From 7ac23a9841ab8f4df81a1ab53201c334180aac46 Mon Sep 17 00:00:00 2001 From: Matthew Helmke Date: Thu, 15 Oct 2026 09:26:56 -0500 Subject: [PATCH] Redirect pages from the migration sheet's Redirect Only tab Delete four pages that duplicate chainguard.dev content and send each current path, and every old alias, to its www page in one hop. Section aliases on other pages would otherwise catch the old aliases first and send them to paths that no longer exist, so those get exact-path rules. Exact-path keys go into the nginx map hash, and these overflow its default 64-byte bucket, so set map_hash_bucket_size to 128. Also: - Redirect the empty cves section, /open-source/, and /open-source/slsa/, which returned 403. - Add aliases for the two Guardener pages whose old paths returned 404. - Remove the contributors taxonomy and redirect its list pages to the About Us page. Bylines read the front matter and keep working. - Point six inbound links at the www pages. Co-Authored-By: Claude Opus 5.5 --- config/_default/config.toml | 1 - config/_default/menus/menus.en.toml | 6 - .../eol-grace-period/index.md | 6 +- .../EOL_1.png | Bin 63049 -> 0 bytes .../EOL_3.png | Bin 47785 -> 0 bytes .../index.md | 122 ---------------- .../updating-containers/dependabot/index.md | 4 +- .../updating-containers/digestabot/index.md | 4 +- .../updating-containers/renovate/index.md | 4 +- .../strategies-tools-updating-images/index.md | 135 ------------------ .../working-with-scanners/false-results.md | 4 +- .../guardener/github/actions-security.md | 4 +- .../guardener/github/getting-started.md | 4 +- content/software-security/cves/_index.md | 11 -- .../software-security/cves/infamous-cves.md | 57 -------- .../what-is-software-supply-chain-security.md | 32 ----- data/redirects.yaml | 74 ++++++++++ nginx.conf | 6 + 18 files changed, 97 insertions(+), 377 deletions(-) delete mode 100644 content/chainguard/containers/concepts/lifecycle-and-eol/how-eol-software-accumulates-cves/EOL_1.png delete mode 100644 content/chainguard/containers/concepts/lifecycle-and-eol/how-eol-software-accumulates-cves/EOL_3.png delete mode 100644 content/chainguard/containers/concepts/lifecycle-and-eol/how-eol-software-accumulates-cves/index.md delete mode 100644 content/chainguard/containers/security-and-compliance/updating-containers/strategies-tools-updating-images/index.md delete mode 100644 content/software-security/cves/_index.md delete mode 100644 content/software-security/cves/infamous-cves.md delete mode 100644 content/software-security/what-is-software-supply-chain-security.md diff --git a/config/_default/config.toml b/config/_default/config.toml index b3b743b46d..36e69a3f16 100644 --- a/config/_default/config.toml +++ b/config/_default/config.toml @@ -103,7 +103,6 @@ notAlternative = true filename = "sitemap.xml" priority = 0.5 [taxonomies] - contributor = "contributors" tags = "tags" [related] # Only include matches with rank >= threshold diff --git a/config/_default/menus/menus.en.toml b/config/_default/menus/menus.en.toml index c8176efdff..42aca69e1c 100644 --- a/config/_default/menus/menus.en.toml +++ b/config/_default/menus/menus.en.toml @@ -137,12 +137,6 @@ identifier = "menu-security" weight = 20 -[[main]] - name = "What is software supply chain security" - url = "/software-security/what-is-software-supply-chain-security/" - parent = "menu-security" - weight = 20 - [[social]] name = "X" diff --git a/content/chainguard/containers/concepts/lifecycle-and-eol/eol-grace-period/index.md b/content/chainguard/containers/concepts/lifecycle-and-eol/eol-grace-period/index.md index fc7beb869a..a6c41ab75e 100644 --- a/content/chainguard/containers/concepts/lifecycle-and-eol/eol-grace-period/index.md +++ b/content/chainguard/containers/concepts/lifecycle-and-eol/eol-grace-period/index.md @@ -4,7 +4,7 @@ linktitle: "EOL grace period" type: "article" description: "Understanding Chainguard's end-of-life (EOL) grace period." date: 2025-05-14T08:49:31+00:00 -lastmod: 2026-10-08T13:39:28+00:00 +lastmod: 2026-10-15T14:26:56+00:00 draft: false tags: ["Chainguard Containers"] images: [] @@ -21,7 +21,7 @@ aliases: Typically, specific versions of software receive updates on a schedule for a set amount of time. Eventually, though, every version of software will stop receiving support. When project maintainers stop providing updates, it's known as the *End-of-Life* (EOL) stage. -It's recommended that when a software version reaches the EOL phase, users should migrate their projects to a later version, as [EOL software is known to accumulate vulnerabilities](/chainguard/containers/concepts/lifecycle-and-eol/how-eol-software-accumulates-cves/). However, there are cases where an organization may want to continue using a container image after it has reached end-of-life. This could be because an image reaches EOL before the organization's release schedule, or perhaps later image versions have one or more issues that prevent the organization from upgrading. +It's recommended that when a software version reaches the EOL phase, users should migrate their projects to a later version, as [EOL software is known to accumulate vulnerabilities](https://www.chainguard.dev/unchained/why-end-of-life-software-means-400-cves-per-year). However, there are cases where an organization may want to continue using a container image after it has reached end-of-life. This could be because an image reaches EOL before the organization's release schedule, or perhaps later image versions have one or more issues that prevent the organization from upgrading. To help in situations like this, Chainguard offers an end-of-life grace period for eligible Containers to all Chainguard Containers customers. This article provides an overview of Chainguard's EOL grace period, and also includes a brief introduction to using Chainguard's API to retrieve information about an image's EOL grace period status. @@ -175,4 +175,4 @@ Of course, you won't use `curl` to interact with the Chainguard API in most scen Chainguard's EOL grace period gives customers the opportunity to continue to receive best-effort CVE remediated updates on EOL images, while they work on transitioning to a newer upstream version. -For more information on the EOL grace period, [please contact us](https://www.chainguard.dev/contact?utm_source=cg-academy&utm_medium=referral&utm_campaign=dev-enablement). Additionally, our doc outlining the [Chainguard Containers product release lifecycle](/chainguard/containers/concepts/lifecycle-and-eol/versions/) can be helpful for understanding Chainguard’s approach to updates, releases, and versions within Chainguard Containers. Finally, our conceptual article on [How end-of-life software accumulates vulnerabilities](/chainguard/containers/concepts/lifecycle-and-eol/how-eol-software-accumulates-cves/) is helpful for understanding the risk involved with using end-of-life software by outlining how EOL images accrue vulnerabilities and where they accumulate. +For more information on the EOL grace period, [please contact us](https://www.chainguard.dev/contact?utm_source=cg-academy&utm_medium=referral&utm_campaign=dev-enablement). Additionally, our doc outlining the [Chainguard Containers product release lifecycle](/chainguard/containers/concepts/lifecycle-and-eol/versions/) can be helpful for understanding Chainguard’s approach to updates, releases, and versions within Chainguard Containers. Finally, our blog post [Why end-of-life software means 400+ CVEs per year](https://www.chainguard.dev/unchained/why-end-of-life-software-means-400-cves-per-year) explains how end-of-life software accumulates vulnerabilities. diff --git a/content/chainguard/containers/concepts/lifecycle-and-eol/how-eol-software-accumulates-cves/EOL_1.png b/content/chainguard/containers/concepts/lifecycle-and-eol/how-eol-software-accumulates-cves/EOL_1.png deleted file mode 100644 index a9b345b4ea2c4073b37d60e2a193e0c5317e3bdd..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 63049 zcma&OcRba9|35A&CsM~uR657rBN7Uo$jaU$GD^0LY?5OgvbT^jva>Ry#ED2|8b)UJ z-lX5-bX}j%$8~+K&-eDb{vIUZH9#auj3?WJE+n6bkY(8bm}S zhD1cf%m`xm8&ACiMfk@NXALX(9yCk&8q}AHCgECVDf{AN-x< z?;nZ&@!#&KVY^N|`sW|u2bUYDiDb7MwuoLz9r|TyN(>Vb@u81WA)*=G8zy;n@ZWz2 zA0dnI`L8b{eBhGA5jE_R*Xc*Qhrf{qwSM^f>z9s7Q#LGJBbq&Z^nWe`E{gP#GzCjk zRMaEn>e`x@u4}A3OTcl8p18dl=U+(7ug)}PN~7DiS*cDu2}e4)x#b!=68-($w}uyq zaLc^XK|J}wN2H{r*7u!P#$@fU$1C1_A4EZkIeGW}lad=-PZ&j!80V=Db>&Oq;tZ(u zcK*hfDb*;Eo0P^4-rt6Xu5ojR8P*LrGD&*7zkPJXb+%7XNXWYD*}LV@_n)7Ntuf4K ztw&ExSh%@uEiW(QBwL>_(bG?ljcL?9w98ccTBu(>)0=B)Vd2QE^*YsC4s+uMx5Nuk z)r@uT)hAO2Zlg_s!Vj`FYJB!K)313M=;?*XJb!KX!_(b;;@7WU1iiVX<*&^b`e!&-=FTaKFshbLY>W;Ww^-FpgJY&rXPM?`&|=k;uPF0e0h$ED8^8Sz?O{#>=*P z@C$j!cl41=QVp89D)arHKNfth_gF(>bW4mU?{+_z4NKrPTqV|i6Q7HKjbUnfI@llrq?u8}v9Qx7XNH&EhygX{h8Ae`gY;t(Q}lKE!qq?18C{C#Rt zQiaVx#E;u~8x-g3^MqmyDmAf6iG2Od?|OTwQR_b(8Xqw4uYH!<-Q6WQe)5?=tu~hQ z)VXJ$&B7gqYT-d^7w8myh-7kpFH&=z(i%-N>JUppK!+t0U0u3dXG{vk3J zoe&qNXJFvz;jt3;1e3YEvSKwChd4|?-ZnX%c~ zkCoz5f1;4-Xct#k5fKp|SpF!~ja$mfb6<)ie0E*zzkS_6BUPSW>CV$+&s3Wp9}f^5 zF1xF=H2h|+zknTyFsQVye7Im>Z`#TXd)39og@!D!$e>c(Wg7Y9*`y@K&CPAGi7A<9 zzP~_sZ*##)qq!Rv2e$JXu^>J$FtE~Q!2VkqYgJi(_t@B2!|p7%l9E!id>{P%3%SUi zD_LHS?3^Bfmcra_*P^ws^Yh^m5f?7oCRJ97Brh-un#nwTc==QG-2Lw7f!W!2Ra8!i zBF*PVNBxoC%Pmjizkd4ksjsi%*|SHCzfv6UWeVX|oT65}^~w`-eyp3bpdGl@m>@bFYrRM-yJ*W@Q%xODI2 zmcuJiEiAqH^C`>E>B_joq@*iWJy}zqQW+T;2a0d+6_hkQPs9D3eCS%+lF;qQ$;k;% z?R8}(E#m0L+`u2$jaHA1F8(}D{2faD%WK>r`j<|0br;J;UXa>fCdspqmVVUG;Opch zq)HjVDB9W8<+#7S0(@2wGKW#u}k3&9i5-I zH8+RiC2IG*0+!2nwT&Ht%D=8Xx;fn)Ao0>X-0$~>E>_LRXwZfOV{SeUHEw@JjvgJpld_V2wdIRvG?G#5Hr zK1I~Q7*3FW`8^LWuPU1X6%&&`eR-PAAE~wL#W0>_6PpV^Mtt{pF|8jy1Q#Be`t{3U zu$mI(vbA_yk%xulD5}C|?;!)`e6C6w2JtCPA~EQtxQ3=?QBe`>l3yLk;|mK5)6*|Y zO8mB$O{p{)Wnbp$!-_)t2}8oEBj)roGBQ$7P#DKQv9qZD>cs^ke z$=5ER(>`5XT#U)=diU;Kf4}SR-3@EOo+X4rSAT#1*RR#^&|&KsmETj2yl}1cWA&3K zpTf^x(kU|N&rxP1Aqm*tcBhgO7VdlZ&h$&6K2*gd3AbXnvA{rCSld!~6rxr=GAvY| zQbcTaRwq?dR3aiGjAY%XI?nn_cfIj)4&2_&B4h(F`@H?o1ho-9fdH9W2hLm5rA+sZiKaPq>R!`jw z*_cE5?8VS*e*vsVTg)_cU$3o2W$c+DId^F5Sftx(z^!{-$YH11KL=Y<)YP$KV`h&# zzI{vPHd0hnoP}LGnP_57Tzl^m1GcLzmR;d!AjZ_j<_Fy0Skd%3lq$XJ{MS-w5-fR6 zbF9(wNDRBm)1P$ly836%oLR)nts>ISbhNcubv?WOA>zCOnE@9jymU7I!NZ5IOG{T^ zO;yM*!F|C>R<@^c>l8{OcJ}sqTk|8}w$7qtKGRN4PKwwMR;$0bX_5NkGA^pSFuwpl zIy#C#4WnOJ=Lz7C962IGQBa9%89ObxO=MoE#bsw_S99L#&%tj*Cixk@JK<}qtJeMb zBEI|XDe~6V`GJAQC?2@F$|7Lp!fvX$b}b!u(cfC45n>Z1!RD^^Wfn#kkz%aakV_bH{Oy1GmDPg7G9 z{t4sO+(2aWuiuFrm_={K2eB0N?TP#YeM~}^E>U6tMKPafs6jW=ONfgb7#PGH^%zMk z&@FMQdor6ZST|Z$R))l+f8E=DUs#+rjDwSH){;YTz~`+!kdJ-N%G1EiEryx+MO}G#uKp zGgpi|=bi9NLPFu;;nO|K-^wj()*MSR5jDX~aEui{! z6;$2WSn3V4@H2cy^0}x=b!_-OZEdWD)Z6L@Sa3(5z}y3JNP%n zTLk0Me!D!;Zl^C?RZAs5ku^d&#v18Z zrx|?eygL%sTGn#V>Z4Q5Rc2;pC=38WZUmoV9fb<;BAXQ@!yJ=0ohs^p#sXr*^ZtPg z!D3LlcYAn3&`$+Sn`U&SEGE;snLd8}h{V9}vMS8TQ2K6<1_uQNRoFJGL-D@Ym#;nd zE5nb?KOYx0-#A;A4zB6W2KZa!fUe01u&cQe=&8UGqbj+B-MfO{?#Wj2*J8G(X!?-u21?Q-N#E8roaaU7M_ZA zKP~U+EeXu)3#+xU)*}f(HAqjhadOa*IXEokD5o;e({~X^iMfYA0Ql>1dlG=EON8S{ zgU>o;`i&xbG)}E|Lchit3kdZXXSoUu${}L8r18M|>#NN4^b19;NrL9`5A$)a27}gC zR=NiUM1_QAzm@+QYYA%`F{o&Jd*rBb0HD5sN5>=kIEV+k?Ew{GGGD<1ck#QXOIcf8 zt*5X5MtozrL+;*@^0KnozPw&o^~v@`(&NX|C4Ex%b9$A>^36{={CUdt<&D=?4DC&) zp1VKa`U|VPxcOvy9d%-V`bFf^w6xIF@UZnDYbTmVl3{{VT$qP%+^Mr!qQ8FC10Xj& zUG4jO*Zf07nxxNeqKWUQF|}qME~4RzfhWcuTCfoJBjfV_T~MbH|1~L zl0iJMyvZnHEhEk=)+Mc)7rWC5NPl^kcOfC)Cm@ybfpa7Cx&WDIiuK5p?}OHk!APlt zYQQ^CLg0pLl~XTQl$6nq0(oj(Nw_jp<>!di82`B+|{%QDBQot)C%J z5`$^Y5Y7KV)GFBojXCN*++zR0z@Lo)lhfy}I1-*_uIfOZX0UIdHmzw5MX+GRlP9-d z+v+#^{ys{49iXfIaD8506!O&33KY~cMnz;U8}-kKhZeraP!$d%k{XtaZ!deST9A;C z4EtWh;YUU?RE(mfO-xJ{vPqPK=QwzHghfUFjD_*Hx=;?i3K3lVTFM+>G(jmLAtC-z zN1n25E?b9kcYFIHb~^kb-hFfao6%%ef%Z6*=LfObj=npSXOxuMJ34Mb8N~Yx9Xoam zS}t5y56juMbF>cq?m%f=`ja|zACx4q#inVg=P8mFqgg(@&lAp_%#DER?Hq`pV2^+` zF*GoknwnZ|YV)Uc`jV7%uk$G<4Vkl(Q_#t?O=<3IUSu=&TE^nmlWErH7TshPnDdd< zCg1PzdZm{2jjy;@&z?O4)WK^|p|)^Z>R_8W?Y$27 zdjCDSD(RP881yFqoT{tOplRt2LKQemPp>BHzWnq0qQfzK^MUjNCJ^V#gAIo0xhoWvPg+n(fU~U@PPK`g@xgT{C|K_Au@mdyko}8 z$vM-NNwTGD?AkY>NNS&AwDnT`1s0PT7Dm3b+^lQjbJx!9wuS}<4QB<7o#rq^$+i|J z8pu{VO)6rM*HEcxX+zJhlN7sXdX;5Coz1HFUcyjfSak~3Ol!e%tn5wrx#@c&1IiOa z>odJIsSJX6iHGwSe`&Y1#c=BuN5!>u>jKUM?1IRo<<>zK81XHAuPoU7#1-4-o_oW| z$*Ed5V`6G*c5ZI1_ye;CltG=orG~wTf;-S_fmH$DZBJuiUaHZramrTXcq-=1ri@}| zm*b&>-Qmn^9zL@fP$eL@{f?B$8#r8ryv$rzgQ84hPAn@~VAH#InE-xW5?K_26EfJ8 z&e_U_2&PN`U}MKsFCKU`Z)>Wt%7cNOk zN=|H^t^J|uB`cp3a{Sb}YG`nvAUK|;sj~Y)hl0MwZ5+E&PZl^9%;YPL@L7IGnx39+ z_}X@5eci>$34@@dmAB6*ef4U4uB6f1+Z#yCv)o)chm3dhZgXEgH8(d84f(X-Xou?D z*q0=_og!XURK(p<1Uh5&IsMwo%F4mP!Ryzrp}nttue8xEHu{#WbOzdVZEHLCRlGa= z7$Wo3d2ycGwJyCm%22J~dFbqQ#y}TINlh(i=(z_JZ6fU)h$tf#W_N-}-=woObjriEB_%~+zZQyLXk>C?=;-E^x^E$F3ugUFk#| zm<9do9VrUWFtBUp=jMKZau6+VVQ)VSyf^uhWzPVWQG<64G`xw;8TfOIvXX%!sj}mw zlUTB^=9`+X_V)HKUvxNV2r$Of)O2!K?bD~nb&*lnOS3JpEi4DH9=#1dUce{;bnqJ2 zySFFs){8Y=4>+E7)dTp|CbUy1rh|7y7HCm;cMv;Z5kZp~To=S!Bm@roHx;Gj@BMri z0OYddcHL{xnLus48BYK1d{G-kf2DQ5(B;byot(yo)t(4OgoVxhs44;J<@IZ5K%1a^ zRc0_Z(=&-VWdSP#KrzwNu)V#_0OuCkkcgC_KEpKtbTqLeGM& zS#0n@%y|k5Kg!G=>-?(|V7ML#GK`E8SFQl(73bjzmvJY@y{fKu-(8=fU=T)z$}quW z0EAQHLu-DHiAm~y*TragEm(cH5GHXK1j=RMyNE#`=#r-IgZlF{KOS2xaxs{O}0lmKqtxh`A!4eT2tqvlE=f-UI zuJL$bVWFTozOTq|prfOsrG-^UD8}uIEf8Pj6k$}b!*pa&PEdPmtE02C&9}1byu3Uh zny}Yv&S>^!y=&f7ibFOpEJBrOk(-G#y&SV|U%J5xe~0!zT@@4S_%~phT8VOf3Dg z^28&wx1G!KMS}ADNZQx;U~#Apl(k5txYIN3a*JlK+o_?VlnI2wM5R>`RhEGWswUo`Gm4>1X14G?fJDCaQu3+f*fHd0xoGy{xTLLQ zGg;i%xJRc`Pvhy4N1i*Kh-1vu@KUdN{*tYPA<=Nh=|>Ki%*(z5by}|Nsk=lnwn2x# z_lT?>ACvTYCuKZ0PMXrX_vVt&seNRk5)-nN@(9yqCbMITwu5x{CYx!e83nei62qv$M0vS5&pUZpegFjdkQPSp-h4Qn#-HNnh}lm(2UCcL*&< zDJS7-!XN19e1USdIMT>;go)xP;h%JL$3ujFde9Ye%Lpa&@bgCwSY4-ljGk}}Wta{u z#SOhYe7n)@la!Q{-QC?gJ39is*`d!v`!!i zR^-(0^O!Uk@z6D{XTLO74i@xvmYrT&f+m|07uU=?40H~)lu0QgRS0Xj`tt4^s4VZjiG7pxlhDl1FI zz$zmqhU%e0NIZ9I{hK!}W-HJD(ag-2olmVSENIT3S6*kraKQgqStp?z(T`uU>;!%7 z23xGGj7<1>i7(&3i;IdTvb@xxGz+)vNE-e5Q`&VF%orK8I;i$lM7FZfi~vb+#I_NW zkSO1}HP&IU8bY-cyc`B=o;`6(v&(n)YP)uADH~GK|wk? z7veMcppLcE|63gkE&B)i|gC&)R2f#%|jANWqwT3DPrdFoWoiXXTD zz#j^?|XZlL2HC#eHHEo@Hmr{Z{g%Y_(!hd zAeYf#J(8q9kB@Zw@$}U^iWKMC7kJjpzM9XpUH>s)$?F=hpw6~71$p_detmNTo_vHL z9%NU0dwcqEFm17FfUtZ%g4hT`OY`3H=nZTXkdvou!1#UOJ7-qcSH?eVtgnOhtYA$5 z0WZ;6*&jcD78Mr03N98!-aju?hB6|fahtt_HrQcE;)2t7b0~EkIA1kRtZv2W+;ng1 z>p`M>2nHJHqxj}#i+lGP))KV{yYx2+vXt4SiS)m+0RPhdepS+FMdK&025(6@mFcs{@ug0&7}n zrS*dJI&5-tN?E-vy_edrI=J-ixuJyerdvuM))*a3v{5JDdI(mr4RSPI}_-&K^C_YMrO+f<4=33pzoB~eNtc9Pe}>>L z(DuM}ap^sjNMxNNBPR!gpZ>xHcset{NQ;3>!#!v*IGtBY;Q0oQIlu>yjA+iDO$HS? zQgNnUX!(W_pT@uS$&CCQ#J6l8U7g!)X>QsFRZ%6y$ah{(cAjXf%eKPt=5_I-Kyt76)s%DrUc%#@Hcr`rWtKQqou$7iZ8Z%N-40Lqx{C7Qk zw^4kN$m24$GKU-Q5!qH~Y4DBTC$yEvr^zTeFutT}poHH*?Kr$3k7f#N_VL*p<&Ta` zWX)PqXseA%X3|yD$WmLT=K5Ts#RaP|J~mct(g;@T3P^p>VV`nS)GUICx%9Pke0yaa zg+jsgLJzjJBa>>L93_?2JB6CYOcHt8AO9yTq(K3;n^j!AAFC_!H0= z6sq%Q61rxcgmoG6YYj~z7SALI>>BqxP3o&WeJSE<+lfz{w>bHdiwhM zpdf+SbO7ZY9)nS}BTAP+W9#uTa!@(_;7P%uheF9NCI);gN$0q42q&5HDe0`xlP5?4 zgG!&+zJKG<@A3w^Q}_MR@OTECe$JH7oGRbtMjvAnn|A4)Z`>98(UCdAW&E*2p+&bF&hjh z2Zjk-2r>qCBMsMhc^A?~0$voWXroWkoUS{282tV_9($hu5^?R?H853d@7>b@x`?_F z1Rhb(O)f636!;409$@bVQ!pk#{6ZPZF8vk9XYwrhx+TM)(%^@@pbXc5*Fkoa7~~p= z*6fBDklvuoe-bIE!xf*Ly;|oX`zPm@y>FbDD4$)^Z@B;mwuki$y+3zoFKeA&J*Uif zbK_*_-e%|f8FkL#(3w5Wa{jxM>@*2+9C0bD=uz-H;PQloR>266i#P|Tk9_>XQ$Q;7 zLv>rAy@6?Vnn@Dea0~W>bUgw<5kB1Jr76pHkOjpP5tlu*d#}`Dv}kET0}KO(3x~^o zs8$4QeJ?LB&ww4M(hKwRolnK6>F5A3Rb9B|8MPVPK56&kHNZv(cX!x~9|)E-w0ESY zw|9MLXdAF+21?3O>wYe5}_Fi6Wq)ND}-rT18HX>u{q#v6a;yYe)leD*rNa5|1@ zk*)cd0}y+GhNc3r zhin*~;NrV)^&ZX;<;Ye_v=GwI9u9aB+97c|7@+Xc|JR9B*Ve)gvUz}!hMC^qS)(5Z zGoG3G1qtb?D8yfYvoWh3zCvhh8yhomqqVMc&1Qlgje{M@mwr@O-RM0hXodyRbR%Cp z1YN(+vGCBodtngmd9BjAL-b@@BKLE0TtLRulK0cfE2C|FtshK=J-Ze>3$Hm-)Q;}R z=h~E-405gYmD)&UvciPUK`brE2ZA&!5?Ktx1m^TNr8d16Y)@_)Z^+i$~}h_>>ONi9k%7 z?s&?W>>(<&#>bL*p3%3f}*|~zrXPFnB;fIf0jOWQPC~H zh*nlsPBlgZGCJYpp`$~0vFFh*{a3|ES{jf8)WFI0(!(+s7fKr^(!PrtXP2Xys_3qE&+;o!T)t6|}^#>umQMiO6yDCj$f(oMBl z>g3^SNKEq+;`M5OAAYPfk9tXR-b1{wy+0}FSH_z({a&d$^61+oEvLv;pHi)~Ub^gR zsByC^c0Oc&fByLxd;wh15CG}H8fWlqS2s3(-<=d!p3ytjZf`MVW%4~ANqvw1YZ1}E z(99%e9x=@n(Q1K#nU==-cY&;yif7B^XoWy4R)E|JB#nx?H0N6(wRTxpcn~xy{_g~; z`Eb6Ke8Q8JDzvJq>Jd*lJw@(?&E+DjheP!zHeKl>kpkCWNX-|wY<^bgf2Z(6dcr`#$3SWQGvxxvs~Jl{#Y zJFq)AQEjB{AJI)9dGV8V>%#*UScKU#~` zsOZKWo`Ia5f8NC?7kq0TkHv4z3C`8yzeOclwXq%n;MAvBnt%L7&1aApD1x)b4)%y zzk#@PA)!lxCS6#_1E%=m%|Fm_t7~gx?i9N&JXror_#tdB-ab^b_r>XsF_E_ea zU@ZIVMyeMIrwop@7w25N%c6HoSwN?h@fb)KNNzPVO=18%B^*r{R^5r2FGV~&zak97 zSHMXGAQ3Kj>f}imN5^OUimbR-kY$7bMlCQy5YoZh)qqgjO`kFGj*f}J7+w<;T!HfhlmMP4 z*xBMsL9<}XAdWr;y4jUA9dK2S!cb(Ye^I%<$~g>Z>zANU5IAv&IWY94!*f9d@Q{F` z#VPw0B6NUM%?Z49_Dd1Kb}{O_~8iMaQ|>OT*IMx9Qv!*oz9w%y;^trmRiUlck?C#14B=m zE-+n?F<1iGaZzu*S@`XXiWnYH!7*Za*u}jqAN|W+yxW(2R zhlwX6;FEKQ@d+HXhaHwBO7Yw^x#2al0!!tX?D~CI)0=dc?sZ5b&ercw&&`F&JO`K( zUJ9X!8bLJcnO2bnW&-nma?jNCdg5L>m^!eqK!}IG zekJ%K!ku1|1pVq01x}6nTh?<8iBC(K$?p7CzltrNcY*H0!Xl%I)@DD4=Xz*JbVzB= zB{)(>3YJe`VGE0jfUz$+NrK@B@b3jKiig@f97-F=P}K!^m*k{#TUo}&LttBSQH5?U zjesJksvFyIusb*UJ~%eXsb+9^xZyc2YO2ilwCdk_B1 z#V4t3p6SFXp19(KHL^TULn9-~c8SV6m<<+q`S1d3s>{mDpxkoc$u)^KdP1zg~({m1dA+y%_8Cz)E?MW0Dpc%5C^h~ZAxap_xB+f_4Mgeu+~6V{IakUob%S1hK44j z#S9uKqzu)1K@Eg^inwqMOlo{26F*%TcNT&W#|AnNr;m{5xp4I>SdBUR#$p7q%Q*n; zO;P5hS=Pq5c~36)Dfub3=gYvIoNDat+dQA3 zsMfoM69wnrpM-Q3=lOfr725@9I~0BLd$h*^WD^t$)J5-_szS~^!ilDf`Inao<7`|x) zTPN=D*7knhpN3`i`F@%eH49r`GYjI?sBX*wC2>FMFpWgwLON~4iSOxGSXjKc#(jS%L zl<5w45pX!XL$r0B5zDqN5fMJgxV>?uTN6!o1}_D1WkAZO#U9-naa%XY zn_VU7^}_$Z?rp;LH)D)(NE7P`RT?tcJ9jQp20}l|C)1^E0!?1;a7llJwg4~UcH4Qo z)%=_XE`i`7HIh6+Pf&Z1{HaZR?x>Hc)yS)N93`d<1boNE&FvL{bzSCwJsxtn#QjH6 zgh;lPef8b}C=acxrMhO~_$ybhdP6~jhXZxBUMX^zCxc9i0-p5Q!%zDET>JV`zy5$T z&mDIHPKH0QwJpre&DG+%U1fh;MWvIG{ZGn?w|XtdNe>}SrvKBmsa-B{=OojWJQD~Y z)A+S*@?S+*MMlCXHRkIT!~Dy(|7 z-WS}H$6$yt;9D3~y8qo6pXq2&86gq-K<_Pf+&{gyycDRfuMf%vT9=lMg=Lx}mW%~l zI!3y~cg~fCP*RNh-S}~7Q0|jdV#zA}X}-Rq)VRh;7BW;D=RbVE+8z;L>kv$3Oz!>NcvCGpDrP<+tlQAaLj~DQ$mj3J1_iq;bl+3!?@L`)Cmv@whQb|FwWU& z$Uv2b35DAl=K+wClau@T{Q)5!S}j0EDerAHJ7r1?AX%ech)#8U`UEXc;b%+O8L8cA zW`M6j6pSj#Lab6!8CZxHL%JPe1<6TCU%!5Z%ufniOnkfuJQYBmkZ=J+v^8}10 zL7otj?V&O-)c_VsbZV;7Eigi1$RHpu&kDkh(9R@KU! z6#*X5{eR>L!ou2N{>AF-Wrtyyp|J6nRs)qDa`WLUz>a|2$}l5WsvtqmfH~KAuxkUD ztJ)uOoq*F@=-2cBHE-|in1{x?!C9t~f;6^iv|b6I;Fb%Sn~-x-x?PUG}I^h z!}aOCHa0L&vC>+V-9IpJvV_wCGQ@z1>Brx`l?LH#SMyf09GnOh7-Rxq3_DlUy63@gmztPT?Cm>b#+S2eQ-PI$4kvWs3ZyaOS;1J0VM03t|iN$LA7rC z_z~@735+qrcb5~t4ar`!(rQqSB`1IWgok|mIRfz3bp215&}bbrG&W9`zW5cOOch#& zQqp}H^xQ{vI>QhMB19ZHFjzHPTOJQ<$oGT0+iYiU4le3B1ESgcpkn5o!Ecv;mV7ar zaPwjW?A@B$TBy#9FDdcv zz-D28@MpMh`T?&7>`NsJ)yBra0MgmugvU;5VUZ>9BtgfeK{YFX>grmCa37niu%KXO z-g!xHJyq4y=1(E3h7|YOtzY2MXS|m?QZpT%GFT#@@dy8?+h&QBN; zL`R40BXncXFhY48GY!OtejHQ)LiwHQS5;6raf6c2prZB5m(6~5v!33JH>CdHsy0KA zk%j7nAtgkf2Hw8C2+^$6JBo^A>R2EE!Xkctepn>_im0e=EV`q$6^S?s#+m+W+p`Yk z7nOsv?pRybLQ5mCK_qPi(A415OgVzEUxgQ#J78aTBRZ<9uZ%sx;Z`>{7Y9l*q%Zzt zlkM%BAOIZznyOhn`-<5;*EU;jjc$J6_k0N744bOGom)htvPURbGivf#U}^n1>Cd13 znTV)Qhk$s5#8&q=%JH%?AsZVTe*TiWr;z~x@1ctb;AJRd?wW-^xOXoHHicV%5+5}X zTkA&a{r9J(fW$>gPhvSyD+hH{3N~fFGS|`6Rk9`pfJPE zgjlo|7WSyD>;sXrRV))0Cnz!r)37hqnJWwM^y45Bdx9eciZuAWS)cR8Z-TN17#mLF z3rHIDS>L@|2@1*>t63>9JGPBaq9fj$-z@tKi%DouOyGh^Mt@xAj{gYSe%tCwapH3U z2?;OQv4Hkqqd=%6K28c? zG^QYrK7RZds`K8?uZ$l*e#D-*>QvU;);0s-HAp}XrTg{WQ*_8sxOMBQ>nu%;4k!77d-&5F(i{cquJSBvz#~g=jG=)#8e8vj7|VvVg#q2V+OS`5bi1F^P$b1BDO* z=mN96V0p3qvKHaQgs*^v#7fl$Crw@!LM78}F~GDNV1x;5|@b7|F|-w&=a zv=6DB32I2sF3`d)Wu~V7fZj(%P0fG1b^?MSIz3inkYB(^0-*Iq$It6>#XF~mVdn09 zOOHEq34%|7kn4?BBt#LiMbA&az6i3F2k{|t{|_G>X8=-Mp(pnSxSy1mDu)p^oPdA; zp|cSCzl8@16K*WzLVgcn#0A75L|_w`#ZGQB55iVfA6r{M)BE}J=j^N}%uCy2A&3JM z4xj?`tk(`B>BfFHHYq_^>T7P!g8u*mV9!)1r>5Y%w&3x27=7;ST-;k~WOo}8pfNQz z9)@TJ94rtT5_$BS-uUEHRIJ0JweNfRz?RA8zp?<)Aelk>v|)QJ3^cY^gup7GB?#DG zjJ%aB6quk4Vh#(HcD^vNYsLNU$6lAungiVj{ohYhvlk}0&P(||Esa!j?XS+tnjnn0 zmX}i_jzSPw>i4>4;N{5xbk@RZ(-FeSUHuL7-8wEfF!;swUh_}3Y`%l}EzmM!Nm>*6 zP59g_U1Y;fnA4`xAFg2eA!v&;F&r2!$?9ki?tG)z;z6p=<{v*&iy7v)zI{|-=jT`D zp@S&u%d$)8nYmdi2Z(}g5*pB|4wQ=3t;FZc(zE31FSWQ}sMG{a25hABTKDEu;Nw!< zC*;3V#@74?8yZ-$Kr}C}9rzZTo0|^5*hHL)N>pSnfeRgcl<>i?;e(xS_LV0$?Y=7u zIH&Huvw9azwzcph_dP#7WCw!|bNkaAn9CWnFA;62vV_nx4ULxlf(z}DDTJ$ROvWj~ znXa1F<%sV!!8N_N5)=Lfk%*WAvMSqe8hU#2??;-Cz!SOfFHht@&}3)qKHc9-d-$6y zdo{83gU-9MG~fTfK1UD8B8_#QO02#40o}mI0}k?U)TRA1q`Q|6lB?M&e7Uw7Frt=`v*= zmm}VNW~0Z5SuY^d&ulM0TCOL=1^YaKT=uaUUm|w>D-KBg6$b_mgtDFXf6Kv22K{1I zb(TTlw_!F_h6WmM6%1)(SRt_Zg#7T0!oa_RY&M9@T7Ot+wdV&SZ|CRVgD040z0qUp zK||J31@p;J;u}pe_l^GL&QBg@Ewb;}szWW2C0`%*Pbm z@AAV719a6?Lp^UOP`=585X3VVG5KstOaPr z70>niE-veV6w8W~3DFQ@PcSjGbo(US`oU~LiLf@3CX-Fbf#DQxS^0#{ z_qA-Y$!RYIop(Ze3Mh*bPt#i(*amB+B z3FNP+zg<+(eKNze4{?ea*fx-90%Hl>*Nnt1v(b<~vv-e=fvyQ32&n)FcsBmtOa*hJ zsAvIzpgi4#th3kV{LJv1IyDZ^O_gEF?bEd@SE?ZpLhSzxdJts$Bz#=+L8FP|)V$Y` zWD1_Ko!!FXq6!nR6o!AiP6MW?LH+QV`@(AmFHdoEaT#pzsgprdhP5!?3~&A9^Uxuv zpn!YKn~I9+z6Sj`%+B~rzcT-Dih-VqsU$ad3z}BUQLAcLCK)tpNo1;+!GN)))@ zCy2x6#z;1aU-#wg)!Ts+?X>eT%QTraH9L^~eE#CauTQC#ckV0`#*TJ(Z_3H3f*1^J z+QLu8%4%lB@6UN)BTP(<&c9S(9vo&rqK#lM-vlI(_ra&zEy_Zv*>Npq`G{YiGe#ic z1y)*fOA81S@Vb&>2Ik0-dJk$;1w=;1vT;%FYin!pIt>Baudkp7!1Ct6t4%;$Xr7pz zwT3+T)D+#>vo#)T_pnhQQ$T!3UKYf6$P)o1$@Gu}&`0blM51mqW4^VV~pzw$nLqkIy9pN+^O@ZV9X)>;PUB+LLkf?(N1)W6I;{amkEa!JefN+D%k?KiM1z?m6 zMhM=ZwG8_p4-(Qc20tkUVm#1(m<$po9|J5;LX3+#ot3|%MDsBk3i$+PB2ZTr>UcMZ zSwLwZels8QUhkOq*P|7s82*3wg4#NizU$p`SrDZk?CV>HeCowv$g^O(!1mRi10=Kw zLR^d^43a^ZrH5vIVIdR^g3o0^!5XJYG9Pbnj|s15*r56VpbLqC`o?0Mj$Yr`faGGw zXFow^$N8^8s3F0{oKEkE5)4LE4}TRFP|R?7ku3oQa43Q2-lXK3UAG|j?SV8Yt4 z;{Nqqt${*)^LzJhQn@^Qn4>3v2b+BdUST1Khd0#Fgu%>n3yVm2DI9Llw?fcB7Ex=D z>BrArx(DMk@iOLx4CdjgPp@R==AME42qEG`6*}=*>JQ5aadGjUaC&E~b=d6WWItqe z@SL~QuyG6Iq#cCnea){Fvoe$x48^G}uvJOFq=V+;xTcA1zv5fH?2lMR zV()5U;Tr!KHX)XCu=gElP2&wj2!Nco=FOYmF|0}Qd^U((0 zJOVNi%$*4x0ZQw4a8-FUjKAR`ZW*K;1WL2>1K>{ZZtyG-P(6icMqvPb6%?*sIhgXW zdI-B0wm?=6Bym=_%FJ5G@)0$x=YXn%!!3v>j4(flk^x~M5b3%66I29vmqO}ym=%`< zk1~7(x*Z6uVy;3kKnsBzHcCf;|2dN@o15^G1HqLtLX7iOdHEg?Z~;6B8ee*QnU|(} zd?VEC)FEnl-_mjb^bj~iz{`{PLVBqlqq8`Sul)5m6bKJ)K}p@6buOM64>%FRsxmYX z{O)NyDb!1L4YKy-t`cFb{_b zHFI0rdO*Z5L=GMB76>=DOdhZ@c;L92Ag7ALJ`M;lzmfrbx2HKY;Ei>M4%WpZ<$g7= z;qGQD+1C6OcuR@B^^KsDsDggzb!C;6lUmcsvFFIXu>90&ze%oe9^Pk?2zet+=JsOU zk|eMhs>RXKZWu*luxyKAP1&T(=j9^E9m^Sh2gyQr6#>XYA?ZxzKPoH#t%0CqQRn3! zpaadC7eFh2!UtA}uPlvOI0SlCWC-KU?rG^-2yiXm6Nt^U>{~fT;`uB629yWuy{cMy zcf$A9XKtJkh8GurntF2<-eCZ-bxLc2uXLYO>S8UD>CKIF zbRapLYt;`D(bHmvf_QyUMTGp~zZLDk$F3Ly7NkpE^zunF4>ylC=zcmNgv@QyWu>7Fgc| zLg6DLZNi8p41yQa;<@-Jv_+TI?>=WBj?+qZyz%ICVo-kFUq9PpiDxuTWJ-~#_N(GY zRoy2LbA!N=ovEohU^R%65Z)ZZ)dV;PK#u|souPrj!NJ}Vw8uYFsSd58|C-!-_XUm=)wrEA#$Cg1MA#I8J?Gi^qmN3U9)@S z6F5_TS=0NcOlTxMR+~S3kmHJn__nZ^Sh5Z&o(qR5BH4b~(nNk#@#@8^{L7<9MuEN} zJR)_;OE8)63M?@(u079VQ)wc;Z)B=fA^X1QLo+CsUv2o8=`b=(5tb&PQM#C(;lMVh zYt*cdf>u2#HMI`>ejw$1IcQp7utNl~ht!jDxjTqRLPc2{3rHEdEZizUzGMN@$H4F5 zOfVjM50h0l%86v<)tCS0E^4>eCUL0IP~aFjXI?Zp?_3ImRt0DvQ8613p~cJ*2>RYV zY&d9Y(n7C4?X^CQq6-6L2m7kn>UI)EumNF1rJVcg%&F4fpzif_O?&|&8RtuZ82CFY*7DZbCHa^e8^wB9;R1v zN-$$LiA3@AcqhBsBmYb%{kyNs1w*qTA1wCf!HuVe zY=72oKGuF!IGKIF^0^vY?57MV6Rvpsudj~CWPV@VO?N|8-qIrRkKv-WM=X!_sJSL4 zBn*RIFD9nn`@|(bvOX9ENq7VEGKk+q?LV!DDWJ3%ry2?sHWXn{p+lg zi_C%F(#2d}KoF{nCB~&@EnqWPUAcldGL8AZe)ONNf1Ki7Z|{BB`CyLx9aQ}9F~Q>! zN6*Y0Rfj+Se~f*1Ak}~Sex%HBWF^8eGBQ%h3UOp7J6lB=nPp~F) z+Q{T$zovct`Z(lFkQ2g|?krA-xnxVMCWJ=bOmG^p zYLwr>1F2@Uqj!C#s_#b)x5SsOaJ|JfwY44C(usr6K^mkxneAL*I3K;mM#zQ8lDj~&E4zdmI1{>)I{>jxtPh=N6F#e zX(F4(U2G)i2fnfWnu2$5!7?)3K%$ecXV<=FP#G`wTUw3q~Lh;0lMzr1Q|L&b$`8 zOIM3M23abeY;aw=TEYv6(r<`3-~bEe$dn_CmHy@v*1Tj&><1p@q3 z>4AgDi?b(=(lNk+qWmeF-S3!TD0z1>o(&%-j*Yu`*=RI1Cfak^kouLxo#Xr^(l%#s zEnCPPfzkq~3?xvQA)1BzuK>-`^XHv`SE~6#>ig?O-aE7_eJC>tD<*m9X@6$?iu#M* zCt!97Het{_01Zl$nNYEVl|9RYvEI}CKMyvG%ZIW3=t0rFW!{qkU)1orQhur==e~J- zZXKs3r5|+OAtnI5z~9$bYk@@f<+9*I>-}UuCA{I{V^}=Y0^{D2^xm$XX38ik`n=Gf zo?+d3okZLu*faG!uB8h-#&82m$Pfk-vq*5S;l2Ndg7`l^Ma5`%KF`U#aI_3C-W%(t zABDkv2Sqr-4=%ffMr}WMd`H!P`v`*$lb2VXKQC%pdR(2`eT~_g(vN-=vQr$oXg6eR zxHZ(bn0fXOz|wQXy3~td-|$598vy3sU&fQ&P0khHvGWVsxwb zwegC4cH0*r#*^o({o^E=Oxc`iulY`L?gY;qtoG{bV~_L=(_erjyb_5ZovgAQ8tnS^p2%!VQPu;lbqk93mNsjpwZo@-bd zX{fyp9MNgj^S7q7H!MQG@95v9Dxbpzwf|Igr#NRTah;f2hu>osR1Iqc-mUPx*pSG~ zvqXo|berU5``6CWbLICPgCgo~KldXF7WWB|L;-GO=e!l1lG7uVRac|~2Uc-``w#6ob&_!WOZWOK546Aeam?jO7)Uyk zhp2U*Affq#Uvx#6Mrd7Y!N1#b>K@h6}o`MDq^TRYR zdE^YOw@Y5V>MXlro%O1CJH^|&Sf96-#-O-M?63lnGCr%!Wiw)Be0)~*hcDSxbYvPX zMm9<+`e#R(b2iN`4erYFO9bf6yD5&3S17i8$E4WJi!RNJ4&5=vjt;ENr|jlrP8Ig| z36L<0oAlYPxT~?&I{+4hqCO^e+k%}>TVY~!=-NX0WCT?_2R3QxeCdAdc~m5uj2t@X zk_uw8gkrrUGqcr0O=s+O%;xdZVkRANjz0MO;JV`{gE)Nnn$Tme1TQoEjdgYYSs6K{ z+pih|S_sF;8we4Kp+q#SJTfQcCWj=i?&xT*KBl{FOy#GB>2lVPyW-^JWMT1KCJ7xH zDojtd6Ou0Fe$wND^b=VXJnl9;B(oTEv^Wbhid__`<@=ndjylQvJ9^7Nd(gVF9P+xD ztf}On>h$zj>S31NwxlTj}tsF>LP_Dx#v?&!oAA^ch~mSkG$U)tM| zTr$HaF`Jw2am_QM+*phVizHU%3VpJS((Q)7evbXy2HNe{Hg(>o-65eHvn;C!uI}yC zr;}5V4Z;dIUz zmGsUOkj9o|d%#8@*LSofCMO?+bR1xBULKwY7g8id$?u0r9KOOpqmeu+CwW_v%SBoe zt>B1yPNa?q;+EN6J<>mvIbz#kw4J;tx{xdg9tUWdVM&?L(c5B1aGyZ08H$=hG4`;}j-(1-gKW%B`+Ui_&}HS0`c^tu8b9RJ^73+YbTs2RcL2|N$9jjMYdShQ z3XB#fv4O=Zq#c(BYFrY(Kb*>wGJ+zW;saAS1u~Km!6T#Pdo}1&m8buD3D1z}*7Yhb zkECantxYl2_wa=nLTG4cz<>;BNLfwIXdEO1o?d{e#Kpxik+;%u6816;c%wZg37Jpo zq@tLWFtQUqj)WK=G`qZS5G74gEOOZ{F=;pFLj{t=TW|7|I+tManu;?J;y$p=J zrLh{wexRs*@PI5wr)ggGgX{zwM(Dl^{8anD{!|Za36H$pn~Ghf;XKlr5Xmx)$ZyGRii|Mx)QAQfHs=ab~#69ZGpV3?zqRnf$}O31b3S}$={Z&Ue`Oz zaoKZeQ*KyUj!Z7;ZSS!CX<^~(=H^h4(H#1WxuDM$GV96-2 zq|eNNNu^)(B%7bdq{pTCyB?Gg81yAXGLl-;cV}+2rb@eKv$E8340Aq;QPxDgq;X8% z8avi0eowsK0l*BPJ^^^jo~K1i0JNTdz}P^SrJplDGjq5S=~W-#QR_18lAsVMY4+Dc zR=I5u)7j}_o#|foVW~C8a_j*rN$?X6ka8RcGB{XFwTI6FtUC-XSwQ6$U$KPR zGhV4L@$jt)eaQricj=GCW6wu|^NZ(v=>&jDG?bL~;0B9VZ=F{``?cuY(#KQxUw~r+ zAf1)N{zt)IVC(%+JCVF)11+s(u-yZW*6Kq8Tb#YuB8{E6DR!`uE6aIHj*L8@6)|Tu zi%loW$oecdz$wViEJjb}51z;1x@85hB>yxN;Lx3Cm6EDTN%1Lo9@4t8E-1diNW$G# zkN?M#-Am?@Rzdr$ib7utM2lbww2(_g$EW|dhcO8($p-+%yS30FY!Gm48l<(M{~hTT$NyUxtr7C`lnABWCCQe$0oeF4;YV@l%; zU@br^fb6L0hcZhYqo;@6-mtU<)B%8@tnx3Tr+g?RV?kN4C>I8w>sS>>$p!daq3Bjb zqYgqWMKG>eTU#4;9L`_a-u@*VnHXN(`MweXUf!(y{I+5Hb@(OpfBPj0LUJOYkOc5$ zz^U8Fd$S|4x37=*1;FmAkA>u(T`%l;|KP}BX6DwVEwE9ZK7j;1ApF*+0{oG7kDIU8 z#HeO<9wZs8O7j5n9lKyB{!eq(CY1F^$Rccr6 z^t@zYUA3_6acGLxdJP$7bCIZBKW)mQhaVk6it=$%Y8GKs>Qx*bbmDojf z-}&^O8%kC2hKn6h6N3s$yK8Nj=Xs$EY6^@B0hP-kVPQCv0O){04rZ9k1bkG0`@tg+ z9KgSWRHt&5Cd`i@d>@rGK9-a6=uuvIxyciwfLgMBTMro@{x?hhO`K#q1e<|80%r zo||1(#gNPZifdGC6|+=a10)R)b%Kc!ydVRae}pd0{^o`W?bDz3naziJyv372p^4b{ zi3#Q)9~-mX*722S9lG5C91xokH?PUU_bu`VGd{-0o0o@`EZmhHy@lFe7WS#dfgxqg z>`tq{|7umt*>jIf&Pt_JZ;OpUw9S1GlsMkKo%V)1vvT`&Zh2Yj)lm__@+5IeNeJB; z9nkuC5AYKTC6Xlz*%Gidq16Fi$P*dg0|twknchukW8_PNiD@?OMpGh?_{4X~RkDbv z<=Q_oh|9KF72mse50+MkPHPEy&OgMoUoL>PXayW{kg>Wr_tSd zSFCfs`Xa{NcTUIPRi&MaX18~ifib_Wt4O)Kf5rjw8yT72v6@Tnfx@Y;=7MQGE8l&w zDg5ribq+f53?Vh-<|Mx;$q4KqC!?=c$^ML@NW zDOM+@+{~_#QcL1N^cK zpuIpd0~n+H)ArC?g`NQ5;bQT&=qqHWXRoXhav!=S;W$ISahL7>?_*V|>wC~=7$hz8 zVYgjBE`cbTzt!!{YOnQ$lyA^!OaQ0y;%;McFuExjbk9mllUsL}m#+t+ClHl!{_9|c zKHx^Kd^yP-+&h8IRIU4F?r!6q@5$M{kGlf0g_v#&dIdGSbI^}kQITJuwW*ilePY7( zyy|#X`*tSgc8t5RdtHay6Atqbgi~2wFWIzlVb3sSn6a=S7t ztwih5koV#XZ?D?<+q6G%()X+1_?sEPF_c|&-k_c%W%duG&CRx<=^ZP znrOmV^?~vYR$V`56(s2>akwfV&wi{MT(WpjwXqLR{<1h0kB}O{iVWX3`L-xXTAf`9 z(Gq(y<>kxpi4AC94LZ~_!LU{Lc$k;rDE;WuLDxMm#_lf;J) zUqQ$8)2B-}oF?CZLB;m6Qj!{1C3=puaIXVLkNbnI{|fwzOuw z-!aWZ&wU-ugYO6aNUTb;YT%x*Gl{Qw4Ol z<8GDEVS=QC;8s)@o{DkrB5JjzND}p)<V2yLk-<`8CU=yr zO3PK=6kWRNys}GsW-B9;BR&6AVOHKsJA;Ui34wfGcX_`p@UtkG#8AeP+)E!E$SJZK z9{Ycn#5&v6})Q?5t%SCX>y#`f)b#Cc(AVYwaXjRJY!&T@`ORavn z#{alsjx83fvRCOTIyM)-qzs)wBEw`kPei{q?pSR)e8c-;#tBWe8o#v5F4KCCJ{dFT`_@s>9nX5Ey0sA4v_^N#8{9f_0w?=LW$4UE0 z)OL=EIiOGc)>-3+~~O2JzgA#~zUFmzMnc>>me+8`?lU-Q5#U1KTWsOxeOG)K3`o=*q`= z){{9DYx7(A2M}%YAuTsPk#Z!=PdX&V(CQcH_d@>Qt2+T?ct%l2R7OXeY|JO64E8Ig zLQ@P7)$jdtllk1guWw)wf6CI%j)H{5(KcdOGWHGGHD`)IOV8IX6JdO4w4~MkF*dIx z)cM`g1!|`_*MyRuo503yAvIa(Da^>swBmB%Z;xUsa(Whha3CVl3jt60x2+5W*}mT1 zr>7JzUaXu-k9%rh_L_oIpeA-e_NqSf{J_RFQe<-26Sei%0?{HJ9WsIUPqPPw6TEkL zdLgB!#4hpW#b!{fI`3?`1=q=hd5GjlCY^qYM{&!ffsi2dkN3f+9)^xj`o(w#Xwx{S zui8Po4U7f=c_faFD zbK17oJ^0%EPH9hfD;J4wW_9sWUbVHf1d1^AU>vRu4z@RggU0W!xH{9TGbDTsNTS2+ zm$~peF}g$@sNoApcRUQ$0Hw^c4*ymLAK971gy}28QA8Y4MDSX8Y?9F{M0TpY-A}R^ z>tBf7*)4f~K32&~SZ&EX?%ntl4L96MKuQDxJnJJe=t(~Wp-_9fj9PPm&V^_X`lO-& z8A%rJ-|vVGLB0Wkii!JF8nh#GbNMSe4*q8}f_*PNyB_ZH5VpLbS5bPFt&sZKlU@Bm z_BYxK;ys;l#Z2?c#!C`*C4JE91fC{Rg#&ETq8~k?sNwUUvcPTy+I10~1C#n9!TuTQ!zENS;fuva@6%F5P2 zYuxuNC+rw#rpGm3cTbni|KQtxNyBv02(y1g?w{WkM<|CR=bZ{>d>^Mk$=!4BYl!z!)BC^E;c7ImB&!V&0^s_Z(@3u{XH(L5Ie%(H@L^fhe{x zJ9~SL(LFeu>(Du-L}t8=y9$UuQpjX#FooC}a2cwA4mdPnkQs+Qs_GL8x>?p7?h)_U zq&(vDaexxxdDpC={+)wj**qP|w66h~$%$;Kp25+@+rde7S4F*dw&0X=!e^|jvpmf( zbdjS80Eo*0JwYDQU;jLK>Or5T+#;3BF^Iz+1q6)xi6U?a5>Z?m=iw1Vn2#CH`qrKG zMzeYIq&Ci9R8_h5sBPZ96+QYoGcyyK@I+;TK&O$C8oFLsDo&9s*Ajg&BDA#%j(6(s zr(llCU7j%C|CiW?VrJP`Dzzx!$uy{XY(bqRUhZdBJPUZGr zU61PT70_R%C7d|f1H^SuZUM@RJOtGh=;C1g&xzf+xh$`A?C_P(XbR?Sb?xBy7T;oDH(zgRZ4Ce%Rl<$CT7RyWkCrb4*0cTg`~M!ULg*#02V65L+^L_iZd|E; z%(F7X(aY$WSidY9nw66SoQuP^hkr)Otj-z(4c7$blhG3G^zLj}yd%heW^||wKG>k<{E-ni|JA&y1Y@sy&`x7HR$PZZWSi5!b zy?}4IbTUVY+MPg(knb}zy$%6!@1nkOfy** zP0x$PvF#h_Ck7E8fbQ}0B;_};2#hGWVUf=Ne#{mEjvGL>yTu~v_Pi>qNVSm74%V% zUS{E(rT_p;$lva(SQ{*dF<*iw8=2l>IKnQe>~kf#2W31{+vM=**VpVuYorI9s`>l{ zXuA?`E;zWB*1ZHnsxxPtfOk`^!G&ED{j%JCCOxR*Wl`-vvUU-mq{PP3PpCM9U>H!T z3ECs`K8;O+*Vn=qsU3f1`W}qM9z~p4$z>~XQ#6>!;rkyy#5{Q=9Ng?jv0;&a87kgF z7=w|fp_n=hj8dTOG+%EO&{=g2NA!zWWhrdMB9Y-Vzh4nFlseklqBk`3^Z>BD{NElq z=22#|YGG3^dqW`4*3;T*W2h;P$KA*&L0U1dI}uot&`h7KhM5Zh`Zzf|mtA7AVLl+4 z!sqa9;~$R$ayj&dMQ#+_>?yc2Us_)(=l>n{$%CGA>=J(ck6#zDAn926nIkA#mxM!= zEzU?pWgu)%!ici)-X30+L* zzZ?i3Lyw#qe|#f>cz!6sZTvCRM4T{d?~l7GL5773g_8I6AdqCNH=p@#T>dQHVT`sW z5!2<>mRuqt5*95Inw6Q^TXCnvK6n_X)FvUhDcq{rDkINkSI?Fh@o4;#5ZsC9Q0#oj zy{t{5bz*$H68nL7XnqI>=z{msf9_5M)?q@kormj&Y8!vJR3{=%Ku3c1wL_N^_4b_>a^V&ceIXW|NS{{9Dn$fc^G9qr=L? zAfx>F40gJ!B!PST*&D@cMXpO{8A1RC0A~mk-9bV^V1i!Wv9rTIY`NQ;A0%z~XFQQc z0Kp7MTc1q@MKY4QXMoVX{qP~}#D(7*6XMDpmz^*7(UU3u&|UaQUSD~AJIs+k&-R>V z8ZfuwQWln0`QZKlXvwBe814^PHE8>i2TXL@ykV-Zf@i+{Ci6#rh8JWH119Y%Rvz9V z2d~4`s+|>qHD|qINb7m@?cPB~V;8@vD-LxL9drd*b%N`t+%XtCk}BhY%^r#7M>YrJ z9(CrpB~$?!B1tv?Xr+Ot4Pm?nC>R?tD{|adtHX0BbPyt^|M{Z)hOY(Bof|k80K7x+ zKb*u-l-b4{Vj*mO;h-X9)BfwE%Awd@K z3rI%?`pi4=IR&yTDh~K$gr60X5l2#8a_v7ac`X0+>9R{!#b2te`YK}_HfU?a+j;L> z>mO~_d1Ob-oTFn6Vm1Km{a#=Iq|wpUjq0=_J1A>olhZVJw%TR;YQ0~WNv*`k^Kdpq zew>Yca;~ExXQ6LfHWB{hi97s%SxHmo0TpANHh0p4YOHof07+E-DQ`q8%{UE2TAh_T+-|n9Qe+ZMf3fA{u4Yr zRENX*J!+RC3@|mc6i9q^Hl!uuUNVu6uUUj2z`igx=FL)zH~{dSR>h_|j`r{z*>F=b zR}x&vER3{VHg(+CZ~u*LYB?&Dwc^7u+i3s5v<}HU{o29{f-r zUxT(gkNQga;~|ir5ZnsSfSOFA#yOBgjg^jNo*5A#et3cwGpbV4xAT>&M}$AAb5SM1 zf3kXtXJur>|8t8m7M)SClrHLLHw zMO;D7%D@e3@Z&QkAqfZ-t`bW4y~UIM^^F2#0{1dxYr5YVvTARrLEZ@~u1UFqQ@m+r zQ$gCGQEzQ-=IB*d@onEE^9w7ApfFfK6QM$2>-h!=zEw+{Jvm>|$~8;J@BqY0m_x3h)WCZ0>wzXIS%B0g3)22GWkk_l^Ob=2 z(*o0C37IDmu9KX<`Lx|lHu2eRze~{Oqf*EM!K@icM+y{Xo02=8x(Tt=v775pDLO1T zL`9JJ`MAZ|xPaK1cd1%hAEy#LYYFL3+95Tw1xSCMLHdK(yBrfWd8UO+NzW(wamgf1 z@X;y*aS`DMvt3}4CgtI|#qaA+TNg9lmdQgN^5bHPcz#?t0c?^1kX{WHpC^I_7D$F; zBUKpRV$7+IpCgm-oAhvfO5?Zh3h{Yg{vOYZim6EUeCYImJ1#eM5ZGH(SIZocv>mx6 zdG%mjl?Nq4#Q104mPX{3U}tSjNYKLL+b5EQ<(TG?!O5u6xy*cZi|An5;v z6vDFfURZ|fwsRtSGH6jPjn2r}Ik|hrW%kQ?ep=woG?-yGSItgNt@qbYcz7I3!Vsch z*Rt##4TWqZb$dfo)18HiwOoLU<7~^Opb27NZk}cu*+>2pU`UWTmM?M^iM+uu|Gl9; zKJZR(D|Z{sFtn7Q>s7bya+u_u2xBPdT?(GA0B-}NOaxIFamfibw+oUK`w;gO5U`fg z>Zb+ezI^^nO-m~bl{)cZ&MjD!J0pR|aW4oJsi2}Fd^?Unt7q{e+_-e_=fQ_BXI(Hj zZGPlQ&x>ih6{$c8aqWuS%7GS#7KBxCFVN{>8W`9kg7pn~-h!(04(*I*;?fnS#YJXj z#J!I{o(&Maeohx8Iymyv%&`a+V@`+mnzx#8_0*lh zGY#7ryUW3T{f&PjRlS2lvr$QgiT*2l=(7x_^FJa~g3S(Nxq--JY zJC_QI2_f;{A%CoCG!l$BANAYbI+%}@0GM=~CGtC5rQ~?O-ie1MO)O<>V#5h@b$Ef_ zqVI(8gaxRrpjV^BPYaeumrv*#DcxQ*s}P`J?sD5$Tt^f62L1?4>R?LNZL%;w@7$7F zQnCjB@A5CmmspL}g_EBT-EaWiB##-zuN{>q=I#--1(WSrtrgfV^B+I34`^52oO8Yd z^IQ>rFrnA(=FMe#shJDJ8vxSkLidqH@ppy@9Ae;Av^<`?T?UOek&*^`W))-qljQ-v z8R6oGAJL*P__bqfSO>h3Zz-5){^eM&SWQ`e+MSf-7u{Z+`#BgwIFU#gxd;}NU{dq? zqrjby4J9FwOW$n7PK5fSr89q=H+*VfAbpxy0T>p>)cW%p0H&&<@(~90`~h8#aueMD z9gD`K8!`4fOfNmbRnuY>+I1*UND_QYg6$$8DaT)0=I&M-lwS1HcY~YSgbl z3qZDygbjpNy-E+!|E!OQpg};H<-wKav?^);%BoBWvO{C_zUxjN6~c$=9l#y}N^TOr ztKi8FgUYUIECq&ntgo{((Go&@)&3PK8e zk@)ra2*qG%`QAmcw{>@R9@@3xWfA#=r*cf%y=H3LE(W;!(S(LU z_(JDdkzz>T)5vBQq+!0k&Y=^xo$+QJG&({0zw z*l$-tWhJPQ_;^2#B08POuW>|7;OKu_>5tsn%TE$N=5WxF0($znZ&pTwu^zndVV1Z# zEHij=0Qus6V}Q8O#AuBQp(hvo{2z5NLKSg8si_~}iSchyi}2|Kh<~oAw`ki5a$7l@ zK9$Zizieg^gP1P2&atRcl69F@uVtt@yE1_@|-)*t@*jl;GbyDVtsh9S$ zzc*wX^>F9fp)#-P??msCRs#1!(1Pw2)RMTM6~+a;I%VD`fm~ZxE;joei@J3mb~gBN zz@Qh{>#*Z1-TQ09U<1;(c%lf}af`VYu23|Ge6~+>_%i7D~kn z9pUIen5e8Am@g7mb#Yk(HCRL4k8DM^;ya4$kPCA*^4D$kT^@yLsZI0ahRU=p7g0tq z?E-+{Hj)jx2y_H*SrEVS1n<<;!Y^Jf=V9G-ED%CtBK+VzCL#jUNKq)1#c76j zr(ZL9V@|zRA>8KsbGd-E{zT=`I2*F!=6~C1UP_R^Rj3**wezNDeTM&DjVphe5r`X- z4l~91X@SAsYrDHiY<^PZspnR7*e#OmH8?EvzYYry8G%YFVPe9)7pN|T|H4t3)L1F0 zf8GDn-O;BnG~N1f|0@@XHFZ-k7@T+rWJV+j1cBbRHdcTC@-UMn2ekk>QY8M1-@EzU zC-ZqYgiGs+u8=>~`2IMAtqme=vy60lLz3bv?Y*Z-Pw}d~S`)be6D+|$H~kV9ge)*{ zi&sUiLE(Jqk9sos9=A-c_kPXDKv+wak<@^9MUs<7--BtOEs3M|QO-0x)9Sa`ymIjn zoNh0rAvuu2*NF8ptdha z7&kz3oHsK>3ze(WjLshrgUXDo%0BGcdDQaBy-+W9mFvh{=&n{VrTY57tI;wlSi zb(E&BcU8gmMyofD0SUWfJz!@p;m-Wy)0XX!4*$2aBUZpIDq=fR7uwhU0Vt45r+BFP z$nX!B55PDUOC(83axxeT9f(?LX&4`UI`s^WCz|}%@m!~Ox&z}--~Edb@{g=Set#O) zcqyv17}B!Hf(sRMGrF-Br=Kh?+5;Plk@4x{$5Rre67K8h7l(sdEx1^fHm|CniBfB+ z0fn^)q9ijK$6?7~iN5tkl3Vxp(X;Q*y35TN~axONmuLwKBQ=XJ`1IAL3}* zvAFGpF;%mJ8_=mxc2~jYh`)&QOLWX%1eTP}Oxkhv3rCsn`L8pf2nuBOk}F(q6v&0$ z#&_m!wVrbUuH?D3{#&?z!Q#?;_xq5~e@P%hFDlhL4Uh`)!g7|RKJ@PTWIMqRk*%-? zSW@Rv!yp@j0eBaVGoOrMTW3N3EQ=p}YQcSXK)-Rd6S&)rx_QAg2;fCC)>o`_8SHK^ zc>6J8O80XLw7xV-2ATrD=f)I}>zGCMl8Tgv8gX^2(+BwAV)Hm}R53MkzyjKfFyjP< zs)1_;kXD_5vFliIiL6z9@|2ab!q#OrK%_NszI?ppZG{x!eY@`k-SI zAB21A-im+coB=txZj+Flvh_>$E-^z`(AAD$)`H89$Ni%(l~ zi+aXa)aD7=t+nCTLFqAO?;E(KwFn1{Ny$Mu1k~fI2@;~L ztVz$GPtsMb*MVb)N_x}U83Ax@0EuyHOAAaxs~Qazrxh?(aX(2<243KxlQtWSN!hl7Cp^lwl;G?cs`yrO3KGAJ-x;n3h9Ip9K@+TQmmL}Em2 z!Bq-gol~d6SPEVT-0p;qFagUOI4)PkytZ7yN_YzVzd`_8qcJX6hDppHK`<&(`I{%5 zAoCT?@+-wvP<*EK*~a~JhCf`Ry5_g?2F@p(2@MO|#Wo29a`hKkMqSJ}TzOx7UF20P z!`ni#AD51)oJC>J)vH(Gc)V5NB5w(LnV!zMHwr|0aknkZYxz;tmfyt2Po}a3(0-us z2@DIHaNFtBHSvU@0|zwWBT7r(E$2BC*X++5r;~Mvh{(duu4HqmtGoMAc=#t^FSRPZ z3}HgFZQ%4ISLKviqRBXyaB`}9wkr#4kDsj?c9Udh$K;mJQ}wzfBmy1>%k7rnJ^dnMXT4sEBpn=Z!G9bK0h9b@ zJvOH@@O14U78Ac_#bduq5dL-_vF|ZaH(jM~K$aYTTyQqBox*ry6G#|vYM@euq;&P` z`FDHsk%9A~%C5^APuU368jttL&gX>`a1T7|uf5w@d_^FVK^TRpGj&c&SxRty3fW8>+!LAWhe(gyR z%BN^Lw5K8Fm6*&@ccok2ylGhF1tnMP)2BB}`nU;?eB(U9YLEVzlvs6%EKc(Q%N9yd zE-s>v;P|8Ci)oAm`4eTk@VKzZ0XIce$WVDj=3e^#r+`d1&&?!o}z*MJK9 zb>4u)5+^S3T&TNm-JAh&n zIAdZCWUWXQT()FH&=97?2$Sz!^4}DuC>Cd`z zWfC9J#>)2N2;Np|@i;-wpZdxseY#zyiy}Vf!|XKMkdp`_h;?3QfjAXVIm=@G&6D!6 zok!Y;l$&*@SdiiDKf}pc+kV#$)w6sc9s{Rd2$>SCxOr;%^~e4TVdnRTk8c(A9C9hh zf>3=*%gWp-tH;5T)jDAUY)-+!IpY!+=+dpMGDnrfx7XR;PKR0$u#fdoLp>0+R}X0T z!gLfCJB|b}>`?aw3C(MWNB>92Rc zpp#j4Kezprt!5h0)}YX=tM|ui;%qvF^iIGq%MTyGTjtMp>K}}zJrD!QA;v+Hc&%*y zz~dM=X9gNgXHOUPiH7!{Fov;@3=ElYq^qlyl$EFInelW;k`dwYY8uigmJ2@%4}LJ~ z?mxrDRgI&s!nXdSzyv0D1HIY2KYDWiUd2tr-NxOvQKWw}kNRwQy{a+Sb8A7p#x`Iy zy}H>W1Na{&Cy79M#@bkhju=u(^+U-ONIQ=ITsf!?!H;$p&W38NAS*w=E$H^m2><94 z|Lw)XDe4`{5z%iLfb+%3$m)IVFC{l5AL7Ob4wTk zDLj))|9PFv1fX7lrw=(y>V#?$g9swN3&d|?=^aTRWnB1qS;a>xNETmcQd^pVYF{ea zaQ3CKaomNJHjw@BQU`(H0(?k@bB-@x+-~Bbity$b>$5=o+8x@y>>=QJ0fuve9FIky zkIH`0onB?eXRx^HG6Lb5`g^6mdE8{AQ_mfUmkP zE@vy`s|thUF)lAQcuY|Qk!C>vo9);1H5Dpwgtn7*(ct|n`pko3D|yb46AJv=;g-)l zNXk`#7{N+MD)s#4e4&Ycod4)+pu|C!8{PnVrlM7GcL&Q&E)xbd2t;CS!l7%}_%js+ zjA!?I)ovWzvv954e=7Wc)SW@mlhFs?)myl1m1hEuDc{nGIr1Pi7=~E_EdC?UuI`(j z!fO~3BSK--K9nGUq3~-TfKKZ+jQs&8?QbAIAinq~!1V_`b`LfJm93J`c*^u-g+LY# z(S#Z|rLAYPJ3YVWCSXx0YKX!4AjUEk{M^;WKxR_K`}kNGS&q*I_8LQaKe(%2?%h?< zNVpTPf=P62U_bN;{++Ew_9IhF)?^?7D%Ey#doW~Ir`(=QOOj4OD6|474Kv4y!U=zX z(CW@!P)vRx;${@q#`KTxcYu@@w01s^8=3)Ev&FmfAi&bob+&B*#^`xA{967rR_w6I zylL zF6`%I;|129p48#kM(-C-HVM*MYxLnbz!JYl#Y z_xuu9W>(hJyM~VG!zipuv#vTcE`Qys87hw*q1pigm@0g!%>Two{e4jK)R%W*z{R?YsRjaa_h>S4f~~653oG$5<*3rBoSnqOWFz`M*6kU;vvlbtCjZe zkjCCSG~rlSindVSOn$2>j8qn8lF06!nNn~3Fl~S;P-@nF_s3QFjuA5jxYA!MC0xLr zfN(S4I(;F`G5j+Q5 zQD7ER{>oEo?^75dXc-=Wzpt4agP%;k_paAtHDuv`{Kd>?|AkKZYj<(bdQ1kreBM{P z^aeWVUR$p_Vid<@4Xfd6D=55B8u+YF7HPkI>LGKPE*SX6diWVxe>yIQJrgbmxS*mGF%TnkwHv=Fn$e;seMVe#Pz2;he%`m5|G*~y z7CQF+B!no?!6KZ*QU=~FNz^+4vV$W}m)V2CJ~((T#|HF#z;6?ThN(C-Ot0gvK4AEM z?ToXRXZ-^T|JzM*V*L}%a9FE}al$x|R|9PhVnYuX_B@S_W>-PN^xzK@fBV@h7vnBw zh=WMdrRw_t*wy?|>i>PU!n({V&djxIbk0kaq{p14=OZ*&rg)lz>@uPLOtUtm*RbRP z{(lhNeHAeuJ}9{_)?72cXW@!ueq~IFKtK7JOw5Zu*UE%;Y2W-@ffe3=ztjT}%sGwv zpKTm>+n(?bo&RF(k_~PCDZ0>8TGLez&qlZmIWX!P8lF%=0&`hWGVmi2!qaf83GR+> zS8?ACXq{HY?$y4;|0Ap`HsS6K=bo{#Y&*5Q%O*p%&W2^BpUkQBfaWF=c!CePx!70> zfA*f~&n1cI(7Als6}-fmccJE3e@F30$Lrtm16(o`xj&K7bEw0OK`3y`-g!mc=xk}} z%i?0(PzWUQ}LO4dE zXY=NrLjEDc^{ZDr6_or{0)2oRv+v!OoV*OaN`|$3F;4 z$6*>c#IQ#uUO>4!@)2bVnX@D5munJ0h`JW$)s03^%Hl|0Xxx!(3|EV9!(N|~6AJW@ zcbB^@8&LP|o5WC87iS}T0U4sL{`Ptfn#gPqT-qlG?F8s29=kJ}4|NO}jROx2=6T=c zZmfj>g=-v}>N79rZr25&f2h`fJmR66j_%Om(nq@dz|C(CTs@ZSeJcSK8WO_fuV~f- zjIddIeP|oR;kGee&?R(bdir>jnk0CqgN*GOjsPf7xqek7?>*@iG7CZ#FKPLx505Q9 z6=I_8zRRI*C;Sc}PdC1Z+Nx=G4?K>+xDVR}F?_hwY(}*KfSVbW8?>;pk4KC>Kuf-^ zxehzQYHug#ARlR%XO3|0nR^Z&S9*}WwPgzwm^&hTxYrEAf6A(ee|{$+0? zyQ7Kg08{f(uQ z1o><+sXjzrkjp~TFFRDZumKEvs-qg9;Rke(XV7WLs$yY4SygV5An_H2aD1)&pqEKW z=U-^GfG^I+*poQn1f;8&-P)6}5+cHm_OMKj3igvH0dSH1mFhKCt*1JzlH|#GozCDa zO$nF)agrkp1GqvZ%E3`rvL?AfhupM3RRCN2#E-2FB8R}>;5z_509or+6JLo3pvh1^ znJNhZBjl0d(`CWfF2V|H?|cveDEv;oyz1-UJBS|@r!y=q#pM&3mC9%7rf-+Qv>D>4 z2CL#HCvK^#nLOxRpbS*}P$Ky&AKE7;0`{$d(Ctj?R>4HiSa4@KZwgvEc$C`nXa#sw znu(MU$e>LB^{5Z>c7@&=osPG_#z4vQR_3OZHlL9W7$g9fagRy4X+_ne2HSj~1mX^M zFEzT0B%`1JzRUi9@uz}7JhnWR!3=rV*WZz`YFxAPhF9t9d;Ny%IS)QCg~SVo-g=C> zc=6(~5%vNTw&bwNyzE~|%04-w3j#MF%Mv9NsC{1~>1({@P6(`iir;x6o`;5*`?2O1 ztYwSx6V{sIcN*ET(9DIt5|~Dkn^U4Y>UJ65{@T_Wb=Fo8cm7nVrJW zlPr6LBq-g|BHqEl@! zepCZASMI(u-B&N&LJsLuOJHyq0JVC*KO|eAT1F>`0Gdv8rp1xkDe~#+lsNaz(gu&g zROuhUC;azlEjw001|{Hs-T?Xxq1=1sGyl%If@`k5VN`R_ddH@1ERJ-cCA)v%v-!kp zXcSH;VgS1OriKiYKrKho`_drpeTqfm+;k|jrK?;_-AOjiF=_dZ_)}(~TP#u7(q-D* z)dcw#qsr1nP&H@gN(u$OfeAW}w}#=%$z4Q-DWH}!>7T>jsg1=!9z`6UY}>!M0DW_~ zZX7_LiLN7o_3{5JgM^MvuupK8bAN=_#yGB)%RZ}@tz+%zSRfea0nL`+Iw31W+hIC8 zrgz%x$M6S!l=$ui7?2Ug3tp+V^ID1nQf!|0t=`E%McV^EIEBEAJqa}pY=!!t5G|Ap z-#l*9_JO$h#_EuvtF@Jzf{j7mKpPB3ywQ5>2Qpq%6fG1eF@k90MLmGGi~cDf#nD4? zBV7K+r5{2i$#E{-gtjZ{c*H_;W^Z?Pi8!NGvHnMPEZ2Ed-r+K6cy25{u*2fvRH-76 zO9cgy{GrkN%8fw;-(o{LrVm$!c>w>rgoVR}vxP4u07`3lr-9ulBh}l(AjJkPN2isl zq9SWl1B5P+(l{ofj-5k4CA}v79ojH;KkG!O4^QY7_&OFds%TKb8Bt7Tu*guEx%Lby z3ugE-2Yw$C8=xx7Yk7X3)3xRI04;lRBXo!Jpz(Gv2rM)Mf< zqXRb)2^b&+&4GEjjAqe8|BVE_7py`qO6Jh^4Sk5azC2_oay-W)COxP7x`2RyNr^2} zn;(Ev?Nhfe%Pfx|vQr9!e3$EH1#uTH@Q~Jwg-=c?PC|p_%FU7T>-x+iHQ|NFA-a+O z%F0ha*`RibOAvU@7S#aRo!F=3lFKLN;fEhVRJaoG;&{V-SAJwdNhP1m2g!eQwjpc_ z5ZwhD@K62+6d;z-OHlJQ3D?NtzJst@)D6Kh6(lGYz!Lb2RdKsw==B+{Jmg8))*m-T z&=EFnPvCq<2X5rrp-?vhe}#Wm=7b4V^7>w}f&L;#$BIQGr)yC?(-MI=sUv{rVvTJ# z>v-_x6S@CYq3wAW=6`g{{+61_Na816FI<5l2}v@M8WYex1u!{;bl>9< zupU!8>;;P}ZEt|287jG#>^p^kQHvwAte|~02*x67t9^FRs*VDqZ$JZg5B-Zf@JnA0 zFpKoB&`*VR7>=?N+&Qs}1wlo8j*`V0a8&{VMELQG06q&CzW(Y$diynIaw+Vx9E--! zBoO>lq=bbZPHaFa-1YhMqQq|F@x(VU80UW^wyex9AUj~PIwN8KD#%b^%dL_Vn>7j{ zWlziVzP7fgxVY5Y;WLi*|6>WDF9+5zK`8#^z(vCreqdVH|nx(}kI?1O-o?6{T>gud2$c6sW!s22Yi54Q~w>93sRkoa=*nU-jWu;)RAljzw;p(=4EDD#$#&!t~d#U8yAlA84O`#)BVE zIK2;-hY9lW%|W`iF}POg0`txiCZM|=laL_!$-=*fS;Z@M^oXGgP*?i@M9*=!s3A40 zgRP+6(1{8K&Ik}@=I19>6eV8;?`ss@JjfD@RFT(c4kZV@%|pBF!z~3k(Z7Q&Rs{EV){gF?KHcqKPtfula{>sbX*uBeR6Vgn;`CMMf2cSk&4~Lku4a(=l?>A zgN`p`k?L8UhuxZV#2VubAJmbxT`fcT`p; z{Ss^<4kxgt{%4qhSyV6<;Da6lPUwltFZcZqoEUyR+XX}AkN5wZiL0GyLyZO~P!X{nwuX7_f1703w00Ib>gR2z(wP-FggdI*@ezf1J7z8dlMZ z?l%^$O$g)}u3KDeesqWr$Kq6b3R5E8Q!m0=Y`hA3n^G#W_qCww3ReISe28X;aBS&a zI2Qcp8W-7qI3E0k{+bGL`xDxOfO^pRU{FJg!^x0%(p*Si9UWu~%6PyOb+Q@<8oyD* z+(Tmhd((`p3uv9Q zZ2gBNiP$$LWZSQ*C+C9&0C9oay29ARz`$CN{;iS z$B$2dau0M_AlL^7I!JM#gDmF0JPGBu+xjAIh~NBBl{eTrLGvFJC0}3?1kfp91P5-Y zBup6q9SAr-1prd#>kGu-s9L$5wShAc{4$?5uBn$K4n#LDqxR!;MEeJqmnpwI9P021)}pO@5;WF$MGR7czQnx_m%3$NRi!nvuA8|i!txq;MPgQQ_w z5~6cvG2=J2ZQug}PzF4WyQlSFL>JEX7{;l{s&ZjU5nuJ$Zz85F{m4_xx5bGR=N|$1WJ|pGS{;m#f7dbIA4RtI4r5MV zct>G9_)C1CGAYs#Zv>0jc)jo2I)dA+7I_-UjH9n4vJ^PPF~&)N_p_h0|&7FiaRdw(_z{r#W4xj$;ILQ zCSJw6liyyaYTi*xo4u&m_u@nU!-NWsC6DEvH!FG@-UErR#WGyYjrA0~N(-KiNFC5- zrqvPP%id7FGAHg=Y)5Nl%=`HS|EH}?>7`(gW4Vz_eWX(5bzB!e0^`ia; znVNJzBH|&V(W8=YkvGcKG8+u6aA40c44eSFj!n2E!5+`~_HEah3kh?kSS(o|2M<8& z?T-?@P^jg5vVX*=FtuC+iP3HSIcDu**C-#5_wf;*gUwY6TmNmt^{sh!9S|1 z&9G%Yip6>HA3t+efTL>h_OM^-NI?q6n8`!!_gU7JT-~)gpXV~$ZSyK$r2RWCB1nmiS1W}I`hF_U+|tfLY49Iqznx4a?eJ!? zbBDZso8d?7b8;`8yT|%oBO2ui)XDD;m&)g`JMRF}s!Fu_8T)f(!Gtblo?n$;=z3df zd%FkF>I^|X@zy+pXubWJoT}LK^Uxc+Z$8@yoJP>oEB@A6{Z48An+MO|^gOV%JU+NT zy_A&?nEjv!{u32TJe1Ws2A<_-O%%d%3cK{}3gJ@H;7%oQEj*&=S_g7L#TD=KwHuda zVNHYF!81B$$U88}!#x@1Yj6(&%|93+st2VbQ)FS}KCQSpt!{8((;{fUS^&-4Y=0G6 z&cSKsgPN~Xo>at5r=ANh-NB)fuaIt=YKb|O%zkVuAY?jP~E&!D&I%DuPzO|E{itbsUPxD^f@!RZkRf4PR)cgj%2MF z7ByK~-Ov+$w`Eva|NVX6a8SV;gixkO7YSET8U1`b6-3TGvd56?i55EPBVo!~nk>XZpOgpkFb&wrs7aiB5VXvUY9%U1z6jfo#Ap`v4w zSc$i3Q>?KlYL#3)z2WIMl2vHvnD_OYWyu_S3030A_)mIG8TPk<`53xJm^&j1p~nlB*`+|=Z<|jMB<3L)vM8hDy?)SKfNOk7Y===OXgjV*+Cp_=rt!Ti1Iy@r`<4wZa*@$Wh#${BXy5{U~yO(J)WvdR8Ra3Q~{Yp-@-UU`CF>I zP;czVLAgyQ=V)Y)x}reLDX(YNY2y~!9FFIDpQt8a{8SzrmCzqf&Hd;2KZFZ!$1ccEuAz|lnpHO!oy&DyOu@m;VyoGs2r(*zuYX75xXcDgMJcJK_q{ zM-{C4X==8p8sNz>a7eiY47nFBmuUO&yrs|D{LDOMEXIyVKaGJ2{(TN$l?)GiM*!F# z=#(u##AiXhWA*UrPg9NljDa7vw1m6xk-}R3#a-K}alB;=r6&G_qnU`XxSP_yvrV}> z4%ip8Sh35s)O}hj%F3SVvsWFPjtU=g3BZ1&1otz6(!UsLHT^`9hhG*;+gHpu^O?|e z{={%ofk`#q;M^2jlZK|pr(xmox73pw>j_WPPYw*lH&LqlWHr84d{a=v~;S_(>D z-KCSP%^BB4{m^kMCrl*8?mwaZol?`OmY;4CX~!$fLnJqrynYt}J#yb?>-Z5Fq~{yq zoR^T0AWQVC^cGN_!Z4#!Qfo$kZ!AX%JrNXaLw?(V!C}(^?Z}6ZpGpvc&8*GeO7V4e zE5*)8r){s`G?TbK)mu&0sHi9a#PqpcJAigxj8!h!XfpJ)5VI4k;+CJz`t;+o(OYIYyMwWp#qX#U)Hnf-*3D6Tpf$VrHciZ+#co=F&3#T>wFefEQaPD(ce#8g=1uE^jo7!0@ zWW+2BnxCW!I~ZA2wEN>(bdC9#75?tybO$YRM8)}lY<#bPH&y)yJqJQ-4Xr+M+{fQ) zV>Ur@jN{Vt>;q(X({F2ty-|;+eg;EXA8zywK!!(NKIH`X4I%2|iW6t2>RLWi=R$U! zYP66PYj_<}T%bvF6t3BkzETCMP;hmA2?}>I1tHcI-MH#2Ux(aTDmOyYpx6 zxM~9vF~x>mn-7^cUdarZsiAJ0dsBQNlPeRl%GM1OaiJ;f{mzGcSi4v|*N9gG_CVwa z8kYu;W)L{hl^8nMhtO{faC+zwS@vA^Kph`#D^!j=tcChp3UaL#*w5i)Hv%95YR?VA z0m?X$$7ciub~agfMNSYBCiDDNEW;dv?;dktdu-zd5UR;6et+LzShH?=L>`eya$W|B ztomxX(Ms^E_|{4?2F$$6&s5*{8+j}igLXO1qIIzl4b4wT%|*I^Vw;_rS-#BlG9{%b zv10h=?=mtZ`KCz61{6vfNR-?u2hh|UKdGCN}?bj=w_ua3&Qkg0Fx4T3QHoi11rm~U% zEyMiW+$ljdinu%K9v&VNCl<%fTak>xJqbqq77p33U%!^4azmF4J%lsVC^T0?agE7R zIAt1x2k}0fHxlWpg$8j|@xzbz=H};tkyHRKSGo}kWy5Kg2?&6EHt`8Lk;Eza6X$3! zU8G1wn(^G%*paxcYrOc>iiQ>UCqV)bPB!+?AD+53k>~@uy|zP}gtmhi;I-M}l-&?|_U=#{IqEf%j4b9{PtzJF|2sdg$@i9zGm z&Kb42!^sIq1MbI_?O+_=Jp?*L*F=t!myy#z)w|L9u3$alGmE2z#o!W8b*@B-4nFfW zY3b%)gb$eeP1sISBb=fr;$~k_%041}xt-wcV#YDQPtJh23Y}VGjQ+$M|WqlJqkO@^*H!~9@JGY ztW!$M2L|F@{Hsv?SGcF6itw2zG06V!R3Cv(5O_q6YOD88gr)25oUI8w+i+?JF`BFWcvI}l=B8IyU#@S~20}*79iQf@ zFHLo+{Bjx{pA+1XxL-`eIwdW6PJt%!#7RjevmXy#ENZ3~6#Si|lCDG=l%P|mMT7<& z3x(H(EzFNRTwK&h7@$4+cBZ0SCk*i+W=9%<@X zl@Y(HCxl||LWGL83_Bk@tHhQpAJ(LtZ8Rpy49@C|efX6PSA39|QowZ#;!P*8*g6(= z=SV+Hz!7$uS%DJnNOSWv)OP2))9T^kMFE?*TFM#f7j4lj>#%&YGc$91FoX+0#Q+_z z+H9I{t~t%94X5e8{QOMAm6q$LUs#HYFOl9kFvNwkm@2-|hiIw0wa$AfY_|B`AY9IZXqs8UU45C?SAzA|bFTZ;Kh;VgU;fnZ zFsebCYw+gL3!3|tpa1=3*g$V1E>a}EcCsslt+WD+Z|Aw4M_tNZqs6BP^)7&Aba5F!zf z^1caTjY-UmQg1vt<5ezsDJ+?Z+JLp^YCCf01fAui5Yh-uxrBaB0cWzcQ+zu!v(o>1 zf+>4B;(!~>QyDFm5!0iOcfw49NW&Pb$n48IzJw4nDTBHZZ(;}QD~+IVoCuu0h^b;+ zjB7|-{I_d_F7{if1R&ZC60F&xUd0Q@vjf}-JJR7kNx_jshrc$l;QW|AH4^<^*fBR zxV`>plZ^M7AcCL|GZ`%-sVApdUGV>$ZI~!*X)Hp~8}a+oqiuWjhu5nwaVCm;dpS5b z++4&x6dMTI4L!O6_LGpTU@RyD(J=g$GmCZJ`Z#%Nlp9v0(Fzs zQCjC&d0%;7p@3j){(2ar+kcKRLM1)iV82$(V`R(lJ6Pr!&CIT&3pu?cz2p|os=qG$ zWHruz{^TsvIDN*Z;rDZB!|wrH#X9BoTSQh2O>E3H`VJ{uU< zrz~Ukbh;#gj;Y|rRuq0{l!wl7$Z*?U>1>e&^dhwuzMCFg_(4O6ApCLh9M=IU{B-s| ze%g<*f+L|qze0uyceeUneH})mZ$l*Q!LPv%t^Q1I6VNW$C;elw1PUjJ(XgJ6U~e0G zuw*uJZz5Eo$Qjss94UwXB=KoC}k+Ju{T=pd&QYY}~qpfHBQo@l6>y3u8L|ho9lmkGIFHDr_IQL=UI< zkG8olRye~onsMzJ@G@Et-^WrM;ADor|LJ5DDjRbCYM7-#H|;AeC&%+Y4G3XDaD~I6 zB_v>(k}k?`Sytb=+M(xdcQ>5FC--$RgWJWs@ZOyOp3?OnmhYsiXi`G`0Iz=3^6bqU z=I4#~w}UaCagnOS^=<^e%=w33Y6P(tR!wyldFb%#?GJV3-WjR&Ms3Mp%>JO+$CYzJ zzi~+$wi`>1=mACeG|iIb-jf+DfGLcj^j80%i@JNmnCLd5dY^AM#K`(5>9=f1DEzT?8dk> z(?6VrlU9*bd6`VHhQ0|FD_MSZ%9hA`7D{tx3$!gRxA|F0qb*ATx$Ys>!{;{UgXNV3mY zth7@oGw;+}68-R)B8CSkf_Kx=FRg(Q(o^hTiQ6AxE2O?lOEzP;jAPr(2dNlUlJu3? zBPO=qQ^aQ7IUlxTwZFFGKYhl2r(7{+a_P|b?Zri6<34}=ZLeqSbcF6(Pg-3UDaC@< zJW0De3B(dSu@MAT=PhqMnq&SICn=s%p*~%y?9M3~-0dVx5lURNH|$(l6*$vD>Q9u2 z1EKHM6RW)^fBqE99_FW-RncW<)<3r_I2$+3u4kUi@J&!&oW`+1)^E;q;a_1=NulG= zwHn?@wCYM*(6A^X&X4a|(xZ1hk4Xw3Ssk9(u zAVZG7Lp2vQ-~9TWO3@Y*et&Q5f5c_9sCH}N!AgN2V{NhCi=Jr(@lc{6?kFQLT~R1< z`DxwG?D#jei7nBrp6Np2ttn6Phz~PEf%DyP*0?S_{&;J-@>cGR%NATQO}7Y72b@bj z@U#1|-gkArBf41c5l7{U*Uh?D*T)-l==t)G8$ZrJnMKDhumw$3ZnLM){OpbEZ!X#& z612f*C}D%`<5w#D?|mibf#sU8w|aum{Kngm@sDn|k0b6UQX%t1sCVA>cxaJ3bO^5< z`8Y%x?HKmNi?`>vvNLLk3AS%pOKy?+7P4EIe&N5(LB^RFmPC_dzbQMB#PDq(=YH*& zWVV=O&lYl%(OqMrzeB-#VN~_9fbM}+%*T7>_MUO}(_THTGYc@U$-K{L&_yL!n~2Uy ztkwasr3(zh^(}V>=3|qu`&M1JD4jq#rwN-}efhfTjKQSHs*1y74Vi7~=Q3V9Ee@-} zZr;)^GmI0x1Ubhz1;x~CySq2OD0mTPDT%+ozBFJXH|cykJ$=n7cdnvlltYRW>`^XLm00Ib%Rc|i z^Ln@K#eCfh;jQ@4RK}duEdyND8dBwF8S8l0Y8BCB8@vuO)TjFq)FSjxtx(312U+bepUL9n9quGxP18pn2-)XV zX2SQg>nS0=mfwvGC@e}fxfD{6`Stpgi|FpmWuA~OSq_vqM zHR>vE!8v&mTi)UNKq!~2W=V!c_J6du9$v*`$R>j1j$RVKIx4A@QS!M=&2c#LQ^oe9 zt+|l$*7w3T{_UlN@kH}HcX3i!IF4=B9OpRE{&H7zVgwCUs!htB8j%Z{TcOoie2F2n z;!4C>QEd#BXK^}&3(Zv*Z<}=3wO~aXoc2AUYh3MV4A14DE)5bF?$LJQum9jn`JM{DO1miy)}hbN&+ z9cx(_WAp`^Gl%W85FeS!jtGBy29kmo;A&PO6@MWi{=k0m~D@M6G{f zT?w=!@#R4vaCv^+DawBG>_lO4Q)X_+^E+3kx#)_ri^!CC$P{~~6r!f(i7g^7QV45N zi0V)Xs#9EI$D?Axqu|)0R>+@P5SCt{rr)?qvw=fYffX4x3z2DP6Ro$uigKQ)U2N~O z*_=sq(Vw`X@3UN9!BPH$qfED>>?$gJnRJqTf#T?1anrDNN4a}mixBVpr_zPG(%H|h z3(9NmT}RK3@1>z0IYfNwULAiE^qP*bGcwCxzUY!7t$5TB?O|0@nf2-N$M<^f^l*)3 zJ*aHukJ*wlr520vFzq&x0a zZJ6%hzQo{X_Xfi}dMMtOsyzDOvEpWvT#%77|3o@23dg4O=h+ZaS!G23Y}Z|y4n5g? z4!xqmvRzk);bF%>WB~8nEthsIhi`j4eo5_AVvI#}FKE(Pg`GbuOw<=(U*+3f6pXI6 z_OV~1V0jd`V!;31m8BQG-NSCxC^V6OIx7wromeu6l^S*4!G%cuCfBrm7!UHy&6+6l zAf;=m0?E~mwN{>&gLFRgWIoMkgss$0c-@H4`=)Wr*z8=Rh;gwjJ-1h1Qtmp3g2P2U z$B>~l<)QTs;Yg8fPuCh9Y>!Xwd1Yr&5nC^8Xbs!HOz*SSgtP?r?Zz~W!^XfN6p?4y z|9lzURl0!8?gw2rHST1Q$4LSrcPV)M^y`J(LU}!FcrDKDp6~tE*F-um?}A!kQ&`t? zO>kLYz#j047?e{ng{P#XGzl%gS3@9|rT*Ta)D~s(#g$KF^`eN09NX~C`nD;x14g{9RmQ6rnPe2dvnb`=HvZp`|XoG)MTy6yXPYg zG>I#*EC{~FhIcr)ycql_E-c){F7B;atf#7ds4Gpa9=$wDm$Pc>w3UC_wBq4shY8i9 z*Edb1YiVdv-X|(_O(I!qN~T`#p(2ucUsIyqoem;{y*96M{ej2YqW4eXO~Q(^I3xQJ z=RS;{_7n5*dtxlvjl+HMh9!IaIr7yg0qaNsm-D*<``J45ZnrMdj+tyBtd@w@Y95ZA zpNQ-;eP|25G8cjt9o@U;FulSt)RI!>oNcvFRVcnBcJGIW!2TyfZao+DnL&P4*(kl| za?NpFjgeMGxb{;6O5eKJ5aUFzU(ciKQRF%32V=>+YlBPmaxu-SEzJ!&I;K-v(JcX0 zLawGdF_lEHLF0pM{)TMcVlIkS3DFtZU6c+4U9+2_>o4 z{RL$`>h$(qeZa z-3{C|c(W;}==GB{$u`b*bbs7%lHk3#YgQ#69egw*jc!gfT&W}wd`x-WqL_f&(^2sb z?q?@7mS^qjR~#I}6Dn(IY$h*SmcE6r=czVD+Ii+HNp)Txb35)%jq22LB9Y;p?30p{ z))>7g7tx3y4?*v>Y+P`l>-y+{E^I-Qql=Cp1M_P`Ya9`0XAZ8bP`!x8qo7S)2w3Jj zEUEvv>$-+V3wy|}?!>qjx=hI9y5KYA1m%2dO40bL2UNWNNS3$D1d(XiAB3+L&npla zu7@I{T#!D?Wx5s1UtV+9Jn^#*k=M^3inNK|Kj&p5UQ>_ny?e&{r=|UXuSM!l)p)iu zc%iA4(s!$ZpZGpRIG#!LW>OpTXic8Or)c#~=bdB}e2wyu7=3JN9ueeY>)7d>S;GIR zaKu_QNy_<~;gnhV;8=joP{V;+a^+|Y4jGrBe!0UWTzKv7?WG7h`rC)T4q90ka;39g ziLdGM6pA%lGrunCQ)OQpugH117BZDBkzM3sw>q~@A*{X$JG6PD(w!)ez*~uOc+cp( z5d9pRl!zUyh}`I!d08>ZxBbD$kEWI4!jH;z=^Q?5Ox!>}CtGxnWN9Bg-AX=VOx%J# zA77_$np~$Z$9ZkfOn8^T!drUl+r8^3=NZf7M&n!Lns#-b{UP}6%3dCL37tlWV}J6A z^YpURg0H`fRT79skUo#5ZOlE!5%biZ?h6k$C;pCY+vlaRP_>Z*WL(4Ohe zn!#M;NUf3qXMO3l=5(?Ty9r!l7pN;T)TuX>WtuC7L#&4vR~CAOW1U&*v z{7gY9g;y)55v0hL?5_`|C~Hua3*CJwb@=%VD5!((pkA0I{Cj#GKG z_tNt(b!>l1T=wC6N4)6tY_Q~JN0a^#mHs}pyyPNURnjH4hW>#oF8y>e)lJDR>Q)N5 z<)@}mt-bqdw2v;A;}jp`I4E<(`%p`n-wk*{N8DQftkv|OCCF6FYs1vx`(^%+_Al67 z;m<6HnpzzlvZk{;=y*1G$Rd@rEw~u_&-t=5Xl$;>M(E7>v9(k_gER(~+Q+uFVzgtC z7I_QWbB2-Itdg_6%%w=cx^8!~HZZY7muamuYH$hV5*{_XT-ox%YsZi~r`AzCz8~et z?6Ewya7g&N5??lwWfW(g!W*r?-Qj(}TaGh^zT!}>J(G37Wr;WRuxc+`kR`sVx*&Pe zdnFv1GjAo-ilR_OlzrV{_p@2TReA7pg|frtRLc;N@!h*|VPUG4mNTHRdvJKz_L9vN zln0+x1TfZZ8I5GhjlH|{jG+gy&ds9#ur<=GGLoh3qiG8_$84dk2D|EH(wcNh_u5_f zSH5K6Wk8`{40hpc3d4NN^gXfc>%H=i%uXWl)pZk#vI-qo^T4J!v6W*UMNLNgQqFHU;6X10~d5 zq`dNLp87Z1N{W0+g09W$eVz~#bJ?NwPtQ?wBgT(zk@LEd!CZJ2mBmSB719=8a|*fO zuQtk0%1O(e*vc+(Nv^QYXIORR_!g}ZRV~GFtm+CrC4;e9v)DY-&QNRbCpa~j*)%+* zWq4*rfg3egHX>u&2KF9TOv9)yW3;%oz|HHQa<4~k@{xRN`jCj?= zmGeYzeuV4Gsprlbak>{&3Y0;-KfK#Kikub`WT~1CqxasXl#FyeCj8$1pnA#d@ijM9 z?k4vUrIlOUu3~1K@zSYQA-%Lp3UP)XBO7MSzMrUe&#>>4wMY97I2(^op&U6q2TKy$ zCl(52(T9Ze6mk@Fu@MxdXUBV{TeJwSmuuJRhw?WY@i8$*bP>Hr(eO)@IS&zu8Kn=+ zKL`Q}GJa;}Kq_VSOKqTdA?&%gfmEFfPVbg3tF%s7yfR_~Wu0BQngatPvGS{_Y9Y01 z$>JKx;)XurcYRP=Q7GLgl;(3IgXhP)Y+j?fnRnoL zw|=QaxGC;^`2)UP4ZfZEzMbsvtry;peR;roFO+tLea#=3Ss(nEhKz1B)qRzH{qO4hwr5t;lfA{<9V%Ur9T^fm7roG)on zR5nD-Dj7bc&&0v`O=yU^Gg}?kHLR|h!_Jx?8 zDzm_bX+3|%1GS+2vG}m_nVgTr1MAd+qK&bl$0F6#uF#%?`k10*jaf83T2GeTPsER$ zg>jd`F+X|z~vJ|}-XU`BA(w(|2GsNA`+{qVA`<=Us zxsxY&UAgPasi?9~^qllEy3u-<5_ho1GoRWYNUH1JN0{XlAJ|6r7PixWEgYuj;8$RK zXO^k(g=1XN(OZY~i-!t7h}oC$F1e}@xQ3F|HwO*D zUsJGNGyDbCh7#7xJ~z&2=*VbLrfUqLYuKz;&=J0+&vWYnC2KwvYd!@c|1yG;nw^uJ z{zyb#pIhy&h{Ro9iMuOwEbDu?v^VR9X^dUOZ=0Vz&vVLe_GDdeO&^8Kv-C&o%HAhFD!%H-ch$b{UH|5fl>Ok=LTv`gjIVd0{|{r?MS9HYk%1PAbTkPyefQ=r#m}uzdtrV znLNc-yX?-AOOBo*@nx*mYMN!N%~OVWrwCRko>tkhK6<5wwbq&TR_pGoQ&=gT=LfL3 zk*)8VO^lAxxV%w9r4B=}wOS#y>LIrR^>dq;?o3SNuG;tQKJVKdm^+~E+b!zbotZOj zLQ7vfx_eQq@GP})^0Ps0ACyMat%ij+t#+j<%?G+s__>XC`HgmO8sFzN27Dja?i<%e zHgfF;8?BMn&ainMY3sLW4^zyWc5J*a&oOe0$}74-Tr<`5eM+`}O7{DdfB%$!@6_48 zsk6OP&*mOIbuO#FqzZ2T*bM3%ej@@|GRVf@|->D`$R(jL<0P`cjD^z ziMjsix!&oT{I0&YU0Ovo87pt4A5V8ug3W=tfbSF@wb*cfzxJV)dNio<)f;)+5|6Ex zGr1g<@MPPLl=tYm*p5VKc%cgF^KFL;>UHZ%{idTA$HrV3hS$A9IR#|5(~a zON@i39^z)#c}Jisd|Wz;I`^FWJB?fy(e5i6bAoondK9c^Q~W_ij?Yp-T=CGZjszgh+ka7$N7Ngig;8 zG#mTc;wKlzDI)vjR3i8Bz}Ma8&<=4g+Z0bhDu;2Mc#m-b7ADp90+u4x6dHy(n7ODT zhqm@NQLmGP1lKitFC=mwIz<=jQy_!Voa|R7H8e6*=eab}Ri}+QlTz**r8A|vg>ui@ zeq3@eAJ?g#%yzVhn_LUizAR>c_&({PShhN2Lz3r_!$ah)&y!(}6YFdfM*`ai4CV{e zSh4HZO>mh_I-AikY$t;*r0+aw5SML^wh5cs^HKJ_JT zJ*RG4CT{&ZvzbiX^2zb=wyrNf+sGW-GH=@NMnAQWJ=8yguI7fIr&jP1Rsh{vC(IA_wWZ>J)s z)$B@?l{ae5jrR1F*vo$A@_agRg7m$D^i9p~Y_p@-8u!n~TKz>&uqrs-9iP3+AHQit zn*9XpeB3@N8n5)t?V9YOXqOzU)hUU=t6M6H3&~C|W2htZBiEQ%s^!aNmAb^=M>r%$ zQ@y7DI_@eO6m5FDB5I9^W90VHM-BsxqlE+q(d^-}(aok!&MrlV>BKI@?8Me`hRlgP z3lJxOpLp2)O>EO&_ebWaWvqMA$b;KI#MoSG-Cn7j@KhgqUZa!FL|8b5qlY8=)pG44 zpt$Sn>)ldZe+HAwn3%6y^!S$aS6R5fimVUPOhu|_ue4GIs(pFca(ukfifWuvCm6hk zE@GCQM!rp%WkV-Rk!EBfkD98f9d-(Sm~!VR?oOG9X*dW(%n_^mY`+zh6ivN4)JgVj z9;Z)GQuQF_O;k<3-M)ct<>?S6R>6rx;tjoYH)2|(t?PB>L2I;uzp5c|rJRH*_Wk|b z#n`BYP#MnMsgT7A(uadrnyvL1DtqGLb4l`>tt*p5-jgzpzQO4`dwW~UsMJuI=Z$Nl z9?MoA7=$A>r)JD95%g3Fy$ei9OQCrm%d$Upl@{Fm(-UkOHdN{XS{ z4L%ahF|4qj5dNRorwE>$I74&dB#y)})2pVp_OL1Yr71A2OT_%zCe`CpZP@39a{ zX1##8!SzSi2z0SYoIxm`>^Q4JDFg6jK(zw8SAenZS;=4#RsX?HRMCy*D>k@@64pOH zMIv*OFpw9Em%Pk{#BH4-jj>ve_tE0ci3mBI586ahmVi(ka}2^ymY5QZ5>)UzF z9>b8GsT6zEUwg#oeT3XpC6Nhw@#5fMy~`7cJOZNse4V1Ek}obgF_Rd%(nULOHiHT$ zpR*T%hFR7I`p?&oibR2HxA<^~tZLzII<)S)%=OM@go&}Lr#F0hdU|lE5X2I{ykv`I z)%w!kzYTor))T9mn$uWbE0$F4rE9 zelV^-Ps&;aq_Y4)29&b*&BQz1p;^or4Ls}KH>-2G?*Xe^@=Dy>IIJ=;jGQVEYNx=G ztX^c^Q9A0L3xWt*Z#98of#pr*^J!+*iZJp}MDvp6+!H~!HPhBehGP(4eG@joAz+0= zOZY>OY_p$HIRW~#896zZKn4S}Tyr&ZKv`--;q<9f08s%Iz`(e;H~?Gpztf2ls{s+s zlch`Mh8fS&w@?PF*R2d+=)+{maX=o{xTZ3zdtEKnnR3H&jy9Q%MS`3ukxQBipT z+d4eD*UD$?bY|Az`@C0sY`xsKmkxn=yrodTcagmgB^<-dz+m?2$w`uET$mT|d;!Bq>N4x4j~Oh%+{Sgj;o;%5QvPL9@IBQ0A_P#H zzMBa`%z(HQXb9X!a!3b(QxmVOzc<7Mxx-_EcV-B!JEH_;4HOzls-eDqg5dQwEPu zq-3|ciphs zV4Zfq#LUbC4HYQ4CEC@*yB_8n)jqs-`M!xs-&>d({L9xQ4qtLYKk{Z~tf8W^a^~W1n<=l(D)dx@vQt&^VeCsGn0f9G)Cf6=3Ag zB_=OP%(9SktcUmgJ*sBbWO47KWYtowT;gGQsI2Uz~xC1=y!dV|0oH;rtT2|IC_pSjdUfZ(@>K$PDe!vELts85tQt&)%>nCSB59RQ&WRFu067Ql$xlLU*9yK8f# zSS5PdFu+pjnTMDG4m}O5xyZaXmVozid(@)~fE{2-)|sBT`(nWq;}iZFEwsX5>3-Hb z?;dZ?Y00Qx{yoa>ttZPZlfY09>noSo!JTLfLn91G4+s~|qURNT$@w25Iku-kSJk~q z&f0oTiL3e}sN`(68r1wGKsd845RE~sbo4VEDzncBV3c&FBRZ1?qQs6mC6B zdmzY9c8MR~Du%rNkF zvsT)WQ7C;hYl{I90%u4@=VVFm%Q@ys&-jZixzOAuX)I8j`x!6dw$@DT{f_y(EFh>V z)kvsa$z|}aNJ5C`yL^Gc(OWT^`KEVBVBlk8aHnpUK%slEu>egYz?!wIk8wS3?{yG4 z2XkJ({&g#n0T?SW&o7278@c-8^7U~*>6Px?1E08zVpq3#2x-7VjSix14VxN?LE&uX z0D;n7gtOEFQQBTv#n1V9IKF!CJ#&)1m?`4hM$@o0f}aBzz0 z+O-dgFIi)`jPBTJr_TvuR{z_UP#v5L7ufYm766jjSLysF_7LmL8O^tvvn>&H*RNma zdndlZz-3f(0Okjx9j!xRXFUH=Pjlc>fL%%{hTRzDnFSd?5OI`&xGYdx^j3Ct#|j{K zK776>4-yCMvX>ThD3o3^E56&D25pWRU^M}P38>t!8GHuLeh4&q29-C&#A?9qusvwl zor?#N19I|8he<^!IskR)z`y{gp-k`7b4}gkr%#U^jb&E94@9(FXP+LjhBEvBa1^ZJ zD$`aXXX;ykHFL!>Z;w;&4t0T*KQM6D-G)kt(crNU75|1hNn;+K^hWw!Y^r>?x~g)V z?zH)y3Y6Q`uww&=vXS|=ss-MveW^Nn04^Io4tQDH?h6>We0vJXd zDl(IqV_gI|sGL%9O=_pUXCqBlFPwF*JTGUu?OWpRGE@dw8?i`^b<#p6h=YLb!tSnn5lLxke4RN(2d3b&N^STyKuawy&3$*KQ53iQM}7dXYyYuv#Ef z(O4purHnEZl6b4XhaQ|RaK~z_&My^cs^huMMv?0sur!h2SXhhfjgBOO4b3C65helQ zixE$gagup`!*L!|o@o0!_kAUBo`&#JvtjcMslPKkJ;?C%F0%jq!qai)C(?H*JSc}Q zK(_q*ZMInOMSLIr{X%fY2_j?r1!r5H-$^yR?E|R<;$z<@?!RAP4m~CB+gQ+F(DC>0 zf4XxbsQb?8|ECYss7bS2d$a$w0&yRLmGvz!k%EV@X}#^O1@#_aTTSRNFaCb-8UWu7 z4*5`i@c(+eSKdMr2JZO~a6~|NR>QGKwXwbqJIKospB++6CR`7Lp;QTG@;z}zMDQO2;y0gNa(J+5O4h>Z?02?9(iu#`^hu21*G09T-sdBhPvH}`Gz zXi&X{og^QEJUB6i`bAMOc(LdH6&Rbu*qLw~+-d*XXD7~7DZY9oT?Sg^ze|6W&^0#^ z)`#zi8;e6N?xmkD9R$f4WP;rBjJM(*Ee)5$UI0MH7}zTyu~#QyU}MV#9f3J?=2uJJ z_*<#SHHG(v)gYoyLQRbVGJ^~fM-nACT|V1^Ypqk$unSrvG~csm z@{iI6eYoEk40!j9F3|iP2fTGHDXS(%(E}r65Aefp&5J~1kn1l*+5{0X#BdtC&A)sJ zb1ouLIT7^X(Zd}!I40(vS$Gy(@nAz^0umf(URn7nM@_n_F#*7zmk_|V76yaUVGc6E z-5`z%!hz=Y?c1qho*fo5B&ky~G2V%k$BY&Ci2Uwr^Zafzs|d`R5v0+8_fSc0zZ|6WAdd0 zJa3%8V_%gt#4IHtqQsMbzjU4hBBZ6z0qx(hZiNVO-v@pPZ+8L`j5D31w+)l~SV&O17eG6|z+l zE!GN!5Tdd_XY}2l-}CR&AD_<)Gxzzs4lQD!E4IXTvGFfcH18tChi7#NsW zF)%QRvoYZ}lFl7^_#fkO(q0{g`>!?(GBAiR80hXI2QUs_Uv5R-JNxMT!4C)dtuFG? zqV1Qh=jUC&Pvy_8v;D_qehQy_%^&CcYV^3=eWzDV%F3@hm5+S;)--G#@tKK9n}LmiQG|gdl!3ch zo5AhEdDp)`Ffc9sWhIH7m67`&Kj1GaJPb7IYEB6T#(#f|$`kV+Ke4$=Fpvzy*XjTJ zOQ8(Cc_)1aYJ#3h90Ln(`;X7X5fxbf{gcSeczh|=RfO?h!((6)q1dlvU=(7J zJNTHFn_GlJT&+`IU%zkPKDPNEPj|8H(bXN0z7?3z`{fI_&Z$$U+RV!?k$z50aO*TC z%fENJ%S4n*K7aoFn%;;AmIyN)owIk!^!V(ecMk-s@7`3wwX?2Ko@sHm`df0(r+bQP zv~BXTuZJ2M8ut61x~&(x_2`EO!Lz?Y7N+;^VI&8pA1L*e)EQ`{nGYQ-J=Uui(Ht+n zw>2?EkyV^>Vzg6GNa*EJ8_8$h-DTFr?v%>PN+YQ?(KVdwR4!b&P;%<0i{!;@*CZ;H znw6FH?e&fQD&qNhliVbl*F;}ETgLG4QA$9}c&>FJx6b?f2hB~h{Z{H{5^smcl!-Ht zqD~%UUDZ1hle71-Fq^1e^{?|>8!bg|$Hc6RXue~7)iu@G*%|lEctlD6wy-ek9i~0@ zX79!~w_HDkb7^Lo-!*Y_+Z=nC)5n%T3w5|p*vxxT&AVHgm!swWq4L1`e&2UnhXkkl z>J#7HJ0Knr_hfKfl)1>7P7#QdwDfr(wXx!v4nO%GVQzGSA0de7#oAR-5hR zRW(ydVMp7%L**_n(`YX$O=F0gDoppqt!4AMhNZl8lDp(?xVEk?%kk|-H8WG+-xC!1 z%6FdrC8OiIxG_UY+qK|#T$$0>(z`LEibUKL}T@32f~ptJP2Zgh1` zjiUK#9qeEUy*-5b{t2wW_3bC`dv-i@$S=VUT61H}%0F=DyC&C%zJ8VBi7G2EPnNOP zdGDV!8g=Q?uZamBHWnNLNl8h&ka_~rsbs=PEA6d!<-FbssiiEOEkZ%gIxTy!Rx(~~*=-*S zk3_x1SkG~51dNF&H@>>QeYFnG#1V|(*w+TimL{q}qEu>1O5e9{jxo{E(UsF**L!<= z$Lsff{mL&WSWg~mU9)lHMsxGGyU(vW9D_&b%C^{ogS%x*4$ebub#>gc)a&{VzeYOV z;}21~BuwV#=jVH#oV@&awXm?);lsy%beBJPps-@aiqofO-QM1z?Ksyez@#1O!J>k(FoWALD@f54EPMdc4EY+8evh*}*}FDp8x#+TYvT+uvX8RG%;~Ffcba zx5+eJef##1@tU>YaljuQwMJ}fYHCVIOf(3SFf4R=xnt+fWVwSH-rYO4Z{NOr`SQn% z*|)Z;7-atW^CwC6Kzm0=;z6>~POgobo%Qum+bD7e9>%=-ZDczs^6E$B;(eaiWjpzqD)`oMt$fntX?(pqorS#jjZw`D8%tE;O6PMtEyY`JTC!yzW` z;FGO>17;Csets%$I)@J*wy{ammvDc3=jBja&ig#O#r|Zw6N4?0gIvln-0tl~wDR)# zx#^!6C?UD=<;#~*17reabaa#;E+HXN-O+K?nu+s>v$JSKiicZ&fB&URm#8Nqb;duR z-$=}Cd968n6r)R&GFDPmRZ2biaK6K0E$mW8Q&BUR9xtY#Eq~ zbW2V~kt%0|nUc=!pRRf_4UyPIi_Xjky1cq|OYG|iVitiytk=3jAv%Y%a-Izjrw}Fc zHxmfih-sIFchIA#j9xRT*F1YAnKiwBuo{b@B;Xgrcyz&rMyiQ_~ZY^_0}q zC~mPW+>|&Xn`pLxu+|wF{^-HnQv0V&D^^73=E@9pW3&-EpAlHH$O-jMmp5wNVa230 zd6wXqZQr&ncy9bfb!f>EFE5j|T=Y%KJu~<7byOIKv@wa@F}H&8-Fe!JeZt31Ods-3%C@yJ$d*jTWo#2(G)OUCP8Nle^bC?0_= zyW6Wx?bEH>w^!?!rtc7CZC^CBq%O>Smv>0IaYH^{pT29oj=Z|InLpaDEMS+{My)eP z-Q9`%`P&S=Iv(D;dUgFl`5ni;u;{pAe=!PDU?@i76ynQBmugH~Bc!lL9^YjxV@%dV+p(=5Jb2M31T;=jY~Z9(fsi zi!!j37%@!3H+B&138MS7Uo~~|6TH0uPakTYy&ClX{FNs79$aSdo1ch^p8ScXRXliOU z5fKYaj&y!~dG+`3$HX@co3Q`&*hW6&hZ7~=DSs7k#5NuNScqdfiLH;RrE+}fZqC@9 zs`}95{r!En^(4LqQxkMDe2yIxRCHk3Oi)#|==a%K*mCoxNCfwHKa-}>p32MIX_~EGW`}CAVyHa!^ zDBu3)*O%4yFVj@hD!%Hiw9Gs7GHCVltbMn2#olNw&V?(k;^dr~nsUCxSimtg@~9`F zj4k8-!6!;Pqb^?L;fTbfo2QbZHk>C}OS*TKDDv&rB`8Mzxw6^(sHdl!8^E5e6d+7v zIdjFJ)J-``Sy>smATu*_YNTVoRH7o+mAGD!)4xZZ^^~4Foxr%QZEVCM5UB2w@-!de zb0SFF*RNlj-n|*iw#dmMJ1pG3(bxXa z^8kVxB3xE*dEiva=o@Edo^8H;`uSEy&whvlCB(Y1a-0=Jm7ZBy-X%;bCpkS1o|@OASV;|?Aar<{e&*t$Bqsz z;T-|UBsMB*bS~WYj%TV|nDK~c4qwhyhlK7)JL|Uiqvq%Z;-5FS_v&QCUF!_|`8Ae8 z;p=knXrZ!?>~#qhUa_0)jm2)#@a?^q_2u^Oe}7qX<^nA>h2-{ow2LhR2~^?wV8jnueGb%k^WdWJcfIK5w(dH2!UcZW67`)OYsR2wO%)@a)2$-piXz zuBrPEkso<=4U8X2$ef|_SR1sL9=}VXO^%KI`4O_%cyyiej^kgAzP=Jyj*9RnW@1v_ zo`{z@{e-vJjcdz_Q}Z~U;Fw* zA{-nYY3p;t(s!P2|M-!Tl!Ua*C0gX&qv`Mt8L0NrCDNeTI|3<2zCN#f+X3+@ldE)BYl(J9pWweB>HNFYq#Ztjk zlCExbvB!ICX{_t)P}`PwzD2s}+fS|%Eef0(LVjtguI?M{dQ$xdIJxhE!pqZ0wnRfo zz!b_sVH=r)7NmG0vK&z5B=6eV5&#!6iTs(>7Q4qS-zX1xT1Q8xZgyQ!SzO}qLd<%# zOR33%E?uGD5g88t{Dbg(@7}#sYrRVwXq99!I~(fx>eT+Yv1gGhRLi}19dm=3S2@o0 z)vp0u_Z8{FvwvGHee2le4cm11%?GD5;^MgX@89ooKD(rWK*@^L$@nw*)^zaKMsq^G zSCy(;OGGK-a#B=61j7%uQ1X|9$zjiba5rzJToT@Sk(+2_B=M0*B-%VYYOtTe%MtnL z(MhB)4i1i#{+8W*fkereacnp@H#b26fw~=g?$0|jQuQ)P0F57U7>^t|^4LxAfZEJLhSpi0pxfe!jl9_Ewsko2R~b?C9v2DqmO;vZ(oyoVkbQ!RB%tQD*O%$#d;Fx$+AW zjq+?6jxR3lV|EE0j(p?&r>FGzUa|Pek&a}yHS5;3m!0|v4ESsC?Rml1>!iF7u&r9f zA6?^@%~j#nMevhS>&n3dH!!2IjC9!*hn zJQo`qo0pe&k$g*jMT%BP#r5k4Q5YcOm0zsywq(q!MN3S)JXzYTgD7JEIqjam&%VcgI>#ap-x`FG4hlk(0=jr7o zXAnFyNsEk(Oitc!WYlzPPjqKj*MVa9%*AXT>#Hl-*{1=zfcOtuS<%A{CTiR9uSeU9 z+&({xynp|`mzP)CD;rv+jJ8;O)*M^Csn)zMZyQQWYxXSNRqMCLd{7SAwl~8pA|e7| za;2b>6Y`#-qGIoh%Z~~Rp9D=S)!)C*hPc*|X_#Dk{F_&I+4T3k%7^*+ZXXLIf3D}6 zJQ-2vdK3?g!J$aXB+(ignY0PC$<>_`7Z8<&{rO88bhPi1p9yS|lq~k{>F(_8tf_IH znH=nk9+(stcD#1&T4!a*qK5y_g&K!aTTRzykwEQY9RRPOzPi;YYMzEKPaM=WrTO*N zaz?~i$=qoarqYmf9BX6pA3l6oP_RzLwHX86Ql1^5C?_qQvhBDFFwq{d`111L^Q(j` zbFFrfg>uLw0tIzlLSw%}{)gAEe|*SyZ0dcj(ue}3tE;QV;n=rV*HhP&p`w29z~{q* z!&|p*WfLXTu!SL380Q@z3v%L~TP$;3fyR)B0nVFmJ_SoK_Ra={d2zQ*FI+n}G$|?nA zoxX%GAdQBf^iNezLVDsedg*v`7xUS)ZR$}7+EEC2#l@;!#^#%K`;&4Vw{744cF!&c zGaDP!wIn+`yL_vo9v&T!{lDXMy*X)-rS=m5duHr8mynPUCgc417x$VxwTm&3Xbhu#=Dk-Y$VDfZFJ2xxSKQA%4$!D-7^EbcfoOG3bCa$5WGk|!+7yrh7#lNV% zPRT}2kRWqr8b3xdbBxWmXy{P4Al&bATixzwE+oGjK2jN+9?tjAHUDc?B>Ld zP%??pA>~o+yO-xaMmG~g?0r~xIrg}?xSTlgD|)T`#ful!AKYP(6HpDib?X)qHuyJ6 zv83bG-G?peKWTbo?83mtlBxjrTi(7!we+%sKeYFp-p#Bm>76_0L6aHZSm%K{s zEdD5=FFAVBmM_5dXqWA>x|?ixmh2l0-;2oeZ91IV+Tx7w6y27l$!){Nzf5b^VW!-- zEn60E5f*bkpRlm-_buI_q47AI816eMTBRYii!c~|>GxJVa@h|BR|al{RroxK@}0VW zVb4tOj*x{iZ4owh_BUG5CXGOdX()EO%Ma8{^j_Bb_4B8BlvDRvJW*Dv!uJ%FrAc;o zd9X`%X@R;h^vre&5m75u!#_JSv%e=~@!k{0zylGHky8V2!rcy8S-Ao;tY6<4LuL=h zX!WpjnNY}qobY-(yM0QR90A5qU;Iyy`` z0|;yg;yBtP?Zt-1#*(yS$Bu!vLL|(#tE{k+SwKkm(OJ4%xups?a2eAs?Aq9<=;%a! z31APL%WE3`gjg|2X~Xuw#IRVJ^6==#mOIAlW5)4apr3nWfp4MQ{^W@h>1y7>#>o4P z4-P+9s72maQ+ssq$qDBpM@&Dei!kEHMf6eG^Th0f-{~3G@~eD1iwBPu?P{OBnfBc)nBf^slDQ&LBVy zU4m!?B9?Z7l9Cd)&RY3HE#pC(;d3oECvG;Z%#f!ghNoKJesyri`SdXIU^sixq#CLgi@)Y7_q3ucW@royg ztx}CFMQM}R2pctnz(8)7mAwbxwy>~Jk)IsBEU50QCsLIXo+y1o1X`Bs5d7eze3&TQ)qH>GOE(<^6fwM69W&_#;!ll z?U1fPkd?izaQN)?>(_7J?)_2|U0fy;>d)-;^z1Sadx|(ag@rimU=c0ycpWA;{f&cM zaW9fYC;^?PK51|(*kWdQmR~ibwxFzT3l=9C>=bqgAcp!Ioh5&9^R{gAj3e^(E_;Va z*UCoU#Cq=ctt3S#gxcuW@8~g%=f)GVcMrmAEXPV@|pcuMDs&FxM`sB;Ph{=2s0}yfmqrl?WqM;TOS`E zC_pwgHYiT@^)H-1zxVLrj6h|Gg_B^9u`Qn93IviHh)S_|SDYtsg#r*bVq-byQ$1X^ z;rFMMkm$;sb_hCqTGIb$g4k_e(U zhFb&rmoiCGCb`jqnowC80(nf)T$)!-P7d4MvOd#yy^xTnvvW;$eU_xY2sbQ ztV`{>-la!xH~yNo391tq&;GRiX>;|Bjl0<-H*NAz3Rnzyr%1a?ZaKnA4-5Jdz*w*rj~_p>Wwf@E+fAlIFOmtHH?QW1Y_gjcRCOo2 zx@HCHxfs2@WBlThP-Bef=PzHrBzxygPWnY~&)MGBki5W%G{?`5G}pezw4XHP-HWuf zj4AAwIOj}qZ4vdn6qV$Lk^~wVJ(=CvbuYrhkT4I*0m>bUF~Yt3c9jd?ZiL+DG4S@- zPsqG`xAHpKj(_c1^E`d+*MdQ~^{-#Q2&b&QvGnSY_|hg{s`a24U+Z{Oon(+tz#I9GnZ(Zopq~s@IPcMKaMVf=Ifmazb z*(UxM=y7@VrSH7)C86!0*Ol|FI`1Fc{@79bjNEU~#Q+p*qic}-=(N9;n|MUZRaSvs z(8oxX^MEha3m6Ms)6GUQxs^9Z=b=Bc+o^>68ZmWVqtO^tT)IX(US4>$~(rRH}aQ0%butl3;pz zy3;e1!2cKMdtiB2Y2GmglGJJ)WWpMOZ+(3Tyt;e$Lf?{70p0iO}LO^uD`=YRJg zAR6vhk^(RK`SY=vNw*g6EnBt(S`LB}8f?yZP8YNi6AOc;ee7 z^K452ViO_ou3lcTxNtg3muJnI;}`|_=J>ad3=9lFb~n&~(rv7)czJoV>|vN-{i*A{ zYgbrgWDU~v76}Sex8#(RfZp0z=)dL@0370aF?IOY(9r(Kd!t1hVbz1~f=dR$uLy28 zp4ycM^1P^YeqMy6NI{jjiX9)Z!tX424ab&bO02 zZw6K}-X#-&D3K-V###m+Uj!>NJ3DKdrV`~umgdFDw7KN}qNXOQ<_plyP%axa!9*8$ zEL8jD8f2@Y==6rnp^rsC;&CBCNfZhg|F_P3VicsU-3_OH4X2itZi`n(xxtpPVy#>p zmF~#k{+_|+Poobrq8XL3Vl4_FK{c-pQ$KP3n8HGha(qj#l@2KcjD1?1`=%w(d;Ht0 zdMBl?8G?|wm1^|%>@mnBJx<^i6g05(0LKay1`K-&rzmN&mX@6~uhJu-@Uv%KUR^Vw z^5|SJX#yPe_w^N%L=Op~CaOh?q_j2mrgo)+z=g$&l&W-#-g&bRO z93*DtE9cH~i&f|5=05c7xI;=#N99G@NTWKlhD=X514=V9Gh?sb>xxB50I>A+nP}}F zl(4jzEiy8>AR}lr8untlVUC~s6fu*1jg-}a1Dm9zD(1x&!y$Hl`Cb<;Zji%)fioq?dXFAGDy$ilb%-fy5H^NSPs0tY zW=m?90j<9?k^iRtL+a#x^xzv zQv^n)lX24kbXM-qqK3)KigE;k4jbalO2WT>RgI;hKq9FdB@y}Y`& z@p4qu_~c}@z>C^i4i=`gnrF{+M7WIrh;s?kfBrPfAgn;A6|Pl>C@4y8;TEGH5TE0A zNOEy^*8qvvqDLbW4Yvo3-HeK2ucb>qY#9hGu~KiUpiZp=cdK}2i60%r$udby2}AhD z`QSEqpYOPraFuN37EgpyE42(nDP^lHfdGD1MOxZ*{7Vh_v*PzQ9v7iRaP98|=Wqm3 z>Utmvn3$|;qbs{ZnsLF8Kn0VO3-q!a>SsCCzoyFb+{xR{v2rCfJaqV>QY;p9b2L1f&wa>z!QaJUg=Q7 zL18v1+CVyspaJ=`u%LijhrAEQkPSNm;%tbSB;zBLbgdARraC!`Lx+S*%K>gM)q#@( zqC8P4d)_FiE(6j`r%T$J;fYV5UmIVo(`tHWJx&9`#mG}z_LMxu)v$yg%vrH8V+bIE z$o3UbEt=l0Uwl--L$>M<(Qr$qP_}K`cF(pnA^%PM(8x%+SC>YNV(LiUrS-Lc0Q10a zHF2sx?$ujZZRnjkm7ROVK4$Nw4Vx3|>zuS;A%jYLXD4T4zi&aWp2NA7f;wJs8bs=d zey8Rb5cqg`Q&LmkaH_X(7i9bW{Azs1Dx=sVo+#jGYHIq9Q$1!JW|P`WLLE>|fP)nc z&Dr4-c#Ii?GKhVk!21Ag>;Eq6~g{uV11gngZ z-Cm=LnumUaEy(A!I8u?%00Qh|V10lY$EL{j7>sYwg5ih*1d8`Q?UsP2o>(@52a7vr zWnREDwk5TUZN@7UWxbtM_4TK}IEIk~#=QI}<0m|l7o=7Mw zfd#-rmoN{N4tcE4k1iGJ*Y`zFE?>1_42G@fnyx1&kEF9WyfgW2DZvv30WBcl4`s{# z6jm5ohM=kfxkN_pK?)u0;HYEmtO{e!B)N4x_Q#lwk3+_G$84cSz|n!{1@p2gkI*be zL3#jLB1$1b&;{zK4YJmDa~p*Jpm%W4&Bf*G@Nj3IT_rdyc#Z^mfe_W)TQ4}J?l`41 zWeh^0-`798HI#Los(bZZ?S@l(-vIWy9zF~bJ{%y(V_Ocjf^k2Iq~uh`4W=6Qt1n-a z+;Bvl4Q=E-mTF-KXJ^;=2iZ=pJ2^%enOJv)`rCZ5Z@fUhRjBlKw-_Zw(L&gA@xC8r z|30B*{Jgw%P6f=%SCRLAZrd-l#Ki(DNhLW>SRGZPwt$Zl@Wi84C>KIwFWB$@Y&OxQN++g5; zulj>il7v&@RHSnAvn@CY(4@yQJhHo%#}V5u2@n`i{CuHvHW$}2Zwu9?(3vd}N_LEV z@(Lzeb$>TwPiW{HI;|9w#Hw;_#b4r9&d<1b)*i&|h;{}Oowx;aSVZPqwp&p9W&*t+ zrc*@o91Y;gEq#Zzx8ftA+N$)LIXgpGnul$`aB0F@)^5xj0X2H6%lgv}ZUtdXSi-o< zMw^CROu3FNAHJGdS$z3a$C8X#ra+=|4*qk065=OR3tZrXJs%lae&n__c;w9A)P~E$ zpnc~C_{MnH1pZ0HQH+W#IxWJ-@Wv8_WeLv(q;_}7zZC`WnHj7fVyLGwr5evk^D@ALJlR*@KZ^dZ+7V| z%?jU|Pq}0ywreVGEuc9)j~?A1B!to)AXy#z1wKG;?;ms&&yCCouV((;yLWZP+#qoo z8LeDKwzS-eY=v54`}QY@d6(CzUL56wCl>KF-WCw2r!qwA@t7GaSQ5kAzXxJP$@cOD+UT*GiqkLsiak0O@KaTGf zMe)j=1wiqkp$z#}ps=o{r08#fpblf#J$;Gn1CK`c+Xe3lc_FKy;DaNMObdk%EFiGD zN+YuJ9)C^6|An6vbohlS^)NDu7s6892q^xItL>lE8jsL0OI^ zA3(f*5kmC3)T>uL92_PfVJ0xS1^M|E*~-x=ZfdoWh^T}n-*0^T4YvLX~SO$BcGGAv#iwvZE4^rivm=_T@BB9%(-_GkAA$a?(_Dy1JoZ2&*m7i^V`q z5A&9blhXzbzq;=3bmA>MTdL94lcSvg#3-SkR#!`CYNof+%Xnl{TTtp-ws@eZgX0pg zU$9mk=&YqBp=4(EN9Fr_2TlTt3G{*(XMuPpwEfr9%KZ?Yh=vINABsKpubT#WQS#); z7G93|OrD&a+222s>z&{Rcn!rZVEhXTA~!w>#F<#nRjNZ4l27K@+r|aSk~Q*mNBtv<2YqMyUc5IMKhQDP68sbt}i7y8Jv5}hHVL*ngL@BqLUz2vXcdY zkL{}%cz*Qt6(Q@{oIQVjc|5VErUr%_6#Xi*ba8)`5YgMf9uz-YM$Z1c?CQi0fKr@7 z)Km!_0PK52xOW8oiOYRg*YEq7zYX3Rr293>EpfnucVeV{wX*Db9|8K7fJP6`uLDp+rmfr!zi~x#|)XGY& zVu>)=*Ijwr~fp<>@f@-b6@9*y~ zv*?S0v0%$U;SzJq-d?1zsJXcr&M!8{4eQr$;bs%?EZ}Bifu^#l0VVzUnL_urY}kzA z4~)>cFYKg{`Kk8;z2E==hH-3ibVyNcZQDoa?@ILm``N_7IG(Yfz*b`zHX^1L4f^8{n=DfCUXG3+spj z_wv;%VN|i!WA^TA6QYTksCPvoQ1%xJz6amr`dQ*;Ftf=M@~!Q`x}6WUM&uGKbO?%u zs2s)DhZrWw9P{^gRvB14+n3{R^Q*Cl?p%S4F!K2`loj}D;5kv#ap^8Qh4_271W@MA zU@i`dKrfV5%$iC1j#5y$;CcvKjF#y2WnOhCRzQuP3fkQffZS+vYvv9I^9*-(1UXH` zjpzC^#afto{k-Y^>6(jt)b5E1xT;Nfo3PKT9mbKkvbrQQNrSz;w+F2r{o+)|$^3Zi zxd7mP>60fO?V*6Nx7PdQ&WLMj9+KwG-tbb2vsH|O+CmW!NOnWrzEKoESFc`$vY2Rf zW^w*E9I<{ObRz}Cm!euYup*j)@LX5cf`x)gDyH;7L0>YC$hy5G<8Y7^9e-r#+}bn9 zOyeQB0m&+*4p&F5q1$bhk6bd6x=kAF@UFZE?gqwn&_ux2PD<7gC8O4Z%(;)><3ORD z#vz#KI@tr&$++t|C}bOJYyW}f&&hUYN|C#eG%DtQ9hfKxh2;kl43~g{h^p!oVlKL5 z9E88Wvm=}e2#5>+1{$WYs7T_wcAwQrU0rBqwYaUtCI3PqCg~&1{4SKVYru`@huFNC zZbMNdyp zFh5|EVG_TVmKF#G3cPvB)vJlmhl>s^X&QgGY8>(0j*1M=GI|x-X6Zo?rSpo=GjRb= zM@Qwu&my2dn!zJ)xfQFCYUJYKG26D^j&p;$PhFfS)s2{`BqenR!0s#U9=K7HC0 ztKjkzO)}fuTcy{oT^p}2k=zJ{n8+3A5n|0CtLvN?Jt~pFSpr#gdUiHiS8U_P8}#b^ zYs*9dgC&euNJwpPztDSCkZ!uVAcvcr;49Y8#DhLuviWQft$r*Psn}iYu~z58sUbGU zGL(t{&Y(vz5?NS2bVwl9cH=-L);l4@g2mDbo>B2srArKPOL>={%A+s&e8b0PLOPv+ z3h0*N|INp-2Nvl1wIx;w9^x1EGyD4b+Ow{`^#?fy2s~Pt?Yj!!%FJG8Xts(wONWm7 z_>%0R_jFYRpT@dkOO>6Or_(GLIGhO{Z#Gi0cM)g|8B1zAPru{;9;Gjy9^J?05b1?9 z{Nn1JEG;c@^3ooD=&m;pR}-PAJOvYh|9w`<3RpUW?%KN@S4Pqivvh3ui7`ma&{?Y+ zD{`~micqu(7Jf~kJGrwM=>y|zU17n%X#5uw8aRn0&F&r+;HBZ(S_1Bj4g%A9maS*C>8P{JoK(E*k@3ejEo4aUHig@DVBxCLW)|& z3if=ITjXs*16SSgzZwo;6GVo$C)aQ@%@}6>hh8OrsH~19i%g&^m_2q4Mq-~MA|eot zK`#RVV%G!cg|}m0-NbRiKM8|xr%PRH8 z)yL7%D^6L|LYRQnec-oNstYV_z@$BZOYmr4BsaW#iKJ#1G`a3aqvSGj&)Vp_c%AOrCr4=1{Eex24anX%|5Cv*$ zzk+qT(gzM?;pdG-Bql^@gcB1C517)(C`Mc44@hZ)UwB5avv=;^O_aEvsClo*H*APP zG`azW$|&T@dBMwya7kT?jm?ZljH9c!F5=(ex#-wkDvU0{te@@`{Z8tr8c zC_=U(bW7B&B=}^ytCq32Q>svS78VvF@fr89nxwDZnfVXFtNxamG$>h6*G68Txep#Z zSnn;HXjk)QdJ?YnxEmkLA5H%Jne*d<%Y?*iNWUI9RcB4X80gLu|lG8>d zK@crENIotV%a0FJla&)#V4FR(w`6KXD4<>Mj2a)l_l&v4L( zk#Q9_5TnfI&HGNxTp$xoO+&WRDrDs3Ec20+p@JC+s<^jiH8-2ZjN=Kes<`?789N-4 zpJX9PVfu$0MS=I}6ex2VdELg1c?smmN2(HV#_j>bpmAcjZfFL_JUA!_Eo}H@P*52x zVEPgc#S-yDBpOshXeqa>&rJ8PjfiVF6GA5Q2L5KE@7zm**tsUFrRC-G+S*vMHn7cw zFy(6H>ri=)>&0HYNIG?v-rg6{47JTI$jONc3{o4=i7izdBRU>P%v@5PZWR@&*t8=R zfaHX4qQ+qy`P4PYpT%9D5W7+9kX&+4`RU|hPH>H@R;)nthE4`-CFg*)uINkTCP@_d zlGrUNB{DIs!QmE?vX>bo7#UG_xyOfU<`C1UEogfjLN+lo)1Es*q#K;0L-HV`DjoQZ zgav2~{2V4oGm|bTEX3mO&$T-2>3KaauFB|MyN|Jc=7kGvP~bZ|ZAb1`g0BOGLd^6< zjStq^CZ;VjL36!N6O)13^X!Dj+Mi8U>PvpT5UD`-)r4+msoRk4HXZ(l=Em%WYC}p& z>e-{UI{G5qEUc^!G1zC<=YRPB=-%1>p}JZZQI~W5)@FgJDga&0xv||-f3h#q4$-Lp zR0Oa%lanQA7U}3Xjea+q;kL{ca0XYmdJ+p)3Tg0O@;|pyt#!2Zm5H03#6dadU77@FN{ znMY28DFKzCgTt5bM{9R#srdHQA&tec+Lriy2IB)_Y6h~*6aVk%!6=8>B#{cf*6;hf z*oQw+BB1Aw?x#UdX9C>#Jg2O+ot&JIs6jpXpYi6lq!2dQxht*Jm(&mZ&*B^0o{5ke{H|3my+9z^CT}1~>tUZJa%jwNLTd^-MUcOw30U#*B z6O8Sn=Gjh7DCh9b*-ub>9Tcw+yv@np-X7(bn}LIa13IeUK8C6YU-~qH-CKU>7mAgf zn;>sDP?Nx|fp_O!YNjmWPs>ItF*)(pU0?q&GD)z=XUQ@6i4CLVsSSXI3%FSWLmZJX5RT{bwl%S{4JYZT!nfG~bC#spDbf z>~=-2%%%OBeK8c))@=9OE?;eev$~Y;?>wnY_V+_fH1d;;oMzkUTS|KkKxA5-0C`6) z;h3=iZI+o-e^Ypy>q`8QRTmx0jQ)4N-hnSLS;{t=kw!f=r^7-2-p#G-;F64IR4vue zhrurH9|FJUhh7H0r8^VwO;V)Kc$)w<;jzkR8|>i<&4ZuR@Xd23xM;@jvC0uL{1K3RMI^ysZUG(&rk}!X(@A#pPgiIFwIAn75CWb-z<#pAuR*(4;tJXfk*Nk2Q$w< z?V;q*&?Uy{;V7MPvUd&LOnpNgwp-=aF!bN zDvUMT;=`@|*ECZj{A$+^t>GAfQzEpH-o06RGP_9)Ox@1kyQlfYZkqGBDPQJIC(5KD z885|LoWZ$z=?dn&4W4QUNXu>A}vs}fN_YO(jG+-Z$$xHvnOkBoxB>Hjk0$(-M20B- zKK9qNZrOiu8I7C~wIL?wYN(VXRk>o~HA5c@{R-qHY`unr9Q_KE-oztPCKY8AYdpacyK3=oar z(2$mqA$xZN+#)gJzZe;+%faE{IRK-atNmZUUaa{7B@GrI+frXN0mz*>b7sh;N#MWN zD)sidXP6s?ur$$|cgY%O=Ki4n1Zf~kjFKc{?cnJd43Gk{F!J2Fcd$wN3pqibgl*8k z$fyi}4gCc$m%c}nV8ugarQsA-c&xP;?iibJ?@fk zc`0NjkZ4eGM?uOO3;`-2L%=pb%fC~F8uZDDk%qLP-d<%u@OM-~RBkZs%Ju89+(ctz z3-8yMGZc7$%@-6akSI`K;B5d|UP)K4q8}V}o$aARuun##HTu`Uo84WxB_)6QJGMY* z75!^}d>*$zP}v!-c#>`D*tEUa_Sco2eU%}e2=UE(Q(H1vDjR|`F%u6f8Uaa(77U*F zj!~+Px9YNUXha6DHARlp`8+ymvi4dlXSdd!q)c>34z%U0{cf|`tpnyDGyo!dt=0kN ze&6~Dcwp~dw0&IQ=3rwBSePq)?EDYZRV{SSzAt^?if-D<*8dtxlb|YrKs3xWqG8KL za6d-lQ1M214k3;V$a;uu-dvCN85D#=H0+V$;^N@Rf%rg@MNMk~d7ajoGF!RI)4%0B zPV?~apy2}*jvo>jF!$ppPvEez>zV*@OMf{;OiUS=9r$;l&qCKni@-(6T!LWfhR?n~ zRX2-XA18!w@LCGms@k7|Eh$C%naF-NbElz6D;$VVOLO=3u0-driv&BE2y+4@UBjQa zlg8obZcf1KF>p|@rQO|4A-d5U)zgS3{%@2GRL;D*w#~D>DB}@z#p2vg({;CnMYh6s z?mT5rt{D6~8C(CgE~&d!WshgQe`RaYQox8aT0R_-hmMA~I$oV6p9coiJ>JQz+s%wT zvQ%=hpd3Ur&^g$eegM@eN*5H=2)MB)+(_2(Mr@`q$D{O3RbX&-XIz8^wV7h+Y@H=WKgA1CQ6UKB4+nk zCYNmKa5%7Kz<2~B-Z%P73-H1Q&>hG7>f%vBKz4BpwAOZa&khfNeqptEHz9I4UFaX7 zw@1SF3;^fWfAx1DL^MxLAx100d+i zevsVFmyhMAOh|B06W(0p@!D#e$kQVDI&t}`P9)i?n|M%%!B?g09JL%)wIMe$-UMcY-dc zKJ@y!`$p(x`dq+G$VCTmL&e#CBkig%G@}0=nWOu${|d()AU{ymP24v8Sf=vO%f*r5 z*x&D9nRnCCSvi$tW@hH(BvJbTs)v3in(s?(4+&Ov);YpR&pGsI86BVj`!LamI+Z|F zN|k{JYcs{Gr$UxLdb;B?U1}WJJhp*85;WfH{k>`e4g_kZRMKWm&F+^kV?D0lMMeAW zi!vM(Zx*S&pP+^YJ)%QFM96X`Sj^bax<5?#lK4{VV-pytrPMSryrKYzi} z((o+by;>M3Fq1%anqcAP~}s{dB#5|l(ZvJayab5n}$juI3l$^ zhd)V%A3bx&z{Vns$=uly1^M}@!8+S7OpMow`ga*kHJO(-5y2Fock2oC7oe!*;^I^5F-9YM^(n>D&XjL^Ki+u?GZ#8W}V{qxz38`6RF=muUYV zUosg15dyEx^p|LPywd^Qqr%+W3dlw$%r&cF)c?=b;o8XXNgR*%0~4RHH3*Fk^MiM9 zploG-@pyXbxb%i=2~Q=xc$#Sue(PLkS;ADX|5l>tl1%b~0i_Cw{;H~n6fcL+h7AK5 zlKkf7x4{jz!cT?`iPMCFAAsXsF5>4v*A{e!bWLDo!Jj?=3!*OpP0R*wg?h}X%nE8{ zn`!v|Vw1lQ6x1xT5}|Sz54veJ;YwwZ7#{};5cVKZbceQ3pkBCuAb}4?j2)Rf zJt@gjQrJEQq zF`PL_bm?%Lof`dwBf$7vT$>85WTwMlDs!g5485;r(mNo*c`iV4)!Ds!Nkgh+(CXkB{Aa5x6U zansN-$qgiFUf79-(7XGq48PN5Q#`5BHUbJ3)+ucfdWUzQJDJ@2R zW+}dD&%X&5pwD3paC*~bIylaZ4OyI5(;1-4$(l+^EnsfYs54iY$+7*(y#tTnW1K2{ zt+^&j7cQ;V7}dBdSDf741MzB^DSE{NnK{9K!&ECF>Wv`*jnZfO8z=&fI8I^|ypm>M zXvjuVIOd;x<^I!d*zMRKsVA;t^8;1kMPF|~2*W8tsC|%4c6=*KuD1KT+LUjr=#W`q z2h&V00lqRAlG!ro?noJ+ysL_ithFWR8slF)1kO=~&k;)0{}+g!OdtYV0VkpgNKW3w zAKlY)d5OSOBb6kzaI9G2tR(nz@(I6V%=p=5E6~T1Rddcy`DoSnNxkK-bE5uET;uWO z2K3~}%BXbS-LAK}h%x!<)oAYais0>g6kVHdf_yz3^P}rYGT6)6U!G}!==(;s@^1e& zw6Jt^cFtjEwU(qY1sX`=1tG}2cgT2g*3IPP_p^Wg#b)}+Jvkf$F#?qwbmOVqV-Qmz zct$JgXS%1kW>{6M`5W3!jf$|-cbv%0%l|e*t5`!-e*75IZbc(ME-6vC?EmQK$Ar?l zYTYYINnZyB1n}0a7>Uma3Mji_Kg-!pN0UflT;Vpz`+zp=`+zgZ@QYh46=S@r2S7D4Mm%@@d?kaaGvS9=BR1B#_UFZAnF zqlfT{3=a<@uj)%Aph3~!45t(b84mNC8uS;QR3C*w@Xnn(sL(SFP|KRhXJk8Iv0+xe z5i}8nPh;2!R@x#0iVnJ`PEF6MKi#oP@7ZLe0U|tT$)Yj3z-tBzWUOe|*w`3M4m=Au zpm?ncUI}0%1#~jIF#7{a)zWj2RE>+wWO~?_vgLn12Xt_VKM;;|#o|FLBehG%!s!SR zA51z-L&i`q7M1wBY|{olSV;*}K$rfo+WbF=4i?ttYS57t}0 z_>Wz8GcDa(njTw5xsh3pz4-QfoXSKR49@;+a|q;^${U^hpiO@fM*H(s3xH*2{Yc*B z;eP4wz6+Tj>H@l%jajv@f6d=epQp)QWsT!c090<--fB~D5OoKMMi${Nb8N_2|38;( z+r+3&2QAKY0KZEX23mFX4^2(OZ%wt@4mW&uiX#Tyc=L489rPR>w_M=J?M`Q-h=?DWPIL9?SHoL97`ArJrL2U&7|}o*rve7{xeNu|NNU)1y5-A}*&m*2Mi-!JdB-JkBTu614K zb)NgNAN#%^M*>Qlc!rGU>U+&})q^Y^N{j!s>RqU>^o}}ut zf|6C4N#UO-7P*>$GyJ+(`VIT}pW-a92!5KMBxaZn*6Am_P7L=KlS(vg%H0dAJ0ay# zQW_1aI3Nl>){zgVgdgi8M$A34Cx;AzpW_-`rEouxF4{LTauDj`=;#*7WL8u7>UM&{ z1Mr;{rgJh*-ILWc;@wBJFSd?szL66D`dm;Q706A(iHi*lh8MG(3Uk|RUwDmR3qHaSwVwzkwn+z#n_MYLwz&$yvpX-Ok6&Nbxj;Ktq}!0Q~^*ugM579UY9OQ z4oq*YpR^Hrj!koph_b=`R`s1g?SEX#4>C(V@i&x7PYki4pcV|(Nrp7#RSy$qus`pE zjg@Qg zDi6laQtbEuYUoIpu-e)_g`T+0YArjl@BCz+Bw&JKT5s^lq`7@7@$?^Yy*Hq|fd|w0 zf(Dd0a4kI&O_!#v$Zm(A2YgqXDf+*UAyM#est3XR&zmy(;UnoFGAFcG{Ny5EeGfMPFaO1KouF8_tW@OD`0&6E9=Xkx3PO?M$K8UDe%lN!~oDEvS5b zv1XRVE}PO54OhNCLv3%5K@-8sqTLlclIy@RwP(5+48X4Z#~s<)x+5fnkA_R|kxHq_0kKFwKTA z7H40!uk+(ZPA0W<)hC^f?~5;O=NdA4ac}F~i!9jVXl(nX5JHAx3>r^|!Y|-*_rp)L z5zjg%(olNi#wOskA&U}$;(yWYMosVTXa@Z}*k2m~1{u;^(1%~(b8SD4*09by8*IkC zQNlA!BW#OR_FEmFUZ%~j=G>ab9zW7eJv?#|y>t9F7&kyask?|ia58=bC9nLFGohjX zqk1^!i7Zv1an(s1Jirns@XD(WjHUrMU#l`QGGb#rTq(TM=#4>oUtb^GN7#12lp;K4 z?%b28P4`a1l?!|T2jFP^q9E8Sr6I{d{%s;m4{PkKfxU2!PBZKOyiv|;{fNAgY6Z?g zdBSKV$s19&s~4Ck8d-jiy1F0zJIpUsSM^n|1Le)*_cD8_&5hUoxy;Xi}aq4$Mf|n=F@cXl+=wg}IE& zIZM~@3|BvgGfwA*oM*c4KRa_){wz+BOW_H9%Puv2)m+4J};0XA1?oDX^_m_!YFhwUFc$ol* zqC|XA=}2a*+_@#k`OypthRs zbXp=#V!AZ!34Ys24-5@Q2+DiLtG*};g>EE*^Di8H&ipTFYHHX83fXs ztTX`^VSvEGQqf$`2{T?D^t#F-K*Kwm*}bzp;%WV@j=GMp6UaqEn4;pj3fF~SKtamR z&W;#PXN10>yP+`Kv9tM{3KK-Yh)9MtjduI-rS{=Z{CZ#CG{n^Ec1LeE)lR{I5{xyelIVOB@N!mq^gVVSk&?A0aGjVW8X^8@5j3=>YfOBh7Ow6UW zAx=WUiOp~|dh*cQLJmWC6=X85-$HMPMu8vcqFXiSX1oDDkR-I}hQ`1aRj{JyeX-)~ zVrrRxZeqe_YwPoL<}!JCd-tv|=w3_RJ0cSXASr%|(A0gwCSM^X_uab}WmJxdX4P>f zbxsV8=h;EFrK=^F8}1$wHsN9w7k6W|&Zk%uP)8~z;jiW=9ICuJ8h&p_EXrpKD}^rn zi1To#vPf}x7f$Mjs7vui7d~Hh`fIn4M4l-Ed<_f?uoDFq6QT~Z>Jm}`D%0h1Dl5-r zD^k{c8!1M(r&5mc)r~7w=2O&@@*VY6Wq;kLnZNIoh~-n~IsWbfyQ&Lc9YPHgnS#5p zfwN-&2ZwdNb%*pg!*jxu>FOW*aS;Yie!%7)r(0O~C6au+}d%?w`G=U)H`p0{#$C9Dd+mRG_M)M9d`ynAA@mKeb=w>*Z zOYi8|+uZb$E%%&66Di~A+V)_)%NOu26Xn+1x7T6Stg_L9?;Xc11goe)A>-@;Ee4s= z6DZ0dQURf}Lx3~zsV8DBqG(qR{m@uQ*r0OEa$wXtr{3O>v|KTfWox$rv-aHqITwYD z>O%ri%QG`FS~tL!-|eM`#cTkw0`CaiWi>y!uK*q7(VKi-6@;K=6IgED&~CoGn$m5( zr6swTw_qeRSFH5=rdks+3rU{0&lNWqiWKx55NVs)2AO{pnb_yYhC88Zzu((ih1v`q z*H2a3)8kU6~J=%7q#4@i%qV3h4p@wV$wG;0}T^L__2cE}AO4ish&eJ*-S0wTk zxQ8$0ST!0DU8v2%wm>)dDs7L^S^<3%Iet(IVw(PAaz2S+;Ul^Q)Grl}dsGFt`3@RQ zzY*P;qNmrfu$?~=9Gcq-SqpKK5KI~L{w7EBkE`MNIyJcv!nH!-E}{|6`FuC6F`;CE zPvMg39hLLOPXjJC?Mtz2Qcn18G#U;1_ZPvW8Q3TB3f+Lb2#f{$JXdU%pU*Y1OAo}` znM+@dT%zG8!+PdIOh@X8ulkPsxH}toW6sbV8mzDF-woCaT{f=SvppX;_WgS88?CZf zbK_RJslRmC#!9~%^MWP$`g0*cHtp&|Y*OwFB1^OUiT`ly1~INVb8_n>+K^0V^jtD%-_d8v9L6pwS&KFUu8 zEbrDm&A0QXmv_IGsJJef<#0G}Objg&Wwq&K-R}OPGU}P2*C!>{p`_=;>JJXi<-{NC zcG_;o@CccAf%sp<|F!0CxVryr*qG-ElWq0-XM5FdLLstz4;k}7F#4U1~V0>RIoj|&b}Zr^=_RBm6x z4uLZ?rYK7^e|irCu=;9|cr9Iqbo5_}v#{bnV?%9AkvrEyTCd+A35tjiJe)?G|HhpO z7b4cYWF>w=TzoGpZ^xEzKiSW>eIFD3ICOeYY30|{so%yw>&%PE3V#H>s0|Jypl0q; zsd1sRHZC_73P(@gC0Bg1>nvZG;zM@jAvLY2893A~_G-Zx7wf(C+LrW)3et|JPlGp7 zsiU7i!=h|~x_~2hQziFYW^KuOiYjrC>dCmzdmejLm#UU) zjy6c1u;2}dVr8;1ownW8e-%P5@Cd%LsI*?4BQPX*)A+q%Fbz8{(^G{yHd)4Y3_Au}%N`#0ZLE*6;ti7TZN!RC(_x`E zHdCu6e|{5*Ce;5|Uzedj8Lbb$17&40Z+6JPK8`w|9Im`hTY=TIkP4OyQuM-L`DM%A z;QcHoYcJ~erDX#e1Lin?Cg^3j3W|58(Zcapc-J>6W^L#4R?|HrnZ8$5w@kcmKk-+f zcpDub7X!qCQqLFA8vQzi_%bhDvcutk{R?etl**l`zH(UyoEX?Gxo6Gl3IzWGtHtlX z{?A)N9rg(KSXcdlEsZ#XQ2YhHy5M)~)-7xE#FHoQgUSo~@{Hre;3|uBkQGa}SDx;D z4t+d+pi8BdQuD8e(5jIrVMX>{gLhP#{T|-v3#U#&=+T0sBpjWh%apI38MNO{=5ZrMz&brRTM)Jf*j9Lu&~7X`CWb?qAHXmn5x zfQv4kfs@5FH}5(}8f1ayCX?GnFjt{_&JfjH8oQ*ss)k@_u=9-CA6a2rIp*M%C+l3X zO2?t^UTO*A`hu|^0=v%H;IM^19Y?8LWF_(u0}Xuk?5R7sXb~@O3Y`h9`*`Um*}Sj%F= zok(nJ!nm4Ju{p9IrYESH{@IS<;(ta@i*-_XUzg$5}u(TDOpoQ zb67ld3r8Xf5aCp+e>pNIysAE(>DE=vE^%Tgtz7vIfv%j5xjTvt*+XMOLRceH_W1a0 zS`7&ejl#eok3c4P6G6&kDC(<#0EQCgl8LlLT24-6g+@l_uzcibPwdSe#fGwEao%I= z)&+Bu-l9%P8|t2+f*sIR__z_U(wn10+nCXgnpmL0@0#>g-Y~ zo~Fp^eM{TU%M0;@V~T~M;Q4s})LYOv&0VnSJ#t^4UORA#Y)Yr^8-BPfHGX2>GK=(y zM_px4>=cmAmx~kH<*Ft`wZwa0Tny6;t`oq{^XuJ2l-rOQ1FvUPp$rw#ywAq0t$DxO zWNB@1usGXNQSrAMHr*G?B9X{;e3$ZgtxPv9@`oNPRqi$TX`>qKN*9dlM^qaq_(K(y zmB_zMa=XWmF%VA>6*wUywAIb*3cxPBttukXrrFoLpRr0fVI5$XQk%u}I*Zp7qX-CJ zyk8-ZJ`S5r@e0p~1ft7r>>Y?8aVxcKVn6n_04o-=Teg?D#)kbo6&DB8OW(fTQ{)Jf zx+W^tjc=V4`A7(h;PfuqR?Oj!!>o(#iZ!j@o`GdsCiq)MzJo{`=?Ebvf;G zThVrac59R5-G|;qRJc>p>jxo@qEcr`q^;Z6JW{>Vr5R~Mjm^zYKN}{|k@I!JI0>}O zhDNQts!GwRfJx&!z7CXX+n61`GNCaxA&WEGn7RKfzFQHJd zEn>h@b-TG-HD$N5eujOBfjIk2((-BW@q0rI-ZS1AG25dJl=#wb=X z!{WSy=Yo2&z0hBl-27+q-13Kmvk0Ufo!Y?{P_iMfVcXX)Y;uKciBC2vZnr2W3 zC93HH)cCzi@#Or=$3~9VhSh3oOR-7qV2CtEGieiGOp^RxXM-7O4VqPsn2i%&d|pn6 z_PNjb%Ll&keYCDzyib`e&6NR`_yf{DKI8pdz4Q5%#aLbdkOS}DP2OAm4iM&nRwL9^ z6Bv7t_*`f)W;<77!wR%B0*$T1S6Mz=xelKRjpg<6F{RRM{FHa_^m_#a$0#mvS= z3RJ-nhb&k=uJ%Fq8T-=8o>VD{ba`{!rAVpi8fHLSdymK?Xr-|;#r^Q9@VfRvAN|Ps z+x6goB&P zLK5bUIUf$H=;fuRAYSVfM^sKR+~o@g|>g>~xrO z3im}=X3vc2Co`W^;g&U@Ifm_6Yho}Ji7S&6oi|LkZiTk?`GO?&ie<$8oca zt{y?q^Ow*O?RFn$bw>^jq3N@4x!$I<1Ufr88DWqNP)<+JH?7I9_pyPAD2H<%8FC&6 zSo%i6B9Aq1jXOgF65fLhiQT*1T2hEy82C=HZ6n(K zX5c)$V3k+#x)J<5K+mi&Pyxg&rnR5#YX!KNQcH&09yDqsIM{25i*u5g?8gFvyZG6@ z;$6 zSiapBvbPfJV=x^CjfPQevP&hH$n?8{mPbOqfrrNkvTrvH-+icDP3f)hkyTMCg<~F{ z1zHm$RT8?zq)q;QX;MylbVF(br4;t3_s?oFm_9hYv7077Ow4=c#DECM#(zi}ru=CA zl?d*5+nL)uM?Rcto*rJwVR4%~WeN6`^HD5*vQ8?dJUNFKbP)s&ju+g)uEw?(m?8I8 zOT*zdWtr{uYtSX(k~A(XM^qwz*4s!4 zvj6Q9sKyTG*V>~XOw65`+iGEvz+!ZUnLku{*%cBnKJYpdY+a$1*_oBU+ zZ3GDisulbKBA!scAmS7Wz0A8agt&i|LK-bDJOFew41W zmU-(G88$=|2Du{QZ%NJBqBCR3U_8MMm{B^gZUFuGL`8?;guT)4+E;xTcwzvm5`-fc zI5qML3ZBKz*z4;K0+Mj9A&3dO4p?JWqB90CqtTqRNa4-hEU3CyLm8#d`1IycC#7)1 zvK1>b<#Mj81!^H1Fgx?&1hzRKrq{((BQLbdGU(asGy#@&^AttTTfa>~j&qeT>8){t zyOhu9hILYGt1P827z-|1wE2|>5Nt@uVAA@JV`JZO#3fXG`T7-`MQnH8Wd+osJ1!om z8_crMvg3E$rzR^~@A8hOBytH-0PxsHO{D94rwYK=0f{eAX%mKd9ZoN%Q|Zy1oSZvH z6KyVM%H8qW5bn{-BD3po@F{tLj44d&9(;wv+e|oAJ&MJXG3Nh6*Ca1DCr3%7>fa3? zsZbtNBM_Ei_fZq#!ST@Ms*ErlBlEy8P!Z8^G7n}6<;9sqKK7fM1Q9q277) zo#V2@XhL-ZAH!hV8oVFXR@aPtN@MpAW!JaH8RqeG2+){A>KEIRbTGw6?pH?!Ev?oe zU#*{C9F2|dp>BsE*f?qJCQb|;IkuzsA!32Y+fijBl@xY?Tlr~C4kgstfw_qnkq?1rGbEDi{@8&YX3oqKjAY46 zc3BamAm8CPBfp>^CME0IwKX!t5ly6ugrdzL(C&#Qu+xc)ATkg>gxnmX*;nlbIJ%Aw zj^_K90hn|RTcn3uri1kcFhOS#X(er34^+_VY;yJlP&_!^y#qpQCQ65$4x!;2<`z&# zKWMITdHu)R^U00$I&5+EZOS|yUyWW!Q3s`_8Zz&ToSTT-VRG8$@{YJg%C1{HJeC$W zEk~nxCOf-~lvKfzZf8lY>b2|74h^qxnJhg^6VdQ>J@SO9>{!QxbOxjufW(0eptT#- z5==Eued+pYeJ}4PEy66;Q0GohGz;Qa?RJ1J4dTCeU89>>92pn42cuRNA81=o-hT6v zc%Kv76?D^LM~c<%IEYub5CjkMKfJn&^e%U9PE@@MB!bN!VR&d~5OgNwpO{;41$vk; zoeyy9Cf-}3rltmHO`*I_K61s>#^zq=?hiAJyd}A32Uuw9ayV*z)H{n2L_@|XeH4N$V9H`5!2mH z3b}Cy56(TA@F%*E>>xSrmcRk#q#y+KZ{`*`5UL7AyLLXkUUmF<6TtlzE2}2wqENDV zdhwbx{!Ql-ga3GA)n5zWTA;73Lw5s$g0Kuv)upBz39(5@goeDEA#exX6KvmO#}_Xf zlZ(*3k~8qwCNs9!=Z{0nupu%x?sN>zf26P;mMf=94XF7V9ZzbySbCLZ*weGq(rWD# z;@=opG76~C%6#{Ft^ZgBt*wIUPD^kO)0r!_S2|V7;SDikc4T~V*@=7b-n`t$immyC zOy3_1+@*t?!AcO|m{K_ep4bSp00SR&c6OFL@z_+8%PTe6bnN%dKOprvN_#rGdib-PeEkA42^ zXYYwh;~V(oip$$^<)07fiOJ_V3#c2VaZDrLB?RKd4};wGInaCN;>ANiL+p8H_cDE< zgCS-l0!JF%03(Ct2%m#0R0`seUUG?;4-t|FTQ?o8n_-=!pZPlJK zqH4x2J4G5khtdHBqfr5#`f(wNO>33n#jfWc!i)9_9(00F50CPPj7dJQjq!OVA zzrHw&f)(eGu1?d^z3mN)ru$QkoCXHE3*8w{0^U_+Ui6P7D?v|z_G7agG$B|k}B@`P<5V@do9 z0&0i>YVav;ls%Ogn#+62$8px|0xI@JFx_#7F7WEkqDPchrY6tkT9x2ohr&aRl^!_v zB#VA#t#vSs_v7oXrE2EVqOUb8`!{Ltstox$g_xg(=BgGZ-0LouG?xx&oxka60rgtP z!r7h%)s0Rw+DN2|c?GWn_Ol(+mt7{!%5;i2(YE0KaAAgnOLOC-&SV!F-lBY<`ze>; z`<|K&NIallo%8P5ya(n7d<+82rH|SP_>=#BA@eN7)T8GzouaTfQOK(LS3UU>eEPFJ zV?T4X$fKBGr;-VTl7yo}$CRn2$NlKWXA&NaPeyUCy|*XPKZ6Gc{}M zx%}AXtavVl!Tj7fp(xfpF^Tzh*NFpb|0)UQCaL5U;uo^7+ip?hyHkPu{%mO4!B~<= zB%IA4x6XHGVDRZCF^=kYH`LqoGVULy_}arWU6 z*A9Lig}w;3MjQli^VGEWWIqUAq+007j#?fwMF{gJMhSxxoISfL@LSms8L~%$x*Pt4 zlpJ)RO(+ad^($vHv$C#?dN27;Yi72iyB(v}jz8weA9woJ;OTho1$jsfI!8@^1hx^! zJ?xi(fq{g#Ri^dst$w}KfQ4i-4zBuRz@eyfb3pl}OTj5wh*;s)Y=8KW5EO_+ zzq~Q|<8qjSP6JA8#1guSoQjYCazDVgfVyL*FPD&p!pGb{?x_RCW^r!vR43%!fZ4Wf zOBi?XJ!K~U)~;E840PZEbtMckuB?32)O5Uzimw2`q;e=9PTj6 zBKQKJfSvgA1?eg6f`*)iRH{2(x=%RymU%k5WE|}5=VW>xoCAK2iHSih z`ia@L{zK`IwRZ?wTUnv<>4E+4p0>_Ejb%hpO*BLY)1KBy2Div7BK1r9 z?_CoMaV*sT<>?9GVf@`hN9W&4sx26IRgbO$jz=t`PNE}H{Joj4SAcGK{^7b^7LA*> zDcBO!&YJTv9WtM|&S$-@FqcNOd?pxlfeRIACC-_%YtXS5^)#R+q3PLVyPm*OX{i5U z|3D4(1}_5+VxT_l$wu42ZmYZ`q)VPWxf!)@&5aK?_CUa1N&D6J*aHzx5aL}?s}Fvf zz{9AltOSu1yH*+MKlnGswb7x1=*^+CeOov!E>V8otAiJeR23GIV?;^J>qj?e2Np@^ z_@AJo^?$dwHxS7R{#A$2cSZIx`t8!8&`wLQUQJ}5p^J+7f~!}5gIX$s53=XkoSerZ zBOMOvfE(aDv%MUH$Q;r2M~yXBwc=%#C%5%erZ3hLHixAW684Dh$3ExeG5eiI*XDa| zQ~izdU;T~mz)2t)>3MWyt|EU7v~4ya@4a>CiNDY7aAV{*p!wOn)*IX&&WWNaS;k);ZLn1B)MsUP zxTl_-kHtmJqbE+EfvfV4JT8j++aWjvCnx5ki~rDI(`kU87{Lk{(WW)6Ao=Tum`!~M zgvdyoLqC7RuqxVA=nsMTnEox^%)K#I^gV6!n*|ASajvXWX@nHE${NLQ?=zI~TAk`An|q&f`6jC)X@~s8@3F?Bg@t8uQlw(nYbT5jc7y zJwjB`P`}YLLAt`gKxF!NPZPfjY}WZ&)g<5Y$f>v^g|zwYiUxpHUK&7{)lUlV`eO1H3v6| za%TZyC#W1rKpk9R{GX0f@l?g>a<^pcxZ zNuv6B$7y=vD$^i)#?N(D>86a+r@yD>?8-!$2h>txLs2Q9zF&;S7hiWZbVIw?awo*Z zNGIBD&C`P(%$YSy1NKR+oY(s>;G@0Bd1IS@c6&9&@RppoVZ{)~^d}HVuHWEC7;S>% z4R+9RsI#Gr-EIXPgP7P_OrYJDPP7lbCI07A%)7fuU7Fq1|79_tLHZtKaR8 z+xIsSQI%I$!86;*iL+k44{robg6mD3jhVcEqRA7m=7?fK5uKSX=Z>m#MAxP1Zx6ub z_B~_9lPRr4hX>P1DMbgeQ3v-Ms-=)9Vn(Da&a%M1gZiA zwVyLj2O{B0zjyhj*oWStBc)=YF8H*a~PUG|YKXq)w`SB21Z*ytGcowO~ zu;4$QkmCGJ-#WZYs5nJp`-(ysHwcs`b4VgXX3d(%4HU(rIF5381!wC=NpUu;S5?^b`#fezJu*iQ z7mB_LQnT;X+bOWkoC&SI2M$skFAN65H&9P6OedKb+1F8muR);N2ln_%!>#GuZ3AI~ zHbQImD-`ei81g*Vblp0Vo(a01XI^;&e3x2+blt^m|2@|fn%oyPn=W^5<$qBwsmtph zA?3VLd)LHa)RIQi2aY*;Q{tkOyf~Z7L2@|^{JehZf3R!DAxPaIVtN|*`GRS-Q$I5& z=QP#X!C^5U-PRuSjPTskPohF<8(AU)TM-zE{LA*whZj0Ac>Y5|t2{^R9~ychwoqX4 zR|~>t{W?iBH_l_(F*BLve{3@X>)T!)b!FDl&9+|tF9Y2IKa8)&cEp31mw!g;1GFSOV9!N!kVy^p?@-n3UJVq-O zyd)vP0j$a%Zn*Oj=h;7Z&20Lk%i+g?s|I~5aaUX1pe2Jr335;@YR;lmipJCd-w}U3`@|wr-RuR86{;&QkuAi`PXQ2Dqa`YF~ z+}DubL*zmuI{?K6=9fG;n!{uc>EaDIh<6-PG;G-M^o*I-a4Te`>IRTwB0TKQ{f8pi znqF)>`)|^J+ll#9ti-i2mcX(KAHmC4uRh_mqyG0_SdpeN`kLz7ypp7>Ky zKyqSii5$^a1FXVAtFw%Mllg%$$3OS#hlodI9OlxA$2BxcI7kT%>=|4HBSlau1$k7< zx6xN=MUPLKow!B0PKcV=e_n@o+J8^CZmZ`lH#Twpc}F(PqU6R& zx^b%t3ZU2vf*@&9~yj^uq9d@A#=H7YrCKD{xvWTq%Ly-`Nzgz?CxKi`@K@>vDc z6KTu3%nPXF5BHCG@c|mm1r&AC2|mhK^r$vAWY+XOkOqR{QD*-|u4)hn%Hl@eRREx& zwbk+DDVmXmv+FENZd~Bk$TU9)7z_#|XHVl$SpwPJrb)|wdEhYX7i#NU#fp!1T-Il> z$I69d;^_M8Mw!?*2ui$S}!Z!r@*RoVBI3DfH)buPkUq6u(FvMwI$m#j1pGa z&(4jjNn1Fh`%G}!rx}e$e(&(ds1f#z^`#5OsqFN|vWe&?XdB2-k6_118k zn}7x?Y?FJm9b;%^Y^XcGSdp4&O<#-uRgL6|1Lbc7F2BxjKv`v>t7iReWFGV*`uTMZ`C_a^<|zc; zS)%*h?p_L!wv*EUu+LqYq}bSb!ouCaJJI@Wpwl3nKEH4rvF!+~zuDWXxpe6WaO;jm zMF%Y6lbRrZ{u{)4wGZVwdQ^Kso-DI0DX?R}p*#%9J0i}3cd!9wVyg$<$*3yC5%IU1 z61>blgj+2TC@T^;zA%cXgw1|W;<;Y zVE~HGWGW-T9wOQkZle$dhlhrOrBhPLK>zP=>qK$B5^3juoBM84&3!1=TuzUpAd!ot zEM2Ocqt+XJ>{vYJm~Yntm4ZYOMMW?uMBp9)s@~JH2})3|>Cl5B8WE(0@WUf6Q~bz$ zLBW+OzR4giN1y%Haobx7>w1aXVPE~@tw?jd^|qC6c)3%HzvE6$4kh(8jycTp^7q%+ zs&!y=prOIQ&dk$saVagX#Guh5H@)Gd16N?mzZVnOQ`f@Sn;o=^*bw)QdHJx$J)A2w zm#6`!xc2F5i^$7@v`Jqch*Q{YH-x*!nW;5Uc)S`KGBhzmf9;C3DPmWyQqwUFH#HF{ z8-eKHG#|s6$qg^`K2IBR7X{&yQ;Z>R6JN0h0~iF;0W;~u7X`{fL(s^i9n5RgL@iA^ zu}M|KcMT~)ZuayZMx0^_rpoqy09r*J3^)sbTp&kY@v?Eyc37wh6~+4v+LVY`_fBqunZ2!8G?YyVQy;|Jqk_&v4Ni z|EH&4Fyz<^(2arv@*9^|aj~(Wdn@+6vBVs1^o0>5zqLDa^CH=UxdGU8fGN>D+9tLO zur~b_a*YUgd!_aE?H9I}BROvrI|HVUESHnJG#9ywT5zKJeg%F+1+E3dJ-YgM**n}- zK8~_$RF7ekOFk|3Ts7{`<05`mLa@qoYvAhDZ+L6)h62Asz76Z6KQSyQEe-bIU+Js0 z$L68=JhqW7%4PjiKdS<}o4T3aFTfr88sQa(&H+OYQP^RK)8P3P+;&>r`e%hVU_h-H zAD?cq-16nBk(f!8ITsEC*jg$N0`2072l)HDE1yHaW#ZcO^+yXQ!~S|le{D+AItK83 zV*oRT4-EO1XkZ)(+Mmh_3J>nyT_z>vgw5|$Rk#M6^lRs8bAElzyo|)J%NU5}JJf&v z@+JO8rRNsX$zx*AM`ivzutJ7qR+HY+BYLTo&W9&ijpe*yoU_Vl*<$|ZTP}Xu`rJZ6 zdgD@o9n4S~Fa4dOhS#6(+G2`uIE}YsPuCJ*bLl6h(c!mv|9>5Q_MgO3KmO}t{&{-# zFY9oXTl(iaRB(2|=xafGgrI7+3cOo?y@-Uc|36*?IJAwPfiWwl+qV0GkaeAZl)Z(v z@WUbASm9qV>sTCMmfYFf4-LV{dETA-W7^u-aCRCH4Schx|K&f_4(5QBO6);e=X!8$ zRr7V~rZJU+^fb&W#9tNszxb=6Q|7{3*Nw@kM}h$wCh`J-e+G<#>o>})s}>&BsiAZq z$r+po1$fa(Rf{FZ6t~*FCBVx9G;I|EIHB{<%!6#@BEQhdjLR?baw9S z*|P}AfGSc%#2-%mwhF)*dB&a3PXaby?p$G6(twRdO|4ToHzlS2PE8&viTn3gC@Qun zM`a(T@kW$L&hFujDKQg2K#o~S5`$}kPydUDISNGJFhV*)%tP`djy`rCp#n4s&?8!? z>2H?VhE_}J^~W|aRYM$t14h(>m{)<`4>1cK2_E3A(Dx=r1P5MFzHS5Gx-ldX=TowP zy^59$jbeZeg2wCGp~u>Zc@fR|-8vXAq>~KaRZ4fNuQWjPe37b%(BSh7b{`Ia=)S># z{h<~yI!}%QJ!J%y(Htm4x8T2nx6pSe&O|dn4POfe1Q@X@UR`u_z>tU;QCZnCPOpD(Px~C8@4>T{ z_Ho6726^0^@0OgKYm{waaD#^G4-b1DjdTwvdI&17sp;4+P`T2lmCLEVjtHm zLY)4qXX@s4B}Yn3Z-dOf#o}(+M1iz}b=OgR!_(ZkoAzT=>)m;lBhRCMQAA# zF|2`Ail4@mp0l67z$V%|OHcbA^+?4L)PLS%nrm(eJu9|9{P4j<{_glWPX07#Ib1;a z0&xDo5XAT|(C~&--W_yv+{#?9b^vTA*i~piaZbxeQdX?kQCZ}7bLvR)+wo}-^PY&Mjl-gkEfmcpZ2J~|L-&jXo4}Be95+aXc9cYPkwVI zA!Xv^i4!h-&_rV)!Vy-OF6+m_A|h+Jew`WN4%9*2%-{zFes(V zEc4c4W}~BvQ$?N~a#2HOb8zxJ^yFV3gNTQ zsMCS|U2a+Zm3^qD|G8Lx?RgQ`J8I5+!^}Ul@Au8#ey^cHArXJ$iiyIH9YoOMaPQS} z%<_aH{OOGwKQ5Z46!SJy62kfmU^2cs3l`(ZKi~asU2}Cy=>VQ(21!VZIC6mOEyfym zW){kZJu=lbGj@A8%=IEMo#y7G4D)ScgjS9m-u;I9=V}^}s7A$ciBh@No-sn{8nl-C z_g^4|(~3A~EuUa+IDN*^8dmuK<5BwS8q?BQ!DpQ3djDQ~L1LF~F#hs7ns4AO3Rn6I zq0W4^fn4SI)u`ZEHb4W=EXK<7>k?t*4vD@O_OBOhoQxQXfGzX4<2&lOsn?Y*A*nB! z{c;XCmFgDMBgOwbtC@DGKFOSaE>=x8w3)=r^g1&ipRw@e4i25Bail=4i%^Ek_ntj{ z+F<-hWbL%;NLyP7tj{fPzxP=nh&Z0#_MS#A#zy$@NG8?zyM0~z^k2}f9%n-Ze%~xq z6WvX{D{Mr*1}Gx!6ru%*eWPVArFELQVjHzqN>KPPUzR+fS2)CaM!g-Wn6rFi@} zPEyL9_bJ%$Ov@M{37oosf!akbMzeqYsK;i65sVw@b*17qgl-Hz{p&VRr@t5Pk4uX^ zr$2~H4hPOtc)V~;4tlaT_bV=#hJ}25(-*)O6tAfA>qiSTf%AG+&bL2_yESh)>9+w( zZu)x}jva|C`MK*ny+f_i^Il)oG>sdgrQ_fTyTv}G zAB3>7`fN20!jWei*LP(a<+UP{LOv2D@y=t>WxU@8Q%_n(xc1pkooP0gz3f(Rd{(x} z^tczB%=apvY6fjXO5qs~;(R;PCCbHI7w8U_m=2n4DL*fvQwW zMIp|w2T%T^7&j<3J-S3C)_*sQ)Y7#pY248&#=VKN@XfY5F~d8{bPw9T4=m&&y&7ht zH@fVsM9rA^iPjmbY5ZgAqaO{muTYB`H+R+HR8ajHWp5S!<+}1Ay^-22yiWxaAMovv zEui*WpPg*FV?5zh!*zV>Blb8ZA8wIh^JtCuq7~hLe+#dye&Rt(kB$hVJffEbDja8b z-l|8bi$2K8|K#D4=-_WB{v0p1nyE=jktmlV*2lro$DGO_~Gz+ucJj8YG?0%rjXo`BMX z-Q8h|5fl)}XmKSn2No{ePN&yJz3sy-bvflUDiLawwDv+u7Ni*~8OROS35Q+>wf2)I zPas^!3DbN(K>Z81jcquNDh!~SJ7*4^*#Yr~<&8s{H4knIkFMTsi}@&v7ehiXDK6dz zW}x(QK>qN?QPk$p9l1kiZke|WFb#=W)+Q!5V|=~iny>V)XqXc8|0S`3e_uADGX8>x zHQ@QU0-_3iz|9Z`kH7)Hb+e|lM-DO42Dl5ykT6r~A`dc4ybyikeCIT})PnQpzrm3N zpGDm#q{Bd5b`U;stoX>NsDlHs8{qnWwLcC98_$Qi-FU3%-a+bvq})$8ITjt0r~wYX z{&Qj&5=iADs=yWGcBO$60tO>;P(gIc8pYdfyXdkqH!Dj>!LAzFTK9p2kXLoVxHEOb zT$$M%I}A7#6QxcO(^)V-45QX-%cygVi>~vaUO-GfrjQULN|7=GAf&iMk0a>jaFYU3 zcab%4x1j;lg|VR_RF~-Eq;zYn(iO`bM!5iS%xnw{g_H_*YP8Ie2w=BXXk4!StkbSt zZ?XQae|visf0LL6j=xJZQ2D$M#*N2cxiE1$l?DO>zI^2^M{bh&`Ae`ySATfX;`y5l zl?pX8GsAe2H<+*Z_7$icXtgx`Pj4t!b=w0z4vkOfjl?kkql}tz=RI0Y-#Tynbk=CY zN=EW}u6bd|S~EZk2njuVRND*!IuQXe0@J9IK3cTRFg z?Gar#vP7eKfv1h#4%c?|Z=LsMHph@1&N%@DA{rf;ZFHt{Zd|aTi1U|Q+$+}W=?Q<} zALn;EZ4dp@lSAJ;Woif-?^CC(psKD8XMG!i8{y214`2l=^%))G{Ct-T$4=JOhN*|I zParv*s%P8Jt7@29TU)kdHPdV=_M*F7NM`fJ1;WDe7sKSiZpl&9)XtJe(VH~k-;3;L znJUbmgg!*^>YU{;kRo2CB9vT5iJ;UVN)wT$pHZ!FV~h>7BgF9Jj}-`;&@+LAjVB-P z=w0wr-FwaLk=SRMH;$Zv&=`nxtE;OCx}CiEB2V{(6ZFH0s$VB2lpaILblHpoCwyaj z*X8Pa4_r@Um=eOoC(0MjY<|#A5#|YpTMWTwDxu^u8n1$(s{WCi@GXDBRxwvZSx#JB zJF`u3hXLtE-w59J!oos$>Xw4C%**=$G93ln;A9fN!t~7&^}2>I0kxOUEzQicAYosRF?=e&dQpTNChUPul#E}ZC|UuLHuL<|cq_p;T9 zCSonpO$)dBW7shm+WP$6<_GYqpp!cmxP-V{x}PhFY_uDbKLe=LNXxt@7!fWZwPeZh zlq^^jSLR-XApkZo+~p-`5qH`IK>dyoYzluQBDVcqKR7i!l;yTqw!IRA)W=- z5=6eukBW1ei^(0OSQ;=BwlY{{8t+lhBS~&Cg~=}{nAzcuh^WDn$Afo}QtuC=^*T>T zX#eYW`AVDf^v1h)^Po>OdI_ia9=ytW&I~9|1$cRjP*A}S76e}tcu$9wJ|2N_G5;vp zhBi_|$)xSaVrd$1-hzEdxO!@F33Y5zyC_LjRMDXpUQPTlxRP5y^1s7&022m!FVMw6 zV@y`neVe%xzitxOJXBazWSZGV>}(ks;kaXlGD}(noOUp356*ySlMxb&jiCG ztNAuyESFh@? zZ-mmVJ%9V^mxa3&r`GA?!B?@HFRn3^?7b0mW6R0CZEK0KROlD@DvjM>b#ZlK;Cxx} zaGR_e=KWwZO||7*Y!^2YCKE~+kA9ec#-M@0<3_B9ZgvY}nu17g;W-$nFqAT(zH;G# zxPjf38AgpERW@2j(#@~B< z)As#@68Qgj2pZAX*N27~6Q3;eTz+1z0fJezy)Edd7SjH)8Dl>Is_Q~s|4ACfem8=s z>cs+b0Uy5JS+oCrFuDJWRP=QbhbN4`=!0)=JEqi)M1rB*!Ez=PLuRQhQDT}CSRo-h zntpQQDzlUxR|WVXgzf6p0APrO8^Nh7daiw_6UFLA))u0kw0@|$o{&Z7^DZLt5scM( z`O-nGN#X68w&QYU;kXI@dA)`lgeui|OeFmvFhPYvtAN+Nz zeFxtoY-r_Wuf5*k8H?1HXAYxDMF=sGP6=liW1CIk=OuE(8(aC&_(D%^Y|rXdhA&sj z{0uS5i~AzTE{yowX?4M|!zjmu=p^;u+E~tGr}2Lb1lirDt4RF+|95^S_&pmhA0GhO z%lI{2TJLU)#UA>GIXbEzUk*c7PS(L=gekZyR_+K9by!1aBzRQVSxFr8gg`g_NF5&e zfIEVt5_i6fF;XNnm4<dt&XZ+yiDWO$j$lS-Rsnz+yJf-DFG+fj5Yv959-prsxd^mD2PK@MFn3p8xz$X{qwW4 zxi~qA;QM%yN|4q2B2&6Np_pe=w9@H|(2FBPvJ}_6U|QS*2MHRvk4osX0JohF z`3K^~L(>o@fya4q<>h{e_JBYFUC_K1SA-&IpZt+D`TZ3V0MI_z0_7L6SP{|A6T%7?p2;WUvWQ)8oqILu0VH`TP5$v}-zM27?S*=24V{UVza90Rdh; zWp7Z1;^N`@PL*};ra+{L0-+D#3_l=iMskeu?*8>U4bXOgFjd329F3aSuiahv`N5?~ zQL!RYxQ~{stL8n7d6uU9x2;?E19?DzXq0ra%$o+`_gd_JV$T5_gPw&6a!LSoRqX4f>4KMiG4Ti6qMasoe2E}IwY_L8)>7Ziy>$?k-c)(GfGSg_~|1= z*F#S*6G#zS+>9L=5AY%pGKJ18q9pMhGR**bOd^JF4QYP!{oxMohHMsK*1;`q;cOGzR#03;&D8 zN9bc?-0}u1X$JMSb^YQ{Yv?hwCckb5My;x5P9OJaB&a=0&qo*g4>j&7{rE8eAp?CkEw$45l>Nt+$+&o=I zSB@?Hb9c*Qm(^in#xZpLqPRRY&!i%TmB&_&Q{#k99^x8#IAI={zjX zrsN@EXI#EMIJYmop z^*f*r!21>(x}+%cMnJK!SYEpEpFRril&R-STn(wzs8t&%iGu2UaV~(k7_zn~Ve2Sp zXjUT5Eyde!S;ova!^2Amlq9-4_=Tk?I>c98>Dk4uu#HvQY)_3N+L|2fm#LY2l_t7M4xK%x;$nE z?k~8dStw_M(b$4Y2OKn;z&K2JpirRMg4<)dQ7QD=js$j?>y9k#vCd$gv6iXVEO3W( z&-Pj;R$il2N|vVsT7YvfHe(O>T>Mz6eNuSJVOEcc2PE}xUqPHcGd+!zk0a_|5lD!; z2r}G4iNtt(DjtIOt{ab61jfPYlZW)Cr;`=%NM9_rzYLbZyrYl?ejJ}(UR_N%U+N#U8=7mjKUHDu1cdS?%qVC6^!J{cuiHcRQau`Dty<8$SzX&p zrDe3pGJ&-!n*ZFrGGAhulz1kEqUGYt_1}?6ObcXNdd@Wpd!Og*;Vth(K1GYA?IGbM zcA*KbKqKcerJmn$H?C4clcJ?Z%cs-ISzY5ST*3EJYCbV!(iBEsVQ?9IuD@t3uyFrQ zo;kzXEaYJtb-x)Ny2%eY@%PRuL33F`)TG&dGygs?J@VJAUBtlHs0Kb~JChart aggregating vulnerabilities every six months to depict the accumulation of vulnerabilities based on the application EOL date. As the chart moves right along the x-axis (meaning newer versions) the number of vulnerabilities decreases. -
- -## Where are the vulnerabilities? - -| Time since EOL | Application Vulns | Application Dependency Vulns | Image Component Vulns | -| :---------- | ---------: | ----------: | ----------: | -| 0-6 months | <1 CVE | 3 CVEs | 351 CVEs | -| 6-12 months | 1 CVE | 11 CVEs | 542 CVEs | -| 12+ months | 3 CVEs | 33 CVEs | 1,601 CVEs | - -### Application vulnerabilities - -Less than 1% of vulnerability accumulation occurs directly in an image's application, and we found that only 14% of versions that contained a vulnerability included a vulnerability directly within the application in the first six months post-EOL. - -Project maintainers won't patch these CVEs, and updating to a newer version or patching it yourself in the source code are the only options for addressing these vulnerabilities. - -### Dependency vulnerabilities - -In the first six months after an image reaches the EOL stage, 40% of versions contain a vulnerability in the application dependencies. The following table outlines how many vulnerabilities, on average, a dependency will accumulate over time: - -| Time span | Number of CVEs | -| ---------- | ---------- | -| 0-6 months | 3 | -| 6-12 months | 11 | -| 12+ months | 32 | - -Fixing these would involve upgrading dependencies and rebuilding the target application, a difficult and labor-intensive task. - -### Image component vulnerabilities - -As mentioned previously, more than 98% of vulnerability accumulation occurs within the components of the image: - -| Time span | Number of CVEs | -| ---------- | ---------- | -| 0-6 months | 340 | -| 6-12 months | 501 | -| 12+ months | 1,552 | - -Ninety-seven percent of these vulnerabilities are within Debian packages. Per [this blog post](https://www.chainguard.dev/unchained/the-zero-cve-challenge-can-official-docker-hub-images-pass-the-test?utm_source=cg-academy&utm_medium=referral&utm_campaign=dev-enablement) many of these vulnerabilities are found in the latest stable versions of these Debian packages, meaning that you can't make them go away with just an `apt upgrade`. - -## A deeper look at Traefik - -
Chart highlighting vulnerability counts across the latest cycle release version of Traefik and the associated EOL date for each cycle. The chart shows older versions have significantly more vulnerabilities than newer ones.
-
- -When scanning the official [Alpine-based image for Traefik](https://github.com/traefik/traefik-library-image/tree/master/tmpl/alpine) with Grype, Chainguard's researchers found that the image versions generally accumulated fewer vulnerabilities than typical, with an average of 25 vulnerabilities identified every six months, as shown in the previous table. - -Take version 2.9 of Traefik as an example. It was released on October 3, 2022, with security support provided until April 24, 2023, which is roughly six months. The final update for this version, 2.9.10, was made available on April 6, 2023, just three weeks before the end of its support lifecycle. - -Following the release of version 2.9.10, 55 vulnerabilities were reported: four within Traefik itself, 31 associated with its application dependencies, and 20 related to the Docker image components. Below are example CVEs within the various locations of 2.9.10 of the official Traefik Docker image. - -### Example CVE within Traefik - -- ‍[CVE-2023-47633](https://github.com/advisories/GHSA-6fwg-jrfw-ff7p): Traefik docker container using 100% CPU. This issue was addressed in versions 2.10.6 and 3.0.0-beta5. There are no known workarounds for this vulnerability; your only option is to upgrade. - -### Example CVE within a dependency (Docker) of Traefik - -- ‍[CVE-2023-28840](https://github.com/advisories/GHSA-232p-vwff-86mp): Docker Swarm encrypted overlay network may be unauthenticated. The affected project is `github.com/docker/docker`, a [dependency](https://github.com/traefik/traefik/blob/v2.10/go.mod#L18) of Traefik. We [fixed this vulnerability](https://github.com/wolfi-dev/os/pull/1779/commits/024b165f14ddad03290ef504c3c46730e596668c) in the Chainguard Container of the Traefik 2.10 cycle. - -### Example CVE within an image component of Traefik - -- ‍[CVE-2023-5363](https://nvd.nist.gov/vuln/detail/CVE-2023-5363): An out-of-bounds write within OpenSSL, a dependency of the base image [Alpine 3.17](https://github.com/traefik/traefik-library-image/blob/v2.9.10/alpine/Dockerfile#L1) used by Traefik (impacts `libcrypto3` and `libssl3`). The Chainguard Container of Trafeik uses the [wolfi-base image](https://github.com/chainguard-images/images/tree/main/images/wolfi-base), which runs the updated versions of libcrypto3 and libssl3. - -## Learn more - -End-of-life software represents a significant security risk. This issue becomes particularly critical when vulnerabilities are found directly in the target application of the image. - -The only option when that occurs is to update. However, the vast majority of vulnerabilities that appear in an EOL image will come from its additional components, meaning that updating just the application software may not significantly reduce the overall number of vulnerabilities. Thus the best option is to have a plan to keep your software updated to the latest versions promptly. - -To learn more about keeping container images up to date, we encourage you to check out our article on [Considerations for keeping containers up to date](/chainguard/containers/security-and-compliance/updating-containers/considerations-for-image-updates/) as well as our overview of [Strategies and tooling for updating containers](/chainguard/containers/security-and-compliance/updating-containers/strategies-tools-updating-images/). diff --git a/content/chainguard/containers/security-and-compliance/updating-containers/dependabot/index.md b/content/chainguard/containers/security-and-compliance/updating-containers/dependabot/index.md index bb4f46afda..6986db692c 100644 --- a/content/chainguard/containers/security-and-compliance/updating-containers/dependabot/index.md +++ b/content/chainguard/containers/security-and-compliance/updating-containers/dependabot/index.md @@ -7,7 +7,7 @@ aliases: type: "article" description: "How to configure Dependabot to authenticate to your private cgr.dev registry and open pull requests that update Chainguard Containers" date: 2026-09-03T00:00:00+00:00 -lastmod: 2026-09-28T14:00:04+00:00 +lastmod: 2026-10-15T14:26:56+00:00 draft: false tags: ["Chainguard Containers"] images: [] @@ -171,5 +171,5 @@ If the job log shows a successful run but no pull requests, check the following: ## Learn more * [Using Renovate with Chainguard Containers](/chainguard/containers/security-and-compliance/updating-containers/renovate/) covers the equivalent setup for teams outside GitHub, or teams that want short-lived credentials through an assumable identity. -* [Strategies and tooling for updating containers](/chainguard/containers/security-and-compliance/updating-containers/strategies-tools-updating-images/) compares the wider range of update tools. +* [Stay secure: Strategies and tooling for updating container images](https://www.chainguard.dev/unchained/stay-secure-strategies-and-tooling-for-updating-container-images), on the Chainguard blog, compares the wider range of update tools. * [Authenticating to the Chainguard registry](/chainguard/containers/registry/authenticating/) documents pull tokens and the other authentication options in full. diff --git a/content/chainguard/containers/security-and-compliance/updating-containers/digestabot/index.md b/content/chainguard/containers/security-and-compliance/updating-containers/digestabot/index.md index aa422a920e..1e968255a7 100644 --- a/content/chainguard/containers/security-and-compliance/updating-containers/digestabot/index.md +++ b/content/chainguard/containers/security-and-compliance/updating-containers/digestabot/index.md @@ -17,7 +17,7 @@ aliases: type: "article" description: "How to configure Digestabot to keep digest-pinned references to Chainguard Containers current, including authenticating to a private cgr.dev registry" date: 2024-02-07T15:21:01+00:00 -lastmod: 2026-09-28T14:00:04+00:00 +lastmod: 2026-10-15T14:26:56+00:00 draft: false tags: ["Chainguard Containers"] images: [] @@ -318,6 +318,6 @@ So please try it out and let me know if you have any questions. * [Using Dependabot with Chainguard Containers](/chainguard/containers/security-and-compliance/updating-containers/dependabot/) covers the tool to pair with Digestabot for moving between version streams. * [Using Renovate with Chainguard Containers](/chainguard/containers/security-and-compliance/updating-containers/renovate/) covers the equivalent setup for teams outside GitHub. -* [Strategies and tooling for updating containers](/chainguard/containers/security-and-compliance/updating-containers/strategies-tools-updating-images/) compares the wider range of update tools. +* [Stay secure: Strategies and tooling for updating container images](https://www.chainguard.dev/unchained/stay-secure-strategies-and-tooling-for-updating-container-images), on the Chainguard blog, compares the wider range of update tools. * [Considerations for keeping containers up to date](/chainguard/containers/security-and-compliance/updating-containers/considerations-for-image-updates/) covers the tradeoffs behind an update policy. * [Inspecting Chainguard Containers](/chainguard/containers/troubleshooting/inspecting-containers/) explains what a digest is and why pinning to one matters. diff --git a/content/chainguard/containers/security-and-compliance/updating-containers/renovate/index.md b/content/chainguard/containers/security-and-compliance/updating-containers/renovate/index.md index 4959d9aa55..91eeb4436b 100644 --- a/content/chainguard/containers/security-and-compliance/updating-containers/renovate/index.md +++ b/content/chainguard/containers/security-and-compliance/updating-containers/renovate/index.md @@ -10,7 +10,7 @@ aliases: type: "article" description: "How to use Renovate to automatically keep Chainguard Containers, Helm charts and packages updated" date: 2023-09-05T11:07:52+02:00 -lastmod: 2026-10-08T13:25:53+00:00 +lastmod: 2026-10-15T14:26:56+00:00 draft: false tags: ["Chainguard Containers"] images: [] @@ -667,7 +667,7 @@ These can be safely ignored. They are caused by Renovate using the `org.opencont * [Using Digestabot with Chainguard Containers](/chainguard/containers/security-and-compliance/updating-containers/digestabot/) covers Chainguard's own GitHub Action for keeping digest-pinned references current. * [Using Dependabot with Chainguard Containers](/chainguard/containers/security-and-compliance/updating-containers/dependabot/) covers the equivalent setup for teams already using Dependabot. -* [Strategies and tooling for updating containers](/chainguard/containers/security-and-compliance/updating-containers/strategies-tools-updating-images/) compares the wider range of update tools. +* [Stay secure: Strategies and tooling for updating container images](https://www.chainguard.dev/unchained/stay-secure-strategies-and-tooling-for-updating-container-images), on the Chainguard blog, compares the wider range of update tools. * [Considerations for keeping containers up to date](/chainguard/containers/security-and-compliance/updating-containers/considerations-for-image-updates/) covers the tradeoffs behind an update policy. * [Authenticating to the Chainguard registry](/chainguard/containers/registry/authenticating/) documents pull tokens and the other authentication options in full. * [Renovate's APK datasource documentation](https://docs.renovatebot.com/modules/datasource/apk/) covers every `registryUrl` query parameter Renovate supports. diff --git a/content/chainguard/containers/security-and-compliance/updating-containers/strategies-tools-updating-images/index.md b/content/chainguard/containers/security-and-compliance/updating-containers/strategies-tools-updating-images/index.md deleted file mode 100644 index 310092d1c2..0000000000 --- a/content/chainguard/containers/security-and-compliance/updating-containers/strategies-tools-updating-images/index.md +++ /dev/null @@ -1,135 +0,0 @@ ---- -title: "Strategies and tooling for updating containers" -linktitle: "Update strategies and tools" -aliases: -- /chainguard/chainguard-images/recommended-practices/strategies-tools-updating-images -- /chainguard/chainguard-images/staying-secure/updating-images/strategies-tools-updating-images -- /chainguard/containers/recommended-practices/strategies-tools-updating-images -- /chainguard/containers/staying-secure/updating-images/strategies-tools-updating-images -- /chainguard/containers/staying-secure/updating-containers/strategies-tools-updating-images/ -type: "article" -description: "A conceptual article outlining different strategies and tools for keeping images up to date and avoiding the use of end-of-life software." -date: 2024-12-02T11:07:52+02:00 -lastmod: 2026-09-28T14:00:04+00:00 -draft: false -tags: ["Chainguard Containers"] -images: [] -weight: 20 -toc: true ---- - -When it comes to keeping a system secure, one of the most important measures you can take is to regularly apply updates. In modern, containerized infrastructures, this normally means updating containers to use only the latest container images that are still maintained. A casual observer might expect such a standard and important task to have agreed-on best practices and standardized tooling, but they might be surprised by the wide variety of different solutions and opinions on this problem. - -This conceptual article will delve into some of the options and offer guidance on which might work best for readers. This article assumes that you are familiar with [semantic versioning](https://semver.org/) (SemVer) and image tagging. If you aren't acquainted with these concepts, check out this guide on [Considerations for keeping containers up to date](/chainguard/containers/security-and-compliance/updating-containers/considerations-for-image-updates/). - -## Updating means risk - -The core issue with applying updates is that it's a fundamentally risky endeavor; any update to software risks a change to behavior and system breakages. It's a common practice to avoid major updates for weeks or even months in order to ensure bugs have been worked out before upgrading. - -Larger software projects (like PostgreSQL, Java, and Node.js) often have multiple versions of their project in support at the same time. This means that users can stay on an older version and avoid the more risky updates while still getting security patches. Although this approach is helpful to operations teams, it is only practical on large projects with paid maintainers that can spend time backporting fixes. Smaller projects will often struggle with just keeping the main version up to date. - -## Not updating means more risk - -End of Life (EOL) software [presents a host of security risks](/chainguard/containers/concepts/lifecycle-and-eol/how-eol-software-accumulates-cves/). Upgrading may require a great deal of work and proper testing, but it's a small price to pay to keep your systems from being at risk and accruing technical debt. - -If your application has an automated test suite with good coverage, you can be confident that any breakages caused by upgrades will be caught before deployment to production. Of course, whenever a test failure occurs, there will be work required to address it. Putting off that work by delaying upgrades will only mean that more work is required in the future as further changes pile up. - -Another way organizations test and reduce the risk of breaking changes introduced by updates is through the use of staging environments where changes are tried out before being pushed to production. An alternative approach to this is [testing in production](https://increment.com/testing/i-test-in-production/), which usually involves using techniques like [feature flags](https://www.honeycomb.io/blog/what-is-a-feature-flag-best-practices-and-use-cases) and staged updates to verify the effects of changes before they impact the majority of users. - -## Knowing when updates are available - -The primary way of knowing when a new image is available is through the registry itself. Many registries will offer a webhook callback service ([Docker Hub](https://docs.docker.com/docker-hub/webhooks/), for example), but this is typically only for your own repositories. If you want to get notified when a public repository is updated, you'll generally have to use a third-party service like [NewReleases](https://newreleases.io/). - -If you're trying to find out how outdated the images in your Kubernetes cluster are, you might find the [version-checker](https://github.com/jetstack/version-checker) project to be useful. This is a Kubernetes utility that will create an inventory of your current images and produce a chart showing how out of date they are. The dashboard can form part of a full solution with notifications for outdated software being sent to cluster administrators for mitigation. - -## Updating solutions - -This section outlines some commonly employed solutions for keeping images up to date. We'll only consider solutions that involve automation — you could argue that `kubectl set image` is an updating solution, but it would only be scalable as part of an automated pipeline. - -### Using `latest` or major version tags - -One common strategy is to only use the `latest` tag or major version tags. This means having something like the following in your Dockerfile: - -``` Dockerfile -FROM cgr.dev/chainguard/redis:3 -``` - -Or, if you're using a Kubernetes manifest, you might have a line like this: - -``` Kubernetes -image: cgr.dev/chainguard/redis:latest -``` - -The tag used will determine the jump in the updated version; `latest` will jump major versions so typically a major or minor tag is chosen to limit the size of changes. - -The goal for this strategy is to update the image whenever it is rebuilt or redeployed. However, the reality is that this approach is still dependent on caching and configuration (especially the [image pull policy](https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy)) and it may involve a considerable time to redeployment. - -One major issue with this approach is that you lack control and reproducibility over the images that will be deployed. In Kubernetes you can end up with different pods in the same deployment running different versions of the application because nodes pulled the image at slightly different times. Debugging can become difficult, as you can't easily recreate the system. You can't even say for sure what is running in the cluster, which will be a big problem when you need to respond to a security situation. - -The advantage of this approach is that it is relatively simple, requires little maintenance, and will keep up to date with changes over time, meaning it's often appropriate for simple projects, or example code. However, it's recommended that you don't deploy the `latest` tag to production, as doing so can present its own risks. - -### Keel - -[Keel](https://keel.sh/) is a Kubernetes Operator that will automatically update Kubernetes manifests and Helm charts. It has multiple options for finding updates — typically using webhooks from registries and falling back to polling for new versions. Updates are controlled through [policies](https://keel.sh/docs/#policies) which cover the normal cases. - -### GitOps: Flux and ArgoCD - -[GitOps](https://medium.com/weaveworks/what-is-gitops-really-e77329f23416) is a set of practices that leverage Git as a single source of truth for infrastructure automation. The two leading GitOps solutions for updating images are Flux and ArgoCD (though there are also newer solutions gaining traction including [fleet](https://github.com/rancher/fleet) and [kluctl](https://kluctl.io/)). - -#### Flux - -[Flux](https://fluxcd.io/flux/guides/image-update/) uses an [`ImageRepository` custom -resource](https://fluxcd.io/flux/components/image/imagerepositories/) that polls repositories for updates. There is also support for webhooks via the [Notification Controller](https://fluxcd.io/flux/components/notification/). An [`ImagePolicy` custom -resource](https://fluxcd.io/flux/components/image/imagepolicies/) defines what tags we're interested in — typically you will use a SemVer policy, such as `range: 5.0.x`, to get minor updates. - -An [`ImageUpdateAutomation` resource](https://fluxcd.io/flux/components/image/imageupdateautomations/) then defines how to handle updates, such as by checking an update commit directly or committing to a new branch and opening a GitHub pull request for manual approval. There is also support for reverting updates and suspending automation to support incident response. - -#### ArgoCD - -ArgoCD has a separate [Image Updater](https://github.com/argoproj-labs/argocd-image-updater) project that can be used to automate updates. Rather than creating new resources, ArgoCD relies on annotations being added to existing manifests. Update strategies are similar to Flux, with support for SemVer and regular expressions to filter tags. Unlike Flux, there is currently no support for webhooks, but this could change in the future. - -### ImageStreams - -OpenShift has the concept of [ImageStreams](https://docs.openshift.com/container-platform/4.15/openshift_images/image-streams-manage.html) for handling updates. ImageStreams are a "virtual view" on top of images. Deployments and builds can listen for ImageStream notifications to automatically update for new versions. - -The underlying data for an ImageStream comes from registries, but decoupling this data means it is possible to have different versions in the ImageStream and on the registry. This in turn allows for processes such as rolling back a deployment without retagging images on the registry. The ImageStream itself is represented as a custom resource which contains a history of previous digests, ensuring that rollbacks are possible even when tags are overwritten (assuming the image isn't deleted). - -### Frizbee and digestabot - -A best practice in supply chain security is to specify GitHub actions and container images by their *digest*. The digest is a content-based SHA of the image that is guaranteed to always refer to exactly the same version of the action or code, and it is also guaranteed to not have changed. In other words, digests are *immutable*, meaning that they can't be changed to point to something else. The disadvantages are that digests aren't human-readable and you need to keep updating them to stay up to date. - -However, It is possible to get something human-readable as well as immutable. The following are valid image references which specify both a meaningful tag and an immutable digest: - -``` -cgr.dev/chainguard/wolfi-base:latest@sha256:3eff851ab805966c768d2a8107545a96218426cee1e5cc805865505edbe6ce92 -``` - -``` -redis:7@sha256:01afb31d6d633451d84475ff3eb95f8c48bf0ee59ec9c948b161adb4da882053 -``` - -[Frizbee](https://github.com/stacklok/frizbee), a tool from Stacklok, will update image references to the most up-to-date digest. For the above example, it will ask the registry for the digest of the `cgr.dev/chainguard/wolfi-base:latest` image and update it if it doesn't match. - -At Chainguard, we take a similar approach with [Digestabot](https://github.com/chainguard-dev/digestabot), a GitHub Action that looks up digests in this format and opens a pull request to update them. - -Digestabot authenticates to your private `cgr.dev` registry with an assumable identity. Refer to [Using Digestabot with Chainguard Containers](/chainguard/containers/security-and-compliance/updating-containers/digestabot/) for configuration details. - -### Dependabot - -Dependabot is GitHub's tool for monitoring dependencies. It can be used with GitHub, but [can also be self-hosted](https://github.com/dependabot/dependabot-core?tab=readme-ov-file#how-to-run-dependabot). - -Dependabot is designed to work with a variety of different package ecosystems, as well as container images referenced in Dockerfiles and Kubernetes manifests. Dependabot runs on a schedule and will open pull requests to update dependencies when it finds outdated versions. - -Dependabot authenticates to your private `cgr.dev` registry with a pull token. Refer to [Using Dependabot with Chainguard Containers](/chainguard/containers/security-and-compliance/updating-containers/dependabot/) for configuration details. - -### Renovate - -[Renovate](https://github.com/renovatebot/renovate) is a similar solution to Dependabot and opens pull requests to update out-of-date dependencies. The major difference is that Renovate is a self-hosted application that supports multiple repositories, like GitLab, Azure, and Bitbucket, instead of just GitHub. - -Refer to [Using Renovate with Chainguard Containers](/chainguard/containers/security-and-compliance/updating-containers/renovate/) for configuration details. - -## Conclusion - -Something as important as keeping packages up to date has more approaches and tooling than one might expect. This article has shied away from offering any clear recommendations, but this is a matter where every organization will need to choose a solution that suits its own needs. - -We encourage you to check out each of the solutions listed in this article and judge them on their own merits. We also suggest you read our other articles on handling EOL software, including [Considerations for keeping containers up to date](/chainguard/containers/security-and-compliance/updating-containers/considerations-for-image-updates/). diff --git a/content/chainguard/containers/security-and-compliance/working-with-scanners/false-results.md b/content/chainguard/containers/security-and-compliance/working-with-scanners/false-results.md index 7f9535ef1f..c397ae96a6 100644 --- a/content/chainguard/containers/security-and-compliance/working-with-scanners/false-results.md +++ b/content/chainguard/containers/security-and-compliance/working-with-scanners/false-results.md @@ -14,7 +14,7 @@ description: "An overview of the formation of false positive and false negative lead: "An overview of the formation of false positive and false negative vulnerability results in container image scanners" type: "article" date: 2023-09-14T16:59:04+00:00 -lastmod: 2026-10-08T13:25:53+00:00 +lastmod: 2026-10-15T14:26:56+00:00 contributors: ["Michelle McAveety"] draft: false tags: ["CVE", "Overview", "Conceptual"] @@ -108,7 +108,7 @@ To learn how to choose the right scanner method for your application, check out False positive vulnerabilities are [red herrings](https://en.wikipedia.org/wiki/Red_herring): They look important, but take you away from the vulnerabilities which truly matter. Identifying what vulnerabilities are true and false positives can be difficult, as your false positive results are mixed in with other true positive finds. When dealing with hundreds of vulnerabilities, the [costs of extensive triage and remediation [PDF]](https://media.bitpipe.com/io_15x/io_152272/item_2184126/ponemon-state-of-vulnerability-response-.pdf) can add up fast. -False negative vulnerabilities can have major impacts on a system if they are not discovered. They are a goldmine for attackers if they find them before you do. The successful exploitation of a false negative vulnerability can result in a *zero-day attack*. A [zero-day attack](https://usa.kaspersky.com/resource-center/definitions/zero-day-exploit) occurs when an adversary exploits a vulnerability in software which the maintainer is unaware of. This can cause the attack to go unnoticed or unresolved until the vulnerability is discovered. Many [infamous CVEs](/software-security/cves/infamous-cves/), such as Log4Shell, are examples of incredibly impactful zero-day vulnerabilities. +False negative vulnerabilities can have major impacts on a system if they are not discovered. They are a goldmine for attackers if they find them before you do. The successful exploitation of a false negative vulnerability can result in a *zero-day attack*. A [zero-day attack](https://usa.kaspersky.com/resource-center/definitions/zero-day-exploit) occurs when an adversary exploits a vulnerability in software which the maintainer is unaware of. This can cause the attack to go unnoticed or unresolved until the vulnerability is discovered. Many [infamous CVEs](https://www.chainguard.dev/supply-chain-security-101/5-real-cve-examples-and-how-to-prevent-them), such as Log4Shell, are examples of incredibly impactful zero-day vulnerabilities. The presence of false positive and negative vulnerabilities in your scans add another unnecessary layer of complexity to the remediation process. Having an unreliable scanner can increase the amount of time you spend filtering out false positive results, giving you less time to focus on the true positives affecting you. Additionally, an inconsistent scanner reduces your confidence in the completeness and accuracy of your scans, making it difficult to determine if false negatives are lurking among your containers. diff --git a/content/chainguard/guardener/github/actions-security.md b/content/chainguard/guardener/github/actions-security.md index 1fb577f8f0..d1d3bd6860 100644 --- a/content/chainguard/guardener/github/actions-security.md +++ b/content/chainguard/guardener/github/actions-security.md @@ -4,8 +4,10 @@ linktitle: "Hardened Actions" description: "Configure Guardener to recommend and migrate your GitHub Actions to Chainguard's hardened, SHA-pinned equivalents." type: "article" date: 2026-07-08T00:00:00+00:00 -lastmod: 2026-10-13T13:59:25+00:00 +lastmod: 2026-10-15T14:26:56+00:00 draft: false +aliases: +- /chainguard/guardener/actions-security/ tags: ["GitHub", "Automation"] images: [] menu: diff --git a/content/chainguard/guardener/github/getting-started.md b/content/chainguard/guardener/github/getting-started.md index f2bf022495..bd38cb4f5b 100644 --- a/content/chainguard/guardener/github/getting-started.md +++ b/content/chainguard/guardener/github/getting-started.md @@ -4,8 +4,10 @@ linktitle: "Getting started" description: "Install the Chainguard App and link your Chainguard organization to your GitHub organization to start using Guardener." type: "article" date: 2026-07-08T00:00:00+00:00 -lastmod: 2026-10-08T02:59:03+00:00 +lastmod: 2026-10-15T14:26:56+00:00 draft: false +aliases: +- /chainguard/guardener/getting-started/ tags: ["GitHub", "Getting Started"] images: [] menu: diff --git a/content/software-security/cves/_index.md b/content/software-security/cves/_index.md deleted file mode 100644 index cb674cf328..0000000000 --- a/content/software-security/cves/_index.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -title: "CVEs" -description: "Understanding software vulnerabilities and CVEs" -type: "article" -date: 2023-06-30T19:07:55+00:00 -lastmod: 2026-10-02T12:53:50+00:00 -draft: false -images: [] -landingpage: "/software-security/cves/infamous-cves/" ---- -CVEs, or Common Vulnerabilities and Exposures, are entries of publicly disclosed software vulnerabilities which, if not addressed, may be used by attackers to access, manipulate, or compromise a computer system. diff --git a/content/software-security/cves/infamous-cves.md b/content/software-security/cves/infamous-cves.md deleted file mode 100644 index 0e474dd9ca..0000000000 --- a/content/software-security/cves/infamous-cves.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: "Infamous software vulnerabilities" -description: "An overview of a few of the most critical, widespread, and impactful known software vulnerabilities" -lead: "An overview of a few of the most critical, widespread, and impactful known software vulnerabilities" -type: "article" -date: 2023-07-21T19:16:39+00:00 -lastmod: 2026-10-02T12:53:50+00:00 -contributors: ["Michelle McAveety"] -draft: false -tags: ["CVE", "Overview"] -images: [] -menu: - docs: - parent: "cves" -weight: 30 -toc: true ---- - -[Software vulnerabilities](https://www.chainguard.dev/supply-chain-security-101/what-is-a-cve) vary in their severity – some are difficult to exploit and have minimal implications, while others can be exploited easily, giving an attacker significant leverage over a computer system. In cases where widely-implemented software contains high-severity vulnerabilities, the damage caused by their exploitation can affect millions of developers and services worldwide. - -In this article, you will learn how the KEV Catalog tracks known exploited software vulnerabilities, and how it serves as a tool for developers and federal agencies. In addition, you will explore Log4Shell, Heartbleed, and Shellshock, three infamous software vulnerabilities which have had major impacts on software security worldwide. - -## CISA KEV Catalog - -The U.S. Cybersecurity and Infrastructure Security Agency (CISA) operates the Known Exploited Vulnerabilities (KEV) Catalog, which is populated with CVEs that have existing exploits “in the wild”. The KEV Catalog serves as a tool for developers as it identifies CVEs that need to be prioritized for remediation because of their exploitability status. Federal civilian executive branch agencies [must remediate vulnerabilities](https://www.cisa.gov/news-events/directives/binding-operational-directive-22-01) present in the KEV Catalog by a due date specified by the CISA. Focusing on patching out these vulnerabilities limits the ability of attackers to find a potential known route into a system. - -Some of the vulnerabilities in the KEV Catalog are infamous for the impacts of their exploitation. When a vulnerability affects a piece of software present in an array of systems, its exploitation can reach far and wide, and efforts to remediate it can be difficult to fully implement. The following vulnerabilities are present in the KEV Catalog and serve as examples of how damaging ubiquitous software vulnerabilities can be. - -### Log4Shell (CVE-2021-44228) - -[Log4Shell](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) is a vulnerability impacting the Apache Log4j Java logging utility, a popular library used on millions of devices worldwide. The vulnerability allows an attacker to perform a remote code execution (RCE) attack by logging code that runs a Java Naming and Directory Interface (JNDI) endpoint lookup. An attacker can exploit this behavior by performing a JNDI lookup to a server under their control containing malicious code. This vulnerability has affected Log4j since version 2.0-beta9 (released in 2013), and was patched out in version 2.16.0 in 2021. - -Due to the popularity of Log4j, Log4Shell was extremely pervasive, impacting a variety of services such as those offered by [Amazon Web Services](https://aws.amazon.com/security/security-bulletins/AWS-2021-006/) and [IBM](https://www.ibm.com/support/pages/apache-log4j2-cve-2021-44228-security-vulnerability), among others. Its widespread use makes this vulnerability difficult to completely remediate as it may be unknown if a vulnerable version of Log4j is present on a system, such as in the case of [a federal network being affected](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-320a) months after the vulnerability was first documented. - -To learn more about Log4Shell, check out its listing on the [Apache Log4j Security Vulnerabilities](https://logging.apache.org/log4j/2.x/security.html#fixed-in-log4j-2-15-0-java-8) page. - -### Heartbleed (CVE-2014-0160) - -[Heartbleed](https://nvd.nist.gov/vuln/detail/CVE-2014-0160) is a buffer over-read vulnerability in OpenSSL, a popular cryptographic library commonly used for encrypting SSL/TLS communications on the internet. The vulnerability allows an attacker to read the memory of a system without detection. As a result, cryptographic keys, credentials, and other content can be silently extracted from a server’s memory. - -Heartbleed affected OpenSSL versions 1.0.1-1.0.1f (inclusive) and was discovered in 2014, about two years after the vulnerability was first introduced to OpenSSL. Due to its undetectable nature, determining if it was exploited against a particular server is difficult. It was estimated at the time of discovery that around [half a million websites](https://www.netcraft.com/blog/half-a-million-widely-trusted-websites-vulnerable-to-heartbleed-bug/) may have been vulnerable to the bug. - -To learn more about the Heartbleed vulnerability, check out the [Heartbleed website](https://heartbleed.com/). - -### Shellshock (CVE-2014-6271) - -[Shellshock](https://nvd.nist.gov/vuln/detail/CVE-2014-6271) is an arbitrary code execution vulnerability which went unnoticed for 25 years, existing in Bash since 1989 and first being reported in version 4.3 in 2014. Through this vulnerability, commands that should be inaccessible can instead be executed through Bash’s function export feature. In affected versions, Bash processes function definitions stored in environment variables, causing the unintended behavior that enables malicious code to be run. Following the initial CVE report, further CVEs were soon filed addressing additional related vulnerabilities. - -As Shellshock was not discovered for over two decades after its inception, the scope of its influence is significant, with it still being leveraged against systems today. Soon after the vulnerability was uncovered, large-scale [attacks using botnets](https://www.itnews.com.au/news/first-shellshock-botnet-attacks-akamai-us-dod-networks-396197) were deployed against high-profile entities like the U.S. Department of Defense. - -To learn more about Shellshock and its related vulnerabilities, check out [the CISA’s Shellshock alert](https://www.cisa.gov/news-events/alerts/2014/09/25/gnu-bourne-again-shell-bash-shellshock-vulnerability-cve-2014-6271). - -## Learn more - -In this article, you learned how the CISA’s KEV Catalog tracks exploited vulnerabilities, and how the catalog is used by developers and federal agencies to prioritize vulnerability remediation. You also explored three infamous software vulnerabilities: Log4Shell, Heartbleed, and Shellshock, and learned how they have impacted systems across the world. - -To learn more about these vulnerabilities and other exploited vulnerabilities, dive further into [the KEV Catalog](https://www.cisa.gov/known-exploited-vulnerabilities), or check out [the full CVE database](https://cve.mitre.org/cve/search_cve_list.html). diff --git a/content/software-security/what-is-software-supply-chain-security.md b/content/software-security/what-is-software-supply-chain-security.md deleted file mode 100644 index dbeabe1a27..0000000000 --- a/content/software-security/what-is-software-supply-chain-security.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -title: "What is software supply chain security" -linktitle: "Software supply chain security" -description: "What is software supply chain security and why it matters: protect against attacks like SolarWinds with tools like Chainguard's SLSA-compliant containers and SBOMs" -lead: "A beginner's guide to software supply chain security" -type: "article" -date: 2022-08-04T15:21:01+02:00 -lastmod: 2022-08-04T15:21:01+02:00 -contributors: ["John Speed Meyers"] -draft: false -tags: ["Conceptual"] -images: [] -menu: - docs: - parent: "software-security" -weight: 10 -toc: true ---- - -_An earlier version of this material was published in the [first chapter](https://learning.edx.org/course/course-v1:LinuxFoundationX+LFS182x+2T2022/block-v1:LinuxFoundationX+LFS182x+2T2022+type@sequential+block@1623557b9fc849d5a1e38177502b1499/block-v1:LinuxFoundationX+LFS182x+2T2022+type@vertical+block@825d4b442d1346ba8e9d7c3b4f765e76) of the Linux Foundation [Sigstore course](https://learning.edx.org/course/course-v1:LinuxFoundationX+LFS182x+2T2022/home)._ - -Software producers have a supply chain just like manufacturing businesses have a supply chain. And just like manufacturers require physical inputs and then perform a manufacturing process to build a finished product, so do software producers, whether the producer is a company or individual. In other words, a software producer uses components, developed by third parties and themselves, and technologies to write, build, and distribute software. A compromise introduced anywhere in this chain is an example of a software supply chain security issue. Tools and practices like those implemented in Chainguard's containers help organizations protect against these risks through built-in SBOMs, provenance attestations, and SLSA compliance. - -Some observers might think that all software security issues are software supply chain issues. How else would vulnerabilities end up in the finished software if not through the software supply chain? A generic example can help illustrate the difference. Imagine ACME company unintentionally creates a SQL injection vulnerability in a piece of software that ACME company distributes. This is not a software supply chain security issue. Code from ACME’s own developers is responsible for this security issue. But should ACME company use an open source software component that has been maliciously tampered with to send sensitive secrets to an attacker when the code was built, then ACME would be the victim of a software supply chain attack. In that case, the supply chain of ACME’s developers is the origin of the security issue. - -Software supply chain compromises can involve both malicious and unintentional vulnerabilities. The insertion of malicious code anywhere along the supply chain poses a severe risk to downstream users, but unintentional vulnerabilities in the software supply chain can also lead to risks should some party choose to exploit these vulnerabilities. For instance, the [log4j (PDF)](https://www.cisa.gov/sites/default/files/publications/CSRB-Report-on-Log4-July-11-2022_508.pdf) open source software vulnerability in late 2021 exemplifies the danger of vulnerabilities in the supply chain, including the open source software supply chain. In this case, log4j, a popular open source Java logging library, had a severe and relatively easily exploitable security bug. Many of the companies and individuals using software built with log4j found themselves vulnerable because of this bug. - -Malicious attacks, or what often amounts to code tampering, deserve special recognition though. In these attacks, an attacker controls the functionality inserted into the software supply chain and can often target attacks on specific victims. These attacks often prey on the lack of integrity in the software supply chain, taking advantage of the trust that software developers place in the components and tools they use to build software. Notable attack vectors include compromises of source code systems, such as GitHub or GitLab; build systems, like Jenkins; and publishing infrastructure attacks on either corporate software publishing servers, update servers, or on community package infrastructure. Another important attack vector is when an attacker steals the credentials of an individual open source software developer and adds malicious code to a source code management system or published package. - -Fortunately, a number of promising counters to software supply chain attacks have emerged. For instance, projects like Sigstore offer a chance to restore integrity to the software supply chain and initiatives like the Open Source Security Foundation provide a forum for concerted action. Further information on software supply chain security compromises and counters can be found in [this reading list](https://github.com/chainguard-dev/ssc-reading-list). - -One further term merits a definition and explanation. Cloud-native software supply chain security refers to software supply chain security efforts that are related to container technology. The process of selecting, building, and operating containers has a number of important implications for software supply chain security. For instance, signing containers with a digital signature (via a tool like [Cosign](https://github.com/sigstore/cosign)) is one way to ensure that an attacker that tampers with a container is detected. Container technology both epitomizes the potential software supply chain security perils that modern organizations must confront while also enabling approaches that can make a software supply chain secure by default. diff --git a/data/redirects.yaml b/data/redirects.yaml index a2520975c3..1147ed1643 100644 --- a/data/redirects.yaml +++ b/data/redirects.yaml @@ -227,6 +227,10 @@ rules: # above the catch-all for that section. - regex: '^/open-source/slsa/what-is-slsa(/.*)?$' to: 'https://www.chainguard.dev/supply-chain-security-101/what-is-slsa' + # The SLSA section moved to /compliance/slsa/ with no alias for its old + # root, so /open-source/slsa/ returned 403. + - regex: '^/open-source/slsa/?(index\.html|index\.xml)?$' + to: 'https://www.chainguard.dev/supply-chain-security-101/what-is-slsa' # Sections left with no pages. The roots are anchored so they match only # themselves and their index files. - regex: '^/open-source/oci/?(index\.html|index\.xml)?$' @@ -261,3 +265,73 @@ rules: to: 'https://www.chainguard.dev/supply-chain-security-101/what-is-sigstore-rekor' - regex: '^/platform/fips/understanding-fips(\.md|/.*)?$' to: 'https://www.chainguard.dev/supply-chain-security-101/understanding-fips' + + # Pages from the migration sheet's Redirect Only tab that duplicated + # chainguard.dev content (DOCS-269). "(\.md|/.*)?" also matches each + # page's Markdown copy. + - regex: '^/software-security/cves/infamous-cves(\.md|/.*)?$' + to: 'https://www.chainguard.dev/supply-chain-security-101/5-real-cve-examples-and-how-to-prevent-them' + - regex: '^/software-security/what-is-software-supply-chain-security(\.md|/.*)?$' + to: 'https://www.chainguard.dev/supply-chain-security-101/understanding-software-supply-chain-security' + - regex: '^/chainguard/containers/security-and-compliance/updating-containers/strategies-tools-updating-images(\.md|/.*)?$' + to: 'https://www.chainguard.dev/unchained/stay-secure-strategies-and-tooling-for-updating-container-images' + - regex: '^/chainguard/containers/concepts/lifecycle-and-eol/how-eol-software-accumulates-cves(\.md|/.*)?$' + to: 'https://www.chainguard.dev/unchained/why-end-of-life-software-means-400-cves-per-year' + # The old paths of the last two pages. Section aliases on other pages + # match these before any regex rule here, and would now send them to + # paths that no longer exist. Exact rules are checked before every alias, + # but match one string, so each path is listed with and without its + # trailing slash. + - path: '/chainguard/chainguard-images/recommended-practices/strategies-tools-updating-images' + to: 'https://www.chainguard.dev/unchained/stay-secure-strategies-and-tooling-for-updating-container-images' + - path: '/chainguard/chainguard-images/recommended-practices/strategies-tools-updating-images/' + to: 'https://www.chainguard.dev/unchained/stay-secure-strategies-and-tooling-for-updating-container-images' + - path: '/chainguard/chainguard-images/staying-secure/updating-images/strategies-tools-updating-images' + to: 'https://www.chainguard.dev/unchained/stay-secure-strategies-and-tooling-for-updating-container-images' + - path: '/chainguard/chainguard-images/staying-secure/updating-images/strategies-tools-updating-images/' + to: 'https://www.chainguard.dev/unchained/stay-secure-strategies-and-tooling-for-updating-container-images' + - path: '/chainguard/containers/recommended-practices/strategies-tools-updating-images' + to: 'https://www.chainguard.dev/unchained/stay-secure-strategies-and-tooling-for-updating-container-images' + - path: '/chainguard/containers/recommended-practices/strategies-tools-updating-images/' + to: 'https://www.chainguard.dev/unchained/stay-secure-strategies-and-tooling-for-updating-container-images' + - path: '/chainguard/containers/staying-secure/updating-images/strategies-tools-updating-images' + to: 'https://www.chainguard.dev/unchained/stay-secure-strategies-and-tooling-for-updating-container-images' + - path: '/chainguard/containers/staying-secure/updating-images/strategies-tools-updating-images/' + to: 'https://www.chainguard.dev/unchained/stay-secure-strategies-and-tooling-for-updating-container-images' + - path: '/chainguard/containers/staying-secure/updating-containers/strategies-tools-updating-images' + to: 'https://www.chainguard.dev/unchained/stay-secure-strategies-and-tooling-for-updating-container-images' + - path: '/chainguard/containers/staying-secure/updating-containers/strategies-tools-updating-images/' + to: 'https://www.chainguard.dev/unchained/stay-secure-strategies-and-tooling-for-updating-container-images' + - path: '/chainguard/chainguard-images/recommended-practices/how-eol-software-accumulates-cves' + to: 'https://www.chainguard.dev/unchained/why-end-of-life-software-means-400-cves-per-year' + - path: '/chainguard/chainguard-images/recommended-practices/how-eol-software-accumulates-cves/' + to: 'https://www.chainguard.dev/unchained/why-end-of-life-software-means-400-cves-per-year' + - path: '/chainguard/chainguard-images/staying-secure/updating-images/how-eol-software-accumulates-cves' + to: 'https://www.chainguard.dev/unchained/why-end-of-life-software-means-400-cves-per-year' + - path: '/chainguard/chainguard-images/staying-secure/updating-images/how-eol-software-accumulates-cves/' + to: 'https://www.chainguard.dev/unchained/why-end-of-life-software-means-400-cves-per-year' + - path: '/chainguard/containers/recommended-practices/how-eol-software-accumulates-cves' + to: 'https://www.chainguard.dev/unchained/why-end-of-life-software-means-400-cves-per-year' + - path: '/chainguard/containers/recommended-practices/how-eol-software-accumulates-cves/' + to: 'https://www.chainguard.dev/unchained/why-end-of-life-software-means-400-cves-per-year' + - path: '/chainguard/containers/staying-secure/updating-images/how-eol-software-accumulates-cves' + to: 'https://www.chainguard.dev/unchained/why-end-of-life-software-means-400-cves-per-year' + - path: '/chainguard/containers/staying-secure/updating-images/how-eol-software-accumulates-cves/' + to: 'https://www.chainguard.dev/unchained/why-end-of-life-software-means-400-cves-per-year' + - path: '/chainguard/containers/staying-secure/updating-containers/how-eol-software-accumulates-cves' + to: 'https://www.chainguard.dev/unchained/why-end-of-life-software-means-400-cves-per-year' + - path: '/chainguard/containers/staying-secure/updating-containers/how-eol-software-accumulates-cves/' + to: 'https://www.chainguard.dev/unchained/why-end-of-life-software-means-400-cves-per-year' + # Section roots that redirect away. Each is anchored so it matches only + # itself and its index files: the cves section is now empty, and the + # project sections under /open-source/ keep their own URLs. + - regex: '^/software-security/cves/?(index\.html|index\.xml)?$' + to: 'https://www.chainguard.dev/supply-chain-security-101/what-is-a-cve' + - regex: '^/open-source/?(index\.html|index\.xml)?$' + to: 'https://www.chainguard.dev/supply-chain-security-101/what-is-chainguard' + + # Contributor list pages, which Hugo generated from the "contributors" + # taxonomy until it was removed (DOCS-269). Bylines still read the + # "contributors" front matter; they never linked to these pages. + - regex: '^/contributors(/.*)?$' + to: 'https://www.chainguard.dev/about-us' diff --git a/nginx.conf b/nginx.conf index cdb02f0ce9..dece718ffd 100644 --- a/nginx.conf +++ b/nginx.conf @@ -38,6 +38,12 @@ http { image/svg+xml; + # Exact-path rules from data/redirects.yaml go into the redirect map's + # hash. The default bucket, 64 bytes on most CPUs, cannot hold a long + # docs path, and nginx refuses to start. Regex rules are not hashed. + # This must come before the first map block. + map_hash_bucket_size 128; + # Key the redirect map on the request path with the query string removed. # $request_uri carries the query, and nearly every rule below ends in $1, # so matching $request_uri put the query inside $redirect_url -- and the