From 973618e80393b53f94c5e7e7903f0eba0786573d Mon Sep 17 00:00:00 2001 From: Hayden <49427552+m8rmclaren@users.noreply.github.com> Date: Fri, 17 May 2024 10:32:39 -0700 Subject: [PATCH] Azure Application Gateway Orchestrator extension v3.0.0 (#19) * chore(clientcertauth): Implement client certificate authentication --- ...pGwBin-custom-fields-store-type-dialog.png | Bin 37797 -> 0 bytes ...eAppGw-custom-fields-store-type-dialog.png | Bin 37797 -> 0 bytes ...chestrator_AzureAppGW.cs => AzureAppGW.cs} | 10 +- .../AzureAppGatewayOrchestrator.Tests.csproj | 2 +- .../AzureAppGatewayOrchestrator_Client.cs | 283 -------------- ...AppGatewayOrchestrator_JobClientBuilder.cs | 91 ----- ...ator_AzureAppGwBin.cs => AzureAppGwBin.cs} | 8 +- AzureAppGatewayOrchestrator.Tests/Client.cs | 179 +++++++++ ...chestrator_FakeClient.cs => FakeClient.cs} | 102 ++--- .../IntegrationTestingFact.cs | 28 +- .../JobClientBuilder.cs | 164 ++++++++ .../AppGatewayJobClientBuilder.cs | 114 +++++- .../AzureAppGatewayOrchestrator.csproj | 2 +- .../Client/GatewayClient.cs | 50 ++- .../Client/IAzureAppGatewayClient.cs | 75 ++-- CHANGELOG.md | 5 + README.md | 359 ++++++++++-------- docs/appgwbin.md | 229 +++++++++++ docs/azureappgw.md | 225 +++++++++++ docsource/appgwbin.md | 116 ++++++ docsource/azureappgw.md | 112 ++++++ .../AppGwBin-advanced-store-type-dialog.png | Bin 41724 -> 41691 bytes .../AppGwBin-basic-store-type-dialog.png | Bin 56439 -> 56400 bytes ...pGwBin-custom-fields-store-type-dialog.png | Bin 0 -> 40207 bytes .../AzureAppGw-advanced-store-type-dialog.png | Bin 41724 -> 41691 bytes .../AzureAppGw-basic-store-type-dialog.png | Bin 55961 -> 55925 bytes ...eAppGw-custom-fields-store-type-dialog.png | Bin 0 -> 40207 bytes docsource/overview.md | 7 + integration-manifest.json | 72 ++-- readme_source.md | 359 ++++++++++-------- 30 files changed, 1775 insertions(+), 817 deletions(-) delete mode 100644 .github/images/AppGwBin-custom-fields-store-type-dialog.png delete mode 100644 .github/images/AzureAppGw-custom-fields-store-type-dialog.png rename AzureAppGatewayOrchestrator.Tests/{AzureAppGatewayOrchestrator_AzureAppGW.cs => AzureAppGW.cs} (98%) delete mode 100644 AzureAppGatewayOrchestrator.Tests/AzureAppGatewayOrchestrator_Client.cs delete mode 100644 AzureAppGatewayOrchestrator.Tests/AzureAppGatewayOrchestrator_JobClientBuilder.cs rename AzureAppGatewayOrchestrator.Tests/{AzureAppGatewayOrchestrator_AzureAppGwBin.cs => AzureAppGwBin.cs} (97%) create mode 100644 AzureAppGatewayOrchestrator.Tests/Client.cs rename AzureAppGatewayOrchestrator.Tests/{AzureAppGatewayOrchestrator_FakeClient.cs => FakeClient.cs} (76%) create mode 100644 AzureAppGatewayOrchestrator.Tests/JobClientBuilder.cs create mode 100644 docs/appgwbin.md create mode 100644 docs/azureappgw.md create mode 100644 docsource/appgwbin.md create mode 100644 docsource/azureappgw.md rename {.github => docsource}/images/AppGwBin-advanced-store-type-dialog.png (78%) rename {.github => docsource}/images/AppGwBin-basic-store-type-dialog.png (58%) create mode 100644 docsource/images/AppGwBin-custom-fields-store-type-dialog.png rename {.github => docsource}/images/AzureAppGw-advanced-store-type-dialog.png (78%) rename {.github => docsource}/images/AzureAppGw-basic-store-type-dialog.png (58%) create mode 100644 docsource/images/AzureAppGw-custom-fields-store-type-dialog.png create mode 100644 docsource/overview.md diff --git a/.github/images/AppGwBin-custom-fields-store-type-dialog.png b/.github/images/AppGwBin-custom-fields-store-type-dialog.png deleted file mode 100644 index db09747b2308fe1807425c2de9b39eaa2f7eaf70..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 37797 zcmcF~bx@UWyY3>S8>G9WJEbI~1W5tu?nb)1OOy_g?vhlxrMr<35b16>&-#7)+vogo zX3y+B=gjD!i}k)w-Em#leLs=PZ)MO?h*2OA2)dlClqv)Qn+X2aA|ZfJVsS&&AP`E3 zoRqk_N9O*DyB6NuE#mPJesaSbgO^OQ*!d9==-&M}->tT#C8v8b$~YtG1|K}DCVmt1 zYQ{zq$ENr6{I*udK_y0|W`H%8#M`A*O=;<<wH0g^Ln6`m3mX)9wBzYPz98tbos~wm zeK9O(A>iqG!@^z#vF=mW*N2fnq6)#1Ah)o#hGh$f6A~gpg7;c0Dm3p{S$RG?tFb~x z0{uObXVi0i`Gm|&6n1uZM@2<NhCo{A$5a)y4GlphX^cOAGIu;jiTy4_{?7|fUr^x@ z=Sge8*}EhDYlKH1hRA<C@-mP1BlOXbKQSL=|M}%tZh2~C=r9qZ|D7-0B)yT76W7qt zDBG&7t4qwxTxMMQ?Jm#y&&2X|mRr3EmKq%p<NLdRerBHd?tVl+R8Ul8a<)C9%z&rW z<|F9i<MZ;{ibWfpYKd~Lx@shs9Nj0Bckba+EPaHf%v%ge>JkO&?(PCgcqVAIrP_D| z>aVn!g5@vfRt><s^IKI_RjYmP+!*jsrl+S3!Fy%jys=TQ6b<||XsXQgdA`lpJ6wlW zXc=dau=_y=^Q4NuO=de7_Wr>@?WF5tA_oV~A9bY)-AEb(gT4k#|IQbP`n{=E4;`D0 znVZQ3nnrhv%Cx#;T`enT>kDJZq!>jrcJJP7MYP^SEHDiELk;Y0L<yGCjNi&)^(pLy zliSa(IqOuFaetO$a$=?@i)$@kTkgjf)?azld^f!|JT_Nzl0^dv=-j+rE8v&O{gIC{ zi(!6z_zM*_Sj<1KR(m8NO*bH?ttDg=@hfi*3GxN!R_`nLF%rm_pGe2trmM-PgQSdi zF-n@`oio1<8%ypHmv)T)MhEA<xIQ~zrV2@@%&V%x6wSd5m4JbyOVt`hn|8z3lIM(t zx3&3&H>|8D4=fVX+4twuoQcCg))sqd@wSue%PJda17bBNE3Wf~jcq-jEXsX6b2MO) zA+J5R=IhsalE;=}i|gETix2LT<vy#%l4z>cSeOu2X1<yJ=EwA$NmtaHfZ1R*T!f^X za*(}>xk`0Y`U8`w!5uTC!$O%o!cHL}OC#c`Tp&jA=pp7D(bF)-)vFxcjGkbv!=inC zj-oQR^lRbNo@U8(6H!*wOx59>JSEJR7S%W!@4Vy1YdfTeL#EP#Q?|%Rs2?m|{F#7b z)~pQ4&CT7e3uFDLNSA<sfS}dvOy_mEzmRL^-gG0csvKCh^JJ+P8L!a$u!OljK2$oB z+*6sHqZU;qDi~VbeZqnB*JL7Hj!<9{?oxy$SED2`>3v8<_4oPq8-81ly%+aq(F7bH zGBt}DeV%V6n;i9VdpJz7z{eH8c@!YUV5xYGwUpL1J4kwa>ji-{D+J#0Q+x$ezVJ5a zOx?K+9NMBh@FQRL**7vahd0R;zr#7^Gmgov{Yv}-qu00tNizoJ^5EPKPn4-UUWlCv zoX2C0J+ZXHX<&UYk#*^oM=F*0_2AOAQ9s?i+dcg)Vsqz0_jY9ebXvKs;z{T1POkd2 zNV-J~l_=9QlE)L=FvP3gy)ydF>19Gl$2z1>0`B-CyK*laOJZPZu($Ua*sy7N{5@Pb zjPNN_*ah8oIlT`Ik?M>yvdwo$bE7Y;e92unk>O;Tx^-Es-SmL_6*w2qph>8~jaabS zD-}q;^F%*Czv19{d~ot4Az1_7iF9W`+J(_?@*B_L$IV!Y<7M@Xm+67o1a7OyfzhU6 zSWLc;fM9gz7H?Z3v-P{;(u7V~Q%IoS5{8joEY2x$FNKp>SpSak9|87z(km+XTOY-Z z((-q?P1Ue(TYDWpG=yXaAYz2WVH(Kzc<vvqISP!3{;U+!_YomS3k@>IRqP{V8nXGK z&R|5#6VR5cpK)1IU}v3`rvavo$sL77kQlVy>C0*42C*d@fteQh*-*_FXwgm%J#l*T zus>V&Q<bULu;eizb~Y`VWkjV+)?XZo=l+m3?%boE-&8ws%$14>RbW93!3hezKuy&_ zUTTu5D63GB(4Y$+pRQJXN-Ha=4Am{PbnyhyNGW9-XE5v~cOd-BR4I+*AuN{?w!nMC zJK^(#U#J-xWS#ZVm>d@cu<8Bp1x(pP503Ko4(kiHT5ihnc=O$splEoB3QnVq1iu z(!SE0o0a1Dv@Hqg7!H->aPw;C6LB_=p%P&v0QU1WB^({Ujhmd!*EU0;^c?+y!}k#j zGTxF_s%~vsfVZ(f;c@?s8FuEgv%m#DjmIh^CUZY{HQO!y6mu%7+V3WQoPS($z#A8f zA}vaf<n8**^G&SBJv(8A6bPiD{ACzxSse7U<G-g)vhp4gm;^r2C1;2mpBwuq_jmT@ zZ~cnt!$LP3U?7io?XMm8twJw`{6o@0IW_FE%j8-hUpN}kG)L(+HX?=6;r)-BL{mlm zIS}G6L&m2eF`OXetUJ%^W!^GkM9w{>;;)7B%dCac<*khm;oJxo%zryYqVC4wy>q*N z#S^A@-c>r{Vl>wc`$|tU;5ez#>GvLk;#`<#bhycHb&Bg}E#J~pf7;*`SALTGXb||Z z3q@-w!^+nkSQ8rA&NGNzR3vBEeRx5{{Q(=>qch1#VhJQ*fl88-dLHpnQkPe*@~cLu zfqz6_-*cI2^F7^p!S`!->|G!noQxf?cTM!l7oGjWX8KHAlR|DdQijOkmCl}A;f;Ym zORsHaU25ZGYCtRc)NW8?``|+OauzqI@|H+G6vag!Rl?YZ5925j9s-VFvzK4Sc$h~_ zYteE}jahTU-iQ9}BUUi3SPv}ZKK!DuiRgjDCy3uRYdFUel^?|M(HV8>_f>VcvR~lj zXib1QqhRA^qbd2n@IX8dl4NH_BVR!@@WlzcE>=H3ahbHfQJF5q@;l{wBs$H~&;#zw zYdun~`CdO*@_Sc}`zBGvSUg3<?0MGS)`auWC)Hf((-mD|1?DbPhnQEG1R3}aaq%zU zE*>sK-}?~)6B!@sMi31YIawQ}*}qXDd`lkHdAF1;vxek8VwgI6S;l*Cu#pN<RmGF= zswG6mmt}}wp}+i@c*5_L%`^XpuX4XhZms6b21>0@uAVX$3+>Dc@Qgt&l?tQlT2_r1 zWJi0Y;`a>fPS3hXqSnI#se-qaV_hU|I9!CC;>6Mr#+8F;&yvg4TK&6CPIGOshyw-J zx2A+9vfop}S#9F1KlXdcT<P^r_-fXiKNT7t?$Pj6tX=R`3VgkB?{L(F9Ed#~bZ$CL zEKOmEZ;D`hGZGOoKI5pvv7(#)7=+RjBKC?MlLQ{VSwczKo#;i6DK!<nT3K7T)$955 z)iES7PsAfXE>yN`*C)@9LwEu%=P&twT;K+@{GM1Hgsn;WSaZ{w*Cf2nw)$X-pLsX$ zX6X;G)V*uHP-J<9%EoLx8gy%!hx$842XPRjVXqM{!sbWuCJ2s9me2jP`E&QbN!&Y( znL#>g<FmU%79Oa$IJ@##kVnZ|105Q(=N7}{3;GV`dG3#23+#JquTkt}ORhP(J2va) zFZ+k&TuE;%pXgNdl_oGJX6V6wsWg-RCEM6v@3}yCZ6qV0F8`d*pCTxC^9Loznq-MG z6&n}PlkbxN#!+(&Ih*nP)wgNw#>Nz~?KV*~(ZEp-d?Ld>W=Y2z1=t4PYgBz5L6}Y# z#8;-)NWuN&52qK`NZBM20hIit*Zcg-kt0388`riEAh_H#cmx_eQEJ*ul7BkOnr@eT z6;co4Q+^Q#>)Z1wml4|c=C4Ql=LCdmA(6+Uioj67!ce>sMe56MhBGuX3Htk!c)2M( zENf4RijA6Rft?^XJ_i?skLVJ1j2_^N<NjI>EI#hA!z{5z_H;qt6v7PJ;-yWss5N}J z;HLCR(Gr`frme%y?>y(5*J&{hVgfQ6;d~HZ@~2@r3y_{W*L9YMO4fL8seHoM+^C!B zukoJ}9DdJ(1}ELrIaL*2xHT@pVl7xW*^;_JqsDo#73gs?qT=`gKd(VLa8HHt`ZO=; z+I-Km$!p2vk5-lR$*`9lgS66Fa8ezivCb4m*3%_NBaYGdyr_WtJwABF`tF?MSq>*a zM~LpuSS}|p`W`OunVA(T8mcAl-4}=8IB$AiHC@&q#*cMpHJ!Jdc`_2UleGtGX7zP; zXa(Fg)}0*8q9PF<MwwA4hKE<tcnGtB44f(GMfT)*$MN<NFFKT&o=5&0K<UC+>BLfM zRV6A*WHX26Nnd|B>x%eONK5#_qq&6UDnr;(g7qu;kVtpKLQ)l$zke<u^3`RoBI(V- zN{S>%iR+2c4D0IaB$cN2ZSoW{T#q_Ide19vLo)N+S@(NF$X|Iu{5BzSnjl|8Yb)qB z-(tG<)?RRPcxms!F{#V*mKL}^z=qHxyi{DtQ!jQDqDNP;I5Il?x=tuu7+;7<Z4e(G zkZbQ@G>8P;ePeaRwnC6p<RR;LLbJ+nwu`dqPM{+<g$@{Y*UvsYh#?hzS6dMsi=6^- zy`fVxDaf)$dxjW^X;f%2@YN0cp}tC}5yNOCbS5#J`7d^;?&pLE`6f``JUI~mxZnGT znOg!A7IV>4Y48|_Tn7shI3kIROZlQOK~<XwdEBT5fcPC<i|~^DUPkvU{=dyXfB9NY z>;)@oOFC?5=YW!%My0?KW4L1pLxSk?2iZf`KOr17w~@o{@s&b4E+nxzm)?&+N$AJ% zwyb*cAQtW;q_(v1J2NC8FcHFSfZp}!;$SmsW#vS7X)hd1m*l?YVA8Oba+F8K`uSnC zz4|6qHObkD>YNW&rrBg&2p8%)k|r<;tg)QVwV262C}O~NQ;#i&ek<2zj%$1rdG1h^ z6WN(}2i>A3;kVz%{JnRPJ&rN{gtozXZD@Popg7C(4lxaxMZ|hQAcO)x;iT#Pzn$M< z?!{{UB9DjZUN$nP3mF*33YPIUp7<*V2?%LY_#~U3@b0IR;67UvD%0_)PTu<ZX7SA< zQRF$No3_}njxcFT_aU`V>v3fK{fiK+NvDz6E_?fFHw#NmoD$X2#1A`E8*Fqmj`<{B z-itQ&67<`Bz)}$)5zW^SvtHK<+EeRis<<vNkU*N{dV4>}m!h%ofobKvy4sKO%k2+X zhiw?gL~F~ISi!lu5Q!wdZyz1Mq&X<%D({{bYiYcX_U0#lY;%xKz*ApSF|XM!;;2%X zl1O$F!#pJpHP>^g!IDUNA>`bW4f59FgD^NlO2a0Sa`L^WzD*}1Hhe3DeGXnpr$jt4 zUsvQR#pS52Gq=q@j|`@TzimF+7MiotW1%-%nb|}|aiz`H4BoX~Xzm+EP50=kYw$eg zs7QLjlKa4BoeVxc6TmrxNp?uZsL|8w%DVXiAz8ge7Ta$@vU-1Z!SLMLRCqu}MPCpg znSlD%v{~mia!m5JxMPxyn0y^U2DXp0tk=H$tab|Dw$1kkZjO+IWKaPJDY?ku>?5q5 zLd6D%bYjY9{qW$+MGmGUjd-3Xou?1maw{2!hc1Qi&x9}P)UV|d@!U7-3<2PQ^%XsJ zk*~ij`PPI}h~GEhqZ}ZUhEx3RlN1iX^yLLsKHBMzMR|)C0y^3n6;|j@A8LZiRpVsR zdegVe@%sQh*;oukOnoUv0l*62+r=y?ooz+W6j);xr-`*_%0kOa@n_u%?a1FP;fcT~ zar?^ayCLJ%|KwBJC|73Ssd%^d^k@=o#w=f!tNLMV>D@FFFO&S<2HsM7g8*xyw%(P; zU0y+WLdLt4KZ+pqyYxF))AP)^W*|0Xb_cTVq_f)C8bg}P?U3<7M9?Sa`?F;fynq_M zF5V?c`uLY?l&n3}0JD$MF<<Bw-M)oUze3gKqXM%|5<TK~!e}%@GrOSQ-<uQO&3sE` zaG$&3=fDT2&MeW+`+C2?6pj1<*(4Fh{&mruE7f~G;%$wQF~9MI#2V2aK6(#FZbav1 z*qL|E>hGp05A?}b(`(9lU73HD=4x<{f7%JbI{ol-bkv?Nu-xBvW%*ppX0}|sO22in z)h;VZ797<i3bsoPTjV{IdsT0$)@_-v({(Sk6A0+CH3_rf)iaIgdRDBTc&?o^B@BHg z^Sa2&7Nuazc7p`$B{HV+c)uzOcKYk&A5Q|&HxR+rfAHqXfJ7^xe?J)EB*l<P;+Pq* z*7<QVr#?e{D}m!&Cx5(J_&!zGfl|uc|J-ExvC3ePhq8E`ujmJ1go>JPhT`bO`Axc% zK0#O?>^aFYiLnm%^ehv$(_c1cE?TH#Su50*F4F5{eMWh1TC070t$TdUnp1W7@=2Es zk?pX7P<R$j#psG-t01tthFj*mm-d`&9Jeiy%`RJCwn9Tvr3}`f11@I_&Y<eB1qYZ- z{Z*fh^t@PH_j*U)Dyc4c>^OZ$LeXbkws6&w>HF1bhW$cmyE1jA5gq%*H#<Vvx`iDh zWmf6<<+D9uVjcMlFx5v!$jm}&cw3+I0GqRZ4j2FHbYxJr7?W8C7my5S2#%?76CvI{ zX*xc3>iJ{Uh9u^M_`*M`m)RjUu*7ULUs|P1;ylzF9KZ1&Ep{ZdbDm(j;a&+e;)R_O zpI*xNvC!@#r@|LoxrHtGUa;NtLqE4rWKVw@{hEUHz0c%<d(oteL7G)D?k{`9N0%rp zO5pa^6*(fe2J(Q=+)<w8LY6GYgzd5m0~^-d^>g;ygmdn|EAH2^Eul}!JTZ)PC)lM- zrrMk(GiaWeZxTQx5LqravbLYza4!`aYmaQ^M2J7>i99lK+Onl4^?FZrsLCawp*X&8 zqNDz4Fd;<^7A!PEA(oPhH^dhc^|wVzS4ksbAdPU#{qr0kj=c=e$RJ5(H;6k}Y7Fk* z<P~x(G@>q1XR7hJac*jEcC}o3`3oJ@WytZsSTCr?=+`d}`xgJCc(k+HH`P{K*iu=o z;URlOP`DCbMFUwoS8{UP+Y89HpG_z6D3OZ#9U`Ocnwm-k#Z-VwIUQc3S0JYmnGE=9 z1x<T<+C?obcB0iu2031N;kT`Lk=Hvv)Aup?G^^_|sY=wP^sCRJEIt=#8CQ)XlE=%h zJT6^eA*2f=q56k>f5dt&;s-mPGcCs{B8GPd{-R82P&_%kd(f^hhm@5CPjzMpfWy%- zK!lHTmYG*NIi}c%%H3=Q;l%8tysltQgkP|pk+DXKEHo9XtCoBoFZ*OYU>b|qF-<{J zAn~kT8~w8?I!2?tdVNtluHWM=im(qEr_&`wk)rd~-N>Q{-*`Z4%)ID2aR~34^&Ek( z-5oEu|3VzF*|qh}{E{MVrv4e!E5~g|;bGR$^hPRPf~4<_aIj(DH~zGh{aLq;wPL^L zG!~{|qzHElqv0=ucaaF|{2GdU64>G?DfDpPhz;gnl!FU>Vmt*K@^|%!Twt<w!qN{S zD>u;F9YZ}YkZMyoSQ<qvmDv`&G(nWw?1;qDOHD|KJnsHVN%wk-@9}EJOlv7UH>ICq zN*^j1Hh+S*a9`qUoX3?w+7(@0UDc|$ehv>S9$m%t!O5xf?x-EJS$B0E9%q~rs>w9@ z-%&w9rC2%t?e$Auq0ZWZdSryylULIV-q55gzIoT>{)M{`1PC>;KB^aWgkvKV@Gl5B znV3xlJQ*4$GW|fTfRg^=y2$ItGspbpk>2@Tzv^#%oq6TPP;H?3J)K?4#EFOQHKtpy z*sNmrV(+ib{w(ZkCkyz#v3<lPa(r32;TdaRorXt2g;XLaY`I5hF<kfFbTS+gynkrU zO8st02q3p)fhrXh8!nWPjU#7k)myQVdew9Fq83#ukwc`i<;wTEHQBm<%*lLf!K|p+ zGYU+r!stXqZSVbgbH}kc(|Js>NP-fIl4#@(4Qbn~<Z%gC^j-dz4)@>gxG)Y{;As*? z_eoilHB=+Zc8>V}E)A?Z8XD$f=0?I)>Ulu!$W@9N%KFMRgU9n4d9w|;NT2*Ru|)MR z#dJm7Da3JG4GkGynLES8`T0HzlYkj6k69NQFBrsU2htKZDpgF#t+tB|2Ie6u9Gpmn zRc5xg8J6&mJ!xEif+RHuPJKTco?5l&>Wc^Ed$)6X`r%6%Bm1<%z21<8M?#@i3II}B z-)fC*Itg9f@5$O)M148YPq#5SCd6!NTH^C0jXwQZWBusIqQ!{;5(EQ#g~W84R7g$} z++8+4A^#KwwF}L$hi**vMtI1)0{A=_Ac@p^M+UFvr7u6ep-k)?(QHiX{iyXp!>>$* zB)*?wT?FwXo7_$j#ryovgw@hCV`Mo)g@l5~3cBC;Kp%|($>h{dr~4OFFVA^OkX}@e zwv5OBh<f;L(H4KQ&J@InAA35|RJ?g@L!TR7ro|m7pq!%HbXngo^pqC))aFmhNkCzF zYrJ^%t>f&C^xEH>I|dK+*~05*2tF}63lzx>^z#oVR<u2)eCZaGK-~@b!4DJIEy5Ge zs>l+<;lE2rh<b6-+pe@Ru*v{pM#1|cDAx=@n~I^emwPas#5KR$Y|P`wc4s8=MLh4B z-+k2HTIBwcQPtmFjl6n&b(m7U+nR^;a7irD-dgycT$mj)#!e0cKp+_9c=0DPRG+;U zu`Vi%0i1f{*LN}=(>=qu2{qpumj_0l3pqk?qEKA?w$eBz2O9z>>Fd+5P1vQhEPfp+ zq`k-H<&WWYRpW4(Ske&?Uo&<QoLBd}?dd*fJ9D}{v2gVh0o=(3NgmG%mUfgCNIgD3 zp5E;*`QSshr8V(|=?wg^{`LHg^}2`q_Kia^tJ=;VlE0n)#i*HH(I*@gNWp#QfpXlw zZw|b*4SP%-Li`9SW>%ztVYokXqdo@f@v;`gv1w?v`5`C_#~u&4&mGUaFw%C7&D@BM ztb;RLPF}zSVuEmz!0v9^@Iv!V;aJ#ju4nSJsvNw*13gF*b;(6lK<rUgRfhp_QqsgX zRhuw)XzP{6yXf-ipq3J;;aH;`Qy9R{)jz$H)Sz>yJv`lDGA+daBCUb?rUrRGlLe5Z za8+ob<@qp6sGXlCxAIjg`wO+8$qjihNR2Fo245jyUN&x~b@Bz$>v>$iP34qz@*pWg zp(UZ5UQJpyiUYbjc~X&5C>TZd8-EHBUV%(cLnBBLCJhS|Un6U)80!+!=Vmilf6k1| z-|;gx$(Kk2U<-sX0A$lu{yL|@7W95rv=8PC`zXN(@Ro|29xCuhH5Z!m5A_rBDAqQg zWLtBhRU^-@W?z{I2<k}YDu0nKEZ!5F`|?~~rK~GY0r}^fGQ&+njGC+xdPbv|-0~)r z_a)DO4hUDgH}&^7OIT=q@rdtxfQe3P-z3~sHyv_{g~P$oz}S)vQ#Ekg@HiF~qz1HT z!b4F+c|M9RIRU8G0N^cAhGv4c)%&iv@}ndJSIEGR6XDF3%%_G@mMZbr@1LK;`)EbH zR&4mo-Iw6ZPe79VfRtN8C3<~y=J=szl1c3;T~U$-M#C;0mBs{SlKi(gn_9=XEQN?( zMTQ7sy)zxTnXGcE0Rl*M<T;2n6^xmgy-H@kpyjL;b{cMy+P~H-peQFhS6WipyWW~o zvuW_6+Nb-&Fgnp{v4d4Nt@FipbJpoBDYX72cp*p2%Zqi2_j8P~_hP{Gw^@qun19#W z;a)%o_TltPStP38CF1V164_iaGm4Vm&hpgK+e-X(MDa(-8}v>uX`nA*1r@*FjHZnE zMic3gYo|@eWNR_xm9rzGA%^BuJzr;%I<}k*jSKHW4ngFR^;XXLSIKbF{KA)7$idtc zyaOQW;V=J>YKm0<Rdw>M{F|YF7bsg)xUK(P(8NIrh0-GEOjcBI<e)z#K1j>aLVqGn z5YZ(<e^N<V{QFB;|DV6a%D~EebcprOJhJ6KNi}>a|5pB8k`g)%Pp1EOgP(l&3eMnn z2-B{Zy=TKi;j|p5L?h(*B6)$2hxetl6orkAjSRhJO1I?$GAAde$IVvC`kz1Z#tTtV zDEq6eBtyxp!GVF|1h3~gBO@atqNBTmo}sqbX1sg%E+RJewX-wVv^B4=h{*cZ*0UNd zG*CJ+bNZGdUmzhbkHW>x-AOp5ZEkNL*XDai{o(~8Jw1JOW21vpjwu&WrQUZ08yg!B zFR!4XnMbi))e<RVW9lYdHt@F29rv59%9CqX1BcZgo{nyAhqVIEE-p^TYvLnE!sM8T zhli;gMqN4EEi{03yiRG9s?@GW0oA^U_;?u~A7MWG<%o`sS3YMW{A8u>2aEN3>BHZ` zIK$}PBpZ&T^Ul}XXqIga4Gq<JT>xZR%N9}TLQ6|)xHns&*U<Xohp^B2gbX3KIT{9q zXw3Y)){oPl%!Fco!e75$nN7X;cQ3%#FRCSr@7PVy_#IYz9v|*hw6zxpRczGCW+EaZ z#T^|v=#{d|FI@hNQ~mz^do3?sRKn7d!P>?~r@XAN5aGq!%#K#?t8|5NJd|gnnS#N` z$H#6I8Kb9Q(NAi6dMkfhYHDgc9&dJp=;FdLDU89qo1C{$Ha0h%{!TM0<cN}Wc6Jt* zm+ybF6J|8<f8gbFSY2K*0tI^MMjl0<<4(j>K0D%omgKZFZVO|uG%|VExeA@RLK0QY z$hbIZaCG{fThI6BYv63=Dnmi}*FF5A=$*E96rdb5bac-e9e#y1Hu8fLk(ZaRcG-C= zB`w`GH%CxdSXePj_gS7QWyr|d8bw4zgriScT|H!AKvp4J_<fnJt1EB5Dx(xNc1%nR z@l1g-gR+JOg0HV{gcNnLI@70=l<tlWNMB#yNFNpsPLPt=1731+a_rx`wO~v`dwYz) zSCB7kgLZ^24?Bt=YJdF-ixLX!<>eKd%=}qi@rOii^&1@r68)<d1}3JinKDfw-eiZi z8w7lOe88^fs%SVku#Ak1Qia^@i|mWI3knM*s1rZ96NX@YojCBN_7o<+J>P{ZP(}Vy zS+G6C-Y)g4&9`&iacyTO{P@^W@uotjk(!bc0!%fP#|p=O^#?Kp2_3x`STN5P4lXXI z=c%cq0I7$E$J%DRn0;;iw%o#ZclMy5plZ)EbJ+sbOaUhe8&7L%CVItmc#QDifB;CQ zh&TSLmB)B8A$*y5@)@S51&f^Zi#Y>_i|de(5X1gBGLMs90wZJNAfxUuD^_+!#?HN} zb_@~{lKJ_0!}YFE26lEt2rV6*Ra{z967Jh<;gaXw4($&JVq#)oE@0P*7#SI}yoS@e z3A=$&VPRtj^4iRH^!Ll0{h96Rf-Tdm>iauWma9>AGAeYmHjqdIS|1E!))(t-pca;x zm<Us%9wp*^+0oevV_ZX6XED|{lELqEeQczVDS-XU=L{Vd4$kT3)NEkO87vT1R8+LO zzCJWQ9@FpPLKA#AJv(cBwA%V-sgWH4jSvDHTj1qO<ITQUkKKY4Lo>6`i98t^dV1-d zBV98yIt)^QfIojMfi-{)gN7MkQ`HR(edX`#5)u-|O<TFr&=4`nL(<ZSdW<>EN76&N zEk-Tlj3gvr^*z>~Mf4h{rluN#@e<?<$i&3S@|78&=XccpL~ha__bj}-GgHtd;q&KE z8kxAYSpL;lZ{K3v-`_iK_M!Lm^%(=3zg`cgfIiY2O<)2%OWRdiO3HApBe1xn#LD&V zV&}Lomc*{5t?l+N^N;(}ArBBqmel>G3Kdg1O~Phf&+gC0x_f%yxy^@Psi-6t-j}Eq zVPRoGz<E<ihEXyyB15V{Y}sFK#=W~dkbLzjVEdk5v#mrcaQn#*M?&^{evw6OC44}I zR!tDu%MTI0PY+kNTR%T5(BjktBVuy(5x!AWG!qvWXJKNBD#*{T=3n&)j+CM<RA+i` zYs&)HQEAXVih_!|u-fXqKw#k0NoZob(&D;bkfLuK!<n3uGX~sGr{x3V8+mzSY;0^6 z28IaGSF?v_;~gI>MQsF`Z~Wyq1RgqEZnhmx<xJnIudg3oS;<n&6i8fYb_stiEnN#D zC_=#JPoJvmZRVi=QM^e{C#J`Vgg(2pabgrxv)&!fohaMm_jqIBc6F%7=Y46*=X34Y zM`*(IIqKQ7XEk5GP~sC1^yA>*%%AU0EmXBX{sgm5lchDL@IA+7W?(RMa&m%>>-%sq z7sJ^Hx^)O44PfVzGc$+dD8xp=GR`h8?B+NpLv`6KzPlY5N8_^^hlYlZBr`KI8Zm2> z8-n0yjuIMFGGmQTMmDlNlF_fKrnV4@N-*COiMy~nRrFq0mvpJkSLp8W`_X)sko$a# z>z<aOA?4jkKgD}<b9y1~OBNDQ9|55cf3Uv$J-oa-9b!+*%cBu;*+wg?tTgw&+&7Ag zi`(xAgxd#QN-VUrA>b$)yszxtwthZuu$-W7u%2N8Jx+zsP3-Jg@3u1>w3L;xps$Ax z&nq@pWngi0bCd2{TwH7jdYsIG9hnrp%`yfN-WL4Zc6&IDg_Tv&#@~#K=ne!1=;%vz z7MRiT@fLSiM;2go+oc9O7JmK|R-J|zyZP$C-v0i&sUoF1;OEt#v+0HJEuqQcoNsr| z$B#G~YHHn(YLJrZA|jCRadEqKb#?z)w4a~o-G1FzYJEL#bY!H_^XJd^H+rMdAgCA^ z<{)P7gEK;dFtf4E+B$$K*>(m!i`{5)J4n}f|5?6QLQ;|l;&!~&$){%kncvCr9|fni z=p&LX>YM&rN{RylHD2I;HNdmY?d(P_4_APNr9Zs%yBA23r3FrB0{sSP_p1B!36IbJ z(TC4&kq1m~%KE0z*lzde1!y;;7NLoLtruyu@=>bg`*)j<M8LetD=NSdW)>>Ed-q(( z^ORP|{g4#u9uO^U?euN)6A*{FO4Li=IRNMjb`uQ338a!-ttD?;xBdA}NcGR3^1vi5 z#<Ia9s;W39F;@2U$jHd(4WBFJsO#$Lh#>eB6k~)Y`^W3u&?%OdGWBVl^@rEAkn|s} zeCNHG{bfmL!t(N^whON3GO)0;=x9{667}>k407QC=~&`k;7Jd+7toPIC35S3Fn=5X zuF_z)#MfZli=qL5fo=2b$APn*u{utZzUrhGO11a*K84B*sj4NWz*VwDypvhAsspyR zwrXl?xf;wzh~3sYU`E`FOG~4CFBdFqXG-6dS63$-EYyWp=zULqr><VTxTp<IL;Mm% z^y<k;RcL4c07K`SB{tY?ZO+*ji4fw4a`0s{3k#b|Dqh~tBiSMudQFbvF8Z`M$liAc zjnD^}nV2R&u`)3kgZ>{=okn}JnVA{jiA>DQ3;h)S!wn9<MgjC%5PLkqygc%M%AljA zt^WJhdW7>YO1#0<g;+^RNjmK**rxPT05VJfC;?A{6g5anM#ekDrvIb(LQlO!eYm$b z)NZLEma}iZI~)`2I0?xTL)<OxByfIDPft#eF%SYqG6mJt3~c5!AKd=#I*TA6BGxI1 z-bkI@*;KXmX_RZ_zHjh2F|KHll#rOez1Sl%iK)<UO%DwTv7DJvz3DgkKa8lir?1Z5 zGqcrf2w&>;Ybqut6r4zCxb7HE<K~4Ujfsr~wu%uF8fx@-e*^hTe)bk5x~GRD{~Ess zFMw1OvR*#FI$W_)_kYOSNWP5|VT|E~Vx`Ugco~3GjZI9b@K9hNh!~_0<+)}9TAa?M zC7n9`?!>ycZ{Gs&!3Iqokd8Pqq2pN{ht7e4;@(ZQs&xiEZf@?8c5W^%N}R~?cK;`7 zr=t9PN)Zt<H#fI*nUyywY`q0<Qk2!yg7^1r;SmvSdKcd1`2y4eydW_vYvr&LQ<seZ zWCo9;)~jlxZiM;8#f>Q?vDf<g`gye=Zwd+uVnz3+`%cfzK{aG>cD%k0;CaxJ2L3eZ zR?eOjiy`jUV9#GjNJvm7%61S=-Iwb$zCF`}2>`~IpPz3C7MgDN{{4F+5OfBHhNg&F zXp(?vor0*TsX20$J+u|nzX?-Ja`ONp>eq$_d;kYhU%E1}>9tJ%UCSDsK5nUc+FkkH zXztm4RMFh*S#~i);lP#>?Y`=XnB)H_2sp##(XV)rQ{WL0_`V+k9CET-lw<t#_|W8j zL=H9$K{V%A;a-{1FD<<)88|q&3cq4>nUEI%q>p8br0<RO^&x=7I^`w2s;u*qKc>FI zUkn)#)$?=sm0vGZDX|Qvi&X{&2gN--1%Z!7fII{c0YZ-NB@r}PDZU4jdCsgs$;pWg zkP{XXJQ6apmAXZ{-vhu-6Rb3<d0)SRPTClNjE$C?oCx{tNuh8KGT-d-!rIz;?dS*- z049KM&G+7eEDM?ng8}>n0NHrr>ubpP#)(xdfX)B~lM8!{Tc)+Qi-8cFkdYA`6a<S0 zh!+60F`R^igoYgfFijxc)yYjH_3WHYG&&fVT3FD$d`XNF3Q#0Sjv3PLNC*ij1q29p zMzgwsX*k|p+S#uDXr5?+4TPARn*$U)c|P;5L_I;4mV=vnuNFpCT3XuC(Xj(SuEgZz zu=Dc|`9(!EG&FDk*3A+Nbnl$yR#nCS{P~l93_HAA9Be4m=1oma4QI>WYc)AiRq8fR z7Wjtdd`i*xLf+loMM6dGPBHL{G#g5;*AfL&Q7d}e`-xF)ZFjfiMt5$njAm|gGYo?) z3ZN;Q%670ujy^{KTi-JNnr#Qwj7bd;&H==urlNuYaaX`?pODXXK7diJuw!@_4J1ye zjeWb!FDS5@74m=lhrWRjBOoNy4fqCiVzJ5t?u)llMn+T(_A4mOx^bDAq(2^S_Y@mm zx;6m3+XcE8&CJX|b{)T8Zuh59Ex`j^@c8sJ2;@=G$7>Vyckgn)e1U+|oGG>VJ&@?= z?%ogP&*6LfVMN!9l`Lo0!`r)iWrYlU<F%C)V`*tA&s3H|DhCW$y;i%Q2#A-T<muXO zwn@Ml!$JT!3<q=AUuwjZFTep|VsCO+dU<)d+HqY1U|59yc#3c->OckhZU8r`KkTa7 zF4R8z{P{B$O6b7PpAvu|ot~azk&|PTsH1$A4+W!AQB%X--rj<JA;f3XMFQQqpXHyC z$0GtO13o$O2<!+8SOXveG9VS2uZ2fO%BAerRaCHsp%Ddvuq_TE(CR8V2mmK1C%~Y! zS+yl{v3&0?dq=Z`uyJvN0ig#R*K*WAP7XPaR1gpr*z><LsGuXd+ht5-u7EWWz3T2Z zr{NpR-rgP!AnSB=bm`)T@!b6U{gVZ6PBx<1CFqlk098GRQu&WF2OuFBum&ih0Khp= zovBxb!Z!rG8RAbGe!Ev!e;RMI_e)6v$*Rm=j{2A94%zkXEtEr|;<I!_VAE8C=nUxq z5X8vB0@1|8<osZXz`*Z@4zN}{9UUD~AvZL@6FI;P7V0c&06CJr_}<jC20}mR+ZIAY zLtFd(8$L~8ws6<r<=1cD@BnA%0dpl$yk9O-qKF~pMe)8meD)9jl9Q7IyAMc<9nTCZ zAPC=&+EBsfHm-WTIrDteU&Kp_fvBRQ0=y|GH1t`B1Qp0!NZ#JwO-)UdqN3zbHloE6 zmYq!wAVscRDsX4V)8BGFfJcl^O?Cg7$iv3M8qeJ<K$Vn~WYMaI82Fq#Yp`8_1)>OW zz3ZEs&Y79#Ln-Xxt*s)`F@%A7-`zT=r|~c_Fy<TVG716f4PbA-#{oX=BT5lXz}^S! z)6mE$kX*#;OG^uJc6K(Dg@S<30f5tRIxi}4{Zw8Xe0{$gvlt@oLN)SDvBw9?C|TOB zk92PgO-<oJMukQg0N6leh}FhKM@Q!b1`ifwIA3kV!OPqGMLgIMXbBM4owodZcye-b z&_N4m7(#r1aC^IdhVd@iKPCa5(3m3;_TT_1$jHhnGRN<>WWo7OG7I#;mmJzx_IuVV z4$3O$QYyDHZV#tZfYGzH-5m-6a@#RJjs>W6`rt-j%j^^gKoTtYG*nc%GyiEB%x}HC z=v~|n7gn5jRJF8_OiVWEcNWWX5RXoJ$`}DO06`6Oh2)NMf(W%PM@|A920;F<i3ydR zp8SH%Dg29g$Be(;8p_HLIJjW?q(cxo@CXRH2M0^^mJZN>M}SNQ948zE16x~Lo_?hY z4XAyCL|I*18}#|}bD&0*mzRG5K@ngoQ!}$%up7XvLt<mmLCPdF85kLPt*uQA9NZAt zX&)ho2F}jTYk&SAF*7qOE^KTV1178W{yk{vhFT$@QsBj~Ib$*)`+!hlXlGa9YENXs zz{nV=%jWP6tvI7!g*x$-fdK_LM6l<|WiucGN{WlafcA7`R8&+z>KQ)EgGJbox4Q_C zs%vOa^YT6iD*@PI?d)dl#H0G#w`tmsL_|a!e0*Vbb!R!-tgK9*Q3?tQz|htW!?7g% zfR6?Y4=bGSFVyU50Ef++Gm*5eCypl<3DRP*|KJB^22%fDp(WLu!at{1Nmvr;9~0AJ zYipy5_#=IYg?E8mJLv@C8^Aan0N<@29mN9z*YaJGIwYa}+bwPF65=e-du7zs)z_v= z)Sw6epvBddb<k1Hou{Mk4aDWFULZe!(_0}!05uDjV!Hp<wGwHIB>NNJpUH<9f#0Tl z8n0S};DJc11S3x^*C>$WmJjsO1F3&B+%Lg$rqa?H7QH9x0J%O59htcAS{*L0P$js1 zwF$zKcqD##tI-xmmzcIdws@T*ZuQ>NJ^VQ36W!RKLo8V#Gxev7DsP~?;(xHgu`;)w z%#9U0Xc8u$W&&4DPEvTH#44a;nHJvL7+mF>A%ul-@QfcFa)8MMV$dZ%+}*iqkp3o` zqBviH3d)bemQfV{XwCn_Ycv0)#QlG}fb%Qy^X8^QXHQRlo$)`CHkBR}WWc~YEVlXq zv9|x?z$pr2OiU<Q3D^ywI)A7+MX?H>-EkBkdqWM=vAUX@_wJuxB(MR6ZZ7v?WJIA@ z=|ALgvj3huPL{o~Ge*zN4F}8(V38Fv`IO?yN`#c5*H!wXtjT5NpCl?Yg2(*%+Hin* z0XQp>TiomXK^IIbp-_axy$=DL;riALf$m}56cXUs5@lxAHqSvG01XAZK@r&)AU9Pc z=Waq5!gH`NnD3|gYx0yuh3RuevP#*^nEF@v=>r#?pW{x@y&(2(sAc@;G$tAUT^jh` zC4~Jn60I}ZOfh%-r3T+HbP~R=IsX15JKk-Jk*EY?-Qyh)kQruY`BJ&BJmC>AU?EZl ztwAFhPjI-nxR8Lz5+dn%;^3XaG5GlYy=32Aw5vlpYA{jZRSE-k5d0k+45VJ`Nmu;9 zCuKtfZvw&4(fw*X27zs0tUqs=)Wg%0=H)F4<W;V6z|dAe|0d}6FzSg=S*bN(RhgdM zxDR#V;NXBjjy;3{-R)c%A@hQTfmj}Ri|}i@3%nGhV*1PF<9lb-hI)~%6F#=H={G3? z2>^{auP7m)`=X$LPWaBls#ler!;vz!1$61)gRru>+WK9Q4Hx;f_SJP<ix(XV94w;5 z@tw$5*27=zh>`h7lHnNMOsDYj)I#D~^NcZM{4f@ynfB+;yl=MJ*PD0DA&|)_)f(45 z{7-lUCL8&KkbnS~!0Y2~e;A0od{mA5n7!@8k@=5CXT`ZgsTVG;t`2V6xiEonK;wk1 z*N*+#CDGH{XZULERfLp3tunZqLnz|K0-@wQVGEJKhThSkt7%LDIgj4FKsB<wTtUj< zdsMDuxK$xi=`VLZp2oO}EHVfs7Z)sG-Qlw8DU?jsHuX@$pX9@l!|r0wMugy{e4=E( z!v4|f3xQz7y=A3Oj3?isq^2fiZ#|dKXsCDHGxw>t5MyCsSyF$T$RoYKGobhi3L-Lo zkI%xw!tAt<<i7SVkbO!_j04c=$IZ5mtZY;8<m7gdjMMHx6sD+dG#uikc&;*!w!M*2 zr28+O*iWBKY3Ww{KN^WW2dcTPt=;<eVIbgBhZsd_CpSLlhX*L!+%6!&xVZ}eyIkz( z&cmF2v=M>+1tKRL35m|g5fxRmj&37JBNG#vIkLLIg_at9!_w-ug%fX=qP3}o{wT~d zDr6F(0ak=YAqu-Q_7v9aVqn?uBP&Y;tmc?QsBCZxfQX0Nn@#aa-}BwgoBS@njnlI; z<#+E2ZdR6;NiQ!k6qBDvS0tX_<t?-m*US@pHpla{7ZnvrC>_Pi5CFXi-~*eQxXbc9 z)slqN;s@Ejl@&N3!ncGdfr4P*^|b)${UOQkt*x%nQSz#LI~Z74SZoq+bOYad+yXi} zt=nyCpX)Jypax*KXQ6jT;<kVJ7sN;vv|$5x`bcK(cKhPjH}}E^lZyD7R}3WL0fIH! zpGUraTx(SF;$MmZOMOM3M8$Q=)fbxsfusspaRKm&-lrA42O6OqwNuM#>$m(7`uZfa z-fLU=h4giq56zNQwQuXj#FW&#jZ9A~>@^|5-&V{{WV;HG#?8LeNY)rzzApw=l145p z+qJDoQe!BNgz<3AjnC#omcef)r8?;gpxWj|0v$k#-M8o@Mm9F#@+EjzNr#)i_C)&v z9ooWEQuz5CZu19Q9`0{>m!7eJmSex0EyBmg+0z%z-Ukw_iDX!wH#q7{bZyth-?!_G zBjNe&b!A??GECY7<PKWUc>7i)Atz<d(i6yq_RBGI=V|wKIFVA-HT8CC3m{>prlpCk zN3_ToiNg$&>}M1dd>-|sUaEWRs|mdenzflSZUUG>Q=vh=ftWuU2_I>0f4uR?-BZXw z54^A_MRKyMFKH+>b~39DFuywnwq(Oa7jDPnHU8pH@>F<Mn9iAa!UcnNr8CyHOD)f; zLP04!lrAbNDtrI!--wR`7y>TaJV0nS^SHQ}_1XTj7Q$`umS3Kl$VB$7Ux1xXBjxXl zUd6WP=Hg<c@9qZy@$nP@8|8T1uP9b%<b9!}C@En~$KLaQ4hlDEL_|QOKR&tGJ9LDm z9cBANn&GswAF~#I5BE;L2cFVd479W&FjozbH8uG`!wRm&SQrdsy8OW587ivKGZ2gb zodaU&E3*PTh~wq36+8wh&_(*)4i$I4(AH*6s;VXA<iwXu71~^I*VWg*9<cG3baLW^ ztc6pwb=TyDgW`^%iAnSv0qcZ3$7WT(QD+%DOmW7B#eS+&>gAo~p;+DYG{BbmHhxt( z8;Fp~{$6Xv6K>0KL&C=6rn@nTTxCk(d)R;$Mn8ZOIXniGE363rUbX5!;EBbv<0747 z<MEWwxGv(n5lP<wx9Jwge*Q!mWW?mKy+#_b7#zejG+Q|T^B0xCPZG3{R&PJ}!$N?D z;P|+_pz-|&FD=l4#>60ujDxPO1E!FG^K%}L^OF$CDM|DeG`hrt>7^O;a6jS6KQ3x& z-1k1`nt(9Ty{YjSoHXAf<l;f<kIV5f=5!-quWCC!{k!zL)~H*W=f+cnL}y7l-sq0c za@SXT7a1POe%nc^HTkl&*{p($9YQGTlRpaDrjaH_u8}+E>(5*iGWg&?>F4$9*AYK_ zkl(C&puSq+aRAK*5LYD%^mBCOi@PI;^85FoZZ>wi3H%4}B)T5sn%Ny1>6poM5~wk# zsHB{1Px=c#SG!mKSB-r#N<0{WMvR?cD1|k&xmggD5;+`JQ3<(B86X`qGw2{AQc?ML z?@_(saGErwrCshj-SQ953#REYwt-mI(m7vMvI8I+aZ~kUvEXi6CG-4TVS9hMO)ir? zOop1$@YRd(b5l_Hzy;CH-JMXcl=Y4!Q5F=OW?o~9kS*4Z{evoa@-@nM{a;YzTm*53 z{gf}69pcWPMESFeOx*gqJQql{Nbo^yS+9Xs@Ukz4e6`Y*o2!nhtg<lqpGJm+h7IRt zz>DmiiNd=lz{OLZ+g3(ax>Th)3;PWLP}r=HtA6_X+gb4ZLMKNv0d#BL;AgcneU_go zyo#Ir2ZE$u4%bU9E-q4m5lV9sr6vdFn+6w7C@gGk;emzAht{Hg{p;t`Dz<%UjZ8)W zoIIcNz2Zn+id1?=hDlFEVg-RuABbhub#(xBX21LwR_Z&y_8ME=wEY*h;q(!W|Mz9> z?-(MZe2pA3iTTz4i3dBDyMA=Lf-9XYNg7>?+RI*@_Ft8ma_4%4O8>dooo$Bca`sYJ zCY+lk*J<yJ!Zn4&-9E3q%D_Eb9C$9)X^N!p|KtkzKUg-Qy$J|T0LLd3!Rn!gOz)Q4 z1cJ#vZZMUVLQ#D-$_G{~)uOt}Xa9N4{7+Uud`V@cv;ydscNdMvR8vzExcCF(;(|J| z<J?S&jO-5dQ%KYD<<3T83XP$i2^?m;C|T6^Tu|)<ILc`JOQ&`Y0X{wyRe+3RWOi}h zR{8Nm`}Or+aWR8~b6QCW(d`xHpN$BlU2?nD7vEkRZ|E(zW<Y>K3xFPwhRwbk{~VC* zZ|#waArXTC^2|u`cmF4HkV%0_B1QGSdHwHR09@RI#vxFFl9CGPp4W;9ghS-j=}&5s z;r(zotC(L{V0^jXtjMMW0K~UxK$kvsYcYhhw!$G`lEZ?Qi9@^97EibaH#d-UY~0E6 z0i%d7DM_RfzBkSr^VB5|izf`6$m<X4UWeirP;Yen@L_+PfD@!fAK!<Uf{`&2uU|jA z_7R1JMX(fQXJL`@xPCpqu%Lz`r;SJ9PbMgcnV~zIC!-`!J;<F`aTPK<V9IrW<S*7W zKTjCL>EV6XAXEt29(sE8y9ZSAR5UcAKxqjGpU95R&XY_<8fDnze%LXbKxcSs^Il$_ ztE-#c`1%-|)qYQIIgdChGFBY0N@Cwp!tPzQ7udMo=&&L%J+rfbH}@VqSsaaSrZ>$# z1^UAVR?|_w=`z-R^-ASikTL-lwW^8~qsBCoeSLJ}q(*Cn-uY#bUj0Eug}M%lrp}dh z{oy<BXWA7S&z6<N;R%#yv1pNzmu?=!)2jB7zpw5*c%7(nxr_>P4-1}|ZVwL^M9V6D z58UN8=gW8{_BVXwDX_mo{P^S~RHLkS)mO}<1A+-^opr66JN{sc6_JR!@nHhFp!Bsf z7*W9ekOc>4g9<CvaGF8P!y7YLnE?=G80ETd0=(bQmIXe(2K1MoPfwkH@9ap@;_zNe zUo-R(Mn!LpTYiJKwM@Mq?GDHI3hGP=viljCMYXj!KuY4^;tGn5waYuf!^aQcL=Y0< zguG&7hiZUV-W5Qq059tVFK=jYvy005Pyr;@(7UIWs<|Ks(~wY9gPAgD_s0gPv;yC^ z8DE%clOX43CBwCT2SfpWeggdM?drc1!FR&U%(xH^n^{r;K|vVHoJak#32N|>wQD!0 zJvlj?k-2pkD#0kftXtAYHVDMW*LqZ9wm}mR6d=2`ZWb3PEwQOEBxLzw=H?oq7lMKm zf`66}YE|xPDj^@TkDp?T^WSL-0l#}qQbA{=F;Ss{w`qm9ndRjyviml1!9cc3q7UU4 zU}K7k&Q&h~RRy3xO;cur${WCloj|Pzyazp5M_U^uQmU)>rhUWT#!d%RMUYy(E`rpV zULOV{ULQHU;PAOd0y6OWoIyMguBgT>e^&c0Y2e}ELm>OM2UyQ}5j8}-){^4ILX;V# zR8+7_OUodThdazyroYb-gmm=v*?<BO1q2yL0O%c{rp^wQV(BD!dPIAC%)=%Xj?3`B zyR2yP-obdh*{*%*%Gn2je17+NzS%_R@x=N=mb8k{!(zSq{(~pxPv)P^O%|_5q~pnF z0US~y74ZTb<$P`9<eW5ytDcyskqZJ5?e@Xuv*Ln$Y0`?L;ByH2p@jjdJ~WDLcG;QR zl^WcvlFGGoGsxt%;WOs<L-mdnaXxc~fglLO#i08k`1w6TEDfmQ8w=x*0pS=JXo}1d zYH;x_%_t)&97~Pt>G7bYr-wk=?(9WOYdMdP3Fj^SkG8ktfEH=k9YzQ$ROs2+ycR4# ze-4g`$?({#aBtF5Rjb-KUJr%@fMQ!mw+UsTl7Du_=;q1V=3X>tSTHqR4k;@mfxH4O z*{lZ$%epI+9GsoAtYVZ8<}U-%xy!j02xBmiY^x6`{Lf)Pd<u#*N`gQJ2j#A}Qd&I@ z>iG?AY>M2M+MF*?K*_o}zeNLB^5fkSves2~U;f~_D~^honE!IC3kg6pNJvN_8ai?4 zB*w%CF3^{ai5Z}OF;AWAjb`+?JGgSZpRXbm_CNxKl5g6qZnnRohTD^TXxgx;ixhW8 zfB2oAgabKC0to+1Ow5KI+#T1*xgNK>>!9taM@j6UCzfOm2GS?pmnypHdA_%^cs+Us z|F!DrLS0i6?z&y73?C?&{h+C%yj0LdGnzBZAf7x>x~$Vht&p0foW7(b%_%9PsJa>p z1|~2fCNu8w0dcJ_c5k_{Lk0*8ol=HD)zyRG7f^B5z;6Nd4Ks67a|;#YE-Zlos1i(0 zO&(8==c0d90Yd#w+b9xhMhvwl_T|A{^Mq@x*p0!ti)-)s?idXZ4_fH!(CdRnT-WWI z+P{HTQ|4dXk3>N`7uQc7VuhSX;pLTOr^hbAfvwljrD109cLLoM)I7REka3MHEh9in z7T<i_?~~cdHp}a)wqkWgY<xZ<?6J3j&7p#E6i?4RJ)6H(CG^Kt_J;ueVEe1#IY7;z zOaod^D1mktZqo1f`d8cNpC@-!E}v^zQ0Q+QeAK6Kb2IipuOQOq@;JsqBNZs_6z=}v z3;8n2`9g3PmeAz*#FzN}`?P`PoZz*Zv9+5Wi(I7~(d&cu7k^22K1`%H_+I>dE_^XP zj*v67^_roI0mR#2Vv!_4%Y+w@HPC>tY!Q1QNJrP3Fxb}-U;!!lMsP2E<8n6F_s#!F z^!L_|I6Vm{obCQu`OXhcKkP?4t||mbp}{%rV&=oC$dRogej;A*pmHMMeTfG48w-aE zW~xXm9@<YRC@5ETaM_ecTbsQ&^$;8D#L3N#sLVZntCF0o0Sf05p0A%FpdEKGqZ$C+ zTy*(7SF#n0fh1TwSlDLt74fOlfwpz<ZE$doxTPiG&!Hi(&qzvRouD&n+>(cIdlMB1 z71PsYkN^-j0|R-5C>Q(t3E&Vs*8a{g$I@50?6gAI*&RUd6KF>|KU_fsO)0M1kr5sk zaEKUP2|%TUbam&1hWEd^zHeO)r^9sG`e`;0y+tTSh1b@mWCHT1hq*2ihzL%1ZW>7^ ziTz1zcg6!vCm><<s!6tT*lCZXC6dflK_k9U3pwuN^`<*VABS(Bf`=D|w6ZeCj~}gx zAJ&DvF8-o7wkHi>(@1}DFxWA_^VW;(HMaMuE!r_WEZ@pwsVHAt9D8oXZ~yAz%0zF} zKmhU0n>XMR5i}o4y&egzc?D7YU+sN)IM!Xe_N_@Hi6moGG>DXtu@EYv$vj0RGnvZV zAeqx-N-9b+CE_+mrUs;v%u|th$~=ANs^@w3e!u-3``zE(@3H^-I_fyY&wa1o`mMFD z>pHLVJa4V_Idhzf2J@O9*0|L>`p90I9=D@j9Xx90u%7a&q2W>0nPu~wYsP-0P*bG& zM$~yvzt}+WJh9EoAa^LLxcIzouJhv8*CzMzt|)x4|9<G$cvyqXykvQ~sQuG*xO62; z3k~M##7T|T*4Jx*V?7E#8T}}SJv}`gcz_76s=Iop<=CbN?`oZ?9x}B1$}{qD$k{{% zEo1fbeY;#YC-ic(BAxLMHNizPyXg>Y&^%>jJwGx$=_)2BE~}+o_h9Y{?Ra}zG1K+F zBDIjXht=n3KD!#9cN(AvoW4m<EC^5Cc5Y_xPrI&~AB}E7?md2ZQbIxot!1rpgCoh4 z%q8tZYDbS=q7E2?*vK8MbYr#0@PKWggEciSAaZ^@e^lbcweXY&l)?6(2)3e|C^_@o zA|o1;z72hB$kVJBSjk!2X--=na`&#Rj((~tp4$CIL7a@smoHa4spl0WtzB&>otg8r zz@&V1ysx};+_d36)d%hVLQw8dCmUb6T+lv5J^ZnwqhqJ&Zf`USPO?vN(xRunw1@Lc zKwxdM6y4f+j>B%K&>T7zhWFcr2W7SlOuE=bEnBoeskblFbTp{-rQGXh@$o{~e@w;2 zWz;*Dnmtsnf~`{G<zF*-EsBq3bFlc^%F5Sw-i1`9#v&zg$ma+P3u~=4i6ueoQ|yse zAdW3;Lkw$nJ=`w^F31I&d1){vk9XRYum~7rEy5N7($7k132}1?zIV*d>>hIMiBB5` z>pfIk-iOINJh3e^_0p)+RDjlo)f;x5U(%Krbihb<!T99tJ$5GMwQYDSLp({OT^q)- zS0&bosH^X3*DDF4_sVr^q$|*_R5ZNNuNvjXFp<CTDe%ih9`s7FZeEi8-CT?)zz19A z+}`_!H@2)vP&%#EIevF)TJfw!h^Be|gr1lO-4Q95LQfOVQ_^`9&v%$zpk3CvqjVP} zIR&0<GPY)vdk~(zLa({~6_}$t?VoByJA{RY7ru$(6EMiTDzx7ilvZt%DFc&A(wYto zJfiz?`l;gdy^haEk~u<_e`b&7lIGtZCG8fmW5s6+`uQpvaz>KyC?!Ob?KFQ?Lw{1y z?@Sbv{od?l#drj7-^x2Xv$nO*`+XhA^V+xJ)$Og7)nP$G*BY~(xHq=*I{$oLQuO@b z^Oq^#E6M=!#xyIxj;zl(dhFO`w`q5UGbcAAZhkZjLxxc9K0U(Ou~2TI9J|cec1(r6 z`#0oH#a~-Y)XJY_R+{C%1TW~v2}L_e$t8uKi<m?|eR|c&hPE&b>ZO__y(^FJoQ&w< zYg9cvZS>J=WXqN^??+UY{FxW@*Opvk`POxCdih0*m-fnoW1QEXb#Fr=_R#wzJsMlB z9p(17w=k{h?^ql@Fp!v-SRndsBN7H-)>T$b%B6`q>jMJm6F9sRj>UERx4SSQ>;?r1 zF85n*`+fM#%Hf}c$Vm}?nwps%*H>ipt>ZfZS~D~0K@zx_<nC7Ic=RYY4nm=_)Yiwn z+Kjx)@?lR_Mu^VSIt?`JM`?53j>~X5eMi~5N;#WBs<_Eac(<Kr_;$|#ORf~n1+=t^ zn>O7m!YI&46SE(roY;0U+IUY7_<O3Gc#8;66Fktu7H(B;LD6v!Ggr|_pM==42=()a z){G~r8S;DLq$C*`w%)3aj2ABo(-U>5*~ydFAZS|swtVAGW*CRf+kA3!yI*p{Sz-&^ z%67NQ+I%bHE=rhQ-o4A=ijxlN^w+r_9=h3gmq(q-bC$AjKoxPi>1|7YLVs;4-x50Z zs~f%Pxw{H4GOev%dD`(@@ovE#Kx=14QU^zx8oyG9bgbAWf;fS1MsO}aoW&VbYCb4x zVQO$9zFIS*e>-K5lf;p5_6n)cu(7qnVpXG|Eo~p^Po27D+glTj=%`BB(|5Y9=wQH? zT3rvp)k}AtE<3JtD9;lo%z~$xZKFTVRBHp?L9*1ax$DfkCQEy%oSbXiLfkaf39QIt zGb<OK+5a``J8gp2$g=n4?}O*Z&vccb40=6hFm~$uTMt_ynmv5Sf9|Ez&2wFbjS(QN zo^%(huea9Dw&j)JgtWlj=>{yiTYNG)o$Jf?jkpCKue?vS@8ZD`cD+X5W#Oy&QS;-m z3P$6q*@Lg?BdDRJOBVOo-&EMb)TU-6Ip;Dg+Mg;UE-m`=V8OfhIptGheT~ES0<OzA zFzW~0JK7^~Q_$d}L>^#Dae6K0rOGWWEguYHe>GM0uj=PIzedUg7Kl=|Eyu~~>K`?g zcO+Ewr<JaH?t|9gu$Q0T;YeDy=1e!X4(5&q6C_O3izB=imX<i{AE<5lknP0PUytzQ z4PegT!boBU+orUa{Y|+mjE$q0(C-)AzFp3$f1%Q*G2Qk`r0NX~x}Z<6Ew}_lWjtsI zpABch5Lv!_m>jEUdj0O{dZEa7ihGC#zNqyR$RJO>q694o*`QQYR{rivuKdUD;o90- zv~yQ+zOMS3r#XG@CbFUDDJcgW$D}S?SZVP*`D31JmaKW*Wh8dmtN}~n;xs_iyyQNs zn^`n~!Gf=F^+cVY%Oi!uvu<EHTQyh60%bg9#IsK;Yzd01La^<Q@`pr^H@|*_QdKF} zc`bm3AI%>7ZuQ)Zj12Jg9bVGTc<0b&6b`b67XH$1Q;#%{uEe&ovm04b`V@3h65K^Z zL;yO-VxKzcQtZv^k=%n$AuhE%7WamG0N3i8CcgsSx<~TGkq~Lc=&F{tciy4xcP)9~ z6REiPuQKbddB^hWa8uL#@Sqo`T+e${guX~vts>)}J+tXiUjlY;Yj5w&*PO+CqJs3} zBj>qC*qVml2b5*Gtvh43XLB$|;+)+}ZS>t4!@@Fbrao^)`l+TI&fau{;U=G+&aJYk z@cMOJeIMAedv4xH`rKrB$zH14PCGXDrV=Y-ZGrQ6|0?r{FS%T!M?rOL`OM|<D$Ybz za<@PX2hYYB2mJ2h1)!nyG<?%K588_A=T7^`T>;lB<kt+x9N%_l)%`8|%I0~@fM6j{ zRI1FWezH6GG5z5#<xSkG;^ODl9J^AtfO}6}^p3&FYkx|KX8%<4{QOIA#P(-H)%wqi za{s#MONWz*%(*tNfyPS?L7a`^(gfbSQF=1smQt{nmP=6;_p^AFhgD|T;wyjsgzpG` zqUhZ}$$2b5-S76hnw^EP<?#Lu3MMvW&p#-4kW4Y=QCYM=e8n%})5rbyzy6`cvS<Gj zZ)^IqHR^0W60m3LSyEDoPm#Rt;ltj?9)FDU_sZOhDrGhMYLG16y8HqRv$SLRg89}k z2D{DE@bIZ#_R91+a_087&4I;yE%HV@C2vl1uyd0J>{8Q%xU%NsM<It}Ece*i?FEdt zuHiZDzcSmsR`s_8OG)%YSIxCM+t%{GFCP^!u{xVH@_k^8C*)lLOV8&sYd$urNkAI) zk%iUp>-Er37HW3(Yk&&SjcC3&z3j7@LrBTDwzkVM^E0UxgfU$TLQeJ;p5d6DXO2)5 zc+%3>&8^nOlyLanEOWkj^X6&}jsQ@p3AN_Un>Sko1g_}{41A=b3}ACrKY6lxaqx}# z#d@`LV8mSky_(K|4$mO{A!-fKvC#JQS%!=PJS1<G2$6?Cd?=nMwhDf+)s}*9zh%o7 zAQrW$v{hAA*ZuvAbgXk1TU%Qv2~aM8=}+i(Ppi%NwO%X&DHVUgYj5iq8W|xhyJb#J zPPvs62)?I2#vDZNghj|`k^B6t6NTu72x%->=_(N!K%zq-8iyM<R_B1)zLcI`QC*!G zTo$x_miWjoFfcH<C*ed#QBza%1bxa*$YZK2R+j@T5)5j!kNnc*%L~y{ZRzV<1tQce z68<5#@kS>bTiZ(@5&5p&j&%58%~Wtjb)6%H0%c9-+!qjduAy1~NgAxWcHa5|P`7M< z{y6&n-d;v<(E4W9!W`yN_WSqs2``V#*(wa|ikF_hymmX2bI9@AlBe+>+2mb`KFN<B zT`mvX?M-7iH#bL!(}dVARHEtVD8jhhs~2oCBsc!WB_+EA1qH#}2JuaK3)72<i3{Kg zmX!Ffe+?esTky4U0Fod0`>#v~$xg(f`@~pF!NR-u?^h5~HXVm}5sR@hKXWR?059&{ zySK!4w72$Fq_kUBg$b6*?ve3v6MrEQlM41RknVSvuw;Y%FX7P56rYfA8hqMbh_;MC z&z_x|9w09R&bA{YBuhMrTq7YS=IZq9hlg^?@zpQDj7))j>rT9c^XRr|h)Xn)wvd-w z_zF}Z>MqE=3?Wj;%*;#yQ54MYuj9=gmBobRjjW>t$>)0nwy)cha|)ZBdv@f`i^Pni zrE`E`7=&Vu(9@A?O;7bCYk?<xWvuFi1Og1dm{@3EV|Iw?%eth7ML_7~%~b+VY~S5O zcUUF2;)n8SDYSth{!>6;I9qYg2a+M?q@<*>va(l0?WNpz4k1@3nmS~7+<W(~A0KF@ zr4X_-6jXrgG{Gb{GBTo2usUTSmjLCB@by-*3NQ7T8KMP0?m8;`c08?y;SfOsIz`1& z1!Ln;D=QrO9dq-akE^!6rk5##VgkxI-=onA+`D%(VzZHAp9t#^LBa3@84Nz7y}kbH z^e@ox1Ye()5*B6x=?`qT1JGtr0F*Q}tS?8l{QC9lh4|0+xBk#kVdoRB<dY+j%Tde{ zrXQGM6i-~%9v6GR5cH?P=J~mGR#sMDQ%zJO=G9}`$#gbm!}V!u8^lc9tC!*oSjET3 zM{%fEJl^*TWIW6kIFopDy_~g#S>k=Oj2AMdw(lVZC7`ypc6a-twkMP}L}E~_8dNbS z(cfPe7TyR8^MR-VG-^8NQ`(+DHDmK#F_7J786$5ROAvHYM<T^fb`r(L>(&9q&ACG* zY!kEN&D?8z2njVoH}j^;>l(yookHY(P`ni^%sI=G)uaZrr|ol{`1X<i!5h=C5oY z>i+!rSR9oF_}fsE%Rm)Jeh`gY{iTNwxs{cb?Vn}u>GK3FYkdE~(^BAX%gM_xvTDp) zT*3lb3>f6Afcb_gUjs7?(n}+d-*FDeg80lTWmncYk^+AH`$&m(;N=h{6-7C07j!&} ziIh;ZLM=oh0TgO2XsFtPWajo^i9@3kNTrJTbIEX0Y#<j?+O&pWKZk`7twGQg1a<IL zZS8sxkV1Ex&^=KOTL4iTC@)<vRd5Kmw6|ZmFXh4`EPVU0uESc00kK$(W+sM0Wjv%I z0~Ip+{8ZeBw@Y8Uo(^2~)$7)IW2;m4sIG=t(W-9iBn}W9_a&--3PB|7>e%9wz=y^2 z<;xcqar-TV9op690|gAxN&*do^zHy;Ie26rKn~TV+B|%d1ucg+NSVe%ZN&{*1(nj% zEAeE($wc3y(3{Ks`lCmWnA^egE&``=u)(gf01Xp}+Fn08;J141+Qk$l6%}xra$9<O z{O-WDG194thQco6&W_WP&<%lW61w?0Vb<LAH*D59m!PBqi545|c~uN$->u{rP{@nG zOeb8zb?ep<u^o~r=i+_h8s_!;PoLg|0km{?FUJ8LBt5nCnZo^nI$a5n)eAr~2C?|# z5j_(`wW-!KXPeGqiCCR%oj7iSoGD2oj6QEd^wGK;%J##DbKl;P<S(va6E!OSxS501 zU`GiHbOGQttk}3QddVk{kwI+K=zNhZedzGvqbE-;Mt+t1)>N34Y3*8+k9h?z@C^cs zF#ECH-p<dD-k4WK2x|}2Q3^;$qaAvl<>at0_j;t_0AtEJ#|PDB(DQ=#*l01U@^T?G zF;4Xe-;c7>zbR>D49E(EIL(>U?|5H+^x28-Ncn9i->T<!J$ZRSQvX(nCA12?eSP&O z^3}FjoZJhRRlkDQ)P$@1t!3efiI(wqHQv2?^`QJsR7#4_<{Lp_U(y#sF?wm=2P5)U zhc-Y4;Ig}o&B1+5S8M;ZXuftKft?iD6)Pg&-hOsM?EVc3y;BBVVBjyVTiVr1(cYO& zyTmq7kjJEq4>CkHds&{cqN8^bT|~Rc-o~C}FWmC$BJazyf=hc(`I_x6Efc};-@nb6 zB@yxKs~-V>HeSJ!`0bM2bpOYukMjElnl_V{=vr!-m-0kOzk$=%{(4@nvt!Q$X{pL` zYFHlOQBlzuUvj&`@Z34dCEIuOlDxm(bjs9@FcIrGZPO%>*Y$LTv9#_^i<kSAP+e^M zBcnT)R+mI~g$&}G&(9*>-zxT)_CLDsvj3KG>cr+tWFy<becJBW!Exx$q1avM9Szzz z$=U3qtX#Qe;P*hyaI5!~l;y`}X|LatT*lnNEPm(cv)f|KQJ#!GJ}i8<9Bi)s8ehz2 zT&aKfaOvlRr)<vKe8}{FtaSZ`(5~L8Gctc<w~hN^4cOG5op`=ev?lvrW>{uLNPfK^ zET@bUj)xpna+3RXP#K@|Jhc&lrlr51NM3;s8ojx>8R1Qj^%jsT<XPj4I2w@EIhiU? zUB7;v2pf?6KJrd7qlKK{0wS2VAcz-A^=fOhR3Y$s6dj#{NQExIMuat>FgM<P*JITH z8y5oJqx$-RP>}5d+X(tLyoWRZvuyE2csUDN;`0S=#=m<xEiC|`KoFohN22ojiAux= z1Qg0E2tKjvS0ER|2?I$7g+fFikiJ16(3Y6dbQ$^&jdhfq`MGH#Ab{fKF2B|Sq-8$x zm%;tE9Rbg%74qY&+1W19Ca!4S;wbnKuOayUz7!kC>c3){aoG)SWNL#WBXSA~ODHYS zr{U`>=$Bo%Acor156LJYn?uCUB4)Dzq6&(a>?I_JHt!lT?MxyUjdIOT&?4Bb1Zf&$ zgRTh&G&Eu9Z@voZWffV*uHSw3!Sm<O_2#5w><}O+uaMKWwzVz5eIaLrr^aVfE-sH5 z+gp8xI3vZJe{La(1T@l)bG~pYs?s~#VfjUyZ(c0gDePpFM}hC!<+<;+9^!m~|2)(P z`%<KF^k@NO0<S4MJv=<pk@((?h=44RUqT{cnU}2Nw=xEj(?L!Z780_~*gplqgqLZ# z7DW6wa*T~j{7(^0n!nK4V5=PY0p@||S|dO<b{TA;IjpK`60Hzm<W0u`;VUn*Uu~h+ z3N6s2uTViFeB(aV#pgKEp>p@ejaM_Xv$e>>q1Ed}Y9N~JGA{7R?4?C(p;s@NB@F{8 z;xPa~MbDw_NH_h&D{|&76N-UiP&?{#T}0t8iF*(TY-usXNW!2;MQ%uA2xVulZpd2U zKe+%eYxIc<j$cYDGE&Cl{whw%P^7XVtS+zwaOsS63YC3m2sUMFI@?9b|K$`fj4gs? z?OHGBu84jbQYAPQ&`^5oUaq)w=@Rme0+bFr;Sezc=_>WY5YN>3KoI7`=A8kY_@U=x z3$Vo2BtirT@|LKos`BfkucV-Y2ykk4TL&r06$nyZym&#OK-DkI%&++>z|zj%UVa{y z;4>4p{Mu<tJ!VJO6&4m!C{Sv?22X-;x3C>IK=On>w*sC!@_T&7fdtV`L*mA%tEVSq z@pUKB`+S8w>dM!VkrCUrqGkLBdF&($ly()vZ+x2b;Qx3Ec>+|Yei{aDYjHzR!CVgv zyavU*XI5WyoTDM!3gCSIP>pB|1e%uP7z>v>c$yJ6HU!Bpx(9wX4i3c_6prGh0SX{{ z9_!~55J;*TMvyCe|6U%Z7GDx|ybt&>+kOI*i8_qQDME|R-q#fHDn40&2($*vMVnvM z)v<!Pi4Go#?$2S`){y1k7vTY~feFZiZ``_dCHB7a^8DE`wrliUfyiq7S%ip8AAKFz ziMJK`KrKr<)>rQh^9CMhgD^$JV?qcePSTO%$3KbB3knEWt&TkwhfesSsOB!!8$5l= z&5mT`2$_-HR+hgCW+@zrl@Ov5O8{)7OG4K^e?9>gq8vZ791;;^<Y3v7bPIZ*56K4k z3YF|=s*n`UuCv1HSX>dtK|?wIL>Y=h8XSJt$f>{+YzU%WVxTBg6i9<ffeO*TC!7u_ zdqiK5vKNBDiEp=5LG_XZ|J6oR31!782-w8jri9Vy1qu^DY6r}eJWjHloE)3kDF=%N zYOsXPdW;k~`f?oGR5S^RPz=S2==C?qBT@Unf<z8FU=&q0(95eQZ|rhSv;>EY8$W0- z`40Xv7xIw(v*j<rk6nl=+c{x1Xoq&U<-ahpvMz@xW+jI>6Bx&XKYz+2HGZNR1r?TW zv|<p?mMu$hkpB1-OD~{H{cu{3NTa^L3n3|Sze4~?X;Fi*v$F&3yGk!Jvl@+<#K0QJ zdIWO@7htQ<qr#t=Xb-|ihA3Pig+f&oLsL_e(!qnojzA48M@UW!>+9L@W?(g~Tm&LF zILvEsS7?IoM4&@C<BOWsE@UIhQ@h)D?i64h;V>g5)7&Ho^Q<-4q0b%rw28X{;DP7Q zKlJs<$GDuclmN^if8qoawhIcop(;hL{nce7dJ*PiZirCmu7F-$T#quc8JQeXphKyV zxQ*SToBy=?>(Ol^U`Z(ayu8lvjA@)k=1uR%6VB}l37T0ka_#ZOEOJ&>0zgVnfzx5A zt*_77+uMtU_Vw8mYOmkvV!ZmD<YX{>fqX)*6F+hhaTBxU3~-=x1a&ivEYh~QL)Hc{ zRA|QFhY8SVKt#t<`jNZxqZH1;b1$`tibh9ARLA3ZAL#IDIwWWOsHSs1CZXO5*{8(( zOK+qsTTX5pJ;HNm+nM+#`%l`4%XBI^;lZWtBvDlvUEx(Iawoa+g-@R;>Ey5*??};X z=swfsY$GZn@?_DlP)(iVhSf`{yBo?)pK+)y03g;F!O;A4<dzbWK6a_~LAIA@R(D_U zNj>qnaOmoy3)F0fKhnUM&8~T;I{AVNXlTTOL$Bw02mP24uvlSdhikYe1|k%GrF2R) z-9I;d1f!?@^e+EfZ^T`yey2;39~x_aeI@@lnBSN@Uoh_i=Wzj&-6<)a0|Iwo_}ajc zeu1g6?%KrmjpR2k>b~6TBfMviX^@yWKH7q2QOORO!O-6cXl(hx7_E)ga$R)7+B=eB zO^mKqen_J8`kfe#6b1SSGc0}Z?=ZuUj1j-xkZuIZ{b_>qZ=hu4Tz@a9N%xeLi(aPL zW5OffYKBI<e%-hV_r7!IgPaiZ!ZGm<&TB662r<--b8R?3yh$@u=f??!xMOXat_zNA z;x)Rb{H1{5m*vupyY{#eY3Ff1uYxxP`#X2t<>8hsDSO@%GW!PrYQHej-BL5|SV3Wf z?!ftuvmN3FbMEX!xJjiBWpoLP2K;(Ui3c>-M&YLeg5RDAR|F%?muBc`0iAzMLXx7Q zB32MqRSOIgk!IGK67WJvNhu;k^}2vreL=Jg*?f>)MRea$+JpnfUE%<iK+N`|NF7g} zyrUo0(*tSXYwT2;p|%51UKxR218x{QBq<Sa&ev-cc*iHd?&Wm0di()ol=xH|6!FiE zihTtF{qgLaP<C%88c-Ynr17fnG3$VhOhW+xuo#dWQZO7l5AbKd7Mv_`Ru4|PqM2=k z6BUk1Uctdfp?T?APIQl8jv;s<K+yFyTVFaBcY=g7rA?RRc?zJI&fEoETd0^V4?Hp& z8XFn7xSCJ468Fe`x8=LHLhef>h!s&XL1}5i6B84!K(>P94ZcYW)RT05uqRQp=T*I{ zBnSPz4W2;nQExg9G?j0DSgx`$W_!+5cRb!u0S7b*dLFYq1{6;c=S@vbl@1*$#6gvU zBnhWB1L}Lgk3?<`q`?cFRpa4rZ-}mWT{5bn8)FKHvfT#KNwbY#zAzJ(8b2|8L7$Hj zRayEsP*i5YgdiRzfiE?ZbT7rm@-gqwzKZyQ=OH2ya3g7_QPEP#*`J?Sq@0DJd7!5H zk^t#4kV_QmAjGePP)(eKPefMqtJZV54$|Pz0(u$<lb;#jXnHxM%&OCgm1&F3Mvj6o zT7=jpbpD%C{|F2kc#x1FGbM6e<Rm1w2R6GNa^Ri9!dDfd_k;hV!HeAB&36KbU0JfK z5ZE2mp8kM=Fx$d=$tZE7{qu+^!~|y$Z@Q48tfG=>3Mn)Y=Os}FpB{gn(~(F-h`hyv z;e6Ek1G6Lg>ewiEUp%?ncki~51qtL}!>u>OX9+*#2Fwv5VtM(>m4#N#d8_^o&H<vJ z89N8y(+JiPTR;hg?atiHh$_W1AV4Mc69ww9M-}vq7INa+SjF46Z6oS*tXadN>kJf6 z)HJT6)fyOO34mcJZ<i2+2X_K5E)u%P^*3)`=8$mQuw~0rzZ!CCxqyko5al|&3|as% zb3L%qp_+*xl6fr8hiY3$8U*0p7&bdBd(Uqo>-uja?}L80-7JLN7#NRNf`b__($#Ei zD@;r}&&Ja1F_8-h2*`|r<<pZ?(N&XN8&@wiw6Iu7OG|qjpj%Mp6s&o`U?tvSph7+b zVmQ$$Grx>NROcu&P8l071ge~%nX&*WqFyE|hAvJK+&v=FQ=j1!zq~X`d_`EZP3~LQ z!Qy;|+?K@<mvo;@`gUq-UK5pJ`(1&q4-?(|sWFSR6Pb-ts0G4^X_xk?b>8Hp>?|P` z2}oVBokg^qfQ|vu1r?H2GUP?3=~a6^&^$<dwEnhu0nkdc`Qq$M0U#)if4IxOwP#GP z?E7#97o+JZtH5KAj}2@(7I!SYTSe6JRIRc<mSTWAXncm&*3CwZcomh3ng(IntXog& zXw*gwZE+l{@@~vKitxnQZzblui?e;f!VPK9Kg21=9r9{lwhV=SPs@+r5$f=S>+1?t zo+}F%*x>Ybq35ca)cg7u7_g64QSsMx_ElX6V=i5yK_iFM{bP@QAsb2(53^JMz&QSD z8U6KfVSPTpGZvNTaV#K_tc)?PT=Wam8^8LEfpk?F8kJTYT))2G{tWRdF76=dX02Sc zYQs)udj~jlk-NAj!WVpYRDZfg?_8R;u4-k`(x``e9Ls;dT&E8QqbbkoebLp9e_kKM zC-R5KABXpUL}A2d8*4#gA@SPWv`g*T3Gq8AJ4L;{v)L{$TwrLp@1h`iVI_^8pPPo! zvwATgv+vutgU@$ne2DWu_P8izVi5^~VqpnaHvax(v>jczQd?X6$&uw(Ze6)jafbhZ z>{b8ZQ#FFqTYrzEYl--5-ScCQ(GSaP`i@q*L*C5nCXj9v(Vf=tKB|aRI>XN=O(s*9 zu0&IVkn3Y29@1P>AsS^I?KimPviPq-b4H>FPw-Oohw!{fdWRI8VhG2kuemNxsSc2= zyecj}FmUGZrZo-u9{IJQ@XCTjTga(j7pI1ZPSQ(M4mOA@ys?T33b5?p78F#CokEM1 z6l4A4W7nM!+Ymt4QZ@jEr{|PBcigS<0Jb;wE7>Q=?nsZy>}6Jgi0cU)AiT<<p71Yn zJfC*eUa)+0$IDMv4b)3;t`qS%Xl|wzG^TRZ9-_er8?-f8*w{91-@XF9vA&xuz&<X6 zkjf3e4Ll7rtz|)>8AO%2@M-43xXp+k9IVHkoyDOM7=$_6%bxRQdoltMu5hcOl9H0( z3&{L9(G1*S5WScTjSCb{=t>Hjo4F{@VU`o~<Vm{utR6Rfx6s@A`r^zAU^@7)Ie##L zv8m2xa3juu^LPq~<QoRY;R##VW5D%*mNTe^dsL=Ql;I=879Wd3(Pq~xsNmXQqg9AV zSL&8``pp^~S#~n8NTYb7%Tv8qVx(||V9U(p2nh{JN=uvE#`UgxdoTRQ0B>W$%;f;! zp{S^c_>>Vq8u>k*P6~$W3YW!I9gqnX!l4S;1CXykG`Fn6QEw6Bw_v43C?yaTC{Ops zQ{gQI7@go%h(c<6cAtKb5(<Dc1+Eba`F$ltMK%tCz<{v0D4xWO0aNv@!!ID97-Cim zB}724ExjDfebgUcPfH?d$ZBe`NYDN}j%G#R;ZXC81Bu_hohFz+;`)XD%ubuJUM<*R z)M(AY@CvmA!@6~`$7lX%WWo~29~I<1X*X74QUD}Q$gV>fh!Qg@9o_YRwl}AEYhoqh z0_y((ID=mztA!jq>&X4Xg2P)oQ2}OVC=&n~Ah<oZsNDs43KkJ<K(8of*JP0?;l2wh zE9v1jPypMmEDN_~riakxM7cUxXP!)4FVJ-Dtc;@l;A*gh!X{!tSc&pHrazwr>k5>@ z`y#U$_FD$AGU{8H96IvdrbUR6%kLJdA<A)wyL$Ot@qH1V;l`gy{(#{jaG?MW-42Av zYUTP}SIvW<vtMPTa^y(IR0pZYQL}l>P4am@2{Ij>ev3Ibgi9sK#PEnwX8Dfx)W~hS zLwqhUr4+Nkh1l_c@d&^|9MGyW3=0+jCX~e^MGc4DPzXNjb9_@ky@cid#g6q!`KDXv zN&=(&g&@@Ezp#t~c&iX~^{94dM|yTt6xZBnvd4bB1uRQ|nsl_`qwUUI$={!GJM3b_ z%P((aDt_plt?o2<Zsa99aNhT(w*~(5<K&Y)L$F`M=+;x<mhcJ=oF%jP<OyJtE)#>? z*w~zme#O0b#Ham*nAff?Cg@obfx8@Gb@7j#Pk2i0eyCOkBauSvSxr2~k>O#p)vsaQ z6N+xv_%zxfU$K>b{lnJ?nJ-@4Bv{xEOzrp1&Qx?OgzyURnkn2dkCmqU_*e?m*RT<b zuigc_G2+`oJgp$*Bi<7kbVezm-@knmW;<?d_HGtIJ^@DyzqIuI#$1;WVpj)8vioQv z!|ZLkRA#Q=&LjYcujoEz_7RJ$onEp9kdMB$jGsdC5~|667VWvX5f5~1ZQGaFIXZT9 zNCBK6En(1&d%wN8_5R&EzdLvDo*#0DmnIn<z@D8cn(yJ8pzUw)Z~f@RAUN9t@Uy@^ zC%s^xYv~R>c#_8ST+*jyAKo}~`m}KNY?dF6bkb{H;yF1zor<TBibRPw1Nh^L%-P3| zTu&RvNyi%Sh)%l2`Uv#PfJV|wPk5r)l7jU1IsWbB;^G>E>5^mZ)S8dC>t-jQTp>fl ztC7b6`a(qCJA{F0kNJUlp~uJGxKH<q0<5fsB7ti9(lRDJxh}(+3y+!192z{N@tq2% zsic0z=}8#3+zk(Zi!3Q~inXVdGe8jTgDUqW!^rajCc4D4G3VkfETR1QS!-hW_oUj4 z;H^Cg#}mn2!|RN6w&8gfrncoYY%R^lLceGlboKVW-?eKOwY`@(6`t6(HUj=28GWQP z<~a4!lpw5dN-4CAt{c`!);|MKl}r$b6)7Me5zH6+9aGWlF&|0#_Yl6Mvv}B*Rsw^$ zk&A|@E(d{$W#%TL^?Mo`9M}03Ta0#BH%w)t*$&Lhwq7CbM7mK>wVt`%rV^HS@3UTm z>$F>(vGzLJ#5`~Y0}YvFry&IZF=-o6JRx6&0Swv6&!6uEa`jR(Dm8WYFXu^l9@5@J zHxUg|;t2!ykejz|vH6>Td>(JN)tOYJ&kbonUcVH)QSnQdDC#gY$4h9rTq(#55hylF zO5U3u>p;gFFAkw^>m3dKOL%!4RkTo^iHV6B0x#E0F<K1br$5~CL^C-@jm;|H4s)6K zF(GRODTG9ANL>Qay5oHZ2~j&D3Hi8G^n``rz(^cnsxAhx?_B_S57e?(U<^>LVUTFI z<be=6%fwOz?K6J<xq+c$aHaDGKa+SGp(s2j9M0Sx<m*d1{%9vtol&tAbdJF6?39It zKY9p=XcUTLUmZ~7SLy+(earuzWAOH^nLQh54eZd8uj;l%*#NIOxUMm<vihR;{L2}Q z9Qee8h|ts!oh2+AmsW*fDtM3FTZ*aR*QKroHa3BfsLekP{~<!=#Zh|Q*SFAzkuUrn za{Js1C{q|%Se8Pffx#i;xBX;3J&6;i5Tzz8ZHTjKW>>(d@hHsY81ZtTu@%9@(`KLv zJ_%^jkof&RLX;kh01^G!aRG>`NLLB=c*N`mPmz@7@bnT&bT?SPX3YZhX@3qh6Q%&{ z<cQ3Oa7`l1*>;^?it0H4r4zER^Ro(;lR%Qs_W<kELqx$_1W7E!i#C()7K%s<p}CI0 zC`^7SX8x$Iu0NZo6-g^d2>z+x`6OL}0-GN{oq3b{7nf92R5YZ+sm%1eN0$Kl+=_|n z#^^&6I2D8+{6z#^4Wq|^%IUFsYunN8lddq-ba>mnOQGuD=n9q5A!_E>Tj+{~WhdAm z2_zLZ5E8SUf>D*pBZ6wTJ_x^DsI939cmkTAH)Iv6C+m}Y(#>{Eto>?koCTNL$V#n^ zR|?G;(-qrkUTr=Va0kX4U;{dQiQbCFw;~LtP?>TgpqtkSuuEQeUb~69IY_!J@9~5K z12Z$B9w4_dglZQQlcVv*J=?HGi1V~95Ep7zRvV&0Vp4p%9IYpUTlY^V-WZ8pLPCTH z>{&AXq9imTLR8#7?k<#Sk%Es$tJBw^i+wgEx@W~+v-)W5#1iZUAsn=%Ly%$BXtvYZ zQg-Sbn|m6kUZClYi}t!d;1PvZc8XP_II=@#Xo&RTqC^T_s$C}?*;e54{9wWvql&Up za(-q69!+e-R2oYxG(0@rG?LA))fT7*Vt?-?92YQ!x<p_PoI9l6h4Zy7LMHCA1+Bos zN|||GzBj05+e-`@vYqIWkXWa=|6SG2dat;vDw-A`@3l9#_}Vc}iYK}d7R`B)htHX1 z{$^9aryEvh`_POaZ~NfE2FgA#We`XgP$qDk6PsR8EL!o)<Wxg0-`d$ptEyUgHbccy zxwW;mK`a;>9eVFoAeJ~rUM$7VpP%WJ0WZiCvqv~+=yPdmYQDl2idBtTV!RT`r5Jco zp5fNh|A4_$sa$u0gD-(9atd~Q4bA7!)nVCV#xyq)HBWjVVPRoqm6ZVEDkju^!SUV9 z5_27G))mpCZ0pw(59Cs$dY~Z*;Z~N6tYcz=0E>;{iM_BvMuv+rSYzO^KfYQdJ0UO) zZkoskTYyCw`oqm~Er=2@Iuy5l-6086Q_XD09VoZeu#sS(n{NE`YFaWDS`wGE>%>kd zplCfj=6R=IXp@$UXZX-J3CG@7Xs1T#Dj<h%Yipx2(xSucE&K2lVkx$xZfq1_0#d7` zswRCn2?iCY5ki2S;GRyQp`mF=t2;B^^@$b?Bh3se4n*EygwB8!)uW+Lg5Xw6IwUx! z8*&%z7#bXeMFKtY&a31A2R}u;xcTGI2oB_8xH6~Mwk!0%w^mHBJC4}zWM_>sFGL6Y zKW<UcjK+{y!9zSf07D80z6k)a-vri%#H9~mniLZ_Y<S>TjVjUI-JRlzhA#0j$6JT) zwL2TRXyoYMQeUbr%Af=whf+2Tl4wHzLQm3k=Kz3D0=E37>6|L|UAuJU%0(1NoCuZ! zBQX~EpyQqKQQg)EX3_8|LE_IMd`>NrrbuP-=O@(^<gsAfL}s@ZBKt=NPd{>!G>$MZ z2>#cOjg6603ufgjDZ1@x85yO=Ri#dLYTZK8Lr_h)&tE@yi+4|Wnq^(uG6ePl?B<@C zNYc|s-vd-NV%YhkCYg({FTvfhI|F~J>kSRMU+e4J5kyszOzeh4;S{+j^=x?|HUSOg zk46qSSJuML*ER?U&{^jUE%6NJUI7DMY$dV~*k&c1?tb{72Kd<c$A^dT-0=kLhyt4M zvm!H2+2O;O=&*!gw^@jK1X9p*oqIOK%#xWIsgS_TkOF|1ehyB~oSokFfVcJbp~p6M zcCV?n?SwkCC)1x;L>@RmjNtH0hygNkA!b2+f1DhsgLz&8O(ic6H$&izminT=GIItC zSNv$sm&wV^B|f+3KXK}fp|^S!$lJaRt6R`OgN|H^G8<@`HHCbawE0kz^*Ai%1Aa*o z51^8d>}K|jlvW~=6=F+buO2}0Ep8DRktHXCiW&9|`v3vriM+QALdwnqowLe2i*@$K zD${WwLZZzjUaq63R}K$CHIo)=JLuoT)Z;B}^Dyb^M~_y0ODpNdF1LQ6YzJ&XhaY-z zEy4==gbUebb&(R|!rb;aRe=yuR)YfvyebynjquCgiVk1H{6Iq{xB>9%{gDGZV#50r zDhWOG*a(n-ztES~h0h#L;;qrvtHc)TaZRcev3QRSPA);Bh-<O4>Z!KI5k{M1HcC2= z9EOSCEw^*W;i?aV=&FksSp%L_*b<8fexS7l!`h!r@VV-0Hhn26XH3qXeF3juLO{U4 zVQ!2jq?Nu~km-)9bHXZP5h_TV`PlZDorrHUNtkRmF|Kooj5t<bgJ0P7QoEcbey_+& zhfK@dln&Wr%X@zAKlrOV6}HS~Gljw^c~E};iEXDyKW*>hL$%LD8|``F4Hy{}q%nPg zT@R;MmvEFkPnAn}l0%J&vGJ!iN#Me(1oAV|bkUzaTO+5T64}@`GARxvh``(vtbCfM z7r&Jdi~{64%~(xNDHqEol`#jXPrViNk3J()L$XBTBZ#ISF#5|7zQaebZp}7sj-<G` z+)U}u$105@f%fm)(Bkf7Yr9`b>3YRG^Td)iSNmE-0}(tj@(~dv$t8V(>}(0q<h;_f zyPuosc4*~X5F)`5K@YvW2Y*e7izL#SZ-I(aoFU?u8Jd^=)n0tIVeYe5*-SWRdsV3M z&=B=j<Q39fOW&E7p#B?`{PF!;OigyG4kH(L-*-d;NFhM$)by58p0K@(zydyCVR?C9 zN~U?_%s`x5N0%qf!YuLI0%%Dh{9&-I?d{Q@4qmOW2lo(JS^k^6nC#N#wRJZ)o@vbU zgHAiro%iqQT{62`LT>a|)YN3e%l-IbR+_NpV`Nxp=u9QwjeX@>qJo0SNp#T%VO>{# zWT1aYCP`e%M|kJXS7Kqx$-8}jL6tEs{|Y3u+eezQ_M>0-Z*a9IZBjWVU{CJI-CwOc zk8(yg-rtsa_ACFQmi<TA^>6rR|0@@TKpXKV=*k7%_Mfr_8P`1SKfm_)j}nLfk`Chk z<)S$c7bi}=GZ*=6W<tI-En=ean?B~S?{k*=fujY%>bAFK_ufDLvTax3$^F~yb<Olj z+-OQyStR=U)(t)N7yq)@;m~)gVam$K-Ap>$nJpDhtX@#`ZOx1KT!9&#fsf{Hul9|q z+*`?YaX7DXI%l#cB4WI0U-<P!lnpBK3n({ud1xp~jKLI2jE@q0(d0K#D5gAXD4xO$ z%P9Z(Wm{Dq-y|;+tGUG&zj}VT7c2Rl`~QNM{x6Q;|GMmP+=(@~k#9^Z4v>Kyd8oD# zH&^!Gy1D=BrT=?VC4A=)naX=c54VtkY-KVd(|hs1HogCn5&Yvbz5V3aLGsLx^D`a5 zK=yjc29SrP`afF-|AT>kJh6?8@Vu|rqhBjY?I{C!fd4q^f4&m`2P62$<$o;v(B@xD zCq<3v*GgKxhdeCFf4Ucbjo@~Ax(K;4klc$Uu+d)+KRQtS(633?(BS)PIii6lOTKA` zPv-C=Gk_|5Gx_OI2`h{_*8S5r{8w#0^@&F--n)zl#v5@_C^M@jWs~KtMyhwHS4&eU znkwoCUb{Wi;K^XdWEdQ}@AKb2H2(ii_$TM<A3I@~91vUevhDx1`#|f3eb`?+{bTgB z^Z&!D{$JdF|9SM;Za=n!;(4;Yh?}u3<5Q>On230_)%0kfPf$QoXitruGGE`>a-mfB znQaEg<rlotev+Fi`r+U+=~kEQzHz6NPESjXdi^g<sZa8mQ=@u94frwF31_6YKFLcM zV}EXW&$Z%VWNtup|J{@zCrx>0-hUDV4Ihg%q$z&>;x;MG0OzY6%z~O<9@d=GJm!1M z*v?x&dLvG;mW>Mc9QR4?v9?gY`2A++T*aQDZ}A}|HDeQI#X>>lnPO+Z1O+8#)Kgt6 z-cJoxnMaRq3#>mizQg$J>;#LjeF)XMWH0W>wK!CK+_&1%AnJ+xDLLKq-HlcGH8Q0w zmX$#Txs`tP$?m)A>gT5z`nQMc02&-=D|0JVzc(F4KgT;Y%FdWPKiB6wdHmY^ru(jj z>XSXOu{rGCeYRRF>$-bcsI^)`=YOmc8mM;S;c0vOX~552s`P~a0GFe&yu7PRjbD55 zI{ksCI;sex`@HJ1Wc@QwUw9uncBnUFXuXg{h+kWxXtSTxlAl|-QX7+WiWDM7{X4$z z7`pN<kAs0>eC}u1IZIQ&qw~9BjB*DI#DrPd?v|!0>ic#-dlo9xH!fuOY4^MK56ODZ zwFj)vs0(M5l%0|ZEV=ew==+_+MwkZbQ0wvb5c+(UO4Z2Y(*0dq1rIz-=k3VP+@gPf zGIrS2rJnZT#g6Mb(Ot7a9$vQHa;fc?Z@Du^3vx2=X4YS)I{*FI*YQ^zZN9j(FL%?= znOpiD?c`$3*S4{|=pQBdA}4>354Og(&kkD^P_+r~5h?ZU_!2tb(Iz(cs;AwgJ!%`* z?x~xnQhqc(w(T4}9zFkn<Ixi}j>H|7Lo<S%MJ=z#ws2`AB>G6vjs++VxIL7t`BKOH zE<*jb;>hsbYG;q_yUz?KM_;^nSXX?A`qkzWCqAOVq_n)P-^86|nj_74lKLh?noTiE zWXm<K8W~Qin{zR%0oMnKycb6^Se!b(1?85UG-=@K)c25QA57FE@7-e`?`K@f&XOT1 zE^fA*>$H}GiUX7Hp6^4gGvQ~;8`e@jnBLuC>KjL29(ZcwROwHrBp)`ey?e$ua^xnb zUpjbwwKHs{j^8zD3pDp&I9YwtwwFE+#8pOt3u0MGI&8Fb%{zE_0y$>`o<8%Xc75FX zeI!3mHHvC7Rr}qx>FP%HfmKOG17~v?u3YP1Q(PB*hjaG;{XkJ~XGh6H?{UA@(q6Wp z#@)NS*NNQDH_*|!{?1xT;EB}mF-g~Pe_y-i$*AI#iQH?x8)n5+rDlx$CG5^$oSAp{ z!h}O<;=0}3P#{Y~XAZS9_S2(r$B3edHyhh;&rk0j9Wr5O>a*+{vSz&RixnnhKE>5u zc55u?Iz5m1T!dfS)l|B`>(@6PX^?RjHP`3Y`FKL#rS@h?=xluE_o3$b(UR``f}pC$ z=9a~&L0p{$60xP+-UAF$qCc4HE%FccW>ty|eRa!E5<A;oUK8}rN<u_HYV>}ngo*pb zyrd)+hM~Bcuf6dGK9SRwdYn3=wLk2dj+Rah=Qb{<Oeix8T3lxnaNT4@9So+9#C<ZJ zNSQ7Q2$5!P-h0aMM9qofTgm!(@D6%@M|Cu=M~*j%>${)QZ`k8*cF(Q6HDz2h!%v^h zDacNhnrhTo(~+}QBl4n$NyA6J?(uQA_AEOt-{4NVxC@HT@bm|(@IYM3UU&Bz{~xvH zjbdFojM%w}7yXQecT|=*DXw~^Y2H#GQ4A!uSgW*wxiQNLI<ot0_I`QU7MzumL&sL` zJwM>vE|a4mUo@6&x!#*IMMJTvdt2)rCCY<B{VP)?sn)X~8mDM5nVUZvsE8=-(6L;7 zxF^DBoW|{uVzPsA8<nrEo2!vaWB$h+)%Cqp71iS6J;$o&*RNk_8S6AYU}vuDG4SSS z{&Q~kkp}a%JvB_vqLa*1B&EA5OXH8{Uve|PqLN*@n6Gi|iVi^xF4L}~v~@Pw--Od+ z?~^%K$IsPk+kNYU{Djug|N6I`mt&oEZpxOk(j(qM2~KY(<)U@Q1%}@C%7k<tk?y=f z?S4;dRJT!3!Thk!ZPtkPz#eyoQZ9SFwDdH5wiCXYmT+!I5Pj!H9&K%D_q^Q~Hm{*P z-Pu!HWAx>xOv$7u``UFgrvcCM>ohQRvde6($m@_uv9LX^%swq&ytlqD>wv4%H=3h0 zFIlj$i_#Pg{0qGMIOpB#?YOi&1{S6Vb#@r&&1K<mX8+uo6PO!U`QV-SOQBQ4Wz?}8 zTH_+mc%vbgRVnVtR<=cDv&Jnly-cNU?criZ-{w-<IdwGdIenGsW1AQ1n#8GJ<2z|& zsiM2LYeLNI6?M2_&byc0ctBj*Dz9y5qE#qEv53~XB=biJ!*|gS4fd0_sa?bQ(sFh4 zulm}rO)DOdFDm1fNurh@pv3pn-Z(Kj)iY9;QF}K2NIiw}-0Ys%Y1tXasfLqT9d~m@ z{U7_W8NYcnuF;jnaVBHdxwNQMLF4^s&tBd<r?CRt;l1AO9S(K%_0hPsg#1?LDEGn6 z&tIQQf}rvUcgW!wpi?5v$yh3#a>#f@b)?DvNr^%-65H+LotZ1dT~<WGD&?8n!d*N@ zkyZ{IS?-D>%Kuq`Il>@Ad8Iw@#a6W>vHgB;uVunX5~MfNvAj4gpXNj&KCR4^L(LM? zEl0k-sjKuzfckd#^q|a_3;!%!|7~fTnDwxAwxVevh2pW1m9;5IKrdU~VfN<Zq5f=) zUWP(RXl-(H+W)ym(C5BXmSXixMzd9v%zWcHOUnRYjSgc?$dVV1{-}~NdlqkeOGVVT d&PZr(oodM0n@MdoH5B|gc;JY9lC0t7{{xj%J<R|B diff --git a/.github/images/AzureAppGw-custom-fields-store-type-dialog.png b/.github/images/AzureAppGw-custom-fields-store-type-dialog.png deleted file mode 100644 index db09747b2308fe1807425c2de9b39eaa2f7eaf70..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 37797 zcmcF~bx@UWyY3>S8>G9WJEbI~1W5tu?nb)1OOy_g?vhlxrMr<35b16>&-#7)+vogo zX3y+B=gjD!i}k)w-Em#leLs=PZ)MO?h*2OA2)dlClqv)Qn+X2aA|ZfJVsS&&AP`E3 zoRqk_N9O*DyB6NuE#mPJesaSbgO^OQ*!d9==-&M}->tT#C8v8b$~YtG1|K}DCVmt1 zYQ{zq$ENr6{I*udK_y0|W`H%8#M`A*O=;<<wH0g^Ln6`m3mX)9wBzYPz98tbos~wm zeK9O(A>iqG!@^z#vF=mW*N2fnq6)#1Ah)o#hGh$f6A~gpg7;c0Dm3p{S$RG?tFb~x z0{uObXVi0i`Gm|&6n1uZM@2<NhCo{A$5a)y4GlphX^cOAGIu;jiTy4_{?7|fUr^x@ z=Sge8*}EhDYlKH1hRA<C@-mP1BlOXbKQSL=|M}%tZh2~C=r9qZ|D7-0B)yT76W7qt zDBG&7t4qwxTxMMQ?Jm#y&&2X|mRr3EmKq%p<NLdRerBHd?tVl+R8Ul8a<)C9%z&rW z<|F9i<MZ;{ibWfpYKd~Lx@shs9Nj0Bckba+EPaHf%v%ge>JkO&?(PCgcqVAIrP_D| z>aVn!g5@vfRt><s^IKI_RjYmP+!*jsrl+S3!Fy%jys=TQ6b<||XsXQgdA`lpJ6wlW zXc=dau=_y=^Q4NuO=de7_Wr>@?WF5tA_oV~A9bY)-AEb(gT4k#|IQbP`n{=E4;`D0 znVZQ3nnrhv%Cx#;T`enT>kDJZq!>jrcJJP7MYP^SEHDiELk;Y0L<yGCjNi&)^(pLy zliSa(IqOuFaetO$a$=?@i)$@kTkgjf)?azld^f!|JT_Nzl0^dv=-j+rE8v&O{gIC{ zi(!6z_zM*_Sj<1KR(m8NO*bH?ttDg=@hfi*3GxN!R_`nLF%rm_pGe2trmM-PgQSdi zF-n@`oio1<8%ypHmv)T)MhEA<xIQ~zrV2@@%&V%x6wSd5m4JbyOVt`hn|8z3lIM(t zx3&3&H>|8D4=fVX+4twuoQcCg))sqd@wSue%PJda17bBNE3Wf~jcq-jEXsX6b2MO) zA+J5R=IhsalE;=}i|gETix2LT<vy#%l4z>cSeOu2X1<yJ=EwA$NmtaHfZ1R*T!f^X za*(}>xk`0Y`U8`w!5uTC!$O%o!cHL}OC#c`Tp&jA=pp7D(bF)-)vFxcjGkbv!=inC zj-oQR^lRbNo@U8(6H!*wOx59>JSEJR7S%W!@4Vy1YdfTeL#EP#Q?|%Rs2?m|{F#7b z)~pQ4&CT7e3uFDLNSA<sfS}dvOy_mEzmRL^-gG0csvKCh^JJ+P8L!a$u!OljK2$oB z+*6sHqZU;qDi~VbeZqnB*JL7Hj!<9{?oxy$SED2`>3v8<_4oPq8-81ly%+aq(F7bH zGBt}DeV%V6n;i9VdpJz7z{eH8c@!YUV5xYGwUpL1J4kwa>ji-{D+J#0Q+x$ezVJ5a zOx?K+9NMBh@FQRL**7vahd0R;zr#7^Gmgov{Yv}-qu00tNizoJ^5EPKPn4-UUWlCv zoX2C0J+ZXHX<&UYk#*^oM=F*0_2AOAQ9s?i+dcg)Vsqz0_jY9ebXvKs;z{T1POkd2 zNV-J~l_=9QlE)L=FvP3gy)ydF>19Gl$2z1>0`B-CyK*laOJZPZu($Ua*sy7N{5@Pb zjPNN_*ah8oIlT`Ik?M>yvdwo$bE7Y;e92unk>O;Tx^-Es-SmL_6*w2qph>8~jaabS zD-}q;^F%*Czv19{d~ot4Az1_7iF9W`+J(_?@*B_L$IV!Y<7M@Xm+67o1a7OyfzhU6 zSWLc;fM9gz7H?Z3v-P{;(u7V~Q%IoS5{8joEY2x$FNKp>SpSak9|87z(km+XTOY-Z z((-q?P1Ue(TYDWpG=yXaAYz2WVH(Kzc<vvqISP!3{;U+!_YomS3k@>IRqP{V8nXGK z&R|5#6VR5cpK)1IU}v3`rvavo$sL77kQlVy>C0*42C*d@fteQh*-*_FXwgm%J#l*T zus>V&Q<bULu;eizb~Y`VWkjV+)?XZo=l+m3?%boE-&8ws%$14>RbW93!3hezKuy&_ zUTTu5D63GB(4Y$+pRQJXN-Ha=4Am{PbnyhyNGW9-XE5v~cOd-BR4I+*AuN{?w!nMC zJK^(#U#J-xWS#ZVm>d@cu<8Bp1x(pP503Ko4(kiHT5ihnc=O$splEoB3QnVq1iu z(!SE0o0a1Dv@Hqg7!H->aPw;C6LB_=p%P&v0QU1WB^({Ujhmd!*EU0;^c?+y!}k#j zGTxF_s%~vsfVZ(f;c@?s8FuEgv%m#DjmIh^CUZY{HQO!y6mu%7+V3WQoPS($z#A8f zA}vaf<n8**^G&SBJv(8A6bPiD{ACzxSse7U<G-g)vhp4gm;^r2C1;2mpBwuq_jmT@ zZ~cnt!$LP3U?7io?XMm8twJw`{6o@0IW_FE%j8-hUpN}kG)L(+HX?=6;r)-BL{mlm zIS}G6L&m2eF`OXetUJ%^W!^GkM9w{>;;)7B%dCac<*khm;oJxo%zryYqVC4wy>q*N z#S^A@-c>r{Vl>wc`$|tU;5ez#>GvLk;#`<#bhycHb&Bg}E#J~pf7;*`SALTGXb||Z z3q@-w!^+nkSQ8rA&NGNzR3vBEeRx5{{Q(=>qch1#VhJQ*fl88-dLHpnQkPe*@~cLu zfqz6_-*cI2^F7^p!S`!->|G!noQxf?cTM!l7oGjWX8KHAlR|DdQijOkmCl}A;f;Ym zORsHaU25ZGYCtRc)NW8?``|+OauzqI@|H+G6vag!Rl?YZ5925j9s-VFvzK4Sc$h~_ zYteE}jahTU-iQ9}BUUi3SPv}ZKK!DuiRgjDCy3uRYdFUel^?|M(HV8>_f>VcvR~lj zXib1QqhRA^qbd2n@IX8dl4NH_BVR!@@WlzcE>=H3ahbHfQJF5q@;l{wBs$H~&;#zw zYdun~`CdO*@_Sc}`zBGvSUg3<?0MGS)`auWC)Hf((-mD|1?DbPhnQEG1R3}aaq%zU zE*>sK-}?~)6B!@sMi31YIawQ}*}qXDd`lkHdAF1;vxek8VwgI6S;l*Cu#pN<RmGF= zswG6mmt}}wp}+i@c*5_L%`^XpuX4XhZms6b21>0@uAVX$3+>Dc@Qgt&l?tQlT2_r1 zWJi0Y;`a>fPS3hXqSnI#se-qaV_hU|I9!CC;>6Mr#+8F;&yvg4TK&6CPIGOshyw-J zx2A+9vfop}S#9F1KlXdcT<P^r_-fXiKNT7t?$Pj6tX=R`3VgkB?{L(F9Ed#~bZ$CL zEKOmEZ;D`hGZGOoKI5pvv7(#)7=+RjBKC?MlLQ{VSwczKo#;i6DK!<nT3K7T)$955 z)iES7PsAfXE>yN`*C)@9LwEu%=P&twT;K+@{GM1Hgsn;WSaZ{w*Cf2nw)$X-pLsX$ zX6X;G)V*uHP-J<9%EoLx8gy%!hx$842XPRjVXqM{!sbWuCJ2s9me2jP`E&QbN!&Y( znL#>g<FmU%79Oa$IJ@##kVnZ|105Q(=N7}{3;GV`dG3#23+#JquTkt}ORhP(J2va) zFZ+k&TuE;%pXgNdl_oGJX6V6wsWg-RCEM6v@3}yCZ6qV0F8`d*pCTxC^9Loznq-MG z6&n}PlkbxN#!+(&Ih*nP)wgNw#>Nz~?KV*~(ZEp-d?Ld>W=Y2z1=t4PYgBz5L6}Y# z#8;-)NWuN&52qK`NZBM20hIit*Zcg-kt0388`riEAh_H#cmx_eQEJ*ul7BkOnr@eT z6;co4Q+^Q#>)Z1wml4|c=C4Ql=LCdmA(6+Uioj67!ce>sMe56MhBGuX3Htk!c)2M( zENf4RijA6Rft?^XJ_i?skLVJ1j2_^N<NjI>EI#hA!z{5z_H;qt6v7PJ;-yWss5N}J z;HLCR(Gr`frme%y?>y(5*J&{hVgfQ6;d~HZ@~2@r3y_{W*L9YMO4fL8seHoM+^C!B zukoJ}9DdJ(1}ELrIaL*2xHT@pVl7xW*^;_JqsDo#73gs?qT=`gKd(VLa8HHt`ZO=; z+I-Km$!p2vk5-lR$*`9lgS66Fa8ezivCb4m*3%_NBaYGdyr_WtJwABF`tF?MSq>*a zM~LpuSS}|p`W`OunVA(T8mcAl-4}=8IB$AiHC@&q#*cMpHJ!Jdc`_2UleGtGX7zP; zXa(Fg)}0*8q9PF<MwwA4hKE<tcnGtB44f(GMfT)*$MN<NFFKT&o=5&0K<UC+>BLfM zRV6A*WHX26Nnd|B>x%eONK5#_qq&6UDnr;(g7qu;kVtpKLQ)l$zke<u^3`RoBI(V- zN{S>%iR+2c4D0IaB$cN2ZSoW{T#q_Ide19vLo)N+S@(NF$X|Iu{5BzSnjl|8Yb)qB z-(tG<)?RRPcxms!F{#V*mKL}^z=qHxyi{DtQ!jQDqDNP;I5Il?x=tuu7+;7<Z4e(G zkZbQ@G>8P;ePeaRwnC6p<RR;LLbJ+nwu`dqPM{+<g$@{Y*UvsYh#?hzS6dMsi=6^- zy`fVxDaf)$dxjW^X;f%2@YN0cp}tC}5yNOCbS5#J`7d^;?&pLE`6f``JUI~mxZnGT znOg!A7IV>4Y48|_Tn7shI3kIROZlQOK~<XwdEBT5fcPC<i|~^DUPkvU{=dyXfB9NY z>;)@oOFC?5=YW!%My0?KW4L1pLxSk?2iZf`KOr17w~@o{@s&b4E+nxzm)?&+N$AJ% zwyb*cAQtW;q_(v1J2NC8FcHFSfZp}!;$SmsW#vS7X)hd1m*l?YVA8Oba+F8K`uSnC zz4|6qHObkD>YNW&rrBg&2p8%)k|r<;tg)QVwV262C}O~NQ;#i&ek<2zj%$1rdG1h^ z6WN(}2i>A3;kVz%{JnRPJ&rN{gtozXZD@Popg7C(4lxaxMZ|hQAcO)x;iT#Pzn$M< z?!{{UB9DjZUN$nP3mF*33YPIUp7<*V2?%LY_#~U3@b0IR;67UvD%0_)PTu<ZX7SA< zQRF$No3_}njxcFT_aU`V>v3fK{fiK+NvDz6E_?fFHw#NmoD$X2#1A`E8*Fqmj`<{B z-itQ&67<`Bz)}$)5zW^SvtHK<+EeRis<<vNkU*N{dV4>}m!h%ofobKvy4sKO%k2+X zhiw?gL~F~ISi!lu5Q!wdZyz1Mq&X<%D({{bYiYcX_U0#lY;%xKz*ApSF|XM!;;2%X zl1O$F!#pJpHP>^g!IDUNA>`bW4f59FgD^NlO2a0Sa`L^WzD*}1Hhe3DeGXnpr$jt4 zUsvQR#pS52Gq=q@j|`@TzimF+7MiotW1%-%nb|}|aiz`H4BoX~Xzm+EP50=kYw$eg zs7QLjlKa4BoeVxc6TmrxNp?uZsL|8w%DVXiAz8ge7Ta$@vU-1Z!SLMLRCqu}MPCpg znSlD%v{~mia!m5JxMPxyn0y^U2DXp0tk=H$tab|Dw$1kkZjO+IWKaPJDY?ku>?5q5 zLd6D%bYjY9{qW$+MGmGUjd-3Xou?1maw{2!hc1Qi&x9}P)UV|d@!U7-3<2PQ^%XsJ zk*~ij`PPI}h~GEhqZ}ZUhEx3RlN1iX^yLLsKHBMzMR|)C0y^3n6;|j@A8LZiRpVsR zdegVe@%sQh*;oukOnoUv0l*62+r=y?ooz+W6j);xr-`*_%0kOa@n_u%?a1FP;fcT~ zar?^ayCLJ%|KwBJC|73Ssd%^d^k@=o#w=f!tNLMV>D@FFFO&S<2HsM7g8*xyw%(P; zU0y+WLdLt4KZ+pqyYxF))AP)^W*|0Xb_cTVq_f)C8bg}P?U3<7M9?Sa`?F;fynq_M zF5V?c`uLY?l&n3}0JD$MF<<Bw-M)oUze3gKqXM%|5<TK~!e}%@GrOSQ-<uQO&3sE` zaG$&3=fDT2&MeW+`+C2?6pj1<*(4Fh{&mruE7f~G;%$wQF~9MI#2V2aK6(#FZbav1 z*qL|E>hGp05A?}b(`(9lU73HD=4x<{f7%JbI{ol-bkv?Nu-xBvW%*ppX0}|sO22in z)h;VZ797<i3bsoPTjV{IdsT0$)@_-v({(Sk6A0+CH3_rf)iaIgdRDBTc&?o^B@BHg z^Sa2&7Nuazc7p`$B{HV+c)uzOcKYk&A5Q|&HxR+rfAHqXfJ7^xe?J)EB*l<P;+Pq* z*7<QVr#?e{D}m!&Cx5(J_&!zGfl|uc|J-ExvC3ePhq8E`ujmJ1go>JPhT`bO`Axc% zK0#O?>^aFYiLnm%^ehv$(_c1cE?TH#Su50*F4F5{eMWh1TC070t$TdUnp1W7@=2Es zk?pX7P<R$j#psG-t01tthFj*mm-d`&9Jeiy%`RJCwn9Tvr3}`f11@I_&Y<eB1qYZ- z{Z*fh^t@PH_j*U)Dyc4c>^OZ$LeXbkws6&w>HF1bhW$cmyE1jA5gq%*H#<Vvx`iDh zWmf6<<+D9uVjcMlFx5v!$jm}&cw3+I0GqRZ4j2FHbYxJr7?W8C7my5S2#%?76CvI{ zX*xc3>iJ{Uh9u^M_`*M`m)RjUu*7ULUs|P1;ylzF9KZ1&Ep{ZdbDm(j;a&+e;)R_O zpI*xNvC!@#r@|LoxrHtGUa;NtLqE4rWKVw@{hEUHz0c%<d(oteL7G)D?k{`9N0%rp zO5pa^6*(fe2J(Q=+)<w8LY6GYgzd5m0~^-d^>g;ygmdn|EAH2^Eul}!JTZ)PC)lM- zrrMk(GiaWeZxTQx5LqravbLYza4!`aYmaQ^M2J7>i99lK+Onl4^?FZrsLCawp*X&8 zqNDz4Fd;<^7A!PEA(oPhH^dhc^|wVzS4ksbAdPU#{qr0kj=c=e$RJ5(H;6k}Y7Fk* z<P~x(G@>q1XR7hJac*jEcC}o3`3oJ@WytZsSTCr?=+`d}`xgJCc(k+HH`P{K*iu=o z;URlOP`DCbMFUwoS8{UP+Y89HpG_z6D3OZ#9U`Ocnwm-k#Z-VwIUQc3S0JYmnGE=9 z1x<T<+C?obcB0iu2031N;kT`Lk=Hvv)Aup?G^^_|sY=wP^sCRJEIt=#8CQ)XlE=%h zJT6^eA*2f=q56k>f5dt&;s-mPGcCs{B8GPd{-R82P&_%kd(f^hhm@5CPjzMpfWy%- zK!lHTmYG*NIi}c%%H3=Q;l%8tysltQgkP|pk+DXKEHo9XtCoBoFZ*OYU>b|qF-<{J zAn~kT8~w8?I!2?tdVNtluHWM=im(qEr_&`wk)rd~-N>Q{-*`Z4%)ID2aR~34^&Ek( z-5oEu|3VzF*|qh}{E{MVrv4e!E5~g|;bGR$^hPRPf~4<_aIj(DH~zGh{aLq;wPL^L zG!~{|qzHElqv0=ucaaF|{2GdU64>G?DfDpPhz;gnl!FU>Vmt*K@^|%!Twt<w!qN{S zD>u;F9YZ}YkZMyoSQ<qvmDv`&G(nWw?1;qDOHD|KJnsHVN%wk-@9}EJOlv7UH>ICq zN*^j1Hh+S*a9`qUoX3?w+7(@0UDc|$ehv>S9$m%t!O5xf?x-EJS$B0E9%q~rs>w9@ z-%&w9rC2%t?e$Auq0ZWZdSryylULIV-q55gzIoT>{)M{`1PC>;KB^aWgkvKV@Gl5B znV3xlJQ*4$GW|fTfRg^=y2$ItGspbpk>2@Tzv^#%oq6TPP;H?3J)K?4#EFOQHKtpy z*sNmrV(+ib{w(ZkCkyz#v3<lPa(r32;TdaRorXt2g;XLaY`I5hF<kfFbTS+gynkrU zO8st02q3p)fhrXh8!nWPjU#7k)myQVdew9Fq83#ukwc`i<;wTEHQBm<%*lLf!K|p+ zGYU+r!stXqZSVbgbH}kc(|Js>NP-fIl4#@(4Qbn~<Z%gC^j-dz4)@>gxG)Y{;As*? z_eoilHB=+Zc8>V}E)A?Z8XD$f=0?I)>Ulu!$W@9N%KFMRgU9n4d9w|;NT2*Ru|)MR z#dJm7Da3JG4GkGynLES8`T0HzlYkj6k69NQFBrsU2htKZDpgF#t+tB|2Ie6u9Gpmn zRc5xg8J6&mJ!xEif+RHuPJKTco?5l&>Wc^Ed$)6X`r%6%Bm1<%z21<8M?#@i3II}B z-)fC*Itg9f@5$O)M148YPq#5SCd6!NTH^C0jXwQZWBusIqQ!{;5(EQ#g~W84R7g$} z++8+4A^#KwwF}L$hi**vMtI1)0{A=_Ac@p^M+UFvr7u6ep-k)?(QHiX{iyXp!>>$* zB)*?wT?FwXo7_$j#ryovgw@hCV`Mo)g@l5~3cBC;Kp%|($>h{dr~4OFFVA^OkX}@e zwv5OBh<f;L(H4KQ&J@InAA35|RJ?g@L!TR7ro|m7pq!%HbXngo^pqC))aFmhNkCzF zYrJ^%t>f&C^xEH>I|dK+*~05*2tF}63lzx>^z#oVR<u2)eCZaGK-~@b!4DJIEy5Ge zs>l+<;lE2rh<b6-+pe@Ru*v{pM#1|cDAx=@n~I^emwPas#5KR$Y|P`wc4s8=MLh4B z-+k2HTIBwcQPtmFjl6n&b(m7U+nR^;a7irD-dgycT$mj)#!e0cKp+_9c=0DPRG+;U zu`Vi%0i1f{*LN}=(>=qu2{qpumj_0l3pqk?qEKA?w$eBz2O9z>>Fd+5P1vQhEPfp+ zq`k-H<&WWYRpW4(Ske&?Uo&<QoLBd}?dd*fJ9D}{v2gVh0o=(3NgmG%mUfgCNIgD3 zp5E;*`QSshr8V(|=?wg^{`LHg^}2`q_Kia^tJ=;VlE0n)#i*HH(I*@gNWp#QfpXlw zZw|b*4SP%-Li`9SW>%ztVYokXqdo@f@v;`gv1w?v`5`C_#~u&4&mGUaFw%C7&D@BM ztb;RLPF}zSVuEmz!0v9^@Iv!V;aJ#ju4nSJsvNw*13gF*b;(6lK<rUgRfhp_QqsgX zRhuw)XzP{6yXf-ipq3J;;aH;`Qy9R{)jz$H)Sz>yJv`lDGA+daBCUb?rUrRGlLe5Z za8+ob<@qp6sGXlCxAIjg`wO+8$qjihNR2Fo245jyUN&x~b@Bz$>v>$iP34qz@*pWg zp(UZ5UQJpyiUYbjc~X&5C>TZd8-EHBUV%(cLnBBLCJhS|Un6U)80!+!=Vmilf6k1| z-|;gx$(Kk2U<-sX0A$lu{yL|@7W95rv=8PC`zXN(@Ro|29xCuhH5Z!m5A_rBDAqQg zWLtBhRU^-@W?z{I2<k}YDu0nKEZ!5F`|?~~rK~GY0r}^fGQ&+njGC+xdPbv|-0~)r z_a)DO4hUDgH}&^7OIT=q@rdtxfQe3P-z3~sHyv_{g~P$oz}S)vQ#Ekg@HiF~qz1HT z!b4F+c|M9RIRU8G0N^cAhGv4c)%&iv@}ndJSIEGR6XDF3%%_G@mMZbr@1LK;`)EbH zR&4mo-Iw6ZPe79VfRtN8C3<~y=J=szl1c3;T~U$-M#C;0mBs{SlKi(gn_9=XEQN?( zMTQ7sy)zxTnXGcE0Rl*M<T;2n6^xmgy-H@kpyjL;b{cMy+P~H-peQFhS6WipyWW~o zvuW_6+Nb-&Fgnp{v4d4Nt@FipbJpoBDYX72cp*p2%Zqi2_j8P~_hP{Gw^@qun19#W z;a)%o_TltPStP38CF1V164_iaGm4Vm&hpgK+e-X(MDa(-8}v>uX`nA*1r@*FjHZnE zMic3gYo|@eWNR_xm9rzGA%^BuJzr;%I<}k*jSKHW4ngFR^;XXLSIKbF{KA)7$idtc zyaOQW;V=J>YKm0<Rdw>M{F|YF7bsg)xUK(P(8NIrh0-GEOjcBI<e)z#K1j>aLVqGn z5YZ(<e^N<V{QFB;|DV6a%D~EebcprOJhJ6KNi}>a|5pB8k`g)%Pp1EOgP(l&3eMnn z2-B{Zy=TKi;j|p5L?h(*B6)$2hxetl6orkAjSRhJO1I?$GAAde$IVvC`kz1Z#tTtV zDEq6eBtyxp!GVF|1h3~gBO@atqNBTmo}sqbX1sg%E+RJewX-wVv^B4=h{*cZ*0UNd zG*CJ+bNZGdUmzhbkHW>x-AOp5ZEkNL*XDai{o(~8Jw1JOW21vpjwu&WrQUZ08yg!B zFR!4XnMbi))e<RVW9lYdHt@F29rv59%9CqX1BcZgo{nyAhqVIEE-p^TYvLnE!sM8T zhli;gMqN4EEi{03yiRG9s?@GW0oA^U_;?u~A7MWG<%o`sS3YMW{A8u>2aEN3>BHZ` zIK$}PBpZ&T^Ul}XXqIga4Gq<JT>xZR%N9}TLQ6|)xHns&*U<Xohp^B2gbX3KIT{9q zXw3Y)){oPl%!Fco!e75$nN7X;cQ3%#FRCSr@7PVy_#IYz9v|*hw6zxpRczGCW+EaZ z#T^|v=#{d|FI@hNQ~mz^do3?sRKn7d!P>?~r@XAN5aGq!%#K#?t8|5NJd|gnnS#N` z$H#6I8Kb9Q(NAi6dMkfhYHDgc9&dJp=;FdLDU89qo1C{$Ha0h%{!TM0<cN}Wc6Jt* zm+ybF6J|8<f8gbFSY2K*0tI^MMjl0<<4(j>K0D%omgKZFZVO|uG%|VExeA@RLK0QY z$hbIZaCG{fThI6BYv63=Dnmi}*FF5A=$*E96rdb5bac-e9e#y1Hu8fLk(ZaRcG-C= zB`w`GH%CxdSXePj_gS7QWyr|d8bw4zgriScT|H!AKvp4J_<fnJt1EB5Dx(xNc1%nR z@l1g-gR+JOg0HV{gcNnLI@70=l<tlWNMB#yNFNpsPLPt=1731+a_rx`wO~v`dwYz) zSCB7kgLZ^24?Bt=YJdF-ixLX!<>eKd%=}qi@rOii^&1@r68)<d1}3JinKDfw-eiZi z8w7lOe88^fs%SVku#Ak1Qia^@i|mWI3knM*s1rZ96NX@YojCBN_7o<+J>P{ZP(}Vy zS+G6C-Y)g4&9`&iacyTO{P@^W@uotjk(!bc0!%fP#|p=O^#?Kp2_3x`STN5P4lXXI z=c%cq0I7$E$J%DRn0;;iw%o#ZclMy5plZ)EbJ+sbOaUhe8&7L%CVItmc#QDifB;CQ zh&TSLmB)B8A$*y5@)@S51&f^Zi#Y>_i|de(5X1gBGLMs90wZJNAfxUuD^_+!#?HN} zb_@~{lKJ_0!}YFE26lEt2rV6*Ra{z967Jh<;gaXw4($&JVq#)oE@0P*7#SI}yoS@e z3A=$&VPRtj^4iRH^!Ll0{h96Rf-Tdm>iauWma9>AGAeYmHjqdIS|1E!))(t-pca;x zm<Us%9wp*^+0oevV_ZX6XED|{lELqEeQczVDS-XU=L{Vd4$kT3)NEkO87vT1R8+LO zzCJWQ9@FpPLKA#AJv(cBwA%V-sgWH4jSvDHTj1qO<ITQUkKKY4Lo>6`i98t^dV1-d zBV98yIt)^QfIojMfi-{)gN7MkQ`HR(edX`#5)u-|O<TFr&=4`nL(<ZSdW<>EN76&N zEk-Tlj3gvr^*z>~Mf4h{rluN#@e<?<$i&3S@|78&=XccpL~ha__bj}-GgHtd;q&KE z8kxAYSpL;lZ{K3v-`_iK_M!Lm^%(=3zg`cgfIiY2O<)2%OWRdiO3HApBe1xn#LD&V zV&}Lomc*{5t?l+N^N;(}ArBBqmel>G3Kdg1O~Phf&+gC0x_f%yxy^@Psi-6t-j}Eq zVPRoGz<E<ihEXyyB15V{Y}sFK#=W~dkbLzjVEdk5v#mrcaQn#*M?&^{evw6OC44}I zR!tDu%MTI0PY+kNTR%T5(BjktBVuy(5x!AWG!qvWXJKNBD#*{T=3n&)j+CM<RA+i` zYs&)HQEAXVih_!|u-fXqKw#k0NoZob(&D;bkfLuK!<n3uGX~sGr{x3V8+mzSY;0^6 z28IaGSF?v_;~gI>MQsF`Z~Wyq1RgqEZnhmx<xJnIudg3oS;<n&6i8fYb_stiEnN#D zC_=#JPoJvmZRVi=QM^e{C#J`Vgg(2pabgrxv)&!fohaMm_jqIBc6F%7=Y46*=X34Y zM`*(IIqKQ7XEk5GP~sC1^yA>*%%AU0EmXBX{sgm5lchDL@IA+7W?(RMa&m%>>-%sq z7sJ^Hx^)O44PfVzGc$+dD8xp=GR`h8?B+NpLv`6KzPlY5N8_^^hlYlZBr`KI8Zm2> z8-n0yjuIMFGGmQTMmDlNlF_fKrnV4@N-*COiMy~nRrFq0mvpJkSLp8W`_X)sko$a# z>z<aOA?4jkKgD}<b9y1~OBNDQ9|55cf3Uv$J-oa-9b!+*%cBu;*+wg?tTgw&+&7Ag zi`(xAgxd#QN-VUrA>b$)yszxtwthZuu$-W7u%2N8Jx+zsP3-Jg@3u1>w3L;xps$Ax z&nq@pWngi0bCd2{TwH7jdYsIG9hnrp%`yfN-WL4Zc6&IDg_Tv&#@~#K=ne!1=;%vz z7MRiT@fLSiM;2go+oc9O7JmK|R-J|zyZP$C-v0i&sUoF1;OEt#v+0HJEuqQcoNsr| z$B#G~YHHn(YLJrZA|jCRadEqKb#?z)w4a~o-G1FzYJEL#bY!H_^XJd^H+rMdAgCA^ z<{)P7gEK;dFtf4E+B$$K*>(m!i`{5)J4n}f|5?6QLQ;|l;&!~&$){%kncvCr9|fni z=p&LX>YM&rN{RylHD2I;HNdmY?d(P_4_APNr9Zs%yBA23r3FrB0{sSP_p1B!36IbJ z(TC4&kq1m~%KE0z*lzde1!y;;7NLoLtruyu@=>bg`*)j<M8LetD=NSdW)>>Ed-q(( z^ORP|{g4#u9uO^U?euN)6A*{FO4Li=IRNMjb`uQ338a!-ttD?;xBdA}NcGR3^1vi5 z#<Ia9s;W39F;@2U$jHd(4WBFJsO#$Lh#>eB6k~)Y`^W3u&?%OdGWBVl^@rEAkn|s} zeCNHG{bfmL!t(N^whON3GO)0;=x9{667}>k407QC=~&`k;7Jd+7toPIC35S3Fn=5X zuF_z)#MfZli=qL5fo=2b$APn*u{utZzUrhGO11a*K84B*sj4NWz*VwDypvhAsspyR zwrXl?xf;wzh~3sYU`E`FOG~4CFBdFqXG-6dS63$-EYyWp=zULqr><VTxTp<IL;Mm% z^y<k;RcL4c07K`SB{tY?ZO+*ji4fw4a`0s{3k#b|Dqh~tBiSMudQFbvF8Z`M$liAc zjnD^}nV2R&u`)3kgZ>{=okn}JnVA{jiA>DQ3;h)S!wn9<MgjC%5PLkqygc%M%AljA zt^WJhdW7>YO1#0<g;+^RNjmK**rxPT05VJfC;?A{6g5anM#ekDrvIb(LQlO!eYm$b z)NZLEma}iZI~)`2I0?xTL)<OxByfIDPft#eF%SYqG6mJt3~c5!AKd=#I*TA6BGxI1 z-bkI@*;KXmX_RZ_zHjh2F|KHll#rOez1Sl%iK)<UO%DwTv7DJvz3DgkKa8lir?1Z5 zGqcrf2w&>;Ybqut6r4zCxb7HE<K~4Ujfsr~wu%uF8fx@-e*^hTe)bk5x~GRD{~Ess zFMw1OvR*#FI$W_)_kYOSNWP5|VT|E~Vx`Ugco~3GjZI9b@K9hNh!~_0<+)}9TAa?M zC7n9`?!>ycZ{Gs&!3Iqokd8Pqq2pN{ht7e4;@(ZQs&xiEZf@?8c5W^%N}R~?cK;`7 zr=t9PN)Zt<H#fI*nUyywY`q0<Qk2!yg7^1r;SmvSdKcd1`2y4eydW_vYvr&LQ<seZ zWCo9;)~jlxZiM;8#f>Q?vDf<g`gye=Zwd+uVnz3+`%cfzK{aG>cD%k0;CaxJ2L3eZ zR?eOjiy`jUV9#GjNJvm7%61S=-Iwb$zCF`}2>`~IpPz3C7MgDN{{4F+5OfBHhNg&F zXp(?vor0*TsX20$J+u|nzX?-Ja`ONp>eq$_d;kYhU%E1}>9tJ%UCSDsK5nUc+FkkH zXztm4RMFh*S#~i);lP#>?Y`=XnB)H_2sp##(XV)rQ{WL0_`V+k9CET-lw<t#_|W8j zL=H9$K{V%A;a-{1FD<<)88|q&3cq4>nUEI%q>p8br0<RO^&x=7I^`w2s;u*qKc>FI zUkn)#)$?=sm0vGZDX|Qvi&X{&2gN--1%Z!7fII{c0YZ-NB@r}PDZU4jdCsgs$;pWg zkP{XXJQ6apmAXZ{-vhu-6Rb3<d0)SRPTClNjE$C?oCx{tNuh8KGT-d-!rIz;?dS*- z049KM&G+7eEDM?ng8}>n0NHrr>ubpP#)(xdfX)B~lM8!{Tc)+Qi-8cFkdYA`6a<S0 zh!+60F`R^igoYgfFijxc)yYjH_3WHYG&&fVT3FD$d`XNF3Q#0Sjv3PLNC*ij1q29p zMzgwsX*k|p+S#uDXr5?+4TPARn*$U)c|P;5L_I;4mV=vnuNFpCT3XuC(Xj(SuEgZz zu=Dc|`9(!EG&FDk*3A+Nbnl$yR#nCS{P~l93_HAA9Be4m=1oma4QI>WYc)AiRq8fR z7Wjtdd`i*xLf+loMM6dGPBHL{G#g5;*AfL&Q7d}e`-xF)ZFjfiMt5$njAm|gGYo?) z3ZN;Q%670ujy^{KTi-JNnr#Qwj7bd;&H==urlNuYaaX`?pODXXK7diJuw!@_4J1ye zjeWb!FDS5@74m=lhrWRjBOoNy4fqCiVzJ5t?u)llMn+T(_A4mOx^bDAq(2^S_Y@mm zx;6m3+XcE8&CJX|b{)T8Zuh59Ex`j^@c8sJ2;@=G$7>Vyckgn)e1U+|oGG>VJ&@?= z?%ogP&*6LfVMN!9l`Lo0!`r)iWrYlU<F%C)V`*tA&s3H|DhCW$y;i%Q2#A-T<muXO zwn@Ml!$JT!3<q=AUuwjZFTep|VsCO+dU<)d+HqY1U|59yc#3c->OckhZU8r`KkTa7 zF4R8z{P{B$O6b7PpAvu|ot~azk&|PTsH1$A4+W!AQB%X--rj<JA;f3XMFQQqpXHyC z$0GtO13o$O2<!+8SOXveG9VS2uZ2fO%BAerRaCHsp%Ddvuq_TE(CR8V2mmK1C%~Y! zS+yl{v3&0?dq=Z`uyJvN0ig#R*K*WAP7XPaR1gpr*z><LsGuXd+ht5-u7EWWz3T2Z zr{NpR-rgP!AnSB=bm`)T@!b6U{gVZ6PBx<1CFqlk098GRQu&WF2OuFBum&ih0Khp= zovBxb!Z!rG8RAbGe!Ev!e;RMI_e)6v$*Rm=j{2A94%zkXEtEr|;<I!_VAE8C=nUxq z5X8vB0@1|8<osZXz`*Z@4zN}{9UUD~AvZL@6FI;P7V0c&06CJr_}<jC20}mR+ZIAY zLtFd(8$L~8ws6<r<=1cD@BnA%0dpl$yk9O-qKF~pMe)8meD)9jl9Q7IyAMc<9nTCZ zAPC=&+EBsfHm-WTIrDteU&Kp_fvBRQ0=y|GH1t`B1Qp0!NZ#JwO-)UdqN3zbHloE6 zmYq!wAVscRDsX4V)8BGFfJcl^O?Cg7$iv3M8qeJ<K$Vn~WYMaI82Fq#Yp`8_1)>OW zz3ZEs&Y79#Ln-Xxt*s)`F@%A7-`zT=r|~c_Fy<TVG716f4PbA-#{oX=BT5lXz}^S! z)6mE$kX*#;OG^uJc6K(Dg@S<30f5tRIxi}4{Zw8Xe0{$gvlt@oLN)SDvBw9?C|TOB zk92PgO-<oJMukQg0N6leh}FhKM@Q!b1`ifwIA3kV!OPqGMLgIMXbBM4owodZcye-b z&_N4m7(#r1aC^IdhVd@iKPCa5(3m3;_TT_1$jHhnGRN<>WWo7OG7I#;mmJzx_IuVV z4$3O$QYyDHZV#tZfYGzH-5m-6a@#RJjs>W6`rt-j%j^^gKoTtYG*nc%GyiEB%x}HC z=v~|n7gn5jRJF8_OiVWEcNWWX5RXoJ$`}DO06`6Oh2)NMf(W%PM@|A920;F<i3ydR zp8SH%Dg29g$Be(;8p_HLIJjW?q(cxo@CXRH2M0^^mJZN>M}SNQ948zE16x~Lo_?hY z4XAyCL|I*18}#|}bD&0*mzRG5K@ngoQ!}$%up7XvLt<mmLCPdF85kLPt*uQA9NZAt zX&)ho2F}jTYk&SAF*7qOE^KTV1178W{yk{vhFT$@QsBj~Ib$*)`+!hlXlGa9YENXs zz{nV=%jWP6tvI7!g*x$-fdK_LM6l<|WiucGN{WlafcA7`R8&+z>KQ)EgGJbox4Q_C zs%vOa^YT6iD*@PI?d)dl#H0G#w`tmsL_|a!e0*Vbb!R!-tgK9*Q3?tQz|htW!?7g% zfR6?Y4=bGSFVyU50Ef++Gm*5eCypl<3DRP*|KJB^22%fDp(WLu!at{1Nmvr;9~0AJ zYipy5_#=IYg?E8mJLv@C8^Aan0N<@29mN9z*YaJGIwYa}+bwPF65=e-du7zs)z_v= z)Sw6epvBddb<k1Hou{Mk4aDWFULZe!(_0}!05uDjV!Hp<wGwHIB>NNJpUH<9f#0Tl z8n0S};DJc11S3x^*C>$WmJjsO1F3&B+%Lg$rqa?H7QH9x0J%O59htcAS{*L0P$js1 zwF$zKcqD##tI-xmmzcIdws@T*ZuQ>NJ^VQ36W!RKLo8V#Gxev7DsP~?;(xHgu`;)w z%#9U0Xc8u$W&&4DPEvTH#44a;nHJvL7+mF>A%ul-@QfcFa)8MMV$dZ%+}*iqkp3o` zqBviH3d)bemQfV{XwCn_Ycv0)#QlG}fb%Qy^X8^QXHQRlo$)`CHkBR}WWc~YEVlXq zv9|x?z$pr2OiU<Q3D^ywI)A7+MX?H>-EkBkdqWM=vAUX@_wJuxB(MR6ZZ7v?WJIA@ z=|ALgvj3huPL{o~Ge*zN4F}8(V38Fv`IO?yN`#c5*H!wXtjT5NpCl?Yg2(*%+Hin* z0XQp>TiomXK^IIbp-_axy$=DL;riALf$m}56cXUs5@lxAHqSvG01XAZK@r&)AU9Pc z=Waq5!gH`NnD3|gYx0yuh3RuevP#*^nEF@v=>r#?pW{x@y&(2(sAc@;G$tAUT^jh` zC4~Jn60I}ZOfh%-r3T+HbP~R=IsX15JKk-Jk*EY?-Qyh)kQruY`BJ&BJmC>AU?EZl ztwAFhPjI-nxR8Lz5+dn%;^3XaG5GlYy=32Aw5vlpYA{jZRSE-k5d0k+45VJ`Nmu;9 zCuKtfZvw&4(fw*X27zs0tUqs=)Wg%0=H)F4<W;V6z|dAe|0d}6FzSg=S*bN(RhgdM zxDR#V;NXBjjy;3{-R)c%A@hQTfmj}Ri|}i@3%nGhV*1PF<9lb-hI)~%6F#=H={G3? z2>^{auP7m)`=X$LPWaBls#ler!;vz!1$61)gRru>+WK9Q4Hx;f_SJP<ix(XV94w;5 z@tw$5*27=zh>`h7lHnNMOsDYj)I#D~^NcZM{4f@ynfB+;yl=MJ*PD0DA&|)_)f(45 z{7-lUCL8&KkbnS~!0Y2~e;A0od{mA5n7!@8k@=5CXT`ZgsTVG;t`2V6xiEonK;wk1 z*N*+#CDGH{XZULERfLp3tunZqLnz|K0-@wQVGEJKhThSkt7%LDIgj4FKsB<wTtUj< zdsMDuxK$xi=`VLZp2oO}EHVfs7Z)sG-Qlw8DU?jsHuX@$pX9@l!|r0wMugy{e4=E( z!v4|f3xQz7y=A3Oj3?isq^2fiZ#|dKXsCDHGxw>t5MyCsSyF$T$RoYKGobhi3L-Lo zkI%xw!tAt<<i7SVkbO!_j04c=$IZ5mtZY;8<m7gdjMMHx6sD+dG#uikc&;*!w!M*2 zr28+O*iWBKY3Ww{KN^WW2dcTPt=;<eVIbgBhZsd_CpSLlhX*L!+%6!&xVZ}eyIkz( z&cmF2v=M>+1tKRL35m|g5fxRmj&37JBNG#vIkLLIg_at9!_w-ug%fX=qP3}o{wT~d zDr6F(0ak=YAqu-Q_7v9aVqn?uBP&Y;tmc?QsBCZxfQX0Nn@#aa-}BwgoBS@njnlI; z<#+E2ZdR6;NiQ!k6qBDvS0tX_<t?-m*US@pHpla{7ZnvrC>_Pi5CFXi-~*eQxXbc9 z)slqN;s@Ejl@&N3!ncGdfr4P*^|b)${UOQkt*x%nQSz#LI~Z74SZoq+bOYad+yXi} zt=nyCpX)Jypax*KXQ6jT;<kVJ7sN;vv|$5x`bcK(cKhPjH}}E^lZyD7R}3WL0fIH! zpGUraTx(SF;$MmZOMOM3M8$Q=)fbxsfusspaRKm&-lrA42O6OqwNuM#>$m(7`uZfa z-fLU=h4giq56zNQwQuXj#FW&#jZ9A~>@^|5-&V{{WV;HG#?8LeNY)rzzApw=l145p z+qJDoQe!BNgz<3AjnC#omcef)r8?;gpxWj|0v$k#-M8o@Mm9F#@+EjzNr#)i_C)&v z9ooWEQuz5CZu19Q9`0{>m!7eJmSex0EyBmg+0z%z-Ukw_iDX!wH#q7{bZyth-?!_G zBjNe&b!A??GECY7<PKWUc>7i)Atz<d(i6yq_RBGI=V|wKIFVA-HT8CC3m{>prlpCk zN3_ToiNg$&>}M1dd>-|sUaEWRs|mdenzflSZUUG>Q=vh=ftWuU2_I>0f4uR?-BZXw z54^A_MRKyMFKH+>b~39DFuywnwq(Oa7jDPnHU8pH@>F<Mn9iAa!UcnNr8CyHOD)f; zLP04!lrAbNDtrI!--wR`7y>TaJV0nS^SHQ}_1XTj7Q$`umS3Kl$VB$7Ux1xXBjxXl zUd6WP=Hg<c@9qZy@$nP@8|8T1uP9b%<b9!}C@En~$KLaQ4hlDEL_|QOKR&tGJ9LDm z9cBANn&GswAF~#I5BE;L2cFVd479W&FjozbH8uG`!wRm&SQrdsy8OW587ivKGZ2gb zodaU&E3*PTh~wq36+8wh&_(*)4i$I4(AH*6s;VXA<iwXu71~^I*VWg*9<cG3baLW^ ztc6pwb=TyDgW`^%iAnSv0qcZ3$7WT(QD+%DOmW7B#eS+&>gAo~p;+DYG{BbmHhxt( z8;Fp~{$6Xv6K>0KL&C=6rn@nTTxCk(d)R;$Mn8ZOIXniGE363rUbX5!;EBbv<0747 z<MEWwxGv(n5lP<wx9Jwge*Q!mWW?mKy+#_b7#zejG+Q|T^B0xCPZG3{R&PJ}!$N?D z;P|+_pz-|&FD=l4#>60ujDxPO1E!FG^K%}L^OF$CDM|DeG`hrt>7^O;a6jS6KQ3x& z-1k1`nt(9Ty{YjSoHXAf<l;f<kIV5f=5!-quWCC!{k!zL)~H*W=f+cnL}y7l-sq0c za@SXT7a1POe%nc^HTkl&*{p($9YQGTlRpaDrjaH_u8}+E>(5*iGWg&?>F4$9*AYK_ zkl(C&puSq+aRAK*5LYD%^mBCOi@PI;^85FoZZ>wi3H%4}B)T5sn%Ny1>6poM5~wk# zsHB{1Px=c#SG!mKSB-r#N<0{WMvR?cD1|k&xmggD5;+`JQ3<(B86X`qGw2{AQc?ML z?@_(saGErwrCshj-SQ953#REYwt-mI(m7vMvI8I+aZ~kUvEXi6CG-4TVS9hMO)ir? zOop1$@YRd(b5l_Hzy;CH-JMXcl=Y4!Q5F=OW?o~9kS*4Z{evoa@-@nM{a;YzTm*53 z{gf}69pcWPMESFeOx*gqJQql{Nbo^yS+9Xs@Ukz4e6`Y*o2!nhtg<lqpGJm+h7IRt zz>DmiiNd=lz{OLZ+g3(ax>Th)3;PWLP}r=HtA6_X+gb4ZLMKNv0d#BL;AgcneU_go zyo#Ir2ZE$u4%bU9E-q4m5lV9sr6vdFn+6w7C@gGk;emzAht{Hg{p;t`Dz<%UjZ8)W zoIIcNz2Zn+id1?=hDlFEVg-RuABbhub#(xBX21LwR_Z&y_8ME=wEY*h;q(!W|Mz9> z?-(MZe2pA3iTTz4i3dBDyMA=Lf-9XYNg7>?+RI*@_Ft8ma_4%4O8>dooo$Bca`sYJ zCY+lk*J<yJ!Zn4&-9E3q%D_Eb9C$9)X^N!p|KtkzKUg-Qy$J|T0LLd3!Rn!gOz)Q4 z1cJ#vZZMUVLQ#D-$_G{~)uOt}Xa9N4{7+Uud`V@cv;ydscNdMvR8vzExcCF(;(|J| z<J?S&jO-5dQ%KYD<<3T83XP$i2^?m;C|T6^Tu|)<ILc`JOQ&`Y0X{wyRe+3RWOi}h zR{8Nm`}Or+aWR8~b6QCW(d`xHpN$BlU2?nD7vEkRZ|E(zW<Y>K3xFPwhRwbk{~VC* zZ|#waArXTC^2|u`cmF4HkV%0_B1QGSdHwHR09@RI#vxFFl9CGPp4W;9ghS-j=}&5s z;r(zotC(L{V0^jXtjMMW0K~UxK$kvsYcYhhw!$G`lEZ?Qi9@^97EibaH#d-UY~0E6 z0i%d7DM_RfzBkSr^VB5|izf`6$m<X4UWeirP;Yen@L_+PfD@!fAK!<Uf{`&2uU|jA z_7R1JMX(fQXJL`@xPCpqu%Lz`r;SJ9PbMgcnV~zIC!-`!J;<F`aTPK<V9IrW<S*7W zKTjCL>EV6XAXEt29(sE8y9ZSAR5UcAKxqjGpU95R&XY_<8fDnze%LXbKxcSs^Il$_ ztE-#c`1%-|)qYQIIgdChGFBY0N@Cwp!tPzQ7udMo=&&L%J+rfbH}@VqSsaaSrZ>$# z1^UAVR?|_w=`z-R^-ASikTL-lwW^8~qsBCoeSLJ}q(*Cn-uY#bUj0Eug}M%lrp}dh z{oy<BXWA7S&z6<N;R%#yv1pNzmu?=!)2jB7zpw5*c%7(nxr_>P4-1}|ZVwL^M9V6D z58UN8=gW8{_BVXwDX_mo{P^S~RHLkS)mO}<1A+-^opr66JN{sc6_JR!@nHhFp!Bsf z7*W9ekOc>4g9<CvaGF8P!y7YLnE?=G80ETd0=(bQmIXe(2K1MoPfwkH@9ap@;_zNe zUo-R(Mn!LpTYiJKwM@Mq?GDHI3hGP=viljCMYXj!KuY4^;tGn5waYuf!^aQcL=Y0< zguG&7hiZUV-W5Qq059tVFK=jYvy005Pyr;@(7UIWs<|Ks(~wY9gPAgD_s0gPv;yC^ z8DE%clOX43CBwCT2SfpWeggdM?drc1!FR&U%(xH^n^{r;K|vVHoJak#32N|>wQD!0 zJvlj?k-2pkD#0kftXtAYHVDMW*LqZ9wm}mR6d=2`ZWb3PEwQOEBxLzw=H?oq7lMKm zf`66}YE|xPDj^@TkDp?T^WSL-0l#}qQbA{=F;Ss{w`qm9ndRjyviml1!9cc3q7UU4 zU}K7k&Q&h~RRy3xO;cur${WCloj|Pzyazp5M_U^uQmU)>rhUWT#!d%RMUYy(E`rpV zULOV{ULQHU;PAOd0y6OWoIyMguBgT>e^&c0Y2e}ELm>OM2UyQ}5j8}-){^4ILX;V# zR8+7_OUodThdazyroYb-gmm=v*?<BO1q2yL0O%c{rp^wQV(BD!dPIAC%)=%Xj?3`B zyR2yP-obdh*{*%*%Gn2je17+NzS%_R@x=N=mb8k{!(zSq{(~pxPv)P^O%|_5q~pnF z0US~y74ZTb<$P`9<eW5ytDcyskqZJ5?e@Xuv*Ln$Y0`?L;ByH2p@jjdJ~WDLcG;QR zl^WcvlFGGoGsxt%;WOs<L-mdnaXxc~fglLO#i08k`1w6TEDfmQ8w=x*0pS=JXo}1d zYH;x_%_t)&97~Pt>G7bYr-wk=?(9WOYdMdP3Fj^SkG8ktfEH=k9YzQ$ROs2+ycR4# ze-4g`$?({#aBtF5Rjb-KUJr%@fMQ!mw+UsTl7Du_=;q1V=3X>tSTHqR4k;@mfxH4O z*{lZ$%epI+9GsoAtYVZ8<}U-%xy!j02xBmiY^x6`{Lf)Pd<u#*N`gQJ2j#A}Qd&I@ z>iG?AY>M2M+MF*?K*_o}zeNLB^5fkSves2~U;f~_D~^honE!IC3kg6pNJvN_8ai?4 zB*w%CF3^{ai5Z}OF;AWAjb`+?JGgSZpRXbm_CNxKl5g6qZnnRohTD^TXxgx;ixhW8 zfB2oAgabKC0to+1Ow5KI+#T1*xgNK>>!9taM@j6UCzfOm2GS?pmnypHdA_%^cs+Us z|F!DrLS0i6?z&y73?C?&{h+C%yj0LdGnzBZAf7x>x~$Vht&p0foW7(b%_%9PsJa>p z1|~2fCNu8w0dcJ_c5k_{Lk0*8ol=HD)zyRG7f^B5z;6Nd4Ks67a|;#YE-Zlos1i(0 zO&(8==c0d90Yd#w+b9xhMhvwl_T|A{^Mq@x*p0!ti)-)s?idXZ4_fH!(CdRnT-WWI z+P{HTQ|4dXk3>N`7uQc7VuhSX;pLTOr^hbAfvwljrD109cLLoM)I7REka3MHEh9in z7T<i_?~~cdHp}a)wqkWgY<xZ<?6J3j&7p#E6i?4RJ)6H(CG^Kt_J;ueVEe1#IY7;z zOaod^D1mktZqo1f`d8cNpC@-!E}v^zQ0Q+QeAK6Kb2IipuOQOq@;JsqBNZs_6z=}v z3;8n2`9g3PmeAz*#FzN}`?P`PoZz*Zv9+5Wi(I7~(d&cu7k^22K1`%H_+I>dE_^XP zj*v67^_roI0mR#2Vv!_4%Y+w@HPC>tY!Q1QNJrP3Fxb}-U;!!lMsP2E<8n6F_s#!F z^!L_|I6Vm{obCQu`OXhcKkP?4t||mbp}{%rV&=oC$dRogej;A*pmHMMeTfG48w-aE zW~xXm9@<YRC@5ETaM_ecTbsQ&^$;8D#L3N#sLVZntCF0o0Sf05p0A%FpdEKGqZ$C+ zTy*(7SF#n0fh1TwSlDLt74fOlfwpz<ZE$doxTPiG&!Hi(&qzvRouD&n+>(cIdlMB1 z71PsYkN^-j0|R-5C>Q(t3E&Vs*8a{g$I@50?6gAI*&RUd6KF>|KU_fsO)0M1kr5sk zaEKUP2|%TUbam&1hWEd^zHeO)r^9sG`e`;0y+tTSh1b@mWCHT1hq*2ihzL%1ZW>7^ ziTz1zcg6!vCm><<s!6tT*lCZXC6dflK_k9U3pwuN^`<*VABS(Bf`=D|w6ZeCj~}gx zAJ&DvF8-o7wkHi>(@1}DFxWA_^VW;(HMaMuE!r_WEZ@pwsVHAt9D8oXZ~yAz%0zF} zKmhU0n>XMR5i}o4y&egzc?D7YU+sN)IM!Xe_N_@Hi6moGG>DXtu@EYv$vj0RGnvZV zAeqx-N-9b+CE_+mrUs;v%u|th$~=ANs^@w3e!u-3``zE(@3H^-I_fyY&wa1o`mMFD z>pHLVJa4V_Idhzf2J@O9*0|L>`p90I9=D@j9Xx90u%7a&q2W>0nPu~wYsP-0P*bG& zM$~yvzt}+WJh9EoAa^LLxcIzouJhv8*CzMzt|)x4|9<G$cvyqXykvQ~sQuG*xO62; z3k~M##7T|T*4Jx*V?7E#8T}}SJv}`gcz_76s=Iop<=CbN?`oZ?9x}B1$}{qD$k{{% zEo1fbeY;#YC-ic(BAxLMHNizPyXg>Y&^%>jJwGx$=_)2BE~}+o_h9Y{?Ra}zG1K+F zBDIjXht=n3KD!#9cN(AvoW4m<EC^5Cc5Y_xPrI&~AB}E7?md2ZQbIxot!1rpgCoh4 z%q8tZYDbS=q7E2?*vK8MbYr#0@PKWggEciSAaZ^@e^lbcweXY&l)?6(2)3e|C^_@o zA|o1;z72hB$kVJBSjk!2X--=na`&#Rj((~tp4$CIL7a@smoHa4spl0WtzB&>otg8r zz@&V1ysx};+_d36)d%hVLQw8dCmUb6T+lv5J^ZnwqhqJ&Zf`USPO?vN(xRunw1@Lc zKwxdM6y4f+j>B%K&>T7zhWFcr2W7SlOuE=bEnBoeskblFbTp{-rQGXh@$o{~e@w;2 zWz;*Dnmtsnf~`{G<zF*-EsBq3bFlc^%F5Sw-i1`9#v&zg$ma+P3u~=4i6ueoQ|yse zAdW3;Lkw$nJ=`w^F31I&d1){vk9XRYum~7rEy5N7($7k132}1?zIV*d>>hIMiBB5` z>pfIk-iOINJh3e^_0p)+RDjlo)f;x5U(%Krbihb<!T99tJ$5GMwQYDSLp({OT^q)- zS0&bosH^X3*DDF4_sVr^q$|*_R5ZNNuNvjXFp<CTDe%ih9`s7FZeEi8-CT?)zz19A z+}`_!H@2)vP&%#EIevF)TJfw!h^Be|gr1lO-4Q95LQfOVQ_^`9&v%$zpk3CvqjVP} zIR&0<GPY)vdk~(zLa({~6_}$t?VoByJA{RY7ru$(6EMiTDzx7ilvZt%DFc&A(wYto zJfiz?`l;gdy^haEk~u<_e`b&7lIGtZCG8fmW5s6+`uQpvaz>KyC?!Ob?KFQ?Lw{1y z?@Sbv{od?l#drj7-^x2Xv$nO*`+XhA^V+xJ)$Og7)nP$G*BY~(xHq=*I{$oLQuO@b z^Oq^#E6M=!#xyIxj;zl(dhFO`w`q5UGbcAAZhkZjLxxc9K0U(Ou~2TI9J|cec1(r6 z`#0oH#a~-Y)XJY_R+{C%1TW~v2}L_e$t8uKi<m?|eR|c&hPE&b>ZO__y(^FJoQ&w< zYg9cvZS>J=WXqN^??+UY{FxW@*Opvk`POxCdih0*m-fnoW1QEXb#Fr=_R#wzJsMlB z9p(17w=k{h?^ql@Fp!v-SRndsBN7H-)>T$b%B6`q>jMJm6F9sRj>UERx4SSQ>;?r1 zF85n*`+fM#%Hf}c$Vm}?nwps%*H>ipt>ZfZS~D~0K@zx_<nC7Ic=RYY4nm=_)Yiwn z+Kjx)@?lR_Mu^VSIt?`JM`?53j>~X5eMi~5N;#WBs<_Eac(<Kr_;$|#ORf~n1+=t^ zn>O7m!YI&46SE(roY;0U+IUY7_<O3Gc#8;66Fktu7H(B;LD6v!Ggr|_pM==42=()a z){G~r8S;DLq$C*`w%)3aj2ABo(-U>5*~ydFAZS|swtVAGW*CRf+kA3!yI*p{Sz-&^ z%67NQ+I%bHE=rhQ-o4A=ijxlN^w+r_9=h3gmq(q-bC$AjKoxPi>1|7YLVs;4-x50Z zs~f%Pxw{H4GOev%dD`(@@ovE#Kx=14QU^zx8oyG9bgbAWf;fS1MsO}aoW&VbYCb4x zVQO$9zFIS*e>-K5lf;p5_6n)cu(7qnVpXG|Eo~p^Po27D+glTj=%`BB(|5Y9=wQH? zT3rvp)k}AtE<3JtD9;lo%z~$xZKFTVRBHp?L9*1ax$DfkCQEy%oSbXiLfkaf39QIt zGb<OK+5a``J8gp2$g=n4?}O*Z&vccb40=6hFm~$uTMt_ynmv5Sf9|Ez&2wFbjS(QN zo^%(huea9Dw&j)JgtWlj=>{yiTYNG)o$Jf?jkpCKue?vS@8ZD`cD+X5W#Oy&QS;-m z3P$6q*@Lg?BdDRJOBVOo-&EMb)TU-6Ip;Dg+Mg;UE-m`=V8OfhIptGheT~ES0<OzA zFzW~0JK7^~Q_$d}L>^#Dae6K0rOGWWEguYHe>GM0uj=PIzedUg7Kl=|Eyu~~>K`?g zcO+Ewr<JaH?t|9gu$Q0T;YeDy=1e!X4(5&q6C_O3izB=imX<i{AE<5lknP0PUytzQ z4PegT!boBU+orUa{Y|+mjE$q0(C-)AzFp3$f1%Q*G2Qk`r0NX~x}Z<6Ew}_lWjtsI zpABch5Lv!_m>jEUdj0O{dZEa7ihGC#zNqyR$RJO>q694o*`QQYR{rivuKdUD;o90- zv~yQ+zOMS3r#XG@CbFUDDJcgW$D}S?SZVP*`D31JmaKW*Wh8dmtN}~n;xs_iyyQNs zn^`n~!Gf=F^+cVY%Oi!uvu<EHTQyh60%bg9#IsK;Yzd01La^<Q@`pr^H@|*_QdKF} zc`bm3AI%>7ZuQ)Zj12Jg9bVGTc<0b&6b`b67XH$1Q;#%{uEe&ovm04b`V@3h65K^Z zL;yO-VxKzcQtZv^k=%n$AuhE%7WamG0N3i8CcgsSx<~TGkq~Lc=&F{tciy4xcP)9~ z6REiPuQKbddB^hWa8uL#@Sqo`T+e${guX~vts>)}J+tXiUjlY;Yj5w&*PO+CqJs3} zBj>qC*qVml2b5*Gtvh43XLB$|;+)+}ZS>t4!@@Fbrao^)`l+TI&fau{;U=G+&aJYk z@cMOJeIMAedv4xH`rKrB$zH14PCGXDrV=Y-ZGrQ6|0?r{FS%T!M?rOL`OM|<D$Ybz za<@PX2hYYB2mJ2h1)!nyG<?%K588_A=T7^`T>;lB<kt+x9N%_l)%`8|%I0~@fM6j{ zRI1FWezH6GG5z5#<xSkG;^ODl9J^AtfO}6}^p3&FYkx|KX8%<4{QOIA#P(-H)%wqi za{s#MONWz*%(*tNfyPS?L7a`^(gfbSQF=1smQt{nmP=6;_p^AFhgD|T;wyjsgzpG` zqUhZ}$$2b5-S76hnw^EP<?#Lu3MMvW&p#-4kW4Y=QCYM=e8n%})5rbyzy6`cvS<Gj zZ)^IqHR^0W60m3LSyEDoPm#Rt;ltj?9)FDU_sZOhDrGhMYLG16y8HqRv$SLRg89}k z2D{DE@bIZ#_R91+a_087&4I;yE%HV@C2vl1uyd0J>{8Q%xU%NsM<It}Ece*i?FEdt zuHiZDzcSmsR`s_8OG)%YSIxCM+t%{GFCP^!u{xVH@_k^8C*)lLOV8&sYd$urNkAI) zk%iUp>-Er37HW3(Yk&&SjcC3&z3j7@LrBTDwzkVM^E0UxgfU$TLQeJ;p5d6DXO2)5 zc+%3>&8^nOlyLanEOWkj^X6&}jsQ@p3AN_Un>Sko1g_}{41A=b3}ACrKY6lxaqx}# z#d@`LV8mSky_(K|4$mO{A!-fKvC#JQS%!=PJS1<G2$6?Cd?=nMwhDf+)s}*9zh%o7 zAQrW$v{hAA*ZuvAbgXk1TU%Qv2~aM8=}+i(Ppi%NwO%X&DHVUgYj5iq8W|xhyJb#J zPPvs62)?I2#vDZNghj|`k^B6t6NTu72x%->=_(N!K%zq-8iyM<R_B1)zLcI`QC*!G zTo$x_miWjoFfcH<C*ed#QBza%1bxa*$YZK2R+j@T5)5j!kNnc*%L~y{ZRzV<1tQce z68<5#@kS>bTiZ(@5&5p&j&%58%~Wtjb)6%H0%c9-+!qjduAy1~NgAxWcHa5|P`7M< z{y6&n-d;v<(E4W9!W`yN_WSqs2``V#*(wa|ikF_hymmX2bI9@AlBe+>+2mb`KFN<B zT`mvX?M-7iH#bL!(}dVARHEtVD8jhhs~2oCBsc!WB_+EA1qH#}2JuaK3)72<i3{Kg zmX!Ffe+?esTky4U0Fod0`>#v~$xg(f`@~pF!NR-u?^h5~HXVm}5sR@hKXWR?059&{ zySK!4w72$Fq_kUBg$b6*?ve3v6MrEQlM41RknVSvuw;Y%FX7P56rYfA8hqMbh_;MC z&z_x|9w09R&bA{YBuhMrTq7YS=IZq9hlg^?@zpQDj7))j>rT9c^XRr|h)Xn)wvd-w z_zF}Z>MqE=3?Wj;%*;#yQ54MYuj9=gmBobRjjW>t$>)0nwy)cha|)ZBdv@f`i^Pni zrE`E`7=&Vu(9@A?O;7bCYk?<xWvuFi1Og1dm{@3EV|Iw?%eth7ML_7~%~b+VY~S5O zcUUF2;)n8SDYSth{!>6;I9qYg2a+M?q@<*>va(l0?WNpz4k1@3nmS~7+<W(~A0KF@ zr4X_-6jXrgG{Gb{GBTo2usUTSmjLCB@by-*3NQ7T8KMP0?m8;`c08?y;SfOsIz`1& z1!Ln;D=QrO9dq-akE^!6rk5##VgkxI-=onA+`D%(VzZHAp9t#^LBa3@84Nz7y}kbH z^e@ox1Ye()5*B6x=?`qT1JGtr0F*Q}tS?8l{QC9lh4|0+xBk#kVdoRB<dY+j%Tde{ zrXQGM6i-~%9v6GR5cH?P=J~mGR#sMDQ%zJO=G9}`$#gbm!}V!u8^lc9tC!*oSjET3 zM{%fEJl^*TWIW6kIFopDy_~g#S>k=Oj2AMdw(lVZC7`ypc6a-twkMP}L}E~_8dNbS z(cfPe7TyR8^MR-VG-^8NQ`(+DHDmK#F_7J786$5ROAvHYM<T^fb`r(L>(&9q&ACG* zY!kEN&D?8z2njVoH}j^;>l(yookHY(P`ni^%sI=G)uaZrr|ol{`1X<i!5h=C5oY z>i+!rSR9oF_}fsE%Rm)Jeh`gY{iTNwxs{cb?Vn}u>GK3FYkdE~(^BAX%gM_xvTDp) zT*3lb3>f6Afcb_gUjs7?(n}+d-*FDeg80lTWmncYk^+AH`$&m(;N=h{6-7C07j!&} ziIh;ZLM=oh0TgO2XsFtPWajo^i9@3kNTrJTbIEX0Y#<j?+O&pWKZk`7twGQg1a<IL zZS8sxkV1Ex&^=KOTL4iTC@)<vRd5Kmw6|ZmFXh4`EPVU0uESc00kK$(W+sM0Wjv%I z0~Ip+{8ZeBw@Y8Uo(^2~)$7)IW2;m4sIG=t(W-9iBn}W9_a&--3PB|7>e%9wz=y^2 z<;xcqar-TV9op690|gAxN&*do^zHy;Ie26rKn~TV+B|%d1ucg+NSVe%ZN&{*1(nj% zEAeE($wc3y(3{Ks`lCmWnA^egE&``=u)(gf01Xp}+Fn08;J141+Qk$l6%}xra$9<O z{O-WDG194thQco6&W_WP&<%lW61w?0Vb<LAH*D59m!PBqi545|c~uN$->u{rP{@nG zOeb8zb?ep<u^o~r=i+_h8s_!;PoLg|0km{?FUJ8LBt5nCnZo^nI$a5n)eAr~2C?|# z5j_(`wW-!KXPeGqiCCR%oj7iSoGD2oj6QEd^wGK;%J##DbKl;P<S(va6E!OSxS501 zU`GiHbOGQttk}3QddVk{kwI+K=zNhZedzGvqbE-;Mt+t1)>N34Y3*8+k9h?z@C^cs zF#ECH-p<dD-k4WK2x|}2Q3^;$qaAvl<>at0_j;t_0AtEJ#|PDB(DQ=#*l01U@^T?G zF;4Xe-;c7>zbR>D49E(EIL(>U?|5H+^x28-Ncn9i->T<!J$ZRSQvX(nCA12?eSP&O z^3}FjoZJhRRlkDQ)P$@1t!3efiI(wqHQv2?^`QJsR7#4_<{Lp_U(y#sF?wm=2P5)U zhc-Y4;Ig}o&B1+5S8M;ZXuftKft?iD6)Pg&-hOsM?EVc3y;BBVVBjyVTiVr1(cYO& zyTmq7kjJEq4>CkHds&{cqN8^bT|~Rc-o~C}FWmC$BJazyf=hc(`I_x6Efc};-@nb6 zB@yxKs~-V>HeSJ!`0bM2bpOYukMjElnl_V{=vr!-m-0kOzk$=%{(4@nvt!Q$X{pL` zYFHlOQBlzuUvj&`@Z34dCEIuOlDxm(bjs9@FcIrGZPO%>*Y$LTv9#_^i<kSAP+e^M zBcnT)R+mI~g$&}G&(9*>-zxT)_CLDsvj3KG>cr+tWFy<becJBW!Exx$q1avM9Szzz z$=U3qtX#Qe;P*hyaI5!~l;y`}X|LatT*lnNEPm(cv)f|KQJ#!GJ}i8<9Bi)s8ehz2 zT&aKfaOvlRr)<vKe8}{FtaSZ`(5~L8Gctc<w~hN^4cOG5op`=ev?lvrW>{uLNPfK^ zET@bUj)xpna+3RXP#K@|Jhc&lrlr51NM3;s8ojx>8R1Qj^%jsT<XPj4I2w@EIhiU? zUB7;v2pf?6KJrd7qlKK{0wS2VAcz-A^=fOhR3Y$s6dj#{NQExIMuat>FgM<P*JITH z8y5oJqx$-RP>}5d+X(tLyoWRZvuyE2csUDN;`0S=#=m<xEiC|`KoFohN22ojiAux= z1Qg0E2tKjvS0ER|2?I$7g+fFikiJ16(3Y6dbQ$^&jdhfq`MGH#Ab{fKF2B|Sq-8$x zm%;tE9Rbg%74qY&+1W19Ca!4S;wbnKuOayUz7!kC>c3){aoG)SWNL#WBXSA~ODHYS zr{U`>=$Bo%Acor156LJYn?uCUB4)Dzq6&(a>?I_JHt!lT?MxyUjdIOT&?4Bb1Zf&$ zgRTh&G&Eu9Z@voZWffV*uHSw3!Sm<O_2#5w><}O+uaMKWwzVz5eIaLrr^aVfE-sH5 z+gp8xI3vZJe{La(1T@l)bG~pYs?s~#VfjUyZ(c0gDePpFM}hC!<+<;+9^!m~|2)(P z`%<KF^k@NO0<S4MJv=<pk@((?h=44RUqT{cnU}2Nw=xEj(?L!Z780_~*gplqgqLZ# z7DW6wa*T~j{7(^0n!nK4V5=PY0p@||S|dO<b{TA;IjpK`60Hzm<W0u`;VUn*Uu~h+ z3N6s2uTViFeB(aV#pgKEp>p@ejaM_Xv$e>>q1Ed}Y9N~JGA{7R?4?C(p;s@NB@F{8 z;xPa~MbDw_NH_h&D{|&76N-UiP&?{#T}0t8iF*(TY-usXNW!2;MQ%uA2xVulZpd2U zKe+%eYxIc<j$cYDGE&Cl{whw%P^7XVtS+zwaOsS63YC3m2sUMFI@?9b|K$`fj4gs? z?OHGBu84jbQYAPQ&`^5oUaq)w=@Rme0+bFr;Sezc=_>WY5YN>3KoI7`=A8kY_@U=x z3$Vo2BtirT@|LKos`BfkucV-Y2ykk4TL&r06$nyZym&#OK-DkI%&++>z|zj%UVa{y z;4>4p{Mu<tJ!VJO6&4m!C{Sv?22X-;x3C>IK=On>w*sC!@_T&7fdtV`L*mA%tEVSq z@pUKB`+S8w>dM!VkrCUrqGkLBdF&($ly()vZ+x2b;Qx3Ec>+|Yei{aDYjHzR!CVgv zyavU*XI5WyoTDM!3gCSIP>pB|1e%uP7z>v>c$yJ6HU!Bpx(9wX4i3c_6prGh0SX{{ z9_!~55J;*TMvyCe|6U%Z7GDx|ybt&>+kOI*i8_qQDME|R-q#fHDn40&2($*vMVnvM z)v<!Pi4Go#?$2S`){y1k7vTY~feFZiZ``_dCHB7a^8DE`wrliUfyiq7S%ip8AAKFz ziMJK`KrKr<)>rQh^9CMhgD^$JV?qcePSTO%$3KbB3knEWt&TkwhfesSsOB!!8$5l= z&5mT`2$_-HR+hgCW+@zrl@Ov5O8{)7OG4K^e?9>gq8vZ791;;^<Y3v7bPIZ*56K4k z3YF|=s*n`UuCv1HSX>dtK|?wIL>Y=h8XSJt$f>{+YzU%WVxTBg6i9<ffeO*TC!7u_ zdqiK5vKNBDiEp=5LG_XZ|J6oR31!782-w8jri9Vy1qu^DY6r}eJWjHloE)3kDF=%N zYOsXPdW;k~`f?oGR5S^RPz=S2==C?qBT@Unf<z8FU=&q0(95eQZ|rhSv;>EY8$W0- z`40Xv7xIw(v*j<rk6nl=+c{x1Xoq&U<-ahpvMz@xW+jI>6Bx&XKYz+2HGZNR1r?TW zv|<p?mMu$hkpB1-OD~{H{cu{3NTa^L3n3|Sze4~?X;Fi*v$F&3yGk!Jvl@+<#K0QJ zdIWO@7htQ<qr#t=Xb-|ihA3Pig+f&oLsL_e(!qnojzA48M@UW!>+9L@W?(g~Tm&LF zILvEsS7?IoM4&@C<BOWsE@UIhQ@h)D?i64h;V>g5)7&Ho^Q<-4q0b%rw28X{;DP7Q zKlJs<$GDuclmN^if8qoawhIcop(;hL{nce7dJ*PiZirCmu7F-$T#quc8JQeXphKyV zxQ*SToBy=?>(Ol^U`Z(ayu8lvjA@)k=1uR%6VB}l37T0ka_#ZOEOJ&>0zgVnfzx5A zt*_77+uMtU_Vw8mYOmkvV!ZmD<YX{>fqX)*6F+hhaTBxU3~-=x1a&ivEYh~QL)Hc{ zRA|QFhY8SVKt#t<`jNZxqZH1;b1$`tibh9ARLA3ZAL#IDIwWWOsHSs1CZXO5*{8(( zOK+qsTTX5pJ;HNm+nM+#`%l`4%XBI^;lZWtBvDlvUEx(Iawoa+g-@R;>Ey5*??};X z=swfsY$GZn@?_DlP)(iVhSf`{yBo?)pK+)y03g;F!O;A4<dzbWK6a_~LAIA@R(D_U zNj>qnaOmoy3)F0fKhnUM&8~T;I{AVNXlTTOL$Bw02mP24uvlSdhikYe1|k%GrF2R) z-9I;d1f!?@^e+EfZ^T`yey2;39~x_aeI@@lnBSN@Uoh_i=Wzj&-6<)a0|Iwo_}ajc zeu1g6?%KrmjpR2k>b~6TBfMviX^@yWKH7q2QOORO!O-6cXl(hx7_E)ga$R)7+B=eB zO^mKqen_J8`kfe#6b1SSGc0}Z?=ZuUj1j-xkZuIZ{b_>qZ=hu4Tz@a9N%xeLi(aPL zW5OffYKBI<e%-hV_r7!IgPaiZ!ZGm<&TB662r<--b8R?3yh$@u=f??!xMOXat_zNA z;x)Rb{H1{5m*vupyY{#eY3Ff1uYxxP`#X2t<>8hsDSO@%GW!PrYQHej-BL5|SV3Wf z?!ftuvmN3FbMEX!xJjiBWpoLP2K;(Ui3c>-M&YLeg5RDAR|F%?muBc`0iAzMLXx7Q zB32MqRSOIgk!IGK67WJvNhu;k^}2vreL=Jg*?f>)MRea$+JpnfUE%<iK+N`|NF7g} zyrUo0(*tSXYwT2;p|%51UKxR218x{QBq<Sa&ev-cc*iHd?&Wm0di()ol=xH|6!FiE zihTtF{qgLaP<C%88c-Ynr17fnG3$VhOhW+xuo#dWQZO7l5AbKd7Mv_`Ru4|PqM2=k z6BUk1Uctdfp?T?APIQl8jv;s<K+yFyTVFaBcY=g7rA?RRc?zJI&fEoETd0^V4?Hp& z8XFn7xSCJ468Fe`x8=LHLhef>h!s&XL1}5i6B84!K(>P94ZcYW)RT05uqRQp=T*I{ zBnSPz4W2;nQExg9G?j0DSgx`$W_!+5cRb!u0S7b*dLFYq1{6;c=S@vbl@1*$#6gvU zBnhWB1L}Lgk3?<`q`?cFRpa4rZ-}mWT{5bn8)FKHvfT#KNwbY#zAzJ(8b2|8L7$Hj zRayEsP*i5YgdiRzfiE?ZbT7rm@-gqwzKZyQ=OH2ya3g7_QPEP#*`J?Sq@0DJd7!5H zk^t#4kV_QmAjGePP)(eKPefMqtJZV54$|Pz0(u$<lb;#jXnHxM%&OCgm1&F3Mvj6o zT7=jpbpD%C{|F2kc#x1FGbM6e<Rm1w2R6GNa^Ri9!dDfd_k;hV!HeAB&36KbU0JfK z5ZE2mp8kM=Fx$d=$tZE7{qu+^!~|y$Z@Q48tfG=>3Mn)Y=Os}FpB{gn(~(F-h`hyv z;e6Ek1G6Lg>ewiEUp%?ncki~51qtL}!>u>OX9+*#2Fwv5VtM(>m4#N#d8_^o&H<vJ z89N8y(+JiPTR;hg?atiHh$_W1AV4Mc69ww9M-}vq7INa+SjF46Z6oS*tXadN>kJf6 z)HJT6)fyOO34mcJZ<i2+2X_K5E)u%P^*3)`=8$mQuw~0rzZ!CCxqyko5al|&3|as% zb3L%qp_+*xl6fr8hiY3$8U*0p7&bdBd(Uqo>-uja?}L80-7JLN7#NRNf`b__($#Ei zD@;r}&&Ja1F_8-h2*`|r<<pZ?(N&XN8&@wiw6Iu7OG|qjpj%Mp6s&o`U?tvSph7+b zVmQ$$Grx>NROcu&P8l071ge~%nX&*WqFyE|hAvJK+&v=FQ=j1!zq~X`d_`EZP3~LQ z!Qy;|+?K@<mvo;@`gUq-UK5pJ`(1&q4-?(|sWFSR6Pb-ts0G4^X_xk?b>8Hp>?|P` z2}oVBokg^qfQ|vu1r?H2GUP?3=~a6^&^$<dwEnhu0nkdc`Qq$M0U#)if4IxOwP#GP z?E7#97o+JZtH5KAj}2@(7I!SYTSe6JRIRc<mSTWAXncm&*3CwZcomh3ng(IntXog& zXw*gwZE+l{@@~vKitxnQZzblui?e;f!VPK9Kg21=9r9{lwhV=SPs@+r5$f=S>+1?t zo+}F%*x>Ybq35ca)cg7u7_g64QSsMx_ElX6V=i5yK_iFM{bP@QAsb2(53^JMz&QSD z8U6KfVSPTpGZvNTaV#K_tc)?PT=Wam8^8LEfpk?F8kJTYT))2G{tWRdF76=dX02Sc zYQs)udj~jlk-NAj!WVpYRDZfg?_8R;u4-k`(x``e9Ls;dT&E8QqbbkoebLp9e_kKM zC-R5KABXpUL}A2d8*4#gA@SPWv`g*T3Gq8AJ4L;{v)L{$TwrLp@1h`iVI_^8pPPo! zvwATgv+vutgU@$ne2DWu_P8izVi5^~VqpnaHvax(v>jczQd?X6$&uw(Ze6)jafbhZ z>{b8ZQ#FFqTYrzEYl--5-ScCQ(GSaP`i@q*L*C5nCXj9v(Vf=tKB|aRI>XN=O(s*9 zu0&IVkn3Y29@1P>AsS^I?KimPviPq-b4H>FPw-Oohw!{fdWRI8VhG2kuemNxsSc2= zyecj}FmUGZrZo-u9{IJQ@XCTjTga(j7pI1ZPSQ(M4mOA@ys?T33b5?p78F#CokEM1 z6l4A4W7nM!+Ymt4QZ@jEr{|PBcigS<0Jb;wE7>Q=?nsZy>}6Jgi0cU)AiT<<p71Yn zJfC*eUa)+0$IDMv4b)3;t`qS%Xl|wzG^TRZ9-_er8?-f8*w{91-@XF9vA&xuz&<X6 zkjf3e4Ll7rtz|)>8AO%2@M-43xXp+k9IVHkoyDOM7=$_6%bxRQdoltMu5hcOl9H0( z3&{L9(G1*S5WScTjSCb{=t>Hjo4F{@VU`o~<Vm{utR6Rfx6s@A`r^zAU^@7)Ie##L zv8m2xa3juu^LPq~<QoRY;R##VW5D%*mNTe^dsL=Ql;I=879Wd3(Pq~xsNmXQqg9AV zSL&8``pp^~S#~n8NTYb7%Tv8qVx(||V9U(p2nh{JN=uvE#`UgxdoTRQ0B>W$%;f;! zp{S^c_>>Vq8u>k*P6~$W3YW!I9gqnX!l4S;1CXykG`Fn6QEw6Bw_v43C?yaTC{Ops zQ{gQI7@go%h(c<6cAtKb5(<Dc1+Eba`F$ltMK%tCz<{v0D4xWO0aNv@!!ID97-Cim zB}724ExjDfebgUcPfH?d$ZBe`NYDN}j%G#R;ZXC81Bu_hohFz+;`)XD%ubuJUM<*R z)M(AY@CvmA!@6~`$7lX%WWo~29~I<1X*X74QUD}Q$gV>fh!Qg@9o_YRwl}AEYhoqh z0_y((ID=mztA!jq>&X4Xg2P)oQ2}OVC=&n~Ah<oZsNDs43KkJ<K(8of*JP0?;l2wh zE9v1jPypMmEDN_~riakxM7cUxXP!)4FVJ-Dtc;@l;A*gh!X{!tSc&pHrazwr>k5>@ z`y#U$_FD$AGU{8H96IvdrbUR6%kLJdA<A)wyL$Ot@qH1V;l`gy{(#{jaG?MW-42Av zYUTP}SIvW<vtMPTa^y(IR0pZYQL}l>P4am@2{Ij>ev3Ibgi9sK#PEnwX8Dfx)W~hS zLwqhUr4+Nkh1l_c@d&^|9MGyW3=0+jCX~e^MGc4DPzXNjb9_@ky@cid#g6q!`KDXv zN&=(&g&@@Ezp#t~c&iX~^{94dM|yTt6xZBnvd4bB1uRQ|nsl_`qwUUI$={!GJM3b_ z%P((aDt_plt?o2<Zsa99aNhT(w*~(5<K&Y)L$F`M=+;x<mhcJ=oF%jP<OyJtE)#>? z*w~zme#O0b#Ham*nAff?Cg@obfx8@Gb@7j#Pk2i0eyCOkBauSvSxr2~k>O#p)vsaQ z6N+xv_%zxfU$K>b{lnJ?nJ-@4Bv{xEOzrp1&Qx?OgzyURnkn2dkCmqU_*e?m*RT<b zuigc_G2+`oJgp$*Bi<7kbVezm-@knmW;<?d_HGtIJ^@DyzqIuI#$1;WVpj)8vioQv z!|ZLkRA#Q=&LjYcujoEz_7RJ$onEp9kdMB$jGsdC5~|667VWvX5f5~1ZQGaFIXZT9 zNCBK6En(1&d%wN8_5R&EzdLvDo*#0DmnIn<z@D8cn(yJ8pzUw)Z~f@RAUN9t@Uy@^ zC%s^xYv~R>c#_8ST+*jyAKo}~`m}KNY?dF6bkb{H;yF1zor<TBibRPw1Nh^L%-P3| zTu&RvNyi%Sh)%l2`Uv#PfJV|wPk5r)l7jU1IsWbB;^G>E>5^mZ)S8dC>t-jQTp>fl ztC7b6`a(qCJA{F0kNJUlp~uJGxKH<q0<5fsB7ti9(lRDJxh}(+3y+!192z{N@tq2% zsic0z=}8#3+zk(Zi!3Q~inXVdGe8jTgDUqW!^rajCc4D4G3VkfETR1QS!-hW_oUj4 z;H^Cg#}mn2!|RN6w&8gfrncoYY%R^lLceGlboKVW-?eKOwY`@(6`t6(HUj=28GWQP z<~a4!lpw5dN-4CAt{c`!);|MKl}r$b6)7Me5zH6+9aGWlF&|0#_Yl6Mvv}B*Rsw^$ zk&A|@E(d{$W#%TL^?Mo`9M}03Ta0#BH%w)t*$&Lhwq7CbM7mK>wVt`%rV^HS@3UTm z>$F>(vGzLJ#5`~Y0}YvFry&IZF=-o6JRx6&0Swv6&!6uEa`jR(Dm8WYFXu^l9@5@J zHxUg|;t2!ykejz|vH6>Td>(JN)tOYJ&kbonUcVH)QSnQdDC#gY$4h9rTq(#55hylF zO5U3u>p;gFFAkw^>m3dKOL%!4RkTo^iHV6B0x#E0F<K1br$5~CL^C-@jm;|H4s)6K zF(GRODTG9ANL>Qay5oHZ2~j&D3Hi8G^n``rz(^cnsxAhx?_B_S57e?(U<^>LVUTFI z<be=6%fwOz?K6J<xq+c$aHaDGKa+SGp(s2j9M0Sx<m*d1{%9vtol&tAbdJF6?39It zKY9p=XcUTLUmZ~7SLy+(earuzWAOH^nLQh54eZd8uj;l%*#NIOxUMm<vihR;{L2}Q z9Qee8h|ts!oh2+AmsW*fDtM3FTZ*aR*QKroHa3BfsLekP{~<!=#Zh|Q*SFAzkuUrn za{Js1C{q|%Se8Pffx#i;xBX;3J&6;i5Tzz8ZHTjKW>>(d@hHsY81ZtTu@%9@(`KLv zJ_%^jkof&RLX;kh01^G!aRG>`NLLB=c*N`mPmz@7@bnT&bT?SPX3YZhX@3qh6Q%&{ z<cQ3Oa7`l1*>;^?it0H4r4zER^Ro(;lR%Qs_W<kELqx$_1W7E!i#C()7K%s<p}CI0 zC`^7SX8x$Iu0NZo6-g^d2>z+x`6OL}0-GN{oq3b{7nf92R5YZ+sm%1eN0$Kl+=_|n z#^^&6I2D8+{6z#^4Wq|^%IUFsYunN8lddq-ba>mnOQGuD=n9q5A!_E>Tj+{~WhdAm z2_zLZ5E8SUf>D*pBZ6wTJ_x^DsI939cmkTAH)Iv6C+m}Y(#>{Eto>?koCTNL$V#n^ zR|?G;(-qrkUTr=Va0kX4U;{dQiQbCFw;~LtP?>TgpqtkSuuEQeUb~69IY_!J@9~5K z12Z$B9w4_dglZQQlcVv*J=?HGi1V~95Ep7zRvV&0Vp4p%9IYpUTlY^V-WZ8pLPCTH z>{&AXq9imTLR8#7?k<#Sk%Es$tJBw^i+wgEx@W~+v-)W5#1iZUAsn=%Ly%$BXtvYZ zQg-Sbn|m6kUZClYi}t!d;1PvZc8XP_II=@#Xo&RTqC^T_s$C}?*;e54{9wWvql&Up za(-q69!+e-R2oYxG(0@rG?LA))fT7*Vt?-?92YQ!x<p_PoI9l6h4Zy7LMHCA1+Bos zN|||GzBj05+e-`@vYqIWkXWa=|6SG2dat;vDw-A`@3l9#_}Vc}iYK}d7R`B)htHX1 z{$^9aryEvh`_POaZ~NfE2FgA#We`XgP$qDk6PsR8EL!o)<Wxg0-`d$ptEyUgHbccy zxwW;mK`a;>9eVFoAeJ~rUM$7VpP%WJ0WZiCvqv~+=yPdmYQDl2idBtTV!RT`r5Jco zp5fNh|A4_$sa$u0gD-(9atd~Q4bA7!)nVCV#xyq)HBWjVVPRoqm6ZVEDkju^!SUV9 z5_27G))mpCZ0pw(59Cs$dY~Z*;Z~N6tYcz=0E>;{iM_BvMuv+rSYzO^KfYQdJ0UO) zZkoskTYyCw`oqm~Er=2@Iuy5l-6086Q_XD09VoZeu#sS(n{NE`YFaWDS`wGE>%>kd zplCfj=6R=IXp@$UXZX-J3CG@7Xs1T#Dj<h%Yipx2(xSucE&K2lVkx$xZfq1_0#d7` zswRCn2?iCY5ki2S;GRyQp`mF=t2;B^^@$b?Bh3se4n*EygwB8!)uW+Lg5Xw6IwUx! z8*&%z7#bXeMFKtY&a31A2R}u;xcTGI2oB_8xH6~Mwk!0%w^mHBJC4}zWM_>sFGL6Y zKW<UcjK+{y!9zSf07D80z6k)a-vri%#H9~mniLZ_Y<S>TjVjUI-JRlzhA#0j$6JT) zwL2TRXyoYMQeUbr%Af=whf+2Tl4wHzLQm3k=Kz3D0=E37>6|L|UAuJU%0(1NoCuZ! zBQX~EpyQqKQQg)EX3_8|LE_IMd`>NrrbuP-=O@(^<gsAfL}s@ZBKt=NPd{>!G>$MZ z2>#cOjg6603ufgjDZ1@x85yO=Ri#dLYTZK8Lr_h)&tE@yi+4|Wnq^(uG6ePl?B<@C zNYc|s-vd-NV%YhkCYg({FTvfhI|F~J>kSRMU+e4J5kyszOzeh4;S{+j^=x?|HUSOg zk46qSSJuML*ER?U&{^jUE%6NJUI7DMY$dV~*k&c1?tb{72Kd<c$A^dT-0=kLhyt4M zvm!H2+2O;O=&*!gw^@jK1X9p*oqIOK%#xWIsgS_TkOF|1ehyB~oSokFfVcJbp~p6M zcCV?n?SwkCC)1x;L>@RmjNtH0hygNkA!b2+f1DhsgLz&8O(ic6H$&izminT=GIItC zSNv$sm&wV^B|f+3KXK}fp|^S!$lJaRt6R`OgN|H^G8<@`HHCbawE0kz^*Ai%1Aa*o z51^8d>}K|jlvW~=6=F+buO2}0Ep8DRktHXCiW&9|`v3vriM+QALdwnqowLe2i*@$K zD${WwLZZzjUaq63R}K$CHIo)=JLuoT)Z;B}^Dyb^M~_y0ODpNdF1LQ6YzJ&XhaY-z zEy4==gbUebb&(R|!rb;aRe=yuR)YfvyebynjquCgiVk1H{6Iq{xB>9%{gDGZV#50r zDhWOG*a(n-ztES~h0h#L;;qrvtHc)TaZRcev3QRSPA);Bh-<O4>Z!KI5k{M1HcC2= z9EOSCEw^*W;i?aV=&FksSp%L_*b<8fexS7l!`h!r@VV-0Hhn26XH3qXeF3juLO{U4 zVQ!2jq?Nu~km-)9bHXZP5h_TV`PlZDorrHUNtkRmF|Kooj5t<bgJ0P7QoEcbey_+& zhfK@dln&Wr%X@zAKlrOV6}HS~Gljw^c~E};iEXDyKW*>hL$%LD8|``F4Hy{}q%nPg zT@R;MmvEFkPnAn}l0%J&vGJ!iN#Me(1oAV|bkUzaTO+5T64}@`GARxvh``(vtbCfM z7r&Jdi~{64%~(xNDHqEol`#jXPrViNk3J()L$XBTBZ#ISF#5|7zQaebZp}7sj-<G` z+)U}u$105@f%fm)(Bkf7Yr9`b>3YRG^Td)iSNmE-0}(tj@(~dv$t8V(>}(0q<h;_f zyPuosc4*~X5F)`5K@YvW2Y*e7izL#SZ-I(aoFU?u8Jd^=)n0tIVeYe5*-SWRdsV3M z&=B=j<Q39fOW&E7p#B?`{PF!;OigyG4kH(L-*-d;NFhM$)by58p0K@(zydyCVR?C9 zN~U?_%s`x5N0%qf!YuLI0%%Dh{9&-I?d{Q@4qmOW2lo(JS^k^6nC#N#wRJZ)o@vbU zgHAiro%iqQT{62`LT>a|)YN3e%l-IbR+_NpV`Nxp=u9QwjeX@>qJo0SNp#T%VO>{# zWT1aYCP`e%M|kJXS7Kqx$-8}jL6tEs{|Y3u+eezQ_M>0-Z*a9IZBjWVU{CJI-CwOc zk8(yg-rtsa_ACFQmi<TA^>6rR|0@@TKpXKV=*k7%_Mfr_8P`1SKfm_)j}nLfk`Chk z<)S$c7bi}=GZ*=6W<tI-En=ean?B~S?{k*=fujY%>bAFK_ufDLvTax3$^F~yb<Olj z+-OQyStR=U)(t)N7yq)@;m~)gVam$K-Ap>$nJpDhtX@#`ZOx1KT!9&#fsf{Hul9|q z+*`?YaX7DXI%l#cB4WI0U-<P!lnpBK3n({ud1xp~jKLI2jE@q0(d0K#D5gAXD4xO$ z%P9Z(Wm{Dq-y|;+tGUG&zj}VT7c2Rl`~QNM{x6Q;|GMmP+=(@~k#9^Z4v>Kyd8oD# zH&^!Gy1D=BrT=?VC4A=)naX=c54VtkY-KVd(|hs1HogCn5&Yvbz5V3aLGsLx^D`a5 zK=yjc29SrP`afF-|AT>kJh6?8@Vu|rqhBjY?I{C!fd4q^f4&m`2P62$<$o;v(B@xD zCq<3v*GgKxhdeCFf4Ucbjo@~Ax(K;4klc$Uu+d)+KRQtS(633?(BS)PIii6lOTKA` zPv-C=Gk_|5Gx_OI2`h{_*8S5r{8w#0^@&F--n)zl#v5@_C^M@jWs~KtMyhwHS4&eU znkwoCUb{Wi;K^XdWEdQ}@AKb2H2(ii_$TM<A3I@~91vUevhDx1`#|f3eb`?+{bTgB z^Z&!D{$JdF|9SM;Za=n!;(4;Yh?}u3<5Q>On230_)%0kfPf$QoXitruGGE`>a-mfB znQaEg<rlotev+Fi`r+U+=~kEQzHz6NPESjXdi^g<sZa8mQ=@u94frwF31_6YKFLcM zV}EXW&$Z%VWNtup|J{@zCrx>0-hUDV4Ihg%q$z&>;x;MG0OzY6%z~O<9@d=GJm!1M z*v?x&dLvG;mW>Mc9QR4?v9?gY`2A++T*aQDZ}A}|HDeQI#X>>lnPO+Z1O+8#)Kgt6 z-cJoxnMaRq3#>mizQg$J>;#LjeF)XMWH0W>wK!CK+_&1%AnJ+xDLLKq-HlcGH8Q0w zmX$#Txs`tP$?m)A>gT5z`nQMc02&-=D|0JVzc(F4KgT;Y%FdWPKiB6wdHmY^ru(jj z>XSXOu{rGCeYRRF>$-bcsI^)`=YOmc8mM;S;c0vOX~552s`P~a0GFe&yu7PRjbD55 zI{ksCI;sex`@HJ1Wc@QwUw9uncBnUFXuXg{h+kWxXtSTxlAl|-QX7+WiWDM7{X4$z z7`pN<kAs0>eC}u1IZIQ&qw~9BjB*DI#DrPd?v|!0>ic#-dlo9xH!fuOY4^MK56ODZ zwFj)vs0(M5l%0|ZEV=ew==+_+MwkZbQ0wvb5c+(UO4Z2Y(*0dq1rIz-=k3VP+@gPf zGIrS2rJnZT#g6Mb(Ot7a9$vQHa;fc?Z@Du^3vx2=X4YS)I{*FI*YQ^zZN9j(FL%?= znOpiD?c`$3*S4{|=pQBdA}4>354Og(&kkD^P_+r~5h?ZU_!2tb(Iz(cs;AwgJ!%`* z?x~xnQhqc(w(T4}9zFkn<Ixi}j>H|7Lo<S%MJ=z#ws2`AB>G6vjs++VxIL7t`BKOH zE<*jb;>hsbYG;q_yUz?KM_;^nSXX?A`qkzWCqAOVq_n)P-^86|nj_74lKLh?noTiE zWXm<K8W~Qin{zR%0oMnKycb6^Se!b(1?85UG-=@K)c25QA57FE@7-e`?`K@f&XOT1 zE^fA*>$H}GiUX7Hp6^4gGvQ~;8`e@jnBLuC>KjL29(ZcwROwHrBp)`ey?e$ua^xnb zUpjbwwKHs{j^8zD3pDp&I9YwtwwFE+#8pOt3u0MGI&8Fb%{zE_0y$>`o<8%Xc75FX zeI!3mHHvC7Rr}qx>FP%HfmKOG17~v?u3YP1Q(PB*hjaG;{XkJ~XGh6H?{UA@(q6Wp z#@)NS*NNQDH_*|!{?1xT;EB}mF-g~Pe_y-i$*AI#iQH?x8)n5+rDlx$CG5^$oSAp{ z!h}O<;=0}3P#{Y~XAZS9_S2(r$B3edHyhh;&rk0j9Wr5O>a*+{vSz&RixnnhKE>5u zc55u?Iz5m1T!dfS)l|B`>(@6PX^?RjHP`3Y`FKL#rS@h?=xluE_o3$b(UR``f}pC$ z=9a~&L0p{$60xP+-UAF$qCc4HE%FccW>ty|eRa!E5<A;oUK8}rN<u_HYV>}ngo*pb zyrd)+hM~Bcuf6dGK9SRwdYn3=wLk2dj+Rah=Qb{<Oeix8T3lxnaNT4@9So+9#C<ZJ zNSQ7Q2$5!P-h0aMM9qofTgm!(@D6%@M|Cu=M~*j%>${)QZ`k8*cF(Q6HDz2h!%v^h zDacNhnrhTo(~+}QBl4n$NyA6J?(uQA_AEOt-{4NVxC@HT@bm|(@IYM3UU&Bz{~xvH zjbdFojM%w}7yXQecT|=*DXw~^Y2H#GQ4A!uSgW*wxiQNLI<ot0_I`QU7MzumL&sL` zJwM>vE|a4mUo@6&x!#*IMMJTvdt2)rCCY<B{VP)?sn)X~8mDM5nVUZvsE8=-(6L;7 zxF^DBoW|{uVzPsA8<nrEo2!vaWB$h+)%Cqp71iS6J;$o&*RNk_8S6AYU}vuDG4SSS z{&Q~kkp}a%JvB_vqLa*1B&EA5OXH8{Uve|PqLN*@n6Gi|iVi^xF4L}~v~@Pw--Od+ z?~^%K$IsPk+kNYU{Djug|N6I`mt&oEZpxOk(j(qM2~KY(<)U@Q1%}@C%7k<tk?y=f z?S4;dRJT!3!Thk!ZPtkPz#eyoQZ9SFwDdH5wiCXYmT+!I5Pj!H9&K%D_q^Q~Hm{*P z-Pu!HWAx>xOv$7u``UFgrvcCM>ohQRvde6($m@_uv9LX^%swq&ytlqD>wv4%H=3h0 zFIlj$i_#Pg{0qGMIOpB#?YOi&1{S6Vb#@r&&1K<mX8+uo6PO!U`QV-SOQBQ4Wz?}8 zTH_+mc%vbgRVnVtR<=cDv&Jnly-cNU?criZ-{w-<IdwGdIenGsW1AQ1n#8GJ<2z|& zsiM2LYeLNI6?M2_&byc0ctBj*Dz9y5qE#qEv53~XB=biJ!*|gS4fd0_sa?bQ(sFh4 zulm}rO)DOdFDm1fNurh@pv3pn-Z(Kj)iY9;QF}K2NIiw}-0Ys%Y1tXasfLqT9d~m@ z{U7_W8NYcnuF;jnaVBHdxwNQMLF4^s&tBd<r?CRt;l1AO9S(K%_0hPsg#1?LDEGn6 z&tIQQf}rvUcgW!wpi?5v$yh3#a>#f@b)?DvNr^%-65H+LotZ1dT~<WGD&?8n!d*N@ zkyZ{IS?-D>%Kuq`Il>@Ad8Iw@#a6W>vHgB;uVunX5~MfNvAj4gpXNj&KCR4^L(LM? zEl0k-sjKuzfckd#^q|a_3;!%!|7~fTnDwxAwxVevh2pW1m9;5IKrdU~VfN<Zq5f=) zUWP(RXl-(H+W)ym(C5BXmSXixMzd9v%zWcHOUnRYjSgc?$dVV1{-}~NdlqkeOGVVT d&PZr(oodM0n@MdoH5B|gc;JY9lC0t7{{xj%J<R|B diff --git a/AzureAppGatewayOrchestrator.Tests/AzureAppGatewayOrchestrator_AzureAppGW.cs b/AzureAppGatewayOrchestrator.Tests/AzureAppGW.cs similarity index 98% rename from AzureAppGatewayOrchestrator.Tests/AzureAppGatewayOrchestrator_AzureAppGW.cs rename to AzureAppGatewayOrchestrator.Tests/AzureAppGW.cs index 6199a21..47c3351 100644 --- a/AzureAppGatewayOrchestrator.Tests/AzureAppGatewayOrchestrator_AzureAppGW.cs +++ b/AzureAppGatewayOrchestrator.Tests/AzureAppGW.cs @@ -24,15 +24,15 @@ namespace AzureAppGatewayOrchestrator.Tests; -public class AzureAppGatewayOrchestrator_AzureAppGw +public class AzureAppGw { ILogger _logger { get; set;} - public AzureAppGatewayOrchestrator_AzureAppGw() + public AzureAppGw() { ConfigureLogging(); - _logger = LogHandler.GetClassLogger<AzureAppGatewayOrchestrator_AzureAppGw>(); + _logger = LogHandler.GetClassLogger<AzureAppGw>(); } [IntegrationTestingFact] @@ -544,7 +544,7 @@ public void AzureAppGw_Management_IntegrationTest_ReturnSuccess() string certName = "GatewayTest" + Guid.NewGuid().ToString()[..6]; string password = "password"; - X509Certificate2 ssCert = AzureAppGatewayOrchestrator_Client.GetSelfSignedCert(testHostname); + X509Certificate2 ssCert = Client.GetSelfSignedCert(testHostname); string b64PfxSslCert = Convert.ToBase64String(ssCert.Export(X509ContentType.Pfx, password)); @@ -577,7 +577,7 @@ public void AzureAppGw_Management_IntegrationTest_ReturnSuccess() // Arrange - ssCert = AzureAppGatewayOrchestrator_Client.GetSelfSignedCert(testHostname); + ssCert = Client.GetSelfSignedCert(testHostname); b64PfxSslCert = Convert.ToBase64String(ssCert.Export(X509ContentType.Pfx, password)); diff --git a/AzureAppGatewayOrchestrator.Tests/AzureAppGatewayOrchestrator.Tests.csproj b/AzureAppGatewayOrchestrator.Tests/AzureAppGatewayOrchestrator.Tests.csproj index 675e50a..4fe114f 100644 --- a/AzureAppGatewayOrchestrator.Tests/AzureAppGatewayOrchestrator.Tests.csproj +++ b/AzureAppGatewayOrchestrator.Tests/AzureAppGatewayOrchestrator.Tests.csproj @@ -1,7 +1,7 @@ <Project Sdk="Microsoft.NET.Sdk"> <PropertyGroup> - <TargetFramework>net6.0</TargetFramework> + <TargetFramework>net8.0</TargetFramework> <ImplicitUsings>enable</ImplicitUsings> <Nullable>enable</Nullable> diff --git a/AzureAppGatewayOrchestrator.Tests/AzureAppGatewayOrchestrator_Client.cs b/AzureAppGatewayOrchestrator.Tests/AzureAppGatewayOrchestrator_Client.cs deleted file mode 100644 index 3398c2e..0000000 --- a/AzureAppGatewayOrchestrator.Tests/AzureAppGatewayOrchestrator_Client.cs +++ /dev/null @@ -1,283 +0,0 @@ -// Copyright 2024 Keyfactor -// -// Licensed under the Apache License, Version 2.0 (the "License"); -// you may not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, software -// distributed under the License is distributed on an "AS IS" BASIS, -// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -// See the License for the specific language governing permissions and -// limitations under the License. - -using System.Security.Cryptography; -using System.Security.Cryptography.X509Certificates; -using Azure; -using Azure.Core; -using Azure.ResourceManager; -using Azure.ResourceManager.Network; -using Azure.ResourceManager.Network.Mocking; -using Azure.ResourceManager.Network.Models; -using Azure.ResourceManager.Resources; -using AzureApplicationGatewayOrchestratorExtension.Client; -using Keyfactor.Logging; -using Microsoft.Extensions.Logging; -using Moq; -using NLog.Extensions.Logging; - -namespace AzureAppGatewayOrchestrator.Tests; - -public class AzureAppGatewayOrchestrator_Client -{ - private ResourceIdentifier _appGatewayResourceId; - - public AzureAppGatewayOrchestrator_Client() - { - ConfigureLogging(); - - _appGatewayResourceId = new ResourceIdentifier("/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/testResourceGroup/providers/Microsoft.Network/applicationGateways/testAppGateway"); - } - - [IntegrationTestingFact] - public void AzureClientIntegrationTest() - { - // Arrange - string httpsListenerName = Environment.GetEnvironmentVariable("AZURE_APP_GATEWAY_HTTPS_LISTENER_NAME") ?? string.Empty; - - IAzureAppGatewayClient client = new GatewayClient.Builder() - .WithTenantId(Environment.GetEnvironmentVariable("AZURE_TENANT_ID") ?? string.Empty) - .WithApplicationId(Environment.GetEnvironmentVariable("AZURE_CLIENT_ID") ?? string.Empty) - .WithClientSecret(Environment.GetEnvironmentVariable("AZURE_CLIENT_SECRET") ?? string.Empty) - .WithResourceId(Environment.GetEnvironmentVariable("AZURE_APP_GATEWAY_RESOURCE_ID") ?? string.Empty) - .Build(); - - string certName = "GatewayTest" + Guid.NewGuid().ToString()[..6]; - string password = "password"; - - X509Certificate2 ssCert = GetSelfSignedCert(certName); - string b64PfxSslCert = Convert.ToBase64String(ssCert.Export(X509ContentType.Pfx, password)); - - // Step 1 - Add an App Gateway certificate - - // Act - ApplicationGatewaySslCertificate result = client.AddCertificate(certName, b64PfxSslCert, password); - - // Assert - Assert.NotNull(result); - Assert.Equal(certName, result.Name); - - // Step 2 - Update an HTTPS listener with the new certificate - - // Act - bool ex = false; - try - { - client.UpdateHttpsListenerCertificate(result, httpsListenerName); - } - catch (Exception) - { - ex = true; - } - - // Assert - Assert.False(ex); - - // Step 3 - Get the certificates that exist on the app gateway - - // Act - OperationResult<IEnumerable<Keyfactor.Orchestrators.Extensions.CurrentInventoryItem>> certs = client.GetAppGatewaySslCertificates(); - - // Assert - Assert.NotNull(certs.Result); - Assert.NotEmpty(certs.Result); - Assert.Contains(certs.Result, c => c.Alias == certName); - - // Step 4 - Try to remove the certificate from the app gateway, which should fail - // since it's bound to an HTTPS listener - - // Act - ex = false; - try - { - // Client should throw exception if certificate is bound to an HTTPS listener. - client.RemoveCertificate(certName); - } - catch (Exception) - { - ex = true; - } - - // Assert - Assert.True(ex); - - // Act - - // Step 5 - Remove the certificate from the HTTPS listener - - // Rebind the HTTPS listener with the original certificate, if there was only 1 certificate - // previously, otherwise bind it with the first certificate in the list. - - ApplicationGatewaySslCertificate replacement = client.GetAppGatewayCertificateByName(certs.Result.First(c => c.Alias != certName).Alias); - - client.UpdateHttpsListenerCertificate(replacement, httpsListenerName); - - client.RemoveCertificate(certName); - - // Act - - // Step 6 - Test the GetHttpsListenerCertificates method - - // boundCertificates in the form of <listenerName, certificateName> - IDictionary<string, string> boundCertificates = client.GetBoundHttpsListenerCertificates(); - } - - public static X509Certificate2 GetSelfSignedCert(string hostname) - { - RSA rsa = RSA.Create(2048); - CertificateRequest req = new CertificateRequest($"CN={hostname}", rsa, HashAlgorithmName.SHA256, - RSASignaturePadding.Pkcs1); - - SubjectAlternativeNameBuilder subjectAlternativeNameBuilder = new SubjectAlternativeNameBuilder(); - subjectAlternativeNameBuilder.AddDnsName(hostname); - req.CertificateExtensions.Add(subjectAlternativeNameBuilder.Build()); - req.CertificateExtensions.Add(new X509KeyUsageExtension(X509KeyUsageFlags.DataEncipherment | X509KeyUsageFlags.KeyEncipherment | X509KeyUsageFlags.DigitalSignature, false)); - req.CertificateExtensions.Add(new X509EnhancedKeyUsageExtension(new OidCollection { new Oid("2.5.29.32.0"), new Oid("1.3.6.1.5.5.7.3.1") }, false)); - - X509Certificate2 selfSignedCert = req.CreateSelfSigned(DateTimeOffset.Now, DateTimeOffset.Now.AddYears(5)); - Console.Write($"Created self-signed certificate for \"{hostname}\" with thumbprint {selfSignedCert.Thumbprint}\n"); - return selfSignedCert; - } - - static void ConfigureLogging() - { - var config = new NLog.Config.LoggingConfiguration(); - - // Targets where to log to: File and Console - var logconsole = new NLog.Targets.ConsoleTarget("logconsole"); - logconsole.Layout = @"${date:format=HH\:mm\:ss} ${logger} [${level}] - ${message}"; - - // Rules for mapping loggers to targets - config.AddRule(NLog.LogLevel.Trace, NLog.LogLevel.Fatal, logconsole); - - // Apply config - NLog.LogManager.Configuration = config; - - LogHandler.Factory = LoggerFactory.Create(builder => - { - builder.AddNLog(); - }); - } - - public class MockArmClientBuilder - { - private Mock<ArmClient> _armClientMock = new(); - private Mock<MockableNetworkArmClient> _mockableNetworkArmClient = new(); - private Mock<ApplicationGatewayResource> _appGatewayResourceMock = new(); - - public MockArmClientBuilder HookUpGetApplicationGatewayResource(ResourceIdentifier appGatewayResourceId, ApplicationGatewayData appGatewayData) - { - // Mock the ApplicationGatewayResource method - _appGatewayResourceMock.SetupGet(r => r.Data).Returns(appGatewayData); - - _mockableNetworkArmClient.Setup(client => client.GetApplicationGatewayResource(appGatewayResourceId)) - .Returns(_appGatewayResourceMock.Object); - - // Create a Response object to return from Get() - Response<ApplicationGatewayResource> appGatewayResponseMock = Response.FromValue(_appGatewayResourceMock.Object, Mock.Of<Response>()); - - // Hook up the Get() method to return the mock response - _appGatewayResourceMock.Setup(resource => resource.Get(CancellationToken.None)) - .Returns(appGatewayResponseMock); - - return this; - } - - public MockArmClientBuilder HookUpGatewayCollectionGetter() - { - // Set up the ApplicationGatewayCollection operations so they can be hooked in later - var mockApplicationGatewayCollection = new Mock<ApplicationGatewayCollection>(); - - // Create a Mock ArmOperation that will be populated with the contents of the AppGateway the client - // is trying to update - var mockArmOperation = new Mock<ArmOperation<ApplicationGatewayResource>>(); - - mockApplicationGatewayCollection.Setup(c => c.CreateOrUpdate( - It.IsAny<WaitUntil>(), - It.IsAny<string>(), - It.IsAny<ApplicationGatewayData>(), - It.IsAny<CancellationToken>())) - .Callback<WaitUntil, string, ApplicationGatewayData, CancellationToken>((waitUntil, name, data, token) => - { - // Use 'data' to set up your mockArmOperation - var mockAppGatewayResource = new Mock<ApplicationGatewayResource>(); - mockAppGatewayResource.SetupGet(r => r.Data).Returns(data); - - mockArmOperation.Setup(op => op.Value).Returns(mockAppGatewayResource.Object); - }) - .Returns(mockArmOperation.Object); - - var mockSubscriptionResource = new Mock<SubscriptionResource>(); - var mockableNetworkSubscriptionResource = new Mock<MockableNetworkSubscriptionResource>(); - var mockResourceGroupResource = new Mock<ResourceGroupResource>(); - var mockableNetworkResourceGroupResource = new Mock<MockableNetworkResourceGroupResource>(); - - // Hook up the Mock SubscriptionResource to the Mock ArmClient - _armClientMock.Setup(client => client.GetSubscriptionResource(It.IsAny<ResourceIdentifier>())) - .Returns(mockSubscriptionResource.Object); - - // Set up GetSubscriptionResource to return the mock subscription resource - mockableNetworkResourceGroupResource.Setup(rg => rg.GetApplicationGateways()) - .Returns(Mock.Of<ApplicationGatewayCollection>()); - - // Create a mock response for GetResourceGroup - var mockResourceGroupResponse = Response.FromValue(mockResourceGroupResource.Object, Mock.Of<Response>()); - - // Set up GetResourceGroup to return the mock response - mockSubscriptionResource.Setup(sr => sr.GetResourceGroup(It.IsAny<string>(), CancellationToken.None)) - .Returns(mockResourceGroupResponse); - - // Hooking up MockableNetworkResourceGroupResource with ResourceGroupResource - mockResourceGroupResource.Setup(rg => rg.GetCachedClient( - It.IsAny<Func<ArmClient, MockableNetworkResourceGroupResource>>())) - .Returns(mockableNetworkResourceGroupResource.Object); - - // Similar setup for SubscriptionResource and MockableNetworkSubscriptionResource - mockSubscriptionResource.Setup(sr => sr.GetCachedClient( - It.IsAny<Func<ArmClient, MockableNetworkSubscriptionResource>>())) - .Returns(mockableNetworkSubscriptionResource.Object); - - return this; - } - - public Mock<ArmClient> Build() - { - // Mock the GetCachedClient method on ArmClient - _armClientMock.Setup(client => client.GetCachedClient( - It.IsAny<Func<ArmClient, MockableNetworkArmClient>>())) - .Returns(_mockableNetworkArmClient.Object); - - return _armClientMock; - } - } - - private void WillFinishEventually() - { - // Arrange - string certificateName = "testCert"; - string b64Pkcs12Certificate = "base64CertificateData"; - string password = "testPassword"; - - ApplicationGatewayData appGatewayData = new ApplicationGatewayData(); - - GatewayClient client = new GatewayClient(new MockArmClientBuilder() - .HookUpGetApplicationGatewayResource(_appGatewayResourceId, appGatewayData) - .HookUpGatewayCollectionGetter() - .Build().Object); - client.AppGatewayResourceId = _appGatewayResourceId; - - ApplicationGatewaySslCertificate result = client.AddCertificate(certificateName, b64Pkcs12Certificate, password); - } -} - diff --git a/AzureAppGatewayOrchestrator.Tests/AzureAppGatewayOrchestrator_JobClientBuilder.cs b/AzureAppGatewayOrchestrator.Tests/AzureAppGatewayOrchestrator_JobClientBuilder.cs deleted file mode 100644 index 8bbad50..0000000 --- a/AzureAppGatewayOrchestrator.Tests/AzureAppGatewayOrchestrator_JobClientBuilder.cs +++ /dev/null @@ -1,91 +0,0 @@ -// Copyright 2024 Keyfactor -// -// Licensed under the Apache License, Version 2.0 (the "License"); -// you may not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, software -// distributed under the License is distributed on an "AS IS" BASIS, -// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -// See the License for the specific language governing permissions and -// limitations under the License. - -using AzureAppGatewayOrchestrator.Tests; -using AzureApplicationGatewayOrchestratorExtension; -using AzureApplicationGatewayOrchestratorExtension.Client; -using Keyfactor.Logging; -using Keyfactor.Orchestrators.Extensions; -using Microsoft.Extensions.Logging; -using NLog.Extensions.Logging; - -public class AzureAppGatewayOrchestrator_JobClientBuilder -{ - ILogger _logger { get; set;} - - public AzureAppGatewayOrchestrator_JobClientBuilder() - { - ConfigureLogging(); - - _logger = LogHandler.GetClassLogger<AzureAppGatewayOrchestrator_AzureAppGw>(); - } - - [Fact] - public void AppGatewayJobClientBuilder_ValidCertificateStoreConfig_BuildValidClient() - { - // Verify that the AppGatewayJobClientBuilder uses the certificate store configuration - // provided by Keyfactor Command/the Universal Orchestrator correctly as required - // by the IAzureAppGatewayClientBuilder interface. - - // Arrange - AppGatewayJobClientBuilder<FakeClient.FakeBuilder> jobClientBuilderWithFakeBuilder = new(); - - // Set up the certificate store with names that correspond to how we expect them to be interpreted by - // the builder - CertificateStore fakeCertificateStoreDetails = new() - { - ClientMachine = "fake-tenant-id", - StorePath = "fake-azure-resource-id", - Properties = "{\"ServerUsername\":\"fake-azure-application-id\",\"ServerPassword\":\"fake-azure-client-secret\",\"AzureCloud\":\"fake-azure-cloud\"}" - }; - - // Act - IAzureAppGatewayClient fakeAppGatewayClient = jobClientBuilderWithFakeBuilder - .WithCertificateStoreDetails(fakeCertificateStoreDetails) - .Build(); - - // Assert - - // IAzureAppGatewayClient doesn't require any of the properties set by the builder to be exposed - // since the production Build() method creates an Azure Resource Manager client. - // But, our builder is fake and exposes the properties we need to test (via the FakeBuilder class). - Assert.Equal("fake-tenant-id", jobClientBuilderWithFakeBuilder._builder._tenantId); - Assert.Equal("fake-azure-resource-id", jobClientBuilderWithFakeBuilder._builder._resourceId); - Assert.Equal("fake-azure-application-id", jobClientBuilderWithFakeBuilder._builder._applicationId); - Assert.Equal("fake-azure-client-secret", jobClientBuilderWithFakeBuilder._builder._clientSecret); - Assert.Equal("fake-azure-cloud", jobClientBuilderWithFakeBuilder._builder._azureCloudEndpoint); - - _logger.LogInformation("AppGatewayJobClientBuilder_ValidCertificateStoreConfig_BuildValidClient - Success"); - } - - static void ConfigureLogging() - { - var config = new NLog.Config.LoggingConfiguration(); - - // Targets where to log to: File and Console - var logconsole = new NLog.Targets.ConsoleTarget("logconsole"); - logconsole.Layout = @"${date:format=HH\:mm\:ss} ${logger} [${level}] - ${message}"; - - // Rules for mapping loggers to targets - config.AddRule(NLog.LogLevel.Trace, NLog.LogLevel.Fatal, logconsole); - - // Apply config - NLog.LogManager.Configuration = config; - - LogHandler.Factory = LoggerFactory.Create(builder => - { - builder.AddNLog(); - }); - } -} diff --git a/AzureAppGatewayOrchestrator.Tests/AzureAppGatewayOrchestrator_AzureAppGwBin.cs b/AzureAppGatewayOrchestrator.Tests/AzureAppGwBin.cs similarity index 97% rename from AzureAppGatewayOrchestrator.Tests/AzureAppGatewayOrchestrator_AzureAppGwBin.cs rename to AzureAppGatewayOrchestrator.Tests/AzureAppGwBin.cs index 22f4305..7207547 100644 --- a/AzureAppGatewayOrchestrator.Tests/AzureAppGatewayOrchestrator_AzureAppGwBin.cs +++ b/AzureAppGatewayOrchestrator.Tests/AzureAppGwBin.cs @@ -24,15 +24,15 @@ namespace AzureAppGatewayOrchestrator.Tests; -public class AzureAppGatewayOrchestrator_AzureAppGwBin +public class AzureAppGwBin { ILogger _logger { get; set;} - public AzureAppGatewayOrchestrator_AzureAppGwBin() + public AzureAppGwBin() { ConfigureLogging(); - _logger = LogHandler.GetClassLogger<AzureAppGatewayOrchestrator_AzureAppGwBin>(); + _logger = LogHandler.GetClassLogger<AzureAppGwBin>(); } [IntegrationTestingFact] @@ -329,7 +329,7 @@ public void AzureAppGwBin_Management_IntegrationTest_AddAndBindCertificate_Retur string certName = "GatewayTest" + Guid.NewGuid().ToString()[..6]; string password = "password"; - X509Certificate2 ssCert = AzureAppGatewayOrchestrator_Client.GetSelfSignedCert(testHostname); + X509Certificate2 ssCert = Client.GetSelfSignedCert(testHostname); string b64PfxSslCert = Convert.ToBase64String(ssCert.Export(X509ContentType.Pfx, password)); diff --git a/AzureAppGatewayOrchestrator.Tests/Client.cs b/AzureAppGatewayOrchestrator.Tests/Client.cs new file mode 100644 index 0000000..d2e3452 --- /dev/null +++ b/AzureAppGatewayOrchestrator.Tests/Client.cs @@ -0,0 +1,179 @@ +// Copyright 2024 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +using System.Security.Cryptography; +using System.Security.Cryptography.X509Certificates; +using Azure.Core; +using Azure.ResourceManager.Network.Models; +using AzureApplicationGatewayOrchestratorExtension.Client; +using Keyfactor.Logging; +using Microsoft.Extensions.Logging; +using NLog.Extensions.Logging; + +namespace AzureAppGatewayOrchestrator.Tests; + +public class Client +{ + private ResourceIdentifier _appGatewayResourceId; + + public Client() + { + ConfigureLogging(); + + _appGatewayResourceId = new ResourceIdentifier("/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/testResourceGroup/providers/Microsoft.Network/applicationGateways/testAppGateway"); + } + + [IntegrationTestingTheory] + [InlineData("clientcert")] + [InlineData("clientsecret")] + public void AzureClientIntegrationTest(string testAuthMethod) + { + // Arrange + IntegrationTestingFact env = new(); + + IAzureAppGatewayClientBuilder clientBuilder = new GatewayClient.Builder() + .WithTenantId(env.TenantId) + .WithApplicationId(env.ApplicationId) + .WithResourceId(env.ResourceId); + + if (testAuthMethod == "clientcert") + { + clientBuilder.WithClientSecret(env.ClientSecret); + } + else + { + var cert = X509Certificate2.CreateFromPemFile(env.ClientCertificatePath); + clientBuilder.WithClientCertificate(cert); + } + + IAzureAppGatewayClient client = clientBuilder.Build(); + + string certName = "GatewayTest" + Guid.NewGuid().ToString()[..6]; + string password = "password"; + + X509Certificate2 ssCert = GetSelfSignedCert(certName); + string b64PfxSslCert = Convert.ToBase64String(ssCert.Export(X509ContentType.Pfx, password)); + + // Step 1 - Add an App Gateway certificate + + // Act + ApplicationGatewaySslCertificate result = client.AddCertificate(certName, b64PfxSslCert, password); + + // Assert + Assert.NotNull(result); + Assert.Equal(certName, result.Name); + + // Step 2 - Update an HTTPS listener with the new certificate + + // Act + bool ex = false; + try + { + client.UpdateHttpsListenerCertificate(result, env.HttpsListenerName); + } + catch (Exception) + { + ex = true; + } + + // Assert + Assert.False(ex); + + // Step 3 - Get the certificates that exist on the app gateway + + // Act + OperationResult<IEnumerable<Keyfactor.Orchestrators.Extensions.CurrentInventoryItem>> certs = client.GetAppGatewaySslCertificates(); + + // Assert + Assert.NotNull(certs.Result); + Assert.NotEmpty(certs.Result); + Assert.Contains(certs.Result, c => c.Alias == certName); + + // Step 4 - Try to remove the certificate from the app gateway, which should fail + // since it's bound to an HTTPS listener + + // Act + ex = false; + try + { + // Client should throw exception if certificate is bound to an HTTPS listener. + client.RemoveCertificate(certName); + } + catch (Exception) + { + ex = true; + } + + // Assert + Assert.True(ex); + + // Act + + // Step 5 - Remove the certificate from the HTTPS listener + + // Rebind the HTTPS listener with the original certificate, if there was only 1 certificate + // previously, otherwise bind it with the first certificate in the list. + + ApplicationGatewaySslCertificate replacement = client.GetAppGatewayCertificateByName(certs.Result.First(c => c.Alias != certName).Alias); + + client.UpdateHttpsListenerCertificate(replacement, env.HttpsListenerName); + + client.RemoveCertificate(certName); + + // Act + + // Step 6 - Test the GetHttpsListenerCertificates method + + // boundCertificates in the form of <listenerName, certificateName> + IDictionary<string, string> boundCertificates = client.GetBoundHttpsListenerCertificates(); + } + + public static X509Certificate2 GetSelfSignedCert(string hostname) + { + RSA rsa = RSA.Create(2048); + CertificateRequest req = new CertificateRequest($"CN={hostname}", rsa, HashAlgorithmName.SHA256, + RSASignaturePadding.Pkcs1); + + SubjectAlternativeNameBuilder subjectAlternativeNameBuilder = new SubjectAlternativeNameBuilder(); + subjectAlternativeNameBuilder.AddDnsName(hostname); + req.CertificateExtensions.Add(subjectAlternativeNameBuilder.Build()); + req.CertificateExtensions.Add(new X509KeyUsageExtension(X509KeyUsageFlags.DataEncipherment | X509KeyUsageFlags.KeyEncipherment | X509KeyUsageFlags.DigitalSignature, false)); + req.CertificateExtensions.Add(new X509EnhancedKeyUsageExtension(new OidCollection { new Oid("2.5.29.32.0"), new Oid("1.3.6.1.5.5.7.3.1") }, false)); + + X509Certificate2 selfSignedCert = req.CreateSelfSigned(DateTimeOffset.Now, DateTimeOffset.Now.AddYears(5)); + Console.Write($"Created self-signed certificate for \"{hostname}\" with thumbprint {selfSignedCert.Thumbprint}\n"); + return selfSignedCert; + } + + static void ConfigureLogging() + { + var config = new NLog.Config.LoggingConfiguration(); + + // Targets where to log to: File and Console + var logconsole = new NLog.Targets.ConsoleTarget("logconsole"); + logconsole.Layout = @"${date:format=HH\:mm\:ss} ${logger} [${level}] - ${message}"; + + // Rules for mapping loggers to targets + config.AddRule(NLog.LogLevel.Trace, NLog.LogLevel.Fatal, logconsole); + + // Apply config + NLog.LogManager.Configuration = config; + + LogHandler.Factory = LoggerFactory.Create(builder => + { + builder.AddNLog(); + }); + } +} + diff --git a/AzureAppGatewayOrchestrator.Tests/AzureAppGatewayOrchestrator_FakeClient.cs b/AzureAppGatewayOrchestrator.Tests/FakeClient.cs similarity index 76% rename from AzureAppGatewayOrchestrator.Tests/AzureAppGatewayOrchestrator_FakeClient.cs rename to AzureAppGatewayOrchestrator.Tests/FakeClient.cs index 6115ed6..651fcb2 100644 --- a/AzureAppGatewayOrchestrator.Tests/AzureAppGatewayOrchestrator_FakeClient.cs +++ b/AzureAppGatewayOrchestrator.Tests/FakeClient.cs @@ -12,6 +12,7 @@ // See the License for the specific language governing permissions and // limitations under the License. +using System.Security.Cryptography.X509Certificates; using Azure.ResourceManager.Network.Models; using AzureApplicationGatewayOrchestratorExtension.Client; using Keyfactor.Logging; @@ -23,52 +24,59 @@ namespace AzureAppGatewayOrchestrator.Tests; public class FakeClient : IAzureAppGatewayClient { - public class FakeBuilder : IAzureAppGatewayClientBuilder - { - private FakeClient _client = new FakeClient(); + public class FakeBuilder : IAzureAppGatewayClientBuilder + { + private FakeClient _client = new FakeClient(); - public string _tenantId { get; set; } - public string _resourceId { get; set; } - public string _applicationId { get; set; } - public string _clientSecret { get; set; } - public string _azureCloudEndpoint { get; set; } + public string? _tenantId { get; set; } + public string? _resourceId { get; set; } + public string? _applicationId { get; set; } + public string? _clientSecret { get; set; } + public X509Certificate2? _clientCertificate { get; set; } + public string? _azureCloudEndpoint { get; set; } - public IAzureAppGatewayClientBuilder WithTenantId(string tenantId) - { - _tenantId = tenantId; - return this; - } + public IAzureAppGatewayClientBuilder WithTenantId(string tenantId) + { + _tenantId = tenantId; + return this; + } - public IAzureAppGatewayClientBuilder WithResourceId(string resourceId) - { - _resourceId = resourceId; - return this; - } + public IAzureAppGatewayClientBuilder WithResourceId(string resourceId) + { + _resourceId = resourceId; + return this; + } - public IAzureAppGatewayClientBuilder WithApplicationId(string applicationId) - { - _applicationId = applicationId; - return this; - } + public IAzureAppGatewayClientBuilder WithApplicationId(string applicationId) + { + _applicationId = applicationId; + return this; + } - public IAzureAppGatewayClientBuilder WithClientSecret(string clientSecret) - { - _clientSecret = clientSecret; - return this; - } + public IAzureAppGatewayClientBuilder WithClientSecret(string clientSecret) + { + _clientSecret = clientSecret; + return this; + } - public IAzureAppGatewayClientBuilder WithAzureCloud(string azureCloud) - { - _azureCloudEndpoint = azureCloud; - return this; - } + public IAzureAppGatewayClientBuilder WithClientCertificate(X509Certificate2 clientCertificate) + { + _clientCertificate = clientCertificate; + return this; + } - public IAzureAppGatewayClient Build() - { - return _client; - } + public IAzureAppGatewayClientBuilder WithAzureCloud(string azureCloud) + { + _azureCloudEndpoint = azureCloud; + return this; } + public IAzureAppGatewayClient Build() + { + return _client; + } + } + ILogger _logger = LogHandler.GetClassLogger<FakeClient>(); public IEnumerable<string>? AppGatewaysAvailableOnFakeTenant { get; set; } @@ -89,13 +97,13 @@ public OperationResult<IEnumerable<CurrentInventoryItem>> GetAppGatewaySslCertif foreach (ApplicationGatewaySslCertificate cert in CertificatesAvailableOnFakeAppGateway.Values) { inventoryItems.Add(new CurrentInventoryItem - { - Alias = cert.Name, - PrivateKeyEntry = false, - ItemStatus = OrchestratorInventoryItemStatus.Unknown, - UseChainLevel = true, - Certificates = new List<string> { cert.Name } - }); + { + Alias = cert.Name, + PrivateKeyEntry = false, + ItemStatus = OrchestratorInventoryItemStatus.Unknown, + UseChainLevel = true, + Certificates = new List<string> { cert.Name } + }); } _logger.LogDebug($"Fake client has {inventoryItems.Count} certificates in inventory"); @@ -115,9 +123,9 @@ public ApplicationGatewaySslCertificate AddCertificate(string certificateName, s ApplicationGatewaySslCertificate cert = new ApplicationGatewaySslCertificate { Name = certificateName, - Data = BinaryData.FromObjectAsJson(certificateData), - // Reserve the Password field for tracking certificates bound to HTTPS listeners - Password = "" + Data = BinaryData.FromObjectAsJson(certificateData), + // Reserve the Password field for tracking certificates bound to HTTPS listeners + Password = "" }; _logger.LogDebug($"Adding certificate {certificateName} to fake app gateway"); diff --git a/AzureAppGatewayOrchestrator.Tests/IntegrationTestingFact.cs b/AzureAppGatewayOrchestrator.Tests/IntegrationTestingFact.cs index 53e1bf1..ce21f39 100644 --- a/AzureAppGatewayOrchestrator.Tests/IntegrationTestingFact.cs +++ b/AzureAppGatewayOrchestrator.Tests/IntegrationTestingFact.cs @@ -20,6 +20,7 @@ public sealed class IntegrationTestingFact : FactAttribute public string TenantId { get; private set; } public string ApplicationId { get; private set; } public string ClientSecret { get; private set; } + public string ClientCertificatePath { get; private set; } public string ResourceId { get; private set; } public IntegrationTestingFact() @@ -28,12 +29,37 @@ public IntegrationTestingFact() TenantId = Environment.GetEnvironmentVariable("AZURE_TENANT_ID") ?? string.Empty; ApplicationId = Environment.GetEnvironmentVariable("AZURE_CLIENT_ID") ?? string.Empty; ClientSecret = Environment.GetEnvironmentVariable("AZURE_CLIENT_SECRET") ?? string.Empty; + ClientCertificatePath = Environment.GetEnvironmentVariable("AZURE_PATH_TO_CLIENT_CERTIFICATE") ?? string.Empty; ResourceId = Environment.GetEnvironmentVariable("AZURE_APP_GATEWAY_RESOURCE_ID") ?? string.Empty; - if (string.IsNullOrEmpty(HttpsListenerName) || string.IsNullOrEmpty(TenantId) || string.IsNullOrEmpty(ApplicationId) || string.IsNullOrEmpty(ClientSecret) || string.IsNullOrEmpty(ResourceId)) + if (string.IsNullOrEmpty(HttpsListenerName) || string.IsNullOrEmpty(TenantId) || string.IsNullOrEmpty(ApplicationId) || string.IsNullOrEmpty(ClientSecret) || string.IsNullOrEmpty(ResourceId) || string.IsNullOrEmpty(ClientCertificatePath)) { Skip = "Integration testing environment variables are not set - Skipping test. Please run `make setup` to set the environment variables."; } } } +public sealed class IntegrationTestingTheory : TheoryAttribute +{ + public string HttpsListenerName { get; private set; } + public string TenantId { get; private set; } + public string ApplicationId { get; private set; } + public string ClientSecret { get; private set; } + public string ClientCertificatePath { get; private set; } + public string ResourceId { get; private set; } + + public IntegrationTestingTheory() + { + HttpsListenerName = Environment.GetEnvironmentVariable("AZURE_APP_GATEWAY_HTTPS_LISTENER_NAME") ?? string.Empty; + TenantId = Environment.GetEnvironmentVariable("AZURE_TENANT_ID") ?? string.Empty; + ApplicationId = Environment.GetEnvironmentVariable("AZURE_CLIENT_ID") ?? string.Empty; + ClientSecret = Environment.GetEnvironmentVariable("AZURE_CLIENT_SECRET") ?? string.Empty; + ClientCertificatePath = Environment.GetEnvironmentVariable("AZURE_PATH_TO_CLIENT_CERTIFICATE") ?? string.Empty; + ResourceId = Environment.GetEnvironmentVariable("AZURE_APP_GATEWAY_RESOURCE_ID") ?? string.Empty; + + if (string.IsNullOrEmpty(HttpsListenerName) || string.IsNullOrEmpty(TenantId) || string.IsNullOrEmpty(ApplicationId) || string.IsNullOrEmpty(ClientSecret) || string.IsNullOrEmpty(ResourceId) || string.IsNullOrEmpty(ClientCertificatePath)) + { + Skip = "Integration testing environment variables are not set - Skipping test. Please run `make setup` to set the environment variables."; + } + } +} diff --git a/AzureAppGatewayOrchestrator.Tests/JobClientBuilder.cs b/AzureAppGatewayOrchestrator.Tests/JobClientBuilder.cs new file mode 100644 index 0000000..f953d86 --- /dev/null +++ b/AzureAppGatewayOrchestrator.Tests/JobClientBuilder.cs @@ -0,0 +1,164 @@ +// Copyright 2024 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +using System.Security.Cryptography; +using System.Security.Cryptography.X509Certificates; +using System.Text; +using AzureAppGatewayOrchestrator.Tests; +using AzureApplicationGatewayOrchestratorExtension; +using AzureApplicationGatewayOrchestratorExtension.Client; +using Keyfactor.Logging; +using Keyfactor.Orchestrators.Extensions; +using Microsoft.Extensions.Logging; +using NLog.Extensions.Logging; + +public class JobClientBuilder +{ + ILogger _logger { get; set;} + + public JobClientBuilder() + { + ConfigureLogging(); + + _logger = LogHandler.GetClassLogger<JobClientBuilder>(); + } + + [Fact] + public void AppGatewayJobClientBuilder_ValidCertificateStoreConfigClientSecret_BuildValidClient() + { + // Verify that the AppGatewayJobClientBuilder uses the certificate store configuration + // provided by Keyfactor Command/the Universal Orchestrator correctly as required + // by the IAzureAppGatewayClientBuilder interface. + + // Arrange + AppGatewayJobClientBuilder<FakeClient.FakeBuilder> jobClientBuilderWithFakeBuilder = new(); + + // Set up the certificate store with names that correspond to how we expect them to be interpreted by + // the builder + CertificateStore fakeCertificateStoreDetails = new() + { + ClientMachine = "fake-tenant-id", + StorePath = "fake-azure-resource-id", + Properties = "{\"ServerUsername\":\"fake-azure-application-id\",\"ServerPassword\":\"fake-azure-client-secret\",\"AzureCloud\":\"fake-azure-cloud\"}" + }; + + // Act + IAzureAppGatewayClient fakeAppGatewayClient = jobClientBuilderWithFakeBuilder + .WithCertificateStoreDetails(fakeCertificateStoreDetails) + .Build(); + + // Assert + + // IAzureAppGatewayClient doesn't require any of the properties set by the builder to be exposed + // since the production Build() method creates an Azure Resource Manager client. + // But, our builder is fake and exposes the properties we need to test (via the FakeBuilder class). + Assert.Equal("fake-tenant-id", jobClientBuilderWithFakeBuilder._builder._tenantId); + Assert.Equal("fake-azure-resource-id", jobClientBuilderWithFakeBuilder._builder._resourceId); + Assert.Equal("fake-azure-application-id", jobClientBuilderWithFakeBuilder._builder._applicationId); + Assert.Equal("fake-azure-client-secret", jobClientBuilderWithFakeBuilder._builder._clientSecret); + Assert.Equal("fake-azure-cloud", jobClientBuilderWithFakeBuilder._builder._azureCloudEndpoint); + + _logger.LogInformation("AppGatewayJobClientBuilder_ValidCertificateStoreConfigClientSecret_BuildValidClient - Success"); + } + + [IntegrationTestingTheory] + [InlineData("pkcs12")] + [InlineData("pem")] + [InlineData("encryptedPem")] + public void AppGatewayJobClientBuilder_ValidCertificateStoreConfigClientCertificate_BuildValidClient(string certificateFormat) + { + // Verify that the AppGatewayJobClientBuilder uses the certificate store configuration + // provided by Keyfactor Command/the Universal Orchestrator correctly as required + // by the IAzureGraphClientBuilder interface. + + // Arrange + AppGatewayJobClientBuilder<FakeClient.FakeBuilder> jobClientBuilderWithFakeBuilder = new(); + + string password = "passwordpasswordpassword"; + string certName = "SPTest" + Guid.NewGuid().ToString()[..6]; + X509Certificate2 ssCert = Client.GetSelfSignedCert(certName); + + string b64ClientCertificate; + if (certificateFormat == "pkcs12") + { + b64ClientCertificate = Convert.ToBase64String(ssCert.Export(X509ContentType.Pfx, password)); + } + else if (certificateFormat == "pem") + { + string pemCert = ssCert.ExportCertificatePem(); + string keyPem = ssCert.GetRSAPrivateKey()!.ExportPkcs8PrivateKeyPem(); + b64ClientCertificate = Convert.ToBase64String(Encoding.UTF8.GetBytes(keyPem + '\n' + pemCert)); + password = ""; + } + else + { + PbeParameters pbeParameters = new PbeParameters( + PbeEncryptionAlgorithm.Aes256Cbc, + HashAlgorithmName.SHA384, + 300_000); + string pemCert = ssCert.ExportCertificatePem(); + string keyPem = ssCert.GetRSAPrivateKey()!.ExportEncryptedPkcs8PrivateKeyPem(password.ToCharArray(), pbeParameters); + b64ClientCertificate = Convert.ToBase64String(Encoding.UTF8.GetBytes(keyPem + '\n' + pemCert)); + } + + // Set up the certificate store with names that correspond to how we expect them to be interpreted by + // the builder + CertificateStore fakeCertificateStoreDetails = new() + { + ClientMachine = "fake-tenant-id", + StorePath = "fake-azure-resource-id", + Properties = $@"{{""ServerUsername"": ""fake-azure-application-id"",""ServerPassword"": ""{password}"",""ClientCertificate"": ""{b64ClientCertificate}"",""AzureCloud"": ""fake-azure-cloud""}}" + }; + + // Act + IAzureAppGatewayClient fakeAppGatewayClient = jobClientBuilderWithFakeBuilder + .WithCertificateStoreDetails(fakeCertificateStoreDetails) + .Build(); + + // Assert + + // IAzureAppGatewayClient doesn't require any of the properties set by the builder to be exposed + // since the production Build() method creates an Azure Resource Manager client. + // But, our builder is fake and exposes the properties we need to test (via the FakeBuilder class). + Assert.Equal("fake-tenant-id", jobClientBuilderWithFakeBuilder._builder._tenantId); + Assert.Equal("fake-azure-resource-id", jobClientBuilderWithFakeBuilder._builder._resourceId); + Assert.Equal("fake-azure-application-id", jobClientBuilderWithFakeBuilder._builder._applicationId); + Assert.Equal("fake-azure-cloud", jobClientBuilderWithFakeBuilder._builder._azureCloudEndpoint); + Assert.Equal(ssCert.GetCertHash(), jobClientBuilderWithFakeBuilder._builder._clientCertificate!.GetCertHash()); + Assert.NotNull(jobClientBuilderWithFakeBuilder._builder._clientCertificate!.GetRSAPrivateKey()); + Assert.Equal(jobClientBuilderWithFakeBuilder._builder._clientCertificate!.GetRSAPrivateKey()!.ExportRSAPrivateKeyPem(), ssCert.GetRSAPrivateKey()!.ExportRSAPrivateKeyPem()); + + _logger.LogInformation("AppGatewayJobClientBuilder_ValidCertificateStoreConfigClientCertificate_BuildValidClient - Success"); + } + + static void ConfigureLogging() + { + var config = new NLog.Config.LoggingConfiguration(); + + // Targets where to log to: File and Console + var logconsole = new NLog.Targets.ConsoleTarget("logconsole"); + logconsole.Layout = @"${date:format=HH\:mm\:ss} ${logger} [${level}] - ${message}"; + + // Rules for mapping loggers to targets + config.AddRule(NLog.LogLevel.Trace, NLog.LogLevel.Fatal, logconsole); + + // Apply config + NLog.LogManager.Configuration = config; + + LogHandler.Factory = LoggerFactory.Create(builder => + { + builder.AddNLog(); + }); + } +} diff --git a/AzureAppGatewayOrchestrator/AppGatewayJobClientBuilder.cs b/AzureAppGatewayOrchestrator/AppGatewayJobClientBuilder.cs index b267930..dfc7a34 100644 --- a/AzureAppGatewayOrchestrator/AppGatewayJobClientBuilder.cs +++ b/AzureAppGatewayOrchestrator/AppGatewayJobClientBuilder.cs @@ -12,6 +12,10 @@ // See the License for the specific language governing permissions and // limitations under the License. +using System; +using System.Security.Cryptography; +using System.Security.Cryptography.X509Certificates; +using System.Text; using AzureApplicationGatewayOrchestratorExtension.Client; using Keyfactor.Logging; using Keyfactor.Orchestrators.Extensions; @@ -29,6 +33,7 @@ public class CertificateStoreProperties { public string ServerUsername { get; set; } public string ServerPassword { get; set; } + public string ClientCertificate { get; init; } public string AzureCloud { get; set; } } @@ -47,10 +52,23 @@ public AppGatewayJobClientBuilder<TBuilder> WithCertificateStoreDetails(Certific _builder .WithTenantId(details.ClientMachine) .WithApplicationId(properties.ServerUsername) - .WithClientSecret(properties.ServerPassword) .WithResourceId(details.StorePath) .WithAzureCloud(properties.AzureCloud); + if (string.IsNullOrWhiteSpace(properties.ClientCertificate)) + { + _logger.LogTrace($"Builder - ServerPassword => ClientSecret: {properties.ServerPassword}"); + _logger.LogDebug("Client certificate not present - Using Client Secret authentication"); + _builder.WithClientSecret(properties.ServerPassword); + } + else + { + _logger.LogTrace($"Builder - ServerPassword => ClientCertificateKeyPassword: {properties.ServerPassword}"); + _logger.LogDebug("Client certificate present - Using Client Certificate authentication"); + X509Certificate2 clientCert = SerializeClientCertificate(properties.ClientCertificate, properties.ServerPassword); + _builder.WithClientCertificate(clientCert); + } + return this; } @@ -72,4 +90,98 @@ public IAzureAppGatewayClient Build() { return _builder.Build(); } + + private X509Certificate2 SerializeClientCertificate(string clientCertificate, string password) + { + // clientCertificate is a Base64 encoded certificate that's either PEM or PKCS#12 encoded. + // We expect that it includes a private key compatible with the dotnet standard crypto libraries. + + byte[] rawCertBytes = Convert.FromBase64String(clientCertificate); + X509Certificate2 serializedCertificate = null; + + // Try to serialize the certificate without any special handling + try + { + serializedCertificate = new X509Certificate2(rawCertBytes, password, X509KeyStorageFlags.Exportable); + if (serializedCertificate.HasPrivateKey) { + _logger.LogTrace("Successfully serialized certificate using standard X509Certificate2"); + return serializedCertificate; + } + } + catch (CryptographicException e) + { + _logger.LogDebug($"Couldn't serialize certificate using X509Certificate2: {e.Message} - trying to serialize from PEM"); + } + + try + { + return SerializePemCertificateAndKey(clientCertificate, password); + } + catch (Exception e) + { + string message = $"Couldn't serialize certificate as PEM: {e.Message} - please ensure that the certificate is valid."; + _logger.LogError(message); + throw new CryptographicException(message); + } + } + + private X509Certificate2 SerializePemCertificateAndKey(string clientCertificate, string password) + { + _logger.LogDebug($"Attempting to serialize client certificate and private key from PEM encoding"); + ReadOnlySpan<char> utf8Cert = Encoding.UTF8.GetChars(Convert.FromBase64String(clientCertificate)); + + _logger.LogTrace("Finding all PEM objects in ClientCertificate"); + + ReadOnlySpan<char> certificate = new char[0]; + ReadOnlySpan<char> key = new char[0]; + + int numberOfPemObjects = 0; + + while (PemEncoding.TryFind(utf8Cert, out PemFields field)) + { + numberOfPemObjects++; + string label = utf8Cert[field.Label].ToString(); + _logger.LogTrace($"Found PEM object with label {label} at location {field.Location}"); + + if (label == "CERTIFICATE") + { + _logger.LogTrace($"Storing {label} as certificate for serialization"); + certificate = utf8Cert[field.Location]; + } + else + { + _logger.LogTrace($"Storing {label} as private key for serialization"); + key = utf8Cert[field.Location]; + } + + // Reconstruct utf8Cert without the PEM object + Range objectRange = field.Location; + int start = objectRange.Start.Value; + int end = objectRange.End.Value; + char[] newUtf8Cert = new char[utf8Cert.Length - (end - start)]; + + _logger.LogTrace($"Trimming range {field.Location} [{end - start} bytes]"); + // Copy over the slice before the start of the range + utf8Cert.Slice(0, start).CopyTo(newUtf8Cert); + // Copy over the slice after the end of the range + utf8Cert.Slice(end).CopyTo(newUtf8Cert.AsSpan(start)); + + utf8Cert = newUtf8Cert; + } + + if (numberOfPemObjects != 2) + { + throw new CryptographicException($"Expected 2 PEM objects in ClientCertificate, found {numberOfPemObjects}"); + } + + _logger.LogDebug("Successfully extracted certificate and private key from PEM encoding - serializing certificate"); + if (string.IsNullOrEmpty(password)) + { + return X509Certificate2.CreateFromPem(certificate, key); + } + else + { + return X509Certificate2.CreateFromEncryptedPem(certificate, key, password); + } + } } diff --git a/AzureAppGatewayOrchestrator/AzureAppGatewayOrchestrator.csproj b/AzureAppGatewayOrchestrator/AzureAppGatewayOrchestrator.csproj index 5189ac8..5a55b12 100644 --- a/AzureAppGatewayOrchestrator/AzureAppGatewayOrchestrator.csproj +++ b/AzureAppGatewayOrchestrator/AzureAppGatewayOrchestrator.csproj @@ -1,7 +1,7 @@ <Project Sdk="Microsoft.NET.Sdk"> <PropertyGroup> - <TargetFramework>net6.0</TargetFramework> + <TargetFramework>net8.0</TargetFramework> <RootNamespace>AzureApplicationGatewayOrchestratorExtension</RootNamespace> <AssemblyName>AzureApplicationGatewayOrchestratorExtension</AssemblyName> <AppendTargetFrameworkToOutputPath>false</AppendTargetFrameworkToOutputPath> diff --git a/AzureAppGatewayOrchestrator/Client/GatewayClient.cs b/AzureAppGatewayOrchestrator/Client/GatewayClient.cs index e14b649..c810faf 100644 --- a/AzureAppGatewayOrchestrator/Client/GatewayClient.cs +++ b/AzureAppGatewayOrchestrator/Client/GatewayClient.cs @@ -65,6 +65,7 @@ public class Builder : IAzureAppGatewayClientBuilder private string _resourceId { get; set; } private string _applicationId { get; set; } private string _clientSecret { get; set; } + private X509Certificate2 _clientCertificate { get; set; } private Uri _azureCloudEndpoint { get; set; } public IAzureAppGatewayClientBuilder WithTenantId(string tenantId) @@ -91,6 +92,12 @@ public IAzureAppGatewayClientBuilder WithClientSecret(string clientSecret) return this; } + public IAzureAppGatewayClientBuilder WithClientCertificate(X509Certificate2 clientCertificate) + { + _clientCertificate = clientCertificate; + return this; + } + public IAzureAppGatewayClientBuilder WithAzureCloud(string azureCloud) { if (string.IsNullOrWhiteSpace(azureCloud)) @@ -129,9 +136,23 @@ public IAzureAppGatewayClient Build() AdditionallyAllowedTenants = { "*" } }; - TokenCredential credential = new ClientSecretCredential( - _tenantId, _applicationId, _clientSecret, credentialOptions - ); + TokenCredential credential; + if (!string.IsNullOrWhiteSpace(_clientSecret)) + { + credential = new ClientSecretCredential( + _tenantId, _applicationId, _clientSecret, credentialOptions + ); + } + else if (_clientCertificate != null) + { + credential = new ClientCertificateCredential( + _tenantId, _applicationId, _clientCertificate, credentialOptions + ); + } + else + { + throw new Exception("Client secret or client certificate must be provided."); + } // Creating Azure Resource Management client with the specified credentials. ArmClient armClient = new ArmClient(credential); @@ -159,14 +180,31 @@ private string RetrieveCertificateFromKeyVault(string vaultId) } }; - // vaultId in the form of https://<vault-name>.vault.azure.net/secrets/<secret-name> + // vaultId in the form of https://<vault-name>.vault.azure.net/secrets/<secret-name>[/<version>] Uri vaultUri = new Uri(vaultId); _logger.LogTrace($"Creating SecretClient object with URI {vaultUri.Scheme + "://" + vaultUri.Host}"); SecretClient client = new SecretClient(new Uri(vaultUri.Scheme + "://" + vaultUri.Host), _credential, options); - _logger.LogTrace($"Retrieving secret called \"{vaultUri.Segments.Last()}\" from Azure Key Vault"); - KeyVaultSecret secret = client.GetSecret(vaultUri.Segments.Last()); + string secretName = null; + string version = null; + if (vaultUri.Segments.Length == 3) + { + secretName = vaultUri.Segments.Last().TrimEnd('/'); + _logger.LogTrace($"Retrieving secret called \"{secretName}\" from Azure Key Vault"); + } + else if (vaultUri.Segments.Length == 4) + { + secretName = vaultUri.Segments[2].TrimEnd('/'); + version = vaultUri.Segments.Last().TrimEnd('/'); + _logger.LogTrace($"Retrieving secret called \"{secretName}\" with version \"{version}\" from Azure Key Vault"); + } + else + { + throw new Exception($"Invalid Azure Key Vault secret ID: {vaultId}"); + } + + KeyVaultSecret secret = client.GetSecret(secretName, version); if (String.IsNullOrWhiteSpace(secret.Properties.ContentType) || secret.Properties.ContentType != "application/x-pkcs12") { diff --git a/AzureAppGatewayOrchestrator/Client/IAzureAppGatewayClient.cs b/AzureAppGatewayOrchestrator/Client/IAzureAppGatewayClient.cs index efe872e..f1d8bbd 100644 --- a/AzureAppGatewayOrchestrator/Client/IAzureAppGatewayClient.cs +++ b/AzureAppGatewayOrchestrator/Client/IAzureAppGatewayClient.cs @@ -13,52 +13,53 @@ // limitations under the License. using System.Collections.Generic; +using System.Security.Cryptography.X509Certificates; using Azure.ResourceManager.Network.Models; using Keyfactor.Orchestrators.Extensions; -namespace AzureApplicationGatewayOrchestratorExtension.Client +namespace AzureApplicationGatewayOrchestratorExtension.Client; + +public interface IAzureAppGatewayClientBuilder +{ + public IAzureAppGatewayClientBuilder WithTenantId(string tenantId); + public IAzureAppGatewayClientBuilder WithResourceId(string resourceId); + public IAzureAppGatewayClientBuilder WithApplicationId(string applicationId); + public IAzureAppGatewayClientBuilder WithClientSecret(string clientSecret); + public IAzureAppGatewayClientBuilder WithClientCertificate(X509Certificate2 clientCertificate); + public IAzureAppGatewayClientBuilder WithAzureCloud(string azureCloud); + public IAzureAppGatewayClient Build(); +} + +public class OperationResult<T> { - public interface IAzureAppGatewayClientBuilder + public T Result { get; set; } + public string ErrorSummary { get; set; } + public List<string> Messages { get; set; } = new List<string>(); + public bool Success => Messages.Count == 0; + + public OperationResult(T result) { - public IAzureAppGatewayClientBuilder WithTenantId(string tenantId); - public IAzureAppGatewayClientBuilder WithResourceId(string resourceId); - public IAzureAppGatewayClientBuilder WithApplicationId(string applicationId); - public IAzureAppGatewayClientBuilder WithClientSecret(string clientSecret); - public IAzureAppGatewayClientBuilder WithAzureCloud(string azureCloud); - public IAzureAppGatewayClient Build(); + Result = result; } - public class OperationResult<T> + public void AddRuntimeErrorMessage(string message) { - public T Result { get; set; } - public string ErrorSummary { get; set; } - public List<string> Messages { get; set; } = new List<string>(); - public bool Success => Messages.Count == 0; - - public OperationResult(T result) - { - Result = result; - } - - public void AddRuntimeErrorMessage(string message) - { - Messages.Add(" - " + message); - } - - public string ErrorMessage => $"{ErrorSummary}\n{string.Join("\n", Messages)}"; + Messages.Add(" - " + message); } - public interface IAzureAppGatewayClient - { - public ApplicationGatewaySslCertificate AddCertificate(string certificateName, string certificateData, string certificatePassword); - public void RemoveCertificate(string certificateName); - public OperationResult<IEnumerable<CurrentInventoryItem>> GetAppGatewaySslCertificates(); - public ApplicationGatewaySslCertificate GetAppGatewayCertificateByName(string certificateName); - public bool CertificateExists(string certificateName); - public IEnumerable<string> DiscoverApplicationGateways(); + public string ErrorMessage => $"{ErrorSummary}\n{string.Join("\n", Messages)}"; +} - public bool CertificateIsBoundToHttpsListener(string certificateName); - public void UpdateHttpsListenerCertificate(ApplicationGatewaySslCertificate certificate, string listenerName); - public IDictionary<string, string> GetBoundHttpsListenerCertificates(); - } +public interface IAzureAppGatewayClient +{ + public ApplicationGatewaySslCertificate AddCertificate(string certificateName, string certificateData, string certificatePassword); + public void RemoveCertificate(string certificateName); + public OperationResult<IEnumerable<CurrentInventoryItem>> GetAppGatewaySslCertificates(); + public ApplicationGatewaySslCertificate GetAppGatewayCertificateByName(string certificateName); + public bool CertificateExists(string certificateName); + public IEnumerable<string> DiscoverApplicationGateways(); + + public bool CertificateIsBoundToHttpsListener(string certificateName); + public void UpdateHttpsListenerCertificate(ApplicationGatewaySslCertificate certificate, string listenerName); + public IDictionary<string, string> GetBoundHttpsListenerCertificates(); } diff --git a/CHANGELOG.md b/CHANGELOG.md index 2a8a9df..1630d58 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -20,3 +20,8 @@ - 2.1.0 - chore(client): Pass error back to Command if certificate download from AKV fails + +- 3.0.0 + - feat(certauth): Implement client certificate authentication as an alternative authentication mechanism. + - chore(docs): Update documentation to discuss the Key Vault Azure role-based access control permission model. + - fix(akv): Refactor Azure Key Vault certificate retrieval mechanism to recognize and appropriately handle secret versions. diff --git a/README.md b/README.md index fa9df4f..bfacc48 100644 --- a/README.md +++ b/README.md @@ -48,6 +48,38 @@ The Keyfactor Universal Orchestrator may be installed on either Windows or Linux --- +<h1 align="center" style="border-bottom: none"> + Azure Application Gateway Universal Orchestrator Extension +</h1> + +<p align="center"> + <!-- Badges --> +<img src="https://img.shields.io/badge/integration_status-production-3D1973?style=flat-square" alt="Integration Status: production" /> +<a href="https://github.com/Keyfactor/azure-appgateway-orchestrator/releases"><img src="https://img.shields.io/github/v/release/Keyfactor/azure-appgateway-orchestrator?style=flat-square" alt="Release" /></a> +<img src="https://img.shields.io/github/issues/Keyfactor/azure-appgateway-orchestrator?style=flat-square" alt="Issues" /> +<img src="https://img.shields.io/github/downloads/Keyfactor/azure-appgateway-orchestrator/total?style=flat-square&label=downloads&color=28B905" alt="GitHub Downloads (all assets, all releases)" /> +</p> + +<p align="center"> + <!-- TOC --> + <a href="#support"> + <b>Support</b> + </a> + · + <a href="#installation"> + <b>Installation</b> + </a> + · + <a href="#license"> + <b>License</b> + </a> + · + <a href="https://github.com/orgs/Keyfactor/repositories?q=orchestrator"> + <b>Related Integrations</b> + </a> +</p> + + ## Overview The Azure Application Gateway Orchestrator extension remotely manages certificates used by Azure Application Gateways. The extension supports two different store types - one that generally manages certificates stored in the Application Gateway, and one that manages the bindings of Application Gateway certificates to HTTPS/TLS Listeners. @@ -55,225 +87,246 @@ The Azure Application Gateway Orchestrator extension remotely manages certificat > > If the certificate management capabilities of Azure Key Vault are desired over direct management of certificates in Application Gateways, the Azure Key Vault orchestrator can be used in conjunction with this extension for accurate certificate location reporting via the inventory job type. This management strategy requires manual binding of certificates imported to an Application Gateway from AKV and can result in broken state in the Azure Application Gateway in the case that the secret is deleted in AKV. -### Azure Application Gateway Certificate store type - -The Azure Application Gateway Certificate store type, `AzureAppGw`, manages `ApplicationGatewaySslCertificate` objects owned by Azure Application Gateways. This store type collects inventory and manages all ApplicationGatewaySslCertificate objects associated with an Application Gateway. The store type is implemented primarily for Inventory and Management Remove operations, since the intended usage of ApplicationGatewaySslCertificates in Application Gateways is for serving TLS client traffic via TLS Listeners. Management Add and associated logic for certificate renewal is also supported for this certificate store type for completeness, but the primary intended functionality of this extension is implemented with the App Gateway Certificate Binding store type. - -> If an ApplicationGatewaySslCertificate is bound to a TLS Listener at the time of a Management Remove operation, the operation will fail since at least one certificate must be bound at all times. - -> If a renewal job is scheduled for an `AzureAppGw` certificate store, the extension will report a success and perform no action if the certificate being renewed is bound to a TLS Listener. This is because a certificate located in an `AzureAppGw` certificate store that is bound to a TLS Listener is logically the same as the same certificate located in an `AzureAppGwBin` store type. For this reason, it's expected that the certificate will be renewed and re-bound to the listener by the `AppGwBin` certificate operations. -> -> If the renewed certificate is not bound to a TLS Listener, the operation will be performed the same as any certificate renewal process that honors the Overwrite flag. -### Azure Application Gateway Certificate Binding store type +## Installation +Before installing the Azure Application Gateway Universal Orchestrator extension, it's recommended to install [kfutil](https://github.com/Keyfactor/kfutil). Kfutil is a command-line tool that simplifies the process of creating store types, installing extensions, and instantiating certificate stores in Keyfactor Command. -The Azure Application Gateway Certificate Binding store type, `AzureAppGwBin`, represents certificates bound to TLS Listeners on Azure App Gateways. The only supported operations on this store type are Management Add and Inventory. The Management Add operation for this store type creates and binds an ApplicationGatewaySslCertificate to a pre-existing TLS Listener on an Application Gateway. When the Add operation is configured in Keyfactor Command, the certificate Alias configures which TLS Listener the certificate will be bound to. If the HTTPS listener is already bound to a certificate with the same name, the Management Add operation will perform a replacement of the certificate, _**regardless of the existence of the Replace flag configured with renewal jobs**_. The replacement operation performs several API interactions with Azure since at least one certificate must be bound to a TLS listener at all times, and the name of ApplicationGatewaySslCertificates must be unique. For the sake of completeness, the following describes the mechanics of this replacement operation: - -1. Determine the name of the certificate currently bound to the HTTPS listener - Alias in 100% of cases if the certificate was originally added by the App Gateway Orchestrator Extension, or something else if the certificate was added by some other means (IE, the Azure Portal, or some other API client). -2. Create and bind a temporary certificate to the HTTPS listener with the same name as the Alias. -3. Delete the AppGatewayCertificate previously bound to the HTTPS listener called Alias. -4. Recreate and bind an AppGatewayCertificate with the same name as the HTTPS listener called Alias. If the Alias is called `listener1`, the new certificate will be called `listener1`, regardless of the name of the certificate that was previously bound to the listener. -5. Delete the temporary certificate. +The Azure Application Gateway Universal Orchestrator extension implements 2 Certificate Store Types. Depending on your use case, you may elect to install one, or all of these Certificate Store Types. An overview for each type is linked below: +* [Azure Application Gateway Certificate](docs/azureappgw.md) +* [Azure Application Gateway Certificate Binding](docs/appgwbin.md) -In the unlikely event that a failure occurs at any point in the replacement procedure, it's expected that the correct certificate will be served by the TLS Listener, since most of the mechanics are actually implemented to resolve the unique naming requirement. +<details><summary>Azure Application Gateway Certificate</summary> -The Inventory job type for `AzureAppGwBin` reports only ApplicationGatewaySslCertificates that are bound to TLS Listeners. If the certificate was added with Keyfactor Command and this orchestrator extension, the name of the certificate in the Application Gateway will be the same as the TLS Listener. E.g., if the Alias configured in Command corresponds to a TLS Listener called `location-service-https-lstn1`, the certificate in the Application Gateway will also be called `location-service-https-lstn1`. However, if the certificate was added to the Application Gateway by other means (such as the Azure CLI, import from AKV, etc.), the Inventory job mechanics will still report the name of the TLS Listener in its report back to Command. -### Discovery Job +1. Follow the [requirements section](docs/azureappgw.md#requirements) to configure a Service Account and grant necessary API permissions. -Both `AzureAppGw` and `AzureAppGwBin` support the Discovery operation. The Discovery operation discovers all Azure Application Gateways in each resource group that the service principal has access to. The discovered Application Gateways are reported back to Command and can be easily added as certificate stores from the Locations tab. + <details><summary>Requirements</summary> + + ### Azure Service Principal (Azure Resource Manager Authentication) -The Discovery operation uses the "Directories to search" field, and accepts input in one of the following formats: -- `*` - If the asterisk symbol `*` is used, the extension will search for Application Gateways in every resource group that the service principal has access to, but only in the tenant that the discovery job was configured for as specified by the "Client Machine" field in the certificate store configuration. -- `<tenant-id>,<tenant-id>,...` - If a comma-separated list of tenant IDs is used, the extension will search for Application Gateways in every resource group and tenant specified in the list. The tenant IDs should be the GUIDs associated with each tenant, and it's the user's responsibility to ensure that the service principal has access to the specified tenants. + The Azure Application Gateway Orchestrator extension uses an [Azure Service Principal](https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals?tabs=browser) for authentication. Follow [Microsoft's documentation](https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal) to create a service principal. -### Certificates Imported to Application Gateways from Azure Key Vault + #### Azure Application Gateway permissions -Natively, Azure Application Gateways support integration with Azure Key Vault for secret/certificate management. This integration works by creating a TLS Listener certificate with a reference to a secret in Azure Key Vault (specifically, a URI in the format `https://<vault-name>.vault.azure.net/secrets/<secret-name>`), authenticated using a Managed Identity. If the Application Gateway orchestrator extension is deployed to manage App Gateways with certificates imported from Azure Key Vault, the following truth table represents the possible operations and their result, specifically with respect to AKV. + For quick start and non-production environments, a Role Assignment should be created on _each resource group_ that own Application Gateways desiring management that grants the created Application/Service Principal the [Contributor (Privileged administrator) Role](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#contributor). For production environments, a custom role should be created that grants the following permissions: -| Store Type | Operation | Result | -|--------------|-----------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `AzureAppGw` | Inventory | Certificate is downloaded from Azure Key Vault and reported back to Keyfactor Command. In Keyfactor Command, the certificate will show as being located in the AzureAppGw certificate store [in addition to the AKV, if AKV orchestrator extension is also deployed]. | -| `AzureAppGw` | Add | The Add operation will not create secrets in AKV; it creates ApplicationGatewaySslCertificates.<br/> <br/>If an `AzureAppGw` Add operation is scheduled with the Replace flag, the _**link to the AKV certificate will be broken**_, and a native ApplicationGatewaySslCertificate will be created in its place - The secret in AKV will still exist. | -| `AzureAppGw` | Remove | The ApplicationGatewaySslCertificate is deleted from the Application Gateway, but the secret that the certificate referenced in AKV still exists. | -| `AzureAppGwBin` | Inventory | Certificate is downloaded from Azure Key Vault and reported back to Keyfactor Command. In Keyfactor Command, the certificate will show as present in both an `AzureAppGw` certificate store _and_ an `AppGwBin` certificate store [in addition to the AKV, if AKV orchestrator extension is also deployed]. | -| `AzureAppGwBin` | Add | The Add operation will not create secrets in AKV; it creates ApplicationGatewaySslCertificates. <br/> <br/>If a certificate with the same name as the TLS Listener already exists, it will be _replaced_ by a new ApplicationGatewaySslCertificate. <br/> <br/>If the certificate being replaced was imported from AKV, this binding will be broken and the secret will still exist in AKV. | + - `Microsoft.Resources/subscriptions/resourcegroups/read` - Read : Get Resource Group + - `Microsoft.Network/applicationGateways/read` - Read : Get Application Gateway + - `Microsoft.Network/applicationGateways/write` - Write : Create or Update Application Gateway + - `Microsoft.ManagedIdentity/userAssignedIdentities/assign/action` - Other : RBAC action for assigning an existing user assigned identity to a resource + - `Microsoft.Network/virtualNetworks/subnets/join/action` - Other : Joins a virtual network. Not Alertable. -#### Mechanics of the Azure Key Vault Download Operation for Inventory Jobs that report certificates imported from AKV + > Note that even if the Service Principal has permission to perform the 'Microsoft.Network/applicationGateways/write' action over the scope of the required resource group, there may be other permissions that are required by the CreateOrUpdate operation depending on the complexity of the Application Gateway's configuration. As such, the list of permissions above should not be considered as comprehensive. -If an AzureApplicationSslCertificate references a secret in AKV (was imported to the App Gateway from AKV), the inventory job will create and use a `SecretClient` from the [`Azure.Security.KeyVault.Secrets.SecretClient` dotnet package](https://learn.microsoft.com/en-us/dotnet/api/azure.security.keyvault.secrets.secretclient?view=azure-dotnet). Authentication to AKV via this client is configured using the exact same `TokenCredential` provided by the [Azure Identity client library for .NET](https://learn.microsoft.com/en-us/dotnet/api/overview/azure/identity-readme?view=azure-dotnet). This means that the Service Principal described in the [Azure Configuration](#azure-configuration) section must also have appropriate permissions to read secrets from the AKV that the App Gateway is integrated with. The secret referenced in the AzureApplicationSslCertificate will be accessed exactly as reported by Azure, regardless of whether it exists in AKV. + #### Azure Key Vault permissions -## Azure Configuration and Permissions + If the managed Application Gateway is integrated with Azure Key Vault per the discussion in the [Certificates Imported to Application Gateways from Azure Key Vault](#certificates-imported-to-application-gateways-from-azure-key-vault) section, perform one of the following actions for each Key Vault with certificates imported to App Gateways: + * **Azure role-based access control** - Create a Role Assignment that grants the Application/Service Principal the [Key Vault Secrets User](https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli) built-in role. + * **Vault access policy** - [Create an Access Policy](https://learn.microsoft.com/en-us/azure/key-vault/general/assign-access-policy?tabs=azure-portal) that grants the Application/Service Principal the Get secret permission for each Azure Key Vault. -The Azure Application Gateway Orchestrator extension uses an [Azure Service Principal](https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals?tabs=browser) for authentication. Follow [Microsoft's documentation](https://learn.microsoft.com/en-us/azure/purview/create-service-principal-azure) to create a service principal. + #### Client Certificate or Client Secret -For quick start and non-production environments, a Role Assignment should be created on _each resource group_ that own Application Gateways desiring management that grants the created Application/Service Principal the [Contributor (Privileged administrator) Role](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#contributor). For production environments, a custom role should be created that grants the following permissions: + Beginning in version 3.0.0, the Azure Application Gateway Orchestrator extension supports both [client certificate authentication](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-1-add-a-certificate) and [client secret](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-2-add-a-client-secret) authentication. -- `Microsoft.Resources/subscriptions/resourcegroups/read` - Read : Get Resource Group -- `Microsoft.Network/applicationGateways/read` - Read : Get Application Gateway -- `Microsoft.Network/applicationGateways/write` - Write : Create or Update Application Gateway -- `Microsoft.ManagedIdentity/userAssignedIdentities/assign/action` - Other : RBAC action for assigning an existing user assigned identity to a resource -- `Microsoft.Network/virtualNetworks/subnets/join/action` - Other : Joins a virtual network. Not Alertable. + * **Client Secret** - Follow [Microsoft's documentation](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-2-add-a-client-secret) to create a Client Secret. This secret will be used as the **Server Password** field in the [Certificate Store Configuration](#certificate-store-configuration) section. + * **Client Certificate** - Create a client certificate key pair with the Client Authentication extended key usage. The client certificate will be used in the ClientCertificate field in the [Certificate Store Configuration](#certificate-store-configuration) section. If you have access to Keyfactor Command, the instructions in this section walk you through enrolling a certificate and ensuring that it's in the correct format. Once enrolled, follow [Microsoft's documentation](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-1-add-a-certificate) to add the _public key_ certificate (no private key) to the service principal used for authentication. -> Note that even if the Service Principal has permission to perform the 'Microsoft.Network/applicationGateways/write' action over the scope of the required resource group, there may be other permissions that are required by the CreateOrUpdate operation depending on the complexity of the Application Gateway's configuration. As such, the list of permissions above should not be considered as comprehensive. + The certificate can be in either of the following formats: + * Base64-encoded PKCS#12 (PFX) with a matching private key. + * Base64-encoded PEM-encoded certificate _and_ PEM-encoded PKCS8 private key. Make sure that the certificate and private key are separated with a newline. The order doesn't matter - the extension will determine which is which. -If the managed Application Gateway is integrated with Azure Key Vault per the discussion in the [Certificates Imported to Application Gateways from Azure Key Vault](#certificates-imported-to-application-gateways-from-azure-key-vault) section, an [Access policy must be created](https://learn.microsoft.com/en-us/azure/key-vault/general/assign-access-policy?tabs=azure-portal) that grants the Application/Service Principal the Get secret permission for the associated Azure Key Vault. + If the private key is encrypted, the encryption password will replace the **Server Password** field in the [Certificate Store Configuration](#certificate-store-configuration) section. -## Creating Store Types for the Azure Application Gateway Orchestrator -To get started with the Azure Application Gateway Orchestrator Extension, you'll need to create 2 store types in Keyfactor Command. The recommended and supported way to create store types is using the `kfutil` command line tool. Install [Kfutil](https://github.com/Keyfactor/kfutil) if it is not already installed. Once installed, use `kfutil login` to log into the target Command environment. + > **Creating and Formatting a Client Certificate using Keyfactor Command** + > + > To get started quickly, you can follow the instructions below to create and properly format a client certificate to authenticate to the Microsoft Graph API. + > + > 1. In Keyfactor Command, hover over **Enrollment** and select **PFX Enrollment**. + > 2. Select a **Template** that supports Client Authentication as an extended key usage. + > 3. Populate the certificate subject as appropriate for the Template. It may be sufficient to only populate the Common Name, but consult your IT policy to ensure that this certificate is compliant. + > 4. At the bottom of the page, uncheck the box for **Include Chain**, and select either **PFX** or **PEM** as the certificate Format. + > 5. Make a note of the password on the next page - it won't be shown again. + > 6. Prepare the certificate and private key for Azure and the Orchestrator extension: + > * If you downloaded the certificate in PEM format, use the commands below: + > + > ```shell + > # Verify that the certificate downloaded from Command contains the certificate and private key. They should be in the same file + > cat <your_certificate.pem> + > + > # Separate the certificate from the private key + > openssl x509 -in <your_certificate.pem> -out pubkeycert.pem + > + > # Base64 encode the certificate and private key + > cat <your_certificate.pem> | base64 > clientcertkeypair.pem.base64 + > ``` + > + > * If you downloaded the certificate in PFX format, use the commands below: + > + > ```shell + > # Export the certificate from the PFX file + > openssl pkcs12 -in <your_certificate.pfx> -clcerts -nokeys -out pubkeycert.pem + > + > # Base64 encode the PFX file + > cat <your_certificate.pfx> | base64 > clientcert.pfx.base64 + > ``` + > 7. Follow [Microsoft's documentation](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-1-add-a-certificate) to add the public key certificate to the service principal used for authentication. + > + > You will use `clientcert.[pem|pfx].base64` as the **ClientCertificate** field in the [Certificate Store Configuration](#certificate-store-configuration) section. -Then, use the following commands to create the store types: -```shell -kfutil store-types create AzureAppGw -kfutil store-types create AppGwBin -``` + </details> -It is not required to create all store types. Only create the store types that are needed for the integration. +2. Create Certificate Store Types for the Azure Application Gateway Orchestrator extension. -If you prefer to create store types manually in the UI, navigate to your Command instance and follow the instructions below. -<details><summary>AzureAppGw</summary> + * **Using kfutil**: -Create a store type called `AzureAppGw` with the attributes in the tables below: + ```shell + # Azure Application Gateway Certificate + kfutil store-types create AzureAppGw + ``` -### Basic Tab -| Attribute | Value | Description | -| --------- | ----- | ----- | -| Name | Azure Application Gateway Certificate | Display name for the store type (may be customized) | -| Short Name | AzureAppGw | Short display name for the store type | -| Capability | AzureAppGw | Store type name orchestrator will register with. Check the box to allow entry of value | -| Supported Job Types (check the box for each) | Add, Remove, Discovery, Inventory | Job types the extension supports | -| Needs Server | ✓ | Determines if a target server name is required when creating store | -| Blueprint Allowed | | Determines if store type may be included in an Orchestrator blueprint | -| Uses PowerShell | | Determines if underlying implementation is PowerShell | -| Requires Store Password | | Determines if a store password is required when configuring an individual store. | -| Supports Entry Password | | Determines if an individual entry within a store can have a password. | + * **Manually**: + * [Azure Application Gateway Certificate](docs/azureappgw.md#certificate-store-type-configuration) +3. Install the Azure Application Gateway Universal Orchestrator extension. + + * **Using kfutil**: On the server that that hosts the Universal Orchestrator, run the following command: -The Basic tab should look like this: + ```shell + # Windows Server + kfutil orchestrator extension -e azure-appgateway-orchestrator@latest --out "C:\Program Files\Keyfactor\Keyfactor Orchestrator\extensions" - + # Linux + kfutil orchestrator extension -e azure-appgateway-orchestrator@latest --out "/opt/keyfactor/orchestrator/extensions" + ``` + + * **Manually**: Follow the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/InstallingAgents/NetCoreOrchestrator/CustomExtensions.htm?Highlight=extensions) to install the latest [Azure Application Gateway Universal Orchestrator extension](https://github.com/Keyfactor/azure-appgateway-orchestrator/releases/latest). -### Advanced Tab -| Attribute | Value | Description | -| --------- | ----- | ----- | -| Supports Custom Alias | Required | Determines if an individual entry within a store can have a custom Alias. | -| Private Key Handling | Required | This determines if Keyfactor can send the private key associated with a certificate to the store. Required because IIS certificates without private keys would be invalid. | -| PFX Password Style | Default | 'Default' - PFX password is randomly generated, 'Custom' - PFX password may be specified when the enrollment job is created (Requires the Allow Custom Password application setting to be enabled.) | +4. Create new certificate stores in Keyfactor Command for the Sample Universal Orchestrator extension. + * [Azure Application Gateway Certificate](docs/azureappgw.md#certificate-store-configuration) +</details> +<details><summary>Azure Application Gateway Certificate Binding</summary> -The Advanced tab should look like this: - +1. Follow the [requirements section](docs/appgwbin.md#requirements) to configure a Service Account and grant necessary API permissions. -### Custom Fields Tab -Custom fields operate at the certificate store level and are used to control how the orchestrator connects to the remote target server containing the certificate store to be managed. The following custom fields should be added to the store type: + <details><summary>Requirements</summary> -| Name | Display Name | Type | Default Value/Options | Required | Description | -| ---- | ------------ | ---- | --------------------- | -------- | ----------- | -| ServerUsername | Server Username | Secret | None | ✓ | Application ID of the service principal, representing the identity used for managing the Application Gateway. | -| ServerPassword | Server Password | Secret | None | ✓ | Secret of the service principal that will be used to manage the Application Gateway. | -| ServerUseSsl | Use SSL | Bool | true | | Indicates whether SSL usage is enabled for the connection. | -| AzureCloud | Azure Global Cloud Authority Host | MultipleChoice | public,china,germany,government | | Specifies the Azure Cloud instance used by the organization. | + ### Azure Service Principal (Azure Resource Manager Authentication) + The Azure Application Gateway Orchestrator extension uses an [Azure Service Principal](https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals?tabs=browser) for authentication. Follow [Microsoft's documentation](https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal) to create a service principal. -The Custom Fields tab should look like this: + #### Azure Application Gateway permissions - + For quick start and non-production environments, a Role Assignment should be created on _each resource group_ that own Application Gateways desiring management that grants the created Application/Service Principal the [Contributor (Privileged administrator) Role](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#contributor). For production environments, a custom role should be created that grants the following permissions: -</details> + - `Microsoft.Resources/subscriptions/resourcegroups/read` - Read : Get Resource Group + - `Microsoft.Network/applicationGateways/read` - Read : Get Application Gateway + - `Microsoft.Network/applicationGateways/write` - Write : Create or Update Application Gateway + - `Microsoft.ManagedIdentity/userAssignedIdentities/assign/action` - Other : RBAC action for assigning an existing user assigned identity to a resource + - `Microsoft.Network/virtualNetworks/subnets/join/action` - Other : Joins a virtual network. Not Alertable. -<details><summary>AppGwBin</summary> + > Note that even if the Service Principal has permission to perform the 'Microsoft.Network/applicationGateways/write' action over the scope of the required resource group, there may be other permissions that are required by the CreateOrUpdate operation depending on the complexity of the Application Gateway's configuration. As such, the list of permissions above should not be considered as comprehensive. -Create a store type called `AppGwBin` with the attributes in the tables below: + #### Azure Key Vault permissions -### Basic Tab -| Attribute | Value | Description | -| --------- | ----- | ----- | -| Name | Azure Application Gateway Certificate Binding | Display name for the store type (may be customized) | -| Short Name | AppGwBin | Short display name for the store type | -| Capability | AzureAppGwBin | Store type name orchestrator will register with. Check the box to allow entry of value | -| Supported Job Types (check the box for each) | Add, Discovery | Job types the extension supports | -| Needs Server | ✓ | Determines if a target server name is required when creating store | -| Blueprint Allowed | | Determines if store type may be included in an Orchestrator blueprint | -| Uses PowerShell | | Determines if underlying implementation is PowerShell | -| Requires Store Password | | Determines if a store password is required when configuring an individual store. | -| Supports Entry Password | | Determines if an individual entry within a store can have a password. | + If the managed Application Gateway is integrated with Azure Key Vault per the discussion in the [Certificates Imported to Application Gateways from Azure Key Vault](#certificates-imported-to-application-gateways-from-azure-key-vault) section, perform one of the following actions for each Key Vault with certificates imported to App Gateways: + * **Azure role-based access control** - Create a Role Assignment that grants the Application/Service Principal the [Key Vault Secrets User](https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli) built-in role. + * **Vault access policy** - [Create an Access Policy](https://learn.microsoft.com/en-us/azure/key-vault/general/assign-access-policy?tabs=azure-portal) that grants the Application/Service Principal the Get secret permission for each Azure Key Vault. + #### Client Certificate or Client Secret -The Basic tab should look like this: + Beginning in version 3.0.0, the Azure Application Gateway Orchestrator extension supports both [client certificate authentication](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-1-add-a-certificate) and [client secret](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-2-add-a-client-secret) authentication. - + * **Client Secret** - Follow [Microsoft's documentation](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-2-add-a-client-secret) to create a Client Secret. This secret will be used as the **Server Password** field in the [Certificate Store Configuration](#certificate-store-configuration) section. + * **Client Certificate** - Create a client certificate key pair with the Client Authentication extended key usage. The client certificate will be used in the ClientCertificate field in the [Certificate Store Configuration](#certificate-store-configuration) section. If you have access to Keyfactor Command, the instructions in this section walk you through enrolling a certificate and ensuring that it's in the correct format. Once enrolled, follow [Microsoft's documentation](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-1-add-a-certificate) to add the _public key_ certificate (no private key) to the service principal used for authentication. -### Advanced Tab -| Attribute | Value | Description | -| --------- | ----- | ----- | -| Supports Custom Alias | Required | Determines if an individual entry within a store can have a custom Alias. | -| Private Key Handling | Required | This determines if Keyfactor can send the private key associated with a certificate to the store. Required because IIS certificates without private keys would be invalid. | -| PFX Password Style | Default | 'Default' - PFX password is randomly generated, 'Custom' - PFX password may be specified when the enrollment job is created (Requires the Allow Custom Password application setting to be enabled.) | + The certificate can be in either of the following formats: + * Base64-encoded PKCS#12 (PFX) with a matching private key. + * Base64-encoded PEM-encoded certificate _and_ PEM-encoded PKCS8 private key. Make sure that the certificate and private key are separated with a newline. The order doesn't matter - the extension will determine which is which. + If the private key is encrypted, the encryption password will replace the **Server Password** field in the [Certificate Store Configuration](#certificate-store-configuration) section. -The Advanced tab should look like this: + > **Creating and Formatting a Client Certificate using Keyfactor Command** + > + > To get started quickly, you can follow the instructions below to create and properly format a client certificate to authenticate to the Microsoft Graph API. + > + > 1. In Keyfactor Command, hover over **Enrollment** and select **PFX Enrollment**. + > 2. Select a **Template** that supports Client Authentication as an extended key usage. + > 3. Populate the certificate subject as appropriate for the Template. It may be sufficient to only populate the Common Name, but consult your IT policy to ensure that this certificate is compliant. + > 4. At the bottom of the page, uncheck the box for **Include Chain**, and select either **PFX** or **PEM** as the certificate Format. + > 5. Make a note of the password on the next page - it won't be shown again. + > 6. Prepare the certificate and private key for Azure and the Orchestrator extension: + > * If you downloaded the certificate in PEM format, use the commands below: + > + > ```shell + > # Verify that the certificate downloaded from Command contains the certificate and private key. They should be in the same file + > cat <your_certificate.pem> + > + > # Separate the certificate from the private key + > openssl x509 -in <your_certificate.pem> -out pubkeycert.pem + > + > # Base64 encode the certificate and private key + > cat <your_certificate.pem> | base64 > clientcertkeypair.pem.base64 + > ``` + > + > * If you downloaded the certificate in PFX format, use the commands below: + > + > ```shell + > # Export the certificate from the PFX file + > openssl pkcs12 -in <your_certificate.pfx> -clcerts -nokeys -out pubkeycert.pem + > + > # Base64 encode the PFX file + > cat <your_certificate.pfx> | base64 > clientcert.pfx.base64 + > ``` + > 7. Follow [Microsoft's documentation](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-1-add-a-certificate) to add the public key certificate to the service principal used for authentication. + > + > You will use `clientcert.[pem|pfx].base64` as the **ClientCertificate** field in the [Certificate Store Configuration](#certificate-store-configuration) section. - -### Custom Fields Tab -Custom fields operate at the certificate store level and are used to control how the orchestrator connects to the remote target server containing the certificate store to be managed. The following custom fields should be added to the store type: -| Name | Display Name | Type | Default Value/Options | Required | Description | -| ---- | ------------ | ---- | --------------------- | -------- | ----------- | -| ServerUsername | Server Username | Secret | None | | Application ID of the service principal, representing the identity used for managing the Application Gateway. | -| ServerPassword | Server Password | Secret | None | | Secret of the service principal that will be used to manage the Application Gateway. | -| ServerUseSsl | Use SSL | Bool | true | ✓ | Indicates whether SSL usage is enabled for the connection. | -| AzureCloud | Azure Global Cloud Authority Host | MultipleChoice | public,china,germany,government | | Specifies the Azure Cloud instance used by the organization. | + </details> +2. Create Certificate Store Types for the Azure Application Gateway Orchestrator extension. -The Custom Fields tab should look like this: + * **Using kfutil**: - + ```shell + # Azure Application Gateway Certificate Binding + kfutil store-types create AppGwBin + ``` -</details> + * **Manually**: + * [Azure Application Gateway Certificate Binding](docs/appgwbin.md#certificate-store-type-configuration) -## Instantiating New Azure Application Gateway Orchestrator Stores -Once the store types have been created, you can instantiate certificate stores for any of the 2 store types. This section describes how to instantiate a certificate store for each store type. Creating new certificate stores is how certificates in the remote platform are inventoried and managed by the orchestrator. -<details><summary>AzureAppGw</summary> +3. Install the Azure Application Gateway Universal Orchestrator extension. + + * **Using kfutil**: On the server that that hosts the Universal Orchestrator, run the following command: -In Keyfactor Command, navigate to Certificate Stores from the Locations Menu. Click the Add button to create a new Certificate Store using the settings defined below. + ```shell + # Windows Server + kfutil orchestrator extension -e azure-appgateway-orchestrator@latest --out "C:\Program Files\Keyfactor\Keyfactor Orchestrator\extensions" -| Attribute | Description | -| --------- | ----------- | -| Category | Select Azure Application Gateway Certificate or the customized certificate store name from the previous step. | -| Container | Optional container to associate certificate store with. | -| Client Machine | The Azure Tenant ID of the service principal, representing the Tenant ID where the Application/Service Principal is managed. | -| Store Path | Azure resource ID of the application gateway, following the format: `/subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/applicationGateways/<application-gateway-name>`. | -| Orchestrator | Select an approved orchestrator capable of managing AzureAppGw certificates. Specifically, one with the AzureAppGw capability. | -| Server Username | Application ID of the service principal, representing the identity used for managing the Application Gateway. | -| Server Password | Secret of the service principal that will be used to manage the Application Gateway. | -| Use SSL | Indicates whether SSL usage is enabled for the connection. | -| Azure Global Cloud Authority Host | Specifies the Azure Cloud instance used by the organization. | + # Linux + kfutil orchestrator extension -e azure-appgateway-orchestrator@latest --out "/opt/keyfactor/orchestrator/extensions" + ``` + * **Manually**: Follow the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/InstallingAgents/NetCoreOrchestrator/CustomExtensions.htm?Highlight=extensions) to install the latest [Azure Application Gateway Universal Orchestrator extension](https://github.com/Keyfactor/azure-appgateway-orchestrator/releases/latest). +4. Create new certificate stores in Keyfactor Command for the Sample Universal Orchestrator extension. + * [Azure Application Gateway Certificate Binding](docs/appgwbin.md#certificate-store-configuration) </details> -<details><summary>AppGwBin</summary> -In Keyfactor Command, navigate to Certificate Stores from the Locations Menu. Click the Add button to create a new Certificate Store using the settings defined below. +## License -| Attribute | Description | -| --------- | ----------- | -| Category | Select Azure Application Gateway Certificate Binding or the customized certificate store name from the previous step. | -| Container | Optional container to associate certificate store with. | -| Client Machine | The Azure Tenant ID of the service principal, representing the Tenant ID where the Application/Service Principal is managed. | -| Store Path | Azure resource ID of the application gateway, following the format: `/subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/applicationGateways/<application-gateway-name>`. | -| Orchestrator | Select an approved orchestrator capable of managing AppGwBin certificates. Specifically, one with the AzureAppGwBin capability. | -| Server Username | Application ID of the service principal, representing the identity used for managing the Application Gateway. | -| Server Password | Secret of the service principal that will be used to manage the Application Gateway. | -| Use SSL | Indicates whether SSL usage is enabled for the connection. | -| Azure Global Cloud Authority Host | Specifies the Azure Cloud instance used by the organization. | +Apache License 2.0, see [LICENSE](LICENSE). +## Related Integrations -</details> +See all [Keyfactor Universal Orchestrator extensions](https://github.com/orgs/Keyfactor/repositories?q=orchestrator). When creating cert store type manually, that store property names and entry parameter names are case sensitive diff --git a/docs/appgwbin.md b/docs/appgwbin.md new file mode 100644 index 0000000..6f51835 --- /dev/null +++ b/docs/appgwbin.md @@ -0,0 +1,229 @@ +## Azure Application Gateway Certificate Binding + +The Azure Application Gateway Certificate Binding store type, `AzureAppGwBin`, represents certificates bound to TLS Listeners on Azure App Gateways. The only supported operations on this store type are Management Add and Inventory. The Management Add operation for this store type creates and binds an ApplicationGatewaySslCertificate to a pre-existing TLS Listener on an Application Gateway. When the Add operation is configured in Keyfactor Command, the certificate Alias configures which TLS Listener the certificate will be bound to. If the HTTPS listener is already bound to a certificate with the same name, the Management Add operation will perform a replacement of the certificate, _**regardless of the existence of the Replace flag configured with renewal jobs**_. The replacement operation performs several API interactions with Azure since at least one certificate must be bound to a TLS listener at all times, and the name of ApplicationGatewaySslCertificates must be unique. For the sake of completeness, the following describes the mechanics of this replacement operation: + +1. Determine the name of the certificate currently bound to the HTTPS listener - Alias in 100% of cases if the certificate was originally added by the App Gateway Orchestrator Extension, or something else if the certificate was added by some other means (IE, the Azure Portal, or some other API client). +2. Create and bind a temporary certificate to the HTTPS listener with the same name as the Alias. +3. Delete the AppGatewayCertificate previously bound to the HTTPS listener called Alias. +4. Recreate and bind an AppGatewayCertificate with the same name as the HTTPS listener called Alias. If the Alias is called `listener1`, the new certificate will be called `listener1`, regardless of the name of the certificate that was previously bound to the listener. +5. Delete the temporary certificate. + +In the unlikely event that a failure occurs at any point in the replacement procedure, it's expected that the correct certificate will be served by the TLS Listener, since most of the mechanics are actually implemented to resolve the unique naming requirement. + +The Inventory job type for `AzureAppGwBin` reports only ApplicationGatewaySslCertificates that are bound to TLS Listeners. If the certificate was added with Keyfactor Command and this orchestrator extension, the name of the certificate in the Application Gateway will be the same as the TLS Listener. E.g., if the Alias configured in Command corresponds to a TLS Listener called `location-service-https-lstn1`, the certificate in the Application Gateway will also be called `location-service-https-lstn1`. However, if the certificate was added to the Application Gateway by other means (such as the Azure CLI, import from AKV, etc.), the Inventory job mechanics will still report the name of the TLS Listener in its report back to Command. + + + +### Supported Job Types + +| Job Name | Supported | +| -------- | --------- | +| Inventory | ✅ | +| Management Add | ✅ | +| Management Remove | | +| Discovery | ✅ | +| Create | | +| Reenrollment | | + +## Requirements + +### Azure Service Principal (Azure Resource Manager Authentication) + +The Azure Application Gateway Orchestrator extension uses an [Azure Service Principal](https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals?tabs=browser) for authentication. Follow [Microsoft's documentation](https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal) to create a service principal. + +#### Azure Application Gateway permissions + +For quick start and non-production environments, a Role Assignment should be created on _each resource group_ that own Application Gateways desiring management that grants the created Application/Service Principal the [Contributor (Privileged administrator) Role](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#contributor). For production environments, a custom role should be created that grants the following permissions: + +- `Microsoft.Resources/subscriptions/resourcegroups/read` - Read : Get Resource Group +- `Microsoft.Network/applicationGateways/read` - Read : Get Application Gateway +- `Microsoft.Network/applicationGateways/write` - Write : Create or Update Application Gateway +- `Microsoft.ManagedIdentity/userAssignedIdentities/assign/action` - Other : RBAC action for assigning an existing user assigned identity to a resource +- `Microsoft.Network/virtualNetworks/subnets/join/action` - Other : Joins a virtual network. Not Alertable. + +> Note that even if the Service Principal has permission to perform the 'Microsoft.Network/applicationGateways/write' action over the scope of the required resource group, there may be other permissions that are required by the CreateOrUpdate operation depending on the complexity of the Application Gateway's configuration. As such, the list of permissions above should not be considered as comprehensive. + +#### Azure Key Vault permissions + +If the managed Application Gateway is integrated with Azure Key Vault per the discussion in the [Certificates Imported to Application Gateways from Azure Key Vault](#certificates-imported-to-application-gateways-from-azure-key-vault) section, perform one of the following actions for each Key Vault with certificates imported to App Gateways: +* **Azure role-based access control** - Create a Role Assignment that grants the Application/Service Principal the [Key Vault Secrets User](https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli) built-in role. +* **Vault access policy** - [Create an Access Policy](https://learn.microsoft.com/en-us/azure/key-vault/general/assign-access-policy?tabs=azure-portal) that grants the Application/Service Principal the Get secret permission for each Azure Key Vault. + +#### Client Certificate or Client Secret + +Beginning in version 3.0.0, the Azure Application Gateway Orchestrator extension supports both [client certificate authentication](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-1-add-a-certificate) and [client secret](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-2-add-a-client-secret) authentication. + +* **Client Secret** - Follow [Microsoft's documentation](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-2-add-a-client-secret) to create a Client Secret. This secret will be used as the **Server Password** field in the [Certificate Store Configuration](#certificate-store-configuration) section. +* **Client Certificate** - Create a client certificate key pair with the Client Authentication extended key usage. The client certificate will be used in the ClientCertificate field in the [Certificate Store Configuration](#certificate-store-configuration) section. If you have access to Keyfactor Command, the instructions in this section walk you through enrolling a certificate and ensuring that it's in the correct format. Once enrolled, follow [Microsoft's documentation](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-1-add-a-certificate) to add the _public key_ certificate (no private key) to the service principal used for authentication. + + The certificate can be in either of the following formats: + * Base64-encoded PKCS#12 (PFX) with a matching private key. + * Base64-encoded PEM-encoded certificate _and_ PEM-encoded PKCS8 private key. Make sure that the certificate and private key are separated with a newline. The order doesn't matter - the extension will determine which is which. + + If the private key is encrypted, the encryption password will replace the **Server Password** field in the [Certificate Store Configuration](#certificate-store-configuration) section. + +> **Creating and Formatting a Client Certificate using Keyfactor Command** +> +> To get started quickly, you can follow the instructions below to create and properly format a client certificate to authenticate to the Microsoft Graph API. +> +> 1. In Keyfactor Command, hover over **Enrollment** and select **PFX Enrollment**. +> 2. Select a **Template** that supports Client Authentication as an extended key usage. +> 3. Populate the certificate subject as appropriate for the Template. It may be sufficient to only populate the Common Name, but consult your IT policy to ensure that this certificate is compliant. +> 4. At the bottom of the page, uncheck the box for **Include Chain**, and select either **PFX** or **PEM** as the certificate Format. +> 5. Make a note of the password on the next page - it won't be shown again. +> 6. Prepare the certificate and private key for Azure and the Orchestrator extension: +> * If you downloaded the certificate in PEM format, use the commands below: +> +> ```shell +> # Verify that the certificate downloaded from Command contains the certificate and private key. They should be in the same file +> cat <your_certificate.pem> +> +> # Separate the certificate from the private key +> openssl x509 -in <your_certificate.pem> -out pubkeycert.pem +> +> # Base64 encode the certificate and private key +> cat <your_certificate.pem> | base64 > clientcertkeypair.pem.base64 +> ``` +> +> * If you downloaded the certificate in PFX format, use the commands below: +> +> ```shell +> # Export the certificate from the PFX file +> openssl pkcs12 -in <your_certificate.pfx> -clcerts -nokeys -out pubkeycert.pem +> +> # Base64 encode the PFX file +> cat <your_certificate.pfx> | base64 > clientcert.pfx.base64 +> ``` +> 7. Follow [Microsoft's documentation](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-1-add-a-certificate) to add the public key certificate to the service principal used for authentication. +> +> You will use `clientcert.[pem|pfx].base64` as the **ClientCertificate** field in the [Certificate Store Configuration](#certificate-store-configuration) section. + + + +## Extension Mechanics + +### Discovery Job + +The Discovery operation discovers all Azure Application Gateways in each resource group that the service principal has access to. The discovered Application Gateways are reported back to Command and can be easily added as certificate stores from the Locations tab. + +The Discovery operation uses the "Directories to search" field, and accepts input in one of the following formats: +- `*` - If the asterisk symbol `*` is used, the extension will search for Application Gateways in every resource group that the service principal has access to, but only in the tenant that the discovery job was configured for as specified by the "Client Machine" field in the certificate store configuration. +- `<tenant-id>,<tenant-id>,...` - If a comma-separated list of tenant IDs is used, the extension will search for Application Gateways in every resource group and tenant specified in the list. The tenant IDs should be the GUIDs associated with each tenant, and it's the user's responsibility to ensure that the service principal has access to the specified tenants. + +> The Discovery Job only supports Client Secret authentication. + +### Certificates Imported to Application Gateways from Azure Key Vault + +Natively, Azure Application Gateways support integration with Azure Key Vault for secret/certificate management. This integration works by creating a TLS Listener certificate with a reference to a secret in Azure Key Vault (specifically, a URI in the format `https://<vault-name>.vault.azure.net/secrets/<secret-name>`), authenticated using a Managed Identity. If the Application Gateway orchestrator extension is deployed to manage App Gateways with certificates imported from Azure Key Vault, the following truth table represents the possible operations and their result, specifically with respect to AKV. + +| Store Type | Operation | Result | +|--------------|-----------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `AzureAppGw` | Inventory | Certificate is downloaded from Azure Key Vault and reported back to Keyfactor Command. In Keyfactor Command, the certificate will show as being located in the AzureAppGw certificate store [in addition to the AKV, if AKV orchestrator extension is also deployed]. | +| `AzureAppGw` | Add | The Add operation will not create secrets in AKV; it creates ApplicationGatewaySslCertificates.<br/> <br/>If an `AzureAppGw` Add operation is scheduled with the Replace flag, the _**link to the AKV certificate will be broken**_, and a native ApplicationGatewaySslCertificate will be created in its place - The secret in AKV will still exist. | +| `AzureAppGw` | Remove | The ApplicationGatewaySslCertificate is deleted from the Application Gateway, but the secret that the certificate referenced in AKV still exists. | +| `AzureAppGwBin` | Inventory | Certificate is downloaded from Azure Key Vault and reported back to Keyfactor Command. In Keyfactor Command, the certificate will show as present in both an `AzureAppGw` certificate store _and_ an `AppGwBin` certificate store [in addition to the AKV, if AKV orchestrator extension is also deployed]. | +| `AzureAppGwBin` | Add | The Add operation will not create secrets in AKV; it creates ApplicationGatewaySslCertificates. <br/> <br/>If a certificate with the same name as the TLS Listener already exists, it will be _replaced_ by a new ApplicationGatewaySslCertificate. <br/> <br/>If the certificate being replaced was imported from AKV, this binding will be broken and the secret will still exist in AKV. | + +#### Mechanics of the Azure Key Vault Download Operation for Inventory Jobs that report certificates imported from AKV + +If an AzureApplicationSslCertificate references a secret in AKV (was imported to the App Gateway from AKV), the inventory job will create and use a `SecretClient` from the [`Azure.Security.KeyVault.Secrets.SecretClient` dotnet package](https://learn.microsoft.com/en-us/dotnet/api/azure.security.keyvault.secrets.secretclient?view=azure-dotnet). Authentication to AKV via this client is configured using the exact same `TokenCredential` provided by the [Azure Identity client library for .NET](https://learn.microsoft.com/en-us/dotnet/api/overview/azure/identity-readme?view=azure-dotnet). This means that the Service Principal described in the [Azure Configuration](#azure-configuration) section must also have appropriate permissions to read secrets from the AKV that the App Gateway is integrated with. The secret referenced in the AzureApplicationSslCertificate will be accessed exactly as reported by Azure, regardless of whether it exists in AKV. + + + +## Certificate Store Type Configuration + +The recommended method for creating the `AppGwBin` Certificate Store Type is to use [kfutil](https://github.com/Keyfactor/kfutil). After installing, use the following command to create the `` Certificate Store Type: + +```shell +kfutil store-types create AppGwBin +``` + +<details><summary>AppGwBin</summary> + +Create a store type called `AppGwBin` with the attributes in the tables below: + +### Basic Tab +| Attribute | Value | Description | +| --------- | ----- | ----- | +| Name | Azure Application Gateway Certificate Binding | Display name for the store type (may be customized) | +| Short Name | AppGwBin | Short display name for the store type | +| Capability | AzureAppGwBin | Store type name orchestrator will register with. Check the box to allow entry of value | +| Supported Job Types (check the box for each) | Add, Discovery, Remove | Job types the extension supports | +| Supports Add | ✅ | Check the box. Indicates that the Store Type supports Management Add | +| Supports Remove | | Indicates that the Store Type supports Management Remove | +| Supports Discovery | ✅ | Check the box. Indicates that the Store Type supports Discovery | +| Supports Reenrollment | | Indicates that the Store Type supports Reenrollment | +| Supports Create | | Indicates that the Store Type supports store creation | +| Needs Server | ✅ | Determines if a target server name is required when creating store | +| Blueprint Allowed | | Determines if store type may be included in an Orchestrator blueprint | +| Uses PowerShell | | Determines if underlying implementation is PowerShell | +| Requires Store Password | | Determines if a store password is required when configuring an individual store. | +| Supports Entry Password | | Determines if an individual entry within a store can have a password. | + +The Basic tab should look like this: + + + +### Advanced Tab +| Attribute | Value | Description | +| --------- | ----- | ----- | +| Supports Custom Alias | Required | Determines if an individual entry within a store can have a custom Alias. | +| Private Key Handling | Required | This determines if Keyfactor can send the private key associated with a certificate to the store. Required because IIS certificates without private keys would be invalid. | +| PFX Password Style | Default | 'Default' - PFX password is randomly generated, 'Custom' - PFX password may be specified when the enrollment job is created (Requires the Allow Custom Password application setting to be enabled.) | + +The Advanced tab should look like this: + + + +### Custom Fields Tab +Custom fields operate at the certificate store level and are used to control how the orchestrator connects to the remote target server containing the certificate store to be managed. The following custom fields should be added to the store type: + +| Name | Display Name | Type | Default Value/Options | Required | Description | +| ---- | ------------ | ---- | --------------------- | -------- | ----------- | +| ServerUsername | Server Username | Secret | | | Application ID of the service principal, representing the identity used for managing the Application Gateway. | +| ServerPassword | Server Password | Secret | | | A Client Secret that the extension will use to authenticate with the Azure Resource Management API for managing Application Gateway certificates, OR the password that encrypts the private key in ClientCertificate | +| ClientCertificate | Client Certificate | Secret | | | The client certificate used to authenticate with Azure Resource Management API for managing Application Gateway certificates. See the [requirements](#client-certificate-or-client-secret) for more information. | +| AzureCloud | Azure Global Cloud Authority Host | MultipleChoice | public,china,germany,government | | Specifies the Azure Cloud instance used by the organization. | +| ServerUseSsl | Use SSL | Bool | true | ✅ | Specifies whether SSL should be used for communication with the server. Set to 'true' to enable SSL, and 'false' to disable it. | + + +The Custom Fields tab should look like this: + + + + + +</details> + +## Certificate Store Configuration + +After creating the `AppGwBin` Certificate Store Type and installing the Azure Application Gateway Universal Orchestrator extension, you can create new [Certificate Stores](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Certificate%20Stores.htm?Highlight=certificate%20store) to manage certificates in the remote platform. + +The following table describes the required and optional fields for the `AppGwBin` certificate store type. + +| Attribute | Description | +| --------- | ----------- | +| Category | Select "Azure Application Gateway Certificate Binding" or the customized certificate store name from the previous step. | +| Container | Optional container to associate certificate store with. | +| Client Machine | The Azure Tenant (directory) ID that owns the Service Principal. | +| Store Path | Azure resource ID of the application gateway, following the format: /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/applicationGateways/<application-gateway-name>. | +| Orchestrator | Select an approved orchestrator capable of managing `AppGwBin` certificates. Specifically, one with the `AzureAppGwBin` capability. | +| ServerUsername | Application ID of the service principal, representing the identity used for managing the Application Gateway. | +| ServerPassword | A Client Secret that the extension will use to authenticate with the Azure Resource Management API for managing Application Gateway certificates, OR the password that encrypts the private key in ClientCertificate | +| ClientCertificate | The client certificate used to authenticate with Azure Resource Management API for managing Application Gateway certificates. See the [requirements](#client-certificate-or-client-secret) for more information. | +| AzureCloud | Specifies the Azure Cloud instance used by the organization. | +| ServerUseSsl | Specifies whether SSL should be used for communication with the server. Set to 'true' to enable SSL, and 'false' to disable it. | + +* **Using kfutil** + + ```shell + # Generate a CSV template for the AzureApp certificate store + kfutil stores import generate-template --store-type-name AppGwBin --outpath AppGwBin.csv + + # Open the CSV file and fill in the required fields for each certificate store. + + # Import the CSV file to create the certificate stores + kfutil stores import csv --store-type-name AppGwBin --file AppGwBin.csv + ``` + +* **Manually with the Command UI**: In Keyfactor Command, navigate to Certificate Stores from the Locations Menu. Click the Add button to create a new Certificate Store using the attributes in the table above. \ No newline at end of file diff --git a/docs/azureappgw.md b/docs/azureappgw.md new file mode 100644 index 0000000..be302c1 --- /dev/null +++ b/docs/azureappgw.md @@ -0,0 +1,225 @@ +## Azure Application Gateway Certificate + +The Azure Application Gateway Certificate store type, `AzureAppGw`, manages `ApplicationGatewaySslCertificate` objects owned by Azure Application Gateways. This store type collects inventory and manages all ApplicationGatewaySslCertificate objects associated with an Application Gateway. The store type is implemented primarily for Inventory and Management Remove operations, since the intended usage of ApplicationGatewaySslCertificates in Application Gateways is for serving TLS client traffic via TLS Listeners. Management Add and associated logic for certificate renewal is also supported for this certificate store type for completeness, but the primary intended functionality of this extension is implemented with the App Gateway Certificate Binding store type. + +> If an ApplicationGatewaySslCertificate is bound to a TLS Listener at the time of a Management Remove operation, the operation will fail since at least one certificate must be bound at all times. + +> If a renewal job is scheduled for an `AzureAppGw` certificate store, the extension will report a success and perform no action if the certificate being renewed is bound to a TLS Listener. This is because a certificate located in an `AzureAppGw` certificate store that is bound to a TLS Listener is logically the same as the same certificate located in an `AzureAppGwBin` store type. For this reason, it's expected that the certificate will be renewed and re-bound to the listener by the `AppGwBin` certificate operations. +> +> If the renewed certificate is not bound to a TLS Listener, the operation will be performed the same as any certificate renewal process that honors the Overwrite flag. + + + +### Supported Job Types + +| Job Name | Supported | +| -------- | --------- | +| Inventory | ✅ | +| Management Add | ✅ | +| Management Remove | ✅ | +| Discovery | ✅ | +| Create | | +| Reenrollment | | + +## Requirements + +### Azure Service Principal (Azure Resource Manager Authentication) + +The Azure Application Gateway Orchestrator extension uses an [Azure Service Principal](https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals?tabs=browser) for authentication. Follow [Microsoft's documentation](https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal) to create a service principal. + +#### Azure Application Gateway permissions + +For quick start and non-production environments, a Role Assignment should be created on _each resource group_ that own Application Gateways desiring management that grants the created Application/Service Principal the [Contributor (Privileged administrator) Role](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#contributor). For production environments, a custom role should be created that grants the following permissions: + +- `Microsoft.Resources/subscriptions/resourcegroups/read` - Read : Get Resource Group +- `Microsoft.Network/applicationGateways/read` - Read : Get Application Gateway +- `Microsoft.Network/applicationGateways/write` - Write : Create or Update Application Gateway +- `Microsoft.ManagedIdentity/userAssignedIdentities/assign/action` - Other : RBAC action for assigning an existing user assigned identity to a resource +- `Microsoft.Network/virtualNetworks/subnets/join/action` - Other : Joins a virtual network. Not Alertable. + +> Note that even if the Service Principal has permission to perform the 'Microsoft.Network/applicationGateways/write' action over the scope of the required resource group, there may be other permissions that are required by the CreateOrUpdate operation depending on the complexity of the Application Gateway's configuration. As such, the list of permissions above should not be considered as comprehensive. + +#### Azure Key Vault permissions + +If the managed Application Gateway is integrated with Azure Key Vault per the discussion in the [Certificates Imported to Application Gateways from Azure Key Vault](#certificates-imported-to-application-gateways-from-azure-key-vault) section, perform one of the following actions for each Key Vault with certificates imported to App Gateways: +* **Azure role-based access control** - Create a Role Assignment that grants the Application/Service Principal the [Key Vault Secrets User](https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli) built-in role. +* **Vault access policy** - [Create an Access Policy](https://learn.microsoft.com/en-us/azure/key-vault/general/assign-access-policy?tabs=azure-portal) that grants the Application/Service Principal the Get secret permission for each Azure Key Vault. + +#### Client Certificate or Client Secret + +Beginning in version 3.0.0, the Azure Application Gateway Orchestrator extension supports both [client certificate authentication](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-1-add-a-certificate) and [client secret](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-2-add-a-client-secret) authentication. + +* **Client Secret** - Follow [Microsoft's documentation](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-2-add-a-client-secret) to create a Client Secret. This secret will be used as the **Server Password** field in the [Certificate Store Configuration](#certificate-store-configuration) section. +* **Client Certificate** - Create a client certificate key pair with the Client Authentication extended key usage. The client certificate will be used in the ClientCertificate field in the [Certificate Store Configuration](#certificate-store-configuration) section. If you have access to Keyfactor Command, the instructions in this section walk you through enrolling a certificate and ensuring that it's in the correct format. Once enrolled, follow [Microsoft's documentation](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-1-add-a-certificate) to add the _public key_ certificate (no private key) to the service principal used for authentication. + + The certificate can be in either of the following formats: + * Base64-encoded PKCS#12 (PFX) with a matching private key. + * Base64-encoded PEM-encoded certificate _and_ PEM-encoded PKCS8 private key. Make sure that the certificate and private key are separated with a newline. The order doesn't matter - the extension will determine which is which. + + If the private key is encrypted, the encryption password will replace the **Server Password** field in the [Certificate Store Configuration](#certificate-store-configuration) section. + +> **Creating and Formatting a Client Certificate using Keyfactor Command** +> +> To get started quickly, you can follow the instructions below to create and properly format a client certificate to authenticate to the Microsoft Graph API. +> +> 1. In Keyfactor Command, hover over **Enrollment** and select **PFX Enrollment**. +> 2. Select a **Template** that supports Client Authentication as an extended key usage. +> 3. Populate the certificate subject as appropriate for the Template. It may be sufficient to only populate the Common Name, but consult your IT policy to ensure that this certificate is compliant. +> 4. At the bottom of the page, uncheck the box for **Include Chain**, and select either **PFX** or **PEM** as the certificate Format. +> 5. Make a note of the password on the next page - it won't be shown again. +> 6. Prepare the certificate and private key for Azure and the Orchestrator extension: +> * If you downloaded the certificate in PEM format, use the commands below: +> +> ```shell +> # Verify that the certificate downloaded from Command contains the certificate and private key. They should be in the same file +> cat <your_certificate.pem> +> +> # Separate the certificate from the private key +> openssl x509 -in <your_certificate.pem> -out pubkeycert.pem +> +> # Base64 encode the certificate and private key +> cat <your_certificate.pem> | base64 > clientcertkeypair.pem.base64 +> ``` +> +> * If you downloaded the certificate in PFX format, use the commands below: +> +> ```shell +> # Export the certificate from the PFX file +> openssl pkcs12 -in <your_certificate.pfx> -clcerts -nokeys -out pubkeycert.pem +> +> # Base64 encode the PFX file +> cat <your_certificate.pfx> | base64 > clientcert.pfx.base64 +> ``` +> 7. Follow [Microsoft's documentation](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-1-add-a-certificate) to add the public key certificate to the service principal used for authentication. +> +> You will use `clientcert.[pem|pfx].base64` as the **ClientCertificate** field in the [Certificate Store Configuration](#certificate-store-configuration) section. + + + +## Extension Mechanics + +### Discovery Job + +The Discovery operation discovers all Azure Application Gateways in each resource group that the service principal has access to. The discovered Application Gateways are reported back to Command and can be easily added as certificate stores from the Locations tab. + +The Discovery operation uses the "Directories to search" field, and accepts input in one of the following formats: +- `*` - If the asterisk symbol `*` is used, the extension will search for Application Gateways in every resource group that the service principal has access to, but only in the tenant that the discovery job was configured for as specified by the "Client Machine" field in the certificate store configuration. +- `<tenant-id>,<tenant-id>,...` - If a comma-separated list of tenant IDs is used, the extension will search for Application Gateways in every resource group and tenant specified in the list. The tenant IDs should be the GUIDs associated with each tenant, and it's the user's responsibility to ensure that the service principal has access to the specified tenants. + +> The Discovery Job only supports Client Secret authentication. + +### Certificates Imported to Application Gateways from Azure Key Vault + +Natively, Azure Application Gateways support integration with Azure Key Vault for secret/certificate management. This integration works by creating a TLS Listener certificate with a reference to a secret in Azure Key Vault (specifically, a URI in the format `https://<vault-name>.vault.azure.net/secrets/<secret-name>`), authenticated using a Managed Identity. If the Application Gateway orchestrator extension is deployed to manage App Gateways with certificates imported from Azure Key Vault, the following truth table represents the possible operations and their result, specifically with respect to AKV. + +| Store Type | Operation | Result | +|--------------|-----------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `AzureAppGw` | Inventory | Certificate is downloaded from Azure Key Vault and reported back to Keyfactor Command. In Keyfactor Command, the certificate will show as being located in the AzureAppGw certificate store [in addition to the AKV, if AKV orchestrator extension is also deployed]. | +| `AzureAppGw` | Add | The Add operation will not create secrets in AKV; it creates ApplicationGatewaySslCertificates.<br/> <br/>If an `AzureAppGw` Add operation is scheduled with the Replace flag, the _**link to the AKV certificate will be broken**_, and a native ApplicationGatewaySslCertificate will be created in its place - The secret in AKV will still exist. | +| `AzureAppGw` | Remove | The ApplicationGatewaySslCertificate is deleted from the Application Gateway, but the secret that the certificate referenced in AKV still exists. | +| `AzureAppGwBin` | Inventory | Certificate is downloaded from Azure Key Vault and reported back to Keyfactor Command. In Keyfactor Command, the certificate will show as present in both an `AzureAppGw` certificate store _and_ an `AppGwBin` certificate store [in addition to the AKV, if AKV orchestrator extension is also deployed]. | +| `AzureAppGwBin` | Add | The Add operation will not create secrets in AKV; it creates ApplicationGatewaySslCertificates. <br/> <br/>If a certificate with the same name as the TLS Listener already exists, it will be _replaced_ by a new ApplicationGatewaySslCertificate. <br/> <br/>If the certificate being replaced was imported from AKV, this binding will be broken and the secret will still exist in AKV. | + +#### Mechanics of the Azure Key Vault Download Operation for Inventory Jobs that report certificates imported from AKV + +If an AzureApplicationSslCertificate references a secret in AKV (was imported to the App Gateway from AKV), the inventory job will create and use a `SecretClient` from the [`Azure.Security.KeyVault.Secrets.SecretClient` dotnet package](https://learn.microsoft.com/en-us/dotnet/api/azure.security.keyvault.secrets.secretclient?view=azure-dotnet). Authentication to AKV via this client is configured using the exact same `TokenCredential` provided by the [Azure Identity client library for .NET](https://learn.microsoft.com/en-us/dotnet/api/overview/azure/identity-readme?view=azure-dotnet). This means that the Service Principal described in the [Azure Configuration](#azure-configuration) section must also have appropriate permissions to read secrets from the AKV that the App Gateway is integrated with. The secret referenced in the AzureApplicationSslCertificate will be accessed exactly as reported by Azure, regardless of whether it exists in AKV. + + + +## Certificate Store Type Configuration + +The recommended method for creating the `AzureAppGw` Certificate Store Type is to use [kfutil](https://github.com/Keyfactor/kfutil). After installing, use the following command to create the `` Certificate Store Type: + +```shell +kfutil store-types create AzureAppGw +``` + +<details><summary>AzureAppGw</summary> + +Create a store type called `AzureAppGw` with the attributes in the tables below: + +### Basic Tab +| Attribute | Value | Description | +| --------- | ----- | ----- | +| Name | Azure Application Gateway Certificate | Display name for the store type (may be customized) | +| Short Name | AzureAppGw | Short display name for the store type | +| Capability | AzureAppGw | Store type name orchestrator will register with. Check the box to allow entry of value | +| Supported Job Types (check the box for each) | Add, Discovery, Remove | Job types the extension supports | +| Supports Add | ✅ | Check the box. Indicates that the Store Type supports Management Add | +| Supports Remove | ✅ | Check the box. Indicates that the Store Type supports Management Remove | +| Supports Discovery | ✅ | Check the box. Indicates that the Store Type supports Discovery | +| Supports Reenrollment | | Indicates that the Store Type supports Reenrollment | +| Supports Create | | Indicates that the Store Type supports store creation | +| Needs Server | ✅ | Determines if a target server name is required when creating store | +| Blueprint Allowed | | Determines if store type may be included in an Orchestrator blueprint | +| Uses PowerShell | | Determines if underlying implementation is PowerShell | +| Requires Store Password | | Determines if a store password is required when configuring an individual store. | +| Supports Entry Password | | Determines if an individual entry within a store can have a password. | + +The Basic tab should look like this: + + + +### Advanced Tab +| Attribute | Value | Description | +| --------- | ----- | ----- | +| Supports Custom Alias | Required | Determines if an individual entry within a store can have a custom Alias. | +| Private Key Handling | Required | This determines if Keyfactor can send the private key associated with a certificate to the store. Required because IIS certificates without private keys would be invalid. | +| PFX Password Style | Default | 'Default' - PFX password is randomly generated, 'Custom' - PFX password may be specified when the enrollment job is created (Requires the Allow Custom Password application setting to be enabled.) | + +The Advanced tab should look like this: + + + +### Custom Fields Tab +Custom fields operate at the certificate store level and are used to control how the orchestrator connects to the remote target server containing the certificate store to be managed. The following custom fields should be added to the store type: + +| Name | Display Name | Type | Default Value/Options | Required | Description | +| ---- | ------------ | ---- | --------------------- | -------- | ----------- | +| ServerUsername | Server Username | Secret | | | Application ID of the service principal, representing the identity used for managing the Application Gateway. | +| ServerPassword | Server Password | Secret | | | A Client Secret that the extension will use to authenticate with the Azure Resource Management API for managing Application Gateway certificates, OR the password that encrypts the private key in ClientCertificate | +| ClientCertificate | Client Certificate | Secret | | | The client certificate used to authenticate with Azure Resource Management API for managing Application Gateway certificates. See the [requirements](#client-certificate-or-client-secret) for more information. | +| AzureCloud | Azure Global Cloud Authority Host | MultipleChoice | public,china,germany,government | | Specifies the Azure Cloud instance used by the organization. | +| ServerUseSsl | Use SSL | Bool | true | ✅ | Specifies whether SSL should be used for communication with the server. Set to 'true' to enable SSL, and 'false' to disable it. | + + +The Custom Fields tab should look like this: + + + + + +</details> + +## Certificate Store Configuration + +After creating the `AzureAppGw` Certificate Store Type and installing the Azure Application Gateway Universal Orchestrator extension, you can create new [Certificate Stores](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Certificate%20Stores.htm?Highlight=certificate%20store) to manage certificates in the remote platform. + +The following table describes the required and optional fields for the `AzureAppGw` certificate store type. + +| Attribute | Description | +| --------- | ----------- | +| Category | Select "Azure Application Gateway Certificate" or the customized certificate store name from the previous step. | +| Container | Optional container to associate certificate store with. | +| Client Machine | The Azure Tenant (directory) ID that owns the Service Principal. | +| Store Path | Azure resource ID of the application gateway, following the format: /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/applicationGateways/<application-gateway-name>. | +| Orchestrator | Select an approved orchestrator capable of managing `AzureAppGw` certificates. Specifically, one with the `AzureAppGw` capability. | +| ServerUsername | Application ID of the service principal, representing the identity used for managing the Application Gateway. | +| ServerPassword | A Client Secret that the extension will use to authenticate with the Azure Resource Management API for managing Application Gateway certificates, OR the password that encrypts the private key in ClientCertificate | +| ClientCertificate | The client certificate used to authenticate with Azure Resource Management API for managing Application Gateway certificates. See the [requirements](#client-certificate-or-client-secret) for more information. | +| AzureCloud | Specifies the Azure Cloud instance used by the organization. | +| ServerUseSsl | Specifies whether SSL should be used for communication with the server. Set to 'true' to enable SSL, and 'false' to disable it. | + +* **Using kfutil** + + ```shell + # Generate a CSV template for the AzureApp certificate store + kfutil stores import generate-template --store-type-name AzureAppGw --outpath AzureAppGw.csv + + # Open the CSV file and fill in the required fields for each certificate store. + + # Import the CSV file to create the certificate stores + kfutil stores import csv --store-type-name AzureAppGw --file AzureAppGw.csv + ``` + +* **Manually with the Command UI**: In Keyfactor Command, navigate to Certificate Stores from the Locations Menu. Click the Add button to create a new Certificate Store using the attributes in the table above. \ No newline at end of file diff --git a/docsource/appgwbin.md b/docsource/appgwbin.md new file mode 100644 index 0000000..9818b14 --- /dev/null +++ b/docsource/appgwbin.md @@ -0,0 +1,116 @@ +# Overview + +The Azure Application Gateway Certificate Binding store type, `AzureAppGwBin`, represents certificates bound to TLS Listeners on Azure App Gateways. The only supported operations on this store type are Management Add and Inventory. The Management Add operation for this store type creates and binds an ApplicationGatewaySslCertificate to a pre-existing TLS Listener on an Application Gateway. When the Add operation is configured in Keyfactor Command, the certificate Alias configures which TLS Listener the certificate will be bound to. If the HTTPS listener is already bound to a certificate with the same name, the Management Add operation will perform a replacement of the certificate, _**regardless of the existence of the Replace flag configured with renewal jobs**_. The replacement operation performs several API interactions with Azure since at least one certificate must be bound to a TLS listener at all times, and the name of ApplicationGatewaySslCertificates must be unique. For the sake of completeness, the following describes the mechanics of this replacement operation: + +1. Determine the name of the certificate currently bound to the HTTPS listener - Alias in 100% of cases if the certificate was originally added by the App Gateway Orchestrator Extension, or something else if the certificate was added by some other means (IE, the Azure Portal, or some other API client). +2. Create and bind a temporary certificate to the HTTPS listener with the same name as the Alias. +3. Delete the AppGatewayCertificate previously bound to the HTTPS listener called Alias. +4. Recreate and bind an AppGatewayCertificate with the same name as the HTTPS listener called Alias. If the Alias is called `listener1`, the new certificate will be called `listener1`, regardless of the name of the certificate that was previously bound to the listener. +5. Delete the temporary certificate. + +In the unlikely event that a failure occurs at any point in the replacement procedure, it's expected that the correct certificate will be served by the TLS Listener, since most of the mechanics are actually implemented to resolve the unique naming requirement. + +The Inventory job type for `AzureAppGwBin` reports only ApplicationGatewaySslCertificates that are bound to TLS Listeners. If the certificate was added with Keyfactor Command and this orchestrator extension, the name of the certificate in the Application Gateway will be the same as the TLS Listener. E.g., if the Alias configured in Command corresponds to a TLS Listener called `location-service-https-lstn1`, the certificate in the Application Gateway will also be called `location-service-https-lstn1`. However, if the certificate was added to the Application Gateway by other means (such as the Azure CLI, import from AKV, etc.), the Inventory job mechanics will still report the name of the TLS Listener in its report back to Command. + +# Requirements + +### Azure Service Principal (Azure Resource Manager Authentication) + +The Azure Application Gateway Orchestrator extension uses an [Azure Service Principal](https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals?tabs=browser) for authentication. Follow [Microsoft's documentation](https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal) to create a service principal. + +#### Azure Application Gateway permissions + +For quick start and non-production environments, a Role Assignment should be created on _each resource group_ that own Application Gateways desiring management that grants the created Application/Service Principal the [Contributor (Privileged administrator) Role](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#contributor). For production environments, a custom role should be created that grants the following permissions: + +- `Microsoft.Resources/subscriptions/resourcegroups/read` - Read : Get Resource Group +- `Microsoft.Network/applicationGateways/read` - Read : Get Application Gateway +- `Microsoft.Network/applicationGateways/write` - Write : Create or Update Application Gateway +- `Microsoft.ManagedIdentity/userAssignedIdentities/assign/action` - Other : RBAC action for assigning an existing user assigned identity to a resource +- `Microsoft.Network/virtualNetworks/subnets/join/action` - Other : Joins a virtual network. Not Alertable. + +> Note that even if the Service Principal has permission to perform the 'Microsoft.Network/applicationGateways/write' action over the scope of the required resource group, there may be other permissions that are required by the CreateOrUpdate operation depending on the complexity of the Application Gateway's configuration. As such, the list of permissions above should not be considered as comprehensive. + +#### Azure Key Vault permissions + +If the managed Application Gateway is integrated with Azure Key Vault per the discussion in the [Certificates Imported to Application Gateways from Azure Key Vault](#certificates-imported-to-application-gateways-from-azure-key-vault) section, perform one of the following actions for each Key Vault with certificates imported to App Gateways: +* **Azure role-based access control** - Create a Role Assignment that grants the Application/Service Principal the [Key Vault Secrets User](https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli) built-in role. +* **Vault access policy** - [Create an Access Policy](https://learn.microsoft.com/en-us/azure/key-vault/general/assign-access-policy?tabs=azure-portal) that grants the Application/Service Principal the Get secret permission for each Azure Key Vault. + +#### Client Certificate or Client Secret + +Beginning in version 3.0.0, the Azure Application Gateway Orchestrator extension supports both [client certificate authentication](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-1-add-a-certificate) and [client secret](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-2-add-a-client-secret) authentication. + +* **Client Secret** - Follow [Microsoft's documentation](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-2-add-a-client-secret) to create a Client Secret. This secret will be used as the **Server Password** field in the [Certificate Store Configuration](#certificate-store-configuration) section. +* **Client Certificate** - Create a client certificate key pair with the Client Authentication extended key usage. The client certificate will be used in the ClientCertificate field in the [Certificate Store Configuration](#certificate-store-configuration) section. If you have access to Keyfactor Command, the instructions in this section walk you through enrolling a certificate and ensuring that it's in the correct format. Once enrolled, follow [Microsoft's documentation](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-1-add-a-certificate) to add the _public key_ certificate (no private key) to the service principal used for authentication. + + The certificate can be in either of the following formats: + * Base64-encoded PKCS#12 (PFX) with a matching private key. + * Base64-encoded PEM-encoded certificate _and_ PEM-encoded PKCS8 private key. Make sure that the certificate and private key are separated with a newline. The order doesn't matter - the extension will determine which is which. + + If the private key is encrypted, the encryption password will replace the **Server Password** field in the [Certificate Store Configuration](#certificate-store-configuration) section. + +> **Creating and Formatting a Client Certificate using Keyfactor Command** +> +> To get started quickly, you can follow the instructions below to create and properly format a client certificate to authenticate to the Microsoft Graph API. +> +> 1. In Keyfactor Command, hover over **Enrollment** and select **PFX Enrollment**. +> 2. Select a **Template** that supports Client Authentication as an extended key usage. +> 3. Populate the certificate subject as appropriate for the Template. It may be sufficient to only populate the Common Name, but consult your IT policy to ensure that this certificate is compliant. +> 4. At the bottom of the page, uncheck the box for **Include Chain**, and select either **PFX** or **PEM** as the certificate Format. +> 5. Make a note of the password on the next page - it won't be shown again. +> 6. Prepare the certificate and private key for Azure and the Orchestrator extension: +> * If you downloaded the certificate in PEM format, use the commands below: +> +> ```shell +> # Verify that the certificate downloaded from Command contains the certificate and private key. They should be in the same file +> cat <your_certificate.pem> +> +> # Separate the certificate from the private key +> openssl x509 -in <your_certificate.pem> -out pubkeycert.pem +> +> # Base64 encode the certificate and private key +> cat <your_certificate.pem> | base64 > clientcertkeypair.pem.base64 +> ``` +> +> * If you downloaded the certificate in PFX format, use the commands below: +> +> ```shell +> # Export the certificate from the PFX file +> openssl pkcs12 -in <your_certificate.pfx> -clcerts -nokeys -out pubkeycert.pem +> +> # Base64 encode the PFX file +> cat <your_certificate.pfx> | base64 > clientcert.pfx.base64 +> ``` +> 7. Follow [Microsoft's documentation](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-1-add-a-certificate) to add the public key certificate to the service principal used for authentication. +> +> You will use `clientcert.[pem|pfx].base64` as the **ClientCertificate** field in the [Certificate Store Configuration](#certificate-store-configuration) section. + +# Extension Mechanics + +### Discovery Job + +The Discovery operation discovers all Azure Application Gateways in each resource group that the service principal has access to. The discovered Application Gateways are reported back to Command and can be easily added as certificate stores from the Locations tab. + +The Discovery operation uses the "Directories to search" field, and accepts input in one of the following formats: +- `*` - If the asterisk symbol `*` is used, the extension will search for Application Gateways in every resource group that the service principal has access to, but only in the tenant that the discovery job was configured for as specified by the "Client Machine" field in the certificate store configuration. +- `<tenant-id>,<tenant-id>,...` - If a comma-separated list of tenant IDs is used, the extension will search for Application Gateways in every resource group and tenant specified in the list. The tenant IDs should be the GUIDs associated with each tenant, and it's the user's responsibility to ensure that the service principal has access to the specified tenants. + +> The Discovery Job only supports Client Secret authentication. + +### Certificates Imported to Application Gateways from Azure Key Vault + +Natively, Azure Application Gateways support integration with Azure Key Vault for secret/certificate management. This integration works by creating a TLS Listener certificate with a reference to a secret in Azure Key Vault (specifically, a URI in the format `https://<vault-name>.vault.azure.net/secrets/<secret-name>`), authenticated using a Managed Identity. If the Application Gateway orchestrator extension is deployed to manage App Gateways with certificates imported from Azure Key Vault, the following truth table represents the possible operations and their result, specifically with respect to AKV. + +| Store Type | Operation | Result | +|--------------|-----------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `AzureAppGw` | Inventory | Certificate is downloaded from Azure Key Vault and reported back to Keyfactor Command. In Keyfactor Command, the certificate will show as being located in the AzureAppGw certificate store [in addition to the AKV, if AKV orchestrator extension is also deployed]. | +| `AzureAppGw` | Add | The Add operation will not create secrets in AKV; it creates ApplicationGatewaySslCertificates.<br/> <br/>If an `AzureAppGw` Add operation is scheduled with the Replace flag, the _**link to the AKV certificate will be broken**_, and a native ApplicationGatewaySslCertificate will be created in its place - The secret in AKV will still exist. | +| `AzureAppGw` | Remove | The ApplicationGatewaySslCertificate is deleted from the Application Gateway, but the secret that the certificate referenced in AKV still exists. | +| `AzureAppGwBin` | Inventory | Certificate is downloaded from Azure Key Vault and reported back to Keyfactor Command. In Keyfactor Command, the certificate will show as present in both an `AzureAppGw` certificate store _and_ an `AppGwBin` certificate store [in addition to the AKV, if AKV orchestrator extension is also deployed]. | +| `AzureAppGwBin` | Add | The Add operation will not create secrets in AKV; it creates ApplicationGatewaySslCertificates. <br/> <br/>If a certificate with the same name as the TLS Listener already exists, it will be _replaced_ by a new ApplicationGatewaySslCertificate. <br/> <br/>If the certificate being replaced was imported from AKV, this binding will be broken and the secret will still exist in AKV. | + +#### Mechanics of the Azure Key Vault Download Operation for Inventory Jobs that report certificates imported from AKV + +If an AzureApplicationSslCertificate references a secret in AKV (was imported to the App Gateway from AKV), the inventory job will create and use a `SecretClient` from the [`Azure.Security.KeyVault.Secrets.SecretClient` dotnet package](https://learn.microsoft.com/en-us/dotnet/api/azure.security.keyvault.secrets.secretclient?view=azure-dotnet). Authentication to AKV via this client is configured using the exact same `TokenCredential` provided by the [Azure Identity client library for .NET](https://learn.microsoft.com/en-us/dotnet/api/overview/azure/identity-readme?view=azure-dotnet). This means that the Service Principal described in the [Azure Configuration](#azure-configuration) section must also have appropriate permissions to read secrets from the AKV that the App Gateway is integrated with. The secret referenced in the AzureApplicationSslCertificate will be accessed exactly as reported by Azure, regardless of whether it exists in AKV. + + diff --git a/docsource/azureappgw.md b/docsource/azureappgw.md new file mode 100644 index 0000000..1f674fa --- /dev/null +++ b/docsource/azureappgw.md @@ -0,0 +1,112 @@ +# Overview + +The Azure Application Gateway Certificate store type, `AzureAppGw`, manages `ApplicationGatewaySslCertificate` objects owned by Azure Application Gateways. This store type collects inventory and manages all ApplicationGatewaySslCertificate objects associated with an Application Gateway. The store type is implemented primarily for Inventory and Management Remove operations, since the intended usage of ApplicationGatewaySslCertificates in Application Gateways is for serving TLS client traffic via TLS Listeners. Management Add and associated logic for certificate renewal is also supported for this certificate store type for completeness, but the primary intended functionality of this extension is implemented with the App Gateway Certificate Binding store type. + +> If an ApplicationGatewaySslCertificate is bound to a TLS Listener at the time of a Management Remove operation, the operation will fail since at least one certificate must be bound at all times. + +> If a renewal job is scheduled for an `AzureAppGw` certificate store, the extension will report a success and perform no action if the certificate being renewed is bound to a TLS Listener. This is because a certificate located in an `AzureAppGw` certificate store that is bound to a TLS Listener is logically the same as the same certificate located in an `AzureAppGwBin` store type. For this reason, it's expected that the certificate will be renewed and re-bound to the listener by the `AppGwBin` certificate operations. +> +> If the renewed certificate is not bound to a TLS Listener, the operation will be performed the same as any certificate renewal process that honors the Overwrite flag. + +# Requirements + +### Azure Service Principal (Azure Resource Manager Authentication) + +The Azure Application Gateway Orchestrator extension uses an [Azure Service Principal](https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals?tabs=browser) for authentication. Follow [Microsoft's documentation](https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal) to create a service principal. + +#### Azure Application Gateway permissions + +For quick start and non-production environments, a Role Assignment should be created on _each resource group_ that own Application Gateways desiring management that grants the created Application/Service Principal the [Contributor (Privileged administrator) Role](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#contributor). For production environments, a custom role should be created that grants the following permissions: + +- `Microsoft.Resources/subscriptions/resourcegroups/read` - Read : Get Resource Group +- `Microsoft.Network/applicationGateways/read` - Read : Get Application Gateway +- `Microsoft.Network/applicationGateways/write` - Write : Create or Update Application Gateway +- `Microsoft.ManagedIdentity/userAssignedIdentities/assign/action` - Other : RBAC action for assigning an existing user assigned identity to a resource +- `Microsoft.Network/virtualNetworks/subnets/join/action` - Other : Joins a virtual network. Not Alertable. + +> Note that even if the Service Principal has permission to perform the 'Microsoft.Network/applicationGateways/write' action over the scope of the required resource group, there may be other permissions that are required by the CreateOrUpdate operation depending on the complexity of the Application Gateway's configuration. As such, the list of permissions above should not be considered as comprehensive. + +#### Azure Key Vault permissions + +If the managed Application Gateway is integrated with Azure Key Vault per the discussion in the [Certificates Imported to Application Gateways from Azure Key Vault](#certificates-imported-to-application-gateways-from-azure-key-vault) section, perform one of the following actions for each Key Vault with certificates imported to App Gateways: +* **Azure role-based access control** - Create a Role Assignment that grants the Application/Service Principal the [Key Vault Secrets User](https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli) built-in role. +* **Vault access policy** - [Create an Access Policy](https://learn.microsoft.com/en-us/azure/key-vault/general/assign-access-policy?tabs=azure-portal) that grants the Application/Service Principal the Get secret permission for each Azure Key Vault. + +#### Client Certificate or Client Secret + +Beginning in version 3.0.0, the Azure Application Gateway Orchestrator extension supports both [client certificate authentication](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-1-add-a-certificate) and [client secret](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-2-add-a-client-secret) authentication. + +* **Client Secret** - Follow [Microsoft's documentation](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-2-add-a-client-secret) to create a Client Secret. This secret will be used as the **Server Password** field in the [Certificate Store Configuration](#certificate-store-configuration) section. +* **Client Certificate** - Create a client certificate key pair with the Client Authentication extended key usage. The client certificate will be used in the ClientCertificate field in the [Certificate Store Configuration](#certificate-store-configuration) section. If you have access to Keyfactor Command, the instructions in this section walk you through enrolling a certificate and ensuring that it's in the correct format. Once enrolled, follow [Microsoft's documentation](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-1-add-a-certificate) to add the _public key_ certificate (no private key) to the service principal used for authentication. + + The certificate can be in either of the following formats: + * Base64-encoded PKCS#12 (PFX) with a matching private key. + * Base64-encoded PEM-encoded certificate _and_ PEM-encoded PKCS8 private key. Make sure that the certificate and private key are separated with a newline. The order doesn't matter - the extension will determine which is which. + + If the private key is encrypted, the encryption password will replace the **Server Password** field in the [Certificate Store Configuration](#certificate-store-configuration) section. + +> **Creating and Formatting a Client Certificate using Keyfactor Command** +> +> To get started quickly, you can follow the instructions below to create and properly format a client certificate to authenticate to the Microsoft Graph API. +> +> 1. In Keyfactor Command, hover over **Enrollment** and select **PFX Enrollment**. +> 2. Select a **Template** that supports Client Authentication as an extended key usage. +> 3. Populate the certificate subject as appropriate for the Template. It may be sufficient to only populate the Common Name, but consult your IT policy to ensure that this certificate is compliant. +> 4. At the bottom of the page, uncheck the box for **Include Chain**, and select either **PFX** or **PEM** as the certificate Format. +> 5. Make a note of the password on the next page - it won't be shown again. +> 6. Prepare the certificate and private key for Azure and the Orchestrator extension: +> * If you downloaded the certificate in PEM format, use the commands below: +> +> ```shell +> # Verify that the certificate downloaded from Command contains the certificate and private key. They should be in the same file +> cat <your_certificate.pem> +> +> # Separate the certificate from the private key +> openssl x509 -in <your_certificate.pem> -out pubkeycert.pem +> +> # Base64 encode the certificate and private key +> cat <your_certificate.pem> | base64 > clientcertkeypair.pem.base64 +> ``` +> +> * If you downloaded the certificate in PFX format, use the commands below: +> +> ```shell +> # Export the certificate from the PFX file +> openssl pkcs12 -in <your_certificate.pfx> -clcerts -nokeys -out pubkeycert.pem +> +> # Base64 encode the PFX file +> cat <your_certificate.pfx> | base64 > clientcert.pfx.base64 +> ``` +> 7. Follow [Microsoft's documentation](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-1-add-a-certificate) to add the public key certificate to the service principal used for authentication. +> +> You will use `clientcert.[pem|pfx].base64` as the **ClientCertificate** field in the [Certificate Store Configuration](#certificate-store-configuration) section. + +# Extension Mechanics + +### Discovery Job + +The Discovery operation discovers all Azure Application Gateways in each resource group that the service principal has access to. The discovered Application Gateways are reported back to Command and can be easily added as certificate stores from the Locations tab. + +The Discovery operation uses the "Directories to search" field, and accepts input in one of the following formats: +- `*` - If the asterisk symbol `*` is used, the extension will search for Application Gateways in every resource group that the service principal has access to, but only in the tenant that the discovery job was configured for as specified by the "Client Machine" field in the certificate store configuration. +- `<tenant-id>,<tenant-id>,...` - If a comma-separated list of tenant IDs is used, the extension will search for Application Gateways in every resource group and tenant specified in the list. The tenant IDs should be the GUIDs associated with each tenant, and it's the user's responsibility to ensure that the service principal has access to the specified tenants. + +> The Discovery Job only supports Client Secret authentication. + +### Certificates Imported to Application Gateways from Azure Key Vault + +Natively, Azure Application Gateways support integration with Azure Key Vault for secret/certificate management. This integration works by creating a TLS Listener certificate with a reference to a secret in Azure Key Vault (specifically, a URI in the format `https://<vault-name>.vault.azure.net/secrets/<secret-name>`), authenticated using a Managed Identity. If the Application Gateway orchestrator extension is deployed to manage App Gateways with certificates imported from Azure Key Vault, the following truth table represents the possible operations and their result, specifically with respect to AKV. + +| Store Type | Operation | Result | +|--------------|-----------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `AzureAppGw` | Inventory | Certificate is downloaded from Azure Key Vault and reported back to Keyfactor Command. In Keyfactor Command, the certificate will show as being located in the AzureAppGw certificate store [in addition to the AKV, if AKV orchestrator extension is also deployed]. | +| `AzureAppGw` | Add | The Add operation will not create secrets in AKV; it creates ApplicationGatewaySslCertificates.<br/> <br/>If an `AzureAppGw` Add operation is scheduled with the Replace flag, the _**link to the AKV certificate will be broken**_, and a native ApplicationGatewaySslCertificate will be created in its place - The secret in AKV will still exist. | +| `AzureAppGw` | Remove | The ApplicationGatewaySslCertificate is deleted from the Application Gateway, but the secret that the certificate referenced in AKV still exists. | +| `AzureAppGwBin` | Inventory | Certificate is downloaded from Azure Key Vault and reported back to Keyfactor Command. In Keyfactor Command, the certificate will show as present in both an `AzureAppGw` certificate store _and_ an `AppGwBin` certificate store [in addition to the AKV, if AKV orchestrator extension is also deployed]. | +| `AzureAppGwBin` | Add | The Add operation will not create secrets in AKV; it creates ApplicationGatewaySslCertificates. <br/> <br/>If a certificate with the same name as the TLS Listener already exists, it will be _replaced_ by a new ApplicationGatewaySslCertificate. <br/> <br/>If the certificate being replaced was imported from AKV, this binding will be broken and the secret will still exist in AKV. | + +#### Mechanics of the Azure Key Vault Download Operation for Inventory Jobs that report certificates imported from AKV + +If an AzureApplicationSslCertificate references a secret in AKV (was imported to the App Gateway from AKV), the inventory job will create and use a `SecretClient` from the [`Azure.Security.KeyVault.Secrets.SecretClient` dotnet package](https://learn.microsoft.com/en-us/dotnet/api/azure.security.keyvault.secrets.secretclient?view=azure-dotnet). Authentication to AKV via this client is configured using the exact same `TokenCredential` provided by the [Azure Identity client library for .NET](https://learn.microsoft.com/en-us/dotnet/api/overview/azure/identity-readme?view=azure-dotnet). This means that the Service Principal described in the [Azure Configuration](#azure-configuration) section must also have appropriate permissions to read secrets from the AKV that the App Gateway is integrated with. The secret referenced in the AzureApplicationSslCertificate will be accessed exactly as reported by Azure, regardless of whether it exists in AKV. + + diff --git a/.github/images/AppGwBin-advanced-store-type-dialog.png b/docsource/images/AppGwBin-advanced-store-type-dialog.png similarity index 78% rename from .github/images/AppGwBin-advanced-store-type-dialog.png rename to docsource/images/AppGwBin-advanced-store-type-dialog.png index 5cc95d22f9397f73786be9e71dadf11cc4725852..2b71e8ce6f47e0b32fe97f5ac26c1e77f438c5f8 100644 GIT binary patch delta 7633 zcmaKxc|6qZ+xMsCs$Z_;YA=Z^RF=?U$uguY4cQIZ#w8(Rs~BSN?YdNUlMxfLWH*?} zzKo%gl(A$PvJ8na7)#b+EOVc8-OnG-^Ljn^?ZwOZe$9D)&*S_YpW}U;v(>zNsCoCh zG6*VfcXd{5mbCZ1a?4D|LJ{41RSUh57=1I6Eq>UjUqwfD!cB{`6(@Uy@TkPZJT|wi zTOs3*$}NLiRmmmo9Rp-vO=x|7!hW+0<?wo`X4IP{w6LtXz+q$h#Bd{xajx}iRM7>C zMF~<}zyj&luZPt2pV4@kozy{3WemH|2s&`!z~k#8;CqmYt;VWrYirNbB)fZh82RsH zb4RIE80=3NLPy)uVgS;LkB>LFefuTD+uF(LZ3`wJ2D2BSuSF~E+O;bxHkPi%+b|J4 zeKqIfs#S???%#X%w~jV0StPK|Tyu?a?RZm|4#yg(1q?p<@&51QqzpVh>%3tSBqbqn ztE;Q4ZhLJAJ|cAJP+x+HW?`vwOKX3BzeI$%xVYbs_q!O_1uD^+oNim~Jr_#0tM*n4 z-KycPOlQA*`3IB5@|fu@tedZ66Ez4?_7Mv{TkDIq<*u=!K~v`tc!qaBBVe>7aCtIN z1hMrqT480Th%BS7ZU<&X_d&(UIll4BZPz*rtjQ=*eKl4`S`i}Qf_rn+@v@=0pp`Ct zI>~`zz&d*7Oi|>~i*;m);+gpIrM>-2W?K=H!pcwv>ddHZT2okSi1Ea?z|jXC*-pfx zrfVr*mW|$AHw)V@WW||h$Zn?|I-`8Yce2gw&YhUuyLb22EGj$-YB>u9OhsNy|F$+a zM9<U?6To?9kjp~gzuxZ&8hd`SmlELf+upr3ybB=GGW4BjrA^L4{|mu0{2TNlYZJjU z%Ds!@Es62*Z`)H<JV0R4U0KaOgZ|#$Bu{0#=PJxM3JMA)C!%$gJo<_srfqEnC%$?m zb@}qUHtfK_z!HZ8ajwUrhy?|=0|Ntz7Wr`ldx<}821D`$LmL|#0Re%f2z|snr3<`U znm|Kd(DU{6rEP0UO3TU`R(kZym$ye<PcvptOxV9$m}Zc#9<P=}LOfaq{Zh^glFyL> zxV|suSB}Fq)F#STRIul)7c`{MXSt$+skK)N;a1G_K_x}~j*tVG?^gJsM8A3CopQHM zVJ&51887tewQI;~Z-!Ret)IJKghtxWlO6_XaIDqWuV2;tre1DsZQZXPIxZ|s^k&qZ zKKpmQxkK9mSy7yq+C!sH`+3Jt`s`>s1{1PjkPnlYu{k%}vZ=U3mw3r50kOmCNWx&y zUJU|L=jRe;;>%$rbnk6tyGn<RUla^?#T~@M;g!TU7|fE;9g%a;v@p*o)r#{+Xf=_0 z`3VdbimQ1kkns2Gn}VO_AN~;!gTXG3do5o`C?VW{e)_3J-Ue4*pA(1lK@2AzUMFHt zfeW^^k8?c<_w-MnK0VV<&e$9c4GpbhlPD|wjXOwHRaMc2#1t*4;ph1HaiBJkKy`%9 z*H><Vok&p+Al280y8o#4WuccR+vgz__imkp3r6Ot%3ku_#q!0^p6$)e&-dspFoQ&C zI590!bM#4ekBL?y$kqoB3NGAvovG|K_yA~;pDBKHq&2dJ;g%6%b@=e%sF;}g?-t+z zts}I<_Bo_P_^GAgbLNJs4e@azs#)$mdG6z%V`utGQa9nz%|CZy=xDlcCp`bKgkAwK z5p+*p?2)5KR|niO+*fDlkmxR(I$XSjKKfgxHprpD3ikv(oM?&HP}SF#7MA&)<wkSx zHNT`AeM0*3WmDb`r;*8I=7Rg~o#}A?Xnn;t*}L}avlNb(C$R4co(A%N8ypg%FgNY# z<Kq*E#TJ2du3PQ1!>s>u!f`y6Q#V~o@AhWt{%(}60ohpO-RS~JtLWAt(%jNgWSpkP z^d3c5wz`({=L^|fOOyn$l2ui;X?h`OVQKk_|9BM@iU@N9gDC#%&~2`?yu5L~aT;E- z#HL*D){BE?yq)dJhhsNgTwT%M-#N|qd_^D-K|32P#%3DW9IzlDMkQz`SQpaOEd*X- z+Zam4ra@cdVz!m&ME<A>4eK|-E(dX^^BK<Eoy`SWT0+y<%XZfUIy#X|CI_v}7JdlZ z@6nZ|J6P#K$TP_xt+M+))_;x3NJ%|}yf>DZ{8+YB0ee1v@??HNffO)+JB5XX$ep2G zFxZ;~yxx6VTPUTwySu`<<q&nbLtQlgE~`B?e`A?NaRfTT=V0e+_0OvN_kM~zs^r@C z+Q7twH8CM2CuanPv8{hnnxf)E@*q>Krl+S<;Ml5>&`q!BFJ9D*&)2fjdz^9bJRr2y zd4`=;5z^h=9T;+2lDq>Ec!A8NOLs6cy=LuDiqb0G+7W^0zt?ND!J)RcmS11$1Is@) zHC5jKdIZdWhelB7f1~PK;X*rc{=x+Vym5wR$*Wh#!2a3H4OUv*yO$+$DBOySDk-$c zpZO9m!R&DV6mfX4);AwKiD-L<)+qdizG$EhP-*{B6OFeGA)7?k_LRX=XDD1!T1(5( zr(q+{yJ5qX<8NSKa14YiNzP8@$`!Nm7F_?c14mz_rES~s-oRi#1dx`Ne(uI@gcL=0 zyd+;Cd-fePZHYUZn4Bz)K+}ndEp;GK@i`wq-rWAxB($`=+yk~rma#M0p1Qi&B1S`3 z5+99!PPyt5C0VE&4V~b}@r`l5u(D@?Pvf=~{+OsJ$)?=3(5*AQj+tb4Ohlx3c-S7n zB2i;vVtVDOhsBHN#CZnA0~8<hKv^yjZ0_bf#Y9?KTHxTp-dL59g3Qc6&!0c<{yF9} zy0;)+Qd(J=Z-Y^hk@1p(r!L=!J)@E&N#%@SQ?5UPvVgfLAflq8x~F^cX>El@smlD| zugx=xK(suDYaR(-{_80iN}`A^13?hTC-w+-feu7>{P=Nx9u_)K{DI2fV%0AizcEFl ziCoSC*+g?g2Y>9ykt_x!z?TZ#^K#jf#h->};ywCFCBLYm@Ss<etwd`S6klCk-A8gL z+AkJt8W|ZmFSTg`%$@$@Ll`_sRpgLSiXvihaZv!&dLpuDcmbp+d&sAet}hmn<J9y* zT2m9n-&9cMR)CDA!-O=y%?^~Wem>(PB`$uG+`uLBHLAW)Zvm{!wjsFopRh2v`0N&2 zAtWS(VaA0r%F4@`Y_{DP=aD7|Y?ap#5v&O?Lc#@;bo<GDZ#vS{+0Rd+_zP3^9xmw0 z*2mU61_`={hBnkwspk<_u3Ql~aG<c8@7V@$?o>8`BN2+n<N0C*!8H2t;X@P-$CvL4 zKnrBx8DQwZ==f3r8iKO?=LQjK0TLY`0GaRJU5*u2G61k)U}S_eHjZ1H9mtM|_>WQY zRb4O+@PZ7>#?TNY@8P=&jay}Pe$!b%R_t)G&~J7=)LihWhWI-FIU>k(DHRp#<m6<& z2dH6YEaz*)B_tAGzWkHIAOUG|+-H`-_PI|$U*ZR=yi!5>0Hs#?jB4^p0i-Jmh2oQ5 zt$o>mC%`piaB%&sKV`7mXQ8wN1Y1T@QpY&oB7lJ*@aF@j1+;tuxg!spB?nzo`uP)} zGQ|+CU;7(X3v0)a${gQ(|CX53*)=uSK~=6Y7;*>7%*xJ&l%D+hOHfSH9&j3{=!zRH zVo<SW2=@UnG7tkgpT_FzHRK%XEW`E*cE3D#tG5p0!6{q=WxNnbUqDbWvH70a{rfq< zE|6pt9MS#yinHb2y9EFsi9VwZM90R4mhs3A&ig$=QUK(rSWe&5U3*%o>O(_Ac1=*Y zP(N_6JibEUK`Y<D{_`IjVGdGy6@cDUE&+v?)YaE#e|vii1VYZ2Q|C8d*8_I8&?G~X zUzz=9zrX$X@uN%#4k&<CE}|LSORsPrpAl`*B@hS~Q`_@|mC#QvDM(3~0utW6XAeAy zH96VZ(vshr{|4eMmn)~Xhd8*o{2zjOoV^gdv9Tc|FAu=DvURq|Z#K6d?F}-$Ex3b_ zmL>;5ywT=tFxh)1^Gla=8H?pO=pkNYapT5~S{hI_O|ZFDe765}u=4fmH3saB%}wh% z@~2Na=Orbl#=^yR=-c~$`wbZw44#%*i?|o3v(q&<+UN+l&&kP2RLE;T3|8}!R3i}& z`HhW@(cybxu!q0ZdioTDy?xJ&jsSl@y&`@Dyj^eh(Eh^*z>8}m%03AX6XhX?6OCzU z>Fn+-PILvUz+zYE3Fd$U`s7S*BZg!3@M&&cctBSOkTG{M)yMDWrvnIcP*mweq%3Ck zdufXPJ{ZhYlQ!0*?*QUUs@mnrur6jPpYXWnn3}Q=TZoAutff7ixm{;bu5z3`y`#)H z9coiC|C_bBIln!Sx&&RibMD+ZkdE<^Y1bd!1T{zP$*)YkI1y<Dg+r(Iz@E~Y;<H=s zcXpCTB8Kb8cT*drx_&w}aHrh}=7*A|bgB%`X`j$lEGLG_MT??rGB>@eWQg?VLWuCD zb7Eo{=;#WdWhCfq06FW{E-ZksiG{4hiv~`_8&q4|y$com^Uv<z_U%K(IPC^eOw_wy zdG@DaCuX`fwt4VM<%=T?GJVCX%`)=-wWHO6fKZ{-B#o&eyA1z=?fXSDeOt_4e?7ey z+*LMfCjfvL$T#v>Q#h@&bHSR^h+$h%x0YypMWaGDTsGF%PsQ>8M<I1|o`LMH^csSc z8KIkVWws^Ao#2}{{{fk8=XArs{K=CV;Bu9L%dV@y<l8pGg~a;)`R(@#EXNzcY6t`L zMf7EL==n;o+D(E@Cf%X?r>`{Uh#Sp%^dtupCOuaU-bTpCKc0SW)Z8lj&>d{YiSx$; z>lggg&Lf7ZeL(#2dB$nPdZ=C__N=-U;FiWZ9)LY};9vau_UMKIp0-MRl5donmz9-e z&?heoI=M78441yj@7k6o5NWEupPe^A)1>G(Wr~^lroBMrq-(DK*aP4C)nr@oApYvr zt1+L=XR6!w0KiKo%855>{<Q4*OX2MGF-xbvi-s{vopn$JOF#c6JJ6lu<W|dmg2mGM z`>lbL==?qrm=vgy2>h$`bP}*3U0q#wz-GW?5+#jZU)Bykbhf*~y@%gHp4E6_3K*6T zd;D4k>Kg)&Pe`al(`7gf0A4HIdoJL%aU!bb_?2(Bgr=vuvXSW!aBhfLPs+&1FizK) zF7*UWAt<?Bz_KP-tc#$w03)YvOs0a~6qW1j2zt&J2Ty11Y;SsueS8j}P3oEuFlPW? zvNAFT)S%UFAOpsbFg&ONz(^jTOm~3D1_(q~4kF<gD7}fY)>eTiz$BcaLGi2aJG1)E zK`6D?s8Eq4?qZCg7irbJT^LC*qyTH>BjW!=HYLf|+*&(3P0C%{&F|iQ9S7P0!0Hd! zeI-FtZ^IRRMl=xSpx6QCnj2Z`)Z!J-&U)gu<!mc%<5xh3Of<{ZL#FdGc2@FbAo5VL z%{3Pnm%vLylmN0fWv)s<%cARh4`57hh8o|+LH$R9SwO>?9C*p5Ob7UE&k~cS1n}Ey zpiCDa06s?y+A;$WWlQld0nAuJKm{Ri@U_=`c04X?^~Jl|I?$WH?n1Ec&iU?!qsB^< zx}|f9M98^oL@~cZtyRl*BLhGc=%@HDlbe@E1o7ieB$&KPOw0x60COW$J21o2>MF85 zMaiYomJXi#{Kbpx!u)jpVmHmyk!C^LF4I-SnO|c~NE8PE2@wP`c{?e+Tg8mx?}g}& zIeqQbn>WRF-nF_`MU`zDcszvXtC!y#0xRX8a)8P_HDZhtg<EFp2?E*ZomKNQy?r}E zSjGF2mX;PMg?&%#`Af+i6fbiqAjIXU)31Iq)NEjixvVT#PjU57YOlsDDO%fHQ_%O0 zK)evf!zRIbb<*<kGK2j3^(l_CUk9h#P=Q|zg(0ob`p2N@_FTSqS=E;H@Op2i_8y!I zNVKJhI&&7Ty1sP(zI|xmxlwU(eW0Ps1LW8_9>Lt`Xte6>@2_qP0NF*dr=N(2*z+X= zsZq$5(X5N}m0w+#4<b_Avk=>!0>3IB7~d=vrSwpS=YS3iGc#}S4W%vlS|XH`l()Ii z=m_}3608#J0B9fOF>`~+e{;us3ba#&0I%w}GevOY!~G-&J1l2Dk;XLF*8UrKg~eDf z*s_>^mQy@PT^BQgmx|bP!?hNI!iuI~4H`+KppoQLJwScA@TRwT{E^(8oGCtz0`Qj+ z!9xFEWNK~82C5r;=M)BF12~<}xX5X}KS5n{DX7xl+PnYmiXW89H~jNLT$!xo%3+pH zoV`uv>9G3a6OKDwtpGL<cu>W24xLqdz-&zv_|Jb{N`gZa6M(rnRwVmEVEdTqZe0j8 zD}G{5<##*0d_i-~hkO!cUJYl_t-|n2;HNRzF;E|pRE6&n4GHpmva+{-1I)Wfkq4R* z^y1HEq64K0unf(?ZL}do?ctB7dNHTWCaL^3EBd4Y-?vw|Y%<Nent$>Xw6)lRX;<nm z0Ia}_gG1o_1`JCF|8yT{8juo*JF!gz;CnX6aw6y{@HzZWP~`f%w(ACsxA-9_TyrcA zTu8kKU!JUWEIv@e%2n<Ua`#EG2*3I!CBd{9M1fwyggC<=LE`gif-9BLD*8PwEv+Oo zGt+<*pPK5i_0A{1r_cqWB^83+#U-?K5^!8EU}dG?^<R!5r-BfONC23zpVL!QWyQqA zHn?0XH5}+`20W`|;Mk)u*w!Lohr1Rs>|(=cd{o8eI}0U`yMBFR-LY>`!U6it`hW6n zYi`b73t4Vg;UDPbIEJck0*W9_#)Fdeq^_7xBto!8q1?kZUMhV6N`7#n6HE!BB8MqW z+B%>dzmKVIPyLr(PN%jT{Ch<tK|4h=;ajr9F$w?huz&BV{x{idp?m*K;3YX9`?{e@ z_`h$U`voMyjkgK!UZWCB2xkAwZ(XR(iUINocJlL=DP8VpS~xh_p%cAWrg9<J;+C>Q z+T%obMFOs~{3Pm^*AZ|owDqBeh=tKVnSaH4sq+wXKHJOZ&(N4ZX=(c_H^-xwwNCtd z5Oq1Rxi^uxT>|w<Jc1WtPZ5UktkK#BhrcTQd$y$a@7hisK9De)cm|TOBx`$ZtfK-= z_Fj^HG;>F9UYDVdin|rJ^)b2*7ahr8oXf!-aP$(o66mG+E5<)Pr6|C{O=>HTt<e{V z<@trAQ%#L*?Z<c8SOdRf==8ru*_HLB@tU2ef-k6kcDu>=O5oZ}oOSoxbwg#cV?tVT zzT4+wv;3mZvNN3!WNkTRVY~Q|^0+oM@EO+3DKhJ3M)%VQ7F=@^_0f9f4@Kkf#_g}p z8&jGJY(}hO9gpfvL#<NW^Tf}X^m&~#d0<ICiBVjAB{^N&GHMx~`AC%9xQ5lm_inzJ z<_7hTMJr*P`C<9>W89;s#*I7GGqGnTxP5Q4y_V6%I4G^ps9M>V-1GB=2L^NdrNHk| ztKZv3@HrUXy6O35V>p+W1+U`t7gAqkSZ7XDuYIB2>&pK+I@7oBD1)3nX5!erfy^m* zr;~jTWgd$9yGrDVUWS`OuWY1qh1{Y?uH;+*x!Rc~IuKl}7I?`JtEKf5HUBvM_x8vz z!q?EMEl45;ks83B4(An?_BgM&PX^E3PA!R0x0TshR6&~0zAFDzsLva*$hhC;+jxQ` z#uOc8KI89+Xt2i<+P%^*>5c_iACIJI`0ELcl-}Uk*D$CZ-`(!LO57>8lDlo5|0Stx zu-?*q*0Qx~J8C8%0SosLD;gZ_v*(q26R^n;7=Jf5eiM1uG#J6Mj+bL=SvYBzx?Va< z3=%{e;!`RGx>AHL7A~ii46{od*WyLj?Q*yW=W=3Y{ewKS86|ItSj<ybBYVerO;?k3 zLf)k*^3Xyp$|{wxwI_I$@F?KHS6)ma-Cv$oUyLdXv}2IFnS@lDuO$qYIXE#1eNU_i ztiHD|pu5AuceT~d`PgB4_jUu0Y&7TNLBben_IfOj5SnROjT(Ip_=>4%oela**V&Lk z1H9;|A)^z~D>E^2^PSa{+~kq(ssr0WXfvLn`UipFWu{QnEQVSiQhc1`yF#%T++IAl zTHhGPJsA0I$S0UI+or+U)YOEO;S|pT{ODlzC#8&_;I-bxYihn~of5Zc<?uz1_LQ2D zZEokBy?g{Xgf-P0e%F7DJ}XUK#NB^hRX~2u)^}gwX&G(*c&5<(`o_nv=OC)kjco z?0*_gxvh56<|59;ef=n060xoC-=*Rxiu8_SQ0Io<1kdeEyxgo@h=#=ExA)S_nmSv? z2V0gTiw6rS3ylcv54+I9R*ove-IhL$8_6wd{ffoe$uwTpY3Gq|Z?`WpKqE&zKW)u9 z{Mf;va{Ak+ZS?T$%;@#(Xm%@wApj1Vzb3b7P_M7b@qbDNcWSs>%oEhB<6g~&8jVm^ z(IZA7R`>}vOAZoqOda&|%%W1_(5oLMjnc7=YW_ZNi%5mJ(oNQZo}3>$M^oU7j`S<J z2AHWq`{jJkz5?kk(SRI^y}Zq(6RJzUuP)FtWTuEILF?(d_?)Bq<rSe{^@Z0T<g`?I zv%74CVq$xb-b#|qv=T&^n?8J+;y7w5=FP~S+I1G*rvNd+C7)M%<)m->G`zN;{(1cf zXc#qyMF#A}(q3ny!hDjdame-|Ma!noAGoSRq%%HVd4tyU-fkPa)sG3h?%z#z3_Ihn zw>D~j;|^7vLUeyVE-fQ-sp}sMPD=fniDO9cH|I?t#^CLG2D#N(%+cViw+HFRzRH!A zrlQ10S0R18-vb_kF*>apvfhC@zm2U94xt`zyjSqq2-j6JeI?3K)$(HKmu{9=sI@CL zn>S*(s}eo+eqM}06OE+Um0$F>T(Wa4%K0v>ANm%R%4-m<_iZqU0%zX%d-+k(2E#z_ zcuRZxou!%g@k57C>A+ySUHKn^0YUv3qd~YsGqki(_JYEp?j8l9BuQp^sqFlR#1st` zt6H~NTke(>uCt<M%vMkYLjj9G{-t2P#0xGd2vtEhE#YXMjpK7p-1Ujy=OH(@$>|PP z6Nh00Qd<xble5(_SWY+i_QTGN-8QX3ua&v6t&i#Q3aIS+=Iu*|EKgR}6-GiWEH3=m zTO(PEV*~7cIOd3^6});$Td)q3gtZ}1hNd>?Lg+_Z>M4r%pXd0hjNie!yxZKDVx7Ur zvd-9M3U?a^JezKY;4%o|<J<TaP2l=Z#u{L^lA6MCbt%eT_Fn%_g_ECBKJ&b<r_*gI zF#)sok2lBpp8JrhrQxV3yR`V$x9hR5hi~CNtrjo&+shNmt}R>UqkfRdTW6T8<6mgB zEa4r^lU`zm>5#r*#%PeX^YVWmaQI4s;%+(Ha_cl5{tWF@dRHC|I!fs2f-YmH`Lj|& zSK@gM+&bU@=n2i0TI5nbQZnzf^_Krp%a-=AD8m+CR2Obm(h;&hUGL7knV`hR`1nZ= zP?=3#avSe9@dwaBqXGlnim(U4)%CP5H1#6kP^F2)wB_>do@+#`2Dn_)mYeSe&XDxA zD?PqGUdqp~zi5(Il#`>Q#d~ANa0YRB?^57DXImB&SQr{s#2lY1;q7^LY;FxP?K%S9 P4@2l0>yU2#_0N9+rh2#c delta 7810 zcmaiZcR1T?_`Z&Fda9?@h0@|wjiTr<YU@x9$KJ8pqbQ2jUdgB9v|3t9>{+!#C^2d! zTGT2r5^5x<8i^4jp(Nq^rssG4uJ85x=XYIPNIrSr=Y8J$xu5%fjJ54$x9$B<2|@lU zE-p%K5)S^C@KNGv@69akA&F~pg3pf+>xrk8`M$L7ARryKL~JA!rs3In!sd3=WRsV0 zWd7N)uXgE~Sm(KjofUFt-9~Ox{l%F_cyg~8We!214=<GJh&DkYM$l5Y7NucP-yv{m z)T$?4bvRlPcfNQLU)<wnk*wedCA@w6S8}&xa(6ztAvnDD#PQ?boBkG;m+uMZZ8+E^ zxu1vUFCN&<YnGZboXr#b{Q3X>yI(EScxG;n<q*uv)0}VWfww(z@?_q(Z?>HE>|NsI zr)S*`zB65k!WZv6MqA785`S#niWS8OU2!W4-&~IG%~TP+ct<yNL0VecYxO(SW?*7s z6Dz6}z*?$hHHrxfqouPW%w4{`Hq+I8Y;siZ)-77|lYRA@lyIwtAn)o2BLgfa5O)Ck z=OgAa+5Ya`yInm!qy!m@0CM24RfvLX-O-7OkB_FS!kC^~jJ_N35`}}s4RoBn|6DIq zE&gYlpz}P*#yPQN$`tHMgg!oUfz64}rMhRC5wf%pF#)})SM*Ov8xz-Nx@Q8^ne(}^ zXrpwMnO<oX73&jHf3G;{+xDMp&p(J+F8?`Yq!d8WZc-`BS6AVaVXDR5m__D}#NH}$ zGwt*eC#c^2y#KJU(rw3vAo)#S^?-TPo-8f<OP4P3^75KL`yJm(6@h}sbELCEu8-At zTafDmyEQ8jxU~&t^FF@$=YmeA<xWi}PoDh2N$25tSZukiIJ7u{cU~ASw*hZhf_#ul zY)sl?#caaD>Q%f)^Y-lfy~ty*0Pit2GBQ#*^1zjn;E&75IAeD~z^cR=^EJ@V-`~p8 zGH-Hn@;F`X%n>UL1SicYg;hL#x_9Qsk0Q68G`AB)j}NVKLN!HQ-P~j)BwD3KB}3`A z%B?YJnxZDJPWANmDll1Z^S*xln^a_$+p5z2J*XiuF){EHt}qziWjg--B!{C2Sx<kE zt;gN{uyLkm=o8AA3&S3y()Hk~9dEp?#n1$CdUc*b9YjM`B}q;YClKs+Sm^T2fjW&X za1CDUZ$)c6tj>-OQw+R%=OW*$13V5p3enD`GC>=QcHR>>$H*fh=6CMA%P=nd+|okI zHx$f0_tpj-y~W|z{{i`j)m_f)Rp@Ip(wUE@SDv&am1T_k<1;xS^xyGe``7T*o+R1q zm-~4pwPPnMqi#FkV$P_&-)1g!yOmVQi6Lu^v$f@QbnwxB`-OQPcbT7wOW4!JJ#Lri zXS%hX*zbHi&Gch}=6g_+&je8T#0#gdIx2`C=i%XTTU60Fb`bn>MI}8EY{2ta4RtJ8 z4eFS9)!3+6=TO!q`a5`0qBBS)C_XEz42NKa?TVZ_Rn)LtZwPS~oIxsQ)}1Os*Jow4 zwVf&|D!6qNyajTVn3`Iw=0Dp(peO&Hb;UgfT=)-8aLbFs%8$O^1P7vt_s~8Y+`erJ zho{|&IYY&=f38l$tM12Xa~O~XDB9<dkzU|6PZByYh)%&Qlr<RJI0jm!jv+Qi-1&us zii?VhqP2blQ2VV;;utlkK@tXFiINae^SfzLXiR!>_%snDnjS6?-Nq6sA))88!i`%Z z`E0tA<Vk2NIY}ug8kV3vh_)(;*jpJQcJ9{eK2W=$imIVU)3@FTD;wC?`Xu7<yZI@z zP(Ij=ICDr)!Sdn54?7$>)J-6mfcHsRTH!>n8pf#!&S7mTs)}og6550>^YDCp>Nqes z64c-bzKqh8`Z2W>G}xZi=#Cv}RE%zWUtpB(IgkfS(+sT)S{ltC!Me+V94dPaU4Q~v z)+JUd=|-PEeWDE(#!AS@%Nvc=`VRNy+~5}x!I<UVl2KN+iciSMC<VV4`%d7ZqN4|k zEea)IB{t<lfYnIl&N}k8A9RI;goM=tiZ%oM%+2Gopq)@Ua_(zt?vEe$K#Bpun)LVg z(?+m`Lm2xx$2qaxpOMyO4p1>zl?tfW)Y>{J3%Tt<Pr>c(u*~Ov_|@IRj@+w;^B+C> zZkgQR)%Wfi{NuwMZv3E<Jpd;Nt2{_qTU%?)wy$}Rs^T*~kHu6~DYdn=$*8NtZ$uuk zGB7ZBz8eHEH`kDNEHy0+O(a?_eXF=ZZ(NTd$PCr_&v`<W#!!lln_GbdH7k7CjJ2_( z47llys8;>>;GmtIoq>@NSSCt99-b#<lr}%=Rc-}P1n3~Yb^>WXH8n-~7`|LL$N1(F zD|7bjwWcs;Jjv6_(-S>Z=2#+Wm~_7<O*!i2OH=T}3IkV0FiAG?dEAe3c`YcY269kH z<`UFwPdXs|Hua#zlq7lk0&qiK>$5!ufB&5zk*SS<cXoEBDS5<?R(a&Mw%)9BPyp3$ zU{UaQf805JgUrE|sg`R0Ib*UvK`TwwH!JwhSk1MUqcz?oTn0sKGt590RJpVtftmaG zlu;tqjmQz}J(Q)B{QQuNf`Ty!&f=ec-hX*>x^Q*6y?g2*dq_w67p&q3N7|%}GtR?! zj~uby-QkdMh;Y|?_io37@|nW=0G^SM(a~|%VXr*fyKi6M%H$`%TD-@g6oS3lUJ1u| z_Pu)|Ws-FP<~dqb400$@JBA5k(x_v;_(Tb1Uy8#O$i3HcbD132Enj<HNy!qhb9}F3 zxDe>4_C9rb0Ggmhka{yUNTqgHGSveOHp#)+@hBAknKPxQeH+cro;?dLc>s`r6&{Iz znLl_?TH`xWmXdM`X3h=w-L-wNfpB_L;lUG9MaG%x@p<#}_d!DITQlI*p7}=UkctPL z(gaeK{v}4FWQW7@V$Ao0$kFg>^kPuMa?_?0#twT6KzFo0u!Ng`5PxW`|M%8|`FVLo z&UobZ50r@n47A(Prf}6^!@WE_F3C#b!=-i>v*7@wa)DcN<&EME<T6lh^PdigS%OTf zcI^zlJ$pmxejoH#wyQ$2A?T}?5fP2oZ``Q%n=zn=udc3cZ;bge`}M^<=KFG@Vq<Lp zV5*UvFfM|&C!g^tf#Pji{c<|$^=o2DIS$Q5XRij`^4`5XE`a*_Otb&c*xl}a{Fui# zVMjW$CFk+u$CvT3>vkCHY9BHjV_$0xS_P!!F_3p$buwV_o0($c%2RW5^QyZozXM9@ zn&W);y6x}p?^-)13FG$WLx)QGPJwFb4Yt$yE-fPiOIP(BA{JZl18ws2X9%~2ParlO zpV!7^Whnr00WQ4gZp#bL!Gbq={;J<2Rz4j7rO?+AcaD^+&j-?XUQP}&4BuEZ13?3r zl!Bl+j6oB$MPZDv(*1YI&PY3O=jJFWBSs6K&OD$s^Y$1KNm!;v@DS)piJ6(0*RTKd z9{*@2q8@NQ(80{i4AA`BL8>JZiQ80SZUH%=^iS&_-sE~KkmS0$y3tzSY|r5``4W<> zj*bqfBM9`@kq0VmU%to!Ml>$8@E)sSj#z^_J}Dp|1>nkUKVUy=CXGa@@)+cWl0gRA z6vkd^f>H&%S^)IhJguZWDPWnnJl~(oFDO`ubthQg*I+ITbM+gz<i8G|R{0x{R9wKa z(pI||R7z<I_xkqXt^o`N^^=1qFhGgO+g0A&ci;$DCXy;$4e7-j3Xb($-NDPpm)!P` znWbd{DDAS*YA?fhu54tpBLe9ZM{aS097Twl1mF&chUgxNya8h8V&AYyW6Y<PyG__q z^>DykW-uBw5iW{B)KW0d30zZF=qx1E#27G)&lA-O130@8_2!NIqs{t&<@&)lr&ZCx zbP8>(wmfL@TMnDe=0(JExfFXwJAyb^WcI8}v|TS5g*unsQy^=F{&|7W-E9F9|Mb~2 zM3TF^d-ucy{&Qi*?mAW_y(iq!J@oSB%a%ZFndj0Yz*WdzxM0boK_tV)l90u=VNV}Q zV_j=R@7%+ymVm7$+H%2W%`-C{{Vsm9vreO4;&K+Irl!T+`}XcNINY`-zBrr`p`xTz zb$tO4YxOt+G+9}|z<hv<%9nK{B=SB_@8jV)-^1@Ou@>tC5>jb<0l;r1^u7jI_<2B^ z$SZcP*9E};u6%oVcpR=NjGguZ=X<y%E)M>_^ZJ)aIab)McN5ff^J}u3G^*yAJoL?V zb!^0AL{vTkuNxjy&wuj1S<GOr$`o?j-lpODvkQq@jnT`4CORb5iHKZK*SF(oq>@5z zEg)DMiJG8YKOV3<BBo9AAQoNAKYXVfcU`MC$MnSZH{yAsiF^yYivF*?{=j%zb%m+P zCYIVeo2<9s^iWSv58fD3Ar6U)17sF__;3+6@alwg0_bYb4)A%lzC5<JKK=L-U~SDa zYGHr(j*oY}>5ymfR<A~j%L@y?%SLXT-?|fLd{vY8P{sMm3adc0J!2(GlN^k->X%oD zxLxm{u*G88!1J26X(drnQRagMMurFoByJl>eMZN**o1~mHXDkVnVFHfdiCc&f1Uto zDY+^xw{+AQUZYR&K2MC1u}WC6%5f``v%H(r&cgLL6?JkRz}a^m`yfX1Yfz<VtEFU% zF)EeHh1KQ+=%1crH5j0u3Ywdnoyog^x)^KSiY0)m!?tFUXXtcar5*Qdgmqk89EfRP z2m{#%0z=g8S#AAu{ouiao`7Og_sGD2zDRDF>I2XwHU!g;)5WwSY}e-q!$3JmX0ndl zdVMM<MnprnC;yvo>H(0X%T}YI1A-`CrJPtJcR#JPrcbJWNfv)-&J|P<kd-Fn9z;BV zr&vy|<HnYfBmgHE!C<ho%dSy=ke{ED+t*XBuC5%~&M;{5c33x${`Y!cKoFt?#c5EC zXh1t%b`5z9MnK?v-;~X8G~nn?lyu<iSE1|~Y2%DO!2QHBM~x<6-nd-OSZU$&n)>`4 zI6hTj!-|Q^d;o^7=&G0O?U(j%u5$t=|Fz!=%`zYE)LMZ0v&6`}<x7R+NOFFeOYIm} z9{~wT?Uc?2^+ZZcNRWUT7#dnQIApxf%~b~83NY>M_%E?y<v<g8(1^wA4<{cV5!EcJ zaA}tXN{O@094vEekbrSzUss}B6AQ==A`k<J4IMz9uz?$VT6wwpvDP6wR%lD8c%}Zy zlPBt-Yk7pqneJpcDXCikfYv|?lv<aFpF78#P4`6ul{OQD0O1I0hI{~2UHID}f%A%r z<*k~)mjJC(2-+}nal~R_2(#|vMJzId*9R1DZ!DEO*>^xzP0fzm4+8?KtV?aprb74d zJf0{wi0*i&8x4N}ZBg&QsgG<I+pmaL*AJPH(3Xn|OMolygUgVWl{E+FPE+<O05S<M znDKObEEgBAg|3_gULy61yR5kQbzlsKxsu7XTY&3?(=>w1BxF=oZ3<1YH+)!g*-%o; z)XK=j=jVqcVT!n)?`gy3&Qn{vR1*lj0@Z_Mt$|=9R5pcg(rU(h<kqjazR?0A*=x9r z6fbF5<<=vtck^b48#Xbe{d-$<;NrJS^7b`<gRU?Hj-Hs3avrw5+AhWq0s@+#$hA8u zjGCX!m5?5t@se;{L|ull`|~+qhmhH_^5Xs(qDvZ6*3%{3V%Irokie2r;6iB$BR6rk zb16tpQPBh-$`oi+aI?84+FLhMQ&T~!9t6ne?g08faJWW5NrAYBHkQViL<<ve*kM*t zX4HAyPGyKaf8fuRDc<t%mC0+st(3GPqfMykz|*~u@YrThM{$S-pSl?VJIv7W_1gxJ z!2m$7B~V-7jOT&%7eoHc3Dy8*Xptyu#q}rEUc<&f4so>~R}%tTI{k=yg~{Lw0ZppM z&st+I>TDfIKqg%JfYuux-W<#cs2ycfha+jLA&easec{DvpB2iZ%=GjHL|bcXh*+*a zF4-vz2C~JSOH3zZW;*_pF8HjoUmc8R>H`<HFD&%sJToEkYe0?pZ?vvnwdIZiK=Wmc zxMx#wtmSpJe?oEV<@|^L_~ZO48BnmCO}^fbiTY7xFP9uo>+1Pe;og-a5jO_hu=oFQ zPJg=hLRzM2QTuXLa(yOu1TZs01%OGr<njVCx3CD@<!qKXHHCpRqsEqo9D~XEK%$la zWtdMn+~hl<%@tTS&WLJ)%y(gB&-*}Ou7zlJb$1T}3)hul;^dTN_Rz_{N13Y~k%3J> zU!Z-+^=Lb60bvc;34M*=Wsu1d;DIc`Py#q8GSIN<fi%lh7l_c+H2{`532Z6g6geQ8 zbvO)*SD^vR<96Ir15*JSZPlacFTCVGfX^=bGjZc(cHdvoS<CK&EplsBKR@y4snjHG zXLKBsTT?>3b3AKhr~@AX1{P)xxPSzR31eGv{o1u_@p-@^(Eza!qxj_#l9LMoEknhi zjZw}$5a_P+2D1Tkl(flE;IQMIzrl7vy3fEsz9IjK6S>?uivGUnKpGJSoH}rf7T_Sy zXD13x#N^>sx0OAKroi49I=WBb5L`NX!6)YQy~(S*$vRp<et^BT&fH!o@1_Qzfqo1F zULvqZdANw1-xx?sT3X*Q=|Vqv$h8{I)k@X(``@=}{_j~DSLGi*b@5&6)hPT8E|(TF zoJ&LL>DRT^XX~6x4+8qM9^UrwMcYRXkhwQa-M2&=Sj30><bd%PD1vT8f=MXfV$jty zyax};1d9P*@`aBT)If$qfT)C3eH^|EdLh}X`XX9kmSEDrB1Ps1^7C`+>i!~lcx`jj zMpsw2ZoQ+oH>t<1qz|jQho@O=!gV!Tx$QC`tm<O1ZUbL~6(&m0-BFZ$YPql?I03PL zE%pa@PQX<TfVd2|XKJy&xUE?OQ6T`?@@`omO!#<KSf*#<5`$b01F?d{qmHGB{rRZg z;id%m^XoV7AXM3F1=Py3-@)|dA&QcA;Qup$xnz5+cFgFP#QF2re8xr2y7aGK3dn7; z`N@CF?%%)vXdGDoqW-T3Z(qB%=f7DFxUK)x(kyT)lD|In;+KkANk59pNt8Wv&Nw;x zmyi-_=rR6JNcFh=_h1YvCprD_|0}R`LEN6FUk=Xvx9%4o?1^7HyI}2J-3B3~pq?aW z2(?oEj{Wa|?j*|o7b)spqNDIRJ017`KJ|a%eM9^7f8UNpX}`aM(s?fijmU<B1t&kB z>UYW637*U861|o0NxtM@ND-aJmO6HPGZ5~Xnf7mgdI)C(W>}APPMNs!y^FW)3M~(8 z*C}4YK)8D@bq*1A>+gb~h(|l^Pr*qi`3f3S>dmX0n1nEivT#?v>3DlKTSHJ@yiSTc z2mA7pdx}%%#P^^G$-<Css^>7~?CxVZ`m4u!dOn#j0<MVF(dpNjm=2k3KDxv`<-32c zK@E;$G1}!l2eSHmE&LfiT>;8?s(N-Hg`#7Wtszi!chIXbduzNx*Tzv~5$l9Ky|Ccl zzE_Xg=;VtOE+mK?ig1EOepei6M7}w9PM`4F33J5ejRhkc+AW)3DXd~Y51v_Nul=$4 zlr63osgu7GM_@&4H2qsnRJd1q1Y)5GYi3Q(Lk*{KjGgfI*(O@};GcTRDS2a`v-&!+ z6lwRnWMBjSvH0Skvn~iHXo(diQ9OKjkijf#5%i+{I`U+TPIEy8fiYA###c10Jk9UV zvCO;*1;JIxqu&~g2TzxgNO#Y65#)$2SHfWNLp#$q`1$LZ^ScXE*e1L&wRk*3(;M=N zWnU0L)N|~~@ZhJLq^7OG<N&0rOo!q?M@n)+I;xPHp}Cmf!XzJ6)kq;RKk_&fX3zu5 zxpcghbgZi<eNMlzTWi@rN9}H(xf&q}LjHTnW6(#7v!bKy27j&HlTs*Bj6E5uf2B=l zryz=#>?c^qoS$e|Kr!kl!%qXxHBC2Ua7&?CUzfk(f<Sae-Igraz0<{=F)6anB>Xnk zxbQku>Q<_Uj@JxZBJicBR7sDC-g6&GUvl|8PBnBG%d#hJ)JSb-S2r|vL*sfrGirw# z%h`>e4b}0L51ckr*VcKJ5uHa#W%f7Xi68Y+tf8xBBJ>ASj=to9SVr^2dt&(Q1Kzf{ zLHE<%K8I~ECC`-nKi8XYUh-n&l|qp^WF&!EIm)(FKCcT2g+~hP5>DB9&sBaU(4^DJ zGz7mQe%v7|7kHXPDGjK*IM1ko|4Pxbpsci98;UTdW8RIj$=Ub7Gu-|J#*v-ll+MCk zKnieXD$3&Xo|{O^en`VF&y(TtjOG-DO4~e}Lf;J}u1Ee2^Gh#`GHh{(<v4mUX)0Y2 zGPNWuxNg=a)%Et%jXgHoBZ-`yAez=yb6@;w-5DV@unh<D4hy0l<=*RY8;G_(V$n{R z|4KcR{g-@CO>4Qb|7Ugjf=;b}9hZ=F4?eo#Y!NVB$oQgDBiHC5B5$i|p1ZT_K|9bs zArm{6J1pp9fpp5jjc+w=>x{z&>N?azFIco>%}c>(s_#*_t+k>`YzD>K-F?P$Q#!J- z9N`SHA5x`lqhz1#Xb)>AN!^_>CL?x@cn=;n&wZ(0Kb3SVjMYPk7^*99GU~D25Hu3w zyg0I?Lv<8AdM7#0nXLaUu$qW=yg@IyHeCWuzg8%dqX)_H@R*);zwF2Oo>0sEuJRk3 zrg4((8C{H8evL(yEj#%z)fqdOx$ZkhXlIW~wdaIsc(4cw{TnPzX%1OUAGNe`v~Wa4 zVi+UKpE%M=UZ3%@E(SB6!*#D_jVO6>sPLcTam%YA_bP0EboC75Z4l_UC1~nYxPU>t z@tGcCeVdp^bFP{8SUtwxQ0t<Ufytjv1@CB960oy5*F60YT8NLXv0)5fIu;47YD>tx z4@3mggV)<KXuo}m1MD<8JzFHTJ>U9(c_sk6xMQvCVP(P;{+H$+X`xCPwN)-d7f4>I zoqsO9n=hEfPR<fxz3{`XGir-3#pfOFMp?ae&fD@5ivvXCjELxSXIZCb@7=pZu?a1V zRm=~nRW`d%riE=!SsCc0LXt4`s@=S0`bvg&gnN1XPLutfJwa`XV(%*k|4|Bpzy5CX zXa6g)%gn9FiNtS|BK)SMDN|Pc152M?ssDX>sPy3JDh{UH%5pwQ4$-a){=cv{lKW3N zRp;`aaA!V>8n^Ud=4Lte&wtaS*sS`&z}Nv1>N<HFw9A#%8A$&CbEcQh+!Q=Oqb47K z#a9xp@^4P^8l{~mS-fH_ABv17xTjGbVt#+!=(y)e5UABE4urD~m^fXH9BG%Vnb_I* z0}-+I8yznqq*jkzwGa$8=Qqtq;|0o27uT6c-tWU;17-taJe~OSkmoe0H4Sjj+sSG) z)k+k6oY)7=`6I-lh+p_SqiCVe2!0KCD*`6Obf0e~)p3ZrY#oLqJ%gXzjgdOyq(B|- zxoY7o^rPv?EXiGUf#eR=y{KvtITp6+9BUANYa^u7T@3UBhmVTQZ)aAfa<hOdv>XM^ zruq4$_wCm?^xhkS0qM*ZuZ6iQbzNPW;n!-zT`H=UPnAjf#;)280jhstLMzb!UT+hk zAsVY6^ZE>_RD``Cw|lEjEp%-iTV!Ch8(kCIM!@Gv5`634RfPVSzoh2xuXY^dy=!AS zhtVZ^J^zF41wm!tr9DlX^~gJIUzC9kkkpL*31%u#h@m^KB>&0;X7MgNhfAaEYvYvM zd<oE3bIpNGk2su7#2ml1*50l-1Ok8eISQ(H;f1=Ca?^wD=hth!!5u%YXvCrXt*!Q! zbP(d0*nxooxo}PJ^2e|F`T5;b9p<;+&?+<7RB1vd$^#g}0fLUZ&BizI#6uypS#EtP i5{b6h^xPU-+SbuxY;EuoCRyN39+;l-&9duvp8gM~#NurL diff --git a/.github/images/AppGwBin-basic-store-type-dialog.png b/docsource/images/AppGwBin-basic-store-type-dialog.png similarity index 58% rename from .github/images/AppGwBin-basic-store-type-dialog.png rename to docsource/images/AppGwBin-basic-store-type-dialog.png index edc754a6b139fa8dbcf5201c514d8bf568aa6003..d7ac55d5e7bafea239e190f199c87569d1416c15 100644 GIT binary patch delta 22012 zcmcG$cRZH;|37@T_l^pwgpg7~BqL3`6rxZz8OfeUONx-49T`cIy+_Fik-hic*_-=$ zT%Ygwe82ba_jug@+<#mT7oCptJl@Ca{dzsu+idE(KdI}!IXr#1xYMaq@d)pVefX)X z-#;)Y-|;+Z_FZc2o{U?=j!fQHoUf@lG2O`Y_NT4>>HYfD{c1)>hUX%x&SI+jt>3)a zL7ObQp7pu7(%kZQSLYjUvchVu<&%GZHt?P6E7dFuGMDzH@^Fec;UVO_&*MYH-v9Wz zg*e9&`<AmZA=UPjci7Lu?(XjW^|6tW4$J<sai8@riRf{PZqe1{lRFjLx#iX<m!F<U zEq&)yNOV}Z2DM*7lA6HAw@*&YDDS0RnmK1@w(ITNl9<M=<1)+1i_$atLYHNpr~g^* zrDiti?~!O4buLL$7un1bd6e_S35Tv6<sYR#i1l3zG{XDB<9ME4wCvyN_eGCOfo8Be z<&-PK)?1_0QY}BcCfVo)<@45RJX?NsZKKIZ)AM?3QJeY^+R^*2U5(+3>|2&@t`!|` zY)Y8kZ#QWd=5<|(t?3R6m!#BA8$R2UuI|-S2P@M9#93al_;|CNJ#AlIcqp?a>S5eK z(DtKih`pV+i$7Y3cxJqvVmH$he70KlrrJD8K|TG%x*JdX#m`=plFBQp&&+gW`zanb zl5u0f)yn^&$A$g=qZt}P3CoMe_g>jLzSpxPpeV6gVrptCu?hD;FTj0q+=Md!N^-;f z`)%w-^l@=<scC6mQqRO$&YpGaDs=UE6x2EWm!*R^dq_v2e_&O1gEYNku}|*+C0^H5 zymt8gYp<lyHQmDv2}Z`o#{~tm>rH}fXAWI=r9Wj7?C(#@$~uuR<>|WVGvn0Mbdax< zN{F;-b5~!n+IVL^-brWm)y~7k4GCJoL-$3N_IWM-pplg0Dcq&pThHNRanNJ^etKaZ z>mkW0Lj3O<_Y?g584|_!=)A<P3JVLT^_^7a;N#<Ce^2xCdW-zu91in!S2w+@d6X40 zIj^Rs_U85L4{|Yz!;MMN^@$uG>9>r>t7~bUvzpRoU|^_EGd^*c-%S0-%Ps1f)PmO) zHoK{$Nq<Q<nimw^Wt_tu<dXR+>*J2|p`$rBDf5Z1iPxK54)ecKjOp#K_{hu8-__NX zH<q(1rLNA{+S)2?(6#*QMDQ70`%6rWLb?fSq*UOK+FI%(M~=`PK71?c4*T72Ppzg0 z<Ba>H^z`)Jb82ku?d>h~<94dAzkAJvPE=T!!sg|uQQ~bhGpvAX`10t}oIZW}(;YTy z4&}EWKN82!8#D{Y$W4wH9_i}u-z<zb-n5hMLG2d>j=53CoR7C1Vt4P|y(O2XP3dPL zv$6VWxXhNLYs^NQ-$X~B6tJ3lfCb-9$Gh8JWKC{Ow7f#<<74LyTYuKnc!h;Aju<V@ zjO4Yo9Z6D@3>LIi{>x@>!OgmV>-O#2zkU1m!F;Thm|I*lUR|+elmGfQCr8M7c67so ziSA#ChHdmujk*dtIy--q1@fOgd$yy?RY((83lOmOzVu?__{!qgy2pdnta4xPi{828 znS8jisw%Ir(824ZysDnwc05Ol7n^J--r}Xb{hosdZ-|JjU0$5+Tb^wz%oXkxc9OrH zHhZO(_$u#QoJ{qsS@~D=fji+e!fQX(=#~ZW<t>ioNLyI&va+($3EI5Z{OxDdp1WqW zC1X==nsHyM<s|dYojXed_&l)qd+6!QJXvqQzhKJt=FJ;*4Gp8-(nEe+IwIQIEWiD@ z)tZv^@5CwxDkNxj^!L9G4n9KTyb%v@czC!zp3vB)R_K!7)Z{-@7wh5Wl|SB97^R$b zVRdCTN2m77p{5kWI`8u=EU&3gDQ5oRcFKwEHRR_kh>SMluV1|xwc#C&^Q)M9DU})K zhKeZ$lA4;#C!_-YjH<+`Zusqg{sb47=gRV;@${f9rLwZ}{dq%ryc-iQ?|a>v&sn)t zTgQn(F$sw);W9=ejof(VFJfX&nVFfbU%!4gEp5rd^pHZ@6Q*Owj$OIdYuAuryT~IJ z?w*?~Ov9r`-iOBt>4LVl;G{=&?tXr_&UXAjGxzD5;rh52_`KTu?4`ed&rjE>JZqj| z!##MPy7y%6@5ATMpZ}en))=adVPqnhI>yFUIos%uIePke%dK1r%g&}R)2B;(rXG|@ z;bc1NmAWW;l}_nNjAGJ{)>is``}Qd&>0ZTqX=-YkjI{;^+bwK)I?|NV)zd@%^wzCg z_4W0SyNmX8c6G%iCH0j0o}<(^Hg*mUI);QC({D_?6fP5TljY3Wv)^-bDdB|7ua*q+ zG_w(!kJp@kR95aaH#cu?Y2h;)em_Hpe<>_2eQVH?K91^h4+tp5nx<KdGw3%Z+jcyn zCR9FZn*2I&<A=(cFyFMZ_m*}E)>*pJ@jb^ool;B`4!QX!Qu;`;e$z%_RNo2dAoaPw z9q;}9t3F&>=g0kMWA2-M#EHj7M&I-D*5Ss|O$H`Z53u|^$;Qt9R;McBtm@Cr^cO91 zE5pUt)Mr_rpP88n;5T=PmXDRehqals=QkgH`{vCSXBzI%t4`FoOPK^sNl!5**CRr` z-M>80PO8$3wb<@_%6)h2G9}e!p3`=5hKZ4J{Zs6OuHj*c=|Q3f?JW2E_h<J~42-ay zP?U2$J}Skll6ykeZ{M+9r7W)?cqe1<@Ux4ib6b56`N@=x#g?EgpZNa$dvgvEj4M_o zJ(3@>OHzzk9;*1bDLHw=5ss<uv>?y(7vImSP}J1AL=G_Ay?3uF<npGO(UuZdp_Lms zcFT!*G@Zdi#4q8AU-U&Bk(-Qr$}`GM%doU=?(RRx{lsg;fL3&rlhYk-!OhRlQ6{R? zyu9~Tbj|zs?=$~QZyq;4V>9=7?YeaXHPHvGtgPk*XO9TkebL`X!>xN|sFq1(O;BCM zyXz_{M{eJ~Eh8giF%*+>GwRNjt5^5z-7C_TZJVS+U|S?w`uY2x)2lz@8_ljPx^bi9 z#1;msjT;hvZDTx4D_59bbBX_DOojRZzwE^7FA5$TchIztj7YlD3w*j6vKBqBu(sBF zcvugQ?+5=_=4Jb>RG+Y#aee4W#{~oe0|Mwq_(U#W{#9Jez{chnOsx3!{`Nm$r8m}^ z)j*^g9q;Jqu&}c7&JTB#fBz=_FUJm4)x+NSHS@2&)eLU;)J!LSr5g9`EOb4hHQJo^ z_AtM9oLV8Lajyh!^Czaqx1^-};$lZ~Cpcfbtf$9b7pt=A1KQ1%YuBC(R5BekA9UE= zBdVi$hgrvoQ?vBo>HDd<qb+GpO^wNfzPPF?!$@P&M{%FicNG*W5_PKf2A4N9_#VIR z@)$ECJ|UqY!<=KwmMzuM^1JLsp85D3$j;6Vi-^!|dV?`&)K_+x>^vz3EuWM!cu<RM z@slF2ePZrw4)qGSch5}UmGGQDnPDH!I=;(&%?<J2MLyYIriSWv85$be*bp{}v8NQ` z*W;Von0wc)tS*d>jwYfz)lb$pHBJ8QxNJ4m{|uAC=>Ugj!P`TPd}oi?PVFfxD{D?S zjn0j8rafPPEt+mRRBV$#9G!Gz=F+?6aoFF5>V5XDh6si_j+U;4aBKB2tv#lrr<K*3 zP0Q5!$^uhUQ`-jz{l=z=Y}>{7#~mWq-X8q^MIqt65Fz-e?rXT17aNOL+Ae{V<m3YM z<~RFJV5r>h_BnQ}Sj>NB`t{O01NY(2-PTu{J)S&yLVl~?SZCd_gnsACXUuHeR~C*P z`Ih#)%lu?tRf3lETW4o<qkMF*+qbK13aMn1Kg&i>)W|<jIjdH%{iwNmab4YkZQHg{ zT5V^Q(1`P}f0Hh$W|)nnTF;)&vYIBRev;zv06ybSw>}nZQwiR!acOK}x}VN^G4zPp zeZ{@19%*xn`tJK~J1sR_-X_j8?N|R$wjtDm?(JbhHQ&*G=RQHp=072q=es?m!=9}; zIA;0$%p9lXGoGV4G@xJ~5f`KI=6hFD=X3|ZhMY@jsf4?SN7S7tnP;}TNi@#aKI+fC zWZ_WorO6JUFJ1Z8w(X)kuk?nKw;N~me!PucP<wE9s&B-}qT<4b3hf&b5@9moVplf? zNSBnBGBRyo+Hmq@v`5z4Gc-xMvKx2O-RLTCW_r3`Wb?6~ZSL#cIG)AC=zDB(W+J3e zZcMMqe|Wh&-R-Ch`BkJ}uO;0SFq8cM%`MyMFW!BA<DdTzp#>bXlnUG3^RT@3ww{vt zYk!|3A7WMFg9WXzBk6Q&V?=Uh+aio}G{c`r;a5V#7+>!XecO_15^SjHFuqdllK42* zDJtzO)6$j}hMsQX=>?|1eVaHYe-EFb!`5&86=AZK9dCQ_vZiLldN&czq$)RgoyG_r z{S5918LzG3jr(*oAC~$SJqmEiWV;l$TjceV1kK+xzWZ3ODBKp3icHVqj?iQdrxsq@ zKQ#1ES5w5)`cbuOmH0>|dGiT2Qx(^7XSeA0JH|)rY7mwN<flASP*Ct+_ba-amAvm` zCd}mJu^@jG(qhV_-ikjgS+(n`Y-m#NBRNZK<n@?z*+V=b0^YT~J+kb_lxduq{of@y z@Y?pX>FD^{M;MLVbzSqZ`3;`?#+>E1!7b~Kt66?}KBqOOKN~#UWcMm;Jz*NM`1_PZ z|DO`y<Q7^V<6kd#-;}zfE*J6YY*0zmtw>J8J4q~@N>e=tubC+nL|kq?=zHTbtFqy? zNP~`IORAmI(GQ=+=h|I9zAk-6|I%<4qu}t&4)d>tMkAHB-s|mHo`qSAj5Jtn&9M}! zEdF@fOP_7OAM=S#*#X&J*F|-$wi7x^WlZ};JjKOLMt|-Yy(YxiUsS3UVVlv&RYsR3 z7M(1`;i-jwMNLi3vfuH*1=rmg$Bqj)9rl-Q&oO40R??;R9sNbwdvrl&yQ@dl8BXt3 zt8uHQ870Q$>si0Qi5_;8oNb8@Zdh5~vxULlVoR}xl=>I8sGsG9Rdsd8&yJ20#yunk zD{!VAsE*nf6cl7K(&)vJJ-0R~{cp&-zBpplj*CVzDo}dqoPd~x#5F}~s|7;#yN5&Q zM7ZUJr(YCX+`0LgRm1a4c5!fUG&eUtHa7k!9W1yso3q*j9NW0OXV0E5_fkeT#9n({ zIV<e-Qh7_`4qN*b<CH^aaJ5A3uJh;5|2K6BA8_KxKFYwbmLe@J-Pze$d{J7b>F1<H z40SELN_GH7$sr*jp`G*>iy|cbZ%9j@ICJJ(^~8IA^V7b*_T?)3IxRtHzdg|1eZ*Ad z`)YRcj{S#)<zlB_N%fVLma5NB^w9A>eoA#x?q;OaVZnv|<3woalXY^|*499;GU*2x zf3{sQGvoPq-IbYv;dvmxd1aj1b!Lh8e=CK$jJGPBzgZimzb{=(Qrz0sZszaINYl$# zui`ByH9yP8?#!h%%=}KQOdg@!VWYym6;xEX_4jM{mIs#uK;O-_;R8(wLz9#U7CbC2 zF1~l)zVS(7va3E$P1wM&%z7-V5R7QeT>Fb%0E_tr1se&10DRb%i_WOimc1;VYBg?d zHu#rHWG%y*yImPhbM@*j!#Ptw)~M5COaX$`e3n)F^Wl;<7ftr!D1Y``=Qe}p)bBvc zfLssJfreYN{NKLaeqTxH5Wg8a_FMn~a)IS|JlQK55D+kjPWeeTni`x-wWrt%u%Tmk z_^qq!E<laBxw&sodc@Gy*KFRr`2)HgN+qdiAzrtJO+r!<`0*f^NCbxPRDZ>~r>UvD zctQn(HPN6lmLao>uOt5l4f+ojM1Tg}?_OSL|Gv)qv{G@@?MQOA7Zz^1e*HR@aT_)J z2jwiQ;pVh`w6wGl622nK3)8@F?Z9J<jEwE=?YZ9`=55}x<zb2UDg5BiS0#SDDm3Q2 zbP0b-R+a$9NhmI0VQIN%_ihrC-j0y?{`<FcVqzjgiGV>f!HZG;yIg3s6cqgsx9<M2 z>_vlT$uXGo8q3K}bx%W{bqrPQvz(vM!1^Sv>8^^8kLR^p;spxQ!qoa%P{66*$OYp0 zOIm38O0--INs1@{4_t<=0VGQA>njBEeeLAb<!_k1=85&ik>O!1;87kP@9CjBA^~eE zA|mqo?OXPgN7S(n|BLL{8=0H;wSRvBjuj#oZ8`V%nE7b)!^z&?SigM-55D&B*tc=x z#)}qzpKjU5{3ljL$Zl!;`o`@Ch0!yx@Df26eb=np_)V>Fr(&Y^chpxL=6iE<fC{lp zMFB@8Zr<E|>RvK?a`r`=xpzfHHw2fbZUcaPM@RToR<`j0paU--pD2a3_zErwW(}|q zhkmc8ukW;MQ>V@K|D6&F8z|K$JvxwOJ*(NC`)p}pC|0kTNZkV<#G_aLR53>L`|}M~ zz0Zv`8yFa1U+o1S1O1%G>*ld1>N73R3CB$jW7A=aw~vjLS4Z7eNYbT(aIvA0=a|@! zT;cJB^={0}%#GI~S(1~JL6#1mJ9p0Ih>#REhNz@u&)<%`yLa#IrlPuf|2`cL56?vl z;_p-6b6R`%?70NG_4>`5OHrjtmmX<qz7h#}Fgw};L}onN%=c9}OAI)V7pjEi{jV0k z-}+TBsT|!xY<Q>HTc9^CbXV81XNQ*npSoO}>Q##1>XI>p5$&po9b4_6?>iy&C)G&p z0+>r&+*!k%Wgba?o}T|CE5v`Xm8Z=d#{WT9iUPHI{^2S$!3ruQcmSt10%<BLdJVoA zTA{sp=gtWESmkiDWs!@l|4p6rcOAdkz5H1w>b0ZekAi|%0JOW09B~E1)hY{E^Q7sJ zyuAGO9Xmj@cCdMg`OEv9R=WS#%&Y*{ZL?c+rWdek$J;_gIEak^<>92+jRqinV0SeG z11Ug~@xOm_Q9Re2Y24nuyQ!BpX);v1gCwYc!>A5lU*CV8#9-1E27jml9<5#{u1Cu` zgS;?I+Aht-&CKCfE7Fs`?A~AA_dj@0xOe%pb(^%SKka$->Q!SMJ3Bjhk02FvLUsXm z%M0Tk65dBH1G?%~d4*;74-8b~5X6rkKX{*XZ^nb<<;$wCqIt<uj3>Nh`}Qy_4qo%{ z(WB@V`TFJ0tE)~OL3;eCYd4Rt-YkUQAuk=PBK`Fa+Ydc=b#*nXAUlI`Z|TG7!I}+~ z8L6osWTHrHk6ZqTh6XL;@S{hMM*dh}Z62GN<~KH8Xp0*d7(gNZN!GuIPOek;^{`U9 z$#<|4w7tRmX5-~*q3kxTRi6$iy-(8<&OWA>bYWe%LdSr($VZ~$ov-g3vG7iZBX$qa zL?r@v&#L%AJ;K0rfXE~$C<yjQibMf{fqZsLsb=|uJtaPAcFPw)1L*jkyiCw4cMlBw z-I`@BdgBJ!AzAis&CJZi++gD7_QC^O*MCRlf=NI4_KCX*nmd%0mCJ2MI>*F)%-Ss* ziMNr?ht9p)cHs0kYxB|0<j~PN^l7z6kHj(ia2Fkc=B*(j_FJoC?#V|kDJJXv0_P$L znU0Rm`VAW@P|o_X?UPn+W~{OL`$EHtH6A(}KiWhQsXG!8FPYC!mES5|?4vAC>O5Ew zOur|KGy0(EU^?4rdA<<2$M=4|6ZHce{ymq@UO72AsB;CbN2IGFBnR4Zgz%;7=bL>O zt)^agcdL&W;n$|d+JdoBISrb5F;Jz;g9Og<@DzX{V02^p1V=A*2IpmlZrO3KTD>qr z?dS5UZE$3~<khb#>4nqcvqd+`83vn`G7D0L%$4^M%o3E`%1U?ixJjsEYKDfv9Fk&U zTUS<A*zYB8w->pT_iBgEpATy&Dz?*9=QK<I%y`<Y%=cA)Rl2u$p?fBDZec<7q1&R` zT1<=6k7~a>gn-vbze{P*DJqH;AZlr@%QZDaXf+Ay70<}fp83hEx)<)S{;Bdl0Uf-E z2<E7au+2J9R*ua?-j(_2eYEFW!^`RFzxHNkWhtZ>97cJiW@J=-mOU9b@u)3Z0J@$A zW;=_Qm~QQtUzwJZVm3Cn1m2W4ofc?FwzRP5H#yZAEdK8VN$PO+51HVRD}fpJ`p+L0 z5D=iFmDh4K<nSZ1rhB*b`FMK1OiP<T*JqA0Ci_HqxJGtjLqh{26VpQt4cYehSbTl8 zEopf)0M>1fM7rl6&f8V94s2ge6^NiFrdbMF#Z_D9oCEl5oZn9UaQLS8NKW<dT(X7j zoK(nS&98x__LL*Hjn!UBS&W}p$9Up|n!5U(2lm=#gc%QH!#khvu(l0>Xf0aZ+F|>Q z)8|_@yK?41AR|oEsHUs0>qG#<p_3#C4V%+bjVCxzeUZ><OW1NQd(idS!-mqHlcRQ$ z5)wbFtM?!O*f+LC5^(U;DM@~gw8V?j8B-=r%vWw1TxnyFjX9ljROU7DIrMo^<;})R z-9&VIN1nqM#Uw{m=y={Pp$9rT^YKoMFL!rtvAh&k`h_Z#PMa%Vh_78%V7BCeo}Prm z&cpTJ9==%rPGs}=Ru5c^Q&U&7w1w8_(~(HGKqV`W+Jpq-n?h1uqt3h%Di1n-N0UPq z{N88bZxAR_<#gkcs`Ktxwgd8;YENr7mc(YPe6aUFE_O~$jMw(t4L-gPQlfo7zn26E zJPEv2mEkG%&>p|G*PRax?1jKR={VDtV+L0RSjN|SYGE#iXtuCTS+D9}n0+M2)<?3( zpsUoi|8U36fxmvx{6iMUn>|iBGyR+Q^Pe8jK1S|SlK;ghFR!}{ZtxG$GT6R-|9{ai zk4q{0h)W6qCRLv|i_{%Hc7ZM8&vFu7bY<T%&-R6)kL>XWNOHDY<4g66BFSh5-uWh3 zYP(gzq`=Qqe!Y+&zAP=Bc=F`I-_*`^ze;>KjG?WJwq}W=;ptR{ZGpBIt~4wYr&Uf* zM@RSRb|h-Xur>2n$YqBcQc?xb4KS?;3<5ExvAH=5s8&FRr@SV&koUGfvf3fxa^2yF zOT(jAH@>6bJ<pD|wKOEJ+;G$3qS*m7s8;>y7TraQ-A|P=%+5mUf@mh5Q6J85@nXPa zU-^Ob^13>o*;Z>;C>MM7?Rx=n_r<1Ny^Tqam@dphuzNq29^AT<*u1$Ngv26l+du2W z5+XD9=B<k(E6>x?+f7l5Zh0*f|MP~-jEpa1vlkrkydSB!zJC3n(B&|xZz*ypD`XI> zf&ihay`{dHi=!D7Y=cQu+|8KAgtn7UGt9@_-@m`xJ+tYEjW9s=0QG%xNkcblaGsdB z8XiuB$5~D5LIv{Rc)I>Crf*(X?6JStmvXVnzrVlOBq}Yfg~HrU!?oF7<h%X017x!g zykN?}%X<*sPTf}}UucS3?bkj9v|GD&Er3BNrYW%eO$etHYWBOrP+EAcXV@VwOZf9R z17F0OjVP|nb?pK&FC`$O_Ct}6tMl;n-6AX}=RLy>%?6D#vZYp=3&UU!HT5g8@K8KH zV9i7LHz4PH2*5W0w~D<^ay_bj3l#h)WqEmdek7&M;&1z!BX)DgaLqm-xq~z`@#bU7 z040ZbA0GuW+<26UX#>gd=y;!cc~KF7`&~e-+m8qa;7yIE`fojd@d6`}S4v6>x(IKZ z^=VQoxD^qdFzXPg(Kd5#er3iX(6-m8qN0M52yM0A1OU-yra|jxVPO|gBP4!4V&x(f zJz;}0Rtr-)<h{b}$Zt+F-m+sy557<W1a18Q=RG@!Jcr3DX`!>~MZ2%L(#ITD1p?u5 zqCOQ0Lx%K#oUi4fV#t{Varo`Qv(HK237=WDL`O@D9OdKy0r5Hxkmj)KNUu0KZ^$c- z2d^$UeEW6=>hnQC8{R{Q4xwN=dwXBucd(Y>u>Izfr>BW&%=dPTc?!tQH;oc%_EXRf z)wiIgHGa7>L6cnj7jA<wJO*Y-zn^`<L>UBoa(#4@{Hm+(XqE>_q8J<C(Ww=@?U)*< zDqkX)v0|@@+l_Q86v|PG=#@)%yg5hSOwnh5&3%L#q?5iYH*92?m+0;7O;GNqK7NL! z;8O8Jb*+62p9c>B=H{9QF#JHP&e|@RP%zrz-BEaXc}b{yS}FZyLc+Oc&z_M?5cUEE z{sIY*&_ydxyO0%$C93Mpu$g~C3bUY%q)tr&e2~EqvysMpWslfc4!oS`#4Tx7gkEJ= zOnm)SDTCx%`?qcY2ho6K1$=Vg>BGENq#cD%r`?#yifa}8`ST7BdENecJ3j}9P3t!8 zT>k)k0}jvQu7VxtHKemp6)7DFbV(s=p5#JBBc~)KC9j6dxCI4CfnMpfW?IJ8F%$nR zRS@S625CmS<@<%)+J7iTO23<7XOO<Z(q#Fw=GOdysz_2qLI0o}6tFURW_&;0B<hc` z{HL4GAca%Ds^pYGzfRm{e)RlPQ!sIOB9w!)w2x-P!@~Y{I2;MR$wHC^e4ZZc32iPv zEoBdpkanOjf`nqnAgRM){bn*C1C=6lM<wuGVV%nAbPy9W^8{?WDoEH`K{?-+CV;dl zX#y$Z<Kq-A-D(yUtIL-!A2ok(+wsF5do|9W<pNmjK_0z>pja1tE|I+^Hdg+LRG7W} z2JEP%F=AB>bp?{7y^a<B1|jKFw>XP^OPwy<qmcJ)2QAOfA3sEz9?i3ZQgq<clGGf# z9zFN6!%l2F;D_cc>jV7!{72898L5igb?MTj`&m|AczB_A*nH2bZ9IIzgyoh(kUTh9 zTw-E(XTH-sy_e^C!+p6mHB{*NpdnXo+}I2dJlslT(Vjb(z<J7_Y`-gl$_*-C=7$r? zQ>~`iNRar$ejC7w(aMsgzN>n^BUM~VN?}>qPV^5rSQ~PW5KEUVEG*tkpmQEY-+%pj zGbbnK&FC5kQc_L#W)mH$POjDNJBR-LE+Am3)CR2W;6;lwwC4@Fv8}P?h`+GGLS>?~ zn^Vs&EG&@X7`#7n%{@Fk^3bpDW|+k!`&6OiU_XNgRA_T;NER29mfnTB=h1Kc36B59 z*;xY&u90;;NE}(n7-z7kgkNmjag)spJjIK57dg~2SH!YT#CxmB0<_MS7B1b-F(F(P zU1XgErDGJoC};VhxH&B+)JH<!!B>no>bj;|{b@}ux-2l{&daa1Uy8Z|(Z2LVu#Jpf ztK}LuR6nFy)s?0B#z|`n3+TiadMzkjtC`_n(8Z&m^Z<LK2UGhBN@GZ2?rLIk;;j@H z7tnQ+oCpVIsemFZ(;N`(EjBMSoQdz7j%ZgU8?^Z0*184;V7LoE8*wkn7=;4y&2HK1 z)vhBhGEwUP!m5<FZ{J!h&7Bpnp1Fcgr=gJ#=6jZ#`_wIZ5<JXl{mHNsxKP-dtr->g z7(henaC&hnabP)jJX7V1ktI>m;hS@JU7Bl-B?gD==R3d7*Nut7q7I9UoGhR<?7!a& z9|}6*x5UJsMMeF-12wwbXr_(!Lh0n&Mny#dW=8#KKX?52i=RKQv|4mIudVYt(BHek zM%vKl4nRNrT}c0!KxuFb$tDR>My4GapMZZ5o5A}6V{iRyqtI5Q+>nhH7ka&Z^Zi5L zlc)1n&CJI3=!@+acC1X%u3&&#aUFVzsHo^eIN;bs-)!b57+#o=4|g+5*HM|wM!=ZO z7&3Tf5a~d=93mr6Aiuzop-nD_MSjl)x7hAMy<5o=5)vpy>c1tYU;R`21<DOI4gcV+ z&Kf3<H7UZ}VG-e3^?3ztO)Z}jiy6qbI96Qo>U5!U|J;GC3@Tj4|Ge$^>_@J%ZXJ66 zd=tX&!RUPYe<8xH#EXeyGA46sb<tT|%g`gx<MxA`>>&Ef%ocx!W6txz2K6a#dHDA_ zeUI$LW6FnUBzcZK+GVuxN4Bz(bDQMtaK)<&&L(+rx2B(*4%{7^<DMv=G$^N0|8nN8 zqJPfIy<5k1S$vLip1hrRu)L@G({11LpB4A}Md+HIynp{Nujw4I)ng&%m;kqjXBd~@ z)Tko;)%~4bagPV7zXr&6+{~e&X4xj`5#;@=ezasu{kcQdC;XqB4ng0-`%o%;)DAXi z9P;03sirPtuzXe|Q>M75Ovt=*qxr`pdrj0e{}uXK;XR~8pMUbezc~8?Rn>`jCkEw* zuz`l_ZFttM2JVX*lS!yg+_w;;s`Xd2U^T;<&r9lcor-AF$)_pNl3k@0(TTc4cXl#a zXWj6hoAsGuN%NrlbnrrDo?AZcHJ^*F^>-nDW3rfM*PYj^&jqzr{xG#6EiDb+u1shm z$=+s$8!+TaMVa*8JPbb3UzwQr@%y*rVqZ@W8G~3ua%_^Sn<^_^y>jInnwVBZQw||S z;~Y`63^14X`}YnZp&Xl7Vm$xAl`B^$?bv@Fe?Ey5S5MB`bGsf1Kbu`HcFjz=pyIW- zaL1bNN=Y>n8ipbWc~1;~psjh@eGjfW-)8f|&27)ahYyFFQd}VqK8DHaqr^VG%g5LE z*F;YV1l9+5H<Qt3Unrvi*kSrgY`Xy1xpXSKeFu8W0>w2oJ0>r$`H`0g#dc>$2hkB0 z9<HNO&Z;hW&ywx*U#ivnS8L+pzgkPzE<%1*)zmC_zF}K2S9v5=9kZact?h(>b;I;> zaD?gxr-@w*=fCjg&U>8yb)!Ue@F-DR+UCpgRIfsAmNFrVsnU~BE_j@qJ1I9iF_Fug zL&XJq1|)m9Ek`9|3?LW^B;g?yc!5k0gocJDLb+;kfN6`@%x5#TrkgsESWeJ(;S8MM zvLJzb+Ck7vp_o9+ww!G-Kg6kCbgtwaqy^+O$o_9<XZO;<;n8e<em;3k>{(v(Q976c z5rAeSlw@RPUYjOx5e72(P;FM1iP`dLWyd;yk&s+uER2nf@87?lm?tic<c3$W!`=r_ zHt%Oz>|seSgVI4FwRnw^ei$yeW-a~Xl&vL@i9W|qIHYqkO@@cg8_)s7cannfgQ@=J zJ#Tgi&OPn#e}4OZwJvu^NQi~CHPo6CC}u&HBcxbQbQifH1a{V_^U7#j&aPaoVA}%t zuxnBQSD^wj9zVXWXr!kodKC{Hpsgb6_KBtCW%%=JkFv79L29fDKLNll#E1z}pgy)W z0n-Jpj3bs2@Q54xMz~^DSzVnGV3zcENYxi$L!{haehi{Fix{*-GH&tio}pIh`%Cyt z<U&SD2X9o)lp>inloA)jn>=!(57WNkIXtxHott<5D)s2E1Hz}9mX_8qcJpunaC*!| zA0wb=Vg1i(6z`9a3KWB|2;HgF|GX<e)LuF|i6q^c#J)xJY3+*84Ok7ZnGZKvws!LY z@$5VzC;{CT!Lg`hRcd+qqL?ob%sa4>r0NgvTsOyP1ds(f4BTEa8;0fSjtsU7m5r8@ z2)sa5q<?pt`AFkcL=`|u+C4sg;a-=lC+gAkg`FEYp$%WvR#%pJFI?#C?!JP67pw=? znRGQ()%O=IIoEC6PEx-_?TY6WAFqF`(0=?FSGX7>dJw4V%$YMRGp+ux+rhDz5mO2h zu%`A1jG<)+3_N@<S??h-M0l>ofW`;D?%Q=lkP$Hu6z+a4tv-*&nB!|IJyv2EiT@Fa z+2KMj;3yW3ki}NmBQA7&A~rS`p?t$Le+AvSy|eQ<FaQ*BlYz>s*4fzj9^`W{9jb+y zpaX*ZYyvRxH3-@yA~0Bxyf9IZyU?)XdVZZl&;;>09Uz};*RBOzwA_oR#be^}84$+K zx$&+$F^XPb7+CPP0FOu^HSz)Yn|yC*ICLCxjGa*aP&A-?b*xG-3ahKT`zN-lxQ(8X z>Bd~>b^v-9as4eB=K(=LGS;xHWDjFUpa!6Qb|D1^IDL~1All#8m#Xp1tCugyXc0ka zOfi(cb7w#5jV*o{38SA#Za_D^9U`(ppQ8veDdLk=Wxw#UBj6-U6D1rZL<G<CJ8vj; z<;r@b*bt;}!cKmurB%q0v$QrB{0cpQ)RD=XLMQQ>6QEkXD7{OiPhbAa-91mqE(q}0 zn5aX%5DCF!j8@4JgnSBw_!5zn2m1O-+Ch*ww7}G%Ailj|I(P<@5o$*X;3BD}<F=sY zb&ZaaOh7qRiURid4!#hezoY)Xj@a_2=UXja0NC$4aA3ByoOXO7)3a}H_XhW>*2N>& z?Xus;ZhGQamtsS3=9F&>%t2bCG?3qiERS8gb^%O&XqlZGS3`GrN87HTpb!GZ`yjr9 zm`)){*u8uALO*_Vx-Y=<AeTZqUT(*)lcp&t_JWaeypuw5D^cgRACJBmQfl*4Rnl+> z_1t<a{ept%QP)R7VBs9<5qf%$pFCl>aKR7Xjf_*U#O0ITZ-@^-q`EnC<UI}yK-y+| z_w}2lVt$S9kAsH}={Tf_iRG+!aw-cJD#wBV0ck+NZLG`7%QJeyW|RL#B&0|_a(a3i z$dHMN$sQM5o0d092Hpm%-#mRv!6Jt(GepJ464Hu_e#x!A|B5dmJ0S`I5YRhvX#eWP z+S*#kqj;0x*h!M>PK`8?2@_H=uwCHFS(@0UVmHs^&!f*a(>ggl-Gi9f651_z`&tzh z71W3F(J{-(UaJ1TH>ApxKFoIea3OAi7!~$0B`8N~e?%(5Gd^JQVX@DdMX0B8UliBL z`mT2eZny+j1%~?zR_}Zm`T5*d$=H*qZumCu4a4OD1o08WK-jSd5ehj;E-`EdWMi24 z`Tg+({+98N-9+^c*2ahfuEPnep3%FQ#=^|Wxfid8tbg#lL4aB7jUeDu0y4yJ1RRs7 zhEbGZPkM?G3t%X@{eI`+3y(X0Zh<BFQRz)DHa<idY(E$@&JZ_lVbe0?Jad!}ej}4Y zxuP?(w8rV$$BLb2kMKUGgv%(jw}Oh5p5HWq3Z&%M9x57%$^^%HcTZYXRaGqUX#}tR z?}qK$w&f8mErA&MoMyv!3tSGDAZs{}9BtB$t}4>1fElAz9z@<3sFC}-cMzA-J|3s1 zr!U1b!Bke$*1iFPL0Wp_e~XsKUjS$SzvEOQh_9il5g>zS$Ao5*do$2tdZ2OTqO>&; z4z3I-ftE+F9da9@t1y9HySNnO=iC1u43uStF@dLe=o`@Q@p;9O*)s7v_g+32y!gM< zX$rJ2vu^}iR3<e3)bfh`MD9LMap^GQp=LwQkfB|-8zP|lm=4Nz&BYRF`>fT*PV|Vc zh6*nI&9iY*BB$ok{Nw-vf-uw(NmMm7bcGEd?#=!kK`QiGND3|)8T@3Pv$2r|b|*O1 z>$o_hY(q0dksknjks&)gTsYV690WcZX(xkpkvsGqe<@-EnOfd`I$$b6@auJHC5uLk zloGY~crZ);C@$XWC6<qV?6mz#esuZ2TOfoji^Mf6>RWxIo!kY>X_J0u9zLIGgO90- zD%tSrJwN;*>=M4m?G$kFlDZf2cLJX^w<9}Sb3fb07jy|$gp)pFP(B_yYVI5Yc!YkQ z7gC{M^M5BNKSD}uOvKC8;FkbP#{MyuMFS<J&_m}mAw-;p%0_AllZ^=dk=EzC#h!D9 zqm05JoByYj*T%7|S$a}lLlq%4`pDYoXWMn7ks1%>#4MU~n%kc}Bc3%5?8idDQ$i$k z2Rf`1qH?II%V=QV9$u#5(iX-9-Ig^=8cfiV?<VUV0&o2O^XE$_MFV$&@|_NxLjbMz ztCF~`F57=Z>vElH-kcDKmSmSQ3O?W2Q}G|9bk2ds=N0nc->S9vv5eH|+X)p=`@(`6 z-_9l{O~WjO2n~cYLFM#6j)!5vU`1`?inw|hv)=+*Wk}v1=_A2jUS5XUS&TibZ=eQ| zA>G78n~+zEnKY_nOlJ+3u9eYcU%O`2aXB}c`{Y>*n|qmpHj$+z<RzBoj6!Bl@BeZR zb*s8CHL!jIv0=Qw;<%?+xY_2xtI(2#%n!4^z4q}K&KO`Ogha~6_pKFVJ$KH-)6-LA z$PP9)EK9bEcbOK`o?6yk?(QOJsv)zto;=~iRNoMBW54NGcx0r9o7=d^G^3zk5Xw$a z{+`VJKnq19eN`hz-H%u2)A!gq-APJcf@Q$-Qz*~lpVU{KwDN9N6%YH};l;3;A-`o0 ztAfI^sF4POm=_2JaGF&^K6vS^g8z#V@t=mozkl88VGyuKmQOCcd{O`4l-qR$b&h{= z+q+Sl-2COPKAuR4W?x#d)#aBx$@LrF-rf0m>F(~_b|d>u?$8`zW@)FKl>aIL6^~5w z=^U63-@I)b>En9rNIghkL!xEM{91(Y1RUqxI8R=Fy!`fHUPH)`%NaYfSq2;gX_Trt zI6F3~caI1w;sV0$L<oc26|f7&=lg<5bOd@P+j!NE70$x8EHbM2de3n({Q-591pDMh zmw1m{!|95&102ewAb8taT!=SsI-vh|&$ba9f!p?gwEq;6iJHA~?Rx%xTH)TPkvlO( z9itbqp}JyHTGt-s<MRb>N-!Og6GV<thIJ^qAJWa0>(|Nj2aqEL-Jv`8*}C_Be%}3b z2TtGrfHJo?kjFmcepGuCg;U9q`HzBdwpd+CU4g(cgmzrH6St2;90|6IW>D*|nV4{y z4pu+x{P_k!QOe{0t+O9QKL(swvt|ugC(P?#_YAZ0-=9^hM^KiGnFR3eDcX@v9<YFq zg6#>)h<ndPa1;50-Z~Yc2a?$dz|`x+buv#S4E1hJeYPz>uzFr@?$bPnT?vqm@D_M- z>cHM)FgL|eh4b9GZCPcRb-~Rl@GDx0Rof9Wlr93{y?7oFfyfXu;>j-&*I1exCj(2! z+aM+O3*ywIzO*0L8z4OQ4cn+6sHx?Ff&#!kZpY*VxZb;I(<a0b!fiPWThjA^1^6r{ z7+qXkfEs)diTQ?H6Lf9Jm%}X?KJY85KHWMFeD~txN40@A3Ms`{gnJGQ4lh5{YDig@ z$j-t4;P4Gryc5p@;S>jixZ@1l1T{<Fe@7@lyZ+m;)>fhw-9qN}ZC?Rv9`e`>^rE-$ z;-N>c+YK3;{OH(%e`jY4fBaaB&JN}x`uOn~5HJcEUHkNj1(<*9hr=@FxDiCh$dfN% z67f1!%%rUMa?3tm+y)syTEB6lySFz!@j1#|ufHL1g*s$l0^aqLq1scbYHC<nD3lLC zB$1jRKM#qJpqMo-|KA)Fii9uc21vVTMVApK-=?RfrDcqB6kx~{l4>GFatf9Usdhqk zBY_(Qg6n%h+Y9*oHq$lo5`F~N8@z%%d;!TA+u~<=xhsYR>1{M7>zCmE=kKo)q#Zdv zD-$8$)|yvGWdUc`wQEa>n8^|zA*4Q%&w7d3qx_H9{3T_<hY+nv(`IVQ1l4fm?%ji^ zN=%-2$k2lyK|lwvsmio8rVtQmMWv*Af%&0kyu_wl_s+}9UM8v=ScYV7P%6&=Btr^@ zYTRDrb{yjRMxe-Ky@uzQ;y3_AX;)cYH~^xjhU#s!X|-F_M@dt<XIMsY3<T(?b9i`r zE`E&+bxrx5l>Ph@hg*bze+sj0iN!fYBX{H?-$2?%SOM~l*KgVcq`58^kMHlq1lj80 zrF^)<29y{Mj6|7FKF7%khHJNEfmPZj4CYBDC*Cz3kCutLoBB9p<~|u;f#ym9+gX$L zOdDhV@6;4~#i~51{4Fhe>Fl;-7#})7TxhMTy3OwsivS;LbQ919G?RmTPZ&}2KU-Ua zgjVL(J;nZo^NI@}L;XW7-wFKmY6tBroI@i=G!#~RXa}tJ1+(EIRAC&>HbJSOyI`^z zi7Wi-L5Td&Ux3fZ+eWr=Q!dCioCo4=_7fgN<6r__%FtI;4PBna=3k>-877*o1{KyR z(*TQYH9IPaF7U?HwXexArw5xL1pFM@2?h99sXZ0Si;hE$X-H&b<Z=o`wwbnF^cRJr z?&z+&L9t!VxeyCN{j2Z@QEJ|1TZpU#X|F)JDDhDy{*iJc<*lUDp}!-{bL#H`_79mn zLS}O#8OwuGq&=IFo{keV#Smyf@xSAk6^_Or1yzRUHV-YFv=Ct<pTHTPTOY4=fY%|B zc=pVh4@eZ;RaC5u*AR!8MD7V3z*$4~<NzTe2*L)TGnw(Y<9V|DUmesf6#KnYRQ6d} z%jaU}p&6hftLf-$>E2jQ7B;`x@KG==SP|>~!h?~4XMEsH)@D2lG!P&lsSsC&%DTG3 zl9Fu*-vUSGK|uN^&|mw7wdx7!ly~+l-dj<Xgg1ihV2GJ=8-e>sT7+VL7XT7I(H)pn z*fOZKimEC#%uJFIkpa8@{u_{~k+RvC3v3OhkCftLbMsBPd3i6u;c$iL05&s8xSlcC zHFh)99!=~B#O|{G#19S)RUwRtT|*N2M9c1J7Qx>*Iz<4J#l!PQxD$`89b;irZbii& z#CTw+0aI29GW5fKhh1~udMEY-`V=fs7L$xHm>o#XpCWq<d=yN;N9)X=l798Wyp3o; zpX6d_Fv3{Jw?6r&;<LQ0q}5Lqeuj%O=Ic72W;Z~O@PZ&g`b$&oa5qeb>)oKw=~&O< z5a$_A&d$}wjLEr!<;$yGW4{<ZB-S5`V#3L>^{1|izkK!SGMh@s!cD6ux~!(5*|K8y ze#|B+$|kaTzo>2ethn#0Q|(E`$UF*#ww&}+_a;$A^*okxQj2Cvz9Pcl_FmMEnA2!< zyE-aI?5(Mr98X<+Z=Lpah`!fjwz;V})#x(#p;wKrEKbsJne^YZw6gk)j|R8T9qdy* zNwEgp+;pT-)?GdBE_UsS!-6(<akFlWg}45^dl!7<HT~Ybp{O7Jue6>9!HPR~>^Su} zlOt=&U9&78N-N0nn)`lg>R#STi%0@!q6C^VQcX9-#2mw#b}5!;`78eOLg+)c5!a4a zjClh0%4+x)lvHlh!8_;-5&$()u@GH!`?G?0^!-47E(<JARay0iIKYNIKhlyR&+H+J zC~<X4n_aZ4;KB{LXjufRq{g;UC>D=>rGhR7c8#e_5<%Rl>T&@yBfMXIR$|*Xx%8nt z6KYMjE#>=#!hrI2aB%n{_b5mMDn`29a=MMJ?Ie4K)%0ilFuRG$tHnTGM#kO7#>R1} zgadZ5n~#sY+al=g=TgmtVjqs+u?eWe8k(BLg@q@|<KYzlDk&*Bo6N6rKvq}xbFl}_ zkF5lzh2pmd&$8!xX$voagT4E$dGc`ph0^}rXmIL~Mp$Iq;%-*a;PSUspY82e&1R}> z?=44A-gNo|2FCOSSxW(CTHzdnDe4|}{1p^b(QE-dh4Q!kWbN)Zn+l;qQPI*yBc)fY zo5XhJ%uO69TpHz}P>7o^Z%`;ZDF?l283-S9t#uU22NREqs#8qwhYTC$3~3cxqm3x| z;d)!@^uF`@tNtS0h9h+NNse?t*+!3yAB-M$O*{VWzfHtfrkYz~s(#+(EnkmsDre(A zaiaXm0T0onL3z0`pJ30FSb5PM+bCjm)4OwD<eE%$56}^-e))}WM!c2weD}EXvF!51 z4D0Q7D^VYr>8kM(#dx(ac6ugn!!;j%-rTijsWtF|?X^P#15Cz@6E~Mw1BC*^G}@fg zhtl;wyZm|9Qb^RqD+zCTJG|oM?adrr!<Nu+zwz>#$Gf~t1TyjbioH*r^!POu-9&l1 z<ay(Dru$>b)2FYVd~o_Sb2ww`nN}#ygRNN^T}h~Zj8tyOW(w@oc_UQ45M?XTRJrYz z=B$<9=d7+++b#@5UU=O8l#!K%<px;hXGB!K5C}X(WBcS&vs=#$N4<QxzHo><iV1ad zVtV?N_sVF}i69FR95#iP9l82=mF<lcizwiM<C`}XP`)*=yTZi}WX*Lt!6%-R9cejv zZKyubRMef}_;IQ|dv3M!z;DEydyk0Tcyytt!1~eAXK8WF{QURa6E#W*YW;@zt7J$J z6q#z@KI8JmiShAUV7Q}}PZOI)9335H@J%8RJe&|IYzf>&Fr%np*0eVmgsJr6QaGG{ z9n5@3C#NbngR&74ha}&h38`OLck?39-e;U5Kwk42q@*e+4PJhJpUJzK`Ln$)PNkLz zZ;nFT)!xA4-MbG^ua+Z>WOhBvux>w{2qn~m5kYln%%BP+K^a8>oNJM&_=*J4bbrNV zFlCSE=xBF$cVHn#1hd33?k8qv<<a@4p#dV=sG!@Lnby@b3}jM`Q;%L8D#}Pa$wA=X zf8anQT06nU$EN^NC5yJdZ5aDaX#ozs$$010nphPTfC5=u?66u&gI;k_(Yt(AHzy}2 z6h$-wNurg=R<Vd$b=V)^0<w|)dS3xsrWWCip3%{-_?*h+f{R}maVl70Vrr@yV|wbx zHjYmK?S7mZjsO-X;Pew$uU^IZVXOIULNh_(>({TJ@2AB>JDP5_9{Z)4po8#8Bcgi{ zx2fppz99EkqMM|PBi!T<k>%gNe}DJEF&w@$!D(kyp6OVt5{PT1yozl&4yxU7kB|=j z3Za$_1Ia8y32BmQXyl&0zEOB8hc8;(B%pE7oK<~^*D#A(4TSqtBM}?}3mx#F4!Kz_ ztui_=Z2rUc8&~?lXP870XXW&jSf~nK2?LxLO<5;rVv-0`h;hKI{eIe$a58BGw)#t* zlT}bq8JnVN8%O4coR#TVv}Fzx1p|Nc#byL`#1_(Am>3Dh{fhgHduqc~#BSX9Lp~-r z{A8s8UR2<4M0ZaQc_aNOtiiUN9N^$Su2&yE9Ig3u>oU$^x|6bn^TD$sSotzzPj9Qu z`$wPg?e#r*?ARrch{kN&jM`Y0SR8?dZE_nzOBJ-HBph16mXieLbR!sXRHeA4MiyI& z=7Py52posoYCYWDO}YxoBi$izhCwQB(Bmnr_zu7rqmrWx**X!Y$Yr%v049TAGku1F zi}A)?K0t@TgOG^?+>1L`uDnD*?E|QhxI6e0^MF|#9(20k%A8stpYb(dl`6moA{ND` z1IFQEG=>5;%p8A3bKc+!P+1g0T8asp&H%0vc<v{mEVs>quHFLYs=^pdvKUu29c@<N z@s~u|C;~-8>@<PqGSZrLk9-X{Avd0$Euz0$H*bE2odV?g1>=Qm`scLDJX2Cq))H&i zP9cIdgsM%qoQ#036b*PJ=Dso+yjo<CQqt6P59Y{cd~jHoUs3hWbbK=KEj$?m1+3-p zHpZC;02*c0)x+ez+zkPOTPaxO%YE??cd&KG4q5OlZi~MUpdN~0n|m=vE-;B=Ho8<L zBWD1kf$(IO4*G&)MLNJ<3!P3JTa~=6H-@tWHzAfJjuL5!VeVCg9|m=?^F8bucK_cI zDC19}9?Xu;&azlW)H@sCwItFHq)^O-uNTz-nVmuChk31&5F6UCetoyKU+_QGvCZxH zwYN9%xu~e9!Y>goHnK7@UI8Tgd@toIQdu8yiXjS*w-Lux8FAJ?(((1{n>b&32PYwu z^qXoQ2g9?|ZA^?}rxp*f<<_geNj_`|iMIfFZevN@0F-q=A|K&y4uXDJVfFEAJPI*# zqB6dm8tOd$Ng%t^169}2+T?`^;it&;hk#V_HR4pX57N<5pa%nBC7)%&9m#`GN?BI2 z@N``sogU*tTrF#5VaU<NMGhA0{ylq+LE4y~o9hR_u0{4w76-$WQXgN!2=`&knk?f- zQ@#!T2X8A234+8qI6_phOK9l>^k?)Ef{mB=E|`7|6rI?}AS*Hau?cb~!jr1WwzUov zB9zHLQ1Eoky6%yYnD+Ju8#Zlv1oy*boV*1z4@Xy5dFcN8_wHrDN3nnPie|-p9sM0N zGtwPKJyatxKsFRSno6Ml(R6)n?N5+q@yJe1_Y)PDF<#hAeBH`N0!_cLaNly*t@|2- zqQ4LUB|*%6X=w>fjuFS~@SMf4r#bz9W73i3{4qzxB?NU4f0um$e_lc(r71}@e=GJA zP<E7qa0h*ARRb7#8Z4DqwAd(6QT*}~BclooU9X^^)1ng-#DokwzeYlXXFveEx%uqc zrjq4k#XB3Oy#SU#uZQpq$u6=mGZIaH8&^nQQuPYc9-kV4dVU=6y$yvv94^h|m)R29 zR|pGY#QBX`gf(54FqWPMAS@{_=V%*uJ<KoXdU4`)RVEfj7j%bwh^mBY=*oOK@fo%q z+r8v3<Q~FV|3`4KNcil{t`LfOq0<nr(U@T#i-P_lEjUkZ-a9vLyoU0{jCHZMw~qqc z2DA3(F=+k-vpv^nf2Ys&<K#zybEg#m`6Arz1?6!LY$I8WI4XMjuLw?Pqd5~>w{B&d zn4xyM%HtpNN8_4ciaDFEq#njjP`U}?l96?3Nuvf5%pPQwqGDm`h@&;%5*A)D&$+$p z*$=NGw;PWRshMA=RazwvDpi$m<a~iu4i)z{kasm6`Tm0kKOrnygYyUE0^s}}Sz743 zgT22Af3odV?YRKGaT(0iJq$)9f8biS8<%WFD^a6VyLW#;+rdqedqS!y2)z?4WFAn4 zQ_IzW1$1rc;Z1cHdb+zmVHYXJsoH~HdcA*-lYnxpu&vu>f0UO?BiKi_BY+UhX+F&M zoT9NlJWzt%7UVDizn24qU=qdp;4dFIpy<f?Hovei2(9sg)zl|kwg%)SYr6K{1)I5V zn7-BE$w*n~pn`NO!`{GP{fO8C$xqNj&E9hJ@W`P%lOqr|%jELMN=P^)Ou6nt=f;R2 z;isZSVx4D%`zMDsn@MMKaANA7JaOVW@JS`Muq=EvL>i<}^<q*|a)>wvCF})EbZarF zgF={ugKPqjRqaoon@IcZ<?G9u(PCHU_r3&uTQh+#BEvTAysw0dqHi$lH5LqG*adEo z*%Y+znTOJ^6*}p5+>MZ2Hzek+dSJBrvTX5z)K)L2x`5i%Q$d!!hxD6MZ^0$5h8$>$ zj3V}xB-#+dfprixqTp$MGHlDXT3wz+Ih_WBulX`R`JxWC%!fK<Ye`5Lw@?mFQ<5CB zTt5SCQ8c1Z1a1N>u*rUAM6Z}0ZE4aWn((&+qR?|`_@0Dy`Q^jy)4^XPaSubQAu%5Q za7HDxQf|as$YJMBb`ycwX5)F60qD@x*quoazOMygBKsKXjeX*yEA}F}G}B{kZAM+L zIXOAt*CdX)di{Ed9?uY>7jn2PLQTrfGz7O872BPg*RH)n%VBoPXK>07g@5}Qb_CgI zCMR#hAi{l|ysiSWUON<<^A(Ty<niN|p})vrJWRg*RaYmE7)CY1=G~*C%Kb;!+wElb zPJcuFHRcdGn5>b25TY_DtQ!1D4d36I<c@_$^clV>5yasM(Gu>dKe%!=JfI}Qww13X zjtgmCc3;&XF4ZBIw=L#PnzG%zMr0lNuCRc&Hsf?H0Z71l@nW-)<N^oDxiL2sGtBg} zwJf(@7Fcg5$B=XPxagwUiu~=+>_2gr`zDvov^jn6#2Rt$ply@<eQ!1GZUONa?J_(( zJPHS<q$Z7@Jc08PhQ>RH)Y5G!DHq`S;{!A2+mXKd1avnW77M3OLqj7<uOZ&vAlTg< zUElTMcW!R(8l9%<>gtPiEBk9BA|v}^?F=-*(1Dfx`#NVKz$mbLU-a1k(<d6&$r()Z z1|E=|CnkEv()F#Z(ud6!mD;4Sax&9rPMjzlS4f{6?ZvO*#xB?vVE;s-8JxsJ#%fK> z%$%-_zkhYPc_rS3Dv6l}tsiQR>;ruSJ>oH2YI2BGl^Vh6-Gn;Rf)lrUb>?*NbVEw4 z*B$fuC&tDl`v$|BHe`I*mi`;4yMv-|R|TlnUipRZ$(*&PSf!25$gpqKolG%M`Ezih zX*G1Ahjr;kw;<>GIRVxvE39F6SC_|F{107+2EEgNCzb2tL+uQR2J>5wLT_Q?wNZSr zh`_))7?hx06|n|@9-i%PMQu)SdDBu;mm+puq%6@ZWm<6F(kS-)b$&Bd^6)Gpj{iVv z&8YzdE<9XAdHYLXujuRb6pFB0&#R(MqkL{)(kyl!IX{m68-@ONI{p9W|AVTB3*ZAh zHq1Q8Be}^uh-KuV=jZG9>M8<aU-AC7ZeH|~q4~XhTu@_Bz|dp&7E10q=E%fNH^n6E z*{u^z^#y8s%b9q*7xS|N3r!zfAGe7+dSxx;?^9NGiRD}5KQ1hODhn5QyLWc{<#awZ zLmKm5yxXfi3~MNq2M3SsrFcB8q9ykChkWkQFk0;r*z?DrTyDavT6N_3NTXznL^)fn zpyNKgj?%qn{0YB4pTMOdJDYp_9Fnzlg{`;pdbtB?=La3)9Ho6fD^8!}Pktlq%N8uA z5m@`^&zJPh+YxMG;%cXw1jNQ!ZwE$5o+$9Cw`-AvG|@_*dH0!MUNz1{Ruge$+P_!Z zAN6!EEp48?r(kCK<(y*Hb7o%sMaf}1fzf40Df+a2uGMgZ)#|#li*&I$O6GT4{9SL~ z_<errW!odiVNRt;S0#7Gtl2?M^5s=iIW1aZ?&&;-qKOech5H!><gHS8<5DvQy;3rC z%$r?xl`K<#(B_1{JSVD4v_^bY3tW&~2@|txEiO*f=}-OY9u}UE{L7%E_QUEnW8E>L zZ8&r)Q6fJ^fDt-MMwiPc$(lVbQO0?MXa5RSx16_<TgN%iAnzzsq3oDB&nUk%&2K!h z^FC(!3*X~fQ-*f_s!^@AKPPX>yW**4Cp9zjfsaA;E2lv>@zSV@IIwBT^_dfwx?ZZ; z38{*dK4#WWm)AKHroO|;dKyg$+}aXaw&p#T3%N`!!_;hM_lYo~Vme1Vm_2@l;V;&; z6vq$!@Kv84+8uNCb_#Fpp$W6pugck9r9;oNo(X$a`t@{tQ+(2+$z6l>S!rql=baQ> z1#U^JoNnoQ@1tKXr%4o?D)jWyIa#rMvM9aB+RIC)ir;vFtO+JjQ`&i*@#MOi1rBGr zp;N&bN`y7vm6nC|Y?>=lkvx9MQ6C+>GP#U?PS`BI=duY84YmH<vdZP%P;)g%d311D zY?JL$&u(8O!$Qsj2~PK0N?lmZSC)HM=%}#ixTESg69=5u5nEk1SC@%<a2t<2*kG#H ze%HXryhcsBx~kGOMW@4oR^!RpsM$X!m_(~q;;z+lQk(YAd}16hyxdr#?yi}WP!?xf zC1;wX-bd@AGnE*`l<{K2TzPiz{>t#UX7=8-b$qr{?mLHhL(0kpzZ#Tp8i-~Z7Za5* zW>2|$e|of8(D5E&ed7`Jm|5dY<-9u6iEzFRl}maGlN^$Cam{C28p@WRW8YCG4%V25 zT&O)9!<5i@C(@2eQi(pwXJu7q&@OK^G+>y{mPg+y9%oTfCUXY4&)lsXd1u;DDmzWY zcrZrwIelL!&#n^7^6t>)pH@uYX=DE5?DFDbu$bMZ$&QCa60g$Y``~(Mv%x4W|B|LU z@s%~Q)nQ&a*^0?^I)TMCY}(D4tyWrp_Xf^&JXg!k$na-uN!pb|Lp5F0l|*;@ce<Bd z4?R`v{}Z+YN&G+F?N$H)ph%Jv(=`3fwVM9sT79zRRdws#N;BX2N<I2NAs4erUmtr{ zlH_i6lf~UtkF>0%!+U>D>(i;5^v2|8)$+;u@~K=-QT;!0YWMgL37RxwWohhEp&oBr zPgA14P-Ik?(;ewKIXN<!OuCt#rPZJAmbXtC4g8;JlB9&wSGD}(?Rsudh*Minbb45S z8xo?|o}VYLavqW-Z(lFfYg|p+HXKq|ua-{h=k_5<0gqN!=bnEpigQ=*364Yp001W~ zLh5OI!u#qH(L!z(v+6xkP1S1p>Uv6snzgB`@;+rWXW|BZFmk0n7`amKzOqE=shN8D zt#C<F%=}%tm1S4-(!VPuF-`k-9CvEp?CK(StD9pg?DTO-di;rc@~v7<{}}kGu3We# zNjmYv1w9-1p0<CjKdeow56Io!P2=bH(JN!a^~%_AjbG452|ry`{I;Wc+IwkC7kQQQ z(2obsI_CX-)Ki)?B1Um*|0TOETQ}3Qv~bEs_4~^d*=^a9B)ctJwp(_`lsjLNY_|O8 zmj;eR0ssIf`?ep~zMcQonCXAjKmHjZNlH!5(5QY3^u~YW9!gEl(3}YyoVKao<WG7o zvYp(mZpzHKrMNHurH<X3X~n!9dD?H;E<igjeBgMUl9;By)E!;CJ5>Z8o)%489;pvU z$10-DBqb-Mse+G}dPWB8iO`4Dr~PF0j0{$z=Cz!*>;6KJRxQ}2kS<M}=DS(UdT&8L z{k6?R$Gm^wrykLSPy6Yk@$2>a^YbO$z8UAOnGuc~XlB2=PP5<r`5Mx|4gs3Ja*!k` zGHixZAMq(u@7)_<km=;f(>ebBHA`&(007|Lcrk364(>d0Pur|s=OJBBPS>@oH|}Y> z#pTh~bu{OzAx`ri_kKkK-sq&ikLq0Hc5-rZl#)i6rV0<0z5B|)QhHjZTwF}@@U#?L zA0JOxuQ?Mo+|#gm>hu|9q^ENv5&!@c?Cgmvr9FgFVKSMDH9$&|r<Z%NwqM-1CX;c~ zCOeP#0RR9Gytxy<*4&9-m-a9oD1=A=03HzS!XB2CQ`*BQRkz;*X9M2oR0<<`@bQZ^ z0000evfN*+;gf;XE0fT|50ie|4Ql3+mUg4G#{d8TfZvI<v>WoUddMZ^+I3yNe5JI< z0{{Sk``qQrSCo=+P2T0p$#mi3#heQlF3WDW>-zQ7(jFTC008bo<;$0o*~LXws#cQ4 b%}xIgtgkiHvF?MR00000NkvXXu0mjfI^m)w delta 22125 zcmbTecUX@9-#=b9AyhINMv+iT(iD|wD_T+!l{QVy(<md7wzjlY($)?w745xf@4e^u zalSwIeg8i9@x8zIA3w+8(3NYP=W9HlkM+7LzpkJAy8g?H$9DwXUVj>7=39Mo=ir8o zVwdf&DTuaiwBEMI`g$v!?=30WAFXCve-`%)Y)x&IYVEufPkVWTvzcs!%tNiD)(1a~ zX)o>lc876(<(r%2J$HqR$zw}1o!-`?8FPVxZD;!g^)ilnQb!7SvP7~HlDkeg?GoK` z*h2T3=6;=Uy@yLTPf5OV`}y<di7#66^3+-9WACUH20As~^Vm~cYZa}mSxED-RiCHH zDNeXxKukqay6hB>t8~=jc7_p&;T#s;`4PS4;oyDyebrOxIwKa1=R$^C9G{18unb-L zRW94#*z(Fs*x$?ir_-)$a+mHAa&kM1i5&5b<}`0!-=~oEDr%;f><&G7KPjo|o_=&o zex#5Kn|OvgpCy&b@7OP<*BH&cHqIVAu)i{1OImx3b>hyP=~r{%w}!r>$t>eyTUiPX zO)KiJ&;MF-uOFR>*49X@<l*NZ@0pGll2WWOzaL=65xVQ+t(zYUzS1f(>x~mueG-L{ zcHECQTzx5j!mV?w!YFrja%1AchE>7i)%h99?gPQw4^e*PEF9<K-*NPA@+AAGU7Uq! zV@LL%Su}nwKd5SyIp(ucK0D@ib=Qdk>1!P3M`{$$R@Kzhm>4D{*-Y1t7t~O8AFQW) zXl0XJU{g?3)HyhKQ(z-UXhDJaTV_H;^Rtah!;dhh;(Osbp;2opbV4?4>{|X&>q`vI zol;G{d&EaMbMw1oy^5l`I`8@UdF>j9*(N;(VcV2ShtHoshliKY3o2Y-iuS0iX|U53 zaB#lx>Y-c6Nw>n+^j(94pH>d?8tv1o2zK~vzI8(W#we8`k6IIh$RoeIdAB<6$Pjz3 zJ)&q@jz3?;`EB#n;Njt6?h~dDZ?Mx*Qd0H=Cp^mO?(Y6_+h7;-jOw?w+}0hmj2G*p zSDydwb8~fNJ#yq}bE;voVZ&$bn%p<GECppAK|#OXbKQOU^5yNm-$53GwXe3)9DC=d zHqW4QSlqGaLgHXi&k~Dp`AYpGfyo0_JL`$omzis#l-)H)jvV2$8s2A+>K}H+t+Tt^ z$<2*AZ*5i3-QE3>o!$Bj*SX^%_TTZ|Uy_ov2dX0i1uVB6Jb2LF-u}UZ2Nxq06K{W8 zH`tI+@jFN`F)dBE)a%51KR+(R`cv9>@9sZmK#Ti{zQOKuTD_<#SuYXq(VU{sCn!jS zDaNQ~KjPZCb7$+<hwD>s{wiiB-aLD@o&q1t!1v&>TC#4=pRALsZ{-+sMXz3Dp)j<! z-pw3P?!MwH#rk+dV}|*04i1j#;U-TE_}TlFhiJELq)<uF)cO0}xi#B{hMu0@!^0z` zc%&trnjnZ;gL4i`vku>4X*=t}ud$sW&Ya0_Z4JEOu=r<etYT$pE=Dn8+v@7-a9bAr z<DZ_#YeK~~Q)FjnKd`dW#fZLt|9*U;m^s;D$?A8oaM_=4&urFK<|z3r2Wd~Ld}d*1 zmulHLFfj19tLsOp_em~Z-c5%N9eRu(Yog?tzkmO}W&3uP!-t<xuHQ7ix-@q8_94Rj zLt$)8tKE^I+5|be0I7>63Eg#6pA>f-qQs@@{SN%QGS_ijNGQ<Di*_gT1(~VdU;GdL zP|S_Ct^d=SVNTwmot>TT??B0w#hI<t)Or|rnIHjgEbgSFBtG-r?Xm&9tUNqky}tsI zjazsPYNNl!sU>61@+&H+T_uQTnCG;#G^3^@=Z9TIe@8}s%?vgCEG_MvpXjQMR(M9N zEp_miwg+PT49gDE(u$Y)oYw01FYHixozA##s75x6ahQm%U3b-0;zxbF`an$-wQ+OG z;j?EwX^zX?pG#0pe7g7a&0Pl$ls=|h|J8PeokCw<zdYc)8$N9}0|Oy5GgznfXPfgQ zOV(q@J}Sn1wHi5KSRePTsA!YAy860x>t4FL>fqkuZe@79d$;SzQS-dvwp@pU5sH$x zZy$0!aPE6Wg&QWS3)6?qASo-0_j!(AoPF@;qSbKYC0uVR<6d1|-Q~rhgo`G2bhw9D z<#;~(`7@U;T_WZe7n3Z9l(9y}=jI4MQ@350rDUZ~t{qa;(xQ$^n{B?xEw4%8=kZ>u zbtU}BTaFCe<Xt_z7q4DzjaN@UhR@nY$6gtBh1zj(;5bE^X~)~BsN-B*T;i86-!V4+ z<$m<aOE<UTqN3+#^?p;_zI*rC>(^AzpFdAAZrSTC<t$2s<`)!fSigR~mlUh@SbGm{ z;SH1U0V*o0*4EYs=H^|EiFcdLr~9j(ksp&|XYIH=amB;aGs9-;7(J(ExJH&0r~R+a zF~jLMpBL6i&Yyf7cU!l7@7l8p%l4yJ-rl}{|0)JRfsJ;0q{Y{`C5`gkyLb5*o&8+e z8!#q3gi+%=ERFRKIt#W21_eE|wk|FxaQdu~mD{*++l0$DDyqBKsBakfJvLJ_eX$r& zq_7%mcMS?+#AfIktc$IUQ#;#X|Cd7}^R~9OXjhS|ep3=FFE4NHCnc%~#h+cpZu~Zr zEOK&k76aAJE_5fkE&8ufaA@Vq<T<Wv*}9dIxV^Tz!pG0A5GJt$CFo0fdLIUuEH0RR z$Auo>N#eQ_8>QI#AHGvxCZg8=JZ^VL9+g1%d8F6W(h#@Z%;4n*56;Yub?9~EI#>+V z%VufCD;uua&JMqFmHk#sC2aHgc+U>%-WB@%#>TIe&Rdj~l`V!F-E-{bCcE53i0V9o z82R#izR#BXoqf{g$+CfOw-%;G&4bKa(u~8y!_VlH(jJowEP1ki^UF7Hy4!Q?!XqO; z-e8|<OSZud#RA~85Efl#e6x@1X@34i+qqHK;9$+%ij`tFX2TYzBG-d8k+MHk9`{-D zbXPSr6xY^zVJo-W4xL7kS5P1noSd906SPE({ZmqSjDs;J+nF!i>Scee;_>9kNBgH& zoiBYenp`LOLgL&5tHg$#cMN%&oFh3;ryA6Kyz}EZYI9Apo;<s9+*Ry_FNukV1qA~z zeUrZh$F3!6U&a)v3};MFPhXXnKYsl96}z{UmDf-iUb?t+_Jt6U#O2p}otautop?=J zuReOj$Hc^>^Dw59PWR)fW$7RN`!)PBjBe*1HcAy(ud}f&?;eWI3(V?S>(N`dx8ko4 zyWaDgA9Fo;UbpxyV`F3EZGHWp@**ov5@CmVd3}Z&64qB{+n66YdNjjgV9z_j8L^j> z;c>Tb9MgZzZ8faQp>gYL{%Bjq>lQ5hE85yeP-ddg&s1;TtVWsI6H@W>=PRt^2eZR! zNy*7gS=O9ew{ERX&|-ELeS(dao12U2Flc#&MPuIgn-ObO47D-ldelx_5{IX|3muW+ zd}4yygYv5MuM*$fxaqMDW>ZsB^sSVH(`rc@@H1X}#nx89#Ka`Uq%E^?s<EkQV*IZd zxrFlaL|)T#>K47(-^|a&>@d9>E4ek(GB!U^)}JR-)OlNNtcrYZz{+|*CGJp#vYW$= z7IFF0uI%;RUmXXS8aUgI9wmfdN1IzuFbqYSGYMLc7Bn^Or>FO|Pna8OaC4@j=QiuU zs{6~oaCu=$Ez9b(Qmpdjm~w~y3~z6`_V#v}K)&5~?{*!@+rCvnx!EdOzPo}xMn~&h z$I;GUFHcV~Jk)OqU8U;N)7331_dDw+Xw7k2J*}Xu?DfJ_UrnqE=NrP+H8C;q+wb2y zuV1gRFQ!vUGpPGCQKzECb+>5yA?tgk4Gr|>=H?Xb4s#myacV!he|n}~(q5V!$*`N_ zz%D65B}Q8g<TsC2OYWu83fZM|X>4((pFuF|BeT`5n|ri9Gv=3!J!r1KUTzXIr(&H6 zXx3IM%q}mx?u9NS<9YNA9ibQ@<-C*Tf=%m}J3r>TJ>|ontiEu`@h!-nILL24e_;QB znsa1gjFR8su9m+Ge+6}v-<Frlpv=YG$}oH4V32yiRU*uI-ieJ<&F?^NAXEA3mkuf+ z6+ZdP($@v14NBi6Y`T40b-Hil^`k0*4^{WC%E*M9^^{)T6ewR-Ue3b0k#(cAbeU)N zn==REZ=Tz<<AAv5F<F+!w7}g39UdFpIiI+?%6e{cW%aC#Wb{0fzLn_acNg_~Caf-> zXxVnyMAPwcuH#R~MRF0EM=K?;uXGRr94i67rTosjL|=M%98!GAZPiunkn6`-v~*pt zsyd!2Qn$!!{J6zyFVFRZUKVl;+2!Yxe>}K<W4+*&q3RP~fcX{H?GfLmP$YLnGeWIJ zAZ4iCsZ{BtkAeKXjpj0Ue~W8&S#&FHJ%SJLI_XDqLVW*q5xJ=6L3ELHGE%1>Z>Vf& z_>uB->$%~$Ya()-sZ-kyJMCgUd?|ca&&5!-tWU~5eS2|xE=S_sJkLb#C%jt*hk?1% zmdDO>1m(zD$;mxgS+upS{jB2pmqy_B9UTyhJ)IF%_mj4&*}bfJ@!7-2NA3OrU%8q6 ze9f+nc9KTpEfw=k!d%=wFW6ra&pWKve&&woU6r~<pV?8~>hv}z=zc?(B)_lB7Rnx4 zaa|pQeM5<X{+6-h66dCl)DV}o-rl*<pkpM^?dtxD$E$ND?ZM#Q&w(m;Iz9;WvQZ76 z=i&aKp6650F5UTKwBtdaEkgrGo1WyK7kjR{G_(iDM~w%}9gS}rQYg&S4%Ig^`%^Zc zZsQdm*;mQib4&EFct(nNpIqx7lWDQ1Z_Dj<o6}?EyUMF#Q%w5iMQx59BaUgCn7kDY zeH1#iMPcv%N-+lF=@Zh8J1%qIo^IJ5Qk&Rl(Q$goZ={3S9kcBF;a0DB(I*e7WqTn9 z2jM+kOd={5)YR0BTEDsj`gZ;Odnw(dZNBq0=e1ZW=501iOLJpa!m7N8=7j>0n*WVu z2*}KhPfr)r)zPV_s4UKolmU5ZjkaclwK4DB{VmgSNORo4iOqrfhGf6@hqg+Uei7?{ z#77g_#w!mjEp-~d+zAx6o6Y#G<exj=NrhHQF+M(ih=b#E`IJ|htPtVWU~uQxWKY?` zLSM+l)KnLst5I{xtLbTrb?etlpLWYI@ACjpSUz_+_zE~7Rph1#1vk3ov9h*{Rh0K! zn@#&IMzJS-IJJJG6{;p`Z?qh$?+J6eaD<)x{O#1_<S_l3$OyYjqRX=P^z_c^mhZzg zkmx)}z*76W6S0+Z<?My1cb4mQWSe<IV{21V8v698O*?XB@84$&IByy$;d+1~d!p#z za-YZ=B}pi7Zww3!FW<h^U0q%X6tsTZQ|4<v)hl~5&FJU!KuzM8FNe6ec8iFJyk!*J z)IHmqJ=bpcX8+kukEt)rQ)p>v#l^=@%+2YIwdYXC1QSAjI~fJConq+;y{Mg9hglBo zd3-K6>!q7)Z^^1OC&R^FV5EHq4k+f>T5h6ddLt3`H)|}n>osTYAGA4?d@4OXJ+#P@ z(YCCgB_;WVg(O_QV`NkgI-`csIB(isP*vqFe__E1t;~F|_Js21Taq_!(4u32H4-19 zqFw-MgC!I+Htu`;_%Q{$%4Zp@6_+?pz|rr(1$T?zDnv-p`JXqHs|XgReEIq{iM`@9 za}LnZc+%S@I6v|i4b9Kbr$D)0oE~_F<^<dmCFRY2xjliJN$B?fLd%H%kC*Y>uYCOS z<reT4X;IO2v$L}R9D#t=-~gid1v)TEBARWdQnJlknwk;~8#qAh+|X^o;aFH$NJMl? zLqk$p`eah8rlw|!e$Dd`V$~0T=dA7Yee{vGb;jx=&8cOJ#`Fm!bZdw@PE2C$@d*eR ztS^bu(b0LhJpb@Ns0fMgNr-vioJ)w~BH75#S`OZz*t2KP{i=@}ThdL70r1Zm*6*UH zFFxO4zrK6+QFC+io?W{x8X27ezR>F_^#+F8wST{wNy8~k>eKC3x8vl`k63+K3ss~# zMAg;XTlDQ2u^F63G+ucMjUAin2QV)d$MG{~c3ru0W&8H+kH-H{(j1fdK&-7U&v&_P zXW)B>=B2Hz{a(n1d;R8}_keCvjG8>qG;izZIQ#kS&s$wQNddb2;lrVusRl|$4mR`S zhe2BH7YCw9Itu&&HohYt1OL#%g7BhH^m>K21nO(}ta103|2cpq+NFihRrg5%1=2;b zyc5?W&*1L&(9n<+3=N&fxY-Mc4Qt|ensLkH*32)M4ov=!50{?J&opQ?eSLToIKim# z3niNL(~VRvr}Wx0G&D4}?$`kw?$efKJ%y)D5#Kg5f3ca;eXKpygc*js^sS>K1UM<l zppM<l%xqhVv8b2RlP8@sTaU=f$fUT+DHs_U^;d;$renYH2VC$*tg>ru?G13yHyIiH z3JMAZg@q)+dA6CFy#C$0ch`Q_2zdW~pI2!sT?$@wG4$FOyEzjm8hqBH3<M~71aJ<i zn+S2JWa~;)^!szZbIMy+vQ4+hXhKBQz@}%1w=n-b<rqa)iVJJY=BOX{ThdN%bAAdY zSs5-#lW8&VG%=COG;f6$!`B6%0^(2=Ax#hTTT&S+_N0~598B>j3(JO*AibXMZgD{3 zU^OkW-xKjSQ^DbjN=jaO9+&@Eb$`pwosl415mqarLMKk0dV}i41t?}ree_!Q$|uDb z0Oaq@&HliiyO^0Fw(I~Gr!;E;cB9|EV~0L2jNMx*Km~L8(9G;R-nPSW$u(Hm4$_Hu z-6y5}!nQoXP$#XfHi7%?J$?S>ZCzc79NU=(U|8klZ%|Y`-@UtLlrd#7*3L*nLqj50 z;9oyKzm3hjhouHnw;l=LHJ0+6^*&CUph*f3N2VN>=M!h=@zR<|S5GdV{Y2|mE^x`_ zhVoy(w&H&5=0+Jr90ONZmdIsJyX|tQ@MHPB&j|@`F)=6bCwrz|z4<vW3yYKE%A$Ua zcX)39zyR0nd<rNNd}iHS>g((I1acc|4mh!uzTABjVnsNH2+z55_ik95O5@6>wYArO zgN+0Mjs3>H3VHtYVI`E$u-8n#YuSSGO3Td5Jo530lhcOYa=#y-9#rAhR#p-biV9J3 zjG5MBa!@Z~6v8%vf;ERud{T<-?CgB%?X8r17jhkzWGL7y%dunCxej)jRwFJE5v-W! znvCJjkYaJQ`Ru5wvzgrHP5Jg>jRuyRO1C*jac*@bB*b)ekFk5ZFgwmaNi}TXe%M)H zuMav;t~w|~sJ+;*g-~`dPo${POc(3RsnxqUGlbRiu)Ab8SqQDHcrkdakY@1vuxo5& zCvIr)#e%<?a-Z_Ub%%k*#G}XM0&nAj9@*Mnm`i<~$Enf$q)(qX8_Y`*ng8T5E}2?} zwb8(nJDQrBEJm8Wt=ny0fcPpVXbJ~S8rFTH6SNxsgQ5@~5wROm1b}Et&eMva%gqtl zX|gXp*nOSP$r%q*ZqXp#gGRW>(A$Ze(6ZG)IoT;KE#3P&s0{m8f!+ISMh2Jt{5Y}B z?P~PRRQA_<Pit3)OM*B-MA;|eD1<A$oBx<nCV<x!`)9nr>L~DZYH<c$h8c%q^vc(l zeyXn`3OjS(!Gm`pO@P)%Mn+aBIZjmEQU2*9aoRBPZVgxG>RN8a^}@_Opfg>I5q9^& z^>$m1as=OP3l>b+O3)mmxP9l&CEUk6B(22c<TBr5tgIWMwL$EAE*km))Skzvao6L7 z+(noDXLaw}Ns+sIur?;lfzixP!QR1v>wLuu*Awdw2Vd0rGd7d=jNM*v%oNtv(o$1X zlY&QUYw%h#B&U|0Gq08xj-(F9?(Nqv^CSrn@jo-5Q?rg5N%yv*G{&i?zXi&HoN~V{ zGgWTEvcK|4mh~9-qw(9&TtK6>+p}$0FXToC7xWqX1{<}swzXMi?wzQJuwJpXcpIcq zMJ>p28kpfuOoi3Q-)*O-1KtJ)GwqZ$I8&H@{uj|<JLNnjEhY86ynNViN)WY_6nwsa zKcdw<JZyx8_$4Lf)B_nav!t{{r`9_=TqQim&K;gy{$eizUhv$ZmGb&jo-OU&F;*_q zWr^Pmxe^k#f5lXJQ`yhnvlkQ+v5%@;8SJ)j9B*-p@#Fe&EPLLQ5;Mug&CUKrlt+*d z3_w=_mIxfP1W9tpiGH4Y(N9`cYcHqf8)xT@VG^#@BS#7h51+jL!?)&H6Z5Q~o6CID z4;P<Ei~c&V{aQQn^S>DNPSRQDLCerKFmQ3NnwoQpjEeH~@rexby>&A<O2anOnC2tf z`H!aVpOk&IptFl8DO|dz&o**sQbK7QwMIGqW?|yp;`zTXn7@4a@~G+Z9?>lmPT7YP zb?dh&?Bwz93}G1m6uhK!hL<-IFbD1G(z>gMogO*E{t(}PHvYEfsQ@Mdb&(hSZgD&q zq^f$Rd0E?aR|2~py<I&=b6G;x>W7Hf^`+a2ydEsxb~iJ-807K$)iYmyyKaH7DC^Tf z-~VAiEapd?**4py1#1swinY4fUhCY*R)Iz=7H_LGu(sM_G0>5H<2UKK2)#ZPw;L46 zX_tVf^Ev#m!D&}#25HLt+uuE`k_I>ZH@N@vJkj&dH$4Yu!%IZBwC&r+#`2P+kWRZY zJ>R6W5P~<t#+HotFT2~R-Q)bn)G1Ys+3X&meEGp-dhDs?Rfj=7Wlo-7GtzUa3k&ky z-TAu`I@kX!^W`*$yfNCIBMq#4zd7ZEm6cV5#;{_dUIo+e$ViNOx=HAgX?yn1P_Y+R z<>ZP$<<W&u^QBqG=I0+(S64&#IpIxAZ6z;^HmdeTvRDJ-o#kPs%bVU&STe+R&5SV_ zsT1KPJO^B#>y-I$0jBL_655gvp=jR)d%h=6o{*onn~CW+R0FEEzM-KqyRn>NaDtbw zUVQ`pIxP150TA7upe4xj<<@QTrkgix7%!yP%5L094uGiFwHRVfT;fV0?ZJz^F<q)T zC4WsG{|Y!yvuDqD6)lI$=w&GhSH#7?+%4WIBqSsSjuqFIM}(l_bD8(bkm3UcR`miF zP_*Vs(->Vokc*^@%qg>_XVe!C2@B^~P;roBs^G-!N3-w|H?5judk$;q7yZR`U$e5h zMv2viU60JnxMNikdckhOqoU5*&p#l+ylCj3@6J@vlb)mQ(l9W*k&5_;K_$f%XHm+F z_wKO(*+Q_b`fzDIgrR7q*u4}~dry5pmjtQuf%1CBxS2;TSm-C9{Q^|OXqW_IFLp*~ z<vA8=%A@~KfC3W#^x=ug$!Zfro&!&xKHWk^B^IGrm0_-TOg@-IO~Couq^cMh32}nN z`M+mJT2fnJH!RP#m<l}_e@rd1{0`;ad}-DgD1(%{(BHQo;CTsyg5sTr$J3Ay=FK}9 z@~f*o(B+{ED@eTAN7i0G+i8OB+qZA%{|rF1&$sXQ7!#%^7bjayUDMK!-$|xRe)a@@ zxG?p#zyCf3?nK2XGcb_h!qV{B&aN(!DgitNiV#fTPKVC#6LwhSA(kgLC+q&w24Z%4 z{@iS|m7hW`<ifA05JwUp%nw9`>=UqHyIb_8YA06*k?RluHL>c;9Wfv-2!MC6Vz%!) z^Z3u7+Y)aXekSRZeRW*1P3%cYO)Ug}LO<BX$;k=q@o0YhPA*Reu_i3CGEK9#P(fhm ze$?0d>^>^-&fWdVix->Ww0-^hmBhv*_Aph~(h33002$kS5u8Om&FI^A;`>upX`jk? z_47Wb)I<#o*eSG#m2)qsnRU?@?N=B2V3v47x(ri}g-f6_JKRM2V?lz}q!5YQS}9-C zBL{3=??g@T)v?_}+p<vwizl3P3YmP*%NX9dlNZ9-M?rCjLQ?$F4a$6ock|OV@>3CN zUmqN%(ECjU9_HiQXJ}|haZKj@W6&jdKASJb+~^z`+3`3hM;MCX-|7fyppM=9_FV<T zduVRHKL6J*S1bba{>sB6o$p`K94GZ?<6P8)J}g<NU(V_6wy&{~%&}t7Gp`SyTUcB) z!_ysC7xdt)6nwn=y1zaikdTlS1LU?Exe4$k2Bb+rZtcH+|K9rg;0cg7Ni9j_TKR$U z;**i6jI1ouEu$d8@x_Z2=S^Dk+uMV&>CQSVS^%r<%m=R{8OD>=_G;iD@D><bDfg>L zJBQZJ_@9yLJ5h6JQoOUF!t&OS=fsXDt##!)4)PXY<|;(i7)nMoV5|vXYhY<pJO*{5 z<tvVm_T46IUFbpwyhr&5Xp2G6N+#>UX0!FGVAxpAl#d}-T4_m1Z3Ch^4D=7)Lpn4j z9l7XlHofOg&~9tD>0>1SR@c-tCEndE?aL9NUqeJTA2LQSw_lmj8dC$7&Vzjk6lB-C zKvl-+2E*oEi}^ujX6lQuDW)RM^YCmid(lMCaqH@}YrBT(<9~p@|NZfTG;PiIlci>2 z(U!GO+&>_otG~ZwZFNor>*^`+6Yo34*t%v5n;Zg|-#C=&M)0}qEzt_ZQIzD=9G?oa z-tzsp+FvL(T<6b2{W*hvr^n<AZx-X5n3}rLY<*3x!_ppF+5*V)1DHLj2oFG`O0>{D z-aR%Dfp@?G;?T@~Kc*mQGsR1J>(;FY4<G)m3cCWT`v>kKR({O2P*Fc0S+e{R%n8Gs zM7=$X>03Fr-rzD1|9;;{f?#4bJMBsm<X4E=cMJ_*qkcehSog<GWc84cP`0=YN+%5y zlbpEthW-2ZN7osEe@BhP+ue+i@}@|c+K>8;mgA^<0R(URer_kgP_vQdb71H5@Ie(~ zZt&<=Z*XvMfIdYOk<}4)C1&<7e3CegEajFmeK=4c>aSkCy3gaku7x!MI!HjkLG*)8 zOg`-RB;8*JMrfaY{mO@hC2nsoM0Zj-9L@%tw-js(slXSQiNl&iL_3XIOXvY$P`lo{ zj-RzMuNc2DxEvB?WvrZ_`3nxKA0cFuWTkKwMYa*77)Wx%ZAb&)&@a$8;n={9?e&zu zaDsO%`*BHITM(ROE@IVwWTCCCt*U`jD9xnt%VF#rZD?uWvIl{-v0q-xghatHW;uR5 zS*L6-J}chAq5M5pbD<be^*yX(`{jvZT&v=B;`+j$XVfYBEh+jxaBCBg-wqx6kZ&c~ ztug1cl}0tsQTV9D8x(~9fSwc*5)wj=%kMRFY(sCbC#Iy_o9zDi-rwJcjhgJJ%V+yF z@|c3|>Z!!m%6-*W+7Pu<qj0F>vd9CWF?z$mjwGU&v;N{}mnoCbql;jiQ^c<sJ4I|8 zY*SK46Y%AS6@+0ub?Vd^Zf;v$+tiz~5)#j?{<?86i8#ujKzg54;ozAsFDZeL=6=5Y zQCNOz@5W3U%8r^AR&O*L#Tb^eXKBR5#9-K!!-)K+J8NX6r7^fM34bpwmFhG6M?xPO zl9)cNNYo8hQy-yRry}vi*kK|ss7>!)%btzzK2D#$ner0sie&1Fii(YC#s_<QdrxWQ zW|th&AXo3YQofh832E@ZM8(81%zCx~rC<P|r9ScVYbxXL|7Qg}w7JxMGDAS!>onLh z`rBmEYjT)g<|V3FS*GDB8-OP*{{y-m<Ubyxug^LAWn#`Mog+Sp{20-fW+|aViG3I9 zEAz(-pO(=7y!FqomxcH5W4p(v{?CJcInRgb9IyZm5-fs(>QAqdFWeG(@E;u>&-jh~ zaU3E$S^g@2y*n)SUl0(>tLQ^ExAYt7J7sH*UDZu3_xieN8xs<uiYvE{@(@F^NHBcw zF}L0~>27C3C;w9AxrC=|NwZks1q<(#lycFU8}XX2R>N*Rynib!Q2IDgFqFVDqBLS# zx9>ve`n}4!oS{yl*#}BlUzV5Fo~ggfe{M+mud6|?b7YM2k39g%<lBd@8eWzE#lm{R zl{zQO`^s+TM>?khGo4TNDK(yte#>7fS`!|n!~MC~Y~8F((eJ9vKxwvup;(p?x{K32 z`y?ziiXz3@_xX9L6K{4ICA=vwFQ43cq$23+x3>Nl8yNl6j53d}zxr52PQv%fMCoOC zX8ip8P$sg6KfY8^m9X6_$QzPR^obwfYhdRcaaxUS+;8tOu{Nq87eUiGqf$M)?a#<y z4WIcmdwdJOkJwL5&gx^UEAeW{k)DU6_YtLSPYMqfc?r2SszP6Eg4vzhaNejfA01Bf z!}P|C%uG}?#g8e_B*^al=+UFfnCr($Xu(V@D}3tNo#1w5tJ}}3Wuo$HO-k28E01$= zEM!bh{G+NXE%gly{G8}2ru=H&w=+06xWZCX<1zp#EI+--mOMg)@qlY&$qEFWAJE`M zMDpwth>1daadB~qKT!2O>!PIz=cWEIw^HKHudXZlZ^p7b6f}Gu@^q3Bo(zi`)u88F z;88wl4H$<+6QMQUH~s5;$L)Lf#8p-IK?}P3C;tg#>`@(h>E$0fy1GgB3udH7o@z+1 zk!kUFszT&AR-C$TDapf;+Hla#{7+H-+T-!@2ZQxQyfhqI<R_XN%(wYfC<nVx*%yka zC|JhD4YhmDIHHN&h`#n@Bh_9n{b2c%pJnZX7Z<zjW|M}NL|_6wT-fY>P?_P+^3MQd zowzK&h#2;cmD68LGm5gKSRiZeM3Y{KyTAX<+gdko9smX@{_$fyDERDHM?%}&pKru^ zGH3$le?Pw&3naj16vmMsH8nKU)Nb}2draFh3jqzKV8rhiv^s^*(`g=gL>rLEfr*&C zG@7-YQDEAy2N3xP8{128ia&jQR~|k3YNd7S76X(vmeZ$Q;o@?^JP@!RE!PWikU$%M z*YYD7!2{ijVB*&tK;o^jh(|d90Z?tvoIU%asYy*RdpaCFQ{Rq_a_=eCd<21>d>jJE zCk2sH>S=G#h)F|YgiF4|7eJ?SRy6Krsta_)y}+O3Cy}~x{(G*BqkEX`$0@6-Hb#9# zD?~M#n4QI?KZgJ;G}SCm1PK&ID}<4LOJ~8W);xmwam9tDHxN<QKLBEfgK=3xV$-{p zGIy1=AK$-2L<-04%r7l@dV6oYsHnIHDY8iX=8=ufL$oG6pUW@5lg1H7{x241gBBr+ zJ#}q5hkpNlQk}u@>Hy3Y6co_fwrAUFX~VpPFjfj9<VmZoApBeM;!%Y7fYrx4Ew#}G z?C097$@fPu(QXlcjMT|}k@dmDN~b=%?&Xxv*z7(=RQsg`4X%IZ?o+t7cl0OyMUIx` zWlENAUY@;s_j)eH9$pXL<H;OHNBk?ILnd@m`<B4W?jzd~8X5{o?ZY*;ZQcANjYK91 z%|JENA|_3HuL@I1e4O=Y>)!y=+;51>0WBEhJsfGxpaCZVz4PNWJ^(?Y6RYGS>>~t~ z=t_)Ltw)+Khg@*j2V=rKFQjuO6*{#KheoMqava<GRD;W&?Qy5hA)~bM^IbA5!pHZg zzyB&08Ik}eW;5^pPZ~WuU@}VLDH1QakAabq>&zLp+4cYt;sV6qV@N}x=hAt8h(CBF zJ|1?t(H&&Zkfb2hWBSiD)XW!HxVb%$VxT>KJj$~z{wQU=C*@}r0=%5`p+GPdlXYd^ zG6}m#MZo^r2F(AKfnOBZ1<4l}<<9{P{tOSl$;uLhrUDUA$u1X5%yTSv=`C(MR5?~3 zANXXF$E5W=*xpo+uNDU9N4TUXe6`DoJwMNC7i@`(i@RSPz7-%LP{?MFtAyAC;=vjC z@xA|(7~jm#0VZAe^XJy1N5lFYMGA*v<$?rAr{|cgKZdL1+q2Em_C^maH|4|5hk76* zBh!zlmXD7Q=m90$YVL4r##zk2s+!v0;o)+q`q$XaRiag*uZ31V=YnDkyh^Nt$iDgG z$B$pJ9o=<A{#&re!0r-I!kgIGSSz`DJb8R}w%1q7@$iWgufT(9K3*n0$^R?fLr*a~ z+E#|QMP@J(Hi`w9X2Dp@e4mZ&yntyIa4QAL+)#uo(~JpqNZN^Wn$I@vPzB|}AEb|H zPM(Yvow}84&yOvByD3ShHeTHqfX{4hR0Hxx5iATig`inG&YwRIr*QVW<+|IIA1;vr zC1+6uqkt`h!zL0hk<<nhQ_r#erEgz^knbVRcY(9*YkZSah4#Ylt_$V$5S|MTTK&tY zG&;CU(&qtqzK$6i$%Xd?TKS}vqN2Kb&&rxs!3X77E)a|lD1z{Lb}=$)bPp!NIIWJ9 zJ&3jP9Wk1L=G2p8d25bOEI@KV(5eunf(!72WY>t*xSXn}0RY~|_u$Z-J9qBgyLX!~ zHg*jQJ6cs$g-7?@He-k#gVSY}u}A8pmI{k;k0{nR*p;4GIRC0)|NNU4cE?r0Y$e4- zR@GY;tIIYR5DD0=cC*7(xd{5a4ZHjIq%PgI%eeya|78-S7}RYmVYEuP7P=1H_!#1g z=w^m_R|kiPAyN{IxBgc~DG=%=d@8`6`T>DL5jO-@z+zAf`-bevdW6071IbE|e^N5w z%v=7B<?u67Hozrk4w^3+2g+NSJ&3YTD(xhxEU^Q7+bAI9;b~6aFTB9|tFiGtvQm)1 zp7bTqIG-TU&;%I!S8a}#%4bZAv!A3Lepo`qQd}|cty-4Z;Ki5gb^Dzo8@!RQ!xAY? zua5nn`~=jW1DKL`K|!+U^)`J$*3qhoM^NL!Y^Hj}B_s^&c!O`z(x3vve*jKEG1c#L z?fzL_PTT|VAMVK0QvbHPJSG3>M$A*uP_`r?=YKN?n!WG;{{0(CS8#PQiKO42&413I zmTmH2^rIO+HcP6DUUb1Cx2x{+G#~CoTlsK<ovKw38*icaBJQ5%L!-d@3}J6*@*B;D zpnu7{+FMB*^@TqGYk(jne<&cBkN?bFiLB0trQNaj_w=N>@|NN6a8okO_hjoaO%Swb zEfH&r0uUWC351PHl7H9_q$n~vnjzv?nQ3W=bu0!d*595ZXgOFLih|!iG}JXZDu-1P z6BC1VM!WA5O~M6@mJnDS3FzdgS9(95?;ss<@ChIrEJx&cJ-xgNfL1_KzZDm6K6&!w zD8{KfXY+U&XC7I9u%PiFS#su^rUuRN<`4xSxJ>}`7(T0{kD-ybRSuYso1~kuIjR|K zHt@>Az;j9Vn8nJSPpT@V=?Nw)gA8lLIcsgx;gxXv0j=5>%#QC(6JP&7ER0kCL$K=r zE-E`G$B*yf5w!G$+@`j#51-+Z6=Ri8bDury$E_okyS!t^4l=BKQaSE6hUVhvnT~9m zsbIC>s1x2&w#3X}gfY+I^kU1ZkC$cqdA5QfLKcCf#L2yjF5yD5)G;0dwbzURZ+FkF z&4ivos!2R3>vf-Mdf#uu?@n8r34o9Hpq+I4v`675p)U62KUseR&X5+hrh?@rvu731 z1I!mDb+EAjJvh?bAMHii+O&ONK6osVx<du}W|q|mnR$h9bHAoOK`R7`%NOJ*L@Sg4 z4{{d=PwJMxr|h2nI={Gx%**FrhLAh5S7uu-j`~()XLwRz2Kyi%Opmr9zkLuHM)ThC zP}CnXKXD3F4ZZP>u5RQ=;ckMtFjYm~wrbX3xG{0VCSsF8)OAo@cu>;NRmgl8q)Py- z?arc?u&wTcKkqoe!#3R>3q$I~PDX8%;~Vie=}5vx&HVYg4Lpf*L^M<pbi?YhpRT$B zHH?x|`FQYj9B(3Dp#y5~mH!Brbut^=IzVz7#gGvUqk2C#VJ|E!%-~;p+r`w>KW|3Y z&*yTya#+><6xSk8vJ#y;ce?WZUQ05&0incsr<jO?J*>vu&>0V}D3<>+W;&e@7)%(v z{P*;kGc{#P?Wgj06C>lx<3Ze<Zg>k&1?TpxYhQk2slP_7nTD32EkHK@8oPJ%;b?mI zz`*5J%kVScs{is|-UMs@45pe7M@R-NcU%0@!-o%Ve7=<-E;iX&cRhGS3Dg|!u5<ep z=p*~~@27izM4>jvH#k^MLZXPO&J#*LyV9rWTgH+PEj#rKQ(qOH_~g2`=O1caH#kXk z#94aR+IIO(q!pnl0xxDaGqcueY_jvNg!2F(dpT~+|HFtsZr^`kpA=4&uxS80K*(6q zp%>e7SbRVCnQJ&ALDJd77RNm~A`kwX&GDa>2LrK5=V7&M?2#=R)=vG=??vYttfD14 z=32PtkIp5PX#T^Iy%H6vkDQNp`O|HxqBg&>RQoVa^S=L(?`Y!WR7lCsCx<niHzU0I z1V<O{r^nui5rsDy4JlKfejx(FE?H-nhqTt%zsQGGJ%CPya44zGfGmZ}5&^tyv@VK2 zmpThy1L=7+FOU~JQE`3nM^os~+cS<<Zbv{t1>V+8ELu~i#fvE3^G8E|IR1x(ALZE3 z^UG5eWV#tL7yHPOJX&0cv*zoY@w(k5?qo8)u~8Mm+ROCx^T>N#j92#UZ$-qDL{-iv z#RWvcIDqct(paAFZ)fsuJDHE4I~_l5cO)!K+hxb0De`8!A6N%NDV(ZTH>G?R7)T=U z#!SnTA@-A!F<vuD7EotDhJ|h2z8y;F-p2?xnf=M9l#!K{ws=cL&rt~qA(|em6kFtf z&M+F4et`a;ab4R2cZtwBdpzmX`+xxQ%^yy5UM5qoxekJ`4UP&3_(Nuc!7YxYHYF7Q z|1S7H1>8g)1<4{Ht&;Nc?)da}ZERc|W$;BV10m)u-J3LUuSH1yBR&t$8zXQV*>Y^c ziJ^qNNoaQj4IP~`j$e>j7*r|>qmJAlXg7Cm-_FM!t3kuUM?g19LXSCh`t(3U0yDX& zHTBwu<VO==oB+|}S_$&=`;nClvjT~BKXhmSN{P^GXB?Lw0Y8o-e+GfL8zRp_+HqO` z0umV@yYeM1jnMt}bYo*n%M`-Nd(eZSn`6(_=lWtg|2cL7EWCO1X1uZ(_OfcK0SP(~ z!69KJ3L9`W7d)ZDZ{I?vO({t2CYyWvc3Pb*0Xw2mZPr-CbIg=zZ0ZweKzN@I2Pw!9 z8??&dmUK4=uwV3vnqvpf88~5eU}Hn}2J4iKk_#e(Y<S-u<jyFZUc4Z$E=jv^+w#f^ zsqjW9PV@$t?qOh%0ez!@KXZtk-36Du?*5C~k&zL8oU4J0@)1)_M($8wx$b=506S?b z>0MxbA__o;aVc^adWnPB4WyxfWHVWKfK)^iaBw3HKb!$8!1a(=3iie)EAs4Ch{Npu ziHQkt%w%{gze7aa5)wEmu1Cszg9r~8UY($ow+<<;rdwH7u29%0NMSm?!%-StL^WA= z2c{AbkK*y0H`^oSL*#4;TLCSH89F#hq*H|#!LR-SLXF5EY@Yq(F%heg<_X;Yg@!dP za)6g}y!7S6=U!TF)I^G->(Te5J&buc3<TM+q@)BvKFH2xo0;uNjZzJke3X31F=62# z5E7cbdnIIKwnGdgBlU_gh^R-Ad2}H0b&pY0!HF`g$Cx06=q%4qP~6keflkVgBQ2n8 z_u!w9AuR;i;Membyn-<*1m48|{pszMAOm#s4SB1iE8Uo5m(Cl4n-0KXD2fbW7bGxl z1D}z-hcxyu;#4`kkdUYH)`%51u<k_Djti?RW5oJ1*lc9?#R!le41-NoU48u-OrMaj zupi6~#OKfv5tWM8$l|@2JM!kun{_sCnMHyzN|cr9rdr@%8@gvpKHXqPg^m_(06p9% z^ymzQq@?6UlS4PbBS|}SdQFKeHV94V91st_y1eN8c5ZyU@^??{tqg9g(Zb5gchS*o zq{0Aw`%7{%OvqJ=LxO?_kp;vX|6dkHDg4_j5F^mr4`Z}J2DwaH`Cw3xSQV}LBeLtL zGG~n%&*1Z~#nzEK004lXetht}$r%Jo?0bxmzY|#=e`eK!$ygeLleVrBrjUIxa*}&( z+Awd}4lm$LA|X|Q;VlEl6@vx^SAYUtJ~IEIFNa3;&e$PQd3pII)3ayKj^r^5J$kGd zQwv{uagngpOgE@=!JWJ(nK9ZzRT^Qej?-3?5u|llFf`yDOw$BE5%$Nn>|EI42hN+6 zqccz<G#CNQ)4YO&4@euCZb5c&d;-T2N88AQXPCDOtMhlUAu5op-@0v^HtHOSpY3Li zARP7A#$fgB1=n#w@xY#t#cHR#UmH#A?yCrig2LFmj7ZOi5jy*uShtAVkmq^y^ybP9 z9jE(uV?U{?s#0Wpo5I4*2dhL%H4<Y?VZStzej{OZc%uyGci2fNAb^qA`@>#N&&-fI zWKE4H6u>XY-1Sz3RG|KsrraW><VOpuK6$FwV-yKirVIAbK@HZRuOqqt4^yNu+vY6E zouIy=M_z-m_r}$g67jZU=gxT}$%(8B1#)J3@LvJV@9OKvI2dDGV8$Uw{{vVC+Uj{> z^pBLd#l^)G(~e;5n(;s1)*CYsHo`9QQ}BXef`CnI_LeF{=_Zpsl;oK)L=SK-XL)%! z#cj(X*5DRu>W1JS;A!Zppd8!UIAU;9IP&*{tT9mazz&-88UG-w2M_EC3eYE&1i7|M zOX=*V|ETYT>3=tNi2rbQD!i{?3-d1$BW*VJZ~9i(Cg$#WNFICou69rH9)_nrA5)#4 zM|+g2L|^a<4!kK96m9BV?K3VMU$2nD?(?j^`O{6B%dhMAq;?#6!c9SOaF(=e>0){w z$i2QB%bF&B<dwMgv4xetzWP`8W~fWv(5fizTD?2klSzEGdoSN^Zknv;7Hm6s0&`#X z(5d1c_fPG_e(<ir`uKo2<yiI`(H|h%{j90Ej%U>1?z{s7PsP@K0=@l&WPu0E>%xyv z9fwNXkAAuy^_GSI?bA)0*Oo6%gATjyKU?&$?SsWqt=ZM9SD$n_;FJ^Gs#C&C!^s{* zIMSZQ?nQz-_H&ElM2bJZc_iu}Ynx-G?Py!A2M?Z@gBag7YHHs)1MjS?teU%S0v7!r z;Q8q<O!m0EdiBsY$Eb;0Y-|R*a|U2$&`&S8N{m`K9H8G2vKhCZ%qP{vkGU(e>JC8Q zNjKvs=jN<!wJ0d^pOq2t#QhkEHUGJ|ZxP9NQ;EK<Im^UGm`-!_hW@EB>VG)vX)h}( zdZ23DOT9UDs;smWrjrX8{nRP+6#qD7!`v1+?=}+^ZS9W;Q@AXbaiZ~g`}(T5FXi9~ z<+{nGzMLUrlUNK;!Apyak5?oi$6JO!Txo=$7QGUhTdB|KSfsXWY;6sYYQFjPK`5Hz z!D0b0sCU0~Pd*5wp!oCc;bOU(PIy$u(ykMdAr&rlgO{DxtY*)y++2&Kc-0BNH6DFR z6UonN<kUZrQYhYQ5P|L7^RpBbk2h;2KEEo&2aNs^_y}T$oO0}8kf>BeoG8o7+Ch=e zOnZ0_1qH?Pp64YUJ#9_+kxj#svgR~P@1i>I>QIr-oB;#*%S$27!z;2aYmvJa)CD(V zAjfE;l06f?GkNBJ-%Q+V&6a$*0UyX^^4Y}cDqgU!YtZ1B_&Pk1Pm~3Zw;%oI!I}T| zpuuC1jsLLh$=;F5DzQGVAWu)djMqQIZ_b>ItvD%P+R_jk{(K_^>s#9`e=gk?upE?m zn@9Z89x1RY`#k>P=O=}}!!}D^Cm!Sw1!Xad0|j)a+xVsSy6q`Tr?{pa{er@AOfG~! z_RaLP2mc-$zR?tpK*`$4F^LY#wlt+HgMWf)44N){*dSrGCM7NHiKW(L#4!>|@%4pN zCR1d1cr=gz7E)g34vG@_S576d6Ae9`iYe=QJGB+fzVGOAxRvvXN!XT8Q$3zghO{7w zxQut9Hdm|W9rB>$FTb-_05QMzIWGWeH$d|Ggfb)LfwKrR&4vjv$j3A%>AY@612y`V zg!SX%=4PF3QuWbU!j0*)mR5)Mz?i08=d0r>cYbVw+Pz3Um*5fo!h@EPF&^obf6b*5 z<exfeP9lc|{)ARtdyaO>+cq^{mJ>&gh$0uU(Zn+_Fb?cJ7MLT?Hn3Lg&nVOTgN8ud ztdiKob+G!tjb#}59$Z8jo6F`zyfxLdV>Nj5)vUJ9kk;@(6MdrwXtZZ+ECKO#NsnnH zdC&vZ=Ta)PfYyC<%Zc})sE$}xQaYtxRRynTUdM}26p{x!U0htM@lPsF6Q5T7auJkR zN>cK~Na+60ck|+;Gp^(40#)0w3l}t@s;$X(g)^<Qp3B#`k3{=1Nz~Ec<}~A22-;E} zIJXrBKz$3K0?RvUac+zghe&V`)&MpD(G2{9fh8{yAZLgy2Po}zIF?tO-h{{rS+Uq* z$Kn70S+q{_@+t!%fW&&B+{L25(>6AscFe#W!v2x|q?MQZe8<5^yq92+Nph2yyZhnS zg-0MNd!JTUMoz#Z+*i{UBY{IO29Q07Pq#9XU}J<qsDSUT!I?e&G}vyGU$Pok(K9d* z15tYrQL-CIYx6+f8i8`;=;-M3=FJVb@skc~s2K1Al`_n9oSmHdbLQGTf9ci$1*AUg zl3-<JJ;BCy6~_9zI)ge7R_PS{5(f-UoH<j;)sB4o;2+}Kvn171gH>TKaPTbxsUs;M zd2be+lNUqTy`if5e%LAtYDzec#hyHS_BxC$6x4U9Xy*_J$5UiHrYFldNih*{%@q#Q z2dpmxG<GR@d24}fJC>_Z$D}-fLv^_QrlUkwBykMD!(?+D5SwhU5TRB*lAnQ=kHRkj z2gv8=J;htM0s#^~(`(r)5DR5m-J_$L{YkC7W3w4E)6-tl=8Ui1+&EK?^_Ip<=OI;{ zK+e*oXPa*3Ip#oi{0J(BYAKETr~}P9hdl4E5Rnf3?cfrh6vCb(QpF+(cjN%SS$J<b z;pf@Mc6w$PTkCpr7H$=L`)tI$Qjx<mMhcTGj!=bD;6=*5KXVD-vKmJb&f#>Yq@s+> z8;m<0wiJ5Z2@a0m6UM?^Tngt+mhIUGaGayGqy)9toPkkBUcLb<V!HfnMKqw3^XyE! z-IzWQ1iFzzI$_c_8TcC~iyOxO{y3*!&Eovxg&|Jo3z+x5VbRA~1`iYZ0EESdfG6rv zoX-)f_Bm^-OXSVgf7Te<2k4SD1A_Gl^5g-WA2`5s{{xcV2J_>84{&Kap*>DHtO0$H z3OA#G#Z_saQwl(y_mZ2sk>$Beyxx04K;S0Q+m*=YlTQNLk%0|YhwkthbQ#970S-x{ z&edRfldags&hF%)Ll+^HreYgd;Ls81q8zrhC(8<sC%Lzo_@<|)gEuJQxKO-mq9|59 zXrmV(Agd%ixj^8~u}7Q$3{fv%5?kVLWhg?VSaDr5f4un$lrq{qdp?p8{E~NvZ|2yh zVgimy%FRf7;9xF8lriKo%f)GZSwHT}VC(g`=xJ;Z+RRgP+ocpPq{HWUhZT~gE?b_8 zMlTyAP{+l{Zzj$gAd55FH$dHJX=uW5z{L=v_9x|d!oTP(W327WpguOCO%aR~bsT&x zcsOeSiGJIbEhTe2BLA!o`XkVgV{lz3xVaTkj+Gxg_yQ=Wly0ICBy6XQlWZ!a6^L&U zkgUer(=jo9#@VA7>?(tX&q04Lh>42Urs!W+JLMy~WYG8}6x1gi#h9pzRyf*WXlOg# zA8MMrAOUT@8v5MKcPh^N@Q;B%Ji@tkN=uA*4RJnTuq8bKwT+yYnc=4EIR9gvQj=wE zS{J8w9l8B_$Z|>myf|cJ4J*_iP?VwJR=Ym9sco0*d0INU2(&^rA)#CFHzp@0sszV~ zY*KNG!Q5m%n)nFp!6|8rSJNFl7>hbxX2cr{@e`dU1PJ~UGG~|Y{RQrI21?hiy+blD z3WA0vtiTj-5OOD?3dEq7Wj^@(6bwEFmQHC)i#onZVB5BB)ld=`yM}NFC?0h5^ig=@ z6MO`pDz0VQ)~#I2W1EDcQO$6%Vc55^*Q4afih?ua@u=_}mMy^USbErmH_0-NllB_@ z+($!N1cy`=3_h~deb!J%4YiO#LduI}VPOG9?iw(n0dnow(mK2WJ%9fmM&Z9g<S~e0 z9o$P)onDzEI?7Da4dFKr;_`A=6sezl7k&_xEP@ce#@7dzP<`=vsrT^e&d!eztJsBw zH9Wd|dLmHyOLUWQZbWi)baZ2y?~-w9^tQp12q~a-S7HjuB7$lmPd>csChQZn0}vQv z77Gdu8sL+=JSn|#BeAhZZOr%lb|el@o;!E0W8!MM+xy<&L24>0&yWzU+%D$xCV@;g z-Mgb~aLB3#f;%~jNO!JGg{<8`B>G00ks7&$Ago~Vw(#J9z-f(4vRzc83ZV&Kz<L&k z`t}Or9RY-G+>xt+aoM(GhZ3wYA_e^wb1DgM|4A2H0n}aib|+7tK3%~F#X@>z6XhRA zM4n@j1i?ul8MrdFXoGb7_NjJ{oZkD|h*v$d?2Wz2*o|8MMr2WhEC<lI<Pyvc+uGjC z93xjLzOX_;S=omy&5s{1k2yv$t#dx<e$>65yJ+++!JD}ngu^b8Dw;Nz0XI}2uHy`2 z45l0+pfY)tAZjxuN8L*5>XcBxuA%Unv}ea)E(91ur)FpCL6O-cGtGKjYEFE3N?Ys8 z0<l9DnPr!kFR$IdAB|QrnleI`PIQ9efj1btAR(LTiFox)hxqG|iQXca7X_(@{oFYv z^aZl!z-;v%v-{iE7X=>=eHHqJ6?uvPNBy+A=cWKtJ|UNbGkT$@VzE#&Ji-Cehfu;1 zytr}iUO1Mx<v=wnBjTF?E`zNZ$?c9y#$+Law`0(h6oJw~&doVOzgisETL*!!ySFzI zmm*k%6OBg$ennz54Ds~{3#$t7$uh9s<Dr^Kc_379t9yk~>bhj@53*vA0b`_Xao{}+ zp2-k^$ERzdPw`I_L~{}W;F}F9)LvmFmzt!XWM#dKZxE<M)KBf7-9y}hLYdSuVjce~ z1D)Q8H{fn&i?5yM&+cgN1;`;`IE4fr#2f>d>6~VHeDLsi@*e&@O({wml8WUYHEg4$ z7S=Un*$!mZEanv^S6qmNBBc)t2z}@sDH5PPl~q*8BX?&z6rX+r-(*2<3Q`C~Bkt}Y zdLsPK5su@wSlu)D4iZE3kxv+Y_uPS=;OAeH6Hr9;5vl<igx~Gm{r7Jub{?OxI_w-A zRw11gvs=lHaEEs=@LlturKJr=OE7?*ae({Y%OW@C1bq9(RS%TCa8j1*;Bvq*46+-M zf)m^bV&le*F-ZMicAQo~O+!nKrCh&>&tw^qZ<U)j{bA?C0;%}@(iL7F|A85IC(9nT zcPum_^!Q55xlW=gib-vfj<iyY;$_`rH2}0vnmL&_(@jSD4RKtQEWRmF{dC|=LrE}z zksZv1q%z))P&go95e;-iweoCZtGv`lrZkhbo7l|Pkmm3Pc$6erwSd(yTXItz*e`mF zG|mr}OgVF7xgs$O(<|u!uTeBkn6+A}DTt(3S6CVqyxiT4FTMyp$JKB$A-i+hmi$zJ z@h3}Tz_}2toSmKdKTEE$$`kVPmWW_r)XU~h$=`{7kzXOzO>fAezxH{}z@VF6z;RwQ zw_~U5G0(wspCkX$WX9SAh|rhqLpg{5M^%cx_D$ardk7Yj63l+`+n-8*{!{>yW^G&D zWZzXpim0Q()82l5F>!IH0D{vhM{qU?#n}D$*T_gBQouOC-`~HlIpljY9R20GieEBv za>_8rrfw|<`}?!MF7)V2dK@0kLcWoTaKj|_2mtxAM!KxLyl<OH-q6xk4BRKC-tKO` z3)0r@ZGm_dM75}jM)($W$P{3XPhhlg-s$p9pV;V-7OnckkM-hVSnvc;#kM$CXu|FQ zEl@MZW1FLxI^E*Li9`tx|MZ3A3rn*z9)lcOsF^mRK^9rJ=`Aj$HyQCV9HJU3YirA? zG(2P8qw;~Z=fqA4m&=!oSL;Wp4v0A}Y2C;Za@Km^dgVDq-f>nXY78M5|D=Yp>d2XZ zUmG3UsnnHgD~J)!B@P2wo>C*;zJrGVZq7l28)?f@0k~PM8@W#XWRK9E1v~fm@7eIh z7#-73Hb3qNL!>)K#*cepQ|Nb}m0$?u108Ft>DY09zJ?um%$0HF$X0ifc_+2*TF4hZ zPO|huw_RKD&yOwSf1G*qUk_OS>ya3@NjuBG)9ysuN4t(tQc&DxIP7_$<(Q{b%K`H5 zp?|UdTk?{u|NiU~TAxq-^FKwNAHJUkwcqjo^Y3ON!v_KcMSjkNV!s7rvt?4s3x!Wi z#@DZy=N%a28GAUUBCXFe=k~Q*e=b{=6a}c?2Uas(Ji$emG+f1-I-}Ym;@hY?O21?s zRQWBaaH{Yr?lymY<d-uuSIGYyG7Zb}nmr@cT1<1ER{dqS|39LG#6Kd$9Vif<hkhI+ zu6=m%$;Y>F#cfXfVwSMFq{{WzsctDl=Pl0)$Eq%|$&pIMyDRf2M^b0X#pBl|7)LUN zE^9FpDmwxi9^CAUWiC3wVdHO5moVIT3_sYjdt2U2xRgBTA{`w0=d)|7eZ~DkR(W%O z-jKj++Dn$_e{R*c)hpSPI=TO|9KjSz$XOQM|F&7{<Z*-mzjl-+#a<8M8f4_F(r+=< z-r0{aupI1XjauNeUW>|o+dlSaWn}T_V3mFLQ^VYt<I9>V;tl%+%$Ji`267sFhVb;D z$h8qJX^-0YpL{EZV=<l0mj5h;{8xo-N(s3&8g|;mjeydlwDt4Gg(0#xh^aJ7#-Uo% z$>U0sQ_9MbvOkKfJy}i%<Y-u_r)^r(ioR~Qwxp~Q5v9X!)pjT2y-YKW-3{Z|w-z!Q z2Uc^$=MoO3Ck?x735c0aks(J1_gWK|Dwd)%l9ysPMg4XrSA$Ufyf>L6I4APx!zjin z^CZ*Fzuf;$c|AP3cJxgEk;fOEM}0FcwCj7y@jIV#g+<h!Fdn@B-LOn2UFT#=aQwHs zS^ZhD%mR`6Cyy|6WrdI{^)Zb#^?5&;WB8)L0c9Tz`if&QL^0dx;Iz8L-<8(iEk>kV zF1%`vQ~tK&o|UD0n@@b3y5qGdreBOh8EWOW!>?=?&6+fevyJT1xQVkS{E=}o>aRw% zF4ZSAM#aelv<J1QP%EA0l>F3EA}^hm7s@Mt&MYonyM5=%jQ4HJu@<Q+Dl7ifsuW{J zrMT`0$)hUWEydltV`=x-Nsp{WC6<5Yn4C6K2~iOo?BaY;I&3TGlkpzGCtWL<jH$8n zbA8bi6c=M8bAm&EX)zEtR3DurmsE274u#uMo8I>9wN??H6&F6e^eAhu!&k{;^qz~` z?G!zDR>ll<PTy519tAX56-ap|b4>qt)(~UMd1DO~Y3rPU_eC;eN=bsMkJpCRB)@4K zEc>O+@gV4IF~`uK-=2e$tzCnwq91Z^9*F98;wd(JU8uD7zCk6C7}{w#;vp>8qM7?H zJiLG>>Y{&0yx|&oSA3CzEg4$mcwb}+TRN>6m3cSC!YXdCHsK@YVtR5-M7E76_&)(Z z1i<@K%E`{rXVbSTE7PX^yZ)=*gMuX84p|q^UekcrJ4=#!y%ePX>_4N_>lu!=Q?IA% z;CCk-)4#v}spNMsA0B^Ji_^7_`HA^tm!5vExx9V7<R4H)O<McwtL6Kg)~Q^rg2vD9 zqj!fa)yW?&I_A5(yGhbr`|zt#QI9-c%Q4lgTj^KsQStiY-EIW{0E#3jAx$&hTBjLr zt<xu4UsLx!tu^c2uhetE6LK+|^!4$7NRr&GZnC($>XDYUbYy?;8GSl!v)-KYoLW9v zUp|$~DRRIkPVJufAzqV5t}2aPD%9ic>S=1^7mA1sb-E)xCnrZHlSwzzv$W>ZJ@WP` zqe1^OU6K@k=9*S~yhG0q4t8qmiOvt}uS0|N`U~^rRn9|_<n8OFdX1}T`^Lix?cLI8 z{oFnzDd5rS>e7F!MRD%xJ;9Mk007{mMQ}ash<{&Q!&}JBVphFJs;OE{U!^2xs9D>( zD(_Q9b0=-o2cuT$gHfyWk5`u}JvCFWyd5S<ie9i=x3cVtTJ|?3C#31X&J#}Un_XSx zZgq1^g`GYwNsm8KPrg;l>F<L+)zypFB}pfLxTxn^y{CWe8;)r6nuBt8chiIgef8?N zFugi1OcNINRs2ua6u13Yp7vfI+f`oWJoMwibB=j`8~wB<kBnCAx_`-T%ht{GEG?S4 zN&TOiD!VOPl4Q4K%XZ7|m~!V!lFgR?{L;XYNB{ufWdDv6+P~|+8av}J`ujh_B}u7C z85-Sxq27O-(o?BP8JatBqtiC^oBT=7N3@r_)lHchw-o#3ztpKmGp(GzGf(?1+Xrap z#Sa{>lM~YPRNXPfyHiEr;c3zI6%qPyOpL<YPF7N4nkx8ssaHgho(OqZeLGB1uZSQu zYF^7}yB;qFYW2e13hvs(X}+7qtoIi7*I(LBa?F1VdioJf{ItJ5ny^7{ys$vh?VEAl zo)zx6fo9G>)@#l`e!hmZRmT9$ST$IZ6cIYpsgJniY4`38FvxW3)R`QA|C*&X0001R zZ@d&bU59p^yr*qeuk(;nlG1hk+KqeKZgF|EO&!hsYN*q^$Gu<Gz&AVVZ=<^uxt*Mx z93@95q^ZI~W$(W7uausaDHj)$JUlJM*2l*aH)!s}jrTNco<4I{8R_X9i39)u1v_{0 zYH1IlRG3VrVhxaz<mu&JtnC*!u8EVO(j_~_BYpq?zyojIq^~t^($}Ruj0XxK5&(b) zMElT(CFPX%FiO?!_rTe}H#?WYNFIFrVhsQQ0E#U47i*I|+bEMt+Zt~n5&!@IhPkAr z-6-ub0002scOotAhCHkua!J0PqAORfmiBl6003~GyK?2Kl9R8?yL>sBE?&BnbMfL8 z+3j|vq@<Si*Z=?ka33mPzMRZ1E~-+sk}Pg+`hQ7PKGa@)4g&xH002ovPDHLkV1hOE Bxqbiu diff --git a/docsource/images/AppGwBin-custom-fields-store-type-dialog.png b/docsource/images/AppGwBin-custom-fields-store-type-dialog.png new file mode 100644 index 0000000000000000000000000000000000000000..296cd70671f91163293de7e68f946d483af014b4 GIT binary patch literal 40207 zcmb@ubyStz+b+6jq)WO*P&%Yb5J3TH=}u`7>28pgkPhkY?nXMKySuy3T)*$zdz?Sc z8E5Z3&KR#_ysq`E`OLWEx~}`42FuAvpra6@Kp+tG&!5B;AQ0Fn@TUS95quJc>#qob zP(nV7i6}WGA1pem;!Q6hogCxGHC$xB@<H)|rPuFVG7sfsOC&*;$1UaVp^2k8zSNfb z9-XHWRxXxF%f?nuETtcTfX(PN1Nq1o^e_7mc3|rKNhH2Zfk00B!96u_J1T{P!^GHO zfyHE)cVJ*>$e_Odc9bokf}IGN$`4Bv**Q5j_VtYbd2$LF6%LU|{I6da*2lv(Hf7ew z4cMaKnMe~=5pTTDpWmLGpCc~!_y2;W`OgncfBE_f78MoCsnfzOcXTv0?|=Buh)*<( zjDzyod9ba`4A9?Wi9Wf#5ySb<|N6=Y(Li5Hg_w!;`9I&GiBtW8e&9zKD*9jJvJv`! z`p?7qtSC|cdALg#kNO34prH2u9_ZokYdX4D92}K@zpJUKeUg+ki*`quH)QzF<5^l= zy}bqlaZFgq@TxTyM11ypO4jvNRqu*)TFK3-iKXHgy<1y73$N}MYQ@a{smFX8kf&z~ z6fd?s-g_6s7SR9wwPg0@sM(K0trWVSY=|HIQ9j<X_etT6nmy0;N`bjnDSiLWUSlx} zTdf{eP(TkIH$Ok$zJC(_lfNiTn7A*KMom@2$BId&s8F_r)<>*omvdJ`fxh15XHIMu z7E)MTjwq3N`L~=r7nepBPdfx|6~~-tY5(A0_11}Mi}GMKl*v9Ugh>}I@glVdF0`+o zCN8LCYX<KOVA^c0pljZ2Vq7<L&7w?v_`vF>fcax*4I<RKYgwJGV9IMHk=<ULDJam$ zCqkJg^n{}Ja`?dwF0I8C88T{ZsM2&cB^UEjrLBFEc+u6~uWw^yIj?Af&5&kuJ-3v3 zb*IIAVc!_PC!UpoaNYPSz&Zj0i}=M{c^p%8w3^>Y99hTY@)398L!gGS{#ua-E6(F> zcr2D^--LmM1zLt2a<w`-L^HBzky?%a{S+38KPwlP)ntptB2Iq6_==1YF+2GN9Hc}? zT1-U7G^A!S8KUa=y7Q-S|C^2gOpl(5S=S3#8VKH2oL+B(qAI%`9rZ}hhhnq)xX;Dn zfk`TgW&0Bob>Er2%^&~eRoA(3kq;Ojx0lGuen?bN*3vHQ95R1<qd!>+fjqa6QQ20B zDVxDORbEgEc|MzD3HBiv6b<dGYltfdU0FV$w?5gBy{stUT5eG;>?}5at9m-8-3)mF ziQSYWog)jLmayz8KQ8&BP~t{!PYnz!)t-#+M_Yx_fUcQYf3tGq$BGt+slL9C(Lh{# zXJ_Wudn^0%*mpVsh1<{Hw1UGvwLkJ>uFj3M{Eh3%WnyWB*Kz-jlZ)BYG1x(Pt`hz+ zjY`O7R~IQoIq)D<)GsZ(cj>ZKZ*eW{#8amw6z0|AT+?PDYc5)&u%Pd?aN5t6_Q}<V z-u3oj5wzgSm&ps3x)v7j5IOpPb)NfF^aHV~jrU*CJTs7P+{hJ<xBrB+qB0f_>00TH zS3s7eL)l^m=xra~zjMJn3e8xDopYl=h>$#8zmn>6ij43qO7&|ucwAjE3oDR(O`ao# z?XZU7G2`;0m8{ucn@VeCcm1Yo|6kleO3}$`&hK=272!maP%18VqWz~+T*R>b0PeU5 z|JX2Ih*vM%Ad@uZJC~Xx3gE&cv@9$vj2bo4ER0j|pUERsti3Gqmb0kTUs6{Sll@w! zSiQRyYo5+zru{RbYd!O+3%z83@I$udi<I#8j($Ja;;~0l`@A=WK2haZIa{s5%+|(m znnv|Fxz7Z?6G#SZhN6y5m!7z*yX#rkeRCsIa4BwDD?4Uk7hM8%u99s8{~jq-3aj!W z-|EtGdH2;h=gNJ}_O6h8lxU`Sg>}ZJn?>Ofev3?PKt-U*Nze2X#n9%M#ycsOEL05k z#7W==zD{pGs@1o5o%7~R<CfctFnHE#EKb6AL<VnI3Vp<jy%YRjgnkK2w3iM$R6Hi; z6v;Jkiq{T`KQTljo<`5iMQHy!g!uk4(?SDD>gH<4OX!1}uBqkE@TG93f@nD!uY`~1 ziAVN)0l-DUFngNoahjfBrQs!9F7qRjOc02wdQ$uBB0kp@{*b_*ocw}!a!POX^o-_; zgtrRlzk;(LVwOdw+L#@ei!3T;f}<Jj$5PYIdH*ka4|2O2m#{Nc_)18}19_T7sI5!o zOwY(fK36A0GQa&WPl@zlkG(^-2QKeuo%_`fO8SAX=m)tdQLWwUZC6rIlY;2>H$4%u z)k{>8^K$e=#>M-tBmEg0>%~4_B10%Gk+}?@H&A>fojO4Qxe$`BRwrYRMzy)JVf2{8 z4hI2rf&VkBm9aG%(Q$-K%dqBcV7|X<<Awxb5+T*a<5&>zj&OUr)4A~|<oinu@|@2w z5Ry2G_JB=^6Y!an<=;;<J%U{lcCFoAyzVD^YpXnu=jax9D}*Y6&ab%PAW!$Lw>IZx zy>qXHJLaZH2c}0>L<t~x8!>DB_3)Yk9=}m<9>pEHH+UaMt>al3i=^8KKZwY@Wd?5c zH%&j%W<A0bM%%-jRa=_}uY~L{^0$`H$Zs;yu3h+}ned~=0B?hbGPg%G9>+2Sxy6^1 z2VG>OcYMG0=UDC9DbW&kBHDCIX?^o6B*VZ`vz*!S2>Mo5^oy^Tu!&HiW(9dyC=<%I zA;>7wWqn$AGeFiQo&|yA_+zxK*goydwsH`BpQLB<cw8kG(sDs&;2!d-Y-DPAW=G>I z#(1tZ!e3}QKyP>|&Y0Z8a^HnfZmGfSq(xXcoMdU6YF8+g{+f*vcqO(H;`#KmcDlt2 z=9Sy&>{(idygA$BB^FJW@#;zmGQ`W3?uBtPCwwOzLdUSYCqI2Q;%PY%&*=xe@MkP^ z$PRBAu6WA~oUgcJV07aUuH`DNAJ%xy9_la7IllL>#mFFY2}rZNS5n1sb8X0Um6ND* zsFG;a(>k4`%f%*1@G0>=a$yoSi^bQYJ6d@bZJn5(x;ziISLZN~`TcdZEu8h>=^}J# zU*cM8{chO)!nDaqGINURtq>BXBI@Z`lJ8jiK=~MEZ*S-OFP_b^aim?H|3rUW*!p>v zA(1b*`)NJ%hT$UpIceYejU_OXM1nT)&z3VgTZ@$A*ID`QbNCcdo4n%h*ZZ^vdka{f z&ihZgTRm2N+$@C;>(D^L_I%#%GCt(ssE0sPDLB`e88zL9foA!5y3TejY@Rv>SOzYc z-Yk_nPC^=If%j{M{xTlJP{UtJC`T=2q3~agc6q;MVPq4j7fN-h&CFFKFzDY)9C)qS zy(*|uzLSQ_x*pc9$>0<w`<s02iR@h-hgY1=a~u}(&CbStXrz2gP)m&8#fF>ee8?qi zHOLEjWk@?a>p|&}!>l-8mwRmGiGo7<N9UKoy4{|hMv(b!369;_Uuw5ZdJ4RKX_n0E z2Dgv@44=*?&`>u|eW!pk)#^$3JFs`XSvIGmvQV)wJP;&a9hHy|Sp|~5^V1WjAUu^a z6JeM*^2f&qk8)(;(hMutIh+cK%N%7~Q^mxpdp#dEph28mhfoOxiwU~ojGbcMcF%Tl zpC0C%yWEeO+1KHw{G@0>^9>1PdMdv|fX6&TOdF9ndz83wc7z`$YhE<env_KUUhxw~ zsdkVsiRh}1i@T6e*aF>GIkWrj_yg4V#b`yp{ZsD}qgidGAnk6~`aRYz1xtX*-)zr+ z%WKd>0=G(W@WQVAg|=I@FmqaP=T?MA`~HBq!9wT~mPSIyM!7_*=qsw8A!Kp6PXq_^ zHzY^mCc3wGyF25HFXN_+-_S=+=I1tvc^ll9uI*W0v$?3t4r&XKk~Q*(<{H(J#r|Y@ zb|<aDK}CjlBMkP#3ieaIS>*{$86&w0kIQ2$?HDS|pJ}<G(eH?k<ZQ&!f?F&Ho-Um{ ziIm1H=%)?Gueaoysb^_|LE_4`k&W_j_Q)xgEYmhFtKF5Q_DEU7<}cG5=^#unKb_L% zeYgsp6^y&UKDwU(IVPBc{$3M|YU=^3<j?+c+iv-T#|P4!5sIKC-^MoXGPvpQ-x#pD zwR3;%@pX%5>5d-=#a~Xz)j3P17bvWY8?x6F^LkrzrATZaF%z<Ol*+j0v<N|f?{_RJ z!UjiwEiCbrnwbe1a}-la=64|}$9{W)e$e*FmNU6?vSP*chgqm?z#2WEF&9oUWT4)j zZs^GOw9;p+z7Q2&6y~TW>#NR))aRSSoi9yWLO8Tr)C;ZA{?^=D??=;zfl(NOj3+|5 zlBrPAmC(t3lIDo9)+IX@U;E=nO8OUQo>5w+OeDSxo3kp$=S~73ZFTSVp0$!ye6(#C zn4b5@c7}n81U%-hPhB3`LSxF`Fd^l)g%Y;CAB}XU{!lrcPQuvysP;~nA=GMU)L$Bx zN7fQjx2A|?e_f*UNetxm^Cc4h_Vovls4&XI-nyXggo5xEq!*n?E|)R6BlouSh(K4* zRDblJAaOOm;~xcV=PPpKK?*;Q&c^TVSpMR$@aQ`}zX>qJfxj;_#%6N|W?IWS7TxZB zl};gmwf0m2Aq<!{*#TKG1OhCi&S|E7c&tJO6+dmnH>?>US<{lThRZ)V0U3i?+2*v& ze`c;qhR`6Cis>zZUh7hK8=Hsf#mMKAeKj&6kW)rI{a73x&KyHiiQz#m<Y|}%W=iCA zm?Cd;UKI#NslkW?r-+%Eb0sEY%x0J!%Zl@2b;k@HiGV>>HK}8K3T@b`2D&9tpS-G& z>g#L{xM+uVeak0&fthXY9dGW3{$3{bIa5IR(?R}TUf$CY0m90LtJiN%HRF0jc9a;0 z7i(~xYf@(Op!{HYg9x=%KvP<;SuE;g-Ujo60Wo|6T@02QGsm(U8Kj3kmQ`@{MxH*Y z-n8>5#W7&p(vqKzOE$YOK3$77RXU*Dq3@$ihdZpGIx)38F&WX|q=UHsWB<^5UoW_C zgn2bC_V-&XvL^^+)Fcmckn#E3?lDLs+O8&eE|?bq)y)W9Q#m`_g9PU)p$L$!Zo_m{ z`oKS$!2`ML@-Zx(2i=`3>&HFK&x2h(glzdp#>|9%;H#)u<&!RnCtOiv)8+tiJ??jA zjZ9T<#LPJPXqMcA;-x+#laC_+WLJktB}HNfkG=;B32L~3WPhA2rs<dDRKWQTfwcQJ zUkW`y+WJ(H%VYDG%(J^U>pZuqn&327m**>oDG?PFu^AbY#w0u7xR+Dai#d1X%l~Nl zyK+-Jc~}@nZVjBg$qc%G+sCx2-Ur~bs9N^cRCSbUTgTbo@Z^#V`Ta;2VFKQSZe-$r z2v-pRb0XiAMFrKv@JsgsOx7!_qt&r*z@_(hFomay8;9txvu2+$-_$p+yk=QfI)*;U zmoD41*Vj`z!G$lueC3!6?|;i%ic`Zp_zIr>U8?87yQGRMN<s^^vtJnoh}=HJvjdZ# zSyX%O#NnM8**L{U25T+aW58`&d$+oE{pcr18iX7E>RN2=&;svee<8txN4!ILoQoYt z&DLFQKxGmWV(7)>y+J5jKv5NJmmi(MOcun+(Q)#Az4M>6l8N?b??}w!qmmu&3I_6Q zDS7JH%sRR7n;B^Uc>McRgPIO-nhogR(g(&C^8&`UE+2r$#{^~N&T*VvVX_7j&sEAH z<R$}B4E0l3+$^qd`eU79<hz(^Yd8Y|EuCf&XzSv2F0(K5Q!f^GPJm@5uPLkGG*>p) zjTJ=z*%@P4d5HY02F0r=uOy+@AcL62=FCR(6i%9zRGS?xds<W#6=mV5+uyr2{*)>7 zEy`+0#i1({&wV|<TR>r5s`dlIn=mP2eNmOl<9LD3ol&0wsQfDFl_k%#u9}?`?wglG zsH&o`VEFEM{$xhH${8XFLbAoQJt-Uj&vSV!Quwb>E$xhzKIJ&2DEInHyV4D~AT`E^ ze9=AD4bHkDeM4VBjNX4}|M+F_BRF!R-j-_7i)@+;k}Xt_xU6)f3Xeq3u2^SgxCQP- zERDB%B6-x;+KVmT#F{B7zmcaZ6y0mqWc09=$lULjWXPCc8;#la!#cC*@9#HbeLp2o zWA*JWEtWy$k3nxZ(^73a)i1Vy!GEw~T16O9!WPYb6gAprWp3b&KaOXy1%xQvU?|LD z<B}Lk-@;}<U|}dEvva=cxSJR<`u#5DfUJm%vG>UAFK*~26F)5PqeHBV2;o|_$%xU~ z^cf}`?zafZBYF{X==}@EFrNxgUY2Nmg2tnzXE*wukpsB$ONvLr+K2t$#^}fe%_A== zeb|2JzxQ2T=u_=OaQ+aV7&4lvL-#4UC_}*%%Y&VKc30u%`pTk0<|oS6=Hg)xic$Pg zV5um8b}?PpTp|o&>F-+HyRZ|Hja}FH6G;jlzWJ58ZZT*a@zO0dmSxGB*iBb9rNVnb ziHAb@uArq9;1s9FNBITh``%M00iK2#FP3!dIk00z3iPp~-`*`8Uxsy*SpTb0F5GO{ z%*jT3>QV&E*Pb)hyxmOl#|&I(3O@XA42Lqu8c{tfBEaNEO^M(;dW4e)8AJ7s4TA$s z75XF@+6m3aGWEQ@FeyB_(US1I%GMoi*K)r#H8}AU9qa`VS4)PN6C8=iXLNXBdtfCH z+WNk>puyka&)Vm>ed!C9SkgMp!Nf-JHI|+*SbCqSP^o}whzSao8W0=o;OGGNUJy7O zEA-4Y_WuMt%;b6xqHo458quO%X0@srm_7boOv}Y9-8%)$>8nY-|BPSKAMxov3cTw5 znB)`Wm+b!9DL?oE76QAWyc|P|RM*I0YR9!eu(UNhjQ0-xy8HAv({|GWR+E43)s_N| z=<kTF@N!<mY?KXSg3hJCIQk46LB-Om<L&s)YOevC6*<vO%YAy82IPx5@!!l^Wrlxo zEM_YZV7=4Zy*a9Vv&1vof4!C(&6fJDd^o=%+v$_6pxLTQ#yWL)O9Eh{+VQK-g(7{o zmIEy6ktHBW{Qy{Hl(P*TVzZY^_+xhqC4w1a0m&&?DLkuA!ezd!itEGldq*f>s?X%U zq%|}SrP|hGQ#jh>DqO-SnTp3J_PHTRxN(?p&WkY{bg|1@(sVk*LFkZKZ0~s~A*WW- zg_LBXzYwZ>b7g}Bf$A`TF7HgXo>N477ghs!ibx(2*w&&wl(e>aJz|~`4pZbp(xmJW zgzD!8rt@<pV~OWck<sPqI20!Hp>C=GC}JhavhO22QuIu<$Y{Q^hsaYiO`~3@hhd<6 zT!dle-2Rj~C7L@SQaI+_TT1@*aDIYJ*wY<B2*!$#qnLYIqHL?NtWp65BztRL#fLX9 z%^n;MXrWLX5X_G|_nE8f$HSJn05eUZUfXQxGFluk)>(fr%ad7J)WQa=0OPp+Cq@bx z>+YtocxW!&)@s`o>xLn|fy>VO87_7zAvr<oZ%I1O#yH5gC+I&U02JdXV<LTjdEJPF zd0N7eNCEk^{{4it8LA5`2&#eDa+BX!XU9aQxOEwrB8G;`f!%O<)#k5rwBo6w72q4q z$#?g_cK8*@g?UoJCl?N84k3a-#l4znc6DUbX(6SK${Q<Xzc@SVK%#JiWGl?>L0%9N zLKT^#W#^!oAiN9GnHO4c3na<9v%~E;?t%A|X9t2}T5evE@{3rby|}o>2<saWY<<IT zI#BKIIu@mTz9+!aVTes9OpN@~^rKpT#CGO_S@y&Z*tj7LjVDFsN0JigXY7#W?}&<4 zTPVWh^Y)5JedJrGD5TSy^f?APl+8n(AZcdKg_k0d1`XZDPIXIj^A$p9Dh|A&9X9N} zlit#OW|?&-@57`2VLY2BCG4G(XyGI^Gc6pHka>-@s6O4I)j3$`|0K}1PZNLy@kGll z29`>DCs?Cdoe?IkEwtk+YVSv2Zo7vV*<G!4Pv2#1d&$TZRtNErMVv&R#@Fj&i7r$4 zro!>9=BE6%)$M&99~`!NU=}jI_FYrZvsGqUoIC;vm%~6+HF4$6AIWAH>xG)>>zo#R zAB+^zlkpCbo9iT`lhgU<&Pls#Z1x^Z+8k=As(Lc5qH9LwQ{Bu9COtX7*1dkJYiSO{ zfojlP&xsVakBE!=s@XJI+o_txtwAM%)+$ftD1|1z*@>`10i}G`*Wl*xgef$23KxMl zTXQ;OY{EsqYl9rXKu$ir=J##Z^ZVA6KoJxbzqP#<Z(S8SIddqu7QhD*>TPm!eB%$A zCbtxMWd-j(ju*)M9t0p26Y^%$b#WO3rb@^~g=ITN1pPd?wvx?$3G(B@K}_v4LP<(1 zbXT10|Jn>{@Dc0p-)U3<1zvzZkpzYR$Ihtn{ku0}{gU)pFO?r*mK{GWMwM0*5upO> zKqYf0wLKK21}>j|Tvp;_Fsu5FlP{SUFNEdkmO;hislR+@RITF+C5BR9$nc`($&qKy z3LuIf|8*m2>PQn{YBW{Zu$H8@Mm$Jl4;8fbi3Q0ky0j1f#o-qg@~_Ja<vW+YyFLsW zy_R_86p48~GY(+19X@(sy+2#a!}SYj$oSCss@|RtkWJuYRy4K-X0*}dg2i+m{BEdh zzkiJu*CL5aALXl*yoPH4qydd|k?eWt76pjJtl{piWW6oT!%P(19LOw8glHte2tG)+ zE0;!@<&KZmH?A8FC7}S}{90}#`?s}W=BtMbSLS~B+3oVLX}lU?=7=0conxHtzYq~t zHqM@&SP3kL2j-6O<w*_4C!~q7{6Z<;2<eZsqM=S1NFY_5J`xbrnJb)!z2l@EMCmEw z4*b4|MO-)m($9_4vH48p6C>bsqxa&eqnnv*mP-cHg;D2=anr3eThb{87G{2_a7`;q zpM8M3w!`1Vz(}&AvA3od(!SofKI1rj(U9~hxfr^^e@t43HKp>CehbDGxnsw18Q*L+ z?%(W1Pq@qzvuE)4NTd2V+ZhW}f{d%VmYr?HDmxO8BxDY9?3=j$_8(~aQXHzP+(PbQ z>e(M{GtfZn%-QMzhz<$l`ah!ngE0?#`C=A>s|Qx7Qsx{W(`Mw!O*I}?{6R6y+Q^j5 z@JZ>y89u6E<>C|#t|A49Vafr2=&8gw{f<q?Apr07$4y;6M7we}K+J%Swz$$~T&x`E zBaz)V93%QQ8%PjPAj;>&yYr>5s9+qh3Zw`XLE9hhaFi%^1CgmQNQxZT3xcl!yO99u zF>p(<9#PeK6<L%LKpQpRfYOdX7=T++D_<@%E3awEowY|!lTyOi3<l_^E2mCn6>Po| zCKAnZ=>_AIn;saFS!c@{a6_v{yAV*}q4#fSc-Aadegp7<1d&2atWw+9BqELp19J=* zM_tK#FvbnADHx?|Q~T?fwkeT?gO(z&$a=NzK4(>>$N02fU%&=sO1L6<G^UB_CR9_r z_DYeZr3OEm+9KS*3N7%>b=Lb9YZLVl_Wz`pQ_Jx4pTW~lYB;wc{{EO$*i?j4F^&SX zjI!9EealH8z4Hno?JqrH<16RfoV2pE4-IISN)Jt2Bqj!zJ)9G<au85miZI8Za7qt_ zu8z%Sw40|Zn4P@Q`svf80HhgYKUjd~R*v2})80RUx}2%!E|Hp?k}@$qsItkb0Cf?` zQKx6hldSibeKgyvA95)z+0`F5eqM6SZD`nm@>gWQKfh0AW|SL5F+eya!T#JgMBiTW zoE+fj#o&YFs<=-Htr{Y_Q)8cn>J_;V|2Z_5`R=axTw@3?;GUe?UrPZkEDniK{fab+ zOc4vcW$5){S$UOSOUL)a;hPODytxMIpbi_pn-FH)RDkS`47B71e;NE=rNbfR3A&0y zV{xEYLTe1@|F1<ttpC5Njaa@hF)<4NUAYVxV>A2jnIKk_m8JiWI;O<`Ngeb5$0^DO zS%`f$RdZGGhHlG7f*4f=cJ}M+LoEdGS8yCS|KC;B|Fzk~pO_xoJl<W7?*3Rf#>dCs znXhGWxjtGfINaLa&iwNSR$E)UxL7}_{>LuPpFe+CU9T+a>gzexm1(2(wue)k?hkAA z^!3kT%x3srym%259NfN8Z<jVF#6VAvMMf5ul|{4jgYV|<u47~b6DJs6fc!XrGBdkM zo#|I}bW~InOi%n0I|&KNkNqk1+1c5$sw%&b5UI@GEV(yeR`xtRJZ;m{1a2))%YMXR zh~Nz?=eH-9m;Q1$|EwK{*RS2f5;#mcCMM4FCtuOgA>CgeZ+j3R!=GGT_3VsgKEJyr z19^@i)kSLKY;(Z&V1})$r-z!03qQ@{?yZln@97Zta+O(Qp>nZHfnLtrP&P)*IxGg2 zlCE$v{zOI{W#xdE49f2_<OKZZs>AB)cr50scJmKexVZ_;r;6H7Ry%D^Rz$=kB-STY zbh`88GqH$>UKA_OlawieCV~Iz1^9Ew-ea>r#dNUPNbvggYfDXYcfJ%1d3kw4ZY$EB z2#V5cyOlN=LlYB&p+rs|hXX<-`mdSu1qB5ir|Z48$4kvFaEa>0Jz$ww`1n(6b`#3v zt;gmb^b8D1n%sPR#4ODh3Q7OgS33h$>%YG)(X98GnNdv^aK?$IlkKUqU6<3=UZTBs zQfPU)GY6&ZmgYhcWU6Eb)5M#TPE0n_aT>@Z6Nh4sbbHR1B=wiDDy7<sMVMK+n{(CX zpc3CvSlaTlSff^dvfwMU`g?5lXc`+6qYLWspJZfuQurN50T4a8b;BbdFu1=u3<?T* z|NcFssHiA$Ax@JyP$AzhHuhy`XecPz=;={WQ&Y2gJUBI1#Ky)(4s2qDbhC1B6jm~U zxI8|tKuALJff4^h;pCs9A~afBT2^ju>oSatjEtLu$`M@?6BQFz3XdBq3kwTMoM4Dj z;KH1JiF311C|jQ)d)}lOAraA}TFKbAx;u4MRe{N=`MK+6Dil;y+snO4uHpgiWj8nt z4Gl<J7zsBPDQW0LuB<^%D3N7DT20KaU$FT~b4!yTXUa5Q2jd~b@61&*ydy^U+KWrH zoUh5ysI>x_1sM%ZOjVUo#bYAp3o;6dPj>d}o^Y}d@FffcSWJMR>y^zW4h{}<jnJCo z&CSYsgm6i1_15RvW>;=eQPDDwN0+|M@1(*Wn%2&ek|^NksDJ~dr&A^iy5hgTJdGe^ zgAK%_m||$PT^DaU?IHP+nl?HrXR+AuveI}6`bI<y(!AQHx;jGZrc*>xGP2d3ognA) ztqibdkjVJ>z7!5eN5^CyThUUC*2gOnSU5P)aR8kW4IN$WF0VPV0UGe{4^B=z$|agF zJUu;+#)^xJnUsrEy`jdQJF&XxxZIubAuxUHTN`2L<^J^PxD*SOpdi`zdeTORL!ZJz z1{$0fz+3{r!dF+?eF-^?(OPb|NZ^r>)`6SJ(Z}+5Jn%d`KCW(Tz=Ib&-0hcw59RWe zX232q*zX4{HM@4Ux5HRjS>0Sr$e#8yl(sD`k#`25e^642X+N$%JNtexUyC_iqUEbx z=&#A#JDkF=XJmwcgoGrW!uQhF*7nj$B|}d4`RTE&rY1m)y8U0iqV3io(Gh7+clYY% zZyoTNH`pwP<0bTZ&80ikf0CeA#M|5Z=IQ>JO}`5n9FKIG5LrS(0?&^ftR=VeFTe#~ zv9e-uTQ7<I`0-9Wl+YU(8w~h~YMCw!*sA>6p_3Dvi`@yNuV24@IcnV^UTSi#RJ)#5 z(Q)^mtu$FLu3a)yz8w*MCS_^4`LpDH4z{g*d>jY-jT)F?{TZEXs+gP{mXiSa-Su%q zSC<&1?dMB|GWUCjgV{<X5fPDvOY1y0cY6flr{`!aQFR(7CSSoXkeTspsabD0q?zkw z&yhGLjh-%jw)s|1VS~`}m>4{K9Gnj7SFhAS4~y&h5O;zqqcL$<z()xQ4#+`I7)eoj zy4T@SbCUb*=I>Cp9_3Q)A#LZ)mpz0A&d$!#jQEuwL-5PNRPf2khk<>ns;ei8*jw(_ zM@eR*LGG{St%(dmhvM0M(J6$IHA)on<7;cVNx*qGx?VGf1O@4~x3{A~7?_!jK@8Og zf6=@JEi|<FA+xp19`if5dZFbazKCq)s)HU+w<h=$6eGZHdJxfxy9f=W3nwcgBe9?h z(AU>j)zl<S5^!d}zns=l6A^*I4e7Q35s^_?IIX*@i`ClN`U-r*(L*RDBV!Di0UM{P zpn${ga`6T{$w*0={&BkxOEUY{;Y_*jP?~VsOFX=HswH)G@l09`F=PTxk@=HmITO1x z)#lSPg9#jJ!1)?&R$-xQ;kVzz3keR^)2Ok~TXw%DgRV`Z*@Y7o1H)MO>E_iyU!ShY zNUD)9BDy{j2B|K$)q?JPjimuF-vcmIQANeC!@25^`uh5E_xr1IkUz?R%R)B+nC&c3 z24@~_&u4*WsF|APYm<GYe|f)^WUcz?6Y~9OFU4%WVs2d;3Aa^QQ<K0Ep&>ibe7zlA z(mPWee&;iqknnKhG|wmABz7YdsV`q9`L+E;+dUpHRkpUadK?bty7dhVW`R2;Bqfo| zH#u_*{QawE-TKG{T$3y$EX*iZCPg1i$nfpkx3YI<Y&{pp_jAJC-Q7h61wUbQn_VvT zS65dV>FIw0b10uIRH+1$r~#p8Yh|Sk<okGOS_1+WZ9~WmNF_776S>gY5<--fl)4VB z`(xf(94*w_@7aP>-CUtw97o3Q5DKFUvat2kBZ8OvX*U5QFK_+q^*Z>KDu_66ZNPT< zzi%LeI6`b^W24*Xcx)WXc2pNmF4&)?@D}<NIL-sGZ{UXsLkS##UlQL1fBg87Q>~?? zf$Qp-4)m5$GYLk2)DG4^#G!6(Zmws2g&&gO>k9{taJ64aNvRB%PNvLmdl>2+h+f$_ zIo~Ppp~o0Ku<0^iOhzsI{9p$TCqW_K;;WX1i&c%)Vn3t|gdE@$&|`+E>g!V*gxXTj zf;dxs72D(AS5(A^=+)iR!`?&4?{q>5rdagnj}P0_$*o?|ov#4^LJJP&Lf;4t4nW#m z2<%&*D%BZjYHErH5~nuQS4sGOyaE0SjE^1o!auX>rL$aY>cWD8nXRFuS>WJmpFe;0 z-AqJ@+8#+W=?ug)p_570g}P|5GDnzrCjd<Ru2+mn{Ep0^>(3}VJKJKjKh|Qo#eKmw z4@|{!p)QI^rzII!eVJCHL;2T2Wwr$A9wqvh(6_r@FFJx3yqNg*?qH_ez~brQR+>I` zZ?c?L3^wn)(rl7GE;hEC>;v$LBrZ#0s9!j0f#Y!9PH_a!_o{-_tx{7~7704xLM`X2 zg1;&&gRNj-VKJfbd|;ceFhYge-SbVa@J#FTqcuJOK`#I(^>!EU1U#0fAF{HtY^d0U zgi;w=T`tYItQL5{RznvEJZPaJgn(tQnV?#o>HO?WKZ)BK7{t}d>IXzG5X7eQCB6h* zTwNJ^cz6u9w|m3r0;sZDGyU)JYh@a7z(T}&PnbcP+u4ij`~A|^;W%ckekP4FUGJru z4<A0vg2Mpet5~(%$3Gxo&$6)mEMmI4{8{(~RTq}&ZUQ4cUtIOT`T;r#7bQD84uGSP zlG#qcXxWVV@vOXj>+5-eZTy4+h2dmgNCCxpI1vZp^W(8+xx=A)P`AExG7mP$rG=G` zi4xsmmt?LAga$JW_6*`-#QuJM@BkQgc67i(%B+`#Ad@Ng-TG_|j>p5rDy|zvjg9=q zgYn*_Eq5r8GW&gHM(rj-V`Jm6)HLF1iCuLK4ZCL<S=m5UM)6YZ=DmOXyu3uFrlvLy z4qN2*Eb3LrK>ii|`t@Z+MFlI^&Sn>(;;|N3ZwLkkMjt3koUR}VrA2_?+VuQ%uL?pz za&q#?tVtRbH+QX!n!l*`!GXmm8k{4-u&}VPY$<|`jSU-jYXn#rkek4NH*PIUw|Vu5 z2j$o^oT48-P{m5N6RvwelSi`(B)zH%@9*EgglziowJff#t`<v8L?HIL_!{A%Abhv8 z8>_c7IdUJ_KBvM$hA2fmcpNuhrz_;I93Mvn<I=4GWB-D&WGYpCe4m&mlfq{^VBTtN zX<?DLpgnZEb$;svj1`=L4nQJ$0RAFlV2In;*!b?3s8^$;xnB`o9W92qULURYMZE$o zi9-#oX4hey7as4}*v9q))m_D$Kq7$##zoKY@bH;RlZd7D)44>&76+}QduaH07Z??l z_joV%Q;Zsoj1Ld6jyDVpollSV*f=;o945oMz@%<&x6|q?+=M8kelvd*6@>+4g$gGa zi<ns5BuUWa;=PlTQ)B3-u+UI3kb_EeTEnAWN$79%MG^8lFhX<z4$dnm5FJSsr20J& zm72P=;(*Vj?g#u50AN^bZ0vYpPa()V7mvho0G<IH6mU98AFfChbnO@zK;`A-?Hd`9 z@bC}<sesUcm5ogVYy%X;B7PW)rolrQE7ssPG%{KR)-6{!=`s-V^JgMw!CY4tJeYZB zz1_CW?)YoK!jSf-OG_(DKGFD8S93xENK1oyF}^}R-qh5Ttff~>LIRPdmX__!iC$Jt z4mA@KIxw(Lva-EZrV|&4!^r-k0FP&aAhu-QwSKy?y6O$07d3!^in%h~P0r^wAOPjg zsoZ>a-i%d=jEf6^`UyyjP)bO`Bn+$)>K?eX(q5&dEY}Sg*DB^my}js!tPoUu#+9Si zhX*&-9-Gw;f3CO73s9fTs-Jr;mXno5$;^xaA}<ff1yjWufiG}r+vetoudc58hK4rP zT@@4+>o14Xgd=2yAMpT>IJvkG1C*mn-!|ni0{ABa0>Vs{DQ=A9>x#-s0HCe^&F}r2 zf&xL%zZer2CrTS_D|~&t90*_~h;1v|+eqBp+-?u2y?J?g@4>b!7prI2rciwdXq%rW z0rPL$_#0hce?iPI{AG8knZK#Ixg11HAR?rLz?*brc(F6~NlK~{90%}|jInPgfK*a~ zgNCqv-}nS2cEAuo*{ja+cu6tEDhrrYJhwGDK$O9m5)q>Gv7#ArD@Tiss#V{xxh!V9 zKq69ARi)(Mzy*r~Oa2HL$HsSFkO82E1|TRn7K4>GZ|ETZ%s9d4@USr80ZA#T`t?N+ z?E#pQ1I#r(p3rI~Fgtrwk=K}xj_%@knWENuIY5;$AS478cq#x6z@{(Ms~8y>M}bL! zWI_gLY2;tSppcOD5*=GxHViU8KX6Px4rZ`{V|1aiG@U4EP@6Aba|#ccs&R2~i90xO z{R|1I7txKVEH7{W^D%_ge2Vc69tyzL%^&UGT|Ai$J>Jv-++YB(JQQgIVoUjZpxk(f zcw>7T?q*%!-$L4#SWiv6=Vuzf$St$qShq)w$JCUR5EvMkc#!T8G08(gfQCTu8C4-B zCMNMoNtpoL%+y$t0CI*0Rz}ME9Uh>eGB5!E!^^D}8~En0K|uuYyfUK!{P_6zw#7v< z6#qYJ6RlO^APrs}FGm2_JDG4(Z$4c@2vRfDIv_kC!Q$ZJ>gnmh(9z}cDK-O+&~&}z z3W%y|lM~yui@|p8ThJE-^28fPMnAxrz|Ps6u6?Ylt7`*}TV7s11GXP<Bfxi|F`bze zB=FU)VBDLX%m`gWLqEOF0ID}{^1f~lVCCfGKv&oDa3*CjQw9U15fJ^M{1RY^a!}U; zW9pu)w1e!61jzKt-rmolByPKTtY9(d%EhR${Y0t2j(9=6V`>T?G&8?9GJ5Ui?hX|> z&`5c(?6wA>q)5-wG7Nw({i}mnLLoP&B!M2!hevsea@A0ORDzDdK{SvtpdqH!<B>8} za=(f^F)>m9Y~$|<*uXY#I6%7mTioy0fD1qhO5K4?xVgEtfpD<00`Y$D1ws~AA+u%1 zmAlS4E-voGh6|9Ad;u0aI5;?&kQL@swE_+fHqZ$m3F2g)rhEg=izoIfH}~U|#0n1M z!8XTb_do!a;}a7*#>ampF_Pz52?83;2zGI8Z7q@Uxo+#}8C)(H>Xwok&`nJxKh%og zLqS0S&_VlH)0OjlMUcE{FFGj+)!f`1j6$p#cyS>u@YgPL((DwV2q0DwkxB#K9g;ss zu5D>CxxKvw>&@r>p`xt(Cod2A=;(-P&RRq64PM{ipqQE((Za&Q%Fa$-ig1cdAV`zI zfja>=1>pxgQdV0VSYFNsU==$DhrFgH8YU(t4<DaT@47czKyorE2&8|2e}goQXn+PH zEl4glc6Pqa&4Ma5;9Vg6f^mR^_2%tcZ^>*Q@Hsd}&_^IAFAoE_ZL>M(m<D?sBWaXk z^!`#H91PLZ(*r0jVnna6OzsCOE9SHFbAZ@kfRX{s^V>UOyq7O+BbJ>7$omHdqJWM8 zt}Fol5280RJnYQutgQ$;2-(0rK$v`(aFYsAF8l~w;Nb9(gwgJN>kB*r0@bTmaOC90 zjn?SRt?I7AQ-CF%?2NtoMDvSpIu|H_p=`}9m0_`^5me8fIHI52$2ltG)ahLvK5SI3 zd=C61`f1<v9Wj)y^E)1ifmnA6cv`JvERZc(ifP4a?%RlgDvh2X9RL(5{k5*(nF=E* zR~69im`ZYZRvic$Rh2C)ErH#ZUzH#Nxy~`~_5aQ#l5an_ObM3htiK)8N8%?=Y(8F< zz(OTbi2tW?=HV=IGwA1kpu#TvH=`hF*%6CE7lCL=sez}n-WhEH3xWAYlq~<9R7$_d z)_^Gw2AzFTLviIohbI#`1@)<=uQyWtN;$QTFF&DXt2|vEyMn$M@+$M7s+tOm$>B76 zH*W}EaZPjK>F;++Jo(Lq@74R%&!=0CKd(zmf6+73Ux2Dg0&t*9-t`g%ygG7Qnq|}# ztRDH6BlE2XP;>upH(~zQG~54$D>eU51JPOx^_Q2|>Y19(D%(R}i%cc!ElvADPA&q! zR7YNZtN}}nHo9|g;SXmL5W=8et0hP;6<j(CXzz>CKtM>Ualrl07aMQ;hlVUC@3^Mo z{?YySVTJ#1-1x!rt#<jDCY%%+`UA+r@d*jlj$c!M_V-HyCGp3>&g{4Pv+uk=_{jV^ zw%3_JN^RRd2NcAriZq1)Oe@P{q?gWsX>)V)<a{4d==s*vFDxR$ydqRGJ0L6!-AQ0c zF>kCg1I+g?`wwlXUVbMi{CUrjlZj~rH%xrOkSImwS`*=Q`dxgIV!$ve*b9Z}^VppK zoW-Z4|5*h1pO={q>Pb}3X_AE<@c}*QYOqiHBQc`Au;17+7mi9W()q6o=-QYV7~%0k z>#yOFt`Q)bjV=iL)6Yn8ad8lc6oWY$2_GqobSkX(`%&iJar~o2srNE6T<|`^OWGjv zFE%1kvY)XlNxpP)gTik{CZ^TH!_F|o;gNyP%w&t3Tl?N>a}@{#NLZkX0_%+hkiIVx zrseN-vrzTyj$71iU44C62)H3tR#_S7NMKDEECxw;Jm75jaTSo%$WQ%><rQT*(zSNp z*eIW92G%w1F$@F%B#=hH>p-ktnV*y`W#;tpy&ugp2j1FMtWo}kg{9O{t=4K$&)j^P z_Wmt^vNtP2pf)h^jTeMQ1{LbPCMy#YOyO25ONHN4=~%OfGHF7=*smnk2NM)ssBj?0 zBTppSPOBdw@72vvxGd+q*8Wh367iEmu>SEAQn+8RK;GNhVmlnq1%G+gin#t=?ACxZ z*2Cv`Wo4tDvDEIaYijxeys5(nwo6PR!_kH!sM{0%4ahTSBwVl%z-};6QP~6p1X3jz zHTwJdf(k3eGewMz5lggMf5N~aepiH_ByFT3R`2~gO9a8f#s(sTiwI*0Mvz&oWGOQ+ z<U~4JT4LvVaMcCq5N(Uia6npyK!#<8!vgwtcJ={?H&gx~p{>mf<~VB@^zYldn}dl6 z?3qluP*3Yfh*wFA2Ojk^%J{?tW%S>ZDUA^9ySrsM1qCz`l6jW_7yG?XOks8Z?BfTx zPKnTh%7v*ZjN|53SWlfQNO17=SasoXbcsjf+WD=`kMBO}nc_fq@bM*SO?Z+9X#rex z3;hY2pNx&u6?2CVwO#|u|Dsy9!gREZO3)Mz3IZ9=UXjMdNr{QD^_ov&sd0}6r~I0o z?UjC_h72jZ?l?f+_6-hx0o1n8^KH-0P$Cv?)uq{4gqoTfr}$X4<L?=AL10VP+S3HY zwl+6`+~ae<*wcf^%v^FA7yF4c^5#Bswv{-z3#OhoqHcL&TtV0HqE{yxu=cWw3acL^ zOllIKZ-a_T`<T<(ngZzWL<;U;maPV%t21MrJa$`nAh)foPrO9MZ$VH|;eI%IbmXz$ zg9o1di=0Nkvxf-~ZlDPxk<%;%1_!^ryV{RveYDh0IWoIGdab)XY^mDnfg2hYHov>0 z9spJakfoTIX3rH_BLrg56W-fk|J-x2%fiW5o331lP#RTFpQQd|0<Zy$E5GZJqoU#j z;sARO<biWr-%vW&@td;p6f4K$`us1kKRM5x-~RFmkjsM8aXQ+Pc<mQi^W&m#1R1r_ z>+7>R99T6FgL-~$9<LT^xw1K*;VHc>1bNz<*X{`sQs=^n<BN#VUSUM>UR^cF^XVLp zho9HrpzejsJlMI>T3O*BGr<xMO~VZ%&1T{k`Bhjg9-teb0Sn+Q*$by6U$7c6%@+7# zWnY%og^p%rn%K3iAreqkC~-_FDv|~zjk-q1_u5ugDVy}MDBRZF-`#1Si-3Ganv$IO zwI-dCVrq&@wod#olTw(1t2%sWcz9_=D2hofH>VH+LSBvS#g1MRn<tf~)*=KFP5Y%M zc)fLHJUb+wRS#!ya4>z+tllFUAbM&Lc5SbZEJ552*6S3fEKJRf1VO3N6Eihp{rq-k zv>grz-l}&;>@j!*>!TUZdWVT$XPS&O8ZkSvv1U<BhLbx6SVjVLYL6DotxAr-u`8uu z{U!XMFb-$2R0We^&6s!H7>|mIT5i{?d~=WVM~dK>PW$-^;Ec$$w7{4cL#wVk9e>bV zD(=Duh|B{V?0h31a8GrS47v2IEJDDz|G5gXmLYvNvsWuPynkE<btF<aB#fR*a}~g^ zjcuNtfGHpHJJ_{0HadFw`o3CnTIUpSi=SM9Oy&BE8lq<B(7a+{!NjHeGPQ5AwXxwh zI{h5*=MOcc4O7@H@KqotfN<?&V=t@+b@B*U4XnF#kIYLUd8unAT_;iT7x&+egezlW zXtHv1ZCj_MPvIck`hPBSZg%HuDF%m_<_Zfe#fz0+F&@Br?Y;E?;A*V&8PeQ}XCB@x zK7=P6!GaqcijBiw_SZg9@i+0iZcI=D56#biJ2*5H6?5^vbnMmJU6=qgBIVpB(8IUd ziBxX8j_>qHPTG3!KtWHxmnM|Qre3UkY}YlofF>?3KAJbl#Ph4>BUObzpZ$>!oG^L8 zc|&Y0r-#r314OsI<D+VsjlA#tjxZ&>M0l!`zP$yDhsPpuvWxCYTYFf^{?3NdHk(DQ zI#crq{i`VCb@Kh~v$~$}<_x1RDJ&4eci)2Ap$I`gUOuyT?WVMqlC_KuB#Wb^`Y?%z z3bvi=u^DmESHK%td!VTqP@A9ql2-2Zn##xPCO}?ty<XctL{w2y@{46y>RjuV8eJ5I ze6L4aK7PjMs;N2owypfh>%Z{Ar|7LgXLNo?tIno+J4*bJ428mzF^OlNX7@|Vp7f>m z8|O`t1*xE3x@WbBRu*la!}%63kkb5Msg&qn9~{26uOXrEBuH~>LKJ@bQ8)Zs41iv} zDF(Zf?x`<t7?^-r1xQH9KAfi&rUlP(IhmRg4Ng=VMf2#Og}j%OJLW1GkG8+RD&})1 ze%ed48&t@TX~a$?7~(bNV*w^;rkJk;=u25;A^&NeLO#4fD5`HL8z^>8Yk<22qGLOZ zv=GYZSZ}te4Ls|imn5!moq_0PV-5e+gP|bxpG(l6?1IJqAbwa~KNpyCBePUYM2Uoe z+&0;SBJ^=&vC9@fe3xk5=gGIR{l;Ik>9LU0JrMbJg_t57m8_8e2jbC^%8HKW&^NG7 zKjVGz%NPLqYs_yI$$;Kuje{#XiMeuxS9I@ixb{mw{AcE$w0;&8Y_o{X&CCEIN%e)m zZ8%7*2QU-UV>1D}ohB&0vnP5HmfG4o`yWh~W$z~n^FP`O>XZeCYs#xdGOE&x_rR0j ziBwn;jU;93%&$}xO4=AmfepAOLJa?i(L?uc!_A<NL~hS^CNF>|CSMG6EL2R!Iw@E! zHT!DAcpqw^|L1{L(mmY&(~II~1S+7Cz4VoGBjNouEY;-Po;Cn#eL9-XA3uUNiAWRJ zMN~f}^Fmke|A|B0=~fJY42}KLKI~rW4OT~gKgtmqUt3R4oU2y85;gM?v&$t4Y})b} zBe^XvDMons$?5J~fy=bR<=#uco-PjOWsfg?eB5Ygx;mGIAy-!;N7G+_T@ip&W>-^d z9stCAtWafCu>_myFta}G#ZXivR>aK>kE({oE1o(`3(G@wrQG>KrThQU3vhAqZb9l( zTc3QUo`uDNZapZJP_eKOh={b8RsDN*fWoSi6V~`7jda<x7Idri&u-$A4%=5uSy?%{ zb5%r_%n>1tA^&3V`V5U&Ys<VsLKyBY_c6&Mrq|q;TI_LUhKFswf44g2`oxJ66_H<{ zK*@NZpE8Z$27`!B9tvW+SMNHNfB;%l6gFU`=946B)NAapu(0zyV&Xs*6M2J2{U(q5 z+67eKIy#s;W@r6HX-t(Y4$uuvgo_;20x`((r~$DCEBzw>2JdG1*~1S=<b(!0OM>a$ z_J9$5RJyQ7BjQ5?g;$W~X~e@x(E%52{tg-*^z;bY2|G_#UtPw5%l=f12h;$TEbO$T zc9|$y%8$uEk1VD1e*Aj;4CjfChBl8D#M-%5R~Gc=lV~LEn;@E>gc;NUbw(j?V{aN0 zjcUz9Vi&DK`~srlT&?Q8vKPI^-@U|p$<0L&=}xF?OjvXK@I*PR;(%y0cJCoXF676% zeSX_Cvg$VMJi?o1hXG3HGi!D|gg9#vYo(PY>7}`tQssous<`^x$Au<aGCjMF`7i0m z*N;=jD+2m70AtE)X@$WdT^rokm<%T1K9vz{dt$tfvOG!Rd4cQZCa<9p0)#S9!$<u5 zIT#BWjnyidU|})MPwtJ6DkIEjSvvs%frx|z(&N2G)lB}sfB({f8~}QEySY2=*?Q!Z zX?@kT&>0vCk@yCPJTH(D(Fh^IT?IqVdwY9OJSiwBcyVk!W+w3Zb+>M4`?vxq_5X!x zjdjZ;fP4cDKoks)j~|DL$G@uuT0&5+&jU(ZAUd*`;NM4>EC>fc5>&?8#>XqVhf`}_ zp5^WC#E<5clwbh0l$DJuK&{ndVVjqC7UBi;<4zzbwRO%es}vSSMMtB@7Hkr7n`~pV zvcK!NJ>OQRX?**38wQd}j&4Fla$g7p#g>+qDcg7BIo7`iHv5K}L)zNX@h3pZB&>Bf z)qDP%qcmzFhEOY&7O(ReCaLff2M$j7TK%^1ySEclLO{Sn!YK?`Pk&F@cCp*e6drO` z!Tu&j5|k%)c6Y0Ta=|41{rz{ATZPfk(A29m)YM)Ci*<D0wyt@an>N0emBj=|z)y+( zqlkyl)BXO7P$CX|P@!!b5vJ4q_eLde^6N~!0sl{_pD>U({J5Z?c+5(V$CI%JOmJU8 zUS0jC%NIe2?o8P#GCI0>dHG9xe1JO-K}i4(0st))jUg?K{tKb|k=&Cja!k+XzY7l_ zSM{dM*PcE<l^1;03T1=5*K#L=vKW=$;#|9UVH2g=UwXYC@8uLVI=cnA^~vupIeK>| zJlAH*oi6sLBSLz+jqnPT=najHU?Bpj7h<CqCNK~qBX+k|dsIUsc8Hg=upOgnS>9in z7=gR~%`=DEZg4784(GJ0pNr(=RKbm{)m`0R&m2IcLwrAv;#^g2FFiUr`4Mm*Fps~7 zih+C>A7_$nK*t9)FYgNoP^8&TE>n=fAr>DU2V&TZ0-2l3Dzv9at#Wm3+@|NO&D$Nw zUv2%dh4rfA6Qz_wPskA6-f&AB2XgPSvhDg^Kyb-ZQ$f#<D0m4eSs*NwKUyu+g=d6+ zpkifhyRuwfH}3fYK{ru#cc;^TfKS68XgTV<W;2Un$U*pm1Od|6N^Tm)O7--Tm%o4Z zl>7Zz>;Nk#=jN|HanRcJ{CEjJc%NW!SK0mrN1lbndZFGOm4G=*zXP5^No5)oWp<RW zc{9c9*Os53;NN$$mV&b33Q*d6PIWwb^5jbZlK}SIQ<5?t_2~Gkw0HW$&H?Mu;J(DZ zkQb<QNJ>h|X{ex*rDEhrqjxFFhKXotk$F7WasyEv5i&YGAu*G@y}Gh8bJufD_^0%F z2uN#?=ilEr*G`>m$k|}+FVRhoh}n8h&dcHR3Mb=v4e)(@h<_D?4x(A5{`!R@9lzo` zI?4)|Dd}{n&Uy>N63gq?2#Bz7@Cbq-;0usX9xf(e;u90}^48_DvXZyg3X6)mhDf+i zx^~8xe#wJ=^hPQNWE2<t><R@^fx6a7qc0DKtu{74#8hX_fif)m+4Kb{{EJ094-Vex zT^;ZOn8wPi)8a>8O{}Lk(rKE9JDehnnoxviZ*PC&v5&vAx2F&K)#CZ=iGSGJm)mV$ z;qONY%<;|P+dnVizm!Dq@k#yIXUCyyp&z>5>nRR&Z%c-asEJtv(a)dR9FAr%@|Aw7 zRT>+BBUos5C1`y(;|M@2?<{ML{>5gH+OyLBVQyjByc0yD+A;JGQsQCXyMwS_X$+oc zH6lUY@or`1BqJH1k*CU1(b17OU!ScA?-B_-KWL(n3lO$~ON!C!nkGN8t##_Z6Uhp& zHFR&YtGzWdGiL>rH02S)aME2^2q>D6U#pqlC!d|M-`vUgVaOsW?7nvjJKx%}4&5Ei z@O{Hb?^k*(<`)p4H<~UoQ*DQY@+|WSCcUf-3!sH~4mwgC28IVWMi{UufSJ6rTB`H* z^2$d>btV50fF@#Q_EUNPP+sD*AxBv5y#~p;zM&ynx?cL_qx6>{IUSvd#5r{|ilb1K zIL7X1Sr?lLi3kVZh-0x((%o?zM1|iGg(?#o|BjEJ(O}_x<rEd+w6wJ9>Oy@)GrU04 zUNm_sXnOi2+X@Te@qA(=RBeR&BPbxi=2pi68ub>;#v623Q9&vWl&1AnW$Z~8@s(Fl z7&lCfj7$L4RT@pLGzbJ9Nf-(E?a58!;?FY_%@(&8;2-+|Htd(Xtq2;g7*i8Sy?i=g z7aC$GjNLZI{v}wl>7L<%0_9rpm{q)B<LY4FrTO$X4XTLbVRGE3n{`Ll9xN_8QfB5% zQ2N5;c67{277hgMMS45SpEp3gfz2>TtMUGR7$>BA;l_~QxBP<Iz<oku!vEFYTZdJ- z?pwoCQNhG+KoL<<5Red%Faae@kd{^{=?)W>5)lz85fP=OJ48xSkS>u1>F#&jy3Rgp ze`oLS{oe07*Y*B$_O;f;#h%Xj#2w=|eq)R$`&;$~%ofLy!Tc0o0sF1!U~K3AzB0#A zU>~E}lCkAWKZJ$;n3z01)0uzI^=3n2QHN1us#pI02a{JmhEgbbdCU<B`{%61YUlHR zR!{KN$<;x~NktJ0zHGt0Yf(;yImh#`*KoTBJ${{2;Li4He$u;9c=1GT39nV$E*sl< zc3d`)^OvGNik>~oCm|^rsJioe_4h2a*jtUeTG8I_8{@a$UEZO~iZ7;q)7qedWo~l% zOs4pUh_KvTr)_tR?4=J9P0e2PE(BM0!}+AFte1~hSyxVd-U_gfTgMsrjA$Ttaj3n# z=9=fKs@~g_wJooFeII3`xq7IpOtoEXo3DWR)^!u>BAT1b7ZWpZryjd5Y+N}k+S<_s zXGeZpU_!!H!<IaPrx@M$92!o{%;)1tZ+*{Uw$QT3+Y-ph<-B~k1A|>{J>yFhplf!h z)eKnecY8UJkeg>0Xxzfna{OjSOw7hA?zIhEn2&~c7CAs=ZXbVbWi!=k&D!ZvcwWJ# zx_Mzib#%yP)ei3+Vi!_r(ELCjSz=_A8nH5L;!xD))D~>#^bWsZc++|}dB><-XM}5= z!HIRA^K=)CAs~_Lq^fW3ieoSyZW*QhDYS`Z*|Y0%hLx`wa&|dB0;s?cUur40gEN+M zcy_Q5osax>heLiDtzCv9;u;6GY}xX2B>2L1c9B(^Jl?msqUANzXnYJvCg-Ea0mFeg zxuNkX8k$%2Z|RYsG-o}@ZZY(OIpA2{okOf^G4{|W)TLxeQ`7DlKb7;*5E@7hX_wrn zMZvq3A&U=A1^y^q!DGJ2tA!?0c{$(XS)Q$h;^K{6=<9)%zt`pObN5?N(?!6pS_2-l zTTQRLxt-0uIrp!Zk&!f~>68~*dVkEeUe_sWkxoQXQgZK<wFo~h=B1jsS2wh@9+BhW zRa17l5Y6a*%cDi0zNLk??evrQVW*a9V{KJ|8x#`@ev68nO_V!_`WZn$eKP8}jed(_ z+OwxrdTZ|99%M7obEA@tRD{e}KcZUm=1m%fh9yZRht_VIXU;A!k1ia`EcJZ^qzy_j z`Q4=5<e+hV<?(bwMV9hA&XFGu=9ATvbv0Kw?cngHAFb1y(bgWaHrhBbFux%xZRED2 zCc`!pzSOmvnwkZLg?VWHJ$p5!^2IK8CAeQS&U85$)Ym`;LHJIBFXG<xM0Xox`?<Fc zTO@fKQY9KRowBs#TSwpMmNLWdytAYJt)!AtlUe3`vT)B5B|4?uiyhh^-c4uRSEI}1 zF&A+6(XFJiotg1f)zxO9t`o-v+#CY$?&Z{PrUXP$A3m%DMoKZ=YRh{qEm}q49&2nP zS4soWt=iD8sX5gXa=*OlTdvr)ZS^t*`@(|M@1@Rqe5m;jMZ&Ib?P^*yHwy}qo){&k z<u;{>%+6XH8ygRqPUA>7fz;lygV){Dv#xh4E6=dtd~i(R@r+qmN3n>#eHXXP>!{La zd@#`15)mi<hE$*W%SX<gR9({B*LUgSGq=&MGQ)A5%ESv7E&v-jxU;by)#QDRO)vEO zwc3<%0RV|z@$vBo4;JK?(luPXew79&PO@|=KE7<p&PYl^g54LjmEjS3&t8n}iizP2 zy!`RbSb^$6&#yB1w|UHG#sb8o&Of+&cZt89)$Vi2LU%vkySMmpxXFY$#yihI{^PdG zNd^y>+AdL4Jf{jsMnuvanE)JSx-EH4wk0(k>R-Q$=+ocLpeQ8T<x5VES*(gI;kk$b zugy%oXK(Alx4bqhuX%>%rm{ke)5@j0JyKcHG2g>qUQpMx@%T{<ZA~L{8Cu9D_MLM+ zb87AqS*|N89^EajR<h^}2EXfXZ^t&lQ0s&-V%V2uJ!iq5N8cS7{cdvDB5kXEj%&hM z&+`x0?#ftJekZYQO#6N^^|8u?Q}p}&1et3a1oj;4mYW+H<?!VjJ>c-jj#ICGOr}rQ z!2alZnjgJ0%PwCo+sE3^=<w*U@}!E49uo+fsE{(H=gRTD5i(vmCH>+|2lk)L;Tp22 z@R)7Puc2*7v~?Tr6TbJ!o#W|3#*wC-=932uyF>0@Pn`%*ln}`&+^pwH<;519otKwT zmH(Cd`T1Zd8J4VLSXkMTmunQTYv=Z#Sju%q)@Zz$w{`7zSc28-aa^2}MSnamWv<0e zuR8qVuX#h-j77WE+eVp$7p45(ZCLg2_-o(CiwhHnC+ogQ3Gt2@W*3!a<bqQBKI|JI zcEWOneuVF(zQdP~2H&Dn(bLoOa6Gbl*$Q-4^*>#D;pKIj`EYL5-TQCC!knOAZA`LT zJHB)6?%lhSE8AV%&b<23=7f!2)xe;o{bUQK*1b<pI40!)m^e8(Z{Ww1GoavIp>#EF zS=ZL)_Or1rbI8rpAVKWrt|ka^W@fBd>F+6DyY>)lf*6yGVpmylu?Wg+6r#)SiZGa( zjz`DG>wU6W^>Ar!?pd;^qT>5-m1XnRtyy2czE1rPE%q~a!%gRdH)6j{Oj>r*O7x`a z-f*VpY+hw0CClCNb%wXQR$~hh^#BwKw6|Z~-r4*xcJ%Sq1{S@;?|4mukD5%pDi;Gu zDLB7MLP7!!{DS><Sj7*rvfjPQ|IGUBInmi!h(7@&?gI^EXNfq3vT)-7AES1BQK+$f zY%=--phrcN;@yYA`yZ{{)!Z4=-r4y!A>n=Q)ESU|V`GQcclW7-Y&z)Sb@Ir|tlHY7 zT#nGRwB1-I&q1oKs;=$?J@h~l#U#=|CF$9!z>BpXMO%Ti@i~kjLexHOM=f`Iq#&jA zmoc<0K)1_W&QVF1h1}_y(0fHAnZ)#x<55GReqhqOq_cJS1Gje~_DWR6jhr<#HTw=9 z-UN>Ynqbx%&G)Wcy#Cnw;qsyJot4AI5e3Pn)KK2;cW;WAHjYnW0VJ)flRIuY!UTSl z>%H)<xo3<_ZmHCgj6OOB3TgI^&GkxN560d*Hf<9d46>D~If1L4cg8FhcR4%FzNXpD zDib`t?_3*g?Yiv_n9L_06wvg%o=7;0J9_$2ZM@}6-}R^Hnd`g8{8{2(m!8=;l62+Z zW>)`$A_a?#y{jK^K~Rw7?Kdu>&3O1QOOFK8UN-^$n;R<}W|r<<OMgz~$EfL{zr0EH zK}>(TtT$br|A|w4%YFW@6vgU;f4xcmA8+cv+v4ZflDE2LcIl|y{EUgsZ-UP)lv;}M zEb}?qeXja}-?pE^cF>?oXut<2%;=9liTgC*Gr0GftZduo;IQp|94U#X3GGMIb7i2p z$o>aEeFKO4ils~Z9{x6N^)S2XZT!RKrO@vGlk9j#=fz*ikP(7IF5LAMH@S|x`#Oj5 z>Yoa{Y8LAJ<P(Rl-=oj=pO<xaUu-7Pi|Z>ItWG>Rfj2c;Pt(|%@k=;M@?Sd_c=d<Z z7bagZsXPsp7Jb)ezYo&nUA{*FK1;27Y)`Gcf_aMbN3q8aPcmvpEBF3&EoL0(GkL-< zvZ$)*hMV%K?`xA%S+KkQTSg~X&%D=m?Kl-qHzIJ!qlm|@u8%xCHbIC_d*#ZNGiT49 z48A;mTLSWosnIfF9~-mo^1aRs!WmwSjBcsTz0{EB7L?f!IsSmfu1ERB86J=4&+io! zi0L*YtVQ{Xz(`OA_a&J7s*-NszAbMfqoUHX+Wpz$^7J}dh=JY4#>VswNW|0qK&BXP ztT7Y^>?!EJVv!*#r8QXKDR)NN#VxF?PBCrV%fz${Ds74b1m%07O@#@D*n1kAnvzo} zKVZ-}D<QE4G8FXe_PC4TpJ?qedVP8*+-w%6yTAfg%s7`p0L5-QV*-TjOee54b8$g{ zLWE{eR6c?z5H=1r#Uu&^@Zu!&bIn$LtT1p87ZvE7>+!d@K!S5ZP|$GVmmKNSazLn@ zp9_^7gRv?6T#Ps<Mt2&>a*soTkK=;&%@Eg&EyEyVdIc^cluAVO1Bez@HRA4HRb@w^ zaBy%mwphV70ZLtR2Hm^9`d`#VUPp-zZ#_M|Ykx!H<lH@E$MmHA`lS#aW;fdwSFPDR zJE<Km!B&&vo0fJjeR8lYj-}Fb>b8zf9c1-8D4qTNCB#2~<rE6*#zsZv&8y^~*@U=S z4U#OhSX?;rh`V6Zs)t87INZ_9`UD+n489C*g0K%CZk!5yrm3YB1NTcb%H2;O^30%& zAu?sNvF=NdDyw~Z#VQx`0D^<~$2wUKOMXFEB`HLd)uWImJ9F^ZFW5}L0>+WIoe0~B zZa*w6?6*H4hgMhvu7r8mPKetAh~Eri`4zaY{fXgeX}+`b@TrBTq`Z!hkAF&h3mkd1 z#4$j;9^@3Ex!g{9>E)I0$!GX;86@nw-Q|HtxVT;vb{I|cC$<=Uq7$-twU&<mg;I*i z6VI0~V`P;rA4Vu9U+&9X+ry{SPfblruYnWT&&<pjFJF=|(|h=(k59u}`?xAv44~1; zNp0e3sH&<;PhJJh&Zlb6-5)QRmFm6pw{!XCU7$5(BScit*cu)<I;z9@bjQTxjFuL& zD}yiyf>l`f_lde@K}m)=K+1Ir(LM?Z39*9}LcS(kfNLp`;nG4lcEiBH4Q?t`C}pQ$ zj3U}O5GHG2>r<SCq3*7Wi)7fRPg=aZ*b)Z14)|LvWw04qQXQ$}gdU~yF5Y#}Q;A7R z=Auwu&%oez?;cS&?LBm8B?ay<$8E|MOBmfB&kDlDGcz+o#B`7+Qf`13XxvefZaoP` zdx!ZzW9wIm*IX-6zFLeF9^imp5wbD0#w0_C`j%0MO;7s7@G_#cTwIvUB<jG4{)Wjc z`@<EsDfP7Lb{}^@zQ*VLd};u3NCB~NFE5WHS98tUwb>9oZ(bD`71dIt1Lvlg^}#2) z_aRA9wwu;eOtaVkMe=c*DR$5?fihv2<m3wHot&I>;%(pxf>_nC_49Hf286k;?Y*a$ zmvIMdinm~RiqEkC1&!6AkU7AQ-*i>Ay)a9U3vYAQVCLdFcd-Z2(d^+$sV}YBXXl4A zrhYo1SR0HM1QjvR1=Awb_cw6cwsUIG3^b=Vs9K_7@Qy9`a$zpAPoKi4<1;X2yX<BI zEe=cd#*OliDXA5-Se(b`u*}7(=dXM4;K825hgUmup#8ZI-bZZHSRx8aONo*c%I0Ol z!oqNB##wbfE9+999_b*CDJV>tC0{S2yy8$_0f{IFjHCL#s@en5b_2;>>v!#Pf+d3r zxSUwUp!8#h<enm8V{-zl&dZ}Ju0-5xKR><=y;N1)TOg?70AU6cJ|X}Tt(~3ktN5`b z-*t4P23PKol_kPv*dOlTK+(|9xB*`Z5z{IvDnc8d#QcQ0M*(*ZjgIx(wmB9TOHkHI zug40++G`NS(B0iF5`6ia*BUH3ZMa*^7(AVwo#;7pnV6XT`1$i5bS4iTK0L|d3I0|c zsmVmmM?|TpI}+t;K0jP-2)Q+)ID7>TqYMf-6(N%YxiT~sQ$Oz0UX+)wS5?I74HWem zULgz(w?dBt>UA-iuu4)WxS~YM3vu2T=!ZYS9YM*0?{mYZO;o7iv2y=v$z-@4FCS() z0wwbgr=uA}O^vA}FS&{mH+}vqw3Fn*K#NN%bV#?K`S^rgTk}raG@b!S5RLMs7<3>< ziQO|$w_`f8fBZhKQ?Z}Gw!<>v-QP6fynaikY&OBlqfzjNZHpAJa)z>c9Lwl}_TtI* zpWAL|-44B$Jo5CsO}yo?X1NVj5yRYS&Vg^<P+%7>udLMJhyd9JrIRGv?Cl_+vGMV7 zxH>CCebLdsb?XqiWb$!Jva;0P5-UDkZ+xo=`5^!(zwO6Qe4qxNKYuRMHxLfxW<kdY zb?E)E@W_e#y}h>&dY*^WH&MY}VP1sIOQ(q!BhsY#e!Cc7;(!RV$M~EMt)#QdrH>bH z`ki5U@susS=Y5#P31uHIJ!m2Eo%A2<055}$R;*aj=(4J0czTX!6W8k1PHgctVxpp5 zcRhq{ZEer*Vc@_LiJ6QHot&A5Ug{SjkT|xy&#&p5W~!*Wb<lPG<>Nx3O?$XFdail{ ze&>5U|M80}&L?Q!Z%jqkI%;Yy^kgi6eaV669)^2_0xJhU^Pr&;TX}Ix`c-+!w?C=d zrQO3!m(il}u(jo=t4R#;`Qvw|UD@P^Fg|<~gvoybv%l^92byv--FR!y8}q^6Y1<}_ z)ES@NUzM3)|Jl9u^on)emBYV3`a~$O8yDBF`dt^T?x9z*Y=%yF=+$q;bQ5POw(oR~ z<A(gxXrtuC`_%mn*IE8Lk)Y1Fb{TlPFlzyfe{^v3E7X1dK)7cEr~m5#2`&ui;+AbH zEKIU$W8QpTGvw>5?YnYtndS~iIJmCsNdJ9N(j$P>@TP)vFSl~-ken~I@2+TWKEK>f zT;lVSb`6P%@%~Pl-x1(qqJV#C_$)0++Itc4rXfYIo<5*?)$JrGO!xK=<b6lmJ*<<n zDtIGvUY@+yF&@r=v5rB<v&<goxd-WOtf;w2k}fKC?z~a^w7dJ}aX!94`^5z`7S3M1 zx*1;Ts5}h=1N2Dq=U3CvWMLPu;%3&viuMDuIh}6Bw^Ih=_u*298r|Gl0EbV%X1{w0 zmQ3OZf}7#~xge0lEYLAQ;$_7hiE)aqO3?fFD~On0jOp{wTqkRM;!UpC&Fk*o4CI~7 zMo*TQKKlD{6D--WhF-aL4N-sW>=cN2p^Zk=_&vzeC=@CG6Dy^qr5~SR#PPfV$M@SQ zbmrVSMlP<+Fzr1^O%;&cMoF6;NQJQ;g5gs*C9IG52XgM5lD3YHhs16wB_$Q%KioPx zjoFw3(Kd%c^9h^*g#xS0YFSxXe1V0f<z6@nDA+b>0TQvW5VJ09cF?$yQ$T6!wqf5n zv{_uRGTt#Y?WhOkZ|<>d9I)mrmSuE%;4+0_09bPf?wq(C*7EW@6a71jy~z}I9GToJ z7!)>7p#X|uo2SLD1XJ=!HZR^DhQ8_uomd8vR+R5bM~ue_1})8_s}Th8ZZsy=;8WyG zzgwlem*rqfz$eaR#Xh5vkyR7TnZlK!60$$TA|f=g)M`_R^OU$W(XoV)6+R>Hiw89T z9f*^WSo2`w091o<MB?D)7&uyGu3gJzmhvsYmz8c;Cw{$^4^O@H_AZ3eIa{mbbuN_D zb>K|uh_mrqkSLsDPjb}~puGp&s$q=8EsBP_&0SMNBN_vQz)W~H3gPh+UYw>)HSSs$ z78$99_NppOTr9FG7$v};uzeA<hI{-O{;q6rRNk;qf~eDU=I9(Z2^RkkEdV|)w{>u^ z3`#$bLJf(JS2-!+A3i)zpQzU<ZfOZ<O0)EUyWZ7hCpS5}gq^9GnZm@B3JCZMCget| zeQuAiQbGnw9EI>Lc*{p<so0Khfj?01n{a(EHH+ud>Dk#>RMgREBR4B9M<C4gzVoi% z4+?bgT#(Mp>z2?s29Fcm6lax{=|AV>e7aT13^_X^MoPXLgX2|}ho=IwU~M9l>G$tf z^>x+GoLNS2+>IL!2uk0J_yGzjJYaMu{%uSb5cm5~BG~`HnA*;xyB%iuq=}kvIqYUW zGU{+Dow{*jkFs??H}N+hQ-DH&Kp<_rTH$)qoxQMAJoE6NqFD5P42iZFR@2w@0d@k@ z@Te`{jcl1y@c6CYycwVZzJqlPLe7BGjTyGP0K*=;xrstPi5pG>BJfvp`Yz&v-AzY_ zj)L@0DAMz@?^7#$QHCT5_Rt$}7GsIX1vp_h{Q1RkF`u#Neb_v9Vyf#YCWml}d)CvC zFb5JCAUP|lFrQUkz8=>K;#ok;^t7#5E#n-Y7x2{9*8YIqJP+LkV#J4Y^R%q&HgK9S z?=)uOEM<zQA+Z+_*tLyKF$?Dsty{;bFAr)~b^&N150!+#mP+_2?zH8teHR?uic@?9 zRRy3qaoD5ZPI4jO>HFC!4Cg6HacJ-8Xnk_PKPxJ8;VFlD9&rjGc`)}tfXz|>F-jId zK(tN`+wKz<>){ljS-CPBMIWinieGa(g;f%Ax(u{3>(8qPH^V{qW7K+X<>mIhl?e>! z7=A|Y{)(x2JOioxcL5M-Vb0<+PRht^-L4LMm?%65P$9x;;_m0S7P5vTa3i7&gh%h@ zc=6tVvV0hwKi$Y)N?bs|*%Ws5yfq{p0!tRLEMf6N>P1V31>Bw&<>a2A^i!J}YK1Cs zsl%gPa=_ZuFjd%$eG?@^0u^dj(;isn?lz^Gx8Y)u9xvcOyKXJ}TpPop$elav=n38F zujhsh(OW=a2TXiNGv_wq1W7T1BJS~_EAQhT7nYW;14e<h>9nn_;K<0x9pF^9qx*U+ zvH!zrL_AM<9rXMrG~lSu&i9W~(b3U?fwKx<4<u}eReaO-?KEJmo#_R4^7HfGF*H00 z1NZ08pJAIJo|~!Z>1@ma%*Q<3w1#jU7+;bQngTFenjSd}GYpZU!HEa2!*Dh=16-7G zMZ@@{pAWYwXGN>#{1_N;C5ZzRNLh&~4<n2CmdLO{or}icJ#i1_Z2Sh3K@<rEaD7qs zV57iUZRftd8B_umwTBoGcf9ryk7`h8=qeyt)F-4~8d^mANryWU<yR{~k(gNTr32P& z@+eLBdpx!l7lDA($B!L?g7(4rD>OHB`k;bkhK}|89(b|frp|@q-pa%q+xAUIFF#wS zwL3UJTzI%i+W&4;&Gv||X^VCC>yxLJzw&;4`&wk$+l?xE&CcdBXH0c$T(+wpJa`aI z|K%V-<RuQnI|YFdijCB(_V6rWiB#3nstz70LCJF(at`PlC556wL+=4U!j|;fhD=)c zGtCd#B`dB2F}mG+sC)_=@e5B+^w@4Tt?1bWd><MX7I>9KRbRhZe_n5#Dp_%%d<J%s zXD{iQM8AUkLo=*P#rme2uJiear}~&K2VOPlk>ph(32se!VLSeY8mB}$e2(d<+wR=C zlV?YMt=N&R=E)JI^o;<vhwj>Z0kTFne_)NdH5S=_hZldf?=Ss7go}%|mA|1NO^=eG z|C!$I?i(>tN1115CQK@S!>abZfvK^-VbkM(#rb`b0+<^cQ2Gtz28ObDt6zMT&k#tC z+Rk}LB*4{;K*IJ*<5}YG0t2&i9tSC4wu`)J8K!dk^O=ML<htFVchL53O3Ka}eJ%Cy z{O;y;4}br?PouT2Pq?5=jEo%UXa9Ye^cVhL8Nl(W)L8DFYo(YDwDr39Ts-LM$D*#L zyGA=Ca0p<TpZ~?=Z&*8)KrhWG&2(Vjq_WVd0Kavc)IFp;FCE-6wVz`p5H$hIKKuSe zMbY&PGmYT0UU3W3Bve=Xv8l6cWW4eA=)|1K<3FtEGod&6QELysI1f~+qf}a3kW}fF z$?*Q?Pqpt=RpS<^li0D($;nNoTZUj|Zs=up6GBmvciq4dnK<v<2ru{{A|e+6jsTsl zP8dwC%U5rGgQ5mOAt<n@fAa(IGb?*FAW<P3rCNipUB}lgV8pO;QZV0uopP~d#_1mb zF9EX|tD4Nmt9Q)J^Rd?qfw)s0{+Zhpv%CG<W)LF~KM`LhxCqpT_s$3RPM8h0DC2&N zDZMz8z{tX~O2F)w2%<d@MWf%G_5{44%}h_ohp4Eo&Ru*)Oz@(nHcDY>Znm9lk_pj- zS1mVpdD)54H7LJ9AHfXCPeNo0ii#>j{Sf7{Pf#%ZY%$4&36F?C&+Q>f!DTB}2#s~@ zaeI%v1b|O9Y~!%2f@e7kH=G8iTw<c_;>3AepuxAGE}fm%kiaACl%z(+s)Je!7{Gt4 zHeF?9rD5;)L(l+?|1&Qs1jre#khl&VEQhNsxp4IwVz(>y<=X`D_}$c0Yp3H2<5Bjl z!CuOrd#l1Aj$8x#I*NJ?P0j4;>V%vLA!IfH+7l}DKQUx!?ryL^g!UoaCQ4n@zE0SI zjf+N*ICGlOT?9q@{A7zGFg(EO+}s>;g9rzOK#k<8jwHl<AOi}wn%FBLHaanuxv2+T z8lVy?Dk`*lL28hsqwVZBD3l+tK%z{4AjWh`OiavU?*@>W7!i&r0bqtEo>sX0|HAGB z@EXr5W!PAH^y7ItVl8K(FTr>j8XEe+CYK0P-M!Rb6J_=bo8X%#-eFJzpHy>J;7LbR zH^n3{ZGg-jVc-pi=bcc}t&R*oIy)c1roYuR00a<%R`e2@E?L8IAtoX51p^jP(oNEb zXD^sRCrc1T#6?fIEgNLQ5R4BjNuiL?DiDf8vxAv!u;Igqh}!Qo89w%lw$KlNMA{1b z;=}v*PkVG=kcnb<1qFQR;zb9PR?C(xD^DsCEheA|glAGpirU=NFoHq$!CbzC0<SBi zMl6J_11yv9=3I_#mEr&jYb9K^XF<S%1|rtQ;LA_YQnFc`pR_=Av0=-Ws?Ld2xOSNv z4r95_aC%;#1vSBI#h8Kce@zxPj={Z~T~I)SEQphrE^Qz?h=#^8)bp=i#o2s!M^BV% zr=(YdLaf$WwBK)_IWH7Ii{}~P9s2yp9}EoKi`|oa$@g^dTj9#-J5fV**F-TO;$SV_ zMb3?64*>UIhXOSh7#7x`!G}M%zkdA`9iY8JLi8v^&}lk-`SSDXz87Qk7_kV-LK}+~ zCrKRW0H5yO-cPVypZ;U=1~vvUavFsK0GT6j`Hh~6;GyB+yCQo;G&Gn143<y;b;xh- z-aYBlV4(2liU4P7VWyL>#xXMon0F3*hfDk_46In0z?5;lm-4GuqenwWDwkwe>^^?y zO>Wm@{x|Q56fi{5x!Rz59H1}){;c1<t7eLQDlZAj=;5DEN6mVR*?O#TnTAG+j<x}| zgWmmuG%=j<>UjC4c7xs9wo$)Po#kO?@4kxm!#rt#*Z~h!MyUvs@rkk6cs&ERyx3oG z7s!7tpAM32fkl`6Vzjg5{u##Xso}N;y$c{fSUf|kmYHG=By9tNGJvtLIFsv%3-SfS zH12j(x>>#aOH$ba#bJcz;BrChdS_<r7Fsg&mp{f822afPC1UpZ`O)F-b6_}PSW?Z; zPCEMdD1_8A+vXsTYdx?al3UpGp85N`qA`HP4y@BgymqYrfUE=u{f!vRLhKc$vcmV4 z=83TW-;194#f^1O-GmpmLvMHvR($g-xH(Ij?PmLVipW}w2nG^C1vj|R)DJ4;3nVm@ zLIrp6;zi2g!-r9wq!x0)+Uv__ydp$8;1SZ$fP$ipI?mh7kJoI+jgskKzHHeI<mg=g zq;}TnmW%c|QxlV<0O9$uE8nZDKQ}h+2A7B>M+AaJp_%S|;0kVF-r-qjay~_db5n+2 zzI=hEeFan;(33mLN9da?J<Hhtf5Kx@Q4sQhk+(!tR20+zbViOB6Gm)mCK6gE5@dlJ zY^je5%x>Mqsd3S3)dBw#R4P#%@}8E9v5R|*hF7y6<E{#Y41a${ecFz}@W;K?Q?C!R zvOa{rWooW8y)on;oM7MgImqw;;U5_a(B6o`+Jo7J#jB=cqTR?cME&+vWn}=obY^vC z^iQC~kpEIqZ-k_UtS?{QReJG?x8&f-KPQ)<P<#^-QllmhQz*=m3TrCKXCiAZIoUFG zJTZRWOw)QlNFhtw=lePuQ>eTpsz;*)xj1;v1)mBu-T3h$OUl@LAL^=1d;5saZL1#2 zmmsY~K;q)Gja}HvcRc;39S*wnUt7fXtQXm{K5i;4z9Tw1x;#a)A`zRy^~B+)6?yq8 z@$V!0-z6s`sGQ$}><WX*w!U$jjXl4(Hs{-2_@WW8a(#l4tdS0j=lR{z=kLW<mg~E^ z5-9b+<Uv_YKgdP2K}m=6?$iUR%+(EFYPXk4oo*FYJ;f_3`Ws*I2jzQ+p$Gw8mWwv1 zzy9mrfBgiLi8;^j#_Zpi!vE~MR*S#8>(HG3r@2Z;Kb80TvRoZOduw(ae<Pj$`=dub zSp8tCD32b@a5)2BcImt;gN4NJ?~EG-Jai9i&3W7wcm<u{`Vw8|@$F3wfq%Z*?5`d$ zCM>8kau5aTJ)b21G@`{O1OH2tI-cI%JOPd-uzrf^hMQIe$6V2ra7Gd{*XD&y%p#(W zBg((wYIAj)cst(I-drTw9b1Y1ZN*2<Rl!R$nV4J87;ypwn;Ad&4T9h812$I1XT`p! z&aSRcsnnD>duo})SgwD-x=Vi=(iPNWQ}L<~FR$FBt{zdeW7iJznUTphgnQ6n@TJq8 z+l0odEgSR5P@x7Vd!E&A>eF`3T6W#jl9Fpto+1>*n)OkAy*zmmAbOlI!&zBbK^}e< zT~N5I?k%rPH8)5#)zH%V+}y0(m#}~1N~};d`Vwf200ENj2Nu@`)|zX3_wGfc<8>cA z+V3<{_%2?*Ui)zdQsg_BwgZ!n8?eV%4>w!GjSCJ9X1GO>@$oI+zI{Uj_Y@IKpg;5B z!@&<%L$~$~+2QEP28)%VGUwaIip01?gIm6&n+PgTc*rX*p+3dF<&2p58>X1Gh!BJ- zU&zSF=nfb<<tKap2}&X=gu`O!27zQEIg;n;K1M|iR=@fiz@&}$JJ-*u4pxXzh)CTa zyR~2FQFMU@GiC>JR?+?rH?gp`rlS1S-FB3>HxLsSKZ%VjL9by2Xksu%q(Wo%h)-QN zZ6kzI8OF@!oDG{sx<4f(<e?jaOOg`2Fgq#vz=ZldW5W<=8g<l}7CpgUBt+#-0EC{| zg@sRMx9!AJH_?;6<`H`gmc^w69wBZ4h~x)S_f7$({4+kIG1nTl12{sLKM!IScB`?Q zn7QaDs3V_ZYHqYlp*X<9<NmG6_a~V);u}^zdGe%@3$4r=6?;0|a)d%8Aq30eQS4KI zeR?#ZfD+k3s~&9F!C5XZAtNJ$mZo%Ai&;=mP;v?+qt2wIpM|K5A=LJFMnT!BflH-0 z;6au8O*mC*lKq(%i%vfh7h2K$BztkvgJeS`uJh<<-dnz!5I}!}#2yo(&fAwjfsIN< zDwko$jwfjKkUQ4X(*twOX3``B?E^p0ZWWv1<wP04Nf{#9Da_38OFDWk>}<o9{hyTc zQe?xc(ODso1o{R?NFTs3Ap!<{NO(M`R8&;RUXG#e@9$57P#hiwuE*#_7at}A!aF0H zrd+4!f|vrv6okW$HOkg&aiz%H%?EZnOiXH0qLCYi?E}FPGEqA*xxm8t%nIUg3Ky<} z2=-nC@P8#_%MT|Z2_8bc39}w=iyQZVkHaJN?+pf-B%udnHEE_Dh9g@UFwAJ40}lp0 z8;<63V+J2i7BmG>Xe^1dmC(tEYD_d>*vh8(7<ck+ew!)=4`IqdT!w@kK<{tKo7Uqb z;KyBTnYFd`9B#a#E!oF!-aLqd00H8P*ik~1;g_9in$E4>+WxH*ymYxO^}`+<D{xf? zELKuP-RMc+QJj3|M0Ki{*S3Y}GJE9qe8#vL9v)WQ4S1_J%-ikpzvZ&Q597TYlyJln zDy3U_&U$l@h&G}@Ksb;ly7cqt(t+JZEmI53QBXw~Vn7Yve-;gNbarwEUMv8)dL0>H zB<2s6Y*sa78*Up#iD8#%GtCJWR2_j%zre;x)`vrl5OmH(4O$Crgz5c4XeVLG@t?;1 z4A2i8@;pyM|5i9a{&NhSVce*ERFD8L<gfjFc@olvw6ruc_1lu_$v|1Lgd7LQZq`*w zw{_>vum1K6mVe0iU+5Qfd?oaqE;11tt^Q6~r`(QANO%d7{pGV~<?Y%KOW4ix$HvCC zbqZoY6Db9jxL;^U6XgU+Rdkv}^`;H^#C|3wcCg%ldIHWW|4Hw&x}6VJTUc25g=&;& zD5j^TqW_<=j)c^OnWtFHiAH0EgQc}~Eb1zmix<l~`4wX{Rwkx%=~KBhG@}6^XKKo= z0NslZ(z$S_puh+K#Q)TgXb_8kkAan(s8%o-uOHc1@iMP}3TPgzeGER02u>g}PMsx8 zJSk*3{>o^?|51lXqU2jHw(ks8Opz6g+(9|e)K|i)ej!;`4dtI=6EcgT0+6$^;>Vrr z=+)5^HnX<@8v6wqq$cjxk)uc5mfXN<hJmp#8n76RoE0$ox6!J2&Rq1pAV1$ReY8|S zg3T)y(OeuD7<LHzG;_NZ(SNxA*RSi)YMA@ZBSQDp<&PR9d#kz$Y#Ir2gjGin)&8zT z*PTUhVLZezAZ-rPyg-@^>8~J+4Bu+EIB(8#Ba0#<D_f&F*H0%b45&MS;=#xi8DH*X z(8{wKTlXnpm`DpvKTuczj*bEJ)^9qv`6-+3C%>Ai-A_33VvO};$HsJ=OV1>zp)eqH zBUr&lv<&MI?@5$Y6jH0f$_**bo`VNza1rRLvHScb?V$M=O^NSY+vI*%i%;QkBb_V` z?b6*R=Eo`}J4=d-zd))n1nEr<WQV9zpnU4gNQa07DNHn=87+`pMwBD5+GU?nP9hhL zhL$#8U@-0erJ!@Im;`!kqNA_sM?u~aZsMMs8!fm|?AL<78k0A1b93vxJjBBC8ET?v z1X>Xp3967+#|_oOMwywIL{wB5FgQ_Vqo;7o;}|94TUFIVNW#a)$5quv?A^TNp;ExX zvs;d6z`}PjLdJZ%{XaS^Syk$PFI)+=@V9=8$t|1P2KZ<aHwZSHsHaf=!@|A+w=5zu zhg+u_MZx>Cf@WrBP{KR_7(fy*q3kJSnLx(bLu`y{=y=eqUfuUebKe;Syz>>(A8|nB z!7@mK{fQ1kZ*(K*Vj6XIbr9Snz7DaCH;tSBRq>kK<1#x9dI1~#($dmW5~P^i6Vadl zdNnOAa>(|h#zeE_46zbHhc@7v*le{LtP8{y%dw}tesTEVK@r61kt|+Z%Ace=g0gYR zn;dodQCm$&)UXY6fcHnX5!q02|44+kIZs(t)fP0^&Vr67p_B9H)ThzPyi;U_#fj`D zib>A|s8Z3|A}T*w*~FZw1_3)Zlz<3x0UNl3NPR$Xs{$y=A2n9!qoZ_|`W3M*9xFRR zB_JT6-voVdVsiS}78Jcfmp?{Zj%xXWgMkDFPL;D#QtRFV0}NXtIrB4=TSHg?xeqmX zb39E+NkMV=Aw0Z&p~-$_ygT}rB)hI?6^3y>Nh%|(+33jh9P=X8+Le+DyWW7f07pXV zeDh{YY7%RSNZvb0{xefIa6YteUr=FJxaY}Mmz53k!;~M-qpQE7$wKq+Gjq|mmsp2z zoH;Em3^*{Nw{qRhSE0YL(S4Rdqvg_^--gYbA0W<3G3m~dT|Bx(nU%6z!2kle?4qNY z&e;DxW9$Gn4j3u92$)a+m%G2Wct6W10Idm`4n@AjD?Sg3-m1V0F5vEcY!2x~e##^k z%?2rLm4a`z3{cnpbIa;Bhk^PjD|?2FO#jl|mHbAFN#!JA`p8ywBt0W%j*g9rk~TL| zGzI3taCSnEOe(Z`2d|PP2AR~u*slR`=xUK`i{`WH&6`sqMUC=n+&IrO`qW|PhvEtw zDw_>-TvKTCMO#nmBd)6rJ4g=F%}9|A`Anwxb3`5$x?~c*FH$MB`u04o(0^4g9e4T< zMx#t<_DDrV1%-khUM;eCy~?>_{%{Sr)5PkFQF{Y<b`S$mQOFl!j|I_Xzpw+Toc9pK zi@(fnGj#`qWj1o**x1<mBYpB-fon`QWW<6_x|bN`CCsBx0PG-%!$=cDwL65=$sA-3 zBKjQlW)>D`q^4toCprPRnKCekpp+u6G>Gxo24*2z{OP4)mkl(WocRsO&?E}f2E-qN z(?v-#-_xgA+jTgFuKwX&a_H=>hZDONX2!?HhCq<2qmqFH`4!i#%TCkSfk=ukB@5N~ zrK?w$QAn@#A{Zrog{E8ovIS@uQlo0^Z#}?ggNY6mIbn-2=0?^B9cXX;T3XsUkppx@ zE;_iYhDI;$8NmA`T+Rntu>K%;y;5t}Uwt>J-MfGH-FD-ep2id4J?3ptiD4!**czSH zhUzj93<7C!B5<EW_46`)dG!X;XDbgpO;}U7srLv9`t90QU#I?>2N^^zpyffi8BK09 z`2xuwJv}`^oyt}{`%wXyvn;r}27u)x4byuhR8QM3Ro%PcvXW9sQ=@{SVsQtt4?~@w zecC`;fi(W`90P)O0d*UZ%ATiM_<a9k7Z=hdfQ0V}68J<I-AMo-g&lhjiBSX<0}fDf zWAUtb@a5eCW^2$NCGsr5E<<GR%5=?7wVh3swxUpWzZXAq@~YdXJFTY%RxE>P0!5Rr zkZnqC8r+tvfzQ8zqd<mTtDkxEU2H!T%pSBor>Ie<zL)SOS^sNxa?xOK!#YFsBJkYT zX;2ImgchdMNv15)3>(*Og9wVma{3hWLWV~cPiVpr;qw_oj06=@e(;BYnDU2bkh$!2 zBM<>pgsahjyfHJ@6Tz&9VC-zf7;+%`m)Sl9s%LV`L1pG3@R1||g5Oev`t+~>g4H)~ z-VDpaDyU=hjrkg!G6ivyNzx%y7fUF=Te?aq4|tm`f~t-!gIL3&&4ri3wMGsX^sJs9 zD;XEPEy*G1Nf71>0hy0nUDrX$N4Pvp3aO}^37D2wpl^!*asU{|U6_34<?zf=6zd9> z%4cFsWEUgBibK<LW|NvCr#}PNaF}#ol)!95j-_s_3reXoXU=3{#lx*4&lG^X<+tik zXd2$)Egz9{Ol*aq-jkqWp*re=t|*eMmJ_uqYD2=uC*7J%oJSp}hCvH6A)=2LmH;nP z>gg)^`-0qr&?TTDk9Vlr;)@H0%d--;uJa*n)b+x4Lck}OqxtW|J%}w%U!gN$pj=v9 zoWwm|x^m?{cx0nKQVHX#*uLRmSe5drv-Kk|JZyV@uVsV2MWdI&Ol9A21v%X4dkXkQ zA?6*%tpvV^cz#U#`XiMvB|l$R^zkZ-3@oL+acIcM2uDG%0!S;LU+F8stizpAUtcdp zdtLwNLIMhPLt&&z`z*PEK53OD{Dg8?dGO3hR0DwBJJiD)sIQv8JQt*jm;`k|A4#Da zExH6|#Ixh-zQ4)>`HZE7MKmUq@Wt>4CXTZPc86G5^^6(nw<ar=0!|7v;ZdFXM!V~x zRjG*T^_#NnL|wmoQHP?vZUk_uE+q41hzGq6eIQj97V5l`uzrq+eYfLNO6Ii`5Ybrz zGg(dW)DE4+sk+yW>BV}t8f&VnsyIB)=Wf?I&Lem;mDWnVWctPGUyF(6U53h44;S)V za&*_zFfCo;y?R9?EA!L$KQtoW4M#iHOCE06eC%DZeuvC$Z!7Mzu^U-KXAjqW<+}R) z@TG3<CkGKAyuPsSc@ld;R&+6Yrf^!Z-sU?(pN}A{%fi>OSWZ}*o_%!0rfkwiVE+9( zp>%8QTc=OYO!mpfDdogGsu>gK_4|l$=BBcIg;@*ViJixhbzZ&egvFiVn2CYe4v1EV zLi@>NOMa&CIMf)VY0|$AZ2;J|j#4{ips627}XWDgl7$2P}KscR|vvS&G<lGnbBl zDCNlkX8RgEUxibHj^UF0h@hgEk3j~Xm$KEZb$sp5FuM;xJ67x{G#2QxgT*9ieBP#| zysX^rVP+pXf>#t28fM0^kQx{4b&Q*}h^k7-n=Z>=_$r(699<R78YS}*tTo;k*+S5D z>nbIVnb(I|PEWR0*|e@!DJZj>h;1~fl#IGHSNO=@KC<Y&P}jKJ>@0euG2@e$dIp1C zFDhO0dy2Mcf^K3HPt+~yV_HoCDYiBCZuuz^0UZ16?SB^TPFt+i9cDq~Tf9kKOyjgq zOS@jqqb;^(6FNH>bXjOm42iI?u*BrkTbtD8JWwg?EDH$8obNZ-fk!v=bt?6x4Tsxy z_DBizf3G^-bD5Qu)f=G<P$ItoZjbL{Jf;1bM^E0Y(J+5};YiOw+u*8Qm11tJHYZ$) zyh19Y&d?t>(;axtcP#UjnL?`Y>Qw2$<~qyv$GfMbdFM`<CwBQ;n~kqeiI1NQKV@Ex z;(*sig!!nFX#<+9saD(jxWO!}Wg8r5vrq3Gd;ANf<GRSO!zpiRC?b<To9ZZ(&70i+ z<E0^dUyQb%q%7?c%8l5#ZwBF(3lDRB)OORUr6#7wD_}+cF@8H}UyN+jxcv<q*|6|m z?)9%Hgu^#e946|zAKP5vwYWW#5`I0I)81C&<OKcrKqUPtN|u&(Z2AFwu%1k~VqH}Z zg;IM&FJZ$<ib(#3e|&Y{SXrrZtd=A>Q`$0XrnN;c<8^$<Q0;QxX9WFY&$rW)ODQJt zQf>vQTBXICqy_zgge}g@j15#q>g{~Vtuf==(jMu3%=nIy61CfUii2!r&xYxtG*P4P z8yvN3pY82$ey`HPYE&@WYcyYyxe?#oBodOz(-^HQhYwLoQySzQ*PkqEiJ~qkDUnOF zXbN~A8>oqQ-QBfDrL*urfW+CexraLgta?B4O*R_yS}no?$=C7X3MZaQr<>gIat9_% zWOC<gXk~Qo)B!&PoL<ML5#&bO|7oHnTbMk+r4ZB^&+Sa$fzm6|g7HtztrU^n=zg>k z{T{B&@7H9NJdr-!C2c=*1<AHX*ljxRQqzl(WH_$~xIH{}Gt{g1w@d=LYeA1@`SZzv z3hZ6JrqyyvCpal7t2a#VR5bZ^wocPaiPL6k2$H5lI7sp5_`8~Af|C+hG>zNcMLSWf z+vX;KQISRjDioidkc=XVgc&_barpaIc%78}@bM%5XbR%*CB}?)$D-Y;@4(@lP@o}e zh?krKzNI>)MBPpBC9Ta5D#VK!U_<xbaZJmkYG_Hf2xCk+v_Qs%`@J+Er}E}CP)5|e zC)9l>rrSOEensaPmGX6Ie0zJAZ>;=u&Gg79w0Hqn<$)0niZa-m=tB%pP197)*}V$r z#|Ub<SHMbLPY*{H;Q0NR_^>e@GiXjDiwG<OMG#yWqemM8K^oeaW$0^-Aj-J&^Xj9; z)WTEQa~((Rdww26DE}t+zTpusw;H?jDj9|S;;sS%NsZXr$st|FwLnRIOu-=C6p9+7 zzKF#4Q0Pt*81r;C^U*rG*VObDduRp6E}AvyCE5%a2NYo+to;5xE?cvF%LK~pU-31{ zxCRnHBb8RyhEw_?i*{)Hx+h{usKd45yjAgTZp16I7}sVLqWjLY(b6JNLdWdprqD1H zGH)~#-4?Kt;v*j-{4*pK&tkZlP^;$DXumj5?wWj8i*cEtH_CRn!2+=69D&WCK$5rV z#U{j3xSbdgLs=QCmizRGQc9eu55wFK>OR5J$kc(?O6E=62na8LzKRpZ66c-Vx6_N> z9NvvDjIgIi+_Kd1)(2$7h*yNkMpbL#aT{MjQCzt;Ug7p4eo-k^7f{lVOO3+sblCkU z88ktz{4CoP@0^6$$_v~@XJ}aDS6GOAQA;8@W7HduUB)Kp1>B}p@NBPK(j8UY{225k zekC;MPq!Zs_NH2Qe2>7d=+n5a^;(Mu{7f#F3Qjhj!1TIx`}S9?U|vi+*l%R5@Y-Jp zsYQcCv+ik8uwK{D`S!Diqz<!AAqJ_}2gF@Zj1&Me@u4;(Q_FMEcF>xPt7Di3x{#1e zmzrmI;E^HP=tv|(wrZTUgxX}-n-cx;NrCB9bz+7m%5aT*I&(5dMuU&q9>V6LM8-2D zl)jdo-aGh=G|VuuKurnl5VSH$fCsG+Y$x9j2P!hxbW{5irgIn;hMw9YU@@Q!qw?6D zA6ZvrWxIkH=5GT3K8FL!?tam8ugFK$7%x&}qtv$7vAF*+A_9z@B>ca4AnwaJq0U~g zRZ?Iv5*m$)fZ~oc=*CK7|A=EM#F#p!`Sk@1czaR@GptMb`@(-gPoiYGlValVw|%T_ zN9=%fQ$~<e0^i_s1MQz7!k!EBGh6f$+jE1H=X%48tG7w_mk-DDbw1xOmu#eoe5<ji zn$V2lSoB7pD?i5~)((ET5F_)7oLq9VEuQSak1n?j+$3{PyDsbB++lKnygxEhYS7fi zAqxbA2Z+`<%Uin~22|B|_I!Hi)&;d-_nbB3?AU-`@Y=Px8|tFNTe)p3O7glB?{Xm7 z+}>{#*kI&kVp_+wNmzi=o5y+L)}(lh&kKktTSXtI_=NO^_LjO8_=&m}^iLKSWY4;l zY_*+<)A0!|df8FhGRG|7w)<Ol5EbP|)zxd)%<TT{c8Oh-+HD;+s_uX6f<@V;rhc|J zDHNU!gQY7dZ(coK_SZ|T7M;7Gj!udd4Ta(p>|&>0GJ5n#^X9hh^$qF$5lvP$6iSq= z&$wp+26QC-QfzUzf}+l>s~su9Zb_k}x$0KSGA^NXZ)e;{aZvm3dtr1rEb~~5Liu`C z_L|f0pVzKEB|o3w<>~*e7p}<bdvUf0uP9w({r&UWwL|3R0rJB9f9a(nN$nxIpAx3m z;(!0Vb}g9v^!>+8{?FU}ul`i<np@`#6NRElUUH#XVIe0n>h5N9=FC#c#rFvbGUTTe zdC@>AM{Y8wtdglG`TSz>1Aa{8{cSGX7!J(;`w{RzclQ7DNcoRD`}<CcMfnS!#U1MS zeVhJUUe3NuOS<}xd;1Qck$mib;}_)q+rtdyF{571V6S$?nTq02<L;8OF}bOsIpt&C z5{k%yy3K17FUc|{ZUJ;P5F2>%AB)w$8omGXyT32z|8q6|8?MInYqGQ`-MEB~4UEk7 zG>f9RRO(e4r1K98@vG2k{;=SYa+9km|JO{Rk4*p;Jf35$N`ek-mp|Rr9JCsos8erA zG_Sv&;>0&uTGl8>H!8gK_nUS-{m2_CIALooHP@@EB<L)~+i|Z!;0R;WCKQMqq)PmE zFX1&=d*?4-na#6iykR{0`iPy`El2tw)xxLY*E2#-yM1%VG#gr#FV!eKc_eL5;{14H z<81MM?}Y-(x@kcJo!HVi$Ff2kZk<{Ck7_-w8tGDplL~Qi1|dy}rTFznfjPS5g@q_B zv-x(O$|g7emRnupw|fJ03X%^jas^S_?4?ehFW${H=R7y`v**^W=}gh2DCH{O`;P+L zX$Or@`sfYL<uV)#U3_<BYS2E;d$Dd<R%@oLE6z@EG{MoR-8#cPMK8m5{*m3GP3tll zS2I{Li;qNHi7LaDtd|H77)cd>PMb06J2ySKn!oqE6L$AEF0boDCHT#41_Fj_(#(gp z8GjMT@DHK47aFWHcdRx&moXZ#gDcKnCPMdXSLSdwQ=w_gtln#%>h^cBdGU2ET^VK; zFL}d@ofQ})+@3yd6mH9m9eh?PAChAxlzOGiz*Z*ecIktC86F*L4;weAl$GEzOb@Ug z=n~eSHXcZwZLJ>HYM!_edYff*tnFxfV4Yihse#<+<(vLyzqoHHCJY>QHg7q>s~s>j z$k*Y!&uG!uORIC!HqC&^!55>_=|UxvIx+7pC8hXBqvyI}TlD>yTi63lZJM57&#eE@ zFXsm~kc&;lvnuR0zQAep$)w6l`v4p1KK>A2>odyN$JFd>>Y8>aC0=0(vwD|&OLAb= z&C$5reejl2RLXl!>tDQ#nHd9<5u?>yQH5Xgsv;^wJth6D?D~uw*3xQJeSPn1KAwN< zj#wsB;kwi{CDQh@QI>;uQ{y7dbGS2$3^(<0F0=)WjxsbiXfX^nn_DF8{(fMazgZ5y zo8h-@248!;=sf0yhg`49j2HOKeD75EXbw1(DYW17+EGn8x3BacLnC$ls!Ip;Q@TD- z9N1z_#MK8fEcIQFo0$yQc0RY6toDd4J1G#)7WFaWEB&lXf$0@H9|qgm$g5)?3i5^Q zMV_~h#2Sc4HFH}oPMMR!w8Qq}2eAzMX1$1pOzS~9qyBUieZSJAxmTrv+2d1DeD=~! zt%G8wk{wnxa>oa~i~YuLt`o4jnrCkkAdzZjhQWGMN%_hZPXp!A;o_w6?8cGG*#_O& zVh^X-sp&^NCsWua8%MenE$Y`sR2EHEDgj&m*pgv2=VnyCPP@H+u%uwf-Jr027jt{; z;w<O*feecq^3`$ei%NFVWQ_S*FTSJ=U}rA8;66?U#1$3(<Kjle+Ij7nokxl*_Pa#P zDyL{zb}n=UMO3OR3{92_XPb7{g}pCHck3H*VrcO>?Pe!EV^DRVp?~USn(<&iXa5X! zefTkpTAxuD2Ad;Yel~jawo^UT)A8|D;v=E?+h-D3V;er`DTL^mZ6DiN_CY;;xLJQW zC9dda*G{9{8vT+jDyiJU8C~C<7i*iR2P`X%zK2X)aQpgH!oJ-{{CT}{)kj=>eQP}* zN4rdRVQ(Ar44cAlb$t%*JJ^#9q!z!sHT*JP$dT@NTdCjs^h*7kOX{NS6_p014=VHH zEk&)MR3T)a+H~k#?}5pXMTcg-Rw}Op;{Nher}STqq|OzIo9a!(w`8YwCSB<r33gl9 zV>>e;@qDZ$RQg<+`gJ?&{QEm5Thr^qGbgr-$F!v;l&a?cs&fxX5l`B<k`nhxyXo=V zz(@O{*8BnQ-q&B9YxS-_(u=*O9BxoNFgx(fj>@X5clBUFu1fNuZT21SZHz18<uXh( zneFBuGZmKETd0sZtXbptYNl)FNWR=?!>`PkP|@4g*Ak_6SxqM$bE!8tld!XbOj3^% zvt!Sh3WI2c{end84`-&&2R6=!C8Go^ofe+6VD>XUL;fudm>E7XKDmu^HgQz>Q)ZdJ zrNzuxzjtQod_cA30lV>XMU(onV{O&KA()XeM^ro+l&oZh41WaQ(wFyOA}{Z&N+K%j zr^PG2#|=y?WqXp9j4#tCfNyevRa<%3-Pg9`llb#sr(L5}(h?<JNBLMTY~$_hT|IC! zwxqy3gL{!vb@BT|Xep+&_i&$Z*PDIjWiG<6#-Gj)#xJ^hkB{X>sMHA8Jfku{9;7ZE zN@tbvk=d(-eQ%3U+crM47N-~t_B2b8fZfMbB_;$kYHa3gz1m-`RF5gLPSA^Oat~-c zkm+ls(!0)H+h@9p+jF}5yL9`$S>;-OgW|x{j(Y(%jIw_A)(hi7!V)7DK86_!P3j6Q zBBS#L%`XS-M;8b7(#<c>8RtqK*e}lPJS*j+UK|;a)|0X1AqyURRU6Y})?fmr)j_iD zSQ}eez<{lZ$AEEPE7j=FpB-`|pJOCbT3kmWC)br#RZ87DW^i>;e0t1_w)BaLV0hCk zbW!5-#%nD{vsjgFJ8EuP=6prai@U!;Xiv1dMDmXbMcZsTA1)pSg(-`jUPsOMZ=_t$ zT(lgki=;p0MLOf<4ie9K$3OO$&zo~i5?m|s?_P@c*-;!ynz^@0mEqsPUR7Ng?4i2M z6AXzu&tFE;pYyWnu`aI;$+Wq%%~@l#Ym*Lzax*bL;Ch??|G)Zk{N~N;)m7>+teCzH zRF$)u==G)_zo1<F_H3EixCMpM-MN+3if4TMLPe%Z%heO}ZuW7I%e>{{<?YJd=4Ccs ti?=*NQ_bfqz2L~pz4tF)QSw`)_3sXNxc(tm6$SqjKPz=6^3;uc{|h6i>fHbU literal 0 HcmV?d00001 diff --git a/.github/images/AzureAppGw-advanced-store-type-dialog.png b/docsource/images/AzureAppGw-advanced-store-type-dialog.png similarity index 78% rename from .github/images/AzureAppGw-advanced-store-type-dialog.png rename to docsource/images/AzureAppGw-advanced-store-type-dialog.png index 5cc95d22f9397f73786be9e71dadf11cc4725852..2b71e8ce6f47e0b32fe97f5ac26c1e77f438c5f8 100644 GIT binary patch delta 7633 zcmaKxc|6qZ+xMsCs$Z_;YA=Z^RF=?U$uguY4cQIZ#w8(Rs~BSN?YdNUlMxfLWH*?} zzKo%gl(A$PvJ8na7)#b+EOVc8-OnG-^Ljn^?ZwOZe$9D)&*S_YpW}U;v(>zNsCoCh zG6*VfcXd{5mbCZ1a?4D|LJ{41RSUh57=1I6Eq>UjUqwfD!cB{`6(@Uy@TkPZJT|wi zTOs3*$}NLiRmmmo9Rp-vO=x|7!hW+0<?wo`X4IP{w6LtXz+q$h#Bd{xajx}iRM7>C zMF~<}zyj&luZPt2pV4@kozy{3WemH|2s&`!z~k#8;CqmYt;VWrYirNbB)fZh82RsH zb4RIE80=3NLPy)uVgS;LkB>LFefuTD+uF(LZ3`wJ2D2BSuSF~E+O;bxHkPi%+b|J4 zeKqIfs#S???%#X%w~jV0StPK|Tyu?a?RZm|4#yg(1q?p<@&51QqzpVh>%3tSBqbqn ztE;Q4ZhLJAJ|cAJP+x+HW?`vwOKX3BzeI$%xVYbs_q!O_1uD^+oNim~Jr_#0tM*n4 z-KycPOlQA*`3IB5@|fu@tedZ66Ez4?_7Mv{TkDIq<*u=!K~v`tc!qaBBVe>7aCtIN z1hMrqT480Th%BS7ZU<&X_d&(UIll4BZPz*rtjQ=*eKl4`S`i}Qf_rn+@v@=0pp`Ct zI>~`zz&d*7Oi|>~i*;m);+gpIrM>-2W?K=H!pcwv>ddHZT2okSi1Ea?z|jXC*-pfx zrfVr*mW|$AHw)V@WW||h$Zn?|I-`8Yce2gw&YhUuyLb22EGj$-YB>u9OhsNy|F$+a zM9<U?6To?9kjp~gzuxZ&8hd`SmlELf+upr3ybB=GGW4BjrA^L4{|mu0{2TNlYZJjU z%Ds!@Es62*Z`)H<JV0R4U0KaOgZ|#$Bu{0#=PJxM3JMA)C!%$gJo<_srfqEnC%$?m zb@}qUHtfK_z!HZ8ajwUrhy?|=0|Ntz7Wr`ldx<}821D`$LmL|#0Re%f2z|snr3<`U znm|Kd(DU{6rEP0UO3TU`R(kZym$ye<PcvptOxV9$m}Zc#9<P=}LOfaq{Zh^glFyL> zxV|suSB}Fq)F#STRIul)7c`{MXSt$+skK)N;a1G_K_x}~j*tVG?^gJsM8A3CopQHM zVJ&51887tewQI;~Z-!Ret)IJKghtxWlO6_XaIDqWuV2;tre1DsZQZXPIxZ|s^k&qZ zKKpmQxkK9mSy7yq+C!sH`+3Jt`s`>s1{1PjkPnlYu{k%}vZ=U3mw3r50kOmCNWx&y zUJU|L=jRe;;>%$rbnk6tyGn<RUla^?#T~@M;g!TU7|fE;9g%a;v@p*o)r#{+Xf=_0 z`3VdbimQ1kkns2Gn}VO_AN~;!gTXG3do5o`C?VW{e)_3J-Ue4*pA(1lK@2AzUMFHt zfeW^^k8?c<_w-MnK0VV<&e$9c4GpbhlPD|wjXOwHRaMc2#1t*4;ph1HaiBJkKy`%9 z*H><Vok&p+Al280y8o#4WuccR+vgz__imkp3r6Ot%3ku_#q!0^p6$)e&-dspFoQ&C zI590!bM#4ekBL?y$kqoB3NGAvovG|K_yA~;pDBKHq&2dJ;g%6%b@=e%sF;}g?-t+z zts}I<_Bo_P_^GAgbLNJs4e@azs#)$mdG6z%V`utGQa9nz%|CZy=xDlcCp`bKgkAwK z5p+*p?2)5KR|niO+*fDlkmxR(I$XSjKKfgxHprpD3ikv(oM?&HP}SF#7MA&)<wkSx zHNT`AeM0*3WmDb`r;*8I=7Rg~o#}A?Xnn;t*}L}avlNb(C$R4co(A%N8ypg%FgNY# z<Kq*E#TJ2du3PQ1!>s>u!f`y6Q#V~o@AhWt{%(}60ohpO-RS~JtLWAt(%jNgWSpkP z^d3c5wz`({=L^|fOOyn$l2ui;X?h`OVQKk_|9BM@iU@N9gDC#%&~2`?yu5L~aT;E- z#HL*D){BE?yq)dJhhsNgTwT%M-#N|qd_^D-K|32P#%3DW9IzlDMkQz`SQpaOEd*X- z+Zam4ra@cdVz!m&ME<A>4eK|-E(dX^^BK<Eoy`SWT0+y<%XZfUIy#X|CI_v}7JdlZ z@6nZ|J6P#K$TP_xt+M+))_;x3NJ%|}yf>DZ{8+YB0ee1v@??HNffO)+JB5XX$ep2G zFxZ;~yxx6VTPUTwySu`<<q&nbLtQlgE~`B?e`A?NaRfTT=V0e+_0OvN_kM~zs^r@C z+Q7twH8CM2CuanPv8{hnnxf)E@*q>Krl+S<;Ml5>&`q!BFJ9D*&)2fjdz^9bJRr2y zd4`=;5z^h=9T;+2lDq>Ec!A8NOLs6cy=LuDiqb0G+7W^0zt?ND!J)RcmS11$1Is@) zHC5jKdIZdWhelB7f1~PK;X*rc{=x+Vym5wR$*Wh#!2a3H4OUv*yO$+$DBOySDk-$c zpZO9m!R&DV6mfX4);AwKiD-L<)+qdizG$EhP-*{B6OFeGA)7?k_LRX=XDD1!T1(5( zr(q+{yJ5qX<8NSKa14YiNzP8@$`!Nm7F_?c14mz_rES~s-oRi#1dx`Ne(uI@gcL=0 zyd+;Cd-fePZHYUZn4Bz)K+}ndEp;GK@i`wq-rWAxB($`=+yk~rma#M0p1Qi&B1S`3 z5+99!PPyt5C0VE&4V~b}@r`l5u(D@?Pvf=~{+OsJ$)?=3(5*AQj+tb4Ohlx3c-S7n zB2i;vVtVDOhsBHN#CZnA0~8<hKv^yjZ0_bf#Y9?KTHxTp-dL59g3Qc6&!0c<{yF9} zy0;)+Qd(J=Z-Y^hk@1p(r!L=!J)@E&N#%@SQ?5UPvVgfLAflq8x~F^cX>El@smlD| zugx=xK(suDYaR(-{_80iN}`A^13?hTC-w+-feu7>{P=Nx9u_)K{DI2fV%0AizcEFl ziCoSC*+g?g2Y>9ykt_x!z?TZ#^K#jf#h->};ywCFCBLYm@Ss<etwd`S6klCk-A8gL z+AkJt8W|ZmFSTg`%$@$@Ll`_sRpgLSiXvihaZv!&dLpuDcmbp+d&sAet}hmn<J9y* zT2m9n-&9cMR)CDA!-O=y%?^~Wem>(PB`$uG+`uLBHLAW)Zvm{!wjsFopRh2v`0N&2 zAtWS(VaA0r%F4@`Y_{DP=aD7|Y?ap#5v&O?Lc#@;bo<GDZ#vS{+0Rd+_zP3^9xmw0 z*2mU61_`={hBnkwspk<_u3Ql~aG<c8@7V@$?o>8`BN2+n<N0C*!8H2t;X@P-$CvL4 zKnrBx8DQwZ==f3r8iKO?=LQjK0TLY`0GaRJU5*u2G61k)U}S_eHjZ1H9mtM|_>WQY zRb4O+@PZ7>#?TNY@8P=&jay}Pe$!b%R_t)G&~J7=)LihWhWI-FIU>k(DHRp#<m6<& z2dH6YEaz*)B_tAGzWkHIAOUG|+-H`-_PI|$U*ZR=yi!5>0Hs#?jB4^p0i-Jmh2oQ5 zt$o>mC%`piaB%&sKV`7mXQ8wN1Y1T@QpY&oB7lJ*@aF@j1+;tuxg!spB?nzo`uP)} zGQ|+CU;7(X3v0)a${gQ(|CX53*)=uSK~=6Y7;*>7%*xJ&l%D+hOHfSH9&j3{=!zRH zVo<SW2=@UnG7tkgpT_FzHRK%XEW`E*cE3D#tG5p0!6{q=WxNnbUqDbWvH70a{rfq< zE|6pt9MS#yinHb2y9EFsi9VwZM90R4mhs3A&ig$=QUK(rSWe&5U3*%o>O(_Ac1=*Y zP(N_6JibEUK`Y<D{_`IjVGdGy6@cDUE&+v?)YaE#e|vii1VYZ2Q|C8d*8_I8&?G~X zUzz=9zrX$X@uN%#4k&<CE}|LSORsPrpAl`*B@hS~Q`_@|mC#QvDM(3~0utW6XAeAy zH96VZ(vshr{|4eMmn)~Xhd8*o{2zjOoV^gdv9Tc|FAu=DvURq|Z#K6d?F}-$Ex3b_ zmL>;5ywT=tFxh)1^Gla=8H?pO=pkNYapT5~S{hI_O|ZFDe765}u=4fmH3saB%}wh% z@~2Na=Orbl#=^yR=-c~$`wbZw44#%*i?|o3v(q&<+UN+l&&kP2RLE;T3|8}!R3i}& z`HhW@(cybxu!q0ZdioTDy?xJ&jsSl@y&`@Dyj^eh(Eh^*z>8}m%03AX6XhX?6OCzU z>Fn+-PILvUz+zYE3Fd$U`s7S*BZg!3@M&&cctBSOkTG{M)yMDWrvnIcP*mweq%3Ck zdufXPJ{ZhYlQ!0*?*QUUs@mnrur6jPpYXWnn3}Q=TZoAutff7ixm{;bu5z3`y`#)H z9coiC|C_bBIln!Sx&&RibMD+ZkdE<^Y1bd!1T{zP$*)YkI1y<Dg+r(Iz@E~Y;<H=s zcXpCTB8Kb8cT*drx_&w}aHrh}=7*A|bgB%`X`j$lEGLG_MT??rGB>@eWQg?VLWuCD zb7Eo{=;#WdWhCfq06FW{E-ZksiG{4hiv~`_8&q4|y$com^Uv<z_U%K(IPC^eOw_wy zdG@DaCuX`fwt4VM<%=T?GJVCX%`)=-wWHO6fKZ{-B#o&eyA1z=?fXSDeOt_4e?7ey z+*LMfCjfvL$T#v>Q#h@&bHSR^h+$h%x0YypMWaGDTsGF%PsQ>8M<I1|o`LMH^csSc z8KIkVWws^Ao#2}{{{fk8=XArs{K=CV;Bu9L%dV@y<l8pGg~a;)`R(@#EXNzcY6t`L zMf7EL==n;o+D(E@Cf%X?r>`{Uh#Sp%^dtupCOuaU-bTpCKc0SW)Z8lj&>d{YiSx$; z>lggg&Lf7ZeL(#2dB$nPdZ=C__N=-U;FiWZ9)LY};9vau_UMKIp0-MRl5donmz9-e z&?heoI=M78441yj@7k6o5NWEupPe^A)1>G(Wr~^lroBMrq-(DK*aP4C)nr@oApYvr zt1+L=XR6!w0KiKo%855>{<Q4*OX2MGF-xbvi-s{vopn$JOF#c6JJ6lu<W|dmg2mGM z`>lbL==?qrm=vgy2>h$`bP}*3U0q#wz-GW?5+#jZU)Bykbhf*~y@%gHp4E6_3K*6T zd;D4k>Kg)&Pe`al(`7gf0A4HIdoJL%aU!bb_?2(Bgr=vuvXSW!aBhfLPs+&1FizK) zF7*UWAt<?Bz_KP-tc#$w03)YvOs0a~6qW1j2zt&J2Ty11Y;SsueS8j}P3oEuFlPW? zvNAFT)S%UFAOpsbFg&ONz(^jTOm~3D1_(q~4kF<gD7}fY)>eTiz$BcaLGi2aJG1)E zK`6D?s8Eq4?qZCg7irbJT^LC*qyTH>BjW!=HYLf|+*&(3P0C%{&F|iQ9S7P0!0Hd! zeI-FtZ^IRRMl=xSpx6QCnj2Z`)Z!J-&U)gu<!mc%<5xh3Of<{ZL#FdGc2@FbAo5VL z%{3Pnm%vLylmN0fWv)s<%cARh4`57hh8o|+LH$R9SwO>?9C*p5Ob7UE&k~cS1n}Ey zpiCDa06s?y+A;$WWlQld0nAuJKm{Ri@U_=`c04X?^~Jl|I?$WH?n1Ec&iU?!qsB^< zx}|f9M98^oL@~cZtyRl*BLhGc=%@HDlbe@E1o7ieB$&KPOw0x60COW$J21o2>MF85 zMaiYomJXi#{Kbpx!u)jpVmHmyk!C^LF4I-SnO|c~NE8PE2@wP`c{?e+Tg8mx?}g}& zIeqQbn>WRF-nF_`MU`zDcszvXtC!y#0xRX8a)8P_HDZhtg<EFp2?E*ZomKNQy?r}E zSjGF2mX;PMg?&%#`Af+i6fbiqAjIXU)31Iq)NEjixvVT#PjU57YOlsDDO%fHQ_%O0 zK)evf!zRIbb<*<kGK2j3^(l_CUk9h#P=Q|zg(0ob`p2N@_FTSqS=E;H@Op2i_8y!I zNVKJhI&&7Ty1sP(zI|xmxlwU(eW0Ps1LW8_9>Lt`Xte6>@2_qP0NF*dr=N(2*z+X= zsZq$5(X5N}m0w+#4<b_Avk=>!0>3IB7~d=vrSwpS=YS3iGc#}S4W%vlS|XH`l()Ii z=m_}3608#J0B9fOF>`~+e{;us3ba#&0I%w}GevOY!~G-&J1l2Dk;XLF*8UrKg~eDf z*s_>^mQy@PT^BQgmx|bP!?hNI!iuI~4H`+KppoQLJwScA@TRwT{E^(8oGCtz0`Qj+ z!9xFEWNK~82C5r;=M)BF12~<}xX5X}KS5n{DX7xl+PnYmiXW89H~jNLT$!xo%3+pH zoV`uv>9G3a6OKDwtpGL<cu>W24xLqdz-&zv_|Jb{N`gZa6M(rnRwVmEVEdTqZe0j8 zD}G{5<##*0d_i-~hkO!cUJYl_t-|n2;HNRzF;E|pRE6&n4GHpmva+{-1I)Wfkq4R* z^y1HEq64K0unf(?ZL}do?ctB7dNHTWCaL^3EBd4Y-?vw|Y%<Nent$>Xw6)lRX;<nm z0Ia}_gG1o_1`JCF|8yT{8juo*JF!gz;CnX6aw6y{@HzZWP~`f%w(ACsxA-9_TyrcA zTu8kKU!JUWEIv@e%2n<Ua`#EG2*3I!CBd{9M1fwyggC<=LE`gif-9BLD*8PwEv+Oo zGt+<*pPK5i_0A{1r_cqWB^83+#U-?K5^!8EU}dG?^<R!5r-BfONC23zpVL!QWyQqA zHn?0XH5}+`20W`|;Mk)u*w!Lohr1Rs>|(=cd{o8eI}0U`yMBFR-LY>`!U6it`hW6n zYi`b73t4Vg;UDPbIEJck0*W9_#)Fdeq^_7xBto!8q1?kZUMhV6N`7#n6HE!BB8MqW z+B%>dzmKVIPyLr(PN%jT{Ch<tK|4h=;ajr9F$w?huz&BV{x{idp?m*K;3YX9`?{e@ z_`h$U`voMyjkgK!UZWCB2xkAwZ(XR(iUINocJlL=DP8VpS~xh_p%cAWrg9<J;+C>Q z+T%obMFOs~{3Pm^*AZ|owDqBeh=tKVnSaH4sq+wXKHJOZ&(N4ZX=(c_H^-xwwNCtd z5Oq1Rxi^uxT>|w<Jc1WtPZ5UktkK#BhrcTQd$y$a@7hisK9De)cm|TOBx`$ZtfK-= z_Fj^HG;>F9UYDVdin|rJ^)b2*7ahr8oXf!-aP$(o66mG+E5<)Pr6|C{O=>HTt<e{V z<@trAQ%#L*?Z<c8SOdRf==8ru*_HLB@tU2ef-k6kcDu>=O5oZ}oOSoxbwg#cV?tVT zzT4+wv;3mZvNN3!WNkTRVY~Q|^0+oM@EO+3DKhJ3M)%VQ7F=@^_0f9f4@Kkf#_g}p z8&jGJY(}hO9gpfvL#<NW^Tf}X^m&~#d0<ICiBVjAB{^N&GHMx~`AC%9xQ5lm_inzJ z<_7hTMJr*P`C<9>W89;s#*I7GGqGnTxP5Q4y_V6%I4G^ps9M>V-1GB=2L^NdrNHk| ztKZv3@HrUXy6O35V>p+W1+U`t7gAqkSZ7XDuYIB2>&pK+I@7oBD1)3nX5!erfy^m* zr;~jTWgd$9yGrDVUWS`OuWY1qh1{Y?uH;+*x!Rc~IuKl}7I?`JtEKf5HUBvM_x8vz z!q?EMEl45;ks83B4(An?_BgM&PX^E3PA!R0x0TshR6&~0zAFDzsLva*$hhC;+jxQ` z#uOc8KI89+Xt2i<+P%^*>5c_iACIJI`0ELcl-}Uk*D$CZ-`(!LO57>8lDlo5|0Stx zu-?*q*0Qx~J8C8%0SosLD;gZ_v*(q26R^n;7=Jf5eiM1uG#J6Mj+bL=SvYBzx?Va< z3=%{e;!`RGx>AHL7A~ii46{od*WyLj?Q*yW=W=3Y{ewKS86|ItSj<ybBYVerO;?k3 zLf)k*^3Xyp$|{wxwI_I$@F?KHS6)ma-Cv$oUyLdXv}2IFnS@lDuO$qYIXE#1eNU_i ztiHD|pu5AuceT~d`PgB4_jUu0Y&7TNLBben_IfOj5SnROjT(Ip_=>4%oela**V&Lk z1H9;|A)^z~D>E^2^PSa{+~kq(ssr0WXfvLn`UipFWu{QnEQVSiQhc1`yF#%T++IAl zTHhGPJsA0I$S0UI+or+U)YOEO;S|pT{ODlzC#8&_;I-bxYihn~of5Zc<?uz1_LQ2D zZEokBy?g{Xgf-P0e%F7DJ}XUK#NB^hRX~2u)^}gwX&G(*c&5<(`o_nv=OC)kjco z?0*_gxvh56<|59;ef=n060xoC-=*Rxiu8_SQ0Io<1kdeEyxgo@h=#=ExA)S_nmSv? z2V0gTiw6rS3ylcv54+I9R*ove-IhL$8_6wd{ffoe$uwTpY3Gq|Z?`WpKqE&zKW)u9 z{Mf;va{Ak+ZS?T$%;@#(Xm%@wApj1Vzb3b7P_M7b@qbDNcWSs>%oEhB<6g~&8jVm^ z(IZA7R`>}vOAZoqOda&|%%W1_(5oLMjnc7=YW_ZNi%5mJ(oNQZo}3>$M^oU7j`S<J z2AHWq`{jJkz5?kk(SRI^y}Zq(6RJzUuP)FtWTuEILF?(d_?)Bq<rSe{^@Z0T<g`?I zv%74CVq$xb-b#|qv=T&^n?8J+;y7w5=FP~S+I1G*rvNd+C7)M%<)m->G`zN;{(1cf zXc#qyMF#A}(q3ny!hDjdame-|Ma!noAGoSRq%%HVd4tyU-fkPa)sG3h?%z#z3_Ihn zw>D~j;|^7vLUeyVE-fQ-sp}sMPD=fniDO9cH|I?t#^CLG2D#N(%+cViw+HFRzRH!A zrlQ10S0R18-vb_kF*>apvfhC@zm2U94xt`zyjSqq2-j6JeI?3K)$(HKmu{9=sI@CL zn>S*(s}eo+eqM}06OE+Um0$F>T(Wa4%K0v>ANm%R%4-m<_iZqU0%zX%d-+k(2E#z_ zcuRZxou!%g@k57C>A+ySUHKn^0YUv3qd~YsGqki(_JYEp?j8l9BuQp^sqFlR#1st` zt6H~NTke(>uCt<M%vMkYLjj9G{-t2P#0xGd2vtEhE#YXMjpK7p-1Ujy=OH(@$>|PP z6Nh00Qd<xble5(_SWY+i_QTGN-8QX3ua&v6t&i#Q3aIS+=Iu*|EKgR}6-GiWEH3=m zTO(PEV*~7cIOd3^6});$Td)q3gtZ}1hNd>?Lg+_Z>M4r%pXd0hjNie!yxZKDVx7Ur zvd-9M3U?a^JezKY;4%o|<J<TaP2l=Z#u{L^lA6MCbt%eT_Fn%_g_ECBKJ&b<r_*gI zF#)sok2lBpp8JrhrQxV3yR`V$x9hR5hi~CNtrjo&+shNmt}R>UqkfRdTW6T8<6mgB zEa4r^lU`zm>5#r*#%PeX^YVWmaQI4s;%+(Ha_cl5{tWF@dRHC|I!fs2f-YmH`Lj|& zSK@gM+&bU@=n2i0TI5nbQZnzf^_Krp%a-=AD8m+CR2Obm(h;&hUGL7knV`hR`1nZ= zP?=3#avSe9@dwaBqXGlnim(U4)%CP5H1#6kP^F2)wB_>do@+#`2Dn_)mYeSe&XDxA zD?PqGUdqp~zi5(Il#`>Q#d~ANa0YRB?^57DXImB&SQr{s#2lY1;q7^LY;FxP?K%S9 P4@2l0>yU2#_0N9+rh2#c delta 7810 zcmaiZcR1T?_`Z&Fda9?@h0@|wjiTr<YU@x9$KJ8pqbQ2jUdgB9v|3t9>{+!#C^2d! zTGT2r5^5x<8i^4jp(Nq^rssG4uJ85x=XYIPNIrSr=Y8J$xu5%fjJ54$x9$B<2|@lU zE-p%K5)S^C@KNGv@69akA&F~pg3pf+>xrk8`M$L7ARryKL~JA!rs3In!sd3=WRsV0 zWd7N)uXgE~Sm(KjofUFt-9~Ox{l%F_cyg~8We!214=<GJh&DkYM$l5Y7NucP-yv{m z)T$?4bvRlPcfNQLU)<wnk*wedCA@w6S8}&xa(6ztAvnDD#PQ?boBkG;m+uMZZ8+E^ zxu1vUFCN&<YnGZboXr#b{Q3X>yI(EScxG;n<q*uv)0}VWfww(z@?_q(Z?>HE>|NsI zr)S*`zB65k!WZv6MqA785`S#niWS8OU2!W4-&~IG%~TP+ct<yNL0VecYxO(SW?*7s z6Dz6}z*?$hHHrxfqouPW%w4{`Hq+I8Y;siZ)-77|lYRA@lyIwtAn)o2BLgfa5O)Ck z=OgAa+5Ya`yInm!qy!m@0CM24RfvLX-O-7OkB_FS!kC^~jJ_N35`}}s4RoBn|6DIq zE&gYlpz}P*#yPQN$`tHMgg!oUfz64}rMhRC5wf%pF#)})SM*Ov8xz-Nx@Q8^ne(}^ zXrpwMnO<oX73&jHf3G;{+xDMp&p(J+F8?`Yq!d8WZc-`BS6AVaVXDR5m__D}#NH}$ zGwt*eC#c^2y#KJU(rw3vAo)#S^?-TPo-8f<OP4P3^75KL`yJm(6@h}sbELCEu8-At zTafDmyEQ8jxU~&t^FF@$=YmeA<xWi}PoDh2N$25tSZukiIJ7u{cU~ASw*hZhf_#ul zY)sl?#caaD>Q%f)^Y-lfy~ty*0Pit2GBQ#*^1zjn;E&75IAeD~z^cR=^EJ@V-`~p8 zGH-Hn@;F`X%n>UL1SicYg;hL#x_9Qsk0Q68G`AB)j}NVKLN!HQ-P~j)BwD3KB}3`A z%B?YJnxZDJPWANmDll1Z^S*xln^a_$+p5z2J*XiuF){EHt}qziWjg--B!{C2Sx<kE zt;gN{uyLkm=o8AA3&S3y()Hk~9dEp?#n1$CdUc*b9YjM`B}q;YClKs+Sm^T2fjW&X za1CDUZ$)c6tj>-OQw+R%=OW*$13V5p3enD`GC>=QcHR>>$H*fh=6CMA%P=nd+|okI zHx$f0_tpj-y~W|z{{i`j)m_f)Rp@Ip(wUE@SDv&am1T_k<1;xS^xyGe``7T*o+R1q zm-~4pwPPnMqi#FkV$P_&-)1g!yOmVQi6Lu^v$f@QbnwxB`-OQPcbT7wOW4!JJ#Lri zXS%hX*zbHi&Gch}=6g_+&je8T#0#gdIx2`C=i%XTTU60Fb`bn>MI}8EY{2ta4RtJ8 z4eFS9)!3+6=TO!q`a5`0qBBS)C_XEz42NKa?TVZ_Rn)LtZwPS~oIxsQ)}1Os*Jow4 zwVf&|D!6qNyajTVn3`Iw=0Dp(peO&Hb;UgfT=)-8aLbFs%8$O^1P7vt_s~8Y+`erJ zho{|&IYY&=f38l$tM12Xa~O~XDB9<dkzU|6PZByYh)%&Qlr<RJI0jm!jv+Qi-1&us zii?VhqP2blQ2VV;;utlkK@tXFiINae^SfzLXiR!>_%snDnjS6?-Nq6sA))88!i`%Z z`E0tA<Vk2NIY}ug8kV3vh_)(;*jpJQcJ9{eK2W=$imIVU)3@FTD;wC?`Xu7<yZI@z zP(Ij=ICDr)!Sdn54?7$>)J-6mfcHsRTH!>n8pf#!&S7mTs)}og6550>^YDCp>Nqes z64c-bzKqh8`Z2W>G}xZi=#Cv}RE%zWUtpB(IgkfS(+sT)S{ltC!Me+V94dPaU4Q~v z)+JUd=|-PEeWDE(#!AS@%Nvc=`VRNy+~5}x!I<UVl2KN+iciSMC<VV4`%d7ZqN4|k zEea)IB{t<lfYnIl&N}k8A9RI;goM=tiZ%oM%+2Gopq)@Ua_(zt?vEe$K#Bpun)LVg z(?+m`Lm2xx$2qaxpOMyO4p1>zl?tfW)Y>{J3%Tt<Pr>c(u*~Ov_|@IRj@+w;^B+C> zZkgQR)%Wfi{NuwMZv3E<Jpd;Nt2{_qTU%?)wy$}Rs^T*~kHu6~DYdn=$*8NtZ$uuk zGB7ZBz8eHEH`kDNEHy0+O(a?_eXF=ZZ(NTd$PCr_&v`<W#!!lln_GbdH7k7CjJ2_( z47llys8;>>;GmtIoq>@NSSCt99-b#<lr}%=Rc-}P1n3~Yb^>WXH8n-~7`|LL$N1(F zD|7bjwWcs;Jjv6_(-S>Z=2#+Wm~_7<O*!i2OH=T}3IkV0FiAG?dEAe3c`YcY269kH z<`UFwPdXs|Hua#zlq7lk0&qiK>$5!ufB&5zk*SS<cXoEBDS5<?R(a&Mw%)9BPyp3$ zU{UaQf805JgUrE|sg`R0Ib*UvK`TwwH!JwhSk1MUqcz?oTn0sKGt590RJpVtftmaG zlu;tqjmQz}J(Q)B{QQuNf`Ty!&f=ec-hX*>x^Q*6y?g2*dq_w67p&q3N7|%}GtR?! zj~uby-QkdMh;Y|?_io37@|nW=0G^SM(a~|%VXr*fyKi6M%H$`%TD-@g6oS3lUJ1u| z_Pu)|Ws-FP<~dqb400$@JBA5k(x_v;_(Tb1Uy8#O$i3HcbD132Enj<HNy!qhb9}F3 zxDe>4_C9rb0Ggmhka{yUNTqgHGSveOHp#)+@hBAknKPxQeH+cro;?dLc>s`r6&{Iz znLl_?TH`xWmXdM`X3h=w-L-wNfpB_L;lUG9MaG%x@p<#}_d!DITQlI*p7}=UkctPL z(gaeK{v}4FWQW7@V$Ao0$kFg>^kPuMa?_?0#twT6KzFo0u!Ng`5PxW`|M%8|`FVLo z&UobZ50r@n47A(Prf}6^!@WE_F3C#b!=-i>v*7@wa)DcN<&EME<T6lh^PdigS%OTf zcI^zlJ$pmxejoH#wyQ$2A?T}?5fP2oZ``Q%n=zn=udc3cZ;bge`}M^<=KFG@Vq<Lp zV5*UvFfM|&C!g^tf#Pji{c<|$^=o2DIS$Q5XRij`^4`5XE`a*_Otb&c*xl}a{Fui# zVMjW$CFk+u$CvT3>vkCHY9BHjV_$0xS_P!!F_3p$buwV_o0($c%2RW5^QyZozXM9@ zn&W);y6x}p?^-)13FG$WLx)QGPJwFb4Yt$yE-fPiOIP(BA{JZl18ws2X9%~2ParlO zpV!7^Whnr00WQ4gZp#bL!Gbq={;J<2Rz4j7rO?+AcaD^+&j-?XUQP}&4BuEZ13?3r zl!Bl+j6oB$MPZDv(*1YI&PY3O=jJFWBSs6K&OD$s^Y$1KNm!;v@DS)piJ6(0*RTKd z9{*@2q8@NQ(80{i4AA`BL8>JZiQ80SZUH%=^iS&_-sE~KkmS0$y3tzSY|r5``4W<> zj*bqfBM9`@kq0VmU%to!Ml>$8@E)sSj#z^_J}Dp|1>nkUKVUy=CXGa@@)+cWl0gRA z6vkd^f>H&%S^)IhJguZWDPWnnJl~(oFDO`ubthQg*I+ITbM+gz<i8G|R{0x{R9wKa z(pI||R7z<I_xkqXt^o`N^^=1qFhGgO+g0A&ci;$DCXy;$4e7-j3Xb($-NDPpm)!P` znWbd{DDAS*YA?fhu54tpBLe9ZM{aS097Twl1mF&chUgxNya8h8V&AYyW6Y<PyG__q z^>DykW-uBw5iW{B)KW0d30zZF=qx1E#27G)&lA-O130@8_2!NIqs{t&<@&)lr&ZCx zbP8>(wmfL@TMnDe=0(JExfFXwJAyb^WcI8}v|TS5g*unsQy^=F{&|7W-E9F9|Mb~2 zM3TF^d-ucy{&Qi*?mAW_y(iq!J@oSB%a%ZFndj0Yz*WdzxM0boK_tV)l90u=VNV}Q zV_j=R@7%+ymVm7$+H%2W%`-C{{Vsm9vreO4;&K+Irl!T+`}XcNINY`-zBrr`p`xTz zb$tO4YxOt+G+9}|z<hv<%9nK{B=SB_@8jV)-^1@Ou@>tC5>jb<0l;r1^u7jI_<2B^ z$SZcP*9E};u6%oVcpR=NjGguZ=X<y%E)M>_^ZJ)aIab)McN5ff^J}u3G^*yAJoL?V zb!^0AL{vTkuNxjy&wuj1S<GOr$`o?j-lpODvkQq@jnT`4CORb5iHKZK*SF(oq>@5z zEg)DMiJG8YKOV3<BBo9AAQoNAKYXVfcU`MC$MnSZH{yAsiF^yYivF*?{=j%zb%m+P zCYIVeo2<9s^iWSv58fD3Ar6U)17sF__;3+6@alwg0_bYb4)A%lzC5<JKK=L-U~SDa zYGHr(j*oY}>5ymfR<A~j%L@y?%SLXT-?|fLd{vY8P{sMm3adc0J!2(GlN^k->X%oD zxLxm{u*G88!1J26X(drnQRagMMurFoByJl>eMZN**o1~mHXDkVnVFHfdiCc&f1Uto zDY+^xw{+AQUZYR&K2MC1u}WC6%5f``v%H(r&cgLL6?JkRz}a^m`yfX1Yfz<VtEFU% zF)EeHh1KQ+=%1crH5j0u3Ywdnoyog^x)^KSiY0)m!?tFUXXtcar5*Qdgmqk89EfRP z2m{#%0z=g8S#AAu{ouiao`7Og_sGD2zDRDF>I2XwHU!g;)5WwSY}e-q!$3JmX0ndl zdVMM<MnprnC;yvo>H(0X%T}YI1A-`CrJPtJcR#JPrcbJWNfv)-&J|P<kd-Fn9z;BV zr&vy|<HnYfBmgHE!C<ho%dSy=ke{ED+t*XBuC5%~&M;{5c33x${`Y!cKoFt?#c5EC zXh1t%b`5z9MnK?v-;~X8G~nn?lyu<iSE1|~Y2%DO!2QHBM~x<6-nd-OSZU$&n)>`4 zI6hTj!-|Q^d;o^7=&G0O?U(j%u5$t=|Fz!=%`zYE)LMZ0v&6`}<x7R+NOFFeOYIm} z9{~wT?Uc?2^+ZZcNRWUT7#dnQIApxf%~b~83NY>M_%E?y<v<g8(1^wA4<{cV5!EcJ zaA}tXN{O@094vEekbrSzUss}B6AQ==A`k<J4IMz9uz?$VT6wwpvDP6wR%lD8c%}Zy zlPBt-Yk7pqneJpcDXCikfYv|?lv<aFpF78#P4`6ul{OQD0O1I0hI{~2UHID}f%A%r z<*k~)mjJC(2-+}nal~R_2(#|vMJzId*9R1DZ!DEO*>^xzP0fzm4+8?KtV?aprb74d zJf0{wi0*i&8x4N}ZBg&QsgG<I+pmaL*AJPH(3Xn|OMolygUgVWl{E+FPE+<O05S<M znDKObEEgBAg|3_gULy61yR5kQbzlsKxsu7XTY&3?(=>w1BxF=oZ3<1YH+)!g*-%o; z)XK=j=jVqcVT!n)?`gy3&Qn{vR1*lj0@Z_Mt$|=9R5pcg(rU(h<kqjazR?0A*=x9r z6fbF5<<=vtck^b48#Xbe{d-$<;NrJS^7b`<gRU?Hj-Hs3avrw5+AhWq0s@+#$hA8u zjGCX!m5?5t@se;{L|ull`|~+qhmhH_^5Xs(qDvZ6*3%{3V%Irokie2r;6iB$BR6rk zb16tpQPBh-$`oi+aI?84+FLhMQ&T~!9t6ne?g08faJWW5NrAYBHkQViL<<ve*kM*t zX4HAyPGyKaf8fuRDc<t%mC0+st(3GPqfMykz|*~u@YrThM{$S-pSl?VJIv7W_1gxJ z!2m$7B~V-7jOT&%7eoHc3Dy8*Xptyu#q}rEUc<&f4so>~R}%tTI{k=yg~{Lw0ZppM z&st+I>TDfIKqg%JfYuux-W<#cs2ycfha+jLA&easec{DvpB2iZ%=GjHL|bcXh*+*a zF4-vz2C~JSOH3zZW;*_pF8HjoUmc8R>H`<HFD&%sJToEkYe0?pZ?vvnwdIZiK=Wmc zxMx#wtmSpJe?oEV<@|^L_~ZO48BnmCO}^fbiTY7xFP9uo>+1Pe;og-a5jO_hu=oFQ zPJg=hLRzM2QTuXLa(yOu1TZs01%OGr<njVCx3CD@<!qKXHHCpRqsEqo9D~XEK%$la zWtdMn+~hl<%@tTS&WLJ)%y(gB&-*}Ou7zlJb$1T}3)hul;^dTN_Rz_{N13Y~k%3J> zU!Z-+^=Lb60bvc;34M*=Wsu1d;DIc`Py#q8GSIN<fi%lh7l_c+H2{`532Z6g6geQ8 zbvO)*SD^vR<96Ir15*JSZPlacFTCVGfX^=bGjZc(cHdvoS<CK&EplsBKR@y4snjHG zXLKBsTT?>3b3AKhr~@AX1{P)xxPSzR31eGv{o1u_@p-@^(Eza!qxj_#l9LMoEknhi zjZw}$5a_P+2D1Tkl(flE;IQMIzrl7vy3fEsz9IjK6S>?uivGUnKpGJSoH}rf7T_Sy zXD13x#N^>sx0OAKroi49I=WBb5L`NX!6)YQy~(S*$vRp<et^BT&fH!o@1_Qzfqo1F zULvqZdANw1-xx?sT3X*Q=|Vqv$h8{I)k@X(``@=}{_j~DSLGi*b@5&6)hPT8E|(TF zoJ&LL>DRT^XX~6x4+8qM9^UrwMcYRXkhwQa-M2&=Sj30><bd%PD1vT8f=MXfV$jty zyax};1d9P*@`aBT)If$qfT)C3eH^|EdLh}X`XX9kmSEDrB1Ps1^7C`+>i!~lcx`jj zMpsw2ZoQ+oH>t<1qz|jQho@O=!gV!Tx$QC`tm<O1ZUbL~6(&m0-BFZ$YPql?I03PL zE%pa@PQX<TfVd2|XKJy&xUE?OQ6T`?@@`omO!#<KSf*#<5`$b01F?d{qmHGB{rRZg z;id%m^XoV7AXM3F1=Py3-@)|dA&QcA;Qup$xnz5+cFgFP#QF2re8xr2y7aGK3dn7; z`N@CF?%%)vXdGDoqW-T3Z(qB%=f7DFxUK)x(kyT)lD|In;+KkANk59pNt8Wv&Nw;x zmyi-_=rR6JNcFh=_h1YvCprD_|0}R`LEN6FUk=Xvx9%4o?1^7HyI}2J-3B3~pq?aW z2(?oEj{Wa|?j*|o7b)spqNDIRJ017`KJ|a%eM9^7f8UNpX}`aM(s?fijmU<B1t&kB z>UYW637*U861|o0NxtM@ND-aJmO6HPGZ5~Xnf7mgdI)C(W>}APPMNs!y^FW)3M~(8 z*C}4YK)8D@bq*1A>+gb~h(|l^Pr*qi`3f3S>dmX0n1nEivT#?v>3DlKTSHJ@yiSTc z2mA7pdx}%%#P^^G$-<Css^>7~?CxVZ`m4u!dOn#j0<MVF(dpNjm=2k3KDxv`<-32c zK@E;$G1}!l2eSHmE&LfiT>;8?s(N-Hg`#7Wtszi!chIXbduzNx*Tzv~5$l9Ky|Ccl zzE_Xg=;VtOE+mK?ig1EOepei6M7}w9PM`4F33J5ejRhkc+AW)3DXd~Y51v_Nul=$4 zlr63osgu7GM_@&4H2qsnRJd1q1Y)5GYi3Q(Lk*{KjGgfI*(O@};GcTRDS2a`v-&!+ z6lwRnWMBjSvH0Skvn~iHXo(diQ9OKjkijf#5%i+{I`U+TPIEy8fiYA###c10Jk9UV zvCO;*1;JIxqu&~g2TzxgNO#Y65#)$2SHfWNLp#$q`1$LZ^ScXE*e1L&wRk*3(;M=N zWnU0L)N|~~@ZhJLq^7OG<N&0rOo!q?M@n)+I;xPHp}Cmf!XzJ6)kq;RKk_&fX3zu5 zxpcghbgZi<eNMlzTWi@rN9}H(xf&q}LjHTnW6(#7v!bKy27j&HlTs*Bj6E5uf2B=l zryz=#>?c^qoS$e|Kr!kl!%qXxHBC2Ua7&?CUzfk(f<Sae-Igraz0<{=F)6anB>Xnk zxbQku>Q<_Uj@JxZBJicBR7sDC-g6&GUvl|8PBnBG%d#hJ)JSb-S2r|vL*sfrGirw# z%h`>e4b}0L51ckr*VcKJ5uHa#W%f7Xi68Y+tf8xBBJ>ASj=to9SVr^2dt&(Q1Kzf{ zLHE<%K8I~ECC`-nKi8XYUh-n&l|qp^WF&!EIm)(FKCcT2g+~hP5>DB9&sBaU(4^DJ zGz7mQe%v7|7kHXPDGjK*IM1ko|4Pxbpsci98;UTdW8RIj$=Ub7Gu-|J#*v-ll+MCk zKnieXD$3&Xo|{O^en`VF&y(TtjOG-DO4~e}Lf;J}u1Ee2^Gh#`GHh{(<v4mUX)0Y2 zGPNWuxNg=a)%Et%jXgHoBZ-`yAez=yb6@;w-5DV@unh<D4hy0l<=*RY8;G_(V$n{R z|4KcR{g-@CO>4Qb|7Ugjf=;b}9hZ=F4?eo#Y!NVB$oQgDBiHC5B5$i|p1ZT_K|9bs zArm{6J1pp9fpp5jjc+w=>x{z&>N?azFIco>%}c>(s_#*_t+k>`YzD>K-F?P$Q#!J- z9N`SHA5x`lqhz1#Xb)>AN!^_>CL?x@cn=;n&wZ(0Kb3SVjMYPk7^*99GU~D25Hu3w zyg0I?Lv<8AdM7#0nXLaUu$qW=yg@IyHeCWuzg8%dqX)_H@R*);zwF2Oo>0sEuJRk3 zrg4((8C{H8evL(yEj#%z)fqdOx$ZkhXlIW~wdaIsc(4cw{TnPzX%1OUAGNe`v~Wa4 zVi+UKpE%M=UZ3%@E(SB6!*#D_jVO6>sPLcTam%YA_bP0EboC75Z4l_UC1~nYxPU>t z@tGcCeVdp^bFP{8SUtwxQ0t<Ufytjv1@CB960oy5*F60YT8NLXv0)5fIu;47YD>tx z4@3mggV)<KXuo}m1MD<8JzFHTJ>U9(c_sk6xMQvCVP(P;{+H$+X`xCPwN)-d7f4>I zoqsO9n=hEfPR<fxz3{`XGir-3#pfOFMp?ae&fD@5ivvXCjELxSXIZCb@7=pZu?a1V zRm=~nRW`d%riE=!SsCc0LXt4`s@=S0`bvg&gnN1XPLutfJwa`XV(%*k|4|Bpzy5CX zXa6g)%gn9FiNtS|BK)SMDN|Pc152M?ssDX>sPy3JDh{UH%5pwQ4$-a){=cv{lKW3N zRp;`aaA!V>8n^Ud=4Lte&wtaS*sS`&z}Nv1>N<HFw9A#%8A$&CbEcQh+!Q=Oqb47K z#a9xp@^4P^8l{~mS-fH_ABv17xTjGbVt#+!=(y)e5UABE4urD~m^fXH9BG%Vnb_I* z0}-+I8yznqq*jkzwGa$8=Qqtq;|0o27uT6c-tWU;17-taJe~OSkmoe0H4Sjj+sSG) z)k+k6oY)7=`6I-lh+p_SqiCVe2!0KCD*`6Obf0e~)p3ZrY#oLqJ%gXzjgdOyq(B|- zxoY7o^rPv?EXiGUf#eR=y{KvtITp6+9BUANYa^u7T@3UBhmVTQZ)aAfa<hOdv>XM^ zruq4$_wCm?^xhkS0qM*ZuZ6iQbzNPW;n!-zT`H=UPnAjf#;)280jhstLMzb!UT+hk zAsVY6^ZE>_RD``Cw|lEjEp%-iTV!Ch8(kCIM!@Gv5`634RfPVSzoh2xuXY^dy=!AS zhtVZ^J^zF41wm!tr9DlX^~gJIUzC9kkkpL*31%u#h@m^KB>&0;X7MgNhfAaEYvYvM zd<oE3bIpNGk2su7#2ml1*50l-1Ok8eISQ(H;f1=Ca?^wD=hth!!5u%YXvCrXt*!Q! zbP(d0*nxooxo}PJ^2e|F`T5;b9p<;+&?+<7RB1vd$^#g}0fLUZ&BizI#6uypS#EtP i5{b6h^xPU-+SbuxY;EuoCRyN39+;l-&9duvp8gM~#NurL diff --git a/.github/images/AzureAppGw-basic-store-type-dialog.png b/docsource/images/AzureAppGw-basic-store-type-dialog.png similarity index 58% rename from .github/images/AzureAppGw-basic-store-type-dialog.png rename to docsource/images/AzureAppGw-basic-store-type-dialog.png index 5028c43e8f51de02a40b96ea1ce62c06dbf3554b..accfde47343bb0cb7ce91152b212e5ab8ca1d219 100644 GIT binary patch delta 21747 zcmb@ucRZJU-#`9o?@398WMmXYkzEoQ*%67#-ZC=}Eoo3zC?k85S+<G@S=mCvi0r+6 zpT~K9@B6yH_kI8V`(2OgJUe~j^Er<9@p`{r&-E6Zy>2>d-P<3;8bQCG1UvEYs&DJ= z^Ni_|ET^6nmX>-vX;s@3vzg28=gJ3tCS|>SbwRU}!ouT2!MwbNHU|Bj!2*V%*Sk(w z)1EqY>V00`eualmrL&vgQ7A_!(h}!Y*+fOd{EjKSGztDSJjOi2Zp=>mXJEB+y#mAI zih#a(N`~^jZOuamAH@WWtm&x^=Dl*;&W?qTFQ?A-Tbx4w-1zVL5gWY1E?w06xM5r| zz&&iGd-?N2KcDCr1EY80yN>MeqCVbw`f$J6%tbEU`pAp829wo|yXdRuC;Oj{GC#Oe z6|mst*Xe$QNU*%A%CXP1CH2I#by)`sC+AZ~zqNB&f43GbI&mvnQ8Z!}garE;sHiSn zy?UT2N!_qEOyps#E8XxVPnx!O%iEcRPUucN>h^j0%Eyv2KmGY<mWhsfoC_~6FRg$z z^Ua$#hq?-1&kT3)+7DfA_%^8%b^Jj^N+XS0XTgH|gK`C8&Dle4>x4F$T1X1tiJ?q5 z;wM7R-d>xn`E~qv`E6_KkLBf$#8&3+kBwOs6c*kcs#%<@6*KIq@VTm?k*@b;Z%v56 zeJ`&aqN1W_&z^mwoDjrsNuO=nVlX?>dG*>g-rK(<s;jGmPU&vMli1E68iK!zR8F{> zXUpDS8(v;XR6hCQckK7j&@-8sTUaQ(iPdD^<wlb;;jS~ZJ9qA+Jb3iT=1(1?L3Pmh zlhM?<V}dqQ2hW>+T66Vx{-f3)32(Xr<>PCZOGY~LZ{NNhaqXSOam_5xmF2}KMK;QN zw`IY}{@VWLlxy$bzkl)K#T${4lDq5X78j$`k_MWRS~!WYnBCk`q5hTXzu)-=2bZPm za81s;TPhv+LshiOGv+{<*WT2*w&L*ChiliZTUY({>p)xPv6Yn-;X7mQTlaDN7#*#} zXRQf3d2_9KN6v<ls;X^<hKBZ|U0#nLZy|3%$YG>sX?}A1fs^jfMHe=^^BUH?weFQU zdh}@4@{6!Af*vcEtd+Z0S67$PoO)e$exjHB2u4Omv#x^R_wUax%nVmaF}OasdpG&+ ze#=;8hR4ZD`8@l~D%Z3{`L=K;JUQdOUNNaDM99G#AK+P6r|9eJd)8@+&Fc_<UtPq7 z@5Kaz`!*UbtG~@BhK7fO`OFXE8L*x{?f;nS7!P6G!2Ij??=KY<KfdSMoHlEH@#Dvh zgZviN-gH9o$}wAc4XR5%d{`qUCU*KD`H)-N+cV5N_#~gxd%b(d@8jd6r>AE%(IcIx zn(&cWnPeb;v?f$2dwR#_&2Nmq#irTT{0dL{;=J?O#6WWA&M7fvvo+C@Q8yQ7hNp(w z{Pq(kG_eXb2`X_}i|WZ&&-<}n-n?^XtYvqRR<RqMyT3nmUv==OKlM>twr`KN?yXF- z@(?c&R^inx>N>0C%-i<(g8I`F?hl6ar8xqg9OAclYw-1;nVH$!>}>tv_UzKq(ziE1 zZB$Ful2%mQ{qtv=&dkX7-22K2dXs%$8<W&`i4kIAta3r_#l>QOn^Tws1cLwkF~SSy zirto5vrTC(zvgS&c{M0Fc)Y{1cum{#m2>APUtgX1jSE`8e*KTXf2**yq%U16>F!?L z*L|K*M$%eFW?+-g!h+M;?5viJz5>>3E28K0=tVBE{rD4U+EpN6Z*LzI6jWE>XcHL~ z#ZIWiZoi&y-`gKfY`oE56MDzVX)hh!WeJJ(&CSh+h3ucTwqC{koOKvEOyT3>LlxgJ zGP+dt@`O@?DjW4yIXStLCr_SBP_-WI60!LH{)6Wprnhh3mVEuXgP)&YKICk~*C_NB ze|8lQuIqVY-xS1rf`TeiuDyHjGS7oQ+=yPA{i|9`vG$ewE`97?qesiDn={Ygmf-T7 zPRJu7f)NXFF+#B}NuAq%sCCUbEv>_G3gHHS>LRcvO7ASL<9Tl{!PB#{xBuMPNk>IR zC1^J|Wpa$Il+)<vNJV4{lZ{Bgkz?+*#_Ce}+k5mMJa}-@aYD~y$Dz-k9_`Y|AoR9S zoM%VMYHGa68eLwnOH@mFWm;%e?oEe|5#hGHaN4|``p}_6iC2<5loNUezQu)zx*j}s z?3kea(51EvecIDTyD92v+A$8JUF$b&SYtKz<9tX+2wA-7Wvv|@Hj6XnWS2@wIZ?c_ z@K-kc^=_6gbtPld!e&eJ#JP#KJr%rCX+B}G?0pj}qF>QSs16*cxW8%FS*stEP$7rr z5%r{|_F{|9yqmgyv*Y5mebdPy10O<G*B&@@sNb3CUO>P;)SB+<%JS0GH-)KzZ&E@j zj4Op<JD9`i?k+jW9BEm}n^krkX-&T$9nH)tA5!uD_V2T{e^8J=<*+@&dwTTzW%N@` z`5tMed@e2R38<0s{555EWPWIKkM|C#Hae??m`OT8TejEyma$UL>HiE2^e%iS7N!z% z6ykM?MNepEu~`=htn(9nw4a-e&9ke}+4Ng<bhJ^`X<lC4iWiI-Y8nMT+qYB4P)TrX zpV;q5bxE)>>0aj3Li??L_aE^RlMUa#F`YRRkeqznoc_ay57^YZ_w4z=UA!cY4LKo_ zgQ;WIp7j{bMOau^=9g;Op=ycX)j*FuDnh5sjf=HZT21T@R`TQ#U*0><avf6$)0-J; zdqywvsy<4J*S!7oU`twU>h=7$>FFOD8hpcv6<ROJ3vzPX(LgAtEr{<y7%!<>xoh>f zmv={=X0JNX>zMK|pGo%J^IP@JKJDyg)886hz73i*#w%&%**-3G&XhWXR)5*WMcBMO zD?%ks{;H;CL%dSd(f<CPp3-#P^0UN>aBy(&P<L@Sny5)js+V{~$+vG*IyySOety}@ z66gTAxK^y)8$vda3-5e?Vfru4**lD-f7LjW>}=?zt&j0+q|zVxY+-RzX6TayMcMb8 zbqqJV>%!EBj*deN3=G4jPieS6cXYg-{@ddB>eZ9iuMd5F&Ch+BK}bl5Ud&DIoki!^ z?5rW?np~*hm3-DdY{0TFUmkb7v+NhhIe&j6xiK}f36n2QnFM2|HEW}(rq}gr@;w?w zN+0qL`>2mlIrfSgC(uf0y?@lt#vfYMTIkGQQ&WRJ(Bo8yimwhA3%~iv<CN~_?R_<& zRe5%Q<FBS4mC>KMP@9sRJT^09@csR5)G5uJ{v}V}h75D_k3_EAnZ+l$^m_t-&lVCs z0Rb0@IqpE?wwxKxKtltA&soObf<&D8u=C5Rs-EWB^fwebJ3RC9O2@;isoANb@=dF} zSDoKoCV(UT#)q}B@}XPxYUSn^7H(Ns>@3;D;8ODHj41}<J-$n3-(q(F2t=V~TU%S- zs3irTG2MS9NzJu)k}8t<&qYZ|{kFD!OT^pXzxLAjRrHFDyf_f9^`n;l)it(+&bs|o zTl-kF!|#=rm+P9CJn>PgFKRP6eXyaSAuE*ooSE72-pYU~hgV~5ze#9?7Rp68RjgXQ zyuR;QTWM|-zqQEfhz4I%C9jp7sj!%1ap|B>SeX2+TSt4V`d!auYNkj=)f)+kG7>Vf zl6f9!aqF#5_B<D^-B+X3+~A+nd5FjEyw3LR+g1u(_ocOO!~h&0ANS|hDJpTFbQ~BM zU}j;tX>2^NtiM&M!9uc=RU?I~@QCu#Fa{~PS+JS*AHRA;WuN$F#s_od6<dz>{!~dj zA0rd+r@L5e$HCJtD9ZSo-K&?V_evCPM0cO>nm_SixA^991;$S|{7Rx}2|yC|^U-*T z@j;!}dLQ!7-QtFSThaoL{PVNoe++(<+}$g&m3)13CmwW_&C!Q!I~H@oZ!Rt{ea~Ci z?YbPfJk|D8&%i(_MeX8(%M?A`;%Tmz!Vh<gdq(;mQTE(xKUul%<=5>$qojw82i3M= zxIUSq%G*#`xt6d~=7`&=qu*A&`|#kE4>k39cQ}sYlM2o`IpyJU{IfEDwiq{NY)r{N z{l=v%qfBtG#^>)rHb41+DzD$WgsX}%z`V?0Rrd6ab$cbVPl!{lDv0_TWy_niv`5CY zREez`5pJ(E&F0BF;GP(W3zyl=E@7<5CX<>FphtA!jwResd@P>S|J;0@-+$b=+&^zG zzBwXOIbTR<MQLwG(PAiP|LBY0fB?hdqA>a<(<`?sT63;m4GvJtesIV9^eef0&2&G9 zeEy;}_P_od<7&R(WyRFzw)W8SP96gT{%6m6BewqP{)t_2`$oUO-d~Nx{0KiUf5i1& z$21+x6)VqBiJxQN;6pobP}1>uoXOX%1u9<(N^F(XqiDN~*{^xu(bYRj7jq~7Yj~EI zDb1DEmV{>lmBNcVyte=Op3i=2mTE4#if2Sp^w;NrO~<>I9<TTPmGaJVk#?zXNy27U zQ}r#^Ys**3$LE|X?ZcSk2l(QNi|j3mo0T|3>L04`=h93Ex$Az@4w@;f^b>Gc68w5i zs7N^&H5v5!HPEg$I|HMPxTeX*{G70l#O&F@v+A5DJ2TfXpKA;-3S*7Ep?5rL`qyyI z??tNx?>o;Ke|PMAHL@5}{C4t@E-GmJpnv77iUU`~eZrr|rKL$NMa6LwSL7unH@@aG zkG$|`=bbxu>T+!iixvhs8wZ!-#I-+vxWB31=yci3@Hq#ky|eyV{@bUfRxR$uJ(uW_ znRKCOBs|$*YVY+)`B5)@SXdZ1(67NknKbRfx$f0vosq7>q)vwY`#+=W>WrH`U~}7b zWy_y^5#4p_e~N9x(~atnniGpwc6Rz>KR$$r5i2nh9P&D@)B7;hDY%v~V6eU1Dhqt$ zJY9*0OkZ;A)L>rS3lC>_w2Q$22q`)?Hp6kU?-r*nW>Iupf3e$T&p@=hvI6NfF70+3 zx?Kxt*v`5qD=*W9PRJ`L7y^197PR%;$El{6X>eI|c}m5vz<bA<V}6z1^hB=Zn`r57 zR@;CO--(%}p`QQ-0ICK+jj9RC8{8eb93QQ&%obDPRXO&b(0p+J{yHTkrRq?jK){-} zF7wua4;R11UJmBb-@1SQesr|o{r%-Y;O;~9A-lwuUidIctsNULXZZd1@6+t;GoTn4 zT@3D9s95WA%sW~LtC?TnL)G=B>r-}Yy5TiSe@l0-fc;n{=cX3|)LS=rczCF$Y6Y)Z zxA9HA(cH@7==@+(+Iz=I)_0cOpWE7k(ah5wMzzs7t#04GIrXO=ox)~i$x$u&>Ic9; zD_h$h(7HIM>A?^I8;<}^^}T!c-1YOL0^$eQ`1$)c@u@O^^AsQ7#v6b-=z(DX`82KC zYAKoz6B5{u$%niVf4KFu#rGiG=Ndd3CRT;8>cOTYU^vH^SxwJ=cIvI$w{Jhm&mRXY z0RlGp<HI@*)p*4p(+guiFT6ai@iCa!ki-Y&<(u$7aAFMTDEr}d@Yh48ri3YQ)1^>B zyUp9S{RW>ZEi1ceX<7S%@xtb<TW@vbnB#@|*vp6TUGe7pwN+m_fG9<rXB6}8&4ooo zH1h3FfF8<)oZX|YuCA=Cyfyh<U?2^K|BpZ&x1Ru&&kmfrw@Y;Hh(fnoq0_XlTSwWo z5`e^E+Q$V>(;VJ}w|6_(F)b}^h_ItC$CbpBn7FrY-3k(R<N=WF$MA_ovB|wUy~Q1P z<JD>7k65Ac$w^(bKVhdSPyMQwYucE?a&mH#ujjuE3Oc}N)>?u!-LiG-QDNbN#u|+R zx>p7LC2Zj}?Zf9*nacK`>ns2I)eCR#=i_si&`jwAA^%?J9Ej)j3$(NE>+9RLwxuN{ z?x=Sju=|Cnflmrz%Mze2p3k2j6BK+!7EhXv7#5K%JyH))Q&am7GJ|Qn1sqKy)8JuF zVEJ<fDth`F8XcGOz$~p<##F#g6msdMq@=bSx%imCTS~<!-~Ro1M{}|U82{yn@X>=_ z9-w$iSYq)D7lO~;J_@jS6w=DGXWMb}QlC6_Yyp?U&kVJuudA@w<~%bLfu}z;+8y5Q zw&;bT{5d@Q^|RL@rKG0n*ZgTEPJKPYXc1OcCs8*;o%w;5Me`od#a4n+h->fGQn%ND zy<JdK+mGFWm3|B)f&Cm1XGs;w26Stwu-o|7t;k{9t+#Y_FSMjyX9u|g7L8Vpkzqb| z%x3D35(xZbPtPAfr4T13QFyVJUrYW=SiyoFjNw__+0LV1`9_hgHQ#|7R88x>)m@BR z6(ZZ@iZ_Fp_Q5#LE}s8Rm$-5=tYa&~LU}mVQx8*g+~!%(qq5A}_C6H<0B&Sd_ht>9 zkbP-uYtU?$^K(hBgSQu^jKNX<w5BtmF7)f(oIf`cm<!lWMNPe4FD=vB+By>Oirb8P zd2u#QGuz}WAta=$r&o$XMaNygabp88)h!`{F>K%7y&rqN_|fv21=&B?!#3u0B|%j} zLgI$G`B$J|PcN^s&!0VP`fEU5pFMrL4UK}lumG8u6G=eLX9Waq;%!HZSLN~Ct?;q8 z%ASy0Vcn*k)PgZ)SVuh5lf1k{6t?>N{Cr&l1Iguu>Bmo>a%Oc2<k=3~gU*3%bOeum zYHCW@_4V$H)6MIBb{yhkK6>;XseU*WzR70U`tV*>*6Bu*?3r3XXLm4w;3V}l9#BCJ z^;9`qTid(6qOJ?7&MtU!<9hLt-PGLuZU1mH5|$085zb|5H4zsck#q<5(B6V4NlF4h z?&OBV&yLNF>r!vMSj6OBTb!Df_8e_VT3R~Gq)Dcue&dD>_4y8#=6R7>G$JA*kW^$Z zUD^za`Ki7Apj5fKv*!KX8)*L@f^}0@H>xwRdpdD-mH(4Shp2-s^plp`0#no5Ms7_{ zPupZigcuK@(nD*{D{#;5xOCCj@L|(s&q$7dq)Qr~<0Zabus?RzsP2f1i%S;2A8i2Z z8hO8S0UUenXjVm8E0<bCyn@;v8_O>CzVdSkII!;8J8!?h07jxK9ZmSkQ6?s6Z@*g8 zbuszEs;lK@M!OY2zM<SmMkxLm7<inP#{K2Xm(#`#>(9l_G^Ab^k`EOu1MnW3nsOPi zp;^_+n_9>H%~06#-;~MHg7c443V1P~Cg5O0g37TjV%4?s<q6po&1_qaH1q;us6G2> zzQZUqByngRK&f@!TZ@v_2Li1Z_!yrgs#+x9Ho3X$+?Yoc;EMW<yr4~6avT1dV5ES7 z@i@<z{YzjeMeAa`;L+nKAzt=mpT>JD#^2@7%NrU{d1X)ojT+<kxGv7<PxO2V5wv@P zP5L4zC|;!IEAiE<$aRqil(C?oAV|o8t25uBytNhM>d?^8(8)7rToV?a61)CQmB#+8 zrY#=cmt3_6ObLX^@8zrWr4OC&cw0LUWPJ9f+vfi8;Rf8sk4Fq{B{el%>aW1TmzI|` zpg^K1vDl=HK><=PX-rVbCYV^r{d>lwv94%mTNGPSQBlxq!_}bw%4_UPF9goq0wH<y zXp`9T6qSVqH!%X0OTVN2!K!tz$;`gVXIZ@!m6b=A0;{sjt}O;sL5|gJ&oZtK6M2n} zv)`$ZOS|BJrKM$anvQ~r35SJ+#c9hft+<JHBFDU{(0TU2$r}`z7+;g7#8ZYfAx9Z> z>Ms4Nnvt!YF&`Nj5e$7gH{0;^*|W-wOwPHR<z>CV1;@wRq;cQ#Zr|#^eftz~ejn?? z%$wUu4m!C74<4+C2CMzPhzaU4^rYj*k6Xult*&NfWLzUFTP0l1%*tvaBwG>ITxUd_ z&ef(mTK>FhSERg*{+OZpsWYq25~l!?Z9bd*`d)u1I;KzTp}tCr@VfG>&y#+$lbvbu za=lW;_k&*1^4=Lr5~DqG>eL=4rYK<tPXhyky$lQrz*RPdsr5!#X*7-X{RuXEI;tWs zK7~wmV{YtcUg(26oO;owbI?gPU05N0NUsrdzWQJJm#o1FotrJDp!%_~u?J`imo6D$ z$=KQ1+wH!T_3AIg^e^%;Znfqe<ojY`H?YA+eCgUgYKi@ie(gNkz5Y3am_bwG6-e6m z7>K1k+qOMzxy}NrQ42bzub;9z=3Er}(w8-sCS7Uw)6-846A*HKfA-pYZYyKyA(CRq z1R2xnj&!;_STNoSefXV`2ruup>2K8JO9PzW?@Y#?;^mFH_;i1nXyLI3yCd%uo+-Y{ zRQkHItt`xL+w5dVn3(b4pnJx%Qx~;Fuf9n>u6QiQdT{JY4Z~BtQh)g}6%AZXq^I8H z=-n|lx@Y)#&2)$d9eZ{?by-*Wzmql^pF^f3+hcrC)ARWtej0?a!B0N>F2O9oa`8V{ z(V+|LE^Ijpl85iJz;OIejwrpG{hyz<W&ICg8GK$^FHir<fe(M5@7cE}baZ8KXTYCn zCE1NGgW7w`wvnIUxmRuIe9y}(H$zsSs1tLZ2fYI(FO%W~XYo>S^6>+IuG~37IHGga zgp1XpfFZ?f#0)5{sY!jGbp1F~(np1bB4<pSs~uJWV9r|iY<~Rsacf)K&tJdp<>or3 z`_mmdBr79B_NFr5aPqPxZa#4p6uPr~>T~sw<_*dg#ZT!x+N%SV-aE>-%7M6(9s-l( zvmawWKT(F-G9NJ#7d+kqgZ)aiPv5*_NAIt)r}HC|)6>15c8T?Te7H?QN{YnX(EoF9 z|CaQbSOM9z4#g9KK-!y>R^*gT_0MXtMc!g~{OpM**J<}^rBCVBcfWN~pf#~TSlh5| ze_iCoZNq;t-_a<y?b`MH)}b;^<6ZQ^H)_KO5xLiVUI394_tH`cx216@4t2M2=M7fS zW}&ff`@S;w`?>Vx%O|>?{IjUkZzP%}iV~r5tEFjw#fn*PctOGbexJW8vLOsQE%38| z%iPI?goN$1JP$~4ugLb^c3`h*b23KZPQU<IDSy7_@}godL?{xJ-N10|*`|OvZ!iw# z=H?VrG|y0g6s3UL1)zxOSNh*1d#<SKE4#nV<3O#-5#k#*?l>qh+EutsBz$Vhmcqls zla&_y`t|SL-k8p2ppEtGckkVMPbP*WfpS47*Vx$D01TADA-E(j--pj5aX<JFVe)Qy zd3k<$w%c)Tj4|A0VhcI`fdmg6JeWbOx^3UFV*ttrQ2F{J?Ce|MDeR;Zd=L}E0zvI3 zOttNFg8sM^tEIWyFk1v1Cz!pxy|*7ed$Prui!52CNC!iP?E<xTL;J0l>9z~3e*7I7 z8A&nf%(IIa$jHbbf<#>fp;CceWJ2{vi}l2md_ngtOvL%6*y@rWEw8~zOsISJ@8??m zTuT8I?S0B!bOUPk($Zw@_JgNA!NN@9f=0jRenP<{Tzkg_{3R7t|JI^YkOU1kZX5xq z)g5Svk&u+!uc>hD+BGdLt*dWutkKrien32U01)z9%h+x1=O(w6dBc^(?$y0mIw;Rr zI+hbBcI?`<OY8b|Fp--L(bE4QikzY%QGET6O9SEnuIGV)1z9l`pzXMJK@h}YO3{4Z zA#Zw-O1%60L=|_g-QWEfnGz{#ejy>%@F$JCi$wArh*1L!`w*<}!`0e<+QO)EB$H3q zg_eHD%L)q5{cg){6X7y^)%@|}T6X}a@iH2n9vNO@#f3t`b=(|02g)-#q5TR93bAs* zYu%L-N`clW&d$yUPaBnh76KvO0x!drll}tb`}glgkocs$57&1c=2fxyeikGo>VyM2 zJ}J{;W7Q{K;mon<tORgDflEg8_rNp3D$n%>>RbgX06UJxjmm`y(*i6*z6^pwm~GOu z_6B6@2Ob`Nr^1;C>`&A%r2I^9SX`KRAlG#Y$-Ih}XAZp((R>vW0{ieN1Z>vJuj-<u z{lsf8lS<jDD9b^KuqUg1G2TgdmM>iSZBQ%e+1b5S+{NoNq-f&sUJy8TF^I0e0ZY?y z;ytXnBFDfJ*Iq)sqX2~o-2U}o?aXJtrf`PsXkt)9cOLZWd)V*$<`gmCudcllj>i$_ z9zMP^F|!>1VK4LTcZaCaFJozBv{_FfvlbeyyE_H5{&`ds(*=+1ADWu3^b3+#_-lAt zGWGFke*W_MdY{pvMenkwG`bcRsXL+pmHDpM{ONwz?e=<f2M6~nj}-MZ`o6xtcBLvB z0oXwfesA9}OKjf!10Q8O@|`wD`3nGyF=&s^;6w%(>I2kKAXJg*_~;P3*Ay-;E~v(1 zJzuEq-Mcq7K7JEB9`bXn#9zMy5sZWsb5#K6qtH+~Fx0vE`P(o}C@V{o3Sf3mRXy_a zg(4y%@Qyw&UwUY!7yzZW*XQ-4B6gn34?D%h<qfNi<|P&69Q4;V@JD`&??>=*xZA>( z0GW&TH}0rwX^F#=P6p5={ba1~NOy59o_JPNh=&K^fj8LA!0=o$>PzNzRVOE>_qn<0 z`c?b!3@|8ef<?Eptba}~a_i^EhozrCE9aPL3^u1cRZfslP)MuL|JP!w4>9>P(QyC@ zu54qNB*zoJ+83fQJ(#Rr_zG9cbMxc+;meG8H(fAd)fCNr?&Pbc&BSqZo(HIRkhEH{ z)q=VVo3%$B92{Ufe}JBwJ)fVSAC(qPm|X{2%ySs6`SIa?f_9<c%a<?F-S!8GN<k&N zBqyf_DFUCRxwuf_!<5ax3nr{L1f{Vy!|(`I4r%nu-_OOGW6kR$Hyq+KEBW;4K6XZ5 z8yE2;WRhOU{y1JF`w?4!%*O2pu>aPVR8)Avaw9c(e;F2h9NB@P!5<CyXD$<)3M(q& zj|=6Sl)d~(&SwE@y0lg5rIPUwo#fjV`l}yxlJ5?ccMH4By?C;ZvrqHyY%&0_vWkjh zf2f0Ps*QmGD^~R*ft~=+MiUFKD>^2|*m9}93|R+UaIDMx#Qer^V`F28R+BYCqdfvG zA?Nsy{cv{6j|WXq<Oqn4i_<kSsz5q{_KXQNo-Pyqv!(eroPDGO23)*J5OT-4^I6{I z49)9H=b20T0&WhqD$ZFN&K_>gxU?pkjc`LJ=z*1PJJjlf3xwNvH#b+HDv+D|<Ru#N z=iT@2JX-ep1PjYUIMncxJS3wcplm=1ykTH4lb6Iw!W4cj`Q7u9U7;srUV@i`#JY4g zkwd*yto4wyL(V_*{f^E50)hOBqM7{)qqp!K`@+tiHuH9T*DN1*Y93iu;-1P`>E9l! z3$6s*t583o_0MZdlWdpe^aQW{^Ti)|znj?>MD?4jtxpL5(wtGZ{>phFJp=vTwzRak z@;B)tr!A(r4865~4?fJ_zSLNlm3XZ5(1oZk%toDiYUp$2Wn`R+j5*Y}q{4ruo^4E1 zuFR(THLUKxlIWBovz@kM|2EFd7R3vUUE5>!N*F|&9_URENj$?jCeJeI@=Z1I*5k~l zB8J|CwysO~nP}EHKmQjWk9CF0Mm-TPIMt`n{yF<8$IxHZ&xiGkjFnXyXglo$OlL2b zK+X3zWh?DSVq4yKuCd9;!$Gt1B~#adVE^_z&vsk-E9Xvdhva=Jj4xk*__dl*p5eMn z?qUj30g}@)7XiREG&JC27mOr&@?ZT&bSC~&bv`}ZDw@<vcjwiq)d5YJf9|DmW$TZB z%hoT&zjkpo99x-W5tcq4ddBBe;`*uS>8uWg@Mx>v=R&y+!VKs5Y#eUXfA+b^&BVG9 zn%&Gu=j*@I*iIQ%KR>F+yK1MVrow>P$36_S86;rCN-s@MpJmw{1~-hvHTz9nOFMo` ze^+Tx=BfKe-2SG@HuaeBpHuFI#SR@had~oTst3vm1)3U-f<kRzrMfy`U9wK`ieG2! zF(T=$H-Lghp_5(0OLpzAlgn3b;u<}PDb-n?mEvNju8H2Nr;YU5&6C4!80IlutXuz5 zg`1~coF3|Lf{CnAaOZY<iw1Raqh+$=0`tRDg=#znzm>foU0*Y?>qwv(ZOk|7^Voea zT=#SpIA+dquK2z@am~ZWXAiO;htCpL?(n{EquaGyKQYc7h>!$6aLcxBx(EP~n*?IF zFN6W}YaBbEQz5xA_He+UHte#K)5_lqYtXh6G%{Jyv`HUWr?%2i<eD+Z@v(iY+8eUd zeJz}8a~6j?-l@dO(PFf!N9v2Fy%inTZ~vP)+V<CCbd_&^Z{@2%x81q7%NV)BiY{u( zZ1meWmucX4I9`Vc-neli!UwQr=6~GZb>Os7-L}6#ix(jnV9S-();@<(JX{3V@03~V zNvN&w0k@c>yrW3~87>++H+ScV^8>>#zAV)t0)7mDOEF!t<Mt|S)CUe6z;5=)%*?cR z8qi2mOKI>{TnlONIU2#b4ew~79?Xpsze(~AKb)M|?Yd#bT$Wu033LyyW}EDTu6P1i z%=S;+T~cv9X{|T&thAhgkW*FdV&O8$eud_N91~FDPh?}bg=dk+Iq5QI1yn}MZ*dqv zo^k^iMyue?9(SNu@~<G8yALUOhs-bl%EiSUqay@uk@pCP_Co=>BWn-Wg5=Lr;GM#^ zT;e^3m@V7sg%1Emk;o0r_U^s3LNY;BQ1GWIi3WeoBq%7@?PAmJO4@;q2~-F$Y{=*s z#snXzi&%$M>;a`INqR?WoZ~>$Sl%*-f7^zs*3=N8LUGI6@7SxRzZKOi5RIXiaGP@6 zq?wbp;~XAS_t)+~PIs-m>E3mhDn^Vz_OE8>Nr$=O;#gQ&5xn3d^GCn{n|JL3v^@!_ z1@8D|BO^AdWAb{aWVCrdU*C@~0uG2coxXebE}R98*WHj|FX6(W=yH9AM*mRUC$4%A zlcW_?)ja#*N?#V)tR0ze7tY!1VncGlfBDqZ6ab0W*e^Em2r+VXcBt(FN*4@ZRkk?% z*KoGoUo}$pUtJkp<*^%71$6W8Kj^kJcS<3AMdUgSQZSG~Bg|QunC@p9);1(-@S>>y zDL64VVF>Y#sj^6^K~~Dv?<{a6jeS1LF1Z^w-sJ2!H=`P!l42e<dG^lO5roLj5`uya z$gtq9w~CDZkBE;x>d5HyL8PNd^0H=b_+7WBr)OPG8zidnk^E6>+~eA{YsaRi^^sd* zW@bk0Yu6jPEz3V2F#xYNA3DQ%bVUG$RuzI~<1qXIk<SVW-nwx^@lQ6t!-y6ufk+Wl zZHQU5@5Js6o%e*qW)1&^&%C`9j=8&J6zO|_P5}RZhOsq1GsDWmGZD~Hiu>ELYga#b zO39Zm33Z}-GU66oU0o4;*(PK^bcBN=v99*exKn`BZeu;Ol8;_YS$FlkLnspqG0umV zdw<FHTi&=)GDNgx&QG`Kv;jq=y8e&6O(mQK<ca<_+4%NgBYQ|_=xqmw^3u`=AeF|G z&a<5k^RSpSirqx8p-7~gpa4MFmTPlNhgd#?!SIYhEDWfJS~L7GwtQJ-CGiCC>c)Q) zuy@Ia2}`5?NfwEFhKotHXHUfS-=r`Jb^Ig`kJG@cN<kq~ALrrxkTN<5;bBpi_Z8*) zn++()MZwMbfa?OmyJc+rB}O*T{bO1cSmlkIH}4{rgQNt2&+Zr=VsYm*bp4)=Q=}A( zN}#mon9Cw%rJkzA{&oZa>oZ~*V6-Hz9A+b-3?iRRsb2(<0qW}NT3Yy<hUacIGo%4) zM;wm9%*@R9BG=bwA2&=*tI~>Bww3_BkYOZ{DAh#O$G8gWd69jqqO}S-{e)Q{pt3vJ zv){fwshMN;SUiGlsvQ#iPUI7hL0Uk(>6X5JfMqZ`o#9|(!tv{Q{*ZHdpde$Ilw<H6 zICX11tV7`9pM8CwVI6AcUZ#*<3RJ=fMYgTOR6j>+|1l!5l}LA##;wb<r9WFZ@W?UZ zMaa@mhr^4#)~S0c9*1>L%zxKT^Cuw91|#aB<1)Shx`Y3TYijwU=rZw5CP#!yGPANI zR#z==AzTQEyS6Un8b4Ot^T`vAv5|DlCZt-nVZ}b9Q4OGjF}O}Ch1o(<g}+fBuf(L8 zW%L1l(g$3~wq&9f({}1lOBw@)8}Q{#b8|0nAy}j&*nGYTK^3>)cXCVHu$$x-%V2zw zR9ThdN|^0@$~TVWuRY}z6_<nxuc$6ue4qOV(hg!R_tDG2$>Ll^PM@ZhDqk86y23`C z+nxnR4W$s^pdLNrh;w_PTrj~yP6R-0<zhG2VH#=dAdID~;hO5|XOO911P4n)U;O;} zvtVf4+-!PAhBzX1<G;$Z?(c$1Kt{{R>O?H8Ez^+PNb{%%Y(d$GmM};RD59UU-GpK5 z+naL>3uvK!!uqwryvJ(YrEcAt+2K^{Mo9DW@v%bm0G0mH+acjbVg-dwc|@0Ig9-<e zPbH6|)M4wjUruG_W$0BMYiA$Qv(qdZu<QNxOB}f}o6dozJUdf}NbuWsU@v?`iVEwj z6eF__&!nQdIvQq9!RpE)p5aUQMfLA*>wf(7DVym~Z5K71J;EC@3q1Hcj*iAHUOkuK zcBAJV7QUm{QG!eyH=I~^RODOHc@RjtIQh_9B;gXO$JR$<AhS`357yyLk@Hmk!LK;p z$E!5B-<_?hz@;P-%C1WFqn&hEv%Xw=Qe95DTL6jTT!i_?3@MH@o#LH@-aEfPfBqcp zJf{-0)NJPQ;K2{nFcyj&F|e`>AdZvaxpwbyM|pX9GWdvn;TIhI1)B<H6O7=Ywmslu z2sz1uVx2mDIvQ?;%j8%7_xXmabLam{n(N<Tt|-_*V6F(X5%B-~K%NW}<qPI*hY9W2 zVr4dJB%M64v8=&$5jaL=N?g47b7)9TTzoAJmsUwx*#>01l9Q9~AX0d@g}wy4{0XWS z*Bgru5lo@2Hm?1D(sGeI#C2jW3;(_7`s?YSdR@QQ9akBB=7xle#0-D%j~!A8H?DKF z6urvkw3&D}^sw;MuD#YV#1$xI(y6bn|9==B`Y6LY&d!-`%T53iw{2{qpmBm$k=7}4 zgeUp<YNo%A0K}2z0$KqgPBo>EscZtEK2$&()kwd!A(Jqy-Ix(Kk1Xxv#|2@91XYqx zn#XNvV@d_@(p#DvhkFAt@c^%Z+}*qJcP4`acq6pGnGCgC-;-MHrl0ulwo1~n16qFY zDP74h_CC<CQ~H(E=y(!HWZ8KA*w<)qL}*T{(CG|t4U4EKJz;4%DlYVxhP-@ad!dtF z?zjy&l3`d&zqGUzuM+3YXAX_B?fq@0O*;=)@TdLPblLOw*j7lFrJgVa0x5ur3cIv6 zB-@XI@ZV3^rf{Fu!6Cv!%ry8KiA8Xk`}yd&*83M|op3B;>4>sDtA`&>tJgX;t&kx? zWUDpuLr}1!V}-<NB`^z_)Pu4IU<=(<3PKUATlu0EZ8S*%$klk_F)&BLc~0t8><%5w zL_h`Ew@N4&<N*6uvTw_sY`*bin(4<6*@q@23q+lKe3Ufo?H>|ijqlHf2snAMhzdP^ zZ^hl+F*ZFlWo4xJ@Ntod(f7g5y(v%sZye3bu<W0>+p9R<6MqhPNq)jXg^5rPx0ShP z&z@<i{Jof<prog-zvs}Qrw<>NaoRQh`nuaj?5=<=-|dk<I~tTH!`J2{sD<6t)%-pG zWsyaj0dMh*h*Ov>v}d$@o$I>D2hh)W<cK>I#5bxO*(!=@M^Bv^kLkGN_MZtidXd6N z5t=cLe}&w7J7yR}oFpLXJw46B-6b5;ro+O*f;tNuwet@O^29xcvFzP&-5EkP+IgX} z&|@#J7_D4u?xsNMX4WwEtKpZf2HjgQQp)>xOm6e|=$IL4Mf@7}qmrm>(PNZI&&bI! zSXr7+%RdOpE)#@+nddEiJw1u(!6qGtGhpKWC;g6O=i;A3AluA5of#a@eoU8pKJlz^ zAnYE=OfAH-tP{24e*Ehn-$P;x=gbl7s>GA>t8St5VlEOp$}8t%9~W4M2k5NGsqNoB zRVnu3dx0Y_5KH?o()^GPsVX6veZS&%LR?(j===LqtCM1@eum+aQ9m1EWN{Qh*UYRs zf3!%Jc)I_DA{%v?@=R}4;B6}_ww$GZDXuC*-`ZfLoH8(ISqs7ppJaSNLEYZ$tlEuN z!1A}}#%`u+7gj#pMl%N`m-L(w(cv25DBh27Z_TV0YM7LmNgQ5UYBfKh54J)JVaOyq z?~)@ojy9ki`ts=rI=ZjN!d*VX)KU^Yc9c{ph?xK3TL^e;rxgc_qL9iIf`Vq<MWLj+ zb#-uoRS-3e`HP)E3*1RTZl?^U0vy&8%Jk4zBee^i<}K6#WH6Ey@gBd@3P|~6<&2Ep zWj$$vO!DA<w2EAU!9wjvzJCE0062(5-tXBV{+&1lK|x?b9;z}5trYU+-F2IOjf{9h zJ;X*Qr9@;g@xBKj87<C^l6e&*Mb@;PZ-F^DHaU4AK^5u8FR;LA0emnNmS#FEm&QKr z0!;n!gZNQ`zcGf5Od(AMObJj&l8Yc#<BpF&A0qQpva+&Hvm@ZdPDTB}lM9)PNmr6S z<1|Hdr#w~!bp<pT)Yzzsb^7SOW*wgBGg@8`PtVP0N^^hHiann_tIig2Te?%UvS5lH z`v}o2jG9kfL{}KX<WIrrz#4FY4`vDru(f1g9{-5|I8L$DA#Xr}dEh!IWbjbl!T}-U zD`=afN(NR^Myw&_qhDUi|J~S7cI*VU1awwH5RH^cv35a%b{yAo%p&kyFb)V9U}!rA z=;);A0b;>x(#Td5CbI1um>jV@O~a{{43^3Ovj$lzNXuMca)`vOwZdT<oIW}0wsh9r zUZ%6FD-67kOf!+HCKQN2U4=rr<=(xx4GKb4>5h{IfJ)@2Q$XsNgoQ(JhUqr}86Wxq zq}eaC!niE#_#L=jeO%8!Sozp7(^*4({Zp<Bwg}^poCsA-vTD#Y3PM_*@I;WaiUhK9 z%z--&OKu}9T?(|;N0!CQFF~Zx$`4{U*1}*~b4gZKx6+>-*PnsN@#p6ZL@mk<<8LD} zNI=Y_u?OzlmScVh?qVMXwNt`sF)16)8M4>=TpEq|J6RAL7gzq}eauBcHwZ3QuU>rt zEn6n$V{`LMGGYXEG~>?rEi9od)U9<Jw;y3<egLY7pb1n^$rxpySFdCchB0c0-a;8C z#>e5BTd%IT9^^BtK%#+CQBgsj!x;H4@QTm85+Mc>?LtsOXvSu!^%RNuA!q`-d_pwh zpOl;!nhR-6WA>O-IgS?29>6|-ArkrCw1o>0{sHoL6zq0ZMDDw7xO9qyyIp7LFdeax z*AYwoVykOz00mDCcLZVuZ1BNw&C+vnHr_zo3L+Qy4mFBXi6a2nYenc-?phsCaUClU z^BQc&Ds6m&;S8omUqSDK&=8X3I<H%jH8RQU0cFdUE$8fy07+iKr$3omy+T&%s>}cN zQv$q+*|D*@)Lu?p75YPIUEK?88joEJ@_1@*Gc$jq%d9`b%S(mw>#Ge{fHH&>6=`w+ zZT}b?tV9~)lBVWCd^c&^0LAk<O_57Y!cW*q5puyiK-|1{#%|#A!9Wh5wQ@&Ha<@CW zB#&Oj3qot!3=aZYbCi7t+}6cWMA+8V;k1udIVs5B>4H^4o-hJ6+>2B+Y?P`D{VF3I zz~Knk>JA60PhbS`yLMx{>qs~nubKlUEYBishxKZw>^-NmI{M)+df7OXds2V_(K}2& z!@xlG)G6`J1O#oN!g|xA2!K9)`cyWoWp=nj3VT~4%V-Y;>9wiBCfWRMKu8)InlNEU zahyLwm=c*b8dN(XZ{>#JuAkxd1S8|JX3ZL8uGYd)GpGr9eE04e?5y&SAMfGg_w3$X z0&CT%ErW%EcJ&*~2Vm#IHKGe-H!JF1Z4w#xkMYIoBOjxEr$!-6m=Wu~ZQHgZLU%~R zxedpd(B}bq*13~At1>{xW!<+VL_V2u+zC2F-y+*l@FAom$DxP<F(qqeKY`Jefsfyt z5=b_E?P8*byV;*p-5aZH+A`glPdF&#k0M4#f-FQz$P5t>6V?uknGR*gZFSiJmaLVP z6&Vagd}rMc0BdV&p7ZC=gTb!(F)~sE<U}4DYG_biYzK%FaGp7i-3+ZK12!KtrB{~M z5ws#14|dJ(pPwGJ^H@t#hxa4=_=EUxzwMnR0}g#5{Wt-KpYr3!5BLAHuZ$V?OhE+R zd+=c5*H5r?khlEx>(@jlS0c%?b#*_H^#B}?fz_~aghHNaf`<;NR590D-vkNA9-#^n zLyXs|{co01p(;U(+x-ncmh8U3i>6X@Ah?h$et|#Rj&{+-C_e_}qGFXRX>9a|8#e~l zNCkfj788^Ptnxa@Argq7%_DeAO119x)Qz3Xqnje(H1VQs4(FY(2-6%vSGzksJuz_$ z6K!gw^N>4;n32>$BAnl#`T!htL`<0guq)i^oN787DM%pd;qu{SZ^jj*r{7L3r_Tn> zA%m3gAfag6m|J${U5T4@0)Hj_Wo!^K1K>3E=L7s2gomPF_>i*}tzaYGBQ*4S>g+{w z`&)AV+iN2JH?v9S2X`~|Ma0xtSy|ZvkbH-9dS{|%3sR?!Gsq!Es&Y(<q{ahgB9_w^ z>d?hL!CefP1Ibsd#~LRfmDs3JWL(|LNbaH6Pt*vlwsb9*w`i@dG8Bi04u_a~e3{Ul zxVAllU^8eon~-#QR=^!uFv&C#w!j>D%Y`%Mp>M=kO|5S?UxcDtwX@rUUMVN_J5=+h ziun#1^1Zgnsbwe<vTNVvT*fzGU#O)`gtR>GpPUygpwAC)d2Yker(qAsH9t3ZwtQx> z<)VIOn<@mMn7FvAj*e>>?)8WsPvc1n5iPk+(}_d&&Ub&Wr%)W8|2`(q!6dRg^XQVa zrZAIy(thfdjy8oUOIKM6k5eLrLOVsCJ6^N5j9W<Pnu5r*KYH~v#PdN=HO&mY$4)at z!K3#@D3l)~>dB0I9iD@hvGMV#fr|SE1_t80_rY5owOB_Pqq*q0p0bPLelwSGLSf#P zk3yly(D;qEogi|%D?hKc)(zTwt;35fe=_CsEsYniZS{HAE`S$SLf(h$z@MKs`{3Uv zpY7iA|H~KOWfP+sqfeg*Co(TT+8Ls3FE1a~Yr*Pgawa~xh+C9ZM=ad;;C_n#*+EA4 z{JR7F;R-#Csn;{F3Z?5f#4A)VH^n=rxp2N@w<_$J<Xg6$y7$tIf#s>;<KAl&wo{E4 zD1?2vLWruQlhc=w$HGBYT88q>rfvLDmU$LdO+M|#f8#YDZuBpy7||jy-6kd`eA~>p zh9fBNy=3y}wR5d6!UqWWqPOtLoN~@hhFL;euHZQTyU2Y2uzt#ZsRu`Y|GGH+r~cD? zdsUSzg#0@A0{ZD!x4%;lLK5&ICX}+OYNI)KHLQgc@=(BVcd?EyH8piKlH(e1kDGxD z_Z>W_X-0g=z(kdild~<dXv>Jf8QBwJV#T)xM(v%a>ZP(l;OFP8=65-y`o=%<rKX~a zLRW&8BLlx;usu5|%y~q>5$;XIj0H`U-O#L^v@dX4BYM-?cSsF2VP-XAgoz2u4>DTW zIDEZ-rmd~bH~Pf293ud;g|Sb>u58P0(X!Ig?=wXlYRU0+b#)!|N9cAwf`^U^OvKDL zLDx#Wo}c43-%BIi@Y=E{0b{wlS(Nw-8TXZ_YaY5}7VLolb`?qVF1DN%3iWdgMNUCM zO@P8HE-nSQ+hec4#-h>q&(v*iN$+ls`JMn6_t1jyLxvNBqpRU;!lRO}op$`BJA26& zhyT(b)gb~c=bPm;ZE`}p;3}}*U|VJ!OztC4byxrw!FbwpZQ>x&t0GW-1)hU~@c07^ z!~~qDI4ky5KIr6mT)hftXf`mZ-B7C%ax>6p-2qQk)3imV35?B>B2bZpTG2&09Hv!4 z>;T5tNxWH`fPH>vDl8j~<NI@Sa}&(kGM;#PzF-!a{chtMjajUQ8JVb+OAfsloaU=C z$sP<g46FB35M`HsC14W^8kX%mYay~Yl$od$<$)ARByd}0cef7CFed60yA_QR;caFw z(Y=vqPKHuG(CN?}&}q?vBvCfvNHNjTY|P9ONUXiUhQ>Wb!-`?!<dnrktQnUN=D7$K z6j*jk33j|{lG+K^`QE^TLiWkb#_*#OH8NwN=k;2hJq<{7`PFG@<ny0+dpCm^^z`?~ zp*9j7iOD|SXiPnAoJ4QJOgdxPC2ZbZbR82_4d=D0G>m?vaq;r1`08bA>hlEK0#35? z@F+KUx$mQ+OOf_tmCoC97FuQkP7@jd$nylt$y~ZrhxeWu%B&qkT<&F)$q8Exi`V=@ z7KMd{EX$hZd#R|lr995H{@Y;5LLf%^@xd08*0&LW?{OG<MhJLLjE~oYs@aYIy13); zSw%!Z>}W42D!zaW69M`pji=`;>3tX@(4bd9R#s&FR)?05$JGI-CEz;T%4L+OI&2+8 z0wS=N**Q35P<)Nx-De=)NGqF}C4cYi+($)4M8W%IXJq^^Z!97pprM|&;>13HhFw`v z@uJhhA&gE=L7@e8K3z(s5KmU@%rwj$T<*;$US3y_f1l8*N!Ls{2!nw<MuJSa5!47l zB!HNWp-=i+P`}2i{v`t(n3QMW>l8wY(tKwTii!LC@GOB8)pWaQS^^-;K@q1cFoSr2 zV{#D=f+0e^n{-`8V!{^bf4Z|)=O7^{qe}JPb@Yymq#|3$#>y%Q)3gcc2J(AOT+dU* zvug(C+qZi+xlha?TcOF30|UVnMsTSO>(~E5cCi6{$d(vxKa+AjUky%Q0P`}Kvh~@+ z6VuaI^z@<=)zeb3V4O#fibqL$H2|F-m&QSDfBA6HVHa+|(KrCel&k6Dp!9`hs{$pR zQ6S^6A^a9*N7HDu@0<ryhXNAF{3XUsT3Jo)<z$ArwRHv<ek#_&6gG8xHenhly1Fze z9@wjWp1tz65I~G{adZ0Xrcy14XH5tjg?xid&W(+TSX~kxIJxdv1%&iD@WGeK4g&~1 z4O^{`_JWnwTkMja0;g=G?{J?z&cWeMo2f@qx1l1vRUwP-qoqv%pI|$FTn?=ukx)+y zgQb*!eVK?{cYB^)5;Gpf<-u=p&ryugfPRUnCy&J;+!wvmA4ZMiFU1#8hd$)vMl)`L zZPD#)3Mdo-2C0c7;LVUkrmA^s@e4!HrL}#dL8>au_(&NNT`inkR-mfsp*9s9!y{_! zAvUDIwHZX!L0|ENS{@1HB?&#nx45`?GOVimHJYrp>-3e2Qc_7^f#kITd0$Dtb+K@| z`PwU9LvO^IlJM9Q0mFQwfm5&H-q5$Rs|_-NOcN0AGXfP}z*(^-9C&hcbYw?c!O@y} z0^ghjuUiXoa!jE{Fk}o`p-=%EN#M+HZ_eLG_%7+ii`@?&JTSts+?sJTIt4d3H|%mn zs2V^Rtgx)@1{=SO6(6#C$MgE@L0*Gr$a=;=+BE|G80^e{hmvvqW-eqm$c*wsv|1Jy z)QHO8cAYTjdB5yR$0>8!KN`hF=KX30Fx7mR=NA__+1M`8)6<hTf}Wwz_qumrfE^`m zNEFjuz>w8Tzd8lqweqKx5d_yk@PVRb<z06_cG?AI(r{}hgMX2G7SHe{76QRTTU0xM znXE4kSTw$~)M*<g?9pQ@OtSa4YLCP<MRLTa4Go!Hym%3g`UTj1ugOx5k7pBsh~(Hl zHZh@WWE2le`3$rVS7af#ZrSoBv&)j<K!#>YMw{8Zw^ZKk&!=aVi92`R<G{cq-755k zMo5H#j^G^4@W-jqHj!0w#dJ@+_AZqG3rd3RY1CchN){hDd^C&f%XsW0Fvnn=LL_tI z0~jgwP?@Or?~g?g!tu_Xc<c`Hw;sUW$wo4{5H?Ot=I&yVLpQTE14z>%1UhWYiaW(B zZgO%`1&xZDo<0?)$Bp4eZ{50;V`66i(~I``L}8u2q<2R*r^#iEH~p|YTl`{<z?R(X z5d%3^KOoEm*qWS}I9C!?mCl`8Q7Bfy0tZwCUrOWo9OliJw=zoZLhhouNGL36ko6G6 zlmY%wL-)l|pGfkdVoX>&IH>2_5960IB%##|K%e0<{Nv*4N=!opm-gk-djG?EOZ<@y z(=5`+P2*Q)xRW?0MwW(7z`9hw1CoXbB#fFWTA+OV5{Dq%lI?HpxR8*;+2$Q;(5+s4 zHBiA+APcXgq{O9r8$l5IhKA&UC6kVv6wvlK*vZuM%Q#pUPwt6>XH4RazY(#C@DZ2? zkdqO-Gxi2Zf|{0=9Wi4NXn8!cmv~!jgz3K5mV=9<#p>u{5IACxx*cxIl!D=<f|f(V z8(5D`2`c3R&0w}|!}hpr3H)l2>e=TqWV5pAmj_I|<ZFv_sYge5DZY}4q<34MZaGL` zv)~s^MBzs0#N4!CAt^rGx)13I0XQ8TEG!oV1OyyYWpJwQ+RjH8Flg)1DyCX>pYO}7 zuDJc06Qg<Oqu;S-P6dAYNe(P|{zWTGp5Tyd9x)&rb#d`~E7NI20x;&ooN4FA3qRCZ ztXU@_N}PP7TQ>;VS`q;h8&Vy{zv~B1Tb6aNt~i)~f3LJ{|M5Cx747<}Y3)Y4uH)pK z45r{A%Yq1U(TLR*CkRidCoWiBP090rY0{uaYo`@VJjpR@i^O(A!D^4_dv?!WNl<1X z;Y59XJ^Gq2x>ggmU7$H6)mS({#*IY0QjIeyW0SQh?F$9HG1E}Ni(W*NyI|}dSyE^d zvc7`0f8NA}IdOEKavl4y30L6{g@~*+w550y;Kh}}C^V@QjZ8`8U~EO_RDcI#U=w2l z0rI?TGizSAOZW|jmMQWi<e-In`3BIA*ufyGg`I%^<2;jc0LK+Qw3*S-G)(Oz#NBI( za40odUB~qbnw^TIqz6>r$Vc=}Y_&m<drw0@-9aa)s+N>pCw8?YG@5zvCd3^QQtvo$ z@*DyuzR_sd3CM(?F%CAwJjINOfosq+f6h3wt+CLVaEOVG1vr#Mo~HA1;J)ei0d6U} z0DN^A=v#r3v|Yw82DTsotOQ-;?xGIv3&@vKSopi6!h)rvvopD$H1TSYy5rUhBJ16* z9K~4@X=jHeb(N!HEk5@RCzfrEc!E`njnC|OKA5`Se1!YuDg2_G>i`9bibTY{swEU3 z-t#ZoZaq+KEWRY0e1n%l3F_ubu63`4tPZeaWo4x@nIY*EJ#*#?oE*n{NnZ_Y+L{eA zdvj;w-tqz7t&Ytaz(-F+FLAVRd)H=`arL;P#kNb*(n@%nmAY9??L1p)po-#w95g8F zv&3P3SFyW7($Y<z@Ui{rQ;Tu0&G}vfIbZiqN5muvX&^LNpRWdfX=#=|FMBx#Z!dNT zsx`hc^8fTx5h}sm?Ath<0L;<^iE~wPvGKxEK)@gF=1a;?`DXuS62;2OoxN3`J~1i8 z`&m#A-Lv?^_xh{HI=!2&8Y#`<#OR0W0G+!p{o~FaVBfzX+cBww=CsGsOmV!M^OoY1 zxjM9KmxBFOMNS9HC0<RxRaCV#iOwK1x8!%>Tm6e77DR`Gl4+!pL8d@AB{(D`8RwBr zFeNn+USqHT^6>u=Tp{)paeVNH&W1I+D1;=*F>s=LVu$#{6N|jZq-ABlk-r4#j9F{l zyu=xbu63=%-lJ<M6h%F7_0+|%OCa3TVtya$?fl&9bMTK5G21|o7vGD7{pGp5$^J0s z@J;{3O&yI*L)?$@s+~(`W0Vhm4P|1q8#K4{17R<@&Kj4sNl`}b;c@4;m+3?fyAY4P zdgap{%9Vz@wS^gulidEh{?=_O#Fbr}y3+{n5v}%5Y_}N{uIiXE`Z|+WbK?NxUVNs< z9(>_<q<xoPc-uDO+})8BP3`@Ebw&@Zq4PG2(aPFq%3vIrHlXRGmOi5tLcZ^j=c3#m zCRLBOXwH7S)_&V9qeyTf=U{gH&y1QtF>e*|LDeP`#kSnb_>U{es?GX^9$%9<8SN53 z=J7RUT#pKPA=sqfZhJhjbmp&tvR}hg^R}ndS8u-;{4S<O&<%Rm7t9tb%h#mo{B#qk zir8sa9`8`MKG3|_yE9J8MW><mQB7_&QM4$vz+sR!IbGc1nnr)(GiP$2sZ-<XzKgb@ zsZ>%mvc6rej=}Wfu3z*Qy6JhDr8{4FeRIesxKgk4|08&4T}>Ww8b}#w-#6>mu1X&< z7Hi2du9rb*u5YnP{r0BKHL+(jDOoPx!)ugPT2qi$d#7`b$5JsD*YNV_q3Z!*FB9Hp zZ|XJRF;@T1xIvw6AViSgsZe4z?MO@J;U}9{6$gxi$<>j$6q-nDs$JK2rrWqbmLc@- zvUBJ8+-uc>&J(^x3TH<`!u?#CjJ$_<rD)YB#Xh|!1}2xCT*t(B(9xt`msXh?{pLsA zSQHVdt<CyK<XW4z*$&zcjc%=_5`oLt>3<&X4t+qXH(FOkMD%!q{e8k>{%Y(D6$y@9 zGaQv|HMqZD@Iv?2mY8koQ_@qc8$8bVw{>2|jo4ePDA74(S*7;hJoWdd6n@n}On&HO z23=bvQT=`-B!g#|C6Cyk@y_Kr{?p0XUaa$4b^&vOwk~nv330`IrMWe?YeJx7>N(A) z#zLJpxB7;yjDJV`$jgiKea`Bw6=uocCz-6OXUqL?ML{LFv$JPd_eytQ``_Q(9+g9G zOfPeTJ9|cM+RNuoj-Gbti>FY|C8S@ksf(?hB{&Nd-q?qPC)1khC@MbksOjCGluz%L zRrJ#BaM}h2GygANql-S#`!Qd3cJ(T#yxLf_c;7dg*lvEzPx{sLj9~xFuI$t}79njL zdEMA)jyAgECA*vnrK>Hm6K{jIY4w->oNO;%4iXfb_skQcislYvW;?_FHTV0i+bu#i z3+xue@c9&ttSbGENke6S-;ln&mnJjyzdF1+Yn^Me;40*>Rh*eZsnE4u-7u(V`Rrx& zGnLMbS5DhGJ_uV~4NTbdZ0@ynhRsx4)``l>EYnf%)x_B!yQTTXo7?;XPmcw7`$lWm zKK%2j@R(kH$WOBldx7hV#R7dHE0e?AEXDWd$EJvk_um(T!dn&W|BN5IR?$)`mAx)8 zUgK~3f^{2xpdE*L(wlLc#lc~kmw#HH8-`A%sO^%@GiF#hGos`tWg-ywYMNvDg9wK< zQCOaWW%Y?>jxk<1WO`=VD|<n&s%o(7UA95Na*WeX7gY-bKkQp?<}ZW2j8B`cU)F4D zn9U~?{(MV#J=NZGtZ6WPW8&4^kfWR2el?8LGf<r|?x}2OjS&}V$SI1Ia7*>9;Nnt< z#;;kb(BnaOc&SF@$rkOaG8$Wz^J8WSdmr7)VEIku!bh!kr>x)W7Ru{R7EV-a&HGRK zGtV!~$Gd$qdD3mAc-`sU{|OEQ@%(aGKerD_3V5)(I`@BSS)99iTW}^4006jX8CGB0 z65mtTJ}u>8F{^%)YN}S#Pghbi)I7MJ%2zC-*%LSD{ZT9R{-~9D=cOe|w`J<ZH^U`K zG4pondX_`cOaH0Vq%`f@e$=IXv%8zDULMY=u*=6K>5)h4%dcuVy*~I;T|9ePl636H zvwAY{UB!Q||6ZF`@0Zo;p{RNN^wPL+y)-UdQS<vL@s~?Vh(DaCz30bvl}|ZO{j~p- zbKXBkKdwn5V-&acJ2~vxx|W`$1yeR^z~83GVb7K%Iqcc8Uw1gC-1(AZx92~<G;k&o z006kyyX~m<?)b09PJddjf7C~kWJ}4==mGQf+T?$pvZZ8b_Jj>C+cao)pPq^cmDS5b znHkp=_r-VW(4)Cl%-x=+{Z^p?+J5$Z=j+s@H2tmKnBv{3BJlLKXxj1!eK00geS#+` zB{@wMD*C8bM2H^k^nm)co2*_DA!^*BmdkcMo(<Bf`8yTXwVBI&4~tpv&L5zsgC{!Y zg*<=WL=!$8pnpZJ*Q?LWlXT-@oHu9maXvsZ>z#F)_0F&NkOsC7(Dao<BuNonK6L3L zA$98QdjkwI{rvNZoZ7W(mf8RS0Ko0>T$gD&u;bWmZL@madvzrxU6(Iiy{+vQmj~O_ z)$A{ay3BjT_azN_t)u=qx^t1+$;ru4YEng-D%@N4<}3d}>1mmAb2G`)+fr<Od^};j zW>45~Tf^q@6DO6Cp3a#_002<1Q^zir_7F;i$z&?l04Yh{KGtGwzqoNvlY!ADJig)w z007+e=1lxbb0&UO+QYc35F!BpxJ!g~c|cN5X%C}R-FOdN4SKC(DU9Uq$1m0Z005xK za(}Ugdy^2_ACsTi4wInS4U?eR3~HELTH4jp9s>XX0RAM>(yq$W%TsQtm#^r;g^Q&< z9smFU+~F=<xTw_B%knK>PNuWx&gGmvdqEC|LszcYN_%Vo006iHl`mgTW;Zugsai=E b4-fqxONlazZ+JG900000NkvXXu0mjf|5^p) delta 21822 zcmb@ubyQaC+b;T|VqlAkA_j=0f`9^&iV6ZMibzQ)9g+%2P7Fj*L8MzsTBI8+q+3Kl zKtho2u6@n5_V3&Kobi2QoIlPOYmBA%`p!9@`P}z?)#G&f+JKC;AAS>5*<PIlJF!Dc zTI>9};;-~RU)g4M(H`K?x^>Z;Df_$2;s(E0mppHt)o!nu9Q)dQhOe(uuR7F5F2Ks# zHmlV3>({Tp2L@C{sJSAF#w4~;C`TyL7tSfn%{{mpDxwl^>z4J!D?27CTIX%ds?8n| zM`k9az`nJmGB=Npb)4QN%h|TJG=NXPOJQI@=I-6Q;r;LA!m7u+OD5a;@Duqr4k@(J z-QgTmqRU0CuQszDm6ollH5EU6mY$wn`GbXEb<)s_;F5@oFU+m18dtU+67iqxtD)<- zxN+Q<bK1qL-T4T?Zgxk3V~_EVMD}Ti;?`rFoG)y>*3735(iAS*abGj1s6;Oa3x$cZ zusr?n;bgp0a&@SvJ<XLxp#jew+^J@*`z5Vazx8Y{I(p*t(GJSQ;MOmOjfL;8_El9@ z>hzR)K5=nLv7a?<$ug_?nW8N%S3|g`?qJH24^y_999X;SkT^m8`|jM<A%?`9{o}uV z)|B?SxVTt!ecklk=yZw4;gYhlO@|L3UYYCO{`t$7@tK+RsRu@D#8-nok4kCj>K4B_ zCM$TacMCs1|J>Z%@87?jWump(^KHMsR}X5-v(Yv&srveymWPi|``gR?coQcb=FER2 zsyxQ0`s<^E#fd|l1ScnpT<FWRG(HX=w~H_KcK-hTu_{R5dP1YaOtZeApde+(p+nW- z=Ux4Iw7+o{=5>Yrt*kR%m%M4i#}1qADLl^^gdapJues!m>veZ^No1L}DW@CkTwa`& z3cp4%UtX~4tqH41x|L;aVZq4Ac+URU!?hbWZrpe_NwFb8DOrigmtoX!7h?BG{$|F= z$M-_JNUe90sw3iLEvv(-?(b2`M8URP>epv>(@?KpzurG6s3A>XZq1rC55|5|?cq>3 za^#3JuC?~$ozLr9GEFu+`}xsTS62_U7aX9ar4?Ho;<Fz5`DuQ#Z~w{Ll*5iwJ1P3r z!FT?Y`&_ti!Jw5<RFn{PaBxu0u{`$e+c!$0O4`$jKNaL9B+j32PB)~ru&|gKZuRpJ zTiCdEZNS<S?U$q5X;mVvbvb@|uT8Z-maHki$C$F|tzyC%n-K=`0>U;U%<SyXBc(j* zvn{l@9TfVC`=iP>?_7hW`P|+fYS{4ZdY-k3^~kR>yc{Cnl;N)N@o^m;9rKZ2XXyFw zUb=K?<EsM#dW$o|3UTr-`}y?97aJCKnEusz?1j4~Ce684ocR84t*t?&rI&blc?E4J zm~X}_bc(OeZzun1iTlBp2`pEAx?zJ-uHJY}V~^+t$@%*~OgB(7uxC=_BkMkxwDQ}{ z3`r9&_MW&TC)f8q?ncWpr()t;X)l&1PoC6fnQ6Y)EZTNfMuz5IZ{?k-zjf=Vsjuf) z{!z-7VAKeW3*gZ-+xK4mvUOK&qt@mljP|N;WTLyiy*e<rxTvkI{WvM<1Zs*AWivh4 zlxF!y=F#KFo3_`iq}udVAM}<v7Q}B7p;2HrN6gRj;N9VkD(6|BC@U+wASK0zA1q7{ zmb_QbGiXVV%lz`Wvhrnz)8f`r)8sX4*Bbsv+%M&E=-A1VJ2W*lGfi40B_!5RQBft& zZKJu)`{stcjQF$fO-*0oq6_$6S9;Q(WhrKz{CiG<N{UW>vbQQFE$z$KuTOfbf@lvO zyg~%<>i%uX;1pk7;-d}ENC@cR4LfQgCeLuO_#YWC~5Z(7>gUvlpCQ9h)kd@3%c zK7anaYUbVNGSL#@*KTWRJ$m?%N+$Y^{p^TE_qVN*FZVrkaiKOfHO<b+Aq#o<Os@5? z40)CM=*{BGQ?$>YKmV0$^`gR$yCK(VkWebb`#G&;6r=W#dFkL;UmiX^<By$wLZd0# zB_~gvio$kb+f8FPJy1L|+)DNA#f$E#{)R0Fg?97t@eTY)lI{NXib~LGU^jMsc3z&g zmX<`!)ew#0H7*aRPy9NllCG=sK4w?Xy4PI80|qe<^Iz81UPHlGez^1H!Q2?5Ea7{c z>h@@R!O!Mqi_Xu~c;{Ce<8R)pq8s^{a+HOI<$JPb*t;u1Sc3BzMvd1vd_)`<yc=TV zx_f#qV4Jbu$~^vf{nj<V2O1NmM%sdY|GrJxc1YxzmlrKIB;)bpTkP%aO*;y!(8NDv zWc+E;BpmyVX(O2T)9)(`b$umH9KIyhy4JS$@9Fx6Q^mm@9e&LP_BM|mJt7Ny!#0Mu z_xh?^mW?u07n_o93EaIqA*S)S`JO1J{)3Z!MHCe6JlBN}si_g_dDcT6MPXr13(v(I z7Ytlae=TZCd)SjE`dU+NQ&)@Ttj0iaYnB-+O7l4_E3fG<L6qi&2M?|Y&W?7lo;kBW zT0USfv?^RNfrp33HhOSpgrMjF^44-3m#<rI2zBb8#9#2f62xB@DYboSYRb}aMBH&f zq4l2?+IvEE_k8}DgI;2;d$|P#{o4!djT@q(q6{Waq4}1+X5>{;$@ko{Wp^~~1&%Ef zdS0}bguW*{N_$aYz0vEjD<4r49TOvEWW=GOqSA5?_4nG-^W23C>xz~pHeU%mRW|z* zQzzA;TM}L4xvQ&`v|9Xw#{q1UtMw<fj9A~D81^&Xcq{4Zc@@c7?)^5S?SFd8yedOQ zgK)2Wc2fp;fs)G$)6E&ibQl%Ns;U!{HR6$V2G5>9XXNGG<@}9!b$}La-iK4kc_{9% zgg1-s{z#GJ409Wu{><ygTX^M#pCma22AZj=zoI|wChNzQVq<2VtT*^0>A8nT3>M}7 z!1qnEva<B2jTCw&&zw19G4zwCI!s(nPmg7Bc9fNi%e^JTIPx0X*wob5rY66h9vu_m zx_sMvBkcvU=s*Nn9H))Gzjaz(ptjc7IG*cMezz@H>dmj`FF#!f$V&~n<-cq3<W6Vr zo^-W-S(z{~$FZ52ZzUyCi!EKnFEAMO+H$R;-o5MU?Uh80Zx;0k2|4I-Sp40sEYo%C z)_pLjV|sTrBtC?8vOgxQtEcDdaBJ2iL+jgfYs<aa&nFS889If{MXy!P&<>nV`u4tx zb>ebI>}_@TQqI}u`Icen-?uPv{rYmxJE+>0oGtqL`f6%wmIdv3HfH2}Lp5POuE$>0 z9d5}`NL1b#&AS-hr>Lm-z}}t@o9*SRSDTl3nJ-8iHfQp87OA}pbSzf$cvdmK*j`jx zUQRGA`BkLfy|w5wiL%yiNjD_l9$s75pFhRFa_;rF7YJjo|NQy$w!Xe=T%6(i?g`EV zXQO3<0|2x)F1gI#ueOgQFvlfWU^|kGG3`?C1#FM9X6E_$$9ji}`4~sNK}xhp%33 zHOdH7Nz=QIN>(ZqW0ZNMp`)YV8>0S+*e=Y)Wx?}YZKZqL^YJq3m7(w)mp3h2O;QqX zYjpi#zvSQ`^6uTcef#$e2PH{HGM+ebrFCu%TBH1XwHyc6O<|&@W4}K+tjzb-pIwzL z{v~(2+W%Fsu-(z7$<a{V8%ZK-OVYnhdd<ovGW7TNGqbSB7do_WIF-<7bc+5}W+yEX zk**VEJZC4fW5fB?(n+;W2Hg`^3|k8rZ_rH@fBf*frd4S?-s)^*-HyYD<>n{;Y~CUm z<`)`zRbGCVudgq+Pt1;E!+PIM-ZT!>Z)Pg)s16Y>!6+&#FW36?h?-Y{@yQN}XT;0k zBl3sDrs);p6`rpwFE-%iZ#v?#Lt^8&#~$W$J;t}SwY^5m&Hnu`P5*jYFRlzR!uD#^ zj_BJRnS6I|**v+WbT}eeGd)bq-m|juczk30r7(~7NbRt1#g<p`_ab7MpY4u#(w0Br ztjl+P-ay_yFt_pZ_ey`Jl_#bTQ&Z1|c$de0QBvXO+wE$1^TWM#uFy4`@%JtsITy9# z*wEcMEBcJYbAw!4*)&t`rp#RM<q;ry)#kQVKh^X*BEOOGLfo4(o)X?CryCUFf2!P3 z{TB6e%_WMXqv+)d|7*q7G}8^=wS<%LMAvukx<GTCX1Cj$1fyfNrsS<1sbAPgKHA0* z=^gCk{~7PI;HvollUkLyq-uA<`|FQUr@r!eVI4i)Kh4R>F;dg2KEyuW%oBSR^`dVc zXVf_GipA@9hLoUvj}SY1|NJ`(L(L$kqraZzgne9J^!Q~!^VXx<wy}@qY~~zCH5q<d zxIYoJDqO6pykgMw<@pcw1KyTpPj+0BIj19;`}F#uia6D@HKPi=+$Yt)HyS*(Q7!L1 z+P*K~(s}lF(@9p7KP?yc%vcc|+U~qHPUnxV6`D1bsa#$s)}Q(^&(kB@;t$me0Y|2X zQ4a=(Tdmg@oe{75Rj_wYVnuHd3+Lv-(9~C~n~ZX|8eK0xwp+qmM)rQ^_bVe8MOnsv zrqjK1OrFrGK3H^h@`rn}w>~y^Z*MQ#ZZ{<%j~&MtPn>?Ne(UPa5B3aJ!3o43|B+_O zt|J37r{rjFoaFUww;Q)^U2zn2l*%u8Jw8lxWp=q<^XK>%o=r?H54OtaUe$TY5nftT z($Lg&bfvDrublPh(Z>K~_2K6?h=_>%{guO~={UW|$ZF+0BX{@jPmc{w1!@V0&Dq%P zn)Oci-ZC|{`u<Uj$Auo5Ne7Bb9N|X2lK1US+?V^?<>chl)YUDltfG~YHI_zKSGdvX z8%MTp-mH!0m;B(g#O@;3_;pimwWfbLr!;e`0K`2row9Rtc^{13MmJuS@8h^iUi{9T zJCp|x9*q61i`-RnqlJH*w>{qFG!RLjpQh8Nni`KUuG`aWC-vlS+~5ETzLD~W$A0E+ zeZyo}5zE&K^ee6QsIy|jxsOH*+c)oKII9@9;(oQytH}K*LC5@6`~tfEQ7L!k<Huiu z6*Lq&+JAFDxY#1zoi?E&aIHSdgf>^^s<f@W)65tu71Qp6ZpGesg}5~zg-7$h5UY!t z6i_mZh0mWpJ&cWI>#Yu{aM?_!T<CBH7&-!o=yCur_2$i+ySlr_CnviBqt9BKRl6Q` zDkVxik5bLeb$g6YPZzhe1UfrYW=1=<e|)lu)}S?W*f`s6T+SL`<5AO-wZBL6Tz~ps za6gzoQBI|^%|+s2csL_Qpx#GkDuYw>g{v#}g$o0mrtSG<m=+e+)_TBNLv49}>FKA? z{r8F5okC9riwfPtsc1g<;{?OOgT(yOWKEn#fzbb<8NYjao_Kg{x3jYYNBaOIj9EaX zoTj(+PlaC$CI<Bnznck)cZ`h60Zd}Ag|ES8A;%U)#BS<YnHOuC-L%o=%a=9!3-)%| z(zpNsudS@A>TgbC1?ClbFy>6Nhhz7HA~A=#*T(?o%zG>MgDH=VkAM2~iONT&INx?M zRy~hD&t~)+76jLjkGXpA^XJck#EJ;$&Ck|WKAqAXfafHwzz@I~p5jwRgH@B3)h7D- zC4e5}7lej}lKdz;Tae{y@Uw&jPIh*7YTwq13cM)Qu?p^@v8nzW1n}>t4Tl|G$CxAl z-b)t^cb&LxaC>fM>H>bdM@mY{gfgH1^5qt=e`z0%o8;64;JO?t643d@brP_o0jPlG zO5nP)YHAFCK6d~z=jP`-M@MTwd6YBn?tk6ZZD?#<5qR1d@Z}C*O`=-P8{ke5WZ7XN zu(&n6%zoR;iT=d4Z8U=Ncd2xoe*O9-=rDJ3|Ni~4jYfyWohq>_n^Sc+WBu;7q;JAa zZP~JgM8n!8?$L5#VoOsEa#Mp%9uO%aA|nG%-dTgIXg9rAKV{P5{V(%&2?*F<v^;Zw zf{FU^<5}E{qJg9B(j39l+1cqZUQBm?@W(5>$TtB2n?8=T<yqXn?@f{Seul5a))p}R zg$aH5z=0qM@s88<TN~b8iL@SW8Tysug_Y+utY^l~E-NkljnRMV?$6h+U+<t7Fs%du zcsP{%LBHk@$=p^~mgk4FI(}wb9BprJzx(q8RfcL6fwxU_T)#R;U0r?CrcEUODzKlO zs1oQH8!tJWhB|YW7;Fv^wm}gyfjfikr5H7Gq^71$q?<_Wc6s=)Yj_jWmCKjYUtK+i zZA4Nd-E!|v;7M|90=Kyz5_QYTIkR);PVCQ(#>U2n#2iYoXEtu$9BDUA41m8yD(EG@ zJ#pjR78;jFxVjeh5Xv{(X;}yx{m<NZceF)L*9pG=H|No+;M9*DYGwpmET<a#<EOc6 z?_S9Y-xJr_b_WYtxvk$yUz?&Wh3c^#Etoa<9=kI}F6>)b*>m@U!t$ASRq*HQbO<6~ zuq{sjTmS5g2q!BmE85D$=Y{$rf{4GF@DwtKq@-l9m?Qlw$@AB)?Eo%f%N(TZQV9<a zC->l;FHa5a_dQ%Qs^lYc5%~MZj~@)e)-QklRK{8eg5keztIp2OzHMM|iM+8mg_e9F ztAQtAJNVkAmBmp4?|myS%b}Q9`fTS>LG#~d!_Sukbe}S;Uk7Ms)EMuQmnW>Jr$-Vi ze3e8+NF?yIzrTNN#6_~9Nz2LAG-PhNu3&a$NArg}=fOm?@AX}M-?TaKR>U>7OR}=( zlN60t^9u^7=H~mta_pu#yjbPlVa>4ebcFvX$XP~76TW@#2_2WW56;xAe^WDa)=Bi( zGh?ESGt+_OJ=o7Yr%rt@)H5}`ie*sGy-&Vj5KC8xPJrnX!&D9{R*sI2m#<urmXV3T zduw^h{~uzrC%W)&e}5e$0;nWstcUhtnFNIjTN>z}sIisShX13SU}?|F$!$My;J|R< z(umUXs^*s2yRCIlg49a>)HZQvKW}Vms=4WE`80)(m-l|*deMSkn_s)h*U)eV?YMZ8 z!^Si9<@M+9T!$phYu}zj>olPA;`3pl+UBL|!*N2FZdHt>e5p_Lm4C}~L)pbY^q&<I z8m{@4i923L@2+oXz{^>}97t5p^Yu#cVI<xw7htJ8Jv{~gzp#_QQ-*8a-f%Q*dVdgf z`ZJ0Zuf?y>db}oDR(Oop<lCg=EBfMSS-+oo0`?ZS&dnO5nL!_bgynTLL}(ma;Rg03 zUU&2jr>ely+63CiuL65NZ|~itgi-tUVW!fUZh=gm_dhQ?I`zZ1I2Tb0<DiH9r(Cs% z{aS~Zdt{OmK;X0u4a<g_(;z@>lZoCXARzE`%l<cgJ2zqI=yZN|d3jj;5SSOb3Pir} z>yeVAUWKu7Z{Rz7sEDnEmR7`!pnw1&urM=RfjS+Vn9v&em2-cz{UCH2Z0iruL%x5X ziZ16~5v?o_xRz{q+S)|yQ{-yV=skrGTv9zgix)I<<W!B;@1z^)JX1a#JxMQYeVnp) z@7_}ewa$l~=BR{)^VAIAym<p%?>2-*=oOFyqyS2&{x>~ooFTj&=KuJ8kG+0=QAlSt zVs2qU%QSRZd(B~oF{+i7mCODo&$V`k%R2I$K3)9f%VY5PO#)edMOg60R1=fWM9$^Y zi*B}dEtWdEx;s}YbX7Bxmdob@0s?qUT2ATJgkC`p-CUqa$F1=)D@y>x^yul+d$3r6 z0%q@TIGMB(nSVgax9mGfiI$fJ|MBP3zv}719m_hd+ZwIk%5P(16Y~Dzl70V0NlD%2 z<~>Uvy1Og^6ny7~j&yx4a471>mhY^6OGE2uUz^>SmmI7K)d_XX9o*sR<8$%u-Q!r0 zoO=A^&Fk0B(b2l0+Pi3JGhQ9j*=`JoN2n!l^6W18v*9{xH1AwmrhnjSTjaib;t$Vg z^IMMm-C8d{dH8c`oMPxhZPo7ivc>rkCDwNnksaqQSH0XXGSe8g<+Z>6Gf&U!p?f0m z)L%<VZWKDqt0fzsq8}clK0ReyuJ&~y6*Tww@#Fi%9I{R67~5&~_tO`K?)v(vR{Q}W z|FPzfZ^o%;li8=2)obb2et8p6q4aZ^{_tUsxHxu6N$w8Xz`#Hm85uWg4ND8#0PFtw z%q!0x{d$>uB~?}34pd=Pk(%1GI6V7tslcc15)YLOqdlxwgMXJCCcb|D++{^4y^--N zpXH-V0V<pq*lP`F2+NN_b|X!ne*W~g9wu5+?tEEK@~y6|B=0y@nf{Vz)>KSl`IJj# zWmiyoXh49=f*}ol^m%H}-u8UM%F0TEx`>M@+ebGsK4H@^tK$B#ar~X7b&CG*=jEl$ zKDoeLp|{7iFYk=mzL$-2^LOdEU?B&e$r7ghJkdACcPoO}urUSDvR`2TnKitHzxBt# zPV28<n7Gf{{<qw%>!Qw`SO3zXfa8ffNnW&r`-)del&P0`;4b1SbVZQ6e}0_HbLylw z$;UvW{(k#-mhnG4DrBAKKOd0L2mSh&Z0+~{DlL#qb5y5|CxR(rvQ4usd{=>(QJJ$` zn=F(4KcBh&*-iA>uY8V|4Mm#zE87oW|B_-^XvmcOOaG6bxR($0+5(#G1aq=RK{<5n z9GlTYq)>uM1<7uYP0EYnLdV4qSy?f9Re|#(MOK4*rQ8`9d3bgT3kw6Ko)i$^_RUA7 zOG`_C`u6Reay2VS{;vCL9j@M{V)K%RFK_R@vunPaC%$YVa#J0bQ`R(~f%<Z(my`1g zu!&+nGjxZ5h6St?m;FNhIH_D0zo3H!GdNg5f^H1=XYTIbz#E|LTLL6Ag)GK|Ih9+r z)tDs%GA08?H*%dN*DK<gTLCLC2UBh>g;#28Njdd4o3(eFQ(b`H_8wP03n-bM><Z7s zxQPp7$t{U4IZ6}|SCp`yIf+6SoBO?%g0h+in2A%HFCN|V5dh<vhX=R$Vz-Al%jwe@ z4>oiC^MKB~0%+&s<>lqk_fJPkzAE2yb`1p5?va(*9S^j$m|#Bij&**4X2c8lyMD_) zXNmCN_0h7>uNy$spg>-WQ@B6!D*&o)_%(u!vT^%%eROgd2iE|g;Tps$Cec$MHj&Vc zWC6Uo<tJ??bgqVpRYB~U2bPTknuj_X0iNcfA!lbNL;(hEX##v7pO~mOMeSl1Y}&f@ zVzhi6uE}!Q-x<&<K`}`S;y*Jh>%HNY(<Jb7KS&6tw*sz`5JLn&UrucP$w6Ujb7<*X zwr*`MBE+9QeL6MT5eBTj=C!x?6W9f=+YWxNuYUtI)O=~q;_0@7GPo5%rzOF2=gtL- z*zN-CUB8XNe^8W;+_P+Tjm;a**W9~ZlA}i87e!;)U|tl}EK_xZ+{8rUIE=TeXmYrT zM9rem7j)cRgM*uOHbm;zg#Ljer2~hF)T{tixzw^LADh$k=eu5T?-RPuMoR0rv=;2J z7RFxqBOlB=B}nNS2)54P6gi=>g?H`V{S`8ra_)V03~3kNh95un($UdjSCF0#0e~ig zdshm?ym=T#tOTsC%oaU)`cw;40Ek0cR`$!6FKd;Ql(6UhVX0vFRAeM2C(D6GK;hkR z1QH~$ht{1tpCB0agN5S}SfKkln-$JK1-0OHT6$2pG$Cu+mRpSR2?Go-fbU-KWzxGF zA=>ixpElZ!hjr{+<s-{>DbL$LE^4;c%2uPHp`lynSG|Ns#r}60A3jjXZA5Z_ochWz z@x#vGcsqCRev*-KngW7R41<CF#yiSe1rE~B`v^w}$kqH$`JUk5;GeLZaOYpDs<u)v zyr2Vq0pCb}p{)QpOA4xI`aG9rVK4xr1-6E2hEcKaiCfv$!_Zy7vrPp;0X$>bvyoJd zH`8&E=z!e7cp5-D(q2i^tBO!eQl)I!&-(-%!0U3@QQ}8pC#(>#z%-jt4G?PyKQ48O zzlbd_NpD`a-3km2ekl{pbo#UpSXph9w3kHk6|$07#g5Tm2z6WSjdoACmBsbCATS3@ z_p_yC0?2($bHR%n?=CY!`f%NTc+E-6o>Gy%Y;fPgJ}x*0P`N1=Bqc3jkE|K~>@^m4 zcnfSCz}#*0uX<gYybiqOA^K{#ix^-)oVBho!M>xwMyl~?udUrtdPpx!oDh5X@L}Su ztZh=PJuMplah0W{fQ=p{BqUVplAZi(>)@+kT0>J)_sGbj9gedH@yfsb`lWW@Qe2~v zNp5g^ky+6)e+M-OH~rHjrQ|~pfm$>w=tw8e#;f8j^Mx&2df-E04dD)y!65@2RQD{O zNaeU04`Y|wk6W{PIyNfUHi*K-#RV`w)>B3cA`Lt54lEUKyygoPUVPz<ggtYG52q_6 z>CDVbuvv@6857FN(xe<(sY;Z{ueP@4oO`TLWul^^;XtTlnTBL$jo8AbTw7bM|MJC) zqdYw0F7vo14+sUn>90~yOVSELmz6;8fRZ^iJxy+E<EHn2Jj7Ryz{ZB|o@PC)YQh~8 zPK0A1@BlMF^Pjj&=Mx%w2nN;N_WS_&hgw=%W3#hOR~a8n{oRRe!_3d`o2pwOkIIKn z2if9c^?CAzn-yt|K2IFE_8gkH=A3^R{ueiLE$;WELUJ|Wo(eovT9(VTTr{LVcR;{2 z3gDMQa&wh5LXXFw_6WWWdI>2KyYz<8?#Ri@gD<@W;!c8S5jfGp!hFdOtHB@9aMHHG zsmFH$`aTa2zw@yF9w|zE{dytOw5=RJ&q(%QI3u6;z~EQ5MWS-bqZ+ZrEr4~Fmb{0F zr4)V>j1lD`C(%QP4neVCsj()m_o&Un%TvJ*&%18B7^lE{`y&PSLji3g4J|PANCl3R z^mLuiPd51n2JU6w{!fhy|NR#Z-sH@rHPzVjE#PR=_=4Q0?F=>Z#q@oOGu%tX^rcQq zRnW`glvA|c=Qz~>L6OB`({3x($E&ZWH}SXbC;?D*l9$)+j$MZ86;;(h>rM}@P%%dt z+%QC-8iBdXva(0T#6t0xSZgwR*X5p}>X>Z3=z~TsAIB^zdJvZ5d(8jX>ydNh<kKj~ z&18@Z75P+NF4JdBf)Z@?fA#OK?MzhsNn5lR7d{ihd3_&zFVY;jXfl2)+nf<?Fa`~X z`Pi`($3<%lA(cW0+lS|J$x>P8ZN7uO{VpUO$Z_WAEvM+WW*9epLr>-7OKVa;MJ`8v zr{$wk0ZXe)HWd`+76!pFE4qKS#_Daep@F;PM>dZ4zVSL4D1L^-OB%y>x(|<-XsGG_ z3#XzD&d1PlJ0^xd>`b8cOn#F?UirzKKJUqErRJIc{H8X<>uS^qFU2SZLRwGn-GA_u zz<=Q>^zf^XF8y<<@F2hqng58{pfWGd8S3s`WqY2~v0UvlX;WHRUY@3@Dd%xcyUp;| zfO<7U!MDcEHv8w|><#zGJrj5;=_NhZax_@fGQ`_^%Ar9aQO#ZKi@HUuX0*2~EAh28 znQizcB=G;OfG3APk;vaKbL?5=rKXeR+GlPWEB+3V>79QUr%=30pU$5A`Z=+cD3%y6 z@7JGM+e2g{pGoBN^vboAXT0DT8dUhkpj&7tf1`eXo7EZPnJXWw>vFwi*}k?Wunq4y z`+qCo-m1jQ9fa9SxQz9in7D&;%L-yk)*T8`G|1Iod&yZ`PRd7eT;}4xb|I95{E>)f z0?Ht0d6~gXw`T<h1eG{X4gVBN_<8VtAkS*Qs!TL(*Ray}8Jgb(<z8oOmV~Nq3HwTv zwR6?8tW3@?F8Wmmm+rf{W?{juWjIDoK6|1hM2#>E-F_q}NBD!mm(qy7owSdk_@OeZ zrWc-WJ)n#{1E;qbH|8y9pPTm#xK(BF8QSgJx0B-%b9@f)=S7A{*YG&=2)iNs{=fZ2 z*+v|@7ru(iIK(-Kh>AkTZd|dov$LG&k*2@~d=V4VCmW)qgf57_KH}ol`;LX+{NOGj zAprzu71ztIQ8hVy^9~x_Gh#|%R%E59z^)x>jTZ`sHGWJ^JJm-?M{BUs7}JI&C10E# z>T5(%tK>hhNbytY8EudgKe6m`S}rW=<hv%Br#5Qk;~zNBu2A*7sfxT$&s17jxh~c0 zbC7`9UgDExJ=!12mFX05%6sjGZMDgo;=nXxxi5~b{DHE7vN?mh1SfZe^hAz3sC;or zveBQatKG3Ug(utaXJppLiR~i<?l|-yG8J;{*u_OVMX||dnHzT=CeO`s#Jc<3Z?n&A zH*3v&MS@4O_WWH{leR7y&$(}ChB?+~(Azk!X7TXzb1fgS{Ni?AO~mm990HcD8$S|W zM`AUJP-Hwnwjqhl!}Z$-I=;E0`_G??w{IW8eSZZY$CNjkg%tA)e8Kb0o6msi`_5Q0 z9~8QOdts^{6Jc$$sEDlZ@jJbh0ZU_FwsTKwxMc-Ngn#__kpj6YI3y(Fi);;mhEJyJ zuG@$fsTDfxXUndRRp9vMK^(3D(&?`aUkkPW`=QAtN88EXD<<4uA+^oTw3-3rMxfmu zzm>Vg+4E?c6tmdMoOVRS#8nHREA*M)!^5v&N&=|bb!LQ}x%U(jaQDDKdA3D2>Hbro zWc2~8QJ{jl;*Y$1eb?*ETK0TjMTP-8sGq=<fkzRYp+F-2SQ)@a-iwBYhFYHWu#4_a zCUJ}*9T<}j?CeMh^mSk$&2EQL7gtwukwB>Y`Az8S>gwi01!CHjAa6psv6vpXc_gnL zzw&`lb`s+jfv?T^b|K23yB)-;D83&0VQww|&ff%Xtfj_T-+s?#<H+K{8w2Nhq{3|8 z>MpiW5NI1~TXM`<QyP6sL(KWf(9>_9KR-Gq>)X?urB_9dnM)2RPNnzE5Y@)U%+YTD zTM-zn?M`*@nU{w|1K++q!lCp&QM3c|{SrRBX%qLRPbDQATqHbMYjz%$G@tr=9Z{2V zWWv(-q<xq;Ypn}z#08!5OJk!C0E3ZNT>KHjRC#u&`Fu^NXn#l1s%%kM*Kh_@Vc+8_ zpI28#S9z@l6oB)*`wlrR&GE>Et%$18AthsJX&G+C0yLMVUsIo`!beg-sQe$H<wB+| zy{8%fkFcItH3%#TZ70>RfdvdI-HMXxx`4#eq*}?R#~Uon%|8-#b)Iknb}}%i{j~xG z`G018*s+l=MAqFlGpiXbTHW>$_)PM`g(sQSBdu8;HXV+B0P4H;?R%D-%-x!4a+Hzr zAq*ahiQM1q;!7Vf>)T_m?;NkOm>p5iyxS~s_ACW4qtA79JJ+s#EHPRD35}OPwg@fd zFB(?i@J<~Y2~w0pC@>A-3X)yoMTm)s0mi0U4Jt}{9C`&c34A13jTOeh<p&Q0H66yO zuU@_ClKK3#==V`DU_5bip`-Bi>(^bJ+MhKge1ClDsP@{uru)LTGT%e+rir_)`!6@0 z=E4%HwUPiw(j=CBU_tb?WC3yy4GoduFbK9W089+xP7MEp^i1lI&CUBERKX4U`#sKU z#$mK@k&E1ukh>rX-zaig7WosWStN!W)9=CLA{L-PWF^zIirpkCytMz;hAXQODkNHb z`SPWp;{v?*r`T1<27CfXh*OB$h5QwRsNL>+_wGS<PQR!2f5dI>Whb{RC8R%MZ^Ufd zN`LAj-Xl;C-Tcqb16!O?#X!KMh>hsn@e?O<?)UGyHs{z3QVZyVd=BnB08Ai4fzV67 z#tmvvxK-QS{3ImVHE&H?GeN4sfPB_eI4w*Wf(QLY_(-?Hw{hl?8eAhxnc?6>bTl-K zs^p>-87OaHV$oz&&Bf&oHVgc@Gsr;#T`w&RCR4~H(7DI!@0gfeK|})2ecrR<#`x&u z(wG%dZH*8cWp1K^dlMWBTm-%^_6DBxB(dTE^d6_0!GYk$d~c4!yd^>-<>+x_3kQYm z!ma`2e2i+ledo@@pr8YQ(ZPZiT|R^B&VtRxK@p&Fi9l~yS=sWSFT}>6K5CQ4AyK=| zzE=+%H7f3HvLx1&l^u2}Nzvr$8+aJ}cm70J&G58LU$Sxv6KbpX1$W`cwzd!qAhd1A zh20sdTXi-(K*r(k>MGOv4Aob#C@CaE{Pyi>Y;5crB@gf-4;XOf2;7h|D0a!*-$;*% zs2gm%PZ@oG2ALWn+UCN!uFcrZ>bD8o&=^FGuvIp0-FocAiLG#O;9EX-b7MlN!(PNW zD{HnQU$;v$7D15~ZZSL{oZ`3gaT8G$W}%9AtXRZ>nOi!OBI>z6cSV3vLGam%iu##l z7B(}DdDHdRf7ML|T`A$};NYOPk&z5i8W2v_rn<IOcoXcH2nR{~6F1)E<cXjjD+c4O zQOJG!cy%`Zt8D_zB{o>O5r;WBIRVq5>Q*++o6iiX*v*c-f<!_}7^3#RWFcWc1R}6X zXE!>(umBfikJIY14W{r@^awIK<ux08=HA5p2h1#b+_m;Iglu3+3J=;U81GtcP1cDU z%0Y7uLbc12lHQ^6{m&JA%UZi%(_V59X!JQ2Bwn}e4r@Zg#Fb=DXb}suqhZF;O8;Hz z>B9dc|6hb0wrTtJrkT4Ud2B2qA_5E$>oL4Y0jT;wnP+HdH7x5h560eRK3bk`(o~4O zM&%-L{kH8y!+UjMj3Jkzq9W^KfnMi)c5Bcqt><WWV3BECvqLw)Z@V%I*!tN#wl|wk zxyY=$i_69LXI{f1U&EGOeb!p;50?1hkln6>2i2pfPq~ztRqGiTu;Gnf4m|bz|3t&S z$%!vVnd}Smdiacvs6KSi!p24)4nev}>t65<SexGjIvgJ7+0S?!K4sP(3?sQ7J1X~n zzXaJ1&~6qM7ND%r?%E{*LStxXX!~^FYmi*iOrLHGr;Efn^x&T#?ySu+>yS)Rq@|~q zQBWY$ip<Q+=13euuOYqa@^ZHg+Yjv~9*k0vB`hc;#Eak>E)vlY{3&>W0bedDxgM_L z5-PXl$kfe&uW1_JSqftvs2$ODV-)O|LR57KuT3h1H_eYfmct1udAzJdMd;51lSdep z7L=yTSi^c$hyI5^6+0;nAWutxfO-Z7x}mhOsY=SrY0S*bpuM=Jq*%N+vlcLG*O?h= zR!C5MH8ph~KDa+8fi-%%{cyG09!`Hzd;Zs=l>+eo>3sWa5efwaH9l~qbi_g({0o|S zNqzk;Sn_baX|`M_4ys8E-ZUMksNK{{E3&Y<@H#A=_)pNRRkrW6^^o##(O^?@&CC6K z6I*z)jGNpcDVYDQWdsliPS}wAR%mVWr#=v3(glR-fUp@|%ccBhxO>ON8C}RnEl)Xl zcsxbzXMXqfNrebmr5i#as6u&=&SYU9+|gZ|_a47J@ICIVwa1I(WP+O%LGnq7!G5%0 zgAOrY86do=_T7~Ococ+gMd5LsOH$-B{&75BF{zwXe}O5<cp8k477d2+n(NB;(}_wZ z$)rDq09$$kI|>-B?H#7uuRI$M3~Y$YZW7^d0Rz4#-SR`{?Xe%dnWzk<%boaezh55a zDXjfX=bvt=ixUBt*TU_QDk0owvE`{7m=DfM3A8nK*MpS(KZ}`t9gL*gzu!k!Uuo|A zs~2AaBAb-E(jGtCJUgNOG&v^5_55Rw%TvSWx)n!#4OEb;hxglRAi^mocId{929Z~W z=Sm=W!zz0-dUA@GEYa7|>7iHUma%nX!u*8wiwUL?7rxi*ssG}p%Kd4c_oU2T`v$J= z_;4j-Vhck9eT`f@_xJ?)9b%4wqXnC72P-j;kocv6MkQi9u`XIZ?%*T4JqZ4Ct4mFg zxl4p59p)$g_U{?aajub(lS3?(y(4$^Zyj;89I8?jqwRPvd({jF(yAbV4x^FKJ}|Q< zE_<^5ZI``r1&w>yXFwXd7^bFuTxQe<q4E6BEnh$H{x12V-imL4zs$(0pV||tH&^|~ zBwaQO3%Z{5{MD-y%Z<$v&$5D`MgsK^ZN;G7*B@=!y5$(mjosYzM~@!GA%~UR7x+67 z>-O(s`!CbOYdng}OEkk9b_fme_>EwH@69_;5``rdF5E9%Ob}LxXp%aye=N>kT8Eny z0vKhKQ#N=8DY;lI%nnwrb{;hnRIC=b0yi;nX+l3W_4Zq(m4`jpAxI+Bn<~X#dkEZl z4W3pP*M#v-bO|)h`LNabFp))IGKi8)A|ed%G1?tx)m4dfgNG8~Y`*#2nuRYPKR%xl zB1cM8t764s!3R@E_G#-`pE&8fF1Ay7fAZ>m-NglM>UX4H1qjlMa#71Rf5=_5^ajTo zETOcMS4=^w$RYV6w)WkhCvhhiE??e)H$nCU1hFF&6JFdO!SM)-iJmfttVkj<a=yn) z4*s&ZTc5-~x<|5C@EiFhQP1l;>s;2qK7*&_GS3z+dChp<pfP?A1uq|h$!lPpak%z$ zvML=HNS}s-!wu=#JI2PFKSJ3My#IFxVwM+$O5iNVBIQ-sin#*!ISdSJ57GHgSTPxS z8bX=(9+T`NOu{79j4qI19X-8N?UHSoW*t}2T~8bT&;d>n6c%1fYX3mu<Ou<HcX!;v z4gg3L0U6FmJ_}upRFNSp{e+1CF7)z%z_!wDxj+=8hkzDVS$P@htqPby=9ZRSSshN@ zD0<=u6VsXv8#driWZ|t)psj6yyj1e>qcaeCs?)L^E&+C<15kvxaXn(PAkLEo)xk|+ zZJJ4{r^Ocj9v!y+A8eT0mHs?HglJhMnD7_D@7@oSXMQjq`OMly5|fgM00FZ@Gcz+w z_|X$rS8YH*++h0X9~7QSs?H`d8G`H>;944BJS1-y=x8TTzQ$1usPP8}&{Ofq=H}*X zD+m7ZrOdXhU3;<YeYMy=yU?}5)qfU*_t~vPS6e}-CG!%1FFC}j81m?3tGwGz<Od*; z-wFPTFzlH#0Z6yk7dqNokG5Cgdj;)hj#I$+dw@-Vz4su1d>bM(&PTM_bR1)2d-nai z0)_lqButRE*igGIuC=xG9@KEXO8;}SBW=z3wtOH6`a?fc$gGMpGFQm)UcgxlGU|J~ zIhD}GQ}Y3@Lh;XWT;zwkJFlS+s+W?IatC-9T8tM7j?giOR}vHdd-LWaa&sve8DyFe z(S6|>YsB`DOgeJx7_~F*ehlHF`dlmHrR8OI%|a1u7^)*DPQ1bddL2jvmOrB2yieRo z1ey9i%tv%T7!xnCWpIbOKuGDPZGlBA3xm-stE3a!6&8KLo~gj~eZ^!T)MwUi-@W~F zPz#`=oKsb$=kTGqb?X)>50JqbaQ-t`!nn9N`1Q^p`$%CS*-WPN!Hpn$T_FNbg#-Ol zAYgd;`<LRi8vgvihyVoDk)ub~LaYbX!_g6T6nCU%krP-#=g3Gk3fZ7J^%y4H-L_mZ z9Dwr|>p!k8)vTIh?Po^X5~}(NX4|!~?3jjKIDSGpNg#U^G8;5DHs+8FPB7sx+eX+h z2%0;Ck&K0{E^TmzMM$P$umY91@J1S%&n+$V&bVAxe}5Tl0NArqaSG%ais^wyDoc}? z=;%LX_pr;cO7zZ{gFG;wj^s%xM$7Zyr4Hx7%Pn@MT1&xMAWG`mI_N1~ot@XCR+Ik` zO#3*Ax+4<`O9ILF^IctCt+_N2i6$uuOhD`@@{|`)+f&#L#L7G?1&|u&rpVm_w-MgL zL9!9-=UoR{CAKtnzP`TR|FrR5taiFtM<^LMK`00UiXfaMM87`$`V|cB-rd>xP&KLd z<HNNMbDgdP<yXF~7vuS-JskR8ELTWTI-?bua0?;sw6xC|_@Y<nTW#%!kAwUI0x{rf zQ$x*O7^Q{FGq>Pakr935b0{wv&hXY)D7{y!+m<jWfqd(t8APYyqQhbi&*bC2uYXNh zSRiaP1dM;Ygv9?6l0YbEUTvx_A)B9{Zy8NGmtR}^Uxm`*vDASiC-Mu;I>gBG#+g3~ zKtwn;cgymB=g#;eI)Y$6c|?p$Bfk_<&ZaF}biO{@iE}$Vu>BATH0UT4B~vcAJTiWO z#OG0AROrix2r!Z;z@e5UF7@1~;XMu-DD&$a<f$?Q^k+XCJ5BU#!n!LfD^r?3O(G&u ziQV+f%`F13h~ls~oTc!7sf+q@GQ<f_6e;x2pwY-@&^E_$KmraSKz1r}c`!#_6crKA zePzk<mfRseL1$d<!&yQAOJ+<i0F%YE&B9>V%cXV+U;u138YUc@j|@=5Pb3_RR#${! zw&57xwQvb)GI(lkZ4K8m0De1CkrZ=4eH>W8pn%m9=V$`g3cPCXE6FeLZ=3UMxN)qe zDk~8HpEO`Fp(e&U&zl@NLx{T7Y)04z+S*WS)^<QzXaVz`u7@e;sUNGWx1pMsmX^{z zHZDL1hPf3p!vOCGM-X?=(fN&9U%#28x(CrPazB6`Ur<o+<~QF!N)iY7@1g;@;303o ztz=3*^3OXKzm+n3LD44m0^kF;L!}&n|0~$UPRZMnIZG@C88QZLc|Y6<Gxkeq=`&1# zdK@GI_5^uGx`^t=jT=C_pK$=`3i94aQX!?6Ycsmd+0%0;tn?mu*ik4uN{hxdo7tkn z&qmNN5Qxi|T+e84kVE!e-zH>Tkq^c+Bg`lyH5oQ^Xa|<ZF)dPSMYi+E;<>>y32{`4 z@72m6M?sO@fh%cicdL1b8a2Gz+Tk#{6`&B>XHQFes_u)cqtl@J%J~m?0MVl)Txf94 z?lIzg5uoU(X)@mlZ;tF8`ucu@j--w9wN;jzm*C~7sD7`S5@J3Xf3lh($GwT5ar*tB zn)`=fRx0-xov|Ae7uPnNfb^Ep4Rr)1BVi~fXM)Hgnh^Hs{2?U;h(8!UlhwkbyXXBh zp-7(O<Kwg}!~|JwY7Z&7s4}v8nApCS&-tx?&!e262&^L$(<9r;DbBz?;*M&lTD^$B z=9LDSI!)dEak^T*c9tjj?or*4JwYdu9rZ@mnq%5vB>Ump$43O$c8D+WoK7iKU!#}Y z*KM)NGi#~dBx*-Is41u{z003~=ceXD^(!eV`odcEHfx3}_NTkMo1xWAlg_V7&nr1O z8OI!ZhKG|Np&ER8L{Kk)B!&z^9lB|qS5RxQhT<$-lG4rU6X0nvcs`2RaYOK93krpP zA9>hVh);u)Ztrqyv&XF2vg;aV8I7w~-9sHFq^YT?`yXyNR10vCp;NYN8nXSz4fYhu z$B^U;=b1+s=(yCbsi_5ng&*VQ=EkSlMMQ!-+SXI{{N{Gsv57*Ve3_8w37hD@i(h)5 z@S>_a!F+G^=z&#j$Anv_aoCyS9U&()yl}pCHGIdsl<)?8br`K*n%D2<V+VCK@+6<F zqfnfA4vidoatR;a*F9p&a$yZVB#5t~CuZvh*iM{Lujn;x{Ine7?G+ScmJ?JK)v`4q zcJzZ(Pv7Vb)h}zD<)uW|nX{f;UYZ>LC1hpfW57ByxNUk<NJQZDh_7a}rOSIi%l3D) zQd|aQnLMcvd{qmno#oGqt{c<08Jd&U)zk5=4k%swyySlG12<nMzL|G}PZbU%ISP9a zu{V`(v%eggfnUsp=MSjrO+7^8d@DA6uoGp_GdRfURW_B^N^ySVE%Pkj|GtW;X)z~| z4ombg&C~5A#V-cxB3&ml{QUfctcPNu;8$p+>@!VfLu#xROTFjdLC1>ClYo>7khGOC ztG$@1H*6Smq0_hq*qcs3M8;`o9B~?IOz?xx6r6l3^KKl*YI#RT(S?P)Mx6Lf0AVjH zajhV-9epH4y`wN>iobmWNV_pHF(D7XetIaarX1MQCc`FSUy^oFlI)w^`}fBo7PC8- z^kTOi7E8oPS{bpB-~KQtPy0|JL{Lv=llFW<1%A+v#nGZ<=;$2${4>6@H{;}w;g;Ga zDE;PwyZ7vg#+h)F=G2QI)i=Se?*m3i*Bd7nyaQ|Rs23xK5g!QT(SC|tZ-!Pe4OZ<c z#wAC}3dQ>+bTD=n7D+TOB?*Z~I7P-CRP_#+*?YQnOH+zwQ#6quhv3jfQ!j7tC_ts< z@PF^H+cbTAZ0t4jX@lCcI8iNRHx<ilh%=iDNUi$>2F4=-WP}q8mNqs@2=gJ)5rOu` zCMc+EHSqm9)^!T31z=9as4l`~vSA2`4zO^6o3YnOp{734Lo6PRY`CLHlK>=$*DNYT zaP*deCN$+*)-Z<%;O97)N%TBgPtZ@h81mXomEhDK-}?ds1$!a^kpk)Zv>Gu^X}jJ4 z{oMx-CZVPcpqd~{6q2Zz5bCsGC_4U?_DvKN#<JGdTfiFid^IAGz$`|jWRa%tf#blt z_Yixck&M|rw-QjLhp<3`j1LFit5>_-;ECp8>l3Q!m$1r8Mn>^SA(QzRTU%Sh@vdUk zBBz4Xw6r}83_}c~7+XL!Vk*b?PXDbt4@dh4PPoLO-eunaYlnmTuro19Y=cIyVfzmt zHE$oEXn+5G<m0apD=YM(cIilva!K2b<n-ZGy)fvO40v-B;wq=~s~L24bh3k8)~^g8 zK+i0#m~fNDOM3R#J&%Zp2<Enp%7Ep8yt-~t2Oi!7K0uNy7!&50S6LM3{6R4X<r<O6 zm!Wn8>?%n=nEd`^*rs*=z<ShkTODU-k1Hht{aKT_mR05D-++)t0XZ0AR>!Mm#7nv} zu;VEBtHa_N03zQ3%1(n9`SGmVupt3gaC`RbHS;l6R%1+)Kv8?^!nE}7=ieIGR0foa zK>0*Mq5enGtqjvPA+$6@)SYVX{WxH3a*L`LI;h~lw<mLPF;QIB)~1emK)!2)?n1(T z+>n>QKRv+h_XekllEDn|9{QR;;W!6r%cF?1q0g%8XqpvF`{E!-ICu-n^F+rVhJ?m= z$U8=0&jSrH9td^4#lDw)({4X1DlOo41w!H!(8B;i=veO1cBe&?By}QB5g|QmcY7QG zu|s&c5hsye9TZl?hwDM&Ph0j}!Y^eo-KYx*6s?fsLOKrnBqN)cfL)r}I*b}<f;<JJ zkpOMUpszZF{0s^Ca2{C-8RIx0;y)uJ@4>;@MMc$Ngx0}D{L|ML1HeZ(PB$v$TK;hZ zbbANFYycMcCJOnpbJ#CVPEKxaZt}Q+^t;WxNQoE$&M$!4ACrazU*F#l6Ea$iQ%7X4 z!8A+2P9w&MZRUNj1fE0kioyv*V=y(<9Ls26NM>oSY1uc}wjq8d<RU}Oze0ov-Gus8 z4-0vk)C_WtkJ89kxVPe81h}*i?cSEi(mRjlhC?Z*`lgm=J1R`Gj5`V)jeaBsbai!o zhen&EmLuPopwtALt`V+J!RpH5{I?yuc12)`gp)Or)bkX9MyNG<V-BsknAa`Qg9BlW zI4W`R;zh&K*90TY_U%dz4*9^-$p9rrFb(6cM?QtM#w6X6Z4n6vITApPd^V$|_aU8P z!gwy&g4g!Gh%PO}c29(@#L3UEh{ZcT)*c9?_ZPO*4;*^48vA`tba|>l=F+9tm=DZx zYB`p?K~?{J>-1m@@@#A;iIdlWiWJZs(?Y=H5sOq6B3AOrh7CeA5M)+Z2bpB|jvc@A z`zEr;a`w}(lSa(}2!`U`jsjBP5V|y2crKYT0%PyT*onUu{)oB%l|cJ7JQ{k^iL~ZK zJb@v2cObt>pwrU0REA-Lq=p8eL9=x$nIf153>!!(IfMZmgfWzk^h}0XhX!QcI?yHb z;Un|&^X#WiDIlbX<fq>~2b{0)f^LtZX~c0R7|s<94L2|#c$Y@k|B9>BO9N$&!8C|R z9tYR<LD?k1?e4hW3an99QzM5?rAT1CGw=Z>zx`)SiCZOZH)xN=0p1(^%1*hLJNQ12 zSsLy)&9-g6Ac1(0q^Kxnv`S<u%G;1A>qsuCg;k5z=Lo)GDafE&=#T@%t8u&NpKkE$ z&k%%v1w6%d!2X-~Cn?B2o0HRzM<_2Xea%eF&&|b}brhnIWUgHCX*4>KUXU-BP<&Ha z6DPdg+}(eG7iK_TnI7%Xgmh&0H{5k1qw~)naw=j<8X{A$fDGtvdip@K0!{IgIvJ|E zY0WeY9{0On8n#ETJbSj0dfmF+f-5+x{1?eqn*bYV+f^aLN_dGfSBa}Xu$kWCwUsqB zDdBWt6LtY<R$mF=y@*o1j!~Kpxp=s};1=ZjA5w=Mqaeg^h={1+=+ng5*fpqz3doKe zV`et^@^q^m47p%^Mkh!9&qf&>qN1W5f;f3nzC=a!+q!RbG#N`v4g>gn^=R+A83+co zq2UvIUkq8>dse(;$SS(|D-fir!ojK^eTpl2(x|P<|1t|u;|=Uhd28!TNaFDyKRya` zBI}9MhtE^v&r8vRCij;+;t|;bD}IOLT^yX8vKS*|i`cV!cNB_07FW(iZIYb`XS_JM zxUK@YG!WPXYSp#aTR5}s^oAK8!lysGuHB&-lzoF5j6jP*--$;URLEiOLq#U5TqrpT zLj3sNczIbN4bT^3+W)QKD&8qsp1$0gTtFCLn`B#ngGOCQhy7DtR(2g7iyUq~+?pC& z5AYwKS+wmb-Pwo}Q?jUB1!N6wf?iA4qmNnr{zwIk#>v4UgHszqHY35%v6%6-SbT-# zf|)?_)TFMyegaMmxp{arp?Vsz30<B%F<4oeC*KLo%Mk5XFJ5@HnKl6uW&lg9S&dCM zsFNTO26ogjX~=ABGb<EAH}2FxCkR^-^p$?}<?^bkMxej@aE)LWT*vJwVK(BBst*ct zH2y34bdR~<eRzOL8U?BzA`_SXd2hBD&iJ{hD($2o!!~kc-A~&-%i>k0!nv6|m3xeZ zWk7Rv!4Dhlrp~RRi=ykCu5;)!9VWKKb4$D3%2u~gO1k#fj;==CT4mK^Zn0zaJyyv8 z=~{Y`2Op5mh{RKJ9yxLr;ch#OjGJkCSICk;cp(!udQW$Eq-uuKeAhIV>TfZf=656p zz<)Ee9P2Ccwv4wHlCcg5!z3C+Pw<653&=H?N|-<`Y6P);wV&^sZH*R06SCJx%NrQP z;s78CgpDvk0tGE1@FI>&5ByAt1gj}qQ!+J@H%iVU)epCE>O2(%h@GjrXEDJ8P$>iF zNw+cx*3SQyLr3xs4Sf$yg$>u%OH-L`vkAk|rwE9T#zVx<lz8Qo2wpxua@3-a;6I$4 zk-@9=X}+s?_N=qf_t<bC3E{;+A**-|yZ&QUVd9#QJ?MFLo*i-+`{bZKfn+Hd@+nAC zB*<C4O_k+UAL|OZ@B_ts8YxU&Jw2H>5aQlpbx1OZ?Tq2>2OSV++15r^>D@qM_VM+7 zhnATDS4%)$@mIGZ<{vrxAyXbtW$E3|f7ica5ONe7Gjmk!a`KHBcLe`;@7&p$&$`@% zqjHTI#!5*lY41KJh+GUmw5Ev7M>EkgO0;z~!SH(6;MhYxYA2yn0hf(x({m*yZIoW{ z&-#|`Bk+%*yoW%Jy;i5|WNP{z-+8}D-KO75PV72<3vAEY|BdxGKuSDh!K|ocD6QE0 z6-`Z9rNa&N^*#Ol0o>UwclrHHO!#jV+7oU@4Xv$<P!IG#JRsdpwk?^aHS44(Pqght zI4K@N{_6YDjQsokZ#WcU3G)UMG$?ZGE;y~hy2ZPql&iJ-v*ZL?@ABK)+vhQ8)3RPw z0B*-C<_M}{5f?AgI#F@sSNBYlRbuw(IyToY;Ru*W7<YpZk+24d$(8prajtWmoQ>oX z>@^u_WL<SiNzdhcjel39@EU6y+fSFaS`+@Dt;B}Xh=o+uq>Js317hB;Il-=JaZ>&` zjq#+1spijpG%c%L3)9DzB6=KkH;(Dct4`PI@W#nU%TRN1##{SW^-6fmM)>ZT&0e<Z zC{B7V3HG>VtqvFo0BSU3B}2p#it-!>7_YhMGp!!S+V=GJ&bV%SK$+ts`%1YFH>c9= z9UMl@VbXSXxhs=ltB}?ut6Afz_IcT`ydmkgvsT4sPn%z}Bxiox<5kyugt*k3Vf-(d zmimWW<KHR@{l9;I=ilG_%e?>p{SBjE@=v;ro*?ok-Tx5>&U1Lr9{VpoKVUYSdI*1* zeL8e_B6P+~T=mBnwj0~i<6_QeZnFuP{m?O~dn&M1N~>k+RyzyhE+`t8O;xtPed+I} zJaaZE*N&~HUH(ADuvX2?(Uz<v9Wmt{OjMNYFT3}=TZunJlcTiC(3+FzdVN4FIQ{)s z3FcX^&RPz_S)xrn>Cy2YMePD>gc#1q6c}*UiPdv!He|dU+BF=>yc6GXR?P9Ki{a$B zwCZBRV2hJee4)_NQ~Ipf{?uwe@vGOgTJATRDi`Nm!7pyc4-KYjME0Kc_UBjcR1Y%h zuTGJ<95ljfB0{fjv}na=Sk`an_*aYiCViayth*9XV%L3YH6+<PXt6>mTeHSGR=dDr z;GjsEZfkP)%)p(ZzUj$N_qZm*23H;yy0vvXERSY%BuKq@PLn*H+Oj@Bw)8#U{iQKm z>H1sT#~Z&m)#P1XZPk9q9Cs^i(}HPJ&9RKZr{p6zZ+_9JUQ^VrF5FGX2XRF1uA4f2 zEadWa;>GKQYAbsFJSm^GOWq;6P0yaUF-wP4$-Mp&8p*ht{6f}#b<s#kH%gz~sfsEm z;Bw1;;u>S4q;O32D^2#sWzNd!yRJ+}+m$5ke1EJ=<?d>DXWTmw-jco`Jp6Mm@?HUv zEPBM|g^IqMM*ZyblHkdE_e|GS)j9TZOd5UC-zPvg70M-V(TM7#WlHC>4P0@wb9*Fw zN`7jy?4J*PY$cwNjNQV6K`%yyV)`qXLb~%p$am_zIU&aNGK&{4U#gX8Yj_&#jni+> zzubGJV@OSZZg3|K>$-`#HOIakljP0IE4x!u=YB;zUfW}D^|Z)wJ<;!(4-4n+`rXrT zKPsg{1T=-*u=Xubm`y%u>^H1v?W=B9*&maaaPu{DquH*v#hbX}syYG%n{M&jB&_fp zS8H3OX189k_TxXaB`zk9W6@yZuP*frkM4Jxi^Ws&KUYurG`C%87gL;eEPO1sq?KJc zBA^uz)O=;+kY1m+z^e5<dv_YhUi(}BTsB#92qTyl))_9&#|7r-#Xb_|x8%xFZkxW= zx_)8k%eoT|HjgixvP>Twf5zNjprlxl5Pb1quJ{q@g_5xu-hilPvqUS?)!Ty$s;SGm zeWykWG@|n!yUg9G+2mql!m<5DPOX*uVWDKlR`>Wx+U*I84WAY)r6cO!G=x-~*lSa8 zCM&F~iD0N5C>B=F6eU=0#<BNvJxo6mq(sD&Mf#nI>Bzj7cLe3>?C@<yGuC~&#IP*! zL8Gzq%?7`V139ZifZfN~B6a~*rLg=gm1Y&|;pP?1=|c=0{gS0Z_7iW`7tX~p$2Fye zFWjlIXy(!vYRy!yt}Qfk7m8VRu#cFs`9KNPAolv%AKtucw$55~=ECOr`Ni0)w{M;{ zR+rM`Y8y_y>hr$>*8?d0>J>F{USGX2bcv4sc-A@JYW0w$oAwb<^Df>0aBb&QtA6F* zxkn}IulKkW001bK)Z}!{cy*0tyt+moZGJ)B`?l81H@;NQfo<hxHtDOwZ%UG^ULLYo z-F1Jf+WLOie{p?0eWPBU`h;3N(omJElvmWik6hY4@?(;wj9yU|yHuoy+cnU%sLvG{ z)y3tB^xWKBnM@{K%gENMk9W$iQaKI&pZ6q5Nyjf~*@s*8<dATew%R^=pZ+mCTrWO7 zPd?>6B}sn%K5Edkx)RnOP?z4VT-ML)Ly`g?sG-iie_EF0uHF)yi39)uE?R~+(AK24 z)wNGcd05P9aDR1GujQ{RX_;ysQePD+mD8Nb>-El<6?$jP3cdOK5@p!3H0-qqNmA_m z9lD<FP|RolR9bSn_HH}k(!SZ<O;#@t=Ty|?<I?nS+XnKlR$i|R{#X~!UX~;s{qd}x z2zpBif9t;2##Q@dwR$Leem^}wAwthjh*0!`eo8uVNr?%E^0oKe_^$FP@2Q{mopR3m z=h(+IWpu3K*L)|3JxA9vvbAv91`YVzG&$@!k|c*cNA~Lu=ae^JlI-?^=a&V}L;?T+ z7kjoI(Vp%9)%Y1t>6H)qNRn)+nHoD_fnJ{4e^a*9OwF0J-esGH&F;~YkzulWc_=IM zy5hh1P91wR*YbJW^0nV8EKu9dzT<qImYlA?)gM=~J5>yx-WI*LEK=`|i&LMFDN0RA zSH(&`>J=HPww>-%zxGqrD>76~TGV#guE#UMTDf3{!n-zeneSmS>#YR?^i;@X=e*Fz zf9}_$j|b>q(d+cm)AJ?Wco^rknSGoO(9C{wt!BUZ%RQt)9Rf9D#SlqSWS93{`bbQh ze(T-<gG@jFd_1>Komyo!0001RYdqWKJ?-Cq^p>_+qu$-RlA58*m#*H@c1y|wZR%;x zm&0A=J?!_q2EF{K{yDaDvD?Yb%~e`*MY<~9?R)c;f2WM}EV;Rv<mqiGu|7VWv`%v- zt-qyV^Vso|%FM{%Oe6pRDBP)|7t4AGWx`}Km1uyJByS&UiMC(TxF?g$*(N(*@dE$= z?s#)2f2FyTzbflt+))UT007(}!n)iiDYvYLQKoLZ2d)Oa{Ad}B<j%)0)&KwipxE+$ zv4)d?(kqki*&b+m`qi=?0{{R3{v^`VugcTQQ*LROujs;si)B3?0002o<}O^gsI;`p z@~co@rnBeH<(@rzK@NvQSFYH~dTamy0JsfRs8C*JH#b$SR#_Gg5B(qLAUlig{me4} O0000<MNUMnLSTY1srg(0 diff --git a/docsource/images/AzureAppGw-custom-fields-store-type-dialog.png b/docsource/images/AzureAppGw-custom-fields-store-type-dialog.png new file mode 100644 index 0000000000000000000000000000000000000000..296cd70671f91163293de7e68f946d483af014b4 GIT binary patch literal 40207 zcmb@ubyStz+b+6jq)WO*P&%Yb5J3TH=}u`7>28pgkPhkY?nXMKySuy3T)*$zdz?Sc z8E5Z3&KR#_ysq`E`OLWEx~}`42FuAvpra6@Kp+tG&!5B;AQ0Fn@TUS95quJc>#qob zP(nV7i6}WGA1pem;!Q6hogCxGHC$xB@<H)|rPuFVG7sfsOC&*;$1UaVp^2k8zSNfb z9-XHWRxXxF%f?nuETtcTfX(PN1Nq1o^e_7mc3|rKNhH2Zfk00B!96u_J1T{P!^GHO zfyHE)cVJ*>$e_Odc9bokf}IGN$`4Bv**Q5j_VtYbd2$LF6%LU|{I6da*2lv(Hf7ew z4cMaKnMe~=5pTTDpWmLGpCc~!_y2;W`OgncfBE_f78MoCsnfzOcXTv0?|=Buh)*<( zjDzyod9ba`4A9?Wi9Wf#5ySb<|N6=Y(Li5Hg_w!;`9I&GiBtW8e&9zKD*9jJvJv`! z`p?7qtSC|cdALg#kNO34prH2u9_ZokYdX4D92}K@zpJUKeUg+ki*`quH)QzF<5^l= zy}bqlaZFgq@TxTyM11ypO4jvNRqu*)TFK3-iKXHgy<1y73$N}MYQ@a{smFX8kf&z~ z6fd?s-g_6s7SR9wwPg0@sM(K0trWVSY=|HIQ9j<X_etT6nmy0;N`bjnDSiLWUSlx} zTdf{eP(TkIH$Ok$zJC(_lfNiTn7A*KMom@2$BId&s8F_r)<>*omvdJ`fxh15XHIMu z7E)MTjwq3N`L~=r7nepBPdfx|6~~-tY5(A0_11}Mi}GMKl*v9Ugh>}I@glVdF0`+o zCN8LCYX<KOVA^c0pljZ2Vq7<L&7w?v_`vF>fcax*4I<RKYgwJGV9IMHk=<ULDJam$ zCqkJg^n{}Ja`?dwF0I8C88T{ZsM2&cB^UEjrLBFEc+u6~uWw^yIj?Af&5&kuJ-3v3 zb*IIAVc!_PC!UpoaNYPSz&Zj0i}=M{c^p%8w3^>Y99hTY@)398L!gGS{#ua-E6(F> zcr2D^--LmM1zLt2a<w`-L^HBzky?%a{S+38KPwlP)ntptB2Iq6_==1YF+2GN9Hc}? zT1-U7G^A!S8KUa=y7Q-S|C^2gOpl(5S=S3#8VKH2oL+B(qAI%`9rZ}hhhnq)xX;Dn zfk`TgW&0Bob>Er2%^&~eRoA(3kq;Ojx0lGuen?bN*3vHQ95R1<qd!>+fjqa6QQ20B zDVxDORbEgEc|MzD3HBiv6b<dGYltfdU0FV$w?5gBy{stUT5eG;>?}5at9m-8-3)mF ziQSYWog)jLmayz8KQ8&BP~t{!PYnz!)t-#+M_Yx_fUcQYf3tGq$BGt+slL9C(Lh{# zXJ_Wudn^0%*mpVsh1<{Hw1UGvwLkJ>uFj3M{Eh3%WnyWB*Kz-jlZ)BYG1x(Pt`hz+ zjY`O7R~IQoIq)D<)GsZ(cj>ZKZ*eW{#8amw6z0|AT+?PDYc5)&u%Pd?aN5t6_Q}<V z-u3oj5wzgSm&ps3x)v7j5IOpPb)NfF^aHV~jrU*CJTs7P+{hJ<xBrB+qB0f_>00TH zS3s7eL)l^m=xra~zjMJn3e8xDopYl=h>$#8zmn>6ij43qO7&|ucwAjE3oDR(O`ao# z?XZU7G2`;0m8{ucn@VeCcm1Yo|6kleO3}$`&hK=272!maP%18VqWz~+T*R>b0PeU5 z|JX2Ih*vM%Ad@uZJC~Xx3gE&cv@9$vj2bo4ER0j|pUERsti3Gqmb0kTUs6{Sll@w! zSiQRyYo5+zru{RbYd!O+3%z83@I$udi<I#8j($Ja;;~0l`@A=WK2haZIa{s5%+|(m znnv|Fxz7Z?6G#SZhN6y5m!7z*yX#rkeRCsIa4BwDD?4Uk7hM8%u99s8{~jq-3aj!W z-|EtGdH2;h=gNJ}_O6h8lxU`Sg>}ZJn?>Ofev3?PKt-U*Nze2X#n9%M#ycsOEL05k z#7W==zD{pGs@1o5o%7~R<CfctFnHE#EKb6AL<VnI3Vp<jy%YRjgnkK2w3iM$R6Hi; z6v;Jkiq{T`KQTljo<`5iMQHy!g!uk4(?SDD>gH<4OX!1}uBqkE@TG93f@nD!uY`~1 ziAVN)0l-DUFngNoahjfBrQs!9F7qRjOc02wdQ$uBB0kp@{*b_*ocw}!a!POX^o-_; zgtrRlzk;(LVwOdw+L#@ei!3T;f}<Jj$5PYIdH*ka4|2O2m#{Nc_)18}19_T7sI5!o zOwY(fK36A0GQa&WPl@zlkG(^-2QKeuo%_`fO8SAX=m)tdQLWwUZC6rIlY;2>H$4%u z)k{>8^K$e=#>M-tBmEg0>%~4_B10%Gk+}?@H&A>fojO4Qxe$`BRwrYRMzy)JVf2{8 z4hI2rf&VkBm9aG%(Q$-K%dqBcV7|X<<Awxb5+T*a<5&>zj&OUr)4A~|<oinu@|@2w z5Ry2G_JB=^6Y!an<=;;<J%U{lcCFoAyzVD^YpXnu=jax9D}*Y6&ab%PAW!$Lw>IZx zy>qXHJLaZH2c}0>L<t~x8!>DB_3)Yk9=}m<9>pEHH+UaMt>al3i=^8KKZwY@Wd?5c zH%&j%W<A0bM%%-jRa=_}uY~L{^0$`H$Zs;yu3h+}ned~=0B?hbGPg%G9>+2Sxy6^1 z2VG>OcYMG0=UDC9DbW&kBHDCIX?^o6B*VZ`vz*!S2>Mo5^oy^Tu!&HiW(9dyC=<%I zA;>7wWqn$AGeFiQo&|yA_+zxK*goydwsH`BpQLB<cw8kG(sDs&;2!d-Y-DPAW=G>I z#(1tZ!e3}QKyP>|&Y0Z8a^HnfZmGfSq(xXcoMdU6YF8+g{+f*vcqO(H;`#KmcDlt2 z=9Sy&>{(idygA$BB^FJW@#;zmGQ`W3?uBtPCwwOzLdUSYCqI2Q;%PY%&*=xe@MkP^ z$PRBAu6WA~oUgcJV07aUuH`DNAJ%xy9_la7IllL>#mFFY2}rZNS5n1sb8X0Um6ND* zsFG;a(>k4`%f%*1@G0>=a$yoSi^bQYJ6d@bZJn5(x;ziISLZN~`TcdZEu8h>=^}J# zU*cM8{chO)!nDaqGINURtq>BXBI@Z`lJ8jiK=~MEZ*S-OFP_b^aim?H|3rUW*!p>v zA(1b*`)NJ%hT$UpIceYejU_OXM1nT)&z3VgTZ@$A*ID`QbNCcdo4n%h*ZZ^vdka{f z&ihZgTRm2N+$@C;>(D^L_I%#%GCt(ssE0sPDLB`e88zL9foA!5y3TejY@Rv>SOzYc z-Yk_nPC^=If%j{M{xTlJP{UtJC`T=2q3~agc6q;MVPq4j7fN-h&CFFKFzDY)9C)qS zy(*|uzLSQ_x*pc9$>0<w`<s02iR@h-hgY1=a~u}(&CbStXrz2gP)m&8#fF>ee8?qi zHOLEjWk@?a>p|&}!>l-8mwRmGiGo7<N9UKoy4{|hMv(b!369;_Uuw5ZdJ4RKX_n0E z2Dgv@44=*?&`>u|eW!pk)#^$3JFs`XSvIGmvQV)wJP;&a9hHy|Sp|~5^V1WjAUu^a z6JeM*^2f&qk8)(;(hMutIh+cK%N%7~Q^mxpdp#dEph28mhfoOxiwU~ojGbcMcF%Tl zpC0C%yWEeO+1KHw{G@0>^9>1PdMdv|fX6&TOdF9ndz83wc7z`$YhE<env_KUUhxw~ zsdkVsiRh}1i@T6e*aF>GIkWrj_yg4V#b`yp{ZsD}qgidGAnk6~`aRYz1xtX*-)zr+ z%WKd>0=G(W@WQVAg|=I@FmqaP=T?MA`~HBq!9wT~mPSIyM!7_*=qsw8A!Kp6PXq_^ zHzY^mCc3wGyF25HFXN_+-_S=+=I1tvc^ll9uI*W0v$?3t4r&XKk~Q*(<{H(J#r|Y@ zb|<aDK}CjlBMkP#3ieaIS>*{$86&w0kIQ2$?HDS|pJ}<G(eH?k<ZQ&!f?F&Ho-Um{ ziIm1H=%)?Gueaoysb^_|LE_4`k&W_j_Q)xgEYmhFtKF5Q_DEU7<}cG5=^#unKb_L% zeYgsp6^y&UKDwU(IVPBc{$3M|YU=^3<j?+c+iv-T#|P4!5sIKC-^MoXGPvpQ-x#pD zwR3;%@pX%5>5d-=#a~Xz)j3P17bvWY8?x6F^LkrzrATZaF%z<Ol*+j0v<N|f?{_RJ z!UjiwEiCbrnwbe1a}-la=64|}$9{W)e$e*FmNU6?vSP*chgqm?z#2WEF&9oUWT4)j zZs^GOw9;p+z7Q2&6y~TW>#NR))aRSSoi9yWLO8Tr)C;ZA{?^=D??=;zfl(NOj3+|5 zlBrPAmC(t3lIDo9)+IX@U;E=nO8OUQo>5w+OeDSxo3kp$=S~73ZFTSVp0$!ye6(#C zn4b5@c7}n81U%-hPhB3`LSxF`Fd^l)g%Y;CAB}XU{!lrcPQuvysP;~nA=GMU)L$Bx zN7fQjx2A|?e_f*UNetxm^Cc4h_Vovls4&XI-nyXggo5xEq!*n?E|)R6BlouSh(K4* zRDblJAaOOm;~xcV=PPpKK?*;Q&c^TVSpMR$@aQ`}zX>qJfxj;_#%6N|W?IWS7TxZB zl};gmwf0m2Aq<!{*#TKG1OhCi&S|E7c&tJO6+dmnH>?>US<{lThRZ)V0U3i?+2*v& ze`c;qhR`6Cis>zZUh7hK8=Hsf#mMKAeKj&6kW)rI{a73x&KyHiiQz#m<Y|}%W=iCA zm?Cd;UKI#NslkW?r-+%Eb0sEY%x0J!%Zl@2b;k@HiGV>>HK}8K3T@b`2D&9tpS-G& z>g#L{xM+uVeak0&fthXY9dGW3{$3{bIa5IR(?R}TUf$CY0m90LtJiN%HRF0jc9a;0 z7i(~xYf@(Op!{HYg9x=%KvP<;SuE;g-Ujo60Wo|6T@02QGsm(U8Kj3kmQ`@{MxH*Y z-n8>5#W7&p(vqKzOE$YOK3$77RXU*Dq3@$ihdZpGIx)38F&WX|q=UHsWB<^5UoW_C zgn2bC_V-&XvL^^+)Fcmckn#E3?lDLs+O8&eE|?bq)y)W9Q#m`_g9PU)p$L$!Zo_m{ z`oKS$!2`ML@-Zx(2i=`3>&HFK&x2h(glzdp#>|9%;H#)u<&!RnCtOiv)8+tiJ??jA zjZ9T<#LPJPXqMcA;-x+#laC_+WLJktB}HNfkG=;B32L~3WPhA2rs<dDRKWQTfwcQJ zUkW`y+WJ(H%VYDG%(J^U>pZuqn&327m**>oDG?PFu^AbY#w0u7xR+Dai#d1X%l~Nl zyK+-Jc~}@nZVjBg$qc%G+sCx2-Ur~bs9N^cRCSbUTgTbo@Z^#V`Ta;2VFKQSZe-$r z2v-pRb0XiAMFrKv@JsgsOx7!_qt&r*z@_(hFomay8;9txvu2+$-_$p+yk=QfI)*;U zmoD41*Vj`z!G$lueC3!6?|;i%ic`Zp_zIr>U8?87yQGRMN<s^^vtJnoh}=HJvjdZ# zSyX%O#NnM8**L{U25T+aW58`&d$+oE{pcr18iX7E>RN2=&;svee<8txN4!ILoQoYt z&DLFQKxGmWV(7)>y+J5jKv5NJmmi(MOcun+(Q)#Az4M>6l8N?b??}w!qmmu&3I_6Q zDS7JH%sRR7n;B^Uc>McRgPIO-nhogR(g(&C^8&`UE+2r$#{^~N&T*VvVX_7j&sEAH z<R$}B4E0l3+$^qd`eU79<hz(^Yd8Y|EuCf&XzSv2F0(K5Q!f^GPJm@5uPLkGG*>p) zjTJ=z*%@P4d5HY02F0r=uOy+@AcL62=FCR(6i%9zRGS?xds<W#6=mV5+uyr2{*)>7 zEy`+0#i1({&wV|<TR>r5s`dlIn=mP2eNmOl<9LD3ol&0wsQfDFl_k%#u9}?`?wglG zsH&o`VEFEM{$xhH${8XFLbAoQJt-Uj&vSV!Quwb>E$xhzKIJ&2DEInHyV4D~AT`E^ ze9=AD4bHkDeM4VBjNX4}|M+F_BRF!R-j-_7i)@+;k}Xt_xU6)f3Xeq3u2^SgxCQP- zERDB%B6-x;+KVmT#F{B7zmcaZ6y0mqWc09=$lULjWXPCc8;#la!#cC*@9#HbeLp2o zWA*JWEtWy$k3nxZ(^73a)i1Vy!GEw~T16O9!WPYb6gAprWp3b&KaOXy1%xQvU?|LD z<B}Lk-@;}<U|}dEvva=cxSJR<`u#5DfUJm%vG>UAFK*~26F)5PqeHBV2;o|_$%xU~ z^cf}`?zafZBYF{X==}@EFrNxgUY2Nmg2tnzXE*wukpsB$ONvLr+K2t$#^}fe%_A== zeb|2JzxQ2T=u_=OaQ+aV7&4lvL-#4UC_}*%%Y&VKc30u%`pTk0<|oS6=Hg)xic$Pg zV5um8b}?PpTp|o&>F-+HyRZ|Hja}FH6G;jlzWJ58ZZT*a@zO0dmSxGB*iBb9rNVnb ziHAb@uArq9;1s9FNBITh``%M00iK2#FP3!dIk00z3iPp~-`*`8Uxsy*SpTb0F5GO{ z%*jT3>QV&E*Pb)hyxmOl#|&I(3O@XA42Lqu8c{tfBEaNEO^M(;dW4e)8AJ7s4TA$s z75XF@+6m3aGWEQ@FeyB_(US1I%GMoi*K)r#H8}AU9qa`VS4)PN6C8=iXLNXBdtfCH z+WNk>puyka&)Vm>ed!C9SkgMp!Nf-JHI|+*SbCqSP^o}whzSao8W0=o;OGGNUJy7O zEA-4Y_WuMt%;b6xqHo458quO%X0@srm_7boOv}Y9-8%)$>8nY-|BPSKAMxov3cTw5 znB)`Wm+b!9DL?oE76QAWyc|P|RM*I0YR9!eu(UNhjQ0-xy8HAv({|GWR+E43)s_N| z=<kTF@N!<mY?KXSg3hJCIQk46LB-Om<L&s)YOevC6*<vO%YAy82IPx5@!!l^Wrlxo zEM_YZV7=4Zy*a9Vv&1vof4!C(&6fJDd^o=%+v$_6pxLTQ#yWL)O9Eh{+VQK-g(7{o zmIEy6ktHBW{Qy{Hl(P*TVzZY^_+xhqC4w1a0m&&?DLkuA!ezd!itEGldq*f>s?X%U zq%|}SrP|hGQ#jh>DqO-SnTp3J_PHTRxN(?p&WkY{bg|1@(sVk*LFkZKZ0~s~A*WW- zg_LBXzYwZ>b7g}Bf$A`TF7HgXo>N477ghs!ibx(2*w&&wl(e>aJz|~`4pZbp(xmJW zgzD!8rt@<pV~OWck<sPqI20!Hp>C=GC}JhavhO22QuIu<$Y{Q^hsaYiO`~3@hhd<6 zT!dle-2Rj~C7L@SQaI+_TT1@*aDIYJ*wY<B2*!$#qnLYIqHL?NtWp65BztRL#fLX9 z%^n;MXrWLX5X_G|_nE8f$HSJn05eUZUfXQxGFluk)>(fr%ad7J)WQa=0OPp+Cq@bx z>+YtocxW!&)@s`o>xLn|fy>VO87_7zAvr<oZ%I1O#yH5gC+I&U02JdXV<LTjdEJPF zd0N7eNCEk^{{4it8LA5`2&#eDa+BX!XU9aQxOEwrB8G;`f!%O<)#k5rwBo6w72q4q z$#?g_cK8*@g?UoJCl?N84k3a-#l4znc6DUbX(6SK${Q<Xzc@SVK%#JiWGl?>L0%9N zLKT^#W#^!oAiN9GnHO4c3na<9v%~E;?t%A|X9t2}T5evE@{3rby|}o>2<saWY<<IT zI#BKIIu@mTz9+!aVTes9OpN@~^rKpT#CGO_S@y&Z*tj7LjVDFsN0JigXY7#W?}&<4 zTPVWh^Y)5JedJrGD5TSy^f?APl+8n(AZcdKg_k0d1`XZDPIXIj^A$p9Dh|A&9X9N} zlit#OW|?&-@57`2VLY2BCG4G(XyGI^Gc6pHka>-@s6O4I)j3$`|0K}1PZNLy@kGll z29`>DCs?Cdoe?IkEwtk+YVSv2Zo7vV*<G!4Pv2#1d&$TZRtNErMVv&R#@Fj&i7r$4 zro!>9=BE6%)$M&99~`!NU=}jI_FYrZvsGqUoIC;vm%~6+HF4$6AIWAH>xG)>>zo#R zAB+^zlkpCbo9iT`lhgU<&Pls#Z1x^Z+8k=As(Lc5qH9LwQ{Bu9COtX7*1dkJYiSO{ zfojlP&xsVakBE!=s@XJI+o_txtwAM%)+$ftD1|1z*@>`10i}G`*Wl*xgef$23KxMl zTXQ;OY{EsqYl9rXKu$ir=J##Z^ZVA6KoJxbzqP#<Z(S8SIddqu7QhD*>TPm!eB%$A zCbtxMWd-j(ju*)M9t0p26Y^%$b#WO3rb@^~g=ITN1pPd?wvx?$3G(B@K}_v4LP<(1 zbXT10|Jn>{@Dc0p-)U3<1zvzZkpzYR$Ihtn{ku0}{gU)pFO?r*mK{GWMwM0*5upO> zKqYf0wLKK21}>j|Tvp;_Fsu5FlP{SUFNEdkmO;hislR+@RITF+C5BR9$nc`($&qKy z3LuIf|8*m2>PQn{YBW{Zu$H8@Mm$Jl4;8fbi3Q0ky0j1f#o-qg@~_Ja<vW+YyFLsW zy_R_86p48~GY(+19X@(sy+2#a!}SYj$oSCss@|RtkWJuYRy4K-X0*}dg2i+m{BEdh zzkiJu*CL5aALXl*yoPH4qydd|k?eWt76pjJtl{piWW6oT!%P(19LOw8glHte2tG)+ zE0;!@<&KZmH?A8FC7}S}{90}#`?s}W=BtMbSLS~B+3oVLX}lU?=7=0conxHtzYq~t zHqM@&SP3kL2j-6O<w*_4C!~q7{6Z<;2<eZsqM=S1NFY_5J`xbrnJb)!z2l@EMCmEw z4*b4|MO-)m($9_4vH48p6C>bsqxa&eqnnv*mP-cHg;D2=anr3eThb{87G{2_a7`;q zpM8M3w!`1Vz(}&AvA3od(!SofKI1rj(U9~hxfr^^e@t43HKp>CehbDGxnsw18Q*L+ z?%(W1Pq@qzvuE)4NTd2V+ZhW}f{d%VmYr?HDmxO8BxDY9?3=j$_8(~aQXHzP+(PbQ z>e(M{GtfZn%-QMzhz<$l`ah!ngE0?#`C=A>s|Qx7Qsx{W(`Mw!O*I}?{6R6y+Q^j5 z@JZ>y89u6E<>C|#t|A49Vafr2=&8gw{f<q?Apr07$4y;6M7we}K+J%Swz$$~T&x`E zBaz)V93%QQ8%PjPAj;>&yYr>5s9+qh3Zw`XLE9hhaFi%^1CgmQNQxZT3xcl!yO99u zF>p(<9#PeK6<L%LKpQpRfYOdX7=T++D_<@%E3awEowY|!lTyOi3<l_^E2mCn6>Po| zCKAnZ=>_AIn;saFS!c@{a6_v{yAV*}q4#fSc-Aadegp7<1d&2atWw+9BqELp19J=* zM_tK#FvbnADHx?|Q~T?fwkeT?gO(z&$a=NzK4(>>$N02fU%&=sO1L6<G^UB_CR9_r z_DYeZr3OEm+9KS*3N7%>b=Lb9YZLVl_Wz`pQ_Jx4pTW~lYB;wc{{EO$*i?j4F^&SX zjI!9EealH8z4Hno?JqrH<16RfoV2pE4-IISN)Jt2Bqj!zJ)9G<au85miZI8Za7qt_ zu8z%Sw40|Zn4P@Q`svf80HhgYKUjd~R*v2})80RUx}2%!E|Hp?k}@$qsItkb0Cf?` zQKx6hldSibeKgyvA95)z+0`F5eqM6SZD`nm@>gWQKfh0AW|SL5F+eya!T#JgMBiTW zoE+fj#o&YFs<=-Htr{Y_Q)8cn>J_;V|2Z_5`R=axTw@3?;GUe?UrPZkEDniK{fab+ zOc4vcW$5){S$UOSOUL)a;hPODytxMIpbi_pn-FH)RDkS`47B71e;NE=rNbfR3A&0y zV{xEYLTe1@|F1<ttpC5Njaa@hF)<4NUAYVxV>A2jnIKk_m8JiWI;O<`Ngeb5$0^DO zS%`f$RdZGGhHlG7f*4f=cJ}M+LoEdGS8yCS|KC;B|Fzk~pO_xoJl<W7?*3Rf#>dCs znXhGWxjtGfINaLa&iwNSR$E)UxL7}_{>LuPpFe+CU9T+a>gzexm1(2(wue)k?hkAA z^!3kT%x3srym%259NfN8Z<jVF#6VAvMMf5ul|{4jgYV|<u47~b6DJs6fc!XrGBdkM zo#|I}bW~InOi%n0I|&KNkNqk1+1c5$sw%&b5UI@GEV(yeR`xtRJZ;m{1a2))%YMXR zh~Nz?=eH-9m;Q1$|EwK{*RS2f5;#mcCMM4FCtuOgA>CgeZ+j3R!=GGT_3VsgKEJyr z19^@i)kSLKY;(Z&V1})$r-z!03qQ@{?yZln@97Zta+O(Qp>nZHfnLtrP&P)*IxGg2 zlCE$v{zOI{W#xdE49f2_<OKZZs>AB)cr50scJmKexVZ_;r;6H7Ry%D^Rz$=kB-STY zbh`88GqH$>UKA_OlawieCV~Iz1^9Ew-ea>r#dNUPNbvggYfDXYcfJ%1d3kw4ZY$EB z2#V5cyOlN=LlYB&p+rs|hXX<-`mdSu1qB5ir|Z48$4kvFaEa>0Jz$ww`1n(6b`#3v zt;gmb^b8D1n%sPR#4ODh3Q7OgS33h$>%YG)(X98GnNdv^aK?$IlkKUqU6<3=UZTBs zQfPU)GY6&ZmgYhcWU6Eb)5M#TPE0n_aT>@Z6Nh4sbbHR1B=wiDDy7<sMVMK+n{(CX zpc3CvSlaTlSff^dvfwMU`g?5lXc`+6qYLWspJZfuQurN50T4a8b;BbdFu1=u3<?T* z|NcFssHiA$Ax@JyP$AzhHuhy`XecPz=;={WQ&Y2gJUBI1#Ky)(4s2qDbhC1B6jm~U zxI8|tKuALJff4^h;pCs9A~afBT2^ju>oSatjEtLu$`M@?6BQFz3XdBq3kwTMoM4Dj z;KH1JiF311C|jQ)d)}lOAraA}TFKbAx;u4MRe{N=`MK+6Dil;y+snO4uHpgiWj8nt z4Gl<J7zsBPDQW0LuB<^%D3N7DT20KaU$FT~b4!yTXUa5Q2jd~b@61&*ydy^U+KWrH zoUh5ysI>x_1sM%ZOjVUo#bYAp3o;6dPj>d}o^Y}d@FffcSWJMR>y^zW4h{}<jnJCo z&CSYsgm6i1_15RvW>;=eQPDDwN0+|M@1(*Wn%2&ek|^NksDJ~dr&A^iy5hgTJdGe^ zgAK%_m||$PT^DaU?IHP+nl?HrXR+AuveI}6`bI<y(!AQHx;jGZrc*>xGP2d3ognA) ztqibdkjVJ>z7!5eN5^CyThUUC*2gOnSU5P)aR8kW4IN$WF0VPV0UGe{4^B=z$|agF zJUu;+#)^xJnUsrEy`jdQJF&XxxZIubAuxUHTN`2L<^J^PxD*SOpdi`zdeTORL!ZJz z1{$0fz+3{r!dF+?eF-^?(OPb|NZ^r>)`6SJ(Z}+5Jn%d`KCW(Tz=Ib&-0hcw59RWe zX232q*zX4{HM@4Ux5HRjS>0Sr$e#8yl(sD`k#`25e^642X+N$%JNtexUyC_iqUEbx z=&#A#JDkF=XJmwcgoGrW!uQhF*7nj$B|}d4`RTE&rY1m)y8U0iqV3io(Gh7+clYY% zZyoTNH`pwP<0bTZ&80ikf0CeA#M|5Z=IQ>JO}`5n9FKIG5LrS(0?&^ftR=VeFTe#~ zv9e-uTQ7<I`0-9Wl+YU(8w~h~YMCw!*sA>6p_3Dvi`@yNuV24@IcnV^UTSi#RJ)#5 z(Q)^mtu$FLu3a)yz8w*MCS_^4`LpDH4z{g*d>jY-jT)F?{TZEXs+gP{mXiSa-Su%q zSC<&1?dMB|GWUCjgV{<X5fPDvOY1y0cY6flr{`!aQFR(7CSSoXkeTspsabD0q?zkw z&yhGLjh-%jw)s|1VS~`}m>4{K9Gnj7SFhAS4~y&h5O;zqqcL$<z()xQ4#+`I7)eoj zy4T@SbCUb*=I>Cp9_3Q)A#LZ)mpz0A&d$!#jQEuwL-5PNRPf2khk<>ns;ei8*jw(_ zM@eR*LGG{St%(dmhvM0M(J6$IHA)on<7;cVNx*qGx?VGf1O@4~x3{A~7?_!jK@8Og zf6=@JEi|<FA+xp19`if5dZFbazKCq)s)HU+w<h=$6eGZHdJxfxy9f=W3nwcgBe9?h z(AU>j)zl<S5^!d}zns=l6A^*I4e7Q35s^_?IIX*@i`ClN`U-r*(L*RDBV!Di0UM{P zpn${ga`6T{$w*0={&BkxOEUY{;Y_*jP?~VsOFX=HswH)G@l09`F=PTxk@=HmITO1x z)#lSPg9#jJ!1)?&R$-xQ;kVzz3keR^)2Ok~TXw%DgRV`Z*@Y7o1H)MO>E_iyU!ShY zNUD)9BDy{j2B|K$)q?JPjimuF-vcmIQANeC!@25^`uh5E_xr1IkUz?R%R)B+nC&c3 z24@~_&u4*WsF|APYm<GYe|f)^WUcz?6Y~9OFU4%WVs2d;3Aa^QQ<K0Ep&>ibe7zlA z(mPWee&;iqknnKhG|wmABz7YdsV`q9`L+E;+dUpHRkpUadK?bty7dhVW`R2;Bqfo| zH#u_*{QawE-TKG{T$3y$EX*iZCPg1i$nfpkx3YI<Y&{pp_jAJC-Q7h61wUbQn_VvT zS65dV>FIw0b10uIRH+1$r~#p8Yh|Sk<okGOS_1+WZ9~WmNF_776S>gY5<--fl)4VB z`(xf(94*w_@7aP>-CUtw97o3Q5DKFUvat2kBZ8OvX*U5QFK_+q^*Z>KDu_66ZNPT< zzi%LeI6`b^W24*Xcx)WXc2pNmF4&)?@D}<NIL-sGZ{UXsLkS##UlQL1fBg87Q>~?? zf$Qp-4)m5$GYLk2)DG4^#G!6(Zmws2g&&gO>k9{taJ64aNvRB%PNvLmdl>2+h+f$_ zIo~Ppp~o0Ku<0^iOhzsI{9p$TCqW_K;;WX1i&c%)Vn3t|gdE@$&|`+E>g!V*gxXTj zf;dxs72D(AS5(A^=+)iR!`?&4?{q>5rdagnj}P0_$*o?|ov#4^LJJP&Lf;4t4nW#m z2<%&*D%BZjYHErH5~nuQS4sGOyaE0SjE^1o!auX>rL$aY>cWD8nXRFuS>WJmpFe;0 z-AqJ@+8#+W=?ug)p_570g}P|5GDnzrCjd<Ru2+mn{Ep0^>(3}VJKJKjKh|Qo#eKmw z4@|{!p)QI^rzII!eVJCHL;2T2Wwr$A9wqvh(6_r@FFJx3yqNg*?qH_ez~brQR+>I` zZ?c?L3^wn)(rl7GE;hEC>;v$LBrZ#0s9!j0f#Y!9PH_a!_o{-_tx{7~7704xLM`X2 zg1;&&gRNj-VKJfbd|;ceFhYge-SbVa@J#FTqcuJOK`#I(^>!EU1U#0fAF{HtY^d0U zgi;w=T`tYItQL5{RznvEJZPaJgn(tQnV?#o>HO?WKZ)BK7{t}d>IXzG5X7eQCB6h* zTwNJ^cz6u9w|m3r0;sZDGyU)JYh@a7z(T}&PnbcP+u4ij`~A|^;W%ckekP4FUGJru z4<A0vg2Mpet5~(%$3Gxo&$6)mEMmI4{8{(~RTq}&ZUQ4cUtIOT`T;r#7bQD84uGSP zlG#qcXxWVV@vOXj>+5-eZTy4+h2dmgNCCxpI1vZp^W(8+xx=A)P`AExG7mP$rG=G` zi4xsmmt?LAga$JW_6*`-#QuJM@BkQgc67i(%B+`#Ad@Ng-TG_|j>p5rDy|zvjg9=q zgYn*_Eq5r8GW&gHM(rj-V`Jm6)HLF1iCuLK4ZCL<S=m5UM)6YZ=DmOXyu3uFrlvLy z4qN2*Eb3LrK>ii|`t@Z+MFlI^&Sn>(;;|N3ZwLkkMjt3koUR}VrA2_?+VuQ%uL?pz za&q#?tVtRbH+QX!n!l*`!GXmm8k{4-u&}VPY$<|`jSU-jYXn#rkek4NH*PIUw|Vu5 z2j$o^oT48-P{m5N6RvwelSi`(B)zH%@9*EgglziowJff#t`<v8L?HIL_!{A%Abhv8 z8>_c7IdUJ_KBvM$hA2fmcpNuhrz_;I93Mvn<I=4GWB-D&WGYpCe4m&mlfq{^VBTtN zX<?DLpgnZEb$;svj1`=L4nQJ$0RAFlV2In;*!b?3s8^$;xnB`o9W92qULURYMZE$o zi9-#oX4hey7as4}*v9q))m_D$Kq7$##zoKY@bH;RlZd7D)44>&76+}QduaH07Z??l z_joV%Q;Zsoj1Ld6jyDVpollSV*f=;o945oMz@%<&x6|q?+=M8kelvd*6@>+4g$gGa zi<ns5BuUWa;=PlTQ)B3-u+UI3kb_EeTEnAWN$79%MG^8lFhX<z4$dnm5FJSsr20J& zm72P=;(*Vj?g#u50AN^bZ0vYpPa()V7mvho0G<IH6mU98AFfChbnO@zK;`A-?Hd`9 z@bC}<sesUcm5ogVYy%X;B7PW)rolrQE7ssPG%{KR)-6{!=`s-V^JgMw!CY4tJeYZB zz1_CW?)YoK!jSf-OG_(DKGFD8S93xENK1oyF}^}R-qh5Ttff~>LIRPdmX__!iC$Jt z4mA@KIxw(Lva-EZrV|&4!^r-k0FP&aAhu-QwSKy?y6O$07d3!^in%h~P0r^wAOPjg zsoZ>a-i%d=jEf6^`UyyjP)bO`Bn+$)>K?eX(q5&dEY}Sg*DB^my}js!tPoUu#+9Si zhX*&-9-Gw;f3CO73s9fTs-Jr;mXno5$;^xaA}<ff1yjWufiG}r+vetoudc58hK4rP zT@@4+>o14Xgd=2yAMpT>IJvkG1C*mn-!|ni0{ABa0>Vs{DQ=A9>x#-s0HCe^&F}r2 zf&xL%zZer2CrTS_D|~&t90*_~h;1v|+eqBp+-?u2y?J?g@4>b!7prI2rciwdXq%rW z0rPL$_#0hce?iPI{AG8knZK#Ixg11HAR?rLz?*brc(F6~NlK~{90%}|jInPgfK*a~ zgNCqv-}nS2cEAuo*{ja+cu6tEDhrrYJhwGDK$O9m5)q>Gv7#ArD@Tiss#V{xxh!V9 zKq69ARi)(Mzy*r~Oa2HL$HsSFkO82E1|TRn7K4>GZ|ETZ%s9d4@USr80ZA#T`t?N+ z?E#pQ1I#r(p3rI~Fgtrwk=K}xj_%@knWENuIY5;$AS478cq#x6z@{(Ms~8y>M}bL! zWI_gLY2;tSppcOD5*=GxHViU8KX6Px4rZ`{V|1aiG@U4EP@6Aba|#ccs&R2~i90xO z{R|1I7txKVEH7{W^D%_ge2Vc69tyzL%^&UGT|Ai$J>Jv-++YB(JQQgIVoUjZpxk(f zcw>7T?q*%!-$L4#SWiv6=Vuzf$St$qShq)w$JCUR5EvMkc#!T8G08(gfQCTu8C4-B zCMNMoNtpoL%+y$t0CI*0Rz}ME9Uh>eGB5!E!^^D}8~En0K|uuYyfUK!{P_6zw#7v< z6#qYJ6RlO^APrs}FGm2_JDG4(Z$4c@2vRfDIv_kC!Q$ZJ>gnmh(9z}cDK-O+&~&}z z3W%y|lM~yui@|p8ThJE-^28fPMnAxrz|Ps6u6?Ylt7`*}TV7s11GXP<Bfxi|F`bze zB=FU)VBDLX%m`gWLqEOF0ID}{^1f~lVCCfGKv&oDa3*CjQw9U15fJ^M{1RY^a!}U; zW9pu)w1e!61jzKt-rmolByPKTtY9(d%EhR${Y0t2j(9=6V`>T?G&8?9GJ5Ui?hX|> z&`5c(?6wA>q)5-wG7Nw({i}mnLLoP&B!M2!hevsea@A0ORDzDdK{SvtpdqH!<B>8} za=(f^F)>m9Y~$|<*uXY#I6%7mTioy0fD1qhO5K4?xVgEtfpD<00`Y$D1ws~AA+u%1 zmAlS4E-voGh6|9Ad;u0aI5;?&kQL@swE_+fHqZ$m3F2g)rhEg=izoIfH}~U|#0n1M z!8XTb_do!a;}a7*#>ampF_Pz52?83;2zGI8Z7q@Uxo+#}8C)(H>Xwok&`nJxKh%og zLqS0S&_VlH)0OjlMUcE{FFGj+)!f`1j6$p#cyS>u@YgPL((DwV2q0DwkxB#K9g;ss zu5D>CxxKvw>&@r>p`xt(Cod2A=;(-P&RRq64PM{ipqQE((Za&Q%Fa$-ig1cdAV`zI zfja>=1>pxgQdV0VSYFNsU==$DhrFgH8YU(t4<DaT@47czKyorE2&8|2e}goQXn+PH zEl4glc6Pqa&4Ma5;9Vg6f^mR^_2%tcZ^>*Q@Hsd}&_^IAFAoE_ZL>M(m<D?sBWaXk z^!`#H91PLZ(*r0jVnna6OzsCOE9SHFbAZ@kfRX{s^V>UOyq7O+BbJ>7$omHdqJWM8 zt}Fol5280RJnYQutgQ$;2-(0rK$v`(aFYsAF8l~w;Nb9(gwgJN>kB*r0@bTmaOC90 zjn?SRt?I7AQ-CF%?2NtoMDvSpIu|H_p=`}9m0_`^5me8fIHI52$2ltG)ahLvK5SI3 zd=C61`f1<v9Wj)y^E)1ifmnA6cv`JvERZc(ifP4a?%RlgDvh2X9RL(5{k5*(nF=E* zR~69im`ZYZRvic$Rh2C)ErH#ZUzH#Nxy~`~_5aQ#l5an_ObM3htiK)8N8%?=Y(8F< zz(OTbi2tW?=HV=IGwA1kpu#TvH=`hF*%6CE7lCL=sez}n-WhEH3xWAYlq~<9R7$_d z)_^Gw2AzFTLviIohbI#`1@)<=uQyWtN;$QTFF&DXt2|vEyMn$M@+$M7s+tOm$>B76 zH*W}EaZPjK>F;++Jo(Lq@74R%&!=0CKd(zmf6+73Ux2Dg0&t*9-t`g%ygG7Qnq|}# ztRDH6BlE2XP;>upH(~zQG~54$D>eU51JPOx^_Q2|>Y19(D%(R}i%cc!ElvADPA&q! zR7YNZtN}}nHo9|g;SXmL5W=8et0hP;6<j(CXzz>CKtM>Ualrl07aMQ;hlVUC@3^Mo z{?YySVTJ#1-1x!rt#<jDCY%%+`UA+r@d*jlj$c!M_V-HyCGp3>&g{4Pv+uk=_{jV^ zw%3_JN^RRd2NcAriZq1)Oe@P{q?gWsX>)V)<a{4d==s*vFDxR$ydqRGJ0L6!-AQ0c zF>kCg1I+g?`wwlXUVbMi{CUrjlZj~rH%xrOkSImwS`*=Q`dxgIV!$ve*b9Z}^VppK zoW-Z4|5*h1pO={q>Pb}3X_AE<@c}*QYOqiHBQc`Au;17+7mi9W()q6o=-QYV7~%0k z>#yOFt`Q)bjV=iL)6Yn8ad8lc6oWY$2_GqobSkX(`%&iJar~o2srNE6T<|`^OWGjv zFE%1kvY)XlNxpP)gTik{CZ^TH!_F|o;gNyP%w&t3Tl?N>a}@{#NLZkX0_%+hkiIVx zrseN-vrzTyj$71iU44C62)H3tR#_S7NMKDEECxw;Jm75jaTSo%$WQ%><rQT*(zSNp z*eIW92G%w1F$@F%B#=hH>p-ktnV*y`W#;tpy&ugp2j1FMtWo}kg{9O{t=4K$&)j^P z_Wmt^vNtP2pf)h^jTeMQ1{LbPCMy#YOyO25ONHN4=~%OfGHF7=*smnk2NM)ssBj?0 zBTppSPOBdw@72vvxGd+q*8Wh367iEmu>SEAQn+8RK;GNhVmlnq1%G+gin#t=?ACxZ z*2Cv`Wo4tDvDEIaYijxeys5(nwo6PR!_kH!sM{0%4ahTSBwVl%z-};6QP~6p1X3jz zHTwJdf(k3eGewMz5lggMf5N~aepiH_ByFT3R`2~gO9a8f#s(sTiwI*0Mvz&oWGOQ+ z<U~4JT4LvVaMcCq5N(Uia6npyK!#<8!vgwtcJ={?H&gx~p{>mf<~VB@^zYldn}dl6 z?3qluP*3Yfh*wFA2Ojk^%J{?tW%S>ZDUA^9ySrsM1qCz`l6jW_7yG?XOks8Z?BfTx zPKnTh%7v*ZjN|53SWlfQNO17=SasoXbcsjf+WD=`kMBO}nc_fq@bM*SO?Z+9X#rex z3;hY2pNx&u6?2CVwO#|u|Dsy9!gREZO3)Mz3IZ9=UXjMdNr{QD^_ov&sd0}6r~I0o z?UjC_h72jZ?l?f+_6-hx0o1n8^KH-0P$Cv?)uq{4gqoTfr}$X4<L?=AL10VP+S3HY zwl+6`+~ae<*wcf^%v^FA7yF4c^5#Bswv{-z3#OhoqHcL&TtV0HqE{yxu=cWw3acL^ zOllIKZ-a_T`<T<(ngZzWL<;U;maPV%t21MrJa$`nAh)foPrO9MZ$VH|;eI%IbmXz$ zg9o1di=0Nkvxf-~ZlDPxk<%;%1_!^ryV{RveYDh0IWoIGdab)XY^mDnfg2hYHov>0 z9spJakfoTIX3rH_BLrg56W-fk|J-x2%fiW5o331lP#RTFpQQd|0<Zy$E5GZJqoU#j z;sARO<biWr-%vW&@td;p6f4K$`us1kKRM5x-~RFmkjsM8aXQ+Pc<mQi^W&m#1R1r_ z>+7>R99T6FgL-~$9<LT^xw1K*;VHc>1bNz<*X{`sQs=^n<BN#VUSUM>UR^cF^XVLp zho9HrpzejsJlMI>T3O*BGr<xMO~VZ%&1T{k`Bhjg9-teb0Sn+Q*$by6U$7c6%@+7# zWnY%og^p%rn%K3iAreqkC~-_FDv|~zjk-q1_u5ugDVy}MDBRZF-`#1Si-3Ganv$IO zwI-dCVrq&@wod#olTw(1t2%sWcz9_=D2hofH>VH+LSBvS#g1MRn<tf~)*=KFP5Y%M zc)fLHJUb+wRS#!ya4>z+tllFUAbM&Lc5SbZEJ552*6S3fEKJRf1VO3N6Eihp{rq-k zv>grz-l}&;>@j!*>!TUZdWVT$XPS&O8ZkSvv1U<BhLbx6SVjVLYL6DotxAr-u`8uu z{U!XMFb-$2R0We^&6s!H7>|mIT5i{?d~=WVM~dK>PW$-^;Ec$$w7{4cL#wVk9e>bV zD(=Duh|B{V?0h31a8GrS47v2IEJDDz|G5gXmLYvNvsWuPynkE<btF<aB#fR*a}~g^ zjcuNtfGHpHJJ_{0HadFw`o3CnTIUpSi=SM9Oy&BE8lq<B(7a+{!NjHeGPQ5AwXxwh zI{h5*=MOcc4O7@H@KqotfN<?&V=t@+b@B*U4XnF#kIYLUd8unAT_;iT7x&+egezlW zXtHv1ZCj_MPvIck`hPBSZg%HuDF%m_<_Zfe#fz0+F&@Br?Y;E?;A*V&8PeQ}XCB@x zK7=P6!GaqcijBiw_SZg9@i+0iZcI=D56#biJ2*5H6?5^vbnMmJU6=qgBIVpB(8IUd ziBxX8j_>qHPTG3!KtWHxmnM|Qre3UkY}YlofF>?3KAJbl#Ph4>BUObzpZ$>!oG^L8 zc|&Y0r-#r314OsI<D+VsjlA#tjxZ&>M0l!`zP$yDhsPpuvWxCYTYFf^{?3NdHk(DQ zI#crq{i`VCb@Kh~v$~$}<_x1RDJ&4eci)2Ap$I`gUOuyT?WVMqlC_KuB#Wb^`Y?%z z3bvi=u^DmESHK%td!VTqP@A9ql2-2Zn##xPCO}?ty<XctL{w2y@{46y>RjuV8eJ5I ze6L4aK7PjMs;N2owypfh>%Z{Ar|7LgXLNo?tIno+J4*bJ428mzF^OlNX7@|Vp7f>m z8|O`t1*xE3x@WbBRu*la!}%63kkb5Msg&qn9~{26uOXrEBuH~>LKJ@bQ8)Zs41iv} zDF(Zf?x`<t7?^-r1xQH9KAfi&rUlP(IhmRg4Ng=VMf2#Og}j%OJLW1GkG8+RD&})1 ze%ed48&t@TX~a$?7~(bNV*w^;rkJk;=u25;A^&NeLO#4fD5`HL8z^>8Yk<22qGLOZ zv=GYZSZ}te4Ls|imn5!moq_0PV-5e+gP|bxpG(l6?1IJqAbwa~KNpyCBePUYM2Uoe z+&0;SBJ^=&vC9@fe3xk5=gGIR{l;Ik>9LU0JrMbJg_t57m8_8e2jbC^%8HKW&^NG7 zKjVGz%NPLqYs_yI$$;Kuje{#XiMeuxS9I@ixb{mw{AcE$w0;&8Y_o{X&CCEIN%e)m zZ8%7*2QU-UV>1D}ohB&0vnP5HmfG4o`yWh~W$z~n^FP`O>XZeCYs#xdGOE&x_rR0j ziBwn;jU;93%&$}xO4=AmfepAOLJa?i(L?uc!_A<NL~hS^CNF>|CSMG6EL2R!Iw@E! zHT!DAcpqw^|L1{L(mmY&(~II~1S+7Cz4VoGBjNouEY;-Po;Cn#eL9-XA3uUNiAWRJ zMN~f}^Fmke|A|B0=~fJY42}KLKI~rW4OT~gKgtmqUt3R4oU2y85;gM?v&$t4Y})b} zBe^XvDMons$?5J~fy=bR<=#uco-PjOWsfg?eB5Ygx;mGIAy-!;N7G+_T@ip&W>-^d z9stCAtWafCu>_myFta}G#ZXivR>aK>kE({oE1o(`3(G@wrQG>KrThQU3vhAqZb9l( zTc3QUo`uDNZapZJP_eKOh={b8RsDN*fWoSi6V~`7jda<x7Idri&u-$A4%=5uSy?%{ zb5%r_%n>1tA^&3V`V5U&Ys<VsLKyBY_c6&Mrq|q;TI_LUhKFswf44g2`oxJ66_H<{ zK*@NZpE8Z$27`!B9tvW+SMNHNfB;%l6gFU`=946B)NAapu(0zyV&Xs*6M2J2{U(q5 z+67eKIy#s;W@r6HX-t(Y4$uuvgo_;20x`((r~$DCEBzw>2JdG1*~1S=<b(!0OM>a$ z_J9$5RJyQ7BjQ5?g;$W~X~e@x(E%52{tg-*^z;bY2|G_#UtPw5%l=f12h;$TEbO$T zc9|$y%8$uEk1VD1e*Aj;4CjfChBl8D#M-%5R~Gc=lV~LEn;@E>gc;NUbw(j?V{aN0 zjcUz9Vi&DK`~srlT&?Q8vKPI^-@U|p$<0L&=}xF?OjvXK@I*PR;(%y0cJCoXF676% zeSX_Cvg$VMJi?o1hXG3HGi!D|gg9#vYo(PY>7}`tQssous<`^x$Au<aGCjMF`7i0m z*N;=jD+2m70AtE)X@$WdT^rokm<%T1K9vz{dt$tfvOG!Rd4cQZCa<9p0)#S9!$<u5 zIT#BWjnyidU|})MPwtJ6DkIEjSvvs%frx|z(&N2G)lB}sfB({f8~}QEySY2=*?Q!Z zX?@kT&>0vCk@yCPJTH(D(Fh^IT?IqVdwY9OJSiwBcyVk!W+w3Zb+>M4`?vxq_5X!x zjdjZ;fP4cDKoks)j~|DL$G@uuT0&5+&jU(ZAUd*`;NM4>EC>fc5>&?8#>XqVhf`}_ zp5^WC#E<5clwbh0l$DJuK&{ndVVjqC7UBi;<4zzbwRO%es}vSSMMtB@7Hkr7n`~pV zvcK!NJ>OQRX?**38wQd}j&4Fla$g7p#g>+qDcg7BIo7`iHv5K}L)zNX@h3pZB&>Bf z)qDP%qcmzFhEOY&7O(ReCaLff2M$j7TK%^1ySEclLO{Sn!YK?`Pk&F@cCp*e6drO` z!Tu&j5|k%)c6Y0Ta=|41{rz{ATZPfk(A29m)YM)Ci*<D0wyt@an>N0emBj=|z)y+( zqlkyl)BXO7P$CX|P@!!b5vJ4q_eLde^6N~!0sl{_pD>U({J5Z?c+5(V$CI%JOmJU8 zUS0jC%NIe2?o8P#GCI0>dHG9xe1JO-K}i4(0st))jUg?K{tKb|k=&Cja!k+XzY7l_ zSM{dM*PcE<l^1;03T1=5*K#L=vKW=$;#|9UVH2g=UwXYC@8uLVI=cnA^~vupIeK>| zJlAH*oi6sLBSLz+jqnPT=najHU?Bpj7h<CqCNK~qBX+k|dsIUsc8Hg=upOgnS>9in z7=gR~%`=DEZg4784(GJ0pNr(=RKbm{)m`0R&m2IcLwrAv;#^g2FFiUr`4Mm*Fps~7 zih+C>A7_$nK*t9)FYgNoP^8&TE>n=fAr>DU2V&TZ0-2l3Dzv9at#Wm3+@|NO&D$Nw zUv2%dh4rfA6Qz_wPskA6-f&AB2XgPSvhDg^Kyb-ZQ$f#<D0m4eSs*NwKUyu+g=d6+ zpkifhyRuwfH}3fYK{ru#cc;^TfKS68XgTV<W;2Un$U*pm1Od|6N^Tm)O7--Tm%o4Z zl>7Zz>;Nk#=jN|HanRcJ{CEjJc%NW!SK0mrN1lbndZFGOm4G=*zXP5^No5)oWp<RW zc{9c9*Os53;NN$$mV&b33Q*d6PIWwb^5jbZlK}SIQ<5?t_2~Gkw0HW$&H?Mu;J(DZ zkQb<QNJ>h|X{ex*rDEhrqjxFFhKXotk$F7WasyEv5i&YGAu*G@y}Gh8bJufD_^0%F z2uN#?=ilEr*G`>m$k|}+FVRhoh}n8h&dcHR3Mb=v4e)(@h<_D?4x(A5{`!R@9lzo` zI?4)|Dd}{n&Uy>N63gq?2#Bz7@Cbq-;0usX9xf(e;u90}^48_DvXZyg3X6)mhDf+i zx^~8xe#wJ=^hPQNWE2<t><R@^fx6a7qc0DKtu{74#8hX_fif)m+4Kb{{EJ094-Vex zT^;ZOn8wPi)8a>8O{}Lk(rKE9JDehnnoxviZ*PC&v5&vAx2F&K)#CZ=iGSGJm)mV$ z;qONY%<;|P+dnVizm!Dq@k#yIXUCyyp&z>5>nRR&Z%c-asEJtv(a)dR9FAr%@|Aw7 zRT>+BBUos5C1`y(;|M@2?<{ML{>5gH+OyLBVQyjByc0yD+A;JGQsQCXyMwS_X$+oc zH6lUY@or`1BqJH1k*CU1(b17OU!ScA?-B_-KWL(n3lO$~ON!C!nkGN8t##_Z6Uhp& zHFR&YtGzWdGiL>rH02S)aME2^2q>D6U#pqlC!d|M-`vUgVaOsW?7nvjJKx%}4&5Ei z@O{Hb?^k*(<`)p4H<~UoQ*DQY@+|WSCcUf-3!sH~4mwgC28IVWMi{UufSJ6rTB`H* z^2$d>btV50fF@#Q_EUNPP+sD*AxBv5y#~p;zM&ynx?cL_qx6>{IUSvd#5r{|ilb1K zIL7X1Sr?lLi3kVZh-0x((%o?zM1|iGg(?#o|BjEJ(O}_x<rEd+w6wJ9>Oy@)GrU04 zUNm_sXnOi2+X@Te@qA(=RBeR&BPbxi=2pi68ub>;#v623Q9&vWl&1AnW$Z~8@s(Fl z7&lCfj7$L4RT@pLGzbJ9Nf-(E?a58!;?FY_%@(&8;2-+|Htd(Xtq2;g7*i8Sy?i=g z7aC$GjNLZI{v}wl>7L<%0_9rpm{q)B<LY4FrTO$X4XTLbVRGE3n{`Ll9xN_8QfB5% zQ2N5;c67{277hgMMS45SpEp3gfz2>TtMUGR7$>BA;l_~QxBP<Iz<oku!vEFYTZdJ- z?pwoCQNhG+KoL<<5Red%Faae@kd{^{=?)W>5)lz85fP=OJ48xSkS>u1>F#&jy3Rgp ze`oLS{oe07*Y*B$_O;f;#h%Xj#2w=|eq)R$`&;$~%ofLy!Tc0o0sF1!U~K3AzB0#A zU>~E}lCkAWKZJ$;n3z01)0uzI^=3n2QHN1us#pI02a{JmhEgbbdCU<B`{%61YUlHR zR!{KN$<;x~NktJ0zHGt0Yf(;yImh#`*KoTBJ${{2;Li4He$u;9c=1GT39nV$E*sl< zc3d`)^OvGNik>~oCm|^rsJioe_4h2a*jtUeTG8I_8{@a$UEZO~iZ7;q)7qedWo~l% zOs4pUh_KvTr)_tR?4=J9P0e2PE(BM0!}+AFte1~hSyxVd-U_gfTgMsrjA$Ttaj3n# z=9=fKs@~g_wJooFeII3`xq7IpOtoEXo3DWR)^!u>BAT1b7ZWpZryjd5Y+N}k+S<_s zXGeZpU_!!H!<IaPrx@M$92!o{%;)1tZ+*{Uw$QT3+Y-ph<-B~k1A|>{J>yFhplf!h z)eKnecY8UJkeg>0Xxzfna{OjSOw7hA?zIhEn2&~c7CAs=ZXbVbWi!=k&D!ZvcwWJ# zx_Mzib#%yP)ei3+Vi!_r(ELCjSz=_A8nH5L;!xD))D~>#^bWsZc++|}dB><-XM}5= z!HIRA^K=)CAs~_Lq^fW3ieoSyZW*QhDYS`Z*|Y0%hLx`wa&|dB0;s?cUur40gEN+M zcy_Q5osax>heLiDtzCv9;u;6GY}xX2B>2L1c9B(^Jl?msqUANzXnYJvCg-Ea0mFeg zxuNkX8k$%2Z|RYsG-o}@ZZY(OIpA2{okOf^G4{|W)TLxeQ`7DlKb7;*5E@7hX_wrn zMZvq3A&U=A1^y^q!DGJ2tA!?0c{$(XS)Q$h;^K{6=<9)%zt`pObN5?N(?!6pS_2-l zTTQRLxt-0uIrp!Zk&!f~>68~*dVkEeUe_sWkxoQXQgZK<wFo~h=B1jsS2wh@9+BhW zRa17l5Y6a*%cDi0zNLk??evrQVW*a9V{KJ|8x#`@ev68nO_V!_`WZn$eKP8}jed(_ z+OwxrdTZ|99%M7obEA@tRD{e}KcZUm=1m%fh9yZRht_VIXU;A!k1ia`EcJZ^qzy_j z`Q4=5<e+hV<?(bwMV9hA&XFGu=9ATvbv0Kw?cngHAFb1y(bgWaHrhBbFux%xZRED2 zCc`!pzSOmvnwkZLg?VWHJ$p5!^2IK8CAeQS&U85$)Ym`;LHJIBFXG<xM0Xox`?<Fc zTO@fKQY9KRowBs#TSwpMmNLWdytAYJt)!AtlUe3`vT)B5B|4?uiyhh^-c4uRSEI}1 zF&A+6(XFJiotg1f)zxO9t`o-v+#CY$?&Z{PrUXP$A3m%DMoKZ=YRh{qEm}q49&2nP zS4soWt=iD8sX5gXa=*OlTdvr)ZS^t*`@(|M@1@Rqe5m;jMZ&Ib?P^*yHwy}qo){&k z<u;{>%+6XH8ygRqPUA>7fz;lygV){Dv#xh4E6=dtd~i(R@r+qmN3n>#eHXXP>!{La zd@#`15)mi<hE$*W%SX<gR9({B*LUgSGq=&MGQ)A5%ESv7E&v-jxU;by)#QDRO)vEO zwc3<%0RV|z@$vBo4;JK?(luPXew79&PO@|=KE7<p&PYl^g54LjmEjS3&t8n}iizP2 zy!`RbSb^$6&#yB1w|UHG#sb8o&Of+&cZt89)$Vi2LU%vkySMmpxXFY$#yihI{^PdG zNd^y>+AdL4Jf{jsMnuvanE)JSx-EH4wk0(k>R-Q$=+ocLpeQ8T<x5VES*(gI;kk$b zugy%oXK(Alx4bqhuX%>%rm{ke)5@j0JyKcHG2g>qUQpMx@%T{<ZA~L{8Cu9D_MLM+ zb87AqS*|N89^EajR<h^}2EXfXZ^t&lQ0s&-V%V2uJ!iq5N8cS7{cdvDB5kXEj%&hM z&+`x0?#ftJekZYQO#6N^^|8u?Q}p}&1et3a1oj;4mYW+H<?!VjJ>c-jj#ICGOr}rQ z!2alZnjgJ0%PwCo+sE3^=<w*U@}!E49uo+fsE{(H=gRTD5i(vmCH>+|2lk)L;Tp22 z@R)7Puc2*7v~?Tr6TbJ!o#W|3#*wC-=932uyF>0@Pn`%*ln}`&+^pwH<;519otKwT zmH(Cd`T1Zd8J4VLSXkMTmunQTYv=Z#Sju%q)@Zz$w{`7zSc28-aa^2}MSnamWv<0e zuR8qVuX#h-j77WE+eVp$7p45(ZCLg2_-o(CiwhHnC+ogQ3Gt2@W*3!a<bqQBKI|JI zcEWOneuVF(zQdP~2H&Dn(bLoOa6Gbl*$Q-4^*>#D;pKIj`EYL5-TQCC!knOAZA`LT zJHB)6?%lhSE8AV%&b<23=7f!2)xe;o{bUQK*1b<pI40!)m^e8(Z{Ww1GoavIp>#EF zS=ZL)_Or1rbI8rpAVKWrt|ka^W@fBd>F+6DyY>)lf*6yGVpmylu?Wg+6r#)SiZGa( zjz`DG>wU6W^>Ar!?pd;^qT>5-m1XnRtyy2czE1rPE%q~a!%gRdH)6j{Oj>r*O7x`a z-f*VpY+hw0CClCNb%wXQR$~hh^#BwKw6|Z~-r4*xcJ%Sq1{S@;?|4mukD5%pDi;Gu zDLB7MLP7!!{DS><Sj7*rvfjPQ|IGUBInmi!h(7@&?gI^EXNfq3vT)-7AES1BQK+$f zY%=--phrcN;@yYA`yZ{{)!Z4=-r4y!A>n=Q)ESU|V`GQcclW7-Y&z)Sb@Ir|tlHY7 zT#nGRwB1-I&q1oKs;=$?J@h~l#U#=|CF$9!z>BpXMO%Ti@i~kjLexHOM=f`Iq#&jA zmoc<0K)1_W&QVF1h1}_y(0fHAnZ)#x<55GReqhqOq_cJS1Gje~_DWR6jhr<#HTw=9 z-UN>Ynqbx%&G)Wcy#Cnw;qsyJot4AI5e3Pn)KK2;cW;WAHjYnW0VJ)flRIuY!UTSl z>%H)<xo3<_ZmHCgj6OOB3TgI^&GkxN560d*Hf<9d46>D~If1L4cg8FhcR4%FzNXpD zDib`t?_3*g?Yiv_n9L_06wvg%o=7;0J9_$2ZM@}6-}R^Hnd`g8{8{2(m!8=;l62+Z zW>)`$A_a?#y{jK^K~Rw7?Kdu>&3O1QOOFK8UN-^$n;R<}W|r<<OMgz~$EfL{zr0EH zK}>(TtT$br|A|w4%YFW@6vgU;f4xcmA8+cv+v4ZflDE2LcIl|y{EUgsZ-UP)lv;}M zEb}?qeXja}-?pE^cF>?oXut<2%;=9liTgC*Gr0GftZduo;IQp|94U#X3GGMIb7i2p z$o>aEeFKO4ils~Z9{x6N^)S2XZT!RKrO@vGlk9j#=fz*ikP(7IF5LAMH@S|x`#Oj5 z>Yoa{Y8LAJ<P(Rl-=oj=pO<xaUu-7Pi|Z>ItWG>Rfj2c;Pt(|%@k=;M@?Sd_c=d<Z z7bagZsXPsp7Jb)ezYo&nUA{*FK1;27Y)`Gcf_aMbN3q8aPcmvpEBF3&EoL0(GkL-< zvZ$)*hMV%K?`xA%S+KkQTSg~X&%D=m?Kl-qHzIJ!qlm|@u8%xCHbIC_d*#ZNGiT49 z48A;mTLSWosnIfF9~-mo^1aRs!WmwSjBcsTz0{EB7L?f!IsSmfu1ERB86J=4&+io! zi0L*YtVQ{Xz(`OA_a&J7s*-NszAbMfqoUHX+Wpz$^7J}dh=JY4#>VswNW|0qK&BXP ztT7Y^>?!EJVv!*#r8QXKDR)NN#VxF?PBCrV%fz${Ds74b1m%07O@#@D*n1kAnvzo} zKVZ-}D<QE4G8FXe_PC4TpJ?qedVP8*+-w%6yTAfg%s7`p0L5-QV*-TjOee54b8$g{ zLWE{eR6c?z5H=1r#Uu&^@Zu!&bIn$LtT1p87ZvE7>+!d@K!S5ZP|$GVmmKNSazLn@ zp9_^7gRv?6T#Ps<Mt2&>a*soTkK=;&%@Eg&EyEyVdIc^cluAVO1Bez@HRA4HRb@w^ zaBy%mwphV70ZLtR2Hm^9`d`#VUPp-zZ#_M|Ykx!H<lH@E$MmHA`lS#aW;fdwSFPDR zJE<Km!B&&vo0fJjeR8lYj-}Fb>b8zf9c1-8D4qTNCB#2~<rE6*#zsZv&8y^~*@U=S z4U#OhSX?;rh`V6Zs)t87INZ_9`UD+n489C*g0K%CZk!5yrm3YB1NTcb%H2;O^30%& zAu?sNvF=NdDyw~Z#VQx`0D^<~$2wUKOMXFEB`HLd)uWImJ9F^ZFW5}L0>+WIoe0~B zZa*w6?6*H4hgMhvu7r8mPKetAh~Eri`4zaY{fXgeX}+`b@TrBTq`Z!hkAF&h3mkd1 z#4$j;9^@3Ex!g{9>E)I0$!GX;86@nw-Q|HtxVT;vb{I|cC$<=Uq7$-twU&<mg;I*i z6VI0~V`P;rA4Vu9U+&9X+ry{SPfblruYnWT&&<pjFJF=|(|h=(k59u}`?xAv44~1; zNp0e3sH&<;PhJJh&Zlb6-5)QRmFm6pw{!XCU7$5(BScit*cu)<I;z9@bjQTxjFuL& zD}yiyf>l`f_lde@K}m)=K+1Ir(LM?Z39*9}LcS(kfNLp`;nG4lcEiBH4Q?t`C}pQ$ zj3U}O5GHG2>r<SCq3*7Wi)7fRPg=aZ*b)Z14)|LvWw04qQXQ$}gdU~yF5Y#}Q;A7R z=Auwu&%oez?;cS&?LBm8B?ay<$8E|MOBmfB&kDlDGcz+o#B`7+Qf`13XxvefZaoP` zdx!ZzW9wIm*IX-6zFLeF9^imp5wbD0#w0_C`j%0MO;7s7@G_#cTwIvUB<jG4{)Wjc z`@<EsDfP7Lb{}^@zQ*VLd};u3NCB~NFE5WHS98tUwb>9oZ(bD`71dIt1Lvlg^}#2) z_aRA9wwu;eOtaVkMe=c*DR$5?fihv2<m3wHot&I>;%(pxf>_nC_49Hf286k;?Y*a$ zmvIMdinm~RiqEkC1&!6AkU7AQ-*i>Ay)a9U3vYAQVCLdFcd-Z2(d^+$sV}YBXXl4A zrhYo1SR0HM1QjvR1=Awb_cw6cwsUIG3^b=Vs9K_7@Qy9`a$zpAPoKi4<1;X2yX<BI zEe=cd#*OliDXA5-Se(b`u*}7(=dXM4;K825hgUmup#8ZI-bZZHSRx8aONo*c%I0Ol z!oqNB##wbfE9+999_b*CDJV>tC0{S2yy8$_0f{IFjHCL#s@en5b_2;>>v!#Pf+d3r zxSUwUp!8#h<enm8V{-zl&dZ}Ju0-5xKR><=y;N1)TOg?70AU6cJ|X}Tt(~3ktN5`b z-*t4P23PKol_kPv*dOlTK+(|9xB*`Z5z{IvDnc8d#QcQ0M*(*ZjgIx(wmB9TOHkHI zug40++G`NS(B0iF5`6ia*BUH3ZMa*^7(AVwo#;7pnV6XT`1$i5bS4iTK0L|d3I0|c zsmVmmM?|TpI}+t;K0jP-2)Q+)ID7>TqYMf-6(N%YxiT~sQ$Oz0UX+)wS5?I74HWem zULgz(w?dBt>UA-iuu4)WxS~YM3vu2T=!ZYS9YM*0?{mYZO;o7iv2y=v$z-@4FCS() z0wwbgr=uA}O^vA}FS&{mH+}vqw3Fn*K#NN%bV#?K`S^rgTk}raG@b!S5RLMs7<3>< ziQO|$w_`f8fBZhKQ?Z}Gw!<>v-QP6fynaikY&OBlqfzjNZHpAJa)z>c9Lwl}_TtI* zpWAL|-44B$Jo5CsO}yo?X1NVj5yRYS&Vg^<P+%7>udLMJhyd9JrIRGv?Cl_+vGMV7 zxH>CCebLdsb?XqiWb$!Jva;0P5-UDkZ+xo=`5^!(zwO6Qe4qxNKYuRMHxLfxW<kdY zb?E)E@W_e#y}h>&dY*^WH&MY}VP1sIOQ(q!BhsY#e!Cc7;(!RV$M~EMt)#QdrH>bH z`ki5U@susS=Y5#P31uHIJ!m2Eo%A2<055}$R;*aj=(4J0czTX!6W8k1PHgctVxpp5 zcRhq{ZEer*Vc@_LiJ6QHot&A5Ug{SjkT|xy&#&p5W~!*Wb<lPG<>Nx3O?$XFdail{ ze&>5U|M80}&L?Q!Z%jqkI%;Yy^kgi6eaV669)^2_0xJhU^Pr&;TX}Ix`c-+!w?C=d zrQO3!m(il}u(jo=t4R#;`Qvw|UD@P^Fg|<~gvoybv%l^92byv--FR!y8}q^6Y1<}_ z)ES@NUzM3)|Jl9u^on)emBYV3`a~$O8yDBF`dt^T?x9z*Y=%yF=+$q;bQ5POw(oR~ z<A(gxXrtuC`_%mn*IE8Lk)Y1Fb{TlPFlzyfe{^v3E7X1dK)7cEr~m5#2`&ui;+AbH zEKIU$W8QpTGvw>5?YnYtndS~iIJmCsNdJ9N(j$P>@TP)vFSl~-ken~I@2+TWKEK>f zT;lVSb`6P%@%~Pl-x1(qqJV#C_$)0++Itc4rXfYIo<5*?)$JrGO!xK=<b6lmJ*<<n zDtIGvUY@+yF&@r=v5rB<v&<goxd-WOtf;w2k}fKC?z~a^w7dJ}aX!94`^5z`7S3M1 zx*1;Ts5}h=1N2Dq=U3CvWMLPu;%3&viuMDuIh}6Bw^Ih=_u*298r|Gl0EbV%X1{w0 zmQ3OZf}7#~xge0lEYLAQ;$_7hiE)aqO3?fFD~On0jOp{wTqkRM;!UpC&Fk*o4CI~7 zMo*TQKKlD{6D--WhF-aL4N-sW>=cN2p^Zk=_&vzeC=@CG6Dy^qr5~SR#PPfV$M@SQ zbmrVSMlP<+Fzr1^O%;&cMoF6;NQJQ;g5gs*C9IG52XgM5lD3YHhs16wB_$Q%KioPx zjoFw3(Kd%c^9h^*g#xS0YFSxXe1V0f<z6@nDA+b>0TQvW5VJ09cF?$yQ$T6!wqf5n zv{_uRGTt#Y?WhOkZ|<>d9I)mrmSuE%;4+0_09bPf?wq(C*7EW@6a71jy~z}I9GToJ z7!)>7p#X|uo2SLD1XJ=!HZR^DhQ8_uomd8vR+R5bM~ue_1})8_s}Th8ZZsy=;8WyG zzgwlem*rqfz$eaR#Xh5vkyR7TnZlK!60$$TA|f=g)M`_R^OU$W(XoV)6+R>Hiw89T z9f*^WSo2`w091o<MB?D)7&uyGu3gJzmhvsYmz8c;Cw{$^4^O@H_AZ3eIa{mbbuN_D zb>K|uh_mrqkSLsDPjb}~puGp&s$q=8EsBP_&0SMNBN_vQz)W~H3gPh+UYw>)HSSs$ z78$99_NppOTr9FG7$v};uzeA<hI{-O{;q6rRNk;qf~eDU=I9(Z2^RkkEdV|)w{>u^ z3`#$bLJf(JS2-!+A3i)zpQzU<ZfOZ<O0)EUyWZ7hCpS5}gq^9GnZm@B3JCZMCget| zeQuAiQbGnw9EI>Lc*{p<so0Khfj?01n{a(EHH+ud>Dk#>RMgREBR4B9M<C4gzVoi% z4+?bgT#(Mp>z2?s29Fcm6lax{=|AV>e7aT13^_X^MoPXLgX2|}ho=IwU~M9l>G$tf z^>x+GoLNS2+>IL!2uk0J_yGzjJYaMu{%uSb5cm5~BG~`HnA*;xyB%iuq=}kvIqYUW zGU{+Dow{*jkFs??H}N+hQ-DH&Kp<_rTH$)qoxQMAJoE6NqFD5P42iZFR@2w@0d@k@ z@Te`{jcl1y@c6CYycwVZzJqlPLe7BGjTyGP0K*=;xrstPi5pG>BJfvp`Yz&v-AzY_ zj)L@0DAMz@?^7#$QHCT5_Rt$}7GsIX1vp_h{Q1RkF`u#Neb_v9Vyf#YCWml}d)CvC zFb5JCAUP|lFrQUkz8=>K;#ok;^t7#5E#n-Y7x2{9*8YIqJP+LkV#J4Y^R%q&HgK9S z?=)uOEM<zQA+Z+_*tLyKF$?Dsty{;bFAr)~b^&N150!+#mP+_2?zH8teHR?uic@?9 zRRy3qaoD5ZPI4jO>HFC!4Cg6HacJ-8Xnk_PKPxJ8;VFlD9&rjGc`)}tfXz|>F-jId zK(tN`+wKz<>){ljS-CPBMIWinieGa(g;f%Ax(u{3>(8qPH^V{qW7K+X<>mIhl?e>! z7=A|Y{)(x2JOioxcL5M-Vb0<+PRht^-L4LMm?%65P$9x;;_m0S7P5vTa3i7&gh%h@ zc=6tVvV0hwKi$Y)N?bs|*%Ws5yfq{p0!tRLEMf6N>P1V31>Bw&<>a2A^i!J}YK1Cs zsl%gPa=_ZuFjd%$eG?@^0u^dj(;isn?lz^Gx8Y)u9xvcOyKXJ}TpPop$elav=n38F zujhsh(OW=a2TXiNGv_wq1W7T1BJS~_EAQhT7nYW;14e<h>9nn_;K<0x9pF^9qx*U+ zvH!zrL_AM<9rXMrG~lSu&i9W~(b3U?fwKx<4<u}eReaO-?KEJmo#_R4^7HfGF*H00 z1NZ08pJAIJo|~!Z>1@ma%*Q<3w1#jU7+;bQngTFenjSd}GYpZU!HEa2!*Dh=16-7G zMZ@@{pAWYwXGN>#{1_N;C5ZzRNLh&~4<n2CmdLO{or}icJ#i1_Z2Sh3K@<rEaD7qs zV57iUZRftd8B_umwTBoGcf9ryk7`h8=qeyt)F-4~8d^mANryWU<yR{~k(gNTr32P& z@+eLBdpx!l7lDA($B!L?g7(4rD>OHB`k;bkhK}|89(b|frp|@q-pa%q+xAUIFF#wS zwL3UJTzI%i+W&4;&Gv||X^VCC>yxLJzw&;4`&wk$+l?xE&CcdBXH0c$T(+wpJa`aI z|K%V-<RuQnI|YFdijCB(_V6rWiB#3nstz70LCJF(at`PlC556wL+=4U!j|;fhD=)c zGtCd#B`dB2F}mG+sC)_=@e5B+^w@4Tt?1bWd><MX7I>9KRbRhZe_n5#Dp_%%d<J%s zXD{iQM8AUkLo=*P#rme2uJiear}~&K2VOPlk>ph(32se!VLSeY8mB}$e2(d<+wR=C zlV?YMt=N&R=E)JI^o;<vhwj>Z0kTFne_)NdH5S=_hZldf?=Ss7go}%|mA|1NO^=eG z|C!$I?i(>tN1115CQK@S!>abZfvK^-VbkM(#rb`b0+<^cQ2Gtz28ObDt6zMT&k#tC z+Rk}LB*4{;K*IJ*<5}YG0t2&i9tSC4wu`)J8K!dk^O=ML<htFVchL53O3Ka}eJ%Cy z{O;y;4}br?PouT2Pq?5=jEo%UXa9Ye^cVhL8Nl(W)L8DFYo(YDwDr39Ts-LM$D*#L zyGA=Ca0p<TpZ~?=Z&*8)KrhWG&2(Vjq_WVd0Kavc)IFp;FCE-6wVz`p5H$hIKKuSe zMbY&PGmYT0UU3W3Bve=Xv8l6cWW4eA=)|1K<3FtEGod&6QELysI1f~+qf}a3kW}fF z$?*Q?Pqpt=RpS<^li0D($;nNoTZUj|Zs=up6GBmvciq4dnK<v<2ru{{A|e+6jsTsl zP8dwC%U5rGgQ5mOAt<n@fAa(IGb?*FAW<P3rCNipUB}lgV8pO;QZV0uopP~d#_1mb zF9EX|tD4Nmt9Q)J^Rd?qfw)s0{+Zhpv%CG<W)LF~KM`LhxCqpT_s$3RPM8h0DC2&N zDZMz8z{tX~O2F)w2%<d@MWf%G_5{44%}h_ohp4Eo&Ru*)Oz@(nHcDY>Znm9lk_pj- zS1mVpdD)54H7LJ9AHfXCPeNo0ii#>j{Sf7{Pf#%ZY%$4&36F?C&+Q>f!DTB}2#s~@ zaeI%v1b|O9Y~!%2f@e7kH=G8iTw<c_;>3AepuxAGE}fm%kiaACl%z(+s)Je!7{Gt4 zHeF?9rD5;)L(l+?|1&Qs1jre#khl&VEQhNsxp4IwVz(>y<=X`D_}$c0Yp3H2<5Bjl z!CuOrd#l1Aj$8x#I*NJ?P0j4;>V%vLA!IfH+7l}DKQUx!?ryL^g!UoaCQ4n@zE0SI zjf+N*ICGlOT?9q@{A7zGFg(EO+}s>;g9rzOK#k<8jwHl<AOi}wn%FBLHaanuxv2+T z8lVy?Dk`*lL28hsqwVZBD3l+tK%z{4AjWh`OiavU?*@>W7!i&r0bqtEo>sX0|HAGB z@EXr5W!PAH^y7ItVl8K(FTr>j8XEe+CYK0P-M!Rb6J_=bo8X%#-eFJzpHy>J;7LbR zH^n3{ZGg-jVc-pi=bcc}t&R*oIy)c1roYuR00a<%R`e2@E?L8IAtoX51p^jP(oNEb zXD^sRCrc1T#6?fIEgNLQ5R4BjNuiL?DiDf8vxAv!u;Igqh}!Qo89w%lw$KlNMA{1b z;=}v*PkVG=kcnb<1qFQR;zb9PR?C(xD^DsCEheA|glAGpirU=NFoHq$!CbzC0<SBi zMl6J_11yv9=3I_#mEr&jYb9K^XF<S%1|rtQ;LA_YQnFc`pR_=Av0=-Ws?Ld2xOSNv z4r95_aC%;#1vSBI#h8Kce@zxPj={Z~T~I)SEQphrE^Qz?h=#^8)bp=i#o2s!M^BV% zr=(YdLaf$WwBK)_IWH7Ii{}~P9s2yp9}EoKi`|oa$@g^dTj9#-J5fV**F-TO;$SV_ zMb3?64*>UIhXOSh7#7x`!G}M%zkdA`9iY8JLi8v^&}lk-`SSDXz87Qk7_kV-LK}+~ zCrKRW0H5yO-cPVypZ;U=1~vvUavFsK0GT6j`Hh~6;GyB+yCQo;G&Gn143<y;b;xh- z-aYBlV4(2liU4P7VWyL>#xXMon0F3*hfDk_46In0z?5;lm-4GuqenwWDwkwe>^^?y zO>Wm@{x|Q56fi{5x!Rz59H1}){;c1<t7eLQDlZAj=;5DEN6mVR*?O#TnTAG+j<x}| zgWmmuG%=j<>UjC4c7xs9wo$)Po#kO?@4kxm!#rt#*Z~h!MyUvs@rkk6cs&ERyx3oG z7s!7tpAM32fkl`6Vzjg5{u##Xso}N;y$c{fSUf|kmYHG=By9tNGJvtLIFsv%3-SfS zH12j(x>>#aOH$ba#bJcz;BrChdS_<r7Fsg&mp{f822afPC1UpZ`O)F-b6_}PSW?Z; zPCEMdD1_8A+vXsTYdx?al3UpGp85N`qA`HP4y@BgymqYrfUE=u{f!vRLhKc$vcmV4 z=83TW-;194#f^1O-GmpmLvMHvR($g-xH(Ij?PmLVipW}w2nG^C1vj|R)DJ4;3nVm@ zLIrp6;zi2g!-r9wq!x0)+Uv__ydp$8;1SZ$fP$ipI?mh7kJoI+jgskKzHHeI<mg=g zq;}TnmW%c|QxlV<0O9$uE8nZDKQ}h+2A7B>M+AaJp_%S|;0kVF-r-qjay~_db5n+2 zzI=hEeFan;(33mLN9da?J<Hhtf5Kx@Q4sQhk+(!tR20+zbViOB6Gm)mCK6gE5@dlJ zY^je5%x>Mqsd3S3)dBw#R4P#%@}8E9v5R|*hF7y6<E{#Y41a${ecFz}@W;K?Q?C!R zvOa{rWooW8y)on;oM7MgImqw;;U5_a(B6o`+Jo7J#jB=cqTR?cME&+vWn}=obY^vC z^iQC~kpEIqZ-k_UtS?{QReJG?x8&f-KPQ)<P<#^-QllmhQz*=m3TrCKXCiAZIoUFG zJTZRWOw)QlNFhtw=lePuQ>eTpsz;*)xj1;v1)mBu-T3h$OUl@LAL^=1d;5saZL1#2 zmmsY~K;q)Gja}HvcRc;39S*wnUt7fXtQXm{K5i;4z9Tw1x;#a)A`zRy^~B+)6?yq8 z@$V!0-z6s`sGQ$}><WX*w!U$jjXl4(Hs{-2_@WW8a(#l4tdS0j=lR{z=kLW<mg~E^ z5-9b+<Uv_YKgdP2K}m=6?$iUR%+(EFYPXk4oo*FYJ;f_3`Ws*I2jzQ+p$Gw8mWwv1 zzy9mrfBgiLi8;^j#_Zpi!vE~MR*S#8>(HG3r@2Z;Kb80TvRoZOduw(ae<Pj$`=dub zSp8tCD32b@a5)2BcImt;gN4NJ?~EG-Jai9i&3W7wcm<u{`Vw8|@$F3wfq%Z*?5`d$ zCM>8kau5aTJ)b21G@`{O1OH2tI-cI%JOPd-uzrf^hMQIe$6V2ra7Gd{*XD&y%p#(W zBg((wYIAj)cst(I-drTw9b1Y1ZN*2<Rl!R$nV4J87;ypwn;Ad&4T9h812$I1XT`p! z&aSRcsnnD>duo})SgwD-x=Vi=(iPNWQ}L<~FR$FBt{zdeW7iJznUTphgnQ6n@TJq8 z+l0odEgSR5P@x7Vd!E&A>eF`3T6W#jl9Fpto+1>*n)OkAy*zmmAbOlI!&zBbK^}e< zT~N5I?k%rPH8)5#)zH%V+}y0(m#}~1N~};d`Vwf200ENj2Nu@`)|zX3_wGfc<8>cA z+V3<{_%2?*Ui)zdQsg_BwgZ!n8?eV%4>w!GjSCJ9X1GO>@$oI+zI{Uj_Y@IKpg;5B z!@&<%L$~$~+2QEP28)%VGUwaIip01?gIm6&n+PgTc*rX*p+3dF<&2p58>X1Gh!BJ- zU&zSF=nfb<<tKap2}&X=gu`O!27zQEIg;n;K1M|iR=@fiz@&}$JJ-*u4pxXzh)CTa zyR~2FQFMU@GiC>JR?+?rH?gp`rlS1S-FB3>HxLsSKZ%VjL9by2Xksu%q(Wo%h)-QN zZ6kzI8OF@!oDG{sx<4f(<e?jaOOg`2Fgq#vz=ZldW5W<=8g<l}7CpgUBt+#-0EC{| zg@sRMx9!AJH_?;6<`H`gmc^w69wBZ4h~x)S_f7$({4+kIG1nTl12{sLKM!IScB`?Q zn7QaDs3V_ZYHqYlp*X<9<NmG6_a~V);u}^zdGe%@3$4r=6?;0|a)d%8Aq30eQS4KI zeR?#ZfD+k3s~&9F!C5XZAtNJ$mZo%Ai&;=mP;v?+qt2wIpM|K5A=LJFMnT!BflH-0 z;6au8O*mC*lKq(%i%vfh7h2K$BztkvgJeS`uJh<<-dnz!5I}!}#2yo(&fAwjfsIN< zDwko$jwfjKkUQ4X(*twOX3``B?E^p0ZWWv1<wP04Nf{#9Da_38OFDWk>}<o9{hyTc zQe?xc(ODso1o{R?NFTs3Ap!<{NO(M`R8&;RUXG#e@9$57P#hiwuE*#_7at}A!aF0H zrd+4!f|vrv6okW$HOkg&aiz%H%?EZnOiXH0qLCYi?E}FPGEqA*xxm8t%nIUg3Ky<} z2=-nC@P8#_%MT|Z2_8bc39}w=iyQZVkHaJN?+pf-B%udnHEE_Dh9g@UFwAJ40}lp0 z8;<63V+J2i7BmG>Xe^1dmC(tEYD_d>*vh8(7<ck+ew!)=4`IqdT!w@kK<{tKo7Uqb z;KyBTnYFd`9B#a#E!oF!-aLqd00H8P*ik~1;g_9in$E4>+WxH*ymYxO^}`+<D{xf? zELKuP-RMc+QJj3|M0Ki{*S3Y}GJE9qe8#vL9v)WQ4S1_J%-ikpzvZ&Q597TYlyJln zDy3U_&U$l@h&G}@Ksb;ly7cqt(t+JZEmI53QBXw~Vn7Yve-;gNbarwEUMv8)dL0>H zB<2s6Y*sa78*Up#iD8#%GtCJWR2_j%zre;x)`vrl5OmH(4O$Crgz5c4XeVLG@t?;1 z4A2i8@;pyM|5i9a{&NhSVce*ERFD8L<gfjFc@olvw6ruc_1lu_$v|1Lgd7LQZq`*w zw{_>vum1K6mVe0iU+5Qfd?oaqE;11tt^Q6~r`(QANO%d7{pGV~<?Y%KOW4ix$HvCC zbqZoY6Db9jxL;^U6XgU+Rdkv}^`;H^#C|3wcCg%ldIHWW|4Hw&x}6VJTUc25g=&;& zD5j^TqW_<=j)c^OnWtFHiAH0EgQc}~Eb1zmix<l~`4wX{Rwkx%=~KBhG@}6^XKKo= z0NslZ(z$S_puh+K#Q)TgXb_8kkAan(s8%o-uOHc1@iMP}3TPgzeGER02u>g}PMsx8 zJSk*3{>o^?|51lXqU2jHw(ks8Opz6g+(9|e)K|i)ej!;`4dtI=6EcgT0+6$^;>Vrr z=+)5^HnX<@8v6wqq$cjxk)uc5mfXN<hJmp#8n76RoE0$ox6!J2&Rq1pAV1$ReY8|S zg3T)y(OeuD7<LHzG;_NZ(SNxA*RSi)YMA@ZBSQDp<&PR9d#kz$Y#Ir2gjGin)&8zT z*PTUhVLZezAZ-rPyg-@^>8~J+4Bu+EIB(8#Ba0#<D_f&F*H0%b45&MS;=#xi8DH*X z(8{wKTlXnpm`DpvKTuczj*bEJ)^9qv`6-+3C%>Ai-A_33VvO};$HsJ=OV1>zp)eqH zBUr&lv<&MI?@5$Y6jH0f$_**bo`VNza1rRLvHScb?V$M=O^NSY+vI*%i%;QkBb_V` z?b6*R=Eo`}J4=d-zd))n1nEr<WQV9zpnU4gNQa07DNHn=87+`pMwBD5+GU?nP9hhL zhL$#8U@-0erJ!@Im;`!kqNA_sM?u~aZsMMs8!fm|?AL<78k0A1b93vxJjBBC8ET?v z1X>Xp3967+#|_oOMwywIL{wB5FgQ_Vqo;7o;}|94TUFIVNW#a)$5quv?A^TNp;ExX zvs;d6z`}PjLdJZ%{XaS^Syk$PFI)+=@V9=8$t|1P2KZ<aHwZSHsHaf=!@|A+w=5zu zhg+u_MZx>Cf@WrBP{KR_7(fy*q3kJSnLx(bLu`y{=y=eqUfuUebKe;Syz>>(A8|nB z!7@mK{fQ1kZ*(K*Vj6XIbr9Snz7DaCH;tSBRq>kK<1#x9dI1~#($dmW5~P^i6Vadl zdNnOAa>(|h#zeE_46zbHhc@7v*le{LtP8{y%dw}tesTEVK@r61kt|+Z%Ace=g0gYR zn;dodQCm$&)UXY6fcHnX5!q02|44+kIZs(t)fP0^&Vr67p_B9H)ThzPyi;U_#fj`D zib>A|s8Z3|A}T*w*~FZw1_3)Zlz<3x0UNl3NPR$Xs{$y=A2n9!qoZ_|`W3M*9xFRR zB_JT6-voVdVsiS}78Jcfmp?{Zj%xXWgMkDFPL;D#QtRFV0}NXtIrB4=TSHg?xeqmX zb39E+NkMV=Aw0Z&p~-$_ygT}rB)hI?6^3y>Nh%|(+33jh9P=X8+Le+DyWW7f07pXV zeDh{YY7%RSNZvb0{xefIa6YteUr=FJxaY}Mmz53k!;~M-qpQE7$wKq+Gjq|mmsp2z zoH;Em3^*{Nw{qRhSE0YL(S4Rdqvg_^--gYbA0W<3G3m~dT|Bx(nU%6z!2kle?4qNY z&e;DxW9$Gn4j3u92$)a+m%G2Wct6W10Idm`4n@AjD?Sg3-m1V0F5vEcY!2x~e##^k z%?2rLm4a`z3{cnpbIa;Bhk^PjD|?2FO#jl|mHbAFN#!JA`p8ywBt0W%j*g9rk~TL| zGzI3taCSnEOe(Z`2d|PP2AR~u*slR`=xUK`i{`WH&6`sqMUC=n+&IrO`qW|PhvEtw zDw_>-TvKTCMO#nmBd)6rJ4g=F%}9|A`Anwxb3`5$x?~c*FH$MB`u04o(0^4g9e4T< zMx#t<_DDrV1%-khUM;eCy~?>_{%{Sr)5PkFQF{Y<b`S$mQOFl!j|I_Xzpw+Toc9pK zi@(fnGj#`qWj1o**x1<mBYpB-fon`QWW<6_x|bN`CCsBx0PG-%!$=cDwL65=$sA-3 zBKjQlW)>D`q^4toCprPRnKCekpp+u6G>Gxo24*2z{OP4)mkl(WocRsO&?E}f2E-qN z(?v-#-_xgA+jTgFuKwX&a_H=>hZDONX2!?HhCq<2qmqFH`4!i#%TCkSfk=ukB@5N~ zrK?w$QAn@#A{Zrog{E8ovIS@uQlo0^Z#}?ggNY6mIbn-2=0?^B9cXX;T3XsUkppx@ zE;_iYhDI;$8NmA`T+Rntu>K%;y;5t}Uwt>J-MfGH-FD-ep2id4J?3ptiD4!**czSH zhUzj93<7C!B5<EW_46`)dG!X;XDbgpO;}U7srLv9`t90QU#I?>2N^^zpyffi8BK09 z`2xuwJv}`^oyt}{`%wXyvn;r}27u)x4byuhR8QM3Ro%PcvXW9sQ=@{SVsQtt4?~@w zecC`;fi(W`90P)O0d*UZ%ATiM_<a9k7Z=hdfQ0V}68J<I-AMo-g&lhjiBSX<0}fDf zWAUtb@a5eCW^2$NCGsr5E<<GR%5=?7wVh3swxUpWzZXAq@~YdXJFTY%RxE>P0!5Rr zkZnqC8r+tvfzQ8zqd<mTtDkxEU2H!T%pSBor>Ie<zL)SOS^sNxa?xOK!#YFsBJkYT zX;2ImgchdMNv15)3>(*Og9wVma{3hWLWV~cPiVpr;qw_oj06=@e(;BYnDU2bkh$!2 zBM<>pgsahjyfHJ@6Tz&9VC-zf7;+%`m)Sl9s%LV`L1pG3@R1||g5Oev`t+~>g4H)~ z-VDpaDyU=hjrkg!G6ivyNzx%y7fUF=Te?aq4|tm`f~t-!gIL3&&4ri3wMGsX^sJs9 zD;XEPEy*G1Nf71>0hy0nUDrX$N4Pvp3aO}^37D2wpl^!*asU{|U6_34<?zf=6zd9> z%4cFsWEUgBibK<LW|NvCr#}PNaF}#ol)!95j-_s_3reXoXU=3{#lx*4&lG^X<+tik zXd2$)Egz9{Ol*aq-jkqWp*re=t|*eMmJ_uqYD2=uC*7J%oJSp}hCvH6A)=2LmH;nP z>gg)^`-0qr&?TTDk9Vlr;)@H0%d--;uJa*n)b+x4Lck}OqxtW|J%}w%U!gN$pj=v9 zoWwm|x^m?{cx0nKQVHX#*uLRmSe5drv-Kk|JZyV@uVsV2MWdI&Ol9A21v%X4dkXkQ zA?6*%tpvV^cz#U#`XiMvB|l$R^zkZ-3@oL+acIcM2uDG%0!S;LU+F8stizpAUtcdp zdtLwNLIMhPLt&&z`z*PEK53OD{Dg8?dGO3hR0DwBJJiD)sIQv8JQt*jm;`k|A4#Da zExH6|#Ixh-zQ4)>`HZE7MKmUq@Wt>4CXTZPc86G5^^6(nw<ar=0!|7v;ZdFXM!V~x zRjG*T^_#NnL|wmoQHP?vZUk_uE+q41hzGq6eIQj97V5l`uzrq+eYfLNO6Ii`5Ybrz zGg(dW)DE4+sk+yW>BV}t8f&VnsyIB)=Wf?I&Lem;mDWnVWctPGUyF(6U53h44;S)V za&*_zFfCo;y?R9?EA!L$KQtoW4M#iHOCE06eC%DZeuvC$Z!7Mzu^U-KXAjqW<+}R) z@TG3<CkGKAyuPsSc@ld;R&+6Yrf^!Z-sU?(pN}A{%fi>OSWZ}*o_%!0rfkwiVE+9( zp>%8QTc=OYO!mpfDdogGsu>gK_4|l$=BBcIg;@*ViJixhbzZ&egvFiVn2CYe4v1EV zLi@>NOMa&CIMf)VY0|$AZ2;J|j#4{ips627}XWDgl7$2P}KscR|vvS&G<lGnbBl zDCNlkX8RgEUxibHj^UF0h@hgEk3j~Xm$KEZb$sp5FuM;xJ67x{G#2QxgT*9ieBP#| zysX^rVP+pXf>#t28fM0^kQx{4b&Q*}h^k7-n=Z>=_$r(699<R78YS}*tTo;k*+S5D z>nbIVnb(I|PEWR0*|e@!DJZj>h;1~fl#IGHSNO=@KC<Y&P}jKJ>@0euG2@e$dIp1C zFDhO0dy2Mcf^K3HPt+~yV_HoCDYiBCZuuz^0UZ16?SB^TPFt+i9cDq~Tf9kKOyjgq zOS@jqqb;^(6FNH>bXjOm42iI?u*BrkTbtD8JWwg?EDH$8obNZ-fk!v=bt?6x4Tsxy z_DBizf3G^-bD5Qu)f=G<P$ItoZjbL{Jf;1bM^E0Y(J+5};YiOw+u*8Qm11tJHYZ$) zyh19Y&d?t>(;axtcP#UjnL?`Y>Qw2$<~qyv$GfMbdFM`<CwBQ;n~kqeiI1NQKV@Ex z;(*sig!!nFX#<+9saD(jxWO!}Wg8r5vrq3Gd;ANf<GRSO!zpiRC?b<To9ZZ(&70i+ z<E0^dUyQb%q%7?c%8l5#ZwBF(3lDRB)OORUr6#7wD_}+cF@8H}UyN+jxcv<q*|6|m z?)9%Hgu^#e946|zAKP5vwYWW#5`I0I)81C&<OKcrKqUPtN|u&(Z2AFwu%1k~VqH}Z zg;IM&FJZ$<ib(#3e|&Y{SXrrZtd=A>Q`$0XrnN;c<8^$<Q0;QxX9WFY&$rW)ODQJt zQf>vQTBXICqy_zgge}g@j15#q>g{~Vtuf==(jMu3%=nIy61CfUii2!r&xYxtG*P4P z8yvN3pY82$ey`HPYE&@WYcyYyxe?#oBodOz(-^HQhYwLoQySzQ*PkqEiJ~qkDUnOF zXbN~A8>oqQ-QBfDrL*urfW+CexraLgta?B4O*R_yS}no?$=C7X3MZaQr<>gIat9_% zWOC<gXk~Qo)B!&PoL<ML5#&bO|7oHnTbMk+r4ZB^&+Sa$fzm6|g7HtztrU^n=zg>k z{T{B&@7H9NJdr-!C2c=*1<AHX*ljxRQqzl(WH_$~xIH{}Gt{g1w@d=LYeA1@`SZzv z3hZ6JrqyyvCpal7t2a#VR5bZ^wocPaiPL6k2$H5lI7sp5_`8~Af|C+hG>zNcMLSWf z+vX;KQISRjDioidkc=XVgc&_barpaIc%78}@bM%5XbR%*CB}?)$D-Y;@4(@lP@o}e zh?krKzNI>)MBPpBC9Ta5D#VK!U_<xbaZJmkYG_Hf2xCk+v_Qs%`@J+Er}E}CP)5|e zC)9l>rrSOEensaPmGX6Ie0zJAZ>;=u&Gg79w0Hqn<$)0niZa-m=tB%pP197)*}V$r z#|Ub<SHMbLPY*{H;Q0NR_^>e@GiXjDiwG<OMG#yWqemM8K^oeaW$0^-Aj-J&^Xj9; z)WTEQa~((Rdww26DE}t+zTpusw;H?jDj9|S;;sS%NsZXr$st|FwLnRIOu-=C6p9+7 zzKF#4Q0Pt*81r;C^U*rG*VObDduRp6E}AvyCE5%a2NYo+to;5xE?cvF%LK~pU-31{ zxCRnHBb8RyhEw_?i*{)Hx+h{usKd45yjAgTZp16I7}sVLqWjLY(b6JNLdWdprqD1H zGH)~#-4?Kt;v*j-{4*pK&tkZlP^;$DXumj5?wWj8i*cEtH_CRn!2+=69D&WCK$5rV z#U{j3xSbdgLs=QCmizRGQc9eu55wFK>OR5J$kc(?O6E=62na8LzKRpZ66c-Vx6_N> z9NvvDjIgIi+_Kd1)(2$7h*yNkMpbL#aT{MjQCzt;Ug7p4eo-k^7f{lVOO3+sblCkU z88ktz{4CoP@0^6$$_v~@XJ}aDS6GOAQA;8@W7HduUB)Kp1>B}p@NBPK(j8UY{225k zekC;MPq!Zs_NH2Qe2>7d=+n5a^;(Mu{7f#F3Qjhj!1TIx`}S9?U|vi+*l%R5@Y-Jp zsYQcCv+ik8uwK{D`S!Diqz<!AAqJ_}2gF@Zj1&Me@u4;(Q_FMEcF>xPt7Di3x{#1e zmzrmI;E^HP=tv|(wrZTUgxX}-n-cx;NrCB9bz+7m%5aT*I&(5dMuU&q9>V6LM8-2D zl)jdo-aGh=G|VuuKurnl5VSH$fCsG+Y$x9j2P!hxbW{5irgIn;hMw9YU@@Q!qw?6D zA6ZvrWxIkH=5GT3K8FL!?tam8ugFK$7%x&}qtv$7vAF*+A_9z@B>ca4AnwaJq0U~g zRZ?Iv5*m$)fZ~oc=*CK7|A=EM#F#p!`Sk@1czaR@GptMb`@(-gPoiYGlValVw|%T_ zN9=%fQ$~<e0^i_s1MQz7!k!EBGh6f$+jE1H=X%48tG7w_mk-DDbw1xOmu#eoe5<ji zn$V2lSoB7pD?i5~)((ET5F_)7oLq9VEuQSak1n?j+$3{PyDsbB++lKnygxEhYS7fi zAqxbA2Z+`<%Uin~22|B|_I!Hi)&;d-_nbB3?AU-`@Y=Px8|tFNTe)p3O7glB?{Xm7 z+}>{#*kI&kVp_+wNmzi=o5y+L)}(lh&kKktTSXtI_=NO^_LjO8_=&m}^iLKSWY4;l zY_*+<)A0!|df8FhGRG|7w)<Ol5EbP|)zxd)%<TT{c8Oh-+HD;+s_uX6f<@V;rhc|J zDHNU!gQY7dZ(coK_SZ|T7M;7Gj!udd4Ta(p>|&>0GJ5n#^X9hh^$qF$5lvP$6iSq= z&$wp+26QC-QfzUzf}+l>s~su9Zb_k}x$0KSGA^NXZ)e;{aZvm3dtr1rEb~~5Liu`C z_L|f0pVzKEB|o3w<>~*e7p}<bdvUf0uP9w({r&UWwL|3R0rJB9f9a(nN$nxIpAx3m z;(!0Vb}g9v^!>+8{?FU}ul`i<np@`#6NRElUUH#XVIe0n>h5N9=FC#c#rFvbGUTTe zdC@>AM{Y8wtdglG`TSz>1Aa{8{cSGX7!J(;`w{RzclQ7DNcoRD`}<CcMfnS!#U1MS zeVhJUUe3NuOS<}xd;1Qck$mib;}_)q+rtdyF{571V6S$?nTq02<L;8OF}bOsIpt&C z5{k%yy3K17FUc|{ZUJ;P5F2>%AB)w$8omGXyT32z|8q6|8?MInYqGQ`-MEB~4UEk7 zG>f9RRO(e4r1K98@vG2k{;=SYa+9km|JO{Rk4*p;Jf35$N`ek-mp|Rr9JCsos8erA zG_Sv&;>0&uTGl8>H!8gK_nUS-{m2_CIALooHP@@EB<L)~+i|Z!;0R;WCKQMqq)PmE zFX1&=d*?4-na#6iykR{0`iPy`El2tw)xxLY*E2#-yM1%VG#gr#FV!eKc_eL5;{14H z<81MM?}Y-(x@kcJo!HVi$Ff2kZk<{Ck7_-w8tGDplL~Qi1|dy}rTFznfjPS5g@q_B zv-x(O$|g7emRnupw|fJ03X%^jas^S_?4?ehFW${H=R7y`v**^W=}gh2DCH{O`;P+L zX$Or@`sfYL<uV)#U3_<BYS2E;d$Dd<R%@oLE6z@EG{MoR-8#cPMK8m5{*m3GP3tll zS2I{Li;qNHi7LaDtd|H77)cd>PMb06J2ySKn!oqE6L$AEF0boDCHT#41_Fj_(#(gp z8GjMT@DHK47aFWHcdRx&moXZ#gDcKnCPMdXSLSdwQ=w_gtln#%>h^cBdGU2ET^VK; zFL}d@ofQ})+@3yd6mH9m9eh?PAChAxlzOGiz*Z*ecIktC86F*L4;weAl$GEzOb@Ug z=n~eSHXcZwZLJ>HYM!_edYff*tnFxfV4Yihse#<+<(vLyzqoHHCJY>QHg7q>s~s>j z$k*Y!&uG!uORIC!HqC&^!55>_=|UxvIx+7pC8hXBqvyI}TlD>yTi63lZJM57&#eE@ zFXsm~kc&;lvnuR0zQAep$)w6l`v4p1KK>A2>odyN$JFd>>Y8>aC0=0(vwD|&OLAb= z&C$5reejl2RLXl!>tDQ#nHd9<5u?>yQH5Xgsv;^wJth6D?D~uw*3xQJeSPn1KAwN< zj#wsB;kwi{CDQh@QI>;uQ{y7dbGS2$3^(<0F0=)WjxsbiXfX^nn_DF8{(fMazgZ5y zo8h-@248!;=sf0yhg`49j2HOKeD75EXbw1(DYW17+EGn8x3BacLnC$ls!Ip;Q@TD- z9N1z_#MK8fEcIQFo0$yQc0RY6toDd4J1G#)7WFaWEB&lXf$0@H9|qgm$g5)?3i5^Q zMV_~h#2Sc4HFH}oPMMR!w8Qq}2eAzMX1$1pOzS~9qyBUieZSJAxmTrv+2d1DeD=~! zt%G8wk{wnxa>oa~i~YuLt`o4jnrCkkAdzZjhQWGMN%_hZPXp!A;o_w6?8cGG*#_O& zVh^X-sp&^NCsWua8%MenE$Y`sR2EHEDgj&m*pgv2=VnyCPP@H+u%uwf-Jr027jt{; z;w<O*feecq^3`$ei%NFVWQ_S*FTSJ=U}rA8;66?U#1$3(<Kjle+Ij7nokxl*_Pa#P zDyL{zb}n=UMO3OR3{92_XPb7{g}pCHck3H*VrcO>?Pe!EV^DRVp?~USn(<&iXa5X! zefTkpTAxuD2Ad;Yel~jawo^UT)A8|D;v=E?+h-D3V;er`DTL^mZ6DiN_CY;;xLJQW zC9dda*G{9{8vT+jDyiJU8C~C<7i*iR2P`X%zK2X)aQpgH!oJ-{{CT}{)kj=>eQP}* zN4rdRVQ(Ar44cAlb$t%*JJ^#9q!z!sHT*JP$dT@NTdCjs^h*7kOX{NS6_p014=VHH zEk&)MR3T)a+H~k#?}5pXMTcg-Rw}Op;{Nher}STqq|OzIo9a!(w`8YwCSB<r33gl9 zV>>e;@qDZ$RQg<+`gJ?&{QEm5Thr^qGbgr-$F!v;l&a?cs&fxX5l`B<k`nhxyXo=V zz(@O{*8BnQ-q&B9YxS-_(u=*O9BxoNFgx(fj>@X5clBUFu1fNuZT21SZHz18<uXh( zneFBuGZmKETd0sZtXbptYNl)FNWR=?!>`PkP|@4g*Ak_6SxqM$bE!8tld!XbOj3^% zvt!Sh3WI2c{end84`-&&2R6=!C8Go^ofe+6VD>XUL;fudm>E7XKDmu^HgQz>Q)ZdJ zrNzuxzjtQod_cA30lV>XMU(onV{O&KA()XeM^ro+l&oZh41WaQ(wFyOA}{Z&N+K%j zr^PG2#|=y?WqXp9j4#tCfNyevRa<%3-Pg9`llb#sr(L5}(h?<JNBLMTY~$_hT|IC! zwxqy3gL{!vb@BT|Xep+&_i&$Z*PDIjWiG<6#-Gj)#xJ^hkB{X>sMHA8Jfku{9;7ZE zN@tbvk=d(-eQ%3U+crM47N-~t_B2b8fZfMbB_;$kYHa3gz1m-`RF5gLPSA^Oat~-c zkm+ls(!0)H+h@9p+jF}5yL9`$S>;-OgW|x{j(Y(%jIw_A)(hi7!V)7DK86_!P3j6Q zBBS#L%`XS-M;8b7(#<c>8RtqK*e}lPJS*j+UK|;a)|0X1AqyURRU6Y})?fmr)j_iD zSQ}eez<{lZ$AEEPE7j=FpB-`|pJOCbT3kmWC)br#RZ87DW^i>;e0t1_w)BaLV0hCk zbW!5-#%nD{vsjgFJ8EuP=6prai@U!;Xiv1dMDmXbMcZsTA1)pSg(-`jUPsOMZ=_t$ zT(lgki=;p0MLOf<4ie9K$3OO$&zo~i5?m|s?_P@c*-;!ynz^@0mEqsPUR7Ng?4i2M z6AXzu&tFE;pYyWnu`aI;$+Wq%%~@l#Ym*Lzax*bL;Ch??|G)Zk{N~N;)m7>+teCzH zRF$)u==G)_zo1<F_H3EixCMpM-MN+3if4TMLPe%Z%heO}ZuW7I%e>{{<?YJd=4Ccs ti?=*NQ_bfqz2L~pz4tF)QSw`)_3sXNxc(tm6$SqjKPz=6^3;uc{|h6i>fHbU literal 0 HcmV?d00001 diff --git a/docsource/overview.md b/docsource/overview.md new file mode 100644 index 0000000..f8c615d --- /dev/null +++ b/docsource/overview.md @@ -0,0 +1,7 @@ +## Overview +The Azure Application Gateway Orchestrator extension remotely manages certificates used by Azure Application Gateways. The extension supports two different store types - one that generally manages certificates stored in the Application Gateway, and one that manages the bindings of Application Gateway certificates to HTTPS/TLS Listeners. + +> The extension manages only App Gateway Certificates, _not_ Azure Key Vault certificates. Certificates imported from Azure Key Vault to Azure Application Gateways will be downloaded for certificate inventory purposes _only_. The Azure Application Gateway orchestrator extension will _not_ perform certificate management operations on Azure Key Vault secrets. If you need to manage certificates in Azure Key Vault, use the [Azure Key Vault Orchestrator](https://github.com/Keyfactor/azurekeyvault-orchestrator). +> +> If the certificate management capabilities of Azure Key Vault are desired over direct management of certificates in Application Gateways, the Azure Key Vault orchestrator can be used in conjunction with this extension for accurate certificate location reporting via the inventory job type. This management strategy requires manual binding of certificates imported to an Application Gateway from AKV and can result in broken state in the Azure Application Gateway in the case that the secret is deleted in AKV. + diff --git a/integration-manifest.json b/integration-manifest.json index 62eeefb..9dc4c87 100644 --- a/integration-manifest.json +++ b/integration-manifest.json @@ -34,6 +34,8 @@ "ShortName": "AzureAppGw", "Capability": "AzureAppGw", "LocalStore": false, + "ClientMachineDescription": "The Azure Tenant (directory) ID that owns the Service Principal.", + "StorePathDescription": "Azure resource ID of the application gateway, following the format: /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/applicationGateways/<application-gateway-name>.", "SupportedOperations": { "Add": true, "Remove": true, @@ -46,19 +48,21 @@ "Name": "ServerUsername", "DisplayName": "Server Username", "Type": "Secret", - "Required": true + "Description": "Application ID of the service principal, representing the identity used for managing the Application Gateway.", + "Required": false }, { "Name": "ServerPassword", "DisplayName": "Server Password", "Type": "Secret", - "Required": true + "Description": "A Client Secret that the extension will use to authenticate with the Azure Resource Management API for managing Application Gateway certificates, OR the password that encrypts the private key in ClientCertificate", + "Required": false }, { - "Name": "ServerUseSsl", - "DisplayName": "Use SSL", - "Type": "Bool", - "DefaultValue": "true", + "Name": "ClientCertificate", + "DisplayName": "Client Certificate", + "Type": "Secret", + "Description": "The client certificate used to authenticate with Azure Resource Management API for managing Application Gateway certificates. See the [requirements](#client-certificate-or-client-secret) for more information.", "Required": false }, { @@ -66,7 +70,16 @@ "DisplayName": "Azure Global Cloud Authority Host", "Type": "MultipleChoice", "DefaultValue": "public,china,germany,government", + "Description": "Specifies the Azure Cloud instance used by the organization.", "Required": false + }, + { + "Name": "ServerUseSsl", + "DisplayName": "Use SSL", + "Type": "Bool", + "DefaultValue": "true", + "Description": "Specifies whether SSL should be used for communication with the server. Set to 'true' to enable SSL, and 'false' to disable it.", + "Required": true } ], "PasswordOptions": { @@ -85,6 +98,8 @@ "ShortName": "AppGwBin", "Capability": "AzureAppGwBin", "LocalStore": false, + "ClientMachineDescription": "The Azure Tenant (directory) ID that owns the Service Principal.", + "StorePathDescription": "Azure resource ID of the application gateway, following the format: /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/applicationGateways/<application-gateway-name>.", "SupportedOperations": { "Add": true, "Remove": false, @@ -97,27 +112,38 @@ "Name": "ServerUsername", "DisplayName": "Server Username", "Type": "Secret", + "Description": "Application ID of the service principal, representing the identity used for managing the Application Gateway.", "Required": false }, { "Name": "ServerPassword", "DisplayName": "Server Password", "Type": "Secret", + "Description": "A Client Secret that the extension will use to authenticate with the Azure Resource Management API for managing Application Gateway certificates, OR the password that encrypts the private key in ClientCertificate", "Required": false }, { - "Name": "ServerUseSsl", - "DisplayName": "Use SSL", - "Type": "Bool", - "DefaultValue": "true", - "Required": true + "Name": "ClientCertificate", + "DisplayName": "Client Certificate", + "Type": "Secret", + "Description": "The client certificate used to authenticate with Azure Resource Management API for managing Application Gateway certificates. See the [requirements](#client-certificate-or-client-secret) for more information.", + "Required": false }, { "Name": "AzureCloud", "DisplayName": "Azure Global Cloud Authority Host", "Type": "MultipleChoice", "DefaultValue": "public,china,germany,government", + "Description": "Specifies the Azure Cloud instance used by the organization.", "Required": false + }, + { + "Name": "ServerUseSsl", + "DisplayName": "Use SSL", + "Type": "Bool", + "DefaultValue": "true", + "Description": "Specifies whether SSL should be used for communication with the server. Set to 'true' to enable SSL, and 'false' to disable it.", + "Required": true } ], "PasswordOptions": { @@ -131,29 +157,7 @@ "BlueprintAllowed": false, "CustomAliasAllowed": "Required" } - ], - "store_types_metadata": { - "AzureAppGw": { - "ClientMachine": "The Azure Tenant ID of the service principal, representing the Tenant ID where the Application/Service Principal is managed.", - "StorePath": "Azure resource ID of the application gateway, following the format: `/subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/applicationGateways/<application-gateway-name>`.", - "Properties": { - "ServerUsername": "Application ID of the service principal, representing the identity used for managing the Application Gateway.", - "ServerPassword": "Secret of the service principal that will be used to manage the Application Gateway.", - "ServerUseSsl": "Indicates whether SSL usage is enabled for the connection.", - "AzureCloud": "Specifies the Azure Cloud instance used by the organization." - } - }, - "AppGwBin": { - "ClientMachine": "The Azure Tenant ID of the service principal, representing the Tenant ID where the Application/Service Principal is managed.", - "StorePath": "Azure resource ID of the application gateway, following the format: `/subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/applicationGateways/<application-gateway-name>`.", - "Properties": { - "ServerUsername": "Application ID of the service principal, representing the identity used for managing the Application Gateway.", - "ServerPassword": "Secret of the service principal that will be used to manage the Application Gateway.", - "ServerUseSsl": "Indicates whether SSL usage is enabled for the connection.", - "AzureCloud": "Specifies the Azure Cloud instance used by the organization." - } - } - } + ] } } } diff --git a/readme_source.md b/readme_source.md index 3c99033..6fc09c7 100644 --- a/readme_source.md +++ b/readme_source.md @@ -1,3 +1,35 @@ +<h1 align="center" style="border-bottom: none"> + Azure Application Gateway Universal Orchestrator Extension +</h1> + +<p align="center"> + <!-- Badges --> +<img src="https://img.shields.io/badge/integration_status-production-3D1973?style=flat-square" alt="Integration Status: production" /> +<a href="https://github.com/Keyfactor/azure-appgateway-orchestrator/releases"><img src="https://img.shields.io/github/v/release/Keyfactor/azure-appgateway-orchestrator?style=flat-square" alt="Release" /></a> +<img src="https://img.shields.io/github/issues/Keyfactor/azure-appgateway-orchestrator?style=flat-square" alt="Issues" /> +<img src="https://img.shields.io/github/downloads/Keyfactor/azure-appgateway-orchestrator/total?style=flat-square&label=downloads&color=28B905" alt="GitHub Downloads (all assets, all releases)" /> +</p> + +<p align="center"> + <!-- TOC --> + <a href="#support"> + <b>Support</b> + </a> + · + <a href="#installation"> + <b>Installation</b> + </a> + · + <a href="#license"> + <b>License</b> + </a> + · + <a href="https://github.com/orgs/Keyfactor/repositories?q=orchestrator"> + <b>Related Integrations</b> + </a> +</p> + + ## Overview The Azure Application Gateway Orchestrator extension remotely manages certificates used by Azure Application Gateways. The extension supports two different store types - one that generally manages certificates stored in the Application Gateway, and one that manages the bindings of Application Gateway certificates to HTTPS/TLS Listeners. @@ -5,222 +37,243 @@ The Azure Application Gateway Orchestrator extension remotely manages certificat > > If the certificate management capabilities of Azure Key Vault are desired over direct management of certificates in Application Gateways, the Azure Key Vault orchestrator can be used in conjunction with this extension for accurate certificate location reporting via the inventory job type. This management strategy requires manual binding of certificates imported to an Application Gateway from AKV and can result in broken state in the Azure Application Gateway in the case that the secret is deleted in AKV. -### Azure Application Gateway Certificate store type - -The Azure Application Gateway Certificate store type, `AzureAppGw`, manages `ApplicationGatewaySslCertificate` objects owned by Azure Application Gateways. This store type collects inventory and manages all ApplicationGatewaySslCertificate objects associated with an Application Gateway. The store type is implemented primarily for Inventory and Management Remove operations, since the intended usage of ApplicationGatewaySslCertificates in Application Gateways is for serving TLS client traffic via TLS Listeners. Management Add and associated logic for certificate renewal is also supported for this certificate store type for completeness, but the primary intended functionality of this extension is implemented with the App Gateway Certificate Binding store type. - -> If an ApplicationGatewaySslCertificate is bound to a TLS Listener at the time of a Management Remove operation, the operation will fail since at least one certificate must be bound at all times. - -> If a renewal job is scheduled for an `AzureAppGw` certificate store, the extension will report a success and perform no action if the certificate being renewed is bound to a TLS Listener. This is because a certificate located in an `AzureAppGw` certificate store that is bound to a TLS Listener is logically the same as the same certificate located in an `AzureAppGwBin` store type. For this reason, it's expected that the certificate will be renewed and re-bound to the listener by the `AppGwBin` certificate operations. -> -> If the renewed certificate is not bound to a TLS Listener, the operation will be performed the same as any certificate renewal process that honors the Overwrite flag. -### Azure Application Gateway Certificate Binding store type +## Installation +Before installing the Azure Application Gateway Universal Orchestrator extension, it's recommended to install [kfutil](https://github.com/Keyfactor/kfutil). Kfutil is a command-line tool that simplifies the process of creating store types, installing extensions, and instantiating certificate stores in Keyfactor Command. -The Azure Application Gateway Certificate Binding store type, `AzureAppGwBin`, represents certificates bound to TLS Listeners on Azure App Gateways. The only supported operations on this store type are Management Add and Inventory. The Management Add operation for this store type creates and binds an ApplicationGatewaySslCertificate to a pre-existing TLS Listener on an Application Gateway. When the Add operation is configured in Keyfactor Command, the certificate Alias configures which TLS Listener the certificate will be bound to. If the HTTPS listener is already bound to a certificate with the same name, the Management Add operation will perform a replacement of the certificate, _**regardless of the existence of the Replace flag configured with renewal jobs**_. The replacement operation performs several API interactions with Azure since at least one certificate must be bound to a TLS listener at all times, and the name of ApplicationGatewaySslCertificates must be unique. For the sake of completeness, the following describes the mechanics of this replacement operation: - -1. Determine the name of the certificate currently bound to the HTTPS listener - Alias in 100% of cases if the certificate was originally added by the App Gateway Orchestrator Extension, or something else if the certificate was added by some other means (IE, the Azure Portal, or some other API client). -2. Create and bind a temporary certificate to the HTTPS listener with the same name as the Alias. -3. Delete the AppGatewayCertificate previously bound to the HTTPS listener called Alias. -4. Recreate and bind an AppGatewayCertificate with the same name as the HTTPS listener called Alias. If the Alias is called `listener1`, the new certificate will be called `listener1`, regardless of the name of the certificate that was previously bound to the listener. -5. Delete the temporary certificate. +The Azure Application Gateway Universal Orchestrator extension implements 2 Certificate Store Types. Depending on your use case, you may elect to install one, or all of these Certificate Store Types. An overview for each type is linked below: +* [Azure Application Gateway Certificate](docs/azureappgw.md) +* [Azure Application Gateway Certificate Binding](docs/appgwbin.md) -In the unlikely event that a failure occurs at any point in the replacement procedure, it's expected that the correct certificate will be served by the TLS Listener, since most of the mechanics are actually implemented to resolve the unique naming requirement. +<details><summary>Azure Application Gateway Certificate</summary> -The Inventory job type for `AzureAppGwBin` reports only ApplicationGatewaySslCertificates that are bound to TLS Listeners. If the certificate was added with Keyfactor Command and this orchestrator extension, the name of the certificate in the Application Gateway will be the same as the TLS Listener. E.g., if the Alias configured in Command corresponds to a TLS Listener called `location-service-https-lstn1`, the certificate in the Application Gateway will also be called `location-service-https-lstn1`. However, if the certificate was added to the Application Gateway by other means (such as the Azure CLI, import from AKV, etc.), the Inventory job mechanics will still report the name of the TLS Listener in its report back to Command. -### Discovery Job +1. Follow the [requirements section](docs/azureappgw.md#requirements) to configure a Service Account and grant necessary API permissions. -Both `AzureAppGw` and `AzureAppGwBin` support the Discovery operation. The Discovery operation discovers all Azure Application Gateways in each resource group that the service principal has access to. The discovered Application Gateways are reported back to Command and can be easily added as certificate stores from the Locations tab. + <details><summary>Requirements</summary> + + ### Azure Service Principal (Azure Resource Manager Authentication) -The Discovery operation uses the "Directories to search" field, and accepts input in one of the following formats: -- `*` - If the asterisk symbol `*` is used, the extension will search for Application Gateways in every resource group that the service principal has access to, but only in the tenant that the discovery job was configured for as specified by the "Client Machine" field in the certificate store configuration. -- `<tenant-id>,<tenant-id>,...` - If a comma-separated list of tenant IDs is used, the extension will search for Application Gateways in every resource group and tenant specified in the list. The tenant IDs should be the GUIDs associated with each tenant, and it's the user's responsibility to ensure that the service principal has access to the specified tenants. + The Azure Application Gateway Orchestrator extension uses an [Azure Service Principal](https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals?tabs=browser) for authentication. Follow [Microsoft's documentation](https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal) to create a service principal. -### Certificates Imported to Application Gateways from Azure Key Vault + #### Azure Application Gateway permissions -Natively, Azure Application Gateways support integration with Azure Key Vault for secret/certificate management. This integration works by creating a TLS Listener certificate with a reference to a secret in Azure Key Vault (specifically, a URI in the format `https://<vault-name>.vault.azure.net/secrets/<secret-name>`), authenticated using a Managed Identity. If the Application Gateway orchestrator extension is deployed to manage App Gateways with certificates imported from Azure Key Vault, the following truth table represents the possible operations and their result, specifically with respect to AKV. + For quick start and non-production environments, a Role Assignment should be created on _each resource group_ that own Application Gateways desiring management that grants the created Application/Service Principal the [Contributor (Privileged administrator) Role](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#contributor). For production environments, a custom role should be created that grants the following permissions: -| Store Type | Operation | Result | -|--------------|-----------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `AzureAppGw` | Inventory | Certificate is downloaded from Azure Key Vault and reported back to Keyfactor Command. In Keyfactor Command, the certificate will show as being located in the AzureAppGw certificate store [in addition to the AKV, if AKV orchestrator extension is also deployed]. | -| `AzureAppGw` | Add | The Add operation will not create secrets in AKV; it creates ApplicationGatewaySslCertificates.<br/> <br/>If an `AzureAppGw` Add operation is scheduled with the Replace flag, the _**link to the AKV certificate will be broken**_, and a native ApplicationGatewaySslCertificate will be created in its place - The secret in AKV will still exist. | -| `AzureAppGw` | Remove | The ApplicationGatewaySslCertificate is deleted from the Application Gateway, but the secret that the certificate referenced in AKV still exists. | -| `AzureAppGwBin` | Inventory | Certificate is downloaded from Azure Key Vault and reported back to Keyfactor Command. In Keyfactor Command, the certificate will show as present in both an `AzureAppGw` certificate store _and_ an `AppGwBin` certificate store [in addition to the AKV, if AKV orchestrator extension is also deployed]. | -| `AzureAppGwBin` | Add | The Add operation will not create secrets in AKV; it creates ApplicationGatewaySslCertificates. <br/> <br/>If a certificate with the same name as the TLS Listener already exists, it will be _replaced_ by a new ApplicationGatewaySslCertificate. <br/> <br/>If the certificate being replaced was imported from AKV, this binding will be broken and the secret will still exist in AKV. | + - `Microsoft.Resources/subscriptions/resourcegroups/read` - Read : Get Resource Group + - `Microsoft.Network/applicationGateways/read` - Read : Get Application Gateway + - `Microsoft.Network/applicationGateways/write` - Write : Create or Update Application Gateway + - `Microsoft.ManagedIdentity/userAssignedIdentities/assign/action` - Other : RBAC action for assigning an existing user assigned identity to a resource + - `Microsoft.Network/virtualNetworks/subnets/join/action` - Other : Joins a virtual network. Not Alertable. -#### Mechanics of the Azure Key Vault Download Operation for Inventory Jobs that report certificates imported from AKV + > Note that even if the Service Principal has permission to perform the 'Microsoft.Network/applicationGateways/write' action over the scope of the required resource group, there may be other permissions that are required by the CreateOrUpdate operation depending on the complexity of the Application Gateway's configuration. As such, the list of permissions above should not be considered as comprehensive. -If an AzureApplicationSslCertificate references a secret in AKV (was imported to the App Gateway from AKV), the inventory job will create and use a `SecretClient` from the [`Azure.Security.KeyVault.Secrets.SecretClient` dotnet package](https://learn.microsoft.com/en-us/dotnet/api/azure.security.keyvault.secrets.secretclient?view=azure-dotnet). Authentication to AKV via this client is configured using the exact same `TokenCredential` provided by the [Azure Identity client library for .NET](https://learn.microsoft.com/en-us/dotnet/api/overview/azure/identity-readme?view=azure-dotnet). This means that the Service Principal described in the [Azure Configuration](#azure-configuration) section must also have appropriate permissions to read secrets from the AKV that the App Gateway is integrated with. The secret referenced in the AzureApplicationSslCertificate will be accessed exactly as reported by Azure, regardless of whether it exists in AKV. + #### Azure Key Vault permissions -## Azure Configuration and Permissions + If the managed Application Gateway is integrated with Azure Key Vault per the discussion in the [Certificates Imported to Application Gateways from Azure Key Vault](#certificates-imported-to-application-gateways-from-azure-key-vault) section, perform one of the following actions for each Key Vault with certificates imported to App Gateways: + * **Azure role-based access control** - Create a Role Assignment that grants the Application/Service Principal the [Key Vault Secrets User](https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli) built-in role. + * **Vault access policy** - [Create an Access Policy](https://learn.microsoft.com/en-us/azure/key-vault/general/assign-access-policy?tabs=azure-portal) that grants the Application/Service Principal the Get secret permission for each Azure Key Vault. -The Azure Application Gateway Orchestrator extension uses an [Azure Service Principal](https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals?tabs=browser) for authentication. Follow [Microsoft's documentation](https://learn.microsoft.com/en-us/azure/purview/create-service-principal-azure) to create a service principal. + #### Client Certificate or Client Secret -For quick start and non-production environments, a Role Assignment should be created on _each resource group_ that own Application Gateways desiring management that grants the created Application/Service Principal the [Contributor (Privileged administrator) Role](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#contributor). For production environments, a custom role should be created that grants the following permissions: + Beginning in version 3.0.0, the Azure Application Gateway Orchestrator extension supports both [client certificate authentication](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-1-add-a-certificate) and [client secret](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-2-add-a-client-secret) authentication. -- `Microsoft.Resources/subscriptions/resourcegroups/read` - Read : Get Resource Group -- `Microsoft.Network/applicationGateways/read` - Read : Get Application Gateway -- `Microsoft.Network/applicationGateways/write` - Write : Create or Update Application Gateway -- `Microsoft.ManagedIdentity/userAssignedIdentities/assign/action` - Other : RBAC action for assigning an existing user assigned identity to a resource -- `Microsoft.Network/virtualNetworks/subnets/join/action` - Other : Joins a virtual network. Not Alertable. + * **Client Secret** - Follow [Microsoft's documentation](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-2-add-a-client-secret) to create a Client Secret. This secret will be used as the **Server Password** field in the [Certificate Store Configuration](#certificate-store-configuration) section. + * **Client Certificate** - Create a client certificate key pair with the Client Authentication extended key usage. The client certificate will be used in the ClientCertificate field in the [Certificate Store Configuration](#certificate-store-configuration) section. If you have access to Keyfactor Command, the instructions in this section walk you through enrolling a certificate and ensuring that it's in the correct format. Once enrolled, follow [Microsoft's documentation](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-1-add-a-certificate) to add the _public key_ certificate (no private key) to the service principal used for authentication. -> Note that even if the Service Principal has permission to perform the 'Microsoft.Network/applicationGateways/write' action over the scope of the required resource group, there may be other permissions that are required by the CreateOrUpdate operation depending on the complexity of the Application Gateway's configuration. As such, the list of permissions above should not be considered as comprehensive. + The certificate can be in either of the following formats: + * Base64-encoded PKCS#12 (PFX) with a matching private key. + * Base64-encoded PEM-encoded certificate _and_ PEM-encoded PKCS8 private key. Make sure that the certificate and private key are separated with a newline. The order doesn't matter - the extension will determine which is which. -If the managed Application Gateway is integrated with Azure Key Vault per the discussion in the [Certificates Imported to Application Gateways from Azure Key Vault](#certificates-imported-to-application-gateways-from-azure-key-vault) section, an [Access policy must be created](https://learn.microsoft.com/en-us/azure/key-vault/general/assign-access-policy?tabs=azure-portal) that grants the Application/Service Principal the Get secret permission for the associated Azure Key Vault. + If the private key is encrypted, the encryption password will replace the **Server Password** field in the [Certificate Store Configuration](#certificate-store-configuration) section. -## Creating Store Types for the Azure Application Gateway Orchestrator -To get started with the Azure Application Gateway Orchestrator Extension, you'll need to create 2 store types in Keyfactor Command. The recommended and supported way to create store types is using the `kfutil` command line tool. Install [Kfutil](https://github.com/Keyfactor/kfutil) if it is not already installed. Once installed, use `kfutil login` to log into the target Command environment. + > **Creating and Formatting a Client Certificate using Keyfactor Command** + > + > To get started quickly, you can follow the instructions below to create and properly format a client certificate to authenticate to the Microsoft Graph API. + > + > 1. In Keyfactor Command, hover over **Enrollment** and select **PFX Enrollment**. + > 2. Select a **Template** that supports Client Authentication as an extended key usage. + > 3. Populate the certificate subject as appropriate for the Template. It may be sufficient to only populate the Common Name, but consult your IT policy to ensure that this certificate is compliant. + > 4. At the bottom of the page, uncheck the box for **Include Chain**, and select either **PFX** or **PEM** as the certificate Format. + > 5. Make a note of the password on the next page - it won't be shown again. + > 6. Prepare the certificate and private key for Azure and the Orchestrator extension: + > * If you downloaded the certificate in PEM format, use the commands below: + > + > ```shell + > # Verify that the certificate downloaded from Command contains the certificate and private key. They should be in the same file + > cat <your_certificate.pem> + > + > # Separate the certificate from the private key + > openssl x509 -in <your_certificate.pem> -out pubkeycert.pem + > + > # Base64 encode the certificate and private key + > cat <your_certificate.pem> | base64 > clientcertkeypair.pem.base64 + > ``` + > + > * If you downloaded the certificate in PFX format, use the commands below: + > + > ```shell + > # Export the certificate from the PFX file + > openssl pkcs12 -in <your_certificate.pfx> -clcerts -nokeys -out pubkeycert.pem + > + > # Base64 encode the PFX file + > cat <your_certificate.pfx> | base64 > clientcert.pfx.base64 + > ``` + > 7. Follow [Microsoft's documentation](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-1-add-a-certificate) to add the public key certificate to the service principal used for authentication. + > + > You will use `clientcert.[pem|pfx].base64` as the **ClientCertificate** field in the [Certificate Store Configuration](#certificate-store-configuration) section. -Then, use the following commands to create the store types: -```shell -kfutil store-types create AzureAppGw -kfutil store-types create AppGwBin -``` + </details> -It is not required to create all store types. Only create the store types that are needed for the integration. +2. Create Certificate Store Types for the Azure Application Gateway Orchestrator extension. -If you prefer to create store types manually in the UI, navigate to your Command instance and follow the instructions below. -<details><summary>AzureAppGw</summary> + * **Using kfutil**: -Create a store type called `AzureAppGw` with the attributes in the tables below: + ```shell + # Azure Application Gateway Certificate + kfutil store-types create AzureAppGw + ``` -### Basic Tab -| Attribute | Value | Description | -| --------- | ----- | ----- | -| Name | Azure Application Gateway Certificate | Display name for the store type (may be customized) | -| Short Name | AzureAppGw | Short display name for the store type | -| Capability | AzureAppGw | Store type name orchestrator will register with. Check the box to allow entry of value | -| Supported Job Types (check the box for each) | Add, Remove, Discovery, Inventory | Job types the extension supports | -| Needs Server | ✓ | Determines if a target server name is required when creating store | -| Blueprint Allowed | | Determines if store type may be included in an Orchestrator blueprint | -| Uses PowerShell | | Determines if underlying implementation is PowerShell | -| Requires Store Password | | Determines if a store password is required when configuring an individual store. | -| Supports Entry Password | | Determines if an individual entry within a store can have a password. | + * **Manually**: + * [Azure Application Gateway Certificate](docs/azureappgw.md#certificate-store-type-configuration) +3. Install the Azure Application Gateway Universal Orchestrator extension. + + * **Using kfutil**: On the server that that hosts the Universal Orchestrator, run the following command: -The Basic tab should look like this: + ```shell + # Windows Server + kfutil orchestrator extension -e azure-appgateway-orchestrator@latest --out "C:\Program Files\Keyfactor\Keyfactor Orchestrator\extensions" - + # Linux + kfutil orchestrator extension -e azure-appgateway-orchestrator@latest --out "/opt/keyfactor/orchestrator/extensions" + ``` + + * **Manually**: Follow the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/InstallingAgents/NetCoreOrchestrator/CustomExtensions.htm?Highlight=extensions) to install the latest [Azure Application Gateway Universal Orchestrator extension](https://github.com/Keyfactor/azure-appgateway-orchestrator/releases/latest). -### Advanced Tab -| Attribute | Value | Description | -| --------- | ----- | ----- | -| Supports Custom Alias | Required | Determines if an individual entry within a store can have a custom Alias. | -| Private Key Handling | Required | This determines if Keyfactor can send the private key associated with a certificate to the store. Required because IIS certificates without private keys would be invalid. | -| PFX Password Style | Default | 'Default' - PFX password is randomly generated, 'Custom' - PFX password may be specified when the enrollment job is created (Requires the Allow Custom Password application setting to be enabled.) | +4. Create new certificate stores in Keyfactor Command for the Sample Universal Orchestrator extension. + * [Azure Application Gateway Certificate](docs/azureappgw.md#certificate-store-configuration) +</details> +<details><summary>Azure Application Gateway Certificate Binding</summary> -The Advanced tab should look like this: - +1. Follow the [requirements section](docs/appgwbin.md#requirements) to configure a Service Account and grant necessary API permissions. -### Custom Fields Tab -Custom fields operate at the certificate store level and are used to control how the orchestrator connects to the remote target server containing the certificate store to be managed. The following custom fields should be added to the store type: + <details><summary>Requirements</summary> -| Name | Display Name | Type | Default Value/Options | Required | Description | -| ---- | ------------ | ---- | --------------------- | -------- | ----------- | -| ServerUsername | Server Username | Secret | None | ✓ | Application ID of the service principal, representing the identity used for managing the Application Gateway. | -| ServerPassword | Server Password | Secret | None | ✓ | Secret of the service principal that will be used to manage the Application Gateway. | -| ServerUseSsl | Use SSL | Bool | true | | Indicates whether SSL usage is enabled for the connection. | -| AzureCloud | Azure Global Cloud Authority Host | MultipleChoice | public,china,germany,government | | Specifies the Azure Cloud instance used by the organization. | + ### Azure Service Principal (Azure Resource Manager Authentication) + The Azure Application Gateway Orchestrator extension uses an [Azure Service Principal](https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals?tabs=browser) for authentication. Follow [Microsoft's documentation](https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal) to create a service principal. -The Custom Fields tab should look like this: + #### Azure Application Gateway permissions - + For quick start and non-production environments, a Role Assignment should be created on _each resource group_ that own Application Gateways desiring management that grants the created Application/Service Principal the [Contributor (Privileged administrator) Role](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#contributor). For production environments, a custom role should be created that grants the following permissions: -</details> + - `Microsoft.Resources/subscriptions/resourcegroups/read` - Read : Get Resource Group + - `Microsoft.Network/applicationGateways/read` - Read : Get Application Gateway + - `Microsoft.Network/applicationGateways/write` - Write : Create or Update Application Gateway + - `Microsoft.ManagedIdentity/userAssignedIdentities/assign/action` - Other : RBAC action for assigning an existing user assigned identity to a resource + - `Microsoft.Network/virtualNetworks/subnets/join/action` - Other : Joins a virtual network. Not Alertable. -<details><summary>AppGwBin</summary> + > Note that even if the Service Principal has permission to perform the 'Microsoft.Network/applicationGateways/write' action over the scope of the required resource group, there may be other permissions that are required by the CreateOrUpdate operation depending on the complexity of the Application Gateway's configuration. As such, the list of permissions above should not be considered as comprehensive. -Create a store type called `AppGwBin` with the attributes in the tables below: + #### Azure Key Vault permissions -### Basic Tab -| Attribute | Value | Description | -| --------- | ----- | ----- | -| Name | Azure Application Gateway Certificate Binding | Display name for the store type (may be customized) | -| Short Name | AppGwBin | Short display name for the store type | -| Capability | AzureAppGwBin | Store type name orchestrator will register with. Check the box to allow entry of value | -| Supported Job Types (check the box for each) | Add, Discovery | Job types the extension supports | -| Needs Server | ✓ | Determines if a target server name is required when creating store | -| Blueprint Allowed | | Determines if store type may be included in an Orchestrator blueprint | -| Uses PowerShell | | Determines if underlying implementation is PowerShell | -| Requires Store Password | | Determines if a store password is required when configuring an individual store. | -| Supports Entry Password | | Determines if an individual entry within a store can have a password. | + If the managed Application Gateway is integrated with Azure Key Vault per the discussion in the [Certificates Imported to Application Gateways from Azure Key Vault](#certificates-imported-to-application-gateways-from-azure-key-vault) section, perform one of the following actions for each Key Vault with certificates imported to App Gateways: + * **Azure role-based access control** - Create a Role Assignment that grants the Application/Service Principal the [Key Vault Secrets User](https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli) built-in role. + * **Vault access policy** - [Create an Access Policy](https://learn.microsoft.com/en-us/azure/key-vault/general/assign-access-policy?tabs=azure-portal) that grants the Application/Service Principal the Get secret permission for each Azure Key Vault. + #### Client Certificate or Client Secret -The Basic tab should look like this: + Beginning in version 3.0.0, the Azure Application Gateway Orchestrator extension supports both [client certificate authentication](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-1-add-a-certificate) and [client secret](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-2-add-a-client-secret) authentication. - + * **Client Secret** - Follow [Microsoft's documentation](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-2-add-a-client-secret) to create a Client Secret. This secret will be used as the **Server Password** field in the [Certificate Store Configuration](#certificate-store-configuration) section. + * **Client Certificate** - Create a client certificate key pair with the Client Authentication extended key usage. The client certificate will be used in the ClientCertificate field in the [Certificate Store Configuration](#certificate-store-configuration) section. If you have access to Keyfactor Command, the instructions in this section walk you through enrolling a certificate and ensuring that it's in the correct format. Once enrolled, follow [Microsoft's documentation](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-1-add-a-certificate) to add the _public key_ certificate (no private key) to the service principal used for authentication. -### Advanced Tab -| Attribute | Value | Description | -| --------- | ----- | ----- | -| Supports Custom Alias | Required | Determines if an individual entry within a store can have a custom Alias. | -| Private Key Handling | Required | This determines if Keyfactor can send the private key associated with a certificate to the store. Required because IIS certificates without private keys would be invalid. | -| PFX Password Style | Default | 'Default' - PFX password is randomly generated, 'Custom' - PFX password may be specified when the enrollment job is created (Requires the Allow Custom Password application setting to be enabled.) | + The certificate can be in either of the following formats: + * Base64-encoded PKCS#12 (PFX) with a matching private key. + * Base64-encoded PEM-encoded certificate _and_ PEM-encoded PKCS8 private key. Make sure that the certificate and private key are separated with a newline. The order doesn't matter - the extension will determine which is which. + If the private key is encrypted, the encryption password will replace the **Server Password** field in the [Certificate Store Configuration](#certificate-store-configuration) section. -The Advanced tab should look like this: + > **Creating and Formatting a Client Certificate using Keyfactor Command** + > + > To get started quickly, you can follow the instructions below to create and properly format a client certificate to authenticate to the Microsoft Graph API. + > + > 1. In Keyfactor Command, hover over **Enrollment** and select **PFX Enrollment**. + > 2. Select a **Template** that supports Client Authentication as an extended key usage. + > 3. Populate the certificate subject as appropriate for the Template. It may be sufficient to only populate the Common Name, but consult your IT policy to ensure that this certificate is compliant. + > 4. At the bottom of the page, uncheck the box for **Include Chain**, and select either **PFX** or **PEM** as the certificate Format. + > 5. Make a note of the password on the next page - it won't be shown again. + > 6. Prepare the certificate and private key for Azure and the Orchestrator extension: + > * If you downloaded the certificate in PEM format, use the commands below: + > + > ```shell + > # Verify that the certificate downloaded from Command contains the certificate and private key. They should be in the same file + > cat <your_certificate.pem> + > + > # Separate the certificate from the private key + > openssl x509 -in <your_certificate.pem> -out pubkeycert.pem + > + > # Base64 encode the certificate and private key + > cat <your_certificate.pem> | base64 > clientcertkeypair.pem.base64 + > ``` + > + > * If you downloaded the certificate in PFX format, use the commands below: + > + > ```shell + > # Export the certificate from the PFX file + > openssl pkcs12 -in <your_certificate.pfx> -clcerts -nokeys -out pubkeycert.pem + > + > # Base64 encode the PFX file + > cat <your_certificate.pfx> | base64 > clientcert.pfx.base64 + > ``` + > 7. Follow [Microsoft's documentation](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#option-1-add-a-certificate) to add the public key certificate to the service principal used for authentication. + > + > You will use `clientcert.[pem|pfx].base64` as the **ClientCertificate** field in the [Certificate Store Configuration](#certificate-store-configuration) section. - -### Custom Fields Tab -Custom fields operate at the certificate store level and are used to control how the orchestrator connects to the remote target server containing the certificate store to be managed. The following custom fields should be added to the store type: -| Name | Display Name | Type | Default Value/Options | Required | Description | -| ---- | ------------ | ---- | --------------------- | -------- | ----------- | -| ServerUsername | Server Username | Secret | None | | Application ID of the service principal, representing the identity used for managing the Application Gateway. | -| ServerPassword | Server Password | Secret | None | | Secret of the service principal that will be used to manage the Application Gateway. | -| ServerUseSsl | Use SSL | Bool | true | ✓ | Indicates whether SSL usage is enabled for the connection. | -| AzureCloud | Azure Global Cloud Authority Host | MultipleChoice | public,china,germany,government | | Specifies the Azure Cloud instance used by the organization. | + </details> +2. Create Certificate Store Types for the Azure Application Gateway Orchestrator extension. -The Custom Fields tab should look like this: + * **Using kfutil**: - + ```shell + # Azure Application Gateway Certificate Binding + kfutil store-types create AppGwBin + ``` -</details> + * **Manually**: + * [Azure Application Gateway Certificate Binding](docs/appgwbin.md#certificate-store-type-configuration) -## Instantiating New Azure Application Gateway Orchestrator Stores -Once the store types have been created, you can instantiate certificate stores for any of the 2 store types. This section describes how to instantiate a certificate store for each store type. Creating new certificate stores is how certificates in the remote platform are inventoried and managed by the orchestrator. -<details><summary>AzureAppGw</summary> +3. Install the Azure Application Gateway Universal Orchestrator extension. + + * **Using kfutil**: On the server that that hosts the Universal Orchestrator, run the following command: -In Keyfactor Command, navigate to Certificate Stores from the Locations Menu. Click the Add button to create a new Certificate Store using the settings defined below. + ```shell + # Windows Server + kfutil orchestrator extension -e azure-appgateway-orchestrator@latest --out "C:\Program Files\Keyfactor\Keyfactor Orchestrator\extensions" -| Attribute | Description | -| --------- | ----------- | -| Category | Select Azure Application Gateway Certificate or the customized certificate store name from the previous step. | -| Container | Optional container to associate certificate store with. | -| Client Machine | The Azure Tenant ID of the service principal, representing the Tenant ID where the Application/Service Principal is managed. | -| Store Path | Azure resource ID of the application gateway, following the format: `/subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/applicationGateways/<application-gateway-name>`. | -| Orchestrator | Select an approved orchestrator capable of managing AzureAppGw certificates. Specifically, one with the AzureAppGw capability. | -| Server Username | Application ID of the service principal, representing the identity used for managing the Application Gateway. | -| Server Password | Secret of the service principal that will be used to manage the Application Gateway. | -| Use SSL | Indicates whether SSL usage is enabled for the connection. | -| Azure Global Cloud Authority Host | Specifies the Azure Cloud instance used by the organization. | + # Linux + kfutil orchestrator extension -e azure-appgateway-orchestrator@latest --out "/opt/keyfactor/orchestrator/extensions" + ``` + * **Manually**: Follow the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/InstallingAgents/NetCoreOrchestrator/CustomExtensions.htm?Highlight=extensions) to install the latest [Azure Application Gateway Universal Orchestrator extension](https://github.com/Keyfactor/azure-appgateway-orchestrator/releases/latest). +4. Create new certificate stores in Keyfactor Command for the Sample Universal Orchestrator extension. + * [Azure Application Gateway Certificate Binding](docs/appgwbin.md#certificate-store-configuration) </details> -<details><summary>AppGwBin</summary> -In Keyfactor Command, navigate to Certificate Stores from the Locations Menu. Click the Add button to create a new Certificate Store using the settings defined below. +## License -| Attribute | Description | -| --------- | ----------- | -| Category | Select Azure Application Gateway Certificate Binding or the customized certificate store name from the previous step. | -| Container | Optional container to associate certificate store with. | -| Client Machine | The Azure Tenant ID of the service principal, representing the Tenant ID where the Application/Service Principal is managed. | -| Store Path | Azure resource ID of the application gateway, following the format: `/subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/applicationGateways/<application-gateway-name>`. | -| Orchestrator | Select an approved orchestrator capable of managing AppGwBin certificates. Specifically, one with the AzureAppGwBin capability. | -| Server Username | Application ID of the service principal, representing the identity used for managing the Application Gateway. | -| Server Password | Secret of the service principal that will be used to manage the Application Gateway. | -| Use SSL | Indicates whether SSL usage is enabled for the connection. | -| Azure Global Cloud Authority Host | Specifies the Azure Cloud instance used by the organization. | +Apache License 2.0, see [LICENSE](LICENSE). +## Related Integrations -</details> +See all [Keyfactor Universal Orchestrator extensions](https://github.com/orgs/Keyfactor/repositories?q=orchestrator). \ No newline at end of file