From 5876c0f3462928b31441bfe25bf4c6b6a56a9dc7 Mon Sep 17 00:00:00 2001 From: classabbyamp Date: Wed, 21 Dec 2022 13:25:55 -0500 Subject: [PATCH] migrate README contents to docs/index.rst also add v2.1.0 screenshot --- README.md | 291 +-------------------------------- docs/_static/custom.css | 21 +++ docs/index.rst | 324 ++++++++++++++++++++++++++++++++++++- docs/man/zfsbootmenu.7.rst | 5 + docs/media | 1 + media/v2.1.0-multi-be.png | Bin 0 -> 58397 bytes 6 files changed, 356 insertions(+), 286 deletions(-) create mode 120000 docs/media create mode 100644 media/v2.1.0-multi-be.png diff --git a/README.md b/README.md index 8ea2c04..f6d21e6 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -# Introduction +[![ZFSBootMenu Logo](docs/logos/Logo_Colors_Horizontal_Layout_NoBackground.svg)](https://zfsbootmenu.org) [![Build check](https://github.com/zbm-dev/zfsbootmenu/actions/workflows/build.yml/badge.svg?branch=master)](https://github.com/zbm-dev/zfsbootmenu/actions/workflows/build.yml) [![latest packaged version(s)](https://repology.org/badge/latest-versions/zfsbootmenu.svg)](https://repology.org/project/zfsbootmenu/versions) @@ -6,290 +6,13 @@ ZFSBootMenu is a Linux bootloader that attempts to provide an experience similar In essence, ZFSBootMenu is a small, self-contained Linux system that knows how to find other Linux kernels and initramfs images within ZFS filesystems. When a suitable kernel and initramfs are identified (either through an automatic process or direct user selection), ZFSBootMenu launches that kernel using the `kexec` command. -![screenshot](/media/v1.11.0-multi-be.png?raw=true) +![screenshot](/media/v2.1.0-multi-be.png) -In broad strokes, it works as follows: +### For more details, see: -* Via direct EFI booting, an EFI boot manager like refind, `rEFInd`, a BIOS bootloader like `syslinux`, or some other means, boot ZFSBootMenu (as either a self-contained UEFI application or a dedicated Linux kernel and initramfs image). -* Find all healthy ZFS pools and import them. -* If appropriate, select a preferred boot environment: - * If the ZFSBootMenu command line specifies no pool preference, prefer the filesystem indicated by the `bootfs` property (if defined) on the first-found pool. - * If the ZFSBootMenu command line specifies a pool preference, and that pool has been imported, prefer the filesystem indicated by its `bootfs` property (if defined). - * If a `bootfs` value has been identified, start an interruptable countdown (by default, 10 seconds) to automatically boot that environment. - * If no `bootfs` value can be identified or the automatic countdown was interrupted, search all imported pools for filesystems that set `mountpoint=/` and contain a `/boot` subdirectory that contains Linux kernels and initramfs images. Present a list of identified environments for user selection via `fzf`. -* Mount the filesystem representing the selected boot environment and find the highest versioned kernel in `/boot` in the selected boot environment. -* Using `kexec`, load the selected kernel and initramfs into memory, setting the kernel command line with the contents of the `org.zfsbootmenu:commandline` property for that filesystem. -* Unmount all ZFS filesystems. -* Boot the final kernel and initramfs. +- [Documentation](https://docs.zfsbootmenu.org) +- [Boot Environments and You: A Primer](https://docs.zfsbootmenu.org/en/latest/guides/general/bootenvs-and-you.html) -At this point, you'll be booting into your usual OS-managed kernel and initramfs, along with any arguments needed to correctly boot your system. +### Join us on IRC -Whenever ZFSBootMenu encounters natively encrypted ZFS filesystems that it intends to scan for boot environments, it will prompt the user to enter a passphrase as necessary. - -This tool makes uses of the following additional software: - * [fzf](https://github.com/junegunn/fzf) - * [kexec-tools](https://github.com/horms/kexec-tools) - * [mbuffer](http://www.maier-komor.de/mbuffer.html) - * [Linux Kernel](https://www.kernel.org) - * [ZFS on Linux](https://zfsonlinux.org) - -The ZFSBootMenu may be created using your your regular system kernel, user-space utilities and initramfs generator. Image creation is known to work and explicitly supported with: - - * [dracut](https://github.com/dracutdevs/dracut), and - * [mkinitcpio](https://github.com/archlinux/mkinitcpio) - -Note that ZFSBootMenu does *not* replace your regular initramfs image. In fact, it is possible to use one of the supported generators to produce a ZFSBootMenu image even on Linux distributions entirely different program to produce their initramfs images (*e.g.*, `initramfs-tools` on Debian or Ubuntu). - -ZFSBootMenu is capable of booting just about any Linux distribution. Major distributions that are known to boot without requiring any special configuration include: - -* Void -* Arch -* Alpine -* Gentoo -* Debian and its descendants (Ubuntu, Linux Mint, Devuan, etc.) - -Red Hat and its descendants (RHEL, CentOS, Fedora, etc.) are expected to work as well but have never been tested. ZFSBootMenu also provides several configuration options that can be used to fine-tune the boot process for nonstandard configurations. - -Each release includes pre-generated images (both a monolithic UEFI applications as well as separate kernel and initramfs components suitable for both UEFI and BIOS systems) based on Void Linux. Building a custom image is known to work in the following configurations: - -* With `mkinitcpio` or `dracut` on Void (the `zfsbootmenu` package will make sure all prerequisites are available) -* With `mkinitcpio` or `dracut` on Arch -* With `dracut` on Debian or Ubuntu (installed as `dracut-core` to avoid replacing the system `initramfs-tools` setup) - -## Community documentation - -The [ZFSBootMenu wiki](https://github.com/zbm-dev/zfsbootmenu/wiki) contains additional documentation, provided both by the ZFSBootMenu development team and by community members. - -Installation and integration guides are available, along with other live documents. - -## Containerized builds - -If you run Docker or [podman](https://podman.io/), it is also possible to build ZFSBootMenu images in a container. Build containers are based on Void Linux and provide a consistent and well-tested environment for creating images with custom configurations. The [build guide](docs/BUILD.md) provides a brief overview of the [zbm-builder.sh](zbm-builder.sh) script that provides a simple front-end for containerized builds. A straightforward example, which includes optional support for remote access via the `dropbear` SSH server, is [provided in the wiki](https://github.com/zbm-dev/zfsbootmenu/wiki/Building-in-Containers). Advanced users with very specific needs may consult the [container README](releng/docker/README.md) for a more detailed description of ZFSBootMenu build containers. - -# ZFS boot environments - -From the perspective of ZFSBootMenu, a "boot environment" is simply a ZFS filesystem that contains a Linux kernel and initramfs in its `/boot` subdirectory. More thorough consideration of the concept is presented in the [boot environment primer](docs/BOOTENVS.md). - -The following example filesystem layout defines two boot environments as filesystems which define the property `mountpoint=/`: - -``` -NAME USED AVAIL REFER MOUNTPOINT -zroot 278G 582G 96K none -zroot/ROOT 10.9G 582G 96K none -zroot/ROOT/void.2019.10.04 1.20M 582G 7.17G / -zroot/ROOT/void.2019.11.01 10.9G 582G 7.17G / -zroot/home 120G 582G 11.8G /home -``` - -> It is generally advisable to set the `canmount=noauto` property on all ZFS root filesystems. Regardless of the value of this property, the initramfs for your environment will always explicitly mount the specified root filesystem. Leaving this property set to the default `canmount=auto` may cause your distribution to attempt to mount multiple conflicting roots at startup, leaving your system in an inconsistent or unbootable state. - -If the `zroot` pool defines a `bootfs` property that points to one of the two boot environments, ZFSBootMenu will attempt to boot that environment by default: - -``` -NAME PROPERTY VALUE SOURCE -zroot bootfs zroot/ROOT/void.2019.11.01 local -``` - -Unless the [`org.zfsbootmenu:kernel` property](docs/pod/zfsbootmenu.7.pod#zfs-properties) of a boot environment specifies a version restriction, ZFSBootMenu will find and boot the highest versioned kernel in `zroot/ROOT/void.2019.11.01/boot` that also includes a matching initramfs. - -Boot environments may also reside on filesystems that define the property `mountpoint=legacy`. To avoid time-consuming searches for boot environments on arbitrary legacy-mounted filesystems, such boot environments must opt into recognition by defining the custom property [`org.zfsbootmenu:active=on`](docs/pod/zfsbootmenu.7.pod#zfs-properties). - -> Filesystems which define `mountpoint=/` may define the property `org.zfsbootmenu:active=off` to opt *out* of recognition by ZFSBootMenu. - -## Command-line arguments - -Kernel command-line (KCL) arguments should be configured by setting the [`org.zfsbootmenu:commandline` property](docs/pod/zfsbootmenu.7.pod#zfs-properties) for each boot environment. Do not set a `root=` option in this property; ZFSBootMenu will add an appropriate `root=` argument when it boots the environment and will actively suppress any conflicting option. - -Because ZFS properties are inherited by default, it is possible to set the `org.zfsbootmenu:commandline` property on a common parent to apply the same KCL arguments to multiple environments. Setting the property locally on individual boot environments will override the common defaults. - -As a special accommodation, the substitution keyword `%{parent}` in the KCL property will be recursively expanded to whatever the value of `org.zfsbootmenu:commandline` would be on the parent dataset. This allows, for example, mixing options common to multiple environments with those specific to each: - -```sh -zfs set org.zfsbootmenu:commandline=""zfs.zfs_arc_max=8589934592"" zroot/ROOT -zfs set org.zfsbootmenu:commandline="%{parent} loglevel=4" zroot/ROOT/void.2019.11.01 -zfs set org.zfsbootmenu:commandline="loglevel=7 %{parent}" zroot/ROOT/void.2019.10.04 -``` - -will cause ZFSBootMenu to interpret the KCL for `zroot/ROOT/void.2019.11.01` as - -``` -zfs.zfs_arc_max=8589934592 loglevel=4 -``` - -while the KCL for `zroot/ROOT/void.2019.10.04` would be - -``` -loglevel=7 zfs.zfs_arc_max=8589934592 -``` - -# EFI booting - -Although ZFSBootMenu images can be booted on legacy BIOS systems or (on other platforms) alternative firmware, ZFSBootMenu integrates nicely with modern UEFI systems. ZFSBootMenu builds a custom initramfs image around a standard Linux kernel. Most distributions compile the Linux kernel with an EFI stub loader; the ZFSBootMenu kernel and initramfs pair can therefore be booted directly by most UEFI implementations or by EFI boot managers like rEFInd or gummiboot (systemd-boot). - -When generating ZFSBootMenu images from a local host, it is possible to edit `/etc/zfsbootmenu/config.yaml` to copy the ZFSBootMenu kernel and initramfs directly to your EFI system partition. Suppose that the directory listing for your current `/boot` looks like - -``` -# ls /boot -config-5.3.18_1 -config-5.4.6_1 -efi -initramfs-5.3.18_1.img -initramfs-5.4.6_1.img -System.map-5.3.18_1 -System.map-5.4.6_1 -vmlinuz-5.3.18_1 -vmlinuz-5.4.6_1 -``` - -Typically, EFI system partitions (ESP) are mounted at `/boot/efi`, as is shown above. An ESP may contain a number of sub-directories, including an `EFI` directory that often contains multiple independent EFI executables. In this example layout, `/boot/efi/EFI/zbm` may hold ZFSBootMenu kernels and initramfs images. After setting the `ImageDir` property of the `Components` section of `/etc/zfsbootmenu/config.yaml` to `/boot/efi/EFI/zbm`, running `generate-zbm` will cause ZFSBootMenu kernel and initramfs pairs to be installed in the desired location: - -``` -# lsblk -f /dev/sda -NAME FSTYPE LABEL UUID FSAVAIL FSUSE% MOUNTPOINT -sdg -├─sda1 vfat AFC2-35EE 7.9G 1% /boot/efi -└─sda2 swap 412401b6-4aec-4452-a6bd-6fc20fbdc2a5 [SWAP] - -# ls /boot/efi/EFI/zbm/ -initramfs-1.12.0_1.img -initramfs-1.12.0_2.img -vmlinuz-1.12.0_1 -vmlinuz-1.12.0_2 -``` - -After the kernel and initramfs pairs are made available on the ESP, you'll need a way to boot them on your system. This can be done directly via [efibootmgr](https://github.com/rhboot/efibootmgr) or via a third-party boot manager like [rEFInd](http://www.rodsbooks.com/refind/). - -## efibootmgr - -``` -efibootmgr --disk /dev/sda \ - --part 1 \ - --create \ - --label "ZFSBootMenu" \ - --loader '\EFI\zbm\vmlinuz-1.12.0_2' \ - --unicode 'zbm.prefer=zroot ro initrd=\EFI\zbm\initramfs-1.12.0_2.img quiet' \ - --verbose -``` - -Take note to adjust the arguments to `--disk` and `--part`, the path to the kernel in `--loader`, and the initramfs path (`initrd=`) and pool preference (`zbm.prefer=`) to match your system configuration. - -Each time ZFSBootMenu is updated, a new EFI entry will need to be manually added, unless you disable versioning in the ZFSBootMenu configuration. - -## rEFInd - -`rEFInd` is considerably easier to install and manage. Refer to your distribution's packages for installation. Once rEFInd has been installed, you can create `refind_linux.conf` in the directory holding the ZFSBootMenu files (`/boot/efi/EFI/zbm` in our example): - -``` -"Boot default" "zbm.prefer=zroot ro quiet loglevel=0 zbm.skip" -"Boot to menu" "zbm.prefer=zroot ro quiet loglevel=0 zbm.show" -``` - -As with the efibootmgr section, the `zbm.prefer=` option needs to be configured to match your environment. - -This file will configure `rEFInd` to create two entries for each kernel and initramfs pair it finds. The first will directly boot into the environment set via the `bootfs` pool property. The second will force ZFSBootMenu to display its interactive user interface and allow you to boot alternate environments, kernels and snapshots. - -# Run-time configuration of ZFSBootMenu - -ZFSBootMenu may be configured via a combination of [command-line parameters](docs/pod/zfsbootmenu.7.pod#cli-parameters) and [ZFS properties](docs/pod/zfsbootmenu.7.pod#zfs-properties) that are described in detail in the [zfsbootmenu(7)](docs/pod/zfsbootmenu.7.pod) manual page. - -# Local image creation - -`bin/generate-zbm` can be used to create an initramfs on your system. It ships with Void-specific defaults in [etc/zfsbootmenu/config.yaml](etc/zfsbootmenu/config.yaml). To create an initramfs, the following additional tools/libraries will need to be available on your system: - - * For inclusion in the initramfs: - * [fzf](https://github.com/junegunn/fzf) - * [kexec-tools](https://github.com/horms/kexec-tools) - * [mbuffer](http://www.maier-komor.de/mbuffer.html) - * For running `bin/generate-zbm`: - * [perl Sort::Versions](https://metacpan.org/pod/Sort::Versions) - * [perl Config::IniFiles](https://metacpan.org/pod/Config::IniFiles) - * [perl YAML::PP](https://metacpan.org/pod/YAML::PP) - * [perl boolean](https://metacpan.org/pod/boolean) - -If you want to create a unified EFI executable (which bundles the kernel, initramfs and command line), you will also need: - - * linuxx64.efi.stub (typically packaged with gummiboot or systemd-boot) - -Your distribution should have packages for these already. - -## Image configuration - -[config.yaml](docs/pod/generate-zbm.5.pod) is used to control the operation of [generate-zbm](bin/generate-zbm). - -## Dealing with driver conflicts - -For some combination of hardware and kernel modules, the ZFSBootMenu kernel may leave hardware in an unexpected state and prevent the boot environment from properly initializing and attaching drivers. The simplest way to avoid this issue is to disable the affected kernel modules in ZFSBootMenu, leaving all hardware initialization to the final kernel. For example, if Nvidia graphics hardware does not function as expected, a dracut configuration file can be added to `/etc/zfsbootmenu/dracut.conf.d` to exclude the `nouveau` and `nvidia` drivers from ZFSBootMenu. Adding the line - -``` -omit_drivers+=" nouveau nvidia " -``` - -to a file called, *e.g.*, `/etc/zfsbootmenu/dracut.conf.d/nvidia.conf` should restore expected functionality to your boot environment after recreating your ZFSBootMenu image with `generate-zbm`. - -In other cases, it is not possible to exclude drivers without depriving ZFSBootMenu of critical hardware support. For example, some XHCI USB controllers may not be properly initialized after a `kexec`, leaving a boot environment without USB devices like a keyboard. However, excluding XHCI drivers from ZFSBootMenu would make the same keyboard inoperable in the boot menu, making it impossible to interact with the menus. ZFSBootMenu provides "teardown hooks" that can sometimes be used to address these situations. Teardown hooks are invoked immediately before a target kernel is booted via `kexec` and provide an opportunity to run last-minute commands to prepare the system for the boot. Scripts may be registered as teardown hooks by adding text of the form - -``` -zfsbootmenu_teardown+=" " -``` - -where `` points to an **executable** script or program. A sample [XHCI teardown script](contrib/xhci-teardown.sh) demonstrates the use of teardown hooks to unbind the XHCI driver from the USB controllers in the ZFSBootMenu kernel before launching the selected boot environment, allowing the next kernel to properly initialize the controller. - -# Native encryption - -ZFSBootMenu can import pools or filesystems with native encryption enabled. If your boot environments are not encrypted but, for example, `/home` is, you will not receive a decryption prompt during boot. To ensure that you can decrypt your pool to load the kernel and initramfs, you'll need to you have the filesystem parameters configured correctly. - -``` -zfs get all zroot | egrep '(encryption|keylocation|keyformat)' -zroot encryption aes-256-gcm - -zroot keylocation file:///etc/zfs/zroot.key local -zroot keyformat passphrase - -zroot encryptionroot zroot - -``` - -It's critical that `keyformat` is set to `passphrase`, otherwise you'll be unable to enter the correct value in the boot loader. ZFS on Linux currently supports only one key, but in a way which we can exploit: if you configure the `keylocation` value to a file on disk, put your passphrase in that, and then include that file into the FINAL initramfs (the OS-managed one), you won't receive a second password prompt on boot. You'll still receive a password prompt in the boot loader, since we can force a prompt for passphrase input. - -For Dracut-based systems, this can be done by creating a `/etc/dracut.conf.d/zol.conf` file with the following contents: - -``` -install_items+=" /etc/zfs/zroot.key " -``` - -It's critical that you do not include this key file into the ZFSBootMenu initramfs, since that file exists on an unencrypted volume - leaving your pool essentially wide-open. - -For convenience, ZFSBootMenu recognizes the ZFS property `org.zfsbootmenu:keysource` as the name of a filesystem that should be searched for ZFS key files. When a boot environment specifies a `file://` URI as its `keylocation`, ZFSBootMenu will attempt to mount a filesystem indicated by the `org.zfsbootmenu:keysource` property (if it exists) and search for the named `keylocation` therein. If found, ZFSBootMenu will copy the key into a cache within the in-memory root filesystem so that subsequent operations that require reloading the key (for example, changing the default boot environment or cloning a snapshot) will not prompt the user for passphrases. - -When searching for a `keylocation` relative to the filesystem named by `org.zfsbootmenu:keysource`, ZFSBootMenu will first try to strip the `mountpoint` of the keysource filesystem from any `keylocation` URI that references the keys to map the `keylocation` that would be observed on a running system to the proper location in the keysource. For example, if the running system is set up so that `zroot` is the `encryptionroot` for all filesystems on a pool, running the commands - -```sh -zfs create -o mountpoint=/etc/zfs/keys zroot/keystore -echo "MySecretPassphrase" > /etc/zfs/keys/zroot.key -chmod 000 /etc/zfs/keys/zroot.key -zfs set keylocation=file:///etc/zfs/keys/zroot.key zroot -zfs set org.zfsbootmenu:keysource=zroot/keystore zroot -echo install_optional_items+=" /etc/zfs/keys/zroot.key " >> /etc/dracut.conf.d/zol.conf -``` - -will cause ZFSBootMenu to attempt to cache the key `file:///etc/zfs/keys/zroot.key` from `zroot/keystore` when unlocking the `zroot` pool. Because `zroot/keystore` specifies `mountpoint=/etc/zfs/keys`, ZFSBootMenu will first try to strip `/etc/zfs/keys` from the `keylocation` URI, looking for the file `zroot.key` at the root of the filesystem `zroot/keystore`. If this fails, ZFSBootMenu will fall back to the full path, looking for `etc/zfs/keys/zroot.key` within the keysource filesystem. If either location is found, ZFSBootMenu will retain a cache of the key should it be needed to unlock the pool again. - -# Signature Verification and Prebuilt EFI Executables - -ZFSBootMenu is now distributed as a prebuilt EFI executable alongside the source releases. For many systems, it is sufficient to drop the EFI executable on an EFI System Partition and configure your firmware to boot the file. - -Each EFI executable we release is signed with [`signify`](https://flak.tedunangst.com/post/signify), which provides a simple method for verifying that the contents of the file are as this project intended. Once you've installed `signify` (that's left as an exercise, although Void Linux provides the `signify` package for this purpose), just download the EFI bundle from the [releases page](https://github.com/zbm-dev/zfsbootmenu/releases), download the `sha256.sig` file alongside it, and run - -``` -signify -C -x sha256.sig -``` - -You will also need the public key used to sign ZFSBootMenu executables. The key is available at [releng/keys/zfsbootmenu.pub](https://github.com/zbm-dev/zfsbootmenu/blob/master/releng/keys/zfsbootmenu.pub). Install this file as `/etc/signify/zfsbootmenu.pub` if you like; this key can be used for all subsequent verifications. Otherwise, look at the `-p` command-line option for `signify` to provide a path to the key. - -The signature file `sha256.sig` also includes a signature for the source tarball corresponding to the release. If this file is not present alongside the EFI bundle and the signature file, `signify` will complain about its signature. This error message is OK to ignore; alternatively, tell `signify` to verify only the EFI bundle, or download the source tarball alongside the other files. - -The signify key `zfsbootmenu.pub` may be verified; alongside the public key is [releng/keys/zfsbootmenu.pub.gpg](https://github.com/zbm-dev/zfsbootmenu/blob/master/releng/keys/zfsbootmenu.pub.gpg), a GnuPG signature produced with a personal key from [@ahesford](http://keys.gnupg.net/pks/lookup?op=vindex&fingerprint=on&search=0x312485BE75E3D7AC), one of the members of the ZFSBootMenu project. To verify the `signify` key, download the key `zfsbootmenu.pub` and its signature file `zfsbootmenu.pub.gpg`, then run - -``` -gpg2 --recv-key 0x312485BE75E3D7AC -gpg2 --verify zfsbootmenu.pub.gpg -``` - -NOTE: on some distributions, `gpg2` may instead by `gpg`. +Come chat about ZFSBootMenu in [#zfsbootmenu on libera.chat](https://web.libera.chat/#zfsbootmenu) diff --git a/docs/_static/custom.css b/docs/_static/custom.css index b85baec..223f5a5 100644 --- a/docs/_static/custom.css +++ b/docs/_static/custom.css @@ -2,3 +2,24 @@ li>ul { margin-top: 0px !important; margin-bottom: 0px !important; } + +.dl-links { + display: flex; + flex-flow: row wrap; + justify-content: center; + gap: 10px; +} + +.dl-button, .dl-button:visited { + background-color: #2980b9; + color: white; + text-align: center; + text-decoration: none; + padding: 12px; + border-radius: 5px; +} + +.dl-button:hover, .dl-button:active, .dl-button:focus { + background-color: #3f8dc0; + color: white; +} diff --git a/docs/index.rst b/docs/index.rst index 0d30234..88b3d43 100644 --- a/docs/index.rst +++ b/docs/index.rst @@ -1,9 +1,35 @@ -ZFSBootMenu -=========== +.. only:: not html + + ZFSBootMenu + =========== + +.. image:: logos/Logo_Colors_Horizontal_Layout_NoBackground.svg + :alt: ZFSBootMenu logo + :align: center + +.. raw:: html + +
+
+ x86_64 EFI Image + x86_64 Recovery Image + View on GitHub +
+
+
+ + Build check + + + latest packaged version(s) + +
+
.. toctree:: :maxdepth: 1 :titlesonly: + :hidden: CHANGELOG @@ -12,6 +38,7 @@ ZFSBootMenu :maxdepth: 3 :titlesonly: :includehidden: + :hidden: man/zfsbootmenu.7 man/generate-zbm.8 @@ -23,6 +50,7 @@ ZFSBootMenu :maxdepth: 3 :titlesonly: :includehidden: + :hidden: guides/general guides/debian @@ -33,6 +61,7 @@ ZFSBootMenu :caption: Runtime Help :maxdepth: 3 :titlesonly: + :hidden: online/main-screen online/snapshot-management @@ -40,3 +69,294 @@ ZFSBootMenu online/kernel-management online/zpool-health online/recovery-shell + + +ZFSBootMenu is a Linux bootloader that attempts to provide an experience similar to FreeBSD's bootloader. By taking advantage of ZFS features, it allows a user to have multiple "boot environments" (with different distributions, for example), manipulate snapshots before booting, and, for the adventurous user, even bootstrap a system installation via ``zfs recv``. + +In essence, ZFSBootMenu is a small, self-contained Linux system that knows how to find other Linux kernels and initramfs images within ZFS filesystems. When a suitable kernel and initramfs are identified (either through an automatic process or direct user selection), ZFSBootMenu launches that kernel using the ``kexec`` command. + +.. image:: /media/v2.1.0-multi-be.png + :alt: ZFSBootMenu screenshot + :align: center + +Overview +-------- + +In broad strokes, it works as follows: + +* Via direct EFI booting, an EFI boot manager like refind, ``rEFInd``, a BIOS bootloader like ``syslinux``, or some other means, boot ZFSBootMenu (as either a self-contained UEFI application or a dedicated Linux kernel and initramfs image). +* Find all healthy ZFS pools and import them. +* If appropriate, select a preferred boot environment: + + * If the ZFSBootMenu command line specifies no pool preference, prefer the filesystem indicated by the ``bootfs`` property (if defined) on the first-found pool. + * If the ZFSBootMenu command line specifies a pool preference, and that pool has been imported, prefer the filesystem indicated by its ``bootfs`` property (if defined). + * If a ``bootfs`` value has been identified, start an interruptable countdown (by default, 10 seconds) to automatically boot that environment. + * If no ``bootfs`` value can be identified or the automatic countdown was interrupted, search all imported pools for filesystems that set ``mountpoint=/`` and contain a ``/boot`` subdirectory that contains Linux kernels and initramfs images. Present a list of identified environments for user selection via ``fzf``. + +* Mount the filesystem representing the selected boot environment and find the highest versioned kernel in ``/boot`` in the selected boot environment. +* Using ``kexec``, load the selected kernel and initramfs into memory, setting the kernel command line with the contents of the ``org.zfsbootmenu:commandline`` property for that filesystem. +* Unmount all ZFS filesystems. +* Boot the final kernel and initramfs. + +At this point, you'll be booting into your usual OS-managed kernel and initramfs, along with any arguments needed to correctly boot your system. + +Whenever ZFSBootMenu encounters natively encrypted ZFS filesystems that it intends to scan for boot environments, it will prompt the user to enter a passphrase as necessary. + +This tool makes uses of the following additional software: + +* `fzf `_ +* `kexec-tools `_ +* `mbuffer `_ +* `Linux Kernel `_ +* `OpenZFS `_ + +The ZFSBootMenu may be created using your your regular system kernel, user-space utilities and initramfs generator. Image creation is known to work and explicitly supported with: + +* `dracut `_ +* `mkinitcpio `_ + +Note that ZFSBootMenu does *not* replace your regular initramfs image. In fact, it is possible to use one of the supported generators to produce a ZFSBootMenu image even on Linux distributions entirely different program to produce their initramfs images (*e.g.*, ``initramfs-tools`` on Debian or Ubuntu). + +ZFSBootMenu is capable of booting just about any Linux distribution. Major distributions that are known to boot without requiring any special configuration include: + +* Void +* Arch +* Alpine +* Gentoo +* Debian and its descendants (Ubuntu, Linux Mint, Devuan, etc.) + +Red Hat and its descendants (RHEL, CentOS, Fedora, etc.) are expected to work as well but have never been tested. ZFSBootMenu also provides several configuration options that can be used to fine-tune the boot process for nonstandard configurations. + +Each release includes pre-generated images (both a monolithic UEFI applications as well as separate kernel and initramfs components suitable for both UEFI and BIOS systems) based on Void Linux. Building a custom image is known to work in the following configurations: + +* With ``mkinitcpio`` or ``dracut`` on Void (the ``zfsbootmenu`` package will make sure all prerequisites are available) +* With ``mkinitcpio`` or ``dracut`` on Arch +* With ``dracut`` on Debian or Ubuntu (installed as ``dracut-core`` to avoid replacing the system ``initramfs-tools`` setup) + +Community documentation +----------------------- + +The `ZFSBootMenu wiki `_ contains additional documentation, provided both by the ZFSBootMenu development team and by community members. + +Containerized builds +-------------------- + +If you run Docker or `podman `_, it is also possible to build ZFSBootMenu images in a container. Build containers are based on Void Linux and provide a consistent and well-tested environment for creating images with custom configurations. The :doc:`build guide ` provides a brief overview of the :zbm:`zbm-builder.sh` script that provides a simple front-end for containerized builds. A straightforward example, which includes optional support for remote access via the ``dropbear`` SSH server, is `provided in the wiki `_. Advanced users with very specific needs may consult the :zbm:`container README ` for a more detailed description of ZFSBootMenu build containers. + +ZFS boot environments +--------------------- + +From the perspective of ZFSBootMenu, a "boot environment" is simply a ZFS filesystem that contains a Linux kernel and initramfs in its ``/boot`` subdirectory. More thorough consideration of the concept is presented in the :doc:`boot environment primer `. + +The following example filesystem layout defines two boot environments as filesystems which define the property ``mountpoint=/``:: + + NAME USED AVAIL REFER MOUNTPOINT + zroot 278G 582G 96K none + zroot/ROOT 10.9G 582G 96K none + zroot/ROOT/void.2019.10.04 1.20M 582G 7.17G / + zroot/ROOT/void.2019.11.01 10.9G 582G 7.17G / + zroot/home 120G 582G 11.8G /home + +.. note:: + + It is generally advisable to set the ``canmount=noauto`` property on all ZFS root filesystems. Regardless of the value of this property, the initramfs for your environment will always explicitly mount the specified root filesystem. Leaving this property set to the default ``canmount=auto`` may cause your distribution to attempt to mount multiple conflicting roots at startup, leaving your system in an inconsistent or unbootable state. + +If the ``zroot`` pool defines a ``bootfs`` property that points to one of the two boot environments, ZFSBootMenu will attempt to boot that environment by default:: + + NAME PROPERTY VALUE SOURCE + zroot bootfs zroot/ROOT/void.2019.11.01 local + +Unless the ``org.zfsbootmenu:kernel`` :ref:`property ` of a boot environment specifies a version restriction, ZFSBootMenu will find and boot the highest versioned kernel in ``zroot/ROOT/void.2019.11.01/boot`` that also includes a matching initramfs. + +Boot environments may also reside on filesystems that define the property ``mountpoint=legacy``. To avoid time-consuming searches for boot environments on arbitrary legacy-mounted filesystems, such boot environments must opt into recognition by defining the custom :ref:`property ` ``org.zfsbootmenu:active=on``. + +.. note:: + + Filesystems which define ``mountpoint=/`` may define the property ``org.zfsbootmenu:active=off`` to opt *out* of recognition by ZFSBootMenu. + +Command-line arguments +---------------------- + +Kernel command-line (KCL) arguments should be configured by setting the ``org.zfsbootmenu:commandline`` :ref:`property ` for each boot environment. Do not set a ``root=`` option in this property; ZFSBootMenu will add an appropriate ``root=`` argument when it boots the environment and will actively suppress any conflicting option. + +Because ZFS properties are inherited by default, it is possible to set the ``org.zfsbootmenu:commandline`` property on a common parent to apply the same KCL arguments to multiple environments. Setting the property locally on individual boot environments will override the common defaults. + +As a special accommodation, the substitution keyword ``%{parent}`` in the KCL property will be recursively expanded to whatever the value of ``org.zfsbootmenu:commandline`` would be on the parent dataset. This allows, for example, mixing options common to multiple environments with those specific to each:: + + zfs set org.zfsbootmenu:commandline=""zfs.zfs_arc_max=8589934592"" zroot/ROOT + zfs set org.zfsbootmenu:commandline="%{parent} loglevel=4" zroot/ROOT/void.2019.11.01 + zfs set org.zfsbootmenu:commandline="loglevel=7 %{parent}" zroot/ROOT/void.2019.10.04 + +will cause ZFSBootMenu to interpret the KCL for ``zroot/ROOT/void.2019.11.01`` as:: + + zfs.zfs_arc_max=8589934592 loglevel=4 + +while the KCL for ``zroot/ROOT/void.2019.10.04`` would be:: + + loglevel=7 zfs.zfs_arc_max=8589934592 + +EFI booting +----------- + +Although ZFSBootMenu images can be booted on legacy BIOS systems or (on other platforms) alternative firmware, ZFSBootMenu integrates nicely with modern UEFI systems. ZFSBootMenu builds a custom initramfs image around a standard Linux kernel. Most distributions compile the Linux kernel with an EFI stub loader; the ZFSBootMenu kernel and initramfs pair can therefore be booted directly by most UEFI implementations or by EFI boot managers like rEFInd or gummiboot (systemd-boot). + +When generating ZFSBootMenu images from a local host, it is possible to edit ``/etc/zfsbootmenu/config.yaml`` to copy the ZFSBootMenu kernel and initramfs directly to your EFI system partition. Suppose that the directory listing for your current ``/boot`` looks like:: + + # ls /boot + config-5.3.18_1 + config-5.4.6_1 + efi + initramfs-5.3.18_1.img + initramfs-5.4.6_1.img + System.map-5.3.18_1 + System.map-5.4.6_1 + vmlinuz-5.3.18_1 + vmlinuz-5.4.6_1 + +Typically, EFI system partitions (ESP) are mounted at ``/boot/efi``, as is shown above. An ESP may contain a number of sub-directories, including an ``EFI`` directory that often contains multiple independent EFI executables. In this example layout, ``/boot/efi/EFI/zbm`` may hold ZFSBootMenu kernels and initramfs images. After setting the ``ImageDir`` property of the ``Components`` section of ``/etc/zfsbootmenu/config.yaml`` to ``/boot/efi/EFI/zbm``, running ``generate-zbm`` will cause ZFSBootMenu kernel and initramfs pairs to be installed in the desired location:: + + # lsblk -f /dev/sda + NAME FSTYPE LABEL UUID FSAVAIL FSUSE% MOUNTPOINT + sdg + ├─sda1 vfat AFC2-35EE 7.9G 1% /boot/efi + └─sda2 swap 412401b6-4aec-4452-a6bd-6fc20fbdc2a5 [SWAP] + + # ls /boot/efi/EFI/zbm/ + initramfs-1.12.0_1.img + initramfs-1.12.0_2.img + vmlinuz-1.12.0_1 + vmlinuz-1.12.0_2 + +After the kernel and initramfs pairs are made available on the ESP, you'll need a way to boot them on your system. This can be done directly via `efibootmgr `_ or via a third-party boot manager like `rEFInd `_. + +efibootmgr +~~~~~~~~~~ + +.. code-block:: + + efibootmgr --disk /dev/sda \ + --part 1 \ + --create \ + --label "ZFSBootMenu" \ + --loader '\EFI\zbm\vmlinuz-1.12.0_2' \ + --unicode 'zbm.prefer=zroot ro initrd=\EFI\zbm\initramfs-1.12.0_2.img quiet' \ + --verbose + +Take note to adjust the arguments to ``--disk`` and ``--part``, the path to the kernel in ``--loader``, and the initramfs path (``initrd=``) and pool preference (``zbm.prefer=``) to match your system configuration. + +Each time ZFSBootMenu is updated, a new EFI entry will need to be manually added, unless you disable versioning in the ZFSBootMenu configuration. + +rEFInd +~~~~~~ + +``rEFInd`` is considerably easier to install and manage. Refer to your distribution's packages for installation. Once rEFInd has been installed, you can create ``refind_linux.conf`` in the directory holding the ZFSBootMenu files (``/boot/efi/EFI/zbm`` in our example): + + "Boot default" "zbm.prefer=zroot ro quiet loglevel=0 zbm.skip" + "Boot to menu" "zbm.prefer=zroot ro quiet loglevel=0 zbm.show" + +As with the efibootmgr section, the ``zbm.prefer=`` option needs to be configured to match your environment. + +This file will configure ``rEFInd`` to create two entries for each kernel and initramfs pair it finds. The first will directly boot into the environment set via the ``bootfs`` pool property. The second will force ZFSBootMenu to display its interactive user interface and allow you to boot alternate environments, kernels and snapshots. + +Run-time configuration of ZFSBootMenu +------------------------------------- + +ZFSBootMenu may be configured via a combination of :ref:`command-line parameters ` and :ref:`ZFS properties ` that are described in detail in the :doc:`zfsbootmenu(7) ` manual page. + +Local image creation +-------------------- + +``bin/generate-zbm`` can be used to create an initramfs on your system. It ships with Void-specific defaults in [etc/zfsbootmenu/config.yaml](etc/zfsbootmenu/config.yaml). To create an initramfs, the following additional tools/libraries will need to be available on your system: + +* For inclusion in the initramfs: + + * `fzf`_ + * `kexec-tools`_ + * `mbuffer`_ + +* For running ``bin/generate-zbm``: + + * `perl Sort::Versions `_ + * `perl Config::IniFiles `_ + * `perl YAML::PP `_ + * `perl boolean `_ + +If you want to create a unified EFI executable (which bundles the kernel, initramfs and command line), you will also need: + +* ``linuxx64.efi.stub`` (typically packaged with gummiboot or systemd-boot) + +Your distribution should have packages for these already. + +Image configuration +~~~~~~~~~~~~~~~~~~~ + +:doc:`man/generate-zbm.5` is used to control the operation of :zbm:`generate-zbm `. + +Dealing with driver conflicts +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +For some combination of hardware and kernel modules, the ZFSBootMenu kernel may leave hardware in an unexpected state and prevent the boot environment from properly initializing and attaching drivers. The simplest way to avoid this issue is to disable the affected kernel modules in ZFSBootMenu, leaving all hardware initialization to the final kernel. For example, if Nvidia graphics hardware does not function as expected, a dracut configuration file can be added to ``/etc/zfsbootmenu/dracut.conf.d`` to exclude the ``nouveau`` and ``nvidia`` drivers from ZFSBootMenu. Adding the line:: + + omit_drivers+=" nouveau nvidia " + +to a file called, *e.g.*, ``/etc/zfsbootmenu/dracut.conf.d/nvidia.conf`` should restore expected functionality to your boot environment after recreating your ZFSBootMenu image with ``generate-zbm``. + +In other cases, it is not possible to exclude drivers without depriving ZFSBootMenu of critical hardware support. For example, some XHCI USB controllers may not be properly initialized after a ``kexec``, leaving a boot environment without USB devices like a keyboard. However, excluding XHCI drivers from ZFSBootMenu would make the same keyboard inoperable in the boot menu, making it impossible to interact with the menus. ZFSBootMenu provides "teardown hooks" that can sometimes be used to address these situations. Teardown hooks are invoked immediately before a target kernel is booted via ``kexec`` and provide an opportunity to run last-minute commands to prepare the system for the boot. Scripts may be registered as teardown hooks by adding text of the form:: + + zfsbootmenu_teardown+=" " + +where ```` points to an **executable** script or program. A sample :zbm:`XHCI teardown script ` demonstrates the use of teardown hooks to unbind the XHCI driver from the USB controllers in the ZFSBootMenu kernel before launching the selected boot environment, allowing the next kernel to properly initialize the controller. + +Native encryption +----------------- + +ZFSBootMenu can import pools or filesystems with native encryption enabled. If your boot environments are not encrypted but, for example, ``/home`` is, you will not receive a decryption prompt during boot. To ensure that you can decrypt your pool to load the kernel and initramfs, you'll need to you have the filesystem parameters configured correctly. + +.. code-block:: + + zfs get all zroot | egrep '(encryption|keylocation|keyformat)' + zroot encryption aes-256-gcm - + zroot keylocation file:///etc/zfs/zroot.key local + zroot keyformat passphrase - + zroot encryptionroot zroot - + +It's critical that ``keyformat`` is set to ``passphrase``, otherwise you'll be unable to enter the correct value in the boot loader. ZFS on Linux currently supports only one key, but in a way which we can exploit: if you configure the ``keylocation`` value to a file on disk, put your passphrase in that, and then include that file into the FINAL initramfs (the OS-managed one), you won't receive a second password prompt on boot. You'll still receive a password prompt in the boot loader, since we can force a prompt for passphrase input. + +For Dracut-based systems, this can be done by creating a ``/etc/dracut.conf.d/zol.conf`` file with the following contents:: + + install_items+=" /etc/zfs/zroot.key " + +It's critical that you do not include this key file into the ZFSBootMenu initramfs, since that file exists on an unencrypted volume - leaving your pool essentially wide-open. + +For convenience, ZFSBootMenu recognizes the ZFS property ``org.zfsbootmenu:keysource`` as the name of a filesystem that should be searched for ZFS key files. When a boot environment specifies a ``file://`` URI as its ``keylocation``, ZFSBootMenu will attempt to mount a filesystem indicated by the ``org.zfsbootmenu:keysource`` property (if it exists) and search for the named ``keylocation`` therein. If found, ZFSBootMenu will copy the key into a cache within the in-memory root filesystem so that subsequent operations that require reloading the key (for example, changing the default boot environment or cloning a snapshot) will not prompt the user for passphrases. + +When searching for a ``keylocation`` relative to the filesystem named by ``org.zfsbootmenu:keysource``, ZFSBootMenu will first try to strip the ``mountpoint`` of the keysource filesystem from any ``keylocation`` URI that references the keys to map the ``keylocation`` that would be observed on a running system to the proper location in the keysource. For example, if the running system is set up so that ``zroot`` is the ``encryptionroot`` for all filesystems on a pool, running the commands:: + + zfs create -o mountpoint=/etc/zfs/keys zroot/keystore + echo "MySecretPassphrase" > /etc/zfs/keys/zroot.key + chmod 000 /etc/zfs/keys/zroot.key + zfs set keylocation=file:///etc/zfs/keys/zroot.key zroot + zfs set org.zfsbootmenu:keysource=zroot/keystore zroot + echo install_optional_items+=" /etc/zfs/keys/zroot.key " >> /etc/dracut.conf.d/zol.conf + +will cause ZFSBootMenu to attempt to cache the key ``file:///etc/zfs/keys/zroot.key`` from ``zroot/keystore`` when unlocking the ``zroot`` pool. Because ``zroot/keystore`` specifies ``mountpoint=/etc/zfs/keys``, ZFSBootMenu will first try to strip ``/etc/zfs/keys`` from the ``keylocation`` URI, looking for the file ``zroot.key`` at the root of the filesystem ``zroot/keystore``. If this fails, ZFSBootMenu will fall back to the full path, looking for ``etc/zfs/keys/zroot.key`` within the keysource filesystem. If either location is found, ZFSBootMenu will retain a cache of the key should it be needed to unlock the pool again. + +Signature Verification and Prebuilt EFI Executables +--------------------------------------------------- + +ZFSBootMenu is now distributed as a prebuilt EFI executable alongside the source releases. For many systems, it is sufficient to drop the EFI executable on an EFI System Partition and configure your firmware to boot the file. + +Each EFI executable we release is signed with `signify `_, which provides a simple method for verifying that the contents of the file are as this project intended. Once you've installed ``signify`` (that's left as an exercise, although Void Linux provides the ``signify`` package for this purpose), just download the EFI bundle from the `releases page `_, download the ``sha256.sig`` file alongside it, and run:: + + signify -C -x sha256.sig + +You will also need the public key used to sign ZFSBootMenu executables. The key is available at :zbm:`releng/keys/zfsbootmenu.pub`. Install this file as ``/etc/signify/zfsbootmenu.pub`` if you like; this key can be used for all subsequent verifications. Otherwise, look at the ``-p`` command-line option for ``signify`` to provide a path to the key. + +The signature file ``sha256.sig`` also includes a signature for the source tarball corresponding to the release. If this file is not present alongside the EFI bundle and the signature file, ``signify`` will complain about its signature. This error message is OK to ignore; alternatively, tell ``signify`` to verify only the EFI bundle, or download the source tarball alongside the other files. + +The signify key ``zfsbootmenu.pub`` may be verified; alongside the public key is :zbm:`releng/keys/zfsbootmenu.pub.gpg`, a GnuPG signature produced with a personal key from `@ahesford `_, one of the members of the ZFSBootMenu project. To verify the ``signify`` key, download the key ``zfsbootmenu.pub`` and its signature file ``zfsbootmenu.pub.gpg``, then run:: + + gpg2 --recv-key 0x312485BE75E3D7AC + gpg2 --verify zfsbootmenu.pub.gpg + +.. note:: on some distributions, ``gpg2`` may instead by ``gpg``. diff --git a/docs/man/zfsbootmenu.7.rst b/docs/man/zfsbootmenu.7.rst index 37bfb12..8014bfd 100644 --- a/docs/man/zfsbootmenu.7.rst +++ b/docs/man/zfsbootmenu.7.rst @@ -7,6 +7,8 @@ SYNOPSIS ZFSBootMenu behavior is controlled through ZFS filesystem properties and command-line options provided to the ZFSBootMenu kernel. +.. _cli-parameters: + Command-Line Parameters ======================= @@ -142,6 +144,9 @@ Deprecated Command-Line Parameters Deprecated; use **zbm.import_policy=force**. + +.. _zfs-properties: + ZFS Properties ============== diff --git a/docs/media b/docs/media new file mode 120000 index 0000000..f47d0bb --- /dev/null +++ b/docs/media @@ -0,0 +1 @@ +../media \ No newline at end of file diff --git a/media/v2.1.0-multi-be.png b/media/v2.1.0-multi-be.png new file mode 100644 index 0000000000000000000000000000000000000000..50157b8398cfa791fde5ff699ae8a1f9e24bb4c3 GIT binary patch literal 58397 zcmc$^V|b@emn|H1@=MZT2OZnCZQHhOCmq|i?T&5RwrwYG{_~t?t~oR3JzvkqyY8#7 zYwf*j*QymND=h*8g$@M-1Oy`{Dku*G1SSFm1fm82`EKbK9R~mb;R1;X@+rCkpJzh2 zA`PH+o48aT+Mg5z%L>4BNGQmqAqkz30!Z`Z!3MfuYH&&ONdGLu{}AFm>3EVw1mFcQ zBF=iWv}tZ-el@wYjA_}oxj+I#w!b|$Z)B!EZN6`w8*WaXWA0pT0D2$*K)|>_V7@@` zKp?z8|9njALITh$4s==JO-aE3JT~Ie>J-^y1OSkqIzkTNS2`Lx!_=*f_4QgV zSQijK^;S!>*a^vbS6rbK{U+oJo%p8IsLpVpVy)}rbIkGzx0evLp)dg9k4kZH`b5dA zk6m{_+uwjV&sy4cN3-MN$V^+?iP5+8^2VQTmHC`R_2BMQ?s>Oc93O^Mmsp6sZEyF9 z9(lWW4h-~rQ&?;FFA2kKj)XQFm?ThdmCfp|+YQ7{&tn3vPF^o#)jF19Y)PJ1)nOv< zS?ONJd=%lpipR$dH*PFnsn~d(Poq|h!-Jo(rIci{Nk|D9>dTY*ky1f#_M(hwk1|Ok z5uQSN%F64tR@oiXlONV;Hd%6)c-KgRc(U0nf;-NA)$aGoWQ@V248^fKAwxPNfh$IGPvWezIY7d8P# z)YfsI%G0ewgrAE?`IusV;IB#wrNU5O9}D3TMVC5IpfmIR$)(T`G4ZLp`z1IXI9<`g9~2oZ`L@P>>hWo|Nh|X;=Wv5?oBG!mi{gO zr$^=)$Af~>L@a*XML?$WnB$Q;OMT6*H2GJVoGyW4N}>frx$gAo_|)r)lHN|( zxF_R_E;w*y>M%rB43~Esax8au^bUwLS<9@|UC|AZ_=2M9GOBKj%nh_0pZ6|PEDgu} z!-}W!{NC1snPXp7S?inaIic6sU0hAPYPOzo7ufK|Pn*?MY$)mS zDe3lS%N|}UN*12`2)ihzHqjp|A4PgIRZ$&jhDc!GD#~lM6jG^fag@E9Ux(Jq?-N1g zdUr`>jo$K%w@3HAJVWlv>Tf!+E?6l0U?6Zjz!qI^*DA>705Ehy;5bWcJS!PIgVN8| zphyyYca~MU(LFJrI7a={WY_m?-!AYlNs2eN_?pSz>A7twR*Jd-v|bz%E_4DeWJ4wP zkpQt+L}0zw;QmH0aJ~-O^=JVh2be)J zjmP8^n12kD1xAdM>%=bGFXGPE9v!v~6q^@2{Td-4Jghp~sQo6o%r!yjRs4*{xhWbJ zrXi+3(s#^N*g{y(rn3%v#hvw!CG@z8#)07_D04{>a@OuXk7wluA46WBE2a+p0j*8PsPgGOfsIg zXLa+{pPhvlTh9lZ*v1PX0l=pQ0aM^#U_``^MU4r0?Y#N<5l-mgt?92POrjKSpJ?OSl=JJ%JV*rmR ze)JgcivQa0*DfX(6l4AQCerM5dcn5OzeAnIQ7Za!N+Uk2&}q?Wqf?>t;_<0t>AQb= z6dIe$MnJ)UDstKv1yk_g#glH)*d`tfMCk_ep9WhzU+FFMoqW@!`liL<5p7`bG8isdYn|r6N@LPD^ zY+M@1oZD|i!zSBUq#duf+oJwDiHCx$T@<+aTWa=)WEUPE{W*{93(UIaedqC10S#}> zClN*Og)q^L5hV%dehLKk+RG-1In<{M!uPil?43L=3GGdTo5@sCtNrOne~%I7FAHtX z5G9c=)w(-nGT~&O_xmZaU~Tj@>%Oov;of?!;G);LY|1U~1gGhizBWok$*lrb>xqhJ z7G&MOJapTk^)?S@gzL_lGSAT&FPgmLw+L63hAw^_@wjFlpL1yWeUI-MJtfc#3!>X< z*4^$x+Qz~~QnKfQ$(g(EthxBwYAve70xN`#bRe-k2B_^w-UdcnDxDIB)!AZ?$FA0c z`_?=(ovNWJ*NHk_UW3UH%X~iiyASnBjjV)Mn!1TV>G^Mxpm^f@#PK7dYOY(UI+D@T zL+@_wzI=i}#T0bW$yTR3uXr+jhZfA=E>(>bt@f138BO(FOknGQ{P8zC$)x)A;*1&5 z1U0f4NeOp=3u&s@0Bnk(Lxn#v1QjsDT5smZl9i)I{%i@Vj*E7%F04|Bu&4 zM(z~h*fzh-I0;DCGGd+G^5vh}kmf9)XQlgcge8b+F%LkV&|8XQWK zN&T9S(F0EJoe!306p?qdYs}wt$JHYGgEY2I^rx%^F2Jl(ywITz?=Sh`+swujH?!q) zjNb>gkNqIa6eox2WeAy%Q3?iirZ+R0zzQL|a$V(pGW=`Xy1pG~`nscNyYm;Dd)70rn;WNGc&;cD|+BzaYZ`=u9` zum)MOt!c**w)A{m~$|kyaqP+#f#_6lJmniL(i8(+EWxx zP#0SKiS z>?6DMH0&3i53QD&>^VAQQEzEq%X*>w!^lz2b3ni|lsH|@z!=fw6XzTWRbNLbvS0;J zg~^iLNu6Nb^}xg$k^BY;WC)1nMtoRcV`H>2r`D;}@2 zzUFa#n3a!AALU@Eis~s^WMp&+vV36!!A*NKztI{z_k;eG%S zTJWX>y@%JIv%EnmO!3^Ds^*NO(6e!u32KLh&01m(BrEfIjlrBSYqg{%Fl%;Xo8?Zp zaQW5bd9+bw`hL0*R?z<0L0Zytq1(N&eN5H8$lo_VY)la0!b3r9x+0<#HdWtQv>(FW z@?{8t%c6e@K#ah89aDpJBQnH7Z1QqHDMk}4qL8<>KjS*3Qa8B+Y6Ts7tu+WG8Ga+E z9$&jbaTGPa(V}O$uN*iY1n`Ph8vOh%_hJOPlsKRPK9gu!mkx)+T}BiaCst#6}d|4)8wf^CW!?m z8P`E^uQ{ORECkP6jv|O=#WKt8`k2tUo=DLB%{87h+(=ZkgEK(1w1gH^Y3ucAFZ9b> zvW3OlviEJv`*!8_c#ptmqzZgZnoOBYX}E99pRvIr002h=S1=;STCIBF^bJtIdSnn^ z&@&Fo7vtsD3WfFtx2ID(ww{t2TP4rKNKI4p^0{0{gHR%aUQrmmXG4>KpC;n)Ox-03 zOn*YLh=`W{6L0;;b#ola2!3uF?U>P0=UJ(q1DU}xZbr>Ih(1fG)wq_$cQo$q{#^3o z&4gTjH>#-rNeTe-?d~AtZ54B8(f?Ysh#XceX{!(}n71-ki4EYL;1~-YUH)NqbVn-_ zx592IsP5c@d}71G=w#hGVGVqq1w82iGw8}WU`i;|_uA@2XlEV9+~X`5e1h*>8=oVE zd!UK5TVCfdhjlP*Y-V68_%fz#MMV3BU7B8OxC$S=*(iV{@?(YMED8-#Z)f(AzJPoQ zt3~~DF*eNeu@HB(jtw!mqE&lwf4%v)(+&SZmqe{v(g+-NY5*tWytA_Qe1*~PQc}uY zoksy#!a!4lgQCrVtsI07q5xIO#-C?kRId+kbZ@e&9V!s?2ksdk;7EVT_wIulIA(`^ zd38uSnF+N!_*kx%SjID=f1Yl2A^*Zj*UjAS2G4{QBSfqsU*t#SchWO0SM@SG*u5aa zI;u!9U&ZCa@?s8(GR2BXj>|}}d`XT|)A#xsZ>*pgn*5>fB=lqFVsB!`^okW88$t#J}441iC*RmDI?q*1o3ZHRDE2rsyZP1kM?OmspAJv( zdDLw{&)Ib}zCSIX;Z*~Qb6DiP3$2Gh;uRI!XL+i=_0gp%z2lwR*oF?rW2T7Q{`&yH{zvbV%tn+H| zm)P@o{pCW!q1KIifHClo-F^m661g%KnHAm69_sp}S2I(V7Pv@I$Nfhuwi!p%AR#hs zBt!>yq1tB^Lz0TLIcaITFSPSVyT#1aosX7wt-emw*Y?ZR6ZIB{gUQ0FH2ayczR)wn z95LpiHu>z?Xx%JygVX$gkpNZI-fZ6(4;!cJ1qY7I^3!b5c?FNkC*4Q2&DV@q$76S; zy&Z4;@Mhm?vG@J$Du(pZ4|c^-R%Fqw(AI>zO$VC^Hh&ou)3I3tg|J8`f~#rYwwB=| zaT9G}*s}qv$hn}4niW=yCcoFRj(iU!He+^B3;0t`4F>#RA$d`o9{|$)B?QuphrB52EQ@ySBzE(^1v5^SE4V z9nBIp8QBNc#fUA;Hl932HDHsT%m~ldf6vHQo8d%zgRrZp&Y%-9tx!7Za9S7Y8u zlg<0zFCYBATDQu<54DId4s>Va{r`w~fXG8#ytT`2yB>!*vnR~jx*8jKV9evXicOVu zi~C`njz}T4_Fd20kF8HkW9B1ZJewhKY2R)FQD569>wADQM%hoWOB~?Qzp=H7cbjkn z5RvE16Hq_2G@D48pQcQw9d!VJVOqGjjmd}v@7uB~S#_qJ@Vq`J9H=eSbc)0f@XDwU ziudrSDXW_ETPL0df9ikptqYLdno>^qwy@6(9zKZ`I0PY8Hh&eVC3qKLIAxMOEU)Re}xiie5*}~IL z_n1nEwM#r;1G#}UpEJXxCVyI~q1HO6OKf$pJiq_N_A)Ah)PPjxy2GA>|1a_v=$n}Q zhraEW?5?{9b_D|d_f-GlhJnD)iNB{rFWTxh|L=b&!EnoJV|;D?d;9*_IoDzo*gN*R=wz+JFssipTLr#v`m4z{Fe@WCGx6+TYE` z`mbcr#ef3aLjDgn-gXKA@5fi43h=&xRY|!)_4`lo|BZ-mH>luuW`Y<-(}ns^<{b#^ zKX7!y1(K7(%Hc!!@1S7gg1|3u@=gLN{1@i`KRT6wegk|81QP}X{J(d)214*HIRv%` zPXYPY;QzS*UM#@3DXkS_LwQ%GSRcGnSYQJGV@BWZjbFBS(zP!g=ys-0ByEQhfB@W@ z7LP|<;QwZ{-z)Ame}+DTiUJNgANYSaiFcd(S50bp%TyX4*7v`sKR|eK_hPQ>$+o(|(n+l}PNr9O_UdB`TO@%P(n z7qXe62oZL31=6Cf@hZ%M&NH5*lT=ivUSNl7oFk8%5)3uPKA1;j7r-F-${T^F8sZ=z zPukaKeP~d(W)+EUM+Bn4*lT01VQ<|U{ar9@{8E^WjZm%IWiMAZwnb5^?PC6^IsK)& zdsKINn15G*g7Eq#1Chl)*${W6^{1CIhf)IwLDD@M7L%(-awtTomu(-+wG%)>jjX*^ zUnD*L%%4w5OcMkQ7scw$Y2;fhIXspAh_(9A#^fc1-6z3ti(?#`GSV_KNet~S0`B{8 zf}lw@P9NMb8dxZk>x(cyXA%)6%&)$2AE|)m1OzBKc1W} z$!pw>5heZ^6hF}VZLavtQwTr-rh84N$5nKA+Vc?#`V=r9Spxu84;EYj|R z`@y0AlYtqdeYtpZdJy27VNCHRrANgID~tC2{0VE;kBB)9N>iWRs<)Bl>%{^OUC*{8 zBbRQydy|Sp$UQqSJciFE;SZOeH5*Sgl$??;s{a#e?ETs22}71Ts-YBCfsSCW8zg0Z z0h_u!W>(uk(VMKXy|*!?;&ICVUhen4mQl*R)JW zaX8x_Y@G>pS-lCJJaSK}xyUS+xOD{`)M~&=M-_{!4sj;yC52>nv$R0KS)A{F=|`$( zySM4yMTS8IWB~sDKAc%DPS4rBnjeMeNE%DrYL(aG7I1BW6fGd>*hqsuZpN&1TNg_% zkDKr00xA6Ch?s0(8xoS z#&~m0Mb(kp*cAbv%?s;;aM@|YwYQa_MH?i$gtFyg)ZtlY{{tOu_V3Jf(xnt>Ok!N)@Y%V+)!iVf&9Nh5VN7v4w8AnI_@o=0kkd41F0z4oxM9V#US| z?+;@9O^t|s2Vj9Er7|L=H};B$hms_8Bqjz7FJmNl94pl`IkK^W)oq?sZ&!?e)hj!=^lqFe=8g@HUe`PneZYp_J3EgAtB(j)R1@9#QrN>$Mc#28!z zApMG+Nj&Deh^9=1MS%h7l(XqA&f;dUW)*Ci*sKc&iXetSAiUc>1iEX;T&|0LLf;3- zJZ^Wtj+llzTQu)8GfdhF)IsU8=4r%w;S1Qo0Yh6C<)`9dsQqJJ<1Hj7+RS%^0(RXs zFE0@XX~u07zu^0FBlgbivGVNRV#FdNhw|%pnM5z~td59~ewBdSLH}JA3V9Q3E}dhj zKA}`O?-C2;mEP9p;%H174YVFsHN;vsFsMZrTMxVhqqiq%Vbm_w6Shkt&yRN*5;pYA zGTW9GBM<;%8zEN+5ox%>W@d}vcAeNo{K1U!mK_MmVmzApo$lw-t)wJFhb3x&qFz=q= zeid+ZZ5oT@qR{+`Z2v*DGN59EjwDQ9kX*^<^lvRd=+-gGpA)atqsnfqwIR2}CLy~d zdpy47dKFze;TxJ@C*jfp|KN|#bSBME`0TEV(*&V3{7?}Knq3qQG1V`eEEMFR7+LXb z9!HKMi}+-Gqc+$AY$#}tw#awgBrQeFIpWE|L1Q9y5oYqPxVsl*;sUMV@(mCL2L>8; zHMGGMws}P>pTKL2h39f-!hzrQ_2Mpqs3aws42s5wmBV@wATl0uAqk-$00aFWkFd5D zXuNOQ)uf8~u=aR<8LCr6(}Y{KfeD(JA&!tBS7?2n_*`U}b-U*a?OrQI*VSoikHzh+ z=k>j4-#HZ~2uP3#W>86&6uyKoN9k-LA9Qri#8cuX^X!B~@(NKmzqUVw6hXkCLJlLG zqHK^TApIx?pttyN55wYgzBkL+F<*S*dl;uchmIbL$IWk`y|d|v%n=w@9abB2h+sPM zNAPpgtK+_y#?&&qfgk`32@eGxzx2K~Dl78u=*EhrA_0ONSW&}baZkz&Is#rUApor< zzM|C?);!IRBB8d>8??8ew;c+UKcUH^KoB)?K$;Xm{-vAv&;2ro4@rIW?60wqZG=zI z-awUKD+&sgp~6hqb@A9)AE375D;a%iKl#ff`Ro2BCkz#o5&E$zMnNN%O&Q$)_U};p zNXdT-qB;G>xF6hw(hxYYpj%m@4EqIbXR2!I;dATBz7-Hb)aGxag6`|DKS={gIMC9i z$Zq6cfhz z?$$NWD_;#XL@5~Riq(cG!cSN*QVxuaa3Ew69WpfqzYxUb&muYkQGpuOrbGsHx6b9s@jgTuyWOKgH0JNwal{FDWBTC|lYAQevOUnYxOP+#ek6_5erz+1E}M4BDpI9`GOxPWLeL+)QPt!NylQSJy~bTYXBDyuIx^tvx{~ zvV6pJ4g8&!eJxk;j?GvG2Iq_#X}oQfr16VH#pzE|7YQiY0D|yF z2}rs00dsqG-Xf7%mdKpN(4kJN6ifC^1*Q{yWD?FpTLr~OzPN|CVuf|;?97_22@b+y z?yv5Vr`t1QUHfT&^x$Vt%_P4|%dzbU+yRgPn7=4^1TOMSD@-zM?;n(!t&4F6k~WX#CLB) z3h@vKE~BPoI(3vVQF;J!q{_Y zdRTUd$g*}`k6D#^bM z@EE3`#+OJ+on^rht&~4biBUsif(R^~g+TYeA;|GV^erj!V}~90{tG$G4?^68pC^5w z<8&d@Bt508-f?HU39|-~BHViW11$e?bfJPm1u}HJQl+^2sP(1z$T-9K(*fCV3~;qQ zI~)1J1bz-kPBNDdryEsC4o{!F*xzDf;7|`{6!!-gdtZl_Pk9#scp8bOo5<<~w8Uq$ zq|N;l&JCk_Izu2|5o&X>W$8Col2+0K%@-<2A4b%~lPBhPZ-|G4$@J?1!$Zb5)Hg*p z=U|vfh=TbWgte@;pp>+WaNMthX->uy4U72D+4m!nW;Ub%Bpo{o%TQzJ4QYh?>FbJH zDc^|$1G8<`$R`#NZ}#{kZDK|`)U4{3e?F5CgB7qNKgX&4knwn=Nj1v7#Kp7cQn)t> zjG%W2{`Da=TFvnw+PI|6vJrAMKr-6X~tbnD;(u-?cKhnBDY{P zr2>WcE-*Mjz%DQ4W(j}*WdJa2R*-;s15G$MFa60VO$Z7rTK~upq}9mfm@3iCC?P(1 z1HKmSt=H;5jXJGC4amqQhzWrK-3ppahfbt1UYk_0aF+a=lKWph9EXpUyI}m>&4~g0 zA=FC6ze_`OLs!^G=eYR86z-M_2{^^xVYeAT&#FyMyaW!k1U5hw%g&MtA01nWF+%Y{ zmRbEPL((+@NG7RkHHM347*r`^l=OIC<*l%j81Kr@8I8Q_c$Z#fDj1MXVxu{X2qG57 z2&S2QlpqA)Qv{XDtM_|uQIHVji&Vkq%(-@mex;6tdlovk9oK?-37g=q_bX1Y+c5#v zyVtg9yaB})v{E^-9oZLBeCmIYBEJH@Q?-A3UJ#R{S}AeE^ka5o|EF<@T)(4Vz7X4_ zrAHzL4S$KTK|PiFN6J#-dM2n#qF8TxewJFSNQei6;W&9?=f_|kjM*tqZoEm1Rp+U( zQYM4AQ(T%U!Y=WQg$?oyzK@%PA063N-FxDMDu-Xl8ozL<^h}HtDB)oTPOL2AWoQ_( zdsbnAQcy3#Kes3h;J4hVzHfd74&D_2321eJJMSlDF{0(p(pUIc*14gmj~GdTvZ|V? zR*;Cs5Uz~Vn@0vGinJA4@k6R!a%W=RBn_o14wRQm>GBB4yG{n9k^;Ov!kQP!52BtS zsV-MV7Iz7!8s23^2>1aIfG0ZE(2*<{tVDQVZ4DxKU0b&>s61DQW}?&=hOT(oCJ=7`VQuOz=q;Z(?FweLNNzfIQ; z_Nq4Ic)bZz-Iu|*Sn9M5xxJ)?HDU{Blt-gXgJ*IJh%toS*8k|FafF#98ml8ciI24| z_}J7^PA|imPFou&39lB6_}Lh~=n8iGQr>!B=3o#?ocQS3+E&djR_@~B)7sI@A4!Ps zplBdU%?N8Yd)y+wOH6f%wj-_NkroM48aRj`<(WMy(DXM#y>zUJ5^>KIh`6J`u|H=} zrg;Wcx^VNs;&(=sV~QM#=7Q@BJ60)CekCQ<{SL|oLVJ^s7%lCJ#msu z|4huWP+Zz;pIAfBBzBbv(T@EO{Cz{cPslsx>qE|jw`uH7EwG3h(HjrtM6-hQzy8_2 z@Zwy{8?1(z7;_Qo9v#Eov}p{G$k9&Fo^o=wd}QY{GXmGv`) zZjploj8@uflnq4;ZflL~%hAZYU|XPh6qvj z-7!&k(U7)cvG!vl@87fx1pjM$@7CUry|uu}E6HgzHRwrFm}T2b{v?xVUp_B>F!P6z z6i+1@AL}toh2!UnFjV$tmcj(c#^z@*`?oRWnh(0ggfAy;#?tVs`5{Q5&{Ii8VdXty z2Ce~X(R@Kkd(BI|=p4Td{%-|jl<*OS`;WI(Vy^UtjKkwVM z&6*u;i&84&O6PmEH8>?hL;5RcJ99iWEz`Ft6-H3wO-&DK#G7`pv~+Jh9Sl)+DbC@W z3PT%?k88WG=7^M#5=Qd{fn?KwtouD`8`X(C%bs9qf*#rIZJkwi_|f66TbD z_$w`h7#0|w%oAKF@$T@osz7#>cH zNtG^**mcxNe5v4Kz9Huey9d{&H1&F|?@c}q23IHK1K^?15#S(j5dZKF68#k07Tpw6sMENRJO0FFxRF^S^!q6( zR2UZ~n60Mb?R!aZKD8|LHxr{tsQYVy_OEnh+uD&8by=Y0cQgU{iG%?yT2S}5HNv^{ z?evc@tO*&*!ngciZ9rhEAk_V2Og`yA)4;(0JAM59bb$EJ(?MKQ_u^NA zujM&T>S!E@kr>}dY2bzC8yCB_|CttUbYt5BktM^Ep|rQz{F|2Lp^Mu+7m%2XhS87` zZhLFz`@s@TqvN(u7U57Gd9^slI9o=RO1p!)t-xtC28j0mLGUeFI)Gf@)78?I-JX@4 zo@M{qBm@eI$vPkRaM^hULpsE~AeCIR6;>Vyp=}}GH4%N~jO$5kO+CKBMvh(Wn_Hl4>z6USbm zSFls;FXBhTcrqSq&o+rcn(D6mLl?42l+VV`1(YY!suq@Xe5@&R@#DN~#?T5l`USlSxz=(x-R#0~Q{p-ucUd(0R8F0j#NhpG&Dmk% zaUUZ0Bw@mJ;m%3o(Li&UBeP+&Fa)%o^c^~W3Uk|~KK=Ip2OUNd4p)NYOzyErX3C*K{y z*;#$EaDRH7UPzJXJKWXT+hD#}Y3umJ4;VgE1l!wq@(j1efQPPc#eA~v7QqB@W^O*4Kc6Z*0dfk`$Pw#qaVJ&2;U49| zJcM$)4r}TE==yo3>5NrPZ!>ka^SD8KvgFefRMLO{=Wlo$3LI3OjH4&Rb+i2X=LJDi zJPW4^S@5;bWAXBPe0Zxk{4Uu*ykVp7{l(YgRdPH7lzhH371ru9i1@1Y`4PsG@DRy? z$!4pa`5DU`yN6mE=_8fNP$8=akcqMF6HpXej}q>62)u3Knya8JFB6V9h~b`HxiZYC zDuaRRR*yn5_UHgWtHs)Kt+vwZ9p7@P6ecP>w0sYpqWA5@Xsyd@bMOAPbg$UQQStq} ztg932#N;!d_>|FRu61PdC|M?*{;T-*NM+)}^o3&>LUZ$}538$dhWH|xEuMJl`BivU@_^bVTU}kSi)qC+{#7|0+K$u(B@}1>>h_9>Sa&zX| zBg;kPAh^@+*PlzTD!9si0uoav9PnexcQbOD&9-khsvnM5tIqmy?tPDf!4+Zcz%GQN%@aG0u1Kl)0jQT=cOzmJh?d}+nkZ|U5ba9) zZrA7vHpKa`bDP;4G~<=4IP7J1;kNiJTyyZV9ajckZ;V9@vkr25#ygX{@R!cRK_#dY?V{% zimbPZOp>H3SLPVOfUl6kvEY3l1{+Ra5h_x#hB#pDNH6E|a;4M|jR^S@Tud1zR)? z__kT`fZN<^_Z9EF-)}?2$548RE(EP8O>F?1VsTw^17p@Wb3TU zFa8kM~fiE3Za};oZ13Iulr{7rPA{ zxtDW)Xz@!t0rJAM>zlh=^dHX%lf4e^cC!{196#6;&iR=-w`a$ zem}eHjG?SqZB8WpZl3MQ<5Zg_X1AWEhGRqCZR(@n{mW$QbV;oFqB-m8bGI?($XQpw z?a`RbCa>(%86TN$=b$qvlfk%>yF~E#*@$*kW=PsC~3)As_Zc1Bp zk8o;RLpWo$vQP1P>+wnfH%x&sIVbDdp>Ansa^+N6T7Fz+l zu`g;?7g>tFoE1kyMaajl^8?RcYJSAV)7dQXk3GvEH+KIKE+_U- z&kh3&yir=_OQaJe_Y=={HU9y06MZ1nU3PBah-CWID689%l|mMGl9vIllUR z++1}qwuc|z|LDNAAD-S$u!3050sr=^4AYqm_0RWu9u<$INO)>#MP0%RrY9eN>xxT{ zMi9KW5i0CG$mlGu)m)0Ji;;?6GsYD2UeHlSExzI{N!kujKU*_9$i2f0B4N?!nq6i7 zBGcPHG{$m1*&(e-am9_I&cxHTsp~ma*E6=1<0nc7p;jJa-adMU%QR<~vY8^0<{8gR zJS?ZIi$(+j-4?+a5Y_+xvhY*^D`mi9$-=TOqdEcFnO`Q<7^Dja<3Wx>wYEYE(QoSk zBKmrKf{oBKqj!3$x^kZ_8LbNIZ_T%4?T8{V3qi2+(+vV%!BJaRhN@}@zx0&R1xJ(M zl24>^s{L*p#Zi33VOCsIbXmgKj<{Fv>yKSlxB8?w46eUD}4?z+)ver*reRteIV&xlla)j9XdyA%;VZW&cmJ?{m9!x?Pl4%tIeEkpk(W16K5AipJ3%BWO;xjl^V(|t+9JMK zzeV~JwTFlM(?xi`X<;772$!Lxv3(i&n>4e1a@(&U$-qHr+lgP3&ZeWIii)O`l}jZv zzhj#;g>%@2nU1|r>0x%6PQ~}=jF&Z{wYY~od~P&Utd-soW;#^Q{J66AdbcK$Ib0D`Ae!6D&oP>IJ;=a)A#m`ftuMP zG4e;$N&4*{+6Ewt)a{XYv@re9|1Sb(PL2Lm{5u6>cBik;0wIH7$7e+bSJC);PzdX^ ztalDFBYAZN)Tz@bNEdZR2b%>KncWO>e-oVckKIL74Vf(yEL_DxCG4HsU3yA$q-~*` zQ;8!t-UWCAA3m?Mt!R?ZH@bt(=UT`spSKZ{vHa-hccOGVKHUlOJKx=0I^*~kxyBAH z>dX@wn=QAa1Ct@g=FMZYE{d%S<_^#Uc`=AoAR8yrs+|Smull!DlCkt43E2d8f)`k9 zENo)s%x80BWoPb%dNKIXWtU)&7_*s?8Ca>2f~IJe(7I)6-xzl{K&-r++``MeWiU#r z=GKz}YA}rSB@H(;8=K zoV`$xsL{>hB^-j-N|fa#<&ZkCC0??z-Y=^#AJyG8q_$482Ul+iLEt@4`KL}D+t9v! zw6s3U+A16MKwrod|0Qga2reP8pNRiIp&OK)o74z){5M5)p&YdMWP`@b`SY*p_02dR zm1AvJ`lfE}#L@Ndatd;Q4UP>I-r4Wr7}p1Iu2P*XT6*e8zL0+jroUYN0OJu8FjtM2 zi)1_Z#-DpI{W0chdt0G-vL}@NM=71P#*S;VAt%DX;W+E(PX;XR0xyMPkoL<^SwQcWUXA0~!jx^nly2ja+te9fDhObxvQ7jTQR<$)l zEa>dZQX+%NZs2RZgW9`}q|Ll!Oi3o|%(n>~bI29a%@mLtuVkG|Wxhxsp_oB4izir| z&6fVq(_H*I=5oP<7HJp_=PjAk^p#=31ytVY&cT>UXgX8vGpu6g@;jhl!@~(z;WLDx zx=3FEt3g0QXni&EV{43R&->lnB5y+Br-b>(X`QIk#oEiqz^I)m-qc0+t}MCY@X}VW zASLyjh{K&ae%eBP`J3=#2YPR@Mm7Lg+%Vqtl~j`ASyL=fO1q^%=Qde})2HMsJ2=Vv zWA+5qTZ-wH1&GAT-+Zw?mHS`81uxqZ>W!abQc|ic_I)8K21LhO8O`u-AEF`fXz0s%08dwM3F8l*a-wMcu!( z02ZxR2XMQXKS?ox@~;H7M%}JjnhrC1NTB~3oz#*I2y51y9chJoXMdgDh9SS%ze7y< zbh*52rgAW>bSBkxNttw4{RBRnn(FqZIz@%ZBsK=PcgBzMlGMWJ?kI=hsPCZUAZ2vAZHlj4UV^81+@0pAqa(z zmj|FKb(O&Npy<9$#BL(4rPrnDO+Tf+OwM*v)}ZuEtL<#0;o3g-7NO56^YPsKTIUqF z-|Vf*EFIK`mt9C)HMMUQ66!0Do7Zwjq<)J`zUYs!!GfnJ&f-vce_al&r>Q%YZ=N( zbylY)U5Cc_!YB*xg#$b5oX+cO1F}??*Ix0**DtiF2@9snDgFPCy|;{NtLxf@YgmB- zr7Z=Dx6l?VUYtU)Vx>3~cXua9fl|DH&< zQ8Arcrn0!Bd2}yfjTL!=r##gZ_mxw1*bTh)qQ%G55m+~WH>TJnvxUtA zYxLfQ_QQ~dMfCDzF`uw`N7sHtxVqycJkvPX4Qq-dX{y+clz8uMGS`C-%t=w}IrLpt z4e7J(Fo~o@PWJNnugPw~`uNusP@7ff6xc#XCVmlxyU!lgvONw`Wtu&h$Ld1?7L)?m zeV)#5U4=d&IC#$H8bQ%`qW}IvIEXPNP{XfoV-7eO`6xw!-ltKYeH4~5={4&DkH>i? zachBWm0~I9e@ChxFiScX)=An1Z^vv|ddC%gk_ViO@(U-r%>5FvY3?6;FoXBMVAQMU z(M&5#!iJetsa%g_Cs(XlffZ?Y!IBOAWZG!p#%~=Gz0P<=lgEI~DC?Edb?XIW#z%`L6RqIi~I;DaAliS>)kzY)vMkHqNq9RjY~t@Djh^h_9e!N-(tF#l@%b;I?Ty6!U<^>+et~AHLjrAv+g)mruaJxVoIv+d zr?hIBkz4)NX7s2Hx9b8^7wR!eylaCyaj~c_;nsd$iKhm^cl>+TCGvdy+iJ^?5{nA( z6}xfoZHtIZ8_%LW%vsv!dP@#=h2U2-g%qr5h57!^UXD`Z5T?t~YSnsQ!s_Q8YK45B ziY9xw(Ef79$#*;8ITVhpY4Wyx^`)9$7k04iy_Y7;M7l)&yTm8jiJ>t(>H z-S1jmlMMb*y)sBSU?j;~p+l+la)Oqq0 zHqkzSO+r9Gt}y*rhk~F_rVs3Qao_5ei zmAksW#Yoy<(OoESota!1YWMpgEq`CV*_(UCN*wr|25%nygR_2{T2JOyCYctQ9o|1i ziL_l4YvkJCr0V~?;>&z37Ay0gY=6JWH5V%KHvw+QRPTSfQuF(aMb7Q6zi;Dpk5u4y zk5mBY*YVFQ(+>$bEf;!EpGAJNMg3FjF31Kd98w)GP(7lB#@FD^bVhltz}UQmG0e*0V{=5}YKsFM`y zBes6Ko@j=|6h}T)iDGbE=dav>O$>@H`Mm%M@n^wVliAT0RyAYx(b>U=XCj)P!LQqs zDl^Yt?6y=2Y8gjx@Z*+BYu*${DK)M2Ak0FVq3TzBXQyj zVrLn`%)b1B#(O+$qW88(C*LxDG2e;6Cp$7=ujY&BHmE@A?~KVZe~&axucbGQ~0Stm83( zk@S`27fDRvHO%3a&^HtUgjw(MY;jb(Vmfv$xG&ppwUNllDQPFZloj!OtimVt3f^nj zS?(vLC0bIi;!F{7Lp87U^k(qt!A7kQ*PWxUn?JxpUkOr;+?4jKc!^|FMn5_MZ(8jZzH6#+tP9T2hYVwgG zw_5q_Ic-5}zB&I&$b+zt3hnEJ9z+q?MtqG~SNFaBR5~%ZvVgIKP+}=@xgDH2z5pDN zZ>kwibhH3_?BKE}DUQJVVac)_!!Yr>0xVkd!ROh;Gm>4_fE^PWi};|@!ET<+xJg8yeCBE?%?km zCQ^n-g&BDtV}ZZ>cZYNdN!_{gH#H@oxb63j{=BN73^Y1iG&fxMnMARKHSYe9Ck|_` zR2=NRYwqwKH7W2BgF`AqsByR7u5`O|>|T z{PeVji$&3-e?&K{Etk*#m@ap28h33lqOzZ+6e$}N5(5hdl+ zgw;GdL}XhwQb1ZWk1D+=J>O|d&PTMpiFbHf``f53j*zsm?%SpFZL z0S|~>KjkZFzQ3O|xZvgSN+Fjw_$k-90-yeyhv?^og%&F7jQHk%+jx;*G|%-an{en} z`RCw0G<;7ThJ%zQ2y$jP_%8GnM<+j1_BrWKBzff@Dfw9~bXX!LuZf|4{#(?Z4wF=kl)rf-z zDx#|wZE0T;-+{u1&e$sXIk4p462#vVIzAJ5Mk3e2TXEaai9w^RK2Tqt&csWm3C-8? zGS~_e^Xa1uo8(Cr+(L`A_>aR<(g^I{+lDdAq*ZH`{P7JJbT;Bl&UsaOE0|Vj;hSfS^IAw5ftqc@8eL1n+rOF8WKCwNNiZXQ;`+d6nrcMfI z-jj;@09R}<@d_?y%QOHyU*xgZC1q;2m4V7yri-j)uv@NiG6# zuJG}Jo(tM#dVeWf53i@(0}<50VWeYedsbxCSQu}J9x5xoOO?qGip&UMdnjE#M?0M% z;%HFHElYg2zN6}0<%`BE9{N*;a_Hl#kROdW(`#BJy@d3Kn^JtOX{2*e<}%cVr0&uk z2}Z0VEu?v*iEn{&!}mCT2#$Rf!QfRce3hBi*R!MfJ|xkexjgY_xYqF9=ey5kWrM}v zO5_xie_LOeCYu^wGkWbW^@<}GC->#0EaNQrHFm|LfPWklJ$Ok(`2DH*^Di9f%eZ?+ z_0GGykFJYjE*HX{h})Fn)hPSR{=Hlt>{rJu;vv*hU0;6q;*-A)nG01Xy60K{dP?VG z>Dm`Wd>r>A2=YGcvp4>BO=*kqU`!kg|Qv7EFFL#i7O2Rw%LX-T^Q09!5Eo)^MV+`X(&4?sE4*?Zzl>2)>r8l3#DKJdSmel3Kbi?Sj+^FE2Kjk_j* zt@R_uQMp=_NwL?-W&KP7JS*IgEo#FAG4uL{z&4ac4wW6{VS}~dF&2Zhq#0EA2t{t) z{{7)sNjH3^Hkz8|J$?Vi2yALQhdbHHF>nLx|NiOq@82%ovjVEoA(unwlklAXcE#u3 zTQx^iKStVrZ`1F&7GS5AD`#xR`cVjVT{>D+R)tOqfY@m#lH&>Q`L-;zBcD<#r`MNSe_^ zu>36Xz+BL2*>G$fK>l6WV13<78@m*xz z0JtsRhXx%#WhFzOR{B2xqmRFcJr>25=}jjVLRadLS7@{9a5>sVlE}{Iv7juzTTy6e zmv+mAeLL>u<`>FUuA#jtWELksj(Cf~+o^~(C3+V@&g&HN>MpA_{$@v)OR-jMt?0K2 z^5{FR05q$$N@~85}kvEhP z)Y4;PH1_z*vD}aoV)LZGl()wD(*v;3FzCY&XdpkY zdA3RT1sB`eudl2oc(?`TEk#HQ+Y)Ty)cEA@&*}}~t)vN9vxCQ+oO%;=n%(#W^UIZo zKA~AmgX;yG!zi;*(>_%i37R=iUAAr>Bw_&hTA?DAYQBnV#&Y<;dyj>Lm%Q2=Pd!lvUOCeOsH`M8)#INz8 ziC8N){ez!8j6fxFXao@1aW$EB_*it)osp7~aNT&D&$@?1&AJY8iWb)h&{6!ZW5aVu ze!5)2%3yA}n1Y)1TRxo#d4$i8YSE_6+k>SsR`7)VRq8C<0^y!9d|J&rY58|?s$<9y5K=~ zS=$&tUDEAHqw7QX`Y)%A{qnipc7X(|Y;Z)yet}j(K_!Fp0&=ojfzEoU9@IgK)6x3q zyIM&KT#0y@*rKGAz3LgdJ=+D#l)&@XijbTK&^ zUZeCy^`0%jYBT&a>A5P3~RO|*2t6|~P z6&99bea+;sN(Ig@Q=j^B1>hQB(pCn)QsYUj$}lZS<#Nwik=JUI@eJ2+gHZ!ZeVFXV zjf78H!}t3yUeQXDG@|yaZTEC|%)KHpY^lmHBvb5kkfM^Wi}*!mO818}UGhb~4LCxk z-52}XF6x+P%v@gRBK9u7{$)767I&&kb@{3n1d)T6n;ka%Kp;13>sFtvMdbDbIt0~u zw@*!61%smRP`i;s>$KtdG<85amHqP;Ks)ii0H=-A)cV3ig4RScWVhyt!`M|V(k2-x z=QPi7(K#5&q#*k?-OCACQGgN_uzwp&`!ycVn zYro+a5O5Y2n^@Y#!-m0aIg0Hj)4u?yspTdVjg`D4HHVECCD^u2m1r0cP?dvs{0Ked zRcj_1&4~$+p48oIFh=-a;pFzc*vDq=F_vn`+;e>Q(=pNkHQ}pvHGAi~ft8---hOg& zHdi`x$?4IF=4g2hzJi<<)}KSCMqn?*E>5IZ+#KAGSJ;}@WB1o2FR|yON29Un3a>>c z3-LaL-FC~Ak$roWh^824QBcTax6VFBS1Sp+QqzbTG+P<1qyF)SWplGo#J3;kXKv;m z`ra9P22qBFM?iV#aB`SC0y(t*VD5BjWu=sy>-b1<%%^uWJhwA|+fq?6*f8kzhYzm< zN_Cz4j#!)=-RoC$8cJ~eTc`sp-Ou%y-u*jP{tlQTxBZkLcLq-RP(Ov; zX(^%7jUY{+9=S9`wV>lbTc?xk^-{pgHgLK|FlT0RjkUkQ9wr=byyaeAUO#&R((xei^4G0w%g`WuFwY2=@7x6?d>@I2pFj|AQ{(w7G$gA-4a7mo%#S3)-g zkB`<Zr6yXkDk_<*uV5fmkPa(!Fsm5LS83QR3 z#~V%}P-4`t6w11p{e+<>ygvJtg)ox+R5*%$%$b88;Y6Hy`7{0?)1*!EvqdAf40dga z8iB21h2ajBNkZuMt~6NJ$l6T8Us3%vQ=F*ga5p)orv)V?C71nsR+iVJ$(Y$7>)TB%96LE8$d2;C5s$a$;t#a3G2na23uh0j8Dvy*9VJrfTbcb2j`F(e7R+1x>O z_3^YNwVKGCGK0bspAyQkp3~#_K=tXY?8W}v?XCptIY-Xyo_#&h@$2zeMn?IyLXaLBVZ0mxHKspb8Z94G*_3 znGe+yRO3@2SjoiTvCqaZQ_&!)b~M3gfA?S5@ZTRVFywhBo~GzJDH0=2iP5#*1``oG zyo+;=BU$9Hh3`sy%XGFCuKcy)13p}_zP(4gG-eObnO0;uzGSYnspBx7jX(bBg|FMdEz)YC*%QSDXyq3k3Z6Zmq#&@^7ef5<={$SX1xrL9IF<&eG`H)-c9ZZ@O{vD! zX5;~ot8^q+8;cx5SDmr;2OH;+^G*l3y3Ly|_Qci+bU{h3-UkOz3Ly`th2)L7KA)tK zlL*__i)js)kqWx=&Ra@oMC6ml_7DK4@$8qnarXnTP9cTBIa)!$VNq2Dzg3D{LY=-uFI9V{m3ZJGFIbVo4|G(+{SjO${9!6d~WE z6P|FG&6yoJQWe*3<#_asrP|gsbx72F6TIzx*3?AI832Jv6~-fc03rqv^1GuO;ME9(u#bQ?+joPNZtv*4&6k zx9;R=`6@d$h?5fB*!z2fB|k}JxHMzDV-~M|Erf0ZYE}#ObPX}bMfXtjuf3N*?~)1k z=r$zso*3nk80Dad`QD@=+!wJ1O=8C@Z$@z-@CCwQ^j9l;F8X1kA8sbgU{t6{M!6u-)@I%?|UEg z&e_`PrWL5!Oe9wsOcIAi;s7Vb7=*a37iw>x)0x-|P6ZxpqsOC%sNR6muco!6X|nPJ zg-xU4xsU3tYa)xIm}j{VOTmn?$uLLZF38pH53zk=@K01mVtlM1gO|K4m|LFY_R7s1 z$CvmwDo?fAkxgh~1+tg#WSlFt%1~&HhDO5FYi(=;35$51W9(fRTxJuo+Mo(V?uB_9 zeM$(x$jb9>s+9c(q`UF}`5Z5mSJtu)jOK)Xaw*krhH{rdeNn8!^E@`lZJ;+7KesZ{ z^orYpb&dOmAh1(SuA@;{4|4sS)VZYNLnzuPHi%Gjj6WeanCJ&wVy`&=ICj!^Q083|Sd?yc9I{i8z|h)k^2>%8>{(Dg7&E zF_{`}{ZfXO7dOh*KDHxCaU|nvS0kja zMu;E+!u?qm$_Q>cU>X{pu@XGaabTY>VuwcA06 zVf>}0ez-a}!8cuSIqa-ncg|LjOqV7gy>@x&w!Tho$ymIX{lr&KTeNPh_~v7btu+@J zh(0R|(jmI$6uebR@zTa;ehjU7W<0aGvpyUBtzalDkZK{84UyBxll}Ayzb<#7mL-*( z(M}1LQ~&oH;JdIy$dM`k!u}?^kSk%h zimP|p?$g2H(+I?3r0)4(?9PJ(3|+p9%wAOWPsM#^-8aon6Iu$*mHcBMSXrY@W5rb- zwBj{scp92_XOc_c*iFKpXcIF~M2sqsMkK`|18cf@4Wa1( zQ}1Jg+O#2s6q1o&V-}?-wPPMi_2$=w+gtT(XC?DV%%0j0tq4VjBHu>;5?T&+r6l9Y zwshQ&@!02NUd=_?BIY>}DP~<;3B6!87jGkXgVw{t& zM{htfMd8cR2V9x7CW!Rjm`{_jXGWp6dOtito{q#fwips80%DlTt5{54{BA0oHsW4td)Lrr*>Dq12JBN(ak$LY^^}78VfIjMe=(SbG%M4~ zVJ=-=s;)j|PAV!^Io5vGacw4t36VASJZm$#&L-s5hAWm0^5F1rDxA#YJbz2rcuPVF zG@QF(vaYP7rdo-^OkEaiGT8r?W>>lNM?&l)HCR!Jmb3nwak4TGW}6#+_n?;W?Fr+s zRp|;r(?xhBgC|q^@oETXSJC^=1zUmj?oZ&hr4axNF%WLY@o0ZF{JfBZk3M`0~6BDkDGl|1A=aHN>_Q6cA)(RC6VGV4WFU zMI4>HB7gb*W+eaM2eB*Z9KMWqT_D#L*w0Ad*%9_mX>_rG{wxaec7jtB8bOS`P^%pHw%ZfUY3c`6P3e zKDn@gmyajgZB1AkY!4-cV*zhWt>33hnsw>;cb$g0n;)h6KmN)cgW`And1y?IcqUg{ zL&588&{egjMZx-$Nc1hm@M%&aG37JGgDZ+6g{F($0F8;UgaPe~xl!q{(j>&s?YU}4 z67lPZY-)4bDEuNYER7o^Gxud=lp8Tv>jHEGX{NE9-Hb$# zte>y)$PD43EEdZP-plAog<^*>$L9KtOi3PPZ_F@4@tp;4la?;D$4VFU&YXB_-pWN& zS=Q&xb1jp3JJa4`(>+fgQA=P&|5^9^PV+*#nWuN@hWM@m84v1kW=!)!!!ZJ;$qi3W zs2Ok0?ceg%5zCwNJd6q?uqguP!h@L>PG_0`h)c_h09WsH;%YdEpK^Qwu-AePJA4%Z zWkWA*=-@DxG-(BUMZxW@RouxvW@{CM97cRlf-7UTvZPo(>F8-WEZd8zrpNI&P12Qk*aJaD58b$~L05=xNNeLZ zU!_o#hHiY7S6^nQOd}j;R1;lfhZzvSu+t52)rJcf|_wv$0m6#qpWOT&x>_ z_WuIJ*6UXP#L+d)zC8YDdCqC>M+}kqhBi`O!wN~CJMb~L1|Eh!eEq7z$Fri#JY^j+ zPV6f2-)lPayq|isF~QkxY$dqf%#T%~{)4N^z%YTwK*VsWk*bLu0fnlWZpUS5#;Ept z7#y-Kjd^UgcjXQsxv72H`v=Y&2z9Q2nn&k%b0;dV-=6cz=(uWQgK2bBLa27&G>WT2 zym4Jfz&=pA60o;%RtuzX+Pummc~$}N4trr7xkBer=#ryD9zNgUu`?qy%}G1T2>o0w ze4_d`C~#SY0}J8SG7i{YF2zi1ZY&oMcD69l&{Pur|Q}@S)E3be)cuRab+v zCu4v*nC6w;6v+xhxSKs(0fScWm@cN_Inz_Yla(}M(aUFBQ}bBmZyxj5=X|T#9;${uE}ALNm=)fsRrK8InIF`J_aAUExF%Fq*XX1sJ!O^kbNAxh zoS`-4|4U^a-agNfi{@8O0NbVm6*n}Ct9o~SROPy|$VszGEgs9dM(PY*CL3xotPStn zoiE(mnlu?#(zRXyMkgma*tL;xd<`70`ZaMC!J`&HB`+f<6){)tz7*DX*V@#BjI7M! zGxO@#Ae+OPGf0PG{5GZK{7b$n;o0Sx3YBk)*oXx+yrTgW0N&gi!?Y&JV=Z?|#@PgH z>=UoXbhL*DaO1%!)e{^JAas^2cJR7O7~L!3q215!1Mz?aS4wG_;7I7nN)Y1s7$j7? z<^zp>gq*M`V9cv2Vym#8C3HF`#%-lD9E;pnM;&!PaVFt|4LEJdcpCViPK(OgSGx}) z^Mp@kCIeQp_=TFTUmDYF)3&&fQhvI0ss?Rx#!4lDeG&r; zS~gT&w$q_~&0bZ=!=b!Iz)&o~sk58aQUZZ0__TA}w6m4Kmc0b9wWqar*)`_K{Uo5~ zv|O;uRq#g^zhSNCUgPWiAO$sJUWjHN;UhAm{O+E?>if*sPbkUtF!&rzhfDv+ND+@ly-M`u_r=HbLAI);vGF@$QqnT~5RtAwe zvzzvCWT>Wom!kl3*G6UAG(Cl3y*`K=QD(7x$8p&`?!@DPu05VUf znbDmWFuSmAaTVe{`gsMG1ZXEE~HPcobZO&Dqq`etNqvtd^MtYsx#jp zn%{Vo1UVw9m!8sb6E1)*oh#L< z=mJc1v+F%C&d#n+akb~^{ynYCcXQ!ECA@#JDYF`FsS!d9%b|P(Y=HZk03akPqj}3N+hC*w> z+{T|%;(#4mfy35e?l4@6k-l;b!-Ph90!FlXuNW2TGj)6J-CP;eS(zfMRrxb~G#%ZH zr>m^{5QSEjV61Ef^hQD>UxAU zxFG(&3*q6+Oyd{q|2qKgoZe^ouR3@&W~tAZIeGkawdDhh$fmtdt~3D!Q=4qeS!$)# zh^@(!(e%zl5CqB|#*CkPS+ka((e+|p8|ZPkHG`nFr}lEqxRUocrGiFGhJ;fJp>9`0 zE&+nil!_DLV>dmdrOT_U@|8(E%+2c)6hN+lMG#>h>rbiSk~gz44(eZSy`CXrmfm9N zS56Y}2?gOpmCy4cOI9KStYrl~pv6$FF{Otbu*Fw04Aq=x7-usj4X^)~NIjyjCKX?` z$m9l6m!~9ZO+J`kG3<;W=Q*#As~5Csw6x0?WZVkGz-Uz6%j3ug4_9dBc4-o zZK;BBX`Hq?9DctLF+06BvR2-e_0Y1Jj$3eK%w9--%9>HrSs(o>poBb(rS>F&Ui`~@ z(i>JY#`4Rp)APe!OFuQp;h|AvM@;(XsC74sJqzmpr-HgbK}!@kNIre;>R^MwmX+6j z#l!q4$=O0%ar3))qp?OAuU8gkuZczO978J6v5tuMCg#y;Pe3JHqC z$-bbtXI0Any1%d1qWRj?UX}+w@&`f$iD#kZ?ab+H^!<6N$`hf)*2qo1CUsE5n`wEq z8HhlWpk?X8&unFe!a`5@jgqThCCkShoP!=4=sz+7o1*_@1X)k^QGm!CncCs;&HOCI zi2cog-G+n`jr%LLOo^4dbu?A(mC2~o2WI>u5530j@*uB{W@tC|0jkwk%V~}ai$)FC zFLz3}5sjsqeyB5Ub@ok$QMh3gv@_AB6}vlq5j3-w$>;fL|GHbL9#L||+b~eg6G6_O z>v);WrIH~LE4e3Vw#DhCKEZg3&&&d8DmocP(Z%f-=`DWI`L6piIq=@(n{Ux=NLuky zzbh{oqnY1TkW)c$?u#BQ*MR+L9XQz0$H4xorvM7(;$cv*oT-spi?dw-V4aqbmU+l+ z#LyluXVQYq^~Pp-^Dl(v{;G_M{3^zN>yDbOgINsN0t`=2jD=;jk`{BJ9W}^lA$IoH z9fuFSWR{n@GhL?8@RF09>*u{0*9VuA=CmfC4eW{|m{FTS6$I#)hF&&Gqd%~mVvSzD7ebb0c-i8WqDD;RHU6dIklf514{7zEyC{zCGr0^Lq# za2hl6SW_C0>vLjqbvgF^Ch9FWSVDA!j0fj-U41^>C*`-+OsK;c0+mBNHPgLDaOft_ zC!EP2M_H;-d0HJ6`(Qq2Npc@PWPd6MI5+JBo;$2x)`l$Tq&;(h^^;(3fEv(w0h$bX zuW8#_D{>=zjxu0Ct0AVo-~~^nu7}mDePvw>UdA>7&@cXb{*>NciHfDpE_w25;mD4M zmCORL9;mMS$#5g&kt@XUXd-v}kSzI;elYH0(&Z&{q{3n$I$0-~yiu61uiP^n`qq-> zKja#0>VpIfi?n-h>&wFiSR3+#J(0m^EeM^J%o?JT zstKakqA^Ofm6|VmaK==}n}B}ScmGw)ABigAXx6DV8Qb0{Ej!m-fuy?Z`_MKDT=die zh39=1i%C@1c$~O%U5eyw625|YU~PbbP6!)1%RFJ%9Ud6B6`?orD;pa=NI>cBY1=5d z4$`P~nJ1sZd|P7ZSV8*XFA$2IO8W1fK-B-DCm?+{&tlN5Z9|&e)QO7p*$vMKR~3ON zJ1$g=KD`kuu~WJHl$!6rik-W^-ryfxTZr17Y%(=IrW>t@TYhj|5x6y(7s^#S=*D!Y zeSKwp9l6*^w{QOQ$Jbj065;NdGB@+E?>OHrjM&F-^d>|^@Na(#CxgFFxH*{mIxXuq z%BTBFjeLE{t|!E`9?bH$!So`9Q9U0e|2xyUo;cS%DK3kCVr|-+gJpe{>0&Y>{_2?D zx?_R;-C{hEq2XrfJ%7xadU9@^`!p@@Q(m*{n5ZbCj9Rr*dHH=P5mc`{Kl$( zg2?|N3dgA>uKb4!@Fybwfixl_e=y-6Q2nnE`Uh0s!Tyt#{7!5Cq;-Gt;(wI`{($N~ zp!(khsXw6l{{X800O>zK`VWx4b`*cA)4#*!A0Yh)NdLR5@&7*{tryMwBjV@zbG-xb zM!af5z4>YSaqDJ#g6m_IR0aHo&5oxJFP6XM$}xJ9T%Z=S))~~bi-$7D=zr=v&b}nw z^m_Q~rx4J@Ux!fSR};}S*^o!+9bE~AEGF~mP+bSk6K(AI&-&%1))o^-1B`dPI5TkP z4N9cshjbx4jtb3!98a5U8q4RgfrW1rdEMSQwc_$udG4FdFZM*)&O>0E8!s|Sb=Dd^ z4f{v&=3Pkqr{t!p$>XEWKD%Xnx9tPT6}hq?ramc|TKD!$1P;%YJRRAZJX&R_T}=rr zGcvw%m5X>s+`8%7RsF8BGnJaFnv~bk>er-gGXZNEVre$FT!yRk`vP5~R$J|*M!jn| z7}&bQD`*vPJpHnmP}C7Yw!m=K%e^o#S1ca5URRYm;d%6sk>D-O+~uVN!kYWdILA-3 zfu2`$4XoCN$*{yK0I7iOQ>b^CPe*rK|4) zOfq4Wu)5m*b2|OzV-tiXSuQ z5T&a^!z=*#1p`Zd1O3Kl03NmgJ@>O-%&rt0M*>+WkNcUkBQsBfDzuKreXM(#&5luZ zeCtCUez0tN1PhN4e_D|MJ*${P+=Xf7tPY!>Ggi>fh%;O%)F(AW8Zkxz)VmULm|HVj7glTqW=CF&WlKQd^ zv{Dx29yGio+Uva#7h{CxVdjy+hHTrX&D+&8*M9f)ZsvuIqq`PAMMc?C4Ja$R@Bw>y zcZQASa5wFw7uOZ}xo8H>saR43=5b#Hg%iq0;_DyOZHLtGAmcAjO&yejY084thFrX1 z^YDiI!qyq~qab3ksG(a2D z9<3v>Dm_p9Q?&Br2TI81CTo|cMLmT`D!2m(P0!0l?s!B{4(FQfC&$@~KYlEpw_(1p zl`cEu)=i9E0L(&L9UUru)tKrSbq zPNUODnA1w^K6LzBvT2|E=Wwo%+gzU%Yf(51g!p@Sc#Hrw8VCciLc=Rr2%b*TUP*nP zQ0fh7T?QO7=oCFkQ75!C9O1(Z46|0HO#4W<)GbIqRUpw_Ys@_K^6=U4f*~AO4II=t zyV%~#7&B~}=G1fJ=&R8sj?bO-*A?Ac7sFIi!Q|9&kd{)gL^bJtdN6GWN7a4i$!f9R z#fGdmGxr_wFr0s$pUc~7VTaOeoxSd7=1Wx0z%3UppMzga-sL+70KaP)>26oycU=uG zD`e@$+=_bavZ~$`V#?n?Qq&wO6sozglWP=|KQZC2Lrn8opn|Ka$VNzq#9i&ZX)He~ zR@oVgq{~Z8Ed6}VL)>1+?~PmhtBJ9 z%RBsZ2_MBMYhezhiRKB-llv^LKolrENz(DbgvW)dO@YvGn6{?dmc}_GkBr53f2@Pf zvk^vH>7o1hMftfwSwfF4aa=*}0+~<24=$KvS5{i250R?(%y*eajPq}!{b}U!RD#*S-<0_3&@0DE6Sb8Dsq*k&D(ldXdZ&bBb)9{D*myp%sPv~V^?U~}fHeR)1gl}st>*)$84 zo?Ht6^TGCFiFg?>NGCexp{t(Z8Bn@r?6hRhxwSgEGh#}Rr?<+Yc-4F-{{GHZ2>(f~%J*2;I+YCNC^PH10e?;l zS42M9ss{R#UV*QVmmAcqvNOb}AqbhzKPuYf#_M5k5gANV?uSkNda}uU{7}Z(#$mQo z_h|I8F|v^s{fnw-!&t*hj1NOi$7XZEWE`JIhu*;Zii@dU;MX#$jsCONp^q@EXZWP4 zjZr9!ElCqEjXiT~5U9G(JgV@PTi!v01}`H)m%q@oC%xJ-lEiG`T?U2dZbinH zZ_E6HXJ@dWkRK?2EFB(BAq!ZP0f}evh9sp7xwCX$P3{WYDLPIrgQC&R6lE_k^uQ`& zy6P7I5wEuB0D`58!B}Tl@^Z8qzJ4VW*EzZCPuOWPASQkROd4D-K26*>fnDoI=ZOwF z3S^InDOK4|OelS=o0-I?J+m=fp#t>Lo~=Sp@Pt#T9Bmx|W*S1V1l2-Uq4xFfJ@gtq zd?)6T13We)_aZL@A^CHHb!w0$L`2n~hT|IrS7%l=fE3iunIWF$`j`^+#3gg?`JF}S z7)AIS^F19MF;*OG7H0J*5~9xjr6P#Z>_>&A`*k>F+|| z%gk2X0Iw(;mL48l|Gb$@t^V`C^ZF0M?vBQjXU5l&$kKby73oE_P0SAXY^UhGHIh9y zAbDi4Yf6eoi75=q{4p7vJPUQeJ%Vkkmh)$|e){xK=?A{`66}ety0gVQZ2uOQZx%Lt z+6`ZImP)%i9?j@5+4?Zx=2?%+D^=Hy)v;BDp<3*twd;3Q-GM#F8lUsmywEamvEnDR z<;QUp*fUFO=2Gfy=GvhPaVARJo41+GvDPGwd|%I}m9;?`DNiw7>zV(GzCaY)F!YoH zP)R^l!1oQ-Rm1yZArN?^Jt#Hs#@Tww_HD8?p7~V0^gCH)mp~u8GE*C?qk6!S7DcYo zS;q;@wucBwq?P=>87J9Xcnw`&+slAl_XhGND@l+I_f8xE%V4B?o*`F>nNWjgU(4<% z?d*X4x8wWq3xH&b>DYoks^iasl-xF<3?(mw%d`c5Zog36;eOBC`Qcj;_MT9K7=Nul zR)5Lfn)+gof;+jqYHq;KMHydZI3jr;*WQ*3Q6%XMo^3W2*O@j7ADiuy<&aeJo-mg4nIygsf0z%1E)!@|8E&alPvD^v~tma2@G zQ*UM#S03IA>v3qS^rK#4+Fg>m@rKX>=b|T?>!)oIZ!HI8q?t(P*r#P=n61uyf@3I# zQ{z<4c3rn7#H!jx3e1zl*PMS9^Wu=km6{I2aqoj{(ibpkKIf3>4@B~&3LaNH$jHsk zzAt8nc;KBRX=nklDVR)GU5wp7TB=$d^<(y*tGbN$FKs?uu8XVm3AUwtW;TdzYu3Nr zGBicb@<1_xxzXFm(LqfNqEB*_<$QwV^$_&bDzj#`Tv8LJx2m0YaPH?PEnSM{;(0ay z*}YiPVRY<7M(bX^WzyOa7I+Npmft8;mV?y0zs+g)9>@YqzVIOBlH+*#zM?jWzVKAS zgJB&rSm-&>f4_NFgTNZ#5|aUKOCg%;E%+v_5B%Cfmiex_;&7M(_Yu3EB^ z2``9ytOjP(8tC0yNKa;S+N{C~dTWtvLRe5kS4dQ_ZiH2pi)uJEWh-0!K~$@~Q<7lx z-saMHg-Rm=jeinyzpL-3llD|#?u0wiS<=7SXWKohi(S%bf6hSb)2B*#Z7;_MRJI3l zv#X5}TD1B9;R0CoNcE4F;8~dTTF*C7b1`N+<0|R*nS33;YtB-s0{c2R1TA@>I7Pv8 z(5;Fdyodtepo7bDNYFJIh_6q4P9&RQaxiC0i+aKuwB%9FL?)EhclI2IwW#e8*dW@0*vdvo4K3y`X>muM-PHGlVnBcqh1S->pKjHJ` zQR|Q3`=PLt$EQAlWV7+rR;HiNS17JVQN0k2h+rqUoof?TWlP)GkA%3mEm2lRR+2r+ z^oSS9jd^)5hibKXSFRsgBjuf*D&nq#S}6X0=)Gr?nau>@?4i}f@E}`Jz{5|jRjAEP zPN6woToI!nA8xFD1L`Sgzy#HmaniS)Qkt1=6b%(g(U5#*|#6w5X zy+bY*WkoTR!>JVY-qx!g17P#MP)QxR&V-6g2LKmho|EFXHRe%e@&m#eE*MXD(JNe&y7ZWeEgFnWHDRk&aq?^7B+<4LHB z_c!h;Dty6;G&dhGb!i>-kSe}~MKxx8SMFmqh?dA2XX>7z4!kODu?(0sDVt7-2^#aEGiYhTa7#5g{2E_T}%#+QR~Axd`Jn5&F&LDVlQl}RSUj`6_K(1_+Z8BU0*wb*h0 zs#U06b$%hPWuSPXZ1@Gw$v9H=B0V`pOAl7bCQ^*-t`A43O=M>nXgA+}F9dFA2QP(-gN7ih6KNC!B+nivMOst7*+qTV#ZA>_^ zosMnWn%K7Ao`d&3&$;LR*}eO-t9I>Gt7?7MuWQ+m0_0rLEoG#HvV0q(wObnz$HJmy zDsU|VzosOg@ah1nFCHDHf3a|puCJA^8&|BMqM#Zoz~OrUY;DA4>pQoH>|N1)TiAtg z+qr5*0V0TYg(}~`U99$0@7$K!lqKo7$Y)Ql`6v4Y3-Si9ubIY2M}2Zv~FPr(&9UI;&3tqXQIvO5d+uIg&%VhIsBw;?p z;5+JM%QU5$2S?z}I3ez)!+ph^u2t_>RynmSu`Kz!C&qqXjk8F)R2);U&uMCNdMNdu zV>#+&^YgUL^xm5+WsRT@oN_IF1dmoVms+Vhb+`_G`CL!K(XlW4lKoYiww6tAe0+lG z#hGC0PR-pStY6`0x~~J~LFSB3Mx(2Pht*++G(pP<8#C+2B&}mfcZK3$*Qob+XRs=# z`u&+~OjF@gyQ(EFDeSD1;>rGdCd@1^r<{j8EQ6xBj+=nJ)I7OVL2~}}FU%)kw6VTE z_0DD8+fTeQ!)ez1$J0#bq=pIc_kd~qqu$QR^^F!AUT~kdaX>n=#vz>%{%@K1|+qvk>g(Rbp!!T1!ZL9iw z(p8_AW|1F7rjr0476#S1FVU31Guzm>T6H}lcnw9;U4@cA>u~0$YhK&FoQ6~ax4xJW zG+d1sWc`@%N8U%qgF;&R!sad}GFM^d%@g#jPI_G4ehp-lqVycv$=b|lV-R_hHqQ0OSv#~G z-f~*8CsQ43DOC>A3k5V8S-n3JsJNM>xY?QTadPX~#@agb&iz?xSh?FO;@{xa#Cr~+SVe3*h^PAldoDDr}dqh6CESC zBW>5ct9^kkhg&I&X=kZv=7NB8$Ae0Cmt+F=wzvZ(vDQi-t@R`KJ7~%H!S9~FgHlT;_fQ_m#zZl&BI1( zhShf7tdnopb2A*gr|Wnu44?5NNZhScj06HlFE@1a?>1PmtWRE`>$*$;e3e^V4ZZ5* zqK)BZQRU}1meN_mmb94!k~66_m0Rhm7Zm5~*V|WTcr6#VAw`6d3~INUnR?M@RX_TJ z@5^*0Xb><7-J`xDKCt*WiZpKp6)7fPK|d{-e0`T7-c8i$R7q)TJTw#Tu=xG{WN{M) zwo$XGXY$y9PY>!(&hHnR)Z|L9j*=84L9YdBbc##KEPSUuyO!df^~r8~lQ&Id(J3py zRd+&K(rIklLSTE#{L0Veb;6 zAwj=cr>7D0`r%O345Hx;S(s1xh!CJ?Re*dn3WDfHf8vH-b zs5c-5IkCXdjG&)+j;*QU&2COQS%!1`R8__g#kO(o z!hV0s{23m2z&GvpKkapiX#S*d6wAGk|1kYQKh}mgeYCEU=--VVfoQ9vl1vj?WEM5x zR>rSGjoI;}pb|#-P>6fs)MhIC(a3W}0;(UV?Q#$+;QO?72sWv?0DYe2?LN5^m#u0J zPyAzl-{^f(+a50vA0b7=)P1g?Wyz4yU6IfkYl2V=@S zOuvjpm^AW3A-AP!3lDqN1&ub<51U=2SWfUviLX!a4BG58B9pd>8K1ul&r-Ycy|igu zyrBfrgsoc(B-Mgn3)dMkzv**a^gMOIa=N~tu5F)3{>nH8q zQ#xK3#VfK7ztg9ICg(!#thIC0IN$;OwXBM-5v)VS^}q zJ$RR|f$~78d~YD{mkexLDpH+(vm1mg<=x}>T8s4WU76L&>ILCXaNQRAAu zm6Y{LpQq;6=#CbMVdlQ%2lI+h#HA-XIHl!TPEGCOZ*Gx&T^0O-Rwzmn8C$a~^)`C` zn0XYwFr`D{Ddn)wj0O)$yc;C~D!;YFs~4K6oaU?A zWnOZ|N1FZoeS~rql%r3kZo*Hj+bbHA4oOLm0x6XeI6uZv-Q>8K!QFD>X)WpnZVc4lC)Gt2+YoU z!zvO5kCj&&ZXZX?oLZAxl5v-no?R!EQe?I!aSRI^uSz5rQARv1GO}%?UYtPs58s<|>lK^;a@i}lq8cf-q!m%ws+zmW?$_dX zs00Po!q8@@W?Mh^W%NnzR&;0GP92`zP+is9n?1pa&1|2XKER+d;l0C9VlL|D==sy_ zsUW!s)@sx*a22KFdxhtX_J{_T;eBf^S%Ui4_jFE(C@7!v>7p+Snm?$93O09A8BLSC@C$jY+*IFhDR z+kUF{^!*@6#WBzZRVszSpWGXdJo?NW%*J3_Qxm0__vj*>F3#nLk48eaw#REh0|3{T z=LFhZuIt^d{427momWi9(|fZbjjEM|&h=y88i;O44(Jo$c}_MIxlXRiOUS`qg$hl zlyy{;8lKxh?kQczxT0C3xo)uJbcv_-!>!mXEF)8P^BWfR=Py2weTUUDt_owm=aX0) zC|LBFMtbSZP5f}+Ue0fH8LD5@a9%guu}4;B#S&CieH$00;SvCI)d(H|7#l0l;nN4w zWu{a*d7vZQb0xqcRB26E-;W&$4Q5#1$Bsn&&zlq&ki*^zq5 z@qmGcLisX5Z@h=IysUptRXRqjq`@seU5M3msq`VWe1(u@yvUL=ftebJ=_DvOWWeF4 z0hH~ESV&&I;|obHhI-BIUM?ggB&EqjF4VgTVra0@HdsxHMH7oe$_A%Xc4>&8!xY4o!tmj#ZsCg1*=i2dTKzXS73}GLs12$7N;d7 zssgI0e4EKwgGrzQ$fjdsWr<|lWGs!tYlhYf8a_`8TYgT;+Jgj^3ZBvO zj};mc7TIUzcM6IyM?Q#w88mqo3?OnUHU-u4i_}9TC^OZe)L{&X_wY(aqvaj*! z&aX*)^b*V5RAr_S0@eJctcO_c;wV35oNkB5cUmFrD9ebOUg3!2AC^e*8ZO1^%2pY4 z%{rwn$*@llxEl@*C$=V-qc~5iSE?m7ypL6?Vw_H^Bj1K(0c5w#^w|gNFh6%;#jNU< zzxJ?(fL%R;+QM|BLd6PBa#I?M!)PDPWqc~-W?8MD%Dekgs_~LZ4?$?P`LU7m=aM*e^ zYB9pUe=Pincs>AC_3zR`!OE6nPLbfpL`o$FU9u@9%uP@sv-&M7wrk(xVA)b6JueZ8 zSfO9IGu9U(Hkwc_0uY^vby0#XL|$d7Ej*^DBaTF8lx@ZTAxP@f!&D=l2Q1y>i&HV_ z16@BG#GWC}R@j|Lq)^K(edx|PDLpPm3D=va5@}W-5QggDV8}xq$j(d&5re?^f>1*i zMIF%xCp%rDj9}s2gq_=G4Mop3?V1|5T^JtQfBbWQJUd+k3l2J-2#JR`oOEn*d>aLg zg;!0GV&5cu(2JCg`G*{0jEoK)MsTHht29!&!LqVJ3Dzkx!)*Asb4_9 zsxYhO^G}{4*|B`1SwSdl@5nB;VjE$k{6a@RN%bMEh$Y)vBdj~0a+{|dhPx7svpzd4 z=C3Ch?Pl-`-sN6`Zp@1rfS44Iqe=FQX$HlmYPXEDU@-t)4^O$x>qOw?kxqnVQUVoeAyX#{$ z8NXYpwqycc$%I=BHJjUGJ+u@^$cxUkQskRot0``yW3zp(_Hx(y>zk^dg=pUt3t0lk zgN=8~l17;wMdeb9X_|7(6XV!Y=E0BIh-f^(B0v*0!nJ%4VcpEmQ$wi5&d3Hej=t(i z^4M32{oZK1a=&nTzr5bC-#&`X`TQzr_-HF@ImB{;^`Har)|Jd}LZDIo{#EOWpG!>$ z*9fc-KRvwhKF23-wv=E#)f}82hu&-m5!@sQSiZ0>06lO5|IV56{$xgFO z0zciE<@t@eqTxjq$Erhd?rV^=7YsH*;B5zvsqP-UvCh+$wSfTF?d9mnSml%yl<^6# z>v_1L>5+dgt~>pY`jg|q`AiB|Wwm&2W%$*|E@gxSZK~zGZfmoIU$qgfbczmM=%QjX z7Ewnt(*5MF?AQ|MuX|yE#H{tYZwd%6Bp9g18T z$_`Ftp$kLDyud0TPe0_yT9&v+6bV26ybNDIjJF0eyHo1e8gsmu5GTdZOqb|L8)_!>G*=tthHT=nbWt%OPXUQoW zbg40ht=N(X;lCFYvPd7Myn{uDSqn+V-sBnyJ)`3%Po3cPPbEJ)-$ZI6g{ zxiSf?gz86WA~ye57ja*8Qy6_6Wu=^)e>0iGUt()m=puCZq+Qm@GMWq}KLZRIO7??C zfVCWvU_N1$K?kAirul*jWu)TntV4hRnat=TLBox$77{F#Ol>Gx`zTtuN$dIWc+QVd zzuh4yzg3}uaZQ*3i#D>{Q$BW=L>8!2FmS)`N=Sai6f{3SMS_6-y)YV)0q91^CNivF zz~8?I)&E_n1Em${gc!8!XmxGrdV+7-uY0jX(S?i*) z(8eG?*_}S+AaMGFAccAW_hLfcsQ&&0pm_0zo^v0|M0Joj0Iv2`TIMjVn#aq1W8;zl zx9|nC$VQyqB!{hZ2IHhhd)t;PnL*F{Ti;bw1`;HZC1Y0v>f02;Xx^z-Quu&YQ{9al zx7`C}4Z*|1;najl`pp9$$$d9s!NuPn>XuF)CfJ_Iw;e#9@y|j}MPQEp<;g z_+kaFY>P#Yd8)SLOnL0X$mxil+sfH*SVTeXGK>R3gIhT<@^Ipr<4X{itNol&WB33wWhio@Kzu~P=(Ty$4zVUf@9p## zvC*fvh2bhGM9gS&x7!=~GB&_>nY@RkKP;w)U1k+;O;CTOaK5-%=ZtrrXj>J-M&_hV zl;~T!3%du6?_1G{lEH9U2(wrHQ8grejZxgNGg&f@Ug$v_-Wv{)gpGRdkV$kg=hrx{ogGT**)MdMSyFV7 zp(U%rcVpMr2`6Dov#PkQa03PE1Q@72ufY_Q5~~F#e-Eu(-vM>ew|x(mtFi* zf!}Q))<#Fk>hTzQ!ri+C(!j{QVErAo4yIHSG>VNf{s!*!6}_v01$P$pZr|Z*s)k%32j(6xl1i z7~*AGf5nFXvNep3CQ$jlO4zYke4|0Nba0iB zx^|7((YWHYHr88+1UwxanArBji zWKFr9ApE$LJGnZdu2U&qGyKr%=6LCDgrBJYvFWKFWD=X*EMR0-cD{>YGl7b`+QH*l z&>#B833{l>IgU12Sn{hxO43=kxwQjE(QYkKh7ger2N><|gw5{(@hm7=%JVKy63Ph^ zL2^i#dlZ#iO?7|AK9?SB5v?^XRHC)-%i-3z34sXCF9niGQ67_yhywoyKnZo{$B4lG z6dy1b(SHvWpF302d#3lckX|7V>Y4-v;R5n;CfsMscQrtNmiAG6jKAueJ>uSylos@F zEx>cq4)!?V+m?T@i3u{~X);(7eAVNUrl{P!Z-yoI32s<^J41&Sx5G0V+vlat=6yi5 zlb{E8HsFY*7Lp~Y(J0xz2=RA2EygnhET(_gHVKIQ__oDlfeJ1SJw<|mLPPel%C9^k z2s}oA<@*xHRe_Y>!{V_*a4~ovnGPIBu>oWs7HOz#b4^szxa!!J z3b%QHscBU9zPxCQe48XR7|5gG{qIbN|3Ze6?6OWWrn7#*Wv9w?Pyh!lq4R}nbKDg$ zr`=A$rnr4NUgn6Bp1=RqNJcDsHLutq9lNqc(*5Es21ks^dD2l-Q7~ydtbzCaEt@Mk zgZp*v`uOAZP^X)DbG@S!(7-+}} zgw23~Uc{<{(>-hnqdJ4Ht5soHNBS*?C}EQ`j#me7mCmD;XM>fc-cDCEzw5k*zICIR z(9@4khkoc2oA=ExRT%lRW#;+t8p>3op5S&%gJ;{1qZ5-!URW?|d^8SaTcqZjL_B31 z=2fxcd`*|RV|eEtpa}{4_9@7*Njz9 zsIY26x6txKV~Y+YX9Jvpnsj1b+q1~rZ+LlilaV^l_X57VM_l1II20}CpQWjVLfZhH zWa*+3bcV?7<;%jUD`on>0MnI?gEy{209ON>259N-wY#bm|F5~F5n#3pF)6Vvhlp04qQIkK!WqpeSwG1zF>@0#hTWad5c)fH&2N~XiRH78!o)=l}Q0J z+_lpy>J372;WVdDi9j}>sGZhG>p8bKP7(Rl)qf<;ZSXB4$2^>~JfVzdvZQ9&q8rcO zFO7+VJmG>mEhApajPNe9|LYPFt{jpk6AHDFo;$DrgRuE{&Ws{#IUAOF<#(~?)GaKl zgecF}K`abrJ0Xnc1^eLWyq=m1Mq<4td@CxD*KaVAs^&0jqBY+N5*Az=i$@zPrS^u5 zWSE-u3f$`R($)RL)SR#fpFQ|6NQ^El4{JK&v$HRobOiHlh9Xq!8)Bqx)88$l&uE(C zRutNNA*W|pNC;UtD3UHO+KJT;b#b*IKqLM{R1pQ_DJDE->9c_x20D)ogVCN3!8X`K zkH*lG*5Rwkxi(X?2|g@^;e8eGKROK-bW!a&N~(%}@^w@#GNnt+k{bTN95SwP86Kx? zR96)K%zN-Z=*b=GpXljpOhongc{}ldil-2%vQ9JcD`i4F#M#@5@`)=3-+SQ%^Vc78 zQjs9d^#jywKE$CB0kraatnyu8#HSt9hOh2pcv47NsDkdmavOtOGN=&(4BP7t3RO)kwAKWb&I9OHAHs?CWwwD|MSfM*vo2L4cq`ovW$f9{UW;CO^Sctw_6mlFWYR#b@J}t!d!zGjHLf8Exh0sv} z)%XKGY&;>VXGS@<3!!U6r@pjGQ(d8&^$B3;Zj;;5YEAoDe|C@MLmV~@Ev4-(?w8r@ z@$OdYJc;}IQogor+V_vMQ>mz1Y_f1_FZ-9p2IjO^b8C}~mCzez-`ycA6{rIWDl z!Jx~GjNwEWgD;N>Wl$5g&ie~9j!FMcL_BjMMhM~Bvxrr+s!^+PJbaG&thhg6y3pTx zWUw0Q1YS@v8IkTM9g8{$MI6#A($@#>nL{A-R89s=FjUj`If$wxs^>E1r%%>CrKwx!yct1jNs`f*98CT8Sz&iR{FbYzu}E#1muU z-FbppQIDV_Fx|pn$#>~p2A_di3o75c>oQ|b%)GuDN>zOqF16&!`2J4;^_Ue$HnaT| zP()gwMEHC#5SCE{Xy`Fbp0G3A5^V%8$SX@uSld`4I z-2#7ti6e1kI|wKtN?-^bHsSKAOo05ig_%-4zLcjopZu~-qM?k6hE|sRdwSv5V4Lc{ zp)W9^{O{GoqTGywpSe5>FibkIPeM??(2fuf7FFn#HK=c0Vq5CdadRM_tXP~Z67pTu zpNJ@?^b8;m7SZa)<(G1(R^%q($2^BW5Ns6XYM?2tB=cbR%?rBVHPrA(WT$My#yR6K ztmllOy|cQ%i`wmJg#SoWau_H8a{$XUbLLfP>LkSW7N!M3NcjZs>LEZ--eX3S_v9Y`I_^WIYO+daT{rkP+BtZex@{8pJ0I!tFS06Q7AQ)1=qiSHo^}^yU9CgFp zEIB$|*GGS&-L=zn2pi`UKZdSAPy4tGbU;6vv7m;zrXdT!{CY|@yvrgA0d2N36BI|mV%0qP1s$hGToq1}Z^w$)wjVp0 z{eMcH3>A?Csc@$d)kmJ4<*oi3h|%~+YdQ(r!AV+1*d;ny){#l*T0QI+rNpnij$3$ZRt7uZW^E zyJj44bp#v?X#1tr)Z-_W*YU%0ry1{60_LirY3T+LaAj}Nh}^D@!ogcub_CqF@bS3(7W)B5}$C{WKI>5}(VhiE?_?SHdCYH&U6aWo=3oJ{bc zCDrW7wUN8AZH=xI3#6W?My^dlxLSTwCst53h=0Py_pkqgjYKPdTC=7Dy$2`iA`a^i zeanVtveg}QIq0)VhqCYA?oCfgDuCIh*2rVru!vP139{`-RNfwJKN{e|zgV9Au$FBL z{f?!dvd)n|rR&4~{QV;O8`NJkTAygI9Mc*SB@3R<+~MmggHbx2sHk^cTVAG_?Zc4D zefM5o+*t^{rqE6s@KJ+$c(?zlefmsV(RANmv?$;uFTUiF0|FcuedN&n_t^A=C%#d4 z%!vo>sb<}9A-e~{G0zFkSKqZMb)@iozI>*Kx80+})@*Mb{0UgvUoSAD1w_n9YH;AM zYxi`)7X0`aq@S!Bm-aX*O0V8xa~~UNW^U+OM(;|IF_V(gs(F)C$s3iFB?*~OX~XK1 zN(L3IFi*ZQxh~}@6DRs1xo~^2JE+Dyl59oah1s5y(jACum_EbX8@jY)NVLDi?qt*y z0!eievC0LQ@p z6Qyb=(AU7o|6h`(V2Hm+nxa71p~vp0V1ka~U`UOuSQS5NxqM7pa#`vZhwOwI%Yr88 z3k;J3a;7w49;eL@JrE-Bv0{Cu2uv!>=m44$Osm%cs zoa%Gqt&d*@QIm}1^YDKT@*)TKqHmOpRg@F@?2obkGaPo59L5{+Ic&HboGFg2y zYzlikquf|3;JG1GZa4J&uE-(V>A;=$l*h+CH5J-5c9TEX4tEwJ-3 zqIia4#Z9k2UR*E=!nIZ^PZ~<$As6qx-|Xk9X1|^*6yVP6Jk?8A#qkuEw2{MJS+DA^ zKrZ`tp^#RyzX;lrI*^@YS1bV-#Si5gbz78{iwRGfUR^yl6nsAZ$T)ASbM}+%=NAIX zu~IZv+^#&VQ>fc?5jx|yNPvcTBMx%^Jze%W$Fl{zxG7Z%W_WJ)XQ(g?y8&qWnc@LJ zda-F})X>{AMk_WmWykxtOMHABGa7Jryw=%r4=6=^f7`i<+Nb<>S^Fi+-NiJw^8UGz zP`4zh-`4wSYTpQyxVfi+mL=(DVzx$dayXiTYd#}2aXo54w&(3pxWIeY{AkgK*6gUd z^Y4cCGU2RRrQ>tbkj6`6Rfg=R`?w0b$%RP!d86ZVL3G@qb6Cud=R*hOJ3npO{oq0* z2cYt^ONOZQSr8#4a?AalilB9!xF9}$=FHN%f~})Pg^i4sT_ua*77cdp2m)2Y4#<$~ zk0&}F_;{c1iPaws`U{0FxcURogPe#!z;l!Q9xACd&cIszKyW|B%Z5W2b(`h{(>?5d zLlC~?0B4{mZ2QW)Y{5q0*pT1mQ8Pv?$RH`o@X3oM3bC>%J z%-om}fyhgLs|Q^|;`n56T;Uy>3-wPmOqw*!9i(a!yvlw2ZgOVX<`53yTBQ4f5tE`H ztIzA*@66C18dmT6j#gpq4rgN;Q3}WSVTdpNdHCyNG(-SI$}h~BSQX~jus%o?xXBs- zQ?fxMx@%%fbrF=5DO0OWUo-6w-H+@tF!SLsm%Vj8Ca@#Y1jTshv%IVt_@)1m#(bBI zPcXFV^`@EBhN!^7X56V6|6Hw2&ZeLVOkWadw218HQHTbfVGhwZA%G_{`4=A|o}@-k z`xLqCW(}_!Bd=}8-{Q|&V`wlJ-_l<8di;pnhY2JTsO-wz2xS!W6}L2oX{C&j%#-`Q zeM?5b2xAFVv??b@05wJlbcFi}yoXuzpH}w2=|{5%Ji#y7Uu;a#fnj&jZZ%8WuPV&J zd;GlnjN8Zx_g)%>T^2Sf?#(m*dga}oylnK709*5!30QWAKF0ZsC+`JDrC>8|IC*bx z&_cuGhfUcSDhw1&!)s>ape@lq;lY-IgmT|TzA>J)O0vFCQhd?`qX{jk=+9mLY*QIl z%h$-?j_yM?xSbGPE@kNUPhJ7oW7{`1y{x=YLR{sj$fP_DZ#}|F0OQq;gb=r-T&t=! z4R_r=ycAf-KVnr0qMy%#8U;+QZmup9S^hF8T$vljo>+#FPyuOQF`8xtyK`}@vQwR< zxH7+CTsJ{U-zvueKoh}0zw5mN7iMPPQ~sM<=qZn~u^=W?h&eyWo-+z8>N9A;c6sbDf_X-dxL-Tkn2P!oM#){5g3m1MMX>5enCtn}gw8%0@! z7Vb$bN@^E1>m~9EUgxq!N{KFnh%6B|Ga=OUw0LvzMwi8U;|sO4Tp838W5Y>a^-_E) z=v6#~z8zSoK<*erchFA`hiP)3SFHdwAcNXJcdws#4Nm`C@VtwU=*84a44gg0sG;%i zcJ!(vHBKJg)ySa4+27BnO#(=NCj`!)!>9k-nIv{S2L7aKKpX=FwF0kRSK}N-1+%P}9fJ+%zgh6U` z&x<`ALev!WXdgwCLf-wmdHt9QOua@)HG^gcO9C5Jk_%$O7q)USN9z3ZJ+_T){|_!a zRuYO}>=5jaDTyEy%H7=o4|5L#8T_MG$p5G2Ly&DLx9V8(dAhU@-dZr~JPqYvfiL=}e+RylwF>^iGk=ZOWUZ7% z$~;2K_nuZ=;5IMnnrJneM}nQL8}3eGvfWmk^GYQ3cS3g*ldHrO<}=Dvrs?;pGg>=| zYMxLVEE7p3spwILZQ))bkH7(7)1R09%m)j%D|m`G59>=sSxj(nTXBC%W-WVPQfq3b z=%lt5eVd)}e2;tSE>c`ktD;*1JW!9Xt4NQP7A^EQ$4--GBiVZC>jsy$$`&%}UyWP` zfD1n4I9PNI7{HPNS0bd;?`U@+{!tmjXaJeXyg}WEJ@M`%VNrxt%higoey#y3&3ABhGCy3hpqf0Jm;Sekl8=KnRGTndU8(^(}?8~V-E_JC>L?i#*o zrnxDb3c;$#cUn-mkFb^Tmx!q9I?UjI1&B8`l>b$t;V8>6s1l?U!#oehMCm~D84_Pu zjKGPbLN(3uaeuxw%(Jo0&5JAKoa=4t2vQ}|di`KR+y0c6$Igv((m2*d`>m;Ec9(i9 zUboXt{8H)Z7wJjHN@etZQ zEesUHEM7$}>}9)$D##Ua^WHuc;;5(H^LWb8bAJqz@e_&4_Qo)^!6!K+s4<97O!rX< zX}Qmpo6eBSzV7sqVQP?+?`H|-PSOV@?*-pDyC=EsJI@47dAT33dQw8QAz?s25dwFt z&t0Lru?dcsrlQ-WyidnE)jSX+aR|nLHna?X3>x^a72757p@5nBP8wq!WW&?=_u2`x zmD`f)`7yUoG~{=fFJveW;5OlXQOuP@&)^E`CyflQBl#9TGP64>zAbLtE!set=T>EQ zGkp!jDl$@i1qWczyrhuJ;>6zmxIUxoMi@wJ$=$~;{i*) zYj@jx+asjKS84GDOj|dJKFU)M^T`I;(ich<>Tx{vSa9%Uicg1#DJHFg6~I{tB>-ZQ z11#J*{GZ{J5Qo1Rb{S(ay1!T$sv;Z8fKLem`u~6F=PH31`wCF->`1bgBwPA1er0oos~h!f^^BE2*W(0HjROVp=`UTNl>^Vg)pAA)0NvRI=FS@}75@o~0()j}E=kbM0Gh8`%A0RjKZuzl48FRU!< z7HLR;7Gob`3vw}7*?TjLF-MA1pkHp5t>=!|_Gqllq}$1k9Sz&rOYA%2CYIUZiM#KE zcrSGIc~@Hh07j<(%J?`|jwXBMGu@slnie?d z|2L0+n1db$v|ApILvzzMOCteh#R+Qz;H!Q2k{ax==7ZNZXAE*`vWht&;?vrpEDORH z%LX>CX7e&|^)DRDntkd)^@WQ}Q#Ps=heW;Hioy_ll#fahSwxiC49KY9QPP47=QgXC zIkOl-s5PgTlONPCw|uWPvq8x(%BXca7ag5|y*J;s9p)EWH|oyZ-+#iEzjdxoybE{U z%>}j#4V#pt-@I*CsMUr{%m`_T)=F{p?;A(K692^yfnpQb77S%tb`aiT)PjS2$h@!0_0!h8nstU+3JqAjVeZ> zwCirF&OVHLqJ5i|Zk{o#s@~EarTF!qG;PuA+a4ZRlEdJr%&4>5?4ZE^GBZHH|H#|i zNJ_WJ9fikYA@8-pnQJsbe*V18FDc<73u*@UuhurcII5QL#K*`s*OJ}OUO=a;IR93{ zH6CE(vw-8X;P5^|_8vZdUpN~a=U2Cm7xl3@I@qxvRe`ge{QCIzVY!}^{o4C7Pj`-w z61scfV<+Hs*Xi@k{DK)Rf3Du*QxMQ0f`Ic`yLX)YtaAoItoZ5ra6HAY81i-^RnVhM;_DQmPQE@XMg99!_q(DTccjTYIN?rn6bxjoMx?zwQ+{^43kJww)HV&HU#3dmlhR9i@RT zYAarVzUQ0EPwk(`mbO3UBilW5f=p49RV{-_(_1jINcft~BOIHC*MGkhX-7! z3tw$@br+up8!sLwcn!aRnE&O;{_&V&48TP(p1TvntsZwS{JTl$A4fm_=uGm&mA&xp zdONwt;LB@VY%-wi|NTF0#v~ZH4Pov@&IkGQ_e)=O!H1p{;5`0wEI~k-1%OK!b~lv3 z-`_fLU`@KNGG1!6W5%u5jQ2YPkx5;IJHzU6Q1p%r6|JnmuyFV%L z%g^99fA2t7JS8wM81MQC1O)tV?E_l?f+shyfTzC?kKQnD+mY(=-;luW&kzs YM@rHs!&6(Bz^fqQ!ZJdY0(t@e58n&KYybcN literal 0 HcmV?d00001