install" in m + assert "doc" in m and not m["doc"] + assert "notifications" in m and not m["notifications"] + + +def test_manifestv2_app_manifest_preinstall(): + + m = app_manifest(os.path.join(get_test_apps_dir(), "manifestv2_app_ynh")) + + assert "id" in m + assert "install" in m + assert "description" in m + assert "doc" in m + assert "This is a dummy description of this app features" in m["doc"]["DESCRIPTION"] + assert "notifications" in m + assert "This is a dummy disclaimer to display prior to the install" in m["notifications"]["pre_install"] + + def test_manifestv2_app_install_main_domain(): main_domain = _get_maindomain() @@ -228,6 +256,53 @@ def test_manifestv2_app_install_main_domain(): assert app_is_not_installed(main_domain, "manifestv2_app") +def test_manifestv2_app_info_postinstall(): + + main_domain = _get_maindomain() + install_manifestv2_app(main_domain, "/manifestv2") + m = app_info("manifestv2_app", full=True)["manifest"] + + assert "id" in m + assert "install" in m + assert "description" in m + assert "doc" in m + assert "The app install dir is /var/www/manifestv2_app" in m["doc"]["ADMIN"] + assert "notifications" in m + assert "The app install dir is /var/www/manifestv2_app" in m["notifications"]["post_install"] + assert "The app id is manifestv2_app" in m["notifications"]["post_install"] + assert f"The app url is {main_domain}/manifestv2" in m["notifications"]["post_install"] + + +def test_manifestv2_app_info_preupgrade(monkeypatch): + + from yunohost.app_catalog import _load_apps_catalog as original_load_apps_catalog + def custom_load_apps_catalog(*args, **kwargs): + + res = original_load_apps_catalog(*args, **kwargs) + res["apps"]["manifestv2_app"] = { + "id": "manifestv2_app", + "level": 10, + "lastUpdate": 999999999, + "maintained": True, + "manifest": app_manifest(os.path.join(get_test_apps_dir(), "manifestv2_app_ynh")), + } + res["apps"]["manifestv2_app"]["manifest"]["version"] = "99999~ynh1" + + return res + monkeypatch.setattr("yunohost.app._load_apps_catalog", custom_load_apps_catalog) + + main_domain = _get_maindomain() + install_manifestv2_app(main_domain, "/manifestv2") + i = app_info("manifestv2_app", full=True) + + assert i["upgradable"] == "yes" + assert i["new_version"] == "99999~ynh1" + # FIXME : as I write this test, I realize that this implies the catalog API + # does provide the notifications, which means the list builder script + # should parse the files in the original app repo, possibly with proper i18n etc + assert "This is a dummy disclaimer to display prior to any upgrade" \ + in i["from_catalog"]["manifest"]["notifications"]["pre_upgrade"] + def test_app_from_catalog(): main_domain = _get_maindomain() diff --git a/src/utils/resources.py b/src/utils/resources.py index 5bde70e83..46f2eba33 100644 --- a/src/utils/resources.py +++ b/src/utils/resources.py @@ -69,6 +69,7 @@ class AppResourceManager: elif todo == "update": logger.info(f"Updating {name} ...") new.provision_or_update(context=context) + # FIXME FIXME FIXME : this exception doesnt catch Ctrl+C ?!?! except Exception as e: exception = e # FIXME: better error handling ? display stacktrace ? From 2ccb0c8db6691a1d485d3a4be1f4fe197c5742b5 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sat, 21 May 2022 16:38:51 +0200 Subject: [PATCH 061/174] manifestv2: add some i18n support for doc/notifications --- src/app.py | 45 +++++++++++++++++++++++++++++++----------- src/tests/test_apps.py | 19 ++++++++++-------- 2 files changed, 45 insertions(+), 19 deletions(-) diff --git a/src/app.py b/src/app.py index 0eb06d33b..01d5cc7eb 100644 --- a/src/app.py +++ b/src/app.py @@ -1972,24 +1972,47 @@ def _get_manifest_of_app(path): def _parse_app_doc_and_notifications(path): - # FIXME: need to find a way to handle i18n in there (file named FOOBAR_fr.md etc.) - doc = {} - for pagename in glob.glob(os.path.join(path, "doc") + "/*.md"): - name = os.path.basename(pagename)[:-len('.md')] - doc[name] = read_file(pagename).strip() + for filepath in glob.glob(os.path.join(path, "doc") + "/*.md"): + + # to be improved : [a-z]{2,3} is a clumsy way of parsing the + # lang code ... some lang code are more complex that this é_è + m = re.match("([A-Z]*)(_[a-z]{2,3})?.md", filepath.split("/")[-1]) + + if not m: + # FIXME: shall we display a warning ? idk + continue + pagename, lang = m.groups() + lang = lang.strip("_") if lang else "en" + + if pagename not in doc: + doc[pagename] = {} + doc[pagename][lang] = read_file(filepath).strip() notifications = {} for step in ["pre_install", "post_install", "pre_upgrade", "post_upgrade"]: notifications[step] = {} - if os.path.exists(os.path.join(path, "doc", "notifications", f"{step}.md")): - notifications[step]["main"] = read_file(os.path.join(path, "doc", "notifications", f"{step}.md")).strip() - else: - for notification in glob.glob(os.path.join(path, "doc", "notifications", f"{step}.d") + "/*.md"): - name = os.path.basename(notification)[:-len('.md')] - notifications[step][name].append(read_file(notification).strip()) + for filepath in glob.glob(os.path.join(path, "doc", "notifications", f"{step}*.md")): + m = re.match(step + "(_[a-z]{2,3})?.md", filepath.split("/")[-1]) + if not m: + continue + pagename = "main" + lang = m.groups()[0].strip("_") if m.groups()[0] else "en" + if pagename not in notifications[step]: + notifications[step][pagename] = {} + notifications[step][pagename][lang] = read_file(filepath).strip() + + for filepath in glob.glob(os.path.join(path, "doc", "notifications", f"{step}.d") + "/*.md"): + m = re.match(r"([A-Za-z0-9\.\~]*)(_[a-z]{2,3})?.md", filepath.split("/")[-1]) + if not m: + continue + pagename, lang = m.groups() + lang = lang.strip("_") if lang else "en" + if pagename not in notifications[step]: + notifications[step][pagename] = {} + notifications[step][pagename][lang] = read_file(filepath).strip() return doc, notifications diff --git a/src/tests/test_apps.py b/src/tests/test_apps.py index 2c6deac7d..4661e54b2 100644 --- a/src/tests/test_apps.py +++ b/src/tests/test_apps.py @@ -219,8 +219,8 @@ def test_legacy_app_manifest_preinstall(): assert "description" in m assert "integration" in m assert "install" in m - assert "doc" in m and not m["doc"] - assert "notifications" in m and not m["notifications"] + assert m.get("doc") == {} + assert m.get("notifications") == {} def test_manifestv2_app_manifest_preinstall(): @@ -231,9 +231,11 @@ def test_manifestv2_app_manifest_preinstall(): assert "install" in m assert "description" in m assert "doc" in m - assert "This is a dummy description of this app features" in m["doc"]["DESCRIPTION"] + assert "This is a dummy description of this app features" in m["doc"]["DESCRIPTION"]["en"] + assert "Ceci est une fausse description des fonctionalités de l'app" in m["doc"]["DESCRIPTION"]["fr"] assert "notifications" in m - assert "This is a dummy disclaimer to display prior to the install" in m["notifications"]["pre_install"] + assert "This is a dummy disclaimer to display prior to the install" in m["notifications"]["pre_install"]["en"] + assert "Ceci est un faux disclaimer à présenter avant l'installation" in m["notifications"]["pre_install"]["fr"] def test_manifestv2_app_install_main_domain(): @@ -266,11 +268,12 @@ def test_manifestv2_app_info_postinstall(): assert "install" in m assert "description" in m assert "doc" in m - assert "The app install dir is /var/www/manifestv2_app" in m["doc"]["ADMIN"] + assert "The app install dir is /var/www/manifestv2_app" in m["doc"]["ADMIN"]["en"] + assert "Le dossier d'install de l'app est /var/www/manifestv2_app" in m["doc"]["ADMIN"]["fr"] assert "notifications" in m - assert "The app install dir is /var/www/manifestv2_app" in m["notifications"]["post_install"] - assert "The app id is manifestv2_app" in m["notifications"]["post_install"] - assert f"The app url is {main_domain}/manifestv2" in m["notifications"]["post_install"] + assert "The app install dir is /var/www/manifestv2_app" in m["notifications"]["post_install"]["en"] + assert "The app id is manifestv2_app" in m["notifications"]["post_install"]["en"] + assert f"The app url is {main_domain}/manifestv2" in m["notifications"]["post_install"]["en"] def test_manifestv2_app_info_preupgrade(monkeypatch): From d9e326f2cdf4643bd5aa5d4b39e2b497e2e21df7 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sat, 21 May 2022 17:11:41 +0200 Subject: [PATCH 062/174] manifestv2: print pre/post install notices during install in cli --- src/app.py | 30 ++++++++++++++++++++++++++---- 1 file changed, 26 insertions(+), 4 deletions(-) diff --git a/src/app.py b/src/app.py index 01d5cc7eb..720c65905 100644 --- a/src/app.py +++ b/src/app.py @@ -186,11 +186,13 @@ def app_info(app, full=False, upgradable=False): ret["from_catalog"] = from_catalog # Hydrate app notifications and doc - for pagename, pagecontent in ret["manifest"]["doc"].items(): - ret["manifest"]["doc"][pagename] = _hydrate_app_template(pagecontent, settings) + for pagename, content_per_lang in ret["manifest"]["doc"].items(): + for lang, content in content_per_lang.items(): + ret["manifest"]["doc"][pagename][lang] = _hydrate_app_template(content, settings) for step, notifications in ret["manifest"]["notifications"].items(): - for name, notification in notifications.items(): - notifications[name] = _hydrate_app_template(notification, settings) + for name, content_per_lang in notifications.items(): + for lang, content in content_per_lang.items(): + notifications[name][lang] = _hydrate_app_template(content, settings) ret["is_webapp"] = "domain" in settings and "path" in settings @@ -840,6 +842,15 @@ def app_install( _confirm_app_install(app, force) manifest, extracted_app_folder = _extract_app(app) + + # Display pre_install notices in cli mode + if manifest["notifications"]["pre_install"] and Moulinette.interface.type == "cli": + for notice in manifest["notifications"]["pre_install"].values(): + # Should we render the markdown maybe? idk + print("==========") + print(_value_for_locale(notice)) + print("==========") + packaging_format = manifest["packaging_format"] # Check ID @@ -1090,6 +1101,17 @@ def app_install( logger.success(m18n.n("installation_complete")) + # Display post_install notices in cli mode + if manifest["notifications"]["post_install"] and Moulinette.interface.type == "cli": + # (Call app_info to get the version hydrated with settings) + infos = app_info(app_instance_name, full=True) + for notice in infos["manifest"]["notifications"]["post_install"].values(): + # Should we render the markdown maybe? idk + print("==========") + print(_value_for_locale(notice)) + print("==========") + + # Call postinstall hook hook_callback("post_app_install", env=env_dict) From 6da5c21cffd0bd83060967c711818cfe63a3f804 Mon Sep 17 00:00:00 2001 From: yunohost-bot Date: Sat, 16 Jul 2022 05:14:00 +0000 Subject: [PATCH 063/174] Upgrade n to v9.0.0 --- helpers/nodejs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/helpers/nodejs b/helpers/nodejs index 42c25e51f..4b8cff17e 100644 --- a/helpers/nodejs +++ b/helpers/nodejs @@ -1,7 +1,7 @@ #!/bin/bash -n_version=8.2.0 -n_checksum=75efd9e583836f3e6cc6d793df1501462fdceeb3460d5a2dbba99993997383b9 +n_version=9.0.0 +n_checksum=37a987230d1ed0392a83f9c02c1e535a524977c00c64a4adb771ab60237be1c6 n_install_dir="/opt/node_n" node_version_path="$n_install_dir/n/versions/node" # N_PREFIX is the directory of n, it needs to be loaded as a environment variable. From dc1f5725d004075027fb745956a5113cb0342a10 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Wed, 3 Aug 2022 21:47:02 +0200 Subject: [PATCH 064/174] manifestv2: fix v1/v2 conversion for maintainers --- src/app.py | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/app.py b/src/app.py index 720c65905..b691b563b 100644 --- a/src/app.py +++ b/src/app.py @@ -2076,8 +2076,13 @@ def _convert_v1_manifest_to_v2(manifest): "ram": {"build": "50M", "runtime": "10M"} } - maintainer = manifest.get("maintainer", {}).get("name") - manifest["maintainers"] = [maintainer] if maintainer else [] + maintainers = manifest.get("maintainer", {}) + if isinstance(maintainers, list): + maintainers = [m['name'] for m in maintainers] + else: + maintainers = [maintainers["name"]] if maintainers.get("name") else [] + + manifest["maintainers"] = maintainers install_questions = manifest["arguments"]["install"] From 0022abe896ef5025bbf5dadc3891af822f7bf170 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Wed, 3 Aug 2022 22:11:17 +0200 Subject: [PATCH 065/174] manifestv2: switch to API v3 for catalog which includes v2 manifests --- src/app_catalog.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/app_catalog.py b/src/app_catalog.py index d635f8ba4..12bb4e6d7 100644 --- a/src/app_catalog.py +++ b/src/app_catalog.py @@ -19,7 +19,7 @@ logger = getActionLogger("yunohost.app_catalog") APPS_CATALOG_CACHE = "/var/cache/yunohost/repo" APPS_CATALOG_CONF = "/etc/yunohost/apps_catalog.yml" -APPS_CATALOG_API_VERSION = 2 +APPS_CATALOG_API_VERSION = 3 APPS_CATALOG_DEFAULT_URL = "https://app.yunohost.org/default" From 7c97045fb662bdaf068c852f8ff3941241058c26 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Thu, 4 Aug 2022 18:20:02 +0200 Subject: [PATCH 066/174] More explicit setting description --- locales/en.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/locales/en.json b/locales/en.json index 68174d49f..9042ab063 100644 --- a/locales/en.json +++ b/locales/en.json @@ -371,13 +371,13 @@ "global_settings_setting_admin_strength": "Admin password strength", "global_settings_setting_backup_compress_tar_archives": "Compress backups", "global_settings_setting_backup_compress_tar_archives_help": "When creating new backups, compress the archives (.tar.gz) instead of uncompressed archives (.tar). N.B. : enabling this option means create lighter backup archives, but the initial backup procedure will be significantly longer and heavy on CPU.", - "global_settings_setting_nginx_compatibility": "Compatibility", + "global_settings_setting_nginx_compatibility": "NGINX Compatibility", "global_settings_setting_nginx_compatibility_help": "Compatibility vs. security tradeoff for the web server NGINX. Affects the ciphers (and other security-related aspects)", "global_settings_setting_nginx_redirect_to_https": "Force HTTPS", "global_settings_setting_nginx_redirect_to_https_help": "Redirect HTTP requests to HTTPs by default (DO NOT TURN OFF unless you really know what you're doing!)", "global_settings_setting_pop3_enabled": "Enable POP3", "global_settings_setting_pop3_enabled_help": "Enable the POP3 protocol for the mail server", - "global_settings_setting_postfix_compatibility": "Compatibility", + "global_settings_setting_postfix_compatibility": "Postfix Compatibility", "global_settings_setting_postfix_compatibility_help": "Compatibility vs. security tradeoff for the Postfix server. Affects the ciphers (and other security-related aspects)", "global_settings_setting_security_experimental_enabled": "Experimental security features", "global_settings_setting_security_experimental_enabled_help": "Enable experimental security features (don't enable this if you don't know what you're doing!)", @@ -391,7 +391,7 @@ "global_settings_setting_smtp_relay_user": "Relay user", "global_settings_setting_ssh_allow_deprecated_dsa_hostkey": "Allow DSA hostkey", "global_settings_setting_ssh_allow_deprecated_dsa_hostkey_help": "Allow the use of (deprecated) DSA hostkey for the SSH daemon configuration", - "global_settings_setting_ssh_compatibility": "Compatibility", + "global_settings_setting_ssh_compatibility": "SSH Compatibility", "global_settings_setting_ssh_compatibility_help": "Compatibility vs. security tradeoff for the SSH server. Affects the ciphers (and other security-related aspects)", "global_settings_setting_ssh_password_authentication": "Password authentication", "global_settings_setting_ssh_password_authentication_help": "Allow password authentication for SSH", From 5494ce5def9d9e705a9f442085804f65abb602d4 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Thu, 4 Aug 2022 18:21:24 +0200 Subject: [PATCH 067/174] Simplify code --- locales/en.json | 2 +- src/settings.py | 8 ++------ 2 files changed, 3 insertions(+), 7 deletions(-) diff --git a/locales/en.json b/locales/en.json index 9042ab063..d0eb794c3 100644 --- a/locales/en.json +++ b/locales/en.json @@ -488,7 +488,7 @@ "log_user_update": "Update info for user '{}'", "log_settings_set": "Apply settings", "log_settings_reset": "Reset setting", - "log_settings_reset_all": "Reset all setting", + "log_settings_reset_all": "Reset all settings", "mail_alias_remove_failed": "Could not remove e-mail alias '{mail}'", "mail_domain_unknown": "Invalid e-mail address for domain '{domain}'. Please, use a domain administrated by this server.", "mail_forward_remove_failed": "Could not remove e-mail forwarding '{mail}'", diff --git a/src/settings.py b/src/settings.py index d15ab371f..a5a0d3625 100644 --- a/src/settings.py +++ b/src/settings.py @@ -15,10 +15,6 @@ logger = getActionLogger("yunohost.settings") SETTINGS_PATH = "/etc/yunohost/settings.yml" -BOOLEANS = { - "True": True, - "False": False, -} def settings_get(key="", full=False, export=False): @@ -136,8 +132,8 @@ class SettingsConfigPanel(ConfigPanel): return self.config # Dirty hack to let settings_get() to work from a python script - if isinstance(result, str) and result in BOOLEANS: - result = BOOLEANS[result] + if isinstance(result, str) and result in ["True", "False"]: + result = bool(result) return result From 91b56187438bee4b1a5f574738e5d844f74ca276 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Thu, 4 Aug 2022 18:24:47 +0200 Subject: [PATCH 068/174] Set 'entity_type' as 'global' for global config panel --- src/settings.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/settings.py b/src/settings.py index a5a0d3625..a4fbedae6 100644 --- a/src/settings.py +++ b/src/settings.py @@ -102,7 +102,7 @@ def settings_reset_all(operation_logger): class SettingsConfigPanel(ConfigPanel): - entity_type = "settings" + entity_type = "global" save_path_tpl = SETTINGS_PATH save_mode = "diff" From 5d685cebf054fd793117c628d8ca4393d02d4759 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Thu, 4 Aug 2022 18:32:27 +0200 Subject: [PATCH 069/174] Unused imports, black --- .../0024_global_settings_to_configpanel.py | 21 ++++++++----------- 1 file changed, 9 insertions(+), 12 deletions(-) diff --git a/src/migrations/0024_global_settings_to_configpanel.py b/src/migrations/0024_global_settings_to_configpanel.py index 25339a47c..d23e7fa9c 100644 --- a/src/migrations/0024_global_settings_to_configpanel.py +++ b/src/migrations/0024_global_settings_to_configpanel.py @@ -1,17 +1,10 @@ -import subprocess -import time -import urllib import os from yunohost.utils.error import YunohostError from moulinette.utils.log import getActionLogger -from moulinette.utils.filesystem import ( - read_json, - write_to_yaml -) +from moulinette.utils.filesystem import read_json, write_to_yaml from yunohost.tools import Migration -from yunohost.settings import settings_set from yunohost.utils.legacy import translate_legacy_settings_to_configpanel_settings logger = getActionLogger("yunohost.migration") @@ -19,6 +12,7 @@ logger = getActionLogger("yunohost.migration") SETTINGS_PATH = "/etc/yunohost/settings.yml" OLD_SETTINGS_PATH = "/etc/yunohost/settings.json" + class MyMigration(Migration): "Migrate old global settings to the new ConfigPanel global settings" @@ -34,11 +28,14 @@ class MyMigration(Migration): except Exception as e: raise YunohostError("global_settings_cant_open_settings", reason=e) - settings = { translate_legacy_settings_to_configpanel_settings(k): v['value'] for k,v in old_settings.items() } + settings = { + translate_legacy_settings_to_configpanel_settings(k): v["value"] + for k, v in old_settings.items() + } - if settings.get('email.smtp.smtp_relay_host') != "": - settings['email.smtp.smtp_relay_enabled'] = "True" + if settings.get("email.smtp.smtp_relay_host") != "": + settings["email.smtp.smtp_relay_enabled"] = "True" - # Here we don't use settings_set() from settings.py to prevent + # Here we don't use settings_set() from settings.py to prevent # Questions to be asked when one run the migration from CLI. write_to_yaml(SETTINGS_PATH, settings) From 76238db4bbc00e239e1e6ec6eb25551308ed3903 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Thu, 4 Aug 2022 19:09:47 +0200 Subject: [PATCH 070/174] config_settings.toml -> config_global.toml --- share/{config_settings.toml => config_global.toml} | 0 src/domain.py | 1 - src/tests/test_settings.py | 8 +++----- 3 files changed, 3 insertions(+), 6 deletions(-) rename share/{config_settings.toml => config_global.toml} (100%) diff --git a/share/config_settings.toml b/share/config_global.toml similarity index 100% rename from share/config_settings.toml rename to share/config_global.toml diff --git a/src/domain.py b/src/domain.py index e40b4f03c..d86760e84 100644 --- a/src/domain.py +++ b/src/domain.py @@ -44,7 +44,6 @@ from yunohost.log import is_unit_operation logger = getActionLogger("yunohost.domain") -DOMAIN_CONFIG_PATH = "/usr/share/yunohost/config_domain.toml" DOMAIN_SETTINGS_DIR = "/etc/yunohost/domains" # Lazy dev caching to avoid re-query ldap every time we need the domain list diff --git a/src/tests/test_settings.py b/src/tests/test_settings.py index d65ccc77c..4ce54b5cb 100644 --- a/src/tests/test_settings.py +++ b/src/tests/test_settings.py @@ -6,8 +6,6 @@ import pytest import moulinette from yunohost.utils.error import YunohostError, YunohostValidationError -import yunohost.settings as settings - from yunohost.settings import ( settings_get, settings_list, @@ -45,8 +43,8 @@ def setup_function(function): if os.path.exists(SETTINGS_PATH): os.system(f"mv {SETTINGS_PATH} {SETTINGS_PATH}.saved") # Add example settings to config panel - os.system("cp /usr/share/yunohost/config_settings.toml /usr/share/yunohost/config_settings.toml.saved") - with open("/usr/share/yunohost/config_settings.toml", "a") as file: + os.system("cp /usr/share/yunohost/config_global.toml /usr/share/yunohost/config_global.toml.saved") + with open("/usr/share/yunohost/config_global.toml", "a") as file: file.write(EXAMPLE_SETTINGS) @@ -55,7 +53,7 @@ def teardown_function(function): os.system(f"mv {SETTINGS_PATH}.saved {SETTINGS_PATH}") elif os.path.exists(SETTINGS_PATH): os.remove(SETTINGS_PATH) - os.system("mv /usr/share/yunohost/config_settings.toml.saved /usr/share/yunohost/config_settings.toml") + os.system("mv /usr/share/yunohost/config_global.toml.saved /usr/share/yunohost/config_global.toml") old_translate = moulinette.core.Translator.translate From ce0362eef8ff77def20a61e8408ce0470321417c Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Thu, 4 Aug 2022 19:10:52 +0200 Subject: [PATCH 071/174] black settings.py --- src/settings.py | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/src/settings.py b/src/settings.py index a4fbedae6..29c7f64c0 100644 --- a/src/settings.py +++ b/src/settings.py @@ -16,7 +16,6 @@ logger = getActionLogger("yunohost.settings") SETTINGS_PATH = "/etc/yunohost/settings.yml" - def settings_get(key="", full=False, export=False): """ Get an entry value in the settings @@ -50,7 +49,7 @@ def settings_list(full=False, export=True): List all entries of the settings """ - + if full: export = False @@ -106,18 +105,20 @@ class SettingsConfigPanel(ConfigPanel): save_path_tpl = SETTINGS_PATH save_mode = "diff" - def __init__( - self, config_path=None, save_path=None, creation=False - ): + def __init__(self, config_path=None, save_path=None, creation=False): super().__init__("settings") def _apply(self): super()._apply() - settings = { k: v for k, v in self.future_values.items() if self.values.get(k) != v } + settings = { + k: v for k, v in self.future_values.items() if self.values.get(k) != v + } for setting_name, value in settings.items(): try: - trigger_post_change_hook(setting_name, self.values.get(setting_name), value) + trigger_post_change_hook( + setting_name, self.values.get(setting_name), value + ) except Exception as e: logger.error(f"Post-change hook for setting failed : {e}") raise @@ -128,7 +129,9 @@ class SettingsConfigPanel(ConfigPanel): if mode == "full": for panel, section, option in self._iterate(): if m18n.key_exists(self.config["i18n"] + "_" + option["id"] + "_help"): - option["help"] = m18n.n(self.config["i18n"] + "_" + option["id"] + "_help") + option["help"] = m18n.n( + self.config["i18n"] + "_" + option["id"] + "_help" + ) return self.config # Dirty hack to let settings_get() to work from a python script @@ -137,7 +140,7 @@ class SettingsConfigPanel(ConfigPanel): return result - def reset(self, key = "", operation_logger=None): + def reset(self, key="", operation_logger=None): self.filter_key = key # Read config panel toml From 9482373e906c36191cadb8daf650b91dbf64133d Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Thu, 4 Aug 2022 19:26:41 +0200 Subject: [PATCH 072/174] Fix tests for global settings --- src/tests/test_settings.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/tests/test_settings.py b/src/tests/test_settings.py index 4ce54b5cb..cb2132780 100644 --- a/src/tests/test_settings.py +++ b/src/tests/test_settings.py @@ -207,7 +207,7 @@ def test_settings_list_modified(): def test_reset(): option = settings_get("example.example.number", full=True).get('panels')[0].get('sections')[0].get('options')[0] settings_set("example.example.number", 21) - assert settings_get("number") == 21 + assert settings_get("example.example.number") == 21 settings_reset("example.example.number") assert settings_get("example.example.number") == option["default"] From 7f45b3890ebf9b48461984f94bf29fe71c57bf62 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Thu, 4 Aug 2022 22:03:06 +0200 Subject: [PATCH 073/174] =?UTF-8?q?Fix=20logic=20bug,=20bool('False')=20in?= =?UTF-8?q?=20fact=20equals=20True=20=C3=A9=5F=C3=A8?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/settings.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/settings.py b/src/settings.py index 29c7f64c0..ed9df9761 100644 --- a/src/settings.py +++ b/src/settings.py @@ -136,7 +136,7 @@ class SettingsConfigPanel(ConfigPanel): # Dirty hack to let settings_get() to work from a python script if isinstance(result, str) and result in ["True", "False"]: - result = bool(result) + result = bool(result == "True") return result From 73ed031661c282c148cf061b2fcfbae7a422c137 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Thu, 4 Aug 2022 23:18:18 +0200 Subject: [PATCH 074/174] global settings: fix moar tests ... disabling the failing ones because it's apparently sort-of a feature that those work though debattable ... (though they dont when you're in interactive mode ..) --- src/certificate.py | 2 -- src/settings.py | 1 - src/tests/test_settings.py | 14 +++++++------- 3 files changed, 7 insertions(+), 10 deletions(-) diff --git a/src/certificate.py b/src/certificate.py index 05c4efaa6..30d1587b8 100644 --- a/src/certificate.py +++ b/src/certificate.py @@ -25,8 +25,6 @@ import os import sys import shutil -import pwd -import grp import subprocess import glob diff --git a/src/settings.py b/src/settings.py index ed9df9761..17fe97bf5 100644 --- a/src/settings.py +++ b/src/settings.py @@ -1,5 +1,4 @@ import os -import json import subprocess from moulinette import m18n diff --git a/src/tests/test_settings.py b/src/tests/test_settings.py index cb2132780..e943c41f5 100644 --- a/src/tests/test_settings.py +++ b/src/tests/test_settings.py @@ -175,17 +175,17 @@ def test_settings_set_bad_type_bool(): def test_settings_set_bad_type_int(): - with pytest.raises(YunohostError): - settings_set("example.example.number", True) +# with pytest.raises(YunohostError): +# settings_set("example.example.number", True) with pytest.raises(YunohostError): settings_set("example.example.number", "pouet") -def test_settings_set_bad_type_string(): - with pytest.raises(YunohostError): - settings_set("example.example.string", True) - with pytest.raises(YunohostError): - settings_set("example.example.string", 42) +#def test_settings_set_bad_type_string(): +# with pytest.raises(YunohostError): +# settings_set("example.example.string", True) +# with pytest.raises(YunohostError): +# settings_set("example.example.string", 42) def test_settings_set_bad_value_select(): From fded695b451452b2322da7198b76289c6229284f Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 5 Aug 2022 14:09:14 +0200 Subject: [PATCH 075/174] Adapt script for missing i18n key following the change in setting nomenclature --- locales/en.json | 5 ++-- maintenance/missing_i18n_keys.py | 28 +++++++++++++------ .../0024_global_settings_to_configpanel.py | 2 +- 3 files changed, 22 insertions(+), 13 deletions(-) diff --git a/locales/en.json b/locales/en.json index d0eb794c3..c86a57553 100644 --- a/locales/en.json +++ b/locales/en.json @@ -402,8 +402,6 @@ "global_settings_setting_webadmin_allowlist_help": "IP adresses allowed to access the webadmin.", "global_settings_setting_webadmin_allowlist_enabled": "Enable Webadmin IP allowlist", "global_settings_setting_webadmin_allowlist_enabled_help": "Allow only some IPs to access the webadmin.", - "global_settings_unknown_setting_from_settings_file": "Unknown key in settings: '{setting_key}', discard it and save it in /etc/yunohost/settings-unknown.json", - "global_settings_unknown_type": "Unexpected situation, the setting {setting} appears to have the type {unknown_type} but it is not a type supported by the system.", "good_practices_about_admin_password": "You are now about to define a new administration password. The password should be at least 8 characters long—though it is good practice to use a longer password (i.e. a passphrase) and/or to use a variation of characters (uppercase, lowercase, digits and special characters).", "good_practices_about_user_password": "You are now about to define a new user password. The password should be at least 8 characters long—though it is good practice to use a longer password (i.e. a passphrase) and/or to a variation of characters (uppercase, lowercase, digits and special characters).", "group_already_exist": "Group {group} already exists", @@ -516,6 +514,7 @@ "migration_description_0021_migrate_to_bullseye": "Upgrade the system to Debian Bullseye and YunoHost 11.x", "migration_description_0022_php73_to_php74_pools": "Migrate php7.3-fpm 'pool' conf files to php7.4", "migration_description_0023_postgresql_11_to_13": "Migrate databases from PostgreSQL 11 to 13", + "migration_description_0024_global_settings_to_configpanel": "Migrate legacy global settings nomenclature to the new, modern nomenclature", "migration_ldap_backup_before_migration": "Creating a backup of LDAP database and apps settings prior to the actual migration.", "migration_ldap_can_not_backup_before_migration": "The backup of the system could not be completed before the migration failed. Error: {error}", "migration_ldap_migration_failed_trying_to_rollback": "Could not migrate... trying to roll back the system.", @@ -696,4 +695,4 @@ "yunohost_installing": "Installing YunoHost...", "yunohost_not_installed": "YunoHost is not correctly installed. Please run 'yunohost tools postinstall'", "yunohost_postinstall_end_tip": "The post-install completed! To finalize your setup, please consider:\n - adding a first user through the 'Users' section of the webadmin (or 'yunohost user create ' in command-line);\n - diagnose potential issues through the 'Diagnosis' section of the webadmin (or 'yunohost diagnosis run' in command-line);\n - reading the 'Finalizing your setup' and 'Getting to know YunoHost' parts in the admin documentation: https://yunohost.org/admindoc." -} \ No newline at end of file +} diff --git a/maintenance/missing_i18n_keys.py b/maintenance/missing_i18n_keys.py index 817c73c61..e152710ef 100644 --- a/maintenance/missing_i18n_keys.py +++ b/maintenance/missing_i18n_keys.py @@ -99,15 +99,6 @@ def find_expected_string_keys(): for m in ("log_" + match for match in p4.findall(content)): yield m - # Global settings descriptions - # Will be on a line like : ("security.ssh.ssh_allow_deprecated_dsa_hostkey", {"type": "bool", ... - p5 = re.compile(r" \(\n*\s*[\"\'](\w[\w\.]+)[\"\'],") - content = open(ROOT + "src/settings.py").read() - for m in ( - "global_settings_setting_" + s.replace(".", "_") for s in p5.findall(content) - ): - yield m - # Keys for the actionmap ... for category in yaml.safe_load(open(ROOT + "share/actionsmap.yml")).values(): if "actions" not in category.keys(): @@ -143,6 +134,7 @@ def find_expected_string_keys(): for key in registrars[registrar].keys(): yield f"domain_config_{key}" + # Domain config panel domain_config = toml.load(open(ROOT + "share/config_domain.toml")) for panel in domain_config.values(): if not isinstance(panel, dict): @@ -155,6 +147,24 @@ def find_expected_string_keys(): continue yield f"domain_config_{key}" + # Global settings + global_config = toml.load(open(ROOT + "share/config_global.toml")) + # Boring hard-coding because there's no simple other way idk + settings_without_help_key = ["admin_strength", "smtp_relay_host", "smtp_relay_password", "smtp_relay_port", "smtp_relay_user", "ssh_port", "ssowat_panel_overlay_enabled", "user_strength"] + + for panel in global_config.values(): + if not isinstance(panel, dict): + continue + for section in panel.values(): + if not isinstance(section, dict): + continue + for key, values in section.items(): + if not isinstance(values, dict): + continue + yield f"global_settings_setting_{key}" + if key not in settings_without_help_key: + yield f"global_settings_setting_{key}_help" + ############################################################################### # Compare keys used and keys defined # diff --git a/src/migrations/0024_global_settings_to_configpanel.py b/src/migrations/0024_global_settings_to_configpanel.py index d23e7fa9c..82b5580ae 100644 --- a/src/migrations/0024_global_settings_to_configpanel.py +++ b/src/migrations/0024_global_settings_to_configpanel.py @@ -26,7 +26,7 @@ class MyMigration(Migration): try: old_settings = read_json(OLD_SETTINGS_PATH) except Exception as e: - raise YunohostError("global_settings_cant_open_settings", reason=e) + raise YunohostError(f"Can't open setting file : {e}", raw_msg=True) settings = { translate_legacy_settings_to_configpanel_settings(k): v["value"] From ed865dd3c0b056403c4a100862e147238fed8a15 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 5 Aug 2022 15:47:13 +0200 Subject: [PATCH 076/174] global settings: various fixes --- locales/en.json | 4 +- maintenance/missing_i18n_keys.py | 2 +- share/config_global.toml | 64 ++++++++----------- .../0024_global_settings_to_configpanel.py | 6 +- src/utils/password.py | 2 +- 5 files changed, 36 insertions(+), 42 deletions(-) diff --git a/locales/en.json b/locales/en.json index c86a57553..6cfab9109 100644 --- a/locales/en.json +++ b/locales/en.json @@ -369,6 +369,7 @@ "firewall_rules_cmd_failed": "Some firewall rule commands have failed. More info in log.", "global_settings_reset_success": "Reset global settings", "global_settings_setting_admin_strength": "Admin password strength", + "global_settings_setting_admin_strength_help": "These requirements are only enforced when defining the password", "global_settings_setting_backup_compress_tar_archives": "Compress backups", "global_settings_setting_backup_compress_tar_archives_help": "When creating new backups, compress the archives (.tar.gz) instead of uncompressed archives (.tar). N.B. : enabling this option means create lighter backup archives, but the initial backup procedure will be significantly longer and heavy on CPU.", "global_settings_setting_nginx_compatibility": "NGINX Compatibility", @@ -392,12 +393,13 @@ "global_settings_setting_ssh_allow_deprecated_dsa_hostkey": "Allow DSA hostkey", "global_settings_setting_ssh_allow_deprecated_dsa_hostkey_help": "Allow the use of (deprecated) DSA hostkey for the SSH daemon configuration", "global_settings_setting_ssh_compatibility": "SSH Compatibility", - "global_settings_setting_ssh_compatibility_help": "Compatibility vs. security tradeoff for the SSH server. Affects the ciphers (and other security-related aspects)", + "global_settings_setting_ssh_compatibility_help": "Compatibility vs. security tradeoff for the SSH server. Affects the ciphers (and other security-related aspects). See https://infosec.mozilla.org/guidelines/openssh for more info.", "global_settings_setting_ssh_password_authentication": "Password authentication", "global_settings_setting_ssh_password_authentication_help": "Allow password authentication for SSH", "global_settings_setting_ssh_port": "SSH port", "global_settings_setting_ssowat_panel_overlay_enabled": "SSOwat panel overlay", "global_settings_setting_user_strength": "User password strength", + "global_settings_setting_user_strength_help": "These requirements are only enforced when defining the password", "global_settings_setting_webadmin_allowlist": "Webadmin IP allowlist", "global_settings_setting_webadmin_allowlist_help": "IP adresses allowed to access the webadmin.", "global_settings_setting_webadmin_allowlist_enabled": "Enable Webadmin IP allowlist", diff --git a/maintenance/missing_i18n_keys.py b/maintenance/missing_i18n_keys.py index e152710ef..f85b49219 100644 --- a/maintenance/missing_i18n_keys.py +++ b/maintenance/missing_i18n_keys.py @@ -150,7 +150,7 @@ def find_expected_string_keys(): # Global settings global_config = toml.load(open(ROOT + "share/config_global.toml")) # Boring hard-coding because there's no simple other way idk - settings_without_help_key = ["admin_strength", "smtp_relay_host", "smtp_relay_password", "smtp_relay_port", "smtp_relay_user", "ssh_port", "ssowat_panel_overlay_enabled", "user_strength"] + settings_without_help_key = ["smtp_relay_host", "smtp_relay_password", "smtp_relay_port", "smtp_relay_user", "ssh_port", "ssowat_panel_overlay_enabled"] for panel in global_config.values(): if not isinstance(panel, dict): diff --git a/share/config_global.toml b/share/config_global.toml index f13072704..775f02cdf 100644 --- a/share/config_global.toml +++ b/share/config_global.toml @@ -5,20 +5,30 @@ i18n = "global_settings_setting" name = "Security" [security.password] name = "Passwords" + [security.password.admin_strength] - type = "number" + type = "select" + choices.1 = "Require at least 8 chars" + choices.2 = "ditto, but also require at least one digit, one lower and one upper char" + choices.3 = "ditto, but also require at least one special char" + choices.4 = "ditto, but also require at least 12 chars" default = 1 [security.password.user_strength] - type = "number" + type = "select" + choices.1 = "Require at least 8 chars" + choices.2 = "ditto, but also require at least one digit, one lower and one upper char" + choices.3 = "ditto, but also require at least one special char" + choices.4 = "ditto, but also require at least 12 chars" default = 1 - + [security.ssh] name = "SSH" [security.ssh.ssh_compatibility] type = "select" + choices.intermediate = "Intermediate (compatible with older softwares)" + choices.modern = "Modern (recommended)" default = "modern" - choices = ["intermediate", "modern"] [security.ssh.ssh_port] type = "number" @@ -26,43 +36,37 @@ name = "Security" [security.ssh.ssh_password_authentication] type = "boolean" - yes = "True" - no = "False" - default = "False" + default = true [security.ssh.ssh_allow_deprecated_dsa_hostkey] type = "boolean" - yes = "True" - no = "False" - default = "False" + default = false [security.nginx] name = "NGINX" [security.nginx.nginx_redirect_to_https] type = "boolean" - yes = "True" - no = "False" - default = "True" + default = true [security.nginx.nginx_compatibility] type = "select" + choices.intermediate = "Intermediate (compatible with Firefox 27, Android 4.4.2, Chrome 31, Edge, IE 11, Opera 20, and Safari 9)" + choices.modern = "Modern (compatible with Firefox 63, Android 10.0, Chrome 70, Edge 75, Opera 57, and Safari 12.1)" default = "intermediate" - choices = ["intermediate", "modern"] [security.postfix] name = "Postfix" [security.postfix.postfix_compatibility] type = "select" + choices.intermediate = "Intermediate (allows TLS 1.2)" + choices.modern = "Modern (TLS 1.3 only)" default = "intermediate" - choices = ["intermediate", "modern"] [security.webadmin] name = "Webadmin" [security.webadmin.webadmin_allowlist_enabled] type = "boolean" - yes = "True" - no = "False" - default = "False" + default = false [security.webadmin.webadmin_allowlist] type = "tags" @@ -74,9 +78,7 @@ name = "Security" name = "Experimental" [security.experimental.security_experimental_enabled] type = "boolean" - yes = "True" - no = "False" - default = "False" + default = false [email] @@ -85,23 +87,17 @@ name = "Email" name = "POP3" [email.pop3.pop3_enabled] type = "boolean" - yes = "True" - no = "False" - default = "False" + default = false [email.smtp] name = "SMTP" [email.smtp.smtp_allow_ipv6] type = "boolean" - yes = "True" - no = "False" - default = "True" + default = true [email.smtp.smtp_relay_enabled] type = "boolean" - yes = "True" - no = "False" - default = "False" + default = false [email.smtp.smtp_relay_host] type = "string" @@ -132,14 +128,10 @@ name = "Other" name = "SSOwat" [misc.ssowat.ssowat_panel_overlay_enabled] type = "boolean" - yes = "True" - no = "False" - default = "True" + default = true [misc.backup] name = "Backup" [misc.backup.backup_compress_tar_archives] type = "boolean" - yes = "True" - no = "False" - default = "False" + default = false diff --git a/src/migrations/0024_global_settings_to_configpanel.py b/src/migrations/0024_global_settings_to_configpanel.py index 82b5580ae..e1d4d190b 100644 --- a/src/migrations/0024_global_settings_to_configpanel.py +++ b/src/migrations/0024_global_settings_to_configpanel.py @@ -29,12 +29,12 @@ class MyMigration(Migration): raise YunohostError(f"Can't open setting file : {e}", raw_msg=True) settings = { - translate_legacy_settings_to_configpanel_settings(k): v["value"] + translate_legacy_settings_to_configpanel_settings(k).split('.')[-1]: v["value"] for k, v in old_settings.items() } - if settings.get("email.smtp.smtp_relay_host") != "": - settings["email.smtp.smtp_relay_enabled"] = "True" + if settings.get("smtp_relay_host"): + settings["smtp_relay_enabled"] = True # Here we don't use settings_set() from settings.py to prevent # Questions to be asked when one run the migration from CLI. diff --git a/src/utils/password.py b/src/utils/password.py index 565a6aca7..42ed45ddd 100644 --- a/src/utils/password.py +++ b/src/utils/password.py @@ -86,7 +86,7 @@ class PasswordValidator: # use as a script by ssowat. # (or at least that's my understanding -- Alex) settings = yaml.load(open("/etc/yunohost/settings.yml", "r")) - setting_key = "security.password." + profile + "_strength" + setting_key = profile + "_strength" self.validation_strength = int(settings[setting_key]) except Exception: # Fallback to default value if we can't fetch settings for some reason From 03eaad4a32b56aeb108058bb809f1e3e096f25b4 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 5 Aug 2022 17:28:57 +0200 Subject: [PATCH 077/174] Rename i18n keys for global settings in translations to not loose previous work --- locales/ar.json | 8 ++++---- locales/ca.json | 21 ++++++++++----------- locales/cs.json | 18 +++++++++--------- locales/de.json | 35 +++++++++++++++++------------------ locales/eo.json | 17 ++++++++--------- locales/es.json | 35 +++++++++++++++++------------------ locales/eu.json | 33 ++++++++++++++++----------------- locales/fa.json | 29 ++++++++++++++--------------- locales/fr.json | 35 +++++++++++++++++------------------ locales/gl.json | 33 ++++++++++++++++----------------- locales/it.json | 31 +++++++++++++++---------------- locales/kab.json | 2 +- locales/nb_NO.json | 6 +++--- locales/oc.json | 15 +++++++-------- locales/ru.json | 14 +++++++------- locales/sk.json | 2 +- locales/te.json | 2 +- locales/uk.json | 33 ++++++++++++++++----------------- locales/zh_Hans.json | 23 +++++++++++------------ 19 files changed, 190 insertions(+), 202 deletions(-) diff --git a/locales/ar.json b/locales/ar.json index c440e442f..fea601e24 100644 --- a/locales/ar.json +++ b/locales/ar.json @@ -120,8 +120,6 @@ "app_upgrade_several_apps": "سوف يتم تحديث التطبيقات التالية: {apps}", "ask_new_domain": "نطاق جديد", "ask_new_path": "مسار جديد", - "global_settings_setting_security_password_admin_strength": "قوة الكلمة السرية الإدارية", - "global_settings_setting_security_password_user_strength": "قوة الكلمة السرية للمستخدم", "password_too_simple_1": "يجب أن يكون طول الكلمة السرية على الأقل 8 حروف", "already_up_to_date": "كل شيء على ما يرام. ليس هناك ما يتطلّب تحديثًا.", "service_description_slapd": "يخزّن المستخدمين والنطاقات والمعلومات المتعلقة بها", @@ -158,5 +156,7 @@ "diagnosis_description_services": "حالة الخدمات", "diagnosis_description_dnsrecords": "تسجيلات خدمة DNS", "diagnosis_description_ip": "الإتصال بالإنترنت", - "diagnosis_description_basesystem": "النظام الأساسي" -} + "diagnosis_description_basesystem": "النظام الأساسي", + "global_settings_setting_admin_strength": "قوة الكلمة السرية الإدارية", + "global_settings_setting_user_strength": "قوة الكلمة السرية للمستخدم" +} \ No newline at end of file diff --git a/locales/ca.json b/locales/ca.json index b660032d2..78dcdf119 100644 --- a/locales/ca.json +++ b/locales/ca.json @@ -155,12 +155,7 @@ "global_settings_cant_write_settings": "No s'ha pogut escriure el fitxer de configuració, raó: {reason}", "global_settings_key_doesnt_exists": "La clau « {settings_key} » no existeix en la configuració global, podeu veure totes les claus disponibles executant « yunohost settings list »", "global_settings_reset_success": "S'ha fet una còpia de seguretat de la configuració anterior a {path}", - "global_settings_setting_security_nginx_compatibility": "Solució de compromís entre compatibilitat i seguretat pel servidor web NGINX. Afecta els criptògrafs (i altres aspectes relacionats amb la seguretat)", - "global_settings_setting_security_password_admin_strength": "Robustesa de la contrasenya d'administrador", - "global_settings_setting_security_password_user_strength": "Robustesa de la contrasenya de l'usuari", - "global_settings_setting_security_ssh_compatibility": "Solució de compromís entre compatibilitat i seguretat pel servidor SSH. Afecta els criptògrafs (i altres aspectes relacionats amb la seguretat)", "global_settings_unknown_setting_from_settings_file": "Clau de configuració desconeguda: «{setting_key}», refusada i guardada a /etc/yunohost/settings-unknown.json", - "global_settings_setting_service_ssh_allow_deprecated_dsa_hostkey": "Permetre la clau d'hoste DSA (obsolet) per la configuració del servei SSH", "global_settings_unknown_type": "Situació inesperada, la configuració {setting} sembla tenir el tipus {unknown_type} però no és un tipus reconegut pel sistema.", "good_practices_about_admin_password": "Esteu a punt de definir una nova contrasenya d'administrador. La contrasenya ha de tenir un mínim de 8 caràcters; tot i que és de bona pràctica utilitzar una contrasenya més llarga (és a dir una frase de contrasenya) i/o utilitzar diferents tipus de caràcters (majúscules, minúscules, dígits i caràcters especials).", "hook_exec_failed": "No s'ha pogut executar el script: {path}", @@ -207,7 +202,6 @@ "log_tools_reboot": "Reinicia el servidor", "already_up_to_date": "No hi ha res a fer. Tot està actualitzat.", "dpkg_lock_not_available": "No es pot utilitzar aquesta comanda en aquest moment ja que sembla que un altre programa està utilitzant el lock de dpkg (el gestor de paquets del sistema)", - "global_settings_setting_security_postfix_compatibility": "Solució de compromís entre compatibilitat i seguretat pel servidor Postfix. Afecta els criptògrafs (i altres aspectes relacionats amb la seguretat)", "mail_alias_remove_failed": "No s'han pogut eliminar els àlies del correu «{mail}»", "mail_domain_unknown": "El domini «{domain}» de l'adreça de correu no és vàlid. Utilitzeu un domini administrat per aquest servidor.", "mail_forward_remove_failed": "No s'han pogut eliminar el reenviament de correu «{mail}»", @@ -471,7 +465,6 @@ "diagnosis_services_running": "El servei {service} s'està executant!", "diagnosis_services_conf_broken": "La configuració pel servei {service} està trencada!", "diagnosis_ports_needed_by": "És necessari exposar aquest port per a les funcions {category} (servei {service})", - "global_settings_setting_pop3_enabled": "Activa el protocol POP3 per al servidor de correu", "log_app_action_run": "Executa l'acció de l'aplicació «{}»", "diagnosis_never_ran_yet": "Sembla que el servidor s'ha configurat recentment i encara no hi cap informe de diagnòstic per mostrar. S'ha d'executar un diagnòstic complet primer, ja sigui des de la pàgina web d'administració o utilitzant la comanda «yunohost diagnosis run» al terminal.", "diagnosis_description_web": "Web", @@ -506,7 +499,6 @@ "diagnosis_http_hairpinning_issue": "Sembla que la vostra xarxa no té el hairpinning activat.", "diagnosis_http_nginx_conf_not_up_to_date": "La configuració NGINX d'aquest domini sembla que ha estat modificada manualment, i no deixa que YunoHost diagnostiqui si és accessible amb HTTP.", "diagnosis_http_nginx_conf_not_up_to_date_details": "Per arreglar el problema, mireu les diferències amb la línia d'ordres utilitzant yunohost tools regen-conf nginx --dry-run --with-diff i si els canvis us semblen bé els podeu fer efectius utilitzant yunohost tools regen-conf nginx --force.", - "global_settings_setting_smtp_allow_ipv6": "Permet l'ús de IPv6 per rebre i enviar correus electrònics", "diagnosis_mail_ehlo_unreachable_details": "No s'ha pogut establir una connexió amb el vostre servidor en el port 25 amb IPv{ipversion}. Sembla que el servidor no és accessible.
1. La causa més comú per aquest problema és que el port 25 no està correctament redireccionat cap al vostre servidor.
2. També us hauríeu d'assegurar que el servei postfix estigui funcionant.
3. En configuracions més complexes: assegureu-vos que que no hi hagi cap tallafoc ni reverse-proxy interferint.", "diagnosis_mail_ehlo_wrong_details": "El EHLO rebut pel servidor de diagnòstic remot amb IPv{ipversion} és diferent al domini del vostre servidor.
EHLO rebut: {wrong_ehlo}
Esperat: {right_ehlo}
La causa més habitual d'aquest problema és que el port 25 no està correctament reenviat cap al vostre servidor. També podeu comprovar que no hi hagi un tallafocs o un reverse-proxy interferint.", "diagnosis_mail_fcrdns_dns_missing": "No hi ha cap DNS invers definit per IPv{ipversion}. Alguns correus electrònics poden no entregar-se o poden ser marcats com a correu brossa.", @@ -533,8 +525,6 @@ "app_packaging_format_not_supported": "No es pot instal·lar aquesta aplicació ja que el format del paquet no és compatible amb la versió de YunoHost del sistema. Hauríeu de considerar actualitzar el sistema.", "diagnosis_dns_try_dyndns_update_force": "La configuració DNS d'aquest domini hauria de ser gestionada automàticament per YunoHost. Si aquest no és el cas, podeu intentar forçar-ne l'actualització utilitzant yunohost dyndns update --force.", "regenconf_need_to_explicitly_specify_ssh": "La configuració ssh ha estat modificada manualment, però heu d'especificar explícitament la categoria «ssh» amb --force per fer realment els canvis.", - "global_settings_setting_backup_compress_tar_archives": "Comprimir els arxius (.tar.gz) en lloc d'arxius no comprimits (.tar) al crear noves còpies de seguretat. N.B.: activar aquesta opció permet fer arxius de còpia de seguretat més lleugers, però el procés inicial de còpia de seguretat serà significativament més llarg i més exigent a nivell de CPU.", - "global_settings_setting_smtp_relay_host": "L'amfitrió de tramesa SMTP que s'ha d'utilitzar per enviar correus electrònics en lloc d'aquesta instància de YunoHost. És útil si esteu en una de les següents situacions: el port 25 està bloquejat per el vostre proveïdor d'accés a internet o proveïdor de servidor privat virtual, si teniu una IP residencial llistada a DUHL, si no podeu configurar el DNS invers o si el servidor no està directament exposat a internet i voleu utilitzar-ne un altre per enviar correus electrònics.", "unknown_main_domain_path": "Domini o ruta desconeguda per a «{app}». Heu d'especificar un domini i una ruta per a poder especificar una URL per al permís.", "show_tile_cant_be_enabled_for_regex": "No podeu activar «show_title» ara, perquè la URL per al permís «{permission}» és una expressió regular", "show_tile_cant_be_enabled_for_url_not_defined": "No podeu activar «show_title» ara, perquè primer s'ha de definir una URL per al permís «{permission}»", @@ -568,5 +558,14 @@ "diagnosis_sshd_config_inconsistent": "Sembla que el port SSH s'ha modificat manualment a /etc/ssh/sshd_config. Des de YunoHost 4.2, hi ha un nou paràmetre global «security.ssh.port» per evitar modificar manualment la configuració.", "diagnosis_sshd_config_insecure": "Sembla que la configuració SSH s'ha modificat manualment, i no es segura ha que no conté la directiva «AllowGroups» o «AllowUsers» per limitar l'accés a usuaris autoritzats.", "backup_create_size_estimation": "L'arxiu tindrà aproximadament {size} de dades.", - "app_restore_script_failed": "S'ha produït un error en el script de restauració de l'aplicació" + "app_restore_script_failed": "S'ha produït un error en el script de restauració de l'aplicació", + "global_settings_setting_backup_compress_tar_archives_help": "Comprimir els arxius (.tar.gz) en lloc d'arxius no comprimits (.tar) al crear noves còpies de seguretat. N.B.: activar aquesta opció permet fer arxius de còpia de seguretat més lleugers, però el procés inicial de còpia de seguretat serà significativament més llarg i més exigent a nivell de CPU.", + "global_settings_setting_nginx_compatibility_help": "Solució de compromís entre compatibilitat i seguretat pel servidor web NGINX. Afecta els criptògrafs (i altres aspectes relacionats amb la seguretat)", + "global_settings_setting_admin_strength": "Robustesa de la contrasenya d'administrador", + "global_settings_setting_user_strength": "Robustesa de la contrasenya de l'usuari", + "global_settings_setting_postfix_compatibility_help": "Solució de compromís entre compatibilitat i seguretat pel servidor Postfix. Afecta els criptògrafs (i altres aspectes relacionats amb la seguretat)", + "global_settings_setting_ssh_compatibility_help": "Solució de compromís entre compatibilitat i seguretat pel servidor SSH. Afecta els criptògrafs (i altres aspectes relacionats amb la seguretat)", + "global_settings_setting_ssh_allow_deprecated_dsa_hostkey_help": "Permetre la clau d'hoste DSA (obsolet) per la configuració del servei SSH", + "global_settings_setting_smtp_allow_ipv6_help": "Permet l'ús de IPv6 per rebre i enviar correus electrònics", + "global_settings_setting_smtp_relay_enabled_help": "L'amfitrió de tramesa SMTP que s'ha d'utilitzar per enviar correus electrònics en lloc d'aquesta instància de YunoHost. És útil si esteu en una de les següents situacions: el port 25 està bloquejat per el vostre proveïdor d'accés a internet o proveïdor de servidor privat virtual, si teniu una IP residencial llistada a DUHL, si no podeu configurar el DNS invers o si el servidor no està directament exposat a internet i voleu utilitzar-ne un altre per enviar correus electrònics." } \ No newline at end of file diff --git a/locales/cs.json b/locales/cs.json index 47262064e..ddc6d5f99 100644 --- a/locales/cs.json +++ b/locales/cs.json @@ -50,18 +50,18 @@ "good_practices_about_user_password": "Nyní zvolte nové heslo uživatele. Heslo by mělo být minimálně 8 znaků dlouhé, avšak je dobrou taktikou jej mít delší (např. použít více slov) a použít kombinaci znaků (velké, malé, čísla a speciální znaky).", "good_practices_about_admin_password": "Nyní zvolte nové administrační heslo. Heslo by mělo být minimálně 8 znaků dlouhé, avšak je dobrou taktikou jej mít delší (např. použít více slov) a použít kombinaci znaků (velké, malé, čísla a speciílní znaky).", "global_settings_unknown_type": "Neočekávaná situace, nastavení {setting} deklaruje typ {unknown_type} ale toto není systémem podporováno.", - "global_settings_setting_backup_compress_tar_archives": "Komprimovat nové zálohy (.tar.gz) namísto nekomprimovaných (.tar). Poznámka: povolení této volby znamená objemově menší soubory záloh, avšak zálohování bude trvat déle a bude více zatěžovat CPU.", "global_settings_setting_smtp_relay_password": "SMTP relay heslo uživatele/hostitele", "global_settings_setting_smtp_relay_user": "SMTP relay uživatelské jméno/účet", "global_settings_setting_smtp_relay_port": "SMTP relay port", - "global_settings_setting_smtp_relay_host": "Použít SMTP relay hostitele pro odesílání emailů místo této YunoHost instance. Užitečné v různých situacích: port 25 je blokován vaším ISP nebo VPS poskytovatelem, IP adresa je na blacklistu (např. DUHL), nemůžete nastavit reverzní DNS záznam nebo tento server není přímo připojen do internetu a vy chcete použít jiný server k odesílání emailů.", - "global_settings_setting_smtp_allow_ipv6": "Povolit použití IPv6 pro příjem a odesílání emailů", "global_settings_setting_ssowat_panel_overlay_enabled": "Povolit SSOwat překryvný panel", - "global_settings_setting_service_ssh_allow_deprecated_dsa_hostkey": "Povolit použití (zastaralého) DSA klíče hostitele pro konfiguraci SSH služby", "global_settings_unknown_setting_from_settings_file": "Neznámý klíč v nastavení: '{setting_key}', zrušte jej a uložte v /etc/yunohost/settings-unknown.json", - "global_settings_setting_security_ssh_port": "SSH port", - "global_settings_setting_security_postfix_compatibility": "Kompromis mezi kompatibilitou a bezpečností Postfix serveru. Ovlivní šifry a další související bezpečnostní nastavení", - "global_settings_setting_security_ssh_compatibility": "Kompromis mezi kompatibilitou a bezpečností SSH serveru. Ovlivní šifry a další související bezpečnostní nastavení", - "global_settings_setting_security_password_user_strength": "Síla uživatelského hesla", - "global_settings_setting_security_password_admin_strength": "Síla administračního hesla" + "global_settings_setting_backup_compress_tar_archives_help": "Komprimovat nové zálohy (.tar.gz) namísto nekomprimovaných (.tar). Poznámka: povolení této volby znamená objemově menší soubory záloh, avšak zálohování bude trvat déle a bude více zatěžovat CPU.", + "global_settings_setting_admin_strength": "Síla administračního hesla", + "global_settings_setting_user_strength": "Síla uživatelského hesla", + "global_settings_setting_postfix_compatibility_help": "Kompromis mezi kompatibilitou a bezpečností Postfix serveru. Ovlivní šifry a další související bezpečnostní nastavení", + "global_settings_setting_ssh_compatibility_help": "Kompromis mezi kompatibilitou a bezpečností SSH serveru. Ovlivní šifry a další související bezpečnostní nastavení", + "global_settings_setting_ssh_port": "SSH port", + "global_settings_setting_ssh_allow_deprecated_dsa_hostkey_help": "Povolit použití (zastaralého) DSA klíče hostitele pro konfiguraci SSH služby", + "global_settings_setting_smtp_allow_ipv6_help": "Povolit použití IPv6 pro příjem a odesílání emailů", + "global_settings_setting_smtp_relay_enabled_help": "Použít SMTP relay hostitele pro odesílání emailů místo této YunoHost instance. Užitečné v různých situacích: port 25 je blokován vaším ISP nebo VPS poskytovatelem, IP adresa je na blacklistu (např. DUHL), nemůžete nastavit reverzní DNS záznam nebo tento server není přímo připojen do internetu a vy chcete použít jiný server k odesílání emailů." } \ No newline at end of file diff --git a/locales/de.json b/locales/de.json index 4aa75270b..e2b5e2d34 100644 --- a/locales/de.json +++ b/locales/de.json @@ -221,7 +221,6 @@ "app_action_broke_system": "Diese Aktion scheint diese wichtigen Dienste unterbrochen zu haben: {services}", "apps_already_up_to_date": "Alle Apps sind bereits aktuell", "backup_copying_to_organize_the_archive": "Kopieren von {size} MB, um das Archiv zu organisieren", - "global_settings_setting_security_ssh_compatibility": "Kompatibilitäts- vs. Sicherheits-Kompromiss für den SSH-Server. Betrifft die Ciphers (und andere sicherheitsrelevante Aspekte)", "group_deleted": "Gruppe '{group}' gelöscht", "group_deletion_failed": "Konnte Gruppe '{group}' nicht löschen: {error}", "dyndns_provider_unreachable": "DynDNS-Anbieter {provider} kann nicht erreicht werden: Entweder ist dein YunoHost nicht korrekt mit dem Internet verbunden oder der Dynette-Server ist ausgefallen.", @@ -232,14 +231,11 @@ "group_update_failed": "Kann Gruppe '{group}' nicht aktualisieren: {error}", "log_does_exists": "Es gibt kein Operationsprotokoll mit dem Namen'{log}', verwende 'yunohost log list', um alle verfügbaren Operationsprotokolle anzuzeigen", "log_operation_unit_unclosed_properly": "Die Operationseinheit wurde nicht richtig geschlossen", - "global_settings_setting_security_postfix_compatibility": "Kompatibilitäts- vs. Sicherheits-Kompromiss für den Postfix-Server. Betrifft die Ciphers (und andere sicherheitsrelevante Aspekte)", "global_settings_unknown_type": "Unerwartete Situation, die Einstellung {setting} scheint den Typ {unknown_type} zu haben, ist aber kein vom System unterstützter Typ.", "dpkg_is_broken": "Du kannst das gerade nicht tun, weil dpkg/APT (der Systempaketmanager) in einem defekten Zustand zu sein scheint... Du kannst versuchen, dieses Problem zu lösen, indem du dich über SSH verbindest und `sudo apt install --fix-broken` sowie/oder `sudo dpkg --configure -a` ausführst.", "global_settings_unknown_setting_from_settings_file": "Unbekannter Schlüssel in den Einstellungen: '{setting_key}', verwerfen und speichern in /etc/yunohost/settings-unknown.json", "log_link_to_log": "Vollständiges Log dieser Operation: '{desc}'", "log_help_to_get_log": "Um das Protokoll der Operation '{desc}' anzuzeigen, verwende den Befehl 'yunohost log show {name}'", - "global_settings_setting_security_nginx_compatibility": "Kompatibilitäts- vs. Sicherheits-Kompromiss für den Webserver NGINX. Betrifft die Ciphers (und andere sicherheitsrelevante Aspekte)", - "global_settings_setting_service_ssh_allow_deprecated_dsa_hostkey": "Erlaubt die Verwendung eines (veralteten) DSA-Hostkeys für die SSH-Daemon-Konfiguration", "log_app_remove": "Entferne die Applikation '{}'", "global_settings_cant_open_settings": "Einstellungsdatei konnte nicht geöffnet werden, Grund: {reason}", "global_settings_cant_write_settings": "Einstellungsdatei konnte nicht gespeichert werden, Grund: {reason}", @@ -252,12 +248,10 @@ "log_help_to_get_failed_log": "Der Vorgang'{desc}' konnte nicht abgeschlossen werden. Bitte teile das vollständige Protokoll dieser Operation mit dem Befehl 'yunohost log share {name}', um Hilfe zu erhalten", "backup_no_uncompress_archive_dir": "Dieses unkomprimierte Archivverzeichnis gibt es nicht", "log_app_change_url": "Ändere die URL der Applikation '{}'", - "global_settings_setting_security_password_user_strength": "Stärke des Anmeldepassworts", "good_practices_about_user_password": "Du bist nun dabei, ein neues Nutzerpasswort zu definieren. Das Passwort sollte mindestens 8 Zeichen lang sein - es ist jedoch empfehlenswert, ein längeres Passwort (z.B. eine Passphrase) und/oder verschiedene Arten von Zeichen (Groß- und Kleinschreibung, Ziffern und Sonderzeichen) zu verwenden.", "log_link_to_failed_log": "Der Vorgang konnte nicht abgeschlossen werden '{desc}'. Bitte gib das vollständige Protokoll dieser Operation mit Klicken Sie hier an, um Hilfe zu erhalten", "backup_cant_mount_uncompress_archive": "Das unkomprimierte Archiv konnte nicht als schreibgeschützt gemountet werden", "backup_csv_addition_failed": "Es konnten keine Dateien zur Sicherung in die CSV-Datei hinzugefügt werden", - "global_settings_setting_security_password_admin_strength": "Stärke des Admin-Passworts", "global_settings_key_doesnt_exists": "Der Schlüssel'{settings_key}' existiert nicht in den globalen Einstellungen, du kannst alle verfügbaren Schlüssel sehen, indem du 'yunohost settings list' ausführst", "log_app_makedefault": "Mache '{}' zur Standard-Applikation", "hook_json_return_error": "Konnte die Rückkehr vom Einsprungpunkt {path} nicht lesen. Fehler: {msg}. Unformatierter Inhalt: {raw_content}", @@ -436,13 +430,9 @@ "global_settings_setting_smtp_relay_password": "SMTP Relay Host Passwort", "global_settings_setting_smtp_relay_user": "SMTP Relay Benutzer Account", "global_settings_setting_smtp_relay_port": "SMTP Relay Port", - "global_settings_setting_smtp_allow_ipv6": "Erlaube die Nutzung von IPv6 um Mails zu empfangen und zu versenden", - "global_settings_setting_pop3_enabled": "Aktiviere das POP3 Protokoll für den Mailserver", "domain_cannot_remove_main_add_new_one": "Sie können '{domain}' nicht entfernen, da es die Hauptdomäne und Ihre einzige Domäne ist. Sie müssen zuerst eine andere Domäne mit 'yunohost domain add ' hinzufügen, dann als Hauptdomäne mit 'yunohost domain main-domain -n ' festlegen und dann können Sie die Domäne '{domain}' mit 'yunohost domain remove {domain}' entfernen'.'", "diagnosis_rootfstotalspace_critical": "Das Root-Filesystem hat noch freien Speicher von {space}. Das ist besorngiserregend! Der Speicher wird schnell aufgebraucht sein. 16 GB für das Root-Filesystem werden empfohlen.", "diagnosis_rootfstotalspace_warning": "Das Root-Filesystem hat noch freien Speicher von {space}. Möglich, dass das in Ordnung ist. Vielleicht ist er aber auch schneller aufgebraucht. 16 GB für das Root-Filesystem werden empfohlen.", - "global_settings_setting_smtp_relay_host": "Zu verwendender SMTP-Relay-Host um E-Mails zu versenden. Er wird anstelle dieser YunoHost-Instanz verwendet. Nützlich, wenn du in einer der folgenden Situationen bist: Dein ISP- oder VPS-Provider hat deinen Port 25 geblockt, eine deinen residentiellen IPs ist auf DUHL gelistet, du kannst keinen Reverse-DNS konfigurieren oder dieser Server ist nicht direkt mit dem Internet verbunden und du möchtest einen anderen verwenden, um E-Mails zu versenden.", - "global_settings_setting_backup_compress_tar_archives": "Beim Erstellen von Backups die Archive komprimieren (.tar.gz) anstelle von unkomprimierten Archiven (.tar). N.B. : Diese Option ergibt leichtere Backup-Archive, aber das initiale Backupprozedere wird länger dauern und mehr CPU brauchen.", "log_remove_on_failed_restore": "Entfernen von '{}' nach einer fehlgeschlagenen Wiederherstellung aus einem Sicherungsarchiv", "log_backup_restore_app": "Wiederherstellen von '{}' aus einem Sicherungsarchiv", "log_backup_restore_system": "System aus einem Sicherungsarchiv wiederherstellen", @@ -548,7 +538,6 @@ "migration_ldap_migration_failed_trying_to_rollback": "Migrieren war nicht möglich... Versuch, ein Rollback des Systems durchzuführen.", "migration_ldap_backup_before_migration": "Vor der eigentlichen Migration ein Backup der LDAP-Datenbank und der Applikations-Einstellungen erstellen.", "global_settings_setting_ssowat_panel_overlay_enabled": "Das SSOwat-Overlay-Panel aktivieren", - "global_settings_setting_security_ssh_port": "SSH-Port", "diagnosis_sshd_config_inconsistent_details": "Bitte führe yunohost settings set security.ssh.port -v YOUR_SSH_PORT aus, um den SSH-Port festzulegen, und prüfe yunohost tools regen-conf ssh --dry-run --with-diff und yunohost tools regen-conf ssh --force um deine Konfiguration auf die YunoHost-Empfehlung zurückzusetzen.", "regex_incompatible_with_tile": "/!\\ Packagers! Für Berechtigung '{permission}' ist show_tile auf 'true' gesetzt und deshalb kannst du keine regex-URL als Hauptdomäne setzen", "permission_cant_add_to_all_users": "Die Berechtigung {permission} kann nicht für allen Konten hinzugefügt werden.", @@ -580,8 +569,6 @@ "yunohost_postinstall_end_tip": "Post-install ist fertig! Um das Setup abzuschliessen, wird empfohlen:\n - ein erstes Konto über den Bereich 'Konto' im Adminbereich hinzuzufügen (oder mit 'yunohost user create ' in der Kommandezeile);\n - mögliche Fehler zu diagnostizieren über den Bereich 'Diagnose' im Adminbereich (oder mit 'yunohost diagnosis run' in der Kommandozeile;\n - Die Abschnitte 'Install YunoHost' und 'Geführte Tour' im Administratorenhandbuch zu lesen: https://yunohost.org/admindoc.", "user_already_exists": "Das Konto '{user}' ist bereits vorhanden", "update_apt_cache_warning": "Beim Versuch den Cache für APT (Debians Paketmanager) zu aktualisieren, ist etwas schief gelaufen. Hier ist ein Dump der Zeilen aus sources.list, die Ihnen vielleicht dabei helfen, das Problem zu identifizieren:\n{sourceslist}", - "global_settings_setting_security_webadmin_allowlist": "IP-Adressen, die auf die Verwaltungsseite zugreifen dürfen. Kommasepariert.", - "global_settings_setting_security_webadmin_allowlist_enabled": "Erlaube nur bestimmten IP-Adressen den Zugriff auf die Verwaltungsseite.", "disk_space_not_sufficient_update": "Es ist nicht genügend Speicherplatz frei, um diese Applikation zu aktualisieren", "disk_space_not_sufficient_install": "Es ist nicht genügend Speicherplatz frei, um diese Applikation zu installieren", "danger": "Warnung:", @@ -618,8 +605,6 @@ "domain_unknown": "Domäne '{domain}' unbekannt", "ldap_server_is_down_restart_it": "Der LDAP-Dienst ist nicht erreichbar, versuche ihn neu zu starten...", "user_import_bad_file": "Deine CSV-Datei ist nicht korrekt formatiert und wird daher ignoriert, um einen möglichen Datenverlust zu vermeiden", - "global_settings_setting_security_experimental_enabled": "Aktiviere experimentelle Sicherheitsfunktionen (nur aktivieren, wenn Du weißt was Du tust!)", - "global_settings_setting_security_nginx_redirect_to_https": "HTTP-Anfragen standardmäßig auf HTTPs umleiten (NICHT AUSSCHALTEN, sofern Du nicht weißt was Du tust!)", "user_import_missing_columns": "Die folgenden Spalten fehlen: {columns}", "user_import_nothing_to_do": "Es muss kein Konto importiert werden", "user_import_partial_failed": "Der Import von Konten ist teilweise fehlgeschlagen", @@ -673,7 +658,6 @@ "migration_0021_modified_files": "Bitte beachte, dass die folgenden Dateien manuell geändert wurden und nach dem Update möglicherweise überschrieben werden: {manually_modified_files}", "migration_0021_cleaning_up": "Bereinigung von Cache und Paketen nicht mehr nötig...", "migration_0021_patch_yunohost_conflicts": "Patch anwenden, um das Konfliktproblem zu umgehen...", - "global_settings_setting_security_ssh_password_authentication": "Passwort-Authentifizierung für SSH zulassen", "migration_description_0021_migrate_to_bullseye": "Upgrade des Systems auf Debian Bullseye und YunoHost 11.x", "migration_0021_general_warning": "Bitte beachte, dass diese Migration ein heikler Vorgang ist. Das YunoHost-Team hat sein Bestes getan, um sie zu überprüfen und zu testen, aber die Migration könnte immer noch Teile des Systems oder seiner Anwendungen beschädigen.\n\nEs wird daher empfohlen,:\n - Führe eine Sicherung aller kritischen Daten oder Applikationen durch. Mehr Informationen unter https://yunohost.org/backup;\n - Habe Geduld, nachdem du die Migration gestartet hast: Je nach Internetverbindung und Hardware kann es bis zu ein paar Stunden dauern, bis alles aktualisiert ist.", "tools_upgrade": "Aktualisieren von Systempaketen", @@ -684,5 +668,20 @@ "migration_description_0022_php73_to_php74_pools": "Migriere php7.3-fpm 'pool' Konfiguration nach php7.4", "migration_description_0023_postgresql_11_to_13": "Migrieren von Datenbanken von PostgreSQL 11 nach 13", "service_description_postgresql": "Speichert Applikations-Daten (SQL Datenbank)", - "migration_0023_not_enough_space": "Stelle sicher, dass unter {path} genug Speicherplatz zur Verfügung steht, um die Migration auszuführen." -} + "migration_0023_not_enough_space": "Stelle sicher, dass unter {path} genug Speicherplatz zur Verfügung steht, um die Migration auszuführen.", + "global_settings_setting_backup_compress_tar_archives_help": "Beim Erstellen von Backups die Archive komprimieren (.tar.gz) anstelle von unkomprimierten Archiven (.tar). N.B. : Diese Option ergibt leichtere Backup-Archive, aber das initiale Backupprozedere wird länger dauern und mehr CPU brauchen.", + "global_settings_setting_security_experimental_enabled_help": "Aktiviere experimentelle Sicherheitsfunktionen (nur aktivieren, wenn Du weißt was Du tust!)", + "global_settings_setting_nginx_compatibility_help": "Kompatibilitäts- vs. Sicherheits-Kompromiss für den Webserver NGINX. Betrifft die Ciphers (und andere sicherheitsrelevante Aspekte)", + "global_settings_setting_nginx_redirect_to_https_help": "HTTP-Anfragen standardmäßig auf HTTPs umleiten (NICHT AUSSCHALTEN, sofern Du nicht weißt was Du tust!)", + "global_settings_setting_admin_strength": "Stärke des Admin-Passworts", + "global_settings_setting_user_strength": "Stärke des Anmeldepassworts", + "global_settings_setting_postfix_compatibility_help": "Kompatibilitäts- vs. Sicherheits-Kompromiss für den Postfix-Server. Betrifft die Ciphers (und andere sicherheitsrelevante Aspekte)", + "global_settings_setting_ssh_compatibility_help": "Kompatibilitäts- vs. Sicherheits-Kompromiss für den SSH-Server. Betrifft die Ciphers (und andere sicherheitsrelevante Aspekte)", + "global_settings_setting_ssh_password_authentication_help": "Passwort-Authentifizierung für SSH zulassen", + "global_settings_setting_ssh_port": "SSH-Port", + "global_settings_setting_webadmin_allowlist_help": "IP-Adressen, die auf die Verwaltungsseite zugreifen dürfen. Kommasepariert.", + "global_settings_setting_webadmin_allowlist_enabled_help": "Erlaube nur bestimmten IP-Adressen den Zugriff auf die Verwaltungsseite.", + "global_settings_setting_ssh_allow_deprecated_dsa_hostkey_help": "Erlaubt die Verwendung eines (veralteten) DSA-Hostkeys für die SSH-Daemon-Konfiguration", + "global_settings_setting_smtp_allow_ipv6_help": "Erlaube die Nutzung von IPv6 um Mails zu empfangen und zu versenden", + "global_settings_setting_smtp_relay_enabled_help": "Zu verwendender SMTP-Relay-Host um E-Mails zu versenden. Er wird anstelle dieser YunoHost-Instanz verwendet. Nützlich, wenn du in einer der folgenden Situationen bist: Dein ISP- oder VPS-Provider hat deinen Port 25 geblockt, eine deinen residentiellen IPs ist auf DUHL gelistet, du kannst keinen Reverse-DNS konfigurieren oder dieser Server ist nicht direkt mit dem Internet verbunden und du möchtest einen anderen verwenden, um E-Mails zu versenden." +} \ No newline at end of file diff --git a/locales/eo.json b/locales/eo.json index 8ac32d4ce..d9f84e82a 100644 --- a/locales/eo.json +++ b/locales/eo.json @@ -105,7 +105,6 @@ "field_invalid": "Nevalida kampo '{}'", "log_app_makedefault": "Faru '{}' la defaŭlta apliko", "backup_system_part_failed": "Ne eblis sekurkopi la sistemon de '{part}'", - "global_settings_setting_security_postfix_compatibility": "Kongruo vs sekureca kompromiso por la Postfix-servilo. Afektas la ĉifradojn (kaj aliajn aspektojn pri sekureco)", "group_unknown": "La grupo '{group}' estas nekonata", "mailbox_disabled": "Retpoŝto malŝaltita por uzanto {user}", "migrations_dependencies_not_satisfied": "Rulu ĉi tiujn migradojn: '{dependencies_id}', antaŭ migrado {id}.", @@ -238,7 +237,6 @@ "dyndns_unavailable": "La domajno '{domain}' ne haveblas.", "experimental_feature": "Averto: Ĉi tiu funkcio estas eksperimenta kaj ne konsiderata stabila, vi ne uzu ĝin krom se vi scias kion vi faras.", "root_password_replaced_by_admin_password": "Via radika pasvorto estis anstataŭigita per via administra pasvorto.", - "global_settings_setting_security_password_user_strength": "Uzanto pasvorta forto", "restore_may_be_not_enough_disk_space": "Via sistemo ne ŝajnas havi sufiĉe da spaco (libera: {free_space} B, necesa spaco: {needed_space} B, sekureca marĝeno: {margin} B)", "log_corrupted_md_file": "La YAD-metadata dosiero asociita kun protokoloj estas damaĝita: '{md_file}\nEraro: {error} '", "downloading": "Elŝutante …", @@ -264,7 +262,6 @@ "log_user_delete": "Forigi uzanton '{}'", "dyndns_ip_updated": "Ĝisdatigis vian IP sur DynDNS", "regenconf_up_to_date": "La agordo jam estas ĝisdatigita por kategorio '{category}'", - "global_settings_setting_security_ssh_compatibility": "Kongruo vs sekureca kompromiso por la SSH-servilo. Afektas la ĉifradojn (kaj aliajn aspektojn pri sekureco)", "migrations_need_to_accept_disclaimer": "Por funkciigi la migradon {id}, via devas akcepti la sekvan malakcepton:\n---\n{disclaimer}\n---\nSe vi akceptas funkcii la migradon, bonvolu rekonduki la komandon kun la opcio '--accept-disclaimer'.", "regenconf_file_remove_failed": "Ne povis forigi la agordodosieron '{conf}'", "not_enough_disk_space": "Ne sufiĉe libera spaco sur '{path}'", @@ -295,7 +292,6 @@ "log_backup_restore_system": "Restarigi sistemon de rezerva arkivo", "log_app_change_url": "Ŝanĝu la URL de la apliko '{}'", "service_already_started": "La servo '{service}' jam funkcias", - "global_settings_setting_security_password_admin_strength": "Admin pasvorta forto", "service_reload_or_restart_failed": "Ne povis reŝargi aŭ rekomenci la servon '{service}'\n\nLastatempaj servaj protokoloj: {logs}", "migrations_list_conflict_pending_done": "Vi ne povas uzi ambaŭ '--previous' kaj '--done' samtempe.", "server_shutdown_confirm": "La servilo haltos tuj, ĉu vi certas? [{answers}]", @@ -310,7 +306,6 @@ "password_too_simple_4": "La pasvorto bezonas almenaŭ 12 signojn kaj enhavas ciferon, majuskle, pli malaltan kaj specialajn signojn", "regenconf_file_updated": "Agordodosiero '{conf}' ĝisdatigita", "log_help_to_get_log": "Por vidi la protokolon de la operacio '{desc}', uzu la komandon 'yunohost log show {name}'", - "global_settings_setting_security_nginx_compatibility": "Kongruo vs sekureca kompromiso por la TTT-servilo NGINX. Afektas la ĉifradojn (kaj aliajn aspektojn pri sekureco)", "restore_complete": "Restarigita", "hook_exec_failed": "Ne povis funkcii skripto: {path}", "global_settings_cant_open_settings": "Ne eblis malfermi agordojn, tial: {reason}", @@ -352,7 +347,6 @@ "log_domain_remove": "Forigi domon '{}' de agordo de sistemo", "hook_list_by_invalid": "Ĉi tiu posedaĵo ne povas esti uzata por listigi hokojn", "confirm_app_install_thirdparty": "Danĝero! Ĉi tiu apliko ne estas parto de la aplika katalogo de Yunohost. Instali triajn aplikojn povas kompromiti la integrecon kaj sekurecon de via sistemo. Vi probable ne devas instali ĝin krom se vi scias kion vi faras. NENIU SUBTENO estos provizita se ĉi tiu app ne funkcias aŭ rompas vian sistemon ... Se vi pretas riski ĉiuokaze, tajpu '{answers}'", - "global_settings_setting_service_ssh_allow_deprecated_dsa_hostkey": "Permesu uzon de (malaktuala) DSA-hostkey por la agordo de daemon SSH", "dyndns_domain_not_provided": "Provizanto DynDNS {provider} ne povas provizi domajnon {domain}.", "backup_unable_to_organize_files": "Ne povis uzi la rapidan metodon por organizi dosierojn en la ar archiveivo", "password_too_simple_2": "La pasvorto bezonas almenaŭ 8 signojn kaj enhavas ciferon, majusklojn kaj minusklojn", @@ -454,7 +448,6 @@ "diagnosis_found_errors_and_warnings": "Trovis {errors} signifaj problemo (j) (kaj {warnings} averto) rilataj al {category}!", "diagnosis_diskusage_low": "Stokado {mountpoint} (sur aparato {device}) nur restas {free} ({free_percent}%) spaco restanta (el {total}). Estu zorgema.", "diagnosis_diskusage_ok": "Stokado {mountpoint} (sur aparato {device}) ankoraŭ restas {free} ({free_percent}%) spaco (el {total})!", - "global_settings_setting_pop3_enabled": "Ebligu la protokolon POP3 por la poŝta servilo", "diagnosis_unknown_categories": "La jenaj kategorioj estas nekonataj: {categories}", "diagnosis_services_running": "Servo {service} funkcias!", "diagnosis_ports_unreachable": "Haveno {port} ne atingeblas de ekstere.", @@ -516,7 +509,6 @@ "diagnosis_http_partially_unreachable": "Domajno {domain} ŝajnas neatingebla per HTTP de ekster la loka reto en IPv {failed}, kvankam ĝi funkcias en IPv {passed}.", "diagnosis_http_nginx_conf_not_up_to_date": "La nginx-agordo de ĉi tiu domajno ŝajnas esti modifita permane, kaj malhelpas YunoHost diagnozi ĉu ĝi atingeblas per HTTP.", "diagnosis_http_nginx_conf_not_up_to_date_details": "Por solvi la situacion, inspektu la diferencon per la komandlinio per yunohost tools regen-conf nginx --dry-run --with-diff kaj se vi aranĝas, apliku la ŝanĝojn per yunohost tools regen-conf nginx --force.", - "global_settings_setting_smtp_allow_ipv6": "Permesu la uzon de IPv6 por ricevi kaj sendi poŝton", "backup_archive_corrupted": "I aspektas kiel la rezerva arkivo '{archive}' estas koruptita: {error}", "backup_archive_cant_retrieve_info_json": "Ne povis ŝarĝi infos por arkivo '{archive}' ... la info.json ne povas esti reprenita (aŭ ne estas valida JSON).", "ask_user_domain": "Domajno uzi por la retpoŝta adreso de la uzanto kaj XMPP-konto", @@ -530,5 +522,12 @@ "app_label_deprecated": "Ĉi tiu komando estas malrekomendita! Bonvolu uzi la novan komandon 'yunohost user permission update' por administri la app etikedo.", "app_argument_password_no_default": "Eraro dum analiza pasvorta argumento '{name}': pasvorta argumento ne povas havi defaŭltan valoron por sekureca kialo", "additional_urls_already_removed": "Plia URL '{url}' jam forigita en la aldona URL por permeso '{permission}'", - "additional_urls_already_added": "Plia URL '{url}' jam aldonita en la aldona URL por permeso '{permission}'" + "additional_urls_already_added": "Plia URL '{url}' jam aldonita en la aldona URL por permeso '{permission}'", + "global_settings_setting_nginx_compatibility_help": "Kongruo vs sekureca kompromiso por la TTT-servilo NGINX. Afektas la ĉifradojn (kaj aliajn aspektojn pri sekureco)", + "global_settings_setting_admin_strength": "Admin pasvorta forto", + "global_settings_setting_user_strength": "Uzanto pasvorta forto", + "global_settings_setting_postfix_compatibility_help": "Kongruo vs sekureca kompromiso por la Postfix-servilo. Afektas la ĉifradojn (kaj aliajn aspektojn pri sekureco)", + "global_settings_setting_ssh_compatibility_help": "Kongruo vs sekureca kompromiso por la SSH-servilo. Afektas la ĉifradojn (kaj aliajn aspektojn pri sekureco)", + "global_settings_setting_ssh_allow_deprecated_dsa_hostkey_help": "Permesu uzon de (malaktuala) DSA-hostkey por la agordo de daemon SSH", + "global_settings_setting_smtp_allow_ipv6_help": "Permesu la uzon de IPv6 por ricevi kaj sendi poŝton" } \ No newline at end of file diff --git a/locales/es.json b/locales/es.json index aebb959a8..ec513fb52 100644 --- a/locales/es.json +++ b/locales/es.json @@ -320,13 +320,7 @@ "group_created": "Creado el grupo «{group}»", "good_practices_about_admin_password": "Ahora está a punto de definir una nueva contraseña de usuario. La contraseña debe tener al menos 8 caracteres, aunque es una buena práctica usar una contraseña más larga (es decir, una frase de contraseña) y / o una variación de caracteres (mayúsculas, minúsculas, dígitos y caracteres especiales).", "global_settings_unknown_type": "Situación imprevista, la configuración {setting} parece tener el tipo {unknown_type} pero no es un tipo compatible con el sistema.", - "global_settings_setting_service_ssh_allow_deprecated_dsa_hostkey": "Permitir el uso de la llave (obsoleta) DSA para la configuración del demonio SSH", "global_settings_unknown_setting_from_settings_file": "Clave desconocida en la configuración: «{setting_key}», desechada y guardada en /etc/yunohost/settings-unknown.json", - "global_settings_setting_security_postfix_compatibility": "Compromiso entre compatibilidad y seguridad para el servidor Postfix. Afecta al cifrado (y otros aspectos relacionados con la seguridad)", - "global_settings_setting_security_ssh_compatibility": "Compromiso entre compatibilidad y seguridad para el servidor SSH. Afecta al cifrado (y otros aspectos relacionados con la seguridad)", - "global_settings_setting_security_password_user_strength": "Seguridad de la contraseña de usuario", - "global_settings_setting_security_password_admin_strength": "Seguridad de la contraseña del administrador", - "global_settings_setting_security_nginx_compatibility": "Compromiso entre compatibilidad y seguridad para el servidor web NGINX. Afecta al cifrado (y otros aspectos relacionados con la seguridad)", "global_settings_reset_success": "Respaldada la configuración previa en {path}", "global_settings_key_doesnt_exists": "La clave «{settings_key}» no existe en la configuración global, puede ver todas las claves disponibles ejecutando «yunohost settings list»", "global_settings_cant_write_settings": "No se pudo guardar el archivo de configuración, motivo: {reason}", @@ -464,7 +458,6 @@ "log_domain_main_domain": "Hacer de '{}' el dominio principal", "log_app_action_run": "Inicializa la acción de la aplicación '{}'", "group_already_exist_on_system_but_removing_it": "El grupo {group} ya existe en los grupos del sistema, pero YunoHost lo suprimirá …", - "global_settings_setting_pop3_enabled": "Habilita el protocolo POP3 para el servidor de correo electrónico", "domain_cannot_remove_main_add_new_one": "No se puede remover '{domain}' porque es su principal y único dominio. Primero debe agregar un nuevo dominio con la linea de comando 'yunohost domain add ', entonces configurarlo como dominio principal con 'yunohost domain main-domain -n ' y finalmente borrar el dominio '{domain}' con 'yunohost domain remove {domain}'.'", "diagnosis_never_ran_yet": "Este servidor todavía no tiene reportes de diagnostico. Puede iniciar un diagnostico completo desde la interface administrador web o con la linea de comando 'yunohost diagnosis run'.", "diagnosis_unknown_categories": "Las siguientes categorías están desconocidas: {categories}", @@ -510,12 +503,9 @@ "app_label_deprecated": "Este comando está depreciado! Favor usar el nuevo comando 'yunohost user permission update' para administrar la etiqueta de app.", "app_argument_password_no_default": "Error al interpretar argumento de contraseña'{name}': El argumento de contraseña no puede tener un valor por defecto por razón de seguridad", "invalid_regex": "Regex no valido: «{regex}»", - "global_settings_setting_backup_compress_tar_archives": "Cuando se creen nuevas copias de respaldo, comprimir los archivos (.tar.gz) en lugar de descomprimir los archivos (.tar). N.B.: activar esta opción quiere decir que los archivos serán más pequeños pero que el proceso tardará más y utilizará más CPU.", "global_settings_setting_smtp_relay_password": "Clave de uso del SMTP", "global_settings_setting_smtp_relay_user": "Cuenta de uso de SMTP", "global_settings_setting_smtp_relay_port": "Puerto de envio / relay SMTP", - "global_settings_setting_smtp_relay_host": "El servidor relay de SMTP para enviar correo en lugar de esta instalación YunoHost. Útil si estás en una de estas situaciones: tu puerto 25 esta bloqueado por tu ISP o VPS, si estás en usado una IP marcada como residencial o DUHL, si no puedes configurar un DNS inverso o si el servidor no está directamente expuesto a internet y quieres utilizar otro servidor para enviar correos.", - "global_settings_setting_smtp_allow_ipv6": "Permitir el uso de IPv6 para enviar y recibir correo", "diagnosis_processes_killed_by_oom_reaper": "Algunos procesos fueron terminados por el sistema recientemente porque se quedó sin memoria. Típicamente es sintoma de falta de memoria o de un proceso que se adjudicó demasiada memoria.
Resumen de los procesos terminados:
\n{kills_summary}", "diagnosis_http_nginx_conf_not_up_to_date_details": "Para arreglar este asunto, estudia las diferencias mediante el comando yunohost tools regen-conf nginx --dry-run --with-diff y si te parecen bien aplica los cambios mediante yunohost tools regen-conf nginx --force.", "diagnosis_http_nginx_conf_not_up_to_date": "Parece que la configuración nginx de este dominio haya sido modificada manualmente, esto no deja que YunoHost pueda diagnosticar si es accesible mediante HTTP.", @@ -618,10 +608,7 @@ "domain_dns_registrar_managed_in_parent_domain": "Este dominio es un subdominio de {parent_domain_link}. La configuración del registrador de DNS debe administrarse en el panel de configuración de {parent_domain}.", "domain_dns_registrar_yunohost": "Este dominio es un nohost.me / nohost.st / ynh.fr y, por lo tanto, YunoHost maneja automáticamente su configuración de DNS sin ninguna configuración adicional. (vea el comando 'yunohost dyndns update')", "domain_dns_registrar_not_supported": "YunoHost no pudo detectar automáticamente el registrador que maneja este dominio. Debe configurar manualmente sus registros DNS siguiendo la documentación en https://yunohost.org/dns.", - "global_settings_setting_security_nginx_redirect_to_https": "Redirija las solicitudes HTTP a HTTPs de forma predeterminada (¡NO LO DESACTIVE a menos que realmente sepa lo que está haciendo!)", - "global_settings_setting_security_webadmin_allowlist": "Direcciones IP permitidas para acceder al webadmin. Separado por comas.", "migration_ldap_backup_before_migration": "Creación de una copia de seguridad de la base de datos LDAP y la configuración de las aplicaciones antes de la migración real.", - "global_settings_setting_security_ssh_port": "Puerto SSH", "invalid_number": "Debe ser un miembro", "ldap_server_is_down_restart_it": "El servicio LDAP está inactivo, intente reiniciarlo...", "invalid_password": "Contraseña inválida", @@ -645,7 +632,6 @@ "migration_0021_modified_files": "Tenga en cuenta que se encontró que los siguientes archivos se modificaron manualmente y podrían sobrescribirse después de la actualización: {manually_modified_files}", "invalid_number_min": "Debe ser mayor que {min}", "pattern_email_forward": "Debe ser una dirección de correo electrónico válida, se acepta el símbolo '+' (por ejemplo, alguien+etiqueta@ejemplo.com)", - "global_settings_setting_security_ssh_password_authentication": "Permitir autenticación de contraseña para SSH", "invalid_number_max": "Debe ser menor que {max}", "ldap_attribute_already_exists": "El atributo LDAP '{attribute}' ya existe con el valor '{value}'", "log_app_config_set": "Aplicar configuración a la aplicación '{}'", @@ -657,8 +643,6 @@ "ldap_server_down": "No se puede conectar con el servidor LDAP", "log_backup_create": "Crear un archivo de copia de seguridad", "migration_ldap_can_not_backup_before_migration": "La copia de seguridad del sistema no se pudo completar antes de que fallara la migración. Error: {error}", - "global_settings_setting_security_experimental_enabled": "Habilite las funciones de seguridad experimentales (¡no habilite esto si no sabe lo que está haciendo!)", - "global_settings_setting_security_webadmin_allowlist_enabled": "Permita que solo algunas IP accedan al administrador web.", "migration_ldap_migration_failed_trying_to_rollback": "No se pudo migrar... intentando revertir el sistema.", "migration_0023_not_enough_space": "Deje suficiente espacio disponible en {path} para ejecutar la migración.", "migration_0023_postgresql_11_not_installed": "PostgreSQL no estaba instalado en su sistema. Nada que hacer.", @@ -684,5 +668,20 @@ "service_description_yunomdns": "Le permite llegar a su servidor usando 'yunohost.local' en su red local", "show_tile_cant_be_enabled_for_regex": "No puede habilitar 'show_tile' en este momento porque la URL para el permiso '{permission}' es una expresión regular", "show_tile_cant_be_enabled_for_url_not_defined": "No puede habilitar 'show_tile' en este momento, porque primero debe definir una URL para el permiso '{permission}'", - "regex_incompatible_with_tile": "/!\\ Empaquetadores! El permiso '{permission}' tiene show_tile establecido en 'true' y, por lo tanto, no puede definir una URL de expresión regular como la URL principal" -} + "regex_incompatible_with_tile": "/!\\ Empaquetadores! El permiso '{permission}' tiene show_tile establecido en 'true' y, por lo tanto, no puede definir una URL de expresión regular como la URL principal", + "global_settings_setting_backup_compress_tar_archives_help": "Cuando se creen nuevas copias de respaldo, comprimir los archivos (.tar.gz) en lugar de descomprimir los archivos (.tar). N.B.: activar esta opción quiere decir que los archivos serán más pequeños pero que el proceso tardará más y utilizará más CPU.", + "global_settings_setting_security_experimental_enabled_help": "Habilite las funciones de seguridad experimentales (¡no habilite esto si no sabe lo que está haciendo!)", + "global_settings_setting_nginx_compatibility_help": "Compromiso entre compatibilidad y seguridad para el servidor web NGINX. Afecta al cifrado (y otros aspectos relacionados con la seguridad)", + "global_settings_setting_nginx_redirect_to_https_help": "Redirija las solicitudes HTTP a HTTPs de forma predeterminada (¡NO LO DESACTIVE a menos que realmente sepa lo que está haciendo!)", + "global_settings_setting_admin_strength": "Seguridad de la contraseña del administrador", + "global_settings_setting_user_strength": "Seguridad de la contraseña de usuario", + "global_settings_setting_postfix_compatibility_help": "Compromiso entre compatibilidad y seguridad para el servidor Postfix. Afecta al cifrado (y otros aspectos relacionados con la seguridad)", + "global_settings_setting_ssh_compatibility_help": "Compromiso entre compatibilidad y seguridad para el servidor SSH. Afecta al cifrado (y otros aspectos relacionados con la seguridad)", + "global_settings_setting_ssh_password_authentication_help": "Permitir autenticación de contraseña para SSH", + "global_settings_setting_ssh_port": "Puerto SSH", + "global_settings_setting_webadmin_allowlist_help": "Direcciones IP permitidas para acceder al webadmin. Separado por comas.", + "global_settings_setting_webadmin_allowlist_enabled_help": "Permita que solo algunas IP accedan al administrador web.", + "global_settings_setting_ssh_allow_deprecated_dsa_hostkey_help": "Permitir el uso de la llave (obsoleta) DSA para la configuración del demonio SSH", + "global_settings_setting_smtp_allow_ipv6_help": "Permitir el uso de IPv6 para enviar y recibir correo", + "global_settings_setting_smtp_relay_enabled_help": "El servidor relay de SMTP para enviar correo en lugar de esta instalación YunoHost. Útil si estás en una de estas situaciones: tu puerto 25 esta bloqueado por tu ISP o VPS, si estás en usado una IP marcada como residencial o DUHL, si no puedes configurar un DNS inverso o si el servidor no está directamente expuesto a internet y quieres utilizar otro servidor para enviar correos." +} \ No newline at end of file diff --git a/locales/eu.json b/locales/eu.json index e0ce226d5..d35a0875c 100644 --- a/locales/eu.json +++ b/locales/eu.json @@ -254,7 +254,6 @@ "firewall_reloaded": "Suebakia birkargatu da", "domain_unknown": "'{domain}' domeinua ezezaguna da", "global_settings_cant_serialize_settings": "Ezinezkoa izan da konfikurazio-datuak serializatzea, zergatia: {reason}", - "global_settings_setting_security_nginx_redirect_to_https": "Birbideratu HTTP eskaerak HTTPSra (EZ ITZALI hau ez badakizu zertan ari zaren!)", "group_deleted": "'{group}' taldea ezabatu da", "invalid_password": "Pasahitza ez da zuzena", "log_domain_main_domain": "Lehenetsi '{}' domeinua", @@ -284,18 +283,13 @@ "global_settings_cant_write_settings": "Ezinezkoa izan da konfigurazio fitxategia gordetzea, zergatia: {reason}", "dyndns_domain_not_provided": "{provider} DynDNS enpresak ezin du {domain} domeinua eskaini.", "firewall_reload_failed": "Ezinezkoa izan da suebakia birkargatzea", - "global_settings_setting_security_password_admin_strength": "Administrazio-pasahitzaren segurtasuna", "hook_name_unknown": "'{name}' 'hook' izen ezezaguna", "domain_deletion_failed": "Ezinezkoa izan da {domain} ezabatzea: {error}", - "global_settings_setting_security_nginx_compatibility": "Bateragarritasun eta segurtasun arteko gatazka NGINX web zerbitzarirako. Zifraketari eragiten dio (eta segurtasunari lotutako beste kontu batzuei)", "log_regen_conf": "Berregin '{}' sistemaren konfigurazioa", "dpkg_lock_not_available": "Ezin da komando hau une honetan exekutatu beste aplikazio batek dpkg (sistemaren paketeen kudeatzailea) blokeatuta duelako, erabiltzen ari baita", "group_created": "'{group}' taldea sortu da", - "global_settings_setting_security_password_user_strength": "Erabiltzaile-pasahitzaren segurtasuna", - "global_settings_setting_security_experimental_enabled": "Gaitu segurtasun funtzio esperimentalak (ez ezazu egin ez badakizu zertan ari zaren!)", "good_practices_about_admin_password": "Administrazio-pasahitz berria ezartzear zaude. Pasahitzak zortzi karaktere izan beharko lituzke gutxienez, baina gomendagarria da pasahitz luzeagoa erabiltzea (esaldi bat, esaterako) edota karaktere desberdinak erabiltzea (hizki larriak, txikiak, zenbakiak eta karaktere bereziak).", "log_help_to_get_failed_log": "Ezin izan da '{desc}' eragiketa exekutatu. Mesedez, laguntza nahi baduzu partekatu eragiketa honen erregistro osoa 'yunohost log share {name}' komandoa erabiliz", - "global_settings_setting_security_webadmin_allowlist_enabled": "Baimendu IP zehatz batzuk bakarrik administrazio-atarian.", "group_unknown": "'{group}' taldea ezezaguna da", "group_updated": "'{group}' taldea eguneratu da", "group_update_failed": "Ezinezkoa izan da '{group}' taldea eguneratzea: {error}", @@ -317,7 +311,6 @@ "domain_dns_push_success": "DNS ezarpenak eguneratu dira!", "domain_dns_push_failed": "DNS ezarpenen eguneratzeak kale egin du.", "domain_dns_push_partial_failure": "DNS ezarpenak erdipurdi eguneratu dira: jakinarazpen/errore batzuk egon dira.", - "global_settings_setting_smtp_relay_host": "YunoHosten ordez posta elektronikoa bidaltzeko SMTP relay helbidea. Erabilgarri izan daiteke egoera hauetan: operadore edo VPS enpresak 25. ataka blokeatzen badu, DUHLen zure etxeko IPa ageri bada, ezin baduzu alderantzizko DNSa ezarri edo zerbitzari hau ez badago zuzenean internetera konektatuta baina posta elektronikoa bidali nahi baduzu.", "group_deletion_failed": "Ezinezkoa izan da '{group}' taldea ezabatzea: {error}", "invalid_number_min": "{min} baino handiagoa izan behar da", "invalid_number_max": "{max} baino txikiagoa izan behar da", @@ -345,7 +338,6 @@ "domain_config_auth_application_key": "Aplikazioaren gakoa", "domain_config_auth_application_secret": "Aplikazioaren gako sekretua", "domain_config_auth_consumer_key": "Erabiltzailearen gakoa", - "global_settings_setting_smtp_allow_ipv6": "Baimendu IPv6 posta elektronikoa jaso eta bidaltzeko", "group_cannot_be_deleted": "{group} taldea ezin da eskuz ezabatu.", "log_domain_config_set": "Aldatu '{}' domeinuko ezarpenak", "log_domain_dns_push": "Bidali '{}' domeinuaren DNS ezarpenak", @@ -359,8 +351,6 @@ "domain_config_mail_out": "Bidalitako mezuak", "domain_config_xmpp": "Bat-bateko mezularitza (XMPP)", "global_settings_bad_choice_for_enum": "{setting} ezarpenerako aukera okerra. '{choice}' ezarri da baina hauek dira aukerak: {available_choices}", - "global_settings_setting_security_postfix_compatibility": "Bateragarritasun eta segurtasun arteko gatazka Postfix zerbitzarirako. Zifraketari eragiten dio (eta segurtasunari lotutako beste kontu batzuei)", - "global_settings_setting_security_ssh_compatibility": "Bateragarritasun eta segurtasun arteko gatazka SSH zerbitzarirako. Zifraketari eragiten dio (eta segurtasunari lotutako beste kontu batzuei)", "good_practices_about_user_password": "Erabiltzaile-pasahitz berria ezartzear zaude. Pasahitzak zortzi karaktere izan beharko lituzke gutxienez, baina gomendagarria da pasahitz luzeagoa erabiltzea (esaldi bat, esaterako) edota karaktere desberdinak erabiltzea (hizki larriak, txikiak, zenbakiak eta karaktere bereziak).", "group_cannot_edit_all_users": "'all_users' taldea ezin da eskuz moldatu. YunoHosten izena emanda dauden erabiltzaile guztiak barne dituen talde berezia da", "invalid_number": "Zenbaki bat izan behar da", @@ -416,8 +406,6 @@ "diagnosis_ports_forwarding_tip": "Arazoa konpontzeko, litekeena da operadorearen routerrean ataken birbideraketa konfiguratu behar izatea, https://yunohost.org/isp_box_config-n agertzen den bezala", "domain_creation_failed": "Ezinezkoa izan da {domain} domeinua sortzea: {error}", "domains_available": "Erabilgarri dauden domeinuak:", - "global_settings_setting_pop3_enabled": "Gaitu POP3 protokoloa posta zerbitzarirako", - "global_settings_setting_security_ssh_port": "SSH ataka", "global_settings_unknown_type": "Gertaera ezezaguna, {setting} ezarpenak {unknown_type} mota duela dirudi baina mota hori ez da sistemarekin bateragarria.", "group_already_exist_on_system": "{group} taldea existitzen da dagoeneko sistemaren taldeetan", "diagnosis_processes_killed_by_oom_reaper": "Memoria agortu eta sistemak prozesu batzuk amaituarazi behar izan ditu. Honek esan nahi du sistemak ez duela memoria nahikoa edo prozesuren batek memoria gehiegi behar duela. Amaituarazi d(ir)en prozesua(k):\n{kills_summary}", @@ -440,7 +428,6 @@ "global_settings_reset_success": "Lehengo ezarpenak {path}-n gorde dira", "global_settings_unknown_setting_from_settings_file": "Gako ezezaguna ezarpenetan: '{setting_key}', baztertu eta gorde ezazu hemen: /etc/yunohost/settings-unknown.json", "domain_remove_confirm_apps_removal": "Domeinu hau ezabatzean aplikazio hauek desinstalatuko dira:\n{apps}\n\nZiur al zaude? [{answers}]", - "global_settings_setting_service_ssh_allow_deprecated_dsa_hostkey": "Baimendu DSA gakoa (zaharkitua) SSH zerbitzuaren konfiguraziorako", "hook_list_by_invalid": "Aukera hau ezin da 'hook'ak zerrendatzeko erabili", "installation_complete": "Instalazioa amaitu da", "hook_exec_failed": "Ezinezkoa izan da agindua exekutatzea: {path}", @@ -468,8 +455,6 @@ "global_settings_bad_type_for_setting": "{setting} ezarpenerako mota okerra. {received_type} ezarri da, {expected_type} espero zen", "diagnosis_mail_fcrdns_dns_missing": "Ez da alderantzizko DNSrik ezarri IPv{ipversion}rako. Litekeena da hartzaileak posta elektroniko batzuk jaso ezin izatea edo mezuok spam modura etiketatuak izatea.", "log_backup_create": "Sortu babeskopia fitxategia", - "global_settings_setting_backup_compress_tar_archives": "Babeskopia berriak sortzean, konprimitu fitxategiak (.tar.gz) konprimitu gabeko fitxategien (.tar) ordez. Aukera hau gaitzean babeskopiek espazio gutxiago beharko dute, baina hasierako prozesua luzeagoa izango da eta CPUari lan handiagoa eragingo dio.", - "global_settings_setting_security_webadmin_allowlist": "Administrazio-ataria bisita dezaketen IP helbideak, koma bidez bereiziak.", "global_settings_key_doesnt_exists": "'{settings_key}' gakoa ez da existitzen konfigurazio orokorrean; erabilgarri dauden gakoak ikus ditzakezu 'yunohost settings list' exekutatuz", "global_settings_setting_ssowat_panel_overlay_enabled": "Gaitu SSOwat paneleko \"overlay\"a", "log_backup_restore_system": "Lehengoratu sistema babeskopia fitxategi batetik", @@ -678,11 +663,25 @@ "migration_0021_cleaning_up": "Cachea eta erabilgarriak ez diren paketeak garbitzen…", "migration_0021_patch_yunohost_conflicts": "Arazo gatazkatsu bati adabakia jartzen…", "migration_description_0021_migrate_to_bullseye": "Eguneratu sistema Debian Bullseye eta Yunohost 11.x-ra", - "global_settings_setting_security_ssh_password_authentication": "Baimendu pasahitz bidezko autentikazioa SSHrako", "migration_0021_problematic_apps_warning": "Mesedez, kontuan izan ziur asko gatazkatsuak izango diren odorengo aplikazioak aurkitu direla. Badirudi ez zirela YunoHost aplikazioen katalogotik instalatu, edo ez daude 'badabiltza' bezala etiketatuak. Ondorioz, ezin da bermatu eguneratu ondoren funtzionatzen jarraituko dutenik: {problematic_apps}", "migration_0023_not_enough_space": "{path}-en ez dago toki nahikorik migrazioa abiarazteko.", "migration_0023_postgresql_11_not_installed": "PostgreSQL ez zegoen zure isteman instalatuta. Ez dago egitekorik.", "migration_0023_postgresql_13_not_installed": "PostgreSQL 11 dago instalatuta baina PostgreSQL 13 ez!? Zerbait arraroa gertatu omen zaio zure sistemari :( …", "migration_description_0022_php73_to_php74_pools": "Migratu php7.3-fpm 'pool' ezarpen-fitxategiak php7.4ra", - "migration_description_0023_postgresql_11_to_13": "Migratu datubaseak PostgreSQL 11tik 13ra" + "migration_description_0023_postgresql_11_to_13": "Migratu datubaseak PostgreSQL 11tik 13ra", + "global_settings_setting_backup_compress_tar_archives_help": "Babeskopia berriak sortzean, konprimitu fitxategiak (.tar.gz) konprimitu gabeko fitxategien (.tar) ordez. Aukera hau gaitzean babeskopiek espazio gutxiago beharko dute, baina hasierako prozesua luzeagoa izango da eta CPUari lan handiagoa eragingo dio.", + "global_settings_setting_security_experimental_enabled_help": "Gaitu segurtasun funtzio esperimentalak (ez ezazu egin ez badakizu zertan ari zaren!)", + "global_settings_setting_nginx_compatibility_help": "Bateragarritasun eta segurtasun arteko gatazka NGINX web zerbitzarirako. Zifraketari eragiten dio (eta segurtasunari lotutako beste kontu batzuei)", + "global_settings_setting_nginx_redirect_to_https_help": "Birbideratu HTTP eskaerak HTTPSra (EZ ITZALI hau ez badakizu zertan ari zaren!)", + "global_settings_setting_admin_strength": "Administrazio-pasahitzaren segurtasuna", + "global_settings_setting_user_strength": "Erabiltzaile-pasahitzaren segurtasuna", + "global_settings_setting_postfix_compatibility_help": "Bateragarritasun eta segurtasun arteko gatazka Postfix zerbitzarirako. Zifraketari eragiten dio (eta segurtasunari lotutako beste kontu batzuei)", + "global_settings_setting_ssh_compatibility_help": "Bateragarritasun eta segurtasun arteko gatazka SSH zerbitzarirako. Zifraketari eragiten dio (eta segurtasunari lotutako beste kontu batzuei)", + "global_settings_setting_ssh_password_authentication_help": "Baimendu pasahitz bidezko autentikazioa SSHrako", + "global_settings_setting_ssh_port": "SSH ataka", + "global_settings_setting_webadmin_allowlist_help": "Administrazio-ataria bisita dezaketen IP helbideak, koma bidez bereiziak.", + "global_settings_setting_webadmin_allowlist_enabled_help": "Baimendu IP zehatz batzuk bakarrik administrazio-atarian.", + "global_settings_setting_ssh_allow_deprecated_dsa_hostkey_help": "Baimendu DSA gakoa (zaharkitua) SSH zerbitzuaren konfiguraziorako", + "global_settings_setting_smtp_allow_ipv6_help": "Baimendu IPv6 posta elektronikoa jaso eta bidaltzeko", + "global_settings_setting_smtp_relay_enabled_help": "YunoHosten ordez posta elektronikoa bidaltzeko SMTP relay helbidea. Erabilgarri izan daiteke egoera hauetan: operadore edo VPS enpresak 25. ataka blokeatzen badu, DUHLen zure etxeko IPa ageri bada, ezin baduzu alderantzizko DNSa ezarri edo zerbitzari hau ez badago zuzenean internetera konektatuta baina posta elektronikoa bidali nahi baduzu." } \ No newline at end of file diff --git a/locales/fa.json b/locales/fa.json index 599ab1ea7..9ab48cdfa 100644 --- a/locales/fa.json +++ b/locales/fa.json @@ -302,25 +302,11 @@ "good_practices_about_user_password": "گذرواژه باید حداقل 8 کاراکتر باشد - اگرچه استفاده از گذرواژه طولانی تر تمرین خوبی است (به عنوان مثال عبارت عبور) و/یا استفاده از تنوع کاراکترها (بزرگ ، کوچک ، رقم و کاراکتر های خاص).", "good_practices_about_admin_password": "اکنون می خواهید گذرواژه جدیدی برای مدیریت تعریف کنید. گذرواژه باید حداقل 8 کاراکتر باشد - اگرچه استفاده از گذرواژه طولانی تر تمرین خوبی است (به عنوان مثال عبارت عبور) و/یا استفاده از تنوع کاراکترها (بزرگ ، کوچک ، رقم و کاراکتر های خاص).", "global_settings_unknown_type": "وضعیت غیرمنتظره ، به نظر می رسد که تنظیمات {setting} دارای نوع {unknown_type} است اما از نوع پشتیبانی شده توسط سیستم نیست.", - "global_settings_setting_backup_compress_tar_archives": "هنگام ایجاد پشتیبان جدید ، بایگانی های فشرده (.tar.gz) را به جای بایگانی های فشرده نشده (.tar) انتخاب کنید. N.B. : فعال کردن این گزینه به معنای ایجاد آرشیوهای پشتیبان سبک تر است ، اما روش پشتیبان گیری اولیه به طور قابل توجهی طولانی تر و سنگین تر بر روی CPU خواهد بود.", - "global_settings_setting_security_experimental_enabled": "فعال کردن ویژگی های امنیتی آزمایشی (اگر نمی دانید در حال انجام چه کاری هستید این کار را انجام ندهید!)", - "global_settings_setting_security_webadmin_allowlist": "آدرس های IP که مجاز به دسترسی مدیر وب هستند. جدا شده با ویرگول.", - "global_settings_setting_security_webadmin_allowlist_enabled": "فقط به برخی از IP ها اجازه دسترسی به مدیریت وب را بدهید.", "global_settings_setting_smtp_relay_password": "رمز عبور میزبان رله SMTP", "global_settings_setting_smtp_relay_user": "حساب کاربری رله SMTP", "global_settings_setting_smtp_relay_port": "پورت رله SMTP", - "global_settings_setting_smtp_relay_host": "میزبان رله SMTP برای ارسال نامه به جای این نمونه yunohost استفاده می شود. اگر در یکی از این شرایط قرار دارید مفید است: پورت 25 شما توسط ارائه دهنده ISP یا VPS شما مسدود شده است، شما یک IP مسکونی دارید که در DUHL ذکر شده است، نمی توانید DNS معکوس را پیکربندی کنید یا این سرور مستقیماً در اینترنت نمایش داده نمی شود و می خواهید از یکی دیگر برای ارسال ایمیل استفاده کنید.", - "global_settings_setting_smtp_allow_ipv6": "اجازه دهید از IPv6 برای دریافت و ارسال نامه استفاده شود", "global_settings_setting_ssowat_panel_overlay_enabled": "همپوشانی پانل SSOwat را فعال کنید", - "global_settings_setting_service_ssh_allow_deprecated_dsa_hostkey": "اجازه دهید از کلید میزبان DSA (منسوخ شده) برای پیکربندی SH daemon استفاده شود", "global_settings_unknown_setting_from_settings_file": "کلید ناشناخته در تنظیمات: '{setting_key}'، آن را کنار گذاشته و در /etc/yunohost/settings-unknown.json ذخیره کنید", - "global_settings_setting_security_ssh_port": "درگاه SSH", - "global_settings_setting_security_postfix_compatibility": "سازگاری در مقابل مبادله امنیتی برای سرور Postfix. روی رمزها (و سایر جنبه های مرتبط با امنیت) تأثیر می گذارد", - "global_settings_setting_security_ssh_compatibility": "سازگاری در مقابل مبادله امنیتی برای سرور SSH. روی رمزها (و سایر جنبه های مرتبط با امنیت) تأثیر می گذارد", - "global_settings_setting_security_password_user_strength": "قدرت رمز عبور کاربر", - "global_settings_setting_security_password_admin_strength": "قدرت رمز عبور مدیر", - "global_settings_setting_security_nginx_compatibility": "سازگاری در مقابل مبادله امنیتی برای وب سرور NGINX. روی رمزها (و سایر جنبه های مرتبط با امنیت) تأثیر می گذارد", - "global_settings_setting_pop3_enabled": "پروتکل POP3 را برای سرور ایمیل فعال کنید", "global_settings_reset_success": "تنظیمات قبلی اکنون در {path} پشتیبان گیری شده است", "global_settings_key_doesnt_exists": "کلید '{settings_key}' در تنظیمات جهانی وجود ندارد ، با اجرای 'لیست تنظیمات yunohost' می توانید همه کلیدهای موجود را مشاهده کنید", "global_settings_cant_write_settings": "فایل تنظیمات ذخیره نشد، به دلیل: {reason}", @@ -589,5 +575,18 @@ "permission_deletion_failed": "اجازه '{permission}' حذف نشد: {error}", "permission_deleted": "مجوز '{permission}' حذف شد", "permission_cant_add_to_all_users": "مجوز {permission} را نمی توان به همه کاربران اضافه کرد.", - "permission_currently_allowed_for_all_users": "این مجوز در حال حاضر به همه کاربران علاوه بر آن گروه های دیگر نیز اعطا شده. احتمالاً بخواهید مجوز 'all_users' را حذف کنید یا سایر گروه هایی را که در حال حاضر مجوز به آنها اعطا شده است را هم حذف کنید." + "permission_currently_allowed_for_all_users": "این مجوز در حال حاضر به همه کاربران علاوه بر آن گروه های دیگر نیز اعطا شده. احتمالاً بخواهید مجوز 'all_users' را حذف کنید یا سایر گروه هایی را که در حال حاضر مجوز به آنها اعطا شده است را هم حذف کنید.", + "global_settings_setting_backup_compress_tar_archives_help": "هنگام ایجاد پشتیبان جدید ، بایگانی های فشرده (.tar.gz) را به جای بایگانی های فشرده نشده (.tar) انتخاب کنید. N.B. : فعال کردن این گزینه به معنای ایجاد آرشیوهای پشتیبان سبک تر است ، اما روش پشتیبان گیری اولیه به طور قابل توجهی طولانی تر و سنگین تر بر روی CPU خواهد بود.", + "global_settings_setting_security_experimental_enabled_help": "فعال کردن ویژگی های امنیتی آزمایشی (اگر نمی دانید در حال انجام چه کاری هستید این کار را انجام ندهید!)", + "global_settings_setting_nginx_compatibility_help": "سازگاری در مقابل مبادله امنیتی برای وب سرور NGINX. روی رمزها (و سایر جنبه های مرتبط با امنیت) تأثیر می گذارد", + "global_settings_setting_admin_strength": "قدرت رمز عبور مدیر", + "global_settings_setting_user_strength": "قدرت رمز عبور کاربر", + "global_settings_setting_postfix_compatibility_help": "سازگاری در مقابل مبادله امنیتی برای سرور Postfix. روی رمزها (و سایر جنبه های مرتبط با امنیت) تأثیر می گذارد", + "global_settings_setting_ssh_compatibility_help": "سازگاری در مقابل مبادله امنیتی برای سرور SSH. روی رمزها (و سایر جنبه های مرتبط با امنیت) تأثیر می گذارد", + "global_settings_setting_ssh_port": "درگاه SSH", + "global_settings_setting_webadmin_allowlist_help": "آدرس های IP که مجاز به دسترسی مدیر وب هستند. جدا شده با ویرگول.", + "global_settings_setting_webadmin_allowlist_enabled_help": "فقط به برخی از IP ها اجازه دسترسی به مدیریت وب را بدهید.", + "global_settings_setting_ssh_allow_deprecated_dsa_hostkey_help": "اجازه دهید از کلید میزبان DSA (منسوخ شده) برای پیکربندی SH daemon استفاده شود", + "global_settings_setting_smtp_allow_ipv6_help": "اجازه دهید از IPv6 برای دریافت و ارسال نامه استفاده شود", + "global_settings_setting_smtp_relay_enabled_help": "میزبان رله SMTP برای ارسال نامه به جای این نمونه yunohost استفاده می شود. اگر در یکی از این شرایط قرار دارید مفید است: پورت 25 شما توسط ارائه دهنده ISP یا VPS شما مسدود شده است، شما یک IP مسکونی دارید که در DUHL ذکر شده است، نمی توانید DNS معکوس را پیکربندی کنید یا این سرور مستقیماً در اینترنت نمایش داده نمی شود و می خواهید از یکی دیگر برای ارسال ایمیل استفاده کنید." } \ No newline at end of file diff --git a/locales/fr.json b/locales/fr.json index 2773d0bee..a158d8767 100644 --- a/locales/fr.json +++ b/locales/fr.json @@ -300,9 +300,6 @@ "dpkg_is_broken": "Vous ne pouvez pas faire ça maintenant car dpkg/apt (le gestionnaire de paquets du système) semble avoir laissé des choses non configurées. Vous pouvez essayer de résoudre ce problème en vous connectant via SSH et en exécutant `sudo apt install --fix-broken` et/ou `sudo dpkg --configure -a'.", "dyndns_could_not_check_available": "Impossible de vérifier si {domain} est disponible chez {provider}.", "file_does_not_exist": "Le fichier dont le chemin est {path} n'existe pas.", - "global_settings_setting_security_password_admin_strength": "Qualité du mot de passe administrateur", - "global_settings_setting_security_password_user_strength": "Qualité du mot de passe de l'utilisateur", - "global_settings_setting_service_ssh_allow_deprecated_dsa_hostkey": "Autoriser l'utilisation de la clé hôte DSA (obsolète) pour la configuration du service SSH", "hook_json_return_error": "Échec de la lecture au retour du script {path}. Erreur : {msg}. Contenu brut : {raw_content}", "pattern_password_app": "Désolé, les mots de passe ne peuvent pas contenir les caractères suivants : {forbidden_chars}", "root_password_replaced_by_admin_password": "Votre mot de passe root a été remplacé par votre mot de passe administrateur.", @@ -326,9 +323,6 @@ "regenconf_now_managed_by_yunohost": "Le fichier de configuration '{conf}' est maintenant géré par YunoHost (catégorie {category}).", "regenconf_up_to_date": "La configuration est déjà à jour pour la catégorie '{category}'", "already_up_to_date": "Il n'y a rien à faire. Tout est déjà à jour.", - "global_settings_setting_security_nginx_compatibility": "Compatibilité versus compromis sécuritaire pour le serveur web Nginx. Affecte les cryptogrammes (et d'autres aspects liés à la sécurité)", - "global_settings_setting_security_ssh_compatibility": "Compatibilité versus compromis sécuritaire pour le serveur SSH. Affecte les cryptogrammes (et d'autres aspects liés à la sécurité)", - "global_settings_setting_security_postfix_compatibility": "Compatibilité versus compromis sécuritaire pour le serveur Postfix. Affecte les cryptogrammes (et d'autres aspects liés à la sécurité)", "regenconf_file_kept_back": "Le fichier de configuration '{conf}' devait être supprimé par 'regen-conf' (catégorie {category}) mais a été conservé.", "regenconf_updated": "La configuration a été mise à jour pour '{category}'", "regenconf_would_be_updated": "La configuration aurait dû être mise à jour pour la catégorie '{category}'", @@ -474,7 +468,6 @@ "diagnosis_services_bad_status_tip": "Vous pouvez essayer de redémarrer le service, et si cela ne fonctionne pas, consultez les journaux de service dans le webadmin (à partir de la ligne de commande, vous pouvez le faire avec yunohost service restart {service} et yunohost service log {service} ).", "diagnosis_http_bad_status_code": "Le système de diagnostique n'a pas réussi à contacter votre serveur. Il se peut qu'une autre machine réponde à la place de votre serveur. Vérifiez que le port 80 est correctement redirigé, que votre configuration Nginx est à jour et qu'un reverse-proxy n'interfère pas.", "diagnosis_http_timeout": "Expiration du délai en essayant de contacter votre serveur de l'extérieur. Il semble être inaccessible. Vérifiez que vous transférez correctement le port 80, que Nginx est en cours d'exécution et qu'un pare-feu n'interfère pas.", - "global_settings_setting_pop3_enabled": "Activer le protocole POP3 pour le serveur de messagerie", "log_app_action_run": "Lancer l'action de l'application '{}'", "diagnosis_never_ran_yet": "Il apparaît que le serveur a été installé récemment et qu'il n'y a pas encore eu de diagnostic. Vous devriez en lancer un depuis la webadmin ou en utilisant 'yunohost diagnosis run' depuis la ligne de commande.", "diagnosis_description_web": "Web", @@ -499,7 +492,6 @@ "diagnosis_mail_queue_ok": "{nb_pending} emails en attente dans les files d'attente de messagerie", "diagnosis_mail_queue_unavailable_details": "Erreur : {error}", "diagnosis_mail_queue_too_big": "Trop d'emails en attente dans la file d'attente ({nb_pending} emails)", - "global_settings_setting_smtp_allow_ipv6": "Autoriser l'utilisation d'IPv6 pour recevoir et envoyer du courrier", "diagnosis_display_tip": "Pour voir les problèmes détectés, vous pouvez accéder à la section Diagnostic du webadmin ou exécuter 'yunohost diagnosis show --issues --human-readable' à partir de la ligne de commande.", "diagnosis_ip_global": "IP globale : {global}", "diagnosis_ip_local": "IP locale : {local}", @@ -536,7 +528,6 @@ "regenconf_need_to_explicitly_specify_ssh": "La configuration de ssh a été modifiée manuellement. Vous devez explicitement indiquer la mention --force à \"ssh\" pour appliquer les changements.", "diagnosis_dns_try_dyndns_update_force": "La configuration DNS de ce domaine devrait être automatiquement gérée par YunoHost. Si ce n'est pas le cas, vous pouvez essayer de forcer une mise à jour en utilisant yunohost dyndns update --force.", "app_packaging_format_not_supported": "Cette application ne peut pas être installée car son format n'est pas pris en charge par votre version de YunoHost. Vous devriez probablement envisager de mettre à jour votre système.", - "global_settings_setting_backup_compress_tar_archives": "Lors de la création de nouvelles sauvegardes, compresser automatiquement les archives (.tar.gz) au lieu des archives non compressées (.tar). N.B. : activer cette option permet de créer des archives plus légères, mais la procédure de sauvegarde initiale sera significativement plus longues et plus gourmandes en CPU.", "diagnosis_processes_killed_by_oom_reaper": "Certains processus ont été arrêtés récemment par le système car il manquait de mémoire. Cela apparaît généralement quand le système manque de mémoire ou qu'un processus consomme trop de mémoire. Liste des processus tués :\n{kills_summary}", "ask_user_domain": "Domaine à utiliser pour l'adresse email de l'utilisateur et le compte XMPP", "app_manifest_install_ask_is_public": "Cette application devrait-elle être visible par les visiteurs anonymes ?", @@ -546,7 +537,6 @@ "app_manifest_install_ask_domain": "Choisissez le domaine sur lequel vous souhaitez installer cette application", "global_settings_setting_smtp_relay_user": "Compte utilisateur du relais SMTP", "global_settings_setting_smtp_relay_port": "Port du relais SMTP", - "global_settings_setting_smtp_relay_host": "Un relais SMTP permet d'envoyer du courrier à la place de cette instance YunoHost. Cela est utile si vous êtes dans l'une de ces situations : le port 25 est bloqué par votre FAI ou par votre fournisseur VPS, vous avez une IP résidentielle répertoriée sur DUHL, vous ne pouvez pas configurer de reverse DNS ou le serveur n'est pas directement accessible depuis Internet et que vous voulez en utiliser un autre pour envoyer des mails.", "diagnosis_package_installed_from_sury_details": "Certains paquets ont été installés par inadvertance à partir d'un dépôt tiers appelé Sury. L'équipe YunoHost a amélioré la stratégie de gestion de ces paquets, mais on s'attend à ce que certaines configurations qui ont installé des applications PHP7.3 tout en étant toujours sur Stretch présentent des incohérences. Pour résoudre cette situation, vous devez essayer d'exécuter la commande suivante : {cmd_to_fix}", "app_argument_password_no_default": "Erreur lors de l'analyse de l'argument de mot de passe '{name}' : l'argument de mot de passe ne peut pas avoir de valeur par défaut pour des raisons de sécurité", "pattern_email_forward": "L'adresse électronique doit être valide, le symbole '+' étant accepté (par exemple : johndoe+yunohost@exemple.com)", @@ -578,18 +568,14 @@ "migration_ldap_migration_failed_trying_to_rollback": "Impossible de migrer... tentative de restauration du système.", "migration_ldap_can_not_backup_before_migration": "La sauvegarde du système n'a pas pu être terminée avant l'échec de la migration. Erreur : {error }", "migration_ldap_backup_before_migration": "Création d'une sauvegarde de la base de données LDAP et des paramètres des applications avant la migration proprement dite.", - "global_settings_setting_security_ssh_port": "Port SSH", "diagnosis_sshd_config_inconsistent_details": "Veuillez exécuter yunohost settings set security.ssh.port -v VOTRE_PORT_SSH pour définir le port SSH, et vérifiez yunohost tools regen-conf ssh --dry-run --with-diff et yunohost tools regen-conf ssh --force pour réinitialiser votre configuration aux recommandations YunoHost.", "diagnosis_sshd_config_inconsistent": "Il semble que le port SSH a été modifié manuellement dans /etc/ssh/sshd_config. Depuis YunoHost 4.2, un nouveau paramètre global 'security.ssh.port' est disponible pour éviter de modifier manuellement la configuration.", "diagnosis_sshd_config_insecure": "La configuration SSH semble avoir été modifiée manuellement et n'est pas sécurisée car elle ne contient aucune directive 'AllowGroups' ou 'AllowUsers' pour limiter l'accès aux utilisateurs autorisés.", "backup_create_size_estimation": "L'archive contiendra environ {size} de données.", - "global_settings_setting_security_webadmin_allowlist": "Adresses IP autorisées à accéder à la webadmin. Elles doivent être séparées par une virgule.", - "global_settings_setting_security_webadmin_allowlist_enabled": "Autoriser seulement certaines IP à accéder à la webadmin.", "diagnosis_dns_specialusedomain": "Le domaine {domain} est basé sur un domaine de premier niveau (TLD) à usage spécial comme .local ou .test et ne devrait donc pas avoir d'enregistrements DNS réels.", "invalid_password": "Mot de passe incorrect", "ldap_server_is_down_restart_it": "Le service LDAP est en panne, essayez de le redémarrer...", "ldap_server_down": "Impossible d'atteindre le serveur LDAP", - "global_settings_setting_security_experimental_enabled": "Activer les fonctionnalités de sécurité expérimentales (ne l'activez pas si vous ne savez pas ce que vous faites !)", "diagnosis_apps_deprecated_practices": "La version installée de cette application utilise toujours certaines pratiques de packaging obsolètes. Vous devriez vraiment envisager de mettre l'application à jour.", "diagnosis_apps_outdated_ynh_requirement": "La version installée de cette application nécessite uniquement YunoHost >= 2.x, cela indique que l'application n'est pas à jour avec les bonnes pratiques de packaging et les helpers recommandées. Vous devriez vraiment envisager de mettre l'application à jour.", "diagnosis_apps_bad_quality": "Cette application est actuellement signalée comme cassée dans le catalogue d'applications de YunoHost. Cela peut être un problème temporaire. En attendant que les mainteneurs tentent de résoudre le problème, la mise à jour de cette application est désactivée.", @@ -607,7 +593,6 @@ "user_import_bad_line": "Ligne incorrecte {line} : {details}", "log_user_import": "Importer des utilisateurs", "diagnosis_high_number_auth_failures": "Il y a eu récemment un grand nombre d'échecs d'authentification. Assurez-vous que Fail2Ban est en cours d'exécution et est correctement configuré, ou utilisez un port personnalisé pour SSH comme expliqué dans https://yunohost.org/security.", - "global_settings_setting_security_nginx_redirect_to_https": "Rediriger les requêtes HTTP vers HTTPS par défaut (NE PAS DÉSACTIVER à moins de savoir vraiment ce que vous faites !)", "config_validate_color": "Doit être une couleur hexadécimale RVB valide", "app_config_unable_to_apply": "Échec de l'application des valeurs du panneau de configuration.", "app_config_unable_to_read": "Échec de la lecture des valeurs du panneau de configuration.", @@ -675,7 +660,6 @@ "migration_0021_patch_yunohost_conflicts": "Application du correctif pour contourner le problème de conflit...", "migration_0021_not_buster": "La distribution Debian actuelle n'est pas Buster !", "migration_description_0021_migrate_to_bullseye": "Mise à niveau du système vers Debian Bullseye et YunoHost 11.x", - "global_settings_setting_security_ssh_password_authentication": "Autoriser l'authentification par mot de passe pour SSH", "domain_config_default_app": "Application par défaut", "migration_description_0022_php73_to_php74_pools": "Migration des fichiers de configuration php7.3-fpm 'pool' vers php7.4", "migration_description_0023_postgresql_11_to_13": "Migration des bases de données de PostgreSQL 11 vers 13", @@ -684,5 +668,20 @@ "migration_0023_postgresql_13_not_installed": "PostgreSQL 11 est installé, mais pas PostgreSQL 13 ! ? Quelque chose d'anormal s'est peut-être produit sur votre système :(...", "tools_upgrade_failed": "Impossible de mettre à jour les paquets : {packages_list}", "migration_0023_not_enough_space": "Prévoyez suffisamment d'espace disponible dans {path} pour exécuter la migration.", - "migration_0023_postgresql_11_not_installed": "PostgreSQL n'a pas été installé sur votre système. Il n'y a rien à faire." -} + "migration_0023_postgresql_11_not_installed": "PostgreSQL n'a pas été installé sur votre système. Il n'y a rien à faire.", + "global_settings_setting_backup_compress_tar_archives_help": "Lors de la création de nouvelles sauvegardes, compresser automatiquement les archives (.tar.gz) au lieu des archives non compressées (.tar). N.B. : activer cette option permet de créer des archives plus légères, mais la procédure de sauvegarde initiale sera significativement plus longues et plus gourmandes en CPU.", + "global_settings_setting_security_experimental_enabled_help": "Activer les fonctionnalités de sécurité expérimentales (ne l'activez pas si vous ne savez pas ce que vous faites !)", + "global_settings_setting_nginx_compatibility_help": "Compatibilité versus compromis sécuritaire pour le serveur web Nginx. Affecte les cryptogrammes (et d'autres aspects liés à la sécurité)", + "global_settings_setting_nginx_redirect_to_https_help": "Rediriger les requêtes HTTP vers HTTPS par défaut (NE PAS DÉSACTIVER à moins de savoir vraiment ce que vous faites !)", + "global_settings_setting_admin_strength": "Qualité du mot de passe administrateur", + "global_settings_setting_user_strength": "Qualité du mot de passe de l'utilisateur", + "global_settings_setting_postfix_compatibility_help": "Compatibilité versus compromis sécuritaire pour le serveur Postfix. Affecte les cryptogrammes (et d'autres aspects liés à la sécurité)", + "global_settings_setting_ssh_compatibility_help": "Compatibilité versus compromis sécuritaire pour le serveur SSH. Affecte les cryptogrammes (et d'autres aspects liés à la sécurité)", + "global_settings_setting_ssh_password_authentication_help": "Autoriser l'authentification par mot de passe pour SSH", + "global_settings_setting_ssh_port": "Port SSH", + "global_settings_setting_webadmin_allowlist_help": "Adresses IP autorisées à accéder à la webadmin. Elles doivent être séparées par une virgule.", + "global_settings_setting_webadmin_allowlist_enabled_help": "Autoriser seulement certaines IP à accéder à la webadmin.", + "global_settings_setting_ssh_allow_deprecated_dsa_hostkey_help": "Autoriser l'utilisation de la clé hôte DSA (obsolète) pour la configuration du service SSH", + "global_settings_setting_smtp_allow_ipv6_help": "Autoriser l'utilisation d'IPv6 pour recevoir et envoyer du courrier", + "global_settings_setting_smtp_relay_enabled_help": "Un relais SMTP permet d'envoyer du courrier à la place de cette instance YunoHost. Cela est utile si vous êtes dans l'une de ces situations : le port 25 est bloqué par votre FAI ou par votre fournisseur VPS, vous avez une IP résidentielle répertoriée sur DUHL, vous ne pouvez pas configurer de reverse DNS ou le serveur n'est pas directement accessible depuis Internet et que vous voulez en utiliser un autre pour envoyer des mails." +} \ No newline at end of file diff --git a/locales/gl.json b/locales/gl.json index 4a77645d6..1aa987aac 100644 --- a/locales/gl.json +++ b/locales/gl.json @@ -308,17 +308,8 @@ "domain_cannot_add_xmpp_upload": "Non podes engadir dominios que comecen con 'xmpp-upload.'. Este tipo de nome está reservado para a función se subida de XMPP integrada en YunoHost.", "file_does_not_exist": "O ficheiro {path} non existe.", "firewall_reload_failed": "Non se puido recargar o cortalumes", - "global_settings_setting_smtp_allow_ipv6": "Permitir o uso de IPv6 para recibir e enviar emais", "global_settings_setting_ssowat_panel_overlay_enabled": "Activar as capas no panel SSOwat", - "global_settings_setting_service_ssh_allow_deprecated_dsa_hostkey": "Permitir o uso de DSA hostkey (en desuso) para a configuración do demoño SSH", "global_settings_unknown_setting_from_settings_file": "Chave descoñecida nos axustes: '{setting_key}', descártaa e gárdaa en /etc/yunohost/settings-unknown.json", - "global_settings_setting_security_ssh_port": "Porto SSH", - "global_settings_setting_security_postfix_compatibility": "Compromiso entre compatibilidade e seguridade para o servidor Postfix. Aféctalle ao cifrado (e outros aspectos da seguridade)", - "global_settings_setting_security_ssh_compatibility": "Compromiso entre compatibilidade e seguridade para o servidor SSH. Aféctalle ao cifrado (e outros aspectos da seguridade)", - "global_settings_setting_security_password_user_strength": "Fortaleza do contrasinal da usuaria", - "global_settings_setting_security_password_admin_strength": "Fortaleza do contrasinal de Admin", - "global_settings_setting_security_nginx_compatibility": "Compromiso entre compatiblidade e seguridade para o servidor NGINX. Afecta ao cifrado (e outros aspectos relacionados coa seguridade)", - "global_settings_setting_pop3_enabled": "Activar protocolo POP3 no servidor de email", "global_settings_reset_success": "Fíxose copia de apoio dos axustes en {path}", "global_settings_key_doesnt_exists": "O axuste '{settings_key}' non existe nos axustes globais, podes ver os valores dispoñibles executando 'yunohost settings list'", "global_settings_cant_write_settings": "Non se gardou o ficheiro de configuración, razón: {reason}", @@ -336,11 +327,9 @@ "good_practices_about_user_password": "Vas definir o novo contrasinal de usuaria. O contrasinal debe ter 8 caracteres como mínimo—aínda que se recomenda utilizar un máis longo (ex. unha frase de paso) e/ou utilizar caracteres variados (maiúsculas, minúsculas, números e caracteres especiais).", "good_practices_about_admin_password": "Vas definir o novo contrasinal de administración. O contrasinal debe ter 8 caracteres como mínimo—aínda que se recomenda utilizar un máis longo (ex. unha frase de paso) e/ou utilizar caracteres variados (maiúsculas, minúsculas, números e caracteres especiais).", "global_settings_unknown_type": "Situación non agardada, o axuste {setting} semella ter o tipo {unknown_type} pero non é un valor soportado polo sistema.", - "global_settings_setting_backup_compress_tar_archives": "Ao crear novas copias de apoio, comprime os arquivos (.tar.gz) en lugar de non facelo (.tar). Nota: activando esta opción creas arquivos máis lixeiros, mais o procedemento da primeira copia será significativamente máis longo e esixente coa CPU.", "global_settings_setting_smtp_relay_password": "Contrasinal no repetidor SMTP", "global_settings_setting_smtp_relay_user": "Conta de usuaria no repetidor SMTP", "global_settings_setting_smtp_relay_port": "Porto do repetidor SMTP", - "global_settings_setting_smtp_relay_host": "Servidor repetidor SMTP para enviar emails no lugar da túa instancia yunohost. É útil se estás nunha destas situacións: o teu porto 25 está bloqueado polo teu provedor ISP u VPN, se tes unha IP residencial nunha lista DUHL, se non podes configurar DNS inversa ou se este servidor non ten conexión directa a internet e queres utilizar outro para enviar os emails.", "group_updated": "Grupo '{group}' actualizado", "group_unknown": "Grupo descoñecido '{group}'", "group_deletion_failed": "Non se eliminou o grupo '{group}': {error}", @@ -349,8 +338,6 @@ "group_cannot_edit_primary_group": "O grupo '{group}' non se pode editar manualmente. É o grupo primario que contén só a unha usuaria concreta.", "group_cannot_edit_visitors": "O grupo 'visitors' non se pode editar manualmente. É un grupo especial que representa a tódas visitantes anónimas", "group_cannot_edit_all_users": "O grupo 'all_users' non se pode editar manualmente. É un grupo especial que contén tódalas usuarias rexistradas en YunoHost", - "global_settings_setting_security_webadmin_allowlist": "Enderezos IP con permiso para acceder á webadmin. Separados por vírgulas.", - "global_settings_setting_security_webadmin_allowlist_enabled": "Permitir que só algúns IPs accedan á webadmin.", "disk_space_not_sufficient_update": "Non hai espazo suficiente no disco para actualizar esta aplicación", "disk_space_not_sufficient_install": "Non queda espazo suficiente no disco para instalar esta aplicación", "log_help_to_get_log": "Para ver o rexistro completo da operación '{desc}', usa o comando 'yunohost log show {name}'", @@ -543,7 +530,6 @@ "invalid_password": "Contrasinal non válido", "ldap_server_is_down_restart_it": "O servidor LDAP está caído, intenta reinicialo...", "ldap_server_down": "Non se chegou ao servidor LDAP", - "global_settings_setting_security_experimental_enabled": "Activar características de seguridade experimentais (non actives isto se non sabes o que estás a facer!)", "yunohost_postinstall_end_tip": "Post-install completada! Para rematar a configuración considera:\n- engadir unha primeira usuaria na sección 'Usuarias' na webadmin (ou 'yunohost user create ' na liña de comandos);\n- diagnosticar potenciais problemas na sección 'Diagnóstico' na webadmin (ou 'yunohost diagnosis run' na liña de comandos);\n- ler 'Rematando a configuración' e 'Coñece YunoHost' na documentación da administración: https://yunohost.org/admindoc.", "yunohost_not_installed": "YunoHost non está instalado correctamente. Executa 'yunohost tools postinstall'", "yunohost_installing": "Instalando YunoHost...", @@ -592,7 +578,6 @@ "service_enabled": "O servizo '{service}' vai ser iniciado automáticamente no inicio do sistema.", "diagnosis_apps_allgood": "Tódalas apps instaladas respectan as prácticas básicas de empaquetado", "diagnosis_apps_bad_quality": "Esta aplicación está actualmente marcada como estragada no catálogo de aplicacións de YunoHost. Podería ser un problema temporal mentras as mantedoras intentan arranxar o problema. Ata ese momento a actualización desta app está desactivada.", - "global_settings_setting_security_nginx_redirect_to_https": "Redirixir peticións HTTP a HTTPs por defecto (NON DESACTIVAR ISTO a non ser que realmente saibas o que fas!)", "log_user_import": "Importar usuarias", "user_import_failed": "A operación de importación de usuarias fracasou", "user_import_missing_columns": "Faltan as seguintes columnas: {columns}", @@ -675,7 +660,6 @@ "migration_description_0021_migrate_to_bullseye": "Actualizar o sistema a Debian Bullseye e YunoHost 11.x", "migration_0021_system_not_fully_up_to_date": "O teu sistema non está completamente actualizado. Fai unha actualización normal antes de executar a migración a Bullseye.", "migration_0021_general_warning": "Ten en conta que a migración é unha operación delicada. O equipo de YunoHost fixo todo o que puido para revisalo e probalo, pero aínda así poderían acontecer fallos no sistema ou apps.\n\nAsí as cousas, é recomendable:\n - Facer unha copia de apoio dos datos e apps importantes. Máis info en https://yunohost.org/backup;\n - Ter paciencia unha vez inicias a migración: dependendo da túa conexión a internet e hardware, podería levarlle varias horas completar o proceso.", - "global_settings_setting_security_ssh_password_authentication": "Permitir autenticación con contrasinal para SSH", "tools_upgrade_failed": "Non se actualizaron os paquetes: {packages_list}", "migration_0023_not_enough_space": "Crear espazo suficiente en {path} para realizar a migración.", "migration_0023_postgresql_11_not_installed": "PostgreSQL non estaba instalado no sistema. Nada que facer.", @@ -684,5 +668,20 @@ "migration_description_0023_postgresql_11_to_13": "Migrar bases de datos de PostgreSQL 11 a 13", "service_description_postgresql": "Almacena datos da app (Base datos SQL)", "tools_upgrade": "Actualizando paquetes do sistema", - "domain_config_default_app": "App por defecto" + "domain_config_default_app": "App por defecto", + "global_settings_setting_backup_compress_tar_archives_help": "Ao crear novas copias de apoio, comprime os arquivos (.tar.gz) en lugar de non facelo (.tar). Nota: activando esta opción creas arquivos máis lixeiros, mais o procedemento da primeira copia será significativamente máis longo e esixente coa CPU.", + "global_settings_setting_security_experimental_enabled_help": "Activar características de seguridade experimentais (non actives isto se non sabes o que estás a facer!)", + "global_settings_setting_nginx_compatibility_help": "Compromiso entre compatiblidade e seguridade para o servidor NGINX. Afecta ao cifrado (e outros aspectos relacionados coa seguridade)", + "global_settings_setting_nginx_redirect_to_https_help": "Redirixir peticións HTTP a HTTPs por defecto (NON DESACTIVAR ISTO a non ser que realmente saibas o que fas!)", + "global_settings_setting_admin_strength": "Fortaleza do contrasinal de Admin", + "global_settings_setting_user_strength": "Fortaleza do contrasinal da usuaria", + "global_settings_setting_postfix_compatibility_help": "Compromiso entre compatibilidade e seguridade para o servidor Postfix. Aféctalle ao cifrado (e outros aspectos da seguridade)", + "global_settings_setting_ssh_compatibility_help": "Compromiso entre compatibilidade e seguridade para o servidor SSH. Aféctalle ao cifrado (e outros aspectos da seguridade)", + "global_settings_setting_ssh_password_authentication_help": "Permitir autenticación con contrasinal para SSH", + "global_settings_setting_ssh_port": "Porto SSH", + "global_settings_setting_webadmin_allowlist_help": "Enderezos IP con permiso para acceder á webadmin. Separados por vírgulas.", + "global_settings_setting_webadmin_allowlist_enabled_help": "Permitir que só algúns IPs accedan á webadmin.", + "global_settings_setting_ssh_allow_deprecated_dsa_hostkey_help": "Permitir o uso de DSA hostkey (en desuso) para a configuración do demoño SSH", + "global_settings_setting_smtp_allow_ipv6_help": "Permitir o uso de IPv6 para recibir e enviar emais", + "global_settings_setting_smtp_relay_enabled_help": "Servidor repetidor SMTP para enviar emails no lugar da túa instancia yunohost. É útil se estás nunha destas situacións: o teu porto 25 está bloqueado polo teu provedor ISP u VPN, se tes unha IP residencial nunha lista DUHL, se non podes configurar DNS inversa ou se este servidor non ten conexión directa a internet e queres utilizar outro para enviar os emails." } \ No newline at end of file diff --git a/locales/it.json b/locales/it.json index 844b756ea..a6b341ead 100644 --- a/locales/it.json +++ b/locales/it.json @@ -232,18 +232,12 @@ "global_settings_key_doesnt_exists": "La chiave '{settings_key}' non esiste nelle impostazioni globali, puoi vedere tutte le chiavi disponibili eseguendo 'yunohost settings list'", "global_settings_reset_success": "Le impostazioni precedenti sono state salvate in {path}", "already_up_to_date": "Niente da fare. Tutto è già aggiornato.", - "global_settings_setting_security_nginx_compatibility": "Bilanciamento tra compatibilità e sicurezza per il server web NGIX. Riguarda gli algoritmi di cifratura (e altri aspetti legati alla sicurezza)", - "global_settings_setting_security_password_admin_strength": "Complessità della password di amministratore", - "global_settings_setting_security_password_user_strength": "Complessità della password utente", - "global_settings_setting_security_ssh_compatibility": "Bilanciamento tra compatibilità e sicurezza per il server SSH. Riguarda gli algoritmi di cifratura (e altri aspetti legati alla sicurezza)", "global_settings_unknown_setting_from_settings_file": "Chiave sconosciuta nelle impostazioni: '{setting_key}', scartata e salvata in /etc/yunohost/settings-unknown.json", - "global_settings_setting_service_ssh_allow_deprecated_dsa_hostkey": "Consenti l'uso del hostkey DSA (deprecato) per la configurazione del demone SSH", "global_settings_unknown_type": "Situazione inaspettata, l'impostazione {setting} sembra essere di tipo {unknown_type} ma non è un tipo supportato dal sistema.", "good_practices_about_admin_password": "Stai per impostare una nuova password di amministratore. La password deve essere almeno di 8 caratteri - anche se è buona pratica utilizzare password più lunghe (es. una frase, una serie di parole) e/o utilizzare vari tipi di caratteri (maiuscole, minuscole, numeri e simboli).", "log_corrupted_md_file": "Il file dei metadati YAML associato con i registri è danneggiato: '{md_file}'\nErrore: {error}", "log_link_to_log": "Registro completo di questa operazione: '{desc}'", "log_help_to_get_log": "Per vedere il registro dell'operazione '{desc}', usa il comando 'yunohost log show {name}'", - "global_settings_setting_security_postfix_compatibility": "Bilanciamento tra compatibilità e sicurezza per il server Postfix. Riguarda gli algoritmi di cifratura (e altri aspetti legati alla sicurezza)", "log_link_to_failed_log": "Impossibile completare l'operazione '{desc}'! Per ricevere aiuto, per favore fornisci il registro completo dell'operazione cliccando qui", "log_help_to_get_failed_log": "L'operazione '{desc}' non può essere completata. Per ottenere aiuto, per favore condividi il registro completo dell'operazione utilizzando il comando 'yunohost log share {name}'", "log_does_exists": "Non esiste nessun registro delle operazioni chiamato '{log}', usa 'yunohost log list' per vedere tutti i registri delle operazioni disponibili", @@ -506,13 +500,9 @@ "group_already_exist_on_system_but_removing_it": "Il gruppo {group} esiste già tra i gruppi di sistema, ma YunoHost lo cancellerà...", "group_already_exist_on_system": "Il gruppo {group} esiste già tra i gruppi di sistema", "group_already_exist": "Il gruppo {group} esiste già", - "global_settings_setting_backup_compress_tar_archives": "Quando creo nuovi backup, usa un archivio (.tar.gz) al posto di un archivio non compresso (.tar). NB: abilitare quest'opzione significa create backup più leggeri, ma la procedura durerà di più e il carico CPU sarà maggiore.", "global_settings_setting_smtp_relay_password": "Password del relay SMTP", "global_settings_setting_smtp_relay_user": "User account del relay SMTP", "global_settings_setting_smtp_relay_port": "Porta del relay SMTP", - "global_settings_setting_smtp_relay_host": "Utilizza SMTP relay per inviare mail al posto di questa instanza yunohost. Utile se sei in una di queste situazioni: la tua porta 25 è bloccata dal tuo provider ISP o VPS; hai un IP residenziale listato su DUHL; non sei puoi configurare il DNS inverso; oppure questo server non è direttamente esposto a Internet e vuoi usarne un'altro per spedire email.", - "global_settings_setting_smtp_allow_ipv6": "Permetti l'utilizzo di IPv6 per ricevere e inviare mail", - "global_settings_setting_pop3_enabled": "Abilita il protocollo POP3 per il server mail", "dyndns_provider_unreachable": "Incapace di raggiungere il provider DynDNS {provider}: o il tuo YunoHost non è connesso ad internet o il server dynette è down.", "dpkg_lock_not_available": "Impossibile eseguire il comando in questo momento perché un altro programma sta bloccando dpkg (il package manager di sistema)", "domain_cannot_remove_main_add_new_one": "Non puoi rimuovere '{domain}' visto che è il dominio principale nonché il tuo unico dominio, devi prima aggiungere un altro dominio eseguendo 'yunohost domain add ', impostarlo come dominio principale con 'yunohost domain main-domain n ', e solo allora potrai rimuovere il dominio '{domain}' eseguendo 'yunohost domain remove {domain}'.'", @@ -574,20 +564,16 @@ "migration_ldap_backup_before_migration": "Sto generando il backup del database LDAP e delle impostazioni delle app prima di effettuare la migrazione.", "log_backup_create": "Crea un archivio backup", "global_settings_setting_ssowat_panel_overlay_enabled": "Abilita il pannello sovrapposto SSOwat", - "global_settings_setting_security_ssh_port": "Porta SSH", "diagnosis_sshd_config_inconsistent_details": "Esegui yunohost settings set security.ssh.port -v PORTA_SSH per definire la porta SSH, e controlla con yunohost tools regen-conf ssh --dry-run --with-diff, poi yunohost tools regen-conf ssh --force per resettare la tua configurazione con le raccomandazioni YunoHost.", "diagnosis_sshd_config_inconsistent": "Sembra che la porta SSH sia stata modificata manualmente in /etc/ssh/sshd_config: A partire da YunoHost 4.2, una nuova configurazione globale 'security.ssh.port' è disponibile per evitare di modificare manualmente la configurazione.", "diagnosis_sshd_config_insecure": "Sembra che la configurazione SSH sia stata modificata manualmente, ed non è sicuro dato che non contiene le direttive 'AllowGroups' o 'Allowusers' che limitano l'accesso agli utenti autorizzati.", "backup_create_size_estimation": "L'archivio conterrà circa {size} di dati.", "app_restore_script_failed": "C'è stato un errore all'interno dello script di recupero", - "global_settings_setting_security_webadmin_allowlist": "Indirizzi IP con il permesso di accedere al webadmin, separati da virgola.", - "global_settings_setting_security_webadmin_allowlist_enabled": "Permetti solo ad alcuni IP di accedere al webadmin.", "disk_space_not_sufficient_update": "Non c'è abbastanza spazio libero per aggiornare questa applicazione", "disk_space_not_sufficient_install": "Non c'è abbastanza spazio libero per installare questa applicazione", "app_config_unable_to_apply": "Applicazione dei valori nel pannello di configurazione non riuscita.", "app_config_unable_to_read": "Lettura dei valori nel pannello di configurazione non riuscita.", "diagnosis_apps_issue": "È stato rilevato un errore per l’app {app}", - "global_settings_setting_security_nginx_redirect_to_https": "Reindirizza richieste HTTP a HTTPs di default (NON DISABILITARE a meno che tu non sappia veramente bene cosa stai facendo!)", "diagnosis_http_special_use_tld": "Il dominio {domain} è basato su un dominio di primo livello (TLD) dall’uso speciale, come .local o .test, perciò non è previsto che sia esposto al di fuori della rete locale.", "domain_dns_conf_special_use_tld": "Questo dominio è basato su un dominio di primo livello (TLD) dall’uso speciale, come .local o .test, perciò non è previsto abbia reali record DNS.", "domain_dns_push_not_applicable": "La configurazione automatica del DNS non è applicabile al dominio {domain}. Dovresti configurare i tuoi record DNS manualmente, seguendo la documentazione su https://yunohost.org/dns_config.", @@ -615,7 +601,6 @@ "diagnosis_apps_allgood": "Tutte le applicazioni installate rispettano le pratiche di packaging di base", "config_apply_failed": "L’applicazione della nuova configurazione è fallita: {error}", "diagnosis_apps_outdated_ynh_requirement": "La versione installata di quest’app richiede esclusivamente YunoHost >= 2.x, che tendenzialmente significa che non è aggiornata secondo le pratiche di packaging raccomandate. Dovresti proprio considerare di aggiornarla.", - "global_settings_setting_security_experimental_enabled": "Abilita funzionalità di sicurezza sperimentali (non abilitare se non sai cosa stai facendo!)", "invalid_number_min": "Deve essere più grande di {min}", "invalid_number_max": "Deve essere meno di {max}", "log_app_config_set": "Applica la configurazione all’app '{}'", @@ -659,5 +644,19 @@ "user_import_bad_line": "Linea errata {line}: {details}", "config_validate_url": "È necessario inserire un URL web valido", "ldap_server_down": "Impossibile raggiungere il server LDAP", - "ldap_server_is_down_restart_it": "Il servizio LDAP è down, prova a riavviarlo…" + "ldap_server_is_down_restart_it": "Il servizio LDAP è down, prova a riavviarlo…", + "global_settings_setting_backup_compress_tar_archives_help": "Quando creo nuovi backup, usa un archivio (.tar.gz) al posto di un archivio non compresso (.tar). NB: abilitare quest'opzione significa create backup più leggeri, ma la procedura durerà di più e il carico CPU sarà maggiore.", + "global_settings_setting_security_experimental_enabled_help": "Abilita funzionalità di sicurezza sperimentali (non abilitare se non sai cosa stai facendo!)", + "global_settings_setting_nginx_compatibility_help": "Bilanciamento tra compatibilità e sicurezza per il server web NGIX. Riguarda gli algoritmi di cifratura (e altri aspetti legati alla sicurezza)", + "global_settings_setting_nginx_redirect_to_https_help": "Reindirizza richieste HTTP a HTTPs di default (NON DISABILITARE a meno che tu non sappia veramente bene cosa stai facendo!)", + "global_settings_setting_admin_strength": "Complessità della password di amministratore", + "global_settings_setting_user_strength": "Complessità della password utente", + "global_settings_setting_postfix_compatibility_help": "Bilanciamento tra compatibilità e sicurezza per il server Postfix. Riguarda gli algoritmi di cifratura (e altri aspetti legati alla sicurezza)", + "global_settings_setting_ssh_compatibility_help": "Bilanciamento tra compatibilità e sicurezza per il server SSH. Riguarda gli algoritmi di cifratura (e altri aspetti legati alla sicurezza)", + "global_settings_setting_ssh_port": "Porta SSH", + "global_settings_setting_webadmin_allowlist_help": "Indirizzi IP con il permesso di accedere al webadmin, separati da virgola.", + "global_settings_setting_webadmin_allowlist_enabled_help": "Permetti solo ad alcuni IP di accedere al webadmin.", + "global_settings_setting_ssh_allow_deprecated_dsa_hostkey_help": "Consenti l'uso del hostkey DSA (deprecato) per la configurazione del demone SSH", + "global_settings_setting_smtp_allow_ipv6_help": "Permetti l'utilizzo di IPv6 per ricevere e inviare mail", + "global_settings_setting_smtp_relay_enabled_help": "Utilizza SMTP relay per inviare mail al posto di questa instanza yunohost. Utile se sei in una di queste situazioni: la tua porta 25 è bloccata dal tuo provider ISP o VPS; hai un IP residenziale listato su DUHL; non sei puoi configurare il DNS inverso; oppure questo server non è direttamente esposto a Internet e vuoi usarne un'altro per spedire email." } \ No newline at end of file diff --git a/locales/kab.json b/locales/kab.json index 5daa7cef0..99edca7ad 100644 --- a/locales/kab.json +++ b/locales/kab.json @@ -11,4 +11,4 @@ "diagnosis_description_dnsrecords": "Ikalasen DNS", "diagnosis_description_web": "Réseau", "domain_created": "Taɣult tettwarna" -} +} \ No newline at end of file diff --git a/locales/nb_NO.json b/locales/nb_NO.json index e81d3af05..f6109e8bf 100644 --- a/locales/nb_NO.json +++ b/locales/nb_NO.json @@ -86,9 +86,7 @@ "dyndns_key_generating": "Oppretter DNS-nøkkel… Dette kan ta en stund.", "dyndns_no_domain_registered": "Inget domene registrert med DynDNS", "dyndns_registered": "DynDNS-domene registrert", - "global_settings_setting_security_password_admin_strength": "Admin-passordets styrke", "dyndns_registration_failed": "Kunne ikke registrere DynDNS-domene: {error}", - "global_settings_setting_security_password_user_strength": "Brukerpassordets styrke", "log_backup_restore_app": "Gjenopprett '{}' fra sikkerhetskopiarkiv", "log_remove_on_failed_install": "Fjern '{}' etter mislykket installasjon", "log_selfsigned_cert_install": "Installer selvsignert sertifikat på '{}'-domenet", @@ -115,5 +113,7 @@ "log_help_to_get_log": "For å vise loggen for operasjonen '{desc}', bruk kommandoen 'yunohost log show {name}'", "log_user_create": "Legg til '{}' bruker", "app_change_url_success": "{app} nettadressen er nå {domain}{path}", - "app_install_failed": "Kunne ikke installere {app}: {error}" + "app_install_failed": "Kunne ikke installere {app}: {error}", + "global_settings_setting_admin_strength": "Admin-passordets styrke", + "global_settings_setting_user_strength": "Brukerpassordets styrke" } \ No newline at end of file diff --git a/locales/oc.json b/locales/oc.json index a6afa32e6..857ab09cc 100644 --- a/locales/oc.json +++ b/locales/oc.json @@ -293,8 +293,6 @@ "backup_mount_archive_for_restore": "Preparacion de l’archiu per restauracion...", "dyndns_could_not_check_available": "Verificacion impossibla de la disponibilitat de {domain} sus {provider}.", "file_does_not_exist": "Lo camin {path} existís pas.", - "global_settings_setting_security_password_admin_strength": "Fòrça del senhal administrator", - "global_settings_setting_security_password_user_strength": "Fòrça del senhal utilizaire", "root_password_replaced_by_admin_password": "Lo senhal root es estat remplaçat pel senhal administrator.", "service_restarted": "Lo servici '{service}' es estat reaviat", "admin_password_too_long": "Causissètz un senhal d’almens 127 caractèrs", @@ -308,7 +306,6 @@ "log_regen_conf": "Regenerar las configuracions del sistèma « {} »", "service_reloaded_or_restarted": "Lo servici « {service} » es estat recargat o reaviat", "dpkg_is_broken": "Podètz pas far aquò pel moment perque dpkg/APT (los gestionaris de paquets del sistèma) sembla èsser mal configurat… Podètz ensajar de solucionar aquò en vos connectar via SSH e en executar « sudo dpkg --configure -a ».", - "global_settings_setting_service_ssh_allow_deprecated_dsa_hostkey": "Autorizar l’utilizacion de la clau òst DSA (obsolèta) per la configuracion del servici SSH", "hook_json_return_error": "Fracàs de la lectura del retorn de l’script {path}. Error : {msg}. Contengut brut : {raw_content}", "pattern_password_app": "O planhèm, los senhals devon pas conténer los caractèrs seguents : {forbidden_chars}", "regenconf_file_backed_up": "Lo fichièr de configuracion « {conf} » es estat salvagardat dins « {backup} »", @@ -325,9 +322,6 @@ "regenconf_dry_pending_applying": "Verificacion de la configuracion que seriá estada aplicada a la categoria « {category} »…", "regenconf_failed": "Regeneracion impossibla de la configuracion per la(s) categoria(s) : {categories}", "regenconf_pending_applying": "Aplicacion de la configuracion en espèra per la categoria « {category} »…", - "global_settings_setting_security_nginx_compatibility": "Solucion de compromés entre compatibilitat e seguretat pel servidor web NGINX Afècta los criptografs (e d’autres aspèctes ligats amb la seguretat)", - "global_settings_setting_security_ssh_compatibility": "Solucion de compromés entre compatibilitat e seguretat pel servidor SSH. Afècta los criptografs (e d’autres aspèctes ligats amb la seguretat)", - "global_settings_setting_security_postfix_compatibility": "Solucion de compromés entre compatibilitat e seguretat pel servidor Postfix. Afècta los criptografs (e d’autres aspèctes ligats amb la seguretat)", "service_reload_failed": "Impossible de recargar lo servici « {service} »\n\nJornal d’audit recent : {logs}", "service_restart_failed": "Impossible de reaviar lo servici « {service} »\n\nJornal d’audit recent : {logs}", "service_reload_or_restart_failed": "Impossible de recargar o reaviar lo servici « {service} »\n\nJornal d’audit recent : {logs}", @@ -453,7 +447,6 @@ "diagnosis_ip_broken_resolvconf": "La resolucion del nom de domeni sembla copada sul servidor, poiriá èsser ligada al fait que /etc/resolv.conf manda pas a 127.0.0.1.", "diagnosis_ip_weird_resolvconf": "La resolucion del nom de domeni sembla foncionar, mas sembla qu’utiilizatz un fichièr /etc/resolv.conf personalizat.", "diagnosis_diskusage_verylow": "Lo lòc d’emmagazinatge {mountpoint} (sul periferic {device}) a solament {free} ({free_percent}%). Deuriatz considerar de liberar un pauc d’espaci.", - "global_settings_setting_pop3_enabled": "Activar lo protocòl POP3 pel servidor de corrièr", "diagnosis_diskusage_ok": "Lo lòc d’emmagazinatge {mountpoint} (sul periferic {device}) a encara {free} ({free_percent}%) de liure !", "diagnosis_swap_none": "Lo sistèma a pas cap de memòria d’escambi. Auriatz de considerar d’ajustar almens {recommended} d’escambi per evitar las situacions ont lo sistèma manca de memòria.", "diagnosis_swap_notsomuch": "Lo sistèma a solament {total} de memòria d’escambi. Auriatz de considerar d’ajustar almens {recommended} d’escambi per evitar las situacions ont lo sistèma manca de memòria.", @@ -488,5 +481,11 @@ "diagnosis_domain_not_found_details": "Lo domeni {domain} existís pas a la basa de donadas WHOIS o a expirat !", "diagnosis_domain_expiration_not_found": "Impossible de verificar la data d’expiracion d’unes domenis", "backup_create_size_estimation": "L’archiu contendrà apr’aquí {size} de donadas.", - "app_restore_script_failed": "Una error s’es producha a l’interior del script de restauracion de l’aplicacion" + "app_restore_script_failed": "Una error s’es producha a l’interior del script de restauracion de l’aplicacion", + "global_settings_setting_nginx_compatibility_help": "Solucion de compromés entre compatibilitat e seguretat pel servidor web NGINX Afècta los criptografs (e d’autres aspèctes ligats amb la seguretat)", + "global_settings_setting_admin_strength": "Fòrça del senhal administrator", + "global_settings_setting_user_strength": "Fòrça del senhal utilizaire", + "global_settings_setting_postfix_compatibility_help": "Solucion de compromés entre compatibilitat e seguretat pel servidor Postfix. Afècta los criptografs (e d’autres aspèctes ligats amb la seguretat)", + "global_settings_setting_ssh_compatibility_help": "Solucion de compromés entre compatibilitat e seguretat pel servidor SSH. Afècta los criptografs (e d’autres aspèctes ligats amb la seguretat)", + "global_settings_setting_ssh_allow_deprecated_dsa_hostkey_help": "Autorizar l’utilizacion de la clau òst DSA (obsolèta) per la configuracion del servici SSH" } \ No newline at end of file diff --git a/locales/ru.json b/locales/ru.json index 1546c4d6e..b3042c82e 100644 --- a/locales/ru.json +++ b/locales/ru.json @@ -238,7 +238,6 @@ "regenconf_file_removed": "Файл конфигурации '{conf}' удален", "permission_not_found": "Разрешение '{permission}' не найдено", "group_cannot_edit_all_users": "Группа 'all_users' не может быть отредактирована вручную. Это специальная группа, предназначенная для всех пользователей, зарегистрированных в YunoHost", - "global_settings_setting_smtp_allow_ipv6": "Разрешить использование IPv6 для получения и отправки почты", "log_dyndns_subscribe": "Подписаться на субдомен YunoHost '{}'", "pattern_firstname": "Должно быть настоящее имя", "migrations_pending_cant_rerun": "Эти миграции еще не завершены, поэтому не могут быть запущены снова: {ids}", @@ -269,8 +268,6 @@ "group_cannot_be_deleted": "Группа {group} не может быть удалена вручную.", "log_app_config_set": "Примените конфигурацию приложения '{}'", "log_backup_restore_app": "Восстановление '{}' из резервной копии", - "global_settings_setting_security_webadmin_allowlist": "IP-адреса, разрешенные для доступа к веб-интерфейсу администратора. Разделенные запятыми.", - "global_settings_setting_security_webadmin_allowlist_enabled": "Разрешите доступ к веб-интерфейсу администратора только некоторым IP-адресам.", "log_domain_remove": "Удалить домен '{}' из конфигурации системы", "user_import_success": "Пользователи успешно импортированы", "group_user_already_in_group": "Пользователь {user} уже входит в группу {group}", @@ -284,7 +281,6 @@ "diagnosis_sshd_config_inconsistent_details": "Пожалуйста, выполните yunohost settings set security.ssh.port -v YOUR_SSH_PORT, чтобы определить порт SSH, и проверьте yunohost tools regen-conf ssh --dry-run --with-diff и yunohost tools regen-conf ssh --force, чтобы сбросить ваш conf в соответствии с рекомендациями YunoHost.", "log_domain_main_domain": "Сделать '{}' основным доменом", "diagnosis_sshd_config_insecure": "Похоже, что конфигурация SSH была изменена вручную, и она небезопасна, поскольку не содержит директив 'AllowGroups' или 'AllowUsers' для ограничения доступа авторизованных пользователей.", - "global_settings_setting_security_ssh_port": "SSH порт", "group_already_exist_on_system": "Группа {group} уже существует в системных группах", "group_already_exist_on_system_but_removing_it": "Группа {group} уже существует в системных группах, но YunoHost удалит ее...", "group_unknown": "Группа '{group}' неизвестна", @@ -303,7 +299,6 @@ "regenconf_failed": "Не удалось восстановить конфигурацию для категории(й): {categories}", "diagnosis_services_conf_broken": "Конфигурация нарушена для службы {service}!", "diagnosis_sshd_config_inconsistent": "Похоже, что порт SSH был вручную изменен в /etc/ssh/sshd_config. Начиная с версии YunoHost 4.2, доступен новый глобальный параметр 'security.ssh.port', позволяющий избежать ручного редактирования конфигурации.", - "global_settings_setting_service_ssh_allow_deprecated_dsa_hostkey": "Разрешить использование (устаревшего) ключа хоста DSA для конфигурации демона SSH", "hook_exec_not_terminated": "Скрипт не завершился должным образом: {path}", "ip6tables_unavailable": "Вы не можете играть с ip6tables здесь. Либо Вы находитесь в контейнере, либо ваше ядро это не поддерживает", "iptables_unavailable": "Вы не можете играть с ip6tables здесь. Либо Вы находитесь в контейнере, либо ваше ядро это не поддерживает", @@ -334,5 +329,10 @@ "log_app_remove": "Удалите приложение '{}'", "not_enough_disk_space": "Недостаточно свободного места в '{путь}'", "pattern_email_forward": "Должен быть корректный адрес электронной почты, символ '+' допустим (например, someone+tag@example.com)", - "permission_deletion_failed": "Не удалось удалить разрешение '{permission}': {error}" -} + "permission_deletion_failed": "Не удалось удалить разрешение '{permission}': {error}", + "global_settings_setting_ssh_port": "SSH порт", + "global_settings_setting_webadmin_allowlist_help": "IP-адреса, разрешенные для доступа к веб-интерфейсу администратора. Разделенные запятыми.", + "global_settings_setting_webadmin_allowlist_enabled_help": "Разрешите доступ к веб-интерфейсу администратора только некоторым IP-адресам.", + "global_settings_setting_ssh_allow_deprecated_dsa_hostkey_help": "Разрешить использование (устаревшего) ключа хоста DSA для конфигурации демона SSH", + "global_settings_setting_smtp_allow_ipv6_help": "Разрешить использование IPv6 для получения и отправки почты" +} \ No newline at end of file diff --git a/locales/sk.json b/locales/sk.json index ac9d565bc..a681d84e3 100644 --- a/locales/sk.json +++ b/locales/sk.json @@ -212,4 +212,4 @@ "diagnosis_http_could_not_diagnose_details": "Chyba: {error}", "diagnosis_http_hairpinning_issue": "Zdá sa, že Vaša miestna sieť nemá zapnutý NAT hairpinning.", "diagnosis_high_number_auth_failures": "V poslednom čase bol zistený neobvykle vysoký počet neúspešných prihlásení. Uistite sa, či je služba fail2ban spustená a správne nastavená alebo použite vlastný port pre SSH ako je popísané na https://yunohost.org/security." -} +} \ No newline at end of file diff --git a/locales/te.json b/locales/te.json index fa6ac91c8..0f7621dd7 100644 --- a/locales/te.json +++ b/locales/te.json @@ -15,4 +15,4 @@ "app_action_cannot_be_ran_because_required_services_down": "ఈ చర్యను అమలు చేయడానికి ఈ అవసరమైన సేవలు అమలు చేయబడాలి: {services}. కొనసాగడం కొరకు వాటిని పునఃప్రారంభించడానికి ప్రయత్నించండి (మరియు అవి ఎందుకు పనిచేయడం లేదో పరిశోధించవచ్చు).", "app_argument_choice_invalid": "ఆర్గ్యుమెంట్ '{name}' కొరకు చెల్లుబాటు అయ్యే వైల్యూ ఎంచుకోండి: '{value}' అనేది లభ్యం అవుతున్న ఎంపికల్లో ({Choices}) లేదు", "app_argument_password_no_default": "పాస్వర్డ్ ఆర్గ్యుమెంట్ '{name}'ని పార్సింగ్ చేసేటప్పుడు దోషం: భద్రతా కారణం కొరకు పాస్వర్డ్ ఆర్గ్యుమెంట్ డిఫాల్ట్ విలువను కలిగి ఉండరాదు" -} +} \ No newline at end of file diff --git a/locales/uk.json b/locales/uk.json index 9a32a597b..8c5022e3a 100644 --- a/locales/uk.json +++ b/locales/uk.json @@ -241,24 +241,11 @@ "good_practices_about_user_password": "Зараз ви збираєтеся поставити новий пароль користувача. Пароль повинен складатися не менше ніж з 8 символів, але хорошою практикою є використання більш довгого пароля (тобто гасла) і/або використання різних символів (великих, малих, цифр і спеціальних символів).", "good_practices_about_admin_password": "Зараз ви збираєтеся поставити новий пароль адміністрації. Пароль повинен складатися не менше ніж з 8 символів, але хорошою практикою є використання більш довгого пароля (тобто парольного гасла) і/або використання різних символів (великих, малих, цифр і спеціальних символів).", "global_settings_unknown_type": "Несподівана ситуація, налаштування {setting} має тип {unknown_type}, але це не тип, підтримуваний системою.", - "global_settings_setting_backup_compress_tar_archives": "При створенні нових резервних копій стискати архіви (.tar.gz) замість нестислих архівів (.tar). NB: вмикання цієї опції означає створення легших архівів резервних копій, але початкова процедура резервного копіювання буде значно довшою і важчою для CPU.", - "global_settings_setting_security_webadmin_allowlist": "IP-адреси, яким дозволений доступ до вебадміністрації. Через кому.", - "global_settings_setting_security_webadmin_allowlist_enabled": "Дозволити доступ до вебадміністрації тільки деяким IP-адресам.", "global_settings_setting_smtp_relay_password": "Пароль хоста SMTP-ретрансляції", "global_settings_setting_smtp_relay_user": "Обліковий запис користувача SMTP-ретрансляції", "global_settings_setting_smtp_relay_port": "Порт SMTP-ретрансляції", - "global_settings_setting_smtp_relay_host": "Хост SMTP-ретрансляції, який буде використовуватися для надсилання е-пошти замість цього зразка Yunohost. Корисно, якщо ви знаходитеся в одній із цих ситуацій: ваш 25 порт заблокований вашим провайдером або VPS провайдером, у вас є житловий IP в списку DUHL, ви не можете налаштувати зворотний DNS або цей сервер не доступний безпосередньо в Інтернеті і ви хочете використовувати інший сервер для відправки електронних листів.", - "global_settings_setting_smtp_allow_ipv6": "Дозволити використання IPv6 для отримання і надсилання листів е-пошти", "global_settings_setting_ssowat_panel_overlay_enabled": "Увімкнути накладення панелі SSOwat", - "global_settings_setting_service_ssh_allow_deprecated_dsa_hostkey": "Дозволити використання (застарілого) ключа DSA для конфігурації демона SSH", "global_settings_unknown_setting_from_settings_file": "Невідомий ключ в налаштуваннях: '{setting_key}', відхиліть його і збережіть у /etc/yunohost/settings-unknown.json", - "global_settings_setting_security_ssh_port": "SSH-порт", - "global_settings_setting_security_postfix_compatibility": "Компроміс між сумісністю і безпекою для сервера Postfix. Впливає на шифри (і інші аспекти, пов'язані з безпекою)", - "global_settings_setting_security_ssh_compatibility": "Компроміс між сумісністю і безпекою для SSH-сервера. Впливає на шифри (і інші аспекти, пов'язані з безпекою)", - "global_settings_setting_security_password_user_strength": "Надійність пароля користувача", - "global_settings_setting_security_password_admin_strength": "Надійність пароля адміністратора", - "global_settings_setting_security_nginx_compatibility": "Компроміс між сумісністю і безпекою для вебсервера NGINX. Впливає на шифри (і інші аспекти, пов'язані з безпекою)", - "global_settings_setting_pop3_enabled": "Увімкніть протокол POP3 для поштового сервера", "global_settings_reset_success": "Попередні налаштування тепер збережені в {path}", "global_settings_key_doesnt_exists": "Ключ '{settings_key}' не існує в глобальних налаштуваннях, ви можете побачити всі доступні ключі, виконавши команду 'yunohost settings list'", "global_settings_cant_write_settings": "Неможливо зберегти файл налаштувань, причина: {reason}", @@ -598,7 +585,6 @@ "log_user_import": "Імпорт користувачів", "ldap_server_is_down_restart_it": "Службу LDAP вимкнено, спробуйте перезапустити її...", "ldap_server_down": "Не вдається під'єднатися до сервера LDAP", - "global_settings_setting_security_experimental_enabled": "Увімкнути експериментальні функції безпеки (не вмикайте це, якщо ви не знаєте, що робите!)", "diagnosis_apps_deprecated_practices": "Установлена версія цього застосунку все ще використовує деякі надзастарілі практики упакування. Вам дійсно варто подумати про його оновлення.", "diagnosis_apps_outdated_ynh_requirement": "Установлена версія цього застосунку вимагає лише Yunohost >= 2.x, що, як правило, вказує на те, що воно не відповідає сучасним рекомендаційним практикам упакування та порадникам. Вам дійсно варто подумати про його оновлення.", "diagnosis_apps_bad_quality": "Цей застосунок наразі позначено як зламаний у каталозі застосунків YunoHost. Це може бути тимчасовою проблемою, поки організатори намагаються вирішити цю проблему. Тим часом оновлення цього застосунку вимкнено.", @@ -607,7 +593,6 @@ "diagnosis_apps_issue": "Виявлено проблему із застосунком {app}", "diagnosis_apps_allgood": "Усі встановлені застосунки дотримуються основних способів упакування", "diagnosis_high_number_auth_failures": "Останнім часом сталася підозріло велика кількість помилок автентифікації. Ви можете переконатися, що fail2ban працює і правильно налаштований, або скористатися власним портом для SSH, як описано в https://yunohost.org/security.", - "global_settings_setting_security_nginx_redirect_to_https": "Типово переспрямовувати HTTP-запити до HTTP (НЕ ВИМИКАЙТЕ, якщо ви дійсно не знаєте, що робите!)", "app_config_unable_to_apply": "Не вдалося застосувати значення панелі конфігурації.", "app_config_unable_to_read": "Не вдалося розпізнати значення панелі конфігурації.", "config_apply_failed": "Не вдалося застосувати нову конфігурацію: {error}", @@ -675,7 +660,6 @@ "migration_0021_system_not_fully_up_to_date": "Ваша система не повністю оновлена. Будь ласка, виконайте регулярне оновлення перед запуском міграції на Bullseye.", "migration_0021_general_warning": "Будь ласка, зверніть увагу, що ця міграція є делікатною операцією. Команда YunoHost зробила все можливе, щоб перевірити і протестувати її, але міграція все ще може порушити частину системи або її застосунків.\n\nТому рекомендовано:\n - Виконати резервне копіювання всіх важливих даних або застосунків. Подробиці на сайті https://yunohost.org/backup; \n - Наберіться терпіння після запуску міграції: В залежності від вашого з'єднання з Інтернетом і апаратного забезпечення, оновлення може зайняти до декількох годин.", "migration_description_0021_migrate_to_bullseye": "Оновлення системи до Debian Bullseye і YunoHost 11.x", - "global_settings_setting_security_ssh_password_authentication": "Дозволити автентифікацію паролем для SSH", "service_description_postgresql": "Зберігає дані застосунків (база даних SQL)", "domain_config_default_app": "Типовий застосунок", "migration_0023_postgresql_13_not_installed": "PostgreSQL 11 встановлено, але не PostgreSQL 13!? У вашій системі могло статися щось неприємне :(...", @@ -684,5 +668,20 @@ "tools_upgrade_failed": "Не вдалося оновити наступні пакети: {packages_list}", "migration_0023_not_enough_space": "Звільніть достатньо місця в {path} для виконання міграції.", "migration_0023_postgresql_11_not_installed": "PostgreSQL не було встановлено у вашій системі. Нічого робити.", - "migration_description_0022_php73_to_php74_pools": "Перенесення конфігураційних файлів php7.3-fpm 'pool' на php7.4" + "migration_description_0022_php73_to_php74_pools": "Перенесення конфігураційних файлів php7.3-fpm 'pool' на php7.4", + "global_settings_setting_backup_compress_tar_archives_help": "При створенні нових резервних копій стискати архіви (.tar.gz) замість нестислих архівів (.tar). NB: вмикання цієї опції означає створення легших архівів резервних копій, але початкова процедура резервного копіювання буде значно довшою і важчою для CPU.", + "global_settings_setting_security_experimental_enabled_help": "Увімкнути експериментальні функції безпеки (не вмикайте це, якщо ви не знаєте, що робите!)", + "global_settings_setting_nginx_compatibility_help": "Компроміс між сумісністю і безпекою для вебсервера NGINX. Впливає на шифри (і інші аспекти, пов'язані з безпекою)", + "global_settings_setting_nginx_redirect_to_https_help": "Типово переспрямовувати HTTP-запити до HTTP (НЕ ВИМИКАЙТЕ, якщо ви дійсно не знаєте, що робите!)", + "global_settings_setting_admin_strength": "Надійність пароля адміністратора", + "global_settings_setting_user_strength": "Надійність пароля користувача", + "global_settings_setting_postfix_compatibility_help": "Компроміс між сумісністю і безпекою для сервера Postfix. Впливає на шифри (і інші аспекти, пов'язані з безпекою)", + "global_settings_setting_ssh_compatibility_help": "Компроміс між сумісністю і безпекою для SSH-сервера. Впливає на шифри (і інші аспекти, пов'язані з безпекою)", + "global_settings_setting_ssh_password_authentication_help": "Дозволити автентифікацію паролем для SSH", + "global_settings_setting_ssh_port": "SSH-порт", + "global_settings_setting_webadmin_allowlist_help": "IP-адреси, яким дозволений доступ до вебадміністрації. Через кому.", + "global_settings_setting_webadmin_allowlist_enabled_help": "Дозволити доступ до вебадміністрації тільки деяким IP-адресам.", + "global_settings_setting_ssh_allow_deprecated_dsa_hostkey_help": "Дозволити використання (застарілого) ключа DSA для конфігурації демона SSH", + "global_settings_setting_smtp_allow_ipv6_help": "Дозволити використання IPv6 для отримання і надсилання листів е-пошти", + "global_settings_setting_smtp_relay_enabled_help": "Хост SMTP-ретрансляції, який буде використовуватися для надсилання е-пошти замість цього зразка Yunohost. Корисно, якщо ви знаходитеся в одній із цих ситуацій: ваш 25 порт заблокований вашим провайдером або VPS провайдером, у вас є житловий IP в списку DUHL, ви не можете налаштувати зворотний DNS або цей сервер не доступний безпосередньо в Інтернеті і ви хочете використовувати інший сервер для відправки електронних листів." } \ No newline at end of file diff --git a/locales/zh_Hans.json b/locales/zh_Hans.json index 2daf45483..e27a7473c 100644 --- a/locales/zh_Hans.json +++ b/locales/zh_Hans.json @@ -300,21 +300,11 @@ "group_already_exist": "群组{group}已经存在", "good_practices_about_admin_password": "现在，您将设置一个新的管理员密码。 密码至少应包含8个字符。并且出于安全考虑建议使用较长的密码同时尽可能使用各种字符（大写，小写，数字和特殊字符）。", "global_settings_unknown_type": "意外的情况，设置{setting}似乎具有类型 {unknown_type} ，但是系统不支持该类型。", - "global_settings_setting_backup_compress_tar_archives": "创建新备份时，请压缩档案(.tar.gz) ，而不要压缩未压缩的档案(.tar)。注意：启用此选项意味着创建较小的备份存档，但是初始备份过程将明显更长且占用大量CPU。", "global_settings_setting_smtp_relay_password": "SMTP中继主机密码", "global_settings_setting_smtp_relay_user": "SMTP中继用户帐户", "global_settings_setting_smtp_relay_port": "SMTP中继端口", - "global_settings_setting_smtp_allow_ipv6": "允许使用IPv6接收和发送邮件", "global_settings_setting_ssowat_panel_overlay_enabled": "启用SSOwat面板覆盖", - "global_settings_setting_service_ssh_allow_deprecated_dsa_hostkey": "允许使用DSA主机密钥进行SSH守护程序配置（不建议使用）", "global_settings_unknown_setting_from_settings_file": "设置中的未知密钥:'{setting_key}'，将其丢弃并保存在/etc/yunohost/settings-unknown.json中", - "global_settings_setting_security_ssh_port": "SSH端口", - "global_settings_setting_security_postfix_compatibility": "Postfix服务器的兼容性与安全性的权衡。影响密码（以及其他与安全性有关的方面）", - "global_settings_setting_security_ssh_compatibility": "SSH服务器的兼容性与安全性的权衡。影响密码（以及其他与安全性有关的方面）", - "global_settings_setting_security_password_user_strength": "用户密码强度", - "global_settings_setting_security_password_admin_strength": "管理员密码强度", - "global_settings_setting_security_nginx_compatibility": "Web服务器NGINX的兼容性与安全性的权衡，影响密码（以及其他与安全性有关的方面）", - "global_settings_setting_pop3_enabled": "为邮件服务器启用POP3协议", "global_settings_reset_success": "以前的设置现在已经备份到{path}", "global_settings_key_doesnt_exists": "全局设置中不存在键'{settings_key}'，您可以通过运行 'yunohost settings list'来查看所有可用键", "global_settings_cant_write_settings": "无法保存设置文件，原因: {reason}", @@ -455,7 +445,6 @@ "regenconf_up_to_date": "类别'{category}'的配置已经是最新的", "regenconf_file_kept_back": "配置文件'{conf}'预计将被regen-conf（类别{category}）删除，但被保留了下来。", "good_practices_about_user_password": "现在，您将设置一个新的管理员密码。 密码至少应包含8个字符。并且出于安全考虑建议使用较长的密码同时尽可能使用各种字符（大写，小写，数字和特殊字符）", - "global_settings_setting_smtp_relay_host": "使用SMTP中继主机来代替这个YunoHost实例发送邮件。如果你有以下情况，就很有用:你的25端口被你的ISP或VPS提供商封锁，你有一个住宅IP列在DUHL上，你不能配置反向DNS，或者这个服务器没有直接暴露在互联网上，你想使用其他服务器来发送邮件。", "domain_cannot_remove_main_add_new_one": "你不能删除'{domain}'，因为它是主域和你唯一的域，你需要先用'yunohost domain add '添加另一个域，然后用'yunohost domain main-domain -n '设置为主域，然后你可以用'yunohost domain remove {domain}'删除域", "domain_cannot_add_xmpp_upload": "你不能添加以'xmpp-upload.'开头的域名。这种名称是为YunoHost中集成的XMPP上传功能保留的。", "domain_cannot_remove_main": "你不能删除'{domain}'，因为它是主域，你首先需要用'yunohost domain main-domain -n '设置另一个域作为主域；这里是候选域的列表: {other_domains}", @@ -604,5 +593,15 @@ "diagnosis_apps_allgood": "所有已安装的应用程序都遵守基本的打包原则", "diagnosis_apps_deprecated_practices": "此应用程序的安装 版本仍然使用一些超旧的弃用打包原则。推荐您升级它。", "diagnosis_apps_issue": "发现应用{ app } 存在问题", - "diagnosis_description_apps": "应用" + "diagnosis_description_apps": "应用", + "global_settings_setting_backup_compress_tar_archives_help": "创建新备份时，请压缩档案(.tar.gz) ，而不要压缩未压缩的档案(.tar)。注意：启用此选项意味着创建较小的备份存档，但是初始备份过程将明显更长且占用大量CPU。", + "global_settings_setting_nginx_compatibility_help": "Web服务器NGINX的兼容性与安全性的权衡，影响密码（以及其他与安全性有关的方面）", + "global_settings_setting_admin_strength": "管理员密码强度", + "global_settings_setting_user_strength": "用户密码强度", + "global_settings_setting_postfix_compatibility_help": "Postfix服务器的兼容性与安全性的权衡。影响密码（以及其他与安全性有关的方面）", + "global_settings_setting_ssh_compatibility_help": "SSH服务器的兼容性与安全性的权衡。影响密码（以及其他与安全性有关的方面）", + "global_settings_setting_ssh_port": "SSH端口", + "global_settings_setting_ssh_allow_deprecated_dsa_hostkey_help": "允许使用DSA主机密钥进行SSH守护程序配置（不建议使用）", + "global_settings_setting_smtp_allow_ipv6_help": "允许使用IPv6接收和发送邮件", + "global_settings_setting_smtp_relay_enabled_help": "使用SMTP中继主机来代替这个YunoHost实例发送邮件。如果你有以下情况，就很有用:你的25端口被你的ISP或VPS提供商封锁，你有一个住宅IP列在DUHL上，你不能配置反向DNS，或者这个服务器没有直接暴露在互联网上，你想使用其他服务器来发送邮件。" } \ No newline at end of file From 0ed05e221a4e6b04a8152818cfca7c1643edca82 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sat, 6 Aug 2022 12:37:12 +0200 Subject: [PATCH 078/174] i18n: fix weird phrasing for fr translation... --- locales/fr.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/locales/fr.json b/locales/fr.json index a158d8767..a5ee23720 100644 --- a/locales/fr.json +++ b/locales/fr.json @@ -671,12 +671,12 @@ "migration_0023_postgresql_11_not_installed": "PostgreSQL n'a pas été installé sur votre système. Il n'y a rien à faire.", "global_settings_setting_backup_compress_tar_archives_help": "Lors de la création de nouvelles sauvegardes, compresser automatiquement les archives (.tar.gz) au lieu des archives non compressées (.tar). N.B. : activer cette option permet de créer des archives plus légères, mais la procédure de sauvegarde initiale sera significativement plus longues et plus gourmandes en CPU.", "global_settings_setting_security_experimental_enabled_help": "Activer les fonctionnalités de sécurité expérimentales (ne l'activez pas si vous ne savez pas ce que vous faites !)", - "global_settings_setting_nginx_compatibility_help": "Compatibilité versus compromis sécuritaire pour le serveur web Nginx. Affecte les cryptogrammes (et d'autres aspects liés à la sécurité)", + "global_settings_setting_nginx_compatibility_help": "Compromis 'compatibilité versus sécurité' pour le serveur web Nginx. Affecte les cryptogrammes utilisés (et d'autres aspects liés à la sécurité)", "global_settings_setting_nginx_redirect_to_https_help": "Rediriger les requêtes HTTP vers HTTPS par défaut (NE PAS DÉSACTIVER à moins de savoir vraiment ce que vous faites !)", "global_settings_setting_admin_strength": "Qualité du mot de passe administrateur", "global_settings_setting_user_strength": "Qualité du mot de passe de l'utilisateur", - "global_settings_setting_postfix_compatibility_help": "Compatibilité versus compromis sécuritaire pour le serveur Postfix. Affecte les cryptogrammes (et d'autres aspects liés à la sécurité)", - "global_settings_setting_ssh_compatibility_help": "Compatibilité versus compromis sécuritaire pour le serveur SSH. Affecte les cryptogrammes (et d'autres aspects liés à la sécurité)", + "global_settings_setting_postfix_compatibility_help": "Compromis 'compatibilité versus sécurité' pour le serveur Postfix. Affecte les cryptogrammes utilisés (et d'autres aspects liés à la sécurité)", + "global_settings_setting_ssh_compatibility_help": "Compromis 'compatibilité versus sécurité' pour le serveur SSH. Affecte les cryptogrammes utilisés (et d'autres aspects liés à la sécurité)", "global_settings_setting_ssh_password_authentication_help": "Autoriser l'authentification par mot de passe pour SSH", "global_settings_setting_ssh_port": "Port SSH", "global_settings_setting_webadmin_allowlist_help": "Adresses IP autorisées à accéder à la webadmin. Elles doivent être séparées par une virgule.", @@ -684,4 +684,4 @@ "global_settings_setting_ssh_allow_deprecated_dsa_hostkey_help": "Autoriser l'utilisation de la clé hôte DSA (obsolète) pour la configuration du service SSH", "global_settings_setting_smtp_allow_ipv6_help": "Autoriser l'utilisation d'IPv6 pour recevoir et envoyer du courrier", "global_settings_setting_smtp_relay_enabled_help": "Un relais SMTP permet d'envoyer du courrier à la place de cette instance YunoHost. Cela est utile si vous êtes dans l'une de ces situations : le port 25 est bloqué par votre FAI ou par votre fournisseur VPS, vous avez une IP résidentielle répertoriée sur DUHL, vous ne pouvez pas configurer de reverse DNS ou le serveur n'est pas directement accessible depuis Internet et que vous voulez en utiliser un autre pour envoyer des mails." -} \ No newline at end of file +} From 133d8b60c1955a0da54efd8fd9353bf9f8931519 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sat, 6 Aug 2022 13:03:28 +0200 Subject: [PATCH 079/174] global settings: misc naming/ui/ux/i18n improvements --- hooks/conf_regen/15-nginx | 2 +- locales/en.json | 10 +++++----- locales/fr.json | 5 +++-- share/config_global.toml | 11 ++++++----- src/utils/legacy.py | 2 +- 5 files changed, 16 insertions(+), 14 deletions(-) diff --git a/hooks/conf_regen/15-nginx b/hooks/conf_regen/15-nginx index 482784d8d..fe5154cb9 100755 --- a/hooks/conf_regen/15-nginx +++ b/hooks/conf_regen/15-nginx @@ -56,7 +56,7 @@ do_pre_regen() { # install / update plain conf files cp plain/* "$nginx_conf_dir" # remove the panel overlay if this is specified in settings - panel_overlay=$(yunohost settings get 'misc.ssowat.ssowat_panel_overlay_enabled') + panel_overlay=$(yunohost settings get 'misc.portal.ssowat_panel_overlay_enabled') if [ "$panel_overlay" == "false" ] || [ "$panel_overlay" == "False" ]; then echo "#" >"${nginx_conf_dir}/yunohost_panel.conf.inc" fi diff --git a/locales/en.json b/locales/en.json index 6cfab9109..1180415ad 100644 --- a/locales/en.json +++ b/locales/en.json @@ -386,10 +386,10 @@ "global_settings_setting_smtp_allow_ipv6_help": "Allow the use of IPv6 to receive and send mail", "global_settings_setting_smtp_relay_enabled": "Enable SMTP relay", "global_settings_setting_smtp_relay_enabled_help": "Enable the SMTP relay to use in order to send mail instead of this yunohost instance. Useful if you are in one of this situation: your 25 port is blocked by your ISP or VPS provider, you have a residential IP listed on DUHL, you are not able to configure reverse DNS or this server is not directly exposed on the internet and you want use an other one to send mails.", - "global_settings_setting_smtp_relay_host": "Relay host", - "global_settings_setting_smtp_relay_password": "Relay password", - "global_settings_setting_smtp_relay_port": "Relay port", - "global_settings_setting_smtp_relay_user": "Relay user", + "global_settings_setting_smtp_relay_host": "SMTP relay host", + "global_settings_setting_smtp_relay_password": "SMTP relay password", + "global_settings_setting_smtp_relay_port": "SMTP relay port", + "global_settings_setting_smtp_relay_user": "SMTP relay user", "global_settings_setting_ssh_allow_deprecated_dsa_hostkey": "Allow DSA hostkey", "global_settings_setting_ssh_allow_deprecated_dsa_hostkey_help": "Allow the use of (deprecated) DSA hostkey for the SSH daemon configuration", "global_settings_setting_ssh_compatibility": "SSH Compatibility", @@ -397,7 +397,7 @@ "global_settings_setting_ssh_password_authentication": "Password authentication", "global_settings_setting_ssh_password_authentication_help": "Allow password authentication for SSH", "global_settings_setting_ssh_port": "SSH port", - "global_settings_setting_ssowat_panel_overlay_enabled": "SSOwat panel overlay", + "global_settings_setting_ssowat_panel_overlay_enabled": "Enable the small 'YunoHost' portal shortcut square on apps", "global_settings_setting_user_strength": "User password strength", "global_settings_setting_user_strength_help": "These requirements are only enforced when defining the password", "global_settings_setting_webadmin_allowlist": "Webadmin IP allowlist", diff --git a/locales/fr.json b/locales/fr.json index a5ee23720..fd807c8a5 100644 --- a/locales/fr.json +++ b/locales/fr.json @@ -535,12 +535,13 @@ "app_manifest_install_ask_password": "Choisissez un mot de passe administrateur pour cette application", "app_manifest_install_ask_path": "Choisissez le chemin d'URL (après le domaine) où cette application doit être installée", "app_manifest_install_ask_domain": "Choisissez le domaine sur lequel vous souhaitez installer cette application", + "global_settings_setting_smtp_relay_host": "Adresse du relais SMTP", "global_settings_setting_smtp_relay_user": "Compte utilisateur du relais SMTP", "global_settings_setting_smtp_relay_port": "Port du relais SMTP", "diagnosis_package_installed_from_sury_details": "Certains paquets ont été installés par inadvertance à partir d'un dépôt tiers appelé Sury. L'équipe YunoHost a amélioré la stratégie de gestion de ces paquets, mais on s'attend à ce que certaines configurations qui ont installé des applications PHP7.3 tout en étant toujours sur Stretch présentent des incohérences. Pour résoudre cette situation, vous devez essayer d'exécuter la commande suivante : {cmd_to_fix}", "app_argument_password_no_default": "Erreur lors de l'analyse de l'argument de mot de passe '{name}' : l'argument de mot de passe ne peut pas avoir de valeur par défaut pour des raisons de sécurité", "pattern_email_forward": "L'adresse électronique doit être valide, le symbole '+' étant accepté (par exemple : johndoe+yunohost@exemple.com)", - "global_settings_setting_smtp_relay_password": "Mot de passe du relais de l'hôte SMTP", + "global_settings_setting_smtp_relay_password": "Mot de passe du relais SMTP", "diagnosis_package_installed_from_sury": "Des paquets du système devraient être rétrogradé de version", "additional_urls_already_added": "URL supplémentaire '{url}' déjà ajoutée pour la permission '{permission}'", "unknown_main_domain_path": "Domaine ou chemin inconnu pour '{app}'. Vous devez spécifier un domaine et un chemin pour pouvoir spécifier une URL pour l'autorisation.", @@ -562,7 +563,7 @@ "app_restore_script_failed": "Une erreur s'est produite dans le script de restauration de l'application", "restore_backup_too_old": "Cette sauvegarde ne peut pas être restaurée car elle provient d'une version de YunoHost trop ancienne.", "log_backup_create": "Création d'une archive de sauvegarde", - "global_settings_setting_ssowat_panel_overlay_enabled": "Activer la superposition de la vignette SSOwat", + "global_settings_setting_ssowat_panel_overlay_enabled": "Activer la vignette 'YunoHost' (raccourci vers le portail) sur les apps", "migration_ldap_rollback_success": "Système rétabli dans son état initial.", "permission_cant_add_to_all_users": "L'autorisation {permission} ne peut pas être ajoutée à tous les utilisateurs.", "migration_ldap_migration_failed_trying_to_rollback": "Impossible de migrer... tentative de restauration du système.", diff --git a/share/config_global.toml b/share/config_global.toml index 775f02cdf..49a674627 100644 --- a/share/config_global.toml +++ b/share/config_global.toml @@ -43,7 +43,7 @@ name = "Security" default = false [security.nginx] - name = "NGINX" + name = "NGINX (web server)" [security.nginx.nginx_redirect_to_https] type = "boolean" default = true @@ -55,7 +55,7 @@ name = "Security" default = "intermediate" [security.postfix] - name = "Postfix" + name = "Postfix (SMTP email server)" [security.postfix.postfix_compatibility] type = "select" choices.intermediate = "Intermediate (allows TLS 1.2)" @@ -121,12 +121,13 @@ name = "Email" default = "" optional = true visible="smtp_relay_enabled" + help = "" # This is empty string on purpose, otherwise the core automatically set the 'good_practice_admin_password' string here which is not relevant, because the admin is not actually "choosing" the password ... [misc] name = "Other" - [misc.ssowat] - name = "SSOwat" - [misc.ssowat.ssowat_panel_overlay_enabled] + [misc.portal] + name = "User portal" + [misc.portal.ssowat_panel_overlay_enabled] type = "boolean" default = true diff --git a/src/utils/legacy.py b/src/utils/legacy.py index 4742318cb..1ef3c1023 100644 --- a/src/utils/legacy.py +++ b/src/utils/legacy.py @@ -79,7 +79,7 @@ LEGACY_SETTINGS = { "smtp.relay.user": "email.smtp.smtp_relay_user", "smtp.relay.password": "email.smtp.smtp_relay_password", "backup.compress_tar_archives": "misc.backup.backup_compress_tar_archives", - "ssowat.panel_overlay.enabled": "misc.ssowat.ssowat_panel_overlay_enabled", + "ssowat.panel_overlay.enabled": "misc.portal.ssowat_panel_overlay_enabled", "security.webadmin.allowlist.enabled": "security.webadmin.webadmin_allowlist_enabled", "security.webadmin.allowlist": "security.webadmin.webadmin_allowlist", "security.experimental.enabled": "security.experimental.security_experimental_enabled" From 66901e4f73e784c612742c8cec86e31e1586ab37 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sat, 6 Aug 2022 13:05:54 +0200 Subject: [PATCH 080/174] global settings: drop the support old DSA hostkey support --- hooks/conf_regen/03-ssh | 5 ----- locales/en.json | 2 -- share/config_global.toml | 4 ---- src/utils/legacy.py | 1 - 4 files changed, 12 deletions(-) diff --git a/hooks/conf_regen/03-ssh b/hooks/conf_regen/03-ssh index eb548d4f4..832e07015 100755 --- a/hooks/conf_regen/03-ssh +++ b/hooks/conf_regen/03-ssh @@ -14,11 +14,6 @@ do_pre_regen() { ssh_keys=$(ls /etc/ssh/ssh_host_{ed25519,rsa,ecdsa}_key 2>/dev/null || true) - # Support legacy setting (this setting might be disabled by a user during a migration) - if [[ "$(yunohost settings get 'security.ssh.ssh_allow_deprecated_dsa_hostkey')" == "True" ]]; then - ssh_keys="$ssh_keys $(ls /etc/ssh/ssh_host_dsa_key 2>/dev/null || true)" - fi - # Support different strategy for security configurations export compatibility="$(yunohost settings get 'security.ssh.ssh_compatibility')" export port="$(yunohost settings get 'security.ssh.ssh_port')" diff --git a/locales/en.json b/locales/en.json index 1180415ad..dd0361424 100644 --- a/locales/en.json +++ b/locales/en.json @@ -390,8 +390,6 @@ "global_settings_setting_smtp_relay_password": "SMTP relay password", "global_settings_setting_smtp_relay_port": "SMTP relay port", "global_settings_setting_smtp_relay_user": "SMTP relay user", - "global_settings_setting_ssh_allow_deprecated_dsa_hostkey": "Allow DSA hostkey", - "global_settings_setting_ssh_allow_deprecated_dsa_hostkey_help": "Allow the use of (deprecated) DSA hostkey for the SSH daemon configuration", "global_settings_setting_ssh_compatibility": "SSH Compatibility", "global_settings_setting_ssh_compatibility_help": "Compatibility vs. security tradeoff for the SSH server. Affects the ciphers (and other security-related aspects). See https://infosec.mozilla.org/guidelines/openssh for more info.", "global_settings_setting_ssh_password_authentication": "Password authentication", diff --git a/share/config_global.toml b/share/config_global.toml index 49a674627..f64ef65a7 100644 --- a/share/config_global.toml +++ b/share/config_global.toml @@ -38,10 +38,6 @@ name = "Security" type = "boolean" default = true - [security.ssh.ssh_allow_deprecated_dsa_hostkey] - type = "boolean" - default = false - [security.nginx] name = "NGINX (web server)" [security.nginx.nginx_redirect_to_https] diff --git a/src/utils/legacy.py b/src/utils/legacy.py index 1ef3c1023..df6c10025 100644 --- a/src/utils/legacy.py +++ b/src/utils/legacy.py @@ -68,7 +68,6 @@ LEGACY_SETTINGS = { "security.ssh.compatibility": "security.ssh.ssh_compatibility", "security.ssh.port": "security.ssh.ssh_port", "security.ssh.password_authentication": "security.ssh.ssh_password_authentication", - "service.ssh.allow_deprecated_dsa_hostkey": "security.ssh.ssh_allow_deprecated_dsa_hostkey", "security.nginx.redirect_to_https": "security.nginx.nginx_redirect_to_https", "security.nginx.compatibility": "security.nginx.nginx_compatibility", "security.postfix.compatibility": "security.postfix.postfix_compatibility", From 324c03e6ae95457eeccdc7abf1a889394a2ec513 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 9 Aug 2022 16:41:20 +0200 Subject: [PATCH 081/174] Move setting migration to 0025 instead of 0024 because of the new python venv migration --- locales/en.json | 2 +- ...to_configpanel.py => 0025_global_settings_to_configpanel.py} | 0 2 files changed, 1 insertion(+), 1 deletion(-) rename src/migrations/{0024_global_settings_to_configpanel.py => 0025_global_settings_to_configpanel.py} (100%) diff --git a/locales/en.json b/locales/en.json index 7ba471995..6755771aa 100644 --- a/locales/en.json +++ b/locales/en.json @@ -521,8 +521,8 @@ "migration_description_0021_migrate_to_bullseye": "Upgrade the system to Debian Bullseye and YunoHost 11.x", "migration_description_0022_php73_to_php74_pools": "Migrate php7.3-fpm 'pool' conf files to php7.4", "migration_description_0023_postgresql_11_to_13": "Migrate databases from PostgreSQL 11 to 13", - "migration_description_0024_global_settings_to_configpanel": "Migrate legacy global settings nomenclature to the new, modern nomenclature", "migration_description_0024_rebuild_python_venv": "Repair python app after bullseye migration", + "migration_description_0025_global_settings_to_configpanel": "Migrate legacy global settings nomenclature to the new, modern nomenclature", "migration_ldap_backup_before_migration": "Creating a backup of LDAP database and apps settings prior to the actual migration.", "migration_ldap_can_not_backup_before_migration": "The backup of the system could not be completed before the migration failed. Error: {error}", "migration_ldap_migration_failed_trying_to_rollback": "Could not migrate... trying to roll back the system.", diff --git a/src/migrations/0024_global_settings_to_configpanel.py b/src/migrations/0025_global_settings_to_configpanel.py similarity index 100% rename from src/migrations/0024_global_settings_to_configpanel.py rename to src/migrations/0025_global_settings_to_configpanel.py From 899342057d58cc2a0a557de67a6e3e82041de133 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 9 Aug 2022 18:33:38 +0200 Subject: [PATCH 082/174] Rename admin group migration from 24 to 26 (25 gonna be global settings) --- .../{0024_new_admins_group.py => 0026_new_admins_group.py} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename src/migrations/{0024_new_admins_group.py => 0026_new_admins_group.py} (100%) diff --git a/src/migrations/0024_new_admins_group.py b/src/migrations/0026_new_admins_group.py similarity index 100% rename from src/migrations/0024_new_admins_group.py rename to src/migrations/0026_new_admins_group.py From f4cb20f081a1e6cbec23d3770e9ef654a92e50c2 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Thu, 1 Sep 2022 16:19:38 +0200 Subject: [PATCH 083/174] manifestv2: try to fix a bunch of tests --- src/tests/test_apps.py | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/src/tests/test_apps.py b/src/tests/test_apps.py index 4661e54b2..4853817f9 100644 --- a/src/tests/test_apps.py +++ b/src/tests/test_apps.py @@ -220,7 +220,7 @@ def test_legacy_app_manifest_preinstall(): assert "integration" in m assert "install" in m assert m.get("doc") == {} - assert m.get("notifications") == {} + assert m.get["notifications"] == {"pre_install": {}, "pre_upgrade": {}, "post_install": {}, "post_upgrade": {}} def test_manifestv2_app_manifest_preinstall(): @@ -231,11 +231,11 @@ def test_manifestv2_app_manifest_preinstall(): assert "install" in m assert "description" in m assert "doc" in m - assert "This is a dummy description of this app features" in m["doc"]["DESCRIPTION"]["en"] - assert "Ceci est une fausse description des fonctionalités de l'app" in m["doc"]["DESCRIPTION"]["fr"] + assert "This is a dummy description of this app features" in m["doc"]["DESCRIPTION"]["main"]["en"] + assert "Ceci est une fausse description des fonctionalités de l'app" in m["doc"]["DESCRIPTION"]["main"]["fr"] assert "notifications" in m - assert "This is a dummy disclaimer to display prior to the install" in m["notifications"]["pre_install"]["en"] - assert "Ceci est un faux disclaimer à présenter avant l'installation" in m["notifications"]["pre_install"]["fr"] + assert "This is a dummy disclaimer to display prior to the install" in m["notifications"]["pre_install"]["main"]["en"] + assert "Ceci est un faux disclaimer à présenter avant l'installation" in m["notifications"]["pre_install"]["main"]["fr"] def test_manifestv2_app_install_main_domain(): @@ -278,6 +278,8 @@ def test_manifestv2_app_info_postinstall(): def test_manifestv2_app_info_preupgrade(monkeypatch): + manifest = app_manifest(os.path.join(get_test_apps_dir(), "manifestv2_app_ynh")) + from yunohost.app_catalog import _load_apps_catalog as original_load_apps_catalog def custom_load_apps_catalog(*args, **kwargs): @@ -287,7 +289,7 @@ def test_manifestv2_app_info_preupgrade(monkeypatch): "level": 10, "lastUpdate": 999999999, "maintained": True, - "manifest": app_manifest(os.path.join(get_test_apps_dir(), "manifestv2_app_ynh")), + "manifest": manifest, } res["apps"]["manifestv2_app"]["manifest"]["version"] = "99999~ynh1" From 4faeabefa2f415afeaf95fbd6341a2f3f3b441ca Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Thu, 1 Sep 2022 21:51:48 +0200 Subject: [PATCH 084/174] manifestv2: moar test fixes --- helpers/utils | 2 +- src/tests/test_apps.py | 13 +++++++------ src/utils/resources.py | 7 ++++--- 3 files changed, 12 insertions(+), 10 deletions(-) diff --git a/helpers/utils b/helpers/utils index 1b6e3cd50..7741ee02b 100644 --- a/helpers/utils +++ b/helpers/utils @@ -926,7 +926,7 @@ ynh_compare_current_package_version() { _ynh_apply_default_permissions() { local target=$1 - local ynh_requirement=$(ynh_read_manifest --key=".requirements.yunohost") + local ynh_requirement=$(ynh_read_manifest --manifest_key="requirements.yunohost") if dpkg --compare-versions ${YNH_APP_PACKAGING_FORMAT:-0} ge 2 || [ -z "$ynh_requirement" ] || [ "$ynh_requirement" == "null" ] || dpkg --compare-versions $ynh_requirement ge 4.2; then chmod o-rwx $target diff --git a/src/tests/test_apps.py b/src/tests/test_apps.py index 4853817f9..20a47b5d7 100644 --- a/src/tests/test_apps.py +++ b/src/tests/test_apps.py @@ -219,8 +219,8 @@ def test_legacy_app_manifest_preinstall(): assert "description" in m assert "integration" in m assert "install" in m - assert m.get("doc") == {} - assert m.get["notifications"] == {"pre_install": {}, "pre_upgrade": {}, "post_install": {}, "post_upgrade": {}} + assert m["doc"] == {} + assert m["notifications"] == {"pre_install": {}, "pre_upgrade": {}, "post_install": {}, "post_upgrade": {}} def test_manifestv2_app_manifest_preinstall(): @@ -271,9 +271,9 @@ def test_manifestv2_app_info_postinstall(): assert "The app install dir is /var/www/manifestv2_app" in m["doc"]["ADMIN"]["en"] assert "Le dossier d'install de l'app est /var/www/manifestv2_app" in m["doc"]["ADMIN"]["fr"] assert "notifications" in m - assert "The app install dir is /var/www/manifestv2_app" in m["notifications"]["post_install"]["en"] - assert "The app id is manifestv2_app" in m["notifications"]["post_install"]["en"] - assert f"The app url is {main_domain}/manifestv2" in m["notifications"]["post_install"]["en"] + assert "The app install dir is /var/www/manifestv2_app" in m["notifications"]["post_install"]["main"]["en"] + assert "The app id is manifestv2_app" in m["notifications"]["post_install"]["main"]["en"] + assert f"The app url is {main_domain}/manifestv2" in m["notifications"]["post_install"]["main"]["en"] def test_manifestv2_app_info_preupgrade(monkeypatch): @@ -290,6 +290,7 @@ def test_manifestv2_app_info_preupgrade(monkeypatch): "lastUpdate": 999999999, "maintained": True, "manifest": manifest, + "state": "working", } res["apps"]["manifestv2_app"]["manifest"]["version"] = "99999~ynh1" @@ -306,7 +307,7 @@ def test_manifestv2_app_info_preupgrade(monkeypatch): # does provide the notifications, which means the list builder script # should parse the files in the original app repo, possibly with proper i18n etc assert "This is a dummy disclaimer to display prior to any upgrade" \ - in i["from_catalog"]["manifest"]["notifications"]["pre_upgrade"] + in i["from_catalog"]["manifest"]["notifications"]["pre_upgrade"]["main"]["en"] def test_app_from_catalog(): main_domain = _get_maindomain() diff --git a/src/utils/resources.py b/src/utils/resources.py index 46f2eba33..f93543cb2 100644 --- a/src/utils/resources.py +++ b/src/utils/resources.py @@ -615,9 +615,10 @@ class PortsResource(AppResource): # Automigrate from legacy setting foobar_port (instead of port_foobar) legacy_setting_name = "{name}_port" port_value = self.get_setting(legacy_setting_name) - self.set_setting(setting_name, port_value) - self.delete_setting(legacy_setting_name) - continue + if port_value: + self.set_setting(setting_name, port_value) + self.delete_setting(legacy_setting_name) + continue if not port_value: port_value = infos["default"] From e9190a6bd6f9f1fe3d55306fb798539e5f4b2989 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Thu, 1 Sep 2022 23:55:16 +0200 Subject: [PATCH 085/174] manifestv2: moar test fixes --- src/tests/test_apps.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/tests/test_apps.py b/src/tests/test_apps.py index 20a47b5d7..e62680824 100644 --- a/src/tests/test_apps.py +++ b/src/tests/test_apps.py @@ -231,8 +231,8 @@ def test_manifestv2_app_manifest_preinstall(): assert "install" in m assert "description" in m assert "doc" in m - assert "This is a dummy description of this app features" in m["doc"]["DESCRIPTION"]["main"]["en"] - assert "Ceci est une fausse description des fonctionalités de l'app" in m["doc"]["DESCRIPTION"]["main"]["fr"] + assert "This is a dummy description of this app features" in m["doc"]["DESCRIPTION"]["en"] + assert "Ceci est une fausse description des fonctionalités de l'app" in m["doc"]["DESCRIPTION"]["fr"] assert "notifications" in m assert "This is a dummy disclaimer to display prior to the install" in m["notifications"]["pre_install"]["main"]["en"] assert "Ceci est un faux disclaimer à présenter avant l'installation" in m["notifications"]["pre_install"]["main"]["fr"] From 0610a1808b12b218651cf9e1b7faf3431882d568 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 2 Sep 2022 00:20:44 +0200 Subject: [PATCH 086/174] =?UTF-8?q?manifestv2:=20attempt=20to=20fix=20mypy?= =?UTF-8?q?=20errors=20=C3=A9=5F=C3=A8?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/utils/resources.py | 14 ++++++++++++-- src/utils/system.py | 5 +++-- 2 files changed, 15 insertions(+), 4 deletions(-) diff --git a/src/utils/resources.py b/src/utils/resources.py index f93543cb2..9edad2970 100644 --- a/src/utils/resources.py +++ b/src/utils/resources.py @@ -22,7 +22,8 @@ import os import copy import shutil import random -from typing import Dict, Any +from typing import Optional, Dict, List, Union, Any, Mapping, Callable, no_type_check + from moulinette.utils.process import check_output from moulinette.utils.log import getActionLogger @@ -123,6 +124,8 @@ class AppResourceManager: class AppResource: + default_properties: Dict[str, Any] = None + def __init__(self, properties: Dict[str, Any], app: str, manager=None): self.app = app @@ -199,7 +202,7 @@ class PermissionsResource(AppResource): default_properties = { } - default_perm_properties = { + default_perm_properties: Dict[str, Any] = { "url": None, "additional_urls": [], "auth_header": True, @@ -208,6 +211,8 @@ class PermissionsResource(AppResource): "protected": False, } + permissions: Dict[str, Dict[str, Any]] = {} + def __init__(self, properties: Dict[str, Any], *args, **kwargs): # FIXME : if url != None, we should check that there's indeed a domain/path defined ? ie that app is a webapp @@ -362,6 +367,7 @@ class SystemuserAppResource(AppResource): # fi # +@no_type_check class InstalldirAppResource(AppResource): """ is_provisioned -> setting install_dir exists + /dir/ exists @@ -427,6 +433,7 @@ class InstalldirAppResource(AppResource): # FIXME : in fact we should delete settings to be consistent +@no_type_check class DatadirAppResource(AppResource): """ is_provisioned -> setting data_dir exists + /dir/ exists @@ -510,6 +517,7 @@ class DatadirAppResource(AppResource): # return # +@no_type_check class AptDependenciesAppResource(AppResource): """ is_provisioned -> package __APP__-ynh-deps exists (ideally should check the Depends: but hmgn) @@ -583,6 +591,8 @@ class PortsResource(AppResource): "fixed": False, # FIXME: implement logic. Corresponding to wether or not the port is "fixed" or any random port is ok } + ports: Dict[str, Dict[str, Any]] + def __init__(self, properties: Dict[str, Any], *args, **kwargs): if "main" not in properties: diff --git a/src/utils/system.py b/src/utils/system.py index 2aaf0fa35..fe6d2d01b 100644 --- a/src/utils/system.py +++ b/src/utils/system.py @@ -21,6 +21,7 @@ import re import os import logging +from typing import Union from moulinette.utils.process import check_output from yunohost.utils.error import YunohostError @@ -74,11 +75,11 @@ def human_to_binary(size: str) -> int: raise YunohostError(f"Invalid size suffix '{suffix}', expected one of {symbols}") try: - size = float(size) + size_ = float(size) except Exception: raise YunohostError(f"Failed to convert size {size} to float") - return size * factor[suffix] + return int(size_ * factor[suffix]) def binary_to_human(n: int) -> str: From 564c2de8153f2f7dbdbd3668e0898ddc83a178cc Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 2 Sep 2022 20:34:41 +0200 Subject: [PATCH 087/174] manifestv2: moar attempts to fix mypy errors --- src/utils/resources.py | 39 ++++++++++++++++++++++++++++++++++----- 1 file changed, 34 insertions(+), 5 deletions(-) diff --git a/src/utils/resources.py b/src/utils/resources.py index 9edad2970..05499c9b7 100644 --- a/src/utils/resources.py +++ b/src/utils/resources.py @@ -22,8 +22,7 @@ import os import copy import shutil import random -from typing import Optional, Dict, List, Union, Any, Mapping, Callable, no_type_check - +from typing import Optional, Dict, List, Union, Any, Mapping, Callable from moulinette.utils.process import check_output from moulinette.utils.log import getActionLogger @@ -124,6 +123,7 @@ class AppResourceManager: class AppResource: + type: str = "" default_properties: Dict[str, Any] = None def __init__(self, properties: Dict[str, Any], app: str, manager=None): @@ -318,6 +318,9 @@ class SystemuserAppResource(AppResource): "allow_sftp": False } + allow_ssh: bool = False + allow_sftp: bool = False + def provision_or_update(self, context: Dict={}): # FIXME : validate that no yunohost user exists with that name? @@ -367,7 +370,6 @@ class SystemuserAppResource(AppResource): # fi # -@no_type_check class InstalldirAppResource(AppResource): """ is_provisioned -> setting install_dir exists + /dir/ exists @@ -393,10 +395,18 @@ class InstalldirAppResource(AppResource): "group": "__APP__:rx", } + dir: str = "" + owner: str = "" + group: str = "" + # FIXME: change default dir to /opt/stuff if app ain't a webapp ... def provision_or_update(self, context: Dict={}): + assert self.dir.strip() # Be paranoid about self.dir being empty... + assert self.owner.strip() + assert self.group.strip() + current_install_dir = self.get_setting("install_dir") or self.get_setting("final_path") # If during install, /var/www/$app already exists, assume that it's okay to remove and recreate it @@ -427,13 +437,17 @@ class InstalldirAppResource(AppResource): self.delete_setting("final_path") # Legacy def deprovision(self, context: Dict={}): + + assert self.dir.strip() # Be paranoid about self.dir being empty... + assert self.owner.strip() + assert self.group.strip() + # FIXME : check that self.dir has a sensible value to prevent catastrophes if os.path.isdir(self.dir): rm(self.dir, recursive=True) # FIXME : in fact we should delete settings to be consistent -@no_type_check class DatadirAppResource(AppResource): """ is_provisioned -> setting data_dir exists + /dir/ exists @@ -459,8 +473,16 @@ class DatadirAppResource(AppResource): "group": "__APP__:rx", } + dir: str = "" + owner: str = "" + group: str = "" + def provision_or_update(self, context: Dict={}): + assert self.dir.strip() # Be paranoid about self.dir being empty... + assert self.owner.strip() + assert self.group.strip() + current_data_dir = self.get_setting("data_dir") if not os.path.isdir(self.dir): @@ -482,6 +504,11 @@ class DatadirAppResource(AppResource): self.set_setting("data_dir", self.dir) def deprovision(self, context: Dict={}): + + assert self.dir.strip() # Be paranoid about self.dir being empty... + assert self.owner.strip() + assert self.group.strip() + # FIXME: This should rm the datadir only if purge is enabled pass #if os.path.isdir(self.dir): @@ -517,7 +544,6 @@ class DatadirAppResource(AppResource): # return # -@no_type_check class AptDependenciesAppResource(AppResource): """ is_provisioned -> package __APP__-ynh-deps exists (ideally should check the Depends: but hmgn) @@ -542,6 +568,9 @@ class AptDependenciesAppResource(AppResource): "extras": {} } + packages: List = [] + extras: Dict[str: Any] = {} + def __init__(self, properties: Dict[str, Any], *args, **kwargs): for key, values in properties.get("extras", {}).items(): From 7bd5857b3cf38ea507e0e1d7f8a989dad068d8f2 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 2 Sep 2022 21:01:39 +0200 Subject: [PATCH 088/174] manifestv2: fix some FIXME, add some others @_@ --- src/utils/resources.py | 43 ++++++++++++++++++++++++++++++++++-------- 1 file changed, 35 insertions(+), 8 deletions(-) diff --git a/src/utils/resources.py b/src/utils/resources.py index 05499c9b7..3db999c84 100644 --- a/src/utils/resources.py +++ b/src/utils/resources.py @@ -39,6 +39,9 @@ logger = getActionLogger("yunohost.app_resources") class AppResourceManager: + # FIXME : add some sort of documentation mechanism + # to create a have a detailed description of each resource behavior + def __init__(self, app: str, current: Dict, wanted: Dict): self.app = app @@ -156,6 +159,7 @@ class AppResource: def _run_script(self, action, script, env={}, user="root"): from yunohost.app import _make_tmp_workdir_for_app, _make_environment_for_app_script + from yunohost.hook import hook_exec_with_script_debug_if_failure tmpdir = _make_tmp_workdir_for_app(app=self.app) @@ -172,10 +176,29 @@ ynh_abort_if_errors write_to_file(script_path, script) - #print(env_) - - # FIXME : use the hook_exec_with_debug_instructions_stuff - ret, _ = hook_exec(script_path, env=env_) + from yunohost.log import OperationLogger + operation_logger = OperationLogger._instances[-1], # FIXME : this is an ugly hack :( + try: + ( + call_failed, + failure_message_with_debug_instructions, + ) = hook_exec_with_script_debug_if_failure( + script_path + env=env_, + operation_logger=operation_logger, + error_message_if_script_failed="An error occured inside the script snippet", + error_message_if_failed=lambda e: f"{action} failed for {self.type} : {e}" + ) + finally: + if call_failed: + raise YunohostError( + failure_message_with_debug_instructions, raw_msg=True + ) + else: + # FIXME: currently in app install code, we have + # more sophisticated code checking if this broke something on the system etc ... + # dunno if we want to do this here or manage it elsewhere + pass #print(ret) @@ -327,9 +350,10 @@ class SystemuserAppResource(AppResource): # and/or that no system user exists during install ? if not check_output(f"getent passwd {self.app} &>/dev/null || true").strip(): - # FIXME: improve error handling ? + # FIXME: improve logging ? os.system wont log stdout / stderr cmd = f"useradd --system --user-group {self.app}" - os.system(cmd) + ret = os.system(cmd) + assert ret == 0, f"useradd command failed with exit code {ret}" if not check_output(f"getent passwd {self.app} &>/dev/null || true").strip(): raise YunohostError(f"Failed to create system user for {self.app}", raw_msg=True) @@ -390,7 +414,7 @@ class InstalldirAppResource(AppResource): priority = 30 default_properties = { - "dir": "/var/www/__APP__", # FIXME or choose to move this elsewhere nowadays idk... + "dir": "/var/www/__APP__", "owner": "__APP__:rx", "group": "__APP__:rx", } @@ -417,7 +441,10 @@ class InstalldirAppResource(AppResource): if not os.path.isdir(self.dir): # Handle case where install location changed, in which case we shall move the existing install dir # FIXME: confirm that's what we wanna do + # Maybe a middle ground could be to compute the size, check that it's not too crazy (eg > 1G idk), + # and check for available space on the destination if current_install_dir and os.path.isdir(current_install_dir): + logger.warning(f"Moving {current_install_dir} to {self.dir} ... (this may take a while)") shutil.move(current_install_dir, self.dir) else: mkdir(self.dir) @@ -468,7 +495,7 @@ class DatadirAppResource(AppResource): priority = 40 default_properties = { - "dir": "/home/yunohost.app/__APP__", # FIXME or choose to move this elsewhere nowadays idk... + "dir": "/home/yunohost.app/__APP__", "owner": "__APP__:rx", "group": "__APP__:rx", } From ebe41411adc0ea23c79c663f12b02223064b0030 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 2 Sep 2022 21:03:25 +0200 Subject: [PATCH 089/174] Unused imports --- src/utils/resources.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/utils/resources.py b/src/utils/resources.py index 3db999c84..22b1177f0 100644 --- a/src/utils/resources.py +++ b/src/utils/resources.py @@ -22,7 +22,7 @@ import os import copy import shutil import random -from typing import Optional, Dict, List, Union, Any, Mapping, Callable +from typing import Dict, Any from moulinette.utils.process import check_output from moulinette.utils.log import getActionLogger From 28d0b6d891197076382fc87b2f9f0232ca230f9e Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 2 Sep 2022 21:04:00 +0200 Subject: [PATCH 090/174] Unused imports --- src/utils/system.py | 1 - 1 file changed, 1 deletion(-) diff --git a/src/utils/system.py b/src/utils/system.py index fe6d2d01b..7e1d8746e 100644 --- a/src/utils/system.py +++ b/src/utils/system.py @@ -21,7 +21,6 @@ import re import os import logging -from typing import Union from moulinette.utils.process import check_output from yunohost.utils.error import YunohostError From 74e745a291d651c2ea965a15931da7e875c3490c Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 2 Sep 2022 21:44:00 +0200 Subject: [PATCH 091/174] Stupid typo >_> --- src/utils/resources.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/utils/resources.py b/src/utils/resources.py index 22b1177f0..a7685083a 100644 --- a/src/utils/resources.py +++ b/src/utils/resources.py @@ -183,7 +183,7 @@ ynh_abort_if_errors call_failed, failure_message_with_debug_instructions, ) = hook_exec_with_script_debug_if_failure( - script_path + script_path, env=env_, operation_logger=operation_logger, error_message_if_script_failed="An error occured inside the script snippet", From 487ef303d86fa8543b1c0c4ea66739a45b2097b0 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sat, 3 Sep 2022 01:04:05 +0200 Subject: [PATCH 092/174] Typo again ugh --- src/utils/resources.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/utils/resources.py b/src/utils/resources.py index a7685083a..73284b5be 100644 --- a/src/utils/resources.py +++ b/src/utils/resources.py @@ -22,7 +22,7 @@ import os import copy import shutil import random -from typing import Dict, Any +from typing import Dict, Any, List from moulinette.utils.process import check_output from moulinette.utils.log import getActionLogger From f6970ba4034739cfd5c5a7d5584b0e392e03d08d Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sat, 3 Sep 2022 01:04:29 +0200 Subject: [PATCH 093/174] manifestv2: Add doc about each resource type + script to create doc file --- doc/generate_resource_doc.py | 12 ++ src/utils/resources.py | 312 ++++++++++++++++++++++++----------- 2 files changed, 224 insertions(+), 100 deletions(-) create mode 100644 doc/generate_resource_doc.py diff --git a/doc/generate_resource_doc.py b/doc/generate_resource_doc.py new file mode 100644 index 000000000..1e16a76d9 --- /dev/null +++ b/doc/generate_resource_doc.py @@ -0,0 +1,12 @@ +from yunohost.utils.resources import AppResourceClassesByType + +resources = sorted(AppResourceClassesByType.values(), key=lambda r: r.priority) + +for klass in resources: + + doc = klass.__doc__.replace("\n ", "\n") + + print("") + print(f"## {klass.type.replace('_', ' ').title()}") + print("") + print(doc) diff --git a/src/utils/resources.py b/src/utils/resources.py index 73284b5be..4bda6589f 100644 --- a/src/utils/resources.py +++ b/src/utils/resources.py @@ -205,22 +205,49 @@ ynh_abort_if_errors class PermissionsResource(AppResource): """ - is_provisioned -> main perm exists - is_available -> perm urls do not conflict + Configure the SSO permissions/tiles. Typically, webapps are expected to have a 'main' permission mapped to '/', meaning that a tile pointing to the `$domain/$path` will be available in the SSO for users allowed to access that app. - update -> refresh/update values for url/additional_urls/show_tile/auth/protected/... create new perms / delete any perm not listed - provision -> same as update? + Additional permissions can be created, typically to have a specific tile and/or access rules for the admin part of a webapp. - deprovision -> delete permissions + The list of allowed user/groups may be initialized using the content of the `init_{perm}_permission` question from the manifest, hence `init_main_permission` replaces the `is_public` question and shall contain a group name (typically, `all_users` or `visitors`). - deep_clean -> delete permissions for any __APP__.foobar where app not in app list... + ##### Example: + ```toml + [resources.permissions] + main.url = "/" + # (these two previous lines should be enough in the majority of cases) - backup -> handled elsewhere by the core, should be integrated in there (dump .ldif/yml?) - restore -> handled by the core, should be integrated in there (restore .ldif/yml?) + admin.url = "/admin" + admin.show_tile = false + admin.allowed = "admins" # Assuming the "admins" group exists (cf future developments ;)) + ``` + + ##### Properties (for each perm name): + - `url`: The relative URI corresponding to this permission. Typically `/` or `/something`. This property may be omitted for non-web permissions. + - `show_tile`: (default: `true` if `url` is defined) Wether or not a tile should be displayed for that permission in the user portal + - `allowed`: (default: nobody) The group initially allowed to access this perm, if `init_{perm}_permission` is not defined in the manifest questions. Note that the admin may tweak who is allowed/unallowed on that permission later on, this is only meant to **initialize** the permission. + - `auth_header`: (default: `true`) Define for the URL of this permission, if SSOwat pass the authentication header to the application. Default is true + - `protected`: (default: `false`) Define if this permission is protected. If it is protected the administrator won't be able to add or remove the visitors group of this permission. Defaults to 'false'. + - `additional_urls`: (default: none) List of additional URL for which access will be allowed/forbidden + + ##### Provision/Update: + - Delete any permissions that may exist and be related to this app yet is not declared anymore + - Loop over the declared permissions and create them if needed or update them with the new values (FIXME : update ain't implemented yet >_>) + + ##### Deprovision: + - Delete all permission related to this app + + ##### Legacy management: + - Legacy `is_public` setting will be deleted if it exists """ + # Notes for future ? + # deep_clean -> delete permissions for any __APP__.foobar where app not in app list... + # backup -> handled elsewhere by the core, should be integrated in there (dump .ldif/yml?) + # restore -> handled by the core, should be integrated in there (restore .ldif/yml?) + type = "permissions" - priority = 10 + priority = 80 default_properties = { } @@ -319,20 +346,33 @@ class PermissionsResource(AppResource): class SystemuserAppResource(AppResource): """ - is_provisioned -> user __APP__ exists - is_available -> user and group __APP__ doesn't exists + Provision a system user to be used by the app. The username is exactly equal to the app id - provision -> create user - update -> update values for home / shell / groups + ##### Example: + ```toml + [resources.system_user] + # (empty - defaults are usually okay) + ``` - deprovision -> delete user + ##### Properties: + - `allow_ssh`: (default: False) Adds the user to the ssh.app group, allowing SSH connection via this user + - `allow_sftp`: (defalt: False) Adds the user to the sftp.app group, allowing SFTP connection via this user - deep_clean -> uuuuh ? delete any user that could correspond to an app x_x ? + ##### Provision/Update: + - will create the system user if it doesn't exists yet + - will add/remove the ssh/sftp.app groups - backup -> nothing - restore -> provision + ##### Deprovision: + - deletes the user and group """ + # Notes for future? + # + # deep_clean -> uuuuh ? delete any user that could correspond to an app x_x ? + # + # backup -> nothing + # restore -> provision + type = "system_user" priority = 20 @@ -341,6 +381,9 @@ class SystemuserAppResource(AppResource): "allow_sftp": False } + # FIXME : wat do regarding ssl-cert, multimedia + # FIXME : wat do about home dir + allow_ssh: bool = False allow_sftp: bool = False @@ -362,8 +405,13 @@ class SystemuserAppResource(AppResource): if self.allow_ssh: groups.add("ssh.app") + elif "ssh.app" in groups: + groups.remove("ssh.app") + if self.allow_sftp: groups.add("sftp.app") + elif "sftp.app" in groups: + groups.remove("sftp.app") os.system(f"usermod -G {','.join(groups)} {self.app}") @@ -382,34 +430,42 @@ class SystemuserAppResource(AppResource): # FIXME : better logging and error handling, add stdout/stderr from the deluser/delgroup commands... -# # Check if the user exists on the system -#if os.system(f"getent passwd {self.username} &>/dev/null") != 0: -# if ynh_system_user_exists "$username"; then -# deluser $username -# fi -# # Check if the group exists on the system -#if os.system(f"getent group {self.username} &>/dev/null") != 0: -# if ynh_system_group_exists "$username"; then -# delgroup $username -# fi -# - class InstalldirAppResource(AppResource): """ - is_provisioned -> setting install_dir exists + /dir/ exists - is_available -> /dir/ doesn't exists + Creates a directory to be used by the app as the installation directory, typically where the app sources and assets are located. The corresponding path is stored in the settings as `install_dir` - provision -> create setting + create dir - update -> update perms ? + ##### Example: + ```toml + [resources.install_dir] + # (empty - defaults are usually okay) + ``` - deprovision -> delete dir + delete setting + ##### Properties: + - `dir`: (default: `/var/www/__APP__`) The full path of the install dir + - `owner`: (default: `__APP__:rx`) The owner (and owner permissions) for the install dir + - `group`: (default: `__APP__:rx`) The group (and group permissions) for the install dir - deep_clean -> uuuuh ? delete any dir in /var/www/ that would not correspond to an app x_x ? + ##### Provision/Update: + - during install, the folder will be deleted if it already exists (FIXME: is this what we want?) + - if the dir path changed and a folder exists at the old location, the folder will be `mv`'ed to the new location + - otherwise, creates the directory if it doesn't exists yet + - (re-)apply permissions (only on the folder itself, not recursively) + - save the value of `dir` as `install_dir` in the app's settings, which can be then used by the app scripts (`$install_dir`) and conf templates (`__INSTALL_DIR__`) + + ##### Deprovision: + - recursively deletes the directory if it exists + + ##### Legacy management: + - In the past, the setting was called `final_path`. The code will automatically rename it as `install_dir`. + - As explained in the 'Provision/Update' section, the folder will also be moved if the location changed - backup -> cp install dir - restore -> cp install dir """ + # Notes for future? + # deep_clean -> uuuuh ? delete any dir in /var/www/ that would not correspond to an app x_x ? + # backup -> cp install dir + # restore -> cp install dir + type = "install_dir" priority = 30 @@ -477,20 +533,41 @@ class InstalldirAppResource(AppResource): class DatadirAppResource(AppResource): """ - is_provisioned -> setting data_dir exists + /dir/ exists - is_available -> /dir/ doesn't exists + Creates a directory to be used by the app as the data store directory, typically where the app multimedia or large assets added by users are located. The corresponding path is stored in the settings as `data_dir`. This resource behaves very similarly to install_dir. - provision -> create setting + create dir - update -> update perms ? + ##### Example: + ```toml + [resources.data_dir] + # (empty - defaults are usually okay) + ``` - deprovision -> (only if purge enabled...) delete dir + delete setting + ##### Properties: + - `dir`: (default: `/home/yunohost.app/__APP__`) The full path of the data dir + - `owner`: (default: `__APP__:rx`) The owner (and owner permissions) for the data dir + - `group`: (default: `__APP__:rx`) The group (and group permissions) for the data dir - deep_clean -> zblerg idk nothing + ##### Provision/Update: + - if the dir path changed and a folder exists at the old location, the folder will be `mv`'ed to the new location + - otherwise, creates the directory if it doesn't exists yet + - (re-)apply permissions (only on the folder itself, not recursively) + - save the value of `dir` as `data_dir` in the app's settings, which can be then used by the app scripts (`$data_dir`) and conf templates (`__DATA_DIR__`) + + ##### Deprovision: + - recursively deletes the directory if it exists + - FIXME: this should only be done if the PURGE option is set + - FIXME: this should also delete the corresponding setting + + ##### Legacy management: + - In the past, the setting may have been called `datadir`. The code will automatically rename it as `data_dir`. + - As explained in the 'Provision/Update' section, the folder will also be moved if the location changed - backup -> cp data dir ? (if not backup_core_only) - restore -> cp data dir ? (if in backup) """ + # notes for future ? + # deep_clean -> zblerg idk nothing + # backup -> cp data dir ? (if not backup_core_only) + # restore -> cp data dir ? (if in backup) + type = "data_dir" priority = 40 @@ -510,10 +587,12 @@ class DatadirAppResource(AppResource): assert self.owner.strip() assert self.group.strip() - current_data_dir = self.get_setting("data_dir") + current_data_dir = self.get_setting("data_dir") or self.get_setting("datadir") if not os.path.isdir(self.dir): # Handle case where install location changed, in which case we shall move the existing install dir + # FIXME: same as install_dir, is this what we want ? + # FIXME: What if people manually mved the data dir and changed the setting value and dont want the folder to be moved ? x_x if current_data_dir and os.path.isdir(current_data_dir): shutil.move(current_data_dir, self.dir) else: @@ -529,6 +608,7 @@ class DatadirAppResource(AppResource): chown(self.dir, owner, group) self.set_setting("data_dir", self.dir) + self.delete_setting("datadir") # Legacy def deprovision(self, context: Dict={}): @@ -543,50 +623,37 @@ class DatadirAppResource(AppResource): # FIXME : in fact we should delete settings to be consistent -# -#class SourcesAppResource(AppResource): -# """ -# is_provisioned -> (if pre_download,) cache exists with appropriate checksum -# is_available -> curl HEAD returns 200 -# -# update -> none? -# provision -> full download + check checksum -# -# deprovision -> remove cache for __APP__ ? -# -# deep_clean -> remove all cache -# -# backup -> nothing -# restore -> nothing -# """ -# -# type = "sources" -# -# default_properties = { -# "main": {"url": "?", "sha256sum": "?", "predownload": True} -# } -# -# def provision_or_update(self, context: Dict={}): -# # FIXME -# return -# - class AptDependenciesAppResource(AppResource): """ - is_provisioned -> package __APP__-ynh-deps exists (ideally should check the Depends: but hmgn) - is_available -> True? idk + Create a virtual package in apt, depending on the list of specified packages that the app needs. The virtual packages is called `$app-ynh-deps` (with `_` being replaced by `-` in the app name, see `ynh_install_app_dependencies`) - update -> update deps on __APP__-ynh-deps - provision -> create/update deps on __APP__-ynh-deps + ##### Example: + ```toml + [resources.apt] + packages = "nyancat, lolcat, sl" - deprovision -> remove __APP__-ynh-deps (+autoremove?) + # (this part is optional and corresponds to the legacy ynh_install_extra_app_dependencies helper) + extras.yarn.repo = "deb https://dl.yarnpkg.com/debian/ stable main" + extras.yarn.key = "https://dl.yarnpkg.com/debian/pubkey.gpg" + extras.yarn.packages = "yarn" + ``` - deep_clean -> remove any __APP__-ynh-deps for app not in app list + ##### Properties: + - `packages`: Comma-separated list of packages to be installed via `apt` + - `extras`: A dict of (repo, key, packages) corresponding to "extra" repositories to fetch dependencies from - backup -> nothing - restore = provision + ##### Provision/Update: + - The code literally calls the bash helpers `ynh_install_app_dependencies` and `ynh_install_extra_app_dependencies`, similar to what happens in v1. + + ##### Deprovision: + - The code literally calls the bash helper `ynh_remove_app_dependencies` """ + # Notes for future? + # deep_clean -> remove any __APP__-ynh-deps for app not in app list + # backup -> nothing + # restore = provision + type = "apt" priority = 50 @@ -596,7 +663,7 @@ class AptDependenciesAppResource(AppResource): } packages: List = [] - extras: Dict[str: Any] = {} + extras: Dict[str, Dict[str, str]] = {} def __init__(self, properties: Dict[str, Any], *args, **kwargs): @@ -611,6 +678,7 @@ class AptDependenciesAppResource(AppResource): script = [f"ynh_install_app_dependencies {self.packages}"] for repo, values in self.extras.items(): script += [f"ynh_install_extra_app_dependencies --repo='{values['repo']}' --key='{values['key']}' --package='{values['packages']}'"] + # FIXME : we're feeding the raw value of values['packages'] to the helper .. if we want to be consistent, may they should be comma-separated, though in the majority of cases, only a single package is installed from an extra repo.. self._run_script("provision_or_update", '\n'.join(script)) @@ -621,20 +689,44 @@ class AptDependenciesAppResource(AppResource): class PortsResource(AppResource): """ - is_provisioned -> port setting exists and is not the port used by another app (ie not in another app setting) - is_available -> true + Book port(s) to be used by the app, typically to be used to the internal reverse-proxy between nginx and the app process. - update -> true - provision -> find a port not used by any app + Note that because multiple ports can be booked, each properties is prefixed by the name of the port. `main` is a special name and will correspond to the setting `$port`, whereas for example `xmpp_client` will correspond to the setting `$port_xmpp_client`. - deprovision -> delete the port setting + ##### Example: + ```toml + [resources.port] + # (empty should be fine for most apps ... though you can customize stuff if absolutely needed) - deep_clean -> ? + main.default = 12345 # if you really want to specify a prefered value .. but shouldnt matter in the majority of cases - backup -> nothing (backup port setting) - restore -> nothing (restore port setting) + xmpp_client.default = 5222 # if you need another port, pick a name for it (here, "xmpp_client") + xmpp_client.exposed = "TCP" # here, we're telling that the port needs to be publicly exposed on TCP on the firewall + ``` + + ##### Properties (for every port name): + - `default`: The prefered value for the port. If this port is already being used by another process right now, or is booked in another app's setting, the code will increment the value until it finds a free port and store that value as the setting. If no value is specified, a random value between 10000 and 60000 is used. + - `exposed`: (default: `false`) Wether this port should be opened on the firewall and be publicly reachable. This should be kept to `false` for the majority of apps than only need a port for internal reverse-proxying! Possible values: `false`, `true`(=`Both`), `Both`, `TCP`, `UDP`. This will result in the port being opened on the firewall, and the diagnosis checking that a program answers on that port. (FIXME: this is not implemented yet) + - `fixed`: (default: `false`) Tells that the app absolutely needs the specific value provided in `default`, typically because it's needed for a specific protocol (FIXME: this is not implemented yet) + + ##### Provision/Update (for every port name): + - If not already booked, look for a free port, starting with the `default` value (or a random value between 10000 and 60000 if no `default` set) + - (FIXME) If `exposed` is not `false`, open the port in the firewall accordingly - otherwise make sure it's closed. + - The value of the port is stored in the `$port` setting for the `main` port, or `$port_NAME` for other `NAME`s + + ##### Deprovision: + - (FIXME) Close the ports on the firewall + - Deletes all the port settings + + ##### Legacy management: + - In the past, some settings may have been named `NAME_port` instead of `port_NAME`, in which case the code will automatically rename the old setting. """ + # Notes for future? + #deep_clean -> ? + #backup -> nothing (backup port setting) + #restore -> nothing (restore port setting) + type = "ports" priority = 70 @@ -702,24 +794,44 @@ class PortsResource(AppResource): class DatabaseAppResource(AppResource): """ - is_provisioned -> setting db_user, db_name, db_pwd exists - is_available -> db doesn't already exists ( ... also gotta make sure that mysql / postgresql is indeed installed ... or will be after apt provisions it) + Initialize a database, either using MySQL or Postgresql. Relevant DB infos are stored in settings `$db_name`, `$db_user` and `$db_pwd`. - provision -> setup the db + init the setting - update -> ?? + NB: only one DB can be handled in such a way (is there really an app that would need two completely different DB ?...) - deprovision -> delete the db + NB2: no automagic migration will happen in an suddenly change `type` from `mysql` to `postgresql` or viceversa in its life - deep_clean -> ... idk look into any db name that would not be related to any app ... + ##### Example: + ```toml + [resources.database] + type = "mysql" # or : "postgresql". Only these two values are supported + ``` - backup -> dump db - restore -> setup + inject db dump + ##### Properties: + - `type`: The database type, either `mysql` or `postgresql` + + ##### Provision/Update: + - (Re)set the `$db_name` and `$db_user` settings with the sanitized app name (replacing `-` and `.` with `_`) + - If `$db_pwd` doesn't already exists, pick a random database password and store it in that setting + - If the database doesn't exists yet, create the SQL user and DB using `ynh_mysql_create_db` or `ynh_psql_create_db`. + + ##### Deprovision: + - Drop the DB using `ynh_mysql_remove_db` or `ynh_psql_remove_db` + - Deletes the `db_name`, `db_user` and `db_pwd` settings + + ##### Legacy management: + - In the past, the sql passwords may have been named `mysqlpwd` or `psqlpwd`, in which case it will automatically be renamed as `db_pwd` """ + # Notes for future? + # deep_clean -> ... idk look into any db name that would not be related to any app ... + # backup -> dump db + # restore -> setup + inject db dump + type = "database" + priority = 90 default_properties = { - "type": None, + "type": None, # FIXME: eeeeeeeh is this really a good idea considering 'type' is supposed to be the resource type x_x } def __init__(self, properties: Dict[str, Any], *args, **kwargs): From 0d2cb690b3b20669df5725a96f4fe28f7c86f9d4 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sat, 3 Sep 2022 16:31:42 +0200 Subject: [PATCH 094/174] manifestv2: moar test fixes --- src/utils/resources.py | 26 ++++++++++++++++---------- 1 file changed, 16 insertions(+), 10 deletions(-) diff --git a/src/utils/resources.py b/src/utils/resources.py index 4bda6589f..9da0cedb7 100644 --- a/src/utils/resources.py +++ b/src/utils/resources.py @@ -32,7 +32,6 @@ from moulinette.utils.filesystem import ( ) from yunohost.utils.error import YunohostError -from yunohost.hook import hook_exec logger = getActionLogger("yunohost.app_resources") @@ -127,7 +126,7 @@ class AppResourceManager: class AppResource: type: str = "" - default_properties: Dict[str, Any] = None + default_properties: Dict[str, Any] = {} def __init__(self, properties: Dict[str, Any], app: str, manager=None): @@ -177,7 +176,14 @@ ynh_abort_if_errors write_to_file(script_path, script) from yunohost.log import OperationLogger - operation_logger = OperationLogger._instances[-1], # FIXME : this is an ugly hack :( + + if OperationLogger._instances: + # FIXME ? : this is an ugly hack :( + operation_logger = OperationLogger._instances[-1] + else: + operation_logger = OperationLogger("resource_snippet", [("app", self.app)], env=env_) + operation_logger.start() + try: ( call_failed, @@ -249,7 +255,7 @@ class PermissionsResource(AppResource): type = "permissions" priority = 80 - default_properties = { + default_properties: Dict[str, Any] = { } default_perm_properties: Dict[str, Any] = { @@ -376,7 +382,7 @@ class SystemuserAppResource(AppResource): type = "system_user" priority = 20 - default_properties = { + default_properties: Dict[str, Any] = { "allow_ssh": False, "allow_sftp": False } @@ -469,7 +475,7 @@ class InstalldirAppResource(AppResource): type = "install_dir" priority = 30 - default_properties = { + default_properties: Dict[str, Any] = { "dir": "/var/www/__APP__", "owner": "__APP__:rx", "group": "__APP__:rx", @@ -571,7 +577,7 @@ class DatadirAppResource(AppResource): type = "data_dir" priority = 40 - default_properties = { + default_properties: Dict[str, Any] = { "dir": "/home/yunohost.app/__APP__", "owner": "__APP__:rx", "group": "__APP__:rx", @@ -657,7 +663,7 @@ class AptDependenciesAppResource(AppResource): type = "apt" priority = 50 - default_properties = { + default_properties: Dict[str, Any] = { "packages": [], "extras": {} } @@ -730,7 +736,7 @@ class PortsResource(AppResource): type = "ports" priority = 70 - default_properties = { + default_properties: Dict[str, Any] = { } default_port_properties = { @@ -830,7 +836,7 @@ class DatabaseAppResource(AppResource): type = "database" priority = 90 - default_properties = { + default_properties: Dict[str, Any] = { "type": None, # FIXME: eeeeeeeh is this really a good idea considering 'type' is supposed to be the resource type x_x } From dd59a855541c75796aee3fa81f84548d782f4d42 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sun, 4 Sep 2022 19:51:16 +0200 Subject: [PATCH 095/174] manifestv2: fix i18n --- locales/en.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/locales/en.json b/locales/en.json index 67d8feca5..2a50db16d 100644 --- a/locales/en.json +++ b/locales/en.json @@ -44,7 +44,6 @@ "app_remove_after_failed_install": "Removing the app following the installation failure...", "app_removed": "{app} uninstalled", "app_requirements_checking": "Checking requirements for {app}...", - "app_requirements_unmeet": "Requirements are not met for {app}, the package {pkgname} ({version}) must be {spec}", "app_restore_failed": "Could not restore {app}: {error}", "app_restore_script_failed": "An error occured inside the app restore script", "app_sources_fetch_failed": "Could not fetch sources files, is the URL correct?", @@ -463,6 +462,7 @@ "log_regen_conf": "Regenerate system configurations '{}'", "log_remove_on_failed_install": "Remove '{}' after a failed installation", "log_remove_on_failed_restore": "Remove '{}' after a failed restore from a backup archive", + "log_resource_snippet": "Provisioning/deprovisioning/updating a resource", "log_selfsigned_cert_install": "Install self-signed certificate on '{}' domain", "log_tools_migrations_migrate_forward": "Run migrations", "log_tools_postinstall": "Postinstall your YunoHost server", From 888f1d8e55407bc0a7c8c7a02fc39b16e492caac Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sun, 4 Sep 2022 20:33:41 +0200 Subject: [PATCH 096/174] admins: fix class decorator syntax? --- src/tools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/tools.py b/src/tools.py index 080f3a074..045f3c0e4 100644 --- a/src/tools.py +++ b/src/tools.py @@ -937,7 +937,7 @@ class Migration: def description(self): return m18n.n(f"migration_description_{self.id}") - def ldap_migration(self, run): + def ldap_migration(run): def func(self): # Backup LDAP before the migration From 3758611d13ee77bcc13def4673b18dc204225c77 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Mon, 5 Sep 2022 16:40:07 +0200 Subject: [PATCH 097/174] admins: bunch of fixes --- src/migrations/0026_new_admins_group.py | 7 +++-- src/tests/test_ldapauth.py | 6 ++-- src/tests/test_user-group.py | 2 -- src/tools.py | 40 ++++++++++++++----------- 4 files changed, 31 insertions(+), 24 deletions(-) diff --git a/src/migrations/0026_new_admins_group.py b/src/migrations/0026_new_admins_group.py index ca9b45d07..5601c8bf7 100644 --- a/src/migrations/0026_new_admins_group.py +++ b/src/migrations/0026_new_admins_group.py @@ -19,6 +19,8 @@ class MyMigration(Migration): introduced_in_version = "11.1" # FIXME? dependencies = [] + ldap_migration_started = False + @Migration.ldap_migration def run(self, *args): @@ -48,9 +50,10 @@ yunohost tools migrations run""", raw_msg=True ) + self.ldap_migration_started = True + stuff_to_delete = [ "cn=admin,ou=sudo", - "cn=admins,ou=sudo" "cn=admin", "cn=admins,ou=groups", ] @@ -75,7 +78,7 @@ yunohost tools migrations run""", { "cn": ["admins"], "objectClass": ["top", "posixGroup", "groupOfNamesYnh", "mailGroup"], - "gidNumber": [4001], + "gidNumber": ["4001"], "mail": ["root", "admin", "admins", "webmaster", "postmaster", "abuse"], } ) diff --git a/src/tests/test_ldapauth.py b/src/tests/test_ldapauth.py index a95dea443..7a09fff40 100644 --- a/src/tests/test_ldapauth.py +++ b/src/tests/test_ldapauth.py @@ -2,7 +2,7 @@ import pytest import os from yunohost.authenticators.ldap_admin import Authenticator as LDAPAuth -from yunohost.tools import tools_adminpw +from yunohost.tools import tools_rootpw from moulinette import m18n from moulinette.core import MoulinetteError @@ -13,7 +13,7 @@ def setup_function(function): if os.system("systemctl is-active slapd") != 0: os.system("systemctl start slapd && sleep 3") - tools_adminpw("yunohost", check_strength=False) + tools_rootpw("yunohost", check_strength=False) def test_authenticate(): @@ -47,7 +47,7 @@ def test_authenticate_change_password(): LDAPAuth().authenticate_credentials(credentials="yunohost") - tools_adminpw("plopette", check_strength=False) + tools_rootpw("plopette", check_strength=False) with pytest.raises(MoulinetteError) as exception: LDAPAuth().authenticate_credentials(credentials="yunohost") diff --git a/src/tests/test_user-group.py b/src/tests/test_user-group.py index e561118e0..8ef732d61 100644 --- a/src/tests/test_user-group.py +++ b/src/tests/test_user-group.py @@ -11,7 +11,6 @@ from yunohost.user import ( user_import, user_export, FIELDS_FOR_IMPORT, - FIRST_ALIASES, user_group_list, user_group_create, user_group_delete, @@ -175,7 +174,6 @@ def test_import_user(mocker): def test_export_user(mocker): result = user_export() - aliases = ",".join([alias + maindomain for alias in FIRST_ALIASES]) should_be = ( "username;firstname;lastname;password;mail;mail-alias;mail-forward;mailbox-quota;groups\r\n" f"alice;Alice;White;;alice@{maindomain};{aliases};;0;dev\r\n" diff --git a/src/tools.py b/src/tools.py index 045f3c0e4..e21dd585d 100644 --- a/src/tools.py +++ b/src/tools.py @@ -30,7 +30,7 @@ from typing import List from moulinette import Moulinette, m18n from moulinette.utils.log import getActionLogger from moulinette.utils.process import call_async_output -from moulinette.utils.filesystem import read_yaml, write_to_yaml, cp, mkdir, rm +from moulinette.utils.filesystem import read_yaml, write_to_yaml, cp, mkdir, rm, chown from yunohost.app import app_upgrade, app_list from yunohost.app_catalog import ( @@ -965,22 +965,28 @@ class Migration: try: run(self, backup_folder) except Exception: - logger.warning( - m18n.n("migration_ldap_migration_failed_trying_to_rollback") - ) - os.system("systemctl stop slapd") - # To be sure that we don't keep some part of the old config - rm("/etc/ldap/slapd.d", force=True, recursive=True) - cp(f"{backup_folder}/ldap_config", "/etc/ldap", recursive=True) - cp(f"{backup_folder}/ldap_db", "/var/lib/ldap", recursive=True) - cp( - f"{backup_folder}/apps_settings", - "/etc/yunohost/apps", - recursive=True, - ) - os.system("systemctl start slapd") - rm(backup_folder, force=True, recursive=True) - logger.info(m18n.n("migration_ldap_rollback_success")) + if self.ldap_migration_started: + logger.warning( + m18n.n("migration_ldap_migration_failed_trying_to_rollback") + ) + os.system("systemctl stop slapd") + # To be sure that we don't keep some part of the old config + rm("/etc/ldap", force=True, recursive=True) + cp(f"{backup_folder}/ldap_config", "/etc/ldap", recursive=True) + chown("/etc/ldap/schema/", "openldap", "openldap", recursive=True) + chown("/etc/ldap/slapd.d/", "openldap", "openldap", recursive=True) + rm("/var/lib/ldap", force=True, recursive=True) + cp(f"{backup_folder}/ldap_db", "/var/lib/ldap", recursive=True) + rm("/etc/yunohost/apps", force=True, recursive=True) + chown("/var/lib/ldap/", "openldap", recursive=True) + cp( + f"{backup_folder}/apps_settings", + "/etc/yunohost/apps", + recursive=True, + ) + os.system("systemctl start slapd") + rm(backup_folder, force=True, recursive=True) + logger.info(m18n.n("migration_ldap_rollback_success")) raise else: rm(backup_folder, force=True, recursive=True) From 1d98604e8826cf256dd05fb878fdab92f8a65b3c Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Mon, 5 Sep 2022 17:39:08 +0200 Subject: [PATCH 098/174] admins: moar fixes --- .gitlab/ci/test.gitlab-ci.yml | 2 +- src/migrations/0026_new_admins_group.py | 5 +++++ src/tests/test_user-group.py | 5 +++-- src/tools.py | 5 +++-- src/user.py | 5 +++-- 5 files changed, 15 insertions(+), 7 deletions(-) diff --git a/.gitlab/ci/test.gitlab-ci.yml b/.gitlab/ci/test.gitlab-ci.yml index 519ae427a..d7ccbc807 100644 --- a/.gitlab/ci/test.gitlab-ci.yml +++ b/.gitlab/ci/test.gitlab-ci.yml @@ -34,7 +34,7 @@ full-tests: PYTEST_ADDOPTS: "--color=yes" before_script: - *install_debs - - yunohost tools postinstall -d domain.tld -p the_password --ignore-dyndns --force-diskspace + - yunohost tools postinstall -d domain.tld -u syssa -f Syssa -l Mine -p the_password --ignore-dyndns --force-diskspace script: - python3 -m pytest --cov=yunohost tests/ src/tests/ src/diagnosers/ --junitxml=report.xml - cd tests diff --git a/src/migrations/0026_new_admins_group.py b/src/migrations/0026_new_admins_group.py index 5601c8bf7..227a30730 100644 --- a/src/migrations/0026_new_admins_group.py +++ b/src/migrations/0026_new_admins_group.py @@ -52,6 +52,11 @@ yunohost tools migrations run""", self.ldap_migration_started = True + aliases = user_info(new_admin_user).get("mail-aliases", []) + old_admin_aliases_to_remove = [alias for alias in aliases if any(alias.startswith(a) for a in ["root@", "admin@", "admins@", "webmaster@", "postmaster@", "abuse@"])] + + user_update(new_admin_user, remove_mailalias=old_admin_aliases_to_remove) + stuff_to_delete = [ "cn=admin,ou=sudo", "cn=admin", diff --git a/src/tests/test_user-group.py b/src/tests/test_user-group.py index 8ef732d61..30bb89162 100644 --- a/src/tests/test_user-group.py +++ b/src/tests/test_user-group.py @@ -38,7 +38,7 @@ def setup_function(function): global maindomain maindomain = _get_maindomain() - user_create("alice", "Alice", "White", maindomain, "test123Ynh") + user_create("alice", "Alice", "White", maindomain, "test123Ynh", admin=True) user_create("bob", "Bob", "Snow", maindomain, "test123Ynh") user_create("jack", "Jack", "Black", maindomain, "test123Ynh") @@ -79,6 +79,7 @@ def test_list_groups(): assert "alice" in res assert "bob" in res assert "jack" in res + assert "alice" in res["admins"]["members"] for u in ["alice", "bob", "jack"]: assert u in res assert u in res[u]["members"] @@ -176,7 +177,7 @@ def test_export_user(mocker): result = user_export() should_be = ( "username;firstname;lastname;password;mail;mail-alias;mail-forward;mailbox-quota;groups\r\n" - f"alice;Alice;White;;alice@{maindomain};{aliases};;0;dev\r\n" + f"alice;Alice;White;;alice@{maindomain};;;0;admins,dev\r\n" f"bob;Bob;Snow;;bob@{maindomain};;;0;apps\r\n" f"jack;Jack;Black;;jack@{maindomain};;;0;" ) diff --git a/src/tools.py b/src/tools.py index e21dd585d..ccc2b4a32 100644 --- a/src/tools.py +++ b/src/tools.py @@ -60,7 +60,7 @@ def tools_versions(): return ynh_packages_version() -def tools_rootpw(new_password): +def tools_rootpw(new_password, check_strength=True): from yunohost.user import _hash_user_password from yunohost.utils.password import ( @@ -70,7 +70,8 @@ def tools_rootpw(new_password): import spwd assert_password_is_compatible(new_password) - assert_password_is_strong_enough("admin", new_password) + if check_strength: + assert_password_is_strong_enough("admin", new_password) new_hash = _hash_user_password(new_password) diff --git a/src/user.py b/src/user.py index 3fabc78c5..3b980e89e 100644 --- a/src/user.py +++ b/src/user.py @@ -381,7 +381,7 @@ def user_update( # Populate user informations ldap = _get_ldap_interface() - attrs_to_fetch = ["givenName", "sn", "mail", "maildrop"] + attrs_to_fetch = ["givenName", "sn", "mail", "maildrop", "memberOf"] result = ldap.search( base="ou=users", filter="uid=" + username, @@ -425,7 +425,8 @@ def user_update( # Ensure compatibility and sufficiently complex password assert_password_is_compatible(change_password) - assert_password_is_strong_enough("user", change_password) # FIXME FIXME FIXME : gotta use admin profile if user is admin + is_admin = "cn=admins,ou=groups,dc=yunohost,dc=org" in result["memberOf"] + assert_password_is_strong_enough("admin" if is_admin else "user", change_password) new_attr_dict["userPassword"] = [_hash_user_password(change_password)] env_dict["YNH_USER_PASSWORD"] = change_password From 98bd15ebf288fbe89eb77ec38873408be930bb94 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Mon, 5 Sep 2022 18:37:22 +0200 Subject: [PATCH 099/174] admins: moaaar fixes, moaaar --- src/migrations/0026_new_admins_group.py | 16 ++++++++++------ src/tests/test_user-group.py | 2 +- src/user.py | 2 +- 3 files changed, 12 insertions(+), 8 deletions(-) diff --git a/src/migrations/0026_new_admins_group.py b/src/migrations/0026_new_admins_group.py index 227a30730..c1ba5b638 100644 --- a/src/migrations/0026_new_admins_group.py +++ b/src/migrations/0026_new_admins_group.py @@ -24,7 +24,7 @@ class MyMigration(Migration): @Migration.ldap_migration def run(self, *args): - from yunohost.user import user_list, user_info, user_group_update + from yunohost.user import user_list, user_info, user_group_update, user_update from yunohost.utils.ldap import _get_ldap_interface ldap = _get_ldap_interface() @@ -36,7 +36,9 @@ class MyMigration(Migration): new_admin_user = user break - if not new_admin_user: + # NB: we handle the edge-case where no user exist at all + # which is useful for the CI etc. + if all_users and not new_admin_user: new_admin_user = os.environ.get("YNH_NEW_ADMIN_USER") if new_admin_user: assert new_admin_user in all_users, f"{new_admin_user} is not an existing yunohost user" @@ -52,10 +54,11 @@ yunohost tools migrations run""", self.ldap_migration_started = True - aliases = user_info(new_admin_user).get("mail-aliases", []) - old_admin_aliases_to_remove = [alias for alias in aliases if any(alias.startswith(a) for a in ["root@", "admin@", "admins@", "webmaster@", "postmaster@", "abuse@"])] + if new_admin_user: + aliases = user_info(new_admin_user).get("mail-aliases", []) + old_admin_aliases_to_remove = [alias for alias in aliases if any(alias.startswith(a) for a in ["root@", "admin@", "admins@", "webmaster@", "postmaster@", "abuse@"])] - user_update(new_admin_user, remove_mailalias=old_admin_aliases_to_remove) + user_update(new_admin_user, remove_mailalias=old_admin_aliases_to_remove) stuff_to_delete = [ "cn=admin,ou=sudo", @@ -88,7 +91,8 @@ yunohost tools migrations run""", } ) - user_group_update(groupname="admins", add=new_admin_user, sync_perm=True) + if new_admin_user: + user_group_update(groupname="admins", add=new_admin_user, sync_perm=True) def run_after_system_restore(self): self.run() diff --git a/src/tests/test_user-group.py b/src/tests/test_user-group.py index 30bb89162..1a368ceac 100644 --- a/src/tests/test_user-group.py +++ b/src/tests/test_user-group.py @@ -28,7 +28,7 @@ def clean_user_groups(): user_delete(u, purge=True) for g in user_group_list()["groups"]: - if g not in ["all_users", "visitors"]: + if g not in ["all_users", "visitors", "admins"]: user_group_delete(g) diff --git a/src/user.py b/src/user.py index 3b980e89e..1f6cbc5c8 100644 --- a/src/user.py +++ b/src/user.py @@ -425,7 +425,7 @@ def user_update( # Ensure compatibility and sufficiently complex password assert_password_is_compatible(change_password) - is_admin = "cn=admins,ou=groups,dc=yunohost,dc=org" in result["memberOf"] + is_admin = "cn=admins,ou=groups,dc=yunohost,dc=org" in user["memberOf"] assert_password_is_strong_enough("admin" if is_admin else "user", change_password) new_attr_dict["userPassword"] = [_hash_user_password(change_password)] From fc14f64821bece00a25d7ac2e09c43e05e42757d Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 6 Sep 2022 00:35:10 +0200 Subject: [PATCH 100/174] admins: moar friskies? --- locales/en.json | 1 + src/authenticators/ldap_admin.py | 24 +++++++++++--- src/tests/test_ldapauth.py | 55 ++++++++++++++++++++++++++------ src/utils/ldap.py | 2 ++ 4 files changed, 68 insertions(+), 14 deletions(-) diff --git a/locales/en.json b/locales/en.json index c7f3d0085..74b62408e 100644 --- a/locales/en.json +++ b/locales/en.json @@ -429,6 +429,7 @@ "invalid_number_min": "Must be greater than {min}", "invalid_password": "Invalid password", "invalid_regex": "Invalid regex:'{regex}'", + "invalid_credentials": "Invalid password or username", "ip6tables_unavailable": "You cannot play with ip6tables here. You are either in a container or your kernel does not support it", "iptables_unavailable": "You cannot play with iptables here. You are either in a container or your kernel does not support it", "ldap_attribute_already_exists": "LDAP attribute '{attribute}' already exists with value '{value}'", diff --git a/src/authenticators/ldap_admin.py b/src/authenticators/ldap_admin.py index 31b2a7363..704816460 100644 --- a/src/authenticators/ldap_admin.py +++ b/src/authenticators/ldap_admin.py @@ -17,7 +17,7 @@ session_secret = random_ascii() logger = logging.getLogger("yunohost.authenticators.ldap_admin") LDAP_URI = "ldap://localhost:389" -ADMIN_GROUP = "cn=admins,ou=groups,dc=yunohost,dc=org" +ADMIN_GROUP = "cn=admins,ou=groups" AUTH_DN = "uid={uid},ou=users,dc=yunohost,dc=org" class Authenticator(BaseAuthenticator): @@ -29,11 +29,27 @@ class Authenticator(BaseAuthenticator): def _authenticate_credentials(self, credentials=None): - admins = _get_ldap_interface().search(ADMIN_GROUP, attrs=["memberUid"])[0]["memberUid"] + try: + admins = _get_ldap_interface().search(ADMIN_GROUP, attrs=["memberUid"])[0].get("memberUid", []) + except ldap.SERVER_DOWN: + # ldap is down, attempt to restart it before really failing + logger.warning(m18n.n("ldap_server_is_down_restart_it")) + os.system("systemctl restart slapd") + time.sleep(10) # waits 10 secondes so we are sure that slapd has restarted - uid, password = credentials.split(":", 1) + try: + admins = _get_ldap_interface().search(ADMIN_GROUP, attrs=["memberUid"])[0].get("memberUid", []) + except ldap.SERVER_DOWN: + raise YunohostError("ldap_server_down") - if uid not in admins: + try: + uid, password = credentials.split(":", 1) + except ValueError: + raise YunohostError("invalid_credentials") + + # Here we're explicitly using set() which are handled as hash tables + # and should prevent timing attacks to find out the admin usernames? + if uid not in set(admins): raise YunohostError("invalid_credentials") dn = AUTH_DN.format(uid=uid) diff --git a/src/tests/test_ldapauth.py b/src/tests/test_ldapauth.py index 7a09fff40..5e741fe0f 100644 --- a/src/tests/test_ldapauth.py +++ b/src/tests/test_ldapauth.py @@ -3,6 +3,8 @@ import os from yunohost.authenticators.ldap_admin import Authenticator as LDAPAuth from yunohost.tools import tools_rootpw +from yunohost.user import user_create, user_list, user_update, user_delete +from yunohost.domain import _get_maindomain from moulinette import m18n from moulinette.core import MoulinetteError @@ -10,19 +12,52 @@ from moulinette.core import MoulinetteError def setup_function(function): + for u in user_list()["users"]: + user_delete(u, purge=True) + + maindomain = _get_maindomain() + if os.system("systemctl is-active slapd") != 0: os.system("systemctl start slapd && sleep 3") - tools_rootpw("yunohost", check_strength=False) + user_create("alice", "Alice", "White", maindomain, "Yunohost", admin=True) + user_create("bob", "Bob", "Snow", maindomain, "test123Ynh") + + +def teardown_function(): + + os.system("systemctl is-active slapd || systemctl start slapd && sleep 5") + + for u in user_list()["users"]: + user_delete(u, purge=True) def test_authenticate(): - LDAPAuth().authenticate_credentials(credentials="yunohost") + LDAPAuth().authenticate_credentials(credentials="alice:Yunohost") + + +def test_authenticate_with_no_user(): + + with pytest.raises(MoulinetteError): + LDAPAuth().authenticate_credentials(credentials="Yunohost") + + with pytest.raises(MoulinetteError): + LDAPAuth().authenticate_credentials(credentials=":Yunohost") + + +def test_authenticate_with_user_who_is_not_admin(): + + with pytest.raises(MoulinetteError) as exception: + LDAPAuth().authenticate_credentials(credentials="bob:test123Ynh") + + translation = m18n.n("invalid_password") + expected_msg = translation.format() + assert expected_msg in str(exception) def test_authenticate_with_wrong_password(): with pytest.raises(MoulinetteError) as exception: - LDAPAuth().authenticate_credentials(credentials="bad_password_lul") + LDAPAuth().authenticate_credentials(credentials="alice:bad_password_lul") translation = m18n.n("invalid_password") expected_msg = translation.format() @@ -30,17 +65,15 @@ def test_authenticate_with_wrong_password(): def test_authenticate_server_down(mocker): - os.system("systemctl stop slapd && sleep 3") + os.system("systemctl stop slapd && sleep 5") # Now if slapd is down, moulinette tries to restart it mocker.patch("os.system") mocker.patch("time.sleep") with pytest.raises(MoulinetteError) as exception: - LDAPAuth().authenticate_credentials(credentials="yunohost") + LDAPAuth().authenticate_credentials(credentials="alice:Yunohost") - translation = m18n.n("ldap_server_down") - expected_msg = translation.format() - assert expected_msg in str(exception) + assert "Unable to reach LDAP server" in str(exception) def test_authenticate_change_password(): @@ -50,10 +83,12 @@ def test_authenticate_change_password(): tools_rootpw("plopette", check_strength=False) with pytest.raises(MoulinetteError) as exception: - LDAPAuth().authenticate_credentials(credentials="yunohost") + LDAPAuth().authenticate_credentials(credentials="alice:Yunohost") translation = m18n.n("invalid_password") expected_msg = translation.format() assert expected_msg in str(exception) - LDAPAuth().authenticate_credentials(credentials="plopette") + user_update("alice", password="plopette") + + LDAPAuth().authenticate_credentials(credentials="alice:plopette") diff --git a/src/utils/ldap.py b/src/utils/ldap.py index 98c0fecf7..28ff8eebe 100644 --- a/src/utils/ldap.py +++ b/src/utils/ldap.py @@ -145,6 +145,8 @@ class LDAPInterface: try: result = self.con.search_s(base, ldap.SCOPE_SUBTREE, filter, attrs) + except ldap.SERVER_DOWN as e: + raise e except Exception as e: raise MoulinetteError( "error during LDAP search operation with: base='%s', " From 102c6225ce5005acf28999167c0a5151760d83d8 Mon Sep 17 00:00:00 2001 From: yalh76 Date: Wed, 7 Sep 2022 07:22:04 +0200 Subject: [PATCH 101/174] Implement docker-image-extract --- helpers/utils | 43 +++-- helpers/vendor/docker-image-extract | 254 ++++++++++++++++++++++++++++ 2 files changed, 281 insertions(+), 16 deletions(-) create mode 100644 helpers/vendor/docker-image-extract diff --git a/helpers/utils b/helpers/utils index 60cbedb5c..94c373a24 100644 --- a/helpers/utils +++ b/helpers/utils @@ -86,6 +86,8 @@ ynh_abort_if_errors() { # # (Optional) If it set as false don't extract the source. Default: true # # (Useful to get a debian package or a python wheel.) # SOURCE_EXTRACT=(true|false) +# # (Optionnal) Name of the plateform. Default: "linux/$YNH_ARCH" +# SOURCE_FILENAME=linux/arm64/v8 # ``` # # The helper will: @@ -119,9 +121,10 @@ ynh_setup_source() { local src_sum=$(grep 'SOURCE_SUM=' "$src_file_path" | cut --delimiter='=' --fields=2-) local src_sumprg=$(grep 'SOURCE_SUM_PRG=' "$src_file_path" | cut --delimiter='=' --fields=2-) local src_format=$(grep 'SOURCE_FORMAT=' "$src_file_path" | cut --delimiter='=' --fields=2-) - local src_extract=$(grep 'SOURCE_EXTRACT=' "$src_file_path" | cut --delimiter='=' --fields=2-) local src_in_subdir=$(grep 'SOURCE_IN_SUBDIR=' "$src_file_path" | cut --delimiter='=' --fields=2-) local src_filename=$(grep 'SOURCE_FILENAME=' "$src_file_path" | cut --delimiter='=' --fields=2-) + local src_extract=$(grep 'SOURCE_EXTRACT=' "$src_file_path" | cut --delimiter='=' --fields=2-) + local src_plateform=$(grep 'SOURCE_PLATFORM=' "$src_file_path" | cut --delimiter='=' --fields=2-) # Default value src_sumprg=${src_sumprg:-sha256sum} @@ -139,24 +142,28 @@ ynh_setup_source() { mkdir -p /var/cache/yunohost/download/${YNH_APP_ID}/ src_filename="/var/cache/yunohost/download/${YNH_APP_ID}/${src_filename}" - if test -e "$local_src"; then - cp $local_src $src_filename + if [ "$src_format" = "docker" ]; then + src_plateform="${src_plateform:-"linux/$YNH_ARCH"}" else - [ -n "$src_url" ] || ynh_die "Couldn't parse SOURCE_URL from $src_file_path ?" - - # NB. we have to declare the var as local first, - # otherwise 'local foo=$(false) || echo 'pwet'" does'nt work - # because local always return 0 ... - local out - # Timeout option is here to enforce the timeout on dns query and tcp connect (c.f. man wget) - out=$(wget --tries 3 --no-dns-cache --timeout 900 --no-verbose --output-document=$src_filename $src_url 2>&1) \ - || ynh_die --message="$out" + if test -e "$local_src"; then + cp $local_src $src_filename + else + [ -n "$src_url" ] || ynh_die "Couldn't parse SOURCE_URL from $src_file_path ?" + + # NB. we have to declare the var as local first, + # otherwise 'local foo=$(false) || echo 'pwet'" does'nt work + # because local always return 0 ... + local out + # Timeout option is here to enforce the timeout on dns query and tcp connect (c.f. man wget) + out=$(wget --tries 3 --no-dns-cache --timeout 900 --no-verbose --output-document=$src_filename $src_url 2>&1) \ + || ynh_die --message="$out" + fi + + # Check the control sum + echo "${src_sum} ${src_filename}" | ${src_sumprg} --check --status \ + || ynh_die --message="Corrupt source" fi - # Check the control sum - echo "${src_sum} ${src_filename}" | ${src_sumprg} --check --status \ - || ynh_die --message="Corrupt source" - # Keep files to be backup/restored at the end of the helper # Assuming $dest_dir already exists rm -rf /var/cache/yunohost/files_to_keep_during_setup_source/ @@ -181,6 +188,10 @@ ynh_setup_source() { if ! "$src_extract"; then mv $src_filename $dest_dir + elif [ "$src_format" = "docker" ]; then + /usr/share/yunohost/helpers.d/vendor/docker-image-extract -p $src_plateform -o $src_filename $src_url 2>&1 + mv $src_filename $dest_dir + ynh_secure_remove --file="$src_filename" elif [ "$src_format" = "zip" ]; then # Zip format # Using of a temp directory, because unzip doesn't manage --strip-components diff --git a/helpers/vendor/docker-image-extract b/helpers/vendor/docker-image-extract new file mode 100644 index 000000000..50a9751bd --- /dev/null +++ b/helpers/vendor/docker-image-extract @@ -0,0 +1,254 @@ +#!/bin/sh +# +# This script pulls and extracts all files from an image in Docker Hub. +# +# Copyright (c) 2020-2022, Jeremy Lin +# +# Permission is hereby granted, free of charge, to any person obtaining a +# copy of this software and associated documentation files (the "Software"), +# to deal in the Software without restriction, including without limitation +# the rights to use, copy, modify, merge, publish, distribute, sublicense, +# and/or sell copies of the Software, and to permit persons to whom the +# Software is furnished to do so, subject to the following conditions: +# +# The above copyright notice and this permission notice shall be included in +# all copies or substantial portions of the Software. +# +# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING +# FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER +# DEALINGS IN THE SOFTWARE. + +PLATFORM_DEFAULT="linux/amd64" +PLATFORM="${PLATFORM_DEFAULT}" +OUT_DIR="./output" + +usage() { + echo "This script pulls and extracts all files from an image in Docker Hub." + echo + echo "$0 [OPTIONS...] IMAGE[:REF]" + echo + echo "IMAGE can be a community user image (like 'some-user/some-image') or a" + echo "Docker official image (like 'hello-world', which contains no '/')." + echo + echo "REF is either a tag name or a full SHA-256 image digest (with a 'sha256:' prefix)." + echo + echo "Options:" + echo + echo " -p PLATFORM Pull image for the specified platform (default: ${PLATFORM})" + echo " For a given image on Docker Hub, the 'Tags' tab lists the" + echo " platforms supported for that image." + echo " -o OUT_DIR Extract image to the specified output dir (default: ${OUT_DIR})" + echo " -h Show help with usage examples" +} + +usage_detailed() { + usage + echo + echo "Examples:" + echo + echo "# Pull and extract all files in the 'hello-world' image tagged 'latest'." + echo "\$ $0 hello-world:latest" + echo + echo "# Same as above; ref defaults to the 'latest' tag." + echo "\$ $0 hello-world" + echo + echo "# Pull the 'hello-world' image for the 'linux/arm64/v8' platform." + echo "\$ $0 -p linux/arm64/v8 hello-world" + echo + echo "# Pull an image by digest." + echo "\$ $0 hello-world:sha256:90659bf80b44ce6be8234e6ff90a1ac34acbeb826903b02cfa0da11c82cbc042" +} + +if [ $# -eq 0 ]; then + usage_detailed + exit 0 +fi + +while getopts ':ho:p:' opt; do + case $opt in + o) + OUT_DIR="${OPTARG}" + ;; + p) + PLATFORM="${OPTARG}" + ;; + h) + usage_detailed + exit 0 + ;; + \?) + echo "ERROR: Invalid option '-$OPTARG'" + echo + usage + exit 1 + ;; + \:) echo "ERROR: Argument required for option '-$OPTARG'" + echo + usage + exit 1 + ;; + esac +done +shift $(($OPTIND - 1)) + +have_curl() { + command -v curl >/dev/null +} + +have_wget() { + command -v wget >/dev/null +} + +if ! have_curl && ! have_wget; then + echo "This script requires either curl or wget." + exit 1 +fi + +image_spec="$1" +image="${image_spec%%:*}" +if [ "${image#*/}" = "${image}" ]; then + # Docker official images are in the 'library' namespace. + image="library/${image}" +fi +ref="${image_spec#*:}" +if [ "${ref}" = "${image_spec}" ]; then + echo "Defaulting ref to tag 'latest'..." + ref=latest +fi + +# Split platform (OS/arch/variant) into separate variables. +# A platform specifier doesn't always include the `variant` component. +OLD_IFS="${IFS}" +IFS=/ read -r OS ARCH VARIANT <":"" (assumes key/val won't contain double quotes). + # The colon may have whitespace on either side. + grep -o "\"${key}\"[[:space:]]*:[[:space:]]*\"[^\"]\+\"" | + # Extract just by deleting the last '"', and then greedily deleting + # everything up to '"'. + sed -e 's/"$//' -e 's/.*"//' +} + +# Fetch a URL to stdout. Up to two header arguments may be specified: +# +# fetch [name1: value1] [name2: value2] +# +fetch() { + if have_curl; then + if [ $# -eq 2 ]; then + set -- -H "$2" "$1" + elif [ $# -eq 3 ]; then + set -- -H "$2" -H "$3" "$1" + fi + curl -sSL "$@" + else + if [ $# -eq 2 ]; then + set -- --header "$2" "$1" + elif [ $# -eq 3 ]; then + set -- --header "$2" --header "$3" "$1" + fi + wget -qO- "$@" + fi +} + +# https://docs.docker.com/docker-hub/api/latest/#tag/repositories +manifest_list_url="https://hub.docker.com/v2/repositories/${image}/tags/${ref}" + +# If we're pulling the image for the default platform, or the ref is already +# a SHA-256 image digest, then we don't need to look up anything. +if [ "${PLATFORM}" = "${PLATFORM_DEFAULT}" ] || [ -z "${ref##sha256:*}" ]; then + digest="${ref}" +else + echo "Getting multi-arch manifest list..." + digest=$(fetch "${manifest_list_url}" | + # Break up the single-line JSON output into separate lines by adding + # newlines before and after the chars '[', ']', '{', and '}'. + sed -e 's/\([][{}]\)/\n\1\n/g' | + # Extract the "images":[...] list. + sed -n '/"images":/,/]/ p' | + # Each image's details are now on a separate line, e.g. + # "architecture":"arm64","features":"","variant":"v8","digest":"sha256:054c85801c4cb41511b176eb0bf13a2c4bbd41611ddd70594ec3315e88813524","os":"linux","os_features":"","os_version":null,"size":828724,"status":"active","last_pulled":"2022-09-02T22:46:48.240632Z","last_pushed":"2022-09-02T00:42:45.69226Z" + # The image details are interspersed with lines of stray punctuation, + # so grep for an arbitrary string that must be in these lines. + grep architecture | + # Search for an image that matches the platform. + while read -r image; do + # Arch is probably most likely to be unique, so check that first. + arch="$(echo ${image} | extract 'architecture')" + if [ "${arch}" != "${ARCH}" ]; then continue; fi + + os="$(echo ${image} | extract 'os')" + if [ "${os}" != "${OS}" ]; then continue; fi + + variant="$(echo ${image} | extract 'variant')" + if [ "${variant}" = "${VARIANT}" ]; then + echo ${image} | extract 'digest' + break + fi + done) +fi + +if [ -n "${digest}" ]; then + echo "Platform ${PLATFORM} resolved to '${digest}'..." +else + echo "No image digest found. Verify that the image, ref, and platform are valid." + exit 1 +fi + +# https://docs.docker.com/registry/spec/auth/token/#how-to-authenticate +api_token_url="https://auth.docker.io/token?service=registry.docker.io&scope=repository:$image:pull" + +# https://github.com/docker/distribution/blob/master/docs/spec/api.md#pulling-an-image-manifest +manifest_url="https://registry-1.docker.io/v2/${image}/manifests/${digest}" + +# https://github.com/docker/distribution/blob/master/docs/spec/api.md#pulling-a-layer +blobs_base_url="https://registry-1.docker.io/v2/${image}/blobs" + +echo "Getting API token..." +token=$(fetch "${api_token_url}" | extract 'token') +auth_header="Authorization: Bearer $token" +v2_header="Accept: application/vnd.docker.distribution.manifest.v2+json" + +echo "Getting image manifest for $image:$ref..." +layers=$(fetch "${manifest_url}" "${auth_header}" "${v2_header}" | + # Extract `digest` values only after the `layers` section appears. + sed -n '/"layers":/,$ p' | + extract 'digest') + +if [ -z "${layers}" ]; then + echo "No layers returned. Verify that the image and ref are valid." + exit 1 +fi + +mkdir -p "${OUT_DIR}" + +for layer in $layers; do + hash="${layer#sha256:}" + echo "Fetching and extracting layer ${hash}..." + fetch "${blobs_base_url}/${layer}" "${auth_header}" | gzip -d | tar -C "${OUT_DIR}" -xf - + # Ref: https://github.com/moby/moby/blob/master/image/spec/v1.2.md#creating-an-image-filesystem-changeset + # https://github.com/moby/moby/blob/master/pkg/archive/whiteouts.go + # Search for "whiteout" files to indicate files deleted in this layer. + OLD_IFS="${IFS}" + find "${OUT_DIR}" -name '.wh.*' | while IFS= read -r f; do + dir="${f%/*}" + wh_file="${f##*/}" + file="${wh_file#.wh.}" + # Delete both the whiteout file and the whited-out file. + rm -rf "${dir}/${wh_file}" "${dir}/${file}" + done + IFS="${OLD_IFS}" +done + +echo "Image contents extracted into ${OUT_DIR}." From 7695dede06e98e773c97178c349b0df2b3a3edc4 Mon Sep 17 00:00:00 2001 From: yalh76 Date: Wed, 7 Sep 2022 07:44:25 +0200 Subject: [PATCH 102/174] chmod +x --- helpers/vendor/docker-image-extract | 1 + 1 file changed, 1 insertion(+) diff --git a/helpers/vendor/docker-image-extract b/helpers/vendor/docker-image-extract index 50a9751bd..55fbac92b 100644 --- a/helpers/vendor/docker-image-extract +++ b/helpers/vendor/docker-image-extract @@ -1,4 +1,5 @@ #!/bin/sh + # # This script pulls and extracts all files from an image in Docker Hub. # From 96d40556dddab0639c536c65a622c2c2e6fae8fa Mon Sep 17 00:00:00 2001 From: yalh76 Date: Wed, 7 Sep 2022 08:04:47 +0200 Subject: [PATCH 103/174] Simplification --- helpers/utils | 6 ++---- helpers/vendor/docker-image-extract | 1 - 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/helpers/utils b/helpers/utils index 94c373a24..71e7d2b37 100644 --- a/helpers/utils +++ b/helpers/utils @@ -132,7 +132,7 @@ ynh_setup_source() { src_format=${src_format:-tar.gz} src_format=$(echo "$src_format" | tr '[:upper:]' '[:lower:]') src_extract=${src_extract:-true} - if [ "$src_filename" = "" ]; then + if [[ "$src_filename" = "" && "$src_format" != "docker" ]]; then src_filename="${source_id}.${src_format}" fi @@ -189,9 +189,7 @@ ynh_setup_source() { if ! "$src_extract"; then mv $src_filename $dest_dir elif [ "$src_format" = "docker" ]; then - /usr/share/yunohost/helpers.d/vendor/docker-image-extract -p $src_plateform -o $src_filename $src_url 2>&1 - mv $src_filename $dest_dir - ynh_secure_remove --file="$src_filename" + /usr/share/yunohost/helpers.d/vendor/docker-image-extract -p $src_plateform -o $dest_dir $src_url 2>&1 elif [ "$src_format" = "zip" ]; then # Zip format # Using of a temp directory, because unzip doesn't manage --strip-components diff --git a/helpers/vendor/docker-image-extract b/helpers/vendor/docker-image-extract index 55fbac92b..50a9751bd 100644 --- a/helpers/vendor/docker-image-extract +++ b/helpers/vendor/docker-image-extract @@ -1,5 +1,4 @@ #!/bin/sh - # # This script pulls and extracts all files from an image in Docker Hub. # From d0a0a8a9c999f54bca9aafe33cd29ad38c91c6ed Mon Sep 17 00:00:00 2001 From: yalh76 Date: Wed, 7 Sep 2022 08:12:13 +0200 Subject: [PATCH 104/174] Made myFile executable --- helpers/vendor/docker-image-extract | 1 + 1 file changed, 1 insertion(+) mode change 100644 => 100755 helpers/vendor/docker-image-extract diff --git a/helpers/vendor/docker-image-extract b/helpers/vendor/docker-image-extract old mode 100644 new mode 100755 index 50a9751bd..55fbac92b --- a/helpers/vendor/docker-image-extract +++ b/helpers/vendor/docker-image-extract @@ -1,4 +1,5 @@ #!/bin/sh + # # This script pulls and extracts all files from an image in Docker Hub. # From 59dbeac5be097f9b49ca533036c697fd37ec009b Mon Sep 17 00:00:00 2001 From: yalh76 Date: Wed, 7 Sep 2022 19:37:20 +0200 Subject: [PATCH 105/174] Update helpers/utils Co-authored-by: Alexandre Aubin --- helpers/utils | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/helpers/utils b/helpers/utils index 71e7d2b37..466d0e0ac 100644 --- a/helpers/utils +++ b/helpers/utils @@ -87,7 +87,7 @@ ynh_abort_if_errors() { # # (Useful to get a debian package or a python wheel.) # SOURCE_EXTRACT=(true|false) # # (Optionnal) Name of the plateform. Default: "linux/$YNH_ARCH" -# SOURCE_FILENAME=linux/arm64/v8 +# SOURCE_PLATFORM=linux/arm64/v8 # ``` # # The helper will: From 18e4b010f0a2d0ac848d83c4d4a551234ed6a7b6 Mon Sep 17 00:00:00 2001 From: yalh76 Date: Wed, 7 Sep 2022 20:02:40 +0200 Subject: [PATCH 106/174] Improving --- helpers/utils | 27 ++++++++++++--------------- 1 file changed, 12 insertions(+), 15 deletions(-) diff --git a/helpers/utils b/helpers/utils index 71e7d2b37..03f3ff537 100644 --- a/helpers/utils +++ b/helpers/utils @@ -132,7 +132,7 @@ ynh_setup_source() { src_format=${src_format:-tar.gz} src_format=$(echo "$src_format" | tr '[:upper:]' '[:lower:]') src_extract=${src_extract:-true} - if [[ "$src_filename" = "" && "$src_format" != "docker" ]]; then + if [ "$src_filename" = "" ]; then src_filename="${source_id}.${src_format}" fi @@ -144,21 +144,18 @@ ynh_setup_source() { if [ "$src_format" = "docker" ]; then src_plateform="${src_plateform:-"linux/$YNH_ARCH"}" + elif test -e "$local_src"; then + cp $local_src $src_filename else - if test -e "$local_src"; then - cp $local_src $src_filename - else - [ -n "$src_url" ] || ynh_die "Couldn't parse SOURCE_URL from $src_file_path ?" - - # NB. we have to declare the var as local first, - # otherwise 'local foo=$(false) || echo 'pwet'" does'nt work - # because local always return 0 ... - local out - # Timeout option is here to enforce the timeout on dns query and tcp connect (c.f. man wget) - out=$(wget --tries 3 --no-dns-cache --timeout 900 --no-verbose --output-document=$src_filename $src_url 2>&1) \ - || ynh_die --message="$out" - fi - + [ -n "$src_url" ] || ynh_die "Couldn't parse SOURCE_URL from $src_file_path ?" + + # NB. we have to declare the var as local first, + # otherwise 'local foo=$(false) || echo 'pwet'" does'nt work + # because local always return 0 ... + local out + # Timeout option is here to enforce the timeout on dns query and tcp connect (c.f. man wget) + out=$(wget --tries 3 --no-dns-cache --timeout 900 --no-verbose --output-document=$src_filename $src_url 2>&1) \ + || ynh_die --message="$out" # Check the control sum echo "${src_sum} ${src_filename}" | ${src_sumprg} --check --status \ || ynh_die --message="Corrupt source" From 09e3cab52c0a46ce1bd99ffcc38c4c6029d549c8 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Wed, 28 Sep 2022 17:19:50 +0200 Subject: [PATCH 107/174] Move docker-extract helper inside a 'full' vendor folder with LICENSE and README linking to original repo --- helpers/utils | 2 +- helpers/vendor/docker-image-extract | 255 ------------------ helpers/vendor/docker-image-extract/LICENSE | 21 ++ helpers/vendor/docker-image-extract/README.md | 1 + .../vendor/docker-image-extract/extract.sh | 215 +++++++++++++++ 5 files changed, 238 insertions(+), 256 deletions(-) delete mode 100755 helpers/vendor/docker-image-extract create mode 100644 helpers/vendor/docker-image-extract/LICENSE create mode 100644 helpers/vendor/docker-image-extract/README.md create mode 100755 helpers/vendor/docker-image-extract/extract.sh diff --git a/helpers/utils b/helpers/utils index 82c975c00..60d789765 100644 --- a/helpers/utils +++ b/helpers/utils @@ -186,7 +186,7 @@ ynh_setup_source() { if ! "$src_extract"; then mv $src_filename $dest_dir elif [ "$src_format" = "docker" ]; then - /usr/share/yunohost/helpers.d/vendor/docker-image-extract -p $src_plateform -o $dest_dir $src_url 2>&1 + /usr/share/yunohost/helpers.d/vendor/docker-image-extract/docker-image-extract -p $src_plateform -o $dest_dir $src_url 2>&1 elif [ "$src_format" = "zip" ]; then # Zip format # Using of a temp directory, because unzip doesn't manage --strip-components diff --git a/helpers/vendor/docker-image-extract b/helpers/vendor/docker-image-extract deleted file mode 100755 index 55fbac92b..000000000 --- a/helpers/vendor/docker-image-extract +++ /dev/null @@ -1,255 +0,0 @@ -#!/bin/sh - -# -# This script pulls and extracts all files from an image in Docker Hub. -# -# Copyright (c) 2020-2022, Jeremy Lin -# -# Permission is hereby granted, free of charge, to any person obtaining a -# copy of this software and associated documentation files (the "Software"), -# to deal in the Software without restriction, including without limitation -# the rights to use, copy, modify, merge, publish, distribute, sublicense, -# and/or sell copies of the Software, and to permit persons to whom the -# Software is furnished to do so, subject to the following conditions: -# -# The above copyright notice and this permission notice shall be included in -# all copies or substantial portions of the Software. -# -# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING -# FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER -# DEALINGS IN THE SOFTWARE. - -PLATFORM_DEFAULT="linux/amd64" -PLATFORM="${PLATFORM_DEFAULT}" -OUT_DIR="./output" - -usage() { - echo "This script pulls and extracts all files from an image in Docker Hub." - echo - echo "$0 [OPTIONS...] IMAGE[:REF]" - echo - echo "IMAGE can be a community user image (like 'some-user/some-image') or a" - echo "Docker official image (like 'hello-world', which contains no '/')." - echo - echo "REF is either a tag name or a full SHA-256 image digest (with a 'sha256:' prefix)." - echo - echo "Options:" - echo - echo " -p PLATFORM Pull image for the specified platform (default: ${PLATFORM})" - echo " For a given image on Docker Hub, the 'Tags' tab lists the" - echo " platforms supported for that image." - echo " -o OUT_DIR Extract image to the specified output dir (default: ${OUT_DIR})" - echo " -h Show help with usage examples" -} - -usage_detailed() { - usage - echo - echo "Examples:" - echo - echo "# Pull and extract all files in the 'hello-world' image tagged 'latest'." - echo "\$ $0 hello-world:latest" - echo - echo "# Same as above; ref defaults to the 'latest' tag." - echo "\$ $0 hello-world" - echo - echo "# Pull the 'hello-world' image for the 'linux/arm64/v8' platform." - echo "\$ $0 -p linux/arm64/v8 hello-world" - echo - echo "# Pull an image by digest." - echo "\$ $0 hello-world:sha256:90659bf80b44ce6be8234e6ff90a1ac34acbeb826903b02cfa0da11c82cbc042" -} - -if [ $# -eq 0 ]; then - usage_detailed - exit 0 -fi - -while getopts ':ho:p:' opt; do - case $opt in - o) - OUT_DIR="${OPTARG}" - ;; - p) - PLATFORM="${OPTARG}" - ;; - h) - usage_detailed - exit 0 - ;; - \?) - echo "ERROR: Invalid option '-$OPTARG'" - echo - usage - exit 1 - ;; - \:) echo "ERROR: Argument required for option '-$OPTARG'" - echo - usage - exit 1 - ;; - esac -done -shift $(($OPTIND - 1)) - -have_curl() { - command -v curl >/dev/null -} - -have_wget() { - command -v wget >/dev/null -} - -if ! have_curl && ! have_wget; then - echo "This script requires either curl or wget." - exit 1 -fi - -image_spec="$1" -image="${image_spec%%:*}" -if [ "${image#*/}" = "${image}" ]; then - # Docker official images are in the 'library' namespace. - image="library/${image}" -fi -ref="${image_spec#*:}" -if [ "${ref}" = "${image_spec}" ]; then - echo "Defaulting ref to tag 'latest'..." - ref=latest -fi - -# Split platform (OS/arch/variant) into separate variables. -# A platform specifier doesn't always include the `variant` component. -OLD_IFS="${IFS}" -IFS=/ read -r OS ARCH VARIANT <":"" (assumes key/val won't contain double quotes). - # The colon may have whitespace on either side. - grep -o "\"${key}\"[[:space:]]*:[[:space:]]*\"[^\"]\+\"" | - # Extract just by deleting the last '"', and then greedily deleting - # everything up to '"'. - sed -e 's/"$//' -e 's/.*"//' -} - -# Fetch a URL to stdout. Up to two header arguments may be specified: -# -# fetch [name1: value1] [name2: value2] -# -fetch() { - if have_curl; then - if [ $# -eq 2 ]; then - set -- -H "$2" "$1" - elif [ $# -eq 3 ]; then - set -- -H "$2" -H "$3" "$1" - fi - curl -sSL "$@" - else - if [ $# -eq 2 ]; then - set -- --header "$2" "$1" - elif [ $# -eq 3 ]; then - set -- --header "$2" --header "$3" "$1" - fi - wget -qO- "$@" - fi -} - -# https://docs.docker.com/docker-hub/api/latest/#tag/repositories -manifest_list_url="https://hub.docker.com/v2/repositories/${image}/tags/${ref}" - -# If we're pulling the image for the default platform, or the ref is already -# a SHA-256 image digest, then we don't need to look up anything. -if [ "${PLATFORM}" = "${PLATFORM_DEFAULT}" ] || [ -z "${ref##sha256:*}" ]; then - digest="${ref}" -else - echo "Getting multi-arch manifest list..." - digest=$(fetch "${manifest_list_url}" | - # Break up the single-line JSON output into separate lines by adding - # newlines before and after the chars '[', ']', '{', and '}'. - sed -e 's/\([][{}]\)/\n\1\n/g' | - # Extract the "images":[...] list. - sed -n '/"images":/,/]/ p' | - # Each image's details are now on a separate line, e.g. - # "architecture":"arm64","features":"","variant":"v8","digest":"sha256:054c85801c4cb41511b176eb0bf13a2c4bbd41611ddd70594ec3315e88813524","os":"linux","os_features":"","os_version":null,"size":828724,"status":"active","last_pulled":"2022-09-02T22:46:48.240632Z","last_pushed":"2022-09-02T00:42:45.69226Z" - # The image details are interspersed with lines of stray punctuation, - # so grep for an arbitrary string that must be in these lines. - grep architecture | - # Search for an image that matches the platform. - while read -r image; do - # Arch is probably most likely to be unique, so check that first. - arch="$(echo ${image} | extract 'architecture')" - if [ "${arch}" != "${ARCH}" ]; then continue; fi - - os="$(echo ${image} | extract 'os')" - if [ "${os}" != "${OS}" ]; then continue; fi - - variant="$(echo ${image} | extract 'variant')" - if [ "${variant}" = "${VARIANT}" ]; then - echo ${image} | extract 'digest' - break - fi - done) -fi - -if [ -n "${digest}" ]; then - echo "Platform ${PLATFORM} resolved to '${digest}'..." -else - echo "No image digest found. Verify that the image, ref, and platform are valid." - exit 1 -fi - -# https://docs.docker.com/registry/spec/auth/token/#how-to-authenticate -api_token_url="https://auth.docker.io/token?service=registry.docker.io&scope=repository:$image:pull" - -# https://github.com/docker/distribution/blob/master/docs/spec/api.md#pulling-an-image-manifest -manifest_url="https://registry-1.docker.io/v2/${image}/manifests/${digest}" - -# https://github.com/docker/distribution/blob/master/docs/spec/api.md#pulling-a-layer -blobs_base_url="https://registry-1.docker.io/v2/${image}/blobs" - -echo "Getting API token..." -token=$(fetch "${api_token_url}" | extract 'token') -auth_header="Authorization: Bearer $token" -v2_header="Accept: application/vnd.docker.distribution.manifest.v2+json" - -echo "Getting image manifest for $image:$ref..." -layers=$(fetch "${manifest_url}" "${auth_header}" "${v2_header}" | - # Extract `digest` values only after the `layers` section appears. - sed -n '/"layers":/,$ p' | - extract 'digest') - -if [ -z "${layers}" ]; then - echo "No layers returned. Verify that the image and ref are valid." - exit 1 -fi - -mkdir -p "${OUT_DIR}" - -for layer in $layers; do - hash="${layer#sha256:}" - echo "Fetching and extracting layer ${hash}..." - fetch "${blobs_base_url}/${layer}" "${auth_header}" | gzip -d | tar -C "${OUT_DIR}" -xf - - # Ref: https://github.com/moby/moby/blob/master/image/spec/v1.2.md#creating-an-image-filesystem-changeset - # https://github.com/moby/moby/blob/master/pkg/archive/whiteouts.go - # Search for "whiteout" files to indicate files deleted in this layer. - OLD_IFS="${IFS}" - find "${OUT_DIR}" -name '.wh.*' | while IFS= read -r f; do - dir="${f%/*}" - wh_file="${f##*/}" - file="${wh_file#.wh.}" - # Delete both the whiteout file and the whited-out file. - rm -rf "${dir}/${wh_file}" "${dir}/${file}" - done - IFS="${OLD_IFS}" -done - -echo "Image contents extracted into ${OUT_DIR}." diff --git a/helpers/vendor/docker-image-extract/LICENSE b/helpers/vendor/docker-image-extract/LICENSE new file mode 100644 index 000000000..82579b059 --- /dev/null +++ b/helpers/vendor/docker-image-extract/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2021 Emmanuel Frecon + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/helpers/vendor/docker-image-extract/README.md b/helpers/vendor/docker-image-extract/README.md new file mode 100644 index 000000000..6f6cb5074 --- /dev/null +++ b/helpers/vendor/docker-image-extract/README.md @@ -0,0 +1 @@ +This is taken from https://github.com/efrecon/docker-image-extract diff --git a/helpers/vendor/docker-image-extract/extract.sh b/helpers/vendor/docker-image-extract/extract.sh new file mode 100755 index 000000000..cab06cb53 --- /dev/null +++ b/helpers/vendor/docker-image-extract/extract.sh @@ -0,0 +1,215 @@ +#!/bin/sh + +# If editing from Windows. Choose LF as line-ending + + +set -eu + + +# Set this to 1 for more verbosity (on stderr) +EXTRACT_VERBOSE=${EXTRACT_VERBOSE:-0} + +# Destination directory, some %-surrounded keywords will be dynamically replaced +# by elements of the fully-qualified image name. +EXTRACT_DEST=${EXTRACT_DEST:-"$(pwd)"} + +# Pull if the image does not exist. If the image had to be pulled, it will +# automatically be removed once done to conserve space. +EXTRACT_PULL=${EXTRACT_PULL:-1} + +# Docker client command to use +EXTRACT_DOCKER=${EXTRACT_DOCKER:-"docker"} + +# Export PATHs to binaries and libraries +EXTRACT_EXPORT=${EXTRACT_EXPORT:-0} + +# Name of manifest file containing the description of the layers +EXTRACT_MANIFEST=${EXTRACT_MANIFEST:-"manifest.json"} + +# This uses the comments behind the options to show the help. Not extremly +# correct, but effective and simple. +usage() { + echo "$0 extracts all layers from a Docker image to a directory, will pull if necessary" && \ + grep "[[:space:]].)\ #" "$0" | + sed 's/#//' | + sed -r 's/([a-z])\)/-\1/' + exit "${1:-0}" +} + +while getopts "t:d:vneh-" opt; do + case "$opt" in + d) # How to run the Docker client + EXTRACT_DOCKER=$OPTARG;; + e) # Print out commands for PATH extraction + EXTRACT_EXPORT=1;; + n) # Do not pull if the image does not exist + EXTRACT_PULL=0;; + h) # Print help and exit + usage;; + t) # Target directory, will be created if necessary, %-surrounded keywords will be resolved (see manual). Default: current directory + EXTRACT_DEST=$OPTARG;; + v) # Turn on verbosity + EXTRACT_VERBOSE=1;; + -) + break;; + *) + usage 1;; + esac +done +shift $((OPTIND-1)) + + +_verbose() { + if [ "$EXTRACT_VERBOSE" = "1" ]; then + printf %s\\n "$1" >&2 + fi +} + +_error() { + printf %s\\n "$1" >&2 +} + + +# This will unfold JSON onliners to arrange for having fields and their values +# on separated lines. It's sed and grep, don't expect miracles, but this should +# work against most well-formatted JSON. +json_unfold() { + sed -E \ + -e 's/\}\s*,\s*\{/\n\},\n\{\n/g' \ + -e 's/\{\s*"/\{\n"/g' \ + -e 's/(.+)\}/\1\n\}/g' \ + -e 's/"\s*:\s*(("[^"]+")|([a-zA-Z0-9]+))\s*([,$])/": \1\4\n/g' \ + -e 's/"\s*:\s*(("[^"]+")|([a-zA-Z0-9]+))\s*\}/": \1\n\}/g' | \ + grep -vEe '^\s*$' +} + +extract() { + # Extract details out of image name + fullname=$1 + tag="" + if printf %s\\n "$1"|grep -Eq '@sha256:[a-f0-9A-F]{64}$'; then + tag=$(printf %s\\n "$1"|grep -Eo 'sha256:[a-f0-9A-F]{64}$') + fullname=$(printf %s\\n "$1"|sed -E 's/(.*)@sha256:[a-f0-9A-F]{64}$/\1/') + elif printf %s\\n "$1"|grep -Eq ':[[:alnum:]_][[:alnum:]_.-]{0,127}$'; then + tag=$(printf %s\\n "$1"|grep -Eo ':[[:alnum:]_][[:alnum:]_.-]{0,127}$'|cut -c 2-) + fullname=$(printf %s\\n "$1"|sed -E 's/(.*):[[:alnum:]_][[:alnum:]_.-]{0,127}$/\1/') + fi + shortname=$(printf %s\\n "$fullname" | awk -F / '{printf $NF}') + fullname_flat=$(printf %s\\n "$fullname" | sed 's~/~_~g') + if [ -z "$tag" ]; then + fullyqualified_flat=$(printf %s_%s\\n "$fullname_flat" "latest") + else + fullyqualified_flat=$(printf %s_%s\\n "$fullname_flat" "$tag") + fi + + # Generate the name of the destination directory, replacing the + # sugared-strings by their values. We use the ~ character as a separator in + # the sed expressions as / might appear in the values. + dst=$(printf %s\\n "$EXTRACT_DEST" | + sed -E \ + -e "s~%tag%~${tag}~" \ + -e "s~%fullname%~${fullname}~" \ + -e "s~%shortname%~${shortname}~" \ + -e "s~%fullname_flat%~${fullname_flat}~" \ + -e "s~%fullyqualified_flat%~${fullyqualified_flat}~" \ + -e "s~%name%~${1}~" \ + ) + + # Pull image on demand, if necessary and when EXTRACT_PULL was set to 1 + imgrm=0 + if ! ${EXTRACT_DOCKER} image inspect "$1" >/dev/null 2>&1 && [ "$EXTRACT_PULL" = "1" ]; then + _verbose "Pulling image '$1', will remove it upon completion" + ${EXTRACT_DOCKER} image pull "$1" + imgrm=1 + fi + + if ${EXTRACT_DOCKER} image inspect "$1" >/dev/null 2>&1 ; then + # Create a temporary directory to store the content of the image itself, i.e. + # the result of docker image save on the image. + TMPD=$(mktemp -t -d image-XXXXX) + + # Extract image to the temporary directory + _verbose "Extracting content of '$1' to temporary storage" + ${EXTRACT_DOCKER} image save "$1" | tar -C "$TMPD" -xf - + + # Create destination directory, if necessary + if ! [ -d "$dst" ]; then + _verbose "Creating destination directory: '$dst' (resolved from '$EXTRACT_DEST')" + mkdir -p "$dst" + fi + + # Extract all layers of the image, in the order specified by the manifest, + # into the destination directory. + if [ -f "${TMPD}/${EXTRACT_MANIFEST}" ]; then + json_unfold < "${TMPD}/${EXTRACT_MANIFEST}" | + grep -oE '[a-fA-F0-9]{64}/[[:alnum:]]+\.tar' | + while IFS= read -r layer; do + _verbose "Extracting layer $(printf %s\\n "$layer" | awk -F '/' '{print $1}')" + tar -C "$dst" -xf "${TMPD}/${layer}" + done + else + _error "Cannot find $EXTRACT_MANIFEST in image content!" + fi + + # Remove temporary content of image save. + rm -rf "$TMPD" + + if [ "$EXTRACT_EXPORT" = "1" ]; then + # Resolve destination directory to absolute path + rdst=$(cd -P -- "$dst" && pwd -P) + for top in "" /usr /usr/local; do + # Add binaries + for sub in /sbin /bin; do + bdir=${rdst%/}${top%/}${sub} + if [ -d "$bdir" ] \ + && [ "$(find "$bdir" -maxdepth 1 -mindepth 1 -type f -executable | wc -l)" -gt "0" ]; then + if [ -z "${GITHUB_PATH+x}" ]; then + BPATH="${bdir}:${BPATH}" + else + printf %s\\n "$bdir" >> "$GITHUB_PATH" + fi + fi + done + + # Add libraries + for sub in /lib; do + ldir=${rdst%/}${top%/}${sub} + if [ -d "$ldir" ] \ + && [ "$(find "$ldir" -maxdepth 1 -mindepth 1 -type f -executable -name '*.so*'| wc -l)" -gt "0" ]; then + LPATH="${ldir}:${LPATH}" + fi + done + done + fi + else + _error "Image $1 not present at Docker daemon" + fi + + if [ "$imgrm" = "1" ]; then + _verbose "Removing image $1 from host" + ${EXTRACT_DOCKER} image rm "$1" + fi +} + +# We need at least one image +if [ "$#" = "0" ]; then + usage +fi + +# Extract all images, one by one, to the target directory +BPATH=$(printf %s\\n "$PATH" | sed 's/ /\\ /g') +LPATH=$(printf %s\\n "${LD_LIBRARY_PATH:-}" | sed 's/ /\\ /g') +for i in "$@"; do + extract "$i" +done + +if [ "$EXTRACT_EXPORT" = "1" ]; then + if [ -z "${GITHUB_PATH+x}" ]; then + printf "PATH=\"%s\"\n" "$BPATH" + if [ -n "$LPATH" ]; then + printf "LD_LIBRARY_PATH=\"%s\"\n" "$LPATH" + fi + elif [ -n "$LPATH" ]; then + printf "LD_LIBRARY_PATH=\"%s\"\n" "$LPATH" >> "$GITHUB_ENV" + fi +fi From 90e3f3235cc8ac63b18571d230c294e089b9305f Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Mon, 7 Feb 2022 18:58:10 +0100 Subject: [PATCH 108/174] configpanels: Quick and dirty POC for config panel actions --- helpers/config | 14 +++++ src/app.py | 144 ++++---------------------------------------- src/utils/config.py | 131 ++++++++++++++++++++++++++++++++++++---- 3 files changed, 146 insertions(+), 143 deletions(-) diff --git a/helpers/config b/helpers/config index c1f8bca32..fce215a30 100644 --- a/helpers/config +++ b/helpers/config @@ -285,6 +285,18 @@ ynh_app_config_apply() { _ynh_app_config_apply } +ynh_app_action_run() { + local runner="run__$1" + # Get value from getter if exists + if type -t "$runner" 2>/dev/null | grep -q '^function$' 2>/dev/null; then + $runner + #ynh_return "result:" + #ynh_return "$(echo "${result}" | sed 's/^/ /g')" + else + ynh_die "No handler defined in app's script for action $1. If you are the maintainer of this app, you should define '$runner'" + fi +} + ynh_app_config_run() { declare -Ag old=() declare -Ag changed=() @@ -309,5 +321,7 @@ ynh_app_config_run() { ynh_app_config_apply ynh_script_progression --message="Configuration of $app completed" --last ;; + *) + ynh_app_action_run $1 esac } diff --git a/src/app.py b/src/app.py index fd70e883e..81557978b 100644 --- a/src/app.py +++ b/src/app.py @@ -1429,90 +1429,16 @@ def app_change_label(app, new_label): def app_action_list(app): - logger.warning(m18n.n("experimental_feature")) - # this will take care of checking if the app is installed - app_info_dict = app_info(app) - - return { - "app": app, - "app_name": app_info_dict["name"], - "actions": _get_app_actions(app), - } + return AppConfigPanel(app).list_actions() @is_unit_operation() -def app_action_run(operation_logger, app, action, args=None): - logger.warning(m18n.n("experimental_feature")) +def app_action_run( + operation_logger, app, action, args=None, args_file=None +): - from yunohost.hook import hook_exec - - # will raise if action doesn't exist - actions = app_action_list(app)["actions"] - actions = {x["id"]: x for x in actions} - - if action not in actions: - available_actions = (", ".join(actions.keys()),) - raise YunohostValidationError( - f"action '{action}' not available for app '{app}', available actions are: {available_actions}", - raw_msg=True, - ) - - operation_logger.start() - - action_declaration = actions[action] - - # Retrieve arguments list for install script - raw_questions = actions[action].get("arguments", {}) - questions = ask_questions_and_parse_answers(raw_questions, prefilled_answers=args) - args = { - question.name: question.value - for question in questions - if question.value is not None - } - - tmp_workdir_for_app = _make_tmp_workdir_for_app(app=app) - - env_dict = _make_environment_for_app_script( - app, args=args, args_prefix="ACTION_", workdir=tmp_workdir_for_app - ) - env_dict["YNH_ACTION"] = action - - _, action_script = tempfile.mkstemp(dir=tmp_workdir_for_app) - - with open(action_script, "w") as script: - script.write(action_declaration["command"]) - - if action_declaration.get("cwd"): - cwd = action_declaration["cwd"].replace("$app", app) - else: - cwd = tmp_workdir_for_app - - try: - retcode = hook_exec( - action_script, - env=env_dict, - chdir=cwd, - user=action_declaration.get("user", "root"), - )[0] - # Calling hook_exec could fail miserably, or get - # manually interrupted (by mistake or because script was stuck) - # In that case we still want to delete the tmp work dir - except (KeyboardInterrupt, EOFError, Exception): - retcode = -1 - import traceback - - logger.error(m18n.n("unexpected_error", error="\n" + traceback.format_exc())) - finally: - shutil.rmtree(tmp_workdir_for_app) - - if retcode not in action_declaration.get("accepted_return_codes", [0]): - msg = f"Error while executing action '{action}' of app '{app}': return code {retcode}" - operation_logger.error(msg) - raise YunohostError(msg, raw_msg=True) - - operation_logger.success() - return logger.success("Action successed!") + return AppConfigPanel(app).run_action(action, args=args, args_file=args_file, operation_logger=operation_logger) def app_config_get(app, key="", full=False, export=False): @@ -1556,6 +1482,10 @@ class AppConfigPanel(ConfigPanel): def _load_current_values(self): self.values = self._call_config_script("show") + def _run_action(self, action): + env = {key: str(value) for key, value in self.new_values.items()} + self._call_config_script(action, env=env) + def _apply(self): env = {key: str(value) for key, value in self.new_values.items()} return_content = self._call_config_script("apply", env=env) @@ -1609,8 +1539,10 @@ ynh_app_config_run $1 if ret != 0: if action == "show": raise YunohostError("app_config_unable_to_read") - else: + elif action == "show": raise YunohostError("app_config_unable_to_apply") + else: + raise YunohostError("app_action_failed", action=action) return values @@ -1619,58 +1551,6 @@ def _get_app_actions(app_id): actions_toml_path = os.path.join(APPS_SETTING_PATH, app_id, "actions.toml") actions_json_path = os.path.join(APPS_SETTING_PATH, app_id, "actions.json") - # sample data to get an idea of what is going on - # this toml extract: - # - - # [restart_service] - # name = "Restart service" - # command = "echo pouet $YNH_ACTION_SERVICE" - # user = "root" # optional - # cwd = "/" # optional - # accepted_return_codes = [0, 1, 2, 3] # optional - # description.en = "a dummy stupid exemple or restarting a service" - # - # [restart_service.arguments.service] - # type = "string", - # ask.en = "service to restart" - # example = "nginx" - # - # will be parsed into this: - # - # OrderedDict([(u'restart_service', - # OrderedDict([(u'name', u'Restart service'), - # (u'command', u'echo pouet $YNH_ACTION_SERVICE'), - # (u'user', u'root'), - # (u'cwd', u'/'), - # (u'accepted_return_codes', [0, 1, 2, 3]), - # (u'description', - # OrderedDict([(u'en', - # u'a dummy stupid exemple or restarting a service')])), - # (u'arguments', - # OrderedDict([(u'service', - # OrderedDict([(u'type', u'string'), - # (u'ask', - # OrderedDict([(u'en', - # u'service to restart')])), - # (u'example', - # u'nginx')]))]))])), - # - # - # and needs to be converted into this: - # - # [{u'accepted_return_codes': [0, 1, 2, 3], - # u'arguments': [{u'ask': {u'en': u'service to restart'}, - # u'example': u'nginx', - # u'name': u'service', - # u'type': u'string'}], - # u'command': u'echo pouet $YNH_ACTION_SERVICE', - # u'cwd': u'/', - # u'description': {u'en': u'a dummy stupid exemple or restarting a service'}, - # u'id': u'restart_service', - # u'name': u'Restart service', - # u'user': u'root'}] - if os.path.exists(actions_toml_path): toml_actions = toml.load(open(actions_toml_path, "r"), _dict=OrderedDict) diff --git a/src/utils/config.py b/src/utils/config.py index ec7faa719..ac317d83c 100644 --- a/src/utils/config.py +++ b/src/utils/config.py @@ -273,6 +273,10 @@ class ConfigPanel: logger.debug(f"Formating result in '{mode}' mode") result = {} for panel, section, option in self._iterate(): + + if section["is_action_section"] and mode != "full": + continue + key = f"{panel['id']}.{section['id']}.{option['id']}" if mode == "export": result[option["id"]] = option.get("current_value") @@ -311,6 +315,82 @@ class ConfigPanel: else: return result + def list_actions(self): + + actions = {} + + # FIXME : meh, loading the entire config panel is again going to cause + # stupid issues for domain (e.g loading registrar stuff when willing to just list available actions ...) + self.filter_key = "" + self._get_config_panel() + for panel, section, option in self._iterate(): + if option["type"] == "button": + key = f"{panel['id']}.{section['id']}.{option['id']}" + actions[key] = _value_for_locale(option["ask"]) + + return actions + + def run_action( + self, action=None, args=None, args_file=None, operation_logger=None + ): + # + # FIXME : this stuff looks a lot like set() ... + # + + self.filter_key = ".".join(action.split(".")[:2]) + action_id = action.split(".")[2] + + # Read config panel toml + self._get_config_panel() + + # FIXME: should also check that there's indeed a key called action + if not self.config: + raise YunohostValidationError("config_no_such_action", action=action) + + # Import and parse pre-answered options + logger.debug("Import and parse pre-answered options") + self._parse_pre_answered(args, None, args_file) + + # Read or get values and hydrate the config + self._load_current_values() + self._hydrate() + Question.operation_logger = operation_logger + self._ask(for_action=True) + + # FIXME: here, we could want to check constrains on + # the action's visibility / requirements wrt to the answer to questions ... + + if operation_logger: + operation_logger.start() + + try: + self._run_action(action_id) + except YunohostError: + raise + # Script got manually interrupted ... + # N.B. : KeyboardInterrupt does not inherit from Exception + except (KeyboardInterrupt, EOFError): + error = m18n.n("operation_interrupted") + logger.error(m18n.n("config_action_failed", action=action, error=error)) + raise + # Something wrong happened in Yunohost's code (most probably hook_exec) + except Exception: + import traceback + + error = m18n.n("unexpected_error", error="\n" + traceback.format_exc()) + logger.error(m18n.n("config_action_failed", action=action, error=error)) + raise + finally: + # Delete files uploaded from API + # FIXME : this is currently done in the context of config panels, + # but could also happen in the context of app install ... (or anywhere else + # where we may parse args etc...) + FileQuestion.clean_upload_dirs() + + # FIXME: i18n + logger.success(f"Action {action_id} successful") + operation_logger.success() + def set( self, key=None, value=None, args=None, args_file=None, operation_logger=None ): @@ -417,6 +497,7 @@ class ConfigPanel: "name": "", "services": [], "optional": True, + "is_action_section": False, }, }, "options": { @@ -485,6 +566,9 @@ class ConfigPanel: elif level == "sections": subnode["name"] = key # legacy subnode.setdefault("optional", raw_infos.get("optional", True)) + # If this section contains at least one button, it becomes an "action" section + if subnode["type"] == "button": + out["is_action_section"] = True out.setdefault(sublevel, []).append(subnode) # Key/value are a property else: @@ -533,10 +617,14 @@ class ConfigPanel: def _hydrate(self): # Hydrating config panel with current value - for _, _, option in self._iterate(): + for _, section, option in self._iterate(): if option["id"] not in self.values: - allowed_empty_types = ["alert", "display_text", "markdown", "file"] - if ( + + allowed_empty_types = ["alert", "display_text", "markdown", "file", "button"] + + if section["is_action_section"] and option.get("default") is not None: + self.values[option["id"]] = option["default"] + elif ( option["type"] in allowed_empty_types or option.get("bind") == "null" ): @@ -554,7 +642,7 @@ class ConfigPanel: return self.values - def _ask(self): + def _ask(self, for_action=False): logger.debug("Ask unanswered question and prevalidate data") if "i18n" in self.config: @@ -568,13 +656,22 @@ class ConfigPanel: Moulinette.display(colorize(message, "purple")) for panel, section, obj in self._iterate(["panel", "section"]): + + # Ugly hack to skip action section ... except when when explicitly running actions + if not for_action: + if section and section["is_action_section"]: + continue + + if panel == obj: + name = _value_for_locale(panel["name"]) + display_header(f"\n{'='*40}\n>>>> {name}\n{'='*40}") + else: + name = _value_for_locale(section["name"]) + if name: + display_header(f"\n# {name}") + if panel == obj: - name = _value_for_locale(panel["name"]) - display_header(f"\n{'='*40}\n>>>> {name}\n{'='*40}") continue - name = _value_for_locale(section["name"]) - if name: - display_header(f"\n# {name}") # Check and ask unanswered questions prefilled_answers = self.args.copy() @@ -594,8 +691,6 @@ class ConfigPanel: } ) - self.errors = None - def _get_default_values(self): return { option["id"]: option["default"] @@ -1334,6 +1429,17 @@ class FileQuestion(Question): return self.value +class ButtonQuestion(Question): + argument_type = "button" + + #def __init__( + # self, question, context: Mapping[str, Any] = {}, hooks: Dict[str, Callable] = {} + #): + # super().__init__(question, context, hooks) + + + + ARGUMENTS_TYPE_PARSERS = { "string": StringQuestion, "text": StringQuestion, @@ -1356,6 +1462,7 @@ ARGUMENTS_TYPE_PARSERS = { "markdown": DisplayTextQuestion, "file": FileQuestion, "app": AppQuestion, + "button": ButtonQuestion, } @@ -1395,6 +1502,8 @@ def ask_questions_and_parse_answers( for raw_question in raw_questions: question_class = ARGUMENTS_TYPE_PARSERS[raw_question.get("type", "string")] + if question_class.argument_type == "button": + continue raw_question["value"] = answers.get(raw_question["name"]) question = question_class(raw_question, context=context, hooks=hooks) new_values = question.ask_if_needed() From 47543b19b764bf085b91ccdd2d721f6abffd986c Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 8 Feb 2022 01:39:29 +0100 Subject: [PATCH 109/174] configpanels: Iterating on action POC to create a certificat section in domain config panels --- conf/nginx/server.tpl.conf | 8 ++-- share/config_domain.toml | 68 ++++++++++++++++++++++++++++++--- src/certificate.py | 77 +++++++++++--------------------------- src/domain.py | 28 ++++++++++++++ 4 files changed, 116 insertions(+), 65 deletions(-) diff --git a/conf/nginx/server.tpl.conf b/conf/nginx/server.tpl.conf index 379b597a7..4ee20a720 100644 --- a/conf/nginx/server.tpl.conf +++ b/conf/nginx/server.tpl.conf @@ -44,10 +44,10 @@ server { ssl_certificate /etc/yunohost/certs/{{ domain }}/crt.pem; ssl_certificate_key /etc/yunohost/certs/{{ domain }}/key.pem; - {% if domain_cert_ca != "Self-signed" %} + {% if domain_cert_ca != "selfsigned" %} more_set_headers "Strict-Transport-Security : max-age=63072000; includeSubDomains; preload"; {% endif %} - {% if domain_cert_ca == "Let's Encrypt" %} + {% if domain_cert_ca == "letsencrypt" %} # OCSP settings ssl_stapling on; ssl_stapling_verify on; @@ -99,10 +99,10 @@ server { ssl_certificate /etc/yunohost/certs/{{ domain }}/crt.pem; ssl_certificate_key /etc/yunohost/certs/{{ domain }}/key.pem; - {% if domain_cert_ca != "Self-signed" %} + {% if domain_cert_ca != "selfsigned" %} more_set_headers "Strict-Transport-Security : max-age=63072000; includeSubDomains; preload"; {% endif %} - {% if domain_cert_ca == "Let's Encrypt" %} + {% if domain_cert_ca == "letsencrypt" %} # OCSP settings ssl_stapling on; ssl_stapling_verify on; diff --git a/share/config_domain.toml b/share/config_domain.toml index 65e755365..e7f43f84d 100644 --- a/share/config_domain.toml +++ b/share/config_domain.toml @@ -16,7 +16,7 @@ i18n = "domain_config" type = "app" filter = "is_webapp" default = "_none" - + [feature.mail] #services = ['postfix', 'dovecot'] @@ -28,17 +28,17 @@ i18n = "domain_config" [feature.mail.mail_out] type = "boolean" default = 1 - + [feature.mail.mail_in] type = "boolean" default = 1 - + #[feature.mail.backup_mx] #type = "tags" #default = [] #pattern.regexp = '^([^\W_A-Z]+([-]*[^\W_A-Z]+)*\.)+((xn--)?[^\W_]{2,})$' #pattern.error = "pattern_error" - + [feature.xmpp] [feature.xmpp.xmpp] @@ -46,7 +46,7 @@ i18n = "domain_config" default = 0 [dns] - + [dns.registrar] optional = true @@ -58,3 +58,61 @@ i18n = "domain_config" # type = "number" # min = 0 # default = 3600 + + +[cert] + + [cert.status] + + [cert.status.cert_summary] + type = "alert" + # Automatically filled by DomainConfigPanel + + [cert.status.cert_validity] + type = "number" + readonly = true + # Automatically filled by DomainConfigPanel + + [cert.cert] + + [cert.cert.cert_issuer] + type = "string" + readonly = true + visible = "false" + # Automatically filled by DomainConfigPanel + + [cert.cert.acme_eligible] + type = "boolean" + readonly = true + visible = "false" + # Automatically filled by DomainConfigPanel + + [cert.cert.acme_eligible_explain] + type = "alert" + visible = "acme_eligible == false" + # FIXME: improve messaging ... + ask = "Uhoh, domain isnt ready for ACME challenge according to the diagnosis" + + [cert.cert.cert_no_checks] + ask = "Ignore diagnosis checks" + type = "boolean" + default = false + visible = "acme_eligible == false" + + [cert.cert.cert_install] + ask = "Install Let's Encrypt certificate" + type = "button" + icon = "star" + style = "success" + visible = "issuer != 'letsencrypt'" + enabled = "acme_eligible or cert_no_checks" + # ??? api = "PUT /domains/{domain}/cert?force&" + + [cert.cert.cert_renew] + ask = "Renew Let's Encrypt certificate" + help = "The certificate should be automatically renewed by YunoHost a few days before it expires." + type = "button" + icon = "refresh" + style = "warning" + visible = "issuer == 'letsencrypt'" + enabled = "acme_eligible or cert_no_checks" diff --git a/src/certificate.py b/src/certificate.py index 2a9fb4ce9..137a0aba0 100644 --- a/src/certificate.py +++ b/src/certificate.py @@ -95,8 +95,6 @@ def certificate_status(domains, full=False): if not full: del status["subject"] del status["CA_name"] - status["CA_type"] = status["CA_type"]["verbose"] - status["summary"] = status["summary"]["verbose"] if full: try: @@ -154,7 +152,7 @@ def _certificate_install_selfsigned(domain_list, force=False): if not force and os.path.isfile(current_cert_file): status = _get_status(domain) - if status["summary"]["code"] in ("good", "great"): + if status["summary"] == "success": raise YunohostValidationError( "certmanager_attempt_to_replace_valid_cert", domain=domain ) @@ -216,7 +214,7 @@ def _certificate_install_selfsigned(domain_list, force=False): if ( status - and status["CA_type"]["code"] == "self-signed" + and status["CA_type"] == "selfsigned" and status["validity"] > 3648 ): logger.success( @@ -241,7 +239,7 @@ def _certificate_install_letsencrypt(domains, force=False, no_checks=False): for domain in domain_list()["domains"]: status = _get_status(domain) - if status["CA_type"]["code"] != "self-signed": + if status["CA_type"] != "selfsigned": continue domains.append(domain) @@ -253,7 +251,7 @@ def _certificate_install_letsencrypt(domains, force=False, no_checks=False): # Is it self-signed? status = _get_status(domain) - if not force and status["CA_type"]["code"] != "self-signed": + if not force and status["CA_type"] != "selfsigned": raise YunohostValidationError( "certmanager_domain_cert_not_selfsigned", domain=domain ) @@ -314,7 +312,7 @@ def certificate_renew(domains, force=False, no_checks=False, email=False): # Does it have a Let's Encrypt cert? status = _get_status(domain) - if status["CA_type"]["code"] != "lets-encrypt": + if status["CA_type"] != "letsencrypt": continue # Does it expire soon? @@ -349,7 +347,7 @@ def certificate_renew(domains, force=False, no_checks=False, email=False): ) # Does it have a Let's Encrypt cert? - if status["CA_type"]["code"] != "lets-encrypt": + if status["CA_type"] != "letsencrypt": raise YunohostValidationError( "certmanager_attempt_to_renew_nonLE_cert", domain=domain ) @@ -539,7 +537,7 @@ def _fetch_and_enable_new_certificate(domain, no_checks=False): # Check the status of the certificate is now good status_summary = _get_status(domain)["summary"] - if status_summary["code"] != "great": + if status_summary != "success": raise YunohostError( "certmanager_certificate_fetching_or_enabling_failed", domain=domain ) @@ -634,58 +632,25 @@ def _get_status(domain): days_remaining = (valid_up_to - datetime.utcnow()).days if cert_issuer in ["yunohost.org"] + yunohost.domain.domain_list()["domains"]: - CA_type = { - "code": "self-signed", - "verbose": "Self-signed", - } - + CA_type = "selfsigned" elif organization_name == "Let's Encrypt": - CA_type = { - "code": "lets-encrypt", - "verbose": "Let's Encrypt", - } - + CA_type = "letsencrypt" else: - CA_type = { - "code": "other-unknown", - "verbose": "Other / Unknown", - } + CA_type = "other" if days_remaining <= 0: - status_summary = { - "code": "critical", - "verbose": "CRITICAL", - } - - elif CA_type["code"] in ("self-signed", "fake-lets-encrypt"): - status_summary = { - "code": "warning", - "verbose": "WARNING", - } - + summary = "danger" + elif CA_type == "selfsigned": + summary = "warning" elif days_remaining < VALIDITY_LIMIT: - status_summary = { - "code": "attention", - "verbose": "About to expire", - } - - elif CA_type["code"] == "other-unknown": - status_summary = { - "code": "good", - "verbose": "Good", - } - - elif CA_type["code"] == "lets-encrypt": - status_summary = { - "code": "great", - "verbose": "Great!", - } - + summary = "warning" + elif CA_type == "other": + summary = "success" + elif CA_type == "letsencrypt": + summary = "success" else: - status_summary = { - "code": "unknown", - "verbose": "Unknown?", - } + # shouldnt happen, because CA_type can be only selfsigned, letsencrypt, or other + summary = "" return { "domain": domain, @@ -693,7 +658,7 @@ def _get_status(domain): "CA_name": cert_issuer, "CA_type": CA_type, "validity": days_remaining, - "summary": status_summary, + "summary": summary, } diff --git a/src/domain.py b/src/domain.py index 29040ced8..4456d972c 100644 --- a/src/domain.py +++ b/src/domain.py @@ -499,6 +499,19 @@ class DomainConfigPanel(ConfigPanel): self.registar_id = toml["dns"]["registrar"]["registrar"]["value"] del toml["dns"]["registrar"]["registrar"]["value"] + # Cert stuff + if not filter_key or filter_key[0] == "cert": + + from yunohost.certificate import certificate_status + status = certificate_status([self.entity], full=True)["certificates"][self.entity] + + toml["cert"]["status"]["cert_summary"]["style"] = status["summary"] + # FIXME: improve message + toml["cert"]["status"]["cert_summary"]["ask"] = f"Status is {status['summary']} ! (FIXME: improve message depending on summary / issuer / validity ..." + + # FIXME: Ugly hack to save the cert status and reinject it in _load_current_values ... + self.cert_status = status + return toml def _load_current_values(self): @@ -511,6 +524,21 @@ class DomainConfigPanel(ConfigPanel): if not filter_key or filter_key[0] == "dns": self.values["registrar"] = self.registar_id + # FIXME: Ugly hack to save the cert status and reinject it in _load_current_values ... + if not filter_key or filter_key[0] == "cert": + self.values["cert_validity"] = self.cert_status["validity"] + self.values["cert_issuer"] = self.cert_status["CA_type"] + self.values["acme_eligible"] = self.cert_status["ACME_eligible"] + + def _run_action(self, action): + + if action == "cert_install": + from yunohost.certificate import certificate_install as action_func + elif action == "cert_renew": + from yunohost.certificate import certificate_renew as action_func + + action_func([self.entity], force=True, no_checks=self.new_values["cert_no_checks"]) + def _get_domain_settings(domain: str) -> dict: From c39f0ae3bc5d7d68b3f944dae947e61885be21cd Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 8 Feb 2022 14:45:36 +0100 Subject: [PATCH 110/174] actionsmap: hide a bunch of technical commands from --help --- share/actionsmap.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/share/actionsmap.yml b/share/actionsmap.yml index 89c6e914d..86ef3848a 100644 --- a/share/actionsmap.yml +++ b/share/actionsmap.yml @@ -552,6 +552,7 @@ domain: ### domain_url_available() url-available: + hide_in_help: True action_help: Check availability of a web path api: GET /domain//urlavailable arguments: @@ -868,6 +869,7 @@ app: ### app_register_url() register-url: + hide_in_help: True action_help: Book/register a web path for a given app arguments: app: @@ -880,6 +882,7 @@ app: ### app_makedefault() makedefault: + hide_in_help: True action_help: Redirect domain root to an app api: PUT /apps//default arguments: @@ -1065,6 +1068,7 @@ backup: ### backup_download() download: + hide_in_help: True action_help: (API only) Request to download the file api: GET /backups//download arguments: @@ -1651,6 +1655,7 @@ hook: ### hook_info() info: + hide_in_help: True action_help: Get information about a given hook arguments: action: @@ -1680,6 +1685,7 @@ hook: ### hook_callback() callback: + hide_in_help: True action_help: Execute all scripts binded to an action arguments: action: @@ -1702,6 +1708,7 @@ hook: ### hook_exec() exec: + hide_in_help: True action_help: Execute hook from a file with arguments arguments: path: From 40ad8ce25e5459a0b7ebc28a901692918d25fec7 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 8 Feb 2022 16:07:35 +0100 Subject: [PATCH 111/174] configpanel: Implement 'hidden' domain_action_run route --- share/actionsmap.yml | 14 ++++++++++++++ share/config_domain.toml | 1 - src/domain.py | 21 +++++++++++++++------ 3 files changed, 29 insertions(+), 7 deletions(-) diff --git a/share/actionsmap.yml b/share/actionsmap.yml index 86ef3848a..969a2e07c 100644 --- a/share/actionsmap.yml +++ b/share/actionsmap.yml @@ -563,6 +563,20 @@ domain: path: help: The path to check (e.g. /coffee) + ### domain_action_run() + action-run: + hide_in_help: True + action_help: Run domain action + api: PUT /domain//actions/ + arguments: + domain: + help: Domain name + action: + help: action id + -a: + full: --args + help: Serialized arguments for action (i.e. "foo=bar&lorem=ipsum") + subcategories: config: diff --git a/share/config_domain.toml b/share/config_domain.toml index e7f43f84d..14bb72a67 100644 --- a/share/config_domain.toml +++ b/share/config_domain.toml @@ -106,7 +106,6 @@ i18n = "domain_config" style = "success" visible = "issuer != 'letsencrypt'" enabled = "acme_eligible or cert_no_checks" - # ??? api = "PUT /domains/{domain}/cert?force&" [cert.cert.cert_renew] ask = "Renew Let's Encrypt certificate" diff --git a/src/domain.py b/src/domain.py index 4456d972c..45a516f7d 100644 --- a/src/domain.py +++ b/src/domain.py @@ -530,14 +530,23 @@ class DomainConfigPanel(ConfigPanel): self.values["cert_issuer"] = self.cert_status["CA_type"] self.values["acme_eligible"] = self.cert_status["ACME_eligible"] - def _run_action(self, action): - if action == "cert_install": - from yunohost.certificate import certificate_install as action_func - elif action == "cert_renew": - from yunohost.certificate import certificate_renew as action_func +@is_unit_operation() +def domain_action_run( + operation_logger, domain, action, args=None +): - action_func([self.entity], force=True, no_checks=self.new_values["cert_no_checks"]) + import urllib.parse + + if action == "cert.cert.cert_install": + from yunohost.certificate import certificate_install as action_func + elif action == "cert.cert.cert_renew": + from yunohost.certificate import certificate_renew as action_func + + args = dict(urllib.parse.parse_qsl(args or "", keep_blank_values=True)) + no_checks = bool(args["cert_no_checks"]) + + action_func([domain], force=True, no_checks=no_checks) def _get_domain_settings(domain: str) -> dict: From 0dc08c8f8c1f0c6ed8cb6251810a0979eaf188f3 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Wed, 9 Feb 2022 20:08:39 +0100 Subject: [PATCH 112/174] Apply suggestions from code review Co-authored-by: Axolotle --- share/config_domain.toml | 2 ++ src/domain.py | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/share/config_domain.toml b/share/config_domain.toml index 14bb72a67..84201b845 100644 --- a/share/config_domain.toml +++ b/share/config_domain.toml @@ -71,6 +71,7 @@ i18n = "domain_config" [cert.status.cert_validity] type = "number" readonly = true + visible = "false" # Automatically filled by DomainConfigPanel [cert.cert] @@ -89,6 +90,7 @@ i18n = "domain_config" [cert.cert.acme_eligible_explain] type = "alert" + style = "warning" visible = "acme_eligible == false" # FIXME: improve messaging ... ask = "Uhoh, domain isnt ready for ACME challenge according to the diagnosis" diff --git a/src/domain.py b/src/domain.py index 45a516f7d..50a6451bf 100644 --- a/src/domain.py +++ b/src/domain.py @@ -544,7 +544,7 @@ def domain_action_run( from yunohost.certificate import certificate_renew as action_func args = dict(urllib.parse.parse_qsl(args or "", keep_blank_values=True)) - no_checks = bool(args["cert_no_checks"]) + no_checks = args["cert_no_checks"] in ("y", "yes", "on", "1") action_func([domain], force=True, no_checks=no_checks) From 0838d443a1d49826c34496d11d3cfe9a410ba222 Mon Sep 17 00:00:00 2001 From: axolotle Date: Wed, 2 Mar 2022 20:43:26 +0100 Subject: [PATCH 113/174] normalize actionmap config API routes --- share/actionsmap.yml | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/share/actionsmap.yml b/share/actionsmap.yml index 969a2e07c..9d5f8866e 100644 --- a/share/actionsmap.yml +++ b/share/actionsmap.yml @@ -586,7 +586,9 @@ domain: ### domain_config_get() get: action_help: Display a domain configuration - api: GET /domains//config + api: + - GET /domains//config + - GET /domains//config/ arguments: domain: help: Domain name @@ -605,7 +607,7 @@ domain: ### domain_config_set() set: action_help: Apply a new configuration - api: PUT /domains//config + api: PUT /domains//config/ arguments: domain: help: Domain name @@ -958,7 +960,9 @@ app: ### app_config_get() get: action_help: Display an app configuration - api: GET /apps//config-panel + api: + - GET /apps//config + - GET /apps//config/ arguments: app: help: App name @@ -977,7 +981,7 @@ app: ### app_config_set() set: action_help: Apply a new configuration - api: PUT /apps//config + api: PUT /apps//config/ arguments: app: help: App name From 3644937fffbd2a8ff73f7141329e04403d0eabd7 Mon Sep 17 00:00:00 2001 From: axolotle Date: Wed, 2 Mar 2022 20:46:51 +0100 Subject: [PATCH 114/174] fix config domain syntax --- share/config_domain.toml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/share/config_domain.toml b/share/config_domain.toml index 84201b845..7189003d3 100644 --- a/share/config_domain.toml +++ b/share/config_domain.toml @@ -63,6 +63,7 @@ i18n = "domain_config" [cert] [cert.status] + name = "Status" [cert.status.cert_summary] type = "alert" @@ -71,21 +72,19 @@ i18n = "domain_config" [cert.status.cert_validity] type = "number" readonly = true - visible = "false" # Automatically filled by DomainConfigPanel [cert.cert] + name = "Manage" [cert.cert.cert_issuer] type = "string" - readonly = true - visible = "false" + visible = false # Automatically filled by DomainConfigPanel [cert.cert.acme_eligible] type = "boolean" - readonly = true - visible = "false" + visible = false # Automatically filled by DomainConfigPanel [cert.cert.acme_eligible_explain] @@ -107,7 +106,8 @@ i18n = "domain_config" icon = "star" style = "success" visible = "issuer != 'letsencrypt'" - enabled = "acme_eligible or cert_no_checks" + enabled = "acme_eligible || cert_no_checks" + args = ["cert_no_checks"] [cert.cert.cert_renew] ask = "Renew Let's Encrypt certificate" @@ -116,4 +116,4 @@ i18n = "domain_config" icon = "refresh" style = "warning" visible = "issuer == 'letsencrypt'" - enabled = "acme_eligible or cert_no_checks" + enabled = "acme_eligible || cert_no_checks" From 2199d60732296d34d4cc1dfb4af0fabfb5863f84 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 30 Sep 2022 19:22:29 +0200 Subject: [PATCH 115/174] admins: change migration strategy, recreate 'admin' as a legacy regular user that will be encouraged to manually get rid of --- src/migrations/0026_new_admins_group.py | 34 ++++++++++++++++++++++++- 1 file changed, 33 insertions(+), 1 deletion(-) diff --git a/src/migrations/0026_new_admins_group.py b/src/migrations/0026_new_admins_group.py index c1ba5b638..ada92d2a2 100644 --- a/src/migrations/0026_new_admins_group.py +++ b/src/migrations/0026_new_admins_group.py @@ -1,4 +1,5 @@ import os +import subprocess from moulinette.utils.log import getActionLogger from yunohost.utils.error import YunohostError @@ -24,7 +25,7 @@ class MyMigration(Migration): @Migration.ldap_migration def run(self, *args): - from yunohost.user import user_list, user_info, user_group_update, user_update + from yunohost.user import user_list, user_info, user_group_update, user_update, user_create from yunohost.utils.ldap import _get_ldap_interface ldap = _get_ldap_interface() @@ -60,6 +61,8 @@ yunohost tools migrations run""", user_update(new_admin_user, remove_mailalias=old_admin_aliases_to_remove) + admin_hashs = ldap.search("cn=admin", "", {"userPassword"})[0]["userPassword"] + stuff_to_delete = [ "cn=admin,ou=sudo", "cn=admin", @@ -94,5 +97,34 @@ yunohost tools migrations run""", if new_admin_user: user_group_update(groupname="admins", add=new_admin_user, sync_perm=True) + # Re-add admin as a regular user + attr_dict = { + "objectClass": [ + "mailAccount", + "inetOrgPerson", + "posixAccount", + "userPermissionYnh", + ], + "givenName": ["Admin"], + "sn": ["Admin"], + "displayName": ["Admin"], + "cn": ["Admin"], + "uid": ["admin"], + "mail": "", + "maildrop": ["admin"], + "mailuserquota": ["0"], + "userPassword": admin_hashs, + "gidNumber": ["1007"], + "uidNumber": ["1007"], + "homeDirectory": ["/home/admin"], + "loginShell": ["/bin/bash"], + } + ldap.add("uid=admin,ou=users", attr_dict) + user_group_update(groupname="admins", add="admin", sync_perm=True) + + subprocess.call(["nscd", "-i", "passwd"]) + subprocess.call(["nscd", "-i", "group"]) + + def run_after_system_restore(self): self.run() From 87447def383ae6742c8b0525d2829f98099039af Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 30 Sep 2022 19:31:04 +0200 Subject: [PATCH 116/174] admins/ldapauth: attempt to fix tests, root auth gets broken during slapd restart test --- src/tests/test_ldapauth.py | 2 +- src/utils/ldap.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/tests/test_ldapauth.py b/src/tests/test_ldapauth.py index 5e741fe0f..0ec0346da 100644 --- a/src/tests/test_ldapauth.py +++ b/src/tests/test_ldapauth.py @@ -78,7 +78,7 @@ def test_authenticate_server_down(mocker): def test_authenticate_change_password(): - LDAPAuth().authenticate_credentials(credentials="yunohost") + LDAPAuth().authenticate_credentials(credentials="alice:Yunohost") tools_rootpw("plopette", check_strength=False) diff --git a/src/utils/ldap.py b/src/utils/ldap.py index 28ff8eebe..627ab4e7a 100644 --- a/src/utils/ldap.py +++ b/src/utils/ldap.py @@ -84,7 +84,7 @@ class LDAPInterface: def connect(self): def _reconnect(): con = ldap.ldapobject.ReconnectLDAPObject( - self.uri, retry_max=10, retry_delay=0.5 + self.uri, retry_max=10, retry_delay=2 ) con.sasl_non_interactive_bind_s("EXTERNAL") return con From acb0993bc95aee78ebfae56de62d1c9b3ac9c761 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 30 Sep 2022 19:35:15 +0200 Subject: [PATCH 117/174] Unhappy linter gods are unhappy --- src/migrations/0026_new_admins_group.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/migrations/0026_new_admins_group.py b/src/migrations/0026_new_admins_group.py index ada92d2a2..23bbf213d 100644 --- a/src/migrations/0026_new_admins_group.py +++ b/src/migrations/0026_new_admins_group.py @@ -25,7 +25,7 @@ class MyMigration(Migration): @Migration.ldap_migration def run(self, *args): - from yunohost.user import user_list, user_info, user_group_update, user_update, user_create + from yunohost.user import user_list, user_info, user_group_update, user_update from yunohost.utils.ldap import _get_ldap_interface ldap = _get_ldap_interface() From 35bac35bb08f933b88b0dc112411f0a727afa8f4 Mon Sep 17 00:00:00 2001 From: axolotle Date: Sat, 1 Oct 2022 20:18:32 +0200 Subject: [PATCH 118/174] add readonly prop for config panel arg to display a value --- locales/en.json | 1 + src/utils/config.py | 35 +++++++++++++++++++++++++++++++---- 2 files changed, 32 insertions(+), 4 deletions(-) diff --git a/locales/en.json b/locales/en.json index 735cf4c15..86a7ae770 100644 --- a/locales/en.json +++ b/locales/en.json @@ -142,6 +142,7 @@ "config_apply_failed": "Applying the new configuration failed: {error}", "config_cant_set_value_on_section": "You can't set a single value on an entire config section.", "config_forbidden_keyword": "The keyword '{keyword}' is reserved, you can't create or use a config panel with a question with this id.", + "config_forbidden_readonly_type": "The type '{type}' can't be set as readonly, use another type to render this value (relevant arg id: '{id}').", "config_no_panel": "No config panel found.", "config_unknown_filter_key": "The filter key '{filter_key}' is incorrect.", "config_validate_color": "Should be a valid RGB hexadecimal color", diff --git a/src/utils/config.py b/src/utils/config.py index ac317d83c..c03d6cfa8 100644 --- a/src/utils/config.py +++ b/src/utils/config.py @@ -524,6 +524,7 @@ class ConfigPanel: "accept", "redact", "filter", + "readonly", ], "defaults": {}, }, @@ -609,10 +610,27 @@ class ConfigPanel: "max_progression", ] forbidden_keywords += format_description["sections"] + forbidden_readonly_types = [ + "password", + "app", + "domain", + "user", + "file" + ] for _, _, option in self._iterate(): if option["id"] in forbidden_keywords: raise YunohostError("config_forbidden_keyword", keyword=option["id"]) + if ( + option.get("readonly", False) and + option.get("type", "string") in forbidden_readonly_types + ): + raise YunohostError( + "config_forbidden_readonly_type", + type=option["type"], + id=option["id"] + ) + return self.config def _hydrate(self): @@ -797,6 +815,7 @@ class Question: self.default = question.get("default", None) self.optional = question.get("optional", False) self.visible = question.get("visible", None) + self.readonly = question.get("readonly", False) # Don't restrict choices if there's none specified self.choices = question.get("choices", None) self.pattern = question.get("pattern", self.pattern) @@ -857,8 +876,9 @@ class Question: # Display question if no value filled or if it's a readonly message if Moulinette.interface.type == "cli" and os.isatty(1): text_for_user_input_in_cli = self._format_text_for_user_input_in_cli() - if getattr(self, "readonly", False): + if self.readonly: Moulinette.display(text_for_user_input_in_cli) + return {} elif self.value is None: self._prompt(text_for_user_input_in_cli) @@ -918,7 +938,12 @@ class Question: text_for_user_input_in_cli = _value_for_locale(self.ask) - if self.choices: + if self.readonly: + text_for_user_input_in_cli = colorize(text_for_user_input_in_cli, "purple") + if self.choices: + return text_for_user_input_in_cli + f" {self.choices[self.current_value]}" + return text_for_user_input_in_cli + f" {self.humanize(self.current_value)}" + elif self.choices: # Prevent displaying a shitload of choices # (e.g. 100+ available users when choosing an app admin...) @@ -1018,6 +1043,7 @@ class ColorQuestion(StringQuestion): class TagsQuestion(Question): argument_type = "tags" + default_value = "" @staticmethod def humanize(value, option={}): @@ -1189,7 +1215,8 @@ class BooleanQuestion(Question): def _format_text_for_user_input_in_cli(self): text_for_user_input_in_cli = super()._format_text_for_user_input_in_cli() - text_for_user_input_in_cli += " [yes | no]" + if not self.readonly: + text_for_user_input_in_cli += " [yes | no]" return text_for_user_input_in_cli @@ -1342,7 +1369,6 @@ class NumberQuestion(Question): class DisplayTextQuestion(Question): argument_type = "display_text" - readonly = True def __init__( self, question, context: Mapping[str, Any] = {}, hooks: Dict[str, Callable] = {} @@ -1350,6 +1376,7 @@ class DisplayTextQuestion(Question): super().__init__(question, context, hooks) self.optional = True + self.readonly = True self.style = question.get( "style", "info" if question["type"] == "alert" else "" ) From 9a3d65c3132d03f9e558b3ea722d88aefb3a2dd2 Mon Sep 17 00:00:00 2001 From: axolotle Date: Sat, 1 Oct 2022 20:19:51 +0200 Subject: [PATCH 119/174] update arg 'time' validation regex to allow 24 hours format --- src/utils/config.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/utils/config.py b/src/utils/config.py index c03d6cfa8..0ab5fc2ba 100644 --- a/src/utils/config.py +++ b/src/utils/config.py @@ -1029,7 +1029,7 @@ class DateQuestion(StringQuestion): class TimeQuestion(StringQuestion): pattern = { - "regexp": r"^(1[12]|0?\d):[0-5]\d$", + "regexp": r"^(?:\d|[01]\d|2[0-3]):[0-5]\d$", "error": "config_validate_time", # i18n: config_validate_time } From 3d4909bbf51e8c4efbb1b14e801c6c99dc338f40 Mon Sep 17 00:00:00 2001 From: axolotle Date: Sun, 2 Oct 2022 17:10:05 +0200 Subject: [PATCH 120/174] configpanel: misc fix + add section visible evaluation --- share/config_domain.toml | 1 - src/app.py | 2 +- src/utils/config.py | 16 ++++++++-------- 3 files changed, 9 insertions(+), 10 deletions(-) diff --git a/share/config_domain.toml b/share/config_domain.toml index 7189003d3..fd12d4506 100644 --- a/share/config_domain.toml +++ b/share/config_domain.toml @@ -107,7 +107,6 @@ i18n = "domain_config" style = "success" visible = "issuer != 'letsencrypt'" enabled = "acme_eligible || cert_no_checks" - args = ["cert_no_checks"] [cert.cert.cert_renew] ask = "Renew Let's Encrypt certificate" diff --git a/src/app.py b/src/app.py index 81557978b..c57cf038e 100644 --- a/src/app.py +++ b/src/app.py @@ -1539,7 +1539,7 @@ ynh_app_config_run $1 if ret != 0: if action == "show": raise YunohostError("app_config_unable_to_read") - elif action == "show": + elif action == "apply": raise YunohostError("app_config_unable_to_apply") else: raise YunohostError("app_action_failed", action=action) diff --git a/src/utils/config.py b/src/utils/config.py index 0ab5fc2ba..4291e133e 100644 --- a/src/utils/config.py +++ b/src/utils/config.py @@ -49,6 +49,7 @@ from yunohost.log import OperationLogger logger = getActionLogger("yunohost.config") CONFIG_PANEL_VERSION_SUPPORTED = 1.0 + # Those js-like evaluate functions are used to eval safely visible attributes # The goal is to evaluate in the same way than js simple-evaluate # https://github.com/shepherdwind/simple-evaluate @@ -675,6 +676,11 @@ class ConfigPanel: for panel, section, obj in self._iterate(["panel", "section"]): + if section and section.get("visible") and not evaluate_simple_js_expression( + section["visible"], context=self.new_values + ): + continue + # Ugly hack to skip action section ... except when when explicitly running actions if not for_action: if section and section["is_action_section"]: @@ -878,7 +884,8 @@ class Question: text_for_user_input_in_cli = self._format_text_for_user_input_in_cli() if self.readonly: Moulinette.display(text_for_user_input_in_cli) - return {} + self.value = self.values[self.name] = self.current_value + return self.values elif self.value is None: self._prompt(text_for_user_input_in_cli) @@ -1459,13 +1466,6 @@ class FileQuestion(Question): class ButtonQuestion(Question): argument_type = "button" - #def __init__( - # self, question, context: Mapping[str, Any] = {}, hooks: Dict[str, Callable] = {} - #): - # super().__init__(question, context, hooks) - - - ARGUMENTS_TYPE_PARSERS = { "string": StringQuestion, From f1003939a9b25045bf176201cc62638a877b778c Mon Sep 17 00:00:00 2001 From: axolotle Date: Mon, 3 Oct 2022 16:13:30 +0200 Subject: [PATCH 121/174] configpanel: add 'enabled' prop evaluation for button --- locales/en.json | 1 + src/utils/config.py | 35 ++++++++++++++++++++++++++++++----- 2 files changed, 31 insertions(+), 5 deletions(-) diff --git a/locales/en.json b/locales/en.json index 86a7ae770..0a1203b61 100644 --- a/locales/en.json +++ b/locales/en.json @@ -139,6 +139,7 @@ "certmanager_self_ca_conf_file_not_found": "Could not find configuration file for self-signing authority (file: {file})", "certmanager_unable_to_parse_self_CA_name": "Could not parse name of self-signing authority (file: {file})", "certmanager_warning_subdomain_dns_record": "Subdomain '{subdomain}' does not resolve to the same IP address as '{domain}'. Some features will not be available until you fix this and regenerate the certificate.", + "config_action_disabled": "Could not run action '{action}' since it is disabled, make sure to meet its constraints. help: {help}", "config_apply_failed": "Applying the new configuration failed: {error}", "config_cant_set_value_on_section": "You can't set a single value on an entire config section.", "config_forbidden_keyword": "The keyword '{keyword}' is reserved, you can't create or use a config panel with a question with this id.", diff --git a/src/utils/config.py b/src/utils/config.py index 4291e133e..7411b79de 100644 --- a/src/utils/config.py +++ b/src/utils/config.py @@ -356,7 +356,7 @@ class ConfigPanel: self._load_current_values() self._hydrate() Question.operation_logger = operation_logger - self._ask(for_action=True) + self._ask(action=action_id) # FIXME: here, we could want to check constrains on # the action's visibility / requirements wrt to the answer to questions ... @@ -526,6 +526,7 @@ class ConfigPanel: "redact", "filter", "readonly", + "enabled", ], "defaults": {}, }, @@ -661,7 +662,7 @@ class ConfigPanel: return self.values - def _ask(self, for_action=False): + def _ask(self, action=None): logger.debug("Ask unanswered question and prevalidate data") if "i18n" in self.config: @@ -682,7 +683,7 @@ class ConfigPanel: continue # Ugly hack to skip action section ... except when when explicitly running actions - if not for_action: + if not action: if section and section["is_action_section"]: continue @@ -693,6 +694,12 @@ class ConfigPanel: name = _value_for_locale(section["name"]) if name: display_header(f"\n# {name}") + elif section: + # filter action section options in case of multiple buttons + section["options"] = [ + option for option in section["options"] + if option.get("type", "string") != "button" or option["id"] == action + ] if panel == obj: continue @@ -1465,6 +1472,13 @@ class FileQuestion(Question): class ButtonQuestion(Question): argument_type = "button" + enabled = None + + def __init__( + self, question, context: Mapping[str, Any] = {}, hooks: Dict[str, Callable] = {} + ): + super().__init__(question, context, hooks) + self.enabled = question.get("enabled", None) ARGUMENTS_TYPE_PARSERS = { @@ -1529,10 +1543,21 @@ def ask_questions_and_parse_answers( for raw_question in raw_questions: question_class = ARGUMENTS_TYPE_PARSERS[raw_question.get("type", "string")] - if question_class.argument_type == "button": - continue raw_question["value"] = answers.get(raw_question["name"]) question = question_class(raw_question, context=context, hooks=hooks) + if question.type == "button": + if ( + not question.enabled + or evaluate_simple_js_expression(question.enabled, context=context) + ): + continue + else: + raise YunohostValidationError( + "config_action_disabled", + action=question.name, + help=_value_for_locale(question.help) + ) + new_values = question.ask_if_needed() answers.update(new_values) context.update(new_values) From 18f64ce80b2c20f5248158546103b2a06de62ac8 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Mon, 3 Oct 2022 17:03:13 +0200 Subject: [PATCH 122/174] Moar friskies --- src/migrations/0026_new_admins_group.py | 7 +++---- src/user.py | 5 +++++ 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/src/migrations/0026_new_admins_group.py b/src/migrations/0026_new_admins_group.py index 23bbf213d..afe299cfe 100644 --- a/src/migrations/0026_new_admins_group.py +++ b/src/migrations/0026_new_admins_group.py @@ -1,5 +1,4 @@ import os -import subprocess from moulinette.utils.log import getActionLogger from yunohost.utils.error import YunohostError @@ -27,6 +26,7 @@ class MyMigration(Migration): from yunohost.user import user_list, user_info, user_group_update, user_update from yunohost.utils.ldap import _get_ldap_interface + from yunohost.permission import permission_sync_to_user ldap = _get_ldap_interface() @@ -94,6 +94,8 @@ yunohost tools migrations run""", } ) + permission_sync_to_user() + if new_admin_user: user_group_update(groupname="admins", add=new_admin_user, sync_perm=True) @@ -122,9 +124,6 @@ yunohost tools migrations run""", ldap.add("uid=admin,ou=users", attr_dict) user_group_update(groupname="admins", add="admin", sync_perm=True) - subprocess.call(["nscd", "-i", "passwd"]) - subprocess.call(["nscd", "-i", "group"]) - def run_after_system_restore(self): self.run() diff --git a/src/user.py b/src/user.py index 1f6cbc5c8..efffbdc7e 100644 --- a/src/user.py +++ b/src/user.py @@ -208,6 +208,11 @@ def user_create( all_uid = {str(x.pw_uid) for x in pwd.getpwall()} all_gid = {str(x.gr_gid) for x in grp.getgrall()} + # Prevent users from obtaining uid 1007 which is the uid of the legacy admin, + # and there could be a edge case where a new user becomes owner of an old, removed admin user + all_uid.add("1007") + all_gid.add("1007") + uid_guid_found = False while not uid_guid_found: # LXC uid number is limited to 65536 by default From aad576fdd0ed5dd1f18478c08b9c9c47dc836115 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Mon, 3 Oct 2022 17:12:53 +0200 Subject: [PATCH 123/174] =?UTF-8?q?mypy=20won't=20guess=20that=20'question?= =?UTF-8?q?'=20does=20have=20an=20'enabled'=20attr=20in=20that=20context?= =?UTF-8?q?=20=C3=A9=5F=C3=A8?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/utils/config.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/utils/config.py b/src/utils/config.py index 7411b79de..36f7d986d 100644 --- a/src/utils/config.py +++ b/src/utils/config.py @@ -1547,8 +1547,8 @@ def ask_questions_and_parse_answers( question = question_class(raw_question, context=context, hooks=hooks) if question.type == "button": if ( - not question.enabled - or evaluate_simple_js_expression(question.enabled, context=context) + not question.enabled # type: ignore + or evaluate_simple_js_expression(question.enabled, context=context) # type: ignore ): continue else: From 6512bbf70cc76b711df910acc5d47e13208dd6ed Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Mon, 3 Oct 2022 18:03:00 +0200 Subject: [PATCH 124/174] Moaaar friskies --- src/migrations/0026_new_admins_group.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/migrations/0026_new_admins_group.py b/src/migrations/0026_new_admins_group.py index afe299cfe..87ea26907 100644 --- a/src/migrations/0026_new_admins_group.py +++ b/src/migrations/0026_new_admins_group.py @@ -61,7 +61,7 @@ yunohost tools migrations run""", user_update(new_admin_user, remove_mailalias=old_admin_aliases_to_remove) - admin_hashs = ldap.search("cn=admin", "", {"userPassword"})[0]["userPassword"] + admin_hashs = ldap.search("cn=admin", attrs={"userPassword"})[0]["userPassword"] stuff_to_delete = [ "cn=admin,ou=sudo", @@ -112,7 +112,7 @@ yunohost tools migrations run""", "displayName": ["Admin"], "cn": ["Admin"], "uid": ["admin"], - "mail": "", + "mail": "admin_legacy", "maildrop": ["admin"], "mailuserquota": ["0"], "userPassword": admin_hashs, From ae73e94c3e839e634e14def965c77265fde1a57a Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 4 Oct 2022 02:00:40 +0200 Subject: [PATCH 125/174] Friskies pl0x? --- src/authenticators/ldap_admin.py | 4 ++++ src/tests/test_ldapauth.py | 17 ++++------------- 2 files changed, 8 insertions(+), 13 deletions(-) diff --git a/src/authenticators/ldap_admin.py b/src/authenticators/ldap_admin.py index 704816460..a7fc18da6 100644 --- a/src/authenticators/ldap_admin.py +++ b/src/authenticators/ldap_admin.py @@ -37,6 +37,10 @@ class Authenticator(BaseAuthenticator): os.system("systemctl restart slapd") time.sleep(10) # waits 10 secondes so we are sure that slapd has restarted + # Force-reset existing LDAP interface + from yunohost.utils import ldap as ldaputils + ldaputils._ldap_interface = None + try: admins = _get_ldap_interface().search(ADMIN_GROUP, attrs=["memberUid"])[0].get("memberUid", []) except ldap.SERVER_DOWN: diff --git a/src/tests/test_ldapauth.py b/src/tests/test_ldapauth.py index 0ec0346da..db5229342 100644 --- a/src/tests/test_ldapauth.py +++ b/src/tests/test_ldapauth.py @@ -2,7 +2,6 @@ import pytest import os from yunohost.authenticators.ldap_admin import Authenticator as LDAPAuth -from yunohost.tools import tools_rootpw from yunohost.user import user_create, user_list, user_update, user_delete from yunohost.domain import _get_maindomain @@ -17,7 +16,7 @@ def setup_function(function): maindomain = _get_maindomain() - if os.system("systemctl is-active slapd") != 0: + if os.system("systemctl is-active slapd >/dev/null") != 0: os.system("systemctl start slapd && sleep 3") user_create("alice", "Alice", "White", maindomain, "Yunohost", admin=True) @@ -26,7 +25,7 @@ def setup_function(function): def teardown_function(): - os.system("systemctl is-active slapd || systemctl start slapd && sleep 5") + os.system("systemctl is-active slapd >/dev/null || systemctl start slapd; sleep 5") for u in user_list()["users"]: user_delete(u, purge=True) @@ -67,20 +66,14 @@ def test_authenticate_with_wrong_password(): def test_authenticate_server_down(mocker): os.system("systemctl stop slapd && sleep 5") - # Now if slapd is down, moulinette tries to restart it - mocker.patch("os.system") - mocker.patch("time.sleep") - with pytest.raises(MoulinetteError) as exception: - LDAPAuth().authenticate_credentials(credentials="alice:Yunohost") - - assert "Unable to reach LDAP server" in str(exception) + LDAPAuth().authenticate_credentials(credentials="alice:Yunohost") def test_authenticate_change_password(): LDAPAuth().authenticate_credentials(credentials="alice:Yunohost") - tools_rootpw("plopette", check_strength=False) + user_update("alice", change_password="plopette") with pytest.raises(MoulinetteError) as exception: LDAPAuth().authenticate_credentials(credentials="alice:Yunohost") @@ -89,6 +82,4 @@ def test_authenticate_change_password(): expected_msg = translation.format() assert expected_msg in str(exception) - user_update("alice", password="plopette") - LDAPAuth().authenticate_credentials(credentials="alice:plopette") From d7067c0b2264a01a5910bc0d161016a2efb8aa07 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 4 Oct 2022 12:38:33 +0200 Subject: [PATCH 126/174] Friskies m0ar --- src/migrations/0026_new_admins_group.py | 16 ---------------- src/tests/test_permission.py | 2 +- src/user.py | 2 +- 3 files changed, 2 insertions(+), 18 deletions(-) diff --git a/src/migrations/0026_new_admins_group.py b/src/migrations/0026_new_admins_group.py index 87ea26907..e44f1d716 100644 --- a/src/migrations/0026_new_admins_group.py +++ b/src/migrations/0026_new_admins_group.py @@ -37,22 +37,6 @@ class MyMigration(Migration): new_admin_user = user break - # NB: we handle the edge-case where no user exist at all - # which is useful for the CI etc. - if all_users and not new_admin_user: - new_admin_user = os.environ.get("YNH_NEW_ADMIN_USER") - if new_admin_user: - assert new_admin_user in all_users, f"{new_admin_user} is not an existing yunohost user" - else: - raise YunohostError( - # FIXME: i18n - """The very first user created on this Yunohost instance could not be found, and therefore this migration can not be ran. You should re-run this migration as soon as possible from the command line with, after choosing which user should become the admin: - -export YNH_NEW_ADMIN_USER=some_existing_username -yunohost tools migrations run""", - raw_msg=True - ) - self.ldap_migration_started = True if new_admin_user: diff --git a/src/tests/test_permission.py b/src/tests/test_permission.py index f2bff5507..379f1cf39 100644 --- a/src/tests/test_permission.py +++ b/src/tests/test_permission.py @@ -109,7 +109,7 @@ def clean_user_groups_permission(): user_delete(u) for g in user_group_list()["groups"]: - if g not in ["all_users", "visitors"]: + if g not in ["all_users", "visitors", "admins"]: user_group_delete(g) for p in user_permission_list()["permissions"]: diff --git a/src/user.py b/src/user.py index efffbdc7e..e00fa3685 100644 --- a/src/user.py +++ b/src/user.py @@ -56,7 +56,7 @@ FIELDS_FOR_IMPORT = { "groups": r"^|([a-z0-9_]+(,?[a-z0-9_]+)*)$", } -ADMIN_ALIASES = ["root@", "admin@", "webmaster@", "postmaster@", "abuse@"] +ADMIN_ALIASES = ["root@", "admin@", "admins", "webmaster@", "postmaster@", "abuse@"] def user_list(fields=None): From 85b6d8554d2ce3fc545a20e1d109f0e061b59149 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 4 Oct 2022 13:04:30 +0200 Subject: [PATCH 127/174] Fix i18n issues / also we don't need operation logger for domain_action_run, already handled in subcalls --- locales/en.json | 2 +- src/domain.py | 5 +---- 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/locales/en.json b/locales/en.json index 0a1203b61..81be8da6c 100644 --- a/locales/en.json +++ b/locales/en.json @@ -139,6 +139,7 @@ "certmanager_self_ca_conf_file_not_found": "Could not find configuration file for self-signing authority (file: {file})", "certmanager_unable_to_parse_self_CA_name": "Could not parse name of self-signing authority (file: {file})", "certmanager_warning_subdomain_dns_record": "Subdomain '{subdomain}' does not resolve to the same IP address as '{domain}'. Some features will not be available until you fix this and regenerate the certificate.", + "config_action_failed": "Failed to run action '{action}': {error}", "config_action_disabled": "Could not run action '{action}' since it is disabled, make sure to meet its constraints. help: {help}", "config_apply_failed": "Applying the new configuration failed: {error}", "config_cant_set_value_on_section": "You can't set a single value on an entire config section.", @@ -362,7 +363,6 @@ "dyndns_registered": "DynDNS domain registered", "dyndns_registration_failed": "Could not register DynDNS domain: {error}", "dyndns_unavailable": "The domain '{domain}' is unavailable.", - "experimental_feature": "Warning: This feature is experimental and not considered stable, you should not use it unless you know what you are doing.", "extracting": "Extracting...", "field_invalid": "Invalid field '{}'", "file_does_not_exist": "The file {path} does not exist.", diff --git a/src/domain.py b/src/domain.py index 50a6451bf..51c9fb7fb 100644 --- a/src/domain.py +++ b/src/domain.py @@ -531,10 +531,7 @@ class DomainConfigPanel(ConfigPanel): self.values["acme_eligible"] = self.cert_status["ACME_eligible"] -@is_unit_operation() -def domain_action_run( - operation_logger, domain, action, args=None -): +def domain_action_run(domain, action, args=None): import urllib.parse From 35ab8a7c987d3a5511b48ec933aaf2fe7eae6d87 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 4 Oct 2022 16:05:45 +0200 Subject: [PATCH 128/174] Unused imports --- src/migrations/0026_new_admins_group.py | 2 -- 1 file changed, 2 deletions(-) diff --git a/src/migrations/0026_new_admins_group.py b/src/migrations/0026_new_admins_group.py index e44f1d716..3fa9a2325 100644 --- a/src/migrations/0026_new_admins_group.py +++ b/src/migrations/0026_new_admins_group.py @@ -1,7 +1,5 @@ -import os from moulinette.utils.log import getActionLogger -from yunohost.utils.error import YunohostError from yunohost.tools import Migration logger = getActionLogger("yunohost.migration") From e4df838d9d72d0bb22ecc9b5c9bb5d307d250b81 Mon Sep 17 00:00:00 2001 From: axolotle Date: Tue, 4 Oct 2022 18:12:10 +0200 Subject: [PATCH 129/174] cert: raise errors for cert install/renew --- locales/en.json | 3 +++ src/certificate.py | 24 ++++++++++++++++++++++++ 2 files changed, 27 insertions(+) diff --git a/locales/en.json b/locales/en.json index 81be8da6c..0f2ef7be8 100644 --- a/locales/en.json +++ b/locales/en.json @@ -125,8 +125,11 @@ "certmanager_attempt_to_renew_valid_cert": "The certificate for the domain '{domain}' is not about to expire! (You may use --force if you know what you're doing)", "certmanager_attempt_to_replace_valid_cert": "You are attempting to overwrite a good and valid certificate for domain {domain}! (Use --force to bypass)", "certmanager_cannot_read_cert": "Something wrong happened when trying to open current certificate for domain {domain} (file: {file}), reason: {reason}", + "certmanager_cert_install_failed": "Let's Encrypt certificate install failed for {domains}", + "certmanager_cert_install_failed_selfsigned": "Self-signed certificate install failed for {domains}", "certmanager_cert_install_success": "Let's Encrypt certificate now installed for the domain '{domain}'", "certmanager_cert_install_success_selfsigned": "Self-signed certificate now installed for the domain '{domain}'", + "certmanager_cert_renew_failed": "Let's Encrypt certificate renew failed for {domains}", "certmanager_cert_renew_success": "Let's Encrypt certificate renewed for the domain '{domain}'", "certmanager_cert_signing_failed": "Could not sign the new certificate", "certmanager_certificate_fetching_or_enabling_failed": "Trying to use the new certificate for {domain} did not work...", diff --git a/src/certificate.py b/src/certificate.py index 137a0aba0..3be821b0e 100644 --- a/src/certificate.py +++ b/src/certificate.py @@ -129,6 +129,7 @@ def certificate_install(domain_list, force=False, no_checks=False, self_signed=F def _certificate_install_selfsigned(domain_list, force=False): + failed_cert_install = [] for domain in domain_list: operation_logger = OperationLogger( @@ -223,9 +224,16 @@ def _certificate_install_selfsigned(domain_list, force=False): operation_logger.success() else: msg = f"Installation of self-signed certificate installation for {domain} failed !" + failed_cert_install.append(domain) logger.error(msg) operation_logger.error(msg) + if failed_cert_install: + raise YunohostError( + "certmanager_cert_install_failed_selfsigned", + domains=",".join(failed_cert_install) + ) + def _certificate_install_letsencrypt(domains, force=False, no_checks=False): from yunohost.domain import domain_list, _assert_domain_exists @@ -257,6 +265,7 @@ def _certificate_install_letsencrypt(domains, force=False, no_checks=False): ) # Actual install steps + failed_cert_install = [] for domain in domains: if not no_checks: @@ -285,11 +294,18 @@ def _certificate_install_letsencrypt(domains, force=False, no_checks=False): logger.error( f"Please consider checking the 'DNS records' (basic) and 'Web' categories of the diagnosis to check for possible issues that may prevent installing a Let's Encrypt certificate on domain {domain}." ) + failed_cert_install.append(domain) else: logger.success(m18n.n("certmanager_cert_install_success", domain=domain)) operation_logger.success() + if failed_cert_install: + raise YunohostError( + "certmanager_cert_install_failed", + domains=",".join(failed_cert_install) + ) + def certificate_renew(domains, force=False, no_checks=False, email=False): """ @@ -359,6 +375,7 @@ def certificate_renew(domains, force=False, no_checks=False, email=False): ) # Actual renew steps + failed_cert_install = [] for domain in domains: if not no_checks: @@ -400,6 +417,8 @@ def certificate_renew(domains, force=False, no_checks=False, email=False): logger.error(stack.getvalue()) logger.error(str(e)) + failed_cert_install.append(domain) + if email: logger.error("Sending email with details to root ...") _email_renewing_failed(domain, msg + "\n" + str(e), stack.getvalue()) @@ -407,6 +426,11 @@ def certificate_renew(domains, force=False, no_checks=False, email=False): logger.success(m18n.n("certmanager_cert_renew_success", domain=domain)) operation_logger.success() + if failed_cert_install: + raise YunohostError( + "certmanager_cert_renew_failed", + domains=",".join(failed_cert_install) + ) # # Back-end stuff # From 6295374fdb36206a01d357700be43bba25bcbfaf Mon Sep 17 00:00:00 2001 From: axolotle Date: Tue, 4 Oct 2022 19:27:04 +0200 Subject: [PATCH 130/174] configpanels: auto add i18n help for an arg if present in locales --- src/utils/config.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/utils/config.py b/src/utils/config.py index 36f7d986d..869b2792d 100644 --- a/src/utils/config.py +++ b/src/utils/config.py @@ -527,6 +527,7 @@ class ConfigPanel: "filter", "readonly", "enabled", + # "confirm", # TODO: to ask confirmation before running an action ], "defaults": {}, }, @@ -669,6 +670,9 @@ class ConfigPanel: for panel, section, option in self._iterate(): if "ask" not in option: option["ask"] = m18n.n(self.config["i18n"] + "_" + option["id"]) + # auto add i18n help text if present in locales + if m18n.key_exists(self.config["i18n"] + "_" + option["id"] + '_help'): + option["help"] = m18n.n(self.config["i18n"] + "_" + option["id"] + '_help') def display_header(message): """CLI panel/section header display""" From 1c06fd50179c53228f50a473c8e12633f3a3b073 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 4 Oct 2022 17:26:38 +0200 Subject: [PATCH 131/174] configpanels: i18n for domain cert config panel --- locales/en.json | 14 ++++++++++++++ share/config_domain.toml | 5 ----- src/certificate.py | 25 ++++++++++++++++--------- src/domain.py | 12 +++++++++--- src/utils/config.py | 2 +- 5 files changed, 40 insertions(+), 18 deletions(-) diff --git a/locales/en.json b/locales/en.json index 0f2ef7be8..ccbba1609 100644 --- a/locales/en.json +++ b/locales/en.json @@ -321,6 +321,20 @@ "domain_config_mail_in": "Incoming emails", "domain_config_mail_out": "Outgoing emails", "domain_config_xmpp": "Instant messaging (XMPP)", + "domain_config_acme_eligible": "ACME eligibility", + "domain_config_acme_eligible_explain": "This domain doesn't seem ready for a Let's Encrypt certificate. Please check your DNS configuration and HTTP server reachability. The 'DNS records' and 'Web' section in the diagnosis page can help you understand what is misconfigured.", + "domain_config_cert_install": "Install Let's Encrypt certificate", + "domain_config_cert_issuer": "Certification authority", + "domain_config_cert_no_checks": "Ignore diagnosis checks", + "domain_config_cert_renew": "Renew Let's Encrypt certificate", + "domain_config_cert_renew_help":"Certificate will be automatically renewed during the last 15 days of validity. You can manually renew it if you want to. (Not recommended).", + "domain_config_cert_summary": "Certificate status", + "domain_config_cert_summary_expired": "CRITICAL: Current certificate is not valid! HTTPS won't work at all!", + "domain_config_cert_summary_selfsigned": "WARNING: Current certificate is self-signed. Browsers will display a spooky warning to new visitors!", + "domain_config_cert_summary_abouttoexpire": "Current certificate is about to expire. It should soon be renewed automatically.", + "domain_config_cert_summary_ok": "Okay, current certificate looks good!", + "domain_config_cert_summary_letsencrypt": "Great! You're using a valid Let's Encrypt certificate!", + "domain_config_cert_validity": "Validity", "domain_created": "Domain created", "domain_creation_failed": "Unable to create domain {domain}: {error}", "domain_deleted": "Domain deleted", diff --git a/share/config_domain.toml b/share/config_domain.toml index fd12d4506..28c394cf1 100644 --- a/share/config_domain.toml +++ b/share/config_domain.toml @@ -91,8 +91,6 @@ i18n = "domain_config" type = "alert" style = "warning" visible = "acme_eligible == false" - # FIXME: improve messaging ... - ask = "Uhoh, domain isnt ready for ACME challenge according to the diagnosis" [cert.cert.cert_no_checks] ask = "Ignore diagnosis checks" @@ -101,7 +99,6 @@ i18n = "domain_config" visible = "acme_eligible == false" [cert.cert.cert_install] - ask = "Install Let's Encrypt certificate" type = "button" icon = "star" style = "success" @@ -109,8 +106,6 @@ i18n = "domain_config" enabled = "acme_eligible || cert_no_checks" [cert.cert.cert_renew] - ask = "Renew Let's Encrypt certificate" - help = "The certificate should be automatically renewed by YunoHost a few days before it expires." type = "button" icon = "refresh" style = "warning" diff --git a/src/certificate.py b/src/certificate.py index 3be821b0e..7ef7f1d54 100644 --- a/src/certificate.py +++ b/src/certificate.py @@ -153,7 +153,7 @@ def _certificate_install_selfsigned(domain_list, force=False): if not force and os.path.isfile(current_cert_file): status = _get_status(domain) - if status["summary"] == "success": + if status["style"] == "success": raise YunohostValidationError( "certmanager_attempt_to_replace_valid_cert", domain=domain ) @@ -559,9 +559,9 @@ def _fetch_and_enable_new_certificate(domain, no_checks=False): _enable_certificate(domain, new_cert_folder) # Check the status of the certificate is now good - status_summary = _get_status(domain)["summary"] + status_style = _get_status(domain)["style"] - if status_summary != "success": + if status_style != "success": raise YunohostError( "certmanager_certificate_fetching_or_enabling_failed", domain=domain ) @@ -663,18 +663,24 @@ def _get_status(domain): CA_type = "other" if days_remaining <= 0: - summary = "danger" + style = "danger" + summary = "expired" elif CA_type == "selfsigned": - summary = "warning" + style = "warning" + summary = "selfsigned" elif days_remaining < VALIDITY_LIMIT: - summary = "warning" + style = "warning" + summary = "abouttoexpire" elif CA_type == "other": - summary = "success" + style = "success" + summary = "ok" elif CA_type == "letsencrypt": - summary = "success" + style = "success" + summary = "letsencrypt" else: # shouldnt happen, because CA_type can be only selfsigned, letsencrypt, or other - summary = "" + style = "" + summary = "wat" return { "domain": domain, @@ -682,6 +688,7 @@ def _get_status(domain): "CA_name": cert_issuer, "CA_type": CA_type, "validity": days_remaining, + "style": style, "summary": summary, } diff --git a/src/domain.py b/src/domain.py index 51c9fb7fb..f5f58b3cf 100644 --- a/src/domain.py +++ b/src/domain.py @@ -505,9 +505,14 @@ class DomainConfigPanel(ConfigPanel): from yunohost.certificate import certificate_status status = certificate_status([self.entity], full=True)["certificates"][self.entity] - toml["cert"]["status"]["cert_summary"]["style"] = status["summary"] - # FIXME: improve message - toml["cert"]["status"]["cert_summary"]["ask"] = f"Status is {status['summary']} ! (FIXME: improve message depending on summary / issuer / validity ..." + toml["cert"]["status"]["cert_summary"]["style"] = status["style"] + + # i18n: domain_config_cert_summary_expired + # i18n: domain_config_cert_summary_selfsigned + # i18n: domain_config_cert_summary_abouttoexpire + # i18n: domain_config_cert_summary_ok + # i18n: domain_config_cert_summary_letsencrypt + toml["cert"]["status"]["cert_summary"]["ask"] = m18n.n(f"domain_config_cert_summary_{status['summary']}") # FIXME: Ugly hack to save the cert status and reinject it in _load_current_values ... self.cert_status = status @@ -529,6 +534,7 @@ class DomainConfigPanel(ConfigPanel): self.values["cert_validity"] = self.cert_status["validity"] self.values["cert_issuer"] = self.cert_status["CA_type"] self.values["acme_eligible"] = self.cert_status["ACME_eligible"] + self.values["summary"] = self.cert_status["summary"] def domain_action_run(domain, action, args=None): diff --git a/src/utils/config.py b/src/utils/config.py index 869b2792d..9b35d7d3b 100644 --- a/src/utils/config.py +++ b/src/utils/config.py @@ -346,7 +346,7 @@ class ConfigPanel: # FIXME: should also check that there's indeed a key called action if not self.config: - raise YunohostValidationError("config_no_such_action", action=action) + raise YunohostValidationError(f"No action named {action}", raw_msg=True) # Import and parse pre-answered options logger.debug("Import and parse pre-answered options") From 702156554a9fedf571dfea65ccd9a0ddcbbc56b5 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 4 Oct 2022 21:24:51 +0200 Subject: [PATCH 132/174] Add more info during selsigned cert generation error to debug CI --- src/certificate.py | 1 + 1 file changed, 1 insertion(+) diff --git a/src/certificate.py b/src/certificate.py index 7ef7f1d54..34b16fff3 100644 --- a/src/certificate.py +++ b/src/certificate.py @@ -226,6 +226,7 @@ def _certificate_install_selfsigned(domain_list, force=False): msg = f"Installation of self-signed certificate installation for {domain} failed !" failed_cert_install.append(domain) logger.error(msg) + logger.error(status) operation_logger.error(msg) if failed_cert_install: From 463d76f867ff4253882a0709a44c1a5deac01153 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 4 Oct 2022 22:21:23 +0200 Subject: [PATCH 133/174] domain/certs: fix bug where a self-signed cert would not get identified as a self-signed cert --- src/certificate.py | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/src/certificate.py b/src/certificate.py index 34b16fff3..b0f563c32 100644 --- a/src/certificate.py +++ b/src/certificate.py @@ -35,6 +35,7 @@ from datetime import datetime from moulinette import m18n from moulinette.utils.log import getActionLogger from moulinette.utils.filesystem import read_file +from moulinette.utils.process import check_output from yunohost.vendor.acme_tiny.acme_tiny import get_crt as sign_certificate from yunohost.utils.error import YunohostError, YunohostValidationError @@ -656,7 +657,17 @@ def _get_status(domain): ) days_remaining = (valid_up_to - datetime.utcnow()).days - if cert_issuer in ["yunohost.org"] + yunohost.domain.domain_list()["domains"]: + self_signed_issuers = ["yunohost.org"] + yunohost.domain.domain_list()["domains"] + + # FIXME: is the .ca.cnf one actually used anywhere ? x_x + conf = os.path.join(SSL_DIR, "openssl.ca.cnf") + if os.path.exists(conf): + self_signed_issuers.append(check_output(f"grep commonName_default {conf}").split()[-1]) + conf = os.path.join(SSL_DIR, "openssl.cnf") + if os.path.exists(conf): + self_signed_issuers.append(check_output(f"grep commonName_default {conf}").split()[-1]) + + if cert_issuer in self_signed_issuers: CA_type = "selfsigned" elif organization_name == "Let's Encrypt": CA_type = "letsencrypt" @@ -905,6 +916,4 @@ def _name_self_CA(): def _tail(n, file_path): - from moulinette.utils.process import check_output - return check_output(f"tail -n {n} '{file_path}'") From fe4f8b4d5e00414a2ed7d24fe35ac7c65dfdf33c Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 4 Oct 2022 22:27:23 +0200 Subject: [PATCH 134/174] not foo -> foo is None --- src/utils/config.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/utils/config.py b/src/utils/config.py index 9b35d7d3b..b55478007 100644 --- a/src/utils/config.py +++ b/src/utils/config.py @@ -1551,7 +1551,7 @@ def ask_questions_and_parse_answers( question = question_class(raw_question, context=context, hooks=hooks) if question.type == "button": if ( - not question.enabled # type: ignore + question.enabled is None # type: ignore or evaluate_simple_js_expression(question.enabled, context=context) # type: ignore ): continue From e2838455e04ee50e87567d9853d21442770895db Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Wed, 5 Oct 2022 14:18:21 +0200 Subject: [PATCH 135/174] Moar i18n friskies --- locales/en.json | 7 +++---- share/actionsmap.yml | 2 ++ src/app.py | 2 +- src/domain.py | 3 +++ src/utils/password.py | 2 +- 5 files changed, 10 insertions(+), 6 deletions(-) diff --git a/locales/en.json b/locales/en.json index 82a26a418..560ad30b5 100644 --- a/locales/en.json +++ b/locales/en.json @@ -4,10 +4,9 @@ "additional_urls_already_added": "Additionnal URL '{url}' already added in the additional URL for permission '{permission}'", "additional_urls_already_removed": "Additionnal URL '{url}' already removed in the additional URL for permission '{permission}'", "admin_password": "Administration password", - "admin_password_change_failed": "Unable to change password", - "admin_password_changed": "The administration password was changed", "already_up_to_date": "Nothing to do. Everything is already up-to-date.", "app_action_broke_system": "This action seems to have broken these important services: {services}", + "app_action_failed": "Failed to run action {action} for app {app}", "app_action_cannot_be_ran_because_required_services_down": "These required services should be running to run this action: {services}. Try restarting them to continue (and possibly investigate why they are down).", "app_already_installed": "{app} is already installed", "app_already_installed_cant_change_url": "This app is already installed. The URL cannot be changed just by this function. Check in `app changeurl` if it's available.", @@ -64,6 +63,7 @@ "apps_catalog_obsolete_cache": "The app catalog cache is empty or obsolete.", "apps_catalog_update_success": "The application catalog has been updated!", "apps_catalog_updating": "Updating application catalog...", + "ask_username": "Username", "ask_firstname": "First name", "ask_lastname": "Last name", "ask_main_domain": "Main domain", @@ -446,7 +446,6 @@ "invalid_number": "Must be a number", "invalid_number_max": "Must be lesser than {max}", "invalid_number_min": "Must be greater than {min}", - "invalid_password": "Invalid password", "invalid_regex": "Invalid regex:'{regex}'", "invalid_credentials": "Invalid password or username", "ip6tables_unavailable": "You cannot play with ip6tables here. You are either in a container or your kernel does not support it", @@ -541,6 +540,7 @@ "migration_description_0023_postgresql_11_to_13": "Migrate databases from PostgreSQL 11 to 13", "migration_description_0024_rebuild_python_venv": "Repair Python app after bullseye migration", "migration_description_0025_global_settings_to_configpanel": "Migrate legacy global settings nomenclature to the new, modern nomenclature", + "migration_description_0026_new_admins_group": "Migrate to the new 'multiple admins' system", "migration_ldap_backup_before_migration": "Creating a backup of LDAP database and apps settings prior to the actual migration.", "migration_ldap_can_not_backup_before_migration": "The backup of the system could not be completed before the migration failed. Error: {error}", "migration_ldap_migration_failed_trying_to_rollback": "Could not migrate... trying to roll back the system.", @@ -636,7 +636,6 @@ "restore_running_hooks": "Running restoration hooks...", "restore_system_part_failed": "Could not restore the '{part}' system part", "root_password_desynchronized": "The admin password was changed, but YunoHost could not propagate this to the root password!", - "root_password_replaced_by_admin_password": "Your root password have been replaced by your admin password.", "server_reboot": "The server will reboot", "server_reboot_confirm": "The server will reboot immediatly, are you sure? [{answers}]", "server_shutdown": "The server will shut down", diff --git a/share/actionsmap.yml b/share/actionsmap.yml index 78271b4cc..7417bb98d 100644 --- a/share/actionsmap.yml +++ b/share/actionsmap.yml @@ -1514,12 +1514,14 @@ tools: required: True -f: full: --firstname + help: Firstname for the first (admin) user extra: ask: ask_firstname required: True pattern: *pattern_firstname -l: full: --lastname + help: Lastname for the first (admin) user extra: ask: ask_lastname required: True diff --git a/src/app.py b/src/app.py index 9af21df7f..a90584157 100644 --- a/src/app.py +++ b/src/app.py @@ -1664,7 +1664,7 @@ ynh_app_config_run $1 elif action == "apply": raise YunohostError("app_config_unable_to_apply") else: - raise YunohostError("app_action_failed", action=action) + raise YunohostError("app_action_failed", action=action, app=app) return values diff --git a/src/domain.py b/src/domain.py index 14b28940a..2e82ab199 100644 --- a/src/domain.py +++ b/src/domain.py @@ -513,6 +513,9 @@ class DomainConfigPanel(ConfigPanel): # i18n: domain_config_cert_summary_letsencrypt toml["cert"]["status"]["cert_summary"]["ask"] = m18n.n(f"domain_config_cert_summary_{status['summary']}") + # Other specific strings used in config panels + # i18n: domain_config_cert_renew_help + # FIXME: Ugly hack to save the cert status and reinject it in _load_current_values ... self.cert_status = status diff --git a/src/utils/password.py b/src/utils/password.py index 42ed45ddd..f55acf5c0 100644 --- a/src/utils/password.py +++ b/src/utils/password.py @@ -61,7 +61,7 @@ def assert_password_is_compatible(password): # as well as modules available in python's path. from yunohost.utils.error import YunohostValidationError - raise YunohostValidationError("admin_password_too_long") + raise YunohostValidationError("password_too_long") def assert_password_is_strong_enough(profile, password): From 6001b0f7af7d846ca1c194f4e48f72e96f171eb4 Mon Sep 17 00:00:00 2001 From: axolotle Date: Tue, 1 Feb 2022 18:23:38 +0100 Subject: [PATCH 136/174] rework domains cache logic --- src/domain.py | 118 ++++++++++++++++++++++++-------------------------- 1 file changed, 57 insertions(+), 61 deletions(-) diff --git a/src/domain.py b/src/domain.py index 14b28940a..eab56761b 100644 --- a/src/domain.py +++ b/src/domain.py @@ -24,7 +24,7 @@ Manage domains """ import os -from typing import Dict, Any +from typing import List, Any from moulinette import m18n, Moulinette from moulinette.core import MoulinetteError @@ -47,7 +47,47 @@ logger = getActionLogger("yunohost.domain") DOMAIN_SETTINGS_DIR = "/etc/yunohost/domains" # Lazy dev caching to avoid re-query ldap every time we need the domain list -domain_list_cache: Dict[str, Any] = {} +domain_list_cache: List[str] = [] +main_domain_cache: str = None + + +def _get_maindomain(no_cache=False): + global main_domain_cache + if not main_domain_cache or no_cache: + with open("/etc/yunohost/current_host", "r") as f: + main_domain_cache = f.readline().rstrip() + + return main_domain_cache + + +def _get_domains(exclude_subdomains=False, no_cache=False): + global domain_list_cache + if not domain_list_cache or no_cache: + from yunohost.utils.ldap import _get_ldap_interface + + ldap = _get_ldap_interface() + result = [ + entry["virtualdomain"][0] + for entry in ldap.search("ou=domains", "virtualdomain=*", ["virtualdomain"]) + ] + + def cmp_domain(domain): + # Keep the main part of the domain and the extension together + # eg: this.is.an.example.com -> ['example.com', 'an', 'is', 'this'] + domain = domain.split(".") + domain[-1] = domain[-2] + domain.pop() + return list(reversed(domain)) + + domain_list_cache = sorted(result, key=cmp_domain) + + if exclude_subdomains: + return [ + domain + for domain in domain_list_cache + if not _get_parent_domain_of(domain, return_self=False) + ] + + return domain_list_cache def domain_list(exclude_subdomains=False): @@ -58,47 +98,11 @@ def domain_list(exclude_subdomains=False): exclude_subdomains -- Filter out domains that are subdomains of other declared domains """ - global domain_list_cache - if not exclude_subdomains and domain_list_cache: - return domain_list_cache - - from yunohost.utils.ldap import _get_ldap_interface - - ldap = _get_ldap_interface() - result = [ - entry["virtualdomain"][0] - for entry in ldap.search("ou=domains", "virtualdomain=*", ["virtualdomain"]) - ] - - result_list = [] - for domain in result: - if exclude_subdomains: - parent_domain = domain.split(".", 1)[1] - if parent_domain in result: - continue - - result_list.append(domain) - - def cmp_domain(domain): - # Keep the main part of the domain and the extension together - # eg: this.is.an.example.com -> ['example.com', 'an', 'is', 'this'] - domain = domain.split(".") - domain[-1] = domain[-2] + domain.pop() - domain = list(reversed(domain)) - return domain - - result_list = sorted(result_list, key=cmp_domain) - - # Don't cache answer if using exclude_subdomains - if exclude_subdomains: - return {"domains": result_list, "main": _get_maindomain()} - - domain_list_cache = {"domains": result_list, "main": _get_maindomain()} - return domain_list_cache + return {"domains": _get_domains(exclude_subdomains), "main": _get_maindomain()} def _assert_domain_exists(domain): - if domain not in domain_list()["domains"]: + if domain not in _get_domains(): raise YunohostValidationError("domain_unknown", domain=domain) @@ -107,26 +111,24 @@ def _list_subdomains_of(parent_domain): _assert_domain_exists(parent_domain) out = [] - for domain in domain_list()["domains"]: + for domain in _get_domains(): if domain.endswith(f".{parent_domain}"): out.append(domain) return out -def _get_parent_domain_of(domain): +def _get_parent_domain_of(domain, return_self=True): _assert_domain_exists(domain) - if "." not in domain: - return domain + domains = _get_domains() + while "." in domain: + domain = domain.split(".", 1)[1] + if domain in domains: + return domain - parent_domain = domain.split(".", 1)[-1] - if parent_domain not in domain_list()["domains"]: - return domain # Domain is its own parent - - else: - return _get_parent_domain_of(parent_domain) + return domain if return_self else None @is_unit_operation() @@ -198,7 +200,7 @@ def domain_add(operation_logger, domain, dyndns=False): raise YunohostError("domain_creation_failed", domain=domain, error=e) finally: global domain_list_cache - domain_list_cache = {} + domain_list_cache = [] # Don't regen these conf if we're still in postinstall if os.path.exists("/etc/yunohost/installed"): @@ -255,7 +257,7 @@ def domain_remove(operation_logger, domain, remove_apps=False, force=False): # Check domain is not the main domain if domain == _get_maindomain(): - other_domains = domain_list()["domains"] + other_domains = _get_domains() other_domains.remove(domain) if other_domains: @@ -316,7 +318,7 @@ def domain_remove(operation_logger, domain, remove_apps=False, force=False): raise YunohostError("domain_deletion_failed", domain=domain, error=e) finally: global domain_list_cache - domain_list_cache = {} + domain_list_cache = [] stuff_to_delete = [ f"/etc/yunohost/certs/{domain}", @@ -380,8 +382,8 @@ def domain_main_domain(operation_logger, new_main_domain=None): # Apply changes to ssl certs try: write_to_file("/etc/yunohost/current_host", new_main_domain) - global domain_list_cache - domain_list_cache = {} + global main_domain_cache + main_domain_cache = None _set_hostname(new_main_domain) except Exception as e: logger.warning(str(e), exc_info=1) @@ -409,12 +411,6 @@ def domain_url_available(domain, path): return len(_get_conflicting_apps(domain, path)) == 0 -def _get_maindomain(): - with open("/etc/yunohost/current_host", "r") as f: - maindomain = f.readline().rstrip() - return maindomain - - def domain_config_get(domain, key="", full=False, export=False): """ Display a domain configuration From 77471c41403fb8c39c2e14b9b65d8c170d844012 Mon Sep 17 00:00:00 2001 From: axolotle Date: Tue, 1 Feb 2022 18:38:01 +0100 Subject: [PATCH 137/174] add tree option on domain_list() --- share/actionsmap.yml | 3 +++ src/domain.py | 46 ++++++++++++++++++++++++++++++++++++++++++-- 2 files changed, 47 insertions(+), 2 deletions(-) diff --git a/share/actionsmap.yml b/share/actionsmap.yml index 78271b4cc..e7f935b3e 100644 --- a/share/actionsmap.yml +++ b/share/actionsmap.yml @@ -443,6 +443,9 @@ domain: --exclude-subdomains: help: Filter out domains that are obviously subdomains of other declared domains action: store_true + --tree: + help: Display domains as a tree + action: store_true ### domain_add() add: diff --git a/src/domain.py b/src/domain.py index eab56761b..beb8cd161 100644 --- a/src/domain.py +++ b/src/domain.py @@ -90,15 +90,42 @@ def _get_domains(exclude_subdomains=False, no_cache=False): return domain_list_cache -def domain_list(exclude_subdomains=False): +def domain_list(exclude_subdomains=False, tree=False): """ List domains Keyword argument: exclude_subdomains -- Filter out domains that are subdomains of other declared domains + tree -- Display domains as a hierarchy tree """ - return {"domains": _get_domains(exclude_subdomains), "main": _get_maindomain()} + from collections import OrderedDict + + domains = _get_domains(exclude_subdomains) + main = _get_maindomain() + + if not tree: + return {"domains": domains, "main": main} + + if tree and exclude_subdomains: + return { + "domains": OrderedDict({domain: {} for domain in domains}), + "main": main, + } + + def get_parent_dict(tree, child): + # If parent exists it should be the last added (see `_get_domains` ordering) + possible_parent = next(reversed(tree)) if tree else None + if possible_parent and child.endswith(f".{possible_parent}"): + return get_parent_dict(tree[possible_parent], child) + return tree + + result = OrderedDict() + for domain in domains: + parent = get_parent_dict(result, domain) + parent[domain] = OrderedDict() + + return {"domains": result, "main": main} def _assert_domain_exists(domain): @@ -118,6 +145,21 @@ def _list_subdomains_of(parent_domain): return out +# def _get_parent_domain_of(domain): +# +# _assert_domain_exists(domain) +# +# if "." not in domain: +# return domain +# +# parent_domain = domain.split(".", 1)[-1] +# if parent_domain not in _get_domains(): +# return domain # Domain is its own parent +# +# else: +# return _get_parent_domain_of(parent_domain) + + def _get_parent_domain_of(domain, return_self=True): _assert_domain_exists(domain) From d848837bc65c5de06f5bca130bd7907718c42c98 Mon Sep 17 00:00:00 2001 From: axolotle Date: Tue, 1 Feb 2022 18:51:21 +0100 Subject: [PATCH 138/174] add new domain_info() command to get a domain's dns, certs and apps infos --- share/actionsmap.yml | 9 ++++++ src/domain.py | 76 ++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 85 insertions(+) diff --git a/share/actionsmap.yml b/share/actionsmap.yml index e7f935b3e..e4c66b82b 100644 --- a/share/actionsmap.yml +++ b/share/actionsmap.yml @@ -447,6 +447,15 @@ domain: help: Display domains as a tree action: store_true + ### domain_info() + info: + action_help: Get domains aggredated data + api: GET /domains/ + arguments: + domains: + help: Domains to check + nargs: "*" + ### domain_add() add: action_help: Create a custom domain diff --git a/src/domain.py b/src/domain.py index beb8cd161..034e0f935 100644 --- a/src/domain.py +++ b/src/domain.py @@ -128,6 +128,82 @@ def domain_list(exclude_subdomains=False, tree=False): return {"domains": result, "main": main} +def domain_info(domains): + """ + Print aggregate data about domains (all by default) + + Keyword argument: + domains -- Domains to be checked + + """ + + from collections import OrderedDict + from yunohost.app import app_info + from yunohost.dns import _get_registar_settings + from yunohost.utils.dns import is_special_use_tld + + # If no domains given, consider all yunohost domains + if domains == []: + domains = _get_domains() + # Else, validate that yunohost knows the domains given + else: + for domain in domains: + _assert_domain_exists(domain) + + def get_dns_config(domain): + if is_special_use_tld(domain): + return {"method": "none"} + + registrar, registrar_credentials = _get_registar_settings(domain) + + if not registrar or registrar == "None": # yes it's None as a string + return {"method": "manual", "semi_auto_status": "unavailable"} + if registrar == "parent_domain": + return {"method": "handled_in_parent"} + if registrar == "yunohost": + return {"method": "auto", "registrar": registrar} + if not all(registrar_credentials.values()): + return { + "method": "manual", + "semi_auto_status": "activable", + "registrar": registrar, + } + + return { + "method": "semi_auto", + "registrar": registrar, + "semi_auto_status": "activated", + } + + certs = domain_cert_status(domains, full=True)["certificates"] + apps = {domain: [] for domain in domains} + + for app in _installed_apps(): + settings = _get_app_settings(app) + if settings["domain"] in domains: + apps[settings["domain"]].append( + {"name": app_info(app)["name"], "id": app, "path": settings["path"]} + ) + + result = OrderedDict() + for domain in domains: + result[domain] = OrderedDict( + { + "certificate": { + "authority": certs[domain]["CA_type"]["code"], + "validity": certs[domain]["validity"], + "ACME_eligible": certs[domain]["ACME_eligible"], + }, + "dns": get_dns_config(domain), + } + ) + + if apps[domain]: + result[domain]["apps"] = apps[domain] + + return {"domains": result} + + def _assert_domain_exists(domain): if domain not in _get_domains(): raise YunohostValidationError("domain_unknown", domain=domain) From 7b7c5f0b13ab38fd1f1341f7b3a135e70c60074d Mon Sep 17 00:00:00 2001 From: axolotle Date: Tue, 1 Feb 2022 18:53:43 +0100 Subject: [PATCH 139/174] changed cert acme status to a string to add 'unknown' status (when not diagnosed) --- src/certificate.py | 10 +++++++--- src/domain.py | 2 +- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/src/certificate.py b/src/certificate.py index 076a12980..45453e170 100644 --- a/src/certificate.py +++ b/src/certificate.py @@ -98,9 +98,13 @@ def certificate_status(domains, full=False): if full: try: _check_domain_is_ready_for_ACME(domain) - status["ACME_eligible"] = True - except Exception: - status["ACME_eligible"] = False + status["acme_status"] = 'eligible' + except Exception as e: + if e.key == 'certmanager_domain_not_diagnosed_yet': + status["acme_status"] = 'unknown' + else: + status["acme_status"] = 'ineligible' + del status["domain"] certificates[domain] = status diff --git a/src/domain.py b/src/domain.py index 034e0f935..c66924fe7 100644 --- a/src/domain.py +++ b/src/domain.py @@ -192,7 +192,7 @@ def domain_info(domains): "certificate": { "authority": certs[domain]["CA_type"]["code"], "validity": certs[domain]["validity"], - "ACME_eligible": certs[domain]["ACME_eligible"], + "acme_status": certs[domain]["acme_status"], }, "dns": get_dns_config(domain), } From 81b90d79cbc3b36e39e79d84a6055fe8b59ad9f2 Mon Sep 17 00:00:00 2001 From: axolotle Date: Tue, 1 Feb 2022 19:06:03 +0100 Subject: [PATCH 140/174] remove previous _get_parent_domain_of() --- src/domain.py | 15 --------------- 1 file changed, 15 deletions(-) diff --git a/src/domain.py b/src/domain.py index c66924fe7..9dff5a779 100644 --- a/src/domain.py +++ b/src/domain.py @@ -221,21 +221,6 @@ def _list_subdomains_of(parent_domain): return out -# def _get_parent_domain_of(domain): -# -# _assert_domain_exists(domain) -# -# if "." not in domain: -# return domain -# -# parent_domain = domain.split(".", 1)[-1] -# if parent_domain not in _get_domains(): -# return domain # Domain is its own parent -# -# else: -# return _get_parent_domain_of(parent_domain) - - def _get_parent_domain_of(domain, return_self=True): _assert_domain_exists(domain) From 96233ea6005c5a450055a0ee09dc8005a0bfdbda Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Wed, 5 Oct 2022 15:06:04 +0200 Subject: [PATCH 141/174] Rework domain_info --- share/actionsmap.yml | 9 +++--- src/domain.py | 77 ++++++++++---------------------------------- 2 files changed, 22 insertions(+), 64 deletions(-) diff --git a/share/actionsmap.yml b/share/actionsmap.yml index e4c66b82b..90146db89 100644 --- a/share/actionsmap.yml +++ b/share/actionsmap.yml @@ -449,12 +449,13 @@ domain: ### domain_info() info: - action_help: Get domains aggredated data + action_help: Get domain aggredated data api: GET /domains/ arguments: - domains: - help: Domains to check - nargs: "*" + domain: + help: Domain to check + extra: + pattern: *pattern_domain ### domain_add() add: diff --git a/src/domain.py b/src/domain.py index 9dff5a779..677441469 100644 --- a/src/domain.py +++ b/src/domain.py @@ -25,6 +25,7 @@ """ import os from typing import List, Any +from collections import OrderedDict from moulinette import m18n, Moulinette from moulinette.core import MoulinetteError @@ -99,7 +100,6 @@ def domain_list(exclude_subdomains=False, tree=False): tree -- Display domains as a hierarchy tree """ - from collections import OrderedDict domains = _get_domains(exclude_subdomains) main = _get_maindomain() @@ -128,80 +128,37 @@ def domain_list(exclude_subdomains=False, tree=False): return {"domains": result, "main": main} -def domain_info(domains): +def domain_info(domain): """ - Print aggregate data about domains (all by default) + Print aggregate data for a specific domain Keyword argument: - domains -- Domains to be checked - + domain -- Domain to be checked """ - from collections import OrderedDict from yunohost.app import app_info from yunohost.dns import _get_registar_settings - from yunohost.utils.dns import is_special_use_tld - # If no domains given, consider all yunohost domains - if domains == []: - domains = _get_domains() - # Else, validate that yunohost knows the domains given - else: - for domain in domains: - _assert_domain_exists(domain) + _assert_domain_exists(domain) - def get_dns_config(domain): - if is_special_use_tld(domain): - return {"method": "none"} - - registrar, registrar_credentials = _get_registar_settings(domain) - - if not registrar or registrar == "None": # yes it's None as a string - return {"method": "manual", "semi_auto_status": "unavailable"} - if registrar == "parent_domain": - return {"method": "handled_in_parent"} - if registrar == "yunohost": - return {"method": "auto", "registrar": registrar} - if not all(registrar_credentials.values()): - return { - "method": "manual", - "semi_auto_status": "activable", - "registrar": registrar, - } - - return { - "method": "semi_auto", - "registrar": registrar, - "semi_auto_status": "activated", - } - - certs = domain_cert_status(domains, full=True)["certificates"] - apps = {domain: [] for domain in domains} + registrar, _ = _get_registar_settings(domain) + certificate = domain_cert_status([domain], full=True)["certificates"][domain] + apps = [] for app in _installed_apps(): settings = _get_app_settings(app) - if settings["domain"] in domains: - apps[settings["domain"]].append( + if settings.get("domain") == domain: + apps.append( {"name": app_info(app)["name"], "id": app, "path": settings["path"]} ) - result = OrderedDict() - for domain in domains: - result[domain] = OrderedDict( - { - "certificate": { - "authority": certs[domain]["CA_type"]["code"], - "validity": certs[domain]["validity"], - "acme_status": certs[domain]["acme_status"], - }, - "dns": get_dns_config(domain), - } - ) - - if apps[domain]: - result[domain]["apps"] = apps[domain] - - return {"domains": result} + return { + "certificate": certificate, + "registrar": registrar, + "apps": apps, + "main": _get_maindomain() == domain, + # TODO : add parent / child domains ? + } def _assert_domain_exists(domain): From 1a543fe4166f00aa332be6ee99d703d6cdab38f6 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Wed, 5 Oct 2022 15:35:51 +0200 Subject: [PATCH 142/174] Fix acme_status / ACME_eligible --- share/config_domain.toml | 4 ++-- src/certificate.py | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/share/config_domain.toml b/share/config_domain.toml index 28c394cf1..a3607811b 100644 --- a/share/config_domain.toml +++ b/share/config_domain.toml @@ -90,13 +90,13 @@ i18n = "domain_config" [cert.cert.acme_eligible_explain] type = "alert" style = "warning" - visible = "acme_eligible == false" + visible = "acme_eligible == false || acme_elligible == null" [cert.cert.cert_no_checks] ask = "Ignore diagnosis checks" type = "boolean" default = false - visible = "acme_eligible == false" + visible = "acme_eligible == false || acme_elligible == null" [cert.cert.cert_install] type = "button" diff --git a/src/certificate.py b/src/certificate.py index 45453e170..5ca29ce55 100644 --- a/src/certificate.py +++ b/src/certificate.py @@ -98,12 +98,12 @@ def certificate_status(domains, full=False): if full: try: _check_domain_is_ready_for_ACME(domain) - status["acme_status"] = 'eligible' + status["ACME_eligible"] = True except Exception as e: if e.key == 'certmanager_domain_not_diagnosed_yet': - status["acme_status"] = 'unknown' + status["ACME_eligible"] = None # = unknown status else: - status["acme_status"] = 'ineligible' + status["ACME_eligible"] = False del status["domain"] From caf1534ce61293771e7e9a2af84379f5579c2afe Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Wed, 5 Oct 2022 15:37:03 +0200 Subject: [PATCH 143/174] Typomg --- share/actionsmap.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/share/actionsmap.yml b/share/actionsmap.yml index 90146db89..9df002bcf 100644 --- a/share/actionsmap.yml +++ b/share/actionsmap.yml @@ -450,7 +450,7 @@ domain: ### domain_info() info: action_help: Get domain aggredated data - api: GET /domains/ + api: GET /domains/ arguments: domain: help: Domain to check From 23b83b5ef7a75c3ef898f4f4b4f477e571103f40 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 7 Oct 2022 13:59:54 +0200 Subject: [PATCH 144/174] Unused import --- src/domain.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/domain.py b/src/domain.py index 677441469..dd84d6f09 100644 --- a/src/domain.py +++ b/src/domain.py @@ -24,7 +24,7 @@ Manage domains """ import os -from typing import List, Any +from typing import List from collections import OrderedDict from moulinette import m18n, Moulinette From 73a7f93740e46fa320401ccfd7d0ebb001398736 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 7 Oct 2022 14:19:15 +0200 Subject: [PATCH 145/174] domains: make the domain cache expire after 15 seconds to prevent inconsistencies between CLI and API --- src/domain.py | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/src/domain.py b/src/domain.py index dd84d6f09..78e3c2597 100644 --- a/src/domain.py +++ b/src/domain.py @@ -24,6 +24,7 @@ Manage domains """ import os +import time from typing import List from collections import OrderedDict @@ -48,22 +49,30 @@ logger = getActionLogger("yunohost.domain") DOMAIN_SETTINGS_DIR = "/etc/yunohost/domains" # Lazy dev caching to avoid re-query ldap every time we need the domain list +# The cache automatically expire every 15 seconds, to prevent desync between +# yunohost CLI and API which run in different processes domain_list_cache: List[str] = [] +domain_list_cache_timestamp = 0 main_domain_cache: str = None +main_domain_cache_timestamp = 0 +DOMAIN_CACHE_DURATION = 15 -def _get_maindomain(no_cache=False): +def _get_maindomain(): global main_domain_cache - if not main_domain_cache or no_cache: + global main_domain_cache_timestamp + if not main_domain_cache or abs(main_domain_cache_timestamp - time.time()) > DOMAIN_CACHE_DURATION: with open("/etc/yunohost/current_host", "r") as f: main_domain_cache = f.readline().rstrip() + main_domain_cache_timestamp = time.time() return main_domain_cache -def _get_domains(exclude_subdomains=False, no_cache=False): +def _get_domains(exclude_subdomains=False): global domain_list_cache - if not domain_list_cache or no_cache: + global domain_list_cache_timestamp + if not domain_list_cache or abs(domain_list_cache_timestamp - time.time()) > DOMAIN_CACHE_DURATION: from yunohost.utils.ldap import _get_ldap_interface ldap = _get_ldap_interface() @@ -80,6 +89,7 @@ def _get_domains(exclude_subdomains=False, no_cache=False): return list(reversed(domain)) domain_list_cache = sorted(result, key=cmp_domain) + domain_list_cache_timestamp = time.time() if exclude_subdomains: return [ @@ -443,7 +453,7 @@ def domain_main_domain(operation_logger, new_main_domain=None): try: write_to_file("/etc/yunohost/current_host", new_main_domain) global main_domain_cache - main_domain_cache = None + main_domain_cache = new_main_domain _set_hostname(new_main_domain) except Exception as e: logger.warning(str(e), exc_info=1) From 4d025010c421b1b22f4c67b8ea157a830fc2314e Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 7 Oct 2022 14:21:21 +0200 Subject: [PATCH 146/174] domain: add proper panel names in config panel --- share/config_domain.toml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/share/config_domain.toml b/share/config_domain.toml index a3607811b..0a3ba96cc 100644 --- a/share/config_domain.toml +++ b/share/config_domain.toml @@ -5,12 +5,13 @@ i18n = "domain_config" # Other things we may want to implement in the future: # # - maindomain handling -# - default app # - autoredirect www in nginx conf # - ? # [feature] +name = "Features" + [feature.app] [feature.app.default_app] type = "app" @@ -46,6 +47,7 @@ i18n = "domain_config" default = 0 [dns] +name = "DNS" [dns.registrar] optional = true @@ -61,6 +63,7 @@ i18n = "domain_config" [cert] +name = "Certificate" [cert.status] name = "Status" From 435084c20b47f92b82a75c5111db639049163fbf Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 7 Oct 2022 14:48:02 +0200 Subject: [PATCH 147/174] domain: _get_parent_domain_of call tweaking --- src/certificate.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/certificate.py b/src/certificate.py index 5ca29ce55..299095af0 100644 --- a/src/certificate.py +++ b/src/certificate.py @@ -798,7 +798,7 @@ def _check_domain_is_ready_for_ACME(domain): or {} ) - parent_domain = _get_parent_domain_of(domain) + parent_domain = _get_parent_domain_of(domain, return_self=True) dnsrecords = ( Diagnoser.get_cached_report( From b30962a44f17a368e7dbf6d314e542c61e6b7337 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 7 Oct 2022 15:07:48 +0200 Subject: [PATCH 148/174] domain_info: add 'topest_parent' info + fix small bug with return_self option for _get_parent_domain_of --- src/domain.py | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/src/domain.py b/src/domain.py index 78e3c2597..650b5e20f 100644 --- a/src/domain.py +++ b/src/domain.py @@ -167,6 +167,7 @@ def domain_info(domain): "registrar": registrar, "apps": apps, "main": _get_maindomain() == domain, + "topest_parent": _get_parent_domain_of(domain, return_self=True, topest=True), # TODO : add parent / child domains ? } @@ -188,15 +189,17 @@ def _list_subdomains_of(parent_domain): return out -def _get_parent_domain_of(domain, return_self=True): +def _get_parent_domain_of(domain, return_self=True, topest=False): _assert_domain_exists(domain) - domains = _get_domains() - while "." in domain: - domain = domain.split(".", 1)[1] - if domain in domains: - return domain + domains = _get_domains(exclude_subdomains=topest) + + domain_ = domain + while "." in domain_: + domain_ = domain_.split(".", 1)[1] + if domain_ in domains: + return domain_ return domain if return_self else None From 3079f2f70855f08a0bb28e70a914c6c921aaa412 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 7 Oct 2022 16:52:54 +0200 Subject: [PATCH 149/174] i18n: fix fr string for compress_tar_archives, full description is now in the _help --- locales/fr.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/locales/fr.json b/locales/fr.json index 445dbd120..82cd438b0 100644 --- a/locales/fr.json +++ b/locales/fr.json @@ -529,7 +529,7 @@ "regenconf_need_to_explicitly_specify_ssh": "La configuration de ssh a été modifiée manuellement. Vous devez explicitement indiquer la mention --force à \"ssh\" pour appliquer les changements.", "diagnosis_dns_try_dyndns_update_force": "La configuration DNS de ce domaine devrait être automatiquement gérée par YunoHost. Si ce n'est pas le cas, vous pouvez essayer de forcer une mise à jour en utilisant yunohost dyndns update --force.", "app_packaging_format_not_supported": "Cette application ne peut pas être installée car son format n'est pas pris en charge par votre version de YunoHost. Vous devriez probablement envisager de mettre à jour votre système.", - "global_settings_setting_backup_compress_tar_archives": "Lors de la création de nouvelles sauvegardes, compresser automatiquement les archives (.tar.gz) au lieu des archives non compressées (.tar). N.B. : activer cette option permet de créer des archives plus légères, mais la procédure de sauvegarde initiale sera significativement plus longues et plus gourmandes en CPU.", + "global_settings_setting_backup_compress_tar_archives": "Compresser les archives de backup", "diagnosis_processes_killed_by_oom_reaper": "Certains processus ont été récemment arrêtés par le système car il manquait de mémoire. Ceci est typiquement symptomatique d'un manque de mémoire sur le système ou d'un processus consommant trop de mémoire. Liste des processus arrêtés :\n{kills_summary}", "ask_user_domain": "Domaine à utiliser pour l'adresse email de l'utilisateur et le compte XMPP", "app_manifest_install_ask_is_public": "Cette application devrait-elle être visible par les visiteurs anonymes ?", From 0930548640aa60d2d9c54c5b794dc162aa1d8551 Mon Sep 17 00:00:00 2001 From: axolotle Date: Fri, 7 Oct 2022 18:03:51 +0200 Subject: [PATCH 150/174] add title to DNS registrar section --- share/config_domain.toml | 4 +--- src/dns.py | 4 +++- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/share/config_domain.toml b/share/config_domain.toml index 0a3ba96cc..88714525d 100644 --- a/share/config_domain.toml +++ b/share/config_domain.toml @@ -50,9 +50,7 @@ name = "Features" name = "DNS" [dns.registrar] - optional = true - - # This part is automatically generated in DomainConfigPanel + # This part is automatically generated in DomainConfigPanel # [dns.advanced] # diff --git a/src/dns.py b/src/dns.py index 1d0b4486f..d96041e75 100644 --- a/src/dns.py +++ b/src/dns.py @@ -512,7 +512,9 @@ def _get_registrar_config_section(domain): from lexicon.providers.auto import _relevant_provider_for_domain - registrar_infos = {} + registrar_infos = { + "name": "Registrar infos", + } dns_zone = _get_dns_zone_for_domain(domain) From 5cfbcd4c494e161e77f6382bdd313fcf3ebc1877 Mon Sep 17 00:00:00 2001 From: axolotle Date: Fri, 7 Oct 2022 18:08:25 +0200 Subject: [PATCH 151/174] domaindns: update _get_parent_domain_of defaults and calls to --- src/dns.py | 15 ++++++++------- src/domain.py | 6 +++--- 2 files changed, 11 insertions(+), 10 deletions(-) diff --git a/src/dns.py b/src/dns.py index d96041e75..795e056ea 100644 --- a/src/dns.py +++ b/src/dns.py @@ -41,6 +41,7 @@ from yunohost.domain import ( _get_domain_settings, _set_domain_settings, _list_subdomains_of, + _get_parent_domain_of, ) from yunohost.utils.dns import dig, is_yunohost_dyndns_domain, is_special_use_tld from yunohost.utils.error import YunohostValidationError, YunohostError @@ -446,8 +447,8 @@ def _get_dns_zone_for_domain(domain): # This is another strick to try to prevent this function from being # a bottleneck on system with 1 main domain + 10ish subdomains # when building the dns conf for the main domain (which will call domain_config_get, etc...) - parent_domain = domain.split(".", 1)[1] - if parent_domain in domain_list()["domains"]: + parent_domain = _get_parent_domain_of(domain) + if parent_domain: parent_cache_file = f"{cache_folder}/{parent_domain}" if ( os.path.exists(parent_cache_file) @@ -519,12 +520,12 @@ def _get_registrar_config_section(domain): dns_zone = _get_dns_zone_for_domain(domain) # If parent domain exists in yunohost - parent_domain = domain.split(".", 1)[1] - if parent_domain in domain_list()["domains"]: + parent_domain = _get_parent_domain_of(domain, topest=True) + if parent_domain: # Dirty hack to have a link on the webadmin if Moulinette.interface.type == "api": - parent_domain_link = f"[{parent_domain}](#/domains/{parent_domain}/config)" + parent_domain_link = f"[{parent_domain}](#/domains/{parent_domain}/dns)" else: parent_domain_link = parent_domain @@ -534,7 +535,7 @@ def _get_registrar_config_section(domain): "style": "info", "ask": m18n.n( "domain_dns_registrar_managed_in_parent_domain", - parent_domain=domain, + parent_domain=parent_domain, parent_domain_link=parent_domain_link, ), "value": "parent_domain", @@ -649,7 +650,7 @@ def domain_dns_push(operation_logger, domain, dry_run=False, force=False, purge= return {} if registrar == "parent_domain": - parent_domain = domain.split(".", 1)[1] + parent_domain = _get_parent_domain_of(domain, topest=True) registar, registrar_credentials = _get_registar_settings(parent_domain) if any(registrar_credentials.values()): raise YunohostValidationError( diff --git a/src/domain.py b/src/domain.py index 650b5e20f..0b904b70d 100644 --- a/src/domain.py +++ b/src/domain.py @@ -95,7 +95,7 @@ def _get_domains(exclude_subdomains=False): return [ domain for domain in domain_list_cache - if not _get_parent_domain_of(domain, return_self=False) + if not _get_parent_domain_of(domain) ] return domain_list_cache @@ -167,7 +167,7 @@ def domain_info(domain): "registrar": registrar, "apps": apps, "main": _get_maindomain() == domain, - "topest_parent": _get_parent_domain_of(domain, return_self=True, topest=True), + "topest_parent": _get_parent_domain_of(domain, topest=True), # TODO : add parent / child domains ? } @@ -189,7 +189,7 @@ def _list_subdomains_of(parent_domain): return out -def _get_parent_domain_of(domain, return_self=True, topest=False): +def _get_parent_domain_of(domain, return_self=False, topest=False): _assert_domain_exists(domain) From 1fe507651b1ab5646878aa797a85af88abed2055 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 7 Oct 2022 17:03:07 +0200 Subject: [PATCH 152/174] domain: i18n for config panel section --- src/dns.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/dns.py b/src/dns.py index 795e056ea..318a5fcde 100644 --- a/src/dns.py +++ b/src/dns.py @@ -514,7 +514,7 @@ def _get_registrar_config_section(domain): from lexicon.providers.auto import _relevant_provider_for_domain registrar_infos = { - "name": "Registrar infos", + "name": m18n.n('registrar_infos'), # This is meant to name the config panel section, for proper display in the webadmin } dns_zone = _get_dns_zone_for_domain(domain) From fe2ae7d591a9215ebf18e713b1ee1698536a3614 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 7 Oct 2022 17:04:15 +0200 Subject: [PATCH 153/174] i18n: define registrar_infos key --- locales/en.json | 1 + 1 file changed, 1 insertion(+) diff --git a/locales/en.json b/locales/en.json index 560ad30b5..750205af8 100644 --- a/locales/en.json +++ b/locales/en.json @@ -619,6 +619,7 @@ "regenconf_would_be_updated": "The configuration would have been updated for category '{category}'", "regex_incompatible_with_tile": "/!\\ Packagers! Permission '{permission}' has show_tile set to 'true' and you therefore cannot define a regex URL as the main URL", "regex_with_only_domain": "You can't use a regex for domain, only for path", + "registrar_infos": "Registrar infos", "restore_already_installed_app": "An app with the ID '{app}' is already installed", "restore_already_installed_apps": "The following apps can't be restored because they are already installed: {apps}", "restore_backup_too_old": "This backup archive can not be restored because it comes from a too-old YunoHost version.", From e968e748b61ee33c76ae229af732b2b6ac679e20 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 7 Oct 2022 17:51:04 +0200 Subject: [PATCH 154/174] i18n: moar wording tweaking --- locales/en.json | 4 ++-- locales/fr.json | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/locales/en.json b/locales/en.json index 750205af8..41a31cd52 100644 --- a/locales/en.json +++ b/locales/en.json @@ -385,7 +385,7 @@ "firewall_reloaded": "Firewall reloaded", "firewall_rules_cmd_failed": "Some firewall rule commands have failed. More info in log.", "global_settings_reset_success": "Reset global settings", - "global_settings_setting_admin_strength": "Admin password strength", + "global_settings_setting_admin_strength": "Admin password strength requirements", "global_settings_setting_admin_strength_help": "These requirements are only enforced when defining the password", "global_settings_setting_backup_compress_tar_archives": "Compress backups", "global_settings_setting_backup_compress_tar_archives_help": "When creating new backups, compress the archives (.tar.gz) instead of uncompressed archives (.tar). N.B. : enabling this option means create lighter backup archives, but the initial backup procedure will be significantly longer and heavy on CPU.", @@ -413,7 +413,7 @@ "global_settings_setting_ssh_password_authentication_help": "Allow password authentication for SSH", "global_settings_setting_ssh_port": "SSH port", "global_settings_setting_ssowat_panel_overlay_enabled": "Enable the small 'YunoHost' portal shortcut square on apps", - "global_settings_setting_user_strength": "User password strength", + "global_settings_setting_user_strength": "User password strength requirements", "global_settings_setting_user_strength_help": "These requirements are only enforced when defining the password", "global_settings_setting_webadmin_allowlist": "Webadmin IP allowlist", "global_settings_setting_webadmin_allowlist_help": "IP adresses allowed to access the webadmin.", diff --git a/locales/fr.json b/locales/fr.json index 82cd438b0..c8291737b 100644 --- a/locales/fr.json +++ b/locales/fr.json @@ -579,7 +579,6 @@ "invalid_password": "Mot de passe incorrect", "ldap_server_is_down_restart_it": "Le service LDAP est en panne, essayez de le redémarrer...", "ldap_server_down": "Impossible d'atteindre le serveur LDAP", - "global_settings_setting_security_experimental_enabled": "Activer les fonctionnalités de sécurité expérimentales (ne l'activez pas si vous ne savez pas ce que vous faites !)", "diagnosis_apps_deprecated_practices": "La version installée de cette application utilise encore de très anciennes pratiques de packaging obsolètes et dépassées. Vous devriez vraiment envisager de mettre à jour cette application.", "diagnosis_apps_outdated_ynh_requirement": "La version installée de cette application nécessite uniquement YunoHost >= 2.x ou 3.x, ce qui tend à indiquer qu'elle n'est pas à jour avec les pratiques recommandées de packaging et des helpers . Vous devriez vraiment envisager de la mettre à jour.", "diagnosis_apps_bad_quality": "Cette application est actuellement signalée comme cassée dans le catalogue d'applications de YunoHost. Cela peut être un problème temporaire. En attendant que les mainteneurs tentent de résoudre le problème, la mise à jour de cette application est désactivée.", @@ -674,11 +673,12 @@ "migration_0023_not_enough_space": "Prévoyez suffisamment d'espace disponible dans {path} pour exécuter la migration.", "migration_0023_postgresql_11_not_installed": "PostgreSQL n'a pas été installé sur votre système. Il n'y a rien à faire.", "global_settings_setting_backup_compress_tar_archives_help": "Lors de la création de nouvelles sauvegardes, compresser automatiquement les archives (.tar.gz) au lieu des archives non compressées (.tar). N.B. : activer cette option permet de créer des archives plus légères, mais la procédure de sauvegarde initiale sera significativement plus longues et plus gourmandes en CPU.", + "global_settings_setting_security_experimental_enabled": "Fonctionnalités de sécurité expérimentales", "global_settings_setting_security_experimental_enabled_help": "Activer les fonctionnalités de sécurité expérimentales (ne l'activez pas si vous ne savez pas ce que vous faites !)", "global_settings_setting_nginx_compatibility_help": "Compromis 'compatibilité versus sécurité' pour le serveur web Nginx. Affecte les cryptogrammes utilisés (et d'autres aspects liés à la sécurité)", "global_settings_setting_nginx_redirect_to_https_help": "Rediriger les requêtes HTTP vers HTTPS par défaut (NE PAS DÉSACTIVER à moins de savoir vraiment ce que vous faites !)", - "global_settings_setting_admin_strength": "Qualité du mot de passe administrateur", - "global_settings_setting_user_strength": "Qualité du mot de passe de l'utilisateur", + "global_settings_setting_admin_strength": "Critères pour les mots de passe administrateur", + "global_settings_setting_user_strength": "Critères pour les mots de passe utilisateurs", "global_settings_setting_postfix_compatibility_help": "Compromis 'compatibilité versus sécurité' pour le serveur Postfix. Affecte les cryptogrammes utilisés (et d'autres aspects liés à la sécurité)", "global_settings_setting_ssh_compatibility_help": "Compromis 'compatibilité versus sécurité' pour le serveur SSH. Affecte les cryptogrammes utilisés (et d'autres aspects liés à la sécurité)", "global_settings_setting_ssh_password_authentication_help": "Autoriser l'authentification par mot de passe pour SSH", From 4b9c7922a77cfa2739450e52993b02db2214baee Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 7 Oct 2022 17:59:05 +0200 Subject: [PATCH 155/174] i18n: moar wording tweaking --- locales/en.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/locales/en.json b/locales/en.json index 41a31cd52..0266f4fdb 100644 --- a/locales/en.json +++ b/locales/en.json @@ -386,7 +386,7 @@ "firewall_rules_cmd_failed": "Some firewall rule commands have failed. More info in log.", "global_settings_reset_success": "Reset global settings", "global_settings_setting_admin_strength": "Admin password strength requirements", - "global_settings_setting_admin_strength_help": "These requirements are only enforced when defining the password", + "global_settings_setting_admin_strength_help": "These requirements are only enforced when initializing or changing the password", "global_settings_setting_backup_compress_tar_archives": "Compress backups", "global_settings_setting_backup_compress_tar_archives_help": "When creating new backups, compress the archives (.tar.gz) instead of uncompressed archives (.tar). N.B. : enabling this option means create lighter backup archives, but the initial backup procedure will be significantly longer and heavy on CPU.", "global_settings_setting_nginx_compatibility": "NGINX Compatibility", @@ -414,7 +414,7 @@ "global_settings_setting_ssh_port": "SSH port", "global_settings_setting_ssowat_panel_overlay_enabled": "Enable the small 'YunoHost' portal shortcut square on apps", "global_settings_setting_user_strength": "User password strength requirements", - "global_settings_setting_user_strength_help": "These requirements are only enforced when defining the password", + "global_settings_setting_user_strength_help": "These requirements are only enforced when initializing or changing the password", "global_settings_setting_webadmin_allowlist": "Webadmin IP allowlist", "global_settings_setting_webadmin_allowlist_help": "IP adresses allowed to access the webadmin.", "global_settings_setting_webadmin_allowlist_enabled": "Enable Webadmin IP allowlist", From 403efe48731825646e52b869b7f949b47e23d336 Mon Sep 17 00:00:00 2001 From: axolotle Date: Fri, 7 Oct 2022 21:06:59 +0200 Subject: [PATCH 156/174] actionmap: add missing key in '/settings' api route --- share/actionsmap.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/share/actionsmap.yml b/share/actionsmap.yml index 6789f1dd6..2253cea54 100644 --- a/share/actionsmap.yml +++ b/share/actionsmap.yml @@ -1153,7 +1153,7 @@ settings: ### settings_set() set: action_help: set an entry value in the settings - api: PUT /settings + api: PUT /settings/ arguments: key: help: The question or form key From 5addb2f68f0948efcaaf5479fc4d781fd592a3dc Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sat, 8 Oct 2022 18:30:17 +0200 Subject: [PATCH 157/174] Implement a new 'virtual global setting' to change root password from webadmin --- locales/en.json | 5 +++++ share/config_global.toml | 22 ++++++++++++++++++++-- src/settings.py | 34 ++++++++++++++++++++++++++++++++++ src/tools.py | 2 ++ src/utils/password.py | 2 +- 5 files changed, 62 insertions(+), 3 deletions(-) diff --git a/locales/en.json b/locales/en.json index 0266f4fdb..8e85f815a 100644 --- a/locales/en.json +++ b/locales/en.json @@ -397,6 +397,9 @@ "global_settings_setting_pop3_enabled_help": "Enable the POP3 protocol for the mail server", "global_settings_setting_postfix_compatibility": "Postfix Compatibility", "global_settings_setting_postfix_compatibility_help": "Compatibility vs. security tradeoff for the Postfix server. Affects the ciphers (and other security-related aspects)", + "global_settings_setting_root_access_explain": "On Linux systems, 'root' is the absolute admin. In YunoHost context, direct 'root' SSH login is by default disable - except from the local network of the server. Members of the 'admins' group can use the sudo command to act as root from the command line. However, it can be helpful to have a (robust) root password to debug the system if for some reason regular admins can not login anymore.", + "global_settings_setting_root_password": "New root password", + "global_settings_setting_root_password_confirm": "New root password (confirm)", "global_settings_setting_security_experimental_enabled": "Experimental security features", "global_settings_setting_security_experimental_enabled_help": "Enable experimental security features (don't enable this if you don't know what you're doing!)", "global_settings_setting_smtp_allow_ipv6": "Allow IPv6", @@ -582,6 +585,7 @@ "pattern_password_app": "Sorry, passwords can not contain the following characters: {forbidden_chars}", "pattern_port_or_range": "Must be a valid port number (i.e. 0-65535) or range of ports (e.g. 100:200)", "pattern_username": "Must be lower-case alphanumeric and underscore characters only", + "password_confirmation_not_the_same": "The password and its confirmation do not match", "permission_already_allowed": "Group '{group}' already has permission '{permission}' enabled", "permission_already_disallowed": "Group '{group}' already has permission '{permission}' disabled", "permission_already_exist": "Permission '{permission}' already exists", @@ -637,6 +641,7 @@ "restore_running_hooks": "Running restoration hooks...", "restore_system_part_failed": "Could not restore the '{part}' system part", "root_password_desynchronized": "The admin password was changed, but YunoHost could not propagate this to the root password!", + "root_password_changed": "root's password was changed", "server_reboot": "The server will reboot", "server_reboot_confirm": "The server will reboot immediatly, are you sure? [{answers}]", "server_shutdown": "The server will shut down", diff --git a/share/config_global.toml b/share/config_global.toml index f64ef65a7..27f8d47dc 100644 --- a/share/config_global.toml +++ b/share/config_global.toml @@ -12,7 +12,7 @@ name = "Security" choices.2 = "ditto, but also require at least one digit, one lower and one upper char" choices.3 = "ditto, but also require at least one special char" choices.4 = "ditto, but also require at least 12 chars" - default = 1 + default = "1" [security.password.user_strength] type = "select" @@ -20,7 +20,7 @@ name = "Security" choices.2 = "ditto, but also require at least one digit, one lower and one upper char" choices.3 = "ditto, but also require at least one special char" choices.4 = "ditto, but also require at least 12 chars" - default = 1 + default = "1" [security.ssh] name = "SSH" @@ -70,6 +70,24 @@ name = "Security" optional = true default = "" + [security.root_access] + name = "Change root password" + + [security.root_access.root_access_explain] + type = "alert" + style = "info" + icon = "info" + + [security.root_access.root_password] + type = "password" + optional = true + default = "" + + [security.root_access.root_password_confirm] + type = "password" + optional = true + default = "" + [security.experimental] name = "Experimental" [security.experimental.security_experimental_enabled] diff --git a/src/settings.py b/src/settings.py index 17fe97bf5..2795d5562 100644 --- a/src/settings.py +++ b/src/settings.py @@ -108,6 +108,29 @@ class SettingsConfigPanel(ConfigPanel): super().__init__("settings") def _apply(self): + + root_password = self.new_values.pop("root_password") + root_password_confirm = self.new_values.pop("root_password_confirm") + + if "root_password" in self.values: + del self.values["root_password"] + if "root_password_confirm" in self.values: + del self.values["root_password_confirm"] + if "root_password" in self.new_values: + del self.new_values["root_password"] + if "root_password_confirm" in self.new_values: + del self.new_values["root_password_confirm"] + + assert "root_password" not in self.future_values + + if root_password and root_password.strip(): + + if root_password != root_password_confirm: + raise YunohostValidationError("password_confirmation_not_the_same") + + from yunohost.tools import tools_rootpw + tools_rootpw(root_password, check_strength=True) + super()._apply() settings = { @@ -122,7 +145,18 @@ class SettingsConfigPanel(ConfigPanel): logger.error(f"Post-change hook for setting failed : {e}") raise + def _load_current_values(self): + + super()._load_current_values() + + # Specific logic for those settings who are "virtual" settings + # and only meant to have a custom setter mapped to tools_rootpw + self.values["root_password"] = "" + self.values["root_password_confirm"] = "" + + def get(self, key="", mode="classic"): + result = super().get(key=key, mode=mode) if mode == "full": diff --git a/src/tools.py b/src/tools.py index 09574c36e..a06ce8637 100644 --- a/src/tools.py +++ b/src/tools.py @@ -94,6 +94,8 @@ def tools_rootpw(new_password, check_strength=True): except (IOError, KeyError): logger.warning(m18n.n("root_password_desynchronized")) return + else: + logger.info(m18n.n("root_password_changed")) def tools_maindomain(new_main_domain=None): diff --git a/src/utils/password.py b/src/utils/password.py index f55acf5c0..4b81f5a54 100644 --- a/src/utils/password.py +++ b/src/utils/password.py @@ -85,7 +85,7 @@ class PasswordValidator: # from settings.py because this file is also meant to be # use as a script by ssowat. # (or at least that's my understanding -- Alex) - settings = yaml.load(open("/etc/yunohost/settings.yml", "r")) + settings = yaml.safe_load(open("/etc/yunohost/settings.yml", "r")) setting_key = profile + "_strength" self.validation_strength = int(settings[setting_key]) except Exception: From a355f4858001ae44f087673c1469d1d0c545f3f6 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sat, 8 Oct 2022 19:21:36 +0200 Subject: [PATCH 158/174] domains: simplify domain config panel cert section --- share/config_domain.toml | 11 ++++------- src/domain.py | 4 ++-- 2 files changed, 6 insertions(+), 9 deletions(-) diff --git a/share/config_domain.toml b/share/config_domain.toml index 88714525d..87489999d 100644 --- a/share/config_domain.toml +++ b/share/config_domain.toml @@ -63,21 +63,18 @@ name = "DNS" [cert] name = "Certificate" - [cert.status] - name = "Status" + [cert.cert] - [cert.status.cert_summary] + [cert.cert.cert_summary] type = "alert" # Automatically filled by DomainConfigPanel - [cert.status.cert_validity] + [cert.cert.cert_validity] type = "number" readonly = true + visible = "false" # Automatically filled by DomainConfigPanel - [cert.cert] - name = "Manage" - [cert.cert.cert_issuer] type = "string" visible = false diff --git a/src/domain.py b/src/domain.py index 85720d022..e79d5acfd 100644 --- a/src/domain.py +++ b/src/domain.py @@ -573,14 +573,14 @@ class DomainConfigPanel(ConfigPanel): from yunohost.certificate import certificate_status status = certificate_status([self.entity], full=True)["certificates"][self.entity] - toml["cert"]["status"]["cert_summary"]["style"] = status["style"] + toml["cert"]["cert"]["cert_summary"]["style"] = status["style"] # i18n: domain_config_cert_summary_expired # i18n: domain_config_cert_summary_selfsigned # i18n: domain_config_cert_summary_abouttoexpire # i18n: domain_config_cert_summary_ok # i18n: domain_config_cert_summary_letsencrypt - toml["cert"]["status"]["cert_summary"]["ask"] = m18n.n(f"domain_config_cert_summary_{status['summary']}") + toml["cert"]["cert"]["cert_summary"]["ask"] = m18n.n(f"domain_config_cert_summary_{status['summary']}") # Other specific strings used in config panels # i18n: domain_config_cert_renew_help From 5347c6afebb7c2e6d6936deb1719e9c5741d7c07 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sun, 9 Oct 2022 17:01:57 +0200 Subject: [PATCH 159/174] Merge firstname and lastname info --- share/actionsmap.yml | 45 ++++++++++++++---------- src/tests/test_user-group.py | 25 ++++++++------ src/tools.py | 5 ++- src/user.py | 67 ++++++++++++++++-------------------- 4 files changed, 74 insertions(+), 68 deletions(-) diff --git a/share/actionsmap.yml b/share/actionsmap.yml index 2253cea54..98ae59a7b 100644 --- a/share/actionsmap.yml +++ b/share/actionsmap.yml @@ -73,19 +73,28 @@ user: pattern: &pattern_username - !!str ^[a-z0-9_]+$ - "pattern_username" + -F: + full: --fullname + help: The full name of the user. For example 'Camille Dupont' + extra: + ask: ask_fullname + required: False + pattern: &pattern_fullname + - !!str ^([^\W\d_]{1,30}[ ,.'-]{0,3})+$ + - "pattern_fullname" -f: full: --firstname + help: Deprecated. Use --fullname instead. extra: - ask: ask_firstname - required: True + required: False pattern: &pattern_firstname - !!str ^([^\W\d_]{1,30}[ ,.'-]{0,3})+$ - "pattern_firstname" -l: full: --lastname + help: Deprecated. Use --fullname instead. extra: - ask: ask_lastname - required: True + required: False pattern: &pattern_lastname - !!str ^([^\W\d_]{1,30}[ ,.'-]{0,3})+$ - "pattern_lastname" @@ -136,12 +145,19 @@ user: arguments: username: help: Username to update + -F: + full: --fullname + help: The full name of the user. For example 'Camille Dupont' + extra: + pattern: *pattern_fullname -f: full: --firstname + help: Deprecated. Use --fullname instead. extra: pattern: *pattern_firstname -l: full: --lastname + help: Deprecated. Use --fullname instead. extra: pattern: *pattern_lastname -m: @@ -1520,25 +1536,18 @@ tools: required: True -u: full: --username - help: Username for the first (admin) user + help: Username for the first (admin) user. For example 'camille' extra: - ask: ask_username + ask: ask_admin_username pattern: *pattern_username required: True - -f: - full: --firstname - help: Firstname for the first (admin) user + -F: + full: --fullname + help: The full name for the first (admin) user. For example 'Camille Dupont' extra: - ask: ask_firstname + ask: ask_admin_fullname required: True - pattern: *pattern_firstname - -l: - full: --lastname - help: Lastname for the first (admin) user - extra: - ask: ask_lastname - required: True - pattern: *pattern_lastname + pattern: *pattern_fullname -p: full: --password help: YunoHost admin password diff --git a/src/tests/test_user-group.py b/src/tests/test_user-group.py index 1a368ceac..dc65e8ed8 100644 --- a/src/tests/test_user-group.py +++ b/src/tests/test_user-group.py @@ -38,9 +38,9 @@ def setup_function(function): global maindomain maindomain = _get_maindomain() - user_create("alice", "Alice", "White", maindomain, "test123Ynh", admin=True) - user_create("bob", "Bob", "Snow", maindomain, "test123Ynh") - user_create("jack", "Jack", "Black", maindomain, "test123Ynh") + user_create("alice", maindomain, "test123Ynh", admin=True, fullname="Alice White") + user_create("bob", maindomain, "test123Ynh", fullname="Bob Snow") + user_create("jack", maindomain, "test123Ynh", fullname="Jack Black") user_group_create("dev") user_group_create("apps") @@ -94,7 +94,7 @@ def test_list_groups(): def test_create_user(mocker): with message(mocker, "user_created"): - user_create("albert", "Albert", "Good", maindomain, "test123Ynh") + user_create("albert", maindomain, "test123Ynh", fullname="Albert Good") group_res = user_group_list()["groups"] assert "albert" in user_list()["users"] @@ -211,17 +211,17 @@ def test_del_group(mocker): def test_create_user_with_password_too_simple(mocker): with raiseYunohostError(mocker, "password_listed"): - user_create("other", "Alice", "White", maindomain, "12") + user_create("other", maindomain, "12", fullname="Alice White") def test_create_user_already_exists(mocker): with raiseYunohostError(mocker, "user_already_exists"): - user_create("alice", "Alice", "White", maindomain, "test123Ynh") + user_create("alice", maindomain, "test123Ynh", fullname="Alice White") def test_create_user_with_domain_that_doesnt_exists(mocker): with raiseYunohostError(mocker, "domain_unknown"): - user_create("alice", "Alice", "White", "doesnt.exists", "test123Ynh") + user_create("alice", "doesnt.exists", "test123Ynh", fullname="Alice White") def test_update_user_with_mail_address_already_taken(mocker): @@ -255,7 +255,7 @@ def test_del_group_all_users(mocker): with raiseYunohostError(mocker, "group_cannot_be_deleted"): user_group_delete("all_users") - +/ def test_del_group_that_does_not_exist(mocker): with raiseYunohostError(mocker, "group_unknown"): user_group_delete("doesnt_exist") @@ -271,8 +271,13 @@ def test_update_user(mocker): user_update("alice", firstname="NewName", lastname="NewLast") info = user_info("alice") - assert info["firstname"] == "NewName" - assert info["lastname"] == "NewLast" + assert info["fullname"] == "NewName NewLast" + + with message(mocker, "user_updated"): + user_update("alice", fullname="New2Name New2Last") + + info = user_info("alice") + assert info["fullname"] == "New2Name New2Last" def test_update_group_add_user(mocker): diff --git a/src/tools.py b/src/tools.py index 09574c36e..ecf19cf25 100644 --- a/src/tools.py +++ b/src/tools.py @@ -146,8 +146,7 @@ def tools_postinstall( operation_logger, domain, username, - firstname, - lastname, + fullname, password, ignore_dyndns=False, force_diskspace=False, @@ -226,7 +225,7 @@ def tools_postinstall( domain_add(domain, dyndns) domain_main_domain(domain) - user_create(username, firstname, lastname, domain, password, admin=True) + user_create(username, domain, password, admin=True, fullname=fullname) # Update LDAP admin and create home dir tools_rootpw(password) diff --git a/src/user.py b/src/user.py index e00fa3685..13c806d1c 100644 --- a/src/user.py +++ b/src/user.py @@ -134,15 +134,29 @@ def user_list(fields=None): def user_create( operation_logger, username, - firstname, - lastname, domain, password, + fullname=None, + firstname=None, + lastname=None, mailbox_quota="0", admin=False, from_import=False, ): + if firstname or lastname: + logger.warning("Options --firstname / --lastname of 'yunohost user create' are deprecated. We recommend using --fullname instead.") + + if not fullname.strip(): + if not firstname.strip(): + raise YunohostValidationError("You should specify the fullname of the user using option -F") + lastname = lastname or " " # Stupid hack because LDAP requires the sn/lastname attr, but it accepts a single whitespace... + fullname = f"{firstname} {lastname}".strip() + else: + fullname = fullname.strip() + firstname = fullname.split()[0] + lastname = ' '.join(fullname.split()[1:]) or " " # Stupid hack because LDAP requires the sn/lastname attr, but it accepts a single whitespace... + from yunohost.domain import domain_list, _get_maindomain, _assert_domain_exists from yunohost.hook import hook_callback from yunohost.utils.password import ( @@ -219,9 +233,6 @@ def user_create( uid = str(random.randint(1001, 65000)) uid_guid_found = uid not in all_uid and uid not in all_gid - # Adapt values for LDAP - fullname = f"{firstname} {lastname}" - attr_dict = { "objectClass": [ "mailAccount", @@ -292,14 +303,7 @@ def user_create( @is_unit_operation([("username", "user")]) def user_delete(operation_logger, username, purge=False, from_import=False): - """ - Delete user - Keyword argument: - username -- Username to delete - purge - - """ from yunohost.hook import hook_callback from yunohost.utils.ldap import _get_ldap_interface @@ -357,22 +361,14 @@ def user_update( remove_mailalias=None, mailbox_quota=None, from_import=False, + fullname=None, ): - """ - Update user informations - Keyword argument: - lastname - mail - firstname - add_mailalias -- Mail aliases to add - remove_mailforward -- Mailforward addresses to remove - username -- Username of user to update - add_mailforward -- Mailforward addresses to add - change_password -- New password to set - remove_mailalias -- Mail aliases to remove + if fullname.strip(): + fullname = fullname.strip() + firstname = fullname.split()[0] + lastname = ' '.join(fullname.split()[1:]) or " " # Stupid hack because LDAP requires the sn/lastname attr, but it accepts a single whitespace... - """ from yunohost.domain import domain_list, _get_maindomain from yunohost.app import app_ssowatconf from yunohost.utils.password import ( @@ -402,20 +398,20 @@ def user_update( if firstname: new_attr_dict["givenName"] = [firstname] # TODO: Validate new_attr_dict["cn"] = new_attr_dict["displayName"] = [ - firstname + " " + user["sn"][0] + (firstname + " " + user["sn"][0]).strip() ] env_dict["YNH_USER_FIRSTNAME"] = firstname if lastname: new_attr_dict["sn"] = [lastname] # TODO: Validate new_attr_dict["cn"] = new_attr_dict["displayName"] = [ - user["givenName"][0] + " " + lastname + (user["givenName"][0] + " " + lastname).strip() ] env_dict["YNH_USER_LASTNAME"] = lastname if lastname and firstname: new_attr_dict["cn"] = new_attr_dict["displayName"] = [ - firstname + " " + lastname + (firstname + " " + lastname).strip() ] # change_password is None if user_update is not called to change the password @@ -547,7 +543,7 @@ def user_info(username): ldap = _get_ldap_interface() - user_attrs = ["cn", "mail", "uid", "maildrop", "givenName", "sn", "mailuserquota"] + user_attrs = ["cn", "mail", "uid", "maildrop", "mailuserquota"] if len(username.split("@")) == 2: filter = "mail=" + username @@ -564,8 +560,6 @@ def user_info(username): result_dict = { "username": user["uid"][0], "fullname": user["cn"][0], - "firstname": user["givenName"][0], - "lastname": user["sn"][0], "mail": user["mail"][0], "mail-aliases": [], "mail-forward": [], @@ -859,10 +853,9 @@ def user_import(operation_logger, csvfile, update=False, delete=False): user_update( new_infos["username"], - new_infos["firstname"], - new_infos["lastname"], - new_infos["mail"], - new_infos["password"], + firstname=new_infos["firstname"], + lastname=new_infos["lastname"], + password=new_infos["password"], mailbox_quota=new_infos["mailbox-quota"], mail=new_infos["mail"], add_mailalias=new_infos["mail-alias"], @@ -902,12 +895,12 @@ def user_import(operation_logger, csvfile, update=False, delete=False): try: user_create( user["username"], - user["firstname"], - user["lastname"], user["domain"], user["password"], user["mailbox-quota"], from_import=True, + firstname=user["firstname"], + lastname=user["lastname"], ) update(user) result["created"] += 1 From 2b3ec3ace89c7234bdecf5f51b4f1a58e7600ae0 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sun, 9 Oct 2022 17:02:41 +0200 Subject: [PATCH 160/174] helpers: fix issue parsing yunohost requirement from manifest --- helpers/utils | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/helpers/utils b/helpers/utils index 1751a3b1d..e2b5a8494 100644 --- a/helpers/utils +++ b/helpers/utils @@ -932,7 +932,7 @@ ynh_compare_current_package_version() { _ynh_apply_default_permissions() { local target=$1 - local ynh_requirement=$(ynh_read_manifest --manifest_key="requirements.yunohost") + local ynh_requirement=$(ynh_read_manifest --manifest_key="requirements.yunohost" | tr -d '<>= ') if dpkg --compare-versions ${YNH_APP_PACKAGING_FORMAT:-0} ge 2 || [ -z "$ynh_requirement" ] || [ "$ynh_requirement" == "null" ] || dpkg --compare-versions $ynh_requirement ge 4.2; then chmod o-rwx $target From e64e5b9c1411440a9b4752949014cb24b12be8d3 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sun, 9 Oct 2022 18:02:45 +0200 Subject: [PATCH 161/174] Big oopsie --- src/tests/test_user-group.py | 1 - 1 file changed, 1 deletion(-) diff --git a/src/tests/test_user-group.py b/src/tests/test_user-group.py index dc65e8ed8..095558d7a 100644 --- a/src/tests/test_user-group.py +++ b/src/tests/test_user-group.py @@ -255,7 +255,6 @@ def test_del_group_all_users(mocker): with raiseYunohostError(mocker, "group_cannot_be_deleted"): user_group_delete("all_users") -/ def test_del_group_that_does_not_exist(mocker): with raiseYunohostError(mocker, "group_unknown"): user_group_delete("doesnt_exist") From f03b992c6af61735b08135092d0cd6a6760be785 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sun, 9 Oct 2022 18:03:18 +0200 Subject: [PATCH 162/174] Friskies --- src/dns.py | 1 - src/domain.py | 4 ++-- src/tests/test_ldapauth.py | 6 +++--- 3 files changed, 5 insertions(+), 6 deletions(-) diff --git a/src/dns.py b/src/dns.py index 318a5fcde..0b002d912 100644 --- a/src/dns.py +++ b/src/dns.py @@ -35,7 +35,6 @@ from moulinette.utils.log import getActionLogger from moulinette.utils.filesystem import read_file, write_to_file, read_toml, mkdir from yunohost.domain import ( - domain_list, _assert_domain_exists, domain_config_get, _get_domain_settings, diff --git a/src/domain.py b/src/domain.py index e79d5acfd..5e338f4d4 100644 --- a/src/domain.py +++ b/src/domain.py @@ -25,7 +25,7 @@ """ import os import time -from typing import List +from typing import List, Optional from collections import OrderedDict from moulinette import m18n, Moulinette @@ -53,7 +53,7 @@ DOMAIN_SETTINGS_DIR = "/etc/yunohost/domains" # yunohost CLI and API which run in different processes domain_list_cache: List[str] = [] domain_list_cache_timestamp = 0 -main_domain_cache: str = None +main_domain_cache: Optional[str] = None main_domain_cache_timestamp = 0 DOMAIN_CACHE_DURATION = 15 diff --git a/src/tests/test_ldapauth.py b/src/tests/test_ldapauth.py index db5229342..25184ceac 100644 --- a/src/tests/test_ldapauth.py +++ b/src/tests/test_ldapauth.py @@ -49,7 +49,7 @@ def test_authenticate_with_user_who_is_not_admin(): with pytest.raises(MoulinetteError) as exception: LDAPAuth().authenticate_credentials(credentials="bob:test123Ynh") - translation = m18n.n("invalid_password") + translation = m18n.n("invalid_credentials") expected_msg = translation.format() assert expected_msg in str(exception) @@ -58,7 +58,7 @@ def test_authenticate_with_wrong_password(): with pytest.raises(MoulinetteError) as exception: LDAPAuth().authenticate_credentials(credentials="alice:bad_password_lul") - translation = m18n.n("invalid_password") + translation = m18n.n("invalid_credentials") expected_msg = translation.format() assert expected_msg in str(exception) @@ -78,7 +78,7 @@ def test_authenticate_change_password(): with pytest.raises(MoulinetteError) as exception: LDAPAuth().authenticate_credentials(credentials="alice:Yunohost") - translation = m18n.n("invalid_password") + translation = m18n.n("invalid_credentials") expected_msg = translation.format() assert expected_msg in str(exception) From bd7081baf276e5307f0a26d504b2402c2fb83454 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sun, 9 Oct 2022 18:38:34 +0200 Subject: [PATCH 163/174] maintenance: cleanup .py file headers + automate boring copyright headers... --- bin/yunohost | 1 - bin/yunohost-api | 1 - maintenance/agplv3.tpl | 16 +++++++++ maintenance/update_copyright_headers.sh | 12 +++++++ src/__init__.py | 19 ++++++++++- src/app.py | 42 ++++++++++------------- src/app_catalog.py | 18 ++++++++++ src/authenticators/ldap_admin.py | 20 +++++++++-- src/backup.py | 43 ++++++++++-------------- src/certificate.py | 42 ++++++++++------------- src/diagnosers/00-basesystem.py | 20 +++++++++-- src/diagnosers/10-ip.py | 20 +++++++++-- src/diagnosers/12-dnsrecords.py | 20 +++++++++-- src/diagnosers/14-ports.py | 20 +++++++++-- src/diagnosers/21-web.py | 20 +++++++++-- src/diagnosers/24-mail.py | 20 +++++++++-- src/diagnosers/30-services.py | 20 +++++++++-- src/diagnosers/50-systemresources.py | 19 ++++++++++- src/diagnosers/70-regenconf.py | 20 +++++++++-- src/diagnosers/80-apps.py | 20 +++++++++-- src/diagnosers/__init__.py | 18 ++++++++++ src/diagnosis.py | 44 ++++++++++--------------- src/dns.py | 43 ++++++++++-------------- src/domain.py | 43 ++++++++++-------------- src/dyndns.py | 43 ++++++++++-------------- src/firewall.py | 43 ++++++++++-------------- src/hook.py | 43 ++++++++++-------------- src/log.py | 44 ++++++++++--------------- src/permission.py | 44 ++++++++++--------------- src/regenconf.py | 39 ++++++++++------------ src/service.py | 44 ++++++++++--------------- src/settings.py | 18 ++++++++++ src/ssh.py | 19 ++++++++++- src/tools.py | 39 ++++++++++------------ src/user.py | 43 ++++++++++-------------- src/utils/__init__.py | 18 ++++++++++ src/utils/config.py | 39 ++++++++++------------ src/utils/dns.py | 38 ++++++++++----------- src/utils/error.py | 39 ++++++++++------------ src/utils/i18n.py | 38 ++++++++++----------- src/utils/ldap.py | 38 ++++++++++----------- src/utils/legacy.py | 18 ++++++++++ src/utils/network.py | 38 ++++++++++----------- src/utils/password.py | 39 ++++++++++------------ src/utils/resources.py | 38 ++++++++++----------- src/utils/system.py | 38 ++++++++++----------- src/utils/yunopaste.py | 20 +++++++++-- 47 files changed, 802 insertions(+), 579 deletions(-) create mode 100644 maintenance/agplv3.tpl create mode 100644 maintenance/update_copyright_headers.sh diff --git a/bin/yunohost b/bin/yunohost index 8cebdee8e..afa3df7ec 100755 --- a/bin/yunohost +++ b/bin/yunohost @@ -1,5 +1,4 @@ #! /usr/bin/python3 -# -*- coding: utf-8 -*- import os import sys diff --git a/bin/yunohost-api b/bin/yunohost-api index 8cf9d4f26..9f4d5eb26 100755 --- a/bin/yunohost-api +++ b/bin/yunohost-api @@ -1,5 +1,4 @@ #! /usr/bin/python3 -# -*- coding: utf-8 -*- import argparse import yunohost diff --git a/maintenance/agplv3.tpl b/maintenance/agplv3.tpl new file mode 100644 index 000000000..82f3b4cc6 --- /dev/null +++ b/maintenance/agplv3.tpl @@ -0,0 +1,16 @@ +Copyright (c) ${years} ${owner} + +This file is part of ${projectname} (see ${projecturl}) + +This program is free software: you can redistribute it and/or modify +it under the terms of the GNU Affero General Public License as +published by the Free Software Foundation, either version 3 of the +License, or (at your option) any later version. + +This program is distributed in the hope that it will be useful, +but WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +GNU Affero General Public License for more details. + +You should have received a copy of the GNU Affero General Public License +along with this program. If not, see . diff --git a/maintenance/update_copyright_headers.sh b/maintenance/update_copyright_headers.sh new file mode 100644 index 000000000..bc4fe24db --- /dev/null +++ b/maintenance/update_copyright_headers.sh @@ -0,0 +1,12 @@ +# To run this you'll need to: +# +# pip3 install licenseheaders + +licenseheaders \ + -o "YunoHost Contributors" \ + -n "YunoHost" \ + -u "https://yunohost.org" \ + -t ./agplv3.tpl \ + --current-year \ + -f ../src/*.py ../src/{utils,diagnosers,authenticators}/*.py + diff --git a/src/__init__.py b/src/__init__.py index 608917185..af18e1fe4 100644 --- a/src/__init__.py +++ b/src/__init__.py @@ -1,5 +1,22 @@ #! /usr/bin/python -# -*- coding: utf-8 -*- +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import os import sys diff --git a/src/app.py b/src/app.py index a90584157..c9ca1fa95 100644 --- a/src/app.py +++ b/src/app.py @@ -1,28 +1,22 @@ -# -*- coding: utf-8 -*- +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# -""" License - - Copyright (C) 2013 YunoHost - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU Affero General Public License as published - by the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU Affero General Public License for more details. - - You should have received a copy of the GNU Affero General Public License - along with this program; if not, see http://www.gnu.org/licenses - -""" - -""" yunohost_app.py - - Manage apps -""" import glob import os import toml diff --git a/src/app_catalog.py b/src/app_catalog.py index 12bb4e6d7..847ff73ac 100644 --- a/src/app_catalog.py +++ b/src/app_catalog.py @@ -1,3 +1,21 @@ +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import os import re diff --git a/src/authenticators/ldap_admin.py b/src/authenticators/ldap_admin.py index a7fc18da6..151fff3b4 100644 --- a/src/authenticators/ldap_admin.py +++ b/src/authenticators/ldap_admin.py @@ -1,5 +1,21 @@ -# -*- coding: utf-8 -*- - +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import os import logging import ldap diff --git a/src/backup.py b/src/backup.py index a3b5ec3a0..69d7f40cf 100644 --- a/src/backup.py +++ b/src/backup.py @@ -1,28 +1,21 @@ -# -*- coding: utf-8 -*- - -""" License - - Copyright (C) 2013 YunoHost - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU Affero General Public License as published - by the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU Affero General Public License for more details. - - You should have received a copy of the GNU Affero General Public License - along with this program; if not, see http://www.gnu.org/licenses - -""" - -""" yunohost_backup.py - - Manage backups -""" +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import os import re import json diff --git a/src/certificate.py b/src/certificate.py index 299095af0..ff4e2cd65 100644 --- a/src/certificate.py +++ b/src/certificate.py @@ -1,27 +1,21 @@ -# -*- coding: utf-8 -*- - -""" License - - Copyright (C) 2016 YUNOHOST.ORG - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU Affero General Public License as published - by the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU Affero General Public License for more details. - - You should have received a copy of the GNU Affero General Public License - along with this program; if not, see http://www.gnu.org/licenses - - yunohost_certificate.py - - Manage certificates, in particular Let's encrypt -""" - +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import os import sys import shutil diff --git a/src/diagnosers/00-basesystem.py b/src/diagnosers/00-basesystem.py index 73bf9d740..453cc17e2 100644 --- a/src/diagnosers/00-basesystem.py +++ b/src/diagnosers/00-basesystem.py @@ -1,5 +1,21 @@ -#!/usr/bin/env python - +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import os import json import subprocess diff --git a/src/diagnosers/10-ip.py b/src/diagnosers/10-ip.py index 247c486fc..d440f76dd 100644 --- a/src/diagnosers/10-ip.py +++ b/src/diagnosers/10-ip.py @@ -1,5 +1,21 @@ -#!/usr/bin/env python - +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import re import os import random diff --git a/src/diagnosers/12-dnsrecords.py b/src/diagnosers/12-dnsrecords.py index 9876da791..ad09752b2 100644 --- a/src/diagnosers/12-dnsrecords.py +++ b/src/diagnosers/12-dnsrecords.py @@ -1,5 +1,21 @@ -#!/usr/bin/env python - +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import os import re from typing import List diff --git a/src/diagnosers/14-ports.py b/src/diagnosers/14-ports.py index be172e524..5671211b5 100644 --- a/src/diagnosers/14-ports.py +++ b/src/diagnosers/14-ports.py @@ -1,5 +1,21 @@ -#!/usr/bin/env python - +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import os from typing import List diff --git a/src/diagnosers/21-web.py b/src/diagnosers/21-web.py index 5106e26cc..4a69895b2 100644 --- a/src/diagnosers/21-web.py +++ b/src/diagnosers/21-web.py @@ -1,5 +1,21 @@ -#!/usr/bin/env python - +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import os import random import requests diff --git a/src/diagnosers/24-mail.py b/src/diagnosers/24-mail.py index 4b370a2b4..88d6a8259 100644 --- a/src/diagnosers/24-mail.py +++ b/src/diagnosers/24-mail.py @@ -1,5 +1,21 @@ -#!/usr/bin/env python - +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import os import dns.resolver import re diff --git a/src/diagnosers/30-services.py b/src/diagnosers/30-services.py index f09688911..7adfd7c01 100644 --- a/src/diagnosers/30-services.py +++ b/src/diagnosers/30-services.py @@ -1,5 +1,21 @@ -#!/usr/bin/env python - +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import os from typing import List diff --git a/src/diagnosers/50-systemresources.py b/src/diagnosers/50-systemresources.py index 6ac7f0ec4..50933b9f9 100644 --- a/src/diagnosers/50-systemresources.py +++ b/src/diagnosers/50-systemresources.py @@ -1,4 +1,21 @@ -#!/usr/bin/env python +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import os import psutil import datetime diff --git a/src/diagnosers/70-regenconf.py b/src/diagnosers/70-regenconf.py index 787fb257d..8c0bf74cc 100644 --- a/src/diagnosers/70-regenconf.py +++ b/src/diagnosers/70-regenconf.py @@ -1,5 +1,21 @@ -#!/usr/bin/env python - +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import os import re from typing import List diff --git a/src/diagnosers/80-apps.py b/src/diagnosers/80-apps.py index c4c7f48eb..faff925e6 100644 --- a/src/diagnosers/80-apps.py +++ b/src/diagnosers/80-apps.py @@ -1,5 +1,21 @@ -#!/usr/bin/env python - +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import os from typing import List diff --git a/src/diagnosers/__init__.py b/src/diagnosers/__init__.py index e69de29bb..5cad500fa 100644 --- a/src/diagnosers/__init__.py +++ b/src/diagnosers/__init__.py @@ -0,0 +1,18 @@ +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# diff --git a/src/diagnosis.py b/src/diagnosis.py index 007719dfc..2dff6a40d 100644 --- a/src/diagnosis.py +++ b/src/diagnosis.py @@ -1,29 +1,21 @@ -# -*- coding: utf-8 -*- - -""" License - - Copyright (C) 2018 YunoHost - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU Affero General Public License as published - by the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU Affero General Public License for more details. - - You should have received a copy of the GNU Affero General Public License - along with this program; if not, see http://www.gnu.org/licenses - -""" - -""" diagnosis.py - - Look for possible issues on the server -""" - +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import re import os import time diff --git a/src/dns.py b/src/dns.py index 0b002d912..a67c1e4f0 100644 --- a/src/dns.py +++ b/src/dns.py @@ -1,28 +1,21 @@ -# -*- coding: utf-8 -*- - -""" License - - Copyright (C) 2013 YunoHost - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU Affero General Public License as published - by the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU Affero General Public License for more details. - - You should have received a copy of the GNU Affero General Public License - along with this program; if not, see http://www.gnu.org/licenses - -""" - -""" yunohost_domain.py - - Manage domains -""" +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import os import re import time diff --git a/src/domain.py b/src/domain.py index 5e338f4d4..5789aa20b 100644 --- a/src/domain.py +++ b/src/domain.py @@ -1,28 +1,21 @@ -# -*- coding: utf-8 -*- - -""" License - - Copyright (C) 2013 YunoHost - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU Affero General Public License as published - by the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU Affero General Public License for more details. - - You should have received a copy of the GNU Affero General Public License - along with this program; if not, see http://www.gnu.org/licenses - -""" - -""" yunohost_domain.py - - Manage domains -""" +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import os import time from typing import List, Optional diff --git a/src/dyndns.py b/src/dyndns.py index 34f3dd5dc..217cf2e15 100644 --- a/src/dyndns.py +++ b/src/dyndns.py @@ -1,28 +1,21 @@ -# -*- coding: utf-8 -*- - -""" License - - Copyright (C) 2013 YunoHost - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU Affero General Public License as published - by the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU Affero General Public License for more details. - - You should have received a copy of the GNU Affero General Public License - along with this program; if not, see http://www.gnu.org/licenses - -""" - -""" yunohost_dyndns.py - - Subscribe and Update DynDNS Hosts -""" +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import os import re import json diff --git a/src/firewall.py b/src/firewall.py index a1c0b187f..8e0e70e99 100644 --- a/src/firewall.py +++ b/src/firewall.py @@ -1,28 +1,21 @@ -# -*- coding: utf-8 -*- - -""" License - - Copyright (C) 2013 YunoHost - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU Affero General Public License as published - by the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU Affero General Public License for more details. - - You should have received a copy of the GNU Affero General Public License - along with this program; if not, see http://www.gnu.org/licenses - -""" - -""" yunohost_firewall.py - - Manage firewall rules -""" +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import os import yaml import miniupnpc diff --git a/src/hook.py b/src/hook.py index 70d3b281b..d985f5184 100644 --- a/src/hook.py +++ b/src/hook.py @@ -1,28 +1,21 @@ -# -*- coding: utf-8 -*- - -""" License - - Copyright (C) 2013 YunoHost - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU Affero General Public License as published - by the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU Affero General Public License for more details. - - You should have received a copy of the GNU Affero General Public License - along with this program; if not, see http://www.gnu.org/licenses - -""" - -""" yunohost_hook.py - - Manage hooks -""" +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import os import re import sys diff --git a/src/log.py b/src/log.py index d5e8627d5..6525b904d 100644 --- a/src/log.py +++ b/src/log.py @@ -1,29 +1,21 @@ -# -*- coding: utf-8 -*- - -""" License - - Copyright (C) 2018 YunoHost - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU Affero General Public License as published - by the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU Affero General Public License for more details. - - You should have received a copy of the GNU Affero General Public License - along with this program; if not, see http://www.gnu.org/licenses - -""" - -""" yunohost_log.py - - Manage debug logs -""" - +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import os import re import yaml diff --git a/src/permission.py b/src/permission.py index 2a6f6d954..801576afd 100644 --- a/src/permission.py +++ b/src/permission.py @@ -1,29 +1,21 @@ -# -*- coding: utf-8 -*- - -""" License - - Copyright (C) 2014 YUNOHOST.ORG - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU Affero General Public License as published - by the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU Affero General Public License for more details. - - You should have received a copy of the GNU Affero General Public License - along with this program; if not, see http://www.gnu.org/licenses - -""" - -""" yunohost_permission.py - - Manage permissions -""" - +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import re import copy import grp diff --git a/src/regenconf.py b/src/regenconf.py index e513a1506..f1163e66a 100644 --- a/src/regenconf.py +++ b/src/regenconf.py @@ -1,24 +1,21 @@ -# -*- coding: utf-8 -*- - -""" License - - Copyright (C) 2019 YunoHost - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU Affero General Public License as published - by the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU Affero General Public License for more details. - - You should have received a copy of the GNU Affero General Public License - along with this program; if not, see http://www.gnu.org/licenses - -""" - +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import os import yaml import shutil diff --git a/src/service.py b/src/service.py index 5800f6e4d..1f1c35c44 100644 --- a/src/service.py +++ b/src/service.py @@ -1,29 +1,21 @@ -# -*- coding: utf-8 -*- - -""" License - - Copyright (C) 2013 YunoHost - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU Affero General Public License as published - by the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU Affero General Public License for more details. - - You should have received a copy of the GNU Affero General Public License - along with this program; if not, see http://www.gnu.org/licenses - -""" - -""" yunohost_service.py - - Manage services -""" - +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import re import os import time diff --git a/src/settings.py b/src/settings.py index 17fe97bf5..fb05992b9 100644 --- a/src/settings.py +++ b/src/settings.py @@ -1,3 +1,21 @@ +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import os import subprocess diff --git a/src/ssh.py b/src/ssh.py index 63b122e76..d5951cba5 100644 --- a/src/ssh.py +++ b/src/ssh.py @@ -1,4 +1,21 @@ -# encoding: utf-8 +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import re import os diff --git a/src/tools.py b/src/tools.py index 09574c36e..63b798ba8 100644 --- a/src/tools.py +++ b/src/tools.py @@ -1,24 +1,21 @@ -# -*- coding: utf-8 -*- - -""" License - - Copyright (C) 2013 YunoHost - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU Affero General Public License as published - by the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU Affero General Public License for more details. - - You should have received a copy of the GNU Affero General Public License - along with this program; if not, see http://www.gnu.org/licenses - -""" - +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import re import os import subprocess diff --git a/src/user.py b/src/user.py index e00fa3685..32fcfe97f 100644 --- a/src/user.py +++ b/src/user.py @@ -1,28 +1,21 @@ -# -*- coding: utf-8 -*- - -""" License - - Copyright (C) 2014 YUNOHOST.ORG - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU Affero General Public License as published - by the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU Affero General Public License for more details. - - You should have received a copy of the GNU Affero General Public License - along with this program; if not, see http://www.gnu.org/licenses - -""" - -""" yunohost_user.py - - Manage users -""" +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import os import re import pwd diff --git a/src/utils/__init__.py b/src/utils/__init__.py index e69de29bb..5cad500fa 100644 --- a/src/utils/__init__.py +++ b/src/utils/__init__.py @@ -0,0 +1,18 @@ +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# diff --git a/src/utils/config.py b/src/utils/config.py index a13f37f1b..c61b92a40 100644 --- a/src/utils/config.py +++ b/src/utils/config.py @@ -1,24 +1,21 @@ -# -*- coding: utf-8 -*- - -""" License - - Copyright (C) 2018 YUNOHOST.ORG - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU Affero General Public License as published - by the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU Affero General Public License for more details. - - You should have received a copy of the GNU Affero General Public License - along with this program; if not, see http://www.gnu.org/licenses - -""" - +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import glob import os import re diff --git a/src/utils/dns.py b/src/utils/dns.py index ccb6c5406..091168615 100644 --- a/src/utils/dns.py +++ b/src/utils/dns.py @@ -1,23 +1,21 @@ -# -*- coding: utf-8 -*- - -""" License - - Copyright (C) 2018 YUNOHOST.ORG - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU Affero General Public License as published - by the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU Affero General Public License for more details. - - You should have received a copy of the GNU Affero General Public License - along with this program; if not, see http://www.gnu.org/licenses - -""" +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import dns.resolver from typing import List diff --git a/src/utils/error.py b/src/utils/error.py index a92f3bd5a..e7046540d 100644 --- a/src/utils/error.py +++ b/src/utils/error.py @@ -1,24 +1,21 @@ -# -*- coding: utf-8 -*- - -""" License - - Copyright (C) 2018 YUNOHOST.ORG - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU Affero General Public License as published - by the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU Affero General Public License for more details. - - You should have received a copy of the GNU Affero General Public License - along with this program; if not, see http://www.gnu.org/licenses - -""" - +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# from moulinette.core import MoulinetteError, MoulinetteAuthenticationError from moulinette import m18n diff --git a/src/utils/i18n.py b/src/utils/i18n.py index a0daf8181..ecbfe36e8 100644 --- a/src/utils/i18n.py +++ b/src/utils/i18n.py @@ -1,23 +1,21 @@ -# -*- coding: utf-8 -*- - -""" License - - Copyright (C) 2018 YUNOHOST.ORG - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU Affero General Public License as published - by the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU Affero General Public License for more details. - - You should have received a copy of the GNU Affero General Public License - along with this program; if not, see http://www.gnu.org/licenses - -""" +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# from moulinette import m18n diff --git a/src/utils/ldap.py b/src/utils/ldap.py index 627ab4e7a..ee50d0b98 100644 --- a/src/utils/ldap.py +++ b/src/utils/ldap.py @@ -1,23 +1,21 @@ -# -*- coding: utf-8 -*- -""" License - - Copyright (C) 2019 YunoHost - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU Affero General Public License as published - by the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU Affero General Public License for more details. - - You should have received a copy of the GNU Affero General Public License - along with this program; if not, see http://www.gnu.org/licenses - -""" - +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import os import atexit import logging diff --git a/src/utils/legacy.py b/src/utils/legacy.py index df6c10025..1ae8f6557 100644 --- a/src/utils/legacy.py +++ b/src/utils/legacy.py @@ -1,3 +1,21 @@ +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import os import re import glob diff --git a/src/utils/network.py b/src/utils/network.py index 28dcb204c..06dd3493d 100644 --- a/src/utils/network.py +++ b/src/utils/network.py @@ -1,23 +1,21 @@ -# -*- coding: utf-8 -*- - -""" License - - Copyright (C) 2017 YUNOHOST.ORG - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU Affero General Public License as published - by the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU Affero General Public License for more details. - - You should have received a copy of the GNU Affero General Public License - along with this program; if not, see http://www.gnu.org/licenses - -""" +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import os import re import logging diff --git a/src/utils/password.py b/src/utils/password.py index f55acf5c0..02e2efc0a 100644 --- a/src/utils/password.py +++ b/src/utils/password.py @@ -1,24 +1,21 @@ -# -*- coding: utf-8 -*- - -""" License - - Copyright (C) 2018 YunoHost - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU Affero General Public License as published - by the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU Affero General Public License for more details. - - You should have received a copy of the GNU Affero General Public License - along with this program; if not, see http://www.gnu.org/licenses - -""" - +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import sys import os import string diff --git a/src/utils/resources.py b/src/utils/resources.py index 9da0cedb7..9fa38d169 100644 --- a/src/utils/resources.py +++ b/src/utils/resources.py @@ -1,23 +1,21 @@ -# -*- coding: utf-8 -*- - -""" License - - Copyright (C) 2021 YUNOHOST.ORG - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU Affero General Public License as published - by the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU Affero General Public License for more details. - - You should have received a copy of the GNU Affero General Public License - along with this program; if not, see http://www.gnu.org/licenses - -""" +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import os import copy import shutil diff --git a/src/utils/system.py b/src/utils/system.py index c3e41f604..63f7190f8 100644 --- a/src/utils/system.py +++ b/src/utils/system.py @@ -1,23 +1,21 @@ -# -*- coding: utf-8 -*- - -""" License - - Copyright (C) 2015 YUNOHOST.ORG - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU Affero General Public License as published - by the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU Affero General Public License for more details. - - You should have received a copy of the GNU Affero General Public License - along with this program; if not, see http://www.gnu.org/licenses - -""" +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import re import os import logging diff --git a/src/utils/yunopaste.py b/src/utils/yunopaste.py index 35e829991..0edcc721b 100644 --- a/src/utils/yunopaste.py +++ b/src/utils/yunopaste.py @@ -1,5 +1,21 @@ -# -*- coding: utf-8 -*- - +# +# Copyright (c) 2022 YunoHost Contributors +# +# This file is part of YunoHost (see https://yunohost.org) +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +# import requests import json import logging From 3e8b05b9715e7ef6be7c3badc7635e7908681272 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sun, 9 Oct 2022 18:41:04 +0200 Subject: [PATCH 164/174] Drop CONTRIBUTORS.md, unmaintained for 6 years... --- CONTRIBUTORS.md | 101 ------------------------------------------------ 1 file changed, 101 deletions(-) delete mode 100644 CONTRIBUTORS.md diff --git a/CONTRIBUTORS.md b/CONTRIBUTORS.md deleted file mode 100644 index 0a9ac7527..000000000 --- a/CONTRIBUTORS.md +++ /dev/null @@ -1,101 +0,0 @@ -YunoHost core contributors -========================== - -YunoHost is built and maintained by the YunoHost project community. -Everyone is encouraged to submit issues and changes, and to contribute in other ways -- see https://yunohost.org/contribute to find out how. - --- - -Initial YunoHost core was built by Kload & beudbeud, for YunoHost v2. - -Most of code was written by Kload and jerome, with help of numerous contributors. - -Translation is made by a bunch of lovely people all over the world. - -We would like to thank anyone who ever helped the YunoHost project <3 - - -YunoHost core Contributors --------------------------- - -- Jérôme Lebleu -- Kload -- Laurent 'Bram' Peuch -- Julien 'ju' Malik -- opi -- Aleks -- Adrien 'beudbeud' Beudin -- M5oul -- Valentin 'zamentur' / 'ljf' Grimaud -- Jocelyn Delalande -- infertux -- Taziden -- ZeHiro -- Josue-T -- nahoj -- a1ex -- JimboJoe -- vetetix -- jellium -- Sebastien 'sebian' Badia -- lmangani -- Julien Vaubourg -- thardev -- zimo2001 - - -YunoHost core Translators -------------------------- - -If you want to help translation, please visit https://translate.yunohost.org/projects/yunohost/yunohost/ - - -### Dutch - -- DUBWiSE -- Jeroen Keerl -- marut - -### English - -- Bugsbane -- rokaz - -### French - -- aoz roon -- Genma -- Jean-Baptiste Holcroft -- Jean P. -- Jérôme Lebleu -- Lapineige -- paddy - - -### German - -- david.bartke -- Fabian Gruber -- Felix Bartels -- Jeroen Keerl -- martin kistner -- Philip Gatzka - -### Hindi - -- Anmol - -### Italian - -- bricabrac -- Thomas Bille - -### Portuguese - -- Deleted User -- Trollken - -### Spanish - -- Juanu - From b9036abcbcec03850ccb5b6adda64840d7bc22a1 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sun, 9 Oct 2022 19:04:58 +0200 Subject: [PATCH 165/174] Improve most used password check list --- ...0000-most-used-passwords-length8plus.txt.gz | Bin 0 -> 430350 bytes share/100000-most-used-passwords.txt.gz | Bin 375311 -> 0 bytes src/utils/password.py | 9 ++++++++- 3 files changed, 8 insertions(+), 1 deletion(-) create mode 100644 share/100000-most-used-passwords-length8plus.txt.gz delete mode 100644 share/100000-most-used-passwords.txt.gz diff --git a/share/100000-most-used-passwords-length8plus.txt.gz b/share/100000-most-used-passwords-length8plus.txt.gz new file mode 100644 index 0000000000000000000000000000000000000000..6059a5af8ace23e96f1462d955944bd53e470580 GIT binary patch literal 430350 zcmV(>K-j+@iwFP!0000016=)Elj}-yEDXNmUz~@}#_X6K8IZW!_b}6!EphCEaXL5)lD3< z$)VeZLpM#yX<2q1{P-N!{q-1^`}^0@WP99)_14Wv_M`g_pW9cmua9k?mn``h=6O5~ ztNhNqUB-Dx#%XyDujP?!d$)de>y{js+x@Z2@7%`YWtgTR$^0w1uj70iwk>I!x+;r2 zWb)hVbJ+Jm4*pFe!& zL$S(19=qc*b@FEGbXe9U>9+oaM-o2>US0Y2hhwh?w#iZ5$7N3BoXaU6`eSnUzt56w8t>P6+5Ljy6XA64>u}Zg)mK=De!GtI zmK+}Yei^!65AuBZxV|rRJc23dm+5}Nug`Ls?Sr+0EBt?^zStW-V>|>>JS`LqC!i(rU z``SK3a_-iXoR>aHvos5-%$TaR@1!4&!|fo~TV6Kga;lT_(tnSWT$FBH<(kM`oMdWV zI++TGby=>{YfkQy9MJr@$q8StGiKgl8s}@)ghZygOn98iEd2QFw(qZGo0m_$FYeuS zloLGToPLh;c}qU!oyP8lvn5k;?w92J7-xOOS#AJ5GC2jqaqUjKer&xaa$29mS0DyLnhs-Cqh*msf@bts!$KI8CppJZ;z-6hxLYE#)xwtUEG`0D06KjVi7rXsx1LOc%VFr&utIc-cau^HDy^E_bfnXq|s0_=M|*7Z{F@b=+S%&(CtJC);?t%TG4B zQ)HHO$KkzXbvE<`MezalhdRdwh!R@?H$( zg76F_+j81{K5W~4kt05>-F%hP5iiG@l>U``cRw;+EywvZ&N%jKC-X|CQd0X@@|@(_ z-Nsd3Xc!)w{JBi5{@CrfYx~L8A^F@g_g+crUwWhTi_Ah@4o>5i{N*=)``dr~^Iv~& zr*M%!zsrT36CTOwy06F6Yr5!Da*w}o zai6+w${grrI!}5RbiaEr#n^%9{8*)gU--6oqp)@ zleJB%mkAd?Y5glXy-vsZbUb`x*^%W%rho9SBuhh^H$`1mIMA2um4oam)ATwl2e~;v z*Fko_bTwmL`e&C?&rc7}Ap4U$9h(TTl)9Wk; zH}@URid_3~$P(O^hY?GwT%d0`MM;+(!ZGg)?2hs~^ZC82$TgOWd3;Q=Q_4+tk==8X z1@C5ynSh1sV6*>wxZej%`t5VP-Rw1<HyMuu zHinx{EnPVDF!9PORvr9KKb!`=n>fQSIK8JuHgeq}2iZlEO(yF2#9}%<>|@Ft+d7&5 z$*0_xXW9Jm%yC>~X3Hs&B~K3VyiE3je_J+8>~8uvC;efaKQ3|+Wm_I~8JL#&e34z` zea5j2;%M~x=UI`JZK&czXp?E!Z?Ya{vf6L*PtMOSiya=Al(G=Z>LDLY&XnA{@xJJE zdzK|g7G-(Q0W(r}2icFOq{EuD%ME^8X4&0ke&eRl#a$Mu8_rj9k=uQLoKEsCoBWO( zoSdFrUP`8otS+)69_0*m7d&M8t@{OY1hX4w(&x6oykjTFG|D-%#qruX^uWZpJ+S?q zGd+7U9nSB&BTMxzl8xsqXzba|v%JkT2*g=s(c!caEZ`eXC(l1+F36=FhFzAaB+Knv z@2-BiWf=5$$YMOporAe5i|2lsWP;0;yp5B5zT_n9xggCTlXR9%Rc_gSy<={!z;3cs z9kvKra{wsc264(|JAKIsO5bQ$-UMi8lsPPKC&*N`=1xv~FRP*)CvH-?3hVtM>vU52 zm+YDAtTT4MJkG!y$=ux+eEdW<ra{1*GZl#vogg45GOAiIYFE%alw_FK<-&=*4Ve?49WX;M?mVVNU%swz?=KJ+zt!C z`6hpaH71>?Y@6<8yj#-oR>w=joe8ex~%g&$@|`b666SVZMZGC?=OdbpAT4?=0OqH zrdUdTbXSal&13OJLO(h#hU~lh1xuW~$#v6rSucmoF2Q@_Tw?G>oCP&Nbh|- zB4UvsV>t*Um5V2f)p*2Ke$!P!ZW5pc0sgn2;+E=_?1HrvVfjLmDY)!qsgt{E`IO%u z;*>1q@C1foZ;hx2kZ>TyL*l;fE{C=!0>yTGYDK!008~4KqO_yI#W@3* z<^GkVe<$ApEk3agF7lJLlj(>}91FKDuyV2X75HVB*j8_M+`PJi-DQEDmb;veE*$b> zA<;_P6nMn=Uo;*trZ z>^4C27_-P?HFS@CJUwI)kssTfl@H(R&4hgp>o2a3q9|Dt`Ux|GYaF2cg8fwXpvTtr zb|Lhi9Gl!^0zD*p1Ay#oQ_*NbVyYunP+9%tp3qb6k)~k#qdap0IYYrDX_3_)M}&{Pcbfucc|(nvB%Ided+pA$nJ(8v z_N>E#`$6{WfQJHSg_?4O5P(YbsawP@E7B&fzRG2mGuU5G)8TozB>N~+SWc_lEX#fv zlrA~TA}sIQFTGqn1PlOY_fghW0mXV}ZHvsz-3Sy+;2(&C<(`!Q=!bvFtd*Twt_?2D zrfkcI$ZC{xizQfhTkOiR>@k2TsL_NaYiIg*3&at1OY!sTO5F7Hs2w}T|T*N2D%{#!h33%E))MM zAp9{g6iyNIMM-i&Q~SPz=+`{`kR17xmV@fclY}RAX&nd3*d-uiI`*(7(QfzOJpn9 z17JCmkNhd;e#IU3x-Ab``Q+{8-Q|9l4~SSz!tx11zC zIUsCYe_{fENJL}b5iMc!yWMn$>u_z>US`neaJY54rffI}S@C7l+vHNp{5;7GfRJ1c zdeH#hXfg0V5~B4lECSsRxf@4;S-7(mtIG#p1XjHmOOLv29Xf7U-3)d>9gtLx8u6^vZiZ* zD+mB|<`$U>S1>m@ava{;IriwVTIfsI24=LL zxYQ*c$@8=x4^O#uK#0ixgUPp!8ccBgUU75CN-BqmNufLA6}*XDPuWQ{Am2200pDP> zD^5UnmS0NK8q2oL1?LlF*B9&$e2EojleyIi;9g~(Fpk-93EBb=T#E(|KY}_1m2d3IJjngN$jAP!-@Jd*AKaDh!quCQEZ+}jB3@Zh;bsBsmfFYz~Msn=!M z68Rt&x5>{dJow9%0el4xn|~$i$GD!>^Fda4oPueQc>>&`YxPHWlND^4->c!bK+olb zNAjk+{rgi%l=oAmcf;yJsCutUf-&+)(@)gb@AjE|Q9 z)XyIzes=k6a>iu)McD9C0v;>B1_{ndXG%*dS0mWpi0k`;`wUpj$&E-`Ar1mxEo)sT z^FTgphAWWcp&Y7iY!}&OUSJ|5_*;7f_HuwF9*IP7MP3$_pX^T7p4Ed!nUG75e2oAb zP{SEmFKj4tf}3u`hSE&}_T`Y0%qO0qU&X(&#R~+LMOAj#kA6Cn0FsYo|K#JyG?E9I z#7@r7@w(w^3}3h@4-Y|Wm)9V1WlS2#0m`-{w**eh9S>vU4xQ3+oi2?yqbJ1k*k1=A zEQu_dGSr2fpQgyGvJP@Jw+;`@Old4AtNyZe4+%U05e+2E`iUL$CTLd4cm{mEl4`F( z);f#5u!(wHwJN=amz9GQaEZjsP5yk_1Pok{AMNK?IVYDFP#fqATpw&a=Vf1%uVtDr zlc-j(2iAe^aI}b{N?ZGvys&4EJL0jfzsiEEfJJw4=RRM!dBf+H51N*=bC~Rpxzpdm zeIc{(E_=41ujSk!vRjm=mNRgFfK0YfW6L6YDcgh~M1()d{J9hwZy@|rvQDO=ZS0pp zFz!XR-oAT|z0Q?cf*lDm69nQKjLU3Sa?iMViMXE0zslRm06X7ypEUPK93k&}S%!K1 zl2gdEi+mvaheL>dcWD&r| zd-kt4-;Om|_CSeB1wb9gdB&QbI5C%DpXhqonE6qfMBykP&h`*oft!4r<(|MZH}Fg{ z{ij9ls|_i#EcqQX#PX7I*8%%qByQQd&j_;sxaLkHw1X~zxOToRB%pDWTaq0u;30#m z#UrlsmdlgiDOp1wj`@9&=>cL+PT@^%s=ItE9KjkRmzXY@t{<24sh4|P7B$O;DTuwu=RIi1 zzpR=l(`&y89@pHTFJ_rxdTb@!lmti(yX_N#PW0p_hXtG;SOkgkG}6;m2RDdcrkaDo zuGfyYk*ISP2sf_CtjpCqXNkVB(kcF>2hbsz@!?-c)Sj1@V4ahJpLaBnWMAR?dTu_k z1vEN4kj`sT^^^)VU}RXzmWJ+wzNl5>AJ}O9iPmE4oYn+A|Uh7+2}CMOd(~s z&=!mG7=8%Umep=sz7Sl?e3BSS;<0tZwU--n-LbXp-M5@U0WcQPtVV{Yyn!Tpq&{RI zOAJVfdH9swYM(&y8<06mR0M`w8Ej>Oz~353+U5O0LSh}u(<1fDD@)qnDBzF_Dih=r z5&iT~v}hRlE^8!H%n}!!^rllNKSE^T!Ay+*TP#t_y2{nj0Pn7JK4!VU>UudHKW4#l z@8BqYs!4Mh=j8@&=wkr`1F~QiAc}c=9wZc9J+*pVWMNbC;&?svNiQqXOQ~1CL|7GM zHN)B?*F4~Xf#E@<@$1L|Sti86s!);hT@lXh9YKTYwIT#2p75*0>h;z}6-S(XKr zKIHTqJGta%>_@s(A6HpG4j(U2TmyFHB$W2e=^vEKILx<90=ePS7&TcepM&Nh7FjQF zg*WU;1G144>YXirx+shnY$1!)5%Y|Mpi7#qj*I2ogA^) ztb#hSysX<$R836q$7BnGk5Ue@+kSikKFKBT?no(mKy=obiTF#?7>XlqpoIX9Xxodiv&qx+`#PF_q@N+M~+`p1dfP-E- zw%;9qz);nJenZutq4jM8K8+h$=F?w^$iGuuNl?frch`hk4 z`E#zjV7|GHN!V|1C<`ACA?VQ&Q=MgTp0AjjGLQB_B3Fs0vDb}8Q(g38WWGZHQ-Ko4PXKOE&#$OT%iV^`$@F1RVmb}MVl)0XJh4dDRu7J_wpg;2EKfxZd zLv^P-{8c8{I6q#UoLHT+%Ba_mf9T6U{P7iQ5TiO@b^zg5%Rp)~wsY4Ivp2FE-d28`=3HZ+iJy_3|Ab2gS5= zcNoE5OC+{0kcY^<2c+N0E^{9G#Z@cvNHon;Va<{WpBt2tt?h?t)=1KJJf|(EonB?d z1YGPS*pNs|Q^KD8+mv6#exFR8eMcl9$19i{k?_gCl$!C7ZkBCHgZH}Dn_d1>;lV4~ za%CuD4pR`)D7yq0UfzoUo=D`$syic8181znf`nHPo2g(&PDU?)>VW7Rq`m4EkKKBg zt!hw_9d3MfwM7g5Df=42Z0l{Nx)p_{`Tx-K47mGSa}{GLS2W~41|si>$R*`#6joo8wh3c zFV%=xwD{4zY^lI39TCRZ%?=IfL1x%ZJ|d-$+&~H*YlKk+kBneiHrLN{GvuEiC)K;^ zx&~CaLEN|whvA4QLBYB*HAv?ui7hLj?utu)inC2EROP7 zR#_V%7gLduQakr$LKKI+cvluk*M4oEN13aio!(7gU!Ef_DVUX;J*m_%9>&)pg(7jv$90#p;aOV9 zr3LQZaE1lP*p3TqZ#*GWY9HV*0nje~g=}BnO{YxxmQw4u%Gv^`|Gg!J}Jbd>W{XrN*{>FcB4e)wunCP~&> zK}81uiB)#>kLhp);Wr?HP) z!#@wQNUtDuWT(=Zd%|fzZl`;k9~%U_a_Xl+&M7h@_7AwYwEL#iK?KMx2Q}BXI7qn` zmnO?YNDd@p{HNCAdV7s)&QE zRJmmnwki}-bk>dg1(|l0j)3a7>H!dq%Pa=~mh92X;LHA-Km>NpW%Ko4o zuIvFP+r^bikc;18&;ENBO379&Hy{Mh-8ySZ1zWXpnX!%}B}|v2&K>$>nV-`vB{Z+z zaZk%j5;%c_#q)&w`*=24;`TtQwQVg~qG?Q7l}=N4g+}bwKjy1OM6$DHOk~LpC~yEI zc5?NvQZs< zi#J@1M96f>6(v6~cF^QT#AG<(8A(@PZxFP<@#aim3p3z$3CqOJpSwYTs`- z!AL}m;KQJ6GKehG;wq7aX6&_!qb_6%DP?mh%3s6p|GE6_-x7)B?cNK8U;03dAD9aQ zm2DH|JACEG;wiun&$JomQjK*!a8h}^r$4fIqUIFJNeKmu$})W&0@^C2-WLF6wRK9u zUfF40riTPUCHKVHn3B89{u}Oqxr3Tb@Y?OsKfBjF5K_ugfaJ*cIM_v~LM4-H+whRt zGk*(M`cBS=%jtQTPI{(QyAOe=3gC{5sRWQuUhvQ|q61!8kXMI?*O8@QrsRMPdO@#r z?RxxAEU=M>vpDs65ehLo89s(L-Ro%g`US%%4 zaC5(wUc$K0a1SY+`IG5uJReSierB0YB_0W~4t}b+ZWsKWoNJ<>@?=WNqF8fv z%zY2i7izeqq<-#g{?A#9@J5-P|QnIgr!AJn<+J+-^EIRo84kvdAi0U z$!gzmhJVN>3`cwa7J1@Q^<*EI2#Kt2zexD_0MC>8%eE} zgOroGkzHnej?YD_do2<{bfSd#ihUalq-S_CuNBmVSt}CHw`7)+Gb_ntI}j+akB8j& z&lB+8s?}0}!~)oN%O}qds80a+Ks(R7$&RUxm3v3#jQztpYM&{zeqV;xH+~uT)NFjV z1m5bQ_LVi1S>S}W85u~5+P;myN-@V;P5b$*ZL0FW|Jk^ZzJ*1-+n@3w`*-(g2?poSyT9* zXSuICw#%&#U$xvT32@`CBM1Jce&T`jjo_qcO6?Gf?|?p?lKQ`f(AZ&QN* zG-wV`uHLNWm#b-~lueSjO=WCYxmBYMhI1WNjc=FHu9=ES1*(2UdHGSD**@TFbAwCe5TkIaS1y%Ny&1{hEaT-& z856e-wPhi%e!6CL;H?^2%ACNYdU;?FECF?j<56l*uF9(*p=46?L2FA zuk^0g(XH2R-ZZ6aTRCn}%lw7XF`is?4~&Rb{C1T4GH|mFTvyG%41Z(EuM=(#vFH+`OL^-CN5;-MMS(&NKpymMcz^(HcNPG5wBc1(6jsXa6id4J4FG1%oGfX zRzUR7@gRo6lgkJZjVDzFK{Xxj(?z^Nl2FeiUv74$R={r1>< z#mkT_%FGfNiHzuF*v;1Cyw8`9{_rK!>T)US%ST-mZF0IEULRkAUWN^5U9fi)gUMgt zHClqH%rt21y@9~%E-?wkrN1OF)Pdc$fzh4Az!HPvr|m&kAudq4!-K#)Y9J7kCwyYc zZLPPqBM|&Z_Z!6|1t+G@nzpL(Kzw9>p7Fr4h7nW4m8#)iHJ%Wc)y#2A?U~iAc6=}E zTOg9De_rS+L|*>N&;c}65g1-r45lg5j4`f*8wMPB>6E)%>N1OrU|5#Lf&+&s6#*)b z1H!!Qr|6lvwOZH5l2E45Ajt=*(Q`-(X_+Vn5Xi3*ONQ)$eM{gQTEQx9EM<0vYCWHxot|YzzABY zy=vsP4eG@EU_wz@!k`#pNL$RV_E+kiY}tkQD%t2j4H?uVr>C4tG* zz~p*hV2F8#hmyR$L$;WSF+?eWd^64tKJ#7>xyI3t<;C!`@tlI<8JGLmQix|LVsmb@ z;-J7p@wla;+@o?ql1HXdNR&B!TSvM%E_@{e(wc!#!>zS)q-1l*4%PQjWK#C^VI|He zP2Enae7mWHBmv!VvxLR=kl^H?(v7v-Pm9WdWKD!5bCq3eAIzv~x4OQ0N1{_u6ej3$ zHF?fl=cc3>JFP4nKORcgK%jNCl6**3ql#iPe-#zYpitJVRs^(}qXTM* zbmKPmM*eO%pJ6hxM=hj;Q0pDa^SJxUTs*98nyxVIkm;*s{_h}BU?3v+S5!w#FJB)q zn;PE@4K-t;m2on15iGdU6$EDmm(I+ubKo6qfisqomIOxQliJrc1=KZ{Gmo{ZcVOm# znv1eS?3z2c&by4r+T-PxlcHt-UQwl1a-SuQm6C<^O}Qjlk}`^;s5oj`YKq+I2=eln z8fA%fmcY*kF>~^-v`eE1O{bqtJ`+%VYVuT(H*}>luIGBX%qU5MGUcp`&2reR>Ukd5 zrvRx8?o+baYSrv>Je$1^@S7G4E)tq;%D%v}K~_v`l!GdiZ#YJzWUM}P%i^T%lFR-$ z93^`AJbbHK0hJD_e6!3)ceHumFL>R>40AN>LVEdl9rnz)at#qMrw1fnABO|dIT{dr zAgO?;a7O0K=UnAvjqS-6;|4AljuBf<$BMCAoR^VKuZbEJNBWOK#;`6k{ZC+uB5>ym zO#0fO$QT1ge!j%C4qR+~I<^e!T5h~8H{K@Bc+Te9w?K&;eabTXBLkn!rNf7e*;|?D z9K$jFLjRL^BZ!x@*#jJKjg)spv#rp_EkHq3LE?|Yzf!qD&1H2-gWc+KoiOIdDPN_+5#6f}E!T%~J_zmxY-#fuq=Rj6H zWF9dGvg!^eDxcUk)k{9(OL=YIM5dJ^QzJ=IuIV|~bfaG~F2RmfOU7vtv^JdlIw%QL z>=w>)-b4%zeGnMARn!Q#RvG=iFLbwHMuJUc`+g-b8Uwaz|mZ+IEzN8ICAJF}Z_QWZxF}a}C$e1y%Q;1Y+eQX@O*eL4t`? zo+`bhB9@piDSHR6-b~;DYf1=8Sg%avDwrg!&_w6>7-7;az z+>)ZSZ>NXtHgS;LkREPG;?-|7W4Jev2MU!(PByR&#p(b;!Og-J!+?P;YnJk|d&>8$ zoa{r+ACVrmTggz7Z!sy4Fs6W0&d-+fvvq)C@t=lj}>&mBpSlE}X%+nGDt2?CqQ zGNq=&gGL=Vg+_?!yN?b^-eo19vGpV+U*mUK!<#GTR#gzdQRY&EYmL@BDVg1r5scq( zxhW2lf2RTLvwM80H{=twNss3scjV)!;S+b4i8;lJi z%9~U&rX`X;-eqm~2Wq2b)4MNbR2%EIQ5K`s7#fK{F$D9y;f92!{Qu|Sb(%i}4*D0$ zEiL5&ohSa?@1vRKpypnSPjK{Cd8&u3`r3UXGQKAe4&FLdTwvQor7?s&!zUb#JdMA( znV!7BS(Xxc{S1DH^T+k@10nKx*k${LA;AFA+NpcWS=@&TIcRlvG>-x!c6ux570lYH z0+X&CI91c2E`B8_3ev)$ylO)!cTDZuwoH(m=ql&@&Z*-GE%!@Hz7|-9Dy~N!3^lH- z4CJLl&6TC%GZk}N6~nB`VP7b@))ZV>3jQ)Nq9^5Rl2;j*Dw663a6MnjVBQmIEtjgA z*$&cKHX!%K<4NCWn4El7;KAjrq7p!{Lf~@dxVB+v*f6BClMsl8YZ4X(L4#t2ii4a3 z2LweL*R_o6+FRfOvA44u-8a@Xq6fY*Wn&qIZyB?183TZfwM~vED$*YXm&KM@gSZG5 zz6e@`n)7$;2xZB0O$jeJ^E4_UQE z@d(S|ztNa`eJlK29lNQZS&5nZc)P<$1Y!)7k;t-^F74PnYDBcJ4UU(;(qmgKIZ>Jn z!UT_4New%ZZhL_HIB#EThDz)+t-WMzwIV*G6;(z{y^B^iK(ybjT1-C9d4@_eSXPWP zlzdeQFYToKk2Q?-9~vgFaNlP!J8e6ZF9|vIU9I!bxCI$-1xA7%^OAlx($9Z~Az>hA z;YtM!b)#}DYH*mrnUfdKiEsj!A6AH2fNY^b2M%{Du8BtJ1@I&DRo~h%q!P}H{fv*-Z znvT49&YX~j)hz>x<|hgiu4={mcl>_M-`PUO8dg;N=1XnV9gc4~*)6(yXMw?b?yE_w zj)^H35&zs7nf;8Po0351;VTZJ6sYC;ViAl1n3n7oV>J)@RjlC3Q=-U}v_wkGm{we# zO2$Uzo49qkZ4q@03cI3gKCV+SIZC0NN?G})8ULJf$CfAM`j=M+p{u~GbEp0W`vO1N z8!GD8PQ4W6ZWSnHc8-&cf4p4F^OyCjD{{ z(0Wyf=jsBXOvZI9E?_yy?TXqECH7jbQZ;jR&efG!@$*=Qeef97N*KC=;uAGxVds!zC!h*MH}@BYbIo8sP9!{&LEND|IV_lo4%8 z9xLVPN*hOYX+y<$!&G2Re!eErQgh*|nLV%F;~-^xZ-FD;wDj}ugiXd3Of`6ZJcTF0 zQWC~#@rGQ@PfJ-;b+nX88sy5Tr1s;Jm^DTw(I zd~6SQ89-5;nzt#dgNH0!2b70oYM!T#b%-35L1DZIA^fK0R(DwQ94D0d?U!L!UUY^- z;Fc_>({{mfH7}1DSxs2?A^NT0B?l>BmfTQNGN{?Oz(p8nO~byaXXTZJV_NF^@wKm} zj2}0&hLD4n*i6?eB~E({B5Somx*+6vf4D8?|&*rN95^{yg+gy@XH zR6_=qQjS3I;elK0Danm=q{*3Iwl#+6j2;!KO7fV^Ifnc^w=|6fR^GE-=es z>MMt1)IK|QD_!YqnGpYF-olRNS}vH1<{B=cQEJO7pzOZ^y^>sV#rQCC$vL^?ib}7V z`iF?-Vo~;wAMb_KTPA6du$h9%gJEOl0}BZou9u#1;TDuJn$DtjklDg4<#L|>_pq_z zQd+vg`z;xyF22nevP+A0Q(H?$NSR!Y!cVsSp91{9uST4>Fp*yLBXSI2G=$)d5(Q!AE(SL^Oe-|k}iRr!*JJ?S(Tn=w+U278MiCF3jQ1>WWf^H4Z+g^ zrVGoAY8y-S{&-+LpYV|N{2_;|r6Y2n-4Vg{tjb}5rsLFWt?lD<>Lyx}z@rqE{c2e2 zwK*LLwTgq1Yj;K%TNB1M94N3&{h2pt^*FfZT3HbgR$NA_xE%XE?CWwtX074^-Ez=4 zGJSJx1tDti44Z-0s8{5&{?0}Ff#uvM@{}oP$05GHrwqR1YThs%7a6*S17+xZ!yw}m zsD<$;yyp5Iqwt)1jFc>1B=2NR@q!qVcPgax6|MC@&&YBb;x*w~ct6u*f$Ce$3Nk6d zGQD`4gVPIZ|NN{0RwL;r@sWD~FWEVngJ{h1zlge9LhFKw%9?Vj%sEHfPMj3UsAi_H z*y)0b3_!y{%6+Bcpd?nWSumthRVw3z^fZmQDJRw~vj1EvRPsHfEpKR)eS7kc$u0nk1E+)$}C z%R4*;nT}iEAqarAShpW9hvh4oSgJF1$d-&OQ!OjJ33y8h&ZB0iA$-cP= z2O{Z)gNlNMhVq2KMYwh5KmjzD(}u{k;p$g2hr#&H34_8{Y|G6?Z0*0yyW5KgG8S{R zgx#%+C8KK6fVd|-O0KJ=PmDl1FtCQh7yQUcG+gjgDvU}l_;FAW$72iN+RI{Grz6G)9lCRmxTN3D9>;9qi4x4ZGC+S|=)tq=16i&OUu zPi48MuKCP|~2uikeZv3lQ9Nx7jys=rgUBKYF#iQOAb4?GDVD{>|B` zASb4@gqLy1w#VlTSOb?29~9gqYKqz7Ah0;2qVB!s{!x>84%{|kF1=*ptYJNR!yN^b z3^`;bHe4o`J8^BBP5E*)r-)5|3$5b*?xJOjB}-x4YY14?bzcyLRI95*xh zwp&CQlIP1>QY5UY&ZrvAC~$Cor{HoQ3-212bYr2csbZ?gdRMG{sT|}vb}xzDW5Ghj zY=7-+4t}}t4bmZd&HP=)DzA*|eofLmBT^?of0N?{(RoEqJTf{gcF?6f%e385MlLO5 z5lfcE-+32_`QDK7m{}X-$Qx31dY4k0ZzgO~Yv~;7ExUh>y+N zzzwLylfk?kA5N+)ppr9pv1ey2E3F;OqE6 zn*q2?cp+1Q+7h$M>egM|sbQABj{RA7hkbvcZ7+O7)H|e`aAYtMgN_WxTGx4jM^cu* z{ReIImD2$sXBe5YzAV$Jc^+TC)eL9&Bj9lBiCy#;J%hNTyGoN;85S_ zgM!flmvs9bU&QKnkl@<>ii=^%^d1YKd?n9``y&UGySU;F_X}z&A|>At+y{dDSUFy> zvLF)hHP`J(+0?F}uvI#iarvo>x>oMIfl?F4^nvSk!F3x_iYm{vlQImn%>Zet@4J;XpoJ(X_sHtcoI?uQ`6P?>~9e#%C?{>^|f}sGzFmNGk^ zGN+QV-oyqCEAng$sDB#Rk4i51o;M)uNm*2yGNSf8D+kH}QH)aZ1C|8(MaE6RPo}X# z_$!umr3|D~*5#)x3s3X-JCv}P^dze2V+9J$D=h+PmHJ7^qouspY%7sNrMK>(OrEHs zpZ5%O&;jnI$===W9UA%UsI#B6je_^p+8$bCI%H6xth>6$J+@slo#=sZ>JOi%sDP6J ztSg7!WW5mL-L)4wntQy}yc-NPcN7?+%OYHKqN^GGBayQmR@Z5P<1s#-5=@)qF`jFu4>;oZAh!lC8TX^Zp2c-F$tM4Jkq zN4RAkO_|fp%Z$c|5(mjEJf`E4{KicN;nWsN^mG{o9=n6>294K4pg%R z7Jvob*dE5@q`|oPsSuDGQp03%!_9_@x4_~PlMUOJ>3dAg7p%DxFn|7aWS>)gMx$Hi8iC>a{jVMlqvH}G0FgkN|%z+PRVGyQnTf5 zTXRr(bY`)byTIjS5_6woUbDtQO+($-RwP!_M4!ob1|C`{A`R-|Q|jVVIu-c-oB5!o zmsOdX-2*l+9h~5XxOx*v^ErBD(eMb3($;;!KD@&f8_rVDtWVlR4u*dhc+_|cFztYY zy>c30Y*@!+WQiTs;e_$hDweV$6mWMX^T3Jx1+c&y*X3;eljf1vr(AK}V!M?S_qxM9)b=N@-6PCh# zcSe)WHJLuXEN^rjuj6e|D`B+M?7xTP;~~2vJ{`9AvjmpWa2ZzMFKsn{UV7~+lbis0 zK!v}@@7vNZnevzF%5~Ci<@hM9*h%17ppC2`Hb5XNn>xCp+|bK>I>0s#J%HBB16%p) zs1-))iK_;d5~x~B(4%*H%aY%DlPyr7pNH;vbbBwj7QlDrsZDhIlPasbc|?v)Ht^A# zq+3_^tSFPRvhT!uFb7uI2GW@&H}a@1NXcvFq%%{pm=z^r^c8#uuQ?@R8nd?Cts4$p z_ez^Nk83lQ{lsm%qPs#%_OYhezh zYFXEqdeX|s%Z9tP>%dsU8t7!^#q=!)EP2$Bmx2l=uS0l8!`aW|WkGXAI(b<*+y1mk zTlT89Q%8>3LSFl2TRh-htNyi~w5m9WTYF9xvt-B{Eni!wDlPVH82kEWR+B8G;xwa4 zkkgs5_@E)38LJR#?$$YZ&1g6nE1qe)($JYoYYzA+7#n$599W&1bGHtxbZX4gCv{UF z@|ZcJdM@r6ZM0&jyfUXnwVDap{A~i!3hTr(W+iP3{AW(pTjBhtQKKHP=gienS&~vVl=9N01Xd}vCMkIj3x}=D zyx=eA{88Y*VMbt}O=Rs{YgE{=TEjx->Zb~HqgZQh*%fzl|A5Rd_#lntWw427C&11B zPhELn{f#~PwtRJM0ab-;!u__;K z|0sTxvg_Va*5zgE@YqdmFKthymL^v`;KTC}$bhDHX#Ig#LzJv#6B9yA*jG=`)P2Y? zTppWsM!P(2_Y3+jpaAx+Ey}|wHg%a*!4m1^~lv_&$|$3S4~`4NL)+43IPO#W^G8sKM57IQw}}`37q>vmT;0vG|0FJTA|H zYT`g?Qea{{5Q1B%YoZe0ZFutsQec5ObN8Jo84hRMmSbETi}7OcTXKV?U_|AF+||i! z2G*DbCaVIOuR!zAz;z*T0S~;@eOoTMEk_k$>(O*e+Zz4RI~V9sf)rRFIu9%s3T%<( zyD@blwk`V}o-)tpuJq+0;jKs~oSfQ`l9o>u2Zf7Btc1psWi90nEn{4Y?lUF`G8Rj^ ztb`TA8c#FyV}c;#BJVqNU?~m-h4xIw9ohr*iUfGYIG7?)A8;2pF-jDy_$EkW$BaS> zkGV_k>r7l)sO@iBkZ<7j;ZbwZaFCFTp0)KQfu2hF-V}MhP}oz zI)G<1z|NvaIn|~M&l{mD(hz*PCSP#xPyooK0q7o-%0+qHh zm3(%7Syv9T5Q<$YsCWuq!$kImP%#FWkFn@q~Pr5_@P)F39^~E{O zr(MNUP{vuXNIjN>MnlS+9Czje+si#|Fq1r!cM|1AwG?TNmuuEe~?u)!v1M8h_P_q!ANx7Go zv;|@ut-G>Qz=2}9z*?6;Xzv?#q`yn5{i82e&XU!ZQFF@ta7$fJ!9irbYg%$0z-5;!jVpvZ}&0pDhQ4CzGu%-z7Gz63!?ccY}|d1|NYG zdBs?}F#5YrGj7f;)&3<5!74K24Vm%WlhSP*q)by6v>D47YuDVITk8Mm0nkP>fR=;6 zz`W(Y-7p?+7=0J4(rvj*M~Xad*A4gNoP_{!PcAt4sb}l+JzRb&7@$eXyF8%ard@Ea zPU-kpFi4NPZq8ko)_)pP^OsXnBy4fv)n;)+E*N*$+-&2Z;%3{ha-d-;Z_C&`c13{o z6JMux?2uBAmlC{*v!NpoqaCdx~q!~sBr7yEx6-_Q*vHtyElXd&w^S^fU?`Z&(F7;sO~eq4)|)u9d!6zgNZAcFRWIBZgtbXrf+wn-De zl6?KgEt|Uf$1h1<*f*=;a{A3w^qb*UZaL|O#I=*#^ySVe9S@{NU5A^K+-6vAI$T%O z(kdiSaPA3g7IfH;VkSG|zVCV2h72vyc3?s*P_7u7xVbZZ&T@c26A~A870hHuiEb?A z%V~+lytVy^!Y-l(x+?@~NCQ`UAEd0%4&3+Yv1N>U4ETL}Eh?;Wfz*0nzlxmY+$qWS z=#AVms&APHFUYY+6G5uU8XDGG%}4|ZfrE_r!E^2G;1oi{2A=o`Z1NT;pA7Wm4$*lu zC1^>RryvvzEJg?{MhMiaIt7rCY_AC$qEfhV#aSCo?HdOP?@|#$0wvN}rpGDap?t*( zk&3?1R1+I)@H*-`lI?Hj4Nr1c46m7M&6sP=7|~^%Eg5%`jJj7ZLJ5QovG-(P5lTc0 zH7g1;M+;V#;-8{mz|6EuMs7HxX_NVsS!%qtO*m(i&e{qG5~f~bTJ!9%UCDf=nNEzt|f{&7=?ioY==qy4M(h`Lj2~ZG@xKgcll%3Mo zCM7IQ$r+_wjZ)g{rz}EEjWY@?z9}i8D@g*hEVT&~PY1^SEv3>Wp+?Po0PUC~<}fzE z;hLrABeTy&>z1c4$o}WXDwxu`qF^pIHH>ciaX?)1PU>@DnR~}c8Pg=X_Q;Q(OW&PP ze1cv@+V{}1^PmR)?JvLl_1EA0IX0L?x7}%&`>|*Dax}ZSE|XT^Utc{k@X2=3me{a! z`dX~jc{e>FO&in}1&>7ggJ>P5^*;?Tc3PL`s4nUA(Y?{9$p+n*Chpm`7y3DPlpGf= zsn>oHh?h)C@Ugs%gZ~)jSx|+h*iW4*$}W%dazNjQ%d)9BE%}FadE9%s!SV!6f(6TT z-altOt=2H5Ukqgub-7)FR;bzz6>7V@Y8!GC4RiE4Q}ZqB{R;;_ zMqltp9+BjXaPycTZhejh)-VRL&Vk~cz)mWjh%X60S`KI)Y!Id7@8l#RNKFt9QK1uf z=R35>oi3IyAFSJi~l%pl5K14WVRv zz=QB3r_MbPhqN5j9Hi<~6F#>u_|z2Z=}CkV=x0z+;1`vCG3!usP|?^Rkm_iNSu&au z22vdbo&5t-6cx#jnhZxvhl7%XC;|+$I*4$lWcGskKr=t^gRi)sR(xe{Kp72`y?_eD zhOFeKonxUx#yob$9%dOC>WoV5j3qu!dK4TGy~J{>Hr8Fmrdm;!5Yrd20+&ibLpYAp zf>T==)t_E&)jB$<8=4`|6~Rc3K$zlygUPLosjQ4e>o%yPn_^5+&`q(WC9A>|z6ERG zJnPW7$xa*n6-k8HGc3vS19M>@8-W=p@gSb_CS~iBlx<0!8p+wRB#;OR)F!mV8LaI! zB7`u7^<=E2OIazOGIMF5#1#4z7;^7tO-9O^cPBy!LEbnc^FbZUeq$jp4IEm^30sr3l=*C$! z>%Vq=H+5N-Opm@huJS_AE?kgpfcuZ^*C>61Q=4`M#NVjs;bXCH!z%MxfXS<0m$Mpr zuN#~pK!KdB{l&1r4g-pXRo+67746-YWccWgkICxG3{U_#(Gy5O#<*I=gEAsuR{HLx zRRA!q{8p~z*zG6t;6$?vU*mOn~V5n~X{jvaEqQ z(!gjYu=`!0m@P2N9T@ut=F$QK+`wW<$1Aem{A!)Ak!}fius|>Rin4Q%l^yslMI)7r zg(D6|N}6tDL>vVXM?v0%WqnQT#u9->Bv5Ee`bHD6VMNB9N+7IgnNx|r><#IXf^xsFzjGz;)(MU#;-F;F zK+8dFWf29Afiy^dYVJA*LmUne8nO)ytEOuP^(XFe_8jgf&8sj5(Or5r@$r%};}dgF1Q%mSjj`WBWjLL|`Rh z6kJy1OiHF_Ql@7z4pQQjK%5c?Mxw2CEQE;Sib$srmDs@irJO|xgeTE~Fgo)GHgB&q za|4}S^0|()S_^)5rf<)a=eSJT&uzavZijiC(DVoO0ppxNAqi ze#4x9A8+!*X&COB$hi&z55Sg4ln-MSErwU;LD}EeyXrKz4*l1m_5blX^jjy#263f+ zYf<8H=?AruMRMni^2Cca3^3tknWxF0Wv!Ege*4F6W?u*irGN$W9NA@XHR0tAMSfZX z(arN^7;j3rXs(8Yi}fdgPl{kLO9)+O$RVsFwU;>rE4r`iS_b_nzj01Jx_dVdn*V{% zp&a@7p>BvbXf?b7;&eVe<=fL#oZop#wSK33&6eX9-I4<#o}SsYBBf93+?%#McRm8_K3GWRzw5 zV?8WM5$v0cNvvvUIVji^DG7lSIi|kJ+;Fp`_p=CxEFu z17y$m>rkE@xcoSPX^C4Z4gvv8O`fHpcr!{s0+kC=x9Kn9Hdt0f}uFTGA^9Mf`fvt|72=HAI&ly2<(=dO=23B{0pynu@w{3&=Kh ze{0=gz@Bkb&@v0c@>W-ekTNkXNX2JLA{n9`2In=a3~DBjDBR0P#$|QvM%`b=_Td>5hZ*B->rdgWycHfHYRlMD#vu?@pml6^Lrb%_ z95kmKv?A$}b3ofOBWCa+Vr;a(LcU4N04u@wM;aT**X9DZZ17*xWaqy;pqM=V5WE@1NhL(ed zgiygjO07(6g_tveRT6_SffY$3LtHkyQVQ2oCbUyJX{T&C<7K5$851aHZ8?ZqnOIgz zWsD7My-ul>gTz!De}1arLE9#RaRiU_ofVp*QsQ~KpE@W|pQq{cI33s1MTQq|MgQf}fFZT~QmJ6JYv8GUX;zn=Cpgf_2k7F>jmN{c`nc@x2HC~lqe zTyPs2me1BFSnD?hF5cJWV>s^0u-{(R?-Y=&9{}@EcKTSy?{QH*>_aW57r066w_zIu zoDBkGdO>+pcRMWWSy14ZT)nO{xe7c(-&E7-%!d&fC9|2BVKO17>ic68z;$_?O&N57LFwT!!>)RRtT;J6zQ4^D=`l^Px6?A3PgJCyF3;0rpFUpB zO`%j~+&b$>a5^5YhvO;vJuoL+1A7~Eg4aF|%j05CS(`nISJCNPV$!^iz)kv-Kr-A8%J?X`Se4tresOvmyLc?ra$&_14E~_Dz zRXFf_w^?X8h`zBo2Z2_8IhDQ{mA3MB;ulyDP#R`PTLQ{R}(OKMv5}`jC0;Oy22T`I(9mX{99nBvq1Pt-O}4Uw;`ZS zY0s4t$Ck|Vm4vS;^L!cee1Y8*bEfwK>APr>&hA8Y%Q7X}ei&HwkIclg+vyfWqbUhF zx}UdfmiDITh(4 zo_WSfDa#~MS^+thjM+h|nT(?I3?jqllm(8?=f(c)(eO7o!xxFYcLuRw1~Jw)H5^1N z8O7DnFF2*XsUe>iRn{f>yq0-KRy(z90HV1`zA1TNN0+oH(JE;IGO20l8#Af#P7f}V{tTdlXcW)li{ti8PC z;c`k8auv5BIwq&!^w1M;9sn1?UhOeu2@CsqnNS0LV}kKE>;NlAt)=?9Yc=()JNE!e z9gLOFFQ~VsWmA+hAcJY&$)DJ^BvO4FDzP7D?WsH=-+7Zi6IdyT=_Q~O^;j#)p2izZ znL((*vr@ofkFqT-*FLPnXL9L26VXpckO z&<$RWyzBc>CH39m*bk?(U`DEHa#~mB4DWNwesWeAS~Ykb5o>TMS1drYJZejzYB(-u zCnOt0#A?4>_@74z>>w+rv7%$xjEUI@W(#82f=p-TOsAqz<~E5G0(+1;hE0iKBXliE zX9oI`M$WRLNQ{MSR^#UQt9E+Kp=)$~Dal#Vf31xL=TTZ#FlQTlP}3Qvj_nM{S-uO| zTBd3<;#0y>6^Su5%JQYarYC`=ErI?Mo`y{cLM!JiYhuqfl9%*xYiMHK#Ev$BMd=*a zkMis%5L$T7wvO#@V%M93gP5~znX08RoYA8G%2|9tp81qQeFjYKITQI&a-VG^K?N6d zVaxmCRGz6NYv?f(2hnw=Amokxa|+_xjNmn*Sk=hux2JfcYTk%Z$C1qIWwd*CteKG* zP3cwBIM!71l)P$9`jXZM8QniKZqgYmATyf#IW)`(4PzrU5}GzB$!z)uEC}40m~*g5 zLpe+Odg(W9$XxagAgG!a>%I0*zx>nhnBwhzV?EdkIpU}tV>>nzwEIV+`+?&{n%C5k znQT3`TeGue6HQ$s@{2|2x#PSx4!ko1(!MFzm6S#nDJ38&S#lfHCH-EhV{c+V%s41G z2voM0M27{@VU)P%q!VLGH+sUB4grlbbd=a8!;e$_!;lUIzj@CB`N0@J>+;;tp&Yw0SUv*5iTuUN8$Tr{v_lDDOkUCiw^ zu?8;=q6V#HN;fLba*F3udfOpg>zV>`jtvnXd&s@pTVxLF3r;K;h*q=^HIid(|R0G;OIwgO?=zLX0y?3eG zlE3YPKm%0m0k?r+L*F{paw9W*So&A8jg!Exu3xM#GPGA)H@R)?=`tN&r)xCXK~KB0 zIiaIAZ@Fbag@S`%Xg3T!u#r~JnTAcBXO~G&UV=k|C|y-)E7ap44Ud=QE`$E1zBGR- zn~!V%@t6PMO-AP|xlYR+kJvzYK#F%0gc*`QDwR0wiJ(3~QUYt>Ij2H00Ko2eSk0Yh zA36+RXTB$ATgFa!pcKb-&@<+l-_B+B`xu*@?kog1)DNybFA8<#{}S*lxgCXzsCfhY1Z@6I2d#{(1 ze;)*pAxR9TxksCiHl5_}1>Po$;cl&)Xu8rUCCk?s%*w3~M9$YKgw$AQ}Lr45SXgX>nhtw!JjP^l-7uLPMQ{y4SIZo7!$C$Ff6O7591x+IVy-0b=rS}qggI2B z!+;?)2UI1CE16UbOezKzp$BGP0!aj{34u-O{r); zU<1d!Y`zvK>kaI==C}^Tp;@f5CrQL?!C{!m>zpUf_>oDy1X3@7m0*E36oEp^z&egV zS|zYkuiH*_o`O~ikO+yiiVNkan6oss3*1_Y(%IiPqe9z}R+RWh&!O1cB&MlT)+fdk zbW2y?$n$YvkgMj8yw0&^-n%A?Ms-8R37OH3&Rc}%v?I!h&!T9*;2EbTuTa###fF4qhA8`d@Ym8h5}PUJ)`Hnf`E*m z4O{?6Ppp)gmXutz4eFX4VMTyQVV@(9N3haR9j)G8RF!d^K z6IgeY4LZaW^vm2Cc7bybSR@`70U}5*kBZ~=;db9wRqZ_v+6@hZX}qE9fM7gx9T1Rb zU3a%-K3j9*xw~%{B%Ck9Q&7iz6}UG%hj}@*uyoKO02DRs-En7>d-=%yGKDK09a!t8d&5=n|pLkQez6tetwal}pac3Yp%w zw&+2AJ~@x8r^^4KTaBGXy~Tb3b0}9^v+Kxws}KMP@?cGrpK{?r!J?Gmg{v(<_2QY?${*H^MsWYbq1)ZwCP)@ZV!^e3$JmkY#OSrQ@!-Jd& znFVrU-R*JO;if!*&5LR1Uv}i5Cv#Yy=T1ORk<^WSCv_159;nbv@kk0;&#O9Q^i|G? z9t-k&EeFwHD(4_}4o!Vvv|hm<<>dEr!bk@X-1Gx^7DJD9bdAhe*BKMh6+t77nxlQ> zyWS!rzZbLCw6LffS~thm3n>w1Y*)$(j3#!PPRRkbbgp2Rxwn8ZrmrLB4D_Q+=~z|M zhB6Rg(y^*;nYCs@J5qlJHJR&n7~pb6!pJr{RL0gufp{_kOV*jb<%*>K3@iGHV)x8I zGeR5GgpqZ_64cn|n%c&i?iPkZosJ7G^b1t&dk2U>3b7?~NSh11SK#YdDyAg(jAF@x zeemLdeN>fHe5)O65`8tFaXu)vToD+0$d5%|4&?q?4(Oc~bJ}fW`cgtuR&_L#Nw!fP znUdg(C8jA2vRD!Nwz1SgQ2k~_XtbV=PFd_B@y;0M)ItUh=#*t>Gbh^gByh>kRT4Fo ztSKp3y1_mJ8RfAV8~zyntV_a9nrOZA%&FtgmV<_Q<~o{R#xhbSoZFaZj`gI`+nNpi znrM^}C6EdxVSQO-Z?JjyRB3JIhu4ZK;U|t z(b_fTlup^P(?M)T>{<}A1{!j6V2IZcxCtT^vJ&hyet|q?9f`|Wd6H7vnERk^XwngL z*MWnKoMz1dYi1RfW)aP1Kcm^4{v9bZ-VGsZL$?kpBU|>cGBitJr7u2dK_ZpLu100n zq%y5K#WVTTP^2{ZOTCi(2{`kg!lA}lC81x!&pYZOr~51@p7(Z++Qj$J0LE!l@3k5M}!TwZThgGcJmH!2xrjo+}%dQq>7#df{y#E4qzn(huyXWm{Rkc zf*!3fV?BhbANJktLEF~y*Mp$2zx=;s$xc^v*IG9Lak5A!_vvANnyA8su1*F5w6yhB zx9+nR=yotA6%0BLXcHwc?6$yWCTI70I?gI6y>{Q7))#-|KYkRK`VyY-578SuPQacM4_VfQ%e7;;HGzG5Of$63|se7Q+MW6|!Tdov7sM-2VljxiPEKYT@H3Hw3nev=v z&KVQrv}K9Rtl6?SZqA~M3NJ1zDgvi*h*j+b4S_sY)|NFMNAEY8Q+=|n^y&8Ou|P5OvkvIO<@ew`f+liW^7q*$W^IT;vOoEQ%=j21@$Ra z#3>U_DNF2A&PMOPT9H3Z9k8|>G||$wWy-xEV2xd7qK8~g=-Co+visYcQH@S6CBbN5 z7QJN^H5<^>5sb0~$Fk@R(WEEg3y)z^&LYR4DG?{z%|vR|28F2=Xj|;mYDsF9X7dUn zU3cyLX@s5)jpA}DA#-NRBazy?UFXv!`R;yL#`voaAAh(!^8ccnZRS1UhH06T$KG8& zy6)FtX^zP3;Glph3r ztle%nQ2^lbK-=&AB4`W=Q~;+PGC)AaQD9qw7e&4`xxI`i5P%3PwB-Q>Kk z6O8Wn;q;2;@;)%{x%Gtyu;iuN1wl^oGsV}M7FL$>y4ZIzPUCghhA&{kS<~znq?_fD zoL@IEs^c*^FZ*i&&I5v1y7{c;d)iPOeP__qRZC_B?FI9i!=VUblt0};VQLLDjO(A^ zq~{E{5MDIP@d}y0*3=v(WV^@X^>fg)_dcL?UUC#@yy6g#UjlQlhyL`P9Idkt@M5=W zU)ZA?&&k_r2fCqG6Z_)>6+a!wS{Ung>(MZDH+NSg_65dWy9wEKPi?PB$*&~m7x7%` zc&_E3ZkX$igJ`eI!fCVD4L?CWE4Hx|oGTU!R^3GDB3d1)sXl>KRw0uTFG^b25BODC$uZevF6c;L+#p>~B zZPRi+2TP9K1w1D7q-NX?N8XTjqQSR=I~n%n7X%8pX{en zAIsr;0SvpRJDFP3V>qR3GGq5Y*6O?o*VNPdmczH%YiQD*aTLhbFd1(LXI@hhuC)*9 z=+2iCJJLqSp7D=E<%mPZmPoO2q*ym(UR$R3X)Ro{jc-idoBT5Jtb}@e<=nL-8MVFM zte|2&Ia?E`!wzmWU`J|uGZyC>+B0(0|2#PKak`ZD!uCugM+5XE1bMOIo4tW*HsWnq zt7FABq#jvNOh@yS_DLz-2U1FhQZ9@sn}~V-oP#=cDTrib^uuXcaGjBrWOKnc8Oh4) zmUewjZ2C(w(yFt`IFjaM$dPjXq?8xA(lT`yowv7NEVf}AU}Gg+)mc(pN-{oWBa4*s zkd$6sMn+m`O+}1Y5QgOX>8K(heh~ zH)KjuKjlj6TxRTF$ZGK>c==7sK}_SDaj_o{gW;4+d`i(r%JtACoUyebC7kb^f5EoI zU`h9*q0IHwojX|YT!y2dwTr?{O@Lzn+c`)vPu)Cr$tF1RqUJN(GR@<5K?WYBIV!lk zHp|+N%7pIf-1pbVwh2_NlXU~m={D_-ga;f4_n{xrfEbWeVBtEPM|5M5!Qt@Q^CDS` zA^!|NvgAkn0>=H^zJ~soAwPc;SUe=leIM_Fpxn4ewlH*JxT9P2mW=B%gZcy`x~w;=K))WI}s zqd)X@Rm}fU_Vq8>^N=N%?sj;r=(Bu=tn$8&ij_~GCeO=sI!=#+3=ZRY^=6Gj|F}oq zbk`9CrU|s7c))IX+;D{2B^edpa)HlgiFo;#pRfJ(Aurm)hI&M!T`l$5Emf0p(;+209jz8$$KZ9;kK*6dnXt z?QtX(ik9?b zv|7v@VzvaGrWbXW9mZf@t3x}+mK3HHkvpH)kf3VFo7VQ-b!0Om+GJ&TOF9zAXbO?o z$RZjtl9y~N0?0@{X3WnQUjA(v`-Zr&Cc{|rM(!FeMoN-cRB*>j~1eLhudvPyIw=L367R0U8h=7_MA!6*wpt&jdC5fCz_g)GAhUNt#tO!aZH{eVKgyh( zV&rH!$;$M|qt>iUucPk~n{sF_p9qw>q?BxY${5Sj{IORj5pm1ToW`T(1j{)Qan4`P zv!A%u2!vY#;b^EG)vFl`(lesnhL!0VK`twf-sVQMJ2C(pGMA_#yI&;#^T zf>a1RhvapdPvibV8*QyQ0z7>#({<_Lhkcq4*V}XwoC}P&Z`!PTzq~RGh6#eG{j#c) zq5$4m;Li!j_jpk&XjoKU(SlM??dLG;fEv(cE?3kn4PW{%`P*-P{mq~M^$)*M-y_vl zf+AGOrzQ2}Q{G>zyiSkiV#D<42f?q)-tCLL1)PpFm3_Z-1GJgw?;)^nS@#QATX+|B zv6vki01OA{0y_C6h;j}2W;wLw$R<9WR|(aw|LgIGxaTMBOac&NAfR7nYb<&k=Y5e6sFh6vDx2igeFJWNbXW77 zgd@^wtt9 ztAYXZ09RsoP}W)AYC4bWlmKpO`*t~#&@#W0%*XjROyKgeY+L0tA&0qeoF8}dg71XP?ofS#d zqHHwCpgzjAUzemz?K?p|yEgmC z;@GW?a@coGdtfO$E7;$hF)P@$yo%U}wZ%55DJrmMN<&Lr?E_P;KA;@7X1Tio=!THm z`QV03D%mn8j|r(2C415>(0$qmDM5BdkX^IMYXsSugKUH5b}|F^2&0^98aajw^%@n9w;s=It0mLKQXQzd8Wzox1+W1>Gcdt+5q-Oxs6}S44Le31;F4PwS^Xs4L>=;QXuNUmiwDO4Z;q>#R)7>J(-nAxBY0 zF)OR88d`luhfl-G&XN{>1v8fLIiBXgQvYspRe1Q9vDuFcUNdIuTe7yq(`L2gyeXUg zpx{bY_YQ;0>7&0QhK~vT>rc6Tt+}GCnP9`Eu~GjTJ(n7)U8!wt*<_`qyQg7hf^gE? zOf?v0Zkgh*Vv0ZdDMgAmCiJO5wXA)Wxk+b9h+7iI4SDZLg_wy*X<CiNgH#N3CHiaw6wq{xlj|YpUVy#q8nQ3gh z!VdHDrZ6~v9>2bmmx7&M>!JGPQveq*=l0p59m%uX22JcfE{Dg*H3)(96Q<#`>>D*e@R zdF1cU3re|Gl@XZ!^ejko+#mPk+@Z@nVB&!!)C*})thmZ$ zKpB)$quc(11*i3kc^yq@y06O%R-MB^Q2GTl>2vIt(+S;n_sg?`6r=C#JNccOBe~tW zOpGl-*S>8-sr}SFdQ7L|WiVn|u;*o&093nO{<=r){q3-h{Tarc`;G^Q({neW^j`3; z$|MfmD*sSjzir29`J9vP$D>`_>ODm$XEhlH?v{R}n)uk+%dc#LPQ&+^11#u*$sIhh`_Ns|; z0>yuX2uzj*HgfkyzL8|5n`d28OPc$jt~rRPk|t`KP1w5E+hPco?y8X9lv@=*4+vO!(Zj*|&}`yFZq(unqqP_ThQI^Tc; zHO+yMNnlxCU_cUR>L6%OzgdExb3l^SDxYeytuE|i(R0Sak&I5-PN`-rii&0Wbn|>C z^b6w1IG~%n@vo*H$yi)sgPLygG5g;ZlmW!-e<1qISkupXeS4YxdEMyd`PP!M0L#c*KOS1>c$F2&Tdmh88(r{IPz9K=62-A* z%j|#Q9fmFGU;G3gl||Kd!iOW%|2gSc*5j)nfB=wPm~3Ee`~0c|mlL|VeCh-H9lzdz znuCl&TIyOd#@x=!vd5o6%aXrS@R@=HE$g0q0m_(}ayqtQ{S+PKji4<#@Y9j9oK29a zj8hi>w}oTWnhdQ86P#3}+CQZ_I%Nf*4a^J50b5h<-`_t**DR<)f%G6Fbl0QO^HV{l zpP-bnwyRHD(y$!VB=t0rciJaxbjQr z!i1KCXbKf5UTukEa~ChPWMA!f{IeItv4yYVE?%HJRLvGZCTB3^SISoFDdqYp#V?MK zqk~kewu;>cYYqxpK!I5;YVB5=GLMxqWsp)%m2x7wpQqyC0JNQ!$*V(k&{~;>^$y3& zCsOG0(5}eyKF&+>nD$j6)xO*nJp%1Q3Ywwi&!By8)bVNV1ZlwE^KrX@DMXVWZ-6X= z?$E+_YF)r`-8vm;g%LcBlxtiCC;^C(XRY4?f%Wth00TdH!E*bO+=p|wLB=3umi?i`A=0i2%Hwg|>)Zw_i~NkW&C#y8zbc&EhAZ+OX)! z&}j1$_KaxMepC^S=0u}8pK)%svTqhfl^nz}C_>kkvH;^SJ+odpnh0fM|5)slyM2^Z z`8)VzdNN*#OtS?+1WrPcHqJq*v=!+J2o)U6`0=&ER1##+xVc412$#UX9yYo zWbPouu7TzI)CJT8s4a16LznrwBGhEl=eI2<{o-5tbJo!;Dq6s2EJ;e8#56Y3;Z{Wn z16?9ArbQh+Mp~12(m-R$-*Gs~syQ#;ui1hzctyTajmV1Rfu;Ec>yAnXjRqrY!bq=r zV#Cgi6DiB<77rPe7?q|lbr?$)J)_po2dSgZI@-dsZog*3Bm0pbwTc0>i?t!rSeDcs zY@nYcxc<)&se#PqCq&w^<6}#E&?ZV$TNW*qM5J_xYGMya0?{V67h>JL!Nr_|i~z7E z%5!#*`u>z^laxNNDZ?HIfHD0}CejE> zQtKsgpKD$@DQ#d#&<`W0PJs@1DJNjc9vUepU`p0JWn>Qg_H&Qvs3^^-C{?)Es%YMY zq-;b~*DSY>gNlP_3R))LU-q4RFVjO6k^*rS&1-+6=-r*7CIKU7L62LH2iijpfM7B> zodlO{$y3nA3uM)EJPt!}0DEk=BhEXYy{)E&Ox=R>Q37Ar|(Y?EY22|HkK~Py% zL;X7TO1~!C__e=gSXd1!jyS^rO^a@^0i_J=TLA3bP5n|^@z&|djqOpupJ4#osXn6I+IuGzCHi!q1WwB5yf53nJToBXJN)d&<7Vuy{B3d{Z+At^ z_YU2_^8&&G=rhp@bKYMUh;r|O*>1pZ%VW2H$ubZ3aS+rvztEOxkb%7R4TVkep*uWO zY^%+Qz!@(%d2V@?nUVe(mRYx9+7;s7jz_ScF9q0mB)`gkF2g6yu&%?qehi>n(BX6W z63~4{%Wgs6GLyzl4IQTOxInWiXuDfyGuX$sz-8DptefD#>$vYK#khid9>0g=W4zt; znQ?|kgiOAFc;)}Ohrj;ApRCMGJBnhUX#Wh|f-=UJkLNz`Ka$fRZ;Y9F>c(m7WMZFS z$BzzEr>q>h^E4#G7mV^{u7dR5_YlAwqv3ZZkle3DKR%cBsD)?KP+&!s9gc7+8#+q>&r4JgMBAO1LNxu4O=S?qW^wPSRO50Gg8Yf@p&LVkJ{X*#EmVV zqUwOXpA?M~owX5H6A3c87N{t5%dLXaf}ChP_BziA%PG=TNq{c3B^3qHV5^`P0o`3q zKTvZJ2;DP+dB^z`$#2?gx}u<=kT(MLK#rLj1H!w>cgpiOCH&(Sm@WzOLx^ zO4_&%ME5mmT}2k1r@XranqUKxZ6PP)~1dRDtZBw97HieMk#G<*Axw|Vwa}W2Q_W{(c=g7 zpFEtFHCaHzfm>BIqym}wG7SEP-YE_F3B99U))chPtCDL-scuQ>RGqRDSjvLjl(h&p zsAIb(dJ43$xQuqK*4wGz@8my2_>9G6Ic2h}GE+-ezagE&r7c#=x-&!fImuinvP*_I z3_?vxTeGQXOSb|8^)4eWSVqS(-jv1`Dcg^w3@=ks7Ac$Nrffgv9o|cN#9AXL1NAwh zsN5|i(mciuRCrK*p0dG2N>8|yMUK|p$IC!JH$dztsKLn+%hU-3xp5)PbUh)Z`bwP@JJll(mltfr;w6BMqEYj;bQ z;|}MlpsI~4i1Aro_WL4G?e;RuFQ|X9zqA}Q9HfHMmw8ine*yhgTV}?zg97(;k?6sC zryjj`s-9a^z`;ZoAiX=|v&y$uY*iq7}-w4dD8*nFKv}&|7dP2 z*qH7R+HG}1%=ocvmq#b37k;-W5FE5q79KJf?s&+cAFpPTHBPTi?^1!o57>S|L$Y-b z!OGB(=;XUdG=xWT8PU?Ts8L;a8=+pNVeYgf7Y&R$i2xq+rmZOOX;0etK|RW#GDk3Q zoImWpM&y6L_F2p8wBy-nS$4=-k`potXUIz=j9JHhXyT|w+%Q7VBEf-NNVu@|a&@fG z4&G;r+#mh=@tRNT%mxh^9L^qyN;39^?UMd_nhwvy<)c4*p=-lvZfD(dkVpaHf=sB3 zYLg%@Sr~>cvw?s1%QJ$bU*#{S{bZ61Y=( z`5p%v2Q(EP6rHd|m(lbUpYcCu^>rY%6<9~&9v0D`BDzuJ)S7V6u=T4+OllJMuCocu zz1ScY^sy^!O^k1%lZwzjC)oGkgOyT&L1&N}SIAa@O(MyD+hMPn zVkd|ay&wdJwnc2VMGvw#s7o431O^FY_3MhUK}lA>W&t0yC2xA4N|IR8XCe~^)3krG z0p7HxFs3Gyt^Gd87{_L`((_1wN)i(^d%nP8)QWz+8FeF!4cgcRma%~r50alRWPq^0m$p{=p=qsEX)1 zVeEcOcHd>)Im;Rut@;2gy>WNs_M`qJrGIbfB4tyOG#pg+g25@`jLqg;c2aXtuq#-} zeh@J}NnJn^l_d5%9%*Ha;ZjD2TmUnspt2aPrd}PHGU4R0N6J|`Ao$CBm5j-6tu~WjbSqu;0j?HP_Zn81 z!jjg9n?)zDh?rtPffmHsc)@NSWw6}4hd>dO`w6C+lJ#;rp8Br?>@0fYMgJxH3`4#a ztN?^@1$bp}@i5VN-N)~KI3g@d?$aPU1UlDZps|7+(P5Ejqo#DQXX7UEj zw;(#?SQMkd_ZQ7{HB?YBjo>i(&``RdKya>6A1FV&3COxZ_;T-h3j^Sfc3Tby5YSL{ z%X>X;8V+>BB*8;>A9f>3WPFo<@as51ME*)X z9#1)7!MPug`Krky^jVu8qr?#cL3^~v9Y2xhSRM)V`tz{K2hc{lANNyod7KwKATGyA zg*V3luugIuhV?!PYImlaIDD?eV8o*5Zu~#>lGJH2I!pz zJ$g58^76p?axyS?By_$nP*)w%+s@kU_JgGtWLjyH;$ydW(@TPHP0DmCAHNBlKWJ*; ziU(l*(gTAZmhHF#p*@QV z&@pRgICsdW>?VmUkU^LpYT?oC%QU_c@tL?zApF%&C8KIGS9)>wIRm zseKFduTrS;YFXc^tZeW|%EG<{{jVPqC~d5X%vsA=62_P8@sV>NkWWHgF1UrQ#mhK);N^^(%3qH0WH z;fBUEz-ws&V)}GHGWO35Mf`i_GH3xBm@*IS#p+Q64UJ>&z!D7<`#6;JBtrBtW&;n4 zB5Fn&6@OGQu3!#=b(b0ciiDYW=_najGz=#iCJ{=i+H)omGMb5`w5cmRz%c6&pKTD85Vz_ZB1h3YxgKy<#z=+0ov=8qpNm}D#xt?;Z)vSOT3GAQxT zEHDVA3eE=wYbiO<%m`0i#)8r;Miu%a_NJ?ISFFc?Bi2$zQIf_PM4&CDI?VE>Y|ELl zlH5xu>6@%F_gDkTKW}{9@`OlDZ@rQ-rPd>lh9O85C^%}VN@q8ZcOHZ;AuaPDHSO{& z;BezR&UFt#3aZknJZc$CwCv_#0Y||^Mqr$gF*o7K1)3_QY?_p^6v%TE4FyLflN8Yb zkHJL4-gHrCWa$P^^l)l<;iU!&o~dC?P|B_{o>O3!K~+T_0jG>yQ&!$0xj<1;;O}Ib zq(CX=!7%oBwC9!Z;dSZ{$N45vgEjIHp!JFV5A!ynXB{kYF5|WV8$q~&L%3NL+E85PKjhf^)Qm93fhd z?y4m&-k0y+im$x#X-mSYFb6cD!#&#F!&-Wu@GP9$!m zhm)j=d#z9%UdSVuzDsbVe3BP*^*AKCG70h=lR{6NW$%D}}T-F1a{nPZZ9tFmu z=?6+my9v%J5^BAY)9deW>Xr0g9%?%+Lv5l0|LO6m9rP|TC9j7U{7LQ~op)na{h3)) z%kiF&!%(BX;p;vvh~WgVZ=E(~>DTdox2}4FoauGrAhX6MQ1>5S5;rJy565c6RnY9O zqeZ%IP`xF`Tq1(d2Q3o4Pv}qbn5Mq_JS*HEUPERK{U&h^lt2=YjSv8>-O&_4Hi8sL zzmx8J`|6LU=lKA&{<=Wg4*^|{ZyCu)m?rtPJKT4G8>(%IIO$I1EIxHYR(a~e5!$r6a;RcElfYKbEpKFIk-dlL&C{6ew-Ft8FUu#VbAMkUJwqWwuq`;&%suynZAU*@$TipqX;FHK&X z$6!r|Ypr@EC}gd*+YeT>x{f}CDOF1)+oS|9h_z_I&E#1Bm$Au@SH0HEOt3qObw2SR zfE9t>IE5OeXslw=B##Da54XJ(plF{_iQw$kH zh~O!Px3P7g!%D$i1LaHa>;ppx%Qbkaf(7J>L4Ln8EP>Kf7E?o`=1*wpORp3Y)3abUAG4 zsvT<=-e%gBkLFmIDhOD#jI_FKAsZ=R&KR$qp4-l|`MgZy+>1^n6cg^`4UXN!d3u<*nff zk%m4lHGN!iAJixRUs6iA z=>GB^r1XQ~Ggfr#AxGuY(*vHG$(NRqPfhcflBpJ&Ahr~B)v>c-;DFwTEh}_eS{}A+ zacH%+Edw6Q;HM;+yw_pFhBI-HvO>3HVugaOmc6`NT7Fv^#YK2*x8Q@)lP_A1;pCgE zvTCZb*z~ZDMu~x0n7~k~VklKGUSi;6MI1gwGoC}5DWuF|r%d^I&ZSMh&8A+35yLHp_gtud|p}lyo^&A&R(_8l(vV8waVD^nivdRlsb4Km(qAkPS zNGDl``)mJ1k?cD3NDiPZ1DPaLY-kU^bxHokqb!fGMpU9iHQ0{K&w}=Y3&JjqE#U^a z?=Q6)gz=5Vgh=`oU0aTE{$f{p;MxC%-PJVUV+=gWD0KS*{?eB4AHBU>YP> zba5Xh2`)Z{^?{!7H`R|p*JjBf_ykGJb=6Bh21&U`t@PK%e+ zza2B~g2c#ie2zy`lp&LKf!#T70vYs23Fs4iRv5}-aMDwGUWeO+YzWMV9tVie;7l)p z@uVYUEE9pRID`%fr13JKEhc6j%sx-uW4a>ca_aW!@m#A`M)Phhl!oV7qUTqa49Hd@ zxiui2)5}EfCD7hS~+#UNGI*yuD#mjjpWR4+hO^HGVF$jDZ?aSOU#4vJH+no zFBN;8;o524+cl>rK{exIo*6IfL5^72=DPr=ZGfTrw1fBeS{1Qj}4Cc+`kFOSF-4$g47G zEBj7r6s5GG%9C7zpRz5q2F1SFEIu}5V%K;pMsY7pLie0KX?&1*`FKrp&9|JaWJF3& z%~(fX$39F^U{=v(vt(s?P2;43z2-{~UsZd?vSd2X1^O-rf_XRKWQxkNR~{TTOm#62 z5ZLoDP(B`*5bzMUpvw|lceb%z)H?fUVbf>S_X){*9q_k41IEXDbSrcQOHa!tU>4l5gDi^bvDZRgG z&Ww;*+2!oI)NoMJQz@3Y)SjWTN_9W;!Qn)pfIE?p%7nmX z+<_+F7CG88m3{VKO9k^vImK=b!^4tdH}+bJc_j-Nb7rIbOlA(8P3+c2)m!~j2q`GmBge+GP4CK_ zk`_#SrjCA}j4q=olO?O1Sjb{!PUazNs-GoLCRfvoDGo|nFx3n*OL{S}g}puFJPB9t zlnjiC>l%9Gw@hfgOMOxXrv>G9u{NLG?W684CcSF525o7UZ?5_N=d`v>sXg#P#ptqR zP)TiG^wHPs7wb%@A5H0_oU&XjWoctd>yeZ`5h;5`q`YTR>Xtn`Y*_`w;-8xK`Kr6) zpO*~BN}s+ddqsFX4~_6O*F_;8b;~IY$Wj`RrCj_|-aIb1W7&R7yQY@4`5Fu|H0FKf z!5}4h7AM;6WJ){>7(G;{N0~>3HG{#NlDvvhA)7^6=+|amo8K@_tQhh6*~ob6G9G-! zWFF-SK1d}d{MwHF^OU?kdIZSN)6|u3}S|IH)1Vews90}qkbZJV| zc3!)$qIlZ6uA_z3;eilP&I5#0GEjfeYYZLXQ6=HXfHHm*#j9D>{V{(FqBkNiaT2@Q~P0<%ENUgj&82%Ti>M?wx(3v|qrw#B2)+ zLiT-3`iNg!*|!0jYa#h%O`8g-+xU*Z<6>>obO*mNFtB&;^=qa`0yqQD0# zR?zAdXu8WZ92{Pjzq>6T3mymvM?Lp9?XWP73<&e&R|JHxFue)*my3Yt@7s!Oe*MkA z|MJ&A{_dY(5pWr&9s)zWtNsoQR>#Rojo^gfKC==k%9+1_nV6urL!6{B#Id`p8NhQK zJ`opwP6J$0KOSHZP+uf(4<%*t(an!;m6#K5u-dfikAM2-fB)q_|M}lcD5x&9%l;|v zG08wDMV4GJh0q&KX6SZ7$cms2VSGr=5Ban10qJ1pw%CQ z|8dP=(^#>PPLLjV5=#3aBlH5QlJbT0syzzvTW{FuK8|R~-nJUS0$4 zw0I=PY3OEagDbzjy-+oTpU5S{aQKuUPU3zUJyrhb$;jLW!xkVy#LR_1f%8Q&K($@w z(WM|1i7a7e`)Nf+^2w9mt|J^GP)WiCLjkWVNTY9sI4X?+{w53Or=1S%fUgmil zA0XzlZ(8i;9Axy`r5Ty&9E+bKMGN&j!`L#IAZiHoiSj70r4K?$p<=^CXU;*i*p1G* z7438BgJ8MKmNB0v!HjrjTV7Kdx?cdb`Q9v{qLD$&Ii?=-Sv=>(Km^8tnwdbmMmIaC zXgF50q^V$A-ioQl+7pYGPqbY+(52Cx$4d5EDCj&Edo9FDrh=7Br4M3lljR{x27d*A zlx3DS^e+k(saR}iSQcxe8g}Zf>3?9dME_;M&DxkIkU9=T((YWw#=32c5Lp`)rHj#r zw`JF}XisJZQ0-4KqbU|Ws%37)W5&VDKMhGQ~ouYKH z@N8pElU(~{$`jkBF12Y{$)X?vSubQN*~g(`MN{b}32nteZ1GTfjZ@3c4whW>bR0|7 z-5rfB9%3fa1|>6*1^?WLiHyd38asvpabXegpinVqE|M)C>YAO>Vy_22WAUXY@Fc9n zgR$hd=NYxLLvH`@L)`VDwA5o>$QL`S#R{sD?hQ3{j8Uu@-O)0N71;qo<%>M&^rp_T z7}8~o+xQ`wf%ic)cu@bqxC$$yt=< z5n)3_-_Xjy0=SF=R#~+%q-z+r(QYk@9^2@tmePv1V#2VY6>r4>%^ytbXzOIknp#da!n>=^ru2y9s- zKw2ft(wJj=(2rsBLMx5Z#&RX$1(5q=e@2Yht@=DhMVzU*| z-0RRCUI^m$U9*1(;UuC&=+>{}`7wMa>!rJI5*SIOCfF0${I5g5U6GEF5XsQJ`S6W64$!q` z22~Y3SGOuEBgv`?yKGaeEBNWzLqb1685pS2>Jl zXJHvKVUxTS9?2vqeHsoUa(ZXY08NJ{l1-=NDxiE`BnE+$(_GiC`a*K}7~oq1HF!gy z>j<16Zt&p1Kr4SfBob6l5N)rFW*nBJ8}=+V6R`ohm`KPZ@mtvC^*vFye!&xB7-uc` znkHCgNYvIFDZqBhUv3Kbxh2SIDcvCv+I+a5UZxAx60l)LjQLDpcc;e!(qo$*dm^EX zHN+n7IeF(;AWtR0&B z;UU4(MQZ9Br1(R!*Ccpey&P z(#@kx5jIY4eFDEIBQ;Z?R@w7u^cw-)oeeKJMxHb zfr;GNtC{m5CpaTj4|BO*|DmVzxT7Qub(iBVM-BBT#M+|-VJCQk4@=S^%0{%0bg4E+ zkpU{oMir0VFLKAY6GWpqzp~0hQX=)27kMZIuN1X?C%K8GB|d7>?`gb_aEkCRP5Y_v z-12`Kgn3RSr$3l?jE>DrN)B?ZA5&39V7-F(FsV4msWy$h@KXBJF+Qtfd{#0ntC*Z) z2CiYl6U)hYkU=aEhy`q5zib<$=j3Q%7Zs^ie&*RD=0*Y=MVXS+p79WcHo$=*Jaev# zou|!}&O=GEx`CxVUTjt|$wvXH#d#j{5EXk%*THw2mlv5(<9y!cnD1Zn;NpZ8XJWz@`#UnYHqefrM=m zyfu`O(!{!DOKZ#adFoVl-2ZltsFj79?)2@8+O7>Y&dXPq$vSF^~hWszA< zp9>DGw#?(LmN^wBt3AzDxzN*kpm<`5wmvCu2oKjvR+~}i8GZQb=$D;S=*bp-7Sd%u zCEnDKkEy1b0>s)^AeVJ=U{z~@v7P^U#RMML>Xe-*JrzfHjJHygHW`+jGrfz)ZS1a6 zmyFw@O-93Tt)x2!qcj`%@lY_G(yk??C27jafRubiO1jRobUDrTT1qxq&}PAzzhKUb z!ZON~tGK7)qEfSDzAZ4`V!kbQPO;3HJ8@)c(H9#C796n2HQrQCz5Yuu>p*5CurN?u zE7%RdC`6OIVbzq{xQ)AtGS4WI(OxXKVY0yq*ilDX-}Z4?Kl=5QJWrSBemzZzhFM;; zrV-u(MC!iT8$2}57r1%BGkd!XJu-0@?R>2*^rjI`+5)&x+=O6HkvOt!9nv71Ksz+( zu>LOnrbp4EqA@i0#d z#bok!k#vDYGLWyjiMLB8^c#DiU@xO8Stn zlexF6+H>x;H~aOm!DVnvt`e*ayS(dlTs;}5MV8a>l2}n9dblQDC8)h1u>E+<7UO() zX<(LoOhbQq!I}j%cpGji4HjiiY-$mBz{QhraMHR;^azLH#5YER8o<*WB!Sbmmcwbx z2u~5@{O)MxDZ$8&8oA^j-nqZ=hSa14kscbImkDlynGAZ%Ety$}{n!7`0mX-^nLQ!4 zT+zRA$Do_~(Rx+N!JMo^rRD%fxM*nib9mYhXbZHW>-}A2q3e!EBGY0%Jl3;k1w)XS zQm$`5d?w%za6Ms5K3Z%!ZbzgYWw0Q;-OxLzx2BiK?&BgHA94=~C_wKZ>+X46T+vPxHt1R(lZ;KYBOGNdF}V2@`Jv(uLz0sktj$Np{b;9y+91Tlt|niKtV_)az74NP2#( zQ=)_h+NGM#6fFv5p_2G|L8tav%?F_&l|MhijKsvGTk@Muzp@0C9$M`ILb{Z%B$pLj zPT$6Gv1Yi~uu72$KI=$ifH`NT#cc=+%0+9|Ei$iXno#%VZta`u&RD=$GLo$5R#H>u zS$d|=eA1(+GjQOqL%b5`@(`GEu^vTM(pWOKEI5d%!|dllMW1x~8n&^kW=U(4f@O~t zs~sCwGRA0=1C3f4-BpaMD;kin`ouj>3NLB2u(M!9TJRZvWlHiq{tVQXHcS+j)QwiI z8*Ldj#?)cWu9{|O;x;M;U08BzRC5N{IWJSrm@cQTHh1FM-4Hpb12v&^Br&H$PwNHG z6kCjGX}$WVK`cG2*>JsP=S>^<$z;aaD-KI${7QzOG(l`*4zQ$vv|%zZ4r&e zs#96oFd%K|muT|QmQkm_Aj^1tP%xL6Gcv8HHI2RDTPjOwjMB!U#+uzZW30+Ho$tuB z;vhZ~ILPR`n7a)1UGEqLr8H1%8xEL&tYgsHFd!|MW#qteimm^MI$IlLEOV@U(D0d< zWmIcMW;AK*<6&%N=|)&WGH7L`qxmkn$e2wAe2~$bk%8^I(y`&dx-)5C6%Az9+tYe7 zsb@lrbAR)bVSL&)byX@%^e3}-iqc;v!$Xslcu*2sGFMr15H07~h}1%6XHDpB>Ygi_ zy;L6z_OG`ZN{uyK66*ug54a$E2b zhOx3MNV#LBR12hRub0+M4l;&9*4SjK^p>PC4{8HXF0yM!%H1d>3F_%j>Q~!nDap1| z7Bn-X$=IEDorlO3og^z}H0fDiv&*QaEm@Yx7J5FYS>9MNdM+3})9R(BAAK~CH2Zi@ zf6`Ydx4!ad5fd|6_gJmAk?Fzk~tb^0%aFBpPTVFj#0k_agKF7nV+B@Vs56|I< zD#_)B252I2^AC00HuoZlDwmI2DX7R$n-9#RIko1j%_W%q54f%)gMs4va9!Lp`% zN&Ez-nr^tl2}c6+`KYyS8knOBYURAr;F<1wSq~DWN-!|Ys8@tJ$}zvE692n;?}vP09Yr{QLp7@T_aEeJ-hD;f|Mu5O)xlE>B%$FQkCz8B zyZFn8yi#`@PpF_=j(hh+g3?=YHJ;ghY%#^#nT8j}h{*QB^nS|{nJX9M*pl0$dr4G0 z8bM%nni9~UPXZLXi2Km6%SvZua9AEIT5+vM?+I{&&nOsx-umaF&ToO5Rt^Zq`;eG^ zJSyFSMZCQ5dWbxrP5p<)sq$UnjZ#-`zF2o}TBAF9`~-ayMDmE(~O=lSqDe z;gNg{+henKv?%42yYIG0O#l6jM>0NM`#OC7(BK|@VF%QTj&m<3Ou{n+`s+5{60k`F zrqv%V`ju%ge}G=$f(E&u!X#*2Uw3$b;>-=J9L{;d-TXi%_#pStcD9ziFgrS<2beM> zr^jrk#R5-M9GmH<_5+aFfQhf>KVY4r`48HOttwMSJ2AAlgB#E~Y;x(~f-^&6zyKbd z0#2vHfHqoQ5Wpbly5$lI4!Oqx%G!1S~6hifKP!oa!F^ zDfB;@H%4)6^84TXKK%24{Q04pU~NZm-1`$cAADSIRu+oSk^FA$es}%b@b4o!m%)<= zJiscaVHz!|e1;f!v2Sf!HX^|Pot*S-(2fJcunouxV`xO*Q9i+nc68QzK+XbMsy(Jo z^}!%~G&zmXA7!X>C#w+#{hAf?gLJ|fis4<`gUI#S=i!C6#AAO}rLP>n%B$semKm%G z?8D(@ebCIT#35|-iD!NI!>C)X~ z`A>dhWvI{)cdBSfI=S`x{&Yf%H2qElb2oJ@;Hz%_oNwiCPVhOhucXArX8)36Jv~cw zxGq#0mm_JN-}{f}oO&>R!Nbdj(K{owz-mAz z8gh1B(?L_`|HpX-%W8XwO#_U;a4aw!^8tTkG=;MPbiWUb)B;^+oQtUGp;WO$TgpBR zB@^CAW`{BZ$Z=EEnuCJOLv&ZAscOse);h4Iazll4lsY$5I8*AZuR~^r`IW%*qGiC% zi^<6!V#Yws80b|KXm=S{4i)Gn7-(AKS@I~5&fSvLq|P-5{sD8ZItoOHKA>Zh(jACv zvW!d!{h7>!$uASVW!#&!ArsPaP%-~rusXJ;KU45QoiYC&jhg7sWR!@1Qp)mu5RICm zP&y}DVl5-IZBt3Lr&U=*PJz~@6 z##8ggdwB5P@Xs3(7pxBSWPQnGJ*}JG$@+?&=K@KR(u-}8My;8!wgIbdTjuEBW=@d_ ziGAjB5+E&kkBW3hL%}t3^u}^{Dx9qlGxj^ocz5cEbiz8wK?N1@!@Oz}9=(G=pl5KvhGa)mGrS%-T@M8l7aytOOcLMf)ggh*3}| z;B1hwAekFVMa4kN&KR-ww~pQYDtb+^yPx^fx(X%rrP8(EvBP#j5`|tTe8DO?B!Qe1fEj_Ua^Tc2c`yh6$nLQDepX2gSRd(uz{Zz z8nLA;he%ltk#ZkQSv&6qzI1ysoq?Yp(tAdRR27Y&N)8IQ(lsptCbk(tLFs@KMqk}J z`Ol$SwWIeJzqH)9*AiY$nF`4Lyo?*-Clw)p8Hg59$rB3G^8@|-zOjq8GMHc8iooN# zYs>DemIK=*X1}ZAU^QD^kRMOA2G!o(`l=j(>*yqs&D4z7ex!a;nyBP3K?ZzSwQa}i z2C41K=ni#*(gC;)nA9kL@EDI{k4_+u0}^}qv)#OFqgbI+DnvVqZ|f+L#Cf&^pR zynN!3Y-pKb?oud41b<=T1U%*K1<@j0J`6%G`OkUPD&ym-W;Lub2Fr0-v^mJu-EOL+ zmgq%WCZeJkS>TYYXg7Cwot)#SS{X=ehQ83WsnRau%a^Qz5Hi3j*$a*3`u}))0lTCD zG6!!{vM2YiuY5S|_vHRiMr(`3$DL6hx9%95jmu!U;Gu=d;KP&qxbKL)wC6Y;GLXo; z%asE;4aa>!dqd-7NPR#v@590<4}A1{cO9W>7!x@M%c8ROP05JCO@@mi!6Y(?0h-)x z!`4~3^C(wg8Rsh=$#NMN^ixch(+MK_Dfu&0;RiXubj>1Xv@c%=)v$oU>CO)h ztW)9ut)~_=s|X)H#%CCd-eC9j(zYsUay2})UU}7DM6<-ti@s(zKV}&GPWwgs2HuiC zEoaD^FRqo}7i)5^ssHJ4dMP7<=I8sP2cfdAMvZteb8;Q=LFB%IygLf73FIec>L$2gYo;e;LJc3r9D2+W>TjnT5{g{B{{vO%l<>& z;_qLl<9s^GA%dFems_oa0_rKp+8MeyZmPvUVFF-*I9>Pkh!@dLi>LF)db%FY$HOr> z$vKy+oy%b8)y9f_9?L`y{D@Yf$uAIe4I?bL9xjYQIr`@)lg4-)baj-Oq&{^0>1qFx zeweMJV&C1rA4OTZH)uFrsYqg!Vc_H>VZIdqpfHi?nJx_rXzuUqvvrbKS1 zwd*hL`lYo5v*|QQzyxa*37V%n!t8urk}7^BW!dE58WQXLY<=eo^#LoX^)JY&q;W~>&N8FzgMnUgkBC>4bw6$z7y zh2-Q(+KPk;Ys8iMpwc7o>d<7#2N}((1Dn~uGFMZ%!{lhm%`!*@&WW!%9v_)4M|O}>&TNd zq(>U+Lvper1ud?lETnawL>UiC0odFrqXNn+)HyIR#Djh&s55G~z2#=~!%kVtP_k0J zqCO;gkrkvjpyH5Ahkl06Vbm-~rwGJ^BFKp3jJheOE@I(A z%_f{|%h?1fK0rqlrDm4h%gmJ=CjR@0%lN5zhMWl8?gbloQnz7zh1ZD$sx3%MI?E9o zc$O@6$TWq{}Ny;PYMoO>4Xy~)8mGFM2r4)M^8}e>onp0##>+CwvI=kY4 zjfL!WGXA-fAiS$nW*59xqoNQcb|ETRV;`$GYS!4d97Mt;dU4k*wr^N$U(jrghTG<- zR&(I>C9JsfLCV68SchM+{GNmh48W$`KKq){7vw{~V7HtaN75b~vBTr{sxt zjL6$QW)&QuCIobjN>7&UG9Ee@06bQ_DE!*`esFg-wK9)P0yhJYQ-A5Sd*t5KDR zUJbbvXcpQf)9cZLE=i`xj831OR*pc$B!dMakgEO}tpdu?0U4>&>|+^FxAMK*_fCEro+Pjt(Y9I7hYeKPB_HInE;6Cvt)S-{9(E{GLTSr{ znPR0a<2q$l+cGX2n(wM}NAerBp!~Q_Nq1k4-SoO|(566XHZO2bAJ1~*B;E1f=6uh- zQ1>FM{rQq~2l>e;ui3On?Gl*RIpRJIE$cQ|K<0yt zG81+Xw!iY6c}sGlX#%u5q()eIV`NGC^PqNhNlU$n72GtWPw4$e{-dE}qhKp4z^D9?f54jd6*Z+Bb>w6GQo7$m6pXOTa2vY}7j$=sHV?7MFufdFnzEZ-#3>E- z8}NbtRf-2CAS6qaBk_AD;|=0vF|^}TlB2BgfD2z$x1pq|gI2mwhr@C+A4D+-TM55a zAr%J&2Z1_~NVcSOiI0MjlIHL=og`u>Vm=d@nKn{1;6Myo%3#QUf$Ult7j5y%HpT8Q z0UG8#`pIzq%Vj17t^Je%vA$$K=pzvu5z`vpq#rdYkb*yQ%?*n$GmX9QA7?P$1`-tq zbayxPM$3V72rN$XLCHZu1BrqL5(U|bmV=z^M5HMy4veNyU!s%+ncgytz7b~F?h*uw zAyeKW&R~=r#CBkT#(z1<4N5(n+^_(a+AQNMS`ruP2|+S}jXYA4k4{st+i^?c!bl0P z#Gy}SN|9E|doC^AywnC}{O%uz-RGUk$S4pAWH1VsgP6$#MI^LJB)OlmVV@Hhl#JNG z4})}nN+DLtF5oT@i3~GR8pSm>W8RS&P@_xJ)XD1fhmk-~Z3lM=^Y=?;UB*yNzAY=v zrQumI%TeQXyxmx`O~atdmTjC*i@IV+ba{TrheRy^+&#cvprLT)>;>o!^&TAWu%5qk zrX1*I7|ZUU({Mc zVpFtgyIVJE`AFRZT*)eD5zokxjgOnW=FpFj1sGL=RI(E!HZYe$8Nx+Ro5%g7D@*Vv ziCj9w-5F#dTImEe$e{DvTc*KcL;H&z;e!9EMNrAyNgRjP%rH=#&{}Jj_t3~+2FGq~ z8v1e6kx%*G2~-x>ao^1if1c&wF}%VwPYDz_lP9;~Ydpep{WhGD!TwVBdwGoNxq;6j z=U;mn-~@qTbD9P1o^OK=bpG6`<3GNt_K}y#v^}&)43#=t-^sa#L}q=!y<VX`smMZI>LbwPlIegW0U$N2bwhe+~)Vx7~tX=635AAzgL zRRUvmXvED6UPdO-fHrDq?YC(gwE==4Of)5Ha9%DCIaOGCE|1$`nfhG@=ivyJ4!s0% zOvzdG7tNU5%zOw;K%cu(}?#^Y3n$wV-gO1rM+@o7Vo3 zoiTL@0`5(R1~AmKAJ!$Xb(A|qPMM7^oer$h$EtrM&OR+)aGivnWaDgm=niOaA_(Us>|^rYu35x9KQ%MU@O++KX;VhV7=7AYC%tZXF)U&<~T` z>{}v>#x!7R_22fbw2U_p2Q4GpO20geS=HtM(AWL`pa1liKm75}f0Jj<2f6Q2MD#Td zsMbMU*m$2{KY1RtP^mvp0-CEd!4*8Bja!edaqE7$bq{l&)aoNyEcAr;*%)qlS6Jnc z7Wu5pap|%8DrcjXB5Q|E4qfuQ<*}k*C-KTms8=97LJ=IQi*R@#c8=g`QD)R@Ezi*4zC5xcakYx6Ng16uie<{1NA( z;zaBn=$ojE^UIRlEX$oFFMIiB2S|VJ{qlJXz()%mL}toQ6Hj$p%F8 z;X~$VQW9=T)`vE4l#Or`GShv_)XNFB%mY$z^bseWB;;XxF^N^Bf@-F(mYk*YY*e7c zs!2tZE@lhT>r4^3ILz;}S9x8B^Y)k`3kMlZKT}qxa#p7pKVNNS zsx1>DqxOlZ^9H=`#ryJ@b`>$Zlb#Y$u#}Zi4HdJdRWc%QD`mwDhuA>s|$&Pt9>A;UmsO$)gQK(KkA)f^4CT zc@`P7409IAD%Qp-TA=162_^KGp#`dmp-TSAi)|U}F&WEU6g0XQYC>vJ#%fva)iO1a z;ciMv*y4@01~|&{=AQB^bPX<8k`si`%tWl%cPJR)_PA)fjbyXs4(24;Y)Yfll}1}-s@T95Ntm!! z6_J0lgFGSsrXnZ_wm-%0xdb+)A#ipDLm};ZKX!$9z`Vno5LTYfW{G@;4ZenC|NT+l!KW%{e zBnu$)qlL%3`MBhCb}>$juTSKZz>t$d1Eze6`5ZqsBJUKu%JjCu6c;J?Sc2zW=Fgdo z^3TzJgQv-#!r*WJfgj9OnFy$BAxaLk8L(zB!+oHsEq8!{CWsrAMs5}{rM^GU>v=f8 z?3Uo)z1(JAyNTf%MQ}e{t_?Iiau*JDi98(%Ww7p0gVtL;S=s9_oKFEl_|(o-4IRxW zrqh|bDWt$JF)5Y&Pkn`1%ynmM9Mx9I0janDxbykk9S-&I1Y>8MGFV8##T5&ZI*@KB zf2z;d`UGVZ9A`k+SM}7rn~|#F&aRrzVRw`O?PYwegHNB|zyI+5<0mtYIl^y7)>rf4 zW>f>g%by3ixkkLkeC^D7VwSsL<*I1-qN=qn-3>;a!Q5Sq)<1VGm;;g0d=4`#a1^4Nq}^16Dp=m!9e0J(t^HtV0} zFDq(BAjoJ@=4Nc8G#LNs|H%LN>l#2RH!YooM`97sF0b?c6by(}F^Sdnd8n^l|5S;U z-UwgEYr3Xa6vD1uC6~quC9y}nURp1cb*q4j-D5k;=&ZG|-BZ@~x^I-UHG65Shtx_o zK;NoU?SAa9h$rdm>xyT~*{ih~4+j|(fF7Y>H`a>*m@k{DO>Cw%JLvZMcGosIMSEq8 z87T=HB8e5K)aJi0i#ph#;&7H1UAjky1r;=SmPDIP?FlusUc(E6^EkJ#aMf@V>;jOR z=5Aky!CCISFWo%Dxb_Ru3xj`|gKeZ%wh#g-&?;c}TANKT3T`(DAiFQGuM14m%miol zXp|G^PnWKL4a+3x_N_^8POq97wtb z*f&Q?cdDn|GdM1%Wj~zGP+A@5mq~fVsGlw4anu-0-RLq3tPf33Iqdh%`6Q3*dO11v zbMS*{xWItIFanocGuVlP!}BnmQJ)5-3MNp&VH%G|M7x3kr2~nKh(`z~mE1HhQ4}0b z!*bUP!$F3x4(`6eL5>-hYT>Yi?X?UgjkYSxC`ZoLc7`;w+Xre}j1!{m53(auqFO66zKs3!{EjmRZYqn@Ld`yl!1K==z9S$}MMIkeuj zds8T?Ll4ALpg&!;B&YNzm7q1s0KC>J28;u`YJX) z6zstEa4P$vkMxU*A=Iy@9n7ysd7pbZeRk%}qjj{I3NaJ%?GN1ni~93Gb*r^7Irm;r z`AV-fJa<=*3fisxQB8Ee`}o^$KY#eougK=q6HUWov=$E8*ij971=Q2^31i>=$!&Se z8hzItAIixSusm@M+Q~KHG{TmAr+(nJayvEe!3S#|Fs_M$aP-XqJj}JgSECiQAk^s% z%D?au7hv?odOi%Nql~r|*sBgd(fo*!In^?GB_4^0>f6C`=ro=@G0ayIJP%8AOWqB+jXN%-5E05*;lidQjBM_@%M)30WNm;H-sVt*CNzClLm_8*jZ)S}0 zW!XAj2qcT&C|~xcoPWyrDnG`^;*V*)>Xfg7bu#)0S>-JK256b>YoJfWSNXvfyPn94 zVI@Uy8z=}Oa=$k1Tg-}APOwSdG+tG;Q#2IHX($xYhq)j>Eb&5@RmCzs;+0q0bVcZh z%D;{+T$bb5T$ZyKi@Pju>bGi>!4(8CErkk#jr~=y!c~#|Rgv^nc&W>za?Zb^6xDr~ zQ&PNWDfCq;mwI8Vptq1JT1JRq18o?Km)FXQb++bf!EN~pxAa$|7qAYug}z4A;cX^Ei2+%t!wYFL zwCV7+5TcOYLKNgxrPIjpb)qE25}56nT8}xQEM$Bvm3S4IWmeDg(}><-4iZZ8Qj*TL z!d}F}9wTP0R_6x}^{xigt9dIBZtue{6tbLaR8Ynl6`M12!FnFccvVHlT0vo5PUE4C zpBA%d7rVmltJE$bhzLS@36=B`$_X})<%~=-QqDADmi5Jgo9bYA>fM%Wv`OSPrdjMvGxHmAiWj}VLWTi^4DoUh zv5dzU+JdIdR@jTYp2t;9{c;kL`01rSCLNhMkyqwOnl?I_)y{>JLFf6UKTa~k4xYQ| zd^s$*=X%zIwclY3y~v%Mf_=S2!CwNtle-o;Bw2?apjG3X;IEV1)S_wt-Cct_9TWzO zqAY0?T?;tEW@u6U9prbf&XsGlR)`SR8jeaMmS9=s&gfNcc|LoZ(ZTGYwN^Opo>+qA zdVU$?Dip{a{RJLKy}2lvb@Wy4xvo3Z2d8!zFCOV@G&+m&eQJd7tY%0k`^n9d7Xink z02BbjoFFqz-vrX!x_gY{0R_5s2l7*=$-cLJzwVS#cioNhmh)|SNoDpi%RRLw6UmKt zEBDI#U>+~Xj+)`Pbn0{-gh15?jB)1fIM>J!o=>iCnPo%c-Yxh96Q*(F*2$nYH*y2^ z{ynOQ`_s^BrBOhAyUoF;`p-eGNqHs{e30mFT3MOK8ElBg%6>}+abVr3pX_uwG`qvl zo({oumfPy{%Q6Yt4^{y@3N>;B zdZ$^&bvLM=jd?c7pf#d?heJ%An#Qi*44PUa-VJiT596ucU&0i;yIxI_6 zHAVYL4ibP=2L+T`r4Z8_^s?GyFE7Qp^d4&HpLA471eU)z3I7d3`b4|fcXv!!WG zefyNR{IQ;zJuHggpS(_T&vJYnp1a3E*8AuITL^5HGpd!nLLaGGBevA9`-ic4Rp+uJ z9Me>)ckHz0iYjEUD&OFET5h|3c@9Y2n!&6@(AK2qnCUNDR3C???hkSB{hx1t{-2+I z{q)nj_saFtA?Kj!d2%WFUe0wb7HUElIwvqULL3@mpik;kb?Ex;28A7fhG!i*jVmjH z!{OeXQ<)wdw*0Zfeuq@?L5r1gWoVJ+g%(2ud+>2yW&6B;xxvkQ3fk+lUF+e5VCi8+ z`@o8ha$sZZddjg48XpwJ>JDzC)kZ$!a$OoIE$?j)N422Yt4$fAzLudo9&7UlSEk#2 z=?*6(l@wX2@{rU#g%32A+$RxY2!(OAv`u4a6yJ?;0wx5IVCP#Gv>rn-UYU9cOQr;>jD^s9R!SloLOYQ9zC`nE_R06{l&E z#&uBUNxeJH$3SlJZA>qU;*Gj>dD3qW{fIW1z5G9%b%f+4Gwxr00-UoZ}0RG1-Bk9XzNy?^(a zc3dg#xae$NY%yyINr4GTfw@aWt1Y>Et6x^MIM0~3mXju!ux!b6?}F~<=H2B?#FDB; zGJ%{67?Syyc-b;9y=+<0^}N~wyElnw#%g6udSA#QWkgHzoKEBkLB!f*!rEj(WhmXV z@`{znlvPFwLMs|#Z8gP;EV^QgM@y;t3|Rs!X^6!-U$u!na~Av(f|y=eY8-B6s9p=C z{L@N+&hv}OB%`B;X*{hcnDEJomXBf@5_>Ih3-@MGu-aV46EfsB_pI%am}SC*AoMa} zRX9WLYjsddfakX9UjuXE32Bk_HF#~S1*QZsBf%LGZoE3Hc(|T438GK!%M;Nz(U&@Y z%t;$WZa1KMQn|@WSuG67hl|OFO9>bW{?&<`Hd>pXR<(&n$&jm9NVMm8xsQ>`5gm>r zO5+UVl?zK1ke0_2BqFECS#&u$a}~iR8r>wKISYv?%Z7!6Jflf@PV+4Stsm0kipuMV zCV3H?0Pez-Q(?+z@w_C#uJk%&#UwZTlXC%c68^FZWk`rU4MhM+R@g%{|H@dp%UoOR zgu2bQoR;R>Bl+fA9y#gGij@9^();eqrMj^a8BwcBbMlIjlmA?LIJ zqbZpEP|TVUu;i$uLT+t(1Vtp$N90Vo)mKHqtCk$q){D;O8@rIf>0h0@BGw)gk_zc; zZVBp6e57VQ+QJ<}noY?Bs%v{xBfZl}>R`f}W9igEtzA+!$x$Mt51)a2ON>itf1cCu zD`gZrm9!cQM_p*ivJ}PU2J(vG>^Zfyn?-uWvSvn_Vn($s!`V%m8ykVGAiwLwO5p)F|)-$SP3%aLAUd=RPb+>F!Nq}UW zh|6V5Rx@+@d?f@CtC+7B`m;I%bP4aAKxD{r>v%c2qPV}thwgcLom;a}qJ5-{iQf0g# zw>-ce8wTXr4ecS75g2sGX?}&C@BWa31`GGa%X+R~$6L3h(1X(m%_P{1)1~}fVx-a|a{OdU;5~fgt$^7FOT8bl2-xjR+56~Ft^~1hvNY~bsA&FD58u%%UT~Ny*Aq43PBp=&ZczdY6u^4( zFW`1_O>nO_eF6@~ULis$bGm5ip4K$4a65zW@UBsL?E}#;pg1o3ldOJyuQl{uDULdx zlkAv*<0zX#ZqrfhT;<*^0@)FAVp)~?=oHNwbV*b!S1*S_bvJ3S-eEW#+sk!;QuuP6 z+RH0yP2e=%jng>aa9^)^d-Wvy!$iZeN`&hpNJn41u9*d2R@ix?gvp~h&?tG!lh=Pk zv38rfW}U_h%8|E2y?3p!?C(jP=dIw_*IEh&zw3!6g=ijPaO@r&&DE-c?*r1KPj>8pFbO8BU zU9DDZdOQedEx8Xif0GG%i1}MiW25G75YbN0BKW24t+@G1{engXs+=#~ zHIjLymO|HQSDVOqf9m8(a?pYEbwx7$9T9?Z>|bV3u9QQ3=@yhkk8;lAkt5W{L(s3| zxvPiM3OBg@6N^tCyhi0x{gT8yMu?Ub&JJ-A5gOxzzpl_R3 zIhj;Pt;J8Ao|o}bBNj2>TLhPGXm)Ee2S1y0zEwKg<_T^lOvsy60643I44nTu>krtL z*LL2GLj&WBZf;xf@ow!1No+TOzb%^qpzoTS8PE;t@h;~k{_i-+MwP=*&a5!nWY0m@ zuXp{{-BFtjvM;-492W4DgVQ?U%o`wXMlV5S%ktzWsxYUqe_luU(vAHNbtwV6uEqEU zn=UODsQ{W~SXkD{u13P)1NjpgbvTU=_2SpM|8YL<>O|&JXjo__=Mho&h}gqWZhrlv zv0j7Yb&mwYOK_Bpt#tEar>vj}5Aje_PY;+ip`1PecZtGucX_|Ri4+oRw*$c0Wm zndQ}4kbLs4KFN7`ke5w3gAVny=pchcMvd`2pp$`A!}bL^o-(?%FZ&wR+W@uu=c0}T zt*NpR*VrDkJl58&+!16&fOp187hun(vIPXl&cL;;87=oAXykw8(s);)^^viSI(#=> zi<&L$^R!Z2Z#7$#Y)3HAf@XKVEW-e~^}TE47*_%IMFyaaB#MV1WnW%smbVi$A9hpr ze4=E#?&U~<0(;Ol6|UnlQ0xPEW+G<5^wci;@ zRX%NeVtRvWuM9aynOW|x54i>Jz*cRCQ`=op_HAIU5bU~(C7JBHBcf37*3f$oTG^Gk z)CuSKZujjA9mqb$nhtH!+yD?ysuuh)a4ki^!UNtcPs#y26k5nE{x z7+L)xVX~KjeB-mS9$an2)-41xrw1W{y~g|x1`+6vwg$*)^^J9A*(ijfv(qQ4N&RA09`cazG+Dl$uph$ZgK z4HA_QOM+#^5-yEHoiv+M`%Pel@#LGzwpOj>{FQ}vh%`SmW~>*_S!;4;EHgIqt!lm1 zu_*%2Nr*LLL#Ke!>mg!gDI$kGqFUA|vZ31{+H*4g$!n20OYXE1jmV|*s`Zv8L9T37 zvRGXaButYis1M&v6myoULndo(28k)jt|d#%C8@13LnJa*mU9PrMH56aTJwzNg^7cl z6=E|u^vz2Wn*qy*Fj5pQXL4D4-5d(P7Jv^Mj2uBjt)x}F+!G_T-b=DDD^C#}Mis+Dof2ttO-HnKv$Dh-`FL*&TowzM%7 zEDlR>fn8soyT05?!Y+xfDB~`vMW$14NYO~h;9F0`OkIP%iP674lCa#%3<#?qN2~;U zWs$bNA^k@~o`R_9T4|6z3?XGCA-#K@#Y%m-hB)X|i9wjv2BZA@;82ZqcZsX@y}16fBg-Sq8$|7DxAmdpW)2$naqzdM4Twms{H4Xg?M(zm(%E!QRw2A5EPIOi^y_IA& zGGjqds@&)9x@KH8Gedb*^Zv9VS_7-P$A;RUw0f+z2=iCFuSpXlrq1ZIaU2Uc^iT~$ z+75!?BDZ-0PHILtVUKI^7>9s|Y~V(?)g)7sT5HJ0LElsh${`BMow*9aUlI!|#y6$1 z8d;hMLih!QHvr2&QI@MRSe@<)w=>W=t)6^suJeAGgIjkSv7m^2!6#_8sa6qgCpB3+ zG1MbQeRrHO(7qg|D=SYjZNaxhdMtmVvi_4Auh$R@m9Q%{p32%9(f!x_2u>`O` z>~Oq}7yAu{@liifgpk|!agyC^tl3g-vket_b#m-`ZJ%6WqX)SX0cH3ZTx&G4o~So3GET_8mvixnJYi?$ZuH!| zB2PC#aa!IT?gI6+SFWdg!TQ*$mnm{dv~O^&FLGk6C|Dnd7NwGYy~oO9;|+@frF`~dH!B?z6lNGuczmm-w*p+%F#vo@JgJ>bGSIi(UbWLO*&MIC32p*c z*Z?jx6G#I&hX*VIuCZ*1F=T@FoUu7`G*68Z`c3TenaZ-OzW#Rrf zpT2*W4zXO1QM^_s;Zs*Xl3oSZJKh6K&7KH}*Y*&_1U z$8|tL2FBRqTFaob-h$)Q9S)G;JBYTpS*>x~RZPQKENAw7I`5a~S>EB$9U|NxT7d7% zZqfqwy=#%-QqPu)3hHp@)L}RnfK1%i`(;JEOY2u}0y*3=@II^JaJe!f@a1xnE0Ce^ zusMkaa#%gD7EJpcq!!oq#E&BG>dMfVN!`NeXUj*eQ4~=*>9>-qHwr1eh12(q7~G zB^UR%^@r|<^#cmsJ)C`pF4*0V%Sr8jP_veUekM@c&;cj0*@hlql`uYf?PKp`CV@r3 z*&?-+g)C#1fx2lle7AnWX~B8PF)SLo$@MC`j&IQ&<>NqPZqf5rhO&$lTG4Lp7j^6v zSwdSuJJ2pXp7WhmwXK@1<|@di*{R*BOjnHHEMTWDr!rReNKr!D>Sm9?#6c_H7}{ja zlebZKSodN$U-V)Mm)2pCshSKb7UfZmmrmU zBPHKGnKAdxxynwNcTsw3SCZTuM_ZF30ZBfajc31R-u(EjZO~u^o zBK!!aon1`xm6#4IPVL_K+q5w?t5e*ur}TTE@dK)E%5S>X0x%9Pryz2*VGx~Oc5?d> z&q3r@;~=W8%k5ZSBbYfIWuBOF5;PPb@IHRN9tA{4{02c(<3!yd7NoMn{h-QvML_Y5jFA}_~sY!H5(`* z2%Q0Le@d<7T98dkb7W6u4p}e{Stn->v)0mCyJkf%qA^Uw5H2gB8}Zxg(m4s!3Q)~f z-nadm_4JT#6k8}!LK6yB*sZYcYmm_#!Af_P12wa79%RIUz&YTX%_^(#)#fz8;(M_L zHzyAA(mh#?9-i>Yw2Gj$2Sw@*B7%_Y?!s&LM(WO3srP^=npZmUo3<2R>-(gFo0&z7 z1!a2p=zUFn{>FMjdEJgTPbRP7(+5`R++=9SJa`!w=Kd22K}4_E$ZaR=ISF6oVN(%C z?RX1>PB-p%t(E%NgP^^G6Or6c(rHBBO9!BL!$>Grp0{3#&0|6~ffK%2vUhrSWhYul zml9m-QL=P{S=vvSGli9O4dk2UY)lZ63to^5PK%1HqD6(W%)?0Q1SazeWzy^q?8wQaA2d&+1&&=W1;OiEak^>RwY{+bU_e$Z=j5v3U1!BUKVFp&Z*$! zgy+nDwz|JF0lF5K;lNV41qRww++G}&6?c>V=Lt+1Th^hLi$-`q=Ltcd}b*> zCl%ak`Wc^-68OGIw|Ca@up&7;V;b~kcuT7btIk)f*ZZf_(x0JD_ zpF2RIJoYYENG}?5xX9H4*U9`bk1;FvhhF8+jbv`$G;%3i$acHC<5moTF6nT=Qoa@L zbC&zv#F&&9r=9D|6Ayx7G?apno)=1JSGVVs#r+Mi+%J>8P+LQ?^8cs(1pmD1Pozc} z%Bgh6jQO;GFN^!ja=sK3 z>i^w0F=n*V5w&#bT0MqYT(T;kNMYRJ_}3^mw*5K%fHNI*V*P1l5G}i8r;ld zSLbc=T@2Lz$Xw+dTksR? z0Py-xC%CiX!<4~}>!)@f`u2!~tCwy@m2z(7X1=|nZ-P9m8crQ@TRn`L^xbONs6-$Z znh3e2dfz7bm^~XBvSAMDzdYB&4ZQ;;F>rl+HegZBq6#;1F(9q}X`*Cf8k8((l{g{=4P=%bM;LGdd zrQJ_=cl}tq@#djf_`h}SD#swn^8wmPE%rB>9ZHA29a=f4 z&{6^08cjO24OVwsGTP;&w(NNBD(29^+#Dx4~I1H}O#4JPM3UGqc>{ZSjt*-rIU6RPVB(MqT!0d%5NY}TT zmwfFSZNWsrFCC(f#>2usNrtY+9k#;O^%$({F(?c4Do2fndug-d1Yjl%768^o#>795 zXk!d!Gh}T0D>@@hH^W)=TJPm-h;wl5FWSHXebSwfZ$@nC$D!hoA8RwHl<6SJ6FAXe!ZPzNO!NItTl5U+qu5Til4_F1_lA`w9Y8p zo$J2V5+NECP-cLh-+5bNz+fjMR5x74bBmq=+JFNF8QPuCT4-6&C(X8CcTW0ON>afsl`?F{olWT`0eBSkD%J`*QL9I zY7b%5U~LQKLPIAqW0%Rb!Q5Qj@T3mfUOli8*4Xw38=>ViOY=A?134T=EY`}L6rgx40M8?)fV@*J-qt3fGzy9?8!-x05{<*W>ET&fK@3fb_h6S!FD0YLZ z-;OY-23LPF$1zpkX}H=bW93b4_tDRoZsv`my$-qQ+RLh`pyTatzx@8^XW8U?TxMlo zqMdQk>mIziZtZYfyTO?I;1jsbigq!b#lIt{2vQiV$aqqgbXt*jXphUunr6XXzOG6) zWH_>o3he+SD#2SH2+$~Lx?`<|(r8$Z7Ou8Kli^vPPxr&HlYA)oRe|_6~=h z_A93L^g77kx*H#ARU|-r|FD}LmwkP`smpYOLlpqshuJzMI6lz|8QraA!37bmkoHxc z-Ju6E?dnA?89PWU!8O=vizg(1e=wk}qFp`6(0@SdV~}60fP9o2x?E~30y^ty!j$}G zjShH^%Y^sM^!WY5r}WQ21~|D$g1e8DyB%6~+V`02Rki@A{qQCa-V9J>J(bxnM_-FZ z$WgXn+Fk1a8X%jgn3y9=%br4{(LqBPLc=1c&3PJ3BN*!EU$TH%%b7|MpK% zYCwSuiNzsp4rvwzSyZNR2CM5$7f^r2LAw0}XKVb3p*hhLBa+|N)S;*5V>T) zx+PXl@ZJc!C3!(L!PXMV*b<4|=X$fiw*HB6(UZ-h_c6ajNV$$>F8^cx&lmPjG6ISS ziqze)O(5V*Z`N5&JFwYgf7K4eY@1L!kVovFY>gDU%j6ZiCG4NrpHe zn0CCLE0+^&#@PwmCIyYNRcPRS7?waBg!I%-2x13$=4o`*7E2d8uy@`>4Yqe&l|W!^ z6JN2MUpeRcrzsl5PNII zJhi<+L>-X#ST?{vnduIN59}R9{O-)%@`g-A=>dVM5>mI}@!`S^bu#v0B1#XcAbR6+ zDes~b)D}dP6eQkGvF3@_=$W8pAf$bc^-P>qUeX+xJ{A!JB_rlYdaIAdjknUNNqtz!0b8eqIesi;72e=K4Ol1#1qzK2RWN3o9rN@ zX?H@ioSbGkA!F%cHcxU25mFDTvv!J&v<~R3ljiKH(CSde&v}dOt(M4CE;d!r78BHHHgWaB-4F zeZjN5L_;L`h@%#!8=lU`?km|D4*X9j!A4Y0xrI2JIo5kAD8um6(?+eBdJF~t<_SR@gtuxe zyJB@=hI;LIZ$IR8#k(;DEp(52vcw%*hBM*KXvLY?xBRUq#cekfvYOpE192 z_w~uWZ60zQb2UflR^;YMp7O~lA4&K={45$EWnB4;tD3PnKypXOED(1ouLw4m^4P@} z+Js??Bc)g-r5J>xjf0RX3?>uWBRN4vkg~nw9zyi~3fbqa#fG!^Hm@0LHAJCK_$BaYmGJaQKwKheBDLr?OI{TYiW%%iVa zh1C{Xn6ev_Q(=))VUe)+vVl!ukvNc37&(P{UqHW~;Ca{&ulg^8xLtbIparX?yTD6} zIKP*67;)33N(`-jJ=By!-qb)CS<^+IbCSE;PW^wTMQ*I0RBM#%zRUtV@Jmw`_xeosQLs-XNTDsi$N8s)7@EoJ>pbY1W?zHtcmX z;bofO=srY>;iP_3hCVt)^}aNoUFoV`nJE*f2f-h$z zp8c-kpEe3^y)yU#;NF2YQTO_)2mJ3pef;?T!-wD0eCZWO&8?G7Gj&%1mwJC%VbOG4 z>aNGD+S52(x(;oo`6M?|!A%WS(6DMJEy#PnNxMc^q4g?n&@8uJYtFa&-m8H*dQmm1 ze*o@95Bro$xwWKZSiiBAf>!5q!Ahw=^15iybcXu=L_Ji145#(u2mq6?I=HIO$`Q6y-Q+2rW~}c9 zRpzWe4xrDYEjCW*7I=S*jj~Wd`@Gf{1L*S!sO9LI6sXD5b!<8rgP<#VMW6y~t@QMc zAVTV}sI8Uk%gxp*gss&y%G^6acdb(o>T3&onQmXpn(U8LdmJb2ugT!G8fYKX5RHdT zUNotSXlZBY3eamCz5CYn&%wHHutyRgmsHI-l}k$B;-YZXbk3%MuE_k%`nl<0)uIBU zZq~*UpwboqbiRS!+}DDpnqg_n0Ki`|9CbYG$LkIy@<0vc=L;|l#a9CLD0bWu8n44&4iliAA87-`Sh;VD8gc`f~Y3c9+q@u7NVLUge@JQ83 zE=5vnF8Kh6HiF})_m9K%?a%1!HOh!M!d%GvDMvKFG3Lqfi5_VL->oASHQ;h_(g15f zl)u=hRL?xMrsmM?o@e>LU9$|wGeQou#{#OJr9R6Rk@UuPylqbo_Mv57XK$ zdpUv7z*R!V!A!Ii)N*o-4?_?g9wxcupp-AOo1=Eh4t;yQVthaJGN@u3tK}B190HDV z{k{c<%dt46hvc5CM9Dr^B}y8JFtyO0APM2JoY#ABXcu`F^h`*1=q9*wEjXK==o#+S z`RToRaIHc60yQG?4<`Ia&cgTX0>X<6D~rZpyI)jL9K3J!Ckmi^RcUeqizICSWDmF4CJ!f?IKrgz=wd!35GsXV*X>3*~ zo-UZk36PV0l+&uQfZ1k5QxJ@#G7B311kK*k5`somM78$`Wk0>D-U*BPdkvN!TMrhD zBESyv1}*eG)~A-aAM~WEzeEi5er+1_+miWY2i5Z1=?N`y6zFImI|Kd2{RxxD{Zzl| z6hMVHI@<5$M3SQ&Zz)K2@I?WnNR4JXpz#aUR0r09T7|Wmvb!JUo62#aYN;Dq$@?Dd zv3(T0Jzr$jJDr0)+(R!i|5c!I6Q}O9)~7XidqS=OI)-w-&24=E*sYTsaxy0Ev6JO1 zYClot%MSq4Gwm^Oooe(PXLO&?YLxpHRcY184yjXss|F|UH9SalKYJC)YMw1*n6GlR zl>@HPYx5qN(h#KXR^Q?~`9cmFneJ)xQBA`_^c-g_+H=$5n!cZ!%%9Ze)El0AJCa-2AAJUW0MlX1#rlm{1{?4r04b2HsaROFNyk&*)+rk43;i zzwQpBwmOcruquP-tA+a-*0G+A>Sh_beIKiStHl6}E+$<6AbkeBj2HAekBHkqA5+FW z2uiWr^-e+1?rCmfci*~lt&mHy%x>xh!?A4B8ajBn+xte|g)XNOQoPBDhNIhB&QScZvO8?`YH}2bA6kfKrYnD66Q5 zizF+HI4I?(LT#ojlPro7c_c5gB*Y`~tUSrmpcw!C`G@Y8x2h_`3xXogr(^%+85B_j z{Z|p>h5ZJ3mfAl-R@yHDgHs5{VGzt>5oMZ`- zD2=da<5YKP!jRL1MaqP(PM*C%`?PAy1x}c>5qX<5FX^ndHAN#gR6}d!agHz5cn;#K zDylfmN@fOE%nZ)yy0(GX+oRSDb)zsURASmS#mp#h`?bV7rv?(fD&ZsElP%d#Ea^N( z-=>)EF(xm|**X1c$hHCg$@FR|pX|M`lHDll$b>FRtG0Y%+PD>)jT;k-txxK$#)4Wa zQqE)QTD++mQKlBt>aC(oEoA33W#=@aOf90HTS*YPv74E;8DTkQk<&rU2xLmxzNU*1 zXuFoJw4Cj1D|-^y`y^bAm>8)U<);+ z?hP$edn0e5e$~D45fit0dz8L3?gCe`yP6P0%r;@jNzN?f94%A?CzLS7i{ccEH)S)L z$C;g+o9j`l;x2MDkF&;Y#z#D+B;pZ3-^Q5Si0Mhr=g2~-AGVew9`g`Bv0uVg=nEer>Rw{)$^>wa7%8=d9$&TKl<>@i{-P(-sw z7rm9Pb<4M&Y(cPvBv%x)MQp`J)UjoZG)W2AlQoH3Zd)UFnuoi@RqWETU7NE@Yoa&b zP}Y;pa!9Eo<`8+{a!!d`>dH2YFe%w{b!}Zn*;U5IT;@U#YtWVv8?+U*ZZQFxrWrbi z8o2DjIK~(`pfFBbt!(C{lrE;U__I-F-dxP-O0^W zBxibxlg^sBW_;(Y0t#UwM!iNHJJ6}MZ;|lR6K?dxyC4qG?)>sd(ss&ni$+ONjKoBZ z?beClYbMIPp>Nx=)t4_DW=B^3=YP9b9%e`0h$YZu7Iwm8ztlubk#!K$2CpP249LRJ zm7J|v8sk~})(<^^7{b&D)R{Q-#%!KYc=yE{vljB~^2vzmxX6e0h{_xTdB!l7nA$vM zu-N-h?dQ6nh{_z7?UjsYiRrY54lSr)F`Boy-p4B2LkF~U@4c+>ESHd-UhDljT_WVU z9`e)--Mlj*b;Wa9w%+fS8l5=E>BVP(E1scJu{BBouqU__jE@c-=*!ulE7@VA64=#x zIs3XyXR)5GtJ)av6q42ABE3zU7qPEfvYi_-Yg%(wESM-HEyV?Rh3Bl8HqUcA3a3ki zKv@lqL!0~U#SToQSFwxhedd&gd8zXx+<32awO*c6 ztw&I7BE8H-dKJM}ZQj-d&bhhYOE{$x3(WQ`uhRe~S1K z-`(+@VSuD*9QWPnyuTa}T!YP`9c%PNuh$m7gX`%~tM6ck8rK{wkI^b9P$p`HZdr#K zOR!Aix>z^ais%9C->d|+jMqnv5J>?$6D2I_{-t5epT|o(d?(+0>25c9he2hAk9xYX z51j;`PorkZ1n>~FRA9Ji_2coW(KkI<-{wr%!=g|<{D$DubE@}PgZZ%;63)n-Xwh>< zJ1?S+kRS}T=d9&Q1c-R-sJ4-{u?ztmYNelU+Nh1t6|T*;@P-l)YA)XUm4}A$p{hs$ z<4r9Jud<_t`GRiny}op^NmM_ zjn$SAh0`50)u%X|=18u!$b!{%`eU#eD!ZiVX7rU8IiPcZVM%4k4G=fpA{OG0 zFZv^Ia67DhCO1WL0~N{m5eGLp+^*<~qSth-o2j)vwA$(cnSCN09nq5#u#97`k2EV1 zfC0MWGqNr;N}RWGon*B-GilU@?RdLA4aiYvaX@keX(9-^&=(Z0fB)C_A1>qcb8tKF zkL!7=7xa_mgNK^UpaOPiO@D#$jD{X3(i^)sQqIZt7O= zaeR!y`0~7ts12*TBYHk+G^X)gqc)Vs{U%_PJvPdE?m#gaWpvW*A|I$BQ0V;D8s?*Y z-b8Nc5g%mDnxTEI<)Bl^;^Pc&Q2}yXFP&_@0rAt;=T%oUWRyQ+Y8O$0l=BX;PZ!xu z!IhCRzd$mi-AfosdQTT?tose^U42h@!_-f;hU^9`!BxhzbqDW8!6l)D3ME^v_w_ltF(#H@Borf`0z#P4#ZrRTgu^1+Cm>9OUAU zM&K-4Gx+e+zu$lS{kPxTMRF$(X#sq<_8JJU6?qvy?Gh&-o-bVlU&*63Y?y%*^z~86 zCBcXCnCyOT-UpZUA_LxKRXrw}aI%Kp=B)(SZ*Y+V@QG{CrGBk1YCc&nZU59qCi6DD z$e2^l-7)yr3bWXC)=n^jGp!|Ty3F~s)-pPKLpXHj$vAePf12V%pj%K@l>%5k%0u1t zs-35^UVxMv<9*{25>Gjp#z>tiLGyqarFKx%l~UfaL(dnwPfc5s0|q^0$UcV^GD?U& z$L7&$`dskS;6?myKs3;ZcqXMYiG z7VW;Ry*z1K*>sgBT(D(`1n9jR-S?wPL`j`!D2)pAP%u?$*D4(MGde zV;|Oge&7O+Q4h)E=rqq*0&TXVbt*vH$pUuZ!;HakMZTLHs<=`pSqV8qtv%8o_F#g+ z`f`*3LV&z(KB~NQ)}vK`hI9$oO{-dGj`e~Ct>~$BA@A{Yxb>`q z@*D>!M@J9@yB;2zt&9LBGhLqO=8i{nRTp`K^ReFT>K)q4BNm!zCY$n90A$S1LVL_3 zV)Fo6nS^UdlujU&9Du1ovt3MW(LV$A472ibVi8JkyLma`S{Tc(?8m0S8&DToWukO3e=zfLcz- zDAd;S(^|`oOogsjbd-1I)p>m+Nx1J+;Cj~9u1rrF?NwvL$iJ+$47Ue%l+i{8rvrU+ z?H_|t2}4kDFd`s%YjmJnm}_gV_X*bzw0hNwWpFjDeoQ?LPt2bL>>lRniAymQwrCM! zMpeJEHM)XCv%Cnvi=Db4f+QB=8ZD8bI?duy({#s^Umum;tPq-Y*{c+1Zk0;oBQDap=^fmtvtYefsBz~0!=wdWfKXoe}W{l-ylIJCXQ$#T5THI z$n&?*%Z+FdN|VEcN<2^7D%@7o)UZ~v^5$?%4K16)U!}8^1N)N|6ccLd1cZrp4R^R# zSYiQb^XvW7-)s`c4$!iyTQmyA8@@_HShq66y8)x1vuGl0tcT*Q|=KRXJ*V|%hS`6f7 zVT#3ow}f5Snx!wxP0s(Awa=JNW!}n79OPRow{*W#>*;z+IOWPS&)%i8u>;k|QZmhi z`${sUw#X_2+7S!U#bV*Gd z6>aDW$%<5VC0y+++5MjN!1?lFBqjso|T37k+tpX4Oj0Y=iW!oO3Hl+Ow*gO zeH^oW?8gsfa-J)evTGcA*Vy#B-d_(n6tH;`lci!HPiVv%Q|?P(Z|DlTFSWIt(PY+Q zKoEJ-ZVTTvVt zBdYWwMlD5T#6)DoM9edE5VO~vQ-93ZGizvj$B-tB?&4Y!P@4SJ#g!nZB3b3aH2BQf z4Wzcug~)7iTSGf#_uD(obPll2c20Lz(-w#9MptY?yYM%ob!f(~lhFj#{8~35GWEv= zjayCl>%Cs<%V_U8;Ui9DNZIR6*?FWFbCk$OC)!Sy5jBZ3_LV~>t7*^J+ph^_$IMD{ z1#n0&R_!!L>^(=`kd^a2txWkVNGClyby8Ol?-IYhuy_28>K7_{;wX&1{!jS&YDsP1 zD1Wv4tn`6R0vvmvIkWaM<-HaA!+y-hl+zms>Eg;HHgj?1XX)OKT=`p30&GEUe(G>! z^FDL98N7b`a z{R!RUn7M7%EB0fYL!wKFH?Y~j()886UfG5A4H9nB-^j(ch)^$3|9`v>@cV7Cr3zZWSs~9lj4jg$6Wa)+U zNiij}WyPg@B>4v96fjpA+uF3H&9^+cklJQ;ytSL{^U{!JDBjlIOlTGO22XTUVbokz zvE!Yx(Y@Kymac8iWA?X0?{BMPt$tR_IJ$_LbLv>DzuML|huD~VC-%!!7^MXkfD{Yk z=yLCGm*tg`XlkQPB<&|NZv{iT8iXXqc<-A|wPESKZ&Os;+~fa}p8&SAFVHppV}`S8 zL2KnQlo$MP?kN&lhwbgDggYUNaJY@fU7d^s#l@b`=UM1jjmrU0=y z+D(E~P^-IWgCl)Mz_p#`zEuhJ34Kj=!BtCbLGT(U4$m!hu+=we`}u_GjDX8{h4Q*S zwa0Z@gGb!-e?5|W_Iq$&R#@fk_Q=KSS_rG|P-^$%1;EAAhtuxxe8Tw_Y8EJw*8BD2 zb8i1(Jl+(n=gYZ~<&Ic9l|;jicAa)3dNj-S6D-quy`dy0;M~D|4He5}#M8&;EZ`X| z-BCmL8f`gG?TqLi z<;%4PC>qhN){gJe?$N;OF7VM+ZKfIOsts>_X)VC+c|{ZHX@YB0S6{njypE=qeroa{ zV7H*JtkFWN2JC688lY_9AF8&vP?gNLb()}npKntOQi1?AvDJsVi zp+ZH_JGo0()ls+Y(dtCTj%*7^mQV6k=3DELea`}2Z>z!0`?XOa+$YwnQMk4)9uWXc zbBit3PkZF(2LaTrHp^Wln?fmV+B!%fA+4xqSnEbfS!v?mU5-z*pJl`Amw-YVs`Sk} zH~4tk?T4KlxzpkPau|^EcQ`JWtH%8`yS4A5;A6XM_j@_O(9cE#8F7Et-S~|)E{t;N zj$1iM{I9yEUmo?01uE%_ZC-S!=eF4&7VTBLcW(WV$EL$_e4c_oHvP19tX1|rKlkX^ zpev28&6Ry>6G?01Ks{H@copsFD+G_Xv0I;Vq&;Awi|++_b3f{Fdh7Obmp4YPWtLkz z10f!1CTnoludf~$ct_G#4FNOS1@PIOCUj=mc8<2z@?{Rj>+v$R*RGMhG&YU3oCf$= z$|gip`8dk@Lr%P$WN7k)KfmJ6i(1*Tzm>(M0mR<;P?D$Y|v33?*ZVV+dRKLgvRJrk}P3xtFfDlq* z86aeY5p=Rx!OpZq0PTLN54zK?RscsLlwq8HS3Ok{ybTP4W$5|kr+2^p^uv#z(crG3 zH5350jLMJoUOx}6^=o~C+2gf-v3~@uP!XdCJ)0=#Dtq~f8o@7bK7RP_w~xQ!kqeB* zF&wI0b+4jh(;5R{Ywb1Ga9_(VAK~@ep|z(C=hG@9nIat+O=}!QCMCw`D#%?vtnYl5 zH|S=Qxb-p==};y6@TRTJUWUV~EWroFq#{J72f(iF+k0mXTsI3&2+*xQLINwp_GO*M zxqj5aWqIzN>*>%3mq~W_9dWN08I|_0?L~mBD3}{^wB2g?J}Y#|I4I`YJJ%ID*ZYe) zw_arHj4B4apy)5xTL6%`Yk+6-fy z*LJj=2Lg_5SEPxYZ)Ya7d0!eaiT7H?bLV=-5flgiG5{6xu*z4D)s^_x%9?cddcYF= z1iNMIQ1q)ccF=&_^#Z6v2&Nk_0M=;5X_3L$`q6e3?yyHdvFk3E7E1tASBhF zj-#AQSCvbHLZj{Lp#e7mt?Bh}nB|eqegkt$mhs-?(qG(w_J^bXM8OaG|2V$&FS~IG zerN}|N@IoEPOVi1cr)%;d%ymNdZ(vh@cpXZF;VdS$KQVX^~0NgzyDQ*)JN?r!$?`q zZuGEi26%uRA5BC7m~9>@w$2C=&3?QbRka^Q90r&>sdQT=ecf$tEA+T)ECL1@g5n4U$`9?OTCZEP{0z!Hx`8+gnsK~h3Eo`} z{qDX)v-`51bxeSN`GjeZfQt^xjl2mQg4qAA2x0*`FwdSKDc3-4a)YL#K;||A4(77b zpsj8hmTleWy@EEt!ER}GPyhJZxuvkkxuVSr$+ZPh3XoU5KykfT=lChp-y3Arrl!^| z_rto}v=>r!w0{16Y@S%q!XB{%Z{>>GfUvdi^+N`Ln@30va`4I7z1K-$+k2P0?zPLU zMmm_ef$xEy_WhY;q1rU-^zN;J$gG*$IoX=q!`JRMdfIC4t9t2fIMs^@r*9yXBB~Oc z&nVL__N+$++%a0Yf}1NdTGYW?oR!w=zSgdt-q*M823__}8MA8FtUmfcGV|^6&}6JF z?RjJT+2Pok5lg8DQ5zZ9%OzgGem|mTJ#|+QI{=h$iOE37p|u_WTJ>}S zICN@9J+w`CLHwpnGjWLOm88+<^hl&dAg7GjD%x&k3|RG5^}2L2l17`jTbuOq&p4}~ z+oDx>NX%T&C|8=-R0rzXjk^Hr(yLW7jO0Opd;_NLg3L{9KAELzJHEf1Pp;^;w9dtD zG1!+6(7Kl$6hYz*VrUb{OzeRhO$fVJy`Y2AWZi!S(2);nO-0RjB=0;8*+TdU|hjqMI7je|65%6(InhcMj9 z|Kt&tAW5Q2K2_7KJR8vd zzJiRQr71y34LO1J_pNUeQ{?0krEL9I8wa3b$3LPPoW|Vw=EqHaxOM#f3lvli`M z+YB~Ub^*n}R75!-8NgoUomOh3+=hEol_#VJkQGpE38$N?e3OnR1eBMX;M^3H4hpKu zBL<|BRA5%!&TYskjn1iC&e9AEMc@gOQZs^$IgnBWUeS-64&8a;qymdWb>VtON<+q0 zJF^p=T|kHKyd+N`bbWYEo`5OFJ?51;XfbQiF*|r}!wsH*QEN#UhzXdcnuksyFk^1M z${In`nP&tc1?MF_yEl-NW)M0sQh_J-COlT@1#BQ^V5<=iQa%!Y3qVCsW86f6w!mWQ zL7j@AkNB#_Jc(i+KQUYOF^vym_u_PMd%+0Tk`b;Hw_{hTtwlt>fkn8+k^7AMK^t*3 zB60~L@BYN}@O4Rh;vlEJxCOr^e2$Mu5otUj-zW5rq_Y%q0#m!|#n80vIYsU{!(sD? zQoRys=|*Ob`wzoPKJ+@@U3&8e&pc~Xb8oCxWy5V{B)9Z2iwJ>p05NFS=7hnPNy z&Q)6+@_{3^_vrzR9FCtsD7S7fQa%kjF>uGPTCaeYN`{RT36 zp+}@36r>=;PC-Bdr;6(}>a|L;LPgja`3@Q7!WlnnF%I66zVAgg0Dc6wx!V-0@tWL+SykD;(}3MngvI z%DGs6b3Bj9Zm7syNS$slQ|+!)0i7e>2`=tGo~Z4(vJf6EXqNUr$`?>`eT|WorzNU* zcaMRXn{;fIc}Q>mk}6;cECAM)dP%-bxfj(Ko>84>KBuVO_z?-2 z4kl)H5Ie|Af{hK45=1JhPs+5&@-HMrD5Iewf59$*a8TzXo?8$qS$Avqgq{0@ zyp@DT4+)Q!gmU_XUI{Td7bH~~Fr~fCvP0%7m)LB0XMKjW@bHw~h?Iqxlm+VcbH?p%0lex4uYha@d&K=3cn1tN6=@AI z-_XWzPtJV}UOShyzIMl>g6DdEHc4)|yQuCz5B>5)ztl|L=TNB%s?Z&zIe+fZ=rBPrIj}i++VymEc3n9sFB!)VeDk zsrS<=f7*5SJvD+1%C&oaL2aoG{`~x#4AXHGfKZ^Mf_3UOZ#P&Em&2rqaDN_-&*9zm z9<00j^Kg?D_%r?V;rGY%#>M%gdcM!6y(R%)&m%S$75M_%K~1R_xKyjB^wJIcaowMw z%-=y`D}XeGPQ5^5jRbBNH*$61egy;h5gj!FGTEIYJknb8N`?C^>SuHC*{Bgio|aLbj#k%#hVA^Qm!++*!Mwi08Zk0^`2%oA`p2;EKUpK4HWH|k*oQp7kMQ7qJKU@d0OH@t;u`-cu(7Kr@6(fBKe0V%9<*eF2z zH~54eu^PM&wNWSL>o`Ju3t;}wb8qtZV7`-@)>I=#KabviY?iF`w!OdbFzl ze}Iz%0JRbTy14pCGok6Egop;LiFTMxI&anhFsw($XD!zr)IC)*1}A`V-F3~l#>$0w zItAj|HEI)Z>euV-;9LldHXAD?CmQxl1mrg!=RTlx- zjPjO;%kHU6i&lbSwfCzI0`gusR${ZTR|bgjH{er0qk|;x++Af^kwnJ9ICFIoGSt{o%{Y z`FWny!XC?JVXv+Sf-TD0xgXaKp~~&xezk%;8W{(%9DAE>eQ9R(x@K~)-8)cBP)LWp z#7%Xp;F@62?B-E@?7MbG*s@mUr$9!QQSA*z-H~#Y9sB3?*6n9_)|cn>nO9^`93;czn4H~lgKWR$(Fr{F5PR$uPk^~Xif;Q-z1B&Y$W>JnVlAmVT^ z7lct67UR;ivh@Yb*7Ul{1~3-JCt3$+`myy(htynvBuPu8OE34fz1MD)fHySHgv5Ok=EwoQ5;T{4d`Z~~ z>)h3Dp%9sc!iofrt7&NQ2!fS&c+S=OH@{dWHU8AV1PJfb$N&mo`t{Oc@sw)WCD))| z_A+sh!S2KFah8|+`LZZ^W$v8CA}5vhxO&+K11MAITMe&cAaq`4CyT)^2#O&NBOz~gFmZDs5A zW@)oU8g&)|aG z2c3yr*e5p6endm-Y~ot?fn0GXC zuK@C=t4ugC(@{>$wT%hn5jg21?V&UGfG9Z0cT*=LPYHkv!zx#0`B!j4k^lw+kYCyt z<;EaYS)Cf>)Pe)@3D)Ky=a{d<*eICI^FhwVv%5KTje@Zb9z$|-&7 z>{r09Q@3^yhgCg{q?<)EwNK!JY0kKu5Ncm<;R4|A$Szdt0F4bt8RBB1yZ&%G>@fj4BI!VBH}}14i2iVg^@RN+sP945 z>(zWhJL89`Gaiw1aVq8Fz>K~&B$xQ$AlC=kVh8w9%ulc}Ny>pCg*qE_aHbd*_nqi# zGqD2Lt@A0+-nAws92@-y@dh$mT%MYZUeC|M!PRUio7d#s*0T2vz}o9Es_AILncSU?mMfcp@`O0Twl>7?4~YfNZT?W*JHs z*kuWj6V|5Ggbrj5)8L{x?K*X?(6wv2=^~S;1;!Oe{l-mqwP3JD?b2aEp_vG>D;v2> zY~}j}?=X(-FFz`kXPK1BBO@`+%ck9TIy8c=qqmQ8$jL3`^MGW8E4VZodH{~!DcC>T z{k^@PwR|20nit~?{nJphZ#5GW}EcCbTJu*Wo4lh&1d zV*msnIU>xkem|oKAP2l`n>Y@3))Xo< zp1pn4Ph<;BM!ymehL`?1Y)S2tpjGc@l)odV@rpkVqtf0?`B2i$Y zU5%22{39Se9zK6~XhwpbH1g>!ZvB;7qfrTOKE3)C7a4KN+Ht70rcnaVR{2@1Jx>NLA}|8ZH9 zcXQwo4DzQesWLcs1o`>&_~pyx&mb>jxfowgL7v)gkSF#lAgT64BY%qRH^>V64PdrB zEca`mD`;hi^oPHv*Z04C3DRTIy`ILGAWht}I4SKnNDBK6k_7$rIC0+&gx6DJ>TIBm z`@>L&uRtw5tleV<9>&?R7OFXU{vn9c1>AM$#P@{{sU?hH}7`D{!9yc2v1f`pbHB|$-^PvuOXtaPSN zu9hBX{N=R$Amv91HFgLKNaG3~kXLeaa<}lX5Qg*{ZcWa}1!Ls+8f9^e#VIwpQEHqM zL%vJKEyNCtgV3`Vs=|R8c2tokEm#ZI`8OolY~X7egEDdw5^)KzPJQ%+>HM9+HO`axe)w znArH4I>*QCMx3I^yc`2Yz$x6wgk&)a@j>>4%iN2#&m@AFwrNw z(?mg@O~LI$j-~-45GB!9dy}l7y-7@a6IhqzDHiuRQ38>V{|1yd#Bht;2Mwfr*lLiY z8PP8wA~iFjae(uWGUp#D0cfsnYnV9MC?|juN9O0c=XuZq#b`q%AMq5FjFc93>5X+{ zPfqxpm=qs1J~h@*InRtf=H)0P;`0L-P*mOlSB<=ENrBD%rd& zVy3!-%z?f$_m}ndH;^(QBy(WaE-C-y7CH&JHVNr(3F9i{5+-Lu=FTiC25@SWc7q(( zn~zKVhRmt2WU8|I>itqy|GhyzLCH^GQ`Ktuq8AqMqHz9~bb3k2oyr(35|Tuf62u-h zVoWKgfyErmVxEyPw^mHglbFOXx+{Q9MP5`!?o{TVMf;_g);KXwj+jRQISodlQW{f| z$P}hfe;0!QAr?1}!KRCNmPVe+5RvoX#H!GVRawPsl8}5VW|M4uDx+G({F9$KyajOf z6zEKeJ|6(Ihmahql%_J7n#x3Um$9!H^4#V{&B;_Ty<|34RcNd#&n8Lv@|1r{NTzZ+ zQ$;!x4YSN$rYHzf0wqdSG?nr2jEcmh%1;jmF{4d#CuMzQUKIo>DOd>!R|#EeO1jiU z1R+yTB7)FeYK(&AB%jg`KqF;UBxRWcjZMYer6wgii=-?Ac3ljMDv2};gp^bVDcM;G zNm-Eti$8G^RN>cY0Q@pNC8W1aM7~x`CmVX(Y{4oy(^KpXo!7*B3?ptCP0OYWPTb1f zipKtANm3#2L(FETBFJeoW4tftSuqUGY-aM!LT2NARit~7!DYbHI5L{AWZbIR_J+*J zNy*$xnFT_Qzq`vYJtZe`%N|L|>9VUuNKY=akWmg5-`UQy$em-%490zH5~mP@rbXu% z{}!a%!#M_1KzhlP^pY`C8T@*TN>~vvPsK7<$RFcIAb;PDXG*u3F}_y$4ahf8FluGv zbd|KCsmST7Xhjo}(?w4j*Gs;>3HDQ;AK&bO;`|aqQc(n$uj>Bv9=g z9$;=E7`ht-bgyVP#v0ZF1`}vrXbS9LPBWiS6h$_Ry4C;n(}xc~z4_&nJyKr_HLy`7 z>;u#$RNcX|L2RqC#Ndl!b)Cw&kxhTnB*c)J}7PM0MK4`=rmfC%ef(H?*h657Fgu0 zhtm!YBX?*hk#G*Jz2<5E`Fr(u`SGtuunw1De8|^b2XqFzyV>X9O9k@s)9!d4z_VG~ z%k_CUsgcg>tJ1b6c+6PR%X+9Nv^oCoG~DqOj&8Db1T3; z{0xf*SSTzf7=Vlu8ENX~qdYAqq`~~B9Y8`cgPy%p+Tf6(em*q}ZRQT3U;Fw50EIT5 zbE&nrxzvpl6=pN(QCF2}3ERkmz$IE(E zjvZ)3k#p?uZIxqZVLO-hHp+Tm_I#OXvRkzgMc?H1xY|Rt7ZJ$-UVqkkI_;EfJ-6U z)B}9*Y}qkSi|rAl-&VHT(fpC1|I>fp$Xc3BE-OJUtNdGb7#xen*as&}VT!%JIXVtL0=w-w#d`SOj!^4eN(F zgLzb5%)zwE=?RJPv^wQQKs)d2TMKwN3@y@q_!CUBUA4bBjfWnK05r(wF__NN0ghy3 z@xcMWVWMF`(_z>>)HA8Yb)!|=qB}g!9-@G zQT>fgED zFVPkp1TNjwYB)K-tSRd^m?5p#J^Wt;@4InUvf$-;>yC&KlCv9LPRJ9&&cDfctb7Uq z&AbQk4)!m)Lf7Ux@0a=VEm1HDen&9VfG2jt1#~-*0bxQj1{hn=$X5=aUe{!JX#4S2 zd$tg=jasK&+$?yu*qDAYJ`u`BQy79t^n0z{tyGDC9oWGDF#iEK$lksOYQzLv4)Ffk z0lc@H>@9N*32xjwzblzP{QduUpZ*r;6`>hl0;qiNKblA&$o z@Yg@>O(FPeGygceq@RLezrXcy7MHO)MS&3=4CQ<|e0tPI^Sj7UaeaBd-j@Did_QbA z^^UsrEv^Zm{#nA%@~CfhR0qHO_UEsk-~9BeG5_G?0TSPMP2)6HTHg_C15h6aumT5- zFLIM9(Bl-y98w7=kgQ(2XN`A*+tf*UwpX>`14|ElTN&0)YBzPnqIOf`(8GzUf7GkY z0)Z}S@dksb6+@S2DqTl%0DI>ER>lF8u>g#}W398eD^B{xczw?U;$k!u2`2|weCBK- z!}k-zzgkXpZDTAx&`ki2HR9BO_R2g!e$--yQ-d0~OtnHd(&?KGdmW&0t+CBsch7ch zk(PAouz>Cd0$@b|j^Vx;F~IkFEFr%K6hQf8nSp}EwOfzyu9^?sO9bW~#>NGXRpZ>Y zM&TQdAdm|{|54la83$m=dLxgS6|xODx9 z#eK0r@KX>)8tpV`v{MHXgiK;Ca{sZGa%^AV$AwYh(q3f#b^(y%Rr!It2IP>-75Pu6 z$zq=t^#B58u*2mJgrW<_6Buh9rg{}{gnvlnIZvAEGz>bi_}6$El>YgzPLCU~4UkB3 zHqWeUr~C69dIl8Sv2;tT4HgW?01i+`sE`HZ@1J0))Aygg^q=tPj1-(2q`^rJ-UiW5 zAb{x=0t7-m+mswAcVzf5#Y$H+2x}O4cgogVo!|6Rr$68l%JxV0NOxF4u|I6?T0`*T z-!Id@|9VS%EjeHW9F+@jQnAHJ9+6uBox1&~otGJ5PouiY&6}$h;-c&~fElB*Mo-%h zY_uAU4AclHycaTT4o_U~5!{AP4}QeSj0uEs2A`2q1)+^VD3qK&hXWXbvQn~zPU`gn z4>%cRrU8z9N(z*b!hqbbsUg?U$i-o84Pth#tU;ZBVX6m570rs$_|GF)Io0(F3Sh4y ziz7IBXSI7g9*)KcJs$S^TRr_nvJYnst^B1&J`f}<_4}$%%y?U;MM7VY4AO)x0C=lzL@8!Q;cI+Z%w>kjRPBMxqIDpEl zfmHH7St{^Qt7hzQ8rl=~uX}mT!S~;FXp$zu_cq6flou$|^JnmV`JZY1d;C|>K5+u? zcf&FS?JAQ!Fsa&Uz3Hj&9>?fy>H^3+YHZuK7ZhgzGP9a$2by)&H<~vTK(~ZZHE55| zo5n4*GW){G6#$h$YQMC5xhP&CBruMsT>cxmH`c;{fE~Do3a|+1jNxQ9V0o%cL)?EW z(0M@vKd?qgqCwN$Euc*)`*Vle!(#)R$Z70p4whQ*6&Qhy zTu5aixB{5itdT9>-r_=|u;iu=X_`$7W*~yDTIF5J=e2TIP+aSv*?z!0ydO`pnTHJ? zf~J0g)OHChgboZkLmHAL*Tq?5vlM7-*5N7JFxWqr_1u7hhycSuZh7}FugzRTB`!13 zUau;$zA~c%&v3#Ovl#`PL7BZGTZ^P|fx8_pRC|Pn$p(vpw~m7SZ5dv}JP!68iV&}* za{>Ulw8@CDA2pr|bVj)x%pJ&#JENWLk$I`nRm17<1nu|jb*+9l{_~@UamjEAdSi#0 z%buxRupaA257?4Hy_fq?0jIT=f5>N4$FdePLCyG*5v$%?eiwGZtyZtHtI{oHb%#1C z1WcZ)@lq% zOo{&c`YMyJ!(wDdTxbOB*IsXs1X`Iy0Biv3;O(1tKYjS{=B?SB!BE*7=1pK3qI!1k z*4YGVyA`J$?8D#=s}Whs`8y)^>u`_}S!2I0>fi{XV|yzy@FoWtUH7m+s~ebe1>b%A z>GS6|zy1eA%3)E9YKsJuN&0Sd(adgK<_DB9yHW0s_0u3RRL&w|!{l24$c0l*5VJ-D z(@~~2%Sl%Wr4)o@qFw-%qXIppK&>3xt2_f7OLGw2!K}>E#bhq0JL232-x4?03rx_4POdvw0GURldicN5x-I6RAcKM+x@Dxb z#^zM&rn5PpK>ggyrTNVj@rQCiAmg`1OeVH~iSbZ6c!fd>L!24JZE>Z7E;47o8^G~f zt3F`F8`Q(0KFNn1<*i51Nt^QpOHl8x@HRy5TBAXb!JB>j`uDr#KS8~NJtjnT=FBGl z4(hM*AE0sSKS7nIYJbkawJ$;W_n+(d-TM^DYh_f0bx>wyrWf2Y%#%WJA$PNdTm|)3 z9!yRpT!tRNR^ev12(z@R4yV8=p=FRQ$K7y}!#XRHD$bKQ$kL*~A|Q%xa*YbIB$Bl{ zbgw}cg;m;gO&6qPQD6zuT%MlE>7K?_TIGd&P>_a2fqS+f!5!~B^+9q-4!6_iV*EWw z%H#RiuJE#FY+Dv2NNv;DHu-^DT#!UbjD@jnWPO_Bo3%+2O5u&{sfljRyEHpCM7xFF zT=BHFkYrCjV$ZQKD$qZ%I1kjGV_P{fMp8@@H+_V}Qg7KM^u}qe#J$^$+UbnJ ziZM==_nn;e89VFKyxTHk)>Sm>s%QmOIWZ$9iO9&F8_4PAmXqvh25lv&oh2V}T3|^t zrjjhnlH{_I_Dm%`m`Z*+-GgE#8Cj4Uh^_@!!$9OlZyWuyAR*K&+k7Jw@B0MTS;3tkUxvd{5&6+16Mf6H|{9i+>A16jdZhY%hjMQ zXSADHDLB70aql+cmnM9~Hv)4+V)}W+bS!e}X~kr?l+@GQ-Q3K?tso23X>{!U#tc-7 zX?WzJafO4da-yldPr^Sr>rz2x)^FsX`u<`biGz%Q_HddoSFY#baB&Xm*F3qwUFb1oow$zwk;D% z97ObY%Lq~rpEEKltlludiEqPKEu zvdRr!^o9X>bv!3cddQCXNhztBnargr7LZU&EbbbYGc7MGnU+@(WHgiuotA25an8T2 z{LFE)IC4+zRpzMUOw-f>9x2IXEJ-V*BETc@3J1m+bpoYcKeB>sR05-%=HGy9W207# z#EZyAEy+f$2r@?ErRqNCoKbQsDHe$659(}GC6AUQn0f%3c{HUpS*ZFX=e!k8LUQ*y z{Zq`>$KATzjJOW zUQ!&yPDiaO@>2PTeFTm6^c2)bB9d6mFDc?>C!z)-%3!e@t973LiI*Ku_NxdoM*NZA zs*G1!wq<1dW^TL{@%rN+p{ri*{MIe&54#ya7PZ$S8P?Y@jk83}i=$N5B#kn6+*3C_ zZhE?r8o|{bu`8njdpS9dlsrUqpK=hA`${vud}G5VPJ%VYtaFSL*@}rq1j>pa^wjM6 zl#j}TBcXd@;(`DtxaLl9t;lpWs;VC@2}#`vzYY_&BDz>byjmH^3WD5Otc7P0PVU;5 zW?#O1VJ6}0H)K}wQon5Zgx9aE)$S{7zry`DNrp5L_01P^^Tj;dcm*}0tMO9ZSTg4Bj7eOM$ybibTCQ+A z0eOx^0OrhCp9rq5DI5?LX|f?+7dv&;QVaEGBdQV@Q8gz~)yRJ^{$n0uYCA2WwjttZ z7*PihxjrchH*Fs*|3HijGv}zP3n0x1LsHzs@TtX~h?)$y0F2xM&|(gKbweIwA*t!1 zU-2Ep&RR9HYRW$)--69JkT!u}%!HWdOE_Kdj!Og;39|KwCyw$H!j464mIq9lf z@M7V>n5+?LuQq=-Q$pjUI%hZMcjx_$^HyU9d*BXO#%cEtc>E zNk~pjNH6A%j)AOl9<7-hX8ekx#!v-bcB`Von-wNv}nMOkbWVS=1T6 zse^1YUCao``L%G$*j^sW+oJpi2JprLuCP9@FZ+6KvgcY#X&%>Ga-;AQ5n_FZJ97e}B6F+N8TUcxi|6D3_by zC4KyreQ748_bNFK02C!yJRY<^^Ot}l+6aIB`pcWwVtyAqK72kL(*@Ms0Stp#ogOWN zvP0*0ib(jq8krY0+ef>Y10aBM6CWBG11@m=Jk%3tzV)Qk3xIloIPgBw46=t_xRbZO zchj-!yHP+7)?z;@ch~#9ik;94&aV9%yxmsY!uP}JzFZEy@pjE6h z@`d?=AuK-0lU zNb$5`5YxG;#lRN|*4)ySim18R#Wgy2kAqWHI z3m`sAeIV8H@zf%b=cXZ;T3`o2%MZlb%L4Mz{A{ctF+V`2>L%sSVj*o74G@L<(ZOzf z^sszv>gP=Zcii={&_K-Nu?N9*++UCzr|y$#*tndIh`ltT>@bf?f>oO%fMpmT0KF6A z=K0_i9!L(A9mX0R1I(j65lMc3hX!4h+h18ZX$H^Vq|=Opa4Q-J;)1Kr`## z4z&?Yl?vifbN{2Nq(OiQ*iPdt;N{#Pq#ye=V^{`*SZ~{2BuXuJpVo`#t9*}c=XxB3P zYEoG$nH5X$(WtCZ09(@s^3f)>sqBu!2s-NsqA$R{eqbCkf@@VdknKGwISaHXfoLq> z$6%7L+ko&n9frfnLP9Ugvp<}!Ah+Tu0ax|1n?U)W+SB=H38F2e569WODz8RvK$>Vb zsgb3oiN?Xy9B&`s#$iNO*>m8psepyCkHG z4hy=fmLsZ8mbLwQgsAdQZmY8UV^CG$dWPcxxd+`0drB}=ae)3V>#VJ1jS`j9Q^33^ zXG1_|1Xsk-B8Kb~{BHi1@UI;I2PT#mn8GoE6qHuuM+NBUV<=ME>JjpRTi1hn@ieze zC7&Xl6Uk)&h?JE7f~0zzJEyHKHR4Z!hNl@*9*@r%yi#r0&ojVH?d+V%8Y)xu0Y^93 zHt8t&yV+5K*(yU4+OR--O_IH#%cyp`H#GUXNgrdzY9gQe=w5?cI96S`7SB8YAL5F; zG5}>ZnWZJXE#dfw)g0ygl4Gt6#+{sjAW&%Zsd-usZqz&c_vLy#JV8vA@keH(O0B~| zWe6#5IL3!=KQ5pV0D#2pKo01keOa1uoHi=!fcVo@_IBHV!wR2PxKX~ECP+OjPjze_ zmbFfS-Ix;Ii*mW?HPdvRZYTKU3P9=`oGPb%*Y@>s-1w}>LhU>Pb)7VA?+P=j8hR3C zvqH45UDBz(8Ccg&IHnmQ+uApnwP4f);)qVvuSM_`H6xmQIxxJfj*5HNDO37W| z+iW(R8Z~>}sc}|69y|5R5+LYUFnd;>v;72p_bS(ymU*;lCvLDAX~(JKYp=W~nY4l4 ztE57(dgW*2W;ntrH$K`ZC1U;_Z(?!;!Ro^Rc zerpi@mZ0C=4qu+&4%d%Cjqph84K%Ltwu05$Jas)U(-XmsU2wVm=iR5D_mAK*zShHt z38*@GVq$y;o43P1GW-SmWfz>Y+u+V(3hlM4cGXH0Vi$U)FeOumhj;k%QI!v!?n z8B7iUxr&X);L=28HGJ52KL$U)y&fL#KOI5eHT~8F>Gb+6@Sl{rjl|q5cFM)*PMrc7 z$@Fi1cU*e_IZ~d(5d7=kpZ|RSyPU)4b+{-I(riLQ_=VO3(sLDHVj>5F{J$LIFcTGk zCHU8GAK$(C6;xlP2rKD#JPq)K6VT2e&AY4UvLBi=;&&SmOaLqm9GSbu7M3$aJr{#> z{gi9S{tPCuoL;T0gq${6oFxj}gA^{U<3WLZ{V_O`zznvr?DZ_@AZNq7+ z+gSE8NXEBXP1M!P^wzcJWxAj44(dsrOEn|&gd;*f;(R|m)lUD^oklF0>Z`8sNF2uk zUrQ{b5o@ zO)^DP@dWu5iPOPx7iE{b3?avQ?V-R4evr*BUoHlvy1mFu4av!J!pr?rgFs`ufZ~VJ z+*N)8!`}lUi*aflWU!qPzaZ0m_z3r>a}#|3^Z2hJ|KU5ON+Wq%f!@X{XBr_92f3v) zGgUcRt`MpmI=T7T!5o!8!J&Q1%8sB+ukG|`PXhYxMSc|QJGrK9NWcL$@FPrEEl>L( zm+VF+egY=kCBTFg#;GBg*8N@!0S=UVZIX!t58Ok2lEG^@1n&{7Ji&kU<<>Sbw{W}G z(UO+i8UCy59LZcdQkFKPVF79{2bsVKxPd16TEocI#H!fc#||gF-0k$^Qx3pZFITX1 z1y38-M4WayHnw}^aPNag=9fAnYt(I0!F7kdDnPCpvRoB`*%`pc5sLu(1uNS^GGGLY z(>Q2;$v^)y|8RrFt2wbZGRkSfG>So}w+LvDqglMVnnv!dZkXr;$V{@K`zr{8P5auS zqynf%2Gf# z%lbY8o!7v58)5Shx7NzSmXi?@1CMcz!L^>}X{%M!`n z-^)O8Kd7GpVw!ijOzs;Q2p+HXm%zQoqAhotq0_MuwbkGoQwn3E*Ml6raMQ&&3U;!9 zVI1J_E0@eL1V3C;s8{&Y_N|5+?CXOJT+dlq*#optM$eX4xle5reD~*v51)Sg=`+aL z$NB25cc5Yq`*Dszz?RujH>joU1p`Q+`5L&xK&;Hr!4!9r zV-A;hnYYR9^6_X)Y@LUbimhDiosJ{BQRY&sTo7Oa3(~HD7E|Uz0Ip$2Fu2vRSKjIR zD6$aG0ZV&?L{3gDIc;|!Zja+t9l0?NHpAUs?oRb}YR6jdzTshmh&^g845`+;aaSLW znvGjI0r2a80f6oP1hCV*=N*i?5mdgDAq)#x+XEEf04J#Pm`{E55b9RbsOJSoj)1}9 zxtqgNji7gk2#{+MfXqr)5W*4K0x{waMCM*ic5nD29_e9n-762fMhzcVI3wX>Dq%Ek z1@aAR+j^i>LGlnE3aVUP<85t+>k80Bbq-UP@w-9X@?M>=Nd z7)Esdr6rXGf!4V18lH&39&GH#3}o7=XD<{id(E!~lmpk;-A_%{hO|?rmZW)~Yvps(6*T=#Y5H5z;6QaV>Uvpk~g!+BgB;~?hSl%CB_@(q;%)xx#n)s=*;rm zK~|Ajz5#u5##ebdbWV{#PLg*{l6Ov{*W7!`9xA>O(yh7NZfG1N3xQ^<2f1XDHF&eS|OLtNB>GyPsv9IM?CA-!|jV3AFHV` z8Q3W|cuL|mjmz8$nG|z<4w=EJ4gutvZ&t`=pq%i@c2>gyIraeam~Y6{VBEB&^`->i zk!J-KMw(YjRmVcAIs?p&Ywljg38~KsiOx*)br3PqoL~z%&$meP(t%ntJ5$DOmq~E1 zwj}e=3GNnz?z=nw5~hzTYy}l57J4&BB)?Y#DRa+BhgbGGbtk0mIUpUrA|2ign4OT$ zOwE{NKF>zqz($9UoDN?VbaXBWGIw;gjP;Zsn(&>;<>whoTeg_I5C@4f<;`2!$BT&L zV8m6W0lkBiLF)QQhJ}vI5u?>hMyu;bD7%qN`II1b%6!GJ^$i$_KI9|eH;?4oBQYJB zBLaFf8^hgKl^*vF_=wT!Q~oK9%CaJxJ|l>ku}Q4~;J^heg-hM&+`j=!% zTLoBx$o;E==%Y-_cWVjh-cA&K=HjXrb`h0dq1HX1$S*f&1CQSIHmn3qpy*yr?ePUz)al3`C` zy)o>aHC&QkO&5Nr+HahDQthkF=D8x^BUrJLZqp^5T6sY=hP~0~?a*=%JIKhw&*%V+ ztx?2fQfZ7jLysd~Kb>ozIoCd`$hD80YhMuL^n%XFzBl%~^Ir>+!V6Nb3$nutAEn$B zdb5DeX!yLDIg@IilWPAJ`#Uhq%8TQhzdxr+wODB6V+nP0yn+ImL3I!5F- zM$~T^k-kXCsNVn#o;_hWWQcuA5RqH2bor9z(SCBIG`vkIVn|(q5KsEb{Q^ZA*H?~rJf{vHFTy6GUZ+%(A!5OG(YA=&`qB!f{XiT1u=@H^2{l*NM4`py!bI=pK`Gzp>p3$Il8`3vYD`+gv zk2kLVe>p*3)n;^prX_S%(Gof#WuD&9IExvV5b@&bO!?R?q19TN=WI;j4qZ;&0JwmToHs0wm+#PfP*6~QH@ofkzTLf%+ZGxmEtI(fP&Eq4q_$TD{0lt zqifxs5f25oly*mHe4&Uw;t~DPBdS*-a^ZO?2Q8cY{DN$JlUh25za%IKNbk>bH>9># zWqfBJS9mY$Aax0VsRL53YO1#x3S^0!uN^kXC3nm{mN@%Jka)`WsTLn8Y5=z z4%bTL=LQaW!iPMjD9dvYyNsZ!Xnsu@fwBI5YlM{7aQ@)HJg+G}@S%)hIpM4ZLSeAc zWERy5IBnk*a3K}cE*dB(8c3-XC4DB?9KTA2O;TI$@wcgLn?P!$5tog~^G@pVpkrX-ZSBwU|_X4n+Mg$Y;8?sGE-rg%vC zcR;5mhXV zT?l!18}b5ZAlrlt6@?6;JCs)xDX5+TUnk9i|I2=YSGbbDAfU%$(&bW>1+Pl*ACAH6 z+@>$hB#)fucCOm{tqxx6FERt$H!Z>*|9SJr|B5jolSiW%;Y+Xe?KC!N9K1%a@oVy$ z!nk}mf?oZfUy^;jem<*j`RTkocT4bW>(kU7Pr-9H?S{ku#98q2JjG>wNQ0O4`{{@F z`j<)?5SAW1{`y${UH$%N@R&NVQ*ZUY72Lw188+q*W2>pLIjA%WsC-Zc`eQ^F?=cdf zTV`-Ky8Zd|gwg?BgH@Fd<0IT84`+f<&Cba;Ie^9!!_a&>O!X4{_5Rc6 zPd~kTA9!SaD&SuqZ-?Jkc%AQ0;PWUzV@*~H=HQu3JszYM{rk_4?+#fPn^eMxkpCvs z2bH9)0B?U+3er%+3ms9j%_z_6nsz+a*Wlmn^n8mR^IbM9jieg%cC7&=d0=pu=)ht)chKt-ov$Yl?V9~e765a!RKjQcd$fTrV(-LEp!>OM^@-E z)Ve$d*pI!+F`na6S5Rt9aJQNXT60Q=IkSLsJIOv508^*bv=}oT(9xDsaKIM;XrFEH z`Ls?m(wUc&e&G<0Ty>u>r)f2}^V8I}w{C=RV?Cbm=_mRAyY2|RhSIc6!SU!+!2!1< z`4;VZkS$*XiwbD)oEB6Pn111y)V8}Ii)Rj&=I~sX%kC_zQa^iT(5c~jmKLSLx?hhq zL?7U-M`opNA2qL&Mmn1iq%$B#1hfURUv~AgR>6lll$!EGhO2o6p$$&gYJ%8w4))M_ ztjls#Eyx5DLkK=5^~i!uM0U;Iz%3Joyy z?K6e~q*2n|JPz|oeZj|JJV3>x;0V2m>OP{%L0GBkOVV^Y?4RfUa8k5u4zIybW9EmHm(G5&`m01UvTDwzBG4_UrHh&@Pwu8GQNW{pE?g^@#Y^jY@vaBVAUP3@qD3~yS^;aX@)WNfOkTud24|u$5G6~JzCv|(5fn5e_AiW3y;7A8hRn2Vn@9+)%U47u! z*@QMSw5!l&R}UA}*W7Uc-Oxx@*#MCO^IezIMF(4oZbp;VOv)qG(-EYSTPJ6}YF*@- zVVW5@#4B?Y2&Q)c#}z6A0do4wT;>KPjvlbL(-WDDJq+bhxi1M!uQSeaUP8lDFNb=% z2DcyPe?I5G$QsCz(ca)c-)bgA1l7)5tE1ix92^`$x3<01J2^?siC$LocNhShHs`5C z(yu7^{mti(KfV3w&E`mtLA(Ji+BH5+Xm0h3re_1GZ0`ormJD;XJa4Kmu!q!{H`2C; z8mj>=;1v=^Sm&Q~6nB)VNN6+}kb)TcA=L=&H;oVgRF-(FW2-igGW{5_1h?2c^8N`{+kP*!@IEX~SSYK4?8vMV8RrcTT z=bLxUuX58C1#+dTl@>XSi?W;r$l(cUy!;E&COjg0!=3~8{48|${J0SG>!3gKP94N0 zQ%i|b1z?27!Qx)jP9M8i1_cLr+5R#gR(bQ2j7RnPbYD*Lk+MtY=V3ix&dmbB(rYW* zF!;57JV!_$1{<6n0&s-EyuZD+ub{~eZF2$FJ{am1$0n3am>E4)(j?=TT!((G<-BNR z3tjKaFco>`N+sEk0@|ik8B;U&IEAjN2ZeFJoUX$`W>(i}2f;`i`~sa4j#(8fnZ9WT zYjHHa688CZ9EVB$@daqIhk5qrDrJ)4p_Q|e!ll$fXbPqULg=du_&xM^*Ynu-5R5{& zG(zeiK(1b9NMSmi*GKNcAIAv zhcmzkYW@=vCYiXet(o^XIQ?W&AUhWnud8X8;^3F>eqMige}s7F1$N>w04AKOPC_#; zAqZWsgggK_+tz7k*8a1Ss3=WRFn3qwj*glIAp7Bqf?EG&P;YPLzhSw1<05Z zVNp;+|9u4m@i^5U6o8-tS1#e*k-E^kHIK?eN;+Psf{T z1h2(u{xUDupnopM)Aw}PNFWbjT&9C8P!o-_NmMnXN5zZ_)09>DcHulG)^kWEV@XRHBx2;-c*>)8SXQUfLv z8e65X2IuW3IMZ}qjs4*fAa{uujUYI;hXdU3pO6d5jZj*|f*_NWnb=vb95S>Ist$rA z#biRWjH_~GM>y83S|GcO{`BkT_aA?K|JlSpYErAPM+|`+nerdl5A1<3V;dm^0s&v{ zSAY7Y*8Hk(vItxWgt2u?B?vlXlZ|qB9(3?IKgr(Gq#q1h9o(u%`IFqd%9-3Xfofi4 zxQFDYJ*<6X0w0W@@XeDGU7kEPjoz=R)*a*6>4F>YG7o-~14^|OCq&cT@jh|~19Jt9 z8*u55g$$@>XK7UnAlnoAvlD^`U^dbI)M(eMIw<$Zn-0a|`0&BZ#Jc8?gt{)08=?sqN%OvZ)n*^QY z4r71*GVOw6_j((=L&>j1axok{}<#ZdNM;vkO$uzi1|pUU`3S=Ku7I^+%Do!7SL3)%sy6VlCEl; z08P@XrZ8Z3hZLrRo_}&3JILs#Q+hd{mR05}n(Ht_YN<&LaNIwfhc9InWx+v)bybLc z-=Q{fj7)wsn%Bdj?VI_Aw|cwJe*O6gDbRgHNi&6l$YUo|9R!)q%QDqy$F@jfoV&X! zfA$DGg5XE*m2nM02HgV1PlxGYfHIfdgLVSU<4^4`Kl|R#Rm{h}9DSI|1AhHD|E> zm(c`6x-S(W5XW*FVAC4 zl_QQF$S!#M+n*ml|N8zv^2mH0Ef`@MPV0P81<-MQniNR4ya4lgkpn{WC`}wRLR&Om zCz-=&_`+4Lc8dax>N62uhFCVa-n>Ow6yj~n@b!*vKf=7C8vVSC>QXOh|o|q2VR6{6iVIArlYU~+QL-I|ry`h{? z`IW5ijLFkmxih+}hO0he4%P+xG->L#EYc>}hm&RM$pLv@pS$5KXg}-*nLT{>=jYEq zzJK$M;v$IpFc*4g@PPoG812?!&^ttgK4h1gMi+03BFq!ogX6oLCzyce<13D zfP6Q3xaCgcS#)Kl_OXX@Pw#J4-UEQ$r)newZV9+TpC0UP$FmG&_}6lhZ7Qpv%@ia@ z;0FJRXxR@Sk8fODAe(?MVb^bLZ!?%Ki+>I*GH|{3OuLamcDzbx@)g;3NfS!xH?ubIF zs+cgToHy~3>zH)RmihH0+x8WLCV4qlK<4v<{;6%Pk}cqXMe`)$Bra6GWMU)!IFf73 zZs*lC51l|n#60V>zpLjz$YZ$bUA2l2 z-IIH!)Mmq+Ad3RGl7ma3LX$#aQKZzbHh_xnY5@>HDj%BUZsCp>PI5Hsc6jsg{jVQ? z`}I9!Qn=Q2oA5~hhjdjy!3GI4N4)`6q_TYnsQ|f)yUGb-X%+~jfZPcQr3N(B0w8qI zsS>KeV75QuQ|g@#S+!bxwE*?2T#jY{^|%m_o|3952Z8;3Y0d|L+o^_I7xYuQx$9o0 zB8}!-9BM48ma>}Dn-A~*_2$=iA59XaUL8S=35RUrHK<$Eqh$^yGpa_jf@C+})YM1r z9N_VSv)kcLgFP$|HxJ&(N;fijMJR?{{WFFBvERLYr^iIS+dZ)eh~j-Ck5vC;_qLj* z{XaofRdP;2-BjfXvM^HFeN|+?K^2x+9wwQbbtUXn!#oSCWU60+vV@PG9Pu<+{URvL z;|L#31SJ+CG$P2U;3o`#zsMFS!mz*+sZ( zoFGr*3`>x`t>S-YKjui?h_M9FT0wIaWD%?&vNTAqZH(;aAbtPcxc>Qf8ORx-{{(58 z$(KS3M=YN&OW;1qQIJ$wf+a{?3??8elM)i9yo$3jN(DsGd4D|yVB#qo4{pX;6>Hdr zIVdKiA|$jxOlX0akVBUkbxx&OMu0J3&oP>)3%W8!bW{Yn1JzCCaayP%%PnI~$5m~D zuE;@Fdcue1c`z3wbk<`+Gh7EDWncwC?BO3K%_>|@rYlc{SP@Yw7P{yw+q7O4K}gY8 z5yV|~c=z$oe^bxJ6cA1LV6Fola2=EcA(KJ~@=e&KaUd?Ap%t!!j36Qisqm^C*dtsG zcY%%R{T`RyaDZb(Toykbis(nr4pFU^Q^jJk*If>lIoM)F^f`>FD5?D^sc9kw&gEb! zHD3%7G3{8)=eW|Rbfe3-h;uA1^(wXyk<8UwRYe(B>>y)gNJaIQg@5>p69Aab2BKOP zX4Gn>lxRf+%nq@a$9zu2kBImjKm5|X3?r3`x_+x5$W_RN#T8we6+)FuN^widZ}9V?_#FR2DNpN^-y`LIrc18_NV1Xw3pHLFh&`7iXHtnO zx^$gYcjd=ILP1W#bxyd+6YlvW%*r_a!Vr^+V2d@$DDARX6D&+K*@8|oO1lbzgaG2G zB*y}cR)U2(t}WkWQ)J}?358e{WmlUJi_$EUU8N@FjHx<}-TK@jOH9xe^9_B|#gwC2 znhE4m8WN)FD2mS_u43c@iRuyARAXVVS&16>=QQ{o^iX8ol9DN33MKpzvDkpwM z6f{S?5;}-onw2s9#9p58vl4z*Y^?N(vX6?%8I^DMsB#6T3AzeOyz))rg%lK-t;J>O zTCa)#U$A7BOG$N5>8fs5e^mrje-(+xs#uze>y=8%gm^`bD6n?X7nNNm40C-9Ip7hU z=%Yfeo3hLhbY)loV%uSqQAdW^HoBZc)5;?aVV~n%iZieqB7cn zs>ovg$#oLU?uw|Db`TRl#U)!Zid3rwWf;z%tX$gzLNYR+Lq{Z$d(uim5K=N$P!3ix zJSBG(n7*7U97>~I>a}I2Sn<3qyep@e%iVYEi# z^K?&0QIOj~n)u|-qf%muz^MJQ@RXFVa_vpRqbynv2Oxco?qb~2BWwmNYYI}#{a?nYmImpT)SfG z!E#E)@-1B@ay?jHnhZ=9mw}n+%d3d#U(5kCN=huy zddb}>#B3`1GVxXnn3$T02MDk3uJ?)=xl$4olzn*!OQrcNJcA-0R`lqPDBN}sQTCO) zfUBa&YZGwgn{I1UX_W*NaGC5Yp=vCl?8}9>5v7_Dw@AdZHR53fv5qVhXI0c><*vXo zxt5Q`A-^DRbR*v1x;QJLIIAMa31WiK!(J@W#ZPlup_p!~+TvffK$wj2FB?b+RNEC( zV7G)T`VK$I6DF%uf&LCX<6}$Q?s~8!RD1Z)$qOXG4F?_^c zWeT;BQf`xhS(=RP!LSOcJ@et-LBdF%S$qqJ;xhW|yOPFp$ z@mNmrnCZb>0FzU!mAfB;%gIWDoFHZbPD0I?0$&XaUsDkC5#N|O(^4{ub~2wMhcr@g z%~;61o02lHh@!7e29`L;m~LZAvxF~qSrKL64r1!T3hKcq3{#1h-;9R5lMWf$>3XnD z7*-Nkx{d8PI;w<}g&R;^8AXFBwQx-MG>~n&GRn!SO;=Vj9H(%QWfYhdE-v}Xl@rS15!!C6YkX-G(Uc}Qm#lchmxnov^3#I}$VlaM;|kaz7463Ws-=I`W; z-N`*$C!#*h)o6Sl|ExI6qI^@MRT*Vz71e0DgH4}iNjfDZXTF_zYwjSTJ}sv{t)f0n zpOc#SkP2@HsRNU)#kLC!#7yML2@-19Dr(pYg2;hp-f)9QJRl>#B?@`%4tec1eOgYT z+V)7cCGKcIPEPGvPI+6t{V8%0nmL(x(9Q-lRwq%jo-p$7^^XVS1g~qqVu2`a|6FH0 z)b1>#<#qpZ*bf)w&Og^~nLtQ?F1P35zk}!bw7XpQ6Vh~6&|m;81>$);ynJ{0;j;?T zUhijlF(`*<^H7(z1h7foPxU_dPyNG(H=k~&;N|7zmS!2a!CCM!+HdgE)#G!0gVlN2 z*USINzkPtE6VBiAYzqlGH%JHCJrDM8%?BE~FDn#ppdLpmeOtiYyw`o#fRzR=Kg@==#GpF( z_nQyzfBpQ^ufhGRq-5QGf^QHE;h($LU_C8ghF0z-7I=$m?vLy#_{|2(+Rn-kGj*Gs zs>`&_vf*UA2{IS(#T0LlwZYGRngPa}3*D~8aUB45E4VHT5>61)0Ap$OU0$a8MRN}X z+`Co|AprCyC!oD05sfe19)!SUyxkhOiVBe9Y=06k4p=;`=rMXkQHS`UX{?pZ<=I3r zVvD-{1-!Q9)GFUe!3`S`pu5g^PCKe!EnKrDTi_J`G?DQFNdS7$Z;pTZ`yrP z`CF~6TiE4e5pcEim!<97gRYzc`LxgbWB**=H?D?*iVsI!1BoGGr*uoy!#bn4x`0MF z?CKTBe1;d@(`{oSI@t=r{G9W&kXxnsdA-%k=?MT=@4ad1z(|`P^`P9~d7aISUgMKM zopMy)8Le~+KK=RYyEnhSea|!{XzC!pQB|32P2Hjb(2R`*>|kBIQ^lM-&(v^hb5*QT zI}03w)Nb5ce_d0VPGhgBOqb_D>7)3cD@gH3X1b~2Gz_0`%qRe{RP}Y*5dCCAJJsN6 ztJ{E!@w&nEVDoM%YeWy-CUcRWZy+s00(R>bwQ&a_ZO}CY0Nozkw`r7N5#aKKVopKC zM?wX|<=QIPgNYW*;9a-f(L$ge*z91LJg{lU+o@|$xyt)Cecxl&bflrXdD7G%M{ck3 zJ{hdQh*h9kMi~xmvtOP@mJ!e*9xRv{MKa6UA6jg3ITLDVM@{F4mF-{(3@K#SG$+}l zQ1@MH)OSCfG;JxeKq%!1&uXHq8a~%q&!<)iX#hL*wxzt!b$rw6K(&kx{9QSU>YI{tO}wWM>B=P#?wM%SvThkz;PgWRM`a!!nvOGQu(Nv6cf*zr^)v*wmH=g41mKFd`sVdj$3lqrz=ene zFgYrk<2jkr04iF&2u|y9r!1#w-GP^|1`~ba85^b2J*7lJrYCC#30~hrn5O_oj>`1r z)A-`Tz1S3dTB!L5;U2iRrq`2kY`X03%X2yh)7dy#4;jkUK)h)YK-C;!h#!3H_9xH{ zA>F$lQAeVys?Ms#L}oLhHBNb&Co0 zW@ylZKmL0E@$-NF{OPyfsqNDUDuqex0A9|D7ELbx4FLUVAzXPb^C!NRLG_wl&$5wTMIlvz27_QsftpNMc)OxG=qTkdq8)t(@ais+M zx4lJv)$?P7#UCYo{I5O`J+LckxAh0W83Rxcr7D#+&^LKt2`@mQjD?!ZVKD9x}f`CK$_Ol<{J`4lrJj@n-Bj&0{?5K@e{NdO1$3Z;E%s>gu!+0O(Zr4ro1vxCQy)tsgCDOX; zmwxxJ55e_`2V~B2eg2Osq_0nm+~WcS9|Qc!gVG8^ssn^##x4>HBh5_11tH3UU;cko z{adr!Ra=EHrDgXi`L4p8<3&$Yi{P>ft zWhUh%sSmXQg1C0{8+v{X#+TChk|pc{H6kQGNj<5dg_40Gj_kRK!1QtKnWkt)D`0>j zqy7{LtL1JAJTeygU}iUEcTEou;8xB{qf>84eB zQsowgXd~?bFN|Q3qVYe+tNNu$`2`^bGOh)h9j%2Xg1xY~hZ;_SQHotdGc{OtFgOv( zq7-24wZx6qVu~F-3Z-dt>jrL!)@yK8lj89%t;Neu zoj1azdQ>QUX{y%JW{qvzJU0;|Y7xP99peV26~cAE^hd1KFqVETm z$WfjVzZxG<05;*nL&~GL0J^nbZ*_YuFo}?L85+34`|dD`kb|t$DzcY0(GHCZ zWY@^30izU(yx61^+Sl%-uIw4vH%ftdWz(qFxPr_**09s@u&bmo1Sd5q z{lH$4etq4--l6XvqF`YrMG~!^G(Pd=I8LrAvglNE)IzU)yJhV)!89sL_k4 z!m!Wwb)6CE!rB)Brxvp)N7#-7!-D(vpwY=a+z??E07JElRNXXGL#Q(h)jHT5KvYN~ z_SGFc3RtYsnV{F()5cWNFPg)DpC1S#JWI=+{e?5iB!mt@90vqLO4r$}^+aBfAkLDh z>B}Y$+OdNzTlIpe=4Ui%fiXEh|AgQ4|Co`IJt8}Qd;jr=cb`A}i-D5!3xg=}EJ{OL zMTC{%>DkH=AQBvXhckV%%av2iPf})K$KluUpX>Cm%};LJ zwsjGiUz=n|Gj7|Mi13k|6n`){bCA|Q1?qxuLY@F__#`d!L%r|!;qTF!jFMQx={WV# zM#`MiaU5u$@au6n9Ts#tPCuu|?3bSg4e4Yo%2Uz|uG`7&G*JXnfp`g8^c%6~7Ewm* zCY`FsgOLKK>VB+V&JZu!*hIXit+P8{$0enp>(x_q)CFtL+{ z5YL%$qlhgiBT1z_ciT@YW;Q~OV}D1YK$q3ROyzMnj?w{?vXRbm zNc59K_6tX;?(UUzG34pg+jfLG*NFM<;TI`FTA+5MoBeAtWZw{jiW<8>Na;dH6$p)7 z)iCu`g>-BfcFG|z_&I~6qe4CIpibkR0?}z6lA1tBVT|LKHtOFj>S$UAfxuY`uH5g< zyY2w?RT~a3QrAd70p7E+bkBnC>wr7U9R#y(NAWT&nIdqJLh9QxN;lXhjmz2lC7oG!~K`O_YEOnaKe*^9o_cBv2GUW{>2`k8Y8$=GQLz82M+WixKza4 z&4~y!lH|r9pu)Z=u^lLC%+<1}w6jygss`TfQ?M0dWUI1?CjsPu0*M9m}a`z-t< z4_K`Ms8XcCDNzLf!5mLAz<$Tr)Q(lnev(^@t_@;RhXsM0u$#i*g8XHCYBOFU3Pgjd zu+UYh!@J5NR^gc^U8)64js5s~Sz)NdAl7r&V9})JaX$f$q2tPX5Vgh~HYyJ%!E!%c z;^ZT}>iYXl9>@#*_oNfqi7+?BpWJ_M|Fq&mv}-E`!Xg5zbLf2E^%o7G?e-NC1>Qu3 zy|iQzn7M!2?ZJ3&7}YQk#(NevtHyhBaezJBAA5w$N|{_DRHB5}-bJ1LL~!)Gec%a} z=H0tjbou3?yn`JhN+Yn<$XCOlVs()&I&2MZsA6QV6R~*mV4&I3ia2z5i-FtUUali! zL0f4to~i+Xwd^m)0nOUEM}#hrAK=wtp#8X$BIDhMcYply=F`{k?(CH^=nD&?6QxNr zA%(VC!B&&6H9G|%g?2Y0G*=3i7N*CuRJ?5sNFR=~S}u2VHW0^qRWbE=#6u%pEf%NE zDoyUL%t9kA$NjCAk0unz4F(JmrK=;5B*JM(?Kqv07=e2jmkR|T0>QemcL*tw&lvHB z8}LFO;R>6cbH8h+PIlp@U2Tk^_Q(hx>)zfatu$a0?vZWsRM9z}!x1 zL>r0Utxbg#FgPpi-wDCOw?*S?kx_xmk;<<-SZFXKMPmjD%f)ul!9nnf483Et@XN8g zGFrGsD~^7F)2hQ}-^~Ld2fiBF`TeBWEsQJPV_a;f5>2k~mJWm5`Q-}CCk{xug4hRw zjA6)02gAO%A-cE2UV16#eG_(4YDviq4_K5|EM|6irHBC{*k_;5c(b!RNy&}J9|J$@ za$F%eHfsUIT}2l_HpuBhc)d#Ng5`q}at?e3d>(YdS=;yY| zT%?FCo_f4sdn!gC%l9uX0P_)f?W>L<$OBk3T*M&1z)=BS3Jpar6NDhc3Q@Mz?m)|t zwVTIq(rbg5&gQOVn6JIS&duJ?$QmJHb=7H@|@$>vT6L-?4oZNO5F|Tnm&a?b8p#zgCs;mL`8yvwCLnXz>UXSE(}NP(xk|?n21`hj|T_xAkYB` zKQIP)-9|XyVvWqa3EhqPcz$kl{%5HV(XO#!1W{i@aK;o-v9i|R|FnQo`D-5 zM1QBVp|sr*J`aHaYKVbnUQY^P2|rBTp|jxRg+tdOq?I*1W0DIOa2|vj5Wy^^s$>AT zAWjX7D9N%1nBCJLaU9|1he08Xvm)AfOUJ+Q0LR@MR;p=k9qP;NlD1iKSSAD{U#=Jq zs(Vyf(vIKb)d2kwk;NFLjEb32%IKBTTiAk>CF8U4WZ}pdFVryP&OVl-Qc*Px1Q%3PTN(#hJc|Xeq7IBde;3hbC7@w&u09o3AX37ZBJYGpE1e;R-Y5+1S z0W`$tWyO;A&|sWQPV@*%WHV*t7u8fTcM%00$H8-WTP@&tTe^rm1i5g5fMYp*xh5u9 zsWU8@q*5w8z!sOxeNsi?%_qDS`u!6u8YQn)3`_3s(&7yj^6C+;k0PXmnl(_F8)Bd` zBag2~zKc{tcgc-!AkfYMT6oO3PR9e!p?2yT*|)Da1SyQ(e0cXyi%)J}HGCVf%iB%q zA~sQ`F0f=b!b4m{ty6F+zT=RBvg)RK!fQTvbv#;dGj5wkIVXs6=HDQ#-|j|`ti~}* zv!gqmO=Cs*Gs_}0*B=AolgqL|>gSY#8DkZL%ay=q6br(`*V>Pp@H<>tFar7Fn?=GU=7tG}9=Q-N(~UU%tMC z67fDM94BQbau~9MDwJguC)-mOo&nN$6~Na4#bLKE(xMCbHr*s~oSxfTH(Wzr7TYZb zLlK;eBqH19WyYXpyu3<6_WAM0ruv}_S-Cmw=f^o@a%4r8Cqc)DVu~CoWd0{)NhHsb zbXc-j`b!wSLr4Qs@R{%-i}Y_u5fNU%bg_twZ7yHO40)s=6;O&4%!`dSl^T?g`V2G^ zvBx<--6?YmW@b>dO~f_95a`slV^dgDpBZirmd_CAjf?QUPGyLFh$W#OKd&p7AY%`FS}tIS+PA%PWlf>Buy za4tQHnW4%Sg|~Gxx2<`6S~zoN;mrC`>E9|mX1VZnEOu|}u5KRRrE$$_d}-EXTMsDS zdX(eVLkHcJ%Y=W#5aVQvOlX z^jY32a>hQF9`aoJcFgQWOLL%yKf4EKr&e%I=L=#=ef9 zPU$h`rA@BXh-qC?dVq83A6bN_TX`iul{;}yFB6#uQkw=7BAvc!bP zX6r{9NdO~GBzNRYP2|t8?ZnJBw}rcIK7|`{=B0;i7cOFt-=;;Ul>mu{&?g>+p7tskOcs1OQEAenH4Ghn@uf*4}xb(;`uX|*f zh}@9VeK_-t2Z)#Ex~Yzu7TX_r4v(Bfp=MdR$Ax?Fx5l1Z5b{3_ryu{-^$jKl#$P!{ z_8#InKE`dlk3;-fq3a=jMi*Wb@f%{il&sf7h<~;BS@ExUi6rgT_-E4i_91@P@=u80 zVo1Kbg}BncG}+{oHw2C68ZN#`Qx#c>BqH6&;UZ2tl^W^q0p#Bx<6?twJrDNMaPiUw zgR$MxZR_ERTZ@uWk(VA5?m`_ni@!&SZ#*VEb-T`IaQHKXJN2k+jltF+HjT<=p!L>6 zugzd`gbvHIzjKXb*M`0 zwY7@UKPn>=x}CzmUa-|@A>omU+(W{*8;=c-+%q)uAo0Y4#C4s-zh#%+&BJ037Kl_m4D)e1l{zqGjg3q8g0;x2SaW z9xeQ%-1n9HzH;A}JvEu%=**+LGrt~=bg_VS#GhwHDFqs0rcJs)2zi2TF~Y;8SWmf5 zZ1Jwndx;(MVgc+=k*ff?&O+KZ?og^B?H;afrAX>oCw2aVGhs})uW4Rd0Q)nxed|k# zr${We{ky^GQzRDBP9sqaY`1VOMZcR~re(e<=+}u!w;Y=aJ^>d3T*W!IFn9fFvFdLs z4_eZ60W^wKrh87Tqj^J?&4dnR4_;&uYNOzus z-kaz#c%D=>Yl(q5VuBI9~?*aE-y?F3j9B(#Ah=z}m zzQ?}n(R=v2#<*`S4nF3vhXuPoquvV_i3hvqE@F>ycWcu;Gb7X7ZA*1Y?n^Qce>W_G z4`9UJ1hTO8)WgCsM0B`jc#mKAXmvFg)tE&SxrL;c3>+{19)RvP zp&Gw#*FEwQJ8~RHFel zm!$qJ52Uu-rh+b<9umFr*v*ZHkZ#j1z|dhqwggxZW+ zxN7N9v!#Iw)MoT)Dyo6qrR~cexyVNzBDV~;DDcQ*z6%$L3;!tRN3rkJ58hAETO*N= zGiaoEzO_hk4eYis)4~IMwaJmYyJ%@5_i%6x{?0D=UKwZ92yZQXBd_`+=g>r6^&>#sZALAeS0Qd5 zDgHfnyzr3mXQX)UBJoJ^t;dBYF1XX!4@yJ8OOLH#O@NX+ZV(VL*$UF`_F_C9(VOp9{zf;RW zIt);_c)FWz%**s*|M{;~cwG1W@ifHYF-{X_3p~23dMiFUhBt3yQ4711bqZenh9iOL>AYyf9OK8~J|F_~ zD$Y-DQxk~G<_o;8vKVu@_!e4TgulA}N3}1-;Ki|neJSh_0I=uF>ZRf`Q5f2IY47@8 z8L_Wb-Mu1y{LlCQ(3t7)*PAc@{mZ-0@4}0;P>~or4&d>fLF9bptlMMI^Q?ZWxcd~iee1C6+j^|SpXYBMUyi3DtjB#*zw8hD zu+}$ZJ@Mi5WX$7I?aGroo>eQYYnzTq(n0N4*6t%DVLj_OPg;RL=+FlYwTQxLr zz0SwBmxCQEox!to`d5TSvLU8)^e!g?115g|$V`s2H9+SGE26#xYlg4&mAVwg4@ zIp_x@zuYaVz3Y#d|1~2T>N4&t`r7Gl2)?~@UNT~&O$A2oF~%8B^;$+@zO{?S%)lI$ zB?jZyFXP3;-{Rak5qVbdWy>{HB6uC)bqFh8ZN{?-TFf%|JykFU2!L zp5-cE+qRiCTE5+NRsSB7^cV!cROfh$>qU)8xfV4)Ta0|M)zJ78 z3~wReg*}f5XK43u$Hj!#%0lB2qmBU6e49cXdiBe_w2Qjah^!~x#c{vv5Y7WZ3jz1e zg+K0U@$-n{uNgnTE=Ykh03`2(xo_Jm=IMs3oJzn<~_hBVPbN z0#?yFMJaz;?Bb3<(tepH2f$LO00ID(f!uZ9BM1++yLf1^@tu~9(>l*I9{l|0mtQ#9 zghBm`R9_oBWeD@H?+D`$(}=aJl|lW?s1TUtX<`0N15qI{y5C~*N1GZp5q$ygQc7}7 zM09`T&@T*79*yZJB8j;6qf zwpCML6!$;{NIH-cz{>rb`~fcsoPfW+{PW$9Z~tZjoV%8N$1h2nPT7**i?!@F)?+Jg`5eZzJC3FtrqfKPFExt>O)8jt!p>Pvj8Ez{9?o?Ps=&+UwCv{166E5KG#eVF{6`9mLZ@*g zR1a#zh)7s$U}Ui&&j5^yFX*}au7Cqs0>fnK)9E+KH~{PbG2*B+MocWjtZ(Ta9XQ@( zA_M(kh8buWPgl!Rma^o6h$**%QPhtn|u z17R5(=`ldS5mH(=!#GQ!DR)Tf+~vrlRO|tU?1yfW9#aKN<4biKTCffffP3GXXm9wY z!V5MgBAOecRW1j$zdw+`EaNomZT3)f~oB(mq;#!LM zPx~Kve*PnM@$ue=fw9V{tQpKY$i4nlq5laSf;<`bN`HpS{nWfJyI09DAC*%8+vE9& znb1(v^>~MEFD#M4UB?G!C`$oKqrvhpQY6& zje!dWLta2QkcP++eOcJ2^Bg~p3>(>3Bp5Kr7Xsk~YLVPYoAKkw1_Mo#$5;9?t3fh& z2m@wCV~d7g_}HNd4?qG0SPx1x09T=#kMIpP?_?Y}BH;04fo!l;x9JHp0II<}taDKZ z^hy`GFj71-0!&c_{3a(^TwH)~APu~oTzq8~a6h=C(&G@(DN^Fn9<+l4ffPQ<59zx} z8GLD*Zqa$gkUO44+u&NjoLP#zY%6GLK_h@Oq ze3#OINC7%ApIj7X$*gPwY2DRi1!*91QK%L3ttB2o+B(uT{`ltezkYr5>0MCUt%y{F z8HoS{G+Dz(k`PEIm^wODQRq%4?PN*@c(ix!OCbpjRJR{hpwyd*OW<&v37n>sYg03m zn~-m^l!DX0FD&2&2BSceB6z8e((Htrb#>@=1WpjIz~gQvh8KgXKvJLxDU(2s0Ml)E z92*BMln@pINs@#9qq}p1Heip@8TeI8T`6V7y&@d}@y}}HjBKMqTB9m$1`tatWP<_ky*Y_`Kn z`iwwQSV`9-ht@>mFV9PwqKn*b^_QNbO+YZ!a+I#w`G(vIGJ#agG%){dZN@o!hbs0w zfte)dD+11gh@trn<1gTXoI$U+Bsstf?M(M`k+s}mm`4xebr0C#S@v{o8`-{G;<7xR z!*6m4KHlHR{RdkUq4yByyL15MGbwt(EaM2^@d;%>p=eZwC`dO$ZmKkA0|F9dMSh{> z;73eL>xw@hl{hE@CGkOo^!+Dk*`2|8>-0jOVR4J5*BKN-^aw=AWt5)q>EHYE+fT_m zQWr)%Kfj8|ep&}Nxu)%Piy0>1FvvkIFuR@s`iqURkQieD4aw6e^$?A!;a81EDV&Ds zc>1<`gkOLD`ueDU`Rp(RG7ttNnqQN!0|EkvL{HU>k=3mW@D48R%pW496sBo5yctpK zpQ@%sA`4;M?`fHR?f@`QQEVylL~iJ*s+Bn@?dX9`4`7!r6)XyYM1c1(1h%oOnImPeS5*V2WMge8mq3n+z%_B^5@M#GNKg)Ap> zp|^TZSqnfEP{dg{;+#=h5>|);?AV>grUk)`{Dl_~Od&9uMR9D~eug^GxA(Ze_RW4c z)=x?U@eJUXED?RdX&3rbB2I?UJht7XK{%T4;cxB{YENAO#Hi7W7X&!bV=QhQb^8L**U?J{87DjLkrAaWKLlEs;h1jA>mW^(qx7=o8>j{=BCYQrIGEGCh@qp$H|$X_FQf@jN@*f(n1Pl+ zKO+ddBkw^fxqg*C&SAL^`}K5Jw8M4ZoTMxU)#34w97C!D!@lLmFrqI6g2O_ORI(fn z07`)S+H{BTGccr2ztg& z5EW85oDrE{FYp#W=qrmu*P{g`Me#wZ@&S-QV>TGFLF$rSeY)?@;pgwr2LBTd(g3_) zroD3sIU=B#4ZG?tC#TbMpF-|pb+PjnfgUjh5PPsNuhH0& z8vo!i;rsh=V$`>Y{ayabC1~ZBJc-OkKflSogzzIwG8!zzE4J7ZJ6>iuTiZ zUJ25d^`b+taC+<(O34(tsE*71RqOJk{&Gr8t1a zL`cM8$s!OTUhtqpNcNx&y4>YjiW*`d)S>-6oz~O22J~Th;Fd_+5n=Th4WO`qcmN}= zy;O{Qzzq!-Q7yQ8Mv0I;cFovG62ZaFLPRYc47_yPx2UF93MpBtqikInFEJPq3SQky z>jeqk>OIB?26I`L@@`*s6W@NeN{Sd^w~mG}>e_bQ^y^9-HXBiI-CeK}`|+}W{pEa;bjz0IwG22No-(se$l*GpgZ_qJhx~r~oC~`cL z+1OW7?k(Xh-|6hkupZ;z6nK9vJAFFeL}we7L+Mo80ny&QBUq#41e!r zJMEwYEEwpT0q}VHojpsv22^;5ic$*70NN4Rn7gvg_M3N)Z@&;Z zAw@xKq=~|j6C?wy941=8oR~l=qU-&zN~2puGlGm$uczaMKSUnp`LNa^qww1tNiADY{B&6l0VSS&^UH8<-PPua1BvKqzCwI24;8_3d72 zdoT^gwFXf*0FlMfg&NNa2%;i}WRiLatcs={yKDuULfhgskrGKlYz0BMHC-f7Z2(sR z?+c0ulkR@_{lkaf-~RSRmdK?pGbdT_v_=FNN#$0LlIItGt*-BPE zBQ7@IW%*qe;RkoasJjCWaF!*9AMp;K01LU909feX@Wao=@ay>7Pob8UDXR>KZcgQH zNsYZe9v#Hc;T=HDwxTp-YgVt30NdeAo}tLV&X~ZWx~sYno*{*~6mbwo(t%UMXCzp^k$;kXF|H$-{jBVa z4k!x<#YULoS}-qwK=Iy71Iknc)`m{@sd&Srgy$F~1}UWn{B7;76`>m)A3@?b@Jb01 zH+_P@J;PZHAo#WVl7U$IZaldlu%p9l1PTQXIlE)y0vnP4Fo8`(N4p3j^0~)>RbES6 zhh7i`c(kty>);QAbV$uY(dl~9&xVPIF*y>50SQbFfUhHnrd?-4G?LH(G&JlCjs((I z_L{FSG)LlKjqS!o?(mJonHyLlSBI1_Wo>|t;cp2mjLe~-Bc0|!D$yG-92`&zmGn9q zjKzuQ&K0LZSK$9PRTthg&wJFI)LlRhzGq_>{aSL%E4o}ryQ-3csov$e!8qh+sNy+k z(tUQwk41PB|B$>*f6ScBQGX|MY{Pb|FU7<5Z-2rw%-|5VrTz`uxQw^aw{KxXkGV39 zi%r-h`d37j<{LD0Hc7m>zwRHQ+{g~(Zz%Q8!^IrRqS$N`xt?XZ-6DnJejLj6bO}Wn z@8_z_?@K6>IKN0=2LFfLW=4hlu>9P;dA)>ODrdTzfY)1Wq7-C~EKTLPk>e;gm|>kK zU~6PCSRMQuGHEi*=p$rX{Ts5)kmS?utq576kV}*FdxAUI&&;q@Ng|>cDP&ojwzb^E zEZc05LY9^Z5|AGH4+IZJnuWALES5ZzXJb~cBPZ`8iBnx!<2=&HrdOx#39Sr{ zt&9AL-q^TE9lepcNL)CT1E(BWtSVp}#ssk`;VRP7s2qr&zW??q-@V<388lV&9-2wc`VF z3(ZVChS&HSTgPf7CdkF`^T?fskh`CIZedr(*C>pp@q}n7Xe0NP&GFvjbCcY2nHx14 zaicKehOQI)b{wm*DdKVq)J3t`$kh`eHAM!hOXidZkGxGX3ph#KvC%~4A~BIGumj0C z9l49tfgMjON9t4#em!$4N9Nx$5{;WMnt0+lxK4Zp;*H7?AWjhRQ%(Q+ZLFf7{wO!i z8T^hM$!Q%=k($T}^01AiPPIrape6C3TN9;=*s&dvV>`AkHqP(JU8F7&2YGB=6b|wr z^}|Rvsl^A1$dD+WOMIu64N}hr3i~LX=mB0v2}9{`BC-TYg#3rFPlJ6Z(ZjJF{w>eU z3}!83$98O#)}bp~J(jq)qlws&9I+!gWF4tRCD)Z(f;WtT;rodF@$eYa#GRE*l+NTx zT_h$Hp|Np<#>Uq%5=`uMO6*jO*vmS1UsgDWu484LJ1Zw{sGP(WU1TByfg^DghvlTm zAEC&LxX3T7J1Zv++e+MG*+lF}4^ld|_ANhmcV9LU8|_0O9~(O!hp9wf8hXsD5<#{b zM}u$|IfL604~JDzMotZhj1i)H&;Bcp{|h4Z!!R~X+wqQm!)kn zs1twIX{Z4v;>llM{wX4D^QBz3V~AmkgHVhZPB%o04DAc-6+&z#Cn5f*?jj;Oj5PHj ze&6vA&?0<^5#pcpJ%NZGQxIi42wRYTX%gbM;|pgt#5R^COO!PlV(Ep`Y$C2*ywU!e z2*vFIO_FoYA*LZqg9aQCDNg|a!~iWphk%uEv=%)QNtp`*O=1@jJ1la&5r$ZjS%O4n ziH0d}9b&Py;z>~@IpHM+vDkXt^VVS@TaWJFx~cuvAW4QZA(+JC%}Fug1}&yD-nyaq z*7+Z9P_06_CJB-OPRhtcPOga^yaUgSeNwu3(okX-kklDddZkaXgq`GpmdpqMz1q;wuh zsaK=$sC{>#Hi`)$D48-{3Xj@%hM5Y*qNKhg^$lu6O4%oR7=AjQe+px>slb+V>9eQ6 zK9G+h9Wzl$F11DOSd_#>?x2)BH$KYt2};Qfl!61w-L*bfY=EOvHZBSiN--(_Moi(? z{a$+eEB5vm*e3>V@tc}kXG4XuPg2dtxnl%!hX#1mbDZHkm2Xl?Z!{sZq}U>fNJ}J$ z6v_A~*d!Wf8Q?~l!-O)!1R544cageqbPACx*5@)}%2ULSMcKM2T@=nfDGhL4uMo5)>c#G5!c#h5N0Evz~WYQCdO5UcS0x6^lt z_=V>$dNxno$>neQZy)>}f+7pPe@T`a7)3!WIC|Z@{3}UxLB|dd8{FiKtMgN1r6kTu zu~IGZo2jwlWSkh?DDm8y7=AHMoE4QgyDITQC^5*L(NhY8reHg9o+F9KN+gJsqlsX$ z%6&-_W1=YU#IiI2FLB}ol-xzCf`6*NY5s92N@OB0jE#<{HO>jx+FqYESDV@P${3;*P zqQIa@966sTaz2p{auMNzAzdZ6lo@F)u~JqXWw3P!$=0bI4v2$5f-sWC);SDYcaq;a zZe{CahOK2`6V8DtV+X>dF1V!dEf@Zgwjq=Zqx&)d%hpC=log{NX%{f^fv{-nD1oh! zZ6fE^swfH*q_tQ#CUQ8f@nmunN_4T)aqz5(%tdMQiJTr& z7&NAQ(ql>&xe3M5*exji%9qv;RzwUrFi!R;3}j@i82?D=F*-~cIk`^hFfcaTf&w?G?au~BGp$I&QiCiU%T6`>+e z9Z-`vjwW*)P3}0F(ggV}4jsyjE~SJSB5OSNX4Xnpk#Ai%G$xJ=2(#Td8K!g*JN~6~ z5fT5Q=aqVvNc}=NR5tQKDFec|$cczC#8B$jFtzd1$f2?Zjfou^vvE-xGzK?U0dR%W zV{#XLwh3&}+87@6GYF~!!!#srQqapFy4Js%UXfn{)ays=B`Qsy4kwayTIa4}n#^E!$!)G#3U^02ob1A!uCw?Y# z5j%AzGT00$FaCtH-H>h#EwkM?W9BIm7m*3&&=gLTDGY4mPjBp}H>R3%3l}^tCEDX@b8ze$^66PLwKya9T^D^F#6VR5z#XsAOV2p$_T%IcYSlhtlvj> zIBYU+%!s?7RI@Qn|2?5KPehFz z{_Cqn>FR&QYj~9_xm+b%y}Z02&JZ(q65=6aDcVpGa{xr@`?&eF!X=s>H zXR?53#+Nyvz%)(~7kbzXPery3=YAOEW{!iAd1c34(~j460Oh8^d-cFstWSa2RWI#w zY_GB!5ICH$HO#?W)8!m!i;k_gJv5agSgoTEew9Te`k#mot1qooBX6cs(U>wYmo5Mdox5@A}{Wl3Y z!+-jPf`#X8#HU0nP@JZY^$wwUZyX}v|%!$vU z>h^FtUr5m5jD=f!ou~a>juakn&dbrYMGVd9xV!+A1J^PzbO0FvUWbuqO9jy`tK#0+aVwg44$?Ir+}g(oCtom zh*kJ1qFTloFrJ0>W^%SeH)9(V5vV%tK-Xai8b{-j**@D;w92v1q60XY{0 zoy(OI?B!vA=MlbjmJ$FbCSs33I*460wS?=)6N_&hs)3iULgs@J_mWRpo4zF9V&&+N zX#;`rZVJqao^Q);l(P);y4>bnexEC7jMoFAu}*sp6C_z@UM3ZU1E_3>%DL*LH_@xW zJiafh#h)2q2gsei?G&(c?vTPvlSzPV*80)Hzgh$#GGOmCNEDKLK>$MbJk%rMJLGoF z%e8~SAy7LLA5h%>LpxK*r2-pf>0Xf_Fm-nhU+}&GUVxIdX!<(YSY?sOv_AEWcg^-3MoQvlQhJkQld_mD@}^}NXDQ10NO<08TX zYQ~iAx&?qoE$lD@*anaG$v!7dGbRp3#kC;50sz z3X1IE9qp?t=l;)U8X!I?J}J;Wuzr=by9ZfmVE8Qe88^Foy)tBC?sywX^_gX*1yrAE zfh`oGa-&s0W$sLR2-}d|^5!71|^M z6Fn7Rbm-8gpT_&Stw<@lpAbMQ;uW(%fh3YArEe5qghk{QVP2*P;t(PcL)AB<+(=X8 z@?duDj$62BD-MF)NfTJoYkV0XM{G8zs3v70)gWnHL}H%hIGc#K;q&Rfla|^b&5DUZ z00;+0rmq1ll%~gs6xaqiRxd;$aYDZ_kwzDrpwVdHSW0uPmf~1;vzH9JymHa;w!cd^ zAx!Q4awmXNzS}N}(1WPZ^pyq!9u};2)mGx?cc0$<{N~4Z0a3fJFKsQN8;;-(Of5pG zK#7uyS+3{_JSFrY=I~hrA9#f?ZMPccErRqL5}I1#l-fok z7(_JS27%sG)7v-DT5`Fk6nsZNRaaO=1IKheSCT`4TtY6509?{2J@fwP#;YNX{`R~5 z0`9mfPKy?a7a&#mpTFKoui@YSd<%lo8O0-n+#@uyzO9I3yIdf2F2J|B-AlXdJcj?- zy*7VsKK~2+B+d>i%T4%}4au)fdn7hVx@+IURkApoR?na$(e+xy^?FC(<8=is05}_| zeUZX-zVD8sZ0I_7a%1Fi101QH&O{>epMtGaUGcDAM=8e8?505A3K{~^BPG8_?xSS-4aC$nfc=c4dbnTVU}{2| z9rBD`#~vUfZqxdmBF;#}F3}hKkB?t}{&lE7ge&|*afAN&@aA7%-+z2ZY!Yj8(2`IR zg{$<2s`~f{*X}kVftJ*AT6;`PQiC88X@a$2*9PD>k;3&TS02@!s>6guvepHsDS~w# zT3J#s$U*MENu@2_84)i_qq8SBa?aA*AKKk;l)K!nhjv`Ds0fOD#6)FR;SZFN6X+6H z)&dy`DigQ{gNa!7CncXW-C~H{albw&7pYz!p;mzt-NBl*LLOk60%MPqBm8{no8 z3?R)>Vwc!10&EEp+9HMnC#hUfPk=_VUSw;;Eyc=P>PBFe&Tuy6qEiLtn5OB{^ah(rPi>QWQqgMZr@dCP+!Ea%{W} z5bbgrcOniICbxjCbm@Q*17rzA+gpHhwv^pv0I30!>%$oLNt+%rf|L#|0-y&lel8Sb zI!2%+y|n0}5}R~IFK!s+>d8eK6reP05)}xBp~wr+nZ|k@Q0oodxs~g<51+bY#fk~8 z*9#g#txBnLfiRMjc;JB{UJ1!KOK1QYdP%HXW^kOlusIkE!j+Zj2y?oQ##;! zvH3g5rIu0wdpb|mtRLFrxgF?kn;>eivTCt_Uy`*8tu(|U2LlXo-+(B^&PgHcf!pVPqSiI+CrcdAlL^N!prsi2tyyE@B`wfB>j0i%5H7 zu|e7sdWsML#1Q}mx(5h*Dr2tJ-qE9=s4H%3K+r7^QW#}H#d7gK;c_0MZFd^NrF&JR z5ui^>tAt=6v=lMJLO@lASejQbqlN~3ISO|9FI~SsYDhJ~P#FBabWJ0faCG+5)y2u| zwd~i!cQ_Q7Q*z@-X~G!5F!sbmNr5^66NMl^(4MB263dh75qXF)&Fe069^nlTn@& zODjscN+gwH0BSV86Ku)(VMW%%1r7130)c6e=cXb0sR8u^!eUmru%d<8M-?%dPe2hH z{Hctb0u___1o{FvPqSpvhLo$WC!+w!rxBdWOLds&>`nF)hFmUk8!+HN_S1T(5<@;I z4GLTw>Wg%HMMx83JV(lSA{!k-kw*}iWclIuPw)Qv{libP zk5V}0zMwFux+zmgH&BF=&OhRyq)`(pO2|Bo%n9%!~1`{ z`~1i6zkiTLYlDCyz?XfUjQB%6{QC3PkAH+77TrJ=QNU3i#K;{6_!*3iCrX6gwh!nW z^`jgc12N?pIAid&Jq+P2o%jhIc@fn_9^QF5-G}*Gh8IoYx6kjte0~4vO+bMUgswC) z&r;YCLI{j5IZ$?@-74{SLg;v|i`y4)7^yoIW~;%0#b~wTNzy z>YyTo3d15IqydCG@$1VkFU6<0%o0MU>Q#DOgihg`r&a%os0O5PlAbf+eVPGrzgyuBbt|#Y|o`z;Q4w7$9r|~$T1V43;hmNkDB#*EjJ$0AM z{aPKu>5v{XY0Cm*wMzd5MKL8n;y_!q2C0%Ko9G`A(jt)O;a3$$a<5pegM0Nd*D;0k zXETZeo_Ywx4U0e@Uuwe>V)Od8btD!yP{~oDh*3ON(^e|T;;QgqzMcTSk~SVrODm|E zVn3~2=$84S-GukJ(e>H~X_oLW!B@;t-Efl@y3|yBg@!53;r+0OH9H<8=D}@SA0d6~92ZpYZs(vS>v{a+t8vX#HO7@ZZN1Mm3J7EB-e-*;0P*Yw$;cbe^TR(d|SG4Ttl|!UCLH1rTS)j=|^n z%>RU6-hF=i=ZAM+z`wd)TB#$*ZaquAsERM&ppFX10^@MLfP%}6r(g|ntN^&GRyl&*`3-7s`D%@UHS)0rjFHWhNFw?@@sNiV z!;KiWRV77*3Lu)6;Yb?IVL9SmS$#O2WxYw-ftVn0n8tN?ls4-DU~WkY!vZXx0uind zWFsAbKOwjY1P6>lP*j%~cq|xH%r3SN97%#`+LqufMQ8z>g&rTESmU8b7f{5W1sa%I z%9w{jU169lxzG@MG6*jE3B+CxKnk%SF9^V5hq4_F1IWE`b*vQpvfaj9`PP^gs zAl2)5I_%f|y>}cJN-tHY2M++=agTUKhz9!sloJ4S47i1hASINNhZMOb1MAV|zEa)&#bobGA@?LeoFusVJnxz`5^fUcm01{*+^ zU5>BPB?L`uwC)F>U(zOdRnnK@j6wL4_RDMdNwV~fxGX~Aaf6_C2!$f_C*}aVV&;txh&*}yVp*4EZrt) zY|o&E4TP$L4~FRzCM0`9EHG7pP!c&*Q@sEp2F7ehh**DV*DKj!`@gZnwh-qAZ)5g{ zg-uo|M)p#E)L^hZ!X7W1CTS9z$RIklOyx1{cIZ;=8;p{ju{Ky5QiX_+uGDH=#QRd_wj*&~=+pmZ{1JXMn2uv(!Z1dJb?#{|+qlc1Rm_NJx1M!P61jgumPNV{C|mIOySUM?%zsXKD0F@r(A(XW@f!+O$V#{gL192HdWyJ0!( z@25t@ewXG_PAAcp^t4)`X&ndpK~I}lVF9DYVJJ*C(<^X#t);NYM4a!->wW(SZ;93! zub3*Nx-;AwOixrOZmpY8hJvy-Vk!sWYV)~+xKtgXXkEKss?I5E3F&J3_T9#=wz3b< zmRl~73KqaK3V>a4rH)W7Aa3kU8ikElT}4L0SC0fX60CM4?MDQR0;i*t?TwtvvHPF>&g(dHRp+nueqcO?`urxV(l*J-yscbU{ zt<-nbb=@hrZIJAUdn28^2EA+*B)DDBZjBAP2DG2j*Af@lMK4XQJJ#vjT4`@}&37U7 z{eF^CYLJ?%z74yf9&WdK2tWM!_3OLOKYa)o0tU|4L`-bk@dX2O4r?QmZNe*-*#*{` zdU;mP6jGAkNpj=t3@T^2sWNex{lh~_fn-d#TG}xLf{}uSCy^YrX?!uvn{?(dxJ6T@ zPE{)nNbu#**uOso5NS$sD_!K_he_%SG}dK_PFk&}c!BX6Xm2qw|A4K%YAdxKUogKW zH2~Z|0Ng_KmYQ{Qm=Y`^P^u~; zt|O-$WH+S_i_nP)V7>9*Qw22G_|m-YrIg|KiGS;q1IKclic#PyaFG4@avEz~E(~AR z%6dEUO#u;aFI}TT-=w=#p%v;=hg!O`oqYXCeM>=oQ;B6wjZx}a$FwVy`Ox$jfJm}D z2MUgpm>}?qbRZnA1H@JY-<^s8Jrftg$JsEpKn~Rp(f}dx7X5Si1ce7K=qk@o_~G5B zU*CLu|4Ekgw-zrUMU0}bI!9q;omLuN80nB(g$bswvIJxMJ1#-5yx@|a%sVuBc(EZm z9#O^V#X(9CDQs)W$MuUE{ov%$8v-c~gCjH9acn2m@S{UL1Jv7a8WsLF9BMdGfEkCs zAjS0rvx-2g4@)GEz#T&cDRhTJH%e7l%RRZH=MTY|jHr|uCAdBoa9xyZ!-mDAWMaBl4lUA;g=Q0<*L>h5&)s$9=F-_KI z&Z09>tqYYjm*GMW939_CIhQVn(7srpZ3S?t5J*O>`_8TdXKg-8wY|qyoBiSFBsBcO zJPw6P{vz`I{t=g5sHRs#y8&s(ACz!rbCR80l&Qgp?)-$*iGU3R&Qe9UI0exL}%5*lsbrHK2Um zZi@mbY&S_>1+id6dvdmMrE_eB53!Gb0iYnr)EHgM(ZsZFI z5KrQo)&=xsNK&r>v>A`eVNCb%67#Wmp^J>~IbzMa&!tikBU(c{Xo zll9`~62*PJ%&#!OrpTuKEhP4GG9;J*-k>|2I0nW*dZmH%NWya_)z;ZUTZg52K(dM4 zMQS47y2uQ_$L&~5Z{qNn#F;UPGh>piMUARZ4xdtFK;~nqo@||>v^A`tiO9%&it$T) zo!Iy8Bs_WKH~45{&;S+u$RHphjL)`lz|zKoX;mmuZ|nHIt$k!nh-72&bSjj?S2zx^ za2%jvxHb+w+E}EkisC797pYC&@8>8xw_t{k~)Tp7g%L1=opKrx?#KbCEj6 zFL%KurQXWYIZqyfJVh+pY|KH~W7 z;B&tPxiju^f0}YXu-uO)ci3I-+{E092@{I!^KaR6kz0tnLHxFk?Aw?i70?O}70UO^ z{OgvHawkOQk<$eoahF?=aFXGDjdVSdEXk38>`RfH=9d`6?@9AhzMqv68piyj`IRmT z7Y^~;KCymJQM%yQl`y1yKc)GV{`JB|?x4QRx0Cw5j2W3ZCe!1h4eysY)ep42Vv8gq z&yXMzBoSE|mtc-SqCJJx@q0pmU*c>(dx%qiuu^BwrN*B!q#r4L#+6Ggrr2_>d?4qQB@*C#F;YnEj110)Tj$UeW%4PmFY=G<2}`_y zPyFB$FCIKHI!U}ZPy8$r2dySf$4lf!B~h+|cQx@_mw1j&JliH-z$ebsO#B2BznO`J z*eeK7zwW2wY|z9pj)`9uX@nH{MjDMk0%k~#4U8xhRTq0MkNv{L7A3EOygsiuV`~u@ zW3Y6QIZ-fnS|CM%q{7gGR^i2dJz_6Oy@jJ9ceG&cL_x(Erv9z;xx~L^m6;=dP52Vs zAn7GRE`5RIjKR_cm&6VvjQu0qjy8*&F<3s)g5>^fE}TCKrFD+uSrTs-88@(SIACdT zKqUzpiZbGj-n!Tr98mXRg<0fGO1TuLw!Mbi4=wmzW+D5+c5knNx*NM%!EX2Rse46+d>7jxx9{+3xO!2$dYmYY-@sIkl zBgAiYNHoMhpc4r^p>^k#^G80;c4J7Q?PddL1j&Dwc9|Uk$aONT=Lo>kIe$O^f~>R! zS5Hn$k_c&tM`nZpD5QS2-GF+2Rtn|($R zEL{KtI3)5ft3=7gLnm0lg4@ywgP92&w6+ADFsSQ9EO`_xSUPHu-*Qae##vL|Bvg@e zox;I_Mr7I;m)9tSsf);PgetUeW1=*nSVPAn+H+yZ!i|#(OBY}cN+v2d&Lt!w(0O+d zWlVNqWH>@=#l+rPRCeKakvPq;bWs?@P$`5)d@CKbR9bUbg<%bqH&;4yskFi_E*%kA zItQ@yQ!Wj7Z8XDF1#F#SN8FgmT%?XQj2vP})Sx25jb<1byHL4=g<}m3)~A5N+;N1Z zi^6e)1RZM2!YG89!3Q(I`tlSB5W+*ddki5qV!a~=w~ibvP2>(CB%hEC$)|`NIhZ8ll!V;1ePdLg;(944GRUtyn^$`byci zq6f1W3B*DE6CvlEB@_vgF$l>HwC1!?3AZY;nClpsGP4H1F$iM=4dze2U}_>Kp3rz+ z&V^Q?D`);u>U_b}zn=OoQY69%74MeGnP;T;l{u1#LUPw(5s~BZNg)a(2Ms0;8YGp_ z*ovv4h+-$~fG=nt`E!*z+$}X2f1EmTGxc&*8;gmd2e(^i5N0m?BVrD{Oi8_Db;vUX zK+tjOch{SkiYL^)Cw{2fUocU)FkoSduP5Kq>?JRxI!v}3BoSqaBtjnzF#c{gG^-_j zd*VX)i@^?4PH7EF0tB^Fn&^230wLjnfN3a2kY6vIHrRb<5dMvExQ%Xq(@%oo-}r@2 zODvwC!tX!$I|eL`R#@>6B#$ejFqKbjE&T`FAd&ke*@S3J8Kf|Gk?|u#$~q@o`GrMk zf=EIUu*x=&A$H*r|;!#0r)M32?hb0_-qC z3b7$V!8k0D2s@-}2HMZxzP-Fqr0KVBCbEn;!^eZDNr!Wz-OQoQn5d#ScH|++h&uEX zJDl6-hlLA;9y;q#`-z4@EFF4SxJaC1xHVCjfLBHwJBc&4{*{pp6DJ#HMmAJ1qTQz` zf#-(<3W*W4K|>RnvkRXPL-GwHEtey2Iz-Ogjr=x8UXMn8I*~u`k>6$?B2=N@vO3a- z2;;~`RANVHn}|&~vXEyQJll#ATZqOk%$;4Bn9y%&iy`u+V&vn2k(+o#-e!y( zL2bezhWV3Sm^iy|W9-81QjoneOS6ETtp5-bSh%*=)*jB;$h|@brGA$pXftU5p!cQIt$MYLllNcIHRAAw-gnI z_??RQ6e);@b{2)-)501az$5Cu3P<1-@e`^T`O1-hWOvXlM54lPT;a^P!n!^th(|1K z7k+aK10)+BaqCpXrzlP6*Hiyi>g%L-Jk~0WyfJEm`?9OyZ0yMWM= z5$1k5eZm|zK&7ma%bx0e&2nZ(?o1S$%%GZa=!@P290#&vv30A)*T&9 z_a%yFjU1M31V(;jS0neQJNGP+#oAam6r;l#2~6}S*T*oyWYh!8{0KAW8)lwGGcTGl zRxX8$C%`dvZlkV)zXUk4XBe@a`6M|i+cEKvVrM%V)-ZG2XX>{pwc)GCEl5m| zNGn&JejT~b2(X76xxf@i26|^R8akk^ugc2CFEfM*crV4J^>z%|) zT8BlO;72+FZz6WuuV$YT_HnWT*9!dZ_Q$&U6dKSdpjq)~DXjKZVEc=kEC7 zw^qdeF>mov&9A#=e*<0eb$&sg*10d&`+hpzroG6+ z>308b041l(c)3(iIy?EkKgv4$`;#I$L(L+2s?n%3X`yZZ6doAA1|iL6S_kykP9DXxh9gJ5Vg1VV5q zcE@$6gv(ALmJ26(0#mch>)Cj!Sb0?A&6jGzRQp&yo2G8W0jQ9#VRq8o0%qA`cDUTLm-r=lNnfPL9R9+1 zMp+gw;dWoD6=BD>@s2q1BK$)|EK6Q7jcYix1Xwci%|s?*Y{pRvVij`JZexF*UpSdi zBxa~j;RebFxDGejKYroezn#AA@9T07H_k(^CJ2xnfUumF70=HN0g~<9_Kv)iJpp?- zq@@UiTAwQuyUG}t_tFF@mGU_4nq>ggayTvsOp~ks`=|GB-vDI^4%SXitOXZoCr8j8 z+NG*{hzf~vqhx-4Nk6z z&A4%vUu8mpnz$tF>a73#*!;W8#;`8;`@X+0P6}|$_O;!uz+GPN6{o_l10Km^+c+|F zgjm`}E{h6mSriav$SlM`V!pY2LmvGDeu(O3fQ3NT1W$9lg!Obh^{BGfeRHhOnAf** zGWSw}oT+hLz&%_g8_ogPFe`(lhC?%6ihzfxx^%Mod~Nl66M}AJFJC7^yTIGK z!|M+b>SYU><{61XL7kY1J@We%AzCUh!F>TYV;Qe1F4Zfknn)C|$cE@^!Y;=F(~3J0 z;CznvSQYXT;(IV983GfC?_nVuh``OMny+II7U#$~BE+WAOJ3H%TAdL%fxASE1AhcW zqcI|F>42l0rFB5S4Cc))$MI6l*zd7p06hf*3qj)K%-}^|CC$O!DaBZV;G-BzI7kKhd5Z1 zm7IH9Nu2=(+1FtlW)0KKBhC@2PwNRZTNB@b{}W_526M0ZmkWd0<`C~YXH<+rvKk=+2a3- zED8!vaVOcco;rx3#e8BByYq4E0od#?5#2zZJQ+rqN!_%9zPXSi27V{7P1Q_6ni(E8 zFptxxLLtHznMx6rC3wXMG2$_VU=R+(zLy)Iz|X1LFSmwj3beE;-c5+=awR!*kC^Ql6fr{26bf3) zc@6}A;+7E)8b3jyi3RpQk5GD}O3iee`_9!^76KKCu=+ z4|3{Xy8bL>%f!#ngph(<73i~4&@mK!K92K|B+290GDb(LslL7+K=uTu0c_SIm^s6l zK+h}6Xo!({m2a={XdJ=3SbLH^#}{ex&Bu6A=IPD{M4!T4Mj@{_)_*M)Iz;CarByHa2$ZaD?ATDz+&IV)Ma#%xYNJuAtp z#C*yTjZ$CFjs6Xwxm=cVZtu$gn&(<`>pRIT%!d%Xs5_~g=B5f?-v0je!<$b(67*R! zukA*~8P3u!CFKCb&k-{MocJlCx-gsz0_0eT{T}GWxq8u{2@%z-0MB{V+~f*y&!#;L z3iljQ^(y9*1qcNEz$r9-Rpfl0kTEMz6V7*~eImNnu%F)npo;xGl3;86&w&6?1vh=E zJkyDg2bWtvE|)lsjr>VKDOsS2iQJc@8-;>86I2?4mkOu4lREG+gC;5kGlEs7dt0+H z4oWCe_`FK7S`7s#q0)K;C32MqhapFLpAe}U0D5E%^!aO=6?oqkCI=D87ZG7!9q z5V*9XYK@fxDD+0~LHJB$D2SH-r{Hm_O}wiJKvME?+c2H3=Tm?BCZgG&L0$sRk-IE=AlrfZ~WB#Zdu2%IZhNbe!+?w42EUa3d?@@^ zJ;q5NH6R^^e%z}-Brbpntb!(BkA*IxflIe8N)yPAQW{jCk_6C|@Z^c8rH?QD+9^^1ZTKJUUdEu8R&(=s-N|aQ z(A!|&DDg7#+ghQHXu|(|^Ci^-le`lM>6*9APA-XR3&Z(e|MTYGFhs>tS%k^pvh>>~ zDvG$sH+U=mEqS^o=->o3j$M!9^}?Z6GK|CHK?Lj z&3nL$G8X>oLA+OlHvw{X2ANdK1n;yND2`3|h+*hp7a zswXJ9A0U%T-xWy&BB?G5siO%H9iWbOXx?5=0QYym%U_9Mm@|kSiCxzYV>N(nicm%> zV$-GHMmXu2!y+PpW8soRdv6nkm5zr47^P>1=wG|~an7VjzDngibgx?%dH4f`Qg@Xj z+4slOz*~0R?~Z$*84N`#o0JEa-YHaieb6+i*A5s`Im#-gXl27v%U=Q90arzdq@c6X z*(1iL29Cf$tmu=80Dx#-6jlnJ{U6n>BT5hCGX}i>fv`U5_=RhwMhz|se1va-CrWT> ztTfYg`i?bC)2IAjRD6MsrlNsnMGd^-@=P|}qcyRE(9Q!y1@t?GlopRJ{K1g-3CBWF zx!6$1f&$!AjExX-Ixdm|iU?_H%wU^Nc)){HHWiHpMpOvWyO`E6O71`sv7omP(P}v) z@^W8pyEqro9x9YjW8V@=JP~2a0dop=3q@7yk|tq1pE2z~mPkVrDU1y|j8d>lh1DX3 z;jwEE3D~4}Eyn^{y)7ytIk#JV-=87Qy6Hh0x%IIuf^=~!Hi)G!oq@?05ZVO>^F>Yq zSkw+AbYf9~e;PoIx)78q8RiJ4AW*42oN$bb${&VEEu%H$ouNCANDxx1DE+c&h3f23Q8EDr@<5IGx+m8NaTl`{}j}K%ESG;1`ycZ-K*x zM|3%;4pKp`S29#_tstZ!A$Le&s){~s`|3y^kyHK^)%0UQ>; zoNGLo0IT*r?udv3vlED_a)x)(Q_;k49j#hY{GSlj0upiX8>6Z6M|#; z9tc=P3iM4;^OOrH4N`wL?MwKm8m!dy!oY8-F4m&hmLRNF?6v`{ia{O<9q4sMk;@}P z*6P%*uS#D8^-S(+q#6w%G` zYJgWDSa*QwNyqe3J)}f=O;spa^}eTtI*6}8d6uNW;-83HckKv+U1ua`z>?~U$7!=6 z=v6Ay>PdVB^mMN7@N7YU{jSVZcwI~jMJLas3F*J8h`^AY=DJc8td!Ub*XhZ-hiI9f ziHn^R6;+&5oDk*;!4P;LWocZ%-kNsVWZ6L)Cfwvs^1$vqazDG7uP4#5L<1LRGaQUK zd-0PY9o8|iIS#Z(*fCkIsvypCv2cUPkX?b-6~&hUz*OErvVf2qJW+r;1iEaaZRAUJ zkox@EQFMFhVG}RQrx|hXtsYc!tQL}bpOfdpB^s6A0%LR1 z#rZJqw8-tH+XgSF&?CZG9^%l0_qH_bIQ8A*!Maq$1{N=?DEN(#dP6G)UKJQPp~HhR zfM^0>5hUj(5P;J{NIM#aOFagK(7O>q!UVXr{ry@IO?zhJ{HZ9q1$bQ2YVTVYrHY1I zYF`l?F4w1hIn#iomz#ug2pC$7QO70-t;N{r?ifB0ucALg4-6tkcl+w9$VCk2O8s(` z&0}bR)bqX~UyY)=>$z9W9e72GdOgT-$xXyaSpGjX)j{R;Gl2!#N};Wt&jND3{O z2q-IdT=&(hw35!FwD#}P6+gpD;Q_y+vt0NY?FO#bS4iPJNS2eEf`&P0Zgg>jT5M6r zfvIr5Y|@uXnhodw?%8$z4WpPmE+f_ka3}Blp^~n7fY%Z`F5-*?(e+BmHD!X8FswC> zQgV@Tdj)L)LfShA<=>vsP&juOA(O(00NnXFE)<>&i#x|Aq-HZvZbDJ*a9!j=AceEk z3LNl0qXEw!B<0dJ>c7u5PWD`1_k2C~8-bY}ak(T&?8(WUS+W6-yNvsN3n4udGIXaF z38De<41&Yl6qg#z;OcrMcjnA~HH@=J)$It*l@{8OH;tO_x_*;71Lj%bB(0ED$+^f7 zt+I64mOia$%Sm$t9NjD46`m&PcjHznLN`uLL>XDS*CTs9rQvk98xv6ut}Z%{K;@3d zfkT)OVC_=yZPjUP?{RyH* zGIeL18br*Gq{)kyY)aW}m8r`o{a2;z=3IioJBsVL#1vf{sW@UNbfT=V?GA70(Rc1{ z)qo_o75^cQNd<L<5iC-=84Pr+J}K`ab|sZhcOCO=Ic52J-$>Qi4X-m2 zslM}af%gXFgg0Fs1`q&+;hchLy)LQ-I9p(Nh`;TmxdQ>n`aSTO1eznDdp^MOt|MU- zXEHREzUD)5J%L0Ag&I}Fh5fxTbW;2AZ43nXRiU#8GS*xEOZrsusJ=&a_vPI`b(u6F zRY+S%#lAJc@efsU*D3J+i9)WVi0&-Uv+VQvCv?ZdzHN4OrHo<_8svfDI|_&$P=6p3 zPg4J1P*@#linra0=mDX>ia1C&N$%=#HEiDTI-aE52Lu?+dvpYV7+&V~^%X)9G-M6q z%{GPl^P%f>Kawas9QN=EasDs>#D*O{I)FGPZg^PbVK(k?Y`Eb|^&}AEi}hiw0qhr5 zlUjAeOq!vV9d;V1`b{Kg+RyZ-QD4VTO3L*6f z{AVmw5i1P`_N4$DmZG0TxS&t1biP&KRKT&B4*0@FJu~EaP-EI(FklM=pDd!0M<$}K zS?(OmWZrjmJ@nz1_+MG`XO$$9fujC?n6kJJhx=6xD-QPyI;U}vi+mlWW)27GJWhCN zd62t|fnQ@6gSWf3gb9OPygOkim$yM&Mm>Q1upotF** zlrV@3IzxmWDQv>rKj zPeQ9J2q}72F4^sl5TKpS)d(@uapHhx>~tnbx#>85Kqj*6j^eQ5lt4np3loSMsA_aD zX$q(U)MmLbc;66y7D1{mmH@l0LW%%>B<+g>V9E2ErW;wZm!>oB&)7V=e$M6+l;j#@ zz;L+iSY3sKw67)0$yLG-$^N(yn0%J1595#r4DRqkNja!Mcl^);hLE09__>1(uk=Zj zu8bq^dcHX+BiZE`8|NVczMAMI9f8P&s{0mwXQdCMQFDEME zz_+C$)LIc2_Ks|2VscTrNR`rzIAlVYQLs6JnSuk@O8=TkQI;!RBZL1mjhBD4)5QqP z%_s*fLW)>Sr~-IdNi?0=X8VZoyGD5c9Qy+$nV$0(~rims#J6=xf5H z#|g&3Eg8#Fr^|UrHK6EaxpN{M1dYEt%92 z`X{t0)@#*Gm=Enp=ANqGt&75$F^(ewF6cKA(nBL7`|vjs^Yaf7%xZK10Vt#Ft{wEn z6sXLvcrf=3jHIsn7kqa&?9Z?~mqtH`>3h7>BRajo0P|kjgBYhVY%`Y(m3o8jD>*p4 z-ZheQ3~}ZZ9|bxmSR(Z=XCR20?sS8JqA#P;o-d$Y%LA@-?NT??mBkcM6~_f@q4NuD)xT~h3;Xbhq*X>{np+Z=@h|yM>>-NQ_ZOtQ z6s(DsC7<+=9SEI=cOTxp{rdU++t4;IsH)cV;CpD6M^bD@Lr(mmFnhl-$}Uy z!G?uYgz}VJ?i7Tpx0O2f8Y5bI`fU=!b5(9fbGNtd&ARN4*kZGyaQ+-XDRBKG3$cnYt^ILZa2XE&Qm!=-5EeQe~@<&Xo#jV;CbE!0Bqwdj|82 z9;{3VSZYWs0J0f7ib@A`8@|Hl1Oeiu+Xfyl1Wb?8&KJ=lIcYj~kwWZRShy2D4f6ts znxs#@w4UU|p^hzv6dN6vjT32GG^hR~^-KfQatCiRX;;Z}H_)iIk?uVbSURAQ~|;M&W~EN#Q;$w`yHGp9g!&A!&R?2EWGhWaC9 zEmc?3KClH~qt|8L9pxzTwjM4ZB93Rg$P@u@$s1OZB6HP(wt=lQ;DJqhm2PAU0dsJi z7C6-$g>+(d3KeA$I1@kOb*hrCaTCD!ZZEuYqjIg6YK3SIFWp1d)?!DN)Qe`Ewrc9J zmpfZa&5l~Rsio+tk!z~k?m9^yUP?o$l5U*{_w#BvDtlN6vE~bV2+XckLH50Lht9)# zn4MRhnTQCk25fr_oDrzg0vq)4=FP@L3IsO7737I*(qcM)YosJ?Vrf`oSbazHR1kr0 zk9L2I4`)#=`Z)60x*RagK*R;(drQDGOfueXkq*>xjUfi9Zl*n!HOuine+#?m4iD~9 z8QADe>_~ftFZNDHy;=zQC)eOD-kr9Rfuy%~U1!?n-GLPC3HW<_I7#0aH0JSo zpI8^}IOTrdnb=`dcoho5GVBoW{&t5~HkeQY(V?3H3O8my^Y94dewe7a)-dV@M8NzD z0v!0D@2G6+7Z|Q{3kvN9sT%{D36b49BFM)B-@u5FzCp`#2d=$=kRu+iGX-lm5oevx z0)+%YBsN7=OJ6Cx{n-8d^&evily}oq(g59^Pj{Mz?mE5%AY=r zUF0rO=YMZp;94FrS>_5{I3d1gC45WW<*4t{h2+g&-hBMy{qLW!1a^sXSAKr{^!fPb zKI{(1eRF!fOD`P2?{3d6koY~zj$7&0-4;1r`KA=Ha_Qk3iE4I-i93>QNcZM6ytgXI z`=0T75KBgO;&w3n8zK_GrJYc0OvJiGF60Oyz0($%R~i?X!vn!qED+#}^s*Oafun>5 z@%swesiVIO7b!)r=CXIO!lN!d-V240!nwnw+q}-hF?8Qm>Ckjs4*TG^bk{ z6P)6_&N<=WvLwrZ{nnQ%N@3>{?9v3k*Y|_e1FWTf`18YuAAkS(izC1bhzd!>3GdDZ zh$9;(KdfEf=tlR_W*f1srn$!il<$s`!yd8@z~NvrPwOjRpNkkqv=1OS(}@6a_;Nsv zXY^!i=J|f-0^g@O%L_iM9`L1ySgxd?OF`w}aJ-TkfD*?WS+1i3aB;ktQ@FUKP>;)h zr1l%nX9I@=*ep#aB#3UeR>Xu~^g0n7PBCC!h(f_JU@hWQ4F{61#}+f6r4v`99LIA6 z5IEkyg!=NL!&oBHc+<(+m;EkD^OWH47uu}3dUC>*3eK6;$_K|tp!2~gXe1?Kp2y4V z0>trgq*(_<)1&WRbS92?n@gz^@+jdsqY5qc`pg-1 z^+_@hTy-2Up35#eyb{A*>JE&$g1{)!M3(pk-8_i)^%W5E!)3%2Ckh0%KvbC4CgNNj zSMtU&j85KovtlIS2N8^w`r-Z0Km7jt*MBLK9N};fe0oSH=e+(}I=z8XB+rqjD!dwG zA4H@SY1j`1R_6Gp3#sO;r4VM*!A@H7=Ccb$ zpG!8zU?Ka*4YP-+P7edbc$}Ivx7l}qLW2ogFk7w~?}TfVUdUf9*CzA4puqS}5`Hkn zMKpL3!TS@Wh?l3cxkJE$PRjo`E7})ec=P4XcdYr=1(q~jjw{M{Q7}`dXeegs?MTf6 zA>C&X$*+86paP*S72*r3!z!YyFpy##^CSVMoO3M+ENA?v2)X%3xmQgkdzub#MV1~~#R14Wi0GI~hLf0TzNZu+ zCDd_j!yELQ;QdowuTm1q6DHz{X>>|RM@9EW!RRRn>8OjY@H|Al)=pPI&QZ@GxI|Q^ zZwMWs9xE}OIb7N4JPQ>@QwQd{8cr3G2j~wm?%}5biHR?ha7v-%wSunf+xi0)KE17203OK`K67GIbtjc~Z*HP^H^6 z%F8%xrQsrv?kQ}?Wy-Gqn8UW)tmVB}0t4g=ep96UFWUhwK1K@Lk^nZz%VC@9Ul9eF z>0uj#CNKGZ8*h>_Eg+&i1AAZ-K!_nG2E_OnAT{8PK##{fN0DjRY;pijWrZTikisUH zFG~uWEZZQ3O{{;zCfXtAjv}^YQfxC|_cl>l#6^+I#R5ovn**=}B^xnCP<(ju^1q41 z=bWZdmh&ntl|{rB=!7zq`bX9(0b|brp_g-$6iNfW153XxQrQEP94|JX#SxY4GA`v> zlvyaFauY@T8H#NgBZ`5r(q9BE$yr`#VQ9MOi(w?BmrPh+FBq*X@?u%TbG%3p{ z$W_AC!+Gm*mSvE7GD8B&K0yk3s(*vz2jmI)D3RY2EQu*$aFTr)``=-~l}*k5KWHnL zA-it(8yH<9P92DQpt-*0sF{v3h?kH zZ=`Y&kOG_wkVIr9QXqN^omKgfB0)q*!6?Nb?8h3xnkt2>poo=~Z|w8b@wFxj7m367 zT_^y3K!U$&Uy;lzbV+XCG7wSffQU3Us$A-fS|jxrCb)MaMJT(Utb6x#FbaR+A~X2@ zwltv_{jDSN6>OqHQTrSFx=}t<xAY}z^C=|%_4{riU0>! zCt^DVD{)?`34-nojlD6*os#o)<=j6qK=Q^R?Hfbr7%)F}VE)F1>_W;rB;(}gipSS; zFa7S6j=e4&EMJmrMt1$y8TfY0rBlsIL+B_uf4g-&{>ISvx*Y>pJEAIam??<&NQS;A z)?Q9Sl87Qf0_fgQ^M#|S3qK2oRwadz=n|(_nRtE_nXqr^tt|ZR6i%%!98h04iQRct zi9@T5rN41ex=5X_pE_OtDH0PoSI&J&ZpXtiB5@HpfxmRYj}reV@$CSlNJ_t-m*4K( zNWO{Ft4u^D2+W6JVH`WRe`_Mo4dAa!EK4|mRRR9G#2!88S(!+k+n>A0Ttv>~&rR@9 zJ@@AB`;Z#|3QT^zxw)gvbALQ@e;6~#B$+b#NqcunKT-UK?#>A8N=e{P447|c;Q&?R z?Pt#0-!m>|$#DJL5Jha< z{wJ~U1i7r^x~_*%t!4SIoy z*>{V9$Sp$@30fLCUt#v{F1cklr14P?of!oPUDJcC$W(W0^&MB|gYFdK zDyh;ctMaO-LcCp$oP&=(G>DB|f5Osj#+JGYxhNSWJK7lYP+04B8!7f#`tqcqfycku zkhi}n9nPPlnML7n{*3*60G^Xgrb3qBTg7Hm@ayRY38FwU=zdYUP{h9SX}4yl5^tRm z?OsbJNW0(oM+W}hT9e&a`=yJ-S^Jrb#8~@^&)34-MByTH9=|V9(toBfTeV@@x`ZpBqU;ks^tZ%54LpI9w(qk=>sdvftpk z8^3fLgV4r~R5cub>^T0|;rou`SBQV+-!ho8vQ@dVft%UR%*e_&?yk2pm9Vc%4CY?C ze?nDGL9{yaYQY$Db3LuWb_L^7C8PkXGTO z{vz5qpx=e!_zS(=gS?>M*0FZR}{3X=NWcEj75M)S{{ z=1*bP5xL)Y6}hwfpMd_tMDC>iJT_9lZpZk~S-C}m$dMrU?}_dQ2OsB-n~|w`j z&hCFg{0kS@kdv}AFXJ+|mB`#y!o8!6?_WCK-vv%A^P)`~tdWEMN$R&}I5V%fIP*;J zEl%V6mrnCfT*NN8!Ps|U4{BQENWl7Uksvlm0ghOyTn?_~828k1<*8@j)bQ6T%GiW* z_zm>!E>H^gS2BO;9~sX*^~X8&6H5KIdXv)-{Vwv{$^4+n&xpT4m6rgoe+OQl2$?%> zv9wB&L||Nz9DKR=2?_P-?MdlBR@dttqJ8;R&5FP8E!!qF?<(aeiBV+ON>t3NGe(w^0ND~8<#}0#y6YK59?sR2z{?Y_* zf#G45&i`G+&g%#9zATY~8E2-7*~dU&mSslRC+yxvXJSXjn#di#FMqxnf1fCPYk-@0 zE-6)%W$xJhjnnpX6S~Bj2(k45O(ZU2h3v;s>X7|BSnD5DddZHF!tqfa5UFq1f&y2^ zy{HtRzkQPQGZ&E|^_81%cPsJ=1}$nO@*5U6_7T9?4LM^U3RJefex%Lj*a!Yh@au}H zRZ2b?^iGQ3Iw0N$0V8kZnMhptI#0-c898LXaFIJ?KXQQnldWI6hzy{wQ2WA{XjKup zvyur%>gSmQ^ke7dKXLh~Q}Rovjv^n$GZ8zmzI2frxxP?x z{Wb+l0Pnmax5ZQWPJI|g%js>>#6TA@gs=;E(#aq%i9&noM4{$xp`YCazjlO z*p8bXMeeK_`6!;@=`#~t$IFDw8pXI>`waGoLTa~F}b>?23m6Ih?x!CQ;j z$o08%>YYko6fRQd)Pv_vuR>tu*>rj0=?fRRi^w?jy2PI4)Or+AY91<4>fQsXbtDvO z|D@aJrPJ*lYOf!a_H{GDGM2rP>wV?iS2m8niqu77Q2XtZZXcP@Z>7F>D}TH}2B^J$ z9ZrjNUlO%r1KHwL*QKup7Q%Ber4y;d&Q@?!z>kAY4){XE=) zH^Uen-y7uNzD@|(@4LIm;eZtG%fwjQ-ExEmMKBi8T+gy}=?J=KWY7J#q8O9&ua%yF+ zbiZdX6$B%;Ub;s$H6X!vi_T0Y16fgoMz4=d$kS&cqaZ3-1m~$b*nS|!9@|%*eYI>{ zfO)@f@AHd->vhuLU&n4fE7ZQ57-9c{fMOsbUXGYPxL!@j{dj2?M(G6Lb1`Qqra}Z8 z#RUh0gAxtyY49GGh{1?f2>xOK*k8)NCk4MzK%-Oeuhm@+sF^FI@UolsugmRFpX8Y8 z_A(C_Ii~79Fk`&{PBY+YRrdrj0U~b7xS;6x5jZhN*%T(!ZedM8Y#dSga>NL;`OA3w zfa}X5oDn8KVw&lTQ0;|b-Si7$NF@;ZXD8IDu*9E;oI2X#%vQo$eAIk<2K6G zlll9VMaf?( z`1KA(5Jd1JkgQ#A`0%`dk%nnPfcCRMG!Yrbf3sD==SJ4tV-7G_{Rmi>Bi>KD`nKGs zlgRU>uN%2&`{QlKb9+MsA_~4+JKxLQT(wd~AzTxo>=eAo!01(&NeXD1WSJJ94IO|a zfuZdkDK#RGr`>RY1;BpV-|D9YKn%=3BKMEAe4{>}C40$1{-e5FNuIu$qXN#pI#!3_ zFdvlauO}*(6a2|=i^t>!>e(&slPYZ>e4g9-sAkMBgXqsgbq$=63M#@nUv_f;lyTGe8t<|J`&tgta}^_ib{mc3~xh zNb<&7_sDco7Vg3Ke=J=SJMlju@t@PlMKJUfpS3MZaghHp;U5AZu?V7ODMo?pvCNzW zF5jPbm${SueVx|J6@f*|G%gFmZ$WxtT%?%-lo0!Nr@a3gLRKg+$6AFvVhg2YOUXD; zXEzGy26Y^$_WKSINZ5hws2z@gPAuaUzun;pa95Loaai|3CNFoS&o>S@6>+^s<0t8+kX zBHp@)Ohl2I3iMqMQ-b}zk|PdZkG#coSX2})G8a4-mr&q@B;o5XfByX8{ZH?(G|c0M=q__gg9B22)x4n6l@6TBFQQpdYrw{!r)$9ev<@%V{0{nc!Wq%{0JaWh ze4t_re}`sW?)5kMR7xzh~4qkbS(&G)cI1X0!l?4TVD5>9PQZKE%1bsW?>j z(Y{}0Zz3{UGN{P{go6BV1ah5_-ypzxQnv+S$w?a+_YjyPT*6}k)JigTBqt6Fiam%y z-4dozS~`6&i<>@tQ4!Nyp?W;VfMyHM6oN26HCwojOZf8j{imNlzxfx;7Nl7~`-Ao- z&wOV-4D-{Ff#Qn!)3WU^U*G-l%bQQ{v8?TD!13k25+n=JFGn>}m`Tf_B%X!V3v$tLBJ?3hl)qvURRc?g`&_NC+%Rtj#FKs*XO!l3 zUCUxbWlFzq9($<>aQ(-ABwsWF)xA*c5JR?@n?vNz4Y+O;Nv=Xo9a@I9(aV8U zB6>L>7;V11zUHYk+i2=Q!arPHNX5UPg*m}DW=1~ZGkU@Ne;2&{@;kzc?xMOYXmQd% zb;+FrzNZc;J&K5dju2)kA!1mU2gHTp@nn@OZ4tio(qioK9G>rr6`s$lBGTvX(dyGH z6>v|KKWKo6{!}}NS&x+(98{Bl`BNNS)SU}o9S2XrL+{W!Rw$`@NbKOB(ZQAmkGdQd z!Vlppv7^Dvd<1*rSgE}P4+0@P!>NN9)%@Z(wru&$pfjOGAHMwZ{_8LA-uxJV1Ho$~ z3N4pJ*jXQ?#$FLOjb^DKk;E>f@ZC#!4T}9tgNxTY1@XZYlJiY8{77e8 zivS!DCxilr;2o)v!2iLPruI;6$si4W3gD8}Hv_HgX&g?HH!t_6amEoZjz6Q7 z>E;>4^dW#>nglr=GUU!DCTPb2+C}MB7;=-$6C+cB(sw%VcRTcQCh5h!s3V+6xM84^ z1Runsik$5-h;H1m(?hoy2eLtB61}-(0>sRm2FsXw$sWS&GIdBa=S9b-BOx3+2&t}q?S5(TTkx?tT6R1Nb4CFL4$rxT+ zP(YMqKR-;sHbX@O(Wog(bpg`k3{l$#`&K%1*zdVw{1N(}_4tyzM@QxY8wBACSB(}O zQEV0+$gIg4&#|=lzWKo63ngX^gzs|_FhG0w+wb24{C!z$>hEh7xrzKKIE_Jd>|c&E z75o9oe*v>M9U*tmRw)Pwwu=P1|c!cLevc;e9N|&HeQBr@wen# z`YrpGe=Fpd4JHoCo^}4jH}wEP+f%JShAio& zmnTopb)l_aYyKbri(IGirKgDl#-v)w%bHI*9 z3|XF^W+reX84gJBG=aY$z9x;*s>9mSKE7YON7L?f#zgpoi~e{n!aC>ih6r0xEfQ@{ zkb?9Qba+L?g-`aiKkl2I^cv-E(_a=&8+~;ro(n&ubt9{HhHt-iSLskn!v}^YfH{lk zfn1bhJA&?j8>40=TwSGHCut{0U*Jk1t!KF{a8Z=CL`c6$>Mn?3882n{Lxp^_AEYp? z7j-Y;50wXLuu<%g@1#RZ7CHn{_(MHTdU~967eoYJF+#yZk`67XNLUGiMkr+DO6^+_ zbR!vUsdl(-(pg$NX;c2uN|O>il4}dr2TWyPL%K?T77mVxqiJCA zqqZz?W4Vz|*o5El5&?ruSkhof3uxs zq#%^O4M^hhne_4zXdT93g>T0rzyVYbWI*#>`b2W05{}P>k**GsNyf`T|Eco}3Jg5s zNI}X9X=BI*f*`P41un2F7qN*5;!tt&xrxL?xut_l1#q5v%4|0#Hcye8C`B}IsjcL& zcWtHNRMVz`I#uu4S+Ul}>d7cQxeobx|C|AawW z>`38LH{EET_o-7d0rli#FNPeV?YG-kh5w1}G(p9v4;l&- zEL|WtP=axusiTPwU)hrWZ<w#T1E@`{WCrJ>BoPn**Fv3uXD1IpfKfe3??>C>{{|$WDPEG;KD~Mye&gu-ah?RXwYC$x?zp2Tf?Vz=$lpX$$(CN+(Cj`mf_*EHmr zlyFA0Otr_#vNt*)$=5rycwo8%5@{m`+)Lrli`**+2I5>H7t)Rg?~6r^NV4|1w~KIY zi4%ms!8DGrM>I*c}M55m%Gr z=d~kR5*I;gBXE}b^_H;e?4>V;B%;B@fDu9}t8VINb>_hU$|Vi`e}B838dB@&OaS~p z{dqqB@cX~Gs0SKfh4fe;fFxI+p7rs7JrBsht@-rOXlGS-p&pc7y2*^7Bvvs60LTzc zcgDOWY?i*|7?wxflVu|9FO>W-(MhKYU+7y-rT8%R+7|Am?>MtP1TN=GcRGjO|A=bq zD=fz4F|3zSN{haGD0oywv<)B7_L7d86c=jjvmZ_H-EohpIZ~U#;YY`LfC-{M6r6pe z2QjPHk8~Kgq(Y*_kJLow^^+!Or>WZy&4PNJFr&Ud>Mo>z13Vt!Qy(}5;6+No4-f-4 z)y}niD5Aluw2S)xNF^52f6GKT=#3QOjh zZ<3_|w#(CwQVYmK_Cd-b+L81vol;T=IqwNej(c1AFe8cBV-~}Kf>Vw@v{EWv+KTU8 zqzigQyD0Sa{dC6RW_KUZ}H=fX1`jEK`$D47Bux4EJT(tSUzoqT@P_N18}!2*b;N3;jRc)t`(CI%^w zPQY&KXHvkLs7xFOye>5lBwI27nn#KwX7QfJcE^(Ogi&dXo}4~OMHXHE2dl#lNs{>@ z-Qj_B%WyR0*vN+`1Lpr|L>ynRZqvdIxpXD;dD6OvphM-ciZLKfv`+Z zB*i7GrVSJX=TfUrl4S8;-+lS={_UGseUgB`JW1PQl58QO!IMBfk%X33-wghb#+{q z00+CP(m*j?v#s&|&i#)nQNY&93BRA&SZ)KF)_7V)oX!_;b-MwR|L6zNfvUXLeRvN? z%&QcKoO~*cKNWZ_2UnzdlwOO}cpdE{Dh$So>;RYxVAnTzd(=IhNij{e9?!H%YNYkP z)}g!1BPaEB7reEVEDWlE&r-oPY&IQHS3U~pwZO{;>%?k_-kSNwwX#4ZO|J?&Pxk2{__?3t3%MEn#m4C^BLg`rBA~!fbdIYuWHogY3WSRCE1*xur+CWV(9j0BP`+Y0zYP{zF^HX4{*dd zaGn;enFf8wD5AQb^_}oxrRUoL4o(W%N6FaG_et)xRF6`P!$@hwgh<*p4VbGDeukm^ zq+U&Q!B(>+d3aoyMH3O;R79Vu{}P^eDMTh|>cY2Z8XJV$A4ZHJA84PXCKV8R@X|%0 zaV7*CL~gC5i}VOaDe5p?RD^8(NTCj75G=`Iq;wsJJH-Khq7cj$hw(UauI}NxqY|*d z@+iYSsT*fGvYrsz0phX&fAWA9DF$)nV)ki$j*|1!V+kX0oR5AwpH?Y$e*X3C`NNd_ zKu@JPlV-a#D965vGxJp1!c*xoRF4yUj5uTCAa_}$+?xunOj3p|{cY*xCrp*#j})cY^hvfG`G;jnL(GwNjckV}aYL%_YQg{{&utxW|n zkn&4y)YK_pp4HrGt9!9qQ(U6b{v0|B1RyTAOlg ze2=UGQA-_ehD@c42!>2LU?F0MreFBE8qVu7uj9&D^3txVt^lE8oWfdR2fTo0t|zTp zdVMA;iV8CpVDNOsyp;oHeYAZU_IJOJu&Fzrq=5qqp@n8oKhgN9{w9m+o!XP{L5)WP ze7{bU`XkA+c(3t8?#KRCL=&5N;`%Y9xjCo-8lxQ zyYozkGMYz`_x}?VG71;LP^INDOQs$%Li*F^H=o}A{{9PB#3Fi2AtO?7UZ6aZkBWnb zL49W~98fc-DZNIj6BMVoj|9sp7`8@1XV1bHNkw7; zzDm-{<-2P$rP@&F(8y08e*gUL)7y7gWEpVZbE?%H0*;=EI#Mm);_uc}koA4f>)PGa zns_gF8M7eZM>Q{eTZpk{4h2B4et>Be3En2)UNxWq#5M0uUA)QU@Q%YmPQ?Cbts~Hw zNMuqMn8aPEqL?mJS2~bkLNqV6#xTgGkb6I|Z!2B@{jElkx389}kC(feQ=y`Fb1H}< z{UYd1#r;d2J75SAjom~IrNAP_w4k4gEHAg4B-)4eRa(e$snkA76pW!T1$4iIA5_2M zwQ9SW$FH=M6k)ULcl*xilmnFO{J~c&fu9!+cuz4 zLTh4VZX^-Nl;G*YQcCKVOBQfB+2_-cp!HG(PR7Vu)UP zrFRh+>xG?FKLe26U@ehI0bZ5}?}E@dVQr7s*f7$aHqnD>$RrypY6s9gG z5Id>EVywQyt86T(VAvAcZk}K$9RRGB?zV`-VMcI%cB7+M}Myxgp<8Vw^Pf)5@nsaPh9kYauti$GN% znY>w0sy~JkowH^>%_7j&s$C=$HJXeR=ovNB_}C&CQ-qYL{Z4JR=qp91R#6DK z(j}N(^wk|l#a}LN!NqstDqCN(C{5&U%N6^QxPaKLFp!5BF%SaJ4*GWBorE-65{QP@ zZw;w%aP=CcRz+h@#Dyry28KV&f+Yx{8e&>?(dxn+y6`QOY%_hiH2g(0WgZx#=(`A6`)1wA`itC<1<9I8`Z9Dpt&{ATZ%T-MWU|u{EBleb=ygy>ud&!t&_hWY z=9h2%=@Nd#IO2fmht2*hSp!0fB91>a@Ti-m5#7L*9WTg{$+|&WB@HHePB_PQ(tqmD zg)t5@>f-m*vTOTP#Z&Q99Sv{V!?aCtcv4ftGX~;{_opIut-bHZ%x{D}LDaa?aPL}< zFL-+ZA1}C`-PO?xb%Q)bx7}&CA1*NW+9RpCm%4oE-_TSq2h5ggsE}a%)uB#>Xa|N! zG&Uu83wy7DFX`a(#TOiz|rucf6;8M=PVBh{d<=pm43 z4%YLB`GiT?rUFl%ipaghxPb$v+N*^auMdRfS6Ybi6#DiwMKBeEs|+rG+$0Sm4BtNf z_>zD6*QX!-6PoheJ?x?k5J?C7&1jr84Z>7+KD0>ZQFV#toUK#@D)A82c!){t1Z3j1^iPI}$ zvl^q3*#!FusR-yHMn^MD%%sziTk}9*jsm(hqNQVp{lHiZHhL8NB8|l;V24DbuW7E( zcA$0G;Q((g%rDO1&4qcrauHy=Bn1Y?K_D8uM}qh-`d*2UEZMRB1#7Ub#|$D-?Wt2I zFa!vl=>vwhowzt68QV?qEp`#9*cRnPvoNVr=^xhZFpmo{&I=lgv=2jB^i&Yde1yrH z2qe0N_1%n*cJNNbxncsvP1YHtdo(QP3%f_?HNlYlA!?8A)t=T@gEVvyWh|#6UzXBA z9+V7O%TbN*<~6IUol&%||P(bP?#PNXF={S2&7XMIP5HX1h%$cU29s zI}fmin_+2&X#ss}HfMJ;E@QSj%0co@!KSRC{Tmby1=c5%JO*zKnV-z2O6t)uL zlNL8M+qlSJQ+96|3@7S#2N9S;zlPV-t$xZypLJ)FyK<} zF}P`0!4eR|Fku&|o1ln3lHyGYnrK(aFIAB8w|t$7G^bbFM3*HID2^#G$`_lD+wAsj zQuc~yG`d!H1`{4EntJ+jOV?dzX4b0>ARvCbU9J;eLz{Wq#zpQTqj?*L3AB#Bv@~yH z4QDQHW%%LGx4*sn*Sjy_2bem;Asn_s=)6G4^=dKAxmIVlEk%WLmLf?K6>0-lPVGht zp&CIb2;zY0+x&u4|KaoRe|>rP=X;pGX~bVWUG_V?n1SirEUixn>8`^C4AX=ex>ir5 zOJJqy#z}WDeIvs{Dh>s3h0W9@i(#~Gfak0c@i@`TX=h=ZE8NroOCbd94ATnQhzTJ7FNs5c}G;qFrC zg&)Sc+S7e&lqdK_dV_F=OY&X!^n9bx{X%qyBgL`m)G7``hAQZoB|^?fz26#!_fcUi zRC3AV!Io&vSVQSS{GcLMKew0BEZ$ylDb9eCoAff;_U!I% zi3$3>U0~W+(aDW7_#tZA21?_!Lhl^jZZ8-{qqSSp(GrdhR3c7tZ|LaO_4=BoMkDW# zz$C80`wv~Dwy{!R95c+979p(w+RW8=ygr5C5MQXjTSz?|Eu%_`W{A4FBVbp$0cbhQ z5EbDO)vanU545^TYr`GlDzk`#ag~bFEaH-9emzk7h#0K?rYWTrFI^yd*1^1YXKO@L| zeyTv)!dgiIKB@jLYqWGRSj`Fwc|{*Hyv*0DhskPuCFu&w_7lc4>2b$d(h!(|OF=Jj z2+p3Xbj)y@m`cnMk7xwQ6X#IEv#%MEM4%w=hNtbFiUXYa_UFsxWtLu4)jq1TPSmX= zi*W+@Q&C)d`r=I^hSMn;DbGcmn;M2}Rf92K$y#sZK7W#4+$S344SGUQ8k#wpNgj6f z=Et9Z{rJb%zvz+&KlM<-VIA#L%&yo2z$2w0oe$uV2N840)ZhUn1S5^*BRsUt49C10 zet!YIsvWpzkWyCTg?m+-FE>R)0T^78! zpvoLZbHLbblXJ4`9&ejJL>6frWvPfbK??B9LV~@X{)2+yUXhns*w~+MqOuKApa~wr z0c7*~4@#}=LOE9_Fr7jv1@YXR&Y^5~`~CTK6H3XFNVL|=!8QTnF2W>_a+9>j^<@sQ zuS24n9?#b<%-)4wrm}>ypj-vL1hVIEbkb7|C%s4x@eqowJL8qP{;Nd7SS^whb>BQ$ zuP8Vk2(d*9MgIIOO(LXF#QHbn=f1km2*1j=`Zwg8ZHyH1^42bg^&awKxgUVe$_qJL z_{-%*o*)I7CL)DAFE(=dQxQpuBqEAMMX=<9DWH^Qj8|10psbPPSp-);Sxb_LC`Jky z*j88Stc1&Qo!Lc%gQeaQb^@SBhiQtDWqkZB8iA&q>##mKniKL$>kbE zB1*Y^g=jkQ&w=ugsSo67E-h$XNn&u^Vp5oMO^RUy%E&d`y%cf4o zR!h9CyXA3ZqtdHMo-QeTiIUAtWNw?cby2!)-o|Y6vfOR+3b)OB3LLy)QPapwCQPIu zA(;R9ov55?Hk0xs@L=5)AUpyl3ksNh)%4+*5fF6?%f z?wD2@YFFL#aK%c)ft$ZxN$)(}pyRboq%LCj*W0>?-Dody;cj}gsB^Ew!k#b{YEfrd ztFY(WL~MfJG9I-Vh>-F@5-jdOATQh@FL6J--2L!qr>AB}CL*)JQ$sstEGN$3HbK`q%ZRx*VT$m77_M`Qh;+J7;$;F_F+1&p(QgLXvIZ%tGI}9IXpj$t496M1%zUy8?-ZczX1i zXGu3BF=xEQo$+WuXSXi1g3o;LQn$a`y6atJ{&nhcXW2jVCqC866s~ofum6&Uq6pZ~ z;v@b04c>GqlKa;c?p7C>z|K;4rA*z$&xzM2HZDptvO{AnaW@flvcvsN-On%eOYLqV zCQ>u7Q%Ag*FLO=6K~CCFZFdr}(SINW6$h4CHPOc26t2k`8uy7ZW#&Ox%ADzEE&qPU0*39BJ&JOyv9!=Gg(lP zC*~!mA8G47iQK_4a?{GltBuI3jmY!T(-t@KqAK#65qaqx`BS1*|HegT4s^Qr2yaG0 z{I5Izg!nHdCWqMg$g%{zs8QDW0=l7e0OJ``^s6|;pOy4NV>(5kP$r_&5dSfCgu%vR zx)c+H^m=FX`eTa`2=OmE(K^IG>zqBf)lGa282{MtPl(@w-2k(@w-d<)BC0E2$i_cR zjQ9<)4Katfy4^7F6k_v@hshkC6*!!2)pS6FyQytcm~FhMO5x+8-gNv7*C?eoU98{V zDCiu9^JYLtwdpfgLthDz-5DfRLITMpROZHVBZFW?YH{ z-?|)0M6!`iUy;+N&TZV>0%~iOYV2*X*!_@Ww>dH4rgqzn3H6{;Ul8@OQ-e73zuLMt z+SX0mwtVhW7qL6nMQ&KPal<-(l=%j;_`55ey5yz4vN^j@WLxv8Q!6|>olOcacnIn8 zNRyP-bGn_4pYp~Elz3xUe-(74i?xC;-FpR&b$Y6WyGKDtGV8i6mn8m?s`SMlEsf{!zKP zW}7HoJU>d^=Z+uc`t0Rq&0!*;@a<%FVCG^JyRotf{|Ff|OA92p+ij8D!Y(qAyO$kq zcjk_VncH+`?r)g6Ygpzck8ax%d&@F*la^RLm!G0=L07uMT=M*CWPUX=&+C~v)u`WH z5xenSY{qx`Ei2>H3XjHj=05iS=jzXv-8iytP4qtAVq5JhJGRaCZ_xv=b8(6kDTyhH zQgSh+Kl3InIsgGg14aX^z|+?lW4bTpDT+>gh(0{LncmHjI-Lp!Iymx=;gtcMqKhDv z%-mrY=X=~e*)b(?3#))cl3w7O*k*#?+$w&%Wet^xg{v~ z5~{N$%xlbq2~rSyR-BHowm7-4#49Iyd1nVY#x!*!Z!kxRFGjtc9CG7o=VyC`$ z@G^Y46Xr{FL9Y$!wV<6I-_Aqkg!%Hs$?(~A-t+-O2I}!Gnrsrq*@1zIdl3Vb>nLx~ zNyBa~=5)uWMHAuwPYMse(un|rsMVqQVZVEWH2Vu96YnFdZa~B1?{uR>`0-6ZPrbkD z;niYe5eKcj*xu&Bp5sl9Z+Rp4fN#IMH@d#j+vU(Mc@}@2t5|yD{m%c$9b~2~DAf{k zO;^kgQte_-_|rq-0Dt{9oo9wWRs2|NOY+YpE9!Md2dM(u7mK}itC|K$;USe^pzKs9 z1}MqCgWJM1wTql8pswRAeiM(+SKxq+T#^?;-Q5fF9m-0-58Z@865! zi8n@^M2Z(CGfrr5J?hl+i=|(Q7f=7v3Y7AndtdyK0D0uwKPC>yIQ3nY4sr)*!$*;8 zJ4cbPyCW}N8hI-&^1`i=>lARH(_L*IdEwT`m*tVuPm8<~PvpgQ9PB*k7Oo-+VV{Py zPfb!VB1n5Fk%XY#Ec6zPwU!buDj0dez}!RZl>;UHw?CwEJrRYjBgep00IlQ0$qK%S z2<|*222OD>wNfhdwUh4#jeIw#gD{}5_Hbz_$ajbs0uEE$# tHnSIKf4%5n>fudm zP$GZUYIQn-2L~n%=oIe`&h!d>&!{O2nrh%qsohBonxLS+VCs)?+EE9upLB3dTm#$X zH3Gfr-QLUf?Y$P<-gT#$Y9KY1_Fmp>@9IgX5xDajfztnT(q+DnGxS}X;oeE$ntWiM zdmX`p(+E6x;G=rEW(T=c1MQi;9qUvBGY_d33yd9Pf}P*ubmw+ncg?FbhhC-G=>$qS z(7MYV=*re@=^%6xf~HUyF?b2Vz1IocNhi<__A1RzFwldE_&Gf}Z=!~|YifnL)0%b~ zfRgodT5%?-{3ZsNd!fJB3;lWE=gwkwNv2ucPZaXwr`dZQz=MaKhr}xbrUC}91Gw`b ztw5*Zn0dLd%)eXa-!1dHVVUbta_WJRR}VC0Kzqr|r>e}SD&K|a)B|;}=}kL`oQ$CE z?p4$>m$#i@pmrtxU?&8bxfW)aZue$EF&%n2WdqXybRREuV>nJQ@Ze$RA$E{@!N9|t zVBpTl1M12?tEaAtGO%OJ1U11x+vVgpQ?D9nJ)xF8dpw2aPK7q zy(*w-_puRU8h{o*iECRqF~Gfp%)|iwE|(7zuYH+FiZyi7e>)F+u*56ldF5r3{xe-Z zrwHl0NGS#wJAJ?0pYF6T6R#I%;57hqL1NL8cxAlAmv@O*#`7}GP7F{wf$p0oUNtds zBNPr&57gXaF>juN!#K|vC86p_6$J1FaV!3%9AGHZn?MUaa6-ai5j^on6DyvtRXrE5uR&4F5Io1e zl$WsQu;0CAY5xkN{rT(d)343tqcs1fmBI&4Tee*_0AfI$zo+FKJe#4VUs*uc4C84k zYGB)ySW}?yL9PdO8KK>n>`Fau>X6$&h?k z2Cq$bsY`seSMR;%Ri6E*Sm^(N8v7eOR!$tLy5O-K?QihFLve~H1rYlgxr|V8RilIu zxm955fCRc`6r7t{V6H$&a?trO=Ln{m=oe+1{9*hih?o#gwImp=GynDG=^)+1-X#5O z5!4${EwMW{T^~yu(H2Sz8?JJ3;{lXgteaCO1;KOsEID096SvK``x_h32d6+jS`4d# z>WNJw&*XnP(L~83YLX^F%07Z=9IqtJl@0!Cq5t{u^AErM`jPU8?RhAw^D>vkO0mRl zId74P8Y&J5r(!YSa%<`vE}BY6S;GexWD+>YkrSvoGzWij<{sTcc{M`-onErIc%)5v zo#!-oyfvvG!TnKkt#uRJ7r6~$F8X6G?&WS;{_)A_7p{}(7cxm3?Dr;Q7@0ERJl^r1 zlqj@Je81p*j$Gn;Zx;&r%^o7^7q;@5ewU;5NL#9LSX#hzYBf_-l7^hTb8oFc;;QIB zq*vHd!;t<8BzQ9Uz-Vli)8N&)!3HqV$qxgBai7K1s&y=#_f*>($+4DX{nmVmAkmk-?~ z8`Ww{Ti+ga@JG>|nGB?RIJFmoe2Fe5dZ;y_M!5RAHMiw5yawx|i0flK1SpR0aHU+tf`WUc3*v%@hxLR@0QlbR`rs^ShHibI@48m8%j@%;&ba;tJz5HJ6cFrdy+{ zb7|$mXc)&%{%R<%xaTZFd^t)GmINw~-U&{cfmAHIS^ycm$tp` zvy7d!RA+1kq&6N~TOC1A4;i4)I)QK3@^+N23(A4@&QglLTtm}qJdbpxCNW0Tj`aF0 zpVlGURL?U^$_(oqh zbOE(U-i67M>ruFhW|2!HessFKmSIiT7V_pL{X;G!C(t+!mKyflG9XD6&nE+5>qdH& zUWx^un;E5G(zr?*vE_t%N*ylptVfF*b?BEf`OFIfKa)IGD>mtYjN5A~1Xt)T!Ci4G=> zBw|I7!vpFe%1uZS%&UB96OhReBy`vgStwBPAjLvNn89qKdrshx!e2stTA{qy&Fe5X zlap?lH>zCOtBEa zW!hduks@43t-W0mN%_obi)fCC=cVJSvspTdI6N`18=H<|NQuNh-+lcSxlL4qTd0ym zok}VyN`uTa7RSM~6}gU=ig*lBY}$&PoGz%x(Q7Mi)I!_}`d|axr;!>0q{1FkE0a^n zDpKn?ej{A;#iQvn+B2IdqmyKuisK?gDR9%}=uEEmQjGQ?7deWUaJhXL4I6Gh|J%ed z={JbE|KnIhK@4gq=ha`Q`Ud-+uh`^&@2%uMOSRzIZ)G zr_9JSC}6U^wO&{ewH;mMnLy*(J7}F`qh8Pi8h0M3@95Pkxm>5XI>|<^(h}&b5v`LR zRRt9qDZM-qZbR{G2_02P1@yB5u>YKdW5XOp*F4m1p2yp{ZKU8h4A=xyfmz%AAaH3A z@1v-Tf|uWZ{PzCc=g-)3Y;9SI={iyX&jcRdAPZi;{NvNhKi>Z%co|k|Va`-~e8_dw z%a`B&vAyfLEC8pYN+=o_1MMyleeNz4k>fgf(|K%rS#X34Y%sx51ql}o zo8%!$A05fVoz_@uipr6y4X7N+U=otb!Po7fl#6(E$ZgX1VrF(os9V}V^Oai2kzk;+ z4*;?UU2HdoTDz)iwkzzNW6MYN)w>G%Oj_NG9Pr5vz3hb7M3qpNzd(dobWExr99F57G5=y&?Hl%0o^GQPAk(Uz!FXK+80vLY+h}l5-F9Y2x_`B7tm9J@~*|| zGo_WdObKw}nxR2Ll_&a`rtvZKTSlrf~1t?tsPSjiPy9&Jsboj7YhsM@eQqs)36++X*rFJX<42J)VqyA#RMyF z2qy_ZQfGbc9MBvPNQe^OOT~>-w@lvDEf1ddyEn=tbZMj5Z$g)i5xY@lywzD*!bx66 zA_}hx%+-V^gKI~*3?LU|j|RhzQj=WynB}pP&7@Q_fMQ+(9_1mHY^EiwqBld>3uw++ zoP_>I=0U=jeJ@{t^m|Xmao)4Lt8jSn&d0orrc^YMQB7Hs6ba6iv^3ddxtwionDmK5Ktjwgw4 z9>NgE&q=CJ;0X^-b9E{YVv0x};s5w5Jtq z+&wg=*~+MT-sv!bz6fjjKn2hfMoqm@34z4H*M`gWPqWhk#kU81UmMc`wdN||Tr7vk z0ar%gwB5@>M?u(zG@GP6kxl)@i+-{VEQL=N;sokz5M1xWR6OrZP0iP0Gf_7>{2lbb z#oAfQlxW>T^~@WtBN{8U@iWN*ufCa-LHTLb zdrZideA}%!Et!&gn>-Lz2^tCiFHumf`Tu`!`wuNphp0RZ_D<|`+xaa!FEpC@EsAX~ z5_(8H?mg^0ScSqL96=Fiq6h&umu@KRd6pAEp2hh0_>nZJ#dGjIdc;jKrAxM%QYnJON&l`3yiM~WYIy}$W`4IROW!?2 z!S5T@6zeFsZOGDhWZ|PJo5~5Qi25Lcns&LVou2Wi)HE&5jSlN?Ei(3-rm56J*ONN` z0moyFx@7|ucRD+v(kWZtRpSIs8;8ha$D@=@x%j-9g$4B*0R6Z)WmCDy`yB7uC9WZuB(C+LLfI9aakVrB~Y| z#|8VpFq1fHRV+Fc74R(K)MB9e%8g>PBeiD7D_azNn2UMbyp1(o3~(3hTI?ni=Ml!& zEOk{D^3qLJv1UL$O;b|c2fu%Q_s{pg{ZqT>u&?)U^iUFpMvA%u6g*Vvq$sID30n|} zQKKh-c|M}GNNH9?0HdHqy-p=I0Np%g5^H7CR3Lxl1o;+n@~u3W`e{^u1w{KCk;NfG z3L*neTa@h>fvp?B#l36@CQpOU3}^%wO+@C<2$$WMgiDahWqcP1WPH^ zjSfR7oVu{fw~*fJBvDPmIB$iMd*vYhO};oNRw_x@l?N#|jb7WedA)UGYhtlCG*#zU z!c7j*4VWR=19&qlH)4zW z2*anmX4x-o} zRMQ;RVZVL-@Ye~pn{m%m-qH6ix2W>CvEflS62qk@wnA5%>TxiYSia9Fpchz*ydw1+ zLaDvV=Db<+qw#952La`vyvXYg5Ax;RAD>=6aSIph@~t{{zD5#z?dd4SslGDiu5zM- zEhsuI3hG(|z;xX|$A?^?F${WvJJNySt>B9=yJeC0iEvBkMv`w9F5SMqG!lxHIsALb z^{!N2eGJxphT?0W*FFiws<#E!cp>-KqZC(`F&HQH1VsRTt(IHPD8#n{P!B5C*?~g+ z-E{)eenGQpyg5D0-+ur2_1(AMz6O*#U2k|>fZY8DqhgPJ8{;rZH(YA6>M6rN)+FYy zCYXmEX8nrXW4~H?Lkj?y;SZ(m78^8aXQ-MN?(@L(E zBC<|GO)9m{?UeZNAA+@%-}QpExJi5IO1W$-Xwvfog_)zUHx^77qyvXX_&gOT)IOS5bmlF4C}7 zAFD%(*_ouR{pvSglGFO^$fX6XwyuT9uCEU{~z*Ez(aH*;~_W*D?i;&$gDr^0Q= zU}CmT^tPn_;7m1JuJS5_p;!@J8^N+FMP}J0hVSvESkyaXI<>MsOtE&J4Wc*Y+H~)L zQC&>yGOo|H=YZ_MF|x5IoGBMd+1$EyqPMk6D`;AbtbB&uhfDH8wNMkRje>r~!yMO& zVC@iB$YmkPWX1Xw-=U;pvtho67>^aWe!H3~K;rE4jZup`u(9Mr=)ZRrraU!#cn zr$IkIrkWmK`k8UPoB)-yhbE)G#{;mpWX3_i{`QYA-+uk+YtYND5vO-h+m@qi2CPh| zYun6acMX0Wse4832NNQbIxU^B=JhOnOC~img2LEGla#F%syx+2nI2c`D&NJ&kGPwzHuf zPWQUC1au{TLD}4UF}($uiT@U7D-c%N;x%Jy5*V5yg0m zl_BVxSCl>|<|U@9_`~a+C3f7*l-l=?JJOsY+~WygS0F9$RG~N+Aze@d9BDDm5 z0)d{1AhlUG@sM$T<|&h2l&aCFDdZ7VWrLy=v-f%{-)Q8l`ti*kwUQoL~3j5LkfU>`f! zMGlx|4HBvIsv0F|o*PT-d6l>?&6i>mXymRhI9{CT{BuvCTtL&AtSYJ}bL$JRF(;?W zyOR>{cv9>V6uV9$p3Y2Z#RYv-#8c9y!RPhasyW)NS5qCNF0Znk3GuQ617OBzw{-W* z`Em=odDV28IruzZ_xHnGNO5IY+GI^gVb5l@qZE@VPWFh>r-0pN=;YTVGIF1p0k%lASIdZLaC{xmO}4Tn~oeUVACLG%NRDH*Xq^8 zF=_LvnaXclnBpZhc{hAyO6zVDTQ&r_mNbpsVlj1ldK+}&lm&zTE<2ps&a*|M; zlieK!-Ac{b<5phTp-j=pfdiUdgR(iJB635gr-kY7%C|H{c1^LkL1sc>x^m~p=2}b` z*ly#AqqWAJi^beS7&uppexIV2ZNGZr`_gWt_r@v;Y~feoYys_JZw{pmrb0O z!0ys>i&Kl|R!XV2c(}<-Y}Kfvg+LePRr7{au3%dO&DX%rokD7Q$P?mS$ ze2ts^%dVi*frs7D)b&-euF8F17!t|uPwCVqP zW#7g5v8QY=EOcFOA?|lf^0nRS& zfZAgl(G5io3WbDQ*PZYt{+s`W8HIdDij@*B7q%w=ocq}{ zlJs4gqIcT9Y342j4dI7#}8uz)DLtWZz+-q44m(vj!D;}uJ5wpJlX2P{tZ4UdD zJvi(Wl1y;rWP({)5eg)Op)jHoVH8(I*%fv?$I|)PQ7&}LrIAoDMS%e~8vj%yrlwq7 z@O}fH;K9@SZX9pCloMg(yaS|3?m}6F0H|)w1k3BXd)%VqWOBiB+e)BcZm%R98dOax z&@5D^B%FCjJtTmkp{qKBU37R;8-5cT7EpAPn!_7|B!^8nn8q8bg5a`LmHNK_HjQ5? z64OY7Sl`!-<%kl(w}JuCvD7_DOITv(US2p8*qgC+&GDJP5h!4E8JkTr>;P?#l8I1u zRExcguuAMYC6WRs&;Se6;wbfkOV3FZd0JPmlpO9is=f~z0gBGq3LCvU)aY;MQ{Qti)k+f;u9-L9@i|_m5cou!Z3sZYR*q9Ee!V)->D7q5 z(RiiegJ91ocbC7WaJF|;3U@pbK|M<>E*Jvy8BC$y`Slg$(JlD&^6ve|&!68(u$Xi4 z1QpCc0~FJMc0SWgX=Q}c7lfnTK4@?A!>&!>xM_PE+3z+=-FW5P2aSYqD!zn-`GZ5f zf~w(Yr1&)9bIG=I$5ErLp*Hed-=MjnU(tRG3411kt>V zw`DecWGej%kfO^sqE7NwaZ>N6K|)b@c)T*6nKBs^O=ek2!REd=nrg8VP2RoHe;HAr zT)-qMFpm$yvONV7t!nXorLjyElUXv$$Xa~1cIMP8JT2u)hV~?ru|@hb)1W=kux4?^ z9)1Qu)76z^Y$-pqt;g+6n;C%b^SZS`TRoOlQKe44YM}zNiTl1$phoo-7I~|AB&ZYs zGc3g|IB&N>G970YVSFgSnZcg_SouQ@<-uL(WHfCxuP9R2*;H)=`#!Yw6DRnup_jSs@) zG?Ax)rO%rz^8xojOLgs5sVS=zmAM$)>{IzG3QNUqo8QK;ELEU>xmAvpi_2VB(G8coylzmL<{%+MfW$|=w+L?3NrGwnoO;`RU zi9D4a5~q#)rjlHoxFV7Ekrr$H{KLE3?JJ`mwPMRrM~Wp&-wP?2<{2fDxpqc^%5!sK z?fEl(=i9Dn((r*m$qFsx5k`{}O^!kbXmN3po+blut_a&&0+?$$7-iM8ylE%{Znuqk zl}79k)C9h}ri7n4*LKD86C_c1rnCZEMn3~e(^HD!AxDz^nZnf9tFC zlw|vW;sr2pDYnchP1L`oxYrH&__Sz6>NB+rhrR zK6&uDIxR@3F!xSKh+3EhXe5eia?EFnG$TC>G+H<$D1+jssXZP!!u^w`t8|fxFSGd~ zxHW|VXV4ltWIrqw)?jg8FX=Oa?mM4jm4 z>2e-R+zb`P1I8brYjDkoR4)`|!g0s;$Pm~<-q&Sygr>X$_Q@E!4m|ugcIA54NyqDQ zMU3Dgcl?JZ;CkEhcEpX*mR_X6+$^glW=^`2pm(#VV@BfB>Pn&JG|G;Cyi-To4M(FP zj0&iyAob9$v;8YYX;e=Kla?Oc7AlZ$6g05--HM{l&MR%kSb!XPesW_>(&MQdggwn2<3|qF16p&sQ zw0Hw3bv;N}2({F?=LWlad}OB<s_m%4bsT{32JYHa$+P@%`V}vv1PrSagE`_FlpLw0>N)pv|-8Nw$vyA#HvAJ0sN%tFt0zMA@U+av~@dIUIeRe@xtQLo(vR7)eckrNaZOS`N!f%E50U-}q1 zS?RfzI`z1)w@bia&@Annq;&k3x^x`>B{YqT{2D)BtMovj>05D=JTw)jQG^}4d%2Yq zB4j?cl}?I6Q<=^I%sSZeW5>lsCM~_tVkg`l13MEyCr)B=+R`mk8;UcuH(v$i+Lfj# zU9`1yq`4y8ptw7UY3310OpmWoz-2P;KYjh6Eqskk#LjJj3fW`J8T{15X6GoE5dk;~ zITCtJUu_=f<+eFwvz^v}E5$W%^dr|Y>8*+mmN><=VNhsB z)G5*hP14A&OgySgO#2*s z{QT)(X!(Al2DY@bXOqlU1?MEQcTO@J%_H3B`Wn3^*Tef4iez);FRHEvHEVrcXb->w z!qZVJyjI>!q=HQ)K|sSrGc!T|1x>YbqCM_Zo!xgp0zw{{2}@@(*;Ch>h&Gp2q0|vj zv;wwE!4TA2c|Y>*AO8CbasrijSB`9=eyG>}hUPblCbTq=kMYqzppf1q_`6iwQIk(V z$Xlws3iBnM6jda14RU1-u)hENG09#U_9XrJO0D;QFFOW z`gwQcoVnwTUgwBb?X7QNmBWfuWvJ5a8kN=d<@-KAO+Mk z@;Rx!9@k1mQOyO`Qjs3f9;76tSGuNp^;lDU_2h_J!J`wd1R#+$JV>L`+|_eN;+4Sl zRgD+MeuF*1q^$^Sk4R$sr1@h6&eMD)oLWwA0UYHU0su3+My!lTGLkeO>w+Pu`<8R? zk*w-VO9d!IFq#dUDQoj}(V(r{bwEQB_UrzCQD%Fg{}BS`G78R*f^yL9e9{7PN^#rd zC24WbCJ#8fyTk}ur_DU}SPr{W$F<#(1#v=)MLH3N)QufmZQPQ8-@=eIuIPvu!~s;4rWn^dU3Zv?2yt4V|tD#X(Ci~; zOTmNVII|NCkDYpWjhf{{LqF(0bkdT?7q0b{Ip)sEO%75VCWxHKxb=cKQcv2eV=kjV`$;hdZ16G$Ei}h68Z-{NmklmhXfMo3eysOBqS0L;j{ro_ay@gNL0LB&S4q z@4n&(>5)sv{EB8Vvx$Hj_r*2LIj2N()m5Gsbn!JKwfUajpyK*b$rw|U+|;f~eeoJp zuV{K*%bGS*^=O~0vVv;8jYpQl0FBN#rE;XtYV99fc`2Rpj&pSgxMV~qHSLRsb5+(H z2dEW?%XvNCj>Pja9M8R@bQe_fG|csMJO>pA--_XWZ5N}9mjTTI-7 z(pIj|Dx_q7ui%HTAK!iZ^v6dNJ!b|MurotY)A%tmW%P$WAE9R5P?^{NOW@r9 zpVQu|TSM35lnQ^S#qMO$sarfEEzzK?#(8F+JE0#<=6pU)9QdflX=5M^@;*c0N?IwV zQ*)fa!LLFPBV7YDyE&FzI^M!0)p21eo^xXT96RW#SU#)+tK&B!&{0Ywg>^0o9~O_1 zfK3q6_T>eiB2B9l=~ zoqeK;tB!-z0zVCeQtM?y@omirph7nQEdk_2lBUFX8Fu8PAAbAc-4DNgeiz7rgHphN zMlf0elu>^ST*doC*UJ40Rn!*-ZjpW^;b^M&URT}J)Y%s!HTCfrI$3ozG@QOVOgc}d zv`%A`Kn1^%n(Lib&pm?*M$>XG>8J=ioz0^vbXA7)4ungxkU+uGV6$6$z-1? zWRJ2x#!-gab}nGgAs^j~IpR^R2|ok;1zInDaqm>xX=gjkOsCy6?a^Lorkw!Qypoo!@YYVW zH0H=jxc80QVo$?KO-v)E-cG-B{M78#x}r(OWI^`DtowbYt}v(tx5t>@0TG0RJ5$Pi zX{$L&95MPE`L`G)^KPq#j2i80O4ab5B>jFpZbw|Syt8|GyG-RX_~HH6Ll}PjN+Ed8 z;Frcbn1Xd0nb{=@e8;8BG)PrwZ`k(=DjJ`2war+-M19zIV zr7rY{J?i}=B-}Lnhbr>ZIGCJ#$FVnL?Cmy>CMUnjrPdFim#TT;a!*s4rvsB8cJaqu z`VPflKKg4BtBsJs$L8Qf%Y&Jy0% zAn{B&cr?A3m`pvMd76M0MoWO%jtWQ9bR>(8>Rg_VO7_;V?LvdU?ed&3&m5KHvf9}M z>e-zlU3$SmP|=%EIX-MvD~0B3iK>rm)S)bYKl0?yJcd94azV&r=6NgRVuh&1D(^>I z7*5IgMGiJ8P|vh!vh;TFsJ|4Pe~u<%57Up87zNVV_#`y$U{sGV+6Z;QijnC@m4bmC z)OFiK5sCaXcg2HHj(L&uFfKr%lsnpmT0IM>Ii~N0?s) zl;(X<_OGc%2+RI)m4hmd)Ty^m{)DbuEO6@?O!WS7HLZJmGY4#{kdBk2=T}a0E(IEu z5wJo)voUJfU%0&J2+W+&?I< zPB70K#wc_QD!)bjT|vqD2{R)UP24kD6V#%gT+(c(dTzGH0W6!c9p`pHvx(!0V@cU{ z4$|whwP0<-eL0dm)SfR>(Oi<%mYZmhA9j2SuqR8H{|ore@C;;LHG+m)liduZUXIq0gfv zMU84%NTt>a*}ldBM_QO9I7ry`C_C7Jg?z^Qb*C1uEa2D_01rSz7;vP^DS^g}K~;sc zjJQN<=v%aqIH0T+L|M;01K?=Wy~_XiqaPCNE!A5tHT%UCfP#o>_Dmx+w{U?9bCbp< zWrGrBG6Sy766q-QS?6yQrGKIBz{nXV0ef8u9GJ3wWux~7aC8rC+xJAaU`qOCV{4aC zdW2noKxo|)p;+V^Q3Jc`fdBG?gTFShv?6fJ`vUfYJr*jJliq~0@e~yuN?PWV;_6D4 zf_{PrM#br-Wv2ie6~eR9v(AZ)f|84N=u!s2rjDS{(&SQep!ul_8o{inii&mm61;!+ z{+}Oy`}{eeX0?kJe2rDNW92fk@Ng8okEhSqAO7}JP)0d*$q*+YJ({7kES^t9aX~@s z=WBH@haND$)|Gl*hTxrkMB0Dsu9rs?pdI&}ZfI&W!~#yb>Lg_^oi>V?uM66YCEIgC zE{P_bxlZEU%8`0NA)ujU6z3jrr?qYwf`YRwB^ZwC@1}#7ew>dqtvJR~)KrCMRVcyl z<=-%zf@0>1AKrrBnr@(&Ce^Q1aEd1LssnuPf)3?qP!;q^Lf@1~G%T_c1Jv(2>TCn^ z?_NIq_|wmS`z3g1%lvs>eXM7>DBwSCESATq>GsZT8?I_V6}J$Ob#azJ-nm8U*DJVyi08eVP}t&u0PS<+Oezh5v!{hqG&qGUD84_Q z)b|UD+tjlD4&)DrK0J-^520B&`d*9+$`C4~vz14m8}AIFK+9VPw3!{?X<=Pyxfj zjH{?;UaWaFyHv=Ch(vLg91OT7h@i!l4iXQMgT3Fyk1g2wEjjOu+NnLM}DY;5JD87F0t;xgF88t?;JhJa+5C zO*I-p#n#+`Ro$QjZ0WZJKmM(xS(eSFRoX?i|8u#l&-5R_jQZ|W7dW(N$`7y&569M4 zG9PSc32?AUW`M&%s#S*rMXvUTK!Tmr|32(@dxqdm*x~UP*1;in{%?Xqri!`%*nhzx zN$Be2KuF~CL~@`A!G4?Psd`<4eS5u}x7`}-4|&EANO*jogi)4&!;G$cadNPCf9hbr zi!z2_pYJltW&qNdA=t-hP7d~Aw=e+kYI&F^hmf2fVoAk_^YD;G`}m0;`R)*=I}QMl zrI3Z%2%IN*lHn9`f;4|fck%Z}u!B*dB`1iTjB-^wPzs{@!_NNPgI$KGLI5NYPDPH{ zrCH1n>|%VM9F3V>3_=KUQ(K#Z{QVF6cM0MmKUhl>u-`KP{C`2dZ@1f*=9K>fm}EtT z$~(_@Aw$4r7gET|^DIkK#2>y`w#Op|c#WI^fJmdVVjd&r5rQ0%&Jbivy~}AeWe577 zm^Z+oY3p+f$aa~I!J8Sp3AknXj$H{UAl)VV_<(E$%=eiNOLK-G%kYRhi7!)LS&xYW zo?JE=fe;;d9|Au<07)(W9;?d6^W_YHC}IdQ%Jm@a0HTy3$inRGr!_4-&p3LXhls2?HQX7=k26sz)G% z41jD;aUkw9?a3fPL@)rtkReD?x#U^^$iorSABX}wT))`%_?1#l8yDdXcU*6pFcszk z+?oELPOaEX_KGtgs5Q|90y^}u@}a;P3fU?4h(!NCoGkOPCds!XE`CXBy@U74tQm!9tFtUV>qpxBy@U_4nhZ+ zE|~gbQh#MrO^f9gHeCU9e@z%#+OcyGx5KQiz1ZdgU`yGI6a84mWz-IJTm>i`oZ7b6 zesd5zpd$CdsYe-PI>tn!3@Dg>aLQTn!O7vp2d}_>a8gR~!E4JKq#k%L7YXsfNkqj5 zr|K6UoT^{!RhHv}*8?|MxYR@FfKTZ4;o`j$1B$(ZG9Z-s7VljebASta;baFq-F?B> zOUD^dv3&0|?HptTr{BJJ>Z=ZT3%MNIJ9yh-r)U1|CN*tfH%dcJ^_1P6#R9IaOl1 z?~&|Lyz@`EbGlRxaGgAk834#c2m*Vr+(|XXxywzl*F<)}UHK zxzpl`O@nUdArjbYT{)%$6l>2&iu#p zvULC$SExkxLVHKAU>AG6y4b7J8Du&*^9N^dTclY9pi~vMq=y3oV4pG&LI!{okcSTJbeD}&|I(>XD5-yGFI*R=J_V=#l~bRBQzv5rUnAnM$#$E|8_DXmF zSMGZOyg2sdiP!0ky-u$Kot64s34_3Ii5U#sm1BQXmq#L)_6USj8ojYo%LX74Dd8J? zODm3iIUD(MKXT%iapd13^7Waws{pPVi=4t=964RX*o5nL9&!)7yOXGmz51>LUB`X6 z$R`-tRm|z3&-D0tSm}j9~GW1U!`b;1C0xooFeX*C(jYFq+9(!9W4t;s=Eh`7w zmHLBIe;pHQBv|B0e3t^lPQEUPoEBRUeKYx%Ao^-vk%Q>(UgP?E@%-1jzyA-x>&)&q z5;gLYrp9sa{uTfE^4~#prI1*LN;9G7@dak zL=~gx$8l0eNObh@qs`O@w6ol#M{X8v5WTnIOh9Kt6%hxRT5aK|4Da=>ol4F_k9?mD zC@zyKtuyS5-zPt$A8b>;uY%~%_h@Y#0v4TA{SxStItU3Awap7srizka0?~&<%DR(~ z_+8PhA2$NE9&uOSA;QiP_WjEB82{0yBly4{nLjR5R~-LQlY}6j>JAb@;&&zPU<%eB z_&DqqaG>5=x{J}QQI?^*T)VOz+TjGWGBZU2b?)Q6z=>d|d~F!Y2a0Q>!ek&s`JQU? zhiD(|s5E}?qSFUwwM7Rf=xUIApj5Os$)kf;+&*|6`-2nejl5EGbnqh72PbG59h|x; zz_d&Wepk*wNc}NRzTO0y_YN|h75iPW-{Kx@pY0d`Xze2a_+Dv7h%DCkF3(4M*Pe*> zt{{%~t_n9`YE~$gY(58j4?7RJhtz|f zF!9GEepl?DF!B%YUl6e8u3erm0FrReZm!5{NgGfZ+#n>F=&J+2g-^KipL^#dTce#9 zSl{`G+Bt3BXy>F>3GQD0y-Z6w^AHOBF^Rh=Aw3Xcf3L{j!llfef76|_hoT&|J>8E) zIZS!F$HG7C^~ne!1Hh>nN2Wj>dx!)QF?NtS;4|kwwdBt3jdCaC8>tzfv%G?Q?y5Hj zyhWI^ksy#^6nWk1$TuFM+$S5~c!+%C!N3l-%09}SnMj>tnHmmsy8E~Wd}UV`M!8p_ z&wLLaXqTaScfd9TA6z|s2OXGXyRN-DvVZv_&J(VPh%zKGgn({%832iT3Iz-R9K2(8 z%&f5ih*AcEOTU>{yU+ABa)A{FzVQ)R#=H;FNu*(?$`HlgQ zWek8c->Ljca2i6uZp?wJKO%K(G7gh?#}GtseTY%=*MIzBtsn=vz~V1)y-*HPLgcqZ z3EN}x8&O_ZK*0q;H@?BWG2+m#fQvzFTyu20^1@v*-<>@8UAv<2v>)E+@UOqn z4U_$~!3~=J^_vZj_^;n#_aA)v4}N>coU!fJKN#3RoE}9HNBFlpKC+JOfmu&E|#J4eYGc(r@gG zS>FzIpzFl`be|kuZ(|fS9mPxns+BVUP#z!ptu0w*rK-lSpLO&AXAR*-bU~5}B$Q;*cS_TZnQ1*!xZ7pjW~riIuSY0EbK`wgm@g z&h9nHJ@9=p*PCd-XU&}96=tqy+JNtzIm0Wo(FSeFm1jd6ZO9#D2M;MBQ*p^53wxc+ zzn2;TdEy~*pa%;R27;A<2AR%^{M{q}Jnof!L&1RQIOX_ig40u1k{a+9scRC2sWU@E zKM)c6fr!vs_+jdLF&sn!d%@JF(bSok28;x6*oUbb5DdLxAEvIV2)*?l%6hl!xNn;J zVj}gQGW9R$W)uM2s8X2toMvMS2M4@Y;uE3)Pxo)(#}*9o*h5Hg-!yRpod%iCav97F zWgTO!lF*MNgoztK3lrCMf*pLJl;Fyg*fqoq7-O+dkOsMfOc2@yy#W>a?*CBT|9p2F z2Y7?r18=HKm^onDh*_pFsmHD#A&h<59sA-Yb{)>4@BRm*a_itA6uj;7_p%P>F!o!R2MA?|rP>l%j*FeGz`0tQujOW+qy)-);a-}9!MjIplqrl{`_#dn;F7VQdJ#r$ zycMu_r~A|^V@OwawLc*9TioZ4l#Fu^x}eqL4ss6}A@Nss8J3TO6vHBcMLer189|3= zc%$A?isO;FHMxjW=;Ycvv_Jdc|N3A5=l>Br`N!=&ab5-Au}iKvg5)E;I(LVO|FEV+JbOy>5F$8<+eQr zTt|jrI}S%%va%h|(`6_pKr@urrV7;Xm36dn7Bpvpa)JFwWk!P?p_oc)%5LRU7MJq{ zPf*OO{3vcV?6Y^k`_f5sNB0R^zGPF{B*E){{0aX1)g`sp`9u3kzs#@G@_NpmRK)x5 zsr&nd~Fb z$f>Xd#S5Y6#)VL?w+&Yx$BzD23AI)$5xD5rLD2#@uUc;W{`~FpkH5eB;g^7mz|K;F zd35DW1-#%PXYFX|JzDxAU7A21Ugf0$IG-5+bm7yl+D+u!2#`Y!m|l!fM$(u1G7j1@ zNC1OsnGAwK?Q!PPNEQvr~tRC&vRzp47no{Px^Ml?1AH`y@Ooahg1_<<;oK=ZP4j#>NlRF_w z7}5Pxzd}Qy8hrHp4VqF1b^BuUASqUauo1rN>e5!m59<5P)zn1 zR7j;ym`6DrJ32pmluchv6YgGY)r33?u>Sz-mC_slI-IT}0$pe=23kt*2{6^vmL-^` z2_FgxQ$v@JqT|=)CA!X>n2{Rf?Z9cD#{^p&`6$lAOwX@>7Dto^FE7|q%OMk?VF(`a z?&ZE)*4vN4{aH2vjDaJ0*)Dj6<0@xy`0l7Ts`5Tv07FgZ>VWgB*4F{n z3!T8-DbPnR(DW6?K(HiAXsKXLpJD67=xH?A-2zTc&%)r|RKxMUobfQ_)s^%2vOO{Y z&cnIs?#J)M%dI;OOpf=m!hfd{F;F}?r2+3&%$vT=A6#!vp^Lkqxf80fM)})wrCz5bQ(A_7@yaEAU`;W2uG=nt`z*D_QJ{nn!1YXP;nu56|9%*&#%Y+ zLx5zkUe5i3t2WiLl@HvpSc{lTUKZFT?TicIVGFK0oP*_`ziz+3`(?$Z)3nXaHTd@D zZ~1{!8kPq>u6(F0_n}$1{A^k6KfqjdunarUbY&p4b3g7;FE6X|{Q#h1(G~~Gyvh&& z%;$Bfv1{7e1+`T`VaSELYN6qm-y#DPa|RT11<*}ZL7dW)E;Wtq5S zr>Q;U9<*y&xNus)RpH;Jk$RK7@Bcl_$As7EGkO^c=;ElqofjM<;4v-5WY2_ZL-Y&i z6OO=z^*pAz(;JEe$RmHuXcVXx#;=^)*+r*=h1M$%eT07dr zY8P`+gPVLWkC$=5w}4%>6tIw%@i9o%4u^$EPZ&%FRC(2-jMF@_ApqzlM+&IU zS|htq0+F`OGTzR`67rziX{D~jGLFlc-ira97HR_Mmxjj-wxDfc#f#@5v>l37Ku?A0 zk-$|h8Nt>UF5`8T!co2E{T-_96&A#0Ozr9X}~P<5{9OY0aJ}2dLtCYCd*@6_#lk|2hYB> z{$Nh^p$m#{KmYdY?=Qc7!4_D%a}qj;GY8Sm0Y5euXFqoCX8K8?GqwZB?m$C zu%k?vh*0P|7(|3?tK58U%tsY~UXZoL)|msWf~N}3Y%X<)r*-26C>GUfXUh;Q&1)eS zGmFidN(2S{6A+@99|@7rFg3nWKm&p9clzKPj6V4xgW*OWjx$aFZ_W3$r90)N>2J<~ zKT$&EOLHEiq)PYgu)B~_nqt0D)b?8=$BsA;mH39jtwdQ=Y~4stS$rx6f|Rc{RE9Dd zCK4+mE-FJQKNGGDfX?Iy>3Y4Omk&U3E>u7jRHkQghw&i;Szwo}Z_-v=xH4`*#Sfr| zlWQ<_fHQNyC6-%UwYOg8^+|*q3M! z^4ZsC!vMICTI)Ek(@}1;=9MKB*HtI6`vKEHfP}L%I(4l9l?(+)g$`g@JLnyp3j>-^ zRPm~*H`92%fTM@l#$RRJ7^P)_KAQxZg>ZfUrKzznSQ!Z>+*hdqITCj zw0SL25)Q?oNSY~m5 zgQ+r;iU-A~UKXdEg(l9O!V?6_0d;u_9?YxdQhv>M$)M$01rrS^y z3vPC)#%h9>Ma#w_+r;cc5w_cUTnMwwsTZV~WzuZ`sxCTw?ZePPUADQPCBSU zI^{z;U)e7=S=T(6a)c;z9mH?M+fXzCg*-t%P6+Clc%iRGJuY2{qI@Gv^zBVR%N-3! zKqp^KFXKGAJ`R*b8`q_)L>h-`>Gpd-H&Qf|fEE}}0nwQb`}}})tK0{G0dgnM#{hR# zh>yeG0qT7N#)bi2Vl3N+lJS5-orCjmuMZ#g-_x(a@o{5+0HLBOK#+$-Gq(^6@h`f+@)b6HjJ|1<(ETU9^)MfulCg%9ROq< z7_NkZUNB((uJXYEXt)#{z~0in4PFpe#f^?B=eD022sb1eet1wb9r01y?oJms1`}&C zzOsIlg#*TmfXRUor&Qju7#w&lc7d>*X`7RE6QK;njVZb_pQoa(QHi~r$A?V286a1| zfV(Rqfzv`sID+}v23?U%Yo@nzFL?_*#>*MSF}r`}v$Aa>D7VwX#iZb7p+|pY)H9ut zaIQIs9mE~ez4T0m#6u`JO|6c<(lsm-ZrJa-T$4q!v0<+o|J7=db00(vG9 zs27J|RsldRrwH=*L{Rqz0Dp5`u${FuS0womB86|YEp{F! zu)9$s)qyMuT`YDv$Hg0G))eP(#vbAMR4I$Cocvp)tGdL&9`x$BZz#-c^U(d44oX zan*Smx$+c1*P^XJOHf~`^FV=VZYh>$+ZeDtKNp*%f&i~575Hw&!yJCi#a$|#05mSy zDtVy(pn{P40+E> zqt!vNrzS@k2uRs1 zX;|#eO}p{R=cVVeAqTmG$U%5;yTX0ufGJ;)hYqsTfv$rzp6m%n4ju97jtzr=3J3rs zHgzG;x2+s6%#sf&jCnU_$S>Wt`1 znM66zDG$CHMBH-iDW`#094Crpp{AuU_C!}iQplE|CP~u`9pKIA8h0u?c56=~Vgl8* z0oT?cm(p=Och${!E?xun6>K@`2Lkf!Q=n3WK(}E6HEh+f5b9m2!4ffQxcUjn!XU~# z@Pc{u{n}oF>H1&vV>(^7YM{&3%h~w2QD|hkOqXcSC%@c|l;b?}(CbodrA8N~%Xur+ zABvy1Iz@t0?;O6R!Hv#nMKyBlL`QKQ3Vum_vFazN3l?oEl(;a*V3+G519r5d5acng z^P3=5L{YOWg0p=TI;EZJ#X}xU=Z$6~&Oa~rBVMfh4#W#}<#k0m!jE>4@A~O{tRH%v z^Rc=N&Gjid*2@Dx%~6hXiAs7~osQe_tgiIwct1)RcsdUB_Iku;I9|)OxpLEakf6_W zWOOc_h*Ca+s=S=g%A1~HHbu*83f~Nk~oNC51e>m816h| z1WG+KuIjN`m`sSZy66D%@CZ;}EsvuAa3p}Q)CuOO2DVh|X-3*;I5Ne2V89zAzb|av zkl4jZKnoG&tifKpP<5{OKGi)=laP74JeOBX0%f&a7lYj?C?Vtw;HTs4_3) zcv^a?pEKMS_3p7?LSSDV^@i||{1^i8ufBgVqb_36Mf<$zc$WMYg$_`v8^nG~C@@FU z=8lNpj{d<^uoiu}a%h9l(OQ^_i~IP+g~#A)6)gTxrxHq7hr!q4L@|2Aa8bAHY9&;3 zwJkWyFs7ejR-1yRLv`gKA~e%$o*S?=Ly*_hsVLDFV!gmcX*t);{{7GXWj{_Ig71&U zrgu2vE7{cewH6Ll037Eg?MvEjd#RG;Xwg%smWS`N0(f9a~H0hKr`4;>=`ZNBR ze8pQw@uNx7Dfk{f4$Xer1rpt&nBfhLbh(N)ID0^(8K643t!(VeJh-hr`|LYFM~8Ae zoP`ZC%Wc`pq2Z|FZP~Tea()K4|9hSv;S}5`NW@_fPAX`dM-=={K(hP70W@sIM?_X8 znBWLVEk}__{fJr#rGuzJsS}(9Zj6>yX9W4Yd-k%!g?QZbVuz zWZZ&!slne^_||<><6r(@KIAhr%abm{3CpI3ZzvOcz%8r?8(U1^0T2!hfdv29k$A=N zG)SuA3XqBv9vnrR9Hq01X+2Tg1cbKVAu_^MGY?7d`)^;rynK82m0JdN?cYW;2sz>7 z#^&rlwLGK^D>P<9L<^^Nj;iMTIyq;Q6c$Cr+Co%BZ?g)MZR~rEa#7b5Dek z{b7Qh?f2X0{Ne(rFwJYCp-~k#z_n!{aCCzyrLX(BT1=Dt21|LqGHTURfui8%`z{>B zMkqIS1}y9e>2cL*$ZTt`^JGy5baiXZ%in+Dv~%RiTl=i(N*TaT*f|b>%IWEPier5O3#2>`kU5@8=z$jpyU-FrR(M- zPXbAD_0cX>>AV*CL~mLrJqt9bo%thbs&~cIluzFn5#g2P*0tJGCp_ z2f(?60*)x$8c7_)4w#7O!kG5*?<|3oPMTqOq7fo6dz9GD`X_J>01iBXpc9Vjvi zn(J1qoqh6RnYQYJ2BvdP&;w@1Pc2X#PZ+0mC1?=p7X0q$@U{(=u}9XAo>ejWA2x97 z&&3YnpYC4T_Fs-#+r&{r0Sp;FEGz}f;&fHb36D1_HK?6w*XGC9NHjs7-U-UN0JNN0 zod5pr>$?x1UOwXXv_BZdf|{q@TxnI{Kl~A#3bf)06|is8v-7Qyt;2+}nM98JmR zCb_=JL$Sxr1d+C|Sx<1L&W$6fbaHtsx?3S9!Z!-|z;qvtYDK?EIS}3s!k!`X5PM)0 zp)4tMaOI<zQK5*?6%XVRfH@cjm>$r$?j!j=Vk_;Y_a4~^-?s$HKg^W@BS*l= zRD>u-jmudEoDLCik^!}D4d|HPAjut|1RQUw`_w%*q9u$}!i}($DO)y*m>}~c6hU{cAv7Vi=dLn|0-#661Az%|Y?4{7k50S+!l)~Z8* za&9s~%RzEd@eY7*z}Zji1e=&<@u4qlb_c_Bv^i^EoN*WoIp^wp`R$ia@A3p>+d?$6 zzK}9HnAA3nb`E1pqjSd24=Cq84L_g}-{avC4V;`43|-l4LM?q$YqWQu=D+~s4S?*8 z${zrm76mhBG-zZ2wGpCazHS;oK>S_`^}mbQxdmvX^g6UuutPyMus5YR6 zW8_P*E-fdn48=OP*PwwJ!5bQIiT|uOSSnVD>WCE#y7+egH z^Y>2~Z_WS#^=PD?Hvkv0qixb}Zv|Gr zsZTd2nCt1Fzc>A5UWeNo1^xOgjz_eM`W10VJG=;fW!*ZQaOO(Ih^7HdHG5Y9u-##+ z0lEdb9@peR%78cTR}Nh9#`yPjN%83OTutq534VR~ZK}H8K7ai1p1Zrpoqd?SCKREK z)z9ap=S;?)BV=ctSuYjSYtONs$8|QKzDPe&1^bC-nvm?+`DXoiNT&VB2j`d(sp(;< z_VT@r^xm_zzyTOQ*KE~9Ky50&?S@wI8{>2JG;s@90R6~;#JV6fl9TzBCGe~}PTqtD zo}}nwkR%R}^qD!V51z9d*wP!vcU4j?9i(;?vu=kLAuwzeQ!2s%y zwt}kA^J|jU!GOjIg+B{QTo~}18E6Y<)FUOayMa^9dbVllZoeNp8`vN)5bBYGr2Tjq zW#abZ89BD*b!v)Xjsj_km==YaXk>}A5UhpT4`a5AuG9BJ@av#uPKaIiC+N|XQ%6sa z+TsCImoSY-O*V|bccLBXapn^GHE{scT1{|PuB5=PSlK4LeX@S2YiNK9r;ZW z(ihqy?U@79eZ%EP%#v)>@~i#IQFpfO5M7)xHS?2lz9y%@0-E#6@7drbYJQA{-54l$ z9qc{eb=Zm-IopSwNqEbvfN?VlTP?XjJ)xCOS6{W;G)wVvuDPHeO$&g9APj-l?Vj1)*6D z@PDeT^@Zkn@_s4=atCor_`V{&!Y1l%?D)WI(a2?XC?=GPx-o3ZPD!SiP@Ay|A;2aP zAQ$X{UkxI+1=fo}?6>H1kT`HmXog+1GtAOl$It7n?KoM5d`1!wQ2uq#$DUv<>)l|G z)+=9)k^^C6fDA{tZar%wfUGx;E^4Buh8c&l5tv%0Q8hY<>}b>0Fp}kAs1Zqz`^01H zAhc7uZRiCOjv^Fi3i|PrPA5b*$5n_etph?q`|#IyUw?Y{_2V~gsa8(XGqB48>`kh1 zcF|akHr{SbYov!|PR+~3)ck-g}Q6EybN+C*pv8}#WV)}rg63Zz&OZGH7c z5-3V8Ko-;mQdg9tN#D~LB2evJ5FHe8g2X|___KwfgoRSd1bTIB1O?65o<>%y>vV0o z=8S;uJkp2;P#*&Yi9Enx3;7B4KLYa$uZX&uC>Wq%*BW2yY=bg{QZ-0%8c+6pPiQ}- z{G=xpga(z;4rM@)g&irz3Cd}dg|P=c)mFw7#}y}Y5c7h7QD65(#aaLlHlFgm z1EsWD2Lag6rNjUOiEeoTEa#al-7LR8^2Jz41(0Y6x{bo>?F<+Ob$E1-@UV<%4R-f( zIF}2ytalh-ZAGx@&uCS#GqnI5Y4PIpwX%671nJBHuA9x(^^A8D`2(*T`w9W-OC=Nx zfRZ(83>&>$wo-#F-7+lGP~vH1WpNRj5!$`9IXT5&z`mZVN8XWbk{Jm>0OL{MUWlZb z{vzgF0T&<sE&jUpMm=+w!4&BgpxBxD46rM?^rIUqjSdA8&0H*!xxVko z80Vj-U?OoU2HA@&(UZ=?lT-d^IjUO>P3c7Z|5$g2nG{pIRl)L@09{}Ftq6c>BtI9OX*)M1n(zM(6GT9yH}0NdrZ(+>sHaD`tQuX{V)BR0!*uDv1Di{N`OcNHAn>0~z{6*FRt_0CnF7fFQ(Desq!8tGkGFX!sGVPEmk)H%Y?YmEg( z@3{^rV5#45Fw206N5I%CsA8^zXLl3MPF7h0gycq0_H7FG6kH9``YoWdb6}9Ij6b}J{MXR#9Ng3&D!qszWUp? zPuApp@XJ5Hev`|F>xPI$2(Ih1SJJqy%aiNO0B9$&!oRMloDhQRay~Ky*ZKNyyy7p@ zc>Vn2-+m9S6nlfsZqOnYQm+Ai0E`jXd{npVg@ zSGjy{@Ek2I5$&2vStpuh$H6i}J@y9=u|RsN*Omgs%R;dHPtXK!12nP;DQl%`i(JvQ zCwvmLt{4E-wH#lO6g>r3wv_4wS3>jojC39R(rni7zfwtbfE{hbYJxJYn##Zx7%Rt$ zwG@LRUsOp~y$u*}g%THHO^#fDZJHYzrz{Mw>VeIW)ku4(M!4$A#i}`GQmEQC?l6YkWfU+ z@latJ=fP#wl4j{xL+1OU4n8XgRj8MS)wx9Rg%4(&a-jGHMAFpm8VyC0F(unck3wO{o$F31!NfWF_j(n`RD2WU9}AW)b8g_HX6`LT(=(Z~!gr=h%a zMB#FxJ5=7cdDt|%OS4E`4=}Hsm0-XOa8YxCkppvxK_HV_P!)(kSO@)v+-?x_EaW3p zL4xS0TPSWiz_nlia3WW83I5g`j||vC6}5$rQ4E|4FcInO|9~f|maSK7?ozT+;9ZKR zdT9U;t#aahlsizQUA%@nV1$KH6L@$|h;Y$8VCsrj6!-v}zi=ryPm?iO+-z1aYLc~> zwk-IY0WXNEmC}v^y(NJ?QI|rxnLG;x-_%apdBS;&9aEDn48~z6unAyqD7cNwUeFF` zg9_NSOE_~0?nQF6ET~A<4kVds?FE-9^zEYJ(5Fo{2VBq~!-k*{8wa6-z1yNuX|6)< zIwgYzSd|!)mVCHPJSM$8(B$iscRg@6^eWu|Ea}8#AjC;)mDjB?O zJIy6ZcANxLMV)H`wp9tzizgrl?FAa-;XjX%G#g&TX7yDex3l>Jp(5(;U;^D8txvJjUB(V2~4dh(I9+Kq1nfE{xW zJ^@Y~H>Zym`v0hnu#Ip-n$Xx^%aKEBpCX=y0l9ss0``VaCcz4nv^}A<^&5_~4|d!b z3o3Ut_9b&o$Qu&qzaqvX(Q(JjE7Z-6ABjVaZO^6H17RMyeg$xwnkOF}#ff`L?T6O?3GlX)3e@&=V(%~F0yXAB6CHro+aU$i*J?)b-NFQR z&wx^=c!jyyYL1=;3);Fu5?FAe7WJX9X^S2v$#WwVoXZrn$+Jp^kInwK;Jn=iw8APt zJ&m{J$ljXsy{*SP(*GIXqhs$q06BR+5DE>xo>w^sIs`uhQjTR{%SnTI=e57duMvPt zq^ZgdK874p03ef>Yf0e$i{Q)!yfvc60N-6B4v+R|z}g5foj5DYDOTb-$O1K z1K2N==MIv{0oSdZ+3vheufh3pcdF~>3mS{(3mzB6UTKRS$i3!58=zn@VEocc18q_D zj!*pj9AiL=1!xTsO58JYF&j~Wi7i(aVJgPXxbJXzo$wJG7I_*EVY3Xm??gaF$FJ86 zQ>$qht|~ux$UVft&jz?()7{jc!Uvd3byVwFsJ^!erJ+o)sD(W|v@4#u!9#T=AAwWl z?*!?~!)Q5MgK_U645Vrg3&Vi8rAA%b%`92o+b*G1bh?gV@&G#_U!=|8h?n*JaN zY7eu$Y{`e(^GYo09cEj>lZV1VsV%i;HJz3E*?i+l&W*++7X`Ll>r5!lhm273{*j1H z89;B{B!C-dM0(&cC~h81b!e8B;|<9ct)p_&71>q69_4d^+KfFZXNo3Mb(_EdIQLN; z^BDf8NGj@a>f%cCT^p&&a)McgGvTb<(AX*Y*64n0poh(t+I&n?Q)NX|1QKwJMb~+>f{v_XS zjkcUdu5bpRV!~%LV2eytt|tfMX29xQ3o6w|C+c9nTzJD`Q$fjjp=`wQvPE&^>b@K9 z84YQ4#VO-`>AAw@gi>3pzWJC>&O8O6dHWmzT%xLHw#BLup?)B1ROdGoa3Zpx+#0<7 zNIz|8#ho~XxZuQ+pT_Q}J`VO>%Bv-|)N=TSE%l6VDbTQRAW0B z(1*!Mlbra%oS>N?t({Pia2_$CJ+brcG}g0qk%F!R?Jhv^po6Z{P@Lrdjn3vydRunv z7tvmDq{+|`%Z3ROl}9Zn4kC@!C4XT|tXj6xPM3SxUCt989+uhdQk(ND{3y3$wo7r= z<-BRO{HeV&O1I#rcGW`EfVB<#ssS8j=H29p4(5b|5C`|;ZB*O%WSs*U;lv4r1a=eg z@DKQK1p7XKVj!45ulFKfP4JdYNfV$&!zSNiL$VFkmYCv^y ze&f@*gyrdeFy)`idKvCZS1+CW!F5l|clU#dh<+ezzPBdNpma2#Cbm&zM-~5dhxLCt zBBCzCRw6cz_0_T-z@n~UF9RC905fJz?62fP9fPBeQGrM}uFoeyjnt9Qb0$sjle+0( zV`9s-;KbZhgM7e7x`TwE!C`=g$hlmYZqQ&w@bI3g5DBD_7X~E5rlwO$T%f$EV8g!R zf%f7Z8KbyQE63ykHm-Oo7EO=<(Afe@*pmjWj!1{>{8Qcs*w80q8b9_s)L(#7-X%_a zrqehJv@lR`Vo&5rLq2w=4k-r@@e`MIHY@`S@X5paNmq8kaa*tD_i8G?18*06<1pOS z$LfjyO~(lvhl|!*+qXUJgX6tGg?BGEl4+QtYB;X1O)WzL*mayHC8)agCMZ^z^T+kl zZtP~^c*Zua;a>D__Gu9~X+eOmc?^Cuh_t0|@Tmxj0Ksswvl@=f8P%&Th2W2JhLeY6&>5aGZ*@ zFKRR?ew+#pG4S>PTJ-{YawIU|_V2#@@ag3TZ9&5VFFC&2Fd2Z((+&i4yhcFrhC=%Y zJ38gc)#EsKAqN9+)n%iy2wQM#SFnh53V3@DI}f>skWgz)J>kZV<)fQ<9&mt#vpEGY z1-tzlp*`X;$~I*52Q8pTSg z^y^E>oQf#Qg25?W)~ElKeosg@7IM!6Q654 znx9efLc57D!>9XyuB6>O2XGc}pFjNlfgjksbgHvd}@~w?y31vO}8pKcoCWQ-oJXxm>kK zkO}@vk2pL!#=}S;)Jx< zyfVe21f>HCE&&D<>`2G173uGU=i#(j2Ed8Uq#023T=a!jLV?RJMK#`G>Nawsg|`M( zsBa4c*;X8cWC%XebKGY%XjI=Wu>Kn~W0EA@1)A;3K12c~X#ptX*ncL6a&1ZHjKRlY z?KQt{3K|v;lu>WEWQ}z-{c86G5=6rV2lT3f6tc=cM1zL>qgXg)k*EaRxD`iuie8J8 z5M4IBhJ!jfX+$B=boj}xYEaMI-w@6#GF`wqIGTsUf7ILDbl3J);Gcl~e2rIp|JbSP z59UnchBI>#=aXfGiYuu&+qXf(VJJ{9H0^cd8jB9Ck;eLUb{^ig;OV$Jk)4iBeQFp0 zFi$wUt6?oWvx0PlsI4ps2My9Frym6J8#srlfmC?v=j%d$<`))Q^`_~(5df)jsh4fL z1RwtR@Q>RGv0K{!MjR-TPvb$r0Qim;6YfxZ59IaQRr0c1qy47>p5u7RP&I3L*3f`r zX{j7wgg300^H5IoXIsy8wXAroi^HR#%`pjTPWGzN46CQLXU-Ei)2T-Li=$Nll#rT) zASy>5Usx9q3qej#H5lg3K{tBP8U>%}!M8O9^5a58{7xo{#GB#FdY{`{~5>sRUG}HP7X8+!{By9y$pmr?KKyOFeg5@l zeD=$Fy>N81zI@+~<-I(E&X-NT6+V#4ZN}k0rSIRT?}NI%J3|)8Ww8bo*ZB!>$F>l) zx32X73#M*SjIf(ffX1bOA>hh%ReuC|4B}2U`q>=dWPyjGj>EU?Q~AJUm?{TrdGd$Z z=^zqlP@qPuQJx~|_JsV5j9Hu0P#$x#fn0omMe7eq=7EB3>-FaLV~`NvN` zV$*e@yI^MMb{_ET28gzgFQ0z; z^6@Koab*yna^{dN%NTajO>yRc-^5&1^PpkS{B#3Fl~G7&HT*Bov?x#U8}V9*cdl#{ zC?65rQ9b*%3j+i|cW3(xfTTcQcqIJ=Aj0l?;R+=$Q!jfF&94{GW;W0jG1?qRm~~&l z{Hk#n>V?bgIuopkEh@Vsn(fF>@4tTe+t2U+71YJ^slGf7Y3pSRb-uR-5erm-Zp1#w zVx9z?lMB!ikt<+6+gyP9ZSiL9Cf4rXD1ReFeKD=wGvcP{dPfm9i5A)2q>%%Z9{_*D z-MS7RyFhW&MtsJB&9Rx#c9#4>4V@P{(sc=}{m`c2N=$rHHfz~|VGyStc+D#(@AH*f zSPc^+fL@6T_KVl7qiM_5PK^-F2+kRtZY$osx}&CHH$w%>{LDp$6&FWx+6XRA*hz~VuRVF|L>9io4?nWD{jgT0e(V)4ZDG8 zM2rAb6BBAN0)wC|bj&!RrZ3x_eA9)-* zdH5u#qN_NQ%;x<4;85E*=Wh{ljWR(amIO{TN9qP0*O}9jN&N&XfuNqoTFAizWPc$| zGeFhcxQZY5vZYBpxxZ0~RG_XW0gMttTX6|vU21D1AHaZWp_8nN^$|^l3QaWz!bmBP z;D_Hn|Mu(qPw%+Jyv-1rW{3?cy;4`pZ>tEe!f3tHDQ$uCKhd+q=g%L%zF_MS)*myOu&WxubS?{W-Nj6T_a=n5Cr1lF5Db=jT_LDiz- zYM7z`)!gEK?XrFSg627(eR68518#vKh`$81?U*22R9~DyRh`$qYqoU13&|*5U`Nrf zUeDIZ4?lnX^z!Yu-+x90Rh>28jm4cq&L}bDo1a@GrG+QM7(XL1{_yjs-(Nm{d*POW z9e{-9IA{AnEmpdbeq22tJY<41%Qgax%W~x)m;0fU-?pevn+G=c?HTVqqz3Y&Z9VVbx)iZG0@5jZcO??LG3f0{4UG#piRP_6`a$sroeSLG}~9Xb(g1h$fg2}KNj z0W_0`DDo6KYUbWUPN2_HJuYWqz>*`V`9SDe1Ejo;U#jSD?P#0qZ&01C%b+O|74?pm z?poHUQgM%CZ7Yl`E`b`T&j4yl6vRO#g95GQN`4+tF;#5Ap+4az+PExU>t(nUm$Trg ze}K(netj0-gCEK$%Q;PmUB7%|T(v-31PPmPZYE1J#G2FSL7ZV96OhwsV*c>%<=dyv zpMMMJ14PdA30ehKX`WBaqvwJlU?Wc&G$Qq60jSjw3o2C{Naqc^@kA8a2&}ouvb&gu z_C9KtTP!6sf72pZpBbqeX&nB*?>4i_D<%$OE`)|l(FnChH3^({gm?M+;nSCQpRwgO zN$a8|-qxyW8LJKn4bmrJ7>cr;4?hGM^zbyDB^?n+d9`LL~OZDb$Ki4h_Br6MK-35pnOyn zyU&K^5tR26O4H%YL|opBD&%c%3lrM2}Upo+CqKSIVN~A|iHlWX z@UqkIYKvv9{|^;&$@TRda1u1gCYMLQ&DO2UW#|8WAO`RSNGA5YaC2 z@mDQ<2=)!De^~7$3S0$c|48C}J3BzpB}fECTt1f9fKIjN>o$AX3D|}(KuIc)zZL?! zhy~^*m?R}Pf~|=nr8`D#he$rQ4Z)dZWp}+z>;nX7c^H6eN?PtJ>r;8-8+OH0^LR9q z61BU*G*$*SvTBGbT+kPK7?8BIL|3_l2;O%#VbeAqJ9jyDOB&Vw4rntuC>D3PP3F`k zG^}qM3wJLi;cNe72+E877rdvF6J=w9T5LFXIoAc}8v{?R(lD+k>!RdrGLAWw9609~ ztw8HkNE$96aE^dLLm_2*dQ6RWoveNZEVy(_kVpn$Xm2;|;>b(vAacOzWPnp=k9%@` z>L3(xcC@Xo12Btg7weO!LCvDIJs#C}R-V`Wp}pYo&-6~pOmgNT5PqX(W2*z#VdqS@ zF*)H{&APN~D3pz+h@_gKNORIxr(Q6Z>k>P62UN79yq@ zz8`P9eL@=KofU9t+3`xCf|@pQcxuH}2ds3ypU6^n2|9wXi{mi+dN}02|gLXeA+_;kQiwLY-+CaqGnO2rY}{yj~$ij^BIwP%Dze<|OR*QS0W0qbl6vIpnS;k=RydI#NWz<(?mir)TW zcSk8Dep(PrNj`hWbi~E)d`4Ff&SR&lu$Z-@^@g|(n~E{(oU@r3!?tSz9s#!(st#Wv7`Du7-#r{e;sX9hq~%|~Qd z&S0R%fM7tYP(YUt0L@4q47gUS(0IvV?;wjDAQcpTD8&FZSh4n0a?65u>q*xWzuof?n?y6!cm-gU>Yw??laxo6rE(Ab`5z+xZ&26QJ_- z{@w`sLpZb2i%Er){|ZT%u;KDG>H4 z;5dFION7R!fQFPntGYzB-$cK+0*v$@v?J`TBq*ln5Hg(q_H z3?HkuCOghWWHA{MI@sG>JXz7{58x_45NINH^r;6JIY2ZMIB5bEAd`&7evrN^%?&F0 zqZAba=ZXo{jHA?p;y~U7m~#zqg>FMO;iWpQd*BkaqN5j3SW191+X{jr(c$zsId=Gx zET(i#E@DQ>3h0nkHP6E%p_O~PcbfKBX;;AzXqJ~{g6@PmkFno1uZ%YNk<$;mLGx;* zgkZNbaC2)9_KU;cOh)En@!jW-zr4Kr^5HACF(saO-^#ox(80l^(&x%aVCy9)F2jYn z8qL+9XeTYNibymZ@!{Kv%?56%V5%{5pU1=RFMr~R{@3|`{jY$FhAQ@n74#C%j)8Zl zfiwAV%E|mk8Ytf$x8Zmzp9U4ji-8N3$;L-eG_dS-d@W5=mIw9P*(Ff#Fj@hV`2sLt zV&N)}M^hSD2H|?znZ-_B$LyI6-l-twj0Sw=`cgdc3{`V$xo)ATJ~ltR%MrB|2Q-McJ%-Jp8@;U<)gbOub1jl@ZHO6c{;H_>K#l) z#d2YQx}>Z*+pa;8SXOmi!D1-n-N2?&qs_bVK!UAPK=lY4tVQ8$4ytkacg~f=yTh0L z?jP~r?jP&JKZD|s><&yw?~*e9A*yk)I6kDvNJueJ8COZ228SWKzpL`c>CfQsOR@aY zbo=0N*zXwvH;*L>4twjd3EoC$`oA#x3&Zcm`Xq;ao?%;+(5M?_Cfc?SAd+a~}Bzpz|k_@u+TZ9GsER7fd zF}|Vwiyu+U5a2BR2S`(7e;h~cm0cVoh~q59b>d(*qtVTwfZgSqeUE1(vK?I>qwo)Q zHq!wI6=@k&`#RVi>dV;Rad(F_kCJ_yfubkeM2Qc;lNvckP-7YSZ=z`PpUBUp!GlpQ7C5J3ZsY~M!w_^<9vmZ#f zF;mSBKX=-cBwRC!8zWvBf?enmYrgH)eR}}FB0XmP5ai}iVGi;`J8SW5ey~nSzz^=M zLzXcBqKMv3XAwh??|T4~Ky1HrKLN2Tt$IW2DP)p9A8YA;_aVVF>aN zx8;(`>>s!F_;Ff;%ze9E0o-Q{L5Amco941n1Fk`e|LdWJH_Y2Nw<-@kU@H+ z9g1c#N})pz!z>BXeVj4?a9WO+iC@8C#1N!APLsoPva1KT&H{X+hyj4|i;Me^Y+WI3 z4}}H>UMXY%Aa$jQAY}+rj;8T@b0+VzmZr$9339@Lb7B&t-7KM}2PCG5Awa@N7=k2? zb_@aHH)R0e-;@aw#B1aN{|7(l`4=ylFwG%{0dS3k*FZ930Hj=vg8Lv1>`^f3DsdPw z1b7tpLeVZ}0N})kC;k_jo*5oA!mT3SEkY7Ha1ZXOc^C#Mj|um(_8jB_MhIc2xkUz{ z0dGslv<4?(QH-aEM7T%j0BIr#laRCc0a2dIHz+8!D}{QZ$b+^-_8`u9z{fvvQ>*Kvz~ah)S5_3o9(3?ti3hOL zG(QK4z&(#Z2j}iyiVz)>D%SxLf91qqFqT&Vf`71B9^(L!KPIvV+xd6j=>-oSv?Wxk zHsI?R;B+meVSF0+EquZqUl4hU@V3RDwe!1n%9jozfj@YsQUH+Ko9qH3r3;43N`aDn^~GXP*LK1}!(aaUu2D-FQd6}zi z2=?VOADsq#4J9T6e|nmQw^`s1PTjL2*JYsteW=VAOlX!c2rO|K>^$hK$O;hy9US?C zBY$vYZ<@m3-tjCv4MSiCS-L0WS!H=L%?P+10iJqAgU5Z73|Lafs5bjXW;vhwAucGkb0?51%qeLK!_O(XcZ9b zeUr$2uEZG>1bZoi&;j#a;uE%k4i2qMOMJRE;01l@kSKw3mtye zh1f$Vu!3D+XQl2feEcU&ypax${RLyc%OzD>Q;FWxe~82x({a2%9Z%)?Qk8f7$o32b zlnO9&W0w;EY0f}M_xoHB(|!-sl#g}r+aEBR83+VdY8WH}OOygWXzV`;dji-j;y?B> zv9GscU(m+BJ{F|f;;O5dvCIlpki7wK>TBrO*U+&Fjod@#L08T!j|uELvA=TcFX+-r z>@&LownWF%dATC3Ms+kFxtJ1`ddvVoBPc}h#KamgmunLWUy5upKCEnse56G_(jsrx zAVJbN61;6O<0P^ai?n(m6% z%c?$Uz(V12?0Rv7gwe~bspxmonmaY;m$0 zkpvIz*?_zCLWm#56YVs>_vCx}J^P;X6mE|nfN+c-2VDPmQ~3)bukwdY(&q!b30x5; z`CN^Dm)uenL{6|Kh`zL(4vN>%7!ikHqF*^rgfH|f-Fx$00Ua0LM&^Ng=9aD+J3Q$x zHXk^M{$`HXf{4DcCIRO|Z-|ed=oh5f2wc-g7_|r=V2%d}@;3k|Ciwu0ezXPMLG)qd zC^>HWL8~ON>xYT%jtQI;Ueo|BULFVq9o7LfCmDBlQ>lW8(@u&S2NzpW)fJ+HV@q5= z6TNfF8C>_FD#Ae~kS{e3C$d<+i>S~}NHxmnK!HEl36m5eb_C5Nv#ANpj)X`$67^;9O-Fz-kSE*`o%T9>bcx5v&vjzzzmBN?>-B zG7va74>7cdS%&~{?ZRm9nlzF15u^fpuf2ak>k-&{*m>Z+T#F|1odwa})u9G_)V+@u z1K!lf#$H8w?m-9VewUfx2C24K*&g{0g-G28cCSR$Yvel=B6TR}bzB2F+PfMP;J)(S zRh13pvk?6oL&9XL_$ znsNp?Z|W0N?u@c1_b-|2B~yXBDS#8j@lWcW$G>E*#Ikpw=K(0kAI1J?gxnGtAjwebk=V@3bk&4|Q9NOfzpTZx zJYfK&xMad)k|hTQLc&0Z83^_lL_tH{Ix-_B%KXR4oRt=-Z-Sp9b6uoS=8Ln;r?<@K zTLBY7=2{mHGJ(aDfi7s>K~d&Usnt-=7ls{uDakloL)g+Ea!ga^qNl zJZ1o7yFFIt?-psR!QH^`aVRmuqoG ziR*%Pz$?3^yn!9FcaP!vRROs_ICnR7&C1C4r8v;N5`S>wPfr*K)-w_L4wH!eB<}7m z{}|xl`0>4%U!MYofD;Cjv_1wlbFhHD8FP*XE5g|3KLGNaAz+s*3JcsKMrL8}l>uh} zkTf$25Hk=$20&sn8UYkYZ9CE=w*dgtt`~imj5~rHQWA=}=5Q?u|1StO&&5%e{hh=C zO~$SbTYvYEeix>HXRFHS&ySNpPHPGB!9&>Zce+BF(T$dXWAHX$eCMn`!)0-B?L1r^ z*n}AWqpWI&I~6j9l?N7nt{?FBMyEF_-{`=$ndkFgxc>{Yzc9T12mi-K!s6{Ju?H91 zDd#|>iQnuZ9RCaH;=%CW{Qv)UyOP*7RQUsc%cFy$bii@~m0H4KVxGd8#ul3_albzV zaiaVC@-lX#rUp#6u{Sn+A6pcA(<1gcG0;}gDyBM=!J!;w?92O zw7Mkn1+5>uk0RHvB#3lbH*ygFf`Fa08ycb4HzmklL8epl`u!)2Cm=kf@Ffnd{b93&3(7AP@x_F#!W zJ@F4__MQVhv(=IYOwT)KYXc&Gx=R2Ckpqj3$Um5isN7Y%p`S4j<~}9(`2k_>x`-U) zguUOg|IaNtc;`=dX(RV>n7dwo2Qk6gD`D=_M()OK4eVg+^$&BOn|!MukXRa1tN*Zf zkarq{d!E9*U5Y)vPl7vgY4iTagg#lu5}Rl zrg-RQ2RQIs_!b7C1KrE@0XfiFuC&Qq$?QO<+nf^vyI|svvG#VDxjv9kBmakpLPqX~ zUfUNmnX3pxKSRL4o+;MATAKlG1xg^9Hnk1 zQ>dnHE^y_qAK(YLh)7+{M94id+e{HIz9-K zY|j8lQwBoB0C4uJgVaMpu&#j6kJcO5!PfXBpg7_#pDYrViY$y0pS27U2Rh45R|4cR zAOKko(@F3xL103d#1&T)=$ zW~`}TxM=J;3mrs(8`jhoGY}nci?4`cXZVD%uc%|6nPNA@7{+b_2q3p_=7+|^*uQP; zQ$y^!p#hw2%Lj9#hGFdbqa4HzQr$H6$5^*$7>E8XLK|ldV>ezKMp>5R`#8P>*=LY& zn`YT$1ZTV;4@N%kc!S!2Dbw50VdT0h4ERowPc1fFejwO*ZW#HRFY*5=QK2sH*CMGnH92c6}TQWU1{@!jki1HG9qmm(jzvcPRu z#IdTuQ|Kw(dB{EBlHqk2t1He6xmsqoW1doSV8jE~heh-ngElsDtM?O(SP5KdA_yi;TB|0WdTS z!N117Y@3L?Od(f?8{+cUrP_vF+D^gq(rw4#I31tCvmFWsK-ZS^SoUmBr*$e8LJ_6= zeegUtmE4a%&&7D)92I2mXCq~9T(=ooO0JN)y4c0Bfu6CsHVnbDdc9ZWeE>A{nz9X- z_82^i@9r=0b$(PeA^O+5zyFWmUjS^1wIxmvBcQ(20`q6ltv9?YFrZ_BQ>w?DzQ+_vNQNsIWmWoR@4{scDbu{$np53I|s zyiZ3^H7uqg^8gI~a)soL%m*IRV9}~7$ z!|~d$CGN;Yv553wJDuvOnA>1Gu9x#Re+S%-@^|!4d`Vol=d&EE;i=+Sq)ZGtH`|et zRCpZrbUlzn4Nz`v?t2^;y&hhV=_PnP`~3D8w&1Z<9p?lDfByOB9EB#mzYR-EAj5h{CEmaf3t?e3vMh@DD=e6q$ zxTg0(^&&d_k@qSjyp~i9?Nf($cjwFMPmjT$zkUAW*O4t%^GpB4kTIb0KK*y>F2a1&zk;svY2fco{S8eCB{EDsl`nb63M z$3s$OxcHxf!@+IY?;Y%R4nn^x)E4@C4+%rFjH>}PVjO4}r)AW0MXcp~0FcDe)0KQ4IC??}=00{Mw0C>ll0G#ms~H@*TU z`%7A$YdaF=`uJKQhH;LxWgbm?rtj=!E{l~{J{8n>Zl;vNQt}OhjpdB`NwPoWmP^MU zrs)Jg^)}K+*`v5qlWP#z8FWmxgiEs+oa51;9JvMecjwPLDJDGRH3O>_Rb_GA%yWhXAT-Ew0h9#bxhA^$TG z%`kG1c!&YbQqd34y`^hrSTKJWL~aXmnnC2ZAi>{{_si>qf1bo+cR63yqp@tQ;17^W zbZ)X$nSUH9^MK0qE>Kl&SW*~RT%3>J0oTiQ8MOP1Yj1*Tx%RdR)wAuT+Xj5`2{di; zQpDB$bb3JOo9;Xkx`Oo(ppXmnyR^#D&KA&`{Dc0<4(U(xjK{n;!$~d`knQhHv+#ry z{zrchMvUvGp7;5}J6Gp{>Na=O`NOeB5-nd*%iqT%(f$)yiY}+AydN8+hH~gNuaR&6 z;49&Hl-!-tOfgr;ViSQbJ-7w0(ZkTBJi}~4;&=KxoEm)aqH8sX2!Mq=;Q0!A0@VeO z!l;LE-@j&a8Y46ALo|58EKSkwyyJgap0>d~-XDiG+Tk6YaT=_zrTKVR@6ng++rK#U zzb+fy4_?l}KV~^fPlI(vxoHAuV#Vk>mz;FD08o6=^%h_mDQ~fQZ~gzc{VRX}%g_ev z&^4^84CEi@ux&-fo2@dRB3?B5T(Z4Nq9ST`8j!b-{oHTC$WnnwEY#s+kYgTj|;k~2Xbr~vY1HU-}vboB(whw_vv zF9=t9o)gf&8jdlI)a3#5Zj(1pU?U&8%etUBwPNQwEjaDqAtuZ%m5l(B!YD|nuZmZJ zY`6t+zyN6G5AXiD2hc3Mb`Er*vXpD8#s08;i>e>#puv^!{H*K%{dKKjAuO=&<~GFP z(*_e{d;sXUkqDO4$W41w1cEL9)X_f_U zLjQ{O7-Ne-Tj&-U756ey7GdV5n`JC6vzE9-L*&e7?i{0knctM5R(uwjiURwqNj29GS$nrG< zK&pATb~h~ZeZseNy5PY#$`8`HzH|unL{uT7izx~KVC(DvZKH23{e+ecpdTp=k6n@g z-we1WdqEk2Ooe;3*O39hgs^zP!yCkzhcuAsJJ-qJ2+adQwU!1uJB`Bgyem>Ig$o?) zJ@A+Y32MC&j+Qywy69j>0;-YT8wkkAyv1216TPQ-E(j-DtO1?SKZ*ypz+B_Pa{!$Q z;UUj33F=nR7xN)^z=ssXev51z!zgtS;(5>1&q%n-`Laz#;rD@?iHbKR(nQHVc!Bd>ztEZAj_GH5mybY~48h1(}0v?;wsG=wc#1aq&uzXRPl%0v^K_M`hazn98Q|vMgQDrKk;e0D^-jFI=vq4nXe7XLqthI?I*fs1){dM3!Ko*WSvx? zsH0P>CEN0K*CI-yC0>#x4d!j`F30`==pMW;pdREm@kNVQvSb&`>~WyQ0bsjv2Ec6H zZf#?P?`JTVCxe^c(xHtnXq%gd*g&3}(TwVE?3SG=TTaQ%^CWStRc;ueY0=z5`H7&YtFF^*}GGhV9cq(Hl_Q_l*#X!n41| zX}r3NNDI+W1)7NJ>40MHP_oVIKy?ciKrbG-5hkxLHw+uCX(L*Yvy`NE2M;?3xd%Ot zAad|O_{3wpO)@OBej+49Hj#)nvL6guL)VXn}1A;5Z#B%wIbM~{fYx`H#l^a}wc47Xex zm2NYWDoQ?r+{g!9S9LwIqtBCobvdCbo=-&aLOmkXgaX!|v#nWs1a9#f&uY4-R{M~; zBKHvSZcQtHmN@#z^;Lm%GqxI=M6)@AmFkqT9-v#!ykUh@KJe*^Sp#~4H}85(-1!xI;I5nRMDd9WJf*~RisUbwk6=YTIZ-sEVQhIH3# ziJ+ak;z8=J_RvMk{;Xw0Es6NzhU3w`Qc*RV(nUHwQXV^RYm~r_nCDAs`3)_+Oi@e8 zo0+kOPoB`1*gWM(57TxD=I`A+)l5aVt!CzRfbwr3r1eZ_JTCP8V*G4&)z|tOIEh7M*VsM}f5F!H7_)t6vU004U$%xct zsQ3klQh_p*hiVY38NL)fj}8Y1*IuBO8eq6?dM85Yw)8A-Z|eC?1Bph_^SHq70qBa- zfDTm+&M3*o%>)POk@tLK*=*1esGWW$+~hfT=6j$3VIvgWP5jV21Ev_wPy;?4ng_T0 z8X2^eX=(9?bt$PVp(l3|zCS9E7vG!8W(7Jimw&m78Hux}); z2PnfZn~_y|C%!0Pn`Nd%F%9jxkC3Wj9_%_lsmw4_fMo8*2j%hzce)HCRAXOqODpk5 zDzpVJpFjQn`^T^UmQtA4_5#@;OQX!rcU6HGVcx1qifC4;J7|34nTK zU#^?=9tZQ4qiW4lfLe3!fmgq7Y!MPk4=YyOLS?@;VLGuE|-%wy!fis|y+xU>vrXm?7DPqROS6 z#zoa{JFYk!PmNlGE{%hicBncIU%Y(!_4k+GzPw;df19ZSIk%K(Lc7sGiK3-yCS7UI zZFiRwb))Iwft4ah)ZH(?nF&D9wGJwGk%qoC~IDop+)%s^GNQ(KV{<+QDw`AWa=4 zi3fjhobt-GhQ+x>OYG+p)g*6#=5=#sbMv}dWD8XFH?L=_o|@Owh*E$M59~LYy(8a% z`9bQp${6(B{?fqMaHfX+_|X1MD|@P<0MKwZO2-xg`@Mu^jfYHKXSslABeY-(TzqU|~`gU*f99g=<& zz0S|l&_x4`#Sl!iW7E~?8^Mxt#7(E6SyB8n6z*eMZ=Bj^Pv|=K7tbXt=K1`u4Q)sxUQ`Pl`cO^@QfCe~2&@+s*;=0pOY`f`%G4 zOGz*{<{%gwMJre|azi+?mj-~g=V|tkc(D8i9xboai#ZBnf;>3%sLDpvl*{5+bf-yo{lyR6ek4cU<1E}mLefML=N_T z%ibLm=9!1sL3Z%q4^I8TiQnRHN=GpcLI;tD&|f*!!Pdt$7st^W;6-&lb<8jYHN;L0 z(^)w+bQs~ZpK!DISkJ%jPx+@{j^=ny=5)qY!-@_e=U}>{I`7e-oz}Hv0I;)@$wA2e z55T-^L(v-0sWxD4i~U}p#{zW4!1B^a;;L`x_tW&A)*G5x6E8AoK!Y%}l=mBi(!ZTn zG=ckT3@DXXgK7Sb);(&aiMDck#Cgaux9JstHbgfTSHSD0`hMad1X|w#1+Jvp_I1P~ zCvmpRh?FPdc~twW4*|P*Ic!B>4bv?o+6BDkP;?x$FhD}mf=H?-2((zAq-muNY>P^P ziSA1{Qt=gK(n5)?$uun^0S!VxTlcioCd#|9u_sV;ji)00f2jJiX1S50TN}K`zj*CC zZEe<{9T|X}t#1yC#Zs|~WKm>ECF!EofhmE+xG`jI{tQdrpip{rP;pBO8!v5ePJ`<8EKVCfWK5IqEdu}2X#+<1R6Z0>lcCYr~1e4$o_@Bp{!ZQ zicxCNvVeGXW^~nO`OVSX4tdPD*%Un?WL4>+&<-qrR(z|p9Nm21e4(g@&Nu@+6S zi;$Vc9go}$vrKizVk{~sZ-AG%99h(ht|-$4<+-Ri=~^Ru&=C|X^QkDio13AfgW7l= zUiT+ram|MWH&I*@9+-5&w;X*%li|5hpz;UHg(QEd!2*Vo!^fcTs-wbGGvwt)9&$Wy z&Tu4Y$&_@V$}~bWs^(YTj-~@zo?v)#!_mV!KUfGLD^;BM9dkBeX!QX(4T=elkqiK` zQ{|1ciW-SG2ciC1>C~KI*YE2jOK0RJBqYA385gO#EYEqj*Qz*mInOoKy~sTkW0cf1j<tMV$r>XqY=PVg?1H@vytzVrUpI&&MlX z`h89|oP(EtAAg1f69-&*{lW^$)!VY#*!+$4Lm2$+jf21a@!{L=|N8sKEiLi~avi%7 z%B=xJ7lY#lxMvTvx7yHyIxmm$c3Sjs9?&)El9r21+%|ntr4pC|M}z&?-xMvAe`aWWc_o1qM8(SL{H;j2&y){h8$c zME~&miu@8H4WFP@#{@6YBhGjB$uChJjZyG7dt}`6+hF?3mU!}s3hOQ;3~T&)xSLq-Q-0CZuur7UnaCP;P! z29LtEIleWci5Ap-BS44L6DE!70EWJ>T?1nR8fa=k#4tqz)ev^=fGes!^|!B(5mLIO zGf#RbOaR6|N(i_Z4+35L%*BV@B|bu4$9K;Cw}AY~xXNf$$tX5M&)j0{K!%K0{J$n& z4Oof^91;k=e*5tK-M5dwF{M@DnLZh(u3oUQS~8#1X|MzwGzKPBN#cXS*ku^4H)ifMroBn)4ZG z&0kWu1VP@ZdP3S~g25(G0mI7pQGkA+%`N_;rQ88$6!4gSShKzt^o&Yoz}5o)HD>6s zk)Y(jJR$K=S2^m~R{)ys1u5OijWAa(J#N5r)4HYSGd532F+2ez`q|PdA7x5tx`3hG zPIILuOUUn(c;1NMq=XEdvZV4(;3hyqw0k4IFq!uAR8>>oS{{CdsL(-BL-lxdY)FQl zCJrgHCavg136SKRF2(iQew7vT&@kd3Z8kO{pjJRa2DIu;2?X9}uYM(reM zFmh-LDzdl=1hr?n6fJ+~Rx4Nn6t%AaDJp|OD6ol{ftJl2=N-6UB4Pv&P*&Bv7y5eS z05gD*G;!gIdMxW+Wq%3ka{&Fq4bU<8W>4tTwB#{tu#mrB0Y5d6aFAkgY6((~02!nj z7IcoHHx3o5s_TW*EY$_YvAQ;Ew7cLOesXD$Efo3=n*U{XGRPcIrI~xxPQftZWAL?H zCmhlIh*}>EC0aSi6b8C)F7#2={95+t`d*Q7C4>&GWTV9qLs&;5u3Xr_ZJ=ElG+3Tf zVfT(3pfN7evOvES4Ea1NBq^b1^W$Mp$Z3Ts7^h?*IJ|va0@6NLiUCFiAgkG<(7<6D zjM##O1desO;424AIhHffYPC^0BBgwZ92y?m$^&1bfbEEYjZ!|)5SYivJdor5L*6}Q z*bJCaX!$UVzRg|)upcPOI?ZM5ntWnMGpw2e^q$&i^8U@Ps}Lpt)?O;8~nN##R7M9WMkn zeigw{aptdFmh0egmNQy{)@}_{k7g_BZbW&poqcoC9gZ6M-Sg~pb$hvZh(m$ZTj!Sw z0xC|wu%3e*H$hfqnGPI!$Q-zvxPX{<$)&BLj5xuY)T&3DrM1aELaG zLZXIYfBVOWZ=Zhq_M=iPtY5#((2a7AmjJm22yzxEMS+Tf-~Rsn9aOO2{vNPasb(pr zJO@gCn_ay~kLW2Nmb~nezpdvdQB?sXHE_u=Uap+uXxB_Ha0O*lz%N)Wd!Qf8N?Xi;v#?`sy$_hS zq!9s~JlYF}RK=S(ZLr@UCS=v9X&|zxwKS7f+~dB5%soNu?priwd>MVSwvg;`@&D$r8XHjPuh*4J%!B_I z{`3%SdkEOq1`>UrB~ZCLq-2a2#`kOfup>N73h9}G6?!7t!e<70rHL!9b&G4cx#d_2 zV1gXL*TXo_3@Z+}j+A8qw$cxfLog~XT%YvCdZrGVk5>16 zSw^#}L(sFa3DUX}XD&j3%N4HL!p#MN1v>j#%bd zqJUfgJ?{feiglNrL5@=y96|$jDF*Z*D>}xPjY4L3Qg%X=o+;tQ}BhcoVk=0r4!AsP0Fwxeo%evs%cV4_73I0 zyD`fu8u_4Fc6`X^5$}L%tLrBZxhf@CixK$gzg+enPCF0r2GJXYgd8=F7r0g3RO9X| z%9UuSJhXsoIomEm=?scSDJFe)Ri2=qWcjHe_|Z1YAc}R!CkWT@E z7JCI>@&`qkh$)m}_JmgJcK{sDJnkV3zSp&Oj)ejfb|(Y!aQ_5>)f?-GZEVI37z-Lhu?qt=l37JGw<@bc%{f~)Td}l z^7+RfKV(zZGA*53$asLH(tH!~csO>vulaC@4!ny=BW(bVwyb?X8&)oG12mJ>SDJt6 z16Yr=!zc8N=?>u9aXinLG>uMSgu0xj|CIRO$* z0*!jo^hI;}1ga=CkDAg->ym^tLiG@zJ@5hD2yOXtAoQ8q69}JNsRQU1ZUE{*E$;yN zN=u*)TIH>3d6B9~`WDTC);6-HI+_CL%xNjB{C2fa_D6^*;7Y@6pVuM(*cEw}7f6)I zjfZYmUn)UdNsSjiJTiWPbdmKfDC2O_1b|{sn*-ouPO@em0eQywI&Y9~fam;d z6mLnotYNt0-YV5i6Ck4y%BAmmLMroJfa4a>T%dIVG-XReu)jD@GgrgdE7C=~XjqTG z#POWOXs1V>WOv-@)F)}*;=!iOLEpqfOziIq+&eXlF**e87;8OX&<@vl8XD~CpJpQ7 zLVl54OyHuJfMx^Nh4$91B-jQ`lOA#V=E>5gi5sC-n~NR@3WrWScADL7*>!11wiBZ_ zx_CIn9zp@V!0`HLD^kbH_npjkMV#^!NG~F&&je)aw2OkzJ%@qvHK4?pPz@$f-`L=| z0q>h#JW8k^EKW9vdA|$=IrP0J6kh{>VIq`sgZShj(%HETn~&1r1k}b2KjZSE#P&$X``{*rR87A)jei%ASG#SeyRZ3yP|F3bJad z32vek1f9EOTh2jQf=QC1N_WG$qU#ZMI}glhLFl1NdjYb=ex59&&S;b2fPx!AhEIIH znq!{1pza@*;-1x0phZXmdvdh8E9*pc9kpn^t+E<&Ie(Q^yEx=EsD)373^njAw@SF;*I!jxDs?+ zFM<&oq=4s6^6vTe<)}kD`v+>Lc}RJzdc~Ft#oD~FVPJvmUO~8Rn(mYEJT-1pz`J8v z%6VEOa2A@1=}jFHjVe#fV5lsP*1e#ta(2qJq*D=qlhr*Bcj?j$%)5O*aOGl~wXfBf zri2mq`3OE|kO-&4>>*ybs~Yh^xHcS>2V~c3?g(jF4fo*lkMG`p%Rb|(89f)Xl}-ox zQ(-AguNou)6m(($aIds1+HDXLw48>}vZ50>kie^vC?p8SD_K7(39Z+ZJLvr_<)@4}#Uk7uuuOb z*>5yTKM1iAnr)GqXZE3YIwgN$&aGDM)A<>mB7yw}M+msVGVob_BhjFz%voJU%I z)ox`Lk1LIXm_qxu$-we#oVjAkLp5y>d&svGNQQukQw_oAci+DM{O;2yri@jd>0k&5 zP=f(Y|4=5Ma#noafz zr>0~;+3)QrP-Ht%o_Y_oxb?^7DxLH|0;Sg=-clk1v_ZHDRRetEEQp|7?9MnrYALAV zvjI(;jWn+Vy5h^M;x~Fje^9zi$D@F~yP)do-UHii+8Id>;JUDqBjzM-0@^+Ty2YAp zPIOp{$8jB+)X`S2$QdP!lyZC@P%fPn#_qbPgWDFuV#_suM{xca&Bp>L+UhF!yMf{p z5d5!N(<=zFd^Awj64aW>$2!O^g+y#w(?E0 z5cS&Y)+yrg^<<(5z}FPPeuLcx{8e3XBcPS1iNI&noIBcYCOM9;0B&4c&dXMvY-tGv z2W0H^aC@{BB((nRQ?VHoY&*7I}Km6+l zJXYATkVnB^{_^Qre=O7Qe^g)lpjow4Aq8}=+z4q2SvP1N%aoK=7Bu&yE0Y(zzfVT& zVLV1bv)t#NZxX=Cw^u@Z?IGGV3%Y4+flce;oit1BrYC9~fg3=so_L;Oez=0a${rQ- zu31v9Cg!fRUU9U+by*GeOY8x~GC&ewhO7>W5l}Xip9pNQ0g(5S zo|l$Me!~-u8M3|<&~O#d(^=09pm&oykLhx=ksxvELV#DG6qH0XtOklX`bijZC%U38 z=VL)!a}!V1m~lB25Ur$U^`+UsBiCVR-C1TqE}bBo3$Ph*K&I)PE%0gDVZUdz$02BL z_o7;pm!OfSLuLX%&SX7A0xc`{aNYp7Uh(ZuGa;7=w`M75v=N;zvHylvfk2}Yfm&lc z*4$9GHAt9Z>llJhAHTojrWDSX3)D(B)yqPsXMlk-&Ch@nv{HW2?k>{XIF7b(I+LoX z%wGuZn(u;7RhLa%EQSHzUOl`(2OB{H1sRW6&e6@ z3GxX#*7UXF?>Y9$l{O+9arlHns2Nq3MivwS3o#&H=wzeg57N3_S@}4%oacPbL^gdv zlfS-Ja_U4}CPvC;xJm`UZ1P8?p(aAdv0WN2xdNRgXGtN!9SNHFB|y;c1_Ec#kS!>q z_VVSpOegFI`NRZpTJuatap<3*!uES{Iz%#T1*ZT>~?g<1rM0d{V={WQd85A@;Xj}o^;>eV2o$N%} zTH9r^HE9;!0d5u>09{z3r%YCPV{0}$$@*!3gL)aC55}tkpioiFtm#s%)VNeVztF1~ z6luDgkh|Y{PIi}5bO>sOndPWdZ9#7BA$-K!+)~-|5I9*Gf#@WGrVRDV%f6h;M|Tfu zjw?nxT&u^sNl=Sxyak>OJ!;)gvwX0KC_&@5{b(NL0R2oongG!og`R|FsYLCr(cCq( z1|mSsj|jC(mJz_UjkMGOUA1%Tw(shOYX&bx{lN8NCqyr~6j+d0)- zH}*HE^#=`peOt0*m1ny8W`BdadQ>WObw!g({!WcEicVdP^@Fy01bUGqpuF&c0;nto z>P0-_`5`gW?!iDgQkejiKx)4)RYA!rM#$J&64IW27i%siK$Y}hze5en=TSh5QbNP2 zJ;5Y@cY%4hK)e2{z@CA0*gy@2$GtzypTE%phPuk+P8GnOm=AXSt80F{{uI<`a64+M z0#19^dB>h54t_;JpuokHxmKw_1Hvg@Kr_kxMa@|pj+fSXJ#iyA0-iWee+&Qm_rn31 z_m@;vB)QwHaGebKpTJ#zp{Gk6;T}}4E8GT~JBPgd_1!-hB;bgPIhJ`ntPvV)P?fWJ z`}N)LKY#l0;Y;wVlN8i(mn%8I|10f$xW=)j&P+!fwNz0^S_XU&sv{|LUTY6V#)(EZ zF}Pu>45ABv*Jbv~sll;%12}E~4yulofE%D$hpFeUXph-A0e**HUE=F4E9Mo2F3#?? z1eV*Q?0ec?1EMok+}q#(_3m`ZehqGme7RIpLvP;Bf5+n+#D@(c50ULE7&iO1n3o4Z zKOS}-BBkV#R0xW(cw1WfAPCQAU{h(7l#o;GCg555yE;$$SHf+PuMO0_o*UuHAw2>Y z({UyQOf{ZA^loMVkQ{obLBD*f!(V=$4(EMv8&i}4U2%{B$rSw3qs?*?V;Bed@1&j^`$XCnVKA)hb@v^xIa)6YE zUxY;N2XAtpwPy}Fh@B85Z(Uh5>kZjo&#O!|Zgsm9`Uq|}{G8)2H%?uQ$#Mm?H>v=H zs^r?U>Xn@I2{PjsdE(}2tMXdpSqgdY2H|YhObE32WkPz;L;t0-LSL(@cx%~wc z#h9=BX;xWj&uOs?p$tGRoDbso$|iwjc{Z2zt;A(A#gE6XbTltOw-gnTrf|39(MsvK zB})N889ANMnI22OTj>D@zv8Oyvce_YWJaksjzHprK*@+N8q!urG5h8^j&KR`$*q$> z6a9pI9l5KelLGF-8_aaGB(8fG@Q!|QEj``xXLT-jv>tddwQt;2Y1|c1j*eqiH(Ec? z3yc9Pj=PTB2)%~n0gf9W<+?l`j4qC=$^|rM1Jrm(nJC~^^ku)L?gT?W?>C4Ae8Yk^ zr`Z+h&oty~Du6 z%jgAMn*xbKOm8o5G`$gT^P_R(6J=cCwlC?QUm(95r1@ayq90iSTAM5Tk&Qj%sev*B zaHT1i2i^mEzZrTd?m&K$|M>j%xZl2f=oXX;jx)-=9Rwdv+0#RlkYg|ed440La=ihf z)XJ0B_v%Sk<-l8>&Upr)U$Ltb;O!4{k!t_d{cpQP774VY296f)e{yQfE%^B5r;lIg z_m-9zW7jk93ddJWLI#hztE{><+LtcLGMxye79kVp1dV{Y+Th;g9hx`UwsaHSL?oHK z2spwGNaPz5;4EwdN%kWFeQxJ#ztBDH#wbxqTMvte zrg|EnCoo92T`5$EbTUr*KJjQ4sX_*dtQrVh|6%Q@QBYAEZ#m>?TOSxy98%-@CJwV{ z4KzWbe8p!;toeE|IQ@zaOz2f+K^zWn~_eNbh~czM0x zXqpL^3o3O+t-HW$oU7pDk00L4y8#|JeWZQI7A2+MM*)>vND=_E@2cE1=IKPBUkm!3 zt7yP7FPT6ia#hsC-EP^BhoD@|w<7?;JpBWfudn@Xy}97$dzJNfyi`s>RPtFI*lYx9 zy8)C21LW4v1}L1C6dnW$z*Q~{^76{dpe>cMR&uNr9VYtiHx5eEW?fJYSw7W_@Icc6 z8fFUU(AA)X?nrMubk+rseg0&?I!J*2a1DO`?f37$|NW<*n8LBLh+s><02-wwn1KSI zs2V%bG;srrQ%;LPz}O{rwXrkP50V5?bJ~Pz1E^*6_cJwJs%l&%vp(|1Ksim&@L#Es zQJoyJ+9gItK`EX%Skm#*9E{UtTDtYl1oU`lG*0F=%f3)s5>N^vT*v-l`~1DOv`FJ= zo9AOe%?7MjxlSo*xsvgNSkdN%fMR$*6U_M;%^E?yY>@Ca&2wkjrwiQz5^6r62PlW0 zSXu<9*n=KaaM)nK!Ola3q6Nu-8v#-R?@psXHSXnhFIIg3$MjZH%PVh9B0mlRUbOk8 zEfuH+Cj^a-8vxo42lHr(qQOprhDgim)@S*!%%r+$J9Jo7yzhN83vB#zBLf*)Z^Stn zvefmmJWc67dkxA0%1M=UbbSEX`Bj4nWqyCI4+gU+bNUu+{eRn6&4ZQsNT1Yvr8J}9 z*eRDRWc|Dl@Z7uI<#Z-%XcW+m(wqsE#%;=NjZvASyjbz^L})eWh^C^|n$Vxo8EQ?a z0;c1SL7PVg&<6~-v_X(Lzl+)?!MtSQiAzp60j^vmfHx&MH{{WZ{&EP^W+n0+TWa0W zs-1Lxpt_TD!i)Fod{Cm&t(^8lv2%}_o_Gax*H3U&#k%h}9$z4XsIpT|E9Hlo1>K=I z&|z8Wrjjf003+S$z7oc*kt3=ha}-S22+=nvWx0~`xvhPqksJV+vg8V$#AE<`7YInPU*G+qH)uT z87>cnv4{BNA>wnkO+G_6`uW}GkDq@3?F&=5QjO=Kq|8dexnT{IlPXPR zC}aT)xG=sRfa{)fR2Mo9;)qP?d?!O!f6 zzOYXU(J+U+M7Yc1vctjuIoBTroQ5axdqn+`Ag0FDsL2c96%*O^!mR+_}X#| ze*!d14Plp%Ej6m^b*VUhI(g7<7DZs1CZjD$l?^beSY5f;ku&-MH6=z0BS0rde}}@! zVG!(^%lSHUG*gtMp3)4u0U*0w%jA`jGp^HXvgN>&|H(;ufYyou z(7N+^|2kIBXR~rw)%Nt>1t_$J7o`yekp_04`B~FL-<4ic7Aa*wh(qW;6z)ida-#dT zH}9+s-O!+@wA0O*o}7L>7y{Xd-^{^uY{C@BQtkUe{HxFpEIow4!IMq3m>+p zJ3zFDS9ItFSMzm3H9n}eJ!2(tVLP~@bv2=oR}l{}u1J7{X(^$0<*wkIn25_+DSxY{ zBJe^R@fE4VMwKT-g>C_V+4u85ZU9CsfhKhAvnK-|P0hg5%OD{)z=PmsvVu)CQ_R^Z zp`)-Q&xiCncSXma*xjZ5L)E0`d!FAx1|XFT4wufyrLME z38aRUhb2qRppZIsf~tSL(G`<%!WPnymKLO$siMHyW4dC~d;fPYUp-yi6k9KleC-Zip3r!{0 zG6Sooq?yk(S!OAz*W_AHoSg=xorYMh?m2LEL!i(@D&7iZ)-Z)r$E;uuvKAv@5Y)K= z=w%}&v|8Uxpj9;?>(qpDIcfLo1(j_VH&^x{^1*wGRGNDgW^Kax?ceO4zguI zzgt0NC2)>@@W2vA7@&s;lp~xAH0uwdmO~S+dMWs@dJ2f>hwUm|5o!y88-N}uS%DpA zg4jE_#=WWo0B{pz9A~^bMz&!S?$BY;+2_?I*g?}bPnV!ryP~90RREiEe!+DM1~o0x zKmD?Aa5!yb*O3xX{5Q}KB43_r5l2@IBHNoRQ)$52S;C2f6olAA$pxM`d3cTw z-0;H@VoSq#rNzi)8z{d3bYUn61PEgjq2WfjUTG^T;Mi?3LX~QC3}d%Wct2y&%y+aB z#h5SjL`9&LmDp2KxSj$96_OKpPiRM=PhJTe{jP(bDCM%XFCaLt^P?x2 z`BtG-TnP`(8Nvb2R>?>5nSfUp=^&_K^9^@bz7_)xM+GeJ#WFX|4W+Z}=DP+6iffyl z@hAA{N>`3h-H=Nbr?|)$-W;-pLkILOO+d$W3Vz~vIsM}mbmXA7lXrBhh7Z*WTq0J zwVwNVX$jEE_{h;wmkNr_V(6zZ^tmoTA8Q?{1RM zh7Wg{fAXb&koB0&Xna`c|13&_d>MPKqyx~0DXybvHgthWKLa8EsR37d%qPU zMqQ!T<=1tPQvc!lTBqmTZu%q0w^2*GK&sSswhqBnJXQ&u5+shXEkdK+twsk)ggamy-52#TCt_BK*K~T>@&>V4w zzEJHAv=2I}JrHb7B%suN0MIU<_UGV7beL&!otps4rfE0Xd_3=u=M3c`+uT)WQv>lY zTmXI~I~$kQoSc!Q1QA-s`22DFKFgN-$MLJYU||=EE&H2nG+Qx3G24j%=Sz6mho|_A z5}DDTtX$=4tv3V-12hdDN?X&SFE&jhM89BQH-mPGR^K3`EKodt99@l;n>XPq`V1mm zDM}fb>wd#hhXWGlQ{Im6P(3`HHi$f+Ol@dyMHn4CghvCqgC~@bB!XZ7Z7K**>RH_*yq9eXDvCp(d9a{ANlTlO^)Pdh- zT6?6V&e7n6#F?1h18RT)s|R&(jag;%P9iyRqreu2pacG~r}q4UA|Xg)1II!MJzOJ} z1T8+u`i6lf_5{D;7dqQSM;3?zF@^>ly zWAbw8UNPLWu4tyZz?<%Jxz3~$xCvidbgkJQxzX&>mncHL%j%*@(z?iK35YMLrdv3; z(j<4tQ9s`PO0V-jASrF{bXy%{)oaBK0BMAt$};)yW*$}(r|bTU2=#RDn}sulKYslF zp1!D&%xA*mnN@A~0DR}?fL%&MMF7&;u# z^$h!o6ggPD97$T68;P`f&4cX=&$4RFs-|7oY-iP#BQDhjiGXJlpef`-Uga4@pcvd4 z9R;&f#4Y6WdkSA!Wq$*@L7@j7L8WzfBsriX$Pk8L6=ic`4)yQpcF;qp2Ws^nLH>z7 zveyD|0X|E*5ue>P^e#bw92g%qh&`apX2qIl>?tem5H?u`42HWW75}1sawGT=I8k9c zOEbRC&~DaNd?0H{Ce8A@jsFq20Z`Q09D^t^trG$7b2=PI=ya*-Whl3d9tG$xQFOvB zGx&<0lwj}5==_$(R)^-X%3Asrj^YFV1d5497gk0VA}urLn>z#Aw_bE4EehBSFq*)~ z0!HA(wE(hUKrNzk}byYiV*jQv3-Z{%$E|ij$eMb>53#P zC0t(4^MZzzi=fiJM;`8uWBrm91@bzsfBSfjPtfJExY#j}T#!Y1-0dm`J4x5X%s5hX zN?n_!^BqVd+jI=lMTRXqz%=&^T$e86EI%&k(wUBnZj?d|4{j`;Rl3mi6#5#*MCxdg z=fMRyd;8STJ}7x;$^bZ~+yLb=zu0H+UjIc5v1Tc{4^X0}F`Xe+u9H@Dif>Jp=$_}a zLqm#oG@WW&QbmxLxRk3|sNQ-=HaKp8OVFt|+XX;cu`f!|&`i{zQ^=Z{Lr!HeL_cd5 z{lpSz7@N}jXg*&yIB#&;0Jj5WKoJY+V8q&pbac;ED=kIVRRae(^&+U50CfHaG(az? zuJnu=$Y9iM_jrFDbQl2x^fLYw+6)S|DV>dQnR!a9P6xq+ei`Ym zgCJju0>>d%LDpXgL+=M;-v9RPE1J;HefQxtc;Anm)}+u4b-~3=`czJM;f>gG^%Wou#UWie)uoYllP3;dKJ`FHVNcP&WMY1Q#rU! zR)N)SbEi4&J+Pb#LLS}8sV@NnFbyvmLsiCvXt|A={uI0XJ)=cz!8>;2cD#fBB6qfM~ z;~7x{-w6AXRI9;LM$x1ZAb}f!t|OUAoGI>$%LZt?L8Dw26Rgz)(B_%YG1y9w*0=R` zy>-Pscz=6M&=R7k-D*geb^DIFwo#2J7VwtEMFV8yu6DWrLb0BotbCW-;O0oh8^_Ef93CjKmMs0IR3Ixj?N zEf=o0=m>*L9ann+wK$AG=0f53CE81lzNaNUP^Yxvd@n=F9!=GT5qDQ~k3VflbL|b; zZyPFpiclYh97YkK6YyY_w1n{AspTk9x#$E5AGJBq23@%Y?|=U7{coS%{mv8=Qiq~i zHa&+l0M*@b#U)_2>cE(m4`yU(Ug-&qe3P-IE@t{j0Htz*L8uw8lK`drh>Lyr*M~1( z@J1NZCM}&obkVMVeEaRw2joe9AE~1-MHcZKGf~)04|~DHsjQU7a;oDcm#49@F}Q3H zF~f5jF=-zp{xTQf#p;Zjt5c!IH@BoJ_azM+7QQw&w#&>HNs}@>9YOA(xvS}wl@#0{ z>w9=hNe%MJZE)Uz<=GP}K&gm+I_E%_BLcdyCiK&w=aOe=mKoQ{!xK}o(eGjm69cMg zgp?jW4NxZE|NQRbx6kjs1ZlB$$$jq7q!st#sSn_MJgrwWAw`GwC#A{W`@%1BO^d47 zHhnR{M1T_T{=@g<&+k9|8l-IYX)FZLNI3zr#)Jle%L-|EltPoKUKSqHH1t&&yob7y z(4Idf(1qgrAAkSy>remsDM+(?cQ5$5GiZp-4do9>^z{j#J4)8I1Pz6xqvVc%w{9$N zFDafV8KWo+Uj?|$kwiuTq7|MPKx;*__1Wn8(qvepukoTuUv z#@pzDtvHKLZ^xJmiuZ~D>6(d2A|1u3(7IqEpC%MI7e>Y)w7DIF=4;wu>^9&{L4feE zu)-4{oYAhj_go4%Ucr;&$sr3;epQq*&5)#AK3Oz0*A}XUp_A*B)tBYfgUejB0UH(? zFw&qSb@DdH^S4|Rd)Pon^BBquuFdd@^fP1|`!IU>s;-?tX6J;|ZmIFDuA|=sHq*3m zr2j~!6nsEud#xC|h9+rBNlh$M&`8drr4H4bLk||M!KI>XooEU9h6ZXA@pLHv{2{~K zp`g6KeEa3^|NQsoAU&APMv(4r|2!@GrT-YDAq1w7Z#C?SW!hyyvUYP_&v;R!axDlq zx}Hj2g5;r*nmS09=To9Efu@Q89NN;NS#~vjR|h`;G#Z2yh)XD$fJQFy4Gsr@ylSzc zZ|EVqY;eSxyem-JGpMH^NN7x!(Y*5!G=>CdXnQ7L%>s0t3I;)eDFE3zE-ip-Q?k-h|1*MKJgx^TpE6@_d1WCK1D9Y4!S zVZu;D)aer%iR8Mgv}QbXfuuQtq#*(q8VCx`j}r1V=S|sP0)&TY=fPeJu2e)tA0*>4 zFI0007RnfO%V|WFaFM{od?p}Y7DklwU*g~gML9rGM@nDQ{kVX#8K7G^9tmjW3>@Gx zg<~*8od;C2dTavMLh|GlCFz;KIr25vVOI%r1jh(D1{F_FFCe-gwRUDLEv)F(;|I?F z(M%x`=ru98pDc)FRi5O|K+~?Itk9|4t7Oh()I{+hn7m;SxoQ-OF;UdEXlFntT^{xu z*gj6(XdlJ7Yy-T6ANqgyRE0+v+Q%+BL-nMk>)PEO0*0tDKo$#Rg<=3I}1Rr}QY24FZ ztKcG7xDm|qfKGyaPCDAO%pRPw0y!g1&dBb`$YAPUJ+zgc1;~|Oo*dV*3kOZ$8d|gz z`@%rI0vSDc>ODAr5aZVw^cz&y;D=A|-v9c`yZ4qt<9Y#J;s$zUT*@$c(3rHLjD(Hc z_E?-gPU=T|F7qOPMgCRKj;mP!G@hOw962y%6_LN-2^n5Z`MiVrmQ;#jo(oE@gifk) zE}^@#YF8ue%431`jumxD)ktVxmH`!=a-cZ>KuG$?Qt;t{oelsQm}r07Xg0Jd){3Q)&Hxn`8pEeI+HlqLHqXC4>{4ZY3t&CA%7J(ly{!wuqt2fk8AGf%e20B(S~;zqzD znF5};+r$lUWtYW!xaM*c_`|y&zr1_*`R5PcJ|Ho>`qO4+kZ9mjG)0iGqnVXa>_&8Z zbUwj~uTBBl5J4`=eqeiVd9T)<#e!9>Q6^#~x*MFK716|i$RvVxP)HjGAW zKzEbm1kfB*az13?sleSvNu2DGeemwteN_lAdPbLbbauiLE*-vym+%s}m4R@e)VSB? zAfM{=18wl&VwfDq+((<@dxyGB3y;9bQ4n6V+gt}3pp62I@<~7^athe}ZlP7+!e7z5 z?P>2pKS!b9u$x8`?&!-2dsa%f$Xu4cqCa@v^UN@_Z_y$gCo|+N$j!~I<9G~hz&kdE zTnaDe{#p~SV-&jL6&IMMKCO@&9QI&Egrs!bU@r(M=L1w_qu|{{7yrEfsiA`xo}S)m z`2j4^*m9{zJ^3%tY~K+$d4d!vQ-JK{kw0HkQgN&CHVIdYUu;|=8AsfcuKoW@`16Z* z#{15H*A5wy0`iBZ>_FM%JmEj+XLJocu_Gj;OV<<7P(dbOU>k+JCA3_pCD1gUNHfqI z9p5P2==`?#y!WKjPPRma(79&6L3BPJ-J(T>4yL)3nEp=%vQzL731p+_x|>|01av_}cdUW3ewm_!(WHl< z9dX)k;36aH69Ot90*&HqWT1CTaB*x9pW@?b`=ZBxCsHmEB7c6p-HySCrk1@Bl>#tfPwdeX5j`5Nd8vSy_*r;r95 zECkRQJIhGR8QzL13|KhEIFUfR=%eBy(Ci{ju_g|v0_1WEKWk{?0!e_wVw`FVxQ2~O z$qYD;zEDq{V;F`_B5Z9wga&asu9FoNc`?w2%gWL^U z-R4T?{yeHMiwS^Ja6wT1>fP(U`}EUw z7hp3M?*KISA`~>4#IBT!S*8j4zANu#R%ej7#%`5F?xjx)wPysk3PuCG{Mr;0# z%Md&E;|k@&o>>s@3G8Fof4i)|xw}r#D*g!TXLeg=j!!ZGDNbet8HWm-{_vgY ze}&)KP+%p~9gdeX+fuhVoyX-iCi!2U4(FuHx<7sk-0l>gFX-@*JF)!@-o=M=$PH;x z7k4{{CySCOjWYZ;!ZAp32ey1Twfzg;h3_xN%jrklH!(a%KmBwJF6HHXJ(p#0F}u=p zaM}Ji;Nidx5Qf}>%NfV-A=F*Ym&4__J2F489S{3m9K8ZVTx^fCoXm_2aM(rXBYN7) z@krOR7s8HPa5+TW8;j!I@eH~6atO}{Y!S|}JK;9sc7q78L*sHLL=m^(5}$BQ8Xcf) z{`m#+AHN=U+yd4{)yPY9insxy9k&4aaN-6yhTH)AL%c`z;WI~U6al!MGer>KA>>i# z=`Vuml&@jJe<*f zo-fh)usiI-{Rtf2cKbOd;9`gK4ta6rm6`2l|Hp~sFXVhaowxyxM{WUk#0(RJ)RPR0 zxA%gdAyc>oXJj%rz+uk~u#0!Q1Fnoa#_1?MO((&2C+?9RGKh*EW?3(QD-I_~%e$R}AkZ4MM`6n?O1D1fDM30DByE#Dkvf zPqslMP{bI0WfQ>v{jOtN6h)TdaFpjmWN!su!UMP9v_FO10LK$I0BRLpAz**z7V!1! ztvX^XBOQF8s>PuW+}U41eBefixCN&;+{G8(2)=Uz;5ren6VYS$4v!WtFDaL_9M{uw zt}cBz1V_AgZo%=iF69mS-0`H5&Jo~)6oM`h8#e*BfK6f)MqFNVJRL9G0Eh5&xJ3Kl z_+NkU<#6N{a3WHZkw+ANZUJ5q$`5bkr8P17GIhghme=0BP6&Xy87eJwF`h@o-v80E!tl!cKOu>Oa)4f$SgXcvj$A z`mkX8qc-S(`{WkTq@HCAus?7Eu$@AcK$fx6>;QOe*Z@cNK6pOfq}}L#ci&z%5{7!Y$aJPz$jIXw~=J0_9cscsxLH%q`d-&{<+59Jm3F zY#1&C*1eFx&VNS;xdrSg_FT>;V1vBpYHf~??e`HfZjX!Y!yUI^kEWX&A?5~%nfXk? zv+ek7{!IxahwRx&V+;22b&s390*)~^0NyWK>^&MZZh#PvidTS+ik;OV*i9%e5$gEP zW|F61XDh^S!R}&zgWY-Phvn+>I}rUgHbTS=aGbm8QW8RL02GBY&wY-M+yZn!5D(&O zPYRD`6lXM0F$awSY|wH4yJK29O`8JQFtd-_LCD}nh`9mKp<)A|kqz-s=$(=8(9m~> z%bpwHWTB5h_}PI!JK&%L@8y8Xh>Z|)BZS<79WKcYaF}=VqX>5Xl>%5dc`%-AnOp|I zE5a7At&j01*u`l0u@Uy%0LKG207^G~RNx(6xDgKA0@XKKmka*<2-K{gc?ov-KMGM$ z0nyi~pXN*GZH^uUzx%uS%M8wBj)ufmi6IpGj*5E2d= zQzJxd2Mu&)bTNJxJFdus{XEjD5P~9ec{px>91HQjL%whHh};0ksE`?j6LSObxmW_& zx9I2ScDMl`W$2y_A`b__*)k#21M=s399}d$YBGml&kjwRo4_6?)Z+-YTNT7X{1|fi zy9tB;E1s6I2x8j4(&K$DwDtWYZUK!SG%^%t*X-lvQ5}B|;7q(@G;F3z!v2K zT(+mvllX!i>?~t+dfWh%K~M!4)=*ii_=dbYK*Y^}&rN{N1F^yAaP)wZ1qio;LNzM{ z<&pt&d4?3Y1@@;V3d9Z^4d!88`1vA-$E^+cVCeW_qw(GFn#z8L> zu-|^ZlgCyMN{O~RjO^eudp`({_~2_qkws@1UoObvL}>SRW`>{#FyN`qeEehNff-`J z6DS`dfy%Q7o=1gkFR&*%>lsfQXxC}`)lq{vfP+2kS5ST_i*Dxo`tO24FuFLww-|h#-DPO!3VH!EXMf5~E$Ao%y6k#{Hb|$k+r{&Q9B_ zKly6qftOHi(lG}ur1EeOSg8=$G5h}p?b=xpI&H62pr_Cy#~VZffAiZLN5{_%0GSON z;lK?5)q`CKKhSUpVr~Ganb-i3Ua$d_E&O@p^ZBT3i8qJ@cJ<>{SqRYT04NE^(1V`c zV7Eae@b|2$aU}SPV4zN{z?6zZKf6t+BAPjUH(RK-I+2X^? z``!8P_&GWm=(i4y(BZu27Er!CUrvX6Kxr59_<;~}1E7b+22h#W3+x>V*mfO!z#u-9xU7^-BmQ*n-##i2x2y@v--jZ$|cdF$WKaH{ik1b}Nzf z*B*F@t?AouZTMc&!rlWj%iz2Lf4(&cdu5-2zZSA@Zz+3gEB0Hd-YeIXvg0O@)M3DP zw%^M6KJ?{Ga1i*yv}f^VS=`<8bU%Jg-vhtb6-_teUA1(pc3w{00O(|Q>|}SRGdBQ7 z0oWB#T8yeomZ26PKczXv6a%UD<0Ik*KwGJ7xcQ1N~}mrNBVP?6&j7Rxfs2 z>$}_9S^<>cIKB=^e1wP*Ljp=G!sRv5H-gV#10Ejv*Dp9KCA9J#Z=y-Oi6+otAv&Ox+wPMU$#|1f z;;lr-Tk~wdn^A7>H_*XH%jB3Pni&{x?KI(h@+tdJ=hlojNM_VHvZH@S*kKj#QtoTNoC>3pmKHB6jg0~cVKy)tL0LMKy0EDZMr3SJDULwvM zMh9*L-`juU^w{|;JnLccw zgMEez>~XdnQ*l3RpksVN+LSWhovsx<3U09bSe{Hk4r zr#;Pqkdkh@;%PVSryv^ThA9TPN5uuy8-X;3nCHM3d@8@&HMTvOo&s;%U5!|ax3!~P}bD2MwLOZdZAji)^ z^r_JwfYTEDAZp@#*X?oU+Rbs-1Aei1S3&gAqT&S6&lZ{^h_;|!(a-L|l_^2=SFT*; zt^Tzy=-w}guGO>cGhEcWXAL5{=FED$RyyV^_@cf4NI+#i8l#^od7?B(s*$_8Jaf2> zp9=j!N_I`}=)0mH`-N_!0hL*#NAFjyT@NDfQvlHS4TC>Nwgem(eQzsAkzz|Kkz$L# zg6IcZy92;GQ8D|W=^wW~0hkRmAn$Gr%NKb|34v_FA{Qs9E7>7G;x5r$-k!G;;jAi1 z^C>kFw4T~ucG2;fXZj*b0Yb=;I2xX)suE;##mLRn-wfFDcu)#t6+0=^4YVo($P|QV zI}e9=w97hef{YRbk>3^4xiV*VWu-uC8V-37_WoDs!TiQA(X~sTgiy^HL52~8@T{|Q zTI0-fosOE-AZ#f+h~+%bDVA3hKqR{|dZWX3*nqz}p48k^^pJHK8#m2K(pDFnAe57EI8@C^TW$c(9h`7u=lH^nz#$SI3{e1E zV8Rb8?K#?WBbZESz*{9?Gl2L{2sP9p;Lvw;_G2d=xXX9ckqsB^H_$GhnP)#F5S@KT zO^`fgpsRaVpG+;)Zwz9sBV?{QOwKq8NU7Y-&riX*TvhK7M{*xCxJ@5gg?8Y7r=M7F9 z=;w#a<@pp?-8p%!7huv;blTp<$q!+A&@u6L!pMsH5k>sSR_(~_Wz~cJ#4Yf1m`B2n z8zJTva4OT@`*CX~j$Y$8IGjE3EgvKQPLF);Lp8&8XdRt zeDo5i2cB?iE{eJ%><$h#%`4zW*d0!GP{<8%K5_$~kRMp;5625P02HkQ z@91!dxCLy)&$@lQN^XQ5H-ZhGc~FWC$VS_ESY+d2u?J?SV6XG|Qh)FR)*g-<95&c( zz@KkT{=ttIZs^HS=5_rgeA~Ybo<#>g#1nBm>|kd$ zeIVNB)sp9I#`kW{O1i&`_GkB+bEX+6qYq9M+H4u#o7*rHaLW1e@+Z1KQ3pia2q8BB z`-TfojV#^sT@h$W5baT^_N-KUG*z5Ak08?=c4xj~PJ|y_l6vBs*jq) z`is4vUNATuH{dZ_{o4Dv6azMKd#?d|;EimrWbcQ4Jn+nZdcnhS108eNE@9(89+(Yk zqxKuQ%*J!m8ae(x|YP{oL zcI7)i<{a%J-<|EYu3W(WdgsTJqutiN?fhI;v<~-*Q+hv+@q>;4a27EQ! z*qVX;%2ecNw{-+NKNMlG*Df3QB5W7+?e@;Azfo)pE&wm~4^&*snYAW{JQTAcaiBkD z->Jc7zU+86(JLQe%+tQh(^<7E=KI_qj?yLZ1^5tP6Ab0BKM>MnOW_+-%_~!N!c5@H`3*JHhcY`Y4YHUmYEpo#Id%(Y+Z4Ww7>9Q zRE$De;!p&(89Hqfr4zaPP21K#r{78&qS zHyJbD+V6O4kTjxfSGN)UXd7Dgp!cVUwK14#im5h%R! zoanUoD*Vx=A=@bR#lv0@X?}qq^UWyovyjm?fF0Sm^?8H0l+eH`gr!|P#IXks6WX8N zAe8OzM)!^wTIOxT;!)%+Ej;W5R=Of@VGwCFoZU;biP+JmrbK>H$b$|(ZD&4NuM+w3 zUxE#zY{orNv`N;RaZeO&%6jDIEooWgb95^d;W{s6(mnA&VeQtY$AgDk9~7E_xquts zM6)8CGCUr*0S-rQ1YH?`(h;(BggaUj@nBk-Pyz_!GX-;=G2S1n-iO;jJQNDEEw&{4 zeESlZ4#=VsM!steH@P6(UcL>}?|=To<3We}7J|d_p+hUOjlDog}+Me2}6+7%0OA zydN8l*$XU(PtkU;Z^Arqm)Bwdr)`%FFNd4ykcYPvo#(I}Y_^BtX?s%|JUMQ_w{Y?U zSsrxJNZPCiT!J=IQ15Wi@dTX-pee9KDjYOyskK^9MLD$=FyG*kHSd$PQx3YTl>O;60 z{)C(1j{$F&!xQ^`-8ZYl7ih6N^u}m&aAo!ixSNCTLBq|mC*16KJm?tH2E&7&;xyou z4qnI#HSln}c;GW=1md^>@A%-mxbWZyLp|{4zEL%>V@@*sFt8IIw_RrC5N-nx;bxlS zL1*4su{d~5EIfGOh+qfrj~8x$-JV;ZNqcMnKavZuk=)P}@-x8{!cf*P=->f44Q=yX}?jwx(P9Fss>aYgtSmjs*T-J@sXS^9H94b^?2lofmAwotIw2ofkdA zO^a5KzGKepd>EfHWHIILs5+ygy5N ztVxfU;EQ~`75R8;6gDf90FFR$zi_iM2{+>s1LjTaZKgcv%rqtt*kpCMX&N4QX0Kp` zu^)vFH+3S6y?7VKTM>)5)+6?2vtjI|x-j-5JRWqO!*+?izg0ifAh{?G1@U&#XuAy? zUJT!c*=UlCZ#!-PnnOdl3cUos6WN8Lt(0xjau{t7Zm{1#zq08P1KvXK3*Es>qpJ5c(Vp!oTP*k759((>@l2AylXT`9J^H|N4LYe}ez;Pw@P& zKiijx08Pgy9gjy(T)y^3$hm(%Gs@-+4e)$AN7XFwzB>G@y#My*t7A(zdq6$-_dnnN z;|DGbLdu_OV4ttChA@SG!Rm7v6Gzvs&!t)9A(Ftj6oBjV!S!R$B~29#;yE97c~#WG zbIM<{F)ilc+4o~VxQNimtH2up+N7dWw`bohba#1rqaA+GPN#f4cF$=H{@qS^ty8i` za@DpgJ^?e4f1>&SGrd)Hk>+3?bCZc0*N zcrr2-UV%eWvwU^>UER4Nuke1{jV{D$JhG#;!K%G!>gbB|>GVHt422yM+76Gwg+*sn z;3t={XzgC`jL&jF8?4)(V0{$x%L7fwx{QvS!0u;VI@~)yfq8e8Z_JfZYB~0|&Le%B z;}mmqvsm&>ywdUe?Il>J)2ZG+alU@-TgHAxLq!*mDB+-qo^c6d+qW&DyV9MVAZdC7 zbAmC;h49)>W!2ZtpsdE=U;UJ~bcDF}O+P&xZmz#NZo%3u*E}ol!FpSkV!b6xj>Oxw zNQ;uUe9NX6g{20jU0F26Jx_zR?3PiN-4yu0 zzAd*5g=a<8Ozv|TFaYsW(w&H=6~Rh3!H@XhfsdcNQOz!(WHf_dO~!(ope&YLlyv6H zdUaz$C$)f=NX2e-U7agaoOcPa(kVl)gIm|p?>C`z>(c|;2?O2$N|2l+zOKF%X=pQEgHv9UnkUv`;4St|NZFx{?GcyFPC@c`u)G^rJ8@J zuMsZszl(~7N3X^4{pXiY--dko`S$mJ+>x+*9`;$22LJr<<=sE=5xmOf2^tl^;W!s5 zpsB8>{QP)%2Cwd3=7@ayHv^^yjtx6d6E!As1AtQ5YjevieSBriy~@?)Ci z^E>$C`w!*_BKSi^mf7oV+;Bw}+0{KOlI8fLXV9I2`^L7QPhvom(G$0zFJ?smrB7Ts zp$z``?c0x9qx(RM`(Oxe0PAEz$mlg!p!kE2zN-~2K<-l5CIJ#RM;nB^a8nHQ4k=QI z1w!6UvjL5#2nl_45IAcSJQ_4e^oRn;s;P00;88s-l%fHIH3Q}~9h{j{x<}R7Kaz#~ zFhJe#5PJxfVsS-0oC%{muF~5KzMyFy`o8pNzojEeU8&|qxK4x96*GAsBeV>*K`8rN z$I$Ez53fjBx~r!3(T`}HxIQ+Z_d)?XB?78*9C!o9$sYy8-am|XTN3jdlrml_;j~kB zH4G!&6EfbAU|vSL5`M^UA8HPPAx0-d`lA|cck1Tn2J;5Gp$r`f^Pyn?1f-Pfgr_%W zRrrDif;UvIt@^7+**k84YF6khLjF(`Md4hbH2?hZ_YdEH`=_N$ogJQAwt6y9bXQT? zkK5kT`E${PPC#c&2F@SO+WALW(MLURubPk%$Z1ALp`F~Lbhwdz7C2h+5q9?-&YaKs z7yR+z_pg8d{{3G}p-0w=&@oE@(~OqmA(&RQyM&>qQ(Y1*A`MXF1Psb2ptrR^^FnG9 zw@EERrO5U?Y|Q7p(_y*1us+x}=`K;c($Vp7nYd;f95?tMK!#ULm#Rby@AAmyD>)W0 zdkA!`lk2t=>X?i85ho47lo|Y31h|b;3P}xWGEg93Je8K$!?&yrOW?^ z;tR<8rCz#!^BxTtS;GijcW-2l%QrMgmT`lt0T=y0=x-LM0I-Eu)8ZIvmigpH`$xh} zR9$W;UvCeFBk0Hd2CQ*zq?bhA*ht60sBQ)kQ)=Y2c3l;94Nx$W3t&i+=|3!D?(2Vk z_~AQJI&)9^V1G)7!Uk*u1iDt!E%VrW779SUecR9IvoYU)#W{HnoqHGTy@pWGwW|W8ca_#TY8D%B1zrp=qNx$3Qhr@^9 z{(wMxACJL(`xD$}1&}C$d%rq)QS`72I14LxZv>43csK|oHyE5R8-yNC+c77mpv1k# zX97Lu@mGD;_h+Uw_nzis0{U;bQx;=11^^=oqGsItqNrU=%ZodHS3_oLf;)N-i)Tx! zYIm>QQ!LHRLoATC?_sw=WMHlf?=`KNYZSKSPmY3rY#7{cFZZH`L_5(lINveEVMA9o^JsxWQ^(y+{n~xe*-0nr@(@7*SI)-@RfCW(esZnXsc8pqkw) zv=moVP{Bo4VaThfHsEyCy+Q_dsbWiz<^&Tn z;^cYmUOBp#M&1VZpZ-|$<$iQaj?94`CUN&(jEtc<-bg7oL2|zwJ!r6d!}ESaJY?|# zr6j$fb-5Q^UQTz&)OzoD+Xf6VAs7p;o+GypODvPyI(JA1r`-&Z-Y+u1P6!_IkuQiK zvE1`c$#wOtUyYI!iz2CH5)fEtj#?y^AtJ< z;OeHtB?f9E2yC40j4e3oGU@Y*Ex2c=Xn&$r?mc;B^ljuva!2 zx_I7i+*jVJHF>pni7(l081QBjWR-hr^vxhV;=$3ir}S-nchl)g5R$cBp7tA^Elq(0{^5KexO-H@_g#U5 zqWHW!LPA@XVbX}!GOrB^ssnW4;qk``D95~>(*UZpMtuOuQe`N9bo)uK(81ENheH`! zATy^ZGQr&U{;6(J%`b zO%;y_J-cr2`ox#|mRXrvDhTcjAHG1TPdYmC3YKfLatomLFRaCY8i(I-RFRcQ{TDz! z%nI|%xIrbv5XhNehg@Qa+9g@%k+JPSS0Cq%K@eC@1QA`2|NifHUp{>M?R$V*VU#ZV z!UsCKtp*IeS0;-J{t@4Vmd9kvgyepOj%u7O2pG z0R>TjGQRFN2nkJ}*fBN3FA^BeI^^XU19|2nS1DJ9DI@^CBnyQMf>aoQyN(Obz}v|A zdbm4hWH#PUPKTLFsSk`^4q*I`P9RZurq_{W)X%)LdI8;S67oh*=!Sv8G6-#N2Y1kn zM?E!*@#|s$VIlBK;80=>ba*@TjolP#WY+UF;U;m8;P-FuK7RT5<*!OJuNd&cOzxN{= z*9>>iGYDBPpnq!`@fL!)#pQLPCRx)io7Z)E36Kl(D%(nu!f7yLm>qy|b#;YYs)j*>5dc&jW_Q)C zGb0obSU?H*$D66TnxQ=eQfU}EpzlY4)40!EwaX}(8l-=O9$Mu|P*DEh$~#7H6X@Ll zQiY5IFtAiCfX)bIfVI`abn2vz8{o)c1b_qS~_Z}i0&a?KJ(X0oh zvNNw9&U+81lLt1vgoXn)hLn&5y919ZP-$89kzHtz^+O+yVlFx6xjP5+XRcuZzkIaZ zAlu-)0eWeW!hvm|eOC@Oa^JYT>c-2le<-GuT6+~hg1qz3C4-U8Je=c$s3U-uo4}!4 z_uw`-pFJGj0L8Ve#(ABpS5c;3r?mG^NNf6?oy+{y24_K1Km_@C=PfZZJ=>TvR|7|| z09^#uK>`|}H8Nm;Hh_PZWzP6VI=G>yX~J#Et~w7MvePcq(Q)>W#X6BG?H*!+;`$00 z!;`>%MK{d=FUmg}b+RhHo9(VmPggMKfE^#b{E2Skd)#o|%AIpV++fT3WWLA&sH zS6L;wt|d2s{RLD7w_whnYl%K9m=(!IwVEmp;dk`Nc5~1QAasocs*bOOoEv~+oMXOD z{2`9f3xj@_j81#Ag)={ZD5Qit=j~vR2VlU|370Wq65hSzy)+y^i3s_?p@`ip!)|@PG?}qMcpLbT(i-l z%*rOy$mzmOJ(c}KVEw48QCgUz>?av`Yjzw|fMPkjtAk39;^NX?%a;kQyP%pn6b!q3 z!V%3U_MO%xOQP3y38rWIge*`8-~aXP-TS|P{}4=TmycJ}IDkU-0@{I^6CmqyJ&I~+ zF_i>#rfBn~M>V4t*Mu+F0;5kH9B=Rp27Cx3R6jt=&48j4frH|4@ZFP=r1vVCx}`v# znUHti|M>9X_pcw`8GQNh-F7v-Gk80=MD<+_kx2%Oep^q*R8a|hGy+O-&z~~v%bhn2 zL53aSbYC4L2M#Js_rVP|xHa8zJJ+GaI3EdS4K57ESlB-l;HxE zlvSxgiq=cJ*h-%)jW11U8m?0kB`1K>i0-s>)`1YvE9Iv*+P~3Glrx+Q01~_%MbIvY zIn-H1Qe!|CJP=?3gaAcDkMlY#Qw8u8=^UA&50lWf3_PlB86~*&)bw}`0;;?R9^K@M zl{(R%4jmB~rAuOuutQU@QPQyJ^@SL@4tQf{M(n` zEhQb<_IM%;(}Lz&zyUBy$wQSzf(CjEgQ9$=tX|T8e4yDuw}Gnkj0c!bdqP^XDjM-+ z;o9$irB;KK`VyB2yk+Hi!i|g9I4( zU4Zijp+R;&8F09baMXh8M$`|lsV{`~IC zhd=??+2K!`QtKxV99Cv5$p){{L+^p|q<|r=1w-#s>dL3w+{1v9A2Gxbv#t z0l%}mWJ=4D@%{IA-#&f({ew~pP_I;G$A~K&4rxd4Ca7jhXDEoI_vq~8 zZj$ZRWWIgyO1+mKE=jV)njI!1Y(bUwz;0c@%1e+iM3DS3;FZ$c^7~*h>XdQ{S>*@U zDpnnV#%6@n3Ob?D?E?5zlcCzKet~{bFs2T9%xLB_Q9a_6tP$;61YN@_iT5ezwgiSS z6I|#MdFtn`syP+(y&upt_ju@@QF2+J`>rpPw*+T#=fItbj0|H7&5ckwOKEe>yT6fO zEEQ2kEWLrCN$aU^Ml?%%LX%4(?b)1-tDvK90mz$$og$!W*a`P&uqrkyec5vZ6dG>> zWR4pE{ozPKM{qiLIG#MjZ?Ns+8|fKknI(Xsgw-=~=!I4?{Maj&!qg38!69>ca8W>5 zf)`Fe91{~j#vTK@hq7Ljexe|F7&LZFKX49#z^P;&+)Ld?N=9J{pgBIKLFP0cbtN>+wu!Nu9WHj4&%0LWeFM+9`1Q%&er=v7>g!%hGs5}kbQSNX|y*|`>E2a~^P3h=3m;&s0Gr{+IZ4^fhDGYo>fRLJmtAX;i?#Drq z3BT9XFsOAQaFBaq_(`=JwbUaN#X8S5tTENj4>(M9xQ~w)dKQX;A3hioFyIIA}h=0+#1$D^nF`)2NV9AnTUMKu=jQR1vkBD!;ZIMuK<*?NCo- z8n6dlKFdl5B?LhrT!y2dFVK#DuhR4Re88@9VKCOnKpm19tTAPTxXhb|uH8%OF2|}J zEG2(T$s)){hxVdGdx4_}i{fvQ#&xNgBjwiF5)|uG)Z|x#lu};_^#F~ZK}9{3P*PYc z8JeCd3V>EOg4|6jA<^_2ffP``Z^E<|R7JrDp{&T-2GQ}xz>I( z>Dn*nBL&d>bu|r*KpPgqAO#)JO2Pm%3~2fN!$1G^>D`b23ce%7cc&nQs|LJsBP>q6 zcK-VIk6#AHMI`hxh5$?e=$MT_%ly?IYNT<2KK&QvHbJHwZ@7CywhM+bX_@kurC%NMc$h2R z6r_8UX_N`pZaf|GnK#netP!9q^NO~_lmq)QP7m2=}Rzy>tDfTSE z{^1F-oU{L(j!SVG`}AL^z~u_{%pWOabSS72#?J&z4|TkNN>W+wI{)|#nyG^280r$8 zO72jJb-V7mG|DTNj8>YQS9LP~7c{zrv!PQqFytLm>f*^rMO=p>cOFyb^e;e1iguf_ zkARI_%2`=j8W5{t9v*@uQGbkQdvM10JNrq_AE?6|D60Y58#90*-76g|hz(@PM55mw z0=vv<1IlQoyG^!l9t7hz>RE;2_5t| zz|zc?!pVsck5YC^Q7EOQC@7#%MX1`A>J9Ekrj6gzTy^dnqnl4DWQ8jSMpLJ_>e$WE zO;+2Kp#ZtAVM@agH_DDQnNkI9pOW*Qi$R0QtriP-a<7gy{J07CfS|*ya*sqd#1q7r zYtCn9Amw(t64-9<2oRGg=(~9xxvp~JP- z8E~DdJlAlY+D7aOGYXRq>CJiB8JZ~5ENm6`x2F~&WBRxA_u4Xo$v zpq*b2B+v_F)p>=|V^nVBe8h2n=_mBS1p3(Q3D8P7e!<9&{%jd%(gij^N#T!^_=E=i zP4L}yKSJQp&olXk1mFZ}G8`mNT5$uWrMuSsGmlP3`abe0*9}gBwBb-8r{FoLE3#n| zPDb3=+xuCGJ+ABLCz#~wS{KQdkOF72Hr5{iybzLr>vm2Aan zE&t+coakD4ptkOy>K~{@(Yn^o4NwE=s>Y_JNSX*B*!aJz3fja1%DIiG#u$Vi;teK=ZUhF7z6f%f7nE;EXmX8_Dx{|JJxSbL;^8j& zuC6%&aJc=LFVD;VeK74H_VqiIsyM1muZ~nb1Gd zY@V^9Xn3PhX#nHKp7H<2F`>~oU=(~a|_YZH~WacOd` za2%J4R`CvSO;&o`9ntXVhCo@xj38KUL4IB}cW8n%w1shMTc|SkV5AFQE*cq!zS-^Z z%wv!9vB@0!*GjoJazLN{{X#=dc)Iq9Aaq* zH=1q|T$A;ohpH<*g>mq$XV(z&_l*3mMolQoXcEeWf>Dzx+!#n!^0e)gFI|!%s-g$( zv;383*5n+si5byH9wMFq&D?d#xi7=fTqDzw^Ik;>9r&tsMIxHNek0gTrnS~m5T^gp ze;qI7gc>Fxp!)0uHs{aZ=Zq#d3gW{CI}f4la+FX6iOe^Ej_Uvci7hlG(e{(qOM1m| z0yI^&XGSOWlw{0=gpGY8=$?4EZ@>NU@yqw$zA%M`B;yAC2D=UTb_g!=Dd!DNXAj5I z1_uwj?dS1jgQJIt;4;6AK`hyQY`f|eEpqU!8S`IXen(1Ea6}c4UH_#T3;dU?>3Bnt zzpYJKbTWPfCrDrN6gb|hVx4Ogw%hQ`WRE-E>gCpr31LnlBiyn#40!xFWOK=1RNh2) zyp{NY4l8kBmUfvEt9<1=_ISI_>ryPNpj_jri_my9qhe$xr_%x$(q-i9s~Cx%<*4c* zmY{>AxY?_R)qMID?eWL~l4<78u8v{q1J!a40P+JpZ6(SY)v}5U9$2m7I^VV+7WPB`_z}a{UA*X7LH)d|11~KLAe3$eY2#{BRJ5*#xf&W z9A>H==m~9^;7Ds9jg5jJbzM-@W$vS25com?5FZ&aT8KivI}mXZ4Jk3tTbfRTy0W+y zbwavAB)bvvlxrv$N*i)Cf7wDbAFdv;Tsgy<6FBy@ddNL7);Hl=<&ZfH;@E?( zQY@`Ipswe+IuQV5NE+Y?I6+0|U(ZLuiKfEb5hKeFKV@`c-~yP&h>lK}X2A z3Hs~t;z9S3rFq7R1#n}mi=kjE8v*^y=TEDF13X-w*4V`WcGF3oqJ`ankIEs;lT3X5P&6Te2)gPD1>ZwGZ11=zq zC7;j1^|(5hfM-v&k~FYU30;qYnxMRm(GIdwh+qBb`QqjIc+FEh$II*9RRbRF<&jTW zk=~O)&OM*pXI?(5et2`O;XP~o*DiG;_O-kg8MIORa@kTZ+le5A8N}xewv^}%_UH2( zo;G@O4;uXK&jqG_AF7=ZU6Xk7Fy@b!;LW=#9eU~uR~!&{vwR=mDy>5zdXD`rJiP&v*hJu<$vyHS!}VSsxYu!nKCt4;pMUhlGD-h4 z>2ELI!O6=T43C~0!2Sj=?R6Z+*ERUtFYUvf_c-QueC@Nk!ujd4*k#vSBcvPS;3cDz z24<&wzD^JO)EAW!r9Y-uv^Jy1UA!gY4v@ZmiIj{4deePztNjY}n9%+gv?*O~Xt7>s zD8SX!Z^2)Jm*^4a@>}x)h48t1?5D%)5np!0?bx8GM)4!x?MHN?e~Zi?aPSg7F8O&p z&BtKag6j+qzff{mW(bx`9ehPkZF-M0k={@*}1NU=q+)$vFoSc>;IX|Zh4qo(@wlILUafL^u>&- z1vtbEMhw_Td-UgDsls+C4j$)axL%Mu)Jka(JWvCre)N@)Le*nRzCf!Hq_e>KG{QhZ z$e^D2E157T1)XhA=(rKue1_cbLA%iK^>@N`~Hh=hM(~8|;|FRa?z=lU1vkS_16?2x-nixXpRK7fZZ_nJBtO%i-@Cx0P`_2^vj^h z_JONbMh=RB`fHCqZlGCp1C8-3UVGB(psA#(OTaE)-9A4w+(MAu@0rL^;Y<7{^3o%X zn9<#R^<+shqA>Pr^@&?81s0! zQ#MmS$9(dpf6x$_z`^HQ)KyC>pwDXpU2huASpzW z$CKbn-wcG*@}D*-Det0&KGN}+YFX9eaxcoN-8Fq#C?6{O2g>ff6}RqkjE*sy!%zSE z{M+Au|2Y_%rK`F2jJ8!(%97mVG)xz0(HCC0r-04mgDa5;9Jr1=)qL%Zd2kS*Q${XR z`{6vfmH;@Y+5oB{^9H2>m1saWD`NoM2x*S11VdePw;W35Q0H6}i$}l3#qp>8;C={( z>iKl~AZC=X@Di(eo|0v}l2Q)x5FEEalblr33@#S}?a1)R6-ydF470p4ps@geGrT-g z*RQm81JpEN5NIA8z&SEOqS2zEY6s1}609piBl4+AM&3!oB@k$-t2!SzM?TQsm_0x~ zHcNG_L@Ae80=8OJ|DH=ot!io3E3*(1uf}1-NNKBQR*JflWp^u2+tL z3?*BNWhFqvf><{|HkO$Odefgje){xba0rRCfiMVzyur6(Qu5SnRWqfgH#6LYY1 z<4CtPGy+9`bP;GNz)%cxITm$`7h2Si|5j8VdVcQb^%i{n@cXv~((SsS%yaqSRJ%Yn zyPWk2zUH{*Q=`G$uIqvON7TRjTSaO=t8& z0&7IxqoNJS9`+4Odq7Tn`TgVHKku0`$@B)$t(-w4&;<|y*IydsOLtu=JBGj~=#YK7 z6P)S8r{DMrIflxJa12G?QwJmDQ@t~|p_TfoIrW+sX*JLYXt)xY4~NG`F966P{f0a^ zuU(=CLPy?}JUGi0j}8E}j!h%9@nu$?5?H!&Ivt^D`bGvcU-fX@;2E)f*;51*ouAOdIj1SqD*4PpUQ{z)KrDTGbb_Y<*CG6uhqH2lCmIDl0Cpwf-E@r9CWx%lbP(*Wa9gLR-=c8!kFiL$0s1 zR}*B_q_;=PbV3w9j;k0as0t|2=s-9DLtrP)=E#!)MEl97C5~?uPsSld0;DLtY9Xbr;3Nqo+ky`hjNLX1xA>6ZLu&?@|8J3|ZzOZI?YH z3;+iuAR_l#3D+Msh=booKQ-2)4eA(RRzUf`AFoi$pE%)2yIPdQ-!wos@n9Le9z8(X z^PpX6Lwk$g#`EzIqnYXlye*mv1K8K#7_Amtm_qBUXPdu~fmV+1UPu5%c@{wo!Mz&j?Hb`8yBzoU=m}aY z8}w~)@8c-!pjDhB6AfFI}fL`2fl0q!(t1w zWEZ~zvWZ?j2#`)#ej8{1NCmf`uW5~Uk&DS=Ufdh%O>T1oMh^Qvs@ad<+rVcv?HOSiHlqT!uXW?Wq^<1`b@ zAgNo2jGjLLEd*Hk$>JAibgZo1@+=)AymZT5Di>guF*BiLj}4%RglcF2p}+v$X}4s# zY%>Ymf^McK*EYS+WtZSvJ-Zv8wVSyRcNARZeW*iot~oA*2)^{R4!uT9L63!p`qFdxT-zfB%?*@c0%ZQ~5ZG$&hzFx7p`9HdzjD@% zl+nGQfM+0>Oz43>vmqNmpG>aebY*8N-jE4>+j|QkpxmJW>WV#wL4Jxnpk4@$$8)q1 zYJsN>b{jB6nWxyN(c!z1>SovH4L3m6FNy9or4t&*q$s9t5pBEz0pCMKX^0tBjcAhGd4p5%<>Qy%KYaP|H>7ko_k6t=(EQJcmOLGe z_~`GY(_q4ZCxZSmu_U7w(`Jq^6!a3o1vwpSdMCFs&&q(qX#yuZRA61PfBhoJ_q@xR z>QPl2ZHG~}esoWdm(vFR2e$6n<9UOakjsH%Cs%KL?Nx0H?YoK=*fsBmJ~<$V8Cd-z zazSio^YjjP2tfPJEWX+rF^DmbibINkPGbSIpz+TL$m0W{mMTxkn~V>`VOx4lHPTW) za{l086(OYsDPhOOj9tZX;F@<#DG?$?SFXpyd_`R^=dOKf<{X&QPZX^j&>XBOT9Ra4 zjNPrg7bqvoP6zyiw3i^%u`!|q;*lmf9@U%7#&odL!MOovHO91luK^Oi+DpU=Bj}PG=>~!)z21tK6vdls163XX(oqR}X!`*NfaLFox5r^-_Ih2KGE(m| z`11Ze;YXynS>{q*^1#3NaONCgm)vhqJy~F6y@8U@xu>ITf`Ou?ckJalzBB=pI}ck* zcn-c8;GMtw{pWX|K7QaXnSq^l16vZdC}Rp*n@1jh>}kTZ)cEL z)U%J8P z^?gYR{yS6^q+U+9JRgGg?yd{lzIJ(5bcbN7?$kWOuiAJWpDxJhe;M6vG`? zo$krKg&5IJW43$U8^i`$tegSR;50iP%pp=f{gl6^jgFxba~}=bHf636D;<^g-5rIm zrICELAhT$qJEH6YP{LpF9Am2ye}bdkA%IJka=hNrwG*d>+8z~qM(J$1?6!cc3&5MC zYfKTXJOQ2589+m0D8M{(BlNU!+(1%hM#mNP!xRg*%Wjr9ZQsJaG$MF9GzR*ttlV|$FkIHT(U*++~P?Io`F>p)Tp(fI*59>!y;XU_$>q)|=;0rrnnQ-lNj<$9~L zXvaG!s24JgF5|uHYvcgFX`s3_$_337*^v#E=N3)rGVST?uI*m)_Um|AxS4l-0L7svQmPdV_A3qK+R86_12}F0 z2mgDD*exfO@`lHtvyw6i+MFwUylfB?e18inD#kl#Ig-dI1pxa;s_5^DKsTIDpn)3# zeZcWL&_Z*T>8h)_1)nR5v;Dx7(&?2|klFIp;3|)vq=b?hokCBmo&i0UUOCQCWIz#g2vr=o;tsC7=d8TAz@VH zIwDtVS0c@o3HFDbAl^rI2A_chbnhN)m;Bxu9M2n^HrQ`~8bx4Fjue-psRWciV^B{$Sr&W%9p6=;Zdkl>zXqM~2YHUcjhzuLkN<3H0P+lvK=^l+D7< zL$vpxe1+Blg-(!1Q7(|Bk|1v$xF-P*c0ISCEoX+N!xNWnsra;?e|Gmv!=Cgy7j2ZH zTIA0sj>etkuP89AF}U}pV*5?2juB!}%ay)dPuQXMHA#iLKfG41q^f^ZkqS_#Z zzPnhj=zfn=Q*GA1LT?BOb5`H>1Ul2&30P7ETq;L^G7N3ybJjwE-)R?gMklDzWxf(< zmeLSPx3V%4x@;v}8xHjWa(aLyq+B3DP)G&BQHm5`C*SUbbV$*rr5&WD5W66um8!5P zMIGHex9PP~e7n!-k6P6cw2A!QLsYF+CVPMJZ90MH8nQWyt=H})Ai zP?Icw`8&2W3oPc{}10`S|EC_Xu%1vDK@|0BIcPeH}8tFZl> zb#&fXt~(iF5mHwr*fosr%lz{J9Wk#Y=O4T;dM{z5g@8UV<}AJlxC!K`)WmKhGnbNb-WyQ&){xLi)=9_IbcRi+ zy8f;^Y4AcVDdXxq0UB@pEbW^%=84?uk8!mWN`ho(S5FFoLGbM-grqfd0xrt9v7-I@ z?jIjMePo&&t?91msEtS6EUE?|r=b=1F=7=x<_T?W{bvX~rftz=zN6yq%B|FsU#QfRST(=M!Nn3z4>0b%gDp!Llpx7$169IOi z2i5Z{BzpTj?f9)R<05Spj0`f0?ie}Kar}ex`Lvt?6!N13$ZQzFacv5PAHjhaNhhu& zB@CsUUlMD&fEQHs>P_%srb{96s)0h&uW=BUW{Y(fDOZUL+(^gQ?cuOL9xnJ*l$H@= zTml^W2ZD>}jV<^bn%W+;q1UIIbxA6AwL!DoZ9xja!rTGeL^-TksKbXl0)tl70GjL! zIiTyf5p2aQ{aZ1T1)$E)@i_uqOQ=mpK*6EHiTkoD)#YNc;|54qr(OWW#X3r=SNdBL za0p6}QN$8)#akP{u|Q%!S9{SztFoo7F{MC|ij0rGvZjla}fn$MMDSOzMsf!+*Z$2@Or@)}SL=0F38|M2O_FTk-cG}h%{ zhX$JgRSlgFK=+;KPy!llX&6=1+4-(&e*m0Ri9-Y1mG*QGrg!I2WJQ_|KP#1})HNlS zrhV!Y8wTYfy18#xf>|J-l0lMQI}aihd#&(!37Q+%b#j(S#MK7Pt;DnO^T52Ro<1i~ z^3;2H*b6i_DvO4p@0;_V2>HWvV<7hf8wvI_s%t8`dKvo-^30Pu5W|}c0zC6hXd%R= zqngWVX?c@0X<~RF;8f@AglIX7tV;;jhHD}@`an;Hmq>^v6eW#*QS)XdRIji9i3yAs zS`y5|4JFw`21mq19Xv!3tB&$-r7iDg#{||a+O=cTDfV z70;CTkuoFw-f?D*uIM7>((w{rV&rdm8yZeHek!VY<q$ zIC>#RYW%R4C7+>+Qr7o$CN$I~g2ua%$M2`4(p$GcQcxBfg@J;q=wTQ5&_qn>EgTV` z<%Af1&+Z8#t$K2bU>P3|{q*OPmpxjKXMiI6mm)7vBtKb+S`Qs9ew zR{eoL;8Y#$SY#5fQ@B?~T)~~X2ko`)!6&Zdq~{3ACxTB@gc+5KCh;n)&dAG&96|{$vnsDT3C; zha;iL)xA38@2HD%w$p+^l=3gqM0R}U>OpSWpUXLczxve+GWd_V5LTKn@pWz2-2+3m6kib~Lg_BUWS zEm!vwpsyE&1>6YmYcwXmMnC`X2><@KU(@=LltKNM2fd^O^)gx$TQA+USkUO!P<%Mm z0%#s+=_`VbtJX`|GSVr)b=S7u2lZSQbdH3|RZm6LP$H_wCzOD^1}rl-0M{iHg?8E+ zCn<^B7wH4P>I+)6nhTFO7*Io2e|D}C(BG;6dI`i3-cO@wvZAzHaJ`-(9rnC(?u`q@oxxj0~1N1G|KJmBB>hwVze70z+0V*dU z@i%a*xCOPmRq-~_;V=p}A+7cChQY4{*40|(ABFP(+1vmfbWMW}+P)Z|&-W1G=lLT^ zp2(jrHzzEF53UnnZxK7%o2uSS8>PCYDc=Q{Zj9Yrc zIdAp!9BxtY>&>j{kWwD@`}#)W|9hO2uDIv`E%^20@4x@+{kz|TUztR`SJ81efse|* zwAct!o>|Hy4YsEIIQF<&#dte33^h^%Z0Ij;90|Ay*vp{r0!p3cMLQGJ+50jkjbPHO zfQYL;1oG8l2)R}uQI>G)OFPPCx`f5vrJJ1{I&X_ud*XvX^Cb8ni_z?u9;oMGID@1sB+LIE7fHnaIwh&ZxoWYSvP~$oTFL4e)#hH-{1fGFQ&{|Zlh=A zKp254DDDk?BKRO9bYI=HzkEjCg-+le?1y#>G87yL3A3T}Xu zVHBYq)JeDx_d^oY?zzyvAtA5n6BxijoLBdyNA0nE>rF3 z^Bb)=V70NBjSikzQaON&wvSNdC9_?9G{j;9`L6x--R~d1ef;u{X$(=LlTwP-3G#R! z>jbEu94xBQd7{(+f|tug3`~Q2DOGT zbrhom>w05{zMS_tYDk9AXf+W*B3*4`hLq0V@F0|41;9p*XfzhJjY-f z9-z;9tuU&&w#|kRYsZifEa2`l*8!kRa1e`XdQJJ4Lqv_gb4ckNvnQdd<^)`ZMg{dY zlti#T&s8(>m3PbPz~<|8*j=6#QbqJ81{Sn<0$Ial!u9^I-4qjz5)3 zPKZKC3xKLm^9cokXv^Af%k?Tl2LjY%-GS={M?cgg4V{Xhwp1SIG5iq3Z+hjVTe>QTy0hVupoJJohCxp@r$*qAW@{~|%s)A7Wu z&#EX?mL^l4Q{}utL4Box=dDX`Y0{y%(5|9eadS-@pD0-TQqPOr$lmI6Iv(;NxakjX zvQo6dE1+#x`b;rm5F7v`AGF9fE=n)?v#RAvzKM|FMVvRlJ)+~{20#&eFe7MY#d+#m zd3$C2V4Shc7PM6;07V#IcEv5Y^KarZnED`Y{iGA*7Be5Gkcqo&n^On!9W;m`RdM09#5v zC|d3<&lvWGr_MOHj7m>`M4St{*@W_n6FIZo`sK&Z??3+ILy5xtwK=i zZ3iZ9VLRdINl?8ANMaKqx}2D6N#Y*VZ}MkwJK3M$7P(8i&+*1L{Whr9Q@k(ZCHVOG z<@87PLM^?bUloqGS9A!BRw?*+SApFH^smp2&>h14QJ`xRq*Ho`J)n{Lct1qDV}zeC zxbCek<7@D7E`I*k-ym35bJ`U$ZfA&jt^HN3dCnplK=i66F7<&xjy__>Bfl`|KUcio ziY|2~sG1)q3vU?(C>@=Ge;KgGljIbPAk#kr9ghhpPYV>5rIO3{;{m{Eaw`w6pyNV# zA()E0(Qc#jexuXd-V@VuTXja|h#NtU#)6N-^q?=lpyHBLG{*q@3%K0Z;lmwp%3q?Q z2tIZUHjnnQ>KJPPqKZLv6^wLxCt&1o(7ae2+l_*cUw;4g;p@jAnNqdqLm0^4NyD{8 zqFU}og_80_xgs7Lr*=BXiCpb&$i*KrOQ8pGqe^4k#OtW+ly2WzqM@MWq~%At0BM>( zKL7On$L-7C=c@U{L%6IS8ZwCLc(MU9tm|`^rXjNx?RCN_Hh|+Mu!3l?_i*A9b7UQl z@v%dmplm(u;mSTe9Pqv=!a+&J?koD|k-G{sRC;c%G$?uk#C^05AE93Uz=iH;x2r4T zLswl&+oq&Zz=<4%m9CQ$bQD#K7hkh-SM9JgQ+^?g@+aSe8u|Gy@kDbh5v>k3?6=)?rR0g@rAGa1z@ZhRb~V%D z?VIMjjQ=}5?>5+Zpy8xQI8E+f zMy5ELf&~>FNZ}>KMsvygBPoBbJqjUf1Hj4+K;!5h4jXK{Acq*7aKKALdhY8VW+ee|T>6P#De$_(PLMPHo`Ast1c||T)o6R!&-1W>A`yDf zS!avMR4T&y-1Ahk`6UI6eb(?)vnD18jXXC4O07ZzWc~GW@qkSHS-?#A6L3DRb))YB z*)G#l86(XS7>*pe_eS{rD38BPX%&(HP(6FbBq}+w^5l|M-g!T-_z*y(+T)k>(8Ti4 z)0Y`40f44}JXfD+c!^I%bA1lbiMnMrXmu(8^;JO%Nl3s5UTg64Z(n}=`?q)B1@GSf z@Ga0>PXukc?AzWVxDa!N?j`uhwc9r+aDq`EhER9`&3e^TG|A>oNvWg=x~$7M1zHPJ zx7dN^(yEmIDkyAh3$)0CpoW1Td8e0bvoL^b&J6%fig8a`jeGGcbaB4Lyw=1*NqKkG zLQumn-hfv~%V(}qm-I9f3;t5JbG8;id0UIRZEk>jVaq1VYVI|$lRH6vWP(z4eV8eDKyOfeci8e5A5*|G@ z8XzngUxYJYC2eO{bdmzDFd;ZPnPph8hnhpK2)nQzK>J=xmP`UC*ng&{cIxd+;!+`< z(Z@1WM60!Q9xi7OcC|)pkqp=}3)u4*M3zFgsYbN{XI#)#zWes$AMd_>V2XKfBp7ku z``_OGilkv!XGH)Oa@BIKyT=y>5ixM70s0LCD&Pd@T(1GG(d5AkH`aAlgE%}+t0NJ$ zc@KQIg8kkDtAPQvTT6>h8}Kq+Ig|_UfSwE413OMf8PElGBPi7}0@9@@_&DuTqwYUL z43Py7Qp|C)2TOrGF?-k_JjA@Wwox2`k`w1tWlAW`)>ArFC#B%j=%0R;&Ybj2X?lIU zA)#QXK>>Xk2{Z^!NEjFfz@FqPaJBu)nV}@GDyoS+mfQXYbb2hu$ED0?zJB}7D5JGp z86V;}gz$1*2lJwOeN>LV_Goo*eQ+r*p6t4;jYjUS%LC_}t3c~h?`TD?%ecf`d6F=`TD z-#>o&^5Oe;rZj3Dqc;q+jQvsalsJ(aP*h3owz#<`X2>eq*R<-%S6EQJ!ww`obH^v zBDFoI)j-t~@3>1ylRpQpqxCFT`XNOJOyJc|8ypSTb#UlWL%sww&AejXqLt7ts0*v} z5b-Hc{HCPW%>d2XP{;;PKut-IxOM+V(MG8ON81G)UKB*z`B@tQPSFJgEd1BeJu3=G zfK~B^w6>TtI7X9x2FT>tfz0(BJgJ*F(M4cj@SOpt;jf%2gPcCKy)i1CU>K`c0knZw zkU_U7X1C0CWHz|SAip}FMiXvAs(9K4EThP|INIaxpn5bDQ`l5>8ZaSp127`N6`9SD zga1FS{-jxs8|m6b=kYJD*&Q9Tw=9}$N5?3NYThD67Rf4=H2DnCWkhB)xueP4nS=A& z?^?@&EuBjd)RTw~fk5K`9PSvA6UOAY-4h_NUw9ow6O0}K+|1VqAo?Bx>c_pB?1p_+!AV`gmK-EkGD&Y{g zBrm8qfFZUXwvixzHv(!@pCo$Lqja(LLtlj^j@*OezRC(8%L*}?~ahB%p~5@O8E}p1N`6m>EzFnsOq@r8saoq73e1oC+14QfZ`VG1 zebiG+cS#Fw-A+q$I51|C774+jbwLiaV>VuH$sS3R4v z6JkCrFNEn*cNT^0;*#BopRHW(gp2gY0L5@F>c^Al@(aJJuBpqeW~puJVmg;Sx`ifx z+?S%@LC|SwiaZw&iT)MSFzs%;Ay2dfGr#acAZPdyd41Hh0tG6U;e1(Ej}5w6k2JDm z#84l+Kc=Q0&L}Ch4AkK*&tS<*QUPR z^sD^`-lQ%sXO6xM*cVpItoFSGfNPvxgr?=<8;#6f~VMk%Bu!hh)MSWLQKr0$Q2Cx+{5K2cMVmRl0`4!`M#86+HN##h5-wH`cQ)Vjl3DWEo{o|B# zi~7ku<~d6}>~XfVs*;%Zq0YAxBgQ)NY!&4v;W5#2gdx^NSkuwfL?ePLuvwD{CN(~%*adLW*z zJJ?do2}q5M;TEh^sp!o+GPj^xO9tR5kC4lC(uo??)hH++QL*QN`1SfY?hUBpNVvKa zWf*s&qg>PnSFQ|ze0ta$SCyi{FyK=;7@=2^!~S>-v96?BJmUmr0eJE-JZw@MXfqUm3vE;oXjzyKp)Af_R~@+P zG|xo9(5xy&)WUuk#WAlqb5YMloN1)?CX0pVJOH~Gj}THsTx%k5B3xd3><2nU4>Kg$ zs@E?m>k>GL6hIkJP>b=!U^q1aw7}un1;FR`#NsKFD5c(x(Aa4Or*;Xh47VT&WTc>; zC$m(kHQySt4xm`LU8ts?1&*fy{kyY!C7ih9MsVe#Hld-%PXdj88&I#6V8sfB)+QH4 z?tsEVue}fSp|v1B0IEe(jDWeh)A72Y=Bz~L_GUnl13;}XCa$VpIcZL~w@OoG3t$Az z#}Q;hax%QC*pcXP52>jtTJ%?x%pMZDkw#|?>1l~jFV`f|`H-OlF}I}iGZB4s(Ct&V~N{s_`NdIdnCJ{)%|F0}AM-vk#r z>8>>lnRvNdu5MzvrYhbvv;>G|b1{l8=W#Zm`2i0b0}O-&MXQ|O{pYqlr_CQxJ-#l} zxaTHfKx7NFNGAfeL2FY!c;Zvw5h*}94Up$r^(7kd^pM|GRhygqp>I6NbA zwxb$_HMg@O$wWFYVO(DMtF>&!T`u%|TQCvhQ!Dk{d_iE&dxW4EFnc4VYwRTW1MoLZ z1vX)TOdh$-qvTU^h>3i^?s1a)fSR-0DDr@niY&ChXm*6=jRy=?4OnivahWgfOkmZ@ z1YG|@KT6c98bIa+0qvv}_FBgAr(*!#8+B=&@RnV*PSjEZEDg7q)}33Z(QxVl)_a;X z_CGL`BB{gqiTgWxy$681fB>={Pk?}7hkVZpYATi5&S}I8NF;4XKV7K9%T5JgicE-_ z2Cdq2RwHNXW> ztC6kt4qpXa6%^o{Lx8uKU4X6NnC*EEMpm-%#HnIVWf*ZIxd2sYZ_u@NsCs4R0YIW_ z1L|!ETJGHzalaHTiD?dx9xb(u!$}+|umkv|X8|?H0G)ZbsHGad@{Kx-Tewung2;5^ z8@KfWLFCm##bey+x`|VgZN#fv8p&s+;JS;gaYR40^bN#sMm$<%F)YWNe~7jR1QC#uu^N#CSAd|EYe{1b-0|E9aq z8WOLz`_&X{ArBE~@|qq5-q-_%f^hZzdtMH?W_}z4q#m^IQ%K8MfJ=hGiu8tR*SFn+-;h8p zLIX*-bTmD3?XX&OK$ z**Pma#0ELSqY&7smj_6C;XCFS>2UK|ou+d07gdjHmXRtzSJCwWAfLwj996H>8X6~o z+)aS47<4SP0XuR)EAw0cc7>yX9g@}%4;AZVhnOZbK-DY0E=Q<$-0J3ia3(+q{Ir5Y zC`aCd>nfb@tEA3|FHqeagqH$xO2nb$zy)};pcTI_Zj7t$3W~(Qk^J zF^VjatfB2zcjci|XRWCa-(VlHWS?kEN>I@~5xsm&*QNy&kAkX(Wy`x17!2xZJ-#e` zWsq8pAS!PN4?vp{e1MJKHURD+M1`(c0|p4n1O|Wx>UehdSO*Gf6KSO$8GS^M&kC9sQTa6^PfNea9V$R z_dGs#=iP_@{xGyJKfjAAy!^na)vBGc&Ebe|VJ3?4W{rwFN{v)};$wg`Knys|+OP+p zZATOq6fF$)R>0-bwtXK}blP0zS7)0$)rCZ;F@!-zN90m=)=30(9_90ODK2%Xxu)_#(?=Ce zKa{UChj2?&uJc7%1#oNL5-7HgF`$>jdlZUtt!A3n1e9a4O}B(jYw>`x!k?%NW-18s z=R{~Y9Zt|tQoyZp1bJE_&>gryAMeK%eN&5Et~ohhPUpu^Ps4)u z;?gWvr|F{SB89a;fa+0Gr4K+Oq`X7Ly=*Ii6E}kam8O3r&}xTbsP997xKscjrZ4EQ zOH+MyT7J_9t zdKbFvaaT1Yw4%{j)Oundl(d~nKw-e=DaWzrx-8+;Qtc6tYZ;*&2aNtO<|A+cwC8nP zwI8;Gi&oMB++)@Wx^f;pYi4~>Bb_dGz>CDL9kD^EL54&4QzI8%$Y#CYwYy&58nECky23NYp8AJG{W z?Ci_-%DqI$NZbu#{W^^<00#j>#Lf5>&F>jtY;KUe0h3#Cfu7lh0*4S$iB?0c9|0P@BBrg> zokLDpX#JL8p3-P@(pEhK?Tw@=9%zf3In%~KRK0GFd;@N(Yg-TcN(4$LMw?A?^q3|d z*lW>FlK4bjVr%JW%c^{s$NOLI(sgGo>ARixgn8YON0QL zC};_0y@t@u>X?KRM-C!Ziyuu4PZ(1{Qj|Db(rqlorm|Y@ZKr2L)NYq70PnS!Ed)R( zH+3bYaw<3z3d)(KB=m=;cAzh2(3Sp?2xDi$vd4-*B^4Bn>Km$JmO&;$TzjHH5`#oB zbT!SH){?y!%@~sknt5kBrfIiD1G43*ra?zQ&amx#8V?U%gD+N~cfioHtgaO;u3}*D zqesLIPh|cp0nH6dUS)eG2(w1cC4KVEZ2GySdAjhKh>(avP`5(xUtnl$?|z`o8wEIo z(~);t zWXg%)WD%;v_@R_(56S{n&50LO!yiBV^!@X1AHE@TEQ-f$P7H7!Ls_faE-Po+Gvy^8 ze*5vmSH@P(%0u-W)`hhiB;(2eI>3DhXpL21twL2nP*pxwSE?El%E~g7Q^X~Ad2`=g z5sHx^pcp4BPms(WXF)El4XQ9SRQ(n7)ncH3-q4_Mxq(>%E@_8rQmJs%n$VS{CfNzS zx@Cf+&W}{rOG!yLi}z*+i1uYUk52>009@>FdYNQt%+|QT5ck9cH+$BZYE@rdn{TsB%s=C1EkT9?$Hm+ z+7o23h==k=$#3KCrxPdOxFs3My&0rz-US@H1d5F~&@<2qvruifyO{}SLO8u}HNQN@ z6P%9~&`kzlZdO`1AviVM=DH%@8ikwB_BUd8-sCLUF7)kO_M}YtqbW)9rW37o3NEx+ z?}>xRAK!ib=eJ*f{Gga#TNs5}#~{dB2f@rZiPSj))ToN`&hmIN)zQ)o59`E(tF4k7 zy=iU?aJh3qjbMcdPwg~Y7$|$AjbsKuw%ve(J=9Ghj1_n;BO1y7vppS%PH4x zCGxXEOWboq$Xc{Ejb5uCiyg=qXs-(?e&Tau@ahK3Ju9_GeVh?&9B=)#H z8dwf>u0^8*zyQzbr3e%$1Z=ciJ3k<*15TWCW-3pE%OMT^NSnEfUf^U-uuJFtMwFhV$g3e_g8X1 z+j=B%9H@#7=;iOC;OYgX`(ow)3*NPH^X}3|)J)}!8NmJ{T*eNg!ADdqw@2OGDQgr< zQ@i|D1ImROF%4w!0)13J;sfDXGo2u!I2Sa;cI{6k$hm!ryeXzt-bx9xOk@=tbgBqy z&wz~g6?Cme85|&mIb`89_F9)Lrasy3bvgy~TYHP%fBp5_cUtXW6a%53X*9o>Mb$EanT`)oT zAftNlg2;s_f)*GAbVE;|Epft(>q`ULk1otqR`1tkY~Tm2aT;DQH=UU_(qc z3#+Uckw$rgH)ukhGvX-mIeQr^1nSNmW9TBv_-Q21o_{m2Onf(%FV zu=d;(f`T8XM*|G!C-qy$Q6bvz(+7w7t984Hk$?MvRI$@4VZv`#E4E0GsNecIg=>0G3&p&^O3X2UfzrOS5VfZAN*)9{Pmm}D)ktJ|O7_40dD1JJd?y7Z8FMSF?q4@{)0!_>Qts`KFeB24- zzNO%H!B)AUp_~DRgo7@tYW#zAw$wWKal%NuWi*%c_X2AJ2sGzE3LTfF1ypaOJ@Nl} zu=yfzz7rR{PLj-;itb(otiRg;3H_jw-L=yB)AZP99ul244P*Y`7odTNS+|(ti*lg4 z(zZ7N%`V%e28EIvj&X8BM}LHBaSgv)Rn0WdZjkN+WF8U&h!7n75HAn&d&M6ZHY&%e zLdM{VCdW|kfrhC;-E6q@R>&QI3h4V^-hKV}`TKXqO*D)f;2MC!g5Su7BofeS8?a>| z(9b$!TFGgElNtpAK3;0qo$NchsaRh1lb>C1Bhs}xiD+xHJ2KMH>Q z_~EOLv9%B+sj}bcZ&aMl)A^+sN;V2q$S-c}7f*FjbD12JH+hF<1!MZ6eiZqTZ<)vS z?fi1F$Yr-*&p5MgYmK-GQn4!Pa=A$Dw5VQj3#Pl8>Y+N-Pf~Gn1ooNGO-#Qd9LvXj2!Urb7mB#8T2g94ky&W$ArJLsq=LKA#0%vfvUN(~&>c z`c&brwB9Q#@*uNQ18`@0?k#di(sBIyDuQUpV*>_v90=si^1v|Z(N8&sa_;$TX`iTg zcTeK_zeuF)_Hx7m$ho(XW+kTEl`(kPg%xKZn;KLhO_jo;TsNMM22`vj$nv#0XuUaZ z<^<0S(R;dp8A?82Zb!S<+|q_p#F~9n>fx9c>O9jCR9rob4)t9!e{Sc8GysW{C-1 zXP39RlSU{9adN&xKMA%R0^+X8E*O{~4yf@95 za5WG#9`|~=E0;HzfGZ~~b#IDfI-71>n330ipz86K!$KQ?0<>8x+b?$BH>b}tnAb=8 zg``(E0;hX)$dyj-)L+l883c677QKJ>>B|plP7sqzE(Kt~Y3JAw21E9hI(|$h*B2Ll zr@opbPZ?|iut)Wj7|}l|q2nei0Vi?rJW9xRPbUvZ9yT8K7IUJth(g=dRS4v}i;1H7 zCssbHLDk%YZC}lP;r@_NxDZ`X+n@8Hh{4FDO9aweRbjxe(rQ2_7i9#OyQlL&q1v5S zc|$7D$6%1ctGM%8MTnpBItu83BP#aCW1MIbBfE|aQIXVXo7H%)_;tR!1ee7f7uAub zc=yv!>24e44|%A608pE!=3Ep&ua=TOiUD2m0!b@hpZWv9Nc@BjfgmA;FmfD0s9j+( z=vW|{p)ar>v<49<`r+T-zkm4p)5kx26lBmJ1jXuOq&REn3J<7e0IDtx<*WqA=~U)n zlX}P$)3jXZL0M(m77s_>VzO~O;L1PUjIefZ;p zV!ZP#GC%q#sM~W3I5)D~kgqbi$@Eg}-);#t8pmURLx4>HzCp!>S89VIZ!qj?X_P+4 zP@|_gCqVh&21~(deFzu`?(%ph22@>hbU}u0XO*EW5@%r-fwJNUs&`OLEyw6aI(8nm z0(y5bpgRI1y5JRXsE{wuW~N)jd|Ek8lMv8XrUo+E4d4tPV=!{!E@uJTAi%1P*@P3f zuL9(=m0+fn2p3wt5}-@=aK3ubvk0i8esN&y0d>NFB}kA6Oqo9CoL(;d(R}Lb;@&bL z+!Y83IhU0&-O{|T3)l=sKd2R1coo48IjQd%xYVF$?V@tEbcab0KACJPl&RElVvmB@ z57acF&rJx`tCar%3j=``B_}~kKNdewQ=b+?srOqx^h$yxKsXfpm{Cs^gp(*F8tm+P zDG}$U%)-oe)EmkJ@Qs}GcJcT)zHkf%5w@e3<4Cqb*<9u0I=!sbo}ejq0)zpyJA{hn zA4Ga-0M{RJYmDSZdLIOFvIoug4}v^r%&eI)Lc@7HLc*;nxeT_hywSwrVM`dPtUwr+ z5d%X~TdYne$ymOhFBXjxc7Mouji7v5;>Zyab6%&ZTI zCJ4DH+5b=h12H5SQr`MhI#UP<7&8f_E7}n)|Hz>Ub%D^haF&CakyrC| z9L}U%)?o#SUMt66%V0UZ=XErNODEg;m?ZX@hW;NqXQ(gz^Re8cyuV8z24wMYAJDyY zYc;PBzX`0&2Am!z$bbbwzB38jykfuwJVD#_0@|tda7qQ7pb|)L&fsGA$>kE}2apzR z7{!?qfh^b-z^_cPufhsJwu>EI4`?Hv#{GAbeDBB6j9 z-m$J3v~LKIGXUB}b_RbSsLpoPnxa8Q3~ku5q;uQ08m!LY6v)vzeST20BB!Sg<#Wfa zL2MN}S{9|p_%}3QZ!fr3gMn58MLmQwf11_APA$84fN9~9$tK;9 zhup0_p`0bXv@`;`s@rb4ANRpax$BjVlp#X@fEUw{J_m51NI0R&3266~H$jb~&jA4~ z))DS1Nwk03(O(-QFCzm%K5PLeD%tN1dfLKk$o`7}sMZ|)@axatKK%E;e<+3vOa!_o zOnK*OrS-%L_qyq0(Us!h6XxhZs`oR7DLS( zgW_@&xcg}~fQ+N-Njh6gMT{w|^=VIR*E+$p7L@__CJ^w{nJ1emI5S^R8Q^QB0*tY8 zeZIQhZnjJS)nFj3=130(wfqo&Gl|WgC%e4NdXKf^H0Ic3ulWlI!xjT;&QU-~ED@Qi4B2GI~TXCfm zVFUDcKd`eK>~y+QY6&N)G!jh6z&~{C5=rHoo(J=4cuH#k@Nky20j0X?2?NIr2JDr7 zkQatUC!brcXCQ_qjuq23PRSo?E*cQHKceC}RY?yjj48Rn=8XtN)3Kmc+IP!`q4?WC zLu{gyd?(YF>|f|Sw!NTwJ}t&NK!Ujz*S|=kz<(Y3wz}!`)^%(p@%?Cw#X~8uJ%WUG z+M)Vf@IWtQ{=SE^MK3Qk}Eq#QJf3R-SXiACezr?iEEyn=*In_C2*wYj-_ zLzi*0UR6LjuyU)HQb4E}SHeQoBf>OGpahuY0N8VhmMb$?b!gOpuI#E)XDPxkv$v~? z2DJiDE6VfAh3*{V%-xp4c20kld@1*YC_>T7J*J9U=Rdf|7g;q#j46la&Xo8(#35Q}u9!lp&Ih!l^t4*b&&N z-K&m>T-FxM=!bXT{`uki5AQyHWHegkf_Ir44am7ePun*^6KXOGqnl`mITLUcNf@dJ zN19ZnsUA8+{X^CnN9mtm&rP;7pFq!}gze#A|KbPD<5x`gaM|rSW|Y}34vie$zOi_r zUJd3RUTAud4AkPfXD>lydiayQ`*oDAXo7&A-zz6sjjXmGMaGz88&b~M7!5-M)6CzRTfp3{&Q zcOvAD8>!f~1o9xkU8GdD<|;XNvYe#vQ!dhP0CdjEVksjp1g+E#k2fUbCinry2PZWI zu}Lc_32k-~RRPRg|B$e}+tyVH1x+-p~<1u@&^ zmBcvDIC?Lq)8mX**WFp_Q7qi;HWpOid?z<3U*AQXUZ%Mm0IRHq25zO9S`=_JYg~st z5=M4D0@}v*!0j(0PR9`n`O11jLC(IPmOUp*8ty+P|;H#ebf1KXw@y= z0U$YV(Mz~RMh9>wS#@O*d$&v#L@qpK>CR>{%`M&w-@ET0-~IOe*Kdj$7Pkkq?d#RK zh%Zc&ACaR>UFOF~Yt`-R&I3j-Xrr`Ivmmun`f?oqc94YKJmJk#g5TCASGnA4hqmg` zx7Tr9rpTNcLqy@m>WW+EJcO8J=K-yahlc(XpwJAYKw-GV;sHqC`)Oe`0z#>BPo0b;$2Wx z`4Q08-+Ol5#gQ3h^IWJwDd?FIQfQMaaG zob2}^b0MP+WU!r&VB|h?DP}&lkAYL@*Alrtdt3DCP$D zeyZ&lki=eT97ayt6P$Jn5HyH>2cVRz7)`l&$OK3cZ+H$F($1sud1$SVqi2^#o-na! zs%iQ_)Nxa=>2;*BLAi!wuG5xnUwm zX+^~Z#n2`vQ&Bz&bwq$8MIEjrjvNLPTL0;|4Uh`3Mm`OOhuH9b_b1+uTMyd+Y<~pl zEqlckRuYItl^8Ce+_^?pL15S*;-mdJCvj5Os%k zh(UKY3<7JQ>F|?I9H<{Hw>DgKL#^BfV2$WYv@IR)h-QWx$_P^8q1dV2^aSm#kaJZ| zDO1FpXN*?R*gUoWf~}6mh}7IJ9lxT0?`RNvhy~q=GO+8>G3;5qy9bwG(*QU}c2e4v zz(rUdqLjhB>L^n1#k%Wy9=n;)IBqc)a+A*!zfkctNqO=Gq_{q;Gz zY%C4%YBz(D>(;ctp+#lx4wbD}O3?*n8;nMN`}OBvzDM$HHxAnXX@FS3Nk>9GYKfE* zcGJ!>KZ+mp!_y*9bpb0SCl=H~h^%Gkg2%o<=^G_)WMFmI=-@B4lEEDnT&tiC&oJAg z%$Aw~1uBlQ`IqENZCBgO6JQ)vpwTP5QlFG?Y0FYT^{D`fhd9J2an&pB)1(KX+JgBF zRqH%gRKM~+D22WQrqs4#oE$qEP`UtUE0Y1+D#1SWunUKFhX6a?(9{}O1}gK;L%>ji zO(jWl56*NnVxe75Hktxq=mA`UCw5(4TM%f&H4qM#}fk)=N;Jr znqfKR^#el&TJX5B7PnN@X6(50zw5PvH=rDTbt@zkZ&lsGus)8v3FSGqWc3_~3`C)>mCe*DY@J-$>q zUTv)Kl$u}uO71W?D4@=@8Mykv<76E%cMs`Q-B{dKt;F+|i0wzj0C zp&Io4@5*w&{l@Q7x_*NJw;;{XnY}BxMB74QDwfylL^%xdtURy-%rXN3vf-7`-sW2& zkbP2D^c4f3Ef=bgLdsfJZa#Wv%7ge|1%*Jl4|a4CSy&vsQ1EG$`GIhSrgd|zDDcNr z-gc3>Y+;KpU_BGCV-{=zB%34;DrW`6)&!P&9RNcZuhN-}QEc7Khik~uB2 zdUM(~yYv2XU_??Tb%M{~k~}T4a)UfUvU1J?{k1Fl>DfP+On3*t|B-tk<=gF!*ZDu7 z_|AQ3k&7YPhIFIf*l)Rlb$rd-=`=s117c66L*cepzO@cPLH=a_T$DLS_2p}&l= z;IKA%bo|hM9sApt=$QB0?e+_wh*tPs)@4VqKe2GfQIq|j4K;-C{dS8iLpQ}u^JB#9 zR+b+RkFn&wtK*@k)pk^5w7rMzfnQB;VVU{%Lbtzg{0oP_@bVWH9uvEj3IJfkK=77v zA$3#o#_R08-MQnw%8un`4>)ca0EYtuVYk_4yyc$%+w2&ZrVJ6f9(F&t({6XzZuZFw zXuCP;DZ4FqV)0mZ*rxjpz9cZ)9Z`Y+X|mCa?qYmc=G9h8dN^r2P-_jZxJ~gY8y-sV zY-Z3li5a5fCZv30no|Ize8ZGy_#XlxWdIy@3@=Dsw#RpX#CFVL|7BA953t)Z05-`k z+Y;i#K2A62&5sCW@4~Hy4Zfy?-oPUTD213jr*sAeh3028F?6Z_1I_&UuuSPRj8RV@;%CfY@F6`M_DAE*1|!^^&e=gI+tK48 zc>D5#yDA!=KIQ+!32v04P;f|pM3cx0MMfdUvAq~6J8t$mXU8DeZR3sd1dPk@iSX_* zK69poAQLzfg`7V!MEmD`D31Lz+P@yhdVBu4ejn{o^k{7*+Bf?@ZbP#kyJ(+pF30Ea z&+7MR&!&uX344?&2Eb;QutLYg4MT)_%$kkX7j$4C;7yRY+h2%}4>pM#5U=fc1#Gtr z>qKNt;r%vS2Elf7*b9<$mqq*iVb2ixJ*6#yIe~oLvr26_&c=s5G61sO%iQp+Y@?QE zk9LcJfa;~ZJ3&B- zw4&Ug^RvIvZpXbCRR=&dM<65&fc*gt8e?|yr50Joi{fv9*WTHmqX&!OKCC@2L#f*M zsp1_{#}MtdY?@HCXwqUs(^c$@83-vuWc{ocHPD!E7yt?C125R%MjO5=x-=>*08s7_ z0B9hltsrFpBi$o20*%Hh<3=rOLfZuXpj*ANN&pHrfi$gA@QvkBGxgr zk@zQOh<3DXgGN5uu2<9J+Af#sI@K?L{oyt*D23Z;Q)Tz`C5g7^4j3Y~`kJRkqq}d~ zd(Y#9K%BLiW}5Gm2D>jHEhjKT|S_yQZ;Izw4knOUal zj=aa`XNb^fu;IX287|HE;;7${JuSPekh}e9upG=Ks;A8vb;gD zU;v=da+JeC3nXd9P|(Fy_@nU@|HlA;bc{gQGDMqfd#{#qu1OmPLdrl$7yuA*5CHN1 zWu-A<(En_*|B18B|3qjnjuaGML<|75L=>o5{&uuZ1xOeG$V+ad!aoTE0CE;W1c_?L z06=e#0Km&3L{@$H)e_yCF=*Tn0P#VV{5Ek}G5}C*(q(*gKxBE$EJt}`0HEPS03Z+0 zvqstTSu~I9Cd$5^|5d)e|LxP)_xys{<(GIr+@4WZl?6kTm0a>_M*z3O%PwqIy4BmR z&W^_e10i7mppK#|2B3OTz|A0mQJRV%CTTgre>9u_qllr~{yjLLelp zI-A`+@&%8PX~Ga?o5O*&bO}3#C_{EK061nq*Nnz%#{fVEWXu4baAbi;V5V*e8O_oV z&>|A!dlOltW4sQdEeH0kAtvu1BdrO=bY3 zQgb9686xY;k>|WYV)G3VZ38h7VumP#OvL~=92p1+17HVHlWjjJWgsLB0OUo&yg=Pz z0HE4Xde4wsd;J5%$4mI}61--@*W`Q$1$GaaK!#jA90F_t#2z*}6l=kYAP-m`c<1<_ zsbm9GTo1et1W1gW1MsSNt4&xQm_p@;VzO{KAq&7{V3eGtib;G@@d{i)LNm2v0B``w zlhHk(5668_NEragjhML+hgUY(dDti>v9}QL1!KLku8QrUad>3|ydZKkQ?BA4O{{y! z1ok=xI{CmLVEgBRwI5lV`a{SlerIG!>hHV@hj#wy0$slKY34+NJ#=F^7AxzLD1Gj( zFKxC&>F-~EOOsFkjMDpN+C2_!l&)2s)*qAVLzF_2;}+2<4YGP#o4bc7t)3rGZISJN ziPFE?zqA;q8+98~TIkrUX_V$N#EC<0TDQxsh|(jcK2Uf7kV+u{rD!x60O({804UuE zge?QX3aW=gfP|1}ozq~en3%zU`R`#900}$liyQ?i%z#5UbWnB~Y?usvh`k^jvZ4#v zF%Y);5FYp}W&17wli>?9&1dS0OSx&@Cx*_Lz38g7+8#d8Z(A@Ca^<3s|@%og2?79pCjubJ7zn9l+Fs2=79b(`Y}|*UCt#7;E7J}EbSSob*sJL60&D}k z9ZCfDUIu9Z9XfmHVlC5z(CkA0Jti|O0o+L%Z?xQ7=TGM*b)+Zv7J6M@@1!wu@A5d zz>`%;6mzf~->LQ31<>Wb+U$HY?m_45ET?v%J=ul!WT$Gd51?ml!b3A_-*)^MdUt_N zP8kgBO+&>nK%L)?({34Y`Ih=9d5_Ast;@A4hC1RrD+9qsocJd}Erpn$Zuh&xHg<$9 z10iJq><$csm?7d&4^kxFXlug{0RMZrS8gu(BVzzS#77|bnzs#~WE(yJhM5co%2N&1 z*$oKTl5Ty+>>&#fPG&Z3QQ@|+2YrAoKcp@X-x$eeFi>UMhMKnx9fQGE;GY$`3Jii7 z1mU4tu<)Q1h6?A0#)7w)aGx|hA`MRu-!D!=;*;?7@>^J)(BufCskVgV4Bc*IE$HZEg0b+E;iFnpG1^|Y3^kI}zqUK05-Qa6(QbEEH zafQXwzX{#ZCUoH&ecye6od-5)8`ZsSfK32ho>=MMgidUuPrnTiVzyZTrcfXH5MU<= zhYr>UZbC=52~~F!YOH}y-dVxhsK)B#ErTGOytS{eQH|9@H~vjS54KU&O$7dR_*sv; zGbv#Z*c~&sludnkg7D2Uelv^&82~n>i#T0(+-%XSae0%|xcCR%8vhY85cm|NDZ_}4 zYb^R=+msN#Q07Hr58D8n0K89-t+G%R4Pt?P#Vq7?CTWYQMiytW4jrt%Wua0TWC3Ci ztT~x-f9Jtsd<&X|ek}|AS{6P`7CJZ#1sDu`dbZ&azD>=%)JzCB+*p&Gg`O@8O=%XS z4ugGwEPx)$>Hp2($*xbrA!|2Rj<#H($9Q?mK=3_A8tP{n$^!?p zsxtyTF7ZuIs$!s%<8XQWcE~ylh@be|18YcXFyTrp*_sK$1eT$g{sV50vPr%HN|L1>KRK2*y7?sUtj0(e< z0Th^+0e}WPJ`gZEq>W-OuxOD5|6~ji_3Z7f;?Rj1qyl@HI7vc`Z>$AOR&0Z-a0{0G ztpVZy@w2_zUE|}??h%FtaTpqC!eF=cz|R_oPZo#nDh@+~FonP`u=khm!wvVAX>k~` z#o=?rY87?EtxtHo>1pdKHKl~uL##ttcorI_!9~7$Sd4wLI0z^Nu3D3laFQ2Q;!x3O zwuyUC2{99$Jk!^#*xa`HZrJxx@_TDrvyi!s~3u4MqD$%&|6Ahr^>n43QCv%I8{YXb0 z*Ad|6TXk}TUVglie~w>=&!?{dZI{L8XlG}8QIlq+MJ%NEm$9RxQvhw@@X#+bHOuRp z%G{nLztHSQhiClEy@XW<7`s|I?H#-WkdAg)qs05YjuP)vl;DO-M=%qW0CNi$C3RY7 z^`_p|QS#ySI&obo`OsC@hA;cUTq#9~caRe$-bW3<+`8b9`Bxyw0|J5W-6uj(At!Kh z+GhO*IrDz)WmujdJH?4N0}C+oUQzPHTGyO31IQi?z}tNX&_oN*@zZFD-(N1^Msa{` zu8fl0m9q7bNasD?ias4fUF1$Tg{ z$Krl@@k*mRiOWvge!m<+>5vV4)8q3|*3AMglt>Q>ZHEC`970S*7!KIf z?h`cnCdAx+&V3~mF$L-pJZuAO1R>ZDv@wJoeW3`@v@IquE z@TEEc)pFl3EIsdpo)e7O`U+sPJ}EZD+`ay?P0_#d>NI-Y?m3rJN9QI8H2!4o9D8>cJ$bL87-k9KxZ4oYV+Xy%@kg$6+r` zZ4VZMjL|u}aG$Mz=wa(W$HC^02y#+mT2lHZhYdSBLVB*Mt00`5s7FamTTn5vf9U?G z9)aLL{r>3B5$K$Qe}o{!?0G{e-0)4=>BmgZe!J%$FG4tZ8_wBq@g?#rF#7;}FX_5$ z11Ki;AC<7<*V!GVpC~Ow#1amhxvA*ZLO&qB=7l7t7QG2Vx>_Y&fhqn9Q< zYz2}n0Ne1?Z8&G+6YYh_BuvEv(r|JpetwQJv8i|+iqC6_Hu3PfWQP>(`C(~f7biIc zfj{xuk${6utR_@TL?9p=Gsd879awHKRF5gY17e1VYo81Nd~52a;GZo6A#J)IjXpKe zsGF7?(p*jf09yt?vSlFHtfc|p@Ze`oJnRWJGD~c-pUHsy&t=Z!5WeccuU&b_0;BiI-yjR1%d>ED8j_mYS2oZ& zsRk|_TUlWXivS)r9{9>Tvrr8{tF-+AP2UdH2_d3_&~cLql61$qvqMvk0NCQa*b(kB zYE%of#vR#0V#+(CAnzzx>_T&gevG*(u=m>e87vPx6q>Z1pQuQ7p-D5y0wf;v7NPLl z8o)8YA;8vyoxHb?vh&Nm9yS4(9zS2@L6>jB$zCei`Bk!H=O;XpU8oMb(Ae!lQQw7} z-%9w&Ja|H*l{o{d76A~!E$~K%Z2;;VHZ`oCI z2P4&|@DG)a8bZPlC0;R)kT3usnr&ITx0?e4Vb4HFciH~H#AiEH^GzaRAW-A2pxFL*E^4L(56n+6}2Zu0vaE5VoN>g#`!?y7MNa$L7zH zuoB@xFMybgqqwpsAaDf3L!tPD6^}&2h2!?tajIYw z3Kb+o^tPG6vSZ^Xl@hISuol>2$05MZ1IydSFFq%>*s%@3JBJdu30?LkG+zQ;6-uDN zHh|7Kg!}BnefItlenBMJ`1vFND!P@6O=zw*p`Z!avJy6SXcHdmJ9aIJDBnUMvb7Pu zy`Oncv`Avl_wo*5V@XT2L)Cz- z$U;+-g`$uJNh7SZB(|)w3!s=Jq%fv#X_Tb1`8Z6{mcAnJvC}tEJ}qdOenCY{o&5zJ z4;lAikTwi}L&`u%7yyt+4lErh2U{#1DR&&{D(+xoQqpb85OJY&uOV5w$++Jv(z0m6 zH%YVSYjMj5Pxh~VFc22m?*Pn>1_%M@jsNxg2O|^<&RwKgb$?M0o@OOo)U;L1fnJ*B z-NnaiN=P6BAB4PMmkhvdasqmNF36j{H1$A@{2g{dD9{!^2?Zic0e7z)j?dS>_^&hY zqdqPCv1OegY$ok*AaRp~6!`hizkb&z$~Lk>N{}BF?dY*KlhnJ*Y~=l%*hWwK_cWSk ze|#4%-pLk#$Iip~^7PbB;k>5tK%WdAnRx-r0C`bXA=bYXUN59zf0*9Lwt=keTg1CJ zIzHXYUq9Br@Wnkf0~~(a$2acA*T4Vh{`RAKdtdyzT>j$r=7zt1{q5cGi#z)N`gKsD z^*`d}Z~XG|x3tFX-}rAgi;KX14~zd5j2qeibtq*1-@oBoN#JG*gN?T63MHD`=3R@i z0u(T@$7P_*AnDz!C)azh2SqwRqt$mKE5|y;gVi?u&_Wyu6^r{uBCeV4b}Dem(UniW zHCtqrgoIkSTPBOOU+<=Mq{IUoFRt`)m!K{B=^aADord;04datENCTo`xHQBygmD zfj-e%?J@h*dt^JGhQVf7zXfFB-dT8l7G5X|SEb>xA&27REylW}0f@OVb=Jp`Y#}@Md^ka@aEvwhV-XfeVEQVlkX zil!rzaduseefYB*;=jCA66XwnL92*>5p^HQxc9Q z_W-=*-`FOT(Gkw-mJ_conIvIGDhU%&NfJacX}_@h0wcjIO=50kkEI#W7B<(>T@y zFVTk;^(6MXB_1{&Hg*p0L-6G?thy(07!Jijx(&ulJC| zVO}Q=vzu`kTgPF16nkw!51RnGDh&xs-!8`y#U#^aualE-dB|w5p(N|-{#pJ{6km_y zq1~^$M--2jo|Y~0C_Z}4h*;|iXjTmHLF1sRA0NH8c^nk;J?JXy$UHE{PlLu`eZd3I z@ycWI(Q7_?;3Ir>_mFzPd&gQaup4fDGQ0|OeDq_ISW5>xos)%Rq~Si{1!L2_iI09} z(}T{5_XjRH#gK^@0Ne_bB?cHlM5bSwZX;{XQl67+%q@O#RuQP$6@k5KKOy1hg1-5 zXw7LHRQcne!EdlpGHj@4pu`K(0D6Qqu<^m`+rWUs1 zv)glu2(nGQ+r-f(|rhL}ytA|c?M z@{T}>jpumbA>M@Q92Cbr@TyRUH|lQj(2eimW1A;E2G|GK21p6Ef=yr`SfB496ZjN{ znjdCP%3CsMNnTJeZWjpiYQXHli<1oD#YkKjp9X#1d zhrb=;i)Eo5%|iZ$smC~|eaD$!$&77UQLxz`Ql-q7zbrHWnO_!;gSvK{d5N9CKuE%C zB;kg>N#O2o6_=Fzx-o2vIp=`EVJcz(Xa$DHOv#sEBd<721H?hGI!^s^a2&?^aT+9} zpfnw)UKKP>y{s9B!FrqqIVcT1cj{FrsO@T5rm^;JBGy&D+=Ve_95j~=^ejJ_5hs4?A`YWL z1D!*uOAie#UlPhq68hFK2#k|Z=fY@E7Uwt}%eG~o?G@uok_Lf0wuE6g7$>1m6(o8* zRh;;SUN6Ce&dI{#eYOhhDvgUADZw~iC&?sAA1DFEBmVFuRZ`;kMl+Bxm5?&UVnDyy z?*$o+z{LN+e|!*Q5*j0+pf2+y64`Co9ea-6METhLjpOM53V))1=uh;2|KI<2^!)3O zu}ue%G;N3fr!W2W1wd!6udmUce=g&7hOGH~9=FdYiua#?obS_@X)cD}{}VkQ)g+Vh zHVxi)0rmkl0nng(3NwxWf4`$Y-+uZdrUhv~EPWtNH4>6Q#q0Ax+dG@1E_|Dc_djqL zv>V#t?C=a4EWm*2`I@A~4fp)>)lVl1blI(XmX7TcaT@8w;kiC#jT*p-{AvJD-7;ZJ zw_d0r`lNfVqQSk_+_j}c%IDXzsBfqIFZ6(B<~diJ?Q+Ti*=K-SeEKk^?<3OAxnZx#RBlr=!S~EPvmk^P+fV>SkMAApj+qW z;tp@L|0|MuZg0%!%IEgrF7zjdBK+*8$k6HiI>cpQ$?9v|&-qgpeH;~zKlH=Me9 ztn(_X?~iqI(sF&QegD8efUcFhQ9xy|OwIXmzU9be{;+i{=Eq|h%Ja)(0i4d|aBlM3 z{K6m2xfss)BH-$R#>1k^E6w&U_)L%KN=Ipcmuo%!Mtg|SV_fYoiOSm-!o+<79x$Hs z5EF(|z7~YbFy33-YeX^Z*U4amp6-uvx-2vUL&f>FLPtr6X}sVu;x@fw3|-OF9LQrl z^=|r&DLJ(a(PJ1FhUjs=*Y|z)zkqUnSqgoK{%@^aqG~PiWa#0L%yXA3uHk{>P`UKmGUT|NYAGCXRH&`87u# z*2VDbs-`xQltel|M;?`j`jW0TfOOU|3A)A2gi3yYA63_J?}Udg0IkXf@_>HB0D^#r zjR&+h1_{9}rOQ{sG_dv&)RP065TZvh4$Cxl(IcO7ybxcWRNKG)2l{pcRW72VPZJ)_ zPxYPoo9`dhsjs4kWA0+m_n^n4u1g60NDojCHA<`|@5q;#J~#otun^C0&4b6!gP+i4S>Vft9At%lSQ-h*9GV}LEow*~b*>3sE;M!x0-k>}k z(#NuWOa>L3- zs9SDf0AQrNOSu$_09iw{&>bvVY|sV8o_4cemxeWaxf>x04_S)GnXcQpH%9wo{;QoD zpVql8qSyb!6hyD+J{bflXTR;)sDiK6W369n`~w_N4X0}py_TD0pEHqkOU)f5uSL3l zE%7;C^YPW(CcfrFK?lOotGl)G;q~gqLPL&M`LRIX_uu_~pHkEFfH&GCn^#(qevST{ ze0~3p;>9b3z3t)n8r{(Xps1#R0qqBpdVl2Tt&d4`|Jxt_@U7jQUYeI@1?Xz@hB$G# zO!XW8>W%dd`8SzmWlbLJDZp$>1#pLI9x{(PRr68U-WKc`<-O zO(!47#%xB6(COdDKJO~db_?CI-+92d2e_f-cNx2zIi4{>6AieifB@>5rsIDf`SAum z<~%Y)_rATB^98xwm&@5*@!all${!D;w0$BoP{r=;)ZOWY%1rX2(KOg^1Ee0(U4V^; zT9Fck`?`#|hBRxkFP=b#Fy4j3= z|MlaKKm7XfBVsO{Tc?)LG63lCkVO*zRORmAfh7*|(2U#$a0?h?nnz#ZAHaB%SPqyV z)}5l?n~^R_@WNCQw@Ev`lHB%H_BKrHxz27=)IjSc8?TYx^=pszyIg?_h`5d7d4 zHUm{R(rFAp51%3w1rORZXG~v=r1?@k<^Z~FDDDkg)kVkpnH$dTO@%R#UJ&t%?o?GB zt>WJsx1fa9tm43Sfgo|Omg_pt^o_@_bEREHf@KXI>bM@YLB)-gQqVmJUG+Gk1koK2 ztInNbZP6@*O1q{2jsYM)?s!xAIG=b9HzqR6xxW#&!Xvt3>@i;Yy=t3*H=5-w_g*#2 zLYw^es=ClMBEkE(zgH#wlQSy6J@RoPFo7ANkR$SG{u>LMip8kPa|VKWRk&B~iUAXo z?Jn9e;sNbVS&mh8MyHfleK9O}5houK?bV2zlYZAOQT94+w!frV!akZcdWc-7fpG;L zxkR#wKb|&(sU7LD)6+2k+YO`S?O-f0cNd^*Ikh(e^S&j}H$oLaXEz)zPaDliy#3S- zkuCM2hsY^0U^p=lLL2Y;Yx7`L1XOBAT(?YaEd|wd*a*sYrmF@Z8nWRF1YGpkYj8Dpw|+n`+@Ww`@v=Ec!ium;ClCS5h$aygknAxmgNGYPSd7j!{!P zy4_x1^Stk)|J?GXZqId_MYnaGkXe`LwhYbrbiVYY`f|x3&yXO16S{IaK~B0YmtNx> z1B!yTrJ2tBJh$nAVF#M2+cYly0QnBXs2lykaZ>U&KKtrfBCBuX!=2csdf>5}8%8>x zBBdLQ-!elEatvYvEsT1IJsdI*`vAKQU^1VWguJ@(-Xs2|dqO#myB*>1r7FiW4|cb4 z-p2-YlkAL&5VhY4*6Xs40`%c*0Em4>k5NRF*-1C!FjViumS=YqG^53!dF+@C=;Cka z9isn?r|;ufGwM`zbYp)TtL0WzCqQ|TiyP`zwtdUF9^pk>1&I~6LlZP3>R}ro5yW)O zK!c$;;nG)#fyi__KX3JAZuz0lPt-Dv%5LY!dcNdOzzYs9kABKuP+su6z~?UTOIX&D zO>XV2l?LdoU2Jj(;AkT@`cFHruKU4pXmD$1bU7HG6Gpn#G(bykz=XEbvO1QTb~=sQ z9Y1S(t)^>Lp<)Q>S4u!zlDAgFciwZTX>PcUnggXN=y}Ey+D^~uxS}F@9=#hG8-TsY|5V=2k(DxIBL&-55 zQ|bu%Rv2OA`kqDM=;Qg;=HvJnnRB^ZYDKqZDI3}?zMY!>(Qj5j7R$x-CWjY~%{0p`METHq|P9Vk^l)E2SP;FNADX1hIkD zoqDnv+gm*>2sv*(^kvOPt48x!a7c$r@$^;2s)vBpD2e_x9N#uSO6ql1Sd5PGcJV=fl^} zzy12pcZ@*+(Da>0r_=gY+G(J&I*$iJfsfG=oVLvypgZ-j3xI4xRiVQ_!o^WkCE+Nt z^gk517B*xRRZKf$C^{^hH5#X1eIfhE<-M$Z^e)g3wy47YR>MA=jVg{CHZfZx3#sI==;q&0kWprB1sUbK z)#dD6AmLOGy;*l@r}p7QuB05`IyyQ>kugXt#--`OlYMgfgkcojBC;8gRH~M(MbasbN67n1{x<}zqq_{>7sudRv``| z?&HiK7``RCYJix90T1X>UAUwKq7XV0ibtWRwZ%Bmkcg*UfRvD{k6Qt=aOXOCzsA)(+a7Hpw~Y*PtrpdUH1 z^W4@95v5=Vr#DeM@zeji{qK^DHEmPf~tNCLQw41iOU54%0Ud)~m17dZxb0U$?a zq8g)|l8`^}PxSrw&+mT!{qytFZ#^Pgj$)65!JJNg|NYmGa`3rm-ea0Q3=M!yz}$L3 zQw*q<2ZnT>Aloh+3_La8x!k6zA0e46s74HcX~8I*(~urh5Bq}$lwbpN#sJ#383>)) zKR}tYyeqLwbumacJlR);W$iUqCiF-yFXyb`oeAkW210vH^sI~h1)ZCz-r^0`x_;O( zX29_%z}St~=ha*~r2cPzqGc}X)4fN&Ob_-Gr*=SZ`F(oyT1iFpE5^jtD}b%e+7USO zF&H#$PvEFG#btOrC+87^CI=%Z#8lc3#hCrp{G@I1*{AX0??0|f4T(U&{e=d61pr=s zOF-vPG=ytYtut;r4rNp6*(0Cr1i7ZnKxaqE+(YUi6P&uSWG42Y8lv%pPu>~vzx_laIO7oAgZc5J-zGzh;Z z_@`=Up}X*n?zQ?z!@h4%c<(J;r?@iCdD~{S-VN+7o0YqP&j9gXr zRQb7@`Jxq?uZpRw+`Q_I9Y!;{vmo)1Yz^!xIwM^k1|#d345P8n_a@SG+3-YuLV6<3 zy zxQ#T38~2;&JBk(MC?30BHTy@<6eNI7ZFT74t}UN>J*~rj?;+g;NIjrH;f^Jxql$6k zGPAe<8a$erfrff!sUC+1>ftEpyjy9dZEb-n%)=8luv zfKh`1K>zR=3sT1d;GgLG=T9F$|NQwk#y}8e;S!{Y2Yl=A1{)uv4}iX!OY{6^wr@i> z*yn1}x9--C&eJ(?xac24JCSmxeW6Q>3}K%!wiTL4zE(4>hm<*6on3$6=|!_%?kgaF z9B4L#pk-!&^l||59?TSL>H~*{X18C`HTpiho4fPp=Jlt?H>8#xh|?oZ?53%|L#$i6 z{81p?(b6vH+*mQ%Ww!RCg@{5o+5k7nnL7!>6jIgBG&xrh=1Q$uJ2!dDcY(}3H>_f*4G9};4j30yu|?IaJ#qOr5oo-t{rqa` z35&9XP5ANPVYl;ulfM(L?rt$nfO_5DE{AnegDsozkd6LF_&s#b~dj`k{yu527;dC$)#Bz3)ps1$4Nj16SeJJD+MDGEs+G91|OG72LMzb=8%9nB-m~| zWC2+24Z_K3IFy8#n3uP<#!Q%(X{cx6b(|LiPFE64$N;oxyoZ2v5+W?sfIx6AX%~{a zGEXWs01gxgl}4)ocN$q(no0|&1`DetfeVx($AuYyX442OCkYADI9_Ih;<6W@@n5+7 zOg3|oBs9Kyjp}8s-ar{!T{*pvtp0FyUza}^GY;KDMFm(Q;|aq`TabW$M4xQHwQT}d z=>@3rlfj@jt~%LeBvdDR+GVhUP+h{yoLBlh1EBREB+39)1}vecakLyc`HaV{ii_@g za(%TApa<3*HxX#m^Qx1oWXCFjvE^D;%ItDvX(w1?+Ef^)*@KJG*~5wk-QAEFavc$n zw_FJP4ye=vAsz$N%Ai~tqx_+AQtgiZWs=FhHtIyL1OT`ODUc-IxZ(1^a3A+JVicM| zD>sf4muxT_cR<&{d%C^B>H7b*VtL9R&9I&c&5&;EJo;W=t_htYF4gNIHJ0yy_v3J5 z3|oD^XayMrBhsFI621@KYgS7vYoMo%LC!VfMV%&dQov$cQDcho@*5g?{SVITV>DI? zBxxBHe0M>J(R*^TZJ_o^`Zq?Fcn;9%Xr-e>uKc!yYN;rwa;=q$MudL69OFRoo>Xx1 zhT!CTo`CTlV+KDa)=y8H7{?8xdd#YN4lA2j)M09B5a@`M zX+^8fRcb&f&*uV0F|&(i_Ev+*!`PO{SAsq)fDPLB5AT2Z?br9;BIc;iRY;-|ODdHW zKt5q0$+y)=2s!cHJ*iiMTyl>N8Fz2%#dGgUPbV$~8nT24I4Bjcr4}UNP#j|7LjYu) zd&S6R>K~-zNw4ovw>u8a+yV)aQW^l?ozKPpWyBcdq%*#t%3wq_)-@6hfkWTNO%V6_ zKAasxAaICV2^@X4vxpB8qTR$b{6m0@P_|st2Y9It&`ZQ}oEzLRX1uWb%BhS?8z@pG z7CAGCqJOo17brH;9DkrB(BUnP(w@;a#7PdLonTIu0?^)1?2kMVyaJ3TJql73yHYot zoj-J%x$-9p_jD#}yWS?}7V7V*^G9PQbryna^xW=Z(-;_%prM$M;Q*Ck&6K{pL`tEL zp}JtfTVKWp)dtyHMuV>n5!fILL|~CjY2n%{`zfd(w9y<@8xCqI+=xosbIDii;BE@UT2r1B@*e!2mId z0=KYqok4={_-!4enZua6ohqG9Ppt;-VRy=l11X^8U%8VH0AjdE#F6JzIUNKx-FRZKUslDPj!A<(d@Y<~gjXpV` zaLNE9K)uxN#=Jxqj1ml}sG3G7E)V=8;9x^AQw%1IbZ$Us7nNRuDnxOSmjeQ)#_eoZ zkNo&@$vg*mi>U(~0{D+9w)_w>E?-d$_@;RWL2?&>7W6zaIXOlh1K&M|NO7M$sALmT z=Jod5zvnfLzAfwH#_7))&3{|+afo7Hy=PSUP(206UogSX(asBJud63uT8o9VtRP4p z`ZyxAfQu8;vRd@*``2H;eEIN|G3~YB$Kf3FiFqP`{D_VKNIfsbp+B~>ii`9}0um~W zVN*dn`(tRAS=|kM6Qdt&_XNmTJOE;Sp?f$gV;XR7iGYqU6JRu?n?eLQ=sB+BGCSa) znNLmvL#Xcry*(J9DoNlvIpBJyilB%CcfnOWT-SV|RbAr>0rd(9)nJ874pipD?hP{|%g@TK&W^cmX}0(Zf+WP~agbTp z#h*?Tls?$T?-jnruK|ALc#CTop6ddJ8JNs+^+z9w&<#Su~Xh z+eAm`DzzJKqFC-hCDlzPQgO62`k0cVNkY*%yDA?$yGlCf1e380^qy0)w|5!BLkDU< z3r^Nhxwlqp1@J5_S^S&zy0{`>yL_x)2%L}q^dWfCaeEn_(><+0RyCmH%bC& z%adp79}>|s>#a@A$X%M128$)&qvigWZx~ z7l7a4I<1;F13)5;6N8J2HR;5Ol<1qV@<&gHqX%|}0?M5R;hb186{iLx%0?ZhqGm~& zDuA90tf43I7Dj590hb4*FqG}fqi`P5jRz$db;<_6z?StL=@ld)25t5g3DC&oivKI? zuPp@UQ8Pzc^s)p}xx`Mxuve*SO>Y@+snpqATS{M@JL9fxHT=A@xVO_vNY7R7Y2E}# zJmA~x|3Ve;w;$2BFTeiy;p?Y&zxgvLLkK9rUE88k6K9T~&H)Yq_^r{8P`D&j<>RpP zpbt~Y1(bomQNdMsG~NCa;J4*lh5nx%GsayL9WoFu8bK25oRZ76{Fd%MSeBx}X*Iqg zIkxczsfSBHV$^*PzpM%H?7=>yk>K*!ZUe*~HsMejVv=x9>|-F6T8b_bCjjUp`Bl)W zSn)=|Z`1)^9ppZ>kEBKg&ru~7?>|1OuCLAVB3^fJksjG}mY6(f& z+VRbkMJekAPBBC2V|v%l)k@O5|0J?j5pZ_?w65l&FM&>O0dwKdfhXy9!ymqL7^iWf zrp>qU$_Y}Y8~t^~Ce9%CpdvU9j}H*~X7%FuVWWNk_09-`CLjSVgP>3`CnR?AY2*SA zAxG^5aLB=iN1zAd|2H-XT&dy8sla(?r;#}cIg6VJJy7k9F1Ij_ObskUy0)QO3!$9G zf>5Gn9u9$acq>k9P@2%Q(J4uS!9N%%dT>e~Km~8Sj3y_H^3{Xr?b30?vYOah_s85>S&_h3lqiVcG_PvcfP)-x1#{h3J)ZzUmRLThK zxeQn|^6EkF1oP;w^NQYc9@hCp9qD-(@AKd;0`@I}ntLA;Lp3P_SNsyij8`f{8Tgn> zTX{eNHhbZzVucw--3riO@fcLJflBOI>OpsEIXIjH@J>?3BAn3Q@|C#HSq;sAHt2Ch z$27R-b7X5UxK{>(iQ;_DRZSwm@B88_R+_vR97m2kE51v)3gFY&bK0seJRoV`dcGQG zfvDa1IFFSl_N~3%HZ`y`1rwTODK=}XQf7P@M z?S+6b9;B6TpFaHj%ZGPAG6rwa@ftLbweA8ar<;MwZO?hzwl`4u=~Ys7h;w*%f@!%4 zbf}Z+6yC5K?}H@1ZZx&6Z{7G^8~zbfX?<$u)}fNshc4_SegeiYQwF{a<8pi>WX`vM zjO@AN?_pS3-goNZHU<)#2$nJ`+OsW1o88b#J)pXpR0`5EI6!;V2swIfe7nv)E0e@K z_n=&td17PMxf@2zEOebzkSc*6YZy_mAek8GDa2X(8jy5d+;c1`3wEx&xHB`y<$c3~ z(IuxiVQsxUY<~BR2y9zU0a8NQ-q2xv6R<)7ocun5{G%@r-!vC-Sv#qi6S{&G>oTIn zD^bEBuk$bAin^M4;McflEtzuQg&G;BMqmRg116-pa(02h`ou%d{(9PMa3|NxN)LWs zs9h~DacG1t2gvI!U+}PzQs{i4M;o@yXMFzYg4?yvr}W9@_EmoYH+Nat6|}4Y63jeB z-+ul6%g4`@^V@lT%$(F{=l0s_vYD19@TL&xR_?MV*r29G2eNY31+5H5)_m%~rNEAG zVn-!#9s8YjD5=*$C@M|QwfzcVd?euScxC6-_Wv`pej&E4!0(JbKtHoZJY$#?DD(m6_7qmBMb0LNQ^Vj$PWK>CwWk4|&uN3ca!gb{qly7ZuI2?9(RU@wb z(3dFpBLVUTk|r)}G$+If_GY|uIF*Pvd9Ap$ z4<-wp1V_zHf0`uLHs^VNXz-z$_PLI15CB8F@ILJ=ce!GaV6F}TFjTt=q)r3C&2Ktq z!V_Y`mDV8etk9z%E$zwmy56=x)4mO^8w9yy9ih<$RpF*>ENu>G+0Ub)$>iXeu&}XT-Wz-j|xbI$f>~eqW zR*E5jYN7fn;VRLNAPJ>G_eV1mXc3>AQ_dLoz|(n-dmY9npM|lNMnW_!QC?R9KK`Ub zXrFfn51XBULW_Y@kyc~Ne+;FY2jW&HmIOBp$A%Y%x@>K`DFp>Fa0I ziEj-R2=pbLAHjm~B}yggf<{;Ay)+VY0Tov{NEF%i3XS!gjXN<2Chn>r436r-q|>7s zJovLul9>dSHkxvn0~|bPq#`Oh7f##nJZP>{#OWfzCiRdW_<8{UR-ibX9qXhVh?ce4 z9rpC56wRl~cX6lv>Fn4XooESfhwQDMuHQ6xh3e6dD@EDr^|7ce0L)HZB#0x8$*8^B zL7RsMKnidIl$8tN^`TM(usp0@Z)mqh0%zkd(YFu(wZDuSxxOqY*GVT`D4i0hXr+hI z@`Yk@DXanF9sPdJe6O*DI6^ssKL+=3M(r>PAl6FH1mo7>)I3&$j59RUQgkgF1Jr;A zb&=-iTeZ9^76>+9xL#6mwP0Wa!ck$tg%&{7u}%OSHQr|~C32;HRxihiRIdCD=-$2o zAcgA?V88RAJ<@Nu{R^|dFnzBfUC7TqPxNt+UwV-epFiP@^cpoI&rRaM%+5l~1ntcrC~TS%x> z*bCgkL^h8elq`boU5pF>w=CRc0+<;DSE}U@^p`|YZ}Gs ze}-sVtiJay*51|u0XdpT0(Y3=u>hMuWWU99T~_L96w}yoy8j#QLengW8GXl4jLUMS zKun`KL}N6F(?MLz|n*w9rKQz8EP`7#7S?xTK_7V0h!STs0`|wg`Apg%VJSg zaj}!!`n0>E1AJB_!UuR575^;bb6bqhN16>*T7OZv}y!Q00M(<81h-qx7_e zwSop`90YoVfp_3a0kf<*Y<4R@R8BL>F%CKEVX$wdaU7y3r!p?!TAfC=cLn>~X~%Y; z;I>0HxdcZku}C+&9cONec)ChGsEA{H5ya#eIK*tjFaov7Z1?CNrX}L;ZZ0{Q<8EE$ zjxnL)it#KOw5+c!H@a@ULCzit7}~TbnFLMyL-=M8Of)-bFc%&;ye5?HaUF78XspO2 zKAi|NcRLEuv`;)oRh+3?__g#HWCCZ&-2AxMMl#@fskW@3Zf+O^7;4IAr+zpYwH0x< zzK6qG6cuw&A4`>YH@jiv`ifsg<5}E8o416XO(wHox{Ngi6D@o_*x@?r-mu^UPMWcF z=q%Jlxv5->LN_Q!$c+~g*8=T2H*47%VC@&6(L^aBuPF9_a@u4f(AT-Z=3w0w?R}95 zFw`PoxVxpV-q~vr9^NSPWb*`arPhvu7Wrr(MfJ=$fYU#Q()|@_hRh9Dmv_2JH=@6L z3foId8ycWfPCZb7SNiOn*mT$cOakwc3rK>R81M z_yzhIG7WofPXW|p8QQX@v1)^n#VwlpcU)(&8fxT0Wt(6Roy}|uX{fja1JGa6b*7ax z4?6u?l`32mFgf0$8$QWDg!Bi!Q0sbS5mkcrdZE&Ezg(ZA;3`GA>nuf%y99NTiw~6J zTz8{_wlayPfR|T%txme5jOiZpS{Z2Of@-4WxhBxKWG0w~cCq~Ks@`6&(-%lQbvnjg z@?pS_E<&MTN-0$6B{013ci?W{2{OCKy6~X-K;SHdfO5Jmx$?zY4pI5wX2G4d0nz~B z5T`5%F(-Nj2Y)E0bZ-#O*@i=#Lx2#YW{i-AtGJqH@D>x!Nx}`|a36{t?sPZN&7IKq zsam4#q0sg1-A|u?`~07Gh^f&sDT`{1EGQsrgdr75^tlWKbO~zzQ3OUcb=**za)9r0 zHF1LKzIFzdojIo`Hy)72ZxA}1)FzyxP9Z-ZatR%2&?R$aheVtQKc#!EzZGzG{AoJwxmi$~RPLyaE-9yS5P zMb`Qn#{wJf0&J%O;bMT{cTrWZq(K`lCuxPDO#oDq4>X4P`u6MXK=k$Bzy0{}W5%Qm zG|;sWY&$Fjd%F?I4EIgz>C|$6h2L$>8?k{N8$!!K(AF9OT56t?bHb)1Kz?#hG#kW% z^Bw@|Q}gs(opLlSk0GBn$cg24*ku`G?7wK5Uy)G z0reEk>NFR0Sh~yj^3y~a7ZSnx;PaHT#!{~4+LGI9M>TI63pe|q=Z_g~*z)SRXM;FxR-s6`{- zjEO)}RiI6v{XvBGWD;onZGe-$Vx01wD#{$NpuK(wdhTGiAxvTWR{4t^_3VLFK)|wV zka*B1Yi#Oi8c(a%a0G8L)Y$=GJk5WAkSn0!n@w}b?=sdgVNv`w0CWn(fHjr5)f zvKK;I{Y(3r2((EN&{Fd*F|xNtom}QQz}Z7rd1#mMjRN!@T)2$QtU==85Mp*AW*cI* znTJgPHcEnY8zA0T=aU$RB78&bQNLnF>Mu$e)Dz(d7-HdgRv|U|1e!=>r4= z;1pS`n$8#8;I1n#=knZ~2T>v8D$}{0@<(^(T~4)(GEHZP5;Ec}nzP9{*dxhCCun)* zoDc-qoDso#3k(4nBH4`KyeCz(_?K`R)sz7=u_67el2eQFWin}XnJ>^@E*z8q&KIXb ziE6-1XVj^o5tQgFL1pOw1sEMyMpO@;+VWJVjyw&s5C^e_;^xWWrYM#PL&gAC-l_j`KS`r z(85Ps5+DUZ^qLxcr5Ya=-=wJvnx4nkY&acC$)SF@g-$7^`gPH!_^C!8CyyJTnmgBV zdQB7bY={7wF!ZnuurV-MpdQZ6N-I5}e;~tX(8qo@!+C9Lr(1$u{UDsQKO0b&^#lL& z=i+}>NQ6nY4TP+yPx(+^c;eT(x-a+pb~#PeX+h(Mn-ukw1B&OVDxNG$b#Yo6jDDwj zpJlrpQd>P8L-e(xO-D_z1;jx!Qz)qJ%vJ$wwLrNeitSkWxS&*5oE?DtH&JEW=LKhd zA(a!TyT_ZOdPog%GSmG!)}99Lo+XvsA`Rf=@GNkXlstgNTG6WmcZ!ylh^cDL79O#w zuKbj?SGvLr36c;)xKgA4LO|(N3ra&NYH>I_SvWoiA{TYP2qy~DB*$%VO!imW{82IF z%w~!1_UngFoVWdom~PaB*HoRUT*sR>G}H7Xb}V07rHU z6~#AxaRK`W0+pZ%u40X@PWZxu3QMKFZxReS6>*4paXH&jjI7u!R8?V}W>s=Ina?S2 zGX$qfM9ZH7s_78sk;V-S{B@vs7a$g(PSX0zS3_oU2|1Ldl%rL7zaUj5y9Zijmac}V zFrYN1(+BrjvFoci^iOpAc0x`H3d{7e%^&*8>L_$sjiBe&(xL#ABbqG%+hGE?4C+4U ziECY+bFYp;*X@)U9K0@i&rSJI$t)8synp4)@ni`ornOzPTM;}`k(n^)1Cu(MP$M*) zGa^*i#i~=@P8>!7P<51jdDT7GOcJ_wR18}2Mu5>e3#gl9?Gm6}Nd%e`(roWn&y4Jr zWm*LTZ6AF7@b2TMcRzmp^+(0E%i|DWA7CSpPB)-@^zEwvZ;BB%i7IN8SPE)B^1X_G zv^5K4QRI+2k^gy9GZ6AuYsx^E%T#+{QOMaQ6^uzR4yM52p0}zTX95jxvRXUZfMJK= z?#oE!CjeIpM?xuk45Etjq|!&dQ!FA-6=ZU2#~{Gq125o~o`HY?GrL~5VDz%6bL9UK z>)Pn6o3Cj32F3v@L4&a@%A!Nt!3k0tcw9L#B1?}~eg`Tf6l|^BHN*IY2_M&PtG8nz zpWlGR%P0u2k|IO8%o^cn9yefswO!>_+Fidr}m0X6NJ2H=f)dL3~B8}GSJDx?NU>_M$4XN1&v z0yN_|xy$OWLU~?ij(!*Wp=QjTtGT&zV?EF@09r0U^R{vbFbN>~%#oRJQdeZO31H7^ zsU@O2P)Up#BQqx4Q%0IgXdSVyz`)*%ZCp$16ib zH}uQHe3M20(vMY+dtN-N$b=uLc>bJ&k9)a$Xa)~l?ld}N0nz~BzWZZ|?XGn0l}x%tokD$i^Q1h?GNi(tkNnr3?ampgSBcqPzof`i_H+{@a|8g&35 zDPdGC;M^a9Hn{{Evl0rb!~ibbkw`!v%!jNk_t-I}TB^2Zcft$I>_{Z5HuLoGAdQHZ z)p0{)8i0?M(c0B8S-=wGXPIbGPbGY0N2b5$?RipyVK%;OE| z<;6S^5>otQ;4}8cx##nKpJ&KI|N1L>d_Dc=$3KwQ)!mizv%tZs=16af(E+?v_3nNf z@rLgCI^Xec^e^}4>$m%d5}#FZdbTr%fCgoCe<9JePU3-8NPxb;!&^)^$A7AS`5%m( zA?VZu6-V|ZogRx+D+xXT9(cWEsWzt!?MV{;1G?mi zljig_jjj)hmUgx-`b|oCRR= zPqauL@h%-jf+qVwOha( z&b0*DTw;EG@l5Nofo1#HpOlY*bhDF;kK@F;W&eSgnj6;fS-%AIku7I=$>mB#0sw{{ zb~Kk`A%Yn?0y!#J0b27%0JyoOItEC1gLZty}d$FN!9;4A+H{0lfwAK znJAC#5mO^a26m%Zpxodq8OWurx}cP?LAQ69Vc~bsaz5;`Bktq4dk8_4Bo$d z{qW{`$AHU2 zZ{RRQ6-eH@qK?&cs&pM?Sj!3IqL}vdOh2ELa{-5a_xQW2vROuWl%JgQNhQ{R5|PQ$YsohH&Qv(i-5{;CE))PE3%xooGLZ^V@G4Jv?;*<&rXkm z{50y}-6+*)f_BOPx`&p%NSrwoKq4y%tuM_a?n}Q)3sB3cZy3KJMviZo{e`K=B!EB2 z-JPu^zb&{`SioJ529`YA-AC|s=Q4J3odBx12_wKEfW6nn;Tqk&U1?$Y>5<|bfV(A` znJxZ8QZ~4b9#D6_jOP4~F~eNxgSXw~+z&Y^WdKyH->kjmJa)s%Eb=p9*RgO7jo@DU z@u8{xYfpv4wuruT4|DhV<>Mb8zkN?O0q~;u2;-b1ufBZz_xI03yIPdwn-2ZFzGG(= zVFdI9Cy+gvwm*Ao=q7x1SkPag7H+ z8|mz&S{ewQ3EfPuCxn)Pa6%u>r(G&-5*IPxRZau9(<0{7Rg1yNWa_qB7zi|Ye=$&X zZCU^HRL<8R@4vK#O|x-=Ub+kfEsb8aN3`k)TqWWm*E{=S7_)bLMDyoTyxV0z9sfi< zXdYBhX~xgS!GQJ)vuY_XU^im9i7|-16W4M(9MX3<8>2&i7{f*xwVBm z>}lPNLC|rAL!i%N5DVI?#HlYHJzRCCE`{JLNDSyO7J;d93xmK$BLJ%*^^2{2T#PN+{P;dOcLim4_QP5oHzcw+UWIzK){^`HmNbc35z>#5?lO%#LGdSHM& zDbq1xuMrJbcAn@b%lTqIZf#@GRjYxQSSs3*X8HmA+>w0VNerx1g{~p)S}h)2h~XsQ zmk-}ReEst7x9AI_zPQ1T4Wp*e#VLybK^;l8*d{ze$1MwZ!g|t(3`L8c!8=b*dt}LN z-|IYxqig|{7_L9j{T7W?5+Lr+HlE>-WNsCS0?BVu(Ra}@2jF{8737DDfU2O6i=JO% zAdwS_hdui`Lze2C5&jTlBFzI=e2v)Z7=&XiVgeR|>Pq9IOw@Sow7m0$lH1B^S`D)r z2-2t~k~BPI?cz)2_xWGBML-p`8cu6FYy&WN2QK55go;7H$ra|-P||R!0OJE)R^gUAXiByIZUBaDk$GftA8Ci_wy{a_HPtITHrE;H?keEIOxShjztx(#yt;?{+!Ck{ zgF{qDxlk&1H|=nXzP$U-uOEN?{2ODcj`Js1x6YLu%Md$x9w2BjoIqWz#8cxuRJyQ> z_ZvQ!9xHI@%e(JifBpRZo5hSv8bF1Tcu9O*ak)fa42}Wb4ndr=sFu%N^q0V_;&bO^ zZJ0v<6BX#K8*TU@dqeJN{^I$s*!1`pN>Y6LL8;LHNRDq;{_T`-LWZtFhhxshe|cx5 zV_KObyd{cP3R;y`r>b5Buyp;O=3Wv^#=X&tg-*S4=#|2?|Tw2A99mhdm+|-%fVwpwZRzUv4{b>5Y z6D=GupHLiXb4eiHZ)1a0>6+Y=Tb>B>rMd}vX$2cmpBay$chB#NDrmdt3IUp{n1puH zfWpzV4g}FJ@4o!{{+EA$WQ=(>6lfwBi1g==&u4+cat2V6EZgYwA79_Ef3({}6494^ zN?q#l&XEH8c}^O3Y%D~yU6zmv&dVM^d^MZGK&_*6g2U?~ck+arbT>YuYmmJk#B}cd z3@``4X9hqLSat-KVIG>yAP68|=T?R_#)S?GQ3ywxqvH06acO4__(yM$6F@W9j#tu# z78g%O+BBFUM2$0NzOon~S&L_vtwx3;ogLB2$Vi1jx)55`T5yg-^&jK>c6|K@ZbH2> zx{?5lLyz7-z-k7N>WPR#!{njzA{~F9#uIDsNaYp^-{XYmm5_T!E={jg;1PL$0D(Q= z`x~Ho8zg%V@izL5mZPiQcdezEKluIzNY!<Et|&{j7GsdOAqF6TcH z2Gg$$5&i3QBSvi6bUUqs2kw;?VaSEYeC8e-&O*{R!{?#e{7?V*uP6>z-LbU%dl2L&!dS6x{AX-lYgGoR;5>h=?C z95i0!vL_)pdJhJ0D-1JKkZuETj?7S-00O?9iFe!u#EW2Xyr6v`(2Bd`#cj#C!T^k+ zZ!MH6x;LoAk5rwgnJpX>mS+6LSP}3$D?z&ZCRow z=*rRz|9U{OiWQ}ik1m$cmdQxDRA)S;yFkp>V&UvLZeP%G`3Y}ZK<4Mvy+Dp!MM`SU zU4Iy&jJqr^UVA(_?J!{O&`2a>I%eZ$#0T* znuCHE4fkScM(QT_=%e93)wlR|IUu8lTUBPu1z7Yu^rfF@yBZG$~>YFN3rpYbd-+1$-5XTk^o?>hvIVRLTsVj$%M@EHv%r2P}&>7BHm=FyO?pd(b}iotU3@h3!?IuQJA(cL^eqjRM89?A zyMO=wM0q@4is5{!P$bTcZAu%?<#9U~s3q;QL8iHWzJMV`9Wdqtf1xJ{Cx&lF^E!c;poE>wD)nz|wLH1ji71dkvB>cd zy%uwjD(KkB8vMiluiDvi?_9qUWFt<1W37NC$iuZV2CT93$(3cs9qNuj0fBw5c<^hdp-s@2+*OW1atZd&^Bj+w)YUsiw40_h2l4ZgfVm{ zS`oNO6U`2e6|^s*IPS>Z5K_%q59}@EZVji=eLXcp6nR=bWNBW>ygPp3YL2@wG@#i& zK8+epCCVzt2-9UxSc+@Qw_Iqbsv}%c>`DSgm}x;^U)2z*>#fkqWmUgA0?m5Qf~w#0 zsY^bUr#V1RU?au1U$*-#dje{SJR6kFYN{Ck*JZ`%Bmj!P0n>bKmWE%Z;*=<>NX5SQR_e5LKcq3qh8 z+pmVgOSeNYo(3+K|MvdsUJ7v%PQ{1>hzPtp<0`@$vDE-0d+-mz|`w9fC%@gIm#-Jn-JqLFxpH>r)WGUkp6G)zW@69w|5_--y{$@K8?QV?BvFz0YSVAkn&{H>mCFSBQZ~h0M=v# z-v2FruV=^%q(Mu$*5Kg5?e&bVeLF{rxiN6pKF-p~Z@xDT)mka$4K;y2VS zgsEWVR5zhA8%Ub3%Uwk%-AmgN3O5}O9`t<(${$(?$x;vU;N>w3z`{zaE(1pIzfo1h1cC48^4b@X*Qa03%}01r;;c}&1D9*090{g(do@MSll^?Mu1#D8%# z#AuQ3Z13XqfWN1xe>`q_=l-E7j0CXQ7Kom1uUH4?fYlp00_PJGUNB=A4B4`OObb1T z0d!HX?-=hvR}=KD?mF(Jjgb_r`_R=wzyEV z4N*)#iMt96P$2-cW<9hdG)yt%;LT2@4H0xFqQ|ro6(>IZ``fSYX(*mC1r@UE%D7?P z6F847pj?CVfBE|P^C!kMQXEO%kWk1oeUA~NqkVnAwc$v_AWb|Z`vA=Nb-FkYXo^}H zeG-RAZJFv}Z)3?D&@?8~zIN1}4Sw^-qL+K>MOee>rd*(i;w2Mph>H8m_KL7jMhp1oL=E2^xpO@vr{b>C>UC+xV zCKTNy7(uADWj^soPD6@-9z6uQ!+t(ji;n8t(#%oXvo;zm^@ z*RGJ;44A=yVd1PxKQ0eerI<8Meu9cWT0e{qNZ>?foq9Tr9>NukEIIe%e7SLX9nd&B zx?#1J&Hsc?nO%EH@ny7C3EBVY^Vjb`zx(-vV$gGp24&U#MTDv4W-b9I|4HL>ygLB{ zp~rw(XSX>A>i}9{)yb!o%Tv94R@&t!+3WCt!uknP&zG1P&K=G4VSo{=sg2R3rp#*M zA7mvLSwvhX7ZhXR!RaJZ+oSg`8S53;_<(5kjzm|z9YFRag^jyk1i1SNsS+d>!;RGd z{5>!a#|xeE2^a)zb&Ne&%Bd%q1mGb#Rp+-K%+dF!&%b@=wm`*nY9XmYs9HjRSg((P z@ubLMY32Mrdc9fz>^<0JAxnQy zNM8sIcV|L`>*Yd>byZuypYEdJwEe1z?M5hv3|#DZT((;QCHIr)iq8^x&7^&RoxyNg z1?c5RLhFiWMQGadID2pgHX$OCxg`)Xnq4eDDjQ%lkbF@{alK-v>eA~C_$qD}eKJTC zgD0kfoZGnjc9hmY#5HoQllN4zpIA4fr3m>$#6TFR4d_9cGqCJk1ZdSx1}eM;b`CwK zbFvp{(T`uL$=Ih`E|OS$)eas8}^YtX&3<-9_7R z5WsZ!Q7NICb^%yF1aF6uqXEX8^icz*6i!Knw@i8nXOF6pzWCRQXQClVC7M zZ9P4V+pHNbcAOYT+=ab+PN*P&uLe11xP!My>e2S|;zPQd^PfsNAsjZ}IKw{P@zrX*HT70#J}lm4YEXn4-QE2Go);`&8_6D!NW&i4riU3{nqC zh@lKX4P`E!eB!now4zZT^e74I^wIvg%hCoRA_Oko@&Co0NVg* z017*v5Y^p$77(lpuR3Xy5V&&Bl*=RcJ-}IjCYUeU<;VnqON+as_5SA5qI1yD0@S||G&w#417c5;j)(u5J{J?OoQtlSC5-_zEsWv7+ftv8){V(r+`}KW9f8f`S zay7tYEhbv>d*ucOLCKjH`qq)5fxhhT%}W;()_Iz*gr$0A=Lje-=ZrwtSSx|r9oqmp zbd{kTz_2XWl)%nIcV;z0!}sH-|NUvZ`@ooXlpFx5qmxuu_IZK9X4DtAemQ2iyr7Z* z=PQb#o(^|B6kRHv(*bB_r9v-(MsIkwD4y?s`6kPVJuMk?&*qISZC}W`K9W$>)COeM z79|JF0;$okuoX1z!GTUutdvFw7+0|gD!6?WLZv5mDgerjQI8?Atnu`DlEeo}D(>lC z9XlfcL~z36W>Y)vF;qRJ3V`f7(WHblVSD%bYNHf79_FI(=l8fLQ~N-j11;a+o!EbO9@@Lmdv$X`c8_vo{DOS;}}Mga;q z+F7@D_jRfn)7}vxu4-xv7y;tcY*5|rI9c!(!^YnzoUTDXmqmM4Q9!y$>?F;CauR%; zAvNHyI28oZkqN}(CZYvJKjGc!*#ISJME}hZ?$E2QY|BnB)-+9=i9@rEb z#2%D68ZT~rk`hZ2x0n*7$Vr35`r4@h=u) z92E26)Gy=9P0t*G@Sw3#9GV^sim{O@K&BE1wD}`&bl%d_&d;#lc+jiUK?0juH?4U! z=n>09(;M`@sM&iFzL|z7Q|rUwk{ z$(qsc>2kK`!MkVo#uZxvyBuQ(8W;z?tXy>wXwOkkUnUp=>7HFk9sR{9QJs@GO7A8t zBY2g|m*M(jb+cU4%CkV5RC<~5R{fYRCz@R$xX$wDqD|U_&5ms_Kn6MpG800G51UN@ z-TCY!H#wT{vpi(in;Kj~j3&Yf9RG+$E(;Te@SfBR-Fui09`+$7O+8qS0b&nse+-a# z*lj$d+W=_*i8ey5IR!lYg}Z&gH}K`!+de0Bk6{*EvNYYKo1NuL%K`B*v2&<%hq7lJ;? zuwJY&7-YF>^rTP9E!C9eWF%h2jz(QLM+kv&kmtuKeS&0rL*Bm~XT6X@AakSHYp`@W|W9ia%? zN|F>owSd6sSb%!G#pBf9@H?MDh7gkvKa@}t-DjDuXoxI$g@h*00&I1 zRbH9J*ahH2%HF1v2?NK@w3Yj6C-*^EDzz=$fE(I-x+$Mm-MZ2+h#)s(pPcu6*K=dY z$!-Kt7L^#f#d^GH+V(UZ->7Z_@Ct&HJVIgsz)`%3>KMy8PRcv#)pAPG`QZtlTr{JV zMmD9^m=<#J7JzwClz93>r-v0-PXLM6wq{F{q=$67+p?a-OFYG>eBHBq zmi6N)DC)M3kc&lgLMz;@uT`IqoC)dH8|ngz8-RuzTVyLRrL|lD7tItiFI;L8XeT_N z(IRfQvU|Zd=+-MGw-&%vQVd>6PR6?lToeM}H0|0VsdE*$mS=a)$7mvtx4clwp8)O5 zJr0DE+<ZyKsC!#yld$Vz%tJK` zE}WkxoY8;_+PSxTH~P#3X*etG4s9yft3mKdBYK^Uyr z<2mnTK+}Q**#j{+Rd#FF-JL%_rDGn!Y;${N58Cj_Jp=&|JUBJUP)M3g3$FGFeys zail>Yz4C;%c()}OeAVSc0Xg9W#wkUUF)6zsa zKE=oJ^rbET1F5WH^*hOK3=?o_WqAhR2JWxo>Tl2Wn2(>|)0;u8m~FBZT;zaT)LBg> zxDvN4E;Qu|$Te?(LwTn~QOGRg^-h!3A3ts54b{%Oi~R>U+ut`LGz@^Ipm5KEbjcr& z`Q=nM=L;HxGuq-C3&yz^>fwykOT|O^M{>_qASunmE3m>Wl~Yd%_oHny%^^dA4>i+yn--V;))b-_Xg(8wM2VaOOJe&&L5q!h@ho#1xtfs+fpcuPxC?6*O}J`u)7I>b2wzDMyC z6ddFQK%O2$0a~h#Q0y-X(`hnmFEmR&s6s#`t9cAU!kto|IWR~GYG6mpB6c`7j|U^{ z*jRDZdT<%N5pts!>wDT+n??P?eY*~=DZtNu(%2i3OIQUq$WAg7ouraWJy`8?!(KqO zgl)rCREkhGD8N0$n)x0(Kz8}um(s3E9|H3Q7hGgp(TRH`1SM@e14_<55_Z>O!CO0g zED8YNP#>xlU(w#nqt>>529;J#wAZ$x5#OPOj5C$Iip#K(>v0SdsXgn@=j!+4i$ z(>&You(wEVUR}xqtmZdJJ>ZiXF2gTQ1~uDNbVyb$*Aa0~40mNM=q?N9BU%7NQ?o86 ze`$jp=eUTI`auH?^!B64N5=5|Y$UIKU1&iWME%`&0xh^8VVTp`n9o2;HeD1s(s$s^ z(-C>|bF-8^wa25^vt0J*GY*ZcyKOye1ny&JH|pXEaGtsMLO_%Ec;b}gVZsF==qjR@ zzUBMew6BAWK*N;|QV)>>W&i{4lhcQG&vsD~=_5|2&Rk%{!jZv&d555R6;B4r7R~8s zOF1}c(X1=a9g$UQ7J-KIzdF~I$GJtf3pGr2uV+XnO}pBVJ&Br`0QEytOhbdhbV40M zI>)qM4me7s8=wm#wn!Dk(<^fva^bb4v{zmacgtGkwH?sSyo)Sq3_=I_j!=$W`2uL~ zQmQkc19!EnieDy%mojHc8RY7t&<@YbiwChfsj`q%GfJ>Woa&`pl{}*7AhIwqZZAk z^5SNG{`G5UUUjeA_$~aXnfrRU!hk4Oi;|no&?`9hhKXLF4Qp$0`IBC5XbtNd(nI8NN6!T3*WS zxbu>x9#FmoN$h;|L4?qOnl%7-a|i~B!T8}qX27A&;*5FXP%XW_g2tgoMn}tuY(A&H zI}rr5=PGQG^^pjw-#>#OQJa@Z)P;-{%%UcZGMz(bnk_ScgJ&%0K&{g-c=Mqgf$!I{ zae|8+r-GbT(IBRv4c%^dV0NAcntH2VE`&*&yn3 zj?1nbf_;@~_v7Wk%`wc>ZwTT-RJ1zB3r8$ast9|oF(ok2f;6^Y9+Y=>A&-~SL>Fj$ z)CNiQt7`qojk)ucXCb+uTNtoSZE5<)Gw+%*NH zF+w-;Gv=nJ3X$N)xj^Gs%d1#=E(9YK5F{NS-|dMfO~(NsbH3_iyP~gs41PTCuF*W@ z!^hw_J@7#h(rn@`?(>2Q`AEH^6VnbLS>rgl{T>MPgs!Y9@F3c@L=qhV{emhys1sovSB2aiA8-T_msn z{oly_$3tq~MWi9^)hPqeJWL^&X=|521y_Rqg*%Ga!xC8jK=;V+r94j5tIixcb<+jW z0H}Kx#=0+#F{7ex&M1KdAN;bRBb3d)K^7h_QlS@c3oo5On_>Z#)JGj{OXCv!Xb?Fc zCvtLN`F-R96uf474rZBbN`F zamKx9PkYm`47}EeO2WCgREVu14A)129P{IUUfLFsw?0{uNpl1{6$pPDHqoQz-?HsuHHbf9?;pNs& zm(mBsJ;}3$^f(qYYkXuQN4WtYV=cACg77%L56xVm#QTR!Hfe7hWluMAAv@ukB$8WKu|hOd^_^_F5{D_ z_>b{xfMjgAZCe2=wpsDtX8UJwtgCajVH#I`U2~D^u|y+zJlzH5ecyI7v3!gNMs7(v zzz(uoiIntf{?T52nWd0M?&A6lZ?>KcO^W0^l98I ze)#QxRLqb28x}`&1W4!0;Ao`MF~X5@>XA!0IR*SO;f>XmSwuB;pZtl9}D_I;ZbubEG17c==;tH$ji+%G_&<25vvq-zFi z1t~aj^XAd5VqiY_wxHqY7c^ww&{O0fG|-e64G2u_v=C^4K7;J4_uE2MLe*VH2fgkr z%FDniwUChrdY${#Uq5xxj?E#yu~^tfF#}vEdvMa)qJWz*DOLdLLZ3?$R4GG$I`Ed44N$VmV z)j^tj2M61#4%K*g2@V&w+X$us%nr}fLFG?Z&CWwEXt`TZ zKrJtq;D_J8{`TRQPru2JHn9aMCwmT%P^gAG3x2pr_j3%d5%GxH-yqIB_)`!E93&n> z!rsObjfTQOs@pi%vKPeBvI;cbZjkRhY(1nN_~_Gl>H4z(Z{Pz@<#cHH94)RuD}T5Q zcd05SXxIqQUzi>QZgv(F`Y~k1CeT!kNSgwFxE#2}h4D;P@}rP7z3F{SUuC{rvvv%jaK$!&+Ph#naLbO^@<)Ks`h&9e}CcZkgC~ zLjeq7ns>!(pCAriPS4ThFWUG%oHc2Kr%(5~clIp7RPjVu&@WkM2XXEp^$-%8bGJ<# zWVwSha{%GnfxkG~dhi!VcDpUW5o#Xxp#6ia4}%|2Cx(iT39+bUS)f{a-3*vF1o6&6 z#8VS3W{v_nz<8%4G}5B^!!JKSfB72m_OawusJ(%v5rDn}YY~P9X~Yq$!*o1CUOp0> z;B=V4)bdJDKjScUqb8&TocR3#pq(l7S-2lbP@oDTjCaZqM&;}vjvO#g8N?p!6g$xZ zZXVVu>o}mwX2t%PTD_ANF1OsswMjvS~!v8yd4;5GW1}?}t|pJ>k^PHWaP} z6`D=I{DZ%tqyB1e@aH%)^aFv4h2+DHowiizqH9odZ!!n`AkHc&DG60^@KAXu1gbyqc&x+rRy2Pl!_nW(FO zXs7~-l|<8@F3W`vZ(C|163oqg=V9X^5wvY{5CC^Th`%&k>-K|SndF1A$M0{}BNDo% zpVQ_Iz(1KO1D8uT-RN12cT3q~{Fj*o5KFm*JUNC&sD?t#N&Q;hk);kOEj5aB3~BCA zFHshzDdM}fzX9i7_pkh3g2@de#ZFZ>qw1=1ut810d7g57Wf?{h^;8{-$3q);55;}y zI7AJgnxjqdLveq1omtfs_p+bs+yg!b-GNuX2?O20^USHbgM@6xg#aBT16DT%ymQfX zgI8*q}6NdxAhAB^~Fyo73e4^+<-W~>RQFIgQ{WX?-5GpP!n4T|x|g*}9Rp~Y4y z2y19Dgj8|48vym=JrbJ{+zUSaG4~YcJ!P!Ga%y@D9zD&`4eDUZ|xhgd|QFbZ$7jNJc37Jp#ze zoqE1#4#Pp>fq~ge83&=)I`%_RH!cVjSKRU%6c^Qz1WrFQCRSQWQIxFAj)b#^Y3w|p zFdA&UkKKNrR`VHIfr|Pji5w{6D%-D5X#2&UNG0KblIrY_1ki!`!SzxP+fANvV&I2- z`~Cav=8x}#L%g3ls&hSXJ!^)R^#@#>ZTRT08|i{i4@l$}Bu;<54-FzG;A(+|rnCAh zJAue^gzXlhAVC9L1a-R{qz<+_4;v5m92dwQ)qBZNW=M(!M4p)tvylZ%cL<)4xcZfP zSg4`6Um%lf@aYp*T>XRwoI}wkbjbjk9*P{CCI=8x4fZ_%Pa2S2dPp1{cOC;yC0kbj zYS%0Y`gv{Y85IZe^LXo#Yy@N@ey`Cc_+${tM+@Hwm9*}X$_?uGem)%A`{BBFhH-|7 z;*dG_w+L7oIG0jnS!SR;*8N+DzJFVl@9FJ2Mx-MT`I}e%c5CiovwNdAKYi}o!hRsc zgm%m4aT8!oFMsZQ8)wLOl9l@Na$3gX9Q4zzpaWcR0@Xu5t!W%F?%FyNd~yV@RaX91QFHE5hms0gDhiy?01t$&;c62pLg#i40cxh? zjp8?oJQfdWjBbKYKmYdp<>#jlKii4cKY&s|ZO9C%K+5LXgfL28vGCbSj@}L1}|!di;IJnmRFEX(M;qCI-uOpLQ8o9lscw=BemxM zcDQPqQ6XxZhd~$_Xyt+@gte9ePx^4%7;melnafM4nUc1k3C@T*vU8GLmtJpcOp*ROw>-|6m_Mc5J5kT}$YQ2(~*)u{0o7VByxY2K(`3^Zu`h6ab? z?twiLAr+zZZc*zhbwqYVnM+i&T)Zt(?cY|ZIx5@^s3BgBXpe-Da4?8!9k@e@aIqX^ zvlyH#Crc$Gfab5zx%f0}lf!R0-yJG7g8ul}w^58#!6ji_@>$1{>K_E0O_4{eo^pOGUasli7_CB`96M9|OYnle1 zTB`0xCDpgx@i2}ksqG&9&c`gM**m3Qd)I!JzTvJ^bS+RbwX$#3bDnSQ=HOG^XsccG zYy8_k4x-0bpVTj)#8J-ewe3*t1G@VmqEFHFCyBs4%~qB)IUV#8 zl>3Gtg>ZlqHECeA>bR z10#raaVc$>-DTc)+-Qm9S+&5Jz=c2#cDaLXYh5h00kXjpk#j(6?A}osr{s#l#nZIHKI=eAw>M5@*pKEfPyag zxZZ8ySGOX<$F3cluEhal#FYVF+k1JHn%QneZ5%g#8_S@Z)9iRbzok3N zP7@oV?%XTcgO9&{_+j(@!+XH{kH3aL;B%e%paA{cL2AJO^~7oc!1ch${iKo`(y8-h z!vfr`IR@G%~o(HQyr*_KmPLT^XKQUU*(f-@SZHFGe>23+7|5W0&q!AaIeA|qNLHL_NbIA2C& z5CgkxuBXnx9tuddiGyfkz#5sLakp+7?p($|SRWM&!89yV!q8DA8Wj=&PFnsU8+xQ6ns1mr@Cbk zKiu2naKOcfYkTL!f`9`$=!%N}?fee4`wxf1y*YBC_v7L7|2=E^ygS%mKvk8G*Y&zD z4|jK@yp3)t9btN?>fz)YS5|lEBc0II1|UD3nJ@;3PzZrH&aV-qi4(;F<@UU`kY9N) zEZY7_s@UNm)jbU!QUe#)4*>R^L~;SQ%sAKxOtF}yFh#W zK7RWCI3BGJ4q7PMkmyNavI*kzTvFT$QvN(9trt)R4| z18`$gSGN@;7gT=#Q~gi>Kgg2hy&cyV4VrZ2vAUdC5>Z zhH%Qdu$>E3l@RA41jGVu2I*unku8Wc!)rALQOmeO<|QgLp^bT}wBv#IUC^CQ!YySQ zYPW7#-BNEzb&PkS=DzU|M+Vl4f~1S5lae3w#Q^jDtZj3V9k6NoNU-n_LU$^3&@Z`% zI5SYgU(9E#bEyEbR!UHj$1ZZP%^XA?6oFJ!q=cN0TAs<>c{2YjT3k5#PStHOoALkv zyDfs6o1_F%7f;YWFo8w&?8Hle>DeQprq-j&G)V=8wr6(5`D`14L`_*5AUz*OYQ707 z`vi65MOHNx&Pu$2;*Dxx*G7P*J9m&Umd2?sFO(V4P3=pLQ)mvei&6*5!vbAi-z#)b zK5|f$W4@hWm<+T#LR7Q{hpAiynT(1gEv*JT7G3a8nqVN9d^BjxXVw!TkLbt{tBJ!`{PN0sTS z$hrA_VP($&eTnacem@Et%ifi#l;JWzR|L4VY~raBAEl1SCe7oJeWY}a&ha@5_K(}P zYc}^_e?N_~VZH?W+npvGM?haZYIJ+{h&jY#OTmmx7woU7>z1B=-~aym&!6_cehT(n ztaQaY9Ymhc`t2`Vw1=`4s1VPa4=7t4aFD0T~H}Uax>>ad-V`tkHA${&y6a?SK9V_UlmEl6lCX z=)yy+19j^aT{ywHy`c4;?O=Zx>V-e(rqQD~bn3?KAqnUoDB8q3)QS7$b*2;Kl;6Mq z`rj{7u(C&Gx@CjCUv^QLp%m{SuS>5vp{CIf)i~U92UwN{i3*sms0Ik5YL@-nKOS1| z0$Mct_Wj(S!v~etaSVAsC0jwwsun=)HN69^W(T${Gp~Rv^#L`yZus80p>C@^VVn@J zf}-vl2S^S8A6bl!_)UO4cX;fn%k0LvRS`mOz*_Stp(gd^TIxGu#fllmH5yoHj zBdo9XFxGqnsz*^@!~&FNCz`t>#&Xg2RAdjRFNFiGbkhFYCIP%m=a&WI_4of7zAnGD z-GBCf-mWjNKl~Ryb^3I!5i{opB-0WBJDW+>V2|#;x^MgGrq&#=q6!JOgh@6B2y}%0 z3?wx3*)B%kp3%wvY@z2+ry_Tb?7ek9z%xCMMOQl8}R215RlZCW~!!4jb)dcg)HKz@ZZZ3Zmct^7+Ge zpT2%{@bmYA=bxYd(lvFz-wU)ogP>i+0`v(0ZshQd2*>HzQAg$;xo}Uhd?lWWz4DL7 zlF|1-Nq_XqV?n$Ckf$JuIE)Aj)xYqn`Jy^=V%4cMs9V=LctiO%g=L|dh9DVnHEp$1 znZ0hgZ%99Pq5e^>8WCXWkz!=+E1lto>nLuLq8)l%5gMhfy;FfaB>5pjwrPN9c1& zxFyb9UavP$<$?XW14YnbKet2EwRj0yLzznfoKWZquMOMY;QRjC^y>u=7w}sI)P(>2 zr{BLm|N1NHj$VsR@l00Hn=PLxP4m1Bl~FgX0$TJEXmAjKT!(k;dlurcN7Q}#<&USI zfBr;vm|2;B8}JTUhp*I;Y^m`9bcV5}eq8a4j6y*Ab{$0bev|uv(y| zAE!9#u=4V4J>J(205!&PlZv!*$wor3>3ShmT&p=^z-N6 z-#^i(nod(BK+TT_b?eaH?+0XMGNhx{k`hN~IR@r?+IFMmtbKR5)$53Cv68PNQoUP< zm*&Vs?hf;KI36yfBQEU9b|mjLF3y$M=z<;Yhf>d~#=~5rLA@V>@86DShRrS6jvS1w zdb)PNABU{D45UxPU0#kTPegQ#9k4wSYfPoUmgnD8&dXaFKW55uGXs{Xt#ynxE@PF+*FCGk9OZ2SB?wr+xocP z#}WZ~r2@2TBU= zf9E>8eZz&)huMMNM?ingAdMX)i31jIgWLgUpg>g7To9;j2F0=&FH+hDIBO5|_suB% zPHM~>vs7>joN>CXgVTxENe3+JapAD_kb6i4+62FEXty9w9K>4>k%y4Lg@yc>exM_i z)wnRKo1@irjr|Gs)pb8#FPAmDZrBJ`-P)c)ys&HM=e=?j^Ua18zsFM~kbOF59DBlh*b<8!h%* zzE``iI6~E_L2p5E-+D+rP?#%_MX2CluZFQVU>zNiIMtUTw?mL?i(w*|!9S|}JWGtD z*3WUh5ZcSg<`+3gDwqIOU+5(>S3?#Cd;6xDS|u4cvqwWXm=3@1ag9m6f@1M7zj@_? znOYPH==bauU@lO!$5TN~JMmcrhT(K7lAPaiYPkPRfQTG<(W$8}Wn-YO8g;kyY`OqF z$E5d#G}TOkqAM8k!IpxhZ01n0LU7_m7o7$nGAHprOUr}wt?QWBY8(fbU zaYB4=z*H(r_olK$;-I7!o1H8Z?RUp&yQGMQt!?28_F1<%h^C4&_T@uF7pSgeT($S{aG$xhUZfu(nix*;0GqCCt^|lO$0G#n_C9p$3qHj_ zDnLBu^o5MqR%L*fo)6r8-(DV%dwHn^T2IwpUSB0Bwihm=KlX%j(z2lTGS7F~ege?k zT@-wG8OQtg=%=;>ci*TT(*i`)LO5zou|PkDoDn5xaT9^M9R-qE2~ylx5m}Ak6QoOE z)%8O)UrwQ(5`JGo(M^(6l3x~M~oc^+NXHG;2 zENB&%tmhsQ50PE1nNUATY;HGVtarF9Z;Imu`tpr>j^z;vM_ zph0RD1HSe|VYa+5vPNWF_p6(^;=H<#vRX%j=A|A&Ic8m)3#5YN4@f z0?pV7WVXgmpdZk?WMXWEU(qKBF)9i@K0KPMfy&pdJyD!hr zAAb2spV8RjeNsGk_mhHF&lJcFs!5>jK!kp&m5YJO&Uk)}gGfLN0=?ZyEcmJq&tE>h z_hI~0I2I4Sk;-|}6!$;<{Nv|OKhuZC5K9kR1N|6sp7Fbxd+L@- zJ{9eaIPj;G2HI}7c%sc-!^ZnHOI1X62m9UdJC#$<^hlC(k>RP+>y6gv3Fu_6E5S@f zk~qVO2uJO6>ltkTba4$P&QuYGrf3BkMyJ=pOZ@=SeQZD+Ez2LQq=+kdh_i2?J*D;a$t0td_jnxK|g12}$df0i$ zJR~0C+*7DG;>~-`#TuGlE$N4_&N7rlbml_EZH68!p(^a{1l?M4-ah#5moM)=efaPk zu==s;eBzp)<}5I+Q6egJ@QWl_G(2wKaQhF8-Z1}m?IwFeg~|}w)1#u#Vf=>Cx973} z^7!T%GNPts;b<6jlb&ZswH8k! z4cGEsYGK)dcU`0*@lN8Nol$`pxD%Cmmyq+t_!w*L0dxYkgfWR$;}#Dnz#4fP^&nR3 z3={`R85`)n>>Z$1(i7RBFmn>PVuC=UqP!nHn_;R5RPPcyK>g7U4T_;w;{sP}98ge8 z)!9@`#tA~ga?BF}E#U};XtYz-APxoEB4t8H!FQjZzJ8<;+wbUuSK28KH3ClB$!$QT z3XTk{_2CHGc%BG*x&ZxB)71u;D+qXOq<{SF%lq&C`uq`|r?IV(D#%kdg2fEy2zmFg z%aa#$PTT(RC{<7O*GAf5H6_4RQCzdJQol8UwdUFUG;B@4Rf%BF*+qhVJwSs=gqSl+ z0%o%BP(62OJLzLn|1H(daKghtb+jWwqfIITF7^><)Re>}1_FdA7ceOW8j=>My##2; zQ@{~Z0ZQTPfLzjBmKxs(FpjOo%INmlc=Eu9p$VdezVB$Nuluc=)i!FwL96TbS_fhf z?ieA18IJ*+#;KnLCoStG(GmLdabmRZ(LTgG0fgVhpr;6j@05nYwr^LHtO-a%f*Bby z2no%)aQzuzzHc&AOnu$c0V;~#sRtxyH?CKu6{zWC1Ko%i2UwX%9FmZXt9`!|)47F1jiz)3OG!X0OBO6$$S|+yma9iYRv}@316{1hk=;vR zP*Dso%plK)B4(hzFXa$H&Hgm-)l~Y0M zmpeI#2=; zJ$?E5>BI9^`fzK}Mo<-JHapbP!l5j{DE-lZlNk@eeLwy2>GNlKS*fJ9ma4hx^2VCS z;)N!(2qVIM_rN)`mZ}>ive2kKSNY1^<6XB2Vh0qvxhAAw{^webkuAJH@ikCu^mKfq zz&4Fj2rIi8wj zNs{Fo)M)9M7VA)Ik|eEKiii>Cml<`@95+dw2F;^k7i|F46T3-4bKiHb)u912oDy1s z=2csq-e5-KWyQZsLHwajYiG{nnEJ%JFbmvY>CYsaBk-#B;$rV zvne$>s0g@X8VtDkqgiO^cBuKtBSf@4L(p1Fi4GK6-+3ZTCAY#iRvcr&phvTF#OZuQ zCaSRt?FK6RX-*-V;8p}Sy%5gS#o_-CxXBTn2s}p?vrxr09QH&K16lC$Jy5@wque9)SZi*A^0R+co1MXvVAbp5P{K`aIt^1oZeI!!_IxLR&7+ z1e!H&z9J^anI^ZHl;dH#^SnTVQ^=0{69;b_?qZ}ZSpdp4g()LD$D#b)E>mFb$e)K~ z)-Y>w?;ju@*_LvYe$Um208?g%7Sz^STT^O2O>v!=Q@Ms<7{ zwnIal1fapTtxOGfAX1%VL%sOZSP&L<{~C1@Aj=78X}O^(9ldgZbgG!3MFsRdP;m?O z6Hx!!vR0)5RlYAo+f(0gIl4WBX6Kn#hm$Rw2J{-<4p?T8fQy61K+~iwDg6kMj-Zjv zW;kjO58zNAjwhQ%d;a|C@25YWe|rj^x##q1!KK1`h_&oaNGc!{rGz%%L~VUpoNi+t zX=@#z;rio{fP%zQ=5$u4Zp~QG2wl$x^r=~yF?!MJP=ySax!;!EMlkj)N`n^l@k^lHJUg5p%0a`eYbMc8K9nM@f1*X z>M=E4UvoGy&{8l?;5W8^aOYuTpbW7;HTydxuV%leb`hlN_urS_FXtbE=KJq9|M~03 zUGThbZrOTUlXc&1vU~9S-MjZszdqTc(Kya|hp?jSTU^i!X%xfEVKpZi>e@lHbAWpJ znbwUsl-<;3eK6ocb?utqIGKh?o;f^5;qLjvhfmKN7Vdf%mj+>p#`+vIZ2!4ztAUuP z3CyNaZr*#q+pGQB-w}$$iWnr-?-0lzuG2zs3 z@0JR-+C)fKoS$5i;MrlI5rdTt3}M-B9i*89wo8P$co=ZAgrGPq23vHq1yK}*|3YRt zopH%7Juo-pwc9$)P!$$Pzr4%PMZ7M^37g{F9ntM*vh(!VqFeDC-@iMj(Yv6Dn581z z`EARh$Dn>dOsc3>FsScb1BNL2fTL4i{eGtD+S(2x!G7p#oQ9P8@6G1lLCtBPKE-#} zw{EYkdG)QCzs5;?Lls?9VLB!Jnp++@9aux!)=UaPgZ_kM6UI4LU2u;$JdQFIQFC;V zLMVVb_hLcSK}xGH>KyTIROu8;I2f$W698&uZ-Nih!@Qtj{cssL2#W8coJ_~aGh^1egdwZ_uo3|h6cpkDU4mn#i8@rsJBUhFTRz(3CSe^@pUX%_U8 zW^{V?i1zuSwcH*CK|4WS0`%G-2q^oJp`B4-EyXz^UC~)P63$vv1K5|;s94WZ4$|*O zluJ8+1S8=3*_z7=rPU2oa^V)Bxv4g(=jSgUzi*oT^G5~ zl_Lmck32FLM|9xh;DhA3g<&F$4YQXJlBq$fW!T2(F*#yo=O}To-8ev}!hwHS?yt#0 z2TATBb`Wnp_~*p__RyaSeTYMaxYE8LKuKL-L46LhC}9qn?&E8?!Mmp0DAg@eo6j-9 zdb&{L-+I`1NIWRUJO&>?M;fmB@XPPte|-1LUpm*a8K|YzzeKn94GD;?b#?%u1dT_b z&FLSeFBkOAkhwpg8b;f~+vW)wpBK$1ZJhwnD92qO%?b!J0K{`|otHOI$8@o)4@<1GoF4Ek_v zX@jHFCc^sIR;c-;+jqSM^v|p_an^@%ZfC6|BjZ2(f(F@w0~}vvEdX%g zy2pWa66Doky|x|c@LFmqOMO7ss9jMZ9ncRca^%ee+7=E~0c_i8ePElzJl?2SK$4PI6wU1)0gM>zy0zB zo@bZ;`ZKyBGlLItsb>L030m05icVFU6M8Ma=iGz~4eb|3yEr#w7rmwpCjA(4+!4^P zT9<9qPagPc#AK~a{6uQ{H`u9$CvoXDAx=WOD2|iF?$nsVhyG;7hH3$N4F>KufIpS{ zQ=6?pVt0jc+mv{YmU<$a_EHkGdZ-9o>dDHb*Yed#uu>6`gN=v817Eh^H(DcAbJs_8 z8Tia*X$F=#)6Kye>jSNwsv_hreM@n`P@Dxe>qnwW34sJrK=X6M&7&kbK(U}R&6qAm zGfyOP@l!a{L7p5)R}_#*S0OY4eh0pk+x_vUJqWQn&M7>Zmx+ZkDL(c3O^Qjc;Y8p&vu_MCw*c67Sk0 z`oSI0_jGBG5V+uVn#-U4vJO#$?G-=!%c?pH;Y&7Ya?H^K{b2Nk^q~_idvN>&w?|WR^Zf8SQUTcbv%XJWWSS+S621 zA>9W+<$bKAHG}OZ6VR@fV8dFvG4rGXZ6^bqE+fT6bga}X*P=8ofd{lw{Pm%sk#IKZ z|Ad*tA%wlVxRTjNKta2ibwfOAjm467c3sG~v z*-MajXmyIPoD1syCbCr}94gBsO*z|DwTvGCsw3*-Bfg|+P9*^~axz&6WP^7y`gFr1m0n;@1u>?8Kijv026kgL9mckpV2f%$JU{*R z(Xtc#V#;U)E`X&@B&s_m*f1WKC2>I%l~s|Y$dFJ=gx1dbyKbz}eMIutm&@_k;NqHd z_;&=BO*jWC0W{-*1o+1ve-H^Q2UY7~JeIF_)X36^#DG;0MYzwaE+3|Ykxg5b3%sk7JgXa<*M3+!F-RolhFdY0sLgthCK5sHvfq#?0%2 z+6Sotl_ZVFg!(`kg`gk9YN`yZfRd>%;c?b-w3EI7FnV= zpJ}8#_)wg?vEisuF+TdevMC3|sgqK`dgwzzrQZ|*xfADHECS6&)5O`JrII4EK_K+e zG}4xQWW);us5U|e_98A!P95YM2QDPYef79t+dJ3ifP#i~99dg9KbZ zYk3ABGew}{!nL>r+0?2F?f|^tmD}nbcgfe~=b+ACc2Qj>>l%F6L`jzBFF~DFNf{S- zchcl})gUx+k&J1dH5)`V`n|g_L}`ecwF-|&@u-gLq)zLMsJ{S7zKHB^qo{Qhg(0=E z*WtLHl4S|1$6xP1x9Jd6_i^p|;s7WqLX8HHlnl6mT2P^Q3z%Z>3Hk4MboKgLE%mb8 zf{GgEY2z|@kG`_TxvR^{0*{vc{bl9MTtqJ_6c#je0u4%3)GWqDu+;_f6Bi)>hWk35 z36wx{19fRZ5U|4jAEi3i?)HZ=h>9j;NDii_UIJ(KXg6b!5kz{v(D;A6|V;B(OG zcR)+K@kPMy&V@^84baR1xNBj=Z37!=#M9--EtN<3)V22YRu@)V!$hch$ghBMiMMfX zzr zykF~57hy{p*QMRK2l4|L$>+7}c<_(xjqEH4Z1PJnKQsd3b z|FWX1<~wz~Y}xB1F9}4-YUaX!W}=ycTxhttzW+=$wbi_?5ccqOtUx%uE>Os+o8ZRQ zLc|$d0UMwdoeY0Kn2wwo28l5tV-^K#O2v=*Wun6?VQXW zB0*EFDW6P`&%vxR5%-gQI?$633$pqRURV2su~l(-ZUQ0I$rxo`pMU@9-S1!FGpt-Q zWnf_&kjog&zkL4X%hQKn=tCo{kzllB9QcwZtiof(uGT zYt<0Trb=OoMDH0o?}dxXxzNmoAq~d}Qspx|kQODYso=UH#tXGvDFj7jjnUYx=w!+| zi}-+c?LAcsaEE?G&8gMM<@fCN2i0(w^$h@IG}+zu1b{dL`O!cX%isl^VWMn12k!y( zTy*q77gaU?Frgn+Kc?nRu8zvt1U0n-I>XZ|PjT;H&)4)fE>8~LfBy8_FJC@=4YW|i zUeiqHjFND}>mbzo)&Le&St(VoO+-soi)`$Mzc= zaz?QlO!J)qR}~7%hH+M$wT-T#sGw0?1n0O8hy8-vMkA}kYr70Qb>OaWPMTG3N<^x|@qSychm~}S((RTG2Q~UJD|Jh(bGMFn^k{mj zLw+Ftz~7ou04r31$!>s3-3boSG&(h(`s0K9Il$-HB+7n#m_*)>XoM?1ibDmjuLO=1 z>&|_lxitYxE#jZn6wI%fte4YWAfBOZd*5AVb`$7xrm@HKLLB%18Vf=*{)?4n$3=L% z)Id+-5XvNRIe7ok+th|{FOkWSUD#_=m*CtupNd79Kod)X480IRLP?-AorbAVsQV}O z%q9dGtxFQ~YLhbvD8bB@-GndAbqd{G_7S_u3Uo!KyPQ|6I&Bzg1dV-eu6ZCv&|$>SO*0Du`>N(fN4VavN<{$2-vnVqVE{xE;}l{%(sRAtA*K_$rqz3v zRf?hBe|-M>+t0uMW?mdXa!`9<<=iz~fpZef==M+u6`m&tXgHcTbfA{;UX4dBwHkiG@f&ks5R zdcSx1T= zRg=UHqR2t0=;6}k$$><>PKIko6^i2Ig9@QTSzDulN*EeW9u!2>`pw?JwY4Ryt-MKHN_PJ^cQ+ZP%-KlD~AuVIU^2#aFniUh8pOV@h-bjlYKHn;6&2YLNn^6q&Th3__~DvHOWM-KxLQrsKa7DhLAEqYcp+G{l*2@@Tm zn@%(2RZf>RY-VZ3bmp@4%Ii=Da7yuB7;(b<{nKwxpFjQlB%g|U^yQ_=QnV8{8))Fn zo}_-R+14n4>^Gd7!bnjgYke&GX0|URpea`Sul2NZjlj4BEL9uv< z!jS7nc~o6E6(LeD1QPCr)71po4kA!hz5sPc<)QRYc-VT#JR~0YvNM%AaECZ>l1asi zw!J4dC1&J%@t|wC^iIRL#ktWkU|Z_W3Z@wUKPyL3@HZ+QYFM# z+gMCNy|ufopsy`^k6io1?;fkpqMOrE`G!F+wC1ZKL=M>Ncf{>Bl{0D1SY_;l4uB0NG%>-3MH+B_Gp4T3f9LPA52na2u_Tp5pv`zS4N{{M2eUQC( zkpqQ_Yl%2cftt7HO4Rp|SH4`vU+`^Dh|H_#AnF*j!##FbUCwr$ znv?S4s#-LKZncvUKHLBq&H&lkfMFLz-X{tjKsI%d2Je3ViZ0gIufe;E%*gQ_^E{Ok zLpP5TMQi{orBy)f2Lvv0laI|PmQ=!|ABTvPcbu8BM~+7qO`~)P0Z!-5F5#&Y3o(9( z`X@l%S~?K7RH0V|7|{C5XHcy`XjVO(5DE6QVOo$(qilIO9yM*|fEOJ)Q_^P?g^W2a zG%fhd-j*nrm#$r}^|9q;dsAi(;M$HI0pC2e4w~9Q#QXNmz0m{O_P$(B228Mb01e;M zhZCv-sbLpbIx{ygi(Tqlg93{rfA{-`Kc7E+eWqVmSm4~WtUy0_daZFQ`O%1qL80Ih zl=wB`zvh?FsOoffP|SjnsuTol;|S6@M8G$N2D1`h{RU>Ms#z~}VbG7Aqe3blfUI1V zurxrSFwtk`BeZWJ_h2D+=x9&9T87HPgwT8n_F@I)G&yMW8K5ji;=cPm-!##mC|PTB zN9ikra(Us@BcgqwI)4UhzP~?a?^Z&kK`}s_9B+@{9rD`3g&5_0VKNwu3)2W4NvTax z4`$&6kRem#9f8V)1-FIl+`535tCo;0{)POi^>MV>zGN>T*KV&Aq0# z492^M#t{HQTA}DdlSC_Q+yuSSxI3Ym6gB;!IK})Lsy}J&9%g|iDi{hbtkui=g6qr# zV>`VXpciDoEdGuLRrmlxS1=#Ws1i6Q{f@KETBcT#Ce{;xx)@^zEExbg0>ypCPgB!! z8=*QL=ld$^IJSaELSS9=ATxLW&J5(4&#^8>gOa-0O0Jyjlsh>whrEc(A;JzyVagA? z)PT0g95fzE4{_+pGODSNBFK!Z!J-H+TulH#3C;yAS0fO(Gn!BxxhSuk9uEzY18ArW z0iW)sI~2eL@H1iRlzXT9XsJKlZOJph{*h?M5bu~?)gA@!40!b`t>cXbcJZst$CXsX zGj4K%iM;?6AGT)GCW97c26x~f&mE+(gE(>!Z3t3`wum~8 zGHRQO8dQ8Vgkc7A9%E|vCusAkgOG5t>9>;maIU?+3N&4rWu@jlNdyhIDFKT8r4C~e z3M0cZalp3HgftHps_z$}%3D0_1(J0LUCELFkeVBS{t!+k1Wabx%t4~}9PesVxZ;4O zlnG8nWU2i?`qoLygdErd_ExJ-5CW)ujDS`gnUr>6Cdw}p`ZztSQbJKNkw&V07TB1u zz!H0Gjuf&1H7$t>P!qFxCheQtLoA5YdQ1>{xlx@!hYUrrpT$lP8?aNPFB)taCtzCD z^i#PkY6rp~JvgM^r5QZ*LmU`l)#%gSR8s+_la$dDOA|b%w%sPIwkGb6osWX0Q=Vrt zOvMd+29?X{8S39o0hMHT?DZKpKj{_gYd&p-Y0 z%g^#bC;wODkv8mrZOfh%XH$!D2TUyd^J)LA7rIrXpIm%4$dC9 z2~<=Ko{HDTfg%-kRjjFtQ005 z_^f_Bj+FyTdVnQZKi1laCQ=2;kr1ly+HSXqTJ$MsBSF4R9TGHS2`CREm(n2-Aj51E z2XW?r!pKlS%2M#Ogpr?9jGQJBSkq^qi>YVect#yD6kNmI(Qi);(z?EG+(JmPtpzpa z?5Kd#i0_ywBxwlxdb&9*+|9zOGh9~Zw{W3pgf$5L0w6%(O0_kk5TqbsY>reW#tCUWAr~GS1yfl=`KV^flFOW z?ggabNkE01hdkKNYgZSvJ@kfelqGLSwU&<8;2q~&ZFwfE7;fkjSZmd5kq76HfYgS* zc&G@--|PgT(3wal9evER1eWr5y&FI(`;(awqh4ONF31*+oY!zM;C!1-*%MLOg?TK% zLpKKfQV7`cGWCIZ9&H8Es|V=Omg{wRMd50g9z~Ileb=KO9bds3}9NPv!bW}#z zpNn%58PIkQVAQA*z*LL@Xxq0in3YrZOgUW)X`$`~{XFQdy{Q}~aqz}~hGFm{MWKSi zJpiUaS-%=3OG&V=Io)f30v){j^!VR#XP6 z=qX>K`+;|rgUik|sL274UV3kFJB@21zXM9Ac%hU5!Qw!mfh+k?I7F;||KCRvGr#QH z@$}fYdo&o$V>%bh$Wgwsxv{t+5LAN20e@<^vAzgZiZyIro3%T$l6}`OTQI5sak5Pb z&9HB{wE#$s&#S=te4GR-1}>c-O4l=K(O7>;Ra7P$IwCZ)B*M2WJv^#=vCYo z4;g`T7`%EM?$m5sB} zLTEU@N8l!w!iYx70Ja4MP)J8V=(t=4uJR}wn)qZ-zcFKu08}(8>N0c9K1kCp)j37h zZJLK08*LhVJ9q(5(OHkiV84W zv4a5dcnr)`Tpk*w^s0_7!YVUt3MekBNgCP^&9?#@`4Mo`Pr$aMDJ~BD~KZP4nOz;oOK0?2Pj3M!f(pcL>lKhZ*q4 zS`-SQbAzjj2YRZk3yMcaJ0O7jbWzDJ?&x>2EER6AZ&_UC;$O7dpxGB3p6Cc}h@n_7 z6{ji6!VR&LPUzCI0+UY3ZR~&p5njvWJAplbosHB1C6Qw7EGGfNm;=bHKu&CBif`}G zo}7SMD5XBwsiS1=TyX5c&Mk4wAq#>!>ji}m%6Y|dY*y)V~noTYyQ-JODaDAt{rKMfMVl&1kK{)|YA-XognJ zT`^NB#F0=9R1Hl~uqZ)3eR==>u*B~2nizA6k zpb8^yr8ls-hGKjaJ*xwR>8K$zE*_cKpd08ESEy_R)J1||{`@^1eSF?_Q;CFLEda-!i+teqms$5oX z#8pbx=L?z}!YEVS0A^#xWnCALzVTu8J5+(p|E^)yv%(Epk_QzM`r+;>m!fBf)^5(OQrebEczQbUEPj-`Z{t1)j!);O_v z<y#SX36C{L7yNh~Z(`@S|h6r+bd`u4>(%)*#`l_J^C_YHp9ncDRl_KCmjZw1rOe(>2{N5n@3Q_r5m4# zsO+E8Vzf!A{3?tC+FJ^#I-q#m>S_(sfNQPj0LyD#No&S9yIYQv*J+_TAV5EdVVV%?{bjxc)F0U| zTnGnR5abc*NEt;vMS?aYkVad2N3-kA*uMfOdZ0Zvh!O`OuYrg>MmrBl@N`ub(9x%7 zhd(GTuk26GchEY?un9qPlmzPSyqcfeV@oW#(~-KPx#X)6$%>f4ZsQ?!fNIM@BA~>) zK7b=aT5;J|aiR5Q)SU)-;vn)6>J*hc?FlwQsx{{es;lM=4YW9tBx}cjLd&tAIJL^I zL2=;}yZW$;J79!eIBbV1rdaQX>w4$V6s5rR!nI2zjgS;8^}zPjgNbfkv2vFQ6JQ+< zW-JUuh0zG;dKeB>i7!Pg_S6?sEL1ayasxnJ{34%%4sd&+16-DKmf-U^iakvGyOHt& z<2>423Dex8<<vFY=sjHh|U3#PmUh(zo69*UJbC!i&!iWxEMd)W{0tJ#PV6%kDzMQ#)dmwO$V8f?z zkaOg#5jNW_E3}y{AsbE1Svs=s|gJqpnkko`mov*)<3@C z@C`W}<__#5h;M$(Mg(eUH{xQ!CxU8JPdX>1tpHq0{pC+zKiEI|QKwU!xGV7tUI3S* zQLI;>?QUwuCojW``5HT5t6ot33{_bd%dTx7QO@t0AKVHb;kx-cQ6~&wz0B(9J7Vxj z(stx2b7W(N)e$6qUFM$9 zoY+Fc=YPY^ze5HBMT=`F0I0Ii_E6mA(mM}Z519vj)rYL2MVaUK&7ybUtM zLd}6sB-H`4TRL03T-fJc1y=C@s0Urp%DOCYxz!D~!URvOMLx4mAoS>Y3aEa|LGED_ z*mA~oAv9HQ)#3Rp;~mVRXKg67HVWKO4I$T=59^^ZSb8or6>_!~WE<=Z_Eh#w8m7%o zpb_4?PD3c}&nWp%=fiyZdV2>y^cW_^))^vm$rq+YP;Gk!07v zl<$$Is*41tX}k-{exg!lUZNS_|Ny3xU+`O_GM+v!8_N2!6 zzG)}Ed%R1jFqea(dlU*dpGaWvHUcvi&K}kI!dT^+(Z>0dv@J={@+PhPa5-)~XazZd z)1miXzttG zfqSUKo2_d=iIg#;t=p>G{xtnNk``&+N+!1e%(Qwcu-5=F!ZR2 zBt4G3timAjH*vcm;52c&p)3o~`VM~f#eJQ0uCW#1iQ{jiNacpgiugr^{sqP8Gw|uLP+5EV_W>J6F20tojRSVS854tFADExqf~YU zVb%(5z}_kcKw%(j2xDJQ!`ngOY3JeXLT36?ecYGPmN|r`R<%?{#;8<>5{Btwz*$d0 zM6pB=c?cbZ2E`(SWr#;~HTPQ&ly}gQHqtY)@NHz}8 z%X$(h0FjH(;YuA`@EI=We$Nk)ZL#YgYY#3-@ zmP?2LCr%cN`iFW!fQ2?F0Q-sCRi+?Eq(X=0K5z5LwPGi`qyz z22fRv0#c}+cpCn%9KRmI*Z;!%ICay&Hy&wK6mm2T9N4X1_8(+T-s;)Gq?Rmj zCV5#OIf~ziLFw7PGH?(#3%jbJon8ag(6Yv)G$4e!>)$+m{WsB-r>B8d?kNHcE&oLV zFK`ddt1R#mjtzTA04YK=V2%_}(4taL)Jd1<4W}!fZ>T7B_~zNX`B^~4S`RKBxB^{N zvrzMJM*)Z6Y6GFW7t*_e!;Lw*&$pw4ESu^pj@)VEz)l?(3u%vD{u2-NLp)6PE9VZ0 zx(1hXmRk=Xu!0&YweEm&UeU=TnB`puTL*pQV3RpWV+Tp-AoACQ?vw?pqzyg3tE7H4 zNazFYXRDYLnz1LGCRJ8LK^=X3PP7SQ3J=Fi)pO4@gemTGL2ZP*xKOcuaoi<4YQilJ z#r;SH_@q~BJ~?HH;$l!{=&*hI^6TfPpP%6~+cX1Uf8nZ%r+)s9x{m3iEg%FgMdT=e z5kbbKP}ur<(JW@sothe1(Lfmv683ngmzSzVS!8L03!Xl1vt#xi)#rZAlMR~JVo!aa ztRf+y{P6qdPs&3)qAbtzxQO$^H}id5E+b)*6o}w7r-}}+?`P^dD4Hx!wsb*JU-{h! zf;3SJMs~@N(H+9?GOW~=DQNk8Ldo`v+q&QYD99RqB8+;HRyM~Dl!!Gqwh<`Fw*I^>b}&qX`nS^f(QAWU|8`&?IY<}VgM01=DhLA|p)P1u#UM=_NC~vV z+=KPnY5h|9qHfrO;KO9)hi~LgFzXMY!m%oWM2VlR8qg}BilbAOrHIWuJIEnD6Z8~T zZ`8YmHU@C+3z|KGgmbY1##K+WGNq9=wTM;EVK)?>s^e5DpWaEI6Q0Ul@}Hl-!mC+s z)WygJ&o+=Eb%CFMqtDbXXMPx1+M!|rI=GXASUxBZDF-t|tVgQy`;YH_M^34VeMeJ= z1?S0B)0OubwII^6Tx1IjFi&)Z2IaU}5LY}XUW*02V}Qk7Bu^iY#AZC&l}E&7iAXEa z8$F)JrbE`^+)l$TXxY=&JOWyF{edR$(4Cpv>CUS7-Sd|Z&(A;8i<9!m0VU0R$iND5 zpyqkOv1mOY+W@Ok+kpXfXnZz>0iH^$9j_%45!#7_Z*tt3it_cq^TDaXm4HsLNV+XA^e-9}lo z!EK0^WJ&9+MfplNI+>(p$`p#`ctyYFgrG$ua7tO{Mnl{rW6EKgsEn(mPTOzT@F`D` z|MF-TZ<9P_TZjOfMC3wR1mD6R`U8cr2pjbtqF^_lP*eT(W3cPdw2#^nyz38R*b*ge@WOt9N=#r&xNbg1@F>+W`@r4pb$>-4exN5Rhjc@b{8N)-Qxbb^ow z+H4?vWPog!atAe}w3sf~ZTrii8%uzdJHRgAafdS?rUSURU%ufR{KM-T{^Oo+Df~|_ ze_*#OrvPxFo!ca64ze7SWpscvp##Lo{To7v|M>pA&UV~_yUYC-iR&ho_r_4v=i<0P%({fUpzM0dk~Yym-K0j|f5%Zs~$u zY-XVVJ_cf374AwrA>J}J@yr;v!4Wun#Z#L!PvcC0q8X#W?BX<|1E7vUsPUSZ*X4Xo zw50=taTab8JtK_hf?Z_mi~-w>4uBRtPVwd_$>;#_mJSd_JEeK({{mThFg)CzX1m2smJR)ErvT(>43F9dI+MFOJZ!cY$-}l#GyHwq2+V6vHS?qosZc+6d zY&xn*wJB7(ArWj-T^37)=* zHdNlVMT%oTVFmaELeW z_`VRSp7R4xl)}w6MmgASZ6_Q6X`{>BpNA;JAAw4=d2k&P@*qlR$jhVccib=t*w6*0 zjtMgQc8hooQ5G4ze3li7fVG6$gzaX$pJ*#?yTQd-i1%$!qQc#)2Rvc3+0g-_hz<~@ zQI3MN&DwpQrN?0tm-9ADhVu))EJL==_=#D%4XK3`E~f*anCB^EDG@SUXA0c7W0n&_B!Up%zK+Be$_$}g3%K5i3x-G0+ zwlQKoX8w&)rNII4%$U!_O>_a$lIbbP=?DoOAhv%Xq;JIZ4VR&5&P?5q$&@1}ZjU-h zBebt9mm#Wd6fPwlINEGj4FGXz7$Pdk8LiZEDFQg*`;tu8pg!ghB>mwVG87@AF=R9% z{~~dcM3ko6Y?I0tl|PyvUAoB=);D?|GEs_x&3p$&Mo1N3A0ZhH-la9tBO|JFA$v(vIHuye23x;7oZ}2xixH% z;gEIN;^wT$*g6T~Pi)f^llp#y9pIsjT< zG_fg>t&9R_`5AyXg$weWGj_*2V28IbFnC?Au;2~oLgCqY-nN{v0Bq?9{B!d#5&p$0 zjYqPujsNj#g*vw!Nr>qH8Bg;RnsbO9M^b`@3$cS7p}k#sp7dp&F&t3#`UczQDV-yW2v@=m2p{2Z+!!OZdbn zqziH!(*Ym?NRmT4y`>}MC>Xd6hQx;2iIpx8oIJ7?&$NvPIo!fS`+3jub$7W}x9st>M6QKu< z+AG~5ZZ;rDByhoIyL8P^-T|g*nb0*?sVRmGlrUWgF=`=5%&afz2rOYQgq#k5CYeGx zTH=T<*yR41t{4S&DH0yJE~NuRXf`&4Fr^DNoBnhzh61ol=m1+b3V4P76orG0;9o4U zJd%`Q|Ff^T*`R@hBV-U_(;Xj>rU)hd(1=ibB6~n|!6vJ&b#uep&~4ac3!V*8h%T_+ z0&2&=cX9|J9RTeT8~~zP#wbD=p$qWtm=2J!bwJ<{g&Rd<3egD;fN-P?2f7S&0Wx{t z%rjn}>@ULr8DfLBi~=5D!#a9iMRb59rUM{5CA^4|JscsS1K`q_4~miYZ~^;AcCB!iy@3gnEnSEkksL^aI56D2k&7$ms|hIs(!a0zw#MkN%!rFIAA;n|2>3O^~ho zk`A!B=a+52o5FLD%~L;K4!GgOjaDcN8P&cQcv0qz)CZZ@;}}q(Jsn`PZEt-GK%&7B zLOMVarZk0xigiOri0F`m*c#9QviD&Y@nlwc*wGP?88iCeky}0zH_;IgDajUqeiU4g zv6jr@k`U5lL!gFMePm)nM~LVEDC%q{GM0gjuE|2Wz~$r(0R+J>V^0B&fc_&xgfyWe zq;x@+Ne4NiH)B@-Vm$wsr-JOEW_)P^UvJ@aP)M<2tm=1ux zVxI7#kn$JeFh!)m1?>OO0q~c-0n{!VIslpy3fK@9C@=_8IsnozWf~?Gmto+6=(y7X z(CdK<*oe{*5aCNeB=fA*KVceMRBN zPfQ2ESHKZMNRtRi%%+ol84zkpR$h#(?e0(#Lb?F?`0tN@7RWmI4mv`p%^3vz#a$7; zFlJ^(H<=C)Z}Yyrws+wsMeR*MryUI_5J?d+DMDIrZ}9Yx`UIJ0!(Fsa^9iVRPO z&_qW-0bvw|u^E@oXts{k1V4!`NME@*1JaS!$6bQe;Rv zK$OuD!bnk^TZ2?3Q3z(Pk=l*EVwM0h-;Svmr81(KbJlFPa($Xha8qG?DTB6iZ^toz_vIvjgvEF8G2Y}ndrf7IHktKa}hMhD>FSiBKvxEqkt0U}DXyciLXDM(>bE&ULr>AJqY zqLKq}?gQaZr9=SnolNCYd?34;aDbFb!dAkLj_~$J2inzz{}V{lTTw^{V7GwL z4563~0BJMjKvsQ2jr5aZzh$fMkIm?GorA1R?D z#2o%%j|K;b?ugNiK4_H62jViTzZ6v+9U)^Ul@QYbAUIKOV3&~&5N;oo-JL9m=Y-U^ zz9OH5`OY#GM;SwgAmryJ2SQ9oh*Etw3KSh6%-74%2g%wc^O&qbqNUiV=92$Bh0PzY z2{KS3Go6T(lk3MgNXl`(e1F6vce{Mgt!W9PfGg9`r9>K`okcG{p#va7;Rvi>nA?D8Rgk5U z?Q(9kKsnhqW@SYBw1UEh9&{EYIohoV z%{}^VTRK9n9yNYqIzYCe10)=6P6-hmAWkGdpdsZ4p~N`}eM4aTiu+Oh(E(7!Q9eVn z&Jj0W6D4TwqH2i9F&!Y>(Ge({Hw2EqK}Jh5PTE0gO|tV6hG)b_wzYpC4)1*Z`W1u* z9S)Fg=?FO;fkRT%+?a4EDr4Z$uF?fbdZKlzJ%G~_j2~3*bc8L(mGKp*Pv`)+8!-c5 zUpVGPR!j*IUBFU<$_oKV!?HV{cq)wO2q9gNB;7HqH?IIRb#R274uBM;5R`BRh*LoL zN$3a>9UwU^6bq9?X=jwGQccW{x5aVUEU3~Fj&LQ6W>h+~c?j6B4cQT5Is&@O40VkD z30%NRNEK1S!2w830y+R=Y7=fpVnhdsIfH@##L;Oiuhr{=*xX*YsQ|Qn_b%d7BZ$Kc zRE)}nGjjZ)kjlqKHvMUk=%Q5SEs^Cm5+M@y(DG=lFYCR0!6DT>@Uiy{xN8%4O3iSLHK9g2^0ouoX^O6T~b-DIuw0LnjqgxV}LHuqKy@QwO zega6>$s(XSxgd7i76D0_RvE6@owRuy@UN#cK4-Vv(gmE?XI)Nt?#`o#4gk3wE}+OY zmvc#o=m5yhZ~?~<=m_CD)qIO;f{llm5WRu2B_LF~8l=1!d6?6c0=r$12)K^)KaR4E zhuDDvr2MV>ttN4x`*Z)qTv-=j8J*xS&iw5e9{2{i17@F{a_rVa?qTCWPfq>`dId)g zwxRQskHA2|4T*P=>^x5Zj_?U6nO zTD&dt+BStKfu_@H9VW~c3B&Ov{DgFXNZVxyoDt^5Xs+N0v5JrZKW*z%aqClYt7<%Q zkm`1ufOe1yWR<`H>I9<9PoZuff=NHG}BcfQ!2&+_Z)#vZL|f>f%j49 zT}?*tuh>{}a)LS1+clcvz&?XXo_Sy<*t*(^;67fhNa7)KV5d-vth2yh!?6!t6TSJ^ z#reN}VAYWCV!9x9^Id>Eq647yhYQ>!210|5=CV#V08*RsXN-nA54n_s^#pFDGtk%P zu2DA7Bb10+4;w<1<$sT%Asr#K?3}x1$bd1Dt5l-e25l{}4KfeB+9z7hwAyXXvyC`soDUj(UQAh!C%Krf5@%OW33uGHkN-GUGr(E+wwIzmQA;E=;M zHIxG($8dy&3ysjH+2s+#&IyW`%XUI?LbbvU$HXG!fjj}@Ofsa!O%^fgLY?S^x z59VVTL7)e!p5A%LJtPA6WC6p&N_n?)ptloJ`Q+POQ3x!84D_7M8@S3;q;M#G6^_im zBc(HNx267NslO)nr(CVJ@#(YiHSz|j%qhv3tK{GS=v2ZH@GkCb1KH@(3-uVhWI^nP z@n1wCk`G^$ZMM`1MBpp{uhRH50VP=Z%MINUcn*=~22%-<)o%jEaONxAEOLR(m_U(- zPfo50OxCz7jsGBtql z=ty7YRxUX}VAIFFZacJS=~&3bSe)XsI19*OPjoNw5)M+PEDIcCRAZNNf@I6Z8(OFq zC0Rcab2>tjbB-51pq#^YW1yj;T{3VXHJD>5p@2)Z0C7wQh_-ZrhHMm4gHT`@FZB(Z zAk{UYrAo>e-zA+R3K*$x>ryZJq`oFa*LW_j47e{qsS+x3z?e?Gc#}Fgo?vyTK%Xnf zJTQn%)jT_pTnS2@L{IQnySg*=Rc5Lb_nRi?lKomlQly;PJs z>7C$Tkyr+1ot51$=W{Ri50Cw~#Xht?`h829th+W9;IpqaRHaTUn#Qz1dF*DE*5Me_{aDo%N%xv;V zPAW=#mPvfQns~{F-AaTa>`EPc~8e1QQ zLrW23A0jRtA*KUtaymjv2S6pjiEjLC=m06Z5&Gppz6?zvpaUeE>(tkTWV0!d17eC& ztcLl^p`$pC?4OZ7B=#+4>_y?&OHr|}qT|Sh5*$PhSeguUjT5h8Un#`ChZFmh7U*Ix zX2o92ihUa@(A#}|9=ib%2eAXa-OI+YuM=Wl1H`@th>@;wm>Rf?Q~y#|@MGVo#=hXk zzIEktYxls!#fGl|VlO?#US^7wD-8VYK2}}N-oUPjd}q7c1jeUKYDa*%sS1nzb(x@-Jx``z?P%>Cs~GShh5Ch-tDU?zyX053>& z*Tz56H8}>lIP+o5e9$ugip<}Y`RBO282P*y`Mek@=jryu`y~Dqu4HPE&)yaJ+kJfc zN=LwVg?UB?;Q9fEnQ!14MdaI*j-cEeSpS;Y!dAcU2$ZTrfrUBrHAUzPKQi`ad%g z=g@aFi=b={QjE?<)%^0V{N zt-i)hTL#geX6_C?)ao)3;#+b{Zy6r)2h|+!7XmG{--GD4OS9AkVV2Q(!HH&-033qj zsqS*JQ=K#f02QF$oGP)QWzg zWeG;%xZ0#(B(<-%r(MLocH~&Z6@o#|gLbJiqcNeq! z9ks}lROA*>@3jmJMBjxW2)PPZ+M}Oo!@6t;h-;?NbNSop^MC#hqI$m2c3lvCpxq#J zi2$~xH2Od_9Q?Eo#Z3EELG=Ez4vOQ76R{1hsivD$)JE^8k^0N%BSZA?8Tz(m0e048 z;nT@#AAm~gdI9daj|5rT3nFKF)+KQanSj)jE;s=ZxV)vtUf8C)42u7|i~ARK$z+0PZ(ke%Kzrd4QsAUA4O)+Hs%j zf*wY+)A(JqYxmuHd=TnOQ;jW%)|KzL3$p(enOKlf87)Eb3?a(1BSG603K4hg5OV1q zC8)|K(7hOOWdi{%ww|={7j4v(I*0>X;~DM*T#QG^e26lc_aM~$NiWNM(9|ptQmfJd z6gv#K+)dyvPPvLP(2!uX-5DiZ7ea{L>rEPTka}#nE8)OS zQPMDo?Zab^YzR1{DF`#p@2raykkI6`#|H#%cM8z9Ptp$HVuD~*I zx1uq&J2)puKt$;j_jE;(fdzBB)5dQHiHEmSp@VHM2zTx|kUr$2KLU=63HlB;VK6OdEm7lBLEZRB4Z z`A^aWjf31EOzfJF-{*l(&UY^B<~w(L&XjRr-f%V?8b-5$xjB<=i}d^N~6z{AfewHxgt!4yTb)Zt~L&F^3QZ z{^_yH_k?`o!Jo<%Cax9GlOi9u$e)U|3s2ypC-kR6%>WZZyJoX<`*3-JhlHH#@&zte z3z!2oX}YodIG3DzU>G+E4+wk-ugP}I6oj0+AMT_~9WqM4T%pGn0@5yWO3J!D-BgE| zWhYHF&L8cP+(liI(h(B6!0i;zc+U3N0wQi0;yKq7v>vJ+q^>H%68Ze;x^~e{{ews# z`9AVj_lc~55BMUS*n*McVthB{khmBP8h$P@-MNW6^?308G4`Gt4jyia)%S{+H$K? zF3>*!@&&iB;3uOCBHI{B;F5Tz%QjVw0Z6zHa6?Gx0Njtf5yaA88u>}n$WNL^e$q7Z zbEVPNb=f1$er_pHiWm)BHy-3bx7pZzwDl>yb%XfP*7e;Tb*n+* z)Iqj&U=PeSsbCO#AA7RRuL-vL9@kfNkb6i3mONY6E04BrtjB?_NnCV<9O}vq!f&8! ztPk!0Z_nMFK$M>^@6N?1~E}=OOW+i)~0J z%6%U2v#C*T^8=F4#W{N4MyxM5wVLapu8(iP=+g8kSG`0wKf3jh2rLHuM5#fl+iY6Y zLFOUx5DP5NtaRp~j|mmrt%uNoJty+diTvk8{!=6W z%Z|o1!?Kj*gGzlFc=HgzxHioF7 zz@s_KDC=-CIpWL|iH;DO$ zIyBII-cuAD!dAXVG8X?n$3vI+Nq$ThrfD@LGfM8!=}>YLfr zEn12EG`xe@Lr8GqVd|zr0O6^sUj-JSsawVprEbE_0iW!1hGx&Rod@ru@A1-c>f7AZ z%S@>kl~SJ%{JeUk>GWN`H1nRLyQy0}5&0=}2ayBH4yl_-Gq8&je@)^86Gt|lbeT&I zpZPiRDD|yt>XTc*{F8Lk@L<#?`)<+@8~4K}tP7LvG8A`8xZG@!ux?25opp1h`zqlI zbVj+`2mxSYo2a!-m{*?0HDC?=(ySN3?i)$}gh&(e5jAvi8lLlRsWeJ(E20!NQI`ix z469U_Pl=6v5-W9K*pqe=qk#Nfe<@zMyt{q;?J}?CbuH8>L zl7^})QzM_aRdWWJ_sP6Zx-;M=o+yc2TqnM!Ghi^3>$V=~6YeZo{anBHf!G5%_Mzwa zmfTPAM~SbY5--FjZsJ$Kb;MEPR@_C2TkPr}abOp3{7X0f$(aw2%e{#g3vJSW>mhNV zB=CY_;xlmKTl>U|g^BOj`Q-pn;>AL(0N>MD^>9{6l zW%+nb(q^vP>gqiH{;vb}rDKih?FieAegcj0QI!ifsL};)t5!gqv+vCN@(mp! zr3>7AFQ3hofgDFclNYJk<1&OiWA%vqBTW<$cZ;y5Byo!@^=U+L`oj-@e*R3@QfV3c zXSSc7FG@4r5js>zQ!ZNJmQ8LQ)BZ(jWqGZxv^6c{&K$Vg?dIsur!Tnh%kN)#U=|Po zlyKYyK--ey4&Hv_BCfO-|+N? ze2+WehA2mR@CH&2(;~^ZFgi-Uv4Bp`NgwzlKs+H23T*-kK)YOmqYYH!=RlKC+Fbf5 zUJR~}vxDo^LD?BB)8b$#4d%5q;9QQ;alJb~8@4A^_oE}4q!m!Vu+ir2)tguEb#a$( zmZOK-!94k=Ze|zu&42s@&Mxem=?(k?Z1zexa7svYm>u-{$>VQrgq^2e)#KmYvG(Tl|ds8Ei;Eml6c(cOZHe|7J`Wi9;sw+B{S z-!L+CRhE=zFzR$*tzfJzNjUxQ_}|ID18xCkD=)DA6c?UJX5nI?9jB1EI!x0kT#d!u ztW?!$WB9SeVKs{sE>u@p+!-XQAH9eY`w?YATyQNw?EaE)Zkz-rCd6(5aTNO@$C!%Q zbg>tW{i3wUuRL?WyZlg<)|p9cj{Oiq?6ze@e#MysJt*@}bfZtPmx^Pz)HI5HXNfa* z77=KAcMeR<@axMQ=&r;++4UW4HCgnZH*)ZH&hC#)l!^T?Wb8%e$d5-xk0Op=QAtNH zaePadCn7)n8@)~cO8XoeLrz+7M{wkZsRPrT$5Co@$};$eHdUcALZrp1DFHd6EgUEyMCG_d2U-;#*`LKj#M#aN*B|ep zt8GPNxI=cvkwHyo~%XW6+8E!W0?h_I^g8c(!IUNAPBsB-(6}#imuYz5| zjH8V~lu*Ms+a0+KBII~Z&X-YWJ6;G}C9i8Df3cgn4q5IPv)an4-yqUF9VgMkh;x^G zi=PGYYu+NQc|$ehNRRM?;sh$d;`i$x$qoO6zMB;KnXk}iw$T2*ybB zSm-vTaFxU^v|k-qDG1%tS%XwTNqo572w?*_8^LBUTFmErfr{JHur1|!m&!u)KM3X z={dU|vLO61n&Ll_BK@2-n?Ld(L|Z@?gl`I;AOGP0{DYssXcjnD9qzbXKaY98wne0b zm@Z)DLPwB-(v%N(14ItY2U*ku($vA5PvjugDQgf6!rX)2W}BiM=yn@B3jO9)0$mX9 z+$>$_H?M{YDi>FVJGVW91=6w`+Czlx5OH==x#8M@9yJ#FF0{@)I-yZpQxm4L~(KO{-^g%-Q zkU2xjwc&IC>OkRS4N!Y5=@;7yoY3YoBZ1cX8!#w-V$*=3+&E1Z4s>zkFLue`H;jfG zANziLXy|7z!;M?P;2`zD2l|R|<2EQc$OLbv{3|m599NS3?$B`Ki`2$-G(tZ`8E$;F zw(+&u#z(r}FBqns`< zMLdxDL+RFw1gW%uhScdoL5r%9EKr$Gkjy6tr`tG!8D?%YI`q?R4(yb_%VY(ER1o?n z+XP&w$+cZnpv~s=TD;}jw=naqTjo~@p%!^~Hl0>!MaCNno!?LenuA7+>C0Iett z{U+AX&#r}jH*1*r<}7oTEKEX}X~UB)cu%P9=6=t}cuO)Q*H`Pi@^4!O0JP zGR#5lVdEhdSkvYw%tAj;MxA3?`%AD0O?{zFeU5Ot$%4?&iiN3@rw#bosV}0bZwEC8 zw#!bAHpx%Le196B)dJ5DueXaO$Z;#w`R4XM*fZEm8ilmsnl+7cLol;F}L z@dBuUoih2!&mM(-iYQFn60p!u5jofhH2Gv;x7!wC2lzxkjby+q;pdYa*fs7hU&$uE zh$e0nC-l=uCcCA&-B$O8i7$1DuVfRqmWV({a4F`ef5OB~T!)(Vp_T|E3v}{!k(EEc zLDYc)l)VMB$k@l13DC-xO*?7IZo zw#k@`eM=U5sUh|-7`u+Bfn5Vgbe9u4Vqd0W zH;v~Ybzl$7=?G39iQUAWgUo|Mxbg4G{KYOEZEIU{DID5&r2ab+|A555*2kF})i6lC zk7ChvOvBh$fYH*?_7tFP=CW@9c}fRJseMBlg+H(%9VuVjaf-l*BUg^nlc&i0m&>k%-}R$!EX z_R~q`2p_N4D7`ea6N0$)d*|9QL?%gfDf<_rT0#pBvM>WS7%|Gxaay?_28 zK@NRf)?!);!gRcxrWxR@2|h0EwLG>jBdM6FVj5KT$76wKfQq@f3QVIEUbT+NI$h?G z22uZBvU<~?YxtO7nE~+RxofMoE^jTd84oY7P2Ix(<@HuI*SSO*zZ}bx#m7s$UZ%qm z{Cy7pySCr`8a$?Xo)qH*%H4#17$(AbrrK-3WL6g*)3nYL%_EYUiYDekCmEe5&&uv4o;$s&k?&s*IUw-@LOYk_Zm-Rj%vXB2hBC{Wg6J7A=ACEitxdQZ8aPBV1 z*8LSln=kFxB0?PqIG?#L0Wh5w&NuwspZ>m_m<;`?EXpe)qu)=DVm}d@3-{zc`l1|e z=_L$Hl+Au~JRdHX;L%;?;z}FC0B%5$zmM+FulM;tsE%ztx1Q9}|BcLXmjS;=N86|q zzqKnSJOHt_?^b4{drLf2<6+_?SRbITo#QwJeqav4#yJ$Oj{ij?Fl@Zd7|aY zMs!5l6OL2MO})gj;r4z&SlP*Qch|=^<62zio*=6p!Qan6fBH?GsK1-BUlr_!5gHJY z!r!#(9Y28PsC_h#rmp)+Zz<=ZYmi_~fh?i76oXckpqSEnFoIdN*Y;7pw$*qn>-G^m zie;fA%*EKqr>HHij1X1DTxaYe{QdOh>HA;)exgs&qLoJ!6fZYA!SZUqxbQ!Je*N$J z56{8h^03FfME~bMPk#&I+wxxnKdbd9&S%<@HDJjR*q!HYs&~2uS$9EMDnf%lT$yL)*9$^EXDsHUo;()aL^ID1YH;Ml31FIwqrC;$j~hoH#jx+^o^WhNRS-ot zw_`HRFNobjk5BBDs+(x{mVo|G*T+zYAXg zvpyc;6Ryd2W_IV1C1I~c6_3PbTkw{6>vl{%INP_81~k+c(Q8~K*A!sOL4t>i=x;>v z>JgsW{cUY8uUx_khCwkyw|?m& z0@ZpuKVk6KbfMh^`OGKO)q;I-*X46v)HPw;uU&6&zAVfA4Gr8QPj{_|AzhZ06(+DM z##=v<%4V%Pz|!@y`%Pq-;mP@Uc6J%`hE-%jZouRx6<}<;vLPHc z^<%`vhpt8hAz5hx9Ib@vY#j{i{X{w(n>$1gQ2DZN*=7WHG{O9sykOWHm1C=(@EgVsA&mW1 zR+|sE`YE^hAkM~W1J zrdiOw{AILpUZ@KVn6s$DK#5_X+X_n*1MdR~U!cWeptL`3`REg*>!nvg1a};fHi$D1 ze8lncDD=Jqszs(q(X9|N=wr5}0R?a8#jcUM?{0rTe}4HG+~1nE!vKa6ozgmEaefF2Vn0NAyIuk>=mgBSR(= z9H;$d<++)4c6XI5!qOk=R@5-P0qfoqviV_#7y+yg z_w@!~je-QAW))eDA#h<0U@fF^=5^`L_xpYf{yRU9PxGg9@H*4-d@}&jwWp=gS9B<@ z$Sx6y`a%#s^bBbwV2dakw`d~Jmc5=D>Yu@v{p$n?^A*w|oq&322qRtadR*^x!GC{v zT|RzY@Q_1a9*Xic_%CYpsvCRsLtfD&9gF(WkoI(ds-3T63@E03L7%R^73+8pUfUTJ zTv-8L=0jc05Vv33exL(%hhcqTJhdv@csj&h33uoT7j%GqJGULKsgIX=xu3SX^@M{s zji~MkE15_os-XGs4+>rjs)o@^ixG_vqoO!9 znqzz|3fieb>=k)aT(@)Z-}FDfm2=*wp!e^SEGy9oU;YYz|8j~(JS-{t^DW*X4wCqE zJE3`e#sBL|i-&nhDfn+V;SU0Rd(2ftTal1?_w7r332ygdm1GVW>uFts8~>OYD*$p& zvlJxT^AOmwZTvcN<;D*5pxdFQ1GMvn0x3Y|zX1)`8)o=FxLwe29xp{dG+YUJyZmcq zQr<4?U#;kk-7b`WDI4D|eXo^=w@YzBe-&X|&!@w_F8&>u%ntDYRdhAgXzFfDm*oHb zn@Xc0C)9PZAgJ@LulLPL$g{b{chCJQ9Zdwu+kfIiS6W`W&BfZu<{B~E4=5qG>1O{x zGZnvV1>HTxjnjNudXygcoc2^E0T}9YLyb#7>VirIklqJ$!2kT^%ZFc|zJ8@&)u?xl zR)GIUg!)didjbyY5teQ`3+Cw-;e}Hzg*o&&awv$8;EANsX#r#Trw8pvW^Q?#s#<2*)|W|PW^elE;XSz&u6^2=U5tAcmR8k8waR0 z4dT>882s74{@TBWC@=jwqH070^lSH-661{ue=10Hf^r}%-7+z!0~q(gpP#;deD@0@ zt6yr4!vMxtI)eTYRw^M2Y-2WjLWsU5_z1BGB1mQ%k9X6kJsXgdW#a-sn~k#ctjtrQBa1yDH8`40)V@-Z&L5W;wOmwsmPy--0hZC2_scoy6cM55_@Vq_zO?0 z^FDq4{ORc@ee=*#+$0nfS_m}3O*l4>=t1Zj>YZXHM%is@-G@#{t%uh>9%>X~eP2CT z85rtrLfOUJK79A-%QMn;KrJ=fDX9e$P%0qQ7mL^$ZS8KOtKYj1L~37jHF9~r!>OaG zvAgwq)YGif0LbzL)EsJ$5WJ<*%j%{?r3$Ey?W6}*M|?%%0rA}3?H_5JRu)D96CWSZ zbgaudj*?zh!oHlA2cf=Y8FM%rD0EJYZvDa`pD?%VUbchlrSI3U;Irb0**12fr|KkZ>&1(OGKT%etnS=n@ zfag$p3znaTE&1vJUMcNQ@rYJ?1+)h);5u^xniwXdLF|b&S~Kfkpj|PxX`a8GdZeUg zW+n%yO8{8v_VHSgMrI3vRg;bM%Q0kgqt=GR;WV1#bQlwCCHk!y>pOc&0t*%@E|e<( ziw1Q&f(Gf96trx$0M&GAG~UF6n3^MRs=z3^H9Wgc9hK({sk}9%hHMEG+Y3IobP|d|DCj1( z3{811_Km=7JnJeHJ4i*$RE-VG10Y$M?PrHff&!%^i5w`B2#QF7KZXA6tzM4xk|Din zG;lk%?A3hT=6e*uN=*;~QQqP#W-C$7$M(wfMj5TT0|HVur!ypeK}B=(x8goFH-0gJ zOS^ByD{A%y@k2{EkmvxHit`+R70m!+4DmNh$P4~_LfiZG$4|kZ^jnU-om~3bLDx87 zMkOEscGpi&Kby~h&WV7AcMNciz(OR@Ymu%f$3}`~Mz?;53**)SYxhDnL7BP!eERzF z)6d`k#*_bM87I_fS!RSZS_-tG5Enbz<#DhHoNm*thfL6nr``cmOQ2xRXPH_hEN9Mi zc_L8wh&@1PDdquHux_Ka#KptTL*gOQZKxzp$?T}%1VhRLCwBl)>++N5=J9Kxr$Ovm zItT5FrXDBX6X7?GMSH0XI9doeT*jfHD4}t8iVuYe#EYolkj1SSm}~EN)W9sj$Q~da ztqj;O-1h~=8zDqeUIpQRJ#2bGkj(^mBclY(>YU{c6oJFBDAleMLtn>=fuUyGL?}6W zNhs(5#|s_dSd0aeSxV22LOB^w-D+wViot+jlJ3Spj+@~$Uevp?+=IeTrkf7G!*d1 zqszT z;aU6$>vd_+Y9glq%1hm#0HPM^CLGt-wHnvpI^C)Hb?YGmTzgIZ05o1EK%PCK{ugV> zh=bTeD3BgNgPhl(A$&zuYY++`8+3dx1Jbi+4D29yL0MrV4#8 z#|62#(arm5KNmGJAh@C9dFvtK2#u+|w$j-7b?Phkutth%^^6)F_X9t&F4~E0+7)8n z&@%>3CAD)QeyQr=I!twcf&j*4i{9w~@rKry)L+rppN>k2KX}Zc*TPQWRwOD@@9pRf zzg?o>k&n_pN^}Ve(!ejDtKsvjU>iBe5edg>T#F;Za(pXU*TdtwzK*RxgUEnpXkP`@ z*tK`AQn()OhyCGLK1d}ei0&8QYipVL@S=GHpQ8^i*Y74$F&yJts;R`-udqGwe7Agg44gE^TrI^+h0Os z#iYL$bip6^8R}lwpf0`kYvHhjq=Q4v!SMzN;G94e*dtb(p1bzTh1EQswe%A^99IGQ zYJdWL5Hv#9e!eXFF|;)5=M}e>9wI@}p-T=rpBnU43C&EANkH=ke;9;`c~QPJ2pw=m z(X~fD9U&n60cciz7J&r}z;zP_6j%ZKky@&+{m8jp6s14P!x)?9b)xhGXE(T6R zf;gP5JXk5FmN&8waU44AF8k>l2BxK6;UHw0gEV%K_!}c#bG%bMkiHj!n^pR#G&wB* zD3F0Rysn7a0)0}nc(%(JFtqhSwF?l{%UqJG21OlkTeQgJ+M;sNG=|Vk)c{*g;2EgM z1JH*{L(y@$w80+$O;(p^q#yFPA_vfvlR>_5ut^VvZ!EkIm@>j))sF6L7>u)81Ez z@(V|v3A37Az`)VjEBkQlAv%Z!=uY*zdMQv}H99+Sg36M_9cXFG+X16MTycK#50COZ zL7otlO<`{z(Z^>H=M!s23mQa_Mi1#x1o$CyH#OHr=kTErzX3G_KQ0IX7Q=ni$wGO@ zfO%cO;@ymw#R4|2^QDOl`e73E5EUjy=(zs|QlAgPGuEC^HFj=bs;mx}eg=Fd$2j!N zVY9nZ`e}}*kyB-WV|zgcV{4A$Q=e88{ARxv<-iZzH=@O%N`;6*oPe39*%u4PdO;0G znl5a1nwsM_N6Jl2^`IlHR(H^|3Kqo+vV0&Kjf0g?Z`Qow599Szz)EWz6c`RomYqkySGWU!Q zFF?h4CpQ1ODnwn4^1ogINV~E)91mPMaxEU*i-5;KY&8KN-QERV^$7`9EDuUlN7CI= zj$j3(SkRBKtNOt$i~{d39Nq;qriTbrp=9hSj1`M!NdfcaSS%D)i+P={3*UgUE|I2~ zX}!1){s18T=`-G4IV?su-%ni8Cx{5ki4zxBiu`KAi?J(E&P3=a7tF}$^`q+pVM+r5 zWiOv*q498BnB%*v+3p1yd4%1nwY20&p-e6 z>E|cXhvzR}o_>151xF@?;uu{&E(EzsxK-IH_9lt^@$~)EyI+3(03Y;E^kX<)5(7w2 z1{N@YOB|!f6B`0Yp(plPMABl4m%V@b?b9zm!xLSwiQ*3cbpa&bjtAv}q(#zfy0m`X zqLEAfTmQ5cyYBs01S?sVbZnX`aJe6@k^(L^aED&*o03_Rw=!#+tO!aNIu%d$*Wh1Tw}oT~Y; zHiB)IMgn^gAWY1s*ksuj(Der@ar%AX3;-*L-@iV8`T6OmXPi^FA{59@2QP}EDyGk% z=}bUfarX7Hp!eDcDz2_u@SOKwe|!GpnHLq^L|Z7qWkyUiw+_%3T}PW8o`T=0_7T}L zxSY8Rk26M>vvr*S%Ubk&`gt)S=W?E>Vs2_eaYbJ3@xkXFrFS|8m+7(&N93Xl$FU$8 zjBf;3AsKhph~S`KhX$SC|A(tLTXNh;ws!CN7TauJ9kbp>fb-S=m!y(Zspn$pCgH>k3kH9Kn(5?9`18H`qcHvPdj+W$>spuxMIkXXt^%z z543(K74y;7Gv!|bH1R3g{Mpi8tYu31$`3(8!-Vdsdwk>gjDz)sO5gnd!O3Ui z6rd^toX-JRTrEmy(ZiG$ng`cvM}`Mt5+|y4AqFzqt$>baCH`1=PG16i)7Rai$H}^; z^!4V?PiXPqKL0booA+j)7^OFJ)4Q5~K*&S`ZS105axLM*Lu+!=u9;U{Q}@QuZx5!Jrta0R{A_! zZqTPVVFIQpX14kB*WG@1hVC*`sKJ;HD1tx^^4EkiKGd=1-+W8iWCP=zY0^o<@to!L zRQW3o%RH@M@WxWSskR~1E*WOz5I@jlHN#N0nG+hBLJgRcqCLK5sA0*mOfGDqt{EMb zl-V5)Nq+tdz};fdz-Fje_u@L^pwoC5DyVz&;g91v`@VhujBaTk)!$!T^!4}69G@=x zc)@{D>*h;^(%Y&!;*9P25=X~qGc8=8-wG<(#!O4!)r`ADDj?)vHs1_*Q18v|2Z+|d zId?)blsvKWQFPh@Xb*)RXId~^c95H=<#PVoop20Fy`+9Iy>z2iF8~7@G@Soe47M5HReTprFAG!Pas?=4L4-UTZ%w&3lN3<&Xu8;{eeEB017);Hv8t=Kc4m%`u>_Q7UhtkOOk6Vhj$J{w|7OqJojvgaoF#eRmA6`uu~XaFQA>BN9r z6RzmTrnyI+Q6C59w09{(w+q-QOz3>Napn!0W1B{`Tij ze<~Ih4caG~F#((mq@Zv?V)l1|t17&UX~3Y(*EnT$TiD;tG@@84_W~%W9Hab3XlwWY zGDcEEUdD9pudGqy{<7b*F%3{NX#@?px$&lyQbP@aD~f=5oZ5~X!B%cp(BlAcW9Yxa zf>tAdrpJ@4a3o}9&)PCjn&64wzW(|1`*)vyLsB=R`s@i*;8`&(c;Zoje?~!7YT*{x zDp)o_UhFPH2{$3yqK;~$)Y2%b&S|0tf>t&j0>n`Oz8-;HyhIDn1$e8Y>y&uqeE&pB zP4NIFWxHpt%U8{Q612P)fajIZ<=hBR5XHEHjzPtql`^5vItPf40k%qEb17A{hATw- zm9~PysSwckLQeW#4H8iM*Vh%I0Mm%_4-}I6IzX{oVLjR&32n?S&A58400Ql06T(`a z)|A5v7%!v1c(GkQcXc?J=dYwABr_>)p;f7}r7vzmdoEK>krI-*wqkef70MPb1giZC5g>;q%DE{V_8;h9W$=tY&zeOw z(0i70)fq4_BA{Y*HAvhjPz?p-*_i4&-WvHp6PzY7;F$IeP;|;BVL)+xef##;ubW(*^oJRjcpU`n`5K!Y^9j>(o0;`Ewx?rt|MCQb2Zaa`6B4Dnam!(aegBE!m8`ig&`#gRd~X*Dmrgq72c(&*Sbq;8;A0B34raK; zlXb7Q{55qiv|C}(b-_ZB6-n?T$3CfY`Jx)jt# zSptKuR2LGSIZ-a{4GO+B{~87&8d`|78Vx>YWR88AN*Jl(wAh}LtcV5ig9MB zL^6dXBm;C|k)|*LYz10)5rmYgFDd8Z)oa0yusa@E;E=!|I}m99rmle|Z;hUuzz(Zx zFsk`laGP5lPTvfJfjYyk>G%;0GM@hyNJ*K4B13AHo8CPjR^}QUWd~KQoOCA0ER&v^Zik z9Nl1FGpo8T%S+WSy1IZCI<*t6iK*VS=t5d3l61W{ed<59`CsS*TIio6-(5?uYX=Y=_|IKa>Yz5W3G)H2%XRHd%j9dT5Zq!ab;sZvxSq?FU0AHrhI zrJO{Bk;Y(@IWQW{EhXtvyXl#0(D6tiO!mDTC~3>f9p4kTW=`b;QUml-0g$C{1PFpi zL5-NA^I=C!Il=(Y=d|qlA;g({Q1(zhsGpYYLTS&Sq+kh9SYd+Vn@*I^xE+qb{|L~4 zb{9e=dwBw9Ujo>+-EZ$cy?^`lr?(-IA_J}c$Aab5I%;x)#toJgXEmT~W?P#FP2)rX zwnSqrmT`r{3T)M&u?U4oG>H$*Wtljf14_=V19(&J9RM=A2G{7=$PiQymoFxt5(^gBUJPw4_RO>P^YajikD6tf5-tWOtnwvb?xDI8hY91P-^ zWl?+fV}Pp6w9Yt{H%O_|jTxnNLCM=*sVF(Y{q0G6yL6gU^;C6+T1it6g zTVX1X0h-8YL_PaDNJZyYv?=|7{&(gaOwqUTtmp5OKA+G6s1g7BJe&D2K*nR^(+{ zm-oA%nnDUBGs;sWtB2*aNIKmJjn%GThRJ}m@*Lm_&&^elppf!GpiT}jBRGLo887Q9 z!elLkP;vs4Mq^TT4V+Ri(%MhlsbnRNYA-0L zmwzj?yVZ{IGSr@EhbN5%K+}>Tpc{0B-f;&BfVzqfhq$jw=)1OFIskv}n=OQ`#z&E=_bSX4 z-VE&t9<@Z}C}TGRje~~SsNCK-S{aP?)(RTk3Lus%<;tCK0-1#9a0mfDOl2LcvLB0V~fp{B>OQLQ;9xGB#=aL6S9a*>@k_eENmQ zm$gJdfc(q=vaD3LTx9DXMFd%gZ|#~aMLXZ{^m*8bIr-P=+0`>aev=Gx?F$e}2_k4b z1f<;w9hINPxuaz5C&v$9oap`Fb@T1*(>H#UL@yx%NITC0n}yYmEmnKHW`3A5nqcQ? zSpM&x4#J+P4APtjAHvW{xTTmd`P5*LoJ`_!uu)4jnwC>7M`7-;dH3nfw>61X6Rq5e z_nR92){;=SpADSTMbXwO{`4K=jAP!qp2HEKom|SLYEWB_58${UU@b7%27rw94L~{0 zE6H;~6_9B|1_ZsHEAN6YE~KDOVK4h_MI}OY>H_Re9Gi%ab5#bhfZOB*+JXk48I6uH zo3{Yl09#$h$&UOR;k=D6eB^pIIT~{7gZ!Nl6bTr0dP{-^bP_ZYeFSYQxN6cLkawJ- z_LSuC2;Y3Y`%-Lq4CLF1l7OcO*Y0_3RtVkALv!hR91U$zQ`CS#k`sWwdIT~{BXCOu z>r=-4y*w!6oEr-)^QHm$ER!z8HCyHGxxjm2}9>*%I0ZFzB2;D zgIS%j=5#!dc&F+2%SH1fY0AaQ0p~)6?GtGhe@irjmZ1Gea!vlmcqo&*ciOQAXt-q1 z24aPE_n?)y1tY{M3P8z3a9Dx5n;_y@uQRQFBs;j*Waid0G+DMDUV)1jtRsTxM4+oU z9z4-0j0?a)7a|VExfS@VfL5YB_mFnflc?)WoVjw-O=o>`CLS{dm0$KpM62$c)0+7D zIWp#REufOhgGTQ9P4#2J55YI+EtxdjU8^e$TwCJ}2R1lne5mHpe!@7olJ~V*I~O3Q z^IqUC_G4C#oaz!BcLBEg$&JZeC+L7^vNkD$^jjyz*Ky*ILj}QUqYcqsuz=MV5J%Jr z9F4n90o1Fy?=Q}Zp)bdl6CbXZe@33xEq-pO1~_g6aJ*k@26_UUuM1{#hm~|6(dqP{ z$8pCsP4{f|AHlZx5lqPtM7tH%pSFCP><|;3#ofuA=QWA~Yz@+pk0LbP93ay$fjvDT z*5Qzzoun$%`Tg;%Y+j*+s|f-*U%>)sFnB;1`1a=Gmp4DX`HLydqD5FhS8snG|iuz1Ca} za8<_-!JFVukhG6KV=rw8)Oh!zms$Ce`=$+x(oS{#%&r%Z&+Pm;2hZ*LlPk>S(&Vn? zU`@wYbn>B$W*B~190p3!mP|JL%*o#z#y|OUk{T+kutsTzxN&IZoRzQ9u6g%lXgEwBsrgCmDD9^Fe<$Q}k(k{e8xJee6=2w!_vX zTp3^e*^KuE9nn|;&;eoS0i<`ILbDj}CtnZCAq5??2c;EgGcM>J=xM_Mx{(1!ZNPEQ zNFw7Bwol-_pr}RYd(jmQSU@`x0S0RW$CdMd&0_HHa2L8aBWMlt>E-8I%TD8q zyK4gkprv(^phsIH&^1W80!v}Ho7&yTN8b)M89qM$;hGaVJ#HZ@Gq%>12$|-7$7c*u z5XKf!z0jj)wRw7el(UgLJxCjr{^QG5Uog1b4QQb&kd!FWh_F(;(m7h`^q`~89q9Oj z(2o6hfYKzO*GvQG%m!{vQBewNW`Y}Co-Kt^w}B4_w{8x{NOG&!REcro zrc+6g*!Trj0gMh0+C50s`6+xs$D?$Gb{26qN?`A!=O&x*fLejZ)~j6$bON4Bxv@9-QS4u>Mqpr%u+APS%%@ zlp)tF20Z0%u-e<2n+m|QTo91xZo~`F!}{ZcI7F-%{XkrrVJ-4Ig|y^ zHQGf=oG6)ujs>(`3Ev1|3#kW~jhZKngj6M+(hs15y$cu-;G5SSvfK zy3yW>1{drA%kFsK9cWjk;|N;;N>V9_3|^nUJ$?K0>rbDNGTb4Sri6voQ8-<|gE=io z%i}SaLlV07UUml8iEm8AmN3bJvE~K3^#a|Mv)H2y{JefDd-Y?4a7@{!H4AXm^|{t~ zT7e^qkwGTG&OirA{uxBI?WvOw&uQG918H@}(8i^J0q9j<{)6Zi#h`EojnE%||GeW7RZ)YLxY6O&1`!;zndWvsf-+cP*?N=pL z?x2Toob>dZi{_UMsHgwN$eS8joo|RMiIHs=}za#Ccpj}5r?C7@O>h%Gm5 z%9Xc~_9QfaruzwuU+8fsx+Uyqt^x2%Gu!i*O~0s32qF#)#8C~atm`1J6D2CknkpLw z`zYS;Ss1qDMc_0cfAsV$v|k|>J1`uBZSVpGFip3Al-JbFy$*E`|jx-bx1bS-#4bSrDM01*zB4(SU zYxbdC5?cBY6BoYiS8ywwRyeM()wRs(!!E+vmo`xMjC1+BiQ(KBJeDI<>M=STIKWM^ zrYa4bx&*IHhyko52-^UvKXNh_86*@>CXbQ9vXDPAlXG_@x8oRFIprp6O+E-#0GbX9 zaIH#E%gNkmJakzAR~j@{9ellBp)S;&0CEmolXLA=5AE-_an5su7IGxL_P?r@{ z6I>>FZAzCbRT>tT8Y(mEmaDZOhw&yYHkwqN)Mv4u`aXA}hSrErlj4)mP1I<3TGOI6 zWh>xX7Gc!p{(zhncF0Ezi*oH?{sHy-~3Jhy+5FS;AsS!tW*G}QR{D868>jG%w z>fKxm$vK_-6%Q-yb%B~b9c71ao_vVc!7T=@Ms{cOCxQcKcL2H8WwqL!ERA1DNzLQO zntdhjLw^945*mUWhh0u9J>a-PyyeW+%J$@B?KFPy`Eh*oI9h@x?^(8?=xTS3PAlj* zyj;s+0Y#pjg1h>(3#}v51_wau7xgm)yHaWsR+HH@?^e>$Nm-Y7z5GkOJ8YSUsCs|@ zUx>f|zkmKSVe|C(N6Ge<$MJ9oV3t`UjRxpDZ5)fmb$mf110fCl=4o^oojH5_G+v_U za6(RTx_ywgJ73~$jDi|oeLiz|7@niu8U5@Nn%yDZqG=*asIVB8aRctl*0%L=*dLH` z+n|pqaoboxj}!)wtRf>#rhT8izk8*4$9<*%x)bg4DWGl09Q$SRuN?RKMT_$TDWmon zfMqRUX8U;jtsnn(=0MO7!+yW#^|)saFaN0@%5YBt zr`>wlkg`+XJbn54&crMwUiJY_=K%4VLgmkZ)j-5o-Ve4gg%n?&cd@`E(Vik2%dSVo zFEi%98z#vr1TMQ6979Udy#^@R^N@BF{CcXRddRM;I1d>hq{PtYo_dJhKIt&R^fhF4 z&(k2~=E_K2rWzA_NKD0XXF#(*Ks3?0-Po7h%|j7bq)Za*X-mk?6fFA^>Tj7Flw&Hu zpyYZZ?mPq3vaJVH{sEbu5+HdG;;5GE0hwH$8uXkQ5ZT1Yih5?U@?t1)YF%@Z-4pv=4Vwvq}4QK5+zWx0(E*(M!IfVyydcx z=jlIx`}*fcrl!=)cwEYLNI{7=vqB;`?k;-TWc<#SPfH=Iecnmq8+$EOR<4B}_(c05 zhsM2A@$*Z2`avrk0x$wbAWh2(^_tvJEteJW6E9pzup&tHCRoLA?Rqfaus3Kt1nMtu zK54TZQ%ZG3fW6gu*Nl<|dai}(MY^V1L7OoFH7DaXT9?vR1CeIrwJ{9i0`BqiTiSI# zF{N>l{Zy&e0J0^Vm2zUB-#P7u89RmN;|zDVbd|dcXhCr6NI9fI3<{mR@}SC1&rF`D zf)h_1pU5nM$WYQ7LB=sF8DzXM!Q}%dBLfmfhVCK^=|FXyc4#$aPJ+sUphnSYJ9^nZ zNI)-v^mb3?4yesjH%Dua-AzHO?xtN7@dbB`3vxj1>H0zL2muY3l9q-SMrKk@Fpx|( z0hFGjxq!1!25|s(u>^X(0r=dr_vOCLVLSz3RTNOq(~b=a%^er{Inf2k-IcR=qJ$6D zwhN;w(vew}m?lB<2^sZ3owkC3dtJw_Ug}v#*K?4=yLzl{PH%zpg3tP~ zYq&{T;50;opbPNEHKaQV>4Ks%IEEAqPVs5Wg01C&N{|6K$qQkrB%dfg(OgZPrbMT+^ssrRxI9SH&R()C?#AC{kBU)akpz@!t()1ub+Fv13xS?*ARQF*MVs8Mnx`cS<+?m*V;)I3r)jWTVH*IQ*pq+) zq(Bvo@IUx}Lc^;t(cdLui0NF<&t_~FI&{Zf+WC5wT|JwKt#kmIj`fkix&Eh5pa1#m zhd1w)lF;h^NuYHm5{fa?Q9r%=`imt=(jcH%Vmn^t0x)@qJEzp>0R6(DUT}y4#A^zr z$4{R>fB7p~Q>cd+Yy~!P*K%?W{TE-Pn1ZE1hvAjej`r!(yPw~`{rZF~m1#JUPWRc7 zn*$qW$(zZ@)2Fv@bTG|6Wcu+$&=LkfCbooLYC;>fSrR7an3w>AC2AUaeot)|u z@>y@CxsRu^gfQF8L(UDYfJ}3125jLCg#Vc1cOw&7{$xAT0_Zw~NKi8zMWr>jrsK0z zvMjYP41_}RlJEp}R@BnBsF9zy6n$o<*3)E#1 z6rRjT6@jF+-UfB%xf~3%RNLSUF<9T&BK1BnNZi(d`Xr~fL%eTsZxSgiU>)qX5P5l_Q+0!zO5tz2snVD+cTqV(zG;PBN|mg zfPU_|gbb<~^n;+i@dVSN>-ox$z$^d=YFKsml5yJ~0IJHu+jT8J0-xS14rFy{_3^1z z2-QU?RohLJafI86&~R6`fSVe0SmQO3%+1hTxq6~0utw@yEn_su))dM0wfDUgPJ&)( zO}F=)>i+P5&^7Q$65r-!ig%h#mn(v6Aq`{OY>9rt_tVrn%> z4y{(&uf*w`K*t9iRyu`CM(ahk$1N{|d(vS;{L0i(t?22)n=enlfBwdlUVV)L-#4Ie z_5xk69d#o;pS(D|a7DGgY@Vux9>#HAwQ%k|K5$CZSdBZNC7Q?&fCzQsxm*O*xfyNv z1&aI&!04BcJchwJcnqCLGps0xaL4B>vt~Q!^enUI zC~4q#CWJ-)%F~Z!vI6h!rpfNbx@^TsVnr9QA`u=3J&swg>89Q8q@#wOCfo!xtIEhF ze!&Bn$2+x>>bzPeknD12hLAva6g)_8o^F!HsF{@ad+iko=IPzPzWw#--6y2IqUCoI zdCOOo5+TP!p=8VF%0WWr{Y&Uu64T@h0#YQYfZ{m`>MeU4MoiJrNzYh}FeFb~+=Bg7 zj*G%Jk8-#(?gDUfsvO5fm989pKXV$h9Jm`~A@s;J?>cmome0!J=43$uZT-q!mn3Kz zgO27*L~X!%OdaOhnZp1CBH2*_l0tKyC4Fsk8Xna36Kl3=66a~4n2u6T%eELGS>K&p zVBqVOqfh`YF$-u%L+3zTQXmv+Fj_u}9uNy$uWcqkugzv-h|8oxZne9DkWvg0xS>@F za^SWC#uaAmur(q6*w}wYPHX=lt}YV#TC>`OGL_sL(7>KYw(H?2=_n;Pxa5t2=M0g6 z)mad24dQUHsRP_aP0vaM?J5WGo_m7hmTy6&exk%sojvPn+w zdH}S%C(#&=8u~7P8keYElWsmhE(5g{1EIOp0h2CVR;w-|np6o6E9_4J;sP3G7Qb{M!gkC>aoLdys{(2{reV6EPZ?r>k2Je$6S3MX`Z9JrbQ{BHHLZ#0$1w{s2G&KfgVrDg1E%}l$6)0(iik- z0>}!>W0q+n(TKqgB7_&9eY5DtHx~cTB$r+z z8h6L-^Z-v^q=FYZ&R&GiUTz{*1oTzea8~vA&;R`P?&DjeP}51_ptxUF*cs6A1;K>(egJ zy>isE2ivH#mk@5f{+7@xWE|nN=cH5t-LasIP~fd~e3eD#ZFvY#xKek?%!rYWB^!I7 zlsZDqXADXagzK*7JW)|mC1;jy+o)yJFUn^cdmE^?WK6C}FQ=T$CZeFpGVQwn6nXWY zXi}}=3S^xbAQ{4maxDeG9a*OsPD?95McKa$UWEctV#ctpUu8xm@F5Q}PuiG;A%#v< z?yjJQL3ew!ka#M}YUZYJq~udLD@o|ep9PiAqim=Ozi>kl;hFCH2*b;En+XO9JcW!a z0#ICk`u*+KcfY*(q?Ban^izB1=}(1k3fC|rconskg=a9EQvkbSkkts=kdiE>NDI&V z0LN1RJ)EyN>rE(YYX&~g=P5H_ARk@J_fn|{QB0MH+Xr2wyg(6PcUSmdObX?mJ+tE> zMU*bXHr{mZ8?BdkJ*(NGQM0 z23Isu^iUwbja0JDi)Ow6qjimRvSb&MGA}4=E4xO!a|lTt4h~J-)m>wM^#y~znzE}D z48_15d1vj1P>NZ_5EuYUP)@U+vvPMC5+l1P17#GAOcl%(cUL9>GG)DJJ1ghwoKFVV zg#$IfW#0OAmop^J6swMLIY{q{@nlp#vZb^7g#PvAB|xyPw=Z=UK+{=)0$g@0#4BtA zoY$XD>rZN5f;D9q1&A*z90Ek=6;yhJ^@3Y9galRFk`nXlY=n_^(V%-BvS~S>wg#2e5w@9FKo{^Ca|Jsp|} z=ubmHZ(4+=%R2+B{v?Ul08?uSdWV1l9|3!YNH_WI-PaGBCnWvG&f+Qjrh^jt;}9_X zpk33^O$gz%06|~cW!ZbKp3f*=*z5U1APoMw% zW+|$b0%#;gzE&K8l>u{W6V!lf+o2zWj@G~Z^k-!BOZkpYhu1H^`RQjC=VY;z>045J zzyMSMvlmj=DpcW0Jp2QrC;iMtPi;fE&W?&SSCA;2;{ey%dmcwxkqtAkY!Y@tetFgce)96`v-=PJft0_EnX$g-hu{XYX7%kdYJ$ot2$u}FlUzoG zXnrMzI@P?kWTRa=RpPb?Hr(QhrlH>Lk zLa_hV`o*4k_2yWXre$Vc1{u%RYkYQZ zXlYugF!Ccr+L4*WDIy#4TnM->G&RLLbHPjsyE_2YLRA}(V$dQCX+hI$fYU}M@46|R z-&Qj90i=b~G2C9kJL9I-A#ook7qn{8HthXhao-(CMu>hV?rbFuoQ* zL464c&bkY{o+lgm3%ZD*GAW!VHIH2eslT113I@l_4@2gqj4 z-QL{rjc-|(3I>SV%Z1Q!)so;}mTrzkzBS24$YLin+_k_}*0j)1gmQ&gKbc88L2Vci zgyyuHZ3-NaloV4LIC*&h`$@q$3UFLgqBVs*A%Wft4Z6{w^f%mI5DvC+oOGpBNjUDp z`SE%oc7Qxh4oZ-s*?SIoD?TWG5XY_+|08v!^9r#gc`ccxtD!s~E!bbBQo{Nb8iQ~Q zz^={R&R0RQaMP8*a!(J3I;eP|f%a%5i^L}*W`L7FwDo=pBw*YE{x*0GGHIa{Gu+@lz0zeON7ohId%u};H zAM`NwJlO?n?&uM8j1ep{DS*IepE#|C-liw08Ae(UT-I4NbY2e_9C8}jHQaPBBZHea zpgRx2dd%fzdV$7}Vo258g#i!ttpa6?X_{RV4}C0EoN@jnYh{eXKfn3<;qA9?N}&fy zLBhy-9Nkhn{Z+BbE4EH-Gnr7(L5Aj905<88xHw4?6pLFJmpme*7R+>Xul65_W)WQ8 z!Wi~aa;vU;9(NH(GxwaeC3gb7`Nx}2pWgh=6mC1!PmC|b`sQYf&G7_KY;2^|#hgiE zcN3$H8DXTSjAL*Jz!5`0i+@62%s#V-&|hKX>g_r@3~ZYK;zZ8971{ zG$hdeC?6~dYCJ2h<7}tR1JVHY#~=IN{J^T4sD2YuwGq-myD4NkOHVQ@?TzR=I67?O z?P2|X3K05avL=umYf2u+zr{P~6FqY$<0R|4GganB#$eEa;{8zqexO4;$U=4N^|TvKAF=t4j>0nKop05?yA zGeAM-r~=Mx@TWpuAtB;Yu0U0SQ~ph97fR_ag<$6Ebn2mnBRTb;DnO$RQ^L8&Lw^iS zCJq#@MA@1a>?2h}P4}o21v+R@Jcp6th$={C!V2Y43T%hBYj2%)a2ha!t-{y{YzCFu zTG`Uo6pg}QfZZ+t z+Q-wIPrrQr$D0pI>Dc_A0H5U7Qa^q~~7^cM(1kHyJ1yps0nYXjeNPRTVh zKZ3!Pmle(e+6o1@Tmq;p2powGq5#o)79~s9&}W(x;BL%pGeWr^4tj2Jy4xPM>lY5y zM#mNG$|7s#D?d&OI_HlsE3Zc!?AOV)6pQZ@@y9ChMJNe0S&Ykszt7$ zHwLfE`k}O<#F*9Ssy^7Ofy_e#O=DB_){QyCCUp8EL{o0~;GFH%k91<>4AM0v_+C(i z9edH%(>=MGvGzDwM9Sy~7liIi&8D8rafG82DAkL4Yc+|`7mom}J~2~SO1CxRVa%|qx+-p|9o zd9$js#XHX6mf@OZPuJ=jIgr;bCjqq-LA0i*jtJJDwjpKUz6-*wD+D$slhRr}AGa~- z#So}Z2<(crIWci%H8WH=;Ocjr>UL$u51^QuXm?m)7l2b5f@u9oIU{V>6pfLB@YD8k zS|JXgKApgIaf8DO(F*J7$Mu-Q1J;Ap84K21?AI&r*VEU`Z{zj!?RwUBJ$P$3^_5D4 zf`Wtt$OhVk=&m$4x)a8Av#7ha+$qvhB>_7NL;}P($aQ_b14u`j{==VSkQs%$rnUg+ zu1VR_VWTePLQ^9sFIS98YKA#`5#A#AFATXuV4w{Cmeo~$(|Ori+tKgS6PCbf@yBKP zm^(L`DK~clrW*cmXDuMpPrOY@LTR;$2SRK6LWQ!hHaZE+1_$l0)ecvJmXZJ&fG5&d>EEh+of`(oWBG;ZK zXy^9aoqN2{^X?QeUKZS^cppaxoPOLLchMO)JJ2&B-_p+JT{dHU z-fb@j)ZM3;9$GX%7uml6z3OrE6uEfZ6?=!nqWx~WJx2!=)9Ss6lG`?)WRo^5_HO`4 zlfzP*K>?Q<21V2&wQjK_EkqHn7~t)<(OPIVD)ZF?# z-MP$%@6}BCW|+&n{51{p)rLtxvJ5^q;3DTR=ksW9BDa{tgA6G~J`?4xXP-H0KlqmT zJtX5{&bqoUn39#+a68PrXch}J$P==z<0B-se^ybU)lnq`Bw8gj$fQ{hf9{iM=s&&h z-v9RY`(~JynSsQgleWIqFOkc{+Lg^_(x1j%gjyCdt%w-#ao}_zSAabI^At{O@gq2$H>Hyhd2fbi)V~y4} z8%ifetd5;*nOMZ6BZg(c9s{HxUV$Urz+EzaVKz|}IFJl74re%*l>qcNW*PCb z1wMR7?`~&;X;gr#qooNT4#H zbF=VwLhsXVaQ99bZyM+$`rVva2>itN-gxdsM}G+9!_Z=QaC z|3<0d^#Hs-7|7yUgu^c)B-usOe||OCttn9eHYvd={3M-a=xV%Xc12&ix}M66hu8Ip zrjmN0!bk|{$dJH*Pywzs-5$Qg0x6IN3Ez3`U$4!?>!W=|%(8&*uHq&iHPvdAl^&qg zZjGV4-H&@c;0@|+&r&aZs43Uk@73Zg(t?48vCg-&7Vc4uzkGf7+n;Zd#E=sZMZcmh z)_KQ!{D79R#RPuQ`2<}tQ|JQyCUkGbqqE;|AjG#2A7H$g@G*fF( zFb2J`u477Hs{W@H zDzpm_g^Q@r?Pj5j)8H+ZQ z_ewfha0}=@7}qdT5PZATCRy-@DW)1LZiGLmRHAdFmksGR z@hnT1F)R?yqGQ$8diQ`LlkZ7ad;c!W+{;zK4KbUcd5QP|Fpye%g)V~n+TcP>Q_pvf zLfjxjW2dhleu|@*)vn&(Zc~b3smimw#s}g+l|1`$fYfqZ>LPEODI=zBzO?y+5=Ghl z`o~{CfBN;WPe1*|ADn+lz6%lv4*5%R$CuZs<&nef`FScV>G|0&$&mlYm;RY_t&%Kh zN%>OW3PO5&zG2Y4K@4Mnh_AQmZW7?F`kz?7$dMlsv zLheO?Q#C0oc)ACun%;{0%s9w^WwM`&C8;dqkc`H(x``@9G#54D%v;*7*DbEM^|7xM zs!*kIiK#a&!s2ljw-j@+w#?9d>1s{rT;hsx$HD5zCZASAGa3KO6b(qUqaEUORbI8R*TbP#FNOGZ)f@o?#=uLV5c5w&Gz~na(vY zm3b|n6LPLj5^SpoD62gkD11dvo)&&0RMOxF0mmzD#e%R!D7dO2(Eg9F?|%OMO6Erpk3(+l$9BoH6yU4F-nu{o1Zu6~3 zhrrjVxY;4;t<9qVzM9lL`QprE_J&*QfB0Io`HsSKUR1aAwrnhbd-6)ip$R2|tFP>yMV?JnC9(oI z2DJO&hIxywm*{dj-5j9VCH<1$1FaXjdKKY=2nj1nmK)}#6y+%%iajb`8r~!?bJRb8 zXv@!rQ6@5Jrs&CEMqU)~oTFdFdH!`O6#IRkc==#`er7r`uH$P9=( zQ3>+u3u))H;(COIP#YBFqxTYf{Me(5DFwLJiNKYL%kji}j#+a$@Y%+6ruP9x-nb&? z8!BAoz>)@}dJDc^rWYH}d_T#83P5Rnfapbry2N%(Q!A-Yp3~J+sie%`p9N{hXm=ZJ zET`wmL2JzH_5mh`X$F7b(apk-K$`eh-&ps}BwAYzf-Bd&2$wCTVc(dQ7%Abf!6$@L zVQ;VI7|iqP;$Ge|gA8@qoL*gpkq?g0|4^oBcPS9fbrf4Pzm(3$z0c`6?Q9FgTNSrcEzkE z+;71YXTi=%Hu>VY1&PkDLFfJDuB;sRA?)#bn5T3e2F^~gfGNG*`>eSzkY2(GRKEks8F z<6M;4=|5Nl-s6k7)=>EsB)iS8Z{MIezPQ-=EXscIOv2*g5;In>$=3eZC)#yIq7QO{XOZGE9o0 z^`|PQ&_^o~tXjOJX>x`yBs)+Wb4ldfXs^0+>^JK^78u_pnX4Qp9uqN9-(zCE0QMGxt)o7e=&AX%j6~lPDg%q@@&dXPGdE&)?lbF zkQ+i`dW##OA3Qt4q-Z}1;NEb_57f`{zC-F}*~bH$FoEwz?ZhJ#Hs|PMVWZ=n&B3CP zPIUhR@K<+dei<5_YOCvCx`kVn86RGOy9tcnxDCV}&R|X1DkaQlyS~iyhgdk8W&^@- zs?F$BXn+59)9X(6{&?jp0oS-Qo_A4VNLJ3-O!>Qr)8_mXe!LnWA%s|0d38U3C zXmM?0DI6~awg~1lZ~eFZWp~+M^p);61xfdUF@2H;pz!^?0=r^Y(xo!`y{~WHefawM z%`cXu1wU6}^yC1dVP2I^aE?|w1h`xRaDhvp$}W$4D{SqoMB271=K7!_C~Sw^zy*2Q zXyH9wA?;#-XK4!4>OldvO7STd-U*4L7|u{}+%Wi6yV|HL0UX@`lN>*STC?(wKiNCW zI(jc5Kxp7{4MVR@zGzD|V|>vhIYCQ41jnJ%Wd$wo8eR@HnL*fXu1+;JE%*`OPL~x< z0jSYH0eP`{p2{1!QF!Fkw(0|1Y5h>bcx@097@vry{)2#XVS?i!0EJ0`?ka#{@aCtV zcH4K~n8MXQ3|yBKiPGV@inDL`u)X^_t*59FieVLBUf)Y2T%llJabHkC)=K zxj`uF3W9_hgK!Ei!~f};8b<#9&*0rxzfw{_2EOY*m5y#9NMG;nI|+BfU5EVn$Cu>v zgK;%VnYhD`x3xd`7o8j76XUacd=bPuoET`>2lyVn#Nohrhiip5s4oG`lq7tydpXq8 zPyj?`#VA-A|HqgAVBr3AI3Ibf-9FSL2-ne(u13CVbGVwpkDLDe!Ir#b9inMA#XNvE z&2H$*x8}|Z05^t3f|NVw2{Bi)0BJRqjX_?%8gO@uk)CY!)7{l6fw2a-m2|W(n)?9_ zT~B*NIt^~QI4;m1AcVZ3+Y{(G1n})h z?tcI7?wjv_-~T=S+#?S-=;ej)TW9gSp6<&rz<%$u<5)r{{NB6z-mnq3&70pp-0;rJ z@$e;i_W^JnW~fg9*VdFVzWZtB2QWmt!x0Dj@5TKFiT68noO_Dyb@LtCN!PQlNS5^b zKE=yIlN;Ge17s_wRLdt>E8~6EhVAa5{keP0s}LeKZ-bpW43P~0?q%dh;4@oVdN62w z;YR>TiP>x?NAu0^=puuK+V{&2mGFWLLQYgjp%|DLt@Vpr=xC7nefu9zxILZ^3{dfX8=a%e7EP{S zUg)-M+I(65;Xho^tM|)PxNFDl8!G|^TRA2uzH3T^*o!*dFZnZc-}aWa&8B}DPnQTk zfBC=v{ojl*w}A$C=ZDbovoW0xy+J?!h>^LnfGR#)6-ucKL6wGS4+F0hx3L-R~uX%eFtv71h&MSk3&c~6C~n(JAr(#h}7^`GGHGY zzz%10LqbtmoFs-^)_Pz+4@1sLoSq@veBlE?5HL6%SJ(&G#{uH?n0WmuI;?=I`30)$ zkRSH^m&uGPPn%exRv!DgpA<<*&KD`D3TSIBpveJ23vPsx(c}r*rTS&=wrBo}q;}eV z{`wmM%B>!vtst|e2DD}b(28APGc5hwFj&y{73f1JU_n52s+dyOibD!8i~D}AN`45A zAHbFJ_%k5Sr79BSW|m%X!V_^ZF`EUlO)}8IVNtPHoFbaq_tR5zc*bbjPsQzZD%u+; zeVJ0N@AOmD^Rwy4rJ~Ov0tN9hz_Dyo}&Hv=~w;~p{szp-Vb-*_zI^F9R|g;6!;+-ca|0mi-6NJ zSA}~`bzqPu_=<}vBFYAWt3PbMs3qHuWF|WLPZV73_;FgG!3esghbmWxFaOD`ccOBd zC%zf5_P+tB5yk@QMTEYj*8_rPX}HYNnQS4<+~l@~?4<}LS1t&C@-v~PDN+D?!m7(l zrQEpbdWG`}%0ba-(;BIU-cGnO$bo@t5`mM~aZt{gdzO&7#~?6DIL*@Zvwb0^kR>J_ zz%ks)jigtUXq8A{#Z*4ya#t_%ll{fH{NHwaIw>7pX}`kFEwx*}s02ml75Hf7I7;*Z zbqtok;w{@dB?^T~u)V*=eslo_zJEbvDItUO`ZroqTK1&@u2s1Q?sgB1w-1a?Kk)d# z|5{1S*wBT`bNigZafSF0Aleg}aw?yh&jz}O&U!%6WfhCI)cPQLt-(*w?aBan$7@=$ zrk!|kZ^m;0PAeR77fQKT`>C{eYhS*;eR}uH+fUz==vzI5w~e!;hJLdJ3~wzc(Vfu} z;fpcz>Th$V;b&0f*M`7QxVl7IcJmnXPH%qx9mCa^ufOcim!Chp{pBzG?4D@}N0`cr z`yzYo(Wco2XgoictgX(Yfn#*!3wH_q4*|Blk|LF;Ah%(LjFH&@Gydaf+08A=#tRf$PLOh;41^ZPKfp=)vOqiT z0CcIr#!X6%P%*f7nGhW37`CmTh8BDf$(mizJ3huZ;>~XboTDVP40Zsi5C!q{?%TV6 zyk%mkwbu*L&3aoMBlNj5b2LoP=&y17*KdFR_U409WY$BVGaL6H18L%c3^=kGG_Dh9 z{{Vol5Bouc%0avTfI6`?;RRqWhe&1>Af&n{;1%ueZLc+EVQ29_g;#n&5wZmFVu$tv zM=m8n6f2dj)*RH5I7eoH<|uITxJohs46yg%64gLwjf5_1bce+6cr&P#vAl zjJ+;m6S6d#Z2|h(R>A|axpuuGP70j<5OE3Q;>+hRpa1dh=ilSQHookhxW|+~cF$I= z`cA7ugivYwl7Zg|wxAh+W!tBCq|*w!6~dL$k|A5rW(Ng)WaE_|O@bmKiS(bS^oi!5 z^#vuYb9=2u0c!e%6!fwM*o0U#J3;AB#{iV(1$G{RRinGPaBvYGtjqZ!q{ZCY?%Td= zmyp|b=7%tK-B<{qGhA2TbJM@4ue}N%!l1jC%46f!kG`bGBM+_@svnHtyRzUaxuUCa zyGoB$E2<%(yYIG?mqFS@Y=B|pOIO#6wdT6!M?i~O0WG}_ACFBqf_5l-sh=>1Z4xANS)d0OeX!fpi$Z${Dn zK~`amAHTC!mGd$U{^k3bL9gxW*3vokE6{YCsWXiaP(Ck#RAS{Au8VUlzZj}0y$SZG z(_WPMR~G%Xbd?FOU0#*p6?253MD{sr|NiD9uSJb`T%k`5h9iqLby>3TtOUb3lyRiB zvu6~Kl=*4fE02VAS^>BDIIviZ`ScU$f#=<9{{ z9jprVLVwaM$eQYMEq%FWaPd^Y2vH-U;b-#&e-d>%1j=`S>z08u`#MB@aYS@stWGt= z=DtFeubZxF%UeQ<4)GpOM0fc$3%)L!QSAaE7W!e{&cDthN9G#xO~;DQjvxAEY-Bm$ zSfF4bhSW#|aX3oaDtn+wdf^vPh*GFjM%buDWxL-CuH5`=eHNuFgD9l%WgEl+;(Y+> z$L4C^Zpdyae$aOF<-?o5e){~ET}gZG8B|M7sd@&PDdhwO{Y~_gbfdsnA9t~(`EJ!*$W@To<1g#MP^7fWhG!fi< zdH>VLU*1!qdw(9k{`m{75&BzolkvAaj#D!DLQww7`@bQ(;9}*gEvxnAOL;sTP(aY; za`kJBU_pKN3xNKEl``(mdjezDc!H+?PeyVk0ZLstv;>;W#JqrPXPBZ{CBVqYXM-T; z@+g4e$|{26N6=P|FmUB(x8ENQ=L5e&S>rA}MKvo^m++WgQS1mDGA2R^-GxV?@AL!Y zFM~*+tvVQ&gBnZE>7{bmDvU9XX%$IGDGCP%fG#{p4x@W@Y1{ad(k&n*Vg;}#n7|0& ze1-wz^MyohHYUh88TYAvt-B>t5`^fNa2WSmw4$t|U{rF1Jt?c49#>ZB9K)|*DcxM^ zEL#5M2AYup6!SpA3KWc$fN2pPpT4woDLe$_OYW)0V7vM9?&BAJlwz@XR@#_kb7g@x zCLCFcUD8P42W7MA6%IVoMSpqo3l$wCngMuU*5jOwm4Kg(W(>l#0spEw67uHd`->q} zg)aoVXWhv+KLgk)pbmel&sJ;Dwb?7H8ALS_$iqU94w4^2H8%^NkltQZn<@w4W=4+R zLreQJiXMdDikf?-0avPzd~Mg>x0F@r0Iyb`hVh;nXaM%^<@LHSOrAi>Pk9YdNEuX* zpN$23rebZtHsmvmnP`pge*X3+v{U?)cKnA>)l&Km_AA5zbXVR$T{Ot;I9ir?GEKIk z5SCeQD0TCo+MJ?4WTzuT_RZTX7+?TgWt zNlC}`-oB_qA4z}N^oTE@Uvxk}maHUzLLE9CVMmryn`%eD?+XQC0f#IB1z`fN9l(#_ zM_lxBTxl0T;=Yj`m9oIT0O-}1@zId#CUgHx(zbuV(5QR*{ms{pZ+`yEQqaRueWF+8 zuHhX7tcXT<{CqBak3pc%zYn?o0PEt`CTuz)J*V~<#TV8lzcBtRL@ogz(9c)jO*_6~ z!+49PWyqhW8Im)9oJM{K!<-hKprdnCBRT63VJHnCqYk0E4FTVhpS-mIzzfvyyNHfv zqd=T9A@puW2^zJQ{^H z;Cs$6(P3=Oy^SP{wtOB&P?+vI#W^57adFEfFUwCsX${0dPVP`S3u?wU&Q7((po zSBT;x>*Muu_0N0=Z|m8Bo*zQxtYQO_4t45FASBW2CI38-z*vr)MgVEQ7{J^>e-WsN zxYELjBA=bk#mtnH%LFX;wBo9x07?>z1A^47`apBND<39FZ0PcCYC40VzBx{xdhVg( zxZ+(qPxc!j4zOiE=2FwzY05is#3oqxY_yFY6krG`nG_3Bq8b4~J68b!DAIn(nqQ7F zFP?D+Dd)Jd_udk6BgZuCQwh1^!4j8DNyBD-;=D|JJ>}3n1D-CHuv{d8p9_aj_ z(}VUaogcrRw7hdcIsaMrd0qGM1io?yc4Z} zPs+@M5}=~&IPuC!D#ag~4N8c(9F|sG>5&wzhiwhgDzTqX$5uG3KcT9Hq}`gt9zIaC z5{JJ)rw2W*zYWJZs_Twbnp!wC)v3$95%-GdsNw}$tf1qjD8}HOyxj;bZq5y~P~fKc zu%)=`f`i^3+T<*i&uQ;dEpQqZA%wjQU1rb^0Z>84@dt87FfdJrSI$^vp-MdxI6Jpu z{J`_&fhTCPE3zLBtl9XL4-cfSx#A;nA3bpQOY=(m(J0g87c z;LJNgTM`NKB1^~zZz-PJ$OJt*MF56HZ~0H8^3i%-8Uf&VKAiJ#UO+D zK`c55RQh8mEuN68r2@E+_2tdicW*y^d#e%Vo$B7bkT=rLYC0V#r79M zqUN$1E&wWXEKe*)TZZO*s`bRB`AF{NLXawm9QoZldoA=n7qOhPOpc}njLgt;9!v_D zOPi3xh7}bJ(({5+> za&MwJIUeThm(7>M$6tnz1qxw*iVo2M?P`BGn3TBRosZEm=34ZQ0nvIr!mf<_$o}Gs zdrn?%FMwzt9q7fbj~h2uG3s<|^LLvs@j2R>u~Rfgsrsl$laZX3j8MB_Y^ymU!D;%JY0e zezxcnvn@(!n{Bo0qu*`|DIVSZZf5k|o$G32vFTnH^cHC2-HUJWWbua4j84UrZR9nq zyn8{xi35Tn!pTJ#Rgur!xJCo}Zr0LzOwfKnL3G`Agj!oy3GU^751?@1hNtz%=)A&d z^La)UO?95^s7AoR_>v2Neq_-6yFZ)vZ{E&Zq@1Hze+-McFra04H%I4d3z@g$mY@Wp zrD{4SLO%oAQ7MpJP%PDk-2_8k3CerfY~<{W{!0jT-QkMki@$ad9b~&e*WVEM?=n#U zF?ul?QpW&ej4ReL`q)_P0jXn@8Uy;n6i`d*2D(Yo%)jFGF>~E8D1;E8FXRlQGj~G- z4E7y2y`pVl=)-Fsko7@Jrr`o+>@%&wn-W>& z?(Qx_DbSf3{n&z1$InI^ps!^e$d88=;sEwMMgdOy6?Op*=M|0t;`KuD7C9lX&<0wb zqWkL5UuV9&&27ot^fc4(m4Kob0A1+*5N$qlSiM1t@A@z#8DLcGI4jY;L;}r85UyO7 zA*fp>DE=zpeB9|^wlY77G%eBvL2JX=WSR;ID!K>k+7}2o7~i|LSsGegd~WMS+v+;N zjq?hGyc?Eo7Rr4zVINY;R*&9RcyS%-B>Lz{d23PH+*Jn9e}q;WQ~?yoC;D4mS-`nh zJCGe`^?Zq;)pT6i;A{c_eOrrW1}PBTe7R9@H;njzu9{oc$Oc7@&xZDeuD;>+%@xJy za8{FFyO$P1RM&9U9V1Z3;h4*C_;YprSQ<3tK;d~FoPDRN8-Um2yv6mp0#vE4UeMEi zp98px4I$v>vq8iZrwxt)@MdcKt3MmMe9IVI82#UK$r0+aL8KJPX98{(HGm3Wpd1j` zT?(QHtOuj>53mhKcS}uR-Y`^x{6yiVtFPt)&j1oNLD9tphlt}5-OzDECSiO$jc+Tb zT=~jet3S}|$O_#a+VGyGSo=bg7l5n0{1Y_U@!4RvrmS#|1Dq}^tY;kqnAICF8RiCc zvCbA*qXIaaT@j#;=Q)AfHu+G&`Pb(qy zyd5g8I*Q7BCgJI-w1b3*CWNLpxC$dov3OUoIuy-vW$c`;D8^mP{oPP|Zqw|twySE03oRW`t>4x!EOWdlo-}btg=~rPSPVGfH$9`> zARD9m`uXYG=YMQI>r3ObYHzth+GtEj>yoYGyi0C>M8o~>n=b0&Zr9=PsE)5Y2iRWD$0J(m zdADir>5@4=Mf(jyi7A{I{?L8Q2xuT4OaiY7z;>xI#N*|(7+a?C%(EcU(=PebKi__s z{(L!Y+LyHNGP5ghpSPFo0Zso99XFp8L3u)l`Ly9YF+TzbV<$n(Aqjx4n)jG#6p4-( zkPedEH;k-qTi8Xc{_RZPWT+kO{2e1rljBC;Kl$Q}JpI|7;=}8|@RR*ZK-v3_VZa?P z$3QTs3!exOL77s^Yh-J-I)?zLhXLXMyIp{IJtopIjvqi>Hwr|NIDsZlD7myTHzHH=OFX?XuZZ#D} z(%y=M=Ul5>cIyN1cVODyruvp`+VA%$zTI%Q@87HVh0&4R9-fDzLbn@^v= zy?g(LZ?}`7(_X+jhSKTS3!{f6K+)zkM+L3Dk|>1pNyZ$4-ULnh(~4^%pMCV_eJsez zXUB^|4!@SXC=Ewgy(x~<`GPmJ!AnTVAD1<Q*_0oG zS*sf8%3UV22ZMwK2Fd?buetpjx33WV$W=iA-yIKbT(;jvtXh;Ra~h6|%BDrE>d5kGotn0R-y8lt0I7m!SC1>>45Rdlw>Ywtpn&XtD3Gj z$0{&|L*jK@y5)jj+eMJ;Ccf>6jf|&92?u~ptAE%jwCDDm*nju}2~mA$8-&HS8E32H z^|;%{&;{BGQk7CFJmraRvsw?nRn2g_)yYD%BrT!%98ITv6R*0Mizf803WjGIFf9n{!UbYwOdnQQ8NAXP@ffARnH<;Vm-%UgF#YZw~O2)Gf#fC896 zPcK-1iVgv`>rdPDr)~Jjjh7WpD`2$w^zP@+AKpBLn>jUSh=Uo2Z~#M_3Vb~c0q6?7 z4a|W{kl11JsY5vKRYhoNp|+k{lr;m&(SnoRZW~8>wt~+cK*dLJqk0X)$8pO11Gf*< z+Y2c2n%)I@O%oAv?^((WrNeSBrnb2c6cdZv!q4VYkuQA$>9OEIf-mV%Bv*QJZs`QK zzEwPAuF$czOlotwx&>r%(AE~*T1yGENSyglZLf2Oc2h1MLckT8*uY-mnj|s(X}0;j zn65lCU+$Vy01U{0lIRGVLq`6bRJYe5m;Zw{@AGOLP_%hF4v;7Ff#~U>O=lHz@jYes z@}eD|E$Oz*c%&^cHy4_sHitlxU+MD=e}M5W+gIos{8DuV`ol`&79p1H0?80R6k;|Hjslc3YY52%01lwocJ9vgu+ zRs-xmQsdI`nZO+bI>`6WDfEH2-+rzcG5*(5XE1zKdl&gePd)8YNuYl0>2Pq%m&lkj zt?oW#`~doCZuMRT#}!zl+S*d`rqsvT$N|TlDos1nFcpAGSm>w5kELE?^~M{(76y z^y$x<9K2Zr^ZRpN-75LM)>paM2l`{g)uNUbY!-s%(~3w;6-LE?0YUTz!CYeaM6j%- z>ByPuPj7$v`sV5V8>F~No}E8=*G%`%pEqp=<)~nowl>4{D{5w0f=Q$WC6(5STIc6WR$wH2PgWrr_Gk zn*>Ua0yYE#yg5PSL&{d?LwqY;05`6{q0$KB>8C(zk`1XVpZ5R34?G*C;o5C!d9;;Y z1BP)EmG(D$d8D$}H@K{@Utt@-1UaGBF#}rBK-G%uKpXo7r;sA6GthPyN9^1j#H?AO zEXi^1N1*ybkVG!h)dk$H_dwPaqHL1d6{82TD+;(m$i&J4x8X*ioNbz@fzloZV8?Lna<>961>LZ-zu`+Yw}CjDAvmu<=}&-e>=S@ZfhqXk z%R*=rw1LjQNB6=k$OlnD@U6X?A??sr8ZbaSz;R#mM%zif229tV(be;`b}FPPxt0!# zy`Za<^R{)j-B$02s!q#F)Mn^%n58yd^vAGPo1<5-tU$qAl+Hsd3c{ zB{as-uG~;Sc5)T{Eiez2&n$bD&+K6;YGM58R<@E^Tsd$in$WmXoyoOK`N#E#q=5lgdGk%}A|R=acz+!8tOQOk?g-q^vsjxp{srx9#TB`R%7)_7ufW zu|fuK+T*j^FDW|E<9WZ;l)#}l_i2CNq|iQM1wxI8cRMs*WHTz`mNV9bbVso%LT}X2 z6@D9;Pz!L;6tPqy=vt=(9(-#viv;tp*lxSi5S6DEL&A2QW%;))0c zphc#LK$~OPaW%_$uNa6602yprR!|DpqK+%X0zb%o50I85rxmt5evoTSM`}u1{{u>w z={GZw1lZCR0M&~-EgD>JE|r5?wi5x^?u~Rl*96P)Mqi`+LW=}J&izFIy2kAR1*4|( zDe?hAO2(_@sB87YiztHBZu9Z4Uq1i#^yVW{xKvv5N}0@zcw&YtP{3-S2Xwg#0xyG( zGzc`Ya&-{Mm_oO%ouFo?*evufs?nucD0$L^vd48_Xmb9H*YKSDJ^$z5QJT-^y-Sk> zus=Rm%^jU)GvCn>LtbmeM%jHlag%!S8U{r*gO*JulY#;7ToqP>j31SDBI&+ zsikL#KTuk0x@aW=2S#RK!26q=z%448p)a&)!w5a3!Fh$#B|!9m-3mJ2X0iayT%#Lg z)M;&~7wC_$a?K*hv<7Mv6WY*d=2jjw1PNo@0j`<~0-!g67Tw7A6r|Z^ZsaADz-G`p zQJF6dpO+Kc2e^}zgQ&kU%?-?G$AD%Q+I zxCRxp<|1~(eOXP%(@y(iv|~G-UTbJjs3=pLl&Z%Qm32P%ly_(|DEY~~(8dE(tdbdA>Vv_`sK~j-#>gsUBz=k3P&f97~IOqAWKq0fzEB(d>qf`!yc9I zJCTrxKn8u0BAP;E9J1wI_F;3m*a?MoR>P;~=XG^UjV>T3v^+NX~%1`#I|LCab( zfJ%V?iO_%p!~mE;XTRrfZ@<2Yn1ZS^(Z-YQA$%cdD={JMUN`^=`0BY32I+`kn{FEU zs!6*hVfVr>nb+O9qQwF5qfr!+SYK_mOHV0Uf7|M}zVMu*|M>aqm*3z1`NX7Jfj=7h z;i4BNz!lG;)2>iYb^-LTgx&g6d=9W(e`23+pqqKlwFp|;0TVRU-Ei|qITZp_9%nFE zwHh++fd=#p>de#nW8+>~P~E7YWCYJ?cR{2_>;`WS4XwY>d+gdF)X9#1%sT;N3<$Vi z9mVkZ(@$?Xn0K1R)%p10%o^Y2{1E8Ogq5~S!|mHeUZ%LKd7+m{m0!zE1YR(Dx`7l9 zex}$V;?xX@o*f0(u8H>?&A{@cPC#49d>}upIF@z~ns+TnJH@yDYQT-80`(;T#cd}z z#%&k0&PobcKPzo~_U(*1v<^)Mj4}G)70MOV8Hns{38A9|iXK06{0yXDhtAt!9bMlj zBOO14$}e_L!Y)8Q2as2ufMtMibCB8|A-=4z{qfd+FRja1MYf|IxsH^5fZlO7Chz457FSDNfCjU^TSGV9jk3Mx|b`*S1Z8EUZO2 zy-}IB5q)QjIl;wVBp!Yq4QM|q2n~$UNmYvh|GoKdv*G36DdZs=!fi6&sWVmFTfL3U zE$cyUvFAhm^0}Z0b%DAp#wKnEe)seSDUCUvBIHi>t6^-V@DeiYLwWk!A0Gvg;m*$_@7~oleZgt&0!wK@jeAEBOHwWhmhStyr)0TGs7yz8LxE z-SNCVpCk3Fav{d|0yzdBLAc=CU+z^=EWdtk|Bi3jtO;HKWIwA95Y*Zi=;@AbY(Da< z4OTQ1-W>&vIY=jepH;SDk3d6nvw=cgmy9W`#pK6^OMwEfu7;rE1MDt* zaF?KiW0T#sX#~yhWBaeyZ||W$G_Czhs4iSfBlh_PEWfP0KfR zb-A=RbURho-pZsPY(cniwaag>-(NP(?Inq}9EEN-Mj2{1AOCO*HxwWx-i3HwyiYkddpd6u3=qBT|aH0C+yQgno85HRwO&--x$@Z~6 z3mS<&7Fx{d7(cwtLkhdca_w>r>~yEjprjjOWsF{cPv?mBqzoQ`35sV#kcSUZg%58t z^1r^<4Mu3F0ifL(a21k}(a4>kiIPV1tX{XY7&ip>;wpoS9aCtgPM}4=mG�&ks_X zALu&1DTkTz8ljt>Ap)?7hf01}0i{!@)kbc2D2tYi;jy!njJC;uU3AdB+dI0%XTmhP znHRE{-~m|uOPW8lqafUuYoT55MKT{2XrP6FJI$(R?e)c#O1YXC4q)d`@XL10}|24J_$udFDSG>e;LXvs@I1P z|9tb|1Kuf8Xm}yhbXu_rOp4+bh@tNT=#3IoPy~*?0%e_`5+_7^0ThicfU`>{3_?eU zX_^D5Uc6dBO?Oqww@2}?RO)P0aMzUx3edAX1q>CTwrDs_SRv3hc1di>pvclPipT^gFa%o7>8EOuCTM7-%_!ovrT9hFOmGOW-v^)+V6Yw&ug64| zVgm|21Su?VV{-+ZOcD9>3da?;%y>a>Qz3;z3S;HI{qUp|$0(f-IV;6=!py7(jblw76@|oh5kMYucc7BWwBlpUOiXQ%Uys$jkcD=*89dP3511O!A8$8}GC{1_Gg#y|R|G=2o7Q;9;T%;sL8{ptb+s|~;# zj|D%1%I$dDu(=(;s9{c!be-m&18%tOXL)5~rPrOBvqglo;98MEy`%Ks&zti8eZoyl>40H>a0|VrZ0GDEkwquo)e@)T{w_P!G!?K&cC*ipnL( zXo} zspv)Ng-|w{HuX17qqKrl(;r?EAy213lz5gA$K0F0y4P3czfhq7sG-^eTx+$fkBmaw z9+<}~L}B)|j7O+B3&0B(o(Rt!$_NL`MT$~ddcxAyGuK`OHpB^3VXtfRyShpPEC5Q$ zU66UJRacj|ga_q}@RO^!@y;tX6@a}zl!3h8;VGW+5N%f(W>rWtUDJoHQUp3iCzLdG z6{MYVlWG4?WVEN|PYCA&BK?%h(FedEV@`i@tAsY0HH>mvs`hD=X;+8@+>FmWr7O58 z@zjV3ia_@9?VE2uQBq^l<)9*`t0c;L-nB2%E-fr6Z^F&ts$Ykf`S^<0l8uR*3P^!j zb6;NTD`6goYfYH4>UJQE{dbODS;OdW`l)N^&>7H9v^FOAxflr)dS?No+?$}db5$^F z>N#b_1t?lkLm@Wrlya@P<_@6uu9)DaCawhKi_f5#afJgxyDu+0Rz&y8K%OJE`SKv0$$;RgMCiZ-c{j{yo{5jn>)Lvx!d5ou$j8q*M(Y^|Be}5_ni9aM$&xkz z_|Or0z*1$G7IcS9>_2W)eQ#B!-r7J?V^;zsb6;Mln&vbI-uQ&dcii2b9_(~C=&Rw(<|m? z5cM8o$_;D+MQSI|Kcn7K>aMMF;0mpppbc=>4PoguF$1`{R*lPutGXY-e^{LwmMeE; zK1h(de$YYmfvprkY*3eW^eaDvXZogA69BdB2I7+}91vs-^sqZh2l#OpE9Ily*3W*g4Z zG>w5BQ)vBzjC-;4D~9$v zRMF+2;;Oc1d!TZ0VXzv?dAvsfPO8V!CX_OElp5vgYaQ|jO_~b0_G5)mcGffjp+$ns zu92uMiUw+0g!9=TJR+*$xLd(;(fT0@DU^o<7%=;Q>J$j;mHcr{u}Vsa14L_z6$ssM zgp|yA19u5`bKy|{;b6C3*{v6J$MxX&xWYDiq;1y|<%Mp=^W_Jge&FE;?jLwMKJfS> z_4wmrD?E;~qZ*TspjI0g|Pg{t96NPkNzl}R@Uwm>$mhtA`q8SnsQ_DIn{Bt1-&;5 zD0o`l3hjJoxUy`Q7kWG4+E`ssL^!+ZwUjzf3(D{a`QS6QEP+nb6uF)=D{Z6zBy(*P z#5yjJCpsvd>2~+yn@>Og{`Tn`uOy!x{0Wk|1j^P`;fZMyXid63#k=^p)4N`~+r~Vq zaLJqY9GtIkwn!csWqLJD$qym%W_E~+27^EnyQ}D=@w%b@Jq!4|E<>MsouHm;`>mYZ zWG9z2Ir<1VZ#lmMkd1tR!wUNqVu38?0~}V^t?)P|3UFQzK0RPPOWn0#{pq-#emDn^ z{8B%Mms8KLL0qY)(dv8+2}E6C-Ie--CqgqH7Ns$0s@^>VB$bk(6)K7MsVj3%%&-Rv zY-i+~@~&aLMn%x5M^JYuV9x4-HUtE(OW>BCR*y_cySmX&ZW--mg79fXP-rGWVK1|G zSI0SHS3#z}P#q%Z5e4xICL(xymWTAD2?y0VsE9758)MuJdq zWyZ*g0uF})uX#0r>MHsv^xJsALgr1Xn?-F_P>y?hG!0R>MmDneQ+KM`0PR0EG|7vB z57o_FyDrirTp|7IHh_k!jDW5#rCveTF&Pd3ag&|c6}@g31(5c8g(#$k%+63!&eaSE z0tJ=v%3ZwWGfj-_oBkNe2u6UjJ`!xuxpMI(HV9)3N%iY`?Iye1we-LI5)5RkNXvN7-WC``uXXJ*G(IRjHOW+gCD7{A#w?t?rAiPz4`g~&ls4Q zQqc8-LF>)7H}DFV71#-;{zYaNfY76*7R?SosjkjAQJMzhU6%%HK9?q4SM`JLWHY}q zZJRWckh*?u?WZK4%svq%XjLu4?lm*etZ5Mu#Jve4yOCm z4T*|!SH|)$U3_uPatvJYetV@y@g{1c=RKA6sEM0hvu{veqcW~`9%D=No3nM` zC>^%rHbcK;8}J`{Np58S09E`3nkO9#u z!`dE+^~%la))jzTUxyKuSWj*7-DrIx350 zKC3)9ggT`-MM$h?D1!J9+WlqE`Z+C0s-2g>uz4Dg)btBcPs5n%53qi|6}LXx9+9Kz zhO?6Igai-S0J1!7^Y&H{>1RT6UOlDx(k@V8jOaA&!|?mBe%Zy)#OtBJlkSnR-u~Ux z-O|+#Vo}|_c3RH`?9W`>{LsBHoZJvS2*15R4E8l4>6RGf-aSu@4NCBMD<{D;%-(x}iqXz(Gp0hpm8uYr>9v}P{ zh`nTozJuaE!5cu?;MTRe8>fP^`m$@}9smM5Azpjj@2tP;2HI|Lbm9J>Q59k+F~YQh z8-wRiBQ&D{5`-rmosC7=3$)jn06k+4kmrIc9grUE_#BxQ_@T3uWEna^cy<7X^1AEo zKa#)OjS1{i*elypv3s7Y(ed70AI00#Pb7IYCSZJ`pNoJTTRKMn<#322P?b6qL|2vD z>;6wAAte)J-AgNA9GDF~#A$m6fzmKLM`F}05xVw#3~)FEfLQY3^QT`v ze~K^62vWAE@RQ0FngYXbs#$Z(K*MV`iOd^md{WuP>ot4}Is6;YUR2%65El?)s*Bq2 zW6hPO@j>VlKY#e}*O$*~Uai00ht7?rta_A+n=zIb7qGIl(3;U#;S-6@8umH{BTxe<>_5=; zHJx5CV1EAX!<%pKJ~5?abddN#>H~j!_wDV^zblQ=XIDs_s4Y}@(j!L$%R98X+IIn5 zY(VD}=x$$@;lP@n+r(YnanD#PC^LLE+{qxbdP0nDb|XinQsw4yO=Hox zzh<;!L8RtNP=*q%zplWal5VtmK`Y>nxu>$mm(yIg`i4h2NCH-Tf zSzRXl2o8rma!}pVYyONzP~D1ao^d6oW|&nPd(>63EH{h;xI-0PqB!E)x@ouYa3$q+ z{yn{uAR=&%vAzu$_3;6ZLGZ8A}&)*rY!Ga$)GNm`Cgz0-*CGt1~#IZ*J?62&S%4Z+0 z#O?SmWdO#42smhb754KA>v8NY1?n(F`TASF{zh3ypg}|=kwL_fMi5wr;B?V+N ze&iA$zi1&kz|lY!>-?j|EQ9Sqpcz2}ip6D*fsJB7+1svl!l*w$j7z0Ty<>18FMz&0 zOp%bT-~~3Km5K__^V(N_2=nXferv!jEL=^gY5G>noizpgvSt6~Mb&5*Vl-ejAB@#D zAaW5={SOxrr4CSAckM|)*+zg4j~b!Tjw3!dPe_I+DbXyu74&LBZaJ@@Y-V0-79`i% zv)HUt&EO7os|%QeKSFr$rf1Aw0;4=3dml(Aiq<8!&r$}X!&O>uf1r~CMpQ!zttr`h zfC*lM#zRh0;{$-g3t6-l(KiZV=7%tJ4SK~7W!=m)9IP4B^`$5Uo%K{`$Ys;8k#dKC z%9?gk?F#Y1AUsW7u9XALf;&TMZlbt)WngXGl}|i7YWb5GR5vPf^Ha;sp)U;>@bd$q zRWvH4;g3Pdz|q{YsBiK_AN^n>`41OyX;BbG;V2rL0L&slRMQ%rLmS1ENo4X3AXQJy zEnD~qG@DF_E|k`wtxt^BL};Wp8Z&Nyz%g92fbq*}T6pf1sbtVnEWsp3bmO53peLS| z;|lw8ATEm=ntcxnoi3CyjG}y&8>>Z;4>##z0(LzF`UI>Q?#J~bh1%b)|2!8b9DdDf zGpVifQN*Mm_SkVpzTUqrIi!fHwHjb>G)KW%jypL^7#;7j(jML8`Fsgb03{+Z`@zY zFHl5ztI@Wga)>Lrr>B;3E79GL2`2}}2W>d|nfmJKTFgHB63T0^<+j>FtME->Or#AR z`d}f(U6o#E;cNg5q@&8{xdR*H`v=e1DOtP%GlwBSx;LQGb}r$~N(+M?L@#BJc%w${ zZGebZDhc?nu{%97*S4L>%bcg>O>3I>)3i1+goML4*?Q~5e4BJHBi~=E%`SpC-s%cw zo)KUhKvk?YcVQn0hXe1@%$y1!;Mu4{dhLGh3|yHJNiGG#h z3~e!FkvpfTHT!DZ#d;gGZh%OD`;uX)7im)oMNl02&x;-18aw z*Q>*o67({<02B}I`lz{vKs$3eMa4J97*(?QU=NVfhVFy04jWqT*da7r;Hx>?Fm!rJ zB97Z$tLykNo0eRiOIo|^xj}~ld7hiP0N0_+S(5DGxs|?7mOO0}$h~;LRme@AZ_9am zJdyI}dy1}=0xvs2Ur`KTY+L>@QWujbV8CgGD8QL8qq|#V#@fA_V)ntk48Bcy%!}p@2(7|=0c_JJfD2uO z=hCBdNn{4ZZyBnX{7=$hmYilmDZI;Em63fG^(2myE|B0p2vQ$XSW5-ei3QPlh4m-a zIsr!+0&Oi7Gl*Na1W`C$Mw_^W1;6MXb3av8FOZP&-8Jeznq=f|lT> z5IhNuV3MnQf=y+8c=PmapK>u6qStl_#00e%_wSy&OBJ-O-8lH(Ko+y0 z#9SE2K+v`#c|Dk<)5(#_h;hEhUn2XjKhKryEoEVQ(@LQheu7xeK;S)ZV} zg*TsmM&Z3hO4G}6BY~2YKt_rL>-Yg%X%SFJkpAEllyI+EIYl}`*ffitX)y%= zP-=bm97A|h zlyDGfBgiiwT#EAhxuect%cTDFAQp=@rLb3(yF@kpWb$bgQ$BSGjnwq32G~*{-w}ku zQ-9mNygBcy%>4v(r?|+Gv)yhQ=iU|j*Dao9w|$-*#GVgvPPaw4ZPZqf4I)9*Y71T+ zCGqnv-)}xdmo0|8SIDAUPMl41LaL*Fi?MQ>eaQb}3*2({1!ewWyX_f=a8upWWi?VnsiY@Xi!E^tpvs|tUjSN0Yd7!zwg2Uq{r%IXdMU4E0vWn`ar^o2@#oF^f5wON z@v@6I)$^`$9bnqf9A>nO7v_YFb*2asdASu!63Rp*f}IK+x!D zaN<$(v_LUf#_!)pTX#oniBS z%KMk6Ew7y=FGGF@pr2+ZUybt`G`bqAe?O1>-ezQZ@%AqJo%W8->(TW zMRffHAvl;f;r!vgj3r~zSHm*mp&e;Pvq86C4gLLjY*88zfHcEaQK#@|deuBQVq9(|>;1g)cWd3*>79$Zji~SFocChNlQ{T7fN|=n{-tmAUrX13Wi1 zc7*POiV5w&#Efci%bk9z0MFCN8VEShdwj(uZwd^Awp%b_R>p3z#PWG12pZGqHt)IY zPN&K=c=xp1FgRWUu;vO>8ZMvc$EC8MR4AyvuOv2A-Q7GZ031JnxhY3zOjS26+NxP` zou@^|3h*}wpaj!rt8Tn&hK3%u7qdqsYGAAA)fuhREh4P9-b>zt zfrG8_cLO)Bpn%?keD`t?Aa~F1e9+Hig8T*<_-CV*6G8;@eOu85UF(^_!O7T`i|vD& zSH}tcp%&27BOkD+!W#l(rO{o!oa)7#x%wnx@@T&Pd=u#9$6JApZosuZ|NS>!DSmO_C;E@*Mxb(v^N zw=|UCs*V!s=&vk2U-1LTTy>!2Na6_32EbT9P0H+IoaF*#)!~ZxbyIzs{_*Y2dt9vT zUMBRJzRtFy1{Pyu5rvpl(zTWa|L883|B$?Ue?DOhr$clMrt~$bTgmrs6@WbjLxj(1Ig_|!4kdtpxUvJV58-(ES(SKX@d-rt!2_qS`_4*8acaf)uq3DK6;+trN$iK89f9fn66 zBFmT3S}TSgxisFqC;jGgOHvJ#KdSRZAmz5Ap(v10K1=4{V#Pe@EYHt|uAP=MiiR+C z!y*_Ij`4q7)G}92! z_)W0g#=06qMs$L{Y-2%}_fDXlz3<`3XB^5F3zKX%3@>xkxG69T6(D1M$7nU;JuDEPa5w99MYkD zT^T725NXeHRn{;5x=#owH;Nc|H+Kd{7A>91$o%^WIytu@G2C$gRsXu?ClayvS72Nb zJEN3J|K4_(k4nnvzs=@7X@Bv+0G35S5(QA56YK(?YqE?H_3??BW3N zdVx4R2Wr=Pspz!AVFinF6r~P5M3ka7iXCT)96$c0fvg zD=#`dp)ka8BX7s6I`6y~5{n4|Of0}tm1hhl(s0rJeVzu*%P%i}oVFXeLUk_`?dS^B z#>zm1d?@nt*4imar`enLZ~yw~^P8`~Y&d_?>W`tSkk=Mu6bIw-v}%ityfgQxakPZ@ zY$aTb=wUgQ4xi3`RAPXuk3xHEC1jvfK%X{CxF!Cl+03D?O-?obc z8Ul?j1xd}x45FWk^9qL*b_UsU;3Wx>!0Baq$}go(&ulG@ruU3L z4B!R`)N)^QQFy-s3y1DQl}Uj97}9-R6)^nlrSEZ)Zc?FC5Dhp?_;M=n$AI&pl`q^} z>zFIrUWRJyb57jyf_dc?(F;whFQ>T|cFq*t-Ku^&l(rBha z_dOQrM1U4ZZU2ALWT7ybEYtTPk5^FnBrns#dFd+24~Kyoa>4*@e%ZW-q)w}cP37*h z3B&+?2#k7^aQ6+^y;8^6yaz$L>XlU4mM392*V$n07z(Tt+#FXn0hy+t39cMb#1J^| zug5`9N&3W}WadZ(^_0LQMR%!;dO0W|nYqJCTO-pYjLt{Wi-`tqvV}?7z0IRt41;-- z8K_QFV#vmA>g`^A3!_vLztjY@M+qSv6Luk33YEl96)ca zg=#?s$;HY)RC9u9jx_|>Ch;)F1ni_$zjqi0`UI+IU^&HFb${{xMjkCvDtJwj#0 zg~3k~X8^n-7Bp>9ZHCz;YqJOJb;*P#rnu6{{sF}I=-$8l43Yo1OTQm?c#((ad$jwG ztn8qx@6YkaO%>Jkbql#*)lAP9+-mDC?RmmQwp(uW-ED45n<)S2Jw1O{7Bgcz&P}W!Fm?Ns<#691t8wI0>txB zeYC6iHeU;V1fF&-fNO0{A)j-%(jzmFT{VkEvW*?LIVt7-onAuB^MjDl zl?CZA-vuaG)ZB^jprMA`R^Jl0@g;MYf>|F=)pcQh$Nk|@O*nseL66PmJ3u_5q10`F z(gW?8M-9Hg8#xhhExzj^8C#dnfc4^i6K%IWUU8pqFFWoOx%CNm`IMVmx6mvyBIrLt z>KWDzkZ3mRMo*TsWu1snG}%Mmy3w|N2srKl3XO(@*-g~q4Ov|U=gSJ)0J~j)c>M`I z#2UQd+VVlC2gMJH_CHV=;6BkK zAC6ly*eE;BRlk%5mo^=SG1w>6jV=-0iZMy zCb!fAnSO`K+ja%N!excy3cD3_`=V7$Ap$gCmjxQS6?_sX^L-yM@c~Z90Eg2GkCbSI zZGb3%`dEOb&;9`LBS5O1C9{4}(a|-re*MkWlhShaV*qH90o0)qhB6i4r7k)vrDVhu zx~R6Nk{uF(yP54aM~xeRU39c3kQEFe8n}Ke;v}lU=>c(oV>tSIMM{{>QwBy0soK;n6 zx|Sb8;{Scv%3biSeO`Q>qXo8oeH~Z`ZQAieXm9uGmO+wZ#Lkv|aJ#!)D%6u(gRVQ` z5KLb^stI-9TnkDon(1o^K2xM#)ZIE+mb`w++eUojI{mGhmS)H!!aNilGyvLsO0c(D zO+%V5b#dcvZG1~*$8oEgIhT%1@(KrhtI*MPCwApreaY%uObh>8wf+l~8S;%XB{xak z&?R)UO9`4V0zg#{XET|DS*KReK+AH~Q&Log=lJ)(5O7m-jmZ%?o7d zczgHqXBrO&w%YR9^8NxMVP@A4Xr`j0s8~{MW6P!) z|8m?J3~n(%^<1F{AbWrPrRpS*JOtv#=!lSBFS`Rl5#I!zq~UUv(Fn;o4iIe(&O4nR zMu)O0`2pC!fNNLyltVg0gs{&1@$R?Z-q7d5t#q$+G6vXP_T!8vDTbu*)gAXQY&Zne z?uBb(x5EAfaH5fgRQT_E27A60^v%iFUO4>3ms9NH^!b1sU8f>%lZ=aMH(G|~ye1oE z3RUms?>^yt=FPvDwZY9#qeX=$oud6dI$=Qj!%u~bQE#+^gAi;$kGg_zYC=OqLL76t zoO?mXaZU|vp-iYjg1`j{qf{~Kgh}oUPOm2e^o$1aKBU-qp83;H-rw&`akTqGZfW&R%gY;0yQS_3*l`0=Zos%P2tE3c zeiGXFLOW~P-rqQF++`HL-8gD<#!b_|Y(F+3%20tT!A;PEmJpntgD zQE>oZAY@Eyf*TgzukD`c0sJQMM^9T>cR-q^Y<7;g(6)C9G zdS_6GhdJ}lK>B?tn0CdxR-GiAScum!+S0KXwLuUaaIvd#>C%@s)|K@8>{T-a+W?wJ zz$;GjlFcNzVIklJWkOo6ZX3m;sEgjq5#{oz=Tf#bsGVs89O+<8-Vxr6Eb&LVZXxq z$l<-Em8nJqn!yBMjZ3T0jM8d*(7T1Ia^Q@rgXHL_V7o;B5zH~t&7ICK$pWe5RJ5nM z$H6CeNcYu#Jai|N%rV`+v<~m&a5$yDL*KcZrrUOh>bu>I6V%iVMC*kg!1r1G1*q+= z-JAvJ2pNNXPn#0z@sjK=oAQO?tcw86{bg7xKt1Kz1;=psrxOzzJ(Mr3UoQ~j%9m65 z{EVhg?{|`=0MINiQcB-FYqZ4m47NKE1{WFv0R~2KBA~M>_W?9$6W62Y5OhTqYk>U< zkwD6CNiS2QM=qvmN%&{Osl)@_rUM#UD&y?~Z9W>qf2qZ|a?0`wS_B|DZR7oR^NyR( zxi3V!&>b^1&MxOBLj@DW)xD5H1)c)JENbE3=#aA2*P^?+a-*&5RP4)faEvAg=;LG_ zk+V_OG~MRiSZnhZQ|Q~Q3xLtg074x>_5$S?c5}UZ`u*MeH~)OY6nfm}S#*@BTwP~c zu>o?1X(C_%yvu!SN!@;dLQ~2l_e8s|6Tg(Mh%YPb0z_*H8n*$O5g;wtvz7L6+~M=i zFbWWz!;gGD<#-$#S?=`Eq-nir83x zHq=pz>%16nRjGU|+m;W{*nzh3gSJMpb6@GO()p2g`azFhk3T4S&A=DZkJ6s6tl- zA*<`39r}a58{M-{0kq}bL1ifA8YV-TV$#E#bV@XUFzGkM9zQq5)6&%Q;s@4ctJW1BLN~`%TmZomdlIP?(oG8+2ad_&QHI-`}FSHJKlmxk^N>h znl1vnaRp9X;qW(~zJ2|Rhttml56@=$>~o^j8Vpy+xQ;?fIOh*waNb#P?I2GPv=h?j zf!!@Y90#z9pOw4qnUyv3nmT=F&b)c+lp*XA0>j&~RCq**!4G4sH=%>XjsW>;#*Q<; zIJ4(ZYL#jujEmXs(xZTLI2I48Xi^Sg6}?l z{QMQofoUin)=vi2rqlA08#ClPeK5}0xiwaan5Uwfd{4j+3~0lNzj@LFCY_un>P$r= zXb4w%OQjDrcjFD}C5#ESqvN~+Q|4#%Y`Fj6#=J81aeD9NCs~y+Fe}M6ZA;R zT)}A|-)_MDgCHJ1P{URDBIBXQm%|U_;PP($@<_&udPg^Pf3a6*+B~`dEOfzt+5ac5 zj2ab?RJg_;z6BULGzpq(fNBZwI0lba7!J=>0QT$zy#Cgb7+ZY_8G-b-Lc>1VF!%xs zU%Mte65Yuf_>hN&y@SC}t<;30G)xGz+uOK$fD75@I!Ykf;2Bage&7mdoO%|;Ko4(% zR%U`A0veZ1C}8=k4U~oF(1f1Rnj5(QHIf=2XNTQ26ahxz0NftGVp|$<;V(c}g)3R zyS_!6%~P9I8COxVdH9>h9$lFk)e)Iho%PZNZXzWvaxN~HY(D&)b1vvnHWLw0{0NdD z2x7SaE-rRbKW`(Z%H@163cf!#AZ}F-Na)FWymI-Th{}ipsiuo0#VXP`U`LdzleI#b z%N5Wa;^!zDE)@iDE}F%XtB!8$xm?Z{Isn8=PWsWr+`v&R+W4XN)6Ng}qY7>3TZ}4V z_x0=iqxjNY=~JMb;w^su*|oGxjq>y#o`Th2YrM#s>u;OjS|vTAgXW1=*LPn5?!V9< zY&qX_VdE!I8iG>m2A!zgLZQ(h_CUGQU^{i#E56;3qn z!|!y;FL?MUbbk#AH9LHa9N!>`buzJn8bKe zSw5G%*GP$0ycUBxcg2dlIOAz-*rI6IeMQcpN*R1)>)JpwqulQRosq-?gBB=20xQ#^ zqG}5l0JYq_mD^V};RFa|d`-~SwF3f4A`wVFb zF{>Wa$wQCVbgyVj)4#}~0f)z16ihsnXV9>8?uC=dEqkGQDVn;{M|M5!3)O_Bq2w&6 zZmyeHN$bFBaA97_b6$%AjdHzqIzolH5VRpAf$y6UoU{Z4-KuNcv@%h+pp@RiA09 zSWr%sC!2dYjo0zE!2obqim-%&HhOmrRqr@?@x?$s&o2(G48W`z6EyPgA=_X(wbv=z zPOn*~g;C#q`Q!WdukW9J`$(@&W=IXf(1U_j-^2}`%E|+T1rMQzedYl@at{GwJ=n~b z`Gngw;eLZ)yFXyuXh$3}Mk7-sOAP4O;e_uE=*=*&N8Kl2EV;F|(xzw8yA!xe%>tml zam;JZEmx@mTKfk=wLv?qU;g;~EuVCeOohw>SsDHUkf~z$IMv?GT2hPT=pi8F)&Xf& zF%mHWs&2kQ?s;)l7{8TOZ8E_1P1evx$0O^7obiUzUycwwfaSd$ z#~lYb7D~k)vJLhdBm(qCSqMBCP@WLbY^{K!d4Q5lEnvB|6dVBhBbbJ$2)Mrd_0_b4!sLJFW*rx*F4MjjQP0{tbup=1ZeBiCxm zMomi?8I<=oQ0x=R*Mu-&x_+V2;tZk(Wj>r_bFSh|V>f97N5k_I2|Op313qzQgXnY3!g6W8?c_7kgPMw=ay zW%R&0Utk%ObjUnp2M=lDA>MqL=a5w%==9L1VL!WpS3dgMByWAKl;^ToPpD=zgI|72 z|M_*g9a&ZO?Ske94f-#~^<4G;1a-mTnC@}zvd-5eKrMdxboo8_Z@l;4+@BwR%t?%s z=NF0z^9IF~KO5&%$`UcFegU+bPdhQ^ov$x-BN)z&ew3%r-ML$+tHm?Lz#!{~FsI&C z)7}otT0lT)mzB122y;E5*I~9zv!jRo8{o@+5wQgkpbdr(S{?LrnpTU?V-M^vHX5uK zO!Gi?;mV*kc16rA9nFOb`Xaw6`BWH66uIK)>gcEylO?yS>ih@qdr9G4nXn=d< zx+-DE+4qJ6z*pKSHiGEipqi0|HbNdNaGFkM&PLa6QPm{mWdd1o_@ec zLa-T|#$&j7+9PvS1?*hVc5cOci;H$pYuc3B-v?Bfs48lWM+X`XYMP3=EJ(m6 z@AtAa3;v)~% z{L*)i=K~&6)BI@vaz?JKOXT^b$QNQRL#0h!Pz})tvKVvtr@VYg;wAdNYpOds!pxee zl}%fwsb00+5W$_et?QTS)>UZf;X`GLw%ouGxHYmSKftb&I9^Q;?jgYICNr5$sOCdL z7_Uk(fUnkVvy|$A53nIUdm397&~%&!%0mKHF9M76)JI3Q+lUo2N+_DCSO+M$z`+CO z&6`ToA`F3h_;4Wwljwd}P*V{s%z-kzpyU?b9?+Nk^6|G1AHVaBYA|{QHT)k zgFT8>=q<3XuSNK=8d;<E_XPQ*YP*KUq9Pa@qpq|qbqp65B0t3w6C8&`js0*Nd z!sbf13JVW*A8YDngJOd?+vw+2`X-^ukPlzgGpnDu&P zHgToNrGO5_Oh8Qpfj$tS+^)%KXQL^L`gK1bx8&F5-rno##xLp~)xa%J2*}tJFY&2)2`%ffCGgxO7n|J4cOsZC|OSL2WP1-VzWta_`eWpT2&5`i(xW zZI79ULvZjEryiL9&@mcL+|mSX8U*f^QCjER;=2x-L*%BXQcw8esKM%H!WP>_1JQWw zkKe!k_W1{V=J|AEveG_HM}bFcgqaASvv~zQ#UA-q=YnFma?EP|`i@QT>Ww9aQa*OcfMRK2FNmQ%;Q*!1a3P0;+8qK_1s?yi&Xo zJMTGEHv<{~HtLiHfK%&z3U@Jpfarnq*&-VF6sVdZP`npNU?BWe|BbT}5@OU~nIAp7 zQhDWy{?V1;4IG;}^D3JvpQ=vYvo_}BGWIrK`F>Q#rTJ3jCmv7$5wKwpghvk?J#sQF zB{0)E1jsS$j@x={w1H2*efaZN6>y|kJ?T_wc3Ko@S*&$Udv@Fc)Cbo~p?iaP1LYK1 z6bTKc8B&MA=A#XJJhmQ`n1pP*YQOog_asm{6V&#J^sa*KoaOf33=}t9CcaSR2~pr0 z8oru9(PUOr;2gzeYlV9G)UeH^O##W<0MmviUF`F*@l`Fvo*c(u1XfkBtzOxIbJjEq zOkSnxkJSU6x^jYC!yvA!(Mx4rfl@k+uYzv9E1asmIVMU+l{ETXF4_Z%o2fJ|UkTIQ z3uilPTt~ez{-W77aQYrJ z2{ZE=u9WEc6|~tB#B5h-MJ1rD=BaxiK$=kQDi*G?9H~S|K!d^f%4%EaLCsEaN%kr4 zm*u*PK&sbx=8T>rAC@yC;;uveI;nS(CFf(6-gaO1>-l@SN62Y-2(u7(MY4cJ@tXR8 z2jrqJ;W0h_CKbRYKyjeT8KC6SX23BC_u(-_T!O$p+39|rZF~c-%Sp`H1GP)oHgUEC zss4r{m6X%XU6m0|kU3tcW(T6+!*6+7@3RJ;r64wG%fAyoBppF3VF6PRQLZ?xgKT4r z+;R*D1DyZ`DD;4a$^aFI0a|r~a08Sdf;JU9nThLB;QH(U=zBBlOKLA`L&&9ta$39j zil&v&-RqJ1d&D+3Xz2)b&Hlq_<)qIXdN{2f^3g+h^q?rUT7tQO?i%7KOLm{v_Sdnj zK5$j{?(-jCfBEI(_g{IsobCyO;79Cw!iiIUfNEa2_(>2cbOd>$an%!gTrMB;9W`~i z7*J5QDEOcMc>4ZM)=zy`QH`&x7*(Qa@{a0tW?6zR%CV z6Y;`3E94#2{U;fdCCsl=mIeq3)$omC&S@TdIsh%)GYM!cMfq-8%LjA)X_~JsTK(PU z>F@46*T|fvaeTR(KB2gRkZ*uG7SMEiChIiTwSIsD2MdtqQ~P*ykXStMa?`35G}Oct zXhNA(G%Mr4kqf&B?GN?JXudj4Q^uynKjvgx5cLLuL1hmiLE7EUKHTzu@0z4 zgyVF-Z*cX{j>mXIyGji&LG{*&26%3kLPj23XTZHF1q)kNk$*Jcy1_st2E(>A;FQ~B zc&*%Q)K@-?ZhO$%qd96UXf(KOObeRZl_y!V64u>)10Mt0&o`Jt1MLbtys-ggt- ze*Ep-)1Szf^l?5Yna&nb@V;}F{R^5!g?pl{8QJ)_3r=@#yaE2x#}EADyiZ_GK=fi(O) z6)(3S`~hG0pd;L66p{ehL`mql9L&H+S&?`);Gm@R8W);a`279p$B*ydzR~O2P+fyi z4V<*u$N(ZpD;)fHX6sYw`k}l!^C^2)C<3;Ngj(HWW2$2bifQ%Gv|Tw>!*)bVD4&5J zWHUpaRvS1jw3ZJ?>hFStL!E>m3w5gXUyXavhx}^pElp4>EUnIQMY6m~DO3OoF5e=s zPeGr8v$DFTyf%b3knKg z(dIKXUW!PqLHfCZg26~jd`hQr!E-Km0=h2DFPw~0%mGeq-Ka@6h6$;EKB0vir%4-w z1IC%V%>mF!xyXlS&@dYC_6bGlG1}#jdsWueO=d&JPyrEZ5{aXQ7!|>B|-P*HKqe1A|F>`e_^%*^J`w#+c2^*-= z0MO8>;H2U~uoUWQN!|uo;2}+sRD|Tg zrHR@j2UL|Kx8YS9E%foq5J<`1Y2Ezsn zx|U$ZqEO|&iYQ;$NAHzM%K0kU2heN%*JqH%ao{!9H#gaL0WZxeC{L;|N>drth1~M- z>_Hs`kS2)%Hh@mjB46Igoktkk5*9&DKvy6(%yL(Y-dj8bioOWD1 zagE~A76LlJxY7|IN6yZGL-l|w9Rbw>qs?ru=7?Lqa$j4KqY9RR*2Neqgle!f0niED z%P7dD;(wwcaaC-cUy8>~e;yFk2&m5_j#H(Bi$oHSC6X5%S}is_ow*HsLs*;TrBc5M zSl<`4!RKi~uSh*4!#E<*Hb=gYnscce&?WPx+)n3iJvVoDoz4ijtYwP}d^%sykGdLzSRUF(kJ9=OaI^#PihesQftISqQ7_O)$*DDy za)OE-CbuDEw9ja+Az$MysB}mrdbVbdC=Ug*WI~Sr3^t0<+R!Zl-(Zvv_XR>oU%&n1 z>9^mW;6rmwN||=Ff1rVT1T&)CrG|69h(%EKCr}i`-AFi!=6<&m! zUYNMPilat66>iM=5#ktviZdlHWLWXQ;$E~SfUKZgp4N~~!4Y+K&JcfKx*1^H~BpWxt z5znRm#Cqn@z|z^^^a_u=>7-hKDJEYt#K0Xr8(-YW_>;83`s)~I;2g^2z@!rX=%*uBoWEpB~IxcfNL>r>EHg~pv?CtbbC+reQJ=!%UVcBK;<*Z zr;}~+Q#~nMKszkM^Yb$&b53=`$lP^7bE)x-sJsG3&HeAc-b=%bMsJtxQxDO8gUEx- zP;N+(-f+9&=Ymcim**=Js77W)SrAFntLf7tIn*QY60CaO=`?TSz%LrIB> zTp@*XQhuMA7G!rvvyIc7Q4TWHbf2r&JMB}$>!$U6JBpO34c9A4dZL0+st_P8`&mTn zj}y3MN=T4dB|^JcBUIVe$%JxR*>9w5|BG=eE#_D)2Htr|D;dRE_QBM zx{5s|^hcVN#gvBrDul8*N8Z|*nbauTAl@Lbt0r}*1RZTlwcEk?vQfVQ z8)%TzC|HGNtfizb;1q&E=7FWbAoQTLAq2XZyI9(QkmnukLS8N{16Qw>0MW4F-U1-1 zPA&qQ->8sPdTy|Fs?fD5DweCNTDVy;#T82_s~@{l(VBwIsW@au_0KeqNWnF~cFWCvbx@=H^sKkY!~DEe68_LY6)mZHRsrRP zZYYZQV)A{HaGVFtZQh){YLaa6FzJR0`et z@&*SFhr~nV0YM!6Nh%SYxTk3|vW^x}x^kRWP=CnHW+DLK3oupuX$JP>rhAg52G*P9 zK<)DCcAw4Wj!q3WcH*Y?y7CLV>BNboS)_kPN+37Ys2fml5du|26hd98(+3D+gGx4L z0i_?W7Dbzv52|S0l}6w_|MU$NZ0=4K6HDeY-IX*B<;dvRF3*IvuUOG=!&9#Hcq7VO z8%7>Ef@@$tHY!6=9rBO|ySTh_^6@h_MD18#|2ve9vkp`Y?kK^c3+(!pr+O}V91J9< z(S%OJ*=7yIj~uIYef8F*1UF6tbD)!k9ROVCgenx2?BgWhKsnf?5!c7ucAWQejEYL3 zB<|R5z*R^9uIt39r*3{qI1j=(ZfX(`s0$LK3-;Nwc@~`O;Kp}mJz+zR&KpL8t{OAJ zNd*}{?4J|d>s?Uij1u*-*eoE8wN>AVGvP(U zSe`~YTy(1b#!(Ogl7(S1^KwW4Z3;TXDF2Q_XU{0)F2A2Nv_T!hiYDc8pO6C|Mr_rL zl-NcLEpL6Yvp>PHRW8ER0O~Ocl0%BC57aC;BCWGS><-a&_c`5vo(>;5Lm59mCr#Ew zsA1wXI7SpI!Z~W<7u*=0qEmcA;QuCJ1PjXhLZ!m`u3exH0@!aA3VgLcJnBORWXc!xHb-|q+0r@DqYW1zH zQ!bpW*T+Mu69R5`s#_DddCNEn(Sd9XMzpMe6OBCpxS1;V-2t)sn0O~mdrqz3GU^@v(yV;0 z{Utc=2?XH6<(Y3#EOa|>wP+c~H{2i!H~OpKMx|K7ik?l;2xl&`6j)*aIKw931m`Ef zSYK%dTAmQ2ENz8{!$#=_Q5?h@2OIo#gZ~it-Qhm{@&0eWeng{de)fe#p@+Z&H_RYt zmVv-^;~UsD-2H5Wy};T~l1)XBWVq45@(QS2uc4>h-mK)rhM@IOG|uk(nQ{r|9R=Fd zfE056o)ECDu9p}8;2FYqs_P+OZ-5REq*dp=|E42h~y{y&mTp(GUDIL1ezy-G62D zyWBfPlvBgjNEL4)rAX}b~JMfNfb>vlGvg{gWf*`H?&IS*3txy6F|mT%!6EyYp-0%Fl{ zTnfmr-SD`$`XawUODbga+cKtOTQhRoc(LX~4BP6w!G41jk92H+Ci9^_l|a=LAyQHT zf};=KQrQi~=tC~rIrLtYQh^X88w7er5zfr`uD>!PexiN=`ycc=t;5s{w#E^7>Xfnq z1)iTRGbMT{gb?n7L?#yMD~E{k*C0lmuWk;C5NR_$9$F>)2|zV&_`Kdt5*c41_%1QQ zHs2zk*$D~7iK9pLc(K+m2}~u-Ks5dpuZh$LZnD>kHw3)vk`nuP|n++Oql^(H*27CG9h> z70aq1uY)+1x23&7Jdb&_ft_TIJN`s=6g+0h8>ai87`a~*C8+7nHdO{XGy9DxUaPY0QBBhF2=6A>%HXm&~-Q7%PUn$M0WLfo2%(X zfJp5(NIfV9<1ObloHeJV)#0r<9bGzn!%v>ft3a2Vpp0(dpE7Bm>(OIjp>YZ7Oh6ep zD^weo0dRnCAe>}ysqVPV4izCNIhB}La{O3V{gHLu4rkgjvt0#GJ_1I3^ z#GdqO0P0Q(81yHDaP#p%1K1w;V(xjR(l}syXSBTdJlRINt=F99r(d3a{rcPIZw#6~ z<8~?#Xe)u6GNc)4Ho$ceTk^}R+1scu%iVUn_{8lnmZhW@fYaZeP(Rh%UKw@xlMlzA zoOza)?>6N@s%smb z@M9MdsnFCdbKMg3oEyy3_UTo z1NxDZ-ES!1*24m=^CRSwYX$0+eQLcW8v2BkK|fJBTHlJgFxKfIsb@o=;dww;)ok(F zsggbiVYa6d6eR&SStMTVdy+a@`XUXFO3$f!nH$^4z;S;%Px}p0ftEZFIQk$!?KE$Y zZV+#P>~0WxABn&;W5PXmH#&{>KC=GI8)Q3!J{+(S*ircGg9whK5w z`=ZXCO2_fMw!~=)5N$!ZjDZ)IzEu`f2Zjk(unFLOMa0odhDGsDk#oy+9dwmLMVul5 zo0od1*jzR*#n7DZkm#CWd7IFby z$~<)wPVbU@|M>f^KF!N(cR@XNI!~w{PS#W-tu%WJnDBWHg!5G7FPf#UPn>NX6ci9W zSX4*58Y!z)to6@7VoT(@4C=Dn7kSOye=03mSO~~^C|96mIUFx10;&dG zG$}`qqLI2=1nm*%A@mS<(2vkf?S6xV!!<&u>jo{$t8Ljn`Vf%V|nhW>B zlrY@z-Lnl)D7mO$-ZL)4h^B%Aj-Ciyu@~s_N_LrREjnk;5U>R>$UN*fND~k2VhJKW zq>wsjZ8MPghScDa427)vs-HI$T)Az70mXbkq0Ig1<1b&|fBo>}y&Rv?F(h7u?(^dK z5sPu zBSQL1s~%Fr$EWYVeEji)KB(;}sZ`u3m?Np>d`go;+BK|@%i;WTR*Oq|Q>WljaaoGG zLEOrQ$_yOrE>9dmC<*&Rvd1skm3hRRRa{QDsd;`z3R7oDQ>MrpMb35swa)u@?#?yR z@Nwu{bgZ%qH}}pVZF5VvUF~iI-HtOP>qNyW(xlBDH!`R=aN(rj#*5Z&QN01Uv z>3bH@kE@0jLffn*gPfMjK-rT^)YWQh8F_pZ$OuNw4N9scIHp1wbNS?^UTc(UZeFdj zB4AYjp#3WWm!J~xLe0^@QfF#&?m<;^0=A~iN${tr7dQ$U?{nx+lp;}WjXf7t9^;*_ z!)_aNI~qQI`tfJzeHLW*4L85OHPBF#8?LSm^`^sc?>WFg@S`hElO_DPgRPDN6!)w7 z6gFAn24|wY8xlGKj@jdeEIT*)RDIjsPwRa{7JWj?fd_+V173q_m~+Pl7Pyf>c7XxK zILwg;B_n~=gCN>`BIXQ2Xr~$tWVrU>Ak%PAfCuO(uKJSgEalsp>vlW6Xgf()6Ywk@ z2>`l!$`k1G_;=^@R!`-K+EEvVX6IN*jMKdzm5;$uN-4u>Vj~o|`O5tjYZ+u$%nPdS z;FmQp{<}J59kZ0Fd%QJFQp9}j7I0Up98O&_=2r$dl_O3{LSO8>Y2+x{O&rlcDW zl5LZ$L0<$f8pq-PBt;Q(U@V%_Wq(6LMQOkhlijB%=7i%OO;-4trSUNh?RQs)YgEJ+ z1Q4322^ddkz>wF%gJ1c^aTyM{zzYF#kmi$3tKtJ}^Q*f$2$noS0M&y60%X?ek*v{- zkf>wTP*jNEc`u67%_V@mT$+N04CiMYxknZE*UJOnvU*)8l|NW2J{pJgL@(c^T)-wS zs}f))xHpIi=YE@ii%B!BM7F= zwEGAwM!oq97pcdB!h(NktfW>ih!$lF!k_}fVLsFqrC_np17bMv)=$};tHXeean{`UvGWeJ}QT0-emsa*Ssu#D)q3bryEaq^mINhGTDi@)9w%p>g^OB~)VZWm- zgy*%*1;eslkj67SR50eNlj$e)qF?EDHWGWHPvNcY4cn#DE>Vi2v@XcFN9uJSp*j2s&)N;ec5p}Q4yj!WFkw05#XdV@$vfSkU#zQ zubn0k*?q45^ZK9Te~fv%iZDTWgM{uRtH`0+XVbj~ln;rym8@WJuM&{i z;A441*Wf`-?F3QvR}>|5@(dt_8>I4S zoEniH4UFTEZq@hg!cHu}hL}G7`s>s8KYss0A7t~k^PmCdHxy~0jG$f12pX{=sMRM# z2e!GC0<|I9Mh4t#&q&LLJqEEs%!1s@+M!+Fau-l;kS^8Ps@J|+sPB8f(-wWS!wSK1 zJvM+kVJtCxJ-@M5)pHT>Jrqo;c7MKMCo4<*a^1~wvs@&1_tMU9MTQ5;_ykV73PN-h zJ_>Z}i}nW+4BiKyzhl<~edcvYXm6qFXdAmkEz?~!G7T6}HSrC)5oLx2sOwqbvWD)s zdfGh%eYF^%c3KIjEZDgr(V{D%n8sSSq4UK`yz96YXWk&&AQoshE+)Z{PmbU&O689B z{Rf78sptTx7GA0aZ6wHX2L!$fM{0uu!S4bEI%_j610_`J=HRHSo%SlOI+~$4jRLl_ z1hW=j@g$n~c{=!eJia_JYi^3?(bNBI=kMDo~P8r1floX`4 zh>R%XS6tm+o&;{PuL?*4)Y}l&?xVg~(Uv|s_=2Pbojzg$)&(3W4S#s!RXSOn@iO8&sS(Ku6rtg=H`Ax705 z376mjD7eSI#k(Q}rmBHtRki0+!78XiXD>XV?ZTh3WQi;}JDw#Tn6Ct^77YRq;bDXA zVzxvA=Gt;CwDlK&dcCOk3_|b2y0O%Z1Jb1&?H{Ngr94%A_~rHZdmF#&zM^35n2WTj z1%RgV=z|)sqV^zZVFfD6B|4VnJ?fbV)TMc0b1OLR4fF#nUgz60>!`ALsUf%J|I6qV zQ~d&dBZ8NlOVs;tfCv&1o6gcNXF_kC*{m|)v}09J4UG~FBrE9~0R~4!m5SPO-2jnu#~k3+ zqN51|+8Viz<5j@j+zAj%`6h0@4=RX&)5y%^xYah}4Pcjwu+SWDD5CuaLM#14baQTw z3LLa++1&WW3D@>ypye5&+$v@_*|yXKIzl&dnF#?ROCg98wx^Efbl9l7E7kfrWW;9= zWg+?9QJ+V)V+^yshdA~SZ4e$ec=Oo;2)0u}WFWJdA~l$Vko`#rfwpjeR~-i$;6ctm zp0Y=ZCgtNX4a1Bb%ERkFBlHW>ufX=29Pp(Y*4bHp+9!K_gZ({Oxz$pY%w>5@(Ap>a zyubB`SiH1#;rbBo5l&G}m25ovC4wlntAcCLB}a&!K@fxqB_yh5Mu>HJmo```=*RFF zWgCXO4+M^|mK-zUuvmGUO#9*B+T#O^IJr`wItw1kQgvJ$;iKo~A zKL*VB<$85_M_IC5spnbpJ~Tg&-~lWNc}EyV{SZ%XK=}mFK-h_IF%(kSFgPAP?B8JT zK`+?T3f4$N$h@P!%AmxDwXd~>cKL6RYiE>l?KmRF0m(N6QFKE8pP<=Gf;OZ5u=?Hp z{Ntcvj+r_p&;UxB`8;}1@)81pZA>EIwsE@; ze|-2zhbWYX<9{i_(og2q`uI#-JiFC55rj;e{K}@9K$XJ-PpZp?`?Ns^Kh%fce_Xk3 zDZH+grq#HB*Cy&f$??BYPnXMuD^-^h$FzPPoWWY5Or7ix9vOHe1Mj;M9elKV@X@yL zS&$MhkQA5(vng_tj+55=eVBbEUCu%CdP1|&663PHB7W2Tra5DP**Y($wU;^!fypH( zMi1yeOaz)ipX628CqtiIiXR`Q@ix!yy5mZ58Sp42HKB6ADQ;%o$R|p|NFo3aq^~8Q zEL3tp9}RkFR4NRbibO}goX(Y$2DB>Lyi5g0$KJ6yq6gBA_JJUqQUWv3QqoQ(tLJiZw@cx2!excvcoU7Natu&43Mvc1HGReE z(ST|0PUyu{f^i(u4WbQH?@0OJ5qemhhxr;t<;KSi4jx$Y1=k_>}VD50MWb+pfvBQ~T}WWQ#n+9J?6V$V1>E*lrIj zL4Nr^dXZXo007*EG239zn+SYVoKSOUS6(k#gtIHhhp!LE8;#bLf@Os`K$u5bC*MeL z9oY;3xIP65_yPFt{=I#XCvvo17KP}>0303QWqS;_#$(wY{XBXp<0yG9p#HXj=EXjE zl2^c;(*Q-2yOTgeOMraQ?vy0zoEcQt&O^@u62o%dpxU7HkdGeF6qMS7N7;=#+$?OP zMw+wctY}Hq+=&(H$W89huK>`{kHGEY_$Y{aRs`eqN)-(OJEh`QSb+(K~z}1H|z@h`oN|(i|?U8E%l-iI9sMB6` zwGOn#26WO;VXie{<7QQ1<%t1+*! zb;sNw>g{UeU1fvQmWc^$kZe<&P{8p@g8mV5E*us}JwU*5P=Mk_uzn%COI*D~Xz2j> z+bTEG=GB~fP}&nh4{F*81?}nTBb7855E#VhW(y)NUKMddu^c<NciCod?B*5K^Uz z29>p{n41aP9zjIy(F4eDvb$Dpd-aqW7kX4VwSLO}qJIE>xI3=vizt(DVr>}Ys{Rm% z5klvc)bf1)t7OMBl~i78l(+NDoo`yg#q!a48uCkb+kN=2?_WRu`1}n%&-Yr--hDV< z%cdS_GDH)9<#`xts=k)zezXF7?#@$vuThtrFR#n}%n&c@{;k@j5Bgvhxx8#3kD7P=D(?v=hP+t(If{%XKwq~%}RzrOqx z3Dv%|v$W^5?Q_Mi2;pwwY9+#?;d3MQ%>6<5`?`~&<@2S(6Bm* zUHd_PG)J!+hw9Ga)z1COod*E4A;~ABuSOBmXc#IBtQe)mMjLJ~<4xCTq8>0UcW#g- zsL^#2l$5ss+N6h&YxCs~U%&tU?(5$^nitio0hhAna-B(R2~5RQn&rg}-+p}j@$@Uc zbc>d5Y)b(hVYtt1IR&9XOZ7NZ<>SM>Ozp)ZWeb20eYj{{H7Dts^_~$<+PfRzk|>mq z(@0|3`oYw)?XR-pSW*{rW<4!nx0%4fB7x;>Pr*h92Hy9pJ*9WI@ur~M8Z;(O}b8_<3Nr*gJQ( zabg`wyIe!WU^~`(9V<{Xuyx#k0dt9c%Pe}~h=3)@Nn2wXpcnb5Hbjv%h&PC~Q*32G zkY?m{>MTc|PTCRRgF)ndDA@|)*h8d?QGoG_tE;8p#%^47S9PWY{XtAIx7D&{hE<)m zOis%tlo#4^&ew?_xNMPPyr^^q*J4s4nYA)kXpIe*d)}3KWY}KC*GS+?uPxLykp@4- zs-nqNyDBrqMYFlIk%(%zbxeFWNX<^5rkKE}exQxCeC*`&6OKt7+f{xH#)#s*Cjv)e zZyPils5THKtnUrkL->kP_}d2s){Q5MI4z&3xDwhzRf~hH%(hst&lp95J{!r$Ki3XA zr8ZGyyc$jwEjYzpT4pA76DGla51&(0p7y->l2JUP z`P;icKf&v=H2tEch*bZEO%OO0n|~%dY~@yOa4r$v3gLEaVD58=8_6L zQ;d#@KuKhTC{#Dw#--#|zYDWh^+Myj9DLW}eD;h2}Uy0ZIqbznWJ%0u-5}WjT>%5; zpXu*Z5ap>39W-v!M08WnFel_3pFcM?8Y-uu2k=E>k+dtXj+lVu*&y@4>P5hMPoNYT z7HLY9TE^ArcA6#~bkSH=-TKOxL>F+ToGmzPkY*mj;|2!&ntUg<5C}5^%KIM# zk%vS0uv6B6R|@fX*ys>>Qo<7~>a<9vz{^QuhIWZt6y1EBl?TwNvkoKpE5;w+}X7JXx(qmHRgAN4!yrBW*g%1SFmjr#9Zse+V0yO}y0vAL_!NFf+ z_G`IF1sQH-dG5^CLCN6}E6gYd5S{@S_JFJ5fb{&^-#&i-;qSf3a1uWcih8d#mf+L+ zkN{KF^YhA4asxplt3-u_`p|_cKbi)viq_fFsZA@ zZ|lM=TRr^PA&o1TMGD|FckaF+EnyJo2v-|nAUJ>PRdzE3T);?}G!jdoekS3%PFF#v z{zgTODyJr?x=INhaPbA7auFrDs^VH8ohqDPv-Y8)fTN;NKx)+4LdLfDZH5A=HxRS?#oB&sMDu)bERUCQ>myCOq1?Mh`06) zR6&83hFSm!1N=in7$i%_q!f^B6+lwxXWgXUIPY}i~a8<4tb1gT^beA;sl zCe@{`eR>-x{w0-C8}hlzEEW zcS(vg9CG%Fintt_4Bt6_%pgf*g`qxWBN*r3d(;oQ(N z6u*-l+-s688YO6AKAL^I%1USQ+uTm>`eL$F#dJHpJGpU~WwixaHF-QeOPd>v%COox!G_5wPAyWp?pzW5tQ z6lX}$KH7TbzyOz znvr@FL@PKDNhG9J*G zpp9%81=$-J_`E$>|1~w-F4J}KPqcfqGxG<7iW%g$uOEN;<;kB@IUQuaarDH-R$#yW zz(pPosRxd<3DVdDU@9;S+S<}?S%K=Z1UT9r%v+$W%nIMRmiie40M-@k-I68iskWm-Sh zmBU_XwwH0%4@uqZ=kLD*4v6x*kGm3mLTl)vFbad5UOOa|H0r{wAVu6UGO#)s4|9z{RpFSY%@EAGpB zKGmI|qEUC$eW7NzAf1XdqT^VG$DyQaZ`_zs13=B6>V~lUhaFruiQ!7$yXa>0U(i1G2z;> zY!~bFVv8tA_&`%hT3Q;THc&JuA}mKjzfzkV(A}vTAmB*6pdUS)J!o7A(2jG<=uI?c zjPzcww#J!5>$gS`85UbqT+r}p*A|494$xCOXdrZ2rBP7juW}c`NP8dvDO?fqHP87% z-IcqqFvLsCVKcya{NK|3FUQY{6<7Xm&O37sIWg69lL(8|v7swRQun;#W+dWrFSKI6 z;G8Nt73hr?%hYgp214<|(ds%xve;}1`1+X>yVH27Iy*N^2)m)g$-PSQq0t`i17huYAMQ4R54#1 z9l-t)oNPN4v%9wO5)#;N!?!>-2=#8$<9=(Tby7_1=ycZ&`VHC*6q)IMUAV8|`)Pf+ z2U@UVS~YUI!L*iX5~D*zW|DSgJUTc^N zjw@^3%X_12^Rnb`@)P$|;)Y7+S5KD*&8`r7?uJWh*bxR)w^NHg`TNPnx#^>gItU!E z8a+gOa#hN3E1)qo?Zcf*d$d_^4n z5vW2TaIb7ZJ&hhlA3{EQpM(ooMBKfB&{`gHFNL>L-*anel1Gp@c~qa@7n#4D;1{Q%GX;`#(L=Za8uIre8v@5C zuX8)FLZ;mqP$4p_8U9dV||#nyRD55B^@y^_ zeU^%G;^;(0up;(;oKS%=J94W|dp)#dCuS;wElnqCR!P8hGVcv^`E};95Cpx4v8mb=s#Y`2-B8VTLB zuDzhk!~^L82&!A@!F2*Udp4?)tASf04{Rs^`Mk!dNL@AEL*?><8=G<;I1lQ!8DF`l zyrGm=l$fT*=ONuLO;QhW;33)|4*aV820X;HJBWVqu9e zk{64YpdD5>iSQ6-05S2nQS3o&J5^J;IbEp>=e1Xc26Pr0^`odZ_r?b8vKnwkNhR$4 zx8HvJ{`A}L^1iCM22`h2x1uQP`wZM)n4e`B*j!h3mWr*J2Y;42UxI47haUVXR1kWF zlgu;#>QyRVNR7HZ{gW1AN_m_17OCQ1%7v_7s*DkkAc*t(?;n5vNS{Lc%n>xJjsC-` zSw&8qt&7BSPthAGion@d8o+Wa1hSJsm_~|@1az;Ij-1tBDi7@&Rs5b*mGVB^@=4&9 zwKaHFO9CkL;sPcPrD7#`&qyyyu%6SXC?2Xnc%ZLMuwNati#^ONR1uskgueH*c~N|O zzv1So8)&&$sa4%tPWKRVj^_H9y@khxH9X4|iR~Z=LX{A71@B2D=yOR}W7kQ=&uFld zU3IEX8w3X<^?C?}UIe#QYfs?LJB&bAX-DHiyW3ibT-T+G%f9U{h+9|wKcCj^c_obk z3eer4@HAdrbX3IznRiv1w7yR?HX|LNrg1apAs;-bk|3y2C0Gqt-p@1*D)NTA zq=d;uHMCKfWI}fJFM1>xb&9~(Q+#c94*)sMr5JSPWCcD+H-CYr*=vc&;pJfdeAAiEbJ$ZT+*y6ljHl{ z3uS-q0!v*P0_9vm(Ku~E4Ccx!)?!iGtsImXmgd5lqz*G+k9dK;Ra4giHUbI21G| zN*_peWpTfg%H=-gchr{sm6JdaNc+s4GZwe*UP_hceTUBO;yA!v0JZ#wP`E425f%_m z27M|*x4sZwq%jRxZP#X_(0g&(O+eLSfj)jGJql)ink7(U#?R}|$pR(MUD)>*paX|K z_e{JxTJi@B)eTY$sTq3(agiZig6*3Du+0OCu6+cDASIv;Vb>3U2Ay|N&38C%z-YGo z(5M9s_~LC{H?~6K{V!iXeF|Csby5w)2k2;jg+)vd@>E4lkV;_r9>rfBwD$&~e5&E$ zJS_VSA`b;$vMSg4z(mm^UP~w~%Uul6Sz?fGuxJ8`m8abON*w@#c2)q~X!k*2#!-nc zt!$EtxDbd$!#vXlkci%UGB0Vg=n2R|b{$%iIy9iUI1dK{jqDdx+ZfcIblmG}aR#W8 z2T!y!2I{ZvqU+mf*0*&uHH$zm%@EENdal5_li^~OjCEdsvS{_#@Z=(v`UVa8(xRSfxX_u|x>?m(pn(*Y==kv!=x-SHzBNHFufTiNt z&lie?6j)?U+c3)W;aT7Q~Lp>bYaA;{>v}n4qiYTx&XEyjuoAzGO ztbS85qqHw>)@N?1P!S2}2!BDk@_)Pmhe8_K^w+zf$9z>10wi2FtqfujkUAWNQZWgMQz^s4V5HA7}~squ`*bTe_?D;nP>o{WmALGm~W6EX9)O~r*1qc zKGn;e1^_Pe#uo!?={y-|n3|AqP{SZFp!p?()O)oj$hPkRHXg&s@jc#KEX{DVkFst+ zBdE+)P1BtXui&chMN-irQ23+Gy!K+zn#`sYiE1Jmj|6MR5AeL&x1lk$?ZTnbKpr5l zl1x*9gD&r8jZYFPmov76Wb?5?Nt;l$LPG!hVfO{Gid1!xP9Wg4(!!x4Q!nRCC#%IZ z@dip1AkXO{Q! zneMq>4icz_J{tzi9&kg$y`^2#-BpnhIEXC>{V7^McyADzPg~tK=r(9JD1+06%&PAV z)6Ea*>%HC}+RlZCjnpF0`1E|)Kw_824fGw1eAG0|3pn|D-feAwyCUQN{cl<(#UrHx zX`B!C?qh9rreoEt^cfb7bpn{B1?aa#j5k4#98khq1D~ppQ#q+6P_08y4hO`&qKvyC z$1$9et0L)BYPFH59V|q38V#bzLumKA%Uv(pU#(G~h@+a?aY2hRzq?#qr;9E&N7ZoL z*piH6uX=kHU^H$*Izrj66ZPwer8=;UD}61Q@Wt7}#|@Ry;S&zQyuQLGRHeKtPRs3H zU#XH>oVboGLK>XTT{-h-X@)auj8l_ynq074yYma$mJ=7RDL^Ul^U;47H83L+&O??qBuZCOFTpdQUlruKn+kx(Hu$D zi#03b?izcWIy$yg>Yx}l zi;9l23t^%-D}e0s{^R$jU%$TpvEzIj_XxtpTBR|{hn7K5M&w5ec!gGOurkpC{<`(> zfAfEC_?Pn`>}Xb{hsb>Lik;A^qlFIobP)aKgNIO{4S-n})5^X(allQa6yn~#9E+p6 zB^Q<&SUgD->HrfBcnH*g0pK-lZlvP)FUKva=KQ)$`E;h|319YH-p_^|e|CQb)0n!9 z5_8>5AvFbxgXJ=u6Lw?(wN0IuO%m@T>EWqafr&K#qbyt2roP`Sqo`BgymWm?r$>`NVx-2;)KrD0AuF zzJK>2jSty@Q($>fcjzq=@)I23xQxZQbwsbDRk+7vELSEdNk2j@6Dr(myHsbirV!O^ zP!#RmKp4V+GawpeInm;!vOTx3^>#&@G&9CCxp1FfP8J^=GAq~rV5YE6rhtp<801B;D*)% zg+#!t{d@?cr3|FOmHIgZE_gCv3q){(UE@qhrBbpKas+Yc!4i@b9ybU)1lvV{eA=;Q zD@)Lia2O+9)kyo5AjN2c6$RUlD)o@WyKR+7`bLCG`zs4N&ZHAG0Z%C0Y!F(A6%xA@ zXt?;j`}vYI6E;x81YiGVmM4hgIAj~78>sFDaz~>LGK40GePtOV|sBx5IyD*|@R;XTU7> zenamWWE+GA`VpR2$eHh-zW?&|_isORBNxW&19Q1(uSn3EmR^UZ7%kDtm3!L|T3Igl z80pTk(8L{n^3f@|sVCbDLVq7it3q-wk}L_1Q>p@Vk`+H&Oiy4UZ4eve7PjjeOIn&@ z8u>C$@4x->@y8qKTyE9jHWTlrWOk}puB%V|D+h%74H_hdAliJwpA;H3Y-ZebqRn1| zLb-+Zh?Kt9(KPYIpYpyX;ZV(S779YEtcLP_9j^v9azV=3%cbD|tG@X_n*ou4iw6k> zt?YSF&8E(Q9`DN5sz#8j8V_0OLG`v^??D-c5N@XeJC(PpS$nN~AzW>S6(GxSglbYf z2+)iqAV)+Xi>fi?k-iifuv+a5w}qTo#mR=XPT7v%g{^vggJFYXwh?6*Pi#Al%*$DA z-d7_PA9>EYr-ZIO86@@=Wi_Y}_POc2(!#;Y?bS%rcx^mTG!sz#GKf5=bP}TNl)a^! zBy_w-Gku*^B53PcDNRT>h~6OGAodWx!A~y>NP0T}Ta!|-XGd#B1!cy%Txpo|{nIbM zeEsqJH+fcPrS#J;Uq5~O{u{m8O1l-13X3uA7;|`>pix`LaWkb#=SR)~s2>U&JENk0 zIT_?r#X)yZgz#{r^zKljX;=yn#_aF04DYF0>1ys_R~b|)d38kxVE05xO;9VZ4$G0_ z7Ot95K=`s{&H<+#?f;BgSm}vzDx8f^0(?84`z|i()8cS|SezZEG(?ZJ*q`FVrTuOG zW%oY)$Gcm%|J$xe`sk2SK#Z@!6mcvhO3a8<5rt8nbCF09Hpk(}u5MU|ZOB=pu!xGd zND3rh7(t9v(gyP_&|GLR4YYu?dmkj9p5iQe%69MWcdq6OxhKcUvCRCw&Km9mX#Y3B zL`!^k0;KMoYPswquT8xn$9tB$KdSr{XHLT2mm9FcKNRVl13tqV?()}icFp{H+2t=U z%cU=dbA#}?eG~VZ&R?4LHA7wY?jPJh>GQ{3zCIojvj{b3^4_2lQwR4xxwa-~olvL+Szf(f|>8w^^DsACC2zSFqg{#GB7{5h`-3plL;yMWwkp z8D$|#*$m*qSQkz-+sRv}4gye;h^QnekbEiN7V-j)$r0RzA}4ot8}YdX>f{od(|X_8 zrf;a<0kquAr#*mK;@Z(|hmr0@qooLo;d?SOPW4J?! zwtE&hd;6hiI4PO0z3o#0fRqq1*}Cr5Di_fjoSQsxcP+x$zgz{wsIN`~in^bm*CNLS{uV{)FGrA2R=&_nFvXXYdV*BpS* zEvM0jd~N2YzE&^1@MJwpz^oaL&HBx+0)5cI-V-cc>~Y`ZFxxX)Ar~)q87DR#f2_t_^5QH1pDQPVds2wP1xP^@X zc_{MauXg>axH&pNvC8TJ;G&hpgc*NO{k;F%k1yYTM?Qm3GcE$!C)PC`r!)xM?ArBj zC}>zg6VT(&HrN|1%1sOl&HN}oUoNEAs~B(uR`q02Exs5O6~7R{(E)Okase|Pp}np> z^L(CbA!EMH)M|N0H76b@(->*0$uPFd9CcU>6gvQ?4Gk=wpfCxJ8!CkfIvIw(OopM> z{l8lt&0Jj(&!wem8{#?RMb`=y6b&9{A<|{K552n~J5B4d&MbZc)@A}$ppz_fcLMG3 zK&aTO0}NxD>nR2j~{pM=;MPn zi#~$mcCj|6Fw)bwk@(sgK)@Fa-1o|WnOP7VHb@PwQo?;lHab1)>f_3wt zQzt59hN5QCgqopMszCIVDtT7iI+U?#Q5Px~5cHJ@TcnE1-QLj1fchKkNKDnJP~C8u z+-jkrSEkG*vuMuX(EC%IorU0hpCLcv1yIA!jtO0HoU$^g-OKb71&IgS<^}f+zq%rj zPsu?bfkP+SL%czhz7dnNVuy_}uH0o_xJXy139+2ZNoa4uld>Bj3XP894t z==-|mwo32=$@~WuUT#($AiGdy*1&myTwzeL#v!0W6SSSG1wy2thX=>w3Fu%ugA>Ae zM=SpK8~gLQ(BcL_Q)DNV%cw;=oHuATC^k?5G762@F*m5ZPi4^Sl@PXcl<8y2toddL zoSUqhb!kzh>;teW%Fzm3YhdNp$y67i+)}HQ0s#RT{Jeouf~}KMD;z?H_+M!ijiS%B zuBfjA@B{Gq_!zbDk85eH-5j+oXGf^D!y@%8hpK!C=m4){O(PS4*0f*p@y3=kBGjlE zUI}LMA5cnVF~|GLrb5md(4M+ZL)DK0iW?hHbQ~$Ax|QJfmCLzihUFTNOI0`LaOT8J zO6b?C2MVJj3(Ua9ZH6jys!J=rf*)cBAfFU`o-!f>rxG)IwFc}42q?G+*m*KY1bVr5 z~;u9SxY3;Rq5+0i8-E zpjqeXkQiEAM)pPBUvAsSuwy)9RG)}G*I6y{wqOO&KO7DJlF;pnJWvubNIb9%kJP23 zp1va2n|>?F1Qxb%+VntVxen>HED9cC>!2FlAC#j9Hi3dL_MmhePd3&sn*2pl_%#T_ z4FV7B>lw%==W<7?5sQmf@!|rsy#WnP8c;0Oatrxr-NhS30y+Ziamwe6+%IUk11?`> zXt;!ca2g}UabqB z!E?7e#Z#8EjsiLXO~?Q`b*Ay)Zai`Q8Fk~OACI4IeAVsfoJnX$SJCzp-B6dGoLY~u zv-J=8h?+$mijj&?VM?IY4qkJ*txmU}##zmgKCjY(LcCSF`gZ2$J9T5lF!vjznJ2wd zm5-%+W>m_%boB|`Ljx}b$tBG64jiVo&^189Kyw>-BT!jeKu6%3aa}WN+do3xjaNZF zTR7wXs0id#TxEhm*vB7(<>q~^ZZ_yyqZ8EsB1k?aShiqaK{*^Ci5W2Fp`DVE7f~3h z$mNa>;2v~@WxhFm3b)A4k^u)GM$Qs2Nl`LOH`m=MAD(gK<_CAG&-+*VCu(WCIqz?W zG$;gdl)kot@K6xYH~%aC^J~8HzB@tq!H4esR&^4g#Pj^P&>3;Bv1Fn%1AvU;{y&ZbHEy!<+)PfFd)&wVl8+3W2uk_%z$A zh+YHNxDYr?Yala2!me`mE@yW?dhpFQ*w*HeWM^97dh@XXH$wO3#Tj0KDsO-`LlR7u zd^E)~ZxDKrxCN4NUxDOUfW|G1)OPOP{qo00I=v&EfWxS|N;}9AA{t>apfCWyC(R64 zi6aa~DW(q>4@P@ZF16RZ8*e>#Uoc>fMc=hI^+RHLZzTK>Z7M-HISqUfRsIM)OOikz z7Qk&cJW$Rj+2ZS8=8F;ZK2{mpDHlaYDpkU_LR+OfOBBmVft6Y?oOeCG zPv7Hxzy9lAPv1Y_*7l{<*i_e={rbGyWGC))Ov`=*2!8y$h$AEw?aQKrs?0Y)Eo%^( zj|EYc^T;`syvxr+eq~0dKu)P$kVPIs4<&`A&b?}`6tL1BnImZwbc0xMZL0qMMmtSz zch$+jaxFSFTx2R}RN}ZVd!(?@-#hEI+=ba(U~(`)9W+AT>G|z+GkLLdCwvm7Cc0$) zWLZgYgqVVU@9JUfJ+#XP5>bSeGnjAoK+xsxf!jzdjU7zxWdk3IS>qN$bVY6Q%hUV6 zef#5g?{%GhL?m|@%J!kBH|RW6+eNBaoVvkjmf9EL!m!ap>(ASs)E=v=k@l?@X>^yM z9b}ERTkC3jnjdZ@mK;tNw3<~A%KDcfM-&LfmY`a}<`LraJ3_wtG~w8)r|~u2$OnN^ z?SX?wOt^PnRSe{{g-}U&6KV*7gfe(*IH9N`nswDpQG78U+T6)6{i9gAb1Bkl7r-kw zXCQPnt>omF%U`dY{kWWMyUqN3<<>RG(r4F)0lRTr$jZ&M^Hx(5H^O*R25DtvW)}2! z=b>sK@dAF8FejfkVDl@WfC#89Ux0GG4|8?T`dBLYgNJHHiT?Wg`!7#Fewa@hga#T% zB}B3JQOnK>gj+2F(6n%m6GUm|%&BYW*^F0~#CEQhFwAxmEVzsi>Ap0O#t(0lg>T4l zH;?hp3*zi225-nQgAJ26q)@wI@^9X8`fscUA~z3z`7iAfjY{?F_piUcd(w$=tgmYE zJPN1#9bX~3msIE5!9I?s9~W6Z(2Kh2N>?}*7n4pIIQ2t z@a!)xV#((cA`86h?%wL_#s+15HJ~jEyyDkie);p=w?7dE{NCwNIyr8q-kDFBj|P$g z0n1og*j?A=0=$JYpvn(#|N7hKADd63N63(od@5=}d8+i%L?8FIY%gtVnEOZ-5_h-< z+^F16$U}uH^%JQe9x3Uy@Q@r!P>Uw8u+gHliY85lFh z+emZbg041DG)XV*C^4Wtu`4tS+C>A^qIUC}HlR#Knh{zj;Dm{wp(X)9yWR<^QUd@Y zQ$#s6IBp% zZG)krc{*v+LV}hx33`JXBF064r)2`SD3_ipUss-NcU%B>UWzsdJ)C9_>2}IqO}kdm zM%~-N2H6Idt4=hjks9D~r@=#ipyGI9n`h8*O$eb`sbgVOTnsoej8DbcZ5Eglr(i+@ zD(w=+dm4C%Hc%yb(jZKz`@emAXZKTR7PK0L0$A$^aOG|EV5#Lgw&}S2>6g%Aop7ju z5ZZKSTPKy}6pg|$BUHmnt8rseHLRkpswG}~B5)tb3;XabO~>iW$&T4dxC|1(TfdMw zZ{7Vbg=#8q89UeTHZ!!AY%vN=1(9&XLukBM!U(}yZBV6&*2XUl%}?n*3J*9{zm`$T z`G)W3xOMNZx9(UrQg{|BBM??9zCGawo_Jr8!DvB%1!49mCdqNlS(eG zA8%_{^W5kw=W3wV_aumefT=l99s95WGP!{+hBV9p>1r6;C1Om_OGPtzWg|_tfl5yT zS@k90+wKWxs+wtvWMld^R6A8PP*-ufr5ftCaQw_eh025DrqxicFRh|jw)0=Kx-{<; z9WTvQ15H0yg3F*@KZuU74Y_*)bf#qp82gcCbvd1xFfMMl9`+{+<7fT{rve z-F21JbPVeaxMWtKiARD89YNDAF5iG-W7pEUX zAHLsJIj=OD$I1X%fF_r8nXAV^fw@v*N97e-^XhUx?3MfwmAJ7z;A~G zt4y+Ec1DISqvVjDo&n)LNZ8dWwkdIKk;g7#A@lmpxhQgc*P<>$+EU2FTX_MBJGr}2KuUv}@_J@3n?KkrdpiSFar>;OvZmna^!|J<*tqRXl{v$MpZSc7_d|Km&ELKVT|r1u7@$ z1rXuiIVnin4NkgagcI7ecTd0nP{RuN_35|Y{)xT_&*DMHY=gkVA@sn(d_lSan;u(` zbJ#$kZi{rxFVM+mZYqv_yM^;13X}UM(eMFrsynCGc2gxq6_gZI>L~Vv6Kig+hFKK^ z=lUq30Is$r3Q?;q1f$YRGux2>^_!n>d^=#{x*dpUeal%$m845SXaPVps|o0#FweyQ z#&*Saz*L)U8!ZAP4aKu9r1ZiyGc@5vXeVWuxjIY#2w=4aSGY(MLeTk$8isGk3DOPI zHw<)vZOg+!9`wDJ-V;mkw#smOl7z3-mBe}8)a$A>4og5z4aVl=G}E)}^?(x37Ntgr>j@PcrIz+h%s7KC=n zaaYcq^H^3mrxR!S`Iu@RE#wN_@&n`Y@zb|&zsrXs?1U2C>lXnvm-&gNf;;QEfY-nO z_{+E7p1fx;D0pd@32Y(};H3W|aQh7`dN~!vjZlvXP!(TV#!u-asmL?V4ofp~5`fE^ z)mi3hW;I&q#Em`W0)VCr-f^wd)4NbUp*q2ilaiC5ym9psVU$WDtNY~`c~Bw}lxGNG z$^gy2YA#uKoc&eOLFdlD+7IZR!R9kL5BflZ?M_K>gKDEb$A_5(T90IKj6F~lSfI4w zMpAm$ZfUul7eQl1q-i{Htb*%CB6iEUlPy{We5YT2`Jn+~D&LR8JP#xHG0t`7+qd6- z=*&f(8ONa&MXc*;?k`T@TG9=i!Q`*0COqn$KzUMN4>yHlp;PD6b(cv^s^flI9CGA- zK#;Ct3#_!MZ@|h`j$_HI(1HG=(?jQu(pHnoo&}4&1zy}Lxc}Z7u z|3y`wm-Xc9;0yIPRsteUksd&|lUm0y4F%k2g5Z34qSh)0=A3PoN`SyZVZ!eO$jTfq~_s~xl~hgxKlY$J2yujR8y8-Q9(dGPgibp+_b>2A0m5O zcMoa@-B$CQ_D|}gKAVqy<>F#XDo9+AN~xN2FkWSz(;cqw1@5HzX-*2XD)fLzQ7#~ctqP;@ z5=v3JdgUI+z}#J_R)uPMv6?Nv+vG67CT;-iu!o+8*A37UdwTaLs^E0TY_zaeU|DjK1%gr}3 zu-1gb8|R(7|Z`P09GApQLGW%qQy|57)d?zr2$3&1UG z#CFbhc;G1%t73m_cIYJxX%ZKJs+&39Oc+Z|<* zc*w1^e<0Kc6e<9hO6t^4w=g|sDc<#E&a;8{y>PWDO$3P!FWht*Op~{0DroYr8c+b9 z{_*wc_pjf6+p(MNPLN_~N?@UmG2z7h{|rhF%ndd5h_&n$ozs#5m6d;tGvkq53X3?u z5ISzG?Eytu)&{s4839k>?J2sGA=(JHzJ_qPXkFHxx}<;+HN+^WUaNx8j8psAU=hf6 z@e>;OiJ>Fyw6^IwdO)M+VLQcaB8cB0_5cap!+wM9_Ha8DZl};k@~~YKF!~c?<_ugc zA19-m%-&#pJT?Pv<R8#vJAAU`xEcU(Cqi)tAdLT}}<*5TAQNl1%kLh>kOJ5g>tpDu|cMT%Un0H|Ap*T-x^a z3aQVAY_bKU-+39V(w#srs32sn~%;8p|etRQqVzZ&7>I>M;s zxK2vBvj$qFm@=YS5wx#~hjB*F^2sB=IjvSSsu1RxS+fxIR~Z9fuN>9%qS&F^KbCjg zJlg~tyW#V4Ej-}MRKnAs&hpcbA78YP-Bi@8!{!riJ^`WTVj@D-=iQx(Kih#qtF(xW zLNz=6k*Cl@J5)@Sl96&pv~Iiq#2@y1+LeL|N8CkPxNWE&GC~#W$8d; z;cRw|_QyEzm>#3x^lwaTxRp0Rdy3$3|M%RL7v?bZ7P;FltJ?WuLr?^3e5i>jVP15l zX;z!q(91TEur(3O4KO&MW?m=ffwhf6yg`7s`tr-iub;n|4`-S=NU^w!?xHp9MN$n9 z_#lG)6QN-3dGhoeC(AOUE}H9O{Rp#`DOaaL5Yt&NTt$@1_%5Z)H9Ye<<$wS4qa|W_ zap%MF5FE+%?8;i8HqDaY?Ld5L&X-Qb!Ltqg|JxzH(#Ai%1COXt?DQ7i=5(Njo4_Vq zpk#fTKh#@fs@t3Rfj)5c=CQBABNs+lh#MZsth?E8}!|Y%mj6*{(AfJa7zNpc;(P3_A^csMuWq}7as|I}5U`@E=ZX$ic zQ#~Z7r7&RskszgZLX@E`e;*C^C*RghTo(`vXxXqKNOEH9In^QEPWGtng{gqq@)fG;9O}(0 zr`ZTD1<-OQ0=3}u>4X;p+5j>L{bgD&LDMmVGp$Ld^(GXdCo15h<$I!>*o@UL@FFQU zyZ)hn#1oo~;|46EuH*t*0xhsHd`Im9rfAY~JZk5dw>TI;&`=eLu%TW?X$ z(OHqYYXo1aiGc-Ib^U0Ug{Lk?8eF*)s-V`gvnaJ5?AIS8N#H3CJ%p(M$vx@KMp_BE z&Wy~!2}hL5E0BlQ3|La6;E!B9y9OL3X@SEb&Cprh5KXJ0Og&R{lV7Sh{)_ugjf}|4DJWpN$c5bkWVt7r|^y5&K}}7iry%+khj>;;Jl!A zDq6tv%JD9WJPUQK)YU*)6dtq8Hv^ zrXh8R0Rv*IYHZMAKT5q%h71!S_Uw!TsxIgIaVhgX^w9DfA~)IB=i+nL%!E`Qb!cfh z+WHTJtZ-EZ*7$ISgjOnK_*Lc>NG(^u5gJsD1eKpzWR>_ZY&lwuK_bvL!3Gpvh9Ou7 z<#F!Zd}$C-DoLO_v9g9A&StBO%U_r3h1Wq8;9S2zdPpK$R>xo0Q3??pj~*0>=3cE; zKcIeJsc^Y@F#U|^RnT~d;NLBfD)rEVSJR9*q7u-l>26;JFRjXeK=n((_-H*S zs)S+lp^BN2>N8T$?m5Bt*fxA4gA1)yi69bgbb&nf+vktJe0~39K9+?5rVcMGTw5A( zgj?XYu>6YwC;$qWcL|a+2{C(9gedaY_-|~q0i{1r{(4^>7;SJkyixW>8)VyMR__a~ zcB@wxx!J749M_p4hw!Qj~71G3m}v_|7j4@e1ut#D9HP}Lxy z<=(l*?OpqQJsDE)H462Vsk&cA565VOz{A1rtL~PDMjnzRQfbzd;kN<#Uxu6}EX)RU5xX!6d zGq_7Ts06!aj*|TW3GcY$na+9Zl;XTabHKa_p&;Q%r_@nOR44ttm9{8=Gv%o0`kPdB z05reK!GZpJ7`0FMi2b!`bG|*m3NJ6aR;T%eA&k=lweKj>4y*)<^8~#Y2g~}QQYt)g zXR(^ax^GRRM*({1Ogign2Ln0siNJjVTwk}o+UVaZkiKHCnDMHn7IKt9AsL-ob1BD} z`l>25tELB(Xt1v8j`ihbuMSIJ(gv`6_6fTDyr(G68UyG#-^8JC8hcUm$5qJI$ddZ% zX22CTg2K`e#N{&rnjw-=N(p*BZSLRq`;3UbMZ>g5J63Tnn{=XWRj2LO=G6o1T0xj? zu-_mdl+`+C8=%%R2<1a-umq`K?p*h1Dz(Ag18K|}uDj1Ob*2p%AVA7Vu0yU+6S*1x z;|}y~$&fpWc7c455F8@!)Z1U^<2uMQ0@}JGWHEjK^96M^1Du^U+to(Ty?w{-x=e2E z6P~`(cG<#>9gSHIyKCbftl0b`^ItPc5+#zFODd*;}<1FJ#pL@Buu9V*T;R%JU| zV+{|Jod9$MZrh_%izJtuuyO2U0V>)8p~?j%VuPwu0P}d&V>{Z95h!C5TGTT=5=d~| zd=49A+o@DOGNDg0(>4IJMk!T|NuQ3J4)Ci|4P&IB02o?(qiRU>#n4}4XWfGWEZL$` zc;I5K(Q)0IF%?+_r?E894>74HCCA0#<2)W4&4R14JAi81%nOJ^7>9elk#^Ey_*6e>y70ZV)(`;(0RSh!iR0s$V0MJ7`JrP?ZL% zXVJ%Pon58*T>$b8jl=nuJB`Rypa5)l%u7ujV7#(a1G@EMSGQKc2+G@nWP{K{VAoVuWs*!yE8nfAaT_}&&BSX(5!~>B5?XKl(4r^ve6-XBl%rs2`Gln1V|y$ zEA+@8Lz9F_xM!cH`#1{Ujtw-3#*q<9pOP|v`S@Q?zkT@r?ajN@XRxL81YJt1m)2rm zyk!n#Qv1xVPsbTlc;*0$pU zz^?V+ze2tZ@pW435qPlpXpIM&XMqX;L4}9FPDE!5JvOkAr1>ZqTDy(=5A&rtIio6) zpgNrpZ9aCt$h?Atqw}4c`oabV(9gMP?4?sbG!nG4LElP4jN~q(S`X?waz3_mT*k#n zK^oHVUMGFJ;|AFVD%GOEfZB5Sp;1KKe|d4%*SbuQU!26S%Xqb@UpN8Vh6N@`u2`4|M`|Yo{mfPXMtYhd1)#c-FN5a zrMhs`^xOZiduKAOt_4IqN4PHSoLlLKtj!J|4Jm$r{x9c>U2 zP?OiSfaZ+^S_=obYU5YHxD@RRp?9xLmX^C)yVyf~2sVmDQCv{=gXD@=<@0;n6_xwA zSgqM|?K%4{+#9hf@sOskN}IWFYVM|qo1bwjgfA_SCUlD5X?3OM+D^+{OjktoMEzFI zrf@q6cN*F&7u5qy3y2fN+AG7IaODa4W@n0W%-RN-f!B@Uu(hgmLVxwZRn?BBTxd_5 zAPWKnXPxL1hmQGOsUBuJV$u#m`DI=vP85;}rh7v|d#;6YI-ni^h$Fge+X-sD>gPt= z#;9VgxgL_kH#OJYJ5A=+wck?R)y4V3%?@47jz^0mtRC*tb7wJ6s=H`De^?=3fBf+m zT1jw_BBX3h$fX)kjh&1rI+~f#n0oorYCC5DYmJ$2NTij3r*hM5dHV2=r{CUx{J?Wj zdSJs`&K(`0Z8auT&dtC{KgZrX?WsD}m~6~NP8+2g@e>Lt@fySjPk}!tk&GMr*uE3M zqst4tO*yXk{5*-Ws{MaSlk2h#Qo%4({v5}z{H`fF)K~yPA_(%{3*$MGxOHPofS^7O zSA2iVaPr_664cbb5TUvsT2^N|V)hqA(Hn&xtXVVMAlObaBbMB?RZ)c0r}~$B39tA{ zPXr%V4atQ9?M@ksFYCZOQ=%+LfvA*e_dD+7QZqL6rMoWDbU>risSC4+&l2`Z_B&Yj z0IaP9_!t8s^MT09Zhz_abbvz~aC28Qa5P22wa!j?_Ut_H1&e9q;3R>HQTV=3#gra< z%3;Ox%DF568r7a%Yi{Mu3SlSBOU+Gi7fk)^*t0^>lEMU9r1?rCF9dvs0|8Pxe}txi zK&18rBT}7EN%3Sca{q!s)L%PQq(#wQCF>Q1ZTW3LyJkkry#jXJ3^EVd=94f?o7g2F zc?z0YqFSgd5W0LFY<7u;fi-WLuji6`paL|Y2$)e!m0O?Q{rL9FAHRQ;U!jTCeAZ?b z8!&*0&5kn(mn(VO4jEQ0KF5Z+kdnIK1a<&M5gMJ2;73Ms$j^|TgN-WA?&hVm&j7{$ z{P{1d<@18Wq$(09j1?*_)Vu0|}3i4ud@3nHMMhcTXF7&+RVYUw8lcb}y}qiN&NM^0dpFjUU&&?wy9^MEkW{SaC?HWrf>)YA z>gIbQrI=VxE=&#~nyx3esc7sJn1u5!)F&69hjNJaY$1+KeEP@z*nI*X-B2|vGtKd! z?l55AQxA~3O2>T~CEeK3Q!8I1$XHLuBs>IRfR{YHoSNI|vU@tX|M};ie@FFnfOsA= z9S`X~3}e3IA&mk$ULU1l!dJ`Q&CeP0LzZSKtyEQNa-g)00M6!TV$IDa}5h6a-lsrF%pzK$DwA z55U`>r?-RMk;=-`eB2#x$2EPlkKOU5erTcj@rp*1;?D6e-_TJz_L(bkbmxzk@e(`q zv5x2cEm{8fygSkgEE}3*YkzmgX5|=kxjWXE>-wn9yJK~e*)ITxJr@M{{&71%&bxiu z9p6Rke-^vr@pW2qWP#&xMrDE8?s(+bFgH5~4wcL`9FLUDdj}}S8|RAv+5u$8To)(% zW4srt_Q3y#!vQ6f|7Y3ZpkT8!jZkg?2^|3ClKp*j9`Q|eUmC!Nkg&ha2P5A`DP(W< zFpr1(alfYR9w~BI#yfju$HO#^3-cq$Yt)CN4H6FEVE;hbkq)p&+)$N( z64Wn2OhQGM1UM#!(#Jez(Xz7N0t&d49bWq_iTCKtJlY<>O^wl;IPTebnUHDrNLDxk z5|p1|e?ahz`Th`}|M(|wPhyG;fLQ+sh|$d3V|wvoBu)}>jQxm&J1X(^K^P|q>hfcX zz81xjV`|kbV9SwddY}WKhULWFF^%_h0ECyKKY2_;RIvNxz>_H3DH90UjBa;Kw!D=b zQ4b@od!qgVvb|P}9g}?&C44=q_9c8?k|y}f^a&3VX7M@+ax@%)`h|N)>%f4yFXG-9 z$M|`OryMC6qiZnpMdBg49v{eDamEt$2I%2V}BSdt9{F_jnOX2r^Fr2f!x|P=XG`JslxV0;CJlBS7S6YK=cuyW=yb)CoVb(&Fsi;lAFJ z!zJDw{@5oUkt279 zIEd*85gi~+5;iJq_UQn4G8`eM13)09-Q`0TL>a%);UGpfMolCR@Vfg0+6;W!kPdJt zWsVncpd&kCY;2G-P!^hNA=QDOVs#(Pf|mAiz|2QSyj+F>?E!B9sxuA0q{c zV!KC&6o9X*!ig*qaiiTsiYUPmV!GWS=~j**0cb^K?st^mLT)k)Na+X>-H!59c!>CQ z(U5CHyTkHC@8BR^DxTo*B-_-t%R4Pt&D0KQXVpdVsFM~LVEG4dy6R}`VBK-)qH=>Vtz z;Rq;~dR#!WF^B-WW^sncA!>AlgbsinK*+KXvQA>2H84ohWYUX}0W2`D5ppXnf`=IOb zb4PFHl!q_zdnZjTF!UvI8Ap zZ~s7PN(V@oX(IwYQ_QPT+cTet=mZJ7xDekHIzogG&wy|@I#s-ynKFRaCRJny+olO{ z^n*qjMcRyQ18L6@8a5*A?9vf@2b;vc7dqh^mA?#FUPJZc##?{XgB`qk?dx1Ef)A&*8I~ z{s;D6^#XBnrU9pn1DO-rxBaeTcJLOMd=mV$uzaxe@KvL@lx8BH2;))Dy9 zUODQTF^nVCY%&h*9K0X@JpcDb!v@6$Pa94=&RHFG1tF^6;0(tXD;-PduP% zLDQ9S=#%wMK;JZ`6F`JV&W8j^o1=u7ju26#7tjIXBzIFyU>(DhLo=5#@1Uvmw}%lO z00o$XuGxNWU%7%b+xJgTw=R4BF+F|7(UxcT>?1IVksB!D@4U>oO$XpGpcBOGc4m9j z><7-JT@Z6hVbqp~K#8|H67XU73P>F-1fBXmAku*KAtdNibH=?XUKz&;67#~Hb-bVvZN?aE8heSH5~!H8D4A{P9vG$ul0C65_ z1dbw?$ygR8z5&__v{-oUowBnseT*CzGsnfzo(=$^DbMp=7L{XnZD?Z)0%}SJ&}dIc zVDp17jV^P>!PAU#9%Xg(E%tPTfDVAX%f+o(Seh-REZk~_kfXQkKXEDmO;Jn;=m7Yu zItsD}9U-FIsSxVL!-QWFFNgL|`pUQj>db>Eu-$Y{ceBmUxTH{kD&Bp z-am%jzCGvTavdvNUoV%UtPo~-*jJ|nVHU41G|UQ^##ic6;Lf~{etC&5yZyWOhbOcR z5-Rq`TTAt(3!ZkIX@X;L4XWS$u^E?XECJkeg2jA~6s7|}ykd)tb|Ih>gj|P!gghZ8 zVN?zr6psXyCh<5_{B(qb z4gjeh4#07agg!}32Z)lgnvp06ZpaZboFJjwaeO_nu|Hr&2S6Q@cHCeI7`x&s;Bx5$ zAmvaKuS!__@n&c(Vm2Im)W}2W3P3m00W1%8_(F&_q?$=U2Y`SM2iU)~7us+F*~T$@ zP8zb6a|~q9VISUrj&;V08qNj^IUIy+il)`b`?01FK?G$DkIMr(0QwCaIKwrRD!&tA zIs!T%d!B-{yl2+s5Dt6Pdv=033y5+E!JHo?WnFlr4?b`zANKd~u|X-zZ$LnGEWJxM zL3D(KZl|^gBE!xPX*@jeg$1nX{%w%s-`lRA2cFP(1w?cNP7xv>r09de0T3@vF5>4v zN1%W&A2b~iV*#N$qG-0~s36DT_X(PHIDn0T5;8gfhuBaf;WHfQ2zY2JAIPjRZ%2M) z51mbenuk52N=afzJ$yO6}@2xeP^SJtOc5C*IZ*b$>C1pK6QfaJBW zmY$I8_5SDz=JQG))xQimX8)Supmk=$0wIJ|JD-Kn*jwbB2pu7$10Yj#uAQAky4^m^ zgStXjZy%Z=9KfOOxc4G}?I3PP7N8?UY;ycTace zI;0I(sH97CYp9x^(#DJ_0ujp*6-m0d>Es zzY-2~00eYkKnD~;I6_469T0J}iMNL_9Uutl1Tlwo(`>155>d?jd`O!4soOMT4Sq-3 z_`ciD1Ulpq`~-A>{ozWR=mfeQ_Z^}GFkC(~zwhbi3470ECzh z5OJDiS_fi6M~LYF9DNKK0OWwf?N*Tjx?P$+4!<5M+?H}i9ZgcoZ@ZpaLfW_eNC+?I z`Uc=|I~u{%MgkGblpW0Ug%H#2ST)?oJMY3Dj*l2TKO1;$n)IhaN&0Vp{6XR`NVH4M z8yc|zF^^b)1{D212A^=)hp~f@o9c32b3P%@rflnDh96Uy#@9+CcRU?eLc(zx0xF}F zr^1j95M*?OkZzYIG~35)lyK;Z$;G(_c3$uk(gF7DH)Vtv0=Rrsj{}gu*s(}i8?i6O zc}}_=qe@3$#m!UbT)+|7VD1TcSF~+xKG`YH5C^IVsX3L>fio}j3FtnH-nBj9+lobMJ zykcf=G;(wVyeP|Wj7-g8Z%xMquXu2TuN3hsMVudEj8QEGOe9d2r!-syi0KFc9RPWn zliK*f^U(=OIYQ3SzG-LQi?pIM+e0yU@L=XgFuy^M3T0*qKZNKd-0p zSN7dFi%SRKv?bFYy>L1JUO(XLLt>&6KtzuS5#7$~RvZcFHP|l?0y;oI$%H;$ODef@ z@4af?CATVf?Ud}2mtu}?`*xSC<+yMYw`5JI^W=8PvJTpgCs``nelWp**9Mhg@}qJx zA(Bk>OZxlgcN%0(Xzs4M!S{L9Rwuh;v+|b=Cy0Q7%v>e?I5$Ik0bKgWGx9&mXy2aj z_6e@iBCw>s*Tqm5`2$hZp3)_Pt%rS`JwF!Ep{|n)Vog1Kt`0l_r|L>gw4};c?zoDl z7B%v1neUQ(k~If};cbiql52`a{T94?z@OuC-M4JJ70^XgoF-oaL&Gr640qy~f`odDSziEucbPt{s4 zB@pc-MFIRobUW*CK!oFXZ>qT{mN<8>X5bN;rFP;1fC4 z%1Y5!(J6r{B)A5m039Ks1E9*|oNJO%NkgE~AcVZlQ`{x2{-P!1xnx5vlD;o;CP5EF@Xfapj^$mn){#+G5B z3QReArZIF>@H-pG&ooR64(I>@1Xm?Vz!6Ix;*}D}X52Fq2!gUl!eKC#wuH(OOkQLex*Y{54WlQL zoML@h&I^XRob$>FuafY=r$O#TEy0+uYs-(21pRn*e1~8!i}-**gYHRun_r8U8s}o_ zg{KwZkkJ7$iXsGvrIZKo6Doe_lp-Aix}Bd9M?#~S*LJCZh>j4}ZQTlJ^;tk|3P4C% zkJq5b!4V!nNJl{1!OR|A=3DLXau9^*0Qd+IKSE@4*o5GJc}4ajOXh%MqTGvoKu3sD zyA;_rWkRBNNC!xdkg9ll%1OmN0Rm(848UKcKLCw8q)A@HYKjd7>JU0YGT+#PA?Y6} zPE=4J&*7soA)}z~X)Tc11HE>-T@oH6IsocY&X`l1M;bi|_jqCF7vGcJIp%qMheY23 zLczSOB>_T?a{@X7HGX&-awWw9W(7JzNJj`zH}e|hjYOb-J8Cu20fLUZQ|yvp#2?ny z0e4h~7?T9YJssc>((P=hiy0P;Ivs$0Al3^gM|1$Hh_D2jio}7C(GfVl&qqW79U$bC zFh6p@IrlJpCZPsSI6F(EG8ZolIAp`;1OeSHemvKQr7m~zJ^8xcllJ+;E>^c41vp-& zc4(J7pz5!9!CgEbCh8awT+~muU3}%zA2i2tzqptyaN_=O;h$X$|8-_KU3{fI&Ru*- znYZ@e@k*0fhX` zS$F&-bcBc%7h*|`ISvWqC!hnc@<1xboL~xqjOiR7=Bq5f#fPz2^c*UAar>W`+RSYA zsqmwJJ>CW9P@oY$8e2L*7}5bCD^edL&gML+uXqrOD|$op;UFEvFQiJA9q9;rIzm7P zK(Cp~S1~8LG7jv55;{UmM~LVMAsr#0101K8{vSu*c~Pozx-*$8;r-}H!2x0_ z2njMEPsKJm$PqzK>K*78nW7~rrUO7Wrx+1)Bn^&`(Geg8faw=dvvV&%^(Khv2oc>b zPPvUHTE;j%RpWHRCq_pkp=GBSA_d)!${2Jz-znt9=s8mlDdu=f%FmN>1e9u{u^(6< zBy@y0(GM|v=Ey?q`>;Ds57H6#bOcTs^5U2q9Wy4#rL^FTJ}5dM0uI@p#$617o*N+m zeruk8N6Q*h42~}a;E>S)vXBmdGi+k1c1B0gKLVA}csqJza622YiD*;+$O+JtkkAqA zABoF!0)dt<#=Ze3P@RBbCIOAZ0HhDbQ%GTCd;oQ>kV+g)#(}CyfF`ogXO*i`#=zJX2%5r>2!Cd9rZ5kfiu$}%+=V#-;` zUN4BRNk`xy2Oopn&z>z+Gh@Aa%=uYHmlts?h(Jf6#KLgmSe7ja+Bht>Ke{HQ14LYx zkP$R&LkQ8o=E#61P7hbEG~W41R9=YmiIqOo$zg_$Xhw-uRdifu*S$FE-*Ec`I>KIN zref*`hWt2?8(8HNGDw-cm{X9<%hCR*>E)Q}cJG&FU7mL~2*tSJb7x)K-&q~9*PBp* z2#8e5rqzHW>!@a~?TcG>(zN567><9S@p~oM+OwD|&-jl7!9-p(fx)_&avG&RQYh&U zKLOoNYgD8kV=Gi%3qo~!E@xM~K6sGP?KH|n{mZunUC$m5I?0rd4FXOgkoYfoqmW6& z`ENxsNDFQ&O$B{AL6o@%3Sc<6;=<1v{^h^c4*%8rDyWfQkae2sy0{aIX^3hPZbwO; z4nR!{Mk3^hD@!M$Cp|d)*!~h!lSC!RQyixXI0K4g(Yg_q;=gj5iN`^#q8P^WLff+d ziVnDfiU<^XAZD&63xpw!j?aX=qj^05#XCME)WR}CAVV?K&Xl1|La0Vdpo?jpgeAs+ zcLk~J<9g7k)Uud>HGfFWZaWokA;(6mIIp;m6Ol$5dLU=!Tz!Zs!XfK3PCT`iNIY z)N$c8VPr3FkP4_VFnH2q34B9ZTcFtk0^TPbJh7ED*n80X@N4Y zg2yW@9RP0az^&^+M<2<6bE(nbN%s+$o(8(;uw8xduO#662bqr%!A?>2H|#wrNd&rR zzumT{DLl^27%S$2&;u)wK-nhTAn>3x36kx>iBAf_VT0|OKp|7%IO{#7=?1!g`vS^7 z*#^3X(srf(F@JT2>dUH<`c*L8SQyXblK_dnBI z#faOU?e8wSR^8ZycY-$71h|6ZZ@Xxez7%|h7CvYA^euX*RR@sG#g{8Yhk!*VrNj&_vP^_H=~kc-!j~s@907&~@hEqK&&CqeSR>&=ENEB?##N z5w&@e9aZt@2r(TYqBCG#HVEt#jZzL9p;k0XqYXk23FFB6Ayxq47E-8EK~S#tz{sk~ zkWZjWC_4Je-5}TtSUv|&sl2$LGafu8#|?CDuTo{8gzzn$t1jHA4aA0;G#pyrE%ydLBLAs2oW6sZ9KYryXdg}1%`V%LPAG~ zR1lnlvgd6A))C$CpaC=(n-&&Av zpa9bCzGRDjvR#vGVJF))@pg)t=s0YYZImd0XnWge3o_d7i?+u`TN;H@uXIjq8PXu| zU}+J^N@kR8l~LyMG%cz<#7P`*;U6S-DxA_0BD!7V6?zE~9YESJhz-?pAS&@{)IeO` z%mr8ICLt~eCZt*ffaCpWnYq9wh#~q#)NiC^Uco-%ZDB++qJmI$TIPio4}k}!4}t5R z0KVQa$To-s_JK3jJNv+c1sH4r29`Kk&{OGn960CC!=n|AOj&b3cw%yAUQFRK$?YPa zZ4D9uK5065(%T5a4ft>_r?lIAPBzf}+4iu#WrR#JiXNs(SiyEpx}8es419zV7U(l6 z{^D*I!4_g{IXc_2q=D{_tsn{P8PRrEv;`e)7yGJDpl=au-(t&zf&|y>>r=B_9t1xg z7wyeXA|bD)5)CQmkhqos5Z7yTAq1J4E~+bX0LYYj(PhL>NC!Yux@S|Wp=UO(=-#CI z*-39HVAZ%!_jCXbq9+UhwdP)@P$5&7Fk+j^Rn34sok5i89NO1?WDsz14WEM!7YBzT zDpl=uBWl#W;=9$c26oE29Y)Ncf<*WGgxhab>we3`doOrP-O54~>^DdSEO3J-X14v- z)b6*;y5I7sK_sxRBuI3PuTl3~jVfTK-%F%EZlI^`w^J$CIxC%x1#|PDwObY>KH`~U~m6O=##N(rPdGU;HV@ME~n)L;#4eS znM%b_mvc2vBH-dFR*@+rx|D)U%Bi5kRP1C?A=7hWPCP|~hz>xFP;^)b5f{Hwx5EAs zIc=susR_Z7$&@}oaF`p%gUHHjx`~15R==iOwzE#Zfn_8C>-khIdf-9V2x5U{)^y8t z>6YtK-;?u@Y+x7rrw1ruEXnEC#2e`L%tvFZ7}KqZH_+{S%VGw)c)!JGzdd4a0!qq- zb9X1OER$}{xfC(%u7ve~U<*0f-Xhs9wk{ta-mZzaQ`Yq}u&DaxoepHLfa9b)u7ytZ zBix)F1kBb6*HQBIAT|W*yCi$+V(}Dp6*);tu%1ca?!r@l2E(|ahfbN?;Rx?tK-R#Gs|46!CyLp|C)&( zWg$QgIGjE4`y}D^eYT!bvUQM>t<)LlDZzHJ7gPky!AWq;X#$ksYsO^jP9K%e*c!7l+bIpukyExv$L4Q@R zxJeetRu&9GfyryhCh8g-Hc)`RBnVi7lC4N^E4r5)tzo>ro)RWi{NwlUU;q9QFkjlT z905bPR#@n@1lB}0;B~OmKJY8ix;7{&-q_8TUC3zKkvNx7(O-1 zxWO|amNG|V!`uuglC_K-RmbQE5bI@ljlY)nVs-r}JBXOW;;l6>(AA;u0-GJMbR$Jd zIXvAU@xZSY`;kRJU>Pgk+Ld_A;pi6A87M~4$Inkia|6A6Z_R5VTeZKGWTRfP#z{LRF5Vhy4`?$)k zrOV}Vc{yG%K!e&+N^Nee z4Gg3)u!f@#V<$d8g;%L7P=}F0(ow)LNaFae&i38-hHtbl?Yr#j>v*_;=R4qVJPijn z573YHSsF?l1Pb`%z7xHDH_qX^E}-v3Z{JnVzLU6pml=H>!B+4TLcTrXRVDx``0P1y zx2p*5yRkB#MQ{wo_-+Wpcb!TGPEFUB^qtHjAeS)AJt)a51}^Nt`3_u&TG9JXT=zN0 zB8xJG{6;SEJ*|AqKR%Wh`mfK8*XKxBQ}hicl6;eO?b%W{1NMFlvYZjaQ3t3#;UFNH zJxn0eW6dQD9>@yhgs;Uo071-y5JuKQ5@6g2@`i!Tg_JQNZ|@8^>TsC}u(TU7qT0Wm z)(%89+Vg&Jb9n?lFZF@|Vob_g|3F;{*#!*<)HR@<4WGOcS|E;R%OE+>xUQmcgR;hr zyc(BXjjMl+>oW?lXQ)Dj0{m5s%fN;!;=lm{bp1-h`PNt9_awl~p>LdA?`Gu)5)Ii& z=nR}pZh(!a=Zph>x=y$VNI0Cl43ck+%Ui|`rZI&4^Z@pjBqa0?!(J(U5Q-3kM8$Wp zbXkunO_4#MT9^jx&A5oV#AT_Pp5q;{Vb2Vp>I&_=hxkJD^~C-a0f_(}UrI1dM*(^< zn-T=D5h6f@#q|KFi{bV-pz4&qIwk@=)SEo@jA=jBWJ8G1`^Lz#hhR7$R11(L2m&6I zhanyhBmZt{P$6WHI>~c63loCobh--Zp(iMQ0(`5HSw$gCg$hNHLdcKwptgNy%F1E0 zL$*#O`}K|yC!AEG&kwRn_%5ESPd%3}3I6eqgD=yCp#!|8lXl%KApojvfJ9%z4X6qD z4&;(PfcpTxf`p?Dy5|OqJ=c@O3|%Y_ja)d9N^_T^!4L3_NZi@D$YAm2iQ*e1n%Uk>KG|26nId?F|LdoZ`>3w52Q zgZVN}1uSP1bXz$!4AsdF1hwVe2+bE>cL0|%>#=F2xdv0TC*=8Q96pxtyixxa9bNO( zlnaSJ1lZUKA#a#hv_83DSCWPT-0aC_Bknpj$0e}@L6cx_3iBCz8RJ>2&1P)8V?JGZ z>Xcww`wR8|%rdQcD=tmJ4_(G-9F~z>=w4d@>N10U8S{y!N#WT}yrR)8!4}=|(8Y&A z;5{Pzcy0O~zUK7;Q{Ci3&zK8(MW~L-M}!}+sXbnE8b|qVA4cp3RRHL-E$}niqHW-( z+{RPh1Bxp@kzgoudhyAx=;KgU6_ua086A28P|q@A(uVq&hS{eR-u&GBz1j{MFXs8# zzg~lq66G0|`q^la`TN!PuOGkA{eRp0b-tAa-SKSic~J%otb_{i>FR%Irs7ur%g3+5 zo7X=(ACw%7xCXfNBgaQo13o>_{SSxd;5mGbKsLCC*JzG!j}w5~O5MEQC)*?W-cRFc zLdm*J(6B1uQer190W7jIm+^Ahb4sd<+Kn^sJLC;|zxUYX(;}QE=glU}`?MFaa+U^fzS$?N81;ezdo z=@C68YICQM|HK9ZL&MO)R0$wwKipHJ(_!EU|A`I1rUKCLM%<>y9x4k5f*nvSAm^pk zrl*hGqSRnpL|AVyZ^y0N#}zP~>XAZz+n(!FMFDor{mvot=3pWGG&42>gUe9N_~>sN z?2j}v@U~wB8SBZJ4tqC{OiX}n+bNv4_KJu&!hS8YLdoDy)pK%tONgx?(TG*pX0o7{{{{OC;eCE7d4D##q+?byPlL;itF zR{AH($*=D7t;j3->UN#R2?E%wrNegM1oK>RaVGHJThaA0Fq?qo{zf)dq37t{-sEo> zumvW7cT1&9U4uqn37MCNo($WLqRs$-cWTGaMrD!# zHi{TnYF7vy1Ptzw6RhOso&jDcF@vcSx#X#5EY=PM0;4X_TN02*MD8^r_X=*sbtEUgua_~-!C>ThyfB&p z3z!5#pIyR01I79=BM=z{Uy>k{?xTsUHBw>*X2-as@QySxAk1P^LRW;LHxLc z0R#?w2a<0v4kEW1EGhtano7`F7T;dLQB04`H0BI!;vK*v2LOYmM+~r(BVZx{?**K9 z{ptj<11alJ8RT!0rg6aKEKM=$Cm`iDO*I#!sTRQ$1B;PDbQExYFybNL`{LO%oK|U~ zIV??P)(rshCY=DbZ)M!}8%$VlHVM&-JTtjCC7QSlMj?$IgaWC=DPa@143hCu>>eO4 zuv04#$h#%_`5D-Ati>-Cv&0PY`BPW#Vfl$1?u26id)r1J(Xh1K5g18$%)rI5kcJw$ z1b1~_8o9URA#{c0DB%0*;>(9~6<-Q1iae=P=&^l*7|AS;uL7X zXLH*}g(MO1xjG>*Qcy5^qb^eN02;EFN^%kCBY43IL+t!S&QBy65Yt?-f~2JHK8^1_ z1ct;t0ngV<`WC*+89c@cFj|wqNVfPf?yJGPMl2xhWa^#sGhcG`PwKg3VZ+5%Nb`ZG z4IoOQ#FhTzC?+Ijpx;NJ_rv-erzS%vVAQi#*9r8WV+F29l2jWAK>+&-??)cvb$#ta*l3|b+_ zuBgPG)(3yDSwS#Y=s65Ip@M*CQlZir9I=Q$ zN)Mvn$r%Gm9vnq;e7>@^BXd->ABB(s!bhwWdxKKsD}+Y}sRQRbWIsk*9G!kKM>pvr z6nP3^;s9~h`Dp=8e^mq(;HP@7*MX@!%##Um)KpzUA$1Tth!_kjX$tW-(Ww;UR%$39 zYMyJ5Rd2!^bv95yJjV~uJn3MLI%jR%vJS)5nnpI_DGGxvggo?7kGeEVKw=#}{J5Z< zG_LEgFjK5a?76Szxew#H52KnB=BTR83gUun{H!FYr{5!8#vY1hCLL$H=XOA4ovId| zNmUcoq}b02byNy_?hsK)M8rnEBu=L!Az*tQ`oZ!e+?McKCxF3mfU&E{KNkQW2LTnJ z6xj~@oWWWkY%TMaWLVD5OWNrNhLG_v%G0nP2y@C*|KbvL@vzeirl~O_4~TI9G>@k) zkGmBj3O<9hhN;W6snZt{!WT(Z56-wnBfOOu_wZ7eX;YpYPa7q<&C|4X`8ZWIe3Pnn zkl{rm(5x0p)3XwaM(Q%MTQ;H)I=~C)1fX$iLtsjlx0vMt!Bmxb1USYzeJvo7iKMfuRz-3RHyp{I9WU~ByCd9eGHdTQ=PC@pu3W6ovs)) zk?jbu1p({=0bma*1wd^%V88*uz7Z4&Xi8uS2<)Z!33@MLI0cu)`Z^$Dy=HBmIrk>AC~BtEWTRSINAw~E9hE>|WlpRp1KXHQuo5-3Ct@I@0NzI%l4V(-gRIU)WIp6}j+)z0gK zYTdAtanDC{mkvr26VWk%fleF%SnG@d{t=eN2)tX5xtf?{Tden|p9BX0EAxGThvR@P z(%1s2!O}~tq*L3t2#~kWgG=ZS*@^1d*r(oa$SDz1wuALh`oTs=2tbBM009mFBmlHm zv1{es;ts=WI*tt5T*qAD9nVTg99h&MAn7g;32-mSE$%R})O>>yKg~78vFb9KSeFtR zw}gWY|4O#u#TdtMaO6M8b63-&bHnZvLijAPtLS1?jyJKYewoHP)2nZ9|N3xH8&4Rx0EIB-FS{w+ zZwj#7AY`*#Nldfp3D1i%A%+ZCucT<4n_-tY2-Sbg+aePLQNokNOljl*8w?2Y$|ptG z%yo$RR4`(FA31^4s%V^F4A0>^U{k1wAD?1x5%^27uMq=kOx!@taD*-!^xq?N2O{c) zU>6Pg!3sXSM@;`b81BJNJU9T6;oci|5rWMbn1jWZqX;uRvJG!`sU3$En`VP| zAKO0Rn$PxT6+%U^VL~APh^VIG4s9eJ53OITqjmj?04E4GcIt5%!>->>B{a_vFn+5_yV>+$VeRF4cA4=$L-fpZZ*5KWGfEnLeGxdtI}Mbj;2 zF>ZZ|iKI9VO5!`x*JX$l0=_?V4-Q;FYLmc3uI#zhCnju>Y7p$&SRdVR}{{oBf>n5^Nb=9Vg`T027V^&%X5cbU&t2FC|==-jR+8A z9d$NyOtrxzCdmr;@FA?(a3I(w4VhQXSRSy>gz_GjT|o%ULXiXC6b^YH4Aw4n-w|Rg z`SSo+`URU)2DXZiJR3&jW7m}fEb`$vh_!gg3sf#~5MT>9_7m~b0N7h7;t*b*B&2{L z;b&z|lQ4$uS%8OwAZWX+KxjeJxv6>>B4qoz1}jsryN3yNouPubNWJeCqbTqtqgg4G zUS;p-;l_ch`lxX$RRoatL*pI8ZeKA)8>-@{0J5V1-rJQ7fsjF4s!-LV6+8uwF@PWA zVH>vK&ZIA)8q*4RniJ?lSDdh*CFB=%LKH7wVc9!WO=%N4X`UCd9D}nG7m-j^`3OSy z+|UITYRfL7DINyWu#Jund`?2784Xavrcft_B<&AGBdzSvE14OBG4Ba>;N1kVu_h0=nBX*xJsudt#9W48Ny-T@P(n37wiXlMDP909&^-%c zwU;6nH-PtY9b}mtP?0~a03Cb{!eiD{csjObjGi4t3O>J-=rqAQ_L#uH8;oed_8m+y zWvtDCZEEAw@{b7^#`JJxUMw=h9==SlQjW9ahf^Z7bsQJ`MfDNr;!5LI*eC=HTId3` ztO4ss{12o9$g)BvRzR@`T=@z-%sfF)9hk(Ds=6GL%}&b8>$(Gj)iNPAaqxsCI&K_D zme4TBVqbxfL(o=87rQ(wag^QgP2fsYpbHEXIK;^L(N0L9s|ge$2O)zNA||NRDus@c z<4H+k5W4h0`HE|hOKdl&6Q~Bag1Dgf-785-X^ZCH??HIG0d7HhTrKPmMwvkvy zLpdO@^ao%POy&`x&>=7T*gFg()g<)I<1kk6hMgSd41g`x5hgk@DAm{;ID)A%B6BJr zoch#O`}o-OLmA*B0E;!TdencMIG{HA1<{9MhCt4MvgC*1)OYMn{t*Q?9Du8plnAzJ z&GMnH+Fs7;Y_CA;g{5{sn8yy9NCZ7=+xWpp+oR?3gU1I69@?DSf1GiRwS)yPZ z25`XG^D|}OO(?O!2-`peEUd*wFjWKJ9zN^VBFy$K-kw8!>5w;K1q`flO;8oHKyfZO z;leDpaz7iI;LV$4*#qNMGG-X@a$_NCp@imgIw{GVJ8;Tsy_YiAhfgmk^!%bKj8j&> zXDYa+Ajm5hJ}a;Jyz{ZfEYUB_h0PO+zuy%0Wh$@Fdh&>Qyj7Fl6fYXzc-|Z=4j%p| zeSFN;Miu{7cqC~Q_k%(=x)`)B#&NS*cNr}_!{Z4u{V3=jRul@D*kiyZZ;G#eQh+jp zVtRM*NQpF3NIp7vd4=SK()B?8P~+hE~9{5DUdbCKDRpV%zOUvbF!@ZS&o;a#+HV*aP2_z~Iz+|9Aeh8P!Ad^}tx zhy`8F`CsxskCrgV9`-McLX>SkIB02oBr^65VbGxD?RdL52?qww0US{V-%RCA=~>Gw z{7c#fys}Y%e(ei#8yu(_hadb~;~=|C8eTWfE62GR!_q}bJ>H}$5(=Il&7}mTVc>4( z1rN0^EEV;CyTCkFCd3l&l=}os`exqIeKCA>&TFt3&rJtgl0qJVwdhblG!+Dl1NO|O z`vrWCq3=6CByeMRgn{Gc>$JWs8fJmU*HKyAQ?mzd@j2RE>rI^CUEnbuoQi3~GFta2u4;2Z?uC zWM_D-@-ZotAoBYjIY4vR=dIjR1{ibZ{2<7n&k?g&4vYdze;($n(Npu?n3wMcrG3{! z_gz=Rt#USQm9ycc%viTBB-f(wc%H6IE&v^V_H`M(0!Jy7;VrjdnO9RvM_pDdWAM;_ z^elWe0;u3AaEh^IHn}lyaS=OC#(#`g`<@Oz`ffVT$3|={Rl81y?>g?jTEa4B>uiB& znx(GCmCCVs_WkD|pp0*Z%)-F5F>TlM>u)e1n-iqi6;wc7u!XdOy71PV zoI8AmG{yl4a1c-rz@S#dOqsz1GbT=AetKkM&%XhvcH-MnRdC2y@Ql7O3?`@OR--q? zMUy%mqC3O@$#zb~1%QFD`@*uU0?5>6g8=vhQ7=Ghk zT%A7099*t>?L`Ud#JVy|&y)O;-n1q{C*|LGm@E9jr+7i3qR z_%v#9Mu7wK*vRw27+1!P8@w}WaZDj%&@yV=;GJ=W-N*p<0MhwRUJ0I>L5bhOse>3b zETe!_P*WMknRPZsM(Ftd&|M34uAeE^i&Dm5vmO@RjB$hCM(t-P@N)wl5fn1F*NQv< zNaRIa24I2W{++?4i|^jleOxtIW889ah0p;%PitW)y!y}==VBx$2jeYc$xAFfH-7HP zIxmmaMga9V%@}I%PQ4w_-g;S>=ByAP=BABj^JN-m2vDBW+eM7&vr)Q)8x!`NLCsAc zP8QS<@INAmbtyxfj8&h5bRxu)P0|6Fnukj~%St&ff<9ylpthOnJ@$qzVUV8)Z~%Bs z{{f5kaR6XDCppL$fI#R4@()B$3sGs{1HcG20NSz)L5ls?TQErt94fY>L2X08djkUu z%efw`=kW{r(Ye90VvkF|@4yIPslDN4^dTB@rRYC6W)?j~*!SnU*u#7xZ;)r$7N@x3 zH4!o@1KIu9h&&rJNQR_rkz(^sK)^FyZVkSIr{K9u$X4ECHcQBJ6d8puaS#izSiX)qNTRBZ-kuxwr*a1URR(vv&Y5{mgkY=oysr_XFZXG!;<@2|-qhxP2ZUPK zJ+&~Qz@9L@!1rs#;W_KSLZNdC**7(*M}DmDqO0a5kT5-LK?5QdOFgHn!)xqW^z)oh zz+1r>E^nT9Tk2tXX1q+-mO(c0^RC1F;!VTByV$|zr9F6~{5^Oj24=$i;APmKfj*pf zJo7?Gg3^Oh{edSg{TTYOTu;cr_)C@XeEso+TAv?l6Nu?J0Q~O&E10mIK-r%V$=XMkG3iy5Fv3-H_} zY2>`4O1lCaHPy24SUoc3)Y5F}In_yl5cjK|qyWAHfyXNscxNS_qo!Js0+dexH~=w! zdCzG@dPg+mmoWO+>=-YGS<_}8I0DwS$ zzfnP==sVxOduf?9^qj_{0(&+OKddzGVLeNdJQJYrK=rDZQkIbYHKBjZI>=rcVgA;{ zARmVXc{mQ(!_&ZkpqH|+hd?0`%nS5>3pQ;^a?$(Lj8cy0p3JAIi4sO#ttF{ zju6&?@C&H;ULRKEU8Os7L^S0x6!J_@eku0P||}&;)(w1b(2$fz(J?-5~;KrV|yt$N_uS zXe6q?;juO6kinB2o@leB5INvSc+xy7#e)(*Ut1!Dh(W|zPt83$z>BD6pF+UE3V8~l z0@70e>45i6yj}^3?o2v+iOU26e1FU<4824}Uj@Dt@yL^a#xZgMX)Z`~F3n3+om2sd zq{^e7v+b-Pmt4@$@(%|kdHq1Y2!rz-azH*WU&Agxp40R564jJu@T>*6Psq(2$r4^% zlvv|VfYqJc4q%ILm^1=GLZRLkkzw;)5R^O&)MDpIV%{2kZ;FG z1z*xqLI%kzv8p`-Z~(Lhid}URs}ib$_`z}ToD!fH>pZT4VbHr=Gv$;471%TO zd$SB0F;#x{Vl}ZV;PJC!_XyS#9F*i4vGc7hSge!2UaYzk3PwTV5%DrVFIM#=0l6!5 zAxodlV_m@jsmXTh;|0?(UaS+lUab103Z6oEbij{MMHeBYKvdXMi7l8Bjp&H&66v8) zvcLJ4HQ(RoLHDn(Y5qH$;)t>n9z`8N?hJb5U{Z|P5_vcXsLv6E+|Xf%H5so4qWeKY zvKIvrMtTmO?!A4$4!<*OGXZ$8k%>3{g;>Tbxx9!qcoAWjmm(+OL~dwL2x$^%YR zd6KeQ!WPp!XXx2u1-K)d&+(kCXD@Q%Qsi38$mP0-Ys^$`jr?N_(`Uk-bCeen#nxU) z;uvwS1wxyYx5(9&450!nD1tOQMykW=IjuQ`kO8BL{B2!}8tDjt7pVnu7?V!1t8NPP zaS){EdO$9ry3XVJPB+OV2tAWcB+$biF*bd}Myfny<>{`f0ND;4fP;XwA{ewP3tcr8 zy8PqRxfIxse*e(bJWi?0a~6m_r^2P+GpHZ;`9oLpgzl?{u6ki3!~B9yJPO@+4xM;} zb@tHP@RJ79!!1LsgG!P?G0|np8Rf45{9Q z9k};UIX~3VABBKH1cT5CTDsFJz_{CudueS4g5H{BY6z&CMotIpNO+k>@*Kn-jsvy< z!?)sGAUlBt0CeV2vyjW}7R(Gd2-plc!ZNY|(c?J@G8^r@Z8eQc~>T;SxA7 z3i6Tx)sn-&^hg2U1?jt}_$oIsNl;pH{bjTTdP4qhc7pXSk2iiomExxmnQ#efFp+y; zyFW+(vX%Kktx3W&sua`!Bpik2r@vmmV&p}iY-$oqq3H*CJUs9SDAwX)xrTJ#ok3mC zO=x*Md6fi%62}$;h8er4Oz1l)$ai&-v#|^Dkvfb%g9}mSt=QHB4=sCc-b%qRcsxAe z>uv;|?*w*Vw+`~0kzED8q_Vhx&mg%)Aao#}4Hr<~WgA$+piejp`4Y5>;J%I=dA{m= z3gG(-#0NL12yn?L14n~WcvSHCe&al8FV@^`UgKMv#XJ5>Qp>Os^+Z78u|aENV%|TG zfEpQtOll(8_LF`>90aN)4dOA(1BNYe0MgXUW(Hn_tdKZBOhoy@0hDzPJjNM$>I*L(tSc5k= zWmeK-y&~YL28{mV0O)|Jv=0=J7yW5Zr-r(Zo@9A~Ks%J!t$=e2@8;r1(5Y|?fE`x& zN0!3qlZTyD5pj=|{R1EA;ko(71BP&KH+ek9$EvCV#jF>{({21}JnyEycoq)e-RTbl zCOQ~c)eOLsg&td9mAgDP8^C~>LGM4wLtj__JU{5iKmVuW;lJh2;h*&9@L&J^KmO`_lfh6M4 zwFCUZXO-_`Vx0b=(YDq0|DtOy{M z0Jg@2sN#!}i)8=9eW%A7%KG>HcHP!x29#amw^ZC2F_?Yddpp?{zN)-DE%o6$*1+^E zkvJ5{r|Rw}hx_g2@8g65x-EMem-O7*e3c}+%|$s8eE<44bjwR}=?Au!KwTvI7Y31% zkNfk@9ek3pMjsPv>EW97H8T{w4ZwlXRjkpCIlbYIu`!Y^!arXN%1k1Qi zL%GwlXZd@8okC1A5IkQkD^1_$5*Bw)JH73kZ>QnhAMR6K2 zYhG>>AYU%em&5(CSN}X!^|_^cV0^I5?uYw0O(XpXV4))eX89OUl^n?9{LU*gNkQ+_4L~%169fQ;e8dzmMfo!m8+fEE=05YC}b} z?u4HuALx4w-Q8wGS zr0F#v@%rAKi)@&wn(gdj`9~1*&kXv}6c6`y?(h9<047S*iRtjYJ-6Ao;9BL+;Xsv6 zTMm7*+?H*iT-w|%4uWlO*KH+Org2ztX=#SkkR*L?=1Vh>V0CY%d>mj(`QBXUA6AP4 z=WNYq2C3GX%Vp&eO>et$Sw=?!Y(7tbB>sETZFB?O-*g>42)DKStr_sbr_)Y90(%?@ za5Vr((f1`PQJ(?q-JUFJ$fkt-WHi%FK?RcfPv7f(Dr*u3@AXQ3r8`}!KfZl){{$B* zPW(f7&fBWc|J*6}7VmX4m&fS{`rWU7eM6lY!gAOx)+sa2T>DT>X(gjF;hWdlB$exL z$)A6l@6GA`;eNVpr|nMuPknWRMa%o?-0s!AD{E?$Pr=eJNrZO1+OireMekI6H;cx( zMC!?}o@l;vOte+oOhKJ*6NOg7_Am)d07^c?knkH2utwUwoR=uV?wGiHTBhAFP#sZN z0h4+RZF%hg1MGtrATRekI9)Dmx0;|XCyvI2N)|Fs346LDE)C5hCY>2s$5tr~m?+vC z0Cwn+iu8GhrJklGd@w;zJ~?yhr{0;$Y-A{hcH9KGIw?Espxg;aga|6iN#D!1Eg?Np zc_|BOswYG;qskUPf){>E0JVm?g*#hDHUYto3 z%$@~$ru;sY)l}vS?3&;6Ta^!ORvf}oD2)ek@9ko8z6 zdAMh{DMN?yo;9$2dj*7M2q}J4E;9N{uovY(9saxB(CBWG`gYBv3ShvOu`@|DBInq- zZn6e}%#;!2S5Nr$m^fWvEclMHNfPp1av{-Dh=411x<2|t3>q#%h;z|}d7(^DZp0$*V3y9H3~Gqmj87Tst9d?PA`BwnGKvco_i zX)~0U@iL>gLU@|W9e|ICyL)OVAo;*{cla!=OWd=~ z?~opC(^6n4jvy&=w!sn~d<$xY$6;h|**cWN$*`qRoQHbhG)`QpTdC<8ij{jN7PhO$ zZ7vlX!D1ShV+t5MxUxMwcSex6ytWcUYGr@1)5wmso%YB9=QU7M3Jk@aA%rS0fnCa+ z-vGpEn9H&WB0pOCl;rW_{hHf~nzUndn-?@9N7IJ;J*2?J)W{tmYnO>a1LHOXrrGB@ zis-{)l^cb7e-MHEA@JAmmTgB$q`2rP@;Rka#CyEb>qfjzI7%pghqoa2H+pEWdB?nt z3}s4xd>(gn8vH)G+7qP!jGM$Jx`T8Q<8JQ$J-CPW=uT3i`R;!YzK7rG{msqKgDuRW zA?{z!h)%&2S&EynVHn3{A)xHt_2s!8!M3hPf(^1RRb=~i&eI`39rmYRU%h?*t~l)LjJ20}4XT^I z@d>5|2S7v-0Bc7GB%uHVCk7eUi*XV*ZHgNPi^%|jp8iozq2GR&C7}D-?UsK8vBXP& zavlTg9}qQ+kwc%s@{b@3=}h{3Aw-L$Dj4A>z)ru^aPDh64yOfCX{nUmajhA7KNI{= zHw8~`u$DZ45ibwno#+BR_uJ=Ren}&$!uOTRADYR1E!JhF>VGF;e8*t-zF>h9vJ^18 zWL-tD>`@%W_@$G%nW&{Zd|Rgayj44e!pjYjunZ!s&}E%)35cl^^*mMd>dR1{*XkK? zI#X=#pmJOGJNL2pG(S}vz1Py6+4Eul^hY^U3LeX+-^lsASJy1ZW9#z~W)Ak{bj}x! z=&3$GcMGmzx5$P12>Vj5RaY$ysH<)}WzT&nwrsyI)bN6rdOOzuiokiz5Qm~_N#?F7 z<^>P*gbCi<4tKd78%+ZKWOD*mMrUMljj*-Rz+O*!`f6*U0 zq1--FWkf#$82%8VUZ6mE%?KuHrN&8t6OW*7#HA@`1T;mF4Uia=URRDcr4Ai{vZd+^ zP}qhe)Q@v%5g~L2_}lfir=Ej=jgJa)je4^s2h?HT17>mlQm{7{{W<8y5DmUM>tr$$f>^aRiz%^OgF-`C%WZy2q9fd*95qZ%#<8 zzM<|#NpIcTrbCBi?~n0sU*W5}Q?Wcz)Ts7K(S+{ZX^P_G?XaJ>r4C?sATct` zxODZhp__z(U^+kNRf-_b#Y**07s0KVpVxEe!;be4C;xH9b0>7q;TurKgs5xCXTQn_ z5qnB~Sf~}|Bt92ss-mVd_Zr~;+!fhQ)d#MWFmpis&;5)s4f>^LtQ^-gcpgraTFs?w zt}DG(lV#N7rMjxVUH98F<)V66&pq0iI*!^7aFV|S)IS|sN}1D%J`mL+L=~lRN9pKX zzWw^@<6tUE^lDr3for#lUb2~%JnNQrI?HQSYn4|MW!7q`_o}0Wt%eE*Lz_to5jK_l z>WLpJ@W{&pqZj4~icYJ}7vQFC=ZeQt+UctKNegr0!zmocN6%Nbe@Z zPRl+w3Xhk=NtL(qKfKq~(CejguNum8R3T7Dm|AlB?A6gepQxwu?UyL|?f66~P_8{T z@}f^%E=$8TV!2EtNgV+sfTQ9r=PSv;3{>-ypiF=&YiDSn|4DG^%JL4VSBplfoXhUg zu?y8F1Jxer$6@Y*eo*CI0o62A6ICc>|LWWM{6v|&#MVml>R`d3rZDxA1SFoIvvVp7 zh1|KY-EKihRSa>YfSp%_{0DdnM!<55LEv3ccTsn1!H$M|$)W`!Z>M=hHX@MvLclwG zd-Liy9B`=%d!^D?3>F7LVGF7}4||@5&G|%^vRyN9w%*DvrW}|}=N)z_09(l-O3x=$ zgP>Leq0aaQsFq?EuPq5#=c3EDO0PT{xL1;`vnduETk?T@syY1Gj zqYrK872+&;nOCZMM!3ukOe_=dKqR1Vq%k82`-)BAcIwZ~o!umoIH@r%1nlj^_e{;u zqD2O^B2p9al2C$zH-r0TFCXIh_}ky~wd|$gy-%P>vD<-%w*jN{EeLw-1oaIYwdF0I zIG0gu6td=C7y+)MT& zau$INq236PN|-^Opk5QsUpSBot7) zX6{3_B+W@)X&W2_If+`RhY7IHF##r?Frq?;4r(pA&vsNzQW+*ZMj>kt?a7)p$C1i? zyq)?om3d`V&k0Kb|8khq-e2ad+{q^*n3I+AxpKoDCQHg>gJnvL?%%vJUs_&pssjOFmj=mywM{aww-8+&Asq&^1A2v?o!`H9hzq9TD&-YX39q< zzqe1X=nVT>rg+)Bw*3WQdmIF5^w09$ABj!>gfkQ;V+8MqAw}u%^~S52ki>X&PF2h} zQ|esz2qy2S*1TP(C7kT_a3h(N|AD5Ae-5|xW^oYI@tG2cfLh=l69Knn55kZn-rI6Z zk6%B1O)2q~?UbE&11Q><^5oZL3yPnQ6}e3I#xYr%&2l18^Ik4lM^Nu)l8Ng@uppt2 zA;%~+sG`pJJ}h;mXVp};%r|Up4nRA?ewS{~ZrrMTrIXXSpoS676aX49cC65ozA0rO zk}mU!+G2+cRi4j);arTc_jOzHorLCsX%OicwA40h={4qh98m|}W@>Fbn4BV7uT4kE z!1G~P;&`}C7(omv)>Fgdqe#oi%KnT5OIaWrPPV6}dIp5g#cep;+_tEcdvh!r#;r7>DpUZM1mvY~zGCtgfGl|O;qBs=Ewr0f9kK69d4((yTPLEjcU)5k_mGe zx9UnsJW>Ky&%*^PLJ5kFdN&)0^3O(c3%El=LGM_d!(=Zho>eo~R9OPL5<}4nl&DoL zsy4T(EP0>cTa_aV(Cu%&ey!e=-w(HPt0b4*%C+R2bt`B22b$KIH)6P95{iUYs)&d# zHR6oY^ZPdL$xNc9}jQ+o|%Uh!yhpaC?ovztQUyupd|t zhp)x^SO5CyH_8#Y{3Y0`Vulf)Ti$l@7Ul)L(a$84lsEbyIW->{Nkg}v(>BdEs;F}` z$r%+364ZvQrB}?x8xDpV$`gPf_ONFw@gO@o-m~4 zdu|2lGes;rUc6vHxb~Li_xx@xv;JkgmUx`qni5l?0*R-9N`wJVXTS$#Kx*2h%Qxf+ zJL{|rHgcTG^Nhy~Buvck-r0*y0Bv~@Px>dM`W{3Qr3>%F2xHU4GpO>($Bl%*bc zxZdgIi*<-^gkg|YRQX)@x%6Rq>dQVA9`?Y#?w67`SiSD!QY}?=UJsaALG3_L7G<|s zg1o+B^Vlm@69Ij0f+(EViadV{Z*Tqjm&27>c+SsPr$$BOOB?tFe?GqYc(`7#RaL>R zGf_D&?CW|x22mXONrWAoA~;}ao{x2=B$Co8wIK9MG@kPd$!m1)I#4#8<`P^`6^Rg| zB@a*M!*#<55~bmFCBf-L^{N0#4p)+;?NC`j+0lfIF3uO=nFs2w zOEt1-*Xxo|%}S^Ad-yVcd;Rn8zhV{ab-rOb5&{kVKUEvbJP~&1_75_FiK)HoEPn|u zmbwPGllmr5Mf@`Vb^P!xw||~K|NPtE?~Cj8>8Dq(>H2U!wbg~XYG3Bx>igfnzIvv& zp39sPmA>+vZ|%`TfVL=k6zMvL_wCO#+CF~%`*5AEzf|;%*UyA=_I#^bf-&#x)f~R? zF1Z6mVuC8k>Bs=J90e~RKa>ej+miPWZ$5r{`};e(2sc;|X{O~#epXYK*jLc$`!wA8#UI}^nhTbdJ3%{ax_+CiD2 zZ*Kp-+DXyGfUa1^Rel3pWnl&T}tX-TzMqdE&{`N z6{yDxKNOoc&kkw_zCs{=FtgtCV_GTP<5b}Q6l_BjaOp@$`~t8u--msrImp7@MP6%) z2N_Mi##O_1EjS zuim|8mzMKBV^gMSsuXh6i`s5_@wD#p;Hsf&=s^tSu#5^6g)amY2Z>!yBBy|zB??q= zNr)LG76IK$okhS22Y_m=tL>C9cI8N+dpK2V*S#Rs9)G=i{pQ0jpVh4xU3gGl5kmFF zAbA4h;m!KYE_{t4RzQu!z?q}l%DKuFQeVM$;6)CQfe5f^(kyO35)mHGfkUI$(RY%f z*UeY#S`Q*I)}m~6?O50=Lph}Qs9mLbkU)}+plt?$%%%)eQ>Z6aSOZXYZX-v&1CB-2 zk4vroDcO$>5(mBmP7M0~$D=|lP>-uT<%DL8sj?b7{*;*2;gCs^Dp2Q+?bz9Z>qkrV*m9U3>XUFgH|gDe(S6DNUvP%b)LmDJ`qiUigeRy>bHdW-frs zdCblX&1G5y@*bDUlfmMIE7bquloCp+PAa4nY3j*N+zG#;dh8pz-1hn9-}GNIx8?2! z6yY|nx(McDuIIL&mQxEz>i$GgKbKd#^%r^@>dT=TR2VA-d<_OcEGed>m%v>INg6Gomn+tj|Yav4)4>GVyFL2|PEc;Ylc@>ZMVb zuMSoRi^9b!)DE&y;TS8VhzB4J)P-LN5I!Ju;QWLx8UePO5#&)>35(Zlh^uk;vP>nH zQ97Cd%2AdV%-UM zCzbj23JeP}i2OuQZd?F(n?rmxq!lwc_SrabR6D9hlGs7uz$kE*00hpD@BEk-@)SJw z)Z-HYx?N&Gfb|dzkp$F{Acl?<(Pg~yYh(7N8x{P}L7-ra15Y4tXNDe1M}T(hdw!*^ zfkJ}->NAEQQ1Ipcrl%e>LrD!Us$}Ng?z7@~QYbXAQc{D!Hwqe=#`ZS{lY@(c(Ln`e z>@UKpbEFumQ|z2%D$$)h9>Il;n&G)9C0WZ>fhxU@fvU*Vfy5EJu`(p-^TJO`f}=cA z>!7Z~P$;0?^`lbT%~d6`F3cbjRn&xy>{dWvQYtN{R>5OsfH{@G3$6P)mod9S`hf%_ zAKw|&gd*@Xj&u1Sh6;-e7+{VSK$2>tFmvW9qqNKwMeoz<0!^n-T8&C=uNqcG5Bl=k@1NehdG)Kf6wopfDmQ_=gRLXMdUVim)y0f1Dj*y8 z=s}VaCDx61@{A<O?j zLTF+UOq$Ou^*Br)z#L@^K-v)Ul%Ar;N#!kO{(Or5e8>-?^#KAEnNJx`Q&tnG2F zg6At%JzXKBrxWG$5;Y)?K`9ZCfVox`-~#nMBvlDr2BdJgoY2!{;3=;wRzvU)kopj4 zVJTN?HA%!n5nl*Ca(hnDj_Qfp>4u?3qsX3W?r8r9*nV|zaZou(9mEbI2fhQ3p~9Rw z1NT~4EErM;kwPcWBFUQSiZ>rW{ruOfj~uaV!WaZ#oJN6CUn65V9ALAZLHY^+v3vQspMW6GR}kP)db;I4494<@B~Q6<@WAi!W!Ng0xdka?}n zi3`S;2S1RnS6x{OaT?=dEBc?;|BC=c;-L>yQsdcE?&gJd?##jDKnApgA+ZPr&I!d- zh`(by%7_NN)!d_YVc^eC&`#xg7t9)dL^Ee4m%s)SVGIx;02TiObRwOUB=W$8KEx5QkyA{)IEO-8J$~7{b<7@F7XF3`}P;L!B;CYqOlwD?)b_wh} zV>l3xz=R|_qQvJ^RDX^T{zg~t|@~PU+`BYTE#1G5zpATd49w}5G>U~;uNJ;wk`EmQ37NgH5cgQWo1uQMa58EA#~XLdf_~3 z?+vfABne}nwmcEQ`bh$RE^j*n`32l=Y&5#&G34!@$h~5sY&)=!YkQiY!Bg zt)l=Uk=yl(2{(e}E~S8)={bi~2;fpcP4mdZRt%A+5V%Vy;sQp&V-U&y3w`hXQ{5am zewx>ToE0sPJd6r87bu5H4ldJ(@f+ZOd&IbeTm+XqC%!`D#IFhkft!^ zNICX-y+|h&SgoA^di7uIr@Z!7lFlr3 zP;mn^ z=swx0qFRfiRNgHYRM*@y7($K-TIxw$Ep-o3NQB^2P(JSkY{g+vAN`!_OaH{eo;WWh-|F2t;zk!c1th04^)%D1vd~4|s$%eNJfq z<6`-(d>AAoxLofOq9S(wldTuP?VzmSd*#xq}17x`?Wik9Ujto|P4aL6bbL0+#A!-%{z;Ohn2G6u+){Hg=5DWKQsmdT>0L@*A= zR3PPU4h#c?y;14toVZ#9aBT>{h`9h#s+%nf0JfXfne$gil@|nmhI&+} zoQuy9>RGBH=yrJ#0Dc4)dlNXJdjvo~{0kuTkK%$h1TNHNE!l;~ui;YeoZ|q}>Jer< zTLJaOjJqJVYjshGLxyG z?9Emv%Y18q>jXUYZ5SwzkeJ5RWP>b)bf_`R!`Dv(x&aE*tbeg?Xa{Sw=!c-H)TQir zJpch!=p6r|oD~WYqX|sxqkwVF#O*otthw!^n@ARy=;tJAVGhh@P^QIe*sBRKLVk3A z4%cL%ZWfjf{dV}06uX}$e|-8_zoQFcy#H{G<8L4KpH3g_;Y&mXI|(Vskn-KJq`VYR z$I(En4azVmjwD$GBw%wp8iaO8irAw>^W`r=+h_HJ$qzsBkFbn&^}|&6I`-2mPGN`b znaFfSg~jlIoTP)p7h^wX+h2c^iyz|vIPI9Lx809*Lgn9+d2<3cL+QyR9)T~GNQn%} zI`WWblE9aZiLRcv3_LRJc@+*ofq9&kDKOLsZ1;6)LlYN7!!^F88^O6=_uJ|4bkENl z9rOf>4NNE>4^Q9T1<|W-!C~9a>-m(Ch`8;iWknI$9;!9l^;|BCCGTIb9ne!uE&%%8 z+ch627)sc#M>7oP;jq2@QJ(n^pRhHCZJTUPLf`>bu!f=U34Go+i+Z)&x{S$wp?Iu) zP&Un#pvzHc3EFW(H(^_IEb0!+_OLCtWk2W36*N>?mz{?SY*Nq53Fxh4anjSL)nef> zxh-YlC%02WI6wDuzVAerxyAJTwhYU;&IW*65lKh_bZyU<%E(F4R00-1+0G|zi-nn> zng9>#p(IORWoi38yHPnIA)3DI(v?jHrs!6ATqf6w-(x9{(758HFxNAo2MR;mIi!1r6+ z-rvz1T;?Uj-ZtAMry7A8`t1@f*L7bH+jyVGGq!%EXN>#8isuC7idKfep14tY`s>@P zUrBHzr_B!hb9ln9A05Sw75tfa35FxzQ5rc)(g!&=7RwkttTF~+Z9c3$@`+4df&!C7 z>h}>6@291pmv|Rg!i75i1*P>ki=my31Ugi?fC~-)Ry$(tCvcE2rX*0p1OQRlqgp0{ z+Q(Xq$D=YzjR2Bh=o^gsZ)3NOw>SlET! zH`Lc*(;{!x8B}h zF!Hdyr5;LApK9v69-cZ|$YPmINMI>3rVg6QQ=Q%SbHQGr2QY4fc)|%!7C*gx_4@Ze zfBzt^Eo(~%vXZW%Cy;m4O$KFH_Bt_I3Q2%X`Y_2S?5r+41*J)77_dPm16x2uylvH~0z6OWeW*xcdpbW4OS{s>P}-;!wT0OaK2>ux!tc+rSsTL zo(-8I8%<}-ZrC|`Yc}Z1SwP<`RRL(w9bquoT8AJj(aR-(L6wDJoSJeF?8{q|j}K(% zipB`oc`HwrzI(ImHWh2Z#4Cvfcr0~~sKZMit64r2#py3NjXKB+oEmEwq`Z=J+BGLU z4E+zP=>aW<_y{Zx28>q2M!PuW%J_h?!|_z95I{2{2D>BHD{#O ze1)!dO}Bp>P4w$WI3fOqf!fMc!S67or5p$tfm*}ZpwmKkGnA9<0G0$N+((7zh*}*W z<*k{P6`Fkv7$Rn{-38DT4Gh*0oti;XgK2cYi74bN@dFte1wVCwuQyR#Ov1h?9WXk! zH5d5@qW%wc%b$LK|K`K5pFWBUR0 z`)0^_SeP)UVt92hJD41h^ezxPh}>b^dhJwR9FPDfpn+EWDLOHrv^DM8HJp80ESz>QZcV7zIybQw zgYqk9&Y7~1I-MV0?c=KT{Re6>#|c+h00{O1u|nb?cAmNL0(j!h;o}Ao1|6CQ#x7|0 z#oOlBG1&f!+Cs@FdC#1OrtdrNE3fwkfYOCNwF9 zgz^XRMIIm&;38Zu12u$m$!LdqzA*WQt0Z)>%mWZSrrQ?Ia78)t&jSUPNnI9u5g5>4 z1F%Xg6BcF=*x9ay-ME^7qUAn2kTxdg_I7oy4Y%}6T<(Opwh}avB4;oF#3csbIAEEV zk+X)H4|{4*;;lRvW6e2L-M>jTJ8U&|8y8EL>T<(yER!Y>Y~vvdq0G^IQ<$ow z_dt{dLHZs~Ops{=0te1NS1nAitcCK;C(?0on7*J3Kx$^i)cKW)_et3~V#^0XY<{Gk zVewwTQ;?2P^$atXoX4w61zm-ls-vfBShi}&I1>(acE#{dH5AJ;ciA3@kVuqwKD%Wr ztIL8hr>cYP82Sou79?ut6-#^-vI1j3#0}+ZUq}OG;)H1X>r$YC#b>LAGXMoaqKws# z#f`c!Pl)HS`dR-`7z_bh)^%CSx(i6z&)$GD=P!IFYD^dmJ z;y~}h<9opRoZs-}2K|#;CqTUhkl@_f6fH$EW2V#||qZeL#NB#5R>CK0qUVZxgPjTw_BTr(?6p*Ie zp(`h`X)S;pUQQ}T3xo>tTq~`a0Dp9g{igulU~;_DuuUobOM?n0D@ikxKp6D`Tv1T> zWu3~S0=jqv4W{-Oy4^0ElfiZoC|16TIkucXGhvL%9Kf3{A#V>lx(JZ`I}Bms^Aljo zXojCt$sJMxJ2e%%SaqrPL4I*k^48x1Xw{%AwJf7PpnwvGJ>vt?&2z_}vZDgSPXmzj z^;CB2*UM5#$?VqK3(u@UjKU$?&x0nc>|`pSGPsqhn@_=16ZRA(mwX!0vX=C~=M}x% zlKSx@#`H^Qwxjo2*76T@$=Zo4qLM_owJQZWbQw#oq$^(68-y4hFHcnP=Q&iO>gS1p zGZ27Z9U$LP=)hw{P}O9BZv7KL5(>cIsjAlJl3JLu9Oec6W~%VR2rV~N^3-RW6wo0k zA&&MWaT0g{ayi%MQw=k6ILS_Q0KyNJKb`s4>GwNj>f*FQ_lNU!QFhUoP%;!IF-c6X zmEZ0>fw<-JmjJtK9J9SZKZ2UpWgaMLvg;(GRJQ!`{nI@t>(|sx&*rnu(QTpzpM(p_ z64^i%T6L-qTo1z@0p%RGp#&z2z*XG=s$HwnO!u4EvZmVaXb=J1;1Qg%?kv}`x?)`t zur!1pwJwJl;{?Cd3zjPIh^Z^^#)GC0~ zwn#0Vp@BlXN|0%c^4z_{u{i(wui|=p{r6$B_Xc)^Fsy3t1fc_DKzlPmivAyUIlFP7 zguse*Ece-{ymupNKq?bCRtdofNnRt{*m=jnU^|S~0N7@%Bi~Wt+$5cWGNRAwL)<_S zQA5-KP&_p7m?b2DK8p!*5s1_MiF)KW%N4C1Mv)-^skjWK zB=yj}{r~tgV+b=o;x-HxK^dPNg`Kmw$#^1G<-4b|eP9D$tk({w(|D@cJ5}kN=`d4{ z@lS!&L40%+IS3I@$(I1FZ36*6@;FHB3Bf@Yds`X-=R(iF!FN8c8^4#us3k+!@wXUk zfvr*)xNWxmWuG{l9){3M1`;L`0Uj%5C{qU>0|rD1x?QH4tTVDqv?0SDo?gBE{N~SB z@8GhqwLSo=o@}hUBQ6)pGz??Aa&GO$OfnYbvj%N1E75F?0v9VlqM-3;cgjnKsgY4R zOZmB`9_W*fyhrSW-4PP@*I=;>pyX9A05$>wnD!(@y9U&pPt>5OZzyGQ;;Azy5}@RX zG{HoHN}l-VFM&nZEyW9)0UEvEa;3o#Iq(%A^$4U2GQ`E`5?nBR!Qg@Ei{JRgZ|tJt z2@LnO>?GzS(+s0~4V>8d1(DI7^u(p8oIJ>L)H~3ia!mlL0VdeAa|p1LegUk`;QV0= zsRf(4tX8Qs6hQ-o3IU#u#Y*drU!dts#C2BP6tkt)#-2!A!i<~6YH<=Z4m{W1qd8@; zjXJejvoO+|a_OX#0wNC}Y+3>R1VWx8bZ?acA#DVh(uZ4ed=OF-||kFk-u1)dOjvGY~aOF9GfV>)|A_02s5egX|<5t zlced?QI}{-66$dx1)@_~oh^NjC>Z(^GIC@hug0ipmXItkPTY=JzGc>jN+GQkRxI28F z-`Q;skL1$l6KwG@5f==U2SR`q0~5T94MzbLeL?~ZR0>*gsj&0{e$Xf7g(MCQQxBO0 z5FdR^`!WXE#1K(?9FyP$_RO^>uvJreM+O!s349ZT2?2IGr^;}hmN6@-bH7gg&V#<| z)S+}tQF!>wmPHZ$DI4guCqS8<{;&Wv^AwxO%0CdcaqxIpEQRf2^A#4cufs~c8Z5|LhhAsxcrDi^1LXO7p?o*=n3to-4P8lMBp%lA#PdPTQjt_e#rDB3&emZ`jn?OPzdybC z@bT4KcCu_2rEru0DS-T7w>XO>Gb%5qbwo~v0ue#`p z2Oiiy7O#<1=5>umJjfcy&#))+>D3=^)Pr{wm^p!pN2-BHuw%Gz4_~-t1$)NY!HN3n zLlOLV;>$DT@J9UlijB6&ETulDh(AmOh(Gmg+$)*sQ%>>QzctkDaSdxR<20iCq$}S*gKZ zN#dQMe=HC%poW~Oj6v-k>+1zzrdudY1fYY!fRzwJh9oqB$WuTC!{D(?!|_7#6o$2e z&x*!(uKWg!$D=}uaM*r0T%dg5!+TFSK-6z)@d}RUlS$0C#kybk`Gvn6t=y zSlem5P?EPGN^*E-Kuym8S#oWwt)%Y#Gw3ow`2pDjCj9j?0jxyw#cr<4_C7GO`VllY z&nt3yOMUmMBbW19;UK^S21clbP)^VNQ19&04N#RLXr~M_M4!)X?_?XOQ+4NJs)Xul zU#^S=rh`P;3X=q&yj(VddRTUDv(GhkRuC}^Ms%?L&zMsyKZ7dR|6Zs~|9n2}GU~9N zPx){@vFx^z&$_%)GB@&&$SThlX;6dW?}hT7EVHZ}EV=M}OLpCC8n zg_jzG7A?2?(I(k}H$TaH@|10eIf>b8M!C0MG3Z5nf*6S@F))=a6gGO%tR&$O6GJA6*!@T+Nk zpNee~%xw|0kQC#3dd^dNo2U$r$(-48Sr<1CEUib3w>Fzyc zpWY{7d{}l~T;36^r}~@?J(2rMIFmS^lL$dH4p{iZzydzySosGkd5_Ld-=?3w{QcoQ zT(H^OEP!R|L>I_naJrQLxbc5W-N-qmV>VaA9+EcW-iJEo^CXbS-pma4j(~FfcGM zE_8Tw095_ij_X>Mt_j}rMG81TCPb>gDr}F~;qGy~OWz(R>J$n{P$DJKM3Gu-OeTB! z8s9(W;M!@jW#Y0%4LO_9{7qi0H``tIEXVQH4^@`y|NBGs<5dsSd-?y-kMuRm^$|bI zs-e909sjk@>{O2RschS!>(AG-${x-6R@QB{+iv)c=RA(@Y@DC<@F?xo{3ySR*Z7s~ z{Uf`~=li>#?Gd@w7K z)j!gC)JV~*wo7)s+N;gC$NhGlmHNo8jb7$+Xu7jKm7T%yHkbC+>Uy--Wv8Sn?KC_d z_Dh@td#N{0m&QWZob{^hrH*x(otmk(bMq*t>1OA!JnIqPr46Hc%#MeBy7HBcE;~`B zT?QLhlUBBC(UBB*~eWX`akCTmwhWGj- ze--t5*i2hHoA&DLTs91(&YpTa+jOyq>vg^TVr198W%SvP?hFscy-n4TvpL;3PuHry zX4ko~QIUO==lf{W@pUVw`qQsH1L%C?zRSjEIoxfcbbbGP+X=8=;T1e@ecjoKI@_ZT zy`71#w+)iAn(sw9dtpO4G`t!c-B%y*c8MQ7PikYc zwi%^yP(N>+(sNze)vL;TKb4sc;kql^tS+yuefLqf%{baS>U&PD-PxzT;)V;_mE+mo zpIr-$c$-o@@SE%S%D(iG)*zOhtG)YI$s4qxSaK0hcD+w?+j6eBj#|o?A>|KSJcg%@ zJkG0)klLa){LvYSUe>`8KMqkM6a`N9cyV&*Nacz{ARmDnn zvYBl&@|)Mkw;6vQ<;a3mYegMO)&P5)!A{%AFt*{>be;XEteVOu`)6~W`k^UpR7|#n zl(ya%uXVj){ErWo*q7#1T8V6;byLF#V>r~=^>(VJF1s`=$5*=)=hBuQJEi_AKFWvv zZn5TOFNWbarm4*%w5Q&t$d$FMy=XJwUv?hewl25XvM@2ibYQc|KAFdry%QUVFPlg9 z&ZlOw$KBcbxjO14avj@p9_r3do)*FLjY-?tq@8YGdA>gQ&v-Lcqp99>8ZaXR)$Sk7 zz0Rio%?#toKKfJI%Ixi&ZD6wo_s^RxCjW?yzkEKqWV#lbTK2xbzj+I`kK35P*AIqd z`TaG%e5A^Z)%LO8 z?zL*MnH+6n_dUMMY?miCndV_)ZuWzXYI`x2Caz7J;o100vK_px&RM?VW^;Vv!rNNW z_Tv)S*f!y_aBQ3Bz3ZnGWGH0md)}}vqP>FLPMW)j7` zhDLX?)hE42P5}>4*cNVU?PR0$&hTQ^*}Yt ztm+x#Y+an!k(IS%-+J2Mi3ll81SZ*F6T|+dwd>m11=C(}E}v7$_TxL+sh#WPO0+hd zv~<~GSJ{M2f2v`{8u={GTHrp)>s#GPX&FtU>PJ?#imo2DP1UwJXDxAIR(>no zRfuD2Lb^(=P1=*K;j7hN|FPi{(GmNdU6pOVU3qX($B^VNY;dy!*-nw2>duxEd#Rs& zUorj%t;ALR#V9Q-aAV10LoM4+`!$QVSS1yu+9qL}>12Q4FW;u^yJB^=0QIIn&5stE z$7o`pX*|!TQ<-fJ`8MC#pA|j{RyND0p`TASnXa=I)0@rux3(9C>D8u*y^glN+D_n+ zV$JGn(Up(4jB#08_&ZpTHTaTYSK4;$PCF|n&fc#L7Ul_8H}?gj$ZW!Cr6u^VC)Pz9 z>Qj9_>#+&GujO#DHKEFw#>L9cu|3qMopR3V`)n_0eQ`G$l$b%>N>LV@rcj)@w~G(*^b;y z?+DSyOuJ&o_HEIQ?MT;#UDcvSJ6pB~_D>tVHUl(*Z8v7pSnS*BTv_PBcFzo8JDc=J zS374G)OEb9lOp2I0{!wbY368Uw-xQPzS^=j)|NoMxmMlTwh!Ayl*d^Z@o5odcCOpW zhSaGUs)nU>Vr#OffvIvTPj7}5XQQ-nY(r+^MJSD8W7VQ^vBjW$r!64D zli)Ov;MHf_rtJTh)^=C>?ajW}9@aJo+P>v_*I!Rt@fof)fn2RE;?lmk7#6~GWTLhn zO_MH$J>RuC@hi5blC;@2GYoGJ*2x7LU+PcxWTj0NLXp}wn^+_{(wXCQ*j?IvY{TMz ztc>^@>wgfzo*7jAeBk zw`xyLwZop3=d-tH*}R?5{$;E3(-!!fG6g@E4AH?pOM&uBQ~*YEm6Xp`=ENKtD&63mcW(PU-s;wuejir&Dr^9MwX;+ljfi03|F7B?+^PK zk5O5MR@&UVm%J@*KQw2F9Mhd;S&N(f_Rli`lGg?-#VON=y&ziv?4;CoRv*2kPrmus1!npU%xYp5hK+tqKI zlR`inu0x|j41=Lkf=P7u@VcId^mZmJ*Q*~2Z0%hueqyOq22>8VifEMWk7+?zvW@JP zrdt&gcbk1)Zm0J}5k5nOaZR0c@QwaC9-2;Ji628`RkkN>%_I? z`!@b2rA;ay+NEple<}*-9JZR|R{|RQWfd#aLe9Sa@M?iA4%vqV?aHVuGp+2}Znse? z+;Gdj%OAN)t&0C_*lOMAyySVdKs}|L*^v|f`?z7LK1mSPcW>^#|0t31-8FAF4wRPtf{`e@h_8XIPO^FlIh z8PQaZZ&iG<*be^j%WuE^_uv2d@3xYXyJXeeoweD`7Wpz(EDNqL7dGTuZ*Pel`K*A{ z=7NQE4RxMW;ZAjo(aVcAAFFh>E%mVMM@vU<=i=_wuVTf`UNAF)A`#UB+tBXXy|u^; zY#pC#ZKx!oLu*+}#;#{$v9nP3Hj&iZwJNJV)!9m0VpWQ>Ws#LDRkkWBQvEmMJKIj9pLz`OGJ9}Sj=w7l{Pp#MHjm;ttAbnRiYL{$$42ybZ z{j>K}Gr+u(m{!`c);w16XY>kwLjl#2P|I1~+P7^pwAWU%aG!|2RS|ut%xZ(eB8-7$ zy7qvFacjS%YSm|BkJj1a*@?0@$gVWL?Oa$uTUR8gmdrKZ7Oz^Ay4l%s_0YCY`=))f zds|d&K_D@?Z7JszH`x}iQo`lk-liX%mP_`~hpmJI8*I~6EN{2w$?QFqN_I=zKYN{{ zo`|OMmIec*W6Y>xvESr&iH^JV(ulA`PywQ9lMnl}m)!LhU)$Q5dse5?y^WKS2eSa( zcIdh#0U{l^Di>)eUwKu)Lt>f_m-{rFc@yk~WJH#QJ>JR>JVhc;x%H=$%{1l8In!lS z1?Zuuh=4mQAcR@913RDUczo*M!Qvgkk5-!Z+$( zyL-|%K=uz4mdQe5F7>3y)`b1vdCp^Db7iq? zJNjivT~^NQy|)Q|PsRO_cd$-{8{1Rc)K4oP9$#C&L=fLoW1qY{mD?+~mB!xu$s%m! z?y9!i<+IEDaet4^@WI0tsX0p^__j6n^~0CpQJa%Jwrz>}&=R2V!cUghNVu%|db>Za z^zv4@SGRNZVr`X7O;?Id>h_)Vk>z`CoNlTf_5*wAmMoS^TUpep08p9vRw(V0quOLI z3xSjf^I)p{D(PRU&|ZLNQnKshn_|1R%}5=L=X)q0O=W4N1)eXP5*C+IKCtM34SKWX zmf0Ej?Adbb&bt{FD-Bv4ReG@G!3Kui*;-$oHB-p?XPbSVLnz5AY+MhwnjXR}^{s3g zc_k~)*vE9?EHYp^SGA>ew)LLvEosxXe69BI^P4s@r|ornQ&S&b77X#mM_W5AXt7K3 z*{JD>jhkFxnpNZjWwH+s;af63UuBd>DAM;m~B$gVI=N6 zr?{^!XXTtFDduR)A>py=cy?Job*^3-WyNN9$ZgS^1(C3s$IFOl^~Pv?kt^D|W6|k( z$qR25qkGqf;H9iK;FZeJyNXuEJv@nls41VaZ=Hm5|~8= zni;mR+9#`_txlG{Py++LE6ySscdaLPgAd`=G@q$bA|?O)YWXm@I+(9Hus?;c(t=c>5y)m&W|lb zy0;6`%}@4Dl~QfI7?v}p4d>llFQl5`LLkGF*jpo z=`NSt@^pKZ7He~YDu)~_%O(|}ak3?#n|ybt8)u;%6;@k6GX{!wM>~5hD}_Z749C`X zMSGznT#A2Qca|0l(Fqs5!kVou1Kb{q9aUV1xICHnwoo<+9 zgFh`a=ozGCOT_CX<*d7Ok8ewgE$`={Y(IY4+x4ddphG3>VW<8ylb)%$)}PpzC~;}F z?>1RKaBBO&94T8YEuXpcw#rzxG~H$kUzz##j5F{PJHewZyY1U|I@|Di?b`3lABT0@)jY*M&0kO=$fgmfB2jRWz%fWm99?ro#l} z<>?`T#a@~s6npKox4vld8a$JqJVdgv-Cx&pY-|tve)JT#2Q~ZbvF$RAKjy|}g6)wH zmHh6MtJNX2Q4K7@uHQ(@qZ?Dos#pFH*k*WBQK_r02C~#JpXn}seA=3C%Z>dEAm56QV}E?(AMJ(drpU!YWbHd1*;)`Y&I)O4LV3kMU2X3GX8D1e zU3Ia7cFYOOMslC$HYu_3>36Rl% zXqwdGs&!6nD+jw{E6uLh`-FVfWR`jrB(^r?9UPah1*e)+v}3jJZLu5sw+%y54%LGk zKBuLpQupvl%*X`{{Elq{6A`tIu(sCjZbO#^*sg|}O_n!UauunKQh??TAmvzvuRI(@b?)fX?xRIPf6LU`C_MnY?I zndIiuO{o^{^*N7FNnlvamw0}hRSuf<#sy7l0-u=k@@z@C*~zQzQz%{H%&MWh&zKs( zMG;VBB^S^3{Pm8T=TkTK^9R8aV7FT%C`O8=SP5TtG46DdgmKL5DX*o_EcY_jD3xV3 zas+j|wt}ivs$2?(IkJcWSylhl;%p$aU`d20u}o*ZJ+QcxceZ+uHY^hy8bPgMvj&Jk zHO{YZGwL*7dkgX#uo|>ms-5K=qIA5dRfBlTb;UUy3BYXm&5g!~y~B@EbLxwDf$BbC*j*pl`!t-oi(pOQ zHvsJspa=w{g(O}o*t93_Kl{9VetcPMGp0D`)~IpyqkN6*J|*$Inp9wiZKY+$satx* z169?lVgQT6F1?Zpn{9xiiKw}$2YMsU(%w1z4$b`DF{tME1hDkp__?#GKmj1(&U5C% z2{eb&eh(hh9eLHK1nZqx<7~zXHeC+iEHw4kT(;hQCnO&x3me+ZMuZ0#y22`Y>aJ2b z=|dk{z29k5pf$`bdw=$;1KL*78btr;UQ7l?(ZI5rfP;Q zaic1!zkW4WJDc98a!uJUz+Q+U~2)$zG+)-ETmzHOA-aTMloI6{26l{%Z#*AuQ-YvCM<~{<1 z8(62avbugep3^HkTG$C0KuZ!QtaCIU4+An)l}x&R9i`3G0V2QYu1axK{<;yZ+Uq0* z9GH3ahu5LgLdW&DlPCyLDL@hREmG|1oiO@DOoQ#c_FVS2Gff%lI#eoo>3W}(5zeKr zSWUDk{Zi4iYa1F!B+@BI%SziUE$!x4SwY|ZgEt}YrjSqc)`-ir{W@m&Gzjuu3k=s% zgXwC$N0tpH*vVVt<;cyR;VPsIk7Q@JZ*8ymD4(T5|B}A+O(8}t6lbLm_QIU<|EU*V zM1`}b`um{9YU)Ri{!=i>ROL{dU@y^LN@KC7&-`zQNxscaLzc({-j^%ufQboLkziHv839|F%~%5;J0vv z+$2p&6)O@_x^(Pu>3ARZGB#DA5QB!5|KOGYxZmGGZ%{|Fg%pfosRaWlsz9jQo)e>wv{YKC1K@2aL#FCmPMzyf-br~ITXSu5R1d~Z@^$F@PbyMA zCI?FnE$VrtRM?_vZ*GF?Xgm_6HdUS*J4qxc3b)t=$!7&zP?wglWSZ3Pve%u+NO@LX z9F{9s8@M0fZuitW0p4btFDv1r{Gti?u;5&~cX_se@ah5OxwpVq+16~SW$DNbuJXtI z{o*NU5|j>GNTe5AgSgqss=!6%W;+9QS}ID_&FJhi<}EMIC{n1ELs>;+BU`|&cx-2$`?WBGJwl8gBwKa4bx}LU~2>`~<+t8b=Eqq|7XKk{#aUm_RZ+KcLL{}wR z71gG}cIF@!u#S9`+9|2NU1{OlkFPhoWXh|>hO3xZ9Tf-R!cTq85ce)oBLIUY$kEX< z>jg?st7!621XxnWR7yUw(+;4ssIyb_uCIzmKj^65`V=PEu=$$&0<#3(da8tD%^prc zqES6#xD2XwsdX?4$;yVUTEEb3!m`wsF;T2jif_q+179rB@Jz{Gzb)MS=5;6u|7hyf znI$ZCqi%F6?QF8UsQ*0D!vVTsyVQ$S&U4CnJQJVWZ&TW~fiu~eKM~42GDmJNu>Bo4 zo!tr`1{L3zN+lgL!)xsjE*QA;w=(2sKa~@0hI?r{3nY|5RWkl67j_Gja4N}LSSuVt zDvFT1+qN$_9J?hI0$WjOJSpqYN=i}P%N6^?i?fyL1pi43fWW{G1)~fJ3aKAeBDILT z*l~-V8`tTjp=TjrsYv`jlWEvn9H_x~AZ&y2Wv}_%IPGety-%ZO3HG)$G6Zm(hl|$J zyWq&9p5UPs4T#j{C)35wwjlAj031|*XNTHY^jVXWb~ah+M3Lwd_m%)y%v4(dZ!yIOB0jkc|N8xHgW zVHpGoF(TUXtti(*da5C5r=xh(Jf1eiE$CCF84#*c+Wu)5;(6;Qd;YF|PIKpN!mGG_ z531AD{47GUF~mvMq$Vx_IY#rA^=VXhVdR2lL;9l1W1_X%rMCA|kv6evR(h4T5IU+} zk+jXo`2+(0c-+~S;;`Otc3Nc;aA@eieBe^|7Qgvs3+98imSA*M>42`myK(38DHOZ| zh*C~X`J~t$R{T@Pm5VdB|yTD{8SQAeE+Uv(Sf5jR-2XBF^u` zO|)HT^?%xJwF>smNShSqsjZ0P#5jF2z8}q%{7$Ti-isl;7rOjZe7mdWjVWaPeS-+xvyx5JcPDl{vT1FQI+v=h*s^H}*V9(Ru~Gl; z{b0539J~ay*+I5@?#fZMU6pvN@0xzmATr6hKLankdi821{%S#roGe&N zT3GqJU@NmBW}}J{@v8?2KRHN*l|(c-Xdzm|1oQ8|2-Ak1#$RWPK~EjLqX}vu0yDar zwcIE!VT4Vs*X;<=wD|adR<$T-sJ3a^c4d(eyY5teD|@DY-oI#P($OBzg9a<)<&#LB zjB^{=e@)r|z5!VJeET?eAL{c{T(Kw6ybcyX?alV)GPhYdpJ1)9hdMfvO*7wd6S2q} zWF)M@PYCN5=8C+61Y->P4!rTmkI2J z!UI6WfJ)=Lq$*>1N9heeXP&S>l%fu6!|v4!?LPV$SWqXju2;Z7DBHDkK=R?pEnBbF zVore%4M^;y4?E}7^%6nZRzE0jw(}1k-Sqw##6xcq6Y*PtgHoAUeXiW-Wvfmjm@3;axAk}SW46mciP=8`dzPvkfP?eqb^VHo= zKU7E&W4ocw1a(oT`ATHnI@wJKcA&_>Gc57ZvP~GvfIBOp?L?Xw`?S(hy%V`zK$2n& z-6B|K+bu(aiStQF3{toAA_DAG7+V$~BwY9zbcannYR=vcwP;+Ffmc7+zLYpnxd$Hh zl89byyVYj?Z6_Z*;W+l_0}x6*z#_ctq~EDo+1~KoGk|PC7a3KA)DM80D#i->-HO{> zdCY1{+u2_P@52KBluKGvWV_`9venZm6qFlA+fhLVi3ZTJ;g7U^;e$T_F%Z1Gd>68< zkm+FCrA;R~xsoVgeoiI$Zj0?yA|pHcEWz@MC;xcTBOjaTriyTS9x(-NuGv0rnZNBW zPn$u_)%F~lZ7q1V_o?U2!Qg&9}wMIbc*g+nO>yQ6@cf+j<^JL19qWTkXYu64eX(Q%}J~U=#Za%C^@Cwq4y; zy;NGIPeKmK-Te(EUr^?qr11hL2-*jcEIyE9VSa_5Z6g*PIFGx;Jbx8s01)4Fy zSV-`sm0F&_ky>n`ZXr3FHlpV0$O4ipvg`eJO)5eHCr;}ZO!^ssmX^HFre~~*K-erP zJD2WJ_x2uBUiNf)dan=4XN}5wZT%&3kX-_L(QuLot51ZkG&ViezKN`C!ZTcsR#P9faL6TLQqFy+%3d5i8 z1Pd6s{O6f8b-2SsAYiOim9CXLKHfgr8cN`BS{3KcG{UaTO#&0H@Bf`TYbgrIvwwH( zrSsS2+&yB3LroSVRnd<{!(~1e)%vnYk`^BHT59)$c-KzG=mCs!MqBYckP#?KBWAQ6 zSoL_yGSseVB2l8Ny(8vDKijAYV(48ds!|iQ0ys(#qhQgY#-nPP7WmoVqLg5X`$O<( zN2iyfB7Opo7K!`Qt_MN0GJfb?jyz{=>_w&et-nl`IRLhKK5sM_2u%dkR!G5YyS;0W zB!o+!R8vrqQAtOMqn%@xw9DMtCj=Q-+LZ%7>{_edN|@eKFJ{Zlq!|f%y6T=x3-KrPp8HV-1Nyv>sGt#-UVaNs)5WC(3R7 z!3yy{6M$Sho$t^~%Cq&BTUH#nh2Vkfculrbmh3IlTXjtVr$BZ9pGk?d_*;O_fFtMP zqmp>l6xu1bR#drR<@CPS)nn?7*qvlk?&W=Q>?I*UUCm+{zFUF+N)P~TuR%HV<4@es z>PJ%U$X5#>qxMo{cAF~|0_;Mo8E{e)m{{y?VSoc5zzOF^)rd}y1${*tWrLdDUayd} zbDTo1D!#quuJkEa4jzSHyLk*Os>9=MEQoV=wT!U3mN)LdaawT9cL3BH= zc2vQU?h<@qv=xO2TGepX=X1s+RONq!Cc~rDve(!+?>|%X+6j1!#Zh|;;!xw{JlHXj z&__p-Ypa@p@aY;7UD;}EA+r`*&#zgaRC^H4^~v8pVI--f?K8wCL~m>6TVNT3W zr+2ONLm}|RbSH%1Q7|u2{u7l0Za+_y||J=NPUH{iNH8vrv zEF2PXd9{4ll~WBvVr6emoK{g$x^nd(^bAP?D<`t#*A8#xu-yZf7nFxBE}rpw1% z>CS@TwIy-jqokMBSK|XF%cYgVLH$S#WFdMeb6ZSqe|JLYNkSVE+jtEkLt17-4q^c^ zk2Q${Xp;aN6Ko;tVl`_>b){l83MfUeV>1RtQKcU)`m!#WpjlPI{|9 z2MMET6=*u=bH6(Qz`5pP{{jO6SGnFDVH8;?^A=#@bb=uJyBgrm5t_Nyb4Q@(7U5N| z=1PC)p^YB`0SBHkdYAkpFl7>#%bnekQyf~<0QUh@^axKxg|@yh6KK6%11>k}l4gA+ zhPWyw3lBO6vhq>h9MF`V>m;(*wm!0K>DX?H-Fk0J+`8Ddg1gQ z?IM28Eqt+0wuh22PCdfL-aVC>x$7*lw5@-B5{f?hUU_J3NyAWydQD&IQ;D}HCm(mZ z$CpN`B4X#|-j~ZAXTcP-Q9o#(u=l3Mq2p+%MY>SYS=Hd0%%_ylNie9Kp5Q!3LNy?) z>bOtPMmtR}7ii3he<{~KXO@;{&n@fkZHeAuAQ(y|d&mRXs~2iO*_djN_Vr26x-GA> zJr4Pa+62vY7KgYN0R22ab@6SJPA%3M1b>@KU4ol-%F3u@LFE&jPl1`Qh*TqyDs+Sp z;A)V+G!4ev-Cw^T>2`M1;N5Pe-(pHLZj$qjRx|_W=9vYRy5J1XrgNRU_DuEGYfc?#0~Sz0T_21z&2=nYa6rc z>Df-N(CN#4?o%*d+`ECC0X!uu%#xl-SojZPJXI|3tj&fR-Z z2ggoBC#vIJB`a>Jm0fGsmu`a4q?2n_fdg!=ecFk0H6oj9d9gFos3d)wl_e(V`#DoN z?O>~~ElE4^`V+Sw%BDqp!d90Ks$~O4ZKAoWZ0|J|8yZc!)L6W5e`)O!d9L7MEH?4q zLO-y-sQPt>x6F8=RV`@(A+SODihXG-4mqSfHX*ze$TSE!E#>$4RaxXsG|70|?72w; zO>21KQ&Qt^L>V8-v(F@U+{Oikyw60`IHrugOf3E`v=Wc@W^9hMNevT--r$tfYyWgu zz4KDebFeL1{nz6@#^qQql{2agTD?xq`AroJbR*y>)KgqRr95dp*{`=NK$R)jyl3B^ z^|!5>pR`84ycPk`wjP;T_U?cl0MZcfWIG6T zfblBUt0mprbgA|$7f85g7UXsyTrIwLkQ{ihx=X~o!3&IBNjq=9mH*Wx@y6V1Fwzm> zLUlD&`a4oRWs>o=z>?U*UZJHqNd?sg9U1l~q=52Sr+N!z16{^j*$hFc9Yr1)B}|w( z)a{h=NV{yVdy{Xdib=3>eA}3VF6Odn7NYWMo(<7v-$+}u>n~h%TV)VH6;aHI&rp^E zmz@h-B{U5U7(4lcC@Gzm*t|GwE&8;z17NBplS$ll?$nEfhAT3k<#JSbz$V&27|J(Y zX0Z_M%!HO=E|#usCG{sorbi>~1RFFrB^vL<-w^y?6pWe-%5wkmyLPSNMIe}Tz%xKe z4d^{rfQzvrymmgMNdV9a+hUD z@`z(LxZcK4OS42(UOSuZ^9F%cDg~}PnXBIy<$CCw8RAqqza_1)Rq#Tq^#Lfl` zH_JRpj-d)VzD|uCN7^NFGW2A1rbdDh@2ZH{CYYcW%v&lJS%C7<442`0swjkPgn23vN5NXcR-EBUm0v+_|H(wmZGDl5@2rCeCxj$ zniiLz`Y!=w`m5U6%{Ld176*_v3HDhaTv9stZYuT{_MSJr6=7vOs&gT1b#q}_vm~J9 zBsdFz+_rw%HX-5>>jhgl*t|hPJ9d&jsp`AzVX*9FQ3ug&Ju<~P;r_XlXpAD^6gY9Nf4@L%5M4~hJRRQB!O3| zEp`doo?8Y)QZe`kP!fQ(H8%>yZ^0U~`m3){F+nH6mQ%;bI!DCgJWt=ntjP%i8mTZd zK@cuX;)TbR3$ao{&XY{eB-(-lyv4#-HERCmQuLMO^@G$AzhBgJ%YMQrqGT z*_>(~M+(Le5XN2Uz$73BBSB5gbZhNFvILnr3$1 zJDpON47TY9Odfh3RMm)-Xv#`FWc0OJxqItCCD&_g9KJL@1t&LSNCo0b-Dh9jMP zXS$c|sq~6t+MwCg4x%$ysIj(B$Das+;t>Fw-FNu|sbg^Igy)}^&-(uDJdZs4t^cUn zYcRsc=1T{@S|}FPrFLVvmjUL8~lKze_Q8@ z*$B&Ni>NX;I&^9TYVrUlNMS?`eixu}Ab9GooWBTcG7Z9i8>CbEQe;6i~lr}NTqSoQ(=Y8?dZ&(_2jA9@a{K*dh&}oiHwI(Ot)Of7Sr{)gQEGiiTXoE; z%Y8y;p(=&RYep>@)FS32N#C&HSp@28Ik`8&7d0S?3BS0$GyMc5i&#$xFppC8=;?$J0;^{A?8inO zuf>C?^DC2>V8!F}Ex zn5}5{qaMToNJ?+)XsXX9R!vntI#g_Cbm1fvnk!A3ywt1!*;SOp-F4_TT0pi4rktpF zjq4gX9^H%ew(yNG>D1@GL=rD$f<?LdVD1FO6^^&ur1HxQ;&J-k*@j|Y`ek&CqI5eR;WI>t@Ws!ioSHDSE z?7_(^T8AIrHm0zlu9ypjt|bA&Bi(zI9EAWG)Jy3;dN;-i>I3Lfdytzuk*MgL0^;k< z@{T^O!?p9Ka&`6-0@oRmvHn)LgD7VN6(Uy!YCU!u1_9mA${E@0%9F&jnBRNA8OJ=6 z&RU)oQl!mSGS*qG66EYhVt(XX7YxtDywftHstG6EruO;!{mr$a75y(%C0dn_C)N9@ z1bD}cZjVix)QcKrT0wcp6&uoLpFVwD3^@c-Dv)o#-On6ObJ&`+mzU6AQn{zU^)FSyC%} z34#78{_maDjF;(51VT80fZZQr1R7Gi77uHM{YuLe4J#GO(LAk0Z*9P_HaTwhNqF2f zcY%to^Skbxc91(3ofp77S6P?79pjJq`KHG5gf`d5d_^XdR9-b5%jHYbxF;Qsp_#rj zxhz%9r<##(+rVj)BKWCl;%uMUxjr{kJ5GbwB5jV#}iX>5&%V3n+n;}tjPyT4^<)Hy$XS9Thtt^ zBoK~GA{H;#16L?B!OxJA9q2*C1|I}?ryjXWTb*CZjm}9CzUh(hLO%D7NR9q&=LoOq)Cy#q!q0+=twn*L&TJoAceriEpY*tC|!V;iof^s+s zPo1i3il#Zm9oGPk#BA91q!d{v`!Q8&306G59S0UelDcsrheVNOrz?(rm-;EKz84YZ?bT==`3P|45IH z%q3MblexkuHD>LZmj4kgxQPU{LYUT^le2}R-@A+Y`roxu zB7jbT{(p57bqu;L&@#@wWRQZJE1b(sqHn3Rk-OUm8KB&*U~s9WbP~CPIAVb4Cm=>xq;WLq?0cFBYRw7L&&z=f+6kB6}i^*mXN~Tcc#iE z1rkuFl-fNaOTC&vQW8X!E-A#H->zYGe#RQ>ySyh?Q>80#y z^=_B_(~SpzB$P-hm*h!YoHS&Rquwm@5!Vc|ATestl^sjIzbIhVc4q#B0BUAqHLO1>N+;nX0%2 zRl!fmB_t&HJVqgp4E6h~OJj^#V{dMvU21D+V>z_DW-xjc7}yD#Q4i>4mP8-WQfAwF z?vJFv+L1i0`t)knM5*Yio^^IZv##>A>v_s)pOKNc2O z+Oke=*q2xxeQ1xUS(uX|X73-aB89%$%k($XwD3j!cyOGy(Tmi;W#<@?nToim( zSng`AwV%FE!^i#dLy@c|H#_og;oNHrrBtOQ3Hr!V?{sFQG6S^P6U~BEpV{8n0m~5z z)F8p+p??zq3NRq#Juqk0MBX7^F}hEQaIZEbb9p&fh~X0UVTWW(4$gckEuV$N$EU8Z zk{0B}u~FK|>dXz#DmOH+JmI^!s(|s~DB18}DvOG%IZfNLu=%>UGiG|WB z_1<%t4Y$krqqC^zCt#HL6^h>zSd?&GKC-;1aqS;)OCL!&pJt|8In_cdsgT&hca^Ut zvULnH1f*eVb#FcAhz+|H%GfWAHNmkrrg+x`D3xQAo zp0YAP9R+nuQlg_%vCj8PrK-tWiZ+$A0W9644SJqWLZPHpMV4Q+TS84P-#wh%t*G}#!A5ELQ3|4B?Op|`af=L>rFi*ExBZ`Enc;R$#WoBs{=RN7PS`+(@p4N z(RQUT4MPo)hq9HKvam^`R}*bGUPSLfX49_Ogq*+=<}C)EW6d^aL5D@J43Vzq7S7P# zK7>hVr}HBU5jLdA6UdlZi2MFR_h~xy&PJIN#$P%=s$VNX6H7_JCEMS`qm%^aC*6EC zL?_GxErF1{zt@WG{`8i{`A-c9J3HIF2(CHf{rb+{^TR$>xnmt<$;E5Ij!MB_KKu5w z&*qEJrqfGOeJ*{})r&iL9!}g2zmsH!pp`Z8haBAy+OIfB1Pnq z1{gv~+tC8A)394%aoV&VfK{)W&YoL_i4g`TtZ~RQ>Q=D$;k1YOcAm&U+5P~5KiluP zWyN~Clgq@G{{O~CEmtDB&N3k5fImXq6NgCEZPd8$=@Tyb{8f zyYX@1wbG*%opcnHs5FY?Tqccn_k03<(j`zC0wuTPTu!L0kiTmtxQ<$~TSy&#mbr=_ z^$QTiho5n}%is6Z9z=(ZYJxargC%^Y4~cA)-pQZoh>as@M=jhj$Q5K(T)z0Q2kDt? z=(pRgeEi&d5+t4nUPZXY+sIY1!{R>MP>`vt#1^byjtH`h4kWV;QN%PS(HLDFS6PQ; zP)a}83nxKiQ%zs1xpKgH>OhiGXszL~jjddJ9C&TxoA$!sLPjo4`fR#nOYkg(ssgpq zT!p9+RZb%93g-lbgJUfeQq`PYqVe0(Yx@osfYH&=#Mw)M920V|xag?rMwP zYd|Bnc0tPV$IER5Sjv;x6|6nfgv98vldU=$hP+QL5K3QB;(jl<*Q;O+$ykjUA=LP?zr$=O#P* z6(C}f8)`4Tk(75Q)!kh6MJgd~?+301YA1ullJMg?x9B;~xpRNH!#+QxWPBGKuyD&> zt+sMYi}htKh0wQ6pBkTI;UcH>K?3NRHP@#~MAxgzLK@m*c~&jXE(T?jf4G`EGJ!67 z0($Vl_Gft)ZLi65l~MiJ)-NcGAqMY?IMn9 zq2y^{b!!`zt&xQ1m;doU?rvF^XaDBbBa+L>&X;C-KaeCZN3Sm-^)dkJnKou)+)O7XiHX^3JF^CT6#i3 zh{6eiFQvXbREoM=vW?l>hdiY!FvYjz`_?39R~J}8mPFmelAZ`g*3tLHKJYY3N=YSW znb`G;#qUzfw^8jTF5D|~M7zjVXSGgjA%=F?-(ToeOXSf@P~F9eKIam2vhpD+xr=;a z8OqC`LWHT`B{87=QO1BWn4uxbj&byARIw^_@WuP!nz(X5SchrwVx5hm>s(9nMe^>W zbIhPKwQtpzgualsCn^T+D(=1DDonle&|2Er0mUTHqfC#am53^u(%pO6`CiacY(sW{Pk&32u|BA!9BV8Z_`r zS!#(c+Eng8g!dV~Fr)k)<@97Riu-5bbj%6#`jQ=N9jaTbHgVuwhO`~nNuI@Vs;WBl z`fb@)cp`}3XbU)yZxpRza!%xz;`3YNVT(^Te7w)yg&e{r$5c)2@S)m&?-K8$K=h?- zhqcBJlb9F}wHO|CCki$7D8dz_lWg{Q3-~&I4g2j%H4yD3AmZ??D7jFs@Q^2Gk(8)B zRGzPEE+hCAEG>a}HL`Yc(*`$DOQ3*E;f75%WC}rCJlLavC(2h!Vc|YYl*^z#yij^~ab&;Bf za1moIDnZolj0VrxqfhSzKR~C_u^m6b;HecR#K0(ZoD^(&N}4CE4(KnJ zYiBV^x<)@Z|NrRQu6h5X`L62oigpH}5KtY~CSYq_Kd{n>Q@C4Oh9k|z(WQNI0#AY& z#hP!AkedkdgA+NJiJ=`u*-pHi4o zdtxQU(7@4g@3~}z$n)_in?(s?^(UtC@8sS<>>Ad&f%tPsToS8 zbC_8vYqv!c`cF=+h^i3`KPU0x75gafAnmAq;y>I2jmn)^y+VXa<>>BF6G$X3FkG6Z zo8LlR-Wt~syYlWW1EDDE?!^|hQ<@h*8x8Xr}D}tA(#t@<^VHlHw^_#c6Tk&0ecSiHfK{?O3Mm5QV6uzvGR~l z#gH$FF3|L^OCbb^B{t%>h{5AzhX-vP*KW$Ko2*k?wn#1L~Y)#i&z99sUhV<&B( z5duNe07zrONsdP|x7ZIiagnzqo`M8{4Xt`lHhamPKc2EWn(cyr`gH3q33t^b(3Lb< zlvyT~B+B>r0Q6pA0&|71MI*#(r(lg_{vvw{f;I~MWVg^uKp>@VBDggI5}Jw>7yugJ z?e^}v)K-+T3mzvIujVXU1Zbz3fZ> zn%j#=)}reoK1TKFT2l=zy#z1m8T-dUXA8qGfA}{>uFG|io38iVB(|AZw6pdeX0iV9 zV^NU&ofFckOvdLi-;c5TYH3zaB$C`?_Vtzr=~q2`+0=avl6ZMpkf`+0He$u%Q*W6J zYagZ%E`K`|KTNnfI}Xr~+gswkaRigx>BcM~rCC|H=EE(Luoy z{+bYOt?>CsEnF_4O4)qMt+4X8m5q%iabQRFOw^}5H68MiopXXF5ju4_?J~RTkVX26 z_VHMi&uUtFkC7T|*d7}=jn7g>&-ceSjJ~TR1jxLSX#2y?zYQv0OvI`3yYo84lStbY zb!thQOV_*x@iDqA6oXrC5KQQY3Jy>AJ{GG=%KEcitZI7NhX^Y8!s<&S^=n=PD^`*TQ%boes)H(L+bTYgGt%@Dx)DSp?F39Zo390;UD(kHF36-QlSp)VGP*%0Z1N&_ zJ68}z=%mAWEk(S%yCTFLX@a*+zEOw@Ul&+~0rcU+BpstHMW_}Ml#Qe@^?Otk#;6qf z*C-p><~mPFzN1sc_u?}dk#LC>H&?pKxyu#16QY2(!w4n@U=RF!*e)Uss0QOjMXA|5 zrH%qd@=C@mbeTuZ^!kxc5z8MD3>ysJMAnY05r8#2Zg&OfUAdNd=VB{66t~^Zga7~I z^*gt^C=sk<9a#43r4DmUkju|aCbH`1Z+TIDs#MDbF zp0uv#Rt7`1IO3qvNw?OPglT?i1#cwMN0rS|jim$jlzELU5B4dCExdH;;NhriTQkM` zt2+SId6;Nu5hwm7#m-Fd<`XN1hwH3~?4OC(@%MHr5c^O*J z+H!s9%)h8x#+P3Ohn2%Y)-hd9{BK@t1>A^YxC_u$pP zXIkTsm{cMBMD>_rKS7@~qy&*}kdKKw37%1<(`vL70J9QH1k<<{eIZWt>+jT-JX=Jejqi_*472Ht~=N*v$TRcri z<0b_DC}!dlPW5wq!9}@ANvmNQyymX2p4BJ1AITuEV71`wR`w?>8mI#&Y$;WKyU_36 zRW}>J5WxP(k6pJ|HM8<$yWj)a23JQaHeQedVTNJ)D#^h_MQRh5Y-!4E;sQCW`Vi>q z{gEJ`w|!wKzsu}(J=E*h$At)hdIpLhPHNT4someUhWGdT`u65>$;6gyYg>NOjI(#B z)X?4{3UKw8GX~CrPSU*}omzjfq4`gzkdPLSQb9PM!)jf%+(CwQP1=~_4J&uxhz0^?|@6xMd3@1hO2&87TuaWasd zDO76}!dq09a{%1s;u^(ui#I*Gx0H?$>v>C6kKIUwAavM;mp`8yA?2Ym3Et)y&lUxY z)9nPc?hn8G_Uj*h`O9Avy5nQG-KtB3ziIBkEa{;mt8Y_Ot}c0!&MIRCS2j&0oh~$? zG^O6LzE;wQdiI3WWgp6oC#jVYMJ4r$Z|WZuf3d(>oG|4g3MRBlrZHo}cS>8V8C>|A zy`Czfnja8jpt5vlS4_90siNg7OJ-ZK-KBz}*gVjW;v$yclGemQ)?M*bV}JM}_wdRP_)i~8m^%+Uu+s^f9 zY^2DODtG_Q2C})jI$+z~h_g_5@Dgmx(xbDRzNiE7C4}acWT#WRSxKIKA;qJ#cBhJ# zxaeD;S^cB)TFfVt_fNn4^Dn>tZS!;{o zd4RJ>p}iEr@ng1F@T0l9?*E4vUhYBa@I4!uf+RepUaY(b239ic5Fwed;?lF%-u<(# zrHH6NE2+S%<}SZ$X0ag*dH(A0jpCDyA{Y&FS-mj!YXp;&o`)aVDP zhcvQE6@GZ8&#Q7h$Q2>wWFQI;Z*&w(>mFQU8|R8rM2UnYqMw(-jEHqiBX0Pxd~mAJ zOcBD*LXx>1@hu+u4}omag{A>oB3+ib#5tS7qm(zW3VRP+UQ`7Z9<6NzHnhFJ1m<&B zHhS-RFUQitaRN@AG=`*r`k&(X`KY5`XmP2^PDJ<*_xzGxOlDDi0; z3j(55rBbh|bRwoD$x`v{XQvI)4djk#g``O{HITH#Dx_TU9^Eck`=FY-rNmh0j%`lv zTnt=15$N^0ZX;n0Aa~n9@EJZ0(&5!Rr>a6^X#0lEr}AWDJUbT0^?r3c$X^s5JYj&9r|GV(TXQ zUgex9Mtjl+wF@J@zJ#wXwY%uhY`(!LV{bv1;Px?mv?mm&Gz`RBb>PLRf9-y%(2Eo; z3e8iDkn=mkQmFaLQWn#pP+-}yuy*iRAFdUuj>)rk5s)U?+Lp3B=+%?H3Yx`GM>0dz zDoM;hkiOUabB}gXyT<0DEuuCfu7Kq%;G@QPQ~f@d)jR`#C~aLhV>4^1K0^fxf?|aW z!%cF9vI(zTwamu;ML-0)bXu9f_i|iEn8iOS0B*frpXYQ< zESE>60o=`2KUokA$2izWzPKE$BE{c2m&1{*UL=$+HT(|g2P|@Lol95qHXBDS$WO9k zoHb9lVWKYP*+1vD{{I3#c9e}|@N&l>Tf&KKc=2PcbkM#$o(jeY{_KqRvJcK|4WoYs zvg(1@3e9sUPiF=65A1vBn!38YtTV3~KIlH%+mKBRt1&7`EViJM@0Z)@d~t*5T#dL^ zdPFoA!l7-Q$q4>r`+K7g8(1%d7qtQ3KF()Lp(s4c_YNhJBn&a5)R;R)V)XcsZa@vK zpFWYKY#h=h$$KJ*iX2TCidKSb;v4CpkwiSh7PD%bOF%3vm^r&&uNp{S1$ja#e;H`A zB${rx=%!@y+#>vj(9+T)qAx|fG?es(`dgW;58UV^P%?mfwLyb=v)gNR6s%w9x}PiG zCJypASjAen6dpro6;6kpGsp?w<+th(cGg9bwQKVbO0~iA>{Xu-m@h|1tx|m)?KVkV zmcEb#7bo#g0~MUQ5qYe3qbm^Rp+Pfhz|rV&L5D2yz3}`P7aIUoAHTnoBdYB}Zq_4mac8d zu8!uBvRFB_P}8I$=3XWs3oK^@b$aUiZzZlS75>@y0GBPTHAxeIe;awW@ci{3$` zhwlovy@;x0v04cfRLFNX-=a-SO*6_QKVk)pM&*84?-m5zau7vMN@WQ*jV*eZE^q*& zZYtkxuZ{T2$y~|ncY3$8Mq{6F|CBi&BHqZf9A!{|{336$sbZ2AYhWezRxMBN>1`{a zdfh$1kw%V1pBiMHjG)5&Ef4$8Ld6ps3m^CK`}qNtTUuEkbM=;i65%{PFmstZycbHS zC7Hbq5{MqQd8(OwlUd5ul9u@`P4ijlRQAWdue^fbD;gQ^MCXFFjG=&Ciwz90s?8_V zq|cyT;r>X4sqVzNO?@{XS-o7k*lh=aD0^V7cJ1vqZc~Ry;xu1WJ`oaWK1n!TX7|nv zfVp%^-ixZN&y;5@i$0ff@EJM@SQ~ZxH&FDI z(stn|?+t`nQLcZ|R5N*>TIje-0iYY{`MArWJ0-~Aj$5pa3qWQ`z>jgTiDW64a*z6_ zVqkK@KdGyK0%|0_n@F}tfK2ZcAQmdRdymGA&@tB(&jSvlp)}B-`^Z< zGftfumn=?6NlR^b%c3VOs64G_@F3-+%nizfWgUs*S_YBN<#E>x~1u z< zRE3gbp+;nr2t=&C1M-VW`+6>@M>iE7^u&`1=BVvP^(KV1~C+K2L#%6 z1aqV!Q#C#U8YXs(3Q2eGQ_mEVC|u^ruchvscTPnKG8z~LlvJ`qewpw0vj}F6{uDW; zi0ot+)yXA-T<}G~&9guJ{{E(}8zeLvqHldz#!V$#z!OE75<_~`o@Mv#eSDQy((Tg5 z_((f`ZrugMPAaW1OE4ea3Zu&O67(+-E3@BdcyG7hUz`;_if@Jn$#XFh?Y*8k3O1}H z9!n-EKS5*_jbx`)HbD=?W)NWX**JFZN!_YWD)nX71Nw8P#w>Z#xJSVzyE~fKaU}YjyJ8f-w!}kzXISihWym6WrH7A#KlF4|!FbUL>eQ-@ICA|n( z#{fr0oTi70rUXzF7VcuQJ5onYc1E+bv-g{Pb-?Cwv;AxF?|ZMvtc+3!5B+=O3?HVu`O(^fz0hW^pt@v{GRzDMC}rpIn;9a-vK= zr+4iG?4&jkkSiKy6`20{_dopl&wtqxesy>=uEfX&*A)Wk-sMU3$-u0?qjZ}D`ye4Z>EU;?PMDtVexbt!j}CEFr6ue_A)X6!(Y zW z?q$UtRLAs@?T`hvltMY5$>hVF5{l3hoB+|txe+>Cr*9M-}#Y=1(PMsha7 z7m_#|#gcl7jO-Z8|Ni#}0d?E2V`reqkT2|j{X!GSzI#hl&$c048vz=%RK7}eq;0_4 zT4i_7(}`jO`TGu@VLk)`2m;Pf?SR*m79gOLrd|gdV@l! z!a=Q2u3g!fW?9If+?ifTesC{!ps}T&(N!L(S0aqt`bHM{sY2U8ZU>&C|B~U8Jrn{K zu26>|_ru+3D4{>)Mv*;bgxqCaf|9#6tL+++{(87*{G%W5@Dm`e+XmsJ{yfB(N(o*x zDzVu;0Z|R1u~JL*QM+&AB)c*qMc%eW6WTR->ST?GXQ3)pWDO4#U`74Iu^d5c z>L6z{fkdS7{YNTur3C+|x0COdtqcy%(z~O>(O=O`sRs)mX=~W#)mKHK?mquNTVial z)bmfYth3?}C6R3+2-?=;bU>zuW`k`3TmDJ^0D1UTnyHbvQVGa6@!RXjJBl@K2tHdK z4bD8nJ^@6EdLjGBH`b}5qQ^c&9Jfld)%T)f^hq|qqbnY_**8`^)Ly+%>`n~z~+8&`38H5}ZTB(S&&cL$N z_b&dm;&DfpkG;doImsWvhHgI462kadn(ww8^z0$;=SbP*>#dV1S&}u z99y()7nY910T5H3sp7GcF*yU&ZONe+tki1@Bq8)+rx5SKG4G?Bu}Pc~8;Kr7`M^79 zr*O`nbY=9T)&C>sWuP7T&c?>qA-080#7ygjGOIsd@N^MH`98BwFuL4hua|#-szqiFix|^9HW`C!$?wxX|(Wm7FIkRNS7lAB5vM5 z4UI}g(kaS0ux(p;gRB_ASydKw*@z@~gQx_%tgAaA9D3Wb!{CCl<`vCHR0X4(u1LKxViwhAJPiCWQ@ z9DRqDLa_`uWZ{BZN>*R>N43ia*o>1qI2$MhKFjWht2aMXVkV2TD1MawEJ==3Xfeh( zC9ztT&T|jFx<6HPh16mAro&OU=vSc|Mnq+E*A_DW%r^P9*sY1%eMA(;6kZg^RF$)X zw2mIq5>`YoQ|wa+kBm>OzP@NWov{eMq8D+FlIuQd3>K@Uth19k>v4DBAB(dlK}rsG z>1Ct?5$dDF;|@0XdaVxW|Eb=6OoRPrb$gW#_6xcWPjt$BwHQF9KljynlRRwq zKMh3O^2gSm*;bd&P3#d(KcWf2D}2$mMH;N0BGSaH0& z9=7Za#XcA;-X`4^pn0tCgB-~NbrWjzo=)m|IL zA4eP&JNf_;>1akFS6i$m1rV|A%2tqvMR=Ml=tETA__1~V-hY&LNfeg?iqubP!Iq)x z&+o3<^Wn|nj~*Cguh;oeYp=0{9nx2L64DXsdcmG>EW+3HW|=wK*$>RCyW|6ikBqgScqvJ6VDq!fqIoT~5O5`D zwiFs-khCEwi7^95GnvN4gNI(O67RXk#!$t?CKw+U7 z+CSlRKW}g0n_0eOG%V0 z94XCLDlJI&ISv}68JnH0#{UzD0OVa^X6{{*tGl!B+F9%85=Z6slL8-AW!4LHwInE( z;Xz7);!jR;y18_U*1cAuHmaluI1N$WrYvhiYl>fzG7Qs*Cy3WmfT~i&N6*y6nJ%O1{ z{d)p9EhkMOA>3#g32#|gQ`=D=@X5wP>#Y#B+b$EG+STDnP(lCM)llO)ALmVYL*+oa&ygNzg} z?-jj7EaAY8b!2h=SpOr*Z`ce*mBI<9C$WRF|NaMI&wu|zh8###NEh8DfJDlb&lY(V zWfvO{YHAWbyl!HrK&qXT?8pUOQ@@wCY_Fb?l=gC;{=K6=>B19N+oVT*0Z1IVpSq#a z1kHxa=fzU}+eIFW<-|Pa084Y4jSNs#*p)W6`2CVPdWpT3Hj&Lrk`+$`>rU{{!7C+f z=9h~M)}=~N^{iTVN3csabhfMkR=m2VXxzz*TGDIeGiR=At$b2ui3ISsM#>^Eh9yW^ zK9ifS{1wlotchb*OXbIBE>jYFU57YZzGFMYAIKzZx2G0{;K&*4AvCym(vbnXu-(fQ zNd}?J$9#LtQWJljFOx70@nV}2$u#@+%)S)F2ZzFo`Rw-jlFM$2q-;+Ze~kV3n5zD1 z+b6=$J*`NA{XwRVK3_N60!_+IqITg)xYcZRh8JExZ1w4<1U*g zcXM`M#D2X{Ko;T4ZA@n;?z{F3O22RNM)2b%!2&m%o?860wUz4^^J$ zq~#4rqYsHbe@Jvh3`M{nqwB<-YT1rT3g(um3Aefx=c)b}rP?&fMz4}qpG>TK8Je60 zi=6}!mzo*cTLXF)@7Hub7W=;^4=KcbDhhNO}-pr z7ST5m-U2kw2^8&gn&0SvS=5gP#@&L*a$G6^Kry5RT~<|do-(^gYMJg2M;F6bB@r9j zky$>9Z7OHl3Xs}+Q9(*OvTe;plmLnd`~zWIME6dz^`ru>V|9#-KKA((?{Cu%&Ca`7 zE!Eic%j;Na*0ImCX^)Zt@E;TlL?pe)goVrVv^M06z{e`uiHBhRs`J8Xp#y3I+aQ*1 zf<+!t$SU4y0@v+gjoC+O;Sjx;rQW-!mF}`{%A4PqijkzE()cJtxM`3fNRNGrwDx4k zIoSdO#sU^v<@}JBs~Djv$JOm&FOD)Yh$IjSvCc5*02fK!3=W}DqV1jM?l9*q?-)3?Vv#^gO~kLvV=^h%3l#}&5k)fQPQm$%z( zv%h`pcbj8&u_S`75&ZxA$^CCGfD_3`&XNWhWo#otfULR}^9*}APc`}~uSQv(Vo^wu zRrN>tITPq4lNTGRwVX)hntXG-LGolIt`X}Qsh3XvtAh;Zh-}scZQ2eat!9+T?@ewQ zgDgl`>hP!SRok>}Ld1Y9T64ksPikvI-MD5GrF~oFAa2U{VJn|X;It56QcALo;-?Ng zW+*3mPw#aC)Ab|5N-INPaLZCTVYN-@#25Y#CWvsLc0_(@(eUuwegkRpal zOXe{OE4wJm#;e2*CI4MxJd^;a%OsnlRUS2AEy2ek4pztkP&%aM($tPJ1-_tz+?(Y5 zAJkO;DGy27AGVNuHi}yEMdmyEJl!vi3cw(rFtobRn|lGqya^=;DDau=f}Y;C9h)x% zTWvLcEBFv$iP-KbeF)mx?hR^R5QPP2^1(n z7^o6fmt^eBD)o=0rMH&jgA4RgkhHhclfSuQQcc8O2wDqd-Dk7&7Gfv9jbdxW|KI}5mKWc8=hzSx3Nc1e_sW8q zG~>Z_%i-i$!*5KSqpYR;p!@2&PZo>lTCiAP^xXmG%-Z1B`bet|Qfl<_|X>#)G6&$^Uqa{aV z_f`42DkPN5j^tsl@*ARP1Gx&4;OOQ7u9F7uH9V8iFFP=I4*TuKL&H3l$P@~KAxhwH za9@!uZc`vtgs4gpvRp-UFIn{#3WKjXqR`4_+pV^D=~;4r+(Q7%x2dY57?HS@P;o&9 zBMKif@$SNrdYDcXQ^hCA2YZmHW`2U&B>3`a?B^rHa+Nzo$l(i_LcXb@q4<^r{|O5^WU| zNMV|8P3d_3w-Yg8iU|EYK(M4q1*b=Du1J|TXpXgbIS*MYOG*^RS)Tx4I4jALSy#_+ z%)oHS5%|$zU5KH6Yhl4SLH_$6ehLt;<+RD>Cvh!RIpP0zYf$r=A zO$+ZzlIqG?D?;}3X*jM{gZOvqdfGCj+L&Af?Cbr`iL?z=+8zB%Q6Eiq)+H6kPhQF* zv~ID!A^+{NpZ(R+fn}v?9d6_~c> z8s@vuQQt-~8wjdZfOk{oyA9yTDmrFiLbr%6?n8!sztqyu;v2!nyxu;lUbQx}kUOAs zHmJ_?>B0}6xDVvntPi;ZYBouIW^;U?Z?|8RTobnk$6h#KnbK1+#sP?hUXV9JF2|hezZ!B7;bS^Kll&w@ay8;fIA0yt3 zc5k03kpL)_#F3Qm`XSkgsS$8fvy{S!{4RV|RIsML93a2bd=^m(F1(lZ8ZDgtckfNQ zTz80GWG)|bl9X2Yf+$Tx0A*sOxsth?O3(*or>d-*rD6mn*|<`gE`S4ATIIz>f6j)+ zcDvizs;RY%<^FX(0^`nH{9Xc$<>;JY)uJolY%`fEFYtI0dEqLvmNpI!=UI2-CNU z(A0~rdDKnmJVg4u59-4{%9z_&);$38**>#3SfQ8LND5hNXziaU9^32!sfIv}L~8z9TqGsf zox;=q^?!}!AO7->@4qNyoo;feAvjgb-Nv*Fwcyz#&G~l=J1lJ9l6yA@fpp+BsA0n67oy7dmzw> z0srY_?m-54wiU>!vsbJ1N=Wmp9YxC;A>bllS$COR3q%E@sr zWg6_|reqS%UUn+oqXiD!#vg6Yulqjev!w8ONR;&OMww9T@F~&F4U?K1uN~M z+p>FEt&%2K;z(!Je6RUuDKjYs88d*$0pmt-JLs{}RhiGuqQ#WOJs!_(b4eiGAF!>2 zoN63GHArN%KI2AHUe3oPrNbRTGYn{9sf3GwNFYz%$`|6rXGt=+c6Vvt;*Ow8@(q2z z{3acPp(1|=pb!?DI`xFNdb3M`zeBb~e{Ox`hEZG0za zEq;r_;w}{y9fq-rKzE%2-J>mrCCjD*J@SY+Q^|1~ouH-mc!;G{2ixck`Hn$<7*zi{ zR_bU)rGp}RL%XoFIeJUz=d!9mIe`BW&RejoTSAxms=A3_Ifc)gr~_<5O(9C74lg^d z1826-0+#T3S$UU(ZN$;RhW9x75Y&N1V#)PMUd<>T`pZJ2jb#HDdgCF7dNF$a zb}t^cBadWCfYr9TrBhkoUr@$GWkX0*zJmyh4RSc|yEg&kDAsanL%Rh?5?Q+S-F)Fr z9*=^Y+)AYCrB{DG%RqFvBw%ex8zI{KCiU7o-dL`a67FIYz6oGwG{>F3u(mBtaTOPjd63V3v`d2iUL5@o--Gb(q zkYgyQ*^t{O)e_O7sSZ%yJWG`LFMt1EzdDFT6bB(%PQ5pM)ZBC>Bn-yq)w@SX;PG;8_?L+4VgU_qw(`!P?ovT0opeV@ z6JqeWJkfNT(2PR3XTFY$1*!xr7&)hYc5l??dY#d%AhD>pm+$ZiHommw**gB-bUNUwt|EvPFufSMdrLuI?%p#p4EZ*jO2lsUYBeB(<1gCpg6NypP3wA8YwOkU0C* z|08ggX8U1}{p>cjkImu0KUVqF&Dz9Hu!+#zqgBFUCtDTqt6@r(2Sit)@;c&U)o<4+ zNLEj&IIa&H?>aeaD*=dB(aTyzga4T43F`-jH_Ak-P&i3lC>faD03fx_ z{+yq-b9`$)czyh(!floPujZ`1Bl|4pFM-}aX~xdN7K~@XksEidozJd_Z;P&lI%q&y zFb_7!u z;IPTdRnCN}Is*lk7!l9_i{2-}nEL81n;!f5=jnaHvajn0ahALEVH*+6tn9B2JdkL+ z_yb5n^Z9&Ix{+7kU$rs0UhleKZ>i-+;WC=ZPE#@*^q1~qO{*JkK`fbUgR!l~HX4+Y z0Rk-A9L)=+#5XOqr$eiNJF`iCl-%qNnb?oAW-Dt3aY0dd#p(&uEgT9S!U@Aj0Gza3O0G3NFPGi{ zAA%}Soxz!c?!cw|gzsMOz$*wT>6BIg3PNi3*+ReQ=c}{~MTlV6>Y73Jp`~PuMZ6f7 zI*$xYB-KE6isX`C=W}unKI2s?rUi^2jHB482H$9uRKUIf&0w=f*eohKymo3i$0N`N z`lu%ebodyxZ7G{w&cz5PT1LCJCFz2@70N}z$3uFj7K2cq!|U6U8A&7Spw@=<26k!( z8<*R$7mWernP`cUc>0iUue}HTPXAo)p{I*EX?>ZQ_@s(voPt z`#@jhu`LE(Rdu5x$)+W4TQvU?ZRHrd<33>IfynTKfN#XhTK%jw1?qJN&~_7>=PuaA zN|B1#JX4YAkn)SPo$gbOi9BT&o7FaUy{O9P+km%iqqen;{AaUTcF#O^&!5;hbe2*# zlwz1WGD}Q9I-%(qLWe64J-9shEP0gK^6*$q`O_}irs_BxWA8n($?gJ-yKJ$Ww8c84 zew}_Xy=L1>ldwTt^;KvoB%ECl`{dGE-J~q(C%QL;ay(ty#=+X}{7t-V;l`)zU5;Sz z3Dd`^KWAh?7=^Z?-^iQGl`3Ah2Bqy=Hs2-0oK0_u$ykmd;^;IeSkBd9MQu!q2e#l? zrqv9>+sQP;LQtG$*$E);iHN*IP^vlKlLh0&QFPC~hw1%n0e{Mz04xTp!hkaB_^|jM z59YDyPpWs_W@+hL5{6d7Z-4sb-~ayKwtI>gXE`DZP+iwIM(0 z2vL=OuKHthnD@f%v4VHaG@%mK)i3CMsqI_T&o3@`)fH^mOCg# zyNK*t(z8T#jqP$imrBq`tAsdl)XDwhcD<0P)tBj=IW#$U-$@4}lck9-FD0NFfyr{5 zxpF8ulmeQJ_4AgK#eLMSRo#2PR~*B+YPv>Nzmg@h3~qF+vC_D{;!Gf_$uHH@yK?u2L;1t513I zlog~7;+MnWz%Bze!(D7`38o*l{qLb@_J2A^y&+pS&;9ORpytc}LhEh4%7cBF;_0*z ztwUnym|%M>_)+vOqI#eD7lGE(E)%~KW&9!xR-gPc#BZYArke_?(LqA&?4#i=b-$o|#8Y_xWcmr`@grzvzLovXmhs`)p>EMnS*OkGm^4ufsRYK> zl}9kvp%V*R|5W{aFBBG1 z3tDcOqSV(=%Ie&)Hv8<~rLwWl@=7FIxn$PEO@?JZJ~a>f%>E^DP9%W59z`d|HYVG8 zM`_FPpNRxeX1C>Ag~!R|wtmc|WP+qW7jX2>n>t4~UMj%>)WcOUw^0D8@jQ$5b{>+8 zU-{^7f>b`#IfpOv$Ofm$N|ScNFjum8gVt1l_(%~U;w4-o7J=FuOGoyky^l@sTBp(_ ziQ^>TV+7k-_G9UY$OMRa5q$%3Sv!jN+Y6oWkGtbR9zE&0n*jW(H$g)X_ za8i}GT{r2<%M#2Y1F|fjkfqFFY)1s|KJc8jPrIEq794NazyQDgMe6(4Uw-@7um7Z? zsiJ1W%C_^P@lEsoX4A)C5>0*3PaxVGX=3>MN5Vz;qkDO4=Tbc;Ig0$Jq;}KxxOh2$ z$n0;OBBzi3Tw`STQA;t=vQETeaCUZ-K#!F#$agBVmQtR2l|g}7aWOEOAxE6?;$fcz zV(?w-{sc&uIwwWrthV6;oYck}O?rU&hR&G^&~3O8R~d2VWSY14tlWtB^!(|zjf zI?4J_^jl;#9q3;E$lWQtPTG2l&oCS8q$Xt88a)x>EG&?+vQbP~+6XF7*>MYa zTPmyB#*#7LaFyu!Qm~GtU>)n+dX-jpC;!`my^ahhC4>6_RUP6$y{d$UKg5srY3EM8 zs$C?3tH}NKu{|H-U>7=03pi^Z+jH=ORSAvsP1&Gwzn@&iW9-Uq0$D^$zF0m2ba0Ga zI8UkJae?n|qm;T0A=+)=_z!UqIiky(q|^yX{~uITH&IAk2UcGIv2A3AdF;!}2E7j4 z*e*EC0v#M<7v2Y8KfwgH`GQAS|89r%;%T(V76^Z&YwKv{6`PbEKGIHl__?FP!&&}w z3=J%5v4>QUbJWOXhoA`T0|mE_#@;?Q?tKu!{Gdo6 zx}^@xlWx<6OAW$2Hg74@q}Q`aQ07&jV^$Feaj*(g!(}sHn5xInXYzbE50%UGvho1u z`Uf~X^yhG-mcz_vU)=>XmN`q?%Sdu! zft4tk9K@99QgyPOvb;+UzVk%H6)9Ys!d5Z05&7r(etB}$MICuk+t6*ZZa54|>#shO zxWXu~J-mE86Hddvki(YAG7D2N3cyZ!El(%h5u@B|IqCOztDSjLPZ1gZ-0^v`&XVO3 z_Ri#sPLGgo1w?zPeQPK8T^X*~RK7~5z+#JFuh}-1{%i?9%(8y&q>QLGWX>KfLTh(E zQ?uV`YqtGM0-h6_vwXQ5>0%&pVP8?-2KRxplI>Fx^?%fs6+dcJDkZQ6E)UbVmjHe5 z1P6J_@}ukxBSqDRgC9c~3#n z9f&`^ra^LAqcioJ5wiY_ykU(!>cwJ8_Y27-wPT4dqwI{Bj_ulG(%8Aup=^*0Z7hsQ zQn~6{K4*NM>K3P6`{NVR4B$)f!Ly&2&8W7(`Td0CBTB!0#hX{w#*O>jN{zoq$@<(3 z`o&xQdW+FNHqPmFGOslHBc&IKLqdtAw-#()CK`C#PX3-cJE-l`q65K8s4>eMd6uW; zX?~m}y8h7L3>F}a)SjVr^zU!b)sx2*lN@v&FZ*;Z-L3Zf()qzXs_pV{kdpP%3GJWC z^ar=wV|R3spx*g)l$=o~0)=g_*Pgd*Bsx-FT;aO%VpDl;D%Hm=+uxu+fa~6Fx69W^ zf^0UR{s=$vv~YXeaa{8Hs5E<1_4xZJV;5~!3d;o%Mihe&ftU#zZxLy1Dm))k@If-Y z4vM{8MCDgyH9}dpAp6}B8=rA(tVF6j=xLpJ@5BLx(NG&BC4%LR9lmj z$u5N+p7$?03klN`@&-keLy90T0(JZ*9_8R`d==}uIt%;g2=U{R>PO!+_B=00dpW>Q zO{xNHlNh1nA=59%o|ozZ#|TYS7dS+)vZ%N1B1ZXtlnl0k`PoHbd%^sy1M{;>(&%|8 zKkS2cxYP$0-|rtkeugQPAIdA30A%f5VXt@R>A-8*hlo8AvNEDT4g?x<65}fB+WX)H zsb;VVBDvy_6jrU40(f+xSBqBTPtCei_gE!_P&!ye0b!{d?1KZjOBD6vD!A%`B_&PK zeYhb9yI>XQt5x83SJ8M$^@Ti`OT;P(l(vcDi5~Wt03|1 z+5cx_U#}J$d|tZA{+)&kht>2Wo92((5Ju3BJiTZC`qSSnKgM@S;A;yAR4W~A-K!tt z(&H}O06urzDK=W(-sP(#E?wPNf?fUGx-%Uj*JIbX83db(ydvIekvCuViDSgIe8Qx< zm9qjMjDzW%TPoVCmO<%4TR{l?oye5s93kBPE<84IE5#e6MEQ?dC!wXL(>tzC0C) zRSjcsieLyMQmfFJS zmWI8$T5Yxvh&tSwT%Xc0f=tm?+HdMJiME2>HXEy8NDXshHll!TxM zG~oS!J1NC^g@o^`G}5?~F2sn>`kOn{O6?9Rt_4d???f_O2Ii)%q;WW3>}|*eld2vf zh_ijtR_|QTOc%o9oAbRbkv?26nMG;~b z@xyM3L(-;|0+LO%#CH*y9OK}Ssv$p{ zcGXhS7Jf{Bo(DX^iz+UVQ2hLkw7w4uXf1xU5Aa(EKcs_2GGQOc<^|%sO;sAzWFm42 zoq}|*jqb@Vx+jNd_U|G%S|B`ic5p zN3+K3J4_rTiNUqlo!o!=nQaxNvPq>KYA0_0lZ$%;{qI%FNcvURwy4W{*K+YwDHC2+ zKZ$!&k;j+4w|J?>8K%$Xr-TTm_qmrxFOD_6jHzdg@AWebdofR)1Th~)+@Uy=XH#t( zR}bP`NGA{w?@}ysl*fpg=4VrJZ@(@{`$>krsNoWJLH)kUT(AL?3=V?kIm{c?B}SJv zecLCcqz~I6kUO-EpZ<`b74;WLi_-q2%zktE%rW&mFqy|}eXc~6ah+s<5Z798h-|oA z>vMO>e!TpKP27!k$P;4U6BR`Zgpjx=pn5>ffr%|!&3ZUHj1ZS2cH42$(mzUeLtzb+ zPX%IK`B{GSc88jxpz05`XFM{Y=5xM*=obns*-|{jRUbuE2lHNv4&A!j8=(-g8j4%m zP^oTfG#`>)T3dp+YlL^eSngiBA6?hIx7mk(SnQ+jmW4w1#gw~KM5K7=4y4n?i@M1< zMa_f-=NY8Ut)D1--1_U(2qP$P;muV`Z)G?8eM5=J1q-eg-Ks_e4C0S}|I2@*;0Qfh zR65=;j~pcrsu;mH5=Fk6?TV>h#3ikv0nh}h-6;=&N5K`StCgpkj*zf^79OFp zI?6X-vhSdJG?y~Z>#15*U>K_&TNKpZP=Aw-vqhr73TdGVjn zr54771x1xmMHWH}vwK1}d#*|+kkUdz7>+QglU3Onvj2Bx!^p0R1Ky<*j9St*;+{hh z6`MmG?1IB|2*y$o;m$Gjg;b-7z~vCdkwe58`+)gH%{{e)HYql8sQgmCNxvNXXp*kX zLqYZ!m7QZ!BUxlgyw;PzfZK>*wrPDW0=rOzaBK>#mX6aQLaS9!T(=QgEe9Jn1&V@^ z4pzU5v^@4oWu_tmwP=H+uG2B%s^wrEan(8m2=bt6?W0b#O99r;Nb3*^Q>*AztWw{&SgznTKBCcSCxe`^#O{G_wAEG;Rh~Ei%L>{)FDfC(x z1ltsG{j52yQ-#UlC4N2gP?t$s;YE-NmM&PHVkd8hrRQ2lr7EC0d9(==@?=pNEkbc{ z7j9(7kP9Zj*(qE)BR=oIi2F@3k&Kvp^iCB5t5 zedVDfmJT+lKjxuSdXLDp!*w8xat-5S{)n2>CV-c#0A7Ys$YCK5Z=?6MiRcJ$X85N^ zX)kdgHlZ7_Pr4Cmf(2nBCfh2Q;okcq1Pc7_Dx@A)adA=vwUm*pf_U)Q?UyW?Hzh$WhLz$?k5wXbf_PZtjueuyuuc934e0_im zfk{}N&7-R&WOFBll<8)>l}x&`)Z?-J;Ld+q++`i;Il4nnC1ncv`246|mbT0Lfr8LQ zFnM=?_#}+M^VsejzT(=iwKu|$(0NOHar&kj1c(zvi{upN>j_}yhjeK1Ge)@L^0vJ{ z8*HN=M2}FQQ>IP@uqv?T(hn0uBFXK5@Oxr%2!xY3!k*pT=>>@wl{v*S$E<&Ag|Kas zZKQiYp106`9Z7DK25{>|6+>Eb5`6%Ozf(dS4Qw_(H0y$QG4%?y9oM?9@-) zaLT0eOk^|6D2ffu16V#?FnD#>L6k-r=G~Lagsk$gmv9TPQ&)F3aId8pa>+fimgEIa zNbd3E-ZRjxTQr0I<30^%yY|uwVr)yXtbr8|)vtr6jjpxuFO3v!g?=Hh`sNruwgva9 z3(d5WD(YeowPz70xHOe2hcwR!RoXVaHRTsDz6wpXMnE+eI|G243%VZ$wx({Yh)kK6#hs#>&OZxv3Z*kT>tmh0dkBoB_Ij1+KKhvIln zx{mfj5j%4_*hDn84P)b?e8mI`yhdA5*XKmxlKfVn~2Z6+Mj|s2LkGM6txbEa`85J@(UU$2=fZH;w;DRTtuQ?gf2%Bpp_JS?V`*jpwK=PN_HM> zF0u0}URZ#u^6+AEq|i?p^)O9wGRZCisuXYR1B9~=$-HQNrk33<2q(wXpmUOD9QPaKQgF52AC9!= z3b8#80V~=>1!@;)qNQ~gGJcAY^8APTfzdq8L;f?*m)}{0p(FNM6`@1wUd)F$@XW-U ziK}C3ovuQVVRa0$NyNOXh;UbNWmeH%UBzTs1*Cel3wzI9;Dw`yx{Aza6_;og4p^%w zC8iD@g{f!&ZlhSVjW%7V=qLS`Rltr80UnMR%zr1nodC6am+xnRYXK*1qhGfO!7Om% zMeBMoRd);C6Qb5jxlx{?D`8k72#S3B8|bqHr&Xw;WpEBu=@tx6?Nj^%+#L};;*PvaUdC}L1aGL z!{%#g0oT=?7yJIHYSt5@XuG?)icC$ULsjKjcdi~YxBR2^rr)PshHsB#TgS}ds9pWA z-N?2ehXh+dhO}w+c>jMaTtlRFz92+^rfcJ7@HL9Aprg5~RCKa%?Cw^mgkduAk<=i@ zUGGs2UNCsu`szHIjr?EjG@_M&Jr@%9_;NLXfid*?a40b4q*-cNLYLDlYPznM;b?QN zg({W;b_gcoyW{)%tt4hox?oqAO?=@3P~L~7NMwN%9G&Ey`omjk1Q$r3b}sDNx~kyC zcKYAdk#b2X{PkD*YaObRmlii>n=U%QRuy>Gr990oY+$6bf6TRX6GnN1xO##tVJjK- zARG2jlS^ji@|aA8GBnD0Ip^lHIgbq{A+B{H!)2_DpLsYM3sL+i6&O8Elqczi;TK`| zrfR(?<2BSU`?>`w14K3!KzR_Pb% zh*^B|S>lV_a;2^uJa1AhD=l+*PT4U(6#KORKLPqFF!I^%4rq-1;g2N{zs=i%!FBim zuA`#A4hjBs05^-^P9)gRCSsFa9BdL0=%?_)A(fRJ1GJCWWP1!!kk^}1L~#fU@(?XZ z2b(B7MbP5EllJHR&w5i5DBHz8zYQF4sMMxdWgR7?rE#}T-vuGZBD8&%X4%pj3qH|dDevSFbVPZ_!;s?lb)H;8 zz{xo#x_Fx)C~czhvstt!qDi&R6`6#r#5zKYKy&4B>fs`}=NyH-*Uv^7!NGRp`sYzS zDpGux2dXPI!}dwhE!B0xx#kcD`#7LfQ&9O>Z5MH(WAw)MfiGG|C+rvpyQuXXBYZhT zt>;L*vWviF^ScPfn`DQGV3G*jA<#Ra0=NoT-75N|tI&H|MKg32DF0Oe#8x4p=La6R z93rOK|L(wlw2cTR!JH!QUxgt3Dr&b0WgQ1<+65JB8*gwMWuQ$SQBFFU-p1pvLTGgr z#oASv4XwiRWVK#?CkR~5xmq-v7LmLKw4}1s(R+2#{anRV^w@}(x*{&hzl!tvb935e z@1}c$BKiW~TxKsow3MZ8mTo??SNZ*|yHA>QD4tJ}PDQvwPGaDd<}bPO`bXwMZWBI0 zV7G5-ra7jGj$Q5O+{qr8&fFDsRV;%}<(mUsYde?Pqh&WdEp?ZDJNm7{K6z*~u_HrL zZY!cLVBX}-qcAwhiLg>gg|VrHRB{}_)et%{!stM6hxr1ZWf-2a!x;KU-E-I0Uo_*` zdxzWQe5p>a%feE&gCBDPpUa|@vO@c#u3n8u%N0T(+J=XsDzfLBm}(v^c{K(#?b5KV6SxM)}}C&^;XB@oyGm@^Y zhiGjL_Zv2K`H4KsGxKi)wz;FGeeW^($o}*1zy0aIezD-szW<-U{_Ssn{*Pb(nSGQ4 zZUC8`k=f#dru+0T5Hj2uq;-=%e_sN+l3~~L|L|JMXkHKj?}e$KkQ_zbur8H!}>@e4`>_}J>GA* zmyH!r^;Wtld`ZSH6iiQTPbKrz^eMzYHCGAPb3i*9iLbW2HUzOP1NB6ElLFqO6v#_4 zDa}z?8BEffVL~->zwSFcHr()lptc1<09mfd%IYDfTzkcHd+xJe$^;EKpu=o~laSWE zuy#kcU&vI^TZh)vI=18WV&HO2u$&@@*hT2h7P0xJTH89Bq7lZ5%N{Z1A<*fEh!=yb zU4$H=>#TV2o5I9>Jm5Zpxqt*0Q3XnZWZO7cM`3Oo2b&OO*+$=WX}2yuotx;FE(Zad zcPLtVobZq-Ldv`dYp+zS3*ebINK+~Rk-G?m+*F?niQwbnEfG|Ck8e`|A5F6&%0KB~ z9ii`H$g{-23%-8Anr%bKCFFw-Me2MKZ$?Wy4@7o?)E8mBvv}~VqZ)UNgCc3Cd5nCF z0}p5NsFWr%(_I{F17yDq{@;SO-$eLaM9uCPHM@l)xDAu#b%fZPVCt_Uvfe~FZ&730 z1?X%Wt<-Ibmpyz=uW%htu@3TI)Q(cw?+^z8Ogl!Gb-|-e1r)gyJV+4)n< z<{FXsJ_w3FdGkP5D2367I8b1n|1O^P(qL+S?iK}spGHXu zbQbm7RiF%4;j_I8X6-5<5UYSdB&C641kL+6*rlqW*9d(mB@3oagvdn*oyLJ<`i~*c zbNrpco%eG0zsLQF%#D!L&E3^vlm=s3m>0s{`+y4Jt7Fjs!Sy(M=dt8;MEk4}S ziC{+u7Yj39WjD0bD?#0)eP{cx{0AsK(lVm^+d=M zJUch>wJix`7LoTIFr1tRUNv^U!0<&U7^Q3j0gI+E9wPl+LA6ZXM++=z6FX{Kzsoo2 z$&QbCxF886DEWBDtBP>@`E*LbLrU1UX5t_5_gzL)7Ieria9R2;KH_^j>RmGHqVa zWPa2hd5e8uvBz6ld_vNRt=XLafB&x$8NTr*_+pzd)NeG}VIE+nP@Uv{Y?1IoJZDI_}W)xa#kP2Nw~?y zkaogJ`c5V7=!$F$Or8y77?=S2V4HLZJcveNAuGcUM1}-!?2SGoXenQZmyB@8RLb^Z zQ@eN5F6fvR&tL4%Zx8$3g~O|@h%Se@-T5usup4f(b>X)VDleid zy^Tu^eURsyP$6FQq23aP`eJ+rs}iDh-VLRkW?TJ(K7acDi0;WC9vIv zd(SbN$oo)q+DARMh!FJOP}CPDs=VZp8PZC-@4 zWJI)%``i1e4CsK@dA;E4due{O;NJcP%x@P5OB}q8uJkr)ysKzEA5-hui@k>^_NK^h z9}VA7QOLtcGqtA|rKv--rx(eoeT25_=u@vEkX^*%!w~KeHo_8^igytezf=b19V;cno^NA@~lF#jIkk zt%41c4pve3jdHJ7c@r@-Qk7Lmm87V2X;`mQDc9?@`>5BZ;BOPP*iAfpP+nF6v0a7Y z zM}Aj?)(PdVf0ejff_-$%BTz?+LRA%>R0G0Oy1UC-00$)rUGm@Na(Rm)i_ON^Un~x{ zeNoWJAT58i{J37D6HxQVk8_ zUWCUM)!sf3fB+!*Io;i!V75(~xR%K12UX7>F6OiOv4uEGy-cXcr*xyeI&AkXkUseq z@Hf%~p`T9|y6;*QyAi$WCszpB9&B5dG;}A!ZwpS(HxP<%3zUEYKHg|)rqXUkowz-pmHAfN> z5mNGMDTckncIK9~c6v&?kTP-w;H*%yg*R-MzojDhMlTE*&#$a4=K&_`U&`@+VXM$W z+x@T$u7jL1@mZ?XHYnQct}q?(&Cz1;?0>3p{Xbon>t5n#isEK3@IW$r?L@~VUHhnS z{U^u*xT6(uvMYJs=Ew8KICgdN8!*;klzz2**DS;$$iGrry#nKCh;^yBKJ=X$<6iMY zDID8?rEshp);FK38`~4pC%;}`QE)(BS%*zAlHM9jcFbEdK^B&>$Hr*^+ z@1EMPwA#;?&vX5rsrigr%pjKbzTeg2cqJ- z=9HZ3^W74bJqM_l)HvCVf^h=jyp{Iu|M1Jd{`$+`B$UQQJ%R4U?xAJ%f&g4q(nztP zE0Rq4J-~>!Ya~BCdQ23JrQ=S(ebs-T`29@~W7_@-@ZlyHM9Yva5%JE@O1HnT+;40I z{QLqLS~@HuFN<wXQNso+{G~fpWCQ3=K-NuN6C4SP*Ghu|NX%(#o?~jooc;@MX@a?#Syg? zp#xF`ak2=GKoNy1uNga6Ck3Gq2^7)qErLFf{N%P#SI#4PUkc2NFslm83kPQ#!FZ5y zM2e0KAlm#zh>aG3NGzh)n+_IY&LKkhP2ew95yEdHgkQMO$5fU+h8dlH^b_})(vE2Q z7E#D5LT0a6$pd_hNIlp$9I_Nmt@E+a8f#m0Q ziJaroa|r}_3?j%e%EqCdlLv$*4;|e^*9pyXm8hd$8rYdU0>Bi<7olDk1Zn?H9&voC zdG7)jvWwDkklxcl#QIM1S%^R>K;A}N92ApO#@zY* z`vHM$IPR{(D|{9B3F)8+{KzqKjYUT{ z%G^#+S}-Q5Tpp;RRj4VfqI0#1Ofh92n{fKxMj8@8lAk1|Fnc*H5`K$7eN?v{C7aTa zJd&wsCwLKiCu|7n6RY@;waZD~E<|PDY}wz96wkgbIw;ZSeYs4p)OrcZ@L3#Q?EWv? zw5L~3(dsjOWa(=nf@As80ABz~V&8d{n2M{)jllav;oCxAVmN%Lqy=bO;pnw(Il@>t zTt45Z-oxgh+D;j8lJKtGHEt)afdAco+OPbUpd=zlot^mIKdDut-AYK`KjG4XB|%Ho z{;+9ngGTlqdX@ieeNtr{Z9FO5&yU8U{sEt<(!%~Ph~1-maseRu=q%R1_$`w`EsFMi z`$X6GL8$89@%hgRw!&cx1TCsRzY{+SjEcRuw*Vp^_mA#l5xakb5c#a%PWyJM6kj3W zbV%hig8kY%1u5L0KI$_jki94>y7Tfi?ef3b+a*V+UyA>``szl&oitd0?7jomDDRY^|y(C>WKX-!F;M#&^f{b7(ETZQ_tgLc4$u`Xm3;z1cAOHC0U&#z0 zJd*&}lPM1%dQsK4t#4x2wWZ9yTLDX@t3&4TF(ZL*S=dMOuxJc@9jHfuGybz=5CIpE z2+QqV4M+#&9z^ysc z*Ips%O`&u=ng~eHYe|*0$net1FpGz6jjE$5DJNWUHWpwsLl`7om zJW<#d(|*kU?eG8mU%&qAU%#rxEr>@lt#N_>lW-kP+4B#<9mIRclEL1e(fd1t=mIP} z+Yn{0oZKGZG(g-Evq~MO(^LAB$%dF9z5bdlulPgVeE?L+oS~MmPV$j!MTzPyv@cJU zr4N>s{c_T*5fjOlv%_(_!wTTAKOn3_$$7uAHPMUFLVITGL$SoayF`6bZ8>oq)&WmV z1^|mLabSoQ_eO9Ql#PTKE+X#TMBKZIxOX21MU8&+#KG^waOBM(L*>Ki+0`-OrQzEM$ z<6x6O%>@1w48a2C8|Ky!R3P9z!rFd>4+30mCs4il~ntBQQQhS^N-1@J%R36WJE_8PV{9 z?pVTN9qbOP2!Yq3BeaCTn>bkitd4*FJnVm`GxQy7dBwy(>0HN6gvOhQh+R}DT(LJ% zJ6Bk{jo5Z^{R@w5)w|;_R?)~<#dTgqSw2>lRhaUwB7a^5VKT+ChmaXMgoyMp>gI=F ze60y;)8p(@n7#@!!kdSqhV9|O&?V4;tJ=2*z~n*`$c=^L>P z4eBMjEs}Ae6Y|q@1?XoL4Utqy-$Zn~iAs7A1@v_)p!;{y`zk`NF`V6#(&H*btQSX$ zO*m4h3Z7sdo}jHFtx0%~B4E>t%(Y@<6i$hZ#bEz-gu=U@@1Sa5;}=S(I9m`ATL4IC zl2os8C$|HAtslChp82}<{Ot(nx~<(N@q1PkonZD=O`WugUuA3I!RO@+0sr&Vh@m~R z8>1RvM<+V9pAz~77y>xdLYc9){d^*3#(nW$uEslYXJ4x)q26!6Lx5Xb1c~J1k6Aph zt6Q4`^ms~IY3y5gX4Me3d4mu(5QNfLWGO z7T!k~yHP1W1Ec=Lh3TKa{Oymw{xkbATR^z6OFw2m%D0_gcRZioPZ!(nEm)2C zxFkFVUGeN4ZB5bdX7S<^r$7sXYcSn|qGR%se&n3Gw{KHs-E^O-(^Hm;=xXDZZZBv; z=ld~}L|C+UO@;CIVy6gc?GEI*sRRZk*1bWvdeDIX_F_140S;#daxu*Ei$eHY?iZ?k z_wxX)>n~2{5)^t8!|lo#a+&NJ-K1~7Q&}3m8x{NyAPH}YBH5_`+Klms#dnP!twA2Z z?%KD|rrGb&&h@LgfZ5;?Y=qn_50J*=t$qX5LCi}r?%=+i!Ym{$rG)iR9%V7_r#u+@ z>dknx&{t++*|oLvP&(dYq<-DvRqwcHJQ=%>#s>0bRtesM;L&38%TRvPWVrNS_-t4- z{CRqx&fQIpmlqe48da`-1B7;yN;jFtn>VvrI9xuny0m96vTFKzf1EoEIO-9h@=8!6 zxo#jg&`>v@vg-1l$SA7I%|5Y&e}Dw9>T~m;%ALy9ZT9cK{O!-b{>AS8@|RzJv+pxD zJVqAeV;Y@oM@%e?{MmISQ011nyoJSx2+V565FGPemz{KzM?zy)-)0G*Xe}%cqS~?y zJ~e1fIu^|CKI}jC;yri*F5WoWGKk^FJi6awjtf`%$PS2R7ulZH?Fvb5ikAn4gP;EZ+l#6iYD1tj*L{ydzggRM!xV{cJ$~t~E9wnY993+a( zj+mnefJ%`JGM!zRlA74Y6V31#_3mQ;t~Y^HS)8PUcSCMkqL9h?=a5P)sDVwN}uOjweM}<5OoXS2z{Y5n4 zkl2YX0Gb3QLrOc30hG$xd8j8W_3a|++q;mX+9klsBCOz{e$oNoFF2K-4lW5yy^ET2 zpmy^>?dDO%%wy!_5#Hs&>`#hUMTGkMP`oNa@oI_i_aPhVlt=>p{T4#5-51*w^}8-s zdS{y`A_uA|4}e7;#&>QhdJHl4V^qN%pPhbr9W8}*N?db{^W-P9J>*W1BflAB3`LMG!^iX|dS*E&B;g+E!XXHk3-~(^@b@b6hJ75YqAFfQCb12P_dLqu zi$P7K6vs#@ykNeG+#*pP_bIbph0)R~QqWa2U{WF-#C&BhDnsU{y_t5xuE zlcHA4EIr2(Y;OkDWm zS+?H~sGH*mcT;TAr)yU|`t7 zR((VN*~s%};ypis5Q)xNNeRD!%{e{?RqgA}UTKf684CAy*}Bsw;4I}s|UqZzT(j(?3)ow|=c6YzG zyT6vaa$$1p1-5y`*kN@4oWNe324p2$DiQa(m)c><6#OAh2d zpF|l3pHtqa47B?#m!gMdHE)NKeDvZte#j+n#00mq6lKVhC@hT53wF4dQnb6~A=J%$ z?N7b5U?<6--t2@@_NUk{$G%&CC6R%1`p2Q4pOvlkYhiHUL|O(@zOG{;YmV~ImBa7# zcCw^=xD4%dzoh?F=jk(ZJNauh4VROPrwx+QzclRw^iAhw{t{_ENysuaE_Q;+aB49! zEw`DZv=S)y?BXBU#RdGw1@2y;Ionujb+K&ICJJ2xiMRd~UbB=4JFO?&PfNP~eE=2| z?t>`I_Of(Dj-S?m8%0vLaX&D2El*NPcxr^lB7JI0CwZ2w5+^%f-1~o9vYr!E8H^#7Lb+~j z|H(Zbi2F>=O1v02vA7YpV*CP(|N7D$84)mfo;uI$^aJn%LtH6a8o*2SjShH3ITVQ&`gw&Nz63wfY%mZapE z&^SMZa~DAUDzcMpCcs>?27Ez;!y<#(}b!4gVsYS%=O_5qZrq4)$@dQkSE6jbFGrZ78GU5pX6GgiR1r z7l!Hr?b*k{F5D1`Xm=bU2g<_?x`=kiCc%IFJ1O-!1bQeC;dw-#dDwjBG0KuZ!jc|s z10oc>RwYBbO(aX3lq@+I=nz>`demJ!^DepyTMP4?=oxA|d7#NXNm}%Qe>O%|(GOWj z0h>68^k>nrJ1&BD+t9IFXaWmRXweW3nyaTsDfv^jBd6+h*$I2cS7ney}CqfJ%(#l5xRKm$Za;EDzi9ZFI|##>WT1I0UTR}L2SxWLV(zN zB9Y{TT3?76u0k4o6_`R#XesKkOs>Caf5_zDGYi)H2~v#m^T}+^f8Rg#b15+2>9oKpuJG zho9IR4i;HV^LZ3BRwzq`KkQ2&un}ljp7XtyR%4blvMIVcNlPz z(_H#5-3!=nc~KRD$t5HK|N8921GtN6(8vOGyfqLX#eQ`G<$jtU;<{RpawUhEYf>YN zJq8&J42WNVbC-jc2OweK$i z;9cthxxcHOu4Hyjf3PBX8D#BoQNIBL7S3QerS=)}D==?|5_Orky~P^q6x=PuNU!e} z>(=(-=hjsQt2uFRm3=U$I9hd!2^f0M*9U-mDg!cARiy%Qu716#8f7P+P3t1iZ|T@5 zHBp9wsg{sTZW&hL+;JYtZ?&r|Nx=yN7RW3gv2kwQHq26tNj)U;kf)828W!##S(*}b zTCMv!Y0D@*A=i-7O+Ys~5K zTIUDu0tMAgp2PIdL}#Ec`iDqe9N`!dW)a6dvK7qpOLJodAV4wioY&0_o*a% z#@4K?PL@}5Ukbui+G`~b!uq}3Wu+~h(nS4byz!{&5@qFZg)mYM^t5VPMas~B0S_j= zf=%PH`YfgPT?&asxK!q2QLQhVtCAa%7rH^~_1b+}Ey~z!^X+y8AS;i4(4uv7h|Hyk ze$Y159QUE-792`~w(kc>L*!wsMg>(p%eZ&t%hz%CO zKTRazJRC)e@PXY#dbH3LmR?Vg6Z{}GEh6YFLO;cY9gmwJ5^sW>5R771ze)X|P5f0v zm__Iirh`rNX|^e;@`Ncp=_V4FP2?Gy$a^9RErI}<4mQ!tIY!zPYzD_|tsWmzzP2x< zI^joK1aQj{T#+g*wBuEDbn>tt36_I1j}N~)aNa}8Q}a;L4%%uF$n+u#@kIdpiYT)e zAr6`nBa2)Airhrqg6%5!7b=wdI9MfOvg`7sXgADf@{m_bSSw+T@2Y{=H)a4iet|D@nL-ctz(dXGl=CTgy%XM^hHo;jw zMxL^WSmpuGI)>)X;&oC4V|g8I8qZ3OZjNi~K~NJe>He_)iOgCK1kiGQ%VT6LDd{Pq zcU43pSVYQI1oA8ljiD_Br#TPqLKvKQD`o&>K%2i8-`Q-6$Xj%<;uB5G4gZ4CoJXc& zF*TvhynmCjB$QKho>LODiQGj@gjDc9M!b9swaZAFS3#9pg+Re7aG_3H@U$jnA%|#) z976JXAAN^Vd`eB6btF35M58`#0vDDC9Bd&wtU@ev;Zv`J+OUuOW)mo|eM)PNOMa6F z=IfZ!8t>E`es^$)gZ*OjyNxDJ`2G4XZ{n9z<`fEEsAfiQXB(KXRbayMI9NqSR76Hp zMB1|rrJzMJXdz52ZJ)@0{2)2tdAFyCL})PwUL_i}8^Yv=um(QvgcF16Cn<7^QNBGj zc)iPM%3ed$$*DOuHrCna+*-0B7PalIpN$13PN%-xcWV{<=jr1% zpD-A{p89f;7A-{%$riDvt2iSL&k`3yVA$1_q z&%Z^}{j-ZEn-PNwp zDZk&bmcPeHuqH0~2=Jr@1T&V+$zGSBV;Ij!AE=k?BzclNfQNd*4t^-{!h=gujip@z z&x%NM{6RmSAMqMjEPz}4dvoWH2yc+aFTP)*F5el;Tgwr=I)l+Q#2U) zJ?7zglV1ANTShs$nQ=WNAR5dG>=#E!)`+Ns@_JCowjb1x!V`Pjjr@>3m%jR~#w4da z6E>33sEH%^S9EV6Tg+dX8hpqAwU_tlj;r7FsB>C6&m_}X-p89ok$20pZFJsyOT_PP zJuSVTJJ*r6POCg9REP@kt;^ifAe8RWZm*yAwS^}0ap#tOh|qzGI~J55h$hkbsT#=K zmLNTC5W(m;*XQ2G*6odAx!Bn-vMpU3M8$@%LH=f6Pjsb7N7P=t&aTZlw;eIyIe1yb|Zm8FW_3@NF$;L!S^4Dl6iCpZ8%pw3Dy_5Hk-tg5-R8+w3lqm)~@quU+K0ef%+6T+mdhH z4P;HjN&o3Z!%|W;kmX67v+wL(&>ni6k*Ym+mpc!LIgh;=X6lt(s{M51owh!C@+5Um zr@Ne5U^{(wuQSlh@&z}j~6!Eq$(MfvEQom`%c zEXUSvdu2CUaKyvD<;rVNGcJF;zQ-@iZoHSOgwK9z?`SNgiPSeTai%jxUu?3ZhrSV% zZhN+>Qe%h0ezN7UoCijVd?m8o+*Y3lQXkkT7VX$)wmEK&*{1LtPCWpO*ZBrhlxXuT zl1Rrm*ra}sQ&Ns8SxUv;q;GG5Z>r)4No5fRErO*TZJnPi?PJI$ZG*P5j*MuRU~vAO z^f;m5QbbgeGNNN7Lc2I9A|u*ISLhIw?uE!w1b=0h`b4lvc0ronMV}?Y+=P%TqL;J_ zgxofINvj~NtWzH4-KE{{5-QhW+Qg5FNV)>%7I|G5%5f0PmP6!F$7nQdg5;eCi)E8w zaL2_hC=UVBfVg@7a)@MS7YC{L75JedaOeasYT3Y0D5Bw4M4zt+r-LH2VvEJQX%#8o zDqw*@X-W;CBA{*-wU^w`mBq0xzgmjQcLbMBxOEi6)(Xxy0 zY$HXAG%C6W`w%MH2c$0OyLq%0Q;KwqUQZEFxJ>}xj>!VRF>%H34m`0+O_}X_zg?hl z3*$SFgQcUhxMgn=!^NG6ir;-_e+=|nm=<|Q=NS3bA-cGt`w{|93t~7BF_r?xZ~y4 z@tyRmMdW5hq-1Fj17#ZF+61!u{=YG=A7aQE$wR@P$rv>fDdu$Uhl0p(j7V4lq7V`f&_nzgM|XLNW2Eq#}9n{UjLdx}_r)pu?L-4i@E_*J?G{dHQTVEvopuJTD~- z@y|uCb=rHD!SV_gF6o2}n-Z zATVOl>?guCM73S^8!iQJT&^Dc5sX?%nn>maKJbL+=!}^)2U6ggYc`2E zk?HeUck4B9KXTY73<{#&XL+|z?gY>zoCcQ$($At!OJXFa)XlQP023u0Qw&bg@OnLm z9tOXV9UbU3%YQ2AdQIgGP>P`(XFZ+*Wt{;sWXO=0F z8{S*{w3HAzIwgqq)AD>DMSWr{qHb&R;tVN{E}A+@f97>Fj~fm^d%gh;I^*lsPvdhY zb96Kt-L>~=?y}qUQjI9!c2h%tZA6Shjkfub{Yj#?q>7^~R?p;$*Yb*csnWh=|JAk_ zerEqM^bZmLAp@$rmR%$kduco|ynSBgsr|4V(5}cCA%O4tj==_9FyNq;1N7K7Fo{~$zlSGOF)yll$;?N7h_ z^Dlq?HG{p!Bh^EF!bPH--I@&G;Mht@;HmGcT_;AFWrXu2PX;p68fUdrEr?)^$}TOp z=_d0Bw5X*HmWxmI(EZgC?OYio%{4mnAPQ@8avEron6UecWsl$XmY`J05v?Gdyw}qS z$YAMc-anLosQ+62kxWxHs&blex}bM9K5+lFgJ_6Bu|j4Ar0T#|h*qs<@JRlSN;up4 zYo$9-mv(m_YZ6YI-;eAUeb7&nlEHp!IizJ+A)mVsHq|z|XG>-nY^p<;y8d)`4ME-g zF+>m4PuuLaL9<%iUKbUxA|wxXaS#p^i}8eiCyyRnmq5Mh52ospD8Zd1q2e-z!c z{W?Dshkze$17o;~{@Nk>Ynzlix~@S;_eR4g=fcq3t7cZjJoetI^nXpcYr3(NDttu`+^k9lGKuF-m zA~22HP#9ZBbFK&|BcQ}RU$)x-H6G$%lMeQW$WViOW9PC3LIEYva+iEW_jHLq?xI=fw*vEHv@tx%A5E4*+u-`|QEJS~dL$uUlM5luy4noY>ea zxX&Y$PaVRA8>XJ&W-g5)tTQV(&HI)?j0q{B;put-=(CwuMV zJG=N!I@v)k%mdq&hmv(3E$Nj0t^(_r2iCDj$*%I%V!=5U(PJzk2i_zq*!~#GXpsdc zHHc#n!IXinH;kF0IEDaP;2&M(!Bs<2%W#!4R+manPajxaKM<-hUWa82%4v1hHj#qv zQp)MB94XHRAGZreS9t#Jx1k16gl6(8lG05|K^O64|D8?JUXJS%Wtvqe&#c1sCncf_ zOfpDe-bPGN%Bbb7LW42&9PR_!COG2`J?vr*?>gB@tZ&CpM8}u7W0Z zh@Ru3Jh6?Q<1ql3A+YA{$dv1bBhV_k*(o&*uMw#_M|QW3oNyb@6;+#6_|Bw*T{_tB zqc6Fz%#^Gy9ms`hwix(rl4ykkG*ec)4iSxYr2paU=m+~nv?98Yj>0_tK8G#hAR3hZ zqukTm7?FPPlUTNhy%mXJ=GK5oYC0IPDbHPcm51z`PD!4<>+;4w(%SFuZ_JX3m0y-f zfd;Y+cf46-E(tItw=Na?0+f~g_n-grmp}jVSC_J|gtx|jgDzqNkh4)${m%z; z2WR>6S+d)Wz#Bj7tHn!bTwLDYU_H^R!pCl^$N5V+??`5CxhHK*3w0+N1(qt*I4B_h zh8kRXQ{PhzvGG;@|Ec=3CC9B~YZ$!8Tl^RQWq*cwu)gV(l%=7RDIKNisH)o9+Axts z5CoVQg28zD_O;v{sm{pY-W-DjG5PW}FgWlbCy-X!lK+W15R;RXxkmQ1w&n^E+j2wx z$%_=8)02XAsj!#CTMBe5>{-d$EfzEmx#*@4#8=K1R#EEhX!#NuNNj=J>LI~OD3@xSV zvqoQ2ss{#1pF7kHs9xLi6S6}oD*Fxm&i#tQbbihZCtP`Y-c#Rpqs&czf>HkkzoMkN z%X-KDDEgY-7+q25z9CN%YPX&VhBLXNQcTS93e5&~<_H%(e2F6q>9OwEFC4)?r6}); zrdlt9yvz)n>h<=Nw|JHEsJ~GbcWY|(r5>P&JD+QM+by67ztrcwMzRZdhQn>Uz!xqU zh9{cq0~%+DM;_`M+$zu^MZJE3e>y~QQwP&L_DZFCdIUfH_B|woSbO1bMg`mM4oz>EE_~lEv4*BGet1@jv38ZseriYVI%PX?W%j%tY*%jVPZS{nHU& zWQQwKbAu7N#xe5{K}~4aCtZAG?62=qQ_~k@nb+n?!#(83z)tZUI=bbx-(-okNJ@X# z)I@l@xAW=Lv+{11T1vj49rvEi_4Y-bOU#K6vfr6GGd&uv{p)j$LN;J!)oCv^n6B^d zGl{P-sbrarMs9tddoYa2bVUj{ejvWXy4LI+nHciNUzq?-yPsy(A873mO*6m?QA*;U zfBfOY4?p||q}1WPml9bEVlejy1SX&F0TLJQMp@a=6n%649Z z(amxhz1N`bWx?HWfA=bTG=MsF2lg+5#gVT#5S>J6-E{+fa2RthUolpmx@o)qbe5NG z8hKA;Qphn8(z-CnaS|B^d6dOz5*z}k#8a*lZ%-ty&`R7;Ro%0Tqx_CdhSn*P3+W2vqn5(fg*1bhaLh{THVY>viFz^@8P<6eB@!_ zk=GEByIsm8^k%P5DBrX1856hv_WrI;GH>+SM@=1-aF(N$y&iC>99y%+_TWRaLQ!XM z5^JeNQAX`QKmPN3?cjP+{L_iG^#|0zq?1Is_I2I$gjKO^9jKGPHGI_zQLm?eD}*bi z2%+dr(0q+OPpCK=xRo(&d5bS*q=MmIR=`E!74cE+9$w#x)wb0!36*mTI&SFuv(WPe zLMQcyPD9X1k$L94TcEJWb@pfJm1F6GKj*uI9upQiRUs_DmCt6S;%T?mcFnBp)h4S| z)^5rgx*cceq!we?#$N5FHYqAMT+F?s&CCnsFh$Wy)+)@*Yj#eG!W*%N<#_7xMzPaz z59h_oi`>eJTuKsMO6WrC(Dl-xgN)|I=rNoJ-L^cu7>~&zK&+f)d&mtF_gx7+m=g?I zqknsow)6rwwsN*Oyvrl2VzuN=*@40uMbB1qGgn)4+=0Y<(6Qd%-`?65j9mQ>E^bpd z4;ZX~uy#`IAuCC!@!ruYK|e|68{8OMCVE2c@(Kyy>kQ*UIGDr0TP|Ky=(-qzvnoJNlsyI4L5tvjMMm z8}vj?&T6F!lM~%98_voX6)bLSrQYj>-Uln{yOqpbX2-8{Cog%|fFq`Nq8U59v9-7k zqr7*t1lJ2_$#gn@8BnV}rbtR!x$8lqF5eZpB~qg9vIJ>>4)41Ff#2ZJt@Rs8yg1XV z&+6GiqxAZw!?@XXI?~hrt7ytMf9ibnBAEzV7GJClP=f1tp&dQA-a=bw|dfFRQ&n!>_?V-b>61I=@s5#B= z?<`K=pbZ9Bms^_gbKQtVR-c}#L3xkpHFnJG?3O3jS!xzZj8!G19ND^=oLsitdzO@U zb*E%OBZZ|d;jZuR@+st@buaH5?a-awW=L1TtVP|`&f4p3M;ffKd(E~hRir2hpYUPf zY9Rw4mW8BTS*&}|$_p=Ov%*)Yo>=?IroOHeIilK=&+Jrq5PS|ZP&5mr+g%zf(&{QZ&DJ_+pEY-b3O<14%4mPH; z^1sh;s)3uV6p!N_npGeGsPIOr702PMmEU-h_jl`q5AMZ+8WDTpZGO`X^4?N_S{|6VDk zK5?6Romh>Xcs{NBIKWBfTU2Z6MI(yBGDct9g5oKZR1cZ_@0DR}#hxl8t=%5^!tnM} z?Cq!6Ed^tbHHck98@mlq>^&u`@xs9J#A+k^vS;e`R}~(v_N5CRUHPc2U=u1!t6Ofr5Wc0RqvD7=AII6<{AcfH8@jaK(1rl_pkEascE z()**d$Mn)NcgM-xNuimy@3i-s`Xut+Cnw1f2c?g&awhXeqEi7PL?c^6G;z{z>M~0f zg}GIRdVfmK!N}FPIw?x;oTfgB*+R{VyfhhRQF^a5a>j6Mv|!Y6adO*1qB(Sz(+$U__=mx;6IdNfuOuP{TGZpOyvt-O0`E}B|RRNjE}JTt2&4+nl%Y*x%SVr3?z5!-mu5$NKhOe`Rgh%K0fLXnS7zk!JoKWph$6zydrz*uGCG z8n69+N5MFv+sW9WO`ZEUIp^PzirW(Q-Ygk+hjq=&W}=)f4Wl(X!PLDhF!I|j^NoHt zu=#+J^LF3pGKUKnS=KyE}Jz!f6T;S4>V6rHbf#yMS4 zV@jPkYH``KA&U2jzdoNT&Df~zvm(JA?nW*QNHywGOqz*ZLhNg7;3Lu>Z>#G=2!6lg>ogj6I8*sQnui5#y#|M>ae7WCB^1K!^@;uTNKqlr6g)4N#j_Q0t&$XAe2CD<<)Ms$(W%Q#ru_}=m@QwL2I_mB0W)QmGyxTLmS$g()?)NI1n zXG15DA;F*?pU(^g-WLKwn8cwBSG1{5n(Yz6o>cZ@OkhA;R+fO&cu=NZrtK9m4n1mR z_yTF0wjN|7C0Q9UzyZFdXUBvx`QD^JMj0$iO={u!PLHH+k$o24AgW{ZWMNXe$Zn)T zYgUTLc4jYDPLm;A#V4}jypx?EaydFp=aav(^;h&`Z-*-o@);D+K+lzBVk@i0CDP`r zybPMHOW#uBdVNyaDjP1!YFW2&v+OsnjCZ&JertK;V8b=m0e_-zhf!+iVFPvjJGBXt zg896nkt!2J8JUxD{0my|Ed}%KE zLmy!MSgFY~{IE2ynBS%uZfP9jmyKF&*5+B3N>!d@Nq|5Jxd_v|h@}oM67*qn`ERB| z)lr`tD#k$pCUOUC!4AUCDIKq(=w^co8 z(YcrAi5n4lO7b^HqR9KS2Z!2&DT>m{cYUx`|D{V<3oi}}ugVMW`#Dw5@+d-=<{paN zgG_xC^{mRRO0T?&pF)js|Y%aDY1^m97M?4goM5xKVkuZx1`z z&;#ubF7uJ=%s@N-xN&RglOx%VlTtG-jIQkFHIWlZZQ=oUTIeTU=o?)*^N*T&37WY( zldPy3bzxpenSW}RjoT!$(!a>O;%5>DInb=xH4}ra*wm@ssV^R{p$rvpzI1U!Mjw{2 zPMod|s`TLv8@dZq%e#Jq0Pb4un-n-PB6Zyc^fAu;c7Cxch`nhYJGM|bwh%d_ zkUEkOTV!?R69pm^CsBzokp!>7OZ!fZhkbOW56h>}#lDG6iqZo-4nlV9lgOLag-_fO zmvBLJfDF;!L59S$Jwm5(myRTqp5)YZ{=P}g2{;k|0Lg)(}& z%Lgns@CXo0eG)qtJG6`&G^mgSQz!!2{G&0tbEYfQ=$E|4?-Y4?XdE)OY>_uiMyd;|<(sgxp5x zEI&~Qptao2JI=UN4@}kKKEW6TE~b|{*q}b%9PooVu=uYJ!`XON!jJL5jkrbbK% zihc-4&oHip<1Uh%i6Ce@8$rp05a0m=IWff2R274OO-6YUqa!W#7hHeUWOc3UrV7JA zig!)t-W$-V=SRmxZzdP^;LO6ax5rOF>ZX+5YTpAZ-fJySY~sA@w=Gy|`J$yh(tz)( z3J}~p1@~QEiu`Q&opKUGVEj@yGThL-{{8g^}>cN;D>33 zH?Xdk+5nZMIo1zw!KFN(0?0n`8uNf3!VNXutw3l9K(uCSyuC6OW$K$<))kEt4?chR z^8JTDg4=Vw&mK9S8qwz=VqV9A|!SZI}BWaWbF zUTuPFwF!Q9{Uf-XMus9@)P(BN57P)->w;|&Vdtzz<-@nn8ANaS9&3OR=aJIp@q|}9 z&pjT6R{Qkmhu}wzR6O@X(@tpF*W951kpT9<)Jl2^LzH`B9C#G`V@JHGnhTTbeM&N5 z4-3W8yME@3?uG_O`Y~)Zww0t7|bCO*O&SnWSeBI$mtTciIMDHv12z>|W zR0j0f*?)hBDb{vFY&*H%fKEE#joppDxgG3|S?YE@6e0A_LNFw{!(A`mX{W9E`pS3| ztQkL${S6lQnY6{WrGu-hG-(S4T%{XM53 zgI{KaWblX%y?pph(_{(DfHjE??> zkdUgJoi?!-}0zb-&=>em`P1o_}KEdWr^%Z`I{n0HZ9ecxoK zE5jXGpWGxPgjmWR0(%(J18}L?FZIY^9ZIa}k|&cFP+@>f$li25*yR@`l`Es1DVYtl z-E!Hsft)NbRvsLJysD6JDFq;mjgwpo+%!nCqR8Z0l4azC8|g6d&aLvsl`gKQoTk=J zY@%30>BxefjV4~UC5L;HM{;Oji#i)yiRmu2MhvJNeTdu-`G6rj1e4BQ9&h63oU!Wz zW6$p}a(Lm!$UZ3!hve8N?vVTqeJDH@Gcxp{@Z6Xx^%(oe=mOucg@ZS6Xu2au8+>wz zy9>?GR5!5PpOZNrp`J;x`#>4jTr)J4dmbIv-Gw=^NqN{Ym#zsX?;tHbw1!ZJzqA*5 zKrb{P)7tf^e@Cgj&&-lD)sZ<?*uzQ*gET6qvL|lx965vC({GH_ zK>IT%Cqxd6ME>LmD2!_;Vz+dPed_?Iq476{?0Cr*d($_<5hlQgpc*_Y@aq(Z*cj?+ z=Uh6Mp>Vjvbljd63w8r8fM>)-lBb!I86uaAr;c$PaW)5;AvLh$ATJc9OS?0l9OQ-2 z$qPPFh$Qn#>aSz3ocrf-!@S7hICVcWxp$>Fh&rD+6T+zrj@y|{8psUt)?$mmsofkc zc0cLESlVyF5_T!BktaffQmP|B)UBqK$Y8yC_k@Z(MmBPfy~s&9#+g4ta(q&FYADUn zWNZ5-C;w(y?a+t@ik5y$=4NRO50x`;ix5>XL=H0FP?0dSIay&&d`O%(A2|bplT7c( zEKOAT5%%F_ZB}}H#Q4z2ne^3Rj+Xf(G$`boCtBp(`UChd;zQ;@2leBn%E(K{GwcKV zR$>f$2Q5f)@KV=Z7DC?)Lbo>$-9aIAYFX%p=b^9j%6}+wXEKC_QB*!5M&T8=V}FKG zkUgK~u`wH}BUv*aoCg{&_n4VqKPZJ6Q{x- z{04bUSQN&0*MBojr-OHt@=@?!zpZU2!&hyvzDqSHr}IyAB7?Uge);LLC;tr|^Y{v_ zHqMdO;4i7ghWZw%W7(|-e*q*`;1N(xcY};_ekdoNul;?6bi29q@(YxrtH(gf+{=rc zg9h7kA7DN9K(|)TWTigba2C1IrHm}vKY#uaj=Gzi0YjAvb218LWzy|eq7KmhZD4b* z9NIZRcMiH%T9^&wNz}sw=m2fX)TL}zdouWmZ8bUZ@}P++rSJff$`f337NCGCP*1K> z1D-h6QhxGm@QIio#U*61ya(%WgE88Ash^`dnZf?LuOC1JAm1K0c~C0_bb|pMyZUt? zTLJ8OwXj};MgM8$Pb9;6mv;fgM&9ot)$e5^%utVLS1wHp`RG#LNJ0SJ;BBQq|91jG z2q^{U;6{70jy!{j8u0lh|AYJRHuTDXkAmM3@UxH!zs->h@~uAs8GsgY@8#@%Q6pU@ z{3v7~r9VBgQI5(QbUCT~7iHH5iU1IV;T`cm^&O$5fLMb0dK+G*VA?w<`KNhH;kqRS z{A;bQX2H~-VPhr>2<%-3n?fS+S=P~&j%M1W0C`@S3i1JFD8^aV$kzk*0dh^{hvsJZ zPHwX94j?2Tc18Xm@=b40XoF2Zk2MG${po4!1U#``tzNvrCGAPr0Kb@AX@SPJD_Qt7 z(7x0tipOV%%6@NA&dEEY3LF3g*b4J?zXvAP8X-Cd_Z|}QiB$ZJ2;9hZf|P3($5-4g2hH<#|pbUVDKqoU)+lWE! z&vZ7EWy?5Jk`$Kdskp!mBJc5zUn%?F!B41(-CX2L1-bhCyn!?_w1HG$@?VBqBgOqr z(!qica-O&6j2awZB^goYm&?ob7M#_^`P{U(g+|yt0h)8&kMeqOM8ie9>^G$(^kg!? z8%@gcSmRRh&73Haz|uHD$O2#h&S7eyUBgRzWB}6X(n^*2H8`Cw@P<3l((5dvl>755 zAp&|kOUb&QFF{Xrc&7oW)PQ3^Qj~miuqO%#3F6i(9P41J){JE9%Wj}&b}F}g<`cnO zd+Xb6c$EoM3ye_>I^CSQ`V4%heX=?K7PN1tcDgp*={;z7Ci%29ECf;@JA!3U`~a+e zDNJXu6_%&Dt_AJXkJ}R@1cE5-WdJ`xHpLV3RyWwf!E>AGvaKbt%5rQq`AOC{cty6r zpC1r{Zv$^#>hUsje8F%-Vp&@^Gwb`EEH7~WJI1g=A^=ptzyXqt8rr0juz*{EnbL3# zn<^*@YrDf{uNgq&d0=FeT61YySwDyoL>wp^s3$0mXu$@O!q#te_lD0~y)+aKKo`)| zH8W@Ob(`}Ta7LD7X&)`Lq>MO@RY- z2)IE11!{;mIl1gFk%=)gf}z(M7cqI8YHF-e@y;NIZ$d$XQU;*Pk9+Yy-- zJ#}-qLzM36uqHt_T0>F#q;P&iWV8l_5h@23tkdlL@YofYHc4HT5IWRwU=FcQ6mw8H zdg&O1sgd1SOEC!5Em#xYGf&JIE^&eSp<8fwaeM~P|1@1fY*>N93MK(?ORU&~Kx4NQ zGBiMy=<4-W&@ax;7Gv*unG}JK$W(}sv2ZcvdTbMg4KmZQ>ox6#D~M1=u4PXhMliG> zcSs<2%eW(}37mz@&EYB+wHKAU#CaC3avltkNL;6%n6lIe5-xmKUPS75#rm9>u0&=L z7d!L82@i@M6n={-BVvEK*jJI*&Sqn`;<5=n=VBAWmx)gzm&PA>f`>*`hgu?X;zZ&a z`N%Pb*ps0WSHu%%V2|3()Q`}p$|s6E9DsvD5@tl`bRnfz=v|3E!z#b8OeBe_tims# zht%_RT_LY%L*^*2PK%3OhwxZa}jiOVe1%r5$ynVsq_%+#&)D!Vihh>GVau=mEc zS7`=X91M-nG#Dzh&@Dlc3BAQIgd#ks8umwX=O(xbMC7XH$Sb$VwLg*DLKp;*xIsJ7 z31A6`R)`#Ks2pV|4P_`wC2W*V*dUX`K+8C%M=p-Q?mCZ z#9*?a$ju>CpRa!F**8b_)F>C8fRz(n2vuN#4I3~;9L3Dzbzns{9TiKI&YdU}N-)k% z?0+h@iWz(h8oP(NTC?Z=#MJLUXclqIfM8$_mBR;zlX_$mG9^l7QYflm4-5U<_x$kC zsczx-G(WUBtZzxcha+8Pj&#a$FdKl(-3Xi}WCVy~ z61kMZ$qnj1mpk&1IVh3&EhdUckEgpJ#6zP)CkBO{iXJ*J7W(QOdL(-2hKr$xx`m!y z5qi{g=)9uP4+F-HNPXgd>}72Bbd^sIwFVYK*8b4I__aI)p!^a(B4L}&QgrkU~Ue@{n zasLDh;Ro8iFsg&7KMGz?*XDT&Uh7pVizkqc^DG4eyt(%#*dEAvy$4cAUnBWU+w!c> z=(kGMPU^IrXx{DsJEoQv05>qVAvl*^z;@|bnaS9qm{AmimlO|ZLKi0WbA#RaQ~uU1 z0^y=T^69$KvyE~DTC(>i<_6m&Sm)OPd zkFkEzQ{W0|`g$$r1(sK!VO-?0N2Mtz?GSv(yJzsN6zMy2yEYiwX?YBfc9aVYJPz2G zUu!5Yf4jTee#IE zMj9HH1YeJT09zjGTi>;mdECbvxEcgnrWOj1+rX4$I3!{iWH*kCu`?LZ_sdeRv>RZ3 zO29;l_&X{q$~f-mYimFm^c?V7M_aXr;lM^8?rC1=0?#&W=!$>*GN0{EB2RVc816jzRSbn3tPc z?Mo$0tNBgkBO93Zt3ov3KrqD&|e`Q_qF?wyH z;3w?bF2P00W9a$eq=2{x3{xlTFD6(Y&hs5Ta$q+n&;-sD{*dg^jX(tFtzDKv;0qc-kbDH1Ub3#x@?*0dMck*UV z{R9xBfA)0CcQ(hy8PSv;6tpOS@B_aAxmZikPe@5bAT>JwaA@z_z3%2ktr%ixP2|4} zU9Sn$NOkW3>H++j&u2}XmdRO$m+Q;;9(0$N>GioiU*z+5P-qRC!#fyiXmvW-;%4AG zOn~oX*>(-k9?;L|q%X^S-eq#5tNjj41+YEB zW3e0egG3LgLt6Pu;|%}4X(Ci1TlhGix*abKo?Rmc4Dvn3@d0<2X4%#M(#ajccfbAi z>EjzNtE!?I#JAWV zInR-wpo;MmlqF0bfZV*wPBF-fya@6v&w@+}zEJ%ivN%c$2DcHSanHci9Ree_fH(vw zk)txHqcTqUQ0PVL1_N6XXL`7*L{XRA!4|7$osS>80haMP4#S7Sg(9(g>?iK*SNJ4# zhDPGf4~gkRs@R1hxeG;NM_FP=SrU(KbA^an{F$v>?*93%N;bIV(2PXx^{1KWZpTy3kh#jwRpaQF1=>7k%@dIE(mf%+=VAxj)p^Jk<;TQ&?3-7vD zPP%tOQsjnhk*}SRvyLK>oGaiAEq zg80U_P{bmqki-cLvi_EZyXCuW{%&?0qygu)XpAxX_kUqvP5fl)XU zBJ;a4zbo~Li4QW6PST<@=p$8aM(W-asnZU$Tb(&$qHa}vMN$74Au0AQ9jiES7;lh;M@5-E(VKHis4u+Kz z1Dx}xj19G}Fz*RJB!r%eVGfAS*r?pYqB!Iwxp`QSpW!9BOAl=lx+h}cMir&AIwB); z0K0H*6UZD2xfBPrLxG#zv6#$nabHCTR9yNMx^t}2JzQ*39_ES1Br+yQksA{P@6Huo zp&wQZvvKgI@DzdK2)HYKQaFF)uv|<%?>up5jL_99xvN(km{GQfAx5b`%L#m;2fT!C z>S9Ea1COa3kMR(^Z(bRZ=LSR$x|ALu5INT3PKn=A>^#>_ag;bRLkx&kQZh$^_jg2| z1^@kTS%!twwlKkf&q5zOCn@ylk+?l?YLjSQi737?ff>XDeZAlT-~a$h2jFBLud|#B zBf9)D?a;DF#rS%fn(J+Z%fFo5!tYSdNLK(SD1kTl`GfW^=Zt8Kj}RtqmxYPUz)7eR zfglC-zy`xX^qA3On+8(8H#yUz``T7t=AIem8#N&N)WLHb*a=N5psOJjM2#+BHy|UO z>epFn>G_oo7KjTNQDy)ZxhV%kF13@pO63nq1DpuvtBO*V`kjvd%&)u9j~+4S9jPL~ zVEVTw-%$U?|G^iOHBg^Wz9J9PUNmekX4)(Q3<0C$Mx><%qvaLo3fS3jR~&FDuY(ic zKY#kb{5u*2{IQSyfB*a6V3}z$Pdmg{Dp`P&K)x{5N<87sI8&E(027>VFE7(O!v*9+ zbuu)~U^*6A!&s0-!Tl+P1B{si)|MajE-`hK#4LZ;f0(jq|gEOQV#$GXkaW?1`_z@3qNThIa~8 zRL%;W45mFKG&R0P`Euulbd-99v|fP}SlLd{h)6vtWhWq%&jaNiQntU$4F)(CO#Q9b zr-73KG(`O~YGNv&-Q1oUA$Qx?p`}R%Gu!F$h$uEywY1L`{u+%eQcZA2+`&Xq%Pd7P zfD|cW+V}nnq(urq7;3;sK+3c4KmPFX3m}z^SjyXQ8(=1*v3)%VF3U2^8#F7+4Pp>D zZEU7&p-<)?177z+K;@>eimbxF$_O@#luZjrEuidMECPHb z2Ms_V$bzKB5j}UcjYJS6b^zCageg>P*Z#WJa$0ol8Ep14BU|%j?we6|A)4?`yktX^ zfh_MvhO5d`0H4gk@LEsUtP$qN#PRjp6mF98*ISHb zoc(pW=TpH=6w%3pG$KMSD-1BfAnAr}n~|&_t3%NB*qsncX@Q_H(&UHw3LA`e0nQbC z|Jz@H9uSiNycwAmgeF=*5O>OHuH2`z<8G#ySUXycooR<#GlLr=SLRhUHVp(c8 z8pceV$esN=cwrG(Gp{`|8eo(um#|U={L&NgZb3<5n!*fPn8qqleDh>>A*d;UW@>!- zve1!DztcVw`wxIJGZtI34Duh?%o_}78iInL*U%4Smj4)G-!$U(rhy~K%zYuPL7u9> zsoxIthF&1^S)O*GqO9ph1WKw2$PE9@rv~ISvcq83p}a{rjmSGiAEl`~;E(m2<|nM( z>E$~9KV?z_rXdOiN04cg-R&LYWu9b@_JQ#YGIR^9Id34%AT}hBwSm+b1l0rxnSjhj zKEHfvFvu%do5yL87qWC~*_F!EGWnXa zP=5lXHz36!P%pbQlj0;LL{lbZkQ8wVq0X&76SE7YE?+sJm#S4ke-EO~%j3m6ns6<{MO=Z=xS{2zBO-l5P}L z3J)-dBAi0A8a3TpMLMO6a&(d&R-yWg*ij>`NDU-9TttkO|l7D5b^%8f|6pf|-&Xr`)JAC-yrG1B?8fM*fv~*h%aNX6#-J zu~*BMEpdcQ@UBE-AMNw{mJoY=3_yzJqyD9Z{s%)}2^E)eijCfqE9J(p!q7pB%Ud&l zJyXOJ)sZ`vBrf48+A1p54o(T@VZ^=Thr+{ z2}T7wsf&6Hy2qw#=n3Vxl#VQ!4TzVtk<$>A5JOzZ-&y7?7KN4Eom34- z5~aQv_an^`{JPgvecT4QKL+%6KeeGc^P@N~$O!Wri_` zNfbJ;l)7075vH=pU5`^akH(-UjeAsclZ-EEoWIC73F1$chd)xDb0g9(lgsI)y8@J# zdDApzdZL(A`AyXGH`kL;{Z8foyBePy=B6Gcsk9pV5H8>V5Ovs_Y8ZxLp^?&s{GbBZ zNwFgnl|{a+q65Kls*@AaI0-#gQk6bcX;hrtls>sDeU5m@gOPLSdfa~R_cZj)C-iIGS}I z)Xc;{uiTcd@pMw-=_taJISQnxr{zQzCi+nhPVSS~xihv9Ja*JrFog?xN*DB0J}F$; z6FM^EEEpm)+~#thWX_9;sP!TJD|9NOnU^MRFp@gwC3JC5MOBZSM+2l`lm#LO-rw5S z*Y@o_`0u~J|KIOEe}c9L2BlBdOI;oOoBxpG2$~ZtF6W1wK_aOUAk9E4{zuP~Q(!gg z18!^q$P~z8Y&42-L!8+w%o=K#m#%u^_6kzV{=VOyw})Dp2K%MiUoOqpU~lrFsSthv zfC8~?*9e{?Uw1lkyGCD-1atfg*85nqgU%#JkY1jz^#HQV*uxl4M;Tfa6^TlIBHEIuuc%B&hneK8 zn#qFeBxNX_Mj=2UBGjoH$$(4L$zKMN`q#_wJ`H5X(9`toiFP?69-s2izJ-ZNy{qlz z3I{@hH?TG(IR*$*-QW~_*;iTCV?+?=9h{dzD&HAqBlnr`j2ZYXYD~ER1(9kW+NniF zB!7JP{Nu+zzCbPXPGi#>eM(z6X(*5rW9%Pa0q3Ax|GL);o{7Xr3V&EHgW=M`tyF4) zdFW(vC9y)*VmOarZMwtSLtRJY!em9KYkxi|VuKvX9$cKeelrlCZM_b_Y$nJ|?s9rg z%M%zstfa#zSw(6aIGRqJkXAom0m;m-!>L|wG67CAk5m)A&D0c`56K!#m(w!6T!7<{ zbVC3KX_WjnHoBj}T4Y!6+8aG<6q{is2R00UFoD45Hou^C&*%ia(6BO<^9D)TZ5TBR z@>aihL{*+@!YPvmw{8QW7mAwdMO{Ufa}DRydYS;`Oy?QT8^&hFjb|oHjQeZcBYi|o zP;0_7&v}nIi6}Sf#~x@*(>#$xDR1eD$qm8}D30por3c+*S@ChNYd?WBca^n*;U4fs z9qS!JrtANC>5%XNMhHw&A5vgLg7hxmz_osnjqMjTV0h_alKD#wUkr`-z&gQ@k0ls@ zE=W~4fW}iZl2Vo@M)_t3ylo(ZI)gfitJh!=R%HqeRYhSYoD#`mDmKcOi76 zmMK7QQ2(CisqS!ld?7n#z&qa&CxWFR-_%RZhs*0D!2p^y&=w&Mh*4E$d!y@}=WLfq=SNdiK z$q$yQG+pha!iO-4Sj+YVK?Nk2VVwYI!P$9^RJJ55X{$yj+cE>m{{d(i=`CmVJvp_q z?x@4+MV=&INc$di^1eP_EN5pH%AE!(K;tOm#5GwJ39L18IKVF^_+W5U zk#)Y=Wi@FQ@=uy&$7gKRZ50tukVTQv0!)X3sd}WJ%8dAzMvhJkt~D(cR3lm~Kyn7i zsA^#A4URQXLJen{rO4rHqFk=w?vd##cvw$JsPC`zblnJ!fp-ICSp&Y-NcmK~AX0^{ zDl>dsSDLww=#~K7Vem?eV|k6^!vH1KglJid=_C`UZ$Z_A465&68NMR_k922f zvSd!L;M>57K~A_ebVbUQA}-<}+s;k?yi7rMS^rgJ*Zcfuki|(H$oV-`%kqm;b-5l# zdBF=HHi^rm+|pG+n&fXF4N(?UoP=o9@>T1i#B(x?gQIYa=Ch=Z!6bi&XZ)5T=fuI9 z)NvX&WjX9#m8xTqLFud!uSO|#%H7d5cDyAsh0`~pPUbEvnVYL5HYp099N-2UCyJWZ zxFZlS6}>s}C&rGk98iijgLOinMD7V4b@5=B@~}%$k&eV`oI>>^)ZVIkIsnP=h6s0N7!fN7O_WAOyXEgtPoA^ydD~=6necl zuKNRX=K`s)4ym9=IH;__vVbqWz9 zWSlgW`X_Ubi^v@|4b4%*Srs!GC{sFYV=wO;jmeuT#ZX#>!iV~I8>??kZ1x)JsG@|S#2*?ntR__3T3@kZmtjRbU?@aWs_%+& zg$@B!NlzA8-`spwDMYzXGDm7Me@5!Jq)rJ+{4TPiLOIupR85t;no3h^)VjqWAJ8@` zCkK`8Q5!o;h<8z3=4RxPyMV!^R_$KQeK-uUHHRL2Q>6w670w<~$(B)E+&V0D|D(`d zoOPm!s)mh}IMT?FZSU`22NQKs!sVP5? zeM`S7jUuEI`zU$RJzwM$J#?FBi&ZTh9EzO~lo|a;MO;Q#%5Cj1?N;TJBWN{t*OY2XF6IYAewOfVrfDRYi%9UEN5rT??5Ok!n9tO9$d)5{{ zVN{OZ;gAMErh_1)397bqe05fWkm6A>(5?^(Ia2z)OC2jGitlnd89Zy)VlH{W zsLux+11YdV^AUY+5KJBeA|+NN;hcN5kh#m5d+@6N0#K<*r+!5RydoJ#P8M+nzmHH& zfgAMH?3-nHh4l+6Nv5X~N7>|$KFJrNmI}fIxjdclJQ+Y6lEMTy5~LpyB2{4`fb-A= zmp~piKXZjKjGWQ3T})g_YOfvT{Yrp?CLQb7T`H~M%kLll_~(BJE7ep~0b)80yduT< z2(*atIV0dJc|5aKfe1A_-D>+0ZCx3`1Ym2NY@nVDAY}r{lAxK)2>Q=*A2dxB9=G-Q z%HRs~s)bqY#%gt$cZS)h4Fgy`_;q@ZOopkYYU+H}>>CX!k*W*UlTr(>H4JR!^FmU^ zT!ueB{y;(y>OCMw?;uAh#}6;sVj{zRD2UpEvHvG z%a`l;QSnr-{umkLzH=m4bYK0=?o}6$9W%CU`0DB zel@0%4=xoY>dg@`I8Z)OW%etU!W}n*I5c8q8L6Gx0H*>;T4vhV%0fZFj#Th?DJcPA zSOWMDmknUE;JPWz;5x5Z^RDwqLc?|JWwm|_u2^HF(giK3z63PuiGpAL_4()D{s>-n z*?CCC&PnhxKVecVpR#*`DOAHhId}mq5xmr}sv=Ja0kf^#MeGTm6(TEQxmdf_Ef{2F z+*C;wT;LA_>C}XG4kQQo_yyY>`8}Wo%5dLnnBR^wZj=wOZ^3yV#_cIX|H|NvFWVgEI0Rv3 zfJg^p2eY6b>jnxKP~-{c!2F0DEj3Jz+j(E; zeyd=gTKI(6oiqeX`>-kL`N2)R}OJ^ShO)NtN< zoH3C@ExmiOC&1XB*5Es+{D?%=U}8N0Kh3v+UOljcVqEV`|6cwv836|ZdV0{iryi&X zL(0(n)CtvF15rGr`$Aj>=jl~GB2cNC5x-|(MNMDt6#F%@o%aa&m5pZr$7pG>WBE=I zC~%JG6jXOt=)I6K^gPR({NQH4TRlRwxFH!>V}p2qJ_qBIlO;84p=@Y zJ$^}gt!2UXw`Wi#`1wXUO2IJ-gCdvnvm%X1KC(36+OmM_Ad9jXkwax#f>$K7RCc|S zeAYBB;1QXmdG_}9MwBW`D`yqSSu}d#>e!?Bi&2SkYQq%1ifo9Cb7TUs$j(p`_hK-H zkrRv5F1Ru}5{nn(7o|SoLo>y(Qhy+71W3%v+y!Rj8->anGAUB!maHX9Hj5)l6uL@v zh&_skP*$$dM7e`h#`Gzjeo|Ul5qo+?>>2{N1mkZMii#EP_Nt7F*y{wF6pmaeX~-e0 z#BVX)RIWd6FP!=0FcVH)q2_utXN6C4N3c@A#ZbT00kR}1RDYIu7_r9_e{=asj8mk3J((E+ z6ZkTbn#L5{LQAYI9>)jQ2n!=tb7WQQWbO)FI@c)lykeKIspU_00ArP#`RE;ydH~0& zWwXBsqC@O%Ren)aZFODA33Lpia9Qj=vSlK z8qB5sz@C8QDz?G_t;%sMg}4l5C{+SfI#^J8WNqo_k%PODJ7-5loE6_7sKo7n4SCAk z`j;f5M6W0Mu*4}xhQ;JA%Jbx|$R#v}Ivso?$DtH#%KR~r@{d#m=b)DRWLrQI1Ca{4 z{3mA#gV}{@C7L>IqJ%^Qux8#idIBajlF^A`d=-@~o)vE0YYf zOzn9LD08+Q*+*{JW7i$H;(PbZuSmBB1GYRfNvTGuKf*p(oWQYDMQ(7QH_+>F3RVx{ zG~=zzl%1XnCEb*1SE49R@s_?n4v?62bvt(<6X|B zSh16jREK749hZZeyKv&LQ{pg_>d?wVj;0f18!5@iB8E!CJ&kr0JMG9P%vE+jB3Fop z9+0Q_RF&F9VJNetDJV)bpek{OlEx${sst3@aHr5ymlKDZGM}Vw9(2%@JcpU!Qe-(u z9!D0sSXe#MT`|dk*a-*iV<&muK^? ztShppkX|gMDAJ$Wi$*>{1hQRE*X}$kY=+=yP#y|IJ}uM6Wa%DG&luHZ86vy-M(N9+ zAO7>JRO(yJTk9JjlJz0W@QFbx<_F|<@eEc~qM;)pD_EzUU)2{7wU{e4!x3h^s^|4Oylqdw6)RG5 zFr067q|_{`@xV)wU&MNVsU^GSFCYK?p8&M9fnLz~HeN8)_sei&BsHw6A^+Om0m^Mm zje5;aIJ^m#tLotP?h>F=0K8?B3` z8sHpAJos9czI%XLg2X8@%ofCqgJ35UM5sWhcV~FgQr{wYQ!MrMDyvHHM@^4p2jqyz zsTcTtm&LWpKy#-1GH>%rMc+x*3@G)e?L&z5-1ZdmK}Q$?e1wQ^1NKC6n7jd<(Dn#O z&3(At4Y)hYf3=!E(_pQZ-o-iqv**H@?Gw+-J52P%= z4?W_fp4fV&u9W%*WhRLsWI^$BmHCtv4?u7#%@b*usz(62e;cRLHxMMTB2qh1fzP-Xe?l6XcI? zW?+3)=j!3Ej!T2e`_!wN$f1Qgxdg}<|fuVJtI~nDh zk<0VQ^$IqFeG}}r@r20K$6=WyvWjR_$#cimpwSIcL@0ww9U`RYf=_j2WlE8gk=%rO`aI!Xet4$TM!J-mzURV z+P*3_2=QP)oiFfd0(`MR>o?Xga6ifCM{@!gATzRLAAX5~fBffforBZ36LCAiaT^C8gmuG}sfRE&IMs~CI*}JN2LGr>vytn1{(-$4);j=0Af%xi1;h}D;5;#9 zYlm643?v(FJa)<|+s%#Y2jMgg;@Q_-9hl_U)%FJb4W0rnlktf|Q9FWDN9*m&PWBne zXCrn{-^;pFpGiO?Q#61%`~vRSGBop!v4^|4OzyHhjt2UTq@0b|Mu7^-!4mK!@IKPV z_7)%?1b6a2zgvb)PAJsGiQ2%&2sr1vc~#vYG=WGEXA`Z_C^F~;HLEL470M%H3>Y5h zlMo6HIG!{YszSf(sbOq-h)mD4bD{w^WXGhEF)e&T>!bl&_MsBO9q1#^s+zjd6E1l$ zWTP1CecWWkPH|r;Cp_zs2(f%*nVqnwu4Nko{0_v9c1@(4fun{=0oECKf>;)?=RPpM z`2s%Mc!D~(HgoRXa>wi7!-(Y|FCuG3EPpbp<2tF+It!{iN%AVFQX@7QYb?$ zQ%`P-$#yKm&^-5#qLPni@|o)akHqoRGrvlQ_K4RN8bw~H#II1t?!xbl59OZ%e~}}C z1|8=8+x6}-<)K@9dxlt1x((HV_Qg(Yi##DLaT_Y$LI#!RLC0>?qeM0JmP(Y`W)inl z@l#K7jvdZW2(KvIPAYPRARiN{rZ76LyGSrpNH0^ZV5vi7aGo;NO2_K()^Z2KesBXG#RY&uyewCQA{+?34c!9f%@=Ua@e6hbW&&xp59Y)59JFL7(g#$wCc)4MMg=2!A zimr?}Q!|G4eMO&kw585Lq*;!E?j;Z*2J>om297@?+uSzMSUssl84Z|(y@1Rm*xPjl<$bI7DBtlT#? zTV@l56Jy0WbH$}Rk&k)np02LmSDE^D8%fKN596`vT^=^3;bU%?6&t=-c#hb&32ANa zoux{~TwzAi`!WTiJaaGdET_mhI5f#BUF8@$0gh-RxrM2^W~+xjWQ&SKrlomg9Vugp zVvGtk0aqgX@e5!%q-l|MkABS))qu@n&B6y zVevPmVrX&gsgdgxdyL}BEVV3>tTb+&QtA%rV(IZ@MQE5{uEFdIB^u5e;S1NJaYWay zuQt{W4aPQ6*}IQCIL5QF@BBJMjazrZ-iux*jBoK zd13(Mfif1Ufs5ZTMNY!MVTvklEQ|wZc%ph|8Bfg{T3kAzONea}8P|>UHUDI8x2Th% zGG8o}M&<@i`a?6vAeC-zlgNp32Rs?Mx4Gh!?vdqA=T+#@YCb7E>b-LBbA>MxXUiF3 zFmsUCTL$W*Rg}h`t2~EIkxKIrOWn`i!!AOP05sa1`e;>$&$*kKD4eN6L;oPi!SE8F z!LwPK>7@-6Q;B4}Jo-!UpbhI|UdFE7@9O>~6~d*skbzC+z1V5Wwg;8WltFJ$$u0?ubBFTr-3Sb-2=9o=7I5<`{Lo-bWyy@Lszlczs1yP}xT`&CIFw!J{k&dStRgH4(Mt3bn}}lGKw0c*6$70q zYVI$vsgb{k>?y?G^(@(7A_hDX(5Mnpa7%yRC`!Fw298oRgF*GBzOBHzSJ;5dB?NbP zpLK)MZ;_>YYh`E{K)=k-b2Gq0>=jFHfz3RSPL{LF%k$-o(7HkIM3qJ&BKbZ`zxIGJ zr#V1a6AJ#NKi6aMM=!-@3ww6NmC>wS{yyl21KEf2mpAeYk*D(YQLpcBvgvssUhseY z&xilUkM%8JT?;q2`}%AzQ@!h?cYsqp;_nNgnLFIh@E-0I>A|J!fy{3W(xc*ao}~C~ zVQ@Cee+*a96JdS@`74C4!*s-`(oW*sO6N|f4zQc+7*oC3|QVu6lx4NdGOizR?F`vAad9y@?Z<{XE&$eKa+_w_#=o85PmjDlUJmVm z$@VJG{`BF`KY#l8mw}!kXf;ojHK5S-*3%X3Q!jhnmmj^$cEA%vFS`Wn2* z2apSptzYI=)~VC4n( zQobM#H@nIU1`k5u8k`@pYd!DN%Je?Ct<~yF-(jbKuk!@IG;l93Jxs*U^O>^Vv7d05 z3eLj{532L!rJY{%GB}^6OY<@*IrIIwL9+W!Z*fpBFLH?=Q92{_oeRaE>?#l_JPMGG;5BVQvJ<}0 z>4Jdo{G`x$nSsE{&TE%99<;LW9nl+-$w?`mP{v2EO;|*e5c^-GG1f?7fJNMBaf=9O{rQ zZ6@*408yJ9;g6}q%Bh7vDmm0}-bd1>OAuFS;#jlCI;s_2;-IrJ2uuBOtog`ybmKY7 zmF*40?#UjzG>p!1&ipJ57cQOfnHk|zCzf$gC?4yoOW?kmFhE>6cWg9w$*sT!-PG&Ai$DTUOjtlEjm4K!BTX?~!^rGv&QhfWheYpjBn6+Q*WOR$*boFH;Y+ zOcmBut4O7<7K$zF&8d=CV@ICVt`bmp~ys!<0N%v>Y>#R4MA4Hb)|T*sjBTg z#!ezua4T1iYGLG5eWIFt5^;9rw(?XH-5?^MVc?;HOhD_rLWjiU*?5^q|9<3OYUE!; zL|P~i=*oa-Rb(G}>~E9I(;G^kq^`=26udtC_A;AjzC&pKdoI>49jY!Aqb{8FN{l*E zOgmBpTRvJiS3|i6@(JMJ7dpM%fa%au92ADu299!NzaiA6yYU@S4W(kzxm)nL7oS4W z#z1wO10%fV4n;>cQQdXr@N?z2SoET7+5ublwX})*_kGi0moC3P;x&(8hRgxw)CAdtkFlGNLxY&BL!uqKL_6{1 z&BP4>GnZ(mh9ndEb%L-Kf({SI4i6VF7o@=ZSqJY@XvyjCbHB^~ z;JGcAm)Fx1aIsWr^2;2EYx54ocn#i`8p!EmyPqz%0K7zU6CYAND1TPU85yK3m&-BUwz4mk<1ObIG@w*J&aFd#6Uo`=5d*Vk1 zl9je)Kv3Scz{`$I*ITb6j^Nu&3GFtMEV?Ng93Keq8)hfV-|SHj$?zft$5yxMKPMB= zI{^R#WPK&tyFf5`)f|Zc5;X>KK5&7Ah)t>#5Mnne1ySv;cPaea3r12)K@RJgIB{hn z=Ym(6kg>MP*n<}rtmD4rmF00_r?_70_iKF+TbarEq6F8LFGpKK2+RkjPROT^ZIsi1 zFW|TWDkig)O7$KFPYj!ww+#%|4J8hltz?VJSR=5akIu zuRtfJV0pfr<$IF~v}d|RdtCs0E#MtZAi`oP0Lxy2<#K9I9nu{Z4Os;X_T1ltrGJzE zGHC7}kt?9XJ(#aBNej$OEd$+^=@c{V52sGkJ)g>R1t7d5(eQtwN8Be%>VXvzqC4+~ z`l`dBl*P4<5eI_8PIuik*mHwEUEcnEo|vd{N093CKD>8*%U;i2mI`2G%GPBaSw<~Nup5;(pNV0lhVZIR2K zDHyVeUQWT(zsdVSuI0H`F!?5>wUpa*XqcF>2b)DA%Vz+~J4^$Rg`p;k`}u+8e`9XO z4692H{k`rKLk1D|(@clDo2)tD`%yAa#r!ldf3&^S{aArM3;#ygV1mcG5&)ig)6&vQ z@!oF+D**bPYE{n@ajwrb0cMRBh0eac%!>3r$jK$*D;o|c3_=*^9SIGitQITQI$*tA z_?VE+JDUjW zUZ;q9?9a1NW@X)qI=_IxJTrptyUJw*xTwIqw)jF9xbC z-}4nR>jB1&h&}jc{O29BM)K(cn+20RR$|S|9K1C1)P*6EJ+Rdx;A5}h7ug}N1&V!qzTpA7x4b?0)M}6; zts(bVxw$X*Q!vzjov%#qxC3wA&oh3Z>ffR5AIE_xGs9C)W51sOHTUpPy!5nOMZ{_k z5%j##9}*9gLj$nqdQsm=S;Qdo4)R|H;$Y|PdVAfTH&{f13qB#`cmC_P-w0Wr+K-KPy#R?C&D26vC}wA8|?f}*W0vR@!H|tx4&viRUgirmfx?=y5@BFjDdUXz{C0IZm~;ELPyq=pta-lnHTVL>aFD zY~|YnffwmB4QRcf4>x;z#V=6XxdW0()K>oPcYl2N{KIdbgJxc#J;K<|=$~PWl8tGS z?YFr-vN*#4nHD~poH1aC0MjDtb&xkh5kfPZx4CD6YtQhHb-1F-)btagKYHNdROvGh z8$8~IEZ;jDIt&Fl%Qp(FR`J<7kdwKI?lT|$_2ti>KL_1)|tbr46?Erc#{@S$nd zv$d}608)ke6O>hs?AN@IGyMWEuAGY$QpbaNkw;mH-#~8Uk4)rS%cK^T?khaV&*>sq(kH z0!%z>#FItT*V2GPz*Qg*699G~(@Rrh3`dR)`z;C@+e^7$JP5U9T2K9qHT5%A$O;~qdd+CiPH+UQOh{SpRiwd;GGiweyK8{*iRq4@ zNL6kV!p`cikhu|q)U|4*87tNtD+I0Kw#2O&V3L=rhgL?ig3j(75NSaS7`pVpTQkly z>{+pB`-`cwqEk;62BuY+ttRniwkCi-D{fQmQEd3CD>U5>%doLU=h&&8btt z=0cqYi~+9bl5&m}zE0Gsz*2o3Rw62$J11FL$Yteror$xOBh5m|Jfl|uYd+A;C_-HW zU0xj@O&O;?#%l0oO_ZZtIZ9pl#Au+EU7|YWHmsD6lHV` zKm_j=pw4b}P$^A0c7KBddRD{D(qmN=Urrs9j{i0(h)N#}<=pURwDT;0MJI%q)d#`& zv6;jFzTpCC)`9%kOi9KWLTuA2#xI~}9y}t5xXE2E+$q5=6BLLx;4*bYJypX>B}yia zLA#fNMziF`clKwb#(4GzCWpm>+A>(&Z|bD8~H@FW-o!}U6W;MiCDSi3aZB*UPd3r4(;wIiUr zrN}K(2$QR$!{KwPlT@Q-QU%eI(vfndaa-%i4OMKyHxXGB4Pol`+(h8*-mZI(KQVrGev=*3^Yu_!n15*w=>P%U?MVK3B}X( zPZLiso#R~?$GgbfQUb_$?8tfPlRS2Zh)QYQxf_?p9%ge;yFKJsv2LldUns%YvYy%-b ztRb*yQfs3a1v_%)wFBjfkDE(s;)`4xRH1LMp>MEYK?564Jwb>HHqyCwOkp zQ`fZ9EqEdmjIzCG76)Gg8`g0~I6dck8Rvr7i4E?B2OP*_gup!TTsEe;-+fByH` z27mQq3-;TCHh(fmCG-jf=M}{1xqH?+4v6NtYZeB`)L^;20{4Yk#MmygLgfgd*@(6U z@LB*{dVZ18DWZKUV6_c=)&&6gyfDxNumu4uCN2Z={F8LRjaH#V%B6fog$m6%NZ`TN zzk!ap^-xh`fWor(ooX1YS5FiyYo9b7&|1!+M+|uYE z;0iMZ)9ZjF8z7-hiI#Da<(n5W>E^xJ6z>L(&AeyEKlk{R$p!We#J-=Ak*D!EG`4_y zudt|{V9z@>uP?(1OzN)wYJ}=U#v54FE1EU8XG@=mol(rP$pM*$yk7@cN8D}$tzgyZ z@-|$rL-6V6@Bc{xHCzqBjNZVa#$S#?@S|ZMajs8%MSKBVY9uCuvo+QPUo5{h>zELg+ubSUh4b) zE+c+qX!a{TA7;6@!CEBvWoDBBR!PU)ZD%lh$O;|fIDlsa)Ublmk*yleqo;U zvT8<=tl4N-z!RcJ8!wPO305rP&ghB_UH7#^G7$)Pmu*Lj>ax7n8&>|Gmec#M{|#uj z%Gjc&ZoqwBfTLe%9S~ezu4BLq_%-;ce$>Mt*IwtAaI;+CL6<%_Kkq9;q@U=if$a=w z2tuW&`W;|2;+_|@TuQI-f2lSvgvnbO_El(-8x2S~gV# z$-tUotC3Fs3{KDggIyho)ALT2v`kL`9Wjv&8+Ntwot|KUi+1Wi#(5b!;MNy8!d@H3 zQ{V9|(YBVhLzwVuI?4OS#ehxeghN$3?oDv2v2Q-r3o?vO_0&Gel&*vR?LN+Ell8ZT z^xb}3=u!)CyCEU^JTJ0`fRi&?HGK>A{WIt+#R&UsS?OfF-*v(R*Xk3npp9jTis@xR_XbyMO~0Ve1cJ1B;RfyA)JQ{G25n*^>};6S`vO?` z3f6W@n`B_*AQ+oLi0tj!xnYpfI=_L{%p0-824pTD051o#jVCj%^%7g$_aA=$05GCW zWFH^PX95jajvi;tM;g@00%UKZ-u)9Owfxb#W=zrm>hZe5EDYAPvUYv<+i&t8c()o{ zoX>cTaR%#LX~-+BXE&N}z{NuLRD(>Ar!6}J;Ml;eBjz2|t@={v3RY2LR}H#05NJ6Wk=@(2V&_($LD$CNqCPQcvF>Cy!NjDlA8TwH@T*SD@jNxHXBqL(Pm~yQSo}B zjLgJRI#KAea#*o)erxIApF95P zL|tSHpJeJw>p|D<2wFrWA{Xw6>O~vvWi!t|I#Q{fU99#Jh8!0DUJJ)U-H1~s$6dxr zE}fdJCKt)yC%O7r9DsD}fb`)_>uJ`CBbRoI8!6}{bx2y#XXQF4>RoYw+D4Pj-E-AV z2T5_xIVio^0O&~JX1AKzLw~c<$P9=!PYrd@NcDarA*YVQr*sI2RmvYHSrO4;qsY6L z;kBMli=3Uridum*U776$f#*uGY3oxY+9J^`Vi;yRH#J|9pjAv|Au^Z(ou^I@j zqD3(|%bL%jJ{i?9N!>XkHZ)s(GK#<9+eX5U%tSZ$r>CV2nRBl#ohowoT?M<I z$Pj8vqN*I>E*0S}9LUb~{@fAo%%O4H1|sbTc=!!5@yrR^4s~l1m34zc-x@=uo`>G< za0BbucOeFMXAXB)4sRDh#L5Ts>?d`e(Ldyfazk7dfE=LQ1}S;J3%GZ61cZlhF;oH|?{mxmv4>3+a!`fCOrkvVtRYv%5_;2}9?`ixYRO4PP5 zGjqT*bLWRtKT_)7Sn4eAG&JZt^0@L;%|3`{XNG_4QxYX>nVKe0Y6bI>}q#4gWHk9CL)$Hr^Pd&(_9T|>Ge<%Ih`MXQ|vUgd5| zQYjOhL+(TDSazmZwx@S#Bzx+2#L67E2AA)yNC@}9^&)g|J5%=(UN4mCZ7VY{??f^0 z+_JjVy~MuS(7)4AEo?&Hc<>8Zf?lC zOTcu(T(9T|g)ba6&)pCu@!YQ?3qEu&6tdJKXQ+Ebyxwo1wtIpZdEHG@iUVmcoVX3|Qrmw6EF*Fj$k9QcYBDWJh0|AO~t2Uh!g-yj_q%$c|K5lh9D1W$Abrr^0> zrJQ@#_<>N9XInT*WQengM>kvvi~ z54L)s`}9_WCiU7guNz(~`^o`j>1#hBN=t_ReecKMe`|6AHH&Qxw*3xa^tLlSYy%R4 zO9mIgj|HrG(3`jUZD<3+!P~GY%DfFod)gQa7yS9tzdrx)@eic4^|CBsIK8rmaDi(^ zO@EdREJRFRX5h=olJ#DJDfU((X;36duN_&!$!QrPZ1ltpQG+v{p6*c+_z^zws_4n7)}RnB9l> z_xg@tJ1{}f^cZ?xy|_RCmKV?9-f!CClQ%Vtp!#pi^QzQ;bY5f(;SRHGz~b&TwH5c8 zyn9(MVIm^qpUK-Pn3wA?zx|&8O$OvN%}Wdam>N+0JR(ss3hjpA%OB<)fbpBWS z-(cFe6$tDE5AJE6RvIQlHPEf98pvQb%UOaLdp1%6dWj%rYU&@_E&Qxl{Z!8Yd_aT0 zw?QsjwcIfanS>VF;Qy~1IN&`L0Ek+YFYGqo;ZFm4@SP?z^F*pJ@}w>d)%yyf>uthM za2wbuW6IvV)kxtRMtaHLuo}R1<}$#81JZ%P1q7u|f?NOC9%jqE>HvgPHqfCRXvRJE zGt6UN8F@x)ZMv`A;N5c#KFNT*IJ2E$WZzXgF|bOI@jQdo4OIf4)KYG6o$)!*EBu5M zKZg0q?csDy(4GM^m;T#3qzE+h)x1LXW_tE!C<=H-{N5{R?lRHm$v)`~dV#uK=95hB z9h26^x_i>#gYuD$H%uhffOwWo2d zH<-{YP#wV6qUVd&cYMLYFaKHdzy2G%s8#>V-pGIC`Yq^cyv)rC-)@?Bt97^RGo*@t z>EY!ee-Sez@^Lt0;7;fTb~f~`f&CAhYu=v`J3iL=>3QpU$xD?MtgHw6Z<3 z--Cbr>-&EOrv+h-5ECr@aOvfJLUiyh@9!UMJl${|s|~XU;lh2IX?hfJIiXLpUZx%` znSH#X3wf%yaerO%3hf!hN6^e>gg1HJ46?}8QrwKhW&P@*e4?MtNJRvN2&J`a5IP9b z1Z-})LG}mT-qzbd9m1JrW#2q$p70r8HWehu8Y9~)lsZf&l##~NvJD`m`G=oBeERM4 z52{tT!hL+$U_!oPzEUR9^)0eGgRWUlQIf*KhWrT`A(CPv=Y_%sb*&korZ9cO!tPC& z1g2kWckansdbzawjb>jmg0TL*toR#SH}kqSFtJ&V*vp(to%Ejm*Qv66?;$Onc^4H`z9>^RU+LXKgl zdlNd?-0L>@u5RSibIOAHeRvP#^kQ!1yM%Mln#!Q3HuWk;dfK0N-#pJRU^d{3q8Q>l z zIULXRMX?slwkcF}l4-5HUC*bmyhe!x)qh9f$gz z9=6tBALN~XjlU*e)34drAo|2$p&@<7!T2s{^(x0*N}Fva&K&zxsLl= zN0o!nmG`4u;6zm{n4EK!|Ftlc*IL%Da7+*e!Wf{`}l*-f*iTILE9 zZ>q5=re^M$6ZkW;P>b9n1&uY0;Y_@@rhfT8i7WTVr>G-~Qgg#Eb?`{e!W@lMM4}Be zGmcO76Q^oMl=@nbs_jmyeH`3miN;|yyrBV;wY%G-1{qYMm zH)0Qr9Wb`25We~0%MX~TW<$BBO;Iq{ZQ;^Gh&rO*l}ifBF*;jAi(3_|BlD>Snsm1tOp z`uO+$u8prshe8MIhK1e)qpwk^_DH36yR0dy@=^2c&unry`4`$Kt0HZiCEg~>Y@#o0 z-;KJ>M4rC^Zzb)Y+1f6rVsz$@tfLol;nF}!oso1s5B)Q$V;csG74@4-@3s||6`(## znctskn=Sp;Tgz;snv+EDkNpno-}|{+_?Xt`?1=$voN<>|slKFgeTmCTz9k5R-kI|j zojw?62o`A?x#Gl)n-1xTh6hyMKeP5u>910{-IFV0ZNmOpqIOTF!SM4g3miBaYq3oz zNb&Ai;q4R;_Xs^sC-kuF&_jcDQhM|3NE6WJS?;%(RZ{M6H23BUv~!jf;EgfWrchp! z*~T8Kk)paesWL@Zn9#+mp^M)zad}E)6YH0inafqYNv18a%)4c&_Qv#RpaK^D4cE{l z?rG%$*3kD=)&Xbkv`c19&Dgtvu?tgl2V$+S#4Vq4?}5<-DlQKxOKv@{ z;_!J&-TeQUsH&w3UEESy%S%%M67QVFepl=-hgy#IqG27p&%OK)-upXU4c_awwe4O{ z*4~1`mu~&Kzl`+!r)$##XClbmg4lwB5`tb2K&)tRUFH?psvTnm=Zb*Lqb6qmY8Jn*!?Nv=y7Uj+deR@6Oqb?y3g~8TAYDS=;`Yx8Je90g18{R-oF8Jh|IHQQtE;K8x&&Aglgc7RsxYB6S@Ug^2A z0cVj)dy`ABHn(|h(4iU-ASjpcKiTAE@oQ?C5Vv%F@TcYvXj_Y8PaH-@I#pe0u!PoNH?(f!3||*bX6-c2fLHJAgI#6*b!P;Cre)H)Y7M^3ckp_@ zP_Yw1sDn1fmruVzy|CV_QL&Cx!MKwZCU``#V}}_%u*EOz%AvK1lgo>KBbVIJ3!CpX%OXTN#yiu`6*L{0}E^xx$3^ z245rnK?Cf<-WSl=nz^os+k@v-3qTFxpDpN2lnu`mT##A5GG&3y5gfufJ@n++GP3C?rL67J%l#X3%kLq z`&cphVBMa`Lg+W>383Sd&;3lJs*yq+Y%$0ec$!pZmkkW!8+239tl43pzTghoxeX00 zt6+A5e$>2b`fKmconL1Bq8BxAOT+}NE9R4oNBb!WZv7K?_h_7dLfdJS2^2oGXhYkH z>YjJ?x&QRxe?R^KApuhmU|l7CaS*E#r9Yn18ugbzJcMDR5Eb*Eqo`LT#(#Cie& zNPutY0`dYB3UsqNJ)0|{W#RI7g7wu9{Hl=%a%BMt0uES=msNSwSnuE=KqJKtmmGUq z*@uj3#e*DK93c>#fcvl0{1|)m*wHP*Ms*#=^DKuGJZ@TpYg12oUIbTSxmW8MBSK-A zEH{Cwq7@M9i+mY$oqMSt&}^fiE1C_pp*1d$)I9VQj1o`^twGK^udr;#E=Ilg!YMkT5#0Ic?s5Es*{+e+p_JYve?sfJw2ypJO!um zNh|u(IO7d+Kpd}Z!PAUJ^Qpg~L&%6-+}^cKjkcGDtI~gKV3!L`D>;Upkblu{^y=@I z(>$J$VBE_iT_pmE6A01T;QKR8S2-pjeo9Sx@k8U@|H&;lPltsU~C?YYUh z&JWwi^k09eRhKE2BD3t0lg@6wBV3n(JIt*x&qDxjYK^G>8NKe?$4W&~ZR7*Sc!jMUUr^SQ^ zS?z4XEMPewMHukFyj-2I+XWuZ87ac}T22UAz!9>6cO>l6=rZ;nTt|NmW3#VJhA8*NnU*E6(#^$t2&fQ)f`Fm&F) z>XV%b*F*V+90^$fas;js<)ir$Sk509goM*WxQoGp>_wf& z=s1Qw<`!741hR2t-^PFm#88YQ>KK@i?WGK|$^>#mYS1aKWy`CFpq6b09ldtm*%Yr^ zsLYh69aK3&iF5eQNCj9)L7i0r!XUG#U>Ky_k;_n&l^w>ky%*%Au5v+^mkEB+zeDYf zW?q)Tlq?O>FQ4D5bC539#FMHrUGt&{rA$tXDv?? z_=FUziTCncP*$;fNBLNxQ5BiGnJI>3eY{lrc&TR{7d}CUO@FMjr{NX~3nY%qCt>*h zW{tc`Eze5r-l+i^Taiw>)|Q?2-{Q);ZqF3QV@$L6%Sv~{QmdqxawfO$R*y98 zubFbEP~}dcZA2wgtK6)l`x$M~a(-*E^QB|YbdBA=n-*vuldRpi%!Ox(`J0t)bEXsY z&d_4kUR-FsIBUX{COWIE&MF;pmzx!)DpUDb=8d-0@6vQ4Fx+iKP`a=&q#9L+e-Y%VmzIf(tACO20) zB<`l>wrbjfv(|BJasZ3`&@5+@s+F!!Q!QDc+A=Q8I5fkxOb0$7SB+YxHzxWjiC(k6 z8$~gLn_}mE#}0+-q)4=HS9sqp_lZY`s3a}d>$&RCG98l24B9+KM8#^6_wx9qI$t2x z$Xb=AX-tT9>MHN-mD<@WRk2oRR*3B#Lhphq+8n#2!&-W&O{Cz6C{{+t4!yT1#jk19 z)PSw>wwx~M$P?TnPjHV)%F1ACRjRjEsmT$gr;oUn1A!qbN-O+&R%*-ch!3f9@8$U| zv~u&lOQ`|8rFRRJ6kxV(o-naPU zE_KkBU3IkQB5lv9s*TMz_SND2R;mTu-+FeHM~`UiwAsR0?;}@bkf#D+;-+w(Pi=}g zcZLgH4To-=td<#$&(?>_*oXTTIFfqKNT%{O3$S)mIBm#f{=`IW;jC+vd9yO}u0_VZ zc9fRp4VUSlhH#csqCRncfeE8GuGZQ#ly^hA4ur77kzvwg!GNmRd= z@Yt@FZ)yvd`2C5u5cT!l$S=`%2*Pp{BRVEdnXLUke|=;#5x?Fme0K}D*d=m$Ck|wB zrgFI?W$R9Mp}EFw7dGT(6sOlimD7c)gR4|ES80o|^ai7SHZ`t{bO*{IbfY-SQ>oM# zE_A;)HF~r5o3`7yJS%m3V~3H8HPY20@@*pW*0DQX@^P^aq4x{j3r^K>g?0b5>6dBC zFI8<_qAf$N3y})?LhbRz8ll4PJdC^tr__SbzkC-2+eFh<%vVm+y-T~75EEv}-CX3II%~MOU#&{qile)yAuW1`p7A51r7SF| zrSO23>X5-@E`uw~knUSQFY*j<4+Ae!@933gK&KC;>@9OEI`yQp;Fcr7h3!0dj7w~5 z&`zJK;Y@IusMsv=>~1;L(oSG{T=$k>qK`i$Z>D66^&8L=rcmu4(fY$h>is{^MMCEa zgt0FQKMB&-phdu#_|1}DxN7Sp*Ir+F^#0Vpz2svR_}<;pO?V1g~?yAzSTrtUG?iw78o#^zly5Q?PGL5#Jue z`!;kkB8g#>lgDieBb{KF_l91s9{ck`{G5bf4$*A4?xa^b5d6L$3a4NiD{ji~euauKM|*2`5}cS}8O zJ2GW%;1WZgMse3xpD+E6=O^jwX=%BxuJ8S8y}k!u*u_Kg%!c@vovEENz^i=S50Alh zBg_c6jkqZlZPc?p@c6AqFbbM^h`YrEVlRqt_+Z8vAWrq4h$-JJBw&TuNInZPYT*5| zz^QNOw6}-OUahjQ^-AM-`E%EPWYbN?p2m7|x2o6(%Y30fpW5?XDQZJQ@9o*t%@Y$Y z>6>CsXi7xm!QHBc5horc7gMAZ{ZZE5l{JqQCdDqm2kyW`iyhGltqU z2%TnlIr?mH@IsSs8_>|h4-(Ar9v4P#pz+r&!+G!DZ3d+q-qiBaA{bQG@B2D;$f#lO zls0|lKP1;x&R(KSF=E#w^OHGsJQP#_v&31)a3&QnV?aE5NTB zJ7a3z(6mHHk^X>~fV_WGaQ{%UL2?Fi#v`^Ub>y@IBxO*}@EyVQ>s|nkJ&_R(|5LpyD$ARfMHGYHfO2T&KB{UGo(Y-2c>0g?t^$32ng+ zK910?;ia#->p(k@13t+%n*|}&Y{R(M8jQ2;Fe5y{eQ<{eW*KJ)+R%r5nN^)OU#1(D z5MyzGF24-7+cTDd*fkrA@~SUANfs|XRd;MCY6EeU%VBH=B=0aF8S*q{fU7F4m!lnL zP_<3naF(|)Kwh+}d*K~!hM3%*@`asrE{pZ&mcaUD-uf}e5X&)h3(z*}I~A_Uqg1iB zyg{he4@k_o%uTbhQK(%&2sY*IP{jt_A2Zq~97JVg18(n>#DUfxTqh8!~ z1Kf|6eDLGU(}J_v7mk>tuZb=0e7a1{{q$73L8j>Ra;SyrVLzea`^w2W$RKAKSU%_a z3FXm`AO8IK*N6WEXEo|Oqj`O8U2^qrVUL3wn&boLZpOH=Txl>;feFoQHQ<5NfEH zC+!3uWfNNJI1l8Yi6c)x&QNCY9Wd*@KXHHG*K*Dw53kRl{B-YcTYEiqLAPCA-q8HR zIgfc0uGZ#5M~`ll9kS^M#PcjvyvcTGiZ^-h+_1Z$8-gEx8t(arpzGx%s=aVO+Np%Q z>!Ff=BC_X3tveFkXO+UC|I+nn*{JaCCc`TK*&Te~E&U)9ZfhO0jG&jhv=K7gXSryv zGa7NJ(9K#Y2??+3Xec^SRhgnH)tvlb;M{FF4WY? z+1VI;e^IKHb`8xbkz%?IoxtsacS$bB_aDCeF1u;83R}ww8fNq#>pQ}O;3M2Z@rmFd z1kj^FiafGK){ADxA3^qyobh10L!TY1cC(LQ89-b|VckwgMKl5--{gSz&UPT|4tcgi z+8aC;W!YU}uQ*XzH&0kdGQew7T^EriBqQ~d&8+r|azKLAz8U8S1-uLzLI-nruNOQK z{lA8dzo6;I{fz!zGvCqPLk>Ked@<#9`m$0q>{t3SYRpgv7e;b`n)=M-qwhZa@ZE3! zfj8r`m3!7ePGHG=N;nJZH#FzuTnTwWTX#8KZ!m3~DTYJWAN~uNvPaAH6RYTlMNak6 z@w>^H^qCU88az4hV}=czot&;?b(cM}e2+mrj{sL>HHL*WtaTypmdO&{hA2<=405W$g!wl)EBo;4$A1SOWG*+rEg_OyzWeycpSVg2j-1Wlfb`+ls{ZkZ zfG6SORg>sJiqQ~yyhqu_C;q+eB>!m?dB5NV=wHe9A(oHD(wCI|G1XY=@H9bRF+r22 z#9n3%ihup%&*#6Y)2#Yh2aM=3CTT*~zf@@^DJT;`TIf%Z z${#>~Bt@b{3f6nFg2j@kH+32$W%xc0*CAl+0w6VnA=y9b1L?@FLP2%~HN`$6o|d?@ zM_Y}mAB1LzmX+FEG;N?6Rvx~UYED^daFU`pHc1$iM4Ok`vj*bIt^9PtyFw=3YdE~d z5SY1TY)U@8qtHwxORlf9Md1mX9w)ja5OkHg-OF?D60>p_JFgnR4~W zJQRe5wk|6(#?(HgwZSs&iaL<5n!qaahGcHt$I5hpsW%}llS##Y)gcC~e1i64lIC%i zh$anWiqttX(wpr&S42NfU3;cFomf*}Vt0RvHE`V8n7OwxBhP8#U8)acS5cLj zj=r-ssbNgodbGH!gsCLjU(_BXyOoLR0k!GrD$YbTb1}&Qv3f*tV4E;k=gCY3dzs4h zQf(=kx-$+{+@}pidtRguQFIoFd=_P)cL&wQl7c<;?Tp-5GEz;U8~T|rAh!^<=+E4RF)S*5qUDsQKFAd0pVtK27vi3BT6 zc+wa4{S7*bhpAn`doxu!{3qtjh_BTtL731x$+X#>?_Gw}yT z`ZpM-lUIOI*>McnYNQ4*inJ+thzG3=n|m8J_a;gnvY%L#HssobEZu*TkInSvRE32W z^rO3~$ahs1NoCr>f`hdZ$?GsDP8A8NwlK8TVnhjGsY<|7+m0m#haUTrsYWdGx1{?v zORuV2P#C)hr?)9piAZUeX)aTPuhE`l-_gIqRJ+2de{-qf?&vzI0VlxnNTtx$g-omq zsgF<1pz~-qmYzvPvrO5sCG_Tu(>yDx(p@@B4WiOUqlHeDsdgJH?KXyPy2&P@N)NRY zX!IYcaljlO;a>=Gj@ldlps1W+YC7to``V z94ah!43TyfOVuYP-cBsMVOY7}rnU?t%Z9QqE>@Xl>{2*W9mc9bG?8lLs}v?lq;kYs z{<%O=`-r6lM`bED%)Dnvg<_%2#6tCog&A?O73o&5zVnULM>z7d`bdq(BaPUTzkv2& zhQ?mP94nX##_rOo_M9pYEL9#@sOpdH54+_Ev9PAnQHG*n|ja- z>cb*$CtByOib_wYN=!U>Of-zjT8EX3w_Iv%Qox)kROZTA#qP=(*+h*sE4Sk;)nBvl z#-b_mN^jwncH~#Zp!O~kdpYyd4c(#v3c<2+>0ruwth;}5k@t9dZQm@%Nb%SBc#fr>nQ}u?0>kG{uG}YI15}64P6BQn& zCNsoS)owg=s#xf|CGASGk?3E!C*VPCSbD2bJv*bnJ8sg06J3526viqjgjldFyoczj z!je72vN#MhOV<#Zd!`N$DZ7nk>XX>}iiO%}RywGSrg>}T@-+Fj`Jb+u;7X|EFxUR$ z6b0{c-h#xA_xc9NA$ab?d=H+;qDC8XWnMO7#|ePGeLnv+zXXr@u|i2W6NLB+Py!AHgHkf1rAq%WEwVl~C@Yd{?TR-aL z1Qd=ll+zE|@}Sd64=)twfIV5HzrI|Smu@))uLC?kqu^DYlU`4k*X?>5FcR?F;w2mN zD7K})0hZffs0jTa1dWg{?&k~S4xFGXI<6PU2kW5^zBV9_4EGw&5Gsw-F2Y(4 zlN&XUNdJo22klk82s9D$Bf4`=t#(BTd~bc%J<&6TkZ-Fmb1%;~o-$;L#5~q#ir1V%;sw_(VxD_WsLi|*$()Akc0FByB@DGQuf>8gzm*F2&pIuio> zLN!9L%x`r5+|TO&DNp%>hGNUC8yH%k%`;d|cW7hIGMTnZ^F+eg>D){wG(({sUHUT} zJ^PL;DLg)r$F|h(-7DIDkU-+^E>x`{^z2fvvPvw<55UP2PKSc8_s851%Pt#+2b=|8 z%lEl_ynj`%&z`-X`_5=B8QKe0x%&d0Mg!gB+>HJ0m{|B3Qd;2ssai#u%)$LmZR;Is z$bGEQTAe{|fE@BBkDjkR#gVejAQEj0?$@_IkJ(_|&|j6W9{Ys5e9P;AZYlegXtvGh zlQP6l`=e-QKIFf(K(FkKLJ0{$^c_x$FzLh!-(F;dW}vqor#u&{*z~+kw4`1QBXKm7Jto1(ak@YFM<>?5Lou+@xmlzTkg{ zGnN5OP+1!wkz{Nekl>yjQsDi;SU=DcU{6#VqTB0$9_ge~%BdTnRvY<-;&X9Lf-6Mf z^?3;Xxjvd7{)Lw5iENYWe1WtY8trE+!(t*sMmgdTh>70Nb&ywLi@EmfQD2+q_7&aM znr5LJC?69hy{w(^3dO$uDqmiQyXEW0Wq(1x{Fi@y`Sa(`XtZi`=Vh0p?tAddyk2(M zCVu(t%g5h;3SKM+4xLv<6~3UgGu(ogvF}dLw+5O``H;|JLe@zQ=A@HBjX~uN4J&ye z+E85)3&*nvbWP>CgPb$;d+-ybi&1ddu?&CuBl*vELkD$3=j5l~{`}#$AK~xWH`wdI z;ggE@3oJzC;PQ@HPczyJOQh!lOz@#0qr5|Ri!DbcNOubqrHW*P0vax)JvK)g z(4K2~`ZTNkXbm+c!{X!=;{D0?t1PIKPUtd9!%+D+_y#a?d7k7vW|*PPyvTk6qD=PK zqBI9`XilChU3Tdi}ceDF%e#p@9qkhhC@n4gMj=!hV`GK(6b9{;zG8 z9l9JdphJVaJ-}88jV9S2vWJ`~f7L@#w>;6=?yyBF-A8su9eU?okCeEj#*QWUVgCBR z|C7k|W@RV#^$iz;^<`HyK{pMNi)5JD@TQCDVlJk#8|tu5$-{d&eyza|AHVzV=Z|u& zCT|TReziYa!+;dIh;-<{@@{uIawAKp-ETLZS+&btgKZ^$`_ak)p{}WT({~h` z-1onI`u)TIpvP)0R=FMgyLNhcJxwpymp%A?ga}Vw=z8j)(!BK8n?YtNN38FE`tZlE zAHT3+TDK;+Jlsd+s;puYlI&z9z%TlxH#tq?fZlPvv^Y_1>$~j0N9~|?sbp*Gl zm1TevQaLt2+u!W(?`!>_Ln+T^7)UptW6CUHrO;>y9%Jd)Se27OEZb&ArYY<}u`6fu zl>Vf2E0xF3ZGXQ|I4N5XF4-uJBQq{Vlk{Cf>tv-SSwaKsc;X>5{zsIZ96jV4{qE;K zKYseCtyDOgo*@jpaspEXs3?2$FrCf9REBjkX*3RPD=zB=@2OX&SJUGM4Oq}6oBB!3 ze4~A98DzVv~-a^cwOaICg`0h?+@yZ*V-AUNm99>dRg2hb!EPu z>~cTU{3m~+u9Gy>K50-Ed6p&^;-ExnU&39ofR#WVO7Saq7C~BMrF@0RTw(4Cqyp%g z28mQEGe|lKRO~VUM@bSy@+G)C36muB#%7^@sG0XSRYggSr9l_$a2BSbEHYC~R>vgO z=4Y+Elx8NS*jk>njfV~?MjzzmDz_u93-o?l zq5b2+80btREOlV_v-Iw0VUo^*O;dK13T^oop8n<%Dk?n_j~?W+6MbOf_N%21N8i;a z`s&u9%(Zow>mtq7J~j6iINGg|w_9_ccmr0G2}=zmEY+OVI%L}DKv$N1+%U7otiD?6 z4`Qb}*SDPen{?wuYt_bX?^>#)l>JsUXEhzDc5hSFi6-jbnjEQx+P5_q(af3%XwkB< z8fUR}V`J^UrW~||TB(xM>^@Une^OfJu?5R}Grg9TM_QqGX4&UepIx;iv)IB!4P6VD zmliG?%}g(<9oDKcH&-`m)tjy3n7Ey9qV3j11(}KJWmPi8?k%q+*1gr2G}U7q^Sg_6 zp~k8a)<%PBL#x~-g^EPApIe%NYh*sGg?4S}eX6>pSX&Nk>{@@9kBl|Z&_t54TL{M{ z|Aw8bwRKg^SsdYnc0Fn}3YR+Mra-l3vA2S)-{|SC)S*`HD(i`h)+a6t&08$oQP$eU zkqK7y6?LO#=QuWFS?v|u8_(TtG}j(luD+eQHn3fMZi)TAq?@?nweU%9M!F1kv~x^#)Gf_Qmrdx>x8$ zCu*F)#&+zkx+;g&o^)a6xZ2;&^jc~*xTcAX%s4kTRqSzHH!)6fcD%VaL$epX={(0T zwXk`m64+SXaU*SLbC7jC*WR^>U9~rDz4Or5c3Cp?tMyJ{x34(PZ@^y>%i7G z4bNm8fRM7s&AZ2rn37D|`3*wd74E8!9zW3QYHSTyNleg|i+O??2~2x=#f|Oo5i*lU z-&_zbv_jPTzrX(%CcWzgJ@9vQL|*4tqSCL!2CDrm6IhGQYSYVmPD|Uo_AP9A=NsdN z<;J?*_gnC<`}B`bZLsaj6{s}Z+4w**Ii1+GhF>m}AU!>KPegmSS$_hkWu|S0JMUfo zQ|+s&;Q4lYA}jP4?t!@$Pxjv_sIc0c<>{LH$YjUsb zc2Dv#(KwdBI84D8&89@Vd)v-HqStMKBd|8IwV#b7N*QEHQNxQ?SdWhOJYCt??r7NC z*H`qn7mXLy2+NI=nZ2NOUgbZdEMb8=kKMq(JkySCz0KF2siW&S+^^HTMZp)FLGa5( zEt9z(<+6sfbsff6I2qam0h=3g77qjXOrhVAdzT(-tv%I>1R;gE8^f+X3PZcmVh8i??8fsBkz^OJJ<1Uzm@H ze)x(s$h98i`()zUT6f5OT=tG`p3D4JGYs>M0hqHo-YrNp?3jglt5q5NoKDLW{PFTA z-qK(>E#r1Qu}coQ`$D(Ud#zI86$zN+fIxi&6>@)G=q0Q&VN5`Ufq=N_+g6+CG480} z=cTDzgk|;vXGTvdzUZhtNg>MP4GY8{TSy%@RdrA;Qn~)vVRA^ z|Lc$6fBlH&_zh91!SC#j2lrWa5BFBbMmCZAyvp|TipfF)02l|W{CI#f@EyO@7?S~U zhw>!|065=e(muE?>%9a6gStn0d?g&<@a4QBBO}_jh!{d*bCP7{12T z3CljQ3soIF&{LR6jj$CS+6xjlYrNXN=>(1S8=Dt**?MaVire7?Z`FI@l8{ssg>5BoYUTLD> zeLd8{wYm~>MUi##G7~SK`Uh7y89~ySdJvaB_id6%1wS>f?b{=m>Q`XoGOia$nq&f# z(VCekJVs+%E)nkr`7ym_Z+(5f z(9d`Wn+wf)ijx8L&rHc|=Q}4z>D$OOzeU%A*&?c9?kM_tpbj{uc|D^Y`T)&_L$3b?j*VF5n8ct+t zq92alIUDMj$O$|e<~tf8S1@BDijuos2FTLsSqw?>emjT|%x{O}r zpaietD>caw@D4XlXl^_Y@;|_FqsI>ZC!GY?rLZ%9;Xj%egB^lidV_|}r5`4=;cM{O z*5Id)A1J4XYM7au-0Uy#2EIcQT_0JTv|<0L)?+e`O})IEdf?6ljrmJ(-eoyQ!Fkc% z;dzbIt_H&10(Rtd}8{#@AdS0XZ zKhvKzHbFLx4)S`I2`pd(@EXiLNC--H;4@#<)xGT<*y$tHZ+oPUE$tx+9%yG z|FO5%|I9n3)!1rI3*$nuW5gA-D9M3?V30dYbobwJ$>2~pjUY~R#5W_y26|SXM$oC` zjO;XG-y1-q%D{jV=t1o$e+}yzV@73tkxP1Bqmz#_jZ=*kvwsATJ|i>oB%en1>1%Kb z!$wXJ`Zr3mqu}Ff51&|^0#E4eLwFv?M|U4Vqo-5Tv%{}v8`|A3yvvVf{xWQ`XX>~& zjWE`Tf2YMVZ@<+=F=0ZELN~WNb>!WwM9yw_WBXsWD0u|i{j8@T)Ru3tJK@K4*%)L$ zhXy}Y*?2v9*AwnI$uE(>LS%#HTKWu)_RBo@q_e=f#^-KT1 zLjads{07>AZRbVSni03->!W=82BG(Si&el4`iM-(KscS0X@DQNK4aa5`7^fF@39-B zOnV%#8~eeFp=fT6SU z5NP*|T_Tj+&~h)}i!9V{ZxfQ2Winx_m$5suJ-;9sWmS9UNPV0)&=u6}Tu$01tW}V4 z!`lS>1Rh?R+k?ZngP;a6H#kV&{rcNqBvkn6(WeS0o6Bo{*_kDT^*H51c3Q67!CC( zOQ3;@dhFk@s(jGQRJb#DkZ9MmJqlziUhy|OZUuGsLRtej-GS^hq*MrMSu?s$_9Atp zKS5QMWl`jLQ2sFd^t}uTeuAR>oUGZ0Q&9N7pa3fXVX8%;nW{J`&rvmn+X zbb^613sgy+=pB*9r^cl_FH<{haIaY~Yp$v$q?T&EY=Z2NtryY>N@Wq`9<-V`ogh`K zW*Z`pUFH3WMztpXFl|$shjS9dN~3^Mo94`F^jpCg*(Hz^XJ^JiP)FxdHP_{F-8lw@ z-@-m_>`_hv-JIQNw^U ze~o~ks%~p37tYiuv~8_;DTml72P8Q7`zm}Hxk;fB4N9M6#yDVm-``}eedpX(FOm&x zAPb;UazN?SgVHUh3%#RI)dZDh^MNyfZc4=IQ%2I6ARof^v9>He1bWU7BuJ0#N_k%>GWHnp z275QLu8Xm*i?K3yG!>GH_rewLg^Jx1V?9*4u^y@;(zfymxCx1xW0$!OiEH4^GdofZ ze4#_63i!<9Zwr;aXF8AyVXPhPY*7n;8Q{6`eHl|#%TXcEoidR-MS^zUG$YW&0<-saxxG>%+~wQuFufxtBve$9 zs_uL#e+^Bq#sm4Du?{Q^WR7$Tf!|Bwi zCN7#aQ}Ikq#g&(#1ddn<9O@z9#s^6eCC1GF zLqRi6Pv6KH=fCkZR-3Dz0M7rFpP|GJ{3rvXG>`Gf(~H$*yf|WuW2aeYaIq3Aa=)G_ zHzPZ)b6*P603}Gyei$DT(9Svb)0L+vANMlzF~Tf3`iAfMIM(`(WFF;uvpH&n?xh~O*-Gd}B%#uQLOUxm*Yd>p8~U6~LyR+{ zZK#KVZK|QtUP33sh05UyJqST2IMRiFIKo6zi;u8kpQyRHo+*L7k!D8XP-B8rqly#1 zKlXUz$f+PkYS3`_&Mh)I7H6;$dvivJP$QW&z%Bd<_4b59=eB0n1Te6ItwFJ{zK{p^)eyL!{d%K zBX_9lfN>d8|9hzuOq?!fmIb9x5@mwqI%Mu#5IG?PmgWga8(>es%uNq5CFttFSuYrC!k(=ZzMiP2tx=jk7(AS_;dWU?dT(6TTV$XLvOr&%e-8+#X z!W(0EQNSLBtdJNc4p<4u4be9j;xp=Y{NC5&ysg1=zulfu@Z8$z6o-U*O1&jC~S;kQb7nu!~FpLTTbAWAOoy1 zWpZn1YXIQ#K@(E4K=7D)qlfiF-3lJza*Kjj@CMHNCXq`zj91FG!6tbj?(3;`WQ@ADL2#)|YkB51}G{G)m zYA-ueo=x%RQyM1>>LY)Fa{`hRX&*0dh(vDy&Rd+HKc~U^yuo(%iAgh$@KaDa$lK+A z@(fAO@R}yygx&(2^t6zlhy}0v4Gs2nAKIYwFlbv#bZwG^^CwvbrDMf4jgh2^dDHIvQ!Jco5iPbQ1xY190l}Fz| zUcq*`;*<&g_2_|jV5Zz*&H!g{_}7oLaiC#9fYeQh2jM1AFI^lgr&oZ>%jxoRMGh}d zMU|V9S29`WeQ7~XSzeIVyY%Jv`;0wBwlEq3X6N$ zaRdl+ZNOM*v0D96H_foo-T|&K7HKWJ%dcN+beg|@Jbh3?%6`}JRvVus2AgG@U*&*uXG8>C9p(#uWpcX@ z#%pPL$FP%>PFsCm%9i*$+H8L^3L6a^ncQbHfRN#K$1f)!oXD1it@l322dop2U*tOe zRKL;azF*+jNk?6x84A_DY(MjM%};YBuASZWO!OQD8Tq zgqbu2V`fqNf|=X>D)&v#H_h=LWQ8EfYz^kC`tT3a6~DoJ8PE^h0_425NU}DTO)x!2 z@M7MI6uBwW4rhnpGkg}X0ZcG1kv9wL3ow9WSIyw)soxjUX_&AKe$9Q`qY#naT?J|>31F{(mFggZ*D<_6)mkeD8g3LSDtQ)ur@UEeM4M{ZT-6s<# z*B%2M>~8}!sy9gbL8Jg=Ne_RaLBsV%mFyd;adK{4?lxo@+tf4pZ{|T#{C_cC$RsAh5vRrWB+ms z#`#%~n>uC0YLtOX62^XoKX)(3iV@U_%<=#>dSKv3hHH=1fC1Ucr(PzItk=P)7E9>o z!PNs}py}bw=}B762s4$v1IcGulvpF*7QV^r{4Q?-Ll1)#4-E%j=Subt)-S|^TaxV+ zkqTRIWh!OB@e(z7%BVG`?fpbiq)C-9`_=QP^8tz||=y9243%m@Mm%hxC;Bq>* zFJlA7j+(-Q$n&h#Bm)*1`XiGTK3+e4|7-uT36M0@KjEc;U}jkFUuY}@BG1w>A>dM< z&+rZ-X-B?JSwL`a8iVupwmomM#+a&&-t}s%0iG}?uvXv%)Gkgy z-C-^?89ijs;^JhJhDii7-Xcam1!SMoBHzA@SS8NWEax*aG+1@dQVt-?<2-_%_2aMI zr;qZ-hxZ#@U(}N$3eG3xkAd2Q-PO6Db{u1W?56=NAq?R6++et|^^f|AK!g?4mou_} z;B+PvEH30FU`=Oi0v;~AIL0lgz0B!3UTEm@kLQWO+wY+KfXD^H59kBr_VBXP1odvd z6`Z8lVSwf{J?Y&6A74Y{LG_te>g!L~Z{p3LKyvB=(3>|fe)zUd*KKL>CSJPcEjSHt z^7Z}W=Py6~{P{=Ne9UqIhmZ5ia=JF>wrOGdAtxb2!bo;0nNISKKsli8hnzF?SwMfc zQ}yeo#}9#gr*M&Y2K}Sw4!hssCe`C~4`B_ko9kuI(Vyk)P)_&Fr$=@g{R8>zog6X1 zEz&G@8E$0Ab&DMOmeTk^tLCqRBqTdKaDz4_2JPSjonZk%Uyl*wy&p7(ebC?z*%(Py z?M|=yKltI}=g&WX(V%u_viFk?G+?6T2WdTI^W5Ke1V4A!?Tnh>KDEqsKcgUhYffxrI<~#wuX9T>w8#(K53X*-0_b#7FUhey$`{&Tf(NK;_ zIDjjYQKK4|>^`)z$m76V0XYFD=+yd*H}&syA3<0KPL0ofhw+ZMc^Q}hQ6uz+u?}Y( zh-5PEcl-sMdbB60bhimsB@H&5R_lkhxiozX`p})UqJ?B}jKTLLE|W8~(8{C(0|`zh zq#42Eg==D~SL=pJ@lxH@izcup;vke5kugrjWk=<*f)Y0$esRK$umlHmSRG;|_6rq_L8l=o}DnB6w;tAq7 z_(bMuviHcVfXNAXUYsyy0+Uz=7_P`k`i|piGt4{%fXB&|B%?E(Ph{tSdqGPdgYO#r zi_EPA=@j)c(T58Ak9S_eTymxdX<1RgtZ^} z5L4YZARobNNXGgKsX>j@t9m>IA9SKVC2}wc5N)Ty@JsUCuSp z^fr-E4mC`T*bo+>jwPHljFvxRm*dQ(So7oYrV(^S&Js<>5G(qnxH_|yIOY!IdHJN zO5-3u{ssKaQWQaX%ozDH0kb7QoP3Z0PED6=%b!8YQ#2{xN?gdDa8n49@An^G{u?B5 zgfdeGxvwG_3F%{TuG}RJk&nq$GUPo`o8iRm+(}!a{Yk-QL*hoIi8{A~s6>*I&W*yP zGDlFB)C$FN>cf!MDWRdMi3UBBxx^u7)I1SB5|}C{D5W+jXq*CC4sB6l&zjF{qOYFl z^OGZULTywMzn?UrN77>n1~KyRV%eQBq&~9Xi7Ii2m4XxHHfg?u@{o)|RC%Yoa{5lC zB%(?U_$%e`RBk?BxxYV1OUhO9B5iiWF4@;SipnQN z=@T_VF^W=TUMfap@bFbQpy=QAPvW^5xtdty?%tBg7m(#nOv;p)#36LXl6@F&Qp74x zgH>q?Pv2}vA~SNSxK?l zu$UW*g=D18QL=Olb!Q>Vh(R#MSRxClQcjYQu2O^cZBqCo(fo|m=}hY3qMj{@TeYZp ziyE_3##gEi;u0Sn>t8dDjwV~j+D+yV=@2SuDRa`2nzpF%O0L|aOqoZv%o6{a6JIJC zUmZgr8>}#Z>)UOIC6Gb1+<$hR1sgvwMh)0fCHKGfeuNjFAOI;>xKOQDW1#Wx3- zR2^OD?~6e}NkSNk$~i`*JGc}|HY&`+MOj3pl8=}OQK+qdp)8)lJtOp}5b04N z@}%s@o$2Y%QaPt6HUE{Wa3dBC@gU{Lok(&wgUB`EAXh>{?n}enuAT= z*+69Sq#4}_!0CB^Xa2|6M{k}iS2=N4vqZCFF-Fk0ndXI%5tJt2*Os19^wUC|T zo4GoB!Ib5jHw#HRM&hx=n%E6boYxBCP)Qn4q4%5pPpnj^Scxm1XinP}HEK~dl2Hm{ z|B7PU`C{qd0^FV~CMzh*+^QvWPnO&#nn4n(U5l<-k<Cj8vptBQs8l>=cD;qC$sUhtLgOawi$_iBaWTql%;?Pz=B@GCyGrYzZ@_ zmpBz5G$K;0R3yCBkSF~{MM|836l%svq?Rz54rB{e>itq_ritTYf>t!1e!)rwERP~4 z5y{?i!79iyQJia}DJNQeD#=LMMw!N?m}^U6wNU7BQlTD*LiYm;-E>g{QNSK?N3c+9 zk1)3#d*}{fAR_S&4$ zD3yi#*r+Q_p-C!*Kaf0_%$JAO0EMNi=u;DasaPLsOrOknv^pU_35=sOBKIjiC{Uz1 zIomCDZdS_k0S>W~o|Ma^DJ@yy;VkNbllb#BV$I@NN+Ug08qk85@_;;>gdWe58|6vO zZ}ben>~RteY$@FgC-(^-n(8z3koNzh>d)E~#kMYB^q!w`F20ApxjT_vW$wzZGPA07 z?VImGK}8V^8V&vRXO1z}ih55*%A6=7&0;k$8kf-GB`IH_P?5r~Mg&5J-exmYFCD?*r(9>pC5cONL8Byi z<7AtB2i_&IP*IgoQHl4OiG30g73JVkRJ3BZJEmlg9g+Y2_w8SAz6Ou=*iXCQKF{kV zxR0mtP@n7Iei(pWxVLjxpM#g>uk2 zKJJ@30Jj!*wQk*VzyqznWhWESS0=z6K0u^~239a_4SZ7|tUu)Pj1rMN~ z=VrG*1b;k#tl}TU4AD1c3$PM#L3XhL(FfmZi^B+L&3M7npbOkO><}U1Q8*$_@MW~K ze*`LMfrJapt^W7`zR0I?C zuK=RrUsO@>-L{4d^zSvL2_iv(@Q{CeJn%dRPbDS@GXVBqa6wiik0Z8y*&Mvc^*UYKtUenAnvB|Aj488)801(^Iotrv7K|;s=2VXz^ z{^{3Kz^7G%m2oQM=qkG1qs}4w?1upVmo_@egiUgs0*!Itd}Dh?u=l5_dhS}?PC?&A$>`J3mW!z?Ds36BNm!z9fJJ=G*bh9SY|6*qJ8Gc-?Sn_^!1`P~!UqCC1S{^Wu+>0{?_O9@ciy#Mg#?bG)s8zBYn8)4fNVe*6L^0xrOPB^>oYr6lnb+g|93S>nKGz?Y= zjSVo4+u+P&Zly1*qs&+63Vc+p@du1FxWIU)ZZ?tU|Ib`F%UxQ_TpZ6rdm9 zzCcq5kT)1G(S+&U`>&sV;%fu+s~Woqs3f%O=rLspb-o(6Pqs^aw_Ac{dx6#DyUjEl z4;%aS%>=Y&vl(`$%`?zRwsQ^57_BlJI$Kjdmf!6_IPt>m%g&D4vf$8dZS1iuC>E^L zMnH}p_y2W0l5P(O(PIUe?d`X}-+cS$r?5y+8R{f6Wc8$VAhz&}Y8k2uXd|GnX91C> zJ5`7dSp0lhXU0tp!^%8M0YvIHR=~Ey;RqNUSr)U9Nq{7+4FGrB<8(ZssuCEP zFw#I5S#S7OLyTxX(EjsneOU-j0*)vKdgw9&MARQ_q-CG>Ry|;G+b(phHg}qB25)p*A zNSr9B7pwTU78VFp(ntv)ZQBZ{$hJu8;EBVS+NFZJEFBi_ia7X<6u*47jN znr1y1AY|+9pF^@lFR)XZX~R};E*mSHR@LsUS7E!fY1Tfd+@0_Wcgo8OkIYlMvdTFq zvlx`U;>~Z}AHN4h9%n(3C6!In0_UO#i!jJ#{Tk#|9fx(0mw5?95-N&pdbxl93N@vS zU?q!qOkxolOK=`YA4%GWc9sE2vPn_}X=2|@@lZXD^arF;8YGo{n3Qpb7xa~&&}2mz zEXYKUx`|1u7@Sj+WRvu0J@FPLNGPjRQB5hSVreT?(pJh9V&~XIC=j3S6Q=a)(3E?8 zQX+g3p-0kH5<01nJCh!VCh|2;yzz*GDHT5P@8pRPOQ{Dcr9vnr9+*TZlZ>O>Q}e_> z!*&u(nGi}LgPw_3!kc(Cd191u?*Wy1;U&5}6%tW$=1Y};B$an@sRSIU+#SQ%E6vAV zU_LJ6G7semRd`RRR4!1mhAMO6mJ(P$1+fbN)?H^>3o3y@C?aPKjib5&?1w z5637RT|3TWswELJCaVzwoI($2N*$J|a%xJc_isu(wkZ~XDOHF)j!CjgT#+_8_ppnc z1t|6pxoO>0IpC7!xiwjp<0Uv!!ayw|A;2;(>68gjkqPYOMJ`-Ia8O!!Fp-u|{Sx{a z5`hUG3I!et<>6F#l#ow~NOn$<#{>xsBs(WPR){@~T1gShw2AYn#{m%;B&#SvbP_uY z6@w5#F@u)$ZtoB?qC=Cm%v-+G;VD&c&>_u54g*v<1d$dh^r@a^#(FRvC(fcRhB^hF zSjUN1gGyAAJ>S|TLK#(wG?FrfS79W;f3gfFOmUJ4dK7#0qs&`D6+U@2hjOSR2_s1e ziK;%5qYwhADg-=A1Uz~L8Wld_@~MDHs*dO)CB-B{dLk!^B#)?)$Rir7MeZS>OEQl% zDt(fB^C+)!R7u=OIHFV`mcCIXFi|B85%4~EbZfy9TyWBbkZV-s07Mctk|M-rE^Ak-3}My2pb?)iT%FjX!W zn_N0gs@Nmd=Lq_WOgkcvH;sfhmF^LNMAj=J{)oy}lEH{%%7>6e4y{yVJ|TW7^jM|P znNBI8Mw1>R6PxrZX_WgU^GZezs#GX=K_h{j+;LHB5M>TaWrdy)G+1;}*(mpdMxg*r zr9$C#jXaV`ep98eM1{~vg~W^sY96_Z7NDid8BjSSlTbt95=ttTCR60YEA$CCBziw3$YN|v`V4ea>8z^cP$d;3uS687 z%8Pv67WpbH(ghv)nj@kCBps=|N|M7d>Fr2>CnwnjxRC^q@Y~)TR$!x0o>b&S2tZU3 z2IP>Yp%*6ewuL|lIm0O_3OQ|+ijca{n+=BEW6&j;Pl)!R5s!uga-7oJsZSC*MS1U| z(p?br&&oXj=oJa{`VJvJf(TJtu=I*V1-+&80nL9(N#T@E56(e^_)bDUD{ov>NLa>; ztcJd_2YRT?J%}jtN#c{(;feGex0QwKi33<9+=UEZ5u}I|{fiyS9b~BT*dgqm*TfT6 zNN^vA+>j}2D0e}J6v}<#u|vWIIZv&eT@HsODt(f8z>vg_q}7yp;7I28U%mV=bHgNH zizJT}3bvKGTF7CEQdwU~AjxSWRX!1tD0Sc=;f&liWgZxog|FD4*e8*UvE0U{f>U{_ z0MwH>?~jz^O+(3~zD^4?uwWg>azYI>9WU4zAm^w3Jsz|JG6d_A1&&G7PO_c6%#uuk?HB+z zynzgDqybCR`)&(^Eh3F1$iXeV+=GD@u;P+5fC#Y7<_z>*O7g?gd7&;pZ+y53oGz7S%B z!!=)Na0d0E_2HzBN(dcMdtk=1Jv@7#R|!(h>lQvQ^RhPGn594)jpq%+sTKI>j^~Jc z7Kyv-mH?=;SV3J5(lWvgX^VLBH;?ObXaQpyS5Twpae^v8z(hlKnUm=61VCZ>iqH_`pdgouQEg9|Jgf9eP+b z5wUc3n57z+B@6rsz+-@O!eb4t+P-e*HAd0_y=2D_p*~Yf$*vw?nmRnElCM`3Ol$uL z;4?SfAyi~19}_xot(!Yu6jZY7yJtcXrMcaVH_VSaoE%tv4V(Z1#ryq?fnBfL1HRE+ zw(DeH=m^dGA=M>Ys@rVr5KOz_|LKU4I_%cny@$Ti)NUV?RU$?Qk5>tX;`14ctdne+ z5u4S@*9xd8UNBR=0GWdb0`yd0fS{o&&s0?aN#Wu1j~aG>R>AzB9@7o6;nVM_K5$>^ z2G1H0_+)?bHe$C{P%322_T^zE4<2LfWRr=ZNEV1gkyVp$cxOD(# z3#g0%npKl^l?FVYoM~`olb!vCMw9IjkX;iHzvp{Gkl0y5-UwFMi&r$)e}gmOd;(}$ z894)?#aU=BoX1^`LECxUK+b7{N4JD(0jIS+M8s*Gx&=~AGoFK4vkX-_gpN{80NSl* zq$lVlAc6SKxueGw09|DCpYagyydMc|JVU66c&l~~s{c!HuCD|ioZ(^9A+8;;T=GR* zh&Qx&z@)WTNBk9b*{`;8q@6%0hL6Hne#_*{W_JaYnEh=Qfgwg22H!-~Q*G zS8I|1EcRj(yOcj$_wQhxmflVt9I@;W;Q@QUZfV5U&nwM21M8GY_K7DHWp{;klq_zn z<(eA^o%JJdL4EgNJqx|DX~pLqMOT1Gz?W@3GoBekeylyi9q!!f)P8O$K-OEgZUwB& zj`GM>8=0VE({!H|Y~8K#NW5g>W)lNeDoZO;nrOUg!xoFDY>C z$F;u$=CyWPzHK440L{a}0m%R;vx*8BvGD-IO}NG(r$63tY#>)fce5jL4r6dUo!4D( z?ABwq%q#F`=X*mBIjpp$HYAPYb{({=nvTv=$EHQOIRc{8NUn+iG-$^_r3xxkR>E&} z&;fOXD%0AO2{2kDhZbl~>x#FK#X}=W3>q%O4#&ejYwE)oSpBfKdhT$?aX74Y9b>HE zFzXgJW8W;6>|2_I9oClGRSj`y*7>7^)dDQ`!C^kFzcl0gA{l5;cL`vvJ5Ds8+n(m& zBMc|eH%1q5>R#YM*I$};J_(s-H8ljOEX9k79V*+U>%EaN9j4O)^{P8DMu&PGfc-ys z=`y0%>?Fa=jUYOlaGZ^Ub${`)q@lwSI%ZJ)*{?vq(2EXpR{cWe34pCkApvY{o<{}P z4O`Lx#Rj4Sl&Y-Ry&xP~f!csKbC@;>TmeQgGgbSum(d%5Znmv^$a~q8)ziL*GUL8m zAvU+~7VN~{!``5K80_tcFVKG413Yf??XuX`0OqxC4^szqstLHEy}*h4+WK7kFhtqh zQHBbavNEf}kT{FE6?juv(Lu=2xzH^w(Q8D%0kjtE#utz%ph>lE>(z#IJAl4#z?@kv zb-;AD1B{Gy5sm4DU#sO_XbFZ6A3F65K79J|{)@Gcz^&Qn0FX7?&%mMD0AXu*CO_=> zFA6?LvMPd|9UHcto&5TM0O!mPg0Vri$|~+Chp}Cc+6sPl0J-dv{lNzNI|ytM>;=Ud z>R4F?-Od1awKI@wy;WK^#zKz@;$RdAYkTS#T5Ac|Xxp?s#<+mEVKn{z>9^1Cf7+a# zdsMv5Lx0e_0wTYWaB;&SD4}j7k2G*Oe2m^EFAo~Q*??zTt!Hav|M#{2@MD1ypBe_fWdXp-E6wvN_As#-_ZcD zK?4j-TvtCZ!C6F zA|$NHxpK)H1S3%<*5Uw_y(L|uGN>J$=NYY*@kB*P%Rb>^Lr z?R38o>4u9Cu65J69UF{bx4;hq-UbjH)<^*^h!VZEu_wIZ0%s>4$!HIN9iZT@bl$Vd zwO#1FheK)Kfovy0aTh`3AUlT`d0RdJ=lVv*esJN#>VX^!wy@8m3m-t}5axmuD`Jaj zXKOtj0c5p>4t)n@trg%Th=3i|&1MEp?hX}U2bddyoCDMz2sx-E4N5Q$2WIYcSAgK& z+k^G1hGs7uT?&kz4OJ(i=q7^dY`AS5%oPovq`mkydOfvdy&ySukhU>U-Xjc&p;En) zK7_1ZCzu05c&j;{jxT381TJ(3#H7{XN9#i+FNk#ZvIw*h^V_E%pTGSC2oI*&Q1+s4 zpc}iswW01tE`c@}vlkLnMw=C8y)#S#H>j3?#-n`U#>S~Or1pk@kuw6EgEy%5F>4)c zP^)lWPcjC?*g4pYj}b2*^iCvcS*MjqJ*(O+*vWA2fOjJEz%tqN^`mV({H~@%mlV24 z!~yya=W%0$3V`3*>5dr)z0D46N9C^J*b!`}&eVp^z?=8&=eHkireQbL;>9-dja}9~ zZ2?!H{c4&qw{#V>Yid(Z(44l2L9Kvw5Hz#?C8!V9Ye0)v(@5UhrY9x#1_(zh5OS#e zEj)u>^dyf#!so0Wkuf3d1);t*umcX&t{xjy15fMVazEiZi2CnI=7U(QhD6%dsdweT z$=&C&VRkL z5(xjnExMZ$4HH+RszkM}o`b3=OYkVGJSne0)fH((aGe#lGEQ^60vHck7q7^&FwC+b zfBUg}R|a`i<#+{oUVzw}<$oM(xSnMhOkHE%pY5d;+mZ5q z3}`bvU-&=zV5ye`D+Rw3yiQoULUx6E07k$aQF!zf1g^trguRM|$=py2Mcx`Qavp~S z+&TLr;$R{H@*?keNHau2?5fg(^SG>2fl9p7hXdi2-s~`u%V8zSut)&BQb9Ulg5xDl ztc=fm7`PB{8S#++eSHpMD0vfYS1LH{UF@-UrBe%|u$M=DRf3^ZGNG%4%Bj2vQso}^ z#*&tay|j!=A}NUF4y0GTqV*^pmP%nP@*n6yS1iL21S*PoVX@Rh^1OyvRrnRN;!&S zmd6wvOE3`xF%u#)6ZSBZpi<@?IWrH=@}e~^N#%+tA4Ex!l|u8CdF9O!bDv~RicCI; znZE6`=lpZQ*qf@vnMbqv2ZXWrv~o!%Q89kN^X}ya99%G$y4WjRFcVxbc5uP!RZA@Q zaKX&mA4*6}5W!4RVwr#2;TSy}1c`G*)Z5x3r%DhfIVM>qWMSq2g;n8^g?uM^wM{Gp zG4x17nka_CAv$NrM6Q5(#>fykNMZGgEsSNUD19>ighyj~T?0T2rF@q9FUFM8pllgH zf!1!=3n0SS3zrcq$ZfUYkb_hoQ)!6>+l{@HTkMZ|EUVI3B|LT_9I*fx2x;U1gtAn0 z)kN%lCm~HE2%+;{l(LyaXvW^0H1-&}*dP2TMk|^LYM3}}v&ts~66zpBnZ}EpRj<%P zikOuWK`R9&EG21HO1F%vLM=jTG^LHB zZ8wlTRZ`N=5gcC3?pzzIjos zQZS^F&`^hB1eh=*IMKF6V8+Bl6*FnFMIN#ED$Yj4V)?K4BL&$qskCMCc1#3gOeDUh zK279hI*~}4E%x@0N(gAAFJlzbW6_%qs_A1$yjGhWAO(C3CE-SCE3er}45S3xWe%AS5w`&iORaC7I|QUW~-QCAvxy*E=BEF!4@} z{G8Q6;_!Kd^Ffv?wjoapSw^_6+i->^vbeulJ4Z%4qq)NrcK>1vpPy;xm^l5lNC-j} z=-At3#{SZZg@h$)K9^CWOcTq>feWR!CiOITYGc9sV(q*~%{%oqC%YC3g_wKMwOjy1 z88S-HEux+pmCGoYhPpE1z%Y_y8j*(_eR%=4*e8($*A%ciFZ|==)f@;hlxL&F*8JB} zhfNe@F_mgtBC)opbOGQ(3XkQv4V5iG=`58mW93{My+&H`s*y$*Blj}&%5kAIEossw zl{6O;uaPEWM!oGSvQRZZ=zUm2C*>4*29-->)=2cEFI{3#MZN{2XJaVAG=44ii$%1D zb7qb}LY5dg+ZN@7Pe#%}quZ?v9*LXu&VrSfV)A%NGbee=~m&fYkm+HdWu!( zo$Q_SV%^Y)Fg zOY%gJ$I>gSRX%xrC-DitTx9K^1 z%FgvskjaXQYPoQf1gCO5m2urqev;J5#{KdAU#IX zskJ2ul+WTsx@ejAe|$B9^gu>xoUyYYowQ0iX;f14=86exxX=U6L-CkGud+#($jadz zb7`cNg_BCFUNzGMgw%=>K@ekhXG6&#ODIi>X`$XGI5^e;h-F*pUEC?0=3tT3Ps^pP zmMJ7SpYiMONV*Oq2Y$sBn8<^GMGOt4S?{2dN{E+~QzT%Mxlg20z1th2;MvGPR8L({cIgR$02lVKz$z2kR8X zH3W41aoxO3mp*uO0}zjG@MzCFNTEFH8Af}L`Z>bOk^{|=?$>2$VLp3bPhD^y^=HXS z{N-ILe~Bfy@Q z);dnad=fReE^B~i8g?9hO+U*I1vKI=z;#a8)*kUfK$IoCFC9=DiXNIRAA!>}6S`JZ zgu@IRCYJHMku;p0LEtiJ%4xMCksJJ8r#F6eeERb1({Jy8c(iClfas-V$Ur}X+7xha z76AwXRMfhGfQjN201FFWOdxI|fI(Mma?NL{OFbRhw#VDU(LqA-Zcj8N#OLNiXYqKp z;%IxEe*NoG1oM5UL5!cFr3V-vk_#m1c7$XCLVE4!2Z^-7L}>xw=xzs8sGfBqX-|MH z+YvcKgbq(eB8k=kCW_bwKYzV{|M~ropA@MBrUo&Rb{(f%AT#YsXz(N2R14aiqW<0~a!n+pb;iwARF@!#M6CaX1ehkd_2l z&F67k4tIc4mxJs!@4NBE!fNNomg>hFWxnRVtskxIH)%(Cx&yMh4$!|lbr*m+1X-mk zr)*G!Mg>sx&;ip2ijRls@nx zrgT_NXC_+HyDaSub!an}N>au$Clr154-zv1FZ9E6KWG(4aWcVf8>AseGVW1)C5-asf&hK-yRmXhhY5i^_IU2#-YEbXUOlJ+TK0_vTzP) z{Tc;hE%`LSu_mjbEt%^hyfT3U8tnWvQSfzm+CTp{7><8z|4uCoEx?+`({`AjA+(1^ zbby4Zy)0>$2k^JU?!N90!PobH|MTs~@4?VoNpen{cF-X9H?;kXs%mI~EwZqsBj@IN z1n_yF7u;Z_2ritP78t?%u08{&e!f$DZr#toW?msx^<_lMK(Eb#Q$9qsN{eosKr@`j zbGoMIGnDtn#d;eSonBu9nZAa&OCVPxYVJV>?rhC>Wux2*=*?Tbo>~X(>{gg>>e)UL z2>NwU=z~cl{S;z<1WBE(B>>d5-tW5>DAJ~}Cg7Y` zyM25MK96J=U`bqOO!}UI7E(wyBM_8GIy*>28K(*4{ZJZv+Ux?bX@`LxpgoPM`_u8T z-$CSWmXKdJK;y3O03Edx*dMIsg3G5JhrYeg7u3qc2%pb((>CZVLG2HcgY_Nlgk2?C zx+XpoI)Ib}BqSn6heftoJu1J5nk*HgN!I}pc~>T5rac#-McP05OWHLQX)j# z=`rpRHb8(*_b7EpP~tzk?PyIj`ls+L9d=hDKil9VfSj}Q7HQUPH{ywhBKG+Kk53mZXK$pYf#me^c%S1l{CBc5e zL9xKLWIusl1?cCMQ+{N1>oV@4U^qO`Z0*P1hA~O-+t}}%kYN!M-zjxNlp^3jn>`&* zH#9Zg1Ho?B`o2RSt`*vIW?-dZ9Z?(n4fw#S=ihh@!PIoSZH@=~c+;Z~1FzC6j^uB$ zFr~QRwgU)Mpujy;H21(jwtbAmR#-j0{!D}2eK>YI3%ltEnhlg3K?EW+6gBH^8d2RL zfkNvpX>u<43}rYJgp?| z4#RTYJS%d5z1t6qofSKdpbA<=w6kh#f*NAG;Sl)4yDx>6hTRrj!ZFxcW8j=i(Lw^6 z++N4t3Xt`c8%IkQzm+(40M%tXlMhRP<+XLU(|~H2YKQ2MwBP?aZt|c7I0EkjUN%rYY^9S&JE+zkfOuiYvxRx8olMjOw$^vnuN5{G7ad$FAyo(i?ciNw{~{<9+8CPt zvJI|3*rr+^kNSiQWV{3RB2d5epp!c@Rjae#J^lXe*OSdRz+*S{2FSv9QLk#!MlDwu zsG<)RQOdAi0~@)_2Rp}a0o1&I?r4$+tQjZ{MwJx~0M^P@6QVk0n}I6QMcq zghH*be=fpxku5{{+^yvIEkGDJ*b;latvA#?+@$Bas)Egm z>vhAL(GJRHB|6>0p2V=t+78q?gpo7U1g+e?SvMQv5U17F^ybI6Z@+*3=PR(5qNlaNjV-vHl9~jGLhD_zhqdYUH_G8!vfR(qNZfC@c^JYGdRb!|ewwoG93glK8zFI>AjA%W$*#Z8?KwpkPUp6qbSH{X6fXupw z&FYPNXsw(o^?F6~1bss=i=Fvu2QZ_xR#u#!z(0V7>eD<6*;voJ;jp){Bte=705d1v z;j6(lgy`XOG~eQ;O@jI|br@~cmvOdTf)(ompH$c?Tie<8XG$O1h<2svDzSx3fc89M z$7nP#0o^%ucZL={%lb?kcDqD?|3?7v2MO*lz-9qd(-k8Ynzn|vx&5w=vOIW#A^l9% zMC)`~aVNU-sk7q=?_E$Xn*bG`{hU>#wq;uzfZNL%wqn~hyAzcZw+&uFjmM5z3IuDd zhmLjdr2b%4hEY&uc&1kYH3p|BONAROOIm7_#gZMG9WbHxjS|m6$|$H zjL=ESvUGi1Y?m`UX3P?+KQlaHg;G$E;h9E|3eKO}Rum;5qY!XR`4~H{gEWSxY#j1G z#2RB_O7X?ykH4PBcR`Yu?eWkZAlsN?0&&F*TPhVtKCtv&vZ+f19xa6e)q_l8N`)bf zoRT9!n2~#?MPu1aL2k1Ufb@?YU6T348P6(EqtSuj9CnmaiJUPeKw4GkCG)m4|FR9A1k#!lQ5tj|eNgS!^NX6hi4?qQr|5eygXT453GhN)@tlR=Bay zqFgrBnw)cN;W1T(mnke9W>b2dIWay6a=di_%sdJODW#Kb=>xH$rI4XiX!NF2)PqdD z9%SW{R6>x60HcZbr!9R__#~%eZTxCb>+EO~Z$K+?NWD$0a^}rTGaWkbXc&9fDS|;W z`OX%yn~j{^tXyoJlwjth&6H%71B*&k(rsg!S9l2%S~*OpFr(D1)Z*tCqH%AQGHhrnTZ~CAX0uY)nchMD^q=z`jsS+ldg38 zn|e%a>OET%FPNHW?-CCiPyBBB$Gn7(W)h}!*0z-srmS9FZ8HxT^(vJ5DEA*_&gs^z zQ6OhQbYgFW6?+FPs!%!rX{sO>Tp>kyjmDCEjQ!RUXz9f%3lACf&bI=Q7Q%i~+BDX6 zWi5#`CsV&rD)6cY&Hx^%uSI^vuJVbUnPV(vE+Ruy4+t#<2ra#xCgBFAPaM5|t|pr(CHd6fCn8 zzSC`6D3{_;(yty16MF~@WhoZV_f^z)wo5j~3-C_BFX4|_!TPdtrP^UMeIhugFe5;1 zmZbx4>H`Pf@i-U&IJJcHhqd;Izva<(a=3rvvjT0ZIoyDh2Q=X?@P%5TKElr_3Gd^Izv(eoac5Li3dZAgb*W&{JSedExqP zRa-@jXXV8xW1kSrS$f>2LmztM!>I6>F6kIYYKjp4b>9sI@g&kS5;&CD!s1mvlTxID zd6t!T-gS7+O2ExTh|OGx%}7Aa#9Qr#9-Nu`Bo<0D@+i$zC{2Pn6Ja!YP_l}@3?N?y z_tdPS!e%DbN*+vNb$}dGQVO0~I5A6Sy{q|*3JmBVxDx1H2qDg>%$ zLJ-rLD1_eRm!F5u>sM=6B7fg165>-qP)}z->RUlVLA_jNRe0S@%4z0u1kSX4S~-lU zY<=YqOc-5~6nIevlQ>ZM+a?4m#xnAaoDwFrBb^L6t$n>RrbH+!iBeV)v~-)8Nai!~ z2=K(i8X<@&ol9w3I$$6GsLlmAa*)!h@YvE!hQQwSw<^8;FTk9Hh30esE~A{@y(#7J z0UpJjNjm>}-{0CvTQ0Q&no?1ch|}g@=;`urii1IIOX>DV(vnEiI1vD~^f=Ti^?+1q zT~-d4T6lwCB2gB#OW=C3kP}2U74#Yj>sl#99`c&`grHd23WrXb)73fN$X|smYL`OUtA~;{ z4RsDfU)hK3FGYTk=@KrOIEZWMaIdd`SD6EArP?Fb`Y;PFB@F5gyt4`}gnX?$@>PIW zrzlE~VeU)i6-5bQE#w|dSKrEG<|@~wQcsjZq!}HFWew}i1snjDNnCo%;eWk{6Q4vr z;g=&}Wu-NWtu4b!a9R2bmrhL7qhg(^rEj=HPc;l>dhawry*Mbg&uc@6G891Ig47fT zTvm#prRD?=7b2G5W>1z&2o0;nyhds0f8FDD3$N^%=Y+z(ii{EuOT28P-07c+YvDYK zDGgc)7F!A{TRI4>vn`JP)g0B*&K@`?8z}T`wM+O8!K{AF2;i(_MIAITlh$SCbtyCH zyJkXBX0ij$gw+)hLY~C3B6e`$jQ1a;B`ODEcU&@m#x3zs+SDgR(dHB!#lHHc)43G; z$c5HN4rG+#%1Ebx(=l)aZ%@N>@enuT!s^m(-sMX(A`*wT_SXIkN9=|&xt?NiF39H zJ$29}g#Yr~C%&jAyhVkeH6;4J1Dz&eSANK)_eZW?-H#KWgu?FfgPafd9CkPN zNhlC+4ybCqKqBv1^a9hhW72K0kKTM__wv+@lAMH@?}Y^?4-1mq6e9bHAVRya0rEnuGgh zI-Yh59-rOoL3$7W)PP$CFTk7y`pw`a$*$$+;Khjx-bSEV;kzucrCWyw;rPOgH+wu? zu+S`rPRX`jqTp{!-au6CMtfxo`@M{toiqlLRvK`YUM{xIzYp~Spb~tY_Y82kg2wAM zDz`E4zY9#ACuqpr1e^Jr2w(t!n{nC&H@DG$jdu!^0t8IKgzNFX0RZ>fEp&N?3-p5N zzQco#;IB__e|`G_6KFs*Vf_pXzlYO)ZQurd+T0=Sx;t!v-n#;AN-bDu!`Yg6bRAB( zfLAnyVSy@Z9}YHrf^+nUSMV2}l+AzkGE>tn@~s!J9+8eO+emv-NI zNU@c*c^%+eZlRe*ppStk4s)MmNB}gGL$(&(+{ST7F!F|`vX;>1dAXknHiiOeze3Iy zM!@sZ5j!tmO$gcUC}exyjKC|`#4F=I%sgL~mo$q3J*I{Xu*ZO9&X;cL7H61kC!Uts zH08e7fr|s@n?2W7nf(0r{o|+i5Wba2s}+MSmgrl+k)d7*McdJ~XhAr1ymJMBGBM2q zG@%%7{(+ZPB=;v->Aq-qIlyd19-U!vabSL7Mg>K$V zBNhORaK8_x)2`XSWq(>Ai+LuL%9 zW*pQXarN=}4~J!T^`~Ys7ZaI_Lq*vSx`RJ%WLrQG*V>)V!JaA1tQ<&aJ6KR&etv$w z-EOT_H-8K^{vWB1i`LPS%X!=e&(SSzlPO)Yd%hOIcVeW0kfw_5+QaLc=8TvBFC}A} zz^>9AE!;15GXsQck03H| z7SIb|x)0+*VEN@>*T@+d>~0G*#-$wr6Nh^4gmXoF^{ZDo4?JdUUEiO60#rTGQd1G( zgfndsYE3mz*r)nP>~%d;UYCdqB*atCwY6U(3ypQeiL0hQE>z$k!EEcmYG74vuV6fM z&{Ti~SO(bsZts%Mb*AQn^&f}vP;XBmbanT{Xm?hNEf&yd4{&#Hsi6zS zQh=y$0G(Pum1luMyH<@@z5n%H`_JbL;<*QLjD~tzmk|=YfW-|~i8m2KeO{-UqPlAVPKq)RLh?Zw1ckO}is}n-%hzI+9fA71Eks>NHcQy|x@*?C871yQ_yt zfF}dQJ2*?jG&pxJ!1bN!x=P&kB)s-O&u~OYiEJ7eK>%ctR%xa#QRy`26j! z_g~)gjqPN0G?H{xV9y#@@0nn4u#e#IzQxrX(#sucyg(c=0@hEccMYibWz#)Q#C*f- z9Rq;AjsYz zx6*a8KFSDexK(wl4ZlxgQ`>>IZq)BzKmGRcS8zJ-lROJfJy6%D5f1VTU~`N#lDC47 zKoFSKm_RX|z&Vlj@1&oD$o&ad^>IbNIrz^ybXKJwpX2oFHaOZa41%9WD{&*leUGRG zj@H+UQzE(Td=kptL4^0dX+ER1ZPKouSAR27- z7@p}J?l6pnZtXh3MZf|$4MJOnz+LYTz**nGfI%_~P`$u<*1~24vKh?_zBO7;-lmsR zx3^$r{=qb?43$(7asA=4eO_Y z1JKj*9=2!$gB6bPx6>Jn01Omos3#vNI%9kD(H7i79`yhW*tADt9UI!qQ^omXU4FP< zg8gH-Z*Ds)1N#*+&nx`aVJF{C@Rg^GH^9ovz)|1c8fWNh?-KxAO@i z$$pfR{D$D@aTtZP1`a#+fb2-t@&IDDXs~}9n+Ja1-XLfakZg?n_GpkiFxwVC+NhIO z(v;=J$Z;=UbtG2DV{5vN4cYdG<+AA)D<69su%6Cmi1W_SAP@M9cGP}*KmGHeg;PKdw}fm%HI@>-BsT8ZLEQnpO>+rQXM){&?C3}T|9<-V^V7Tc zL~XM(j)c6@9h9O0-fqy7-c7AlJ9}cc?VFQ>Reun`9q%@PWx}E!x~zy+N5YmKnC@|* z55}$s*mwq-8{Qf_>qhL*L{q&N<5?umdY+CJMX=jlnW58G}MUVC=1ZEKHhAVsa*aTsV+zu(_6E@x-DIrhiX@(fL0 zaEbxgo=-NJr1=k*dQ5=Cv~x3K23_T*V{vVER)+)CZO83&UYec!>M6{7ZF_cb8v@>~ zYXME(cEGn`vWNYs2YayDlOt^>l`j=~mnW%-8JUza4L=9wVPX&X?l6R=I{iiemuH(f4+=n$rp_;NTiv(#+n< zr6osM)Q{jJzJ+ivKE-jxPYu>69xuCK`!$W9kHPlKhvD)k{OnQJMwYZ^4i&AE->)#+ z*miqRl(*e>+d;nf4C)DR-yZwTBC|yghpN5j8nv}0yr3c5YkU0mY|@2&1nklX$C`P0`Yg2mw| z0GeG_Zvh*(OAYm4!0|F+=KYm8ahx}-LjLT;i=WqFYY7h2ennCP3vOeJo}ln!eF)x6 z*5aeFw6UkvEX0O4lHDaX+zI&FfbxRgBND*0#~Y-wH#R^cCS1ty5fuRLc)@Mn))EVZASp4ulfVCNk=h#PWYgZgo6HPe-To8zXXRe*x6GS1Zs@wr>M&ch|plpmyYz8d1r;k$&uJh0}4tMTA=OJ{0$AJ>VtU4k<$uTy3vi>FKB=<~6xpkeO z9E?P7_)l;@)nXT7wq9%)U4yK`k0B>))A`gKcZa=j=81xBMQ`;3e;uY0C{aibkR9%6 z08wKcGe9D_#~9LjAJ9jxchCg4rFJ`TmTGiQYKqa<&Hi}4EEemtZ7l+BU_ZV6{4@R- zSf8&EfWMwFu%UY}*5l%no6YbK;>2N4l~tUkNgCGybo+v`n|uG{RIV{yM}d;Z;pR`Z-Gy@f6v6JTh|5X$*2NO9Z2+O z-qtpz%~IR443&NQNa{Yc>O1{=`^RwzQfO7iK?(!!6c4(pAO&6^$t_EuB$NQj= z0Nf-=j;DAQ;p7uCpmHFM3qzKDv|Ju1D`ux<5D4Zy2eE!LE}<^ z&~$(V5P~EGVv?%G)vJo}EBZY3c=O2P%`=}QJ_$Y8Ja;?fyrD$zT7MoVGhNT~6|p~khKlYSL^520`&^7_TZ zg_qJEF7>I~+S1FXmfoYi^!mzz^u?u@xh#p9h`mT-ERSgd&MSq`YZZrtn^y{DrjRgD zgV+P(3t>+S0?~vx&xJ9UoN(bV>>htyNIG1JvSF_G#4B=*Sfv!s6&xU zjQC$oVgkx@fyQ%wjers$#jDr@#v=j7i3^V_r!Y*3;FNO0#Bl3uW**I&`CZK%c!|() zLc1j|?9Wdo!PQK7_RNEDvyd9Yl)lY~xQr#57|VegLF;jl_RKw`Ca9e2O&r9$Og*4n zTEkiiNdpvGP793uV}S)?c}+VsxfF$k0I$m2qsJ33EG%ev8F{FafzyC4I4gGhY+zEgj%kI>0=SiHg0jaSWjs2TmQny9hnLn{vTCJOI6=QU&%Zz?C4~ z#j6T%;X&Q}fQKs)(L>Ml9n$+Xi3RzNop`WRg$4O0NIQi}ZzAwF-+*du7zzcRF(iox zgQt=a&KwwA81PEk!J+Wqk<$*A)~^$)jRjJV{T={oMs?uCL&FolwuGQn$_N(<9x?6^ z;zF3aD^_}n2!e&XJ&dG$9QjHx(us(4B0Rdl2?(b?d40!e3BLl%6Q2+zUPxrP(C0+F zN75aaBqQ~MGY2xS2ue=`I!`>TJT9GjaN$Ab#Eu`^rhgDNUOCxdfyjk54|QHbUn_(< z=t7glqAxjZ;8zfN>JxsH`Y$>;?@+Z+C~fzUuG$Q_g5Gp;!I4uEc5>-qsI8Nt>@N%z zqMz-{9k&;w=Q_U4NgG5M4zvKElY16@l>cD#0rx(w`xI#i764!a6nK_VQqXok^MLb^ z>cJ(IfQfRgyfmv2X^{t_MZWcNaP-W>&vOSquU?bP0njUtM6U{;49 zZz&yLZ;-77aKAE=1~7Ra5nDmNO^_LaAnKXah)a)5e@#LsOk5FkPI=r?*xgcCP8nr8 zJz|GNkG%+S^B`3yEBK5PuN~iwQWk?TUB79OcvgoKwD zg%IlhLeUGCy3-%76sRv;M5XZQsYHoWCrXU3IZ;v&sU_T_VM)-gJV{xmSJ8 z1-{QJ0Nu0FXMD^0vwABgejW0OLbn&8$EQaQmQEnNu=i>)ov?5!e7b|FbLmV9!kI*e z9X#JRrAoB6)UQ8r!o)(mC;DRSLGjvtsa9u_u=S9y%+r&qYWj zK%5E-4w2)^i5yp6?KtND<$cQDz=+mQp{u60Gy zSa#P$;!hR7786^}*%VoFyWIj|)$P(PXf(1el1L5XxPo!qh(bJc9@_l?9B7SM=F z$vL3l0Q3WiA32mc))6_|1~&ZCRF>RwL^QZ3FGRkm{`=2?&4p@#>XA z>Cozx$FED%9MdtRIP`4IOKfV{LM*mBt?1UMl1Yi5GT`gK(-JUE2dN?uh$D zxjT(!fz=&a)Ef;*s+sV3IwXX?KM?wEfJ^*4c_}zL0qc=Rt~&+XGJ%wH3%|a+fby#|scj>x0p&$K*@-7HH)jITE zJ_5vR3G_e_gq&BMq9i9kp0drNtc5b@2{q6~C~}XO_h5R#;Xxn^3$K%12qRnwBwl#_ zK;igTF3EgC$b2U7eI~fQ%9r5vg+taSUPQVe9=;MRURu#A-Gs$Q1j18-+KuLv6p=)w z3y+T{`aRL|4(Oe;BhHXHHEAhR6Rw=IO>|g!px0xd-J?vX`O2f_GY6NaytJnoWWslg zVvRuXyiQ*x-bCg|lmO6I!qE%JoVg21Nm2SF^`g|Tka{OeEzmq6?>d30*bga3Y)+dx z1)#kW;N1yFr(zX|M8?2{N@3vLIZK87PFVpGT2Gbh++*sUV6s@#2u1EN^_5Tbj+4`d z9}f`r+%nIcNFCoc#H~JCQW$$8;z0>EoM?Pc@GB3StR}IBt1H_~%JLzlU-yMV=)O14T9e}=Y z$oWbM;q&|^J3)lc6EzU*?@UKkr<)F_C4$Q$~xE+O-wgUm~2x^i&&TngB) zIQgRTLe^fa8R17T`F+;MN$LIRcQm+h4(_kV$UkLAmU?H|G8kK^Sq z-*@?T>2~`yc#MQpJjQ<9Ef%`r1i<@LFYCMz^p3}!k2?6D!0<1@+b+U;fv?(HlgmU~OQ_ zPq2J{cewZk+SuFENNH@mkj&#S3`qE#N61FN=G$GG;qLaW#vicq^TQ=mHwLtV1o|0I zzy5yu{QLVK!S!Yp%{d-|>*c)r`3SDZ$Nu;->?}DPFND713C|sfc|PE@%p(!KQ-6s1w z`0L&0mp|VIS3ZlnLd*-o+|)O_;_2WtTI|~i-$KMgawNmj1y_gvUuW#0o-{{_P~`?3 z^4A@T);HMkTFKc0LcUI$F}83P_WoEu#!Dy6{ViFk9uXZ{L6W^D6-MJAkMxfsW!d2xO11o$Ce9^B3wZ0$_h%x-(Gql<9_A)N-JJ zc;*w^w8Jz4uCpAVuSY=rxTOkrTW|3;U_zAR?iPhD_C&z?-V%siE_fUXb?y$rPYy>< z#5@G+mU=tlWyxkkg)=4s%>y&v;l2w6xFM{(PCKeM{scz;OFg_9{{_zX4mqz7JD9v( z^RrzEgv2*^%=&ZPK%sG7RzRGW6_(*p*q-i0lG|0klL$9K=a!Ipiv+N3J0U&9z3UB7 z$k5$B0qfpVIC1`d{Luaiei9Q;HEv8mV~O!5`7D&?27DfuLxafKaT={)&0~*)NSW>d zV0Y>wR4yjKxt}PWH=hCXod9-k@VtGtvkoa-KHtnjMksLK$s;(eIKOlEGT`Cy+X8=$;6~usICzQpK%ca&kJuiAocG3p(nXvA}w!<78;Y1Mnq2BNL4Pf5S zHMG3p!)<|E)!G@bshzr$$G+DT_2#Cu+i_@sXa}kbQr_(i;4Nr+FWbW%n0Qb|=4}`v zKzEx&1t7!Dog}_F((q#68N|Mq35!f{_ML&I1QH|o`SkVOk0*lR@uYJmBGxLGpO)C} z{e1fJ^Utrp;r-3Jttt79hp|Y`oUMW3uTR}Jf^K+cho;^;mG#=K5>n(Sd{Cn#B){HR zUm2G=p8{Jl)x_4DG(qTwCO z#MEsM)Z*>{c)`Z$AAZGG3x&Q~|eXJwJqjx6;Yj zwTdlN!CUGUTWkkl5-AfN1<#k;*ml7mAOE}Qj=}T0`p5PfJimR~E`JLiZ&TO)2A6f7 z@0=)w9q(n`ZlNB3SxyV61sAL2cBdn8@IW(O?C7m_F$NcFbQ-|efx!XdeOeCVOr*Qu z?S$q64CnvSSxk`UcS|*cF?dBT}%0KDANKXZ=W5hTW;5Mgk%Q* z;sqw=__$xGi{75>KN0j$9k&W`djuk$mzzh_XUMFCey@oD0dU^7_m>F}d~_--jA(=h=)exZ;ZJr2S)XBroGMh$p(Ho}5=cvTW&nx;rQZ%*gI!gJ z)9!A`X1jR=Le}#rTE0Tp+1B4K>>Um0Pg+IjQThoG`F4SK!TJ7Q`%2%WmZ5?MG~fO# z^w2Y3mlZg6P(T&{@Xr*fwB~_g#le?3|GK^l&UOSxsGcw534-U+H%0>aP$1{A#6ej4 zNl1F2YtGhv7@?kiCV2i#j?KAy!7|o#>rtkiwM7y{C!XNcb8H;1maV?uZPbKN)H6(`bK z7j#r1$8OCf!fA#OC;dv$*OxGRjh&y2Z*8H_w zMohs|gYdc}-RJrd^fmy&3-a!4-z;tj{eNEVzzb?yZ-DfNT(?E*6h=h(55Z?4`eU0N zc+vFeJAebQ2dT1en}_vUTIl`uHOP~9i}TfL0%*V6>9Ixau=WD>qjv`vAFRIKkn8)o zyk^NuaJoT&{m=cE;!SX}?%4_OtyAA#FgZto-yOj9aV7}VCt!a#jSSF_MREp;G5Ea$ zcFWqjQ%8Obfc!145GugOft@T;D;Xn5zmJ%}KYm4G{}GNr{6j?^6>$R=KuwsmW%$*4 zcLEW>Iu?T>1>b>9AHWX)tL3L98wrs6&yoMA`M%m@0uAOr zU>;bfJul+t58paVd*z*fOdVgp9`5gby=z2AclOhFqDbpXZM)SB70Zp7RQx&b6* zJM~EVuDO6;0C+SY)OLs4yb!0EQbu*RNL=)~+XRu%i@y(Cx`O#2YZl z>8waDfPMy6qik?-b^tsEhjm6L>ab4eAOR73u)`9NMu^JpKw82y+)>hzKzQ96f9Ss3 zM<2g^efJc=cj*l8r32)X2S~*C8-PF|3f~ckX$d6Rk39&}2Rj*d#HkVw0)ut9Fx)(l z2|$Lz*nyWYh_}%9qvteODn)sqTCXh=8=l>Q!{%jouvLIcM4kA6LfZgPAH+_OUOeY1 zd3~V7EkXmf!`c2rGJXf{0y>T#pWfOC{eLzKkmUm9_yYyxLCTvMt?k&)`%RtXCCCa8 zZwE&Z!I~k7$G5z4As-J(dAq`(CB7eFRDt0*_4Oqq@8sn7_&|0HmK;Gz+K(F$arWo! z0)lC<@5x5n+m%a$sr~T|&2RLb9yUG0IceYZdk#$Z-G=jElVHTbgtGL9<90YQ+chT= zF4~2RI3zuK@YavDVtHoliMidkqZR$%S~~=tts5)_meF9pkwuFmD+K&;h|ybXx3_-P zzQ#qeSJ!vJ*h}?i?b0^QOhzaC|?I%B2 z+F0XE&VseC)Z}X!3UbeSkv!3YhG!$LM4$R)bv> zJ8R2P`@?gAa^$;?Fz6lom!L1;G{4dqkPRT$9QYv#)OE0{uM?RJAbsqtL1aG}xY9Gp z8J6s<=ePs&64o&9|G9j$pR$&Iv5EZ1SUMot7wR^SqO1_* z;SN#y!6sHVtOPaWmjuny!!)UxY%_cC9iTAIFo5&`!Sw@Z4@+vrDR^h|(1*9ZJmcO> zGm7sPG&VbR?KNnQhoe;vO*e1Zw+HcoW7nqJtjN4;hbuV|1AN_@&GEDhHVh;S;zUJzORSI5)GNGnsB>R4g3Dy# zbg~}qtK$9OH11;&BIf0VI`%fX*tN4=H*nswfI11n_6y}dw)1W?W%oO14j6GvBsQQ? zwK$NKy#=a5Z7<+r zjOWX`P@5YmMt4ZIHRQ*)^hTom{Xug3o2fq9$=eRgeuu6R=;s?6XxVTEGU{7vbf{R5 z+jQ-qWbR0PxZKHfP@q%^B2@0X8n;%rhd2LO2hU{4g101;&D6gi;M5Rox7$nbc8h-z zRPQf19l$B$_U)FwKL}_cE%f6IQT(ApDc|Z?*1=o5s7bo8wixZ>7JW&4u0LwxlTNd- zS_m)F97edSAffvYB=YHKWrI*VV(SUXenrc%;aCGh^Ea^1z|dr430*Sq4*3h~@vuyk z(7&O@Vm711ApyN9U~@?gc_dKBN737WHL)z1LsS1oy800kwo#jj23ugkY;h0k&9|Sw zzI_F4;z9BRRy=|jU>%ZijTtr&*dL&_4<{K=D{7nW;cT-RtwXslQZg$r6xfW`OWmAr z=LFLv&N`{_10-g9JsetV95z<;LENy`sI{Zx5-9T9=pqhu#}iXrqnpmkR%>6f-XTa5 zxaSJ3eh8h6_u$Q^-+q1i^%GQ!OULe+W#CXEqC(qrvL9e~*`^0tCE^YY-)$jJ0jdSy z`y1HEOpG&+7DyKd^nsAsufF~Z-e3xX1(=s$Wh}NpM0&=Vr>C9|AkA#70zcZY#bOK2 z3i=QOxEej~A!E&T1KKJ+qG8;o-ca_x1y|wG*+A6-Mm*L&)h|7SA}IH7zfnu%KW0*6 z{(`>L)6aJwe)}kL25+y|^QNWg1bxdE8(V;FV3QLXJ6J(jJw0z}2!M^F?msva!yWgp zpUB7<#mvA(29npco5;~vI(Pxdc84^;m`(t&p8|8E?IXP3_Vf>E=4J0h|LIAPj=idXk`TG+d) zskKp`I`o9CmpkGW{68dR1olHPH`tI5vYA&q!B21AzI*?H4gunl@ZapB{sq&@*BXGw`nr@-lyU ze%bB8x4@J2EVnBw%d*w$ z<7pXXQEr7G?r~)U?qd`ESrSJQ2dO@`vm092S6N*#J?j@hLS?;3t0lhvIG#q%ds(1 zm*kba05Sy;Fu)NBsiK;Abw+vt6bgysWK^+dX>j>M^TJ;zUYJ=)E+YU*`zKnFlgh6g zuE^0WBA4VbsTRQ4Rt^k7#zijie!fk}ens(0N4h9nBH@3jx{-zvJB@$9aVx_4V!~K* z&WjS_6}Bru<^^GiJz&-GGg4A5q{?4OmA}-S@EM?0h%EtOJxcrQ%~IS8aWisJGGr(o zOH3KT%>kEPdL(LYF?LvaQS}dhyhE!$%q-9WR zz3`ClBJ!jTYVLukA;yJHa_m(dmE_d%&&AK6e*ldD!~+SrR3vYJhzt>#DHL9ayLjD1 zY+s(s4gedOOE5ear6iYbxOYW&N$eATB*c&sF2m9rORhQg&{icmjR7jp2oVQFWRG0# z0lAiSbe^2(Q3lSXVuYmn0jG(cdw6(GJOue8rGlFy^Tg@?=gt%!#1h9Z(Q2$N!b>cZ zP%M*@fm{wLq)W#+mi0OUjSKua${f_&nGuLNB7#UR;z=g!f{bS0v?k!%QqfRS|LsIe zJLiT>KzFZ48G95BnI*BeDFB}Y-L$#Bm!E2Q_mE`6z&?AZR^>e>)eE#O}!?xGoXVL|+ss#+UEN;r$3rB26U{g~iog zQRs*zj>aeTW4RYpskbpmNIfZ2M@5MuM@11C1p2THnp1fRi6x8Go-#PTN}`}Qv6weS zC>(=D?gp6_%$!L=h0j|W$SQpO1a#Cr=L=wp|hcZhMh`9zgh zb+0@GO2`eC^STh4)s!bdrh45$u z(pQLw_vSw^QxL_Z5|^ZOA#x52j#lIGru0panS%38kSl@%<(C9)ilQR&ODrCXBh!?w zSSrc+4Q-Fe2Zf`nRF1V0$x4BomB_JFL@6Ovpzvz=g+G`cXBv4oAeWGTQiy-z>X~CHOu%TTx8Ke=CHbQDpK8NC11ZK!#qNJd>pq zCz5+b;@;3&lH9iaL4HUo;>Y7}_P7W?xQ7EnB%pW_&0981V6+2(21>;l>$S<-Di5vk&t%_{+#8inK`@~(e>TGa1$6Zm-l@Pi95J@aD zP;jIaGG|2Ih`bvF^sxD9tc66$ab^Qd>_wVN>DVf%^HZoqTOs2^*LUdueCnAhq=AqS z7V099K~m($-QbqUXCWz_FM_xt@>p<`snAoVLSC=91`By1#2|je^gy7xcO~R@CH6z* zRnIGTH-T)DOpXbmb4&pEyz&f)O6CET5Z4tr8?Xcs%Y;jc*-){GWROLIXP9K-dRRg# zitf;zRG%=XfK0hhpeu zn2IwZ>PX~xE3wEXktdrtJUlEi?Q%`XCLyiEJ5ChtZbRssXfQxT{3r`CMubU+h5{KQ zh3pdwzqF%F6plINoE7M$5dUkO;2jh4LXHUvB#zkcDTpEBs42N;H^}x#3=wCXP)6P_ zAr@mq#1XAD(IL-0ktX+GdC@`13=tuO6b~wMIC{t{PsIBxkiNnCE|kZS=p*{vu^POY zQRt-?Lf+Y(d9fFV*K4<+-a4>Xw2=$Ro_;IfHm zE=e4U;gWd1i*E6ubu2PjLXgT*lFCxLP&i^s_392mstb#cCvS#+tR4EXwh~bGA`WFj zkvE-tMD95;nM-8jz%vqwCFDooplc* z!X~#Vsw&w?a7ES^W{9dR0Nz#2VTcx?~C zqt>4#FE5-wZ@OBR5pBN1FF;de?WFwpcTaJ28QeHwg7BElfS!dZ^3Py zVIm&<{b%}qc^BMf{DBD5%;dq$&>%(vNi#5Ec6)GND38eiJBi1G1{3g?7&_QV5Fr0I zBWC-N9uwlhbo>2!4sHbI{QdFWo8@~T(QjBsY)60zEu%I44d~f+4*ss^k1a_sAZ#p- z3}auY8>pjRuU9;ayUy)(?8hef>yqD-GO(HJI0x763Ry>>vY|iFj5RDEx@iyS z?6o_=V(gsJb?tIz#I|1LcyN{F z#rjy!^{ETi<#=6&!{%Yx!G1DWFMG zk@vg$5iEciG~;bxMgxk8&J?4SraOHow!v~v3hOLo!P43B?kp_z(4EMX0pX?_phDY{ zD)Uk^?649$+BKH4WAW?LhYwF*{|TI%!qRPECjl`~h|evDl^EjX(BTOm9x;OE0vrXo zS0K*Vg|$FI8}iCa`@D92ZMy{2Ed0Kg_C&LZc6%5AI%k4Shol~?D%u)Hv%dEuSUa`; zESYDRbAad|#|ltP?)}X!wE5Pyi&cg{uK+xOk+6bqvckRrJevz1G?GXopNav;P>04G9!O9T$f@n;FEHgOJOL z3Z&HB#kY~O#EG<c>2E}JGW%oi0tSSi&wzSU_4=aupMDT(E()t^ZnZ& z?|;FE0>~BMD>hv-uE>_9Q;6Y4@#`07DA@UP%j1AIKoOat1X>g1W9di8BJ2m*HbuY(?4K;rzyQ~K=Z0u@Db2?Z6svZ0Q{?u7m;9mJO z?yUTbjN9>oLO+dQkIm%ew2SotEI9y#9Zbj5vONYUr#cGv+} zT$~ZC{tkYSr87IWP6)ORNMYdYEI=_>LVns*?_t33e0#our!(W;$@49W@e2ODP}>Z+{p0Ms^kv zc_YmD25hvfo*R4a39cHDg3uoz1IJeJ_1DMuKZ5Us?18BR?=8IlmZJ9GleWy3DHvY{ zAcCw0dITt9Bnpq$r2fx6u-0KTe}Lu(3#g`K*}v>O_-jb2~K7X*9H5Gx&seqAsJ`1qHhTs;eplb*XC)y?Lfu> zzwhhQucx0MpKSKr(gx&wheYey;&uWX{CwZ6P!K;a|0F*?248-DeR8$b-Q$du{w_(M0C&R zGYqiL-SPm-W;sl>ypUuynou^QUx?u)A7^JX&0BC!x-EE37ET4m!j68^_#_X$SS#_N z?oZqLbPCQbtyJtxHlBF{UkV&M7?hkvud%JSVqn*tbrjAmbhxpL+Y`)G>|j|}6cE94 z4VL@8rZ)!JMTnrWEY{7PK$Ds8toYSW+WLf48XhHl2aR>$8f;k8^j3yY58NjO&|$1o z*w+mSILo6J5ocBy2DxiM;{Gi8cknIf5n|n)r0$*U9B$yrn)P)i zJ?D%y?1vWcG+@9mAq}dQ$~;;{PTQcr1Jnq2jhG~38f#?a-pDZ;cy--Fs@SW9{us&G;Vta8yiv+g%>r9&xMdt8dv`vc?X53aexJW<8JR z%|u#G4S%v8NL6bPm_YVGYyhjcPY?VBr}eZ3r)h1msV8u1tw383Y{1JBJC}f-|K3fg zmcYQl#9r(~oj~JggWt&_`rTFxYxxs=3Bbj<+eXz$X1cLh0ubJb3E4U=itq1F|FfF) z(|56SfLlG)w|cgrzzH3h8oZr(rgk%^IkW+(Sshq_76aTmdMwq$wBtno4w$r%t78M0 z-RgKcm4zc}wct4Zz5n_GicX7HAa5J^bBrvp|M_NB)yJo=Hjmvrj)!5m+hy_}CJ`eR zu1@js76-@vK)%bdv)=KZ!S?S+w#Nn?y7T!AEU-*&Z{Rg^)rHw-6viga17J z{BDiR5q35)NIzZMd;bvoUTuX4E+X6K6?80oU<1LNydZSOn1GOE0lT9PDj0<@2n)Jl zUZHOgSaX8j8L-Nq&KEdkbY~8~J6s$`xR2PzTO%EG&1q+!HXs;xZ(hFs{1S9l!uD2* zyZS6EK+CL&Ty~_!tmKg#)?p7{E9IiCwL`V{;NyJw@Gc$jc$D;@SVkpH@bTM^ zpYMNy5Y*UYXli@{(E;#)937}Z8L?;^1n)`f2V3z1gxdwY-u()4`+0_@nt+)#TQV=NS`?bb> z7Yo)4wn4{!>UKMDu3Q2WlXk$BO;Z!xmQhxKA_S7yo^F320P$waeuTEfek53X4{IoJ zgxY#Xs}tSa`R&{1ckjQ#;{+7y{n&If&9f{c?Z-lW23KfWu1DL4EC3bg+O^l#k%BDPWxT~~dkXee ztBf|CN1lK^Pr$3eNe!ORc>{jP-ir0ss(A5*uw?U~y2S3@ACA|>8tvU}ermqL+=Rjk z&}t_GX*acN^GXW>7l^ZPF|iV}`{Vb&voGKTVF_}BM5aPkrD1GIZxu1fKr=ZtAK)4S zS&^NR;KOIy747;K<8oM%?to{+J%LRP;}Po%LV9KfQHW9!bVX?qFgbR?4%NC z-IF8~>}p(n!OlG`Z11g&?1T2jdd>=4go`ylpaeP24->m)cLCI0hOxJJCQB=50nEk$ zY2hx$2@Lkj;)XA_&C?YCMA&PmqOv9jCl_Y}KmKm0Sj{|!VS^yT9K!zyrjWP&n> zSi>mxr6j$J?(zH1@FH7`P=8G zpEOAUlZQS&7QkEtMaV`HR--nf{(=UTx>b?Q@o?Qt+o0(lk9$P>6p+|08R;cCA{z$0 zF<=}*4;9?NZs3Fq_Z9kX;G6qq-OF61$7~Df2+u5ro`#Y;VM_is@8XY#z zLDS;S4}4qN8A3%32}bZ=Id^u!AySc`VFwDnD{XJXZUh^h^723@3-@FKutCYL+S)bV zY~aatY`}-IJ`3(*lAJWks|AcBYg0iuU;>NJ24w4rq$SLtdchIJ7DtYt6i2~349lDP zWCQZ;{eQn7ZWfNsd|i+I@e1!2^kB9qkms3fCfFHl*E1wbwkvPbZr9BYG@NODkh}!G z3fx>;c=}r4eV^@Q0~>LgZapbQGc3=nn!UnOVT+rI3&Nn#aA@IfC|GDY0t2%NJ}MTh z<2lgL1yrwyBq#LkKyT_;%D3bB46UI%Gv1KEU1-soY|*R`ziHUpp4cYiWl2MEn5_+; zNbW_#m2F4&{s}AG!0`|Uepkq=Y^}d59~ij4;F8{Uj7IMUMW6D$FR8=G(F z=E74Tlb05=oLZ#=QYKAab~W8y1~i2*cR|~`86WIlZ^m0s?V=4xDVT0Y(v$XhA>lTS zM{5|s$r@X7iNGFi81Ux#mL&3cnZ-x4fdN9EGsLucAu)*zbGp4)-$RML7ra3NGSO@& z0{$w_1}3(lrkF|*quf-jVRBp7VK_;*OxT2tFpG@bID!4%tG z!+fT@JChkW*jQ@g(o;M-_WZ&elbS zNe--OZQr&wik#!nk{S(+eFLPpj{GLO#GY&mtS1-L(I(!)T_%FNOchjl5=YQ@Eerhx zMV01JQf6^blz1LW!cvw+Vf-9eETMW_q`=OI`vm#+ylNnjkf-6xZFjl`*^=Ljwd^cO zr=*Q<(Q}YtWi+?39Q30sjq)J<_4%*%U68)JUH@|oc!w;l;><>NX`UrPniZiMbS6#$*bMG=YQlzaCXa+e&VBk_-|m1voed?=D^5@Ek-M3Z|Xn#?EsoNhP~ zA@d0IwsDYcCA5|yv;x7o(r8X71@fRuGM`GamK=+z^1LP>5fkCEl`ECYlBV)ZDUqHaVH`{CpP}$h zHHCOnm2;}m(vHSc$pfVlcD{0|s$^D)K&90XQeFu_Upc8&vZ^wL(2=RMN{214LVn3} zrnEz46nd+gP#!g<_oyjclFO{7^qw_UA%~h+A#}W{>Xks1iZYcs%9N~aGXD!{m54%> zDkPps6?*QJxKt!iiMSQ(7z<%dLRIDnRkWrdP@PsbnF5(km7_^jg{MhHo+ia4_a70M zUl5bWKmt@MTb$H0qY@FOocDzwTw+y;LKTah70Eq^1}=pd7KP{G568l8#S#&AbSb`_iSXpuEGgl&q(>zRv4Y4^F1YRVhA>G6 z_Hh-Qf=3?;I) zNj#5Hn*K80;U+jqadDjRjzted?q=6Id+UGdg_RA8al{r9E!adibNZF@1RgszM#yp zpv(-R_vgvPZsI(v%}~VHkZ>|*(36Vf6g!erB^w@5qJSz(MQV~4kA5lAN?hRzy???l zxr9d4dp*~d(01?;L_bE}vx%M^^eVzl?jSn6Y{ut(JO|N7Xg39syK@mlZ)|94E2z%P z#X7qY_(-<%WOGJPmZa)BSXa|h)zG1LaC5@!=KbA zi3n1KGyKUb&y*@$l82&9kr|a~eVNv$O_E!K$kve<)#6ZviM)O)@9h(LmQ?H$@}@%f zjt8y#UI5K~QpcUj3%UG|>6D8C<;Vt>$k?a!yeWP+)k0)>m7e8Q%D1KTe3~*8mFt!2 z<+j%wf(U$#K!YAp21Je)cPc0Ei3hmw9yA57ErwWu3l$<*6|(Lr{Iattc(4suK#SnZL# z6^rN-HDa4D1Xz`q$K9#su zl_zMq9h47&9EZf}DrEjs5az5TFXcg$is>cZmmG(j@lYmHA+fylrbOx^-?yNxP~we* zz~xH8uS!x7wGz_3Na-S-D;B+r#1eHCN=N6a3eW43XHc0bknUB;(NO#ugOKBW(Q^k}Mfd~N3fN)vGa@*eMlt}5#L5;W zjQ%`sJm`|hCn4El`bH#Lm*X+2(?M!jE}~c_qFCmMUYX8T;+aW_99R;6X~_>T63sgD zb_R|}<{XDYZ!ILxA-u>TlNAvy!!U|Ffkj3}*W+dDcw%{$KD$_p>-FjkwERm9qeGC( zojnT~ViAprqWJllp?Kwjk=7N71m-wxvG?gAi<&`{F;@XwAIFirMA>qeZ|vKN*!Arq z-}wQ}OJB^y7RyB0VzG&dy#~EYZ<59eR+l(le%*=x?ZmGV1DQyDAOvj-It)>?nd<8Z zY8NO}83Fiz@F}l)hRK)ns&4q4-@2ayF9vAKt~!MV`_cdHXQ2$PxI5FmcX2zc6xxM)a?20_6tmhBICZ#cmb>Ow6xBgfG#- zu$zgqD-t2hc`S)5PTQbTra)3BfHzT<$f5}MAxI3%L=3AGV)4ULXJ1rRKFPeHQSOpF zmzPoLO^jlngyNLR%}8sc4Vdq7MgGo4B(KCsJuq?1GXA0{ZDQSqqPHT%&ZsEokA@Km zPUGoZb;kiLv{Jk?(aj2S(wzB8C3~BSw~ItJlVg!%{8XM-Qi;6aZ-IbzCiA1*vCZUo zlXygSjWO;P3(@WbL*UPU66$(_itLF8rV+=*UoiJTvib0>Pim`PX>OsTv59F`iJ3-=q0H0p zGS^)OK}{A&+$-Jo5Pi+@)bw`df^$uBKccgfu`LY!O%Iol{3c2s2eM%rlZfWZRqB~} zsSKu4SzdWcIX#g=M@AF*%x!SW+Q|7Jm5yMhZ=@olrG7pUuPiBJ=Ypiq6aRV48Z7jt z!=c=UMK~jaE2iyHDe4)$kY1^1tSIC%?3|Fu1*=}EX(EZay-8fJKh%v7($)BRS-d(Y zMIx)ka!%r$G||yYk=10cm`y)n8@2=uf6&;<@|tKEsJ6@*9r#D8!Jl} z3TNZQb$d!-B(i7Z)B{4b`wXO?arYv>d)~M(lyM;g>1UbfZyMi#&ZbXO6-pTxBgleE zN$3(sZz~FC8bxoaFv>FpZy^WV%zuK{&-rBceqR0zu+Gr#cmNirVh5MJ7_2`kGZ}*TYvWD{;>bSf8i))bM>jc z+(E2!|AO0v!c^eL*?!%|vv$w0seYxH}fJg++8+RK=)!wFw(7_ZdiBy$KS~%xRv|U zBeqSx-i|Hsn%D74od0#~7c%7lcfEE%lY<%uY4Irds~ffeZvE8}EO*^q+tczwX53-g zT;LS7EPP6TZKno=xV?ROGuVI8;PCKWCQrdSpSN~M)@j|Z^*s>q!lvM!S=<3q1{}z8 zpSlwU9?NaC|L}f-bTtmagVWPJSgtS2@l=4Z2KaSp)&Lu%RW?1!})An1b7rP1^zFk>!-y3194x-~~b(Xluis^4vDr_2W1>UK{9d zXF)ZW?zktJZMOp?3EZ|G;AXH1z&1Oy5V|HyZMN_KdjIw7r=K?0G-KXZZeR%=vRB6&yv&FafxgjJkT) zox!LBB7AP401mb)ybs`Q1?Wl%h8>t=c`$ER&?2FjeVInNUCj(Fd2=H*)Mr6;;e4e7 zwC%*Wv*Tc=G-3um9Vj#btte!JS=r-%w-yH4Lz%Xy=v^r z_dL5c_+i-w{5U&AFIc3n!K||;VkEPU)YFOg`;%ZgULK8|_a9ctPH->_rtSh|ew;;~ z$qAJ`k<}BZKk&oa!yM~y1l4%jU3T{~7DQb^Y5h?W=padY_D=egZk;e56xezTc_=N})xbU%aV?RnP# zUSfR++r(wRvCJyNCU|xR(wF;(vi=ArpKYUs>0uZ3Wd+KX$iT~T-wZFyb-%IB#rNgS zyN`bdm-)UufG0P%YXkP)2)4F`U5nP>qSFPQpREJ5y4Qc;^udb|9KH+qOR~}mzJL4n z`=|H8cY*9KBe+f=?$Klm06kmc^QX7($>E#NBba`zz1g?*Y-Qih+v8l*Nz3|5VDYuE z%vyKjtBIEAd#KSapgi>O(4vLbet*Y%NtA-YH^MmT`^RtZzkd2J34OFHxE%B|R$YvT z;9^ZBsSy{HqgerDzB9;x?F0%WJZQ-FvdsQqw>8i?%<709hos$u8;9x}yubPiY$M#a zI@B58opQj1ogqx?=+%Xbls~1B(r#q1Munt6bbc?i=(4Ncl5Tc1!LB}lAP7UQO^*#v zog)2U`IMnnavtNOL|BPUl1(UApcg zXp!f8vZpTN`5vD@d_S+tVw1VEhMjSX_rPDJmDd4%>o0(!4#8Q7)bmOr)_ED4_7SgQ=3>%hRu^dm$|l_MMI}cpxvZ7PoLdICHKp zk}cOjA|L?VBmy2sG6J{Y>s@G}2JRvJxP}V|o%HA0iWIowtLL>R_3sFTq6I4=*uV}J zlL$2!j5MJ;qo*pHE~}xwSj|81$D595&3MQRud;9&5^@D08_=)V zvEKTbFuq!8*VbbY0$Z;J-gTl80-{O^VGPQk%p7`L8R8D^rJoPnGl_k6dQa`E?-t)` zm-T8ZJ#3Dr6z=7|RUzpXE6$%=5C$6fZ|&ep&{(o%En-#k1!R=~-baTW z*nhA|=&fZ$SHG{pNM1(|r@ri)IN5xSi)gap71X}m$c-jm*Sai{#>j35e27&Vn0}Ii~>V?yY0IV|Eg780O zQp4baNo1kj$+v5idDorfKv4YJes1aHML#wBNnp)e+vn3}yTM5FRNuE)lkGc5UW_#I zdf-iL9O~^(1VS5tFo1Y$5mpP}4cf3{naCU*NE__=X^#=askY|G)>Jk99L9CEon$L z+@Kq4v#8wv<4nWAEZiU*t*3Vcc>GQ$F{qgwTiTqqWEV~?*@aam4&fP|Vi>%OLRctR ztHu~cj5g_OLaC3u7LVYQfkFs#up6u#mY}{+TNsH3TTCJk%ZG&Co*9-tasE5 zG#P90$$SCy8_~+}XbI>a@N?T^vjU9FJGznyAP){4p~oEt{up(Gb~BToXr1(n2#RE> zeCq65#mY__r@dw^GTu1G}uJU~iSo z0?OgYp}n=(j|Ymuev+JnbvQtECGSwPb`gUph{SfxV$JW@WG<1ISTn-vYEKcA{RplE zIEXvhmG!$QA_cMLZ;#Cbl0BY`ND`tI3@idt36=n(!+yOVHy8x(dyHlF$Lpp)9)dl| zm0089a7c^8vB=Zlw>|zvir^*QciZD#yu^!4%N91yFpaA1Y}+a(>~}kK>kPUPvX&lZ z@aNv64YctqY#b5ofAHJp`^se5r%~xYBdgmg^mtzVTj(w4j$BzcPg`sbVqrh zmUgAV2b-~L^#d)lNLHNDvA5Xr`31tgABQ~xv)L6 zHg?xxG_`AS*KS7<1F#s|{tOc{P_@Sfwq_?B35tBQ0}|ZG`2dc$ZANWZ%DTkCho{eP zzkRj&6PC3eA&kaetfzn*Xz%~~{qwgU?|;Db3^cSWOwT|89YlJhyH2~p?6I?G*+ zFRo3?t_Ymez+YT>Z?D1aPn(;@%L5xkO63GjWqaSPj4!xY=&^?7>b;{_?#Cf>F=RwB zZ|I1LU>(n96fqG)gNAAw@5HXedz1wL=Zm~An_#HY$S1EER1zD|V49#go~C2JLjwOm z3ml0woejks&@E9AQcHrrr=k(5bXTVzIZ=aHleF#HX)=??IXDYyvk$uqq*25xlF`ulvsy+Rdp5w)c%BPVf{1uV8Bx1zt3N zgTq?~k`hRgP|X54(uM&G5=nJzac*XW4eZ{gWssj6`n3bthq$+jHz-G7;f$LEyh8_} zDN0Ulao-yhM2KIAADLCbTirm|j@HU=7e?HPusEUoTWo1P`S#nF?|=TX%MRSg8q`b3 zSk$0M@{EuH$s0=Be%;uh9ln=zeZwvGZFj{eZQBixj_gP5fcJoFl~|3)7=Z}c*@2lE zv3M(YEs`SJ38rx^^ngf_d|)ciIO_;@uQqWTpHx0ck$|3QRikw^x4ULJZJqLIkPX)2WVqSA3bCp`dKuH#o|8n_hHh-2S&g`;~l6c!O^4_3?1s4KT*s zT(>XsqoZpisG75k<#sz5hHg}UY^*DJz;t^e!_bm84&ESupm~Fr-5cxoSpkBt+=B8$ z%I3&;cnmho+<+Dj+UCr6>%$qwayRRH!D$UuE#}vSrg0Rh0;_XeYzHo&WM($(r%7Bw z5+oc!eb~lzU|>!gGBT%)6}2m< znTHkg?d~4DvA!Ja?%H}?XfX%V>tM4Tj;Osh)}w16bFitcQP_~d8`40|zEwNpxIqqb zq#T2c30FAli-2=!eJSgzSd@m6B~VSVBU;ms4}NlDW6~KH8Ljp21Bhx^xwCDvG8WX!3Ek>?adU^ZqyL;;iQP-2gapkf zc$#kCKmSbs1SOMhZxdCDY&XXHh|t;SxSj@h`aM|}6SpgII~%mc3FBYb%Gp@G+d!J2 zzD%7J28O5*g>$Y^OzR7tkVUkhdtU8Yc^Y5~e&;)QLV+u&$DJS>8L{(EJGwD#Pqyg3 z<;BRi!2Dnm$BK4Z)RAuLGg2)1^yU4JPj8=Wu07#CS@49`2d;AcwZ>iPfI6S>U$$nt z?yWCOYA5cC!m+RCep)92&Ubxxw{k_3JUd`LZ-~>;F0vB^M>{8k^8{Brq_nidV~n6a z?Cv)!PS%q1F05S4gW67n_3EBrY%4}%nxuzy|h>VI>WfoxjZ zBu5s8U_Yg=|G+%8_v3=LrgOoCUCB+Z4>KCqi$KNt!xOJWRpjZYe+noqnCc;%7Ogij<*F$0CSlrvvW z?xr{Bi~dg{cRq1DNsKK;hbqHTK7G!auW*dhyplzq3xy||z9w8g(+V@KDbuH^sG_O= zd68a4F)CeYao&93YQiP0h|5^Ud~)F9{uK^o7Z=_V3(h^HembAB!pU;S!e}~=zQl7* zNj1&&4Y$ei?O`Cf)KO$TV$&t!q003y^=nN18dC9d3z^&%VJtFh?8&WutI5_VL`uy( zDK&ISE^j|FQ=Mxc$)TRg>5T~-@0138rJVW5>CF8}vV<&DS?J|rsOJ8=nGE`}SB|O* zTCS6n`;(M=&S$O?=xqsH63V1cELGBHy#rY8J=a*GGdZn+U6Lzg3W*H+^jYM*^#mr2 zJ*h-VF4Ml!d-sXf>KwkjApvdtVn=1IUOBCD^phW8CaNn>qMQdjqcwL%eq_LkO&dn~ z)a_InC!U*{dv0n?IS-pl_e&u{WKRjz9}hwDV-|f)In6m zWz7pmV%0ZNttR#JiHNI-to{;FUSlofd9>b;F!fbP>MuBNK%j(NQWye)>{^iQT8Z;Y zdaBMNJ$O73HupqWpA_V^R-&`IbD4N=$wY>XaxzH7i{?Q1!Yi4Ru^b{}e~Ls15e1eMSCzz=cCKW)M&9aAOjnUo3vp2?5D<$E z8jCFLZGJ#^6^}I&y)_k)HqipJDNb)L~ zrMh0^cI)f_V_E)Xvix%)RR|q*Rfc@I?D`zt7l!5$R&Cw7b`ZMjttUT z2uY|BrB%LsvFNdJ;eGq`x&Kk`F+})h5dES)JAL}B!53i_3{^fCu~|If2qHcv2%?WG zp_UPEJ_nJ;b{2u`ik>LrV$m5n1M7NtlV0nt4Aza6@5QRmRTAFLU(NT$X+z>8g&k z8q%3h_F1J|$Vyh(wD%KNRjz%Nx92N;LI*ktRgknwvQR0DG#UCLNWB`2z2<#NcEIlCOJv3;VZvY zBv@w@R(R%TA)~NDj%1^ZAm2Ndm94Axv<$V*3hjlFST<`Y>5%3&}SS2lHX zS~}4R6Hj?{EW?5qB||JfLA@ysuHW@Al5Lfxxr*&t zitS3etS_Otn93rMIKnHJ&i&_(HcOJ-D4^R@KJxD$G6oHTDU;3?rEsM*7?lpEG}|v(S-Qz8X&gj3U1A!$;tOf28W`}rXsUC-?z+@!!mXn#d;NOHWE43vD)oxWlqwnb@q7t zQv6JsAxmX}D1SyTq2UOysY^szt>jp!4x|#%Tq}9osmDTQY^gvltf&G?idPTB$R)XG zv*NdA&h=1S*~~L<)5>#a^|eGRPW*;BK5~-KvkpBFYZy7ob)JZ_LKGp^6-#eZ9I4YG z-YXZBO&vlgdqhu$rQf3G`m5VPR&3_Uu!&D%pKuN2^~s9Z*(oM2!BLYLF+=3Yv5q|J z_DZ&LiT5qVz)jwY83>*k&u0uqbDSm_s7Y3c|M>eoM9E;7KpJS0r)1A&vP`s(e=u_WHn>t@sUg55>17bv1Hz zjVLsg5@*-w_@>eoA=OqvoL8wEfmkcDY~h#Av~>3BrYMhBBylKutvI`BDKEu;Efp)r zs#U^EEB3V^67Q&}FOqN>OB^89g=hOfZ$(mGMV`$?o{eRdNG>xyo0BA|9s9PBwIWyG z$d>4}i78u&8S8WsJD=! zcz$gBe-eEo`oD>z$a)V(dLX)D1T#i5SN*n^(d#$DS2nGi=W%l`jU>4ij)cp7%3YF| z-k?$BT6r;MqTa^kD^0ed0b}`U$OvjG*{D$^%51KXDMSpOIqTfw3fWysEQEww@n}V# zr8ggM)l`+I*JeH;OIEDfieI9`oxgt*7NTwzyyJ&JcCA*JYRN=_98~p)LiLD3F9U{z z+*xfcx6^_G(4)#i?JOD3*k+U24a%iTHkj+2Q_aFkzhfm64^ zVo#<{Gz*ko@@r#~cwNnrh|ZpP@^m5*02xV#>MJ409I_PYwiLg%^aS5RMA|}x-9jYX zLJLV$L_A(C?apb!PA_@Ak^CpQeCoE#4beh%hY-a3js0p|ZR2n8gfaFDkG?~Qn_)Rj za?*F{IjPbayMBG>dn2UtaGCtajYh;m^e7E4?=HiD%VjiAzM;jX>B9 zi{lh{8tr4U_rl=u@>}yf1poW~^4IMjP-!={P0t%VNPL`MhVAAW{O{A#yDv}R&_unq2qzlT4z!F{(K9-Jt}5b$2Z zHYCC+|L5uJ@9*FLB;mGg&lgLGUHqqdKb($%C(^tuhx_~-ytKoJXPd#_*JJke65Qq& z+#R}sgO<>@l9<&SFnVCk!aCwc9xf~}nS^kv94H?xPA+467cm#>Mq+Osz_0^B_t0Hv zSxMtYCezNFSC*DEz=S$p?raGjl#`&lz)z8!To8L=BvAJTXLm}P_B?`*D~(`FYP>8N zZ5LuNboV1&{H}f7@S=7}7F@d*c%uLl-8w_dIr!`U-`Mi*lOu?|+od}PR{$T<;IH4p z^7kT2MdO`8;p;ec z^R(RCO4ojYG2+^_`xVc6mmA264HC%3FMs~L)7NrZ$ZWFY1YFayp6q|{Yg*^!>lj(m zWlu1(tU+6@nRJ+5c(TFxZ5{Pj=*eH>eZ+DAqeLM5E_Sgj5IaAS|2x#c`!3^UzYd77 z5?lZx0RI>aob_VsIG?dC7D)4@QzjwrUq~(7fR>WXYZX8D$+s7mh zJ!?4+elo#40Y>w@}Qvn9dx&b|UwjOob1k)Xb3l;8twg8^+x)!j@^@@8$A z&_Qz?&ww&bRs)WBcMpIT1K!+=9RrT?Jy+12c*~$NZ{U;wGb;*YOvlS|IIaP(V|_Ei z8T5$H(OTmooVo*RBX`wL9q^;u0~74c?wG=ebhq6v2XK_f4wj(w00Z-U0t>nC_8qCq zfPa(9EMyfba)xF;-4V{C7|t|1Ajlq5E@3Y)y<75BfdD(hAoMZPKlCxuCe&I!Xi!Y# zec&jd;=}KW=v=uZBI8+`U!T!?nd)QPUM(E#KZww7JMGI`@D;_0_8jQQC8Z}rqc_W} z4y;|@p6tT0q~4#g8`i^n37(@{+$K}HWcPe6x{}Q1nNx7yX;pgnj-^&TJBg zZH7!h3l{SgurnlfJ>Vmh1ZzvIK1U6>?JmyC^ySsb^p0#;aP7gvlwnD&27-s_d>+@} zJMC~mCbotB9jkr+(~lqTKY#uPKhq8r;BGkS<6-~6WlK9#TkOmCPhUBMWvo2e z4q9@u%WQ=+>K>l7SbcjKhf~*qBt0Lvi*R~@%jxd0vjz>Gr_%sBI6U^qmYztHB01Vq zq`3+01#~!gz;x?53ck1d8c#)`WU-|w>IG)0&2s6<-?-FQI5>@>O-H0n*8^=%*IrJq zv=|%^0YNWCr0!pN(>8oS8q-TvN2#7+kcvQS)#Z*ZCM;C}?}mZuV$B%*RLSC&uWB5O zkH;Oa!1`uZy^N^a$ZMW9*rjj045DDfX}&~A+Tn&y`S|*eTUE}LAB27;mUT~) zwPA((&R`u97^Jc^Sy>y_6XyQ&=CBQhsXZ?j$G4uqqF(p)LY_5@lEJFxpWIlpI4&(i zmlvL_&X*Oa++mpK0gUP^E`3_E)^KS(ow_*q`swY*Z!p0c+S{Y8Sr=PM_^`zT{gj5* zyV5cP8NrgeJy=*CRuP<#;5r?V?9tD&lCUN;6Kdc4@d4JS-2mrRn9gF%W)qCXoaroh<0m+jgE0<@E{Nl?XM=}GtSLA{ zL?I5X^JIP5I{5Pb$7idDU^5%Yg|+QTIfaq{=9-S<03@JEw_A33z_V}S&}yUe7EC{@ zevkl9K(N2q5H|QyzuX|Q0MfX1DOV-!%^S*&uhelgrAo;i9|zFVX(wAd8hOEJ+o^Y8 zKtnz`dTw9fBSg1ZPDe4&t(CtIB%fmhdnS*BHnS6)*AQBf%*j39)1j6t?@#p=!G2<- z^dIEzDqK&CmiwpqD&Ln~b(_7VCP1E{lA5@7a-R^EbEer1DbNk>ju zKR5Q@`aYk({RO{h@>s3BBX%{B<}0Oo;}(g z=8kq@gO+Z+ESO25HR?}C`yW`xx*P1efkCa+yFF-am};!~nU=J++3E%L?P+s=d3hlh z-7dq=^-WHOcF+d2&3!G(TVJC)fCa%Ok{0iuU3oZv)Hx53A$BNOa*bb_9&P9`ONBAdJ;sl1&WQ5;%O2#0P* zQ(6e7S)9QsIYIx((akY;u?7%^=Hvs5iTf?{(<4(shhn4Kep0J~mZ-b+CXz+qT zEqU!2mu&085~y4>pqFDTu0U?Mjs{5Pps8<%!?6jDaPJb;d||N3WQFpG@rbpNoQFf| zu~z-XaW$$wCY2+igRS0o^A?Mf*9fOuYcH$}AM1nt53GZaj(msVWgpOmnIjBqB3r1U zbZXK%>*>Rq()y7D#367$&$=_8zS>Cr^XGT(|N8V+6mq*b#UKZTyy_hIQbTPtNCjl<$~Ty8e{>u0gYNvj?&;KPtG-rhI1GP>AqyDKT< z+(fX&?YJIBIx!r^W^ZNtBl^d83!4qCYxf7ruz)un9Cq7nvw$Z)V;QKwS#P&Ta)L^f zCBsCi6Eex!Tl+|+8RqF*eQ1x|ymkYe+hKF);Xh`>Th<^JK_{itEso_!$bJm;uASjp z4DZ|SU;A6UG07u$YSL9?^Fofd80BMtjFt7GrXRT@RzJ=)X15&_9)geY&(GGl?pO3% zp)-bCsK5RB>DSYbfP=#Q&-b_8`R(tZoukH};Vnq!T|><=lFM!I26FjK);WhqVwXEE z;2u;}^p~yClHvp$Z}CDRx+fA^$M03WfO$^lyG1Lv`;k}4e#8#%M;@pBxRopKNV1m2 z6rQ>RbTiJuZ#|_F_XswHHiv!1%4bnJ8oF&Xy7j^Sa6G^@_h1*(ak6pa=6=-NMxMFD z{%FNbJj2*UNMKvGyB{CHzP)qT+XXJDw9&PG8X`tJh|&h!w-8ahE4E=Ii(T)piNa$K(gdzoB05Zc;jeA*zU9BjB~j2eS9C2~THRVju+ZfCefIss zvIfngKCN*7U9C_YNSWuRgHQ^dI6du~39LFe>Egc3?CgbUBU}gXz;CzTwGwOpEgaZ6 zvbeo2E#7B|gwL>5S(Y* z@47u?R=!&^x`OPEK`*_7aVrH0JbODEE%hT~KU&wN*=;wc1uXU#yH4McrF@5%@Qkx# z(Y6cO zlyB_%e+2K4;f)o#05lfH3-tIC1+9>QgkKM!kDTTm+2P}tel!yZbE6s)9 z;Qi3XI_7tn3d1Pc0*L%D8wO?CT5Ax+=`hSUx7!ZKYP(pMWf#1itX+pd2z#Qtj=saY z1ylSI!bv=PP)fRjY8#k_#q96&$#^wW8wu||3i0J>%$tnJwT@bG|?4g)Hd$l?(P&BhV*c~g5?ilzD?VsHBwvti%7tq2GZ}(Exe{} zq)Kg}EjsWAlH`}*Z7p2^+=XaJsGsbD-;;80b#k2|u^wAbV!n;NA{R-}=Qr)d4YXgi z6qgFA_;?^iALa28mn7noj^FTxkP-wefe(%=l>$&mY8(5aAka; zpTBVXf3q$uc$;;mCdp=X*UJVv$I!uXbIq+o$AA`HQSj#1@SpZBzCK9rygeQxV$Utu zt^{uoz}A0sJnAjFlFu`1<;T5akf$2o}t4xHvkb^koX4@kmI4(h8v`okp17UE$-VP zLbDaIED?C4{7nyUZ+zU@=v<-!mvMCJ0rg% zAD;bgpnP_TUhSSUnmn_Azv(V~MziT`$n{`C|95yjvsX>iXG#<7C0hu+0hY84278d> z+gJ(jp(@aWyuE4nI20}JqbSNlx@|8`TY#bh6Re_JsG(jMDP6d+&N1buk)ZX7sUM(@ z#s=CG@L?W~FxZAsHZFz()6;m;dwAFinSs@Q^Uc%Ocb|U2x%py^9U_D_peA5_|2sCI zrkXG+Fm(_xK;%t~`Z2#W))9okGaQHS1E09ow|YAV_0?TVxJ60(<<;8P19c+K=f8l6-JXoc?ga7mf?$Y~B z({HWOsG+C{aa!CXg9t_N|J48L4nQ2MhHwIQYP)imw~LMIt;0f821OyZdVcZr_U-$h zKdDDRck0vTdc1oD0*g+ex3&Vzhh??1m8$Tsv|vRMW>a{1+v=eFv#TH9gR+W>xJWXX zT$Ckr3an}?%Os1U#NNrz81R*OktHEMuoc7Ky3DL-l=jU$fn-4#!u7OxnQxE!IVi@z ze*M;cc}xFmtP=?o3t~(pS}^VV=X+43#b&b!?B}yQEU8_9SCGSoFE8{5ErT@90^2G5 z4|3=PP~RZ?{7?JtYmk-t3$iRtVN4xGE)6o!9I`aCVs^b-V%v}bGzPVSAT9M5q?zrU zeO3g?i`A<37bH(vH~k8dq5@t$p(}Nf!J{fEAV-j=d6=a3riDBV63}n$6+q{gTEFC% z%JG_)JfVv+x+XZAf(6ngaG?z4Xk9uv0%vVqWs)O+azFwl0Q;lhKoxu40eW1Anir!I zF4nTIF5TyjJ+35|;y~e?tW&2qkW)ASMluPFpq!9^WC{ddg_pHHcghBiZ+kn&r)oR~ zaa9#n3@#6J2EfmhpHnO>d*u@93drualD(@py>v+|3vB8Xgc2Jd3Ahp|xAI)vO2qL> zg#U_srr3L9#@-tfhS*%Cn5C7cR#)D4w4&KrTzP^r_=b=!C`yG~A#-{LS|rhLC34hG z{7)wS^GM%zG7BXUo{%z-Pj>VwY(U8X?JQV{6d$N0K2XUOo5!nkXkBR-P%FW2en}nz zL+H%0b1s-l;~;h71=?#75MPtnCAn8N&{q=~a3_*KNVMWacHWN8TzWpOD2t)<)&`Z< z!{=ks5>uZzW9?KS@%jhU8Yrb+Km`Y}4-tyeYadWvpwL2v1PqGuRRAH8@_}>?O0Rn$ zcWvhdU5GJUI2bQf4)h~Q>D{;sr+QF2DTAu=M%$qmFi5?CK}2h92^=^P2SMniYalIx zO4BS;7#&O;}YpskGb!;!upNlk&pJeL=6{(8(jQ`z$xW2;tBM(H%1 zr4a=cbbc~lBY0M0>{*TU0uLp#5GzDpW`WuV)%kp2l!Ag&1<4$HH})=BPFx{zVhTAI z=Hbi88ljj%st`L(g*^0{3Yjz&_yJ2sCJuaBM%J2AM1krD4vP;Fg(~s}-ytOwsIA~l zs8eZ`q_WzUgQrtVkO8saHgh6oSMJ+>RuYfk;#bCxoFRNe;KkOd`k>V3ryQ6gcqe1F^4$Vt)E3tS!pWKijwM8iGkmc zf4JU^WJ2!RhcK1gf>af_h$r|_Wr2?0l@GbM7>`^c`Gis`3#A;uOBs@@FBD61388R` z42icO=i8aSl*z7~3Lc^CKYt0kOq~Vm?#4;mY_Gd1)f?OE28q2NMBfDs3Zl=vCmOxQ z4VfT%16)Y-v{E@S(h$JrWf>6F@g~`()LM{dc!*D{473F(BBT{wNMgJ!iKV|lA8!)a zBHz7IlJf&n&MPtFD^EGD#DuRTfKYh~WF_`LSc9cPqTrPnv{0(=N)tlfu$AW!t7jzh z@QU-XjL99Xv~p+KB~Ug11GNOXvrJN{I?!ai!V3w-8CWDD2}Duy!8?-E5u7F5`H?%d z2Wlu(l^1r9hC(432j}TrIx-#-S&~x?B6qS5n#)SB?vQ(Z2FW~-`CNLEf5~e(Dqr`? zi*(RWTGpI29WT9F1JxTs$sv@LEXQT*T}m;b)K)@$A@y$KvK{vpxpUg1tU~N%6}-NJWEkSo%Ph!ZTsugYNQTHO zD?qUT2aECw&t7IB%S);%*x>fFThN|Fkx za}$^PLBR#Rd3xqem$R^tsDiW=id2#ckyBF8x?~awEd_lLOQ0d91FDl$sJx?i>=Vcm z&^J5-?HwWq2}Kn$If~~D|39k!WXWx$>)Hk9xQjA7qhoeHLl0t9CnSY3m8tHPl5~(lPzbG1h`>7@z@(LKpIJaG?D-*fe)n&@d`Qs&mBp`T1kZCNQ4vcHK<6@ zieNbCo+bYBB)U9__$p?Ef=INsKQb5L=bTW2<}!o{{JbS;GiCX54|HxZj?JBWoPY*y zW>^iV454pdhS8=y(f$O=V262LZ?- zcp>*&Q^SIeeWatFIoN}A)lNyZDLxW=<0v&WPvA7bEj*w^@%Fjn+HDtgmq!dn1 zBi<)_o>6>8sOUO^1NOixK@-PbP5r0D)FX+hr@}g9j^`jS1>b*{+a;d%;56V3!5-L1qFsXRh32S|&T2GQgyi<5F zcVZ|~39Khhqg_(*RI`VPJfec@#!_^TbEnsyJ4!|IimM0-o*)iF(dDJ*2+%G>vGU>dNF|m;p`$ppJ zE_i;UQ1gvf8sGSUc~vW6greYisn0I-&@f27ODaAoycB#ckVP5GIJ!mb=@y)ibO<

8$myyW2>PlLCKTi|&XibgLSH;Gsa&U;mR31F+rD%ynvDLllKS z$vh%mqAZ23- z@lO5Rb4tOv5VT?=&P74-dTE1a>@;*aiQKfe}e|p6e#s8P(o1 z(Fii3JThIB%yl4Bi9YgBjE!@0K`?ZL5rGyl1?e+^FmjpLi`VDg;gYC$MPZPh5&AE} z$jQ~08?S3GM1_NYq^>{FDcffvUl3Z6N#H(vg<6!EkQPqWUVw{D=)~;v+>6T@9-Nbqj3hC8hr@`xc)eue-I1$f&OtD8VJ`~DyU_QA|6%Ur z?2FvfFXV`QArgiZ?o+Mlp4UX29WxR=Py8KASSULL1_%>rPC7*_yajdZ_3Xwz?jd*qWHN5T{m8{rPP3ioeL6lZk_YR2u8X#Qw&_Iuo$95)Z`S zJeo$}Q^bHu#IfKQ6s32}5;+Aa7)9Y_>{IF06EEQ&FZHX@kVAoz-pSS%QmZF5gHV#l zV?3l@FK&kB^T-L$XHvJ%JPsrED<=9P(QXoLPqiy@F%rNoh`s#u9@z&q?^fjuJ%;!(|0H8eZG zGJqt{sG3GV;-^rpG~@;fx?gF8k<)WLl_ZHH+e z+%eYZ1>=lvRIUwf)R|3k!YvS&0k{PR$AfRta%v}X>+Ou~j^5hk$YHcMjPV)}=}+th zrVyS!#5qA2^^8F#e|`A){mW-^Fz~_r#}Ch#r#OMx-DuOpftvvu<9N3}n5CJI5Un4p ziNnf)%iwqkuV9bRA@~@*3)_;J(LwOdoaRAh1_Guk+tKd#@9+M(oP%3+g#go8@Qf(< z>*?FK4`03km~lZ&(hcE1;AeE*ywD&*;Z_|1Jh(yED7b~;0(!=EoYPRwCZn?(`^fB} z>1`v+MXHkpqNVnD9#ND%`tG%Dr>e|~uTHmy>`}F-0tjlRV z?yIeNgCw2IVpyR$9S66rT?<|1_0Zjeb${cy{G#Z_^FgkB>8yX?X3G4>c=*?h)k@}!*+^Uu|4nQx)eyjK+ zc(w&}RR0*y&G4qex(EEauIyBPeE9M7`NP{_X)l)^wQuLC#m$8nT=`f_Y%49T6r>9BJ=+yjm0SumEd>u5VfGAzgHj&nXz zu6Kc+vmI7L`IZHO*%({2;33Cm8-zl@fLqdZ&3Ww2LWGRqj@w}SsV0QH=9c%K`FAGL1&#OK94{|vO^;p)O2Q-Yskpr;+TEIyOY(Z4T4Z>+cS3n`>`=>8oe*7BDy*={7Y`-PL zX2$4H+kMZ$OCVQVt1~3v5d%+dh23>4G3WCgAzJgn8*%p{< z1c&%;8825dgDHY0EvKF^CLR{#iX-HwF~x+3lGfoZsY$qC>0!={%kcgAZ~F_V*%AR~ zfsw>GR)Q^HFKdTD5g;zw9RL?lbai1{W)K!MBl3!JKy!n^h(|k>cge@gp$6;1G8KSA z-hTP<;~ye0MqGE0FGiSl?rEqW4hP4(J67G9Tnx*mBLOmYknS{39Fgh<5oWV?hO-RN z7YHMwLBtyP8PEwga{_ilAx37Jvo#htN)A`O>eh1$0|_G-w_4lL>@lovu4;`IoU7f` z?uim9_Q%;8IKgzSF_?8)=UM!WbwJpS<*FE{K8;|H1mDEc;Cv%Y2DG)O5k!w#NDVCh zHaZ5!nX$CfxbKA0h{V#EXPJnGh3jOA#%|s>YRrSR0S-m?xLvG?5=zCy|oq}n9-JZ{Tv%|w`{$~0KbI1LC*n)}i zXlf8Lu9g}X@izK(CS7CX^f)$}ZLnIcsCjcZY}1_Gvi2lwu$Y*t+Zk+)8z~^weA$wj zL$N&II56zHBT3_gGpGC~7Neey&yxn#LT?u%wVu`1#Z7bate{e}3|x z{phk^yDW_ZQSM3Ph|GzDi{2A_lLaSZVVF)2ICGvTxcfGGg&z|d&XIso5zw2<7qjO%1) z+LFn^ba@%6NegG3i1ipptKnS6;UX@_9gij8KNBVDK;^h#dI-LLe17`=OfCmv4uh}E zTSe$NV|@JA-`;;bkJInL<+MAjr>R;3=niA>y=9BY8NuYJ#NYrTq_tGG61g#<7EWu^ zgfEOPR^|f(VmV8DfH_weus7^#4HX@cIB?nx;s-|XHZ1pcHul_-Klvz~Klx{+j# z=7s>KO9QdB8IILzm#w1LE($poYa)&ZlAS{s+FvkIIdpsh*~l(2Ug>uT@3h>Q zP_p$#(`0;Bgr4*&Kzba z5RPm`*e$ z#xOn}U}#|cIJg2<$AWIFmGg*r8xXTw3BZxWNeBQ(-C)6vWQ%qJE5IyQZac)!fft8R z+M#s;ke@AMd))WI&^#*3tzlTVo*TN zSc%qHcrgLdm^oV!NhqEMI2toK96gaEXjPtInup!#{w`78o@I7q76}Z7Qi}aOR>i+x zG5Xr7Hs+9&WVSk^4$!j-GMQy1tDlzyHJ5&T0XTwz(Dq1wg3c(x32Q+Ct13u;um>4h-0G6@LE8<8n6rOk|bE;cK19-+r zTn1tT7{W+~hE)gfo&FP(QF9t?V5*R;j5CE0LC>&q^8 zb{3F~1?VLQ=^%Z>!>KLe|AvPaZfK;~HCyn-+SfK)^% z2O)M=@*P(pId+y!+oiQyFOoW)pwG+wA-V#4q=%cxsx1gLlG?%u7zN0Ohq z<+#-MN6^h5p2~N_w!C{zhg6m^K|oQ5Dw#c--AKqG!iz>Iouk^0)2HkUO))ZbuE zY>f&m!Ef=ChT7U@a8bLaet-vMPK85^=0b8udJ#HXEC%jlc)8l0DjU6N<3X<8bxnjd*kXMh!(;B3`Tyy!Z2?ZqnN zW|<_}BnfycQ7sIv25{%tchvX>f{;2WQLU z@4XC~_;j$5rm?@^TsgMl~a%2jvhID&^&1b$nsvV>a0$sC)^ z%bw_tf#g=RO;nKN(V&-*NDp!|)^>LX%L5&1FsSvMRxsSg;Dpq21lHrYA~nDPT|=0U zF!)Ula36IA+<_dfImL;&M0^Z)kTlGxzzU_8*ed2x}u&w)KaFQR{-@&zY2 z9S{53GPsk~MY;*dj|Hur6INgK|8bF|KZ!0&tRuoVK5*f4-PxhT2wUUKZlZN#XZ`E_GK}vK?i?InE-Cpv$JKHT?EJVMSDPFfM0*1>(jzj?Eaixg zs5T#82_qB9BDZnsYI>lNbie}lB8>=30v3n0DB%!ThQQ<+bdt_KEdRpbXxGZl;%E;n zN?o)6*KxeS9=m!8Fbw54%Yyl;?&qR>S7mzs9QeHj5|xXe~B8*++&iTa$ci<@vA3w7?m;jGQ_INlo;~cC7EV1^^;Q z(4rAMO~?(<3g(dhA!l8PCjlGsXw|hlzOT8PE#lB%1~85ftCdcJnRcmAy+2q>+}eDH zX}sA}YGxIQq@S(LdKee0L4YkX+A|FcW!(eNWB77pv4>PikjxIC zAs$*%Y!5B|o7peHFCU&h|M+fx#WOvQ^CC0}B+v)QpdXI=OLyN+!D0XM^99PMB#{Kl zI}XjF^Mfj~h$3il{PO(i!{-m+ik!o!22kWckjR3p*bbyZ52Bf_dbz_MPzb!gcgN*t zu)o{?9mpbf^WXpR`NxM(&o(!lnJ)K#9KXGP{IVl-y@G&#Pp$Gl_ z)3>6q2YL?x(7Gh%;D4|W!)-bR&DHW8Vnx~j{J}epyIJkh_G4hJ>2bQC`$wYV&2&cJ z8Iu%RSIyL*dXG+XkVGz)x7)OxM{5f=!{crh=V#E+tlkWZ+w9J*>8%}UD|Oe_GHg}I ztx#zPV0#<1Sv`RSypc0_(dMAS*mT>`s?3d*Am|GUn#28KE8#`bvxkt3KvV`zg`{A) z+s$eVO_e2wEO>YO^s(Fr^?I=ziX>C7!wzL5Xe1$wwP8Cm>}szqzd2hLX|@-h!=7|P zNtgxH6Y#t?wVhkbr5-`uZtd42I>A68LGOtfD<-WmXST5?4D=FQMKg_HCY@c4C87g_ ziM6KWfK35V%Gdy5Q!50&J{_vh^%w zcd#f^3&KnK#=%SMK;DsF5^+I;T>srKRr&ELs4b1K50FSY)K=hF{$%zt&e)}$0FWh1 zRmu<=!cKs?v0ug!Kqla;*Y@z&cwVd}FK`r`Ex&Rg6UM3oV}d?nv$p{s;!JSWz%seW zoMnzO2N}DG?@+-;H3b*D>IYUu;4n|At+I(DbPjGh${?HWmy6x+fLtHUi>Fd-*5UZ_ zGpO;7pxXw!m;G+&gSUUYe0=vOASV;hC#Nw1++;i7(4n=n>dUbwt^^b{P)p8Mnez^~ zCII7LdcoHXz{I=B8jpBZcK;dvIs#mBLtmi-yTkySprC&H<&R&UzG2Q%|J!kbC;)&Z z=qUi)WJH&gnSqFrao7{_YYtXv!7s6!2JFS?+Ic(HLU2%Ht^JP=w&64o4Wm zJk0`s!gkOEmPyZi3d|DQ?~(7|Xzbg!;F2tOvq(Y-$_qMYkV&q9i@4ei8ixmfMMPx) zucWId9Jd_UGiRG?@b=f|Z{Pm$*peJhvj|(VBcp0(^%XX{%(3g!(IUSAzhuDncSq4d z;8BsX;VThfOjse@RiOI-%0kBy z+K!MbnC2eSRz$j^!a)qlg#0g}GtOKS)haWWg;%M%5O@F!x{1|uV2C)mIKoMb&cC-L zoe*^v}+>ZN|5+s5l^b&9+7!sO>8nx4tOC% z>d6v-hX)qsb`sri3;gzMn|LD!3(kb3RJBMZBCL$d0*KjmRHuwtD}=6upWGes1dkFp z9UyCr{T5`C`VKap5GP`(z>%?|?QdC>l<0pP97*6%}#jINI$U~^a?rw=j3eptu>{9Ps97b zZEL#(2lZs%!k~^8 zymXpIllkgQZC{e{i*-;!6aI9bQFo;4SF=DB8E^OeNWdtUj?x z7QmW#kAt*?Vb_qDN#+)tdP}^!mv1d(#JAXga=+xR)y(MNKQqV<#-*xy+%U>Sx z4#_M!(}1M`6$LC5JZvmx&}k1M3TC$}CQM{z?Ch$C$6DOVe47(}Vwd^FoXM())ry|8 z*x3l*PftF7Wk8Dcz{&W5)0Bb zFNDLGwK{==o!CX{ENkOwfE-n|7^q~oa0Up>PJLJ`H?>;t34>&+=24ydHVU4sJ_Rz3 zRhuqHpiKA6CPZS?>iqa;z{y;FXszp#hWVOfuJ4qwk&iM={ zCb=LKqkWacHi@%LCJ9o9lMGU;%P_}FH+hVYIq@b)i}X}q z_j_}|J^}9{g=}@2h4y8dW?6>5hct~L-%GC3=@E=Gbz4z5B* z3S-6-uQ!@d;0*ASQYaLSrUqJNBlOCKpp=aRu|$r@Qfv}oSNL0n0Rp@tK1=RsEJf&O zEZSs7tP5k3VFXAQ@QZhfEiu00+ zr{X{)UU?KC6(L+AQeiw_0^uF8LWARt5AxqoxK?zP!eLbeS<$|{;wVrmIH(PW5R0cG zLQ1Z<`Hd(Ml6!~A3ddI|y_1WuqVF}N7#I|RS2WVwIb0*s{vy94$Iscgh$S!%JUu0K z4saEPU^#`*5``0XMEFwaSSqDssgxw55F8_HiUXy{ke0$Xaai5w#Z+wp?zV5Hy}a;M!0MhZb8{vPC^P%174GM3CJK`F$B6rz{pn^*Qp z^PJ)jdM@LayNt~rG%f+e)aR!)zL_>)o zDQP0dCvg`#^9jiZ0+U5TM94;X5fU0Q@m|b`Dx%n6P)QtvT=_1C8C7*lcbXu-VxDc!!JU8 zuP}tztFy;GwgRY=QbstE((TFx7Ls`)0*bzOl%~{;aF?SMGoe#bZ7Vm!fF6R(YOA5m4Se;fZ*1-e%YCW+ml4;e*q|*M{r#1)kx!n(a|x(G4w@P zijyLMiNl?^^o$sc!gEl_MbWr^b8`OLpCh!`Hzc8GGYb5Qy~ZfXD6z;Wkt3t%_px#e z#qq{I;3AH#6pD!~!DdiHKxn8W?MSwi3Zq5+sAr+%>@PR{Y{7qMO(szXlfF)*UP5Y0lkN}M{D3wBEfDDCTB#7lrMUWv+CKOhNaqWeB ze!+~{IFL-~2{O3|GMOXD5J|&GMi_2Vd>^X}7P;felmy3+!%{E@iVDv!C_Lz=U}YpK zJP@Z4a-%>99%(cBb);=a#NGIlr2{%ZZY3s3G`dr&Ho}k<6Cu7i5@yelXh?P;tReTr z0}Q&X^k-M9%LAjTm-sFMJq~m?1+>NMR5_##mx!M z!X%V>NQr`Dg<}!(CGlUx`ZXVnR2+iTh50&%s}bdsD%qqS@sK*4V3gREA?JX2gTx9M zO>3fy+M7VHq>e(zV<4km!64K&ec$&&T5`m2pSLjEHYej

>4v%BhEH7dNx>J(~{8PVG4(Q5#&X9I!pCgHjRAZIUnia-^Z)lxC>a^IrO+{8 zO1F1=bTY?~5hbS3JfES6qyg5Pxo$4#OTKYfnbc!t2z|-4Wz@}KUdb|I&4_ABR?J2w zbjTPvIx#i^36PP|F-4wS6ZxZb1uKv|HS!W77q1n3ns24gZ|O8z1$ z9Y&@UMrIQ_nhdEck*F)Wc_I6(qA>EiRQZmuZ_VYND-)9jQwkHqL>u~oF!TkX(1(%w zBBM~X9$!h9lfOEdgUE;;lZi%yKKCf}RRQ!U<}&=&W#*wzrl_{3GUUg^en*kOFu43B zc`+Mjgpom@x<@~QA0w!YN=ATULQ!G}huLroB+H2zQwR@J#)8Gj6oq5Pltjy9g2ALh z!=&QT09z<1>VHEZN5Pym^q6O% zX0$1F6NbLWGxR;4z|9DDqjO?UOX#bvf`Q}!TjVjgEdWL207c{=ljP#H)D}fQjfBUgt7_6u#qWV(KSTS2p$(^J`H7hJTf+U$fn_HnIqMRhm+{MvQS6k z&%y%~<=~Q}xV0&eN~vI2sqUmYP`&fI1eY^qne3P|`~mNE{w*HaPt-cmwpatEo&LqTc^nM@|4aX(`}1q=Z=d`$zAjqo-+^_a|Mn%Gfp za<0UyAA7n>tpDWJl-#f2I&3494rikk)o=}?w7>^WijVj~4JAyJgx1|B{%~MY#Kbi@B7O&`1kZ~eVYUi4$}`F z4V1b6ZK`fu=HRhw4$D!5oEy0~)fC*x)ET1SzF3Pd4F37H`Kx}}{Rd#2i7IG!$aPP1 zaA$mh9rArUozDBE4(`?5w}JXZU!uTCwV3%?J%X40PYh{)X@+qKoCx9++R`a*UmyN``u2_pog=6bo}vRZPQ751A@Df2syD;2 zS+^s`2{%C8EEP#N^TOa>_g?1Kbn_9Tn#?(my;U`C&2d?i*Y?_CXk0*X!_o`_i)Fg;3x;<(2j-)sZl0|wW|fY@BYxM?tc@yEBPKR@6r450$?rrIqd4q?2{ z=74Rp+Mk&V7LJ`gnG1x`Y(EZUbFRR<>8m+1BbmpA$*N^Fvg zEcMfdnCByAX|jQy@^U02XgNX*3Vr|0Tw!VBz(3|7@&nGUgO==%W7TqK<8rvYyV~J4 zFLpfE%v+iT!{ruBwJSz@F4USl#3I_zG`%H^9}p17dUoj$31P_v{1!58_Tw-TYD1Wb zB|Zf4w{|NU#IfW4HH_Z0OR^n@#ct%A_D}GND#QbTd4pR5iz{568_M5eD7+<&`Q9T? z_ij#iZ3VfxG_oX&tdA98lk+-P!`3rwVB3Y%l+~V+hA^9Rf5(vI;Je-JPtRP^LR``u zFscxZyo|)#0B&Q6ft-_NB54K=&?Yto@dbRNMP`86G^ErZHDEgRV5KY=Hd>o)F?8-b zs5lYK>lS4z#YWM1#@dpr2V)ZS0Hu}zCqK>tyPz1Xu|C|6%I)=$Epr* zBJv>YVg`Kx#2r$j=B7aee(>E&A&l&t5ek984i1-{cPn5zYfa_zc{f#;Sp=S#1{?bB zV{{O#qfmbD!9iJ016~6iPPv`qim+@#db&=uo~m)!o~pV4&I1|1V6I+}$;=AD_+DM1 z%sE%f03cDdRD%QdFwVq0-AKSN1~Gh&Snq#a5IprVwHG?A=D7e(K(fD!_Hu594Qyq# zsDStt4AY!iLIEb#F%Xew#|6Mu5(nRo+ug9e1GjU1*$?FI9F{WyJk4;!k!tk2<=iN< z5E!>wMb0cGyv^3t?Enk18Naae`qpfl-L8sA-2s5c_P9MBwlBczSk(q*zBYEIh^w)b z1bW6~xkZ36vG}^*GVH^u4~RaPp!L_4!MCTkzdnDoSpaty2i#d($Zg8E9N1BK5;?gH zQv+x__yj*!TpO6P9`Qf|CK2r1)Vuvcn2v^A|EzAdY}zk}`_az?|A}sKlT7K71(*B9 zas{$>K$8JzhYXt)k2df+ELkrMWvGM8eBU7qmmD2T5Rcn?e$E_x{r2I{rytM6=P(YB z_#8}kki)%9z(`)e_~In^$|-X25gZ*Bq-M`Z!j_vesPn>@D)4i9h<#ticD-9sbTjYJ zR+cYbI#!j=GcoqpEJEckz!pr_ z!jThV$zXqA=UAaFgJ}nx4#j^jcDqCwsvZy2+ReGzTE~hk9a3&^Nx_UHR|g?kVqm$yH@ys?Vw z7$^DgpI|_Jwli~JOv_-|c4rS&F#N24d3k_y!{B6bZmfABwoNX!4JbF(z%_5Xy$7EM z`)8YI7vxKWqul^@1IpM4=R|(t(01pcvaG{y^~hhG&ut51c{(^a<2(%H;ehx6#~uW% zwqsp07@8M^)0+g%q5d2w$F-bBA{vFTm!k+%Hr~ZEDG=YkPA>$PN#7H6a)K z`I(qf>9krs0Mymt%^%4QIGwxwfvVFoW_PG05-(PQjmb7qnlobs$+# zff=fU6*6Z#O_yEB2K^m1s>UpFG%ru>FU!FeTde@Vmvu%AZogVh10yP=prfbZFlRxqD}zTfpx8T4oT4|>ZU z2GDmPCk@a|Yq?=eb4JySUPE(4BnT{mXu#tcyM>mDx#aX%9b?bzqetZmbe@6WAw?8b z7;j&o(NMWLhZRTEkO5>#0bCiY8Cbom0(oZyy5>cH@DQ)jS6776 z^w25a5k~_S4{d7?at|bi&^J~&T3~q6VD8vs*Moa-Bob$`CiKJEIryYNy-!cyKEC<# z?F*Klt?kA}(~dyZ(fD{MRS7na>LycRW{j~y97J7Abd?Z8=DeQvcx+_4?qF`mg;m<#zf>$#dA z;P9MLvYQ1UG77r!#r}xgnI@5UR%^k~YlPxq;|vb^_Xy*`_Ur+exx#SRq8$m3%%0AQ zOqi~{*ddKAwp9Zo*a2Oo*+agd(VNJbCEnJrzQy$xG4lkQOXA@s?vOoQYHU=N@^ z&AukHhhVag?Us~4TL4D}nNWv-X0lqkX6fxBCf)(qXL_;xsk6e52h%|0-Hc_+HH5@1 zU!CqC_srE{0J#T+BuqOH>w}4f0SUFZbp@hYl2o9U5Fo3U z<7n+ZSP32lXS=G%(XBZ&qj_;gmjo6Mi#?98!~H-k(0Gt-LcNjJ(3kP;sb}wGqa!- zEavpU5)&6>X=p2a5D+@6B_(A4AO_iH1q5mbB7#WSI-xON$e>*=9?+JSR3K1TZOV;| zM3A2F+}H#$il=dl@!tdkSqbl);I|K-KK)}eho&vk#Og4ocKi3Q{|Qcq<+vYCM?iwO zML=Z_AOx)_haD*hjvYj7rkfvQ@LNMb$%z4{zysMI@Icp!BJ~6W?PM|;l7Wc!iG$zd z;0M#%;rGK@p|9y=Eefj_+BE}=0n(NwsSh&}zGaRe z1kLSmc8)!?aBvUIsgVD-;|<&(bWqmd2OXOR1fOAECt!o-X1AEBaUU%+uqqY;ip{H# z^sJ<}G(kd;y4YG|6hPjB5+qX4?@u3h--6Z}KjQOhxndx z6(Q$+VmQ?D06ipY$HhY6rp0_S)-clZEF1n3XCYixQr5{Pmn$1gY@_SUwuJngujmSGPl z(SQ?e1}ha8af$4V8p|hbf-?RfHc=T^tMlU*n_-+Mh(QcLKLYM>1UR;L_@S8iA@toJ zK_3Es2vN$%Fk~TeSnrq+dl!Kv)YZ3&%iDU~1cw=?MYNDzvcqJls%>O*86bQ>;;{R4 zm^hl6IlTG8e3)Z(?-_R2?AI) z)DC>jL*<}Zzf@aRr~H^(3cL}XSUV3m z_6G#f0vyjcS%aejifANsJpys)j%ML|5s2)omR!_5X$b+E4OU{oa1Sle4SUP*NMBNs z45T%{zvk?1kLq>WAGfVF4EOdxTKWEdkAI*F*PRzh#;)Mnm^Ngt}gHUsJ~cyA|^ z@9nU5PyhC(U|(JB@RkMuA@rdK@1K6W`SK6utV+5Um119YGYCW--VVKo82}_Vq^6md-5BQ27%Cw!=O2^UWj)AtY4agXRxVR ztTa2&6Pq%4mIJoXfYba;`OmuuRvBw9_fk+~|el(R`zISG< zm?X^z)S$5kG{G{o4!`X7U=@uAsB6?90ow!jjy8CA-gn#U)^>9`uP0V(>l6M1X+(?- zoHJXbwH^E!KdMnTa8RStJ8@8}DLR8{bgjv@UEn`T2ZsNrE_}# z#%LD2226o01KQ|LWr3aE*6ybDfeGqHJIg@$ja57Gi|Quc z&_vA!5Rl?51dwQ6R?w3GZNcm)CeW8JAHgxgyEOoZ0CT~#2Kr?;_Py9egc*TlbjODf zBhqii?PRU*w=lpZZMUQsjR05gx@N>Dc-sNuf$uwB?ST$~O;)ufq{mjl0|nd>=s#A_ z+f}9MESKN$jTDJP_W>-Sm9Qaeqr5l-Qq{>JoygkuKp94Atlx2R)iaK?2aoF^`7-LXXT#60Fg5D*!_z z9Yq8kU06lj0eVZ~5hz!d6Itd()KN2CTG5ayb}oTsWJi((Z|M+WG&AEhuWknNh%PAA z@lNRuS`fS)r?@6W8G&GgfeK(D^`J9VU~Q6cWX&+#R`hw`ZdTaZr3KxH>Ns$4r-Gg9 z65Os2Br*WDdq*;|;{u%7itq^&)Y;7l)VyV7V!NJ>J(x#UcM#|Zm2W_ex+bCpMaZg( zc89mfeP_#z=%9n14*F}%>ACgE>SiN&KOi5Ga@3 z!lhq=H{(5B<1e@2^FMDvHyViKF^9B`Eo$^O=@-0rH|J1cYJVX6jKc~t(ooNq>%-!z z0PcOjAzQJseTa1wl67RYK-4ce018eR17oxRwPOuwQHhR%8-bvMj8Ic(*czeNF#jAvFFW}AED1>#ytBnWSFhm98>EA#8 zxjhHfqkU91^Zf0{KY?9B;(M+ml^8H8%F2q0tY+|eP|)H1uV_l70$Jg_K|VpXFk>IQtslU9sVhHn{4EBb<{W(*WV!vfX_^PXHGvJ4=K2dLx>E&NoMWJ?nGj&8O<9KOQ@B@RAu5($++#3zu_=cxpQ)Ysi66rg#K)#H%^l} zK2`DRM4nic3rm&IfIU%qwovJjEG46i;!?bs(nZL~A-#&x6ogWRjzyK1-roI}nO9c-JoDhB3&@Td*(R!oqocS7Q=HZo*dm7Z}$CYB4SayTnT zvEmmg;aNKIjkqHl!F9YWxrkN{TqTfJ`Oe-Ft z2L=_Mt>Q(<<=`CiA`gMKN=gsDN<8sOsH>8UsZvZTa$s^{f^rYe$(=^99HFcnIw$w| zE+6LwDwe2MDCS^_LWVypbQ|Rq&e89Q*2x9a$z3EZU|KpNf?9H+mU2GRG>I@(r^EBm1UWgeTA3hQ4px&fwlJ2CIgAoQ z=BZCe^5m zPezx}TyD;<?dX=2WI0aUa4braSIL&MBov5!>~ax0I7+$ubB3#=<~w?M^0%8H;t7=Y#go>oTk7WN(qVF%6u>c#?c z5t+qQ#}y-yx?ENq`7024;8o-zk^$-}QyD?Li0SerZlsJQQVAO=$Bh`EM?)kRfqjv% zZjrxIkO(pm&5&w-5Dyo41Fpv z=l_br|BIxr4S%0#HDQCC6FY||>1w;8f0c#DfN^Ce@lepaQ24XZlTiK^^y@Fh21U2{ zmfX@CcwdjCsdqv2mBVO*=n{`f8$_qFDfan3h<>3Yjaj^94I;j<3nGeI1kpRFBLvZ# zwd*isBzgli+j|f_%}3d3Ij$41UcmK&dQ}odX6>tz7>06_M>L5R6JTNu0>QtmdC8Ts z4J1Y_mo*nnWGhQbeBcyObw2?L2JV(UC!3IfuXsZen8W#adMij^n~gYNiKBiA#Qa|G)u@DUj-b3m}X6c8*G2P~0^90yDr(j9jWmn2$07GNwUHH(v2ps$U< zUmHTc2#ngWPA~SCAYcSxY@$&2c;iu5zFI80m%v#n7=iinUuAA9VwPuo8KSdt!MAb`*K((riQ-yur3FRNj=#pb!`c9zR2Zr7bj(fAQGB2NeWF-DxtByfP2);;%CY?9xUPN9hvW%iS8@T`&b$SBv;%jMQwEev+;P zxJol`tF5yhnKjSODLrDVxO(R-hrOrtqS$k@ZVgE7nh{M4v;r70refwnFHkITl5(+UT6jJEC~$hp863(k&vt2ZjgeIvpI- z>(z;!lW)8ul9vN|2{T5hVdPr1k?%saBL@PD*HINa3Oz+GbZu0Sxb(%wf3eZsl^}p4aq){>z^z;WEqAq0n-0U&Be#U) z!iTgizs=ZVz#?r!NU@OFW$4pWhz3CrUdnOP2EdaDQBsnP1=dIzk+ya=1a*$0wem?MuaS+4g$M2GNAxnr3ZB70(23gmF1dy<#xS(FRn`I$wVb_*`eeD zXky3mDkA6Pg=k)xOypT!sdpkly%IsaXd<0JBtRIURU2G}O_UShMYxyi)R2?&Tcj_? z^~#*1FGx+<@IeVT?q(C&m3m|sAzK1;3Fk#f8G2#)O)4svgII0+iEVUZ8*xuIf?9zu z%Q^Iui{Vw4-pNJr3O&3l_YMG8IK3hwnTxopLTI+awVWNft8~aNKywNvaUr`Lqzk7~ zkhw~7SMJGO8|Mh6m5cNR)yz=fSs2k?3ITlzk;{C4E*M@LF}*gSKwdNgjfuxr=$;k+ zjBJCTXOX-`1Wv9q$~}olHChMQdUayw2!7?TYq`*KxnNAWC_TArZ8-cEDOu#*lglbBR3CRuftf|y0- zm6%KDD&==5M8nLVWfls%<%&`9v-E{>Y&qNo`vho+#>z$D$~|~1_v<@6Q|57PnG;xX zPU0N`xxj3vadX^M>bL3WJsF#hG~#q=HC~5|tu`2KP^~tH?gG(@B(211URf@DS46WZ zJ+&(mtSk1guEIHlUJ>sPqeHSPvRGK9`=QuPKyS zSLGRoz%fF49kt6lxyN^9r3Z9zNh~T?DI-*uP+-KcaZA=-3h-_)-h90g)K!we#mk^x zS<<>TGKGV7$zeKD4I9SMw)n=d5WOoBy^9zvUXX-B9x#O#DkGqSJDT__mFN;BxJwfsrH-t!%6)nT&|h8o_Zj^^m~HLl2E7XIG;*lG2cgo z>O+MgcFQx|V&xh!+ezejk=}lNMkIm7mi>~86_W#2 z5C%ppmvD}#-4VJ)-8m-VrSfmmw0~Px4NouUNt%H*Di5V&aBrF3}I5022D{*U-Oi2QJKW z#bSSKvEOKf;xI(DD|p=NW;cTJ1+>#6cpxkXL!}<=;ozM8K6o5gL|#2GD!2+LRdA1j z``SY@{l1>=HR`zc@y-DL|I_{b&-2@b?S<2S9*X8v#T9r)COXqL=t332wIrjGo(wp_;^gf$;;{ z*BRq0Zy1K&4y1okP5w3lB*C%&e>pe!t8adp-mfpgP2&!4L^@cOK@ym4>$Qy9}sSKYY}5}JCd7nJGLAK4GY0vIYfjVTZ}Wi9VP6Exc0dv zNo>JkH(>uvP2eW_Nz-6J=B?RsT-0rs?pI*L?(ty^{(^+_XiF<^8jW%^PZyx-7R+@J z_BB&uaGg0VgRIS-?LXLKb~*pN+P{drvFdaWuH(HT@#H#A(q?mAvAUDAnDI%mSg zmeD5Q+nC`%aWl(W5g;HCSsDCEMi6F^Y_7PDm^*-8@TXnJ5p#7_x3V_DXv5%ou=Cvn z*Zq1wVI=CG`)Rkm+Wc@l?WV0A*8a@I_5jjszyiBrjKkB&!atj7TP4-&?=9@cyCL-9;twgJ;MwJ(?qfXpqE zqVk12JAjndfP}R`Ew!VakGl%r+d0m`k1zjx`C&U7=MB12meKBFL+TmfUL)d^M_92B z%-JIL(wswcvE7a0W|$o+40K%1xDbQo8;hlptL?wN%y(eXq)rS6dvE(~V;2n$f?1Z< z1I9#4bC@)6(OL+gFKvwgzQt)J%k~uq<1R-+=Sn#J1wgft+@$45LK~Jh3QUFvWl{vd z{SXx`A{DIy25q`<3Zd8qP7jb7;)9TK%)uyGz|sIl1BvX?kdOuz+U__Ytj)W&(HaAF zgJrv2ced5)ZkbwdXIs6ryJ{OCz}xbJg}k&CD@-+_;1-O_-GZ1lA>rZXLbwxCDqup; zb+l_!_5B^c>XB{C_ifvOp4M^7sKohJEeq6E&9Q6peSMt%+yJcBVuEctyc!s3(-qN~ z^J-7)9@|@o`4|m!uwmiXQghChW{6t*@Pnu|Jl!00y(eOA=CmD|OT*u8iB%hi0|qn` zt+ooZwp2o@0ot@64jM$Y-I;_nj)5jwE%^T9`QyhYEZf_XYU03e%M}@9`TfV!=a0|- z5Ud7{+EU@QmziD5sr`JO5p+IZNW4M-FmPU%u_f8+(gF7d#2QFy=Y|+H;L;i)#DK4v zgYRFTpWppMh}wYj{r>go^Y5B(G5p*dTp!p&gHYW066xn*2uhe`&Q?}_A1_A`uExRA z(}5PJK4SE^qpN|BHCC59A!{f<=zzHreE+`qZ`@kr^8MHM=g6l^Nb%)sj$M$>%4*zQ4BrQ@ZMfrH&+C9Y zdnR7YEaFsPz!*Vz7RX`e&35F4X0T^3*K$^A;hCzV#NIVc@YW4+@hUG5Pbfm9UG%fw0Iu5s=o83Bbi@OQL z6z9Zdx8qb<-48?lsj!Z-LHO#7@ZnjkI5Oh4Z9T4W@cr$VFK_-K^zH6gZ)^8}u?!Rj z{21AKiQsgW!S0EIBO?x6I^^av%9i#Hi^N^6H5V@HG!P1hmBEC|9TN^sf>%0RMm${K zf(loYL@OP}m;OHiF>5ezVgL2>mz{Y*+Ol!gUXZ;hKZMbu;Y@TD3MNa6fLTm--G&OxxTT#zgEDU> zsQ?(c?hdY;UEN3=x!~KE&rcuU1(f!R2#sS+`P;~dp-ItZ)9GFz27WqS5B>iP_CVUb zt?)7DY-QuLnzOe82*5bIKz6vtWj}0du;Yf)&tTeL9yNh+=k1*cIZMcx5Jrd8X}@i( zT7dl29G*g>|K?n-%Y8ZlFSigbXT>rsVvPWuLvYsw=U{~*@N;|1v_Y3cg*ytqJ-_?@ zagV03H(7IT}?9*TZbyX84O9En%xeNImAN&J7;NdXhf#lTRQlL=(-71 zI!mnqWzY~Ij{_TfLFop{(Ay23tGlh=_m+Erw1;*Ke$oy-f{edahzGmb;XZx%{N~GF zus%%T?OgCL67kMj0>{#WEAv5udR1t|)qdZvdocxBshndZOilj)$OA98Vlv+Q*|J1h9S7 zs5e?uY!Ufx5hs!1hZn^B5Tb`_1G#xfLg40I8mrKnC6fUmwWPfOpr_4R10vx! zigz)$0-;OfJ*%TGVDBwz1e!N%C95wIwueH=a&1uf>;MFLxm0ThvYsvl$a>>cZ{Y1# zD<}#0<#DRbYG%BS57_gy1+EZT?-dNb38BJVW5>!8^y?9^4J;oB+A)B9aP4$lG9OLOogm>|HSR_LfChwaxwr*h5%zFdX-_wPsJ} z(~5gE?C;Zd2Y%j-;lyTpt9)J=D6;h=OonzQUip!F;hAD%y5|Gxj){CrnuU;guQ z|NEbRKY+G}R5%8ot+6*^o9*Ff^#XHh1gj0Z9p11GTigFO7!Xbf0Qg{~^NdkAaCl61 zDeg!fpGggi9D*;zH$=sWRekHr2Us+K<0JjGmdB5U6 z3_)b;891Ka%G#Pd@!r}K_MDu7-@71KzPD%LFpj~e=?#Kv0|37#yXiqcJ}gCnx3_@F zXE$pkTWwtG#?mygd<;AO1X{%dT)vh#ww|EA##t*{dSF~S0Q%zS6j00M}}+%{p-KrQ*VXfPh0b}+JCV6mX!#- zWnP0%=%PYP4urmr{5`ar=z@3EMYa&P81H4c!$QV8Qt!#=6p+{u`9Y5$? zZ5mPeG8z25W}L8D!Y%rCXP4M&I6W#IO}7P{@5oD~_*ZfG@)FJ&SIjCCg7xhzMS;)9 z8`BUi*EgUDiPi@;8yqWbaW>5X)veyztoQ`|?qIvMuvl%A>CrR*< zs<$i*q`qs@Tq~mcaLFrlh2W^@L}2$VXlkmX031X*TW1LYoKZytDsL9d?>@KW@?FLH zTiq-IQ=`DOreKbk3gHJn4I)@q6i;CM;ew;FDykoYdwXD-dx7A3M1f*%7;zHAzAy4C6l0Q)ug(1~n{+w^gLUf#8${Sg}=cN28WZaALo#6NzGvwX9g&r4uO zh>`*U*K_Mof75mhK7RT0`QtyFwL*+7diYUlW?uA@8C@#1pn#7tA_Nc+% zb~u~k3J-Z&24>wEl)xR7AaE!Vt~zr9J{Eyd>m7}v=f<(-2E zZUGNmjx9LK9|>pbERlf#*z>D1=%!e>w^b{G1GnS`o=G+N_<_WEE2+?J^|6^DylZn? zOD|nB0t`6A0T%$q<|C2`~5 zAkm{|)Ql=H1l2e(=Q0W@ID;YB{x3^@miw_&`dmFg3_V*}cD8R(BeJ3ae8J`z{BG^U z4#WVU1bbi(VKHs2R!KwJA$sjVsyN$ojk6W0f_%ZDrM2t(7=ajEa13^i4EX z5K4#-@PiT|Adk>N3Tv78l}-p;;lyi+SbSV8+b&uta8PkE)8In~4aZY;9=Di^$cVnS z;5RfRPk23I?rz)yb-07n#cxkgBJ- z%%LLn5Jgx!|F7zQp)aeof|wA((OMlBGx!h4AzJ9HSi&5z2yiY-eRxr2k1Ifjb{Ejm zen4U{r&|F{bmYU}L*K*cNItYlbpj^T?14}Kk`VhQ_Kqz%SWW4GO_; z-oXN}XVG%eSF9m!oO!sQ$JH)^O@gCs2#p2e2}uq(j!+gbGtH>t|N7BxQQ4+M>}O}7R|x2xgu`^tzJC3OOYtQ9iU$BfA4l|{hcMRQFw=`6bhMo6 zf*V@lKj!i34lKoOaIhu`@|43msPP7#;@zg*uuf*0?s7D<+u4a77OOba04g$PKTOsx z#}uepGnSVGzfA2OS<_)c-=}3G<{K!dT!V)2aL)F++#kU&$8EjX zrF;DcP~*NnU4lcip3skoml*e%ovG$RIKnJwfb|9rG5Uwb@`EOEHi{h85yHs7Jb!-v z_Vf{eM~rR(*O58+p&=UT(6E7OH)Pw{j(6y=JZ$aK96@-bywWdEKfZkXj#>78fcCh8 zoLPbL75sv-6?2_cgAP?g9O89nX|UU0gZ;`Z#Ekw3galZ;Bm9vpojp2m?NN9?js2e> zJPNq!xQ!*9)M`>@Yb!0ZMvYFYfrW#_HP;8 z9eM@o%7Li`dIX-w10Q4aK&!35eMB#R8=x;^nR!9>U1iM>8ulQ=!LtWvJ|2So3B#&M zgTyvLJ^{)SP)N)Uz^L!rZaESKNf>0)v3GWVZ1?rnuGgXFU$EadC&C}^f;hIzogBvs zJ&ba!@v$c=j7%Ey+X>qC#cz81!MkrC{(Sxxyqnk)VukIkCa)3iNMSJ$MbyU9S=;6Kz-`An6Dl;-qt%kO z;5N=xD~e-9d?U6v4$BU$(|0Oz32fA>C+|83P(<{mOj|7Bqi1E3?rc5QxCeE=WwW7f zr!)Fj&B4+Z(o;xf<4nT@SGSNW0LQRBv{pw%pn3?)Uv8sL65@p3#bY@EL)fG?U9jz$}uoRYR2m zB*g*RgbKtRR}~=teNd%01#4@1W$$!;8PSa3T^L(SK)li=ifTcBm}xM%D{w?|`s4L2PJ; zB#G$&6ytG6B%+l)TV)K+;Ozo+oPJq z!ZkW-BcY8K!Wx$fYGlyG8zZtBk0Lf6#=sv)@7jWzk zM9In~fJ?sl$ivlxP{;&wq@_1>IKKJt zO}3B)9blZOj>eBhw%X$GTjh@J#0 z61h2ukpM7alvzbyBpOiUMb-_VkE{-E8%eWnn}OZ8W>1!)>9rH#kOyL}w+(p3#6H?% zW~rO}$50$dncZ=g!MD4^{tk$zJ#2UcF(3qlNxtB!N8%xgUW3C~ysz0-ljWbZmV#(d zso7#M8j+RNa7MWXYjuh(24sj7xy4Pj$61|@Tj*$RDBXbVs zCQ0$rl<1KiyL-zxG4lz>Tn^&4EW^Kc0fNueqaj><#1n#j~tXk zJYj;n1^R<`Hs)aXr4^@g$Wx?;m5;-5Y7@t&m>QZ84J%6CMqz^83;Dw4LQ(N*wgy!h zy@dD#l@(e8>67Rf5`D4?o}Li+TG`iPB2-D!c6~g@c3qNqxo)gt`lK#KTj&4z|NKAy z-=G}E_R*9<*)hqKzyI@}{QWNt2$cdWJc2U)_SaWil6)PCEGU5zL+sn8M35-(l;&?z z^NP)RceXn4Cf9#+Ksg9DSsCLKY*PCr`n@(Wp>oAxoY?*;-fzB7KZ4@<+p;F_=AhVs ziV2eeMah4aEM_yrLln9GgM4X!X3{jU{gqh+`ec!&_V)-7PzQ=-6y&Gl?bFZmAHY{m z&Eb3ufc3N%2nm)!o-sxuPxU{@6a6Mg`7?FsUL@t~$ zQS^=DRf`B{u?0if)Fy8nT!$JoXA8p9zE%}N~ObVl2Iw66%{%em%@;h zLM4@q0*CR(O0p!vDhZ@4Wm3nbB-_#P833p(HZq07RXQAH;i;5m;hofTDsyrwJzLUo z#x@SaL1<;{S(O{{DT$rT3qdJ~zzmhg07|KEQ~zt-VmX9pdWzIW2)m6yQ5zTa?i?^8 zNq5W%6e~c}D&mB=N|Gf74l^T$W#|}?{uB!j1|z;F+lW*dI#Oj$geB+)G2@;y;v{o% zCo>O^%pwPzOiOYpQ{g6g4-4Hx7!fBOfl}X*na9hNlPsy?!5qRNah5q!XP$xfn8xMR znp-{ilo{3rbTQXy=DOjzK%_Y-F*K>?S8{PkBBVd%Jan)}RA>mY6s=N($c@;Ng@}(} z7l{`s(xgkWxzJyENE~G(h@>N%<^Bd`Q69dWK>~hzJddk}hrfKxpTP8_6wtHfQDmgL1f}D4j_JlnfnEGWQ%wEy)C&%*26A zHJ1uDndXsWNEWX!$-+BaKM|)g@wiC`h0Bz(Gtxz9G-suI>nM~wL(gW-90mgGk~pyej}-xI*x9 zAwz;BnW?b@Iyi?o#!@gx-s3nFDw1hmXh_|G*Z~lPhs+6d%ms(cJ>W6dsm30Hs8Hra zz{p%i_(m7iSz&wg1ncxG* z{{OUQE~34~l@v#Ec&JW_99)zh~O9zBg@h|o*~IKbUh=-goz`c zn?#;l8u=?4IffBQlf*z4{)^m^Cp{=K_h86Ow8@NAONSzpqkW`>GpP)><}R(A+&ONI z*B|PtDmFS+1v?tmBmJ;5V?};XQD;|{3=pqDWi2= za`UxE;3)NdqF?hugg$!?JviEGj~l@#0dV^PEt2T_rNxlxNMT-PcNjYhGopna{fy@X zSV{@cN1qTK7k%QOPqWZzk2uoLHuanIM9smNpXgT(ya*z^HnpjAUdH7gv9-;1U}JoMkM7=|)sbw5VYO zx6E6_c$_Qxxmy!FF|aOE{({iT0w1y}0re`$DgmqV6C#;)Zo{N3RS$ zy>cUHW$K`n!d~WnW2s*?5oFQx+<~SnV}UBUv)FG+^x~)_xi>03g|GB5C9>o;;HYiH zhuU~Blq$hQPm-;-5khOj3KLBvLtf=3f8|$dF+K!Y>bHf!ln!CG@yO1ND3KoK4&J5a zQGKS#90XH5%T$<4;t4k{eMcKYpref|bm0(@xe+i^n~42)vENgqBO$uY^WP(M5TNaE zEd|jrQTqh`GUf!-N+2f-KpG2AXDmEuu5ft;X_`cAhPl|8r85F*f?ZhXdKNBwa6nDc zG0AfjNwaW{HX{T{1dKd4RQR73{-@&4IHG1Lq9#`b|DHy3;%g@Qb>fkoiAR1qMpxll z(Q+~|Ikmk=JkQ7zJRRdL2SqF|$}|D3GsVZ86uk8aXrn0i7`302TSuZzk2gQtc#( z90xS^8zEjao6F0JS>dr%n}Fj%)OI2nrBQy>?YeOQRWI>LOv6jSgcR7 zI8}`S?bES8wRq#Pnj8N;PdjtnByvb1)%kktQKV{pq-s4)=t!U1UgCcrdpfA29cH4@ z3AzG)Cnxr22E@eFS|otOd!Q#;Y%l_L#t!JIb4^`aoIp+^C% zAC3GHe{uwd+CxEPXztjdNFFjafn$FFX(m=>Mn_td#1tYDPBarYlyjoBksKO1a;Vsz zrO2P^tRgAYnZyA@OHU3J_H(0$Ht~;!AV#lFDqiS@Mo`ksLq}B~juKb#iafIjOwkRu z0Kgm2qFSF+&BUV)MKBU^v@AV(lwSxQ`P2RaN9!c36Rg}gskXZs_UX-A7i!}R> zLy$t{OD;CdzVCmXWeBG8t5;TO_2kK<|Am!q%E!xp{r`D&{R)J8qJwjG*6QM}b{@;Y z3LYE^J|T+;(nC?gZX7+-fk&fPY^VsHkq5DQh%{=}oO%Q(uUf3UA@*q4*jGDZaV}vT zU^I~-mvbYSrz=c=8x>xZs8SOC9Bj1kRMFTu+KD*oz>8|LnYNdC?q}v-kSx|n!M72qEFhsr~6saLZlZ!FB5mU63;c+F}Qt}EOjU1trRAS%ci97>} zL{Wa>d8-~69+9yrmMR!(IK>c{&kZ4?pmG9X9pd2&fo}zL%|38Ip90Mjx0QfVF+HPX z6MF6_wyMG}6v)+!0YrlTlS;~!pgP8b5k-^^nW3fdqK*ja3dd0CK2#zOMR4`aE5|5} z2`9}-6m>;|6agYNuV6M@iOD-8+S7qdxo)aGr`koD%jn_oZ7%18j&~}kDbr-=pyqZ0 zB#{zM8Vg5C`ejMzvf!i+UFr~`Y>*e;NxdU-=_VGy)EO-l@2+$mf2a;(_BrC7K-a-J$ zii66<7R)Jb6#CZJm@xdH_PbYjF70T=>`kau)iAD-(s=1O*u8Wh4 zI%|y-?J)JfOayXG^jkHH<>cH`B0y^?K&vyEjK1@T*hpyCNc2|$X+5Yk_fH@Bzga{` zYg{-J(daHn4U0fm;#EsgP*FP(xAoN#u9c}KQ~Fd(MtD|-Vij>Ub94Gh=2uFER+WMW zK&;wjvf(aB9nM^fH`J>L8ZM6g0Yu`(qLCYBuczsH=tHSqiNT61ow}}8!dM-XHS{Rf zjZmyy9Ey`lhH>h1<K4+?Ke&CXs!BfUJBZ(#hG@Hg`7(TZB0D@ zR&5)ASjAWsP*!N-Zk)VwQJ(9W7DnPdukK@d?9AVga^_D;={E8OE;Lhw#-*@YPhX)kv__PbBXX548JT#3&_>>q~M zW4Fx_a#j0_M0SltjEw|`RfW+3SxfH#G>R=m02W)r6cdO&g|AJih%i>LO1W6qD`Foi z3?Z$aS?g7-9G|rmm{lOwjcBc+o~r8yV>KLRRan+sB-K(zlvQmd^FY^>`|)M2mn#J% zRRGvnyVDy2);?2_Qw2~37S~d1hTmW`gzY0t;K!Imwi5njGKfrdPUIc?R|k*B%gb(e zy_%ET0R#`Qm~3us=HM}%>hn_XgU7gb<7(#9TK>mO-B#z|(E=&gSHZt+jlk5$@r0N~ zTf3P?JDPvNenDUSqp27Y^r(agg0+c#i)91G7C$P`X0C7!Rei34`yJ@ZIJmE83^~1z z>&)TDfSvSX52vqs+xdN8Z`b{BI-0i|9+3>E`(6JC{=v}j8xXI+k=)<@_2=~R_phGs zT7d6rf8e^lyhOpvczm?UAq`%dm*(Cb_rVK>aQ>auFSkqZqQO(Qm-{2QO&Iwf1-HvM zcFl>@*M8>oh+qVBy7~r)D&AIz{R&#EIe=r_#(s-2;II;WY9+NFw zH}eHs0SeZRVo$F^q=q?DCthrY_Z{|Ca|8c%s1dqzbKzOHW-A_S1ro@ux?{ZL4J=83 zTmiBm;&rw^&xMWP?51ju73r8A&H%x7%^kp808Wo)w%|bBs6{5c>%1Y}730Jkb1bPu z!L`Fsjg}U<70IqRrfWM4cVJtG?fv8QTkvOlwj-XM#TRE#D+qRtp^^M&yR!>)53a{? zwQ78D-IL;AYMusWbg;~9`wOMW&zH1phu z>}pRUk*>BsU^K{`h0;Bcu1F3tm|6k@?$wg;t_@b=IsW)s{=ND3*DY8DagBmMK7aV} z{LbbP2i;x+@2AbVOyAU2kEzs-3XBj^?ASe;A={E>JD8wL1WL zn*pe=h-BIjrfYWM;{IsfpT1%Zz#46uF1IoG@$|>HKfVJ%I|44t1aAg8i(RWb2bBZU z1k8ZhCOv~X3pC5z!s*toI>KpZB8aPV#VGovsvRt74!(op*$4A|S}(zDm$(D@)3VtI z$+VW#39AE}79rz6)V9HF&vV5I2(|a0gw-}M(|(6IR5-wwkW;%@Dy7p`FTr;?k(Qjm z7lo4nV0$=%cne-8NEtINj$*|&%+!E`PL5`4m4)xC#%u#$i{J+0ZSnJEC1h&0M+~S~ zdu|Za`5n;%*q%KPfuCqv*!s1Cx8J2YF!i{Dagrm%M5$_{SkBSQ&E*|ax#lmYz zU=?vwSY5lN^SHHY!xgJmgjIv9%fMVXZ4-PqLu8!IUj*PC&ufqGTg~%10acf=+`{eR zMiRGcrP+5mT5uW3-R-))<;F8AA$Rh3mwOU?|M=nS@1MW?0B4u*N-NnLriJspBZ&8W zMH75ZQFL;?TP&U z;rZLQC!14T>3qELp*v#4#%#rNR|~;AE#3k{VGdxtSf#zg1(38!(U$}NXTFpb&GE+D;nZ2ls&dtkApdcu`Gf)fw?3xFpYa_tF zIlwsKJn0a*Yfq6)+Z}Pb6LG!vfZYY%HIK=_QsAL-i|QTM*^(dwE@$&0qVjdcu5O350{O|-2m^Xj;C`6)b6?!aknRN*D59&V}mKH?BCyh`S$h0 zm(TbbH08p+I^v16Z=Sxre|q~2wl1NDt$Abz-GbucaJ|Tw zotp#`LVj^1Rv$#X^$pbCLxbj21A=dJhd>lUuNio64jaHzvoem_?0^U@D`_n6uxk3% zDrS@A9?Q!X#NEr%;`}E2HIci${h48?ISQpaxx7czoxeT*^2>*3n`^M!TCv`M`TqXl z^LH!(t{5QT8rL1$tighTEeY^NI23|UUHBLYjwzY^X-wFts z$rGN%?A??e-V0oT@V&N&pVoYOy!^a@*bCgke;ka%5?s~=F~zLnSP@E_$i$Ju^oDRI)=SJ@#+j(zCH(M%$X+Xe z7LW)qbE>xB_6`j=yH^t}1 z`l5#05b#T}7IS)Q9qdR3o|;`duFlS&0bA{G3ckJqfbEg8CeQ_e`K8Wk(g##%iqJbcaki0RVyG=J@?@iYOkJ~_O2MFFX5WK?* zSmjq#%RxqN9I5D1T?rYk2=WENa(6D^9C08BP`$sxdXbQvYe`wIOo*dlm__iRkWEz=UgXsQr`pl{#DD*Z<=={Su5f%MHQ+RYJtOTFSbN*MRM%dVC2$ zWu2{2VGiKjb1?dU!52)U;LGQaA3i?^B;MLyz*=0djugDz{)C4sJAyMB!B)pAP`(dt z1lYj`c6>ujC>X7jI)V$u*K+*|ExXwT=C zkX|%a!F(OmVK$(t3e51ivwQma!`t7<97e(!+AZ3?!=CClLxVoFrh)^48f*iwF{nE< zyK0Z6mZLxpXOI}mKq&*e*p|ZvpPxTHfB*2^W)DpKmO<6CwzZR9{O5Z9b$Cf_l^vee z2Jqoa7iaM%4n9}l$pR}38wQ`Be*F6MnfT#OIO47%YFLfchE3{{^kC-EZsTiZ}W_|{rzeg$X$G5JUu@u5E76(h0)4q3^lr-N0DNlOTFz4FLvw30uK+m`gdv4!p6HZm!Bcs!Q~IxW#sMEjV+QCe0a0Ij+IgMc#h5cF-p}k*62~Q@qTA7TYP8a-xCQ;`0kl13?zc zvneuW)x;}rdP6jAua54%IisAlJY@p&6nP7~fcvH)Sy>a%wuvUT+VgG(*%%;+epf@+ zq_6J#&T>ESjPd#a{9+WwaEKeWW(HD21*Ma7C8s8x80|nhCu{ZfXzG(Syw09d3=A^( zT|Fr(HJQbhTV=!*w?qU_=wTzb_(~IUVLNkAc2n~-`1JJc!{;Z?>ZHxtRi0|R@CQ4$ zwH>)N03Cy7JOaQA!g1H�E(+kaCPEK%u|{+{r&CylNusxJKKYM=UuLyR#T3G-m1Q2=Nw=WT}$LQh)NOgv051baPWve$f zf+1TL2}K+z?*Ni)<l05G;2I@^r~T^V2>;J0BPAWciO{hC-M=RC2=A0@<8-*N62)$g<@C7&fc!MwGDzuJM;@cAj2wnBdhpU zT_pV6QZUFxR@kH2Y^FuA2B+%U2Y#?$m}SFBQSrvstnv&lGaloh18>=`XoYTW7^Vum zf~h)iwAJC-k<@9;q>p?8k#14Dv|W?LVv|bjNWjAio3Nn`nhp*r2+pcD#KGATC=q4AHRI{{9lW-&rv-`ofPlccB1>A3X5x3w5!K<&zLt6-vdN~0 z{Zy^ybS=^|V9SCtA1viqF@0L_pIGH`0|QQrXd)%>%Hzc*!@wRoIc8Y;{Wcy&`~h_t zK<5#vTPG`vL1I34#2`y@@3)q@BLFU^7XO12p{0XJ%WEUJaty4pHThud*8SF4qYj8> zSj&=5(BL{X%?0>pYlGkuoGLch2uyY+&Vt{bzJEfsTKr^SmWQq7oF~hVTdvl(%yoW) z!&yukYoO62FldJZoQ%r=Tyji6a#Pa)QEfLQIEAYI1??3?AsRlo%vWp+?F8&jYjrpj z_;jo}0JF!tCUbU=ctd-(sU0kSV+Yla7X&a_eSU03O`cF&`hYr9*M0xleaBMthuWpF zDhjlati3W-sEmCW2b%bvxi?E78dJk+L21dFkbDEzd<~m^~G%V<>)T`A;Ne z{^np=HKvyH0SCQbq1v<$+GaO^_19YF6IhiU&C{T@I_{DAC4tM8nGS355UV74sKoC7&5M{4#ReneB*5w^q);9`7R*FD&o8v1W= zkl=r{D?}8sl`OJWG+WK?h$87oMLLmKiVCbHEY ze-JJnj!l|+XL-qCzuO&7N85gL9my`fN`~%Wb^f&{!x)%o4y&o*yB*w#b z+P~O=SC0p-SoOerkwbN(&ZWSipc3N)2fZ~`8|KS}Lq!U1jrAazD#JMlWZ@d}*B!=g z?C<|G5K6wkcgOz$)O5cttF^QD>wuzSFHH7+J+uVp0$psG&SAB>l=Dfo^D}l!;92^M zgZF>D{r$`P_rZHD;1~TJ)ev~7TA5>&j6I}q?lAU9k#CH4i-RDia>zag5AnUFBGe7& z?8X-GW56Nz;|m7g%y4iOEZ=+}nS*)^NgF5q5l7@6$G{w0JGZVK`532aKNkqO#s?ha z1&`2vY$1^`2k$?A`S#)6Q(*0-kuUG|XqN9);{+6$l9*;2z?19Kw72WqZBbv{chwcu zHDZ#t6&GBB{duX0I^9#|5x8XAm~E-GtQ61u`*vcc3mD-MJ+pB3c*OawL%806r4 zMNZFfdagE1EezkzS)y-VY`UFLPu|zZ({UfXf71dEkO19$Zflq=S|@w3<}3xjSNCNE zkn9&(2l|T%|Fxn_xKx_&-J)7 zgId~dJ1m0`&p~5}dq;rsdT8*P68%ij*@Lx4Tr*z?cjn8+ph4vpg|B7#i&a-GLrkpx zOz875ct%-wvFG<$P}zpXxEZM!m<3J`3}~dlW`Nq5ZMsKC>fNl}TFV!Sf}R6t6;^m^ z(b7lP06J_Z1f@~4Xe1AsSrLX+01+sMM+fj6noBW`Xm9y6L2SFMGoanH75e(@D zAZS*LVE2Sbj{yHde+Y-cRy3f|!MiVSe|-67zDUpgi~X57rcoBuXL~qnGU|i+)SV7{ z`%!xZq#O)r%D~#$v|!(|oO(ysmRvfk)dDTuk|%A6)}CJQq=(efh&gy^g^l$UBOPif zKG&$@*|y(t7>~nB+ZL=rxY*kJ-Gk6+h&x0ut;ozsk(S`!J%9U#Zd7a3J_wT@m?*3j zJECj2w#3c1B{jrZF_qkSZTUrWv6gEMTrbK-yyfW{y6A=t9d%>(_tIjew-S9>nqY?mnoiJ1DSc@u_bzlMJ}j)M>2w5*U=~6`QW6Gc@07 zDORxq2Gbp3)NHK)UEPqcD=&o8S$=9oj&rbNzrUlkT%$*&uGrJOdsIMIFYBrH3~LDg z?p_}CTs60!!P{$;M%JbVzZw&DnwmrS@PsN6(bertbo7MuWt%q#MCR!PO@m(aYH1Xi zyWOJwZxzf6jud1mZNhv~1dO8Dy(Sr3OaW4z>lOy2ofaSiWnc1N>-Bulkt~Tg~3X9rT*f z9kR3Y1Auzm-kL3pK%cfy1l6}=niLh*E@nU0(dp&jI;(*u@ZR_T%og-u0 z)5nvndI(!%AO?pXaYP0o*<@iu_82hidA6dz03v&(0^+XW4jVKLcEQ`{k3T-VwOPBL zB5CiSUH8@=ShhTN0?C`n!*HJlZ?|z+fF^GB&e5*r(~s|JOa8PkYa6h>`vAa)?3KcW&9q%aGd;zoucWntI*cij&z`Fu&a8G z)PaMB7h&4O#aG>K?fBAv2ktLX<^Zh{QD32fXJ_#4!^e+LZ^6;VLyW7o0;Y|(STh}D z5!zNzHLRDT|6up(AB?1d1g0Hcx_y4I2UVX zY>ECoU=@luo55u?Q$ez7%l9}rtu@l{MKge$y#m6YkjRa}-2sT!&85hK?R2*WQ}AY5 zF~ZF%UW2uLc67#wux^g(G+Wb*RlP+4_U7A%A3vTx{}bQ}S&l`6_3bevO?XSvO__ns zE#1uR$ng=d7$R8_(v6OqE%l{wcq7`UKr)Z&x3_az?ifq4#p_XZQLNm?bt!6af@M!sMK!Jo(B&6Y=3}uk7RaZB+qu-&H{;VxAz`~+0dIY zPLsjb>TgLLwzScvCDoe)V>zhJ>gcd6X2I-Ux8!`U7aFj;$HsCiI}50>*=e4TKlxTm@TCS!0+W~g=GHfMImY5Ahc^#KW!}N_ko7! zY_Pw3niis1fPh=0;?0L&AYBgvIKbLgyJ#^*rPfSMcKDW{aTbSLw1c|f4f=0!LmLc? zS_B5KY%!nEHyrV@wMs?}mF+F+vK`>rkZ)kBZMwsVK0Y|e#mqVKAe)0#Nl;ndHs)eM zg(Q@c4~}dDmU`-NEYH8m!Kmst&rjblM^U3K|JgpNOOt>gj`9hdZmTijh5;Qukr|HH za$9HwcOxyjaLvvmt{1w%hw)0M5lwum&ZONVgTi|e=kP}Z1U*3<$Cwk6$9E!L1hZ|8Gvp+5`Wd1XI`;3RHUO9=YGP6@Bc zs{L_)x`TCY$7UO;d%Rn&>eCq?b8wq>dTnhMc?{|2n6t(;vH82cAsyYCJ?Q3t+QpB* z-!1<4shC73k<$mYJ~|;*jW8mD*&RjGa51Fi#5eizEz+Rs(B`rsIJ91sL=!x5EO~ z1i*8I{1(8{6}hE9$7i=WAV7*Vw>8o%UM4djpqCgvRD>mBJc}?(%W{7V7?fzoQ3j6D zz99r1baVvU=6PY;1`s{96UPpSH_wA?Ic$fcm4aE3;Kac*x2u<$iQ(H(W*`F*ykcjZ z3vJQf9?}QSRFZ2jrx+w~L%&{wL6Y~m?%X0$bGjnoq(2+rsgq~qaZho3&X^PntE2I(O z=r+M7G7^YVgw&_tS=j{C)igzTaFBwWmd0gT<^||PX`F#|mBtCU>F}aB$HZnM;H?6L zY-3!8IZ2vg4~U3O5d@lGh|+AueX>vXm*bCO{2C;i!|Bkh`=t(&+|p%=gr4MfK51!I ze553gY@wqc!3If6I(o9fq$m>L*Ygq|P}yzAX&PAKK@YeY`!OO}lPI?283P6cZ8V74$7_#1CIdXNb`=9;IQmP5FZp401i8ds^YTKiAYk9fLWl4#Ar_l zXD5uE*C`R4J)`jyc1L>_VUmFLjpjGvqyv*Dn0vVq%$;!dLU48BxJzM1OU9NvqC3CM z^lheZ9Rrt6#(k&Swg>|Rxu-H*oNPSLU3(Tu4Pf^T*N(LHNI!}^g*|?Sx4Zes;o5n5 zHsY;rA`eCvz?Kk~f~a-T*#%KYgm~<^l+NKwg)r>}f9t8w8`4O~awmHoc?Oa0TuEdS z2X)_gr|=GW@9BnXq++|1ySj0t8#($SE@d`cENs0?E{^mL^g1Wxyo(iH2zy@e@r(

nG4t#B`icVa>1xmyPuFZhg+CC@#ketU_IAkh&JTx&*~&?Qk?Dm=Tl5IVU~ z+5&Q(`|;P|71myy=lf|-guG+CM-Bs=>ssZW9G>fHz!c)e6BG{>6k_9LBFBdpKnWmu zVdV>lmDkbbdfalQsNA6#V{u*NV3O%aycoHs_=@U6!*3luI(N(hK{dqsu$?$}q|YoDr(TeHLg|HUcfeBzttZ5unG{*|guX{E?PlVV zXJYOHVo4IbfFA_VrvlJtGLhrZzd8cO3;p7p&>`yem3#IwpBZIPJ*HyKr+$x# zc9r;_IeIyrEEk=gyNW%w-aSm2l2oQ7Wkwi$Pv`fV8<|5GI!8amhSJS?8un*%NR-b} z0fmV{gU2r+0B#dd?UTfz>`9T=HB3D~I`usN)Mxdn^7zzaw^Lo$lmH#U>~VWi#}oq2 zUSEKD8hbP*aQ4pRv4h)dYXZiAVlPy^NFmPQfyCNhtnEc&-cuMMC0RF4NV1Q?MMNb7 zlUT%hBH_ifq$vco7oXnI&*Wqq5$+35xF^A$RPrQraC%+{5ifzc-;ifd2zlb4K7eE* z8U93KEu`N&!CV$GO-8AI4AXv(D#Dw$9{jYUn3H2-z635n#4rHXTZH@ zq}Y>ipA&m8tbL4+$KV4L@2>?}>>hkydWYb6$7uIRNav*9;a3|G>^Fqz6H-W{h5q*& z|ND*Kbm4!Wd&h|&h&DqL3U8l!s(tAlQu1SQ@m;T>IN+2?VG7LL-2gg z%Mw8ZB+5bo?sJ-a<2m=4IQInF16mSGPKYM*RQtj^!r6O6Iy_50pzae7wkKbH!(U5H zA(CoDq=zhW3?>J)C+(hib|D)}?|4l8e;v=O&l6$k1*yk}5PEGq*73xm-|K`)=Mtwr z<9y_gAo6>3*)OWhxbT44gXta#WM5_;V^3l|kFifkuh%@NW-ub(yUQ3# zDJWFg7&@krkoNlC$;pI1YYP443Vm&WPF9F+&-vVg@&!D1PAI~CCUkx7iS^uOOw3ap zddZN`KXPH{Vg0X{#AVCT1OJ0aA%1H+UIIud{NI0l{~ONzWxmDcBu%yyYY>S*5Pcds zZZ=Y=0NC~iygG?~8)v+ZiheuUzaXMweFv<)q;{jXV}Dtf1_*m}PewbLr+Fr#CVHwW zl4z@VPU>`@9r7c=^%+s&c9FqQHsi7NgxD7w0_$@D>(So;!|w_$EYgG~BJ910xG+ue zF$XO3(kcZdIJ6~IH)ukdNW^%nZI?0`jnLI4lSNc|=5Xm$Xau+yihd&$y+bya9$yZO zWGTG8sP+Jvmaeb?+`g3AgbsDDUy~-RwggO}xgvG+d+j?BM70#1T=Ym9ejDpYkrqbU zLFA80YAbd*Qqu3qpSO0fi1>v}d_i;czn;v7ui177y0YFJ6I7*B`X!F*%5hmB!T#ujKkw|--$^0iD&f3S}7Jx z-?8jHRMI(_Ncpit543rXYmnpd$&qYwL8^15l-#QTXiZU>CBeHrk0`N0th*?5beS*c{5@*(;vky4?8S(cd_`&d(oW|GFSA;A>3d0$4u@4{W;e!w73wr-$^$BYDuPkE+)Hg*Eom2AaFP% zEmnYj9-kiPjDl;z^=o^MuMEdN#Py5wA9?P-yKtzqMd&u90pXsQ{1j09xFp9v$@Q&W z1PsaozQ1%Zf1&+_Bln<7;rRvIFT~g{{1(ekra;5&+nYTLE<$&64xXqygzbqexl3eg!|XTp4n`b)-eF3r`?JM<%kWhF**z%ZdTbf*kyNmTpCxHQ4f8uHV z;L77*(5$dpLS?O?ZJ_D`s!*WU=Q%!sn;`SF+#AXX$cFJ#^z!1mTFT<@aOs8h*R7++ zA7G!5mx-b(iUj-L5bV!#(Y8ihK6TO}>7>EL5ShTbsgwYmAOP3lsqjlm3Gg4c!OFCn zmsALl6u?Hh0Oap)xILB3k$dkT$CLgE<}2N;Qaz@T z6Yj!GOCF-0*2vf7qO^-YddP(qO)&+ot1xT30elqoy=ZEZ^ z;HEN%?ROY|<<6wHx&@;7monT0s$QPrudk^x5Z*aFj8uOj@=LMxOONN@#BN0=Vd7ur z5b>XQvj4_AT!ZB*NdJXc{*j0HZ@d#bOuy*-ssAeZ-<{Mup$Ptz31IRuBgui-?=g~k z0I#|k&~S;c40rF2;k7K+=fG-wLi__StJgqb>C~e@`X}^W7~GOQW5WMaFM!oW7_Aga zGaw`f-@OL|>R;ggvXl_Orf~d!eY+7g-+{Kx5$oU6{Yx&)HJ=N;pBJ9>uTAJxhn$Q{ z(hd3jsc8NVGOdOiP3UOk>~&<%SXn4DYKEuJn>&t|II7hKX(pk{kRbJ zOr%k92DBgS{D>6)m>hg3Is?4Fqx_SLFJQS|8^Pcs^gmZ}G84Wv7fR5KVgQ-M0A!qo zfKP7)tHM+X$h;~*?wqW2u>aBn{c~HUu5_VasbdwRKk7WMh`W98_1&pZ~;G_d$nNZRJ8z&tgVS!lZ7Hezq>*B}>5lHetxm(6wCnqHU z1V4^7^$%m}-aS${fb-DCk$wQKMd~`Oos&7IAk@EZP9rCwwsmC{5itr9c2jQ@44V~ZqJpi>MZw@}G0 zb?-)WvAMY<-Z;epa{eRY=o2X{;C)dpy#dM+xCEF;mIV3&GDYZQ21M`Q_|=@ohJQ6A zCo82nkV#cv6pgz zI)O|cJCTB%Is|dywF>fAXCt|SNCE}iMO3`15`f%KoPTPiIPv}|#^5DH{>Pkb*8YDJ zDS%W!EZG7`7~s-IQWQd)A(V!JQ;UfFvy0|I;?)ac=iu_o;fAO>#6gDIM(DSp?ov60 zUy@VYfGIj+m6#@SdI+V{L*Tr+*hBwL3a@KQX&@9b?ilriOLW=kAZ(nIdne;=Q&QQT zHbUy0jO!%Yb)r2aI-*z`j*C~pgv>jMbF$JqnY0unsgOAX$pkwbw3&G^s1(S1sLM`Kro+~3UR)WOhDhngE|Y<`2qO_*Le}#SNsp|%Wyoc`=Jm1S>FBq zh<8sEOF&4OS+H5}C&V;v_rZPNF`)b2V90dk#SlvGBybP`aIgC6T+MB8PtWTk4gUUq z{amNpICyD+418&Z@nEf|;AK0$Bzf?X-u}vd)>Cl10s0vHwd|hW{tRwY^Kz{E;Pw;$ zp^UH`G2K%XfsyHOfMSFY!k(dKf0=VY&_Ba}HKb!la-adx%p4egYr36X3dDuo zn(bk|LpWh?_iBP-!V#DDhPbe)p5ah#p_-}%F)FvJI8}F>ZlOi6zn<;`6%icUfWG7t zsDz*?W;T|uT=#8562f(Vye{W`2lxHEV@pkhs%xoxID3bvRalQ?J9W118v(0}2Qr#V$-u%dMe6#oLpK5mSBF26Idq8c&V$~0k(Qz z^%0O6SRlEmabV@cGIoGlE#MvOvH5X(mzV*x3~GFWrQ6<5meoMGpeHnXX{UBOf;5N` z_L41FQq1)|A8)T+K*@rRG?t}3t&%}F@bG|4zEn5L6ja0Aetdj^OwV!z>jYds94(MA zcN#>R!CC?zylg?@osjwk2dvrdK-)B19Y)9%j5TEr?D2rWggKG|p;J@e;J8xWU_ZXV zkZ^03QJ2Beyx`bLLkNC=LAY>>w&~`420eIbj?ms&ng)1TGXsM%=tMM#AvUKbl-evp zoS=LF6@}{Ypk4vwDPU(TV`^Ry6^*$|3mV!|4XZ6MOIoen%eA8hLWjv2k`(5&_6I`| zj0)jw^SxGB(|iNDvvpDjz-7ZOGI8)7MhmG_@Ic@S#0~KAq6UcVqPrWNvmI|81Pz9J zEmOeM)%{{m;SoL&+ywuG`0fnAEfB*E)eWlP`yX%LK7aoneE;#s*AMTYXwYB4{a=A> zvj>E9D+m^h9j3c8(mHMj@z*oL_@F9qJWLB%=Ts{IGaODF5XifGp}xR_(;KnvfCCSf z&L~G9RRYQk43CNi-0oRY1UvyKN>I$8<&;tTh;g!vZ=SEsfvozux=@m!0a_maZgy*DSqPlgvP?P%qJ&t%fb+amha>OW#qxbz z7b^mfTQJW@sZUtaJX3`MvITYlzSBZ?V1!zQJuL`6nnz2c;NsEalh%K7|@SOon zxy$f+cTIa4a2)0wj?f>l0?+nzp4y8gn)yt%5(pHub9q+7=z}jC{l}&~A7SvQ9l?>CkM*q^C|pq8hLlnSSLzbXkP3mp z6ubdvAt7PT8BZK++sKCe?PSF+3>WeQ%t)#M_@{sfQ!YJDE03kxGyRy|^AIcPEmY9< znVT0oMT!yJY%>xyXlJi#fY}Mml^Ma{lrli7Xsq&K6Jiq~o*-mCRS4osp=Aeg21>_E> zbFgjeam5$oVg;;|Hi+SXFP208faM+*Z0)!Zvrn0cU4#3KP<4ce0}GEwX{U=)t+Q7; zXsLt%hB^fYC~9CW`x*CTmbL-z7iQ^y4TEn|K8WN%q~LC;gK>ed!3a$aEF7VKFd(A&o8xT&<$SYz;M<67 z1E9UW;S9i6__(>ciz@@@@{k zRd?{2p_+iqgn9{gDI-L&lSZJZ0u!=TY)QDcY8)w}lR}@T%Ic92M*!D}&ThnMSJY6T z_zZr#U%0N-43PkU(+0O_s&>pUAf;fLL+}kF!M;2Bgom?*7gRXx?OM>qyK6Wy6cJ6FojCYP3zY>c79dWrQen)#_~X;p-#>iDf^CH@be&Z|UIrqaH)s{afrfN{M*iebd<$CTRws|F2jDKStt!75}u zswctM5s}$V31|2?Qj-CC4F8MT3n(})Xp~s_V)l%vajGvonwIJdfQmcyg^7;j96+st z_yQXRR9~<>0OkO}6h6f>^cFY;=-$@08u1piWOKj|zqA}z3%v!1E6n7&UeMUDq_)sP z(+my*i=hJ*T$&rwrrka$5ujlUfrYu1@WKUck4rONuoO&mwC_*@u*!v*f#riahqZ;F zOaWvVX2=v!j{!OjAjm+@z?u|RtGGdw0qP8aHJ2cAa6^0W>(d_}y&gkIX$5q%P+9@K zBCzPNqUHjW6V7ameSP}&yHz+Zr0h^o;W|ESC2L-ThxzpheJM{+P~iCx*ho{c(PADj zMpRk=meor63z#(R#AU76XI4k0{KC%uUefVp!xy?7sxpRP;Hh7!vX3GARI!30g4OAZ7IB9s}H>(&BOnk`@`OT2b$#R zVfJ|6cPH5E=>nyNQ&m!Rfw~JQg6!&BUA@fUG+uWB<$%21RNYY24%8+ZS^%kgC@+i) zj~nsyXi3P4A}Tb{Y>BfTj-&1VXeHSIX@-{tptVsyx8In*lF=wMr=!5-cM>0v1mTQvEs+NWV@1%+WUJ)iY<;HXZsR`gPE> z0kYnyIRyPgLTX?IecMQU!S)Qr1FK;XEpMeXnw_(h8tky;Y{4G(9-JdZ3dR}WuYR1! z(ehp-i|GNJAK8$S4l@oD?Ni7vtl)6H>N^0~4~2(^lWy3qUcdK0jLjZJ6LM_^!)dSw_l*}Fy5`q>`_=*d(}Bm zXIQKn4#f=1@Z0Jb$>G!qLf|H$V8;|sau4aOxhmjnkw}{06X3bjx1gv&bEudh^=Mx9 z4do0e_|SSA^tQ0QRd%^RTx*7X*HYR4uC=*+_+m7$OK( z482gVVL2ZyUj-qitEs7gR&?#eBYF|)&B&#M1O$UO&dHqRHsNr$)5B>!+)s8UpQ`EV zBpz0K)IX7?UeO-87P=43`~;(qvJxYw+i@ECtMi4^$jM7cTq45;i0Z`bkv*008hzhT zzv4j2hzYb#Doo%*=cuFtFUE#;&>peEb)dWl99{ye12BkQxH;DqE>aPuG@F(_$) z2j4g$isnpxiXE<^9BNTO+XD`oc2J}k(XHG=8v!rC=uo+u9=?HO2uur|A2=XmQfcB0 ze9|ZIi6BF9Caw%GfhKoOrJqAK@#lNM~j{bt6|N}iy8el=Ww9D z!dmw{4Cq_nzIEg6?Bp!0A_TM9&|nxTEnf6}9GOnKk$|)gV$gW~f)AVu+Dq8hrKOa` zg1+;PSjE`c2$C39Z3jZT8;SR{{BESe#ekB{9P8MH3kuX`+l)E5!T2AoM3^XkcP=K(!&2qsFq%AI(pwqEyagpp= zvXTiE3udq=^f8OX3@r-^8g)?PgtE@ZLwx)6%k^8(?JwPNe^`!JJ7{zZ*^>lq3*;); zAcZYPDqsvyc7$eyaR?4soxD0Ax7wmdeL*P7YdJWR8Ne2?t|ozu#PE%BaFH?uPB+))hBzV0e2 zS}ah-JX?8y7h-gwUaWvX9*js>S;3+s1E zyq?ka2+no1DTj}{_SfL|xBdS1{2lrgcq@IbZq(?gmV0frJy@NfW$+C)LuX4Jj8-Zb z1J|D*@FWk}IZThI1vyVgaSSL+oke(T=`@vo(6tA={5T_5x?2f#u8tMw_f3rx#@J44 zJ^c3Pk3XKjT9JQ(2sjih*5OQ^_X(1fla@5`Mkbd@&GZ)tU925gjF8!|sw51wHP$2g zc28)E&jH?OL1u#vdI>G7I4yS7&yd})QY4D#;A+F-LtT!2MH2G?lbd(M?fUKc{rljwMU9-w z9hL#?PH>>EP3?}043s&fEm8rNe5(3c${ZINE9%W!Dcv;G=*Z$Mp~KAWRJD@zXwlbZ z_P}deSxXYy9ep$ICE_tz#q#78Q`*~j!cn)^5gm}|mzSOgB3J`-&)cKf;^j0(AkYa~ zu>a9gwS1H{GRb~auqcn9^I>`9Uiu#Y;{-mSqA^u?+}gpevbCY4?*U#M9H`NGp^rbT zas-`^i@LYXL)Ux&1(t=vA82-48@}x)sF3t%G6b!adsL67sz-lki;_N3fA+)-wmFHrD6zp)w1L7QWR)|Slxt{=3UXq&E(_Gl>QVF>`0 z67tl{IR}93Qp;n!S9A3OQH>k&Dl<}2HwW*sj(AZFagrk-e8+L&3o%N3;5`Ve3T`!nwXsv2ZOU6=m=9AUoLlsJT(h^C)a@u zB)Z$uI%iECctk$ikxus{G*juHmLq9`gZfqpAyJ9spaBlNX*C@^fF)gm{bM>1(TF|Hhm1&QbTu40k%eJ78G`@@l4BnKLJxWkTw6q)<#(l57Qzq>w$bMSt5 zIG)aNOn?iFD9H@Lf=odCm3#1B7?#pzTMn^-Idlk>_wB$OG5SSl3HDV_4h%HPPFK7a z`|^rEvRQgIGz!l$#ld?#6vTj-^DrbQ4jVx@(IcwlQc|X6&@7@8GhcCBOj#8suw`}J z7EVjzQKcoj7-4ca!h3qZW<3)L-SJ)>gWvA`VfoiK6VQcl*WKFp1Oic+Uc(^3+n_Ax z7LQ|x0`!6k2aWyS@GK8vSQxdL+NuS1Cm;(&V-j|g4VT(YD2?pytASd`Q=#Im7q3N} zmivSs4B>gnVOh^cWl3LC;#Y(&fzhzOu*V?q9Ok|Dqg zRZ|Us5v2tQoFFVLUH$g)<(cr6LA7Q)J7h+rsdVi!Bl`??{$H>|(md$$+O?f-?SU|r z?iK%n-)Lx7AQnO$=nmLhFm}k?Py*VOcXChg0${=#IfON!*&6{t_O@bPNY)^Ig*|Yk zI4fE~^hij~N?&VamovCT-S4~7aqo6Mp@z|uRm1d}T$cmNodY>6yFpYIQGm!}nOH-B z?&vGMeHF0e`Srqw6k-0-B7N#$pqRolwf{zH_C08?biz*$)f_x&%obcJJ=)GIcU-5D z+-l-l2$J{smX6>S=E)L`=wTf;PFE9R?#L{O(>UN;z3=$Q#b_DHX6eU!>!2)E zAcw_g3cqI-nFabxC4L1JuhzWti_s!f3!gnMnirsFC{infP>>eZ;#p!rttZgnFs-SD z{eh6@Qp4a_#sKx@JL`}fFg8glD`=5zkzKlA&G;aJ)Xif74W zph3C0Ve!FXSIAiDIHppJ6=p^V(!GjVjYo7gU3n>mO6k~iMg$3ybi=Q(=jq*VPpFOs zP5Wrs%>(0=rK6_3vC!J^&c}x?+v0hG8)RhiM z?P=^eD203$q7XJI_9N&P@kVi_rXJs-8*~_b7K%gWirersnl{qi^UvjCCR^0wudyC>9hF zHFdC*vEOl+A`O(9Yj&!LzOu;IJdKtuG_@$%gZkmfW;uv9BHvAAGipnA5KveZ#AT4` zON0qdP`--F!dIXk+0fsUwz8a1l&$-X*Tv(OLB94&^vAr68SU zAP|>^=q_xV=jBJs5;1b3>~m$QVn+lEA4JO`yA!qN1a&#y0+N{d_9%Y_Z)^R-%~bWU zTz3Xnx$vgSS>z2u!&K0zt@W%GHigJniUE1pidm~sl*2K|ogo@>G_=Z*U=<}pbbGHR z#hT@4(lyxEGY$mkuw@35i@t_|(N0=@#+$qjGW1|LDqonJQiC7ra)-?9E|3b>RxIGx z$pyCcMUbB|kiTmn6`ToC+V~l(>-2#kNXjG_z#A!{Dud7}EJD8d^V6sAsIrTw!ogn9 zeMw|EnJFy?*}pM(N@UcOyGh7dS+rFHgo$Igz2F%bwa!Fh&8eSnwiK1*OSXD!U$esIo()g1i>? zg%H^=-UUUW$F{xDD!c%WHy2YyeKMY^VptW@PDT|xpeHsC6RDyCTE*%dcSn|@X~*di ziI^5@xYnDmU*7RMC(Jj<8!Gl>AOnSQ5TUmk_k5_;*s=?Q+p(r=$dyXCjImsFjbu>} z>2balS;!+0vNDnkPAkexQj<_@6~a-e$Fah5`}Fni-@m@$f{~f;p1hTLE+~UKF>zO| zougMvu$U@yiAQ-lqY4(h=@t$Vee>}LDNX+isY0g8Bmhn~YMd^N;l%nplt)a6? zvN7}ur?|zSAekyiH7{fLcJnh&`GwVlp`S0V>q2}*s8=3py0 z!E&mmnxqvL`CE@%xf8X5iY%t;I-#<8)s%dZx!LUx$5a3R(!?Lp7BDa=FG0!XHI9L2 zcF40#`tnKnjYeS;m+|xVm|y9QsrptS8_oSqT%Qs6zS<629-KSmvUeU+RC%=&C3g<$UG64v>!SqqX9&^6oZXcS zGf0$W!BgM9cC!&-)W0Ss3|^>G^uS*z7~x^?LjqiCanthk75Rlf8kN4zDo+*RL&xE` z9(LHEI}@i=9#9$%tYNX-^Q#8PzMO7&m+{gK%PRyCY&<+J6{v9&D0Lf=QmV94)blk&@F*Xh456o0z^su^G8;NZ@Mct z@!|d&q-5W0gLFd}3po&JK?gEHnl~(}5eS178R~2cQ7}kENq^a3lEehRkn&QH_(Gmd znx+E5BpXs*HX&|~LevX+FEM8kA<_upltxKh3OkS+V60MnPGltAB zBR71E5oaY?4jtsWFA8#%#TzUBwF6ddJ>KU^fPg*@^=rm+2b=Q*6wA zxxrzCblDpB#r))m6O$V!CUtli1G+e`Bf9oIYT=Vk7C%D zSZEXrpu#yYanKm8Q1mfqOzsTPVVnaK@nZ}dQ`nqAXXtm(urbD5*?R2D*3(@ajG!q)~9GA5Bj(3mqn@nZ@T zt&fd76B$j$p*#@3g;LQZ6_z2730;Yj|1x8^P#(o%c@*OvlGqEl+6S)N?gE6qIo|FP| z&0=Q2aTXb4ridJ2M$DK$VvHW8l1 zJ&jC$q9~sH;+{ul92M_@%o&+8vW=t97#+q1eCGUg8hXa|N(>xB2V%yXaYP!whgc7g z>=$;XFwhJUE5JlrX%-6$lxF?9yZj_FCL%Q>MZu4Y4ULidEFtymkkm)j)ZXFL zBSTW>ft?T;gS>2v<>E*VslBYJ+#5<_M~>0aJfR^qdP-^tj8xgEA!KZE>Pa&$nM>`x zOjS}apo|^QGDsq2HjXT#^SQ(-b#4I7$hY1|j5niABSY4(q>*}qbd~~t zZ-{ymIn<4tv)hV&UKCr<$KwCR-f?p59Va`(2sq62=rg%+^qZ~c;pm8-@nSxcDF&q} z{D$sbk5yna>`jq*;}-}==g16nV?{BgO34!?ogwCp;cmpAQGwa~ z6VqScR&$#?bD*0d@Vn^un4jD$oNd@0=o)%>YIA`!lfp9h+ zgp+wgD=ZvBF%k_$=^;3omdKIvf6PHz5dG82>sIvd>3w>7`!k4c@h!PgekN1e%HS`E zzSB`lIl%E62mxf?EGsGeHrkNtQ@uKMxU+cKKfiP%b~r=n7Eyq z(4r3q{0kxu(Bvm9(fhUIw^9+EA4R`ek5=@X#=Zp6vpErq-j36i0~sRrOwm7v@q=w!x+{Np?Nlmfq5K}M{FR6(xLC?*fDtMg?sDi9=iOEEIKHs7ia_U7^x>RE{|h2 zY&^5WYI~GCa$Fwablf}b38#U!fzF$5uGRNueyms65%$<9H&6<0-t67tY8$pvUMr zx$T@A$;Y{~FO29>c(6&~i5`U~oD{Ci5?Kw7Vn;}f@8iH7g%7>LSOkUIPz>5*2R2lU zFfl^J#G>qM4a`%R#Kz-E47?LN@XmJQjNAx3hQrzZnvWbz$C?eCk$5BWz@5l|JBg8Y z5=YuG#7=IMo7|mDxn$)1K$~IYp46YiJZ}=Avk48c%HO*;5fE z%oZuE(K}qu#^Z84Ku25}x!EN?M|c|f95(s$Rj@^t5yl6Beac+R3hl;%2ciu zLB|ntjDX|!cBG)hzhQ}*+Qh+eR2&^m;HbobVk2|jEEJB``g?H{OTuxO!Nv2^UIJre z2*ZI|5OZ?2ad0jrH6<01=I6~(Wqy{A+x$watZKJxlL@s3IN2~%tY$#G1k@m8kjK>ul z#mF3)LqzXmH7_xVB*N_Yryu)#JT^8=Y{V7TZcMVmA#;jf?3~aUS?(b@sR!X~JP0Qi z2*+KB&!%E~mtrIA#U8B3O5N7P<_uqx`{QMfm!lIa25mhm#~3-b8S&?im?PRwVy8^} z^*NwYY;h=CUL8*G|%SW+icZqKqL{V7^cEg*9#Ewz79EA`a zEyFDTm!ibYCrW3;{ZsC+Qg2=F`eC*S@R}8Sp7GrDUGI+OYA8{4qoew*cqA8bPSr~h%mku%R_8My-|rS zGTd6E3`KC9!ozV2cYl^KM^?TgpUD>HnMd+$yis_=(|R(UDDy|m{H3@&-FJ&Q!=Zf~ z(kC`CppRSUK|ra${Z!50GVpWApTZkJtvD?ktOAkXB|c!3&)^!Y@pa7fs9E+ z_O6kE0?WihF?fWfH98QF!@?+8H*DBu>587=MfBMUi4%$X7OE(f8!RZ6ILMBVHlfcN zL!TBHg;pX`kcxJp6*oMS))_itXh5E=A$PXM`f;=%R|yJz*(@{?6D#VWX9tPvQy9*t zaHOEflY{(jnH?|tFES|ghEAJ0a*%O=QV%I|Wf0cYJx9nOMS?_z2A-o7K{$7EsuBEh zxwIG_$S6UMh~wa^p;ZF~{fQm)N6Z~pts&?q&phuZ^-Q0QHwtGsppQ{^a!>uqY<;#3 z9o)ywD=^6QF|bf-yQR7ibKSpH8>69rwuS-{=x3Wd%ukUy;}`fRH_(sm<{aj4jPb+5 zU?#ZFHgk-h?JwBR#v6qC=8#31T$x+wtD9yR0>}=eu4sxFMLw`{HOEQ}K4f>8s}DLf zfU6@7Y46OKMOI`n!^lC7Taw!wOwnO1)pCfTjW+O&la z${aOF7$Xa>%qUHnPY5%g5PAS>==<~p6pBnj&lO6&A;eE+VVrqvhG(@pBR1%ek%S8E zn%aR~&}K$&$}Au=qvb%1B4jWj@yrDe%8eSN9UK}hbIoJUAWeryN^>!SG!ZQg)+=%kKdO7@UZk7Bzl zm)@mnA2;Zb@IJx?@yZgTVkN4{8GT6X9v>YOkK;=$I1+oSt*R>7cpgz~JR*^Q91tz> z;gYCjR)iw0-*{3`;Wx~UE|eSp#|4-5{`n=wE6N<7$hObyu$hsF*o#2fXv@@SNU1+p zV&`USK$y7pN8yRIlgkKvPoT&|kz)^WL&dZ>GTzX}^M<LIKyors*yc5qT+JTDB5@<_J%erY(t^RtjZSp9!H^!w11x4 zoEg&t(2?Um(Q@1w&Sg+?z*j9z3ABY!RnWHt6UdQoJoA}wY+x|l?I zz9Az2|7ZV#|L7mVL$9x|bzPG=bghPjF9=NfJ%;GRO=<8D>1NmmkLzyQ)m89V^-6FNd*7aaA_h{K2mdF>T~2>k&QTNAkdx8{GB2 zp6H>~aSZOeM~ZU5eOC{M<8rT-;NG@} zvV@d}i7bzzrTL^Ex2_L z+|+c3!LQ&c2hoJ&mFT?E(D4OA3L}p~I(j1%6R8z4so_t?GSJM1V369PHM5AWbjjiTY14>@HfBJc+)~fW8!BM7s?6SaKtlA-q8jjN;Z^t6ZO}h zFYk6)7YEnnbf&Mt>&VYj2g50u6VboCsfDGc^6@W&cW^zPj&vw#{E<_<5i|{mxx`WhXsO{ns(fmXBdW(xb8ZEm;N$u@>jvA{%WWDTYhGI zrGHj3mFOBzC?$Rq24mmSy#|c-vC=UD`ARb`pb3yj9FFA;7z?VY6L5^X-F%&wZlT+wLh+?P|ZR)4V+Y>IZY+KIl@rXl`uSElr^~- zD;M_Nh1cQ#Im8p*{vQtYG`CndjcY}R@5?lvFD>~)c!N$Q*-!lTiHf(4(5OjoQ%s{C zdx4&aMB%PoMF(I|#=B)|ubiBoo*oh_u zgI=vU=-<-+N#Z`p$%?J#s=Nu5p%x3(dvWogSr7%F61x*ZtFD+PyWcK3DB z3r@n6;iT@pTplu~o*$5@?HLoxiT-^Seor}yGIb(BYEb$^U)X$K^wi4ph0bOc#R`5f zMi`cTO34JT(n;!WS-Br#eU`H63uf7``%(sX&+`M(K%`Mc5)pB3;yF1eRcB%$3sc`p z&)2r&j_Ye&t&l~4mX)!#X^m9XnSn%r_!zv$Rf)uFUN3Y{FI?3tiB!fhTF-P;JvlZN zN?bGVd|r*A)6D)c98v zx=otr{dhvaU+zpwNwgx$hnNM@sF0hHoOPi~3r?BLepk9l+EsZIY3h}4?mVt^-9L{; zyOVO-$g3ohb-~Jzx{J98W88^yLxbPJ!r1d*d}@)j6s~F}A8b5nx?6e39ltZ4$7bB^ zh^;~bH#&S(v~@-(gPfgVROv+qy{19Oi@-bs%D#kKS)NR|Re5TW^vq_(6p_}3(okgs zk&Lrk!%KEi@LjG3W;zw;_u2EgMIPG+-}{vxlv5(nuu#yQdqiU#jirv*#E4i9q%ikv zp9#MI@$uWYf5^W=D#~Zid9uX12RT+VeaO!&g?uOfCvv1Kq|j#UI%gm&FoQ_1uGg2O zH2B7J`xV(Leb}JX&$z-5-!I%#1rfe)M&;^^MTSJTGpf`$E#hb$=nfZh=2xrV3B+Pb zI}^1bK-Pu6zym$%JB6hcCJ2*5W$Dv$7#Cr(F2ZBs)P}gai(fTOMz^}qF$lplgJM37 z(y&*ZZ9kL;x4`Dl6B2Byaj?$j51E#swNCUOnF{?WLVk_%ln+ZMadm{)XeWnxIJy5+z@lC#<_GU659qvyAOz7P;eW(7*I z1YXgH0rYIwT;EwqGbcmjTTSh4HQ}X^dUZAt364e-dkmJaSn|&_*N0n4VAf&f(?Ah> z?0HX&Npf*++q9idS*xezyRotGsQF<#rmw0O;i5}<_B#-h)zAmy_op9!zI-7pOWz1a z!eq%8uy|RTn5h;c578nn3uQ&6;8rA^%b!THSf(Wu3t0|ty&Rg(gehxzmVw02tigi|I!v%_!+zs2KC<13&0G~Vbz0Yy^Mr%=`* z#%iP+r@;(?xN5?+X1Zr5j7tu-UcP>Re)H!$EkM=_sYe}e;?XAVKz%95uN zS!`#SP^4|zSE}HpbYFuBgKEpUMs742s~?))Gm})(E)M6VPv)nwBD=>(UQX>c>2kG< zoDs^X#tPT}=FP`v%$37<;;om>#4J#>FYSp!3-W-8j--fCRfU^P1>{?G^7Q=j@$Db5 z=?93Iu!=>`>9DKsM>-y%RW&<;zwY&NAgOD2UG~-eFwm+_TyQwmD349MoNY=dyAB*$ zEEUnLy{Q<7;(gcNi0^?(uAER^Nb^vfp&{-Q16kZK0mVof5-Mz($pYJV0)f#xg$bv0 zJR{|@wh}T-`Q0QwgvenB9pL5p-Mg>v#S7ErG__r4!%;a?Tk8WMYE>FDOhho@x)xR( zASHn>FHhg!J|Pa5D1BWhEFBpoOo*>DJ$cVdDJ%Lnc}XANJ}1G?+gv_gCHxr;?6EpN*xHR3q~JC~h}W&f zA30yQ*4|A)!RmE*rO_^g2*`*?2cx3|LBc8sz0gyd;OAW5nrra$^Ydf+_xqISuveB` zHPY(;`q$HcFc-U}rijUu8hL17W3$`{EfW>R1R&$Ge?9Hz^z_cD(4;Vw2=eUgyQuZ1+HA}=eoZ3&FvHzZ-5S2sr5F$G zPL^u0G&UOvgQ%ou!V4Y4p(tC@GK8BP;eI1~24(t1{Wh2KavA7R_d<7=tf9zK%%UG0 zRdbw`(b$(dB5802f1?qT8z%}}4eQLJyNAKa;DoU5RzSFhZl*4HApFrVL>yMexXBQA ziw%fV#YKGm^T(&BzXP%Zg&T(0Imu;3u0YY`T9*K*)m2zY{jO&#! zx?x;;lvW@IBh8I;#XJy+O2h;vrIOr%@z-`78#XSACHESe=5+QVD=uVpJQY2T$1`%PFZG)FKy&GRJocIk+>78#lAYO{24U67UEn z)Z76z-Qj?eQF%OEmjjNEcV)is*5m2eEWxn*$%4^<3ezg8+@s}l`O@C*BjGZG6^Cv# z^bHr3{{QiC`F$4zZ!Dp6hdT*yB=!!dH$CVgneaJITe`P|G{V$1C!tM-wnh#&RO_L- z?VuftQ$tDcTS?j+TLbSj*d&a4+aSMZ^v~3tf-fZt;3WQ)M0f@S8k2~1zlgYazOx{H zz7xqp*qoq%YB|O1br~jpOLJc5lVEa$vXCvep2>$3fyV%GB@uHyJK2bmYt%MCLuIG4 z_2HctrEKSAKfVTM0l{x2jCve)-99)^6*)y@#XSfGV+fu{^1DQjdksF5A;-5!FgZie z&1~!?q0M00XTDkoqsH-tK9A!-n3arPh`n(!hjS;bMt6cBp2P+BP~$UWFVBkK=rPeLW-Cj1G4`T^oA9JRh+ay-=T# zzfQu#ErjY(YKho(gvOyr@tLZ*aTUC6?%I>ka;So`4-!St^{k^Y_Y_f%r$!Kw1c!1# zA#hwr?h%ZWin46%X$X=#o%wk2D)HVR9HLBU+{}#|22EG9&O&92Kc&;Oy%$cA!kZCA z&In~3*f;w5l9jUb&f{#?nL5aiq?VP;gh!7y_r>oYJ$GC1zU${8STB9^qJ zQ6s`34%?TMq{{WiDQgj=C%RK3gHH2w`x}!uM=TkAGh$jUHx!7^^`3sl&vo6i>4+>j zto{7vkM;fYo&>U2WRX3wYOiWLr=c$XvnVxZl(Aaz8Lc+zgqq@nP3fk5GilhC`-$YflDxmtRHtdWz0KDM|K%59 zj@OBzf8UlnQR8MZI?kfL6D@Zxd$HsMlEcH-RWZ#GKu!^!x5iu$n=X|EY5Vz=Mp^07 zPVMmE3sj!UtKfDA1}!;n7m;IOjKb^fht)uEg{W_3@cBvgNn+kGVaWz*QgN7n&dZr_ zxBcO`Uxvf6sVB@1WLEa~5`RI@-pcA{6!a_zko-3Ak@qY{_awY?O-BHnuy76D?0&70 z$~CPZa7;^}q{gwzO_LM4{p-gYzeE-|zz}i76UvZhX&D!ulZG+hu5=Jjtk~#0(bEv8 zjz*&?8+Q#YN1_~kBMvn9Q7?3vcK8w1Mt7m)$IZqTCuq)&h_nyo<|{#RsFjE(H_GvM zKknGGf~p7`0w5@$ej-5*fzYvIc+yph5Xa2H^W!`;jwmOl)N~Chc$_ichM^TL4p|t# zw5Hk8cO@xt{irD?WN-AWBCHD(`QmOIgHJSg`aQdB2qc=>1uLW++i+o!+14TEcRYJ* zaJTlVTWuH8Dn~PfhMOzF8(@@lVorzNbf(BoUEVS=a&#t1kQ|evPwk#Xm%bH^i7>gK zFCXzXDaea!C*#G5i1MkFPwBoK*$&W?34n?&78`Vhj`|g|%JYR4NgAWza)@i(jsHoP zJ6Y!=nKC@OYc4oFP79rtpYCJL7xr{R>T3*eQRa{zo+iPP1(fRul+$pW;3UW^@pI#1 zRJi$M__(n@l;XvmNyjBFj&$b}IjY?4FyqbbU^Fd9GMvVe4fdx2MFjHdpbg&AKL&e3 zr}LNWLmiwD-&ol=_3CU3{`mC#L`=>fC;r1`rxV{3l>HWzTga6gWR*CMVsR#>T7&NHfPy^d-@e=I%EE9$*;F z@5C6=m{cbD)->W~6M0jA&^2zu-FxHtwaC>@H6rz?7KiRZXRW95uB$1RyBva&LPy@5 ztah?htzbfbJpFk3@`QONj3>ldq=~hR($VS4;1AZO#HKrmzeh~=t44v)E$T>Y-9R88 zrhKSmYA_O52k435no}u$@CobZqY!p|d0&I$>kcX4jxKkPD~S@~&#}$!i0bsxI%1vR zbTn-J`Eo=)K~5dg8v^Q%+@2-%L3}y(0Ubx>9)_1Ioff3al?Tz}kh-O2IFj69819YK zrbQu1ZL5TUx>lZ-X^=ekb0vE2^w359e!acJmcRbdM7cFMb_4#1okJ1X1P@h8zMTdg z5f0Z?99wimGCZ>#^T^8nU3$7Ri~9Zf<@xhJ!SAg>@=(N#8^Y>#J3Ls#ha)>}kL>j3 z*~-WHE-W3E@++v{OB1OQ|}o4=!5nHv*Fcjy{J(V;*ARgD!|B47EP96HQ2 ztwHDL9aOxz{%%Ufl>z8b8^`7do!_6{u&L!(Ruy6p+nVRm7<1Sc>A(SL@eD&ApGl9h zhKbHny^f`lj}w{n!ADZrzdZjiq#Pm@v2ZXEwbf7sSq-VTkFW{V!?V}cAso?A6N8-@vINOHB$dl%s(p9faeSNUbaDj;y&$yIYa;v> z{r3Usxu`OTs%6iR+0_Fn1HqwvJ1coj)1ui1)28o%L?do8%4H= z219ti4hE^(uV=ww-mffF5s9{{X=uNU_)C+(O1bwPQFCYQsutnHNJG6UP?G2Pq%qx( z>=2~26Il*1g=L8M8t^g@4fo!$<2*~Q-S5qy(|d23W|?U!IdLF`jEKi8m&ZS&QRay4 zk->gctrBMLK@=LP1+y-tR3g1cZJEe7B2-So%-uC*|NDNt@M019cB^1>J0a#$R<~hP zq}25&n1_)JH8PPe*O4SQ@4Fp=bxk+xT4*+6)|EDZfQIODBV*d05R=*Dh&m??HuckB zq6k4%KG?IXj=;a;X*voiy+0nXtUmsns$kzeNFlt27b zu_X!x&>edakF@gaPy~BI1LkU_ArJ3O@Sa0KSs+7_F?Iyj5hH`-eou$y(`edsT)?tA zq~%zrebpmjtY>dPIe40YIg!>OWm^+xM@Q*<*34Od4AiMumx9-cRfp$Yp7)H68WzTc zSk_*YI?;aj+3k;c8|+=tS;N!%g=ZMzfs{C>@e;cV>DR{Pyzk`O7=e z?H){$e|vd;7UJ$s^WD3DjCVI0=MKrYaqaL*nwpeGy^Azgw_98&3j6AbLPE2wEGPap zP8#~L<0u(&o_~`e0G>!|RPyjNoNC9sLo7U!@Ni{U>W<6$<;1qjU2o<6UEi*g;q3+# z5Pze=*~^97qWHp1O5!eer>aKu+8u|Vn{AW@yY3-Y8%itUS^j3j#v`HbaDf8dF%jj} z?e_co9e3YeNmWpc!W%uYWV~yK8-3*O+P)FeaM!kC@3l6PX!o|xzWi|~W$rq1V0=nc zosrFnN)hKzJsLZ~Ag16qR{c=9s4=kSG>Snfd@f45)EYkgv%)-c>eSK^Oxt~dEK*N*-&$Ad}%f2jnucf z*6AjWs1KM&Fvr3hC(G(*pkHAVx|8p+FrXgc*LKn^XN z)?sKNUZ7?<9PbtD-p$<1!MnM5JbnK1H-U9$R5&4fES<*9_w(QXBEas!fzi;p=504@ zb#eH*UFQr`rC`)Vn~gV>$(nIR7DB-lkO$LfRJZtc<8mMvj)d0+g+hVppvt9S7+kR# ziR%{sZea=oV;1>r9JsV+uPJWqompJc3zygPMn}}ad4{UO36Y_p6x0xbj=3YLE(=1t z^3Pvdv{vyLv_c~c=!D89|GE4Iiir9yLFM*K9cc{97#bm9>;eW zB9HUam7^A*e5soDauFSGTF#D&cN30}BcbEqT?-L^Zy*fs>^Oo5+bpE;##`n<>sbcx z1aAT_1O;baeOt4Yuwm7I=3)^(1{p!qDD@QrFEt?xvAnh@MZJ6a>zNolb|{L1$2A;; zEIn!3a?mua@I?MC%3o0!#?7_3sxR0c$iq!uUpwmDgt) z+^)A_1~tlD{K44UF_F=7J<1#-$+HZGTHA6d9t%ls!*Xa0bvP`0y-No06L+v5*T#|j zgrn=*k;xuWe)?#G8P;?+svl}pZxO{=)2aKC*h7|wJINuakN30Kee81mDLx;{X`asq zgKc+pSEF{zr+2t(>0#|hO$8`CApH}_ud0mFw~UtqtHqj`+PfKXW{O;)Mg{o7DcOw& zwkuLDvjO`~nu^|d=$N2Ukn+F%@bT@_`>&kkS;gq1-YS+hg%2TO@W29x@&q0g>BfmC zX~zo>#Il>#wsRXxCuZ(6_zN^#!%p3@PZqB;i~Stmr*BRK^kYUx)u1mK#`z209{4c? zLz;%-^?tckEKOkDD7`T2{%180W~>_x33KM<8OVggxCgECX0vgIlxCGg7E7x~cTE*aWU^Ft>> zWjPoO5EaRt8GKbxZfjc-4UvV^Lkb0wIX7eeiH;(vyTg{Q2X@hv%nvA{QdQc!D9}!*6ViE<{W*YZPFEvdX_S)Vf@) z)369-c()BWl8eHUJz0io+@xV2t-;*S+G0--_aeL@%FA!oMumK%8YYr)&&ADw*TuoI zvoQ{l_PqJ?&6}s-joJ~&IV9o^DgHomv5<#1V;%P7C-ManlMwHz_=TPEgew)7DC`k} z?1`KsTAY`u@v#a_S=ygNq6kAI`cNHgRE|c+rKm{)!cq5Fj1stp_K4kP-0;Zwh~to$ z(YXb>2gDh>IF#J(CRlwz-M*PQSq^xG5S02fmPW&g#u`@RjprQKE9(;#+g_M>(x@p* zxf}PRkc(-&6?Bp9lz|Ecm^9jZ#Jg>bMRGBD)ua`Uuc9yN(T-y!VB%OAf^l|dA4dKJ zTI3IglGO?)J&yz~?$tv7MqEYW72}{9&U`ybOcV+aYK2sp@kSDgr8qY1VtFI~#5Uj~ zqUsafisOn%QRH*!H535lVnGxQt4MY!MVLcEV7Xm+@IM1Ba!{`fypCmWCL1uFg?vc{ zE2J{ECgKdzzS*Zv|nzPvi~KI7vibB=}Rp!QE69 z2Htc+EB3~5v>WS=<0?!e5ue?j^*so`&=AFO8XJQ-;!S=!ZbBSa)ghtB6bt#BI;OTr!78CUu^;Vox@Y+)OOh1t;wiEho3KT;4Md6PlBLj+ zI?0=IM#@)d3Cj{E8oX*u*<4K;W;wIrmsm+=3?xZvik+Wc@b~0tl7vW})GSY$WXCTF zWFRA})KknDrUZ$n8$_6YLoFk*CB=jk`4xH9*~pTO2$6lMYd(pwSvEo*Rvh8ZFX3Qt z)B?4v#C0uE@2G^DL>9G@BU)BgBZpxG@=Bjq29^Jmy$VCV@d!Z-PmX12%Fjt;t zLgr}LK^T18CEIgw)QO*8mu%G${Zh4jNXvcN`%2#C#E!Ax>E-zgN;S`9VX}3nbM#A3 z!4%q(gFJ$#Z{I#We>dV~M$RP?@B1&zB`KG#F8nlh8@wf`>Z68ch|6w_1+Wy*66rxF zXr%@e$)d-2Z=^5;m+a>5jC`MlP?_B%45oJ3x5}HIXdqT=0fT60h%hC_^2SS-5&0#d zGde?Eb_7;7Dojf`P=heb#-N&IgHkEAQb9t6!O@78?9jl~KU7nsK|-TOJK-HD&*>rA zHk;uPJoR@0IeUvl{d{VUyMysA>6C(fJ9*EndnD%I-#p<;)LlrWF>dxP+7LRm~|| ze!5iS%&(+ag+vIdeGTwtH}Nb+Yqlon9z5Z97o~`w}kL)t~(Y2H}ozV=2^H+rt&q| zY_?ne0wOns-joYS&R~)YYWWiu9q{pHy+sCR#2*=)a=5ig!Z_eK^q}CEn?n&4<8ELI zP#}(?OkT7-mlLl^r&bhBa3TUXGfpG^NZsV8klZAr&y1od_<0XMm@A41n`a^Z2-w5| zHf0yF!7~dwSHl*hI280?h$;DIFo=5$=q#LmjPgxEFIG8ubNMFCPy1vF@`6>mJv7;d zBu3^r9|11XO>$mDo|B&`;Uvzu2Em`Ba++;%ad~!LRX5~@L7v7Le>89|`a#R-mN}>E zvy30V+^wyv{Tu)H6-DWPK9&DK8{h8Wo&iRg&W`$mmE6QEN-+XUttQE==%8Bq$CWM|{{> zgp(K?6qk_FpwG1|5-~I)Ae8LSiQX2{a~q#HCMkV>Gp>LBdlRI!xV}NU#WkcG96K$V zdGiX0C1NZ2qIgd!g0B%Yy2T`lj`ev@;Ak4i`+q{efl10e=!uYipydlXN#dAX(JiT= zgk;ijeiEmIjHZNm=CSCW87I7M;z#-Nk&dN&JMn(W2oW{Ns1TizbK>aOqM1md+r-33 zqrW(#TX94S@oN(Aw%H8Z(R|`N_NbPaXFg}-&Jb-g#~%eZA-Jb}sYwhxTBHs;TExa1 zjT~ll`-?Z~mt@+}u%lZCA=TdQ);vkb8Ge=R?})1Ax0tfocw%Ycjo8qoVw7$?6tpl( zY2oOp3JwP|O&z}UzZ_GYA+sZriye-%@Ho=Y0Hm?wjuJ|=_3$M#Hr~*t;l{|MLWs&EopDNw z&;v_F{@iYjTWSE%P2q8+xe%fb%C|L!8pLp;na7Rh-uSiT7l~A)($sbndui**h+EI< zqFZB9NDWsS8~QXh^r^pPW6*6ayv(z4=nUeQHr=petuo#eA9h9b!KkH$Nh)!GQ0Ir2 z98;2~Hb(pM$QuVV&72{CsHeJa40%ZMbYy_j!~mzc6B&k;WP4{1GC$F+i#CqOnm&9VE`^ zHI(8Po-{KGX<;IOr>?T_oHy@$IQA@?Snh`nP`dHdQE%jCgoVLHw z`xho-v@qtVZJipnH1!ve`eQrlUg0B?`5>m)`oyD8EeH&%Dc8hyAQv6Xh`nK~QoCMp z`U;DHxsaSfh-M^qrioys!gw0~H8;#=ZostM!(elZZn*_HeHs6vnQGnv4s(}eIdtjP zp-K%C>X3$JhzXh-FElqWXzn+3F)Mfeu}K&;CTVQo(%6GbBM0+Dbl|hjm{w$hY4R4c zY#ap?r9Zhi6GW4g#*EOsm?X|vq)_2QNqNkSpqIJioU~9uJ^ibcIaim?aQx835kti= zbwnUDGRF{g5<7yZp+yU$gBFGW6)8D$?p)0yX{t9OwX{6-;hFkZEwzA64S{K{gX7c_8dHxWOodvC#WPJ9 z2~o5nTeRR$Owp~A#6Y8=2aOiqh(#E6;L+T8qZUCt6DL-gNMgH%ZlT>+Vj-SbPA z`J)CEbwI*IE>_7B^^DQ2H-0TKTxqt6Ji5PgBE(rbZ1-{Sg!X zWc*s<_lS){8rdb=?R$D~;s{L65Rf$F%N+}v$vl|+Z;7y@e4q;2n3X09H|FC&yu>8Q z`J<5t_sQ@io|LrCSo~1d)=0YHPhe6ZJ&i9J+hdF6BilhqJ)Jb$8kRIO_GoSr8-i3Y z(2dP0g@{GIiVaUgvHkR1Sotynsi8|XKdh z%o0(Ec%ev))5s}H!eV_|suX!lY$PA$VxMN7bV_!pk;o%81~}lU5TYAnjpkd&Da|~m zH1|d*M5*oOh}n_o4TdNcdesL|WcgDhPvH^|Fg5OJWK>llMShyD(-~- zT@MW;99kp_{VN`daYQk$Xle-4)E~{g;GqwN(36}=JJ}eJbZcUBxsL9r^`Vsot(sw! zQp1^g#H->;VTNuaG90UzLVwe%ZxDT7<(V#s%!f;6Mt!Bmw>fE>blPRh9`kB6i@x>h zz=-I~A&CB;uk{i{pXnR!4&_(NL8R~ag2+CC2%-ls9RL9#+S6|s)V%BV1=LZzlTe=v}U@KEsvbxbx@(d5tIriDprBBrSTgIf=h z+Ik`oDu*J6Mv)k%ssK@P9my&Ik*`yVkeW-1jpL(ky-_3{ofNzEW(xBf0e#y|pkg zW@~IwzHlXTQd~EYgSl>VPj%f0=UN!t)xldmj1c(^P{epGOj1L=>cFYr%<9L4z1sT3P_IH( z7Op5l0<5hS?95k_MTCt!5tfKlkyV*0u>~6?YR7;T7FO&*qxD3&1B9C)aH>Vv+%RZX z&CMLo)d;J(VO#~`%q{k?b7SiuueNn&*x0l%va69^9ho!tbl_av2#Mid{rbeSViSA9 zxv_v*K{f!a-_T*za-T-zs@Oqsh7n;=|IIuWR@7D+ndih(g%i#McHOM)u0&*2 zLMP^NCNL^nND+E67T#EOJ%we-kp>7>hg`Nf(Q88)*$GdCAGh;3>B+0@Pb zBG2loJp?jSUDR=BwMA^}SsZeVS)DC1(rx6A?(Qnx3K+^}rAQ|f3mGv-f5grb;Yze4 znF>+LC#FVtpuJVI5Yqp>17tIO;JRb#ktxQQd|8iY4C zSS~x{BUPLYtDBo-M%T54`7fI8)*BwQYna~9b_;EBsD+^i>Z2#u?F>WbdKNVg)bNA}bp8S|;*Xv9W5u9pHy*q!$eSAz0Jg# ziIl4+$;c?qt;(XIf3Be~#M1~J+13GYBZtThy<`%5GQL+i@}0?o;0jx-2V(6(qRnoM zjl0ole1Sgn&na}>rp^eBhnt%i9k(z#uF+~8H#t-*nnXv>?V!0Ka9wdA#2aj+TqEmd zb{{-3BzxRlv7^!yik=F3d4;pw8U%0aiELX>!}A^EX5<3*MndDN z3SxBMLPltd1y%J;7>@2M+V0kfx`O0w^}LPso5^6&R#KQ~+l^ua4PsLT0JinH9V9n4 zZ|-rwxw}2jW!yR%vdF*=`D-{}$0pY6xG~i~FnZO(RbKs&ZIh?cuGXz$k3 zf46plGBOc(H$oD7fZfIe>^An_455W}Ii5+#p#Oy%j*T;HVtC-(pC@w?dB(8c-$7hA zMzPzta-A8OBMTc)*g(gL9XRm^PW%PO4j^pT7Z)BUod3cJ8#mY}#*yKN9r1GG%HzgQ zE)wB_4IW%Lrf}?;!W)kg{$&Ur9N7xv>>B8`@X^1B{NY^%Pn2PkVq=n+gq}HE7+g3r zF_^F;2pbQ$@EG9SfrB@h@q{-XBb<0cduN-%#Aw1EOzeQKh37n5w|`i;#7IP8%_oj8 zoN4RC@0NHzapJd+ZTr~h#Ci~gOO=dBY&&`yvwt-daoET}?yvy7_9EmWt%ufqFBGxn zgwD-Xr!(Gg?!m*x1XfA{F|e-#I_Ad7&OJ)kjL;aw8xxx|)Ua@kxw>&3pLpYq+#4bo z=e8nubCClXXAV@XD>trYZXE60f;o4!mN56>CnL*@My#{Peuay}xxvMAl>!}lXz={;%w{C#3J~*Hfd6cx3Pm0GX&Z8U=(5<*J!Vqa$btTdpAZP z-nezf3Ep`6u%lvfgg|1v;;l(;qOI8{;{e2w#|{4i5GT&i1sWDNGc0aq@JqE#7+*NC zwTZ1w{6#omX=c$f3oR5h#))FU<=D{1u^lot+;Z&piyR2qr6rl+p)(bt9Ilw$-OV%x z_H2cpR&tiAKfn=*b5A5rjYu3Bkywk3+3U*G0uh@Smp^r_&5mK5J3~Zdi}R@mn5UjHox1vu8MbM@@!Vs(3WFKji8BvF z&itjNc3|bTseyY_*IZ~uCQ5Rm5HNCassfKB_bBATp^)w9i9dScLeQS9jenr{+lYOb zx%i*@bSO1Mx^I~wA6ZOb%K?1zh%+|MFfejt^O2iV^~f2aVU#luPR_j{-0;@pie2z0 zzD$#-yedg0hBH>mpLj%kVwm4Vjd_xdiFU~x-Pz}~iLta36&fXCEhh$zO;_O~qLj<&J~Qrym=;H@1v2HV}90+VveQc`Hit)|kmgRgUZsDjdc>fMQ>I ziQU)_QIj*HBu7R`7E5^J5yncpV>RT9n!NR}9+7W$Zd)D-37k&nxfPoE;!w#U zA(BlB&qdCE8L1~FZ#@DzGwAWgM02^v6z3kYocj%3c|5W>Y@lNuJoRUBxn*Ptg4Kz& zsS7q-X46OvoXqx*P#Ias;nAVdjzcwMK(MQz>Zql0!okm!aJietCgCG^Jj(Lt&)`1~ z_u1fM?N|N?HLmaL%tdpXibXt*_zNEWh(D5zFXJ3M_Q!kmFqSdf03Y@1t{zU}_&mxh zy%-Wz+%?>@B(0}|8Ug5j9S6FSyRY3c5gv12F8AI4F+A}Mp%0tjemqpCb3MUmR{9#F zQBCyma6b&|@f_UuyVp0T_dkMvcEhgQiCX-)9v{J-E_Ltvax-%p$G;H9OK>mevYyI1 z_~+@%AJ5OhKjr&RPv0+x;Pt`(gce`YEF)MU3tmV2AG~(ucwe7*x39ayshWb3WEA(~c!~^7e52b*v&xC!VSbiM{&361O?jAu8}9sa z9)g=bBPT9+((s0xzCJ~e{r&OFyRUzL=YsMq?6AIpcl_avj8^lfZkR_J^aM%_@yNr7 zPxN;u*JroGeHa%JhH40W!W>VO zQ(KLEK6KTONy#4!evSq?;15Eaw&v^87+l3#D3{N-Q8aox?6#D-SN72 z>#ipXdAC;ez{OKtU5~hK(Uz}{xxB0CIOQsYD{0GXT^e+``?)&fMAkAP5s{$F3%!2B z(1&~1_V7xgbk)%{py8G?QkFZhlKH7AMVRK2E?@`4EC+u*eg5|G<(W|BuA!ezqb#3- zzodSiH^|7m@Y($J^y&G_kB?upZWwW0|E0~Xzy1aP%UTWy7o>vge6C4t9%c?X`jdbV zL{HOzKqmaA0>tXphw0G>hJIQm+YVPT*!GMK3Q%*mhrW#>F;(K=UPzRar(IuQ#@WS&A8vwKtfg@#9!u* zX z8o474!kg<8-yefFH>UlLx|DqO^c!Rcq6Y>(6&T%l<^kHNZM5qsCuf8LbeiAMH7m6z zQ@Yicw1HeWBWDRj>{(5MAMa0ZUUz$Jx37@mOx4feNBdd|;5-XkL@o6#H?hzUp`Tj= zL6i5z6SqItjwon(v0B=*i$*Xw+pmIQw|%=)6p_JOY6;8=e$@N^zCPpL&$UzH zw98eb@^ZzC1z9=+JR{+6wEZL?^qyB#PRKPR3nR-?UhqaO0!7aU@uT@2dX1yVsl-AV zs&W-Wx)UOL=!_&ij{;2ZXJYVPviQW@byV4oN_jTF{ zu}d{z^w~tkIkU>E88xqtMv47|Po;Aoa;67iir2yL(R8uh2jBnv^6u%&+h>QH4vCv4 z>CjNr^-1v=20zP=VN`^qMghXO)}U-VeLb7IhD9;Fd&`mALFP0PQc8A%|Ql>$l= zr(2tA1iRNfhD>T_!>3j|F$|{etqW5Y|TD`;H_|&d2GOMWhiKEIYvv z==svN&0Wf;Mc7+Gp__q2#865FDlYGXG<9WQxi_}d2&uzC44By17 zrGKIuBil%SH6&ysnvR!4*B)~6u37per6EEutPcD@Yt9=)4ALt7PffNVq#}b`3Mm# z6M0TEGbysK2gS~gj<@(|=!0H(_5*^pdj#JP2r{K6^yxmEh;n`Idcm%*ienCn9SMg$ z8w*=RYcd-JtQJvYFCI3NwnICdSLs<;Y`j;s@YwXqL^Zy3EAN{$s!}0*K+y6I4?-si zoy}zH`-i8OKZM2BIwW4dXxKD*`YbW-^|U%efMZ0;YNUAn^_gVv7C9{W*24A8?R4xU z`|d8`Nxrw2g|2L|;Bskkg{T%D3A^UoEVs2tQQLZAVSjGRN<6i>+1Vegs#NOqE?JkC zXS{&*N{15?T^Z`dm%GWuME)a}wsOBo=74Toyv);mrEyLBiY!_jZqsbl*j&A{{ZLQ4aVz>(oufIPlQ|8hdm~~r0)t3rRtVTkAS0v9d|zMw{Qmv< z6Oq}3V~Uo|2Qo2dUPR3vw3uapX+4u&yzZ;JZL?cRTSoS|Qjm0UVPgbqRn(hZ7v^(LoXM@YoscqkJgK-uv+ko8kjW~%8K~i?aFBj>L zS#)yA+hWRHUd5s$fsmemNb<*?zE5W-1NqUfu}Zo>6?8=v|6%?Gq>T++?8b zB6CLWRP!ypMNj6T36<3|J%S6peP$bi$lSAuINhZ!)QL%PliCHGN^aQE3De8d$9K;! z-+7qB+S}?KUw#r(<}(FZ6*=w(?GAZtB2J9FJ&S*3LnQCPzy5xH`SH)6AHRO{(C+`P zO=4$o;FBzrBX2*A;~o5qt#6InnwGA?}?m37@t>o*n?wPCORg{M-fxU4{sGY5gFy7;G zzj&TE<04Gf1lq-{aUl+TqL(oW>m6iZBNaf^>n_UoI2d)8cHQ-*gME{KMD*hS8MOPtLyT)LccB-0QzyM!_991;WUqB5bUXJAMPB9HLU+do z?k1o6Lc;W@336_t7in}x?&kEsdT)dS^h0<5);*fG*2ud^_-^s2iScd(4yUI+PVMWv z%h;{`>Bvj#hQ*fb$y~UMwP@s}k+l1}Jlv7&jjLU{|3bcn_Euw)F}_!)9TjQ!B*k%0 z>+t9hHpf#-@Ykh#JQxUKe-pv|?fK6ifBg<)TqaSvXHMAx(GbwR9Jz68Ja8uZ6gs7j zNaaRWibAMyxPxyhLtZr7T?hrA&DN9|05)kKbsB9Ce+8G_SPi(IUB_zDrCs;!XejQp ziCVK|l_rd()XWjPiRQk_NtzhlL_oI#UOVx(F9K{cI9jpFa~e&1q~PWlK5a7ztu6p} zwbH27Onzx%oTJ_=d1TGiL917Kr@I&vlyP0$zfm%R?vn23 zsCzd4(P)r?$Uw1k5tzF(@7sdQL=v*jkqEi74I-0^V5qAZNP}m}qOBTF^R7iMgHaO5 zeZKT$)Y3ru^Yr=o6KUlA#aQ$-dP?7EBRN{Vlmyr5O7`t~kuWqGf?&Uqc*c&5ODTuh z*ee<3d3tv8OA9y=hTcpwdYxs50g!HC&fHlBxWmUr~8sL&!1 zzkd4o*T<(|Bv2EP7)cU2HPA*Wb1)vxB!$z*J*niox}P{KYHXJDlFwIK>=r~mFM2p4 zmBGVD(>C~8;m``5@}#ov==v^)`}uMR1~x{K7~Zr(H4Nhw!BKV7d^`noAfq&b_|VE-9=nrl z0deCR&S0iGa>TCO5$)a4`K0m2TTdWo_kt0~9e~`h;}hZHJNDt8a6S84-qeQO{ej7; zs!2*4P-ETm!rB{>7))pNp%E&slK9Zd>nW+>3!6o#!>vcrYGAW1dE?8!^c^M>GzqB77+q=|I=+Y$zPc zX?e*YAl?>PDZ5$~E*^8aBn24#tU zB#Znm+O~k@0(#4*-##zQ66||r^NJ|twbe*u#wPqk{<91b%sHv)-O@gB=R#I9BErs5 zTWF1Mem5Dh6@(QwQqCDLpI0?(omcgSHZb;rp(AzS_A~+%Sd&w5Mr9r~mh)5*az0*J zqxwv=UnIPFV|4S^SHqf5r4}62Bg<}!o>LM=7#u8c>@!u=b2c#&hkh&jlW^#~8`bnUN582Q;n3wb69%8k)*FQ*qVt#nqH})F zVuPO0#suLwo_QkF%6TLFw7=2485O-BQPweZI!cVtmIx5i)8~T;rw47@Ap7K52;I9I zQ5`opRQLQv9L%H;Skf^XqiL{8qb{QE_O4;*v5HE8c5^n(; z{{>%fg+^y;W<+|KeA)uCqi$+UCE+t8f!L4C1!&;iI(PM1X!!cXpM$LHBqA~jwoX?3 z$G0DzKRs)f$RJU>I^w+$;{7O@bHlhF+8e>`-5@~uYj-C6n`24{aHsbQ zLD^9mxQf(%j|}OqX{ed5Z#;&*aGGV#U<`hmf3z<~W!HA>{XLV>I~d8m7LuK$=pQAksvrX{nfs`c5HyeW1UxjGDR_*CT&bok4g0`3S z9deTAZ4%oNhU9&(-M%Biy}mQP7_c2ub!S4qQQc;vCL166-oia?4857XB-PFCcABptVp6!EwqSgzp}qE_(WtoV)Cc2e}4S_ zOg#J23kR;mAA-{JMU8XN_JNBZ)os=rhls~FVmA2;HWmUU=Z7fn+KjOFabK70rh-9q zExj@KM3JKSi!=4=4(j`|A_YC@kEhe_5cH@Tl6K!cD)xeWLLq>KZp@cjzyd3Ig%0+9 zJFuzCY<9{xQ++c?GSq;Kpz#fxL3{RGE;_oX^D57L+J9NM?}C1J7c9MRUth_yZ!x9!TD1z0dF;UODLL@$ zd?(JHKN#n;M8kgiwyOn&=VVV$+2l<2>}LOjq>xdLZ5@4Ei6--@wKn-r&bJPUNsTG4 zrMm9wioAD(D_w${%bvcx4d?OJ(&)s2zjFKygf<)c*(r|_28APKV9Xp~NbnM8rs=+? za35ArpVdvuzY9*Ik6--rmPHGOK%) zBDb6!kv{l8rw1DpPAd{JVdYmmJ5uClM?tsIHK%DMV30I=>r0iP>0u~EsXw24gVnc` zmL0#RsTKYDG?iDp;cO&_dFGGC3E5algQfA{q)~$;){7|vVcqUDs*e_mWRy&))7X=y zD9ruraQ8%Lo~&{LDQ|2bI*m92rnVD1H8o|g%t`fyA~>CQ4N>*|8GnYlXWj|ptW#rK zUU837{1}{m{R{puCFCB3{1b9m1U?11GezOpv40Ae*G)vcoI1SrB;F4v5${n&U^2iP zQ!xc`UwASe^Gxo&x=#N1`1#HA%cp-Z-?P5KuFUzSlksMY!WkiVLu$>O?4-I47gQ*f zQp)HNoH*QsMY$7e4tU<}T@4qf7E%3d5(lgl9m*TE61w6-5j&H_W5JjKZ90wDm?P z1I5=PD;N~yL7WOf4=D${>1IS5XN27A#QtfCCT2!F!%-F1<9HYb_TAE8trJH1bL}WZ zLciBBbSri| zj3gdXN)GS%{V*K&3;P|9Y|z*T$M?x0{qP&^t({SYBtY($Ndq-ZBrwj%X)ygi;$H8S ziSDgscUnXxUyFiQ^Y>QgZaK7px78Za?bx2~NcE2Gj>AEZEg6{V@;#Q1hstxu5*1}m zNx0T5yB?3_%^Jp!C5lN-BCbZdis_(zSTHzpBGV)bcID~x z_31J$iHvhA*|E+3mnDOt4Z&UiUe>z0iensU$T{dSWJC(+avzC8x6Efmct|;`a~)?`;Nvu^lbc{*lABIquf`ISkRz~&ncftcfN4g zE41UV>+XDDqhfbf`KM!R7f0?Bz7nO0+3c&9!NTS*3kFIw*0R@~&et2g;B~w4vg~SJ zYeV1u$Z1$uLmFWun~t?LM#XfUtDvi48b2{P?h(?SE4*I*Ob@YWX7!axesh2 ztP9kL%KJCY z^kZ&f>$-X*Uqxo{0p-t@K<`7#QNV|`B{K5RHowP1`ZG9K88UYUHmmV&A5c5SM9q7L z@`@bjAXXJ*R(1;2+(fw5L7c`x^VST0U~%zc5>xnLfV5>(jtr*K2ND{`p4w=D@Q0_D zcbsFr@<7J-(w)s<;$s$a9U0^WI|DMznhquNnGa@g0ow>59Y=^A*iYQwO=~`BRLM|+ zBKT6Nl^W`n#gsikX2h{GA{lmZ{Z5004&?xjKykl*>UhWd^2Dwe)*b8+R?OKykU!ma z!T!eb2_DFPT@D=bPRP`#DN5~ozAq7lMQ;hF{eYJp(rXT7xrxufTh1UYGUf&+%7B=}j*=cwD==NO zfVBBNOX%;}9gjuh!df$g&tpGw(9BFlX<$EcEbLwd3dq=;nRxIfVUvz1gYObb){oH{ z?3RR{HGs@KmLf}}VH@C+RIH0&UOs4ZWz3{o6FC3<<994zt0ynIZBGiN zwqZq>w`8G;+Q2o7^I%`zbP6^h&RfnS#W{@BgN-rXmwI#9+4Y{dYP@ax((;5o`|Y^% zxot|EMBG(vOk5pGFEmaIsb2fi{=?YqkXHonpWeKDL?PjQS?T>$Gs-?}9#P+?!S3E4 z=AXfD$YO$l_jrwah_uW+nPT0>Ewy#1v zuI#&!AI`A$h%z6}fhVoaI^A5a*5l_-&)+^gefbd}(H;=hpHIF8q-8UG%PS{(uH{RL zU(mKFzn_A(Svg_^hi~>Qm$XfNn_ubCudUhMM?q9$6CDz$?n1CR$Evm*rGqlT`Odyf z*S^`7^ZjD;^HL#MMprBdq)$Us1 zIMyQBOswxT9P$l&WKp7--0=4X=|ICN>Q)>aAq$6?%G=02IW7xloi=pR*r=bn(MN#` zRE0pui9Z_b5NgKp%!_C5tfrU@3(7=i89O$$xd9z_Z%}dLCw^NblhcwPx8PF8vo3V( zQSKVHG?)xSdOlAnruz#&{iLFrljOSEz1rrXm4++B;B__SmPg^|tG9zQj#O+qv{!z3 z+MFw;WX+Y5|YxpC87dKAl`c#pT4lr7DThVZe?W6*TJ??xH)@-IWf zFr0yloqI3~F9 z#>N}DHxL9}Q53>7H2aYy)OYPGi{(wr&(526t@*K$6envJ`tD?JHd6x_$U=uegIX2} zvDzqa9!g|Q4Uz}EwH%Anuzdj8NYnO9S(s!L4rPS&3|_tB!Mo=_o<3owql<#3MHYCW zv^9^v!|RC%-g4|O=j}iCdHc*3Uo0Udv*8O$_x&<*N~1;;l)Y~D9d}dSIusP;)_-=& zuLESnZUL%qw~9v?reGG%kF`QXY*>%2=L-`{7H_cusMB zACSaDPCYx}>+3SGm9)O1c-egraT zQQ3DKfmJWpMMKKpF3913V*b$I7D`jqL9LJ5f_g&QUn9XmiiNyMVD6fkT*t#Rq2coK zac?Lrr9e6j4xrh6HSkrp!&Xw+|x!XZ%R3j;;m{L`21fmA@u$)eKc!(Vp%0&n+l;MdIN5;xhx=O|x zmc(g&;sDK>-JQ6j-UevZeR<<#I-NKIv_7Ij$8sJ&#AdCE<1AN14jCn9eUmW^ouuaATrJt{7)Z!@cYLUa zuD0tZ^7U?lXK4m9NU5!6G~qc~7anX9JL4g~MNt4{ZjMx$JCn9dy}^58I|QEDhv(<- z&zNPa6GvowD`2(0XPWK|It`}TX_eZMs2U%_5ul6a@wT!RUPO|+3Er8vAM^z*W(9c; zG^R^YqYdYle9I8tqkJkF&r%hpyGXcydH7Gzy1aE+`wmAP1|@o zVO53a&2}spq>!NaahUFdwCC7#8c5%3*ElCd_Fi+K2`=^N`*&37G{>P^FuIW<2Dh~2 zz_hndFJC{QK*=Q>NM352e&$z?b!qV*X%(MVIaNyO$_pYFzroU!#X^2X#xiJ4ymqT* z=301pzI${$!%vCo^31`6ykZUqf+*5hKN+;sv1_$#NioH1#Kz*fRPDP?;ym5bVS62h ztaexTMUSbvBjLf6qiL&akHTjcRO{oR&O{pQkPP0etcLD-ELm8duGaZpwNega+d2ao z3=EAhM{cp`i!vBJKRtjkuy?Oo&s=-fpno>#Oe+`mpZ;y%Ii)uAD z3)R}F-SN$z?>>Ee|KSG~)F-?zl(P9@oMEXJ!uU|(1>lG6GMsQs5RF0cu2Q)bd%WR?QGBN= zdhRLD)P}iPMduwi2+~$waK&~B)Ow&OlI#2}Pgp)o^l=@OjThA>daQLzt_ zt)+0bn1VymL#p^3-q5#Po= zVm`a-tFh6+8jgsmM&8Sa0u(0Gc$MfgvauV0 znVInZkNh9Jq1UCL>Sk7#E4go}x(S6Idj9YhVFhoxiKRa*YUD7X>Mr<$pir3@z(_ zCtCbUG^h?c{6Sg{)WOztHo;t^8y}{a4*K4)LIHka&~gMNCaUc~*$c?7%{vk>87qpd zNWoC%#Z(WY)rWmmt5OOCzw)Xs4Ep)towAt&(Q=&sqbv&>TdV4SNilCVRKUsZF8 zxGw4E*hH^e$y__|Dc?hRUi_rh|^CmKR*2V!nyX$+T+tSFn#6MrsFQ6mTF%tr*_})bwm_8 zsLPKA-wJ+>)N&S20hh+kB|Y=<(!O#+*9Ad2to-nVacms!nK#0~25++Ta$PYq-U z6>`=+56y%3Cf6dmH?u-B5LKS29cTFw0hNst!P6Ih?fMl@l;1H-B`=jPG_L?PVx59R zdy!wFyv8JeI;j_sM#lyym4hb}UGuqoDACiPV9I=I@PzxzK`tEd3J$ZT9QRvt_*f^! zxoT*CEAL$2GuBZxI6ruz!2%|eR>Ywv%?5PsptP}6!If@7OMV5ZVCZ#VeZhr_{VPL* z5&qNjzj5a;T87M$qLKm)u}qy2IipCtp(W??60phnz)sz=ugsTWsahe*^GHHoLu}Yh zDx1OJ;HIEFoau~=!<;z?tlSUmWhr+WFUo|VJ+VouY_9Aufan!N{=o>O@A(3D4rrWW8+U^+3ua*#DqJef3(Z&RW(?R8+3!45I|5%n~3Rp%6UP<_)TZvR3<4+g8=7 zLg^Ln&e))MTUK?`?)Hc7cycxmQK|G6JXJ{GHfc~=BW78akH>>jYMdn0eJ56KPEA@| zv*0PebRXUYWs)RmiXEdWu9Jou)d(9S*9302NATna$OYREpFdshzrPE%TRq+FcC#sp zob1Fcy_;^gNkRvuc$m2c)X~U@oS}u}mQzgdE^YHICkdGn+bqjN6qHc=N{SGBk?*&S zQfv?^_Z)ksKZA`9>0Il>;K}H# zGz^OF^YORuKW;%m=p>0c0YZfkAqWnQfGKH)I7_jKvj7*p<%O%|GJ#}UOj0gDxw0s5 zuiIl6Fi;8X2?)BxgzovH0NXL2EXd_7=w81-)`tl%gvDB6=R6miIH%KZyQBvc&nCyi!XzU? z7Mo+s1dkeayulwN!h|rGD9Ck1MEKD4IVO0fnVcmBS;?{KLAFg0=246RXxBPdtl?vS;mq^4$&gp?m#$ZZ@=6Log zVk5&FMuO!TGRHLAkV9faTX9-`&ZtisF-bU^C7jSoIf+wDc-}N+4^!&@(MmYsD)OL$ zl>LV(yGjsQIKg8`V;(L>SmH7ZPOx1}$QvX?Sq1N98f9_L@%m}R!(t_WfyYw8h`27? zaDx599J8VQ4-f}P-bwfxCz~jz7vhBPO2U*RA>Adh_=t_j9l(T6vGF5vD#@dKo24?a zdA2#6?iXl*EwEjX;048m`|(csg-?tJous&sg!ndcvG{|5$Se907UF*Rqro{uibT7S z+@0|GCkzM&*CI+Q(KJYiJrGkXLA1aG0hcf^k_b~S5Zq0YND3#mjyD#G!=+vDc2Ghc zPasH&N<4}8_3R98A=-2jId*K~eLK^&`8JglJhwb(OKeUas?Ep?Z}9w%1DQmQBawKh zkr{Sq`ngUbhfqm8tteq~i3#@BQx5HhL%|{>HfM*ED{K=jro-_hbo9_9bRZft^4uG^ zL}Lymq2uN{gImaZzLuD;{Df4YLL%SjX7CowNNMD{IOpIx37u2+BoxIUF$8rIIzp%! zx=n}2Oysg!;*aQ<@rQ6pQD%sn^<2eD{o?Hfg|rz;D!hje$6JL&ymcs&cq>#)Y~&pZ zx#uMBB$CK4R_MbZ_#rkDk0dqGAvR+5nUQM+LnPihVumxcg~77SuuUDRe5=S4ZyhKg z_F!QcsV>}+9?Z!761!abS&z3a>cEI>KJq6s0+loTDuxQFyGX>b(I(#V2SZUP-Z->N zY#3lkY7$F$ksHTzF(cEGaGRRwAmqDHj9k8Pua+5Pm2X5Sp%8Jtk)wM`ZtLtZY&;Tu zkv=wj4u$70l$1$qo!^?g3krj^@JRW>y}>cLIwk@cIOEq6 z9iOQl#THwd=L{_&DK{>BFcywX5*K3o#f1+q8JV_->>47waDxe%!DyfJ#tF$uC3dvj zzwfyPRPLZ_&d8iWLVa#gl?)x5bB7fmm7@J!0tjQXb)vEMy3sO+tAo)W@Nt%t;+1smXVo}@!~Df$OLww=z4|4pcE!{+Qgq<&opzW>)80g z6x+!{L$sqqd6}r;;T+^BVS+yh{&R}`47HQcP~fIQNye!U%+!G+V^7_QjT0QF z0^m`!J;H1&DQu3n1z|87KWFO|&3{F(c2s5z|nnnFxwT$+sr9(4J}% z^3@=L*hwm3Y@^tmJC&o|IYX=TA|#F=V+L*BF6#L{R_Cf2pxv{Z%D0ZsMPMrBOrnY~&)rph>#SUK{lclR; zskB1T*%N>DL>0xc&pu@6{{7Q1=q|->BeLyXAS!Glz5`K8ix^}IZPc+?f8S_oHxl_& zNzvaVm*m>arR!qYQuqK!c*IYJU1TIMou1c5A~2CNA{iDk1Pbyjcz3pgsSfCZHS&cQ zkKW<4FLX$SD1<*VLc12@Gscm4jIpQE#;Uhv+J_`|i59Ck7dZe|965>_BUPdGit3@N z?g;XPlUN0gP%J6q9GPSiK3uEF#i5VWp-($PAA+HTuw$9LDEqM=p^bG}BjIB1O zd2)&*+Ke@~*yCSga$mKPOJzexrz3`lGcw#YS-c~cHKjzh(4~Je$eI23tNsPi-(BC( zH$`;g{~-E7uR9QO3n=ttj(K`6$5gJggJ_NpQ5)@|AbL?J#Y}^aE`#V70sLP-g&+T^ z|3UOcuAYL(8~{PP`cSrg5b>LTj(Ly%;7F3_cX?-zes|yCM*QxRt=G}Vfqoc+=z~5X zir#bdNWTlB=T`rM=q*1Q>aH;8xOWU9^*2L^ZHeAg{0A*7oV~RF0h2MZ>XChrCcZ`G zHKedfgd%sfbXFV{CNU+{9Exob1(BYTBV(e7=PotTT$Zu?N`oMFN+^kP6Rk^iC7aad zlEm%8S6iavC$^T&H55CGT}Y^d7Tb6$A&wUr6p73bZCHf5y|myDMzTSK-~}eA1f{$d zHe;uG_LC+O2c1kIqjnz3#^%Uu_WWHEu*v>5@NVpkJoiTG4IM2csvA}OO>7dGgp$G* z5;VMZBu6ty6lVor>kHegFe3HVvDTukFr<;M?wesp$n+e;%ubUPTATUZQg<5;s1|MY z5=pc^wu`hHP{cPkV(l(s10*J##e>HEqBe<%M)O7+L!(;_UXqyDI=eE~*fU9?ZLNtY zQbk>Rt3E{0){fm5`Kq}yQg3LLU78QQjq*c@wkK*<=Ggue8S@sYIj^R$Xjga^y9`^xT6<)*b_(xKmG`YT>?n@+ zT^Q)Qu)y`z`KU0$cOhJBRQM3}b$DlJ|I9YbY<*&Lj<;@zTgpb;#�R;+>(RMYdUF zw_q(6QQ<0}W++5l1vFBZ2!wH0sbTI}>bWb{nUQHdiwqPytf6qD+_hw)=(y2(S3@_0 z*Jr3(N@4PAv0ZlVYJm}Pwu!_dL9RMqURIY%6fs`UsuNExS%&0}e3(I(lOctXayCkBFiDt(5mob&j7!13IUBHi>HqHY5LK@J{W8WD|mkKSOLsuyAmVHqOv)O2rcYg2i+a4&kVO z7Uh*C$L!l>!7nbd4clg;IJ=!W-RKpHk;sQ8n5LTWS;i@DHcnpeT}&nUkV?8(U@q@9 zS}gGH@4Z2-__468(vFp=ycQ<}@k%nS)yp0y>Cc-@0~<*4R63*Bd1KT4vbLesbpH2( z^6|gsF8|9O|CeoJP1r-LWp-hVh%viuQw{^rOca}h44qhsLaecX6pe^UHAaB*tPI3a zTPfUGGcide%mQ3C&f{w?RYx>|-=rX|%Y|b-5;lD0a=0&S2PBq6JaRP%9A-m7NWLG}w^NkYgCIbDZ7cn6N~k z1R~+`MA>*`mB~n;4+*E*JYu&z#Xnj-R}V^7`;0El+HEMd)N-xJHPAaF_eN|+W}*$< zg@n1y*+cRj?vYWJDTRqUtUWt*zh_!e=tfjx(|Q$bBiBkFu{9?#2~9N3ZIzuU^Sh?H zA}g^)_Q)ciRzQ(7F^-Y(yk!6&cMzv8XJ zMcKBh2e^}vHi}#sg-~dmHsoVPeBy-5`PTAEv?}CGtddq3CpvPR*c?`(LhWjFp~etW zSP2bPtm9UeP0&y!C{&LPg|`s82JA>AYl%{j(7#`ygO)o(d*Y{7Cy4TuP`$U3Ok(x6 zknP@_+DawPp}Jxu+FwQT&=(v+WHqUY_Rs9-inO6Gr*m|H)~2?W16Lwzos#G{D*A=K zco6!RG_<@X^kwwWVac5lJ45%YR*z7?@hJ3<*pFEFZ)#fx#tz@cT#B$`>_&MYWXr}z zLRR_KSmhA@XhgPF6m+(8XiwJVC7NTz3E6mILPod^X$ZG2YY%Pg0)^o9t-;B+YETWg z9vZ)OwW4sV0H)Z!RtgJ!i$!RI6DV#@30CNbCWKp+uqBbC*qUS}vBaM=*3GENl#=T% zESzC5p_6D^9B#A01}w6on1YjRR7$24Cd9B)GD@V4A)%zuI?F@M;N|-93^2ltc2kIM zT&2<(JhkgwF@x9Vn>{$Fkxyu2;k;3g8HM4paRsW7jUXn4wzUenGd9l1{gPY<%54jd z-jZnlT-WEilCveEj)uSop8Sn}o!Z5sO!i0le{ zh`CZ1k}Zz62-yr07WPOARa_*IgmJD=aW*Vm9W*Q~E*GkbQY=Uc*Is8v=9fe~1=D{M zt+&BUX5@)8GA_~R9*Tv&jg8xZX{6A!r-DB86+Aa)u7Z9x{oJ z$Swwo0>KpzLO*aKEYxTf+OP=irb%k2NH!*JP66ScMWK!b%0@?yb<-|A3Vo}KGeT!% zS{3ObgpplYWcO;J?OJ8RBJ|n(bdBfT9b@cWVSzhA;R1ZGBLx}E26W(C70M{ ztOQcrjakq^@~w%swE-l~&`CJtFtqU!*n-2GEg7T}s4(*Zk-5Gt7?I7pc$#T^38k>P zLTf{}wc4G-%tysc{V^k0hbQ0zP#Ec0wDVK*_Z?OD>r+@?Qpb^?{mNpr-bIThqnX8;LU*c4lZ( z7AYwVkknNNLf??Vj=HV3&($&;`lbsQneE8pB}Jno!_*ZpIVN{&qFYrdM52ST^UT)T zi<7znCk#d9RGsRQ%tU)9avu_=ZscF+n>9iWxZbc5j4ikl32ooZHw^hQzX5N+z+?IZ@kGXl)ddSmM@(TkUJ<1P3{6 zC4At%nZgX6NljD`7Ir0}#G*^03L7QYPF7|N6W7;EBh=AZbEDYXleiWp7Noa@Nh+~8 zlOP~8^+$>AietOt*be5>1m89RBeJ7J8*LrgW=bv-pZ4kyF|XZ^X9)dx24{qUhQ#Ye ztPfqQ_#H*4?rn)Z*w|-xu`im$8oU<9t|>h9LlvB%RqQyBXt4{*SnYP9Re?i4Vj+yJ zlo4AYF}75hRbcJwa=6&SFSdvr`xxr0zpNQ;ooKzkO`mF6%QPE40O9^$v zJK{L`kgjM^gTX-%GdW>{ZfIZW@FN=>fO|&VG*YG-sjoeZ+^`*IgwD{(T)zVi{%EKq z8d*s^vgI=D$wjWmF^nt&h%ClOK9Pznjz=2u8mf+~<6Bx4sk1DM+^7*55|uI{Uz~_6 z)rmAJijryHR96^s)MXWMF<+x)Y?wuBZ03+dYCucM+tEhCWe! z@N2XO{Z&pWUf9Q>yNto3y$|gLvd;X$m`2{nquyP2zYaxLEw}l#Zd&YDUdjbK^7G6Z zvXfWxM=7TsW$>Tm?GU#we+75^i-Nnp=El^x7WZ*Jbfd}1DL0x< zy^r=$^!?aW)3FKeyP>Tgki&Ews;Pq2c6T#sQfPL;U7o#huC_nSI0E)N?G{`kHye)p z{96`XxX_<~u8Y1GW)n_NZ9Ath$YaW>CB2iH;zjw#3@q4>4X+Y+zXY$3xxD=hUSD5v z>y+0hc)f{K{JKnO2AOX$12cFXU&r9}c+U$|mihTHzdw9!@%Uc({cG^|4gaFxCe&vX z{Qc*Tr!Vg@yWOU7K;Rf1`P`;au4!&lCl@3)(HCy!Kmyv%i*b@~`h@W|-e!&_xs6lb z4DCXL?ru&rng^!xWA?YPrfws>8{A4~;L83U>DLqU{f=M0-h?a(Zha}=h&O#I+R12n zy1$*T?i-!s(yi}Jejg$FkY0j2`}pb8*S|T}cjY<9Uj4gi>>4g<=-39v9&d|?BoPHs zhSIkpL*EYFgYN6(@?arZRTc-`{7r+q;A+-OaBJ`8THr=co)v_A%Uiq5?JGq9RVcrc z{rma*r{{k#H_^!+b0ZbSL*()Z%6t?(E8-By2o{HyG{1}DY>xtzW6+kZ}H za-RNve)|6WiLbQXj@EpIMPc>>~(+ z>(W;@z8Tl$Ftvy3XKj!FAWQ_Xp#G%BLW37#z3O!Bd|B(dgE8F&nbSwaSNflyP4T=W zoZ_~4u680!dw{XWLqZT7q5XCJ-mCEy!mI4LS-ogM!qOVK-hh3Xytfdpt}!sY4z^FZE2{p#6>^J`VJ4vB*_31+O;b zJf3;b^ZCwma-=0@P*!QB^8?Z}c-NP)y2lc^LR!Ysyq>{OVSpN^!7^M)gI)$XS6cd# zq^+fU$Xnr$j=i5tXa8kzPdahJk-K3U#~roh#Gu4WM}8z@l{{{7ssq!_@SP$TGD}B) zhg`fT0&8!^9Ggxih#k`0gj>r2E0jLx@Ibq2o#?S)Iovo-b2%VEV>xX(=sl}x?B(@t zL7sxj3Pd4xU{EzqV;(@9uU5uh^8zz1boH^~o%%ui3d&jXY_d@3Hj-Me%(7urNFXUp z6&8fWh3UZ3zB1hF;0F!NE(!(@VxcjrKtrpWO?D{u(2&1F8hjQ=LHVZBx$j)Q(%{k0 z>#>tw^mevAopxVj(6POYor0)6(A&?_Hgf9?ZRnS5!i6;~32{L{u*g8?F*Nj?piRr5 zZOd~%&K-@tR>;{y9Q=6q+)bMbPmcaJaRa3>VV3gVBgmoaKsOspx!gxi>D8307dr3Z zk?4HqM>#!YE9s%rl!fnEIVxz%!6<-qyR}I6>s`VZgOFw(P#`2aI;Xe7r98Dtdr(+9 z(8c3|!hqKA$yiv*-HD-7${XfP@auWpmGY%;b9jSf1hb0u5P==Ez$_T_NfZc!&4)Ro zT!qYPW(jIVb$hs7s(2a^U6S&Df0-ef7z%MqME+HZLHG z-=`JHJx9O)UFzVBQDh-!dbyXy0;Nb;KtFung@(iN|Er1> z6AFN=TFpP#u3@C0Z}8bf(*_kZ6ylbF<<0pr(IpFnsa_m>mx1|lp^r8i^595g)b=7I z2H(GZeEIl;v-C#^L86T5ZpUe>BXlfP;T>=>mtHPZ{{Mby>#poS(#NWw;p!R_xpRTc zXHIeEQ?z9alub|mv?e-_r*UHLNTbyhZ}lvq`%10bV|g}%9{uRw4e8a622tnpI9-&U z&m$gU8{*cCK|GIyrC>Uu0uSkGHq+4Mo3aNOEqwvehnCAKU{;gf!;uhE2_`)fAx!C^ zcpeX2yIX2{5u`zPU|hcA=5$L-sRgr}hjq83NB(&j># zmpmZFGePoR5>GO@-vhfDfGrbPar#qq15TyvGJA;k>1izmUCHWaP2Ef0!)EnD8YsDwS#a7 z2oxI}sYtUK@!D54iasjpNZHGG`5IJh!KgFbNoY)~l$h*w1Zy9#F1CUXQSJC9=7#CVN5IG=Yui zD4Qj77;>*S)BAN}!jwu5tQq}C>e4G!kIPb-L^ewb(f3+0Sqo6c)|!Ky-a~tWf2gdQ z(r6ok#mQgpPc6?<@|~$s#Nm|ABEMI06fqY@g`G)Dd1H;>Km%1%Y-UK-`4>lYE*FLp zic<5gG?&qssaa5f2)F&6^uX?_;bJpFPbhU6%0J7Q{81hWkw9HDW<}JRZGJPebj1G> zS?;*!RpF7`OcoPcs8oZ_dNJ8`ysWWf>&+~$y`5>`7{!?xbzkyrr^&Vo7)KrqNo#we z(%rSRXVNDE?Hqf9*G6a1yy-!^*(I>df;5Qnt0V!JCpcHDLKK*kRcQ|!A^NBZh(E5gD7+yhb#rK&$oAIosJKF^Vg12!` z6G;)MZoG&X!8w!{&ChNh2QPnq{~)(X)5`x4?mJ^^JH|Ss1lUdMzPfKrcnR`+Sd6W}*=$i$}cQDVZAAZz3r-k6j*8V!2ZmQmr&pi%M{uy%*%gb?G`b1$UO za{Ga61Z9)(dXYn*Zibg`8ry+by~&t5tO@f4nMUWylE%RbW-p}PEm}es<1`Se1D8}} z@j+NNpIC3@^sM8R&BXEu42=w)&IEPg?U>HHj@N#Ym-gv+I!+GDIUNboVYLwRJVs~8 zF19O7s6hBU1DZ=38?a9&IXGSYE=)I6@Zju%`7Jse`e>AbRW za%wvrr{hL@I$eKxe*f|NkLMT8%ZoOYo?|6#qWPA-#8G0t=ui#I!jO49$66>y%|em{w=41!_pZC0gt@@fRxL@T)Dy3}Z0;z- z1XHu?5j??E?+*R04(O>FS3rb{q~gP18m9|G{YO5SCz5j4tqdZ{R4MfUMvPhI-94vP{ zWkYHXMT?qFJybLlcT0=ZjGYX&Qb>qNAGRX=UXs7MqmSuX!1z9X8Tt9Ip;x0;^%|(sF*_9cXs-)z37wEZiz;3_sVFGO&Os zrN4SJD6I-R*oc)aDsB(`dMhx^iL|=gTP?s3m_ecDs8dVXY7b0-bGp z7o?XeV_ZcVbLHPX>4mo_t_;WpjO9n}|Q2KMO|XT?-ju^}v;UDSZONZFSJWyuuM zqo&Hu%HhPRGKkC1FE4rVcNTopzu+=HNIkz0hQ>5O21AXC7)r%tRoeh6lB`HT%r72| z1_fRynFx@Q1>6g}yHM90St2~i>e)C9W9Y>w@|FywJ{1gRBQw<+SzsW^Dx$$u$*=NM=#^)qWd_hy++1a?&mLK$7em_QB}QynI_N1fFBW8*tGKP)1PADT>8U3 zKm5eG`}TEV&2d54p$6unjOt=2Ptd5wdmel<0|$8e@$t)_pSecx1Zp&_+FPX#)A~X~ z3{NQz)je3phF(u2Wf9Brf*2;y!KIt%WB$@z7#^nF>%xSNqWeX%)^X*4P^64^!cbwH zcDR}Dd^xTtB+(F~21Yrqke+my3kgY=t{Iu2T?~>GkOIX`4g}TVgeVH1Sr@DM%A(SC1u)nPA@w+mjZPLV}9XMZVQBtx;BDq1u}=xaPt;F>NXO z4@3PXGEnSeOlj5J1|c+cLu1#ENHQ-Z2BLU=;hV-I^(}ueRH3@GM9N%RR@5`Z%;)F7 zpPw<00u?3}m@-J1XCHNV)J;p`mG{3$joxCnX7bM@v){ zY6?@?a$e*Rz+FSJ1atZrqpRV_jIDzmz@^g(08^jQz-fX(m1WvYL62s#nH;DYNX>;NWRe zEQp@baH{AvZoDDRqT+pA>UpySEPm5e;|~T&%Pjl(0#GSt6bh-}6MAPO?7 zA&tae@O9KbY)(|sAs7eov&R9~f+XCoYiO4n!9y^R1P9|8)w;1~odD(jPV5vJRq(a% zSRWth&XL_MFi?HMVSD4yL-!gQ>WmadGoRQ1h9_Av7LUh^OGL+xEp_8zWLqV)WAE%p z_%2Sr@A24z@!h_CY<@>LR9EZR9z*^QhPxZy0&5Y$ZMdIXc4iH@tFng7^hQ3cEa^jr z2huB~kCj?2X#~S^TAJ!|Jm^9ZB3Gm-!|@OY!+albi18K@Bti-Y9@T(YNwC^5F3U(l zEDZ!TU75oq3>Z4IM8ForgyoXg|Ta{XzlruG_ z9Xlh3^1$vaNRQ|`l>1RzwD^NGnyC+X)rPX_*abI)%OS$6c)qi@QG&_TA<;YEt<-bA zpF|Eh-;d4fQoka#JKy(ZADjshIt8Cs^%KmTKaej$3rWTuX~dabpglK5-F#;5aYp%- z^%}Ey__d)QbqKxZa6AXcw*}|u{ zMj?U!JPOUWE4g4mPQJ(>0*XeYOGBiZOVdv0gTY;RIYkOd|3fmf$RT!M^+^F6az2x`SAX{RZJSUs3$ghbD&R@A2o7kEAo zh~uB3XB?@!ugHBqckJv!3@5&H;`>gc(^QQWFi81=9M0@FrJ*J`7^poU$wj4C1D4Ln ztd{aR(O|148QFNxDQ8Vq`Olq8Z^ z&F$RD8PmDjbDRewKt~AXz=NX*ch|MC88ix<+jknm_NVK8&>`T6s=4IFMph(`9f63SpI-j?{prgyme{ZdQxi^+PlnDo4pO#3pN03) z{LCK>b#6fQR#7;blm-hZpQ)N7p^|e#U~s|l)JoO(DZ}o3>TFhNgN&Y+`|*i0wFNR> z`Y3a%jY?LasKfG**186}v*Cf)gMl`1fF^aehCW!R0$|GMR}S57w1q4r^JS?RB zM-V;Pn%ZlHe9dm@K&Bfn8ad79r}wN^!bS=*v}W)c*#fDDxKj#M^4)}>)T|7PMQ$ZP zWrG4^zLinl_Ed)K$grsKvdjhUqsAZS*&TRhwy87Kjwla{g-(d*ooCg)&ZRsaB)a6{ zOP0TW4f^%UPsREb)wF&+aWrDTcA7TVZV##1JPl##QQB(SutmD(P)82E>DLNnC!~G- z_)t{~vAiR9=aX`2=GCN2$WV%BMss%t!j{Hi#mhq@%Ook202wF($w)NCvqDw3Q-^+! zToV;~9(&?8mliop&qfWD9QskClW_y=pJuz#Crl0_5^K&?Bg^tVO7>$-Ay|jUKqZ4o zE~eNU1w$EjGNiISj>*g1v;PyqamELp0uNYc;6vG~uMZ2WN5|`_M*f0Nz5Yecz+R{0 zVZUqU^6?t<-GeGH`4k${iLxJtSy#4y=i(3FeL1Wz?V2Gm&5k93SwQZ(!r7bRN&YsvK@QKtN#uaL{ z_7$vMJFl8v5AqCEG?W2MeqaaqfmR$EeDQ&V!MCCjlAv%zNP3=+J<9)oI$})bj7|E zvxwT*g(k@bH&IWeNc4SGvthbdxf$17-Ud!swCUMr%}^`Xsf;PRmMirjSgNk1ETKr5 zCQC=B5rx&Go@DU5gcGBketP=;*8pTdo4@n>r|(!|y;lL-%hU}AW5)sJy#Z5ujsW8v zJCP~v^q`2y$h)S=lkvZT7%Aa`R87V-hns+4*5$CF(eyl1#j4!taXOgA%I9-`%A^c7&zaluTBgZ#FSxJH*DltPmtsG(h$J&f@`phKbG~H(oq>-|yUii)<33_Y0POVcS~@()Z-4RF^^tT#MeEI8e@$5G&3evt50~tPD~?D zf)kh2W<19k48%rO0I$Ix$cPx?r|~4}*J(tu$6b)D4m?hUv=4>N(=c9keDWtER)bUD zb}TKP5O|li!G5O`yN*zijEdrb1MoIZ|36j#*5o#lZR>*X_!n($=cUc|F>xX1KSiI)77X z{rq^x7l>g`6-3YV+}y5o!iA12Rw$@EF;B@+cYdH1%hsNj2CVRoNi_(4cvpc+9kfIG zgfSamMEt(kd)Q{e<%DS(WM`;&bc5k<3YN&Imn!v@H|u;Hq6(YYc#vg zJN_r<>g}#rK39+SLAa_BWrESC#=EN>5qfQhAUSYUI5Dz!BZpK2eVTK1yLa4tyE-+( zU@z!CIVQxOiB*X;G^c0G>^4zDnajnFnxSTZ`-}oUQ+pyz$V1LM#I|$Q^puNpMYDTW zE3UfW^q>9e$3OB9$?4G(zSEslR}1=2k;Ommoz8R^kP|dLdWj-6yS)XGd%51Pf)*tf zfl^Ny|8z%dAURo^BRMgi_5vL5RSMQuRa1fbl#}O(bFQe4mNz}#2+rsitwc^L6$y%j z54(yQ;B+%&Ja|+T)ts(}t6to1h8jU9`RDKNzDO26b+_Z`$M!8b#hi8QR;yR5t&($K zDEObhe1Co0{Q5OH)kpz?;XV`v$aq>1Rpuu&Yq|kc(<$(b{fT^b4%iy_nJ5MS`Qab` z`1;}BI%F(BDgRFq9o1LW_X5CllLE5vV>d=(kG2dhKDyB35+VsSTyYFaCKNUBsO+(4K)61E8Y z@<+9RT7!o6SMiEj(*{?fERWM+=%T~iAni&BR)I4eng5(wkjrDQW?jXjY0s4ekOtw5 zIY6;||B@%oQBnhbBrJ7uK5P!1YLtZjiJS%tuxejed~RUlnaTBIyyZY!j)J5uvIbd9m_asOzY$axjcmF+Ia-~SRW|Am92)|v5H=SH zltASHr=wR*O6)r}r+%lN*2uY2)4c+$`yhf}Dpg?+REf^;v^S2}SndYjQ!#~b z++W+>zB_JUyOR>EexcUX-TkAwP~9*y!&)uW?3q~;UM8%E2Y^LRMO}UM2-&f=UfHi7 zKK=3egN|DF(wNn;>F~c9gzEZOpHZYZ)~88}?I?-rtz3bZ9pgYE>N4p|j+JsBBD>rz zkzQ{Z=n?E0a#y~1et2B$Z=6qQ z*#)<-hYG{FxbhT1Ef1(4l9)y63-0a(Uw=hi>Wh!<^$jI|K_&4{k&b4iouGUA#%9jS z*1If>*Nu6t$DtzN(~i3+%&q$(s=9B!(f4k(#Cb4}S*Zu9o0+D@c?@H5#;1ju4C*QZwLPtmFQ`}@ zP#L}Gg5REwmUw;t;9vHDb^!-5<60>Pm2Z5lo z{7c`XJ9p@r?7HE@rGCo{H$aU~rkmQm54 z*$u2D6uK-3DYgezpB_;CeE{3DJY}@vz(ljeD4|#D9?tvS{;?U8!|A%|Hu6U)^uWFJ zir413R_<$LxTpOToi2;pUq}aTO>3ng!D!PB1e!Q9N z^a+ZYy>8qa_@5}kDoMIRy0!WkOwO~_fyfSL!y>H%s%lMSRnePW<&>HZyE-_(1j*t| ztr|gR_Iqbxmf!K2!W&ED8SlV|!=b(mIO_1LZulh#Cu&I_hx+KD&x3WdsiWifE;JTHZ5OUpXUgb+x4xgC{HHsaf}DyB>F zk3Zl4_VK%q)g=JX_uAh#6>^=CPut&EH7EDrnd<$m8Q*Gv=mHf(|F|_wiIaq)3)9f%k&^1rL|`f(DY%>p{KcK`A9-Iw3&zWzs#QX00z z3EKrf3?xC{*FJD8S#FYRTPORT|H;06ydb7PbXu|e4-<~{!3sm$yAAorr{Dil=ShcG z{BI>H$$!QZH)@MT)U7xO)lI|Y6sv&t=kc~3*%d@m!s&iGtH|z~H#BbdsA$+NOTqZ& zGN?~bp8~}&lf5e;)A}Lr)Tz0)_k)S*KBG$Kp3XtXY4&U8eg%+x3{k-rr~o~4tOm4R zgS{{BD^E>8?ec-O@X*Us=7Tdj3NYPV{ygie~+~WuA*sllu9Fo=^RJ#3*x8d&!p7 zKYKupgn{wX`o3+O-BX%;7%Z36KvKIKUJuv4;S}0Kf^9|4R3jQwuXU_7xQaCA0cl8N zyWJY}L4a!IN%Q#sqks61VzGR@$@cL#OKNWdQ@59% zAB5acqvdp|J%1U4+P(X`ygF|l`jG!$ z>-_(E_deM@tVwoAb}x1PrW^)tlAoV)Y6T;lCfPdK^>;~Z$cZc||;5E-w#Rj{K#qLlXPk#RRjUj^_>PS?N5GQHF z@~;F@+k!D}Wz=`9)2WvgLSXf#}bT7i;TyXl@nn_pH2tjJ!y8 zs=kkm6^Q6h5dV{K>gS%(!=F*iA2@7URfIxSut;H|cU0PURQqVz25CS$N2aKRv6yB@ zYj6hYGv2WQN)0jsFK7nurM^>T;4fDVplDX?*6mm=fu5O2p}MbRQO4dCx2%P2Ucq>* z-jFj`M8iE>E8+^9jc?wvbIgu=ZUjQD2;pYYiXX0aZ@urYRM?w1bE)p73Br(x8rt3F zO@D%Je@4NXoZ<{$y*kdTSN$an)-s0}#4d`y!g`Sz;vnTfStx&2}EU zfYi5jU2nI-m1tUkL<~z%4O`EVsi)f@1xgIAIXd@ar3OGG{AmXCoOUXM8}e4Q-#@4! zlApc**{<5?FWD`!-FlnsvR%F_lC8wF?vZTO9l6WhGJ~6mY;L34@9q6z{RELweFVXc zRVxETJx-;{mL7U{IEq}n41Q}h&z46n`Gp(QXJbd8?S11JsqJ_>j-ABJ?QmfQ>~`RP zvW>~QGSnz@CT=;%!+YbXE1T{c+zc z%TgcMKYI4?+V(Hh$ZE0Bnim`@DweG~%)UNc`nY58bT`<&={wjGLwqW>Csr>*JZ<}U-18;pA|bmZf&WDw_abJ^BwkhFL^MZFoW#S6H&jdk9e0qJWEes zE<3AmR+TPGQ`8pe-R*f%qynmK)&C-NJ-1dC;Ii847iGrxUfjHuKdrkoTPkDKcv}`- zo$sKZYtTgzxa!>=@6Xj4xLg%W>a-5b(wi&;%7CH>WMic5QN4$I%>(U}4`R&Ki2kFA zDh_7gySu^Lr9hOiTFB*!+oESLRGdGI=ekQxwsuv(Ijo;qw8m1+kqvwxYEun9eS5Tl z)(3lU!f`v))e6Eqy&q78?kn4~x``~#9PPH`ZV)v%2tNorMG$aAZKD5ZMfp5PT&UYp zuVk6A@+M?!FR%|2ny?BQqZ@K+D*|lyJ8Io63Z`4NC>t_!jc8BpV9AxwF%fvo38m?Q z(*1t-*2R8j+uhim_Yb3d+q5TdF1g)o{SvlSp#Bn4Syj)dcL`bXvsDw=qDjB?P(|l6 zsOxP}o48Dv1J#v%i?&_}&i&{cWFRXE6xTsGag8AgF*LxpUjBpI*!8kP5tK!@?%h;+ zSiPH$hi~n`gx33aUqAiMAzQwImBR8~<)CVO+x6C{_aS8KD15g}4&Zdw$`c7ixh>

935^rKC zJNq&S6_L1%2S6Cp{E0aw9r#Ti*WTPObg?#6fLk7DTNWumcKw^faynk@ zh#rRFaNmfqBvCaQWU#B+XLH|q42E^wk45s+pFjWnZ;rO-6xeLqM*wr$5EU|mGQ=j< zsOx)f_wkO)e2pL)_6?&v9WZ*|ClLkCAhCSI93^hGV{l=kd@xET1D*Xg?B&*{c@~W4 z8n(*=d{A}QfJ4A^5rTt6=p+8f&34WmKmrkPmqFx?G??a`3@^!43;K7LAmVtkq_ z6?&?IJE0>xb!#p

E|u-QG?AV6aM}{-%FrrMLj$?x)}X`o!LfoBpo)2hbm%(6d0w zU|l~EHOPV+%YS=F&pIPvm*4It4e`#j=%#NLiezOBX3K;zyCxF5E^Sz%NKC3%@rY3T z{?j)O^_M3<2^m-0cu~Ib>=1Vc@3#rt-JGljh$?|;LOR)2u1mrZ{je7lO< zYN6cFvoRa6n{q>sZQX|ZcYM=M&BI17$5G|tH*7YKG2qnKLD<>QL_IAb-*|ah79~*R zYdy|KZP@NZjtc8@Z8ESV(Ly-ZHkbivaQV*SgtzZy@87ndL>Z`9nrot26QD2>bp zoi|+XSC)9uR+q@n4U5w(O^0mfb)5-~N$o_8t-YiP0wN9TsCcN3j}nD3%bmbpdK$zmTx? zZL}VS$zbq-@_Cs}B(TC|@82GBsL^HJ)QpV&^x@05-@oX<>o7Nr3gMF%3vE0!wgVN| z4ZgaESKL(}H){D+IB<)Y{{-ZKmy(K@flvnRWeG+Y)4GRSnK)St>c{d1$j{w{= z!DUhFEiN!*)2E zifIhN(Vusu+qgjyT~6GzizHCH?wy%M7}Wde-B17iL>{O%%rYBQeHf`hF7?o`p0 zQdmC-bF-UVRn;P?-rn4XS8og&RBx&Vs+WF!do5n7wfHk5f5>Njr)YlnuXnsqSwupB zq&1{LCb8H6@x=Zt)%~EePZQ>lT~nH_n2<4VQc0ef#+zzvw_6e?|r>^=1<<%LPV?^%+uM z(3Ll-0&HetW;qPO62i!E6R51Vm|2=2NUCyI=IYxWzFlIY(8@(ur3ys?ecJ8p1->A0 zbvseRd1VGmGn6Vn?#-1m@^(nr(VPyfmj(0QYLg&kvWCV;5UyABx+NdLYL=Xv){>N} zD{AnHdsclrb+43FqCHlO#v0Cwy?rY-ux$F%ObSTD-eo54UyabCIz#K3;8V}4(;I|U z7K&VTXYsVFE%#XRMSs1DeHjI4u^F7CEZJ<)er2mm5|ttEw*a*hvHkIM+D_0s4a`csD0v!RRAZS~_x~L%@fJ%7^AaotsMwQBPRkFXT9nn-H^Z$Tlz5lsjT%5W zCf+^^iCjID9MTbH7GP1cPtL}z!8@s-t?B1jR4dNs#al{6KU6ayI})QDVG(C34!WK@uKLjDjttL z9hSiy`D_6HrY~&k*H^nwE5mAG$nARbtcjEpSr}zS}g%K@E|rb@w(@&4 z{nPphvp9bn6g)sntS~;U;(zkAw93=dvdELCLamA%>}w=X`C3Vj9UVEV0w;S)fBX=^ zTuHJf|E)1CvVKyATR&l9XjNdBbj_CcYyLd}x^2B$B^V%;V>4x-ZdtB%8k;-oa-nl& zv0f@F)}=~=9M0q^8E~D)f00E|t{KBz=h^!4x_?VnSR+}nakyfoRMY};)`c8#%(ks` zU5 zV3s6V6$+MqA}jp?x+P!fPY{m$$q6q8P_UjOXQe*_jy%gs`H&U*OIGQCPTlfx>{j>F zC0S0kikE!<5_?0-rv;7@V@aeg1%*y1V1*i|CH5wD=Q42-$N;@_k#k+qUl!^lmPHmG zFK}`$<@yt(@s}*HinPE4(<00} z%cG2s!u~I2)e@Ubd(ul%C0U^&tpFBlC4GSz&tmnP4SuM2=<0H}lY^aFTz#)@pbTTm zDIvSc(RUQ33T08Q;!iAPtw5oemZPGI>A3=HNcuQEqEA<<7MN5ku-0A_3k+WuMe&4F z;^;|?v5RoXdyAB-%D4rVs)~HAKY=oQfyHdjXLd5@NL8FUzeKrEe*&dlfrGRtXtS#lq!QD%CJEQHKw8_C=50gRoG_KDxHYRb%A-PGQc;g2pYnZ zlAnpikRahv5swwimBFU4OzgWpH+;{gfVqY#(lxs<6lr`27gq-S!t_=g*>qWv+N7T$ zjtE(5+ucQ)zP*kkh`n6E7j4XJ30W%>88X9a9Z(wL-nAD}1Sx%Cwe~|a3WnT}O@6Q9 zOH}OR!ZJ={Kf16%;pJi``Ao8jln&$~g1(3(N^STSi1!t?k5#0T^|&B~AIw%0`1!E& zoj-p2Qf}Yxll=MXZkgl~^&}wY$A0vxUz1CnD0nf!gpeuS~g9H}K=uXBDP$|N~iBqxK&(Zg## zZfz6i9NCIzZcD#}VQq_q`E2kvh@YLT>g5>x4TvzTC!>-%Mt)0!>VF`vF2fsgSRMv@ zeO$&(Wt_&6b-uPyazkct=moxW5g)joY(`Ebn@9wpnC~g(GkN%*yZi+y{i-a26?Uuh z*{*MnoFfO8slLM{`hX%JF4@LhZfm}Hv~sZrl<^GaH$d6@Wxq))zTlh^rbPNdbGHY?YSd6@LgZPIt?>#HZ7zlaHN3t4JY1JhqrV+R5@X6MKX(X^5jabjAEcF-4P&{^nuy7l>pH z6Tf~3)+O^W>I;N7Q(Dqi=1UCI=a}-9xd~iv?2b&oeIPVMMHVLZvL!B&WR3*!_^nK+Na>b}OLYg=EX8fVCm&pK>lLVOMwoNuPWN_9TI&{hN{|3=DIB zR9vNvry5GbeARV!*cmnumUI>Ot{nQw7A`&O;6+g{nF_U~E4ysL+11q0i^D~J|IomYOXPd_PBATCt zWgSCmh!?HqyImv!-?WUEF6XzG@wU>zR^s_t*K$B+h>RL0i_4k#UB#21E+PQMbTSI@ zVs5h+w)_gL;%GWK`<7kn-K{r^F9`d$c~~cYnu+45`0Ka6O8@c4YP~z_NWH!s(N&HD zYTa2up?4K3kot*aPdJ>K1n!9x6ColoVQiPz7nAwjyqFBr=S7sqB2v1T%bH@&y7`K;T4D&4YHoda=zrSO_qB_R(`7ur5oZXVkQV*H(3i8DJSslmbV1) zR5?YXiQi)RqlorQFrDOQ^7n1?2TaAfuvu{+LJ_GT@ZD39Hz|D~kJmT@2;x)o!Z&3R z1Bk~4e>6iVdGU9;V_G)J8B3A_TS=Z<{7Bq6%_;f}U&|?|{5i$oPOkJNk01*z4TLtg zRdRqg3J7#Q%QZQ#H27s1yL1{B0ls(2A^9xs?#Ey=?eGZ4Pz z@sfNFkgK}vDW~*g>b~cgVV0v1I6|CQ89`8gSG6w9gQdqT#KvrH{fL-_!9LFMq%Q7I z8>qnqeiT#Tc{aCi*<6}*lOMM5_cvKhgzw7c+BB>z`<^u)C|KKdprUFO#I5Uy(rhks zdjHbTL~n5-gwNKofw;b$ua^<7GM=8K$82s3GZiZzFCs*X*|$kv%tETkq7VVTTFhUa z#~0+YZ!RcV2rb!UBzq$A&Ej(!89sGxewqlOOXt=sorOYb*(8i^8zM5&xh@N`oXKJ) z*+h7EIvF6((>X=bIYrXRgnLf+-M3DeJ$mYRXG`RH^wbUZXf;2!d|C(CTX&|SyKabE zB9EnW;YeKxt|zkeYs+}P^w~1rf&IrgJH--Yx->U{m#4~ovJaW`|k|z7ygb{=6Gh4hRS!_v~#a2^E_S;$i zlI&ySe@VvTTDh@AGRgiCOZr4wHilO?{;}s@l3{;vQ{5EgSlf_f?@^T&^e@&j$tHbL zovB-vqGj)=U1%~?VsH;$eU)uy@>A8Z-MrAdT4nEI_E{tr31#m#+g-ia$5#2KNaz%) z24v388@WTW3_yqkvJxorCrKEP={RmuD`bdkYIOh!4}$fRJy<_wtAHYa=hkZqI+*&b zy4(S{OBkf&z$E3JYsNAScD(|FDaN&rX$KcGv8NG=Y(7jq9jQX_ZEK0k%A&ci|rYYx3j+mDKGCxnlnsasf0(X-Dm)-1Xs-S{UCZ0UBVDROh?lvr@3R=-Bg2Ln$IE4=a9}Z14$h|#i_x`=%LtjBBeZL z3@k&~kdtkwD3o2~6r3T&Bt@xW1>yreN=B@%-EISGyDMMJB1G${^D~ibCcY<)$5V@b z6XDF%GE5|!h{Uywp|VwgPctS1%(o$<8hm=;Z=!y7m^`!stbDp~_@-eo5u`;Ryo`@^ zH2OG;hob+Vt<(8y=4yE*xh7+XGoy9N5WzEMaU>0Lp~!qG*DF;>35SQrNbuF1onxFV zTg_1x!(YAw*(X~~t*T=9$==VgvYLkbvz2=QSqy0be8eh^zz9-9eDKQc=S1{_EJ?^1 z=>nGaq|BzbMVDYAesB@M)FiktME7!$ z@j_;<9I$EFaxJR#;k=2bR8V zN(v8t#Tyn;7?+b6AH-idr^9j@_|4{#FA)S2VD%K>+w%Ei=IEO%lcfa{gP)Fxn;^Vg z0#wOFp-54#eoVM7=QAak;W!7DJj_&oRxY@ORAq2XPFXPj%lxbyCv@pF%qKz|1>vsD zStEwY))QI!NruG?nZbdaOHnxuT$<=7GL7d?WH}K^ahbY>D?N*mm2=9K7CN&S1;bAZ zk-#dBX8+15@N-qg;8$r_21KDOqq+y;X!@dQDkDhwG?TbB9&{vmz$_~#5i={@RW|tL zF=#mvg<`Q@4-#b-q>=O4!s-qJm1Tx7v&Hg>A4EP_GeuCW_(2MOkW7)plzYa=Sr)UZ z*@A{+fyCk=GJCDWSs)cGJcVS4qqW^A8jC1j3lAv+%Q*7bbC6{@lVT?6M2H~9$W{T% z0DEiMXyGYAgFT74svyh1iEm_z&|o*-5CbX`SPf=`z7ZI-_lp18^u zbK1s`R~Ca@*+k+CvItccagc?lSv;*jL*&E7oU}|LWXv;W#o9?wAeXuWuWuY| zPz^&bZLrG^A~DSC^LK_tfM4{t=aZcO_rL1@;Qq&P8m~rC2-jZB ztzC>^5{3{hfjF98;p)w2R&jmh7YZ`N6y1}SP&R7`i7ZL1%yU3lHjR-@WI2;!CV$_P zO@yQjC8Fg-rZY~Z=r_dR=F>z}W?2T~-^l*Ue?)H;A*QE9Iis~^|DX$kXlIdl8~Z%k1r3CImJPibTU zkHk*%u~WDezAt|nXkTKGbv2RFH=~kk@O9^*G%}B1x+S6_MUN|B@pza-4H6@;1UTA9 zpfLD(x0VEUnpO%D_s0--5WmAD&X8MDYf5D4ECbJ)Qb8P?=$^;WD&H_my%2OmGIXPS z<6`>wX%;`5wWYEcM9tD@IvFcPXE{qF(LEZvS_Dax6dgh;Lpd1_q)$_{ri=+qPzEdv z&iU!n)CCNph@MDh!Vi+#cY&Ws*Y+rex^)gU>C{6>PwR>J#ZzB!BH2XB`JU4EsL3;^ z?lIU$dhe+RkXG45mc>kbX1Poaa~PKM9n8K1aXLEcB8zwpleNIo{x9Yb#{hPa(w7Ry ziNK#$%s0ktT{^2+rJ-5n5am-mdVI;?)7jsrU2z0au1eQxewDG%J~6~mc)Pab2oN7Y zW>^J8B(7aE8ho0TEnQF9K8WArX*I(lpa{qe>)bGT>CQqL+FO5<#Y~Ecgtx1w3Gx8@ zw+jDO^WDpM_cDB2&aa_OHKc~fi|c6wa3XxfH2pIX`&js+BV}e)F18kq<2=3&!8~Q8 z_9>tU@JpROvu@W!bT|3|?%bv;H*;yIbET_kdM@=aRmq)EhE}ea489rzib19elh1RC zts=!{g{?F+wbIqptqVc~tmZO=%9fAU^Aqd8FGSW}O<|t8U?R&nUPj?rO-gkWDJSCK zSX?nI1Bw7Yw(vI!azg~GSo==IiZq73($!oRR&x?6nOobYJeaiU^vZc#43}2TX zPZz9k@+Y5SP%Di=tuzL;(xpdM)8#bEF_G0o!l$W_F`l&!u+O2s7{u38+9pF`n66J# zb3ur!c|2<(=|ub$DVqIhjA5-N63;9hyh$FIh;Ma%UrsYSRh!$gHD0v)T>ID zb3L_m_X=>_Df%ZU0^-^-PDa+7$G+0#oH+C7RyvPv1u6Z0rs2}%q*LPVpPU?rL*81F zR4T88r;N(0oZ9V)EFoE3&z|CF8Ap*y^XL>!;mXe=7U&yFx76u82qm(12QM;OHe;*qH`UQ9!* zLCX13X>W>nzVHWnrUCGllp^`sHz6Pz>{}kbN7paNay1is<9r!IJgb?=Kl@&IQD9oQ zQ<9>Xlp7*li@8cD=3G}yoto5Z1q|VBF;}|9+#E7yvIr;)ksigIA&W_+GcBh61A?=| zG);1)#iai*5#Q<(RZR2gDPt&QfKM+XS&B&mVj}j+O9)LNJ+5D~;f0>BR*wcJn=1W830UYag%7J-O)Zn8P&cYA5%V?O6 zeBYF%^AK?I5K8m8YRKodGoKWnk$P7XyAr+}*>}ONi2^nXG0KcSKP~S7{v(NAq{1l$N5o-r&bwyWGj$W26);KG2L$o@XM}<(2A)>Nr@+qB%2ZEGo;?CRBK*f}WIF-#s zHnZ+vnnmT7&5d{FDQkd_amT;#>2+LnqGge2sL8Jb7KXK-baRned&Y}wo~E0!$;(w# z4B6b0WK(~RH8^ocC=Ld3OsF*b0&_cQEG9Derm1<)Le4_PDIgMY?)5`bUnrg?AaX*K z%{(1z@FV#g)-3L2)*wy2)|B3<9PUd=Uq+$SiCix@Q79f5W_o*j8~bZA>CpVoTH81= zt%mkNHSG3>ph{IELxs!aKQG_&;itDx$=m&)Kf#uLVEW{3c-?LH&qCXXd>iW5-3_=M zy5xd|ofkdNHP@4tKqWEhO0;`K@O6$__jyZ`JU+-3e}(Uem>jG1>8v{O8?&W!3@G z>-4^Adt}M>f8M?S_1)KhCvVwnzAc^?o3dM8R{xK~k zB#-`n?)sMoa_F(Z^1#;irP0^VROlT79$qK@=)IX?^6<7@kNxZZe0gkib>Hld?40(f z2mgu019f|=jsiuV9EV&FoX&f1T`pR0-;zi5QjgU^I9%B4Cro)OP9N1pe}Z#!sgg&2 zPF~*%{w1%kuP^-z5XNX<$LCYKe+aiIHN6hr?EH1#uq|%#T6e4-7c^C(yrRG4HGAZ5 z@+flEYx1gWKVFqnUmjN6dLd8YlDL1p@GnaYDkpy*_1^4zA$r;+FZbIp%5{vrjC=hh zFN004zTE2AkL~5gh7`KYPPc5Y%U;_ioBQoyLdahn?HlgHWb%;w)w4sfp2wsC9)b$( zU!OmIsrAy+mL30I*q}(hG=o*aguDKthpdaHx*!Pmd5=mqA)V;bq`&yYq22+z{$>~Dg*W3PzB+ok_a7CQ1?)DaW6P z+UFOxi&aq2aC@oSts-DGlX51DnJD7wX291lbS!jI*X%X>Qg1ej`nqaIlAwBfJF_v# zGpSR(REf88(i@eUeU}C%-n@&-!bERW#TMbMZo`!=8D7F7_Dgj=-+B7F*$n?1(v6M{ zl@&I6`K$8QQaY^IIq!viGH&)KQiT04*hZIK@|-n_dT}d9C3~8V{E~k?^Dj%D$96Zi z<4)wr&YnZ^udj99y)XWgJge5~{&zc?SZaRmZGE~*{-unovY->)u*I14bKf4SB&Bk4<-~P7mn*x&hB`J6-zMY(;}7JZ15`KX!u+IEY=| z9>z_5IGr!LJ6}Bwm*hFDjwpLvy%WiEeN#Qi2{vI0tj0!o9d7%F0;>A#5_ftFisudg z1;?-z0qJ(9KnAqMUpDyu`YQ$Voxr#jn}sR~sPHgweYV1QY*=AZ4Tc0pz2-t?5>`*D0e zZyu8K??)_TBubo7@qFK(UllR(UjZzZ$$itE$K!2}U8?(9DSi*hf<5i!#D5XhT-%Bj z)TX*`eDP-Pqw7pHX%G(UZd5xtkt`XXu^p|ZX1otu3@MLyMSt>L->woe-mjSO9MvX2 zHmYdHd)r(&z26@&={vF)IxZV$j(4`yOU9wvvDeOcyN|~KXdk$Z>OFz?q#keVRojBs z`VC<7U7v5|(XH{8(Ia~o`7DO!197f)YkwYFH4f9wW+Hnvs~g^l$xFOr`+LB~*CE)- z1IU*nCdcGFpScIqk?qyQn-_{S=mCQ)gC;%MrRe)De|Nd&Wis|Jd9aApVX(e^CIp8b&po5$E2$SVMTtBJhP(2hNOd#kD+&*MW? z#E7YM<%*Brza<#Wm2=gf08^;I#d_M`DXq%rSIp`O_36DaKD<%z1_M#vT-dxwK${}i z+|T1(gwJnIY%n=u-Pmoc7#4>L2o`h=6nT?;IXw(xG4?GnW_YfsW072&i$ zkXn8o6=s^o(RS$smJx*Y=#6ef2357+kM%e9#O6?+=50D?zDctq#+XOjRwFfz^+^rA zz*Z8$=GKC2`r2R?+IMf1nK~2Om>Z8<_P7|2*br8|^Zn>et_Gh;#`<-%DRFizF^>6?F_Wi@>WOxiiy#=Vi zhR3ec=MOJo$6%0Hojc zd>*#tgI%BoFM?3;hWl+F2Ga-HyIvr<92@o~6I@x#5cCwVBSa8N!bI92?15^cKL5A7 zcT*qky*g3K@dLU2+kG+&%n3Gh1aWqL$z@=dVB-b2sPyG}2%_V*ZX6x=mTiOCSKoW< z%i*&ccIH#8v59;x*c}@l+Ma2J!R3=+^QOv(_iqNla5aqLJosDt8ET)l0eXn-b_DvyYtuG8UiUW(EmR$cdN5JrDEGoHz5|u% zw&BK;-YIBa`6aW1aXJAV3X{WyKsEb)2+nYgAarTwl zkQ*@52-?&SL_Lvj-`{E-bP6&Ch|r#2KiF3_1(?*hTGHH zLfC~G+0=&Dh%)n_V+wMH(gjFCV@`maBz?=NGw?iQI=7IWTIy6+vktpzyDi@Y;lXf zm)Pr8^=RAL3Zof*w0G<{`&hWc?Krt8-SwdIHZ{%<(hVK8C8O%Ugb93qs&DN$0S<_E!+yI_F< zLI}&;2KI&PZ$g%k^@{-p|AKetUiZ8_SXdl^I)8V*%>wLb7Gdd)V4sw5pnI!zXZqB>HB< zrDK0S109AQTUhI6Ve7rCLG|^Mp?Xt!uU=J%su%qUo}r9LG?`) z^{p+vlkod#RB)(ly>6%`Df4NppB7Kb_}P$40K7f;pD?JQ;?P5|YgvidB;{9x^$SO; z+Ho<1{`JpqpWc1p@OWf|;CAoW4gY3y%qpNa2?WDk&wA+pc4rdihTn(HgRA@dU?747 zLV@!64g02>M8%PD8lmS-Z~a4mz`16JTai=Gw&}P2m3mWeU=_3C_tu9TuP;@5w&PYp zE%BIO^psIQ@3^gkY(Sd8ufP9}K&m6`v}e3GR%L(v{mYk+A2_VqU9U=DV&oog-n(@W zE-@Sn@f7_;IMY5HI3=%~ut^JHGt*nYm((cO)jeM{4f_PCZkbshu#w!TrvBDr2nA>z z37e+d02r7YCbFC`BedA*_DfKvln|=fg=ce!89+sl1)KQ#Jk&ViJei z`F1*tKU6m|a(*M^jZH)tw+HLU{8W1*BpQfXO43YC&U{wh51~G1x59 z_gg`y0t7I&Wh>vfdxl28e)#g?mv=vZ-~`!6c)3)Hu)3{YUuteVd8l4>es}C0Y%I~= zYK(6VoIf-dK;@;YPa-?!s+6`OmPmAF=wHd9CdGvLVj>hxlQiySi)b@vBFL3p(;;2` z3SdfBaP+qdumL3!MuSA^2U!pcnd+E=VMEZY@*N0@0_KnfnO-j3I4Us<;S`At*TH6d z6eiw*A#BTFM~2P*F(kv(n$Yua%9=`?E7&@pRika&(^tTu#?|%FrXoceDg-qKkL0WC z{F}{C2`*QE7RC~}@j|_S^Tz6OH@@YpKD^I1m~LU5i#qzo&fd2nm51(X#fgM5a6Iv6Ho+&`Gj0R&A!mM~SxfBp5L z8g~Er@AnC|UbpJz3eSkp5EVd%2LJ0`vm?1=C3e9SswKx|itPeX8wkX97C(l1KOXPO zi$DDD1*D?*ukGvZueC&0_Q*ha5}lVHv6po6W6|aR+||eANA{v{@?k#$%H@ybzork3 zg+|F$Eenn)=Jpe533a{4(mcy_2P6EpnlhX~rsQ>kT zp+pHJAY2)$x!zTlkT$Mrcle3e@agrwvE9Dw@Q}2n@A$(c(}_l{UeBIS z1lV9&)+aXgK_B7CO=9a7&o$5PD2u2?Arz{mAITrL#*NfM!}@o&WK|N%AC2qJD@rw8V1ujhFzX}-dp(96I5Y)N+uny_ zy186;SQCL{Txva}`Ul3yUbx=2Od$%@>@*5y!$`{ry7s;@J*D1bHS`94CL4~KI29fr zn9;c&dnTRwYp{drED^P&S8OZ}fQkz#DB`ZT$U)NV^~j7qpeo~{K<@ARR;~DT|KoLJ zmQv(p+{Fg1Yh_8v6J5RSj=H73AL@Qwq{>YUA78Oudp1-)s?}~8TX!_?v4p1LEZBG7)8F;EdrRJIY`hgy&}P2f>@ud$cgBqzp;__I6Rl33)-9Rr_+fuacgzm0gyo`b9cYMb?h=82kIU zp&uloRK-9^&kVajDR-`J2_|jr-Ea;`M3wNdm+MgVNV>K0Kvmt_#)gtJ$a2CwpNML{ zUaj`)YeFxIssn{0MXf=uWFBvarKVKXGP-E$SJ^s1-?fiJZ&bi}q-)-oN>Rl#zVx2Y zoOl5;DUkFRg^PRXKPau98-vR-1S2~7)#FL>I0`V{uTZ_Mi*3`TCyjEp%nwjpy-DUpKczHFgYF(P=-+9n~2Ium_upAVYNh z?S-wtAmj1M405Lk_Be@Hzacd{^*d=!IyGklH(2{f4Ua0%bshw>ZYHIqHnEMwCH46s z5~;p){L>w$AE$1gbZWdw*DoKx{_EYBcREJDuS3r7)Im`&jNQHj>8t`OL|>Y7{a6+p z)(5sK`_ddMH?bX~vpTuR!oQ|UtpDj_5L?1_y48- z)KjtKhPr(Kwl>@~8`T1d>h8z3Ivt-0`f-2jPIM)q=eP4)((Sv;8~sXk{jFEl)i00! zcFvP8^~=ApKM0~jsS8Lgxe2uvT*hsk45~_&0-e!~+(tI2>w&r@bK<1l=aFWd}xoCz>rx3PO$w$7ia5%8w8O zDq&2Jnb;bknP1I#UBUe|&wly2l4$z*_b)%c`!^Tq*Ygc+M1vqjV z#9W$|;dyX>ym#^5GvBA|riKeB3WJx$1QG01@FcBV&JU*6gaisym0VsGEeHN5t}}JD9^EEhP=4ts3H4aL`h0bzhkU7T7&6Wv z5*TuD$CuZ)?fv%Pxa(hV89Vx1UnK1h$>$IJ*IE6?wGBL#Z^<3Z*!Di47QNJsm79?- z?74ahm0{yzf+`H5vr^z?_lhtlyd2szRoZUnq^%wp>jN%L^0|7TOQ7T$Dgz}Ld$Lfc zVfBhP)vHHyKNdfkT(mas%X82h4}rYQlvP4Rr{*W=FlI zvw6A;N*w_eijge;IN^4TItkS@?+9GipcyK(e%^(-BOkgzVmPslr+4weHb7<#vP-CZ z@nt5Q!ER#!E?Uo+TtwH*gi$ikO9O)}d5qdueT<$LwGCR8pqw-F=Fbox)l_TM8GCxh zme(}cu-(1Yrg+q}wqJUwj(r~yeZ0_=RE`fM2wI8iAkj24_I}qve}F1t+${=e7ZqRB zj6`;~`=KKH?9g39;>1xb(HJqrSsB_07=uQ;i`40p!dNvh9^svrB#{E{lmI z?OXe{+i%~J_R&35tOXsvqdl)1i6AfC=(vD`8f0fKWNIy(0t( zcHFo101rbck4FHiR3?k$)1U8u`!@%S2cm2`OrTCcJ3cmBxkvA_-S)57W~T>Zzuiy2 z|LeoQfB!S_w!MCV2zEtHP?{Wq(S3z5_zEf~6zrt5^3lRBi%DAgYzcC_WJi6x8fi6% zf`;dBJG{FhfHQ!l-d)PY{_3mh#OQO?w^E}hIG{UdVkJf@Ij0&hr+kQX#+V(zD2hiWG zclT@Zsi*UNNR-)o7V+s_FR0NZ?fGeFUw%0juSt8_cKh=tX`46YUR=)#s^=$BivC}f zeERsW4`2WI{r68gzVEQaCxYIXN)Js->){}|#39-d7ofIxlw_69Pml~yuR+D7Rp0NX zRE1PZa8^5blB13O3V!d=;-bwu+-Y%a`m}8j`%&V#+f}sXYey%_IRD*&@%c6$6 z9~!XBs`QX}6OmZoEajuZpceMihu^=v`}*_mI_|t&OUOj2I?t*_1?S6l^PsfRpVLoI z{POO-$_k3dD1oWMewqo7s{+vDn`zm`r%m_IU%r3-BWWuSx3txZ)sC(BssLB_&;T%D z4B=DdIqz1j)z)Q&W{Or;Budz)cc{!@vz6RVwSVIID@$#J9qV9PZ}Tm;9&TJzN-M#c zx1~{R(UIgGmyN!sI`<9$i(A@?{Gv`OUhH;p7ZpCq1L6DzzPT~Rc4m!2edv<2BmjmZ zgojRLl9_wS5@+=rm_<6@bpkygkqSi{T^di1Zur5jg{$POUL~7${PtCX;Yanj&u%i$ zY}tJVp3(gr2P6{GlQdsp##U`%S&M`OZzfMA$fYcQr9*dC)IZ z6Q85^pFvch&Rs2;>S|2Rm)+)NpV$_>>Y3**`AvEAiq=?iKJh;}H*asM;C{3E-B}TH zc>pL>of*Tf2`vMEM9S@K&DPFRFQ?d_3-@|$8rC5)+56K1ka^rd=^c~yi1NdxER zB9Tt6WyrJDV4o(;rxSh$RqnY_A}EQQm_s`s(ZoIP5A}81WHOJJOfD_ z-Ow=u@viQybuJtv8iOdp3m87ggY3|Y5<@x%YsN6nXu-%~TmjM!yinC^DX6al>TDu( zy#;%NI?QrypI(^d`&vD#vyDv3b+S}%)%nQCrsxB0c|jX44_D)zm}h`kRh>|w7)-EO zZ?yKsxf+OkmCQ4$XNQ_G1wwR*aHzpJ2kP4h$;B0eu$oS^*UERcG4d1yaE2G`=|1}oBxC?R zyaa>Lij3c4+F0ddsDNYZVC>Hoo@`W)b2U5X=OX#%%daoXFWG95CnuIpCKzx=!y_;^ zF75*LisjUsyK*QbTMAlK^8ks%1|D#&Ux+BdPxttr*fx79P?gF2gh`*A#u&^x-P~tA zNra_)ZGz(csUME_N^Nxzyp?!zRYn9`4+fY?*aH1xNgNNmRrfTZx(_Gxfw}%qtMlj( zN$bS)8?!bihH-(jr$~~2{{GM3b#&~M6u@O`*!rGhSC$4oAHYTKJ@pEd`X53!c|x7+ zcH^;Ai*!1_=`T6)2>qZF|8!k-OsF)Um{&bDWAHJCuujczk#o5`-U6 zHD_?sZ}1VZ=AR#b`Q_i@2P?%2mH3KsRJxPXadY24E1eI;adF%$EVPA#0f#!rkmjHj zo=)|k%AZxOL9uTsGDx)g=ZA0KK7Q~Kt9N|I?Z$Y?KS7Spo^TVX)g>P|4>{^g7xvgs z>Mq}T3)bKT`~Aznw}{+o3CfTI(ji=;BEOpE?mw)fHLupX%{de4l!FoMglVm-%lY6||z` z^6(NSF~&Ck32<4_^a$A1RS<-7lV!jnfb1)*?Z?J%y70ugCjSc*)_=bHO$ksT9lr8C z2W27ke>U;)B1DCUO$L+w?cSK|suzVR){StS+x6E=Mv+6^a;hke-a?~!R=l>mqzQf5 zW>lN#u@qPhc!`!lRnA8$@6EkU)Of0&|8ek$w?t+CPiRYT95Xkg8jB8bBMILvWP|pS z-0BC8{(L|(G~KgWDoK$|H{Mu1;)U+mh7jwfTaGGK$;WPAvGPd`pBh%l!qrMda(Z)7 z%tc+rx;c4qsZ0si`&6w>(eb2W`nS?G!FRUtRK-H)A}paM0cx4z6om=4WmlA18MoJf{eoT_qQm3^!}6ubD? z(tbnpLPrkv_h-cL&aeMD{PJ|ayibk~bR`8>#`Emjef_ZV=wH_T<)y*ePrk$TN$e=fL^jmc-JE3 z{z?nt+&VL^(B?9z({%Bwmi-e1+y1f<9+Z{%K2L%kC224?B*GYIQA{L*xcvU##}hh- z$J6uvanf_AE5~_k?6jJXh3%#r)q6cQj2`0BC>@)DwWM2-Zs+B2VqPpF0p6}8WK_va zSk`-_@7S?`;W+;bmL-#0KX#Nlb-dI$`1Qlr_kVu+@QuSQj=Cx8uiPa185Enp3MC?O z*wh9b#)p5Um1|yg*j_KS`uHeos=u%5+|29zgJni#6@`lpDQFmv^>%yP{78;-e{dp; z#QKA@d}!x9?B4qRVq%4zWA$>5gcGSB%8W;*m~e;caMFVk4kd#NZV&4lCBLcz`0?BC zUpS{U<%wHlO$Hi|0IRg9(jLCJbM1!XQSx7_n;$}pj4IPiP7qXdP1XU+0OvYLHa(hg z+zqk)$kDp?c@EiG=r|%U;_hikg`3)8XuWsBk9Ulng;c)k!0|&aFji4JkD?^*|gQzeZ?(Lq{ zf+EZqpr8^=wP+B1Cv}XX^)RXuZJ#o5Sg>+eiKS)`OG%fG*rKu%&Vc6g1a5`9&S+o`d?pFGxTgr&ShznXae{P(24>#j#0N8qZAX zi&Uc{Q!cHrGN#qA|e}7LRBTxnI^sOyEyn*Dg*Y8FJYM`HZLZw*VcSoLxIX5 zg!fqc#YaX!4m}brfRFo_36c2lM)NG(tI!kN9m4?!RtP`)t<^~1OJvcE4&|lVCck|8 z{p-hf$)W98{C8lm@Cn%P2qRORv?>p9K&$L<-ghURKDFD9ru}d_oD4hFy&W4+9GbUF zuWSYAz*>k0e~^G33J#6OS`Q6<65!y8)kAY>_3aidt|l0jKd4Ff5ySL}s_5%@+^H-m zLXJon2U)3!UkJvJkUhy8v3AX-sB*mFNU%Y*;vZTsWtd_m+4Ms)pR#AlxU;bVsIE(;kSgWWO9B`^Jup*&OFUJ|uY`ExeNy&s zH@5rVKgeN9yW{AMv-YT2*+q`svvkV36ElNILL7WXC2^0)c2T7x(m7h#?`D5LGpM1K zXv8^tdo##AGmH}2s&S(AC0@nS5Jt{sW+HFMEzn8$H?2COWN{W1@2%^s=H(xEKfiGm zzh^E-9^d-6y7OjOqQmG_EG#1$J%_?t9#!5w!d6iOAhGJ_u=iFG+X2Rj(q-M!@Z@3fqyQ?3rRbcfGF-=tX#4W1AV1fAn5e z;v@AyF7ZIUWk(bGAcugbHFxfO+eST&n%nwO^&DYBr})UVe(x8vvSY8xmmI$DD^-PI z)-l<)ajoqSK5En?3TiJZ6!O6>YMNK$4S^cs5raK7X9=)wX9YP}k!*h+Z(C*UAj;?C z5!&pr1(xhjkKw#pDnglG=C#dh6CbLEJYVa!sV0U87XWyo8&{c-$rqXc+cPf4@Bf2g$ViX*(d{w!Lo>Hkq^jDEFvm z)D;t^`lPC1S2Y7q>>vBBqQoJZqk*()<>X#q!m;4WqSTV zf<0BXxBw+Y#bTX=hFIxG9vC^Uc4U=j# zz6ZK!6A4ssK1k@`!Hd2Y-A;%@eraNZ1d;YZzx4ykKRQ(7bV)pXr%q|zJ~xAe^SZsE zN>{fR_qCKaCp^nbRVQ!63iBu`o@vlT7kND zH(M?vGquVmk=PR0|NVft{StPgZ?4F#s!uNblA56;x}Ej0*_|a_(I@Z+qYcBVGc?w~ zTIaSe`V*+RmD_hnkAb8l4WB&N^h`6UJ3zmrW~l^j<*D7;ax2NCF65ClVRgkot!k@@ z1m?P9d3{?ie(c}>Gx?DJTM|ocK2tss&wzwPD<)l%OV#8y*tkb za(HchwnM!6nc?}}-J7ZG?lsb=dh}jwNzeXfS7F(y?Y=TaFQO#U)zKR-seiFyA4idn z?7q9P=cw|RiI0yJTeH#WzT%QIf4((uZ=;U957^F2ko-(-T_849y0Dp2Fjecj*i|Ms z*|D+H?uG$0x%BgetiRrX>SWMF1XH88ttY-%Oe8HKTQz{Y{*8RM>+cejaohSNWT!>| z9a&{4cjpv^Yz)#vnyxu3OnrMjHr*1k;f5nC&Lu^3_YtpEyvS!FZi0k|M{elj=)gmV z_!Fy971`+}8?`MW-Zw??ztgoE!yT1Pr+7Y{Z<5G&r^8~iS?G&TduvqgJWQYL8cDJ0 zFa|0(%E@|7qdubAJCNpT*QoM%IkM-5>6R_3epWGOqeL#t%k5oZS4HH&3AZc{+BKGi zcFn~HmqrQNLMr7#-g;={FfOl>sS<*cH5kKl%J8FA9C!0hb3cE4|J$!0-u^zMs$%uj-m77E``bbF;cm}1Ya8&=j*{iXjw8F(?)C>Z58l-; z>_WO@pCCnB{mk}v$M z+wu9ZxvF0&rfhlQRQvj@M>cHuv{Uh|*wRbMTs=l6R3u3eAwO3Rx!j#vhQI(-@Ls&T zt8OnWaM?w#?C0v{mFXOx2bOU_F0AQ-Gy#ZaCj1}`Z|vUOjoif!OVR4?5J8wU{h1A* zTHhvIK24;YFkeo@;p*zho9c$+G`Bd|QBPGKVpTtI>}SNSi**3+M9X8C@CY(xw5yuo zfn@+QvLbkF0H*W>tS#NC;!3O#Ja`i6XK3a#ayG3zAkZ81i^3AUTy`?vs@&_1LV2nb ze}8B7qYfoQcH4)@H3rkE1FV0zyvheic%l)uQ6dAI#>eB35q)jM zRa+m>gic~T3$Qyhyk&c&a`8rbDw9TrgiKT}w%vH}q{Ft`ABP{nwkXv(%TryH7=KZr z1UJqNEF9pewy(}|&qc13YpwaB@V9Kfq!ve{vOew>Wh`9D(A|WFU2{*~e|q=r+sF4D zcg|byC9$!RWqaPYjQI=Mgm-&--AF`Sh@2ne>tp|xY*j^WpY#43s4gO`se%KlJ`gNpn64m4=y3-{jX?C=|&xI+Q4-H zaR;gj30wqXgeHjk4BKO5sbk;VT;`7bPC5J7N*K^vTGR%VFwfOsRDS@tdRtQxj7)d* z&PzbW9$O+8rbrL&r_m^|GI`J94wD>^fa62G+n|bu?0xhyi0!d{!+B=X0rXt& zq<{RRAgaT0u6^c`cz+E%@n&ZL?MC3Xn#ksUJH%ND1ajFd@(igwthQxGDU#(_F=t>< zmU%D9nA&h_9EO=JOuSRYmJUNjVPq<#p2*HI#m-a7Hsplu{(1j)JE|YKBZutA<>RRI zuV42^U6kKwyKY&kUYEk#xMfgXJxvL7s>a`&WE1*)u8fWz|4tu7JNT-)XcvmN+ui1I z(Ob4#T75A7CELwSv81qV+LOeSn+iVdpImgsB}6cegO(Op;a z7fO`ZY^tBJt*&<#PJ>(I{jDD7fsQss9r}AmeNc5?=nw8(otRMHuu&DEMqLG$tbi_5 zTV+8SJV$%1?pib$Bn+Mr*^VlJKZrE=<**tgKZqq%hxlLG7 zq&_3Sy4s)q{QmvJ*MEHSiTbvwC!$iMOP@Y`<@l^P)6x51bub)X7&L@TYdSWuAYbK! zWxT^oG81x!@QTx^=H0M-Y~U@*b#xOTY(M}x#M4$x*uiho5+r#k>K5!?9v!$n(o7?lilmr^*z_+bmlr0*640OE z&U$QpjTh?y%kZ|Z5qZhAT?V|{nXPp;zq`V{RA54XYTFn6LI4sb&@*5ejzvYbXS}; zdhcMo=^Mlef=P$^r~cry>b=3&rmw9_yXm*_$R>u;MEZ?gu5DsxFOkjTWbohLY$Du> zf+_x8Ue2p>09T7N*|aKEegPx{E;VjFAV5Ogi8FJC7w-Bv-Z*JZh+C0WZpiI18kTG| zd+Il2rncX+3(|%OO4Se|wLYhHr)kqFBi{%`_2vXqDYSdER%H-idwywlL1K5MnFgr? zVzA_I9)!GezC3to^GerFJ^L4zw`O1s1m|z#aaTQ*8Go86=XM*$X*P{_wNafL865>h zeb!GlB;rH$QIPJ;D;AqT@9K~g$m(%bFA2uelzP;ZzLQ&uE3F`l02?k z*&vNr$%8>&^~+KOQaXWmsXk7&^QE0#%Pyy@s5`HDV^50piQ=^ z>qAWhu(uZ1H~kf04aLA~y!KD`gWK9CTGSVR3gUZXlFFp9UzLrtKn{-9+SQ=sGIcaI z@^$m#MNJ|bhSoOKgPszIEGTdsRVbJdL)Ex<(-*sNZKh_FO+9#aAYU_s&pFZ{kcF0z z7<>Kc-PfPgBV$KEM!Sb8 z{>%R_>}H_GZ9`vp<7Gfh=DxidSkP?Zc##-$n{M-^zrC`biqh>yZ$>U->vS3}c1-v5N4zn&1Xh$VI$SmsRHCXRNk&jZbLScol7JCU za>1>-pL)QFD@dvzcaMsLH+Al-AN)^PGSTL%K(%;*W#anxbZ>&F9KVYlpQ@`$SLMC3 zNa7&MQhhtz6)D|oQ;!ef{fdS(D>1qNWpe=MC{a=$V5=L92kMS@f-^UEc-ffPE?yPN z#OeXDoI_5-P#)TpKGMe%ukVOT=HDEr>ws)RG&F5(=Y?EhvV02COec_ZgYYe#yBZby zT~tgh)2Z4XAKZ)5f>Ba>^6o;mB;MIZ;i6D`GeLExti;JcCD$4ZC^1PyLS58y(x>8< zAm`-W=MP^$zJK>6@sOt8d{G<8f;GK?iCo3xo24J`Bul39lH{l5L>vPbHCKK?Sn#VD zj#7vi4)wmX3JKer$*G^?h*A9ktm(tC6D_qjb>Y4-^0@0g;J8{ZA&Wbnv#MtAHsswW z>tj}yACg!j<0U`dA$VqKFxyz1*mDlKX}A!{r=R*U>&1VTHS5Z$*9ZnKV&8R>q+EI82nm67Ur^1iJVnxaQwlT=i&O@N+6@iAc~w`W%?RF|IjkmK|IW!%XR ziR3rEoP}nri%hEBbNWP~-+8OVce{J5wo>&!-7c!BonwEe9z%j1B=i%Em7(L2iwlBB zE8guIW;FGwSLK`Ce6;gZ)pZQKsDV^{=H(i~Ausfe+rE8JJ#K3!k~M~W-n|PH4M7D9jUx%BnB#s&|#mU%jiQ%_b`q2i4K0IscO?8}ePDIL*qZ zRjJeD6n$D2|B|O)(R){g_4I_EY)1#;>1ny-CsGz)e@c`GbmO{Q7P%lVm!+zkCmpRD zL7wVHY=J(N*-|eShT|cQ!8V6PBs(06vFF6Z|?MmPE(=uDER*P({2lPfcS&=W7i(D=D zT5l-QLhny6$r?kca*AZVT9%6<&z_$})wHcw`K{ebidipJ4%Tc)x-KzsU4ZCctQYGQ zzhrXqwfafxe3>uS3SQ0wN(ni+!j={KOV;UAnyd!*a#zz1+sSHHK1fzk&T_e08E`nUSolQ2o}R0fTDX-GAT{Xxk}m!9<&{aY zD&xP1zE#gJ6@jaTL>)z_JT>^w3`dtppA@VF&YMf6zFx6ZO3G0cxLk8~H9epRD@!$-v;j8H3UPz5T=|Hb zm##vIA;*#&{Rxz}Si$T4T!keLVH900*9%ZyEOTyCu3eUDfpke1$Q5#6ijHNem{NgA zljVZ27D}sSp>)%uIX@8{>X$4Tl~=~nlFM%a?GEUi?qahETAhsN`4~Bi={q~ zY*xW^2gbR}Tru|~Pz;yqbSsxB1e_?atX)!eRKq;sz{=D!+A0oqAmyk5U0#5U(l%dRFl! zM-jRpepC=CiwjC-vRJT>$O7~B3+&lb=v?rKR0Vv2u)I(qOB7Q$`YehZuf)Ld0(<3) zyu^??xWv(YiVE`rCtc4!;$3Jb;|H-peL+ z)LZ-z=3LLXlr8uris+o5hzbWrphYqqy)9S1m!m&`6KbO}1I~i#qsUdO6j%l?nDC}$ zb?aJWS-}s2d2v8x#83w024XL>!S=#NyiL-zA4%6LNPyQjPK5hyWZkedtQG-&w)CT= z{ZGr~Q$T6(7FQElOeF3v;{GD87dD_>u$gsXi2GA(s^z*RCHW{yYARPau$*%$bVaIc z#0kX&B@HJ$46>XFUQSl+C$gSNF_F@juyqc&VJ&RfyNokFmee*Ai_#)g@`gn~W>~Ha zku6eNFkj6iorvFHEWMy+}N@T-p1jqYg5CqAk>~XJUV8y@7a3>E5=; z!gnp4X+?^-tC&5E)PqdXk>HXr76Kp z_<|t5Cyj^GxH0u`03^OR2yaoGmjRi94_hgsSBB}0CcYct9*7dOQZX$9a>EozUtNUPg+I&{8!+EiM4?-yw1mJEHMDw$DB3~v z#1d~*0WajYWM_UN5`XihHzWs0#HGX-IR!t6i^(#I$e*-K^VfH;{>C&}4@ zWt@z_nv_p7!LOA4Ujd?LIhTZ`OTyDc?8jV*EtOV%lTX|Y-c_%wo*p$xEJdH9vbEmI9;Qu^*Je9Gofg{U+UJ-T2aZLfBm5e7N_TsjzX z@SX##w+^U`9j<EoK=a$Z{sU)f>T= z0E6Tcp$;n|^$Vvp7t;0Qzofs?@b_`VQlS*{gUk8Ca`vhWuNEYIVezhrloBj`$5gh9 zxvnkdrmV1(x0*<4e{vt@4)`qP<&0YOLc)+E!%3jv2jLVsUB!@6OKHl9=_y5$-2W<} zcbWhY3v&-}7z)5uv0xQPM5}<<$+M|K3Bs!)qI3GDZ^rnHoSr9;+OIVHO2d5S$xmubPU3GD?!%*_I)|U zwEMdT`)27~z%PhPc0L!%e6HzprMcZX@I`oU`962evsFG#$5?!|fR12>*3=gX4>I}dvVafF%p z(js2r8bA=CT*M0(k%n1R(pmIDvbi?M=00Bxo7n$6e9I#SvbdVX$!t0q-H1;|4=~~> zhHebLZyntulfXz+kvN`eiZp8c)E$4hE8nw>moBHziOS#OHSvsFfi#+E57flez zEqu8kNd)miSK)%VHIMh@^G879%>03qRF_6}NU;+akQpNDC`X;@`kG`f{jJ?4*`LGk zNV4zN<;}h~-dj8Sj+XoOoMhiHArIKLy9gF#bpN;hdTcnha$)uj+uKQYyASkb-Nntm z+JmoE)1jW3g$2FUOmxGK>g`nzh1E16X3&z%cFuIqwI9bA8*^JDvE90#>ty zc%hV#{jie^#i>VsPqKgByQY^H|C}}(%>L=^28GquezF%4=fN#^{=)iyo%p5EyA-5f zVxy2G^D68l`|x^gnV8K!cztS;{TvG+MPeh{jAa402WTaI5$l&H8S2wI{}VI3I%>S~ zG5ZM(huaR~EkK2=T*xM^9}#QeWmd0{_iC%uZDOYgwd8|9;8U5jWY4A;g)Q~dkg|d`GCWxarxx8S!3*wNjqgxFL zzssCAtrzj^g112mD_>2-s76+hhp$<9mc_%FzjvL6A8EWlW@#Y){?*zumLl=Sl{#t( zMe{KB;KJWu#)tAMZMSE_%hAEe+XV&wJnfQ*V{6x}tg3fFfBcH2@#El^0fk|;Hn=tlQWg_Qc~QDv7XkJp zgrp#)A6qka9H>U0Qd!{uU~5 z%HCviat%5sa@g?-kV8_e)$8Vb!C7}cRul2nEM%~3?T#zJ*T*PmVKP6FKKZuPK3mwy zP28vjv5zTp(b;#3y@DdR#p1;|ZSF%#dq z2rn1&aS=~2`UaGKEGBd&GM{mzs^zkO`TXi=u!1;}lxDs$ix*|H4^u*|R1d7kuS}P# zo0u^KFNZUdI@G=~V3w^sy#VlG0MBOjdo>ra)inNW!lb;MluWjo1kG$UjUi?8Kxu}S zz{;?SqrXo_B%740nee)FZ67?%CZO+;t)@;#kmYJ7zJyGXt)@}xAWPp`#;ePCHDU!| zDK3i<)0xDJkub6tG4*k=^l|heCgKYbS?N?O#TY5z=yIpupqrNaTRm

%e4)$Qf!H z>gg?UU{ty>9%_gqg1Vf#h$hR-7p8I;WHA%pL&q?SfzoU_jnrgI&kSTS?1`V2-v9!> zq|WmFQD+HOtAO0F^i9!k&z93Tp2#xpo?@J_&?3N(F(hj6LoqNdvWR<;=75#GSd?+n zlD0%Sn98P`yY26+4OD8EQ*%ctiOL>BU;^bB)W=7)Ow)w?WFdw2F7Evgs{TGL};pE{MbBu`>hT zI5$M))Dg=VU$wiOz}_wRL5exFQ+-xWJ@SmP)PU6@pa}5Yc?5=Gk*u66xH2jjjh4FOFb)ZSfYh3v)W|B`N9xWZXG+xexg@8$LVEGi_Ym3>B!iR397E?z$ zNW8R|zog&?p{EM0{5Y+aL(8&n!z#cbrH>87t5beS=7L`k(1OaOV4_v7JTF{D6|0gT z!~-W;u~Z#+7$Mw5Tr0c;Ly)25A+qEr!uO!VGfhV^j*eHPQxR2g!ITs((OyJFTzEu1 zV|er_U}cC~vbZJY`-7A|lR7LO_5h-Ac(^nkoH9gVDMl`J5QC_>VY+>8Ckv098;h#RMNL`EHF_~;qhiiR#Wai~;#RdtrvraW z@OgNj*>Euw)fBAa>Swwy?j`el*&X{5g=XR>0hR^|cTEXH;HY55$5*$fU1 zdQw?2O~_1SIg>I7Ixt!OqgcF@OZ66Wb)?l>RsN+>&gmf$Z75vGi+qKEw1T*{%A-vY zDc6SL`Pn_IyqFB%&j;1;_Bt^D(|dwe|3DiKfUp9?xOoQ9a4_OnaTFrSLEQeJ)+um& zGhg7l7tidaZM|UMv?%WZ!w~4Ot%6?z`hexCnaTR;?d^Yf`uu(8pUWV`Nq^~!AyQ`VhJzzd?*9;RKB;+3#2%(TKh+QU++aW!REl}X3Hdaumc{semd}ku9*smE{h2&! zhIx=a2+g2~UpLK-WikHFhs_N@9^#lFyp3rukvvYjhZ%$GK)fbj#Gw2PD+3QNOzXC}19yCXE&}BfOdN5`dNl$xbm?7|4>4{Kt=%7ZZ|+EKvOT zF_8sbQ^!4!`c2sz{~#!F7}8`KJEe=W^i7`V2`mErW!zwKnSuG-;MF6ckN+}Z7FSX~ zX%Rh}bg{B5Wb-VIx1vRtdF=gfLRFK^sf^yCkJr=DvIxiww3FF1<(AD_i9t&Hw|esN zD&Dz@bMc1N($B2sH%=YkERA5ga?hqonQT^6G(puli}88Dw=d=}#1vhS(*6~3Tr4N> zQ*N5);d$mPd^VpBro>=CJc|K&!z#e%!)j`%Q04H9WqW}$f#2rG=lqch+v;d$$ zU%yDJWNw;Ma$e$h@Mz}Il+^NoTw*)TEMWo*L-q`yosrF>@Y$?0Ig!Og;=xca${2^Y zeA9&i!N66>;p^VOEV~3dGOk;YS{~M#N28MH4A!l1=3AdrF5o3-6uS zUPfY=zhN4SNT*2{lucD{rk~coz5liTElHoM>n$sV>ucX69)FNjwZzHgWE|4I8}y3Q zV~S79iRhcsP_i`m5hPYXX_qqISO&zAatknBb14q8uv>uExEB7P=| zJ2E1E?RFqtPlGfQ;Wd#*)>b43__VeA2kClh4JJ~|WWGeKuG0vSb=!c|GN24t1Qdpd zo%K{fKvDyPYKAz9h+nIM@M9~7Eb_{F8t_Ti(*Qxbw(^_7*O&f)sk0DdxtNLXXCw$% z`>`^@R!$!{^#??-&S@wE{LmsEqOSlf<7obz;%NduSQmT?rhH^_1(-0#^2fV5vt zin>8c6Xeb`6iE$!C^~zP)TdYR^lBMLkqq<5=tQ!Kl)i@wKV3~D*y+kzjOjcmnyx%7 zm#!uOFi7bqiU>~;;c+qcfM^7)m|s-P;b$ZhSo?IodJ0$u*e}Qa%2N>OYErNWQvOZ! z8V4B#S&1VnoCOXSJV2A8MVc9i`{kTO%eeqArvV$0Xgt#8)LRe2_n}$p3+en!I^QuB z!sT3JFR4=i*C~vot^-oTGL9l&E~nX{Amx0i^n(awX$-j4I9d^ zhQd(#?kN+LbF$7uu#h-jI@BJXNkcVuX%eYl&h7E6EGxojJFxWg<$S&T`?^0S3U(;K zI((rc#SHZHxpNAYks{^Xl$LXWTu|^9Buv-1>Jd-eRUCv6vzS&ZOeBNQ z{{qOji@6D8L^Lz30wSz21`0%MEJAWwM6O?Wup0RLYJAWl>b6C+MS}3F{QGKrUW|PL z^YdPgXF`uPa9K>Gj7RtnDb{|3kt!fwQFz)gUATX2@YUQ(GO3kB%jHabqqE>5M43gz zKj6DV&J7YFo$9P&ZAU&alI@aM0`#2HV$SHrq)!%PSc=-vi6fvV-}u!N{d;>Ehd%UiTKh~*%eXCg`Q|y zOv@vJ_)DhI$u!0xf$*rDZ!Bkz%K06O@M;l3VVS2PPDa2MA)^;_D_FSSn#O>n!Czj4 z&qWy!HDuxPWKUxzBZy;i>hy@XKT%lOEG?$#DUYAfPhy3-i91bc9)fA^sab&c<CBrI*Ghb!g{q(=(0#H zMfKW8F49>PtSr(hn??%KSzj~FqAwZ4GO5)zGvAm-rpm0TVu+(v91-|gTQkj~<;kM9 z%p#q#SrW-S!<&ZoCa_!u*r!$0ec3ERW>(EhL#fkXzm`+D=A;bW&LF98EF%bIcw0t6 z3R2F*K9qB?rVe8e2W=7Gx`==-A}L~+D9vU`Gn=M_88VqY&!^a&>s1f%R3J)q3W^#p z8ZDF(l`4vg)DfPRb`)!pYvfS;(86TQ0mowu5EtzK<6rVN|1-;yx7Y16gX|_7J3+h4 zrQ1AjU*D4d=+J}NZ$rH(Z@bsz?KZMiz#B%}-uj{ECvs!wQi1tdPJgY8mrawrHCL=d z2$*SjYx+yAOO35XzcuxNz4qRYb$7^_i+QVG$Dvp*SYrKF-+Jt3Cja^H#~&X)ef*NV zZGUNwpMH~X|If{C->TttyW2mD+}PUht@`mgy!d_9MSp^`cTIn*Fk&Fs>JK>cGr?%y ze=r}+%O&R=)J|da7#!YJsTcA+E$VDIJ3+udF+oj3}YsbdWb*R z(6f+UZlglntkR;=6B z51{f+q!0E+s?Lqcv9d>eLv_CI-oQ=UpZnzX^^dA3Hb4IF>gO--lGpJ*?$~trbv&PT zKD+K#E+bBct^u1v+`vrT!%Dyi)rj6S>E}y48H^<`6EdIc1FJ}F=W$bYeMc-!|ubbB?hCHmOIc0c4Pwj{Ra zOgG$a4g2oD1Sw2va$a@2HV43_T3)=}weJ7pr=Py*s2g#*3M+*#-s()yI&b}D#P7Cc zUlW~Yw@aY2xq}x~soN75RF*kB_PwrWFZoOHvUn+zzpN6nTD~ODkFmP5uiU@Xo~*97 z6I2hzhsd ze%JSsHG(Mn{_FSOfByY<9bX#!YG||y|G1Cxqy4qNDY&r5H(_go+KwynOeKGdUH4@kwwcVKkS!>vfSVPqjTF% zv71;NdEPuW+ipB=yWL3#x6Sij`Q>?Ye#1z@GbKxv{BtyI0&JTl|Eefq%Gb}z-dM~M zAsR={u;Kf&_ad$0Fl?`z$vt>8z~^drf5UAqo^!eX_vhVznnj=7$H!yeUTnWod_3;Y ziKGHWQCO6F7GAcQT-7J9HTFuxH^=)%P#v1&e!ErMtvtH1SD=6f;eLHow#IV5?y$FZ zzuH{YFJq zhkMxd7f!NqAg-LY^+TuQ@G3xT%;l90fpT2&oQl>sx<#Q8t}cx(4cFQqGv4kPK@xOl z)u-QYY!R`CmWRhm`ah1Gau8%o$t zp}5u0KB~|BOl)pw#Av8o3Arl5)T)CIxwmp%VZzNp8i$#E1e39MQz5)l7msYjj(JQI z46%*u-%YJNA@&* zGN@-Dz+k}Wt=0jywO5+=7rjgF<#7mLXZc`He)?j&J_-g#6cziwe}4b&JLlP%p4VNf zf$+3v`)jKKfSgUkKD|OLKaZ_jtWk2A%9?&E11bfoEUV$FwtH+a-b^iE+mhcue)&zZ z%ZT))NYUZD%YcjkZ_l=NJ2q_eJvP-rNw1#pczi{^!9p%6eN_HnMbmgBMotqFg~w(X zRMD8&7B;D0y#cWWJ>(eYSzM;b4wCsybs0dcR%SuC-g`sLFk_Vm62@bV4O@URcbqJj zir5ypNxuWOs*k`;&(6dqw}Y`}4@Z;AJ~=P3A^do(M(hS-uaZEk9Qck(aeSz@n`Bf^ zRB|tXQwacY9PdjvO#is;jzE*HV>d@_na zcl#fI9zH2p8{2;xt4Hhi8ZWLQOvxJ6{e}sX(bf8h$y*h%@9(~UWMl7qi69xASz zMqzIkL*t|O&b_x)Fu7O#0Szy_*7U4Ix;OjN#dfTt4ZpJkGtPmwXRI!FoT~$TX&(4^ zA*5^tOTMVuJI|=1Q*8lpl~=XihkmTi`V$;``+vANFt(||)k-x{GR~@4-yUjO6y3w4 zQ**1ge0y};&#}Y0&TUm5gza;q-mluwZ>BnfVX<%j{`t#?e<#B$|C4WY4fp!i;YCez z3#fmOH!lsABf-7uoIyPXIx0cPR1!tIwo=pd?XP#AKK=d|C%9iySHDnkhbSirFpn$1 zI5=?9HQOv3?v$;T%&k`X&Nk-|Ri%JBqiT}fd;`}TGMP{n1x`>Kkelf?$RR+PX(AZ2 zGTSt_nVf@2=r-mVNWj!q>vO*uIqW6s2ncP5t$EBKeZxS@BLMkuxL^D^tvVGZl7)8_ zUxgv=U9$~_q+wF~wUW4rulwdg<u$Ghy{oQxYuTv`S6lnP6gFG8>8QM zhKt?f0I1Ij)O?HZ|F<2VKoyc93vvx`haHB^Ch*81hOGmzz+jRGWX6uJvXO1|zuBaM z4zWKX*zd_m7~VPdEum`fY?zIBNoN7H;4zFgiS-Qw@Hf6xedb4iQx#GqVTe~<@H@0- z>FGde55VvjnGL$ljE*{e4_!B$qc0CEA%)y9G+F%3Xs^727{W=qt0p~S1jH8pAp5o^ zQ;2PE)qV``Hur;Hcq`)h@J4d41E`9!wJ)txcvKN#39jC_B@VywS_yLB{4W^>S^{id zsay@;mT&p+vTXlMhFg75i#;ggQhFpJWB&nCy_^l~@;_W3B*$>Qcg`W#JC-el62L~a zf+mO6Y9eVilT-x3C%_SLRfDRuxO(?(M(ZR4+>&p9e0uloR~pXI;-KA_{>}7p`U`nrq)V9E5g8cx>JQ?L0CV_?Qa<9Dq&CDmx*YiGdWJmDT5?5*WIVp7 zSM>!j%+Q1VbKMvh3!r`AHlq!0iS7K#vn`_zJ?*ssdk{mv_oY2S2)j$dEp{42;`6$P zE4uD}ICvOikmSNza4_?s0%f>bAwC%C+S#_B(ecwUvMo2Z>o?*2w=eJh`29=b{B|XS zK}bH3l({@;cZN%klx(~{01PVz+9gbY3lk(^?LA>*00T=jjZe`F`GzTjFV(Y7+Zr0! zw(_lg48&f0AK&b9O0~Zo=#5vmJ;L4<(km9fefs$RHyyYaC)k}UHN1n(=J4HT6$O39 zxvyG|nmF08&K+Pg^5I<99y=P&9Hg0|e{|@<-9tYK5zkc}m=^e-W{R^)?*7cFl9;=rQzo>?Z$z$bY z1e}E+6riIwYR^sd6}3r~_$j}rVk-he9pHN=o?&S&G(|>?w%7 zAe7nY5ys*0;g|bwKYdPy`r(J_S4miESHFqeFwnypkBveudjlm7zu?blxr*f8SE zciFgv+zOLg-|FjVlfgQ3RiaADvT;(8Bkf;(p*tYBB81g#)Z3UD8Uq|e39vMxw%yJf zTIy9H<+|S9>e1f=p{=O5n@V|0@5ZPP6*fe!MF08)R0BobtElb!C)K69;pK1y{9mNm zUdELod(;cI5_=R8>f>(sj&Ivrb4BvoDwjHV5X!{2tvcLP!r(w8K=>YT6`%^}{qNsD zz5DVr$Nh#@K}3~ps~2yNh-$o4wFp~wi1f9OJK8h|9oqo|jkWPwA6oEYW2q(q7p(pb z7&pY-?|WWQy+!%1Ucv~KNX5@2Cxchd2+!Uqqz5q@BE0VjMs?p(@mJ&HhI_wtJi(-$ z>-UL4u6J@3#cCChEx;{)4RP~LtrRc5?dn5kvaJS{XjT44Bw_V&X!EOUW#}Z|VSEZ! zS&*naD4I_+p+m3aT*h+ zZ2n){=+d`pu0lnyjf&5g%Omrp3oo>JWC3F(Llr%p3e!ynyO;2xz4&9WVKRh`N`Yek zo0<=DTy-2TS&;=nr8vkspGY~MDb^6$^6KEWo{mvW>Chi7?d0^Rl#%05*S4qP&HZU1sPp&fp_@7J?f38qizyk_(2#t!R|BG z0lw04s=6g7DA)s}4g1<+$GG)~SL)QrY2M@4Bw@Yaa4!G>tGh3Yo$x*_lj++NtHUl^J-O7aWDBSksY!j=Wh*j;Q z3nWKD6j3+HA`JQn2e;c_gK)y(=r8Q&hT$ljN+KAZxMMB|gZ4KD>d0|lfB*F9`^TR@ z=*)@x59|p8NM6@Pca?Abu5qbmK~x_d(}qNIk|4)EXeApr5YggqmpX zC)>Sd6+Uek@>je2wP##l;MxBNSx>l_(6PFirUHYhj-H4SXVcV2V@+ICJH|wl+vUo) zTx>|{cDkNV?dgZe`SNlS?Dpqzw@+>i**i5=K_*`tZ~k+eY)1f7}$EQO`7phn#31XyQsqCSUo|6QTyb!`%(V& zvXF1v|67k>78(X@)J;~zW5+HU)Em>ya-Zu?ZJM#|_d(dM-XsrDBk>i~(Y>Xu6RN;* zEP?r8aOYISqi{FLGYI+&hcvVuHxD1&uzHQVHQ#tUty@Jq$1PWVL(VI^#V?cPgRhO~9OEMC<@Pm-q3EIVW+7c$HJdfd-sv%*|GJ8$w8J=dcnh3Q~ zbzpiQbORyzH=f_`DY=5mhQY=B>3d!hmTrZNTM009!La3#s;JtA2UrweP3RYG8sbc~ zi)!TLmR(%gr`wpViG|uv$$y2;LKYK(c2TOb4jWPXvTlsD|%Er$ZdSf0@Z#0uOIWnlDJjbd0V#^C6>s`@TyF$Ocs1H z+Q)%nO~7OSum5`YANGRdST|r=fO}Y>lP$|NyIuTPy{zk}a&$O_0?JQXddA z>6Q9e!jWC&kf-F2Aeqjb`j!hdRtB$k_j9kqL$dBFPp&tM3PLjJ#^@sy8Ll4ox`Ak; z2(GFQt~8t~E06<26Cif#L>TG5qQ8-_S>71ux@~g}RK=f9tSljyp2zEFy~jwG0aT8? zhS#dtcoRkv6-`%lIC~vm(}fQD7YwKU@%vvNzA9pRb@#6Q*tY~#;a9czha`%I9rXTC zWqChT+;AH^iHJhw7ohWGCq%u9KY+|f2$FyN{`HFvu2B_>VA>GiforQgBp@LDbw@=A zSrU}K_cemrd)ngaT>>*a=`jf@>?C%m7kB0!2_%obB3vnjFYQ%5LHt!ee=yiP^qUO6 zM86hGh@)C_p`>MeI+IzvBjF$Yxwfo(g{X46_KgY<(2X{bEqdsOhcDGv`(0lna66Pa z>Sq{(9s=bAaz?+CpeStn5$Ak$bjxW@cOk|*FI=hKxT&JY1?1}gn%Mica#s!Pb3@}y zenK>Du+?^L-rghvU7KfpRD*HaVKEVaSqXhugASn@Q;7TS*XBy?bVVaYZr5+ONAeHK zWnAsfkB7nfZdZ>z8}O_Ej=|(6l=W^07wt6EH(~-T!z&n7i)VHo`&T=~blZ{I%t{>8_6+~EB&M2@t8 zjGU`{9cr`AWhjis0v*+Kg*YR(8Jd7q3GRDh7AYidmeBTAPh<;GZ&yxq4n(Tqa=)2K zTzhNG`0|cfK72B%X0kTXiKR(JP+K)K0IF+2aEP93rP9S$HN*!+iC1m=v7!o0^>~`} zZ*LwVrCC$Aa!AxQrFU^NL7`EI_EdjgTSD(6Wb)*E$KBNDM9mU9OD|x3^Nz?LJX~GD#t*xr#XWl=P|q`H76EJwfV_NliN> z5H&WmS~`WnbTkka_vClaL+fH!H*L~i9^>;iDTJ{H`izKom}l@p-_5&gCd5BKLY8`0?YbM@et^!xq5 zETk||15$Op!7Q@QZqV)$RQrSaXMJUDX2Fg@w(f0PAFxl> zJ)Zk<6ogoveEIk158uD(xEUzP-K$rvbj+T1_Zvp9yL)#}m`1664pd1~HhkVZ_GidB zzV^%a^5aK&HFVYHxLPJ(hNmpuJ||uO)?XUIOEhN;<}2;HUfqQYusz}~)Gz@p>L{3A zMUuWKg*zsfUV!tqI)R&pJ5YsH?+QW}NjM%~BtoEPQIl>Rvc$1s(pX&b&=Jq{QtX&_ zYJw{}K}*&+nq|wsS!PzZgnp+-lkUR*q&qcFX@7nzu{8NK@D=IZzd=az&v? zG12P~?^FrzxTeR);clWvThOS+71W6Q984$9=Vs{>>MVJEUQjC~Le=j;{Opn%0g+wXKFHvwFI_-Z(=*dftGd zWYQf^)#e$czD|ArjSjohxjvmayq_MY=TYP>>Gp@swH?)I>FSqOa$REm?j!StW(RfX z?^p5hmCX)>FC-;ISw%U&^DvJa(=YYaT6t;#8QE04)@Me4^lda)a`)&(DXi+nDfoD+ z{<*SCy|p=X#Q^ti&u6zs#$$R%6@tG?fbtuF;u)t#R-q8DYLc6?JgmZ zNB-Ym-hKY?|J4~a(G;0#kJfRg>Yv2P&e;f5`B+qoRZO0x=ELDRScWtGMwshktUy2Ic0-B=yukhfT5b?(!VzK zN^n;V;z3!t-PlZ6NsN+LpMz&UsRAv4antx<8ISP3WF7FO=W_#a5oZKw;DMf#y3nNA z^*r^Zzv@q*%avY*nw$yGA1~Vb)dc9`9KAN&u)<_ zF8zr?FZO^nO#i=>)kW|eDOaWpHIiVzW&rR z(sMa^n>JL*4hmoMQmOJ#y-#oA^T+QJPCtF(crmc#LQiv;ZVpaepsLOQ@h zS72PO=xTp9>W~C6sOs!Q`Up&q=@ zZ>a$mNL=Wqpe-F_8;CZg3CfrzTgMQ3_Xj?%zCAy97_AjD1PcZf_SouQVXC`h=lrZA%{yGv*s+MQz@%ecqQjvYITW7#k#)o6JfH{ zpRqk+h*_jk6DfDNGhQNM&2S_BF-m&bU52JvE+D(?f{qf5Oj+N1XGUqL?ZaIXO;V;$mfYV%= zTD(;EfuG1I;r_)pj!a(zl21Pi;5T~H*4n>VZSpXozXP(Ia4{hs(ZlkwW5ElX&i3F~ zd2!9fEu7C(kNdeXQ6B*4;&f|>$WhOjufL7zwcJejnIK0^Bzu}jx-_BREF3lr(O#IQ zzV)CI%%66<^!8j?kE$4T3L2}=@4kNe@NbUKce~9H&>4N8!%q4HtBFG#|Gjy0q-bg8Tmu0KKlMcKS3lY3k&4#e3Bf}MQ)G;fCp1{yHxda;FM`Dm6z!U zDM{t_f~sTpH-ofj@LZVidPa{#tO<96TRFG2)t08ZIuFf-MTIawbsoI%Or(0Wj*4^0 zW{{gJEv66LUlb#F$4lh$Ll?0ryj&YaFT}^qo{B|{lgry-5}F_?Z=XSq4l(t6sU-N| z@9vGX`26l?74LvAoIS?)pcpURp*ju3NAALhEt3DRQ6F533?_0YUL+N6EnJz?gpy+7*@Sa|hjd-vFl z0hiGWh$n0X5-(Nh>rGaeZtsi^;&KmJ0T)LC_F3o|==OfDr{__jZ|~c)jj)*H(+SmD zpZs3De{;v=G zdMJmk@z`s1J()UOD_=$r_X_~_=5HCr^wP$+5{ zac%os!w<6Sl?c5ja@zjNweCO{#^j_JGNCmCkJY_3*{}*(WJh}k_FYP_FPol6MR))u z0nWB=dp`aCspKGGaUqk8Z4APz=iq60A-#w`nH?L47NSwS9n6^XH{vZl6i#n@Wt~s` zHhNQSU$IVHup9MD*mzi_Ktd`5ocidqB$f8G?M~y)GsbQ6_U0i32r6*Ka7qv% zF@Wmf)9OcekjwSl-?#(uc2@_%mDF-Lib&{^gMNLB7UGr9Y|#1q^zoNpzl(3rp1b;+ znKYw1#HyWc4&o-}0w=Nxvh(Zq50=#l8>V{ITA||F)~^*mk(YCY225K&KX7U*8rzz; z+~L73jJvkpU0?ud@r0_@cAQs7LEjm(=55`$^wrI=Qo_^+mfBW%eXU?cydI&Re`e|u9{ ztGkt_Ky_wX`sf3&yAheHA{luV-jD)>)`e|d4YZOplqIZF8!o4A)61B11bVjvZD@9Z zjqhVT@)g`!vSM2ATMQ#H^N%C8;=?aDO+`pl@ zeePLZt5*Bm-}lvPk&BEE8h7DXJtRDdFyM7&7WJ(@^Qh~2m93s?N_e<%wr_n_ZRuHI zQ5`h+YO6m3LW1?hdjsF3M+Sz|{{Kwk1t6dTgvd;@*-GIt$TbN_yS*^F0{$Ik~U3)w{M52Tnd&rRx<+@jRnIf;kCCRvz_&XJR8 zh?T2!?kc?NiVX%-I_RYptOB1I@;Aui-#`BQ(-$4F@=O&xW?|N9LG2jovLkwY8*y0< zy`vj<4LF@8Ozzu&g<;S~^n|2$7}X9PnUDX!b`AMq*PK>fX}@cx6ZL(ROxV#)xC=e* z_u3QXb;S6-K^g1!ryrj_a*Z)xU$t&Xo@edSipNn)u_a)Z0UM^-2Oc_hnRLLHg{uSS1Tt|;84fy$?)cv>A~N1!RxJd*?wQ> zWVR~XMY3hNIFYvXdVR^LAe=bglh|L7lgGYD4Zc@5Rsm%|o@}j=UchGLiT%9@$V)@! zBgH8$jZ4sjNLz+D<#;mH_NGdy3!wjWD`oJ6k%TRl0*I6Cng7XlbY--adKm7l&Weeo zW%94D-+$w%KW#jCJm)|^sR>6FfFQF8Q+>^NWX?p7$9op$ZpYouM_%5(9XCgYQb5n# zhaBm5Fo_HFUxPz{7hXehyhq~`^mljj{fmKk9Wl-LU!$j{Yz13Kj7Za{)x+5O_Ghx) zU2og2d4-(Y)qTH#wK25~78w7N?f>zQ1E=nG$&0qbD>cB@t4#C>!{Kn36J!}s83tVU zh-^13E!nQ!>P@yQ{wG^Ty!7e)<#ut)K-!ZJ=>9TUd3wmdK7Rk}dlqM;WB;oUV+K0D z40O{$GF7+#>b>rC%K-k>K+N~d-Qlbv`XIl)eEFLLIvE7Lr`~QUhueNy&H^Eo0e^SD zxv7fS_N&zy=!TTH*GF3G$+nU5FPHzxw!Uv`+>WI;+xq3=9U`_hOU+V~@raj`ohXsx zb=xQZsu=|0sK0IlHikWJtJ-+07CWC&(;G<6fvf{E`>ZxHpHlB`gk#rl>p1LF#c{o{ zcD}9Gu`X|0Pa$lj2>?5n19tpW2rHjqPL|1Oy!zH1{jRYo=;JsI;!fqWX?>ZVBI^k% zd*(jJZI<>`r`(WIT$169d7X7KU?7Q!Im7da$*|$MW=sm;C*cHmduW&}Q6 zrI-!YAcu>hfU0&-MR-2mg<%nFxHKpvpP0se)!}(m(g~!kU340|5IREL!WQYo)My{h zo~SaM#;Uw-%j$M#_WVFMyl=sHilT6oysY|+M~X71fE?H21M_~W4X zhpD>%M0@`G$N!3R7bz4b%;z$hj_I5=@l3T~ek1LBRZ%7k@zH~SRHbiYJ)JPhMzhu~~SAEwu`s($O{&E4T_RyD&q=%H4pWR}aPGphjz50Z<_u4wh(FxhImZ+9i zNb_)wQYjA`y5JqaOrf;s#TYNr^+Y9DUHX|12e*5~@_a9%sBqT2t znUmS$fI%fuH>^eKUtb|AyMS9)5X8)HUw^#&`nQfQ%5WQo^-;h~VmDzIABj@Xhoc%y zs<$M?8LAPiS2syLszkMqJ;z-I(C9Jm&A5+lcF4hD-^ZEEw6|Nw0Zym3zo`=4s2UeasHrKxVN~Y~G{{+_+#_8GMiztrrs}MxTTdst zv#-ZPD#L53yo}Kw$P2%j7=B}VD{~JnOsC)2u;F+PG7q38nMhz9t7-fjn&|{`ha*cM zbd9oui*wjd=Q^)u-SlfZI1(0MIwciV1`NBA&OPlzV6}6jPVGYCoUkwgk^I)pXXWuf zRX6{bJvS<9O_>+UW*DfdlHZu_rWjG9eurB-6W1?S=UP}?e%ZOLk0Y53NW(KIcGNr= zhDsk>Klh&ZL!U1_gTi{v!d*4c4g=>ev_im*l${Mz?hyv{8M&W9&QV4nl_Bmwk9HN9 zl=q(1zB|T~%sK*y(b!r$GvQ=SP){fNUjuo?@v`L!PZt%eJ$MbVAgGU>E~qx_R~*#) zp3gYA{TdatBM*{KNb=S!F5GzL^lxe~D3kl7Nb=j$AMd_?`N*M~Iy-wuuPVStSwAZE z7+DGZVG|1iyrz6p`@hk*ZDJ<>rfwSRRhxN!Sq)8d+$XqUlFptIYHOV<7Z$WjR{+KAdTPkb;NWa%WbyI)LJt)MZvmyM2!w% zrJauSm#mq*3XJ2kG#jB}{R&EMsltDIQvncOUYNNCp>Y4oGNqBjgFK_D_n?r~Y7FS@ zV}EzPg)~et5jofnp2*tu2t;`uQ$NQSRTCz3mYdM|ZnE#|AdJ|XECc3Mpk%_D#X;DV z?1M5)us+v!FNa*8t^56Yu1_1ft66tNw~*Ig?S}614>PG9Kd3@CUuo640@@A7KZ{wW zCfRztkwT;UV%Bu#w|bET*?6f($i=qm)^zWmcY01OF`|WjeO0(1otH+>bXwCd#C@Z4 zk7^`E`PGC%1g>xPVeGt69n#!;&S0czO^0+sKmD`cE9Hcz_bVH238FR$GZEkHvNjK7 ziCgmPxcA~EpXroGgGd+grG`P@^|-s)s|}UidR$#@>|y!qxRP8_#{Bi`FJHfX`oR^t z`PEo@8}^s-GS@A5#mBYdZ4EX|EyZAJ&$pJ%nQ15@OImL0m{=lg-DpeJ`wKd4%5$88)j{<)l5{poMCHA?=_S4oOgy>OYUMRl7zupdbw&$f#=DfSKh5$ z+Gb*Ih?s^j$NN_i9ylWle;uTW9gl;Kk2^|*r^6FLVP6&WqQiNr{DV#-ZCAC9>54Ul z4<@obHr@8NQi^N_TWEl6cY8n@L$ZzvT)2!utajJk_O@9)>tMY? zn60Vlw=FkG3J<~_9Sj(}4ia*74(i>XD{!j>>y7QE=R9fBGxB)=8RboWjj7B!WLD{# z(LT&7toun%GWNh+-7KnC`pf{v{8zWLXVpp< zKHe`tNClC#Egp!hY`182+tO=EHph)WK%wVsWT;Bs{w~-zw2;XD81Tai3h-l>&kXFR{Q>yUt+sbZo;khtVA_l zHeR(Al#$r0e5+ZD`-_b*t!$)20eN&WGT}E4l9h)__=po7W)QdLrq3#a5V?a*0{r4N zzB<4#-)cB}5&JL0xu2ercFmMl2<~WYd&T5HRj(k<4yU8QVFg&BrDNoFs)sXE2z1hU z%g?cF$bj)y6M}?hi0i3}t09b&2x$dA2N`+EzU8H=-d4jJ6EynYGscjtx=XD$bjR(cIjvrJf491+u?SFvWfuZT{8sWl zL0>?i39LH&Qa6;GRZii~^H^7%^snwf%OQK|kGzkxz6A?{4{hzK2x82PJ0_C5sII*YSF2IO0#!M50B!>li>wSddaZ2#+>JYr zjP}x=-09HUaP!%yJ8wKLPw9`;C--5ReONvn^SJe}eH*-a%uN4=s9xuY_Xwn9Cd zK`u7D=blfc(8seH&8h?X6Hj^i6_90xqRsu0{ZA}Bv%GFk>w$H_XQqO?5A~lTvAvW4 zz3RASB;@0lUq5~M`0-ovkybC2P9G$3VNd`LBQ4SX;5nD*H@!!WKbq-;jXn2=2J>SQ zCg&o{N(hVfJ~C}sZ{P1cU*#iHU=%b~x8?wo1A8l}9fXPI?8x}>^T+o;zI}SHQ|@r? z>2W4#Xnck>O~l>{zxs_gZs^s3RXp|meWaJE@371;PT1Z&S-J02n0ko{slNjGB|Yq; z2(9$QWzXN*9+ja5o52s%VZL8@xMQdq;vN^ZOjY|y(}(PbRSyXZ4n3v^UxBN{ZjbqU zLR{M>SYKo8t(q{)f+$7vtduBFG3)M9R=fLT+@-tsv*2DxCf)7YZU`tX9^&VN zhX-|d9>v`O(%n#wH{)U{dN}QUnK`9`eXFFaMRsVo-EEDnu@HD5vvv#)xn)jDJI?d&dgyJ5Tm%5$ngSCA<{%j%!!{!k5xO`^oj@;xFsLp zl=KhZK0f`SjMzz<;i!auIMa78u2!Pzf*{MqL>^d9SX2{HRn$F9B47q(%nV8A9(?Jg zcO0zUbu4F)d+IT%*Nr2JY)AL3k2+?icUYK`t0w++1g~Bl1XDIQatIp1ru#_b~*Gfx5y-Utoifh`kYe;nU<62+s7 zRSe08XyIlLq6^;aM?kl>K`NWjw?$|Au$^cvAIh*h|On`rGx=ZWM2<*Jh&zkLFY#9 z*xy=C?638;z6EiZ_Whdnbl30deIvg^W79DNu(G0-_6dbbrHg4EUEf?oGWB(5v1#1v z>$}cHrei0Jq-#`<(l609QrQ}bq^^FY?(XWBH3f*fh+$!OO+GyR`_qT-aWn%k-vQ(~ z(4Nkt@=(pXtY>{?9U^*KNT6KfEd7C}&6f($!Qcg08aw0;$_-b{)M<2k~6TM z4hMEOG0Mf@vcMDmg$JhFULgu7+QLXB+TQ5B6{u+{hv$6QTzIyznHo$RGJxD(H@B-) zUU0v;WhRW~36E-uo>%hk+FdtnG|`^#2*bIEnwWgqdBliji#at0k=igXW|YGuMm24N zQERrb3j=uQd2Wci2mL8?y{GE|!_e=gMg9KqhpzO}Vf0}mR5~Z$arXXP(=cs&uHWt+ zv;2obPW&K8TU%|X4zt#KFa$UT$Ct~Q8AGiHE+j8nx^C7e$`6)clGs_tme;?L-yGV^eoA+P8ef{#pF&YpapYAq522+!KHB7|s zIWdgYj;zC%OkqPKn@)fr?uA}d*s?H@(bV@}zx??2^|Mb5j5I-1JqRxBHsU~2Lmb~G z((FxWt_Y7~yhnse2twg7wvLtKiuP2jWSs(aI5Dpt93uN-OXeD9R7bxb4+qDr!0vE0 z=o1HDq|MZNS2wv#k!B&o$V=4VI~$n?&8zl<@7nkNG>rT^8Eu5J9bM(Lb)G4U|&l{?6&voU5ZM( zTkX#)rP8*$wnt@RDHwO9)!>yz#I73@?S|zZ8ORO_eC*qt60)aN;bRhLV#E->hsLn*&iS%;()(xILU((gyq!0;Je9Wa{KOPtgjMCFw9S} zg10y9ZgF4lYyAN`8Xh6NE7$_xB++x61<4Fj%9jsPJqU5oKi{jl@tF_vOti&=kgqnq zV+Ip5r@@5&ZI+5EOYymVySwo#x)>FK;Nhf?{_W|HKe5fiG22Z-Y*1aOimmlU6|+nEHYi+Ubo9HlVPxK@yQEKpqJ&S>DDpUxAwwZS8_sUz>rL zq|XZXGO*akM2%~Z?vBJRCViK^*JbC~0?N2H%#{4hb z9y^k?B=b=UjflQ{wwOpZo$)K^<{crlk$}q~uWG`|nx6B%AdXDjP^eHUx_29xIO z6WA-RO{~w<%(GX`_^{`}$Vuit$_e2Nf3G! z8mO4ww-1s*j(%dG=e=R*V--N$p8IDcYQs|9cjumw5Apu3H{&SqqnH^A$^n(_MoVljNTgObDz(<6=~n%DU#r^^}I8_70G0j`ya$MMee;Kp`} zJMa*BZ^TL;5P9)kkmTLhuQbJc9+wA&$E|8N!P)^iM#fSz+HLh_q?5Jd{;hW;;t6)l zX-0ZP=jB}9_wk5YFI3IV$kZU9xt9iagoqHipQzuKazx6M!1s=?VtrwK(V3|*NPZBeh3>b%a#Ye7+=F9gPp=*W2n~x&nSkA}JW_7`)?=Bo z*?ZC)cvNoCT1=pP%0UuJG(^JGTilBF$C_)4%Gp3bBP8T3`-fzV+Rw@6sf7biQu7`d)E? z`8$P?*nankoilaFdRY}vWs?!hInFNIF|ZA&41USld-6hilojEf^~EAJ7~?k`}C^{(vQD=>`kj7 z^&@n#lT*V?l=0eAJO|eGC+{}jHt8n+I<98_)%^U|$KR4>u%5Tar@K;Xv!~t}JcW3JIUxpbKum)-uJyXreM<*w(;V-wcZnB|{8wOJ zRVpY=eRmT^c&6T}S!dX=j#Cl;?&-gN5N|bgo(K3EFCcHMw-m6^!0OytUDxChSc&b*Cs&Yp21+0}`j9>3ugSu0K3|mokMg?CmKk zXhI#ZN5zHgMgud}R7XzCr<%Cp#s;Lw4E{#tPy5%ux{0VoXHaA?E$ocz!tb73W!v$LZUSkUWeG_vBYE($OiRJZ%XNaF zjMePJRj+R%I|e`Mu#{<#D}l-iA*QeN%&lhsZ>)JkR&TGZ(VHZT@CQnMgqwKZlpUeS ztGVLolI8Uq=h+i6Vf80t-ykym4%^(AtO!vC1c()Vm?~U@MTeQU--h8(WL4lWL201# zbt1Eb4T_|%D;(#e9cLu9GTqAr)}4xuKKzYjV>VDNsmRDWjCsL#LP2*4F?vGuuUO2+GeFmA#~vse<4qcV*q))A81Dk6O9?`IJFM zHXJs3b3L&kmO4W>qZeCZhu)_7gNf#GKIej@e>ii1Z1PPlQYWNz}4_65ZDP zLDc)kmWMpm z{H2*tN>LDUlP95*>rAFIdN(1VaABe1DHx{G<77J|p1+QZ1vAyhiqXT3Da7@`(?SyZ zj3mH;mJvh z>aX`}Z~P{#xy>DCwl2b!EDEFB5^(S z^$QW(@95H6E_}wDf+tj#jrW;-nnszQK0kf`U6~n+ct?Yi!TZ_Om_a@gK>ERz@9Q0k zA=r2KP`#={{7c)ACjk*-49sT zNFDA21aWigy`PatqZAb$&uc)9hqIdTC;?5c&uZE!U_o(Nd8y3c{~|GGzQ$V2>YzBS zYpjXZ{znl9a2aD4(3-33@Kc{%Pmj;4vd9&(rz$I}d@eVsi)E2kb3L42imptae5>A_ zWqB@NmbWd7v$n}{yq?R`zc0yhSls6K*)>@%=kux(WHX#hj-=9Z5!+O$!060k&aMOk z1;now6)GTN`rhRt&-f+Fxtj$`CJij-h0?oFJ&-JCGyMsQMTN_q)fPQ!mPX0 z3X-EQ&@Tz6T;dS6vRv>J!Sh@-;zH6~PKJ}}FpK{pJejucW)@k_^Vw2zM_1AXUo2Nn zp+8`j&1RKyaWY@j_4c+A+R6b?WqhodLNl>B4qe7Gh_Z^#{}h#<^99cYENqKuPR%`E z@4H7|NRV70kp5@^BFf0F&S7nGtcKmG3TOg5zJ-^Uqvt~ z{t1)=t7TvbsIfUO6$t%AW*n7sej&cfW26}%W5>i*s`OU-m|p#+lyBb>@$ zaumh$T**FH)|DfDZjN%R6WLr@cdk%mx&8#{EK@Bt#}4>BoiFqWxZ?Pc`k~os^E7`;W`tNy#xI%8ZBqFt!h^HN5k_ogI=3L< zlz&-AAYkPysDBqwUm{1IS85YuE_0?VD@PfAMp>Pes*qi5v2`~qRa#~$ipi{~T2;HV zf@cer$XTwBoaHn92_)f^dLpU*5@kf)mEoP@omXNXYL=xgL)Ar9_dKb{NfpA&1-+u| zRL;KDLJ3(ZIpru4Rcv)xA1`OF7YTTBri7|yrIJpdq9aFMu_aLCD&?dpdsS?7B&U#5 zNlpXH#Chu=P*h9q6}~ac3~6{n*hY+kH zR*wHebbq0Esd7xO3Y6Pa6U=d_66CQW5=Sr3@i^B*InU+@kBT|lRbI*)hV?6|h>Dz9 zQ36$zmN;fyP1$5oGFlI2_NnBfRQYf9Gy#vtCSB*rKy)#!cEHW z ze*y(&rjJv8FUd)zf^RMC{9+e@i8Wl5mR znXZ-uKv!@o>SKsP2=H8<^Aq8dN+L(`Ag3t#iKvDubCtz1C#rH4LOn~~D04oGsM14u zPErDLh#2KENj=>_@|TpuQVGm2Dbv&bc98;8rhG;!DO6H{lqpHQFv?MJP>p0d1^<8 zl8X9F=?d@?rVzL;%cK!O^o0e&p#XGEDTo78d?;pkHpzjJq5?ifiGouYR459n=7OSJ6pIo^cPfbd64I!uf^fQk>EE-#jXyB=HT_fq z^-H*<{15mvx=2!B*;%qv-y#XXFPR)PH=x4Fc|KPm$cZ2f2goV;K?;75l%GhBBUy`! zxex(47Zq^M^BLca8o-XZ1=*!gb}8n7{scr&M&xFaWD4=w2JQ;BPAv^YBg$%;`nujW zosn-mCiTo0Qtx*%k$=wQCd6@;E=WzmbQ)6ORXShJ4f8y}ch6^WEu$t45_eZVtmbhL zHzV>5_Mw_WU{XxPpGRI~TBIM6pjOF-Jl;_}9xSGhGx3>h88E91k0-D_QKT0Z?{!2wlznxc zNRt2GU)yVvH|I2O1mh8i=3|l*XF2hilR&xRNtra~19BC&Dkq64x3-z^o&Fx@FX{~@ynsU}j*ALO4ig-D8aX~+#OTOtd; zAzkn@(S>Xx_R7UfFpCFg(>tBgzFsZ;VCnBk5vf4jR6g!5r_VI;jm5Gu_~F7|?eYf1 zGnr#Pji^gA7edJN`6k6gs>OrMA4J|SR5z%`)MIMDEjYn_YIDg^zVEntQ%&s-!29Po(mhDVAs1RNiKfY#-#GOX){QVJ{x<%EQzAaYz0L zn@H)ec|`7`{HTR2hr(&VW<^fTnpbAhK&>9iTj{f8(8|eMK1lW;=|n1D%HmcRGWv#S z3gSfaSC6EvRK6C5$Azh&RjEsZz}F*bE0?di$>TQqnSd!MlX^E10-stM0KPtp`_VXn zkXu2@2jNq!;{kEK3{T3({Zq}Omd$bz5J%JZr@7C%+O90os)RKhV&~omUhff}{*1B`oT znuv1HyaD^9dP_f(h!3?|<^dt5N^eXjprV%>52qpi%9Pf%1dsy#*qgrk{R^n__rk>z@L;cT93#TRh5iF*UG6Xy6(4GRlmu0PbjAiOX1z#__KVcF|rYaM`Zn(;G<7%ieS0=~O? z_+Lf=Dv0_Bfy-kNQD1~AScEEAI0+oSJl>X1M-NXXS*a#ae1>(#BC69O%53qdObd4u zn?kK;+;^AEo>?#&kbl7~Y-4-nxF;(Mq3m50Kay8*}(DLuzPWJD7RTK*8Wxl|S3 zNZ$)E1;QngcUZRPk*K*7k@t{n^VviylQM2BXVZ~=p$8P0g7+w2xf^Rh++D=oMP%Uo zp#|k>#8{d?E;u#w5WVcNo2UMUDK9gp@27zBWQ|kpWPT8Nml5=gYLIScIowv{RF7Ga zl^Ic)@v>aLhl-hHcJMpPJNu-qW zmeTQvkfe{ysiqLAWb?b7pcad$&hvo6KvY=G6Sg!_(f%8C6j;7#9JWtwRoH}xJuNcYx!z|}sXhV(JOWqgf z@|tA-e%3$1c(0kTpZz$GH)g?R-|v@ee-PeSRwih7a>F7-_I;WNnoV09XWwcsI~206 zEy@1(3pNQDJ$(Fp;EjBnsd)B-w{?eX+~D$m|1_7ivYpWLrUJI&YqueZcr= z_I~<`X_+O&iwz;M;>%~oXJzY5=tRg%?tUDRb=)ie3Jyl%XGQ?|6Jf`nYGYzQdVA;FQ= zOx2OT45+B20~_q3YDqUY_)_UHk02>pH`J4Sf*4XCp}ZOVd=d8+;f)lO0KYz8`Usii zP)Vc(_%t&gfbb`acSwE%h)BSF?2rfWvIWZe(j;3LBnKE?^%Mq3o*Vq0g{ppo2VhMq zLp(J1#aY}_(cKqh0>7_v$Js;z=R45t&aRn(7!4dX|8ABdSHVoLbxy@oiOHul!*s zhb~xC!)zk62Pr2~J?L5_h94ALO4i4r%fDs8C*lR1Q`i zfl}%lB4qjF!Tb^EY#vbhdh~H+kIv;F@y?WAl2Oc-K6}xF=ef(~+EK=j@%J35ueH9{yf5y$GHej9-o`XqxmB`GAHVzsCv(4Ccfe5RWpVa3<)y_sIver zXMWergVzB0ZZ-}41R>`>I=X}WbH?wYjhFeU)Q7YSfXW`kz}!TNi6Hi7sbgg}^{{2L zsR<~;L>OQ;L1u{PjDGQn%=|{T5)3oLJPWX=(Pti{vVXIXA+tvYm_?g7PTQLF_{n{#AavhXDP2@pvM}qbA}@c?8Vm zB09nSVk^#oPg||2+-%FDXFPlKjA!L7KdLpx^j0~pR7-RUH9Pr17R~@A)1T)i%1JfI zs0Qdi5x$=JIC7L0Wf6a3Bsg&(;wws3>zgHs=Zd1Q+W_POL0ruq z4`z=CEw0N*xH2l&(&@LHh{HGy@CHEwlpg5?{Cw*4EvFI2Af!)|~>I&*zlFd|r`r1iUPt#nc#grK+Z-w&iMNv5>2%Gm}k@RSu>P<3;iI z+CCfIAkK^D=jVx?`xC&9(}GQOcjU!-djR^EpY^4Ku^>~>j15q`{~#}_$(Qncz28iJ z+CUZ#5yr4gKy{Am)zA9v1#r zvsj)-lH|qQM}?}4OMS<#U#vx8*FWmyNxtS@F_?LJAuf$Gv8E_ z?eeT}kU~P_o{$ezanceYSH`LhA$RDhp9jQ|z02ZB>*KlmZL@ruFPBAcJ5VhGd{Y`( z|1o$H#97beamhD_2M_f-5A|D6`SfCXk7wm%`JLzX-eRso}|XCd(g3%kgD-oPwaYYmwNzI}-)TtOV*X;yzTCc2lMbPkH_)|K>qj!kAWo-K?Y(k?cCk04+`}vMgFHqkCe&B0R`Zw zPbHQrgRkWULMrvREiZ_Zna}Z^Y2=*L3q=j7VIC(5e$1bIG}1_z(lGO#F0FJ2*)vo+ zANva#Sn?xN*)pkSLHxQbymTWVedv*C$RNgxeAA>rrVl|AgtteNAdQ}ybQ&m}NIDUF z<`v4c{ ziTraWg=BFY@+5uqwoW8}kaQvyZ*VisPzLyF>M_IgG2b?Q%(qRKo+gtnr&LLo({SxX z<`3dabAN-?`gA!deIhe|$25m2NaZutxB8W1mv0-DBLT0d@h zaf>?rm@C^$O(;70vEUwMs+AJPWzDc9=(>G-c-;{+1bjYQPsl}E)Ch1PZcck&c)Zub3 zoFT5o>r+3HF6R^E0hxhxi5a@f2U$D_PrGA%`5-eB*8}OJD>YqA(i{?Z%$7ci8BXcK zE%Y?z>H-d(J5mh}2(y?B_Mn_TIAw7yFrUDoMgFFXsokDNZ>b@U;ybf=B#V2a?=)Sc zkEom!0{1T|+uBjY%-t1Ym>KY8KJ|YD;gh1r)ZpuktOK(+8F_kc)hvxEy9Rp^BOmG9 zePqCVf-)dCL}8pyQQ#jh96wjyejdUJm zbRG#ipDI=n)&!?9eHfU{1AJ5Ffl5!Glzu`7uz+=aCN51g4}k&1?QGKMgYeC>siR~f zk9%gmgDLRvk-M2pZ+1(X4~!S!4E znBhASKhI1EVB!1oxId5YMU6&~r!%i$NoUifhzOa*Lxl&Gm28EORd51J zfhy!^^+>7clQhW|b|Y@9Ns*pN^&s|wJ`sSAtgQ3`akoor6{Ypji5e-1RwKjUvbT-MEle z>>4-hIH(>ocKw*f7ipMwS;hS?q zl}5TvQ>Y*jaanknJx*tjH%(&H0c2IOmHD*H9n)pz%AoX2Hh^H3k9xG6hPKku4QfMW zApHfrp?u_r(konm`8>crN5AJpvWYkdQ^RK>+!Mkas0<6ckypw|!42Z)9;y`ESNMVz zrh=^_W|nmQjvMx0Qf+dF2Mxu|$fwEUdZCp+*^|YLZMuIru+z*$Qj}$MXqNXQxW{9g(F@5x`2I2XF zG-p0B1|O2hcq}wei-Ku#DV9FyJK}x#SY)od3U?23J!38kpymS*S0`P%cnJUEp;Q+h z_ylH)fO&xZ${u%5ibF9ClBGq|1w~|=!oBD~#9c8pgMuK^3r|K*i-!a$9#wmRRtnIg z1lp5)x*DX8Q_3B(Ps}*JczxX z)Usk4E=wQ%vT5|o8vJPS_@cshtKW@t$VkLl!S*X?Thq z0XZDO2~Fxd%uLsbTW>p=9S#dE}wd<zUXdCZFj<7 zG|hxWnv&by#TLF*kJn5I{g~g(R8xQHL%K)*oBeQ^V-B+eQg}C>^wAra=2O#mBI!hs zfO#kaOlPhF$^gB{V#+aYDePocJBN`>51XbgVi{}bXtL2J@-d5>>2e^SGgU05Gpsc5 zVUG#RK`1QQL+oenKn3E)soj)48pW9xqym1$qp&_!ZKsb_+Y`wqLgZy$CjM9QK#$FynR^@#gvRgt@U zGAYaHg{=*f)Eack73Msr%y;%&*&J{nqB|>{5@AxNr<7pYaR?+&J!YC5jJQs*l4OXZ zl)M5|Np!aSO#XZNm%P2bVWl8OF%Eh1-;fyQ;2b6-8L;30n^FSeSTLE+db_>d+I59j&i?RwDt<8^$l1tUhA-^RVI9A;w8x!dl~jVJ~l-*)}$(ELo^wwuj%v)d+b z-qH0kVV3;2QHM;}Ef*q~!q$hq4eRw?_pJ}Bq5WtkLSmOwC4R;J5!74NC6(%aXsJ*^?%@Klhj9e!H+6m+-u^ z8Ns{gam`QUfMw?Ut!?Y%em!rt&#QZT-N5^opZX{hx!q}}Yu6#UkNTgmMf2fyFnT}G z`*`hF3h;frY}lpd?rnJl2OGn?k6o<{3d{i84Zr_Bn~nMI?eyQteS5pD?ptBI-E42k zeK=w_^u9W-hLtDM-dF9>ma^H96zDJf0~Kla?pU9jVxMSk7P5#CbZ_m-LDCDowW8@+qVBo82wzw0tn=7|8I@#38f4yP;^EFFe z?{9B+ImzqmT~zQoTVgxu^>sh)h5x1KJoL%yb#wGaHn02oNIL)5FW*>;^19mB&!bNF zC#-ari!V3qDJono_g>aJ zzwt#muiXF`#d|s1{Tcs7F7@kM@}dkmo`79{PhLj;3(i+>F7qGndac8bpUJ6aTQe9R z11guZ*O#~Yh4e~}myxZf05-83x%EF-!oTX2An_@@*{{5xFT`6J|7Y~m`xZ-j# zz6@{mxsyzN8LqJj$qRPFn?2jXybR+-@%1t=onDzIh-&nSlqNQh{W5qH*rf>;J^vGH z1zy;i^om!y(ebCFel zzYw#7=Ccr#p&y&)`I|7SB?yoc8dq&A-S>^}Fx7D0RNRqC=k z*2@N~*SFI|NNbUmve=8aTkAk?;wf@r<8J_Skipp1+T=hqDO&#X@%xY8p8oJT46;Hl z0laq_j8531&>03scI)?hZ*lyeUa5HKNw3WY=NGJ>J2oMM?|7D1cy!zKmyKRy`{Ri>Q=ry-!JhA-4|GzoTm$>n z|FO_nD_Lud(#zEaA{mRtFTjCVWA~dK;0#e%HtByb z)GB!T{Q2qqN6xcDI6m$Au$;?&H$1Q=G;4NUd8sk-{!%MX$zg}Bm-2EgY zC$u}8>xu0ycHtdGXOw>qz_U7w=1j|MKfI2)5r`rZp#vexr zTS4_f91vCa-iCyYt@~qtd*8b=`@iCLRMfah;&YR_q!9kzec8 z?WotRp4r?dgRGvLH{rQ$p0D@wR&?J;dwE{%E`zEK;bGr&ipbUG`9eJ`a_$FX^M;ZN zx!be;wri5-{_VED>2!a&&)ZAgtMMkzeqRZDa&N}-(Zoefgl|+)sWD6c%--8R##Z_> z+bl@T`2L3dC!X2tRvMacz@{?9JGwv1|5ge}$2}??XC>zbDk+;omC(%K?HSPSSOjp0^PjJ*9FyizjX@x23U2kN<%fIWxXFsi8RZ24m+rr;2Y*QeJU4exeR@gwvfg5(__W+xg-cD@OE#QCh*J(f2-RF17?Rc!Q zsQ%ZN-@knQ&ler<5O=rZaFN&slnDesZ^>Ur>KaAX_n(}yt{`n7n0Ko&U7tq@#M`lD z7uDo;*w;6Oe0zUgZMNM?Y`1L{IH{BEdAm+-y>jO=Kh&ByvYTd|cw`Pxol5VJn zlys8Xx19gU_3j$}dRKZ?g7sNJy-M-8vgN3VD$GkDn<$GMy>pJpo;7#AXHAj6zOa$f z+2{rYWGA;~6GVVge|_eEa=lTz0~FRUE0HCP>lUJ z-`KuVU&em-ee&bmU+;ha_)UjW%?5?!$G5Lv|BMq`l(`>94p+AF%`OL0_}GYUxZdZG z!|-arVG|0VZ&hG^u=nX*(4!Mem6W=Fjh(4bqZ{ALR=!zg!j>*URPe8+m({>K>!VZw zpu^xb3|Z=@2Jhi1vRVynf=X}>N?)`7}Yl(fp&8bkXnXWb?=<4r^gH1d&o=g zF$WGi!1czDuiw6X{LbNlBpBI)Pc9p+0dh|Gh0muGnd8TJTHlWNcVf$Lu=V@LtKUDe zhn`@+b1=p|Yi^~(-mM)%9GK%ZQg}RE{Pcl`NIkzw?Y=VT{V1>O zGwQEVWR6)NxqI}c0f3wxAF=C?Y6*#WJCy6#>kn{FV~_F{U|)jk*w}hM=(_zn?GyUr zn9moNL-J!+VC+gY&oy>Ly0UL+23*(_SV*!D*P)dJgw$%h zs{E(;TbQi+{+atR&d;p}1$jN1@UA`E*9fe9T?cHe3y?U5nnzT?+uQL9v$_(PXA{Ym z50XwKHIXJc?C-&r0rN7DR0PZE81U*}z#&+viH*onN#jsWNy%761%~IZLxa8ZADh=K zD;7da$tJl5nLSAPAkG{Q3RB*Y82jAM8#nexP;->q}873}1f#>p%6MIwPe; znKC1&-o5V1mZeu(w%1MnLay8Nx&xWO%3(IIfeeQWk4RmAcCh*ryIO*^U)~=^vZ|0g zw&~r1yvA;%foFT|ZRUkLwTA_3n$3RI+WTOMtk~s1*m(n65pVFN59{CcykfPz9bZn@ zx64*O^!LL}!RcSGY!f1MfdQxo`e(n5{VvrW`Ju<1MyNhg7{Hnt$s+BjP_vMm>hQidz@Q1ZRW`~FBV?qdh>A7FwyuhKgN zSswc!x+=By+SluwVxhZT?@~>##-G_l1gf>=d!wkr!`dByKkAp`Jy$`iZ_1$L(E4^n zgsY)epH7Ozn$1M7s1eO=4Iye`Ej>_QZzkxJSGIU}gnO@dpg)JbRybP;OW?jy%?a;3 za8_g+ho87oD^<9EJbnB1;}4G6bmce^zxT-QKG!-nFaPoM|iboGv+caS~L zet26D9qos!U%gZFf54YP+Pt7;n{B~JMA!6$a2Nfr33d!V9;!uhu|b1ec%t{?azCo= zBWW)pJ=_qM1?FXX)S=XZQB~>X-l2~J{asH_T|<`_cKo=!xUmlOxQ8q0_g$nJqz`|W zu5;yH!A+Hrk57FaXGT9GvL8-ChMwLJ=t=3J_BFfbdby%AymE_xp>D6|z1pH~MeXbe{K0Rk6- z%gq(a1)C7qKrp#orZe<~1v^M7Thv#;-eefh4u zbGaSY`|wy9Mb2uE;3fR*Eh+H`sqb-ueVqd9Ll9iHXA%^=fqlj^BUKk$QDq#`!z5VK z=WHPFTyDMo1no{4>$?=b?+J!5EU%d$*z?NTZ!Q<`qz6XgjScSMqHREN{ zy+~PdTduoCC%tr%`t41Tay<;*yiJ51svxRsPST9LmHj>W{^Qe^U%x&59mfP?)BCob zESN){+2|RRVlf0k;04Jh(grjEsR4&Bq>Hy`0ZtdYJD)qTCyPS+{l~{Ye|!4!iF5ni z#<%qQCSF>f500$9-d{Har&YAQCf>&AVsJuU*_GLyeb7z)vNNHd^Fjf>dgH5oXC~d} zZjzEVsLp3!IMUV^vS~KWw9`l-6j7svL36e$J33f(Gwcs;*j`j~)%qM%IDv{&ufl$= z>3&xD&Us4Flz4s4 zyWju(^!rDSBuLnQP;_%Yz5>IsB_>Wi8@`^C@29@+9AY7zRwC^+zO;`mgdwyizk~H& z$?)gL_n)3Vb0Os7sXpsYT{zX#=L;>@Pu^D+?BcNPsmV-SA)HvT-04fl`=wSxSmbsk zTLDU3l@U0}B{jifPtBk;pFCPjgCiDHz6)6-)hJtATt)*#aKky?*8z>8_mzPyLxp{b zP#O_Kvqccxo{cIm<6iACiq5!K17$Q$uwp5eh_^fQspIexWVqVx_!MG*z3$}DQzLLW zP^)E+w;M|MNN>K}0r8?#-?P`Ph+2ZF?mdn#Y=8(#%@B~=kE-_W_bvQ>%<}A@8xOCq6{Dz^!|m!S;6TGqhiYe`J4rWD zLXkWYTSrOV?|*#ytTw(fuH=X$qQnn!%r)zQ&AA@LLgG+2Y>9l?-`H(TI9@M{fDC9x zs*8Q>!>bQ>gsO7h9mnfz_7C+(N~~M1BHn$gYK3c@Xm?8BebZi4(D(IA&l^!Jh>Cq3 zqq30WjS|VGyspmJOzYaulJEOk0-ZW_&tj_Nvb&#cTno8&-ajRWJ1mtjv2L`1u}2M~h}kL#NUX@&=R+)m`0IBEy_^%+YFKiJt@;LZjiog(Nn;m`NLPhn}pp5?8rysw4eEQ(S4GJKrykHWll}Mx~ zH*@H!kzuVHZE~1%v5*lN#!?2=Stiavn_(AEG|EX5Kv=iBY>>tQ^7!ND&wuMfdN$D3 zxqUYtGm{3@)|gHw@L0`QD~KBjy*HpC&J}(>PwkBkP?XEd`W#-VJ|3tuAa>dR**G`! z5}U#kGF9|ng;P>-Q#pOzNj=zY(AgJ zY{EQykkrKSST{uLdhkvpmzC7;3pu}ky`S|nAqoX*n;2aXgw5?b5mhA<>HI|O^C05R z1L1C<&kW`UjxdvUSV^422v`_-QN%H`r-}mQnZD6ZQ!ggM(=qBI6G5P-S z+pnKEDS2yHvpuB=ZsYupSUB7+CWvd=!~-urN+t}?@{3N8UwEZeLE)Y#mrEber5_}8 zC0F|X&P$@(KK_rsM=Z4qi8xqG@SMbI0*t9qv}e<%N3BQzd0oI@^_VSVk!7bFV4 z5LK$LTS_Rz`{!P|3(m@a$zvbK_2jnHFsK59GeQLhp>;ZET6x7yoKoQ(ZKYs<-mR7i-v34}^W1HLl`j$bCH})7e zq0!K84ns$~s@?2+gn&2b8;(J&wy24H-S)vc-hC(fyz%y!oU*U{ID!XscdtddX24We+f|b1C@>G z;gZ0gLp(DFR9-vVSfwg}3l7J}UghFs#sAxF->W#DZ`7B96@ACZg!A3IZJueubD>eQ zHF?+;5K6`fr2U@9d)rq_;fwwR&nO0r#&sF6-Y`kSgw8=mhHw~>QN!tuLp{a4G{JWu zmL3Iz8!00FQBRmC!Gow-_idEe@r|TEuxG#`h`^&K=h3?5d9=DJSTUDLDZEuxaJZZC z@NvMY_uX*ZV3vZaTk&%q4>#s%2nP&texpm8p^GyEXM@2uM9w4n1MYY<^yiYZswdWZ zik|-fo$J_PSP(Bz%d$zneSQD?-#(y=9h6|pCz4IX-vEq2bHCBWCKV)Hy) zb~s8t57X#_2RcdVg`sUe#!bhXN2NaSli1b)o5LpGJVJ=V=#K)WDnq1YbwL*LU~^-F z*?FS|D?2EkH~m$L^ta!dx7Q!P{ww*mk{;0971q^p)3pZlw~VWz6qi?5Iq#!tb%1ytQIX#Z_uJ|&eO^v1h!YEUHr z_HJdJ`;#gQV8l7Z2#i=yi4xRTRZi#r_{Q}k^EG1_>@2ONC73iDtcr-%?3HVBBGRSM zP=fl6OO)E(dzaIGt-4(9aabE_9}RS?S&8}f@z+mZo;bHw^Y9zc^Wkf{DbD@sw(jvo z&2&eDDsQz|M0&rwKl^IuQLZ4JPh7}%g7H;4>Nk_jCp^blqcm#+ zZ|e^6)PYayXg1n6njV5RBgK#oQPX$rSO=m+3!8D=f!OsDAi@DBbe9=aQFQ)-b|2!j zZ+FfS%;!Nmh6aw)OHsB#}S9`}qF-Q=E{iDlp=w#*FQ`JGJDydAzfS|}xz_Z=9o5ikW=(A+KtswX$19P~r| zHWHw|67lqoNY5Y4T96ZNN+t$-{(7_*`)?Y%nRZ@OVlbC%Od5(eo)inXZ*{OhdaId^fLB?WX(^N z!M8T~>5kv9;UxK>*!|z;na|;1-dknNOfEvHudR7%_p~)qt*w#*CtguVL%z6{PO2t-@kwQ_?=_al+*33YE+uU$@8)V zCwIvSPj`=Qn-u{B`b57O{pX%O0^yhZ$)v1}pFGn0bYgx$XGrmVe_Bz;iFo?KNqVfD z&0d<$iT>o%RZUGQ_S5CwZbrJ}PM2JN$?5#oA9~#;^>L4yB=UUg4TB2FM111f(`$Z0 zRm451;;tUV4<1gwu#?uutj-e?jpE8`pr0MW#_lG`pHjkZ?e$Zar@wHfy-OquB_a-f zuT%PT_5^4_J7DSkbnf4DhGjyK=M?ws#%Gjpm_xH?GBhBqO7{;;1!P9GXI0Co z9l^teZUZ5WpwqY>`H6Iw1MYAG6oY?$`O|wPC?aCkl?Y$Aza3neLoRmtS|JmHgqu~@ z9=rahX#dJw0AYP$B9sPq98R&1<7?8|pQke5awXh0fFF zMpu=_d@Z+l>YU>82m? zR-`_+cjVHBi5rJ`@@EiTS{;$I4X*?26W z)lak}5X?dxM`o>-nX-wu(#Aa7Buj$l0uXfktHaXRA zZ#x=fEKcDQ>U%q?OxG{R%Z5@SoqJEVu5Wv~vW-YvAyQIm3+Y{7FDSMr`YAn3XC{R| z`O_qhaqU-3Bsh8L3Ds@PE{1IW?@D^lcL{*z8B@4dHM#B&X%=U%T6?n0-i2>G^2wkL5#Z zJdgLy{8kE7N|YzYS3YC(6l%Q)q83$`d}ZYmdMRf*I&Wa@hO#!^u0&}Mp{dkCXf#3;>1$tOAc z(3B3Eh0B}64<1b+{bgGN z>l*a~5>NJPH`#(L{vp*w<`cooZcWdLu-QwCAGiEZ#$l}nT%xk5uh^_mNyjw_mdjcpX(f3Xtq!J;ND;W8GL8-FLUe1rLnMGoFiB~N5nSa+ zrRL?fr`3ME{XF&?!NFqu=(!FG>_jq=o&J(9C}LL~b%QiIpy%$6Ib;$b_ofvbH>>?2 z`En_j|&yV9K9$?JACxq);&&Y~MjhH%)DnWe!?tb8!lIz8H*BkG@1j#D} z^r_>vfBq#$I%y7^+a9;9AUm=!P(dAD$D?BOi(Wg(JwMlswtR{HV1;WqZtJ(#c@VZ> zg!Rj%A>+=2nsqv2MXq2s!RS08+~Xcqfq(h*`|qDPP$lbuyr4F80cByVuqQSKFX}(W z%E05mFtOZvjKlTj8uL+1TVhGAwmV_!S#>Ws(C!jWp=w8Zp20osWfNvD2T>9K^6CB8 z&rjbu5wmC@{eCr=v~*TN;*m}G=|N83A^}>jmCIP6cm?S6N{*ZDju>9s`0a7^vsUBp zxH{FUYmTeU>V8x+{7B0~4U1#{a_?&iQV~z(5MIZZWAf$WfByXX?FYvQzD;YICw(Y#ch}N-f7}`pX&GU9}*Si?9rK$Co9Bb7TdN1pcD4<7XkV^_f zY-IpUzPQ_*Pcq4jM4bRXt|6X-Nd6vGje2U1No~tO6D9lAm%W38rX`&wu#ixy&uV|B z;CgryOgfsF8c51WY8EUxI>Ha<{v@SS1f5f%TlaqBJ}&S2j=B5X;I)>=dd;jCUdvot zsXtpzcHGH`!pQ$QhN%!?^7HkFVM#dTrY?oK-i9i1O{^>o3YBl2W6Ja9g5mYwCWvaCB zw2?jvvFEH{+~b!GaR6!(0&-MI9d2H8c2E^Fc$W7eDx1Sigk7BQFoP&Yf%! z>1F^kJ`dMR-O*otxZM6V>Z!}M*y;4;;xW=czW@33*Jm9L2WcKBk*=0PdKQtw`I;Qg z?VkGY54Er7hbH-BWa{~0^hylDo@(TeuRp$ilQhu@I^i=TKa=$d*r3`?MB+z8-#K0` zch#(r-S`5~1t?glARZWheaVd6OD7VqR-0Zw6Q5R8`;}@s@`5wP-be?MiPbBUeO&SE zuLEmp<^cp~JTf2zp5sN7oI@CaQET?@ARX^G*UdfJ8Nec;|T#rJ?l zz$>fWvu-&aS}CT7BO~ilkPnh(?W-;iuUECAgwN!o!5xDZ3Nem2}r04HnmbppTw}xVd&T@6QFPpZVIaS(}uW= z5^W}wGuEZzZUzb#cWgX=;*U@7fBX2^SL%L$eGvR?dI?ch#*-cXFyUB|uzyv;Dw0$K zZ>fbLMFyP5{kVpVIGeHaMIMom8;K?Q(NS^#`1tL=pT2$isxx#a0Z0;huBEXH_5MBB z#>MuAbP$HCI`~cG_-29MAN?$iaDb7sLw`7JxOe}|bSxvTd&L6*$Gfyp78gKNZGl(= zN&e`W2TZf;sF>)nFmmYI15%-nMc#+*@J!F8@Y?ORIpjd^j1jAbBCSN+E2MeBl=7id zgdi(Bs(V3{@>cqX{BOx#gb4xNAC-h^uB&9VtClLT?Ju4{C$c|}obN`}N_wzaWLb$v z^;=gTUX{h_d(+d;YNGenudla*fpIL5AH=$bkVdLL`{}g&}jdLf(sr7~H)8T#{P zG|70$6+KwMSn$F9RyDYBG79^fRTWcdp+;Pte4TKw3_ma8S?8!WZ1o7meG%wWY3? z5XBXd;pariHYQmLxjg*5&?pAUadd-qjHLa+Oh-zOs`?3r!4Qvc9hY9t0vu_w1j+Is zb+|s*-|%qg`rawzbW19O~6jhd<1u`9m7!k;biwh<_$R$U%p!TMG++V$1B^yGeu6Xf;BZ z5$^Q3Y!=D>PVU~{kEmGtyTXzspP#e5lF;7Yo>wei66Wr(z?fj-k-2l8#HtuQblVL$ zHL_=a8!r4r)@sEII_&U_5VgUF^PWrXJ?Hs$_x5JEGY9QZ1kdrMrTY-*d_=YpC_~7t zFFf4z$!E#aRucB}MT+CI?)YCnpSK-$dXoKVH*WR%@x@lCgv30$v=?ViEcyKP-ygrd z`}((!_l%qeQD)-OryoAvsFe(^(bgc%jev{Lv;mh3!_0131(b$7PNLd^Qg!w=mT@Ii zjQab6+C)fnmJ-!+nT4;KV($h)otYdl+CvZXu)_@F9dVG zjC&(ZZU<@l57WPi45#sgpZj4t)9)fYUK;(`tHJzT`_x~s8!ztk6dP1%_833gj~o37 z)-*l@RE&c9_$nW)km(3d``mc*LO@ zg87>po%aY@`zU$K`eKtNAWuGj`tsq40|YX6sbza1IaqmBNo*c>jS@JzZ!ba)Z6#3w+n*+B9T)4i~fLtWn&QMmHt`seb1Cf#gdAO zgdFz6)(#dryPQKmNDA+nae5`0ltea)0nzd2kKaFk`j}v7%DLooKb}|!x$j3CdIHtz z5cIS=A@ORp7e7n$w6PW)9V0dwzCH6ab_&j1QFIxoulD^WY;^AX^@X3jSdZA85DxyZ zwQpNtB57@6+ktx)%B+;Rd)8peU0ag$EmPt@_ZZphYmcby`}&Lz^@%P@6D6;1p*gs3 z?%UI<+dx)qpSN$GxA)8I0kZN3G~G&Clxpyf4o!yTNFr&qOiK-vP6uI1xk zkkLJ+S+Gj!bA9@ZZ@lP;^#s8h-HTyO7Tcgo zT$H^a=oQ>}I4PnRNvwwiJoS0cT*lQJLCs(yE)7z_^j}ok#?I*KOHe6)NYU_%J>5i7 zZ|o+b+#Nx02S3%^BoX)Nu}hE14ue;AC6NU+9n{J0St^3Uvb)`wGqby$UnIi?SAHTp z{TcLm^5o{m&hFL>wN78}D}E5>SMRR3D`wSL=eoNx6;t4u*Squma=j}qc4zlb2vk-D zl#$iyLGXHFL59K4z%t|MZs2FKL9c-*qY9`~n0B&L1M0$s`t6P(43Ue92!Xj7XR0%h4mIR}?t=2UYH4Pl?_!oKYXQ@$%hHRbGOXxea0JcWV6;n6Bd| z((W4cbV#jQU!-XwM(IQbsGN4I^F}iAq~g@yS!FrC$(R0hP{VyPp}p%RBVPix0R+4E z7OFeuF&%++BMFHOR0Up=C#Jpq&g_9JcMEZC`fb;rELW&iI^Cnn^19)sV_wPKUq+qW zGd*#~(p;s@@4aoB?yz&ADC#9)u7Lh0lQUd5yg%mmfH-@+kQB<4i1l5~00T>fgnFvJ z-qa)%(D)J{2?dHy${C~$C<3I{8;OAWx}o_Gp6^QW-`!ooigcZdJ6PooU>6s_vGsA` zaHEq75?Ql8D`I`ShkpeqRRWY%kYP(f%nJ~)8pbRTh52`y)V^EQ;q~sXI1S8$Mh5eP zbV>s0A~c!90C+-gfVw!#(Q?G8CEN1 zXGXaP>STMfz2H9i*I(a%{PEGp14{~mC^myAd4iaRyr8Qw!hS7@`m$1K!|K_LwjGHZv+0Y z0AqWK5e*Ty;w#F>mc6hT57wHc59ziZg_XBU7@ zo^P6Zcm4UCY}cE6S>@|h@~@9SzW@Fy+4fh}v*Q)Q0^%()Z8(9o>bGsI!P=@_eQB+5 z1gEAp@pdL#_lzqO{OjZQ@1Nd3Wj;f8=v|%xoFR!th>Cw{+SFv<0#wOi#xZHg1P>|+MkU7 z3P+Y68GX3Bc&g(|aK(*DAJ-gV?am`b+q!A$jjFfdP3^Qg8Sec?TGxQhd>y?o%K<$o z87^3t_WlXVjTj-utb5;J9$>J!UfOrCKEb^8Axkh4FYQ%0tTF#JT-FSK4@?>ultDgS zrY<+iB9<>T4={QhnC&NZH^^P#iwJoBj1p z!Kq*SELCu7$ymzjMj`@JHK3f1Su_d-D$j4X*p^^JbNWKRiN1SxrR3dxHtO zsevD&hkRvaXOrvLzyL;@kN>r(BnuXDZPVr3Ldj8 zupAP^SFRVYLlt4&w1CABp#LDA_9#?jzkw2s8`k4oE=D4K!}LA|JvO$uL7(t%W^tk& z+vK;e-@bq3@OUq8#_L#jCOxykP3(b$$I%b^sKY&R9Gl<#HoDyw7JM!<6G;?74C{)p z(3tHfNQd!=af}T%yL=QnL6Dm7rQ;5hauXc_+W`9NP3CIbo3K8{q%^?}1i&ESAxNGF zW`TNLX5wf&pz2{D){(ZqV~0(V1#K*Te*60Q4>kWbqx%3k{QS3%=w{K!o5TsXk$%HU z7=loDe){mly@TZCn(y$~%4TeD7=m-Ew;uZs%;yuy{vj$izp;p3$?@CvdBya`jZv`E zUxEcB)lOYvn@4A3yCHcuXccrQZfNK+Z;3@HtSL9C=}6kp8h6eVxwIQZ*k)KMsEqk5 z`c}`Y(@Lq+-z8)=5ui=4f~eXef*m%N9MaHHjs3D;BkQL z-0Q^*Z_o1n4O3OB`!_V)E@asLDE&)*efjY1(|_rZ0!?ce>$y1laWe!qln)c?EifRdYfBlX2-G#$=8-u)udLqmDM2G~Fa>6_{asH(?!GzS*rv>kP zrdwe`)pifkvpsKYw`^iSO*+=ox=$=`sok_ulSD!I4Sk)E9l7(k!!Q>OxBlHe~Gs(=#)=H7_I}E2Px$Tb4-GxSH!STj`0%VYNa<|Gc) z6XEn)+6!PM*%sX20yg%}lMup%>ZRarM5DbueoMbR3Vi1-SNbA;~(9YxYP$mt%djiF-25lw;x)xfP5! z8;P-z!B=U{zp7SXPb{4vcm!v^@)$S-O$D^h4#}24fAHn*#B9X%V?_kS66@C>Im~X1>$}f?edKV@sv#lsv$?JIUQ=t28wFj!M(*)yLMPOevyENY=>+Kx_FP`tb zW}hF$`*yDy1>7~q?QVOMGWF}f-tRu2^LNQwZFP$DdZ5>9O$(w<{B`9)2{e5B{Hah# z2Ua1dA-J|=BIgb<7P1}=$NFu1JBVQfY)!4U_U<rXgn8u?HTWQ z-88r=kCK#-L!%5Rz3;kzzV7AfV7%GAT$ce#%+2;jv9@yFNGE$$tU*z`Cz*ugSXUw)~PcTPKpB z!bVTj_xKZgK1bv9*ZPJP|HMm(jUQ#6^wvqE{bxx9jCL-n>83T5W|Imk6zyE>Fp?y;PP7GE*<& z8XF=mVPq;EIN&=_xw9PY}T&vsLn+HBtxAWN@va4x#MyW8!UBU6* z;3U7`W~F+o1mC+s7~Of8*$Y)4$aQ_UXHuO?$wYt0nks;#H6)wFGOB zqy6ls$Gm6U*)%>5EpR-{9wb87Qx1O-5HJ>@47*E%+WHFyi0*Ng@hDJPd1V_z1p4Xs zzjai<`5o*x2OO_&2CNll@&nU4_L@yBkFlei54wOXuC*ic=zsb4^yU56Pv89{O?#7V#1KJ zk(zp?mhRmy#bWsnoBzXR|FH5OMx;r{=V#*Zjb3rLLT6Zws-<|FN7q+O@kv&!#UsU~ zp(|e1P zgB+?zfknfB!L-rGv75>-BDQlnk<6Dw0{L1Yg#`<7`<4B&2`O+o?3k~)QjN2!B`pUg zgAwZeu*+tksu~sXVLN1tQW2}hbbQvTPVpEM>;_z$di-Vcyt?br&GGuYy$AY{&D6)V zT3cgCu*Mp$?Xs@?F9T`xuH5DZu#FE6y${LpSX($Jlesj3qH@(A&%+zQ^7IuO-f=qx zF3%>CLiB}9{uS}e3nn>6Iq5Nl0Z@lsOnki~FYS11r@K0-K@IBOs=eBP*eYa>s_i~i zUaW8XU9O0#DM|H}y_Sr==Xx5}fE8sS_S*#^5QVIk7S{XBPhX-x0>W0GCOmi9cyZh+ z`pj3hs{G5-w?D{AYWE^Nn7@p>9(^BY*h^&ybb8dsRqeq2!A?u7+N(Yia#r1PylAN`PdbscM@#3|GuiUeyj=+vib_s$TYc8}FU7!W1a>27j5A)qJ_gQ^i_- zTo#GMA`^T1SMT?G5jmX=EHn{dG*_<{!B$W&&1hE(2Bzj2<$*Di>rOsIoeIgSO+E%o zKK}dT=fA(`LcPB+4BX$?cV!fwHsf))i5z_5<85ERA2B-0UDun!rS=#@n*DWi=M`SZ zuVSSe^gqFrmR{g37q0{7Cnn-vw;QCV8q(`*k3P>6b|qqi2IFZk9&I!PmatcfN;@4) zJ0yWui*Sr6pg!aWX)l-2xLg<(0m|bazkPb2d}L~`$_bN>de=W?K3j@*M?6& zGlO>uv-HGyY9d|D&?g`1gFbml8JdA=+JrKu`c6@C91p4xKYsc3vqV_JW(}&}XOOC> z)COSDx(er>&VwFPp{&MYyCf{~_U!m5*Sm`KY_cLZoTJ)^8DxK72QdBJgt%h`l3YHt z&P<4Q`s9v)Gs6CDRJjno&};ee^S@Pv_bm6j0IatcUN9Ifkak*QMI6dcWE>34Bp2+l z{c(ka)zyBFr4v$wnWW5AGHLKsQPn>SV>{-Ld+$oZ4L!@NjlJFa65vIw4_3esb~&WA zC7h2Yq$Hyz*a?)_qQo#|jda*D*3%D{v+J^+3G>Lwe!af%gD_OzLuiJ4T)p(wb^TIT z*O$#&9!ZzeMgNm`tRL$x4?>KasAm4y-Q2wDr%hm)g=i~4Jqxq+A||b8Jm5A4)zFpb zV!exUO3(7%zP?P`6Tos@Hqij-!=Vpy^Yex!#lB`~XkG;&--2ZT)q_b|>4tofHoPF) z=Y4T3Yn_TNv7~1=`dsaxj+H5S;%!H}JH@GcvBJHQnjm?UXH-neeEF3P69Vpu6ql5BqNFh?y51##Ncc z56O69M_UazqOU^oIL->edhJJh2BBUd%Pjkuuz#BM7n6%XjRaaV5T0(;d~$f2n~Ey9 z_nf5eO6%zDsK$49S?Mq7&bLcMgH+7JC4jx~CX$;pbQYU1OxK;qw`G=dN$t1`&#F~3 z>|2rH?M?N9k%+-kt-ku)zc4QlB;RyrcVd5Fe;vLaMC&z)8|pi9Te$0|6YKH#I-$d0 zBE^Mh@WG*;h)Z73{&DAQJ`rV?Alc)LbR3aZ@+mVJnRe8TZ_L$W4lF$>py$J~4sFi@ z1d)#YUmz-49izE@DnCazuY}_T=j@f6BJ4?9LOgdI;;smgPnWjrlbzqn%;RHba!x*c z{ldni9gA-}+hHC#_w@OL4q5m)g1v`Ix^d6`IfMiKSF!tH90<+&8o?)0fVCp=!?>Qp zu*Q~XM?0}56w@At-6(MfbnYAZ@b$y5A9d7TZQKsht7=ze!m|Eux7u5``ykS&`6>_9 z)aEDR#VbjtY#~w84X?4>p<{ZzO7;hvXVD=F@rU8U3Sb?v1JkuPAu=UR?x*o&f*9@w zeKq49-EiF90_;1BjuRWJ#$DI0Js%8095WK`gW3mJ8&a|}t|Xn%#Is@`D%?g^{&msk z#vQi*%R~#mly1sB_jzNcZiq&tNPlfdiGhI)os}G)K7RlBnbRA~QVh*At(@BbW*5iG zW+#;z1H8ieM4j15=!7wj51*d?`1<9;cTQoWme0eg(QIkbGbx~3?GHcq+e7k!`NT(T zHp4b*nslq3WPna|(#ThLMT68Y4<>eKQkP|wd@#x41hUBJ8~USNn;#P)_x8+9yQdKB zlMArA0n|5R%jA2JGmW#r7C?y;#GhVzJPv;8F&4&{c*J31i{(FT_797zl)^qH*|{&7 z^(tM@CX$^OaF2nrfIProb{H`750V9>G&n}~ZUln0R5X@sv5OT*qq4)?h;QGuwWI+1 zU6K`r%YtO+l>zY7%?@FIv3(s8I&-o5fO!Xqgii9|<467Js6$KWFqe$mPsVsU>>np= zOydT$NaLEeVMXvC>2J3p1Dm>yzz%!1#$gJMOUARvQokfD~1us`bEf z!eYWS4U#P<^aK6Td#AxvCO-f=h@B<4(Nh6C$ zAt50|TIN+iY@i83q5n{`^AU%vwFhc@H{ispPWsb*-fS1_*K9-ma>!llOmp`=QoA zE8VTF$AmRpY{8{SgSze7y5G0G9lX3r=#Bayqum1+5qWB|x3?BC(B7I0D+?19r0Y)= zmiBsiskcg__WEVl(K`|CMQ$gu)_chSH6l4)Z*bd9p1lA11KYoV`pz2t?XVnM02L5N7Mt088q?!P($wZnM?xWEkcB*Kbe%{Z)rpw^mSW z>#!Y9{>1TwCnId!d)^R)6cwOznf%{a*MUgL4( zt?$3SC#Kt-qo&=R243zQJ+>+hJ!$IX#!%GrHAsfXLXJk=aolX1<8^oNpde#~$1CGE ztty*yvjG`gTs=!3i?f9>7SLMxE@eig=>6fp{y!R888nh(m=|=MkNp*_hSf} z%|OS5;OEU*+yrpMZ3f%>+y^5T-ft`;H%ybN{UG)6du#`v{rMYd&Ay>uxoANgeH-^K zUxW0=#e}{J?hqVrq9SA-jx(I;(YWaYTjHXxPo99-c*>u$!lr(ykFWkLo1cD#xE~cn;b8fD z2>Ffor;S&6<`eP#KB%h6-=4mG{`4{K+xJc}h+ogFC&TbIy>`41wYB9W;F-(vOiIIN zIe%Py8ht??|MBN{u3>|kd2$iDjy@R>iLfao2scJ19wqJix@(&|jo@~@+8kHs*X#4T z+3MES{f!?)e;0l6>Un$fm36Js{eD$tX{(Ry?;9#_>@$o^Q4VX2YWp(N#EwCFUpU0~VcT{(F&qQvx`DXhf*8?-FdoK? zlG;8p6671{p;80(M(auF{rtdsNZhWyI8LI%t|h`;Ae0L(7)O8q^hNr^6DP)#)8L4% zVQ>l~ZX0}ZwZqz$dw{o1G?PAR^xa*2-?59^TlYVRpb)q9;e1yM#mHR;pX*1qhHg=s z$F~VnUuGU?Ywa0#Ty?kWy@X@n&?o`*Ua(>%Yn-u`A@m-jZN0tubB42Ft(wSId)k^+ z7;Q~2Lkqfo#@Gk)wr)Jv+fB*RR$L~79 z{OO+epqFoWe@n)XFewgk8`le-;ZIgGnT~V6MZ|9bGd!E0`-K#zh8+dplIDD;zd+Ef z$vRkaVm~w!eZ;$OfBpDNx#NrllZLJHUdSBp#715G`k(I~|N5j0+ki^pWX(%M8{%c;RrRyYioE;w^zV;+T#cnj!S%TYE|R+M1P*7- z7Gb=NQHqAv5;^UhVv0d+qnFY3w^)t)YD1vH{!CpiLT%8DFK@o-g?5O5epsxhw$AqB zZQnop@f)4uH%Oy!ju&QF3&z(aKmgd!p~2jwVr2B#q@dm{m9uQSJK$hwE&$!)h6oVr z2*|9oJ~KnCS{GxMpmY{q@WxlJ!MBdbfAaeeeTb~0df zAbah)RE`}Abu%_Eo562$v^1kfts0hS`lKi43H80aRI>ItKuUFx$`DB>R9PLHdS#I` zHt|ZSVlPgTQa2ylWAoZ3&Ee&6ew~AhDg}zXY6lVi3$n7*X`W4+>;Os;&e>m_)HbH^tDc5TqJ8Aj&uvaA8QfaL^bEGF=IzO`BVAXE!s4#>FQ z8*K3l(%7YFyV<4#gsT)2kAXMC&MV}MEbeQDwdW3i!&TMxyC6KdW}_JJF#3jrHxGVi zlEsNOuOK@IZoOqG8|ZSaR^r{at>P+EKLiYe8pkz(TswsX?9Tw!FY7Fb^6a}$zrO$a z{&$YqUN+3?u)B`;yEmfI8@)8lO_PY|9h&~~Qon*{FZB!(DAnOzAEE2LPY8r= zsivnt3fOH}O4}$mP#3HAqN73ab=&s0+{_#PG@cKDs}`$IpIPhyN(To>3;{_&Y+E|_ zSln*dOePO-taJk{RE)vh_ez0x@0+Lp{C56V(!>q2kwOC9fPaz7jBoMVq5^Z}xrO_~XdBNtHp!cju9y{OK4ZxJ$CYob_cU2W( zb6vqviU4?UNX`sk0<~{uegvz4Mgn$jN$A=SyIvJ2-{lbHhIdc4x82m9#@w*eHSTJK z+YNpjQ;h=J(O0D{Ns=^Ps3O-^iHwYN2SEf09Q*7giOT|R!!Cd&Df(`5cg;MSrj9JB zsPMjA5Lyh7-c~h5x)c-;7%-X0 zd?FwpcU$W)pFc=8k<`RnFVMAmUH~zBx4vO9jv2Wp6`k14Nr1g3!9a6SFub0mWj|g2 z->2_?CWQY=o4vlEP%HAip%VjjCTl(`EOo1_+%SC(9yogmo8@M%oJ4jpK15$HT{Tyj z|3uh?Q*dGfY)m{HeWX9Z{$=2#YP|ZgQH-fRW!~n2*U=YAaJtq1v)^q^Hrw6aWWCvD z$&*Ru6R484G<==!mJSAaz_ndddP_up~Iicw}w{6L6jFB&8`VOr_N4vciPt zj@A^wupCLl+aui*Sv<&WBJ=4?h95l1z~B>>;T1#2C?v_$!61;!Lex)SYM`RYNL1mB*bl>;*HZN;_Mg5yz5j}_O`T!FF4#;_Q!^w>2k*JRy+Tx1Vb=19^3S#*_rzvb zo`F40hnggpMd0?^-0iU6X9jhl}K{I0S44G^@D z=H3LRKExISfl}$7KL7pwyS{6G^BkC(O@rBR<@x{QrVMOdsEAd=)78ah(DgE4HengS zj+-KNizoEWg*qT50Q2XZl#(zUr35}0#OjOiXvyK-YjBUa^oV;WZspd`pFe)#px)f- zoy86Oe`v!X4aD+nzc1ZPu9-HDC(PEOcCk@b=SZxldNulk`J8vnpxc%iaCF;B^zK(@ z&(ju(f~pL^zCIgC1WC#1EBaUVH82_IC4o?S1^EO_e}H6F0Fmcic*=BGRewo6 zT-^U!4`<92V1%2dOugyX)RODlU@c(nW&8kuK!3mW+Vw49S$#-=1nZBr~Xah@Z6YMg3>$R{KHJxuGNI4J|4lLU$~x9F}LLPFI!usPcI^ zFMf(-@duk%h3;flyAJgBQrhy8tiLQIB$h?NX6eg(m$$>)`|eLsiJE1;(4SydWb9zE z%&U~SlllsrEa#Un3oBV>c$3X^K4wn>ax$21%(yX)VU}gO)Y+5|O^JzA?WG0nyG62K zi#VbJ%IRg1r!z2(KUjs67ezU%=4G<*&C|c1Fs$7Qi0Z{cAzCcT1wRpe`eN?Qt%Q1z zO|uq?SUJ@KXQt0w%<*8(2*B8kx@{%{^(m>=?R50vjFGp##$OuJNz;am1 z4C6)0+tP(X;n+-bU1tjNB25<+E+Sxlskd+SWt+?o2Nj!Su2#dP+wPKi->z1>*F`c{ z4&^7Z$mEnW<#eIEn=hW-sjVoRRi(aHq>^+Jq;aI$XfY3>cPabIneHqrZp{15?d2k( zNSKora|Jn>&ld}RBJ)=j3Cf*BE8tQTC2=v~eDxqvK<&IX%W?{WJ)7z78G)`;LgjH)=}%B}t5=}po8@;hFBiJMR9>H#g>F=4 zNTNV0Q~ZSHT#8qeSsE7}R4Da$UMTa<$*}W+yNgJt+@Z_nsWPaNDI>nJbWV(^Am##H zA?i}exp`VCXL67$0H_3W7VpoNuDxc<*v(Bu!JW}co-JofyWFIjWJV#Mk%ea}SIKNK z)73>;7Ak2o<-9}^PG^Yi*<4pSp^Q3HY4KkzDgm)bl}Bf@Y4bQSJ*AWp>fYJRlfWTM zeh~bd%~GbiN~l$Ajw!?`IFsuy;d-i=nN|PzTj`tS=)S5-31U?iY)23B4bE~i7Lmy_ zu@Y~}s+3bM^vKctY8Q)N_(WyViL z)FJy{IbRTG`>Oq^!=*^+AkuRtUXHc|38>u4dQ!dLvP!q|9;T zy^=vyg#tILa(*J^9EUWj6iNJ&iZIE8N|_{I77$M2aV42u@$V9_2lOkrrijx|B$aTH zw5rNQfdfOj_$4LbP~lSHb^21va)!?=BrKG^6q^cxS{2H+axxs@Uv%Xd${7=f``j>K@C#7xFNqH{A zkWIN}93Uw}VN1$oZ~Go4(z0ZO%aV10rHZ*66)0u;;wt4wM6pq-`c70=&2chi$GkS< zC!&I{U*dXbCq>ihH)(cQ)3a$^RUinXpw@k-ED<&+#2 zIX@A%uM4UoIeJPJs2m9a)U`snm0wb*Hp7RR70_a)JSwNe;czbH1b{1Xz1?aM*p~OK^l~|1zZ~-IB0!5&l97oJ_E)XF=AJQ{gC~rFB4+3v+_w7Cm}GP9&=ingJoFMV&$X;%SYg_e~WkL$!gbd(P?f?`CBH~9PI~Mv zSN5>K=vcB*PQhoV#B4f8T`5w6kP>wQ6=gZxNGeG^=L>+$K)WsT1?o40T?q+8T#8sw zagKY^*#y3t@+~QGLe?> z>qN?l#5*Crxr#d~hcT@pJ|&AB^t6n}q^FmDbrCNr{JjFdrigo;BtTqyyt{}*4B`)U zt`m4^CFJo^NRi~sxL{-Y{8YE>Q*t{edB>!vyuDp}F4)>!lG8UpEh%jZU^;S4K(Yv@i7%h|`5*G*xAr`uGvG&I*Pyz+aWk z;%F8}&Of;{Eq)@Ba=GI}n!4(h=v)w#_H!Z8FNZRhODa>VN~B7R z7R2vTf%b(gK3DDTh241^@H3fiS2|V!xxu9^2(d{kk1$&b0vYq+C*mjOOM5eq>rtMA z_%kdBO=kW?S4RSx3_#@1#Z-DH;t-YLQMsH4__d`!jzS%wFCTXojt&>yd?J+}lu!h6 zf4`H_H|CG)S%g1}&}MPnA2nCKlRIBJSJGu92d3&F3hdC-2YBtw$&;Hz zWX~Sy6eOF-baTi!n)&uNo7G2Qy!R2O3*~?O&%}F!|y4+s_W<#%1SGa7LuDe&xzrvf|pzH zgK*8ax#umX@16!Ij)JIA=MH&Q#iVDE8BWPXat3jkrYC zB>VV@=+*Q*%5j!1Lq!wJ;^Zuj?0ZJzU694KNjQ{`8bFP42h{2~5Jge#bH1{CC}HKJ z)-F@}dkmF!rb#%I67{}m9#>t-m60#XG(2|tmy=cwi8L%HWt_I#%x{>Adl`va zMwL*8Y6Zl}c%)4IzC2!=$1AMPl<6dDO)7ga=}>6za^^S%j(jYrdkg$l-pM%|y^Rn? zsQ@|U;>X|DJ7mTW;u23wJEzZv!6k}$5&wU}^oz;@NDY3QfTuD-llesHH>;sZvr-Nn zI>2lZ5J!=aMU?s?N_AnW{vbq75FT`zrY6&+N8$#Vo5UUTp%^j)DN<0d8K?{vx6hUV zal6HO;Uvu;#2(DT*D7vv=~h$I-w{f3@hGIlqmTx%e|fwlkH@CUya@eD;MB2LFCRp2 z%g;UL!}5H!+V#U$gp8ZhMiML*OGEsL&6h58id%Yt5N>SyXTM2jy(7DHbZJyECYNkp2_^uNK(OcE-Gdb0-z;g6CX7pJbj@ zjGyExJ^Vy?GyRc{Sjkw3{F^U>CM^dyP6k(0U5r9pguM19nSf_OT6d{&aX(eEaI z$^bmy$8dd4hm$f;#V;Y};FLI=M{uf2_B04G1V51|K&gsMN>NDZ>%`@Y(?>T1Z=V~; zlt2-X86t&JM{smS8KxsYpH6o~{-q;oW|#$p*in-`PA|xTk8UXxq*;JHu?|#Cq_S^w zGB=%4K0TYo(c@{Wk!e(YY3RLa6sYKh%1qLEfS)bng_fdeq@%m0{vi>P@)7Q-T`LmL zyZWQoDi4U0vp5;wTtsjt(VRYVMfy;!6;W}=RCd!x11o)0wwOQ60&ugXKP-zdXYp_r z{UGT>ga8*@4Npc*?+~Rw%JQq9mxKJUA31BC-xmP6tn*@5ozR> zye|ZQ-SjWXe)LS^%f8=OB4!wL^Y@GX3BoKx_8n8GZ7))@-;&^nwXE#IT*^A*gzx({ zwmYErmLl1=8Vi&1=V$%)a(V5$)-)F{#PmPO{=D3o#hm?l9*%6bmW{=AhUMApOYQx^ zvp>8_HT$FXo~0oB8)ctwe%EJAgl3;(W8iE*V97xzyi0GA#lEgd_Aho|OtNVsLLGY> zz$E)Ec9w#$6_POaD#+OOM)&<1_U)4_jGiYM1~o{455w6eU9u0I|A}BGE6Lt7F}}Y- z!sJMXO%`0{CS~vUHPdsm_e?j--p5K4;mLLuvUlgvi+QqXQKrt=+Iv<%dpSUoJ$a(O zPF&tz4?4VbE4ggYe$?CRVqNL%a>tHu1o1 zI1c5-#QwXM3^ar<4Ceuk-9_rR&O`TPu6Ujq{9-j93xhqF&mGYD%u~uI5;%dMDQ&bC z61PhMU-*^t2>(2SJ!h02u-~&~8gV*{*qqTe0kV7<#KD`*0!l3JnfNQ{N&(^Gns-gbrv>YHeis--k0Hh83*BQIg4{~Yx(e`e0)Ip z@P%PagWXviSlJE|uZSUy7!KbzW4$s9_ngG zSt{GIWy!B3FTY+lZ-697f&>AIAghY?>w7$70$N{eshDFRkw_%+FmvWPy6el4I3-lA z`Mwi^W^yKpgRvyam!4&oxq#BGlr4)T^FAP0so|%mmxu!<@@3JMma03;b6aN2q%_P8 zMCsCvK|@&DcQySNhWMuClvkFcUYpUCZ!F$hl1bmm7TfjUZyqtv`bZ7s3 zIg(kpj~k_J%Lwk6NtUC+BvLq%l{e-Aelh*af=B=-d^!?GmI%E&GBPKM6=6Y|`Fj={ z4(rX(=4HqMa};Ih(FL-NaK;Qmg#aPP4RQ!`U}WG0IY33MguA~0SYR31ViAI4;dV^6 zm;}c(BoKtaE~d<&7a|a1h#-q00w7`}Mh5bc%xn`q2|*|j3lG=J8zTgZi4-Ft zH!Z9+8*J@(a0j!&o-M<(Q>FI;|DLc<* z7g!#yoOk9P+s$I2A~lJ$pS$&x%|iwNb3;gt`PlFs3AZ9c0I9)GkDW>)u3F|EAj)DS zAvdAMV7S00={k4A$=CDniXpyiKGhuaNhVA~1|xA8;*z0SAg-*$&E0nhM2?t`ts@it zAcf<_?H|J;Ant|#blch5f_UyxrYwdPfXT~I)CO@_^7z~=z9o7nC!8kc^)QwNAk!_B&KMdeU(e zO3*ComKawU2@_ytWO0A2C1&GL@JQ^GNglv_8Q{m#i169iy{u|)0#a!f`Go<8up~Fm zCMhy=H1fF)J>_gd}G%~5B{6z8xevnx)=kc5wv2;1leA|+s3;|I_ zz9`*0W+(%~34*T7##*tQ>X*{3_l#-l0U=X@*d~n|>3B80GL19{QcNTt3AwCH9jeGS z)6hg#dL{utHYy{(2;zxlq(f;%^#_?x#7^hbN*w=z;=>*dpq=!XxTHBup_5l0h64XFEn%Y=(!a2Su}K zcqJ<)6?hs|$)-`2tcaSga9%7YlA9n}ifCC0=5ZCS7vaewa-hk0gP#eBSUBGnA?b=V z(!^c&S>X{>VEnKtYZjgg1BB^Vm}=3*^6EYG1qj<;A&gfD7==nuwjc9g%0zLl1E@c@9CAkKs!W;k|D4cMO|p0EO+hjN#vW95@i%3Tl#HFM@kow_N*%~|&Sd&NdTsO#jjY+M+U zF@h<>VL;|D4D+}`!9&inKa|M1#e>{$i#4;p&q^6Xns}tsS2HpUJw|br`d+*xFUV7f zzS1D4Dv(87*mS3*z#+}u5(4ap^NQ2TKon$|$89nnrZQEtStM#qbI!8p%F3eV&axOz z|85!yqJPmi&fJq8gR_RP%d-HRZVgWZw?P6jk^1?F>}y72MU<^#k1+L za)huhrx28p%d_aX$dq#f!mna-mWTBezms;EO&Jy?2a_2lSvGZ6@L9AsSu9Kh5`_#( z%Bl2;8CgOFfnVZ*~CnraaFUgShzZkYS3T#PVX`lcISsaK;5+*y}K z118NGvE~a{TI})aG)Njgr3idQ8i`sO{239UDwhsR=K7m)%7uZPN#~v)h;U|1`4TWo zI7_2nC1s5d<}5BEDbuMhF2<@yQU>_lmIkT&X45IlrUX0yGYv1(cwGN0qa!_asY*S4 z53p0`!udqa9Vh%{>D1kyTIo!qmnL;L(X@(UBt;Ns zc#mP*y~j#YXH>hiyoogvS&TOu{2i95X~E|ws1 z%Lz-mr2X;K9hwJ`hh}+OB#y?E%GqmBWKhtvWHgjlS)MNC@n$lQZ3=|8tf6_gMhj3XVZO_PpIa6Se6FovoywX z9!8>c8_8@UcD!_e+++skOM~0s>BBg~6OtO}woYS^C&=V+e1->dfbeY=Z=Z!1vng2R zMLvQJFoTo+8axsGM z&gLW7?-*H2r^OLzERHY~hDE?U?)g(kg(zjP#33mx6(IgfBzb`E(pv;XU}7LM$Y_I+ zMd0YiP-esMa9PR@44y`+X0ZHTlyeMMNXq z4HjdkQ#uWDq%n3en@DMr@`Q&l(ipWcgk`v0+BbJSrHiq7A7o~-m~7_Z$$Sj&C^OTA zCqM%WThAu$S*2JOY0Soh~yv+d+vBlV=2N&{7e=eIsO+>dKjLt zw^7kU+{NH2XYM4E)R#R9WXj$OibGg#DK_^=6tJ}E0p=h?6)PHi&4lDM7BQsLqJ?xm z_6|~G#AB&n$9%0c#vuSwXg-carqeit+HscLbN3^sG5i3GUR(Pzl!l0k`8ckf&Z9uh z-R+XjJv9rMoQ=h4?%_wkA8Yk2jU@_(%-~T-NNVdc-dskq%*V-C>D&{n(pZ^bu+L2M zHTc;)z9J@4rSow)XAp!HV*x3;NEC1fiy;812#!L5jGQ$L*Do+1!H)8%T4qyn&ZatQHjXVr_(9P541QY{{#!E7yq3(68s=d+kE_Y=F*C%d z0ua{GRh-Voj^U9^HnZhK<`d!lDS95@7e^kMrSYPv>YPm#a zgzjt-y3=ZhAn^>_m87xI!Qcny?i?J6eVC8mKo$dL{?y22vyj%Y5W-+DXXCe}H1^Zk zs79qR*kHd3r=9!l40cvbuPny+8>cv=v&eveqbLvek$h=3A3-k5du(Rnk+if_vpHq+ zf|S+O3I?O*1cEGCx{<`l8rib6I4He-4VcGOh`(~GMa#%CfSqNd3oD)Kw+5tiw=ym^tco-kE=15lRm{rgU!i)IX$;aQ^w0y5Ig4=+IxWVP#z81i^x4~mHN9fW4uyxM(_*T^i?I<0;U^OHLWsj6RPiEe z2f-{XBexb)ZC{M7_q6b`#xxc`q{TQ@B`rcJp_AT@#`G-4`Pu2THX#=qz#g6$&1k0 zigZeiNlS|^ejxnM;;Xaxim^Nv$BNyv+gEqy42S(oP+PJ45t**NWBB!q~5Buo-4mSqIt zmw0KxLqJ^lE4_p!jm|w=&%%+_#w;4lfE}@ulV4A*Z@0Z{2e7IxA1FyyuVehd=7WQ}V|2|F`CR z<}eXZ#z}ubb-A$_`5Wh#?3coAr$~6)>s@-wZhu&JhjqQXD!BEfe?1xa>bh&Lm+BN` zpMjfN0jS%$>vxxG1Km{0DsT1C$2q;#&Gpt9+g0CRlQ#~NSI9UmK&C!pz1NpigTBP} zm-@5sI+Omyg$`}rxkzir8UcYP)YzdVTL%KZ0NMbiCtBk$gCiknQp=DYXXkyHN! zr=H^`MX=l-I{9_0qZ{ykz3dOq+j}RO2j8v_n=MS~&j$q~q$2~@t2e>%dOiWCGgmuy z;^%tZUHA6m;)9Csmws1YcF8~AFV#F-&6B$Vqx>)6=;s{5M&fsqQ!J>sb2{>+1G_6< zD%_oV&Mq=tCja!ePrG9H#`TsXq=oBx3#{s^VAwZ}p!HteB1c}i*MGsT9uysIUnlp& z{&{;m-49}$!}DRS9KXK!;!>aQ*B9}o-8A~bZMQuJG(IMCWPvi2@l1*lbED$opQn#cpB_`}k6o`AuB+jC2Yhgw zi7Q4CZybMLv&!?nx*U#M(yJP7YEs{;%jKr0IXzuM+{jl5>l*gY$dZ2^KmGpn^fepr z<>Q_4TIObXzwLI(>s@l;d-D4FiYD@UTVx8rB6(FlIVG>d3#&q3eH8iWHZ*JT-kYDl z_OHE4{p+dU;IQ2iA1uZtSADZbdHbU4{SUx{bf&MKS4Z(qGQiwyk!_OYbwm zU;4{wU~f5*wRhEjk#MN)z_F?8 zg!?{J7h3)ok^IRQ`3S?)pwOMz1Z4)-xLa1cv>)z%NHeeUlZyTj&v#ED2XFk2``(Cf#H*Xxz zll;AJu80E;qiaX3FKnfK{lSCu#1(`izUrXs>KsH_G!PhYSl1je2zsCMmwmUOyY@d@=}&RO-~qjwT!u)HPznFb`r zRG62#m5BQL>EpZ4e>^D^b+hlP_5M1ns++EMEdG9}`KPx#MeCKLp|0BNo)oM3?6r!( z7U*7-+p4!Wg{iuCe6A`TPH*7kKu>lu*;UsdTMicpnkRohetY*T`LMeB>;{p`OU1Dy zFR@B-p0Hf8j_aBW&JcXz45pVO-dyUpH-O^?|E~VzSg98)A1{cMR&V(D%`a%%`#oSV z^e=MXw$-}Md|j;t$9l^uzn7}fpYAu;_<-%UwX+S!)kM4tOn)vB;!v=y|R53*c}NNha2ycfbYj?9E$+*rQ&-0yC3bE;mG=a#MCl`sC) zRvW1~y52-Z{d`a$w}O}Lz7r^!x7}eccD$=Pem?Bimo2zzuiYwnZk~G#1y^vbR7i)3 zWFkXE8bsN^HtU`Z{QoCnBTwVFdsB@R=iHb=fkB!^ktCVd?9| z+m2&s{?#0>J;$^^bEL{nbwv>Ay3Z;#{jNII!HAiEeR%in^Ot}0)Y``^JvZx~qpkk+ z>-l#3xXpi0q^-33?d`BvY;5)a@Me^8yRQ^A+spcJcX-7V6Wi~H`}HjBHrMM0ckSv9 z9I1#`-(iD3e7l#Qt4`TKY-=XFi(>PB3&tV0B6`|sC`O9V!Kmt6$U!B~^`LyMc)zO* zw-Cp$31^ZTF}u;WW2vriBkBLlnW7sW?>HJ5II1oeUZvTMSo4_bhpJmc>P@3`toPf^ zRi9GtszIvs^XmCC;eoCBNi zNgB~}b-dXP$8dL76B(Q4RZ7LmzQ4E z%q218V2)T+6@ zNTZS>BwY1(uz7ovbiQ&Ln2bw{sa$XHap&Ju0Sc~w^2YV1s^faQvhMoIG0Wd>mn#** zx4*u8`}j0o>ej_amFe<`%16N(PKLgdR>(=BH;%vdk)qOb)G*W^AX!-(m7FveZydUG zy`2UORlhIn`g@JTx38Qw&EZ1Vn`*yZa=l(z`G37OK1WNw z*>g~qh~%P7cDNRhL9dtFaP9g$NLX+{k>KPwy~M$`Jl)^YUjD`a( znOJRqb~`?`sc*KUyvYqG*Xe4dwrTS1%hSI;f6-;Fs;LLN4W?Rw#8zE%(j#Prp*GHi zZ>`>x?a9|ZILM?P0v$S<3xoWA{MXaRxWv3V-YbRlLU8oq?6qQ|X6V)N!~ssy?nb&r z-8UN@uEWvkgwThm4zyp?eTQaZ@&c;LI13~=B5V3T6fEjKUpKzL9s{(l9nLto#!N!4_D35R?m?2<<<7y(efXq5t{XNy z5jjcp;p#*kAs8_F*XjX0ks{5hUaK)8T&WVeHX+iQecwsL0evVNe(Ww7d$)$Jani5> zQ@Txn)L>&a3#2m{BBOSeL)TjaJwFp42QPALYh{LSAKv{g8BWDZ%u7T_1PM8&4WY5W z-7$FRGLcm;J>$B+^efC}OHNlCaJL6s4+a(^<`YT5eDUxmY}7ErzUhvc0b_mSTqcv6 zS2UdM)$JAVef_%S3`WjsYk0m^n{xwFZ4D;!(>BBLZctP6Y*OFs;4^^P~koXa{i`>s#Cva&w-Di+G60&QC06GG_Ua)(iu;{wz(KL zoGWS4udngCwHji89D%Fx!PWRFt7hjwa59=<<#$Lt(#ls;_;PBVt7ysW(CY= zsw0LN&@t$RH)Kf5^>D*z_(3Y=GSnt+sm;H>g4?E>r6$&1Aq|ZtMn>g=$j)BAHRH?tTuR7Gcr(_ zxXa$8L(&I31)kP{yMP&RzMTzw4x~1*KlG||^kppJG#=X?*lz8A?Z@ht(;H3b+!xtI zJVu|a329s1IbR&|%<G}BNmL7LU^-SB<$!vxIG(obQn{^#8*CT{Z zGT@#qf~=$&1o2Dg#3v!oH5#w6soKRva!574Na_F~Q5MlRf8`YJuokLxU~!SUhQ;xo z8!@^gO(qkEQpg+Syi=<|7FJ1y{$95ywe!SoDlG)Azn#14tud*6-BRV69Hb9`^@jZ0 z4+HZ6g#Mp=m67E&^+tc$?fK+h`j?am2!)_OGduJ4^5lTaWnI{Etf;pM3S$c{`&Cs zub=)(zIM0Wj={d6>lwx~D%taq$mQq1<87S^!5z3#8$nbqfSwU75Lwyv&NN-K-CEWt z<`hX?z3ZPFlbXt|tK26ie8q?gqH_dv)tN3HkcI)|Skt|3LXw?Si`m@Yz@E;1i780! z)oR0uc^Em^#uFe#{w)@qe>43eCFvCip(&U6H53kt5oA^`JT2Vf{hd#R(MP4o>x6yM;<9oCRT zbMl?j)|yMJ2);OyVJ`n|eWRyASdZS+G1^PFMSTFyZaECrZe^bMnYe;gQ}M+@TE%;$ z*mV})$2&o}P_vHI#4kGDH$J+1P>|>@ACA_{j?B0rA(T`bS6^|EwV?Iw?G}@$kd%Ao zW$faq#(?+VH1-#cb2eS|3P^;rx~wRK$BHq9;kXRjC1Gk_Ih9)Aj^2S|(uYQxOGVCT ztk5>}QLVsz^0lFLr!Y3I#icS+eg&KQG=m&_CRd3x81q8W*L3!!BW3jF8$-4bpS?aX zmW{dQ?nyUk+=`t&Mh|hpGdfJCzB>mHrqjtcbw$6Os#C#%%2S|g;B2sld*xpy<@uodWr`VXd7z=Cr-y9tqZH3s?#f9F4q1m0P5+F&N z9j6r!4NYLarrvGorW=}#m?^{s&a9iyLU@=aM9j# zjyC4MAw_JV!jxzCIp%VO;UGVD)iU#b!|yry|$+SAuP zlOSk+iLClp5LqFUB;Plk!$f>3yh!Bk`m(pV+eL>3w7!QnAj+;DnVr{fc6dgeu6x>wb)RQn zA0M|H61(mYQFRy6weBj9i4XPZ>?U5#sL!^sMP)cCslGn_@!`|wkJ4dlrU=n0qDjK% zv~+iH&0xe%`Af99s%jVRJGE2Mnd@EM;`z=axkIf$yZ}d2mb~IYytE-p((rzFK z5`so6BSIVf0Rn$&)ujg7%`)SHAt^!3jTtuEVS}lM*SC|a&h@Q5Ux8IcO{N#GFZD|( zJYt*1HYh9>Mr%fK$d3>}I?@cdUN-?V9_TOUrY|Q_nAmR%mDNNZOjdVVVh~sT>vq>& zx60aUNx(PWvA^^+LiFo9$)bKQqxHsg-GXH)RBWG8%BP#v3Nu?)>e^JhJ}maVU*B2Y2t3)~2Mcm+D>Q_v8+t!3A-*0- zw;&R`1NtaCrr&cmq5Asx>HR-8zkKGl#1{fao4xph1?gBOes{rIH=p+?Vn$alPqx>tR zj_b_eWIK(4JXlJrlDqqTL~oS`)1%T;(49;ekQl1=%49JU>%~GIYzMj#s4DudoJ}k< z*{_|A(ISrS6JXlcDu7qDJ9^E95E+V!jN4T>$3BZ)li8I#m1X ziLEI{k_BOrO%MkUlG>)G*j2kmN?e0qDr?jP)y{c}-Y87G-(J?6miTA4dZou#Rdw#* z5%S(m`~`EYZW?C}=BYW*o9cRPP9`VIKazIMM3n@`D*bC#x(KKieRz*{pJkPaZbKb~x}?#~10u^6!P{3EkGz^!bUwIGQ1d^MrV_2N#qOTVQDR-f{7eY!su zvZzotG+H4$r%-Qs8j*nEK^#jEVV|Lvz_?z;@4-97}n)9M;c=`*zd8I@U}im*!2H z?w1e$diwGhAggBCdl2)~$c9r>a;uiNTH*c~y{h9jRer%uYP zP|dL1pc>Cp{tY{HEVbvDM1yOU)0LXn%%wr^H(8xtK_-$4*33*w=$g210#*k1@nirQKmx-JwvYJR~qVE>C4iv8WhBdtgR})(* ziuTu?V)q2uTssmYh&-b$CUd)6ZLnUgySIRGI_72je7*C;_R?)Hz?O9MowM`v_Pq5p z-^;dpvnme3*xs>huid&sPAJ*eD}2~pq~~3>)wLxfY*lF}9QFO=o(ZxsV+}9Tih^Vy z8Xe?%JD(`uB+%;SDH&=ics`}jS~AYg$|1m6E%po3Ju5(h6OabJF-pHP_-n{uZ_oV= zk2>jlhAX1CrnJUBs=W%%;+ z{?pUD-?3;U@4k#ZWV)2H{E&@=?cT)d`jo`6HNGJ=L01cgq4=;3Z9)N?3QK_cH~j$?UDf@KS66qbf8>DbezEOA`hj32HC*^|Br#FzcZsK{WrnT~>l#@oz11>Y z2_8aTI)iTjb3ly0tLeiOkW0m|AF#(j`&JW3pFts3d!ECN`&tb?yNEUpl)+W1E0#Hu%Tgj0ekd}^6_DNr6{ zgyB*h8ap^t6UekMmEzY#L^ZCv1grjKXkI5OIU8giHcVB4_}L>fc5F$3cu4-U`7FDy?)K~_`~Pn@T6lZbplUt_S(YPNOg3sj z1({7Y&Z$AYd+11)6Io0o+K60u;VHx$mO=FLw^uXtu2tH5493Hw^9@20?wpuGZI9$$#B^xRx%_CK-^t+zlvPsz3hgCUQIBDNRXW zeUy=WAEPfw^8K<~T$h*qcRl_6<%Ol;$$$BuuJtbmVo}Hc`d{DMfBkFy{JyTg^vQQC zFUj}njqP^@ul!8bYEy!ezkS9(bY3zK@Uy8bnER=kY1INniOrg)d=ll{v`(O6-$Ii4+A9ur8@AsH0|9v7^a+biO zop-)lKLzX8Z)rj^;z&g1fQZd759M9`kM z&Dw?beA`*U1-(X4WOtXj-EJxl89U$B>qchvyrP%&&ugB}Re_y{d&~PX0t6z4|W1I5=1T=`nO7nIqlq0rIZ+!IaO&(Y<-5n%xVkPEuDOjrfYkRqcgD#7VW< z-;%RaSa3$poS93cbQwvjD%MPi_$MfjiEfElW5Oh+8!N9MstK+p{Z`@v5}AzY-Rab^&ph9CX5~fCF$I_ zxX9eL)j9d|!u1yguT&l%)Ei1XIhDp>Gp%kjbe>Jc=-V#7I7s zaSr=k04dS9D^@bMzhSn_vlZ?x44pHRhVxKOGPWrcsm@LEr(jJnXLa_K+-<@W62W-@ zn~U>=WQ&8029fF0p1yo}@+HQ$LfSUto(In867OD02XSt0)`LUGTt2SM>Xw-F7V(Bcbp&PBTzR^d_?JuPlW;?-g5nMG-IglgZf4IWu9mi!;^H1-LTx z@XSnUiOlU~KXeBn`*xh`JBw`ek&>{@y2oA30-$|m(hv0Aota?jJ07VrvK7pqPmGQ- zX%np!WEKrXPHy<%nfw4h6Y1IlCu@E2QWsFosQOh!!)++FR|mD3UQIAqEBY`Js)d>m z7>FGvTccI|sd|sK6B30EP1`!mb$BV@5$VCqAU><~aamp3gRj;ei2C#C@tsn3)76Jw z0Yqum-BnZ>EN;#KCu#NEN_tXTsS)L_ud|v@O*px+*zHdsE9$r=4+_Qa$ z3Hx>1%f07OE^H$*8wow1Vq_qhtppCFtyXINiO}j0?A;(ZyU9j{?Ts8To45$cuN?N$ zqX_=_`1R}G{g?M)vC+$eIG7_%M`vo#{^x=5_9oET6B5AUH*n|A9|mP7;E@R%*jr~m zGo-UY%qG^2nOtU-szN&fm{q1cyt}I?q+_A%b(|Jr2$>GE@hl zwR`pu5mj2%IqR!!Nsb5N>S$oG6o9emFV(`NdN8UkRlGfZdi>XiuOG0;7imf2c~nKf zHt<5KO1`5#Spfkty(uAhIrX+)`;yh!y~*Z3#Go{ioV_|%tHIfcJu~Rz4%dP%=eE0jKbH}=odP@Y5%tY)gJJAJ;057DGSn*A-?Q(NaxYA4K{@*{@ zxTq(0q)Rrh@890MI8o@CR{fp-NsmTPkfd~V5@@>dTwmOq)8AAkln;d!i;P6jgL|*; z82Luxd8p3DDIiRB2!|Pip)g$(5RZXzdZLxX$V55hhae(leWo@L=?kN82ig! zI`_RA3AihVlc4sTZ_wUtI_vCAZt4^WW#XQ`9Q>*7ixQxNPak)tc~G?`C*kKmpH!WG z{vwOIyPcJMBGm8lB6PY@6YHH1nby;H61u+A@n6v1J$F$?jH}auf)*)6d~);p(&x$O zYJ&#fpWF=UPrDY)Os-B_jCv={;PW4k3Q>C-8htbUzbI{1n)>$mu)GZlUE9QFDi8~A zku9?p`gT`I7y|Aug>dTbNEXY9@NB*7Dud7U8%Z{jMG=GoDpIZ2f{oHJ>5o!HRPXdn z-z1+KkBIe6b*nGOLg~CesR1GZ=3NC8`YqG=fMyG9W0{m1K;2xX#H}tiw`Uj7W5Uh> z-aX*6#E`^T56E1tRd?z8qywxj0OJNl2CK2Aid0*!U)SzA>sS02v{H!$he4XW$0)d0 zsTlSZGt-jK)%oGCZ=dsrBKiFI`^U#m?{()`cUy_N?mo?;@9wAiIxOeOr++?v{`58J zUe?!GAe(e*@v4p4-7bTBhq@d81t<6saYPge*O1L4+-U%94EQFAS1)w6xeBB^bNmz%HzSHsbTe z{+ug^&#NZ|`3~Q@&Q}W0T3Ke(i?_|Gxy~m-NZKl22#%5j4<#1CanyU)UC$`F z-SiK3Iw_Gmx=WK!Ck12MC7;^<`~P^OI{Dl@vjd6%UAOb0>E7!MbAJbzn${S(x~L$i zqEp3o?lBeSBlg{azF9N@bGDl|k!0<>CK=yP`V+Lbt%|8Wl@?*(0XR1E07cR#kgMj3 zq{v3iT)yO82 zJ&Ys`RL1&b#IyAX$Ajc`u(i#cK&=V)n#R7bDkfa1*7A~a~)P z@gZ-WVRlg7tlv6Gh7)mHzeaJWU+(?om_n|cFeO<(aN#9(!jrN_29Y$}g2x7rUZPJ& zgt>ej)6+a#dZg&L4A)Ipr~9M{hE;3N*+wM!^z^UC_m9b^S`|jT%4>}TJq8`w`kg8U z_(j??UR;~=9H`rebOp)Sn(-4oIzy^Ru7~P)9~wy{H3(#!8RqV4wZ^&G=jrRKknJc0 zr&>aBF%kTA-6L$g%bT#}XF>_B_i8i{OEs-7aC5gQV;v*kVyjzgiM444HA%b8>V8pB z*K3ZY6+ZGz_B|R%w|IXjzDluRGO84()7@(qPj?oH0jHa<>Q|YUH+{?L-k)1vcHZ^j zbXS>|d0^i8AOHOF;mb!|t@M)9oeEN|!_&R=9P!gj#Wq-{8w*}!-c`U@Y`}$*YkONm zVsHih^`4Ac>@0;Hd%KT`?Ce3uJOuAWw+>K*gGzS+?_ma8lbOh1FDtK=&t@Pyn}J&l zX6zUT2F*`5&pHzv34>Y*dh;KDeR}un?;k$NLOFNC{ywK0yKH0&$i^Gloo;(Kc}}<8 zjzDg=O?Tqu8+Xy1ZdumQ3w#=0E}MCw2Ur`XSRE+5*PTcs^+F)EeNZV0cCG_Yr*)79 z3pEV}dr@tq8UHclW#$L0mYvkHV>-;~a;kP}U!2Yg&>x@w{rKfua-#oKx1TafDw1hB-P)sCE zqWbMv#ujwbkEEJxiee;Wzg{x64-cA?o$ko8fAn5C%k|pPfZhvuJt4T;`|D5ioSxV> z13ymghZnAB+@Dmp9(z1d17Q&`Q<{GK_>V3Q9!5CzjZ*s=$9v^CfXWh2HZ0UNWPI0p zU4?^{YwACGRh`eb2y3EfmKZ*I-NKhSnW#~uVzsYKAx&d z)r&35=7gMsPb|tb5}c-m?KX>)&|LYL-@I~V@0}QT=fZ6-Ta3;y-wcE(UH?_))%RF zY=q5*DJRyoV4}_a(X{lOoB+)JW>Y!_Q%C#35HF3!q=~0Co!q$#)We2dc!KiIKTNpZ zcn?a3%jxC=J#>C*j?dNQ)sG+bQ8yk|_P++$_hUV*_r{Y=6+d8QbG9%r{s^XipmOkz zb53zNHT%fJ&F-eAdBhmhZnn3sMlLm*7nITyE3)xPn#Z*!d#u^2P|y%74AQsVM79&5 zh8bB3lj<+1Zu}sp#@|tS3+>bPw14aL%KEjTcna3N+J$N!zA?}ARC_v{!ST&{n(hw9 z-8C~MSVJd6?c@yb;zY>)=IT~TA;ysn-A*)@d&A0CEIR+AzN~K-goucAmCN0X$+yS} zSFVgYT!8@z?&4cZlw!Iw;Y4&cwX$Wc>|b}rePwV^_1bouo5Z#L1p8;I=6bJ|ykO^P zfPd7xX5*JjgtI{44@j2$@$}2%C)@7$95E>nGNS6OCFWlQ8?sHkiOQtju$_#7wT!3e zmpavJFK{`GqHygpwq7&r1Jdc5s4>pEsXwZ>O~ruz2~y<6 zHdqcwdt+_?$*Z4bB5!IFdc{u?o0RqHwWsE*UYln!Q}xPxiW95-6>%zVBwNMA;}hG4 z*xc7IXA_diJ>7=v6`;oh?b8}4gTOb+3rhnH&OoTYm)8+lKrpfq)#MIB^Oh}|y2^mz z6$dj|b#gT&WAAdJENXWbmOC0lgCV|@pIu!vBi3(8)E|Y>S+}~dYDtRbAHgzPd64MD z;%WPdqP2mvtCR|x)zlbf{qwO3;%ASHN`d~s%W>(zsF{S>w*iZQ`9omN+Z)d>I+;-L zO&lo@2@~AxMjzJUa$Uz|MQiqt$1fiqf3>q}AJz+BVeC|Y0Q8+YxUh}c#u??pE>8v| zAOoR`fPBLFh_eyPK#ngA5)SG%B0{9Sjl>q-{+8KZH^*f~LkgmwS_N+VO0vBNq^i4er)~czas{HQdew^Uzyjpwm=$6R(UG zVXQ;oTC<8)4AbmnvH?YW#XcfOpy+_G*AJUj4mR!ejtO>xzPBZ_Yyd~2S}H{V^(|;Y zvZH092CiLN=1WAjByrs`PZDXkA+(!|SC#!yZMxdxY=h1{Vr>@^lzAY+Z_^BYN9ow? zrQamceMqH$KL z59ZQ)AK(4-^zB!!bNcd=Q%w0g75q<5d7g3F(B@f;H#*VpSQwJnnN+CCrl2fhBfQJZd? zw8PEY%IVg?|K#IvTs}Xj47S5Ye+gp-Qi}n`l#H2ytyPSxULX8%WVVXQ7p5ns)|kXo ztWPqc-$N)!fdMx6x65^W&FZ!b65cEWBxJo==Yu4_$#~7xjYTS8Gd$nalq*+~G=nVY$`ODL%e}Cq3 z({ELkLl{wNJ=Uxw@0nWJ3wz>&mUFB2r*}mXsbgFNy5VXhc{UOi%(idOezrYh^pQn^ zfUWWwo-%>Rz|SP?k4;ttrqo#mDCa5~Q*pV!3_}BJpGAk2+91$vTtZHw) zR@@<6(;aBw4Xm4PPn~MT_IRksI)~@O=I~v(Kio#FSWMa;HrM@1uA8?vWrvRf3R3e{ z+m5vn>}8X*-hdaAI1{xDk4% z=$4(7@Tc3|c*y&T0!T@a&3lMzT7Y{#FQ()Gl~S=eomb79P=bNMa>%y1n9zHsgi!eh zSQ^b2(yhw2SrZGA2QYvl!s0d4{_B`>aPIvdoAZtG`ekhSb0%OTDXK19H7_9EB8 zs=SDW8L$SLt15n>&Ec)a$t5b=ww7wLX8pZr&+Gc&O$EPR#akXuiGv21A)2Q1hL-w~W z6S7aUp_(TjAOHIDsEaGg8L*Y|8yJA8Z%P<{_e?|xOW;AJ9G!X-g@lXE5nnEsyJ6?o zUo2VJLlP%v)K^sutibk^y^C~#k<1}zqt_&QHsWXxOh;7ZQ;0rR<99L0dbMw-nD=c` z-GrnxFeWz&U<0V3zwc|a%Ya0bI<;a+>Bq-k{`y3O?5bxbIGMH8tKwUFkG>>9t6MQR z3_%inlqTa^P--QI&5Nw>c)4O%N>G0Q0(iMAR!3=W?Xs*k%Kt^W$W_#{I`0a#U|ZEW zshp+5F|U_j7gcg(oeP`Ls6hmHQV~Sr`FQ7la=g8D^%@=cc)K2InU`m#kqS34(?v}A zPJ(CfMeChve!s0QmKn$E{ZJ|^3G4OA>%uk{ORoite|8P3SwptH3HV4)?&gUn|2s3t6ZGNTEG4F2I+uc0dpP{^jwH zr!QQdcuOpEIjWLpI2CujUaNZP_nzS-UB)X}9!Oh8M1R0|c^Q!F!p_rbAgbSw-gFsI z9fTQV6=UhY#DTP z=W%Po@|>fpXMQ4wx81M>*^BeoTi_fyFh>UWRrBBvWsqUPW4~gh?c9uIrpJz`?D|*c z_CQ`bn~iNTR9!aMMb#tRs;)YAb|Flb4?5yUI~-c;1jGOifl06Q2Qo5+k{>@flRY z>-D|}AdNsWWW$c|2JbB>LSngxy3;qPb;Yblb_!)D923`5$LMF~yXa|a4N<(@<92Kq zsB#_hgU(EOmd)6YjVDzf>1EE7-gSdg^Y$79CvOyi~%BV+Y)-Yaa3tv^{I&2zdwEY`|}qy%Z_!&FnaSlwiYC^ z>*GLbF-%@1zt=v*PFMO%IHGH>(hFg!%CTnKUI6)3v#o-{zZvqZ)HAF5_4{ReJ|0A0 z?_ODZTrpzq=?llzx|5_-bgI_n@#;~LTIqEI9O-1Ce^BCLdzbU><{Q6TgrbO5vl2@Kq%=Pr<^DciC z9Tox_`p2=_sAv_%HE;3=$I+uWGF=9%M#Tbu_fp>ln`&jx)@Psm$gKKauy{FV+lwB~ z%XFzW=|RnYPp^Y`1CWC^d037(A2CmZZ0~{Vx=eoi>+81<@1AVo8RL+w6R>~gWj2v= zB85ojCV;TcAJRO?B6|pu8pf*(=cluK^&ws&57|rfn^0pNZtb0)NrneXx@#7A3fKnB z9|F_3OP2lZua6%dKgDI0{04AS@|=j!S0bto460E79d4Umjy7ynceqvE!FEEMYn!;g zuGd}{cJTJm$!}ldK%U<&{TEf;QU?we>xbSaRLGb8t(qCbJ)7F-O1VIk!QF!@duC<` zceKhG{!2q+^_2MLr8)yq(902R{5e|?b5VRZ-f_JMtr^)=Pt!$$%gpkS#<)dD?Y4UiUS z? zqsJ$;!~E2V!6lu%szpt z@fiWqhMM8^RgH#of`+U{a5H#UzGm=QYt3+~?y46*uu;(_OE^46z6?#fxm`en2hjgO zo@GamDXf1WZmD^LDZTSIUKk0Hbxd2)=|-?Y_ePiX1-4s&oZ6Z zf_n&#<`RZCS8LA0OMD%Kg}u$WXC0J)#R|Pi()3NAeCWIbyk6=h26f`4z0czyzAxBt z#bjNxIfOZLfxz8GQpe*scK@OC7U9^OIW`osIbU`s2qEmo`NWNf-D2Elo_O*~(;Z^h z4W_j>jJ!0RH;QC)aaMqX6?~cDLHJQ*SqA@q- zLjF0OJa@i1ZM+ZK2gaL}%^Sv>2=l4hUO0ENp_){f7eCnlN2G|j*svkIU8$?;wpGUigtQi44C4VxVU zlc=_=m-OL0%(LFeTf(u+=QBOav4%HkbRVAHeg5<pRd@ulFWt z)-TtalXrdAU($HR#9F?sYwyE)|G|=R6Lgn6W{e$|D!(hvjTSU-q|Hj=icQ3n0UGa= zr$&&-(6a-B$PO9XRIX-~nNHnRU$rPxV@%p;#>pG|`?>2;`}cRGu<%)R_x|?wR_z7e zqI!>>OB{*p`6YYL-<*$_{vfGIN#@`C&NE?R{NX8osDFFy{!)N=X$=XO}f9F2VI%r`wt5d8{~XGW|qY#p3Vu8oL|Wfno`vTjMI#mfqO;HuM&XmttF_^Uh)zPwq~GVT+IVWJH?V)43NvM%YrNn zEZH!r7{Y?BZkL^rEnWA0dzXZ2AXoX{p2D*ANnVhO?Y2Z#Ot;$iO?<#^?-bg4I`qC* zaU>!s5sML35AIpRLTK2_WkkGJVv&!Ir}J!3lpVc^8(WQeL$Wj{Fdxe1nlb0Bjz!m$*AJ?zKltViRKwbOnJL!JC^Ze5e%@npB(uXhO~Pt9Khy z_!@6R>jiXb^6ym?Yf9CB{)tzc<3@_({(rWYp2>QxzMy`qk4#V5*Y}eo-oAceICfwA z*g2NMl9{F8P+T|=wKAZF?m4zedHPo&z14xXuGrrNf>Gy~>syP9m3_UaDa|~-Uzxk6 z(AM3BG^jg7^{;h1FuyWkpGTFY9-A|VxNt@_k$^^gAmc*HfZVrR7Dj{h*-&J>T(!;WpX>Hl?x zs5t_N)Dcku`t{x8`TT{bS}8}%T-W!5KC8Ni$f#b9VHSl!bDL|%(j5R!ZxOlDNxy;Y$%CwFmdS~*Qp!Z?9V+^-k6-?!Cf=_KaU0GrSHD`a zoq`UQ0mLH*O0#;^#4=i>+8fVmV#~YFAK!Cz@-F6VeqG;(5v7s`NoR>W1=-~3SFb+K zu=s&YG%z{#j*W{{xQpMq@yz>Ie7^4jwoFDc`*BB_sj)O9w0WKM?4$kcV~e0n zwR9^Op-3Zm2-q)1EJh^oQl4(4Vi2PbaN9EziG==D#C@Q@jyo^z+1Zt^@|n4SE!`jz zuu>9S`zE8fOwGG;?`Vf=J92oR319Xr4TC$^G&l@0ci}4wv)IbJev>;%Gih?a=HE{1 za#zfj$v(Yq(p|E9xo=P)ch4JEmhEmY&3Tr1a_6(&BtkVNAhLc@l`2nnw~i`}Lu!?( zf)$euz?#d}o1Y08ixjdgtE7xbc(vR4VTt>*qW71Z4~*k_IPv&~@jA6{IyGB_8I{8B zdS9y+zV5}k{h`R04`~sca6xKC-R`=-ZVvlH2h%gHs)yqn5AD~xt130MYIno&x<0Iv z-R1Vii`e57NeNN30UXjS+)Bd|)SOZRS;^>MTAL*%{R2BTOx;XKg#uged9-I{<}MCz z6-c%n>g1O%AO8LCkN?P`d28XN51QE0S44k?9dBs1+a~!1paR`pYM+Vsi#Hi; zZL!M?wTIJ9q#Xxo130iFhzpG=C$w+yhe7D^_R3+dYqA$el5vnLA0)BHNm)$wszow0 zUQ>nE0l_%ePD;r3atosND2FY3pIC?lV%VTlBPGvE0VE9~X$QFH=9m7+XL+a5o#F^J0d(NE{e^Y6yMFV= zasZxo9VKWSx$B;7Fn4T7RBs`xI9qK;cV5Jc>bYm`upTdv;LxqIYx~Px4Fut~p(+;P z#Aac|_BH?+t*uTQX3Xq7p>cO;Jy&dZINlG8`$)JPDi6NynzvKG=}!~cCBH!Qy2d*) z?izO^>j7^DJwPsq4Gy!EVd9;p#ClFVA5qX9F{+nFg+XLC+u7BLjgxkb_d(xL5;=@T zgk);A9FMtUqU4V0Fl?kP;=fU(i z$2%9sb4HR+gbqpN2=-;))vnbA%!%6h^aeo_mTFCtD$*j8UsN;Ou0HY<`_t`K`|bUt z7*kEfwzj(!8~7!=>WvNM!2IE*Qa-Kj=ZkY)b!T+WNVK3TUi`$fo~~{lsuRlZU%cVP zjty>*u2mdcE8@LKS#9b9T3y^rx(g+*fUr&pFFiqV=b7mN9h(vb>yuxYsP6j?S9hq& zJcVp-t`EHP=vEbHb&^KHz>GVjb|^u211hJGrW1f)Ob`-yAVY- z=>2S>Ymeq{z4N+E&Rg2L&q1Pfdy5l5w#-_oaMhK*KW?b18ng8>Ac%Vm#1731``|$M ziFoK`d-G2Ag3B9sRRV4S{cSc8l}WQYTyVmrNx$7bOe8*sBQG5ycljc|e{d7)st_ij zfmxO=MOKyC_1mi?)nVTy+shp-V#^M_a>l-hYWe(pVaSWild`?8b~`oUbjb{BgUr}& zb<0!-Iq~d6u2>dnqKvh@sHii&Tg2mPkncAYR|s7L#@J2p=SxhD!>08_F_@Jnh+6y` z6DDPY8%`8AlR%!CptEkRA7IvAxnX86+=*js>eOVO^HwIzx&M$Bf(c3M8@k+V_eemA zfA+=%yEit~g&do@2(k*8%>vn+(?s#*o*x2Q*_RzhuqE4`6+_$p_4V}*sHNP3-u#d~ zoaFl1WUcldWL(}W*?(=Ww+&=Ki3aOefRnXy6Gj~Z4a5qf^XkVpTk0SP+rWU%>B3@W z2i{(C%aQSPjzD~LFN9x^T4fnhZw%zNy!;Q%e^C3?ZOJO$a)0ZMaPYUq&m*OO+q>s# z%N~%DXWKvWx7T&44By_*6&kmQm#hexIzCH&Hc@cf=hc0+?)F>i*KNzeFF5b-8)f5< zpZ|XP@>Pyw8Fid`>ue|;&e!DEISx2RK)~jXYPop_N$}hQbkqw@7|eK5qPEOJ@vD@x zd4@=C*<{PWpaf*tpX$J68n^(M*A1RuI%YkIb)7wvJVmUu)s78HgUBo|5_^g2;>(&o zDX~+xT`BRK*AQaOvk!Ft`NOwwPw#XoeVG8L78tJ0tBG?zVCer~)gxODo<4QW7IM{&=V1zUP`njXhK zeZr7z_jk`slrB{7SC>F%fPJ<+=LAox+iAVJzjAjM_i9v1a`><(qe75|oaaXJ8k=IC zCO-#NX0JQ<3=8RR-_nYso&59Dr}s}^blozZAy9hl>mZ8&Rc${%ef;p>3H=Xnt>%8}JGT0h~eZtXSs`SIJYywUp_QVgr>D!l_r z48@K#1h!3uaLCnqBnYm`2fhKG-1u{K8P*);v_)Cq+*uK3e+k%<2i#I~GSzap4|?^d zZ;xO92@BrP4Hqg)@8Z^AacWvsHzEwPs1o@ZMZr;CwVNJu-P7t3DT_>>UNskQeY&k^ z69PNM>b7z{2&xgwbBYaxC#%?*eVdin{v-)lzg@h!c>T8K7})w=yDm~2WFxs*zcK(P zP!ad`iY_r`7ogrW*Rbim%WD0~Qh@F)d3xngsMSrbUcPg(%V;jDcau@`ZPZe|7GR&)LASgLQA*sKAPvxT&X>bClZ zva6?V44KOI>Nm$p^+`P*BMnh^@eln=`?1ZptO26kx|~DYF5=)`_Ke~ zVlAn^*I(!9eEG0U>e#%u=1kv{vK~XJ*L&hM$Cu>k)3>KDe}4H8*CeBDe5rb*?pQC& zG*W318<8FAXby?#V|8qIQg=R6K-Z^eMsk{)rFwnp$6e;eV-yAY130lvc)GJZAH--d z6gkAN$asqrl#J3-;zKC_g@OLwnk8CzN~=RMY$SQ|6ojWN%%0k3=4aFb8Q!H*vDz}5 z*S+Rj=>u_ku!7$H$AJW*G8)+NG%FwE7n9i}asK`I)6+NEHptu-t9WdjdZpX9SSuY=leK}3{c}m z0ovTyC|2mITamwMs6P@8Sh}#pM}n4fKnIBbC)N>I`^Q&B~TaN6m*ZZ-AvZG5Kr?vvs6<9M-O10vh{isZM8zNb%Cddkd#Pa?Q zv`nEAVLo-~R!QmrKcx_REv1l_RQ z5amy;I@;Sb?z%ic&)?WRQ6Ra-J+=J;n4|jsuTSqDKk4#xzTN{av{l3!F_4Kd0& zNJgY2=OpHYo1GMF{gBO*_iFLn>2uj!`7c=Cx87V)Oe(;u(s*+%^LbS)lFiUkn2Pj25`qttwf6{`>3K$3GL+ z4542N8=m)+<-`kO%jE*nu@&-$mesIRvR$6M{jY557dzm{oA-(?+UUC4`z3XCV#BfF z2MwaU7lZ_6OU)MO`r3G8(H2n%5LW&E7QeNiSg$<{Uw{;YmYddw(YA8Om!lsI7wq%Tb)!2GW~}sL0&;F z!to;@)0hQH(Y}8nI(xN*t`ivy^s@?MnIDXkvB6Et+R%}a%X^hE?nt`f$NSjeP}iNM zxXCJc|M}CWM=p+>4HXzqvu1F^#-NxeTX4s#3w)U(&AndIeHO`yI#q8Yv0yLA~ymuUL8eV+cD)ymE7Q z#|MrV8m=Zp$PTT__7YeUbgZV%xTc8dU5JZ*!=vv%zyC$qoGUlnO(>ZCrs5~UuIb4} zg7PkzDAb?euvbY;Hb{yFWogsu4a!4Dior3?N)xV`xVSl}S*tf6+P6Jd&8okt>B-2@ zJ?^VAZ*Z_?bad0aS{49GmxdD`Hi=I#-4HY0fn(F$x~8rA)ouCzB&>Pj!~_Vt$D8b5 z*sx7xcVm9H$U63g-85`<(Oa59>DheWj3*s&fD(;tHa~r%)6Tn~G8t3kWCva?YG{F- zdonjo>>qUu=6zhn^aoVMa+zml-q|FcoNV@yYgmnXRIb=Q z?^b*4x3|@u>$BI|ZPbLO9k|)nbE+lNp8=-SKW+)mk`w=;?dJ4%LSCT(>(LzG8r+eqoz5^hyy$dUTOqZhiL zRGYj74EB#{T*}=bSIuA}Xv}ci(9ZSh%1tbdW%Me|(`8XEmx^ta=Q$t5PD+ixvAw-w zUj2slifa7+>EpM@%$FEF;|V4hZBzp_`_;>=p6gv@LVl=^7zZq(@1B^zf47D4vcCAM z>vMZIcqyX{rY3H@-6gQWU^sHaHb(Shi+F20ku~91k6ZFGb&(_IOk}Js_DG`Hb$K0Y zWAsUChI4tbXk~@2-BtAR=;kN*W;nC+&BkkW4NP$Y$+#Qx$>yjy-7FTUOKUd;H!Jsg zZ>qO9j2dIZU@RM_ZL0fA)e*;pFV&L>;T;vIVX}!KvlP~VykYu>iOKXe$AB??VD=2)D0CgfiEZpR>~hlvP^_6((iliHNwSuf2jsx8He}nhR1Yk!Y)>PW zBcd|}nQW-|f=stkqy5@NK-`7Ej);u|w3e1h@~CtXqSGV+n8BWSimWfH9T~e)y1%EN z#ZoB<*ldE@vxq-R9kDDp1?r4NFB~xSoFZW}+VEU#M-b-^D6kN_0C4d*kMkOSJ82ntV zn0xm{0`tSao|1P=NWs(U&AOEdBUC1|{6?mBzsYhLIDar=yttG@oEgUr8P}IsBVnvB z2ffOKJ8GpQ@4hdW#Z~dmv0k(**XKH0q~$ev_xYdC-=30ne< zg6s;&uCqf4bT6!tfj9z~0DKQn!w5ok=Tj!w$pnJ23(jP|wfpWHdtK+MRUoJd-XL%7 zW$qbYtv9#$*tc&so48Oy4JK=jI)gBCeC=kJV+(TXO(;xibak|!e=vx29%5evgOgjU z|Io~Y5ipCqwHJf;BWB4v4tKs7Xz0-p-TIroa9gmw4UL^UX1e;|kay1Qv6ZXArgw>0 z_os`L2%>XbpYPN?o%eeK3u=ttoua3+^%aq=kCG9oHxf%XqT#e^I)8S1b!eCX?M&lM zJ>M}f*7=e>L`)iope3E!jmv}LcHH-jZPqv3u3HBi6@1-W9`TCP>Ac*N%2=Xa0qK7V|a-HOdV3=#)@^-6cJaBzRtdMw`^E4%j{g!6jW?R`@( z1k9tPF-E$yYTIwgU~NAzQ1z~5J6&5e*R}Hv=UcsFjE$Cx$kvCDuUnrK$<`-3{C5AM zs=s$1AOHFG`IBs<;_w2`hcM8Y{>~(>F^8ewra>4$3gXIRWI;%~)&nGh%kdsS;}uee zb+uv-Pd15ME1N4IAHGN`u=x$5R_#_FW32*lxUXns2*oe^!)ArxI2`XUnC-R$4(x3y zv3OW-yVGWkDmiy0_OE|^dG{-q-p(Ja8o*nl1tC`U!&@%l`0JO?pFX_PrPA&t zdAA=o>fpu)+9IP>7A`IU9ZvXW0Q(P~~z?AS;9Pw`X>YHZZ(l22wjSheYLZ4so>SbSlg<8Q6OQjoA80mOleK zS~>4boM=8!$e&on>>e4X$OE3bYRJi|tn~*rHrKvYy-|_v#hGchy*wY*7s@lUpPRo-_^sw$1rfQ zI)EI`q>pD@#!youcwwQ+{TYR3g5^OFAb<%ra;l_3rz4OZI;ZQ5)7gNdv|Kdya( zoPZ8`8}FXxkMC5RHrMXBy>BzK`l#@34u@8e!9T_MI?o=EzN=^Ee%}w5)f*T3OWytT zQy;NAf z|NIMA>wT^UkjUy5PggH1`&eB$cTa>3RZv{)iayVEC6xoOydG-^;v!Uet8s(NM&&tV z0BxXkta`Tn5zUYNb$eeno(Lea5BGa%h@kVKipq%rn0Jp~7|mQWZI9x>k_>iUTC-Kg z)yOiTcPz<}==Eh2z}#*TOO1-Ias!*tCGLH@1`O4RnP1ziY$8f4=4A~=_6acCaG2-X zyKOka&rC&nn8;!x#M_x|DUJ}Ilx4)Uf>WJ6WlfiPVaM^+YEZM!naG;8Vr!1v931kF zKuM7LNQ}$HHfks0=0qPw3ORefJP{61d@$j_2qWt}P555MV{IR=ZSUv7iNX|a*P>!y z*Y#H~IL4ZznM{!M(wQg~oI`Kl)>UsaJX_r_e8KACOt;9N7UiQpaTcTh>#^;ctnTy^ z%UrLwf(sp>f{hH-Hv8>S#8cuy^u5*HiyaR8WW`||nZYZIM4D>N_IN9w%<F!uG=PxUBXg1gciq5Ai3F=2uGK%G;7;Mj7o3dp-*Xswm;f zX8XdXc959d0Yl4`N3G8&#X_IKmGOd&yOEJ%h&C;!g+i#^Xny6L}LF%7&!uvu^#LdyUb#C4)FR&zodLx z^L@(GwXIjH_6M$RCe@Ax_r!wGpJI~o0$uButOhS3)aML&Dy?9}z7*G`@OEXnk4f#h zeNa}+d3STv#GfFl8ErubKw6_eefj+NCoY*?>tHnqb zcr5gdb=+rTU67tmGReg!X#s2>vGTyD1O5RGfSy3$46@clrU@0R6LNp8goDc88%vZ+*H-Wir$5q zpjOX4v0B9kjK_PL5VESXA_Gygt(}N6rHQZCYKn5L3gf3QkMBP|{e$&}omfF~5%$UI zTt8D=topYoW<5JW$@Fr-RsZs$H0-0(LszZ4iAA;?{v-6Gst;r^F9p~*$J1{^(dro- zU7HLTq{UA?AMjC0U_wDKA=CB4aIZYnzKW&EVOQIntjTk#HeP*C3ZXn)>%;oXTd%L~ zl?OQ)aYb8@mtHpPz$mP)Hf5Z>mk7(zoaK!@cV+teL|p@sHoXCNjQRZ}Bp3I+lnhLS zkYEg1KYHdrlXy$_<`pO+1G|E*=sB<)R;z@;X-IuP8Ah+vmajH(gI9Rp1E8Yu{!{NT zb$&@#QAHuP$rL?3ef=;Jr*kmbwC&wf_F;@}7%}UitzICjeqPOam_u$`BI@WfELWVz ziBlFQ;MI=r+%*o{uJ%ULA{%!2&EmBdUw{9{7UPk7P?p@9 z>@4g}=zWGUvE5|N@rn>H5i^M$e||Eh3{~#s5s-?kom^?s5}~k(~1$0toMc z8iOtal-*W`L4SgtF~}9$Ioo88te|?rE#=Cz%*Cy9k6ORK^(K= zCOcD&DD!gNZ>oDbF>tI?n#*RW@AXI&d(3hEpt_;y<7_Vu8l^}zQGvvEE34SPk>$#q zL>h$L4bBX$pV`^uJu1|eEltdP56p~V>u+gWgln^Vv8U4dsvy$Ao@*2Ook0xdmm4Uo zEG-?evXk#O>lDrI+?@TaWEAh%otm9N^_HSjxb{08)*Z9MeHjU|^Gq_xroZh1nSL8Y zVU`CT*}-PruMM$f3aoO{?NAj1H*w8Dq9)4lit=B6dV2g~eEj(Ft8Y|oyf*W4gH^NH zIQmyiDqZcB>YOtuqW{Ti$Nywizxhz?yIj=IJx0?pacAYz87XG0Ps1On_lQj?=J&x+ zGg(r^iB(_s{2)^9Pezi570xPh>4Pc#p`g1>L>MslX2Q6Xs2BpAUuw3Eqi<5|h!MMp ziqtGx21koNBpJi-9iPCeHnN(DVU9WY9vXAq9hw8sTq&V73-~cF&54k+AvU02`|Mhc znT{K#9*8lf05CBH#AqpVG@o7!DCnyggAc@HH0&o&Q?7i8Mpn1G=KIb5v7pSb?g>Mj zxGk)lG|{N3cj2mzc%w|zUd{oG0rPrVflFXrZxz`uCf{8G2n!;d&;R^0Syj<~tGv72iW7r)RVDRZva6!yKa98>kq9u!QV1(xSKe)N zMMs29Z-H(?5%!U!Xb)bz?NNfC9>0F2If#`X89d;!a?eEOXUT-su*LA|j`^tZL^T5f=KYnEwQ2RA$A7 z5X{Jc9Bs0bkMTb@n18vdy6-n$)>$25pdO9bBlQHbJMx2gPk+d!xgyU@B0y1_R$Vk~ zEAR7V;E3KJqeK1ow|B9B(#pGu^S<`Bs|+hXqrEl}HSNVRQ>1tBR4GVH44Fq?!_Ck* zPq66JiSOQ`pL}EzyQ*~IlWTsCj~OaoN6tCkI;Z3@bV`Vfrd?SRty~r0d>88!f2wvn zr_GLO0*dU5%JQyp*fy-L2BJ`kIDUPUrhw*&vA^e1icGk!Lhbi?IV(C#S3YP3aZ@oq zg62}KSzrlNuB+IRZeu_@saAJRGXdG?@~6k2{(1lT<40R$GefEuu6W(bV!WbxVJMv! zRIuXfSIjfnm|Seu&j!hi`u>9@Qau+XdS$tsD`O@<<(H4gcfUyu&gPz=l&sQjx6iI% z?S(NFI?AQeTdKF$VY3F-&#UevGQ4iqo_p3MkG{z4Y}+0WFIiH(HiL|c{j(nbe){_P zkEf)1*?b>rnVgeey)d3wJ#%CqK=xx&jgo`C7Rdo3?69kde*D+tH&vZ`6Sl_Xy= zaBa$3TgaZ{{3=>oGA}*Tl^$d=(xkfH zT^(~St15he9#W&tb>dUZt_C*53$jTbzkPdr_d8dtxd0z{@0H_?@aWQ?9klDIAGUO> zNxUEShYjfQ6;|0*8x7&etrM*FTeiwd-6DJw(KS#Ye*V6H*5yXi5kZh z{ygsS>BrG-B7sRv#TqAM0sJ5jtgH~SS)`oC>_7PyALs8zTYVhH7gcKC@Ac&6db2PR zxvD|0LPEFA0j9>0A1@bz0<+Ej~M-*~yILbpZDS&%_;b_X@{+*eMEdkLS>gei}A zo1_+pHp-ihO*0a&bZ?aFFKULc2P%u$Hr#LCdM3v`e);h4&z~L>Z!y87GKftNm-)aq z^5JFI^YFT7BS}5Q@Sd)#orH4r{Y9mnR64u6vN~THI$|awJWCUz&1ohr<30%2EPv8f_#CNElbtKR)|tFt9CjAnD{abjLt%8Dq9ZghHy(t(xmb zsceD8h@_g=hm8)h*@*G>y0wGN-4AX&tre88WHm`pmo3wmhY=Txk<3S&jp!GP+yVyX zcm-451X)32i)!+}N=KW5zP|sjjpLu5x> z$7(hKyZ2m8Hf)GKZgo|iE*0|e!~qyr$@nzzfXg=~nnIGFgcePQ-~ z)jmi55X$am{i13;7Q&t`&yEHW&IcCp&IKwJ?YYO;SJDWLWDt;afBg98uaXdK^6yV- z+gJ`DGV~T{BFJ|(sdFza%zNp3^Z2V8RF7VG_s9f%LeiGEMZi2j8KynE;D;53><(LXvk;9LlDkng(zUexZyfF0k`?QkU@z~bKp(bU8gq&Ft|Jy}4fZKW(FjZha zl(A|(FhC-%noCUvA*)j2P5OK!j^7pK%4Zs#+L2_r2}bAWjK;#_$H$)@|4mm4kbqM@%XuQK#F@l`glcQGjlU#3oLDV)1lag+ntV zqiPk~6UcjM`>LoL-|21_Ox3^5k;$x_ABlZdER-tJL8xGNm*#xd8+WQUhBszKOf;#y zjtJSvc0A=G(AUhymdTf}M~mvM?UlXIt1Xg((%}6;1pDr=8NNeStu&Y|`v+C^>p5Qu zm|-et`kS7pcT8}rHqR`Qze8Ac9_Z}MYCSpMuue?HZsSoQUsrxms<4I6rej4x#ZsZp zxbaNsAPC&e?r=I^UxF!NH``FJHuXzo59*Mp8&4a5WNm`Ah#*1_<*1Q#&B`1VJC5}d zP$jW&C<7WgF9Y@V^`-YIZ`GQuv=1Q5O)F0|Vzmg&y-y=a7@u~c(!jcR%Kz*2msncB zm^C}&O~fMJ)No#{@}Slzex^=d6YR^B_OVoX%|W;OIJ zYw0-q0^MUp7m%Q7S;5Vb?3T#UT?0CLRxA#!?rNk}tM%c8xnVtTb2v&w{q*krlTGaZ zCmvu@oy_{qcw$n~xv&e!1G3C0<9whHD8>;M{KJJ$l&i)w-m2O1@9W|AR{kYAOC?wz zW|BeKN-nc1uZjxHF!Q0HDVJr-S&=+6-Fn|uO%TPx!?p><GQ%*B}BFn{ME|5;HA7nl&s}YMld-)IDh?dLO zSAnALVJWfnfGYnmzj!C7Hu0G0T!?8IJQbU(OA3o=U}A-iP6`e!V8k=6KlO7q>*w zsgGE4rtea*!A~U1m&+o}l;q2YRMlRdkuu9j$>q{>1eQw`ZB^UL@gFwJvMdD)dA3xv zl?9l|C@~1YGAnszA$=p#3oLYZp|n~qvKc>-v{Zgw&Xx4bxyql6S&_ySp$!C>{zGXqM3RTX_Vv+NrVy^q7*fPg9 zS9QJ2l>=P%~kfwpV^4Dj4&0UOc4m`9rRY zJh<}WEL-MpT*!}Gh8HT{5Bjq2FS;syRP!>mzl(i; z^9hOzPU>1bD0UXgwlegjipQ9p#iSABU?yY9y#>}YIbD`=UpY!Tm?ZXA@Efx-aUSe0^P)_s{;k~)!$%2f! z$n;2Iz)1PbjF)F~X`6DC%_tuFVMy&*C_Pf&$a#W$sdC67oyl93Aq+j9Di1E0#y+Pj zh}nH}RbtN%$^55x%f~{IK7Wu#uZWsIctm3U;4Sv%4>7$(L|K8Zh&iW4%sEA3&eGfY z!}K4DWRNX6@WP+Lq;Z}m{sddlgt;EGV_H# zXHI^SArF+ADvCmV?|hLJXe zl?Vo1JV>4iW*GVm{7`YyTV~6m1o$%Mx=9wzB<5x&G9=CB%7ik~5<}jWgbvX&M|8k> zS*b*tBL*c+xTVZEFEdyMQ>K^~V@yd@I5rBEF^M3Rd&;7K8e~qzuJS+UCnBj>5K+pU zMGkP6HxwC<;;$+j9?X@Y=eZ=mevml^R>UFsHvG>Be#VV#sT-<@WDq0S%n?MMlu_`5 z;HJP0Q9<@p4B|~HIf+ZMLrS#^%x1hcRneWNgqj*_o)Uj)#-(1A0X*X;RCM)Ov+HIt zr+=e0h5MBz)jP^~F+vL+H#P zGjiZe%8|0)%u)=H+%?FMkM?gdLp}=hCn&Je$Ij-Fa>^x32^U4gjLJ*~^_PHYk~mw$ zJzJ{e&gK$as(X|JMCYo-3KM>iya1GrGZd7W1FNTz#1hC*LNJ?$6Wu4%LwEuIu7ILX z`P@#5x4zxxW+et0MGg?=c%9=K!Z)c3n3>CYIeuSBFceUX9FI$)L$yUhNlIMJqnqX5 zb1R^;67P_+GYMD;ME&%w1(Bf~%nzc+DP=OSFS*QNl5^x@89bEAE7h_xRPq(hGU8AI zlaS;RM=FhTg075btBl(jk4fO?z9U&LLsn$-8JSxWez_!=8G)BVC1d`e@~JnaCB=G{ z`VR3XUCH*TB=3Unk)p&eDPQ(%MSV%iYtI(d<;kb?l@BLQIWE!4OAcTz=@%&JPb}#V zP=r3n$hlN0kj}J_q0(NWu9Y03TuPV0z^=e9$8I{8eSl|4$ztk~I({yg!|_BFsG>!n z5|tTcl)RU@Ny>cOEMTh9R1uewv@-Y}MZuCP7J`4yojf#Ok^%JNo|(j=3>2jtl3}F$ zM3neSACdBb9|V;O@mNZf$;k0S$z7rV$j}XxJEg9)LqN5bOqHDPBQ9{Kh}3JzGUR0? zFP0gK9m)$o5mlM`C6c`gR7s@k!-IGk+p8F#PP;%)!!rAlpNaQe?Hn07hP=pCf8r*Wq{sWf@h$Mv!{Rs+=vn`a>`6Z)~;vhwR&@WG@b1^c0CIk`XMn4fel5!$LQkj^6 z;jqMzWGJYPRb}H#4pZ7AoJK=QxiHRY|4JiYKCb|>Qz7Y!k@6GKf6N?%>zwSS+(yer zfEA%fRLMyBB}K{Fm+C5_Caa{Y!b`czP?W@!MYB_N9Ga7^cpaJ$GQ2=nFUVS@0Rvmf zQsrwIZubImCdp|olRFEn6hAXyZjTV|Dh1R?^8W!}ND`V9Fl9Lt-cw{SrAk3;va7U= zj2}dyE>w@mz^AlSOC~9D9+v2mLHet;jlrcvQGps>p!%yq;zmw=SD26@Dmn|4QW5__ zavB->u~4SSrD89+&j;l$=?dclqrl)&>WqvMgG&NHr6OZSzC*z;vN^UYV=}lkqY)!7 zDP=Oua(*It>9^z=I*>jc7i9ko(Lv6U@ZqD8K}>xd$!sFwLX}%Sk!&RPH}m<;g?CNH zT-Y+5`>~XtNk+9a5`vMsxCz{MEwb>3ri-v%%mT6pf22t|5`Spw`?ThO(RY(_B7|3M zF8i+hlG!8D-S2lHanFaru`0*{{H|;smWl*DBJER#3ba2lCDf@@1%*S>Nk(o1H&paR znlXGQaArzr#$(P$m6p zG6F*w@@vED2LWB``OwCmO!-h(rvcJ69*<7)rW?GlCXeHflAPlyH%VTtcs_nsBqtD8kpWG9*o2?6De$N& zK)k#R|4P!u-ItD9r+VDCy%aS=d_XY;r36 zL(Y$oLUK*>$$j+z1!J+eT9LVIJUIxEMwMNc0tpDB1!(W|2CFFPt;*Wt97n$^BT6 z7wN)2rVEELvIP+LLNu5VJquR{xx3d4k@MW^h#8J&@rE)&RL)1R|CDHZRD|0iUNk11 z6z%y#z#?F@^h+Y5T+0KFFW2&bqtvNaPDD4;ObHYC-ZRQ1+ITbya^AqtNg94|S zfXp@z(LMK?oO~W)S+KB6>K{Yg<7X22(S*RvQF{#YA|S42emb38k3u>KkEP5d0OoNu zkE=+)AiOwTlF4a5j1ZQ@+}zbZFpI146-x5}ee>cpGD@0SAO5Cv9$wFo4>zs4BK0r*xvpP~#*wp=l>QTr8#V&z2EFA!2_ZFBG@b0;2EUzN+m#^K0|e*VeiXxq)mt^QeshbH)$iEI6~83C!Xu_DaB95mJD1y;?k|id7QR)g4;Dw5;R1MCcVUqWN zA|N+JHV9&W7n67X%#?mngKy3wGAwBFkvIaz;S!6_k?TQEtqdI~-Uawf>%St6ziQ{rv@`Dr@8Ai%agbyegZ!oCUDqt8oS0g*8 zCM(^ZcR#lB1^+>AC?{tI;;d9#FQ+3x20cQ6+Zd2Y)*#D?_*NEPSUdvuB;yyv(Oz0g zEk-g=M-qOHN=g|Di6FePmRU~uq?`m+nKB*(_0r2^fUoslAlAfx(AddiabpqtK zg03BEt1uKaMnfR{L_%WF2N73%b`fomf+j2GXh&icAw&c-yC*x@k#h;X>v0uw-JJu= z5oeP{Jef{T(nz!-b-XZA@9M0W(!ZF}KS&9orv_LQ0ja@32o)9xOGjp?D1w=vTTHJQ zC5IaGBxqp;)lbhuI2Kd=RYXIh7+b24$n+*@kknq45jG15L4>>vPs+%bg#?E0(!B+Y zmJtEP0-;EcbX45G6RzCXXfvGoEx770lu)5;C{+nvKNYnyJR> zjdq{L(^jAJN!iLL9V?%jRk`cA#YA$GNU1yoSI+Qd8rS2?5oPwyGOZlRY_b`jif2Zd zmWMFQQ-4il+&m;(J~gm%XIm318hKQ5`J_wbV`s`p%8A(fGM*^?+19n}u#C4B{7j}B zMSN={PYAy}n$dtC%H!=hzmWutq0OgHrCU^BbxaU`jTKJzy?T31B7w7qLbsgprKM2I zIaM>MPVyitmi!>DCNrr}`axWCCgdr85Qjzi2EE>Mr3@62EEM_7oppwpA+$#bCRt1- zA}9-eJ_{+BG1JQ3zE0xI9dmg$HN1lGRLb-=U=df8fh=`5LiCave9t`!Sv0Y-DMw^e zgL~>6&7<1QoJF$8BH7gDHgRNyN-hXbW8RAh<1Yfoa5S>A(5i^xsc)O!-d zx11ZYXm(}kSg^B6bY+v~?OGsl8L}C{9*br+$ufvdvOzl3ESOfY(2J=07X}%8UCNia zEoo)UACXe^rF6rjRCy`+Eg-FoXteILb@og>6&vsy$XxEc#SA{TD~ld?$UfM5%%<9WS>C#^qjWM7wL~N!ZAppBw#IshH0Rk0D zF_0R#`HJ$os(lp{db#;`cqtcp&%t$@)ke&*qY4(=C6>sHRlKoS4M;1?K ze>ZRR(Pn>pokNoStML(rS?oTQeY>&ItzZU&7W(V5eys+;yPPH2*U|M? zP8pP0Ki8e`-1o;j$W95_S9TT6zBU|yCal+&TGwB0ZT%J?AHT4-$`uk@D`sEfsOIdy zUSxm2C5XO%KmOPMVe&e#5(ZX%&y4xY@LKS)|9bp){`c4a4okT?zv|cC201&|;q{r* zup5Q*&$?STtt>c7m9PE7+ZTZ>N=~v02YJ$u^n0ehc(nEhI} z=Ti+;5=DUpAi0E}MK+tjos1J~L#cAsj8@9%IwaG4e1-b6+Wuy?Zv z1+7{`9^Nx`!eHxS@~p__0bxB_Mo^f>WAHsRGphgdslS`#c0~OyNGI?kDbjx=0SObR zcm2jV{o-O4P#V&(bYP{BKLiv8YaJ%J!G13zGM5VrPssF(i_vaw@W(HiAOM6n^LQnb zd=0aJGGKIqIg1y~rjXBE0h%lWY=(Cz^+3F;^l-6>P25eS2omnbhvV&KyuFO?EG9pS z>AgjKKoKD?!Zi&HAoD|cc$mkNkrh150^|WHF||+ze8@~}y8+or%T)^8h=irxPf$fYgx3J?HAhEPRQ$UCf+7i-AHk*R(E!RDFy zd~`+ajw0h1&`X+7ue-47vuAcp_o1Lv+t^7}EId0ah#|8g{7@njiuml@s~I3nE#f74 zHeWjKth;3oW4Zk*XEdBCy8K#x5 zAaQ#U&pG@aw*%$@ljC`~ap2R)zHT}KZnQ!s59jngDAYq0#=wQWXmWGjK#{BVbDg+JQiEVHKmI|*wny>Eh9fHJ(>=L$XbpXzlhTg zu;=LyYrch58*_tS&039sGQgHg;uy#bv$(Rxoh`?X&mc2D?O=K01rWJ;IgYiBWHFK1 zL>w3z1i*Y5U}y8mnVJCKjS6%j#&9Tn4K#pK#0nL${)%BPRc{FW?kW)aFPUY$+xHYHR_y6UL~3AG?MF;r@ec5i(~n&dLZf%O=9x+(88p zzcE((gQO#w*@d$dgSfK*zs4naF^Q8P+>b1_h`hCkOa){H;&CzdPKhk-vwKega^Aw7 zsH`4wEO^{Miy>V@VTc%yv0dMo`(q*#E!?;?6an^r<`BC@n8g@wkTHg)OtJ7#iox!S z2tW}}7vbfoDg?3b#pF#f#vi1#M|nJ&$H(VWL}k^=u!yVpj%@m}QNS;z46_)!KvI3~=_8p(iX8@%Vk8d3IP*t@d9XluX&FEFED}S6 zYV57g=3|dmHjOrC^GRS$1IyVoupA^DM`x%A<81~9ri@U=$d5?jOJ~HnbKGJgenB1| znTI(aAvHv<3}TxsA}ouq&8Ammkt=7r>t1TmY+CVQhPjwoEi_@Ena6d39P%;}>fj(F z0wqQRtYxJ9MEJxRd7ePQ3om9d;Ri{{=rj4m z3V;}g&TT`dX*Tm{lc3DpsEYw=!y+IzMAF5$G$Hgn7l7;|aM+!5f=WKavm@X%kkr<`gRr)bmk6RgTHB%n6pVf z&fHULaB%YJ>9L}kDa-ms7NH+QoyEJe$@M5iW@C?SR1D_)-5mxm;FY1T zlcuP`?>ABxWg7&zA0)&0=jTuy_c-QKfE9EX1(jyt4e zXABR=TC5zWU1rkEP_~%l%Q`E5A`ADz6bn`k$`@-41ul7CkMj+B0^h?P9l30;|M{Jnce3}C&a2<5jtU!j;*_5%74Wq z?(*+1^@Z$^pV$FD%XignR|~6EQLZ;4tSQRaKOvBbUUZV=YF*^SXzul(8B;%P?dnwW zYdHs;2Fwr}fB5JkoO@}RfL;<$$ni2tx_rwRh&s zi|-y>7@g^YDm#d=dV67`wlx=LcK#MN{TbNxn41j&D<1eIUPAX!jkqL5^I|?L$9J)2 z4=mqa4HugaVK;kwdmG8?`Z?Ik%S(`@%1hoC@M4szlY)@svPDHUSQ9s_ASEJAK z#cm?gtwmK$Y}x%_5C8rT9k&JfkHxs>(SNQ}5Ay!FPTT*D@BTMFMuV?@9M2gfHXfOR z5}uVK*mO=SrWebtqo|1YI{gdR%77y@o5dB03HhJ#?OBwBJW8wQwiv?WG+vNDIA?m1 z0m;gK1csTdUBl$L^^`m>oxk%k9x3guR~u!l)x~6aVdlvT$)wNao}%V@`5~F4U7jtM zSwL#w>u8i4sPA&s(0pt*b14zny_M5EbH@`42r;eH0&$hmw`j~}-(k6LTMp;rnx~Q2 zudzDvq=3u;a6^U(B-OJqZpV~9)>Zif++xbd>C_|fx45aBM`fRpjH?i>L40E#zK*S<+@rjJ6K|Zr6eQkanHy6+a+B28 zMYt~_aH9q}O#m5*Z{_iYdAQHxL-X<86bO&A?VEuH0Qjv{DKK`7w(L+am$2!)H-8GEc&_YZr?ww`z;5^j&KVlsezb!}~nmnLB)W z9^S<(a?2SChM#jMRc7tkxfE~*e9T~(I;h9^WabkgR-DXSMP_a!@o*?h853oaP$0^Ghi8X*fG9AaW#sD7Mc4f{OEkl(xHuKp@wIkW@YfbGD28J(afgCT&!X=_Nm#qg0QS^hhcF88E3#_U0TJj>Vn=bFMsqpM z*wzT3w>ix`ROnTNj#9grjaQz1EmAIR9WmpXwZJ?J2uqSJ7I~&4F?bL=^%5{3T#aqh zm}eCC!&&Orr6ixA^m|w<;E7Z5+8j(kr_ zGGvC)Nf{7DCY_31khtY{ES&J3o|MI6QTsU#U8GY9OQ+tHbSi2lWw=Rw!~LwWz%)yz zUcq#n44I`!i?C%8IaxT$rl?^EH+_*>uM#yYW{j7Lj@#O$jERn& z{O*FC8h0_Rwm$&oe3jd#Ks*^EoFkcyB;HK*4mc^&+)vv@t?6$rO<-5dPQGJ+N*HC>MNXgZBXrm+yqunbrP6x+y`cPKv+&6o=@MEJviKS(g5+oEZ&rjaXVJCDT{hM$d-C5yTp1($_6{> zqL4RZ_6=DmDD1}bk^w*H>B)wfA&Svr+&dthR*OO;V$;RA2s~X_$ug7yMSwj`BOMpx z%+z!drF9YM9z%<%mxmIuj3SnXuwIUq9_C9IWBVnIrJ@FV86$~wlP~O^zVS515e;@U zxAGZ;G9Z%L6E@6>O_Kub(=5E0&EsAKXBLHWF?Kek3wJgd?5vCzlv8lV473<$zo(0_ rQ*$H^U8F&3QMnlV%}27Bh<(i*q3%^mW9excYfk@Pt`a0CNbU;&^Q`KY diff --git a/src/utils/password.py b/src/utils/password.py index 02e2efc0a..15503d4f6 100644 --- a/src/utils/password.py +++ b/src/utils/password.py @@ -33,7 +33,14 @@ SMALL_PWD_LIST = [ "rpi", ] -MOST_USED_PASSWORDS = "/usr/share/yunohost/100000-most-used-passwords.txt" +# +# 100k firsts "most used password" with length 8+ +# +# List obtained with: +# curl -L https://github.com/danielmiessler/SecLists/raw/master/Passwords/Common-Credentials/10-million-password-list-top-1000000.txt \ +# | grep -v -E "^[a-zA-Z0-9]{1,7}$" | head -n 100000 | gzip > 100000-most-used-passwords-length8plus.txt.gz +# +MOST_USED_PASSWORDS = "/usr/share/yunohost/100000-most-used-passwords-length8plus.txt.gz" # Length, digits, lowers, uppers, others STRENGTH_LEVELS = [ From 4822afb9d6d6c1ccf302f01e53e0d2a2646a09b4 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sun, 9 Oct 2022 19:40:44 +0200 Subject: [PATCH 166/174] Fix postinstall test --- .gitlab/ci/install.gitlab-ci.yml | 2 +- .gitlab/ci/test.gitlab-ci.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.gitlab/ci/install.gitlab-ci.yml b/.gitlab/ci/install.gitlab-ci.yml index 89360c8f8..ecdfecfcd 100644 --- a/.gitlab/ci/install.gitlab-ci.yml +++ b/.gitlab/ci/install.gitlab-ci.yml @@ -26,4 +26,4 @@ install-postinstall: script: - apt-get update -o Acquire::Retries=3 - DEBIAN_FRONTEND=noninteractive SUDO_FORCE_REMOVE=yes apt --assume-yes -o Dpkg::Options::="--force-confold" --allow-downgrades install ./$YNH_BUILD_DIR/*.deb - - yunohost tools postinstall -d domain.tld -u syssa -f Syssa -l Mine -p the_password --ignore-dyndns --force-diskspace + - yunohost tools postinstall -d domain.tld -u syssa -F 'Syssa Mine' -p the_password --ignore-dyndns --force-diskspace diff --git a/.gitlab/ci/test.gitlab-ci.yml b/.gitlab/ci/test.gitlab-ci.yml index d7ccbc807..8d0d90ded 100644 --- a/.gitlab/ci/test.gitlab-ci.yml +++ b/.gitlab/ci/test.gitlab-ci.yml @@ -34,7 +34,7 @@ full-tests: PYTEST_ADDOPTS: "--color=yes" before_script: - *install_debs - - yunohost tools postinstall -d domain.tld -u syssa -f Syssa -l Mine -p the_password --ignore-dyndns --force-diskspace + - yunohost tools postinstall -d domain.tld -u syssa -F 'Syssa Mine' -p the_password --ignore-dyndns --force-diskspace script: - python3 -m pytest --cov=yunohost tests/ src/tests/ src/diagnosers/ --junitxml=report.xml - cd tests From e32fe7aa41fff10213d9b516ee88801ee0056aaf Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sun, 9 Oct 2022 20:52:20 +0200 Subject: [PATCH 167/174] Moar oopsies --- src/user.py | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/src/user.py b/src/user.py index 13c806d1c..68310f4b4 100644 --- a/src/user.py +++ b/src/user.py @@ -147,7 +147,7 @@ def user_create( if firstname or lastname: logger.warning("Options --firstname / --lastname of 'yunohost user create' are deprecated. We recommend using --fullname instead.") - if not fullname.strip(): + if not fullname or not fullname.strip(): if not firstname.strip(): raise YunohostValidationError("You should specify the fullname of the user using option -F") lastname = lastname or " " # Stupid hack because LDAP requires the sn/lastname attr, but it accepts a single whitespace... @@ -364,7 +364,10 @@ def user_update( fullname=None, ): - if fullname.strip(): + if firstname or lastname: + logger.warning("Options --firstname / --lastname of 'yunohost user create' are deprecated. We recommend using --fullname instead.") + + if fullname and fullname.strip(): fullname = fullname.strip() firstname = fullname.split()[0] lastname = ' '.join(fullname.split()[1:]) or " " # Stupid hack because LDAP requires the sn/lastname attr, but it accepts a single whitespace... @@ -855,7 +858,7 @@ def user_import(operation_logger, csvfile, update=False, delete=False): new_infos["username"], firstname=new_infos["firstname"], lastname=new_infos["lastname"], - password=new_infos["password"], + change_password=new_infos["password"], mailbox_quota=new_infos["mailbox-quota"], mail=new_infos["mail"], add_mailalias=new_infos["mail-alias"], From c5ab6206730f8c4ab45c3098d20301b95a01cc81 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sun, 9 Oct 2022 21:02:02 +0200 Subject: [PATCH 168/174] Fix tests --- maintenance/missing_i18n_keys.py | 2 +- src/settings.py | 5 ++--- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/maintenance/missing_i18n_keys.py b/maintenance/missing_i18n_keys.py index f85b49219..a83159679 100644 --- a/maintenance/missing_i18n_keys.py +++ b/maintenance/missing_i18n_keys.py @@ -150,7 +150,7 @@ def find_expected_string_keys(): # Global settings global_config = toml.load(open(ROOT + "share/config_global.toml")) # Boring hard-coding because there's no simple other way idk - settings_without_help_key = ["smtp_relay_host", "smtp_relay_password", "smtp_relay_port", "smtp_relay_user", "ssh_port", "ssowat_panel_overlay_enabled"] + settings_without_help_key = ["smtp_relay_host", "smtp_relay_password", "smtp_relay_port", "smtp_relay_user", "ssh_port", "ssowat_panel_overlay_enabled", "root_password", "root_access_explain", "root_password_confirm"] for panel in global_config.values(): if not isinstance(panel, dict): diff --git a/src/settings.py b/src/settings.py index 2795d5562..54dfbaa22 100644 --- a/src/settings.py +++ b/src/settings.py @@ -109,8 +109,8 @@ class SettingsConfigPanel(ConfigPanel): def _apply(self): - root_password = self.new_values.pop("root_password") - root_password_confirm = self.new_values.pop("root_password_confirm") + root_password = self.new_values.pop("root_password", None) + root_password_confirm = self.new_values.pop("root_password_confirm", None) if "root_password" in self.values: del self.values["root_password"] @@ -154,7 +154,6 @@ class SettingsConfigPanel(ConfigPanel): self.values["root_password"] = "" self.values["root_password_confirm"] = "" - def get(self, key="", mode="classic"): result = super().get(key=key, mode=mode) From 42bcd5e6d3ca2e33ee30bcd2f0b7753a3113878d Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sun, 9 Oct 2022 21:53:35 +0200 Subject: [PATCH 169/174] Propagate changes to user_create() function in other test modules --- src/tests/test_app_config.py | 2 +- src/tests/test_backuprestore.py | 2 +- src/tests/test_ldapauth.py | 4 ++-- src/tests/test_permission.py | 4 ++-- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/src/tests/test_app_config.py b/src/tests/test_app_config.py index d6cf8045d..db898233d 100644 --- a/src/tests/test_app_config.py +++ b/src/tests/test_app_config.py @@ -102,7 +102,7 @@ def config_app(request): def test_app_config_get(config_app): - user_create("alice", "Alice", "White", _get_maindomain(), "test123Ynh") + user_create("alice", _get_maindomain(), "test123Ynh", fullname="Alice White") assert isinstance(app_config_get(config_app), dict) assert isinstance(app_config_get(config_app, full=True), dict) diff --git a/src/tests/test_backuprestore.py b/src/tests/test_backuprestore.py index 17147f586..adc14b80e 100644 --- a/src/tests/test_backuprestore.py +++ b/src/tests/test_backuprestore.py @@ -77,7 +77,7 @@ def setup_function(function): if "with_permission_app_installed" in markers: assert not app_is_installed("permissions_app") - user_create("alice", "Alice", "White", maindomain, "test123Ynh") + user_create("alice", maindomain, "test123Ynh", fullname="Alice White") with patch.object(os, "isatty", return_value=False): install_app("permissions_app_ynh", "/urlpermissionapp" "&admin=alice") assert app_is_installed("permissions_app") diff --git a/src/tests/test_ldapauth.py b/src/tests/test_ldapauth.py index db5229342..f8ad83544 100644 --- a/src/tests/test_ldapauth.py +++ b/src/tests/test_ldapauth.py @@ -19,8 +19,8 @@ def setup_function(function): if os.system("systemctl is-active slapd >/dev/null") != 0: os.system("systemctl start slapd && sleep 3") - user_create("alice", "Alice", "White", maindomain, "Yunohost", admin=True) - user_create("bob", "Bob", "Snow", maindomain, "test123Ynh") + user_create("alice", maindomain, "Yunohost", admin=True, fullname="Alice White") + user_create("bob", maindomain, "test123Ynh", fullname="Bob Snow") def teardown_function(): diff --git a/src/tests/test_permission.py b/src/tests/test_permission.py index 379f1cf39..5ba073d96 100644 --- a/src/tests/test_permission.py +++ b/src/tests/test_permission.py @@ -158,8 +158,8 @@ def setup_function(function): socket.getaddrinfo = new_getaddrinfo - user_create("alice", "Alice", "White", maindomain, dummy_password) - user_create("bob", "Bob", "Snow", maindomain, dummy_password) + user_create("alice", maindomain, dummy_password, fullname="Alice White") + user_create("bob", maindomain, dummy_password, fullname="Bob Snow") _permission_create_with_dummy_app( permission="wiki.main", url="/", From aaa3a901d00933bed3090d9220a7a7ae993ef8e5 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Mon, 10 Oct 2022 16:47:45 +0200 Subject: [PATCH 170/174] domain: don't assert domain exists in _get_parent_domain_of --- src/domain.py | 2 -- 1 file changed, 2 deletions(-) diff --git a/src/domain.py b/src/domain.py index 5789aa20b..6a11df013 100644 --- a/src/domain.py +++ b/src/domain.py @@ -184,8 +184,6 @@ def _list_subdomains_of(parent_domain): def _get_parent_domain_of(domain, return_self=False, topest=False): - _assert_domain_exists(domain) - domains = _get_domains(exclude_subdomains=topest) domain_ = domain From 556e75ef082beac8e604eddb6a72c861fb925935 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 18 Oct 2022 18:01:16 +0200 Subject: [PATCH 171/174] catalog: autoreplace app level '?' to -1 for easier quality computation --- src/app_catalog.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/app_catalog.py b/src/app_catalog.py index 847ff73ac..8d33d3342 100644 --- a/src/app_catalog.py +++ b/src/app_catalog.py @@ -250,6 +250,9 @@ def _load_apps_catalog(): ) continue + if info.get("level") == "?": + info["level"] = -1 + # FIXME: we may want to autoconvert all v0/v1 manifest to v2 here # so that everything is consistent in terms of APIs, datastructure format etc info["repository"] = apps_catalog_id From 5cfa0d3be8afed6f8a7503505a08a21c583089b8 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 18 Oct 2022 20:10:42 +0200 Subject: [PATCH 172/174] questions: improve support for group question used in manifestv2 --- locales/en.json | 5 +++++ src/app.py | 2 ++ src/utils/config.py | 8 ++++++++ 3 files changed, 15 insertions(+) diff --git a/locales/en.json b/locales/en.json index 8e85f815a..cfc5c9d6b 100644 --- a/locales/en.json +++ b/locales/en.json @@ -4,6 +4,8 @@ "additional_urls_already_added": "Additionnal URL '{url}' already added in the additional URL for permission '{permission}'", "additional_urls_already_removed": "Additionnal URL '{url}' already removed in the additional URL for permission '{permission}'", "admin_password": "Administration password", + "admins": "Admins", + "all_users": "All YunoHost users", "already_up_to_date": "Nothing to do. Everything is already up-to-date.", "app_action_broke_system": "This action seems to have broken these important services: {services}", "app_action_failed": "Failed to run action {action} for app {app}", @@ -34,6 +36,8 @@ "app_manifest_install_ask_is_public": "Should this app be exposed to anonymous visitors?", "app_manifest_install_ask_password": "Choose an administration password for this app", "app_manifest_install_ask_path": "Choose the URL path (after the domain) where this app should be installed", + "app_manifest_install_ask_init_main_permission": "Who should have access to this app? (This can later be changed)", + "app_manifest_install_ask_init_admin_permission": "Who should have access to admin features for this app? (This can later be changed)", "app_not_correctly_installed": "{app} seems to be incorrectly installed", "app_not_installed": "Could not find {app} in the list of installed apps: {all_apps}", "app_not_properly_removed": "{app} has not been properly removed", @@ -722,6 +726,7 @@ "user_unknown": "Unknown user: {user}", "user_update_failed": "Could not update user {user}: {error}", "user_updated": "User info changed", + "visitors": "Visitors", "yunohost_already_installed": "YunoHost is already installed", "yunohost_configured": "YunoHost is now configured", "yunohost_installing": "Installing YunoHost...", diff --git a/src/app.py b/src/app.py index c9ca1fa95..b761e5777 100644 --- a/src/app.py +++ b/src/app.py @@ -2021,6 +2021,8 @@ def _set_default_ask_questions(questions, script_name="install"): ("password", "password"), # i18n: app_manifest_install_ask_password ("user", "admin"), # i18n: app_manifest_install_ask_admin ("boolean", "is_public"), # i18n: app_manifest_install_ask_is_public + ("group", "init_main_permission"), # i18n: app_manifest_install_ask_init_main_permission + ("group", "init_admin_permission"), # i18n: app_manifest_install_ask_init_admin_permission ] for question_name, question in questions.items(): diff --git a/src/utils/config.py b/src/utils/config.py index c61b92a40..399611339 100644 --- a/src/utils/config.py +++ b/src/utils/config.py @@ -1341,6 +1341,14 @@ class GroupQuestion(Question): self.choices = list(user_group_list(short=True)["groups"]) + def _human_readable_group(g): + # i18n: visitors + # i18n: all_users + # i18n: admins + return m18n.n(g) if g in ["visitors", "all_users", "admins"] else g + + self.choices = {g:_human_readable_group(g) for g in self.choices} + if self.default is None: self.default = "all_users" From db0e2ef3b20542457158997a7651f925aae525b7 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 21 Oct 2022 23:01:09 +0200 Subject: [PATCH 173/174] Typo @_@ --- src/utils/password.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/utils/password.py b/src/utils/password.py index 744175c68..3202e8055 100644 --- a/src/utils/password.py +++ b/src/utils/password.py @@ -40,7 +40,7 @@ SMALL_PWD_LIST = [ # curl -L https://github.com/danielmiessler/SecLists/raw/master/Passwords/Common-Credentials/10-million-password-list-top-1000000.txt \ # | grep -v -E "^[a-zA-Z0-9]{1,7}$" | head -n 100000 | gzip > 100000-most-used-passwords-length8plus.txt.gz # -MOST_USED_PASSWORDS = "/usr/share/yunohost/100000-most-used-passwords-length8plus.txt.gz" +MOST_USED_PASSWORDS = "/usr/share/yunohost/100000-most-used-passwords-length8plus.txt" # Length, digits, lowers, uppers, others STRENGTH_LEVELS = [ From cd3bd8985794ceb61976deb8f2e64def321bc109 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sun, 23 Oct 2022 21:08:50 +0200 Subject: [PATCH 174/174] Fix missing i18n strings --- locales/en.json | 63 +++++++++++++++++++++++++------------------------ 1 file changed, 32 insertions(+), 31 deletions(-) diff --git a/locales/en.json b/locales/en.json index cfc5c9d6b..f6ad40eb7 100644 --- a/locales/en.json +++ b/locales/en.json @@ -8,8 +8,8 @@ "all_users": "All YunoHost users", "already_up_to_date": "Nothing to do. Everything is already up-to-date.", "app_action_broke_system": "This action seems to have broken these important services: {services}", - "app_action_failed": "Failed to run action {action} for app {app}", "app_action_cannot_be_ran_because_required_services_down": "These required services should be running to run this action: {services}. Try restarting them to continue (and possibly investigate why they are down).", + "app_action_failed": "Failed to run action {action} for app {app}", "app_already_installed": "{app} is already installed", "app_already_installed_cant_change_url": "This app is already installed. The URL cannot be changed just by this function. Check in `app changeurl` if it's available.", "app_already_up_to_date": "{app} is already up-to-date", @@ -33,11 +33,11 @@ "app_make_default_location_already_used": "Unable to make '{app}' the default app on the domain, '{domain}' is already in use by '{other_app}'", "app_manifest_install_ask_admin": "Choose an administrator user for this app", "app_manifest_install_ask_domain": "Choose the domain where this app should be installed", + "app_manifest_install_ask_init_admin_permission": "Who should have access to admin features for this app? (This can later be changed)", + "app_manifest_install_ask_init_main_permission": "Who should have access to this app? (This can later be changed)", "app_manifest_install_ask_is_public": "Should this app be exposed to anonymous visitors?", "app_manifest_install_ask_password": "Choose an administration password for this app", "app_manifest_install_ask_path": "Choose the URL path (after the domain) where this app should be installed", - "app_manifest_install_ask_init_main_permission": "Who should have access to this app? (This can later be changed)", - "app_manifest_install_ask_init_admin_permission": "Who should have access to admin features for this app? (This can later be changed)", "app_not_correctly_installed": "{app} seems to be incorrectly installed", "app_not_installed": "Could not find {app} in the list of installed apps: {all_apps}", "app_not_properly_removed": "{app} has not been properly removed", @@ -67,9 +67,9 @@ "apps_catalog_obsolete_cache": "The app catalog cache is empty or obsolete.", "apps_catalog_update_success": "The application catalog has been updated!", "apps_catalog_updating": "Updating application catalog...", - "ask_username": "Username", - "ask_firstname": "First name", - "ask_lastname": "Last name", + "ask_admin_fullname": "Admin full name", + "ask_admin_username": "Admin username", + "ask_fullname": "Full name", "ask_main_domain": "Main domain", "ask_new_admin_password": "New administration password", "ask_new_domain": "New domain", @@ -144,8 +144,8 @@ "certmanager_self_ca_conf_file_not_found": "Could not find configuration file for self-signing authority (file: {file})", "certmanager_unable_to_parse_self_CA_name": "Could not parse name of self-signing authority (file: {file})", "certmanager_warning_subdomain_dns_record": "Subdomain '{subdomain}' does not resolve to the same IP address as '{domain}'. Some features will not be available until you fix this and regenerate the certificate.", - "config_action_failed": "Failed to run action '{action}': {error}", "config_action_disabled": "Could not run action '{action}' since it is disabled, make sure to meet its constraints. help: {help}", + "config_action_failed": "Failed to run action '{action}': {error}", "config_apply_failed": "Applying the new configuration failed: {error}", "config_cant_set_value_on_section": "You can't set a single value on an entire config section.", "config_forbidden_keyword": "The keyword '{keyword}' is reserved, you can't create or use a config panel with a question with this id.", @@ -310,6 +310,8 @@ "domain_cannot_remove_main": "You cannot remove '{domain}' since it's the main domain, you first need to set another domain as the main domain using 'yunohost domain main-domain -n '; here is the list of candidate domains: {other_domains}", "domain_cannot_remove_main_add_new_one": "You cannot remove '{domain}' since it's the main domain and your only domain, you need to first add another domain using 'yunohost domain add ', then set is as the main domain using 'yunohost domain main-domain -n ' and then you can remove the domain '{domain}' using 'yunohost domain remove {domain}'.'", "domain_cert_gen_failed": "Could not generate certificate", + "domain_config_acme_eligible": "ACME eligibility", + "domain_config_acme_eligible_explain": "This domain doesn't seem ready for a Let's Encrypt certificate. Please check your DNS configuration and HTTP server reachability. The 'DNS records' and 'Web' section in the diagnosis page can help you understand what is misconfigured.", "domain_config_api_protocol": "API protocol", "domain_config_auth_application_key": "Application key", "domain_config_auth_application_secret": "Application secret key", @@ -318,25 +320,23 @@ "domain_config_auth_key": "Authentication key", "domain_config_auth_secret": "Authentication secret", "domain_config_auth_token": "Authentication token", + "domain_config_cert_install": "Install Let's Encrypt certificate", + "domain_config_cert_issuer": "Certification authority", + "domain_config_cert_no_checks": "Ignore diagnosis checks", + "domain_config_cert_renew": "Renew Let's Encrypt certificate", + "domain_config_cert_renew_help": "Certificate will be automatically renewed during the last 15 days of validity. You can manually renew it if you want to. (Not recommended).", + "domain_config_cert_summary": "Certificate status", + "domain_config_cert_summary_abouttoexpire": "Current certificate is about to expire. It should soon be renewed automatically.", + "domain_config_cert_summary_expired": "CRITICAL: Current certificate is not valid! HTTPS won't work at all!", + "domain_config_cert_summary_letsencrypt": "Great! You're using a valid Let's Encrypt certificate!", + "domain_config_cert_summary_ok": "Okay, current certificate looks good!", + "domain_config_cert_summary_selfsigned": "WARNING: Current certificate is self-signed. Browsers will display a spooky warning to new visitors!", + "domain_config_cert_validity": "Validity", "domain_config_default_app": "Default app", "domain_config_features_disclaimer": "So far, enabling/disabling mail or XMPP features only impact the recommended and automatic DNS configuration, not system configurations!", "domain_config_mail_in": "Incoming emails", "domain_config_mail_out": "Outgoing emails", "domain_config_xmpp": "Instant messaging (XMPP)", - "domain_config_acme_eligible": "ACME eligibility", - "domain_config_acme_eligible_explain": "This domain doesn't seem ready for a Let's Encrypt certificate. Please check your DNS configuration and HTTP server reachability. The 'DNS records' and 'Web' section in the diagnosis page can help you understand what is misconfigured.", - "domain_config_cert_install": "Install Let's Encrypt certificate", - "domain_config_cert_issuer": "Certification authority", - "domain_config_cert_no_checks": "Ignore diagnosis checks", - "domain_config_cert_renew": "Renew Let's Encrypt certificate", - "domain_config_cert_renew_help":"Certificate will be automatically renewed during the last 15 days of validity. You can manually renew it if you want to. (Not recommended).", - "domain_config_cert_summary": "Certificate status", - "domain_config_cert_summary_expired": "CRITICAL: Current certificate is not valid! HTTPS won't work at all!", - "domain_config_cert_summary_selfsigned": "WARNING: Current certificate is self-signed. Browsers will display a spooky warning to new visitors!", - "domain_config_cert_summary_abouttoexpire": "Current certificate is about to expire. It should soon be renewed automatically.", - "domain_config_cert_summary_ok": "Okay, current certificate looks good!", - "domain_config_cert_summary_letsencrypt": "Great! You're using a valid Let's Encrypt certificate!", - "domain_config_cert_validity": "Validity", "domain_created": "Domain created", "domain_creation_failed": "Unable to create domain {domain}: {error}", "domain_deleted": "Domain deleted", @@ -423,9 +423,9 @@ "global_settings_setting_user_strength": "User password strength requirements", "global_settings_setting_user_strength_help": "These requirements are only enforced when initializing or changing the password", "global_settings_setting_webadmin_allowlist": "Webadmin IP allowlist", - "global_settings_setting_webadmin_allowlist_help": "IP adresses allowed to access the webadmin.", "global_settings_setting_webadmin_allowlist_enabled": "Enable Webadmin IP allowlist", "global_settings_setting_webadmin_allowlist_enabled_help": "Allow only some IPs to access the webadmin.", + "global_settings_setting_webadmin_allowlist_help": "IP adresses allowed to access the webadmin.", "good_practices_about_admin_password": "You are now about to define a new administration password. The password should be at least 8 characters long—though it is good practice to use a longer password (i.e. a passphrase) and/or to use a variation of characters (uppercase, lowercase, digits and special characters).", "good_practices_about_user_password": "You are now about to define a new user password. The password should be at least 8 characters long—though it is good practice to use a longer password (i.e. a passphrase) and/or to a variation of characters (uppercase, lowercase, digits and special characters).", "group_already_exist": "Group {group} already exists", @@ -450,11 +450,11 @@ "hook_list_by_invalid": "This property can not be used to list hooks", "hook_name_unknown": "Unknown hook name '{name}'", "installation_complete": "Installation completed", + "invalid_credentials": "Invalid password or username", "invalid_number": "Must be a number", "invalid_number_max": "Must be lesser than {max}", "invalid_number_min": "Must be greater than {min}", "invalid_regex": "Invalid regex:'{regex}'", - "invalid_credentials": "Invalid password or username", "ip6tables_unavailable": "You cannot play with ip6tables here. You are either in a container or your kernel does not support it", "iptables_unavailable": "You cannot play with iptables here. You are either in a container or your kernel does not support it", "ldap_attribute_already_exists": "LDAP attribute '{attribute}' already exists with value '{value}'", @@ -495,6 +495,9 @@ "log_remove_on_failed_restore": "Remove '{}' after a failed restore from a backup archive", "log_resource_snippet": "Provisioning/deprovisioning/updating a resource", "log_selfsigned_cert_install": "Install self-signed certificate on '{}' domain", + "log_settings_reset": "Reset setting", + "log_settings_reset_all": "Reset all settings", + "log_settings_set": "Apply settings", "log_tools_migrations_migrate_forward": "Run migrations", "log_tools_postinstall": "Postinstall your YunoHost server", "log_tools_reboot": "Reboot your server", @@ -509,9 +512,6 @@ "log_user_permission_reset": "Reset permission '{}'", "log_user_permission_update": "Update accesses for permission '{}'", "log_user_update": "Update info for user '{}'", - "log_settings_set": "Apply settings", - "log_settings_reset": "Reset setting", - "log_settings_reset_all": "Reset all settings", "mail_alias_remove_failed": "Could not remove e-mail alias '{mail}'", "mail_domain_unknown": "Invalid e-mail address for domain '{domain}'. Please, use a domain administrated by this server.", "mail_forward_remove_failed": "Could not remove e-mail forwarding '{mail}'", @@ -572,24 +572,25 @@ "not_enough_disk_space": "Not enough free space on '{path}'", "operation_interrupted": "The operation was manually interrupted?", "other_available_options": "... and {n} other available options not shown", + "password_confirmation_not_the_same": "The password and its confirmation do not match", "password_listed": "This password is among the most used passwords in the world. Please choose something more unique.", + "password_too_long": "Please choose a password shorter than 127 characters", "password_too_simple_1": "The password needs to be at least 8 characters long", "password_too_simple_2": "The password needs to be at least 8 characters long and contain a digit, upper and lower characters", "password_too_simple_3": "The password needs to be at least 8 characters long and contain a digit, upper, lower and special characters", "password_too_simple_4": "The password needs to be at least 12 characters long and contain a digit, upper, lower and special characters", - "password_too_long": "Please choose a password shorter than 127 characters", "pattern_backup_archive_name": "Must be a valid filename with max 30 characters, alphanumeric and -_. characters only", "pattern_domain": "Must be a valid domain name (e.g. my-domain.org)", "pattern_email": "Must be a valid e-mail address, without '+' symbol (e.g. someone@example.com)", "pattern_email_forward": "Must be a valid e-mail address, '+' symbol accepted (e.g. someone+tag@example.com)", - "pattern_firstname": "Must be a valid first name", - "pattern_lastname": "Must be a valid last name", + "pattern_firstname": "Must be a valid first name (at least 3 chars)", + "pattern_fullname": "Must be a valid full name (at least 3 chars)", + "pattern_lastname": "Must be a valid last name (at least 3 chars)", "pattern_mailbox_quota": "Must be a size with b/k/M/G/T suffix or 0 to not have a quota", "pattern_password": "Must be at least 3 characters long", "pattern_password_app": "Sorry, passwords can not contain the following characters: {forbidden_chars}", "pattern_port_or_range": "Must be a valid port number (i.e. 0-65535) or range of ports (e.g. 100:200)", "pattern_username": "Must be lower-case alphanumeric and underscore characters only", - "password_confirmation_not_the_same": "The password and its confirmation do not match", "permission_already_allowed": "Group '{group}' already has permission '{permission}' enabled", "permission_already_disallowed": "Group '{group}' already has permission '{permission}' disabled", "permission_already_exist": "Permission '{permission}' already exists", @@ -644,8 +645,8 @@ "restore_running_app_script": "Restoring the app '{app}'...", "restore_running_hooks": "Running restoration hooks...", "restore_system_part_failed": "Could not restore the '{part}' system part", - "root_password_desynchronized": "The admin password was changed, but YunoHost could not propagate this to the root password!", "root_password_changed": "root's password was changed", + "root_password_desynchronized": "The admin password was changed, but YunoHost could not propagate this to the root password!", "server_reboot": "The server will reboot", "server_reboot_confirm": "The server will reboot immediatly, are you sure? [{answers}]", "server_shutdown": "The server will shut down",