From 8a7665b5a12405e02fd04341ce41a047d4a1f3a1 Mon Sep 17 00:00:00 2001 From: Eric Chiang Date: Fri, 21 Apr 2017 11:04:34 -0700 Subject: [PATCH 1/2] README.md: reorganize README * Highlights that dex is NOT a user-management system. * Highlights ID Tokens as dex's primary feature. * General cleanup. --- README.md | 46 +++++++++++++++++++++++++++++++++++++--------- 1 file changed, 37 insertions(+), 9 deletions(-) diff --git a/README.md b/README.md index 3a2c8b4f..1474b17a 100644 --- a/README.md +++ b/README.md @@ -6,20 +6,45 @@ ![logo](Documentation/logos/dex-horizontal-color.png) -Dex is an OpenID Connect server that connects to other identity providers. Clients use a standards-based OAuth2 flow to login users, while the actual authentication is performed by established user management systems such as Google, GitHub, FreeIPA, etc. +Dex is an identity service that uses [OpenID Connect][openid-connect] to drive authentication for other apps. -[OpenID Connect][openid-connect] is a flavor of OAuth that builds on top of OAuth2 using the JOSE standards. This allows dex to provide: +Dex is NOT a user-management system, but acts as a portal to other identity providers through "connectors." This lets dex defer authentication to LDAP servers, SAML providers, or established identity providers like GitHub, Google, and Active Directory. Clients write their authentication logic once to talk to dex, then dex handles the protocols for a given backend. -* Short-lived, signed tokens with standard fields (such as email) issued on behalf of users. -* "well-known" discovery of OAuth2 endpoints. -* OAuth2 mechanisms such as refresh tokens and revocation for long term access. -* Automatic signing key rotation. +## ID Tokens -Standards-based token responses allows applications to interact with any OpenID Connect server instead of writing backend specific "access_token" dances. Systems that can already consume ID Tokens issued by dex include: +ID Tokens are an OAuth2 extension introduced by OpenID Connect and dex's primary feature. ID Tokens are [JSON Web Tokens][jwt-io] (JWTs) signed by dex and returned as part of the OAuth2 response that attest to the end user's identity. An example JWT might look like: + +``` +eyJhbGciOiJSUzI1NiIsImtpZCI6IjlkNDQ3NDFmNzczYjkzOGNmNjVkZDMyNjY4NWI4NjE4MGMzMjRkOTkifQ.eyJpc3MiOiJodHRwOi8vMTI3LjAuMC4xOjU1NTYvZGV4Iiwic3ViIjoiQ2djeU16UXlOelE1RWdabmFYUm9kV0kiLCJhdWQiOiJleGFtcGxlLWFwcCIsImV4cCI6MTQ5Mjg4MjA0MiwiaWF0IjoxNDkyNzk1NjQyLCJhdF9oYXNoIjoiYmk5NmdPWFpTaHZsV1l0YWw5RXFpdyIsImVtYWlsIjoiZXJpYy5jaGlhbmdAY29yZW9zLmNvbSIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJncm91cHMiOlsiYWRtaW5zIiwiZGV2ZWxvcGVycyJdLCJuYW1lIjoiRXJpYyBDaGlhbmcifQ.OhROPq_0eP-zsQRjg87KZ4wGkjiQGnTi5QuG877AdJDb3R2ZCOk2Vkf5SdP8cPyb3VMqL32G4hLDayniiv8f1_ZXAde0sKrayfQ10XAXFgZl_P1yilkLdknxn6nbhDRVllpWcB12ki9vmAxklAr0B1C4kr5nI3-BZLrFcUR5sQbxwJj4oW1OuG6jJCNGHXGNTBTNEaM28eD-9nhfBeuBTzzO7BKwPsojjj4C9ogU4JQhGvm_l4yfVi0boSx8c0FX3JsiB0yLa1ZdJVWVl9m90XmbWRSD85pNDQHcWZP9hR6CMgbvGkZsgjG32qeRwUL_eNkNowSBNWLrGNPoON1gMg +``` + +ID Tokens contains standard claims assert which client app logged the user in, when the token expires, and the identity of the user. + +```json +{ + "iss": "http://127.0.0.1:5556/dex", + "sub": "CgcyMzQyNzQ5EgZnaXRodWI", + "aud": "example-app", + "exp": 1492882042, + "iat": 1492795642, + "at_hash": "bi96gOXZShvlWYtal9Eqiw", + "email": "jane.doe@coreos.com", + "email_verified": true, + "groups": [ + "admins", + "developers" + ], + "name": "Jane Doe" +} +``` + +Because these tokens are signed by dex and [contain standard-based claims][standard-claims] other services can consume them as service-to-service credentials. Systems that can already consume OpenID Connect ID Tokens issued by dex include: * [Kubernetes][kubernetes] * [AWS STS][aws-sts] +For details on how to request or validate an ID Token, see [_"Writing apps that use dex"_][using-dex]. + ## Kubernetes + dex Dex's main production use is as an auth-N addon in CoreOS's enterprise Kubernetes solution, [Tectonic][tectonic]. Dex runs natively on top of any Kubernetes cluster using Third Party Resources and can drive API server authentication through the OpenID Connect plugin. Clients, such as the [Tectonic Console][tectonic-console] and `kubectl`, can act on behalf users who can login to the cluster through any identity provider dex supports. @@ -29,11 +54,11 @@ More docs for running dex as a Kubernetes authenticator can be found [here](Docu ## Documentation * [Getting started](Documentation/getting-started.md) -* [Writing apps that use dex](Documentation/using-dex.md) +* [Intro to OpenID Connect](Documentation/openid-connect.md) +* [Writing apps that use dex][using-dex] * [What's new in v2](Documentation/v2.md) * [Custom scopes, claims, and client features](Documentation/custom-scopes-claims-clients.md) * [Storage options](Documentation/storage.md) -* [Intro to OpenID Connect](Documentation/openid-connect.md) * [gRPC API](Documentation/api.md) * [Using Kubernetes with dex](Documentation/kubernetes.md) * Identity provider logins @@ -56,6 +81,9 @@ Due to their public nature, GitHub and mailing lists are NOT appropriate places * For more details on dex development plans, check out the GitHub [milestones][milestones]. [openid-connect]: https://openid.net/connect/ +[standard-claims]: https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims +[using-dex]: Documentation/using-dex.md +[jwt-io]: https://jwt.io/ [kubernetes]: http://kubernetes.io/docs/admin/authentication/#openid-connect-tokens [aws-sts]: https://docs.aws.amazon.com/STS/latest/APIReference/Welcome.html [tectonic]: https://tectonic.com/ From c400e860feec125fa9f9a30e507318edf04f183f Mon Sep 17 00:00:00 2001 From: Eric Chiang Date: Fri, 21 Apr 2017 14:22:46 -0700 Subject: [PATCH 2/2] Documentation: more diagrams --- Documentation/img/dex-backend-flow.png | Bin 0 -> 29612 bytes Documentation/using-dex.md | 3 +++ 2 files changed, 3 insertions(+) create mode 100644 Documentation/img/dex-backend-flow.png diff --git a/Documentation/img/dex-backend-flow.png b/Documentation/img/dex-backend-flow.png new file mode 100644 index 0000000000000000000000000000000000000000..457394227749285f3d432fd5919044e8f2feff02 GIT binary patch literal 29612 zcmeAS@N?(olHy`uVBq!ia0y~yVEVzpz%+$}je&uoP{ijD0|Ns~x}&cn1H;CC?mvmF z3=9m6#X;^)4C~IxykuZtP)PO&@?~JCQe$9fXklRZ#lXPO@PdJ%)PRBERRRNp)eHs( z@q#(K0&N%=7}%1$-CY>|gW!U_%O^81FmM)lL>4nJNX!OdM$gjbDGUrn3q4&NLn>~) zy<1%)@^#_=|KHOt3+++i))HrRTA=k%ZAMqq45yW$E4K&hWK86`ktCQKvSbCTB}ZtW z;AQ0_NsfP%+&^Cb!lA_~daxs4i={%jzJQXeQpl!*-j57t|NSdiKI7)xy(%g<@7}!r z`D28!_4V^S)~~DWe$PC=<4@iGcm@Ur1{p=&dmx`OTqxoA0rF9^zz0SK1_pM;2h0o% z417)p*g>jV8u%F)7%Vs#gwM?EH) zGf#_-?&e@%P~a5!AgviSL;cNS%^A*n@1}QM;AdcH+WAN2A{(b&%(L$@UMA|rGx+(w zvD7j!2sj+*pBOuVU;Lfrk_@khO|=OYK_A!|7*@8cSs8Nhy|3FJ?_6(Ybnhq=PyXM( z>nFXkpWjl$zz`(8_k~O1y0zx}8(fn9#eDk7!l1BK@Pjf3pASooiq`J)S_}*xzAS$v ze*UeydiAQLzQV*SSFZ}bVq|Dgx%Hr3bX}&O!V7lo$XJ>8O3JNI;_VK7vimVzb^2-7 zYLMw7jP^|h59dkMs7UQzmfTX!zz`(tTat6*YiWMoJm&-Mi#Tialx>$YGB7M*W2$2* zGyQQVrQ795x(EXUi@=A&9aoz9On-Qol-*4c`osuv$P8xTy;BtgK~8XBV6+!ilxoX`{x9scr6I6U9tfS^th`(S7m9a~D!w;_kW_fz1dJJ9RYl6a_t(3B^O4-xR#lX;z z=60aG!Mpw0?Y`fCWra%*@9?yWdU^HH($l4nzba38S9W~&4h9B>3^$e<_UyS67kUck zU0P$=I%&ywukBe68f>dpN-9@-qlPyXS;j1-ig=ZUl$#Cy*8-y ztog0~CmCyhUJbW;`egFqJoQOY^Zj3Y-7~z$e|GbY#lFGfiEqH!d%`(~Db`#XK zgKewlti89>_R2=*-4nisUcZuYcv-osXEQrr!0R5K%Dtgg`KN#1+OacalF5rhHp#Q* z9#JC%885tNd%I%Gk{2H*REzAn zr`0>RVtVTA#!tQS#$M@jZ!UcKZy^H%!z>QQ`wzwJzb`VJbNlg}2`{zdVv|{J2wvy8 z-ms?*6g(#1PcGlOeoc(K_TE``zYT5wpZPOk!@iW8-O~=l6udtB>ruD<*Gt;jA-hs% z=Si4rK0507VHeZG%3oKQP8%H*7i8UjZ_Sxt|A{JRmyYf`z%qgM}){n=_4@3CXP-Bt&7`?VJyEj_)p;$_j++{c~w z?R6L!93)t3+O0wgBe9DD69v7gIl{@)pKRdsK0&v$bj#`^E`_;tnYgpc)_O_Mf#l%-pfHuIvlAgEkWd|>VH z@2T=3zt__yuRXc_uUd}ouQ}}RE>DlIUCRAyzPQoa@;v_J9}kv`PRsl(Zl}F+AE$r8 zdz+Ve+tqw`c&?6%R`(BEw&&ie4Y4J8_jleFde?ltbj70$-=!1WtMzQvxo)L=c#|&!LxYRc zfpUxW+r32F`(Lo%Eq0o9W6QY{9TmoFcB<|9bHFkAN5Ij<#bvwySMJT7zPBV}U+#Om zv}eoA%O1u}DtmJ;nTKEMgY)gLTh5&bi2J`!>+YtrL4KPPo!M^R)2Z?ME|XmGyTD<58J=+k?86kY2W#pRWWyqH#tAM z8y&W8?d|fczYzThz6U z-)y;OdtUVcGebj*^MUdm*CZvSiVt&$>VcEAj$_r))!97-_jT2yFW1Kl1Ra)NS-W2a zRM_Rr%tM`Ol~g=jQ3r+=8waT%!!BW85kV)2z&@Wa9i43`f%gC!d2N> zJ$feX&-gdR=KVf*H}U$-x4XL=3m7Z%BX_3R+4vjF&s)Ct{@14DvYQ(eC%wu)CTo_m zK_&C!rKgIwP3%{!E_wY;%sQ>|?{BY37n}R%9_R%X%$+R_?+e(-{+HMh|PjS3ne9Z642E}I6$MdYGzAMZA zcjqRkT$Ww?CF|`kUPaqeC8tmF-AuEPwcZkZaIN|3f`dwLwY9JRY4z?=f6aGxe+0Yz zT7$aIh&?4c4RgXw-Y?w1ev$x+~ zPF)Qufp0$lze@LZSyp`H&Rg3)zPP2We_6Fzk7sA*_EIx;jill zoj--iPTu}%24AR5*m1tMQ{I(jzj-lnSIULfs=S}~b!xxzOB+Qr>z%pG`u99H=l5rC zXWssFJZc%J>|JAQo$>ft(Bns{>+9p^UbhZk>=v`upT9Ouhns<6f<{c;{`>Opom7PO z-_PIk>eZ`|@No6{=fywmdKWINdwS{`y}T!4jcwfT_LV&4?tW6XyEi;4YSyJom!1^u z>=9>R@ZjBYkoH}GCC7I&IG9{DH3ijGo|hgpGGDP$R=(%T#K7PY!BV4Qv;O;xw6mI1 zRCMEmmRyqs_c$J2Z~-~2Kp^YG#1B?w8OtYKJ^E3Pje)@-XaO6fpOW<<_{hSp!@qXz ziu(O+`s*o^{lnf_+D|w>S+sCw)O>&UzM6G^=gV9G)jq*~c9F5WOF)62^L+ifl@qU5 z`%LPoWO`g8n}!JzrT)DSD>QDV%j_f3*LOPi!sP=^qL? z@9p=v&A`CmQNmKwetTc>_GflKw|tvAwcRKC_OZp0m*0iWkK3tu`P;Oq*`I3pUt}!3 zUbb^5|Go9^EN@QxC~dYk`wq|VXRGyJUEl6&xXt?OxoFe$drY2}IuK%i;Wt6+kYkSV-9(l8r4R!U$U2b=CuHWue ze#iRqw;djr{_NbG+t1Cw;IL?MXJ7MMUG3{jPF~)!eof5XqD`icW<8u`x7Fcr8&BA6 zGdWOx`t{~GxZJt3YoQhi@u=mR!rQ5mU>m!zeT5|oL z*;js!Oh5JbWKerqx`boR_j&xe*(dJb+i_Du?%!p3_dENYMcaF4{e2LxtmZ3`{in$w z?@=r$k0<{>``f(kj7G1l?WGF)#5Wmttv@G%ijy^#tx~h<4bPT>(%M3{`v<$i*Gy8W zw2Az6@B6;=nb)k8on1f6fdbq#@l8hZpKo(__s)82$$v*&=+N%xDcQf?bE{mv{=|LN z(fI~>TYh~xWqRw^b5LRbE$yV+?bNuc)ZQh(qP}MEZ;9Gmw%2gak{5;Ek(cl0`R;pb ze(d+!+huKU;t#Ghk3O_F?7Jr`e z(Y!Cjq zuxDXlaNu6l+1K1FRk#)8hrX~XP~&y&{SW-Sk~I@Q{rVc1*I%47d)^dziwvIp8(;En zl(OIYP`$eErr-aCv(sJ^SOOr%^u-B`xms_A5(I{`F-gYvA?! z3-3zu>RsL%9=GhM_w?6G!>>u?J~(@}SWmJfvH4p1zpD!slWy8GFf^n%AMh8Hwcc|1 z#zke*vM(N?*RQ;osNMx?1bANZUcZiW=gp8wdN1nZuCynb9@}can*Rr={T>~*?w#dL zx6gC(EN?3QecgUpS3UaosZ+Z9tz5uus2$~b{WIj+SQ!{5`0O}o#=7;~i3{?}{+!F$ zy|3bB(PI5S_iWFbKD+(*;qkMZYWvl_@9yLN*q9)nF;Ce0{&&W|`*(9z#7FMT-T!N= z-Tb)t@I|1W!rs4gO4Hbrt9E?*&cMKMvZvvFK=tWUrk@{HN?CtgH-SCU^Q-MG9=Qs~ z6BWhhjoweo+Zwz5di2tn{O5x|o(i2-TK-xp`s{9%Ub)J(OMWHf=gkvd`@Y)vbMKz_ zH>Z@wp0oz_O*TIhd9`G+-=vWEY`i3u^k_ z3J+WNJMA1N=c>5;sa)b$?3ZNynGxtVeVVNG7UOv@qV^?@5Jk`VVS44+&uOV)LN0g^}sr0*X^~7 zD)}?7-00N0yU8~^-aan(cEy$dd+y!(^pDS5e8OV4nB2&154JxJ4Xbnbed^TKvcGI= zWA{7WE!y<-Ygpv8=%6nZi*LW!4(~Orb*#P5KKtKqCf|MU8D-agkxJ$La!EL$ZbEoM z{r&qJqnAc+%Z!iQspdN`ZFl|VWq0rDd{Qae6Erbs#Wbq|lNRrM^cyuFr>{;}F06=z^j zkOU1P+TUySP^sI0zvAlEt1H*7^Rt_;|D^QpdbOx&+L3dAoVDC@PpdZW<<-nw8(yyG zS4~YnRrQ~Id@?6Mcvgi)NMXcU<0#Xt|5CeRY@ULKwCZp)K};@sD$4nXEoRDj-NUo> z-Gmzl?G_l`jZ?b}iVYWMVcDTJ4he3+G&GYk*7`?cXN=xsRuw6`*$fN{3byxHJzVsr zd)Mv1|H-bRYQvw??nidtaPXNQ%E0g-=gI?jff#KsT|1$vcb|(eFf38a`jDI;{-rR< zDCWM#-B5MURbQ8{Ja%8}o~u_COEm+7LSVDJlE8#Fv#bJ|?}z+x+cEvi-3|Lcu5Nz& z+~`iaBm;xR?9=&qIeeaz?!PyWD=jTOcKZ3}lg~d(9)7mJv6A^T>$T*6-Bs4*??M6t zC#K#x(kXm(b@=)Uaa~0g_RkI#{@&ik|90JdH(`I{!vo#iL6Gsuqy)aG%*@PBzyD6# zA5`1He`ij1o#K^UrLS|2e|>w~{GO|~#=-qkH(6^x-#=i)03I+s%+XT%IllOSQG50D z)2S=>ZeP7q{mu2?&t~UuNk2bt!pG`wZ!T`XU$;7JZP0GreRucDZEUG7_O(rvXK1+M zcA)=&Uc$`gu!N}C*w`z#s+sEc_S^rnc(f&C{n7ri_wGvy&etk|hAAH0-t?N?Uf@OZ zb8hi>oL|1(t9aboarvD6|34Mth6|5e@=@P$xAwy)kdp*HC~x5Qezrh9W7pxcTQ`3E zS#xV^cKD5#jhT7dt?#+|a$L;YX3AcZ^?{KAG>pnqe7pLyh37Qs?B@J+yglasUH5vN zEoM4(>Qu?QozIW$Ucsptb71@GliRt!gNKcU8SUMk&CWi{Xjd^qI{WbLJ(a~ipTE4h zX$&%Y;=DyNdZ5wM3;cB=Wm`X$?R^?hEkE=8^UEs&7bnds|M}^u$>pDZJECen8`!>J zU|=xL`mlII_NrvL{JcfN4m9F${VURWfwYcLQl$yHq)TvXCVrv)}8kRWo+ReI}KEHNZ?C!GGp878r-F4qD_n9eV zF9Z#K+5z zdJIzMA)~2Tb1!j_X6!>ZlZJX|ui8 z7yMkEofY!>^VS=ME7q+HEcNwWJbnGwpMDvY3=9p^9C+)5X8-(P1FDV=xA9!-seZS` zXZ6>gCiM@6)@t8ev3P2nXHeY#eNz7}FWgmBJaPG@HYYj{TOTjBw#b(iH< zZ4X($H!^8v{G>Ks$u*qG?$OVBUDuvpu6a3ab;)Tn&r8Ox{j00}wi(vuNA8>#{m=aL zw_DpjuJ~WM_i|4)LGmb?t+HZl31w6>zO*DR;%{EaphQ2nLmE3vv{`)<#ERR)Fw zok|a^10aq6lN{d|mqu?}S#sJ;_Rp3>66tbzd9AM9ps~rfTR;{5+h4r1?6xXA!6UPy-~3=? zU^vpGX2rK;{V#bd1-m}~`hNA4xR~^3o8T`yZf*PMv1r#?8|CMH9U@#G5yq}m=Yo~mm{Pf9d@$;isG%|mh@~-UlrG-C#y)NdSdVPO>_w>wj zdsy9O%FVSs`zZm`Y>W!}vg2dj*;`)&ukTE`+3j|=s$j?TC9U4mBoBXne$K3~QH57# z!t&?yXUdmWyKC>&+VM3F)Vuona_VZ(;GTto|Mni~T%Y^VVfPjt7h+&gkYd_*SjO_x zPD7ijCtDSBk6gZ+$NT@~1u^~L2jZ=(*Zt_s-Cf$RetO3Tga3yT(ob#@@2v#28&vLG z|5fAmL%#6rhY2qyU9nPj2K78js}FzD=aam?)jK`8;`O(=x>Y)i3=E4DA6TFH=g%i` zc=?=~O>b@P?n*npYnR%`_vicLOL(L{9NzGGroPRguj@9~KF?F0&@XT7rMyl~&Zz&V zlDhWi5ZP50IloVxvbj3r{JP}}x8>SQi7K6F|Es$} zCG>iY@F$U3|>Kz;Hoi#X*0^vaOd+9=PNC^rF}LXZkTo*73=D8d9exPnCRs zn2CWQ!I5`gb8T#FuJyj9^4CPxtqf3EYaDg6Pu@Ol%93BRem)XiZKAL~-ot$Q-r{PB z!@MucHXBxbv)Fy}8ZQIG1&J#UtbIV8*TcWR-TwaJ(O0?bi$*hNbIqK6p2hh4$^7ry z&Ii|;g9nU0{t|QxpE_~Z&M8ZJXM0DN#4|E5JnC(DZ!q_~)ny63?*glP-~ZbjdAi_D zx4!Os+j)=AM%?SUQ2xhz{hEm?%6r&P+k6%A{A$Z+`|$!#@}DEt@3-EWa(kn*_2T)} zyW2xp-{@*DpY6@S@W6tlru}2Zrk;j96)%hS?pt?+WB*pW`O|c&FMfNu&iCch{reLu z?^`J!&WHj{gH6+^He51&j_T<+lU=?|Bm{~eYXEV86)-A5>9i;!>z8} zPP0@i_lC}@xz8+R{!#C4<@+;fwsH&%47!~S?;RGq$7S=JpB20!{=S*(QSI=TyQI}K zK3;ly_S=Hh2dchLoeCcDe0KPA&pUPZ-W|7AgvReF*|~0aVH31hlkx2EXC40Mn_h3f zckTdVrCa>B?Cbd#UcdJ0$#nj#Z?-LbPtsI9=t$=5d%B^C7nML0M}1*cSGV=L_n(`0 zE$P1*0|Ud^-iG%M)A`PtXPsI4>p<*|go%O~={|dvbBt#Q8~!^s@mRsjX}M9m>zY?( z@0%DB-@Sjyi^AmHph+attjPj3{p3bWJ->en4@sx#_cbDAu+7Dt33=W%$e*Uei-^1N_?B>4W?OJ^Df$e4K zH?CF5ud-MpyZd{_^?ChQUaskTb$$8tb8l|Mtu;1Uq<1@_`t+%-`Sm;fEPtkyzP%I) z8n{w*xc;j~>;IGZTif@??EY4>WX+l2(rYtiuUKz)_t^iPv2oVVg3lF@$-PM_yX_kv z7ks$P6)OANiTTqn&F^#MTi)uKY}o5@TrFxQ0|UdOR_F==-xAQW0``ZF;Q?#UFIRTA z%m4C8&VN}{ddiV%bI>XZCOZ{b%TGJqdgtDF@pSg@%#92T3>~tJ@>z2)p1O3~$9d-b zdE5*P4L=^KMT1-QJ5Gw>UUP7vo9|K5j}H&0eP126wyS(1Xstq{6y294y!@!wF!{&d ze-+}2nT2l_74MAssMoakqohmmqd&QEbM|NWovipL^g&wl)^yHzGv31=H>Ljz+Gy=| z^2gH292WH#g)Hi4vp?65a@sV1Kg%CBu7B=k`=5I+{b*74?ac9`e^P}c_SkzyfH0kdj)d$BQO~iq7Zhop(2!e(Lo@e^$lg zKdyTU{>`&E7k|XtX#RdZ`*i1!gYk0kMG9V7%a?>k->Z+jZgtPqD+{z@;aI_<+LK45 zpX&?BKF_b1v)`knv+CcaZaHonWO_^5Lq^kR#cXItnk@#aiweX)(WWm2%@{=FzpR?b?rL*c^P_w-9{`>29?Xr5@ zx=iH1u;R_DSFe7w-^XE5Kkf`+?g7o^zShvW7+)EE^9+G-aSs(ejeo0Ir}Gm zpZQt5QwMAYPt*U8Kbjns9@W=oeYW+p^C`_^CWU$FcOOpT$phpVxY>KPh}sZ5StLT?RvE&-pZP$kv!aks(&pf`4U&Yh--A?0Wsh~NzNnbv%)(f8>xAWsY)+Gj@J{3dL zn;TynK~vLPUz;B>*?&Dc^-O%>505?F>mN;B-NVhdL=LoA=>X@dbwAbaxo*&i*`V>P zTi61;TH}D@o_nh*#2E|Sq(R*W;gVyL%UkDu`?X8RGwA&txmPz9&fRlQ>+Qb}$$O)B zg-*J%`S{IU3;tJrs@QaBUGnd9cik?}kFB-~TE5vT>q3M4s^s>vV>Zw^4B03 z+w)f~?-qY)erK6AccS3O88VP^y+ud*-M^NC<1e?GdxKV4l)j#|_Kn`$Deua>gHC)| z_)}c^a*!-2jvlbMa!uR(OvDS^CZ8W)3LY++8MkNAzxRK3ZgxKO{@$jdvsFt1exEw! zd@XuM!bH&2)cW(fA-ittuKzw`qwelpP$PBb^62Y1&~YfQNz43o4VdcIo?mWn_iOot zG`q&{xwk7qOx`P=W_3HTuV9|tzwE!y<;h_kViUIx=s&~$=z+53%eyc2GI zOm@qB^I~FEZLH^sFOkJurgdjD?pFNmn8N=Hw1%ufY{S#PvePD1Ulp~#c>Ypw%#2F0KB_J$*&OqqCnXj7)2@8bRx6 zwi(xEH7@xj^(W!H?*G{v-#)0UtGzAqc##rlM(_X20MD=cy_ecw+5t;6uV1Zq#+et%gzTzQ?`x|#gvFN4h4l{%X*RA$>>)`a-Too+G4F`%Uq zvlwH|aymY)KJaMi>8aQEua}!+cy)$d){(2b-rTx4Y028#<;!XgJO@?A4Pr)rzq3wD zvsi0vWK#CUV{7i?i6wi~q9*al|J)8)*|R45L4yrwj?O&3cH_mr??3_IJnNKB-8hcRf#eeM?(^vWn>Xh^4P)NhL?Uv$VhPWhE;pwK#v)=ev1t0e64=l0UycpFce9 z^)l&oo40)A-zTsm_fW*?FV`d`Prbe$K50wh^^JwGi*L{F-;uWCZSST=sUL~XZ0)h%Rh#up+V-s4% zYtN_iOrI*x@q2?#{?(5G`;))Vn;`Yg_x-e2&Hdk2{W)-u?fdckeK$5vzP^9`+q&;> z3bz#=E?T7w8rf;tSoW9g?2hN>R(zhDasPAr+?xl>Y8K4&esJva;;C_{^Z2RG~?f=PUTj=?<|u^J6E|VGW()!z)u%VRQWOXV9#B z;+q$2y2*UsmDfqGo1M4gT+v6tb=J^R|a{7tp|cWy|p+*4+EFFK9qzeW9ow>G|!el70c+&by*(#e7) zpmFj?Q&;CaU;XuG$^A2y$9^X|v$^xUSRGewoN{Mj*Wqci-ZxmkpS$wUY4;TyGA6#= z<@bACP0$asKkZt4<`wtVeRrIcxVPbD?Cr{FI@N*K?-gtYb%AymZvPyaE_K=7r1fvZ zTkG;@y_UY(kEzY4+irkXpe*b=SM=-RD-XI;=3^&853}-n^9$ zn_Or8{9vgl*GTRhFL*Yxk-_^&bisCL-O4H*+v*MRy3GmGaLY|DOEeD9CTEl|JzdFh(AXYn~P zch1ZT&X{7p;Vx*t$NwU)jP}ZZ;jIqwU%cn*n|&+%eeSN5^+!G5SvJ0ve}AvKT^`$- zcjJrPebcioWPpV+jA~2IeFP>S--sT zsY}=P`>&4yt?lWauDAWm9O0ZxEwgp*y8T;F-DjAiSA6o-qZ!|<@4gMYxToFZM?5r)NxBd1;@4EW!N#5;ai?i47S#$Aj3L^tU^>n_o*B>-8Z`o6k>M{QvbY4fQ zBr)y`Bt)pXjt0?@G6{C^hl%i4{NSTN>(jb82r(>FI3&INV+Y`;5gymx=& zZH?^hb8?VoOr54lTPXOS7qMNp-8}D__xd##FM6%tSl?Lp`}dbqS39!Xq`%9u)D?0} zSzUgF3p91Pr)1}|^K)e{KVEg-;<1Tt ze2|LfpS!z z_Wbhp`*qS^-R``zytys)YsIFdd+jCLt(UafiQO&Ubk$bf`q8E`+cz%S;aeVyS@1;ttML3>Df_f3hIQ{I z`$x-}-VJ$bDR?pOouR$udd-mQSLR$Ww3zt!X`7--cf~w)hK6U(ymd{x9^aekcJ}X@ z%yRd&x%)r<60E8}o;UUFe-~%A_$B%K|C&7#-S^Y8sLXu(m0vZp_7`++%ekGoG7_|; zqUyWN^>6B%u3w*;acz#1=U4MjZ*;Yf6u#QPa-9z90TLUq_`VGh^TVsY-ubjY^Ym})p44_;$u-jMe{GiJstEWu7F+))w)?Z(IXTPu&#zrV zYpZhSJ~jMuw`kMV{rUQ!#eA1?5`Le%d(5|tb^E=X-+KdNgBPD(C!0GZ`JS`!quLGz zg_nXKgeP2&PTkq5Htk!=%e?J!a|}(FwI?6h^ta&cKj!ks?{9o<{AcjAJW*fi%>QKb z+u>pBRyzf}FYvr^kCiDkZr>7(H?5bt|9>tz(b}j2T3vZb_qIvhnH3vy zIq%>8v`_Hc+ilXXYXv*bf(GQ*@BbHNX=$mxZ<9!HZ1CdWY3DY!6uj_NRS@HK%u6G}ON?@-S}Gzbb>eGa8_ARIf1c?5Et_z5jAS zrTz0bj(X!a(7O8aaFe0gbgx}8j!>{0Eoml;dL?-p&^TH`r!n!cvdx6nyq`mu7` zES(hYfR=2Xo-Xoo=Az@hc6F+mzup|5_2fS5*Rr>_mU>QB%lz`<;;;Ar|K-2Evom;~ zTHd5*A*PMT{!IJs z+pzC*a{eZsdf)Rhe_Bq?CZpNThg%94_fB~5F$L7FKh}D5-==}7nkyE5?%I2gF*{u-(bCrb zdZ+k&=BX)~yI!qY{pCuqf9Cadv6_NnQj4!WzkKQWYyDHZpQgP2nf^@Lx9HcGQ&;2X zM@ww0-uWxd_Pm$Xz5db#YIYZtPyE@rS+%w9-dTQb(1HO_wf1_Baem{HU){;S4*2P= zEc+K{WfDJ~@9gvIFX>eU+9iEg+;fY6+&;a!_hEr=(7HW;)Q^3rUK*YIT+-;r zq6umiFY~qsZr;0&llkAIMaMx4VY1_*(tc~Zl|A3w^RU4DbJ^*W+uqh!d^o^(>_cCy z{0%*8lllOU&CMm-qm}mDqgs3pYvvhT=w6m;qf>7_NQEE-S)V6 zlXZ4{WaW{%ztY+Q5lm12L6*a<{&V2qiqmnWNBx!71y9ypjslWfvCY6=`^X;VUYIdBn{T@^MzWRQ5`Nc=iUcbsp{;|f``o_7- z*4x|P{^&aF-t$m@|1YaI<<5|$(7vfp*`1cfe%^e#hyC}R!uLLpryq*E{4Q_Pv(^H( zbMX(3fXbtv_4}@x-am1<={Db%^LN9;@JfX5%8x)(jmi=wpAg=n*N$_o_@ZoQ7Z*Q&rUFI3IK5p-q%k%$*Op2eRea|&J z@b@=)d-Fr}X>aAL()ax=d-a#!?f$g0l{4OzWgoj@4QdbczEoZ(={K3x<;YKN6Fx?J z#+m=0@BTlTne(f|s)UDG%c4Ii%6L!Po3Ycf;Kqc5pe+@J3%3*&ugpC!?^oazRlD|$ ze*MqW72>LzZ|>|2wl05nMKd#Kt-Y`5zxUk>3SxH5`Vvvc+U>f!CoJpsvE&$?^wfD$ z?_>M4&)si(_=h#g{eZv2v#2fC@9AvJm6kjAZSHRW6>d5o?C)>OwW)gf)AggBNMPvo zD-sXw*4M|Mol(`Ed-i81OU>?QY-!Jy@q5Uem0o#jXO_-y$1{Oh!k`@(KUHcLMxUp~9~alTBZ^gHFRZ)H#0G(KZ_SS4X-UTa|d zU;4=BeOwNk{uyQD1?P*MwgmNU+;abaEmd_BK9JreXTEFU+?xB$zW<)&GI*4-{9!Ro zeDm?&dwETrpi*DoBR{vlzq9rb>sQlvxi*njk9#glZH+A!ur2rye7iEM)-Lz{PV20h zQmYmJZ#HM2dM>? z+cIUw-^zk~Bd7j?(dHy6%TFr~blmJ3?4c((S#zX|gA`EFxBKjm$+y%xIPXP57a66InU63Z`H3W zOpD`xN6q&)er}_<^55^wOD!ASDwp}|URYz zLHNcJ&g7?StE3qdrEd5>z7>miJ4tD_g_1&q>p(+p~#)Hakckvt(4@;lQh5ef^~VpK_%VV zeG#DXrlse_rTvTeu18;K*|@m({MR*>t+V!jhy-=_RbKbLImo{@>fSyt@(KL*FpX|1r;4;pk>oEd-HOb#?b2uiZwmVN1yy_NZM zk`icj?BhtW#`hf!d;Znx`meDIDZCL;zaZ0ZgTwWikcGRy)SZ;K7XEYFR{K0}ab;HW zJO){d{N?_-8(3;SSG}E6^y%cQTT3^evv|Bk?5!q$uk!(aCT8|0FV~;fy)sdGe)fNL z_Ai-7({F8j&HVLU|~mBKr2S(dD~&p!ICmYOk~Hh`ydP_u4Vx%O77})(+RV-S1I- z`qbBN$Ie=Py%Kz7y}!Qqj2D-+uM538Z}E7`gypyTWNm}4|9fKu8y22>?$wIA+A7W6 z-pf1U)6}=-t*zugdtqVM;aeN4`_1z7daKr4__A)_udLXjld4wF=M+zwHf`CiT~=4G zUKQkOVzGPvKDRP{_qUpqnsetNGj=`2Tby?rJ575F>KA@`vKTr`cPHZCoOhPL9KX+* zaO-=0{lA?b=Ng#&PrCi7!X^^bv3#8N_0=q?tdGG0&-35>`}Qg8vC?M( zTYba6g5MQN@u2Rza@lrq?;GDLHklMS#4WzX#Qtr+=Kcb~xY=g8UpCMG>+^hW`Mjzx zFBG@m*4=+Ue~-XC$iUj|x-jLri-Z1FN?BZARC{glT5W|}JGq}f{NtPRu&S5aM3V2% zE!*dfzk}Z0o0;NxfPF$p)wee*e|~g*rT za?NXdw)D*U!{P$caBF+M{Cg#a43%^Dr#<`{_VU0%|Ior89iXYsr}I8HtL=1OU+UI& ztWR#`s^s_;6-Tu^FSYr;|8%;PNeMK*X3?_qbd>RKK4q!b$A32WG}OQ8)_=VB^oE1Y z>p*jf3Kn;^=RUsJk^SoZLhZYoe1n&r&71UgPRS+DV;{s>{$OI5A0i4~ zpPhE^{hM3o%&#r%I$ZT~s_C)nssmm=;8Agv@&^x=A1ipaa`}yOmp323sTC(!8{4kM z7k%&l@6YE!zI?j!YS7?Lo=E>__k)+4pT^rM-8;&b^lOck>~sA|qR;igvxsx| zgBG9Ggu3Z6ffk>dT!l;mw>|pfy2%4Pvnz3<_TqyhDLeKB?pp0PDde?(aPR)mJ>65j z2)*o9omlYCOm}-t*4%IP(+aPa-kzDc^m;v4J$O(E9{;hwZbt& zt4{fj_piJg_kUbH_^nv--R3tbbM~KoU%l?ujAM#r$n&Ms@87w>J4pppI=y=Js%QH7 z=abJrH*Pyy&-|Hf8uyyxf5g9*y}Pq=(ITbOJ358cSB0;S`=}S?#PKhQqo#7n(xsC1 zck{|m+&@t8VCt&>&QJd2+S$$bXJuvGcA1Nt`)OHl_xYdINfz~j{(e^VnTv#(Kiii? zMa}wCxBuz-kpHSeJ1kH9aavLO`r6ID*SELl@9CZv(3HLQ&AyB?^~|Rabba3b^3DDI z_HVW@v-7Q}{{HTxUecile{!Yf?C)S#pR=Fkj{#G>*t7l5>JvUs?>_x>(-pZJS7kn= z2EU)3zwhEa+iIs{?{98)zhC!zZPZq;x7&V{<@zT7EHb<-skzBZ*0$xzfyVX^y$)bmd}suUcuS?d3)h;P;yha zc^))LUiLrYnf|N;{_S_}2usgDzZ|rxbFSQsX{SsZ(k|wGGps+TlEv#}Q~1wpZT-K` z^9|2V2CZUUq{edYzVP9n-4#WLetI9^KYZugc^kh;Pmj%eFuR)R@!9%7{h-ft8a8b* znp^#D=SRIPCywu|$>Ea|zCWF$5pVR-s%*}F-{a3ezubB~uG{K<_WHfc43m!)Ow>Df zU)Z*6&i)Q{aEwUI%ztNC-^jvWoa|pQ+dRK7bKX4LYVZo)AN6?${zx=<#fZk6eKBVq zpN)55tl8P}>%(FG`Povo4?7Ct<;u3Qc7Ay}NyDPv z|BU+lnoAE-`Q&U?tc%@!Z1)S!#?Rl66#P?~2QlHqAJ?RR?WXk~TYd|9mDux{FK@yGk9d`uXG)L%-mi7KcDK?OTJ%pT=seX7oVWXZ=G()Pe!E{Qp8lPp z8SM1z<;~5@!7YzihK4CFymqrfBO@c55ARh84GUYfW{r=frRB$atO}`H^Y7m?Tf)x% zXQ6ZZvE3^e7=)SZW?l7EpPLfBTil!Xfv5Uhk@t_785mS#ne1kXnl^xzx@qfzS3nHp zku0G7m<=kt@^&`&TtTa^ShBF53S;)eg9E(qN)Xgo8i0jY;98n4C(umzQX$T;^6>lb z?sJ|M?R*sL0$OkGe!zWmhuE`ZS^pR83=A0(Om?$E3OvmB_lx{`{pyuYqMd z1_l9XCOf}~9Rc!xuII<|*>iZhn(<55K}2W(J0q=bzkHg|RN;5Px>IK07;m>+k0N zuh-h@Peg|G&-?WJNnyE_|5IaMPpCX+zkd6=-QUu8J^1r^%DlM$ z$&*h%-IRNZnSr69ilxS6My&4MpId9M%l%!MvGLR?{v$h%S-HO2Xu3RG{I220w68C( z9v1qr@+><81BdGY_cL#@-kx3WEZScBUtT`jVMG3mIqPCgs&9ch7JCK1fYohKdZ4UU zw)Iu)`Gq9d~!wDM+G z?(%YrE$D;9a-xs-&)fteqEKA0cY=Hr%}Dg75x6t{x}UA22gCgt#7Xk0^Wl zmib}b?{l`hs&BoSkO~@z*tpo;%)7EHd|lAPCRfGB&uwj-Ypb71DbA0oVPKeWisQ!y zQO!H`e@nL>^WPOc^`6#gqhh%o{>MVgHzpjMR`~k2zFhV6KdDV;nvIv4-Q?Z6@z-BjVdrDEHu;T#=N|k8ZH5+QscG4; zdguDptAm$bUp=Y!+AWZaj^5c{8=N(F;=-4~+&Yg>o#M~9|IdHLQIIcs8~B|I)^4}F z^ZRez-mM3v!0~jYWA)>(dkcSxgJwih@3i^8ztvXVWXHhZA<9w{(UM&aa*ApGw1{VW zznwb$D5zR~!n?BUGrZTf{a?SX^76Jn3=9k_n;Q5%FJ`}Ay*fMO-^u+tr=NU%E&M)d zb^QFeY2T;b(~@2FqX!)Jn>c@t6JPVqkdS!crq~$n@gJ-+zByUoJYWve~)R>0`H=6$67ps^AAj z%`IuxCNk=I4(~3!<2n6%Qt#|sXIn*i28Ja}Om;la(sWNQdGtZ>^zU`CR;qvP7{MC^ z7L@IGpJ@AD{$|^r|B3(iZ8->vknV>586_`EmOcHuZ&Oj_-q4SF(^h3?fzG^1 zy>k*&fhB=9PTto}#gp6;dn->0?qyq+ulU;Pae1H%z+MtQ@+-FJ7@ zMC?nw)BXRm*PiaB`}gj-^=V)Jdbv|4GDP3QjG3e|{j}((dw(V^>DIHjZ{+`STJEjr zFuCnUpv4SZUzd3Md~sA82<~5MaOlV0VmO>Xxjf((ZBDGwb6ccbe^uzV+zooiBNr z9&i7y_`f4)ZFG9el?TF~7#Tn_=!XS#1$M{i#g;h!pAhwD<#+oVi)>$2>NKVMw>v9(h0wC@gf28NY~o<9FLZ^GA;TT4qzSFK(>8Qibg%)=fB z>J0odcx@({5Qxc1!o zq0yCJHQ@Cr`|9@O?x@eXR_o>OZ+=R&Lhu5pf#{yd2Kb6|^C z{?vEX4+2AFe=DWT1r1ST-@5ziviA1C)LZ+Cw=X+ir=xPi`|HDh{N?wT&3SW9aqHK{ z{RbQ47s=W&FcjD^+3}Q}EjiR$^SL7bs^QuHr-R1)%Wr*t7`OKR2mZgWFL%w@cK_#^J}ILgN>AtA zj*YdNE4uAvZ|nj7>!0}<7#vn9JWy`gDQ5p;S@do->xYMGALKs>Eq%jX`}wT7RmBTq z+rTe9sk0yF|7orIW)Us9HcC_bbBOo!IR|4C+^SjGt3m6$JXAru--P;4Kb>^{{dShe zTekdiSG#ics^sA^|L(P`S9AZA=J+vhjnB`&b#n`UWh&l&bM>*zR_n)GCj9%B%=vv{ z)?3c+3=9fa1wJI6)_cOLzo-8ioBgzgeDPNx zpD=vo_>nQ8K+#^{*;&W?HOA{o{=D3=?KQ{?3?`jhgyUI*d<%?aKcC(HEKg6lv^sP9 zxs207AcGezW|Q|-+L3nu&Tc=Q#5=0LrPDIA`57247+iU<_~4sc7ud5i47R^MZa3{| zk|yZj4y}c3_N+&ZMch}{_Af27`ytn`?1p@uC<6n7pW}h@9T^YJC9@8kO*JuRv4M@7Yb-b9dT#$; zHs@A_&HY}rC(H~DN8AsTPk2!9{`+s!FX_sUW7jPC_Q&}1)s3~*yI!y`FnBiS8Oa{f zyHou38cR-}HfUR}@&jvuhx=X@=rA%kY?rSG5Ies%l6>|2MUr)A!1 zs@d-M|Ks+${eM24jt{rL_Wrwf-F~k5RmV2HSTR3-WuNS=)2b(@KAYsd?$@>t_qTQ! zMjbUz6rOotR!^Gw{jGb;cg7qm2n$>Gw1UlkBWRoZ#S3ir8Q)Z`?EJzNx6JaCV9dN- zyR1%sTmSp2%jr$r&(4MYE?a*3X_2O`?%9e-xdpesFXOpZ_PX!s)hkayC-r$H`mS<;Adc%B$)d_R%cp!v}tIswk{D){~2I(FIJ4YKQ_YN{?U zGBBKMXn60?$RKqmM9t!kdzM@AqT43r{gM-=O%wa(78xED<*~zjzj^**&A#5d7Q46o zyK;{ieD+0oN5;dud3Gxka~~%Qa(vL6?p<118kqg=?Covb-!n5ar@i#8J#&b+J^Q!+ z4R!{G&c25C3KN~`3MS84mNQSe)eO{9a@*0b`eb*C{JYt^JN-WVdeda{P>z8?MVM*d z;Tu;kxMy|WpK_Zw=e&-3Zlll_@+I-9~iI?&I z!#7S@!S^GibANBV`zKr1-}}3({|t6;9`tuSE134SPSfD}z4mH`X|X#GU43Mp{u9(n zQPRD~+F*P{YS-bbN6b?y85kH^+z+@elI)muKu+05MlDt-!BYD~HxB;>DK zcz@^b!xMhm+eb;hS7K&huwY`8_f?DH-E;r_^z+XzJNKXGkNnnOJb%jh=f-+$D?k-g zh77n5Y{Ad>roQqUYvt;`R-NZx+Gvys%h3p3NRf?JYn_>R><&pg&Zn5XjShjxpS)&LkRgbha^s6O@f0nD5 znsaB(-}!$|8~tBjU%I!h_VU+hg}+bpzgWxre*vhm;Git{q43a~U58BCtJiP$>i?U$ zFjdk&Y?+?)wDqU!=IHx}Ela(n-0HvbQncu$BkC2P9cQ54?PQMd;`iTwfAx46toZr9 z{Z@y}%uFwD@5?>a?>J`u`>=-9+{X^CElGWSt?x#kk{qS#J<-Odv zH+8f1{H60_za^ixiQfM9%I>Any05q1R%2jbSi|wdBJp7ss2B3Z<)YH*J@eN1{QV?; zy+z0Rm-zKIldF|~PA>miT3ULdijjdqK#ozqS8Qcu-~IRDi5HbB_g=Gmpa1u(MCz6- zQK4(bMo}-fahgXyTl*y}^WLBREq6gN>LmE#qQ=Ep&)(er-+8YpeRJx}eS51k*2l|x zPCET`(&?w0e9phV?p|B{JnGom`s&HwrcS-xRt4(nI%qK2NuAZZ@%wMx)oa(XZmn^5 zezw2((t6dCLT{R#|2?@~C%oy7?f;(}va+*Rg1QDBjEwTUVr#$sn`)XJ`f}|io#N+f z%}-CBntA08`+lZPM*df0xBtDhDQD?+Fa7_2d2bi^gQ}bjN)Hx0Hr+lvyZvw7el0ue zHOs|p(<9Y(e~y&0`M~7KCH>*7WBmtL@fF$A{ic^B1g!wUBU?#->) zvmSr{{dGRSy`a&5`DJ(Xw%?Ww-ci0YrfB!wUx)8*Z(oysthqRMJ0}A}!()yg9W(Fx zu6uTUcK+VQf1k4Je7;j~_i9%Cv6qU8b{{6JF7PeAwcYyerMb&grcRZ=aOqb>14E-aq}?i?7{jUwu~or+oOS#~Z)({{OItb=8+JaF0-c zjZxmP^V;*j!QJz@BcILNoyVIwOL)aj{<@o2A1z?VF>Fnhu=eqN9>DvDvaqGU0`~OWXw=SQ1 z?<)odh8qeGl+`Bw+Ebr&5R!cE)}7ul<52CA3Ga(`KKcH;^moffMc>kAb~`8R`^d<^ zkR$LxFmTJQ-}d&Kb(Wm}J^Of1kel1;8To5^%MRzdxoO|Ec~*7WOlxmwRo2DgE1=Ox z(2&cTjM{teZ~yNMTUT{=)0xV>#imatH45f0=)Lmq-n*yYf19R!aD8=s`SR3g{k^-~ zexEw^Qd*vY;Xq46e}|IkS~lWg-jU&3thF~(D{9M?O+MH4=9U~?>MV8jdF`6NkADBHi!FR9Q2O@L z$xUy6`rBuJ>CF$%1C4Yz9cW)$;9LBsZvV40(E>*QpWIeI@wUu6XmiW&166nPwyWKj zyA|^M;PH7|bV1FHRf-P|D_MxJvp+MxU*#UX{r#ph#ZR9ezOvPOIU8%)?uQZCA9t6% zTmo9*y_6?<+gniD$!WF)9UHhrh{?{WW%bVW>(*VneBLg9=Jm-_SH}N;^^2|jcSBp- zABXi;=KYeQm(2gopC7qw{p!^#;UgbA%)U2X-^1GN^lOj)kGDT&%zno5%&k=cljb-bXUg(HNVD|g@|6g}aSY|mnfBu3sXCCK1kiK;9p5L0c zpPHwiJavZWW$5xt(M$jT`yaPR3^Y!m!c^DQeeHSe(e(DOcRu~!sB?L%w>qz6%|*_u zx7sgHxb?>&vYlt2#*+L$|G(F4FuI(5%L=UQjy zx+STLV{KSYrIdfe4y`To!aglw@Qo+sn zb@He6ncv=?yDs`z?>3$2usVm=_wTs`%Q7%b2;%smsTFm3j#vIvInA0=n|eSU`53Du zf&L3~SG46Fe*gV-mv?*17g#R87{boLu!M)Hj*I)c$?^B!v(N2eRs4K@R$2KGyZ6n< z+3%T$IL~@DV|wB4yR*Kw?{>cS{Xw$-t#`@{3=P79AA$o4c9^!`+qKIo_uq4|+`Icu z8~OiR!1(Ic(%|N-H~w4L?0?kiZ2b|tyM*hdbp7dVvbX-+6T6)NE-(F@5BLW@%zC$a zb@rDdO|H`_Z6jyy`a7*q_mYWvMDnj=`)d!~n6S*Mcz(OFj2`?rQmY_qRLdKAgQ6Uw|w)4SrTN_)Re zoqBmS9|J>y2~%BH=auJw<>e|=QvPYOZujWgyV9pP^Tao1-_m#g?zT+$dgt?e{>$c| z-aJTgM_Bd$Q?Irv`WCC*|0bQ9n&!54Xa1{YmIvQlllP9?WMpjmvn>0>`Y&OiV+9;_ zLE3bf>bN=}2`h9<#>&*0>td~5PI6?H3dz2AXOV5p>340nz1iXxtc$gZyk`9WWqRp~ zM+UWznHd<|l^!hb@Tk4V{(Y9R=jCO8*17)L(;u4r`HuahwX% zzQeAsKHq!){q@=H_c&jE{&(th`^wtgm!sF5{~ckvEWgGx>;Aiv*wUZ=I;Zn)ZVS%7 zp1%N;f*)Au*=HWR*u-2L8$0*o_t)!Jf0bWcpFH#ax9nTwo@K?(c}#}7Wywb$pI{eNfC zcC$Z+H~D}P+|9>tc6_arUw!Ob@BPikZ=Tx!!|C*{Yy0ii(r)w6-ax7gnEpD}1bNP5QgZ+~C6Af{pQh!b`yqvMN!R=Y)r?zxwYJ^R!g(;=a#u zT{3;lLW+0VwY}H)-_E`NuH>#!-j>vxn?5mD{d}K)0hGa2OqupMyJXJ_ez`X2;-aO~ zQg@ZTT%xTfJ1NBcTHECdwI6=}-Sy~_;;UOrC#Tweo?jO>^`6$OSD?8d*8}Af&}tW# zH=pe)Y97=s%Jc}9{cM!C-TFyev}e_ajq17miVO@6MhXwC9SVN%@GZ;V_q7kyfSmap zl)|#7`|+;Y=zpX@eqGMSYmds`Uh)i&{V05T6KXA^V#T!28NHU7owwthpl@-L>9YJk z@v-(!a{kLwZR_jOX6{?JZW*XhR*_|@o77#F{1#rxR4hLKJEFPPsO3+F|90N(@sg5j zLkdn;oZba$68t&2+_`V#-D=1w+5Slr^H{$A{(Ectf8o7bAIeWl{lp%-0$emOT1XzM z-SO$zuKD&h``3Tc-*;ity07{9m-cNc%KFI2;1HzvKwWe9yrQPxd;TA0?r+gCPrSox z_+5Iw&q2G07U*TPnlY| zXKkfUqn)JlzSzr)BAn{N(w4pZH+O6JT(A78)As(bpZ1uSfnmZ4jvtZ{Qcp-eLa!{RMBf$i8U5vh-Lhll$8&MHm{!2g^=8>`zyC&k|K?`XtZ-+H zRn3$8QsuAj&Z;`@@;BpytCzojcvMu>iNZ;fK8y2#&SYcxqatu8*zZBU4&(jz-$BQx zy)BDAl(}VszNyZhS*I&rY(6|`$+fjnD}AN?@AOB1__)D3?%B^+z3H!By_zy_p4_(z z!4HfK4vUl?s52Hb*nYX0cv2{Azx1^DI`19Z+umLF&rW8!7LoOVS&8*Vf&5(g*uuFg znK$~`UjM6p*RgBfG>g2l^$)rgH$QlsXy*p%ZPzM+hGASL$-QS%uqytsC-Ke_x3$R^ zC-<*%{%xGZwX|`W*1_9-VP>;eZhM{cGFi;8pz@6AkBfbrpy>@2Ev7ml&nfcJQkPPf zSem$VT{v5+^X8fH^rJR<(@JMP=iZZl>Ms)mgGC_N-)=FJetmztwki5}^sLu2WxxFG*dN#)kAJ)y^+oIKT&x%c4lnYU^f7zFZJ{-`8z zt_-?SAg`OU@8>n^swE#ZJuki1{ullGTm7Q_`?vYMHqSAV>$|!(Tio{B@t4~iw{P1P z=Gr|i>+kL3&)?U_<;U8+asTzPUyo07apZ^f%+EH|zu0{Em@V6Rd*gW7+uONsep}de zzU1(a+pnHS{#jzha&~j=bvawZ|N39WCGNkxwza#i?4|+l&XfhI^=FRf#GZ6pTe;aK zdiz_GWzSQ}!|vbPDOLa2V{6{sTS3p9MdxRJSzn(%W$~_EZtK@Xu3me)Tywd1`rZ2T zvY?~m1jJeXs3e3p%U8&+{bo1o?e1?c)>X@MNbb-7um0=ji~BFOPM;>Z^>d@1`TM`; z+rRFA|9-=n{ZIeOf=;iLwFyydU8$QNpu6wvKbH5&1>pH5DvC2hC= z$*+1i^QV`$xAC>dpMQQiA?yk|BUSPA)T#0Tkv|!y?%5paZ~Jk=t%^-Pw{7k2Ppq$B zcmHo)+ef?Q-p_@9TxVlourOr#qarBuV79^??@O`Y?G~8L(*c#obtXTQWPe;=UiELi z_Lg^VeJ3rMTWuHe{!Vf4&+AijOb*pb`%hErkzV`9k$KDW!+WcW9t!>4|GfL~bjx3U zxAdgfRr{n#D?niCLwr|!GMb2{(uiBah(C!T+PIhmQ=bm0TJ(5lrTU#2hJ_0@d8 z(Y4Qi;=?5#?u(y4Piuxn+}qo873ZH{9v)vE?5|tpH}#&@-*0`@Uk@37cFtQfb&0x| z&Low&_t*FT`gSVx-vY+7zal}$*R(XuXL;jPbakVC$j6(4i}`D;^{!r@RK3aQ>aNmb z9}ncrQdi%-d0tJ9{Y3p|F=yW?>y$ex4x$* zY|@f>w&$)j9sj=~RsUcAyy$=Sf~V#3YJoqNA*-q-t6xA&@hU+4M1($H2{ z*Ee>v_3MxA@2;N;U4L4Ce^z!jXg+7wEGgaEhxwCU9sau}vs`-X@6621UB9}#uiC0d z2QT{@IQ5=Z?){zad#mS3Z;A&c@I#iySC@zL=j~u+U?_Ay;4gG=>qF42#QOaIwLYi) z_SH7E@$7q1@xWy5^GDrvE4FMgQPyCWdjguS%DuTQSoM9*wIj2SpLqZM_2$FwAz^h6 zlddce=ii$3_3s3My0Y&w#S0I!)$IQGEU=Nig7tj<%7fqK>jSQ?Ts}|7bJdrymrKLL zUcY+pROfKM_x!G}udj37TXcTq{tX|ZzwbV7 zd3WbQF$M+|7N)u`&UGKZi_Pi|#!p*y?)~-F%D-3k-IYw-Ui{<3{@%j) zy02Tc?5vZb*VWZlWxf6uyK0qH*`J7+r>vg+nt%MtRt*LQ2X6&Xk+kj2&t|HaNvL0ZF%=oryQ;MSeVxS?b~qy1_lK_jvt;XLA-@q z3i4yme@rayH+q&EVZ8Nz#vYLn>nU~D*u8UQZ{^JgWgvWq;URVs~0%`|sxdtM9&CR$701%fD_ti+Jy@ zXI{^YYR%t%*_Qi?d6VXv>sPPd{8v=?yCbtH7s61nv9>$j!vPgVK*vy-NXTTFuSu`ThKV9=G&^^4bp*_k)Lxv-$4%Xb_o|P}ZRn5Nb>+G#rUu(adl+lKzqfbrzXjZ?SKAAUBi655cagh3Hgn5r^YzQ0&CdTapWl9A zCAZkina}^(-`@29@7AxAUd`vcu-@Na`2qjF7wwal@cysxSACxomYcga_3r;Wn|$jl z9t8I8{+c&+&*qz7xZP)@^I!NT$G~tzGWWyeE8pf;e|a(gpU&+$nUf8R&;M;)x9g9( zqUo73^VVN~>u#6sh|%knDxA9Q?Hy&$s)zad*A5=(o91%;Af#Y9IDYbNP#(kETvq0_q@c-@p1O zzs}^Tm8+JC+*xFA^I=6??OR{a4N7_z|81U@yj`RG-)_|<-P>Cq%6~n5=gaBWQ>K;u z+4XJu{vBb`|33PA20aWu|KjHJ?$XQp>nE$6F0%jqvVUs*$JS%6lTX()9J=${0W_8I z(cyr<(z62*FV_a0w4N=! z+h5Iy)2O>SL|;V)bF?_HB?{ar#_F|D@x>xHA@&mvD<+;{h-R#nY5xq0DBJ~6XD zU2C=M(4wQ)o>o22y3@Nq-5>hzZf8{}TrF3B}fdtm;2W7Zo(&Uwf4>JRNb z^BJ^$hMCcx^G56Mg10vh>&l=0^>$nOz6l#vZ{@F(*L}bqzrf_VA-C9Rv&FW87S|?# zRut-knop;B=k)UaIQV(S;o1l5@2+P*c-no{$?dn!vu9(!T??X*38rCZcIw(JMZ z*)_$LOmc{govV`VZ@lrFfw1nGcHuj-{dN={e9bG~@^+i-%GGBc$TcZ#{hzPL%lY%* zVckeS$jQW$J)D`7lMmM>-1EqNsQlNcK&f%N;@PGsC5PiupP*|3Di*TYbKbaGa{Di@ z#l+dUhjXp({4Ti75uPpouI*;T_q8j(tzLNO>k8pa&`H5I0v{$j>{zB%rnpn{aP5+} zF1Os059R5cZHNk5b9`a~KLdjhFQa{@iR+KtuBbl`GJAJUG{3V;`d7DO^7of6M^^6? z03Ail@x$}jyZNtOe%0`s=Lgs7NCov3+_t&6{F0ftlPv>-hYQOem8&!Aw=LsX!uxjX za@FtacM85>1b6O12MY5|5(Aw%%)pRgMZd+W)ViSYUw!!9Qn$2?OF+jStCqM%l%yn< zq*^5xr6!i7G8h>cn(G>v=o%S@7#Ug_nOhl|X&V?=85n3QK6t~xz<|(@o1c=IR*73f TR82$x=-5b4S3j3^P6