From 2b3acaed6a22b6104792eaf7e2f985e3c58adf5c Mon Sep 17 00:00:00 2001 From: JD Date: Wed, 17 Jul 2024 17:15:08 -0600 Subject: [PATCH] Article: Fleet 4.54.0 release (#20538) --- articles/fleet-4.54.0.md | 138 ++++++++++++++++++ .../articles/fleet-4.54.0-1600x900@2x.png | Bin 0 -> 52108 bytes 2 files changed, 138 insertions(+) create mode 100644 articles/fleet-4.54.0.md create mode 100644 website/assets/images/articles/fleet-4.54.0-1600x900@2x.png diff --git a/articles/fleet-4.54.0.md b/articles/fleet-4.54.0.md new file mode 100644 index 0000000000..dc5cdfaaaf --- /dev/null +++ b/articles/fleet-4.54.0.md @@ -0,0 +1,138 @@ +# Fleet 4.54.0 | Target hosts via label exclusion, arm64 support, script execution time. + +![Fleet 4.54.0](../website/assets/images/articles/fleet-4.54.0-1600x900@2x.png) + +Fleet 4.54.0 is live. Check out the full [changelog](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.54.0) or continue reading to get the highlights. +For upgrade instructions, see our [upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in the Fleet docs. + +## Highlights + +* Target hosts via label exclusion +* Arm64 support +* Remote script execution time + + + +### Target hosts via label exclusion + +Fleet has enhanced its targeting capabilities by adding support for excluding specific labels when managing and deploying configuration profiles to hosts. This feature allows administrators to precisely control which devices are affected by particular settings or policies by excluding hosts that match specified labels. For instance, if an organization has a group of conference room computers that should not receive a particular configuration, administrators can now easily exclude these devices by applying the relevant label exclusions. This added granularity ensures more accurate and tailored management of devices, reducing the risk of unintended changes and enhancing overall operational efficiency. By allowing the exclusion of any label when targeting hosts, Fleet demonstrates its commitment to providing flexible, user-centric solutions that cater to the nuanced needs of modern IT environments. + +### Arm64 support + +Fleet now includes support for Linux hosts running on the arm64 architecture. This update enables organizations to seamlessly integrate a broader range of devices into their Fleet management system, ensuring comprehensive oversight and control across diverse hardware environments. By supporting arm64 Linux hosts, Fleet caters to the growing use of ARM-based systems in various sectors, allowing IT administrators to manage these devices with the same level of detail and efficiency as traditional x86-based hosts. This aligns with Fleet's commitment to providing versatile and inclusive device management solutions, empowering users to maintain a unified and efficient IT infrastructure. + + +### Remote script execution time + +Fleet has increased the timeout limit for remote script execution, significantly enhancing its capabilities for deploying software updates and managing complex workflows. This extension allows administrators to run longer, more intricate scripts without interruption, facilitating tasks such as deploying software updates through tools like Homebrew, Installomator, and Chocolatey. Additionally, this update supports extensive log gathering operations and workflows that involve moving data in either direction, making it ideal for comprehensive maintenance and configuration activities. By extending the timeout limit, Fleet ensures that IT teams can execute more demanding tasks efficiently, improving overall operational effectiveness and flexibility. This enhancement reflects Fleet's commitment to providing robust and adaptable solutions that meet the evolving needs of modern IT environments. + + +## Changes + +### Endpoint Operations + +- Updated `fleetctl gitops` to be used to rename teams. + - **NOTE:** `fleetctl gitops` needs to have previously run with this Fleet/fleetctl version or later. + - The team name is changed if the YAML config is applied from the same filename as before. +- Updated `fleetctl query --hosts` to work with hostnames, host UUIDs, and/or hardware serial numbers. +- Added a host's upcoming scheduled maintenance window, if any, on the host details page of the UI and in host responses from the API. +- Added support to `fleetctl debug connection` to test TLS connection with the embedded certs.pem in + the fleetctl executable. +- Added host's display name to calendar event descriptions. +- Added .yml and .yaml file type validation and error message to `fleetctl apply`. +- Added a tooltip to truncated text and not to untruncated values. + +### Device Management (MDM) + +- Added iOS/iPadOS builtin manual labels. + - **NOTE:** Before migrating to this version, make sure to delete any labels with name "iOS" or "iPadOS". +- Added aggregation of iOS/iPadOS OS versions. +- Added change to custom profiles for iOS/iPadOS to go from 'pending' straight to 'verified' (skip 'verifying'). +- Added support for renewing SCEP certificates with custom enrollment profiles. +- Added automatic install of `fleetd` when a host turns on MDM now uses the latest released `fleetd` version. +- Added support for `END_USER_EMAIL` and `FLEET_DESKTOP` parameters to Windows MSI install package. +- Added API changes to support the `labels_include_all` and `labels_exclude_any` fields (and accept the deprecated `labels` field as an alias for `labels_include_all`). +- Added `fleetctl gitops` and `fleetctl apply` support for `labels_include_all` and `labels_exclude_any` to configure a custom setting. +- Added UI for uploading custom profiles with a target of hosts that include all/exclude any selected labels. +- Added the database migrations to create the new `exclude` column for labels associated with MDM profiles (and declarations). +- Updated host script timeouts to be configurable via agent options using `script_execution_timeout`. +- `fleetctl` now uses a polling mechanism when running `run-script` to accommodate longer script timeout values. +- Updated the profile reconciliation logic to handle the new "exclude any" labels. +- Updated so that the `fleetd` cleanup script for macOS that will return completed when run from Fleet. +- Updated so that the `fleetd` uninstall script will return completed when run from Fleet. +- Updated script run permissions -- only admins and maintainers can run arbitrary or saved scripts (not observer or observer+). +- Updated `fleetctl get mdm_commands` to return 20 rows and support `--host` `--type` filters to improve response time. +- Updated the instructions for manual MDM enrollment on the "My device" page to be clearer and align with Apple updates. +- Updated UI to allow device users to reinstall self-service software. +- Updated API to not return a 500 status code if a host sends a command response with an invalid command uuid. +- Increased the timeout of the upload software installer endpoint to 4 minutes. +- Disabled credential caching and reboot on Windows lock. + +### Vulnerability Management + +- Added "Vulnerable" filter to the host details software table. +- Fixed Microsoft Office June 2024 false negative vulnerabilities and added custom vulnerability matching. +- Fixed issue where some Windows applications were getting matched against Windows OS vulnerabilities. + +### Bug fixes and improvements + +- Updated Go version to go1.22.4. +- Updated to render only one banner on the my device page based on priority order. +- Updated software updated timestamp tooltip. +- Removed DB error message from the UI when showing a error response. +- Updated fleetctl get queries/labels/hosts descriptions. +- Reinstated ability to sort policies by passing count. +- Improved the accuracy of the heuristic used to deterimine if a host is connected to Fleet via MDM by using osquery data for hosts that didn't send a Checkout message. +- Improved the matching of `pkg` installer files to existing software. +- Improved extraction of application name from `pkg` installers. +- Clarified various help and error texts around host identifiers. +- Hid CTA on inherited queries/policies from team level users. +- Hid query delete checkboxes from team observers. +- Hid "Self-service" in Fleet Desktop and My device page if there is no self-service software available. +- Hid the host detail page's "Run script" action from Global and Team Observer/+s. +- Aligned the "View all hosts" links in the Software titles and versions tables. +- Fixed counts for hosts with with low disk space in summary page. +- Fixed allowing Observer and Observer+ roles to download software installers. +- Fixed crash in `fleetd` installer on Windows if there are registry keys with special characters on the system. +- Fixed `fleetctl debug connection` to support server TLS certificates with intermediates. +- Fixed macOS declarations being stuck in "to be removed" state indefinitely. +- Fixed link to `fleetd` uninstall instructions in "Delete device" modal. +- Fixed exporting CSVs with fields that contain commas to render properly. +- Fixed issue where the Fleet UI could not be used to renew the ABM token after the ABM user who created the token was deleted. +- Fixed styling issues with the target inputs loading spinner on the run live query/policy page. +- Fixed an issue where special characters in HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall breaks the "installer_utils.ps1 -uninstallOrbit" step in the Windows MSI installer. +- Fixed a bug causing "No Team" OS versions to display the wrong number. +- Fixed various UI capitalizations. +- Fixed UI issue where "Script is already running" tooltip incorrectly displayed when the script is not running. +- Fixed the script details modal's error message on script timeout to reflect the newly dynamic script timeout limit, if hit. +- Fixed a discrepancy in the spacing between DataSet labels and values on Firefox relative to other browsers. +- Fixed bug that set `Added to Fleet` to `Never` after macOS hosts re-enrolled to Fleet via MDM. + +## Fleet 4.53.1 (Jul 01, 2024) + +### Bug fixes + +* Updated fleetctl get queries/labels/hosts descriptions. +* Fixed exporting CSVs with fields that contain commas to render properly. +* Fixed link to fleetd uninstall instructions in "Delete device" modal. +* Rendered only one banner on the my device page based on priority order. +* Hidden query delete checkboxes from team observers. +* Fixed issue where the Fleet UI could not be used to renew the ABM token after the ABM user who created the token was deleted. +* Fixed an issue where special characters in HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall broke the "installer_utils.ps1 -uninstallOrbit" step in the Windows MSI installer. +* Fixed counts for hosts with low disk space in summary page. +* Fleet UI fixes: Hide CTA on inherited queries/policies from team level users. +* Updated software updated timestamp tooltip. +* Fixed issue where some Windows applications were getting matched against Windows OS vulnerabilities. +* Fixed crash in `fleetd` installer on Windows if there are registry keys with special characters on the system. +* Fixed UI capitalizations. + +## Ready to upgrade? + +Visit our [Upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in the Fleet docs for instructions on updating to Fleet 4.54.0. + + + + + + + diff --git a/website/assets/images/articles/fleet-4.54.0-1600x900@2x.png b/website/assets/images/articles/fleet-4.54.0-1600x900@2x.png new file mode 100644 index 0000000000000000000000000000000000000000..548ffc70839de96c282d20195235e1eb565a7f27 GIT binary patch literal 52108 zcmeFZcRZDE{6Bu%GC~R2QC35?GR~2Vl29q5D6&_QJjF5Ys9657CtyCl|q&L=HDpE>{H-|)J#EL0fKTc z)H@HzAgJlYmCFjZT!>}|6o?>t2olL(3{%Em?kcYDF?NXChNu2}>015$2tI`Hq5peZ zbBO!DxAw%8|G7oJgNXlgOV5w~&mHvd(S2$B6VriN{4pAI0~`34B=;rp&m{ht1oSUS?i<0sBzfQs|4ibaN&HKa`!?_|NgjlSepAI z18?}3B=;rp&m{gYOd_tL?B(~2Pb;#!8~R6Na=wVv@kxi!k8->ddJ*0nUi9ELjrc7i zWueH&B1ZQ!w7b(~qUM>-R!luf=^i?hF&CIG<5@DPdj3YiO^Lg+xkCPtS>#_jw5!iO zP@NnPdggNJXU+9b95OHF9zN!*Q+z6|sk*$=>MGAQHOao!*qS5kk+iZ#w@*Fy1)~48 z_3)S&Y-{|z(Bq`se{aBtZ-V_G|4`;XT>Y<-_*b<3Cno$WQ~wp_ z{|{RcdL$4Oukd6wHmGH$HC9F?-_Vh-|6+?A<5@XC*q&PN{h4S@u!Ub7`mt6dB(~rXm?%7-uRCD zs^gj9%JtfUY-Yn~sS9Gvuk##4L_LL+KU}XJnd;0j^T7V>H3MW2F7yh4**DsxT%OS_ zb<5Fz63iy8^PS!WVJxl990DtQ*o`NG+he>#)RHOX-Fj{OPusBs&P(_#P|0~|zxI1> zb)q3OMwt52x%WJq0!EktZ0T5VcmYVUOp33`VNY82LVF^DwOYhUKVMccj@dLL9U zId((fwnA`usoapql#)n;Qf^L)7^hwtPtV44v~s8%@E6|>x0%pa z1(@V}h7fE`e&^Izb3%AXk9%eP{@KpHW7!|EaT));sLrv<{!ae6DgUP5<2mg=HfC=w z{V8PjF;vf4&oSxlw#U;@M8e|cxc>ijKp8^PEf*v>u4y&=7a!iT*6m&_bgg*pGJ*kvFyxIB+vv% zgxul8+g@Y8$P#32tYPM1+!>VfQ36#X4vbD?_Tod@gYql2JiKL|4KEGoeKj*F$5yr5 z9odgn(LGbSJXi24Cr+w9Z7hiSX?}roO}5Qeh0dDrLQt-`+=iT?ds9ro%-FV*60e)f zT!71y>S>*>pX?@|Qj;%u;igX;>FQhU%r@vBs6ta476f-i*357)B0N)I82wYV9^sL{>X$K{$Rk$mBW7eRO|UE)Ms=1b9O12G*LDLvBV?zN23T{dh&;PcXmIu6{O zI=q*|nd@;PPVljB__~FG^{krdkFecJjMVWkDKVU!AJjY(Azu5#svCn0*c^*Pjht?` zcSMEhGCYOdHI!o@k%4ikKIOK-F_S_Md;Oi4L#Id0RO*c%o1WX76@t<)!-aa11Q#mb z>DE}))&`9>f;bX`2!FD1`Ph>zoj!U7)nlU=S0z$l?wv;tvbE*~0M1L;>Y{1Nh71=F=$E4El%-=v;)MXOUM37z)2-M7xwavQacGV=lHu0RjPC`ZFv z?NM35n;mVAe`SA+Ku^q?;oG3~q3PY;-NIo1X#C){vrp0jctR%c6^W!tYo}_v6?C5y5dbU$O z=X8&>tL;+&g+&q+J@(o#`i1h%GqH>#YPy+~ z+m(8Z?WzH_uVMOcM^j`4(8|StFMgObO;;W~Dj){8z(c-%jxkH9s5w!i(%r*g-?`AL zeEir9SFd%c1Z#U637rbiPMA8Xe$>VMk&<|VUr$!5r`G}hxku38qvM@3_Zih#g3|3e zBPWjw8SaR#_W31h9n0V+asGMCByX!fwx3lw(d`K?{qNeR;k7lLdxtLchRkqPS7?WDM~gY<;=*Mz}Fql0$9db3^=F=X)=R z>6@7CPS0287KR_JBEYuyh*eP-uUj#D0Lup(i(M8|lNSkoYMDAjQ|A`5wSh@DFx6D>?F}T}#n7Pk}bMnxTJzfZ&n{a8$6C$B)BfZRB zTb$HHC4WWS4;}rAUmP)~$rH{l$xSWju(P>c^l=6W(_Ul$DRc(|8hmu@EV=?M8#MW~ zTps8s&k(3k>_H4=P#T42viN_LJi~nPT`Py@or4!MkdcG{Svm;<+FXUJqMzGz*@Xqq zDFZQIqvpwR9)+$F!2zP8R|`^!KkJOoi2ZK;o9e4k`CmIQW`7@3@znm;s@?R;;@ zBuwHS$CvHQDNBrr&DjHCYcdg7I#-(2di=t}5Q$*j+`BsCh$fK z;X*Idqrr!WdnyZ&zrObO^TwPSZ1V9np+WXM(JL+v0kGtMv-K<2>K>~HdVR=)nmcpO z$eY^2Mnh+AZ!%!Z$6?l?VoJS;aq5TR=PVB~^$b@E9Q@pP3FhT9MeeTF^(H+s?t|~O zPrzdSMe_Z+1_*0=mnMQRRcdNzTIZLqd}eNc3aO9iyFUQF zQYg9BLWSIa`hc&&sk9HjzJ9>`DN_N+3ourW@Jl(1zT42Snzla_5}@7_mpT^%+9M?L z=+=CD&HIu25BTeYl_iP&sH0_V{ztTQ1g~J`389Xbrk`pC1XD-5h#7J_xLk!EpK#~j zxqhJ4-vp+njaDTvywrlDZ^Nj$?Ko+eB;_Po`(|U_9%d?>IJ-fyPlN!S-CZC8M-lta z#0{6~UJpfoQ`}-Ymn+btb)B<`89nQ2CB$bo;l08ZSr~F4i7-E455#D<23BBZjvOYV zZI8}A`GpIf8#tyr=h@Uc>!JKXqdwMte9fm^jL5k4C-g;EQ|{%s>Wg=NC~ zTp+)>41naD8f{3495NH10+B|l2q*4R^i7ds44|}zbV?4G3upHS<2nc84|`FR2|?)6 zYGxT%a=$$Ok&oL|J0Tq64|In$<`2&m8ygHN*@ie&3ln6LhRX@nb#97zPj2$!ZZA$-g$J4@CtIs~yj4YR=|YSwUV$Knjz8yfS$ zW9@g4A5jPVnD7zO?~jUtQ>H0V2@G!>iGKfDL2(@Qd!EQ}Y)K`u2l3|^HMjl-<}z=; zyyOGifq@E0z_uK6DaSj<-D*rOfw76-L?6FtQih+POKg9~&KA_GR=g{+@Zz4I(PO7` ztly1=7Y=rg(V~PZ#G-t6tcPWwPZ}d=ry~422tif9J|E!Iia*KvZJodJsEH&%mWIQH z{H))AXh1b{^DmdCFqhnK=7z0;`qDm_lgi)|l9`@{4QAn&s^5Y_Dd_%io<{9MGWnVH z_7^`&Q72iyQ1jMXW$^#yo3LMWL(tnlqOzM+yU5+jD$x4$2DV<<{rA#B&9|KP)LdQ} zgW%pcPoebD0hz;fLrZC?xj>}_t%vp}(Ig{K5z`*?eW~B@7JslyHcq3cW%or+ zs)KpR>+GhX3Me+2FqCJ|URkqow+g*{Eaq*@%k1(^XL}dy-zw>rf|}Vz5Q-hl{f&Ki z#VLD8?1^Oh!yRPKqYftRCvHZv*ENDwK%&t)rL?ouu~DhLZLKYKL55kFU7pi<)ww>m zaQgC)$PcOM-xRA0Btp_JbFVC^EJdcL zTQW3w?Btl0M_GyQGlv`_0FyNBQ^cTnI%TkHmnq_qP`XrKzD1d|{rro$?dgU7E4(#a zE9pm``XlzALJJWzJ9UhqVfNPLh3AizxwqqNU)-r0)|>i`*%0ChX}>2kn*PPHy?=5UW-()>3nzxmR+g z(P;a}We?ARA!%7pp@SvTufmxntS+r6%4j_Kj~>+F=s7PDGR3RDl!xzP;vI-e3_Zr6 z#BhsofPc`6oHws;D$Qk$Vi>W3+jSJr?KEqtYYh(UWs;D*+kO0Hlmq@SzOTh+DFx*o z&y;MZ$lO2{+pzwWPba`Gw%A0`2bJU+AVe&XVV8TzV)NH zbJ=h^A+_jep2LzEuy`Q018(t^md1>Qm=tdR^su^HVtW2uGLW=%uCaUhR>#Y)7>tFYhS^#2KG{c8V=?S|`W*~v;Tv5%p(}!y!1A3U_LKKP*nIg-imq<6WCnQXm*06G zG7_1*R||xL*|NVETEEEp5# zUsT6$)l1>0LJVzg22_zW?rdCN+W3+ov!BVC35Bh>xe|Lv|I+%}?5&#SL!m0icOFwd zUjAVoVrW<|bE2W4D-G@Y#PMv<>C*7p(r8=%HzYWbM|0iwwa1!TVuoFbav8p2M7I$L z&r@C-8=SPzud%I8{En*Zr{A#x8CwYX;dK*; zjmUnjy9Wz1$L&pvNz&QgY~+&HkvaG!g3$AU&~!Flb7N1>ZqzhB{aXW`BfugE;xd=t z5eOcIIfbv{a@ay3=&mM%r|j}?3STbx4qTcl1ZWDi%)rFQ$*!w@WS^wo`wfb(+|P!OYi<#0ZukeCLlYFLd!41XcZ+J!<^*31{*2U(=C;^tiz->*D=6CwWX z1*wP#St5-xz0z|jTKVN>RFDkM*Jkqd*@|_&xK_tZtA(d$^UN~WhN)i-JA3X)2tCR` za2^4)#ZCVDHxY&hU>7NJ2n|!u_?g)*mJR*{E~Ne5m*OQQcMO>l2d=~1!dHATDH8rS zN{7lT2|D;z)0&tY{#M<3m)79`Q0HyE=|>5Eqd6xk#9fqG6z?{Avdt@V%nM4#~ak`R`a0!;wqx{+3TSPqz)rK}m`t#>uQkrJ53YEutz?sh)fNC+2}=M5E>NPuM_);cu4mG7KZYkgW#_w` zN#(JxzjC))W0eXsb+&zU3cMW8f9elrJu;zg{^AfnC+AHKnS_ZM5`4{{~@Tk^14EZ5~82A$&Is2a)C;K zcLAi^r_U^cVc~+d~AiQl9`SAMNDYdHq)0^3u3ERnj#s z{L^Bb;qJNHnT8yzmU5$?Hk&Ch0jEC%1(sj2;hwl|{_PUCGkzc(UB12fo0$w&0k|~f z{lG`$(JPr;hUMebB{Zm8?1<6g;;96-yz`V5nOwuzY#aF7By?jr9mi2>VHpuv-640< zwv79`z8wUQFbr(UZH&)3h(5#IfRm$5n{n1R8?@s7=K$q4ob zTLu$1I@A|ETyXw+#gAgV{inu%%ub@76ht&lOTiucP9>=ti~3z<@#xjqn`{khbROp< zovK(&L>Ih`9}i-45P~025WG{>c_-&-(ZgSj{3&Q?Lm5pyeZSfUhHCfW)}EpvjoO++#zwnqf1PgqBn13#T+gyql_+3L zMcnSCvfBbI8(qrrNcAdzQJwQE#c$X2c@rXW>aDFIU%3r;dcPC7J_0_XnTu^?&RN8ag9Jka@9`T z&r9IJb!%clJ<4%0F4^=)Bbb1yNY}d`2X@@fpiIq>yw_wh?v7x()|WOmWZ(KC#69SBRznwL`IUTNv3~~MsjG~nkkjMTpy@W$BQ}p7kAhZ_&Nvk z^>%lj?s8w!=O(|D9b554#+_oL{sw_WS7!F3n!=qQnDU4oc27&_Zu0sf4`|pWIDAP+ zKcaCOL`BB>B1yxQZxWrDfF9n)t=7i06pr>hT3Qx!rNgM^($&(*`615zXOWJCIQ3j@ zjw|g@;zwX*9Z!hfcJ10P*#-HF>YvXmpE$GTU{Ieg5Y@GL;x7=OxDFeId9i2_>ee;X z28Gd&k?I89q;*WL+KIO-eB!Mli5Jw_5qtrc|3Z$#u>|+mG_k|~=p^t)GRI|C0+>TT z?dZQK`$0X1T}gD|gG?U%LB@OZYmd0A-oo^J`^wN;g`W@>4CW4yNOSwRk_MA+{x^?Z|oh{#K#u z+bWhgok!dI=^KLBW#M!h|DfgKTotKZ#D;QMn(=dGU|l{%cRw=t5{cS-*s~&UY$leu zyB{n^p+S(vTT}D0)S}K{ToA1Oh75;#tFj;ZGYo#UU7gR#yZS*4Nu<27U5|Tt@xZmD z#R+OxObV$^(mLv0#OCCp_ReWGE%eTu_u=g)^Q2!`EHermT>@=oP6TlO4e*fPp7be4 zFt{cwv8$G)Zy$A(c{@kBbc_%ch+BMp```Q~v$w`IRtfnZ1o9dZ)A|wXr^$?OAjvIF zMmKY`NdG6}I9*Ete9?yXhA485I}Try*4?h(OoggSaXAC(&OVyymho;!$5A7}diW_25a%g}~iIy^hP#JkK4 z9d~_(y0o4=CqT>H)gnk{4!I^d=pKl-z}O9d&D1j4Lj7@d&W-j|UNUy9D7N7QQ9;LT zG}Ms$`}Bc4Q#lCQn_vE68!A;j^rq^0SUc;v_;Y;MS&n|UomzgAlVzp&cV1pNI)*4# zALe2bkI*6(?P_S~8EK!5y<5SzKL*`@gaGFnLfaFs`e)R+#%^K5!TJ4TnY;c+z5jE@Y1?fp8ShFPl#P4a-BLpwo~-NZq*lF( zn0|qq&Hmz00Y6M&*WkM0A*offu^#nMsTs*C&RN3p056mRBu%tlHK}h^<`IXt;rBj5t><@ z5b2o7OyC<(f_};kQz2d>Cj3YER|xZf;Xr5;c}O?$VNbn{#w@g+xs}X`sJ`&|9Z#?Q zHINK@`pvPQsk=WM+qe3%A+fua8a=DAkzw}(vB*cuz0czL^LzfSle13or7}~m>f*Bb zny?}D`rMT{fi6|6nZ^Bq&<|#UW>0|GtgTTtDvQ@$Y0*jHFMqd|vzB)nYuM1G`U27q zba3BrZ{i=j{V>QC_AXL;|F)bQ`O2hqmS)JJ1a~PYAJnDP$){ zqcvpNft>`Jz9&m6!WnOg{VlVhX@$M0o?C>r{)sj6Sb1TmB-T!x@VD!X#u6Oj@%!ep z+*4+DAJ#DeqD5!`fF=LpX{hTB9DPHm(}>35rAz>%=R{4*vWFYR{B{}%7aioG0}Yl)lQT;7-uN^svv z8U9Aht<;8_W)pF?Uy9bh(O|Nx82xt{R)RDdV(jFXGGpgP1k!`_4FiQy3#YYCHpTTF zU*U2S3=r}~oZDI!&iizb$suuX0{d!$+@bx*06t$t7V4J+sJG^{#GQo)kHA1sOI&c( z{x`zbA7*ND7(|`_?VTa|c-#otQu7DH%UZX-a>2?_v+4+m_#ocb~R0Cmc$m0mv-j8S=(T{lYG0ZRy9&S}UuAMdG&z#!%A3M!ac5(Xx39v!xAVoWHNfxEm(B z$hwbdP=6RJbKQAkJ=R9wdTJiGwz}qUPxv85le|Dj<;tDj=d<>MSSc>|%9frt1$)+< zyyvK}wIslSV=02UIcQ9Uo!K?~s}LZ`u0|?u^LAJt2nv{P;c_Nw{9+B9A9)rkckJ{> z9q6hUAx&|MUml~IB7I2gvsLNk@AXoC-4uGP_cipX{AIVg`duEcMOjaJYP*SdU4N}g zgt^&&y}9QGm19ytr)2s@4(E({tEP4@c1XfxZ{rwQLJ+As2&h&5tvj8DHT6RqDk7lV z^Ow~F_3zK!Y!ovboOwz?1h3jgl#WJCsnpi*wuZKY;yYAoO0MPJjuDKZA*7fZ$#iE+ z6nkQ42=S1eyym`>rO+y-x{H4$1uZD+`1 zp7gtx0cFP@;uvBUeU-4S)$K>&)l**&C`T+jqaW~XfN$@PkZ+A=O_F&2) zY`?`SCf*ax3tiqx z2#T3qpO#*@;}_n_?~*K0RLNyLPzagJp7RIJ`KWb0Gj?L0r9Yx8e<|gqVW2+O@Xt1G z|6df)_w*y1(%Fe}?n9HNn5VD23iH3mc87Y#kpGA{Yj_;9+ayXd+jUt_rfNXsY=6r2 z7H=-4duqC;HCtQX7Cvl6swUg-^|{PB330qrEr`t`8dTGuQQ$ZFQN&DH4vy-a_$g2r-ec2qt;@dz1T1!-;z++ER?pJ$NThc1VGA9_kZ zvxh&TUcx~}lSMEjv~Wxx)AW_Qa~St@HYXg;wr3W#whY*#uF{V?&{Z%_TxSWlnM>i& z>O8MX<>oP_qCb|?En@_S{q?XSh!T0@kY{sjpVp+Qw~s{W+%p!r3|=b=k@D-PXYyE6 zIYQ7tIuP1gRA$B-FPB`L?M^p*s`fKE5ppH5t{yJt3IV`QPDhvlP-8UK6QtWV27rYn zmIW!8lryQKpLaIWt-tN9%W~Q1$JqKpUW)pf*F)NCae1~YGdb9Zs(=&&m$RJrDtJpl zYX&kWw~(%wRp+9xTo_p+D;i{Oy8W>^_NJ|c+`a9orrh&y)^2g^i(#37yanfk z+Di~y1Y8u>Ar|e$ARfUuPrnGo3*3;n_MH1;E%wm>_2$dkvEd3S)7DwasOYsWot~qF!QzBU z2;_fABsEqT40~YeZy)N|q`v(uGN>X~R-2H;#6LG(-^5k3zFEw+B#vKDMEf0K|p?zQ! z61#KsBY`#aQ$i~O@JM2TtZ?`?Z2F!!N(JCM!y+{ny;jWCmn}PNS&ghnbIvKT^BiS; zVxCNd2a%cki?Mr)r|$lUK6`|`JNiy?#eL9?VXr5@y6pveq4|^IB_C<0vfT$lNHYjb z#XIexbLjBbSfAx2o@wf(&Z1k6c82B z)u(hm)3t9{sc(GZFDTXIdUO6wq5mjA^RXPm`gXB1n*_=}pV+GnAZZ9@S+;Qeuut=; z5Mu7rmG0Tba_Ejq&ufa81)D*<@%6}`A*}KF%h5etoq8$xn9(ln9kSn{!R`~UWQ^9E zgX0TtycLp|N>b)%R45|^XNW!O%bx$mb#Tm7xvbn(r$5yVN@ZZ4Lt|CH3b(x#JNqx5 z`D1`%$mBW|PRyOC5<@RF^u+9mv)vxLioeK;BrJ^$(W3&B_##vlXE0|=s!JYG3enPk z<$~#x_^hKr7^EpjC|w{l?k%eNUF=*sI^fFDIx13*q{d1$Ovo)_g_gbelX_rR2B1-9 zA$Y&4qsiXL}9o?z9UJ|P-y1L6-kil@k`uALpv#7 zxoC>Z7RuXQ$>Cwhse@6=zh&$gcjIkuKo8eH1`DKbNj1M%X|1LYF!z0(7-b%e zwTSUU6bknao(V#W?mGn4!cMSL^|bh{&?xF$BH-6l=3#24j+CneTh_d~zw-O!FWXyE z#rm>A5#C1~5V%lt(>L7I;(FM-aeq0FB)}@L!%#SBC1s{K6GCyv!2ZEaDdwa_zqQK- z9!q~pe9gNF^P(;HY4nu~gG@xE3FJ~uzKZ1N z`+RX+9fYBeSH^xGj|(t;AQyUPB2MP4RkyB7tB<`vPv$U;L;_`Du+k~@4(?)nk9VJ0 zCrn{ZzR$`?QrTBSE1ej2HFegN?6{*VwxwdrEpF*SyW}GU$2iIvue&8V^qugf4L@fX zY2%tZX~kayoB-hNG5elv#NM7|*S=3_N;@DtBOgo)IXc^6CQ2o1rc-(zR+rwB8wk%F zaO0G!3!k^?vs#z96*GSok?ZJEm^=Zyy^Y+q$LO=1_KQY3OpnahWqRrIPiGgO=fp)M zm#|$Nj$XSJlYc$d!_ua8j5-HkF>4OFNKW@2Ej_dDtJ@cCDrTl@VjUeluCXI}qNWus zySGNaI~eyQ_wMZiFh&vp$5qAa@}lnSJAaI8+4P;)t+Q*hCJYb7Z!Sxol(ye_3r7ue zQ+~_^M0|Tz`A))HfF)c~#Gh4Ku0^?s4+^4i)VhnmkmQ{kyLlaj=hjj6IPp)h&wB@2 zqkiV8Pi?tfTXeE8uQ0CTr^8Cqh|gHyJFu?HX%gUlj7CL0HFq_IS2zh>otxVcQKDe} zuR1_Udsd^`d z7osmQQQMXYFW0%bm0d+ov%QoV(~nVOJJR3huAXch*3;!GH)GMS`&zB)L&p|Ym8#g$ zX0Megz(Z(XJi1YA{G-pTX7TvV(R*g^G_`*i8xA?vz34Nh3c6K}^)WLZkc#t^;wj7zL6uS_)eGCP{;KmPVH_zVp=CFmZe1#JB-3a4#f`>u6gv7viN zQn6K5LeFa=kY#s7kb(m{sX^s)i}=Kw^9?<*w2*nZnyFLGtnP2xBLFFh$H#&soIH|x zg#5}Jb6V}MehtHL3Dz)mRz3W_(I^?{Xbj{*+Ikvk_KCW;zH(b|c*?B> zxZWhMAzrZ;4lct!gzQxNg5gChJuQ-O>{2{M^LSi)0dr>_o5f8DiEFYxs$8FLN(dD4 znRd0>mZoWx%{>8t#4>)y=F6ykY1S2_7ZkK41v06H3s-aGm0e|1b^Gbj>r4!>utYS^ z`hy+EL>jpB-dr}7C6L(Ih8-SWL7u_(f7ex0($WTMVNC;PF@!EHP?#d8tOXcTYW7C0C!ZTrj#ub6iwbFIZY$&#f{`Rs(aTiJ=x(cDU`Q zQ$=Nk*#J|Sla2ez*7}c}72jAJW9zK-oW{_`y9cZ_{aXgp*VeCM^^31(T(Z+LgFN2TAHInyq-gnlLur#lrnd7pE z8*=H4vBxL0aOcLiC&o05HaQRJG~CzbCDDeiP`R_aua2`^7|oYnPyN;|x>~~`T5PXw z2>A(lJ~xRo#*uaxTHiY=V=%}PZD0^drfA^NS7in$v?O#38!E>B;0PMFLRM8WXqs`eNdJ|SXjfoA| z9NZ#7jvN_4bX<&boO0~xG`O8<@Omync=&=apE}D?r9?8))D*@|>8Z{2k0WDAV=0H+ zp=622H9xFnrizPLWu$Bjj#vFGzQzsE&M$fnctig}&n##f!A=1iQXem*$);q7*Kye( zdEUMKX>pz+5yWNcGL*d6mXel69;)ic2!`>4(DK&f)DEu;MP_)$oa4zI#Kh+{gJs+v z2XbxuiB#ZFH6;t%elD%Y@6-zNJ5!>d*;5iHl3N?_GtI&^u5xh^c-M}CJ~IKZK7}#_ zh-t`70F5Z26Cu^g>GY=5`@u3CqlT+dbgU4xvb0X+P$6k znHtip=(??0Lu4?5=@&4f90zE*z5n7Pl9V~JyBa`_FRZfk>Df!!>`F5EwiP z3_DN*vjR{8x`jkK%u50}fb zkB|Z{ysA#HFki+U>E(2=$I5R1Ck>8p#L%Q6>oWxYr-jx@3mu$T6qV&U2{^8`2n1MB z2y8xq_t>KnBtDNT^vB(4j^t7b$>NP*Tr6+RI6F8%993(tq7h861^1TXtBWMu6LqnV zACxZu6HnuhgDY|H)(;Tg_@&6`^S}^rx@?qCThZ{Gx$w`J0on|@ciFn&&)KVQG_A_k=c_6YCm@$gKxI%3|t5sWij+jx` z657hV;$ZBy%>hyXc#)705m{{~BU4P(Sxnx1<6 z@&Wm==LB`)>7~!R7kU+2$s$F{-Dgd7>1!q~g5CfDP9qiHRNxXX!Sl_HMHn(FiOzJ) zcw^z_;)$peAh_Mk>+yaehq_IreXQ1dpkS&?O;5wZ%4y=*M1~ikMhg8Xg0q*vyx~s^or;zlGM7OE+T0XWN5&n`aT)!^j$2E~vAb<@V%gThyQtb5n5EJ!+D|ghO>qHkHWw%$)xIh5UGlnR2 zrc&LXJMW`c3ed>3Yw~01E*h=j);J%aB3r7 z8m^Gh&)cEp>wZDf31(G0$`Di$&~rN;mzZ;dS~brKQ3KW2ipeBU-dF)RP6stSK9dG| z1FdT&)=+I2x!2$t2l`>duLmM)6;gF}mOj9dsP@dy|NU34ZHZOHfE1+pJ`=5X^(?ob zbXzlDFd`p$ON)F6zsnVcXzrZt(6d}$>+=L z_-SYKD#KQH`zU|lg-QDQnk6z_jhC4zQb{Yn)c~P$qi=;2dNWFz z|EYVyqt{bIGV`rw$$0esH6di;bt*Qv4j!-1J@&mKwjY>nr`iZ+BWBBYmH|p%ixtZX zxTz8YhrREFl%6Ux@_d&=zNL*AVl)xh2yHP@s61n{{B-RF1;e;%(8bKm@2ESgD$(T? z$^KDt(Bn@}g}Aw%(;Vm9A^NP~-g?}@=%JN}tvm?e;GHRuP&J(uuX7$>o%_V#M*)Qm zJ|oUQcJlj>q}Js$g@j0bT|UmsGA)x@wJd@63P<@BD#7l%WK>^`_g$;_j~^;Glt<{G z!~MW}ji$rc?y3RiKk&f8IYbfICl3_g3_4o%NrwPQ>x|;6Y+HFxwvM)cR4(G+qDc3g z4l{SMIGYLf^BW@O=WWzEhy}kEkT+WH{6GX6V}z8A*`c7vLbZpss#^z8(@O0&dF*=RyJ8>vTfTk-M&q-z4UCEy$YjH8(w4 zhk2o$kzsXD;A-{LwJ^iM!GVOxf*_$f35v#1PcyF*&uMyol7#82snxW-XHelf14Y~(vTSZ4P98R>$yV$HClt6HZ9WcL!w#_2lb0o#MnHc z6KPkD2IR!1(}GvTXL_VI%zh7bfc3rCeh!CELf~-EN_I-uc@em) zqL3NHK2`2*`l#_62OKedu-LXh1^X|7IQ*`nnp1tXS^~Xk3n$}Pol>VjM5#lxhPQ1@}6&&F@pc0VC#<2;x`rYZN8Hv$jBgD8To)wq#o-pWFV)bQFnHXwAVFg z`%YNf3C2D<0Bo3u-+OhO_hN1Idm651dgF)xkYmJpeP5?BG8u;p#jKMn*p`_%_k8*) zgPVBKTQ}B(I0kAr(2qvTUN{3*X8pA`A#r#0_Z@`$2`K)fa^YdRcsq(7$Vgqm@Yx#o z@Qp>|*)(SIH4}k2w>Ht0@O|Wh54o=-i7Tw=t4Fb8W(N zH$ya1-u-;ASlH45Vf|>lZ&K))x+O2FP<_qMzpUtKu1xuKwi?C=2#r!nSlkaEfxpE+ z2iqYymhOC!FUKmqtstRc!HIRk~kJax!&@_C$oaV>q zR(xMM%s|hI;^^*=5?-TwcWSU%gE@&4TWZ2XB`d7%&yBoxJU*|uXO#IbJ_(_1^w8H<2?~+dMGP3 zmKqI?o5`bhOV+y#Hoy@hKX6(!AJx^{wLTPtD_aX63}qIsVpJFO<&a4FZ^5k&gyqcYUk_3%{Yq z4vSD*FPw|kAcewWAj+=b+a#$ilagmiLij<|7QBwRs75mUeEGO}+5I&aEv`pVaD2eU6@TK;M!Gm|+76p~3e6uH`>20hGCAyp6}| zLdZUjKFj+YmP#a)(05aSV)_x&v$In^qpS8rBv+f7_0tFG3@eS5t)2cMes`apI>j&Ta5i<4@u2*`_(LyY&JzMXVHR{s?0*zQJ~58_j`U+ovHc3|9Y@Z`e<<9rHId3sF2ya*)mshhfOtl{ z)mTxs?RgJAezfcaii^MYm9=fvlsJ2X{?8g{4FjbL2hniILEyvD@A-SD72Jn}O<+Y@1c@=^ov^vlH$XV8WZ%<)xm} zwC4lP_clY@9@$xYN*L%Znum3VXJ@wU5`is0a2ossw47eheg7l{p9G5Cy=y#PKC7~D zL1FcGlT&@J39g6)Y1k4gpE|twIkPBiOjd3CebhSUcT<8bI1C!a6e74lyMF%R;wR~~ z@nFD!IU}LL!0hC)ZMHN`7aNp&;8LsIGw`t_8fr&6IWgP}852y&#OnKP7n5PnV_a z-3voMuzF$NPCI+5Y{Lf@G~M7}&*GBi`wN!SpZ7;-e~UfBT1C2Ir=DafS*-Rxd(|%; z>%udA&U5(58LVi2GJeBQGA+mQhvoxtt~Fj{Z*Elu|L@M8{EbFUy|-(6>?D8TyGg+G z4WR%rr4TtfnT%HUy$%O*9vs>N({ufF};lX#rBDK%bvh>z3foQj>! z-g1ii-g2-Ru!uf{V@KD1D@Twe=fONqS2MvJOx_=j7&uJ?&FTXn4`GXv-Sq)Rw>s{2 zDUe-6l119$kxT(<_4mlBGPaB8>mufneMRS@v+Iskrw^owM+ zHq*X*j_e;QTl?Lk&x-K4?x04Li1El@2#*8?zhSL)(Z&W>#V3Il@5c%aRg0)lxHA|5 z@VPJR0-k5c4tEViHJnEv^ln8$H)Q!C101eJ#slbxc%>h(qoMt`ed3g3``-YWr(ERpFQs8qMP9|Rcd-Z^}{S$`5zQ`VYRVCv<<<@2K z=&PHGD-_VJY*60->-GSc_(k}8eo_)%3DNxgS^P$)=C0x?j>Z(Hbc;w3n10i;78I;; zMS+*{PP$J0u0$bxJ)Remx?h-2-GCbca)gF}`Uso}U#{$4kQ`o%F=x`REaaiiN`l~i zR@NHGMTloeov!|SiU1_D{H?M1RTU^Bz^WAqaKTa?7|G+4LxdC5k76KX|=3H;X) zhnvIa=ZID_`yD$fxI|6hAo z{tspQw#P1ePohYa%2Kk;$l6#+BujQ<&toSFP1do5O15mJ?E9X5C#jTT7>q4sC$hxY znfJQU_w#=Lg7^Kw{E|^K_kCa2d7aB~9>jyH!T*#7iEySm-1tK%zav3j_+DkofCzt|gHZ<*P+ zbgRV0dO{IF5)qryWP%DxWKsyC3o)*JvPc59asPnF>#hUO5k@4GivP-8Z&_kgf2Qa` zpu&C*!4R+p;uJ7(xG^O@#R~ol7GVu`mEJBdUNLBUL10~DPgcU)=wtLc!}G6Nx$HZO z1YLa|`Vmk9JmpF3P z04%^yc?Y7}X_3eJ6?dg?YYjo*W0)d*1{S7LrFk%H_-Tg z{mpN8L|kp)F>!g+X=U(!thOMxVap9^POxBZ`&1<6_An>nmBI6S5>SeGh3-$`1D?;d z?c&SHq~~&m#zE3{-o(>GVQrem8}wcVaP>020|w}Z^cX1rp z+S*F{E52;DYv&#&OH_w-C7COPGum0SdZvvCeNYJcV}Bk|;B`-pNPnt4)}K6QbTV&! zAuI{WLEmNi?R%GcmWu%IJ1cucPF!q?d?+|syVSnm4l@1#Z@e^BYE1^t4%CzfG?LWU z0-%jlgLk4nMNNf^E-lPEHEoX464C$)0x{n$kt>Gm1_~b`Cn#uIQEN?W_fzn?RCcaz zuwO*OBEl(1mhFLbp6%=EMUytBw*2^rzK&Qk&Y&HhCOr@ZeV_;o+~E&{-R}5IMqlY_ z4^^ns=BqfzuLPR_GNjT+T)ZIy?PwY`Sh`s5=~mO7&}2onlY4z#x2{X_nt0?isB+Ct zH<&4o6m^QMsP#O#Xi|ZtX+qEg8aGGQ}Qz=<}7 z2rcm4En&%Ony`D5Cu%K*YMv5g2EPfmNUdQ29FSe{v?B5M>VtrL zt)An)#t3VTopqva()*hpje4eemQ!YBbo96X?dv#kZ(B_u8S2;_5}_VuQ7aU6WvYeY z@#bu_HdSuM>}k}OUT^|9QiDt2R+Zsaic%Yq{IA zr{)*2T2tn|y*$)kEbVP%*LRBfmR`Tm%lM0$C%zO^&WHKws($<4tOAl>Sa#F_Z;s14 zwow1{O(A7kYKaI^9b@A*3=cqITF9f7ON$0O9fP*bxpYLMi4iF~BysVA_v?JnS89+9 zk`7TQX-!W>8kclr5sD8k;_X3~-7Vzu2stvIa*<$r-mi{b`rpUkLI+L<>iYnp7jvq_ zc%91t*`H+Ulw4b_EOOYVP7!UT8M6c#Zw;|mBXJ&Zg=hnszI5-M9#2np8M||Vytt&w z8TKB|T4wUwj$C9ZAapY8E03P!x(CV!kSS>FYv6!oUX{`F{p=5zHRKabQ2uf4H&wa;mFLcMZh_#P`)+k(C%vbZ`Fd6R+$k z>4Di-Alrk#g&Z_kE0sLGqG#vD7vHXd>(q?#+$AT~iT+wc3O84MDQzMT2SS%$}c9 zCU0JM{=?pp9;A`WNPTUdozbg5!*X{oiwZ7C*`!-$di3PC*vYekCwTYwNX6k2u(csV zI|GtN_9WFBPc#4tBJMkLZt59L=e&MM6X!cnwKdQ{wWFo=v67RKQprx&_D0nuZ)^+a zBJ%OWt*YTm5ejZlq@AqyZdCks$FXOus;9NHWtA8oXYvq|;IZvDvcN+XWPD3{dcJC{ zD~bxZq{Q)X@)W7|w)`gs8kfo z(`KKS*j*LBFneZO11TWNDA+0D!u4ojo`?{Tpz+mCi%)`bb-zRI<^;avB=XsLC9qIH zX~UL7P0yu_Qb)P*hUmrD9ka)g({njz4-A~YI%CaCJg2Z3SmAQZsaXZ{IpKKlh4SyK zCl!_C(t=~jseVrK<0m^(BH4T3zVm&@=Udd86oJcA`|I*hHL0iQxxNCD0CR^DI7D#o zH?p4qua=rOphvynnH3&TAR(3bJHc9$5tdZ}`f<#dIwfH80gEwy$##h=Ao!Tgi0&nNct*)_*tsf_i!#+04zt4r?`gETibvD=uo>`p4y3rf@a z7y;3cg8#jL2^yiImLQ9$5|pm3Qf6PJmdy>-V=wOxA*L<5!=m(1^+^dCyJhB zfJ^cku$xJr7g86@F(hS`EL=0^dC^-wP>H>N!e_5 z{7`P1v`?EJKEH3=OWQf$zG%bP$4bw&9Y^^=Yx|aI?0zYCF%orQi`GxOYxrH|eo==; zJ1^n&j=%b%LY>|SK>X%CHq}atFNd;ub=^shkNm$S33AzJ}D(b&|L zc3bq&IEM+w+i*!uYtXZ@;fyeROz`?3T0u#Gjsy6VeFR|LFw*~W<#4L%m{|swVnO_Q z6zV*vg7>f~%!&Xbwy9cm!7McDVA?UWi;t!+<#&LRp!bCoHwc`a8jdEg1G))~+xn8=u=F*E03_6QsqH>!NHzkdL%>{u%ED8?hS%%UXsYzU zckLv)6oFn8vz+83J~NGp4mHsnz?=BZi5@`+8mill|8yn19duM3&V<-skixalv##y3 z;hV-$E3S0ipuP0b-Lgr!#9`VVmCzGCPn7LWisuB9xeF?|xT@{7bnP}yy-G_P%>`cI zxD{U>2dV(vsiY*p9l-11!d!?HEdm}-nKtdS#Vt3UVX+K2r(T0a7IIwZbGV3%jLjao4WdD&XauUD}67ehL`8Gv#93~1zmtuMm}%b(oSDI=a#~it&5O* z)BTTpL%KzY%dL?j3GW~8uWhYb|2VzdNJSE{d%_On%?H{q;QH!Q>GOFYHfRb;HNJB% zsOK_H_?OY2%D^+I#>usN<-+OZu9K6jl%OA@$#hv7II zcT#=pfA?+5!+K_mE~Yj{kc6&$JW;#7v)iq&sk)7omE2uzzz`?nG%p*x<20;bnZp!; z$NzKaeQjuNvg@mB+WSe3T~ox2hRc{%j@7QSTs3-UM;MSV|8*g!{APBpFiuk0Jcs$u z%%U5#H}>Qy9^Yb-$8Sc25gi1$<}JIvA&(_v__&11k|>#eb8hOWx_qvpqy!q{^u`s? ziy1i=D>7K(=r})+(Mbaw2aFS6?3!0n=fky&C5= zUN%cRPvXe-vwIVFsXm4!u!F=YIq}dfXGT!sS%+6-nN{ts01n~X z)tcdPhYa@YZ{X9kj&Yw7DhdxchMC_Tv3oKzQd3ADcuY2P+y`t2g|@>$orv$Aj%adY z;pHzm2~y`1eQFka(^n~H5zBHg)NC-W(K9^Z#mUm9C=nq6VUShUcoHS|MK=bGr*lYS%~0O$GN+# zC#*2I%M5Mx))xp|CvH`Mrrv|S>aJ93h(=lkq!=s?ey+W%#zjuy=K?6!`F-|WCqB<~ z9#7k{P1GMbS$yAE`yzdli*xSj4rGMO^kf{U_CkKV8W>(*%yOBQC8c(k?$zCUjD9hf zH3@2sIpXPvwO!#BfX=KA7mVz7S%GkKfFS_{77hx8iU_hf<%@mys6EWmcMZQSX>64$ zhD)Af`Qc-##V9<2TiMG}t(SOy2~kh&NB6e-rw}nHFI5-kaT_G{kB?Ez4}w_CcLxS2 z+Mw0d&R(GI^E-|`?lT{cJz1`j!sfTQ-(k`l9WR(+vz}(VEy!UGM!{zvY;2$PMV88~ z+flA|Iq&(AQ<-@1jpeOR0XTEZUcA3p)O2y(?274GVf#lTMXx2@G^ESY8_YwXLA(;1zF;mYnE7db!cY90X@)O8s-frk{*CxR*~U+i`&`o3 z_?X|B+X@tmaAJ@If*uSBVTowJi2hfOX?XT)7XC(LIzeK+i}RRLMU{)BM5H_mX1QN( zH%Q=DK|IMWPom9&GnfXU0UXj3*Px0UM$U4?mRjB1W2_k!uVSb=8Z^b;h|xlWPY8!p zdw2}|oymmMM_RvbH8!CI;1CQnERxex2raQcI=fpOMr9ap+|`liniYRwgS&ob`wxis zFZ^D{pMxYn!o)3!ra{o&t#CFk0PN`wLfH2e_90ZFmy%ovoQ_yc6yv@6>Tct?od)e; zEljMTqUz}A#a$}5_C2#3hK6)it|mGsu6o!!bG~b;83J0ihpJPco}6A>bQgMlh5qBP z_jG7HEyF&8oC~N2v@T zKZSs@tcUbvI=0=9ZnpExqxm09z$Y#4WLBq}Z*;ZP69~apH;h~yEe2&X>#mLY1Gjk< z0S7IaXB>QNI(H>gw>F6-ZwIxxW z9?K7*TBrjYf*hTla`6O1!FuNTmRLvoQYLQb_8@2rnA|0;)B5UY2Eme6*lK7}<7L3! zIlU^7z?id{7TLxZliUQH!nX>mNR%vF{URkwQjG6QheJ!|UCoHukZV{+8|ngZR#;?h z+1>74soKp8WZWZI&pzi#&Bi@YYZ)B4Qp9?Vcwv}hDK^{-e$UR6K=L#=?&G;x`%~A; z{nCAv*nXIr1m|mRRa={!>D0VQc0*6Eds6144hHTXpAPctlASLALtknYYQ!SE zRRVqieGWIR@5IIT5yL7T>TM6dw|055y!+F|_=``2=p6E9 zldR^f{+(Om4On%_bm89p4hB1nBk_eHBDa&`l4^a_@GoAjOMTJ-qAQbVAuyPI>>do`Es0lyPrit?_$%PctJ%Z=%1SQ(P4C@v-2j_nHiz zv|PzcM4(okZ%n#~a!m7h;;jt)ZErxt=FbUYQeVR1@ay-DMn<0|A%|*v2BOy$%R&pU zzIu?oXl|oIL{2xPoA2-~axhzCoHf=S57^d|Z7BrZNJlzOx9<|sSxLtqOuepG*u^-{ zCOepB5ercxK3?b@46XL?BRS-`w`GEjyN|n#Xhzb<^+HjN!OZWJrcETBwxZfYUBm7y zNMLa_N{f>{iH>@ln3K1QoSZnBlU|AP4zKUY=~TAnFS?teiQXOINrm--wf8}=hJW}8 zEiugI9z?KyRJkOgoDy8SSR)KHFQ+R(SXhni2fJ-)JZJI;2gap7Knz8sOSNS z+{|kyT(H&qU1lu5st6#ZzMznq%ef;L0fygHO#g7G7*DuPHsE=k@lQh{rTkW%y5H08 zK26tI@vMRu_NDoNATCpzwpDyfl_5JTI1a4K(1Ybq0b?@(4*E(0^tK_u_pB`Tb+Vro z@6L>P4t4ZWw*yG^y)cXJqW6v5iqxk&gnu8`8j;3oMt%9_S^hrVWy1_xzG^*0K=&Y` zq77;9@lVU2F4=VUC#^PgE!P0WRhmPCNlRvdbasAQ zs_EPeK;kfTHcw)ZVO5~ru)GQ@d!0TNhzdeBcsOZrnbx?V@stmRO2l42a2jE_xD$zg zuOdjXyD|AWqu4$!2+%u{ANEpq>uV@2JL%5}sB!G6Y;PEEYkN6~~Ye%1+9x z7FW6!J_5!gh1T-r1Bq+N&$S{e)r*#KVO=u@90p&w0&`-oV$K8bfF%#4^bomPS~*}D zA~S*N6&p1EZPopi55C(!8m~3*{A#&xGy+yq=@7c+5F`5~5f?v%tN-2G+fYcT505G8 zT12n!_^jE_U7KHTL~4BC37$eGdJ6##%w4+EM#D_!L*wF^&YJvFe6N4umGs4XTU1n^ zI$LfSXK1`14_^dbovKlQNW69FHIiDIHk52+@wPy-JWln1rU@OgO#oN(9KCZU-v6d) zt;FNn$`4%i3OPA#X0y*@+&ImO=(5z$AjJl-9_m=nc+Foy&!Bwvd!xBpg*uc87X}5f z0_X4+-Cl;HaM>zBugJ17sN3_FGo<^1@e84D##**B-av3=@nJ()xY*iJLN^jo0a#1& z3wW)9j1K)RgIPmVscjzm6n}Xq+|WWJao)qbmWAmdH-%io?&E<+EfedCcM>FdLBd2C z{qt6JhRZ?_b|Eb1cfBK5IfK7=Bg1f*-nEaJamFK{srC5~wWi^wH_Vh;$-2a}=7<#w z_!mpE2Cr)X9J=}C>co~+PpVxRoY=1?4np1&Uq%g@gCE82sC>6y^{}x66#R~)wsVW(Sx8S1ksR#V z-MkjZ-`HO+$O9O?tI=9oNg|HP=dJ=5-|DMEcX=dp3=7jAo5}F53Mqg{__%=X8Q*co zG%A8o(s)Eh%8r|HJ!bFuB<0Gp{MQznCBr}OO7>>nInAtKIF>B4TedQ%vFob3Y&Zor zZ)(3A4aQZrA~3O(_(dkMY+NGQ{PxSBtZjDP5f_ai*{zhXS{vNTEtsa?rlFwTKb9L8 ze?M2}SfKXCd~Rs>7tIOEh>6(2#ktLSyvI#pTavHAz%@If;UDxCRShi~&=}m3m(!^W z-aYKpr+Ziom?mCXbgjts7twRDb>d2YOOz!IaJ(#ZJ1&LJY#Hk8Ia%D0_d{VbDZcBK zMMBuEv<7rJ|MY;KXM1^93n9@uD}0VV;Ec=nL2NPeg@NMIhxap*oB$umc3MvWDmfF4 z_ov}TP#t1oDe1MTS&&(ZG8@twMBO^2R21B;8*z(v(MPCV$~r#NkL0DimcLec3`N}i z%X=L0T4YaIn4aIErEWV^SgRl%0gv5 z9(?u-?P01Ffs@?@&>7jE`(WZ*wbNy#=G9)K^=l;VXyRCV73QvW^d~Sx?y_oM;6v2P zd_b}7N-LmNxZAZMDZw2i?su*Lx4V0&Uf{ZzbpxLCp#c4Tj6?f$>gjYjmo~`>;4Ix4 zwdkK1-tUc&Ek0dGk$e}2uxU{<2W@t){TWKY7(U=ovcqja4Ut*nNrcAosl?TuklKv? zpl#{Uys?$4Ccwo!08&mXRW5)z0`U_Q(wN(Z77&j12R;HI(k7=o`33q34-x17x*cn^ z@_LTtlo$^h=YaxU!)Rc(&lhqK>y`mkFb%6{~q_AJ3$V5+}3fH)6Ms(mF_K6$d9%z6r zUJv2|CwFT4j>RLl-`H5?*qVb`ew1*OBrB^;;};u}6aYBZiQuKT%>ZrWcBmF|^MIYH zcW5taDx_s+SUWi{I*sH`Em8B6J+b%Gk!jl)Q< zo8`N&H9@N>b-0?YPh_(zfe=R&=*3RlbZc{?1-}Tn{VMm%+^mK`-F6eCvyhFA_Pzsomo9(vFH8H6z!X@f*YbH( zxw>C2wKN$#UJodCt$sxQT!4Ndv$lfP4}6>M-fCfANzaHdc#f%kvNxcTo6um=NAI0u zvP%)kH<@ahD?ua)Ipd}u(##&ioOyeB%B#IR^n(i8k(HF>r!2G=%Rg53+Q44G4-q(D zCejo!y1d4VfndJmirM?7Kh<6{nwPOHQ(jkTGvy*Pn7;fW?r!EECx>mVfPC%+0=rcS z3aO5_2dNosxLc}@n4@{^n)8z8O!K>~!M5$4gkm5TA!X3sI-_O|M4BBL*vx~q0lLB{ zgdfmqbi^_5ZOpO}6@jyfk2`3ey+4Z^!gVnB>Hm}`M)z- zD1{ipjo%se1CXgbSEDBP_1*-B44TL3E5Fb1fWi90;aBo{{C1V6Z_*%aLUP)H$I9nf zyPUu}5Jx!-q_VUd`wldmc8KH z4%8;V-nTjjSC_u#AAj<24!8=SqOvx6(6ciyK~)GCL=}wFL#|og`VV6W(WJ-P1Gj4K zwNJzSG-&#bM~J)F@f-y46fF8%Y=M1=y{rc?Ki+>1PLD5t24IMhDf=zr7bQ{jT!MF#B5z=k^y z-SQbL(>iXn)LVE#_^Y9E>+s^^KmDT;p^ix)el;~Z>54l_ z!J6*(y{*Nr64e!jBqtl=+8XkK6kq(_?_H6A!iF>Zbi1RIq$uWr+<9*`k9u zkF7pVQ)W=l9HUgTl*w2MrHp+z;L=tdbQcnUhfm|tR)c(Ll4IRb*k=~u@n>M&!+ zGIS%DDLd~uFX4QQz$~_k@PEMgPF157YgzyXj+}1vTqvvBSeGhs`{b8b=ADkXsPt)n zj?yr16o=Hcj~I|ck6RLK~5aDZS317$%5Mum5C+#ql{)asu@h7P6VF_Yj21@E~{?|g& z=+D5B-J4YJ{THhx`UR2$M1|XjM;2I=1;Fa~D6ZqCCqo2@7sMP*_@DtT&eVs#;Nhh} zwkhwuLWehSbBDLRox`Q7qIG+jx4VKnsCty<_z(u^1z-S#{cSC|qB0C9NcmUgRMS`Z z%9k$KhPEa4M;25AP7jG?M7-R-aVy)AE6YW2-+GJRuCrzr>GOa+cWTLFFNtUY_ctDs zsQMGE?|L*vz+qf$!*H>Sg~OtIA}Qx=FW8P#;)f1H^*p^D#`~^y z#l;+s3+yIIk`kA~IJI7-3;?X~Q8r&O@#*;74n`=$egy(pqIA4(3^pqFXakH>|0&lw+KGW~JL! zez~BCnGVdyx_V~cmqZUFN2y6Up`lB5INQE+1k+V+iq?YoL>_z}%!3#9w7LaPgTJqa zbg@&#(?7Rnt_9m)Zi=v@8n{ePX6$sm(6I3w`wjKx*#Rovs4^?XhU%a-6ZKi)T@wty z{iTAGg+xS|`CTPBrA&=DNizpSs{VZ?y$0lXqy4yv+)cYvpG zm`@+Rk8nBM;luY5hs~t_SAV@j?60(d7Wj$Wnz~~sM+am(z)7gVz_I<$>*)#E|NIPo z7$e^&`W^ntSDXZ-Gyi!Vee~~A94*t~N*tNQkx3kRiN7{*{d*dY zOybBSj)LT&4IBl@zi#2kB#untC`kT24M#!pa3zjR;{VtrNFo>cpL_q4H4WW|@=diH Jh4N