From d4514fc8613a260df001085a0491c321bb72b3f5 Mon Sep 17 00:00:00 2001 From: Bar Belity Date: Tue, 3 Sep 2024 10:23:06 +0000 Subject: [PATCH] GITBOOK-139: Restructure and simplify JFrog Frogbot pages - easier templates, flow --- .../.gitbook/assets/image (1).png | Bin 0 -> 118471 bytes jfrog-applications/SUMMARY.md | 25 ++- .../setup-frogbot-using-azure-pipelines.md | 2 +- .../setup-frogbot-using-github-actions.md | 104 --------- .../frogbot/setup-frogbot-using-jenkins.md | 2 +- .../setup-frogbot-using-jfrog-pipelines.md | 2 +- jfrog-applications/frogbot/setup-frogbot.md | 4 +- .../frogbot/scan-execution/README.md | 2 + .../scan-pull-requests/README.md | 0 .../pull-request-scan-results.md | 0 .../scan-azure-repos-pull-request.md | 0 .../scan-bitbucket-server-pull-request.md | 0 .../scan-github-pull-request.md | 0 .../scan-gitlab-pull-request.md | 0 .../scan-repositories/README.md | 4 +- .../view-security-alerts-on-github.md | 14 +- .../README.md | 202 ++++++++++++++++++ .../oidc-authentication.md | 66 ++++++ .../scan-git-repository-full-template.md | 155 ++++++++++++++ .../scan-pull-request-full-template.md | 161 ++++++++++++++ .../setup-frogbot-using-gitlab-ci/README.md | 91 ++++++++ .../gitlab-full-template.md} | 20 +- 22 files changed, 708 insertions(+), 146 deletions(-) create mode 100644 jfrog-applications/.gitbook/assets/image (1).png delete mode 100644 jfrog-applications/frogbot/setup-frogbot-using-github-actions.md create mode 100644 jfrog-applications/jfrog-applications/frogbot/scan-execution/README.md rename jfrog-applications/jfrog-applications/frogbot/{ => scan-execution}/scan-pull-requests/README.md (100%) rename jfrog-applications/jfrog-applications/frogbot/{ => scan-execution}/scan-pull-requests/pull-request-scan-results.md (100%) rename jfrog-applications/jfrog-applications/frogbot/{ => scan-execution}/scan-pull-requests/scan-azure-repos-pull-request.md (100%) rename jfrog-applications/jfrog-applications/frogbot/{ => scan-execution}/scan-pull-requests/scan-bitbucket-server-pull-request.md (100%) rename jfrog-applications/jfrog-applications/frogbot/{ => scan-execution}/scan-pull-requests/scan-github-pull-request.md (100%) rename jfrog-applications/jfrog-applications/frogbot/{ => scan-execution}/scan-pull-requests/scan-gitlab-pull-request.md (100%) rename jfrog-applications/jfrog-applications/frogbot/{ => scan-execution}/scan-repositories/README.md (87%) rename jfrog-applications/jfrog-applications/frogbot/{ => scan-execution}/scan-repositories/view-security-alerts-on-github.md (51%) create mode 100644 jfrog-applications/jfrog-applications/frogbot/setup-frogbot/setup-frogbot-using-github-actions/README.md create mode 100644 jfrog-applications/jfrog-applications/frogbot/setup-frogbot/setup-frogbot-using-github-actions/oidc-authentication.md create mode 100644 jfrog-applications/jfrog-applications/frogbot/setup-frogbot/setup-frogbot-using-github-actions/scan-git-repository-full-template.md create mode 100644 jfrog-applications/jfrog-applications/frogbot/setup-frogbot/setup-frogbot-using-github-actions/scan-pull-request-full-template.md create mode 100644 jfrog-applications/jfrog-applications/frogbot/setup-frogbot/setup-frogbot-using-gitlab-ci/README.md rename jfrog-applications/{frogbot/setup-frogbot-using-gitlab-ci.md => jfrog-applications/frogbot/setup-frogbot/setup-frogbot-using-gitlab-ci/gitlab-full-template.md} (91%) diff --git a/jfrog-applications/.gitbook/assets/image (1).png b/jfrog-applications/.gitbook/assets/image (1).png new file mode 100644 index 0000000000000000000000000000000000000000..a89b6378eeb5cc27cea6f0edf7f41e24c77789da GIT binary patch literal 118471 zcmeEuQn+qT>tON(zAD`yK)SFvt`DmO04@8^+my#!sb|5 zToS7-4#%Y()l>7xX~z>B5)eqPbM$e?hgTc4ii$TvEHCrp3Yp8*<#|eqwXw-0%h9-+ zmaI#7434ii0RaRA(0>htg$IFr{}1uL-hti-#3zvd_3gi(90&+N#9IGPnQ$Q>_+l&n zS&1(%I1qnyKIQ*j`FC;CK7UmM_21R}V`Tn6c3Pote>dUu=4R#G37B-J=p{5zJ->!V z+ANH^LOpf^HYVmA?O-jtE(qiHoR8$yZ{Jkk6z@e~Ne9{kBNq8qG;2=Qk+3abNxPFk zL|xiFuTkhRe1j8X7MNlP1P~BFzHO*)T(knwF4?sRfL<}1s;OzP%rEJL5sR%&LDV-k zs;jEIxxF;IzbvnDV5B9_FDfP_pr9TeDXA!>CMVz9d-{pvj3(BVtxYG#EHXEyD?BzX zDkp#fLYICP0B3Zyw6I;Ar@XgY$bE3wnp&F+saUcwG1=QX-re5V+ddUHt13sQX~}uk zl$6N*6wmE-$`wkIk7PF3yLymthKw}l@eAT$WrxK^G%+_(QIqq0?Vo8~#Zo(NaUwW? zPE1suA==9oiL9}= z`L57ceo_(*5fvE$B{3z_?c(guD80j$M6QvDk+pHfn|8Z3?a$%oSMbO*PA)2Xtkn70 z*>V1^j0^!?(PS?hG7KFu${F@$Ui8>aQQ>Gr`i^!kZpm80k@e$k+@h~y$gML z4Fv;p?xHp>@l91-9ezX@%*^w1kZ%ydP_Eb^Z^@nRC9f_*Jo@)^9$myl3Ri@la(yB- z%zRRBLWhpfrlwZLgxTonnBArm=J>5uZGs(K#k~tYs_V^So1LCaObgy4jB?RgWs&cr zr@}M~GZIU$s`$ufS*^2>)|9*@yxM*Kjz3N9w7$C(#K#&H=);;%zh97nHeJ1*l4|p* zQolZwKv|JW9NG}PnI2R1gg>cyEk9f}vJQEd(y&g%VKSdJf~z@HD* zzR8iv`uf`2JNV(Lv5Jb46LY7HGX`3fVhE8f?3+OeA3EY6P_yhlPAhE&5~j9sshv3lB59j)o7n$+2xw+eedh`(G`XoYcPjr_l+^=ZWcPuR|FV1nRxfhm}?h5Ze zhaH!Ed*5Jg>YS@(B&2q5u)4kH#vtrBFdbc^d&Wlw7I?_+_h$quB06j>@bY!TJp$uI z(M?xnT<)zyBg?cRzx94EPZx|`0Rc(@cgQNYT0ce3@7Jl6f?iK*)T4Bq z4xoEpUG6;W-|@Jf>3p$zobD&gVjDZpO_spb)%xWbNGlgI@4-1N-UD`ZZ^syr8k*$e z^E4-scxUC=3(OL(MgMF+C)gw!3K!_$HE1(y%I`+V1eHh%2!Qvvx>#~;Oj^vB!^ueh z9a$cJCnW{z^cV@xbt5Uf+OnkWX`4;yS#g_?S$I0so^zbXS^3V$bdk%J6D+TT^zyE491f>{CdrvHRbo$om%NnsuTwk3nztBDflc->2-C` zT4l|}He-QI(fgEiTn`?M@c3AeFM8|B#2A<_pkRD^YOduam5p_ES#&0y6%`jXL_y7V zKiNKf{UH9v?e-zjbl>ZWBRapH2%a`_(Uh>7oKtU^00l6mfYbi9T%WfEP_Yok% zxI*c!tDK?KH0&kMmz6_U^Koh_JoiKJ8iPSPYf~hf=xuy(w`y&a*oL!rrAdwWu2rqr z7}b_BJJT=x3o5+2B!km)Q07J_7t4jEMI4^`s*;u$ezB3lg)F)ucx+7Ypq5fQUY`m} z3txfWP^jCuIB63Tqw2-C<2fD-EL2!3oN~m|u&PhR(kRsr$6u%B6$OgfvOcq=RU1O7 zp*k!8uG*kbDe1pK7ft+mrBXY87_Q^0{*;ms0hVLTG&8fn!R7hv8Oq`V7EaZUREFqa ztmtO>Oaf9>Q-h7dwa=-4UiRTCmi_%+jHSMD5&dP?uCrPQ3YL zFeDWo9FE0JpBQ_FY%c-q(?#a3DN+Ct7X0Tmh^MBu(ah4cqN2j}s$yxe>P3D|3uf-@ ztdcQjwi7B7ClI$yB>JIc>lw0I)EdGY*Drzh_d15DB4W}U zKA`zL86J2RVIVDEaXFFfIYG?!gi+LPQ!6VsuYkRitMz@%$X}Ju54UxVtrSEbI3Dm4 z&CE!T5V!{{3=D1GBP%ixDaPu$8z#f;y*Hs_clJKeWac3cxHG%v5TZr4#K8xEAl1AW zaE}?|J=rH?v-IhMF|b*ESmxFBQuW%(z8SK1*>3W=TcAnGF>9~##d?I5{7U)Z$xl5T z(B(FQ0{r&XOwRBQ>ORS=;a}=t*^efp(0(n>{lHT-`OtYTnbw~4m$2Ps|4rt=-rtOs})eyWp%o1n}78Mbo;8guhA(#*G;j3=J{w_%w`A&Dfex4bM@SNI(z zBh|O-jV2epo0R;%yX@Ja=dK??kq)M%@~tteDlNeXlRhz$FJ&akR(DnIH3y-8t2J8$ zKp)0@`UvyOh$p&Mlr=fR-Hm%SSDlbNm` z2VHqjymgVd?9cBqULk|gu@0@3m2lR;5PnTl2w=ze_9f;1HSA%MpTYw$PuKSp!(#@V zOM$wzy1d3wo}w=P0WF~R0>;9rscptNC))nzoxW2_^1YDd8UjJEGOV_&-_kq9RNLt= z#-lB{9_r4Xj_d_IkoPVbv64b7g+X1z$zmfu!xnE^_LtXv*p_4_^WFIgNFk%Kd1<#J zT)SX0?w!58TTBS!qX=j~AYEOny9;|;D;|df05~Take{!B9!xURtzDfdk^B$ji>VKUy!B$?!&fY>meD?>-ybO@9$A^#bTo9Yij8Vm|wvG&p20|@5GeLznk9w3Q zzMwF@qB2*MoeBv~Iud5RIcd^zGMc6O zonN4xpIK%)MLuLm{IZg2dr$CCzsAQ3)lNpEiK#`z7bJeQ3tC;`g-dI&RKD%T!DIf! zxHL02>j-*QS64GY;1zwI-g)n@_5X?KC70@5BpQNU6;wnzDA_s?P)i@IEVy6&`pRA^ zQ^NYKqO{7YLy0%P-N;{~gwdED#o7+((+b)tjzd^5F@7A^?44+3YHuE()9fFauBori zWLjES%*n^ORwq$tK2i72;$I7mPm1;>3i%{ZDl_jDO*+`x^HjTYNJw-vVP*LE6{V-A z+nNh16k*#;COdI|;PBB;pP8a-YpSfGsmt=V9W>-{j!Hut^U>X+|ey`y5)wD+kMgu`fh}W(-X-L3Cje;cT>YuHE zC$|J#L+k6~8*^>>#oNn09VCN=4K2M^Cv1iSTDjV>AJm;ezr>0#7ni1b~lul2JvW(x_< z@o{i)8Df{VC40rF%Eo6PNuva2kNfC|gl}&7n=o#?Gjbo7wiiJqU&#Mb{<|A~O!I(* z@KyWaHZ-2Eb*88_j`b(nyh9+17><*TI-efzP)7JkI(2$}N>Bd6uW$o*^6z6jnW^JZ zeIXfpPbYd@JaCptribm~K$!>(e0A1#2gQx&bNgOLil#Ed?5vHAwY9V=q)vYq=m`+v zd+w^$8$JS2w>~^hal3haW#V?6xh{d_N-xbX^Bz+;nI9RM)F1`g)EbzBOL(ZGR!U{Z z#Lyol)14*L%gHHVYhX`WckET(-rjn3+@o93^;I-q<-`raeI5Bdxgo+qj2}F4y|eav zr!?dzk6aB8H`6_Fzc&}g5FBr?d?m!YAURqsu7fs5=WN<)D=Ce{zhp%z<8n274RpYh zWN<&+lsW_ABliGDae)TDIavl7alOvlV@x0%?C-WemQ6KTt4DcOKQD6p&d&7(`c*6V z@j6BWhmVSmgvF;lXEMRn?xkZT{iyZCGal>3$H(2GsHE6_GrBc>oh;>EBC%!7r^e;+ zhhl7OhHzSb0enp@*vRjB#Xn9B)ASxns-a;28iB+!9-vi(#-71Z1en$9*TJ-p#}m)3 z{}h7GBWZM|bnu&|>~FHv;?rG6&jai#L1Cf1wAqoOiB!MHgcRG)%piOYXJ*rbw5nWR z&i8$LKt4XQk7rms{wZ)94}I^em` zFmV->l}}Gk1I-519R&n{JHw(lA2^*T6zS%V>*Ec}?Tgi->FfmKIGUYRoQw}~ows;? zI58%w9*bCNO<>b}b>ufkM{YDUe>`Ca%MMj3;TZ*PGcmEay1reP_EsX+9gclX6DDlX z2n(ymxzJ&P2fuc6+%A?W<|lhNG;O)kyizXFS@4T*dF&}UHS7HV=y=-ngssti+s>1@ z*sMVfTW=SV$X0Dni$@rQaLd~re7^|zO5wBwbD0%7qS9>tJfk_O4A-LhI*1BCl0A6C za|N2rN_P-m=&ouoRuPk7$%|x-dU*v$wBGKnv}|ZtSX^wZCNg1p@^g3EH!OUzjW4YC z$;o-*e#Y3t9@ZsrvUB=;&wFyV+}hpW?>`$P0G1_)&P;5*ZSb0f#P@mxH}8D6*jugA zTTMQurlu~Xpe&k5hkjmIP&(2UJ@i+}+!Q4|nPQEtaC>{GGm)0bq)S^uF56BA4a0QL z(A30pd&ji+5dj(UVq;|_#`?Rj?Wfr9)T17t zt1k9f`fMb$w})G_L$lTZ3q|D>Kg!#O@$(a;;A2+8pRWWwglMXExZRiFPXn*ihC%l& z-^6LVpHyXLZZaJGQdG^2xQI1!F8_R2NNif);2PF{-!F;A>DH{?SH>w)h@G0%Nc`1S z*O?PZ^;>ZB-ZrkV^Jc26PZaa$2DjST#ydwQlid%eMjsV@XGgPj_Yz!{tE9A4mp`p* zzj5NMOZ#r1=wq1n4XiF7=`V#m+XUp*hk)+6wbfNJnK^8@@y*$??07H|!*>P`DH2yt zgWvETqMkN@=D~rs20;W`DWQQZo`M<@S;@9Pr-0f*jW5odk0$$Hb<%<<_1o zARzdn1Y*fP0?KR-$%}1C&<2*bQY5{#a%2|QtR^ZetEj1#65UelMw<3oqnpiVOCU0if^^|5D z{K1@wKh*$wLB+!O`gvsAm4Ked!DODDe^~}4FL>!W|EsN*wJ{L!m$L9@r`4){@ zV>+vyj^`_4hT(W~NY%%lkm9d%(&&1bO)qrVKrWU2u#$@U{3F;ol?vS_kU#!|o12Jb z=w$=1%7st}S2M^YZ(yKVQmk^yn*QvQbq-73+p?v=giDnU=n&_d7|K9?grwi=-i*FT zM97fOX#YIS=tSz>m7aorul5yWNWE}Z|gx9BzV(v-Z zQC)Eqn4f)oXPP68SCrDaWIZg)n*es4<$U`aqd#cVuG8wkJ*FA`NL%or3TF@M` z#Cd=E3ac#`%4Z_f`cv5LncG+lga>OP??%JC#KqVd%y8=mdK=Lh3-iAQLd?=$c98e3TA zpY2H3#zSir)dbeR?}x|lj$&mMK?yvWz{9r)4kART*AzeqNrOs$njTVTJjg;GFH^|v|>Jlo}{Ftbh23K zr)NlqA_X73*;s4JZs)Je79-R{gwV4L7c*Zggk^=(gaQ>9V zrC3elTHi#|YNYmkeur%eL!wD%ZnyQY60GB=SAIJxE4})=XaByG{E!GKuKbBsY3s+1LBbg0=Y|)BN4qa7@PmJs= zR^n=qNTr3O&GmfC6v-PZdVD&H%HnDSo}%kuQ4~6~XQe0_4uJe6KwN-Kc2ATy3Xc$a zb8kxA@&?d}ggCjHJiV^t*Q)ks6N=!C?rLEcyGcthu*HnpCd zo#gPqsNgYnFFa@f^p&vNTOFNj^OB9`BQrVIbmJ&|x%D*Hwg)a;rOeI=Kur|v+bz2@ z+!-R_7}bzARR!Rj-IdG$?JK2GfT!Rr&I~e=pr^}zCUkJ!=BIH`2?ST%^WdU+xM_#q zUzwqyP;L@#W~1{d_GD~_1gYMe0hg1B(tkKknC~SE&dqcJ*sPyl!|qH?(GCyap3cK@ zv8z%l5Qee9Rq7!RG;h_^gMJCN&5fj}9UH(HwP#j~4|5s-)xodqppVvtzJIdD>oYP| zFYfK0Msm8La14}ER5M`HEl>zRp)ovsRJ22!nfId188q_N*smF<&*rQ@OS=!fMh0X1 zfj_iax94`KEjyAk?lD&gL>){NsL<*V!PX@IJYmkyVX*^kate2Zla>y2o$+$PtWl-s zzbzaJ4-QzOtJO2_U6x4xX(p$siGhd;Dw8+W#Hi zn#?39;J01&oWABZz?(lFl&)f!4P#Ko!;a-r4!7yu7%(F1`1ffWhYx0vYTl zCL%UEmp(D+I=`(*u(r^&iLD>0x+&~fIr{P#wFg!o@~LHn46b@x&99&2rb~?z=Uh3l zfu@QcZ@17LA7(?&K=A5J90;X-(q7#RU$1M4(;@{fpa3S)+?_s<|P6qQ(nfd@tfgk zQ&FbDy@2wf&flpN=<;pdmKs88(-)*?E-6v=WhF}IT(4syk7K9o(YP)xo!D@VBAqdg*UyHltJLe&rHrtms1eDH11B%WG0B5 zK);_BanANPmSaq+E*d4E8aS307uAW~AiPnh@hGUa&~v%+4U>8brjQ>ws|aKmL9J%f zwtiWwDQ+S`Hr4vDpiD^-PA1YB#g(On5%>D92mZPGkw!{q*PR*5a;C@WlD)NIilpk@8=i%pDJ{Vtg-zTxmhaQHi7?>PbM|zS;_fFbVpQpwse&s8~ zBhG73celqQLNBg@Yxr!&f2@?j2r<=D(}FX_+0-sWg7LJK)nOLeI|^U({eWZ z`r;rqShMP2LzvJ5`4|-LM&?Z9sk`;kcTo3?=BaWu^Rb(n$kG%WPW>Q7lE8Ko8zm5; z1P>7_(&#wtraN3Ysw-+b(EJyAW|Is2Wq33LRNj-HZ{i9iO6 zxt1cF7P{!1)Tdn`F4eYY6(Gum7SWeNFGKtU2%mX#vbebPb0$~GfCKXTfy!pV$`RX8 zlbJ|JxW0ind90zD9EA@zUMl$^UFPQ($L!1Si(%J#r8+XB z1ZH|XgR0k*^Hjc&kCQP zbDRXp7-M6zz|S5wi8q|zO0)=}^tpZV!D_{yG7_%3;|C zW<$4bKX5J}$y~jV5}0{@LtYVFA))mQFKhd)S9qsm>eEk!-n&| zK(MCNUiMwrOcge$t0&++Fhs3w2uwA@mAQC%&Sg^3ls`2o$I48)qX zM$gdK>~Pvow?0ezvC;T`8HP?nMu_lQ;wQ%hM(3ueYlAV9=!&>a(Fw?hY%0qw z|Gn9cBYh$Cw=c8@G;xmfd zfKGWu0}`%x9S8qu*|q2+3kz-Ca*?>Ea_#oGI#V4} zW5KHrd$!!;;nFFWDd6rbnbk&SCP-y_aUZahHO;jG|` zudiTXZUi^*mC^un%!1z1A6;xKO z=f<^=S1k=KkN0Cj8S5*xJ2d{dK)A3JIupQ6l;pRN!NK3$?mhZwBrm)~k(2w-J-QhQ zOo!hFUDr1lz2%>=@U{}Rwff@Cg;0;N$>G88flr(auvuI^L79~5ZV!oD!OeJ94?m(c z%EkGQ;=POyS1o*OP$0g%v#*269FlJ0if&@a3dc7O9KKDgc#GKaLW>+L(SE;}j9$mV zvs}Q^ZyF3P)0&RaXlSe(Exn231BdjA&X0|nU?zDiq;-KY93a?0L0x63dbR5qz(1^? zgO^D&KM+s3S-;*{zWTUvltFTuPlMbNu8yi}FSob74NC))=Bqy60%G!p=-cWxfEEO+ z1|7+-9Y5zW4~}$4=tx}9>$*t%vwe>yGnL(hj#f!eSz&{iz3m1g!|@Ub4_2Ir);na; zm%TyeHrqX^9S(+jKB(&FxMc8nkhuP!tQpv3M}^^keH*$8Kmb()#``b?`g$!b&WpMA zd669xEn$c;SZwLBIhV7;Uykobkp264&!$IL4rrvmWVpYG8fQ#QjHiV=idVJp-U~f} zh(Zlau9)WHDf)VK@p;7#2GY6BwOtH}pX;`8=cZTk`zJ}JYq9{X$&9Mh&oLO8wO@iV z{}}hqpRm5rvWACZWAoS|c?0j=@w_SRSN~2$iq=D6U7RfovADV0`taF6k%eodtr5@d zu4?qv6SLaK!IE^I?R*(D7aiG=II^vwq%0VXC#5CEp;2~%pS5Q{TTlpm#$#cUN@d<# zM0Iw5fyv2%3>52-RgyDVVH5aDVKrhWVGZmxqP*k-6?wkN16QL>WwR#46Gx1ZoBCLy zd45OH#8T}05qO)(*L(BU8}A&F^%T$MtY+%_UMClXj{GPTE$p@zYeZSyOTO4LnN(0z zRP}{L4a7lzj$OQwjQiT;jtrT}RmSsmfgc>wtDSUrB%k0ps|RZG0Qk^hH5FNrw@1qP z@*ZW~_0}np<)+Qxs9mF9I+D?ZL7l~m-V91vb!5+DtQCT5>*7B<{joY0Uq#*LsHW^I zeI23Y29dSATKg#RX{r5&3XJ|~=Ly(T$^%NC_Rzpk4pfl4`}yg^U_52A_j`PJIYgld zdD7o9D17Gt{Z}Se#;^l#GzLGbHyB++H4P!3TK^0t8(RylPb@DJ2vf}{uLHtjcs*n< zZQidV0vJ%EGekYqcVF=Y3y9YU6nO<7^BO&h9N_Hi>|uH93J9yJ{n7E zAiD}D&X%@ids6RDr+5bQ$bV2^LE1iva#lL1CEo9w|Z@08KL93K|8G9Z>nzh%b%$i%R=eO*p z%Kyx%=&8N=xxu04z(RHln*jtqAJ!n&Jp>x?ARlkXeWh1?F+(Q#QgeeGyebkNO8Edz zV$mCrS6KH}oLkFZx9Y=S`_*SCbF0XPd-gmjoL}5EUZ%gk8q@8?1OD^cF9*iA^% zI2{+0?pYrrG~9olr1&-Ub4`FpV%HMyVrLm)S~^fZU#$Sq{Wv$g<2HZFO2%YLbjpSk|raXP@*W{VVkm|x0y@uu`O}d-~I!1%*4_-e2DRTurzkE+b zZKUOtrr3y6T=Bf=1GHaSkMCX|w-qWn>=`zvm2Y_a5-6{gyGB8COxF13!484_$U}4qTX)+AqMP+r zuF+kfCwg@k=6i;Eo$hcKW8)fb^YOA%4SS*qSr4-fm=sM2Ve`KeYO#P#0?L(1Tm zps-)fGl9Az&N>H!WG_;*%m{e?*1?~_5T-!`hVBg-Vdh{`|Kx&H0ZerEpe730A_(kU z?v3~Ou>$;7h8_mkW6E0LQ`@)Ar+Y@yjkp$RUaWSFm!b(DSan2uoaUB`gp?0*3J4tC z6YV1nN?=Y*w4D*g&FO?VsZwWnMRr@*>D^xAQY~C?WX4D~$@y~nh|vdv zg26(2@0m@4ZZ!ibHXa7kPHP6_CTokbsPp~_`dCozb_DwhLw$^o5bOo#2f3a$0N08( zk}a@Ijj5z7$hyyq&DibwbfU|MOcn#C1e1|`DT2jW;<8vR%Hk>QLB4l<69>fq94o_) zxbHglTUnBqPfuWFJ8};>LVBe#6}>_-9!1-7Hv<7bOS_+-u#*YKS-4#aV-OLv`r6g9 zS%9i4vo4JC434uq6nF^`9CBI6^#L;Yn>?b)IzbPFFdH`$6)S6zsgI38MxKm~y;l+B zIWF_~VX#IBg4usdp8bDDL!|Fx}e=qLJs7|l(R*RfnX zKo5HrSy%QJ-0afHKUoC2M=GU3sGXN57vWKumc?C*IA(|09D7O6r?AH&*{ey$; zOlcoi%oJxEneBst+o?AodK-+|L)?9H$M9>#$eeH?)>8@k-80^?6E;Phcnkyp%xfR- zqTg_vf{Pn2n0tefeGgnGlKgzycsq2NpF1+Hq18YBJVT83SMwrx@fuge%~WjZ%yRou zjeJ`Sc@d5yd3lhDsevsw7fcFU*i1uXKJ~9iVQRxy-<9V7Occ+GnbvEJ`@$^3T)vX8 zZ?{I4mCMtwnjwQ7$o)BW;a6MH2RdVM5yB4@-4Hg+}eC7Y7z z;Vw2H@u$(7ML_1&tHlC0__$Ey2LuTT6>)ZWM|*@SWz}E-Jt~-9GSJn+I`WIj?G)+# zK>FAq+d^YID_|!chPvJ-Oz^#IWVPI`M60M;DN1>+%_>U37po)caTdU4p_XH+NCe4k zP2?IFwV>9CsFrMFYWcME_fScB4^P_DsS3?Uy-RlvE+mE#{^SOu^S5FAnC2p?U>C2U znR9^j8X^@zd51YOS4D5d`BIR-?oeTZ05KW9qU#7X#4b%!1{fU)QKrSo4Hax-r7L+Ov!+)+N;J>E{H(om*kL zf6XYk3sRc!L5r_$VO3@M-ThthvYUqApL$s>?Nj%OIgd`&;yvzFK#pQli<_g`fgA$5 zsBC7|Il53-r+Uj7DA}r2yVRZYEAdU42T1zT;c2X{799plu)&*C6TxN)9 zm{Q;hvyZfmj;MS^-c2Uy5;IA4=1>#hjeR$EyZfesx8Biv@ZnKE+CadAj~vFnQfYYgA*N`}&Rsgu{ZWHao8HeQEmsaw zjW*)Jc`+CeIaK(PA!EH6kLKhd3ya{|wZK!-p-CM2LVV)mFPoeWD0;(h*9;W zx*ScDTha^cX2E#qR7eO?_!%~pFppscR{yli^099dVTIok?5|)lZP~obhy{2yI6TC9 z`mwuam6>S@J~I;yMSBH?Q;8%YPosp^jtm>G=Q>z~-)2b)+%(V{*x6KIl}6dS0RD{; zroNhBR~ii2G~B&ReUA9pKxxCgPaqXbe1nj(e6rwRHXW!{7>3FOO*k9a&q4eK#39}5Y@f)8lK^m=&oS}`T37rG@8;6k8&*yg?e)W86f z+lZ~%F8Y-V`@{diC=vNvus(AW(GKGlcTP!>I->u@&iKoj>ED6Rr!X&sycZG0?Z0FG zXS(k6_n4SYGiRV^{x2E+mHdkR{h=Qb#ly(|v!wsX=ffBF4S2pa2YH+SQqf<@$JQYJ z1P?5^KV<$aQ>;oporDM4O{St$^W+P|qSe{~)^ z;%}8?xi{pPOofhfj^FY})Gss;#pR+;%4Rc@z7z}wJEF7X-~G9LNT_?dzw35q7nlCO zbgvMAuc3Z9_Spf>nb}Hi?N7i$Xdq+ujTnk1g@{A`=vD%vzc$3Wyol2Q@L|}~FoMnh z>6&>T%$pVyQOb8H zRRjULYH~^Pd{Ze&qOnQXiF(CK-s(YM{_avMB%ng}l{c5T>_m%yx6`K*A{hhGKl@DR zW#hXw#n1$|3g4d&h5`tA$CZ5@`p?nDko;>fBrARzq5cCDfI{DW=-o@%`;XDpr6v4E z8Er#iywX2Gf%1(qV5lmHe~xaC|2N8d=GEnu{|O4&ZmhDW%YlN6+AXuL@16J^BE!6&c7yf6IGSY3;k{Ptoxk=8Ud zH*aHWd6LKiXkvD=;K;^IOWw>UM+zQZT2?jDw~MnoM=uu){+DNi5{MzyXJupgyad8= zAV6qCOG8VBdlPojFUBS9-aaj_6D zi=LT|hV5SavvVn8g34XerUHFUBh4}h243~uce0<+e4?t%KJqwxqEcx%TY5{6%Wq`8 zS__V8b!OxwXDF+tp~>qjgC!D=9pLF02+mYeYGP0(6N^W$HmE46px`H3NaAARYHI5H zdU}QiGf9S6KP^3iAgDl0L&Lzi!e=OeA}w_?|%VI!`;!OnnBtk9-0ZBWp(Ev}Yn#J5hiLFz33Z>jHSKR~d~9uPEi4qq#@3J&LyYP3<>zm* zQf)H*SOU(WYig{QPN%2-<@ra!z`#ykU(NJnpq3s+d`GU2%>H>=@9^;O8?C@G4-wg= zUTF84np%JH?+Q9pmECTaW9IjXKQ?^0XH?C-T<>R;-hurNX|zX2R%v)BDaMC1Y_iJ; zZvPg-&%eGGfRncQRC#p1Z8He6uu%)=-y_ebLla5^TECG-DStT)7Je9T=aR82gq4N^ z{}lQ3vpm(G4a7EtP$^q$I^%Bh;+a2D-6H4FCJcw(G_7h9B-{MYYy3E&%*(Iy67u{lroBm#9pEJKVSSRkQ z*YX!vEI=2qMn~8*hmY0d!^?spbKWmG4Vb~m+x>g0rQL7qEBb-M0`8`iCuCm}p91)M%Kk%~{m2~m} zMqQ75>*j7~4k7UvsIc}Wl{b1>_lkn4*`HT-EvrD%OF zNOe*!xa+#OP}QXcj3H*Btn2Ko9J9(zJUsj+FzR!dnOlxcj=LN^sQijg)Q#c&v0KAh zP?Y7qA7b+DzG^b56>W1X=%Ga&AjIyhp^*?c?Wr#+=ZlOX=#WjRiz{ztY&Pmd!juzP z^DONHrkA#7+(Kj}0)|4ZetYEfO0I0&T(lD2gYLR-F z)KXDLBQ7)5!ors*SDCXP!AKB%TT#cff2{U*kGzOjJe7;oykWXCTYal6JN*yBb_sF~ z%8$`z369%rAbQ_<>9C?7kn?6*B)7GtCG5ODOc zwG(>XOk52U9%Ppg(P{IhBMVSEdSY6NKZ%el{#35ybMmaA^}mg;7&L~1qmu}CAW1lJ zr|Zq_b#k>2SB~SsA>=NxDv9-s~$D@(@#(dYoC!t;5|HG&x6N+UlR}WWF*qm&m)D zW=pK}nOG=LQVS}pgUd-tQwWS6S=5#rG**82c|BxVsZ(!h*e~w?grCJ-)c@aQ7*&2o#YEe5lC0-$B`=Q zi##zv%|plyhKI9+hmp}Bppd6|T|i!yz%>YEl#L4!Q^g3IT!P~;#IGWXgN-&^vxb6# zgl{K~`pw>6ATvPc=6J~iitm#UVaUqL%Fij0vR~R{0lCM>$rvfMT}DTZ)J+x5Ya4x( z^c1hxJsub_ve`AU{_qiyP;ib;j(x6G#RTw6wYk0gQnsXkDPRGC3yLaPVw_Bj6zq)p z#ovEekp7*5c|tB`GX2c<4g^GpZ=12}`T~FM0Na{(DO5%kcRZ=Jmr5-_m1tAZR^%>RZy`jwkx*ns<2{P72CE^NyWBp+qP}n zddJ#(?Ps5J)-QNJ&0M+W?4ys)8?Cjw_c{!{Un4Rci~zC*{vxn@IQa}luO#0^1UxN8U6Z3K@HacZ1B~D( z3`}%nJew=QrTsgzXoMcjZG1#D-dUlc?#9wwk~a<0{U>JsUw=ZbdnO0rVek-|8yn@u zZfj?EnF>Jt1Op#mP`HWjPBA^0Y``qTkS?}uV zA|@>A;`+jWO#3HJZv57c0@{m-!RLDv77r^TZCSO}sMDr564Z7vU7T*DE$zR3oJriz zeiZdDW1kzd$IuEf4haC*GiY>3@K-=%;zaCIzU(XpAmFdySW_o=H-}-37Rtwx7AZ(b74`mh6IT*l}3(uzbA=C&VMoBW`_; z-NnX+f~ro}#8ZbNq}(uTP-Rhnywcg21^CN`zg|->^=;C1YEw-{I&m!vTaUXf+ecA5 zby{~Pr#l&+#SXe^dUb|f(5AC^ufUSp$?#2mhl=B|MBHN%eA1IPnsmD25rotkPbrUI zZFfslTZ8k5I=X!Q7ux5X2&+H$1P!Y@=c5{LH_5MH0oqj0bhRFb8qT-2Or zqEd>a0dCq_JdEE)yIq2>2^=OdWoNEyQta41=$zbkzlSzo?C4wQ zuPjbR|Bequu25>*kug(mNoh&(;wK^3seeBeq-NkO9Uf%us@GAuqBH+7Mg zs%fe2xlp-9Ohb*@A+7=^Wd9@r*}2@-QXl(;5d{;s<~1DxN(i0FT|wiOo%x!TT}z!y zG&Bd|-s^eG4erhXNZ8OeosAa{+p-dfz=z?XvIWNSeQdEga4a?6M}%Y77!SK#~$nG6u-0Vj@Y*~oG=8k!k9edNd_VWjYjRN9v{K71CoQ0-vdJ54G)+%i8YF8#)r z5W{S0&n;Th{n}avV7&~wXd0x_d1uDgKTBlC`2Cjk(8TRxY6n<4^jRgHwZ9!taGfIX z*rvMW7>Yhq44$qxjV%wm4&SO8$0ARVW}GeF7ToUNH^C%Grg1>vL`QuerCt-FX zWu|1DCZjA_Wcx29JOSkGXP*(HCEnbQERyg?p;u61eNjfC8tEkG*KhS+qLUfZ|j2U=FwMKNsDH)Jiw&QK{ffGB7d3qz$GM7GaW8wf{!T*knm2^PSu=j^d|jCc|V#Nt3#*2YB#01 zlS(Wg5JW9gR)RmvuB}IajOqwAqj3 zwbVa%2vyVB+SYcl^pY284>0@Gk8ek=ePJ>Y3m%ATy2W$#BPt|{FuR_hh?WjX&*+4& zzk6xHX*>cNp8 zGF(CV@IzhOU-@k093A%~X|NfmXC6)$1tD!01$6~@VIx446_prUg{m^aUgw0HTwK>5 zE>RGf6h3liLJUd!?js|kqe(~NW4%4Zp&5QY!734)`FA{nx^_Ca#>9trKo-ziH-uha zr}~F4Cm;9ce+g~AjpQO^>H~i|7|;8O(TdX68Z@ffh_U>sjlteLC;IO0&dtfZM`<4& zLs&KnXEDeLD;|%8YR;;ZjfDvpiL1F0QbO`PU|J5E&#i0QCCoC5L^e(Uw^0Uuk zFPU^&B+F5(;)R@1>jjWOXVo3Hr}mtrJeByFA6*$tF=GTU0xuDE?-Yq603J`N%e%$~ zK=p~(JHhuhftQ#Hb;EZ(nM)Y_qY>;cFjpB87Z)d3{);Sw5J1@wMzb-&gvC|7p)hTx zr>z9*VqoAvYlM)?5Fk2I%9r7p{#&AEvlwy}*0&d{(7z5fd3HAoff7 z`e+@A4qmgVY8}{U@F+uRs)v3LPl+oHP4bL8{s@pB^RYqzX|*iXhoA*iQDg_a36AV7 zBI=f~KT)J$ZHQch@%Dqg%$i@1J*Nzt5vqP=z59GXM=HMNO(sEUeQqqSs0Jr-x( zE+ph1+2>o7N!7PkS?AUVVvUMTCgM>=qNwczq?Xoolu~>*x3XZUs=Q0TuB~c<%MA!q zObYsz8sc*V&C5vv@x>rBv;bCZGT=h;&JefoWF~~ zi<`klY@rRC@(0Vzmi6_0JIUee`n<98;I*=3nPw(uAH=!{R=Qih(!EcZc4xZ&8K$n$ z&h*c8{T+r`nsZu>HQ=`0Gk>+hxv4BxX$pX#dE=w1_+9}OrC@lftoNxHLWx@C=lDLK z-~j;v?Qgp`^bb0mAwqLb#lf|wn5GD`U489jm1Ql-WtGYU?S8cRaR2-F9GX*}As*wm zi(&Z&Vz3d#PT!4|KH40T0El%f~KJG)uK{-M=WY6bVcMSW{}GUUQ>fHy}b zRbJmIi%W!d#ddRFtwsTC^1!H2o<=LD?yH;-@<^VC8STc#rk&UOE4PbZNbs;O z!IT9a*R@IGwB^(hWl!6DzyrvLK=LARQM?x35VW0y!AL6UPTu0IPkWupm~p1&`+~ zN=b%&BcoyAoOoO@)?@ZUcsBqU; zI9(J=hu3djZM1Y4ULuiz38Omem_DE-2V&cQc}1>Z&C)&3*l!NqpQJPh)ZHM+jAih( z-Q0rw^@E(O)_!WLZsFsEVuMCr!%L4Bvw_T5T0w*vk7AC}dVUrt&Amq1YU82*^ziMI z)^(3q|F*s7jUB!>bjaWZIS40q2m8zB)xE$D?0X*7;7FTlT?u#W!_T%Wa|*8w}~dEOh!Ew#mg29`am9qb5N{)DBU-2pr3kz z2ZsDAgMRK%817!>Cis@fP(aUzk0QRXM+ica`ME>@X7a9OeGcZBTNX@BB|I2cX!x~t z6~OYFnwaY0!=KwNsbT^GUJ=AN*hY(;Jt5E0dXQ=z`x2#Su**0u97_WT_`ZDXTrJu2 zIn^byn17(aDf^m`FE_74qbX>8d-O!DlcdDB8Z1CCas{%jC006&joDb|R98#h&||{K z{Q19r?{r1M!|Yop2^VyCf#MDMz!pvr2XX?#AJHi` z@vU*BA-9rC_rlldDmH@0(Gh;JMak$USNZlkPG$2Ag7h=IiZ1FxqZ?{8=`Oa9XHE@zs z3H>nA{o%FP=*aSg-;|TlkvV{ksU{OP*#KIS$V0Q)fc)PuC`2$<;mm`(HN04@0THwt z_g9eZeko>F1`E?dAW}s~MPq~-VZzHpnv^JU6HhIq+gU+O$F+0l(>D4|c{qSwoO&5h zb8uWlLZOGrGjDi%u8~o((zk4%mVfiqOxv-zbls?PnCW-WK3O1m;UPx)1__G+5=yLb zw53=Em!M8rNx(AKz^rgIhHjm{>^mcxrn@wGonj`go?5cIp~;o&FYwmAK)o^i<$PvuF2c&_+i{AcRMagNDSKJAF8*C-$PrYej8E z*^r7&Ma4gDp5&#NVR55Vm9|F+!6sNym?VEt59zbjT;Uor83>D^R8s5hj5-pR3eDpo z3G4kV2T(aI3u;m5Nv!YR3S)9KJAcW;aQVg}t(EWC_}SV1OaVtux^pFrcHw6xR>^ZOk_ zHd~ETMkq>*kItvUC-W?y~V}Ql|=Ck&7fj* zkD=t3>ReoI?8rM_rq`-UjiY06P{EA!xfwiZ^d`r!JR(imf6m$LIfKOk*uN6%{FwD0 zKN5cBRUYot)civzawUTMSNhOFpJl8{;E@l#xKz!J7?>`zx~y1g(5d_;o%( zA;&VuTHX#e=J)5frYaaKJE7gk#Uk63DXpOfODSM}#meGLYxoi*ww;~kz#CE3?#7ZR zzEtzF$i!!`ywdI>%?kq_mp`1#^&P1T`P$WY!;pE}b82hfxJKSE9THzb&u8 zAhfLrC0f}t%kQnQh|_!x=%{OIR@p&TYpblPtPtc-*8X-%&mO`7mtu8>X}GnEkWzhz zE%k?^l=&wvDQ&9h%~X2ZDc#rN9~b2LO!bw7TsW^f!mbWVKPF&Ql(P(mQ_OVNG)ju= zICJ8ghwtOb(o7ABP?b@8M)n}kQBfiYmwuk)Y3=5#iR~dN<~#aEC8u$jj|}sW>_(!~ z#V$yrSseB*CUC;?_lwfh8Jdeuqhlz{Wdt(P#daZFmQnE}bnIC1&UguHrK8|G;=AD! zu*Dn3r)kNjx1yp=`E+#UgbSK832X&6=rn(Z^-CG1i0Xv+9teTEA-*jk{OmJMPYSLO z)a&>S&X36iV_>q3&L=Bhw5`0P#9^vQ*M+}hfl&v;*!zq~%CGxUkM5w?f#CjA(ss6n ztmjZqgcwFr$bo44GebQ(ho&WkA5$A3p4tL0l4}aP+hKXo%ty;GLmO| zMx=U6CeI=z?%2-P=1cwn$B5l1XW-CclY*=&eEROVc|a7-8_c{g)E#c5WpJCc>T*jf zu8FW7w+;&&%szP&r$ChJ9WYZ7Yk2Aq=TgL|@yW(X{K@Rvtu>s9|awrOR4nkI*$zUQaN^V8FN$ zMtG~CFM`*P!~1!*M}L_#BGBZZI7!f|sreRiS0n;!AZ}zaa;pZn$c^fN)JK^|p4Y`d zGQ!kO2J5(J*e;YSwY>h@P$%^~&&;`Uvk??^9(hOMIM)#lL&_x5<7v{0TM`$%E?YvG zljM2*hdh3xB)mwsy|_c%(!yvQ-W4CKk(>tv2POY)2WT*`m(_>qr zG-i&5MVM0P`6?$!m(2A!C@$LdH!_F|MVnTyqRcIaQ2Z?3h8@lk8|aBLUmPNt2Cz74yym;$~j5=mNa4E_#3NW z3G4HjyU!m)RI$eRp_&GB`m zqD}IA#%Qe1CLi^y94T!Y+o9=X&~K$5PxQ~E9g*PU&HRD zd{_F>#oA8HAg7RP={JFa7_wdxZl*>fszo%FwA8#wZEUb9Xk>H|02(jr!F2A`CUF$h zQZ@!wsFQ)*62-XiE}mtOCMn6Ge5a$&WS3TijP%lsAZ2Lmr{rlv>FKxl`!P9oU=gB} zyC*FN9Ti_|PDOL^sJ_6U+Zw_J5+3G&n~p1`jHNP+wkhWi(;rnXnPcF& z$fi}x|GqiNXDdZM3$m)>?bo#VE9e{JaWua~QVI%hWO#8&Nidn12gd>Q3|iJMb1DU> zWwbkgQHw~V2tSczrTP!6O+6MwZLwqZjh`~E?juKt_4SUmvW6l7?OTapOR%C+Dak1c zO7m&IH05bXtNxu!cLHmEs(!#H2wyYD@deouM#o|ZcOhaXDsHd0eCcQ5Vylqhc3~!9 z|1;!GQ_%joi#!U4z}p-FM!(oo=i;!p_jg8Y1fDm}{ujCo!dJihOGV-Rl%*T=m*=OO zzHoHUhmwSkXL7wV$8N6x4WngVoA!G>C43_chvWILn_2>Kq>aYY@0Dl zE<7B!hh%JadUdw(Izsv5I%s3x$e7{dY_<7m;^Xb)FEvwlF_3nDMqT!b2YfZ6ABc@b zkeOE~)6Fj(RGfX9MfUDf!Dpflb1H(XqHC5$C+jNd%5e_<2>6;uA+!rWRMlg;(}}Xl z8ina(y8}uhUCu1VjOL}sf7_|zR8ak}D6cr|>YWvthkKjdl2uW*{vtzsM*-$ptxPgJF51rVd3lrh@AQIT<1y!v#z{(ww!Hss7>;5)ox4&nk#aY2Am!@*a4nqa?>L+E?i(64 zJul*z2%%6H=m}0^K&hlKbAO+Vj_na++)qA1r2Yt8F^{^y92%7izgr@DVwwm> z;>qr>+b(NCWP_d~5 zaCtq~{RemA{ro^@=rgu?S*uOf92OO|z z(~80G8GI2JXYZS)n0Z>R;9aS)Gy5e>qN}dD);kq>=%VK08l(u|H#Tg+g2Qx1`m(Z^`aeh_@>c8MEN^gY*1O3b~y3ApO@A_|HVgwY|H7q&9 z-=)1!Ei`iB2o_+Qr!}jMgS8P93v-!^84oR3Igmk9SXh9#By8QZk?|aTWyMXypg1+F zMhI8#me`C9_$+ldH7yY&`1t%%lj+wjm1)seR#E`!Hg!cD1gMJ`e2|X!MDgBn`(#0} ziK!W*Csd)3@mx{MHm!Y5qU)^Qf;daPHHX+fzjnjpM>0kymr%GuA)iRD@kS|CJcy&4 zc3iudmEZSh7QM-8K|#UcV<4Tq1EMh{Tl`R*P7|O}dLIk1X!-uvVS9_i1d_s*ohFE; zy#@@P*UX_11Z}%wK2Mag09f7|ahBZCp4%a-dbiQMj|TuK^mJr8LA60HSTabFq;txu z$@xG18mdOcf+G&|&Wzr3+L*u*An2MYh!onjzNe)g&H3bB=J39)4#+|xnf@C06@iIg zEwo5YoV2fN7q1mo=yF^RXt2ykB zsjaK-O*WP>#s_=LKQy+>ktOO4??h3>Pr<=HBNDg*zk+YwIE6FE`zlBz@{^=$d;nq9 z_eLJ24$Jf7 zUqz{-umPx5nV_aeh=E5ZCldj$<{rDX;^6=CF(i>xUK{3X`^lU3U-&p!#@1%2=%_$B z9OmK-YKb$;8%n4MN#ha`ossZT*3Zjl?@}P3#1G}MgZA&fLlq<n%%ykcE(^;#;sZf(Mg)CY@V;GLRV=_^xpd?W55ehg3%+7sDnyt8ECuXpLI>%t7AYj9sevy1M<)=OR+gQnK|pv23TkMNJ{+6SRIs z$4k?<`&{DyS9=#pLh5SuWFwux7*UZ!ygxF*7i~U{W8LeN`_5AL^YbtvhL`8Nmr8#~ zh)n01ciZ}0Q6w{|PNX6sBxts@P}I6tkQLK$4f##)Zv>~p8#|?)=fk7pYE`_}hmwEh?E7h%c`(|{WS0Pr>MXyuj?ep`~j0_y-;+4J$*B|)2 zxA0+xzp4>?qEx#pgtV<504wc!X`o%QyP3}OE`_=cscm4WNqA7eZ-eX6$U%`5nkjTa z`}yVo?*lr_$!YzibG+?k5=V+%6B=K^TBXq>YSkBo=yhwt%jTuL?bW==&2>6jX69&T zfPExbn>q0QS%S{}sAPjgm19WZVb%3h=tx()B_-X)Z50AMDmvOEU5~k$88#+fwWH0N z*8xw_(aA(Q?-1YqTCG?U+P`tJjbA~O--&G~LPR+>rocFQ$;g!B;=XDQ8j3VkmnJ$) z9{Q7{vYwUEEE!90N@L;T@!D+npl(LQ#0bFi?nkmQ%%-`<|@V%*%< ze?eXf@JFs1yZDSpnT?x_b?o(=gD;0k?Cp26h){B2yr*nDF4J0H8%QcEuXr_E;n@#@ z?HXeitjIPG9wAM!I}n$Vk?q@>@P3O!n;)Ux!1p+qBMRPx2xch>X5?#8ddi+`{tj6? z3Wvj=d*3v%%0zqn(67ED2%fEauatIsa#3l2jbqx%k7c$8%b+DH^`>`ElOdlIsz-K) z8b|k`xEV>#5fJ~2C%1c}AA+lewsqb8nQaEAow>%|wkmE)Lvs|B*KQ;?EQu4=MK?=J zor*j}TWp;wckpKAwXsYrQAj5yhKGe?TCG1za&>y~w|E=}F=DBtO{@Q`kq17ueAaP+I>`~iR>`xCg#swzAY2I0r z`BuZ7Y1)J1D^D4`hTsS8N7h~}B{UoG77$NCZj!B-a4t?K{NdAhUBXrL+R5((Ia}LXe@mC%(JC=U*m}*7mw?VcMA6-zB8?`q)%=@6lh4^&aT!gX3_hQ^bjP zT}gZB%(-nha-DTcIzy`qgSpOlzw?rh)%pBtbvwF^RbrG{Z~r*iV&{cyl#&F=&`a5N z$I+%Dp$UYaKd?K9U*K0UzpGtM($9fIxYX6-cz)oj6iSOcrX<9Qi1QZ*hzKt)afC-i zeBD2=F`rt#z1x!IK0w#z-a6&Y<}mG1cJZ{PueLinEsBNMa90GK^v$}mdv4KwJMGkb z2nZ0{)SG@zBO+f9$-&2Y+Vt@FHEN}8HQ{E}VY7Mu609HOg1qE>KTA}^Me9hX{CDi0 z3^Gxyx17<%jfL(>(+B>H$67{R!cJATJ*B`{TL$j9nzl)iWEj|T{0%?mDTbgK>L zJ(22_s$3^Pk0bsoYU}O5LHg_Z#+JtOQIuyUN><1F%Y_|5pVj*ddFdNkFjQ4u{)c$$pgH-i>UVvFQVy- zijQ}E8Ju@-LqSwHIy!+(Q2}oPIj(Au$8mC~z;|cDz-IC*pe;@2TK$ALB{>THXClS5Qis|p!h_i3nOkF2TjFS5 z2^yG#FtWUq(v!*l-PAqvj0h43diT)KT=2~CPyPr_cEl)_6qmH>ZGJUp}g8> zX0=N_;*Y`MH;z>$)@jACLYLEED_QP!ua}OGq`PG0_tycTi`Jpz7}_T}FI3#_lFg%l z5!{i)H;G9~w8UgAEbA$K-IQt2T_K-LIdCmRr;HWBm-Jb)5a%ytY z8klyb+t)QU*M3E+RwUG9eZ4^G(%hw|cNL%(A~+7e@ajLL8KVA zltBl+sw);vOh6l>A$=7y-{J-fCxax!^AX{37YGktr-R?CYk)u=LB^&3b-bOXAy#uc-ehMToOAN5V6vpWZLcuQ;NfjLP6~lh!pM@~a3pdN5 z9~c>$HtAC%hYP+hU6Ji+MA^@MThFT&P4PUR<;7_g3jB8G$S_pwE3QV*vM9$qsnJQU znBC={>G!#NkbFAl-|)nQMP!L73|^ zc8_UKW~Ev!;0d;Ka>WHEGrFT3pF&nCcn@v%94y=4h1$w_T*FzZl{0)Bw~?d7pfqvU z$&a>jV_n>=^p$wsTH1*FiZ)5%A>7x0-mzo3J0mNvPpsX+EC%VsaAH@|DqL~)5rjij3a}Xd z6_ra2>ST0{u1)_Vg@}mL?d0U7Eat3WuAw))<+Nd5T+wz{{&I$cGoH>qoWNz0pq7HA z>afe@p6;1%rOIk&=k%bjIy=yi1C(W|O0VO5TL?yFZ+~wRf&a40%*J-r(s%LM>h}a4 zvlr6d(H;vg@8_EB28fIpFC7BH9Sn$9e}dF?C^_;8#6a-7Il6`3G|2AF%B2{k|`+`{&h2H(0~n^*62@^nb!jV2+}&T7OE%FHnr}GHk@{&AB8t{ zs zuy#$9h-R?Zj7GBi z@ks!sj;LUYzU)1>-n~fN=r~1TlC;Lx%sz;Dek+=PYd~S~rwr}CCZ~Y-XacaQn zbU7u-=DA3_co*}TZEkP4$@949_xEb2&2u*Zu31)EW}SKkE@7{s?S&69=JB{L@b+^5 zEc+PytNRv7#`$IKp&&nRWrb@yP#7y<_hKKXLs{z)G|P!TPi8ux_HPQ93OrajxB%mA zU>8Y+RG5rfgiuJ1z6>sh@L_+%yPH+G^xvI2hK&B?ZEnPlA56+L?^^Ckw;)Gw{`H#nLei)msEF8@%HB$9+Wz$ivu_1*|y`jgRd;OhmDlq_Z z8=8>F@ZZn*?}v`aUrbIB=@wYEe{k&3gaBrqUg7toe?>t5+Zq96>34ufS2k#pAOL{; z{&&^LPCbCJq6Ujf@lX0EY6w8gL*+PQ{PpiS_#Z4P683`Cw6x9%UI{m+0CPXkL0uX?3vZJrx*0!dhF@G6Apoyj-r;6C zX@dx)WVqNl)Kyheq-K)-nypPNLVEg1J{A_22+ml`|Bff17YamLksW&{>4FH7QlelH zG<_0|$plma2_fCZApsJXhd7T!!~cBEQg$%l0ZBYv?+`D-;G<2C)Sf&EttR8W5{*Z<$XmI{r_ zL-AT_dOGV)Mw6>1OBT`he{3KypOVl{mTLl_o+VdHv+ByChT@(`;y=a@5=0s0vxF1f zMhS%#gQ|RNY|#l@*-B&I_Wn zH-R+;7_Dub#N4C*9z7Zax$#HlPe5nsBNLIF+&Hc0G9jU@&9BYR&r?e5xv#amsEEQ2 z1_tM6J`08aFAk2D<;7)No)!Dy@%8noAxv4dE%I5-488%q1EFJpyd<~ zi+AVfwZ6WZQVwsiPA1l2v${FE?(iO)Ta65}b4+d=oNk-SEhfj=gbF$#Ow^98XliH{ z6y%ps4qw|bl9QA9c6Y}vtZFu;2^a=sHxMWlFF#$wS zP=7m?QX*_3jn~r90u?FN`svqqn13E%Q;^gZ5GH_Na^Kw8z(hq|QB_V^UP;ax8$st# z5+b`D9eziCVDo9XJi80$@=78YP|eT^e#jgrdiw;JP#eysCO3Z1z%LMPZq3QZC(T@3)>I<@CX>VF!S;X zY&@J^7Jym`bL_to5fy>t$JSuY1b1RqOitdvvZ4ldnZqMO?I2X0Z-np)xfQP@GQ-~w4&@%f9WY+AR9A*_1 z`Abeuaj2ch=g^jtpl{x%QvcXnu5sOOf{vx-)YLK~Gjni3aJO8WwQF-(9%i`+FW_%i#rU=k$7F|ughb98VW7)8_6Yes zaUA@4DQt<=Iz7Vy2#Lq0lvi}WPo-DIs2--`fB)YNoe<^iB79mrVs&SuzR8%Jn%aA# zzboN={4;kjCZG@2hk=dQi!J2HJ_`nhP>opt^25%;q{x(#LtcJx3ynIsw32S!t&wdVfziWnfyZa+3;eb(~u@MuGc&5-_si{a|(%Eif9%+BQkh@AY}CIiM> zFxoOc>5mO02tKF}a86!@TrC$54~H^JSPW%sHplOa`tJRTfEw4Pp+@7 zpEt8zXw0L^StuY>%St&?7lJ>9hqBKCfv7WEz7{0&x}%X(m=uEf%@6gJftzT$t7~X| z-AA-`PHpsc3j11lZuYAZw2I2179)6qBLNHUVe$+t;VTQ}OuQMGHI{~ovw^Urxu@m$ z>@HXyCnLH;dSc?N>(onrmJbH{;V6{V^LJ1XKRvyjkx&>DU1MWSEv4%oujinvtE%5y zx|;b@m&iX$whm#X2ISGXnD$j0AH8hlaC^#Rk~|j*i-`3Lhle&qp{7IDf%4f|)zhm6 zKaa;}Yu8yCenqthya>G8I3hWuE0xd!tMRXL5tnYA_`X3jqP zR5~h89!bP%(L)9)WTM+O)e|HtCW`UdfYxIrp5w0R@@|-U@VN=6%I&7A|U|gqEv=`36281*{t$Q>e1t)r( zm$vzN95>%V*Jk^oh#?@r!F2~)c3coDD>vMz8v6-$Z^y<&dN?26hU8>z{l;#vM1TqN zR%V`EFihptQdK(M+i}}0cU$A(MrwD}YzBCf(LiBsfl=1;_4vf<<*xOrvNF=0-K&^v z5G+bHLyI<(6L?2Q4la&{`ueZvyT-=pKoQgChpvghKrvW&ctrUJ`n!0(|7Zd9vb|sL zP9ZEk)H!{efr7qSb=(gh9zynfE>Sd_&sP87_YzolX#{GTd>h`dUBLx_XsSt=<(8Hd zX7gP#bi4bhoQ`1Sdi40^J1EK)YgHxf<;`_Xq#iRy%Xsc*hO0{4q!sOte}_)DYZzT zj=a0S^EgK5ySuuPkyiC1gsi9ueN*O_u4q2d#9i#LQZkc?D!abxp;hn(BahY z?a7bUQdHIbi*skp3sI7Vnqq*Mo?6Yx&3G)+;k7(HO$iRaxg9!ndbC%@m8Q47J9z{55Ln(zUKT3x-CyvMm6djCYUwGDj~Ak-@uh3xbg>3O28KlVL~o4C zs`VMjKXP(%bR`$!Bt*lC_)uh7*h{W@y<5Xr<(2<)w~+Q!8f|rQg%vLGkP9&Ul}jpcx%gE+}_+xDAbr5Tf1%_`TTpQ*7;T zJkSH8Vw3dTl*#28Pj?e7oLoNR%l%*OUSD55Jl<}^yLf03_&3#(q&evI1)*nL@u=h(FZ_rk_ZWEmx+?4%8OPE8A_1QbfpYGclHg?s# zjwdJi2z1s0BYrb5V4boyq9tXrn9YO?xu4V}1Ys=Reub>qs13**-U;HP$5XbXUF zR#qw~7qZYI+(If*0?J!`aD&Uj!a_d{H?*G};4iMsNX0HTf;}Erc;4eHqV9G7hK1b| z{5vT2{MUVc$Aq38LSRjUn3$R<`CaQx1f9)Y;5H~AIVHAFj}OPl-TW)xM3&PAkRDyk zFI)L584I(r)VH^q6l-%8f{1;--Q{h7m=S24)7FMMlBh$&(=2H$03Rt$kMoOP#z|RE z4jLYUadj)B%jr+O?#(;bx%5WkUiZ`K_4KyQm(r&MgAHrBd$`WsbncdKyJ1`~3uJx2L{=#WtVdCtIn$4kLM@U1bw_&9;@35f+^)x%0sgD9n%a#%co025<4;NK=z z=bhhQ=Z-P0Fp9vY8i6;`=}r&~5&s2jf{3#60dV0so9UVWn8&{Q?5wOTV*FNw3__xj znU#XZ%FLFQnTd^!frW-F&#&daVcr-t!bp)u#kI>*3d%4R-d{FNmfTiwdp*)7IGrBf zoEF=K>@gj=r|hF4h=zYbb#S^Lu2shn^`?%nqvAZPk{hFAn_&-!y2e2ygRoOcsb3$Og1SaQLbWh9TllHGvasSu71*NT?DB#r9Hi3hjotco zEK$cYhvra68t`<91No`SWlb~f*7w>U#5UsFjE}X{4@;$e^@{dh{$;h~9}no5sD3ce z`2(7>exic)c_stW6hk8z%#EE1q&`uYki7=Cbn#%~qMfnK4oG!<^*BdDS6x#Q#~%t>3d}-T zyn203>sI5nvoo*fH~C85VIjdD$qQQ72y6Sm3Zka0@-H%)I@aHEj9M)%@tjiwAt0tU z`uf1FR18Hp#tTEP(5*#jdfjE8BPmnt zOy8F~I=W~p#9^}*v3Jn6{+kTI}Aq&Sb^FtzU^Yqvk3SK#j5f;(ISz??m zO(C(w9ERzgh&J487n{zszOJs=o0*FXk}#j|otewct&K5cM@>CBB+ZX^D@Cy6YHI3v z8LJBSe!V2>m9 zDH!aTvA;w+Q&(9T0`*Xuxbx5mv0a5_sOd` zAhlF6b&!R@fxs$}w_^A}Zg#0;L&p(j%3@_b zoQS0Os4ks(jcP(W1ve3N@y_n9E$t5M%Mbfv9p)q_AJT}l2&l-m@{Mkc0|j|WS89FR z7CIu7t((92>v3@(}u2Z13$pkx$Len(6Nv@D>F(fO7_ZV2Y<0oY~*cd_HHj& zB_{p;0YX#c4faX{Ie-pknA}$JW@QPF?c=#QZDVg6D4&(C=S>-~R+}!`T}!OU&iW;xEg)WSCs+@3nhGT59-Vc}tpb7hn@;qAZROYZ4hEi5SMbH<)^F7SPlSmXP~PQ;1T zJU2D}d^P4EpOn9F8-bmR`4QfP+3QVh2ew(21l_D>W-LROABV1$gAp(ZB`2&iNLTtP zOyav5>Q@}!Z`EAFA_J!5h2<`{pP)2xasA%j0C2UzqMtcY5-eO}RB)u3nZ=YzZnlc_ z_-g<&>#UMG1B6oiZWk9I<*;Nt!QVaj+Am!kpHKGZGs81D1E2~|{;}`%w)XJB!c3jI z{y73&ny@hVI?9A@5eB|4zF$-Y4MkWKjObyI782WseQRH?B^=E;6fM$87iu}CF6woa z)zJ~@H$$|L;C{B=b`yOWY?5y}%j|q1p{g1(LeZBvmv|@;lx`3kDvOOe^z{1y)P(vwvA55w%M_rblg$L zwr$(CZQHhO`>Vb;#(tkK|1y$Mm0VSIUTe)Y=du3wq}D7*^h0>eHGe+HV}X8s5~q;8 zmxk8zalfH{f_3!gb3rTN0T&FfOREIZaIJJ3$c|&KKw8@zFIJeAwJf1?sHf~J!$87* zuEuSZlvU_~M76b5n|m|4Nn;)GEmlPz`ZXN2M#8`|A%o_8vA z1X)WuuX8Qob2tt5%U&-XT~(BHVCa;fQc)Yy`-kLxpdX$uII^+e(KP($M?|&=<9b}6 zLX4EQM2Pc4gQY3-9KD1z6}NY`jaMxJ%)7GgisqQ;lMW_gVk(EG;xM2i_P;sd?|$C9 zu+i+NHV;)!K2BE$yWzVhgQDfXk@RHuOc>uNAwY5TV-bFT`@D7gDl4t!rs5>${SG!U zA}@o^J8NL?;F!+-O0-G(o8oR-O&20TdB^MazeLVTCeVIA`wZ#eViHJd3g9?v;7P*T zIubj!mE4ygtO;H$DZSmC;o!gt%X?XO)CCsv<@AHEcNmU*h-}~*y^jx%Rs&FUAAX+K zur6y5Az()rMWGKn*^kD~PV_K7k3MoXr>E1=+oQ}+xJE{vUE~~)-u-+09L=Bch2G?5 ztjeh^oF{0~ayn(9jG!kr+ZWBN%nK_w?{i%{{Y38MZdM%;OulBNWq(xx$xK`lBCzfUwMQ@>MS>!68B5}1D zwPNn=ukhRr3=RD=L=d6)*&X+%dzN&GoMVtO*xv;#rO{})=I`$BD=R9A7jVLZ<6)c5 zyD~shLvQcI3)ujpteKh5^|`JCP^w2%AI!E`s?kudulcIwRv|k2ve{h0Y`>Y8SFmb? zpQelq@P3w7R&JLkx~i(m$8a4T9^zUzK_*^ebW;8O`M#2hYB4F_Cv%lguDb0a`7FSX zR!qDjx9O|8-c4*JxAQdHbPmWUe&BVo`C`WO(LbyNl`JYLzwe}M#fp<~GlmMpU>)?r!av65_ky#_zqdwM+GxZKF}?BnBCz^Rk30m?c(Lu(;Mta(&8>`qe-M~?omzxho@caW=! z4}*-_E-pT`tu|`YGK_FPcCI*6H`_M?!+gEMy`^0opTlE*3|iXCjt(9`&Cy?aQ*s0o z6e09`c56xUNAov|6th)$MIf-}c_w0LBAI5_WATy+aD2(JD!vyyM#}crT>^wIuV`2Y zaT2x4t|rwrCWFh}Q(#8+$oqO*4U&fqVPV|(KpLTGs`=@zl4eP<``vO@u#`HdFrRDU z-AHDqa}{DCLIGF)QYbdXJ{#-pe$rsj_lP`O8_N?dUpj`|4Xt$T7icnd0zZB4cO&on z0yfeD{1p6er5z0kA=BE--C)1-6a01=t@e+yo$_+98_+w7WPxgm~RUxBzhY53{888~DAJ80SF z1QhIuq@IB%qi%2SzC|k_G zmDE*HkOGB=yStl2S?sFTW$p*ReYk5=3K*NV6;KYBgq3(Sq-!Pt^X+aB^%nD(p?$&C ztJWVbRV!a9faqY%!q_9Jt2Qh|qlL9=crwle?VwXGtuU7hiaeCa`?kt2UD1+DiII>~ z+M)r$&{1G`irzFb^p)3|tS&XPU#-TZ3K8xk%|MotBpTiMa?uq?*ztJ_lfIp=__Ja( zJUxK@So-^t6$7Y&)+O?_co@o*3cd`akg(U(U2(Y5XFl2_N zoRC;M(9;80Xv-W?=Ne`_WBU32@g6(l!Uk%jJ8&b&88Nq#2C5FRm%rleKgE@MC?vJp zI~!jpZb7ZXR0XEaM8t!2nnPM+O{bbQZuVLGJ zVaBr}5ipFz={u4GaX=+kN?6@5RBT~#$3Y|u^Mj6>!P3apva}+$O^tqm+f>7DAl`Wb z#mH5%3odJ#YVy4$ot9TW{O9gHa}ddnVy~EgEKEXHQA-ZgK~gJ=l`yjpI!$0GvSZ24 zaZ_^{l_}kvIW+Bpb*75a9t%nDewSo|`2?Nk1ol*jiWhulbQZ^zwEq-}zO5MTf0Tcp zGZ-Hu3UPY>;bqWVYWS`@Q76@)f`Eh72u%az*wQh{cK3IMS=MgAp=fVl|$!nMmj zOy}{T>EHbR@?ye4A7j~RVMK1Y=hXH5UHcsMBp}EE{%SUp4Qo| ze8}i~w4DHmrHh&}e`F~uugq`wvjYFZ-?vJ60|Dj~(F4G6--t>W2;kg84cBDVPC(*`15^FSG~&=h9Xf-vjn$|>*?I>8AjK)y`{DF zvek%hk`nl_@q8Hz7dx_XzN)MO9~1L^SGBXoXz0(ZtjJKm<#KIBPG{uij!2Zp0ZzK+ zE(YSaIK$t%AB(yJWaNG$tq(YJi&m}CVR4q~_F|xGX9|FqPUovPy5)mr* z@j;^3nuxfvzByP0peO+3{_T}H3f*6%dmTdjG`H^T)}vgIr-X~g*4 z3B(XbBEJp^K4o76Cyp3pY{JqtilVwc7tH~&GN&zo&Pzs;L!*<&b>%_0H(!(Vb9~L4AxkVC_10eQ+$JN@M5T*_&zUm zImE~q$&H6DJ*emcT;AGuhBg0x27%^QfI&bEc+qFBZ(+mFk^{hp0@yr;$Sd^i;AJq= zdD3eI^=3~S0PTCIfz~QdZq=b}cc^JKOaT3l-dpzJfW9BH_*_zz>f$gKMMZ5)L<}jL zM?L{(C1rUZ2^gRJjaup4!gDda$#=5Ff%Q2)Jxml)fUj6Hy1jiHsy%7qXE?9)obm|XNyccGP1=0t zwu-;~w~_H58pOZMUX_SG2M>fj#K;PZ`Q>ZVo2%&=HmyZvAZDnz*hq2F$ET;B`yWjl ztob_5o7IoJ@G? zAeivrMBkmH?gx0if87NH`0I&Nsd}8L9s@UHzcCSv-I!@uiF`V5US7I6#|Tu|o&jzN zB;QOx9S6{8{#bt)n8e=d?C9&K7;jdm4a|`n;{4J04k;B^*3a#-rFl94!P&K~?OJ$6 zZFRS3w;L%qRX%y%M>u9Wx3cimsq1~@(6a4M%Y}@ns=Uf5RQS1*AdmsI?LVsm z{^Ke8=kQU*^D!b7cNSUiXh%^gU|m?s!iF}$Fe$gf+gb}-p3ormE_*$?@t z)?j?pxfX?|-~x|s`|YQ7BQp!Lu;_p_q=$(~TS5U^J{bquL(UZ6BcOaID#2?H3wLC< zX4e{-;_L343+o4m=^-Z3QW&LjgaZi6Un(kE{()O>Z&zoq5V<0R1V=0ltZYIZ+&mrZ zMYRPbP`L&EZEo|*sy(^@EHi*AQa5RQ-0QIFw?;+HjqEj#Q}zBbob&Wc8o~2%1|ahr zpHg1MbH*YQAh-D0NbKnPV$1h77R#GW6)rKM9`?)B3P<<)C=x2pEs@Yz_7wu!nYmt3 z$XK9QK>f}}1?=8;tc%BX`c3%CJlLC?W(m>amFv zk7T!A;@LNyE)M&tEC$}*cICy+VC3-gv=wl)AQsNA%tW5IuBHN7RLmWl5Q!)5Yx=gr zNt28K6)bXiylvE6Ma;yesI5Vowc&Dlj)K`R67(&Mw)|OE3v&4D`w$Wx-p;?wJ!d6m z|IlCUFdXW*&Q??rAL8Fj%)d^8_{il!cY@>gP}n*yc+7tUP|+(EhX@}BV6wqOoqX5k1Qp*k}J9_02b-BJQpMBFa_`#i*eHs z6x6Q&drLy|C?vHBI@c_PzbL>c6OV!MTi%dKH~{GvF(UQR8G)LvqJ%vzk)zrd@8@SV z`7sb5&Yfro!_4BUFTr;f%MZZ+G{^c!qmC61`0kyl>+<}Z6uq*rH5PSEE)p>66=!<_ zh$p3#bVT2*I!609q(SxxFb4TN5)&EG4keRWydv{nw*33OID^EINUo3Fo*2p zeTc!ZUbP|p6Aa{hfxvPt(x8L_ss@~eNJ7WNw1rQnjnVquZh z=H<@8+{#SjQTN6pJiPRSLslZMWU;G*)r|)}7D|)no#Vk~78izUQ(hSv9GMU?F`LEO z$ayuo@$0o#1+6^?cZ%yJapQI*JVKgd{&0sQCdQimOYxsIJ98%!6E7=-169=^viuwb zjqAKRVZ0WyzvW)Hbof6eo&y|wR4{_cTs|iEuUh&+nvWmJRtB+T)i)+kM$Z)v4t9Mw zedvU^V%G&VF-W+I%sZ-ZI{SdNQ&D($mgm5;Gzhhxc43AqR0@-WiPB=vF2#O0LyLor z4FxN+KQE~DqfpSSm*nQg)*#U5H#Y(2K8Y~OHfh!M(UH zY!G=lvtk4ymxhCrgMv7nq&G9Xel5(=$azddvUecL=bTrx zm7-U#*IF_=Ts${PL|_RM;IiV8(^Qw2*IMSAZgT8PY&hXc@^#HS%_^BeXcYL7^owLB0qOwUx9-&g2BcW>@ zo9w?I-*C3&wrA8C{h)IQr)y>Ongp?qS*ufNULc`^YogU8Czk1tz#+In+L%sm3g`fj z6K&qB&xzz1^9%lPMp#_Dyk*w_`Q#^7N+yS!BH6R7_fXrq&rKOfS8ib`YwibZ+^Rqs zzjV6bt8598Fbc1hrU9g?I@WX+oJgw0!(I=V7uUA3rKRi6@$V*DpRVGKC~`A(xsKM> zYqyv>&6AO^Kno#kyo>oNmoYG0i4ik%Ww?80`1R-{!fPnR?VN$CUUf|@ipWK!c)bJ^ z)K=3W{Kc^?j|;N)4DOfEGA{O8?$e^goBNyhyQHaF0HNDd?z)*c2w72tawnv~Ul|1d zTp$tL_)Jb_^Ct!cMf2!&_Nl&(rfYt50*p4{8Ts(8Q0ZD5HLjeltXzo~Kce^{a(s`& zIF;Y$O&(WjoLzubz-K4^=`mSgEM(8nSSW}?J*|>QX%8kK^`d6B1LGU((poabQ9j$_ z(^#GZ_qvPFBqo}}E zeP#w7W)Jf+n1ZS!bNi)vxsPV;zy!oq-*j1G|A@BO@sIfXFrG}|zcFQ-1!k1@0B zgM)#dreh72$kK>{P+PN)k&}vM=VlDS(C-U$&8!~sSR7{fVxq|se@=2Kj|QY>ppBj- zIjS`^HEwxAezI>l<0pTplP$dLwZ;kwflz58DDEAD4rOyl7Z)BHg$~cAn1mzWi}8Ui<>cT{zv*6C&DArvBcT=ZFOx5hTU@Z8#*129 zKE~9JI|y#et~e=VYL5~p3P zi7{oFGpj|tb(ir5mJjUxSEbi29nyV^obS>_c88b_h>@?kBs?^^)9Id;r5ug|_K!1C z*(D`;#)XBkNJBqBuc!SG>PVY2d~76gZ{#=7s_N)ECkkuYAz_MTPVBW1P0~ z6$8<;;&atQ=UC7VT2@TZex!ZKOj}MUo6nIL?ABP=G$fz_kTJ%4t3{TpmwQKI6v8{e zNR}e2iKS6Q z9WggKy7jQt%G#Vr{%%f_&VkkGtMm|j2Ve`~p{bNRG6cZ-dxyq71^VXL*aQX&jsXAY z^*ot|D-zvl1Oez;X{6y&ilPi?afE(tOO!1kRY``*&{^?`%15WcQG^6Xf}B=PIu@E% zcTM$-m`cBra~1%f|F~LTd0nMi9s`&YtV@9)`UMmP{2C9)0+@^1N%@j4^6d9<5R)5S z+y-w*o=HK31XZinewD?#%h+WLq6ZP*JL1&QUlH?ikdgDIgc!U!lc(6Us&zRm?e8}y z6tKv6;>#nyr*ql)F63or{~~2uT#5xnyW|HbMYh%WM}b$(2j6VwLBsSr_xeCZzv&Hs zV`SxZh`t~(6WM7Fi_l25xIFoVfQX-XpbAZVLQ|@&WJ#jg^Fu_nq=U9U&#Nkv8We8MoeEqjobSz{9Sg6^((8CA8_adqLaC!ZsAtr{5x<`@&$MM#PT= ztRhSB7VT+yevYhKHSl@&_#nI0UQyN&@h!hJboP0l1xdc9+@-Dn+MuSiJ>FKO*{_#a zN?I0{D}3P2M7B8q8vA?RCMdr$r2D&1-H=|Qof<>BRxnVLU+iQU`Nclg4DAD4k*1Rp zPSIF{z%)5?&Hc)Sb-ySF=YSyye;|;)@9#VTth0H0$Y?Ff-!y_mgbn%)3X{;azgZrG zde4Q$g_%1mNvYci9F`a~!!KE_^vn(DsAR&G-eCSfo?Q}i$L7R1%$Q<#@vn)dUFchb z7z7mc7nheKb}+a1fB|{vAAfyfpU!RD$;wKoYqi9gdNFU?=f2hm%{I=}$j&!bS(Y^) zU%}pR3WADm6X{oD;-;QQ!AJF1Bk-c4cv%F&%frJMmsimCfw3V9RtB)#GXl)m)J~*W zkSxPKo!`#!olD|k;MjhE{nEGyMRO}CVyhZyGl}XdZ-W|@)u6fANZ_nUb!yFJ`y&WTm{2C`1!ma?sN;WQSlj++Z6AZS%(RFo=vbb+9 zGhv^GiAkv4A~~@~GI)NjE-%j&8f}@LQSDET+74hy!SUA<*-f!s|BMmV4d{aEvSJM+g?`y;Up7bvz~-%bPJ1&=W?%=>dpH6fI? zxuwM~6W_YBv_CZyquCvyzJ4^Yu=fkns`?8%dBZ$T=zhp;FY9hYHp11Lviq{)YK9V@ zV2c9}o-y9aLt}^qT?5;W_V)OA1SI)IT}5vlOS*#O{y?HR?GPri3X#%MlOXMyh?vVV zLfXnQgA)64ktY_MqR=7Vd)NEP2h#&ue<>R%?uPa(?xP))(eiBuXHA z@za(&*iTW9bZ2&2cCH>wUs`DCNs~-+*4U;_9|5ue41QQ>R3wzM<8xmYT@B})ditoo zExEqVaeRdEygC#=qeO{H?;^n&aG1M_w#S|6xew>Nc_A!rRRVnXjIP&^&F0_Rq>x!e zxUE#Hy1?K-`xi-H`EQsu75(Iu#H)%YE3Q2nc~z&oNM8SFM>2u`#eL z_Lm{9vgvPvsxclzULe4MQ=~br{>wMcNsrY1NwRnn&@Qf09e19c(0C8|a> zgwTXH(xb07HLu#I_}G)BZOrhGJYSC?WR1PNvZm%yIj^Z*TwiWU!(pTN*|AV%G?!=I zt-M?MqMiQrUOxsz7F%abcv5c07`cZpKs+U40d!vcrFdXRn zt9frC)K;p)jK}L=-p%b291E@mCtD-d{r9Bg^mie;KXYu2mvvL8}J_0h#l;Tm~pXx@-<*a_K| z!ofDtjl2oJhqXQITkBxJXlN1)2XjfK(t6y`bkNb2jL)%oF;>cFU@+`~NQliMFNEs* zZEQ;Fx=f>rqmRX(iB@~3UnGklfhZv{J$z`qwAM>)m$mPM+v`AXE?4NF zsP)Wvg53=d+dNM_*>$*3!H1vV@__I!e5fbLA;E7mVxh&qN%(PNZG`Cwe?(%Y;$gU( z{(%T<@6*in4Kr?48HX<0;12}%$0R~XQ@{v2F}1YhVgUn67Zw>TyEsu@rE*gh!96)V zhiweA=V%J9>HeTkU74>kOigQZaXxkdz7PF*A4?Y)g}6QNUcj*w&mWX%(H|@gYEByi zr|Bes0Vv_$THAO!JRqsxA)(d-)lCzU?OE#L;+~n84+7HQA>cVcmX`}%4A5iz)d@1{ zL!H}ed)?WIWFc*m16AbCQdo}*FPQs!@;K}1Axw+~Osg8p)EOSI>6(|pa-;K_W+hWp zc5j@?Z?_szD-tGl+);6)hcVyXh%9?+3oVk?bK`KVj9{b3?8Dp!*ID3%|p$ zUT;TdH5Lj@_@V@I>fJ4u`y&nKEcgQSF`wluTt1msyjAK{C_>yLyK4cTLPRwjziMC5 ziuZ@GS7_;vF{tmt5{m-P`8U?c$q;)zc&vSw_V>nfxy6DHsm41(U-ww4gx-PfIEVpb z?|^gwL_na`n#YeUVM>&`Y~J&*i&YlV;eUCS*(iYrId9=gyNdsgbqQdAq!`dAL-zFh zz#-yK8d+>q&L?%_I)TpO;MVEk8WpOM2+X7G%?KnbRiOIPX%Nqwe3YVd37LswdHBi| z>b9WVFz)c~>T?Q1MLgKOjVC9T12C~pZY?0eMy zM8pC!*Eit^kJLU~ZkB#vInVAc@?U+nq}Llc4v07glto7bzekzFeZKjwYWD$u^$WY1 z!+>YC1+6CSZXcJsLDB0yjLr*FS3*5%&44-lVst}Tj|c+YLYi2S4TzY`^m4pnXXn@} zA(UO^ew#gZih-f2!<}(rXO2~^GT63gB>Iewltb|K*$5E|Y@!U8u8L`D(HGAzIT-8@ z4cNMk;!J*qeXkw=^W%r4lPp4HzCjbLIy0f?Hg{7I$JKpZqXQdKX)edyC+*tVmPZ5WeHIO`(tvEgAon#`6@5=p8e|uXEkT1;URiJ`)o)0B&7K2VE zu~Y&J=;`LLpdlq@r3g=#Wk9BOTf|xnUpx^6Qp1m`x+QX($FX*0dG*)&-8)hgL_nXs zgrmT^ihr>w6FZ55TYg6}b~C}7uM8e<|6TYhc%#xIp@44+7E(erIj~%V5>`_7P^w}) zzoJtt)$=n0XXah^Hhn6S2b1>Xrx+A1i?QBL#R^r}yR1ihvvY{cujO@RP3;hvup=KR zODj_#JKX$t5%L>n!vub;`E8=5J^Akx?+P|!E6U&p9<@%tc)X*axNaa@NOPk$e%tq( z067CiQ`jLX=l>H~_rW0mx*^+c&5HxKs&ql|wJ#9$$f`wycKogvJckrmUB+z2Z!T zQ}rCP%|4^_(8PtgyT~IF-r6#bKpiAPvb4@8mRRukZG(ZFvsC=@+eFFR>$xz#Ro4ed zS3_Wmzm9%I-AD_iCP!uQ8G^JH7xWIi zpVA$-IRuVEByYoiD!`WpF^o_YTBh7PZu1w36z{lnN&e{J(4ooQ$Hv={!z!p6CYkGYQh=n1M}+Iq{?<9S`t$z-yP zLB5g@xm5%DX_RAF`zCkFkuxJ;2dneEgv0Qiy0ZKrMe02jw{bb+w(SE9ETB(4B7u4$ zktO6%9iI5sVYnzK>ZV>yscwFT_x5LOY!sApHpO3LpxO^+a^w_>0LxXY&9g2jX{kq5 zcOOOIhY;4kdwg>K?%9p8Cvwa{SOLIPkrx>#95dG_727O_KrIWi8PgH;cMlJ}lN!qyPg-x4cVd_^ve zJF9F{HF2VxWs5TngzL2fM>=wrc_;B+^oa*+~1GZH{l8i;Hs0 z{IvC8L*JpVbsCKw8k@YKrJ&%ADMgo*2D^M#5kX@`izQS|?4Dx%K`c@%F)&mEwUU$k zOu{#b=m8704D0wI4q*aW{Wx|)R6TP#V#J>c5p8%XMMH}UXj zpWam0l$1~gJknEc=Z_p;LuzR}9WrdlVUWk~HGT^{3NrM-Rg_tD#!q`ZB+rD)$I^e9 zK8Zrf=HCg#r}3P)khI^25Z5NT%bJwhwJA_n@Z?jOvPSJ3j>O zUL9rRWe*ikO9R2{5L$316^|$;>E0U>8oOsWa|cyBl*IGp1tW0*OxOJv7dT zv#>PdhuCw8`(xRkwhKu+X!&e)m(@Scotu#WL9RwQ@2rNILkE< zsuQ>byh04K75IB|GC9R@B^2lc<_f2d)SNo1B^|TA$I$f2UIAcT&QZ1Ap36D>b?h!)WLwqf>`&o&f6P zPZN`uLcMPiNg$e9NwqP<^>Ll_9Rvj!NnYm)-js&SO#K1w3jr&*FSWOME0wyYfn)zjuOg4{uCa;*n zYXivF_tJMnl{Tx6x~?vas+dToS-GfA$V$yFqqiW4t?p?E(GQ^H0e5giq1W+wwQ8o* z-T84?A1L45aT(&&5+ZYw*&pBL!+W`jnATe7&lQWEhkYqPrKfc#k{+E&{N=~R<*?r8 z$Lyi+@nb-T>vt>Q0gE`k!YEU%C-wp@3`V7jgyKr@p*lit-6ta@2|6pekFlblZ85(; zJecUv710?`Nf%|B&6`MtYZG(^dPn+E%}`ZK$gWWo{vh)D$G_Mdf~eN7))FF0A%p}l zNW4J)!qkh?^V3Vw?@HZdRf{mqG2Yds&b}C6t5dz(A4f0yQg+gyv%^dm2AMJD#AFcg%croDn!#VAhmlA&MRQJsjYJcGxJ-8x@Q7SXN63 zNYgmdG=47{b$)#&Eh?0jmdeFxOJfg>$ANALD?PnM^F+mAe2{?ytll})rfhR*{H=(rsyN#Qd3d7&Ozx-?IIkXtI6!=P@qS|2j^b&4kSMf*B$8bKS%k^w9o z*=hteu92T!!u;{70K$w{LVmX^Hfpamcztx@j$|DtX0xe;tysm({Nj#9!kA!cUvCYm zK>W|FJR;KDIr`5%7U~D!(r$~2e2erC_?eFtW7^LW5e~bD<&C{jy!X=Yioz=fyWdNF zeGO!*92FTor6G&<9O8xy^iQw$_fuDZq-MzQJezP3`R{z8vd}k2e`;3GSME3pP29f`I`vAYSjZIkH4jMw*cq$B2yGSb&Gmqrpn!9FB zuXOV7Fz){tyFh&a*Fw~{f5y|NCnw$K`1qK)15!vqENV$vRcDxY?B-6Rajl?TLdlpE z1_evI)ICIR4o@sZb8VSg{s{Wd_nNu6MLPuIc3_UId?@H+vC=Ul&n!?;)Bie||G5^` z`u{wM%k|8S1U!7?0-6y_$i)18eO#TLl)JvPk-Dl|T0ugCXdLZG%=!5_B4chwtRAN( zA~Jxx9I56Xm6E7?nrb#vV{>_#*}`$eYaB-=+#_0US2<3k?E9Y=@$c3-z-v^EjHo8#YiJypRM=Mb z*OmZ-hrN97LqtS`B%j?*?qQ&2DCHudHxqEzD)t-y-nxj+<3bbQnFUzJqEfMOU`-)k z#*ey^+c_UFzFw|a7L-*~2zYRp$5tQG^!HGp@9c6kRmTmZ_YN;>%pA;gWK^uI5TLJC z-OBRf>~;dyzg-4r{)YvSlhfn!O1Gss4+#hJgaAD`#>>XeetdT1wIvkQ{xzuy$W!BT zce#Ir8vY-PB48x4org6*f&F;T4BHQYbYwFJGP9DaYiR5kD=!L z0s;b6A~{`3LfX#8rl3NHKn58dE1}l7BCbx-T#{+#&vR9_-Zki`YL#?dUBi#@uIzKq z3JgQRT-JOm0OKHl9qr%<9RuB(jg*=gz%zh?k{HRz$Ozi<8k!pmJNyLl0U$F50$vgh zj0A{waGEYLvG6zBJxuuJu3MOje0_zE%knDF6n1w{TWLMw0IbVW^!)>sc=R;QIg^7sCPQP5$K$GJem1U->qJWx}e132- zr>2{fVq@m~o8I!{Fu55tut`sm95pdxp=~K_W?=Dlv>c(W)6?~6R^?e zwPDni?I{4qucNJb4}>;ZjFuRd78K zwl@~KZoI-FaNh>_?<-gSxeT^6H3P)LKHC<|XTiZ=SGwv=&mwDgiM2#e(i+*h+KxSm zhDQJ}09HoM*ZCU~0O%x&=OzM9vq>O}m^hEka!o*ukaLKfl>4=R$p9r5Hv>1O-QbFs zn>89m%EY7jmoM9SO_e7I8Pr!;aOg_CgPVbnhmeQ1mi}yBlowh;d%MR4-Z=n>0>(t$ zY|YEy;vnVjn~}kT3?QBW((_&K4-`3$Xa@y)J2AR$w^hGf4Gav+b;Cx8+7>Sz~KyNlxZYHY;a!nc3AR2rLcX6}SG;%B!7;=%%*tx8p^tjS~#S z<=Oe}1|J+LUUDMSjX@fA@c=uWe#y%Jy~i}uBB|*h#CB%G!)*&5iDQN-&QYZS;|4Ab z4S^m>X*eB;>nbBP{k6*LO8{Wt2tO#3^~7)>6p^3#;&ZzKQX8_#c-zZ;+7w{+ z#iJ(VM?UWeQ_3k-wop&hOkcKfan#v8BE34`c%iU)k227-wF*t83C$%9?Rb*8-*mge zYrbOR>fQyW2LA3lz^ytzu(`3qWYYQFt&_vVxTpfqM!%(1U2Qyc)`g8p0!Xff6;Xw{ zE#cPn8y`Jx0DcjvQWQTg=FG{S*qvS7`#VVIN5>bF*UT=P=hNBK=l!9s=N{MEmTQJI zQm_t*HNq0AyXnBGLmav6$H5Q2-Y<}eUk~$nvYu3Q6lGPa1C1G+j)qH<7ty(N9uH}C zN91_xO=-@2mQo;)Pq{=-$c#sTBeI3=1C5j(014Uo6@YEk@u)dlwRt^F62<3oc^{(9 zwMB;hXQh;->+PV-p@9Vnh1kutHAaYiqp>LK;_R$wo;?zPOz*snu;RNvZq)6#HNgFY z4)Nx+<(Xkg1vpc>ZrHwHUgK>~1aEf>01LFL-jBNaK$56+u~2cr^LaKl465=VcnTI) zXV=*&Oo8%mcT@I2Ktf4owkf8PQ{vn6>zk)x&)uheVsHPqHnBz^pQ@pyk3f$rIeaE=x>+bWh3B=cr^^XUv>tM$;{vwm9N*|m3 z7&S0o;bbr!^|0SgHnU>dNAcyVo3sfR~ob%gg4jVVNx%%*<9cuj5Vd zOCErcedp*3;ivE=9-n)5T^$I=(Nwy{pFfdl+zYI_wTpZb-88}nNaR7c%Ff9Q1bG0?w4UdmdZ_{f-2>Hx|&?Tt*2zKkP1= z1W@&JXe%Zr*k!Awcj$ymUY?tKrfExe=qP?{9=8)~yV@wl@1{#07afnu?=9Ju(yNlDN5l%o;zuT1SX zC$D03bF5YD($S?M!f%TwNp#V{1-bxfb+$h-#0Z@0^g{m6NK}h1?f<@c0hu97(7_l& zJ$RLbq)X2$S#wq%-vE3bo7vujG5~~oDw8|3CU_^(Xp#z#xL+*?2^AUqteNOWu06M- z;@~|+aU?A1<@pt0;Wx}L5XRah75SE$mIGH4N4{s|%X)1~s)mST4T#nDm|15=IJ5C!5-Sa} z{Nlvm5#1UM4>*e@B?NTL?dB*i^@zbywm}?PoG+={zE?x^y1`2_Osq3?R=2THxFrsr_Tg!Rj2jb|R&R0{JFHl*1^J{L9&aql zTx;0N==}6_B=4rU)8%`{5Qk@ksB2u^3Gqb~5f-(vJsD*o($fWU|TP<{v32ZWhzIU7ri+zRsCjI}PIH%G*noPB*`)JkS8U&2K9a(-2RnDHchf319P_ zqmokUDJe-kw$reqDJnKp9}@sfpd0qX&C7LdVqNgF)t5>Y?9z81=+I-YOGbYHOV{l3*XZ92orqP}i>0;x0W0ZpaE z4HZeHea_cqk>6Gj@+HwUu51G($-9`I0BT}n4C?!vJGTcuuk3ejs@W-@0m-#3&yO52 zf~>e?;cWuuz^p-R;vc1EHR1p-Ig{Oth^X;tLKxSkr@Nx_YK)W*kkbmWw#~K4OlL&W z`9jn;-q-Ep9*<+cjz}TN8iqX(j|13CisAjZsm^Xz@A%55Hj_8auZ{V6f7}eIPAg!b z0q%1~g#~C1n4*PuRpFrf5%Ik0LE)EX@Z!0O~O z86IP7Q8%I%jE_QnaefDuQdMPd+v0JBLloq6C%>&oaxK1sxK2xdT(~%#JMjLwyd3t? zy_s0Wx8OpfF>W6YmUJ!%$7Fg?P-<5`=bT<%US6LsUMCqWGqvWq(NSfs24Dkvl=~F2 zA|D+qz}EuoU|#2!mP|hbtyvp{c;6KZurRk_O{=MGKy5-)%aJF8$PI^nM2U-16CkDYEUw%xIf?zm%H9d&xn{mwgcKQr&A^PzsHu&Zj<+Sgj^f3cBpXOPa# z_Tp@zr(pYED+Il={C)Yd^!^UZ$+_|%O+9Or1OsP2@4l4U(-Q^zA>-FU+Y=;8T2rB# zxGQw%7TG11g5yB)dwrF8OUx zZohmsD>cnfN5kWI&D0Q&hZYPS5nMiwUwU^zoKzkeJMU*^=M=2k@nrGCOLk<%!)&i? zZ6inCmp4i)`=i{B;n*3)*);m5J*oxRa$R%RNOXb_Md>1ZJiLeBWhZVP%x{9fO0P$c zQh9^O8eHE%bS)>4Gczqtm!THFmboyd^dc#wZSw+2V9ptz1UCO*5x#^-{0L-smL-G+ z17GJ2TBGjJ5Y0gNUH;M-ZNkcZfN_O7*uT?kqu2ne`<*H8y`^TmVoiNLd#!UWCXknK z9A|Xnxc;&+`7*j@?K0k@4OCM(3jI1}>CUr60w*7R*CeFv8aa0X477zW#<*}gz*Z(O z=*AP7sR=uaSKyA3p)GZisdp*rx7Ro?d|R?^8bhxdOqGV;geoU|C==f8Ev}wYE*#VY zbx+B0=A&7iniTLXyGa*vqI8xe$`qUC4k!XCWUf*xq|Q?B|D1$?9Y800bQ*vV(R{?K zh@XN}wBP=frb1u|!5#Kk(G(4_LNxp6>uqo2OMx=S$UaGqMM=%8oq{7!j!E}o{gPZ7 zJtNrg9zIFAgEaI#tN8e6a*{R3LVqMn4lVy36I7^c2dE<4OY8W;U}$z8JCVe-`nP&a z4I9SG(}SW4&o73CPVJr|%GHKJNvMr$EoliJGAQcV-~I!~e!EM)u)03l57D9e*`t!= zC}z_o1Qe4PXI;{SPN|8>OOKuOT1 zKe~1$E&pSWasMD($Dp;*{wHDnHw9?Z^|(Gp{{Psci6N?UFI^RO>{0oWf*I)Ey&M8` z>wc&(OH%&l*pLF^phI%WWVLH@qbf>MQ}cE0fFasT0EiB_koF%LAt9fel$YhB{)|GY zKB>85nvVZ5Kz_LY{1aQjN~VWMnG!Ts&hcMug91T^f%K|Th5Qqs%zTafGZ(vQ4e9as zZ};|10p2Ypq{)u&--Ap{2H>cio=Rm&{}%antjg{D`Wa=;RYghi??cuZgxZN0Y90k= znuYdTP5O{ z)y(PU^wir=4sgjv&dyHD%PI5(55Kv-Esxunn%YuRW9Oyf<)kvtG|Y7_Ej`^yr}1Tb zt7S<;=1WT9zqi|&g~Hhl>dc5a=9C(wTXx`p`^i+Ks{}DII_i_u4rX}m+BJ0y*Fn?V zKR)Tb&is5}CbDs=kNUet4~C}SqhYq%KFybU9=EHiT@w~I{HA08YGC#4?&29SAd%&QGylAt9GWSrsNT1zoyYey0QISYUlxVl9fA*vk9k-=P4kL1;&NYtbNg07Bxf zr@Z_9nyC!U`1LjO+_1C%pO3|Gg>O`&OtbL`3ChK$Xq~;Nv2)kN1tB3Ib_`M-)9k`% zG+c7gS5(#!BrFi<@bJD_{c9p}XIH3%xWGz<5IuinEd#^U_V)HLIrYG!v+nBZ4`+c_ zqXyf<|6u1EqJXB!pAyn@pecEP6@tG!;TLj(XII7Vvdh19r7fGG4nbFVsB6okQ-v3S zyO1FIVm#7Q62{tGtntfNP&~p2=zl!R{EmqsfX2{Y)ACUI+lz4P9Zg+ad^lPWsE5W0 zwsCN|5AX2u`{pmj@6XYn{pr~m_qoQsL-NIVld+uvf3LsX^u9*X2tR$4(JcplgauXA zRr$P58;?pYFKux;jLl%kApg0}Y!JL#aZ}K)^>lR)g|H|q?|sfK?C9ta;O7;*yF_@v zVRG^Gtg5MJW?_k-SkD0er7Wwvmihfn34n`fw_i5d^DF2E)RX%egCpGI{VHFEL~ElH z`2J8REh!!F$zaShGylFG^rx|=20=;qZ+e3mM9`n}M3MK=h5?7qr@#IU#r?u$E<4LC zy{88UQC9FN4{tYt>8a^=r>XO#uQVbbzqc;qK$scf-mA${*xw*mJ>!UoDF362U-fl$ zpNrrBa=;Y?ogs*c4OYS;y)P3q;fs~k&xuNFSfDX1`Fvhp{w&d6D~?nHFS#gk z$cDiX9stWIO^D=rq@~q&yPWHS2jtf^z|Wi~B;@C~4^$C?4GP9*`qEY2(g*w{LxPEe zH8P(Aw7+E)4?042b&rew8aY?2XsLg`p=6-lunG1mhQH_Lb__BauEJ5pf>n06&odSU zYo&Kw!t5kmsc&f+9$klqkoM&DDe$|qAiwZ*40``VbhFFp_dJ@}*Bfx}+T0i5Uo4t{ zoUm*)M?Kz2w;cUA{3k-Ex~viv7UvQ`vwDrv`4k`W8DdrN*FG+E5q>;24%AG0vHi5u z1M1`=Aok^@c3c9jmjfRj3io*wjC$jk$Zv<@X;VJ_YYL$E=ZFTqi)4k_sZ5^JDtct?i^rW=HObjfJWUwxgkGB)=ytzWYr=Pz* z1*~vzmI9^rqugvNT^eio ztheIbwP2uoecUN!tsO^oC?ytZX{oURpD#0xj~Q_0G0-Zw|BN`Tiiq<69T+%>LNVfX zgSW*&M{hQNtzJ*#;Q;|VXm~l(P6hlWm6YQ91N%S02_ttuCg&!yutgXI%^-O5_*`0p zihlhPF&WN~De{>ZfB3PY`!}}mGdh?bN9U&pL5JvJk*-$y(f5zDL|O=8HrX^iY`*`z z3IDkB#EHtWi|v9-fmuoUJa@e<)s}w$TM%Vz?VzSFdwD6P@)rdbwgP--o--1aSw+QZ z4MHJujph3Hcki}JQYVlY{rsF!l$7-SX0Àt0x;u+@ms$KX9vZPav1=j)1$#kuAki1obFx+qT{}Ddc{6dZ z2$_cY2ndDewzm2P`X;3Hr&g+MR>JX|o_EVjzLT^Y!^T{-2bY!flO+w6Q zuEb*6MN}!9`@kURH_Ev*EbJ*swJKpaYR`m1cyXrp4)WEn+3K=*17f|NJ2KEyIRe*1O{Dy$(7rs_Y;zR`Vuho8G~tf#wsL@~JE^4jkE zvmy{Bd>uxVNOFK9@@nemH?H&fW{}L*w3nQGW}{OC8*R}L8qg!WP=Gyjh<`!goZ>t= zyquc)l^ulX>Fi#&6rUjw#^Z(TV3>28MR`ASnOwUOqY3<7_j7Y|Q+D=hYjb5~Uj zcW4uYG2UZ!PPcQE3GoIdx`I$jE^}+BPN0N@n}AhPFlU0nrv9|Nf*JMLY<^~3Y0UQ6 zdgr{q3zJ$zt&-XL(z?PpNRFBVpVAnZnu7O?8?cEqK)Asm^TC z#1RWL5uTWwk{y0Oyu2KF2GzA!yWrtzB6;P&fZJ4MvVbNu@zxR`&8(cF|K*ugacR`^ z74@5{4a$UJ+twH9n5sNN^#NJ-h>Z0|Hvum#b@PKnb52xja}V z(>+w>Vvzp7+afPJ;@4W+@LM_@#nnQV!9+obiirY=Wp;+o&1zmroF`9BhdGbp(_yh0 zD-EF@0)t>_nw@o^-9t*1i$vt_*ZcdeJVtS()J(>Q`}^~=v$^R>PzqErtAkX8CaRCH zd3hO7LqUipVxZ#065MExFoKVN-pszFx7})e_BFW31mZUGu;x4C?2y9qLTMsK%kN{7 zKqXn?-ie>T3iB!LQ~#gO8Z`I=op8oTiZo~`Nz4eP$(Ze0u*TQb$r5<%1jP6`N?m_; zK?EM^X%@%J^%&NN5lu*ei-=HQ!2$isch`ch%QWoie93pa^1u>!74+fYXFyOuC@3g{ zd^u{@>h*I@CE)Fw3~^A-7g$oP1xU{+X$Ud92%j!Exrgs>b>G=M^C;Zo6EXDmfP9_;`#WUFfbZF0R$n`3w~M)&Wbz+KEtRY%J{BokqB9zV+Gfj)9@*|z@f z`2VSHy|{$l>`ENU&NGrT>4{U zm!~JttF0~n*Mq*3SCpkjxw#ZNBX*t?ubc_=$lR*7&K{}Rs*;5i^az*%33ad?Ez{Gz zUyy&Q`z@W>s`K3Kb6NA!egH|pL^nP+E3e0;teb|0SfHboi~tnr)f83x@Nv4>W!e`5 ztx*JryVe0JQrtr$)g*(g!q`OUouNQDds^5w6FVn=c7UL-wFtQ57<{3jD@}vOcw!z% zbIu>sOVKnoD1F6p1?&&orDf*MmODE$N$6`hdSZ8h=xA6+6jx!uD3qiW0LWcJyA1T+ z7l;IW^+I)#1~<2oxm!0w=Htsgo1Ik}SsZ)>xd_Y=Z-GjxSq0_ce*wEdz@!Sm32Bai+mdkWeCuyWpNYez$Urm`Vp@KRCJ z)ET{R@oWWz+IuDvglHJ6Y*yuek05QTKRzb{pHPrGMY&i(p-;cPvNpHs+&_N9l_(pMaYP*J%B*XhNC5Y*B$5_K&eQ|p3&x^`n9%_Taz~G z+%t*oX=yPP^1lU=0mvvY6=?|04+w~CHcpZ%prqI_&Nv{A5(A2u7wUHA(1=$v#pTD~ zSvSHTGPN&6bxC=4B|rsDS+I^hU^(adXr;LXVPqfnrNFDZJFT?2{U^-&g6qrJpAxBc zbX@Tb#n(45)kunVLxkuLL)vYHw-gIa``rcStxT-b%X$+GuJx0a{+$EXciXzEF7Xx!-q?6Yd4K2OLF%D*&B%6hYB) z_KWB~DAJ7`6)XI{6L-I=!&kbuJMhe$kN)}@BIb6&QeRbV^8HKf?8Y6L8q_nQ?Ki2j zZ2N$jj?9jmI6b#1g;<4Hgr{oj0E+CK>A@&R^WhyaBKMpcP*k+F1{;?K*$ayyob7oA z@s2J|x1OKp|QEU=X&?*i#kJj^N!jQ>eGeZ`LXe}IB_xYWMqAHc6(Ujdt=0(ATDrG zOqy+>UVed1fsGAL9kz=^kk;(j2r!ZwVvz5I9^1d%-xz=Hd`8YYVWI+Mr^Yh+wVzXl z>?GO!*~|S6)Go=TAeise(I_SO7Gxb%x0WT?6Vy_?iW{AF56?JYYdyJEu>$%6$__`9 z3wCz?1pKM1n+3?o&58Q?`gQjO^unEl#dLLc`}q3Y>Car(D?jcrw|A2ZAcKVn4X$nQ zQgWJ2J!V^so{uKaDj~so1uZPEO2th4TwGtD-i(4Ehet{lbulUKrG_@f@NpqlE4^h? zpn?7Onf&jnKWE7QN(GPf^z_J#Du*KE3wt)!b>Wc!JU{Y$CU^P+dl_AqR`4V{@eKax zKeV(k7m7f_!Xd&Lbo!@9!9ta%>(DlP!db#Bit`p-qz9HT@oHe)4F$<3<;`nf_i7tZ`#-#FU%AIxe3|5Qj11^ zE#Rdy{S@!Jan_PrKLbX253igf8B9&f&k+h7o}c%dT~Y6NWaoQYe3pFc9ia4F!UW7O z{vm;m3}-g%hR2R#sqC)4pShDb1$AfM0zNE1!NqQCdTZk*vSN&cg)a^LpGT6Xno}Al zPJLoCy1Tmf>Z?H(KR(`n!z;6FI8H!mdC)0EK1TSg*Kj*BP0V(CADfGsu(h_$D?v@gJC5jjLbz@C<&70?laLRPkH=4|jsKv{ zmB+8N3@;TcJ=rNJ;_J9Zt#cOD@qUJbqHPYrUp;n2t!p+HV1u^+qIj&r#&n*l^ zOXZP9zkZDglOdz0;b7wTRF^d8oM-CgJU&&SOF|r!fUv}~=yKgd+^IhN#=y#0By>iX zIYdr=LP=EvTO39K;N;;Jcf$SLKcP;~z$`Zugtdyzz=zq*&1cTS({Y=UC1`S2YWLTmkakawlbx&)^={V(X zY%D^VNT2h833V+9;jX?lsK~DvoiLhP{eDTKCgG9YIjI;8TAPZInIdG=nqWuP|B)Nn z8S1khIs_cyb4|J;lt^!jcU_zRrDFNQLde=XqbO@O^QsFy(<4pCBH|Pr?ASCDls&j9 zZ6;20Nuv~RH8#7w%)v;`?>N;;0OKItSt!&a;w?=#J1a}m~nxSID&)t#)gi4SCZotJN@&QicIH7)nuzp1n|pNUYg7eoyHV3?9u zXU=fnn4^;Ym!m=hY~9##kCyG+zm_K?TIfYdP);!VW{L! zeQlmuQCPR3^R_oMbotvkoJOjzGnYRn+ohS6D`dNmr=>@(rJhBCi;H+;rk$9?CpBdM z5-B`}rLChO)uf+8;KI4LdiQ+CFf%;~T5b2a_xHEwKy-I^>0QH$7ULi2AIut3SB0)1lcTch zhy4e+M6^EKWWv|{340tdD3H7jTH3dpALNwG#7PsK7W&(b#yLeKe)7>b^-p!UnC$Rt zE)LVcBu1vjOU8_evY0dvBt14Qc~c?>*>mhMqKvG^Ab^D67~&H?5r-dy#v(zY2PqEn z8bb?mRL-Z~lBNzS)tuauon?*$KF9Qv@&hK#$#k$PIe1xC>tC#q;Z{ z7GsxPf^Faqtag^(+gs5LWY0!kuVjD|=>#)|*}wx>n`)4TCJf_${Ls$btY-s0jN4Jp9Cm5XDXu;5Q)#>JcPf!=0hhyz@+ zC<~NW6E)P~kadn?=BZ5$wMd-EJ+S)$-U;i8AVOX~{=4nv?b$v-(atZ$W`pQvmnMWR zUhd9ig<|3x1_p7Ij{-laeVFyy3ex#za?}gL+^FNod#b5Uq0ES2N*05q#^4(hCCUsW|iUdB$I~#QeTFESqg_ zZRMuIf)% zM}Z<&Y72~o=5wcA9gjmPc`+%XHLmd}s!2Txs!mLz$WMcd*x4yCiX8HYDOrE8k+Rk%!&r3YcF4Ls<#bqY zt72AjxZJO7)y91WM&OPfru2W&L89T4a9|&EiS!{fN8V1a$9BV?vI`-dr-e0KLCd+F z<=1drEbWe`w)N&w=hwiZT8s;hI+*JKIt z(yV$>Ky;ZHAhXKX)@0>DK=kL&S1aF>LKpnIjd7{!c30^dJk-o6s+t~FP`HUt;AI@q?QxrFSr0s z%n!-v{$!wV*~zATpCP#n)7KQ&s-70Rfho7_RQmm}G*USw7dfDKSn&iW?i3(!Yq}%n zPwP@-n|5_=cY2DV)!>zU=wj)5ct&4&7TJ+e_(IL9teFbz8D(O5#(OjI#6eqsq@F1MvD!UDry{A_QoNjS@z3TNoOL3q3d(Bm%E@C|T9?2BkcukSp6xo4L2DmBv`}Qu-9Ubp zgUIheGi8&nK6;8!8syEXiKNc+0X?kb0mx)Ju-6oH!5D0-aj8DG|JM= zW0(kGNqp)?d_geNHe;6~3yp9;!*l26TY6jikb=^JOjxy*CEaUNL>`Md-rwG%RHEr8 zrp?Y4K{+#!T`n#%E_9<`Z*MPNTGOQSQ&yK7Rs-fS0x_#JJazlsp2`01IVi1ZP6H#f zk9fqo&!Xq&_l}yU`sIs{`!AUVN`LENI!0_1mYePz+ki;4Bt^U|FxXe*XJkUwT~E)} zO-oZhK}PumsF0ozFi(PcS^cWOJY(K~Eg2s_Ul#_Y9PC8s-Gh_y(oApta>3JMQ;ZVb z#0n(dtwvtg#hks+(I~}jc^QtoW+$&%IuNP`TM5T8tb&2OPeJmI944->)*Z zj0_6f_zJq6ABJ$b?ahEpclY^tUPth)JPljo@iAm(X76EsKA-_r-^ElYW2?-!}Vp4Wmu`h0K z8q*tu5`5q}^muzA%liu_hY;68EZ^hG#-bqw5e5n0D5;Tsd`+xMbRO+fQA-EjUkU^pUHQf3F+2d(ejE5k@Qy}ac?Sis^3cxfkD{9#=MbcOU z84tX?B81^(UjYD*d%33;*hXU`O4;eWC^fNK<+^)(cvUMz8S7I|D2rgYHf}8(m5(D4 z3d7_j6Zw0XHs(#f2N^9i3F;M?ZfECDBhY1rg7f=pYjn%Ce;`Q}PuWqBcT4C^q2UlR zhg{|g`6Ex_SBo>}^XKO0vV`p%XUgc(Ah>jq5E6@}77b(Qilnt2)|OUR2PMF@)L{6s zc7;DfVs&c4$*ryI39mClxNQnIG$~kQA)YcJv0+OC{ha6IH;2{6Ce6g++g0Sk09A-262e zKg@OmwFER~AsK&5-$%{eJ-U#=1St(2qjSWf%z1o+Ox^jnx_NwFJA;Wk<7Gy@u1r@M zTz!J@I(0#(hl^q7ucrqR<)Gd=LFRd45p@HN7z@SuZ-32-TDEX-H}!M*Br3x0yL`Np z1g3r2z}&xR?D$M7*onx$WDO;5VY3XDX3V6i%gDixOYHVb|(sT2XC!p%s zDtx?em{pMwk&Qa-kx<(fisPsyqejm~gGenzdENF|PZxP@4h5aF)hvvjwkCm(2ry9* z)4EcZaCP8Fw%Bv5KE8qi3P_#<%j0%6HMCs6+0*u5YHR8t_;qRPKwQ5Bf<3_#Wy0d# zYSl}|qqB&1&U|PEokk`HDLpnUP6jf#wPMcJ&FK^6WQwr0$>H~$+#HN!nggYhwp>`kp}9v*BDRY`%6eJ!0wrGW$IzExC5Vj<`R91NVCUmBl?{XD z#Ik%j0vB5$7XAPuh1mDQrT{~*aXkr4VoKNd@cY>w4Yz$jo>(|6W#LA({2Tf(p&Gv( zj|jho@5h2hI88%@-|KjDxQ9Xe;D~oU(8HxbdHPD9&zCMz%{Yhzg;F}+!+?16V@)G4 z&V`$S0uS26x{gVSQ9}RwQIlQ_0&a@;3L7FD@!%ln$QlTl4W_{+r!+uWv{JAh8OARy zA$#erXkx8ri!_T#bi-RSoG=J!GDr^eF6PLvgeHmuMbQhOT%)LGocj!lZG>7V1O&o7 zCGli8X`I)@2w?N}7UQDBk>VNU0+u1w0QFnpFU&!~e#g2AXfcxyv?8&kyR-IM;t^R3 z3xskMZRD$LZG2q94OQcozr#e2zxf`pec#_6Q1d&i@ye`!``wsm@9RZ8m|UWdOW{BF zG15)s=JOi!SrQTX)bp(TxZOR;4)_=_LUgA#BL!PyPD2cp3|hIA#Yqz$ddS=Hy)DgO zn@yr>S1$HSrQqQ5^K=|{rK#xrMP$6IjKv7GoQ!bdIDLlhRyiJ=F!@Z639xl z-hoi03NykwlHRwv?DqUZ22gj_ecAFs;HWoTd-xOx-<~sW&ASWF#9;Mh{pRX@6SX5O ze2!!T8Gdbo)q`d;^U3L=VF|{y*8DKLg4cpaTm+@o~K4B}LFGI-1u&mRAa08Qd0EJl*K&eBFsHA9$JfTntq6S5s{C~p6u zxBK7gnO26Z_U-L_zn!3t>Jmb=Ed|ZSzR|sj9hAh&Z7F-oM$L>&G_&9@v8F`aWJ?=~ zgBz7H95XB`yh#lrP?o=7Z_wj{Q6(Jwq=AZSe|kJM(=sZfB~e(wD5)sV2V`zQ!J+`D zx9D4WlPNFx)yrPr`dO8R)!bOWpw~TM;Vw(J(VLGkR9oy3Em*Yi4@4;aw7idO$ayv} zs!Dater8rIpwgkHt*VNR(;s3XB2oq&9R#0rF_8sejc^*P-&_0R~#OuG&C`6!(<9KtTMwfjR&~oB$IaW?Y~>h=NDl&RFp<2=-k`ZqI*G}?Dqs75!e-hi7quMGozYkhs>U$Q1Mrs8;<3rS6Y z6G7A}-$#_PL6WsTjBQd8#JI=x-38XEAu#b@=G`GMqHM_$zPQu`heI@HPY9WH<%aKg zSQ^Z;in8WcoEn0foJf~1#Q|0c#PEr6CEpe!vjNh=N|-fawR*gLzyEkO?w_Wta3Op@ z>m5hFEVfcZi+gsbm7%e+%xf^@Re%&lYEKcz$WYM`7}QgMT8MH>jm_2cIdAv2m^DYc2FqWJkYghrN2 zbU{HuNxWTB8bgZ)KrMz)mRYfTqs>Th0AfO%wntlLqX@pO9Ue~BtQq3~OjTX|3OFAk z=ZrQea00V~jHuE)?#(^{%3AQppYc3WB2DL2GcaJrH+7tdP0Zk_$VfY6d{Lv7u3Vle z9vcy>w6&|w7I6fD{`H&%Y#R>&NNCDpAS*akVz|oLhnSE;RVqa&L~73%QDIt_Elp#; zy+aovB!87Q4z=S!Nw5Yq6!8+ONW!9f45rcz917VXI_`lC8A@vU{Xq8)VfmU<@u%ABB`m&OobT(5NSD+t&KyS znR{iGofIm{LTn7Ts`b@+3wMws-ij-^z zORMV%gWF3hBlya3nxR2>BuRW!ftEgUZ02FFKnq`dl1PdGEZmr|VWpwYv~*v*ZPcMh zK2$MnvoMwa!vYZQLNF*Cj9=>N@^ihI=$VP(#-f}tK{hBtU-yl=%Si66F2S^K>c(xx z&BqNyI!dP-TYbwphf`}xxA@kYx<4c+K39pPMeFB>J}f)w3$c6-V?0zjWaL!YFgvL@ zPFh})-BDhJdsU23iZS~-E)82WE^zIPCJI?(Iw1Qn010Pf1;KQ6KPok?!*-iOp?Nsv zL*u?X_SU`8S;YZBAHLZ?I)c`VP|z49R3+D}rf0|&c0*2NVuvPo57RU$+XsviQ|ZP- zm%tA{V)n|#txDDLb&}s%n-bB}q~(v!&H~rZpRkUoI<2jV>HG5mcmxMy7R|oOfxild zV(lAJ!3L^Js27~A!r2gH43%MhUCMP9Jm*$4rf?0vAVW*eLJgKqm2le*M^)Asd5!D| z<2UmT8R_oqM7sb-DxEIklNOl;i-JQjB<>Nk4aw}Vdvy00SIPxfRm9spmSmXVCm{7` zZBr9iwxUs0?tOgi_ zc9$MyJt3#W4YM+f4oJ%N`4cNpH}Db3Cd*k>knJgzh~p_Xie{NDI0ScF+g4I2$f7BX z+n`APS@0T2vH)7!y`)w46LWw)67 z9#Pa72)$G^Pa*oHNN7totE8laGmm7!Lz~Thf67Ge1;k6yLv@sN6Wq`xvo499e1O@6 zXgZuYw3FD@+eCMX1zllJDA-l1v~o0ld^Qc+wd!T#N3CKv>JOMw@V+dkZW?XjNc@0! zx|q*Eiy)k%qx)-?T0BJtX{3UwvNGTjnY$Gk($EvnHnv8b4)?>v_(bVuPD2SdLIU1b zw9+vo*PCl;5^Am27}M}oDfTq;vZ0}1kxC2n$n8kH3QMCp`T>-s&`5x33G9K2mvc86 zja*!7aIh$+DRPAJMCCUobmp$kE_B0@q%k%<3i>LxA{;0@W6q-A4>KJp1YF4~9V5o@_n7#5JU(G~q`bH?3zJf&7WD@b*EIaG zNMNI;x|Lo>&c#$1ndJKbsfv?vc}cLOf`nFkx13RX3gnC-FGs4vdCDmALAoy`j`@9} zp3i`$k{pw|`n&Y4^I*M{LOKfyk^IH3C`Tz~9wic7aDvx$Iu1^gBe4L%QtXjZyu`Q8 z>G}CW_pE@m(9pj zNkBtaY4t@XA_xD5YhycVGuL7)6{>+?Z(p|0B4W)rv2hT?6X@?QfvCyQRR!q1vxE?l;-QXKn$|t}}lxDyQtCGQOf0?lqzhX^rIaqM?@K~UXW(IPj z`m_FGySQW84GVQxqDV^6Q;ax29#?7Be%V~#+ayDqAFPePv^5g6a}#hzHn0 zrjgeu=|9~mq19SFIuuTg6vJ*y1KP?s@u_& z`>oxbjOfJm`}`7i5qC*$veo8UqT;B5)LDg;^%^Qh{k(wNo0Ze{HZ`Gm9YW52(1f<} zm5=ung{D2(gc_K|k+_HSwuY+;qjCY8{yC@%q$YMLb1MG1(z)x4%$0#C{qwz;fo zs|4(ZgxA_OCL9#KICLYT$lQ{tMk1MK%o_ML1c3Q7)D34^SOotIGb;ihdZ;5zsn*rr z@z_(vi6rAMnr~D@h$An9_m5@MJGFz7!OLMz^8~!%P%$_Pur@XZwiM@<1q`{!$PIWg ziAzmyq6`og)_kMn=n1AX*#3z`P@1rvSD{|dQ)EF!lc^ok3EIS#kPu*I+Vnp18hh(X zxZM$Z7p}UO*v701Edcj^_!1&CGuW{H!OAQ^{oTP$=K!YISYq>zjT6PVP2Z)?gcrRS z>aT9QCuCSbfAysT?g2n$`!=97F^$ZEM8JnW0dog`9H9Y(>X(*oRInus9Z|3OaV(wT zm{W>3hPOjj^x{0e`Q_@0F<@{*n(@@^>!5uIw254BPh1iZ^_WI7^NF<;+j5rny$Jsj za&dY15$%}09IhFvEjiPnwdz zeV9uvl5eX8ecksC6bH82$&&7FGs}I!4cvO!;}^K9P#o<1DFV8I7cSixdiU8?XNX`L zyC&7$YD6vHlwowAKH{1P7j?AJy2dGM^W*p$P0qcd>GE0`HZztpfm+tRf}C@C+l2|I z5uEJyjy5$er~+VlF7)@T>7Qh)JB$xvbIi13SX z<(w&ERzyrq60656PMas>;1KW(p=A}9of7ozq-;rA=6b1annjnH!3=EdBt#WJz}Dbs zG7j$ku30;0bq7iZWhxqHW8OdPgdm1w5};D9#lo$-~(c^FcDCN7rK)O zMx`ZZnI5~-Caf1rQ?~2smX8Jp|1Mx2*3>jnWi^r!#ZA5h2H^@@Nz*_3l2QW%W4@F* zA$#?yp(Bb%Y)eTaRy%)rTU4^*moEp^C5*v>8_=^0^F?cdiorllRJ&Di6ws*&7F*J) zsgQnn5(-%XI&QJg&)zWS)in|{l4jawKTL#B!9bXS?&cKnOA~UR=&6CHLE9S(J05hz z;S?03>sp#%uGhg84r=@~u0*&cRh=j$X=$N$)hNl(ihxE72;{_w zY3c|01G5P+QtM|Uvf&gepEhM`8=CV_p#G6=x8M+*4#gPEsA?k8_yiG`ZrMa0KiUVV zg$MYFMZihU9yzL3#*;n*Efz9P#gW2y=tU29{oDaK_z(47aY=dHYm#_M*rdB5WC=dfO@r9}KJ z{|T$n-1o&{t9b?DI!*W zc|9--NG>`Ua3T|z%wf|4FBNdHX3-iphp#D%UbDI*cwmv}K21u}w}e{rhu9fifdL{T z<_ZJaZ>h*_$o6{mlZ-?c7;Eg-szYqh2<7AWym9m}p>#s*F>K@{nCNGKkZ_%_M)+UM zEv17)^Kqk{OT#2wvyMWBIRq=GSj`+kvbU)-dDd(#J~RG!^*-+|!FTM{kqem%Sw=y_vf=~S~ibp@t?#k|C@S6%UsHVLzo zws!92V?40Eue+0t5=3HNG6VH68DdBtBKy)Ufa>G;q@Pe?p@jO9v6_( z5m#Fs>FcAoAUN}-7=9F373PL~&L#?vDnf-c;49|q_CtsGL4m`5A4u|(#8Q*^r-Bg$ zoY>x5**hEv=OP%0ha}HkVzx^lSbR5`L~)E3YruLBs>INp7*|Ka_5>P>bGI%=@=b!* z6Mt}IZR^6>Q$z{?T4q2ER;8)3UoN==_pJsfhg8SR2SwFd(zTy|+<^KO2kglyu^r}8( zHp6RdVnPsSjr11l++ zk+3<+Iqr3TgreR`3T5cIQPT*eds8A3q~{kCYYS5|@-@$e9S<_8Dlu{}yUIln{#;Fh zj^vHY9EGEV@n`1Z;;!z|*YA|?_eYhzX5^$I&%rl=w7Av^3zmq$-FhQ^PlsL;r>IWLo|U<*Su`!GAso4Eq_4 zv&H782sPzr4 zotsOIrInT*Hd+@goFon=*b#p3*s>G0Pr_yzI~K2s3cBlbN~^hC(z~yc!j`aGVO2w~ znm-=?hyVlc5Il8%x1JIqT8IN83Hw8tlgwVD88V0-sZDQqSdJd~T}$cQ%d^P@CBJJs zsXB*EZ+YdehE$2Dqa(eAFu?&uOGSrYLywZ0AK{3O6fP|Y?)m6Y(wsLhTzWoUNePL5 zKdn+heq${fnIGX`Q(ggDF2iCG0n;&(Bb*Ue+FC>t<1Ll0E}322Wt}CQQC5z`ssUM6 zSTD(FIy|m~sV*miQ?~s3Lbx@k?UtKkAV~b%?T{B1+V~K+_I7K#s{aPuWoBWKWJC$q zmt0lP|3%$fcGVGdYr6?fa0o67m*7r-;O_435Hz?u1h?P>cXxMpcXxMpPUqSCefK$I z|AO;z4F;=McUR4-nseUQ?KGP6OWwcOj@fC8Cz;p2%lL{Qo?~_x_#}Y8GplTm_s#^4*VxQdJ z1F5iWkntA$$D&CP)u%Pf!mpX+ZJbzc9mHp8{i9}5`q%{OLnc1v@Pr~R6pwN`(^xrQ zShLxNP2+KM8_U^Cck;7_~0xZzqHW ziuc-oweI|UA5Dz@_D1uhht1B#qyMBoq=#VUse~GCZd{E(S3snDLkgW@s8`laS1T2O zhTAVIrI4Nedv=>qHWNm1CVxB{nhlo_@wn&AM*lbAdSxgyEiX(66J5lmn-yZp_iwE5 zV^@xwvWpK}?qdSJvOt zlL#7qu9$9!+VTxpq10pI427_cCPK5HP$&@gmqaM%h_>oCP~(#=NT8@9_LKk zbHS0SDS%}ebkJBIP*{Ltx)0R++Iiz`)5p^6Q7#Sj`OcP`B`q9YNDj}xo75B+9wo41 z2Hxyx;aSTh!l>+)lZ0an3C0_|Qpq3k-Mo8{(Lh<0fg1|SXV}=3&77o5?}iP{p3iku zLy)H_33c%LSj8xn#5t-v`nKMpF#C8}o=VgiI{sx+bOgK9^PU~CEG)$Ap zqjJZcyF2*jt#>t2A>BQTtkyVpX&%2VNn#eAMGdcwwBOdO^6U$NnA4jHwG~<+QJE-) zx0-BVjkW4NZGEhxj>sF%?P5L|e2x)iv4oXU=(i#bdKT_SGyL%VihdTJdSydA>Zokj z>z&<0eIpLculvCSk?@w#_8^M{|8b)lg;9TgTd0>Dzt2R?f1`Y~5oiQ0aNoqh!3;?A zs~-<>W@D{T8YLRKFuGmmd=OyC!Tg^GfzqiH37?_i2Q#|fL=by%@OrPQgKT?n0kLtV$J^UaPuq{ws%sy`?nqLK1w#kBJDEh;sG5d>)O>JG}<&N(qVBqCX37 zpGuc`{iEbZyA0oMj+d+E_(SkxEit+*r^T>bxzp5)O+0E@OQWP={TG7X7xxF7O5&D^ zvqCvbrz51mG{4vP)hdgJ;KZ7^mn!2XPwVd<8^#+o7A>;yDnq2|aci=|E3U-kg>wx2 znw}Z;J3PH@uyVU;r5)cNDp6c!GfXwgk*}srOdjPXtRNB#dikn4X2FESBQwrWuhCf6 zUH=eikzgX61nu9fJqNO?+g?0<%nz#fkyAJ65|JcWI<|DInOpkGRT%Y(0&z|T(d+L( zKNoaJ3=@tE#=Usn3VoE4*Ojj?k{o=(THzHNH=4D~6Cy3YJ9v=NAD6t}4?P+m8Qjf2 ze%sYFe9L?mH=!0Pr7RGVwOAh#f%7h;Y)LI0dBFv7_;NeR$d>g|?vPyx41iS}Fm4>+ zQa>k$v;n<U<)TN4~|(vuK(yD0JSeEpe4*rZ2o^K4}c3f0&wTGyKl&l|6k$8KURj$KQK$1 z0$O(P|Dvz_|K;D#@%XDX%2X2*;ug5Q9VNd1Ul#U%>uml-dlwR03K-O{g9cR`Escxn zH1!T zf7C^d#t_^;emp9vF058VG|2MF*1M6K`<@F{5ppDU? zVOv|<#(DgVL%du{QX0#i{b2fZE&xQ~VWs|91JAoyS23*q|9S}SFdQ6UC-)C6*cN&?NK+Jr7?`KZPZN zt0}9S+bibuy^EaF0Q&!w<6?Yo4{(jWy|Wtg5fWLRmm|>I%EQX?GSu_S>^l+wd&$XZ zBMLa=7z}G`6V%nMh|58X)z`)A0g!N!k&*C;4Ag&uzr5^Ww+LrYBsEi2=km#dPxmvAs<78Y6^=5V_Z0!#qx zBZ_BH9-tqzx*UZk*UW{>n-7KL1Z$+E03%4HR7Y1S2@@Ngndlo1^elj2{8?Pm6y}jw zrorXeFZGBED+A(Po}Tu@p~T>_n?82L1(I6V)inU4a2g4%Mg#byTCN@yJsuf(V=9xE zrxipJlY|$CK?-1Y;uGWXcz+c(75P@{HgNp7VrncT)(xKhJ?$nwsdft1JMaHbAw>)oS)Yzw)YhKZMrC$4>>V)w`Y;HZ3Isz2yMN z13vd~f%gU0U7)jqVEx_*APhju{`kPwQfqOtc6NSn*$gm>gqV;wg zZs98$`gbBWat)Yi)~=Yi9ONWM&*KB0m*m|i@imCAjsQC8YOX8_I%@VPJ!N@Wv0y?+ zTpZW2<+XJKrBM)K$iS3H!fLB}?$KLn@N(V3$!XUlKZ*>etfGOQ&H8%7<09h}AFmCN zBdB&fEy=18_O^k8zuh^q^1g3%%+Jm8iFK0@djl|wzg%NZuK38LgQzWBo3BTpLjVc% zI!FBhAbtXM4~I;3VPIftAvES~+#WmAqt@LIXj!ysJ%BWlroW${(qMJi$T|DF?QSQJ z-%0!Roz1{R%FWaZ7wQ3h607MsHScp*-i_%GZtm|LPCfgzBbYm;6Gum9t|xUH3189E zdF&jnXO9Aor<_N-|Bueq2UwB9(ZD``eqSN*e0(y^NJmETYNN@NwLZ6AX!&*kvV~wE zWTdK7emZ5A^*qqjb#`!=9HF!Jk&=|8o_P?6w*EBb>2`#OLdt~|+vW+N)mxa5^ZI4E zfNgGWes$WMD9b=p;KX_t!NkN>POw-wuEqUo?m&iXdS*-Pw!rwG#Dr}e0NW(|*fc`{ zuzkHBuL{!srh)tWFHP|a@1b;?ngWzuV?>`@<#_aFl1FH$sn5Uv81kb?CXJ_YI6b{C z0f6z}gJSt`*T3xLQXhY`D$i`2Zu5kuawCY&q&3}an~oEeA~vA596v!q>>n7Fsnuan zD41wSxE;s8wK#vT?l;F{i+)tgB>ivYuMgqnCgJA!IU?2a{bEnlk5)1UhD|8QgQ`)Z z69m-3JYH1@7)XgE=AX-dh8BK7Q^_J9EJ=Q6`qiC}a57)2gN=pE_Y)fq=aKd)oGdT5 zsRJ1pKOw(a3tf-%?Dug*y1qOr$^c$eFd;hr4sd-zKP&UVgkWrBMcr}#c+U=# z9ZJiI4Yuy~4IqI$UhX!~R2sZyRGh3CZg8wP)o30oE;B@=eg_;xr!RnL)oO1CyV_iW zM_We0!;#jPS!j9EU0Oq{nf_ee!ELVDmsynoh$*r_NPvIQ)YMd_(Q#Ep!Rxr&x&FGE zCXbVn4a9#JTjWf3M&@8aM+ayY!cIX+u;#785;s|IFs%!2xmyP)?0lv0GP;Y@G8MVh z&%sXw`Qhi>X0bVhw!tWyXChfdL=)V19Q7BAH5i&sr)q0!f8r?m0t15%19=~v3pwt} zKAavZdl>HCpAvbPt(KK`V&8FExoZ^$AD3q0k{EC?et7lqS6!je#a>{5?Z`x{5q{+| zA6|VL`ip-SG8DEb*OJTN9j-&7Dd%zzv_{ctHqCc+p`fDja&=8?d<^&5V<|ri8X$6V z4HnQck()RP81Tsf2^}n_Ui4JE9 zTdXno$hxpT_x~a(H*{)AVfq2^So0Woqik0-(`T?Hof@bSGF{!=s;s1(Or8O#tTEi! z3S{YE6FZ7pwaXTJ`+XvW^jfJ~7$%u+qf1j}<)MkqpIc|t&v^d2AIrMs>UG<0$xOw} zP5ql5^x+fHH77?@2N${!{eKA=<6-#?*aHorohr0C$lSJb0bsUfXGvKd87V1zYDk{Y z>w=u>LyK;EN=(9VIF(XvP7Z#uZAwDIK9X~5jpIsOhSyUV#E5pYt&@rXaXJ}!<%&j% zI!|s*zk2U8nT(U8Q~Udh?vIz`2|GBg@~rlE=MI;=qN;-ZoIi#t&oZT2TaF$& zp0NRr|NRVol{^HBKR~p_e|mB99+cTevT?^5l2S+39nefY5A$DQ=%;d~? zUri*JNw0QZc)4hQgYw2j!*%@AiV#Wf0I|hRTTXL!{uDd9xy zJ;*Vo3yMU)nu3?e@ReASv9gV2j^cTO7vOPukc|d;{fgCu8C4b+4SI|vBxX9E$#^kv z>4jj`QY&lWb+G{e+pB#8vuWU7Ogx8q;mtI^tEB}ANSS1d@t`koCMn`^dassqr>>va zM!L0oLJ(m0WwlxUk_DuqeI0B^m|v zgpAha`IfqhmJ1wN0A$GJaZ#5wMpgM7_y-@&+F*Bn8 zh)!0PHHg?i?G1l(wVt~kKB_8Y+b-gFw!8g4-qvjF)60$*Up`|-M^(`Kxq_ooXlrTL zFe!ZOfjUZb2!8^UlYBVnhqHauCL`1Qw-w&EAE{fJpFH5vppyX!O~>Pqx53|NAM*=9 z)xN4|1Ry3i`9(4-I=mHDjfhoUcbH!I&OZ+Q=?wJ=WcgPm0NMDQvhpp-z1-A3SCE@p zFN8-;T^*~C%HaYF(q}WWw7I#lwxX)fIQ}Dv=lzS_5sd{ Q%`91$l!f4Z_SU#i+2PxE(+jeJ z*v#&zc&G~6+JL?K{?VSaKDKgWOqR$Dy0%&ny$E{RmYB7LS!R+o0f8;seyW=G5FJw} z49e=t>h#P^U*;hQxsxo2^@mZSJ4z=qQA*{NSL$Gq(6fjeTgDiCaweL=6*8 z0T#vcDtGPoM6F7LfcT}k&cj7=x@?Wo+4C2K3-jFTQ-}pGgs{IuYZ}vTcaMOfVNQ`^ zf0}Ii$lt_H2b7d354|;4TGD})@XkiuEAC>Tjj*PH-|R6U7O=Fu{i?~OcbeBVh!w9^ zMY5AaKgD+^OR#ks>BHZN&9g59>mcfN%wmyXUB+a zTU3%uJ5w%zc>xqPhg5<_%nnwoN$ zj04Q?H*)Az)XR@Wceu{xa%x@O(a}*F^=jG?QqBHo!AK&+dT|`f<$UhH>}RPTsmbG` z9WzHKe_{ou8SK-Ns7xdi`bI|``X1ZuqZ~bHhw3dQt7*zKRlhrDL~JxYtiEymJgd{z zLU92=H(_1g05GQVvhVpgp$`n!WrB)2JyNrkH^V{H|^kr=k?0Q&F%I6dAGHV z_Zv|AfPmtCKXtB5sQC`iX&<8Aue>pL_dH(LH8-BNWM>p7+TWh3OG{q&6(`)>+|Zb7 zf&J`XB$)c4CC?ToulK7L4)h9*miM`i_CbaWmwVTQp!a*#4z2VghmA<+rVf1^&R@0@ zrl58Z^4IHIXB{&eD`8gvW2&#+@sTCU2xSrB-2-ZSa2hT`%Z_mX$$w9>1}i~R<$f5A zBkJN`Sc>Mp=#cSg-ky?=fsqkDrgRgH|1liHmi2M3$&vINd~o&pYAEyF{uSm1eUyhqe3&(}L#pViKx~REl2=Z1 zA+JPx+MA1~CrKvG)x#@~z(aAi`&t!d)E!Lfwn~vkqxDa`*FXnPEw|lWcc0`U3%s`7 zM8Zo|vd8mQ%VNy@#xLlO!c{zE+7p|$w%W!^fbG|Ng@g#31LYYy+BZdUtcpb2Wr*ol ze~DoTmyn>H;qCWhcYI8f@pF9q*BgH+g4~4z;0Z)fWb~cCPPyAuAs&~zH}v+>y~A}K=i9{iIze(*3J3#a zpz(D1m)%dGd)~4UGI%|1pnd%cuo}!-c)!n1ZJ}syakgH+K2NQf5*MX7n4yTYc&N1Y zI)1`z)Yoe*&wG8zcPrEcJ^xoQ4gVCY@Adzl(H{IQhY9Jc|G_8v;?AJRL#*UF4 z!~tG5UDx-e0)y-vI!ON&!Ujd1#9;>0X)DW8TAI-nuKiITBf>Af=9pr&S??YO0Wll$ zPm{2|Pl7(W1A~W<5D8MeiPKZ_{eHyj+qnB%XA$U-b9S~DbhE-@W{rtaAh7kb9dGqJvbb}svzQbQiwDe%YyY#oosn09pQvE4v%CCydb0Z*^jx@c zNE4Y=8tm{MYq#UHH1N5KV zRjr-!y$P4U`E7mO-?Nhpg^gXZV__6bii%TO6@dpNi{7uV9^kKUYE%K(AP2Qj z4Ej*bxZ2~;dcwb{6L>qlfk!!F=E;p$(kS_I(x| zXt;7Yl5P9Q{Np1cG%(u?_)(~umeh4YtHIX%{67d#0+lGKX{TUGaSTHFNJ71EvH9mF z)0QF1)YOQX;Q?mtK8Qc{I|oO#ISYwAOR7^H=}2%i=j}|F_)=K3aa^q=l@8$Zs^@bC z$Lbe93ZD}l!${IEAC0jT3LrsK?*!Db52B3*<12q3u9ni^ZQ-T;F_vjXW-t@ZjaBGf zq-1CI=V0UL`tuc|w>R4-f%y`^vaP#bcwdm^ zOzB?US5xkIP1M!PS5$?y!|Zk)9U6j7-aS0z7>ZClz(Ri8dcEfL)>cv)EsIUHH8sU- zpNWtj+rjiX#EjWVP3(mKlADSdd#eQl<6A=7d5T9-mDCtGhmQW@bg>(pu=g&MW#ksA zilq;Axxndo`jY}P(Z`2S_%b}4g`JhDMpmt=y1hKevXs(bEv#Jq7XbcYl&1K^{*97_ z8!VXfj>dxMKYmOZ5@s(2*_cfp`1 z{#mbXZUCH9`3UWggn>mW2e_bM9jJSf<#>;R5gd!cY`r>NAL^?*BNZ1@Quj4PY$(-H z)GFv|`fE)&)OLLA|D0`QGN;Yr7@)sYhKS1|Dt9=o4bphN^>>~EVjddfg`BdvJP{Fb z?EHpb8zspZ4gB0QRW|aZ*`#WQ$ECGyM*VN6BYSf@#-)UEt#~K4?-bN;>gh z5c$!caPi8t+AZIjSrZa46xC>z$CNR-KsFV7BdBWdJ>>kMMFkZZqC~~BTWYD;}ued`Dojl?`+h-Ip`YpOM$;dMyJ(B0`3XlyYk)7 z4IR}s;Pb4LP6i%6x4O<-Oiptucw$0j*BmITerx*peqXtIj9*@1mxRHicfMkbW~^sDw1cBsRK`XDUMmeJBV#KB zkHOyWs=ZL>PN0q#j4wi_xqeWrGoW19n&dU$QkRCZZ@UK{&{=`MxGEp0p@iL@n`)H& z2K4x?5m~T4|x<5_?14PZcgsPN{3np)=K{p>Up-WZIqN z7%wFy6=h}RkFCCrG|7>qNr>JtEp*9YUHhAqWsTnba0h9eWLgM#|87H5N!?tK03VDL z?q@GZ&o}U&B_W)iL}@#H)JUgG0V@h91N(2oFf`Mj^Z^DDxA@su4p! z?8-xQIxTTEAsA6Fv3C-S2b8p)h>FsZXXqutL^0SX zB@DsD#CVgu3_soquU{sZZkjP%H(_>uz1*D(4yn=b(s5^>L4SjWmZr7!DdPaY zVXeFEWL&yo43vtb)(B#x-xVx{A(l)-w~ABj?kI zwtFugOVIkN`v`RZ^0Elm66MTCR>r89Frjo%>@Erz`;X7o2+UN`n}G)_o0FN<1R_5V zh=j$laJCyV#`Ws-jw=lIFp=UQLtd}tCA6h;-@nAFgWATCBC-VqOO2V}zrcQ6@xI+` zy}56=JWV`?hGXfuDI71*3o9@0!>dX5Tzr$(%OXZPL*3MuGO5dW&HMFSa<9_CR`!iS z!IS|8%W()znldaV8f94wmL_u>Gfk5@zJ#3oSGMwF)x5H>S96F`c7=mr;`rybJc0O- zl=9NSZ0-a+;}8^bd}E)c-Z;`t!%>eT=$Y69!?9`KGA zF_l%HlKdpf_CwuMpA|US+_<;A9q%@=IC#KiiROgz?V2sj{Xk~g&By))x=ybycLUiO zaXXA|;^K@=V*Eum~Mp|8ItH(CTr5(qmbE;NixSs5?1n}BA(Ph(D{ShspGIc z=!J=SKvi@W8oye|Dz@kmt3vTBXYw3tc0*EZ_(sxiHp2fIa7os2e8$;Hh`+8oqNR5AI=r*#~{v(1M13(fv5+DATI4B=6{6Fy!f;?hEzY9=1hS zYx(^IO~MvsLh!LqQcgE6bp;#k(~?;B_Y86dnZQm^@WH0VW?ZXr1POxT7@$JVZ) zj_9D0PgicjLPsxy+QsoriIL*an2oo$qZH|0=~F~L=*hXt{Gq4{?>6(ilN;;vQ;V}K z4?*-KDee$Lgkx<#zmcGV{nsyHkc8co>{Cd?^#1U+5&Kwd{W)-7wgZWpLQBkTId&{W zez)Ozek6X6K+D3rhn$cdK3a+>T~O?a%omX6`m%=fSdcA9kD_Ma1l5zY+ZS(n^Y2bw z-#r&nMU`gDfdpW{vaoTfe}aN zf67)Of&i|9{O^9WLO)$8T^7A;J#_TQ=m+Uew!aLic?e+@EIFkWP+g)DSVz&=7HyK1+J8I*L(elf?HIUjOnr z-Uo*Ci4=J242BRUEY0WP5fV74U^V`o!Y?Efk#yJ`TwG_1^?RbckLNT;6RYP?S4ccB z+a;^3t+Koy*P$fB_}Yw7M#x|{37t|fxv&p-gxy1}fpp-QU^k(koIl}NnlQy)w02Yb zql0mRmBM2a5HxS`R&Y!O1_mM@MDW?tJi4AI+Z?%3LNAD9=H=bZOgIyJiTD#!>TlK3 zGaG+oPVEE*^|NnyT`Z?WD*%u25G~2cw|Dh7ZD)AA)utm-6hbgmT?}JH_-zaE0Py!w zMlg@JhzMysyuYQTrSK8qdqsnIE$vKc>cT!}vZ6u3fMqP;9La#V%9s2V74_Et;z!3f zyS~zG<`qu=lsN~BMe@3unm7tEOlpwvj*`|UFm0Z?qrCd5&iYumj^@+-IADgp@y7+-Y( zp9>l!Q2;Xw7|t9YTfjVWGBI7HAJ*jdOd}B4Dxxv4urQfcC{SQ}IRVz2u;WgG!0rOO z%C5LDXT&2xjpR>S?C@MsSqYatIoV&ACH$1DC)maTaPoUy9B&DQf8*I2Y=$~|k)4*C zGoj^vNpS!nVw@T~U%LI>cSN;95Faq*){!TP*;rleo*$1~ro+nmWN5ZHx3n}f<0w*rvW2X z!^gy+hr}u^>MpbYT^MHTQzpK!tKHUh?j0<3oZNTer|*diVvS#D!gVhP4P_DG5zU-U z*^~mN2Vv$9CV1a2C)d|l_=g{l76L+M1mwS=g9&UJfO))}o}C57F3>z_ix^C!AiC8 zDJX}Agiw7GYmr+q()$!<_fb@VM5o9yZPBQuLqZfF@dZxD>j()P9K7A@J+*=Na_Hp( z*a|15B+bq#De@lec0~kta9k@8h4}lErXV695)ZkQl%uFJ&!D|tLqP}2sW9K~Fmlm% z+)BVmp?z*wpPy%=r5)q$*5r6}1*(1`f1dvoml&LRkLe9;gjhB@VQX&TM_2QgoP_-`!& zHbWQfAjg1CFQK+|bn~xFeTRflN4G&uNdaCZW~ru*CxuNBmYa$EC~d;WangbMf!a}VjBGa zVF83>O*yzPHMKNZH@_u7pKk!S&b4$tmf``Vbf6Il#)rp^$NA(S`uK8_JZ6(@P1e?a zlz!#3yLQlYf5~ee6#y8pP-vxu%}OZZn7|0iCuFb(gQZV>Z(nauCpcdiO?J_a5Mg3s zR3;Fp(UX7sX* z8ZAgQbBV%GHk&<@V68Pgowr=Hl8|y-nkb2uLOvhvOx&Mx$ti0yi=e#QHfEO0KhSYAO> z$@hMF;dT1;%gMn(qseUyGsCO#cXAT>?RSW#lDx|EdXDOl z{*5HSrZanITaY9h?xtEjAQw)s08w&ItRNCkt?j*jkxUY3kpePNrNc`o?WWeczyp%t#HEB3vWFlZX{Z$3p6S1jly|M1&ez+(+*38rF3*wbv%) zDhf%g#)gGNx!SO@I7#k{dS{JB)!%P`+^dqR3XM*)$K3K=!>ZSUZ=0^?)6zhkjh)oM zUK#MD6$L&y6V^-YU_(O#mIb}%85*w0Sg7m5wO3HazT1z8_V$$x&ew48);2a}l(g+t z>=2wgxX7ahBg@Cbu2=Ob&MFRIUk2cW)Tq?gm&|XN=o>qpcBZeVr;Crn zCW#=EggJ^XB_DY|z1cL)&`N5xG4S{vl#fM3xSW?sX^3`0rQ_Le9_C85s{PzO-IjO< z&a|2<%RJYQiqvuQ>D+F)O-<%tOKk3RF}Ff6qvl{(Hm~4<-Nc43&wna-PvC22Cg$f< ziW zV`FMEaxqJ5(G7z3--1?nRP&a${ks2;d%TR(s^-l^e*P+78_iQPh2cD|KMi& z;@cY#mg(x?uX`by?vhf^^K$sszOI9bxscy4B3)n-8+(fSiA)^`3O^}2Z&TKU1iEu1 zLw`wzT_?AQ(y3v6#hIEdl z?ux9;(c;zA!Ig@oN%2R%%i5RHl$qrfw1n}?Gked0y9vN4A%5|TE%N`dVXnM|h2!Vv zlHSZ;q@CT^6iD`_Kf7B%1n(e(EKFQI0){U#HN`9SunK#G0G|8nT|+~|-ad~OohQN5 z;uFVOrn{1{m6ha|=K|Van+Pr&u>Bx(1rrze}-=_!H)~rtU-Q@^t zTsKt`5^`Rc#`moyHh{O;s1K2^O~}aP1?Xc5=ER2kMa@XxmlyT8n&*C99}iAOn?{X1yj<2x$(6hdT8Re5ZJDZ>WO*7n1$o!#3H@heoRtDQ6FR-2RzRsh`^%7d0 zo!y$Y*f)}?02qY>*$*Q7Y(TT>RC*ig_w|0}zuhUD$kychfdS);19HdMRy55lLy z`s`8;UJ4RY?qPa{fC2`ykk-@i=jCsz>`{xtl7J}z%!xptrRT_7z`C2uOHhC?k&LC~ znVei+AEdCW`t88f5}DH!lfon_uoK=RgCuoxc?uGy(<^1s(9uv*NE$$}9SS9NDz_3X4Eu35&VZEWD5uzh~bTX8*qx6F#xA$W@-xL8Q; zScoN9P?Zi2N-7JJypI=CQ#G@5h-Yn=s;U@u(g|uVo$D(qyuEa&u^hdbrJ# z?6Ht6`ZsJ=S@lX0zlI?_Lnpm7JMwX@ug3aUJqg*dwy68c6bW>)g6$|A+T>B(z<4^( z)7=*MQ4tkIl;;>2)V{bTfrpEk8PLC~P09G-vzdF>fcL$!p}juAZ-^qQAdP1TQEVU* zZ~Kg<^`|a{1r;3xIccZ!h=u)`Rav4Wyb7M38|GUMk4k()db=z&wN0idqJYj z^OBQjj?}X~)A-(Au6@lH#IVwGO2Mcn=)h`9m>>BPhF@9QgT_$X)v<({Fs^~L$k+&in-;cPIx=Sr5R7+-Nh$X-{I(IW0x zyY%JNl2dSS0cJgPFw~LLXg5T+Wjc@7?`7L)!BIlrL$)%(_&kZvUHax!1q|&(RUWTk z#or`OPw~a+=|;y!WJFnG;uxppG=J6vC(2q}hcu^1l!{x5L(hfJGD8K4=%X;s#Tz@_ z-{&$%7gwV~jacO62f2N8>PhJrnMT&Jv5WN6oSvGAIv^lL*=m0q={!OIisN;Cn03AF z;SNoau5)#i-9+{JRa|*N$|r*jTGZ5w@lN=Tb-}3)vZmS|k>K5J!&k87{&c4%)UgUh z_def*o5Ms_j}*?n<}|IfzFzX&&Y>Z4 z7^mFXU)?Ve{>?&fy5ELlAUo1zOH{p?Wdr8Ycyx?&VOH*B|7d3q&8M4+YM6R(?AI?x zLz5_9gWjb;&EU8&>Twt4J+k_H#6`cwc@!jUuuh*adPi4teNlHf&6#F57bVq%dKT8} zI}?*AB4PQjK|zNI?T;RNnyJZo>L=<3$hiJW!jqVYY1*rrsi_vl!;ONK1_L7lNa#W* zZ{TmnWRQUDKBI5}h8k_3#FF2oC@bd`%r7lXJH~>eSe_TI1pX+XC?qZp@Ce3Kq49ue z^2`$Pc=Oj<09O$O_XTm~s4qP4*Z8CC7O z+4CV?qD+#@e$9((Sp^~l?JotYI@Gk(9Ykf4Ise}E zFED1eUkjeQdiP-Hx$hCi&)r(i2}YGb>CVYdZf?;)Tv#^ zyIV6xx$paBk+QmHGZa=`L@pRGzwx<*_pjsek7u#lCMX^=va&L%Nc|AQiO5HQW~*bX zgCZ+%n)vA-qn|)}wHuT$TYh{lvy4Ki-5=ez@w|*9?T+gwX{EUmfUS1<+ptgx2BLpl zonXN}VIfc_k{~8nP(&z@#@pZxlWLGH!Nv9YaiF)ap{@@394YBQP{(YkxGsz6NwlI+ z?K=aLg_VWa_dC`g9y$pZ2d(`k=EdPzr@0QLa;{A6JC|De>y0O|&BTwVpN@+*uW$4~ z;;gJpy_2mA+R@^itu!2{QWcZF#Yr4MVnVf z`HfoBR%EzQex6AhSIN3t{7~q6&+JL5ZYYpjWKf1^#NGVccbs_pCk}A(N#anm4v<8o zck*UysO)C(HL!DVsH(3s42nF<0~8^u>|E~92^89^2z%>5+sOX$xw=N0ta4+hK5Q3( zqg}mZ`%dKS)D#XLPG5I!IbB3pDn$dJ1Y%p4QG@#HbKMma;wVw?gxJ`C;#S^L6PLd< zU6x-B&xO!WX9W>RM8k}ggLC{7Sf0=D@PGdN7Q-fn<17n$-C#Isbaer`G?H9u8O`Jz zz<*RuIvD+x6p1fv57hYUwBA>qQwHge4k@ofcb>j_0$5Mu|D`xB$|h=pE`Bjkr08cN zHM3U)KbC||Sy(wiZ_3PTx*84XG0ES@s-ESM(n@4QKQfCV8}5a#;4apVshye`h?4US z{fbA>Zxj7enTL)TC*gnqCO}xIl-MycOI5Is1e}|_Q@XsKmY`9#^x17^0e|!TeG~Rd z@abA$iLC*WjBuoUmpwz0KazOpUQJ|m_Y`XWb4UV;6V#Emfxt9Q$b?gi)>`|a1}9Y6 zSX}%on~>p#oDDqPhE;j5G^1-jTtuKMGjVimY>o?d9_#KCww#JqrP0%|amhTh=m0D& zJ97jqCz63fl$e=c>SWS*39H^sm*(iqijDcUhTGomc7F;P%NKrBN#7Oiw(2U>uA}0igrUKa26jFDY{pPb5S|GtSK!WW` zs%9QH$dvc+uHz@P1q>P+Q8}!QuxS4zCv<SRX-M(2o|K{f}F;xjLv~qEeD(pLZu&(KWFDv5wS1@32mPe-6NNT#}7NKIz;oA zP{_V{0(C70_N(xd5EFA`>!v5_7DmM z8atDN2IP+}3uY!i{*XOBycy`bKCO&CZWT5*S9S9wyWizNrM5^LFvFuzS2Qv(3NH)l zQ-a|RB|L+<3v%oF-P@e=?#p8-p{89utq}e5cUpHV%`@LbjGCo-SQ{ibs*5dPRmc!w-`FgqwZAwHI7IK46uDl@ zfK34j6#j6q4{|&@SvW>)E_g!vBpy%1SsCpogH191S14E~(Mu>aLq*$ojJ+xBJk_=~ zD_UuZ!Rsu22l}usN`a3R4Gl^MyNca47Szo+fE~pm<)z2fvHW(uq3iuL$FAePV?{jn zK2Y(VDr+X>(pYpP#oY!hc+VaO<>%+;L(Xcyz5oR*dz8j~LWCgxtt$2fxx5BoRnY?f zOkM$DPol;g=Mq_w6;$#qn@v?mCEP1n$bR%X-YT;8CxCTkL*CyWq*&gA820stqtXCr zpH&l+ZL1L=jo|*D*St``9 zl3aiW^C&Tp=r9~+BDK=5bHv4cK^H%X0je0iOao9gy{=qh7GD(92!#Ct`{44$7Mz9pEL7zk<~S z@coiFPD(G;O|8{`(+GG-x;=3nsR{A&(;1fhR|I5;1WILgVx;{4(u{;Y=Bc0N73F7W z%KV#_9c31T@W-Yl-EW-3qA+y%bl5-S{-CseY*DyAK>|9s-u?UQ>$GD2EpIX8!J=a6 z<*Az|#C{^LE!EA;n{4#@Tw;a z4}a(N>Xodw;gA7epDCIaOCNeF*H$-q)t15^+eneP&?**R90 zr#$Um=A|^rt7FN*%hI`VcR#xFpt6D>3%9oRq`Jg9zB^n?4Ppj!-{1JWam0^glZdHh z-1Zqns%mIFKUY5{J?5EV1%a7emys4CCfWS?f<_wp9W)RY;qPv+IE5{(9^jw>HCIJ7 z91-ls_podXzaV|xM87+UB`7Of`uzC3T{^g6B@3O$q*7m5X|s^w_2S^{{B+>+q-JRu zhW!xn;Lh#J!sWJ`@Zx+}!%V96INtqOt(ek*8a*c-Tc{WV-89^TjZP zIPhw4NqmQ>uR)kjYpY?VB(j}B*}MY+m4c};8Jo=1x9gz~`{*A#tlR2JbUP}aXsD^x z+AM$jb2q%+ifwexim{kC;!omKl&fY;?iLBwc%^!#mf`sa2jLa7L|_Gp%u^1UBjKESb$fAI<-O zu8_WFWCE^9I}~yZI`w+L0=UnY+g=wsAJ>xhJw4k9o(FmjkpER?{i3^1D^80kf|;DE zk(88j9b{o@TGd$@*(oYIaNQ@x7X%yyz|#ELRdFZ+By4~K4;@SR^72z`VeA|w{8cE1 z_d#>vnx>WtMTP6{-;D)rTE+6f0;Q$^xG3qI?(XR^P}ttu-q*9Tvar-&U76_xrvg%q zJ+hy)adCKiHph|Cj=(MZ@2{{V@A{fo-p)(MD|BY)?fvm2?)2>JvM=@5T0#dDaJUOW z0+`cwLZ3lulE_sw6AT0d#7PN_6wD3qLz$K3TDvETGC9xzF+YuGd3m*O-8oi}k%zU< zKdTh&>tbbAcp62G}0YBIH8C}l?H10hg-MnOeqiHmI*4qPT@4qGt?6XgxNff4q&wG$tpNdn2^H!F z)_TFsN6d5pbOwy+4dA#RWZQU;P7c{h8?PT1>N2V~UNr#4ctL_F!wT#3&_r4%M@N04 zSyL2@Jp!4pZ>2hs^j(_>>PD&vcR%I}i>FevQmCN}Ccde~~ z7Qcg7RGMjCoSxyJ9v2fL@)kkSWwN745Gj=(St&kWxV3kzfEkFzN>r@)s&8#R{!4n`(Y~D{~6G|bF6ki zVYC8-((6j?TJP?je&hXpr}{aFyHj)XugDi|CKfh244>(VsaqNw?*T1dvl>>>XBer` zmGd@kO46{7Jwp=!4G=CYw%&}7EifVa$frjX@h${v64mF=t+X2T>~?GAp!GAuu<+)k)Ii!(R&F)KLc~Cx z?%Pdtj-LT>e@;F2ORdT_8mNhZRbyMVxQr$|6KrFCa~LgXC2-rua&Wi-T9(Zs#m+_C zITP=5edeMlUkeg}VVO#SYdm+oWm0me-7gp*8&&4JyKOu>JsZYG!*SWTgTSDmEiW&= zzWeQUT71Cc^w!qnyI;Q z!Lwy)=E35_4~>fsgz!A6%!4w+hriAoV1LyAYr;uT-vT-H3eCR}Ml^;-UdEYFG|KDF3+=M>6|FAb=oXa*!Cry@0My>k{Eo_A9oWx?h}m0m|Koo43duyR~C?F8=zy7J-%UU(fokIhR29XH_m zu+L~t`fxZKLK4XrprWGGQc?-zO-XmN)s!(eh#n)uA^v%n$U39gsKa@nL|3 z|38NUknzQL-9nRk9$)6pxN!J=vY8ToXanG9DplAiK5)(kA|BUbn|Q}|j1h<#B~`<( zc6!;hr8LgjcX#Z!it6SywV^OlVbe;n3Jiy(v%4$+9ldyPbxhMrMawZyIp7&(d3b)D z@9`E&S`qY~c4Pv0c2@|nJ@>(M7C=WGb&V7zf%=9zM@Pq~+QP!Xc&Sm8Snr2g9aOaa zLh?+Yjd5SBWTlHeB`7M0s{uO3?lqTYLX+r}xY%88v_49L*dQIyrB+UguYb^f%tf#Z zIJkl9<3GD~j2&c#GKvuvNWby5JJ8Y5IXjD$ge(~rt*&cXpzUjcWP2i2UsMz~EiFlg zx*Cz(oyfAMha^}K0|^Zc`^}+DdLJE~XlrYHyaJNia4`ybO%O?aOb{TqFp0=~4UZA! za7D5Zy1+AEZ1kg!ky`e|~4r()^rgwNPM4mwul|DHI+eBD2Mkq0t4one`Agvo8ds(DZ5@ISnmOzf|4> z9w8-mP6!05Y%C?|fd1?NnHQ3lj=qnwuX`lVNeuq9ytG^pZVL4GjUodS)9q)rl#Y(| z%b~-UG|OubcemE2W^=M_|-L5C(+h7MDE0FC?i%O#` zP!&6*e3vDm(@HkfH&01TCOY9-bbrx~`C;pv(ZWH^qcYSQre3=I0KpL3o0!AmSnEFdC_m7`gN= z#2>2W*4EOR?Fj-1gORwqv}-&0tv$y~1tk=j@7gXZ3l$Um-DHuv2xLEhVzv(4E2+rC z?{j_R!&!_L4G=4{va)BH>33$G;74Hg{OeWQ+$a7QE+NCK%(Ddkq?Uw_gkoW4rUkTI z1?4KE|BRH=G(gpmm6cyQ5198D7Ze<7uHClwf#ek>sS><@2T0^0@_Kg?aF(iudPZoN z$O*{_Ba);HHX9;PQoTJS>KYpBUON}66+?aI#Ow*-A!_n!+Usj;XxR8}cefIL$7mR6 zoS(Vqv|Dhwr-v>lTW#7zp`Anr2kIN^jZN}qBv@E#0mT&Bp3#F?JuBN!5z!caV)KvH z{Q%8J3!F_)<##LH;7#%ef9KEuJp)QFu8 zRn5p)epaF^ce~$!RbtuNb!Ok#7n{Q}Fz|fOLF}R(^OjFy+So`Ew zWAaa|J4?&+C1$3^;YAL)C`?pd_C`XWf!G1)C1A)p`2%$7OI~SDz;{I4T)(gNxdr|O zjrVQ!5c#>vey}^ue2O8pm(zO-5+rP?=X4ovyM{s(`OdrqJZz~i0DbDevF*PWQFk1m zMf!qLozfYR{e=6?26Sq}&){>ui=frMI6tPP8mp|JHOM8h%76*=seq&3HtO+9j0wxr zIiBtN9mJXv6-xR)(*i!(mrGce92B{!YFd|sdT5w>WKvkOQ7jDHP~lbd9}lE&vxETX^lDoLGxa|o2_a~OZk}2;j&yn2W{p^yF@48YY|_RG0{mn()iYi_cGI!^|vZ z+BMSBwE&lpfjqgzSShmUK0lEwn%Mb-_ykyZ_~Wmu`PWh{h)HfBp0t24o0|>qIMH;U zn~?5*-dbI9D8&7h>5-D$_A_&e0|PqhnFX`XuFZz|gtEF?T-RqX!-4`vl^Yny4*gI} z697Sb+sb@r<0Q2-HH|t-uMItc;eUM;+IUGQi5RN7ifGMvev<>jWkz%bqL|=Bb(RJS z2#UhI-#Auhr?)e6wV^vGJ-Io7fq{;X49AfTT_RMuHn%qpfJn5?(Ty0L^!0YCP1474 z(Ejgj_@CWSMg~yph8O!lt^9lJZf@0U^y~BMokYy+07V?y6yhl0%~p_GPRBzHp6?5K zeS6nX+jxI><>cg`qInS(?*HYBg+)n9DmEj*mP}!aKc_rRA#8=?qBA%IcvyJ&Bg3n_ z92_ic)R0;oIz-y^??9zq5)#K$M=kI1l71QSg^t-5!%4P5Oe!h4xiQ=sf|SWh;f0Vt zg^qs=l+gonY!aIkmhv~-91J=g6eQHB1b-kHluIj$7(AhrJZ<8jZ;Pp!^%s)IM+j`3 z+#2v)eSL23&#LmfI|n-7)XtCgcD9e-es_C8;&OAh0tzoI)Ua|h%AM7v+(3k)c^t>M z#K?&fwi8~Sb^x=!`xhT%c$#EfT~*a`=}p&E7!{rF8qm*AlZ7y7MJHALAp?DLP}=GC zY6Wb>h9b#Bg0+G;(#zAmJTy+G{GV?e9AIG?!ah`^p){KQZh$}#~T3^af=lTShE8x~$GBAGwl@W6ZnA;aM8tmBG*WW|cBhk?PT zljsJ%%c14)MkH>*P)Ea?1_<2rG{C-1e;eKVX4nL%ubH{qnlh4GGc^>~#OUwN8_0RB z^v{)7Rx;?hZ3D`2Gd(>u1#NU>^tau{&Oq2+Xw-JXyDO87!NJP5x}-RYj8|D(Rm@!Z zN^Gng^gh1FRhKCRH!iis`XOC&BDrjh-W_ItMjxW{rzH$K=89iVTB9az>sQ-8o>FN6w z1r6`nnTpOi!C`OB?X61(K`ZCmiT|@iWo4<`m5=w@)KqkA{98J~D}XIQC`}i5uw$U@ zzV9KtH#RmN9A>}rKP*jfta~4vFm%=(WzY?^Z2*-ki_f0{9Nhadva{*6!UN{!=8!!H za%MgO4)-(-?MB(+Tl zYkX~@Ex?Gc5QrgP{r#Y(v&?KvJVDLGHC;x_U95;Ygk4lz>;#>)mG>_vHPzViWT2{ujhLmV&iHS7Y>HuD z!AVRe()zRwjg7UFGBtEma4>O0RPgP=Qh}<`>R1?d%V##uBR%077u)5|XDMO4M<^c^ zHSPWF0Qt3 z=8L@pV}p;}sh;Lpm6;+kEG};OWdD2}fV(Q7i&b_$SaEanFbta5@T0X8(o{9?npXc~ zGib5_L~cn)&C4mQl2R?uIGBN;bMe8bj6ss$Bj9pl=Xt`OgxFC<NQTHO&9k%54nvd8x%_|zn zzN|dRxah%{oHZ_q+(&qobpy1{IBLn;_Ji#_7(vqe<C(wDu`C zDm$BFnv&W0qcN`j2pCvkl=u0mS>EJ>g)h6gh1t>3aadRcm)j|%C@BDaJ1dsZGT4+= zo}ABu2L8wiRxLEtvzFbxx|>%f7R5}(+@XIMk@9JBS&4wacWW!ouC6QkV8c7F;sv;9 zWO_cFU-!*L^53LqMOE!84KlEGU8Vnv#{Q2(&p4)w6`C|)>+sZX(bUQ;OiH!D%!Y<) zM5l#0Sim_XU(~Cby|~f^up1$w0JxLEuWL)$oSWf3MAVnLN^rbQ6?(%&_CkOQSBVo2 z(AW+8_=Hh(&&Wit?s1?ogSYB{CT_7Myirf)DO2ZFkqJIL46$dtZ?OrWirM}8943ur z7DQ?OO}k}3>RX$73Qi1afpf&N{gMLIMbI zgZJSoZ)Kp@^WYu5+2?B^5Gy7w74Q5kV107bk!_g-ZFi z7WBRU7idBHE(z(ngDJYG6o#g@#@EZtH=`PP1pEo$>0EC53Z6YNMl{^q+#Bw{_gaq4Q2^iZf&rjZr?Al49nhkF zjnb@lQIS4CULciNsaj=gC+BjX>hlgWPeDwN%k7D%(+cpFzVwm+QW-#t{(D!6qPVa$ z*I%2dD4}4WQTuh}QzTzTo%QS6n$8k8=Kuw5?`TD3;lbI0_P`N>Tu-$@?EU|bILF{Y z{s5vgvnZ(1K$SB^gMDu9t5F^~$(QZz#FiEh{MGhY)ZK6$0Y>A@fG2F5jqm-VD5Ie; zas=FE=J8OieV++_pFVuj^2R2M3=gM+(9%lBjHo)ZO%Ns?BFd4sp#9lX^J804ata}x zODZ*dL}H(T4ahN(zNI0;TY`A-bvpARO9sD217vsGx|#f$ALybv z(#esqQTMM~kU$?ipPnF)*Fg0quEG!f>i#G3@WmqTs#^ujVqMrl2sF>eOt8zbf_^+L zr_>fk(5c4R4z{m+_stRKa;q!Oju>+KA!>Vn4HX(@EHecZ!(~L&)S*ND=eDQ{G zY^PNI3G^|6sYMi49v?DShZ!U#xx9me1&vhy{O5BKMFbpgr+dx01#?X{6pE}7)wRJd z-KE!(cy#>^u;sz7+b#dN_Yz6}TzSUHYmVm2+{@~72H)_C*YwW&?<%BCqY(4tC`IU( z?6`n@u8S2#_nlD%qi~J}`4TyOGN{i5UFs-#HY}z_G65{&2wull88avS>k1XyrlTZ2 znP!Kw^%c5`^6iAHmxwWbIw^TMi6R-3>`)fHTAKJ>7%Uvsgz}IORoKy=D8IVeQG5Ks zeDGEt(BS=bG3oOBL0edhf79b|yD7HjR3;9%$o?ttH~E4F{itE(i%4&UhJm3#6(@ai z^`M{)DKEG9nl9_qPL>3n>Qk=S&dz&w8eEB>2SKd)mY&+U-OzF~6M3nSe=T#r3K0Js zcDp)qdR~}DAXXHB9<>o-9TG!tKvT@Tl+;#;_{Ij-+*ZeOTLDHi3=WexRSgT6j>;_s z$>LiFlh9D;IJ$9iX3ryxM1#M^3#g8W7^|(ZVkQ2}f)N2q*SEU9y11kaH&?=uGKv5Y z8>C&4Mn6wv=0OsvqBCe^R9TYw5+Lz>>?RUkl+&zTpBhFw>RCc7ov-q>m$Tt8 zVnhTsr#TgIhNObvdLcoZ3t*gsT+Ph;?w{#-Kge(JNX%V$^!Yp7$nfxy82@v>fgJCk zxo83m`rd)p6H&f1N%EwPaMf2>HOal#lGhNIW#>3YE#3o^=XjpaR6|S*H40D=Eo1+a zrHomDu;>Y~lIAQXT}B#lGEaJqL)L`Tz?`EtCgPqQ z9WTFKa?F=?inN9eA#ybTF_GZEovz(@CR$0vTW&n*w(*4N@Ao5X@Llgb7n*baS3lkf6x$$`hVO<2fnyfCp-OE7< zWt*CUg_oNIPii(FbZZtR4*PGQ7e`n?^VAyA)l3<3%n8J`MlWBFpsH(A9s)v)13}JE zR82xcSDZ3|K!@Ll8Fl|a|3Hv??_j^}p;hPomBHuuOIbsM+jGUW`fG7^$N8VD zcdeuB;=<>VB$aLFI|Pp(FDlwDNk|ab)bi>}BmXNO+hbjEF;xCn4z9h*?2pqy?Wq9G zU*c`KXA%*jlRo}SW~c>vDM#Y!Uz*A-ib+F50~*twJHxBd z0GQQ2K!EAV0}e7)W@c{}KJOUZ5D?p&aLa!jnU)rp^-UF@e~<&3mf_(sOx#lrcE(@Q z{0qfXMIgaSDR<5}b3|H0vC#?3Gc#u=1X=u;r?P-Z%*)HRGca)hxWBJfpO0(huyIb- zczIu4c!YCOkVbuUe3zW z3b%4XA|Tq=Yj1WriRg!tVp_QUeV3Gyy!BqN;bKjxZs(`VB!Ip3Qot=`X`{YH=f*j= zz%fr6p@KgeJ~kGgUR({>8p2U?$qX%t6-RIB;aK3nN7+X5T(K55;hvS3ONNq@7f~hP zBXLZOt!fenoFt9<{%63xTynZ0V92%5_)Eyr=HvdcAEA9uD7qXqlj~8qWEgUmf2(jy znF|;LHs~lyzVc2H5wd&v{g^(CSoQUFh!(!CjwZ5r3yzMKO=l5Kjq3^C>_!(VI=6Rs zJa1z+ckmG?@V?M?t}{<-;b>o09aITH$Dv?i#MNGvjy2xyZtt>cR3mSvxNYQvkuSQJ z8Pk(v6a)l(&q5@4|IqfFqra^hBW%c% zc0#V?4>))HH{9CC_bo*i2kpYc!e`a}ebdj77wwv@8790At@ZewU-6lmA2p3(HQ@&4?R z+IW^lbSFd1e@0vyXF?ASZb>VJ3Xyi0;kw`Ivg*YUeLjmmO69jql3e*GC>y3Gx zNgW(u&|$+d5fyRujJtK%Smts><_z}Yeu8;0)w6Q6zt3Bo`rqz4Y`ng|-E;yFZxZ~j zv5CGUF$;nh=EkAvZs&jJ_J=#8i;0TQ{pgz$F=nY5{;T|X*+Mh`d@)IZZuG`xA3wHI z><BB-mUENpJte4YOsf0{F&M16bMC5gIbOFFG|HweAAR ztgN$W%FlcwQ&-Zb!n~p=_bCY5{-ZkJ)Ppj>1!R+Hy!q{w4bfm1fY;&u#-*rhS zxt6JbWbR977xH2Cl|iO%QOw^(r7>)fmkySETSsTTb=&&R9TlP|U_s9Om7mtGV3aHl z5>6Rt?q1Ce<=q%zA;?h%$Q@?HOy@O?j)rh4x)z%Luxw^nWv$^B2%~7nekIaI0HmPw zDiu|g<>i%FB^LFS&q0H{dicoIgiN%j{Kscd-3O=re%!f zDVIch8H;QlL$3l8y)}mL?Li{YqF9+2)kDmK@4HIG+1@`mQwZ%Di>RfL==z_>)znD@ zZ_6wOAl0RnbPPCZbc%5OT{t)9`nV6fKpRy-E#6yY@dD36v9aaLSGeerI?Z=fCd*JaS(9{`BZ#9dwOYV zN>Mxyh8g~}nHE2eje<;zi98eG^IoDA(irEtnhl_3zdbRY>NT(*oARX+|9r;lDnEB*bx%7|?q zgT`bK_hcF=b_kR)CFRXbq7~|M;AtLJ{dGbU{`>6Jjx4SGI-ECN3%borFBDtyh4~*~Hc(1s#DMw(o(6&j`~dJY;+MFLBeO3dKcMi7 zD~kc~5a!7&#jJSW7M?+HPyGS5b7ZzXgct>&ouFwXKMnbRfD!O%Hh(^?2O_c^3-|2dk(z=% zxZif_L97Cp)!#+5a$G!K*BXey>n*of-r+bS3k!P&B-cQV8L507)K^{DQTR|#mCYwf2spV9!rdct^zEc}x~B}uPPdJ@Eh=;~-}WvN6lmn?1l<1K*= zIJrdMPueX?xE8I3MKbtP^r|Y#btm`2<*}W|_Ox0E^;Ces)B5ZSyOh+4N5iT}I$&jY zdUURws+2m(P*JJ||DQ17ufkpu@*n?)!yM*p4rZXlv30iN;(C!-PA6k0mGBJllX~j1 zt`Oqs8UAcZqGB{sj79`j4xb+YGW>Km=ayH6iIKdQ_CP&gQu^k{;St&afhjD*sjc6% zd_FuI4Om$Cqr>sT!YSd>th^kg?wp@66buXus)~&b0y%k$g@r|6bSWS#d{JMC{EZ zJ0@-GnC0iA$5)?0!={YJ5ei$^B#(mgO>>J}o49K12bfuhjG=mej$z1`B?CdujE7lMwfauY?_OrAEM3BdI>p;9sj z3Y%`|7oVdp16bwz!c)i?nLlC^K8R<)<0RlDQXLQ_5@1z6G82AMYzrUvQ$To3AA=)u zb*ygSsl`q}G%P#}pfk=bCTF-t#*gx%(`+?B5%ceNOK1F`gT5zR49xF z_DQppPRIK!I(~iE%wQuWLt#r!7=>EmgwHpV$4x*u@_r`dO}(r=oOe8Q@s~tF^a;726hUQ#Ht|ix9OAkWy0s5~U#c$^R36Mn-q`7LHA4 zDA6SgdZ%MQ%7ixsV0mc}m+8~BU(T($y6Vc=a&-P|-Ry;8Ue(c&@Pfd5mj~dPru9&g z^+G}beYkYqN?fxwqQFhN2vX`(|M?HBkp+I+!Q4oeW4~2gaygf^#@7ZJ7nZKk+L+oe zn*+$3)!a<#^XtxqI=b@m;(Y-!_uzpd*U<$ko->cv*NUCjxR*}a&CVn`#1Vsz&z{O! zEe&NA;M6#=I>kE08gA+QYz;$?u%ss=$JAe2^OWtkl1R?hf{90>8|>MB+7Qc`Bv6ze zv=$c}9)G3g%1jK1^S++DySxilYszb`&MvK0^05z~yoQ6^CLhq3VPSD#1A#l!Eb`5T zsn;?UUP-(mWysUl;$T!wN!mTBoGmUm330F`D!dcdbMpQ^vg!CZm$n0ApU*hU;_Sk3 z0Vs!vaBffXZoCDFR%cvgE8ztfR+CB|cnJBo6KJihtOpj<%T30DD067?=UK@8E3QMw z&BeO+YFr%mQHH2I#3(kp2=k$=I;JGY5fU2B?dr>?48Umb%^hH*@P`zlEDb*A{&IUm zDa_ceRM)&$kuj-iN_+EvEz`YorvCG}K(PM8+FCFI&bsZ+c!u02dDBkx;4H`LrY-;T zW;%!XuBf)Q`t^v;Tae6A^2OUEKOrJkLW;fnQOGxvD^qP?+U1DS9*Y3!t2 z%6vv`DsNhF50^6@d)o~GpLf8>Q)oiB+U+1*CFz9cWl;&B)?)NC@TPi(xP1`e^SlqA zjbkaw1zgZq2NxpYnCF)8t-M~&H9`|;MdX=w9#05-78X_C$8H#Y1c)tjb8f{nTFxDh zj9e$`ym)Cyjkai9G})|t0_t}7i?tS}wvY#r_Z!~4bZll*zV!yRbj*9%OoUVV6u+1)ZPM^N5Z+M85+Cd9m-wf%)-Hs)n!# zqc=6v$@&BR3^4GKWwbQs7Z-y)UA@T2$tW~@)dK^VDS+DGaba=G8D{PpZIdn^(DfyU19Ykwu|xu7={DER9-(a}5!YK?3lllP^0Bs%sF(G-%wT6M;alrFt(b8MVjtn z?__0VR-m9|Qk39l>C^=d4)kAHrN7*Fa=Oo%N-2T1c4)*YT6X1RNM4fiTJ??#oUe;S|8ySWWiW}e8G|D+^6 z=C5j8<s|1>?2MM&M00Vt4#dBMLVbslCQJ&@Gaee&Gf{~dRbQ$(jkk)oD7EBT$+xGbP%~0% zupIt2-$JX_TElMYOcBe{%Q(gbLTW$G^$Cu3dBY3A)f9v<5egUarIj;jq0;6>yXBqt zAY-sL*bw)&tAvXEGrhI`s-^|0KTDy!j}HSxC^aQN5tVQ3WE4RL*~D94Ufft2n$<6v z9fMryp*&cgvXse1$~DM>hc5$9ngXm zVn<_HH31*DRLxu}u=Tk~#nJ43l38W)_j|g^NPT6~4b{+FD#!Ws`kG*q-r7(QqLKZ$ zwpUV7LOAvb3V>qlRranHOUoC+DqzMH zcq%PaYBIaXz4wKeCN^5q3|ON$PW7Q&oSaz|RT_{6vScLQmYLc+kg%^6Q+NIfPwiJ& zb!`3oxux~9tNw3Cml@{io1&d$3^c6Q(atA4{7*d9u9IYBWH^C$x){xu+qI!=Lc}9Z zC?_^8*>zDD<-cUKwD3eULf!?9oehM%j((lge~bV4I#~coD*|HNW}H5m)~l({QK88Q z-Dgr@Bc;7K*abt^P3G{lctA?KS`}Q2r;@{+&p|z69sQG@sfJdy)2?@aJNU|u{`h!= zdx1VpMp|~wYm+e7#2OY%q*%9|$$IwtDItwVj&oL(qOfvVubgTCx?)4`pF^h>zzG|xl zm}*f@ETZmupX<>HMDl40U(-Ew+8p;ur+FPKx0(u`PlTuzrdFJRKLbFk~4 zh;HfrqHMK`_xW0vZ@4fr_ZUWAe7;(|vxZk7P-9EdEen=&y85l|z2|6$^Y_`R$M0}`jik-i2hjmJpC=*FE>`4T_+MGPL5j9^sk{!`Qlb;6 zKYesf#BkQKyJEDSE3|n6FIf9m;PwSYn|rU|pZ1|hxDVU^d8M%; zUi*L&6yw74HZFyMRCuVaK|LG~O#RlZ${~E1aL5=ZdbD zM?&Iv>DGtY^j*qtm-k9SRzx&Hxw0&v=SgHLb((`RUDQRxvuH5j~@^8)GxL)8N_VPK>4TLY6DTyavni7B1s4sfG?OqMEq*7KXh>-NR*6vf)>q1?t&oMhr+VaJ6o)N2<-Ygw6u!0HcyLN`GT*==9Wt<1;hGzl zJM9M#RQPzD7kj~3BwVZ$@jdsPaMu|}0Si9%*#%~G2gzEF(`1p@sgVJKWrO!Vl2vN6 zC-#w>v1K{M#Is{viX8?yNTvHRI1bwtSt0ZSEsYc$Gp?P0k!xtzlhFE4S=>LD z_pm7-T$Bu6-(Oxg);bJaK1!vBu-niqxgGaSWxgH0bFqONPd7l)f`I@`OSoFw9MhA# zw0JknFIc9`d^;h%WpOD9ZnrZCSj|LE4d;sv+c%L|smz{S-n%IKsp%&vG`O9b0nJ5V zWpXQ$&WRf>dZK|uqBg4?PP~=60I3lMZK2hRD~gPod>;EI{sx=<#^MN$UIEhvb#;M$vFRSWpEv4tgDNaoP3z>ryY?wS0~Wd9Zl= z=Tjka{ZnpyFy;V{-|05&vtQSm?4vcvK6$lrQ$k=5xH372zzg+GR@(@}b z{gE*zCQ;u}U)y40ruWb!u8T1AK@iCYc`*#x%q&qJ1z=B_n^}HG18+RO<_4}{W{yUS zjnOkY8N9RdIMIu!$^O>61~v}uR#*HL_!2a$u$&c_!}`O;#kUN6P&Xh?|6oSJUKcBd za8tBRDn^0(c$e9sn2X}{qsiR7D7XHHOic-SpM~jM`t;Lr3D9r=`D;RA`s?wc z#f5jMLrqB=D;XOvht03x34SvRYkKN+d^D6#2&qtougL~FZP#}mX#<)`N6Bhw$cf|W z=4It-@j5{rB8?gjAIFc7P|;9au19-c+j+@a@2#np)|O|*Q@KX=@(;L*FR6KK58;Lw zOa1bep06#mtjcjENl^~E`fJmAtGVyngFGly#NJxM4`gwH^Ym2>vZyCIpYup~1ztq$~+YJ=E+-NFXp;jqTcoCN0^kFv(f8+F)Y{NzWJ3 z6dW7H=YAn7K3^L6PJpN~mVGU6LQt_ecDck)ABE>I^Xr7+)Z=Qi)W%k$&Gno$100qc z1iIBCb`T*a-*hHHMkBOZ=}MRs{}cC$hQ{e&msT;s0}PyjEWFPL>2HDjPii_k47l@F zi;F8OEMi8#sA5Xo6sL6_7}Jx}QbaM<-?uWYHkzMTe9pK}^@x*$2cD%yxQvcVA$g2I zV7sxJ49kc5edrlFs|v2+zXbJrOMhXp&tVGs7~no8P^p4pF5FdM;uke*co2Z zUym2%C@D{T0PLHFR(DmB0&|8eEG`}ge(c_7HT!bfYSdvz=0wJIP1v?3gIh-@TcN{q zOA}?V8_3Qa)v5{2W?O6y#)1SUNET=lRFB3ry%gMgL=>x>!c6b(D< z2_A7zeP$M6NZ5eFvtKg5!ha8&nHjtPOvZTIdF!X02vb;DmvF9Sy4lJI8u&mcq>V~$ z#R4CKqP;sg(&ou3s%TGbhSfkUcm!r)$(Z^eDs~D|)Qhe1tj2|f6W@jT+Ea|;DxiQ3 z0b&s3MMB1ua1$}Fe5z}jT~t)mQX*;1IWRbeInWyJHgYhk)B2ID7jd3BOt-C?&)L5^ zaMf#bjCbZjUpRCwh#k>8fDl4JR$@W`EE{4-8oEO<Bcp?D%bzmHrKsu)?$b@8Vq#oRX*QV0oFn86_b;so zq%s4DQ!8^nd2~}bQH&4MlElBlf`WtlQER-msQ=D)t z2K7s2bdcAY*3egaxLpYR)9$tIw3}OcBBtb%AX?3M&F`G${S?wFzu5F!=4XeX0)pqp zHn13=#uo_}?e{I|me$g=BOQ}bZ2ME>Sjlx{(aNN0=|oMh;9dt-wozh^z&<;q5VOP& z*?j+$ce_8AsO3DQTN?9b0R1{&|{5lrN!cl}g95XNGSgy;w6} z)MSY9?kcV{p5pf<0a>fvvzv3Kd95$FzH~EVTm?BvlVwhgY~{Hyc8Q;9%)G3!)Af8T z!wcf=&c&y;z1(T;_+|DMFua|4@9oPg_BI}$qe?($M%Kp^x@DLbOnR-bGqgh}+%fvmoX$xGw=-hxnXuPQtf z&}Ib0FQLX7N-Kvz@AkV0`;mZu@j-a76m1jY!eqrXDUs_T%CPWC9H(7FQ0Ng;$ zi&2-jAS(#h0aRoXlCUq7N#jAB?rRsHy&O&)W}!M?2RIL|M8sv!)+X zS>U?;YYEt~aHlcnbGJEtTe&}v0sVXw#ii-74NP{wXF*SfqlyL|5p{x*7IxFS3l^3w z`*F2$8cBTc3HfrY1kVghLr^4BMVuGVUJ#KeBrUtl0;23oZV00G-ON1mi=r%XY1y8J zlQgldVE0d$5ca6`G0vobW!rMP8Aj+Va|D?xtO#jWHQ9jMU@7q|WA5~L^E<oW6XePoUt!w2)(HU!O1Hy4-If6Fq@@YLdtvPS)Eaz=lf z{-8JwIr?JSV&0vX8!PRXWTk{%v%!jzFF71lsOWLEQnjFK2>n4m4Q-MTONnT4l`>Sh zI#9h#QYOvo*4y96fhBuJlp$ZRiivCMk9T@87~CJDooE01){%pQ?HYC;X~;iZ zb-lctuCYSL%FKNCO&mlqx+hG&J=em6)WCb#5H!kjaC7=Ic z=fcUwdD?ZlzOli6hGMVD1=objQ+CnVJ^nas#jz^%fa%#yKX(18I50EGai`#YO3ugg z`XSME9ivPmvJ2=J@V?u#G_zWyfyLcWzszAOEzMffS{mAh>hutc;D$o4q)(Ysn#j=c z-g|KayVB$aqemKq|5ls%GU+Y53X$TC>{}WAA(sah+tn~1i8V8J4%VI=Gyb|UP?f5? zyUem13SzI<=4E6u++v=YY^kHnI0_wSV%GV(pGBwo{HIEh9h8Q_sE6~YVX#z?oMekY zLS;u^_dr1ET5P5xk#-WWeCC)g4N$8H~50;Epf_-3&0@PwF=7i zVelM&4p-l=hJ{M0Q2?_*rp>g`E`}dMl5{qePM{9zooh2CR?rCq=gTZkrWT(&0?UkF zDW&Z8<>^~#Dx*)ADt}o9HW@RHfK;=-T6{Xkd9(3EsX7NmZi&LD6 zupQybARxz`B8Rvj{pgZxWU%W{TR+v}mPV?-4VUnJFE{!r>e}^-ZODn{mq^%g8rBhuqp-)04CAs zdpW(asgg8hsE!Q+qrPbSj?>h1FpdUy#`frh<}kg zV2+yOU&RN~vdWx=BtFx8qPqA7#`eOz!KfFKDFo1RUK9sX=9>hjCYVWVbE^B%oRKp@ zAk}6sr(^p`qJg}+<8fm7Y}H#$|GO`3h%t2(fJGW`)=jd}?|tjNf5OJ13zgo@*ZpaB zBn%oF6yPuaVBGe#+Qb;dQ@bBQ-6?&naMq)0a@YjXBSwHXp!_Sl`hqpTI87EPIz9ha z>?BgXbdc;yKNGm_#$yiuv$c~{+oi>QdHdDb!_dm?W)%MhG37a2XW+)&+m-e5VByQv zINugAf7Wh;;WlBvpPhV2C|(bF95}RaBLAcRqF&0&3vaPnGm~L`*>h<-tK<@`uquTeAngIwZKfHI*YuQ)>lUp!W1&yHZz7BL$C)+r5zGh(iRjxM)1h$}Ig67CNEg7& zRR_=(z?$Db8%Bh{!?Cl0ZsWA9dfwVAZQb_3#0g$6ozkfCFF*I3r+!!~Z@D4LCxV&g z;9K0oQ7Q>d+}noJc_YOs4vMC{jsd6Do&Mk}f&0u#Q;Nz?+4qwJj9eYOD;piVO@DP; z+-m!Wv=gD*G4IBPkNEzAX?-+?ni#|+WO+;I9@Abp7<3>U=Y3yuP3AomlxlL?^=g}~ zfeKV;6HEm5*wMDjP(&e{z z4&-rozls?TI8~8Lx3+}7bVEsw5c=GB@yvV}vI67nO)3ZOu|k+8n^Omw8z&2ky`$UD zLCD41XOwNSKgO$v^I%YK>VpEANNwNW8G7+ZD9nTH@ARl+B}x1$X|WHNM98;5lXh|c zniR`VLHC?Dzpk4CP#gmJ45q)Kqk*Ht+3miwauY!E%4C0A_Qt9~;gjAwe)N}9<4 zRak^`S|*&0xMRdo^6NfK=L!p?k%!B`SQWOE5s$21!3A*ton%Sq#sIUEu|Z#Lcw~42 z2B72U`g+pn#}maITMs;u;7r#PdYGOe^u;6Nj}0!4)#(c+vc*klBbpS+I9hUAX0EWO z0>ke=B3-P8A~sZ&s4jLVbgq;5^wK*RnT?^zL*IuoEB3#oWH4LGLz&fa+90VhRrmB# zG9nb5#p~Pqz!z)YCop}uOd#T9w>g;n*rc=mcJV6wsTy-He&iArBDpg%{hC-Gj@y*S z@+Vi-gdEH|mIN+p4V4A@mqMJ5*nq{tnFyrBLnT6tF?5h6?&T23DW*M#a-%~}0=}z1 z(Xl(VrUU<8Ya^u>fj|zmVUZeg(G=zl2|P2(PHj`fX-P&;2#dsYBUCFs+k}XUip%OO zcQlQy0jo;pc(%UX^>l~nOCCA=2j6XIG`G(8ezn1PoCt8%PFn)LF8O5H`ugo%wP!1; z;xWi+YiiI;$1xFCXy0Jw)+Qvr#zw~nxMGeg2S9mLWL=<;;XUtC^H;yme*CG<9W~bEJN-n zVxX(>K_#XLRG}j2%kIN*Rxhn!Hn89}hZu%eU^4nu25;AKR629fG;&wS!ru}tQ*}s$ zT%K@x6(l|xXCYvvu3|JJJ2}o-ZHx4)?u+dJ)&TLXbUu|T103omV6|7|`c_AVGCcd( z7PlHO4h1p3$TmwOL8f(D4a;=ul~%#|T<+u*1-?)vC#LKCu;oe?Iw|=vEY8~-kKOiz1&%7O#6oJWvpCR$)XTWyEO1wPLy#mrN&8>~+l^L(XR13DKK){{Lb>)6Lc<+%+IZh9 zKOmZow^#O6)&`M|)M*e)bRNjUvVoQQ$yja{n|8X-Cn)7ru}#vn)GZr;NJ9C8jq`H+ zFy~=5cKX^d-vf~W_Tp5Mw~N27mJPFNoo_Lpmi1;l0|pC!LFtG8qUo6KH2pq7M$s^! zXUQ}~og1gA8&_N%VSA;+!SsBI`r~_9uRrD&2iyueiY_|86&f2g#4}2}^6;PWop0h zb%%gezUmKmg1@?hWh1HJnjUz6_o)EexErs3oXeT>x}{JYnR->}@hh6T$ z1sz8;W(-?}MQVc2CCsF=iyQ z_6PU;`!)9BVAD`Ra8C^6Z{nxz3dk&-?}%E^jywZ2QMF$&bAF=ZGRnkQt?W<{z&N*|m*EmQ1epy3L?UdP5#DK__>-u> zZxi-++n_;rf%6Rz^eAa>-1GMyqDXS}|M5e0Th=?ot>-yqFTlv<;En8j0!mHde8M$e z@bCZo{jZXk$rmy16?W>P7A0a(I0&D`4SFx|BCmA}KO}&@LK7l63Mim!?>*uC`{Vy= zz6H`7n^04pOJZN9Ielf%;?(#-(&d2qEZ#EbuMT4z#rD_8{uo~yJp}5e-ktrA0qNaj z81^=&+vYiMD;P>N-~At8XD^J2jl1U3=m`_f3%8RI37t~k^W@F{pwt|!oJ`0 z_WxT4B!-I~y%VZhX6#?H`p>T&v6LjfH3q1WcvOG)_Gh2xHSiK7yp~(P{;>T29iPr1 zMzp}!s$el>%zwV`j|Z0}D2nI|HrrY1|8`Vi0P5(|qHs=7Xh$4Hhk2sQtfEZ?{R6e6 zvf)3Yp;L!waUFP**sRU8Nj`huizAATHR5OfEOtNQReCOj;Bpy@xQ(&VV=Y2U`g(V{ zoES0nMcVA_oB|J}=YYzRf@XIUlMY37`za7L5YoX5?@(8tmz!^FxDTqU5)t{GFIE4P zS9%`xuT=z^_w!l|fo~!rVxpq`NT|plHlNRrEBhgwCi=tb2@w(Aua68@auL>RZPm3! zS&fxm!jp57ndMDe-Z4R6>){%?oI;-|a zd7XO?Td&&zFv!gKAeIjR-u$}^_tSpd`v9?Tq8p2p9q-pB*TNLoxv1Da(jbJNRxjh! zYW}b_zk&_Dw46Nkk<0Fb-k3pP{k1?pL*ETSqcv8RFxd@Oc$V@&D z2#8KkajfsRXQ&m^^Ay=gq4Fswd^_+<17;j<7xsn!z1K!a8LP>H1;=vwSwZ}@2xjFu zqpIw5GuKiKF;iBSzdxi0rHlVGaSswdXU;h{IndvcxYg>PvCL2y6Cj(J{%&L6i%lW>Y>yY z`J?_ha{b=wFw#7UA#GVv^U~b=`0V-A`<@+?kd5?>rZlR`p|E zJvk#WMG}uEyiAiPGb!^;)$7DsPrS)?_mUR&o9FS5c9*U2Zed~nU~O-1)=w{}UT4mQ zqQZmj#0W2B|2c1lBY*RCKd|w(UzxY}seTgB@ze22$w?x^!-s~2xxSoOqm?#Pw-O%S z@O$0yuhO@2a!h=4I_~3tE%i>1Ntm6Vu6AGd#aCtUK122Pw(D}=n+aWirfv_E-ir4= z%JVPZJiFt5JN*W#{H^csDBgZke%JmyR6C4=IA3~pc=Wt=UXXrLdXN`i;}9X0h@@c^ ztoiagYT^I21{~i4(&$s=JK>W%S-CQLwWsmd-FAH@3~Nt3JOUkFj8{jOY0A7@kEe1^ z>W^F>$^1n3>9J`j3-bGV`-xxgA?*T#0-bB>>S_V7u+8eh@r`<-70WNu>#xPRJ%{vs zq)c=GIx4o)smAK|%X#k?;@2y01r067lc78f_A(46`Qd1yBV3xw|0oHbW2lVxz5#iK zwM7@(sIPt`2og!4#7DPvDhKV4d)(!%H&%|yqS8un{nORV)~rMQBHxme4NfrmT&!pV zAm^yJe#Q}vc8f_Xkwaf5M0R$1IcamagEA>uY7CC~IUcuP;ji}^p2@%6yVIED-SBlLFrByI01-Lc)ik+{uLqVl=RZAmW8Wec8=_8H>*K!#f8{5wH2yF+aRbw`qIuXryc7LDR zRVzaAc6Ihf%yYcObv!IPrO8*ZE0O`F% zc3)9!36Z6%Cv`ZHkiaJ!k#RHu@c9P!yv+hoC=igxe(Gl+pW7RC%YaFLhUa#Ue$rT` zdMy{RFq%>3W9qNB*XDN6rS;UL*){sso20gvVo>Fp%c7#T)2O!t)OEKr9F&%41O_Rt z+ulubV(*Y&kArVd)Ael^h}?HTN)c^i_hry+aef|v#G^Z_Zf;Gk7nAF+r`Fm$&U?Y@Z~7LW513*_MZ{cN_1A0}jL51! zqY$sD4$I#n8XNMZdSii(s((SrpR%eUxd@sAgP*Ly#xzV(6T^XbtI10xPpGV!~&ZL*^@MRmgX!GMhp_RxNJ zc&rRWDYu^=-@hvIx0ZZHR}(?RV0`f!;l5)h8YSz8M-63udby}OKi<|7TjXrSO`6bh zWS#Bq7G_4^CHk_9{r`49ny(?qa|=B+kBCal-{rBq=82oMSMu%AZ8?AGUyS;vh)H}! z9V(xe+|9|BXokAxy>Ms1{0Zd1B85>kN3w96jOvr_=JgQM+nF$cB^O5hVs?Azs%9$ ze@0V1ue}cX24!7GOvslA;3{6{)0AMnBb9|Q!11Xod1W#NdSmm3B}e?)WqVbQe0 zNsz3DN8E;YRFU}*gvo{5h{8lhM4G%Gs^Y3aoqG?I*j}^ET*mo9_{s8FXCz+gPpg3w zgp{w-h+G_>T*-Y@-^r)ai?$w5`x{_*%FG>YOK0e`?BpiT+62Vv*FEDMXKegDo2MAre@kKSey{w=! z{t8j3oFn9Q7Jn^6(V+IJnbeZG7X544@1aEtq(X{(`=2F~@eKk)V*IR9bsY4=sk{J8 z{nOQC`Ckj5f)1Xi%RPE0qmphM%F&Dl^FCD-`Qb%LiKWez9tTk^BRuq7wt7IYm;nhlYUgR52mLS0zq@5dyf0kRzzRbika51wn zv2l`8+3GZu7q{En80ZX|Q2=1fnC}%>gW^2R%s%qcR2#fx{K~&vu4VW4$9ZY%FRgXa z3Z-7K2RT)HcA$hDB+~=TBK|szdHA7-#7G`qbagka?PdS8=?+Ni+mF+)$Fc}ibtKhr)1+d{) zj`r+-#1ZQY8vH&PfkIYuZ~T=-W6UCQn%nqM+SJ#w&Kp@qf2i`Y_l_euHyB-letux!d|R~$ykSk+Xk%KMpHT~A1=i#ko-MHYjZvz^l^rl@1+L|zPx;T867BhzIRUUZij zIbUljnR|q?(}4|T%5YgB+SBW6$yuS}}oaI@^Ym#pEh^z6M*54ed!4fxR>@ z9F(c(BL>MiSvR>PJDyK?yg>nd>Sp@&lBNC8)E}OQKlbG|rVFm`^?hv-6v)Ik4hAE4 zf!WH++T?}Qnw8x}8l4p7d;9WLh^yNTASNXQO2Z#%J9!ZSbcboOR{nMc)f~O6|Dld2-`~~=NDT+vdC6~%bg>{Xlv{5^`*-Kf)OT?t7!MUZabkAv3R*GJ`o_1mP zdsu{5<^Aks)6~&kSbV^BWO03;Xg_J$SFRsY=4G;vR7JEje1^hndkuvy4qu$TVX1N| zqC;YDnkP&YVweotwcPbxEL_Ytzdz2Uh6ODjWcsB!7BkORd^BC*7K_}yF>Kf@9nowx z>RqZU+nedRE(}TTjPY7p;hosMMr3YGF`qMd=X6^a19PRMK6-;(%syW~rviw#r7w{f z)yk}IY&liY7jLyU`^@}>eb+iXN;0>Wkhhe*xa_-p1Zj$iu(pxc7ZE^HSy4_~)g~Kk z*I*&?->Sv8pSt4U`%TokNWvdBA)3HD#;yLPID(`m&zFqrT;M_>N7^xceENGL!U%+@ zH7y5{PfV@N?QsBF78UCu1|lNj&WLU&7ZZ;BjGgEr|p1JfduO(j!Q+=En&aV)f& z$!9Rd1V2sb^=$mSr zMpaM`4^nYcu~kh^%`m}Fs)p|@Xy`WY;_m?>Iua5lmeQ1Vw&uE$+A4g?-k%DBKfe1* zLF`HiVCU|-8O$=EyFfruQMK0pD!2Hm6cIKs{1LPdPk|>L*S?V<;E#FB#^PeZxIMvv zL9JC+Cp-68bkxb3Y&aJE4lE%9k`m%nvvn#)c?Jd4M)9+2EnmHS0TGupjGS%Rt<8Zy zT|i;5fdaR~&SRC~09<2cC6$?4l`G7T$1}A#AxtHT<)*N(>gR@K@5Jo~Ck-9|2Q0VZ(W| z^9tNQ5W_I_;zCrM562qWF{dYuRBl7x9nwyIb!i9;3LxpQ+2Qtl!A0))bv1Q6e`!Cb z%C1aOP;oR<`$dbUJtQwY@iQ~m&_2H7fyN87Dg8R9yz62S=g%Jr!X8WsGR5R}o5o3T zjTn|HUp*slBnG~yi0vBf=vIe?h9M&}k(Ji$^`$>D`{0lFiAPFo)_lhQOKp)r_=3Ds z5T+&?P$D`g;HttJmh#@Jb{=2d6vaF&FvxFm8+I^N`TC*h&B$Pc5!&n*{3-%uDt)Lp z8cLg8{jFJUi3vK?rl#2^rui3=(o@3;gBomLrPl-ybiV1aqRH7>YRUGb+5e(Io<+9@ z@0?g$4HF>qAzG%h!oxix#61;9!Yyx){v5#{Fmu%)93&pRASXK@kg4-r87}0n+b4KS zGOl7&HaIwtBVr+FRZq=FMZ-r0-Z;CUZ5_Dlpheqm(8brF3HRd=2(U6!sS^zl)vW=C zKxSn9J`qoZ^m)NgBC6#OcwFO&Vv6L%Sin7vPahX_dj5{j-aGv+9dM1;jJAb_Nzg#n zMRwp~r-?9}4HNWurCK5_J#s*J&?jH+T{v&M|3fv_>0f6U0yuoGcve0S**OndhZeHE ztbt3{!~vQS0rnaRe8_~)MKCxQk;zjXkpaQ_;ye=v9~vRLzIOBu!YTgI$`N{|yiIIkT^FA*s z%sY`cZ;Ly(R&j{%f)p@#J{PcALij+vGbw4u>h*%-40^q$Pu2VyG>~nnQfbNppxP2x zLU@>sV|FwE*9WsVgOf~2)+=wts!*t2f#B;S!gKc8`5Z`H_vcG=Ivokwb263kgl}}# zACwA%-rGI4{|z<3A?(Gd<$sF2BZVNV;DOsX4vbpKBD6-=^tG8s+Ew58KgKf)*kyM~ z4Ga#<@rJumQE^{Ic&8I|6B3<&%cU||p$Hd;;zZE{tM9qRetx%gQjIe#$Ff3v_Zvd2=+7JwcCQ&iJD!t4W9nhTW+nodHGQBwxM3_@s94Y~cG;!f4Ohc+5 zvtcTojRtHkEqHer8 z)eM{JUhXc&Aee$+F=OKfc`!{$R;!irTxwSWz6ob6Qlua**YJoTg0aH%+9wA5LH6BX zu=mtdEhUFL*Kw$lfhU(D|`4=NvTzhZNsA4AYtYJIAlv<0*||3oy| zNmVLp3;WwG$iocoEW{l3Ct1k}-gnNlsDLS`-QRe;@06^-trx_BKuW61glnc3hXy7B z*Wk9#qX2Z_M8(Ec85R*2bH1&`6h!fzSy}XPHJI9`Bw({LsQok>0B20Vzxm?;Xu4m@ zm+T3*DNEN(yNfgOnBo(|%XEqc20{WqH70mUt{Sy%(K!Wgdm7@iV!%~4)V`7>M{jAL z;fCsy>6=38HiY5}D!{RA9cF36;rTw~l{Nuy& zVJUADg%&h2@K`WFg*OfyFLaLo*yP4tSY}-q?6Os&3hv?JyhxwtX0pUex_c+INaN%W435YTrVVkW}+MGAf%M*MMcB z0L=o&${B9Wxrc|*u*uJYJL)0SkTasAH0l99OD8^s_@ooNE~%sEwmjLy#{KDfL>?Xg z;JpP^9l@5Wls==is@YI#S?XO`P}Yz~8$6JH`l)nR0MMO?oIm!H1X)M0j&rLw`ma#8wvNf!^Uao;%a+yK)RkSdgG^B-8QHPLO7?mkue`YzM4|_aErau zlyqgj@mzn=suW9PcneG~K%?E-Z0H051vxMZ=TjJ+hmE61Iml1Ox@eX2 z`p?oE!H5oDr9-p?(J&*_9nniC%v2<2HpKe2;$hLTmVJ+yZP1!65fTl{0=g6e(ZjL4 zh_Lp;c{+4ev(SSwmnmd>65msPy{LVaa8iwR;(ukJwyS+Vj^ zISA+=X9-wqr*Ws;lA=Lp<{qf_5osC8%1+3s58`6$6pxFkz2aJNhxn&_zx#d5QR-7DUyqm1VOM_UTK@6KpiqLzzsxTh)l8>@~`;j(ue=}Zm zOnD&dT@4H3s`U~(5AWT_f4$3hl#Ivm-s=W`P)Una0u>MtNtJDHi>EEwiAk0{09si`-Hf-VOFntYrCub|pY{#H>wf3MI#DbQ@x>s~hbxd;&y-IL^8HC5Z7YaWAZp0Tf90qCft@P|oOT*Cfai zIk`LWH6y@^^YgOrw{?m6lG1%Evtj*DLhmTuZ~J@tK&1A?!a*T5MUOSs`|r2EDc%tb zozE*8oEw>8k%JK_NU3SbB2>I9()z~3Q*+hAJ_k5NQPe%}nCA{piVo`66rX@K+MoW$ z$OXUMWwGPGFKy^9kMRy9z?VCFP9}nCLxZR>x6(V7O9a2sjoNC%tx`O@p8)s>3R;Qe#)G z>R8<$XXF9O4FI_Ng6GzR7ji=Km?HEn1yaFIQt2EmvtB)n^CxOCsweK?ez*Qn2*Bza zHfG(>pWZz+7$|H7k}R>Vt}cXmoJb_p^ykZg`+JklrpRMtE%%r8Z`6Mjm>X z3kMSJ(s9ln1jr(Z_W?ZtxdxfmRn67*E;eBOjXe<~7nMvDXiXnjc@ZOLRwpykQiDuV zlh3KBDC^nSS=ncrd7%#M@{CI*WF#FMR}NDa$;rDfE6M$r8zf?uEu?b9D5+Ag&X@gX*G*RFif1HVt8F5Ng{nZcS0?h^L$&9o$CHo zLcBjD=(+<@c-Z%~HuLo%R_J$z^^EV;Q5^FhEEbk~iVRC9Pp0q}zQa7am3H*LW_9{X z8_S<^-{a9c;m8q+hdS2O=H?oTh=~UW1@%%=sHm>=r3GG?kzy_V59fW}f~lri3O>93xKY5&^;fN+t7tD{f-K1{)bvaGN}Gf|DR1e&#x(tSqFkFpN77#N@WF z618OqRxo^W2~n#B@BqHJHe+@AV{8jE>#;;2p>7uhV-lXamgzVPTi%2vxWaSH2L@lk z-~y60Ww3XO(*G6GAEH826Y&lB43CW5YsIp#?tELEV^!a*vl;}t3qCS7YHn>wbqXQv z4=Snw*Ecb>Ffk5e#qTvNyyhkvoVmM0wG#WVVP`DF3iV)%T(!+r5#=Za%u@SU6_*mv zvT459%e@Us`5O!iJ1Ie$mDRes%Bz)*wM#Mgk4xuoj01%MVmx~wvR;DMa1YM9uSU7q zu<@{c{YZ(rb>4ie?Jz8rRMpYnVJcO$nK&2(Fd~tY3x}j6_C1Dt&;;JH%_t{nHw#&C zk+J6*8eM?sVU$kH1z*nP5Xv3JFJBxygfRLjS03Q#GCk5U<<$ZBKb~6=9YKh) zmM&Su*YjK_y$RAbHr-tzq3-h{eNXg{11dBv{A_G|M8$H>#@yz?A)4ZPnwMK!n4ei2 zx^>?K4RxY_ zKimIjU6P?mY?#swbk1O^_hJ|E?Zt8NafIu?}V6;&3u zI(8oIVHN*tcl_DgILmJ$wT-?_E!B*cmhl5=3dFma`B|b_+P@EqzmAI@co0nj<#w1& z>GfLV`k$eIVrNEfj5QP^mGu8VpY;2A!}PZ^KD93^ufSP&gjlZzUK_rKd7@EbwM zF8uLLhIV4y!q MQ8|$^AsxT}19}+I_y7O^ literal 0 HcmV?d00001 diff --git a/jfrog-applications/SUMMARY.md b/jfrog-applications/SUMMARY.md index e7493bf..d7447ed 100644 --- a/jfrog-applications/SUMMARY.md +++ b/jfrog-applications/SUMMARY.md @@ -66,19 +66,24 @@ * [Supported Technologies](jfrog-applications/frogbot/supported-technologies.md) * [Setup](frogbot/setup-frogbot.md) * [Frogbot Configuration](frogbot/frogbot-configuration.md) - * [Setup Frogbot Using GitHub Actions](frogbot/setup-frogbot-using-github-actions.md) + * [Setup Frogbot Using GitHub Actions](jfrog-applications/frogbot/setup-frogbot/setup-frogbot-using-github-actions/README.md) + * [OIDC Authentication](jfrog-applications/frogbot/setup-frogbot/setup-frogbot-using-github-actions/oidc-authentication.md) + * [Scan Git Repository Full Template](jfrog-applications/frogbot/setup-frogbot/setup-frogbot-using-github-actions/scan-git-repository-full-template.md) + * [Scan Pull Request Full Template](jfrog-applications/frogbot/setup-frogbot/setup-frogbot-using-github-actions/scan-pull-request-full-template.md) * [Setup Frogbot Using Jenkins](frogbot/setup-frogbot-using-jenkins.md) * [Setup Frogbot Using JFrog Pipelines](frogbot/setup-frogbot-using-jfrog-pipelines.md) - * [Setup Frogbot Using GitLab CI](frogbot/setup-frogbot-using-gitlab-ci.md) + * [Setup Frogbot Using GitLab CI](jfrog-applications/frogbot/setup-frogbot/setup-frogbot-using-gitlab-ci/README.md) + * [GitLab Full Template](jfrog-applications/frogbot/setup-frogbot/setup-frogbot-using-gitlab-ci/gitlab-full-template.md) * [Setup Frogbot Using Azure Pipelines](frogbot/setup-frogbot-using-azure-pipelines.md) - * [Scan Pull Requests](jfrog-applications/frogbot/scan-pull-requests/README.md) - * [Scan GitHub Pull Request](jfrog-applications/frogbot/scan-pull-requests/scan-github-pull-request.md) - * [Scan Gitlab Pull Request](jfrog-applications/frogbot/scan-pull-requests/scan-gitlab-pull-request.md) - * [Scan Azure Repos Pull Request](jfrog-applications/frogbot/scan-pull-requests/scan-azure-repos-pull-request.md) - * [Scan Bitbucket Server Pull Request](jfrog-applications/frogbot/scan-pull-requests/scan-bitbucket-server-pull-request.md) - * [Pull Request Scan Results](jfrog-applications/frogbot/scan-pull-requests/pull-request-scan-results.md) - * [Scan Git Repositories](jfrog-applications/frogbot/scan-repositories/README.md) - * [View Security Alerts on GitHub](jfrog-applications/frogbot/scan-repositories/view-security-alerts-on-github.md) + * [Scan Execution](jfrog-applications/frogbot/scan-execution/README.md) + * [Scan Git Repositories](jfrog-applications/frogbot/scan-execution/scan-repositories/README.md) + * [View Security Alerts on GitHub](jfrog-applications/frogbot/scan-execution/scan-repositories/view-security-alerts-on-github.md) + * [Scan Pull Requests](jfrog-applications/frogbot/scan-execution/scan-pull-requests/README.md) + * [Scan GitHub Pull Request](jfrog-applications/frogbot/scan-execution/scan-pull-requests/scan-github-pull-request.md) + * [Scan GitLab Pull Request](jfrog-applications/frogbot/scan-execution/scan-pull-requests/scan-gitlab-pull-request.md) + * [Scan Azure Repos Pull Request](jfrog-applications/frogbot/scan-execution/scan-pull-requests/scan-azure-repos-pull-request.md) + * [Scan Bitbucket Server Pull Request](jfrog-applications/frogbot/scan-execution/scan-pull-requests/scan-bitbucket-server-pull-request.md) + * [Pull Request Scan Results](jfrog-applications/frogbot/scan-execution/scan-pull-requests/pull-request-scan-results.md) * [Frogbot Badge](frogbot/frogbot-badge.md) ## CI & SDKs diff --git a/jfrog-applications/frogbot/setup-frogbot-using-azure-pipelines.md b/jfrog-applications/frogbot/setup-frogbot-using-azure-pipelines.md index 7954d48..3761a41 100644 --- a/jfrog-applications/frogbot/setup-frogbot-using-azure-pipelines.md +++ b/jfrog-applications/frogbot/setup-frogbot-using-azure-pipelines.md @@ -1,6 +1,6 @@ # Setup Frogbot Using Azure Pipelines -**Important Notice**: For Scanning Pull Requests, it is advisable to refrain from setting up Frogbot using Azure Pipelines for open source projects. For further details, please refer to the [👮 Security Note for Pull Requests Scanning](../jfrog-applications/frogbot/scan-pull-requests/#security-note-for-pull-requests-scanning). +**Important Notice**: For Scanning Pull Requests, it is advisable to refrain from setting up Frogbot using Azure Pipelines for open source projects. For further details, please refer to the [👮 Security Note for Pull Requests Scanning](../jfrog-applications/frogbot/scan-execution/scan-pull-requests/#security-note-for-pull-requests-scanning). To install Frogbot on Azure Repos repositories, follow these steps. diff --git a/jfrog-applications/frogbot/setup-frogbot-using-github-actions.md b/jfrog-applications/frogbot/setup-frogbot-using-github-actions.md deleted file mode 100644 index fe4bdbe..0000000 --- a/jfrog-applications/frogbot/setup-frogbot-using-github-actions.md +++ /dev/null @@ -1,104 +0,0 @@ -# Setup Frogbot Using GitHub Actions - -### Github Prerequisites - -* Go to your repository's **settings** tab and save the JFrog connection details as repository secrets with the following names: - - * **JF\_URL** (JFrog Platform URL - Example: `https://acme.jfrog.io`) - - > You can also use **JF\_XRAY\_URL** and **JF\_ARTIFACTORY\_URL** instead of **JF\_URL** - - * **JF\_ACCESS\_TOKEN** (JFrog access token) - - > You can also use **JF\_USER** + **JF\_PASSWORD** instead of **JF\_ACCESS\_TOKEN**. - > - > Instead of using **JF\_ACCESS\_TOKEN** and providing an access token as a GitHub secret, you can utilize the GitHub [OpenID Connect (OIDC)](setup-frogbot-using-github-actions.md#authenticating-using-openid-connect-oidc) authentication protocol. - - * **JF\_GIT\_TOKEN** (GitHub token) - - > You can utilize [$\{{secrets.GITHUB\_TOKEN\}}](https://docs.github.com/en/actions/security-guides/automatic-token-authentication) for **JF\_GIT\_TOKEN**, which is an automatically generated token by GitHub. However, this option comes with a limitation: a workflow, such as Frogbot itself, cannot trigger another workflow. Consequently, if you have additional workflows intended to activate upon the creation of a new pull request, they might not be initiated. To resolve this issue, you can generate a [personal access token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens) and use it as JF\_GIT\_TOKEN. - -![](../.gitbook/assets/github-repository-secrets.png) - -* Under **Actions** > **General**, check the **Allow GitHub Actions to create and approve pull requests** check box. - -![](../.gitbook/assets/github-pr-permissions.png) - -* For open-source projects: Create a new [GitHub environment](https://docs.github.com/en/actions/deployment/targeting-different-environments/using-environments-for-deployment#creating-an-environment) called **frogbot** and add people or public teams as reviewers. The chosen reviewers can trigger Frogbot scans on pull requests. - -![](../.gitbook/assets/github-environment.png) - -### Frogbot GitHub Action Templates - -1. Begin by cloning the GitHub repository to your local environment. -2. Switch to the target branch where you'd like the pull requests to be scanned. -3. Create a file named **frogbot-scan-pull-request.yml**. Fill it with the provided [template](templates/github-actions/frogbot-scan-pull-request.yml), and then push it into the **.github/workflows** directory at the root of your GitHub repository. -4. Return to the default branch. -5. Now, create a file named **frogbot-scan-repository.yml**. Again, populate it with the provided [template](templates/github-actions/frogbot-scan-repository.yml) and push it into the **.github/workflows** directory at the root of your GitHub repository. - -\ - - -
- -Authenticating using OpenID Connect (OIDC) - -**General** - -The sensitive connection details, such as the access token used by JFrog Frogbot, can be automatically generated by the action instead of storing it as a secret in GitHub. This is made possible by leveraging the OpenID-Connect (OIDC) protocol. This protocol can authenticate the workflow issuer and supply a valid access token. Learn more about this integration in [this](https://jfrog.com/blog/secure-access-development-jfrog-github-oidc) blog post. To utilize the OIDC protocol, follow these steps: - -**JFrog Platform configuration** - -1. **Configure an OIDC Integration**: This phase sets an integration between GitHub Actions to the JFrog platform.\ - A) Navigate to the Administration tab In the JFrog Platform UI\ - B) Click `General` | `Manage Integrations`\ - C) Click `New Integration` | `OpenID Connect`:\ - ![](../.gitbook/assets/oidc-new-integration.png)\ - D) Configure the OIDC integration:\ - ![](../.gitbook/assets/oidc-configure-integration.png) - -**Notes**: \ -The 'Provider Name' value should be used as the 'oidc-provider-name' input in Workflow Configuration step 2 below. - -The 'Audience' field does NOT represent the 'aud' claim that can be added to identity-mapping configured in the 'Claims JSON' (shown below). Only claims that are included in the 'Claims Json' created during step 2 will be validated. - -2. **Configure an identity mapping**: This phase sets an integration between a particular GitHub repository to the JFrog platform. - - An identity mapping is a configuration object utilized by the JFrog Platform to associate incoming OIDC claims with particular selected fields. These fields might include `repository`, `actor`, `workflow`, and others. To configure the identity mapping, click on the identity mapping created in section 1 and then click on `Add Identity Mapping`. In the 'priority' field insert the value '1' and fill in the rest of the required fields:\ - ![](../.gitbook/assets/oidc-identity-mapping.png) - - You have the flexibility to define any valid list of claims required for request authentication. You can check a list of the possible claims [here](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#understanding-the-oidc-token). Example Claims JSON: - - ```json - { - "repository": "repository-owner/my-repository" - } - ``` - -#### Workflow configuration - -1. **Set required permissions**: In the course of the protocol's execution, it's imperative to acquire a JSON Web Token (JWT) from GitHub's OIDC provider. To request this token, it's essential to configure the specified permission in the workflow file: - - ```yml - permissions: - id-token: write - ``` -2. **Pass the 'oidc-provider-name' input to the Action (Required)**: The 'oidc-provider-name' parameter designates the OIDC configuration whose one of its identity mapping should align with the generated JWT claims. This input needs to align with the 'Provider Name' value established within the OIDC configuration in the JFrog Platform. -3. **Pass the 'oidc-audience' input to the Action (Optional)**: The 'oidc-audience' input defines the intended recipients of an ID token (JWT), ensuring access is restricted to authorized recipients for the JFrog Platform. By default, it contains the URL of the GitHub repository owner. It enforces a condition, allowing only workflows within the designated repository/organization to request an access token. Read more about it [here](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#customizing-the-audience-value). - -Example step utilizing OpenID Connect: - -When using OIDC integration, you might encounter failures in Xray scans or JFrog Advanced Security scans due to token expiration. - -``` -- uses: jfrog/frogbot@v2 - env: - JF_URL: ${{ vars.JF_URL }} - JF_GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }} - with: - oidc-provider-name: frogbot-integration -``` - -**Note**: If this occurs, try extending the "Token Expiration Time|" in the 'Identity Mapping Configuration" phase to ensure the token remains valid until all scanners are triggered, which may vary depending on the project's size. - -
diff --git a/jfrog-applications/frogbot/setup-frogbot-using-jenkins.md b/jfrog-applications/frogbot/setup-frogbot-using-jenkins.md index ff424c4..f675498 100644 --- a/jfrog-applications/frogbot/setup-frogbot-using-jenkins.md +++ b/jfrog-applications/frogbot/setup-frogbot-using-jenkins.md @@ -1,6 +1,6 @@ # Setup Frogbot Using Jenkins -**Important Notice**: For Scanning Pull Requests, it is advisable to refrain from setting up Frogbot using Jenkins for open source projects. For further details, please refer to the [👮 Security Note for Pull Requests Scanning](../jfrog-applications/frogbot/scan-pull-requests/#security-note-for-pull-requests-scanning). +**Important Notice**: For Scanning Pull Requests, it is advisable to refrain from setting up Frogbot using Jenkins for open source projects. For further details, please refer to the [👮 Security Note for Pull Requests Scanning](../jfrog-applications/frogbot/scan-execution/scan-pull-requests/#security-note-for-pull-requests-scanning). #### 🖥️ Follow these steps to install Frogbot on Jenkins diff --git a/jfrog-applications/frogbot/setup-frogbot-using-jfrog-pipelines.md b/jfrog-applications/frogbot/setup-frogbot-using-jfrog-pipelines.md index 787c20c..4c020aa 100644 --- a/jfrog-applications/frogbot/setup-frogbot-using-jfrog-pipelines.md +++ b/jfrog-applications/frogbot/setup-frogbot-using-jfrog-pipelines.md @@ -1,6 +1,6 @@ # Setup Frogbot Using JFrog Pipelines -**Important Notice**: For Scanning Pull Requests, it is advisable to refrain from setting up Frogbot using JFrog Pipelines for open source projects. For further details, please refer to the [👮 Security Note for Pull Requests Scanning](../jfrog-applications/frogbot/scan-pull-requests/#security-note-for-pull-requests-scanning). +**Important Notice**: For Scanning Pull Requests, it is advisable to refrain from setting up Frogbot using JFrog Pipelines for open source projects. For further details, please refer to the [👮 Security Note for Pull Requests Scanning](../jfrog-applications/frogbot/scan-execution/scan-pull-requests/#security-note-for-pull-requests-scanning). * Make sure you have the connection details of your JFrog Platform. * Inside JFrog Pipelines, save the JFrog connection details as a [JFrog Platform Access Token Integration](https://www.jfrog.com/confluence/display/JFROG/JFrog+Platform+Access+Token+Integration) named **jfrogPlatform**. diff --git a/jfrog-applications/frogbot/setup-frogbot.md b/jfrog-applications/frogbot/setup-frogbot.md index ce48155..7c76344 100644 --- a/jfrog-applications/frogbot/setup-frogbot.md +++ b/jfrog-applications/frogbot/setup-frogbot.md @@ -7,10 +7,10 @@ #### Select your preferred CI server: -* [GitHub Actions](setup-frogbot-using-github-actions.md) +* [GitHub Actions](../jfrog-applications/frogbot/setup-frogbot/setup-frogbot-using-github-actions/) * [Jenkins](setup-frogbot-using-jenkins.md) * [JFrog Pipelines](setup-frogbot-using-jfrog-pipelines.md) -* [GitLab CI](setup-frogbot-using-gitlab-ci.md) +* [GitLab CI](../jfrog-applications/frogbot/setup-frogbot/setup-frogbot-using-gitlab-ci/) * [Azure Pipelines](setup-frogbot-using-azure-pipelines.md)
diff --git a/jfrog-applications/jfrog-applications/frogbot/scan-execution/README.md b/jfrog-applications/jfrog-applications/frogbot/scan-execution/README.md new file mode 100644 index 0000000..f26f45e --- /dev/null +++ b/jfrog-applications/jfrog-applications/frogbot/scan-execution/README.md @@ -0,0 +1,2 @@ +# Scan Execution + diff --git a/jfrog-applications/jfrog-applications/frogbot/scan-pull-requests/README.md b/jfrog-applications/jfrog-applications/frogbot/scan-execution/scan-pull-requests/README.md similarity index 100% rename from jfrog-applications/jfrog-applications/frogbot/scan-pull-requests/README.md rename to jfrog-applications/jfrog-applications/frogbot/scan-execution/scan-pull-requests/README.md diff --git a/jfrog-applications/jfrog-applications/frogbot/scan-pull-requests/pull-request-scan-results.md b/jfrog-applications/jfrog-applications/frogbot/scan-execution/scan-pull-requests/pull-request-scan-results.md similarity index 100% rename from jfrog-applications/jfrog-applications/frogbot/scan-pull-requests/pull-request-scan-results.md rename to jfrog-applications/jfrog-applications/frogbot/scan-execution/scan-pull-requests/pull-request-scan-results.md diff --git a/jfrog-applications/jfrog-applications/frogbot/scan-pull-requests/scan-azure-repos-pull-request.md b/jfrog-applications/jfrog-applications/frogbot/scan-execution/scan-pull-requests/scan-azure-repos-pull-request.md similarity index 100% rename from jfrog-applications/jfrog-applications/frogbot/scan-pull-requests/scan-azure-repos-pull-request.md rename to jfrog-applications/jfrog-applications/frogbot/scan-execution/scan-pull-requests/scan-azure-repos-pull-request.md diff --git a/jfrog-applications/jfrog-applications/frogbot/scan-pull-requests/scan-bitbucket-server-pull-request.md b/jfrog-applications/jfrog-applications/frogbot/scan-execution/scan-pull-requests/scan-bitbucket-server-pull-request.md similarity index 100% rename from jfrog-applications/jfrog-applications/frogbot/scan-pull-requests/scan-bitbucket-server-pull-request.md rename to jfrog-applications/jfrog-applications/frogbot/scan-execution/scan-pull-requests/scan-bitbucket-server-pull-request.md diff --git a/jfrog-applications/jfrog-applications/frogbot/scan-pull-requests/scan-github-pull-request.md b/jfrog-applications/jfrog-applications/frogbot/scan-execution/scan-pull-requests/scan-github-pull-request.md similarity index 100% rename from jfrog-applications/jfrog-applications/frogbot/scan-pull-requests/scan-github-pull-request.md rename to jfrog-applications/jfrog-applications/frogbot/scan-execution/scan-pull-requests/scan-github-pull-request.md diff --git a/jfrog-applications/jfrog-applications/frogbot/scan-pull-requests/scan-gitlab-pull-request.md b/jfrog-applications/jfrog-applications/frogbot/scan-execution/scan-pull-requests/scan-gitlab-pull-request.md similarity index 100% rename from jfrog-applications/jfrog-applications/frogbot/scan-pull-requests/scan-gitlab-pull-request.md rename to jfrog-applications/jfrog-applications/frogbot/scan-execution/scan-pull-requests/scan-gitlab-pull-request.md diff --git a/jfrog-applications/jfrog-applications/frogbot/scan-repositories/README.md b/jfrog-applications/jfrog-applications/frogbot/scan-execution/scan-repositories/README.md similarity index 87% rename from jfrog-applications/jfrog-applications/frogbot/scan-repositories/README.md rename to jfrog-applications/jfrog-applications/frogbot/scan-execution/scan-repositories/README.md index 576a4fc..b226cc3 100644 --- a/jfrog-applications/jfrog-applications/frogbot/scan-repositories/README.md +++ b/jfrog-applications/jfrog-applications/frogbot/scan-execution/scan-repositories/README.md @@ -2,8 +2,6 @@ Frogbot scans your Git repositories periodically and automatically creates pull requests for upgrading vulnerable dependencies to a version with a fix. -![](../../../.gitbook/assets/fix-pr.png) +![](../../../../.gitbook/assets/fix-pr.png) _**NOTE:**_ The pull request fix is presently unavailable for older NuGet projects that use the package.config file instead of the PackageReference syntax. - -#### diff --git a/jfrog-applications/jfrog-applications/frogbot/scan-repositories/view-security-alerts-on-github.md b/jfrog-applications/jfrog-applications/frogbot/scan-execution/scan-repositories/view-security-alerts-on-github.md similarity index 51% rename from jfrog-applications/jfrog-applications/frogbot/scan-repositories/view-security-alerts-on-github.md rename to jfrog-applications/jfrog-applications/frogbot/scan-execution/scan-repositories/view-security-alerts-on-github.md index 83f7f67..5fb828a 100644 --- a/jfrog-applications/jfrog-applications/frogbot/scan-repositories/view-security-alerts-on-github.md +++ b/jfrog-applications/jfrog-applications/frogbot/scan-execution/scan-repositories/view-security-alerts-on-github.md @@ -1,29 +1,29 @@ # View Security Alerts on GitHub -For GitHub repositories, issues that are found during Frogbot's periodic scans are also added to the [Security Alerts](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/managing-code-scanning-alerts-for-your-repository) view in the UI. +For GitHub repositories, issues that are found during Frogbot's repository scans are also added to the [Security Alerts](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/managing-code-scanning-alerts-for-your-repository) view in the UI. -![](../../../.gitbook/assets/github-code-scanning.png) +![](../../../../.gitbook/assets/github-code-scanning.png) The following alert types are supported: **1. CVEs on vulnerable dependencies** -![](../../../.gitbook/assets/github-code-scanning-content.png) +![](../../../../.gitbook/assets/github-code-scanning-content.png) **2. Secrets that are exposed in the code** -![](../../../.gitbook/assets/github-code-scanning-secrets-content.png) +![](../../../../.gitbook/assets/github-code-scanning-secrets-content.png) **3. Infrastructure as Code (Iac) issues on Terraform packages** -![](../../../.gitbook/assets/github-code-scanning-iac-content.png) +![](../../../../.gitbook/assets/github-code-scanning-iac-content.png) **4. Static Application Security Testing (Sast) vulnerabilities** -![](../../../.gitbook/assets/github-code-scanning-sast-content.png) +![](../../../../.gitbook/assets/github-code-scanning-sast-content.png) **5. Validate Allowed Licenses** When Frogbot scans the repository periodically, it checks the licenses of any project dependencies. If Frogbot identifies licenses that are not listed in a predefined set of approved licenses, it adds an alert. The list of allowed licenses is set up as a variable within the Frogbot workflow. -![](../../../.gitbook/assets/github-code-scanning-license-violation-content.png) +![](../../../../.gitbook/assets/github-code-scanning-license-violation-content.png) diff --git a/jfrog-applications/jfrog-applications/frogbot/setup-frogbot/setup-frogbot-using-github-actions/README.md b/jfrog-applications/jfrog-applications/frogbot/setup-frogbot/setup-frogbot-using-github-actions/README.md new file mode 100644 index 0000000..11fc275 --- /dev/null +++ b/jfrog-applications/jfrog-applications/frogbot/setup-frogbot/setup-frogbot-using-github-actions/README.md @@ -0,0 +1,202 @@ +--- +description: Install Frogbot on GitHub using GitHub Actions +--- + +# Setup Frogbot Using GitHub Actions + +## Prepare GitHub to work with Frogbot + +Perform the following steps to allow GitHub and Frogbot to work together: + +### Step 1: Provide connection details + +
+ +Set Frogbot's connection details as GitHub secrets + +Go to your repository's **settings** tab and save the JFrog connection details as repository secrets with the following names: + +1. **JF\_URL** (JFrog Platform URL)\ + Example: `https://acme.jfrog.io`\ + You can also use **JF\_XRAY\_URL** and **JF\_ARTIFACTORY\_URL** instead of **JF\_URL.** +2. **JF\_ACCESS\_TOKEN** (JFrog access token)\ + You can also use **JF\_USER** + **JF\_PASSWORD** instead of **JF\_ACCESS\_TOKEN**.\ + Instead of using **JF\_ACCESS\_TOKEN** and providing an access token as a GitHub secret, you can utilize the [GitHub OpenID Connect (OIDC)](oidc-authentication.md) authentication protocol. +3. **JF\_GIT\_TOKEN** (GitHub token)\ + You can utilize [$\{{secrets.GITHUB\_TOKEN\}}](https://docs.github.com/en/actions/security-guides/automatic-token-authentication) for **JF\_GIT\_TOKEN**, which is an automatically generated token by GitHub. However, this option comes with a limitation: a workflow, such as Frogbot itself, cannot trigger another workflow. Consequently, if you have additional workflows intended to activate upon the creation of a new pull request, they might not be initiated. To resolve this issue, you can generate a [personal access token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens) and use it as JF\_GIT\_TOKEN. + + + +
+ +### Step 2: Allow Frogbot to open Pull Requests + +
+ +Allow Pull Requests + +Under **Actions** > **General**, check the **Allow GitHub Actions to create and approve pull requests** check box. + + + +
+ +### Step 3: Create execution Environment (open source projects only) + +
+ +Create a dedicated execution environment for Frogbot + +Create a new [GitHub environment](https://docs.github.com/en/actions/deployment/targeting-different-environments/using-environments-for-deployment#creating-an-environment) called **frogbot** and add people or public teams as reviewers. \ +The chosen reviewers can trigger Frogbot scans on pull requests. + +![](<../../../../.gitbook/assets/image (1).png>) + +
+ +## Create the required GitHub Actions templates + +### Step 1: Navigate to the project you wish to scan + +Clone the GitHub repository you wish to scan to your local environment: + +```shell-session +> git clone +> cd +``` + +Switch to the branch you'd like to scan with Frogbot: + +```shell-session +> git checkout +``` + +### Step 2: Set up Repository Scan + +In the branch you'd like to scan, create a file named `frogbot-scan-repository.yml`. Fill it with the provided [template](./#basic-frogbot-scan-repository.yml-template) and push it into the `.github/workflows` directory at the root of your GitHub repository.\ +You can see more advanced options in the [full scan repository template](scan-git-repository-full-template.md). + +
+ +frogbot-scan-repository.yml template + +```yaml +name: "Frogbot Scan Repository" +on: + workflow_dispatch: + schedule: + # The repository will be scanned once a day at 00:00 GMT. + - cron: "0 0 * * *" +permissions: + contents: write + pull-requests: write + security-events: write + # [Mandatory If using OIDC authentication protocol instead of JF_ACCESS_TOKEN] + # id-token: write +jobs: + scan-repository: + runs-on: ubuntu-latest + strategy: + matrix: + # The repository scanning will be triggered periodically on the following branches. + branch: ["dev"] + steps: + - uses: jfrog/frogbot@v2 + env: + # [Mandatory] + # JFrog platform URL + JF_URL: ${{ secrets.JF_URL }} + + # [Mandatory if JF_USER and JF_PASSWORD are not provided] + # JFrog access token with 'read' permissions on Xray service + JF_ACCESS_TOKEN: ${{ secrets.JF_ACCESS_TOKEN }} + + # [Mandatory if JF_ACCESS_TOKEN is not provided] + # JFrog username with 'read' permissions for Xray. Must be provided with JF_PASSWORD + # JF_USER: ${{ secrets.JF_USER }} + + # [Mandatory if JF_ACCESS_TOKEN is not provided] + # JFrog password. Must be provided with JF_USER + # JF_PASSWORD: ${{ secrets.JF_PASSWORD }} + + # [Mandatory] + # The GitHub token is automatically generated for the job + JF_GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + # [Mandatory] + # The name of the branch on which Frogbot will perform the scan + JF_GIT_BASE_BRANCH: ${{ matrix.branch }} + + # [Mandatory if using OIDC authentication protocol instead of JF_ACCESS_TOKEN] + # Insert to oidc-provider-name the 'Provider Name' defined in the OIDC integration configured in the JPD + # with: + # oidc-provider-name: "" +``` + +
+ +### Step 3: Set up Pull Request Scan + +Create a file named `frogbot-scan-pull-request.yml`. Fill it with the provided [template](./#basic-frogbot-scan-pull-request.yml-template), and then push it into the `.github/workflows` directory at the root of your GitHub repository.\ +You can see more advanced options in the [full scan pull request template](scan-pull-request-full-template.md). + +
+ +frogbot-scan-pull-request.yml template + +{% code fullWidth="true" %} +```yaml +name: "Frogbot Scan Repository" +on: + workflow_dispatch: + schedule: + # The repository will be scanned once a day at 00:00 GMT. + - cron: "0 0 * * *" +permissions: + contents: write + pull-requests: write + security-events: write + # [Mandatory If using OIDC authentication protocol instead of JF_ACCESS_TOKEN] + # id-token: write +jobs: + scan-repository: + runs-on: ubuntu-latest + strategy: + matrix: + # The repository scanning will be triggered periodically on the following branches. + branch: ["dev"] + steps: + - uses: jfrog/frogbot@v2 + env: + # [Mandatory] + # JFrog platform URL + JF_URL: ${{ secrets.JF_URL }} + + # [Mandatory if JF_USER and JF_PASSWORD are not provided] + # JFrog access token with 'read' permissions on Xray service + JF_ACCESS_TOKEN: ${{ secrets.JF_ACCESS_TOKEN }} + + # [Mandatory if JF_ACCESS_TOKEN is not provided] + # JFrog username with 'read' permissions for Xray. Must be provided with JF_PASSWORD + # JF_USER: ${{ secrets.JF_USER }} + + # [Mandatory if JF_ACCESS_TOKEN is not provided] + # JFrog password. Must be provided with JF_USER + # JF_PASSWORD: ${{ secrets.JF_PASSWORD }} + + # [Mandatory] + # The GitHub token is automatically generated for the job + JF_GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + # [Mandatory] + # The name of the branch on which Frogbot will perform the scan + JF_GIT_BASE_BRANCH: ${{ matrix.branch }} + + # [Mandatory if using OIDC authentication protocol instead of JF_ACCESS_TOKEN] + # Insert to oidc-provider-name the 'Provider Name' defined in the OIDC integration configured in the JPD + # with: + # oidc-provider-name: "" +``` +{% endcode %} + +
diff --git a/jfrog-applications/jfrog-applications/frogbot/setup-frogbot/setup-frogbot-using-github-actions/oidc-authentication.md b/jfrog-applications/jfrog-applications/frogbot/setup-frogbot/setup-frogbot-using-github-actions/oidc-authentication.md new file mode 100644 index 0000000..0620780 --- /dev/null +++ b/jfrog-applications/jfrog-applications/frogbot/setup-frogbot/setup-frogbot-using-github-actions/oidc-authentication.md @@ -0,0 +1,66 @@ +--- +description: Authenticating using OpenID Connect (OIDC) +--- + +# OIDC Authentication + +## **General** + +The sensitive connection details, such as the access token used by JFrog Frogbot, can be automatically generated by the action instead of storing it as a secret in GitHub. This is made possible by leveraging the OpenID-Connect (OIDC) protocol. This protocol can authenticate the workflow issuer and supply a valid access token. Learn more about this integration in [this](https://jfrog.com/blog/secure-access-development-jfrog-github-oidc) blog post. To utilize the OIDC protocol, follow these steps: + +## **JFrog Platform configuration** + +1. **Configure an OIDC Integration**: This phase sets an integration between GitHub Actions to the JFrog platform. + 1. Navigate to the Administration tab In the JFrog Platform UI + 2. Click `General` | `Manage Integrations` + 3. Click `New Integration` | `OpenID Connect`:\ + ![](../../../../.gitbook/assets/oidc-new-integration.png) + 4. Configure the OIDC integration:\ + ![](../../../../.gitbook/assets/oidc-configure-integration.png) + +{% hint style="info" %} +The 'Provider Name' value should be used as the 'oidc-provider-name' input in Workflow Configuration step 2 below. + +The 'Audience' field does NOT represent the 'aud' claim that can be added to identity-mapping configured in the 'Claims JSON' (shown below). Only claims that are included in the 'Claims Json' created during step 2 will be validated. +{% endhint %} + +2. **Configure an identity mapping**: This phase sets an integration between a particular GitHub repository to the JFrog platform. + + An identity mapping is a configuration object utilized by the JFrog Platform to associate incoming OIDC claims with particular selected fields. These fields might include `repository`, `actor`, `workflow`, and others. To configure the identity mapping, click on the identity mapping created in section 1 and then click on `Add Identity Mapping`. In the 'priority' field insert the value '1' and fill in the rest of the required fields:\ + ![](../../../../.gitbook/assets/oidc-identity-mapping.png) + + You have the flexibility to define any valid list of claims required for request authentication. You can check a list of the possible claims [here](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#understanding-the-oidc-token). Example Claims JSON: + + ```json + { + "repository": "repository-owner/my-repository" + } + ``` + +## Workflow configuration + +1. **Set required permissions**: In the course of the protocol's execution, it's imperative to acquire a JSON Web Token (JWT) from GitHub's OIDC provider. To request this token, it's essential to configure the specified permission in the workflow file: + + ```yml + permissions: + id-token: write + ``` +2. **Pass the 'oidc-provider-name' input to the Action (Required)**: The 'oidc-provider-name' parameter designates the OIDC configuration whose one of its identity mapping should align with the generated JWT claims. This input needs to align with the 'Provider Name' value established within the OIDC configuration in the JFrog Platform. +3. **Pass the 'oidc-audience' input to the Action (Optional)**: The 'oidc-audience' input defines the intended recipients of an ID token (JWT), ensuring access is restricted to authorized recipients for the JFrog Platform. By default, it contains the URL of the GitHub repository owner. It enforces a condition, allowing only workflows within the designated repository/organization to request an access token. Read more about it [here](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#customizing-the-audience-value). + +## Example for OpenID Connect Usage + +``` +- uses: jfrog/frogbot@v2 + env: + JF_URL: ${{ vars.JF_URL }} + JF_GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }} + with: + oidc-provider-name: frogbot-integration +``` + +## **Troubleshooting** + +### Scan failures due to token expiration + +When using OIDC integration, you might encounter failures in Xray scans or JFrog Advanced Security scans due to token expiration. If this occurs, try extending the 'Token Expiration Time' in the 'Identity Mapping Configuration' phase to ensure the token remains valid until all scanners are triggered, which may vary depending on the project's size. diff --git a/jfrog-applications/jfrog-applications/frogbot/setup-frogbot/setup-frogbot-using-github-actions/scan-git-repository-full-template.md b/jfrog-applications/jfrog-applications/frogbot/setup-frogbot/setup-frogbot-using-github-actions/scan-git-repository-full-template.md new file mode 100644 index 0000000..c009623 --- /dev/null +++ b/jfrog-applications/jfrog-applications/frogbot/setup-frogbot/setup-frogbot-using-github-actions/scan-git-repository-full-template.md @@ -0,0 +1,155 @@ +# Scan Git Repository Full Template + +Here you can find the full template for Frogbot repository scan workflow: + +```yaml +name: "Frogbot Scan Repository" +on: + workflow_dispatch: + schedule: + # The repository will be scanned once a day at 00:00 GMT. + - cron: "0 0 * * *" +permissions: + contents: write + pull-requests: write + security-events: write + # [Mandatory If using OIDC authentication protocol instead of JF_ACCESS_TOKEN] + # id-token: write +jobs: + scan-repository: + runs-on: ubuntu-latest + strategy: + matrix: + # The repository scanning will be triggered periodically on the following branches. + branch: ["dev"] + steps: + - uses: jfrog/frogbot@v2 + env: + # [Mandatory] + # JFrog platform URL + JF_URL: ${{ secrets.JF_URL }} + + # [Mandatory if JF_USER and JF_PASSWORD are not provided] + # JFrog access token with 'read' permissions on Xray service + JF_ACCESS_TOKEN: ${{ secrets.JF_ACCESS_TOKEN }} + + # [Mandatory if JF_ACCESS_TOKEN is not provided] + # JFrog username with 'read' permissions for Xray. Must be provided with JF_PASSWORD + # JF_USER: ${{ secrets.JF_USER }} + + # [Mandatory if JF_ACCESS_TOKEN is not provided] + # JFrog password. Must be provided with JF_USER + # JF_PASSWORD: ${{ secrets.JF_PASSWORD }} + + # [Mandatory] + # The GitHub token is automatically generated for the job + JF_GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + # [Mandatory] + # The name of the branch on which Frogbot will perform the scan + JF_GIT_BASE_BRANCH: ${{ matrix.branch }} + + # [Optional, default: https://api.github.com] + # API endpoint to GitHub + # JF_GIT_API_ENDPOINT: https://github.example.com + + # [Optional] + # By default, the Frogbot workflows download the Frogbot executable as well as other tools + # needed from https://releases.jfrog.io + # If the machine that runs Frogbot has no access to the internet, follow these steps to allow the + # executable to be downloaded from an Artifactory instance, which the machine has access to: + # + # 1. Login to the Artifactory UI, with a user who has admin credentials. + # 2. Create a Remote Repository with the following properties set. + # Under the 'Basic' tab: + # Package Type: Generic + # URL: https://releases.jfrog.io + # Under the 'Advanced' tab: + # Uncheck the 'Store Artifacts Locally' option + # 3. Set the value of the 'JF_RELEASES_REPO' variable with the Repository Key you created. + # JF_RELEASES_REPO: "" + + ########################################################################## + ## If your project uses a 'frogbot-config.yml' file, you can define ## + ## the following variables inside the file, instead of here. ## + ########################################################################## + + # [Optional, default: "."] + # Relative path to the root of the project in the Git repository. If left empty (without providing "." yourself as default), a recursive scan is triggered from the root directory of the project. + # JF_WORKING_DIR: path/to/project/dir + + # [Default: "*git*;*node_modules*;*target*;*venv*;*test*"] + # List of exclusion patterns (utilizing wildcards) for excluding paths in the source code of the Git repository during SCA scans. + # JF_PATH_EXCLUSIONS: "*git*;*node_modules*;*target*;*venv*;*test*" + + # [Optional] + # Xray Watches. Learn more about them here: https://www.jfrog.com/confluence/display/JFROG/Configuring+Xray+Watches + # JF_WATCHES: ,... + + # [Optional] + # JFrog project. Learn more about it here: https://www.jfrog.com/confluence/display/JFROG/Projects + # JF_PROJECT: + + # [Optional, default: "TRUE"] + # Fails the Frogbot task if any security issue is found. + # JF_FAIL: "FALSE" + + # [Optional] + # Frogbot will download the project dependencies, if they're not cached locally. To download the + # dependencies from a virtual repository in Artifactory, set the name of the repository. There's no + # need to set this value, if it is set in the frogbot-config.yml file. + # JF_DEPS_REPO: "" + + # [Optional] + # Template for the branch name generated by Frogbot when creating pull requests with fixes. + # The template must include {BRANCH_NAME_HASH}, to ensure that the generated branch name is unique. + # The template can optionally include the {IMPACTED_PACKAGE} and {FIX_VERSION} variables. + # JF_BRANCH_NAME_TEMPLATE: "frogbot-{IMPACTED_PACKAGE}-{BRANCH_NAME_HASH}" + + # [Optional] + # Template for the commit message generated by Frogbot when creating pull requests with fixes + # The template can optionally include the {IMPACTED_PACKAGE} and {FIX_VERSION} variables. + # JF_COMMIT_MESSAGE_TEMPLATE: "Upgrade {IMPACTED_PACKAGE} to {FIX_VERSION}" + + # [Optional] + # Template for the pull request title generated by Frogbot when creating pull requests with fixes. + # The template can optionally include the {IMPACTED_PACKAGE} and {FIX_VERSION} variables. + # JF_PULL_REQUEST_TITLE_TEMPLATE: "[🐸 Frogbot] Upgrade {IMPACTED_PACKAGE} to {FIX_VERSION}" + + # [Optional, Default: "FALSE"] + # If TRUE, Frogbot creates a single pull request with all the fixes. + # If FALSE, Frogbot creates a separate pull request for each fix. + # JF_GIT_AGGREGATE_FIXES: "FALSE" + + # [Optional, Default: "FALSE"] + # Handle vulnerabilities with fix versions only + # JF_FIXABLE_ONLY: "TRUE" + + # [Optional] + # Set the minimum severity for vulnerabilities that should be fixed and commented on in pull requests + # The following values are accepted: Low, Medium, High or Critical + # JF_MIN_SEVERITY: "" + + # [Optional, Default: eco-system+frogbot@jfrog.com] + # Set the email of the commit author + # JF_GIT_EMAIL_AUTHOR: "" + + # [Optional] + # Set the list of allowed licenses + # The full list of licenses can be found in: + # https://github.com/jfrog/frogbot/blob/master/docs/licenses.md + # JF_ALLOWED_LICENSES: "MIT, Apache-2.0" + + # [Optional] + # Avoid adding extra info to pull request comments. that isn't related to the scan findings. + # JF_AVOID_EXTRA_MESSAGES: "TRUE" + + # [Optional] + # Add a title to pull request comments generated by Frogbot. + # JF_PR_COMMENT_TITLE: "" + + # [Mandatory if using OIDC authentication protocol instead of JF_ACCESS_TOKEN] + # Insert to oidc-provider-name the 'Provider Name' defined in the OIDC integration configured in the JPD + # with: + # oidc-provider-name: "" +``` diff --git a/jfrog-applications/jfrog-applications/frogbot/setup-frogbot/setup-frogbot-using-github-actions/scan-pull-request-full-template.md b/jfrog-applications/jfrog-applications/frogbot/setup-frogbot/setup-frogbot-using-github-actions/scan-pull-request-full-template.md new file mode 100644 index 0000000..d6669b1 --- /dev/null +++ b/jfrog-applications/jfrog-applications/frogbot/setup-frogbot/setup-frogbot-using-github-actions/scan-pull-request-full-template.md @@ -0,0 +1,161 @@ +# Scan Pull Request Full Template + +Here you can find the full template for Frogbot pull request scan workflow: + +```yaml +name: "Frogbot Scan Pull Request" +on: + pull_request_target: + types: [opened, synchronize] +permissions: + pull-requests: write + contents: read + # [Mandatory If using OIDC authentication protocol instead of JF_ACCESS_TOKEN] + # id-token: write +jobs: + scan-pull-request: + runs-on: ubuntu-latest + # A pull request needs to be approved before Frogbot scans it. Any GitHub user who is associated with the + # "frogbot" GitHub environment can approve the pull request to be scanned. + environment: frogbot + steps: + - uses: jfrog/frogbot@v2 + env: + # [Mandatory] + # JFrog platform URL + JF_URL: ${{ secrets.JF_URL }} + + # [Mandatory if JF_USER and JF_PASSWORD are not provided] + # JFrog access token with 'read' permissions on Xray service + JF_ACCESS_TOKEN: ${{ secrets.JF_ACCESS_TOKEN }} + + # [Mandatory if JF_ACCESS_TOKEN is not provided] + # JFrog username with 'read' permissions for Xray. Must be provided with JF_PASSWORD + # JF_USER: ${{ secrets.JF_USER }} + + # [Mandatory if JF_ACCESS_TOKEN is not provided] + # JFrog password. Must be provided with JF_USER + # JF_PASSWORD: ${{ secrets.JF_PASSWORD }} + + # [Mandatory] + # The GitHub token is automatically generated for the job + JF_GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + # [Optional, default: https://api.github.com] + # API endpoint to GitHub + # JF_GIT_API_ENDPOINT: https://github.example.com + + # [Optional] + # By default, the Frogbot workflows download the Frogbot executable as well as other tools + # needed from https://releases.jfrog.io + # If the machine that runs Frogbot has no access to the internet, follow these steps to allow the + # executable to be downloaded from an Artifactory instance, which the machine has access to: + # + # 1. Login to the Artifactory UI, with a user who has admin credentials. + # 2. Create a Remote Repository with the following properties set. + # Under the 'Basic' tab: + # Package Type: Generic + # URL: https://releases.jfrog.io + # Under the 'Advanced' tab: + # Uncheck the 'Store Artifacts Locally' option + # 3. Set the value of the 'JF_RELEASES_REPO' variable with the Repository Key you created. + # JF_RELEASES_REPO: "" + + # [Optional] + # Configure the SMTP server to enable Frogbot to send emails with detected secrets in pull request scans. + # SMTP server URL including should the relevant port: (Example: smtp.server.com:8080) + # JF_SMTP_SERVER: "" + + # [Mandatory if JF_SMTP_SERVER is set] + # The username required for authenticating with the SMTP server. + # JF_SMTP_USER: "" + + # [Mandatory if JF_SMTP_SERVER is set] + # The password associated with the username required for authentication with the SMTP server. + # JF_SMTP_PASSWORD: "" + + ########################################################################## + ## If your project uses a 'frogbot-config.yml' file, you can define ## + ## the following variables inside the file, instead of here. ## + ########################################################################## + + # [Mandatory if the two conditions below are met] + # 1. The project uses yarn 2, NuGet or .NET Core to download its dependencies + # 2. The `installCommand` variable isn't set in your frogbot-config.yml file. + # + # The command that installs the project dependencies (e.g "nuget restore") + # JF_INSTALL_DEPS_CMD: "" + + # [Optional, default: "."] + # Relative path to the root of the project in the Git repository. If left empty (without providing "." yourself as default), a recursive scan is triggered from the root directory of the project. + # JF_WORKING_DIR: path/to/project/dir + + # [Default: "*git*;*node_modules*;*target*;*venv*;*test*"] + # List of exclusion patterns (utilizing wildcards) for excluding paths in the source code of the Git repository during SCA scans. + # JF_PATH_EXCLUSIONS: "*git*;*node_modules*;*target*;*venv*;*test*" + + # [Optional] + # Xray Watches. Learn more about them here: https://www.jfrog.com/confluence/display/JFROG/Configuring+Xray+Watches + # JF_WATCHES: ,... + + # [Optional] + # JFrog project. Learn more about it here: https://www.jfrog.com/confluence/display/JFROG/Projects + # JF_PROJECT: + + # [Optional, default: "FALSE"] + # Displays all existing vulnerabilities, including the ones that were added by the pull request. + # JF_INCLUDE_ALL_VULNERABILITIES: "TRUE" + + # [Optional, default: "FALSE"] + # When adding new comments on pull requests, keep old comments that were added by previous scans. + # JF_AVOID_PREVIOUS_PR_COMMENTS_DELETION: "TRUE" + + # [Optional, default: "TRUE"] + # Fails the Frogbot task if any security issue is found. + # JF_FAIL: "FALSE" + + # [Optional] + # Frogbot will download the project dependencies if they're not cached locally. To download the + # dependencies from a virtual repository in Artifactory, set the name of the repository. There's no + # need to set this value, if it is set in the frogbot-config.yml file. + # JF_DEPS_REPO: "" + + # [Optional, Default: "FALSE"] + # If TRUE, Frogbot creates a single pull request with all the fixes. + # If false, Frogbot creates a separate pull request for each fix. + # JF_GIT_AGGREGATE_FIXES: "FALSE" + + # [Optional, Default: "FALSE"] + # Handle vulnerabilities with fix versions only + # JF_FIXABLE_ONLY: "TRUE" + + # [Optional] + # Set the minimum severity for vulnerabilities that should be fixed and commented on in pull requests + # The following values are accepted: Low, Medium, High or Critical + # JF_MIN_SEVERITY: "" + + # [Optional] + # List of comma-separated(,) email addresses to receive email notifications about secrets + # detected during pull request scanning. The notification is also sent to the email set + # in the committer git profile regardless of whether this variable is set or not. + # JF_EMAIL_RECEIVERS: "" + + # [Optional] + # Set the list of allowed licenses + # The full list of licenses can be found in: + # https://github.com/jfrog/frogbot/blob/master/docs/licenses.md + # JF_ALLOWED_LICENSES: "MIT, Apache-2.0" + + # [Optional] + # Avoid adding extra info to pull request comments. that isn't related to the scan findings. + # JF_AVOID_EXTRA_MESSAGES: "TRUE" + + # [Optional] + # Add a title to pull request comments generated by Frogbot. + # JF_PR_COMMENT_TITLE: "" + + # [Mandatory if using OIDC authentication protocol instead of JF_ACCESS_TOKEN] + # Insert to oidc-provider-name the 'Provider Name' defined in the OIDC integration configured in the JPD + # with: + # oidc-provider-name: "" +``` diff --git a/jfrog-applications/jfrog-applications/frogbot/setup-frogbot/setup-frogbot-using-gitlab-ci/README.md b/jfrog-applications/jfrog-applications/frogbot/setup-frogbot/setup-frogbot-using-gitlab-ci/README.md new file mode 100644 index 0000000..9d932fa --- /dev/null +++ b/jfrog-applications/jfrog-applications/frogbot/setup-frogbot/setup-frogbot-using-gitlab-ci/README.md @@ -0,0 +1,91 @@ +--- +description: Install Frogbot on GitLab repositories using GitLab CI +--- + +# Setup Frogbot Using GitLab CI + +## Prepare GitLab to work with Frogbot + +1. Make sure you have the connection details of your JFrog environment. +2. Go to your GitLab repository settings page and save the JFrog connection details as repository secrets with the following names - **JF\_URL**, **JF\_USER**, and **JF\_PASSWORD.** + +> _**NOTE:**_ +> +> * You can use **JF\_XRAY\_URL** and **JF\_ARTIFACTORY\_URL** instead of **JF\_URL**. +> * You can use **JF\_ACCESS\_TOKEN** instead of **JF\_USER** and **JF\_PASSWORD**. +> * Ensure not set these tokens as **protected** in Gitlab. + +3. Add a job named **frogbot-scan** to your `.gitlab-ci.yml` file in your GitLab repository. Use the following for execution: + +
+ +Frogbot template to scan Repository and Pull Request + +```yml +frogbot-scan: + rules: + - if: $CI_PIPELINE_SOURCE == 'merge_request_event' + when: manual + variables: + FROGBOT_CMD: "scan-pull-request" + JF_GIT_BASE_BRANCH: $CI_MERGE_REQUEST_TARGET_BRANCH_NAME + # Repository scanning is triggered by any push to the default branch. + # If you'd like a different branch to be scanned, replace $CI_DEFAULT_BRANCH in the line below with the name of the branch, wrapped with quotes ("). + - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_PIPELINE_SOURCE == "schedule" + variables: + FROGBOT_CMD: "scan-repository" + JF_GIT_BASE_BRANCH: $CI_COMMIT_BRANCH + variables: + # [Mandatory] + # JFrog platform URL (This functionality requires version 3.29.0 or above of Xray) + JF_URL: $JF_URL + + # [Mandatory if JF_USER and JF_PASSWORD are not provided] + # JFrog access token with 'read' permissions for Xray + JF_ACCESS_TOKEN: $JF_ACCESS_TOKEN + + # [Mandatory if JF_ACCESS_TOKEN is not provided] + # JFrog user and password with 'read' permissions for Xray + # JF_USER: $JF_USER + # JF_PASSWORD: $JF_PASSWORD + + # [Mandatory] + # GitLab access token. Ensure the token has the following permissions, depedending on your GiLab deployment type: + # Self hosted: api, read_api, read_user, read_repository. + # Cloud: api, read_api, read_repository + JF_GIT_TOKEN: $USER_TOKEN + + # Predefined GitLab variables. There's no need to set them. + JF_GIT_PROVIDER: gitlab + JF_GIT_OWNER: $CI_PROJECT_NAMESPACE + JF_GIT_REPO: $CI_PROJECT_NAME + JF_GIT_PULL_REQUEST_ID: $CI_MERGE_REQUEST_IID + + # [Mandatory if the two conditions below are met] + # 1. The project uses yarn 2, NuGet, or .NET to download its dependencies + # 2. The `installCommand` variable isn't set in your frogbot-config.yml file. + # + # The command that installs the project dependencies (e.g "nuget restore") + JF_INSTALL_DEPS_CMD: "" + + script: + # For Linux / MacOS runner: + - | + getFrogbotScriptPath=$(if [ -z "$JF_RELEASES_REPO" ]; then echo "https://releases.jfrog.io"; else echo "${JF_URL}/artifactory/${JF_RELEASES_REPO}"; fi) + curl -fLg "$getFrogbotScriptPath/artifactory/frogbot/v2/[RELEASE]/getFrogbot.sh" | sh + ./frogbot ${FROGBOT_CMD} + + # For Windows runner: + # + # - $getFrogbotScriptPath = $(if ([string]::IsNullOrEmpty($env:JF_RELEASES_REPO)) { "https://releases.jfrog.io" } else { "$($env:JF_URL)/artifactory/$($env:JF_RELEASES_REPO)" }) + # - Invoke-WebRequest -Uri "$getFrogbotScriptPath/artifactory/frogbot/v2/[RELEASE]/getFrogbot.sh" -UseBasicParsing | ForEach-Object { & $_.Content } + # - .\frogbot ${FROGBOT_CMD} +``` + +
+ +{% hint style="info" %} +In the `gitlab-ci.yml` file, Make sure that either **JF\_USER** and **JF\_PASSWORD** or **JF\_ACCESS\_TOKEN** are set, **but not both**. + +For more advanced configuration, use [GitLab full template](gitlab-full-template.md) to see all available options. +{% endhint %} diff --git a/jfrog-applications/frogbot/setup-frogbot-using-gitlab-ci.md b/jfrog-applications/jfrog-applications/frogbot/setup-frogbot/setup-frogbot-using-gitlab-ci/gitlab-full-template.md similarity index 91% rename from jfrog-applications/frogbot/setup-frogbot-using-gitlab-ci.md rename to jfrog-applications/jfrog-applications/frogbot/setup-frogbot/setup-frogbot-using-gitlab-ci/gitlab-full-template.md index 5f74293..eb60253 100644 --- a/jfrog-applications/frogbot/setup-frogbot-using-gitlab-ci.md +++ b/jfrog-applications/jfrog-applications/frogbot/setup-frogbot/setup-frogbot-using-gitlab-ci/gitlab-full-template.md @@ -1,22 +1,8 @@ -# Setup Frogbot Using GitLab CI +# GitLab Full Template -To install Frogbot on GitLab repositories using GitLab CI: +Here you can find the full template for Frogbot: -1. Make sure you have the connection details of your JFrog environment. -2. Go to your GitLab repository settings page and save the JFrog connection details as repository secrets with the following names - **JF\_URL**, **JF\_USER**, and **JF\_PASSWORD** - -> _**NOTE:**_ -> * You can use **JF\_XRAY\_URL** and **JF\_ARTIFACTORY\_URL** instead of **JF\_URL**. -> * You can use **JF\_ACCESS\_TOKEN** instead of **JF\_USER** and **JF\_PASSWORD**. -> * Ensure not set these tokens as **protected** in Gitlab. - -3. Add a job named **frogbot-scan** to your **.gitlab-ci.yml** file in your GitLab repository using the code block below. - -**Important** - -* Make sure that either **JF\_USER** and **JF\_PASSWORD** or **JF\_ACCESS\_TOKEN** are set, **but not both**. - -```yml +```yaml frogbot-scan: rules: - if: $CI_PIPELINE_SOURCE == 'merge_request_event'