From c6d322639969d755d6d07e5b234ba866673ba097 Mon Sep 17 00:00:00 2001 From: Joe VanWanzeele Date: Wed, 11 Dec 2024 16:22:57 -0500 Subject: [PATCH 1/5] flattening exceptions --- AzureKeyVault/Jobs/Discovery.cs | 2 +- AzureKeyVault/Jobs/Inventory.cs | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/AzureKeyVault/Jobs/Discovery.cs b/AzureKeyVault/Jobs/Discovery.cs index 1dc4233..923ea9e 100644 --- a/AzureKeyVault/Jobs/Discovery.cs +++ b/AzureKeyVault/Jobs/Discovery.cs @@ -41,7 +41,7 @@ public JobResult ProcessJob(DiscoveryJobConfiguration config, SubmitDiscoveryUpd } catch (Exception ex) { - complete.FailureMessage = ex.Message; + complete.FailureMessage = LogHandler.FlattenException(ex); return complete; } diff --git a/AzureKeyVault/Jobs/Inventory.cs b/AzureKeyVault/Jobs/Inventory.cs index d0783a2..e1e9237 100644 --- a/AzureKeyVault/Jobs/Inventory.cs +++ b/AzureKeyVault/Jobs/Inventory.cs @@ -24,7 +24,7 @@ public Inventory(IPAMSecretResolver resolver) PamSecretResolver = resolver; logger = LogHandler.GetClassLogger(); } - + public JobResult ProcessJob(InventoryJobConfiguration config, SubmitInventoryUpdate callBack) { logger.LogDebug($"Begin Inventory..."); @@ -44,7 +44,7 @@ public JobResult ProcessJob(InventoryJobConfiguration config, SubmitInventoryUpd catch (Exception ex) { - logger.LogTrace($"an error occured when performing inventory: {ex.Message}"); + logger.LogTrace($"an error occured when performing inventory: {LogHandler.FlattenException(ex)}"); return new JobResult { Result = OrchestratorJobStatusJobResult.Failure, From e5e6832e8337e16c875988a07795ff0233be592a Mon Sep 17 00:00:00 2001 From: Joe VanWanzeele Date: Wed, 18 Dec 2024 11:46:43 -0500 Subject: [PATCH 2/5] Adding "DisableChallengeResourceVerification = true" to prevent the cert client from failing behind a proxy. --- AzureKeyVault/AzureClient.cs | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/AzureKeyVault/AzureClient.cs b/AzureKeyVault/AzureClient.cs index 8bd0a7f..bccf458 100644 --- a/AzureKeyVault/AzureClient.cs +++ b/AzureKeyVault/AzureClient.cs @@ -81,7 +81,8 @@ private protected virtual CertificateClient CertClient cred = new ClientSecretCredential(VaultProperties.TenantId, VaultProperties.ClientId, VaultProperties.ClientSecret, new ClientSecretCredentialOptions() { AuthorityHost = AzureCloudEndpoint, AdditionallyAllowedTenants = { "*" } }); logger.LogTrace("generated credentials"); } - _certClient = new CertificateClient(new Uri(VaultProperties.VaultURL), credential: cred); + var certClientOptions = new CertificateClientOptions() { DisableChallengeResourceVerification = true }; // without this, requests fail when running behind a proxy https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/keyvault/TROUBLESHOOTING.md#incorrect-challenge-resource + _certClient = new CertificateClient(new Uri(VaultProperties.VaultURL), credential: cred, certClientOptions); return _certClient; } @@ -111,7 +112,7 @@ internal protected virtual ArmClient getArmClient(string tenantId) logger.LogTrace("got credentials for service principal identity"); } - _mgmtClient = new ArmClient(credential); + _mgmtClient = new ArmClient(credential, VaultProperties.SubscriptionId, new ArmClientOptions() { }); logger.LogTrace("created management client"); return _mgmtClient; } @@ -219,10 +220,7 @@ public virtual async Task ImportCertificateAsync( logger.LogTrace($"importing created x509 certificate named {1}", certName); logger.LogTrace($"There are {x509Collection.Count} certificates in the chain."); var cert = await CertClient.ImportCertificateAsync(new ImportCertificateOptions(certName, certWithKey)); - - // var fullCert = _secretClient.GetSecret(certName); - // The certificate must be retrieved as a secret from AKV in order to have the full chain included. - + return cert; } catch (Exception ex) @@ -278,8 +276,9 @@ public virtual async Task> GetCertificatesAsyn var fullInventoryList = new List(); var failedCount = 0; Exception innerException = null; - - await foreach (var cert in inventory) { + + await foreach (var cert in inventory) + { logger.LogTrace($"adding cert with ID: {cert.Id} to the list."); fullInventoryList.Add(cert); // convert to list from pages } @@ -300,23 +299,25 @@ public virtual async Task> GetCertificatesAsyn PrivateKeyEntry = true, ItemStatus = OrchestratorInventoryItemStatus.Unknown, UseChainLevel = true, - Certificates = new List() { Convert.ToBase64String(cert.Value.Cer) } + Certificates = new List() { Convert.ToBase64String(cert.Value.Cer) } }); } catch (Exception ex) { failedCount++; innerException = ex; - logger.LogError($"Failed to retreive details for certificate {certificate.Name}. Exception: {ex.Message}"); + logger.LogError($"Failed to retreive details for certificate {certificate.Name}. Exception: {ex.Message}"); // continuing with inventory instead of throwing, in case there's an issue with a single certificate } } - if (failedCount == fullInventoryList.Count()) { + if (failedCount == fullInventoryList.Count()) + { throw new Exception("Unable to retreive details for certificates.", innerException); } - if (failedCount > 0) { + if (failedCount > 0) + { logger.LogWarning($"{failedCount} of {fullInventoryList.Count()} certificates were not able to be retreieved. Please review the errors."); } From 4692f3fa341a1da5dd77842863cb778d725cfb7a Mon Sep 17 00:00:00 2001 From: Lee Fine Date: Tue, 31 Dec 2024 16:09:47 +0000 Subject: [PATCH 3/5] dual build and doctool --- ...low.yml => keyfactor-starter-workflow.yml} | 5 +- AzureKeyVault/AzureKeyVault.csproj | 8 +- CHANGELOG.md | 2 + docsource/akv.md | 1 + readme_source.md => docsource/content.md | 201 +----------------- integration-manifest.json | 86 ++++---- readme-src/readme-pam-support.md | 4 - readme-src/store-types-tables.md | 56 ----- 8 files changed, 63 insertions(+), 300 deletions(-) rename .github/workflows/{keyfactor-bootstrap-workflow.yml => keyfactor-starter-workflow.yml} (73%) create mode 100644 docsource/akv.md rename readme_source.md => docsource/content.md (68%) delete mode 100644 readme-src/readme-pam-support.md delete mode 100644 readme-src/store-types-tables.md diff --git a/.github/workflows/keyfactor-bootstrap-workflow.yml b/.github/workflows/keyfactor-starter-workflow.yml similarity index 73% rename from .github/workflows/keyfactor-bootstrap-workflow.yml rename to .github/workflows/keyfactor-starter-workflow.yml index 6d8de53..61ea7a0 100644 --- a/.github/workflows/keyfactor-bootstrap-workflow.yml +++ b/.github/workflows/keyfactor-starter-workflow.yml @@ -1,4 +1,4 @@ -name: Keyfactor Bootstrap Workflow +name: Keyfactor Bootstrap Workflow on: workflow_dispatch: @@ -11,9 +11,10 @@ on: jobs: call-starter-workflow: - uses: keyfactor/actions/.github/workflows/starter.yml@v2 + uses: keyfactor/actions/.github/workflows/starter.yml@3.1.2 secrets: token: ${{ secrets.V2BUILDTOKEN}} APPROVE_README_PUSH: ${{ secrets.APPROVE_README_PUSH}} gpg_key: ${{ secrets.KF_GPG_PRIVATE_KEY }} gpg_pass: ${{ secrets.KF_GPG_PASSPHRASE }} + scan_token: ${{ secrets.SAST_TOKEN }} diff --git a/AzureKeyVault/AzureKeyVault.csproj b/AzureKeyVault/AzureKeyVault.csproj index be88991..d10b8c5 100644 --- a/AzureKeyVault/AzureKeyVault.csproj +++ b/AzureKeyVault/AzureKeyVault.csproj @@ -1,16 +1,16 @@  - netcoreapp3.1 + net6.0;net8.0 Keyfactor.Extensions.Orchestrators.AKV Keyfactor.Extensions.Orchestrator.AzureKeyVault true - false + disable + false https://apache.org/licenses/LICENSE-2.0 - false - false + true diff --git a/CHANGELOG.md b/CHANGELOG.md index a4ecb84..c020dce 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,8 @@ - 3.1.6 - Preventing CertStore parameters from getting used if present but empty. - Improved trace logging + - Convert to .net6/8 dual build + - Update README to use doctool - 3.1.5 - Bug fix for error when adding new cert and overwrite is unchecked diff --git a/docsource/akv.md b/docsource/akv.md new file mode 100644 index 0000000..0aa5d83 --- /dev/null +++ b/docsource/akv.md @@ -0,0 +1 @@ +## Overview \ No newline at end of file diff --git a/readme_source.md b/docsource/content.md similarity index 68% rename from readme_source.md rename to docsource/content.md index 10ee803..5f5c7be 100644 --- a/readme_source.md +++ b/docsource/content.md @@ -1,75 +1,9 @@ -## Setup and Configuration +## Overview -The high level steps required to configure the Azure Keyvault Orchestrator extension are: +This integration allows the orchestrator to act as a client with access to an instance of the Azure Key Vault; allowing you to manage your certificates stored in the Azure Keyvault via Keyfactor. -1) [Migrating from the Windows Orchestrator for Azure KeyVault](#migrating-from-the-windows-orchestrator-for-azure-keyvault) -1) [Configure the Azure Keyvault for client access](#configure-the-azure-keyvault-for-client-access) - -1) [Create the Store Type in Keyfactor](#create-the-store-type-in-keyfactor) - -1) [Install the Extension on the Orchestrator](#install-the-extension-on-the-orchestrator) - -1) [Create the Certificate Store](#create-the-certificate-store) - -_Note that the certificate store type used by this Universal Orchestrator support for Azure Keyvault is not compatible with the certificate store type used by with Windows Orchestrator version for Azure Keyvault. -If your Keyfactor instance has used the Windows Orchestrator for Azure Keyvault, a specific migration process is required. -See [Migrating from the Windows Orchestrator for Azure KeyVault](#migrating-from-the-windows-orchestrator-for-azure-keyvault) section below._ - -

Migrating from the Windows Orchestrator for Azure KeyVault

 -If you were previously using the Azure Keyvault extension for the **Windows** Orchestrator, it is necessary to remove the Store Type definition as well as any Certificate stores that use the previous store type. -This is because the store type parameters have changed in order to facilitate the Discovery and Create functionality. - -If you have an existing AKV store type that was created for use with the Windows Orchestrator, you will need to follow the steps in one of the below sections in order to transfer the capability to the Universal Orchestrator. - -> :warning: -> Before removing the certificate stores, view their configuration details and copy the values. -> Copying the values in the store parameters will save time when re-creating the stores. - -Follow the below steps to remove the AKV capability from **each** active Windows Orchestrator that supports it: - -#### If the Windows Orchestrator should still manage other cert store types - -_If the Windows Orchestrator will still be used to manage some store types, we will remove only the Azure Keyvault functionality._ - -1) On the Windows Orchestrator host machine, run the Keyfactor Agent Configuration Wizard -1) Proceed through the steps to "Select Features" -1) Expand "Cert Stores" and un-check "Azure Keyvault" -1) Click "Apply Configuration" - -1) Open the Keyfactor Platform and navigate to **Orchestrators > Management** -1) Confirm that "AKV" no longer appears under "Capabilities" -1) Navigate to **Orchestrators > Management**, select the orchestrator and click "DISAPPROVE" to disapprove it and cancel pending jobs. -1) Navigate to **Locations > Certificate Stores** -1) Select any stores with the Category "Azure Keyvault" and click "DELETE" to remove them from Keyfactor. -1) Navigate to the Administrative menu (gear icon) and then **> Certificate Store Types** -1) Select Azure Keyvault, click "DELETE" and confirm. -1) Navigate to **Orchestrators > Management**, select the orchestrator and click "APPROVE" to re-approve it for use. - -1) Repeat these steps for any other Windows Orchestrators that support the AKV store type. - -#### If the Windows Orchestrator can be retired completely - -_If the Windows Orchestrator is being completely replaced with the Universal Orchestrator, we can remove all associated stores and jobs._ - -1) Navigate to **Orchestrators > Management** and select the Windows Orchestrator from the list. -1) With the orchestrator selected, click the "RESET" button at the top of the list -1) Make sure the orchestrator is still selected, and click "DISAPPROVE". -1) Click "OK" to confirm that you will remove all jobs and certificate stores associated to this orchestrator. -1) Navigate to the the Administrative (gear icon in the top right) and then **Certificate Store Types** -1) Select "Azure Keyvault", click "DELETE" and confirm. -1) Repeat these steps for any other Windows Orchestrators that support the AKV store type (if they can also be retired). - -Note: Any Azure Keyvault certificate stores removed can be re-added once the Universal Orchestrator is configured with the AKV capability. - -### Migrating from version 1.x or version 2.x of the Azure Keyvault Orchestrator Extension - -It is not necessary to re-create all of the certificate stores when migrating from a previous version of this extension, though it is important to note that Azure KeyVaults found during a Discovery job -will return with latest store path format: `{subscription id}:{resource group name}:{new vault name}`. - -
- ---- +## Requirements ### Configure the Azure Keyvault for client access @@ -389,90 +323,8 @@ Once the User Assigned managed identity has been created, you will need only to In order to use a _System_ assigned managed identity, there is no need to enter the server credentials. If no server credentials are provided, the extension assumes authentication is via system assigned managed identity. -### Create the Store Type in Keyfactor - -Now we can navigate to the Keyfactor platform and create the store type for Azure Key Vault. - -1) Navigate to your instance of Keyfactor and log in with a user that has Administrator privileges. - -1) Click on the gear icon in the top left and navigate to "Certificate Store Types". - - ![Cert Store Types Menu](/Images/cert-store-types-menu.png) - -1) Click "Add" to open the Add Certificate Store dialog. - -1) Name the new store type "Azure Keyvault" and give it the short name of "AKV". - -1) The Azure Keyvault integration supports the following job types: _Inventory, Add, Remove, Create and Discovery_. Select from these the capabilities you would like to utilize. - -> :warning: The store type definition needs to include the necessary fields to support Create functionality (SkuType and VaultRegion). Be sure to read through the _Custom Fields_ instructions below and set them up with the required fields if Creating new Azure Keyvaults from Keyfactor Command is desired. - -1) **If you are using a Service Principal or User assigned Managed Identity only** Make sure that "Needs Server" is checked. - - ![Cert Store Types Menu](/Images/cert-store-type.png) - -> :warning: -> if you are using a system assigned managed identity for authentication, you should leave this unchecked. - -1) Navigate to the _Advanced_ tab and set the following values: - - Store Path Type: **Freeform** - - Supports Custom Alias: **Optional** - - Private Key Handling: **Optional** - - PFX Password Style: **Default** - - ![Cert Store Types Menu](/Images/store-type-fields-advanced.png) - -1) Navigate to the _Custom Fields_ tab and add the custom fields for the store type. -> :warning: If you are using the Global Public cloud (*.vault.azure.net) and creating new Azure -> Keyvaults from Keyfactor Command functionality is not necessary for your workflow, this section can -> be skipped entirely. - -- The below two fields are necessary if working with Keyvaults in Azure Cloud instances that are not the standard global public one (*.vault.azure.net) If your vault instance(s) have the base url of `.vault.azure.net` then the next two fields can be omitted from the store type definition and the default global public cloud will be assumed. -- - The "Azure Cloud" field refers to - -| Name | Display Name | Type | Required | -| ---- | ------------ | ---- | -------- | -| AzureCloud[^azurecloud] | Azure Cloud | MultipleChoice | false | -| PrivateEndpoint[^privateEndpoint] | Private Endpoint | String | false | - -[^azurecloud]: The Azure Cloud field, if necessary, should contain one of the following values: "china, germany, government". This is the Azure Cloud instance your organization uses. If using the standard "public" cloud, this field can be left blank or omitted entirely from the store type definition. - -[^privateEndpoint]: The Private Endpoint field should be used if you if have a custom url assigned to your keyvault resources and they are not accessible via the standard endpoint associated with the Azure Cloud instance (*.vault.azure.net, *.vault.azure.cn, etc.). This field should contain the base url for your vault instance(s), excluding the vault name. - -- The following fields are _only_ necessary in order to support creating new Azure Keyvaults from the Keyfactor Command platform. If this functionality is not needed, there is no need to set up these fields. - -| Name | Display Name | Type | Required | -| ---- | ------------ | ---- | -------- | -| TenantId | Tenant Id | String | false | -| SkuType[^sku] | SKU Type | MultipleChoice | false | -| VaultRegion[^vaultregion] | Vault Region | MultipleChoice | false | - -[^sku]: The SkuType determines the service tier when creating a new instance of Azure KeyVault via the platform. Valid values include "premium" and "standard". - If either option should be available when creating a new KeyVault from the Command platform via creating a new certificate store, then the value to enter for the multiple choice options should be "standard,premium". - If your organization requires that one or the other option should always be used, you can limit the options to a single value ("premium" or "standard"). If not selected, "standard" is used when creating a new KeyVault. - -[^vaultregion]: The Vault Region field is only important when creating a new Azure KeyVault from the Command Platform. This is the region that the newly created vault will be created in. When creating the cert store type, - you can limit the options to those that should be applicable to your organization. Refer to the [Azure Documentation](https://learn.microsoft.com/en-us/dotnet/api/azure.core.azurelocation?view=azure-dotnethttps://learn.microsoft.com/en-us/dotnet/api/azure.core.azurelocation?view=azure-dotnet) for a list of valid region names. - If no value is selected, "eastus" is used by default. - -### Install the Extension on the Orchestrator - -The process for installing an extension for the universal orchestrator differs from the process of installing an extension for the Windows orchestrator. Follow the below steps to register the Azure Keyvault integration with your instance of the universal orchestrator. - -1) Stop the Universal Orchestrator service. - - 1) Note: In Windows, this service is called "Keyfactor Orchestrator Service (Default)" - -1) Create a folder in the "extensions" folder of the Universal Orchestrator installation folder named "AKV" (the name is not important) - - 1) example: `C:\Program Files\Keyfactor\Keyfactor Orchestrator\extensions\_AKV_ - -1) Copy the build output (if you compiled from source) or the contents of the zip file (if you downloaded the pre-compiled binaries) into this folder. - -1) Start the Universal Orchestrator Service - -### Discover Certificate Stores +## Discovery Now that we have the extension registered on the Orchestrator, we can navigate back to the Keyfactor platform and finish the setup. If there are existing Azure Key Vaults, complete the below steps to discover and add them. If there are no existing key vaults to integrate and you will be creating a new one via the Keyfactor Platform, you can skip to the next section. @@ -584,48 +436,3 @@ To add one of these results to Keyfactor as a certificate store: 1) Select any value for SKU Type and Vault Region. These values are not used for existing KeyVaults. 1) Click "SAVE". - -### Add a new or existing Azure Keyvault certificate store - -You can also add a certificate store that corresponds to an Azure Keyvault individually without the need to run the discovery / approval workflow. -The steps to do this are: - -1) Navigate to "Locations > Certificate Stores" - -1) Click "ADD" - - ![Approve Cert Store](/Images/cert-store-add-button.png) - -1) Enter the values corresponding to the Azure Keyvault instance. - -- **Category**: Azure Keyvault -- **Container**: _optional_ -- **Client Machine**: If applicable; Tenant Id. - - - Note: These will only have to be entered once, even if adding multiple certificate stores. - - Follow the steps [here](#store-the-server-credentials-in-keyfactor) to enter them. - -- **Store Path**: This is the Subscription ID, Resource Group name, and Vault name in the following format: `{subscription id}:{resource group name}:{new vault name}` - -- **SKU Type**: This field is only used when creating new vaults in Azure. If present, select any value, or leave blank. -- **Vault Region**: This field is also only used when creating new vaults. If present, select any value. - -If the vault already exists in azure the store path can be found by navigating to the existing Keyvault resource in Azure and clicking "Properties" in the left menu. - -![Resource Id](/Images/resource-id.png) - -- Use these values to create the store path - -If the Keyvault does not exist in Azure, and you would like to create it: - -- Enter a value for the store path in the following format: `{subscription id}:{resource group name}:{new vault name}` - -- For a non-existing Keyvault that you would like to create in Azure, make sure you have the "Create Certificate Store" box checked. - -> :warning: The identity you are using for authentication will need to have sufficient Azure permissions to be able to create new Keyvaults. - ---- - -### License - -[Apache](https://apache.org/licenses/LICENSE-2.0) diff --git a/integration-manifest.json b/integration-manifest.json index b9bd89e..528df97 100644 --- a/integration-manifest.json +++ b/integration-manifest.json @@ -5,7 +5,8 @@ "status": "production", "update_catalog": true, "link_github": true, - "release_dir": "AzureKeyVault\\bin\\Release", + "release_dir": "AzureKeyVault/bin/Release", + "release_project": "AzureKeyVault/AzureKeyVault.csproj", "support_level": "kf-supported", "description": "This integration allows the orchestrator to act as a client with access to an instance of the Azure Key Vault; allowing you to manage your certificates stored in the Azure Keyvault via Keyfactor.", "about": { @@ -13,33 +14,24 @@ "UOFramework": "10.1", "keyfactor_platform_version": "10.0", "pam_support": true, - "win": { - "supportsCreateStore": true, - "supportsDiscovery": true, - "supportsManagementAdd": true, - "supportsManagementRemove": true, - "supportsReenrollment": false, - "supportsInventory": true, - "platformSupport": "Unused" - }, - "linux": { - "supportsCreateStore": true, - "supportsDiscovery": true, - "supportsManagementAdd": true, - "supportsManagementRemove": true, - "supportsReenrollment": false, - "supportsInventory": true, - "platformSupport": "Unused" - }, "store_types": [ { + "Name": "Azure Keyvault", + "ShortName": "AKV", + "SupportedOperations": { + "Add": true, + "Create": true, + "Discovery": true, + "Enrollment": false, + "Remove": true + }, + "ServerRequired": true, "BlueprintAllowed": false, "Capability": "AKV", "CustomAliasAllowed": "Optional", "EntryParameters": [], "JobProperties": [], "LocalStore": false, - "Name": "Azure Keyvault", "PasswordOptions": { "EntrySupported": false, "StoreRequired": false, @@ -48,58 +40,78 @@ "PowerShell": false, "PrivateKeyAllowed": "Optional", "Properties": [ + { + "Name": "ServerUsername", + "DisplayName": "Server Username", + "Type": "Secret", + "DependsOn": "", + "DefaultValue": "", + "Required": true, + "IsPAMEligible": true, + "Description": "The application (service principal) ID that will be used to authenticate to Azure" + }, + { + "Name": "ServerPassword", + "DisplayName": "Server Password", + "Type": "Secret", + "DependsOn": "", + "DefaultValue": "", + "Required": true, + "IsPAMEligible": true, + "Description": "The client secret that will be used to authenticate into Azure" + }, { "Name": "TenantId", "DisplayName": "Tenant Id", "Type": "String", "DependsOn": "", - "Required": false + "IsPAMEligible": false, + "Required": false, + "Description": "Tenant ID of new Azure Keyvault being created. Not required if not creating new Keyvault." }, { "Name": "SkuType", "DisplayName": "SKU Type", "Type": "MultipleChoice", "DependsOn": "", + "IsPAMEligible": false, "DefaultValue": "standard,premium", - "Required": false + "Required": false, + "Description": "The SkuType determines the service tier when creating a new instance of Azure KeyVault via the platform. Valid values include 'premium' and 'standard'. If either option should be available when creating a new KeyVault from the Command platform via creating a new certificate store, then the value to enter for the multiple choice options should be 'standard,premium'. If your organization requires that one or the other option should always be used, you can limit the options to a single value ('premium' or 'standard'). If not selected, 'standard' is used when creating a new KeyVault. Not required if not creating a new Keyvault." }, { "Name": "VaultRegion", "DisplayName": "Vault Region", "Type": "MultipleChoice", "DependsOn": "", + "IsPAMEligible": false, "DefaultValue": "eastus,eastus2,westus2,westus3,westus", - "Required": false + "Required": false, + "Description": "The Vault Region field is only important when creating a new Azure KeyVault from the Command Platform. This is the region that the newly created vault will be created in. When creating the cert store type, you can limit the options to those that should be applicable to your organization. Refer to the [Azure Documentation](https://learn.microsoft.com/en-us/dotnet/api/azure.core.azurelocation?view=azure-dotnethttps://learn.microsoft.com/en-us/dotnet/api/azure.core.azurelocation?view=azure-dotnet) for a list of valid region names. If no value is selected, 'eastus' is used by default. Not required if not creating a new Keyvault." }, { "Name": "AzureCloud", "DisplayName": "Azure Cloud", "Type": "MultipleChoice", "DependsOn": "", + "IsPAMEligible": false, "DefaultValue": "public,china,government", - "Required": false + "Required": false, + "Description": "The Azure Cloud field, if necessary, should contain one of the following values: china, germany, government. This is the Azure Cloud instance your organization uses. If using the standard 'public' cloud, this field can be left blank or omitted entirely from the store type definition." }, { "Name": "PrivateEndpoint", "DisplayName": "Private KeyVault Endpoint", "Type": "String", "DependsOn": "", - "Required": false + "IsPAMEligible": false, + "Required": false, + "Description": "The Private Endpoint field should be used if you if have a custom url assigned to your keyvault resources and they are not accessible via the standard endpoint associated with the Azure Cloud instance (*.vault.azure.net, *.vault.azure.cn, etc.). This field should contain the base url for your vault instance(s), excluding the vault name." } ], - "ServerRequired": true, - "ShortName": "AKV", - "StorePathType": "", - "StorePathValue": "", - "SupportedOperations": { - "Add": true, - "Create": true, - "Discovery": true, - "Enrollment": false, - "Remove": true - } + "ClientMachineDescription": "The Tenant Id of the Azure Keyvault being managed.", + "StorePathDescription": "The store path of each vault is the Subscription ID, Resource Group name, and Vault name in the following format: `{subscription id}:{resource group name}:{new vault name}." } - ] } } diff --git a/readme-src/readme-pam-support.md b/readme-src/readme-pam-support.md deleted file mode 100644 index f492e60..0000000 --- a/readme-src/readme-pam-support.md +++ /dev/null @@ -1,4 +0,0 @@ -|Name|Description| -|----|-----------| -|Server Username|The application (service principal) ID that will be used to authenticate to Azure| -|Server Password|The client secret that will be used to authenticate into Azure| diff --git a/readme-src/store-types-tables.md b/readme-src/store-types-tables.md deleted file mode 100644 index f216f3a..0000000 --- a/readme-src/store-types-tables.md +++ /dev/null @@ -1,56 +0,0 @@ - -### Azure Keyvault Store Type -#### kfutil Create Azure Keyvault Store Type -The following commands can be used with [kfutil](https://github.com/Keyfactor/kfutil). Please refer to the kfutil documentation for more information on how to use the tool to interact w/ Keyfactor Command. - -``` -bash -kfutil login -kfutil store - types create--name Azure Keyvault -``` - -#### UI Configuration -##### UI Basic Tab -| Field Name | Required | Value | -|-------------------------|----------|-------------------------------------------| -| Name | ✓ | Azure Keyvault | -| ShortName | ✓ | AKV | -| Custom Capability | | Unchecked [ ] | -| Supported Job Types | ✓ | Inventory,Add,Create,Discovery,Remove | -| Needs Server | ✓ | Checked [x] | -| Blueprint Allowed | | Unchecked [ ] | -| Uses PowerShell | | Unchecked [ ] | -| Requires Store Password | | Unchecked [ ] | -| Supports Entry Password | | Unchecked [ ] | - -![akv_basic.png](docs%2Fscreenshots%2Fstore_types%2Fakv_basic.png) - -##### UI Advanced Tab -| Field Name | Required | Value | -|-----------------------|----------|-----------------------| -| Store Path Type | | Freeform | -| Supports Custom Alias | | Optional | -| Private Key Handling | | Optional | -| PFX Password Style | | Default | - -![akv_advanced.png](docs%2Fscreenshots%2Fstore_types%2Fakv_advanced.png) - -##### UI Custom Fields Tab -| Name | Display Name | Type | Required | Default Value | -| -------------- | -------------------- | ------ | -------- | ------------- | -|VaultName|VaultName|String|null|true| -|ResourceGroupName|ResourceGroupName|String|null|true| -|SkuType|SKU Type|MultipleChoice|standard,premium|false| -|VaultRegion|Vault Region|MultipleChoice|eastus,eastus2,southcentralus,westus2,westus3,australiaeast,northeurope,swedencentral,uksouth,westeurope,centralus,southafricanorth,centralindia,eastasia,japaneast,koreacentral,canadacentral,francecentral,germanywestcentral,norwayeast,switzerlandnorth,uaenorth,brazilsouth,centraluseuap,eastus2euap,qatarcentral,centralusstage,eastusstage,eastus2stage,northcentralusstage,westusstage,asia,asiapacific,australia,brazil,canada,europe,france,germany,global,india,japan,korea,norway,singapore,southafrica,switzerland,uae,uk,unitedstates,unitedstatesuap,eastasiastage,southeastasiastage,brazilus,eastusstg,northcentralus,westus,jioindiawest,devfabric,westcentralus,southafricawest,australiacentral,australiacentral2,australiasoutheast,japanwest,jioindiacentral,koreasouth,southindia,westindia,canadaeast,francesouth,germanynorth,norwaywest,switzerlandwest,ukwest,uaecentral,brazilsoutheast|false| -|AzureCloud|Azure Cloud|MultipleChoice|public,china,germany,government|false| -|PrivateEndpoint|Private KeyVault Endpoint|String|null|false| - - -**Entry Parameters:** - -Entry parameters are inventoried and maintained for each entry within a certificate store. -They are typically used to support binding of a certificate to a resource. - -|Name|Display Name| Type|Default Value|Required When | -|----|------------|-----|-------------|--------------| - From faa0275322e7b4b67f7bbfe0389357500e8d5052 Mon Sep 17 00:00:00 2001 From: Keyfactor Date: Tue, 31 Dec 2024 16:10:36 +0000 Subject: [PATCH 4/5] Update generated docs --- README.md | 484 ++++++++++++++++++++++++++---------------------------- 1 file changed, 231 insertions(+), 253 deletions(-) diff --git a/README.md b/README.md index 09277d4..abed6c1 100644 --- a/README.md +++ b/README.md @@ -1,174 +1,53 @@ - -# Azure Key Vault Orchestrator - -This integration allows the orchestrator to act as a client with access to an instance of the Azure Key Vault; allowing you to manage your certificates stored in the Azure Keyvault via Keyfactor. - -#### Integration status: Production - Ready for use in production environments. - -## About the Keyfactor Universal Orchestrator Extension - -This repository contains a Universal Orchestrator Extension which is a plugin to the Keyfactor Universal Orchestrator. Within the Keyfactor Platform, Orchestrators are used to manage “certificate stores” — collections of certificates and roots of trust that are found within and used by various applications. - -The Universal Orchestrator is part of the Keyfactor software distribution and is available via the Keyfactor customer portal. For general instructions on installing Extensions, see the “Keyfactor Command Orchestrator Installation and Configuration Guide” section of the Keyfactor documentation. For configuration details of this specific Extension see below in this readme. - -The Universal Orchestrator is the successor to the Windows Orchestrator. This Orchestrator Extension plugin only works with the Universal Orchestrator and does not work with the Windows Orchestrator. - -## Support for Azure Key Vault Orchestrator - -Azure Key Vault Orchestrator is supported by Keyfactor for Keyfactor customers. If you have a support issue, please open a support ticket via the Keyfactor Support Portal at https://support.keyfactor.com - -###### To report a problem or suggest a new feature, use the **[Issues](../../issues)** tab. If you want to contribute actual bug fixes or proposed enhancements, use the **[Pull requests](../../pulls)** tab. - ---- - - ---- - - - -## Keyfactor Version Supported - -The minimum version of the Keyfactor Universal Orchestrator Framework needed to run this version of the extension is 10.1 -## Platform Specific Notes - -The Keyfactor Universal Orchestrator may be installed on either Windows or Linux based platforms. The certificate operations supported by a capability may vary based what platform the capability is installed on. The table below indicates what capabilities are supported based on which platform the encompassing Universal Orchestrator is running. -| Operation | Win | Linux | -|-----|-----|------| -|Supports Management Add|✓ |✓ | -|Supports Management Remove|✓ |✓ | -|Supports Create Store|✓ |✓ | -|Supports Discovery|✓ |✓ | -|Supports Reenrollment| | | -|Supports Inventory|✓ |✓ | - - -## PAM Integration - -This orchestrator extension has the ability to connect to a variety of supported PAM providers to allow for the retrieval of various client hosted secrets right from the orchestrator server itself. This eliminates the need to set up the PAM integration on Keyfactor Command which may be in an environment that the client does not want to have access to their PAM provider. - -The secrets that this orchestrator extension supports for use with a PAM Provider are: - -|Name|Description| -|----|-----------| -|Server Username|The application (service principal) ID that will be used to authenticate to Azure| -|Server Password|The client secret that will be used to authenticate into Azure| - -It is not necessary to use a PAM Provider for all of the secrets available above. If a PAM Provider should not be used, simply enter in the actual value to be used, as normal. - -If a PAM Provider will be used for one of the fields above, start by referencing the [Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam). The GitHub repo for the PAM Provider to be used contains important information such as the format of the `json` needed. What follows is an example but does not reflect the `json` values for all PAM Providers as they have different "instance" and "initialization" parameter names and values. - -
General PAM Provider Configuration -

- - - -### Example PAM Provider Setup - -To use a PAM Provider to resolve a field, in this example the __Server Password__ will be resolved by the `Hashicorp-Vault` provider, first install the PAM Provider extension from the [Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam) on the Universal Orchestrator. - -Next, complete configuration of the PAM Provider on the UO by editing the `manifest.json` of the __PAM Provider__ (e.g. located at extensions/Hashicorp-Vault/manifest.json). The "initialization" parameters need to be entered here: - -~~~ json - "Keyfactor:PAMProviders:Hashicorp-Vault:InitializationInfo": { - "Host": "http://127.0.0.1:8200", - "Path": "v1/secret/data", - "Token": "xxxxxx" - } -~~~ - -After these values are entered, the Orchestrator needs to be restarted to pick up the configuration. Now the PAM Provider can be used on other Orchestrator Extensions. - -### Use the PAM Provider -With the PAM Provider configured as an extenion on the UO, a `json` object can be passed instead of an actual value to resolve the field with a PAM Provider. Consult the [Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam) for the specific format of the `json` object. - -To have the __Server Password__ field resolved by the `Hashicorp-Vault` provider, the corresponding `json` object from the `Hashicorp-Vault` extension needs to be copied and filed in with the correct information: - -~~~ json -{"Secret":"my-kv-secret","Key":"myServerPassword"} -~~~ - -This text would be entered in as the value for the __Server Password__, instead of entering in the actual password. The Orchestrator will attempt to use the PAM Provider to retrieve the __Server Password__. If PAM should not be used, just directly enter in the value for the field. +

+ Azure Key Vault Universal Orchestrator Extension +

+ +

+ +Integration Status: production +Release +Issues +GitHub Downloads (all assets, all releases)

-
- - - - ---- - - -## Setup and Configuration - -The high level steps required to configure the Azure Keyvault Orchestrator extension are: - -1) [Migrating from the Windows Orchestrator for Azure KeyVault](#migrating-from-the-windows-orchestrator-for-azure-keyvault) - -1) [Configure the Azure Keyvault for client access](#configure-the-azure-keyvault-for-client-access) - -1) [Create the Store Type in Keyfactor](#create-the-store-type-in-keyfactor) - -1) [Install the Extension on the Orchestrator](#install-the-extension-on-the-orchestrator) - -1) [Create the Certificate Store](#create-the-certificate-store) - -_Note that the certificate store type used by this Universal Orchestrator support for Azure Keyvault is not compatible with the certificate store type used by with Windows Orchestrator version for Azure Keyvault. -If your Keyfactor instance has used the Windows Orchestrator for Azure Keyvault, a specific migration process is required. -See [Migrating from the Windows Orchestrator for Azure KeyVault](#migrating-from-the-windows-orchestrator-for-azure-keyvault) section below._ - -

Migrating from the Windows Orchestrator for Azure KeyVault

 -If you were previously using the Azure Keyvault extension for the **Windows** Orchestrator, it is necessary to remove the Store Type definition as well as any Certificate stores that use the previous store type. -This is because the store type parameters have changed in order to facilitate the Discovery and Create functionality. - -If you have an existing AKV store type that was created for use with the Windows Orchestrator, you will need to follow the steps in one of the below sections in order to transfer the capability to the Universal Orchestrator. - -> :warning: -> Before removing the certificate stores, view their configuration details and copy the values. -> Copying the values in the store parameters will save time when re-creating the stores. - -Follow the below steps to remove the AKV capability from **each** active Windows Orchestrator that supports it: - -#### If the Windows Orchestrator should still manage other cert store types -_If the Windows Orchestrator will still be used to manage some store types, we will remove only the Azure Keyvault functionality._ - -1) On the Windows Orchestrator host machine, run the Keyfactor Agent Configuration Wizard -1) Proceed through the steps to "Select Features" -1) Expand "Cert Stores" and un-check "Azure Keyvault" -1) Click "Apply Configuration" +

+ + + Support + + · + + Installation + + · + + License + + · + + Related Integrations + +

-1) Open the Keyfactor Platform and navigate to **Orchestrators > Management** -1) Confirm that "AKV" no longer appears under "Capabilities" -1) Navigate to **Orchestrators > Management**, select the orchestrator and click "DISAPPROVE" to disapprove it and cancel pending jobs. -1) Navigate to **Locations > Certificate Stores** -1) Select any stores with the Category "Azure Keyvault" and click "DELETE" to remove them from Keyfactor. -1) Navigate to the Administrative menu (gear icon) and then **> Certificate Store Types** -1) Select Azure Keyvault, click "DELETE" and confirm. -1) Navigate to **Orchestrators > Management**, select the orchestrator and click "APPROVE" to re-approve it for use. +## Overview -1) Repeat these steps for any other Windows Orchestrators that support the AKV store type. +This integration allows the orchestrator to act as a client with access to an instance of the Azure Key Vault; allowing you to manage your certificates stored in the Azure Keyvault via Keyfactor. -#### If the Windows Orchestrator can be retired completely -_If the Windows Orchestrator is being completely replaced with the Universal Orchestrator, we can remove all associated stores and jobs._ -1) Navigate to **Orchestrators > Management** and select the Windows Orchestrator from the list. -1) With the orchestrator selected, click the "RESET" button at the top of the list -1) Make sure the orchestrator is still selected, and click "DISAPPROVE". -1) Click "OK" to confirm that you will remove all jobs and certificate stores associated to this orchestrator. -1) Navigate to the the Administrative (gear icon in the top right) and then **Certificate Store Types** -1) Select "Azure Keyvault", click "DELETE" and confirm. -1) Repeat these steps for any other Windows Orchestrators that support the AKV store type (if they can also be retired). +## Compatibility -Note: Any Azure Keyvault certificate stores removed can be re-added once the Universal Orchestrator is configured with the AKV capability. +This integration is compatible with Keyfactor Universal Orchestrator version 10.1 and later. -### Migrating from version 1.x or version 2.x of the Azure Keyvault Orchestrator Extension +## Support +The Azure Key Vault Universal Orchestrator extension is supported by Keyfactor for Keyfactor customers. If you have a support issue, please open a support ticket with your Keyfactor representative. If you have a support issue, please open a support ticket via the Keyfactor Support Portal at https://support.keyfactor.com. + +> To report a problem or suggest a new feature, use the **[Issues](../../issues)** tab. If you want to contribute actual bug fixes or proposed enhancements, use the **[Pull requests](../../pulls)** tab. -It is not necessary to re-create all of the certificate stores when migrating from a previous version of this extension, though it is important to note that Azure KeyVaults found during a Discovery job -will return with latest store path format: `{subscription id}:{resource group name}:{new vault name}`. +## Requirements & Prerequisites -
+Before installing the Azure Key Vault Universal Orchestrator extension, we recommend that you install [kfutil](https://github.com/Keyfactor/kfutil). Kfutil is a command-line tool that simplifies the process of creating store types, installing extensions, and instantiating certificate stores in Keyfactor Command. ---- ### Configure the Azure Keyvault for client access @@ -186,7 +65,7 @@ we have created 3 seperate custom role definitions that you can use as a referen The reason for 3 definitions is that certain orchestrator jobs, such as Create (new KeyVault) or Discovery require more elevated permissions at a different scope than the basic certificate operations (Inventory, Add, Remove) performed within a specific KeyVault. -If you know that you will utilize all of the capabilities of this integration; the last custom role definition contains all necessary permissions for performing all of the Jobs (Discovery, Create KeyVault, Inventory/Add/Remove certificates). +If you know that you will utilize all of the capabilities of this integration; the last custom role definition contains all necessary permissions for performing all of the Jobs (Discovery, Create KeyVault, Inventory/Add/Remove certificates). #### Built-in vs. custom roles @@ -488,91 +367,227 @@ Once the User Assigned managed identity has been created, you will need only to In order to use a _System_ assigned managed identity, there is no need to enter the server credentials. If no server credentials are provided, the extension assumes authentication is via system assigned managed identity. -### Create the Store Type in Keyfactor -Now we can navigate to the Keyfactor platform and create the store type for Azure Key Vault. +## Create the AKV Certificate Store Type -1) Navigate to your instance of Keyfactor and log in with a user that has Administrator privileges. +To use the Azure Key Vault Universal Orchestrator extension, you **must** create the AKV Certificate Store Type. This only needs to happen _once_ per Keyfactor Command instance. -1) Click on the gear icon in the top left and navigate to "Certificate Store Types". - ![Cert Store Types Menu](/Images/cert-store-types-menu.png) -1) Click "Add" to open the Add Certificate Store dialog. +* **Create AKV using kfutil**: -1) Name the new store type "Azure Keyvault" and give it the short name of "AKV". + ```shell + # Azure Keyvault + kfutil store-types create AKV + ``` -1) The Azure Keyvault integration supports the following job types: _Inventory, Add, Remove, Create and Discovery_. Select from these the capabilities you would like to utilize. +* **Create AKV manually in the Command UI**: +
Create AKV manually in the Command UI -> :warning: The store type definition needs to include the necessary fields to support Create functionality (SkuType and VaultRegion). Be sure to read through the _Custom Fields_ instructions below and set them up with the required fields if Creating new Azure Keyvaults from Keyfactor Command is desired. + Create a store type called `AKV` with the attributes in the tables below: -1) **If you are using a Service Principal or User assigned Managed Identity only** Make sure that "Needs Server" is checked. + #### Basic Tab + | Attribute | Value | Description | + | --------- | ----- | ----- | + | Name | Azure Keyvault | Display name for the store type (may be customized) | + | Short Name | AKV | Short display name for the store type | + | Capability | AKV | Store type name orchestrator will register with. Check the box to allow entry of value | + | Supports Add | ✅ Checked | Check the box. Indicates that the Store Type supports Management Add | + | Supports Remove | ✅ Checked | Check the box. Indicates that the Store Type supports Management Remove | + | Supports Discovery | ✅ Checked | Check the box. Indicates that the Store Type supports Discovery | + | Supports Reenrollment | 🔲 Unchecked | Indicates that the Store Type supports Reenrollment | + | Supports Create | ✅ Checked | Check the box. Indicates that the Store Type supports store creation | + | Needs Server | ✅ Checked | Determines if a target server name is required when creating store | + | Blueprint Allowed | 🔲 Unchecked | Determines if store type may be included in an Orchestrator blueprint | + | Uses PowerShell | 🔲 Unchecked | Determines if underlying implementation is PowerShell | + | Requires Store Password | 🔲 Unchecked | Enables users to optionally specify a store password when defining a Certificate Store. | + | Supports Entry Password | 🔲 Unchecked | Determines if an individual entry within a store can have a password. | - ![Cert Store Types Menu](/Images/cert-store-type.png) + The Basic tab should look like this: -> :warning: -> if you are using a system assigned managed identity for authentication, you should leave this unchecked. + ![AKV Basic Tab](docsource/images/AKV-basic-store-type-dialog.png) + + #### Advanced Tab + | Attribute | Value | Description | + | --------- | ----- | ----- | + | Supports Custom Alias | Optional | Determines if an individual entry within a store can have a custom Alias. | + | Private Key Handling | Optional | This determines if Keyfactor can send the private key associated with a certificate to the store. Required because IIS certificates without private keys would be invalid. | + | PFX Password Style | Default | 'Default' - PFX password is randomly generated, 'Custom' - PFX password may be specified when the enrollment job is created (Requires the Allow Custom Password application setting to be enabled.) | + + The Advanced tab should look like this: + + ![AKV Advanced Tab](docsource/images/AKV-advanced-store-type-dialog.png) + + #### Custom Fields Tab + Custom fields operate at the certificate store level and are used to control how the orchestrator connects to the remote target server containing the certificate store to be managed. The following custom fields should be added to the store type: + + | Name | Display Name | Description | Type | Default Value/Options | Required | + | ---- | ------------ | ---- | --------------------- | -------- | ----------- | + | ServerUsername | Server Username | The application (service principal) ID that will be used to authenticate to Azure | Secret | | ✅ Checked | + | ServerPassword | Server Password | The client secret that will be used to authenticate into Azure | Secret | | ✅ Checked | + | TenantId | Tenant Id | Tenant ID of new Azure Keyvault being created. Not required if not creating new Keyvault. | String | | 🔲 Unchecked | + | SkuType | SKU Type | The SkuType determines the service tier when creating a new instance of Azure KeyVault via the platform. Valid values include 'premium' and 'standard'. If either option should be available when creating a new KeyVault from the Command platform via creating a new certificate store, then the value to enter for the multiple choice options should be 'standard,premium'. If your organization requires that one or the other option should always be used, you can limit the options to a single value ('premium' or 'standard'). If not selected, 'standard' is used when creating a new KeyVault. Not required if not creating a new Keyvault. | MultipleChoice | standard,premium | 🔲 Unchecked | + | VaultRegion | Vault Region | The Vault Region field is only important when creating a new Azure KeyVault from the Command Platform. This is the region that the newly created vault will be created in. When creating the cert store type, you can limit the options to those that should be applicable to your organization. Refer to the [Azure Documentation](https://learn.microsoft.com/en-us/dotnet/api/azure.core.azurelocation?view=azure-dotnethttps://learn.microsoft.com/en-us/dotnet/api/azure.core.azurelocation?view=azure-dotnet) for a list of valid region names. If no value is selected, 'eastus' is used by default. Not required if not creating a new Keyvault. | MultipleChoice | eastus,eastus2,westus2,westus3,westus | 🔲 Unchecked | + | AzureCloud | Azure Cloud | The Azure Cloud field, if necessary, should contain one of the following values: china, germany, government. This is the Azure Cloud instance your organization uses. If using the standard 'public' cloud, this field can be left blank or omitted entirely from the store type definition. | MultipleChoice | public,china,government | 🔲 Unchecked | + | PrivateEndpoint | Private KeyVault Endpoint | The Private Endpoint field should be used if you if have a custom url assigned to your keyvault resources and they are not accessible via the standard endpoint associated with the Azure Cloud instance (*.vault.azure.net, *.vault.azure.cn, etc.). This field should contain the base url for your vault instance(s), excluding the vault name. | String | | 🔲 Unchecked | + + The Custom Fields tab should look like this: + + ![AKV Custom Fields Tab](docsource/images/AKV-custom-fields-store-type-dialog.png) + + + +
+ +## Installation + +1. **Download the latest Azure Key Vault Universal Orchestrator extension from GitHub.** + + Navigate to the [Azure Key Vault Universal Orchestrator extension GitHub version page](https://github.com/Keyfactor/azurekeyvault-orchestrator/releases/latest). Refer to the compatibility matrix below to determine whether the `net6.0` or `net8.0` asset should be downloaded. Then, click the corresponding asset to download the zip archive. + | Universal Orchestrator Version | Latest .NET version installed on the Universal Orchestrator server | `rollForward` condition in `Orchestrator.runtimeconfig.json` | `azurekeyvault-orchestrator` .NET version to download | + | --------- | ----------- | ----------- | ----------- | + | Older than `11.0.0` | | | `net6.0` | + | Between `11.0.0` and `11.5.1` (inclusive) | `net6.0` | | `net6.0` | + | Between `11.0.0` and `11.5.1` (inclusive) | `net8.0` | `Disable` | `net6.0` | + | Between `11.0.0` and `11.5.1` (inclusive) | `net8.0` | `LatestMajor` | `net8.0` | + | `11.6` _and_ newer | `net8.0` | | `net8.0` | + + Unzip the archive containing extension assemblies to a known location. + + > **Note** If you don't see an asset with a corresponding .NET version, you should always assume that it was compiled for `net6.0`. + +2. **Locate the Universal Orchestrator extensions directory.** + + * **Default on Windows** - `C:\Program Files\Keyfactor\Keyfactor Orchestrator\extensions` + * **Default on Linux** - `/opt/keyfactor/orchestrator/extensions` + +3. **Create a new directory for the Azure Key Vault Universal Orchestrator extension inside the extensions directory.** + + Create a new directory called `azurekeyvault-orchestrator`. + > The directory name does not need to match any names used elsewhere; it just has to be unique within the extensions directory. + +4. **Copy the contents of the downloaded and unzipped assemblies from __step 2__ to the `azurekeyvault-orchestrator` directory.** + +5. **Restart the Universal Orchestrator service.** + + Refer to [Starting/Restarting the Universal Orchestrator service](https://software.keyfactor.com/Core-OnPrem/Current/Content/InstallingAgents/NetCoreOrchestrator/StarttheService.htm). + + +6. **(optional) PAM Integration** + + The Azure Key Vault Universal Orchestrator extension is compatible with all supported Keyfactor PAM extensions to resolve PAM-eligible secrets. PAM extensions running on Universal Orchestrators enable secure retrieval of secrets from a connected PAM provider. + + To configure a PAM provider, [reference the Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam) to select an extension, and follow the associated instructions to install it on the Universal Orchestrator (remote). -1) Navigate to the _Advanced_ tab and set the following values: - - Store Path Type: **Freeform** - - Supports Custom Alias: **Optional** - - Private Key Handling: **Optional** - - PFX Password Style: **Default** - ![Cert Store Types Menu](/Images/store-type-fields-advanced.png) +> The above installation steps can be supplimented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/InstallingAgents/NetCoreOrchestrator/CustomExtensions.htm?Highlight=extensions). -1) Navigate to the _Custom Fields_ tab and add the custom fields for the store type. -> :warning: If you are using the Global Public cloud (*.vault.azure.net) and creating new Azure -> Keyvaults from Keyfactor Command functionality is not necessary for your workflow, this section can -> be skipped entirely. -- The below two fields are necessary if working with Keyvaults in Azure Cloud instances that are not the standard global public one (*.vault.azure.net) If your vault instance(s) have the base url of `.vault.azure.net` then the next two fields can be omitted from the store type definition and the default global public cloud will be assumed. -- - The "Azure Cloud" field refers to +## Defining Certificate Stores -| Name | Display Name | Type | Required | -| ---- | ------------ | ---- | -------- | -| AzureCloud[^azurecloud] | Azure Cloud | MultipleChoice | false | -| PrivateEndpoint[^privateEndpoint] | Private Endpoint | String | false | -[^azurecloud]: The Azure Cloud field, if necessary, should contain one of the following values: "china, germany, government". This is the Azure Cloud instance your organization uses. If using the standard "public" cloud, this field can be left blank or omitted entirely from the store type definition. -[^privateEndpoint]: The Private Endpoint field should be used if you if have a custom url assigned to your keyvault resources and they are not accessible via the standard endpoint associated with the Azure Cloud instance (*.vault.azure.net, *.vault.azure.cn, etc.). This field should contain the base url for your vault instance(s), excluding the vault name. +* **Manually with the Command UI** -- The following fields are _only_ necessary in order to support creating new Azure Keyvaults from the Keyfactor Command platform. If this functionality is not needed, there is no need to set up these fields. +
Create Certificate Stores manually in the UI -| Name | Display Name | Type | Required | -| ---- | ------------ | ---- | -------- | -| TenantId | Tenant Id | String | false | -| SkuType[^sku] | SKU Type | MultipleChoice | false | -| VaultRegion[^vaultregion] | Vault Region | MultipleChoice | false | + 1. **Navigate to the _Certificate Stores_ page in Keyfactor Command.** -[^sku]: The SkuType determines the service tier when creating a new instance of Azure KeyVault via the platform. Valid values include "premium" and "standard". - If either option should be available when creating a new KeyVault from the Command platform via creating a new certificate store, then the value to enter for the multiple choice options should be "standard,premium". - If your organization requires that one or the other option should always be used, you can limit the options to a single value ("premium" or "standard"). If not selected, "standard" is used when creating a new KeyVault. + Log into Keyfactor Command, toggle the _Locations_ dropdown, and click _Certificate Stores_. -[^vaultregion]: The Vault Region field is only important when creating a new Azure KeyVault from the Command Platform. This is the region that the newly created vault will be created in. When creating the cert store type, - you can limit the options to those that should be applicable to your organization. Refer to the [Azure Documentation](https://learn.microsoft.com/en-us/dotnet/api/azure.core.azurelocation?view=azure-dotnethttps://learn.microsoft.com/en-us/dotnet/api/azure.core.azurelocation?view=azure-dotnet) for a list of valid region names. - If no value is selected, "eastus" is used by default. + 2. **Add a Certificate Store.** -### Install the Extension on the Orchestrator + Click the Add button to add a new Certificate Store. Use the table below to populate the **Attributes** in the **Add** form. + | Attribute | Description | + | --------- | ----------- | + | Category | Select "Azure Keyvault" or the customized certificate store name from the previous step. | + | Container | Optional container to associate certificate store with. | + | Client Machine | The Tenant Id of the Azure Keyvault being managed. | + | Store Path | The store path of each vault is the Subscription ID, Resource Group name, and Vault name in the following format: `{subscription id}:{resource group name}:{new vault name}. | + | Orchestrator | Select an approved orchestrator capable of managing `AKV` certificates. Specifically, one with the `AKV` capability. | + | ServerUsername | The application (service principal) ID that will be used to authenticate to Azure | + | ServerPassword | The client secret that will be used to authenticate into Azure | + | TenantId | Tenant ID of new Azure Keyvault being created. Not required if not creating new Keyvault. | + | SkuType | The SkuType determines the service tier when creating a new instance of Azure KeyVault via the platform. Valid values include 'premium' and 'standard'. If either option should be available when creating a new KeyVault from the Command platform via creating a new certificate store, then the value to enter for the multiple choice options should be 'standard,premium'. If your organization requires that one or the other option should always be used, you can limit the options to a single value ('premium' or 'standard'). If not selected, 'standard' is used when creating a new KeyVault. Not required if not creating a new Keyvault. | + | VaultRegion | The Vault Region field is only important when creating a new Azure KeyVault from the Command Platform. This is the region that the newly created vault will be created in. When creating the cert store type, you can limit the options to those that should be applicable to your organization. Refer to the [Azure Documentation](https://learn.microsoft.com/en-us/dotnet/api/azure.core.azurelocation?view=azure-dotnethttps://learn.microsoft.com/en-us/dotnet/api/azure.core.azurelocation?view=azure-dotnet) for a list of valid region names. If no value is selected, 'eastus' is used by default. Not required if not creating a new Keyvault. | + | AzureCloud | The Azure Cloud field, if necessary, should contain one of the following values: china, germany, government. This is the Azure Cloud instance your organization uses. If using the standard 'public' cloud, this field can be left blank or omitted entirely from the store type definition. | + | PrivateEndpoint | The Private Endpoint field should be used if you if have a custom url assigned to your keyvault resources and they are not accessible via the standard endpoint associated with the Azure Cloud instance (*.vault.azure.net, *.vault.azure.cn, etc.). This field should contain the base url for your vault instance(s), excluding the vault name. | -The process for installing an extension for the universal orchestrator differs from the process of installing an extension for the Windows orchestrator. Follow the below steps to register the Azure Keyvault integration with your instance of the universal orchestrator. -1) Stop the Universal Orchestrator service. + - 1) Note: In Windows, this service is called "Keyfactor Orchestrator Service (Default)" +
Attributes eligible for retrieval by a PAM Provider on the Universal Orchestrator -1) Create a folder in the "extensions" folder of the Universal Orchestrator installation folder named "AKV" (the name is not important) + If a PAM provider was installed _on the Universal Orchestrator_ in the [Installation](#Installation) section, the following parameters can be configured for retrieval _on the Universal Orchestrator_. + | Attribute | Description | + | --------- | ----------- | + | ServerUsername | The application (service principal) ID that will be used to authenticate to Azure | + | ServerPassword | The client secret that will be used to authenticate into Azure | - 1) example: `C:\Program Files\Keyfactor\Keyfactor Orchestrator\extensions\_AKV_ -1) Copy the build output (if you compiled from source) or the contents of the zip file (if you downloaded the pre-compiled binaries) into this folder. + Please refer to the **Universal Orchestrator (remote)** usage section ([PAM providers on the Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam)) for your selected PAM provider for instructions on how to load attributes orchestrator-side. -1) Start the Universal Orchestrator Service + > Any secret can be rendered by a PAM provider _installed on the Keyfactor Command server_. The above parameters are specific to attributes that can be fetched by an installed PAM provider running on the Universal Orchestrator server itself. +
+ -### Discover Certificate Stores +
+* **Using kfutil** + +
Create Certificate Stores with kfutil + + 1. **Generate a CSV template for the AKV certificate store** + + ```shell + kfutil stores import generate-template --store-type-name AKV --outpath AKV.csv + ``` + 2. **Populate the generated CSV file** + + Open the CSV file, and reference the table below to populate parameters for each **Attribute**. + | Attribute | Description | + | --------- | ----------- | + | Category | Select "Azure Keyvault" or the customized certificate store name from the previous step. | + | Container | Optional container to associate certificate store with. | + | Client Machine | The Tenant Id of the Azure Keyvault being managed. | + | Store Path | The store path of each vault is the Subscription ID, Resource Group name, and Vault name in the following format: `{subscription id}:{resource group name}:{new vault name}. | + | Orchestrator | Select an approved orchestrator capable of managing `AKV` certificates. Specifically, one with the `AKV` capability. | + | ServerUsername | The application (service principal) ID that will be used to authenticate to Azure | + | ServerPassword | The client secret that will be used to authenticate into Azure | + | TenantId | Tenant ID of new Azure Keyvault being created. Not required if not creating new Keyvault. | + | SkuType | The SkuType determines the service tier when creating a new instance of Azure KeyVault via the platform. Valid values include 'premium' and 'standard'. If either option should be available when creating a new KeyVault from the Command platform via creating a new certificate store, then the value to enter for the multiple choice options should be 'standard,premium'. If your organization requires that one or the other option should always be used, you can limit the options to a single value ('premium' or 'standard'). If not selected, 'standard' is used when creating a new KeyVault. Not required if not creating a new Keyvault. | + | VaultRegion | The Vault Region field is only important when creating a new Azure KeyVault from the Command Platform. This is the region that the newly created vault will be created in. When creating the cert store type, you can limit the options to those that should be applicable to your organization. Refer to the [Azure Documentation](https://learn.microsoft.com/en-us/dotnet/api/azure.core.azurelocation?view=azure-dotnethttps://learn.microsoft.com/en-us/dotnet/api/azure.core.azurelocation?view=azure-dotnet) for a list of valid region names. If no value is selected, 'eastus' is used by default. Not required if not creating a new Keyvault. | + | AzureCloud | The Azure Cloud field, if necessary, should contain one of the following values: china, germany, government. This is the Azure Cloud instance your organization uses. If using the standard 'public' cloud, this field can be left blank or omitted entirely from the store type definition. | + | PrivateEndpoint | The Private Endpoint field should be used if you if have a custom url assigned to your keyvault resources and they are not accessible via the standard endpoint associated with the Azure Cloud instance (*.vault.azure.net, *.vault.azure.cn, etc.). This field should contain the base url for your vault instance(s), excluding the vault name. | + + + + +
Attributes eligible for retrieval by a PAM Provider on the Universal Orchestrator + + If a PAM provider was installed _on the Universal Orchestrator_ in the [Installation](#Installation) section, the following parameters can be configured for retrieval _on the Universal Orchestrator_. + | Attribute | Description | + | --------- | ----------- | + | ServerUsername | The application (service principal) ID that will be used to authenticate to Azure | + | ServerPassword | The client secret that will be used to authenticate into Azure | + + + > Any secret can be rendered by a PAM provider _installed on the Keyfactor Command server_. The above parameters are specific to attributes that can be fetched by an installed PAM provider running on the Universal Orchestrator server itself. +
+ + + 3. **Import the CSV file to create the certificate stores** + + ```shell + kfutil stores import csv --store-type-name AKV --file AKV.csv + ``` +
+ +> The content in this section can be supplimented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Certificate%20Stores.htm?Highlight=certificate%20store). + + +## Discovering Certificate Stores with the Discovery Job Now that we have the extension registered on the Orchestrator, we can navigate back to the Keyfactor platform and finish the setup. If there are existing Azure Key Vaults, complete the below steps to discover and add them. If there are no existing key vaults to integrate and you will be creating a new one via the Keyfactor Platform, you can skip to the next section. 1) Navigate to Orchestrators > Management in the platform. @@ -684,51 +699,14 @@ To add one of these results to Keyfactor as a certificate store: 1) Click "SAVE". -### Add a new or existing Azure Keyvault certificate store - -You can also add a certificate store that corresponds to an Azure Keyvault individually without the need to run the discovery / approval workflow. -The steps to do this are: - -1) Navigate to "Locations > Certificate Stores" - -1) Click "ADD" - - ![Approve Cert Store](/Images/cert-store-add-button.png) - -1) Enter the values corresponding to the Azure Keyvault instance. - -- **Category**: Azure Keyvault -- **Container**: _optional_ -- **Client Machine**: If applicable; Tenant Id. - - - Note: These will only have to be entered once, even if adding multiple certificate stores. - - Follow the steps [here](#store-the-server-credentials-in-keyfactor) to enter them. - -- **Store Path**: This is the Subscription ID, Resource Group name, and Vault name in the following format: `{subscription id}:{resource group name}:{new vault name}` - -- **SKU Type**: This field is only used when creating new vaults in Azure. If present, select any value, or leave blank. -- **Vault Region**: This field is also only used when creating new vaults. If present, select any value. - -If the vault already exists in azure the store path can be found by navigating to the existing Keyvault resource in Azure and clicking "Properties" in the left menu. - -![Resource Id](/Images/resource-id.png) - -- Use these values to create the store path - -If the Keyvault does not exist in Azure, and you would like to create it: - -- Enter a value for the store path in the following format: `{subscription id}:{resource group name}:{new vault name}` - -- For a non-existing Keyvault that you would like to create in Azure, make sure you have the "Create Certificate Store" box checked. -> :warning: The identity you are using for authentication will need to have sufficient Azure permissions to be able to create new Keyvaults. ---- -### License -[Apache](https://apache.org/licenses/LICENSE-2.0) +## License -When creating cert store type manually, that store property names and entry parameter names are case sensitive +Apache License 2.0, see [LICENSE](LICENSE). +## Related Integrations +See all [Keyfactor Universal Orchestrator extensions](https://github.com/orgs/Keyfactor/repositories?q=orchestrator). \ No newline at end of file From 965f9025d0b7b8aee9c9a5ee5919d3fb274eb488 Mon Sep 17 00:00:00 2001 From: Hayden Roszell Date: Mon, 13 Jan 2025 12:48:19 -0700 Subject: [PATCH 5/5] chore(docs): Regenerate screenshots Signed-off-by: Hayden Roszell --- .../images/AKV-advanced-store-type-dialog.png | Bin 0 -> 41692 bytes .../images/AKV-basic-store-type-dialog.png | Bin 0 -> 51275 bytes .../AKV-custom-fields-store-type-dialog.png | Bin 0 -> 47377 bytes integration-manifest.json | 228 +++++++++--------- 4 files changed, 114 insertions(+), 114 deletions(-) create mode 100644 docsource/images/AKV-advanced-store-type-dialog.png create mode 100644 docsource/images/AKV-basic-store-type-dialog.png create mode 100644 docsource/images/AKV-custom-fields-store-type-dialog.png diff --git a/docsource/images/AKV-advanced-store-type-dialog.png b/docsource/images/AKV-advanced-store-type-dialog.png new file mode 100644 index 0000000000000000000000000000000000000000..782eb1065f1dc5f2a85dad6e7448cb5b5671e945 GIT binary patch literal 41692 zcmd43WmJ{z+c$^>DxfGJ0sM3TOm`V1 zq~}ONAKrbmkKUNHv&NFWZr(lC?RVO~@eApBcZ~OUUo`Nrv5sgZNY5@Vekm)%P3i5mU^G@Bva=gLS7mvDIAj+| zL`Z0UZ&5#z(ZI|5+qbIQg8yE(P~O_gVP$3i84=>=ot@oznG=9G;rA0F4I?97jdw3d zjw@awUci`h3;6z@&uB2-3;g#|o&MvO?*9(&ef{D7zw;#ud13u~k3R^5{NKI#lDv>c zeE$7YvG+;;4yKFz&xyRQEu^HRRLU$Dix+d$s@fLY!;ExdQi}dy{pZ%yqj}t7`Fx)I zmdlJ_vm*KOXFkrNXo(>R(Kz-XF2tMcjyYx(YJA0z{YG?U46J7$)-znOO|k8u^r% zo!vfnPmi=sU}LT_B@r9;XE2x!b#gwbs&cm?&DojywaaL_>M5LDzFEF!^@G*+`7eTX zi9Ee^-1>D>wFjJdeGzKBO46xcI7moJ)a6XtMB5j06Z21otQuj<7_jyr| zKIi1{B#O%3wx*W;dn@J=(yPcjj3^oUk>#kV?Qc91MNos5ZB z5ZMpub(<>Li$!fY=kg$Rd7>Az6?sEpx&5nbF07HmBs8>`&u{Em`HbwSvPv9YMpN?; zyyQt;i5(Dv7_{#hOqcPDV9?Xl(b2Kr9D36F<7QHFGBJZ*SCZ*uIg^r|UsP`2uL8Eh z^X;LKAe6*1YmysrjyWYJLY2d&D(y4lW#ji$-5$fzl61R7tXLdva_xF7Sy+mFakK@X@l?BAqM5ov+BcGr+ zOdPTglE_P-Tost3DT%cvJMc-d;u1D`(q<>Fe@@}#TGx0MZHy$DUfVSESf&7F{SwN` z++QpVjM|O}hW77`eb3XS(<#t?h8#vQ^839{63--EyRh-!@F&|p>#cfJxIKhH%2FY` zEDKo|{qn%^jxvf!y^(B=L@Ft5CI$nlOqTJLQ(0vsx;Z@Q_bcbNB z&%5cvvZ7driSzPV2)X?m_$F$*r_nKOPH8R0^8G6}Zf0##y(vkXqM@Q0kp7r2&CXU3I^9p(CNs7lz2KA5y12KNhTNdX_RXPUwMCtUq_m39WJ89$LzN>;&%WFhC z2NXslHQTicRUi+1+HZNl$WiP(pDjuTQbqMd^Z<8ryHYPs?)?KBN_ZCMjPyPlA{0+f1q#$( zB^jMa_n6QE%M|ZCo0Nb2{JKD&QA~MQYbp!<*(iSNj72MJ=}73hyn;#+6oxlh*GEX_ zC2=UiXD5F5SKqsuS`e?3zjj`B7^0eLPVT>lgcdgtIK`_hxBjajfvkc5^&W)I0P5bS zzJu!9jC)yh9~BiM-dH;ee5O}VVULNWlp?>#Uwyq^Ju2a9`pET*DcaM?(5+ihm?I;p0Q{QT}asvS|AIT-~4XEQSY%`kFJW(FR?0o{I}Df zmu9B;Z(*7wFFd6I%O4?$)~3nv{Ejj$Qw`x%ZZV_`SyDc!(!ig8|HdqjRve;{KIFee zN1uc_iOiTP+kEEnGn0I1cYUqinbYJ}0giuNdv}Day8G|pRR^nH1?O8Te(YCFzo8Np z)BYO8l<%<;q@%4lzT35Rq|=7Agj1j~`mWl3U0&^K<`Mg$X$NTmbHd|(qX~*&+B+}kQQu3k{5@1tEGT&*i_$$Mxa8Rnj2lXL|G~ zHnP_h$IN#AjBBG>Z`ty)%#KL5EV!?@FZOiWr82Q&y(Wv*c!firHf=4GJe$9Jao_uO zL(<+z!DJfdjMQS-JWu^w1GlO&nc*OeAmOU#4QaO^p2a&X%?GhqHgr z>V}V-3~x>t;547Kw^BLphgq_i2M_72dGg}!YU}lxYVS63D5Jl-l3TB4d;3o94Q(Y; zsnUAo2w3I#wK^6+RKfy_G*LbcG zg1wU7kX)j3O(gdPwZ*sTK38@qC# zxu5yzm1%zwxA}7OwRqYf$!+GN1gq($XXADerD@vFR5#mhuN5vB`+M+7)3$tLj#<~z zRoi3cwquO75}0qNqJ@NTU|@b+yh)YYMey$J{4clIANLtIMy$U+R98U>{w`p~qvyX_ z(Q$zr#oDvZ2?u>~d)19+0?5kCEtlg#V57Uz75ig>_o5V-DMt`RcSMY=lx!X}bhdw~ zccSgp({HC&e=n~ked4fs14+&G`q7!6v0qFT({OImZgYyvMX9-6gw2YzW7jhujYD}2 z`(c}<2@P;o%rItL*qS94$HOSLG(EOngd@b5m{+Q!_jnYEsP+E0642qpj~T zu<208eh)EESHj4b*=unzqr>fVi8DmY^)?2HrE;1m%)yRk_!M$S61Ce;gQWH7o)WYk~!R+Y%a zBJ-zxkbyMuGd1Ny3;ktcc#y_<+M@)uTMrM|-D~`tb_OeIW;b+wluW)xl#wqjrEu=Y z-QeWRpw1yYT3CK!xh9F`!!y#gdl^=CW>4X#bn?dNiVQixq#Jgzr(EQDklLnaq7S-w zj_rc>lRTS2jRziTpT;IM&~V3ZaF9|SIJ%FB2vJ>`;~PEMPJPEf^mY7P{^?y=3Ml0E zbehtnOWhM6nmSduT{dw-yT=<7gDQH8m2csdq-p81S=$z5mW$&O+pt5?dl68gw_(M# zb7+@XDp~KnLssqThR;JaA$F-dWxY0;q~gNQIp`hBt2DE`?GcsA>*s$RV{TbA|9i@B zML|z{8|iAh9bkq(i@zylCv3EKCc@zkVN%hv-*2c_8pV*f#$ZMX8^rG80T62Nw7&htGxJ2=lG!P5*?d8JN6>_m+OtXa)r6NNaXMydSnOn`&X)-sSXbU*5iK+DxiZK|OK#6mtfw=xV zSbqaak3|_Ga%N6LJ?Bn)!w2`EOzK!}@ewv94FePZijrGXHZl2Dg%mhVSbQ&zEFWvs z#3qYelW<-SVMG>E+#@P}5Nf?K8E#fw{kG}>zG(cpyXkP! z%RIuSh`UDAGvd=6yDo03dqbf9C3#C`X~oUY$wh4Sq_(=JIr3=DjPtrQP+Y(1A-lF> zR{aZ8OZxj)<28AE?0f>R|LC>jjveZ^B&}ZR_jI68;v<%Ig*%U}yOR4eu$Tv1tPl` zY3%rJ-PqN3=#`x6&4?3W^)Xumuf$AhTYow0mC^9lTrRZQviaSl)J4gk$_-z7_9sNU zmUeNR9uG_mn_nr8EA}`Eia_&hgSS-t#LCv~u25fmPb+KNs>|8P*&H($cp;rSh-tz6 zW&WI|AEN0dz7u}+_l+21{r;jGNCL-6w_a3df z9{Ztz%2M1LKpl8dbpSmNo;?<=*X7o^I?emTOv{p!G&bjn@H?Y2;8o#x1wn*!$>JV%@iQo5!w^3}@F=h&bUX^Q;vU0Sssq3-4ofA!* zMAGxzyta7f8vmMPKQ@!{A-(p12Z%n7fR9>wt?HgyBIQ3TCooBe+XQ$@LyG+F0Hgd6 zTg@*O=y6f`a_0k7@x$A7U;?3 zs#S5QmGr)lmcq(uNHVuJ6Y^5IT;v9xmD{)1e59J9nCX}%DoQ666;D2d+tgM;P?U~W zH1<8=rHP;GSyxA0@aHBqq-fTsjrFg_r;c=^rAe-{S!(-p4^xHK*+Y;&K}wt-wZEYV zX~PJ=kNP9?Vve?ha%m^_?&I7f2Cb>P$o{4QG4s=xPjRXWij-JxPnLJR(;Dy9GB;12 zo#?0=z*z9p(9sfafAFQ$fn8c9OXvD%U&Tix(Lwood?@{SZfTvIUN*nLyLWF4WiSU) zWQlUmZ7#$_Ki+0MNaEdoUdKyIudm|7SsBe*$?`SDWc~33P5f9r>gu5*Kt>=u;gK0{ zm?$08%N*Et27IeMI5w_@lBH*7H@|x;ZS_2XrXwpQ^++juXs0rvB9F4%NIA71*L878 z9QV>s{$u>?!SAQMs6(62P<<9=15FUbIWz25x{%_8Xe)oNjAWGD<)XHU(U;6rE+7@! zdP|99Z3L=#a+zXx4Yx$PU;O=kX&Y*??*C@CQH`}U_#soICV}U%3Iss7cvaLVQv=;n z#k$tcP|tD}$LDUEk|u^=YNrHSMvJT3c8HmT5g2Uapq zJm-ek`BY2A)okBIu&*B87rM9FAV4Am^34PBA=y}&;ISHoiR9rJn(a z`)^l>wq&__m}L2Hblm)vlRUp>5D@c?2~d>%u*Fi-Alk*vN&R8!mDuZsRA}L2z47mE zfyULAz~>{GIT$jC%SnB#4b_J z>tQlF$l7vP?hW6q6KF|fGpDw={e96^J5Dj>Pb_9lfA}!^x)cjU+L;l7{wzdzkeHou#H&0A3%3-mxBu2Mu>(BiOP21P`~7(heRpqq+o($IMzS_; z2A->TrkI$1&w!^b7vAIYt=HM?L#Z;;BpyQ<9fc}a6E0su3D&f>6&}Ba&<_d>RVL|K zFLbxraYh!kHE2tFh(w*EomWVtttCrjC)4no3uiR{>NT(o4|U#*EOGRxQv|jG zzVIRDYzxg{W1FLC{-tT2uEkSt`9256B-AchG_Qxm^BzNIySXGq>G%AUPkP}KL(Wx1 zWT!62P^dyHqKKZasl2>rk#2v&iaQnLFzUW>eMzPFp!tonw1CRQMqVLvs=;{q#;Bu5 zTn*Rfiquz!U#|#{D0ou663<`mn5`&oK5+tJ@>rrkw=e>rI2zvX^2w_1y0kWfw$6(^PH_7-HRw~z zXCYBp=ej)b+?j`bsd7<08N4oPj%IhwBorIR8qYy@;&JgTX(;e#kivP~URYgq@%PmM z{uDAIc?utX>hrD6QpoecAyn*0YgN5#x*Z^%IzO>%k67DOSHB1*Gc4{yQ-%hgj3f!d z+P?%i!e=`=*mP&BrX`aebqktd??O6ovgxZqSEz_AE#kxWafVXhYV=)1=e$3X5xprhdJ0dbyi}DQ>IF{ffjk zMLeEED|WT5qB}>UtDVP6f0&s4*z9X^2-|L0(CEQs9Oy&yD~7!0=b!H@SAL|x_U|fI z7*`6$RW1OLOhG9!1h;85@ZQ5m16d2Eb8Tx2z}A7wEErl-fWlGNC6>C%@&}vTJHjIe z=aRoT;kYMMK`Ba}?NgPKiF8Htv>-^m)?4EZJ5wt?lwO}bVzIZH0h#OisdokSpJ4!q z%<|=|vr~D#QBnYnIHh|>4&Y@XEWec`Y8QbIDZGwA5|4t|rE-6xDB?Oin{x5K9Peh( zFr+0BTlb97YNQ?mO@Q#(AiBHF+CX}d4IcK(0){V7jWN!0MYnbE}{+a0?jk`W@x$%FYVUI+IV#3=g}w1rXoRQ7xWTZ{H^Af zmz!jk4jrf*-MA?WQdA#lc z(I|4%ny>3~kY%rlWsQw1=eE@y`j@jocL4MrzkVzlIg*Kv9%JH9P<-a z*6~l82?@|5DSKOqdA(UjXBL-zftHU(oC3O&E#1h9a%d1Bl~IuN^@-wAbL~=4hzJY} z^^r@g?`@m^qa6Oy}30X%Udu49@(8D%MC4^oL0=vX!5#>KZ5IrD~Hdm zDAALZf|kt1gp$qg`K`cjmgX?wCOY6*N)=C#{!$mriAmh+E;Jz-p|uWVZ%dJ2!R5TG zg9Z7Oy4;j+ne6P_2_*JPD#Vko^4N(`2B#=AAD%G&q2EK$*Ut987{Wjb_jL*76M|a1 zsc#CO6`sLeY?#V#R%d}{l$5#pnq-2itRq(%K_*iJFiq9`7fmP9GsGqLFu&wK5(0Lv zk-+@7B$iUmCb~UX3dKqL>>;M^6a{_qxb`yjM|qMovy%sNZ{&k}}h&c#43-)_ktv9z8w%%1HhzE~lf0 z!NJ4WtQzKLY?j|I&yT~LCYzf*cjuciA3gfw>4_pPE?%NKlp&jW_rU`aR@TzG)!)B= zD<~=T73g*24Ofs{omSH_IUeX=TwZP~a)IroSZ0|#Tc(tqqEYX0us-}yM5NtG?jbnQ zETzlTfdGdz+e4|NIURllkxK0CHWT&dsB*ZT%zENcA8(dSFSU}!WhE;OsmRGanRY#= zb~!uH7|v1EXN;t1CnY9+<96jNEiJtzg>J;3J8X4z;UJf#@Xposic3*XTKX~K=$YCt zh_i2O7^^w&@uLtwcf0j$~%*)>&Io@o#+WB-b zY*1;aFIj{Q9wxcp?eb9mJumMZo!DPccF7b6HJfUlunZjQallwr+Q9XPnzr zYikhcXtfImujd1u+Rrx@mX?Ov*tbHrYp!EqC#Sa!!L$6!W#)bRq}%PP{^tu`q@Go4 zG$QV3cT}7qvfI_iQ%=WJ9TWZuWFG_s3apmJk!-i8#HOoV+Kc#~;NS#>gt&vd`6J^XE@q zUS4fi*MksYS>36N3uj9!D>$4vql+n-?EZ@vFB+N=JN-^l5(CNI-JSDjL@P_Nz$1YB zY{fqe0;=sducu*VdCB7TcK6xgI%V`xGm+cO;-XFWnq}_9Sv5=3Br7w|#m=|ijn@s{ zn1x2e{yjaC{C;?{nd|9dy}iBQ%TE4h0bI5*)8#S^2GW3BJ|Q!hJv&>^H5e--rwIA+ zgjxyX$rD|&8uQurV}%Cas;ami@?6lRO2i?5f@q;qF7A-rs&hw0d&Y_pBFqOjYqivo zzGFEyDXE~)GF$Jt+Lw%4bA82;pP&EX!-uCsh{7!;U3Z&Q83``O(Hi8KxgUFF!wWe~Oq^ zNBEnAwLw%C78Z8f4M7EkaE)uV8rPWB{?z%oxv!a-loC9bjBnn&S+QpCisfqedi2WN z&aV0I-!H@>p+AFyZUx`&zJ>CjCtphdGSwbZS|MMvkqh+~%7bUm85x5^U{vAe>(8*s z%EiWSZnymWiBW7ksu}LO+DEKZsIOtK)_Yo@QI8z!a-^7}TEXx0gqqc64GSrX#ViHV zJ?$d}tXln-TPSGlihs24$)t)eCWoojO-;qZ+m?{-5U3`sGy?w5$`Va35Beq0!zygp z3HFz}N$KcdMH|20!)$43Ni*lJQtO6w-re7?hYv5uI{8B$)gO3y-6atX{|wvm?%g}* zoxdnpI5^W%1V%ypiN9g&B1@_0$5fRQxV82Ny#g=?BJAG0G?K4%ur(Pqm?__%z=xV5 z8d0|~TF_2qb$xYNXf_>NS64TlQ)4n-Tv}0K1sHeS_3Hcg?>kTe_D<#l_9v{mWiu}- z9rm9x8$X2zfoFS+joldjMk}wRL~kTdBPk^XuMHA+(!9%NV+<;D~SPkN@P%dyaEEivK6r176;mY)sco_ee)ZM|Y6MIll)E==p#^ z^ZaPjW9U5&4$j%prU*pT3nWODe7$Z$$HO(96^=5k<_F?&+?|*boPYJ=T=?I=zbX0n z_1xSXECDj9c=RV&1H`%?99Z}D^@X#T5t5LQz=h&=cFa{&RlR+E7oeDR#BxP#O;%WK zjJzo}8Rys6CqslxUfxes9Gaamque*vE0X>M98HM(a&$c78jV9r6_2T#oQx5VVV6~; zp`gg<2(#4Cc%j!FdnfJSVs$7RAM&9d4%n_f_XhzZ5AKuS|5+85XsNu9(bb^&n3QK3I(&0x;OpNr$kJb_;Vp3RqiM@z8kb}s}{J_UYu9PizIv>CjOvvR( zhC{3N@xZala;El%&O%F|u(5HLMl}=^@^8rK(ln~&NwA!9xOAUBTV9-4AWp<#yCKOR zK$s2lUwplWMZ(h3zbql#7Gbv#%_I2TH)L`s@CN+QM?lH|EQ^{*)~v;mnV6;ni>}@ujas4=CGfVK=uO?G8iI<9C{YynS3xd zr5qVR2swCM^nH`DLZJwHogcqKLv4qT*P+sc3}q`%7pnkv2uT(R!;6h$w-LU9#V3`) z>4sRlle06t*yHVKbzE*|`w04a&xi6*;o`}JTThvxL(~^S#n+eoginmN?(?kkxX*>o<*9B%{>C=Wsx#tg&7dY?lYBe;eO8FCVq)&u}w%kE|f}d4CX{Y94XOHwGa(!xL zweM7A0E3VDcH3%SzkVg7pqN`5%v4ZRgc&|W;f3A|^>7w|4B&nZ?jj{WZ=u%NH02T+ zs3P+_v-OB->2~dUcCh*_Dhj{ZpCHlg`l|A5Ewl3a>KswTp`Fl&g$x?nl+{450}#y0 z%KAx9PcPim(C~+N>Z=zozI5|kKZ6PkwA8RDvfAa`@^nv!o`FF~R5S_DtA~Rug=|E1 zu$^)kjVkopkA5^Ya>o~6er;h~o*h!|D;c0#q$`(P$JwP$=iH%UWgXceBy&MrUZ?Ff z3CT@5NIz)z04QqP+kGJJL&^%(C}089svJWcIy*W#c8&p9(=jk4I_v|hKHUZIJ5fMG zD0u|IaTg7ZQIwYJ`itRYgj)Hvn5bwtw+p+v^X?tTs#qAYMBrxVTJo!vW;K`0an5`9 z+QVp<=Nf&Crz&w}Wcn$1+=M5`noHRi%_eC8gwtR8nsG@$eQJijfZjY-U;j;~Jv4-E z*;F=WuViR2d|&wH#K}&4Ws4q>P%MAwc1AwJz<66? zI(f3+%`;l%#KK}W)zH`XD>^#*KCRIE);s|&$AeGZv0NKdRZ%`Tw0*yMQD9F z1qd~O{TNS_1|q71kv)Ehush(8*49=Co{$J#*h?QD)NZchXHZ*-nVE-n6sjDVTwPru zlmdf-v{sZIa&1=o?!?zs$WWGlR}EZ?jpQx_V@EG+(z9 z4^dAZ@=4k6ce1pHYy+-@nwx9w;D^t$1PPcDAO9JmCK{}y0=w<0in4ph9i!-W#0ZA|#^xY;UC54*!*4&&94qzz6xZ3w$ zT?2{ex9jB@Fu*^6^BzBbEGQ%dxq_}zX&(ri|CoS4%+ZmZo11%NeB27)D}a-{q9S54 zGB1c(OgubcK-3l%7Eqy=V<#2nXJ%>vq9PVM0-_u7{1DSwDrLWzO~!VP#?5Z^0J~*2 z9{HrtRdwjUnbAdrii(PWz;F>oMMYmcrXNIZ7ro{((tz!Fu1;P75I^7=RU>25#UvG9 zn6#T-oca3=Mv0uAIRUYlx?ev>f5!UraDCWnq2&>{r5tu!+VFTt`bA1=_Oo}oqS?Ly z43A;Asq5<6iuK#Rr!#$=9I%F#x!zElbSUZ&ptI1DN!i$NPn>w5Sp6O}G*iBc%Q!!UdFnwM_4fLrOz-#;9TT%UUP23*0Jt3=eyFIZRsh64di1Drrw)}9u51nX zXRO{8n&;lt`8FmFjsPqa)VCQx4n}`u)2wcRLNIupD*3@Fv&D9Lx z)!f!L1p?c7w-KkP`e7!$X2V^8fQ`^w0qiw(cL&%_yM*B~=4tKXnA=zE=`UgIAW zgz1OJR5v_4Oy?%MECKi#!LJ${-EG!~aNlc#sf(zhVD`eCt0!r!eL`KiEY=2P#f01X zV&}Lbqy^BgBtT`*17^0j1B8<^=qdvUI6@H@0|2aPYHGT&CD}GU9tA;+x7Fo(wwemS z%c^KyTBf9WTZBlqC_40PIX}Gv0d&R1ALLf<2`5k9GcDQ9JiAEu+ry5*Ox6+b!)t^9 z{2(ZJS58h2kpZ)HcX(q^(4N*plzxFe1rc6ha_W|`g+O~B!zh@U)pn0-?7~(uD2a*h zz@i%)8@GwIcXjb6_Rh@BS&lCPXN4kQFQKGjX=w>0t+ur_eZuYJM}qnOk{AS>ht5vug052XVCntDz9BEKencL*~KnJ=!vzeHfXmg(hc?956e_VOS9`>81eHqYC zALF=%baZT>uz;lb!3NSC6r;bth(+`VGq9)Kt}icheqp@7$PDplId|3a!+1aN!Pb^} zyu?fovIlZ&#Z_M5?u)DGlj*Wp;_n#P5WY0~lza#+7u~@7|M7PuKp`ySIA@mQqb{A6 zJ(0(o{?v4t^A+(m3d6VW7fd$1M$Kz7cXD6<6FyI-SbXU_`S9-< zi~YBxOco=j!+(d(5vCo6wscQV)ODN&Ocf_v9EbKhUoAc1J|$1;qnFQ7dBMpEQ0Ey) zq!7WFwzjrKs*8q-1-j@U>BUx*mGu^zC`0x2QyT)d(9+(X2z;xAxZ`Eu^`F%-{Eef1iPd1MfVE3eMh z5hC4Zcw9h@-eF-lczzymMky5)6-t|&9H`A-0fXYNF#tGbHl1jJCYTvb%fJu>V$^gm zd#YHJ?n#AujjJyd=c~)}>E1u!JV2JT-*T`k=1;uwHggb9t)QS_{&YExl#43{Fd5-z zpo#9F7NdU#u)5S0(+(2r%5W|bfYtOD+J;3+vCex!AUK7y+fYDeqs;XD<^^`p1M3>= zu!NhVQYO90J~leqTV|yP6!&&5tcv~B>GJAW5#=j>-%p?iAbodt&;RuIrnHQV!(J;X z$Sb$wVQE1^qJstoDnvcNJijpkz~->re?XX`&&^dX@dsd!TYP#v?WPB`-+FT_1T>DH zv9YFPQ9(iV7pME^=f;B>vLG8KuKmYiiQ6*tnkYD=wKZc?UCP&6S1*a_hNcK|3_|-x zfDg!3!&2+bwY4@Vhd1nJ-Ek1A1Y8&*$^t4O_vL|1_1PMwrj}L&Xho8bOMz3L?6uQ6 z0GeKzC}RK!I#)ETrZv~#Z46itz+^NC*qE3yRiOi!^0|M2k=?v?3(7T>dUdo^B7Z(Y zd4v_@zP_-6lN$6U+({G&XzJ|^ge%T2FQdE#O8DTx1LvbrJv2hja8LvTqoR~IU5qp} z-vfGtb23-Tsi<`9Ew)3CXExpkCD{S)`vjtR*=Ih0RF4cLonGU*?mwVzxR??Whsfr@|t5MS@0D&&2-fdJmH z9k=h?xzPiYH_#SX?Y5qQs-fNZ1A8D>ortUqjT2A>AXfk`NHd86-1Hq4fcps@79N$` ztRo|M%F19S&g|^$ZDeFQg;WrWo(c#E0L=hi*Z_Nx8tZt!NU0Nmek*WV?;k%B;5M^h zvw;Ym9dAnjCPJVQ(5O6g4mU=F^0k_8&TMXW0`Kzn@j-CC!O1GbLJ_&1e1QZ5`ime& zH-L_K{_Yqzs}Tc<5Q(<> zf)J68C)dk49xd|`K3n!`MM`3zzpYMHaR3=Gp017o`Ku2^Sl%7VkmzXNkdTlUZ*RiG z!Plo60kNXJ=!4{-<6>qGg?&XRKlMft5fO!^laY`JumT`eAz(NX)Tn!CXbl}5z7rEF zARv4Nmj`SW1UZ9rqM$|395k$-hEW&(jffftd;6YjWfoU3QgpkbTOmDg-)PmiT~%BX5pDQl84vJTrbOK`*Pjg z??67zK+cn}vzM!Q9ULF00wIHHHM_o!S_`P2958TWV{)AhqtOr=2oG>+#Z5;h(1+?Y z96(g4g4>cC0`EY7zn|L$`pK!U2TUE_w}FBPb@83`Ggb z-aSf6N~L0B@0uDOpu*0FgYq64KM>p>7^+g{AtpRVLyZh{H+Hu1Jg4?mLv-e?1!I}n zLXakaHP=IeLe2M{J%qy0pD6GU*f^-V%TRMc?cuK6@8Y0Rs|;tEvahFmEt$yghtQv4 z-?1Ou87R<`m~!4118Vf@{{8!Cxs#5kCFKYk4vKCBoyJY*HubHo_ZS!$>i@vYKN1sP zfwV|Jv0;_^5#*L-AfE_UhY*i|@`qAxL*{^=f|U2?k0x|E0M)nhz^R#XSSBEJyRgX0 z$^wV0bkiIG$-ZMCWsHp2H%`}>W>eFxu8GBNT;fu5AY+U)RMgSG!NELTH>cv+i13$> z`9aGP)&{LMJ|0O=Z`tz3_EKlmB8@!gL${uO?b}>AbOh#VZf#vTU+tX?mK!+@4OG1R z353T6o~V1jp&^8e@mQgEkTk(7nSn<}ScUGM-v$O(*%_4n}+aeu+a!V;E{kRVKZ z`OiTQ{^3(240h#a$p^$k>>s zk&$wy&3|@zT(u%U1#rUP*(tBZGN>DDwi{2OxM-HC=SyV{LhN>}NKzw8tQ0|!E1NQ6 z72jVtg{XD8K6g8k{P!zo>HYht#Q*E7!Smq}k^c?K-Z06E{I72cH~rsyQ&`Cl8DAZ{ zD8Be#mjmqldly}IK;QMh5p<@Mh_)DJ)<5KVGX0wRf6Et>|L0(k1t<1b;!YzCy59WZ zh*EkBwWL0_ew|2Fr+Ja=WT))41kid7NLp}BVLQY?g8^X{;S4G(kDsenaU6lxhFHJP z{~>m{%Im087HaJRQH32(O@Gv6-s`LsV~tBArQz$YR4=ULY6`9v+cNaHj57zK$ZR&% zk*85_ZeamzC<>?(fQ`{|8%oHp1dI8m&7?8wttr_Kz!Q39Jr# zuO&ElKP2lQ1imO{6aBuVR<10?&I{#|%yQ5{^9u@iv*o6@GY~;gl*9O8$nmRitJH~p zP^ej4;ir9aYTo51Z}j{;uxpGW3i#`L0)C8~g@q;uQQ2SXQLj1(N1OuN1Qcad)(qD( z%=QPf;L|{w6v8+G3vqbN(hpH>AoViQl#nnwN+IY1kw^ksar z%D+$yGE}Qm#_!PSc07d+|4lrVa{mm`EkWaN?dZs|90gPO1r-(AXE5!ofE*)1S3~%$ zCM6mzKVN_ZGg&;5U8qD2cq9c7CK@jNcYq6YdR@;Tzsqbl@t~=`F?4vFO(+1*n@~LH z$S@OD!2~-e%wJu1aW5$1;eX8nh$$70{dpmkDW$OE6FTKL2*7C#1KN3(k`9O%!XR3K^#$l?(6#NH=V*&FtBrp5 z`UJmA1LaO5`g@s-pcUYM#JqhNW(Wco#vH^~gqVn^`T$V?44zOIjUr4J4u3F5nX;QO2Y6(J^;fq$gkeV+;hro#F0=xt|!c7Encuh*WKj%YhxwjxBN`eV^{S{CyuqUieb~K#u z=bHoc=9~Nw6Bl2<-UNrDTm5PeCm}Hr3=>wTqmBGrSko=H9M5KWL%CW48VYBi;U}wOeh)EL!iy$38Tvxx292rqKKL+m? z(K*kL`{w1=faO%~wNdJfDHI#yg7d2doy-{|CQxX1K%=}dtamDxt%R_*S4Im+*N3tZ zGU#HH1sG}PS1>;;=Ux!M+#N>>5Dmd~KpdS}Soi?R5&?k)5bRE^W_}*%vB1?}aeQ5# zAw~mqA?iW-Edbhb&MF-6suncmT2SHic;ad<_C(_M_EkQ7NMc^Z!5VP(Iyf?)n?lm- z(*DTx&4zoN-?Jim*E08nd=n^6p7pBq`7)q)gkJ*=b*$4C8@tU~1KcAd-anBwyJSie z{)z*jCr=QbV9w?pJSCuAt-d57(OAw1;Dc(er#gt~hs~nlQkX0Vhd%{@m?pT`ZARcH zu*&OLJ7 zJ2=QXqLTUa={aao4>nUl0)l({05c+#a#^2X+5kp7-WZSM2_NIv#$8|NK~X@c^&})7 zAcB8%iZZmU02{lZWZG2(G-a59xj4*qBW7nGQ!_165)u(9aHFN7Dn!YVhEjPOz#d|7 z9|UlXe1(m$;(|Ya5c>D-Tq9yCVq>x*44_%4A`kFca+wrFr7AX?76(QV&go!TmLJRQ z5(!-8(bK02tHnzT3y6UbU{rwAE4ZG!fg+lvUK0x|u@Ce|GhYGt%oi752M33v{nMO^ ztvOIxm%venU{7uP&)$_iRW;=Pu(ULOGWGHOdXp>*!NPKb-74_{_D4=-Tu|Eu1-&k1 z@R&WI*1*sR-BUD}YYBqI1^@63Xx+T9XQLH%v?M{^NlC8}C=J%39g_PVh|4X3uk7vZ zXO@;cfW{+)T*wKa55R(C@E&NbSnvIT*KI63i39NH= zb5jiF6;#Wu(~p=37imjR^1pTWT&w_Jtn?2e<vsE6_9Gc^w9;Q6}r95$B)|T$8hto_zbYE@W&v~@jfm((7b#p9p%f<+c}Ln zN2QudJ*gn;MHarXq3-fH$yb%wxVgM9J zx2*~lsE&5%^n2nh8MKp+6{qZLl0hdfD=QmZJGTWA5fl-jn5|gR(IKi-WGJhlXmcb3 zSQA!Nhwx*%e$C?Y^8D`L71tgLR4F@*Nb zYcPgh#u?dkTRnOdI3_vI5a_nHT~|jfcflDGe#Y^NUu%>nfj<$mKf%wwf^F9^E5y5o zoQL8rwexw8M4`x)rEC#S^H<3#OKLa^t7v@)XFZR2w0CNi;D+6Z+ zs)Jy=P=EluY=#|WW|EX-g56bUJo-4O^&|Xk8plJr2vKc4J*|RKiWnCwup;8)<2&k^ zlaDsX1z=ghK_I4~$x$JS;jnAcrti&=rGyr?0xlr@)fye$lp7GGPl3il=_s5I3Xh5D zjApY^fPD!$j|UcdF;8^;97HMTG6-$U<#IW z`De)9xz*KHkg&lJF2DTZ4Ug3eOj|`Ym*<`uJ8vPdBk%s4@eHFkdZBT`1wBX&%uCA_{Bg8UtP=+*tpOu!EKgPvvrOd6Y0}F(5(hOw9 zC9q=_W9+7W0}>6HDzHy2ri2m-NDHD*!)>MkYJ+Q;6LcJiYFWH!z&uSbz2)WWOU1Ho zz#N6kX-~(-#)eSc071|%A~LHtfloA??gkGJ5A93pr71nc|2q?!cT!g9}iDY6l$fyPtZjd*Cy?`Z~Zf;wx=#rmdm`n1WnS5)U!ry zCfX|fhTZZ>N&^`Pwk($_4j%tv5V7YPY7?nfT^X*{RU6mJS0Dpk*W8?{q6nT&Y-}vc zWuhZsnYH0uw`O$=7Z{y`Ui$$Co4|g0Nk@m6oBA0M(F(&QxXi{1*_~9f#na$m&_#7J z>i5iqj#tZ!>o7;{LQmQ&jp$sm97hzZ{n}d(dotx|J9HVqT?@%ED;O5yL)>X=0{2}E=eJe_i}y7Gm~#k0g%(W<6Xp&gKJAH*YM_tg__9sNnY^7D*8ei z@xrqd401T)m?t&-Jo$l5b^dLox337ZHw^#y&wOjF8MjX zm;>fHUNCJw8y$te+|pieNS(7ugSfh@lrR6SDK)i|vr|hupCwifjzL2=8vd{`^gtf9 zju}9T&?%q|4(#v#9aRj9L)) zSknZJTQy^A?-9=rdV!vbYRrvSTU(|{Nh#9WMV9iP-fkW$;`?3MzxjrWBWmy9FvP!) zIJNX0iHEdZaTT?Vz8y;IiA}uPLPD+AHQ%$55KAa64`7AO^@5Q(DqC(WcNZff)b;^l zfX!46aiM1m^YeU4W2Z_674SjZu0bWYmx72lOuI%~y*Hwx#|$b`@L}|#QJ-$Wx&U## zx#!>hejbfhrZgG0_bOEKIm9D^EeMQ5XdFsT0wsO1|3BEttR~*1Uj2B$z9~`Ih!8;; zH70)Q*Yxi>lS;yH1b0Rw#&0KMyRAm%#8!lTAJYUH{ zg4s$KPr?E<@F{v10FUUHL%A1l!oW!Ff{;%|Ph?b7-kVMx;oSdk3`uh083DgM5*kllGQcKexmG zopbkD6Z_i1aDVDh;Q@hxi(b7>S*9l@Ba4h09=V%Gx{*taGZbLjznsha@H#cDGlRw) zt(Ip*UnlG~xVp{NR8)|012fg(ftc&$Ay{eHP``C_oX@o%IC1{``RFP5C|4IQPV1l= zvo;rvKc}Sh8n#Jc+nzOuxX*!-Zrr?Cr#TNVP!ycbJ2%{9Fjv89L>;W1>HXf|&_4ck zJ)IiE-WA#z<{xJInJ<>*wX16rQkc|9l8Xb1=xg{jwEP21e>+je!UCOIFKW~ED^LE9 zYm4)wB7z0W%;*yP1L$Vf9utg#JX8f}-BkA}den@BwXM}I!uze=dhkI&fLbRF2Bqatb}1o?h%p2G8xcc!%@a0T#(yn}h5 zSjW2HH0sI{7)0hri&9d@+CPH;A-;GX)_}0Y z=LIyA6t?kqvgj)$Kdm;0o!^Dl>a^wNhf;BCX5yVipB{BF2@JLh?TuFp_cAm#)x z>c9ca&CLy8QF&n^;Ii0E$Mxw^xB%rtc)h~K-QfBu$Nx~yC@LB+%#2awpB#G#aFOzv zR3vYjQo&Np_1>-D|(Xjh4YA5`x2A4s+;s7wj zvrpOX?L~Y;a1|LCu;Q}zii*zHZ6fEtWI2ecq?EUh_d>IBR~FOZ37H1R$(SJkw@p{6 z%X9VgfwX~|TUfI|_&dfumua4`t?*hl@k4H*AW!z^jTT;lgz`C5$QP?>Gx=@GgAR-; zv8lXJj%+|b2hkdEam2%O6;L_dq-sBULcoTYUHt(&-CTeo zpcfs(m*+t}@;O2>0u0GZ_jyN%zl8m!5S;VVJqWgV1UMMmPX3QS{#-0Vfpv+=eNvf- zuuCXGp&D(P_jnA+5+$V(P#N)(37FS4(5UF?fpbBeY(SzS!)z5S9}~)a47=hXdp1hK z{(kM~HEFC+@AgmwP)LG(-Txx^H1-u54eL z7DD~yG7ud^@cw(OJ<&ekBt|Ok?(Zi{JA>2n<|LiCL6N*WxFaGh;a7&+83oJ?iW1!; z;jODlGnAvO+O)d_JkW{;I0kXi=)qWtG6uXt$T6G!;5Sw!uhvd){ERbv9QIF_!MND? zmQivXYcKFKmqa-qL(w^OXw8ltL1r2K-QCyAjaGJG|9x-H z@`ZV|T0i{Jqm%ghy9CU(QBYN?W$wV>yh|{3<3A}|TV7zl9-=x!76(HC%!+P-={c~E zERvE%Z?9_Z!SOT9j8=sP1PPFRVjIn8dGVIy!k=&7p1?*c2ELmqxArK8GGF>?AFk7u z!%W~*8#^;IGn~SjMIPd)#yM1s1VbBNURa5*^@A(J9kfSRcXu(QUTf1uTmiAu-}^9> z#|@Yl9J~{1w;cQ`v=%!$)K!K|`8icSv~z9A=pZ2*$wE*k_zyF$*~6;fZm~oB2P&|d$hH+-Pqz&qCFHVXdtBnmJ1SMMwah)1W#!fU%91V@XLG-^D;4nsL4pNO#2 zi|&xjAW!s|5JjuOLJ$VjlVBgLM9SE)oago+4UJmW+(?i0$Tls&pB*EDXW6-|>y!5o z+HTjbUH5kJ-9&ofbDOppDWK`&^Tpw}yE+t9=ehvL@7HsCA*%NFEE}T1Y0qS;nzln631T!D>!hLSQxMeCq|m@D`+D*t*Mf zjdtJ_Icf^Vl`%~a^^`AdB>DJOp+xaaKZj?h^8insy~oq3v!1D|l8e-F6{|fxm)8~R zV_A*T8?mOe*47~qk@ zo!)p4QZs5+5ITHtB_dn|^BF6I*nkmI6;U9OW>8i}T)Oc6xru#S&KK+4v2e*6Y_ITe zo=i!g-y3a<-MbRE<|0l$lxABrUV!M*%6C4BTc0%4iM1}NR7$#eCdaODenb>o{8LHE zQ+zlK@K-nO5&1gx5?Q{-IG+F15^F?7;NZ}gXV*_eBJQ`?NH)f%6Rh78EBBwPNE$2) zEEecQ^J>2yBfzR>)7<5b!e;H|%o9Dsj$m|9{)E{J>yV%QXNw)yqNg1dw@SbiUrcWt zvCqob4Gm5^O%}7o}oj-*Fk z`5wJ8a~bZ9cuo$>2{8RL^YdgMia3pIcs(=LJu#aBi4Vn2- zOh@2^X>%qQ?7va4U>If^f+~>@74!j3vZAB2^9{s)vZ|NerBcwF1y2tBRnpl&Pk%Z= zJxLQvKQQ8(+S-6`-%POUHM6YtP_RsRD>V_vN1xuoXJXQrb^uBiX%i$O65_fam>_%_ z$a~`)ck5J5FwCSegj4h7Rp{mu&FxE>x&;8UE55*nEiu!v(s86k25}pN)J4b_I8-lj z6GKNxwKi**&BFH(W-1t|9uT0TsilDjSvABdlO(71Sr%(41f(gX>8F)UC(*Ux0 zn<2UU0WgEBPqEhl&5bHM-LuGfY(I!pbf6F$15lPmo9hr4!V0z)9njKVjA2GASz2kT zPLlfl-NGjzcHIHl4hRZ-Fb@0KIPUCNl{B;3v2gUylK2f@8Tw$1a1zw+H=AW#{60)z#o{{UBkjG|)EKrRfv@9OJ= zfa*e#70KxSRDoTE;VSs6NB;ir;16Tp6AN(zs)hktvle=JJoh1+!ws~e zBW7M2QO84g zKctru$mD!_BealxEG#R*=%JVA)+dAgqN0qbe8At8Cgx$?u`fv~2Qo%~P*G{x>(|GT zF>zSln`QW6X-K1^rlw|eH#P;s`}gm!z=TIyiV=%&F#bUCpOZ^GQ7FOs%6N*R;F$r{ zT9-nt1g0WP9yS1a!hWge@eI&b`*o5y&?ZrG;UgKxjGfdqD&P(1SCv{cIU&RE3xMZyl@u zZ>E<1eiA5XbekS=88?_7X)S~D{RhfWQ1Zseq`iZZ*nOm5IZ-b!5ZHgkmpBzRgio(G z=R5Gx2C#{e9vb{h=g7#W*XWZY?V{ktd;0tN;Ccglkpn0c3;?~n&@YL1I2(Owxl&_| zu&74Za=8&75$Iu*BQ-$~;9WRS=!2OV=lR~*+~TN35>N;h%zkpBoOXw4y+PEzKUXt7#n%ijH$v!0P*ab8l@cmW zxro<{jjc$ol!YI?sYv4hS|I^u+>|)gU`Izujv9y~O94@n{Dlu%tz&oE;QfM3(CQuC z-73kR(tq8Yg{Y`-miCJ|e0&e1k$6ndDeGmZ=C$Se8>I_p^0l;JH;NZXW}J6~a~_Tv z?V$jPV3n$1_H_@4f>3J~n|mpRD_~gV@3*_sS`~6edJ$d8;PupY9!X%|y1BIU#NB^* z0gz#vl-c+m-ZyJ{HNX`BWOMt>aBgJE47MyuzW-}!(C=(x&5hXAh@P;AfM|YqG4%^% z3Lw&3Sy@hcbfauM#TJ(ujZg2E<9gFve5d6KW7xH@SryM63k6|=uFej!{ek2PFN?Sd z*4CvNdW$f=MwNvyZHQu)-=g8c)vFW~H?RW`cPMI%rYvi!arb;&^K3zYhLBFk_{)cZ zOBF4Q9iM42Th8&yYG%JLU4Qc4!oeQ4v1R&^V_`Z7*8)5TrgqP6murP7@uRQZw=et9 zC9Gu{M)DLqw!d%LV!K*;y8S{wO+9lrXWwv@)q->Fhj704!L}B^&WKb+X8aj5^<<_y z*L5_N`?LSdcx@`_d}5TyL~EC@7d&DmhN^6&qgz zFAHe|{yYxV3@n4zh#i_$Z++MdQ3Jk&QZ62DZlhBF!{}K`eLIC0$RLpB^pbpoB6E{Z zr@BF~WqxjBX>(-jZE=eOW=jJ4jY{uw6%+H*p51<-k&-(6BB0hc_o#JbK$%OXttI*` z(#&evNudC#0GY@DJ>%Qx>DA0P08H%T;8=eZb{>cZ8j;PK@oAS-Lz>02;6N>XqJj|# zh`DXm4b}&_xO@s!utNTwK~QGrw1aA!#VIKnp_ZUdC=WnBXZVz7ik9akDX5nefdCpaEg1<~rC>V3 z1zaaqb`06B8vBxhZ}|;ISJX04X)#@dfphzMtm$+iat$Fz(6a*Q2wJI<_Y!#@aBSd^ z01|Lk}+oEkQ^+m88WLKPvsV+_dMjtyVqJnQ_-RmD5G=ei+X_ zs7XT-S%HV;&Ym>{TY#Ha{X&_A!oY9x8cp70Tme+H{b&Xx78XpGm_SAed;WYsF^~X6 zXu-|`3Zok0fEczTEy94c_dXeP`3SXj{0~^yqJ0?%te@ziXs^Qhi~~vr5_3J8 zSkSOa*~x3L#&f2aIle%0$*$Ro)?(}E_`!r9D2mvB-@JJPmK|s9+`!TD($b44EQvz{ zecoR{u;39QZ;R<9KLdJWyL!9p5`GN`4mTY1A;kQZXXNF3a6Q-yHMtJvKMyb!{S3tK zK)epv(028DPMC0bU8jkP+kBswVWWf4R_KW`$B!S+7+ke#Raa-H@`Xl-l|a^Ui+0e~ z)Km1!QN?KHIdYMGM>IX*McpO~*E}@p7NMluW=>g>mz@%RzklBZkJg#2^6!h4}G6(5#W*>voISmlV=b z;BtCRbYHZU!4BJZhb??BC+9ujy6P0FB=#TZ4!GO+?E2&ha6{q%J-ZuHX+IW!dfGye z(Y!A40$@MPPSqZYMlgY)GtCfbH-B-ud6VATLglkhbilBHrh^|I3^eH`Y(cM*8dD9t zMcA~&-2?kR@oS-e`=#EO<`Y!Tqo02Ujzo~GuU_#}a2-hI9dMEu!9=GvO^zaj+Vm?+xK&AUw`mXoVEjxZuW8HKQBYTM3Vm{qtkEVnC?gGCh@F5Ifmoi zlxhtB9!^wqk+hT)ZtfqrdIY>46mEudq`3q@pD-DOH-Nf9zh7~hYyu;2p@!6ce|;qO=8q=Uvquo z$qaYFjr?nA=>a1nBhxy+EU6$eh0MeC!~%qbCvn_ERX~PKz(KL<`U*wGO5XH0JGgcC z3JZte@SsIs4z3lr`-9wXZr;0p|1X#hlj}4J0K5rQ2ft;LKYG`Qc?r}xcul8hT4b9% z?gg2*fqX%@b!@xTE3>u?Al!S8`uO@9zq`Ge->M}TkgEy|&#jNdfdT^(oEPQ+?g*&f zn^~kt)rZq|!r3{yn9xiu_eIt}#NjkBGD0i_F`lHI5&zNxN6t_pI$aig%(MtnQgC^n z*;Mby2(C{d#BjU!dkOQ|2($#j2$1mdb7Nx&z%Op|cJJS;t*y!Fyx?p%8TU=$O+}P} z{}+kZyEL-yj>b;>ut#`cMbJjM=f^VlVhtbj6#^hq;0cdT%0t=4*nzK&GzAM@@J(fj&8uz9asxe~^x zy@G<<6KXN&VoQYk^e!;vYF3pffK5R&LMw~`QE6y&caPemes#oqw8dXQrG32j<5v@Y z5+6W=A&S9vaup5j4b9l`8SMvAZC@z5p%)Ne5rL?_g^^JX2N~#kHzqo0H^YN+PG#`> z8wT8F(#z9vosQ&4_9Vy*qwuyJfu^0%I<2B8{vK7)XKT-SosK!fZscJ#ZBLZoWWouM z5N-zgc@;x!F|{T}F`@!_4x&0snZk(zx86&ZG}zev;W-*IQl4B-R;OCnEDl^i`iJvyPhBO)R$F)D4$ zyRQ?HH8#gn_p6X?OtD_Yl_32Swnl4HK5DyQ*%q4^<1LDf(m|k;zWlNq(%Bx8J)qu5 zleSTMz-`gv^(DVYE3xpTR))D1$U8ljHjNGcSl{UsCx-k^NMu zq6X3|*r%O7MW5T-3-{ovApg{tZg_>tL+|j$hq9~AMZ?EbH}(6Hxd4Qwsg3hFx!wYE}~mHuRS+uO0f?(MMYjfdqyzGDv6X?Rp+U zN-SnJ6$0<16FCL=3cTa5|EMW0xsyd}`F8(CiJ#vVGCQsuCT^|Ni@zb58h}{q9Ry-| zAmKg-({RsaNf5B0EJgD5@sSk4P@j6LC-KZ7gE`1u%2qbq_bNMkCbMZ#F?v30l1lt$ z)rhzZ!-ScN@*h)h?Ca|Kb~bTn$+18oYM<0o(x1QkN3AygaaQj85DPp-l& zgtO7zZlDFp?^zd2ZAWsX>=t#r2a4elrYm94LM5UE@$dsNa;jJ(?~-GHNiz-4-2H-s zOTc-7k9rPv^z#$pM=*MLgB!VcWalxs5>WSbKD))#1yOTF2R@EW!a=tHs8>2->P~J& zuMH51H1JA-1zdi5AYYJ-Phen2p3^9nO#om=^wl23*YPr2>Crp#ii)H)6-_qRkZr%9 zOi5Jdn5T_m*xCbp)k{Bp#gSw%7-}~{`(-orL3f7_l8Z!K6j{WjOK5G7`3?2fH8C6E zWqt~_3-#fbLU%V5J;D5@TR?RkgjDu66;#<+ebG_?UJfQ?rEbv%N#tzOl?o|~%Fx0Bwg%RRO z(FiXeab>jTI;`9a4)qq3>lz*&9ydMw!Q}dFAI#I6UK6h!s+?8V|HR)O;a=htywv0b zI7Yb(9Jtd*3eGq9Iw2fXA$t=y3Al237(!8e$6dAna0gTCgBefFLBkl=g<(z)A|fh< z+OJ%P3I+tJn`?ikeR0HTx@-*Tn#>M*{ra`-@Z8*7HMDo$2wZ7X8PtX{beoi;X_v5C z2OoXX-_FEzKP80+JT2yQg#bFDKM&mNUP3N|0LC;V*j#LD+^NbsWY8brDL_y6$Vde; zbaQAX3pUIzPBXUCScTp3%ouM6gSP@?L(pLIkNMYLg>?Y6+go7dMsy~74T*?SD?eiA zdF*mWZ!5C0s^&6~^GC3rMB2sFMbg2HRRMC)>A;TcJ925CPq|)sMz}|BgkbTm~OJB z0ySfs!5w6axKM-QD>QlQ@4sJ#xQrI>Sez9g9>k`h%k32W0ulMK0aTz%ql$5n8^%s7 z;i*&v&XvZ9$`$DT)SK?$8!`lFsu-o1JNFYP+ac$2g~Xp zzUdbI_U*RAO#<^Lk3@s;IE;}kTN5!S6~y#piW(a(W6cM>aXZ^b#&eX+eP!H z2QUdB4sG7Dly(vtMI2@d;~x0Df+Cq^o9Y;w0U;m@5KF|wWogKIi&P= z>W8J~Z*S{SsmRXQ|CoSfiG6TDr{>rb`vBKAZryUOt|iB*5dLi8r77K^{|W;;-_voR zFHyAkyYw~F+RxWFapli)a|NYK_VA4^@_lA*zPTcd5zi4Fx>3P}o$@%y&-MNl?`W%& zJ>a5*?Z5qwiX-t=1q|TFQC6*4yEf-K%lzn%PjBQFhKIcK`HuQCr>~!#J0-XyEqQap z7oX*|W07$Y9FajDl`q@Q?)uVLRP6}%0zDeAQgwY_n8+^v<1aG#(8h-jfjd#lfo@Y< zdbpaDCk?Mmx1x8&Fwoe@h)fH%jQ|lW%1=g0;9#p-xxk;G5+mP;LWDbTLbsh=#Bm8xp^@da;|o7DkU zR)67G*bl*g7euGF%VQu8Iy_z*rMIe+d9oO?8Glpi0NgruAWODx*|Jm2`Etgf)ala* zNt#AlGBRr^fB^@O9<5r6i_?%FQhpa5Th48y8SUjpeiSp$xhT%qL<%y!~if&CU;rGpE{jAf#-V`aGc z3K8s&;sy9OLdmKp&|d}mB5WNYcriQzAvK|{@Q}ly0rsTFE|wg``VOUD~VRP)*P?ckz*qW(FiD?oXnB6_EFjg~P9U|wvzgau=lC!oMlFsip06|_8ZFe>sZ zm_o5>*mt=l6KwsHu&|>HKG_)7f<7Vm9)|zSNxSqoAmBaxg3^HcE+aYpXau1LMZF@K zc@&eho13YaM?r?zK@5dtPN_Gx!?7z}&y)We#!sptp;9pgLw_%N6>&f(Qal%jw$mWa zlqAKa|NeiRM18qDM#bnn;0yg}wBEjiLktP`r=t%r_$?Tqt3!XX95~ z2lfrUMM=4YW+XnqG{8Q5>F>l_fW1iEgs6mxiVZMOh`!5t5rPlfm)q$cqp9_OKZSZ( zAnW#MwQUaD>-19Baz>ZSoVD`F(cj(g|C1c5qOR`J9wovK1HmBlya(I_f+N0AR2Rl6 z2rPf1{sGAX$af1$2dr&m${&I#;pJh-$g7@LwvIVik%UDjBkq8AKLB!SLJ9$4mW_(AXVid;e2b&%PPLa46q0r<=fiYjM73tkoSN~7{q%Ry&0IN)Y4gqd~YQk=2e0+ z1*XIVH6gf6KrE?g3Zl`DH=vsDMG@JqzQ6e9Vk#Nag0@GF4c7N1=vy<~-7A)Y73cf(vvU~P6T5pYqb_kUS1dfJ zTpS(@Iy{5{`rswmcj)3N<1;X~khWHKiyCOkrSqd3R-Fv-l&g>Xwl9h?%LS6p6EuIK zDHL|sbe&BPl=%A9QA!f0C+fugP;~J<=7TvzV!+>H47qIOZ%?bg=!bx`friaKPqa=; zBp|#|8C(nTYEI}9CN7F5OU!x+MVWO$Ff_-0U<(4!GgLeQb&{w=E-#)l$K*qh?}nv$ z_5*KW(*90c%OvXfSs%re5Jp)4fjcD_THdB^ss&#VxrqSYSjH;sdIlGtigz#iKD&)> z*qE;uJn>C@r(UT<@CAFDF0ZPjF-M^v)p^TZjc*L8-Dp)giFz2LG4mIBU7^uKWQj%Q z5`$l1IyXA~Hj3v<_`Z|h8@J9lmE??l>iRd#9|6t8s*bcG4FzWaMR-WaMd{j}95Uh( z=Zb6^rP-qb3_c4*(<9>C=$D_LaSC4X>mOAwxA8gH&?`nqn`$zsYx+4K8uw3#4jf1} zdVF*E(PODNm+voK6oks{PX~E~WE|3xY5Zhd`^r$<@WtBOCp$i0e(bXJ#e`h`w$nl8;@rRSA=#To?t18i(%y|$lvZB4P@Z8qp5&JU77N3=o0#z+6~0=Ot% z(1=MZioj7PFCVavfAONEKUal9;l5=y|KTxgxxgFW5a|;@{Mf#k!b(SDwmJK;?D3k+ zen#|eV`5DlZj-EtQ9 z`gR|Kpl3we?sh3XZ7;Q%Cne7&3TvORJy&IWSJbi-c`e-e|=W&NHg#3F-ApopyO zKhuRK*=V@5Ctanr8R3=KGNqjcraPi|5uaOE zqbQk#mih!Z(sziZxfhmZPQmOq1Urd3bOZV=Te=p*D3r@Ns`Em1VAiORD3tI6H7o`Q zMkREfXkY;`Vj~gD9S>vAa%}_ZN7P3<@(=f4L1<6YclR|=PYr`XFMVzbSc3Cg! z*oEJ&ZXISXQfcfSJ0v8efeKV&?9eASAy=?Py<^U$ziAMuO_ELqiAoJ@Rhf^=KC3Jp z;N=~|{q~2KGr1>4r<}z^+~-~m)+HrmwYkbM`AUNl3$PziSOS`6kQ9u^MuQYwixIX$ z6AzpzuLDN!&U|>xi#(~Ot^F8PQ53v=!eI)hrKI8!5~QT}rl`kGcnf$=(B=lIF6-7# zYy8>W;$$pY8*Aewz4xsD>7M1jNn3~bilQX+3(TKlrBI4~(@;ItRqB8d2m)qb&j{*d z=*|8}aKI78>goBhe4$WOgVJtCZBU9sNLQzA^T>#wdu>Odc=%*LSVy5yKHNToKXr+%SOUhmwz7C*j3 zu9b4{ua`>wTR-S>%)3LbCV1a|&(oNl*=w5<@5X?C(8fbcEP^hbL}>$VJ%ZMbl${H8 zWeTkd%D5>KqX8k3o`rDH`9FB@6g$W@s51EINocf>G0=Nq!NaNplC~MR);3RclAQvR zdk%yVPnEu&E|N}ZX(>zskyiqlB|UUuUaN!T#2s4`hf?Tl@R2_Nk88o$Iuvgd`u5m7 zIj19=bSI%Cq2IdIF3t%Hr+WZk*WP7+^{}IyA6PMN84-;B#)8L??lj!nHX4L)8lQTC z8nVfAse3!00iM0U8_UYbRPCT%c}DK%uLg~RkO|{(hCU70n}Jnj5O;lrY!Y+z>eaH; z&}EM3=xBOw>MN6n=yRC@>#T=e+LUP-3VI?EuQS8$WjJ#Fc=YChF=y^t{}q(iYV1dj z{1^|fn5NN!ii(QholFKxrgw{udD^AYDBXp+-TO5BlV5s1JrY3b$5xjE-J^^t@i<8; zoin&%!O*ivP=n1`DXfP%IOIT+WAuG6bTaZ>8ABr@SwBd8W&q17A)F&&VP1DFfX<k_zy2!rto7OC+;Z;=o4@H>93~0AE;nxDHd` zOu?wOX;@h$vkm~AY5+>`69dgISleo9u<1%ae?~9KO*jP;p^pv00IH#`9*9SI5ZzA^ z1xj1C8|d7ro=1x8!opf$)>I)QpT`klJHW`I_N!(VKh@C`uJZKX;5j@QWh93W5yb zr%;zWh{QvrAX8YRF`_pZy>H3Fc6}zO$FOf6vW7{xYoiW%Eas916Icp(@El$4B>e(y zG?mxF)ydux3kA*uxjh%SSO8NTMt3t|D3`;xFMoj8c|{&DfCOR&&yFAKt>R}+Z7$LX zWeHACs;kdot>WP+A{!KjZUHoeH4aZNPuJr(C!YhO9n^2{NNm?Ke%Oox=U-FsC_EYH zCVo-)e)EZp+qSXFu(PvQV+2+T;@loF=a zt&O$|GU6~gD#|(XyX3|_BC41?G_BQVn}b>3pw15*78BEj1Ae?P$lpH-CQ${_lLM$8 zgI*wVLy=LxfHMaxF?R+Ds1C#ROWdaH@huFQ2j*fQckMBen z2kJ0u&CP)8;yIR1PQ;0&0u7i^AbHVODhtd~T2i8g^PDfu;A1$h5b={yCJ(~54p{JY1p1kOaPSM< z9CgztPy+y26mXO4(D9Ig=@~Np3XeQ7bZD?9)|Whs0?Q3gv^xmaFCcvcOup>hxQq7` zV%b=@8K6@h0(2xYlosdq_wU}lfIlx@BPE=bXqY&5=fHW?LfOL3ZtovE)$azf#4xM5 z79N<5JC9)6e){6#A_2d#rNk$8nOFzNQ=LQS)pa0VLA0Vo{{e_~U z9PN>(mk-s2M_PIPs-@a7`NBOaV#z+J=?Y3ISF|LpYi}>|EP|e~RUG5#1MXu?PZYW>y>8yrziSF~=p1m`AY)HgSt;$?d!GYM zM>B5v6&`iSekZ{+R_zU z+ccE1PH(RIlXUaRD$5)(ABRsdhlWPuL^K_lphEMjSlmEB8A8j>VY!fHBS~z&+PJ2Q zM}>aciFe#BMY?~OR7kbsUHmTk>bI#rzjng+;B@qW)S8|r& zk_re4qIow{v#i1hT7ad7adi}{iiK_DxcWt4EW2gI=cy(hlOjDnj%WdP-hk5s)wgSPcyg4<9|M3~rs^JQ%rH zWia{=O@k*Ch-3mrOi2H$2 zCqW|sYt;{R^kF@|3<;;LR0%*%l zMe}+A^_D2ZA)>ekqM2U9sm12wZ<2P;av;AT6FOjqZCqWlUIH>;qeZ6ee5%2xEpR8u z(Sa1gQ>w_P06Om9XSWy z0=&WDgxYvmC=PRRoyEx4L?lU?vZ$J}7Dqi?;*qA8 zA!gdwoE35z&2~JtyG;X_gmzS<-woA+TCBnzA3RzG1#$0({B830>wuDxPG1{q0U5hL zPyReRkz_K08mH;yh3nvOCgH*OhIXAv;fpSX6Djl?H*Dafr6V_Jq~KIZw)UnphRUk4 zH9U`He)-90VxvrG`E!{?i*;*XnJC!a3D5sn^wtJyFIizowC12oP%3pP?0#wM*FlV7jkS|~Hz#u)h;S7n`+c;54C>Kh*$6nw`TX5;*bS$BVf#J7)urRT> z58rpxH|N;J!qom0)z%Cr5lS-fU`m4h5r+}#Wfc|cSJH_+Mas~-Jc4SaDc#r?B`YcN zfToAA{G3_L*mpI!CjW?t6fhMywsEpTzpS8KO*ok$-o+;N?s@-Q^JGKm2`(2_rK<8o zdI>h$p3)QLJ9|=IcHH$s@v5m)yKNa4TBbul!~?c#kC>bffv(IB5(;(X-8*;Us+TaR zQ3EBpI`%snE)v$&H)5zAo`drgm5smKD5|b{6b~5~qF69hr$b<6b<`c=572XJb-*vE zd)e{)g`mi5w35`py-8uWa%V9^$E<=_Pz!BS<{WT5QSq&q3?)y3sB(y#woaV=(Y!@` zxgy6p@lIlYY-atusdbFbt+dw1k942!y1r0b(7Qa6;{}e5;0%e<*tFG-&BKm>I%>H- z06E>a-1Azkpa{yN80Mh)2#^PH-e(ezN5Wd}D*l4U!t`D~cCRlS%MS;}Zy0Bu%lsGV zrRF+)kV2Um23AOokss0W-5$N&oOU70tnTHv#IndxmPP)Nk@d`fE^y7FO=A+u${>m~ zKaZu6@90|3cx=21fo}+p?m#YB5b;NrZT*R1s678ZwPOZeaay8lJ;i*+>i%D;qsae5s7{|7$yf1aiL z|G)9iGn)T@t^QwMD;)<#ghk!mEZy4&mPf=?TWemZ59gjT8*sbi9_X-vQR8fSj_nmw zs&myxR#4hAK4Yr1U*qpY`_Y;lX2V2UmgdU@gE-#Ti_)3VVuSi5xBn#Kj|RN|S{q+H zTvXqEM?AreA*j_asIACg^Cy9yZ1_JD|F~c1UvFBsCVwt`ji&ZsUC8$Zxm=%XVnMq1 zpW`obcSvmM-LO;>*5omHz*6`}zGL{~1Ug=$7qwhMGl>&zO9OM&g-U0&b^8}T2TgnB z_BAO*Olh~ZoS`=DV2`QyaqXWt^Hp?kr(i|@)JKmLIX~BSe!b-uhnaK3xj(gqnKf%( znYK*0Pr5X%aLBQ`)@A)9X6r|Vp}^))mwHp1nyFmD{qm>14!GJHS<6)C7F|iK-jWqQ zBWWYiy=Y^`BfM^1!1M^ytQO~-*sy48+xh3T+VonxActk{sO%T2kzLe)$frs=o5WIh zhSyKImhQBan~kkjp}EyJryBZNtWXaV3rr}WGL3Q5vMas%-n}X75z`sl{NZbP-c-va z&)SB8u{km0LPvuN^~qMQfXT0->|8cwdV_UaJxAgy)B0Vg>+5~TD@J8c5Fvy4Pk{x) zRLvgyZE^T;Hs7!+7AKxB)E!o|WWMQH=U$`5D7E$HYK3E>69pv$0r}*T?OU@I~vpJ3W1%Zrx(u1FoSWCFKiuj5zniyKXd-^Lw0e|I1@v zwzx9!q=KO&>hv9^C6#+~8-^2oI2`BhRV_`QsVxvZm3}Zeh@J-|Fv?y~&gedTjWF_$1#(<-~e>*9Ak&6|Jqh*exHGmmro zfX^w=h)6Fx$mU6kM}^Zls7CCo zavdG!F|0iNqmcRc^EKu%vr`|DyX;|GK=G7^XbWhpYqds&td6<9Aj`Z0_c(+auoe ztuytgt80m^*Vp)cGV9jUDNism4t6KGZ4-L>sB+G*`9ahRN1w0h%Sl1D8a(Un|J>GD zANcFp*!o`7cj(~msZC^VtbJ*d?U5$xFfm-NI{)~wwupIxzDJ+6>ugBTfR~MR*+c3J z$+O-;td_bDle?au&iU*ad%P$<6`%bfZ{b@g9glj>=!L>*noT3RUGD^6=VFLQ2bSL_yMt+-EiTm3yh z#6|O1PR+`DhbGs*R(4`PQbP5rxEQ@yDM{ZvYGkRoWSTQ3+PW)RQL*s*VwQO9aT>qd zboGcT{ns^{zC53b8(#JBu+j+O1QK z)&ItmvOu-nwhfHXZiXyOkNF57g}+Ekvrg=M{9h8V|Au=-*RG}4ibKJmEXZ!#_C(F+DZ_Yr|6){P zBEA$I{yF)wmR4h0^Tamwyg*JiJk!)}+#nDf$5f5tY^}Hu0Th3l)h8cFh=>>z%2r>o cv^3|r`qS{VtM~41{E#AZTH#dkiSyU~8^keEL;wH) literal 0 HcmV?d00001 diff --git a/docsource/images/AKV-basic-store-type-dialog.png b/docsource/images/AKV-basic-store-type-dialog.png new file mode 100644 index 0000000000000000000000000000000000000000..19edb2713b6c28cad5dc5ab1983a84498e3173ca GIT binary patch literal 51275 zcmb@u1yGjJ*FE}T&?yQiC7_^mqauxngdieFNS7dubV`eqN|&IBNOzZXceiwR*WHi5 z@0&Y!zW<&7y>qWK4*0%LoadZ<)?RDv{pc_M{3#yxEo>ADh4)NSTmgl;6bgTHG11|Z zKw|HgDAaA#GjS0```FcShu4a)W-vB4vT;|kn=6}>rat26eEeHE{aM;rMfIk!er1$N z;SpDcOir6jI}2BPOND}EBg>63QF##(k?VSs5!&H9C!UdmSn?8tYilPCRPj&e;~yT3 zm2h=LSa&{D{v7Wr_antnnB@vKHnxa3{Moe&4=3sRA~`iXi%RVyM90D^nwsgw-QO>i zD>eOh!1dO)wubf?ETjGw3`aN^H{{>P@^DCYey+Hy2+eL=dwaZ%lOOz9r2aEDhC8P} z*X7iMM?*_Xo8(62BMCogdv1!|A%Z_kpJ+ZKN7^(HK0_|_NZ0QU@_ihK_%--Cw1bS+ zAHJ3}#0^Eh{=xO{^dz_9!$bQYKYl#UA6pwOvfP<(M;}fR@$3^t4w4g>k-=3;e~sqi z;?fqyg)uQP!4obmB_(QPbniO$)t_<+L4~HH1141$$MKTMqTc1JIxYk54ZCI5*2X+q%h-n##F(W!=n)Wa&iLfVI{m(9;6<;yo6<;Y^B z-v3S!&8!Q;OWEwlsQQ~HoAs?Td%ug%-lBn}>3+?}BPSvkj;qve{8TKXWg@hpk8L!Q zpIC{mPLUf;}mbGy@NrJit zvmT#+{$oWk=0KFtIfjN>?8&;S;haZ`Z6&R>q2tXObt4V#jNaK&v$~t z{QPbOhlUd2;^KajzlRbgzO%6rS}r84#KF$)9vb?hV*kxXeA7p(yGgX4LntE9P!HT5 zlSI8e3RYBpb4hEDVM*!K%nCoeqKMd9W8~M3+i16$Do`eZ58an^tLme~IOG+%ojZR> zr8dmvVZAH>$Ok!XB@s>59hN#V+^~c+;MkmT)DCr zI|L=K%G?;VXSk_)k(GVmn|F`pGoMrpgkikx`uch#mm$84j0|`1_#~amOLuNw-iFwR z)?N8;dmY!xCdQSAZ+bs)+O4W!ig?a2C85Zu{`ejB$d{p^_3`G~kRl$53~H@*6QuH?@*MdyQI9>B zZ1rQJMdGmX-f8jn75t5o4?*M6wY`JWIYp^7!;e(|p3QZNrT!}CX7j2}=Gr=(6%wMm zSIk4-PI*PzgbU>^ehF?_TfMn-d`d{v-P_#Sieo+B){PzTN<@J+w2$nz2{~VCfTOo$ zm_p!TWZ45ZZl#qiznPrHv097)+g#NICNJT)p%lgi?j^}N^Envna>)|UL>}S>;%e#a z56*2rvaJpyX(ifkz3OFJhZ zU(hNm{*qUCjs7x<ZZcBrIr#n(4`jyK7cYwOfiO}eg&ek=Y)A?1DT=X?V@ zCr5fOhk#Ln>cS#TpRq@uno6++CzVJ|2FKJxw+E%Fmw%OiHPtou2wxlTE=gfyPM4XQ zp4pT%@VDq zjV!W&0ZM^vn|1tHAu8WQHiPP1e}@7~?;BQk&p%1l?H8n2Sh?Z4w{W=Xik5!QFHQQbVsL_=}aXPA~8K{E-B4De5*C3$+_XiO)=xX8)B_ z)-zSD!$a1^p0c}bEP*s$!Un2>&%NulE;>mq*8aLhT(zHWr?Q{k)3Dew`ru@@oo&;B zAB$i1^I@StOh@8LwGvzv{rNgCiqZFy*G9mfAUs2EG4h7zSfZVYrroU7D~UCV8kxdx zb0~%nutQ^1Fr5sUG7f_Jnou5Rs%XM-BX_*2EBYSC3Q~B^R7p(tEL}lWThn+f5{;2i zmh$#`sXy_?t~#^FPv{)-aA<9;Zf-|ctHSbCO>XdIYN+XNRZ7{>qy~HnW%$d!5hlAR z&_-bHcFO#2l_kIBYlM4dhR#sdbFYV`T zmE^?BcjSW!?|TU^XUK?qO^UbTn;Fe)ppg=&*({A;G7-Y5P3FQf>h6$DTX^~+Q4}!4 znQYrr>CHlLgVIWSx`MiVkg3U^8~`xY;EiFM=UlcOwFflG%^!T&doV`Xz> z?0k_cU0^kq`8__TDCQjvxyD?FGVbY|mdrrI9FrLpnKL8I2ASo=rK?%nN1rI8-A*ug zE^jU_T)bFZS*a;YCNAAG_irNRvt$yytW?OEAsiR?!q0E>f&Jm5>MAuZGASmZhHj!} zzaYth-)yiyqzyO34=d9m_lED;7o?xgJk$7DUGs)?t2sXbP0{D6As@MTe6fGmaGAw# zIa~u5UhH@lik0_|ftFOQgo^1sDY@nrU*+9b$1D>$f$`i-R_h((6JN85Z0p>*k{P}( zb9<)@w!~5Ys6+kn`>5(soP>J!g-4cyocn)8M?tLkpIp6;I>brnJ={TT1KDnHDntM_|!Ze(|~c!%eCMLUB>&fy+MElTq1?I~7-SJ=cObL2jvqd9r^O;MK-e&bk zluQg?Xx!X4dl&%BM624Gaj{_IQ( z_f{`fAwJ1H7S_hOJpb1fMnbHy<^H2=`iW2Y`P%R(Jridh&FtLd@5(9TqwlzdN~1T( zE(}Y&SA|<;Cg9tvJ;*+jM?}V(iK90_FQ0bxv)K>bJ%*EP)4gZNxT-qhdC*1u#V-ZV zAgn{blgH(QwC`UTY&=1}BS{ZN^cXC7Vk=6@52n zCRVR1%ke9IWwO|kd91`T=DQI={UndK19Nrsx2lsw1&QB8?MO{~FTQP1_}-(7;6Ecu zK8DAI)u94ze*sB=N4(ycF3ic1g|liaxB|o?aHUd#YE>5caNR9jC66GPbq2`A-= zB?4tRHQ@c)zyhi(GrHUqF@7Y^Cb3sthp2>HUo$a$ZC;5!JDbD%OBx=9db;+#{-+A+ zkAl|Dh-(|{8oqU(hp5CDjcoMyV6l}C6W1T<`(Xx)sXS}1y@9G8Qv4X2Wm9YSbfP=9 zw>(xS{o?et26g#0wgVL(&7yd*7aGHwGdL#ZFGb(o3R(*k6=tKBiG7G_A1$t~lfiDK zH&}dF%%b7OMwVP}6)Q;QnRKd=rl$g3 zr7vH`5(GbKhvK3S11|P=?H1Pq;hBS{~%0N_)X-*bA$Bxm^g$Lu)Xx7Yq{CHo^JBiDB-%T2eS)``=6Vn zZ%7u0qoXhvr@!ybVW4~@&_h(BjRe9I)IO2FNZs7B78!jW-%rmG87Zl4_QF@=8W#7; z+WqT{ajZ8YZYWP3&-GOWwO5;h%9XzRhQ!jUMv3xCp!+ZRRGn^-{gfkcKIgCEziL&f2(}GpRFZXBa}^CP$p> zt@@Z zWjfpXH||)o<;_FAk;6JBW7B^2w>0VuPply z32nd-ep%IO`VQCCh?;!q)Pw^PQ)1#f{(3&8>OAETUma=3KPV^;q?&TDj^ExS{PD)+AktsW6qnfeP0 z%TecVC|E0(t0oV4$*4UIxW!Nw+5Ab{#M~o>fjbRMNEYuEv=|^lf-Noey9FHC46@PJ?%n5v|^bp+L+q)gXwDNw1UySaueSys- zl=@@JV3E%Ej*EJ+jE-&vOfov3`;-N-W=)(Q8}}tnE7~dQt+Jk!}{bxh$Y%0PhZx6g_)7wH>~Yac8)JeE~Mr| z4^<=vpi&@s8MTI~&EodK$03S7KDW$CTz?=|Q!NN99}@-*+_F`=z?Ik?76w z@n4yt_qYx@TokeCmh1M+s&>ZMRj8~-Y-~T2(h`5k*9iY6xO~}#j7-Tj6Ij^R$m)6Y z&3!k9P|2yOcX$FW9gv9}Rh#Fmz<6oj-~p(3J5VT<+%q;e|6=Jhkb&*xRLiiqEWtpn zxKE>Ym-V@Yt@$N225G%y(%TGqgvMd+l{KDKu`=y}S}R5#pg~|$iehd_M)>UQ?M;mi z+^Fz9qB%WC8#=JQ0}|wND}BFMV3Me}bz|oD^dFZzT+~F2-~EbW);2W^GIT7oXEf*d zW&RB#qG}}SdQ8xE4>p;UtT8iF1XDqH=PVAS2kUF26}3Ooihaids-Q zI`mIY49m6l{7fk44N2+#ic=t&G~>H|!P-2hZu>Q!WsFl1OShQ6S>sQhX-6r=fY{va zQ@_)wUtLimz?>mVeHicfd13O;2=1HX{JIS_x~;}U6N|0vdT(MrB2GK^d9oGAIk-!9 zR@y5@Xi>@c^}^{bY>R3tMjb463dMv8CMBxs8Hk8@KFzns=pOGbz0T3O3gKiD_rTgM zM3FHpQqbj5G@rRfmdnbiX=GG*@J=Js$O5<|9NLPMR>4nwmD6v5zmn{-? zfwitboi|VxQwumo6C+n;V@6FXt9Nn(EVzy{l_*J+e!_I%rPO9lH^sNA;&9^7goH;2 zc&#kGH!i9OxDk)DaCM2735S z--!=Z4XzCcYxkfxF=uuh7T(w|LZ5|5-Z47(q&yyOf3$L2uM>eKD)#n-96|atl>knrZdGa@Ua7mQHL}*#=k~$36t9oc8D}GN;KfV(A zdr&e}UL-?FELl-3N%>(~sXhkZ>ewcR^O-uwX36ttjt{R6{#3?=_-DGP4V2aem&BIGi1``cL;J9Usw~KJl&z-JzhvG_vY?U+8hr`gwTPh z(CF<8+hFcCbWX)e|w&ng}ps_Cb-D_B%WCOL#v_I`M{+(KNMfW~R zCfk$ZD|Q;4IU4lLo(eQQ++EYO*l)tKAs@nSpjWsv*;bv2=T=>(j?JXT1(WwXr%{?V zw7R8%;^(}Cs)-5u)gqsqoWudn=bg{((JM_E4T%Q_==sd~5hi8Epr?K0nkFB;vss$KVWV!mrP-Lid#R1` zf>I-{n?QplPCi8W0~baX0)7@|#-6Tp{K5vN*g$c1se16cLz^)#&KPwr$~|8YU!I0t z_o4h+EWhJrhJ!|}Kf8jF4|Gv_N<0Tf#NYyc&rIwZAFrs{Pkrgf+{Pp#Za+tQ$|aE2 z>0FVJ7%F)B$O%#W3qkd?(~h^|!CUw;kNW`(-x|t@&Aq2pZ(HQz`7qbpSGjTgE{9Dg zshAkHsXxA^Sy_YuF~+US5eFLe2w47VH+fTWjAqKdbRb@ro8D7y%lzu11S(-0ajSy& z^rM0^9wEb*2?=M@O5VNI*8RBk@}#*cqD|*4c$m-8x$a-{C9f3kY zx8p2Ai>) zrVGbx!d6nY?GKlWYIRb0PI8B=X_u}A`Rdtp?0^L^KZ7((F*ao>ckk}kQpaJP<0PW& zY~K1Tq1eWe&OiCf%MX9xp$je$LlF0P?F ze)Zv9$>&YNKnJ6TR1ix{g5Ia8mDNWf@xv?Pokx>tH-DA4*)cpMcX(J&XpF`cMf8r6 zS$pH%tCcnba4y=)j*7p04*Y0!b$54H>#Z)j9h+0e)hKX&o7!1Fh%1y>*vJy!&h5dm zSeX}yjFg(5e~SSk2#o&kAjrUceLbwiik+$OJ2d9im1NPYFyMCP_u#a{?ReJ3Fg?cF zXn))>NGi|2bj|-t_`px2kv0*g>!8^~E$HwZhM&0Yp+|#6r^5EWG^hWuWy|_tPxL;c zBB+T#*d-wMYCD=0h^4#;n>z1{NQt6L11;5vK}o4f-dGa zVRI&WQc70^zeBP8F@2Bug7)}d_QS)H+uwW%oG|?T7E^1??5{_kXEn{?F6@UzI}tpPViztl?Vo#q1IkRJ&jL(`=({?`$X75JN%BFJ9{Z<6zJO zOY%N^xO957kZ_NQ=`so`CXq2QwNUiI$H(vLb=sAQ`SQgRjwmiGtF8X_f*?(a;dw0J z#T5<5rMtzYrGnY-w6$p}&-T^I&-O>zd3nu#kPLJdm<(D>|G8Rzyqp$TC`WSzpX#w+ z04WdIqAfP>?ilf&V7u>NMlcJL__gZqr%7c@2oQR2wSbxN2#RaL!J_-;7q z=#8c(wVjVHYS-3##EMEvQ~!L;?JCdtPa zr#pCkJsAAf^SFX%yD!yCZJw<#(9ocvx~kmV($!0HpTCEv#)q{oFuPbQnj|D48MwWc z8C+t$paav^A5@Z`znj=;+GPDDI{G7wZ8})!ygFGrBHQi46_;9&0-o?5E2~+E%VSn@ z-gm-AMvGs}(1}7NzS|AoBqN)es_|T$tP%oT4G9bLewC)A4Od<4Nyb@SUA^rk{OlQ) zl(e+=+qYPBbaWYyK7RaoJE9f&rPxOQ+?HmS&X~ z=T1XILnsuhM!BE6JIc%3Te~fi1Ftl}=W9raJ3IozI4&)1AcG)%PfyP^Dk`d9zka!^ zW=M#Lpebc(;6=%xLu}cskKObop!N|>6n^o7XdpukgOrqXXn1(KWFcP6#)cc7&SG_l zV|Ai}d~R+|KCR#HB2x!+Qc3alJUR%UHw0 z!Xo1~BD`}A>-6l*5*`AD+)d`u8opH-v0hHSVBrlDsX|Glk=L( z$$mZT1V7ug5$%?*_apht*IIRcL`^L%JzpoQ+^XgU1`AA->lzv^p(b1o z-lS_(+#=^Q^Qx+7AdlG4z0o_cGN>Xv105=+W^h?m=HleU5HpUA4#MdXLK( zb>29nbsujq)j^Ox(bi6UU1Sz_csLUbAs1R~IpYIRM$#J2LL3?z`WH_5+s-$6{l$wH zq8UnqB^ANPBYK90I4B)xuMx$hY4~)L4*Y=c!x}GM&^S9g|GP(jnsWV8Z^{#4VRzJR zD{Jfe)1w{aA3vQP97;l(^^kLEX=p@jRt99DOG2Wqu`z&e!d|RNk26t`(VI~8%GIk_ zQ8M(l>tpwIbad*hI|Ud%eE8r+C<;QYJ41~R`D+Q8fQXWk#fN~J)%9eJFElFZz8+`P z>tc(i(^IM?o}T^)P1pOY zYirc1toQCormGb_-#M9Ujkt=U@gjsNxa3}Jzm?R~)^>emFpG53c_*;gZX^EiZvdND zMMVW0GDeJ@Ps8LCBasY zY|w=P(7umwEX>b;1h7OCwpkr|5&PId0Xm~FLBMap9S7~rf~bX9QGQcXT0|ry^!OAH zZlnBSV=3CtC4wmKYq;$78?QZZJ1~P8m}&j!FT~Daa-HMp$exWhy_|kMk!?d zw`Ljx0FjZtF5mF1)Qp0P3x7YGFdL>Pu}5^G+>U;@5S6HW*Grc!iQC&3%ip^$nyUD5 zch`pK=FR&^uy@1@F!|u#q(wGC5S0KUL?s>IKEwKWS;~F3h*lmNPCh>6cN66*ZE^g{ zvvYHA_cP@0*L?G}yK z1H1LudFj~=Q86*^h=>UJRK@5<;1#rvd&_sd2z9!Xp1^crd5b0%ROE=xmOJc-0|lX0 zT^FIrWqfzK+bfs!>zCvTjA4y9Gcz-K5(Bn1tV-%DgW0A~9Y8-(zZMHV+tt_Yg%D3j zbhU2?oo;#>_5XeqXo`!6cLT-kQMtVEJy@{k5xTc14a(1SwD4_wnnJ2qT3Xrzhi$!r znYI432&EV=LfSib#EEGEt^eI(uhN7Wr+G%7MGAvGI{#SZ+B~pC_}a28UW=bce008KYmvF zx>Ww&fB7V$Q`f>G`*1a{le?;Ff5b!w043V=&>iR?l4n%7PhaWmR zI%Lw|vqLY!*CkeWj}JD2VT02^R+yikN4d+!@S^>q7-Rd=-1SqIJY)ZrrL}c!B!_Oc z?V2j8x+RQ>!*ql@GCKM%{L0S7RSQ30SNTAkUv?j88$4-rRaH@Wd+q|b4!8&VF-Ns* zW@aYz>(?s`3=Hkb>!~kO{z7uT$HvwO?Tkbe6zTmP4Y5}zfnlmwI+tifXhIP9u~nU3 z3m{?nAVXiJJj}=x zINJbjj}g}GdUmYc^-Toj4vFl0c{v5;BO8R%nT?meG7$ipQV;QCalHFBR?y`ZKpi^j z-Ei(z0R38^>sv6JTEGt8o2kX{n#wCGdKDKJ8;?G+SwsQO{zy)yp`*Ke^X5&U^j?IQ z8X6iF`%;MkyKrc{g0duQfuZrE`X2D}2nuSLsH>RHOaZ56*KNR6hc$)V5+aq1iG`J# z^KLNnOsJOcLj{0;{(vB{yBzYFBs9ameody7q3T@($mKET>FLQ~vnY>ylk*CK z^N%xE7SaS08mn+{aqGU`fB8FZMYl1CN7CWV1e9ancQ4W?WGKvxD(~?eN#x~p8KJ2A7;oMu1CYnj0;Jt z`27kAlH(vG7jmd4VO6H*=Dbf&ov)LS7`vK{6?-Hl(XNh{kpirINK0cvRL|G1UvIR4D$}^CBN-$AtCCwZ{MnN6$VoYeC!muph!+m z-rU{wN=TsAtCqq*|=%a0gkd}_f@)NZFlsBemlTLWt5 zG!Xj`Yyg2?GW2N!p2rXF-nn!8(IeHB6xP<|)3dR@x{;AvNNfWGlvh&n>HhvyNP+zQ znREZb&Y>NU;syx%Y~4nDXl?%f>lY>tDJ!5my8A^X{;Pye->{1^3?ySy)e~cdW>xIp zDzB)RURw*)sBom=;knV9BIoPti-Byep`q91djo3rOUV&k$iRmY@xt0v-kQ{6kAajAqF5J=;>=9rclU+ zUL7qWpmyFwgAChUW@mnQax%EG*VF&&#dnL@CZf8!x@vG55ZHtzGw6&DG_O2DN3mP} z6(6f`A{`hQFzQb79-!TTkpds$Yin!M0$dXF#h-@Mgod(N>bVLz6CMJ~_58?C)^D{p zg#fu#iX64`@luNY(OiVdJ2lxXH`9od_bSH5N859VjC0&wM3a`5ws&+Ch348Jy2oZ? z513zPqd;_dD>C-uVx<0EUHycpVgo}tkb;0+Y1V4XCV<`1-rZ@gRDIT}a~n{VghYy{ z_010cjlM^*Q`%V-nF(xfS_gOIe=+hypq>K603Lbx`(uIJvRE78k&OY^KvXJ7Uz$gc zjuYoD){%Uj^pxhAloUyPe4w@ebJhqtCMFzg?OJCH&!M4c zy1Kd-oKVQS7;hssS zR;r}`$A_1fm9|Z17f5-{{7zFG#=uxzmP=LCfuKGF-Q1lhhVgDFd-@q4IHhi?ul$_< z5}Ww>Eq~9>CImmK5%>YTp74=joB~|VK(~%PX4<4%V0;*jCj;xgh2iwSdaL4pT8TXihRbj9zI+zp!{&`zA7cz~wusI=E&QqB%Kvl7|390jkZ9Qd zW8j(rnf$MJRvJcHKK$2fD~tmYp_|&C|G)c{aI(Dzqmcko9;MpakJPK z`ftU>gH=2a#D7k9)Kt$?Pc^N#5{mX6TI(I?;pv*!9+u`b8v`&5brK`uqGoX=d=0318EfvWGA%t%|NUe z4W!=$6sI0Nhb#J>r`{@O;AAWM@jT-9N#LS;`B;x?QI<*`ddl-SQFV0+$VY*IvD3qb z3H9L9E{}zST-F8B_nt8(G}Pn%%by7SLT!$kS1skU{WIFXpl|q>ThYJp&BY=ZJKt_) zL#!_p3eqlc>*+wgiE2RRsfC4uuH&7Z9U@}lmnnt7CbYnm+T7dAcEMjR>kmXK1LB?Ucw{a2$0U^sD@3^0Qqp}jrZ43{vE^+c)!j#2`J!^0?x z)j=VinOkY#Z|_o0oQJMZfKdkyBrbSUz)z4Nu~i<@3LZ{f*3;9|0u9pC-u^^O>vlsB zWdM?%K^uF6RRsuQxx4rRgej5}4#C#pFrRn~J|r|0&~b1Ofnlh6!o3q}fu^}Gy% zYvxS57jtp|?3V(w=7awzOdD>+3glb~aAe`XZbc z%#NFmj*i)dg$+zuftDVu+hX=BXq}#Ef4nw zHNgo%Q&Stgb&#US_yYJrem-~8oRtl@UvZD#JI?MCBO8#-KAmP;^!y`w78i_~o}NBC zC#NQk-!3FP+z0M&QrJ3Y^))OkF)1l&#M*qK+#h^g#5awPkM|1-LP!1TUsgR}_|lxM z*L>|10%9otEwO68kq0tpSW7(DcgP;NxE{`ifg{BA{N1<|abJ>mie)$Trv9l9GkRX0~=9{w3^OKDk@HQdEq#bblgAih# z!@6kv@s-NVzqKtBCDs`53KtBm0bGPF7?2qK7sLldxp&0zBUBgMBni-*kcz-9`KI#o zDPtHdWHv|>kdl0olkZwtS#i%$0S7xss5{`kRS+Jkiy`l z!KIr20@eFWY=-}N9dMlN78&P%;V>@l?*FEcmacKoF>$LZJ#pmUOO1g>&O5_y0n>V2>FiKo3cgAGk7r*jHm5|&!H_wGs7FJA zU_r_i;0ok`Q;uv+X!k+NEf7+cP}M+H!?;2LS`onnW@iKJE{pxu;fBYL|IKKi1YRik zDgT5^>;v$i@r_JPAiqG3Vhf(~TYmm^P)O0HosV~L)z#JEy}6f>k&)lPzJS`F1nlEb zC=8(<*l*rOZn(Gn>du`z)#Kxo3!Mq(ZMAgBd=47z4i5uaM(zO+{0X+EG1UbW01!rf zlgr>66m6cre|G0u#w5JCIdE zVupeGmXvhKs)T|wYBhA_9t(@NRPt|SN@Ry9=BYIoy--p;o^_-(p$(IQHmsFb7*143 z;-|{W-L{(84?%`wqidwq^j{Tc4)(79-ZTRH9HCGoxnK11g}l7i-@iJFiub4vSdp{O zU;R)JYieuP*1j+H(#{ULF{sXeI64BRYe>-R=+1zk!{Xy3g(H>)EParBcx_Hu!W_S6t46Ucl+h(sHsa`D?9aqQ|_nVB7aK_&QT z)mt3s&5fM&$n^m!y9-Uz8ec$*88n#*kMd@Oghd5@YD;e{3`QqF#+;M0Wz_pqUrhPm zY`yO*G-Xn+qQao5(@m|a5z~`uF@zKJ;7UiD**h!0V+9N zj;m0uZ3H)T6Mn*5)w_v}Phf#}A8;G{saH7iOgQhzKHh2L!o!Hrt2v5qRje`PM@`OSg3gvpd#DGi2j#^q;vaqoc2ZwK@z{D2{9x^e! zcz{-LL19~4+l;kGj=T5h<>EgEf8P2d&~VuITb{8 zj?;me?C_-91tlz_x2NZ2gSJSt0#!T|p{N!pY<6z$IxrRyI#D}0N&Q_S@Q)83`DXW1 zYBUt6+|6D&p|=Gl&7be~v!<1mmj3zk=Muo$=H_PC-gP9Dcs@Z(Rd+~`*_TqL|Lz5# z6nZr?1A>y|&~1PHvEa{@t&2mZlSg;NLxw&CXFSnO?NU%H6(4d__>-?)d!qvknItZa5U6 zRpE%aMryZw6v_8)Be*H@<7g&Wh#4%@aM(5j3RxNg$RMHWI&!=~;Xc^b>F%?`f1j03Ob5Hb(Zn zy9r9Fh<$6}GLWfR<=U5}nE;%Zv~&$J$4UYL#e-__2tiauy;p<(iU4{me!@;WS{H(% z4btf1xWC#A#-oL$Jkrpr$|so8W_|XNk?ywdUr1hmYk5mKER8q}DtmV*8PAWb&%N3_Dfh*_ z`3EYpNUzLB`3^o9>px(rQJ*Lteg+b-@LTh@;(f^Bi(plOXt1}pN5Ji6;X4%+lu+cL z9yMHM#|9>CQRa_$XdCA-8PJ2hQ@y7p0D)st20Xy~kp#qfXjwbWf%rW0FaO}+#&^7G zRfr#q*kJgSkLtjfY5{K-@v!eoeZ9@aMI2E7p+>7(i#^-8pD{NtZ@Bb56Kp@0>?|m( z!d9!=gymOA632oj3YB~#qRdRb&Q{PA>6%sXFwby5kCYUKPQepqE`zq)ckg<0>bDS5 zQ+Fan#?lgPDoj~}=JDfL@XtSsc%rL}{#HoFhPuEvz=ZsF!=IyhOfF5$%!nBq|K4+b z2GKU2BI=C|r9?lV*}A+j{+~WETcm@#q+V{%F?fz-p`h6iLTIJt1_dV@#is2McTN>|inl7!lMH*ul>`-^+5lF{BKu0Cm30FfLB0 zvjCsCMoAes{H}8D0XUT^mCg^dDvueVWk;(c_ThCljaZP>3P5-O=^|EWW}%Y<;MW(B zacA*+@VxO#zq01s-}(TA`IQs`Gx7(?ybUIwn(~*+eVK1!pt>rbro;kOShHh_CICB# zqUTV-WAzR2^J{uDZF73~Oj=U1p4P-dy00_;U3Y%dNUJty6njkj;nC5J-<9<`G=hTh z*X~M9EiE}bbxHa0BjodEQ7tX4%(da+VdNIz@b*->U5FMz$;d(K>phRMGN<@lfbp4? zl>lGgM%hvJTY(T(v!e(Fkqk=eFkpBdPv5U+)g}=7q-J!K+}wOabkNSqs-<9R{`ukI z;jCjGp1K=z7qnR+{agZ$yVc;nwsRhYB>wKxeR{gI-)DVppmz3Uc@w2hBW9pMKLO#i1 z%Nu?d@uWC2ll2KTEna0MS>XLAYe(+x7YM&UugAWz+G88)D`{xRVBDYHP&0|+I`i-A zp+OH%x6P@`JQh~DawoPbaj+LDbd*hiV{_3e)QG#snl$@*_T_(5jC6(GPqk+jE*tXVXu3M$&HH)THcI+iv?$OROc zYlLQ>THsnu9UZKn1#MS{M5Ls!U;S2WE)YmL0}1B0+@D5#?V7@!GlXN0by8ddYTSzk z3B4Ltz-q3A!?^Dr3h~dNGX_dV>2J!ytE+{fmq8Squ4l5c`q0V%Z7KK!1Oyt+TTkMh z)*qsP==c;B@j)lmY@#of&eq?06j`8z4?bnIAueJ$LBYlVxQ4xh!yIEkV4yzql_33G zZfaj8hL2 z5?=1;5wcVzqZC#TPdqTFkTxz5g}#v6!+^9|&b8byaZpgW23=_S!1lnw$^kD8g`|6U zz;+;+N6^clQfAA-q?~yLVYkr3xC4DTJy1MBRM#WB^)_gu+@`EW+NhvFmH?eo@wwoW zAw3NPS(=^jc^wc36nm7+De$iHqxl%{%_6Sikc7m?cYr|#{c_siYogj>AAW(wgjs;* z;w#eO%utRfmF!G}MQECQVyqgiEBYfK00)^VaAlxx#^(l;64Jkk*oDIK@`SR{+%@g( zfxxPveu_f4<>Gi5AG8LgNCe(Oip}ppwU3xV16%6r99n1#gl^WE>1oI#hLySqVAm1| z%_4~!ma(Mew^D|bqT+R=lBUN=L`rJNV$%1E2;3{h^w&hdpAo1Bahv+4jQ82IXDB2u zfjb7alJL8C%r_Vnry#lC@3FoIfw*lqJ-<9Z)ISV}5B6CUv@*N|?GA}9JS8a4dYz`E ztW51<6^7DnRK9i&=I9YX_)Q_#$4`T)3d|sm8Yd?c0B1=`T^JZr)F%OjwE&}|WDxuX zvu2bE*|ANNQE6!bx}viX0AvD=+@Kw5b#g5J)?p!yl2ug~vIkD9IgPI&n@W5S1;9KR$ZL)6A0`g_8Yh9NZSXsv#ohI4-ii&b5+y0(@QI+h==TWtNq)L8>=dSYrjk56s5 zm!!jzq{5_ZH+s!zIGLCN-jp3&qfiWg8vXcPmKlP}vxuj!-N;tvP^?`s>bR<{J*;2Z ztCN%Mbl^($TP+6rM$7Pb90Zb^pVohzbNIFH30M z8ATyGr9nobK}n@$H7JsmhDxQ-qNJ&^eu*?hdmzM5nvyh0dr6dbnrN4n)^oo6T=(<* zulxQV|NDOK=RTh6IIiP5uGIJY8SnRNoagyE-~H{)IkQq<>bI^QD7?2vR!(9jWe4kI z2S*3%v3(Cu)QAi$Jfn61=~MWJ$?vD6#C%m$$tdCXzkF|R|0_0D{l6vC(O=E&?Ir=Q zZprQe4!z9Qk6x;ENY}lRpEbMbTjT$gPKv*-7DN5$S8y%I5HTC@tzW_2-dCa1z-v2d zpFpA}E?!}2v>boqTZi1z=-4R?rQ>m|hL~=J$)8K)<)?Lg{O;XTgi;2|-8KY76djv^ zZ^?G&yxL6HeQW|2F;Q^u7Bs)0whaiRg$) z_fm0x=giJw#J;ni|IR@H8eL1}H#WXXg#0CLF_(Yt<>YE>>`uJ>TCP$0Fa%ogttmfj zyKC;Dj;+9@%37pN{pv(8u6V-`5EHwD3UcAnrN+}Ue?vl>+^^>Y8qh#Zd6Pr*0Ei^C zZ@H(pCV;5a9U__pIRJXiwO~IqwGe8zaNP#~e&_XTDVVvvg*=tVb`HJT8IPVkmR|p- zuPH@rgNk*%lvE%U=2fES8&3lgkJe7Q2`SYe;O^Fqpp=ZD_kb?)Dl{gC@Gii9wB6YK z8{e5OEBQR%JzA+i>);YTK6NzXFKQznKBUS41w`Rdg$)~SK&yQiUF6?Kp1niQ^x_mC zmo-8{p14?&aG(R?KL7j52BuTqypb|lZ;dGRv!^};g=Z6%=H%J>HxfW}+c6DLny8LC z9wlxE>hDun36&KN{Kg8}!VSLxcP8Z}AEU_E+*)JoV2%7#IlNIjjbi zB>wF8j@h+O<@L3KyZa0b+)mUa7yanko@BPjscY7HKa;hziMdOR#m;w)?meq;yu$L* zm+nOh^H*N8ZffF#&^%Y~1l>@+KH#L_nJnz(aXaNwhg<&i7>cR3=kSN65t%nqQ&%Ds zAOm0Qgc0AKR+qcs;ad9=hZnx4R{?xzD zMObP%fItA1IR7kH-lM1pFh2)4b;`M~GZ=u$N&Yp zw|Qiizvit0HdibV;XGppa24R|CKx9{St)MUqgxuGpbl_>6V)r*av?%LA<5~hF^dJ% ztOMESyLZ>w_Nu8pLhU+_XZuoAMu^l($Br$}oE%<>EJ)h-)^FvJ6q%u`of>bPMq2SV zOG`8P<0L@MD~#sjwk4)zYO2zuOQB#%Pn zhSGZx9w9a_)3?eOD-kzlWf_b0yH1a|0#^HrdU8D4Loc)?fI;L!1a<~INKF3=L_dV( z29OI3nwENVv3nmX#5GEuj4Z?W&E{V=GtXPG1GW0ipS{%6zF#fwi=G9gPd3-8>5byz zez8Qmh_t!*7-`HPf$l0655LO7{t+v4hIa@4@Mmvh1S00( zM^#aX+155WuBb~g(` z2m(PU@w`1fJ!L!A9F2ed*lrn$8 zTwl=4lIiA7;=mk9GL6ZtYplyQE?l_K4Fw=>9hcG4-kuAEo*ModsT^>o4<*wx73(`s zH9#2&q~IwEbm{?s$|F`BN_Vu4(Mu1GQWq7C4e?4ww!{l32wZKwpG4mb*5$J1;gq!G#v)v^ zdi7=bOTYS%XWE~&K=&0D6*c69rQY;wUPlSAKG#veKmL~47Zm*d#HdUiTZ-T`a0OI6VDzn_{dd{Rn!S4U zM}y6n$`S?jz5$ASR^80BagcqR0anu8AVGp$2R4gP#G~Q zGJc>CatyyB7MNgIE)-BGbO+0Yj_-izAX?n^mE%BxKy}6?8H{DjN6!J#21Y_kuw+XB zSdIcPbNKea9iqo#o9c1Y3cz>oLG+6tvJV>=a>4|?kL)P0uz6?Anst1{De$?BuEx_x z?RyJXTMob$@|o`+9?T?ZaARYmBVRA?}7OMXNVJ7?l@d+$|>(G1=)2wu)h?O&65)oSUF7yZU{ugU?4JcqDjA0 z6u-@^($h5Jl0OC-K0Z`r3wQZ-M#-DE1foV(+i1G&v-e};b#kP>W7_UsagqKPy3qcF< z@k&I5evE26U_iX5Wv;H%&f{;a+gO>et}Z*+?$XG(5fUGg5WmKO6sXjA$wO!EvPb0Cq^LjEJ3`U0r=WTV3oPkHrqJq-A6{R;*&H ziP~(POI$5LzI-&2jkRZ$5iK9Z^%SbLrvJcAJ&KB2vSNk3<}YtAuO~=Jv*q{Ev~cTz z`p-f6PDeHLlrnjw*>`gwy2MMmrw<>*Kkn(_8TqVceDUJ8r~?sSe;i!{Ep%XsW5-K8 z>WM+La-SLpkKQ8X3{ zSzHya&E8;?x5}Zcaf!p!J4Mt2geUdm1i!&-=S)-2FM`#I4=#hH=M*E}oeVU*LixdZ zVMtr7p+V2iX$8F)yX)S`9GbBw5>;zQF5FN%a3Hs-(XK97= zeR`*nO`QFrl~QXl@MPS-FAvtghi=|^Jb$cGkf%#Mef`nu#7XrAXA|b{&p6lW?{8^a z)XlSH5B*L2<=wklFV_o5*$s%XUGz*llfH81+N`(w>NU2yK|w)*B_`N?=d6DVb#HHWY=_dM$*2gIcX=JIY}WV|ssS*aKr;mh z_Xr^OqSB$2MyClCl;4RwDz>d9Q&QeYyPVu#n6y=|n`>w0E5EUIKj!$jx=l=^YMvW; z*=Vi@@DWwr6Hqd05%QByYytU{0KmbJ9}fyI%ARK`p0qt10TH`+#R?T@Qo1F~@l1SE zOFw_k>0fQ#!=W?UQgt}6Ld@a0@>=oS*pg+dR&Gmnb(=*<4}%IUG@979tvbCxVJMRV z_qmRCZzfF}1F;*kw^ZrxK7F95_4!tcYng7o@2h`Us;6S(r$-liB?^NHA<1G${}59%}4 zj-3rYF&-gdwj8CzL;L<_lv3qDt2~v~Y&sU5f7A-$9CSx{qNzIGto1$H-Uc2Jgm^^A zFh)5ym(Amr`ViAX4boWZx%?6*J$Z*lF25yfJCyg78yVPiuIoDDC*Alb`gddF`LdndT7EExw}cz3lFN=q7JKu z-&Fv`&x4aknT~Ham3dsawCw1y$0k}ACof#mP<=P{Jmp92?$Rs45MJ-|7dlhVyKI>v zl9V(?KVp9UVaQNOfhSnT%+6~r3|%K53I>cnm(EpnDW zE3M2Pnti9tj6Ezg^yx8yz%q^u&$o?5mPSF_EV$C0Mj-STOL+yz>lKMD(cc5hZ1T7sc)RJFPtt~2YNY5$u3Jrkx9%h_ZVUN^0B`0+^)Yw@r0(@>dR!#ttE z<`p*`^IcbFP7JUi$9{UQ+52ROm}tz(&tYRrJrx330k-^AG-?eAme$r{hyokpCeYI4 zR#Xi7cjJrm(_`~RO+|5KnvJdrS&X>{Q ziFPvQJZ6LmPmoi{qzFasXcKjcB+b8&)4=7<#48wqS&sxlVs8)ucgcccTL|0H1>}wZ z0&5@Ii0{aS==_rW+qyDOW-}9B0r3${iK?im+*gl~NA_VXS*L9IitXaC6_i zjq&JfL(2MJ>~e+p`Ma&aIZj+7}E#O&7I9FgaVHlE+)P)h;v zxw!5?Mq361u0}{V=5?=qp}z2>|DqujcOLEAHPqeKmII57=*E%m+5j|Z)TT5hI0I>A z5U7mu{@{aMvwsbD7vW1VZ|H41J$K1^q@)=;uCp$KqJpXgMsb8f1nSiCXf1IDKnf)+ zzG_HULD7-}%gfW{SFqc)N4#&}7XB1p|1{2sN7{NVLL7t8S|nF7v?raTY>|{;&~IW* zv!L!f7Nfft*Di>jjDhj9`%WW0l`Yl4G-{KrqA+5SEXxN$RxSucqK=R}G1+W1m_o%z zUcA|jy0D+F$?35mAid>=SI~b!9}(^Y^dS^<>;McIYU}j=VSw9E@gxg*-?{~WSx7VM zZ=GZj>`mR*eVOA@R?D-Xz#|yRM%WD_Ru3_9M;A`e9x|xz`0F<{Q&k#Y;@fBChYp}; z1ih(>CCOH=i5_^g)ldBkq%uh8ko(50^#ECpzF} zgtRB9D5Yekg?nG)UQ&9iCH6GLbak2I0+g}viPyf5CxsCOH3HfDfXBUMBE_C7zW^tCn8v+!@$;(6ReDZ3boiFP|cw>2QfwBro zue`jR{0Wah$%K~p%U04Bo%hUa+o}%m1y5TRWHEL9YuB$&fOZJd$ft*+79h@J>LcD^ z&;%brHT0k}6r@K;j}MXFYY3_uU8m)2e|&mdR@Up^#;!228LxyOB>)U~7I`E#fpoaP zuP@)O7@vk*Li2GL_c~Mla5mP&TFk=$&;{uaMPenR7WE?>0p4LOWG5!o5Fp6AV(gV1 zdQ@m7voVT7P^%Q+HFo*YRXZN!24mCGKuC}p!i#iSN?Z$3KjDFft0nBj*p3KsL(s+ijW0h*UPw5d*~JQ025#nwFU z_l*Nv6!1TXpJ{)0F4BHw?ooc)7#lk!{JfMw76X=_3ux|gG;?}fp}j0Zoj?-pq>W0E z<=Rz%K@cYZHn8kKm5g`G&U%!Wo4XiV0Ya7$JXjgfUbJJ-XG5PouYD5}YFNyo%*2b2 z0tn*CDNfV!FeGBtWj`dHcpbmIe#;hLDB!^8M1cm8X?%sj(LyLNFL$!(>bZ=a>P)|W zou?Cz>cxouvFFE1er<@*8S89o1=_;v)U|~apPea1i@3N7(K&ERoV{zyO==+C@sd*I z9Xl9g_X51l4M6R3dwDASdu+D5Ogvh*_EFzRPJN+W#ltU&!v1f2mrZ2#he}p{a(eV* zf8+6)Bw+#*3?*9rlG9>hVh||Z-Jro=HB5;Z+SYC6Uv>ZlS??#P8K!fu0}VCa7^l8| zp(b0mIs>sB`PBmf~5Bq6Z)ihx`bvzOG_&`bXjp>A(;pOp=y1TS?(Xtbz2E* z5OHgV_9hT zQ7zzQ^BXyN@-V`qYs=Hw%h}Ru&4%|khSfh-Z_!~^0pb|poIS@aBt$3UYp)Ukr}Nz; zH$hXyziL&Jzftkm=H@#B^R~;#03tcwB!B(V?MQ?&y#9@GX`7AGD>RjOp?yOI4mny0 zNCDPpyF@2ptBdmB#Vj3T=+X9Oi?Er6^VK~($W*R3W9G~k0UB0Ox&s_5R~8|ZQxb;i zA^+%b)=c(qCEIY#Bfk8Zp}#q&k(kh;YS*IA)%Yp@z{tOJME`Hg%Py~m;}tfSA|G5y{Of@3mC-Y!`FIp1&iirc0l+jlT{)U6`C^?%?{Dx;?Y%tLuI7o4yYZ7~K`t zfA=_sp<6}N+{@T!dZb^f7 zeuV3Ljih5*^X%IM?QHBGPgcy|dn2>3i08?<;n8(oJkn*4#zZ%%6w39w=Qz!o9@)s1 z^z^_pv7CVygGXZ5A5RcYt94qgQ#DoE-j>B%`$Z@N#%YR**@z8m-r=luUFVD!=GQWo zKP!oF#59w6;j(2ph~W+(eH>u&Q;?rO&3kH5LCIIiV_`R>%RUzgGP-WdE2$)jg-SV2 zdCh3mSNwhE{U5^mfimL?KD^E4UdOD~cKu2-al~FEj&*JROJ_fuREdd<>MXFV z=Gq-INPCBd@58gh0_zWisz7gmt6^HTZJR&p%5&%oF;?{s>WCNPXb?Q$yobAl1TH-r z`$z6c>jinoL8pX7;jSf9=r z#;A3|TzTwODs( z`B3n_y|YgBhF8W^Q3KdVFi2!dNQEm}c5&FV@vm7E1XvJ&z3%ICmtkblS7%ceZ&Jd= zwaxr=SRDGIHh{h}VqEovQ6QsZ3WOjf5f&bh&gY>fNpT$72=vj;o>{SL4dCSd-!RdK z+@mjciYXs(Q#-J)?c><<*!5YD*X_mUWI`A>Fbc5Z=*8+hE64NsXLc>fUd8C1P z+lN{U1ulzbj4p-|Z{P(pVZZG``A03%`IcOC!AR)DJwn$8z1I1jI%(8EN?39IgM*O} z=xhZgglw)|YmW{HjVqeP1(4IQ0@cK1j+FE0W{hEEwix-l#!U6TELyhqt1HvTysE3$ zeRZs!*TVz_k{2b^v)E45SJQZr8>&M>C?FEJjor;I+s6Pw%tD5M)MG9e)`moUFG6rn z7eldU$MIWSY7;IyVxkte&dOi^!c5C*W(p5*7K72guLLsymma{_-AwWTfmalvh4Ao# z+;4T&L~%v z_Gtc|URU?(6dP0A$$ONf)fi^R%TD$WQCr`sNdz-%;kf;Sm9=j)O55IsPR}4sd+I_s zCb>aYkqF!a&1;T$nXFNI^y-n=l~-GDi~B^RrQc9+Rj|{s5J9`v+G>p0SO`x=GMyoI z8QOYuDPS+GClx}njm5r_%06$+p}Usz=+Z<&62p?%T++KQqI)Vq^WgB~8IF3hE*$E0 z!LZGc_yb5Wq1s*crasi;FYeOPQgGsap`pc~rfJF_jnF9+k@RpXw}Wu4l*e(JATa}a zj{0Y=)70e1yQacXl~&(6tKcj<^WoUNM*(F=M|U}Qa@+&wJAhh_M##3?{@4R63X*7H zJ)(KUi^((cmQ%tHpX#Om+Fy%lK>pvntD%JvIyyuaYYfPPt0R5DKz%aeXK{$6H~Pts z@kYu{+<#Bpc5rN)R^2^qSF^=>z$QiHWQdwcnzQ-zx)xvqT{TI!(4zUEclaH1z`Ucg z#=4#lfE%VQiH<{OiRn>MX+k%_pxGT{D|AdVbTfx`zxPdZt{XIGGt;!LDQu^c&btUoiCsauXIE zm$CE_K9RQBzzx%gJ@^Q11p(U0z<1_?=D_}fmM;hohC|9>wRN&|t7Uzt@|{rWaJMMU z9=?lLBP2CNxR_K_B|84L5~aCWFw+JIt(6wo*M=~fB(MmsW`uY^<7ZiOKt*K^5Q!&X zuaSDhpwc18s8enWo+v-41gz_h>SO>V5HB8ttfAiOBHw^;Pr=psn-bbn!yGIdHynK; zg=WxZLPfUyrW0pRf9}v z!PU2ntR?EQZ_!Ue#ePF#ExPPG=r8*}9adkobm_GM<7RYB_n~*Ub9Uw*Zu%oHd&@2( zve9F%(t_!W%tnXKUXGR9I_jX2Xz4Ja%Go6!eg&*K862fLeRWAJDJ%q2prhc-1R8r6 z(DK1_HTxD965=D~Rj~ZLv~l&+#%UK@-tkv_MMD#*D`y`SdOH}qEvmN2yV`;qeqa## zp?e&6Gx00fbL^P^&{g&K8mM1KTe}s__4;+fJ6Jn5wD<0RUTW*mQDJ)CcGGBMt<3o- zg_%f#xD<_tdpu^$?9e~;Tg?ag(X_>oprO^D!5G~ecc-h7+Oa;N;O@f%`f=zw^)*JV z*Hq-3e~6HP0G3<`O50g|sHgINw9tVA07zTv08w|X5xXi3sM-4OhB4O4$mskT=ZO3> z&JiN#^y<&3Mmr+1=0DRNwFqzDq<#6l`m&qlgu>HrAKt=o{-Q|T^D@hIGPS#Meq5HV z7}2PaKb)yj18uXQ5V!;xne(l(ha2>FHYW2%olN{;Kkj%iU-R4Yd_$(g*4tB)b2qn5 zE<571Iname)J>BtTwk(}ukV9}xO1mSBZsHwPX*gO-R+TOsJMN}ccVT7{hwQgmGU;y zm`OG&!QCT!Zhi?7To=~l!$`X%drN4?3@I6zuiY(sq;-2KUKrioiW2Gr;gnuj?e zBE#bviKeyqnlZpS2mjpHzfY|!&A{fx9v?(i+bk&p4(x;0zmm z<@u_uF(`yg3ZgB#>X)l(Yb#~g2FvRCb^MZCgLPt)EjjpOJnY=ahuzCsr}_qeHCDfL z=F?oVf6RZJOZLpyHbYJ=CVuo`oa2Fi(WhZxO%9^;(x1I zGm6g=uo7*rIl3fFZ;nmh9L4vmBlfUdjA*JWC=&XzWx(H-Pgo}OQs(=QPaST{{16uu zoO|`H+pSwgJV|Q|*%2iwoiju7ldKLt*UOpFS-)Zx(*fR;9XGekw_`7@Y4>pC3+gjatSKa4b3VdbY$sVZ+CVy53EQS>viAIaGGC+w3 zF*JKptj$%h^&)9QqNAhv&D49;s}>*L9CfO>bt04Rt$s33$|%1Sh()ms8Hf zSNv(u8jtBHeutYT{7YF0FS3RKVd}`UvTZ3mBcI*{qbN#%?KdjkYM`r)mqvI1?*fR< z%>OltSqy5UrX+l8PsSe~9epu-p5p*p#xG;JgXi4l#T@zg0{z&CmmP!c3QDE!5WLZ1FPIL$Oahl~pI+L9mZ6R3PZnDu{RlbwCYk!1=;qy-~ zUpjRpxkH#l^ViPPlOw3HXC8!&Bh=MwJCM|=^Mv*pBHKF%tTr$gesUnJ5O+Yja8UW% z;FOLK^GB=*3P&0Z8+qk1(tdtar9o8)+7|xDL7_Kn%A(W8POqj5?gW)HidQ6iZJMie z(Olj-k4elOX%CZ-cZGHQdF32o$dgm0?^>eFcL^<3Af{eH21CCyA2ISX9n6gUVHe5E1~PB2O>kgz>Lx}!D{&tx+wbO-_!fiqK^3ha_7 zZRo=OJLT!8Up9l9(iZO5uEkl_Z%1jc7sPm=w9R@DdJv}G#cI9d?|-c6HI$WVFli(% z2SWtVCJutOYaKIxe&pGmboJD_nRUALJz+uQ(F((xlkfIRl8fuxqIANZXkXL#j5QH(sl-Z*X3rDYW$HylNa{$O12B-j`ua)Tv zY-{+?RDL#1?CN5NqVR_z) zA=i!|)9{n%)@4WPY;Z%=uaFuQYZxgttjPGSdxL)}4 zw!>%iG1deXgs3GMXq#2h9W7mzBZ8T5dM#*vNKAVF{{4`t@o+3SNS&WS%m)F}b zYxs6wJSjBSPrh&1pQ`J>HIREV2vmUG(>t576 zkNf- zab#%RC4Im#$id$xd`pLHqjZOZiCE1$NPNG;@DO-H8yZ6c^x%Me<8Yw-;>C**4bH|4 z71!Be{ldAu9luMW8#Ew+xa0&hm~OJQ)p#Cz)vX*)i2X|opl%9hVVcZF|KSG|x4Ulr z9lmYb{)!UVvmJf8`u3Fbc6J>}ReF&szWm&>_CALm@AC}|%*W9Axr-OqW1ImCe_wz| z2@0td7>@*+gK;%q@PkHMP3m^)JW^RSk9j7-6i%eO3YEDH8b@l3urS$L&b0|vxO(dQ zubP|5lFxr&I9liB^Q^+c(2c2fh0!=cj6pg`Y*{WzOV76kO^}>^`upfD#5N-WP)1~CCzj%s@h>_IHE7Y#C~M4j-%h4@=^4SYZrX+9Gs^XILtA0iZx zPD-m+jgHKE`}Q(I1zfv}P--QH)$SSSd^Xn?7#BTf0(czclg(7|JOu>>u}=f1F=fpd z1z#=YG%SRG_7I90Sm(-BS@+hZ7&T512qlT<)Q=& zNG_0HF-Z^#&XF9$Ff{}y17v<)^P3`l@2gunI>Uc?_ZxL}NhYYB6j=MnKrRPSXAH!N1h*>j|vEKU<^8fQal7Ci*c()6-XEqRSRL8`o6Jo`hoX}sWc&JcG+U- z78fXYTXCi6O3vHpSoT(7p_xbZZJa8I5#_ppNJh1SZu{G;5E`?yCWAGwOb7@sT$RK9l zX8;w~F0h>O$;o-JV?w&+=HcP{dupKS>yhHi9r{nRlAp6L9GmVPS1Y?Kl6zge>h-yH zF2RCl*LX5-PVb0t7cs;3WDt>$39t+t?0}vwAsRDRWw>dwFk`-Yne-Ouj2Sc%B8Jhb zL6rhbYd=HA8*|8Cp@<1N=rLRJX2GHUC}auw=r4=c@cO^xP*zs1d1Xf*L{SvFtl zgoA|3GcKo0h5gqzu1mcA^3*=et@MsWotZe4q%2Yf7?th{jWH&Xugf;Z67UB!20-GS z&`?jPHs`P0_VQ_3fS#iVq!k}=2mv@c#2kZ0cb5~bcd{HD8cOipLp59VRC!?W?YM=&BP<4Q>PR^YoBtEjGH+WEIXdx1{{D5v$!mJ zjTlonfMA4q1g*;bs;Vsrh@kRJYS)X1lsbc6J~JQliEYxpYDFF90;}bN!d+eGDt9z0 zFSXK3&3UwXlk}SoS-}En^^+-@8xD-DF6nno)$%G@(tJlt-cH8r!0=D*U*8(%E#%;E z4+}f-N@h>R$B#E|-+l}gqgJ?NkXn0(jZC@ea~t{EB9vs;P^&?1k=V7W^_h=j)%&02 zJI&e0_>yhLs((Px2n}Z`j;mtni;k=6% zKHFrb$a=Zp?uaCd?6dKyHD79LD-uqrV)pL=Ly&)97N({gin(unu^BR4JJ;@xit47< zw<>W*dtdv#|9s0=O8(t#Npbzs$-cqR1AdxV~>G^77*eekD6%=yC(8vc>FZTTaY z3;d^BKK@7MCiI8TT#lPVWLk9VfAP=n1l~ozit?A=KRzk`=szD)^ySNnKVNVC?_Ur3 z!}lL!4`zwhE8Bk=;ttS^*1mbbO5#baOon%)JzauBF{|vJm~g(ruY6@&x^E>vZPi+z zXDbq#lABi0=o7x6o~46lZCSWn5jN0kK-idRd5AQCmVfDmB)0dYg}{%VLX_-PH9`Dx5l06;v$0Bs@W5N^RIdKrBmGKn-!H1H|{txWo3X;@xW#p;{( z)TLbLZ3v^aX4a_hI%(_Qk}(aq=GGX5PlKmf$d~qx`fT~doV*w1${0b5 z{sJX4P0^!d_8l8T)k2;MR*zD@^ zk%|ekg;!p@Mis3h!doQa>%CD>&;#BDo6j|62{A3ss;c79Z)}XpYH4mJBRkw2KP14A z^w5zfC=Jl87(#ymmgpvuIxg3~?Vjce&}qz9ncSc@NU-lWgeww2)a@u<$i#sGi|l*o zLMTn$Tq^huEE^S7@I&~Dev6E=h*W}NrNcoM-hZ=KAyZF;CMJp_*KJeS7Nka51~mY_ zi-y;LGQyiV2=yc()L@oCbm~)LrgI<0`VqB9ah6ER`4(pC9BDF{vQ1^BKhztjM^wS_ zP?5_3hd?td#0>oSQ3wpa6g4A>*3d~AqO1b;bRHIjG$R8=n}3xqZKU{yuyncB6}1`L zgWIf}^5a=7ImpBaZ+}o%R8B4o?duZg4R8_1Uzu}4(Yh9XpZRklmA$y>X34osEmX=E z2b_>;Sr$}}_PyyN-|($8Km;WSN#)uF+fj^(ga1LVvJ=+}feq<;h-Lz7f(aSQOUVEE ziQ%ZxshcEd8O0S`K6c?;A%9y+WTX@#kDf*NA@VhS3F(9^?!@-9HaC z7^*}P2Qi=nB%wZHKe<$F1NSqeuEv?HgrVd@xVB4+0DS@@i@ zU~yE8Po`EGx9iX}{ac!uBwOj5@7AE2D2F4la^413J6Hxt@9%^{E(;Al-F-r|I82Bb zL=(aD0=bUa04W)mxHxER1`-@b6&XjK9lDN6<2)uX!7Y$P5qLv(ULFgLrlHUDe2DN5P?SV{~qU}4hPk!j=+wA^Jztn=m>gXE#6kh(HBsq__Yilr$r zEO4yLlYoz@A!N{&M&n@(-WC2O*`PwMzIY)F`jsVrc+>@!iWj4-7p zeTi{;Jc(@#D)%vz#gxB7c)yw&+%>O&Frk(o8EsH@8{*nnrvuy#4|e6TC!Ijc=;oOk z1XqrocwfXV`)qjwhV}HJ!-r`-Gti3Wzw$;=(E7R;OYBZ~_<}6(ZeW_+#&UV`=im^j z%E#D33?!+LfSkO%L6mAnn^&B!d%Z>9Wo#X71Y}#VMwqn z7Mwv9-rVAi(_0LUjK&(Lr<75J@xGo8Ei7tnYGN3B)+s3~&xG+ziBM;4P0b9>iY_#S zMtB*J!Yu_C2%)|rej*%m6(L48Jv`rxKP)T^BP*@YbDBaUAO%|g>Jc1MZk`4;pvci^ z7eS#%Aqa{m(rbZ*YJV=m4m9ErYC4>e@m)y&-d%_K^={AuH#9U*6^Rx@9R5{6;dlA+ zEApDv)6Ony@tDjBCin>*B)X&=tWG)u0(*F?x61NO$L6871lyd4QBralLFr{I1!w#&_9s|K@i=X6zHe z5p1S08u4eJ)r}mE=cn0Z0A8Lew!Cvb{Cffx2hO0GXQ7{}1#Z3!oD9-zRM{PT)1%7a zr%ajofrvD?PG3R+ZrG3silnkq+O!i@&WDUkPVkc33yJ4>Ticw<%57Cc;zqIyRu znFm6>xQu2CNoe+jJ}dt(k|00)ZU0H@p;!H93(k2C58fzwWYsNuYOu86a5X$BFF*~ zFA(@{5z0$4M1v?|YgG$c+Se&5TF#zyp+DcOaPfG5?b;P~U&izH>j@{d8ZyJ`(@YI0F2W!%BLgj;8+L_FdvSrpBbs~3GFsp}U<|K9ejqB?=d;1!Ac>Jz1VqHH z7e3S5pBuo*ACaG$*w$}-?i^`_T`x$`&(*s;(q)KY*%Pk&?`7HlTve#J*zXQ+cTsL* z-N(55KX5k~i#&b3@v?Hwl<%(A$mJsR6IXd97MA^{bh$U${?AsS#ZTf`Z{GGat?y8< zZvS%XDxKlW<2ZY-vMtq zjl4S73e=zaU}kfCqJEC7tSX1~e8q6RF=>6KYZ2)O6f&!$8+hEpc0ahCcSBZ#wJpqb z;)7z$U&`?p8^6d_rAqFY5h}&4x8n1rrC6w#5^ZT}>QmNK3^zbu>zvxY@Yc5Zk&gAO z4ly!6hsMlVw-@`kW*k#VTH^4lZNzzYpJ9*&cfG6EUnO#E4@}fK!j?==Sk`-O3N_=m zQmT7bQ&TuGTH3v~bfVYV-?oR{XTJ0Ef%2P7W1=nX`^lILAvQr4!HpGgZvUL5vKWZQ zaDZBeSv`8v0nAr_Kv7CsSelvupw9YIe&FY89vk<&kB&q~^VMyg&unJ6riB-_;jXUu zz_U|>BO@KCB^apAXJhKty(acCjw#cE3;xWiS`1es>Q%L2z&i@xgqlsVXmA?!GREU) z-$#T%)RWh~F1!@VUW69bBsGVvBN4F!h87lz=B+$MMWfS$pC^%c{9=du;(Dw`K;;Vk z+~!*)-QO@AtUofW31G(%|2|vKwBW>p#^W{}7Z>l|UJ|L_S>44hH?x&{mFWxK)8$Kd z0uS-&U!R6l|5kHi^(E*~fb*fcdI$AB@yYPD9pyVAJa#J;hz_>rYH->RZ&bh%9R?9N z>MA%z7!z#l?8vl}Swqlw<=3Z5>+`YF`K%ZNEJoJ=_FhaOB0PJ@{JLOl(j3*?mTSV7Lc}61m6KCOmqy7B{>biW68m2xDGAQZy9>22@9n(ZLXN z4uglm1Uy{0VyWZT5}o&@A?cx7<3&AS2q6}E)#ZszXNIVa~{l&v`0s2S=8GWdbAWDA&i6d9L27loq`>Bqw9gIB)nCo@5H zNdQYz+oC zyoa!44ALta48aI}Go59F%G#6D1L}hTMY8nj*j6BbvA%UKYA14gCAtTXEkjDw; zkBZ?nGLZG=MyoMO^q*bTOR(6yjK==DPY}>QoX@Grp00h2-7JJme^FAfN^-6!S?;w%efFo9|x$5 zE6Onzqmc!0M7dasG{nP+K@^CXz)g^61{o}&L_bw{cT2AoMlI;bTX1<)OwD87{feZJ zXu+NAyOXK{CCvO&PPQNA%Re0r)fb&6^Z>gT&Pg99Jk0Qf!E!C;;K)NW_zmNn)cpY4 zGR9egJ90g2(N7V%fNZ`?WJb*tcP4kc^AY_@)?+15Z3i9#UapcI|lxWDbFm{}en}l>jESV`k@CR5J z-B&GN5NWXbNu~uA0#1wkCF?zo^?;)23cQxDqMh{T(6hgcr3RtmQxI`vDZ?Q1Qw*=P zZyN^-)Q?4%0BsgAKv0~}o&}FarzT#>0eYAOp<47afJwL&TtcB)(a3Oi818KZJ~9h8eOKf}FaT&+UffPi zmBC6R*I#T|4%CL++}wSGgW|ot@JVjVoSqZ~rL_+A6KDaG=jv!b#t~uzK9>v!l;(*i$%!SDPAZ+drEyV8PHoJe&&>1Z+8#im342(i#I0Al~KV z%$AgtB;6<~`ORG7JqJY(JyP)!$R#=gjmB@I8^9VEeo>3DRrn8_P_Xh&nrOnBE~zp` z$h?gcoayNSZ@>|(bMOfQNCdd5b71I+L!>SOa0e3s_GtO<1I@-i-$Y1k8<)7389p8r zE6&G(j>E0MPk^LWfF2pyUQVEnSyAq*N!1YiuC;#P+P*BZy&V1#=R3;|@Ld|w*#`8wFg^sW@I zlKxRrRy{KLU1*I@?=RO}g(nvrA5Fr+^bYd*0OYY>J3Cdes7s0fXzhk%-DgoBp#Au% z>5vuR3geQJX8%54IW-k*Zg^+CkyTnhGr5d_0tf!Fh^7S{J71W0VpbFRY&UYsX_Wkw zUO+GuCdrQ^CL}atE@u_yUr}&_0K5%tC@guPmkdm1fib#$V1U}x6|SwP4W?jw+(Nkw zOj-Uby#rNe+CH0D8{%+-@PViHo4*GQ@+2}}U9B2| zgZXmH%Y9K=WqcO{zHfEq|{4GOP7N_2kHvMItTsa z!@Lh|nH6kJ{%;`=FkE&~H$@UF!f}6Y566u1@Q2S{|0|(bN*P{+9@!wWV z@Rl-WE?B)pZ8a>?N@9&-hyW2^*Wx&l2(aNB`cV1Y|ku2e;C!Y0fHrvk;}L0Dj8 z6YN!0&Bib-$UBXfr!|Ny1QDMHjH_hL%8`bpWZZ{$**`KunY_JINvuBIDF8t)4q|MZ znd1;tIbgI4X+Nb>Kmg}5wqnoYFwYOp0@~mZ@DlEW!=*7*n%PH_t*dak(68+6X)VT< z%iZg{VZmp3=WiLyhPJ~F2*Y+ zc>&n!75a^ydMbAeyk$HB7f&{#kw z7_u~=QCgT%qk4eE7soM0f$jYtl66Hx=`3-u-2#3{Gqj*zKls}ifk8DV@Sp!;jk$D9PA=ejTEvAE{HjvHyWN=}HL ze%b(EMIp&l(jnqhD{8lKcrAOGx6;y_fXATxzJW8I0HXmOo9E;- zE)>xPuqq#byF&5jW8zSJsvU6d0VL_*~&`( z%&y!Uog`xf2nco)P2*`GbPi4nKZ%X$~uq_+CIK;$1ohjG4cAfM+Fiq}<+MfJN z3((K^ZScdX`8?Y{P4prQ3}EQlG{n#nAAjWj-I6jv)H>1)bd0-qxzt^ zGlx6&Fhl1fs zVE8T+LZwsWTn6>jqWsamAcyX?JFq*5D6w{vX*wC|HNM8=XMu64ppsSYSKNO-(ee zDD-z3sf}=XbbbY3gtWm@8RRe~@5=Q(L-%bA^#*=ewR#)VFMVi8+=maSZQD>BmPmERf5S`46AHfDsiZ2dV|8};OgNsxA# z`lW$2K&qiGMsnc&zDHR7uaGLsEobugdG$!E@3SsFoYk}JX2m5Hn~6rt;V+#=V5qT< zy?RgNH<$o|eh$T`26`1$t&KBZPEHOIcR=@IkGcjY>SiB3l075?P0bVNGuUlK z3ZCz;6OF|Kv6fL*{rU$bdB^4pZ0DR6h$Y`Bb(0&P@{AV=9t3i10+GRQT%&ahs4L$Y zr%X*@5W8&p+gYRrqyJ4->;IoWFK$2Ibzx}Y;FW-$HL_ifUPYUZ2`fe=b5(TnH0Eji zK2AZ_WHv9qW*K{1pLa*#aE{KA0U^JZ?Hr}LMh&f2D(db%S8W#D!JI1e?DZ3)5Ij9V zZ42Nk?f&x#cO0Ji0PN00x0P$rt72GT0_#Qrc`H3#j<8uIZAdkis#IgH^9lCY>{klE zQES1z?_Eug$5#xzHA`VuaoZPuYQ;oZ)t5MP{g_S~cZY`P{BV~R4ThtAB3cDUm~Q;G zae6fp>%EqE@CF}{|4_*nphcF3=8nP>gl6!nbM798uCW=2fV6yu%j9x7LT~ORVcAcI=9O#GCoSI>pDuOtTCY&(n&D4b2zZpOv8U>oaLi0w4j-pvI zf{79+`i~IK;P~*6mh&d^uDt`W7VN{xyFq+;IXQGlFZfVJP~wP74+%Y;$4nv%X!%gq zw?X32j@#Gb#RPjOI&5*+NRsRdvJjFSDojs^qd}zcTKFh7PH5{P38HH!mDAtw6(>Cu zXd_gefMFAG=<+Me`a+bbq;W&#`G{7|G&81`d<6=P(q){S^0&OYWV^MfaoER*Jt-Es z3SIC5!a$%#qGP=)~V+AxvK%z^C_(ClY3(u{hU_VSJM*E>m zOgvrAPpviTcZfq~HIY6L;1+fJ_+?Y4P=EhiwDJIZW{?HFGiKvRIs`7~5ZncDc-Xuh zpc0T3;kO+`+#cFkVmnd9dShAu01Z)>m~J4kCT8GEv4$rOPG{1x?HD+&%sIM6#bO^dzi@b6$i+pIl2GK(SQogSL|h>(#7Gl(ATHX`cnoZ77poW_U&-Gtpv&4Itjm#$(ZQeA>=~lX)eE6JvH^n=sK) z=KzgZ#FUINgC4leBG^G6zSZ|}^9)pRZ25B@V$qU$#@H`cm=60YWae@4v*)->sMID~ z)K)qR>w~O+rkf&$f)dib@>qQZ^bF+Q2|9?e3I{Tx?Lga{i(Lx*QVw3r-kvL$^NLTxDw3H33Dx(BT%r>y-s{~@wZ`Tlc{ z{t_(+pCNlol$*vYr>dC@e;LG2K^jn8l%AfBF1sDj1sx!OH4qO=)X>mSk_g~K8zGBW z3tjI?TsR^LN;*C|oYdUhoQ{&F;XHsh1RsI{C;NRyxa*X|fpFQqFyt(5L!VeEyU{)q zm6YLDE=(!GYq8~Wp7Z#y1zIvXCP(a@4SGzn5SokP9E}KrHrHLj!KRggyw}k~qS(St zT$dNipMbUx$6o=LBWqkBhSV%T9_JiA1jk=rg@%X$4m0uz1#C3-CIjGhaDd|fm|@F7 zIZLVocuGbg)RCqEnCQ%d$(AP|P#~o!L~9I~RN}Ok#XuQu!3cdU1-%n>i%^LIv^ojC ziw?b!uKZk66O2$sTN~%$o)lSQv!~yMhDNb8oPo(92cB!molg`$1F`oe79UcP5jyeq z*g4zJH_w7LduwlYLqj-hlkxR_EiDrpF+~c2C_M|n^x0PO$^jtj*MIbp(IfN@Fd2&f??}JAVmxy=Hd|N8ZoK$aG!(1~CIr ztE9f<9L~c<0CZ9+?a+Oapc(;l<_Ea24XU(EBJNy4lY)e`4z?lrqYsCQQ=c)R*UiJW z!tQ6m1yFyZ@AL__p#--Q5QihC{PSRjAO9_B3T`u`Y6sxkN`(*tKSak1;q4Cd_fkaK zEF?jYcF+wOJN!1@`+n-bpb)J=8&BNu@PN9O2{sxQT8Oe#8v~rFO+c0Hsbu6;+ZF&6 zYvab7KwDbJ1N5<5JpB9)XB6GW$*u;Q4?>L09gvrohe1a*ObR3jr-FF~`rZEKH;>rd zOj_vGtC`T<0Y)gnj9E1fOn1Oj?}2eru$kQN-Fbe?#A1)Rb7%AMGaV~oJC&V~<|>nF z6p`z_bX8kFPGkRVcm;PuKmn*Z5On9K;6OapW^`H|MkQFMeeX#wlLSq^33srLnsOs`R;o8t~YCq z#k9)m0Sz{?QuI|2_`??dAJ(k>XKZ1!&EszpKiBEjg|a@^2BUdk^1%(+`OzY}bJR!r zp7tGQ+na9o(7o(Jp{5ISz+y$~6QVyHxiiC4-~Om)`XaqlJ7d`*!L2{o6xg5;r3LRUbP#V|URgQTnFXlg#_cpC2Tn<=kH9AfjZi|O#HT0=rh0j=s3_IB zp!HX6-W-=D(~hh+h=TGQW>^`B-eY+RQ#+9>3G+t%?P~t^BMxMN?sl*R@XBV80CjbB zys8efUjVenWD}==!2an1zvr8O?REp8nTQeRKT8C;l8!KBVR3h_(cc;Wk}ow=f5r+R z9zZtpZ9|}j25frz!~M6rs}4^-$iFHlAz2B}F{U`wdpN3yEWP3SItMkeXkP*j+oBV} z*<^PFtE~qGp^X270cHU(bQom13c=hmH}u@rXsBlh59$HAIE7QipsN@_J_TUA2y;Wf zz7#I;&7+xH>bYUnPQ6Gx;w~zn*9bv;CnRo-$2*NbF3tqM(4K;$JZFIuaCzkTx583~ zxTv08D?!&&WG%!9Kt9SeCiF-&BZBJi!(&wrAeX|(S2Xj4@YYqI$^qC7s^JYs|6Yo? zLZ{+ke7tPp%tb((@S_fg4kRAf8P3Psk3$xKbF2YEg+lZLQi^U-4GyEj6nPT_-YxLd zG{WF4(BMMd5sXnIddDXwX4lkkVIAPb%z`>>CgU4y6rk-U%oxJGI5q5tle5Zg&t4ib$fkw6uag*T)#T1pQTr+$DVV~T^I zyRh(P=47`O2D}#J&pD2ncN0AD9ZF54N{*75@Eu$f7DMSF z7Q9nDJ9Q*H#tlzTI=DyZc-*Sm4KIG}_Dz$MSmPUnVjF?8iOyHTG9}ws$nxXR`vBA( z!xg3=h9hmy0F#5Ws8`a_QU6zQR~}CF+OC(zUG3(PL`5YMGL;NzUe1=8tc(@XGL<pvWU- z6w)VO5OOb2B?{fq*HcJ0{!qNS`Ye;b&qyT)x))vSCQUNlx6qW;v zifg@j2rrOeiwP;O-G;XddX23nau$49PtI=!SPl1Zx%dY(uX|tNb z_8P`F__40NCdbUNy$F(rGm~_K0lgXNGT~*ae zsCm%IG_r>Y%pAjCgArpfP-}ueEu|MF3(AvDH0gn|mj;s@hInQ!!^b0{9rqK&2?)S7 zm|ccj>5oT&!F%RdJ6$vAObo|vBn2G;Fp*cICKFOn;3Hxg*~sx|+ze7=gFh!Se|)KS zV3SBbzBRCCKL8FO_{JNUL?T0+PYmBl_Zkv%;Nako$dFDD$${8R1a|@ZfrvrmTjZQU zFC|7^leh|+?#Z#h4gVb>b+5kx-yCs)_=_SgV2aen#fulig>BEQ_gZ%v*rCE(f>n6T zga(Ivid+<^P(_C`V2}V`5)%z_#gGHJ@6C*BX>GgJnV_*CQ8#G~3MTov^%5rh6kIS) zy!5QBXQ)PyJi|(Ad9X!rHv6iwAp}8vuvw;(7@@kKJWo%ij*FB5@)59XvPePEDxX6qOv`P8rWUIoZ0@ zLb&$y`;44eapO4#DHPE0JB_-N;2n6}m`S)EorK>dS9q3)HmD-}P!z2KdjeZ5s5%Uf z_h11Ku`UJ8d&T<}-i`iTI`0#b1=QR`tBlYG_$7z~<$R>;~B6;sVzaV-H zjMS|$03Hwm%xC_ZG6)hrSg9$*UOX>_}36F&=JPsDhW0`6V0tw?C(glN#L1E4+-SPzjqp#QfL*Z^q_ z1{t$XoOTxp92&S`7hfeOb_p;S&S8`ymMG$hQ2P58u~dT>KAM1EXaMZJe-h`;oKjCg zUU+!;o3wK3--*Ojs=Qh>kh2Yur^VD-Px*_Ix@0MC93Wb4pqXD@AugZC>l$!yzYa`25<5nR6T%Q zi$)|R8N?+O#QLagAOZz}Nhx3!NIC`)c^L-rej8`cRRAAddI)JStnAN(I7gw-!?8j< zIstVM5DFfhZ`qT@;1Y58)sjUKtb*PKtapOgSynv^h71%NECJ^X**O3u(I}vXh65aB zd$Hb0`3nCY!bfA)FGwS-RN}ktXh_Z+5>L^w3(+01|7h>*3{N?QUIqY|1h+zxHmYbI zph#UBtAh3vDHQ!*QnFjOOG&NvA=?W$5P~a+!hE0-1_li_f+7%MU}MZDHbP*JvHleu z3>nSh)2+9HA*qE&TX*9wOFjjs3lT+R5;FQr&ZZU(efdK4Ot|0DreO>T)Qo>=&|<#s z(J=Wacyl^claaotJwb^rN&jpBAzakggd-?{lj}vxa;|PkZ0Kk#()Ndy6;zqGm`r*^ zHwJ1zvq^mBQK?>orwgFZ<>x);y+so&;=B0m45Vz>l<3JgP&IJw+__5*4#gXc@bxon zHbYG{(DW#m+uPIgt-39m7xYwSrsJ!?HoW~JGqcRakc>^j$9N?UWd;4k{Ct)}xf@n8 z_O3yvgQ|Uc#{9|^)*JB_Z&ycbEC{>|n?9kZ#2#*F*C2}nZiI}YgKii<{i@kxDjmTn zV&DB=5OzA6&4BoJ1Hr)uQV6)ZgH{O z=(PFgMS=6rn^=H??{;5q8UH}x!qzk0W>l*?&B}t#Q=j{8*9~_!e2)d0V#PV${?dYDc18b6g zD61wS(9g>n`aS~qPLakB2b6zSxb^=-as7)_XaD{$KjJ;m;-#zWEKoFD^|R#l<7yLk zX-UhT=quk1jc-@mZMUXl_`%DkPAzIu%bGIE{j)rOHdfEi&{wZ}6`Ro%v9s^^Wo@az z9oq5(szEje+SEn7ssetEDn|C*T}N716ujUvVn(N~w@nX@GrUI|{11*-QYdD;+tyGh zl!(>adH%gG3?H*M;}^aE z6t$4Zi821c+ByYelg>KFZ)?bXdLT3$Fx#YmFS&evUAUvu+gA+PBl6tWtuHO>X01z| zpCx$}=@&}9NtKbMyFarw?mm;IlPabzHEf*aGJdp^Rr`w&)66ArpuhX|&6X(TL2-^9 z_r!-*$z$o}VOgH7`tEru3||lD@Dq6LZ2CyIE`82zO6Qngd{6bpw&*Uw%_BEorB+GL z&PqBy^5fo1y63WXT}v15jt>&rUkpy{ph_rb>EC&>JAU|E^@q?n50-k}!&@sSF7|(a zx;_B~yoq;vkGwoM4|rS9@^} ztcU$BO_~)543sw6KcA9xOq;ibM^wS{@YH3tR99Y>)wQl~?=6z|JI{&*84h*O`+DTV z6~$F^0yp*)cvtB?;)#)+O3H$bcXGWBGhJsKoR7&FPn$OBh0AhS>}4h8-;UzPsC1_|vIeM2*-62zO|#D@SLBwQ zj!d`l7x3JE{K#=`{bc8Xc)skTzP)`B+oGhEzvgz|n;KJ4r|mbI85&IXIh4cazh8E{ zg-=9o()jGs?3E=RaGzvJNfOln$1u}lcNlk1RD zdEYFkq_?2o_4>v?-CMJ71`H){J@IZ~!#ak$?!>`mGH$2i{1iW)h}Q2e)%!!v#C88X zS$gA13;WN^<@N(|TRg^8c8E^o+b)gk&a^EMsNj8M9`vZ*T7+zqcK)^AbAD$FcF{S^ z#-;sk!L|EB$3D#|#|v=A4!P6wCh3!MdV2LD66ng8XFZCO-p1_tbBWS)`BrM}pC_hz zM{^H{hwE?3DpM;9pVPW3HOr~8@Atmmz4~*pIct2_v(@B&Y>ppC^TOyV=N_kER!ggD zbUouNtuA>$FKS})r;1J4w1rcFLGB6CCqo%re%n+w&3JqB=2&C5GSk;WZIc`&yM+`A zOybke1U_s_JXU4@vD8+>y7)$OmRsS@mMMpqfAGlJ&RmQTE@>1wxx(r(YwTj0m*B>W zdbEh0<%01ht}eQn`sy;hU&7;Ai^m0PJ`eX#r#}n4Ic@vvhF`9npoabai$YJe+;pmua0T_R^_xLxqQ3OqWvjsZ4EsX6|!sjojN?sWi4{WHM8c_S!PY=!2aX zYxHpv0}H+KxN70+PenzX-TM>{SDcZr`B=kr%1zV_)qTM}S#X7&I1oL)yT8TrK#Xcs zo@bnP{0bq55>-j#pYFQ($}FkBIz1HhMr!R)E$&Eo-lbcLvRMd$ z&*V4crfJRJSgfNXMkTv5zUf?0=4hy{j^nJmce@$_vSdl~B~AAOru5RMi)A?BN2%I| zRNtK;v?ohOhxG7cM7*8Umb&!jES5?V`$6zET|=#uKgPKtEQwy9V|| zSxpa!y3ozOoo}=2TeCpkMMO!6DxuCe6QJd&H*)=qf$XxHKjRoTXIm=x+>1PyYxE^V zUwJ9NMSg6h*Vy>_oONs4Dr5vZeyR=>JKlRW@j#&wJBKCW{F}&(1=mt(s`@h3N}$l) z{L<55N(DW0AE)WL;Lx@KrN?0#QZ|cG)oyw;I)xY+&|30%HZ-o-B0A>MQ(bAloI>$o z4PP)~DVOa|tcz;!&8jX5y&V2r z8+8dBuV9b=-N`(>UIp7WBip7@UpzYVw>DcNeX@~_c1{+x>?!HTaobn!Va6@~Rh7}x zF;XN^j}x&yG-l=l-(bK3T%EB zV=6}w|19GGF$R_x>`q*9)T?|AP7DX&1`Bo*l{@{`lUNUlWfqJ`O z=vUTXsjI#amz5=fh4pE}|6KS=3aYKvN)##a;@@ZNBq4A9y@oLtO6$E zvrctD&zjNA>BjbKm37bt2M0%~--B1~gcXxsJ)W@lrOlXI#!bSTNbN5iZ)y8z8kz7cBr;J}%~MvP4=I#~DY`6aY5_0u#yb1=Z{z+1X61s3 z+~VTy+l#%}^mP3aUE2Uvdc40MxTed^}1gAq2i zU%k#jYs|XPvlBGs_?S3%JJrQPGk}KL1+M!0rw3ct?rhIWY2&NxeE6RLZ$d;5H)n)s zjfy9=QLEI)8vzmDEi8y(>$aW8PUK21ebL9P6m+li9oWE`jFxv=IVQcbuR4_s^g2g; zH7-hYG?R=+Q?cZ~FAzR92?W}=@3m@IE9$!;i|F_vY4|lv{XC_#Ns9dAjL<4|yfvo* z_D?A)FYnd0kI1+cH)K1=bb;VcJxn=4#&B3(o@Gk)!e+u7wJL-f6OI_y7A%OvfdohR zX`fD2aROZHEh@3by^%UHPvaA3!tjC#78T47z7|-)$+XVV89{8{m)KTncQx`>+ye8p zUqkgW(%UyG-ri0sfqj#+z$x=Nq}abb$9n;f&%IFvzLFfus{Vum*`8@Z?NprXeaqVJ zpFrNZb@UJsad%@FQRS_-*9X?x9NDrmMOmCFtG#fzH)Z8o>&cDIXfR_9o-U@J*O|F6 z;^8`A9_;T9@04`iD6W_T(*NFLQ@RMrvzb&`D`2M_0Sr+KBykN?pMj z$(#vl-U6c79Go)u2Ybz{O{MD=R)fwTBQOVxr)sGhfeRVw-QF2WGQEG3k9$@e43Fr8 zr(eTaVCsBNPKH3fp>Q8A_&_|faje~2B4URxU=#brZ<~Cs&s{>QBH@{e2DAxVbw06& z%I1;vV08XGQnp9Sz?wdsqxaH`qO38Hf;y$iARZd|5^j_oPi_L^3Dx_LpVn$lIwrqd zA8ad}BVPpOWQ>`Vy!Uo;AXo`fU=_@o1_@$W?GDS7+-?gQiSaUSusP z8%&3XM6&b~1?m0{R_rmPSW^n42zDp$scU7t%>ylE z{F(jzlBvfnKk0lqM(JKe@nf-rQ-!#>6O52h*YfGEe{6x8w(48_QmkZg!`X7l-26!~ zt)j=Q#pvaeIwCFsh-i;5Qs65CN?mRSX4&vx$J-2{4LQQ{a6%4zWY_TZCUdbZK^-ex zUW^Tw9w!POY&AGsBwWNMxrMo*(nWzG@x=0j3fh%Q3btd*WZaTDCLS?b5w*RlP@9-o zz;(AG!*JGFWnh+w7*TO{V$> zzM@pLt47!xe#;6A(VWw4?drg&#!zRT&)Uq(=T=sIWkkziKjOcczrjF{ze|uv2lBUz zCDWV9iF6p84h0KO8A1U2@g$9 zW2(RAH)<0!S)LfIYg0C}viq2Kh5#GTmYAnrAn9g>Jwz7Oqa;W}U835aRX~Jme$`d_ zS$Je(>9xV5xEK2*%LDdr^Os28_Dmo+N=+7!8_R9DX#AQY5s7git)cibrAA%Y(4XmR z36T6j#ynoRw`cd%7j3-Xe3N>6Bf!%{SzOZbaU=x>^7ODIQS0v3I-4!p-aUlFI5|8T z#sZ=5W9$LRq1ItPN@N+6XaW8G7J6#{_G2kdQXqTi&qgO*f%s3jqFvNGx0GYBjo01E zjkO+p^YznNR5fTBtfIlW@890~3f3PnAVj0KhF?@HkN&|BQ_u(i@!+_<_rZ56bmmK_ z;q-bs63U4c&v%A`i5LwA>Q^y8E8n2VXpjaCN40*77SDPH`SIG-I3jadocO1oTxW=Z z-E$EJbO_sX8>~>p?azzPnl7j{ibhvK0$Lq23oEr6W2*I-Ub$m^{$p(S*k5O}b)mm4 z_iTwky9lF<@W^C>@s7<{mTFP^jBKB*2)$3WUyZMl4#nX9Orx>tk{^v^BYIf<9t~u~ zq>@mYS0adr?yq4WLiOS7TaiXY{Ip1yilKY&UU9#P7;ZnIGLgCe$*u4a0cnAPQCda`-^ka$uH<371(B}SHK<_Emxd0QA=$N8S-I?{)7JMAg?P@Hb=SIKf?WZ zDOB$@O?_#MGTGuzlqmgjbwTNOM@5Qr%4HaqM6ZEHf#k1z?I4{gjuWV5S;>(JF}=TQ zA^jDsWb9<2(QR_T%*wgsxW?%N#qh~Z4;IpRG2%=ln1vZUN#OCFxh<)K_xRwqGs4_o zPzT9Vq9~gq0<0|rL0ND{B3?yhN&GVIjd^l*NS`X~RWMVZA5XHr@eMZDGKsy4?arpR>73Ge*p!S?VA z&Xuta^hq89`d42k3vvqO1CJjx95!ma!Af{HoB46{d{Tdmam{4gzX;QMMb2u?qw`+T$2^3E)fo_?ZsOkV3w|-!YtGjMUC4!?*JQ_IlNq~ zd3>ljJ+0F|DUPI72ixM~kN+;`Yw3R67Q5LH1j%+VbBx_|zQ533a1h3Cj~3RDLzHjDT`ZGhJSWq0GWgs1_;4j$JPUSr!s50d2*f@XsApJ$UuIn% zbvh=+KRssEuk4TLe2SJ0@>iyN@b9i9AwOLD^LilU&f_F9^Z3|B%F{C2Z|0TrozZG4 zmWR7DeDrWfT5Uw~nI}7Z3wcwZhLCi}fJ%UOjWgK#GbD=D$QqGklol~};J&?PvZ*3I zP=TfNB@~O@i+IN+RC-!t)m}&acTo1D&u=N%*)Wac!(|w zqF!Sf7RLZ0GP_o-H=~Z|t!8#1aaS5vTnN8h=*mqZV%wiV0s@Km*XIr$AI(g#s*MZV zc-B>Di_?@s8&y8TA4RqOMHZ$muL=G;N#={-xmHv)Y|{B{6H)a8w?MBM_XBKU;b25^ zy-e2Rs++vP&*Ay5!VpO|LsMQ~N~vaK%(ft(vVI*icuphb4tTqKav1-KvBB zb~ox1nM6=Or=`ShS!`Q&gwZ@5eucEHhbvMjWlqG`M=9ucBiOBo8JbszoH}n?X8gd^ zczQ`x>n+eaAOQh&AB_Y*fPKvSIco#ns1rYMN4~n5))6&0Mp9?ZIjz>N1q@K`*|3je z97QR&I_!=58vTewIf*26oP8gf?)8pWNjsFaip4DY4N;=n~Owq z%xL4MA9gI6(rfYkN$X&su3FB~b@YHrTJm1oiDD>hNxIj;fXTyx33zGSyb2_?i8fSW z|8v)oQUI`b?%3y;_owS%fLHbW`iTGukf#2(9w8+&G47)+4%e|Rqq)e^); zw9j)qc*oj>PhTEcvd0RltAnUdGJl|55ffcX*Dm7TRWJLg z64Jm+ao=oD5Q8Us!d4*l^!}Scu|2h1OCqLOm3B*E(KL$sWVHLb3v;A)*tz#jZ$HcH zV=PKOq0y(vp0##$rg6+^BZ1Jb#>9TNyEOXbHOO)nN1ZE8BfYZBf5U8kn`S=vE%Yl9Tm$MT$V?QlglAY3Ur#=s>VI1zT@Gj&Z z4KV6~@9iTsh?Xvr+MH1z!pCxJ>=3QxH{Yx(XOgPquk&w2lJek*TNx_@W zI;f6#&gpTk9k^AH^d0HFMFe|jY6MN^>)*zm-^8vj9XPLt!|FnQEH-`>5+Q6Bo@X<3 z;T0PA_CuaV(y|Qg^T~|EjwvF*pzw8O2zRRLD#)>EwB?6{t40ZM0?bgN?wQQZ9jWww z?5R?%z|Nw-Z{v0n%bgXGo*~}jyV_6xB>={Z39*aQTB84)p%`v`K(Eq{>_dSEktS|x zG4gY=)hYxfoB^LqPl}mBZ4L_;MoH9H7F3XN28Azlj_L&yx0Cr*{!e9p%11f)D|e$j z>%$cbf+`DtryEC_LFcnsj0K?(AuAKs2(X# zm^4>r&?YFoekla4w*XTNXtEJq;ZiIwYa}{cZZqH4iy}~W_>5SKbts$&6e&`2kf#=r zlIuv2_7pi(0S=iJj0&VjWY5bv3Mrkd&Fyn;l-*%N-`HA3m`s zL_2$8IDU$ZA_I{k8Z}#G?6=HP()ZJqjU!k{Ek%6z3Fj@3AW;s%)s@$?R%^x{>K{ru z($7kjO&5)nqE;OEZd+B0l(}!Z4D_L8*OtAs#__1DSjOoXJLbyb6Tmw5D)Z}+a*$xkcGdw zwngd%{(TD8#1D}*^pI=Ke zsl9E61e4=MOhSJfk@ZB85wKrN`XLcJEf#jq;qtXona9mwEY{2vCbv~QfyVGs$WPf2 zP<*M_I7cuOO7V3vpGxhNHl8DR`moIVl~_nSi2(NX9ch4+sX#TK`cDZIECDq97c+I) ziQnPMMJyvwPX~_%d|g+_3ieZ7Hl*p+yX|+pGkJm>1Ge*t$VWu)jy5gTBVWeMB)@PH zJ=~|vT%DZpUtzgl8PIlrjj^wb(!U18+~w3UxOejBpJ7#*bbo6dIW(f3Xp^O$)zhRG zKvxi(@4^c%A}UzwNr*{cjLFbJLA0<&dQE^8KCm+T2Lqnp4A5EWUgZ|L$4^RtjUROM z^dQP5vUDXd>$I+&kdX7e=Y3L_|bvXRAk+LSK7s)VgK9G%TDu!%BcGiyqDx~g_ouCLlCmOuH<;Ua~L`#5_QXZ%<&oR6*4CJq>-&jpq)4c zv;bGg*b~Y34iHH$2C4j77_@)aM806d_M8dt^HjwNfSby%CcdBDIt0}no0_3Wr8Y)J zGDbtCm%9`TllDTa>#I`;glv{P642#s&cAoje_AKB=c5K8VIAVi{v`2xIMi}y6+gwbU##fTW(j6^dPRK*~`K2-S02AEyVh!ielN0IF z-7XGUn(g1NqiD+#s9MPKvSVzju8a8+fHwifXbRy{<1Q2=xQ{O>&9*l-LavtlDP^q=|X7oZuncMW1}WXIP!9qKnVN0MP6niKpkE$8W|I=fn#eMJHQ-R~Bh za78`xllE2W>#IG);}e~yj`)fzECCjX`6jGsHs0#-RHBg`Z9rrYE$p2q_w;HPknl__ z-~nn5s^bom-^SqN#0|1cP4})7z4scAcxhLtNTJvD{caO!{TIH;*xkzY!LdR_+6XC# z%-do@6N~fi+`J}3bLtOH?OqhobIn^zZ$QPB=z-fViG+Fnu)MK1zwF2~RMHym>CNsx z^TFe$;m6NHl#!e`EXREeP>7ArD;Ke5wShQp-1&>@MW;FS>NNR_rM|9n_@KXCQ^@#c zYPDX66f{aNRyVSrml@7zBH5DIjl2Ze`22$<{r-5~`v%*wT&!2j1rqX7gM>a$Mi(;8 zlV-+!l7^zJpyER7%bSLju*c{1D^(k7nG@R%x5`4z*IOmGr>Gi{GIaK3ez1-|Ug~S0|jY6hd7j4f4HR#&t((mpq`Gz({a@+Av%lUe(F_~C&=@0l(er%kEf3&;0X zba51bB>D;Z-~u@Lx5?fjB6)W1hpsh(%b9`)kx(__W78R}&*P#|u)jC@%98$Ai>Q$s zo4zI&UbQhJcuYq@e~3ot?puq`MTmcGp0!Px+)L<*_9?HsT#n)0{oN&<`Uw zC4y2qAB&Rn^7mfa`)I=$gMsx;{XP>EU!|6w^3bkNSsW}6-jvNrN+Ge|9L0sUe^&w2@ zy;BJ(tdvk?R4pac=>S6J@6DI=ajFtolkMG$`CY?S2v&Ay8|H770nYqwQi_+{-u4zw zMk7U9hR3=}08f}n#;zI;@Zwrs7Ad!c?e&chY}6G%=}`HMMy5E}If9NJKtEI>W-bde zzzlbMj3;Sok6b5@Y*|MJ`(DI`%<3ill$8rTbAou*q=czO9%Xj1YVJFAm6>H8A`^P% zuTa1>;e^jeh9Ol=u)Tj^iiM&&LGo*%UouJR(%bq6t&k9Trh375 z?cQ*Q<-m=7USGJ?oBjern&l2fCYw^V4EE6RPN72YJsHi<11D|%1_2F;LE=fXJvPZY zNTnbRmX_jCJ@|cc!_}4u2G*|w=H3lXA|LQRQPdCagEKL2cZe>)|JGuXC zTz-v@$N#V1rO^LD@A7}T^Z&Od=>KvfQ{28jMuB>ie{E7FT9jA?dRE4xZH9jxQK9(% z*G}sHa+Ci?OZHmHD`;=3Bup`9?8(l|EadUwF3WzY*;d=$$cQ>WKYw{+V`7q_I^_!? zE6vN72+mtWAq@@Qac0>nuiOsjKi4dJp_-eUE9HjT#(n!1TwBXGkRkf?*|s7-AEm6U z?9JP^fr>dnEiIz3u&`7FU)ok2(lv#(gT=}&6Lg(S5d(M$>aXvp>0d_q+jo7WUqO0f2Lw( zXXmDKH#RXb?BVWe&wuO0o;$Znr}8!c#7OFb|;j$2Drl5L%Y5ZngAXLu9d0SU}Rt@b=r`n#|x)ZZn%t%i3w0h z;Snx7*x1@y%Ze6h?~Q%#c)Tp$+1VAoHHYh?w>O7kG$BMa(CfIqLwO=OnxbHz5Gl*i346tp?{## za;(&H>^DzHE4TGzZh+d8ic1{D>R&96jPKW*au9!$rIn(=mY0`rC6aV>WCx$J zIj%|tl{?juaU`KhWMUBz5L`@VgRHEtkMaKfd!!JF4^`T#s;aF6184~e36Yc3OiXAQ zzL&)N2M2paM?sh(0Yyd3aIi1|$uT-LLsccb!R!cmswh?3=(xCXUPsnkB)+~yg@x%K z_G}mS7KysLx@y4|HcW1$*f$5JrIACHL31Ao8M!U*eGZ%TWTD%FqPMJ^T#yva&bAep zQP2;&`n-PPu{~Kt%0+@6kerZgJ6E0QeRa6(z=wo_A|WLe+EeCzb~?c48sjx?YQ-QV9IpY%}jPHUgl?k_fxW@ct;w)hDHvqX^# znjiaVYm;YjzH(t(K4^m{5ma^F_)Z;sE z4g^+JaU)<-*c|&=TE5cvKH%o#=WqM-2N{)sN$mA&cnB3gzn1@ikdTnW{k3C|!2RW% zJ$Pr>u#UFQ&$zM4$+N{hh3paR^G)7_v9Yn5RaW?3m-~4wuGSV7VeyO_#v6U{e|KCw zw$j`kw*OLp;38q`b~u>jZai*B?Hw2hmVem+f^vCt6QN8qf|%2Md2=v@&*PY?JCZca zzWD}$nwq-SWd{drI#^(6y0CZq%nUJ@%;+p>c|^%pL5`OVS!i(20><2)t6>EbDJzGE zQA(l@c&tt5IAmmGY{s2Pot>RT4@m`ug`Lg5cMcc3YQP_QO*!`G>u_mek)ooazKi$@ z;Nakp=$1%iwt{SBWMc9Rybg$uwey{^Ta)h~ObHEqu#L-zKsK3f^5!+=(3(?HCe53$ zf`f-&xjSm<$$gjAy5hj*yeV&LVX^i%Q_|z%Vk$Nz<;#yBRP(it&p_rP;-_S!a*6?nnYX0|Va+{LP`XFT9H$S+6%lpYEN7 zp6<^OrUp@28zI0)p#P$0VVO)6bzFt}7!(AOAe+Oo*b6$kXAt#b-OmSeHBi?qUgDw5fRz)QM1ZI(`}iYV2$};h?U7+xg zLd^}mJM`%f!yq?niHisNQT|eSHCN|Mm%?F&A_yGjOJt-OFdcsik1dIuk`nKY-boD&f^&_Yoc;a%CiYDi1UfZ#q^y^6dj|&3x_f&E%tsPUG{b`57=ZBmj*SvBFftMg zlKoD5Y!}$342=;F1HbY9+*G++Y`X{}3@nU>NJyb+$bA6o+!XzS+&fY!U7KE6jOmC{D zrWR4w9gS(iZ9pdIemGuIbNMBdy&Ehn{|U!)9F&=)#6&{iRz z{LZ0+8KM~ge^i{FI#pXuFjU(wi9A^3=I4jo&ez5kX_kG&$HyTb%{D1g18CRp069MW&{b$$w{S`;o3> zRmmFN6O@(p9PFjG@O5DS1`QV%-ci#P#bl8VqJ@Qp&*h9o@9=PmhI*zl6@c5uWtuI~ zzkmNeJ~47S;g+ekb;G^HEf71qgG%HmGZA61~7dCNjCr010ASlo6t= zuOBr&t{OqYE!)D3h=^#j*hqYHbAu3M27vqN+1bj$LDAE^bDi$7hY*DOdCQXTm0qqY z!}-L*PDTp$HN7ra+wvBjUSw9{4Agiwf#j~^0(N(d_!*OS99 z>~$UhkQJ1=G)*_BGHe zQb+wP1xrerLdPT4*WM0mXJ^OfbImq7HU6npx&w zb>Q2cuj8C7*84IrATOUGLJm-8D@X?!9}HG{HnJ1-C8VVh6w?Gk0AOAzs#&xuzX$Ka z=6Px=pUj2)`1p7`71`80>m)2<_4kLkCJ52TTSg`(I1{w3;SBr4Q|1R~ZfBmLrsiN~ zMn^_Qe)Hx{E69VTb_)W~JMi%EI5;?n`S~?BSJ4Rz>$S|+Id2{B^nj6a@tx4;{aEK2B-B@aflR6pmbIn?~+eYZZ18fb$cWWiY$Q>ie-%~gL0?jQV%E^ zC6i|9KgKqaB|{zi=7%!90{|UNTIF!0JT_uxX0)Ih#H6L6*Xc&x-}^{ONr}CT6EB!p z1&;P9A|e<}=K>-S0gp-`R-`UjF!8ZxP5fnCW@DpnOUvEWk&Lb`83O|Y79n8{<+YKm z?Ss_i48Y>g5HUK7bZV&ZP*!$#Q9>jF0UJhwgAF2JW@Kb^Ia(y2tFf1nmq!B-1VHTb zt&+-0yf6%Ms6pyoc0K~sv{tv3?){TF*0tnrHY1^uDJ40X1|$-ICvL?JqsyzRy1vrN zu~`g}(c_^Er1Dp&xpH0JTJ>LC=O%Gl7*7@J@wsecmy}qCCV)vkBQhz@xK)^i!J{y{wBY=Dhm^^{P(Yfe1{eTk8N*TwHv7dMe@LBLwmYW|<}$E-o$r7HX8=fy+Vp zn9ub}7#ll#+b8VjfIQCsUNb{;c6J7G38jJG4J~we;38C1RKPge=H^I2XD_6nfH4$< zJe*w6P3#3u+u$I23a|ZSi6qEcVC7gyaLZ>mP>Z}&NQM&>6m$XO%z#*fNJGNJ>{)IL zVz*xuf(9yx94Kpoaug6x)%~{jGNP2|05oYfdawhey1c!O1O}hch}a-FpMUA^W!Ba4 z10;?Dsxcac5E0;AAUXAX#-)Rdr{0Z@s$AdP1a_>nj*MUnQD8QCU)jCWo0VMHYrdpo zVJV*3KtLmc0O4kOZf-3n!_TU6ezofhbiV-`CAKn@B3(Fbr>3=FAEQf=kbjXP&|GB#SG9}gslYjP+(*F_&%>A z816GZ*%vrqGQ7RJ8v#54)I(5aL0ypA8cKsYA4b@-Na>)jUvVA|+<}nL*Cz|0mUyOe zYe&a39}!BhKbM!6w^X12AAEU*H#XAvk3N}<_d*)`%mou>L+!Q7C${}qDT|kJeUgulk-0TAiBQYD-o=h1wE!jby6BZA47EN;K~qHhA!Ym(2@WEZ+2Dzke`Pm zFg*9E!H0yvgMoI6h-rWRr}_Sfq~_q{Y-rj&QDtB)x$ZwQk=e1?n;B7~Dw3LlqYl33uDr&Jfq~d@ZA~!um=l>ECz0y?WX+xB|;!+Ww1W`Mlh2tUJR^mjY9us5-0QB#|ps z6f8?j`;YY5RP*86v4Md>BRliikqN3`A$Tw*e|L^-RpJ$6Ay4_&0t|a1-Ed~T^80s^ z=6`cI=KoaE{oiQA-S++MCnq(AwzdoUuKy%=YNY^GhSv@bCF-mOYHAbJSX$KaZSAA^ z%mq~cAw6q`s80Ug;3rd@lXwBCt*@_g#sBxgI&$Ceu>II+HP7TY-G3eeivBNI{l9ex zsLC@uLo}tZP#(1FH8nL|T-4H$>U1%{d@75cPzsZV)~g`JoM#zNHa;(aa{=MEurOF5 zA!`jZ5Q4e(XRgf)v&zeHU|<&7Hbev?OFw@`9!z+bH(pv*1s~So3Cryz@GT*MM<+B2 z722REwV-?ZP+Xn8q4jg*Lo##L*iL%h54iDtXSu$=j!;wVdRLF){j-TB;s5i*lCbkL zYl<*ui($jF%}C9f!}sUA3o=i)#U<5i_aV+~yqo|x2WDmAnh$xwP*Xp^Kr~8p0r+}? zN_LP|ZPOs^4w==uyfHATAz*4S+p*B_wzt0@KKiPsM~;agOD0-OO2*)$Y#wY_KY-uR zt9*PP&a(nhQBjWBSP5ZZgn<}l1_{tELP+d~iS9v+?&w8iX z48%i-V*h}Ad2bCBHxL3ryKG8`u3?=Q7Q!O;MGg#XI?o8vj%4oGI&);bVS$L{sY*~` z1%On(xJdE10E@P(!uaABWn}$Ja2Ra9kvO`quMc5qZ?OpxoXnat6O88|{(7_|xzzlS z%;dh-?Fy*&g!jVWAi2K2-dr|I(QE2*@>Bs=*evPjuAMPDbl@-pX?MIrSMz6(fQWN0 zo7qa3Y+70(UOyTLRjoae$o;VaBw%zDXMeE@H|4Q`;)vPc!qoj|ny2?2k3f;~QjA|| zb#j-=x|>{Vlvzr4RFgWE-6za=FROGgmFL*B^B2FJ%^ft=$<;|c~GadCaqxJl4K zVs^Ng#YZFI(iDBIe9%mqRc4l|rwf6+dl$PsQGglTo*a;?o`<#zZAEPWRQxU`0})c| zyu~9VB+v#R1Y~)2f7J9-L}XLw?(QxDw;LYby2({>+F)q!o?{t3eJ`)a!R3L@cm6$i zlvsZ^@H#QF*&b_=yx5n!OUml%C^|X~2>o8J7u|@I#ogsKPl2&n-Q!^Ja){!nxdzAI zpd9JXpR2z`DNk#~eqpOlbq-E$q1su}PEH&W63NXmkMdB6?{*=rrUtDtf2#`IWi-H< zr8lTd+UKEXC}n zgIHVUfBF{zV?>fpVUv-KE_3kn&j9Z_KHd)gcz^G8RG`W*UrSta#Cc;u3vm4U{`}AK z*RMlL%gTHQxOa(OhlG?CRoGu%Vn|7f&p`QN4z)l&cguykO65|B9SGXh}{^^iKG_y6~PzwtE=UiZ)-h% zuX&#!E*F=UOXSv|Cu!?&d;YfZdQ}(ByM~n3~+RX zM}-~_@T=D)`c3Him?*m;jRFe^ySIK%HJ`%6JD1xe9S?T#0adN6kM?nOa6in$Gu}OyG3h(Xs(Ts$C@dx^Df6kxEu8X)`7f=7SAMrwln^<&f~b6} z1|U~``oxC`E};Y%4vmPf_s5akLGx68+UnNG6&&pQ;7|-Zx1@yeYyyQ70Cb8h?CdZA z2K)7Ep7+Bw)ILTX(&LOJBOe^DkHu}~YvJ`<5POcA7sB%MLvt{#hU%PK#9!bDt3|Tl z(dgtA)L>%Vd*m+e(Zr(riQF>=Bx9>ZN9E^RFaJ;`a2N4--C_g%mvKCNn3bUWve583(k%oi zoJgWxAl(evISq8h{pX3`U+|lQ-tf@C{djW*2xq2B!SPDi(`fWJj6>3o85-oB3%{g% zPBSj9?^5K-eCG%qu8tuYJz=uh!9hW_i(a_6N6T^1qV3V5YtjnNJr?R+EA;(CTj~?`E2L;V8GfUBeAO-=cF_d^ zAS9cu0tj;3V)J9?nrt>s1iLShX+&maWo28r>nptQmlhnB_9rJ(>`t9A>dYxg@y|kZ z75@{1b_1pr8QLzhJ-2b@BFy6? z=<*~U(%jH5^j7SP>-(iljcf*+nOQDu$_laY9?nZ=K!XwC-xmxpE}N{Rbv0+GCs+_}hj{bW(Qprs5eB+tyD0 zwmd1D5W`w$XODNBKnjbE#V)O^ zlxXpLAl2(xyN=4=yDUn1Bd636L0m!NBTBu3F*-K-N1#*qzh(ib;?-M6`%sFD?TFY6 zsrbkg3u-*~HqrSSYFlS!vM2Vaxap-te%5OTe)@!Zp}*zmNyOno55+ow-1YV%Ny*5x zEi5!CPnKHV)vgZBo~o3IyLb-g0sl%GB~g&K9p{Ag@M105rvTA8e@tQaYS zu@GvSRahbuB7UdJHg7z+> zsN7tn^z|w1mYPGp-Tm=!9GZXm%tdd>uYwR}!J7&|OlXUkOc>4o2?BV2O_Tdpk|cFG zc9wKhcj?OWAL<3M85z;j)7G^f?6AL|h8NR%xE+h0o;|&Q`xp!-MfH&>K0p(X5Gx-a zAB!Pe^Y!aO`1)zRS=pANnxdwMiR#5-jS}su%hL&hBJCnU57Z`jJe`7%;eu43Y>ZHK zaM}~j?j-+cP#L!8pL@3GHwOPnF3bawAXx@d{2Va3Rq4}~1@%bdo`E_-~DtUOnVPOWsFec=O z0h53TJ-FZjPl5U29(9GDj{u|yiM)Nj?!iG@H2Ki)%ky;=&+$6Q@;9|{6O1L$ELIp`M_=YQ1A4A5i>&CE0k^MINF2qaJyb$YtC z!)b4K7t8>0J3gx2S4~!vqM@U&EH6X6y}jSa$sR8m!~tOd52{Bz-6+9=nF7rCdU?^#Uw}Nci?$a7c*z^o*=r_Vr0m8c=Xy zA>Y4$r{Z$K?wmCCc^GD8x1Du?Ll_zzcv_1VbQBb&d^)?#=W%84hCl|H2d69UWEyX^ zT~ee+Zf`)_%wc)!;e(CUc;|zQ)QeDzs#Z$>`>3^^HFlS6Wd)(b!!_j+Rhlhx3`nc> zS6+!tVPr^d{@0Z|@;T~)uP_j%Q0?U;i*##eELzN#Q3(A0-Omi!us z{rnysoJq4TJVdR&F#;S@YS#afNxu>9@X+0h36pF(8eH9YHq?-;37P~E*VkE)0KJCQ z0(s3+BNt$VGYLwx>efk3 zOH*{G!DA5kc?V#i=;-Lv4{M6+iwdXco}oxOIK?}j4?VL=K+=l}4@cqR<_+v$F}_SS z6uO)?<>KW9>f$As=COuAo=ZLtX7xoG8e*AsPZ$5x{8*EvUI24%@N*&@kXzdUBCeYG zojU6-q7MHkI;dFKe77GDUlza`CVT|hsP2R;Xqo#2=lx_7S% zI@^Lot@WnXmmX0q2nmD3L_?OBu~b#nm!}NkW(Q2{MDRfSE+lL1d9BMU+zST$_Ku8? zd-NKq!tMwhTC^Z)P9CBT*x1-w=j+aZmaa=gM6}#P>FzciwZ7uk;tRS6&GZ_**f^&z zBnX*;TU7%(JD+}3s>*`wu)Xc22-*%k(G70xz@%VmuPuVOnVz1$m9^y_@wtqE(fPtJ z)6?~yliugg1%(&)I{NxZC~%L^n2EtwgRakrMutYMp(t-F+TOCDI)E|Uz2N07R{O3bP8<1Z? zfNaxlG0O!GvY@T5bev?YA%C#510>R)YOfm|4t`MF34<}42m zr+B)%I;9}XLt=a0K<~`T&W4XvQ1Cc^$J=<{XZ@Y)kKEZ!=VyxJi?g2TG7vUY=pMCR z7qVfu&z@z7IXEDZkdhi18baK!9Ao-7l=D=-uWz6Otihs9sHR>vwU4~ zxc9<(>Vp9_Cb`})GN{ZD6SNh%#I^-rGV>v{;IJIJ(c!d^prGf{3kozj@=5;}Yi|LS zWw&+o-{J{$pMj$(T8 z;)|z2r9a-4)NT8flS4bnB;c@PJI8bPj6j}%Nh$6adP>XhlCA+>dLVTPA=_>Gr8z%_ z8jqVlK6N!OccjhCIXwI!WRC@pHn`FVR{wNb_rv^@k%@`OP(c=Yg)>LC?c4u5EBD9l z<~H+cdcKjL1;cbPG`1zTmKV|q4fSo11`s&sZ8cz->*p@5Hh1Z2Zbw^Mc@}MOQhdCq z=#LQR;Hj<0cCYm?w6RWuJQq0{tuDQhC@VMNRbTv$54Fz9}>&w=21+|B? zD;)PK?-k{D%I-;<>K&~M*E7kW$Hl(NiK9M!@`m|$F*c0v4Of1x`+YC$otvKo1GFyR z6%7x7*3&a-nrik1ce?G!h5K=AJ7psyJBQvJ@7Vck!xrvnQ2~6?{^DY?=9^@$cUvNfgQ?LGT8U`qyZl2j-8e4Kgy%BqWyt6dXZ8lPZ7!+SGvc+L4L$0SFe)7r)hZ>_c1%zJlh zYiiyWXWZFnpx*Iq>d6V`Rd3%iiJm*hD;p7Yu{}QwlG&uTtf7l%g3|aDR8;O__q=S- zDs1`7HD$Otk&NuJ%@v;ghE62Qj1%RU%PM9iYV7UqqtfSnXfRq-om$`3o^v-in0`0^ z%<*8&V6N*eGqh#gN00XXY7XmV;oM=q{?SaCE9&Cw@qOE|1UGJ&Sy3aC__S^|F)=n) zGMYE%JN6t=Pxn21gRAWLMQNC>Q$3Zr2j$!QFD-9NC;eBKFH99r+_(bS?Y)6Gw%xo| z8&+vid0N|&+noN>Ru%~O4p!>*mh7A1J)(N3z(YevYLwM%v!8A6o3(>Dd|Bu+I`u|% zY?L3reS81)*=dc^)tTO+s)x2*D;aBjh`L)=wrgwP*6e_%9w|S6;$|*$qqVlNKA91i z!2=kC)?1j3{oR`zS9m4|t1~f0-NPPuDZ#N+x-qfm%hQJrDgrh`GrBF`%EgtGHb+!# zn$JE=8)*=^hUR%~RB2M0KCO8#^^445{cG&^yu8>I6h@Rmq@6z* zYHw^}@*q0YfnJEI!F?pZIj(V4b(Gv{{RDBkyZfnpiaM=kgxLN3dzj(_X? zUc8R-Q)?_|I@RPb>eP;%^u`>LNg9)(b(5o`PwvzNY>9bFujBugr`mbJ@Y0o*>6z~j zU4<_)3pciwRW;c;$iD9sT|HJQ?ppt0MN7X-WiS7ur}i5&Gxwzns=f})%M)PU7xvC~ zpZn-Y!?oakymcL)4sK7kUv;cvlIzNy5C#sNw{FGl=2i;0>Wo=|gFqg}w8dk+$?50|(gN$BjGx!=>Q=QPjtTwwfQn@g`5!=@%x zXlU;F`s%s6zo@UT7iD9=d4XT6dgg{@>fS&pbT4ZJ+t+;k$_}bj%zYAyH*EE{LqY`5 z+Jq~!DQK`2k9M92mR^rtv=M9N&=$avEZU$w9}A(hyOe#QW%w6#K9H6(FcyVh(=~PG zmIT;Dt0{&B*3wd9)u3jqyO%1Q@7kIA8zP4xpavW%s;Sums2lttDKm2$gbK-7wiWye zKU_-ZUcO{*$q572$Hm6JgUIKoX~WTmCT|E+?)JQ; z^wnjShn2g@AFAnBIE8B?S|v8NI~ZEwAvE)+$_D9sOGUnqlzs|gcXY~yCTo0LkBz&Q zB?TjLY;C_D{Gv4&H)}OHZlejQ9H{>xUICwDHy@&l2=+`YlQk}iW ze=i=t>T5fAVjxgTig`|BuGhp`O-F|V@5gs#4f+EzPwv~xeH)2f^XX!JHA`yV>#1T# zy1u5LIV_j=OxkGfq4M!Q-CC_F$>QZPq>l-E@{YQ^=~r!oJzsZ6gz$TyT-aSwm4}{7 zV%jQ$^VjclJ5E={R_j=btm!{*^=0QN0Q5<*O~)EOb^oH3+p?!C>3-Aly|y2_EiZSs z4JpW7*1pE@=igUK`aj}}Vc%dWZkE21u^eUg5Bc^|Na|nlhi!-c#h^L7V);8T?eqHg z51sta4>`>L9P*RZnOWSEyn}b*rne7a`?~aMf3PTCHmTZWF|jtoVU6ph-y=|TO6o3w;_+}m|iQC_R+2k)xkCldOCVGeu$Dd~yEo zSCVKC|8L(Ui?RK}D^B!u5jDzMdA=*(h=eQcRJuvI{`%F1Q~Im2wLUxk`IJ=}1qXd4 zV`C2;;W*RaKYo$zXl<;g*4|RiPplGB=ZlXB6$pAiB46T8iyVGZ&Fr$?*xL=B$tjg@ zJfBM3-{UGYBw+RA@AW@gEnJ|x>+#_&N4Kt-;5c}6W1rLS+$_lckCx0@KfS|m6vKc| zs=T*qhe?WY^#M$!E;S_U9X){-XRXF1| zB;o-96Z3ns!E(-S+wVIZ5gomcmzUnc!h#GPK7JI&@aFQdMz@mMhK2?`4Qc5zikQeE z^{P|`r?KMg#5@wliBY{ox%{R^S!ZVfN?}984j`Uy-@XyU3m_DQ0&Vr^)YLr*77-(( zL!ZmamQjcX3lgFC@86Gp;~Ocgu2xdoP9X}Q21vBQenHR-DrE1rhbfRUe&vT?<8;dHD@(jw1p@ zLx~8+Y*Byez`(n({W^FF@X1E<4 zeGvG;0ypivQ@hI?J8&YnR$>j}=HcnjaEWlW&SIbx;_L7%)k7bMbj<73f)D{V8}nUw zW4Yg(Nyrs~r#LqHpfyZD+ICA7N>m*OYz!dDlhCSmrJOhx36;iKT$CvK&t?8y>>}3cZhYD{}C4g(&b8^|TsIwTFjCa#ohR7Dp-6hXmX~^|@vH zb}9-pGjqq_;5vPM{e%lC%V9Y{hX>ypycdroSnfZ3SOjC71*H5$@CMDoIT4XthQCo- z?gi2|MYcOb-T|FLwq$~LE&7PbwydL760xD-I}``+Fq z(BVCXylf)9Mi|wSnX>u0Dn7CC7o^Fxg4THb4U!q#0WuJ{ZmD3kG3E#M=;1aISE)r1NsRVAfYtV=ULeDvWZnD#1#3K9FmwWttY zYw8oWOo0YXRd1Lu-S>Y~EYlq^&_DnZ4T)gb6Rb+JExrc+_ZrK1HS(g>-sh^VLq ztcP%Mb${Nv1*$hNzAi2<(8R*T$rtMQ^EBB9u#;&x(%SPg5;M}3Q2SLFv@KhA7EHn z3z6}`g9icg_pq^1uiMV?Az7~o1VDKG2}wCQcUU8^bwUW4AgN`&b<37JLqn$Ilgb6A zcf(f0g^|Sxj|29}R#^-XMD9ItV%zD{rzt=A&%DUV$q`-9&YT z`S9{2Cnp!;&cen{oMq5*Lr_MT#Zn)pQVbfPvmO1o&j(cajgY!Y=*XE7)_}EAGePb0 zyE_Q245sKrpE>&JVAzY))L;1)Sg(6wdwsZ#{T60DhEOYRJ*>KinRz*d+|pC0P8C9` z$>cn-u?-4$itwdN%qPs+Xz=0?^piK+s;kf5!e&aWe{ck1dByXvQY!inv%;SM zA^1xCFiZzuLio1hmpK#*&#KurpMm0@ti|u&m!k?e&Gtvj8``Ub6K`(WWIXd*rY`@P%Z&8H)G8O2yMEgy1pBk}Z%LJKhdKCp&k8lP6D# zVszTnlq32EJS^0R15U9i0)Pnke~H$EaVaSq;bReqyFHQgGxPSnd#j+NB!Vt=*DJ$# zTpA;pXW%)t75L=)>w4=wnFE7M^^C#PD`Nc1CS{qssqM4ctg5wl(?(a9WumbDnWZd< zgePludwO~CoMcNcg=Xq}1-^1_##>b_j;zv8VR#t(AJIMinMoxWMkg5N+CIy7b#(xO ztUuoV`shl-l4QiQ!9%;3*mtHmT@f}iiBo#Ydw019E35ephT77~jRclFn(G{+nHBP& zdCo-z9CKG0g?yc^zO0z1wEzQEy{Ha~x~tURe;`}sdJRfn~$ zA%FjA;+*7Pqjlx3{eM-9VrI8_J-B! zE0yeew71ofO3L-<(T-bYR!gfHH8XEevN@Q5X9u+W6G4jg%y&E5?UbH8zFWXA}gnETT(B>y=tn%kuHKDiP zp}&wLBf`jCLyJ!`5~ZTaXh=8S4Cup!9s?33vfiX3Ers>{Bv{ZH1&6_uiQ+_OBs05a z{rY0qD^~N;ymY^5vYM5Z^$;s-|9CfUK>tqcdDvJ8>iYiuJDDNE%@7yI_VIG+GOu{N zqOq~DMws3~CJco0m{V8q1y{dlqAH!$8ZkPmM%w(D@9VVQSVooyL97vR<&cMIbbdY~ z<)W!64WuG4&%oNpU}IxLaf7SO&e2hnWz$}`Yr4C;DQ=KQ6HEyaGx5%L^!LZcuA@NR zCQ5uUP#eJQ4KXwR(~xVMWXK5he}ZNfEfnJ#j!sbQ{T+n4!GVb#pNc|cw75$Af_F%G zBHNxDbow(hGeo90-dkP@!>EF;t`FKWQD)zZU!HIgJ2pC4FwS;gk4+CXRv$RyJXxy- zn*kj}{(lkQ{o+drx&`^w4V*e}V;W^4F9$X`n>4@lXtA=@hC+d~{2r_ez_6Fm0mjES zr~71Ft+#2SB~<}dG<{gq8o<^pC7r@M*xHRvr**RVlh6c5T2FkEx{7s1TX)=5lSW{^ zx_BAe?^jJsE&*K8P>6An7!&=aB7w31V2F7R_Kt-7{7_g$yzK4l-~}Z%M*{!gL3Shz>?7j-vw}&x~68DnvVTlc;Bq= zmwo%@y)aQNcZ84cS!6^6@wKPew%NPGxhI6lBC!?{)J9<86dYqF17#mSUWBU@_EXUJ z4Y>P_@9(ZtmzG}V|LHREbK+aW@Ezr`@95D-K%#IFJ`o9rISur$BYeZKp6(&2^GbQ> zA7d;EWHr4b{?Ku{)m9zSq`4nHLfp+>{JQ}|?9xIt{;dU|W#s>ukeH|r)t^$VGC`pU zC}5&j>srcGJHK{b++X$7ZPECYt^u znwd24d)|Hca2>2)sLN|mHPE5%7I4_o)6)asRpEKw^ZtFeq$E!4sVQ)x0(`Hf5FZt+ zEF#RldpI~~^-H~rVeYi(e819@QGgzgD7YKyEBegLObz{q9v)|a%XC~9tg~}-Nk#&N zA}1&JcDl{c4z4l`1wG!r<);+t`v}~_i+Qyqvk~eQgab&($b3Nd!YGO%GYiWKO7i7T zn|7bJTmcUTtZ09h>yID4&!5w{y1L?)>cI(Z2MFEy{rfFR{{x*~C))~Pxa9kwqpErj zj=BVVA=sgw@Y^3l4us>9(8CE-f!lDlbY#@)+{OiBRQK}LD=v7+Dc73CuM87Hw`0r> z-XLI0`i?|lEbqesVm8DpLX77eTG^EC+qaYN1RMnr5ECC?JrC!e2|LrKO}9`Ep9{G% z5=R&=gFCFYrpD+qXzm|Rj$iSXc{rhW> z(y=;PHUxl_3MNi2hY6#%aF#w1auptvTU!|r#{m584*rrfv9Kp$8FcuHGlG)t!(1693+*-1#;i{ILhUo?qpZuaOnqW+Kl$(2KR2|J0zA|QS6^XMDbW}jacH_qQ z^+2;E(6IOJ-2>5Yd^``O6SqOso%Y)Cyo3ZA>}`Xp^8ktXj5{5IbY5nt#CXOZE~T`U z?V-E(Pp~nkz6lK1BX0-4eci1&>mhMoN)q7Sx<>wB&|rwz=dHi4=k-VBVyFR_Ctf75sx(-Bo=2KkgOvblm4H zsCTh&WqaQu9Y2EH@GockEjAgy?7nu0Zn=sm)oX+9|3U*^uGpEb&+PTvDF(HKm*&q$ zoiVOB@E5E`jL2{Ldz#Dt17tM|3ivb=Rrj&-Yz1+5=CypEa>>6g^V^eU96`Ty{(Q*I zx)I6Cz?9Svr8i7<@js!Kv1Z$+_Hj(wlG;yEi3@1iXWw7Z;B@tfWLNDj^$Yx*EB2Y1 zT5;$f*u?y?oz9VtA?hy$*|n@DLAqO`fFyih%UpW4jiHJ z=?sllwY|OtFD53eAjsQ?(g_ZH=gyr_9^FEBW69J#W=FP`yLZnDiOZne6ew(Jq=hv* zJbW*(-ZJ5FM}*<@l!wvzO56d``+*DviW|x&jCFdbtN@Cj6HBlqQ7FKd#P117)rBJ^ zSHhg@44$GCT|^|wDd$;kY%sZ=8^QqzP6^mo{EBMkGPSJp&?Iz zM$vG2s|ImrCnsX51&JyWt9%J)1to9#8cC-CBSDGKtbZxEyVgoNAr2y`9 z&&oQ9))Bkz16n;EXdYq z1NbS&is*!hGYwE&yJP}>zTwZ-=R~dX#<@Q)($kd( z1%pFEyg(8lHl^sphZV511~bloYbrrR$-|x=L#=$Lov6zDz~Jo(lv-^Wh|a6e1EX%3 z_lPqWd+2>1A9rQ8yC9qpY($};q#$wy!<~&N4Y260qnKM+iJdvK3=hWVFX?ptxT=ii zPAV!Y$jJ&Jzl@3s5n7DFeg;O5BqBioMa*o7sG455x5srS>~?%ML&6FQ8{s*<2dC}( z;^LJcW;LcOp(`t@tIHG>2+8n52o3>I#7T$&4gAM**ILO20oum8V%BXOjriAc5+36r zR;8zdU;lN4WNFFCmBPo*W!WVGHrOa}sqI(}lq$eA9b>Z#YtMIami#wF6VYtlnj2PM zS68)&he>xDzhIBAL>BSBC+!SdPA*tqx9sU0VH`FCNU zg?Gf}x5QR3IRIybhGA!CCxl|8bkKwjrwDHvZ1#8V-TRIua?!K%bKqfOT8E8OcCK%M zSe(I`io?we%wi5OsN)$5D&6%3i=sFT-hCUZh#_9iS5RX@ zytbjGH+%@O4P+a*aHQ_db&-j8J8t8RgFCv%W2M{AIioAM40NBALcGCkZEbd#Fr+yB z{-xuA!XQ!qf2?#_>KYmYJVHTbwTEx6_}NnPqRfs9c|=lsB*S3M*KpVC%ki=4L6#92 zB;2}n>rrT^H>j8+TG`15!%*OeTz(s@Sg~RcAKxydHs#bktHGPepKZr~8-JJT$`@g5_p~1l_RVvc{%0t3 zj!9g6O+P1iL~|P(#=fKY8&*pHUrCc)>#f%Osc5$q|BtLmPTm`XJv(-ozdQMz?%y1U ztdGBh|6Wmtecn3JCPsxB30g8^!KW(1|5RNX-rF`Z5nN$(DxyVy>dBoA#}2J;`quz# zg5f_Cxc`jl2B&SW#MhdD`uINJb>!n#>X6SMGe9BT1pp}QR&2wX!iQAM3V6s!ojV`UAxs872{%AUc^0t%S4xbx?Vx?J#+Zyolnd)RyT;vFxqZw6n)L{|Ks z(;Epd3ix|88b4)rp(z;}+F0Qiwx@4;2=|t?=bb&^f0L^&sf?xTjOef%Lds5X7s@|G z3d_6N+O2?Aw?T${})A)J{#@-!>1~yZw2R!CN;16vX zHhMC1c7eQf&Zc`!r2=?5yv$gV8f6ex65=}BdCo>iTv}o&2SIR9!aHWjLV^y~m$7yu zJ^cd^0@I3Ov$-w{yx1<~borNv1qhiOv={+><;NN&&iA)@c}Q_-y3Sr&QLzEY6-^?sxo~rfVU7gTJ~tPo(4EQU zK7PGE8k-CGPN!j^Ux(X(&F>{FO%&YmjhizQP z1dSMe2rma%YhObLd;8NUk36Ll<$`lE(4Se;h`Ky!6cPuerAjS2Sje&Ld`xgP9`nE{sv|)&6cQ(5-jg;Qmv*?tgWrdenyCQ z%=_k%Mo5}v;$9DzzmKMDC*{wV0CS#gH^z()N=9@Q0v@L|w7Qa_(`*RxVRD&S#>mJR z9KIc(0g?}5vqU5z(lrwM)#W55-=QN@ke8=`fFOJwWfaL}FR`UV&{zVHc^`bAL}b-X zEd!DCrd(T2aAUrJBKT86R{)3+&TsVlL(cExMR^r;8HN%aqn&Y1 z;d24UZD0dRFrqEoaa%F=1JK$S+Dwx60%KFnku)F+G>Is$A|@tmWTJ4ssy;uDWH7B+ zvql)uq|NTf`oy4yTwd3jy1MTq$}T=B{{hemNBKcq+)*B$Vy|5%M=^Zb2No4cB832v zqf3kJOSeVBh4uCKVaOR3n;Q`!w%HwKJA3;#->iLCGXeY}sAs4lg$k751;nKx^oSaq z2>1!3o=;!Ch@lY% zT=wwuziqGc+TcujZtPeWQZB7roFA9FbLUPW)-fV6(ScUZ1E^mFV>#1tn~t>CEjiZG zN~Jf-1&BA5%$Yzx5jGf!qM(sdz$y~Qz_DYB#|to`1e!hSy6802oJ9w-=(UoaS(#a> zsU!tR52-I?_=YR$92rTn7U1P`r3j0Ot#ER7)-yGAY9IfEXi;QQZYD!dIsUN~&!0a( z3c3SiOi@6X5!5mMDd!iGb{Q=73C{mAeEOuWb2mY*hNU z(%y0C-2F6^lx_nx*3{N^B5|_x`RN;0ItTWK^v5yul_5rD+z~DkySFZ`?|1BVcn0bW zEa6du&s&@jg!bh04MTT(#Qu%GTg}u#USY6KB*ZM^_0%=tickJhm-O{<8m2ek>?MQ% zLQ7u38>YqK4)sqidxnr}di}HB%{lK3&0n#khG6PVSaA}GsZXQ!TI&p=W599pj3Z`- z#7No=#71wxb>PcV3U94kmy9|8bAJ0x=g*%9QCQP*>eXR5X5NmK?6T{5dSy>g8KQY! z{Kn|#{0-4>BvS_?$U^9!Fi#Z2)`bL@mpjE@4SSo5SkUdU!Q^VXC9nUh%b>N5cd)@#7k&*v~sN0QYtDc+|U?)eH#)Y)HL{Y+yeqL@&rqE zK)%3dmHNn?EVmW^09P|~u50Gnu!A2<0Y{1r1DowX4j*5Z8DzQ!{(z)|L@|-!;x)m| z)OYO=UqpCVJSft2t)w{p(@-;Yd*-U&@dI%T;Otg`*a5jHj+t=QfG!#u_?&RBaR+XP zi@Hz!qTf)(M`DB!kAy--qGX69AgsI;)cY8IMQ2JWV-cEH1vRzR_yJD_zHP{IDlp3f zWjxcqw4jU5Nc70ItJhC0bHl^iOoE2P!kDmD2u)`!fWDB7MbQJ0sG9Sa>_9yu>Phm( ztMgZSeWt7g!ul+Qgs&zIgWBQJd%ptMKf>>eDdsRzl!YZN4A6KPqyNafeHFDJ5J~_zz4q6G|0Nvd=H({D&$QKr`w*xEe_$> zLY*MrD-^dUxgH@f8P8PH)?Fx++C; zD@%09y|D7jd7tO~o_o%}Xa4dlWLfy*u^mk{e>;kz`x_nd_;UHi)~7>>%{yEor*QC_`*}Q|t%u8qp z02g+;^=;(+iLGlodU&aC9ygq@u%aq&Zq^)}fW2(;2FslZcFgEb@$r#nfW`rz;~d%U zFM%)-br%1Y4BvsOC*|&O;d(EM{)DUS3|MvTU)0+y?SDqc|LO!ba-SE9y%_H{6OkD4{dD=F=X%`ON2?o(9G+u9B1$Ddo7`;VrpKogCG!ph zbCcdIfg)!gZtK_9g(eF^GRnVuieCT!GRfVxZ6NQhD#_)-#=-RY+<8W5sIT23QCI7C zt%BMguouB3HgA}qJNPf1$j93w1GVvpA>Q40w5iWn29cX!#p-q+Bx1COmDaE0e>~zq zh#kVf*8)FdsgTgLN;w74!bjz-Qk9%)!Iiq(W_kX%TP_3NmYOkE=F{0>nh;khg}T zl2JwFRa91js_u6A^1t;et96lx2@EY%p_g9i{{)_T*val-tP90O2PiC}=J7$y$kU5GbyoElnY9vzO% zFZ?uYGx``&1pgv&l5S)AR`tIb({Sk-%n+~(3(FYs}WS003f!fQmt6ebqr}YrK#id_z z5p4+pmxwpM4c8wT;iD~k!e{&15Nz&Ff!O|OeS1D8GYn26gf2X4cQhy8lXY?utT4S6ESl~m^8ALX(*Ut z51}3X^68TY&&iW%(36tkeli4Gv}NgOY5GD76PwGvel@^jBHGU(gytKfB!4L?y6p^! z6ZtjZ?~cNwpsK1`(q(y?s*or(qvQ{fsXRi5)zqTZIrKgA7H0>KU>FY!pF(1O;U7&w zmx-_O@c#Xaa)Q5EP-OJc%Fs|C2KZTLv+p+P%P_ONL_yzD-GHU^RGFgt)zd}_mO^=Wcv4WLxhM%SG54>v=ZBEw-Hi0~qfcc@q+Q(plM8_B zD+Tk>Sjy!3h3Fh`%}u*s?bIiy^N@Q54FV*l4cH=y%oNg6aEg=CGM?5h9J#tOe>1TW zn0=U)wNfTNK3<=40i-MBt0Zd}oGw5M$$=)h-JV=ib(&@=m{+GEHjX4)lhAE&10_fr zdI||Y{ua@%V${eLC>1$*DuVs`wZYa<^W290DkvhVc1=e2Xe1=fdAuNAv zo9>`ka2XGf*}D6GP@1wFIKX`L=mvm((jPiKyk_>#N&}uSPN*qxAsDjWh1wXs;6%I8 zW%gJArT>8iUjf_i5DAGbq>?NL=p@G7M7Moyz1%c31OorlmnDPghr$wrDbQgF#Ojp9a{=MNtu$_!+m99>4{(Soym`_TXCLEud1Bty6hA|?PkPs1drb-b1I zOvr16#Q2u3>%vwHSYR*~Mo5DG4-r%yK@$nfd)&2WEB-1{|m@*O+bP? z00sal69eh05p*Ou*u92-e+w13npBSJl!${G;?8-|Kk)LZMW2;{*&vTejRbnL$k%h1 z2AvVG4>7JJ5Cg~5trt3Z4#o&Fo`rgr8;2O2J$KFoG~p~rxyeE*x&ZZ7Y>~yX1=}_- zOA|im>k}@~G{dh|D2*(Vn9ses4jlrIag`X(iZH2sc~`&{vgjc$&tflKUlsregthB( zo91L^8@;==GWe+8Eo_X@Zf=y{b909|Ipr|YuUwdJN4keeto2|W#AMaT6UUZ*0Ga69 zd2{T-A)?Czdw__9Do8!J9j8nu`zn7}3emSvKn+LWUo-GpNjx?%#_H#_8F~U5Q!0Z& z_p|eKYc%FeeR#*o-$mv8ob2#o2%{~w0|(BrYou2|z6=R<6zCLiRdS%fOqw$j2kMiO zAaAK%XkYMI$03H`rR2vP+Ht5xtcMRvW9W#pMf?ra#iqlCPUvjt?oT zuUA90iqLVMR9OI*8pz^2H=LDvB)-MOPpT~_P`Mi4rZ!gTAb!2XzH^@Pva;UJXZjKL z9~cl2F*<7Q{Oi*}jjZb-O<871jw5+$Si6rg9J`)7d_uB{+^0KtRtSIsn|ksMaFbkH zQ;u~!7VHEj+KMiJu*=LH8qu4`hZEmK^bT}kOh^war+^7IU1^`N7{8S z?MU3>>2U-SuE*e{^?mA-kCaKt$fScuNdz;li568ASS%5BMg6gXIy@n1m~69ykiFVh z5q`ErOyjWu3Z6Q~caMF1e5_~8JInK27G~>EaEHQ{egzd=fcje%(a_d7k0)L|&5-<9 zcYnX}dPe?+&mTYH_oV{&U6*4La&b!0XU0)8iE}@5%l$4(rmk8~f7!=1_RH9gY=`~( z_p5^t$--|R9yY|lQWbQh@9@m~6p6a}A#@FT9?b&Tp^e=Ua{kQWg9l4LfBTk+2Jfo9gTvzn zL5O`*=SsX-g@oF9Exz9g3<=RTnhi89#dia|Ne2}(BxHzha20Ro$ODs=pOx@RICFit z`|H=Q1Z<*Pn|pw#&i2TiKhK`N1j6x%jjJENh0z=AT6J#As1h)Te$#T5%~*G8E||jr z8j(75snP-k2I_T?g(V>Bow?fI&o5zOVuE>6>q2kw)VtzDTglJ4KX3J~gcBqYT*sED z(HFJx&%*|g^9DHxaCA$Fc1>62CQvg4bSWeTD=I3fymGL9WfN;08#Ed5>{rL|u=db| z^m>`c-*l7B-{`-iUNx`{M`tNOin4Y0?jvY~0Y{~h@}@LAhOgGdSg0?2FX`^+xEMy8 zTY<~>ONUGCe3+m%;Kc)PZ(x_lKMR%?53_DPq=wMqyBs@M5%GM8i7D(-^Olo&O(RqK zCtIzQQm%!BgsjUb|MaO6`+hALe9NTR2RRhv%K$d+O*YDx~NQ}Fe@tdhnn)q`JK- z88?@0zk#L9aLOEGk26zBAr#8iA5zB@hdTFtmXK4s%j7ZCl=7<1tnua6_<|#oX~_a{ zDoSYw&J5taJgsIsY+-B5X&Jw=Lj$K##S|76enyCg`BOH2F?W4#y?C-N{oqu|)`@v)9 zS50s2(_};W)f)}8CfE4x2T#M<_5J%xSd+-^s%V0|$f}oTAEsky3Y0L25sS*XbN5Km z1)>YIcg5N_$d}Q22E@vPQIRuLoQO8A2T~+u7U-KG26QPRDZ|h(@mwsV)MC_n>+q`A z0>B_D2!HG9=#b|qD;UmfuE967RG*r>j-IV4?TVa1kVWl2vBw=a51|UDA#g*ylQ;g2 zZ)yS|J%B+UTqaQ-{kSc@e-IJB0)fkGWW66caY7X<*#WZZ+AK3&$tv6!;8Z?;PXh0HtLP(mUB>H56+em+9HIDr2vqKRuLID%C5NUUIj5#CV>eKW6%QfrW*IUHtPH?Nks{X`w(HhhT-lI zj$DAOS;f#W3KNg5^z?D4KA(YLFb=K;@I2T*Kk5m1MZP7DfkJ~3jLA}DBB#6`o&*N8 z#-Nd~4=duNq@j@tFc*U`LFNjKpiSWcOq=V)@dD_vt;Ni=Ggof8A&453y}ash|Aa8>R+errq1Vv}k+x&YeD-Qk8Gi3V=Hc zB{Lg@Oa$-3BndTm9{JAD*f)=BCnSA;ywK$@X9B8@{*?I(n~^r{uC&6XePY}6VLBi$ zHIPXJG#gg|g>4EQ`XhrTfawPD@v4XoahU$eF3D^ED}n%d&L22tLhAf^6&o8;F5~g= zK{Uw2_ofD%%Y%`7acOBh&RC+RqvKQ*wX#Y_mDG$=sw0j?ltdm(JBJ(7#G&S+hjRYx zpkD;Rd)hfxm6+sCf&m#XTds+Y1Sep<#66FNvNu@3F%w`Y5`dWeEg1tDjOz}dU7y7*%)kit8jedq+Y$KY zvv3N?hzyMKvB1vbj~pf{#gW<{g(FYU;JvP3EeA_1vU(-fV+I;icAdA`6-=YsIUGmY z^86x5+w-gIQ?QV0K3dosTxq1XIRl#A(4WwAu3WW>Kzg_uStr~J($dmkq6kNE9{@k7 zf=O8TEH;x^oY&EZ7pofUnOnbvhVKX?pN-7YY<+>%?1V9PA4RYZoWD*Z`RWYTDzC#t z44P*!;ImQ?H}YC`-G}vi;=^V+0=ft45})DRj%duht?@$3$Ak(x=j7N7qsdV14_lg# zCL(jd&Orzfg1L?Tw0p5JPU6&wIFKyc6X$R{e~pe-;8ZPZKrpgnV)he74k}w1Hgi?d z&}iB}$9BCDy?rYA)YCV5VxWr)N~vu*wZ^yj$w{+NoE4IQZ!ievM`dnmcoJ$FDZiGM zmM&P8VAhR6Vn02OklY{Ci=j4NIUFJ;4WREI78V8)JOczqZH$5_8s#I$LW>bVSreUr z;chJa%W;5JIPj-BfK@3Sj}Xr~sNsO1pbp5i`UpvXu z+^Fz)*1kAH#bZ<)`t>^sZ=&l_#rLd%Es6oHk6#V;Oab^F$m^<-Yjdr*q-2{3bQICRqk}l9 zMiuG-@(AOxeEcFXgowf2!;Mb{!w`$@REihpdLr2%7>^7m`lRF49&ShxB|9<<+*W7~ zuVQPM#n}pg+Y#78n-{=Q#-jLI+Sp*v@#8kC*h7xgg0)v6>w0S!o+e=UXT%S{os@T3 zx0t>8>(}$3Mu6%9{Qax-}2&EwWLsx4UrJ#oB^d!hoc%T8q0D<%VtmqOdYcgRT4F71@~(-J-kGg z$52J&a{RtHJVB3g>Q^lO@WBXg43<;SB0A4L=snoCw16KP9@D`Nn<1w# zuVZ8sgO|1D<=J(3$TIMqP}9&HvE0%d_3U~Td3jOR9c3iZ12H;{o)Lgs?QRd=yIhjx zKtK~NEErn^+Imi$O|oh5*YtD{NG-wM$PJM|36b3rnrti(9HoXi8^^2_~K+^ATKQnC#iS)_KCt$#$IzB z@4nx+FdOaE%O2?0rHA(M^J_s3o+Vcca=uqeR<`b6ganEXRw2Q6=-O04RX%Mw|6^wC zhm@pbrM7Krq^4P(3gAt8`{BM^OnlLTR$+5Q6PJk1wjsKQ&w3yNtVr{AHx7;TkAe)G zlGy&pUFU%~VD6)_on1BzaW5DJ9E`9=2z!JF7HVnF+}b^*vaS8b$>kzlBREn`8sbDX zf->p_rdwWN&SM154HO0%FU1-h?E8CmmJJBS4@iivABXPxVV7G)yZgeSi#l+m$>9PN zK(^t);+hzReI(AI_}d(^Sd9Rs=#O4>bG8r#?43kb`qtnPXl80e=>#GWS4wsh()}Vx z&HPgiaeor>3oBj;ScN(y^n({WGqVT|P^)3EZP^R1E5oQ#1donYd7X=k?O`fAIMq5cA1ZSs5l7M*PF)ShbwKQj51SD((69w~H$FUeAJ=+1- zO5T8#D^~OYCFgy&zS@$VLQp9-kvQm0HL}ga7uxPRyAs|B?*qvzsZo-P#g+R-0Il@F z`>%`=tn%vIdTdO_#SgYljZ6@Z5qn7-EL$cuF}``P!Qv@k+uQT2nX`?Wh= z-Z-P_yo%Go_P2ebS=zk$MnjI)uB8R0A19P_99yNNWKUcVa+-S1)16W8)ubistcJ6v z>Ukm4iS7AXUY>=zZQR|{^Vnn&#aR=4!uAj-Qd>!Hp`Z=1g(^}UVoeIY4*pmEzya8e z5D<-J0svEij~^QnrU{G!)%pk<yqHMdRrM8&%mIdD+ZS@UqD2DCW|^~ zvW#8~zcT)O>E7O;obrT(BZGL`4bql(SE%7#J*{%XI@`~4%jUUflg<+y@$Xmfw^xpj z3aC-8jnQe1(KgW-Fc9dEV#b9A&Mw-m%o<_^O< zyLV@-AKHt>qPg7aWlWsT1lWT_JS#4a>yd^;cquS|Iw03CUpy}_Puf(e)m*oCV1Ny> z)wy0bH#cV6(d-MZLGjtVoI`V@m|^=OOe27wEb5sGiuRCw$n)o(Q^r-l7r?)j2X58z zb_Q^G^*rv4pt8klX7?vgit5<2xZftMG;PY!4&S@qXY9~7G^`WNDL)3UuRU~lW+yE&&6R3D2 zQI|n%Wh$>eVQ!s^yXH7^|5#PEN~bt;uFX))q-Lg3@c^gv!Vyy+liHdD$wxUlM?1C` zX0RVUDv!L4KWF1=)pFaG=Jxj&72${??p zsz zkFW$`koV+Zgx30FX{qVc^*dT?r@TLNto%bJw0e7hiirD?knk^h!KxJpc2Xz-On>D@44!e3eL)KaY&`6V%Gdb+Lx{ZE&G0D?ed*P9aXcVirlj83bq0TUq|JG$X_*`n^Ga9CT;o9nHLS+PI6V@JP*&)RkO z-oY1eix<8dwoCTBv_FW6lHs^FYKJHL%_s&3xwsS_8>raq#81#r(YW?v`-hx2Sr>yC zdOn+k)CX^Ry8x+ckmgd>^bR;!19$rP_3hXS&=9El1)v&$myUH^S}fr)ZAd-?{tESj zm3sjV4nC;@^E9ukn#mV$0>2%W{CDerIkeq1e`OK|XS*ixTA20Y{XFqHMc8<0SW3fZ z*E{s?k-7ogsQzv%6@`s{Z|VxnBeCEsQC-5xFhFQ&K8@L2U#h-8p@ zrIBXng?b$Wy=KgZ@+_%9wy84gZWy`OBfF)hz||F35i1uah|1u}(hrO=HSy@th6OnI zrcwb*xS@On=kp2N1xiwe&(Uo)gJ{daaTwvuNWaTV&5~>>?Nte-lW`XvV>L432oV4p z5j&(Vz~b4=R(u+vTh9k`D>yjhK=&RG9VWm&0nSh`1mGG-zlVeEWc>mjJ$eCJWUl=< z8(Un1Pz@L~PLa!N$!HH})0v<|&O)R7dEBv*LfP?LQtXWK1O{n`@K#}1pdu{n2Gw2+ z-Vqqh)c_=CK^a&fu1m7Fs0Fx-urz<@sr;FjV6sW4@5R8UiXDyAYRrZbLDnObP>wu) zJTnAoL}P5h3JeDxskrWh?N2Qtryx_L>pA@gBzxsHBS1olbU@hO$zio95v0+=3f4f| z#KO9N|5=n*HOwC-!N?fFR$y~cyTBz6;-@W$8pA$}Cig7q@IVJld^uj;2gEzYyB*Rk zWytQsXNkqgdbmjii%J2$iig@nBW{A=_bF2Tcx`_^hs7{ryN=x%bp8Ziq7fLfmPLyK z)ky?|3)^{l?Z7KYR-q#%yn)y5(~6kKP4&{FD?%wU1{F5Nv|{^famj_ph61nEFdU*k zcKJSvVNC5w;tF%P9B2IYO}@j|P=+iliY!ara}v^lCju@3?PMZ^`y2h?0d0K*m=xo`^I6hOp<}=wvfxZ5oR{;ls7MsCAx&>?MAM%zjlnWF%)udx zvmLSJ-AKtuR8KnxZgxt6N0K}`*x~|$gGs{_i+zavC2*$UfO^K*Ap9b*xG!MNs))CV ztSu~rK}cBqtz1eMONAB{@IfY+@;O^s;meRMCAJj3(VI_*tb{lWdkU*fC>cY8nvY(H zn<{vi2+tzs1vk)Y#^YLT!ibjyqoNq>m2qcouL7TSF}&Mr2bTy=QY4)>dVMliCcRCr z?MU52&iq4Ab4?C6tKq$@Rnv7=i3t5Z%l_3tD~V7#7vC*sK$C+|hZ-opYO*c#NhjT8 zvyO;^fv69s?#A6cD+cL6@mcT#Q%rwCs{T7IKnd`oE+{U~xPv8eZu(xQk|O?6+y}bJbQNdO7HkH+jp+(+W0_?#?Ivt|ES!n zb6!;tSWLPL&7Z;1>VMjwGL6Un{{9O~XuuCoj4Y>QPnol%dU9WDQpQU^P#x`a&U?49 z?uAj%Oybxmpic{%of^JcKGN401DU$|V?q@F^K`v<3!MNK7>U5HGfP zgnr-Lmu{6ucH9U7M*$^8I&?0iO~(cqG?bJ+XpyIZ^Mzq-vc?<{*GSkrv>BMgvig^I zfjO&&deI6<9s}RTqHP%H(288%38BVw(6EW1Je#W*$9!B5fo{i5t048s(E$uIjzN#c z*3k#WW;M>3B^GAVhmnQ~8rV4afgethGn_G+I15^klw)*0L^goCOjH#B*?9sZXgcFy z0v_}@7cR312mJscuOqPze};m3mILZ}36?1V}fQx(R? z({md=Lj0-x&>W(Kri!Hj0D|5Ymme?Ze}%z6d1HuZ!_t}@Z%#T!(#3)4!{j9}V!YE5 zU9rs}sET^gc1Ay(GDu~tk0)9N3~Fp!EZpHks0D#R6dsV8pz4)z8CS8K#{3L$n|kfq zl+vl?l-CTjTwLynn%9l()c;p|S02^mvBjx9K5JboB0>w43ZkH-BB+32Q+6Q;#IPhp zv4CNf$WnHnmbxH~M3x6=AWhg3lE@koAkd;BK?q0!3Iu#&SOi26LK6tQ3HZ*@Ki;YK zwg2@G&IxnA`DX5&J2Urpe|P3fJscvWcicQpIt1Y?fu;{2jVOr2fze{*^?}=mVLaGX z-5x3T7+@!X^OZ8O2jt{}1av>#y7czEYH$^?3vkaMRFEJ6K4iNWOgUwfgzv$fd%z8J z0q1-Q2F{EC_6CGV<)b*`12SF#w+)GP03S&61giZOeJ$k(Aceu&@3!Z&1*tR;u&2N< z*)0){09CvK%<0dy!#T9zSPbrtg0z{BaT)0*X;x4x!5t+5xH zMy8LfMMV3Yc+0H%J6+zzvSd>L>i4hRh1$geuvjHSPl^1)Ka)h8lB zRHm-nvC(hOPT)D$90GJ?1PEBn1DoBli8e|H%%h7<&Hn;R^<{+Ujo^ustMsb9-$`3m zO@XD1$~FV&B1jOKpf&TWPB1_%`4hdC*MR4DYRWO$duZ(~&H7F3-_XRw@s%RucQM#o?)Z1wP6N5* zE43bNU16Lj0HLF^($PmC>-@yZYgGW?UVUb@i{Qe8D=WnGLEwaJUXjNie5hlUGgi?r z1&VI;)BFf&cd2A&uk`a@CC`z`tFLZvcU~>}bJVtqi$6-!A6CWA#((#!3MfYqt3uzX zs8C!f8h#g({{?OTX}0v%aBAQ*hd*jaA0-}EjQspv4Y>+iZ>ND!;=q;_+rpQCADjHU=b*%fK&93V@VAox1SLOWm2UuZ#&4+X>fyPj>SGxwn*z3spwQ+G<#be58>utMfpm3K{NSE9 ze%rv-Q`7E|fwIsJuXz~992{bp|6oYJ>qXzu*|#~cr+Y@ybP22vjgiB?XI|ROUAg%{ zb?yX@t55p1Ey2%;m2CIm!*?5p7bqqhi43bVT{A2a>Fw1lKrYxpb4wo0PGBcVN99|b z#TTD8M?QYg#29U@cdMM_k9#eQrv!EvS`uSUEgN`(PP>qHbE0z9TEdDmaREe0Xvky{ z_-9XLv|~b@Ol8t8k<<~?M9k6)uGiO=L{JKEpvcd>U=;5m`3Y03J|c|TBAsqHAgX$~;#}l!RYn9r%?cRRVZGG2c%5Qc zYs1*Rw1a_)+s^U2$nXRSpGur4MM9_Nsf~o7ie>`J0FtJG}a&!7&X^ zStlW2G2P7JhI!Ez|6rH%qckiw%H1cF!;wjqBU6IU@(}m$+b5mVASdmYF`)a+A!tt( zW3is89@DCap@mMIxl>+&oqJxVIYakG;kQ4jBkV|cqb%&IVnGLWrk1=fKS-ub-8`Kj z9jLZyt=XkzVU%#xaE_O^y|1})ee2xBjdg+&grl*sDOcD8#~mH8zOZcM-SHk)*d zbenqQDdW-@B9~gB3xvS9w)>w03V3<&TaP~HdO8!4Di8`os|KUPBfB+v*I~x`!z!QU zjf4CgB)n<*74(Qvf8geSW`ig7}NyIQ4hUgaipC0N=gw79NR;sLN}MJYE=d#@<`zWA{c_JG|7yUG`Yz1Ik;?DHyVn|)kPe%v(9D;n z4ChFSY%Z5M+nM`i#+?l6XvjLl)8DPLA34?y#$0vDJ=*^9Wn5$jVYJD?IQI<1R20mP zl8xMyNhJ$|x`}I3P72xzI-WE?Fa7OwZtQFrNwo?Z;n-yo7}>MmOEw*yJUm@5*)2<0 z+7%ln6v6z5v{lg5b$h{>4(&O(T)p_w~u69KY?LBW%OVB7gK{t0gcq1GE~DmoU|CfK=l z^~v~eeu)yXD1MiA$<=%_ifAdFzlIRRoi+vOMy@U?xsex|dQGx!6T3D4N%5iP3_Hmj z7|?p8{0{=<93R{3sXEUz!;@iy3#W{q#^jVmq~l>lfg|0QlQXAYOzc50b;aYpML0dz zKCvYQ)#I3?#&TJ&!*jrImSJ6GmzRlQ-HYT+c~f|5kW&5Pz*eXk3#XpfZwqNKKdzJL z$p0x!tn4|Up);3x1p%KFM)C=VUS_N3h(};m7y*vk+J^9tt=@40&9JR?Mu6F-wHHiY zmT`=jdYY{z8s1@EZ*U&m!lAHzn{4Xx^?@i0@PXgb29A*nJ{_M<3{X!%E25Ju_S&oD z%ySXRy@nV#dQ0jnEzoZ+_hDyYlB_s1jaC)B)cs9sLxr1L2vm|IyD&569=R!=9*>}G zr?6{B+h8{1c|2N2<4uf%$t_B5V9e+*ooalu#Y3CM7TM}w2`$_D40ZYX*e62ige**{ zw-!zugClRx;^s93O`2|#7`52S4!sQ;0#gX16a9|{kTH1wNK#x}e!?ehx3f6>+gVFV z8!_jz3UgTTH?%Mj_e!l2CcxT0VWx2GzflGc3?RlXmQQ=!%axw#BO0Iz(HEKR+6Cjm zzFyh-%)0(W*u`O*I{KVfpDHfs-o01yoy!%{T)q#?NP*J;A&Vd}0IO|FXQw4xh~m<4 zEJkT(9fG6VbysDTGBlRsONXdg7c0Lkm%YFWxkeTa_}VK$Ed7SM4|GENpM$$=kn;m~ z*r%qPQQjak6(OJENF5XF{@pDgk5*S8;pN}`La`QMrQKsr@Bj|)MOVG=eK(zbHxu~} zyXO~9I5|-#RDnluKGn|2$qmk=U{9FEIZsco&p^pDp6OWd)4|z{sw${|ao#|`-6Y1q z2hb)a(fS4DL7+E{@Z#7=h_SH=#Tli+axeLL`P22y?UKQ#UiP56g1xo#ak|y%OaB2@ CRZao` literal 0 HcmV?d00001 diff --git a/integration-manifest.json b/integration-manifest.json index 528df97..39a9542 100644 --- a/integration-manifest.json +++ b/integration-manifest.json @@ -1,118 +1,118 @@ { - "$schema": "https://keyfactor.github.io/integration-manifest-schema.json", - "integration_type": "orchestrator", - "name": "Azure Key Vault Orchestrator", - "status": "production", - "update_catalog": true, - "link_github": true, - "release_dir": "AzureKeyVault/bin/Release", - "release_project": "AzureKeyVault/AzureKeyVault.csproj", - "support_level": "kf-supported", - "description": "This integration allows the orchestrator to act as a client with access to an instance of the Azure Key Vault; allowing you to manage your certificates stored in the Azure Keyvault via Keyfactor.", - "about": { - "orchestrator": { - "UOFramework": "10.1", - "keyfactor_platform_version": "10.0", - "pam_support": true, - "store_types": [ - { - "Name": "Azure Keyvault", - "ShortName": "AKV", - "SupportedOperations": { - "Add": true, - "Create": true, - "Discovery": true, - "Enrollment": false, - "Remove": true - }, - "ServerRequired": true, - "BlueprintAllowed": false, - "Capability": "AKV", - "CustomAliasAllowed": "Optional", - "EntryParameters": [], - "JobProperties": [], - "LocalStore": false, - "PasswordOptions": { - "EntrySupported": false, - "StoreRequired": false, - "Style": "Default" - }, - "PowerShell": false, - "PrivateKeyAllowed": "Optional", - "Properties": [ - { - "Name": "ServerUsername", - "DisplayName": "Server Username", - "Type": "Secret", - "DependsOn": "", - "DefaultValue": "", - "Required": true, - "IsPAMEligible": true, - "Description": "The application (service principal) ID that will be used to authenticate to Azure" - }, - { - "Name": "ServerPassword", - "DisplayName": "Server Password", - "Type": "Secret", - "DependsOn": "", - "DefaultValue": "", - "Required": true, - "IsPAMEligible": true, - "Description": "The client secret that will be used to authenticate into Azure" - }, - { - "Name": "TenantId", - "DisplayName": "Tenant Id", - "Type": "String", - "DependsOn": "", - "IsPAMEligible": false, - "Required": false, - "Description": "Tenant ID of new Azure Keyvault being created. Not required if not creating new Keyvault." - }, - { - "Name": "SkuType", - "DisplayName": "SKU Type", - "Type": "MultipleChoice", - "DependsOn": "", - "IsPAMEligible": false, - "DefaultValue": "standard,premium", - "Required": false, - "Description": "The SkuType determines the service tier when creating a new instance of Azure KeyVault via the platform. Valid values include 'premium' and 'standard'. If either option should be available when creating a new KeyVault from the Command platform via creating a new certificate store, then the value to enter for the multiple choice options should be 'standard,premium'. If your organization requires that one or the other option should always be used, you can limit the options to a single value ('premium' or 'standard'). If not selected, 'standard' is used when creating a new KeyVault. Not required if not creating a new Keyvault." - }, - { - "Name": "VaultRegion", - "DisplayName": "Vault Region", - "Type": "MultipleChoice", - "DependsOn": "", - "IsPAMEligible": false, - "DefaultValue": "eastus,eastus2,westus2,westus3,westus", - "Required": false, - "Description": "The Vault Region field is only important when creating a new Azure KeyVault from the Command Platform. This is the region that the newly created vault will be created in. When creating the cert store type, you can limit the options to those that should be applicable to your organization. Refer to the [Azure Documentation](https://learn.microsoft.com/en-us/dotnet/api/azure.core.azurelocation?view=azure-dotnethttps://learn.microsoft.com/en-us/dotnet/api/azure.core.azurelocation?view=azure-dotnet) for a list of valid region names. If no value is selected, 'eastus' is used by default. Not required if not creating a new Keyvault." - }, - { - "Name": "AzureCloud", - "DisplayName": "Azure Cloud", - "Type": "MultipleChoice", - "DependsOn": "", - "IsPAMEligible": false, - "DefaultValue": "public,china,government", - "Required": false, - "Description": "The Azure Cloud field, if necessary, should contain one of the following values: china, germany, government. This is the Azure Cloud instance your organization uses. If using the standard 'public' cloud, this field can be left blank or omitted entirely from the store type definition." - }, - { - "Name": "PrivateEndpoint", - "DisplayName": "Private KeyVault Endpoint", - "Type": "String", - "DependsOn": "", - "IsPAMEligible": false, - "Required": false, - "Description": "The Private Endpoint field should be used if you if have a custom url assigned to your keyvault resources and they are not accessible via the standard endpoint associated with the Azure Cloud instance (*.vault.azure.net, *.vault.azure.cn, etc.). This field should contain the base url for your vault instance(s), excluding the vault name." - } - ], - "ClientMachineDescription": "The Tenant Id of the Azure Keyvault being managed.", - "StorePathDescription": "The store path of each vault is the Subscription ID, Resource Group name, and Vault name in the following format: `{subscription id}:{resource group name}:{new vault name}." + "$schema": "https://keyfactor.github.io/v2/integration-manifest-schema.json", + "integration_type": "orchestrator", + "name": "Azure Key Vault Orchestrator", + "status": "production", + "update_catalog": true, + "link_github": true, + "release_dir": "AzureKeyVault/bin/Release", + "release_project": "AzureKeyVault/AzureKeyVault.csproj", + "support_level": "kf-supported", + "description": "This integration allows the orchestrator to act as a client with access to an instance of the Azure Key Vault; allowing you to manage your certificates stored in the Azure Keyvault via Keyfactor.", + "about": { + "orchestrator": { + "UOFramework": "10.1", + "keyfactor_platform_version": "10.0", + "pam_support": true, + "store_types": [ + { + "Name": "Azure Keyvault", + "ShortName": "AKV", + "SupportedOperations": { + "Add": true, + "Create": true, + "Discovery": true, + "Enrollment": false, + "Remove": true + }, + "ServerRequired": true, + "BlueprintAllowed": false, + "Capability": "AKV", + "CustomAliasAllowed": "Optional", + "EntryParameters": [], + "JobProperties": [], + "LocalStore": false, + "PasswordOptions": { + "EntrySupported": false, + "StoreRequired": false, + "Style": "Default" + }, + "PowerShell": false, + "PrivateKeyAllowed": "Optional", + "Properties": [ + { + "Name": "ServerUsername", + "DisplayName": "Server Username", + "Type": "Secret", + "DependsOn": "", + "DefaultValue": "", + "Required": true, + "IsPAMEligible": true, + "Description": "The application (service principal) ID that will be used to authenticate to Azure" + }, + { + "Name": "ServerPassword", + "DisplayName": "Server Password", + "Type": "Secret", + "DependsOn": "", + "DefaultValue": "", + "Required": true, + "IsPAMEligible": true, + "Description": "The client secret that will be used to authenticate into Azure" + }, + { + "Name": "TenantId", + "DisplayName": "Tenant Id", + "Type": "String", + "DependsOn": "", + "IsPAMEligible": false, + "Required": false, + "Description": "Tenant ID of new Azure Keyvault being created. Not required if not creating new Keyvault." + }, + { + "Name": "SkuType", + "DisplayName": "SKU Type", + "Type": "MultipleChoice", + "DependsOn": "", + "IsPAMEligible": false, + "DefaultValue": "standard,premium", + "Required": false, + "Description": "The SkuType determines the service tier when creating a new instance of Azure KeyVault via the platform. Valid values include 'premium' and 'standard'. If either option should be available when creating a new KeyVault from the Command platform via creating a new certificate store, then the value to enter for the multiple choice options should be 'standard,premium'. If your organization requires that one or the other option should always be used, you can limit the options to a single value ('premium' or 'standard'). If not selected, 'standard' is used when creating a new KeyVault. Not required if not creating a new Keyvault." + }, + { + "Name": "VaultRegion", + "DisplayName": "Vault Region", + "Type": "MultipleChoice", + "DependsOn": "", + "IsPAMEligible": false, + "DefaultValue": "eastus,eastus2,westus2,westus3,westus", + "Required": false, + "Description": "The Vault Region field is only important when creating a new Azure KeyVault from the Command Platform. This is the region that the newly created vault will be created in. When creating the cert store type, you can limit the options to those that should be applicable to your organization. Refer to the [Azure Documentation](https://learn.microsoft.com/en-us/dotnet/api/azure.core.azurelocation?view=azure-dotnethttps://learn.microsoft.com/en-us/dotnet/api/azure.core.azurelocation?view=azure-dotnet) for a list of valid region names. If no value is selected, 'eastus' is used by default. Not required if not creating a new Keyvault." + }, + { + "Name": "AzureCloud", + "DisplayName": "Azure Cloud", + "Type": "MultipleChoice", + "DependsOn": "", + "IsPAMEligible": false, + "DefaultValue": "public,china,government", + "Required": false, + "Description": "The Azure Cloud field, if necessary, should contain one of the following values: china, germany, government. This is the Azure Cloud instance your organization uses. If using the standard 'public' cloud, this field can be left blank or omitted entirely from the store type definition." + }, + { + "Name": "PrivateEndpoint", + "DisplayName": "Private KeyVault Endpoint", + "Type": "String", + "DependsOn": "", + "IsPAMEligible": false, + "Required": false, + "Description": "The Private Endpoint field should be used if you if have a custom url assigned to your keyvault resources and they are not accessible via the standard endpoint associated with the Azure Cloud instance (*.vault.azure.net, *.vault.azure.cn, etc.). This field should contain the base url for your vault instance(s), excluding the vault name." + } + ], + "ClientMachineDescription": "The Tenant Id of the Azure Keyvault being managed.", + "StorePathDescription": "The store path of each vault is the Subscription ID, Resource Group name, and Vault name in the following format: `{subscription id}:{resource group name}:{new vault name}." + } + ] } - ] } - } }