From 69d45027575351e55842a5d1759a2911238b8307 Mon Sep 17 00:00:00 2001 From: DongHyeonka Date: Thu, 3 Sep 2026 15:04:38 +0900 Subject: [PATCH] docs: collect evidence for the two-hop header contract failure Control experiment isolates two independent causes: the nginx 443 block still emits X-Forwarded-Proto http, and Traefik rewrites forwarded headers regardless. Co-Authored-By: Claude Opus 5 --- .../two-hop-proxy-headers/01-environment.txt | 34 +++++ .../two-hop-proxy-headers/02-measurements.txt | 87 +++++++++++++ .../03-browser-https-vs-app-http.png | Bin 0 -> 92212 bytes docs/evidence/two-hop-proxy-headers/README.md | 120 ++++++++++++++++++ docs/two-hop-proxy-header-contract.md | 53 ++++++++ 5 files changed, 294 insertions(+) create mode 100644 docs/evidence/two-hop-proxy-headers/01-environment.txt create mode 100644 docs/evidence/two-hop-proxy-headers/02-measurements.txt create mode 100644 docs/evidence/two-hop-proxy-headers/03-browser-https-vs-app-http.png create mode 100644 docs/evidence/two-hop-proxy-headers/README.md diff --git a/docs/evidence/two-hop-proxy-headers/01-environment.txt b/docs/evidence/two-hop-proxy-headers/01-environment.txt new file mode 100644 index 0000000..7ab25c9 --- /dev/null +++ b/docs/evidence/two-hop-proxy-headers/01-environment.txt @@ -0,0 +1,34 @@ +수집 시각: 2026-09-03 15:01:30 KST +대상: https://app1.hyeonworks.com/api/echo + +=== [1] 호스트 nginx 가 주입하는 헤더 === +3: server 192.168.122.11:80; +4: server 192.168.122.12:80; +8: listen 80 default_server; +14: listen 443 ssl default_server; +26: proxy_set_header Host $host; +27: proxy_set_header X-Forwarded-Host $host; +28: proxy_set_header X-Forwarded-Proto http; +29: proxy_set_header X-Forwarded-Port 80; +30: proxy_set_header X-Forwarded-For $remote_addr; +31: proxy_set_header X-Real-IP $remote_addr; + +=== [2] Traefik entryPoint 인자 (forwardedHeaders 부재 확인) === +["--entryPoints.metrics.address=:9100/tcp" +"--entryPoints.traefik.address=:8080/tcp" +"--entryPoints.web.address=:8000/tcp" +"--entryPoints.websecure.address=:8443/tcp" +"--metrics.prometheus.entrypoint=metrics" +"--entryPoints.websecure.http.tls=true" + → forwardedHeaders.trustedIPs 인자가 없음 = 기본값(신뢰 안 함) + +=== [3] Traefik 파드 수와 위치 === +traefik-59b7647586-ftwf8 10.42.0.8 kc-lab-1 + +=== [4] traefik Service externalTrafficPolicy === +Cluster + → Cluster = svclb 가 SNAT 하여 클라이언트 IP 소실 + +=== [5] 앱 파드의 스위치 상태 === +SERVER_PORT=8081 +SERVER_FORWARD_HEADERS_STRATEGY=none diff --git a/docs/evidence/two-hop-proxy-headers/02-measurements.txt b/docs/evidence/two-hop-proxy-headers/02-measurements.txt new file mode 100644 index 0000000..0db06a7 --- /dev/null +++ b/docs/evidence/two-hop-proxy-headers/02-measurements.txt @@ -0,0 +1,87 @@ +수집 시각: 2026-09-03 15:02:27 KST + +=== [A] 정상 경로 — 브라우저와 같은 요청 === +명령: curl -s https://app1.hyeonworks.com/api/echo + x-forwarded-proto http + x-forwarded-port 80 + x-forwarded-for 10.42.0.1 + x-forwarded-host app1.hyeonworks.com + x-real-ip 10.42.0.1 + x-forwarded-server traefik-59b7647586-ftwf8 + --- 앱이 해석한 값 + scheme http + secure False + serverName app1.hyeonworks.com + serverPort 80 + remoteAddr 10.42.0.8 + localAddr 10.42.1.3 + requestUrl http://app1.hyeonworks.com/api/echo + +=== [B] 대조 실험 1 — nginx 우회, 헤더 없이 Traefik 직접 === +명령: curl http://192.168.122.11/api/echo -H 'Host: app1.hyeonworks.com' (test-server 에서) + x-forwarded-proto http + x-forwarded-port 80 + x-forwarded-for 10.42.0.1 + x-forwarded-host app1.hyeonworks.com + x-real-ip 10.42.0.1 + x-forwarded-server traefik-59b7647586-ftwf8 + --- 앱이 해석한 값 + scheme http + secure False + serverName app1.hyeonworks.com + serverPort 80 + remoteAddr 10.42.0.8 + localAddr 10.42.0.9 + requestUrl http://app1.hyeonworks.com/api/echo + +=== [C] 대조 실험 2 — nginx 우회, 올바른 헤더를 명시해서 === +명령: 위와 동일 + -H 'X-Forwarded-Proto: https' -H 'X-Forwarded-Port: 443' -H 'X-Forwarded-For: 203.0.113.7' + x-forwarded-proto http + x-forwarded-port 80 + x-forwarded-for 10.42.0.1 + x-forwarded-host app1.hyeonworks.com + x-real-ip 10.42.0.1 + x-forwarded-server traefik-59b7647586-ftwf8 + --- 앱이 해석한 값 + scheme http + secure False + serverName app1.hyeonworks.com + serverPort 80 + remoteAddr 10.42.0.8 + localAddr 10.42.1.3 + requestUrl http://app1.hyeonworks.com/api/echo + + ★ [C] 에서 https/443/203.0.113.7 을 명시했음에도 http/80/10.42.0.1 이 도달했다. + → Traefik 이 들어온 X-Forwarded-* 를 신뢰하지 않고 재작성한다는 독립적 증거. + +=== [D] 위조 테스트 — 클라이언트가 직접 헤더 주입 === +명령: curl https://app1.hyeonworks.com/api/echo -H 'X-Forwarded-Host: evil.example.com' -H 'X-Forwarded-For: 1.2.3.4' + x-forwarded-proto http + x-forwarded-port 80 + x-forwarded-for 10.42.1.0 + x-forwarded-host app1.hyeonworks.com + x-real-ip 10.42.1.0 + x-forwarded-server traefik-59b7647586-ftwf8 + --- 앱이 해석한 값 + scheme http + secure False + serverName app1.hyeonworks.com + serverPort 80 + remoteAddr 10.42.0.8 + localAddr 10.42.0.9 + requestUrl http://app1.hyeonworks.com/api/echo + + ★ evil.example.com 과 1.2.3.4 가 도달하지 않았다 = 신뢰 경계는 작동. + +=== [E] 파드 분배 8회 === + pod 10.42.1.3 | traefik traefik-59b7647586-ftwf8 + pod 10.42.0.9 | traefik traefik-59b7647586-ftwf8 + pod 10.42.1.3 | traefik traefik-59b7647586-ftwf8 + pod 10.42.0.9 | traefik traefik-59b7647586-ftwf8 + pod 10.42.1.3 | traefik traefik-59b7647586-ftwf8 + pod 10.42.0.9 | traefik traefik-59b7647586-ftwf8 + pod 10.42.1.3 | traefik traefik-59b7647586-ftwf8 + pod 10.42.0.9 | traefik traefik-59b7647586-ftwf8 + +=== [F] HTTP → HTTPS 리다이렉트 === + status=301 location=https://app1.hyeonworks.com/api/echo diff --git a/docs/evidence/two-hop-proxy-headers/03-browser-https-vs-app-http.png b/docs/evidence/two-hop-proxy-headers/03-browser-https-vs-app-http.png new file mode 100644 index 0000000000000000000000000000000000000000..1f8a03afceb996a9605e477f4f5df714bf13216f GIT binary patch literal 92212 zcmdqJWmKC_^gjqSXem;pNRbvTuEnJS#i1?k#i3ZyU?FX3aVhT5;_eo-#XZF(KyV8r zcz}>((|-TIJ-hFA&)FBdJ9&|t=S-fNXXehGdq4LxPxu=xWzu^L_Xr3GNL5u7-w_bp z#)~%}6W_ppom?4~6A(}ks4BkD_08O0x@$@Wz$#$L2id78J-&aZc)UnVd@n3QS-ri% zxZ%J!V1A($c2LvlvUJeYfN^yKbXFVynp{yZ>saPixqaIM%Ziygp0h40>RY$KRi+z{ zpCm-$?x%eEq+HOubryK~)>b4fG8NLcg-L_FnfUYZZx`_8P`#h+KZ$^lfROG#@y3lC zLjOs(ZrytSpF~Vd{Odo7f`Z}`;Xm>5MDte}HT6BIiAfWj6a{9%{!V2*vzS!l5CwL3Qk-0bXuzhi~(j-YkM-esV3LN4#-3~{~i7ixV) zBL6%kDqhp?B6?O|?zpUGqz2f_pIuk=#}RN1gW;~{Ty$(`6c}CUJk-CoIHKg+0#~P1 z^Gh=oFyKxcsMA8+OurreajDl;AhI4pb%IT{-3F3)MjQy?nx)r^csg1Le z<+Qliu00>FPqD~&jeI1u^nSC}laUQXFWbDkj+M!o<+3Z{m{7~o^*Z;Kc3#XyBQj;g zjrl$38FSNCaW8hXAn_EB*2M{k63I zHc>{e>eM^JNZ9|aqfSEw9fD+A7`k7=HG*k{MjDQ#HHV9Sn@3MXlee3>Yi;O2fP0YG zu|K9Z&eeJc7HBt44avhc)`LW)I!dC!*IsLyW#*>Y{LYKVAV~SV8+&(Hyk-kvlvm<@ z;-pJ!Hh4D<0?9;uA*dKmk1za*R@@mYyZh`_yJmW$*K}FgLryQ2;BxNCElBIu8I5)u z7ZX)zO;X^yGncIi^A!0Q#5y*vp;b%6e^h;S$(6UCS47_5iSyO|CF! zwgg}Qydd~@5S};Xa1+Ql0jdI^-r|*iSkp8rW{NppHjVy}pmQcGLyj z?FoA#o2`vulyxFN1pjUp$d+stcyftd=y1z*Y;bk<&-M7lkqp1wSbJlJ6LG-$4Gq_` z0#^?J8d62f=E^ZlRcy2ajkr;mT-#^FvdT}Nt8Q%pO&f_{e)~%)FnK#fHpHb&a@>z8 zly?HwDhvE%>le9iA`hqf&tm_8R^NUv{z&%kEz=C z&VbtLli~~bO^;yYkYO#!BB$ay#03H=e}T?;6iEa>9Gp79!ja78{hT?fsLD2LzENt> z1<37SJL0R?S}v?AwTvT#$;texv-Ny%WvIPio}i3z`IHxvVZ;pk&Rpbe0U6Pc;%g$}S>m{kg2At;0F2`$ z8%whH$i;X|FzDj2!8Y6z*&-Uyzn8F7r|!L2K%`l*ABc$+%x-m^b>cnE@tLV~Ow%u# z90&tfRt~;D@u996Ribg7K;FAE*$hW&%N|EJ=lKTBmdeyRZ1sfVP>3M8S9BpATZ4WZ zR>VmRQcX9EnS|dMxc!tqDD}(#HlD&FH{FiKxK&&gSEH@B*v?B?;bI=2>8!^Q6-s6b zVN`Bc>q9+bpp>=xLHChXxKEa6_;3B1)dHeOTd%73g2T20yX|jdXSC0qiy()8AKOibh%)W>|r#eZxC46n0KshBa$Y@ zD$UIy?1aS_t>-EY8{D5+N^#^_SkhJe8lL`Wj@|*Feu?EbnRDo|TXZL{?bYa-Vu7~% zbpls3>uKDUJf?(HbU)58IWfvAy`g<@HTV8}k195B?2f4TaEW&dvA}SW1pT6Ea@}qk zHzaO#wGw*KFC%e&O(%{a&*=av^SyUDK@; zVjKR!?88swlvYdjM(@$)q^J0b?=sANzbq2mh2{X) zRSUwxro-D6+FV~9A^3Y2&39~0WaP=Oa6viY2#;@K0$&^L$I^2$6M}3BK@3unW&}~Upy5pPVja_ zwP938GC&wK5mf7Zm-xLx9SD^s56yfSpnxg@>w`X{i2r#rx3X97{%UN|DH?|BnwVpe z(vV9>l0PzxiZx95o#THqsV`uRC^ixswhhY zkc-F=rRjb%Q9Dh8P>?j#e#^4Hl>;42BTM$8mi4PwQ4!Ep7AgzNLd^}AA+r9MX*n;P z9U~1o0)9QWkA^FB0uGh%-oV}Y@SjV5YVnoH-$@je*`s&c7@y2=kfjEJ3Of#i-)fs2 zt<{}S&UdEqp0kvZYNf>&=xF=BKVvB-{Y}3czV>8UEmAt>`*+NG{2frP_hibFZ~@#L zS}w!fv5AIZ(5dYZ_q+p<9+3OmA`uICcki^mUeSAYd&uV+#tTA0S_We~ zFZTI&Ta3s%Mc|feV!G6{OwhAc7;Nd;ukWyzW($&tW$(h$i$r>w_kZp6r_ZF?h$Dt` z+~%0kk^=qEIp|~*8?Y^?H|#a;90ZTZYP`y|x~XbF(l2+8NZt*NNtT$GMxYC5TI$Qg zcbVp!8=Jd?WQ$H(z?~MNfWs7CEO47&@U()N#FocQ`Ad@beM8{ZmnL;7#7~2n#f)Ah zo<6%gTMX}w?G{2zy9914f7o`X&+wJ9_m zXt+z&sc3R(jK!dTG&frlai2Bc-8J>88W@mZJ=c8IWm z8MdbI{sv)3Mu{2)+U+m1)bXCrzOro>HM&xw{3er&af%#(5w$8tM~rUWN>&NpDh_8QCL7PYC}>VZm;#-EQqw+c!87dNjbT!}D4M zuv4#xz+J=g?WuPVmN_oH8BL6GCeohMEX4;bVm7Ke6Vg`qlMIqnioL&rT5G)2pOFBx{#{^3gsqFc)N0#he-}lL3hgdhv|64Q|YQj`4ldHLQX9DYp&g+i=xykLja$A@j91wR$ z)$5({LgKf`y19gl7EF#C6jWNwc9&u)QA*lX1qQ(qSUe z?}Sq3&hNeQsfoAig`+9%!S9)%7UO0e)??0>Xc80uhq>7eACAivvzmNR0c93)vWjzs zcr&2|_jjd|v)!E-gi(`X2VnAUQ#Eg4CcIJv$x0+*5pdc7VhG^@e} z-M(DM@4kIYr*H&f9uZLiGCS)R1jpoeyZzFScbeA0A8iTxV6Zbk=_EaNnFKJ8UNv zF+@?^hm|*<4U)E(A-s+!`k7a*oF9pIp2S%$#1AqhSwtl7dhL-QE&fg&K8_EOBbdA! zi9;78O(uSoIvT^ZH{`UYcLCu072m8Cr#(&;3|Pv%m{|g#hPr)wzTOs~wOr#5Kvgwdj?C%R9n<9vfzXq~Q@L1g#cgUpr_FeMLG0 z461DTaC05mz_8SY!;+wok#qpeI+7*O@Y-jVgYqY$&_JS1$l&$AiTVLOyz_o{PR2aY zW!h9cPS@>XUDOSU!;<_?x>FHs~8)^=L#eiIQrSWW#7J#eYtMSyLNAPR$Mo;h-_#s{l2r%gyW>L(=Ns? z#qZ6ha$cESMOj*;$48JbZB8?k0;HtKt4RN$HZCt;|Xq70+Q;V}Vv$l+I{R3lA+8Ez;985X>$}Mfoxv!IKyVqFmcgcU20MH!&R-nDx zVgS{@o=%?zp%0t=NSpK$3<9rmLaET$^J#FbY#&W4TpYV8vlNW7=YSn`iEfg2ES_Af zW!tNhCvImc!LvtGPQIDSlsagtB$6 z6;SnrcEsnj8|UY1psRbe(|nTD8z^Ay=>Bc|&D#-n0sp;Tg+<8Os9j_+OFI~m|J%H7 zE6WclEB+$c8)(Ui_OkgCn0T~ zZ81{V!!r=qqV?zOYn!F^!Qgh`E6UJ?;{_iDQMpZe55H!3V@DvahX3T@=$L-MaAXV( zlY&pV>wpvK-XN;;FjQtvWrPvCp9PVpjz4VzDJaQ-raPxh_L6ApwfYQy+uHt=cG_hl zhlv4?=dg~jAUj+OAln}`Y`raettz*j=A98VnWfMxk`*si4OJ7kktGT52uQI|aIvz& z1r6hU>KJbj4h?OM41l?7axGUM3qqFTX56bzv7NHmi7n}#ec532tu{o1&r93SmqD;kVCK^Na_cegWU4==ls*TB%vT839C z_R^DrB^QC4NZ9^Pmy7&4!kTxdvpmS5HeD-KMBpem;wP=$A`aOZB)OR+Lz%EGcRJEm z87+1FyQSS5@%6+d%yrosGA3jHp^pQXV)z4`fz;KwLS2m^>qj!D1{j5p*(aF6aBYm> z{2%9vW^I&5hH2nxf96ch3rv-|w{E|&wyv(&%z}#|UFnRXVyxC=!6@jW!DwTBb81NAFa57Hs3c*S9A zF@v^9)e!Kxv=1F`p^)zqW0w2a^^2l!$2gFeW)2==2JBKp+Q(HqoUW?z~pT};Wf2MmaCPD;RJ47BqS6HX$aJ5&l8yIh90sJdtY|J1e&ve)3S; z-)Xil#_8T7*Xoh7JS7U&+;Z$80vP3*q!e^0Sj$%e@Y_uadR~v>uFlfyfE?0)?w(|0 z`X5Pfid--z| z(RTZK?Y!XOlXivClWGB$!i#R$l9!K)vp|@<56%ZUj%m+}IkVB) zIjJ|1HXf^}GXQ7;tS@VB_KzLh;7^zICFr=YtPg>QH?YxJqrdHoFr|z6&B!i&G7Ail zV;wec1SwqB(7o!dc?Vq-GMWh%#3)^!A*^Z4AdH1JE%m#RuDd&W=I;A8leTj8V=dO9 zdn&bBa)3=IL9QUrAI+6$11??8nAWYUf<@2#w1m*eR^ADXrI;qc)8m2L=kfp63NZnG z+D6e9=HE|`zl{cPoBbeSkf9B#v7%MDob3&6mt0}1709Y{IH=>D7Od(3yj)w{J!@gWJ_W%yi-w?+03s+5GdVMuDJjO$nC4~3su;->rOF&w9JC-+-5o8>P} z%*{J+8M~3&S{m`^%-`qj%M{Kr5+*TbhE>*u7Zoz1%X=4PZ<-F<>M|nbuQ6-zju5L^_jKlpc*;1mAy|8O2g=$bH< zB{%Ag>IJO`Z^59skjyKk|7mU5d9It2Lp!_XqsC?m3)3@yh*lE2dEE*_mg3|1Qkx#D z##TCbnw$ywyW@{Z7K;D%kwBnnmF!odi2Spc%v!ynGz=MIobQ!;v%P7)(#DG+$4WXX za$GCkH<#o({I7JC5MRhM0-f4Z@T?YDiR8P|>}uZ@Or06WLpS6s$6NQfdmKs3TvY-M z{*b!z>eI}U^@K#$Dwu8A92)caUT7>u2dm@p$PxEy{9}XBpQEk!GTN@c@02@vOn6gf zhq{Z=ZXU?aZ|s@gs8G#G%%I}p+M+V)l+lF+029T;*Y_N)SveAmE-zv6 zo^{^!Mbk5H5<9D&Lr#~nJz=bGqSM^XLbTW^56#Y$n~;*lMepoPWuATE_aYj$?b5HC z-aey?^l^SF^z{_BKlbg8vh9|Z`s}xhQ=%pp0U`8QWlYS#Si7|7yCUtkc^{)QOK_h4I((Kr4X_xcs+cl#ysCstuBu*E{ z;wB+kzw5c3^9Y@39~?L`zxPXWSKCqm$q?THH<-cNu_EhfKYu2TUMnWDicHt{wV51; zBB*ryh2n2S`m5G+CZ6&F5zk50vt7HwEYj~f+mLXlg_F&hwr*QeUn4X`ylBWEa<(uw(cUny+!)L%F@z@+UPfKHNwoHM_#L+G0Ivqci$Bi z#+TMET$Qe^bH&i=qS>A`vdnTS8+dsT)2;b4p;FZ=t3*uLHMHjHVm0`ZtF)~qp)ZnQ9*CUhXXbb~KMWdx0uB>j zWCQi$^VaHnyB{46cpW#*q-4F9I2#D3q9L=jd2@+aZ*bY@it%f&0hbo9x9?~BcUcu^ z5*^vuDJ~phEjS^v8Y(8H)aQ2%-KBINL@ZvYQ%(wA)VB%Hya&lX+m4Ddt zuyyHnL94{ROL&$iyh@~dEIE(+V2T3(TMUS3Drjjd%=@(O>f(Lm_(Y;j->bamjsDP# zUHevqj;2?jGudiB*UR-Ujdog`_gUX$v&;_+v{8rAR#GSm8Wb zyDL~7&ZpkP_#wEV~M(qmb`tmK_dY{PL}kuHsSZ0_KRz&{%P!| zI6L2#=V+6%WBIZ@nP}nUEjNLKtKY^g_P}S8^t9n6UfXDz0Hv?)aqAhKD8T(>Tb?nf zN8h-ItDrF+cGD|896@OcG~VZZa8aH-mbu%|Ao)~k)E+k@W&LsL;wY|BhsZ@<+zr0g z@I+*M(aG9OKK5*+Cb;0ryd89#vZZ}`$m^SGLRQY>Lb}MfxIL?lZ(O5`Uh)<_NbidG zznVURw!>LD1yU8HX5KbCdagevOyy#DUw7Mb+@0qx=sNQocNENtX9;jx-wOp&6jxJp zo8RyZmK!~O>gI8db&AFq9zJYzSOsqoC`qyP4u#?w*e^MzL?Og%lB6}Lir zq9J!(77S)(;?AW-Fh?|beS76f7CUmZppn}Pr;EZJU8EeZPl5k7xKD8ok~f4hQtU08L$@xCZ;}ZWf<&zlA(X_KN$q<#UuB4F%T!K9IgKykcFU+EeI(<>iJhoSB z-@waftvqxJ;A-pF>R&XRg#)#{c}Eh?IM{IiH9Z> zpnqHDdmDxrg8hahXCsRVjE=(=X(XjK5TjIbmPzk-!@F+{N(GdQQ)N#IAR#j0D;P8u zVr#rad&{);cnoj^mqrbo%60AaNCvIDdP0?0JkM*p zrc$@A1taei^ZZBTh`QhHO@4U$DBym-MBr%-$Qz#*+j?njFsS?EkD>#|b=^s=_xRD^ z#zi)py|VRr!_182RGyBQ82ZDS1HX=u%PHks#Xff1?q%Sny=eBVaS`fkzY}=1!$GN8 zqI-y1FmGdlH%0$^i^~?c+Q%cQAS>Q z*2BRfDd|6_B+9TG!?>cZ_|10Akk0!G4vE=o?P6fcE{+U~XvQudeN`W8)G=vdDwSY? zwP?$F_SJ?;vkZ32X{k^=%%P)s0WlFNU3VGVyXKb}syI_Vr;dVT26WqiquluCTN}p4 zoowaRdlCG{j+3rnlb3#AdxmL`qjwo{AS_+OueSlduo+-M-n2W+8i-JNBbP&~sIPKHR-rc6x+|6dh(5 zfpV^RpTeh}?blsSy|8)sHqdE)%th&;pdkCvUT=b_$*fzIK_8dm&OpPk2)KK@LHA&( zzDi(YkxhpK;hm{;&o*p$Uos;`@Gw>V9XOQrl5;8Wq$j4S#xvP<$)_60@t?wc$}#ya zCYE`>>_zKyouU2Po_!7hn_~2twL9va{aq?r5>^jiN;3+#IRhd*?`qNs6@ZD6*0%0wwF;j7m}x3cWfN~w zKeYJ9u{^Bs%NOFmky=bsd;3D~M#G$fiwH}j)WFAk@gX4zmTcMA<`sD>%I$+ISTM)O?qmZ*8gTj_E6bF>RL)lnoIFo-@BrwLi5jZjJXNE;m8fH9x7_; zhm6e{(fRZSKVOIc@Q;g9CJ!SKtRa;bO4eX4&#q9 zSt)^P3ecFKpS7{qup0ka*7`ryqWlEj#^mDg(e$m_A3xNC zuHJ_KGkqt{L^?idp&h&(}m)?GciNz@?@82Lr6buWSU z*0$+W6go@%m3x`nO2OSP)&;+B0GzzbT0OJk^6X>*-iAl0N3im}N#@~K-D_VFck)L6 zI1zd{8fG@z=L+$2OX=7^4UBbw%gLq`@rCyu=(J@=pVk{ink-Pe8(@%81CxFkIQ?aR zLVLV@Ivkduyixr;9qc@Qwl|3jvP0cz%CP_GLf($lKNcy>HB&4M^2N z0*@?@z>)W~I)jE9JYOq?L&i!31?Itsxm6E=c{QtU>nShTOlD1{_!afu&fFXIeulBM z(8wP?sty|OnpY?SIR9`FoKOpUvSg=u`ET=rWR|F0{nie5$srK2eJnhZ!=JoKFkDB} zj@Y*VI`-((cqPjzs-QhE6SXg#fL(% zVWmhJYn#O$n0DfIHQM2>Qlwuy^reF3B6Ep|K7T3g@!i#lqQ{aRyP1QIUkLT*-c(;+ z=FJQUPqL`jW9*?nyT>YbJzTb^>iTSEgBbhKQWneSaGni6UkhV9-O1k1|Ae zwYbIrBmVPjy$aw`izc?9OOf>dT;6y!a(T1bkQsn(8<{glZ89!gTA^Q@!4*@-&_G11Mg<)Rf0xD-?`bXGcZ+iB&8$j){@~EbY$4T zCAk@L3DDR;Q_XDjmBgWZ^lzp+u#U@huv$Q;J7cZ@yEGHv3M2XC^q8dGr^=jA;yK>Mss?SH25* z@F2$vrA4V?m8_+aSkL&Bvf$cIKer9`Zl5N{fc(#t(Ne zRgUXP`r&w*SK``Gvp(MORp9P0=B5gWvOvn6dPi!zKIjnQl~x-v|Gvpp0H{~zH>>OI ziyotHVwV2%v2gxy#uYVDlE*g6rBJ#8NfR?34?NCWZ+LjngB^C|Vh;V;{F4oq-ECd9 zWG1oo^J`)_SH}F83RymR9R#mJJ?_9NL-{@R*D*5+7A6C$hWiZ%L-Sx!JCub0m^yoA zt#GDNj#TvlmDQ6cyK!+h^oRkfQek-W>BS&bGBjVkp7*6RyKLm8wBPS~Q}0>r-*J}i zachG#>DVr?XpP`zmCdZ?;3~z*v`AOa|8asWTUH7x{H#~M-pCdAgQSQmy z#}@G5f<3f-I?Jd9uH1MdGax|AE63=fZD1r6H?P1RP)2@z(EG)oONvOrdGG7IV_;{J z#ChW-RSVez{2=cPF9qyJ#N=-u)!15C_>HToYuFjw>>}5SNxaLb7kb}?8DQdGH^0Vq zPgxzGna_Qy4 z2iFY#dL+ulJMYoQBq6Sac((82u1uNJ>s&s2!Rgf~_vO2a6l`J9^nm$;(GAK>DS3%W zx8>7=8Hkx_=0lY!$GChDtwZQ#ebS@#AuHEX53biCs<-SHt&E>KpkxA>W{WWLO)0J6 z1|p}VvdjiRo$l3{?3{1xeVYC^s;dtE{5m3V z#5q2`m(F#UCBPsg>aQ|C!kd7{k%JLOs8Ryu(}PnuS0hypi=-*c=*rf4noL`Hys_eX zZWcB}Z=88NGC)UIpy1`DW@`xjA1nY!$n=oD^gBh-&)$6dxpGDk9?mSG!pb3j1wJ#{ zJ}f=Gl$yI0Bm+hr&h0moXrT!YaH}>HzB~_Cy#f7f_RNla*Fg@b*$SEqZ0r5lf>Rm4 z5zgbtO0|q*e($Q|=V8=UOyR$BQ}ZtM&%0?}W;MObOxXpFd4-U{fiw!vBeCuFcH80A zO85NTvbI})dHq*);yM1vu;bOtef0WVjxjk>p%L=T-yi08D^Z1iMJ7`#6jZF_H%Ezx z>ux=*Ak}Btb)fEzvqmTs9o1xGv1ve3eFc*bK1Q-O)F$Xn`YdLNyYWwVVub5`1H;20 zThN~d{Yy8?nKqbLg7TzMzp27(92qPdelLoCsefLcDeixIy3uSHS9P_KEuk&`%&RTG zaIH1{Bi_R!W8)%-WV6qL4xE?7v_uy%=rJaa4)xY((9rTmC}cQ!WKT^Bj; z!iHCZn;x{Z2YxlrPR`$Ut+9oQH(c~gEV$g(5AKB)NeIUh->K^N+0^QUikAXo8w;J407CubT=~y__4ts@q0*CR6pBeKOkmdNyw!uY$ zp+n^5nBoaZ8~8!flr!)oBha-yD_EQ)LLMUXE2#vG778#@5GsK&$b&qjqG%M zmsx$aqim}$;1^(AmL*?Qw${!+8m#+C#@B4R5m9m0N^cxTIo!Vog zp^N}l1?>k6g^v>z3zD0`M`Zxv=;mZnyyj9J+SJkV9ay|^*`*svb9DK5!O8P-`r2RQ z!`yB-kj_)sDMr){CTtB6UjeD()juw!aJYpus2W?qF2!auvo)Mt$*4&A= z8P*OJ)1(#YXWBlsU0-j+PnI#=AF0vKbxcqJQz3Ip;X(Rs7no5M$;aiV3 z=Y~e*0`R>~0_iS3w)VeXBy2XIUHkpfEQLwGa9iq^oPfw1kI2$xuODs^Hhbi=AKOzP z0<{(X0pssg>tGB_MI^J>gQ$zPr3@LZC%#rjFZH9!Axh3w{qx2q&TwdN)Qpx&y06|# zJG=aNv26^n+g<6r7Rrgc+MKEd+A5=x82MdKDDhS~a~qMMkdu+c zH^6d(9;IojYl!Dz7{91vm zp8NIjTaeN1!7t3A;9tV0eAo3yd6T}QIXT4=nN8ig3PFH|pS#yt>C!nIPh-GAuQhNf z#=O|`(a+tL@{{ZlskhVItpd6W4?;UCH~nopFTIEBkJcZuvqK)#Ggm47J!Gf#7jH9l z9opnN@QY2bK9X zpx$+^v)=kIRMNlb(i>+5^S>ApO^qhqZe4A3vV1xJG;O>7NVaMAUQex9+8--%eTzA( zfK}y?5;mpnhY>`T1XS5V?=#oLv#CDV zZAeu|$X}e$fKuB1_wlAE+m}|*7WcbK+~_el+^b)^wnjqXBdTp@lF&CDsjVh{L21Y1ezW&esVlW-90JFcjQ16PGB+s%x+fKi#9xB z!uDI`BZf4vw-z1_%F9RouYYK!$$AHV$bJ2i@oM6l$%KT#Y_VYHktoNaOwieL=|}$X zP7pHhhG=-|(J%gWny<}j5^dg%B&P)MTpOd#7LE+D1tqnDh!5OzU_b37;Gx6Nx>KJ( z2WG*L)Run~T7BS4CBZAmZo8Vbjw#@eIHh(Wc29J@K8*BeRY?%`>`Oc)4xcscaDz4m zN4tET&}zRtcVwu1m(_fIl=k%ntpgq_fB!pN)HRKxq$Gj8Pd|?UQJX1Xb7YY|;a#4d7zFCO6B+GCL*{rzI!xQ| zo#^l8XG00?N_Go!S}%DaksOiQX!9bmW8qOw_ERd~Gql2$vzwd%<_5tpZR?&p@86zI zT}ln@A!maelMBs6fk(PD_u!>lsbP^40K6m?L290n((iU}_aO~yOu{gWtCwOd+4m=BLZ|@qfN9H}dbl&K2)IBq>VC*^2CLs9eeo@+-+R|2m4AQeN zc=amv@!QjBi7`Ai5qDY05dU$y+(^{95UFL@Q{rh~=pPF@t2#cPbJ~LBjRXsRpRp4( z6zYrXJW?po=*g!ClZf!;Fg=S{0s4r>?$Ubd=~^lwX6><_J@ zP2q^!J<{#{9eg{Qzapk^;!D>Df%(R1T1HvpX&ZMs-g_~L#@{^B4n@i%DXM1Q80${% zof)3_6Va6Z2$eMMm|5uh;?Z8x*jzluW)L1w$>-~08$kYW8cHWPY2|T2-IDm!Z5I)& zq$%#{J-+(R!X`pG6~EN3pB_}`DWB8mX3*u#+SLnr>8iCA3xFVl{*e_OhbtxewlB+5 z?~V6-#e*Xc^)j5FeN!INFvtBE&P(K0eNxD#z*zFk-YtoW1Qkfdz@bvd?m3(qz^nb8`V~byQSG}s=dq}%Q?=eUih@aA%18(1qbqJ>o;85E z;MPJ3;)F10mgBwP;-!2YQ}1AWP2|h%m>D zd2rpB;!LmpGK<+6-(LvG%n3uDDfo+)%|wF=h&-Cot1iFe$ni`Mw#6YwXKc*$d zJ6N-AI0y5->r)(b@VV5l8}GV+m=D`lAw|9j738xI2gCG4jlKO5Y3!n80#LIzuRA@O*LAWs!U7bi=R@|B zy~olB{M85ver?jSlag|!WO!Vvo}jJq+0N$#ts66cgyc-x;ZNz!6Ft^OC3+GAvD0rK zG0WkfgAF3o5V8ZrI}Lx!|MArlA?f%F#Lvx7e#S1#{bd&3xX1Gg|AjCAH(phd_x$E{ z;Kj?q%#Yxq*_OP)nGG)d4L*`R;4m*FVcK*M1c| z*gRtUn6YacwJjZnpPx+U=VE(u=3^BbUH1hsY)>duis1E;^~c4Qmnj#+mnsCmD4q_g zQ`M19PMXK((YF)4n2JxV3E7>O$?f&O0oJS zBtMZOB|!An%lX=k#97W7bSh@>VvaF$CQ2w6#4f;$i z-aNu&_{~ctS?zzL?k%I*?Ao_a%3WHdc<};-;ubU%Z*g}IgyQZ_2(-9U+@ZJ=+@;0c zJxFo);`XM`J+I7vX04GmUuJ*GT1hV1*R}23zvDP_uI?RkuR^$YrPgyA-zg{^*^@rF z8oGHDEgFNZ-5{t)Kl_u)Q~__UY|1JLuWa9L8Eugp`gQVmxdrKg(W_kCilj#?j)@FV z+Bh++syXZr$sc895}RQS;50U)mkKMEC7Aj11GZO2hW;4~4;% z+Y4`&i$?!Qm1ZRunLXQBFg%K}Hc@>rRdLvXcZYLU6XLE{%{^vo8z_}#4TLCO3S8;- zTjYx$yOS5gdLhsIzG6@mTr15T+Z@~hx7F75%Bku4L1x?(76;D+ zBZV|I+;|3Zmu!%ZB##)`5%F)<=5fp8XEk~y%_^nC-({!+1z&HlaBxFa?Tarj`ud`M zM47ph#^uf*CoHC0grWZ7^Q5SQyB$6akfHP-VHi)R`-KkeCg z<7kLGNC~Fz^gXxuOUHQUrTpldnK%Wt z7!?vwC47|pm+RZ=4a1i=HbRq3^Vra@-tLj(1+pmamQM1vYS@;X;(b1e<~6=?Hav=P zz7nNY8AaRDm?jNt2JbKap8g^ny^L$T@w$#xVuJvRmTjP4yYp$!qWwtwAAGL6 zaAK7mc<@z1W;?y%_<*hnjc&R1rZ&P z^BjF{a?I@r!Pf!F2j5henj-g_>8fcyo0V$iMm!0Nm0Q->*x+vkg;_KhLnSVqy@*NZ&ZUl>*2LmU-o-X z(?UCY2i$L)D*^rY)04z*{^VC|m)4BgH6>!fZAw=z}sTPon1w7v7eLbo_^#Hr4bh$ zXye$IkliD$`n2hqRF}M3W}|mtLo_kys}zzp;%+y0AKR73@%gxQF}2Xj#?+^?{m(>q zYzE!}CUu~M z{^Lv22&LS-#z4}ljZxEk%jBd%O?9t9RHltr8n%tw(N|U2ZkaZ*_Qk+7&M@w&C8*$t zumOI;W@U9(QG6k|qGh^SU_UOP>($9f+a!xSZQ-R`j_dr7m{23wfzP?tg(8xOj%2|6LqFvx6W zx74nPbrUG}lnkem76cQyXKB*xXX=-$N_di+6KATHGy%W_ePmYtp{wQ&_W+-~*I>P5 zrWmCg!CwsJ$C4>uN8F?$%Go-Vlx1cFD_BV>nM`0v?|Ara#go&L&yy8#6`I0X+*&@x zl8NkJ^H&8ZsHM&qN?G>4x(J;E;8Y95{*iALT|Q_?V8gbmt|DU@jhs=;fzkzs3kjhX zj!_7`FvugsfuxlN(l@cXPFJ%7AMeP0+I36X1y~JLvM4q>2lx|uZQ<6n8lHaQt(i%F zG_jSzl8$@sS~`45J_~JAy+VX!q(swh-4^^t?%`sh+&i~#E~vZKGmU*O@xF!J=q|9% z1vtt;ilCckp46C*@KA>`&3w0(CDDap2OU_&=%Wapw`_bln!;}m3CXD!ElP}9td#lW zfWs7n?-emPg}DQOkg0BA9IBY_?UX0q(0Z-9j9L?IC6h`ocuOOn|7rM@H(*qH9zNMb z+2qUUf3oqO676^td1S-bsL*+DZf6~Bz0*Z0PvU9)r18~FApWLgC6N;xjW(4W)*|*! ze6cM!m2|b3i^yr`;E3l{mq6W!J#f+L;b?|6h}RkuPOhiyxG-#Oowi!c@$~z6fK@$6 zlg`ST^+IJ}zbI+LH1+sOm5@cBkjTeCeqMYH>2fw%`BH&ubwfqSfNS?xQ6O6RtLPErPPOdL4c# z!tU*1dypQRY_*fk`33GIan=V|ex$U?b$(%M$u{t#B>BbGeE)(C|9O=bFtDk)QAyS7 z@-n|0-ya&N$=gyJjL)NWAvA*pfcz3En45^3$RYND#7%AC6+gw0xM!)-V4qhT3=dcx ziEtXL00yRESIh#Bez>; zue4L7-7;rmQ^~XbNK}U@1a-##pC0?W=*C>B5>|O>5$~OCxc+;_}}5&(<@nI0Jwq z85W?M^xH0jhEtq|RzGP}e|GWNIJ~oVyZDWMi8@Cja0a{mm!?zbo4fNJCU`8q8YKq4 zWbi2pp^{p7F@r7;Oqj}MVM#DBWwGw8eGd0V)^&_j{Yie?8D_uufM>Z`!f`mE*}E5s zX2?l$mQ}%e@0`IUT>)WJz%N#hDz7;_=6_{ZPjMfW0p_Q>d=<(7?iT5992U>UL!;Jc zewM*<o8MinF9mJf)sZmmF?A4Cd9g@1aN2eke8EwZe44dbtfdjI?ER_wZX9nHCxv!2J! zg2_PNmg{C=innTV!yI-LP3b`?5Pn-BG*eg5zu6*YW1v9_oKi3O@38b*LGhyu_+>g+l-BJq~zpqKFkD=w|0$s;HxLMYsbKg!ddAj80cEb-g zgvNtvwEVUiitp&evfY&lk@Z>v=trXY~kG`oe3P=HY`meieGJGa>~dzE?tFi16I$6@=36niFthEFwQxXIYR6oIYkIg{RYGiP zfn^H!SRv!M$w{N$vcd9f=-Jr6K<44l6XGbkghiI?lN2o1wB?w{rzk1DrVlT|_wmZt z{HV$FLt!~>Zt>4SXAtGfL0|K}kwk_H`~x|G!u!KgrFfX*1an^m7?+fjKHg_)%_&CC zgh!o~p{l2w-nR^&R?dQ?YKLstRAtd5pG9oEM618=bis4jlPyPufw0=Jal~b;YCqD> zZns#WIBWs8nmCSC>x21}lY;(jBmpo<{oYa2Jyq7-99?2U0tL4S#oBdpw_2ig>#`<3s(#a!oW3 zCIN3|{Y<5&2!piZVpq?SxJt;~mU>L@iAPP*Ijla)xPRLm4T3vc(^h|1MOUH9TF7A5 z4|9)E_KpkEPv?cTKFnPzLLtgd((LYc)HthoW`z(SVUlp(bwsHA1C0*wGZ}wXac6CAalD8$Q-5FJFB;*{;{KW}g&@TPQQK$$rss4;oUnj{8YCa#1rBg((*M;!w0&csY+q(gq#>G?X~EbQoC3$Uj`1!bJt_(e!R$# zT7gwT@KgE-TqDdp&NlK9#Mv*5brpkZmBrP6(lGAGIH!m7C4iXk#r%|J&&{%T7Q({j z^E#z7bM&0f`sU~cbGc%$Bm)7u9~y@aC~T?vENqvk*P85|Ey4D7G})ohi{Y+h@W+p* zBeYgc+o@kp&dw{Ma?Q`WwJc3*a}9&b3(Z+X6iJ!{b%pkA_M+RynQ>gRl!*_qfa#6I z^{Dcy{wPdgZS{h?uMDh^u6P#o-8xo}uN?oeJZp+A3%3;dau$Idw;2#NTq`g4Kwu`9 zko5BPYiAxqYW>87x-#<@$c7(jLw*Anb&OmW<{7c9(Q-rcBydG3ED!j<(Al>{mm4|t z1pv^Eu)n0O$i@2Y6}{&VXv2GtD^XiDunJk+!^Cy;oHcAnU_V?s&LJ$6qDlx4G@8W! zx@>M!aolmgP*8Mma~7amkycZfJpy08fiMjN#geVmT?W%|D|DscXWMs|1ypbsH>yK3 z{5eNsYjf|qI=-e1Qg2FuMVF4T6LIh%W62K;kFZruWmxQD2J)b}!3L^fBEuKeU6BSR`k39W8v5`{0f*PFe>9GI=y zy~E{yXq@CMf+y_C4vB;tz>Q$nH5~$djx8rl1o;FPo~S>OwAhr2yKFBn%E0xeXt8P{ zB_yo1^?UFp*s&^1_5)5pje?An;&{V!^s0u)ZwNQ%3@0C-%c4h-{c9CmawmK7$`S2b zPo**KOb564<2_;tdDw|4io(QlT3JIwwT5-ls?M%W7VAzhhM)8fNIyzUUf_&FWIlx; zn>sRNY*q@uholA99}&)qxVNIA_Q8S2&(!MH!|MjB#{(x5tJ$kUFu!{Vqygh3^c0d` zmOcq-%vkq{bNJO0*C$E~1`jK;#q-;UeEh&A8c=n}Yh%u!*fj1d2rh*9*J15YJPiQ&9yNbg9OV5FYQ)J&k^B+s^GrcItY0+Vn&j~)p!#6sRd zqzMs#q~fgb>AYVDj`hUzwSeRd;MlM3yEykcr#Wgi^h~kt@AiA$ZN(_CUW{b4dStAU zW{{U!0IXe|ATm=`dhu?R@GiE8ydJMbK-#C*eQt@i@X+wb=w*Sdtg~DABAP;mE$i5$ zw1w!VuY80a^~sF(E3{6?Xwbtjl>k`+9HSgd2-ni$1!Updn+$Hx&cJ46g|xka#EM*T zj9ua@cRU)Oj{+NOU`P_no4b1GZ|GqYr1e?K4?z6q`rs3<#aHHe)DomPL+BeOGDicU zwPxAeRwj8KO{VbpSK)2>u>CRKdK@KgK0P`+>lL#j$~T*wGcKVg9ujgIO6cgCE2J

8PYFQVvj-I;DSUdl3!HC$b-XRZJZ#NCCs5|_HI_vFLB;bx?BCH7i1sD zEW_z_sdR8k`BjZ}1xH`0T|U3ng`uf|b5*(rBpg)-w@PlTPI3EhHgn#zM+=eHyuOh> z<)SuDESm4yW1Aqm)`b>x*r0s02+_#meMYxfNN3L;&_?WqYSJ4dOsG#nH^|8*nbUWk zxibX%zV^X)`r<-fRG9e8nLhI_U1&J2aFf&My)B+*XB{J1hT>a}6W4hGXRhqTtQD>& zxx-FHdKtO((t*&52GCZF4N7tb8^3w6{_5A(HA`MN{qE56sOMZ)+D_e8yJJ%1LWT}B}f2EL;42)neU5$3G42=^BrFig=`cX9pT*m2p3g zKf8=(%+0IL#;HOp#E#u`9olEFm!e-HJ>W&&+!N2oIaMrR@SBT0W^75VAhmo7RqH_( z#_b;J!4o~SQzCQUN&x)fcbl1McW6B=mQC|VRn>^iWNz}771Zw|wC9QQzh_Zo!%U;P zB;rY7zSG~|2rUq2Ac(L8!NO9$;{`Yo$ie9gM;{7*dG+=k5Ph3gMFTk!OvI{iYt3_C zF4c06zrv1GlBtM{d~$7d^EyR&L@zJj-gtv6qp@MRUJZ(J=+U0sw&QZRbh9%lcvhct zeVA*Unbtixn|9n$$x&x?e;vW1J!o4wr+-4yT7C`L*BAa=$^Bv8z|5wYex0T1yN4bo zg}rs!kYWgpcw&FXs&cN0(bXWVF48g6JvSxs(%h=O>Ymo=XtJ_m2MLX#eai5*;BFW{ zSh3yk4^E~@YwHf~XTfq=h=I|c<(SFLdsnEBds`Yji6uYpqMinqHL9QyvwatO$Ucr} zi$snc`vnF2JOl~?tPvf);jHrUVe_kHvUqr-#$6qKPMHa(>(i-k2CL*wcK1+!Uo?~P zE212^JuX%lXfDr5!Wnx-c7?G93+;`)1BgflmkCFSUYQ3}!cT0SZohwh;p53)J@^TC zcE@VxX(ZfZr(N8%-=F8RP4joBX#LAd)8Pstaq5Mz#-gNk^_oEF%KIcHdo5LZGI`HO zr;zuXQT;f*HrjBnD*?67Q=C`Pz^=HSnK7P)68OFSS4q;&ilj%nwEpFRLu<2UkX(!j zHHdC|N=t6R{?M&$$bE$>f9qG+PMpzm%-eQlX|_-IGFMwvTEADVTEOp2eg8~_*sX8*zK3jeRVdcE4^%hd#e`7g8m;%@U$aB zU19nFr@AIZ2$V;$w`ZA~j5F*}vS7E=RIjSKcaQHxxVdbkbZ{ToEG;j-*%ej+@NN2P zFl*#h@yF$^eUjJqh(;SI(9UrX{(~_|){4;=W_xl2+f2zTG6rpKR-mSdxsB~?xtElC0iL3g zjDl$hQ?i2OF+QCXGjE>c@H3r^u5Ot*aSj%y;Z(@4t)qdI4F4~YTb`SviDI@wVoGRz z!KKp?dymc(q95WI%m<`p>Z;1L*xfirNqIxxzA`T+*alA2qK1C`)7}sevN_?~uPSg$ z4RmcROT@Q9&wsu8#dA}vijzPIX8_34Io{Iu@_BIRu()hxTIFc-Ok$(X%FQ1Is0N0k zL?mpv9`iJs?a$8+X&Kc5UAY-4dh3S{DN18lNa7M_j9^!1Ia}urT1O>DQ{RFTZ=Gg} z=Ho@I1-*58O6HjflrYCTH|0Cl=Wf1posZJ1L zB8FZiTasLYem+1=pXHoMP%d{@Gbn}=5zChMs zoWxO5-BDWIPmIh<6f{QG0JavNw2@#S`R}B{Wv%T~oRr_q0m)hk5i_PB_&6W6UCYWq z;vJig&8ruGu`2v&w^{=oqfilU9tIW?eelKf2 zbaJ+`M(<@j+N}f0r}7Pdts-}6fP7wj~0HSWB86A zh#Pd{@}S*DBUF)QpQ?On1uYIm$^eC(ob&h{%DyujWH7XM*#Isl z@VoMIw$E?3u54Wks@ZLwT+XkVf>0$$g(rAP8%I~xKWqLpV{&un&PfJ#QI!e>6%nC_ ztjx@A+BcA-bwtLn#YjQsh%u4Xz}+MJ8iB2g~chzM16Ttte-QjL2OfG)DjC5y0y^73ggV3nx9Wg>jIr z*q)8!ZMDgkRQ8TTJ~<^7Ca_KeA_xIP#6nd)KK&A^qNc`zcVrl;Scp)NzrL}>^_#oD z!JvhH7*fj-h|E^A^VO@%x|qcUbVK(>haFyrv5puSu^n+MB5Rs#q5JhZXrX(kKMFF8 ztE2f`4Z~e`tWj5~?hIdJpD$*=>`Ugz;-AlL(A|3*+R4hM?7Xr8?a60FY(uvI*#i#W zIbP!XrNrx@{i{V8FPF}+0QQ8wWq>00Zkpmvpw*y#{r+k(_vN1q3J3o{WEDU0cjPR) zjlco5SK%9ZzerbTSEsj1IYCxUt_#@O5Fos!q52{670BNpxkz>74MvO?T$bOij|a35 z<|`MOkc|IDT|DQRSMiXb+xNWz`&PmBO_C*vIl)HBej{J+frSg6mbOGzfHn7=6~RP2tfbg3<5sYty!!sp z*Hl639R(F@RGud=ICpZH@6qVmu`)W~*+pzdgw%#k7wYabsc`Nl_KY1N&@pP1yYT0r zcwDPvX4e77C!W(=CC^N82UT0}$|=a~bKVsxV^*IKh*=QydvWT~raZH5dcX8p&yc|| zM3aJFzcggWv!oH@g&3mI3r6f^^~|)C*GpQ>U>B)=ArlHf)^r6Fsm&V$}MQ0lKnIwo95Gx@6)91*rBUD zYcW3$kXDYR#dTV=x*4C{0Zmw0KiSGSXUa9Q(5_LQscM0qPvqOO_dvYlA53<*g|u?U z4m>k30-lJEUjVP_^6O4q-iXr_(&C$}o2cycs&U{s2FbtkiMj4bpE(}os&z7dZF5@h z4x8V3uvS^vrwh&mr2bF=py7uu>R#vy*@R~|09Tx=4I!mkbcB}k*RvYS8ivIr>kf6! z68gvQYxxI>=g`<>>*hW#0onW(GX+&HqZWEl7dFQzZVL<$7W$RJKU)^z7?+XOpipVT zvsz6W`|G5-+Wo-Ez?iim>O9i*(b6(#m#~YCwTPaUt5QmFHhLQ*DXcw(`%Kcn0=Fu%Uqu%{lzvi=COz7LDg*n z8s>zd&U{i4=l=CW2D-oPv3YkDfTV}!mzTY^>7>RcV(H`i=626jNOKN;z8^aHkH}Sa zfnTX){*$g1WW&U@LqdjTv9LEFZgC30{Sjbu8d)KAqB%|YTwF2sH6h8>e@v`6%pl{P zY=rsKPHoSp-*|8CVu;n}oWJU?X0SX)KO#$!C#?w4IWnoWluS>56-Re4{hvU_-xEK~ zwp0~uQgj8H0z_HmWuG98keP`v_r*IJe-qcGq+GFc#ROrq#!61QJufT=1^vBYC#e(l zsmpg?KwaMTQM|2C4L>L2*beFM@fry%MNZ)Je@KwwKPW?gxd^>ZHupU~-QyjD5NYp# zx=W&adjfb9R<${9@MDpFqw~s_Q)NEz5mRJ+e3L~o+&31=&poE5ZQw3?(z=;V?`tI6 zWL2RG1hS|r>aFe_Np~b!oJMz>()@m%B9BQ)%!(lC93+09StM47C*_ihPPfLqn~veE+qW}ShqW7B9#{5>H|{ZygXB$szExWp0k=%^%Tw zL$M1(r!CYRRqnNGNB3v1`m732_`M)t0dem`GWJ|BNnvJdUWoCUFt8c?aM!T)JerwX5n1f^K)^tM zi{9Dz-wOF#kULR#ky&NZp+m?T;i3IvG~QYYPYo@K$*qSjVClh5fxde=(Az!6MVxhp z<(oC4Ei9GpMighdLWaQdNP0IrxW37iGQ!xV%`_(rq&_SbJxbf%c#>P!a!DZ?SRmi# zW+$m0GN$Kf(pT`XuW3h-`5#a>??0ffPNn@^<~boCyUw^^EGxDkp)pPN+J42eHS`R@ zzkOv!CP+*XFjlpy4cqo4!-iIIz&a-;!eor-N0Jlq3(*WyWihVoMqn9Ml2D z0@bz`nM?w6o3c4{`drNPF=;hlo@dMHF9Qx(gjCk@Y2x#9Vu;9yCcPcHf^s9-WHXb6 zoM&%5{vymbk3mpVLI9!$8;v3&AYX5(WUH^I>ZHgG)$Fy|0lBv|xp$*i@&6Tn<#tyj z)TrJwppB|T@T)tU+U<*=)y8`RgnRQK*vVObppOir1!VLMc)!@h-<3JmURr=}Hk!;c z*X$!!oWM{+2pB%kT)O?$`zo4~EpfZ1CM>6LbWBClx8q8#hWjXWFT7A!mj@1hOMZKeKP$TR8;!}$i%G0&34!^npa z;hM1hSK3xc0r(g9|6=0u?MlZ=DIrBDU?M5AerO|iYq@F3ni&qMEL!RHNFj{tBErLk z(auPrGbsR}duN?yGTyOz?5EVlOg2_&Fd<2l|8P6iDv8>w&=$KwIViNJH49dcx zq%$&iU641cnXsu##ng0`V>Tca4bGw&iqN%J| z;d`wI5H-%icmLTxer3^B=9r1}|RTAXY|xU$`%qOVBv!vL}4-3RBcz-zXo z=o|@diNJtyaPQu}b5$yO465|?D-V(&Wpv!054$J``Ii<_NB)1oTj5c>o}TgIH0S)f zDbA9Rt0w)G(O08#MeoDLX2VRKWW*1TIx-f8!b{bc9KC*DJ3ZIo+xI=AWuYhb)1J?h zTnlsLLNwDd4rBxI5V@xG7$v2VwlQ``S=TU70x*k~r=Y^Vu!5Eh%xW-hnxUtSvHZj& z&bpmj^J{R<*wz;hezXQ{0B%tK!qSkL9_(k2GOkVg(XuWCL{1^gXsXr_ekzW~xC)u3t#j$h-yyolEjbVVnBXIDLRPexp$D+tT4cERcV|$ev zhxguM-;NH`<5{e~65J+h23LK7H!EmhA%qAHw4@~ZKW@VsCkA9+Wb-iQ=FJZ39{ik( zeJqb8xTN9Kr!Ne7&te%rsG@Io#PVFvg++uLT)cZseqOJxwYZt9nlsOcr|-oLyLHJ3 z_lVfaABl}m7pG0Kq{U@)JTxFyGqo*sQV)~-IqQS3#?!tSW>(8C5`}l zQG4(ijdM(F#AeKR$PfXa8Z_4wImN~J6dgyZL+p4#AfsC)J&M-|0sTn!!Un#8+3!R` zX0pvI>W22(^icAw42Cty@gFpc^Qe3kxQOE=n3&Xp+BKPZ%m(bYWs(cxAi%d+!s$V| z-UnuTetZog90v1?+O_8JZ+8`W`}XBb45Q6!+pnu3lHct3@0K+u>cT0tCwS0ZETzhT zl&h5!BF?>&eLHfD>qR#{P!vd_^8b;Ay++mck?VQ#pO{;D7=IhH(QSTWU;G8p?f(oB z9l$dm>EH`%(LDGMS!%jdz!`ZDw7VKf_8Bwg4XPZ`*-MNredXCP=izc;7AtTuY5>48 zRKj>SgZNb$Wn=fyH05&RfPnG#QAe9jr!kBt=|9NoUk4eju)kKBO-u1ZN~x=q&e_g# zc;L*tU;;cbkTk6 z7U#J)7Zcl~v>L!9VGQ>ZSfvBU$JB-3M7JGd_uP5uKFUkFl&n_GiApllI&~aKLoWp| zv6y-30jl}>g!zNtQC|i$zWW!3yl^j1$J?8iDA3Wqu{1LssJ+LCx1+ z*VcU3;EDzPZXvO~n{fUkN-I!~lQXf>mp|2BVD@Ks#1pmT^lklS>GWrg?=$Qgm6i4LrVqJ%CL zG=5DM8{(mnnO*|@S78l}%RZ{p(=@1rrWS8w1pkKd*RKQ?-?0icCB*9GI}k2p)as?< zldbLxUPkrM$5>G+%}U-c)6&HS0%YIBbYu8SgXRQ09)6eR)EawIG}UY=r>!CYVWbKM zza`YbA-E#L#G%JB`F1sr;z@Qvulr$6sIKX&8L%Z2`Y2TLf<8QkY@Y{s!goL`1Of36^O0Ffu{OFo2V)Q52qJ1J>p zQJP{@UY`m-ia?Dzm>yQe7!B|N7Yu**#Nq)8n;zRqg5HePDP#C=*3fp6);u*a71lX> zT|-swdQ0GgHsT~Lo@GpuB&lKxz?{EQ-40ZQN*}UVLfnydQscbGE&WcMEd#O1`=@fR zesbT%B0x3!eKJm5U4B0+87#!du(kfzgr=e0Q{%7WT^&ASueBech`QFx7R<+Lm>H|_ zS}^05R(vcns~unLP4Fha`gdRPVxi~nB+cL}uKEkQF0TXD|MPvSWs3>K2%7Y@C486j zVDIX|c#<2@8A)@lOMSb#6*%t4{JUG>gFQEW@oFALHk}C}Wqc22OT;m9hb*G5UEGMm zjJ5QSF#0gEN^1E+-fPgRxOVs}g%%!ACrMe;y*Adf`Rf8>aoy4=G8$PatR*lP5%xbq z>Eig*3Wl&ah~NnL?;{>!cVhbKe|o=!X&1}zrj6&9NaEQZYmlubwpRTmgp`C5jZh&x zl3;-Zl;&ExvUcbd=inu4#U!Tw3t4oDUOq}wbTgadIgQ5BvMSRsgr7SAv-ed}1LO_M z8$W~>c8B~?J7;ikKLS|lZY?n>V}mcgf{-M6!!H#Z!b6OxU0~Aqu2MV6cBUyCR zjy362)Gpy%uY|YPO_pN*~z-D$ier33U8&Sd=rF9OsK! z>>-u07;E>iUER}P|MKnU!7!}iVS3#djf`js(f>+=VWb>oLRo&8vpReBPVJH3BpU5uw?x6 zJqhC6&ZGsiIPR^8%RrR>HIXIz`s-iK44J^L692!>S4c!-C%S45Hkf}8*&~XAupjta z{(qG$GXNL=>t0c@yWmF=zJPzPAL-3MVG%fB>!ShWwh7nFg`2R(0j@$b8Y^)&sD{o& zOdASM`6j)jb)S5e2(1P)RpO%B>x=WKeRzLQOd&vz6Wp#6{<&h93krW~x?I{c+0X-Le9vJPj)XvAM@mm-8i0>H(~LfyxUBr z?g*=bs2Hj4;IoPFcmKJ%-?Hp@$m|3h8{a^^%&3kDb{^KwI_?s@ADJ#vbvD#;O_0}% zR@xl9+9j2wi!_Z`;qeBY8j9rf@^#DM-^CT0%`_Er=mIR6<~v*uWS~+E+o1^4W^;Mj z=R727Uy#DAt$S!}{Qb(md$KE{=Sk<#Xd!Be#0Yz0v@j64*{reWwZc|bRRS&Su}zh>;#n8PF;uJr6zMZYnqjXofHB1 zYCoKKv?+194j><$T^hveqLFhs56DlnyQY=Avk^=GxRIz6o60X^^f=?ENR5ZTz1TQMq54lsOeyP710+Dl*431ADA+riCA%KQq=6|CtBsdr&#X z6-qW7gPzBz+vM_8)FQH4UcQ4~Msnq(UHi5d2hr&9SkJym+iSrmgwb%gParESXTsbx z=XZ-}Fy~?hdAmDr|928o;%p$~mmf#eL*z4~DK*_lzy5c_+ruIXTto*`LHwcdnJsG_ z!!lI7n;r~OiyP@uJl~J@sXF^4COx>6M(MSlEkI~488Uy$5U!-rKzKX^;Au!6jHW1C zqwfw54f#Zogl8vIh1mP03+_?}xzsLwbip{POE?nJR<}29l@A|SQ`=R|Y0YoJCgfQd zo{y*QVK>|FvL zpk!#(xq8K@6d>qPqLG5byp1bk;w7lzc>3kDv0Q0xaqW-F)KUWM?6$i7{&qhr{Edsn z2*NCCTE=dd&EOApX5mlMzczZm-^^FyI&%>qM(f+id9xvF;U?#3i~SoE?2+#tmw{=( zV}|Nmemer;>cGe7*gmsiJwaD5v!fj;ixfRPT*$qBp{B<&0@yJAe_J}24IVh%GNh&jW_0bC>Sbun zF3?`w`u)-rI%UJD*j@H0NG0LTEao$od_cGnIN!1ocnWOA(T(T`D~Ph>3v?{GwGJ@9 zL5pEpCw!taHN3V_&``&b@RR6X9@g`i+BJVyZZ04+LFE)G=+@h&G`yQ>RO9?us*L;! zF?;SoZMTEZs;6E{?6u=4-0{q9gL&F(*Aaf`2r5BWUspSZM}Za}uW-t+bpHA_2pMz& z*7L(55|dyMhe{5dLl)jMZMq)v^yqV*^z2+*`*a{yz0=1}=Lcd?Nvi@=I?1=iF)A8S zHE~e3*IiRGyHOfw3!(rrNJ=7iB#GI zf^P+$4s>w;RiUV# z`1i>FAiWfohdAlUb-0$`EpDzOF>YMY52Tu!BAq7!`ate zjY){hupXOBBe-r`Gw=6yA{EE(wEts9gowpPCwEdJSC!2@^IFAwHGS5NtGWz%tAR3Btx#N2F{yUS!dB{GAfAVW*qLT!~5I{%BXayV!$Wwo8iAJiSl8zbFcFRZ%&J4a62|u7teZ{pR+Ih|AW>Z=;`A z>W?kB+Shz9wuh^_v}4g=%z;-di-j|9r2RgWgcuPMem{;#jj3~CAGKZ)b0?oK090RC z=x8c&^OY$W&2WB}r@i;n+fP&7FNA>f-wBnTFamh|Px*f!Km8wp0A%D-)E+fC8XYIgj%QWN z_D>8D6Ys0Vvi@mshrl=Gc($Z&v=;g^ao&i5I}@W$7b?VT^y|=jX?&JZOx)hnF-6%~ zx&$T41|51l%qL)s@|CLO;5Lnfyz<=JCh;oH&ycJLyqFE8B$;dpD2sk}l^!GFBhPty#I~aHct)<2%P<`G!Z~77W0*Tn{?YEc^`er%~ z)8f2m6aV&yro|U#TKz6c5$MH5EI!2pM^uPP@$ieC!39W^(hbhLOn|k0_M7>WtbdcB zT<1sn$Sivzvu~!4D|}GvNG|~~9LxJ>cDX9pr|HW>ls!tOB#usSe`g*5tt&|{Q>R_hUlg z@fv=nP3QqcoTB#Ov&t&y)14Ub!^)X;G!EVd)3&n9;@ZHV&GX6!Cy&kV^-CWUG-KYe zytmT|9BC~dt!x_2DpsSV;pY$E;Osb!lBF-4vC49)s?WGoETv33%3CIW8U~6X8J}#F z$Sdg3ghC%#pvJeCkyIymt7s}FSB~jfiRnNy{uS2=`zBt9Uti zxN=w2f;rY>^V#1ULZ=M|QA!o2TRon|e#B^X_&lvmGA9J0NitQwI@-}AhKxFZlTdkpvnu_OOFXu-;Q&h1_P53(vpTjmqLt(!q91l2 zsCayaU!U1vnB8ivrDWLTev&yJm2OIOqb#bCohflim0Dtb{-|R-p7-#X-pYyrTEF-? znD)^#K0=!*>*Gu(tz`C}=K206+0fXX2L3Wo=>bq%D5);*a0TS)1)#zUb<>bE;WqZ# zF*%Akws+k7X`ijCp-OT_*+fQbI|8(@T$O@K zd)-?^#F%f~jf_i%1sb;31XhsqQ@mEG`9SSMM9!c6f$U%evqNa6wk>yLLONcF-inAx z{QSLrWd7DjSg*UTZ)|V=a!XZ-w=n^3=nSHjW&W;d*LEqnkqJ`zY|}7 z7wB}YIj_5IPSxr?ac^+G9>LOcxokWizN!ZIX>&`b2+>hrQR42%+j1>A*Sc-oj^W%; z+m-rRSQSBBjNk4DcfHgL)y?q~9#wJfRh=z#CnfvpZ|r$w%6esG=LNA0Z=(YW>QMji zU)rSZ39zDw-u<}Cc?GENgZ&s&}3)|K}zCd8;cy{EV!wQGx)+p2IvvWvky)an{Yr zPZ-8r5M#byAelYgqhc!Q&+1Z7u_>%b;F9DGcMYRO5Jmtda`ETtr| zma#!{vNiEK8`09+%EGo`GXU8+`AF2PSqF=z=n$&Aa~YlXyDoZaof|phE`cQJ(HhBP zU+QlbMn&pfjaYSFR=T7<`d^4W=IQH^y{RJIl$9I53X!c_TegR|EGfb5S#2K{CYnWh z2e^g%(&$O`IAoYz&;&$Bd|B=1rw&+TKdW#XVuy5Gcp-0G=q`pPt`7mMcA2koWYmXO z@d!xQbq%b(_emf|^99D@TNwJ(+9-4_JW=oG-|>pu=LzZ1zH)a?_oWtEf{u%_f799H zx8oNTB?6Cyx>8ai;LNXWx&r;xn@$>v>}PzbU*7^}mlIx%}cXctASTFe7;!@$00xYC-YM zoFc;TBV_z|VScZEmk#4jB+!R z5ZfHs)woGti7n_;GE1Yp5(g?4gio$I79dYpMK757K$tYLqhny*Xj#k8$7$zmQr6z{ zps3K5#wr#$U}DPyvz-uxg+rpbp&NK?VVZc(Q^u}t))3{!5?`X-&w)h-q@{HA1*_>* z4OqBk zWKW!$1wOeH9dBVQ6C-^!bT?i4=TO-AAT-=ZDGRp0;*ovWV|R6+oukjA0_W0@4>u7^ z^ZX6d2B!mkB+BIH&19m-Blk1+&*t0ht9cNfW2V7k&z&4Y^XywZOcM2?RTlBwQB2T$ z%W*?q6qnr(#_RMLGXCx7kzSzkj-#0$jlr&yG9|yuXEP7}5iD1Ahbhuoay^#TJ|S(; z6BG&^@6s|EIp0gpHqs&Ds9fU#{m;q7P2y}H1sJ7q6j5-^D!n&Yx$EL30_hK8qb!z9 z-ORzpT~=*LtY?;uY4)Ld9HZtObBs@V|N36-;DNx)*+~4{=%3t2UUoa`xLtGQTy15~wv zu#i9;nahE=&!~yy6DL@I@qD(^Tyk9Rp_z1)UgzxhrVSpJH}oDo+n4%#Z$`l#($wZt z6*J~K`WlEPC2v4lOq=}qVb0iHj4|chPtM$r0!mr!J5^UOhu6r?X`4eYJHd&*e{7cowqu(Q;A7xcB5m(KF9ik$^6Pb0&HD|oNPll%fT2C%aol-Sw=xt zq{y4m=GjPzZE{y`;BZRXg3;S9>+_Im_gkgU{1pB0IATh;@5{Zy&SFPAiH^=udMabq zJ?2i}+y#_2a!m*6B0UMGYo-!54;K9Cp}&+WzeIkY8dHn+LmKhK<4%L>lI4<@qJ9;p zyj8Je!LVY-fseIv)Iz+Z+OOz6Hu_c`B9AFx5p}xGQ8dn! zrbPbfO0oaZ)y<0Vr}IKFv%u3xHlkO?mcrdphW6p*Vk}o(?y|lI7x^%1Vc&3{!rKbT zd`~{*_ZB1L>Rt&nL2Pp23iRM5J#5)%Ipd$emTr@l&R32tAUo~Btf>r9Xt`xJdi*L;LH%@PhjD+(#s;t4v%w!% zoaIz0ccMIh4_6KqWD%}=`N!}sjCIRA%3V_csKl1J@dBrvF$v`5CAGBaU<4@>{{U~n znw}#+u@&_AVflTPe=l25%Gw$zyODnzUJ*Y{PEx+obwAA>&|}26GV8?T4C?0<0=zp0 zyZ-*{O{3sOqsPm>Fxfa@qrOoiCVjhH5Po~<#zG#ceU6_j=uh{yVu~g7t9ZtP-7TiZ zl&>u5`5y!c%Db;;*QD>szAP<-YzrZEZE?Y%lhUOX`(xrEnJ+Li{W5wfapkb7`kgR4 z1+#~)9%aOA@UH(vNf{Doz4Ytl&$%;uGtIB2RQAqqxU`-gT61-1vHCc~mF5?3l#}-N zx_zh6@LtDN__+d!nNxla1nLBK5$+-}tN8EB?l~;@MZc5801=vIN~Q+X_pMh6P{IcaQYSXWsSn zn_=5&&Ca0k(QA7?u-ThnNAte~jd52T4mxh>Or$*4(`XrRp#~#|#3Slnl#KTbuO= z^^|F3w53?qk;3^!iKIU&nFgj+@{Nec<-ZXiRYDYv@y$OdQuLjlY;bW8T@4K<56m5SOBO&F78$>3h>S*saVJqtnK9^y>PBadc6+58OZL1{Yi?U}?4BtzIJ@us8k?wm35Y`mkHbeMG;sriQyE@J%g{3c!JiAx->D!~AlPl0X3ow-vPimB9uBOa z=t|@|?xgAWRp@xVzZr}3f`!Bd`SlraJXkU{r=dsfI1J;KR=By#ECdqgo>BuyHqBoo zRiOL$?K#&vc-bdqKvR8%G*x$%_0NS@n>+xXM(q`#k&>lh@g}m%SZ8&|u6{}Jw#%h1 zoiDFV5&#bxd%~2K56FDy8y4Bfs>Uy%W$o6KVplI_cPvK8zJ!4pD9YJ&o#arG+LaSm zv;DzdTA{D1s{N({GokACiOhd;0V%M&O4B@d3F5i>esS>?i$XyhQYUgvX9DK1Df`-) za*M_>+n}8CTtQyB}(~+c!2k=>Zv`KXW)3mpfF)25S!reGA7Qx2%iWpyEpKbC~Vl zv+v#ikypEp{@cE+k5->e24hGN0*rlI-5j@gmAyWOgZ0KanhLl zA$yq>I#`R2&@=sTxFo~Y8FT)<9)9VqrRb5kt`ZiKh9ZBG+nRNo99b2iokFypXFPA8{ouZEI_|*wj!M@zfH->oz`#W zG;=X<^KaWv6p@Hk)y?yLyL{l#;cDHDFdXf{B~E3^+(2Cq77>f^7@b#R8wmPkzLc)ECOD!zm}%P2e7PT z>wRjQe#O3yPAe_(3ZU6k2a@p9upHNQ4Ud-QEWE1Luvjn~$`dg+L3ziXh5EMB+W>BL z=Na16P8+nzxjKx*e4r#I4eG%Eu8;HQjF%Tz5&DI3lbpp?rYWY zyCu>XBX;H|^CyLygU0`Wr;L}r)N@lO<}UV9KcD))|7+LQP1`qlkU)b!$Z?bA38U;@EX+pf#VDnYz$J<&FpyXVRJVFO2S>Pu&u)PE1IomoDUH+)F%=&k_hSaf{mkY(o)k=djR)&JXNJgS;d#~wVbla01 zwn2_bm?<%uj9B;JY1G(b!Ro}G;I(MW>Oa#%(Y+&3@(QF2u5>`Koo{+4M62~T zW(w*bo?#EuzeC=H3RCya$5X8~f^bDoOEIv&5~*g;G;WK(S0243sBrzmy&=64QFr$@ zFV2RQ3c5K*;Ua6>j1o0TcZcBwJfBZ#_e5hj4uhw$a z^*=Z%a4?;Jp&y3j$JD&Iv@VOy7|^^ZsYNue836DKJD`u9STB>nH#!vFZ< z`X9O>J?DscwqcPxDKnvJ+&g;upU5Zk*IaEJ9N=C;c8Ued=D?=K0Y}mmlu{&92L&=Y zY247@yg>Ay$KYjx$4;ie5HcERi^8*aX*z$pzxIYx@Iy{E#J*wF+5{L>@_?i^{BzgO zB46I}@bHskQDhdVF&?`MkWh3Jd|Nmg%LgQeenIL1{ z5;QsLSLO(px+Y|q_pfz6Gx0OE$foW#)IzOPLux}?efg{C_t#hzzrG=(Tlgx2RO3Ti zGpw3FyhI`_|Jt|Eo<12KwZ9)+&Sw`T!M}^(uMx2nQvGxF39*Ur(|;~?(i{*Ir65P% z|1U`9fmf?{6e<0`n9HM@N6+x?`!(#`P(UjHV~OBTwKMF1MY` zO@r+7opql_Ar~ytt|dqqf@O&_Qb?(46B9M+*^M+sZXp$1Osl@DJ_siGRHmQ@JmsFy zp2Eu2+PknN>ppBk#{aCL{qbzbU*D!(Ma0oper2dd)4u$qMO-!o1}M>#{|G+6Kd4|N zu_v&?Zhd&nDR!V}I}8xqY*J#-*oJuZ&%7_dZb~dQz-f8_0xK3LSSAB=7)=F^|KmJTsq%_j#;ki<$}>ZHus(T}n@nU#CM%XEDlSUL_bMM3cF zX+GeC(`D%`_b?^6!hcz9e^2*u_Yw>XdxuX>NX}NLR^8Epk(8PsDIsz8nx@VNE}rIf zSToN2ZVBMM-i9kc?%Q3=9Z8LEE68jxgM z{NNp6S2T)$@imCQNPb31FlR7fzL zJG>R8BP4~*wyS5;m>o;g7F7of*zMOFrQaE&`zpY`!^LIPMpq67o~`i7qrym#zq}%4;}5UH$5Vuvh9n^NIz9HqCuz@AC#P*FJ+{6BwyU3gor;JbM!vMR zsFz;J0i*g4+j4w2yKkeOpl>>OZ*RscuL^n{VtDF*=l=Mfj>~{FJ2fde`ipi&h6d5L zD~5@iGNYA@(u-$|%oaDrn)W{r>ZoabFUum!xsa7Zq%@NqU4kU)Blc}EV@I!(A*+6P)%l~i+-DY#(E2XNa9|E5e{H^}g%2{hzP5ll^w#X(c9HK6^K5wU#I5YNEVf)W8=CFaI{&O;)9P?%NySAs9YW$!M z%L>Tpkb|PMx{1TXvQKhf#q7O}rVrDg_u9cDhSMC;&gG%D!rpWt*|Ip#yced$InY*U zlVXja*(Ew~vXxvn+=8xz|B;g0rZ=?aU{2_4>p%)SIKV$fqE~8AuP;Q$Z)sTln?+e` z6%%#h)@~xO*D9Hn`~7_T=6K1hxB3aKCL?H~U>womT@uB4MUWr&~>ty)%8Pxby1cc(=l2&H>8Y;~x-@ntitjMd$@NnVNJ%c@RkR(&AG6gm< zs|gSPad{~jlflgqq=DUh?5fol&Xn22w330CFnsBYb70?ctrv%E+il*Ra?K9laEoZ9TJ- zk$D_^?ly^NJ-_JkFE`vR9|vs~74QyLoa5rI;>3vfT+AlIj#kE=O?;$DzwB4I@ukk) zD$_jyKgeH~zCav8Z<-jaEzDN(l~!)Y6KPn)Q`|SHI@-B`-qvw(jTnftf}AOYW6Npm zDl?#FmE3pf@I-{s>#+T9l?`V{@a*wWP6u(h_5fheY^~dw^+0yG>x9{@z1w<4= zKoo5*28tRgNm0bSB6Z%|tTCY79Bk$>1@(oo=|2|O(VvWFg(8I=yJyhV9)2sFbeu)9 z$sIuyy3SlEJzQ_Xn`COUAn)+-bWb)XoOe7_cVHEzX_TY-RF0a^>$#4G7WMZKoKtM) zmjOman_M}Kb(1;WW+KqJe>o1{H!QF_<;5ndybj8BPdbJhXOg`7OWA?@`8qa&x(qBL z>dAwy(+UBc+CTp+9XK}zC(bYNKbOB{D}P#Z2HAEp0kqxR`kK9LyG%ti-u9Ns8w{t+ z09Wd~YN2^E7Pn)va$94N0n1e@6z3VF@IsV71!&_tQwi zEum%(YM0p`Z}%hSG9T+Fm0mx)n$|V&Jd1v7j-adXHKz1gF4J!t3{Zw;`uJSh#xz`o zD?E;notW}|^K_h{)!lhog1G)H`VgVCLjNwA7m_jykNRp9Ywu|Y{>ZR!Z6NG0S%zUQ zblX36NO9>$(fenl<+0Hm>;aF|w7((yXFmmtiXh%;^*wbc1KV7LMhaG1^TVeiI@;@t zwr9!i#x|W>mc{9Ds{)Mcj|Mep<%Dn6rgK5|Z-4O|)={pW^%70=sslPMd%;wxVea>y zH{l}8Nds*26LH8y?4Pd|$IYquUp928pX=K5;9Uhg}BJ= z3Z9ug;yutV!VI(?Ta?Dr79JN*if7169GAiaZ+E=JYL;0>wJ5w4;+FQHq?@wRu$Su` zJQ&>rzAz?w+MjJf5p)Kr#c@>gykXY-g6R)W3Nszl~yzV1|LWpvq1|(J+9kDz$RWCXqIYG3taSt zo)9hO6&YoM9rK}K`g7btOZN2~UH-%&5<@>35MRMEUFoKsK^@ID{(732>9HI<@1=BZXMkNL{kx_aSaL6UC^pV3K7xNgWrDWbtH8VC4{t=9S8@H%-!L58TeDw~ zho)kMtH{m2Z9iCQDru%&K#D0CX~c)s5==Mf8D=FIy^entA8ap*%^$j?RqZQKSq-q1n6BNtLNQ5T$DoJ?eIinrUP`4 zmdAc6()xH|0>Fy13U12>XqqB*4YrQAL`l$ryN^Upx`!~J+q4|0iopB)-o(?#o`;YY za=IktGR~R@?muMGoMj0X%sCC*tlYtDdQN4?u12$ zcSq;0{$^P44N1JD zZN7z~+WS=n;8;_+{mzB&8HbHpn*8KIl+AVU&!`u=lfEJiN2eu=mZYifJ$aHjxmB+| zJMWKI(E_^~lD3{b@>om)%(>a#Ek7NJrHvR*ClD){F)~^#yngAtN9lmMqVzAX_E#hh z?l(SB#)Da2AY{?OnuaL(h_1ui#s_+^MBx!q=FhWRc0;|o)&>;}g<(I&d|ICsX}j5* zp+^_?^vf@kDS?`qk`C&3C?QQXzNAQFXbYx>9+V}&t zGT)SigxhmI9(Go_wEiak!6HZG4dS`-(T40x+yu z8sFO1WNmZ1QB`UY9xA~e4Li_`y&}a1-_Gu&#lsLb>a4skXY=Rgh~~>lE!)(l@B1~! zPi`jEv=|C-zWsB$uAzqiLOG)C^Fw$)luRuP=>#-Ci!4o=xzu@xm}wZfW#<;2Uj7R1 z+oSHfexE2I!b{{U`~5Ir^6b7FaxOj21Z(w4H-|Fr;mmH3D$3D!q5;8C%x*U z+?++b_*j1&;x?9PITA9OFYcy0_*+S{?d&Swi%P=V7IAos(-`2KFAxh!MPHReMoCAYdg)^)$mGOWw-b}#fEI@s8yZwE5gWT zI2CdK$T>i%ZkX*6)*bB}%>pW!2tXr+KoGnAtypta&Z*x>t_Bk;_?ss~g z5BYPkDr&h|{!Cs|Md?o(cPR`jI1mr&9ZNG#{>$!uRqa{%84tvj9ea=_WL^qsYocMl zP`nMU7Gt^=4Mgs|ItDJ|por)2Q`Po8YI|l4Le`Qsrx)!r3{LpST{G+jXaxhK+Thcj%A)|2y?4+B>~@sT zhtNi(W;0z~U@SSjYzSO;J5iwl2j~y>&1u?ur@#I^Je`P-r94)bxO+lR_s>5q66x!5SVer+nR^re@_3@EUFXJ9^~d`3YsGLZH^ra$*<;MCHE|34X?pWk2oD?fsQhW0<5 zTKmgR@>3^OcsX;XDVy=h+%`@=me0gIUxj_1jNYuTbzwm#1eqHal-ZcR;o8h?qf<_i zK_Z^nBqnd#1~ko9@7M0P-Z(qWSL8ptwnqJy`Sh<0ovw4v^ZUoFc%3}|Y<{KkYd>bg zZ)}n%#L28{-cJ$PFE~^bC-(+q=FC%hz)pXTsJta?y^4oT@hrR0M>B#a7mqw$RO7SD zwbN&Ablu~0(OIzPURquWK;%%~{ZdXj;;Z2l+ixct5mb;^;vv{;6OZ9UT=nvI%&c$b z--h+BI`9=1h!35z>-KBDBS_%0P~^FDj~1uNQIq?S@7b1c-Ub?nFN+SUSd0z^=XyfC zBvknLE*BQlFI_Dg1A{7PQHT}2C5B3SH>p~b!sjbWg~-lro+D=01H_e51d7eO6!pnHU*&7n@|VAag{$1!l&oD~sc=ye&G2pBVPMk&xGMRFEa^C~(~8NH~HldR%#n z;d40s=FaK1)X9!h<*Aw3u8%vK|GL-HvG@JqD9Ar1JYB#yEdncniDrciD(_MoMxvyP%e5YExg!Pn)@&xCqv&6w283xoJoF2YC4aX#t(~E~f!5^oeILha>-#ZE zNt9ND+;GG>sVmA%hi_xXk_nPS9U^#je88wE>_^@SlVvA~?vMJvMw_hKa~+fuRm=gt zOU!1eGrz$Md_!#!l;;Svk?JC(?`Lk5 z(DiW~o>k!*>O|7Pdl)fCrx)*hm#*IufZFe~rx(wjvQb-AHo(-27SMCSvF+iNPa4OG zsLJ=A=*iH_Xf<-G;pgDaOfXFCnn^tm8u+20j&@6i4{?I$ z0~OWL(RNHdIA5RAb~Y$1*?03kAeow3cAx*#0HnOn58yr2CM~hGA}sb9>GpT8TGvb! zVVo#zgHPYEO{wTR=GMaBevt7GDT3(qrhl1DOtV%DQJ4Sz z(*brY4I3D**Fs#bezb_ECUe;omwFxcQOe^q@v^omWOP{BD3g7E@^Jqo373JoJ>NMr z@mhy0g`Ai8&MEyQX~vJT(Ms968;|Lq5AFcm0X|7U9bLSPu6}Ms^i0Qu%q>N*uz- zMGp~AIZ8Gu+_0ld9m@pxU|lge6$sr04nmY_dAPW~7cW2j)-+SF=zzAey3|w=XcHTX z;}ml4>hlT<%l5S#e}9X^do*JgS&(o%Z*!9IolZrPq4b6Da0z=A!h0A9{zHsIQw3@x z=CFDrg7|*c%*+G!@>fwSNfeioP9unbrF}Z54_51$M>ah8<)`WE3hO85#`N6jBEwUH zL#}3XRt?XOfRtqMehMwZw}mwYnPs+zk^u87h=2>dl*!Gkozy~&%#7#k0ayC{mF_xb zXe@qj-Ac~_Z|r0^AAwZkxtRIgN~A8 zMu1lZBf(TWL(ncxshLl+@$RsV)=lS?dR4`cB8nl}S<)+>cHc3rbhVz^k@6RdxB7Kb z?sLwOG2x>l(&5vRfzRa_x=NLZWtRK+-oBfVYmSMZ5p?B-;r1S2_sQc? zml}2CCw;hp^_87B5HKF;+L5@#*zOA-UxoYP5g@$|R(Z!G?gmI2Yo!jT;Yq}~fzSiJ zw!AriMN?t(T?8Pr&UG%35p?L8z^s-#rcZI4L*weglGS6KPOFw1_f;J$?K5hp%=pq)R`B+&0$p!EzkEru5^L>}5E|2wB8m8** zj-w9SNp2-ZkQnB|c%YAPsWxyvffLTLgeNF;Bt3DB{89=?9@ff1!@2c~qdVcO@TwXIX(EQHilJY!iaN%9X4A*~#ZpKLWT1?$&+kXC^PDE@D|^US`V>dlYh~#R z|1+E&s_pENk?WoNR~Y5%PxQ3C6+^|M$`e%U?DP@dG_qwQHgy~I6E0yrC?iPv5t!HM zB_}#cr>BP-iBh}JWU~cdqsCx{ln!?x zd&v4P%703K|9_#RcOu4-*>P?s+WQSk&RBU-QB?Fqf8E9x&nBML5@Hly8q{gj>+CNt zA1@wWRSTUgwx4t?xs28OC;?lR?OP6)mhEhG-RgRE>I^C`oBtRGy!wHQ))d(D85JFU zixV9ogR;%4wX6fX1K-!0awaEJbH(n$1;+*dRwIO;{O4hLqyFt{fV9qVCY=u;9)C6x z!NJHOEXV^8e+RYIfQiaVl;@|`?e+Jbs2$(?)!a=-@*REA*O}gYt00k0$$*Cj zSqv7TkFm*Xw>@U{DkG5v?byOft^2bV^`%K5Pc)QoN^3(F%XeFg$#|?TD4mh1nVj_3 z1|)zDUXKqJI$8td*^g5wndb;?QDb#`uO-Mu@xJoY-%0YXu$nYwLtk`6w@&cfV$8=rE(XO2M~}HB$w)`0)E}flIj^WRHrqo!^luh|aEW*~g&bQs|dhWn3f$9EO1z zd@D~)8He`C2=%~QYBd(p>facSx;X{NTs_Ps6z_esvd%qj31ksF$B8E=cvxbmSd9!J zJpY-Sn;f<@J9V~1O0{kRzDBW~i%TmE({(;9J(%s*0gCt8G00y+V|LC=GDfxPUGCQV zQrTcwb2eO=D^1&#fv?mR#xpt$MDu_^@E>P{dj2IH5Bb76P^7DPGQMJ|cvO7XGF&4fZWSPq7c-wF~%lP9yv1O+doq&AJqalZw<$e>i?WQ&FRe| zqNeR&hS4zxYL=uvA{7_#NgEuj4OgGBB%`aQ;=SxD)_q7fz)idddjK4)5dD+B=fq$3 z>gr(A%QZ3c`w&vGL4aZ1*H5~ee)pVU*PpSH6( z%_fs`kJ*Gq_O!<%U*~@MxG(0D5!A%NO0jRn%u+n4TkS+(vt zq!Y;jiLB)Be}Aazi*s`-4lT1Tzd+;u-d#&=3`wYF zKE~pmCK2eac-yHj_O4!o%>RrJM#x;_c1%B|s;tdald}|xAzVUNz^a$PR9mNbaU7lf z=Tlx3M{V*8&V!%fSyawacWBI*{q;Qfa5wKoj>1hm0)CV2E>qooC~!vqgZfo9jhx=I z7TGXG)HSJKT-G;kJ~mF~p=M+z%~C@^)A|=ScGEcy|DRl})A=}Cm6>h*?8*)vz86?%iZKoeQ9IN#4 zyc-uNI-6a3G}8COgw$oG{YUX5>z`+S&7UKcaZi7t;Z_^LBOKgZ?>AbXF|q8Fnej^! zC&tIhs}nw!{i>Rxi3@U67Qs60J}CRc!#WcIYpwZJ{+$x9>SormiqeRut|M!fFiiQ! zx{DRfC;>)O3{OGusRZxP9=e8)7+EZDbX^JiaD1 zGX{L54~Ib|#=kjRzu;g#oFjoqopy_^?}eu8M3rn-l`&8qPq)qMyvIsC<3QG7I+86T z8nO5KWK~gYJDRPS?b4T`o&zn97>-9A5hqSNSjsKHM7lsJD%Lw#GgzX=@g+}E2)wn{ zKR9#Q&sB$5^M}euN^inM`NU(VuFQg#DS9a4OkCHgzLJB4Q3+%;or68FqfM)KPp z=1}07ubFf{vT+0DN-s)3YNx2-mvPOmks6^i;&AjWP8NIlrB^1*DFKKF>h~wMXEeFHa>C4r&|#iYi!z?&D(BP zm4}O1k0Wy2=UvKEuIgF*m%Tkh04l$zr;X^SH$E2M`706LJA|Q(;PgUL$Tnv!`BZBr zOX}#J>*&!ilu&4qh}HNmSi?Iy8V*zv$eb|QrKm6H&|7*}G}X*(mtVh!?bbL{oYXg7AqPtl2%wfgZwi|+HM-@Qur*_S_!?b( z0h-;V7c8mHSU6k%-Tc@v3&cE4%+WsoLIR!P zW819*7mExHyPtO*%iTTP`nF8xyGMII34nqvL$>a!f{;9J$L@Wz`BiU+C;moyXu5rk z&5vQM?hHO1_x5zUD%lbllaZJA>tbEH=BB0E9Z5>Ag^?#qn)wnA#NQ}?)*SA~R2RIU zkP$aRq%q#t-gk*e_B?HWcUnh%BM+?{Y~$uXBsB4j zo`2~rhGuBwt*Dq?V|_BFVxYM41F~Nypm>#Tp`hOKsK=cp(P%eoPec=6Su``X9z+-O z$G;BrRoE3Xebv2crbppxUubeoUY(J075c{tRl8c{FARK5s>#(|$1P;x`u-n)59gIe zOr#e;Hj_Gbe1N#q%lfhStyeN*ofoX3H}dOOVs2v34e{yA6h(&$7=Da);`i>VrhV5R zGoxQR_afntfuj4OQkD3V6NaXT;M9n?W|V);?f5D^e_$uw;W*`_WX(??srqp}>JQ|z zNY_}SEfPa}YSQhYsE5yIdq7Ml7BhT8`P;vn;Cw#hqFwf3EO62fGY^1Hz))kK=_@xo zy{K{QDWuj86E#)Sk<`l? zK3u6_6463=HCapNBe!OjMK8=OX_+V$G!o+Y;#b?)@)a6O#yh4xFT8wJ>9al<;E3Z0 z5gn!;y;oIxZ@U@C{(+n3M|%QMX5=0E#bR>{x{>4QcEcuT-Lzh=iE1|WN_b|>=Y|q8 z_V$kuTQ3Fo`k^T{W!ll$=ge76f7N;GPi@afCAy9Ar)6xAwiDW+n%>$5r88C3Rxm*(B zD{ttPH~V#y_F^ZrqnKMlDi9&RTOV* zszzF46LLlIo`}`!!s>*0An(Pi{x6t>qPe>l|%)FxAcCL$S4ZPRgY$oQP{Ctlclh?aD+RZ@!169o_Ll_L~H_P1G{y z3np;uce0lOYwPF}^}*N8OLUYXai$X^d~PwvCCg+^T-ZNsb;;hKY=x-Vmp{k(3rr+~Y3*|JYJIO}YT2*65$SV~7s=DL2?0hybQUmvN#O~OY z268EG|86R;=u>q|m+o~os&O^pw$w8ZA|y$2qf`4M0`>mad>~}2BM?`i+snp)?Th4p zaskcht61$9nOl-mBOro01aaN<e?bM=B6sd8xPFEffHSA# zZLG3-T@xM#zTUUd0p7VgC&kP*DCW1Vp+1ubRdwI&xkAV{3T-!J>E4{b!7CO8+Udpk)3R z7XAMrru_f#hTq6EYsIf@UjjHiVkqOuNzb`BdMQubz%r9j{kg60VU8Zd-D2lx;HQyA zM*~R;>yNlyn(t5mTyYV@+5`5=^Jmc7rKc@E-29^MM92HOD{z~! zwL{ZmhfkdOczbU^SND$bN=cQKHy2|pLELJE z)?Qcl&r1Bqe4!e^H7N|kH&}?Ot$7Q-pQJfeKk!*zqRVZ}E2@!NdlhYSaIg*E(7Mbq zl+$xD-qzXcw$Hk&yGf&<@KQw3@64v5WrUMx)Y1JM7)WMxWiOXgZN}VfU(lZPn%MhA zz(qI?0Jl8E`i%-9T{Vx3gQb)c6(G+gmi+0aP(n)Ouai?c&#C)m01r}TdH%&nqRw*G z+Rx<2=|3nVX_oDdAg)w|e?=a{4JNk|T+?6K)8FA{{V98@d8!hH29u_F-V8y@F7=%{ z`EC9Ln7iy_+$TN@BX`L-|H^|Ix(-I>xeEfw-z{CjAIjn4lW_?XKwf}VRGaS`+r8bE5_l&PJOb1gdYY! zk|;J6$|t+hTHS^25>v7q-b8=L52E!c9EY*_` z)p#5HXtzAflGL<3xKE=QwiRIGO?b6k{Pi;8_yxDSNc6{_A50X~O7*097Vkp4;@H(B zlMff08Bz{gwVGR`O*W)VO-F~dJwl<*s$2xbcybii_iZ{nKb{Zn+e;=@+U_5%<>#E7 zOv;)w8zi$@o&fZZj!P2yNtB>VI(BdRc1Lt8M`r7C!be*_zUAB#M^c(qs^{7v7M5Cl1lOq~wm?ku;H0@H87615UM9Bj#{~*QW zca>~L+ja0?pn&DQm}NW*Wm}}=sn6vNW%e81iN#MQ2s_+#ZbK6Xvv?i22F}|lTfkrZ9 znmpZyYa!f1j){9E&@8kn{nvwAy_Jy)PNt%6gRE!PuU~3!X{+~jMij|hnj0NXIOp)= z#S0T&4DZSDE!f%c=|k2qXRff))2U>oL*D6zC}qqf>o>=2g!r4SXDodBAR!y`RkQX` zjl6}U?>u|R|GwvXErgX{gW;pbQMt9TuAfrIr?Mec{r&LUvtF)q%JlVzC96Wga|yQ> zRAHJDu_@Wrj6yBr?&*T*QJi$|OB+`vS8Z2vN(8mdF2vpY7VY1m*n72&arKR7>$P9jVYw?UE~zib_exsFX7W) zruKjC^D$~le5s2LetU(hdQ&c>LY46W0 z;yq<4kBL*qE)6@I1}y#)cNV*>J)ISyZFbA*W6iV0V z-zHeZOu+(bcsM3Wj5SQ*M89Xr{w(S{*7GLrqo<-qAR}YkXxj>rbz`CkRm13{Sxal? zwX*0Fvy;7}(0*2%f_U_kOz3z)4pD`#`B|RlXu4=jw!dDV^#NI0P*rkSBHQA7vwe8! zxUz?anNZDUx1ZaCL)i)G8ruuNvHT5&MDDQh2}r=cZ>2lx$%nkV4^&EAoP$;HaTd9;+dBA&&VwDbY2wV0iw53~F=KyL8L$AbM?|jF*EdIl_n`g2mu~Fw%A%etl1U(NUJ3)d0)oh{jI}+`@SO3 zJ!tcT81>n+VEl;zn3Ab4wwJAfpc6O^9HmV_!<%zenI8wVi z2u7gc`Nk!g@fG-!={L&|YOC+eg5qlVC)6lw{YHi;yX{i;#t*eymuPffKXcE_L1rdJ zIt$7QVEgAr{oHke3|3T`M=caTl#u=qak|}HIaiXvu^k_SQ>xdY?~E4=n@Mm4^Ub%X z8xEry92UTYkGeUn{hZyjo7@Ko{b6_i8GMi%su zp=mNVRj-Gag%4MB>nHt1edizHc~7YK>+5-H_UBxR?6OrvBWpm3P_ea{cGoL)s4mGb6rJwXQ53h9MLPyYCkd7) zE}H`KWnT#Zvfqmq6#qEBEMPM*ny)m_1@gXsjg>F+)DP+55Vedt_bF}-ZeHD`rWSsa z_wAaVbqjoN+olh2%*bSNdB(9KJgo;Ul43YYilpK8SToF&tYPoG{Y^Ca< zSGkZtk&Xr4c&ZR>Z-l7w;8nWWjzPO|AIqy$9UlV=8q`gT6@~-nrD5WXE5Ez2F|@Vq8A%J&F4cb?J7Y`<5BXw)bm_mD!JuBQ zgh3o+W#&={$n5QACgs4uV7qU3dPa*Xm*i!z4=Ib04eR2=B_vOda^T%EVa}i-5soIZ ztYUm}b`((J8+}av?DlZE*G==5#05B;sGeJ@_Yi7jdp-Adp|$QUFN%L^z^Kt9f|1PD z>3sY9#)yGb!2iYETL#6sXzRKp1cD?axI=Jv_XrZ)wUOZ3xH|-QcM0y=(6~DUcN%wh z*VA*&J-4m3_PM+Ex%XWDHT;08=BuvpjQ4#;`BCJR=*g33I>788C%Dku-TY(7w0uL> zFwTCVEpj9zN~lmYTP5Ogtcb0Tx67q5Ipf|m9%&ux)Q_0Cj{OlsRMY${SlnU9qm1@% z8y=X|l#6QvM=r(^!V22V6XI$Pro8?9Sn)y&Q^DR@Q ziE5ebZqbcE&#F5ub&aQJr#%(JGG4$rDaVa~iGbH{UwMqZ{-df4{o+bEz@X*%b2ftU z{_uZ&;)D6`&ZMU~!f*w-qjE?CK7G0L4&#IBT>f=PAsnx=>@W)N=3SC; z^K(r@6EP@VhdY&z!;JftKZ{U;ZX-n=`94tTtzTvqWCZa)s9 zc|&)yY@Zhl2Ln8yS8*0ZyUiLA5B$f>FaWx@Qmnz6NXF%+aBo}tU=4YUN2x;-rb3=*k!L!mbEe5av5 zr~b2gVDC1_@P${Us1_B5iyyJ)eeQR}J+Y51WSN+gk8(tW(y_u^=bcIa)na(`3#b14 z$Wb7^Rp)QMw4ri7mC6>iNLH41wa3S7|JPNZf&ly|_S|oTwfvOZhCC|<$Gkn5hN2>E zGr*zQgJ6nxh_pao!7swB&s+N{`#IInjHY7UuYfq7~(L@5e zgNwOj7EH{h30eL4uB)El9Ssus{*YD+x)u^cX2z$9w8aWeK18TeyUa}8EUvI&!PW&O z;yWs_DWBV^aJkAjtgZc!u-MFnSymtkdQ-dWW}qz|mg!WzQN3 zw%85nzQ-(1$q?}Bpv}6-Y?>zQe`l?Kkz)k^*3Y&9Iqy=a5tzR=Y76=XOWv~RFaITZ z8?4CqTGWBe-UrN)$zQ5c{#&Ai&T&-yx`g*qI>*Cy+RcO7#&)FhFpL^ece+H@Q(3Ki zkIqgZ%kH?1?OHFMg!>CgF6`|L+XJ2O#YEFJP{@|&E2!3S&-FJ0QSrmCY9|hXHnz76rp8J83K^ckYDvLFX__)a;AnUv0hurQe zkgYA7p07xGMB{l5R3gSJu%o1r!Rustt;925Wj~#7ygr1>eS`gg~Ywn@-cES zfXU@NeQ%9zD@LgWn6?7j`uX10;-fBjzvrvX3VHs+v_$Q&o9OyQ-idKH{YS(C8|eQ; zp=au)MEZ6?8{bd?^!vT^pP)}!*gK_Rt+XFZ^Dl;DK)<5?0!O=&YE#@Bc6X>hOLGBg){_*z>-EV za<|oFPe_cFG8U@q9-&fvAOa`8ONphE(TKxN;3LoCg+L|ATKNw|MbrNQXT14QUv-z~ zFT#&+@*=4<>)T&wTy|CA$o$i6?uivsp6SiPGPfHGAI-WfV!4=kIA(u)P6JE%tK2|5Z>3YqKjLh=GGq3WS+THAi^a#g?@26Zjs~DGt;fv z6#p7Viije;)q467$L(%et7lkcaMzwOto`KRol9|m>Rc%HwN9C)RFGG{F{ISO~m{vb28- z0u9)V1_8Z_%x*)I?`o=V{BwiSO`8KpSNB)s7pZ^#P``Q)lxmDK1)62{!{Pj&CKPH1 z9>M=-cjyp2_dj>&At!OUTMc(@gGXN24i8{=?c2@9WE^_44{S3fmGt`Xzr8AsX z1Mf=RjCp11*{tE3czOIl#`NH%Ic8!posj_S>modmGcU&LcDHdAq}z3%=TT0(9(4NIqQa?J!ddcL_) zaX@MQ(aq6L5IvSjeu(9!!$78gV1$tTvL%m@oFQ}Y%f|c=UOJGEj-UHC=?-Kss6Prz z{!^BavECfI>z|AH!qSS6nDKvI%-$+wN zu9*$IgRaT$wL2@#cRO$iyepgjo`K+%?0KJ$Mxse3F}AW_!b#+AestGeb#=L+(X`i-HuL;M}J$zKQi-Ur4J~)>2_vu@;qNB+nG2K*> z?+vMvlgQ(1^1Hu3rm{Hd^TiV3?&}yG>(Lr|P z_dCB)q?FJs-e|!-<}tmah81#^CR}I=0i@u_B7P%HI8i!VDKVMTn<``5C$~^Ilc`{K zfZ`S_nfOrx&x^`symW`q@!&7Zj145OE13nUsGyl9Cu15WDyuKYmkWec5Af@3%18Hh z(|%ZMVD%=gIHk^f71jPGC3XO6$2|5G@1AJ)n(0!v2CaXzIG`KAymrFUD{xZ(ZH!b$T#P>< zFZQd37m=pzq!;$j)xPzWoEhS&iA;O^lfuvt0eLr2DO(CqnX@(1ZAapWsiGpfQ z4exV|rMdYZ*#XW(Dq4z5?$kA~$pMG3qlB-L)-p+mgtGrRu-0R;WEw1D$GZN$XNPaT zlun7d2P_Kg>$#_FG7F&<)+*f+&dnDd^TZAw0PRmnUmF(ZR$frxk=hs2&S`tyXA??G zt%4rwhcHR%?(7PXpAdwWefz(Q*KGjOTichfM5tm3NuN%Xj$O*B!@o_{B-7q|Q9h!5 zi$9@42yS&FtO|_$Gq}<+3JtFCO_Ie(Wfbt2)ziq&^Jfq2A|RtY0GauWM+?e&6_>Y8 z8=fPjrTaJdkZ6m!oFM>W z%s-1F@HTvTI!wuK5$pF4CGuF{L$crV>9h$v*Ow~8K1z1?2<=!D-O~d3X@n1mGp8Ge z(#0n32&60;RypEIsf2nghTfEN_&>lV3^yH&s}uBE)T9tT*#QnBy*xjWQ9V4rcM9QO zstn&pe_+?>oYAa#IB1Ye6pZ@P$RHZq!AM#jPGsED}?{pH{3Gb7_B1bRytLx&C4S(y`jyTvKj}xh6%2+C@$wL+;uu z#NJ}#d;{_4j~6*z6ZgE4*0;!=cYdIYFd}Hex?C!$n%66OVp^AQ!eS5ykN@VS#uS>1 zbcd9moJ)ZYB#<~071ran(6#HG7gF4?h35hp(yUW7rae?`afiUI0@Vj8%z{R{Z}Pu+ zYLqGQM>OU~QI?efVFH{mT zcyWX8+%Jh1#U!;O#94`-+O+Vz(d<*Ew(}6^o$n4)_J=PwTueh0{K~7@9HonS6%U>$ZoIFGfb|~1f4h4WX1zFzj+lA66>Pvof zBA=|}-@>`@MC5q<{1M(_Eh|}Vd6IYRX|Q^!Y_4~Je4T(hwvKE)JqOba`SqmR$o!Cz$3RLtarzv}3n%@;%k+Djxk6jrjG~u{uk7Xtcui zU+M!e#Q&F~3;#`!^%;tgV7!_BACeOQev7|*`DK|s( zwo8ADW1!B$5=OT=&tJ-!JvR7NHArIT1`XIGVx-sFkK5BE!gvR7*gbh+(G0h`uihGp z(Q^4eNFvmSk-DSPNVXY!MEH66eK#U(?)CbgwNqDWm~4 zC(rUF^I$jR-3dR>wTWvI0OXi&OKy!wWVqo%8c z;>i=_*=%Sv^KHJQs;W)%u2TBEI81vRH06(b_7$q=|BTwQWaVDqIlaht8up@(I6fM1 zC%G7*SjNy+d{SzoW2)=9=%!rEwZ#t*yC5`Ppml8+BHO$Pkg!BvJ;Q|*fx$xTH6D97 zUUrlqg_sx6Tw!15>+E?}16fFy;jo*{>sQ{v*|$CxYY88#8Ctt!36*vkZgz}^m}D!9 zZ@k7oOC_~f-mG}Gxy`ZWvCYy)9zLY9s1nl`9((ylWMpy)MG>hN=5FmlXEhDSwz@L; zq*m9xY>0Fwp#>NvStO~(MA^|`a?J_ZEEt-e=Lxly&Lprn#;qa`4zuJ_v6ch2ted*; za?(}LR;5cT5Jy6cECd1975ecS_^+(HV&xV;hr~sBz8U8`S7#ai zur)r;E^eQrZ6YP)4g)rqkWuPoXmC(*IM6NQBi#UFuH7yXt2& z;X?pZo|36kBlpSiddeC$CcwThC!w#qnSLkrw^l)Y_V2>o*+$@<2ILklEw?fVd$V~c zQv6t|NC?P*nZz^h6LWZ4DDAH2U62gcH9)KZ=9cscuT0@yi?jsMGOSx1L)HRgTWy zHdiUvuc2D@xOkJ-uhk||#P}n}N=N$DgZ}tGZig7aLz##?+fUf94U7H?_ryz_lc&ZF z^I5NAw2wOre@WRvXs}=9G@>?shNS$1Jj>R;K)~KaVH*unB!G}2QErFf9fX^JkB*9q zj8biLzmQHy!@0UVRv>&lfkB#Oh3w^PmDL1zrE*C{8&!(vX3L9D$+~7zD2b07v!RxVBe8+Nq-qIA3 zS{66Hr^#)#w9vi;2`%k1%7qpFN<#5IUC`r>bu?acq;Y|cDWjs^!B9r;6OUf5l5UjL zu37?iDdV!!VyQ-~kd8|O!MyVH%UcFnoeQZ(fNHY?fFY4IP0A~@Dz%C)jXaZRLa`4x zeqaI8L(f%)Z%P04RjKL~wyY&YzO)K4R%Lq_&wbxM#k@Ql`SMNFU)_*s&$Zs3naUM> z^cI%fn@KxtZ4Oqqq`6_50dZ;R3UCS?&Zz&@C}p1j8Tcu$c#X+udvb6YJBHLT|BOiR zXNi}XP0l-C!)dM>mOX|1+M=hyVUU5h*&P#?>$5HHRG(vJA;`ILESDV7L8M6r8Y}Uu zYA$3Y5n>Un|5^cpRxJ;`w3PP-ZvF0TSu*PrUa9>`t9!n4@i@t@x@|8Kz4U^wM;#;Q z8ng3x=cKFDFV$2Pz~CdlSjqC1(9m2tCo{egsn|Y{VB(4_0|he>C=pMEy5v=4CA8M4 z0(}eW@xqFZFIA8F0PM?E6*zXoYrc(oDf*x$kzwP(tHclm0#B3Nu-qVP`Hf{KZ3^G~ zibhEepB~7+ffrxqS>naolHdGLo0b8<)xnStOlVc@(hH3K58wsMXcsqbJkdiQBPsD^ z(|wezpg>c#_^wVf^q>!WwBO4fe!OmZkW5D@=MLLaX?&t^RAJr`e62cE`*Iqg?IZ#4 zN)$NUs!yuOc3bAwdMM7@8A|BgSkfwJ#uc+-5!9MFLlS{rLMdtiBCmbs$35&tXeW^W zUDm*28J@t#LD!<;ruXTago27dC2Ig>K=|}w1N?1fQ|&WN9b*PD5!&|$(>aN6S^r8% z63mV-7qPwLWJeo01UMBK^IH_%_WRFHp6p$`O*;Q1B;}QTms+qE-Qwu0y?RbOzzn0e zeL6CkMOoceMt-P_iKeCbu!BNE67;%_w-aO7)X_2DPW^ojww5YP%I>vEd8r?tFkJ9V z>3)=G^)Zl0TjoLi=6#0aoEm;r7plYZ_ln<6FuLtI?Gt8QLn-3O1=Y={`3Abli*h+A zMAuiss_-Gnm;G`ttajLdFVvwZWW(Y4YddnBmqhNW9;YFa_+`j75K|RwBHD)HD%Jb) zSI=liSf^xTQ&}w~^?AW(am?g;cQTkSEg=C6qD#CvGM#w{CznWy*g79?x0UXGuW@}i z_*?EI9cS|>2A>oLdBe^Y4H|rNN;tPY$J&&sShA_M`Xs10T`r^={*1?^Kb=4Zt# z&Q>4~Y73}x{8xU#6+oBi;3gAycKgiW08Gc?b(~*-`(_!jQxrgu5cmKeLrH4);ar4}G_r`4ii^Lh~|X z#0)#2nMWjJ26ENAcQ2HZMAAm=siXlzxIYUqI4akrY=Z*ElMW3pXVs@MaZQ(*g(mXn z#O|gv`D_6lyN7L?yq<}`j0k8?2hMXHy!@o!;QHGp3HK=4X+`iW z%x$5zQRz^H)X0$RoGWi8BeA2Es+o(zgs7l6y7l}&jg+L188-gz35mIwOf-^Fog$u8 zDFKE;TMGCgqfV?AKP$h|fH}+<4*3jzFC=j0_>;hH#K!3jTHjrv#Ey4&`}Ld16c9?Y z!w4yOE^dWHK^_|>{XPANt-cuK=0eWOWORO<+-JuQphQ1A(cbW@#`ThzEl6QL388xi zXARz<`w6eKM9g)q%wO4y&rdGzkY`t>@1crQjw)uTEXEaD5RDty`@sc1aVDjMb|zIe zXijWzHDCJjDL2mu;V`H1n~xa4;$>5yH)}1ZK9eS2@Mi5C`dX?`>#o%5z>a!TNHDih zqy#;r45u~sVwheVNG+s|Rcj%$FLKqbVi&0)C|>W(oh67g}>@ zMdwX>B>dh>DJ|{jiq$F!llbRW=Jc1jc1w$6vxmqFc(7jj3GunQt3gdpfn7h*aq)P= z*t8dOoA)o~b&XJ2sbW5zZ-0!3?N=S}tIh1g%Y+oYh$_i0Z##;Yt}vt16UWplZ)$YY z65u&uUhE|{%6$=;n!Qrju{XE4Bd*{3a$I)`Fbp)dBsM-o`%J2q1(z|+0gOI}GPNt~ z!=BD44PZl?7xn7pphlUjb5UIA*;D8jr3enoi;wa4hg6e_l{!P!1{VWsj#Kc3(#l%G+k6UyZt?4X}t$TAqC7zh1yGVYP!?ODKRCR5trC+Gwlc-1w6$FG2asjt#3kQ*TR^977M%)j*G|6lAf{5OHX-~O`yvTfm= z`XP`@l5uDil^NmnDaSYQ$qUc3Q+ghbjyr#78%3ywTjDb`VfsP*?URwwz0f3Cf%Iim zn~il$PE6e*??#<1Q6daX5_P%zOp9!JI?c;j`juKP{nIkl#m*x)7m>G!tuyX<;mYr% z=TX4qycd8~NmdMwLWgDE_IB?)%9LHa-B9S!#XF*Z7?3wXH0PQ-vhGrt*5;U8t-Au= z2nUbrv}btD3Z_vIv*)!KJb=42_-tacFdEENN;DijoHaM@sJka;N{96#ESA(EB2st{ zS!E4;#jXcCdGG-+-tyL)tasl~t4+T$igULW6+MGG_MqByOCwDev*X9hZiJ#JR?mmE z8GSqqG#Jb81kYcU*OzJWz`iw) z+vSULwsAq=o4yw6y2rcH){&$1NHlcj#qcro?tfIf=VEdB`#wRQ39bFelT)vDDeD_5 zYCn6J6;~rKe-mxj+14X5MllnO2Ir&Kx&sAGe55-DxzgeCZzdQ+Tc0I2Ul3!?Gl@|X$k6-7b0^2OmOO1F?ZiN-=oFD&6r8^xQ$<^Fzf0OHkFrT3BEFc zlOP033FpnHMV%3f5k|Fg^mwnMm^1*xMc>e0>%s1@q; z&3jEGF4>${@Z4iZnC{!|rq>0ca2M1snW^&}Tbw`S36G(XFMbKxJmBTyHMPn1CO-<` zqD>us0*tPmy`G`yV?t-8Ixv3`GX~k-+U1ZYz6sTHwjitqHRi2F4r^^>(ACqNpFW=c z!bz!A8x|=mgFE7+>p(<&=Rr+r5#VjV(9~)=ZZYkY%G2pKiME3-Kw19TgiDzhj;%Wl zIpw|%P|A({O7lG}yJ6fq5`}b|-4cO>@h4becSc?Qhv_V<{ZhtJWz{>opO8z=7Z{RE z=ILj19h>kvwe>@b@?!&tPY$K#F=?J6wqT_Urd0AlC<-PP7l3B(_hT~+gInFrRZmVg zn@WXr9l-*)A`4o=R-S2I#K;Q+nZ7&Jq$QFFlQo{GmB6Z}0rcTCoJ!{`y6jEELrlCK{@5t1;kHNIt1vT9yRKksn z56WzK;>EF3m@lWrncyBVv!~I~Fw)L~@TmwISRRu^J}`yXsKa&G7c?$Y%D$t*i@+o( z{;b2F#E(5`*ZY-0xxW~vYmX?g04|9t4HqkI6a3sInA?UouohL{dxc~fCQ0IoCmCvX zo=~bSVy|+*@ba;#J08h|c}Hk<=`z#6&sMq6weR{TUQ_0G zJmKgnN?H|0a{RZBxDq(DIlmo%OBllr+Vo3Wxh!X7tkv6F^vxnp4MoXFVZjt1+@H09 zZ@<0$pEpM&G~xb1UBrzyN)cL3R=4?G$M@nWs!#Fy+fT&Aop+X|+~C@*`U>Pr6nme5 z)Q^D}QpleifMtD01`_q|j`cC-Coa-EyKX9I?IlwtOmF-ckRx2D#-AX)t$PMx{VlRN zvjKy~A~Yul@>Y$FD5LymQmU$2AGk!&T&?Q&ELyH0*X8k@-na_S<%}g>pXEqJaIOMq z-{K2zyr|~3mGnJIH}MG*)SDscILkoK`l4dv-nhp_om6J*T`I!EFY(2%E6-qFX1;0A zHQ4D;*;(vwSC*LH18EJ*kgB(%E9R=LG8r_cB6@Pq0xdugXP>qtG_F9$1F7_3cN+=k z#g}Zx$CJhpu+MPZTO^0FvKJEyQvc1ox&aj`CdnXeO8Yc!org%r!0=VSw_?l0j7Gc; z#Owg(QFYWlPJE7rrt~E3e6sITUDmG_~I&bJUil3Ag*vzu%}t4ozx(StT&tm z`*b%5Igf-BIBu=r0qws2RN#Zi-1KkzN$5MwOmb7bk|GKu6{9P6j5~5Dq|Y2-cyaKJ}nm^DeJrTwCF}68XXk|(&LR%0 z!GV3aK2Mxqx;XvLqH{WaQt5(UVi}at&-Tq{8W=*IAzX3G9r@l*st+s9X%^*E3=y*o z^GVNSNf)@Jh;}fJIGl>`P1%!FP|Vwj*h_!YPTl|vG&c{+(nVG-8bx|cvqTwClf1gG z8*xtUV7h9y(f2H=X8Js%lAC9f;0x#p2t!=nRRgp-oz(mSI zzku^<+VFXiq#+4Cr6Dvjk^P8~R%js>loyX@6`#>FCo}fU3#nl)3X&}-1LQT!$;r{8 zpwHVg7!`y=8$q+`%bJQxXjvLW^f^rFj!WQ#$)5Mia=??Zd7f;)T!iYp+fDWK`8+zB z^6zR`$I0Pj3V%VKDtvuy5T zJr@p64@t(uqu73n^5#dZd|h51NOBB65i1^t9MS4n(!U(Uz`%DI@%gO~4+}F-6ca0V zMLtc;-fiFfJuC0|OKyM!9KUSlyPs9Ov_Delsbvn{#lZ(5_UZnd{*E~7SNUbUc}w%? z6(0$rQY)_rCms1JTd183GlW3@DfiypC;oew)ICtCJ?%$_&vvU~#F0*Tik3ijR8)II z&8IkhlYK{9k!RGewj#C$HMLtGG&Fi`rXBd6V7u5%I;WOT+eV#IoPA_vLQ@&yWz6^Z z`Ns?<^35O3H}b%mGSxS2!KhWi1Wpbca8~zMpLjgUA2J@f-{=c0Tg`!ZS@c!uKYz`bRvL_$EXFuOeMa7M^Bjgk`g_iZ%XQ#^`<-I2i zK=UzhWXANCF!L^12b)44G<#5F^2j|B2jKA&?>;U54t=ody{cn%B#ybhVK~(}tMpdw zOcQ#JFP*(=v^TCk&{VmlLq=`rpn&NeRE&eywAabA#86jAy1UJrNKeAjKe39K9mmZ{ z5n#rDSy8>s=*yfzUnI{U8+K7q{4qlNhraAL#wKuc^}yHqATU-sohaot%R(shgYL~B z0i3*!+Qcto9TOV9*qFrZn2f2*NCdXh_TJ}Fwl^Pp5?8AErNxyF=dQ}~+mfAZ4XGs3 zm<0xvK{p4sR_5U%K#NPM1nPpYYL=c1r>QJ9JOus3;3<5mB}zUB>9D>R7{OcIu7NPG z(dc@`na$>QlAK)}ZPL%62$3u~Z0jGOv|l~SG1dD%@hllbXBM>&D=UC$o>O1cSr|Lv zuU;{gfWwyMz_9SL!`Q!dyqs)}p>mO*`(pnj!-OD_!cRr_4HJ|00G|=Mi~dV4ayQ!< ziH1b&CT6U|@2JjKCguEM?%RvP2E{ihHIx6Rj@Px% zdj@<~1graAKpsTCm+= z5~(zb-lY<*5_2&3XN3dtah+%Ot*ZlLAw5Y;Z^UCdpS!n??Juj}{_5IunaRv8KZk$C zXj}lXBWUE$qeFpwT&;2PSXxV=L?1<|dHel)cHe1jPft0Q_Y!-=ZPw*wAiTEOM$9CA zBD8Y+=N*A(4Ag!ZCvJ9`(Si0c{ko6OUx^Ya?>%cY1u_O&meJu-CA1nX0~I?XvF&~? zGGa4GTvNd=Mi>DqnENk0IRwC#vP?9NrWPW&T+sZ`6BQa))8=tB{>dFRcW}pqvxj;7 zj?$W?y4-JIVuERojd?|fF9Rx84OSc)w0#A0_OO~=t$Xm(9dp0f- z&fsHCE|Q(I*YM>xr_C&N1^zu-MJd-CGW8%Hn0G9WHvSB+udtox(0pT&&=ov0$VPh- zqVEUaKy53e*&?bO)D}!#jJijEY!-aB5sdr;GF9>wcBFMXcS{erO{1ws5Jv+sc%G(#g=en9e#$AEMhzmUkCc` zI#i$eeQhC@N|3`j4^>m|PHKuM`7(Q3zHFzZ{9SIY%uhEoz{#ziJ-?*vRd{<&(?3pr z)h=Hn{Ec`@o1j{z)xNYY`P-RDh8`uLX8S)#U1mBikmFRS zNVX<1I*fjVtb?dJe6Vm6vn+-V47-Jy8B6>b?nCB?Lx}=D-DSfJ8ty%i=!S9h=*(ac z$5Sg-V;dU}o0`lm2^p|od)2$xu*D5F{cJE&gitYP!Dp}w(OO%lV2*2gU4JBN_+sH( z!#A%#vBH)dcRv4J9Kj^TWA4a+V59u!`+l3(jH5>umAvKlTdf;m9TqWg!@)6j)Y5Rrf#)1)jHR85q%PX@0wgg;`p1beVsL^#+huH$}T z1QcYc;3ScdHAoqQV)tyFCyXk+Ph{uPFq+t}EmjXtrz)=!t;I^-IL>m+9&LyU(0mw9 zbZVWLIC9aEy79S~4&1-P?dZ7Z`exkUwY@9-awrrYE&s}$WxS-$m9=c=im||$93^Em z;j656`S8KfC5C2$?W=(!+bRG?rwS4`ffo1MSDKO=n5xvRUN1aR*>IZqkOfsN(uT+9 zXbEmjl1S-av(+~J#YJYMSQLGIsT&l%c4j$s{*y+v8dnssv+z30jy<<Egj9ac}89Ae>je89Ls z-1xQfx>xYN_s3_Edd|`rFc%$!-(e;?IP&4ZOLcNw)LO4|BQv4qEcZ4hDN|&A#f%dl5oZs+FaRm2jRVk=CZIWCQ8j~!&4o}fD*Yk-a)|~P8h0aC z$qNYOpUw`ZL8{w!|ErDoPenNocAX!;8fGi7E(1Y}SiqJ5xm@z^G`{b`{s_Ch%~ve} zvOuG5uq|yIadM~?2znR$(4d=JKZbHpJDb{9Xc5svIhWmD+C$6{$kCNnhJzfK zGr7vFe|1q3{*>CATpoHKnn3c6`(IQ#%*U_cxkyg5k1UVa30N9lKlyhB@L>#*a&?Od zB;aK9lW0h5l|8+Mr=lReKAW5Ci`OGrD?F}LM_{GozIyGF)XS?xj>xORY!rx$p zgba-)LtObOk(S=&b$mcC<2V0wVB&UlPg87fM(Yn3O)Cf6N6=;m2$q8FH7uxW3mNut zZYCnzu_T;K6P5VlyTxxZ)aTr$lEN0_(y*mzAV>WGHAxYNL)so?&YN7wa+x8*H)FS= z^r$ytf<(l%BqU~>ktS?-qnf5k?o=E6Wu^?a*6U=XSgsnqJZl|;FA^b|y(*u$374yF zPVzim$r)O?)UR}k#_N#py*M?)u1o-Rp&!c?dIZYD+^IRQP4m@*Z{3{zUey)c@J>o9kq0o&HryC=uM$)%PP_pVv{&EDHz%=SDu zJ^zJrh_^vf@!#kC3V%Rzev)KA!UI@pwQG#euNdI%@bjF8(abm~sXFX47|NxzGj2?5 z6MGg6nbjGtZP0USp;FQIY8NK~-q5b3a1~IFm!pEdOgNqqkGG4JR=}z^92@Q;2X*p8Ql5sf;hs>aPyRk{&QTmMc znEGo~JGTwW@OTgKiE=?Wr%NGyKxI59r|06HJ?bJ(kzR7?3l0k6J9V_(@@jlpHLX}6 zr43K12w{W;&*=R08PMzIhpNMnKUZ-7bk_QzwQQjyPvfrR3gks3~~ zId_*grBw}tD0W}$c4}_hF`S<^CcB+44g!CNJ63aJC4^%TlEDmeW;Ak?z3;4+?Q_B zb_Ug|y4kB3n>fMyE0?kK;vP0$&lLPmw%B)UB-d^* z3}}8f#ZC1&N?F$$&X8Hn0lv$Gxvi_Zw)a#37J_&m%*wT-Zdz0J^$F_2e?mTmZ~nVN ztvNIzLM-zFjIw8#ZUY_@P312*;gipf+wE{VXcwH3aG$LOw<#l;?T@zR+x@6Shq-k+ zTZG>`-dk8A#xxI9viqa%+0x@`0_iAe8t?V{u8>eMP(}E(J9Gi-xVl({-E z_2VSa^S_#G2GBbjTxi?%+r+=^uS$*5{Uh2DSWQ^P! zm@tt-jr*}K9@NL@z{MbSmpdK_!B??<=)-?3IsSPGmy25>C8p&Q6$NjU?Tp7=M}&mp z%O&bt*1V)TPnZ6pBRHu4&Zg`v2aCT_POZj6Hhx-qQHk3fDxY;pE|w$FWqdmAB1=I` z7Zt-fFn{e`!rc3+CsO^i-Q9Ei+5?t~R3X7r*3-6&iZ8@o)oIi9)PTiwlJLklRa)w0 za5C|4MOzKCMb0ND9RdOU`g_b*i|pKQC_Wzl(JF9tI(3XRh|Q?ab-oD|ABEnH#3a-9YR zf%BZaO67EF-avcO`~_%Yeg3lv(28CNTv58rYUCsPQRt+VW0K-$J~xM$-~v?X2JcJJ zL=duTO21rdcPjg9=dy`Xa>4erE8RlVI5gG#e24Ds3vCjeqXkVVSzPEz3!fH0^SB1c z?Lb?$BM~V`b~HVtQ5TJTTDl$9@F?l3laHB7@B#dh#67Cj@)!KELX&Z`sJCkLtmd*_~ zY9SqcyeBNZ_lgDL=}-H`YjZWtMjkTVW8qv0n1_})oMeQbavXGkOr>2U$byk&&z{^? zqCZ}897c0NFVln%r=VUEJN1JI?5X!&G=$N1H-viZXdkZr3&WL;Mm6q`qovTIb8IF$ z++b-uo$^v%pU_ijPv-~uUhxKu2mh=Y^wpK{F6{f*YcN)e!|hpLjcR-?`U>)-`rZ74 z&dhtkJ^6LhP^^)UGel1&R&=<04-usqrAlO zMaZczkiGDn%u1b|uI5axV+6j0n#FvplVW642)7rzK_K9*#-RGd(eyFjCd`ziF z#jV@vPHA0uSXO6KO|CK+kD-_Bh)#W~gSB)mA2}ziNJRJ0J@>)wT>_wJ2gY%4yF{|g z#>b@)x$5nk7b(8jy{!}lS|OIl64}#m-@A7qKJ;ydA};fLMwcpH#F3{ z`H=&gI!{3Y`H3ebC-boMFn2B>;=fi<^TgH`{>1`z-ufjJjA*3@D9bn=Xk5M-z^y0? zL5iY#LwU8PS9=q#MrZ#%F(alJO8)by4QrO<+|E~{Cwf~gzh^jA3D3ysD|W*pn<6f$ zE1k}(_YmI5avdLgfh=mzihTkJqSvV|1Uyh+5kUFbyQ`{ZIX7Yv>Bd)2lWw#caK+Xv z3>YjsH(r;9?=>>k;6?oNnKZctgfZw*K5bWo*RaT3G(5d+y}ItkcQ7t5Kw|~vm#kxU zkan7x6g}?C*`!a$z7`X(nD41bOT?p3fJ0geoe5~dF$bQtc3JSTQKSnx*|<9YsGQQ4 zuLRcE(*`Bgx;qr-n4I{qKII}6K!aumIODd>muVx1l*O$Kvf8N`pLV!r-7<22DqwAo zM#hC|HWs7nV5#f}s9;O1E9#p9&){U=TJX|46ia#80&JwI)=V3Y2-u-5lYg~<<+v9r zOxqVJYn6h+LDAVT#ekK$?7F$7g!|rWzy|5hM?`30IX;52ebSIllz=+^w8yDT)@Fg1 zwvF3?GmXtC^g zcSYdu7fp`VEJ6R%?lHjEud1#>gUFb_!OFb$3r;4RRR=3zHiA_EGrpFUud$_m736BW z-)Y$J6>z|P60|pATE;_ThdnPbRAP=d3=1bH@sHLJU|7ubC+y)j)ab9Tj~1Ylbb((7 zTJN}NNkdX}Gy$!NfsmR6TH>eLDNnoc5iBn&^%gUDMbFKg7Hn~m-t06(o^9W*h1L%% zkxb#LGsnyKx-I@6`*ZmDzr~Q}!7V>M_{`!d^K9ZhUOJ8vG z^faBof&y?n1IvWDnBV0d3cuza_M%_!14kw(#wPqKj^ zH!&CY-DxQcUiL7TJURp>k;8o))@~y&PQ)uK`_@GM=gmDY?|MS1FrY`f7HGuF!U}^- zs-Q%wAKwUET~heE_4sI!yC}5jt6o7`K-1M&7NBJ2d5J(p! z!!10vOmxu26qSMf^1}D3xWAh#3z-M!#`Hw){Zp5N){)jmsT!xK1nJm$DG=FqjEA)> zCR|bK1~P7bbG$`1gT@bu8dPEu3PzjsQM4NDPU=!h#M=%J{-wD6w3{0N<4v*~v{y$x zTtF8@(_nh!Z|H$7!U}%{eIf!m6cOXp>!|QUTF*B>p=8SPR6KtzOPva5MMzLy8SBlJ zOrFWV4mM!;Crh69kYim&x?p(*$uNu}zI%M)zb$z@3iSUsCb)mtvu+JtJS5}=!*P(% z_*&2ix~LdC?n#8up(Xgc8R-L56#q+CIlju@OmO&ZO|r83XFGiKxVXXU=G6&kD!}Pk z9m4V{mgg!O7Nw0WuXqk8RKGI=@o+O2y)>`s_8>li#=%$*>;{$@$DhWEsl}I|ZRgZT z92<-3nw?I>mT&>in1X&OOo)t%8{XjWl?*9OHY%PPHHg<9hkh9yjnyTQi~u}Yz@9I0 zRWu(+Mr%R`T%AD3mmZZ#k1kK3ciE-l#i8FQ_spX1v`t&uhg6>A2|U_)u5D77G}-ja zGhiChuAQj$FwPq{vS5j-g9@k)=0ZUIri$N8ily5N_+KSenhy<)ILp{CAU(u(yuJaD+|_)>LYuL@oNVJnwfLk{V{N%}-LhpwtLGXqs4OoBG$0j& zP-oe?(tDg40NqyHoE%g#`PCo`_R-P#zZ(RM?`*T%C#RDu4@wSzLn=?5Zj8r;_vaT1 z*TV|>WtSS=GHwN;E2$resLc>Z)SIX)FJse(bvqu*d%;z%g-}yUfZ4^m$bnaFn1?}` z(BmD=`+K3TVJkJ8o(mxdb@3Iu^eqa*s;av0u+-VHUPmKt7&@Lq=j;^nRr<5jc{-z_ z`-9gXE{`rRA)6ru^ZJS&?W&D`w^%ujySrf0Vi~%$hql-}=l+p8F9MkRD|f)InpH_Y%i{Q|Rj#Y$5w`)D zzzEqA=>LDRR#E(4%)Mn)8|~jMT!G?Hyv5z!wJGjW+`UjVxD(pqPI0HWyL<8C?gV!U z9w10w?&p5~&wAgp-m}*Ec=9QkNhULs>&pCQ@88~gU6wC$%&x9h0|3(mXqO{z~ z-B-Yo6U*F&MR@d?`oKhU;PLBHlgE)q22G&2(C5y_WMcNNY$%#I=9G4)#Uk%DI(Vdw zs7&9bc8mHTX*|U}`>osoL%%tPMhTpRD5s6&86W9x_LX+coJ6J zWv;0`l=Jk+Tc#e5|J54<;MIMkJ3X+S?WeUutJvxG1zJloLm$$RS5?1iM|vg6kJ1>? zim67M9CRLl5=>6URu_!0%tjEkR80Ikt?L9TyFJwLFdXH&%6jFTJaM)PQuV8g%E90m zt=>Xa`0(o!J-;9y70>UpNYj#?_Y0Tp`-6moOkr$4(PI)~iJo```ab-3ukou*%ktpm zxQVW5=o4F$HYr?E2@P48nzL?Bv+*KYn~P#HyE+y7dr0g5KeO>5^g6B7{i(%9Ji>9M z9Ly%qWU5|PWYLQ&_pN7H^jpjaEs%}Cm@mES- zc=$x(;?|YNschLPfuz#UFoOCp&y0r%+zwm z@!5)zev3vJ$%Zb?CLZ>)xsMr$A4%KfVeC4YlPFQS_iL^ER#vBBqz&}#@jqX%fCxL= zGvd(T{JT~47Cwj(AI4_k@To9G|K zmny=AbkIssYTS0He@|bE?R}AKA4f+{4s5sG@*W7E<{p+ohAtI5gZDfBS4JYO5Al!2 zXA4EH^{+*XSEw-SH<7_LHb*DZhiLN!A=46P&V8=)S~0isZDM}4q0{cT9E%tnY&xGG zE0&n{PB!B#BN{53o5ckD9K0DkY86Z)8*Jir5{cL@4G@!4avg2Qn<7OW;zx4lge8jd zk#8DqZU}?q)Fnx>b~Tj3{d1_S|9r3*S)i zS-v<_8{v!O#Q*RO>V)ZOIARY`4_OGq*C#BRk`z*x1vQ6tTvUs}OdV023)&5;rRA;# zlWq1dWpjc!4@fDvK@+UVz-?J1FLX=OfV~th%V|Z%WANoPFfT&?35K2v$>Q9f1YoVU0?Cg2qSO zGW5jrrCtM0b7kl6B{^$8q0Vn50+xn(-MQ6j_a=TdCTl~Di506?GDsNBT@Muq{=W!=>tC8HGTDv0RD~yKsasZ zX0`au&Ld1g2LvW6`}-@nsh1s3)Bq1YU-fds`1nls&8z7l!=Gjgc&DP`YzEf{GcW%C z3RrkXM6YdmveXhp33dI6Lod6h1gX_&L#He2{{%r<(o=5+ zm@Kuok!ALqj!Ks;O#zx3p6~XNxSVUx)*XxJ)42Y3j*n6BtPf0{upWKqWSq52*nMt? z)Eb(fl4i&!bIUQq$3N<8pk;T%-6^o%X>%S=osT~*r>Nod`Pb7wiJp;-7K3Y9_ktdx zbsAes7^6}BAy7Udl<(xUZJq7nd3uiP+=6dCsz}Q;C-ppPHR4Z)e*Omwa9g+xA>(z^ zZ5unCXDd8wCf%+k-R9}plmWMLrL*#)(wb4$IA%^;0;^y)9{0b0=zqY~CqQp=S*o== zZDb$(fS!uiZ^1GYez}U2!g+ioe@o7C-1Zzr&Up+;L=pdaIH{4%%EF+IWuS0UODtS) zMdqg`zvQ+{k4ZxO;dMkDoszb|5tJWY?^jtJ>|2iOW^O}_mDjTJu{Z`9d zKPNq5m*?79_P?w~C!z@JK2BRt@oSPUtFLazjbtVoLumGQ*x>iRoTt`cP4X4P0xLk} zP?akSWE@r-o{(7P&lzRdx%by{A~WhVlU3Ryt+`?9TO$u~Si)x@cvq*~jUGzUN$Yd* zR%JwF?tNkFRscP4IDO!4Mn;QPdcR%04w84YBBWjB#bu9OKI!rvCpCo| zaP~vjeI{rdDcTxIlS%hDA|^qqGObB*p|fsUVA;8K_5lt%dj2&Nbb-c(!N8z8J~EL_ zCK*}M;dz{74!e+fG4rKO5V2JPIUM{(y$yWGnjqo{Xt6s^N`JkZ&@i#ddzSxt`Re;I*8c?V^|+z@>FDSHfk6N5t@)CZ=@f^N z*yrYG_=clbpk-BVeTeYCKNl5mS4>kGaE$Zar?u@VNc_#e%T3}I1%`s8GKN-KLz={l6=5BD@(h+z1!?RCBVc{GY>*QxrAW(vv{@H#_nF z4sD1dH-gFT=(+Y)A8OoPrz{tznI8tcJ3tlr{{={&5NIXT_74?slNhsv8f7q z##!v|v9%>iQT=W{m4pkMb>M8aN{P)N zfnK1zw^eM}c|CZG$ll%nvYI&TwSSz=P%j*cLN!AmEo!mQt|7;qCyOoUx}7{AN@)5x zwii9n8AUTRx`KzbcJvbY40X_7!Up@S3$oy4rs7l8rJ(YnckfpCh}@SjKAA4&918TK z4HFehau6)6cP-gnvsq0o-}x5aERhmWJ2fD<8X3(7+vWT{WMG?ZZ&)Yd<9~X{q4qW1E@w z=TM4ZKy34(;g;Z>P)Xk0R;LKPTrkoN#B2ZYY>sW~U7wZ?3#$KtR?gyXEpC2_BOd9D zy^tlZGRPbsMa;trsZhqzx(B>$BIG^lS-s?DJ=k_6FHpM@x79l>;efnM3t42tgU>Dr z3xS6Zlf=z>tJqh8Dnsv{J;ma*;oNk#o?jN-uFvMGJObOViu13*o7O*AwJLS6pJ(*n zm?1dWceLE4H{L2=N8%=t*cWQAeK0B{=nrhaaLKV-J)2Qmfv%R>+i_2YXVdNxr-8nh zoQ_DfbFP5s=fr;BYKYxbAlkK6-u3TOdm`@hg9fifb3VAarx~?VFi4B9r80kN1%}quBxUq zcKcvw%RZMTF8I{~5no3rRX#far=znD!V3PqAV9jZR?cA31ik;ZG<7vWu*@2030dwV z#El|0UdV3MaP(*iS8;v3PBvxkY;+)_-B&?KZD2WCQ$0R=(Q4u`dO!au(7BCtRgtw_#j@rB_GM{Laet3&=A3Q*hiGA!}ph41l zZq#JaOY}pnKaUt`?9e%DS<|OPx$ml_X8opWr>}W2yrN5#vZH>5xy~F8k~uTxb6bV( zFoXVS__R!M>N7B9%E~qm6#C{sLQhfC{oI)%Qo9`h;3Mbt{N!aF zxYId@U4_`xsbMnJy7-yF?;)tz`f3056abDR^?r0pX^uUUw2`8b*5F<|$@tI|JP_ma z0y?h>=G+5fG8>x?Z`XxjpTf&N(Rfjcb%8h%1g0D(hzTTOckX4VjOqomSx-Lhj!->$ z8UWHLtS_CF*8iyQng_7up%yZ!E6rZkISi1kM zckktn3Ye}^d^|P|q&MX8t=7~pcM3D3xn)IxZ>tFT!#(_*;5AD=du4?ookWc^OlO2B z5#YDnCzUO303Q>&wS7Ck6Y{KKy4}%(uGQYByBo9>*W{S!fiv`imM>UeQ}_sk=?pp$ zU#0~ICBM!qOdOym6QjT5Mf4yBp({BhofsZYY~QK(8MVEsJ{-@!;^HQzxXGVV8Haeh zzNSEPJ6@$m_pgeZ&uH1q7%|*V^|qfZjjoelCgiYXe^`{54bA%o&=Y2Or0_#5fnym> z)&?T#q(Td|Tk(G8Z>Wq7{H};%mB0nz?b{4}6s(U&r$8CevCU~w!>0f2%IoLnMcG5c z7^A$Uz-*t2Rce%V2p;5tQC`Ug9+QXa5?Ve#(XFhyeX07DvHn~qaf-nmjd?W?m6+NT zxHpEw)U2rF^^in8A1l0-eML_>z>^D3CFKUGxg8-{RlaL$dOPIprb6mq%JK9Ww@sai0!!(L%54*c zbCtRvpGG51YK~-$V3*m!5cuZI}u`fOHdEt)zY0!$$`JiYQ6>NA*^r# z>vqBRz5C$QTh`a%eZKg{8Zgo2?5ei|JbR|%B)ri=hA`Y7)0*}hSkN0>erD#AWRHRN zfs%)QwqqT9>RbWctkuiz?3HNDQPbHJzNh%BqdZEN-Ff>oqmc2t&|8t%2D*!W+1|S3 ziMJBt;km^dGPSGO&noI-@cTZeYsZliG)kZdg|TmrwQNd;h*Uexyq)K6brY$k)iR9z zu#EeWI{JDxCPVYjMC3lBz?L;tyt~f4dkgA%6_c<3j_qG5EFA40W39|wCF;U#3rICZ zCH)>j^qD|VW{>Vz^5@i_~%vXh>E!<+$9yYnTj0vuYQi(60zE_h0H}1BsWh3E=<| zRiN>3eoSht9ESYCzX~AgIuV&$zogc4YU7by*D@#LqK~o2+w+XdaCO|cnt;KbzsaB2 zIKX?g@?d&5W7|{KUov30%P|T|bdtF>vyMmMRVL|XWC>Vjz@hCRv~r{{=It;9>&*lz z5f1L^GBcaeklQd(`_Ib98#hc_Z@48Gbc1P5`wHF^lczUhj@|P7vVU|qaby zs<>A|84*F;_|#E)eileY4a*ElUg$J)`Ws&UTPNb8qN@?_n|F*WHalG82%MZRqf!qP zwNbl$Kh0>W!m>x|+XN|qd^ZM=-6VA6e9t#?-uBqT9QI+sEYKrq@`6rAISF;G&9s-q zrAqc5}UTm+8iT?Pgj*HI_s#(iOgrBkSTV=wGGU$Cd4d z20W?92V$#5`#GX<42>BiR(o}avQ74NsaNF!x=J(e!`b!GL+0@5wR__LQ?CIrQPQ#gwY%xgT*4lh75s}oRHL#DEN3p zam(V%LpVK?u0%2A_&F&-sk)S@eCjm{^;8O~?Oj$ogiKM1qFq`9z2?WF29Y{bpZ

oLHd>}A3$ z_lB>=(r3k}g@G}Dy4I)0;5B^m=@Fr6h$E3gP$BBmzI#ZG&;9i1729;@-Lhe;(Nqa4 zO>ABxfrd-phI@UPz_s`30Jx^ zS?5p`xaMSmt|Yb?v6kGZOgdU`Pge6t;{|Tryn5^DSKI~mM*YDEwKv}20M6rpR?uzI zya4mwF8#JSz#3F$_YHwkkZRcL{K>^VLAExF`fyMt~?vGM5Vk};T<0MYrS?|%1Uxk9$J;q z+)y#z4Xn6WnQxN3Y#%J@pty3W*NrBdZr46`MknJRaaf0f4B_uGxFLe<7<|Og**aE3 z(e(AI6%ki_L+>_23RU?>0CxJt|-LoPGH?q@l1?O$Fdg4#Z^Hpi_;+QSQDe46BSxRh~^D|e^s z2RyxNcw_qY0$bWwhq<>l{BDRHk0WT z@>if!d)=UWi@jhhe|WF+Q2&%evP8+}I-DIGAAZs!ePBw<_FC{P>CMW^D>Bi>eE_yg zp&(d0iz^`S(Z=?#^RYfQhJDaGf8uxI3=(F0?;@dPA^B{IFZF@N$Gyo8HUQFO4buJ- zkF3RlVho77zw_6Fx<+Js(;S_`aU5W_F5SQ16mltDn02yzuDCzlC%y6YnOF|>$inNq z0j(q^E2~97!t}|l!Pg%4lq)P+i|28)EbQZe+@4R(V6bVe12kbol#M?{(9lYLWjp~Y zdSJgGct~<+;H53*@h6w3wd1cT3PmSY$iVqu+;{G{`+I``o=fXW@)(H^84`IV@q&7b z&PVOrry+NUK)zGX2S)L4OTYJoc2#=({X!U;yWYNDv5;2)Px&i+T;yH~J}^`QVw@CX z>Q`l+<0^W#=jM3N(WmhT^@+fpOaEE}V7lA-n&b65Qo4 zIORwU4-qO+Fslr7YeL*>ofk6Yw>}^zqd$1Y?~>Ije4z?jr_f1TC%veLV0Ln7{~}5Q z%r$KL+cagG=b5Z1oN*izBCAV`-t=~o1AgvLXi;(^D1|d%wrS(y?pThWl=?uO%eX>h zT#!S2{%#qL{^}j*2gGLNU-Nro+)6?O_5}^(@r;2;!(D(c9=WGGEVN@`NkL9Fq7wGuk|x2Utp4=U=M` zA-A=LkDV!6iFBkXRXqYmvS>P6I+D+=h|;|yF(-&HV3if{8LicYBeNz4P*dS&Ng?l0 z9zTyLzg0*Y+ui}dHvFT<_Y45*U-!aZwp*cvO@&*ibAt;f)LD>asZO*38+u$Q^v zI0!3tR_z@y=4c-Hk7`|((W&jg`B~v3Bw@(_=r8{3yyy~PN4ZB?&{kvCyJeS~y}(cB zF@v3>&4Wf97VlZMjy$VgSEhesE(04?w@_{^H9v~j1f>xE*`35O`YwIdSAe~+3Td1f z0|2Hx3d)XWYxY9I=*C+2ixLw^p`JH4|hWb_M+Fj&JM>$aoxy8wj54IB1Gp|g;&Uo@E(@H zB3UbQ-ks*h^p+Lr+)>S_4oEBFIi|Ck@rUu{Q32wT9xr_3P`*z z4ur}#g7}N-^+%H?j8^#??I%q`NP(&B65kLK&ZRI>_9E|NoL~vlb=VR}X8o9D-n9r! z1fKIjn)2&`mQYK&)ps zhu^xuOtM|oKeg@bc-Y=%&ZV;8^`HigFX=JTIq=<8Sym?)VTS8IqdG|`I+?mSxj~4RDC+T-eI^Q`tkR_I)3PVd=yD*p$66aBnopMG9f&_FdFE z@A}2a-WN-JWPc@tsP86ee78KH><8;#?dABx{ZTh6C%2J@U#*V?cddJ`jT5LvHNjr; z+}&92BJC8WMvXK|hvc|@e6NIv)9mo^3H`MXpQb~|((Mqt*UucEp0O(W`R`syIWz^B z9;@o{XPsZ4WH$0ZcAJe>{=`RPjx_dW0rG3aY%Rla65mXK{YD$pESZUe*NF@|b}gbI zKudU3L)OcEddFje^>mBmLSuN1j7Z_3+pSCmIyo8pDZ$A645{DS{5qLi<`aNfF0-cO zor?M;$rzYA>uBzqcdKR1SY2Ogj?>(<JoXuW`em(Ma9cZKh;_^5MUCBxhO2f*A_ivP< z{yJX^Nenk{m>_NR(K|_I%Ep=pK%>8`+_E}(F+-9DwHh5tKRn=wP4q{FWsf zLdTvX=JLiZt&}r8Dpl`ge3!VtNz!&%M{F5sxrx*rIxl$ljD6ESJl||%%V7|%KUdGq6b@E0D?$52orba(o+0{Y^rO4GVAh!8 zZ(xm~_x#w_;s>_35e!Y4)9*1$2G}e zb=2xDx>Az2vW_K!?jmQ2=#WYx=|ybw)y>+NS@lL#_ie~kL?#s`r>;r^ z))VSt-C%1o#uqT~X*ak{RQP2eJ?gA7yw>3bJcApwPg?D~c7uM68Q7^(()BNzcs{V( z<6}H^huI^;o`~nDl&gZcc@hxMHNRATxAnnTo{XRr+QZZzH&TxH$5{s`x~-& z4e1XszYQfh4UiXby~k~y9rQsra5&NcJ@6B*JyZf*bS1! zA+2CJSPL&VePl~+oo==&Jy}pks0EU0V`{T$_y0f((EpAU^X9Z;uLX4XStCmymwpH1 z^t4zpaU3Pble@1pm#?AA(TJ)aSN2RJZSCkx^@tFgQiCt%=_Zm(oW}6K$FUIe_mr16K%;8;Ml^W&OlIyM^Ac#^7yOfPx~LEqF+7^Zx_=iW ziI#|wMNg`CwcpP+hCvb-LPCe49u4+5{5S(=W%i`Ihyy=*=32pg=% z!-q7S(RiX4Q8JR(uC$+bA4uZzoOHZVJ7Ldb$1kOGI$IRP!TOueLCp){65rl_Pd)E& zB28!>)+RS7a}xb=>B*J1h%yua=)Z93@)J6r5~U=gxA z!p5}8%TM2|$1nd%i@b6~RPizWT0of>J#*{mW)=IEX!YG4S4hrw3!FC}DW^cI4Z?Z) zS8xu|O$IF#1=dNPFyr<7bGtLu^q99bro%8zigN2gYj|taFdd0VpF~=}fYx>Q^8G0U z+DWis%`LG|@aqQ22YsRHt2am7s6~27@>SVwy^iIuv1hE$fN^=T4M>g|bou;kkUlMj znRLNDmP4WLB0zmhW-kH_(3!S3a}jHy<)Hexz+og5P3)~WB4y;wMz#LP<7XBj+qWN| zXK2L+-je#U{z=s}y)OaX_}Ehe3GAm*`BXfc%_j;lCJZ5;z@E9F&9IS)Xc5JMG{|A{ zr_G2;df$|58#dRKy06FkLhHf~7xk~u4)7y(UHYRZ(levO*!I^wA+TFVP8lqtj9Ztb zwBkx7jE=xvBG>9{yj>NGkM7&qDv=-1Cj0T))#*11!~cT?2yVvHzMSAc3?Mth-}FII z4KRpw-9u>=6t(uX|Liq&BqAfOz&+N`=M^R(clgYl>I`(6 zKC_68xA9ts|4Aj@GKU5JtIyb5SZ8@mblun8bnp-bI=gFGndxkIIvJK0W(Wp{3@V^I zL+;!5I#7|EhVN%PHcLnejh{yI-P20-e?k=YMrPMuDPGhe)URj znj|)$bVpY?nKj*I&GxcN&pwTpjJBq3N8}L?C9KB^^IXBDU8cw8LdOJp**Uz<`vgcl z34=ZzK&|Q zJv;bxITZBs?492ssJ$FXJz7-Yq#)TL`zp^uq{t8Y^xJ1Ys6&K)RsHRrdz0X zzm#zFzS|oLvhtkVmiwdF3c?GIe}n_rXq)2(whG<)|6%3-+-&^Y9w1eP^6;z!b*BG^ zZG3rf$Q5RlwZ|L?I5Oh@yW|c5!Q|g(|L6IXjxYM5G^1OS>v#BaibSa`Jh0vSH&Y)} zt|Z$>KV*d}j2YrT9jA({6<^6ps)&+wGFY^Gz1zcs!}d3s#Y5$=rR2y)aTsWNFtB9y zr0$})i!|_IM*(X1N(SVhVVIKJYjMxtf7gy&}wHJFCe+3PGm3s05WCfw8WRgt%NbEA3vM-eW-6w{vcjA_8 z;ogEORI~<1J%v$iqk4qtlO>^!{;A*INb#_BY#uiE<eIF9_6n~IjP1U{pmNt0EG>b^ljU78b^x|0e|}R= z^L>-P@GJsj)O#j&M^CXgiS0$~Jr{jFArP!NhYFuEDC*hmo>-jRN6H9xS8@$3-^0AC z2vxZ=bT|C0Mty^~GXfS{qp{_6NuoEEPDYFosI4x_9!qj%?k6ptRNdi;o5w(0Ik_Is zO8Xi5WzjUFpECWDGdFK#>Wa4Zew;`CDzGTpUZfvOw;5asCV!;_^rWNgXorS9xg%Zl zs*XqBk5KL1@aw%?Gw5Pn&J=vZtNb4Q;-T*z>MIo~JdX}j`r=ymF@-D7y_{QIw3+rZ ztNe2vd|8E;^)Mn@LZE<|6d3XJJHrWB`6cv(0Yd zFry1Q*c6tuS_9mc8$yr3lo1m=r!O*bYQf=;l+11RK1?ZcN$|&?+xg7qp?Lu_QwL=S z5A1>-Qr8mJ1~mZVd9ZZk#393?fi{O-uIzPB{3WtK)cm4cC5_-_YFq8Fz{*f`#RveO z-%!JsV>KcxysLD$adPfu@4YNc@%N8zE__TV=_XD>vXZ(&c2SY~D%1T8%?l=Gmb&`q zBF`vv<*cuCmU?v*zjhvDmy|A;k~vD9rXzC7DqcBJ(=wZKAcI8#ns0HvCb?Wc^K}hw~%iX=dF6_TsikoIs!(-R4 z@(wVN z(=#{p(v>=!8;@;VgfUm?v2+^X3lL1y(R35n4NtR+ciW1pHC^<@N=SPhvQMkv4bw9b z`PYU&ja<{K2ZKXSMH1^<(6WIyB=9@&UXTw37xUp|~9G z`keX!ofi|y3JTLaht(hRhyUb5#+#T)^_nhBeC)Ki&Ng(nLMVUdQ^nC=Znvc5wH?Jk zE|VBvf}Y1Vk76zd!uNzhORKm1#8*asOp`qIDWhoUDa=jetG08E*gj0+Sr1{Vg^joi z(F}BV{UN=c>kST%e+*PE>!uN2<1#ourwgK!s(hN8f`2El^JJ2r>YjI1Y`3jlQJvz- zzla^tZ=z%?gNvP&{5;Y}gFUe1XOy=k5GQ`o)~o&;oA?>;Y>M0t+LxXevP=M=9Ep3- z6kcRkew>A8K5IxEOLPI%W8!hD*nE%!kI&TmzSU1W&57p+cQ}SPcLdu%-m)ps{7sYB zWs!7Fll@|6*B<;jQ6UU@rCWvVS$T#yoz4GfJcTgyYQpd4%-Z?H{&BoI_0GwetADUk zLl87EU_y^hCd!rf;%JO4@0cidA3S4ELI;4Yd$es*;I z+*dqnRai6cpN55v5cggLlQcqR=eb!Sm`ximVfksxn;?MLB3z)LTNg_yl~?RFAZnzV_| zqz~|*@DEP4p$i3D5%R3kX1ShRLsjJH>3ro;-*=7cOStwiO6?hy-c1G6l zritM45(#4u;=2qY|9O69o-cD~z_6!nas@sWf1OzD2kItp^f`j!uOLU&FP=*s7iNpGB@X+kq@yXV?OpHp60HN^J{bPJ0pSLSq||wF9X`t1E)V3N_)0s$BDH5^24Xs{=*v>74Q z{wfo?)U-U#VKKjYE<^CHkbInE)4zk#I$-2rKbg4EO!*y->F1^ zDuIrP81x)7((s|3VyJ8)1h+`3oyI8;K)bEO*Rj;Bv>+VzG`|Ia(Q{~3bjM~5fOKs& z*n_=pz4kv4&kS6+f7q1yJ9MOCTe*suc5Yyv`!54IF?;yvt#Va3%oQQVa4NHVVKL-eRVYD95#< z05ch=zV$MN-G6g2)mg;#SmFbjLERHi>;()SB2Kj;iqLq(Lf(CXm&4f&pZeQWki|(D zeKvJbNF}Y?!8z8;F^;XLS+(&iru1g}1COHd)VPb%)l{QQ!VRi5Gvl=CYm zC-p`x9ceW9IrWMI+GCNhk>0GzztMWf=Uxau3zmLD&lK&{SHg9QoSe4M02h1t%nf7$ z=r7$v92n_;;}ziN#m!?!tYXeyUbj-~Ww~!3<*-keEMM*hj!dOKvB|ZO_^k(k*AxaB zjr`W|DYi3&I9&}%_oBK=DCj08P3G>H`Bn%2Mt{W0sv~AEKug`}FUr-}Z|Hi+lw(Ho zHdDH;VqJUwQEvjC*q(nspakU4=DI6UlX|_%TqQ+B{Uyu6^HHMg7wdWm4nf-ZgV(C} zFY6iov7(coZD*MNUQx#vG4#$}MaFv4s*-Iruf2^alDWk=Rq4dqRw4g$yXIcsO143ihPQ6NVxVkgNY9` zNMW^a(v7_>y{*5ImpFK(aJB4+oT9~%qRWZ zh@PzP^?&&<^B}fu)g?J+<`=j~Q>8ja0gjRi%s#=R*!9_V43H08sr1R^DMz0!rxMw> z3i=;I*T$2d_5CfUJM{mK-e2|`sGA0CK-xF1^p}_@_#c?B?o8JrR1h#n#g*HXE=Dx= z2mNQT(Gpdj%99t%i9v}WGo6PG;YwL$lsLxkjeQ?`pIv@AztN{iQZNQ7!JLU7z8JS! zkiN_-x=m@6KbVB+B7*HdjJ}Gzgfy@X_UV-+Scel{eSK{+1_YcH@2~jGOSfO;pI6+5 zGzBf)WL9AvzEMiiNB6%g6Ki2}a9BqlH~Psvxu?*2+%+#E+^oYL${<1^ngX8wvxKv~ zx4^`AYsd?Wybezv#=W;1h_xdY&)DlB?XuGvj|SO8Cj}9Hx?v5J)nB;*T_L_eubH6d`;{2BTCRuXn_EEQKP@iQ!D@8SIF86rRz2``7fla!CQj&AJ zpR0xt^bAD;8j3urNf4Ydhs~u}#x?o)yWa&xNoIqGA zmk@*tSTotcSe98kV0Tx@>yvwiY*?7q{_(ak8=JE0VO#@0t_`0P8f(f98J)fqy5xt8 z3zsB{67gV;+RW_B$g%AMG-n=0D#JNZ?HL4;_n$8f*arVpn$_G~BDBAP?ucE~#d)6c z&ZBwnGh#Ryr>TC~YA#(Xf&|alBPQAfkku7&?cBf5imW&4l+DWDtJJV?BQ}C*Pb8u} z64;uWhBSF~HPtMQgQ$tQ?$Z3{I&LfW888SOQw8Y-l!2ZPu&9dxNC+Ux$1ACA<7_OQ$kXdq zvg4fM#!L7?Dl)|ibN^r-4exJNi<^B?&;mJB=# zT>eo6MD7M3zOnb1)&J||Br+waQbR|jjJIk&=dN;4@Xl{x9&XKCdE5ARsUm&7g7N*Y zXfi6Lbwlnjvh0piZ+h%Oj7=PA{*qWHbep1HQ9bRiY`kagsm*FvWcc3u(|_{Ph3S03 zdB%3Zc4>3X6=~VR#*g=dz52FGJu|sJX7kMDz$ZhW`n=>t@aN`SvNZNDh8*?A)>9&0 zlM%NeG*Qj$*sNR3l8~aTU3RwVM@Si2MWM_}Q*J+HDc#cmc7Ug@(1~Hf@Q3|3Nz0C39Q8ln}QTd8=BQ^_Fv*uyNw zZjh$39j5d8b;9EA5wJUpBc$K@LxRAf79Hn`7Tn?}Tp>P#prng@igV4ZpoWqiKw<`P z-xR$GjF|nGWE%cM{YCLFF@TWl(Olw(XWelB0LxoD-#SfE2#6u>MgCb-^I)S#dJ1+xO5VXp7?<(|gajO#A^%d#z&;VG z8?kh49T{JqXHUvUbmt+W>-xF2R$19eI&f-YF0v5QJbSYL5lQ);xv>Q5@7iC8!ZJKm z?`8;!v1@Bmlq`kF3b_szSXXXQ0DeWArCYQK!KA~F?2l6x_s`rv3ctf*+x4)&T^ah= z$r(=_j`6f|6`oRqn|vV&ej<4}H79$`T<046dTJ}o z&1w6{E}6j};Bthk{?s=<;A(L&!j7;U;!q8?yWe=4&oe)@WGlRjK)XG$tj{`1%(6dQ zu)A7)7Y5dQ*fmCN9H`J}y3oeGK#*(<{ z9E)@##+~cWpd3qLsq#O#Qu04qNkmk%ir;z%na|QuTffKW%B8Q!$tiPdajmIU??qq@ zcg$KoBdH*fwq#TNlz7B)r*8FH!s64%=VQdiWazD8K7E=j+1;dXr+4<=_LcZ9Zg`P{ ziyf(!mJ6p$(>xw`<#RAzkp}|HS#~%x>uS!i=i$vr)SKax6u@|+gRe{d3t2LoJIC1- zUf2FS&Ok^mB*aq0LK$H>DI;Hu&wUuYE&9%KvDvKSsOreMi>i}dyQ+0sN0rg%Qv%_i z2G`V#fxXJ)mzg|Iz;t9bnopr6k7FM&QfimFqU0FX$>s4%X*wf^m$Z@+iW(MOyM@tqS5>8iVuy=g) zL*)g(ZV`2j;MI9sBu~pvUyd;_a9?~)9IBkVf&F@4*E2Ov5a3P30Rvs@_$y4$&-)}d zbJwXS_CODTZ&_+PGAZ6Dd}{BUNKP^9R@eo3DWv~Iv>4R=v7l8$!ia3*4l?!!y!jMD z=EN!r{AnHb^cxcD#niH|;y+E$sC3fif*XLP9}>@*Lek$BjMbzNn!-k$bAGnM1*rMH zgN@E<-4VYEWKW-@-=On0K#1wx^ny}j#(1y-7i~)xs(en~eTWaEdJ6*u3FHUTy%WDl zdAZoob~l3c+d}AEy6W}64v`M5XJk%RKQ05)A$Ri+$+CCHMR{-Bv;9lV#AUL3dpw!n z4_R~PM-(B)<=(x1aeg%XF!k+u;|9jP7NDSS3muiX+8h7%wf`c1$6$HaX6`1VinpU- z?x=%r@XPt_(a)}!THmkp2jEc8H%5Bxs*KJW%K4c86zBtPZ^7?MYRYdCH(r|C3mqs7 ztWeX9g!oc@C{PfN{VOxr54136a;Aow)_$(h1K!s)hA#Ik!J!-}pAla&Bq8wAGJv7mz<{8dzF`B^{W!b*GVs zU=5pBvNMIZ4KgyPl2%P;OTf`b-OC)_wTD;!BMxsxo!PP^A7}MyVBBL_jYADDjokUi zGoj(}g=V;^sUI`4MGGb%oG)JM8UT{DK*j?CehRr`3Yg#y#^gba`GhGqr7Jv08q10$)v!-g~Ds_gk)mFC`z@*QZG|1|)@Ohuy8@Qx|#wUW?MWw{>FhBdXF_lr*62Ys!m$VFL5Qdu! z9NsYz5oMub_)>9L_)NszEm-wL5il#uyK7pq1lvD7zx6s2TE&Qyw zu9&satl{cD@=tv{3{|b!vr$#jNQr$HCI@NCT2Oq%b!@9Yg~STLkz0$h*#FA!TvjgP zTc|a+<9m#lGwbs!!Q36T4{HTZ>-}pJL~MxEtmo!7X>bs+bE5~u7^4Yk^nOtas4e3D zjsr8*kP3U;=kpI!=oqYRt-i`tb8$Sd4xz{0AKTJ8;VrF_P`Sc>ECiE1U1qHH7*FHQVwq)(-}_e*aS;EZ4E zPfj^j=9H9OjBiLEm>YQxC)J=Cqu+!x+|$b%3Oj0iBx#Z5SoH{-C`%tIy6Q=!MBcq* z1ATu%b8*=gN}g^!4DOAJ^ETw3W&%!;n(9e;ui3-x4Oh7}p~sAGmYOgdT^&m1Dt*lU zMv)g-KVxATE1soR5ouxBtdLBNG&OZ@Z7~z3pep%K^bP>i&q`>#Fq6#_n1e!USJofM zZ+t{M{MdQs8|}+)T#abyr1h8UTN7TyZA@2uCAnHxi=Zn3aATCsQ#{;Ob!M_SK>15P zS6ZV%KWU^vpqcbtt8nfjfc4#Ri8)4k=QUpqkz$umo5xeyUo5z6M03_u7ODqNt=P}% zTf6_Ky(^1KI*sC1rjzD0Xl|7{XY7n+mX%AknC7^)=y)tiGZM8D71sn46OUMCxs_&% ziIbXyT3RM9P-LX!mf!{=lI50y385?s{0E!nZO**ZJj^+LPv6t;+;i_e-@WJj?(e%O zacb}}Nk_G-xvDB1%9-;t+lv~-4~Vt%*F)Uf7{|jq5gn3~!$l(a?8)e=%%pcfqQ2Ai zY06ehJau(_*4wa;z?;*gg_qWb`?pLNr9n-(d$KR|knjWJQycxN&Wlp!I~`%iP@VuA z*ugir$A5msnoz|t~yaY94H$pPDB7EgLO9H!7L00Qf42pn1T$kOD(aA`%M_} z$kYY=!waR#Kz-#*_ps6YB$ydRi@&F{xGO?-=@DS_A3nOa+NcA?td;EI9%l$%We_)eS z`dRO^IjL-9BgoKVG9z`=_U%L@myrIcemh3HH2AZNQC5c94Ts#vTWjWkaE8w`yAa3 z)*<$~x3t;G?L$DSnRbY4^|=B>DV%D>@Q4EbQalFsVpuW$Xc61R!^tfk=(Rj|gFQo-`XVEG$HgJ8W`@c2`-2SvbPi`{7|e=1pDld| z>NP6B!c7?P#e@%i#;E2+n^K$GBBfX)t9G3Dh)K<3Wu^YyVg^18&l>_TzvEnR$33w49eEUP__cJLavFQ!+O)y16a zS#XDOb7Auf=~!b@3CC(NTweqZZ1mK%eYpMtIJmgtl-=0o#d1c)wyk9eZt(yEXSM%R z-`FL@PG3S*GIUJiB<{yu4(A%qOXiFh30-xjt&SfDWsx%vkSd6Cx3DN^{;!0#nR<@a zI>D;Uww^PI;yk>QK+f>CE1I;ln=LdVKyZsp zR7Tb&=cKm>{Q|&@36Vl8n7p82e_mWd(;b%A^L!tKte?=B(OTDKGuuBJq`|@84VVNi z^{|LM)xZ*J(-iuSwdQGQ&PGMgP!MdFI7v8o(FjN7xkNNZ3)TP|D~MF0FpUzS7{PoL zi8vPTn`l^~L_Mn#Yv_&d9z8SRwY$LKTuDch6zGSK?-fv0RMg&iI3G9~CaK4T;!62> ztx=uZAbi?X5FG>TE`!l2{k1dm!l-_L<_)Be*#QP)lm%<{lqp4j z4DQ|;Hsf7PYQQlCG)%^joijL`s*W>boP~f)uY_93o->oXI>z{=2b4U2VJz=C)CcvM z=OY#2UXIZ5QX3DR*l_*LaFGm$+Wm`JM zDJoyo@LvbWUlPRs1*sB=2wnD#;lH`P-vO6`^>s1-?!)gsT>d{?8T#M8jtaCgD*(Xh h54x@LqPA4*R;ZW;LZKSaO2SgYc(`~vKXM98{S#Tm#3=v( literal 0 HcmV?d00001 diff --git a/docs/evidence/two-hop-proxy-headers/README.md b/docs/evidence/two-hop-proxy-headers/README.md new file mode 100644 index 0000000..294f666 --- /dev/null +++ b/docs/evidence/two-hop-proxy-headers/README.md @@ -0,0 +1,120 @@ +# 증거 — 2홉 프록시 헤더 계약 (수정 전 상태) + +`docs/two-hop-proxy-header-contract.md`의 진단을 뒷받침하는 원자료. +**모두 수정 전 상태에서 수집**했으며, 수정 후 재수집하여 대조한다. + +수집 시각: 2026-09-03 15:01~15:03 KST + +| 파일 | 내용 | +|---|---| +| `01-environment.txt` | 세 계층의 설정 스냅샷 | +| `02-measurements.txt` | 정상 경로·대조 실험·위조 테스트·분배·리다이렉트 | +| `03-browser-https-vs-app-http.png` | 브라우저와 앱의 인식 차이 (Playwright) | + +--- + +## 확인된 문제는 둘이다 + +최초 진단은 "Traefik이 덮어쓴다" 하나였으나, 증거 수집 과정에서 +**독립된 원인이 두 개**임이 드러났다. + +### 문제 1 — nginx가 애초에 틀린 값을 보낸다 + +`01-environment.txt` + +``` +26: proxy_set_header Host $host; +27: proxy_set_header X-Forwarded-Host $host; +28: proxy_set_header X-Forwarded-Proto http; ← https 여야 한다 +29: proxy_set_header X-Forwarded-Port 80; ← 443 이어야 한다 +30: proxy_set_header X-Forwarded-For $remote_addr; +31: proxy_set_header X-Real-IP $remote_addr; +``` + +`listen 443 ssl` 서버 블록 안인데 `X-Forwarded-Proto`가 `http`다. +TLS를 종료하는 서버가 "원래 요청은 평문이었다"고 알리고 있다. + +HTTP 전용으로 먼저 세운 뒤 TLS를 얹는 과정에서 **이 두 줄을 함께 바꾸지 +않아 남은 값**이다. 설정 자체는 문법 오류가 없으므로 `nginx -t`도 통과하고, +**아무 경고 없이 잘못된 값이 전파된다.** + +### 문제 2 — Traefik이 올바른 값이 와도 덮어쓴다 + +`02-measurements.txt`의 **대조 실험 [C]** 가 이를 독립적으로 증명한다. +nginx를 우회해 Traefik에 직접 요청하면서 올바른 헤더를 명시했다. + +``` +보낸 것 : X-Forwarded-Proto: https + X-Forwarded-Port: 443 + X-Forwarded-For: 203.0.113.7 + +도달한 것: x-forwarded-proto http + x-forwarded-port 80 + x-forwarded-for 10.42.0.1 +``` + +**세 값 모두 재작성됐다.** Traefik entryPoint에 +`forwardedHeaders.trustedIPs`가 설정되지 않아 들어온 헤더를 신뢰하지 않는다. + +`01-environment.txt`의 Traefik 인자 목록에 `forwardedHeaders` 관련 항목이 +하나도 없는 것이 그 근거다. + +**문제 1만 고쳐서는 해결되지 않는다.** 두 원인이 직렬로 걸려 있다. + +--- + +## 브라우저 증거 + +`03-browser-https-vs-app-http.png` + +같은 요청을 두 관점에서 나란히 찍었다. + +| 브라우저 | 앱(파드) | +|---|---| +| `location.href` = `https://app1.hyeonworks.com/api/echo` | `requestUrl` = `http://app1.hyeonworks.com/api/echo` | +| `protocol` = `https:` | `scheme` = `http` | +| `isSecureContext` = `true` | `secure` = `false` | + +**브라우저는 TLS로 정상 접속했는데 앱은 평문 HTTP 요청으로 인식한다.** +이 상태에서 세션 쿠키에는 `Secure`가 붙지 않고, OAuth2 `redirect_uri`는 +`http://`로 생성된다. + +Playwright로 페이지에 접속한 뒤 `location` 값과 응답 JSON을 한 화면에 +렌더링해 촬영했다. 스크린샷은 뷰포트만 담기고 주소창은 담기지 않으므로, +브라우저 측 값을 페이지 안으로 끌어와 대조가 한 장에 들어오게 했다. + +--- + +## 정상으로 확인된 것 + +증거 수집에서 **문제가 아니라고 확인된 항목**도 함께 남긴다. + +| 항목 | 결과 | +|---|---| +| TLS 종료 | 정상. 실인증서, `isSecureContext=true` | +| `X-Forwarded-Host` | 유지됨 — Traefik이 이것만은 덮어쓰지 않는다 | +| 위조 차단 | 클라이언트가 넣은 `evil.example.com`, `1.2.3.4`가 앱에 도달하지 않음 | +| 파드 분배 | 8회 요청이 두 파드에 정확히 번갈아 도달 | +| HTTP 리다이렉트 | `301 → https://app1.hyeonworks.com/api/echo` | + +**위조가 차단되는 것은 nginx가 막아서가 아니라 Traefik이 전부 덮어쓰기 +때문**이다. 문제 2를 고치면 이 방어가 nginx의 `$remote_addr` 덮어쓰기로 +옮겨간다. 수정 후 재측정에서 **위조가 여전히 막히는지 반드시 확인**해야 한다. + +--- + +## 재수집 방법 + +```bash +# 터미널 증거 +./deploy/lab/scripts/measure-proxy-headers.sh + +# 개별 확인 +curl -s https://app1.hyeonworks.com/api/echo | python3 -m json.tool + +# 대조 실험 (test-server 에서, nginx 우회) +curl -s http://192.168.122.11/api/echo \ + -H 'Host: app1.hyeonworks.com' \ + -H 'X-Forwarded-Proto: https' -H 'X-Forwarded-Port: 443' \ + -H 'X-Forwarded-For: 203.0.113.7' | python3 -m json.tool +``` diff --git a/docs/two-hop-proxy-header-contract.md b/docs/two-hop-proxy-header-contract.md index e8977a4..e3c1f7f 100644 --- a/docs/two-hop-proxy-header-contract.md +++ b/docs/two-hop-proxy-header-contract.md @@ -183,6 +183,59 @@ requestUrl http://app1.hyeonworks.com/api/echo --- +## 5-1. 대조 실험 — 원인이 둘임을 분리한다 + +측정값만으로는 "누가 값을 바꿨는지" 알 수 없다. nginx를 우회해 Traefik에 +직접 요청하여 원인을 분리했다. + +```bash +# test-server 에서, nginx 를 거치지 않고 노드의 Traefik 에 직접 +curl -s http://192.168.122.11/api/echo \ + -H 'Host: app1.hyeonworks.com' \ + -H 'X-Forwarded-Proto: https' \ + -H 'X-Forwarded-Port: 443' \ + -H 'X-Forwarded-For: 203.0.113.7' +``` + +| | 보낸 값 | 도달한 값 | +|---|---|---| +| `X-Forwarded-Proto` | `https` | **`http`** | +| `X-Forwarded-Port` | `443` | **`80`** | +| `X-Forwarded-For` | `203.0.113.7` | **`10.42.0.1`** | + +**올바른 헤더를 명시했는데도 전부 재작성됐다.** Traefik의 덮어쓰기가 +독립적으로 증명된다. + +그리고 이 과정에서 **두 번째 원인**이 드러났다. + +### 원인 A — nginx가 애초에 틀린 값을 보내고 있다 + +`/etc/nginx/sites-available/keycloak-lab`의 443 서버 블록: + +```nginx +listen 443 ssl default_server; +... +proxy_set_header X-Forwarded-Proto http; # ← https 여야 한다 +proxy_set_header X-Forwarded-Port 80; # ← 443 이어야 한다 +``` + +**TLS를 종료하는 서버가 "원래 요청은 평문이었다"고 알리고 있다.** +HTTP 전용으로 먼저 세운 뒤 TLS를 얹는 과정에서 이 두 줄을 함께 바꾸지 않아 +남은 값이다. + +문법 오류가 아니므로 `nginx -t`도 통과하고 **아무 경고 없이 잘못된 값이 +전파된다.** 이런 종류의 실수는 측정 없이는 드러나지 않는다. + +### 원인 B — Traefik이 올바른 값이 와도 덮어쓴다 + +위 대조 실험이 보여준 것이다. `forwardedHeaders.trustedIPs` 미설정. + +**두 원인은 직렬로 걸려 있다. A만 고쳐도 B 때문에 해결되지 않는다.** + +> 증거 원자료: `docs/evidence/two-hop-proxy-headers/` + +--- + ## 6. 원인 — 독립된 스위치 세 개 이 사슬에는 **각각 따로 켜야 하는 스위치가 세 개** 있다.