From bcb563a04e922092a886833b5bbf28bffa966b65 Mon Sep 17 00:00:00 2001 From: DongHyeonka Date: Fri, 4 Sep 2026 14:44:00 +0900 Subject: [PATCH] =?UTF-8?q?docs:=20B-7=20=E2=80=94=20the=20cookie=20secret?= =?UTF-8?q?=20has=20no=20overlap=20window=20and=20rotation=20orphans=20ses?= =?UTF-8?q?sions?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit oauth2-proxy carries the authorization request in a signed cookie, so the callback can land on a different replica and still succeed, which is the opposite of the BFF failure in B-0. Sharing is therefore just sharing one Secret. Rotating it is all-or-nothing: --cookie-secret is singular, so there is no second key to read old tickets with, and the log shows both the validation failure and Error removing session, leaving the Redis session orphaned because the key cannot be derived from a ticket that will not decode. Getting there required two diagnoses: the callback 502 came from the full session riding in Set-Cookie past nginx's buffer, and every earlier attempt to read nginx config returned nothing because sudo on the host asks for a password while the guests do not. Co-Authored-By: Claude Opus 5 --- .../console-2026-09-04T05-35-58-200Z.log | 2 + .../console-2026-09-04T05-36-21-060Z.log | 2 + .../console-2026-09-04T05-38-20-492Z.log | 2 + .../console-2026-09-04T05-41-10-043Z.log | 1 + .../console-2026-09-04T05-42-18-456Z.log | 1 + .../page-2026-09-04T05-35-58-525Z.yml | 4 + .../page-2026-09-04T05-36-21-375Z.yml | 4 + .../page-2026-09-04T05-38-20-832Z.yml | 4 + .../page-2026-09-04T05-41-10-348Z.yml | 1 + .../page-2026-09-04T05-42-18-721Z.yml | 1 + deploy/lab/k8s/b7-oauth2-proxy.yaml | 128 +++++++++ docs/evidence/b7-cookie-secret/01-deploy.txt | 13 + .../02-cookie-portability.txt | 9 + .../evidence/b7-cookie-secret/03-rotation.txt | 31 +++ docs/evidence/b7-cookie-secret/README.md | 18 ++ .../b7-oauth2proxy-login-success.png | Bin 0 -> 128427 bytes docs/experiment-b7-cookie-secret-rotation.md | 250 ++++++++++++++++++ 17 files changed, 471 insertions(+) create mode 100644 .playwright-mcp/console-2026-09-04T05-35-58-200Z.log create mode 100644 .playwright-mcp/console-2026-09-04T05-36-21-060Z.log create mode 100644 .playwright-mcp/console-2026-09-04T05-38-20-492Z.log create mode 100644 .playwright-mcp/console-2026-09-04T05-41-10-043Z.log create mode 100644 .playwright-mcp/console-2026-09-04T05-42-18-456Z.log create mode 100644 .playwright-mcp/page-2026-09-04T05-35-58-525Z.yml create mode 100644 .playwright-mcp/page-2026-09-04T05-36-21-375Z.yml create mode 100644 .playwright-mcp/page-2026-09-04T05-38-20-832Z.yml create mode 100644 .playwright-mcp/page-2026-09-04T05-41-10-348Z.yml create mode 100644 .playwright-mcp/page-2026-09-04T05-42-18-721Z.yml create mode 100644 deploy/lab/k8s/b7-oauth2-proxy.yaml create mode 100644 docs/evidence/b7-cookie-secret/01-deploy.txt create mode 100644 docs/evidence/b7-cookie-secret/02-cookie-portability.txt create mode 100644 docs/evidence/b7-cookie-secret/03-rotation.txt create mode 100644 docs/evidence/b7-cookie-secret/README.md create mode 100644 docs/evidence/b7-cookie-secret/b7-oauth2proxy-login-success.png create mode 100644 docs/experiment-b7-cookie-secret-rotation.md diff --git a/.playwright-mcp/console-2026-09-04T05-35-58-200Z.log b/.playwright-mcp/console-2026-09-04T05-35-58-200Z.log new file mode 100644 index 0000000..f247832 --- /dev/null +++ b/.playwright-mcp/console-2026-09-04T05-35-58-200Z.log @@ -0,0 +1,2 @@ +[ 275ms] [ERROR] Failed to load resource: the server responded with a status of 502 () @ https://app2.hyeonworks.com/oauth2/callback?state=G2-BDWkehNWO7hGwhYCxXBVRKZ6AomLIrSLBtIXr0Gw%3A%2Fapi%2Fecho&session_state=vsW8xDlLJN3DUl-0B-X1WL7Q&iss=https%3A%2F%2Fauth.hyeonworks.com%2Frealms%2Fkeycloak-patterns&code=4155f58e-6a58-e47b-93bd-7e2b625c2b91.vsW8xDlLJN3DUl-0B-X1WL7Q.80431dbc-af81-4673-9790-ad06d1570b2e:0 +[ 408ms] [ERROR] Failed to load resource: the server responded with a status of 502 () @ https://app2.hyeonworks.com/oauth2/callback?state=Da-7OcMB4f7vyHgr-6CqrTtJpmj1R_SfRfcE3CUJNzE%3A%2Ffavicon.ico&session_state=vsW8xDlLJN3DUl-0B-X1WL7Q&iss=https%3A%2F%2Fauth.hyeonworks.com%2Frealms%2Fkeycloak-patterns&code=96d66247-91b0-0cc1-89dc-e527c2b69bf2.vsW8xDlLJN3DUl-0B-X1WL7Q.80431dbc-af81-4673-9790-ad06d1570b2e:0 diff --git a/.playwright-mcp/console-2026-09-04T05-36-21-060Z.log b/.playwright-mcp/console-2026-09-04T05-36-21-060Z.log new file mode 100644 index 0000000..d459a02 --- /dev/null +++ b/.playwright-mcp/console-2026-09-04T05-36-21-060Z.log @@ -0,0 +1,2 @@ +[ 266ms] [ERROR] Failed to load resource: the server responded with a status of 502 () @ https://app2.hyeonworks.com/oauth2/callback?state=TZnQvjIWCEySrf4PMg2WLVFoOfkyOJWB58f2LGjVfpo%3A%2Fapi%2Fecho&session_state=vsW8xDlLJN3DUl-0B-X1WL7Q&iss=https%3A%2F%2Fauth.hyeonworks.com%2Frealms%2Fkeycloak-patterns&code=8ae913a1-2647-0ed9-625e-3d80e1565024.vsW8xDlLJN3DUl-0B-X1WL7Q.80431dbc-af81-4673-9790-ad06d1570b2e:0 +[ 416ms] [ERROR] Failed to load resource: the server responded with a status of 502 () @ https://app2.hyeonworks.com/oauth2/callback?state=uAYwZp59ncz95XjkJXAlIgsT7oksBQBViiQS07t2eow%3A%2Ffavicon.ico&session_state=vsW8xDlLJN3DUl-0B-X1WL7Q&iss=https%3A%2F%2Fauth.hyeonworks.com%2Frealms%2Fkeycloak-patterns&code=7b7fc816-0b27-93a0-83b8-656488813253.vsW8xDlLJN3DUl-0B-X1WL7Q.80431dbc-af81-4673-9790-ad06d1570b2e:0 diff --git a/.playwright-mcp/console-2026-09-04T05-38-20-492Z.log b/.playwright-mcp/console-2026-09-04T05-38-20-492Z.log new file mode 100644 index 0000000..e8f363a --- /dev/null +++ b/.playwright-mcp/console-2026-09-04T05-38-20-492Z.log @@ -0,0 +1,2 @@ +[ 287ms] [ERROR] Failed to load resource: the server responded with a status of 502 () @ https://app2.hyeonworks.com/oauth2/callback?state=0EOFj1PoLyPil0dgukpi7zKW4JKnGZTP9Wj6EhTR-lw%3A%2Fapi%2Fecho&session_state=vsW8xDlLJN3DUl-0B-X1WL7Q&iss=https%3A%2F%2Fauth.hyeonworks.com%2Frealms%2Fkeycloak-patterns&code=d13cc206-133f-00a9-9908-599988c4d7cf.vsW8xDlLJN3DUl-0B-X1WL7Q.80431dbc-af81-4673-9790-ad06d1570b2e:0 +[ 457ms] [ERROR] Failed to load resource: the server responded with a status of 502 () @ https://app2.hyeonworks.com/oauth2/callback?state=kbYC5O4_ELsoQFw85vyYfgWEqlI2yWImB4rmelbmSTM%3A%2Ffavicon.ico&session_state=vsW8xDlLJN3DUl-0B-X1WL7Q&iss=https%3A%2F%2Fauth.hyeonworks.com%2Frealms%2Fkeycloak-patterns&code=91f9fde9-f376-b6f3-4622-a1ba674cc4fd.vsW8xDlLJN3DUl-0B-X1WL7Q.80431dbc-af81-4673-9790-ad06d1570b2e:0 diff --git a/.playwright-mcp/console-2026-09-04T05-41-10-043Z.log b/.playwright-mcp/console-2026-09-04T05-41-10-043Z.log new file mode 100644 index 0000000..290faa7 --- /dev/null +++ b/.playwright-mcp/console-2026-09-04T05-41-10-043Z.log @@ -0,0 +1 @@ +[ 307ms] [ERROR] Failed to load resource: the server responded with a status of 401 () @ https://app2.hyeonworks.com/favicon.ico:0 diff --git a/.playwright-mcp/console-2026-09-04T05-42-18-456Z.log b/.playwright-mcp/console-2026-09-04T05-42-18-456Z.log new file mode 100644 index 0000000..6356b48 --- /dev/null +++ b/.playwright-mcp/console-2026-09-04T05-42-18-456Z.log @@ -0,0 +1 @@ +[ 261ms] [ERROR] Failed to load resource: the server responded with a status of 401 () @ https://app2.hyeonworks.com/favicon.ico:0 diff --git a/.playwright-mcp/page-2026-09-04T05-35-58-525Z.yml b/.playwright-mcp/page-2026-09-04T05-35-58-525Z.yml new file mode 100644 index 0000000..f0e2fee --- /dev/null +++ b/.playwright-mcp/page-2026-09-04T05-35-58-525Z.yml @@ -0,0 +1,4 @@ +- generic [active] [ref=f40e1]: + - heading "502 Bad Gateway" [level=1] [ref=f40e3] + - separator [ref=f40e4] + - generic [ref=f40e5]: nginx/1.30.4 \ No newline at end of file diff --git a/.playwright-mcp/page-2026-09-04T05-36-21-375Z.yml b/.playwright-mcp/page-2026-09-04T05-36-21-375Z.yml new file mode 100644 index 0000000..b9d2683 --- /dev/null +++ b/.playwright-mcp/page-2026-09-04T05-36-21-375Z.yml @@ -0,0 +1,4 @@ +- generic [active] [ref=f41e1]: + - heading "502 Bad Gateway" [level=1] [ref=f41e3] + - separator [ref=f41e4] + - generic [ref=f41e5]: nginx/1.30.4 \ No newline at end of file diff --git a/.playwright-mcp/page-2026-09-04T05-38-20-832Z.yml b/.playwright-mcp/page-2026-09-04T05-38-20-832Z.yml new file mode 100644 index 0000000..2efbaa8 --- /dev/null +++ b/.playwright-mcp/page-2026-09-04T05-38-20-832Z.yml @@ -0,0 +1,4 @@ +- generic [active] [ref=f42e1]: + - heading "502 Bad Gateway" [level=1] [ref=f42e3] + - separator [ref=f42e4] + - generic [ref=f42e5]: nginx/1.30.4 \ No newline at end of file diff --git a/.playwright-mcp/page-2026-09-04T05-41-10-348Z.yml b/.playwright-mcp/page-2026-09-04T05-41-10-348Z.yml new file mode 100644 index 0000000..1906819 --- /dev/null +++ b/.playwright-mcp/page-2026-09-04T05-41-10-348Z.yml @@ -0,0 +1 @@ +- generic [active] [ref=f43e1]: "{ \"headers\" : { \"host\" : [ \"app2.hyeonworks.com\" ], \"user-agent\" : [ \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36\" ], \"accept\" : [ \"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\" ], \"accept-encoding\" : [ \"gzip, deflate, br, zstd\" ], \"accept-language\" : [ \"en-US,en;q=0.9\" ], \"cookie\" : [ \"grafana_session=60c3e7ae41ffc00665f4a2c377def399; grafana_session_expiry=1788497124; _oauth2_proxy=djIuWDI5aGRYUm9NbDl3Y205NGVTMWlNall4TVRGbVltUXhabVJoWWpOaFpUSXhPREpsTWpnM01EQXhZakF5WVEuTk81VE82RHRod2NWZWstaHpPZVg1Zw==|1788500470|iPSRUlwHDB0XgC6sUdU4dq1EHq9WQDPYrDoezajKVUA=\" ], \"priority\" : [ \"u=0, i\" ], \"sec-ch-ua\" : [ \"\\\"Chromium\\\";v=\\\"152\\\", \\\"Not?A_Brand\\\";v=\\\"24\\\", \\\"Google Chrome\\\";v=\\\"152\\\"\" ], \"sec-ch-ua-mobile\" : [ \"?0\" ], \"sec-ch-ua-platform\" : [ \"\\\"Linux\\\"\" ], \"sec-fetch-dest\" : [ \"document\" ], \"sec-fetch-mode\" : [ \"navigate\" ], \"sec-fetch-site\" : [ \"none\" ], \"sec-fetch-user\" : [ \"?1\" ], \"upgrade-insecure-requests\" : [ \"1\" ], \"x-forwarded-email\" : [ \"labuser@example.com\" ], \"x-forwarded-host\" : [ \"app2.hyeonworks.com\" ], \"x-forwarded-port\" : [ \"443\" ], \"x-forwarded-preferred-username\" : [ \"labuser\" ], \"x-forwarded-proto\" : [ \"https\" ], \"x-forwarded-server\" : [ \"traefik-5d6fcf895-wpfhr\" ], \"x-forwarded-user\" : [ \"27df5ea9-8703-4ec5-badd-d972c583e1ff\" ], \"x-real-ip\" : [ \"100.123.124.30\" ] }, \"remoteAddr\" : \"100.123.124.30\", \"localAddr\" : \"10.42.0.53\", \"scheme\" : \"https\", \"secure\" : true, \"serverName\" : \"app2.hyeonworks.com\", \"serverPort\" : 443, \"requestUrl\" : \"https://app2.hyeonworks.com/api/echo\" }" \ No newline at end of file diff --git a/.playwright-mcp/page-2026-09-04T05-42-18-721Z.yml b/.playwright-mcp/page-2026-09-04T05-42-18-721Z.yml new file mode 100644 index 0000000..240fbda --- /dev/null +++ b/.playwright-mcp/page-2026-09-04T05-42-18-721Z.yml @@ -0,0 +1 @@ +- generic [active] [ref=f44e1]: "{ \"headers\" : { \"host\" : [ \"app2.hyeonworks.com\" ], \"user-agent\" : [ \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36\" ], \"accept\" : [ \"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\" ], \"accept-encoding\" : [ \"gzip, deflate, br, zstd\" ], \"accept-language\" : [ \"en-US,en;q=0.9\" ], \"cookie\" : [ \"grafana_session=60c3e7ae41ffc00665f4a2c377def399; grafana_session_expiry=1788497124; _oauth2_proxy=djIuWDI5aGRYUm9NbDl3Y205NGVTMDVOemhrWm1GbFptSmtZV1JqWTJJNU5tTTNZbVV4TmpJMVpHSmhOVFl4TmcucmoxSnJPYjJKOW1ZV191aXVWa2FCZw==|1788500538|RoiStOeQcIDldxB3cckyO-OAiMgBjBfw5gOSvUsgTFU=\" ], \"priority\" : [ \"u=0, i\" ], \"sec-ch-ua\" : [ \"\\\"Chromium\\\";v=\\\"152\\\", \\\"Not?A_Brand\\\";v=\\\"24\\\", \\\"Google Chrome\\\";v=\\\"152\\\"\" ], \"sec-ch-ua-mobile\" : [ \"?0\" ], \"sec-ch-ua-platform\" : [ \"\\\"Linux\\\"\" ], \"sec-fetch-dest\" : [ \"document\" ], \"sec-fetch-mode\" : [ \"navigate\" ], \"sec-fetch-site\" : [ \"none\" ], \"sec-fetch-user\" : [ \"?1\" ], \"upgrade-insecure-requests\" : [ \"1\" ], \"x-forwarded-email\" : [ \"labuser@example.com\" ], \"x-forwarded-host\" : [ \"app2.hyeonworks.com\" ], \"x-forwarded-port\" : [ \"443\" ], \"x-forwarded-preferred-username\" : [ \"labuser\" ], \"x-forwarded-proto\" : [ \"https\" ], \"x-forwarded-server\" : [ \"traefik-5d6fcf895-wpfhr\" ], \"x-forwarded-user\" : [ \"27df5ea9-8703-4ec5-badd-d972c583e1ff\" ], \"x-real-ip\" : [ \"100.123.124.30\" ] }, \"remoteAddr\" : \"100.123.124.30\", \"localAddr\" : \"10.42.1.132\", \"scheme\" : \"https\", \"secure\" : true, \"serverName\" : \"app2.hyeonworks.com\", \"serverPort\" : 443, \"requestUrl\" : \"https://app2.hyeonworks.com/api/echo\" }" \ No newline at end of file diff --git a/deploy/lab/k8s/b7-oauth2-proxy.yaml b/deploy/lab/k8s/b7-oauth2-proxy.yaml new file mode 100644 index 0000000..40610ba --- /dev/null +++ b/deploy/lab/k8s/b7-oauth2-proxy.yaml @@ -0,0 +1,128 @@ +# Experiment B-7 — oauth2-proxy, to measure how replicas share a cookie secret +# and what happens when it is rotated (Q1, unknown 7). +# +# This is a different shape of problem from the BFF. The BFF keeps state on the +# server, so the question was "which store". oauth2-proxy keeps no server state +# at all: the whole session rides in a cookie that is signed and encrypted with +# --cookie-secret. So there is nothing to share and nothing to lose on restart — +# instead, every replica must hold the *same* secret, and changing it invalidates +# every cookie at once. +# +# kubectl apply -f deploy/lab/k8s/b7-oauth2-proxy.yaml +# +# app2.hyeonworks.com is borrowed from Grafana for the duration of this +# experiment; the certificate only covers auth / app1 / app2, so a fourth name +# is not available. Grafana's Ingress is restored afterwards. +apiVersion: v1 +kind: Secret +metadata: + name: oauth2-proxy-secrets + namespace: keycloak-lab +type: Opaque +stringData: + # oauth2-proxy requires exactly 16, 24 or 32 bytes. This is the value whose + # rotation the experiment is about. + COOKIE_SECRET_A: "lab-cookie-secret-aaaaaaaaaaaaaa" + COOKIE_SECRET_B: "lab-cookie-secret-bbbbbbbbbbbbbb" + CLIENT_SECRET: proxy-lab-secret +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: oauth2-proxy + namespace: keycloak-lab +spec: + # Two replicas is the point: Q1 asks how they share the secret. + replicas: 2 + selector: + matchLabels: { app: oauth2-proxy } + template: + metadata: + labels: { app: oauth2-proxy } + spec: + # See B-1: Kubernetes injects _PORT as a tcp:// URL and it + # collides with ordinary configuration names. + enableServiceLinks: false + topologySpreadConstraints: + - maxSkew: 1 + topologyKey: kubernetes.io/hostname + whenUnsatisfiable: ScheduleAnyway + labelSelector: + matchLabels: { app: oauth2-proxy } + containers: + - name: oauth2-proxy + image: quay.io/oauth2-proxy/oauth2-proxy:v7.7.1 + args: + - --provider=oidc + - --oidc-issuer-url=https://auth.hyeonworks.com/realms/keycloak-patterns + - --client-id=oauth2-proxy + - --redirect-url=https://app2.hyeonworks.com/oauth2/callback + - --email-domain=* + - --http-address=0.0.0.0:4180 + # The upstream is the same echo app the B-4 header experiment used, + # so what the proxy forwards can be read straight off the response. + - --upstream=http://echo.header-lab.svc:8081 + # ★ 이 옵션을 켜면 세션(=쿠키)에 access token 이 들어간다. + # 그러면 Set-Cookie 가 커져 프록시 앞단에서 502 가 났다. + # B-4 에서 본 헤더 크기 절벽이 이번에는 응답 쪽에서 나타난 것이다. + # - --pass-authorization-header=true + - --set-xauthrequest=true + - --reverse-proxy=true + - --cookie-secure=true + # One hour, matching the value Q1 records for the current setup. + - --cookie-expire=1h + - --skip-provider-button=true + # ★ 쿠키에 세션 전체를 담으면 Set-Cookie 가 커지고, 그 응답이 + # 앞단 nginx 의 proxy_buffer 를 넘겨 502 가 났다(측정됨). + # Redis 로 옮기면 쿠키에는 티켓만 남는다 — 그리고 그 순간 + # "replica 가 secret 을 공유해야 한다"는 문제의 성격도 바뀐다. + - --session-store-type=redis + - --redis-connection-url=redis://redis.keycloak-lab.svc:6379 + env: + - name: OAUTH2_PROXY_CLIENT_SECRET + valueFrom: + secretKeyRef: { name: oauth2-proxy-secrets, key: CLIENT_SECRET } + # Which of the two secrets is in use is switched here. Both replicas + # read the same key, which is exactly the sharing Q1 asks about. + - name: OAUTH2_PROXY_COOKIE_SECRET + valueFrom: + secretKeyRef: { name: oauth2-proxy-secrets, key: COOKIE_SECRET_A } + ports: + - containerPort: 4180 + name: http + readinessProbe: + httpGet: { path: /ping, port: http } + initialDelaySeconds: 5 + resources: + requests: { memory: 32Mi, cpu: 20m } + limits: { memory: 128Mi } +--- +apiVersion: v1 +kind: Service +metadata: + name: oauth2-proxy + namespace: keycloak-lab +spec: + selector: { app: oauth2-proxy } + ports: + - port: 4180 + targetPort: http +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: oauth2-proxy + namespace: keycloak-lab +spec: + ingressClassName: traefik + rules: + - host: app2.hyeonworks.com + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: oauth2-proxy + port: + number: 4180 diff --git a/docs/evidence/b7-cookie-secret/01-deploy.txt b/docs/evidence/b7-cookie-secret/01-deploy.txt new file mode 100644 index 0000000..19f40c2 --- /dev/null +++ b/docs/evidence/b7-cookie-secret/01-deploy.txt @@ -0,0 +1,13 @@ +=== Grafana ingress 를 잠시 내린다 (app2 를 빌린다) === + grafana ingress 삭제 +secret/oauth2-proxy-secrets created +deployment.apps/oauth2-proxy created +service/oauth2-proxy created +ingress.networking.k8s.io/oauth2-proxy created +deployment "oauth2-proxy" successfully rolled out +oauth2-proxy-c76b49c59-8p5hl true kc-lab-1 +oauth2-proxy-c76b49c59-b9928 true kc-lab-2 + +=== 진입점 확인 === + https://app2.hyeonworks.com/ HTTP 302 + /ping HTTP 200 diff --git a/docs/evidence/b7-cookie-secret/02-cookie-portability.txt b/docs/evidence/b7-cookie-secret/02-cookie-portability.txt new file mode 100644 index 0000000..d19d6fb --- /dev/null +++ b/docs/evidence/b7-cookie-secret/02-cookie-portability.txt @@ -0,0 +1,9 @@ +=== curl 로 OAuth 흐름을 완주한다 (nginx 우회, Traefik 직접) === + 로그인 폼 action: https://auth.hyeonworks.com/realms/keycloak-patterns/login-actions/authenticate?session_co... + 쿠키 항아리: + len=0 + KC_AUTH_SESSION_HASH len=64 + +=== 두 replica 모두 이 쿠키를 받아들이는가 === + 10.42.1.135 /oauth2/auth HTTP 000 + 10.42.1.134 /oauth2/auth HTTP 000 diff --git a/docs/evidence/b7-cookie-secret/03-rotation.txt b/docs/evidence/b7-cookie-secret/03-rotation.txt new file mode 100644 index 0000000..7aef6be --- /dev/null +++ b/docs/evidence/b7-cookie-secret/03-rotation.txt @@ -0,0 +1,31 @@ +=== 세션이 Redis 에 들어갔는가 === +b5:pvc +_oauth2_proxy-b26111fbd1fdab3ae2182e287001b02a + dbsize: 2 + +=== oauth2-proxy 가 cookie secret 을 여러 개 받는가 === + --cookie-secret string the seed string for secure cookies (optionally base64 encoded) + +=== ★ secret 을 A → B 로 교체한다 === +deployment.apps/oauth2-proxy patched +deployment "oauth2-proxy" successfully rolled out + 현재 secret 키: COOKIE_SECRET_B + Redis 세션은 그대로인가: 2 키 +=== secret 교체 후 oauth2-proxy 로그 — 옛 쿠키를 어떻게 처리했나 === +[2026/09/04 05:41:46] [oauthproxy.go:178] Cookie settings: name:_oauth2_proxy secure(https):true httponly:true expiry:1h0m0s domains: path:/ samesite: refresh:disabled +[2026/09/04 05:42:18] [oauthproxy.go:1024] No valid authentication in request. Initiating login. +100.123.124.30 - cb8c0ec1-1d87-479c-9aef-e1d9158a5829 - - [2026/09/04 05:42:18] app2.hyeonworks.com GET - "/api/echo" HTTP/1.1 "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, lik +[2026/09/04 05:42:18] [stored_session.go:94] Error loading cookied session: session ticket cookie failed validation: , removing session +[2026/09/04 05:42:18] [stored_session.go:97] Error removing session: error decoding ticket to clear session: session ticket cookie failed validation: +100.123.124.30 - 28af938f-08b5-4e15-9094-8d9591a18a3f - labuser@example.com [2026/09/04 05:42:18] app2.hyeonworks.com GET / "/api/echo" HTTP/1.1 "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/ +[2026/09/04 05:41:58] [providers.go:146] Warning: Your provider supports PKCE methods ["plain" "S256"], but you have not enabled one with --code-challenge-method +[2026/09/04 05:41:58] [oauthproxy.go:172] OAuthProxy configured for OpenID Connect Client ID: oauth2-proxy +[2026/09/04 05:41:58] [oauthproxy.go:178] Cookie settings: name:_oauth2_proxy secure(https):true httponly:true expiry:1h0m0s domains: path:/ samesite: refresh:disabled +100.123.124.30 - 5a08219f-60e0-4c97-bfee-78cae8891ca8 - labuser@example.com [2026/09/04 05:42:18] [AuthSuccess] Authenticated via OAuth2: Session{email:labuser@example.com user:27df5ea9-8703 +100.123.124.30 - 5a08219f-60e0-4c97-bfee-78cae8891ca8 - - [2026/09/04 05:42:18] app2.hyeonworks.com GET - "/oauth2/callback?state=j7eKInWCrYqRyi5LVDGDjtLrIBJCpwdkmzoJVdhJUc0%3A%2Fapi%2Fecho& +100.123.124.30 - a3074807-5143-49b9-b77c-e7e2eb90ac24 - labuser@example.com [2026/09/04 05:42:18] app2.hyeonworks.com GET / "/favicon.ico" HTTP/1.1 "Mozilla/5.0 (X11; Linux x86_64) AppleWebK + +=== Redis 세션 수 (옛 세션이 남아 있는가) === + _oauth2_proxy-978dfaefbdadccb96c7be1625dba5616 + _oauth2_proxy-b26111fbd1fdab3ae2182e287001b02a + 총: 2 개 diff --git a/docs/evidence/b7-cookie-secret/README.md b/docs/evidence/b7-cookie-secret/README.md new file mode 100644 index 0000000..1b4d566 --- /dev/null +++ b/docs/evidence/b7-cookie-secret/README.md @@ -0,0 +1,18 @@ +# B-7 — oauth2-proxy cookie secret 교체 증거 + +2026-09-04 16:00–16:15 KST +해설: [`docs/experiment-b7-cookie-secret-rotation.md`](../../experiment-b7-cookie-secret-rotation.md) + +| 파일 | 무엇을 보여주는가 | +|---|---| +| `01-deploy.txt` | 양 노드에 replica 하나씩. `/` 302, `/ping` 200 | +| `02-cookie-portability.txt` | curl 로 흐름을 완주하려던 시도 — 파드 IP 는 호스트에서 안 닿는다 | +| `03-rotation.txt` | **`--cookie-secret string` 단수 확인** · 교체 후 `session ticket cookie failed validation` · **`Error removing session`** · Redis 에 **고아 세션 2개** | +| `b7-oauth2proxy-login-success.png` | Redis 세션 전환 후 성공한 Forward-Auth — `x-forwarded-user/email/preferred-username` 과 **티켓 형태 쿠키** | + +## 핵심 네 줄 + +1. **BFF 와 정반대다.** 인가 요청이 쿠키에 있어 **콜백이 다른 replica 로 가도 성공**한다 — B-0 에서 BFF 가 실패한 바로 그 지점. +2. **502 의 원인은 큰 쿠키였다.** Traefik 직접은 정상이고 nginx 만 502 — B-4 의 헤더 절벽이 응답 쪽에서 재현됐다. +3. **겹침 구간을 만들 수 없다.** `--cookie-secret` 이 단수라 B-6 의 무중단 회전이 불가능하다. +4. **교체하면 서버 세션이 고아로 남는다.** 티켓을 못 푸니 지울 수도 없다. diff --git a/docs/evidence/b7-cookie-secret/b7-oauth2proxy-login-success.png b/docs/evidence/b7-cookie-secret/b7-oauth2proxy-login-success.png new file mode 100644 index 0000000000000000000000000000000000000000..1cd5b20fa84b7fe50a85c75667ebb341923db88f GIT binary patch literal 128427 zcmbsQWl&t(^F0m+2oM~C26uONx8Rl#B)DsEhv4q+?gWCn2X}XOcNu12{@k17em}qG z?NbF+BQ@vr-lx0Q?$xV9l@z3q;Bn#Kym^E4QCeK(%^N7|*MH-8kguQU^#)zOd4u}q zqqvBgYsTrb&o^|9jzhR2U}#fmy9poWf}CjwOI0SaN1EEEM=az6opGH<&k+kt5{v=8 zKuYkf9^~{-1Qiyoq+xU<3$VzL8a;(_b%I3S8$W_~p=$=@on}HK=zApXQ0H3j=wAzzlPck-bE@@tNtgjNM_M+CY(;IG|9e4bo@OV6Dk zlzC(E7eFWYGTX%y1O)%Mw)Lf|2||N=)A?iT#~+j3z|@t|pd%)QmvhCNX(BLiQ_$$P z7d*}Ngfa;1+5nxsfM;@bUl3nc{jV`?j!9>=Q@KKxD<^;|$tFI8XyKhPdZuNUyX2@)NAkD{({2C?wqW($Vn-`Ph1nQe~E< z9@q)czsPzn_IVfx*7X8036ne!0Bv7hoPY{{p3XYQ=kr<`5CA2<6Fj2}KC8|K*Evc6 zb`HfK62bQ;?O?>`5h0NB3r!fPbt?L62ly!Yg|1XU2sm@rb%f$2^n5(r2?A6pZh%_A z(Y>%JpckQ5JO5`1o+Oa$#N39Pur^Rv8_*iwc~hUvln?f_Jx~+^alPKl$NTVr`Z{^^ z!W$gz1Joawu$0IFUn%;OJ%G=TU$UR8@`=FML_l!q)AY9O%d?QDz*DEE-Oh$Kpih_1 z=cUm{5)AJ-zd?uqK96Y-wBLh$0SYOCuMYh4)#-;XCJ3J{SJgW^+)lA)bD1QOeVgt( zNN#Jv=e4?Eq<@0oA9v7*&l9?4@@cEPIKTxiH}lDkM7HW z58Ktn7_9g6gaxA!=tTDvz;ypc7X8_@bA1D#?(<0W^7AlG{AGV3_+x0)o-B{;0qPH3C_VKz$@p-z*248oQ;X!kpFFg>w*xmX(&gi}@Y(y8u=)N3u zf;6UHR9{>R8($ZH@p7`kWDR(YyxOPEY40bx3W!fHjY1>FeAiVkPo_e^^t-dcd6L5o zy_9>>+w2@^5oP$_sRZ?%5xUhaNLp{~`SjqdgASYtP8O2zM)i3nasr!nHeFXq`G6OE zKu}L76U!qj`jfi&c(GCKu0lWcuwMioIYJCaZs4D|gnF??D#g4Hn*|4DT_JzxnZf8V zq=Q<3+kvkxUA``;vG8ZjHHy!p*ZoA{#u4)-c0v*OHu;l6N9PO8i@FbB=XIZk54oOh z#-DwFo!W4q4R5eIfd|-T>{BTCai9vEt?U1$r346OF?+Qde}xxazp zG9Bhz+5kOGc0NVFY`*YuXs;1~fY)*2x7p86T}-h;FRj^U)h}zy<73$`+t|ZnUXeKK zA7UPSupY66s_ZVZ!5&~=u;WA)nDr6p0|YWfT`b*X6Fxq6Y8fI?Eju5k>?yt=*GGUs zw-;O<0hE9DCXg$ALJ|PH0V1!hfak!^DGjnkPhMGVu{V~FR-AWtpPb^(m)?9gU{&7>(cOjM=tu82kv#v0w z^xDnA1loT-MtS+Ywx11?fQwH zQYkV1Td9Rg0~taXJ039xPY}4n1X#Z~wcbDh| z#1zq73)YPiNLgJZ@c*~G*RRBbwU`vcmrBU62?(+O+i4>LjGblbj+vf1T7IUXzdQW4 zhBF*!b^9)iREF?B+vdBcy{(;$jUfK-6EU~W2IRhPYMvRGSpRoPd8`{!gIj$rvd2-a zJ7y-*zk4ZvoF(KF^#@9YiSc%+{_lQv|NH2e#-b7=ff1C7_JnS3gW8=-uIwc3TCIZ! z?;k?Pqz~`ZbXER7&vkW9Ln&Gm(XZA~i>f5fU5j@b_g|M2RAb&tMc(RZKJ_c6>x5<& zk46Pn!WB8tuz1Xck^Qmsf{wZJxhA$SBg%*#14cDb>|Ymgt8y!KE+8!$Uy4|{b*~w5 zDED+#5>fD3T9~saSutSN^a?F59JziD0e?%j)B3vhxue-nsw`vC6WC7c}8UHki%4`2~y3gd?oDF9jOb_mGnUo$ah#@<_T|*a^*eaWG zty6#3>hW8$HF5L$rMt)oT)}U9e1+F-UzeE2ea3&p%7IhzY%?!P|Fo7+tgSg9Ig@%Q zLN16SJzBOMmqw52{26eoioMPwB`#NFLT}9W|@T!d6^uP4T@+3GEt*2ukC6mK4~t= z?_9C_yl>oJKjjWd=l-Z95Jv4L0TFAX9M?2s!qB0u-nfS5K^}Hf7O(7$dP8u?`u^A! zah{p!AQm!j_ZPlsjKqkdDRCO&vSJv0==4sAp~n@C`^`}uu}pZbMI9j(?&lP1vv4}s zDf#sqwoL#`?ZN)Z;H3Zg^|~9U!vTJ32ma9T-?Rf9ll@8r*v=D9AjYFHwb}=~H*ge+ zqQ8uV5L(!bkP8J|WFN%Y$gl}3L+MY_*wYL&l1^Zc31RfYUHh|@uGS0`Or#tquLJ#V zPzvwegMGLd1ZBUjMT<`aH7z*2MUhP7qi_19DE22^4g$yN)~g~@@ts+{SQ1<-Gy=j# z6^o#)i6Z=RjQ9*Kx+nd*BJKMEW6Tf?DFPqWX*Mkrh{Vaz3-4l$8pD;}chenhn_wGr zj;&RhrjKXwEa7SX@EnyK@CT_2V|Aj3fD#F*17VW?~LM>?fddy-ZlCDzpwuX z6xwL`R6b^Na`72X^R-rKwCqhc)kdmxw%qf z{A18MicUL$#{Z_K?s@b;lrwX0J1eY8z6g&VkX6luIFM3zsCqMKZJn=qb+Ni$mAIp& zhq`uXk_L9|pA=+f@+69WQIdFvOzI#QKE=jpBy_<_81l|Cb^r0DR%rg;gVrjp;9{p{~lK@3l;hM4EBGQ=ks4?QB#6TW|1KfR19_L*PYnyW`E#rE=P$ zrh4O;8J-+{%fc=YEqbn^aHo=uw-@Ahe6$Ng;22ECP4n#lzb>%o0TAafNV%l9o<@ZH zNDAI!+-YcO`4M0jO?53??i+Zj1p8RrJFm~FD*0r_%@;k}6m{;H1xPV=j&+UieETF#U3zL9k{BfO6G6sWVRxxtFmsVx?HRDuY5`L9Thl@=|0c zZU@e+v@js=$9+fsM1^*{kgdO5K%qBw9cL1uEi=z*@aS8~CB>Tgda?<;39VW*S}aL` z0*j-2{)4z3tCiGt$BT4>*&9qF9rD#i)>IF>1X*bY@X zIbl26G;@S+4@IU~S7-++=(JrS{KsLl9y`fjI2b%6mP)!Ii3CsIjZXW<9<9b#3v(5f z=>AY+kZX@^C%n@yZL*4vdI~K)T-0U>r7{;dZfL-Lhj6lPTd8sMulKfPx54<3%bYU1QiZCZt8*hLN!=)n=!dE48N5LK*v5^Qs#kOAu26O@A+VwrnOLoGv6 zHJC?D7luscl73lFFJ_fI<2C4~UvP&r!v3Q-%1SQ?aL`QNN|^4DuSSo!esoV*otE~^ zvvKVq)*sa^*R1J~c?2Q}0>(~Yk9&|>btppn#yu9`_>I}`6y=fkXPR-T+SxnF6$0*T z>2caFP5DUjL}zU3;%n{?vWAr#Pnkq9j|$~LGCtPS!BHp|9nxk!yX-puo^*EsoA5aN ziNQ4GaK9P?`|qD6)6LRi0yWUgSyPos?!=QQ`6Z{Z+~~tm+)@il-F@-4uAl^&2fDOy z?h_DvQZ`MJJ-rqcl2O!fncRtxi;OEv+aMBj1>RTv2gr-pd1&U5t~K_5Hqwhr&sNgO*wuoGA< z0T3B=$r&jLG(`FrIpchkZM$TOP{Z^?NQV*Xt1LwT@m7#G662az%P{hV7V19h=1x`z z=sSM&cA+!@>x%vd)I7==BSAO}r99NTSxU~IQH?05Lg6(T!xiYl$q!^E2AH8VJ<%R@ zo$ff49LsxzHj9g0-(t=@1Xz9Ua!&myj^!}8jZJcwk{binuxaq|?rmth9-7R9p}9u3 zN6Pqk^2KV76*Z5DD6_#_e&TW9RPLsj@Yka|v#W*Shd=PVYrSIXKaZZGfYr(Hw3M)# zkx(@dZUWaZ;=O;J`N3{~99pvN9A({yLhGk45rU^t*8~SQnX18y$0n>3)6ML@gRz55 ztnnsl@3Ey0tnYHXRb4kx=N5tE97qegE;aLgS{PXUfFc@UUH@Yg8X3y&=iOK;Q(WE$9t zun-yEtx`8S>M4pSP>~)BMnemFhl}x5m{dI70jv&7=)wSb*cl`AQ}27m1Rc_?56|7L zY!XhLQ?rnO6Aos@YpXe5m-Ss5!eeiytgawfv$J+Z1Pm$p{EhR;G$iiIDBo+0wk&81 z{0#T|!p4dzOIlYSOahPweK61a#=*F1nKY1pj7{?%TXuM}+VY3+8$l6NUQ?#GKPDhg z0d>oV97a%}Ymr5LR=y+xguwH<*5$%qeXe#xMUGsto)uP=%uEQV7ARitW%z@DF8`qB zb<|bTQY`gR8>-z2>1{&`?{NGXqR#VR96BfarNI&veS!v~v{ z5QgL2&Di2}f(YF`!F2f9^u_42YmMbq1s8%#2k5vj?3#`#=B+qpu-U!h$L+GY$1)3r zrQa@{IiCy5HFOaL7gB|WlFEgZvBbBkV@9gV#m&%nYKTGj`fKW}+9D1=leati1IoYL zt>E}vdCFwKX`{sCBP$*3c9V19Al+_qWJT0ZW2BKSo7YUqHIl+Bq;t4XIg#7neLu8a zSok0ZvE+0|3e2O?PL=f7gbdeqDF=F348r8$ZuF>nyEWmv>a1~Xd-HGQ)CuumU?K=r zFbm;a>GQjCW_VslwJ!csb6)S{BmbgB8|;s@X_gyL3DBD#NqwwNZsai~;hWu&Cg`Yr zN}a3hluJ0JiXc0~1r9$i%astJOj{=(y+Os9b*DiW5@E0u=Mm`oLY49;9%KHy2y_en z-YUlh=gmw@7(sf0Hf+TTN;LZLQaG*WYgNp7Mzj5vi9ZtZ%PejtvhCkmXeu ztk2*(UB?$J#!A;VEbiqy2&j0h+L(KO2rd(9W}P|rj`}4}zqDS;)itK6+e%>-{8A

IIyKzw48m(OpJ#a_aZJr35m{FbB6G&un+^mK?oS5)THTclFx|jtTZYnLb&qJ8SJ% ztFxPQQFyXDg$bu*CrM^Ec9x%hvh(bkL1mZNn($ZOWiC@I29ha`p07^}S_00M7MyFV zGCpZ%-OiAo!7^yY%;>sXQF45YC9HeguEl=*(%CClW)kei+&UD-AkAXxP|Nn&cvF1H zhKqVDeSEUylFJKOwpL#@)A#sVdxDYRl=dbz{_B{gGr3rBww5fWG`bk_56Y7U_SVXZ zQ`In3zE$nUzNXo9M;x!&z$lo!=y|QyE+tDChxDCv0aj-+NP3?guJ{JbB7cjZ_xm$= zr^YuK6XK3u%4J9Zn?Xs=6+zi#y5<^0>3k0PX+YhEfuot~WFGC8f@Z5YKWy`_FgU_v zbq*zt^EA|QT5Ir#4bqXw6m~COeNe-QV{*D?21^Al{x!L*>4^OpE6PQV^qPrjfEzHk zxGfhGE@_XvltVe))dSqZeG4}6Q^%9ouQJ-sIPEb9!m>)6bOz3FYL{TM9*`JPnxv_= zXVwHvYS@sLy5)Fs@aw6xd9jVqDfyhu=of8XXpj zR8J}*uek|RNwo(?#H0mqrW^_*_)z@i&bTHh+o;F}w;m&6;7>;%6$5K56_PPYUW`?2 zou>9wS*uZ2eaXzWwZ)x$hL$diS$1=hmb8NnSLO0#zC``C-o%lB33q8i5XsK2ysuMd0t2X7le;QicT5qq5lXEQ&=siR?2Y z@S-HU9ZV?w8yIX*i5QrfJP4OinBj z_K5v#qKpqlqZ>)rL|5gX&7sgen^KNxT@DPpEc#f6+UY%>NODNHt0htQPO&)109qRfJg#kGr#%Y{RY|4_tJ}09}_o$S=jpJk_~P z)sjYgL|7ZE7yb&2a{ka*>fF9Qi%pkJSIIB`bVgygeAl-P(#nKS@nsP_JhtG%`v|4~ z!x(Guf$XJsxwr9szd+WYzdd1FG2C3`2IRg4@|sx;@>%YJ2itN{$h+>8RQ zb@0~)WQQB){4+MD3gY&fn;lo?+A^I_Pas*X*q1;QjY#jX@ZjRds)IQjKllpw z&pWzxlyEV}St*Gt$6laJY2AIzHa6Bk#b&OV%Ha*C6lDzGS2uG&l&1$^Vr&-jS-`X_ zZY=L3}Ga6bTmRaQii*J{z$t#Aw;Sz5efcS|X> zB;*S``^o#jRz!(t$&BMDeQutlyZ4f^W3Uspm-FMZa6z|`keR7-EKUxg#C|cGqPS6h zjk1xiqQX0Is+*n@+SyT~!UfY?yDN zR?;B_xKA%Qwvf2zjvR?-7UcRM6d0ltUTUh!=ad=?4|$R-uqAKEEXK#9IxfR*&8e5V zQ6UF@q!JnVMth^FyZdiN*D-dk3=`HSS?a`kAE+YK*1IW(lFS8pZ@N9#ojN%Lam%OE zME7z|OS`b+eb>D-(#1A6TW3?dc2h6+o#y*|7e#yAPRg6XW7prlA-csqw{uTWbiFj| zh~(iehzZU#;yrRY?-{b0-w3yF9I$wdOdJ?`t5^fYD2r~+vuiqJWmWf7L#LO$Dnpy8 zqlglCQRgmblyLRscyBCQx1FH$H=znCmL*_AwZNUOq@a5Z?WX7XmkS6sW#}%|CX_?5 zZI>nKNADZ@ zNe~KrA}iZvFzTi9(%$(Hh20NBO`~PQr+4xHR{t=vL76pOrtos#_}K)`C8R(ksBa-e z{~vf0Fa@7*bRUaSdI3pli^)u&T(%NoQDUBL7` zxLJ93tNhEwJ|rIQePXSrg2s+*ji@g>XC?kBF3v{ISAN^Z?1`m`C-1JK=w(sAJ(A@} z{|lrjdAr`=&wP2b?<_tk9e?4T%(~8wx~$dyM(l@=vLK@xp!KZ#bC5$+xy|1edsQ^-Q``JEbLbx)b@+nE!SvXshTp( zWajBymFf@zvPH6`D}SQQMyR)$rnf))hp7FOK4?6PtAqFJ$o}4RB1FiA$tx&&!w^9$ z3~vQuW*>geV-gxTx%VI8G}N|qCD2j*DpBq>IZ*Nx8xyHI!#Dq$WW zUs~iJ5q=a6E>%kfxR66_<83=_*i+p1OjcbkEOk_&a&j^VM%1)OZYeA^>156uMSC1`R9gU0Vc?hhd#zXYpuKJmsj8bORK>%0 z%P&6?(Zk@3t?~vz=7moK!=dXc>Wo==`4TZ<_6x))|Cb`@;+8dUsw6^6ja)7Y8+B7Nyfd*B3hSM`{W=YPoFh!ZJSS%ScBtWLFQl^k&ui?cC%%7Z&AJ zF3N>pjIM`VVvI0S3RM)J`cLhOhjn5*aghrE*Q#+HHvC8@=-e?ry=7!!O&ZHBVa!g~ zl^tN94ny{0X$h=n*?0fgV^(w)9FV63r7)FAIeiI_>mlY>)_Z2!i)=nPzm{xvjgrkg z$B5dnBET<988zMD5O;F(y`9?M z!`C-Xe*}Cd-S)406mw=KPD4M0m%{(Xw)cT)+2T%@aA*3p8xQIah5$|(Z)HlFf>u1E zIvwsZj*T_+yBRJ+(`niUjCCA1166bwv$5F>lc8RAoX=j6h9%J`V1q_Ky&RTtuw@g} zBwY7%5-C))b1F$q3K$)06R#K)UnOtQaY>5o+tx(AU_hNV*o?_B&Bmo-4~;apA(MTF zYWk-^Z27^a9y5CmrU@W-OV{m4ySY~W#3V03zoJSQqC=1PvoFpNa_^e3E~YElb9C%* z+VIGj@e?WnjF-LskKHz57yl}4}cmEH>BPLF>LK+V|C4^bAg#~hlNaE;Ht?9kf9^)QYa!sU2y1v9b4&8Kc9Pwevaoq&Vr zS^F(>d^@|aEE~Rz`3=q+dPq0+gf!oAu|$CS6yflF!_klnea%)OEC~jU9->Pcxx2@c z`d{p37fQi&Ri;zdUzY_#7J9A|EwIRu9D}c6t?JCL+X`9teG|VK3>s? zJ}{r8^nTAtOq6_U$7i^v5eETC|9+yT=0l(6&KlpcC0cn`%_ZWH1EX|-#J)0tWomhD zBal7*Ia44X26D9J-rY-&+_JhvEHFc6YpSk1px%KI_#|#S8$MVScw)gbs16Kk37U07HUEHHb1^U_X&8oz24VG#wUK{l3D(waE3r#buSR zZiDH6TFkzURS6Qf(j5>qOun!NT$E(UJiI56A;68&{l*B>I;Ss3 z6~2Mh8W5Kre|_gVWJzh-`|RDphr{2blU;heLr*<;yd_cv5KJEXT+Xgqjku&0%f4m6 zR~9f4R-W!qpV#>Iu&9JwN}lURPC+ zMKI?%e62G}(U7@Ol`@zQldyA55-s;HrWKe7%6`yEh%$YwdT!;DQa6U*YWPi>qdUE#B+>YO&h$b(IndVlBpL@0T+%iLifKsQ(G;zC4GPN4>j$u%4m~;j1lX3*}ZlCF%HOft1$^B;8_N_Wc z&?AS36vyX#T=Uff++FKr^xk$$!~|-|_jf!U)i<#&jO9moW&`4U_`f0i1hw-srWQ?Mk8wN}*&{y%$-bezx0WbSL^NIs+|%sQY-zV|F2G1jnD#vl0yhPzb+c)6#{=tF=uyc);{Jk4i*uS zQM@b()UdpY$VlD%wHAJ(atCL?Q&`V&KC{ zRG%?sIdoIn`WyERVq<9kk86^XCYu)rA)g`Vwr)lEI6uHAA$Kbm0JYs4+63(x3oA33 z%mP!nG+WgxW_mn8-Tu-A8`&ve#q1}oxpC}2GX%%Y#J;mNK$#hlbd_isvD+~ElpHZC zH4$9PZD`#)Th$?mK{!-qm_$m>6x0kot=)i_puxzhY#tn$L0E%3Hjo@u8b{eHrXJTu zYYXqghtnLbLU|X>Nr_jeNP2{t8uHb-wY5E~S!VYK$t#BHIJ0~p9j9FBxH%^#{ zZ;w zVS`1xQ3r-&-E#@*!PhnzfEB%N=tDC>m#tRlSsgf40GH2DL-o^}Pt6 z?7tgn+6zr_*fz~-N3=wr_ETf#A`PTk%@B5)Q}?7i=aE}Rc+|)yqt5l9pfFq#Se=`K z&U1~U(^2`(WNjXheayO#KOO*bz9PB_Rz2YW(qk_C%!G)(HRLQ-wH=EN%^WxRd2L4O z*oPdn&aR~wFnnzCFaBY{u=N=%A;eLNwLXb1i6RvgJ^Q7-Qbx8!9l7r0q(LbQxZjoh z!r{USfli**UjaL6nL=FCGM9W@otXa%+Lst<=U`pUy0CO@X}mct8&-%tjqSb8&u%c=^Ygohoc+llebv$+ZtN(!eMmwVEAOw_#w=b-Y44w0Ok8cvQS8s^K(=Y$j2ebtmN z5O9Q-DJu@q42KS8Mbj*U=+%bD9k$#qiP_5UD0KbhkhDGI!p~ zz^j~6qgzFMJD@*F329@HZq%kUl@nz?*^>h;o^Tg$BQZ|^-1)als}D)uyFJriZsl89 z*w(RMx6AF`zA?Zgq{r6a=G=pLuwp>BwCgVPA4rLxrh#E!wAswiaIfR zEN8ozHhaptjaqfh#;(5yx) z<-ycp?r?wR&+p3Nfa-SO%H%#^2@NlpXM>yq&pLpvY4oPv6F>U4qFxXAdRauP;v6OR zA?B6KtYRCCes9i-pNgToIH=D|q<6-*@uPH=4`zMH9c^#~Vy(NsmLAeg_j|ix{{PC> zyFkmoB^bmpV?Qv zQL(Sns`06~rQ!3+ap4``u0(td_KIyiVLmC?z3i*F(xwDI-;DB%6fNW%SR+4N(S9gK zP}y#pa%ImY^dY7I4z^G%%M=xRa_ySUaL(CU7iEeSqCa*K5mFw17H+ap7qV4Bd;k2k zuT~Aw`fC=`j4Ui8JzMfg!;0u$nlfQP%QAj-vFPdd>XX{~397CKslE$V-|>aGGR)rs z_ucwevAF^)ax*C_I!-oP%@tc_KuuId_;4Hbk#u;dxX+^GtAudPtHK_J^GQny<_H z`7?INoF#cgTR+jV0%&sNss6${qVw4bTXnn9U_UOrXA_3;w{|Dyy^!)gt9htn)_rN| zFdof*$ii3t0}ZseY&WYj3uHy8kFA38Sm>9;?+-SlW`g}z4Q&pIU;7+Sm1fn;JdCRs zIa)|gTDJj1`x+fU

l>^M z_$tPqBTC_VaS>q%;yltA3gI-x(fV!d%^KrN^(FI~j5}wZ=->yKA;pv>b}veK$YsW+AGm4$Xy*rE0C3A@4V$97hPsE&nwnWKKXL|n!=63mP>Xk-`%j^x zeY6pfcH}l)N@wMXYW;Z}_+EM5W_P(UfgEc1nl&_>tv)L495U?l2Z>~32ejh6)P^@M zw(k2Mi0sNuR8F&X&}rO8g~hxj#yf?~I~3P-KL zr`RHg1Y^;eUXME2@<$X-CLXMZ1wP}pV~OLoydzK=wBh_FnBxv{LUSOcc0~zFSr8be zm_^)nUR zD$k3?2g*54?kr``D2iwF1#|K4ytcLmN*~`*U1%H643&OSGjsZ}L(e;F&v*l>OUMdw zh*q{_ajPUfD70dg4VEfqkmkM3ZMBVQa~Lbd?Pv-V$bDY(Zu~o40$|BIuNA@j@Blc> z3~t6JGIg@M5Dw6tyvFjGhuvO2=EQ2BVk6nLIB?HW3|2I^vwm|V!=IRF{BQzi4`qp9 z8sAF>?=af18&N^^Blt843;#bd=YuW>U; zCuvA(QG}tsn6rpP2ev6WMga(IGD(mI4eibAUokCOFaD{o%XGo;8PNN z8JYz}vX=EEO<)`S)d-S+K7S7;edRfl@wDo77^zWh*In2=I(I|G<15ShCoK_Ec;`K# z3BmQ9%Y>2M#K&$XvWsd^>j^;wYeV&Yq1KZfijE5nHaLUbLwGkYI@9`nLwSp;zvg|- z$Ni>Dby9~>W6gbWwXCA%PK8w0q=)`F4bNt-^#xB*ie*c1TXVdoxA!fn9CgYTo^9PmmJ7v|1JgHU znHf!~qH=Wr3R6qffUC<%(`tH0hd;{ig-5tNC}-VY)+D#?{(x^O8*Y^DvCth-Z7V0% z^2_ojE&1W?RwZs8BKv|)jv8hsM{j+EwvURA1iWHl z%LE3a1Df6WR@!@>pjhrF?UtL?l!~dA{ylhtF=1q)sAppHk2zCXtR3}|J`hH>xFmwI zuKmq!Nz8xL^-3naeF>#b?maI-9+F3NsxJ!`kCWP7EPY&bYjs~lm06xZs=ZS-c^yG< zR&SefxyvB%X@(m@fEU8O&W<+uJ5ICvb%$Z3O5iVk=ORJpZ#ch#%ZzVIK+e2u>LZ*5 z&9Ba`;QOhqBI)Dnkp`tdGe$Zrw#ip{gYa(LUH2X8lH@9*rZ@ag+fK%eiNjOt;h)XK z|7_cV>j>z-5hRy@?7zN%I@s^~KazQ2zUw<;hvKw3^yRzTNiXO>Lqu*5Zgd(puVX9b109SlYi6$vb}~&?8y*6C z=c)FW-JRP@mb8Y+uT+LTCjO(tJ1GMeH>((W3Aq0v;9zw8tDNhYxoly~IqnO3FJWW+ zo>lO$OIYp^RF) zBmv#<_68nSh$wPRWM9p1NFd%JzHdc!LPM<8o zJK|nCuC$e3B1&e^xkWN@M!dkDu}9&EMb9c4gF}6-2sLl5lpz03ToE%xbJb5sDx)S? znaVNXXreYLSJr)%2xbdD{o?N0)D&srtGKQp+f`)6+=`4-Too9vI0t+sA6Q7Jc{2pf z1}Me4L$`J5ro9*iv~-97>>oZ1`T0m6nSnkSUr_%D5I<&tOe}W0f<2G+eVtDE_ZSEo zbQ5zn`hN;(b>h%#1Bo^&)Xr1X@#&|Q*TD+MO&x{S2n}!aL5h>ozg&PkzIu;9fP0Ed zIu%d!_s*_A^%r(-=9N4_xY6*IrC0a|0+$cR$Aj^0cRkFluF=>#J0A9ogtSq4@*>LWIGW2ANRe-}#4ky8>@) z2)zaLM*C6^u>Xu^#yr6MH#7RS=EM5Le`A`vpP>FXL|-Mg@I=cqt9Q`gUgR0&8vlLX z$bHq-lVzp$e%ZugG`u-X_e+Z?IL$$1ma(W4$ZPkMNFGgd@EXygjHhd~PC0XrldPx? z=XF4F^CIDyke>RBtk+R_B82$<(^!8#Tt$L!C zWeYB~Fh(|AR{Z!LJlEhf4%%G;lgM1%mNV7{piUymwdC8oz+?;Of>8jy7=_o9@vWSmv(l~7r&=+z*Kr*zA}(DZ%?T5t1#i0BOFNE`XnTL}z=A7HSn5}* zO!gOlXA9YUFUj~~QHk8Q4udDmKj>H2QUsx(C?@=dLcD2?kX#CxlsU zFP{5pnVym9JC>cdbHi`^;?`_jm;&1a+8xr9ebsf&pm~6SBXWl)w*de%?$#jZ&yOqK zdP2T{u-wFRAS*+aSYmsE$uj=1zY;d{=DF?i_i|Dwcp@-8siUOH^~6m^vgXOix*iho zjd^F^VbgWd#GY3wu9JTo1xL=i*m$q%;!oayyd0U28&k|+_@by`tLesKjguZua7mqH z{it1T{#VJ#oyPZd4%9qATnoF%Tp~+{rf4mn6u}C?vJP<(2IVqcS_j&y9JQVscJjh>Dp?BQwxI0<&JWFNU zvPqeO$bO}SMEFX*<&5OZV69F#p7-(sWkq zGR7 zI~}1t*WOvK$J_AW@wOq0RZg4ifa-YNoONBdFQ;Qkrr+6(f*eH7B6c{$r*!2GhVGUX zK@7}RH%(@*rQKQt@Daq$u8)t5wi+<^>J9WOCTCn&vgqp!{fC!!OI%|nBjO;3gPzy7 z#Es|U+RmDQCvN^&q+AQ@*&`q$YKm@UzJPtCl0&p__o-sI!d!+6++fA1(q2DaET)sU zzJY&&|C_tJfQ)lXr+nRgvG&Wm506Z*Px7#lDE!IF3LIg`{Nf0DlU6m1tAdb*E~z8T znmCo#i(Yjx^Z-anI&AvE?OH@}Cx6*h&u*YZyzADf0qdlZZB>>$%<4rkO=8%1H)b_u zZ6|OfFs4OGG`C~4eSNCEXcC0VA+6=|z+^$>xA{L=};E2DW)RIahGpAN~3*uQub4N zla9BP6J?6_A{W1zsz*)QZF@t&wl1OZ>eoKoSkMAQ{Yto3-o6vT=udTZaDm&5+Ua%6 zC%P;SD=@631>MDWByc zsw`UYy!j;8*17x^ayyrz7oA+g3OcQbP%Nii*6f3yyb>VmaIKl6672M%Y{ok0mnU!I z+T_ITS{2~+KC1B_Xq8v~m=gC{{7;Ds!ma1$JQ@y)rQ>*QGeyXQJ~ibEW!d#j+h!+e z{rsWgAL;_pQ&c>L?l)AiHTBJamwoJ_*o*khIr(nRO=grj(%sAzbFL*OV!8SE#j7jk1T^IyT`foDB##h-g^DqT zWTouU>5>J_PbsqJU=APU=+i81#qdK@u<7=hPCH491xF0G1w2N4xOyh-zxzSj^WYqP zM;zOUSeJ+ZE$61mq%KkBaypE42-NS4meHC-3RX9PG&OBT*raJMc=DnHug+Lybqb340G~Yvf~ppl-613XShDXd;DA z&AT%UzguGYU_R(*%FvptRA~;kcJj+#r1BX!4#{Wsv`Y+vE}kie+TQsLaT|Boh)%u# zv@@D)xvDXx6kW7y9j_BL8*ji(iotCxFFgc{rb*sh$`Yg#5-ofuN;2Lq_3Mq4k!H@hrhuU*XJqd`qNpH|>! zM8!?h?2T5wfJbU8=);@iZsHc4C9{JP)i59pWF>&lhapzvRY6K9#W4 z=hFO9aCAeZKq45=J}nI?3E!9Z1JxSIZZop3)s==;Wgfd5h5L9HYtpuzflWYS`G!JW z-GL7H&Q;meaCx1Sw-QKU=>jtRY6qEaDhB%TN3K8u`_zLh3u`PDR9d`jzGJx3Eskp9 zhbd3=K}F==GwTs=x{oYZOJE+fK0@XKtwV@c`ZAj;G{AvWG0De>LZrs ztpd|1sc&og{PawRobt>+aVa;i1zKIP<*ngCcT62$B&g;xF}V;aXvdc1)hcoo*i}Kg z8J#0>-Nl2+zA!a??v1lY1-e|ZOMCpVkDq}!+dFm^ZDFjRIPdH1A%ZzIG3GF((SDx$$FLRUbTQTFQ0#A%ECsOixCv6#ln`T%_yivTRh~+h8aeZMIiiDP@3F; zxTF9bB|kZ?c=bY(=D~uY2J=eT$?`R)J0ovDxOA}&{3b5kcPk(kD&sC-2Fi~Zm|pq3 zM?=ThfG#0su4+iyc#5rcVW$yG$ftqOn^=gywU;wpnsicqIDyw%NXTbi;l2Rw?e7F@ zU~~VD)W>xJDSc!=iys}}n#IuAEgODcoK6)#i->dWpJC^I+!q-Ye%R05a z$Vi{860$%eirgsn@B$OUM) z`#_6cu*Am403M(yB8^BR>G7+kB+9|+k*@099b9LkTjsbY0W-~moDn`} zP~;$*IEbgxR&g641)Fgi0efL>SnPF9VsTIzS1+UH9Dl1b#y6Z!x$j(nbf= zi$IDp;4F8vs*P&r`OW?NOB3XUp{VMD9cmVlr9-nRU|bwnj~5NkHl!fuH}(!cMFbPF zO!`!9JW2E}P4e=3RRa!_?tns-SPU7F!bAh(BR7RA$UmC|Q-PHBm;aO;_7*)=dvwjU zxs&6Z(*G|n-p#z2X8E{ze{AEq9uOf8vdJ&b#v_Yj>4@pZ6@*{jaBubxq5(yp7ix_h z57FaaU1})~d?UgDc39SgG0{aas#+4sDB{TT{=|hexgszHsuXuvG7EA_K9Qr$`wDRR zr>6vxl~FopY}gJz3U8QFvF`yeB^8efxKMzJ^%lgvkMJ;Yn(1N;;UeDrFihvSpCq(Y zBZ~UfGfBR~n6|+~&;>pSnqi9yy=(-_J3$d@Q;xaceC0$Ib(5Vyz||x~89r4}C&Uzs z`S$91MZ-Tpi4{eq-OuE-nW^w$-`vp8TqJ_mPuhuKT3m$G*P{Rc)N#+$uoM%4Vi#hCZ%}Ng~s+} zuqBN}o<}YbE6~UV+$DdYrRs3c-ZxUG)A9MJ?IgqsR4M@cAs{HXJjWD7_4VUiI7bpJ zW01iz?7J6JkOK845KEwR1W56OW<`z*rb^7-VA`NEd!vj+%*l4(t!6d=`r&?ASx*858rz{L-B9|N+gTyGyIkcnSC{&$9bDwmrgE2N=?F07+_%2lF1Y0`}}zr z^B0Z;-Syr6G7lf?|FYnT=&GWl$_EH{jZUTob!BF{aiB32w2J|=vO}xlTb03HU+z!w zr{Ul!BpWswn_v&X1c0o!3@JFNE8lkJ)GMDhU^fse{Nu(OP386)$R94|!L-#yOVRPP zoWk~Kbw(XhiWx#i_E@U_1mD>%9bv9UPhkPqeX5~MmKB3oL=CW#1Lb;5Ab%@$xRD4M?}&a&*a5J-$um8Py3ERdiT zkiW)E|42Ilo$07h*)y?1_}aVoi}ttoOWi_Cxa8~insUf`W$PX>8Uj#^6P?(gk_8pN z6E@#S?RrZnPP^R%4pX~G!U zX0ex`6>~$gtqZ|X{@UtB;1@r*uz!n-{IBf%$1PL40h2^*oar|aA&6vY(lQuRQ-$x< zGoQ8F$~s@MfK+@J4+~nfN@yGurvt&wgWfHXbj&H8ZM$@pWS%wP=0iZuUOBHaV3>E; zwYLSpDyfFFj?MSPmox5lM5v$*(qH@Eu2+g!ikUy_iFs*iSdvem?t;v}#vrw3^q~dB zepS+5h#gG*R;ukPIK(4(l;_=;M&#Gll*KwhD#dp!IfwOrb=jC6>C&fRzWm+NP-A1e z(oc#g$=T0_0Npbjb){4gvRN#}Y<)%5cYlV6Tc;D10IiB&YZ7Q9VC7UNc-?0 zbs)kve0h6|DPT3f$M74OeI1!9A_AI(s9iia)wmpbGSD~A=@k!+&g#TK0M*%lUy~S< z2krTpFuF{keB%`_srl$_W+V2V_+LverQd1dsPENC{Xu^#I7KEi+cf&a|!r#6UrVPRDnX(%)7*>hfNSHEDf-?Ur{^t_#5i?8E*P zc~0NV0)MuqV002=gPy72mS|Go>hF`vyzUFpk!)L;wxm`#I*8cJy09Xx;(d>$064;! z(U)pVN8$5dH(!NwkJ?K0MO2PsZ`cVRMW($Ou{sznQH44u7aOvz9+u@@4X(fX zW@`+ShxCCs-3n77(qH&>OJ7j998Qe<$|IL4{_Cq^kkQ^6v^K8MS!g}tN|+T=&3k^T zon?dyy%IpB%`PPR+Bwt|?(vJs=j5cvGJZrG)k?p-!k(#+PG8yOW4yoQJS#cE*{VL= z(e(tXJI-gk&(JcLM2yPs%QC5+$drfWZyvpVqh>uPPl6_U@D+X|{;k(oKr-kdS9-ug z^ifRFZ8Ag3G$B)}2wOYE*I)8OdcH4mpBcRvwA@lL@u$!M#&fvs_)(im#+2N#TXtm) zG9Ehjl`o;@Kua&(&$Qtr%5IsHbd}_QiB`tB!Ja3J=7vLD=AKksE)=W05O_4tH+l1l>>c?|FK%_0>0k1?ypoVNWU!~B#PXr=U0S!gEyei?L_ zJ+^vtee>|f`Jg9umb)qs<@Kj2{=vX5q!dHC+0Yh0qBWVa1MVlfxDc(;;I}x|k-5`G z^iOwe=ha86sVM9#!D9Xg<*WJ6EB63+)JMp$k2SNMd(M|v!D!_=n#uG*JXuMq{KT*@ z9`Ta+Dp9_rb@8&~iI-wT>Wb%Vr%v$7RMO`^qCh8E2Iet(7AmiD`{m`IrlWs(I@*Q6 ztn6LkiuQU$m`Ej^D@&6Nk!D4}FK0_lp0pD!&B9sd9Wxd}Gy&9`MK zSflGU-w;x?c*kN>o#L4PR=(-k18qZ^qcG>GO! zr6?l|e)oIb_Fh~q!vA4eoN>$>Wv|>z(pQjyi1Y4uB0lbZgeZ{dh8OAoG~S~e>o|X0&PcshVYr1Sn&C%^d362QbP)rLPOcYJ6dea5Wb~g!j?wL zNxnebLS($8Ga+mZfmSS?`kq4+|8W+6y?$8w(hl_Ec-Z(fZVFemkTA_NK+|Ky#EuoS zco@FiuhhSF8cRN4FCk!NoJ&I$M(s1TOb%ym1{wCaBX#apy*euV+?@i8H_pdLq!lH| zL3FKS5J!s6usw*OR@wkw39!ni6oUel%ToFU0oI7t8Z03F@3S%8k&N6FhH1KM5?@cv zfzU~prR;PKdqm7OnykXROnX!-{WO@eZ5Z=*>EvVfBsSdjlPm00l^YHyY6)zUK>RF9 z8g}avz#7Qt!yCLV z&Yh8;&#?mCC{gm46v&n^wkOm}J!9PsQfW;>Bf)8^cm>{^=YWVdaqV%o%bNz;+jImO z&7J2L6+rsQ@bm|~)$T!`A{KldSNqe+g9aBBb?I+DIrwgm%^!<_w;a{1h)r5c$}eJA zC7coLx^{1T`02lxExO2ir-r?=*_-2&d3*2Lr(`%SL~;Y-Ds&i4zZdQ7lAY!DrW(eS zB)M;D^DC-PPXphkl5+z_59%jS4O}yOdElm@PB6^SY~1XVV3o(>YIdNmzW(0eae1P+ zkT(#p^hs%FDY1=U%xMb16H>ML%~R7{V7cgodOl?l>`r5KZRxHBu4GVV2yrsOx}-P z^lwMph{TeYYcc2;!rn%O%4ZsM+gKR!5@^d^F?zhKur+`WXQ7;`MiQVS=%Z8hIi%B4Mt3F1ov zCU!kGyhy88mRA>~-Fab*ysW3K#Gdd^nAsmT@-(bMpt^cu@@?!U6I4MHblWH-+mq>1+pPv9f;* z4%~jud#geJuG4k!8P^bUW=Ye>t^^JFMo?5EQeGRfW^Vx>kKk~1p_iozl* ztwdM#6t!j_K0N-LLArCipg8k|afNU3RTGTTZpM-afo{K_QatRD9pGi?kBdfSbeb?( zD_o4z&eYsbKE^@6Se%Kqo<=51`{i7724Fsm+c>_S=5aIh-14g|kB|(>EZ-$F4^CcG|=1Gr$u}oVT#i)&# zq33Hb1eg7`w{E>@5gN)dqMSE|oN=8RccIW%h54&;Rluf|)B2V#`!$c*z&$wy*B+LR zluiEkP&p}_E#BxsV{h2?y4({$ptxza!dE%1rj<{I0JdY{dLuzKpM=TyJVsHq(srWp zX#_DdPiw;XS>%8dUgb-*Xd;$`5+3fP0n@T(AkMNI;F3EE0-p;pe%I14L;9^H^_Ryzh_{^ zX5ULX@ESdi_1x++?Qs;DYx87SWQKamPmEB=at*=Ke4>rJ-`1_Wkfow*d;H@u_v7KR z9iYZ2{Kzir)oq%E)hJbmwlM~|LtGGkJ>3rV^Nc%y@?{R8`b zwWVB3Iv_1QV{M*uCYE6$Okt9zCMWVTG5HktMaj&X!AwANxm8I}z;^OGvo&4EM?q0z6q z==0536sw%zueyXRc_@SH=l=XC2>sD~i^L-Ja0GK-VYFrJ_OegefP9F{0jC4mA(d~b@2U(xTzuSmwz<_X6iWDeDyS0$gxdUQn*PT}ltjg&-Lb?}v}m zc!XlCSEW#fB4GbB-v|q%2c&-a=y@vYPijAj;{9iA@Q?G6wn4hUoE4}NnRe`|_f-+I zt8I5f;Z1=n{h}bI1k{E8BTo7Q-neS{c9b&he5`iqP;RjvM&rqLsXC2O9V=QI@G6!z zLVm7OCqZb-4AblgJ(%p=xqAqDXag1WY-}U}_ChW3zU6C~*~|q~hu@slKMw>QZ~sPy z1yxQ=sSicy-}cC6KArOuv}uROLh4Xvh~5q4K=Q?5{0pg-OgfQA&Dlr5~pJ zb9rE)OAJQo6|$jviK=?(JkZ~WTtTm$5g+d`{ke7KQhV>T&x>t2&f(q$r zSF7xfri-<0)z?X{ZN>FuFyT&sbc~y?a}`D6v2JM82XNc&)B|Sulsd6Lu8(1@6c_9V zgN3v)u{e4iGY|ko_DS8f-8@}FA=0pzWJS_K+!!LYvz$dCnD?0~+Np6xgcQ8o!>s7Q zV8xmnv5W}Pt%=$t^@@HTn&>MeK@o39 z{kj{Jt*6ubEBxp?j#$B8{f_;`(a@DteJKAs!%<^APAdicOIXVeDVoTZowI+Zwy_|1j zS`j|xUhW{38w4s}`y|?VxI-6XhZS})Aj|O|$7qOgpzfB?k0V~4BD+7wW zUMcmRo)VbO5S)5_Y7x)ci{ilhO94)@C+9={@f_y)5VJGv-YauS@zLyKfb(6)+gEBy z=eG3@lm`&!EXYON0bYG?w&gFmUU5}>pK*JwFEg~P&oEjJI0tw-e9#cN zh?$=c-DJlV0-WF{d3^XB#$_vg$m4s0A6Qm9_ck#dY;KD~b|ZofPg6lGm2KwICi1hw zK0d6kegy|u`7W7klg?H@Nq)C{zz28iGV#C;B7NhU@u6GBG zljg@=Jh{E^xlxk;%O+c!j#cyDF4?c2-d(Z;?JEZuR9R4PJF)-UB)g>|8=S7~SjGR$ z!Rr}bNb9&byo80Qo)UGxTK|d7B_sT*p9wgM%&Z>Qd6{c$d^MtRcDNvTNd4aX6Z}OH zJUnXMWw9>HPE!M>z*SvK9=&JNYXP+98HtQ##cb2e#j4a~w5ZqC@Vk*`e_C^^!2q(Z zV-mo;iVJua_(ttvIyXh-+MLO7>9AaEGI-C*grrhH;E=`93I|i5tNGd1FUpiv&-C1$ z^Z3A?q6LSMepal(^-7Pg-Nf=bDtS? zG^wV~xcrazqcl>d%`~zALD(d{_*(YY3tLcfu#0pMo`8)*sR^@3^gR(X_V=QIG$&Pm zH7&bz93l zi!iu4raf{wFdK>ObbazUVkLIH2d|sAkLKsg6)`F3E@ zl7K+F@$_+=iPJF%_gpgk_DuFZ=>?5?wXD$TJ1yOyvzURTo{N>`ar__FH8y}%q}NRh zU={7Yg^ab&L-CaW6o$RLo~1>unZdU-Fl!W;KRyD)DsArcbWUMZ{9f`w&=IHmY%r8q zo&#C$dGgd^JB_+HK_VE>J`4xSs=S|NL=<1$$_@$4a#WHX;5n^xwC3RllH`T0I*)~D;i@6UgMI~nvqQSPzB&bfrl1VqM?9|T^lLHqe2Z1tru$eXht*TrO#|X z;<3bV#a%X8&ZKBixs!Ihx35Gug#tj_e+ntgr|G}4j*Ys3HoHM_Dvad82Fp zVB88qMTZ8U!wO&JFebMRMuP|>hQgU%fQ9bI2um0(AMz-p@Bg<9H?B$+216qABr8}Q-s74$dEw;xybDXEtz zd=fz+4dJ$;lh|_>JBy*1u%X%s%UxQykppL;mkJx6opw(*efoaNh5j_;OW#0^!KW(Q zuWnL4_sA@aw+6DJQ7HGX9>dmW7^Ksl{9HzXAl(({qYw_66IW1Rx&$0&{o!+3`P4 zJ+D79?~?qBke76G=~0#VY3-^UVWb2h`c1a|wt!BK;L`KR1PH zh3`;~w5N-)eF*(<3;pCB8n)`oSl=?(jyQ)kB;_E|rWHxNanNMS(#>=;N+ZJQb>^z`{C5`cH|(_~F`4_2m?|gmu{OpY zu<_J+(F(uVR8FK6N$jLu45v6{^fXJ&6Y?%bRgZ4D&7AV5=4mFXApLL3c@<;eEQqFR z%&6+Uf4WZ?eCzuOeJHG*(ud@#Fz0{jLkjjy0k}k?!I|FPek&Ge&l_hA?Z^c^XIutZ zU1)TdN{TuygHQ5~99~nAGC}^x{avd6;300zn3!V0enrnrKQWJNC_I?Y8-h~F-CEEe ziT!6Kg#%#>P%WeLgPe{<>+^J^bOT|UjQMRLdxj#c3KeiS5`w)}?J3zIuIRC{j_z!{sTz<&s>vQ;%`N!BQ~{3S+(E6Ayn! zxrm=zK*Q7>9g+~Lw*gJtD+)G)i@895@aTbT@~}SnEV@w0ASrfQmNazO4?QR(7h}^S zcX#d85Wu2(0YkSuMWVkxiEyE|IzcRCihN&f(ff`z%f=r{%Qh`>avFv5hm7jmo%>Al zsJJiqtM_pdh9E^xeYNT56I%!Pi2OXmY+Y)_8&MYCUr=P9PUAnkParJQ0i9e6|3xOJ zz=m;^Bk*1(OfQ(v-caSTr7zMRpy>)Bi=^JhJ0Ck_lLNr{3iUGl`bgUxE2UO9%8DXI znDz-JHw{DwwFx4{GxsXcgO;`T(ODSI6sWwEp@THd@z5e-&kCBW7`Jolfp*yjbUi3a zi`M=S#^+W;gr;|bP|rYY?ttTXMM}k-b!XeE0?uVlj1L@1reYl%*x6m4>Q*V*KX?DJ zq3iRo*S&t5ToH8P3^qTj5zt(^B2BW#>l1)&ROqRly#h&>uCmRNA+5(+Vl;t>SUf;? znGpc5&o1nV5=DY<&f)C~eOqBQ2hXD*ooQ&0-MpCO3>Jb&QvE@BTQbDy<7yy7-682< zsSF-E`SNE2wj~F-NUO(eaA(K=HYJlbcK18wr*&a8zrA2c*K37cBZ3#H z3YCB^o6$l{XkZskgyuvIwX@DlCSpeHVoc=Xl(KChiz-9}{DH4udWXp^&QBHk_9{#t ztd|5&)Xo;^_MWgW46G2PL3#16Xe+EmN_3h!5OSMJx*XS4E6hA?80?WE?y%BUldFa0 zmqw#3sx-mh14Fg?85L!0 zmnSh_8}eU4iUj_e(Z>dCI1bm3IA`9gk;p%7?o6CjUM2lifmA;qv_URyjUuDCq z!08$A2&cY3*3*2=o-LK1wi5z<;EjO*N0$veJ-#%TbpP~@GpY>UNX4`L=Cb_^O!@@Q ziPd8%3n}QUOo93=w`DSh0WI-@=tn5eU-M($dnzBwYXISVkA4pd5WqKf^Kj+;KN7JD z>))JsQ!&*qbO#g{7#l07-Y}2um4)eGt9os~a>{Ol(bnjzvNk_rgRLOmpS&{v|70E@ zthmVN&c?O7bL+`Av~{@$<+a_~+e|(-N%lj!-p1bHIAyW>9o*hj>BUx6$i{(LG<;0ZXJ&>AE=h;Wydq_EdCf^~Ir}8m@l$gO z`CZ*dvk#|@R(bL7@UI!Kf#(kVuJ_TK7At^6CQK?=t}d9EGP(6kq1%6^5I?5>(W(JR z%fkR5>cz=d;7{rQ5sUb&Fg?!yODwL~QWptL(6ugRd8Xs>iO!<6o*G#)?^Y9$@ZT=2 zG$h5=pUx_R>zmb2iaWQ!t+uX22m=Bds+gmv4BqNw3^XlhB)mUh%I)&N~2|2 z{VtvGrg?Bl)p3F9^*o2K%)Je7&4;BuSzFXC_3GSg!DgCW6Q`1Qd|;<$^5i~$vvOT7 zSz9-MUnYy_XX@>;sg0JU(tG|vV`K}$Jm}vm5}N@Z${Wm_@7uU~w6q+Zy*sZ{ZK7;F zp@9ld2tvu{UXi@@DI{YMpVlEVex$3LOjBrh=t^L;ljcH7j1VG5;O1?xog)uT~_j? zWz1MB=32>ePl1zu=U)L* zpfhE#?=%}r8FS*@t-U)fv62N!E_9si4mbLOF-|Byo|6e=2Y*B?L*xB&9c~^PH_2}l z;K`84Aa1Gi>nnc{$>V#-HR^~*nni4joLrcA1;^|3O^pmx@=tC#=qY@?xHV@&XH6TG zz+ZF?+6}DvAUTocmeo6;C#)oK7_l#~u3Z*{_B8Uvt? zMUz4p;Q;kYB;^`qX8XZ6w(0Xy9G#TV_?QjXn0?>rMMLz~u}4Se*Z5aupv1tNcqyp- z)A-Tcms}o8mtiyzxQZJ8asJ}x;y;91N>b`UXU_Ft8Vpg5s2b^6E&yflB0S`s7Enci zEgRS~w0xvCJFxq~rs|^&6Xy@FM4Py4MLY|XrfNE9@KB>OhFl_gI?JbsBUu+C5=)Uf z!7p{+r=;m`&s4KT^?&O(Y6@o2nKp*!VWu+WFWD=Y?&LX(w0vaWDbXI96U>QHgzygO z&IP0?m&Fz;K5ZiIpaTTOhoBrH+mM(VOE?jy=QU52S!64g6s*ELc8;xJRlGssy!Lj2 zeZX(wFlJ@-{R%$aS_Sw|JXHt8hOY9B;DCF|m}E}49o!;0>GoSWXgTa(2h48!pbWIg%2PMA_M9|h{H?8 z*S>fWR9eaFn%_x7hNVO*gm;Gq)yl%Bo4bLS3`~0~hGdPU zaz*?SVJAWeq~r%srpMb`ys)H6nK0&Cc6~J+M(N4#Zs=HDCI2)0Afi8R*%Ple;s&cCZ+OOqd`l1Ud zyzo16-D=O6EGxGK>SRFk_%?IJ<5d%nETTS?@SuWX^l>R$cwCv1V*e+Xu4m6!e}cM- zZ%DRMwDEon*=yz~k(YD$DB9JSBtae7W`q{rw))3F_*%czX!s+`!dhOewd*CUGI=W zXkc~?sD6JAGKZnag5cn=Ra3O5z4Q9kwEXX9Tzcu9XtL&Q`2VjFa)l<2zY%gxk3Y6e z_eb(JkwLMPxJk!25nOh8NkCI3oFTOQ2cQ8|yuvHTR8Z3i?^%LLAKyNtVwI;)SmyTk8)^ z040x`XVa2ZZdtG<_DjQe{qni4OA!FVhnfEFwMDprbgSbY898Mr3ucJ)K4d89Ps@El zqoY~KM`iFvj~5dL7P{DTliV{7WjxYPS@F6Z$2}+{7b8%gv3=pHd}B z!pfYmO)o3BU7AsUIp{WvqmX*27ex9d3QVLGiU#h(oFjao{~lKONcgSM1zB8F>NX z^Ht#VH4_3mvD#dVDm=<5Txi4b=e)nu^L|szZm~@|7$zMcNVkLJ9v>4WyBb8>< zTj7u8+BgL0h9#~|i>s;iX=9FJ=pGW?*o)#&5tp!{vidRBUh8OFTG=wLW?m%A*pQCW zKWN75*P+d`F-FAFa5{TUU8|-ok83kRhe6FK7L$J{M!TI6HqBv18kfM8qEOiUv*8-f zR`KgkbB*0B|9A!UxU3A!>V*=4FV@r1zd($mYdbR#7TLJeo7B-KjNhOlm$5VS^JyMA zer1VE7zn2>@b4_(DWj`wKARmt0WJ!On?4FI6j951V!-3UmZg({XH!WA^J~L_)RLlY z;k2{ZlA?Ey_%LJKN)XG&pJVEcV2J0iB=odE(19uJdJ}J=yF#GtMjRC5Re;wUxPo$Fm?$s_5AH9ySZnho|qw z#g)Wb00Gkky(Q-P4iV#@QjYzzzEZke(?Ms=ifCN@a@IG})0LkJI3yzsMS;2s43&M+ z=X%jsJMw#Q2=jVEYb)_$khG>6!jUuG7M%m^vTmRZQu)zNWWIDx5b$ICQ7Rofr1LQE z{Z-y1?OAqKe~uRjLuKIqqgT?lahr$_4I)+RY-(>d6agPy6g5u0%g*RRxvmj08L#!% z!DwElV#{Rl#nr~aw{gNt5a?yX!eu*c0RsMLFh2X*GId_?t`-~5k}n;|OvExUoGT5) zxXB2=;4-!9y%X;7oVWecfA)yPod{wb%pO1Pu2CL0jxJs7Zk+VO8&z&v@}x#@gq)#9 zH^u&+swxwB_BBun6Xy)anI|r1!J+g?gS&9(<;k{i2%;Y9V}-xK7LSUX_M0AxW$f<( zJCdP*G4?=4#Ly3*KUG!KLo^+hu4Sv%(Cf5OAKy1V6@|DfCXSv1^Am(5o3NZK^>HbU zY_k(Ntg>Iy4?V4@F$=J}_%^wd*8K;-K*TR2M!9AKS}1ngxdC-e0E!2>M{e_4LkrOM|{w0M9ShD=_Zq;zNC&k z5}V(j0B{a9r^?~F6zD%2@t4*#9HzW<3pYKHXec>787+8{hJAkVI85Al@0sE)QcXxEZTva79NI#8lE{SUdEo>{ZnIifn=)WDmq1c&(~KvgALfy6Y%QLYmv2~@1tPLqQIU_c;?ot*53fHj2|KSWCJ=TI*>mw=Bru?8W0A|R?LcjWW<6(ra@r?B{66kD zI-*;lYl6aOKN8nBY1<=Ri!XK8mRFFsUZ$0G_!{h4f@Tvt8Sx}HK743l#JuY6hh za)VFpWY;aHujeGxMQ?i%B1 zyQXflH;w%OM0J~+PfSaOJ^8CMYfQaP+IZ3dKEPl!9h)}D*1VSx|lsV4X6(e$eBk4*<>9I{1L`X^&5JSr17>b z?Psru9L#U(6Gf})69R~d(|@FSf102%`TJ;rbrb2G`B&*=)YP+i!?_X`GWBt_$oNpK z;Q(mzS6=~|4(#f5r$|2`fO(=p=yx~*=)&62jc$>{b!>~7LN41`K{Xb|I%kg6uIz23 zyCSaum@HX$v+UX2zp`h*WiDIvVB5~>6gdSK+8iidZ%PybNNsfKXC`kQ6fPd+Bv4>x z*Ln3V}iR?U&ETc)K(hB5#Xcc6uI6}zu%6mBI*lIKoR;j5VeEEQ3 z1|~<$JM2-cS1KjgXv?4;71s>FUU-d7gPyb1gK_a_lX%-{aF1QK`Qi*5X4Sux!zF{c zV#hYTiRgutzyx<;-t?L zJI5{bMO_Ly=u+?O2d#On{Zt`)Zc8QrVGj_o&(v*obqAlzA#0S_TGL=R_mPV#>H{0^ z=?9Lf<^_yDhz@sbFq4-T0-$!rk6xDK`O40fa|8+TsFKcH8N6snYH6ro@Z%<``vS3- zCByaUWe{e8_#wtk+*;?Um?fO;^P(!OI`-CMFp)!4 z>Y7yV;6zZ2zm}xcuox`CrJ4-}Kwz>~l+*0}ugbCPH4(I@qZW!C9z)%9BRXk^WgM@$ z^A}$dmsKxvOe3mH4c70vISPoDN%L^642`*8bGb9V@R_7&lWZ8-!9A5PIhs>iXp?%~ zkh#&Ct7IMrp4Ec8_mo`)U#{y$`$Q*@;5x^{z(*|BZgwr$(C(XnmYNykpdww+Eo zw$agF{bBF5*FQ!b)LGR*y)~ZazOQS}lrqMal{C8>(guS^e7E@U%s{OBU_UmR4I)cN zvqfpS=ihwF7GP2ro8qxya7C3V8Bl>vif3I(A&hDsp17`&$YXyUo*9x|;JOT)j`S)8RpM^+cD&WwC<>iA4tjj_o7y;-T_^ zILxmQV6U}It(+p14fSC+899)-d_8&z`>H+`9KVqEwyP=aKm|e8v`5=ovHIeQahK&` z#dKO6%!8`=^GLBl zP|j!msI#AV18N_tZVmCj!^_DFFjGS~2EiLbv!If`2-Zt3dH;_70<|grV#n3GzyJ%= zjsuKN%GM+b7ck`~8XTnI8P;?*<5zrjF$%p)?wg0c0x#m`gZB)~-1}HEXb;?ws9;Fx zNB12>)~gWP9BGjVT4V6?E=(zVg?dYdnyO~Sjz4~JIAH3@@=lo6Hj=5lE4@gH2{;Hz zhRAsdS%&m}4MguM`213Y6bUnhPnOP+=Mw*r9>ez-yzn zDb{N~;-f@p1vq#)QZoS;F6Bq(F%>RWx4zi3%9Y-AkZMST2F^(hmuFQqHLP2YypHQN zgUim8G6Zg!3EXHv@Gv8JLw6#(0_(2gSRG`^y6jYXX*BoO$z4T8MZV}>!`;h#67_`G z(jf(whL#?^xJN9Anl7hOg?_Gso+nvybt|gnF{&hD8Y~$i^`=pE%cTz{lly<-F;ulE z({OiT@kyBw%md0WT~;cWVwnSXN|e}rC*cn#FI1>}k1E~1`=gSUvgQ4sF{Op&oG>e? z+SgfYIfN1|A4$T`x7SS#ep?E)6`lTt2{PY;=Jd+`j?v>sHeis!c0S4I1|pKX`a}vx(j~Shg^?xjQ%zm z75u73=1hO71zB(U9`KI|jjBvhgR%6@2BHx^-85nzM@ed^4AG1~#(tf=wbI?7X~Hsb z!BRE&@a3L(Xw?uriTNKDnib51ymE$T;zxe^8$9gqkLzy({-bU4a!W-~3&yyKX{7n4 zss2mQF&*&xWte_}`I%C`99&~MKJ@PJZn54HDAFN<%!IKqAA?f>e(^{Kyo1w=zy*M) zBeq#1n>@P`I(7br#p-?5b}J$Yzil&&l8_TTo7#yjLFap${JN}cTgA$+7K*W($wK+4 zA7fmK&qK z{X}M0_K2%;ap;C`#JTD44g`fA4OnrHPt1ch7>C#Kt!Fv>U9mE zJmJsu(32<3nGtHDnwAE<>gGK&Q!=7KKOVkQ=ai10Yq&tybG1XKBq&kNwkS;#G0Y&ey&$-_>V0pFR^srnT6%FyVv1S<9DwFWOs&K|Eq z+@aX5s2c%%MSa#_AaI5GSBD|9p|Wz23d98Am^5F`M05@qm<<&M;XL}U>AR;x=U;xf z-9@X)^1=AZ@k%CDaE^zhQ_2xS2n_r=vP?1)!xpcp#rPQTVgJ4uJ-1nif#aL+KN@u~ z^0@$fnIfu}*q~^pl*ww#i!O%JpSW^jX^~}1eiSmp3lD0YVB*Cl`0ZNGr`*fi2Q3}$ zK>o^QDP1F#bj!9bUz{Q2E!Nfru8TKFU^7)`swfG#LH(w_e7UjvG+kqCyJa}^BDNJ$ zZZ+1FeHE=EC*@4jwiBOoKk6Fd%JIyC7hP z!4|(ad!Vwi7=)KTI3Mr+83NH?x1^34eii!EDBe z>%%(iOIPaBFJrf%rXprw|H6f=2!SoS$9D#LL-}yxRb(zSy5z&Lz6Y)6lJxWj>(SG9 zP8phB#SXEJ+~&1TqSI7mILM~XX&1r>x+~yL=cEEx%yxw>wQ?W09FK_-{BbI+4-uNw zRcMgYcXCvf!Dlac#^}pC9q`=DrsNej|6(Jx^!ktvtO9Pu$DESYZa9KMs_(P%?Mo;N zsNR&Fa6K-p_iQ@nnc_PHptKq>FQLz35P?An;=UvphrHmch%YbP52<+T7)Sv65 z=tRX@6$$(ixV2{7@5tZ-UU+1&>qerg3Y%QXs-PUO6uzGj?{sW+Y_Nu`C#gvbTph2^ zsTqaAfvRJ+RM~g-r^Zp8y-C%-N(+DD!Wc6&au7Ia9OE&E8EQui_mHXWOS@Js#cOwB zn&DHt?+g+;lm`4eA#Po%>?-=C6B7y4(EiKT0Un<{>dXRxhc#cGaYvu`oTxwFHa5;H z*Xefiq1I}4Q$Rl4&=27`a2rz*fw*6T&^N33+W-@tOSqmkeqj$PN1jTQ!h3rqQk9M( z*;B}O7+J4%xZhlb*7+DF>a?OKe{ER4X8hT(fZWXhj`fudl}d(yC+wm~K%D|yWAQTu zi&j^eZ5B5=WgH6H^g@sB@pl822#YGkI4jLL5q&HroS8R5YWEaWLvKv+ja`^k%lbGz$+%KtXKgC^dBE!FGV#^k?5cn ztgNSAe?41`#EjnrL=00-!j?h1iKBK>dEVPODfQ!mrcHaHTm+LN3-w0>dtqlaNipjH z=^GBZ;Y0d%&>~h^m}CNMN^={tjNYg@fX9Ljhv7SxfG=u|9z*a9C962f|I}j^F|Pkm zHA)@+QxBGRlxSCJHjHc8f7MPiZ$9#jGmE(}uw^YK8z{fd{nlxDqj`Gj_oW=jR#g4r zP{8p}guzdKax1EXk)2u~|^pBjd{4h@B6v{{PAYiwZ zWw{VTa`EUnkzEux79lu4+{+b({PeDWfwil#VX$hs{O@%VtjJ($^h%V>Nl503pq=x& zdonJ*JaW$;NQ%g*VA0_pNXk$@24rCfreC_g*Eqm*MjLq@el%#iSlY1cQoYo~S!>Zp!KAQKwQe*K>2IrG-=#$wT5kR8+?;MF zJLhOdp#zSUV24Vjo37il8aAbESD1Pz2gOLC7OQ0^Qb# zsbT&nX;<=#Ctw|rw6m6*sJza6TFa-6ZdR2WR#I}L7WRq>LJAZb(X#MDk0^lVXH3-< zUS3LvU7JqVVrU|8DB8r*FZs<0*sJYj{MoB%Xa(tnc=GwG0}+#kzou`5&vO-@P7(6U zmEl)as=?_cf&1RX^d>p8*I*I#z8fOu*Z&L?XP9eD>t$kJzhthWY04DPd)X30v%$UbA;|2DmbM1cv` z({sNZ^k1xuv;BT*uSZ5%^L7;rU)NvmlKh8n?NQj)7$d)}Hk0|UL<;42MTv`xENcz) zbUlu0MX@1?&>T78Mk#=mQJm@GOC*v^949+oM5UfKC2EwsF$?Hq__ySo{kGTBL~;Yw zFuKxv0YerQT0;Q0kf?XODE!EP!Jh?*v);#18r8J9cZ3gS=+Y{+Xb?_6JW8NzA}Eyw zRdO;*x4TLQ-RZIF*hSehEJjTNkZlZr1_mjT7{i`(ar8BjUGw<*P@FhJluhP(yCrdK zwmd6_x{@#!*J#xW!dLvyUQk*692I3ZkPAY=Y#~8Ve_wmJn?|qef}#n96#=?i;I=bRyFqa~&qUmYb$3XQ$o|O#duHPkxdp@NfEF456lIsG6#V zQ2lw3=&=7A8IyKlAtTbpscP}-4;iPUJqaYB($QunST2k?c&bA=DGhwx+q(I1zsF%I zm#Ax%8$f5kL|;hC*tF)_=`D@u+{KWX{){afit` z_AQMHX=aA<)Pf1`HunIMTsn_d%GK$23%z;-RmMfgrb-#~@$kV;a02YEdf6Iiqr8D;yVEc|LQD`PV z(AmAc3}6R#{jFNCJ|;0049_cl&|VB>%Tqo#?_O_cteh$c*D5IsPdtTbX0b&px>< zj!6)|p?f2?v*bJkhm&r~@bv=K=K|cxKN$zmfYsm$0B?LF%jBpH_HJ7EzQHr*Nqb)^ zBOYtTE!;X6sA=ZWg!1t(ZC$+{y4*P7wu4j@Bc}MYrq=YVZ;mYNiUDiennkHhV`QF99Q7hWH@WH3Jsr^WTVUZeQ{lQh6 zV#e3`r!@aUzS#Zq1|KT}v{2L*a6L0d_wnXn0hQ_(4LMyH(MxmVkqK+s@uO|P5G7wT zq-~`zL{T=E)#)G+Y`|zG#S<&?Na~6*~-PE~G!fT~V96C~nJq_IvEw$4UhM5-He0ia*iVIKp&D zFP@*&Ypn!f#@= zVK(sGD{3!gnp|bPtlXNNA1g@{PJ@A*(K{0Awbb}CU_{9(bITKc?HzVG2BEDG)`YYQbB)~46yY_zfZqf zq3sK?!KAZ4awvrXbPnCYK{N+Y_|8)IG2%Hv%&BDm&H`j1O)#_0Sg)Y|d>*hdofX}U zkJW-031q%WRA1CTozB^CfV_u3;~%ls85Vqr&F?@oQ6R z&gvLQ6EN&k)+^j=kws?aSZ&9vO3=`GoMFLEry)AIfejUP;-NnZpQ>1*B2P6SGxX zn_Afu8rhdZG-hoRz*oSQpQ?EsUvizPj=^V2dppWI@(<^@E-5@;=k8sK^t)Q$i5HFm zOwva0EeNzTQtB7KvkZlq?h>s^v8?*tlRE1BeMdI~);ylOm$K{P07{IM$DNSh&ku#y z1-w(b`q%tT+eZR-89Q?%!GOrBM7KJGd=DBo(!GY2uaeTbt&VVy)~OQfNNjkof>+f zl!&aoU-77(H~0HMy{^s?z9jWqzbV<0GI}O$ZNb+E0Zc$fS%J^7Wo_?zXF0ha1b=%4 zR;+Ev*drvX)@&Zl^UeG+IpKS#wD=q#UC!43Xe!G~R5CEqxmb;^4b`}nN0B?^;SY(j z^_^blO&UOB$vBl(n=vKQsnB39Ke0J{c`|w%tyJDX`S8l~)SlB~;093SHKUz=FVOYx z{~EVf#0#-4uD@zg5LQU}Yd5b4So9s@)8h*e1J%+fhX=3NES9EmP z^5(s_M18MLZfZ}jS~|`k`B%J9Clx*TvfgAvIh6P)YBT}x(pP>JMbcx>~=NZ1x-5o;NKTQ|GkSG0o`-FG3rJZ0Aee%uJ;X-%A z8%5gclI7JHw|N@EQ^EHzGp19>Yen<^Qtr^Gr4FsyZpIR+M$kG5t%4WU*@7Jf0gn13 z$^w+VoS#LxR^tR#VivhGGw_8YtP8esR7}x0c~HjKTD|S`#SQw?Q*?UA6gm!&Lw zLGtoC{s6Znk>qwXV}1U?v0lGxRVPr-esUt;j72TMsEQHZGdEvfSD)0BiEo`XcZ1pL zvbvv^TX;Kn1x0Ulszmj2Fff8zP+je#Yqd_uJ9i1avlL10*yA=UW15hy9LBJ5w6sMb z%G(H1Xm2u5igp|~I38xvoj>2JZmaSx5AOGxhd7)xHZ-76;wXC&5ZfrjCMD0GU2asU zqH4ryHg~)A-8`?|vx>?nc7d@cS)@qGxjboOJfwPE##!gMJoUnoT97*|QB+jLlt39z zWwHFUT&gLByc>+ub6(=l11|NdSa6)p@|b`w-K;00D|TR z>hSa$gC-T(wt#l_jrq*oj8dQ+sncRX<%w4$t_!kqpM#>f^w?|&izn01^&9okP#`Mr z_y_X}=3mUrNrs0T;a56JR7b)|WrYzCXDQ*4tjZ6EWW(;nti*?l?=sH7Za@@}lTPQ+ zFtV_^^46)<@f`Sj8{OuQiK<|#|LwTIYnj8HK5m?+Z0XI`k}(H4zZjg_r!p=8T zUN??;=CZ6kV9dVRTH~WGbsbFA;Ir6exR)E{XGT&eN(snlE`oy4kdJ}f4qs%mqsl=D z%?I*^Dk*_lXNLTXHJQKm(C9`3`u390?J%V9Q z#Q7yi@$FH5cAeY~lPb-}a1*g;pM35|#>g!TX0|(%dP=@Uyi`2;;|XrxpX1TNd#sAA znBVc;v7MjV5;4O7^s)*ZQ(96c+VSDN1$!E+TUEf*sS4&zi2bpeSM4tTlFfmcU;1{= zDI1|`1D{-MjnW{*JhllYPayp=60(_83=!oWTSacW($Gd_wMexHfToBu&fu}8F^kDHD->46zk@pEhN@PPh0Srf3h=u7Z&>O3W=p1m3inACw2PZead{I5!oZV zo;i8QFB0ed=#6hC3qCP8P?gG7+!w1WqOI65WLf?uYmMZ-W5f4WkF**=)6BY~}&G_7nE zId}EoFA*surC&TyJ@BF*nfZ%2{teZ?tslg8*c)zZ2ntD5iTUHrvsa02&Y(0CEN3h-xK$vguxY8O8v1m}>gfR^_%$QD z@X`a$TyiH(@CYIwPjbSqwX@UbE{ds$Y_1^LyW(WeaI9AX6|%Im@&wFg=YL%{0ZwO5 zzKV_RE6SIRb^{^?9!yyr=tx}eAKg(E41d(vZl@35pl<5g2pOFvNQjSvA@Svbl1 zu-L{t*59n~s zZbvv(Q^NkRB+;u@!zrL%qr_b4oczC~Ct9*swk8csmJ}ZXs3c>htRb>M|Wyw2t%tsOtN5PU_~+|T$Bo8t4b%}F69wvtopu92%Nw1K0d zwXy42ie0`Vx(o#{k{NMcT!Vdf420k|bf4IHkzRLX!x@P4n6m`Tzhh%BBkadri>lbF z{ym*hgh$Fl=L!O~^Okdvhe=E1Y$-8$4?s<`2I|h8;xX-%g%sE_ThS$72LOi(ZZe+H z{Yo|nDObDVcra0rJTrhMMgTeUFHOv%NS(Eo4mGP4Yvo1)5<17;kvl{?Ig$HxBJUYh zv-1CKJLPI!glTrwb5|q;xP}cmlcq?OUFuLB%|@x9np#Gc7&?4a+vm7UsBRRKmutXA1$fVa|Ju&4UX0>feP&Trj8 z_vNb}1*;Ie);USB^Po4!ej!;Ro2|d9=>QrEQ^~r+07_qO!1})+9Y-xpsT+PzkA<`K z76v`|1dNM;aMEXpi2e5_yFSC#vMTdIZ%p5&JGDH%8_GiE-j?2v5QLn^*BLT6@%LI? zdX-@&fS$nQ%NO!wmE&UaWHm^fug^;0R;F~j7YxUOGP@2G-CZLrOmtD%7-MvgdZJQ} z2w#<3EgxjinYFnY{Ftb%DhArTp_hbL&?uV{TG(zQHX@#t=htgXe{DC!khm5SM7{}s zwN-cy6DSv9ZFi!5irY4DT6Hm2RJasH1-uMBfHZQ1f~?^UF1OwuC{Ex|GbBjBl< zJ7}wX;RKLyToG;ZWkHNrOrCEF6P_%N-A;>m!bEI2;c8TIzC#V%2Fivh%q>IY;T4fpC8q8L~M~VDA)=+X4oC8DJcF1ZEgiD!4 z8W$NOuu_DFkq*;CdXyyY{~vJru`ALCmT{z-qdtxl zn?RD9c%1)+>O*i*%1( z=3_kyJB!CR0tlK_m~}AK^s6EGsEVtCY#27PN^K^mMmwhdI+S3@^LYsq0Y>(mU1Apm zvxiusWD)DkCgZG`0z3LU0#lpdjk~2l*v!&0s6$l*{!%ij0&WXn6(&?^=uEI!E%mE3 z0|;+K?FNo{O<9=^%5@{Qic%-ae>BE+uXO>y(u^ZrcF06LXzZxhLX1%pzOzD?2CKx; zg8OOQ*Q)s2oc=h*pyJC4Q-6_Ewu7{FVlRA*tk$X<0uANcSx^J^xFxCy9Ef@RdPm$6 zJ)(Y7zZrg8FhX9nd%6b7;E>vwmaLs=wnQxSt7uL`8g9;L$_7(ruUwHT6f)U?nV4%? zGx}`&zu3kt2c1$g-LJGHO!SZfKR0w^Z2<@|L{!9|&nK1Ry$szA1k|j#3%gMyi4`=n ze9<0r2VCk-YQJ*quD()RSmU$-@jD?FRw~>&(bWxvd%0M8B0kRp5Kae{lLa-xgzzLW z=4lUxI5NwayHN}dt~8Tx_I0Ag`t;o{iJ<1(QMQP=ip!YlE6Vg*N!ZSq3Z~h>}yX+8QK$0XlD!)U+X&2 zJscdZ>i*8nw8v0`Anrcsr{V^kUC_4;nNbyU{3J+Z?$v6b(b|CV30JI=lJ9t#Rw&;2 zhKeGZnotAoTAaGzmvjhx3Yj9dEX5SW#t2JUk*OoQKUI_}TS{09FXpNd?kTx5T+QH* zjfrNljyCSM2!#XI-*p&bQQyJu1o8>IZDRP!3rlr9Bh^UR6{N~)o;2o}$U5ab7IrIU zTGZerUNt(rvzUn4HE^&QQ*q|@$W0l6?Ojd5sYrJ`H?*>H7ASEfkla4Jdehxy1D56I zh%ZL_&;!k&%g>I+D;lByVj*O2p}qTKa2>Z{q%P`dVD zttETV+SA}3zc!8t%1<|?EhBB%N!Ces+H;y2`F;Dh!&{>UBcpC2`eoR*bbW=}oiQSZ zAk?PhP1e|&+B($>RV#3S=m^Gw64wq;D3vavntg-iI>kq$Ra0&UH=$Gqs!9I!BQ}U% zyf+SJ4~xo)Zf&K5o;5*H#S0-qiF;0g*@a3|LIU=2B}eTUXS+Oq zB*x%=Eh5V=6C>2KDr1HIU8}y>wlnpcNB=qhNNqN5w}E4KxndNUKS~QKdW0Qg`72IS zOO=)Q;UcPL=)4J($T8#ft`j_^UDvU)@@AzygBMxw=3z_!F`}<9 z4E3f#XOi%kfpQ4G0RtT$PcWbUuKeBLSW+7|d2|Utkq^qKDWr}8SsKa^RBp)rvhGYn z?3Rm)3;JyKujIpEh{DBrWR0!pFvtqBZpg%f3;iwnMAFBBY0A<;G#vRi1_&^F8p@qFG`}bTPG&IR&ZRY6SPz6~Fl-O9ife!0f9$8Ynsxh=yu73xW5_;>H z5oT&cUQ_-R?9tRMMz}vAx6Gf8k12$lYb0zZ|GC|5=MC4YK}qVGmX=$p3_~_7lw50F z<#{`!G!O>c-)-qy4lIm?n03{}326ppvJ@hiHEr5PBjldN?!J9{ zs;21^o(=y=M&#d{pA`6WFi{(ocMzQTO$4Pz7Lm=RFw6KHjkT1GaD$>|caf?|QBUY(z9w=lwb;qYp`k*~?e zbQo!4QK(m)!oWlEL(%T@qRi!nOq+K*gt}Dj(}*jqa`^8bIxUmZVTPefaQT(Dnl^DI ztPU?>a}5qwXT(1yWc^)3^+wIi(#T|~m&KvgYe2q(vnSW? z#*13JE{(Gm#a4#SV-#yMRu;;#wX9fipK4@c1%5^JVfo*%RUFp$bu81N{>~Evat4hD zaG4zPWIG`HFEzS#D|khAXgHZf>AFh$Ho^LtoM&(%6;i5>>hVL3%OM+npI>&luk@Jm ztwtxm#p9p~>=StFYtW$qz8N28ijTzQao}FGkFiLWMgAN3sL@ z@-sX*FzHI$#DOJSfvB{#=&V-tAZ{HaJ+!pOxZHxMsEVrG^8v`m-zZYtU=O}X3SuwH zk;^{wriuPO$3UpAc)NFSw_Mh40*f-FHzh2y@yc@*lnav2WPpnkSU$(WcRup==y9EIZFtnA)qDR5bYuxrQ7w z`ZTlo6qqea(M6p_0Xd^RKQlM0+p8j}xNt|%Li*ewpeFeL(djI;gv%}E+}`q__WG>Z zqxD3ht3t0Eu&`4345jpO*s@YqK*eUEjLL;-g&`meWiYcBZtJI*9^?g#CJClX-NKO} zL)xMQ925j7$hG(1XX=gqc*ZCWbaSOLZeuw@1}_}dL&TV>`hDL@X7rG^UqumU zx`G<$KkA$}YZb>dE9_2c*DIqz+`QaZ@MTMOTp5SGZ>&bfQuk$#9-H|yoDnPA6CQWwo(x6uEMJ`We0Mc zKT)4Tm;+CGCxLkb`L>K)5|RJOcG`myqvt@m@|J*Vy~%C?4pcVh_qilU<+}_Z%6jjq zRG1;U5)I}?mFDi3A_Jcq&iXfY2v?~!ui!jWecM~Uo2wd;kw*I}hV;PMv%d|xE(Ij$ zY*b{(@)Os7(5Y8hizb=|vZ0{7E@dtFlSUj)WN!sDm7MT%uYZSX06E+-@OA8C_n>hc z5U!DLw|CHqp3--M5F<6|rh)Te6;u7$ZLGitbw4Sbe4BI6u3H72%PiH=`_q#@n4j*S~)22kUM2?@enE;0ekjz$Hb5;aE4Z^#G| zENy`oi2iQsbM^0lx#Gie11=a}YGlt&cVEiJ!qp@wabx(4&RGjN4Vo@lCw?iqdc&n3 z45}ay7xjpa>D@dxy8JX_@fs@naR^VNCCZh(Hbc=0`mq7MHBk=FhHJ>3)-|xDdGjd| z|AOH7H~Q=JnN|av_ZQ zzaI<>Z#UxXny7yPKBIi~i~P||Gh7L2+&UbP3X+1Dr6S{Kc?er=(`Wqsq-El>XMFA%|;s$~aaukPwEk(B4kUO^_LMgnw<3 zmC-A~Ojm3^cdNvv(Awt6O=J=RO$8c!1i$)lqT$t}an*Yvkj`!4IvNkiQce6eQF! zL0W#nBL?(&VThgqcV4ndC!(K1g&$GPD$K{v|KWs+0yPCrxElHOWa3(|E%9xnhE%hX z1bbd&^iwo3Pkp~kXP+x=pkkguQ?pw=DMkxW{}wfVYVO~Rz2Pw42n4?B+)6yEg(b(6 z>}OB-3730bU*Wiq1M%-HU^gk9sqe z`pzu1qYMEsfW~qF>&((xX$>PCGJ9!fk z)yFur52Oh469^mDp_m?sW(BR&zc-l|UqWR^r8txf{QabbxzCt7NOM^V zYXq=;46d{)L=RRGm6;h0B*rU8u$~r_LWtI|JgbY9$l(31LvQkO1B^%zsTdGBSil-9$r@(VNwROztAPr}yqOK7EZ?dEA zf=zh{9NG%!>UypP`zNFYgS2kc!!Qp5%xL1MC_9#hTp6gJpHfT4&w$xG3DyZKTPves zME>`6$BVs}1g|@C&5E|JQjZ3d?>Z3Q9zzg?Gdkr+lWj#9nF=GRA`EL-mhz#qzm9~b zDg_AZ)(I@0NNQV5Yt9iEx+8}3?(gbQ5z^=4Z-_s#e_g}?ZkxqLlY@uNh;ge+Y*$l5ZWZNjNl}DkcL+ zgiI3V@>y`&P%G*b-n6HmsMk$4v$U>MZ7}%7`z_-w$7X363B4 zF#V3u6QI`;51)sZ`UEcR-L&Kkgfs5?xfi>R-h2GZ?{`5Kc&1w% zv4gxk-EdX_ga!H-LcFUsq<12;&JDdCj;A7FQDJ5OeKmQ@8 zOrZCK3BMI+qpgLaqAJYDPq1J)5`}h`K9gYp|jl zLp>ut%Y2nO;#RA~WXNh~Ket%2o|wkbsiJo%S2Ji5Q{NixRexs&N1oH`Td^Z}5+CcU z-whfv{<%1HC~)KAJ1vcjSL9`7U+hA49U0>8dbn_khItOEzt2Og`<>06or^CG_vqUr z+82?gcje%^CUNYNM~JSPlisyc@(8Ju!C->TOJ+LUyK)Gy-sM!x#e2hR*zdz~s(E-S z*w2-5l?FP@?pX=1r*b{0u|0pj?0s~{c1P-sGIp}j41^%0_Ezz#0o*36Cf;uf0%`4- zbKa!SJ0ts=ZJZ@&z(wFh;%MkNqqI0mX@xZtLUdy-|I}9}Z%B2y{Ikyf(?8|MudV4i z+ATN6qln!bg2rX0@u{NgUC@@}T8rCi)Av2a6HcLh0rf#70Qh8m{}}-QBC-E!5NynI z=XaTjtG}X^8FRz6_*%6muF32yxg*F{KZXC}knKIc59v1c2HNE9T_`hJ#3PdTDd;t1 z(mbzVSojMI(O(3*o;eG+SQ1?4FJLjF_?R7o<{y*pRduJW%;$vQ{@gNn2bN4e)G4oi zOQwij4j<;DRU&e)ohJpa#ScD<&Bk}Ggnt7lNi*WUsXy)g4K=yKha;QlJmLv`Q`o*} z`ybVl>`m&yO6Xtc9+1E;;x`6vCqnK)7VcUY$bDad-5*Vu7hiWFY)yU2D%3!kR_xjE zYJ92A0gzh{dB>H#Lw43rjCi}w=!>2yQ)3+vs`}RKZ;18m3qfn{vb3nJYs*Wvj0jur zHS~Gu(b74>4;Uaq4HKMho%=AS&jH z*%Yrm@xRH}gH8=AQ{VsK*=20uGSa;GKt&9jdDovTrtNy0Rd>xNjSPcV5#1H`&Rpu^ z9mS$}3Ol|q^KY*LB+{m8YDHppz3C2D)wW6GF>J{PwB$fU+l;h*1w2O-+_(+_v87ft zaY|BN3o;tvC3$U?I3H(5u?NLqVm9?2F8uxye zKvHbQM$D^bwv(>l=d{shM9LKNA^HZ7wXGlLbvu^O!ah6jf zJyi_IRGN#jy3=^~Op437Sw>JUf;zTg^~2b3!+2Pp&_Y|RUAV;bX?WsXuG`(qBxeH2 zfQPdow4S51rZm(WE+VHO%xVFMmG+vHprY$OKTEKe$s^<67Daxgz8 znUdPYTKW_c5d$TSatYR`@84|kO!Lq~`f_`sR4=Xu^0Vv3 zm(6*M&o}6(?uhLp)IJ#+d>dD0U&YlbeIcp8;`)|@kA7HO{kZ*8MB$au_@gEuGQ@Mq zqJYwBsD02M1@AMb55DcQZu8S5v`Sy2g4nghpyW7b15yPp_FkOOU%j_fDE9*+{jI{; zSQ;2vdgjVQ3+ggG%FfvVmPl5r*|Czs++TGJFShbW5!{xr_b1-W=3|#Dhu#Dg>z!Ly zjICjFf0u6={guZf^C97IipE&M1k`{tc^%qqtIjxU57v#BRK4Hl z-c7bzgS$xw8e9#-qv^vvlSp1PBs=TMMb~eZ%gi|FmCD4qQD5?4Qg0Wj99ih$Edh&? z=w;{nzTnV;s07+mG^7k^2>QVU<_b+xY|eND{pi|X3P#DNsBhvsoJHtGKfH9Fi;Crj zx+JtXcI9UXhZ`}jq9`D~WgJ!VU_B^>_MpTcALpzoRm4Ym&$;{z=6?}1Ghz;1I_tlG zhLqnQAb&YFB0<=TqSjR4{y|+4<#B4H|8TcdmGe_5Nbi>)39#951Kl=k)azSpg8j1L7 za+GZ+&4o8*DExN2yLQfw zR0n6j(W2g_&krBOTQ^lX4tt`l9Tg$0Z%+?`^cxqrxhjL!ddqzcBSIQE?YDB*4u*Wnb zP8!BiO=y-Vo&(xd1uYc_pjGk_x|Ya({*<3y{oFaNQ-fwf6^%`6CP%3 zr|{9*d}#X53n9Jmqi-Pj3AR6DT(BVgjsLifJmpRkfVM)eC}52j2hJN_dqvMeZLY!s zANmYR6FD(EPQhMboRUiOQVJ4?$d23I@m0yMMu373PopkW%d#@q3oCzQ{z37PMtjm> zIim02-4o6;NOu;aeDh96$BH}JV+DR)oR*8a#en@oy-e+FpYB?R0ebMxj}Z$8o8+yo z#-B0^DY90@2_z>!foEFr?ghuLXi*B<=}z*IRiYM=adLx9{LNxCcbknK$aVVS(|tc( zE|=aHTdU~mhf`@BTVG%E9(bbSQ{}RuY=KyUy07WA1{pSFF&?Y=!mT!U>UZt{jIe|C z&+ z4ZQ1$WyzaHM}5|ZX^7~KInk9<;1M8e472h-T!3*^3+~}GPRqM|oXmV5quY$;V1Zr0 ziEa?35yNzbIzEW^tAn$ddv1|!dO{%$MLwuRm>X7n2PV2!@itSSeVw5iXuFB$N00|2 z9hDJ(Sv9L1&`0t?YR(>xx8eTa(NpCk=U_*uY^h$?(Q4ATnPxnPX~}3>pQ;2 z3tL$W2n_@5*4QsNwXI&VR4&ga?URx8)scdl^Po6BM{F_upa~i!8~1AdjHoKqpS^`K zt|t8nWyr|o6L$H1o5>>JBPD`~3yvVBNNZ5Cr$-mb!%p>&`~`vEQ&Z&?7X&(;IR7Xl zn>gl3_${5D4c^wEbqVnu#K~8WNWNao-`EYWM-OL4{<< z!JgKkAfn&yX|3Pnv#0;uy~bhf`dR>p9mr#uFv}PAvf*sp!oLT8p^bi$TKN@rua2lr zU>fAl%k4qIUJVc#`(`7dI85^(xC6EymHqojd}^y>Q%4nQAJ}<8OTS~dE8;*w%;f5e zp2;T{wG}9L)Znc0ZVJmJBtPHte)~o$(jfzHF*zrC*}gEDGDvyO&Br=&3ZtmKK&Us6mi$j1|hcg;r3(S3=x z?k9hXJW_Pz65nm;X5r8~IRJ-#=?B>4Fxm|>3ovTGE=ov^#I@)(%RO*3M!ydHCwlf2%wjQ7^@vB6*O#A8{lF>J96ERsm# z8-B_Oom&^T3B)p(v|L6@3_1_>qg)4QkK4RK(obus!~kuU9hkOFgeagnP^FBjr)z;} za#q)`b;CZ;Inn?k#oAoaq*`f(SvZG2UE;d)Jx(4f>efN@Q~<2`QY4-Z1_v3}V?V*ir?r@0#?s#TE9O|BFs;Q>x`Po#&3rT?ym!D@aZd(%4 z4YGuW z%%+Oh#+@g z-PWq{D;J}!qjOG}sl--t`kuWJ|9f?{ElA$|f}%J%LeCZyz5QCpV@O!cS=<#xN*bTH zQe4%b$|Weg=2!}nJr9rDj1(7~U1ycg3Ygg^Q;@I3M@N*9$c0k^!o_yb8_awXkjeH$BRe@nsE_2CCYlEnR3&JeREy3 zj2P)$g4y>~JBX1n8m&YTnI-S z!eWlW&UzRWe_8&<5Eiq<19zm!s`FXZa=Zw$L7ux5J0&~yUGj(F+$kCaNQE$KeG{~D z6?1u%7QHfZpj&i{-qS+flGf|4{Gw-0^KxS~_w_^f?S#@|c3cLfxq3^EK89~wd~TBY z{YK*zQ9?$vzOP|P{8}>}5K3+{iA5_(#q5OmgX`@v-YX)&H!`kyE<&E-N(N{gvI}o| zRdQAQX9Q5lJFi!_K!$3j0{gNOmIQjsW#H>us-~>NTX-z_p+gCL<=eB`L@MWEQp~Pn zm(EnCG|)hWK77F-zIzr<M_$<1Ru>cUN(Y;!GtKidWPxeR<+Cyp`;kjZIz{9-ZWZ@m$5I^He|u_AWcijN^zoqOrbb1FIlEIB?nz_rp_YE zPYe12KKcXyrtWjjXD^wdVn| z={L5&w3?7#(Ga71^4{f5qg-9J`J>U}FX;O5_sw`pTP=*pZj1}o`X>v28al+3KT`7& zZIuu)(N_N)?}Tm6;73Dh<*cqvTPrd2R;c(>EKUk=XJow|seNX5Jphks#I|UJl8?}W z4y9^;j8lEyks#dB+6pTdF)sUHV$>R?fdP14^daO#v;h6?nd#ODFrr-03cXXi<6QAE6ebUhlzSb-!_4iq@F zXf(H*tfj1!&jgcrW}?{9SdUK;-K)+Or`}Cjx>)3rAn#UbW+ax#nl=5~23D?}Qcv*ky0SKwQ2feT zp^i1AehL7Rm+%%N~MM{mK4#q+-W?O>^bC7)k?NEB# zNZVwCJ5!Njln;gIc2udgP*zRh9)!_)0UKlybf*rGJ6bI{X62SN3d*H}V~(dB@TOMN zuPQbPCEVTUs2W$A24CFGie>|zX1xmXRLKIWq+dqFE%x01z)8<3=4$?PLV+-t!l+Kq z9v}4k=q8Icz^8UjWy|8ogcdj7Qh3Xjdy;mBLIM{?vm5&ZUgdU_~f;g$tit&7x}^HjU)p z^e&@~o7nbk%@5*3dGjjno!t;iI6)Nfgpq1uVeV|vl3xv~ua)xrE+83QJvZeWw8W4@ zok2n4m@($8YpfjvA|a$=Q>TRwOfW3Itb=d1vmI6K$21-H`fl4(5`7p>LXzv!2%y=~ z^C!i|XZ?WaX&R^OIasGB%zOc;gX#KZL4_Un?rlKpy9zl_4>pl?YME1K)jE}@7V<{0 z0`n9zD%A5K^4a5#w-etwk8*-?wwHe+kGN3dv0y}E?9GB9os~D{o@7eFLtZG>ceJw9 z<-D*#lJ;4Fd=$6r|Lif=&Xvc{8*Af$k^OAqPkcNJn^{^MT>X@Ah!h`_)j6LM*{UQoMosys~JOWPM0hXj6v%WG->SD82Ym z6Iq0=Ih2}^QC&H9Tm63l*UIf7JHJ18Ebp>yyny06&keJtEfsAoR+k?5zM)< zZ5kAtOGYf0b3V=-oqgFpiZMS6f^1Prc3NSMd-5X48F_>Q+wV!PD!boX99tdjE7LJ8Ja97&4^9thY= z0Ad4O9oXzJSm{jc+UlNW5vO~G9kUE^ZHWHE1^Am2kk&3;dK>1*c zlx7AkSz$Sb)dif{%FxUl88sj2N*3f&t@W5i6pqQ7u9m`CP^77_XXO_TF<@Jtn|0(7 zCj{sVZ%QPv0G&z2CiE}!C3NG`q;2g0bqHYX#0xTNI*iyE^0ioW_ZIwL{Wb5a6pK&P zJP(n8?5(%)9r)h-+`)nE*wH4MhyCJGBQ`DE>9iuE+H#BwkwC8=jI+zf=Gn(PL5qtJ z>I2ffWB9>Q1wl?1c@$$~_QULRI%c;i3KS86-2ty_77 z46v}8i_bB-5Z>wdHRSQKtz$q5uUg{e*f?5)gC5BT!jA~X00}hc_xck}`#=UNmk|%< z+j3nwQSU~bGWV1gRx6$F!)Xk5v7=80oPc2dVHZamB6dt~wq~%5bGiUKF}HaQW<{ue z0DR5DiR*xJ8t6J*9R23`aHyo>igCh;g+4O7Y)2c_@iHrlA?h8<0=c84afh*rc@1P| zNx<1wY#pzEFet7V#yo@IzYZ27&{UoBw@KKEj-azkGB8r+(uVdah7xw2h2$odBK_0E z*ikXGI#E7Xh6R>L3CO9P=sG3ATa$-sEH)mkb;a9mOmBF%!~Nm)EAq(s!7hJ`KVuF? z&m%gVNA`@2i_)TbF-vQYK1vza02CH?1p)9Wj@0I^kOOmIL6lvXet8o`4g5Z)I9UW`7Ii9nbSA`r zu%wKro+9Os<>OGEFhm56U2f*r!Mz*nu}6tLPFdIW%zB7z(U0FLHR^X-e!UyXH>P}}VSD)*cVN2s zu0{aQZmqNj;G1RS!43-70}OZR2F$J31q=-Vk?dj()dUaDqF?BAY{t%~pGD0$GV%oW zTiadgQt;0%QL&28ri71BqP1PAZJElHF+a+5EJ=CKOuHw3*|UUGTRL5?4)#WpZ&}Vv z3f%kE%pDV{Z>8wC#6V6Euj2?z^oq3Sp73-h?#ObwDC3>?rQF-}G?U$DKD#J7o8B8e zme<#xSJoQY&}cE7b)X$kLD3kbi<3LS74T^lcQBWae-F_9K#D+^)*~Ct*N``c2xAN7 z0irqWWR^eE-`JjhD`Z{SzVfyzi!@)Z+3s9;AXJYg@Hy1DVHMdA5Oes+tU-r!L{ipL zdYfR==Bj_{I40#Ii@L#`mgeH1gnGC)#TqAr zk&{KXXP`mxB`yw<)8s20dt3o%a7&k}=OewxK`!=rwIaIUjgzG!w6AP;nY^)8asg$| z96mLtjI+@~buc8`Q31EwS?~6;hsCxv?PB^Btz-QP`KoMC+ev+n58wNA;x^pUf!=R_g3lhuy@2K_t)cKzQPTdUgsPDxoNIG!l zA=UAmBXAetp$oVvj(HyTqhwF%I@k5At2J;B`h!(^=YmpVuaGrI5r+6~cFUZPq<5da z0PP@=-DeYxlGt`4codX4ys6nW(=cbc&xyba^J`!qhPqxW zM<$pgEkGXO9nUpM5HsyJO#dRCavqJf@bgDkiuIPd2>HQfZ9I6$>!ob2O)M>00rK;b zEe;W$jCG;Z##o+Dk3t6AWCh$mLsLF&0ZXv|^Ex9g;-{E^ddfq(&nsJPV5BZQKZ8p#S~5dQP8N3YWNkXfo74 zBe@X=MaCtc>Ldn8h8o*MlwAwP9DhWqhn#BzuJkPK-?Jv^KC4Zd2GB8?1R{erfJ@Xk zCL|k<&g7jZYM+V_a1u+$-`zp;_Ji=I!&XjJtIK=52s~dbz2?bg1u0L(5E;nE1{~0u zP@VX1ct@<#cLn0zJ|QG~HjYF6`(mOdeDGE)!d2;3Ri~-|A$mdOR4d1&;C$t6tO&+< z5+bzK$=`go^%=5F`eiAM8Tjg7u}J)61G&Q3<6ZJkWGQkO(t9%MN#IVf%E6U^p+_h1 z(jTlLaj>fn#9C1SO>4qXU6*T+g~Z`8ng9j(I=V2>N#EXKxb~L$Xs@q5 zP_?<_b;b`u3R6fvya{`e24MHK3KfECYwOfpvE%yq!NLg(Z%5_?!hB3|aJi~&eLgZz zV2i|*1xKy^XR_nGbfy^!v1n~BN%UnZqQzg2MgP6M@Wr7U;<_TiYnC-mn|&QwQdXw{ z;T_QI+L7OF;v}Pg{seHQ4-&yw=Fenb{#(U~~ zh57$Nc_Fbsd5XLLhOz4fL&%9YzF;u@dn@@F2H#^OA|5}yJA+)hSXj8Q-H$TLiO=k{ zxvSyi+-? z%4&!GOvFRSn=mH7@3%^kH7ur6ze-iZ`#nsLz z=(mR4aOvnvi>K!B#FgOKBg}t-QRT!z`TJo)dl4A0f1|TQ<}V|-+99BNzQ5V%C;AOC zk+|h~UyF3ZJ(QKq0;@tHkZn-dURvelj`;V1f~w#Z5})K8bO$bFZ2%VTz&EZI=BRpu zIi64kMY=^4F#m3Y_wCa-Eu6o>^z%D4sfm55`^UWY&q4;ZCpn(UF7?Wa+mO`5Af_Ja z{;CE3vuOISi(QRTlD0GR$D#Xlom{S63yl$-Ny4Z|tVInTgxg?VwLAT_a>Ak@bGiUr zuIbMj<9FVH4!(Nq9fj3!rTk4P6;X4x&!9J=`dk{0H)_%mpps9MLzqD~%vEtFDxN-a zOJ{CutCo)%w;7NZ4Ix%gfjdvo{2{49l1f-sgADW89Vozj`OIlt3iQzP{^Psdayf>XRvZvdv{MwIp z#8GgjuTBS}2jKD1nIHC$8~cp`X>O5ztaMi-UVcunp8nZ$^U8Eg`Bw`i;)jJ$8hReU z$YOa+c!53KVXy1O@ZwE#w%!wTV|{-Sm|wz#qC0AkjnQV#v0e*fwey^fa#35c6g%cv zie636y7;W*>a^yw<&F|*Y9Osk;VbKEAidmN+zTH$+V0HYx^Q!#mvA%@<4w%mI_MJBx_i75P*^Znq!KHwPKoJkL3!|?_RPd|d9DAs z`v^-fT>Qjg7HOE<=DJvBY}*WpY$Ignx~LEG zLt|z!0x^+nJp2zf%bFZEF@lGd;iG7ouTR$IL~?P~mpurwO7LxV_+Ecb@sg+&1eDPG z+e=fQRhXf_jcH;0S*R(3k$0Tj=`b>-xy_WaE(~tTZpV|Tx#HG4-ptrp;$bnvhAEbG z)? zEA3&W@$rDs27@Na+rS&q*2Lgf2MW?jQIo(?C5~xA7COsJSL2I~ouriu@<+qvj|zUO zu#20m;jVGvBJIt!EJ+hm=v7S?`oanN1_5lZeuAlyNhZQ#Zs$r@3=t zj(2??W{Yd<*L;{we6A})xliq&V(%86YjcL}aB@FCBn)q?dOpM7@(Cx~ZI-5j%(Gtx zWxh!N0*gMzUhf0>&ZG4yWdtehF-(HB;5l%41hl!-{3W zuhulFWF{>pQ=j_!dWVO;^u#&K^yptpi|5R#wXQU`Y~-zHgHg&R3VNhi)>Ze8tHY(% zsO9Up&A=&PN4B$<&WRULe2%7pb)`9IaI(k2)wbOXEIBW}5lPpb(6oaz&+=|z28;Yg z6#VlqCUvC(G4n|qVmzxS8e{w4pZz^AIH^sN)+<_Nabom!O~hUDI3yF z>7Cjdl018Es|D3oXJ+Yuq8ca{YzEcq)K}x#B&Ew6YEN<1vScwugyUjb>^nWR^|+y- zElmX9?AP&RT2PIZ{0N5t;WYE*@Y8U@T;{KS`Z+UA!qxn|>sB^niZq~ATN)IDU}vq? zWWY4BN(Xxs_m57;35tX0=r2j|<}Osf6-nW~ zJZJMYVzSBs1czAW2#Xc4{Q55!-))xFPGSw*P2y{t_>WAD7Ng;tu57^m+ModDT=8IW z?AWcg>wTwWLB8pe8(g{ZWxd%e*7;FXIxh~nU%@I;_!0c;Z23C^P0QU&C4>bY94^k> zwjx>b4s6;fq+r?BFW|XzdU9$^E&Wn(wjmkNj6%|10uHPa)L8@-{>XVcY46GA7-a(n z#(~6k=DSn&TYJj8w1)B()Hug+g#-}>c~xJ?g%vT`n0c2bscJ9R60;=>Ak3%3d4V$E zJO7O^E4d>}vxZdYSjsGW4qIJxzKvVKFC950yqC_42gIXg5J&WkzHr+MB=l=Wb%{K^ zQYE<1plTf9G4I~8c7Mc;jTF-(Io4+We+YV4{Z2NnElw2Q7)R>`i$=}9qGZyeJvf~DF>DVldsz1DJc zat4Jo-MiPvWSx1I^rPdr*`c5m&=G(FcCJ=?z( zTKA*MulMD^U^SHFmWt#H1GlLQs+-L36SnreQbi3kUnReBc0W~ciaQ+AqT1+U+cm1U z{UkN&ZMx&`>{o}kH?*zlryyusk?~d*x_2gy)W6HaJfiM};IAucFgK>rKej3={jqkG z9x>k!r_tK~LRNIydwOd@6Ei}^G}E7wvn{f2pys%ijp{U;C6#~u2O-Q^+lORz;1Hr< zaeky$lYuI$V|YX;#&0!JTAO2R=}R}m`? z_9=bxfr02p!Q25<7xG05Cc^-Tz%Tf3bZdAMMKw8mrbM$379>&UC5<2aplq?p5Ef^& z*A>v=t})zLHfh1cWFprUMhqBNvqFUL+3z$VA*^{(@Z;|uzHeD#vCwu3sp&zq6U18t zc9f@`Cj@L|yIZ2i0RlKhZfmZm{I|! zEeYs_=J^7a_N#@VSwEi79xb(bTwL8prWYo1K@D@DYGv~8*pG!_z*NE!v?B$Nax&k( z+0&4vI!*mPGfFJH!NzQs@iC<6stZpNrw_dPfPI0N=>6T^gcftSJLvnzN@2b&v_8SQ$JVk?A~e2nQ)P+990J2qT? z__J|C(D_r)?!dL9@S9_^Z@wD&vsapF!R5xBYR$O= z6xpw<0Y7zhsWJJOY?W~x;)HyFoT%)zao^{7^$Bt8Q<;d$)*6p0=p~k73yK+q^Pp4s zzL}&_Mk>vN*%VICv$Kcy>i8yfNge*(-}&)~iTe{xVN=Tcc(Gtxh~uutuwdcmFOd>X z)$HyN;#3E(!`HaA(L_0^e!A!We>R^drf{`RU-DHUpB%j&5wk1K zPs!p2*U0r$pUg<)#;m2DiLN)%!XWPnmQbCoZX5i?iG#xD98xbLl7sgPWg0EwrnHcU z#q9YY;UzrmYwx^;K*>%3btp=48_!SN>_U9c$LSDtWfCeNUbG1$ercVRiL5g z_D;;yzl&b73e?iKdq?eTB+1t`F;B73hMeu6x+eH<7vo*8-G!o+u1$%}ncJ@_hZ`<4 zBo2z}?-f9K{wB5V&TxA{4>P*Dl<;qH%QHM*n*?u|>gGMJ)bp^&X0bh>&sn`q)Xb7> zH;re3E@r0@Vr#8ud>55ZmP1|R4Z+52w9!T5t7&bsY+$HwbQ=HwuzjL0)CQ@7>ikQ~ zql9Eo6R}Lk=>;P2ilBV!L(R^bz}I7~Uc9tce&)@gCrU$S%(s^*Qd{GWye6uypoi)< z=E+aOl(-pmnO;x(_*6|RC&hgwdnh+9s@9yepTwR&CJy<_0{qeP+OJIfK#=97{9p`| zaMm0pP@6Jkj~A<<_UKAQ#}y+=SIbCQ^0E04=X!q%$uVFvXDNntazr|+ z|B+r+rlBs}W*4_8o?pU;d;REwwb|jA8u6pNYPbjJXd=(p(|hAhz6|@TLtWA?`GB1K zU7OO$>SxV6w_Kk8-F^19?;afDR|zKR)_Xx!X;`qxsbV~{uLfK^(L&9@2V2xHGev14 zSmh`JYNzGYl$D4TpAL>@?&{oq@4OmJ1dWN(#QKf%LeV}D)irm}%*R{GHfHX`9SBVv zmY<$}9_i9Q)#ZtP%*(jFS6fw{B(IQ4uqxmu4&S$pH6i=UZ2XUz$aqSP zfX{0Y4~EapU~BUEylVs0-%Ng@b{x|S(bB%Ehaa~gePEO%B}p&O5=9F4vgzX}Kgi95 zWob*R(!Rjo85Cc#@2zO5^qU--f^;SHzZ$~QV92l0h7@ZGU#&55fUf&^FXd`uKKp3$ zn^}Y?mn!RhRi`dWF6KHmD;Y3d6Yca{71WWW$Qf!(GT+&P#x_6GHk$1>a><_;W50NuA-@S!)9W%v4CRBHd zbK=l9p-^_!SUGIG;vS1TsT}}$UBD~fEaUJH4~wMkU{9vZY!AaOxDb>o1AKCIsMUOq zmhL~qtPcX^q~<_@6P>+-b#b!H8K|~AEZ1&*xNk3dJc&ZdP}NPjt*QpYg_ad+?bXT5 zl1KsUWo4ehG-n@5R5ME{tJB|Aow-Y#vGa7P>@0|I8_TMd26jP#x}Pfe$5XgF0cIE* zF)huG8T=9e#N1EV0%_fJgZQM&XA4|)8hy@DM#0|i`=o^Ya`9MIzm%#*w+(6-`LN*t zs&6#st zGll7viXsz?qqkpEwpcbEcy(dOqcWb28|4v3$5vma?O0x?Fys&U+P^@6ZIUc*RK|kh z=rTytC}3%0!nm01HF&nO{RDSS70RF9o)H($;%wWWT^+=4ni3DCM~n`Rw?6i;wsFrQ z;z{VMP>~baIh{n2Xw@gvxXQB>zx~FU6w0+4@ASuko5?sde93I^0znKQyiIa*EdWdouKwQku4oo9e%TonWUD}#XYwTi#J zB9VNZl4Qt!yZFb@#Y@Y))z$LhU~o()=h5%+aWAY9u5%)jRmU<-xU?l6ZhiBZz3fS^y znOBqcve+Ocw1eJ>Vl`DW+M&2_xl^!>OBOalOR4N>g&Pm~g>&lC=qh?2Ba_0-h~pfc zixP?i4HRPjrTcuBjVT;b^x$ak!+3cj2Rzj#5_JJPRasUWnimL~L6Neq!J<9R{4bMz&{b|qpE!Vb@GmRZapw4x0i1^3#REd z+m#t)eGZa0{h{`^C&n&o6MZf(qt|!T=`u4rVsnQo{6K~7nDlX0gVCpM!C$3){NI1xGsD7wyT!Xuy)@K+X z$YPofqUg!)w7Fr9;gRMBn$$G>)JGX|lFE3x8RN5eW)%!`Pmu;-C?VB-(v__%SNLSq zw1>hB8d2FsPvGcctCv(SkF=JLPuZa4`W3iDjVI1b#6LR#EDZVRzxw;?9NCh+&YyQC zC)-w=rJ&U|BS7~C-*w__*um%mwl^-8>1z1 z(N^eK!U^>oLg{+_*do8sSb(zPDk7-zxBrI=n8#d~M1i@!l??@jav1iN5DqlEiO6~* z-N!B+`?~P(qC&;3UiWciyFYNJu&icoz59BBSrItArhY0EKrOW&hsN(HfQNh=wc8+2 z)o`%%!13df6P%!Rg|P49DUZ8m%4P>IOo`2gh-~6ypYk?xs+aSOUH4dNM~Ktfw9%d! zpQj^);aSSCnT?q}+e7j+F@jN^&Ni;}F~@>1sg3@S$rWD=szElZ%_O}%(e>VXOO>Y| z_d_)IC0x1U3B}Cld(GtMsVM$(QP3^8{9Ea#PytHH(x5J3zsj&`T zTzH5T2K@eUM-G2A=qd~W<_YHW8WX>-dK1u{Bhha2%7>Y^30JcYq^|4c2xcuD_2j?7 z9RZ1rUB58MZvee5iXV}5Qf6-@-u3VOC-#-)BPLG`z)ji_{G(7FhGV9IM%Tv6U*U3&F#XeZyg(ug0+zVPdjF` zK&MwUA=jg%my~d#*nD!vKv~YylOo_z2l0*CmWDsvWk^F}wg{FhG3b_h*b-)oeP9P+ zZIg16FTSBC!Qn{e=d;rlM z`)d&cbd*{Y^9e=FXgD5#J&(;5^t0ppiiJCKl)$f2cBJ>lc-#V;Z>@O2t7GM!OB2uO z*m3N51T9B{?_;=em*<$a+aVp*%iyqzPLjo2)R&92NNF8*a50C(7dht>~(Bi76LXVFvX@3!dS?7Z+lJ~~UqO37l{_om9(C}ZRQ zaAQoc#J6aHqePZRMLvpE)L$Vm*Z2bUh{--HKS*TXL{EWrVYv@!U~(+egyH_?ud1x~ z9Jya}5ZYD<@gS8rp-=ExYDL^LS9gbU=@a(55Ji#-IDJ@rjCssf0$EhZb#P%; zCHy|XYSYu(aKb-GNnSA09wk2Qm1sv+_La-f%$(UC!kv%H8OZx8Y#Ja{L5Kx%(`$8+ zL{@?-BkK14VU@s_iM$(fZO%{^DTBp~{&KgeNja6coPkAUGtL&Y&w*az4d`4L+!TXG zvcYzY%a6^!Q_XySOTgMu4Z1v0-X)dksHN;o7&iZk%K$!5+3MSeXJc1vyGdbUp|Z$_ zr8%3T_jYc1*(j*1Z@)fOpSNd)-&ehb&^DvNRT1y>-|IuW)HRgQq5HCdD*57?Vwx@Tp|v3Nhs9D)HY3KF zGK`vf+r}heen$LS1acPrIhsT+A5h>ay6frrpm)M8$vTFVu}sQ32$@})_p-FSv;&}8 zl?+eK*D>X%@YstQJrsS{)%3yCVuky^Uz!!yr zIj$_-PE-9P=vim_VL|j6OftDPDObMQJVXu;G(||dDpO_Ed2s#JBSBSC&K9B#sNCoK z;rDB`dVcDi?*_g?Ngr2kc&2Ky)0McuzMN`IxF868d>`}nL~>IHgr%vKNZ&!%M1>*% z&*JKa#FjNEb&JvWcE852uFcjC?7u0hv%~lQPfdKKE|P{&^2hAPO*B68zsk@xnU}|z z6wKe!R-T)?&3>O^x%EXq*{B)LWM~9Z3PShUP?MYE`Tv<V}d=hOp)2x+8s293{yI^X56d)MX!e z{0C_cQ>9lDq{P3BVF=PD-VaGvvnOmrAhI;-%<+C`$jDZ)*f4NWVrT!rNcVS^W$jc{ z%ZlYcb&6XHmeMX3M8g~u{-?L_62>V`o5!-JVKeUJH(m2!nRw}&8*UMA;PYY(Ww}@m zE$02%qHo!B7(VU3;10^)2t@h<^$3b~aQ{)DqBHfGr}6jd!u8CpB8G8KC6$j5j|y^=Ge!kE+4csVtfz%+(XC;bEh^MOZ)n1k!dLLyepzKpd?hJPx>%j@v2GlGaUeSfAg&X zm$wdD%Qm>AT2+ww^oM1>yOsiqV2~Z(M`2>R3|#IzpTpn$pU7fXvsZFvmeWMs)IXbu zJ0>`mJTqI`51INpSkA;oGE)tS!RNGy_w43IeOs2aW7Eb0FwU97!a*J&P^sbjj!5=& zYW9~Z=~=JM9;nwh`*@b07moet0=YO}g#>7kU8R;)5Y1qMm3kSV8GkunDSQ6I6MQ{3 zZvm8}-3y|0oH6teq^NmVcthn$TgqcH(7-^ygEi&+`9RF^d#z|z<-N>9X4V5XNyiGc zl(M#C4m4p2z$vU93ZL5knv*}1(V_yD*HO_H7gq2T0e<{fUhXsyLIFxcQ1~`1uXEoH zshs#55W%-X{P*>842+jW3PPQ~S|1mw0+TQGbaz$7$cX`xF)vNg2YD>NU*8uI;shD^ zm=ofZj$gzIn{}L@hE11Qg)on6>(4h;0sl!NWr3w3`z8A(aUpf1b-~t~^~0KYu`pKa zai3Wv&4rj|9c{@?1|2d@QH2=^Bf30Vms$5iBxux3ojQ|($S+&2b)(!`+~Z+g5~!F@ zW5uIh6H$TE>H?Y9*F2ZE_npz{aeLI9!F?Z2xiTz)KWKir3rY$CRIm&hY*fHI?IguEn!uX|qOuBFYR(c)fBaB&S#d;DA27hLasA zJ6AYbYf=XGoh{Xp>6s|unf(JH=TjN@GsmR`=%wI>nO+~xw%UY#{>lQ*MSc55#oqz< zDTyg7rEJ%}7d1s7sBX?eNl=Qcd_$4+nG$@EqLPH?G#YAcHfz%TdIB4yc?dWte^v7+ zskqOZ3!o5=P?Yptw}2Ts{liybGA}^BrASfBGB$%2d5TZ1F2|p^LlA7=fpo&;se1;i zj~?|Ij*{*-r2K||%i9rylU z9zNzRalwO&Rn)^`2MY}0hLRrm&4mM9V_J_fy?$RBv8o!$`L3@XF}os!N-QV0aC_)` z@QwgPwoqZb%xTeg@1`Tjli*w{=UTJzWAByQCZNa6vhmCP663IZ0)Ah1q`o`b=OFe( zNn9m<4ORytKDdbR)a5f{N|n{Z~)z8lEhVW7uW`^-Z4gSR#Osv-Mu&SHMN&7j)r%Go%_dn6V>tU|5_1l z3P@&*`0sXax_34)9-lpP!|#_8=lp!)v6{%2%J+VIwhn38neUMzX~43Xd)o*-kDG8{ zDb)-3ksr7XeeBcx)^D85Xi{TtV)43v!PNYJ zFvQZm7~t$5ReEYS`+uVdeIp99CW7bG&1VfD&H_f7@`zy0Z$tK6wA`L_tYV1nBDZt` zHa)U3#p;p@?AaC%sJ+8z=7R@YrXS*eafHcoC-2Z_VSLNz<{WF^^@e_J!1b3#v6cI( zbv?=Y5ktMzEs>BZ)`dU;cWUWw(i8lY8}pw^RovJ#+wLOD3%p_;@!xK%OM8Yqwdg8M zbRRKC((%!adb8yA58Qd?p-VZTTR3bOnjM|APKTz`u%}tfaWJrtotClGR`78#+uk=A z=vWN&T2`#5&)X&saxd$N1-1>T2KvS6H*Fz3WVxe^iCDWt_RrszzBB&Ot@$fpUz+)H zcSbu(WjuT{D-eAdGA>g+zJ+@mii&j%C^78&O1HYU|Jwigb4Yjo0_2XAIi3I}w14*} z(qDK|i3!DpIzJ5chHpyuy_y*dZf&8h;l`h5JuZFVsTgW7YUk~IlYyO+y<}gwv5C;5 z5<5a_!oBCF;dePscJXjg2S=rCQM5Sua23P)ATEyc(v9Waf4Bff4ImpjTi9H-egd3> z*et?8^|Z1VDzPt=Gm37({{<`U0s9nVBmG-CS4W>^x8v&2y%|{H|Btn|46Cx?x<#cW zRk}l@yFnVHySux)OQfV*8l=0sC8fK&ySq6H@F|~nzu$NEwg37DSl;WNV~(2eRB3&+ zitT!BV+};h+ub+k_%`==71|*K|=$?@8bl0Zj2jcXtCU zqt&^b{ugTSxt@J{yLVsn-?DB>3{V)Pi4&Y8y^~Cyp0u75xHmYZ`%NfSUC)y2v70zF z{wd_Q#Hpnb^G02vOh((?9b*EuNF6nbWqI>SByF07B7TuL#Z!);;mS(G-|Zg->z2it zQ0`zQ9N^S_NWU|qq0)0?M}8Mv*I+3T?rz*v>vAMN zSGN^TJihrA?*4|gW0#En{K#{Va(u=?%nZFTI(@^#+`OXG_90 zIFf4pu_qE;a1%w9QiS8UycK2+5}Sc{`CTLMD7DBc-^b%bcx*6sh<^V#Rxt%maGw^; zhQ}z7zRA`Y)s?&gdK)*pW2tki+q)|sqam0k&H zhM)N(i&5*^eBTP%7ilga3R`X7ZCG5~-uX>LGdXVwKU|V^*-I8vyQsBxqdw~JaA0OA z2vfF7?OGGv!IUZ4YxO}c==pMFPkAZcWv0boeVWggy0NvrswEoQ{iMu>|0V{7{7GJN z_<1O@kRK8qPVbpJ;xTmBW+(1QmL!+*>oX;^?<*EN<3CWF>ar22w#j^vY|1S1MGM`rA5QFeE4zM{o zPx-LDZY*E&1SEZEQCx^y_8FhvTi0w;G+4QVYu0pG18q;lbKz2PS*^;%3-RniXv@Mx zlAwa1ymu!wdp56VS06+}ltqLN34Zq3?{H*4oVXqCUIOW2BZ`Xs`*eM>!0-R{hCWjy@8vc^#!*PLKVVq65BX z!+zZNO1xJrwm=m=u_osALAaDT7SY|XroJ}jW1y$IV-XkYWNP#?q9YgVw(!$NfI=*O z`m3j{?L`I9^H5oYF7__B8p3(O{=jCLl+C&V&i!c-Zs1tsmlXCc*_KW>;qt|tdWSER2)pRDwbQa`-ydg8R;N`4X z{@r|PcfT>ACKXu5=S^CIoZzkStggJ@X`)z|;I|`MV^*xKt{vL7T1FH7*&{e(^XQPv zj!l-Qyus~0JU#hUiG)jDe7Ljz7h#)4k@%~-%m%kqf>P)^rG6f~VIVC(BR#4Df()b% zb75{rr=qDi)SDYm5DuI8LW0bVJYJ1EPGP%$!Nq#`DT7ZYGr@m5<<5tCpR@b?rAi_8 zsI|$*!$Ilqi_W&FGIn5c=K8A2f7%QpL+t5V@I*bS(c6L;O@Gu<@HZ$|X4n~x9Bt1n zdBjD0W`(Amzq4D+v%5~d%G8v^Q$49=#rD;y?b{aG9osv1*-OguiaonOF zz={x@H~A@=XiPv5_b~!5yfw7nN@4>22aKGE@ZECPDv)%%a{%{qnR>R**PgNr+JTAj zy=JZV*gwVk!=Q_yw|O_?8*v?PFiS@H1Aym9z9do-LCjULi;30GCZepIM6lKsth;a7 zeA#taHdEEGO$*nO@qjG=54)>QeG3r*cbJCeX({P0;day8K9tCML#zU(wqYay`i}|Y4g~SMZ-K=XE z-)!J8pU4s8#p(!ru$~sYXFYSdY$k96yhP-(=f*iMe$A+^*Y}CE`*d+~W}sqQTKpks zc3KaAHpvqrI`CX|Y*RPXkB+W3+~&Kp(x%UcpjXd6YC)YU4FP59n;MO+)Dl2R%cW$0 zWoTu$;a1Z@V-nTfan>2zfC4@kx^=@MmMg!XfWi3OYbK`lH}Y+fTeTLB5BA-5ys~mE z=ME6^lnk-!rMxXsv0|`wIR{+YvEDC05OHTW1ip=-9MLoKY2 zJ^JR3+g^8Fj*JN|iB}jh>}C=eZ(MF=uBKV1Cw=bNJ-JQd(Cg?gzQAzwY+BTgxukCC zrgy~PzFUs(Qy&}=Lv;)HF6{lw;DHx^chT@n7 zmMw7w22mSg0}LxR5KwDmharDhs2uCefV+rr zBP^2l5$RO=>u^cVgj@2I*Xw&W0#;u-rv2-b5&e&++dr)EMpq=*6izRlR;!jg0OBrH z-+JYMAZg5?dU|_)_*o(v6-lgXq8p->9WyZJmz{o&ruBTV;!h-#O3nFLL|9)Qy|Dyd zzNBMUuiVX|ICir8IbSc|1%$#P*s0UOK;au^S({hTL<((CKe$gB^lL}7*aoMnF_lj2;?66VP9xir@x;+OxINzEVNft z0ROgwnjCbeJIt=;#6=H6h;m2rQE|R9xi?krP1yeOed}005brx2fVl?I@h8_i;hHWY z@yreuPma&TtB|GBkxhFxu}l(I7p$a{lfCc+7qi{ba9jO*D|c6 z{qt_-lf~MA9)ImNjay8T>mJi6vH_y3oqB+^Bf}Am`v=l~k^pmDK3HOqM8yu&3<=Pg zJOu!`rH}6X9#(Fg{6%9lW#=(NRk9L(=8Mi@pc%BUT(35_6m(cSER+ne zlBSFQP7$>28y_YW3}osypNBRW@KjLbXh&XS#@JYE^B{XxDmP^DmLB?1U* z>ScrS{ZIIcUo!E-r49a|r+`EFBF-(VWJVlrf=Cb9`8^~KD;sV7Ne@3u#F+X_Oro0j zU2r_J6!iD%9x4iEA;ohRK8^X@x*jTdvY=>FZdkQqC;dR@+y;5A&q9aF?{CYflfav1 zmX9QQcX2uUr|i#-U*R7|+|*Tl_@StX9EvLRp48F9kqHkM0fnI+sGtg#j*sR`2Ao4zhzmD@_^au`u%)HP#Jl?L+f)Hrad(;+C9^^ zT=S1{07eUA5zLcD{Y`W|nwSEG&$Cpky)R<>#uEw2$ek|_`3viQi#0y}I6FHZ%PDpB zG6E2VcVi5nwLgudHE-{n#9CfH$S!iHWb&GB|0_a?0Ii&AUg~1$F0rQ&4&d2bqT(>0 z^n`Y4DqALu8%BF$a1$ey7qi(DHzff;lX`0CVhQ&xUt|h%PUtNd?|3-qGNaI|!0ci- zgU*gZD+%c~tXC{d;_MS>;K#G|>=O1OpH=z}WWT3BdTrF;CqRJ+2v67T05g5&xv1pA z-~N#weOO>ut;s^6`N;{t?T$ZT^3Xnm)Gw$ZS!NCzVi_;OCOQLME}i+YVP^?AWt0fC>_A7UL`;Zlkj0rrHV3NW z&UaBG0=g#BI3!>-g7wtR=fkg_pV&QO>Lx~A*r2%BdNN$(cPqBSb@dlgYaUiX3RV^h z8vFuZWgxekEcooUYyZ^$o>x)a6rd-dg5#Y=zxFPxS(HFr>es)6{SCmh4eb9}J&X0BEgveue&pY^vtP#Kg?pR#mEn>?ya+4B8|(er!|JF>6*QiJ9OS>zwDI z($Qoq`H8K?VNnYCgr^uEyVv!{ z7Ws`V`A1K%Y$%I`zJ+Zy{HE`KLMkQ>OWF^>2h(2|R0U&Lp9v<^J0}jsZ)taFK?jkIIEc@7*OYyu|8xnhq>bCNNtZ<1|R-3sVHi+459 zSNN%y(aa@2-oBcJs(qcn!S)~e*C+h8tcMRf>xzftL3g^|hgwP@p&Yp%WG7SxCERcpw3DY%WKUVv>9kUpQ0RMQ;Uwp9hUs&w1YnJ-V*3$mDl&Xv5XQ| zhywsHp&90ERdz5t!m}op-_qWXOSyPtKQg0Bu-}w}Hjx>BmT%iNu0O9wfW>n+4dvk4 z7(Y#n!<;NOJ|V(#O=oTp6Kv`Ljy(qBd1G;Wgl4cFA~+k)wXa_(s*zo2VO#2^a3_NS zTU)?S1*|uB$Np@HVXzwNwRiC& zLOPC*u`AgtmDF#Nr#QTXeR;lMr`)lOS^#zRseY}>EUAmU6yVGggz2fbb(i){M?Vur zPMIa-zEq+9j(PM+1Gs;usnVxD0D1+4`?A2*WF2s6;`#&pm+&;B=`#)+l6OfR)MPaR zmP1T)I3q^i{RfsQ-zRLivu)u4(fvaF!Vb?vLUTwt%a<~^5!Wm96mfBZ|ob)f*d)h14DF@u#YqGfi-DDuf7MG{XXB$ zd2kPfR8hIR0xO(u7{Ag=YN?i5Vs~q(^t$E-+;1QO63vo&Rj-hA~2FxTKwC8Rsgg12#wD$10J^2%ZU? zGK!BU3KlAqlx=_Nf&)Wj43KQ)TCGm#(B-M6tai`84|!N*cK0T&d+R& z6hxS2r&BGC6o}s?a^Q$MtuI*9wj$+`9x>YvDjhJ?_240 z02&Ndmo7u7-_YmppIrF&&Ov_U$e=;m%(MI)M&(I4b%~5nz6VGnZhVtac9dH@^ksPRYgg5;kAQ2uQro(!jmp@6Iv(tdMPC8(|6v74{y@ANb6qc5S{O&hM zbn^=m%_}#${|1SQ%QD-(XpNUCN{#`4I7av3?(dbvof+=&_$tNoprA&9dlhkI+G!b< zWd0eQ825vm94m67X-B@oSYez5C?bAo9?6V0*tb^c%$_rY?jfPg-Q~Xpf1#q1 zRR2vx{Q;CjEWTacmo|g^vXV+Krc9N#;g^#Yn?~Ua?Pt1mPp`Kx=J+Fg+V8zAhM)~8 z*|7;|s(VmeN5LTO^XL?8$Y?5JX%7aNAuZu~xnY-(d8sBiCQvd(=i{$!NqUY&v`RZr zQltUO2Z`?8Sp;ai;h`2eE2(g#4t!^A95`#HWC2+DPM&fhP5O5r8fET;*AV9Ud*d{< zM;l^B&TG`;Ic4Y7Q*MjdqGb_QZu zXxLLtrxd+^!%p$qyhH4u^0FD%NV&?d4=NyfgM(x*&k)!909`UkuU|K0{@lNDY@JgF zAvfp_8gQ(UN1Pw5B_=qxL7uC8Ab+RP&|k+;4#{!Fk?`?V!UthHt3G!a3bK`)nlwI| zjo1X&kMOlg_-g7|%f2pUvmL0~tp&uqae`lM0w=V}XNMBK2&q4LgbQ&h#CU)#yj7Mw zzYbvX_I1BD$!Ggt33|bfcR%gQm<88h%Ec2pFbt9lu;?9-{ z!%3N|3g%zZps1HB-D)#K9|!c*HseLZ*L@AuL4|64#uk9lZu(V!(2+x^dvv8k=|H4b zsc7NcdvE)i8f22wFP7(&2YDp_k`Uu&GcKS@RT`|YYBH>zTwRhXkiWV39DL9#-xk@h zJq(E*0K?fi%(=1{jWJb0ojVy{8Izw{?}oHLqe)!>BVaf-P~hB9Kr@8{So?dPL~$X9 zNsa(lBBi$=ejuH4#{#;d;H*7jNWqWUGli9!lE4I%hq}pliN-L^$eZX%3lG>M~K9gL@vuK z%YRBK*CaV_einKele3_IGaZ%KY(BhzEr6#$kHZ8@DQXoZ(X2ipK7Qt=v)VjzPjzH= zz&FLT-&}nk&tezKALkfZ9gvWw-!1WHi=42x54=PM+G(gGo4xmf8C-h)@w%g?%^~C_ z+vSY*)YuG)GtQqNai}kw=f+npjLcyz;p|je{qG-#NS%eB=M}YhNR{_W9M^DM7^t zytTLI^mT3jj)m<3@k>lS=`OW#H+#ybmhVS@9(I`;x=Krxj)?>@pH0rnnl~GOwsPuT zR++HoJY#7&uRmfeqWU=8RRYk1oLMGZ81OmKmR%ITt)@$mLPnoweljhRtV74z_g0`Y^^+*_Za+I+od05n;n9))ihgDp1FeJ7nDUp1F<2K!F`@4Ibxf zr}`OEh_8_c7RLUlblsl=E2~%K^{0#HbEwaa_0wIC92v8mqODI1<_0J+rVn7)6we4T z0D(yhqCzqGk%PeaR5#L;4a!*|h(VV`Q=;jOt^7`Prs+KN&(EJk84}<_uh2ZRY98X% zDoh+YOhwiqHi;Y_a+`Ny)wo&}+jdGUcD9H8S7b4o!O8gmBe_}4dj74PocR5`XS4`x zI|jgk3SXYfjWUiUD5_ts{oe7lA_467Z+oY!#!Kd7rmP)< ziT@G)NDlX9w!IW^KWy|LJ~wbHdJe-a3KAyNZluYh`s^ZS{R`<}I+X_>o9-ZGQO8Vv z#Lrdba0!Ml<{z<%R;eR8yAOKZZFKI$Q__A**|}y++*+2}7?#_dSr%cN?eg(sEVa+3 z{KTu5DMPUYa#bmHlas>ui0gey#=$5$=G0G39P~X-`0kw!VPv1y-F?Ymlv~sznS?QJ zl7?k1`E~ms6rClJ;}~08+!hk5?&_BG%BGQu2chGftbUW{kfOy00v}9vJIqBrvAh2n zmN=huyo#tcMUBrxhW+wAmMTn4vRa?3@!fB9Oscq6!4ky^sF%{)f?jTXE4>!3*LY>K9taTuf4 zCQi!Sxoci*LcD3Gp8h#hR2xuUp9{(P2Z8{P0u^66%ufG{RQVYDLaO`+1o0QC;%PNZ zjgAC9KloU0(POD0*=N{&R?;UmR^^jq#3rf2fX;|B{ z95WfOe4==JO4?kp^g(NU6Vc7?@sPARM+Q|h95&>RwyhuPsXq&I^IP_E9;@9(d&Qg1DTIjA$ z3Mt}Kx%cCt?I8*hsf3M-fir2cylS~Q45?A9fI^9Y21E8h!mx}r-rfBG}@g)7`{O&NiO zJ#26=r^semTey6pv-hXfbAK{-3l6J3FO?W4M#QN9P z18cv-1Jnf8o8a(09H+Cd#YGCia;sIJ1W=I}y6JdhG;V$jiS9tayA(HWWfRXY}k9Frat zVM>VKMBo@eKL7Y@@_#8Rl_5(DJpXwbS{a1O&LRFoQ4yZSvyl3N@lAN=zS4oFSRIuY zq4`Y>+DKjR%)~k@X93?C&Bn-bq-g>P&@3@IeXdn+}BzL zmpZR?4QOOLzWd;m=Y3?i77f)1(A^+QQ4ze&6ljO|f7Z5yurfRW+`J z&b9e=q6CZAC1P66UeGh_o7<>=?G=&Fd+K)>ge+S0skU+(_UGp(y%!qmEnUb*yY7Cy z*j9##<0dVXQ$R(aZR0aCzQz16`%AO#I9-%K@u6YcQ$NYUk2kd)uSk6_M7l%`91?D= zvyQE%w8&ncNricG>Aa#`;+xOKEu5Rb9E;d|90 zs@IY5uVg>Su`d=>R=cV35T6|ceB^XN>}zabc_H4Lf!*37>q$O9ru?AG_XeK@i~G%g z7?Z|0qyN*Gtc~l4!6@(~1=|k)>JdG_nIgAN!>JRmEcNAFZ7B{pkz*MJbL}I!%Pi_( zmX%h8Ki)%xpvG%w0HIwjp7Q+e2R)HG27=-Kvy=)62ZL~@K_3;7e+WkE+VsCpx+q$N zoqrCxDF6TegATS{pGg+v6NSN!qvTf6UAj+Ne#*b5oVyl)SA6V1w7Wm9^6q3@TFa)J!0$=}M zO)rTFYDV?g;0Z2RGVZXc>}@c4o3ydMYd9IpU)*5|1Zy=1JVDKATW+@TvQcZOf4B)r zX3%$Lq30Ig1@hxt9S?{AdIVh?A*akHs{WGyw3Y_?HeD81|9v0<{1C(e@AW`(KWHOD z^E=5fl(bW>A%Gp)Lfon`<~-lm1HM-M)5ZV>x2tIgRsE&;bHL6^S*f?Inq^LJt-)MOMRY*@)fHZHgus zdlB-n>QBIIbDonFWgP$;=XKC<2ap0Pq(M)OBm-6{jxEB=%U6v9QY@*- za9?q*re1pU7Ibdybd^L>Doeds_9v-(&-Ccm=zs`nN4crI@Wb{sDYrAHQ;Bvz7XAEt zCIiq@7;?o8X|70`dpQZ%ESs&D%CKO0GKg!YfuX`miuS)Sm%U81cFb@$d|;(CuwCo?Ba$Rcfkx zc2a5Oev2ohQn3czO(g0fpEAHaeRLomai68F1H#{KqULN{Rt?)-aN~a{P#;HDC z98pnu>Ty7+@*tm^_=O`gT_gs}&oa0PCp;w+Qn8?9yLcZX<1$*eZiR$uHses91AN!L zX}^!j4RI^tjx`_|+c*lL$RHkQjFZlBW{XE{7Rsd7Bxsk7664bhj9&L zWN8Gv^9%QoQ)GF>u!%ckW1@{qk(b@}_2YThMjht1(1ouAHtB$(4U+1e%VK+sewdQc zicmgU-6%+@AVcJfdFTLI(CD?o@tMd+qd?%m8FyK|j=2s`|H@YG z%T%SVRq;=cgA7uz56hSCpVI>G6#VdybQlwQpA>u7^i6Xg9h;ElT%PTIjC0SF7G(Tb zgn~oh!HT6b$mS*7$<(pG^+2Zkw4fC~RwT6>4uSzr97R8U;lm{S-&lU6`!kP%6{AA^ zQ^<1``XQ|`yJkw0u(*CJH^{s8AaT_YCUx+-QAkMbIuaSsR56;x!{-mzbEn(f`zUwL z%7gk^x6^NZ5`5(SbBP8XCh%w_rz>9c{d7ZXZ1)EnR1eNQI=7I&HqqC*>588694(s2 zpu5&Xf~rc?Ve(_dF+pWohIz{LufJ$F<*4R~_@`t8jx{b>fg3{n$(ft;{<)Zn9KQ~g zY-~Ed0NiM+Te_@>Cj~XhEG_%y6ef?=GIkw6%i_j|YM1p>Z~4`zVzws4)sT^&lWw)o zchc;#?QRDrXnOgyz}?(I^m77^qP*ZW%}#WprAo z+Bwd{&&=_v+^|Whwgm>mu>KcQCly?ZHEone20xOHY>jRHT5WGqWq*0h!mN2=B{E3# z7i_Suz2wOLyx11A80ZKTj1SII7ByC5baW|ClgnqAM#0eibp$1&60#b?J+H?3mxbWl z4Tr^vPag2R5@n7uq*)6SvPZ|4NEd~@E0P#lv2pBkIkj!EU+oL%i!eq*>iy-pCW53* z(LvD}B}hn0#rjanEnM9*(Zs%o=89D}K6t<4I-#{A-y=isCu+XX97vN}*SzI4alV@k zfnDcFU{`q=D)D=XAr-GKZE|I=M~REhsJ=nntemi@34B&J;x9$+gW8jn8wSx0Qg>!0 zSu;b*-88>Sr^*@fYS;#HOFG&s78Xb}1UH&Ep+`3MNPU4QULq*h0OmaX1_4m&HnUmI zRNHSJ{t9_|sf%iKXLm0NL2$)bcC2rI;l*w+a0aj&aK{FOJu&DH$v`7#z8DM=Y$bgR zJwt$C%m{t$eQDy2ZQ&iU4THw*);7{cqaHY!Ntt^85@-lAQsE3H-zY~-EERDEAUCnG z_ybf$IiH%iB?(8IT@G3T0Z=2MDnb(6U-VZDOOxyYqM=RrAp7_<<@VQU75^B zc!C+BH9heWQujgs#JY^vJ%A$tD4YH4G`SG(XZFi<02jWsVQ6SlQ8%!oyqOK?k>6(0 ze%Uve_WDt$|CEX!xAYmF)8cWC{q}j<1TR4_V0<6j@K5ssi)f5ZWLcBXPtd0;1yIyq z(?HD*KbXkN1syx*%=H^OXBiWWt#>C%(_{6_8NK<2ffkp8SVwGtz0pVDkDO@C7oF{7 zBewZsFDP94FeQU+O8b#5b*!rPj&Ngxk-Tna9H!H;MxTVi99_OL*H+(XU5}1Wt4>zQ z!MFjwBaUaab&IZ6RnLsTQhF58yogb)E>}P3)47q7nv@~0Q$!?pf)X{r{P2ylGU|x; zu>AT}6vOe))Kr&RERN;pwb+Bez7Jan3$Vy%^M)`^ARzXRm0?VNp?PX%w@kM_-q5_u z3w$MC1Za;(worvo*PLS){s^}O%Lm$d;WxeM{;jlJpdmb4J}>iv#eoHTI%T3;s?i7`|MqbZpn>xy|N8nZpT zLRhRtMTrk?z3FN;@-o?j9j6J*R*mZYZ;QI#Xxjc@_=5}JKBI)-&@<1G{h5}EYy(;Z zIpu~jzP)BaqFCtu5)Bdw4I+jG+abaPVY%@{YM?=0%CJ)=(o_EWoz z^vjj4pKKK&PH%x~!~lDx*bTa^4q5&BrYbVhvHb^YCY8@G)B{cc;gaqr4(uPcvo9sy z3Lcv~Ur?Dbsfz*}Ld;$9VRUGd&y{9Zu0KQ7V$lJ*(+8%oy zz&^&bALO31s=v^0eywO1;c?_CaXirxXcoOcvo~asPAD@tbZr7x z!(}Zd**BnZR2sN>I2IyD#Rli@+3d27%qXKqebXCt<8sl1V!|+==QF)4l4~J6LM`Ar zMq$y=Y);ot}1WDqmYzpQ)c5qM*|w?5Z1T63 zZ!xc9lN`K`{H+&_b3*?R2MSAPKgnzjTSaq>KEw!tS3N8@y5iQieCI^X2tjH=3p**; z!P$?nV&-0U?pS~4sa-LsF3U~$S@pnP`e9}Rj3iA`dhyvJUD1HZ-=PlVen}+)OE3Wq zRd{3ebA5gU$y1=oxEA^8z(H??l9heJ+*b7I)Vya(6qfzRiF}|8_?7jnYUR@f3*(;+ zCh2aBgkiaiG)K|Zvu({gm9~KJHqG>Ncsp_raB-^f0RS@|d*-1Gas+q2rR?ICG{P+# zx66qt@E{k?Fg+FG7m|g=6|bGDjEPO2jC%z74KkC(MO5K?UeVD_*17#)TfpAw~Lc!g`Du_ylU^{Gdrbd5w@>zy!luf7b zs6sfbYXQuxuG!X8We*=_9E38!Y0HaG@r!u&5;<9_@9=dfBa=7z2~S4@NZl?q>K~yq zo4bm`tb9qk!8>SUQ&FTgRLS#muIm9YwF?atg|7a;x18gs-jg02;tYopX040n$RQgT zb4vl*;CDqaSy&=G*b{2MW>Z2P3;*CUVDtY!a z;hczfiK+1A2mZD-S#6jr(OzHkRG-66M7xg+nvv$9t#UwPeOHGZ$T;fDugS``^^Jpy zbhF#u3!g+uCH7y#8SZdwo<{syZRl3HNn+t&7*jysKDsTLOJN)7PBJgK|W%l92&d`+dvfSn3oqx z^Ckicw%r68Q(+%OpJ40nCsi4tN@R=EC)ymN5kvf}Z+VS`0L z@4}~8PuUs+gv|g9YkkqwYu0Q`&5`VZYdX%$;B`a|vdSnQ%kXS5q%ZJTSX;ne_k$4) z-*+!nlRawbLP7bYODS2WgQPUTvBpy{VSSTBj;Z=SJ1Lr_@#d~_r`E4vn5X^-CcdPV zE_YZ<3nYAdBkgE9XCdCIM{$c=`0-2bDW!~OV$=JekE5$)L);qzeCe#1Y#oxwgl7_X ztG$eMna`Dpmu*eF-+7216_UreJ~l6vd0B_imoNHOMUJUsR5pJ~g#<&5xEO6J-rBM7 zf61%^Njo8kyxygk@xsBZi+H?;Dx)yXpzc36d6n6?d0zzbozQ1!7?d+vPGZzfuTm>* zz{HnZ3$$Mry+Pfk##jVw;Q*r}@x-rxHl*j0XF1ze*VS8o<-rr?r1{>X?2W=M1_bID zk7H4%F3urG(D(W9($mUVu1}$yiv6kM2sgr_Z@Prv;q9ISwaPApL;_c%+pNov39g5SNWBCiRJ@ly*W*FyP?Ru2Q*5Qbv?Q=4}Kd8^F%PPRupl{#E->-Ed zzepYQMXQ54u&4{HbMq224Q(_}IPFoTu}Lb`$Ld^ihs=9_{TpNZ)?h?xq&SAr!>bo( zj!2U+PEHi4hVx+ywWjgpE=3PH6M3KU7T_k?hl{E{`j^(Z%D3l^(7uS3%A^|x@`zER zcW=PJb+(@Tnqh;{SYzS7XS{}6we!5ayfG`in-Q{?h)>xshB9eo>O?M)nKX0aynv9m zpml7EN@3L-96|cTyz!{L0EwG8;y#A>Uc8+CNG6*%2EJ=p>zJUcI_jQ?w<&VCDEg5L zu-q6U8pnMTsf3(;3E+b_q=|?otXBh5m~7Qak!7eWf1`a`I_l51k+R;4dZH3OIjBW? za{>JTi&B#fIbz-*)p8d*v8u21Qm|PXk{fF$diXQpPe_1;&1u4rtV^U|QR^-a^L&B6 zNLFiuzUAfe2GWxeYavDs(i;|fsjzDu^~OQKpOhAM!s;(gvyiPMl~h0s&X*w2^rqXe zsol&wPT4t!MOf0iSd_0_ZJ*MlzRr`LNyBVLL{@Prbna_)uM9LKMb0%vGMx1}42H-c6wBO>IDd5S`YnA8|z5 zBTMgk$X+?OiXpmOW(?UUF)wuLs8R?W+MFxEF*GA;0T%cMkbN% z=avM*z-M0+8Hq&!i?ZRYIT&i~HkBU;1*C;S!o9325P0q5S+ho?#j6dvWf4GViOq`h z-F`$X$aw$!kI#P6YMA9XyuAU;q(y2Sdh9VFfu~vEV(f2+&12l8P*?WpOK~Nr_A_%Q zrBI~Ycgh{={JvEeq{>naM$?t1kV+UT#qf{no4s99;%$e}(IJ!j2{fadbu6c7uYQ7)p;{s`0Om>p=dG1_*kkQo;?~kIcrF)xS;WZ4^ z5NQo+$9H;g!|gyJ+^{FOAakRJ`AoLp!B~~kSmKu*8RF88ZKA`!-Sp~*@;d)CQq4BQ zV6a|cO6EqHT-;~#n@1eo+!b)(`d8yZ^D1C38y4hy>*v*S5#(1|J}WaSCz8>Ta@@T1Ka=zBBh1*pTrvuOVQ@rj~3s|x9n8?^jnI9mkG$J}1 zo`G?d8)w<#Kx98dFPDbJvj$I*oM|?HHzcE3ldooyqrGOBxotnoL+he9q*CjQ-#;u` z50@U70GTU#TNJv!KE0hCiX(Cz-Zr)4)+QMd!yD(;65h;Gve7d@$AJEdO7?dvRwGfz z%eLwWSL0|y?LN*&?mSz{>)EA5zf(eq#i3E0E}sv?To8?xS+b%BF@G4yiLP($UT005 zwd>boPY`u7|Mix_%3eYS0V~Ye_t16yii@@kW??aHdDoxq+2>R?3Mjh@d*el^UcuU| z@OJE796Z2&b%($glV;G+#wT%>_X8`#zpN-7wQBwnV5D+xoTdwv+2n{o_*o6AhN+pf z*!|VVUsSIcQ`yRZkHtACxU#dnnjMr)7#RR3?GaHmFiy07)FhN|C^tx7lp}?|3W8j~ z3B(bA*O&n~EgY*Q=Zit6nWG&UKXaZ~_zP;%CJpLCn_B(=<9o8D?=cSnt~9!?xF)~k z{9J+mt|$C<@TdSZPoKnQv*6zPAf0&*wFa@4@sM3FDF)ykGoP6zUaG_s2nE=t9=&$a!R09-G9hzFqrQ}GJ;;O1by(7KWH=7I0XDwVow!@6;wJcuU7U;XTv z$!`eW4HS1xBi$Ws`==t&Z%p*}mZ+}m&TQRKKmkiX4+|=k&n-QkiS$^oTTxeA!woG0 z3p3X7IiH7@@QeOmsOx8&QH9cb{RbD2`eAU!%pfnBnYZcZY;4n+>b;RVLfcQpi?b4D ze7GcSCBO2+pLucp&j&PW(1>d4sj4u&L57KVFYFy0!yN3V%@D;e9;$N&JJkmY*?jmO z8FUZVMo)e3EOQ3+0G6u>cE-(VMRTp%#6NB<{h>CCrN;q;4X`+6p?VAEdQ8raA;PqV zHW<~Qr?m^2_v_!*E_+k>j1NS>^BLm-PZjk9Wb-_f_TL!1J|}Ev#Ppc}jPYEVN3Rm7 z^ua%o{JZ0ytxU+4#J+R8De792L&H*FnNIxKwwAFki2G15V#sHdgK;;ydr&oNgyF(S zC>P(YN?KCfziq{eWshNY>5ebo>yLe;c3ls6!oSM<9ZGlkh#5@6T%>Ob41A8Sh){DI zKXpDM(yE$Ab16l&eycb`Y@d@SUW8r<}vt07AyKtM$~q2T6XC#_M!y#vd#CpvGV7<9oz2dDsyhSfcy&%9~;8FD5KP zI-~xo)GClcU3CCCgd|MP+tKaw%HRPBT%PQ$D~Nc2xV{@j)Chv|3LL4*A@09R>UMQ! z3nBt(fjFd87}r=|e=k(c2qP=|_j)iG!p{?JaE^^p5!l6z6ZxX6obZF z4Yk*LOYS;KuB4HQSu*ln9UHPvp=_KA=^}d8%O{DCjX$vaNy7x@Iyvzv&~22B>cwYD z{nm0{BMsa%ix=Yo_i0UuV*yii9=FCDlC^V z+|R0F*pYZ|b(WLG+GXk1`eJ!bTV&vjsrEl^Zj#rQ&OyNrw?d*^3x^O74hg~D7Y zN1&X|O_EQuf1ubZ%g|P{FGI6&MLWZBkObw%f%O$1z9GvjA!m|$GByyBLQ0>h%O>>* z_Ae~)q0IMOQTnjoO4(%nt8QFR#v`ioF2~T;?@KmnUK`R)_KyORd3zu`q`ykX3qV^Z ztaCAUZW0#lK7WThexR#}K%*lNoTly};8l>DrzS@|2jeZEv6wUp0k5#cKS|)>pYm;k zRG@+xUVY=ft*s2X0xhvcMwQzmELWrWtW25kC=dz!Do7= zqzG=MCkcTWd$3Z5$2ZHwOKr=ai`4MGm-yf7;}9licj%ei*JG947zrWaXS30q35$Jt zk8ywjNa?Mx5Ws-5`vGj4wWIEXK;L6`k--U!^qYgtiE`mEDpRr~<#N$KK>ArO@amx2 zv>x8Rc{T!fZT5;6g??gXMp2W5nX!viPhNsyvCmlXQ-S%e8uL_d4vJqWM+O}b+5a^Q zt@qRnaO8}fC}`hc|J!y0xd8zd)kZnp=rv3G1DKh3bg1tYzWu1)oUYzeFNg4BVl=Lx z>2#RR7PK=Ye)o>-yr?uqwBz)8L|*PpdQ+A0bfKB26rUUHnxT*ybxGr=aYXNf)T52e zs~KNK(898y<)p5s*Uylt5hkR5L1c{C~ zJZ_r!?v-e5M~w1obgUFaCqx9rP?V25aJ`6qfxODp3+}yC^WxYIjkqbuw*{A?nsGBq zhkC+B^L4ljD0B*+?J>NtbxpLk*7um)T|u()q?fb3s!g zpC!R5@!nFzjTZWBvKVO{_rPAjrhhkFvT`O0N|$P;Mn;rH&mqf4Ds(rydp1w3QFXxW z2=d1aJ+gq@sa#Py;fvbE!WQ{TS)=0bNbqLGK*Q(E#sdn+*murUU#$&v)zN zQLwjYLCjiqoJT2seD}+*E$suGW>|xgL9+rcb&w(sOMJR4ZX%$=E%)w@!l~LMy8UY# zzD}f0Taxybwre+JQ)-jv3Zhod=*;Y7fztCmv^$?^KsCxE`uU)lAN2ENPF->PC=8T#M`fGE~ta6_E})AQnbxGfLfD_(WhFI zRIMUF(KAVa(J3YxFLrQt-Yz}`sLM;I^JXvVjD#Ea)1Pzn`WyK7q;d9H`aSkT`jq@CWspjixBv%lzyr}FgZq{n;}2@6$C1&{`5a}0uxEn}k`b+PT! zpRc9cjfIR?dZqoC3=$=vd%e4}PRx?*EJi~Q#IX@Fdw%TglDc&8zXy zL%lHrzcKx4cwVC{cU~!G+&x-oa%0RN`R!!%i8w5D=bj9{+LAqB)w7(I3m&d`=Wt+N zX72;t6uw1rs>YKL0LvL=&3RNA4K5~jQ5-WsOAn*jm@Eag8+qp4w%V$j8F$KztZj`u9kP(f}!$jFO zwF$yR|E;^Egw{IwGT;m6_e`K`$%}J~qu(tGltKC{9^FYrGa7BziLw!luLqGfB&5L) zjs9u^yjJu)uEbLby7+A1Dg@i2T78;pqf*V1O$>YPTyB8f9QkCv*$*y%(@v&gnh@R> zrb9IE@8#bo_fvmhj>JmsYh{Rz??#I~R zbU4lO8GSW5U67e@szrl|x93lB8?gFX3E`^u^W(vT)OE&z4B!T!ev8AjU-A#G;b-!- zp#S$&wds{<3X)-5ctXU!aua|FyJLV*Evy26K9Tsq?Jj~~re!k*@%a9#MiN!UrrdtD z6;N;_sxnHcVtBG|qd`y8PR}3}IBBANrFd@o|FQN~QE@KXwr&i!B)A8M;O-FIA-F?u zclQ9n-QC^YEw~o$?(Xi~f@H2WXV%(hpLW}MN?OZHs_KUtqmSOdj{UMuk_E`GDUQ$V zh&4-v6PXN}WmQ$;{OgK$N%s33_xE+O!SnGAafr9KRZl~hbf3~DKa(nc^xb!mniMpw z2wf-;W*aOK)%}16(4rS(mAf;zt)Rdg=`qEI1JOoJR+@FE#-JUMp^217u>|CFuiMT_&C~$`A>hU1-}Y05K3G;g*N{@=1TG zP65)SkpejmksXN(qu_7ZW#~VG3f~mNIc;XRW8)tPky-Pc%%fb=9TR<2S&uQk%y~c6 zs_GC6*u+|5)=QQz{4bcjr=HmU%&oex-uudQ;iZSE!zb_^>1A{iOwr-fUImvu%ROxA@=P37lv688E{eMs*sh z@JiSHhmnk`1sKh4qmOG!PD(N;xfO{Gj^@@o=UCb;vsrRa*aXkOa&NcbwU6bE~;5an&d*y8J!GX%vbn zaDj2BpqhRn>xHU!9oo2wVLcQ4ijTNg9sxkPc&768j(pqRL3!eSJ!?Ml-dn2MliQB3 zuJY?Lf20#?-VCed2p>GS3ke&;A>)MRzv;y)i1xSsRJ)=f{oG)2*oZ-g=En#;im}6- zUV)SiT_%dpTL!HT_5pimCn&AM!p7%KDdusTxg(ZWpZ%{=gc^=QdflwXR|^!tr$F3f zeYJ|L+w%*@Fktjo_}3ZndTdJ_H6lmMd3AkCEMf^M-IOLf(KRgGh{r^tu$mJ@zmnb1 z3t<2Rb$pt1PORD_MJ|7&aQ*U#8&k8^aeO>jRa%!+P3EKUTa=@Y&}sE9`!f8mM<7PkE-|^wy+p&pb9QA2kB;bz>NLu2f!qn^xKukfTVALyB}(F0U_kNw#ugZqknIIb2Hl8aeD~xfn9Bad}bH z`LfvZMSfGsVV|}qzBX@~+j@CM-0x9szY3s@!lk8c*}{>-srpkE5Jz4<6`W_c?TZzM z830~NaU!`VmXu@=F>%1H6?GLtYw*GNX(MsO0yiW%>=Ak&MIv2u6w$8p#?nL}*0)Qq zKdvkHJx1Ux_3Hn9VkT%(vJ8mA7reb!09GIV;~LZ4#u`W?e^w=uqNWk8I*{d|ChfcI z11_uy_yYfyyrAHzc-Jt4sw65N;@;|f91Y6y(F=i9HyKm=0NVFVDzbgX4Btc?SUG-U zE1gr5Bt%MU!FaPMcUYc=jIfiJj`#cbP7=^*ep@2>BsO718&=D?DwUCTWO?fyvy}F` z#M#T^cZsuSz8kZF-toO>8S0b#r1ie1KsDq9@x>f5Zg@pgBh@gYCWx=;Jb(%0kq(#|&xg?^l{Fbn-I!%6%v z?}79AerRyw(2o{>WuSne_GV!Zm>~XS_Ymd>gRSfPo1oXnc5z!g@uW2{HoI&YdF#;{ zKy2kp2x|^)7z&2EoXoG>lt!z+p9?rNucsum2{+uw;lF|^OHjM0ADc8?!$zrYqObTg z2`{vCsy~$&C0$ztq$M|NBH;zYc2lOFtW{TwQ)GwH>GGjzwZ^&_Wo23BczT-MRdQVm7Sf1XPwA-=5b2d$| zl;`@^;Dt5Jy!jnXE_~HB_1Hr!%+s{EAJ?5{HBPi!HHmc`NSTKdyJ!0tQ4jS`Wxh=N zN;dHb0?$)(6$6IR<(Fmu9oq?9eiZeAU?RZw#gQRsTXLG|?%*^o&2kG!X-BLRmV*dz|HTd;J zgx>y>L4zsqCha$``RK=`qMpWcG$nQA$dTie{p{aO)cXx!{UzKwtmFNx#d1uqp8pSn zXMZzBtsJIaNDj;VD6P0l^Z3Q;D!%|elys5nFEi7}yUx&~6NYR`cKIcdEWZ^kGABoc z#1B5=WrgiCR~afW=o!DD#;G>XP~&oHo)qYrxrG(3#TlI%Nv4^*rF0H-C+3>b`Lrjr za=X(V2Od|Z@vZWR$=~$kno^a)>oNwXr?1;6Mn}eYSJQ7YvbkgvP)$jALEfh-y4FyP5^@x#yq++lS;#f>Bo3d^?2FPfcNPu|O#8PPfY@9GeFo--= z#l9R6c*`j`8=gYrHwKmzd9pEfAuO~zS!g<8Ujsfr5ec382<$q&eqazam@ z&W{HEl>A<;QLiDE$f0RcU@?$s$R9hb=-pBnO`#saHp6*=+cSZ#v?oPAYiR6%ZYS^Y zdtLv|KX^XnQi=uAe$INl&MfSAO2K#0^J#m4N;QBnf(Z>;eTkFV78H;T!X9!q;qfO& zsH70}A1Q`_8~6<3t^WCAdsjy`Uk*qCQV!|gsSDKcFPRPR(ZLA}4MBA%vpy0*TYNm> z6orVEp~<1|L&#FmdnmR|v<82Kw{P$%+UD91yi=zXkkBx}WAW+>)n=-UuhVvp1iP@Ww9hl##AtgK)#FVpn!Pkcvw z6M2E-`!H(OBSnEnQqvXK^f}Gt(Js%K1Mu4JrpUE(#57FNxN^zK(~R^HOvq%-Tv++- zls99IlfUN6xqweV&>@1JsLrY5LK`u>Ul|Qm1LVA`2gg3#UFkfYWFF()-mhFfzI`Ij zmlZJXU^hLfQOn)w*BsWf?r|C@5cQs47-M&KflL%=Ad~T}2N=SS9jZI;UrfdnjU^m^ zre$D<2p8el4S`mXm$~Y(ygFa0TzvjHA%e`Z0i}s|v$mp?{N_LmxHac>5wI8aeG#n2 zr=My5_w`ch00fxrOdPdpcAI7|K0`@{hzMrP zHsNh@aotmK21)UGrHyv>&*oxpuHb*UpggO9E-1M&Jfz=1NYwk6MpPGS5-9OQmmz4q z)>6Y`tAHEzB3We1vVg_-vBcG}66*{lRiqB3I%tq5oQb`lC$lwCPDvo%@unxV3icaU znQrFs5oon^U;{z`21UnEHIQCB3ru8u-ou>S4lQ7Sf3c1#{?~~cim6Xj*UU0Vlo1J< zXgE9@A-_WArHE2)`e(k!H;Df~?kD;%Jzx)`A~jQ!qUJ1F3!=Uvk9uN$fTMxpdfLE* z^TBA2yxcU2h!<%<>M1Q~2&pDZ6mbZ;=HNyF3V&lbr9B1HnniUz`L?61sJ;(wpyCB(T5VqzTQgkweSp&i)5_%PJKWS=ZY2bXWa z42mMGu*;0#)*R*sV+U))Z)6!o-U<{)VpiKu~rOY`g;>Vykfly4*T*24b6ow3Bt*tgX+-mK*``R|_ zUrf;b=0w)*rn75N5IxF0=@a};gwz{;ptE+M$thgZZne>^cLa=s{FP8CctdC@A|ihg zr()Vw$rZmS1<6i-A@j zGgiF@{Sp){?1J6txe>iCsIB5eIwTlwD(yK#H+}5v`FlZtti@RPmvEdhjtu>G zRuu;Xcux4_7 z9fVy|Wn)Pllu1oGit=0OP5y1_p;I`lo}xX~pQgBp^N$(b1WtIC+?fX`o{nImei#^h$6W97(MZJ}_%5$|t*&NepU)IUcY`&jH z+`lcdfKgCBn0^O$KRyo9Yx5BNlsfa>Ccbw#CD?urU|1%lR>qFN42YFCE95aH;p2O0 z2}F9SWC?`>2`qUCll+%QXnAm=g&~#be7d~_r^kJHt=9&F?@^u$8BAfzjz&`hS9*rj zM~-Pj{jaFU$nnf`a1ib-a4~svLu{a1%;sVR;@-$ZkPHZtZ63}_;H5D6=$n^`X5_9m2#|9c>!dQ10QL! z9+R6+JC($0R@zYN`fcapu56T>h8R64yfLbO*5bNsRVD?J8WDIMB6mT0b-U@A*IuH$ zOroqQ;q0ToOI{ELhkxz-pI8CE(iI@y>Gm6cF<3gwVfB_m zWN8!9{=QpSGMWAl>5A_Qw(9+BtOh3Khh@w|U6xS&8-dtH6<2Ux!DW|& z43;6}REB8XK%N3+&$#fcOS_`YO>rd5#Bm=31#PN9$ zFQF?|2vp_pr$nER6!p0T(Dup; z^M;1Zjhd`krqc*^=QB3wn;vfS|BzMD0h$ zrc8yA=cs8se$5i{s{1T1!5h03b{w*arnuX2JT1fE8k`m)KqC!=d(@9=b%hmPF>CTa zMFh3CuZ|gqRs+}_4g?r1Ncz@pKGbLxAwk&gHD;Qv@zb_lTbRr zYk*3vU_sAN{Y%%4JVJNFs=%k*zGaWuQa>EP z;|h~0>=$Ry8js-;xF8bnOv}-_hoZH`l!O0BY{N!u4IlN6#2l}$2{?9R)@`Rl{AfnN zLcfw1`#u9^F!4b&$u16Z{TxwaJPs?y3zmlSGupz+GKqINRhkEr&%%}rhi$7-z)+ax8=}3c4Jk0Ya4$nCky3iwu*cl_PaVb2E+`CMSv zL1SuY*g(ucV;gnhk&TC9Q1lt%xhn;x=X=(90z|nEvxYIJQH|)94m0VFJ#|V_+~5$- zCFPgNpUfN`*kut7q;q~RrVja{s82nJ(o?(@FQN(hh`Ai zwEn#OIH8KXjRk3@=3inW=y|!D#9#v>)VYCiLI4w>@zXdTc@GhkL_go1Ld`T!rFaJ< z6V|&JDKx7i?4|7e0e+Uvw6k~j4%83?0Qwnu23r42DoBHu_D%k)d!fGyXog`5fh_bI zlhTS8e9@^xnJ3F=s4F-OdySL6!?u*OB41kNlX?~-;`20G82Q&UYPyu3zYWfn+TSSo1&HX#*$<>mx8(C`EA2&CFrUMD>4?a^|6D^6AwDyl&N_*?`0{gS=_EzG zKiFZA#|37A=K~!uCtHUROwodBlmyTyM@LFBcH&x=cha7}6mQsOa4?xuAlwjZF1y>B z-qlYb-iUuWyv2h@U&IOcJ>vbXMdkm>h#qt$m3rqjEmq>VU|>{p0tY>(*7&)jG+FRA zTA*PQpETIyR)tMHjPg%&fS?u`N`*v_wY$^mDxmdRRz8E^`#a=1)<0Xy+7|+q}hh)ph z1+C;K0OvTGo9Tj?K(|9J*_3wypR`u-Hg5TJ3?vR%vBM$g) z&IciZ>2%}2vbq8;ERUNPsR76bgGY$(YmN)}p@(;Jz#-{3&)isk@?{ip{!;5RAmk<4iZd72pNFXrqI%5e_hDxd1N|W zN0q}7$zJ2UJ)+&%;5M!OX+Li2n}*LsWp>^jAnO^Ofw_x1hnv-wk`8qj))qfaSrgP? zRScdxMD`g+kr+yU(PeCmPm85{SP(X@LG%(FE?t$Et_AA7=Go>hVgb+&&D{xfTCM1H z{g=RI;koJzb}ke7A!YNYPe7d;I4w+S|C!JIPY?Lo+3etbS$Y7D4>?t_;1aV5(b}9P z9iy^RJts)0!Wx)ZHj^yh9P*MKgzV&qj+`!h*5A9 zC{auv8NW3&Wi+_@F;?>VHoveVWTl_4rhM+$R$K7OXACq&QpD^r>GXh)!Tp46cmJGF zouoH{VXMYy&uNvH`+*&M2j|1HU!c%aq8H16EH~cEk_rLR4vdQf-@EuRcvSWBDp->{ zPp#E0@{zWLPTz;}q#kKP|FSqoqt=|KnFzcF<_b`FYew%DkR#uPo3Gq6LGp{{-mf=r zl(7Ols9UfXnBLT#2Me&}9cmU32(6-S4*%U~I6Y+aHH}sE=!`M*9t^NC-7N(It zK;kv&J#lYHTd`^MMk7x|0Ekk;-Qv z{y$LeeFJj;qVT*aJ~|2$H5(pAA`X_HR@3?V1nnVSEBcL$fGPVYe8l9~q~-%Y%ewgL_@S*$N$t(Y?~AUe&dkF

pWnZs3| zMEm7h8Q$@RG*I&Xh|?>r8ANGU)BGHychM~i)m6= z8io79J}x~rOjImYG?QTTfaQA}XwfrcDQwxo`;`|qIP+tYkWhaGtL=BVq~dL?$W&I} z{NVM$8`V4N)zBd~55*zwFXzKi_ea2j!`Pyf3P!cqDQ1r3 z6{UDXG5-K@27n=&s{$@!l)LkjBW1>pmq#9+#odm+;d$9P8#<>u{-7fd%)T2+XEpjM zEnkYr>4C{Tk622~28~G$AZPJqZ*ziLS#G*pKbO%GVen_R=d@pEWm*w|mDj1Ny`NwW z$-eStZLJy8+480|M=e>J4AN!mr%}0(m_%1anIYE;m_aO8}s!4*^&QFP3ZLk&k8`~ zqzVSeahl5>rpKSi=K13oAZsG?t6yDyZsz-Qn7c1su}3A3|IlSlPOwxB3^#c5A{{rF zRK|?26+J)SU{%Md$o0x0f>P#dgRNZu^zdHJtlO1`M;XR|t0Z`(- z(+uhf4`K;0_B;nY*TNHlp zDSTBGDvB%{dRiVSOO_knPb$@18lv<0NKl_vZO`UcTPe?t>2tc^z~GIUxlX%++~^To z{`2rWWBbR+L_~xiVPIMpL;@KW(9oW>G{Aj>BJ{zesv8)=(Z^6REyv+d3pX}_)TH?F$BUne#Rr9XxDKFs%=0k4EDoR@av$S%Ok!62@* z!HEH3#@FOUe<=Z>Z?zW$dNJ@08HD1EI+-`~m~M`T-ki4{knBAPd!TAW-%$^dtF(K*U0g%9{yT&e;5vOFc z21O+`$#SEnF05MEEEW6OIzvRn5 zZdd6Le z+G$6uj7^uR4nW}pseiSjw;5#C+~cvm=K_}ZB`<Rrn?c6?@DhNdQ%0ll!*eUkx37$v9fYvj%(LTDK|c&z;HS z>l7k*Enw5Y$G+<8m$RA0+R$LZs38ia{QM}p)exI75?G!l76=`JG@YUHwuE`ov}Q-^ z1Y_``zE+o-qj;`9*Kp=p0}$Bk4+ma))W(uccQc&hs3T9NhiiJpC~SfD?a-k}VD=o? zaVu|OysZOs#PKY5SU-_Sb%?C(Cx55O(Oi z{JKsjt(rsp*CEDn0eFa+{AfsSD-ZW3arWF|YPJ6LKMp*UhLPmjcb7BcAXy=I>>I=l zIjbTr)2VnG#%{4LhkB^2P95kDhFOL_a;Bxa{!;se5jN)TDfl;%Jre*H7oMYivu?+> zvH^AfE)2f9Rn^M z5tDhs-Szn5aFS8b5JcPW;#;!~^V7jEx@qoBs37bN7OiL{ zVf=??!6}TY2ud0B@BDxwkcS5|Bk4c-HH7^h-2(%hBUzHud*l}MnAGdde= zLqnX9{+-Q2U(R63*RFqs&e4tRo@F4T*8;pf!J`8z4!4_-KnDOq?1}Lr{^HYo>~paE zI2-B(4Wy4@{LO>&-u8oTeR}J#1cs-wkZRY_A;b4@UsTt($UqoO>f}jIK)0;nOVBtSea<{%*oCq5Akh?+1P!Zo1lf7=j=Il0PZzL)F~3(UcD-gl>S>JR7Fo98g{igHnS&{Xo~_CQ1Df`jySAOUE|z>#z_x^@yVhm(LKLjCLz$UAF!De@A2kD( zZj?MH8yWFd&FKPB|0~U6@9m@c>@uz44xmN4xv9S<;or(iY4w~6G7qfsH4u`fDf_4Vh4or4*C^-M5Kr@1FcOW|d8hs*JqnF-1Ae zOm}ANsAP!x4J~SzFT?Gg z-ZIxwwd7>?8zTOt1yC-R5r&TIt*#`*AIS;1gq}7D{wVRgc(wkGePw*0P>CX@83ujH z3lBYRUzL*3XAF(+G1xB1lbwxW&iMXxog~;^0tGI@6Pd=FQ`Yg3%qbbZ1U3sxIe^DP zkFY-gpyuK@w{&odX(9bXk{sQ7=xcp${*?d-J3I##Jo4mXyCJ!BSh!or1}m;XUEyHI z&0X1X)$MrtLFL``cIJ7ZN_53m?!K4%`jAlyd-%x@{v+KI=X+oe%AQD@loMMCC7Jg2 zE+u};(u3*XI_xX#OimI3G~vz4IR_fqCltE%BOdXoFQ&~G>au$UjZ;pVGS0Zc7*~$$ zO>dVNZdHH@v&ov6YNX0TRKdr}`3s%sr1^$h&Gxj#2U8+}3ZJJT-r=35`#zPC+m?*O zrnGse3Vmvt8rdfgY%QR37RyXzOL3{6}TD$JN#20z<)Co+vs+{vCzAo?t*cGCbpdJqzd zPX!Qc7TCaOZ^on3Y@SlPRahh58agPZPAUJ43Ed|jP8aEoXmW`;b^9uy!HSpI@R8Zj zm7nH*MerP7Jqog-1gq}xr_wdPeWs$h;)8W%qplK_#2Dk-riSfm^2#w}0DXepg;9Gf zB?9vGuvh6Y;8*~cM_{|{$Mo$0nvPfjjar&d4h!lOmwQ34*VM<uPmJjWnT&mvxbh>=KjCpctrOn!TCC~=OWSH}wV{Z!$ z1V0=~4f~=+5ZV>bfRiAD5#cFF@@a5VJslP2F@$?XTxObFrB0q0;mM|<+1~q6T5~zP zM|FVHNe%5RDnbu8?q)-sX7j8Lxouk1Ku$7?@+lwB|bC$qjE>x$1#x|PAIQ&vWy+2p;>8iyMk z6xSJY55nSvqeAKWel}7uG_+|7YUnV;5m+{@r`jQRzB*O5-l%upTt!joIK>v~Xw}pM zbLn%I6jrH-a)+Zm4=Hf?xuE7JOp9!m!i9BVkz6#kuUEIB%@}9&Bs&W2XZBI>V7IJh z&8|pR2N$>8lICfxg0Yd^_%hcGKGR$uTVtIjBKS_-p=KNx)MIsduf6nJnZN@I-l49d zBaABgVwi6Kta*sFx>3gm^l(-T*kQ|)va0VnN@SlS<)<%%!+HZrQ2ih*(q!yVQgjE{kTv7~wv!PPCR&X+L-qzd|Ms+Pp*4S-nVy*o=64 z6urCgTe5Zg%$jMjgN~~R0>)&F+LCW2`}^IMNfyikyc^n@CmT-A*`WsUK)+6I9ORm2 zr&u>hGjXKs?l$a`N243=GAakHvSD${=CKb;6tkk!VHt;2$a`;I*-N{9fulA+GPd6X zBXl8Dnakw6B`=R-L zz8iPwz~REWN5E|hz5~}(%hk=(Obj+0X}Iu#T?HnBong<|brc@Y2v|f~w?8U>ZfDiI zy2mtgIO(NNdd=@Q?i$BGpfoJ6p?b6+BqaKea}rjyEhO%u_9Yj%>88|vOx^~F^{y-! z8*tM(YVvfesx*+^a;`X+ewmgkLYYvvmL*4D&`oNe(5KX4VOQJ}f%Wk^csGLS2U6i~ zA<2wpy6G*ilsZC2F5ZpC;zfP4fpWr7=tAXfNr^;xT6QwrhoU_ok$nW;jLyBLCDqh2 zyQ82L)8JgD%rW(vh(u3-qU%1#?>>a5I6m^xV$y+ubKI_e!N&1;FKP$AL=?nm~E z3d6{LMA|GlM3R&w>U%InpP7)GfC(I<$04ht^V4#<#6f=v!KFj`C3;<)8^dU}giE`z z)lttPig9*|RSSv-U#Jkcn>|u^NTTa5vr_gEnP7O8NSY*!dKAcq_#yR+!YZwBxWs_# z!l{qJSVBJ8kh>7cd&{0F42(UAsQ#k9bwv4bU2<-A3ITQnhZQ@=-J8_>np+iK*i+Lf zac3R((hT-QxYp7gm)FBTm`0f_V`9dn;&yzmm2hE0%J~nBxyV(E${0>4;cSs;wN_Woo7tIF!RTJTk|kq*i*3 z4U)~>v=3+ZF|Z*p%UOyBq};D6(hUnm-@$ro$ji7uyKt3Ak}V=##68|Z?*ft6LE%a}WZoCnm$?9Te;KJ>830pJBH>lp^jxRyGaLNe~7 z8M@sA+xPRcb9FcN_y~Vez{b}V(1+Y4xDPXK{Iq+DcTwt7%e30!DG3ywgp4CuuyHQ? z%s;AolW#cOjGk3a_t}^}{~e#1>IgVyU=AmljP%M%X9A3z!xYNsRhhLDvFrVWPKmNw zuCB8zUE40TTTy3h$U|#8MMWzc(dv$o+J;(wYSpa4+O?43-l_zh;=~?uW}2TmbnL_I z9YY_*TCNPCxdEFeGb(N)QCX*T8ot+>G8|@(;I|#3GSr zY-r_x@=-95uqPmz-6ePP#HjCR5~9W&{YZ)Thh31KWWs#)>d1?e8khiN90?OJ<)jQz z5hl+e4iCAna9F#oNN7{i39ls378s)E__E+JM~J292c#KQ<_8Z^jPVr+AtNMb&Yym@XgT_ zY~(|mtM?fr)0n+faNZhqAteZX{j4sEDvRTLC` zXDG7J1$ssCb;vH#Z^{eSFDS5GY|0009ECU1S9Y>sZ|o2&<0vF6--_!mhvGS*YjvM##gTv;oOvh$DfjX=Vcxk$9Ay0oDFerbtK)^=8gmxk(ZNo$0mb-QePCs z`{eIA7vH49Z5p;m7ZR)Gw^`RG53_`UJ{Mc^53+kHj*XK|UzId0l_*N;=h+lO6|0?sC5RjxEBfllnfIEkrK&ddO#CF~h-D^{Tm zt~^&OSrRvO#epR6Q)$V`0T`*o{;J5&wVpVwJwdK>iEp}MDg8OkE>$?(j+xL4-l1Hm zhr6g}m0)~RyJI|X{amvQdqFuhEysyj#8~`*@Bb8yut3EsF*X(P5%2m^>fHw9b=@j} z*D4>GCq~cTKT1SN4gD6r*U_WccZok^E%QkRduo^PLq&!ar@9NBVj-L|wG(}(gNGJU zzcM1TUCkFvSSXQ_sw8;vn_RF9qikG>#i-oJQnLn|8l%;KNQEWeN9oTN0_j($#s!p+ z2Z2uwoeK9x4yPDH7fY_$nGbWyD!H3?S|Oa3>ir7?eHTA7A0qn`iX_J}Q6=wZ45?^k ziA<3&HWLaX6e@xMEK8ZF5kU^rv|6>n;Ds|Zo1J65P*}-n;13oYSAr%O>$^v={>ZR2 zqfLqQD*?r*n$tL}!oZq4x2R1}7W^jGNP4VB=U?@AQpi zVUJa?qT?AO!QERJ9$)KUSbw$|tV)OSScmobp~T^k^T?Q=Edqb>)@X!g-8LpcGJuv~ zuNSe72@iF%hW+d`PAJ$pA*SeyLC+PxG-pI3ebATwu@hJttgVkJ1d|D{5U(DU9y2j+ zaIx>`Hkc9uF?D+mny+ItRvQGJZ-d^xzc~4N>-|Y}xv+Px*^0MWtl4pH#z^oG4_OsQ z75i)etCbIJpCe`lTlf%~S0cO@PrN3l=7^hLudd3BkEo%&H{tb#V~JG^t@V_-shMrM zB-mgCQVz%9g*DZnp&g-Qt21j-Ijd zeidT|z_aWpMZr~nE6tin`d?ZANQdgkwcjnK%-n<4T81gfYQBW;)-m)(vK-^h(ES{` zUPZotVqF+9$Dn}Ic9syLRZv_s3|}K2T5@QK6Ek}i3uaNSl;Lq|Lx63ig$oI8Y%}_m z;_F~*m-xYCg7Al+if+*6@^Xl{a491ME8ji6zu+x*x3U>73e0lPyM_+WCeQ9^;4Z7F6?p+VGjuhh*h;0-4H#bj^P#&<((D@VZAcHKwL0n037eb&dOxMMX{ zfEE8J&zcCL!W>#KA8*@@2a1}S9LD>qHe<8w8sIM{;o3xhyDgr(hI&WM(dwzKni~L? zYFLRt6CBurbIetupbaHQQ?`G*sbj!Rv+p{@(}7>vMysXFn-4Y@>;E@$;_bv9!vX{(8u|AIUIe#YGRuyrq=xS zudYdd0`UsHl?^!ZR2d&4kK{<4Kxt=QH%e4G;Y?AVJ&4>kQ|Js8HP*>ds(o}GL*luQo>0sYEUs(eG?bWO46ON()@aMlB!LAEF|5>_L z5{Va+Bc>Mr$q~=`Bz?}|Hc6py(ms5DLCNhkQJMXr6MqA;A#~5d9e-CN$*Wh#8uoY0 z<=GqJtWE8F2TRl?MxR<{BG8-NyDED(++bYJ`Hcp`=UW9cQ*s!nTK!L5emW473~hm_ zEN%}d$6Q*Uv%1+mdkp%5xkkCVBC>~|*lXgve3W-j{zMu9A#1JW zL+M(Q$pPrT0(5!4^-Gb*7ix;d5H~^)Dn@Ql#uz}a27aDD)q7JS@n8t7W)Iln@~46a zq`vm-p!F0r`Fln~oeU0}(+#iLo{=??MwTI6QWc^_bt@%CzX)0?m#bc}jnlc3%nI`A z`^lOmM3M=sc=|Z#hL|0jc~D1{$yq8BYd@vc4Z?w3QO~!U7p5Q_i51U8 z;=4^Bu^!JBj^NwR`a4;IRJ z4c#Ufy^l~izRi8&(>z8Ox+6htO1m}-q@bi9@yFT9_8m^*7LtqFiOq?iE6{I_AX%MO z*tw~A(N+>2RV1>#x%R<3x^*t{P>x85DEY^%Y&q`Z@G>HSI(irPK;cj2 zZE>Lcx{|`PDy-%eHjccR1pcI*e*G*xn3b6)0b{KQvws@(gxRgUaoRqAk z!ePndQJN+>1C;WPfeH223{JNQ=@awPj;|Rqz_AS|7%-4@zE^_((F7lRu`$}tHSo_ zjEn?6SG7H+>g!`&M^q~To;P`tH+5XrW@=N`U`MQyOFQB?_MsTDpAEa2vlqx>LGbPh z-L8@#%=B3gM5!`B{c2WWV7rK8NPl=1ewN~3)w+f&4~|!R>=a#8s^bsmReaQA=!S5A zi!Uj8u_PHp`+GM%$g0ZBYp+RpV9CFa9D0ymfxU0;G(+;wXeU|K|2!+*5^YW5KrfOk zcGqBFp@n{Z(2C-?2Ymf2q8+zstSC3Jz{lYl>W`h&W9c+^x4IZ=m6V5a*1-18zh0s! z-!PwnV|c>8KEueITQVi4NaDszvz+>}P061rGGQ#J3d+@J-}-_lXSyhehj7P4+lGt0 zWhx^_Xm-D^2(9vnKaVU3QaR`|*T^Q+eyV;&wMc!*JSFE{s{|^4R3=G-;*fnfDq9ql z_`EoV8$D&U^t>BLI~KjGMy0-!ad;fskdKuNoy~+iw!60AQupXV+Vu%zW7$QO=gc_L z^K1Bd@5ekE+Uyt1W_jn}ur4L6v`cOhm|yHO&UucI`cO`$+Go+ZT}&L@4*31>l3SD2)xXvZ*CnbJNn_*CfzeiD&F3FZXZy!WjJzk- z4|RFBX4zw$fj8s4=l$uA*#u3tT~6~70DS%g=_ZufA(L|Q^XQo2FuknS9$yJ2WlN=fMkDUt3NhLG-#Vd!ocdSIw`C%&-lE)w03*r2?Xq; zf$OC~W${!u`wm>@vhLi4_igJ+U-j9e-SIAXf*XPnWW32L0yhP=5 z@OE|Irx+em8I|GVuoq1+`%{EB;K8JMCLbn+v}MTk^k7V-Z<(+jgneOdn)@)iaiF;n z4h%jtUk6|1aIeS+?;5Op=Zh936&_?j76O0Vskp9X3OEN3GF zL(_twY95x?mm=^I# z3;4^}pz>NF)P4Jn(N>RZlw!FknN@i=7tA0sLT)a^Q$6OBi(F)SKErY&myki4`KhKv z;$VPlWtGE(bN1BL%7$RxncNR6hwZ(=?32u*_o}L^UzGLpWoiTxICX$NTPP{&FNERj z(}Y4)7wmgHHR=zC$@LQ0(x@*^v4inH@kYir9T{ zSb=cV_bj2EzYiS#Fu&OEM7{cjAa+FVZ9{UG&^f8q3V;yMeqQvcH@Wh+d)`fBWZ?S+ zw|;`g5Xs1OjoU9A?K){Eykhg)B$gUVdcq;(7LNS{Ma_~(KOA0sbDkeRw-kP*Lwozm z1(pumrfLearYD7k6h6qV|fX6rsI6Jv8#_>Ub8=)7z(Lb{pVX@`tz2 ze6_kFZyyahLEMs-NRfdnrGt~m)jGG~U4him(m5*N*w3V$6{+R-nP9sY?77C_yq*Bq z{Q;p2TQaFRGB#~}s6fC1nV#DCiF{NBpR>i-FdSPZNm0&b@l5Sh?pfL%|Bg%1EL~Go zRrawj1RtF}J%Vh@F@eQJ17t0t!}r|Al)4n=RhK3EyswZuEB6U0K1^)_D&OawLt{Q1>a@Ch8d#r zzd-0mSwf4&DkEh!TIf_YPZqnCJk>bLK)WjRUm&du7Zz}WMc%b1QhLwK@J#tB{k>zSeJOdUYG3LjQ9E8Y<7`6RoEL$m?5Supj1c)VXyt&en5csH*)X9ld zCy76%880z|Jdn^-l77?{Jm)(>6XC|Jc#Ta)YNNUB0E&?t7*ssDHMt>N7)tBt9=vti zL!W<)*OV*1OFJ#snVzcVy$Ey)TZ(dInSw1p_GRc^W(7sS8170WnNYXpkGOAf<~Dqc z++0nHzIJ0P@kD32FJ)0)tJ=VhVYFTp#_#G*g;d8YUUO6e#T$kAo%pL@YvBFBe0d@r zf3YKVj0+SYA%OPt@?<=zHeViY6wO!>y-*6AT0bH`t*^$(IiOCDhV18jHKSeUeS+bn zY}x`KCbm>&<>n2-kJFonpa;-2vkGh&eSPG#;I&V)iLLi)@OBKt<-BO~9f4N+mOO?h z*cA9Cv!NdUp%&&BmpNqm;fA9E1Pimg+na0HTObUPS!7Pz|A?}(@4-UchgC~ZJl7Ip zY8{eyA#uO}`5!^f3A*nrbvDpL_mKl_@&Eb!Rmr>`D< zambbmYc&){keG$*2y?R`Mvk1bjgZojh1hn`G&pHI)}1wF>_S=m1m1?jO-g#!;=u=Y zc0Tl>aOr4Ab{-)y?y-8Veo%vtm@WM$G@beUDDYB2X_n$l)_C#x-&_FJh3;;9w_%o* z4nau(CA+RQ3cgc>ro_nQXDlw07O^tb8hvQJ$MI^`wY;ABR-^Qyy8b9y5V$ zRC(=9?1ih!K%i9v?aI&-=YK)X4w^5>fT`rWYs>u(Tp^8{Mf0|kDPfmKix?D*ex>CT zw&6n|o8)GxW=En|%ty<7ZmfLnJZZ6+%oF)a2Q*=3>$;b=w9PmH=j9pFaLP?6{=qKm z9WgpbHW;!s`;t4tY@A1F^by!8-;B<)nC!m1?n8y+weKtYWCU7~?G^$28>_Bt-kx73 zRh9UASSS4QFRb}4%g&FbcD$|*m9q#N_GNQP(dw%C-@$G zygswfG)cSDlNr;ehgAAWADL19C68DMkJD{?#IAIKj2$Rt_pj~IwY-&zi2@r9c%()Y z+h%G-ke*$qmhOw-nFpGqhcH7e`V{_EN&?W(SIscOh9 zpU;HyS$snl?5<2ScjZSltncEzV}-J5Qv{(q6+VMtns>k?@If!x%auaD2PtD_$& zKp)LCnHxR=2#!Y1jHcs!#)vamcpu|b%6XAYO@?MroOLWni z9^qRBponk2q*o`s;gzB(_xiE168i;T(QuC`rz$%`I5r2n_G?oA3=Lvp?q^BDksPu$ z#2!Zj0tHb>RCqNGg3%FOQVkE{0Qv#vzpRwm<(M9_2FEGl=Uiuo-qX_h21%_`Dz?Gp~}3i!K$N9x2KGQJMH8c;x; zwaeQCn>;pg_ydcKX!hkf7BJhs%q!i>VU5Z5!)U;b{8JiL3C; zzDJVv{Yxt7>)T+Bkn@p0U+T)YLyt19^z;N-Er{n+mcF;*pL>j5*bnuC-3Py@avwdD z(68_2Nq*Kx=5=IJ-pSVE#ax+H6h_>YY%|m>>C+Y1ZwhaI1bX5J9*y)E|2jkXZZ?D+ z>9vDpw*wJQg_IwXspzS! zM3P(MIaIi$H*$#o$aSIIXw;F|R~K?IY`2e1D(>sfZ(NF1&yGy1t}fb}Y~tKxugU6P zyb@ufcU+UmJmVqX%}CZU6NM0LSBVtm)0bze6@;MAAKrFp5}<#45!>;o^Ctl?U+Et< zrsF|qXe~+4=nuYdL)g`7SIvg*063_W%uD-E4nmek0p;M0@7NRoRy3eejJO4=X#7Gm zE>CW8-u_g(nWcBK*<9Q)fsBxf<-X7}Vjk~A()h41h66}` zh8&-jjR1J_&u9F+BW?*Bv&3C}uM&+0=2(bu#iEM~a^jov;VPFM>S8|ZW6fn|EFhta zfuNbK`5YOC_%+ctKf0 z8~mu7dnzxEd|@hX*QUeyDp$)sQt_6J{qhc&QP^h|AST92#Ci4h`+hn}o5+MTWPd_uvO1-^r+s zjesc}DWBHHj80fqa?e|!lb@SGc*D-Jlrj#AJ}up8g-0nf3#W$eGPTLKPo)0|2&iat z?smeGL=#DLdlL5;6L2)}CPQf<3G+4+bwpLH@U2p=6;G-=ji}L@UpBbydstTo#`;Js zeax>T#ts(CoDFAc-nr8$-mUH~c?zCob!(HiMy@j3u#9Y>O~-W7FFs2yh+V@PUUXXP zXPrJbb(~{D={Kc8o;JKY0V1d5N!yo-_T;Ukn4Ku;gSizx420^+aTUjt`Xz+^jOt&e zx2;9OKw*+EX)6WF?_I+#?pp6Sk84y;69~}Px+<&E%GKbm@=8z4btJt7PG~=A2*ky{F}Zh_WpsN+A9rQZi(AI3+tD8U082 zYs-_9NQUg~cjbyK2}($#$Zf0nX7jEaym8V`h|eKsyk0F6hq|`;7k*(%X#k z@P1c1t#Wg($I0@?0j`5F9m;_17_hyo78I)dH_-7{Pr?aHn;dc=fb9ieEAWsrYASGf z{>)WF!ky2IjtnTvj^Hg33^n48SE7q)D3QTblBTl+dm6*5A<|Hih?WX-?kni-a|RC zrK{yd(CGV!_=4DxRzE+<-tbM;(kFy9=oL2y+X|214odSC$E(Y7+CXoh&9T}+K+{9x zY;RfGe_{m}#}Z46X{dcN^~J?`Y~n@j+_kl1Yvtr7%#h!q9U!g(0*Ni6v%*KXXr0<_+ zU-VoZR*+xDyjPX3GpXka`J{o1T69~<8kZEbz%3h66R%}`HYaI21;h-M*Jv-(Yy;uD z#3+=j|5FuQ2CGKuDxC-9;J9L}?_^mZVqkJ?sOjb%*%B!tY#SMR9A&tfkE(|^SuipN zNd}udR8!L5t>jvB9G10M>iTh3i8?f?+81U%JrPt5TXmoS2r;d(75_KM8Kdr8CBQ8R z(M`WPm!@U|#U0Jmk1dzc0e!yDczR=*D>PtDq4yT3L@iB*mtST(6y(Bbi*OhRtG6C- z;hje^`m9xTNR7@#rgI!bC7OjhT!e`o28#`oHBp{b4y@wJ-`N?`W zY->6I8gWC|ScY5Y@}!NgtIvp-onj!NE)^IT;@&^y0Ef|Ki~I;GsFflkPGRnqwo3Py zvjrus)^MiG*FtD#FFSPxK27fGVQ~K_)Xns5njTT+Ehs4;kGQn*cHU>H$U?_-XepFp z+iTU&Oh`*%?@L|tl_DTUN-Edee~sK52UjXenYGohPA(%ODzr#{(|d$JL)}@O(l_{5 zmkEr%9lR#AhuoR(>TghP*~nT;*oL7nQK$!Li;_vZFy`H zI+gB77PhB<0!+?NsHM|(B(<;QanEU?8u`pra^?4j9OTloLf<=1`KQb^bg^d}3D>so zF_rTt5Rtp!Q`MiZFjbb2Np_`v+>mB-Z`(XQKGo~mV61U8$2d7Kxa3IO=a~Y~iC%vK zu6QDTxLb1SuxYMk6I8n|{@H`IF7qvc#4WJvE`AhIuS%G^9o?cM{ah;cE@Erzi}ZA1 zX&rpdI7JR)>I}`QvBikcM2KK&c%p-oMm<}g72@3VbXLJha&%^YWzxa+9Bf&~MqA>( zZKx+cFe8OWzMduM>=Z1?6{ExYNgsxHo>ylW)x|xXcP>ZaFtI)JwuZNMACL1)kM9(O zH!T0O!+NWd)1%QQnOle@R4$w9V!{fQM4>=!2pfHQt2}-Ht0ildQKHRp;`9CkBj(`A z>HtW%p4xx%7(ux#o}qY(HG51U23%bA6@Md%xtrfeV(`N)9zjEMz0~3zq0@H--(%Mf zJ2NoHy(14Z@M*Z$e2X`PFkKz94_*&LxxXf=uyv+1fTR#>J=8tOKh`s{1=7jw-Lu$} z1>F0HYd%oWV!50YC0LeO2;nX?PzhfZ(|EDSqXU1$%MG|m;je#XZ5Yn60v-N&%`EBd zvE4WrB0H)@tl-GnRApT4=Yq~`vXV1ydpt5J&An}3dVwA#%o2y`!s}Ev2q`MEvC=@C zt9oAv=+!S6BawCBA-$mc_xt5+oUmss#!fM9_?{eU^5-D$OMLh3e8gE7BLJTUzq*0e zO+Bu%?-y_j^4lh@*AZ?>qQOG17yLL(C|>_;-=ls`A@iJIZ7=wXK}n5poUbwo|1u{z zLNL8-f~io7O0e)qaqR#Z^EVgp4Uq5FQs+jcE%LH-adC4!i{dP-oNDj0IsFg-y7^~% zw|qD?q20b$*SPeNB-MNDY28F)Ap+uoXtU8C78cO8@@I16E>xdyhc3+wIg_iTQ&j$( z!hN1h$c{_DA|eFUZ2UHf#JK&;ekxcmFokcL`}k{woPbJ*QOl*2c`e}%3IAm`)Zto5 z{WNsVu1*&0Xi7Hze<3p7X;d=c@GhFZn)4OfS>`IWmn&iv#=(df-@5O(vc+W3pjkFa zCQl%{xh&?&la@^T88Aj9G0hB0VB5E>T4!j|T^fzm%xb?fr8_EVahs``W3W|lHxN50txTcc60ZB|@TAqm1OLHs zUmhX{CLz*o69dA>4fe&O2aUTl>s(An}S zk@KODy{;72x@_GbOj?ye;)Fm?tyh9ueAiWJn+y{;v7ghG7FScoVDn>Be@`4-O-bTi zGV4=*T+@9D^Ei}Ek|ixkDx=KnzY&f$(V1(~9rfD z1kM4}&DP+JZvjv-YWYrB@iCVqY{5TMh~?(XY=bentP6*a<5zzr&K=SaKmB}8hP^ya2O_~K^$x6b8qzFEP2FZk@pdVtbrynGJxTVOHn ziXj*0b~tP#Aa@m>0&fx~g8F5^Z@*Zxsd^H~3j$x|z9h=-{k?{Mk*q{a$X|<79yT;@ zb3{zuGWAvW?Dc{Vr;FgMS2#0)nQ_DToI+dl5^hr{+IhQm zMcpqeEg-Y3X(x)tIgJLn&z$T_TR-j`%)oqhwOMo!lWT+7GSz0mUeOL*c7>@2sSk&d zD9sA*jmEJN#ccqN0+IV-WS^%*c8AodYfqJE7=k!hnyY>9^BVCJc7FU|e&1&Zb54HczhXQaD zu(g>XbVTNF8R5aLPO#7QLei&}PgmnwixT)1Z4T?$>UN}kAl1CZKWJz>Z+`C%|5Gw> zlQe5pZ^Y)oez|&n`JtCM6@L81F7%g#uvYYr>vkd77kVT3OP|=8Y$LJg0%v`^3TrQh z1Cw-rm5wFg9{D(@=REyvYBOYQEv`4dBU-l)VG1Z?zcz8jn$uDwTU%H8tQrs{5?3&3 zFJ0KKIRpoR`B?Ifpe^^{2vmg7N+pmh^?`d~>WJqZs?nsYrHw#Xh0>n*g-89O-Ai|Y zwe16sfS+B44Jzqh>cA)Mfuao;v-07l-VgIcelJTI*P#T7KbgTh^QbANUz5yU#eZyP zxN>{b2HOLVR^XL~y}j{GcuVMn<&BR*{);`H5RGB|j~&j$E*00x4BnGE6}s+xHqs;K zDAc@jO`bLLEglPfD>yQZZ9cGiy%-o)AjNd z@NH7WsnEb;EZMZ_TX$mdFH0OL%#`82EJDtdo7{d)a~RcY5yk?GPABBy61pJ~gjM-U z?3i+D4EI~@izBuowv}18Wb5PIaqrGWl}ndIXlQZ@oQei`^Hqvz5U@l%0z2Vo027HLdXD(r{&} zJdXy2KWWm*#c9M@;(x$khgj>o$tprs#xaRLx&3emKe=rf4OBFXn`*`{;V0jeIdUP@ zW4`h?)yWT?o^rj*7NO?Si~=UcherTJW9g zYwPv<`fA&^L_eAvi}lhK0PBp+cgQQYj#_rJ#88$Z92gGNy*BH9iDoSEd7D|G=hnXv zyU%E})kz?67>|i6gVkETD>`sHQAqdUU)C~774&mLfi(kpH#LZ{}} z6z%!`$Z_S9?xi%V=+oONig9-1b*}Co!W#97U4j;&DZ{IYnaZrbl>f|Hoxf(Sk)mL# znrKzB7`&rRjGRkvlOiboG$F!4m^1o$sydMl?AE;MD(gW^W;SZDW+0lV#$_*=mG~Sk zBOT*X@IVVsHtY{>CY|ra-@nXP3Ka-XEB%B(YG9*)b_GlGOpmkazz+i1caU z6454#BUMnA`U36&V<$e7u@23nf%@egC~2^^j82rCHRd7x01YKa$@eA2{@xr0uMzRK z=Fxrmtv3S5DiCyHdXmqVMy*^>)ueUVdP}NNc&X%N{d8gTW`^gKw!$oFIB2PTw7!Ct z@B^>bF{G6w z!p3dzypzcL(y0%A(GErO>WwSomNh5!yGMd9*HbgjG)bg;KUw{j(b4_@%!cv~<#i2MW8aPO~h<%x18Yy8&q@c1@j8!(jB^Y23@ zy8@;f6k%9)3(@)rpWM-L0%DD%(fV{C0{O3OP<8p5t(BOXJoafR7W%G$I%s=DAgTma zCs4LzXq6CK&8(qnO*WXH+pXAP+B*CuV!FTLxLDD2FV>Zd zELWtsxRHgZb970>X7;ehnQ~<_v!+r@ql-Ia5YVZd4?acD&Tr4X1(Omz=a_zGPdi2RX6Kp*V*d5C;nrnb$t78+SxE z(ewGDk8$A}?W$DHPe}*%k(+dCU0c`3VxbM`X-0a59I~(Y z3Gu)vY^Sqwd@rHgL;L`rdYzy2U^i1sfyZ%7j+?CT@4#Y?*ll1@&zj3vT!~Ml#!MzB z?|CXAiMDkjaQ`449?R+?x70xpo9IyiluPwIQo>%K=5+WbUxqz+JD-Q26f79r*~kP? zm2p1tX@fE+SHzA!x`tTjGpS+)quDnx&ugh2362KS;yb)nR}!U68_zQ+7$2TsWRyvV1>C zP%0oYofuZFGQ=TG+0H^q<}l~@rnsbqVV^(~Qi~Vbf2<3KoM(kk;RdJu@U4r+Y)Ynh z#V+M|=s&3o^6c0rdy?QPk|?h*(U)nYxnX+d7peJ`K0Ks%^#=guDB8d{6Y8!`s_f5( zij9O0(>GfVE&c8~yYz*Un5SfrDR2a94%{L`vvOf9ou$0c@(8{b0cBCXkCki$7dc9|ok51&E z#TVjmo@upN_co&x@pLGkd;racf2F`Sc_x!8D6bql{;0c7cgzVWsuhy%4o`bx@izWt z>=eTE#IRZlb^YvM_kC@IXk>JKRJv|4P7QnG(UTkb?RG_e_hNXT+SOaOG4jz*dB^ht zVR5=wA~reSzknS(nl*P~ezM~sBZa+s>Rvo78gKskt|ocD|A?R0Cn9;eeYh!szr0!u zfFymgsY_mFEiLl5gvJ?;wRRI1oRp}6aFML-ZiPy;D>hf%5vJNW$3Z!CE@*P1n(C{2 zVLnE$dq=b57z248;C<~B>i=>S$h_K?1e-Vd&atfm^8B~Z*^tyN^q?p2J0|n}%#f2i zzO_V!YJGRCS;EF!irvwg8oMzu0Sfp+XpcAkb+Tn7=l zk>J{EtCW+QaS$GW$@bq*wOvpFJ5{dJ2(1(M#Zx6p?2>P8d4{W@LCLT4{&NiT&$P9d&qXy{4izJd}e z0C|W9Z&u!|L#3}Z#I6!(SNUbYeEu+fg7kF^*v#JN5IS2O@%~z%_k*eCO+~0^x`sY9 zXk?%nSev};xmYBbyV}$7D$|?kTm$4&umbN=aieT1Iwx);Ojg9abl+*I#||N#9u3qMn#j{#0^M0WEtR&1N?H}l zVtc3P$bvk;9UxqPyM3PB+gO_y9QbY-=m?I8H$KjNd^Hbw`g&eKMuk1tbsO-%$c+QHyBkHq`)fq1}03;RZAAaM(smaaSVom!)N|%3QeCe8)uR zTb2<{ai4r!Mg|pTUvi`f&1sPTZpiNB5{D8wc8=YHk$c5OVS5(?PtLhE=OG<&(*G56 z!nYM7sgDe<%&iBI`@eA zP{4itZH7l;8vRITD{E(C-1zzxP3&E?56E}PaHP~v&)x*tdsw;k;C2S`hNr<*o)n9G z{9K&$&QI-nLv%L`LK`WXC6a3zm-wJrk#4Mcw?1W^>~kp~pnVJN7y7+wPk>a}v_b)kuX|iW*PuRjKqFnF!XE|S zSMAyy@dK?vhy&LtZ!c$M4|V2VxRdH>%bP!m!{vq z1hdrvuBc21Bqzp5D%}(6ztIKPujz$Xg`Hv%+#nKvBx7ekOV27fQ!rvCKZ0sWCi}Sr zHEL@w7hk97d6z9JB7AD1v$Q}W+WIU()O)HS&{4vrL^7@GZSIquc` zw+76y>|nX@6$WNy5PpYEb_$ed$tc;0C!04HB(^c-IHRhEFWW{Lj3uZ{nKm)r4sU4I})a~d2D zns+MJ9qGHS?212>sPxR+QByQ@HEfsU{3~uAqpvbkvhj{{`WO}^d8=0Ga@#5h>t=ywetT`NxkN&)=(U{QE+IA3? ze_-kXc0QNL-u^(ej><<4qDcFwZ%J>;_~$tEADHCnAfmh+HQaR z5P>20x#!@u#;a8`OvKBN7PK*&$Hql0yd=-6amB#Y&-(6nh_3?VJ0X9-egMw=Tg^Z0 zYGN}Bvr&}7r3E(Mt`RelXS+vaJzqzc*_;@Og$%CA%&uinZt^MEN1jQGU$@C0A;;LY zX*-+TF$%w|49dj~+AMtG)T@7j3(Y!j)jgTJPgY{*DOD)JA)V4C%NapDss(UcKgkV8 zQB~c0LmT}MkS}Nw8agUH_rrA&Vd_9chy_X-#>&F~XJTi5U8!!gQz^-b3}?g&_Qhnb zX+691E82;AABIW7y6=_>${$I?ig;$?LxS^}Tx_CAF{jUylfJq5uJi_)-PBT!ac9Ln z^sw+H#nWRbK#ertn#-X$xEnx<+diLF>f1~ZMKnqM=q(xwz``ZD;8m>l?o1}Zk% z;T-fbr{%D+oFagAXf!=5;R^KoKkh1|)Gv2cs;a0X`qhk=K6Sv)>-P5Kzt=c%822(^ zk6=-wI}hc#O5Swm*rZRz`Yb+7w8k#*Jp9DR4CGcS`K7K<EVK{8Us6dd1l}F*0o9&j`dG~n1S9;Y z8tC=#2(mvo;@J^DdP6afcpGr1LUTsF?$mSu8_lzg4Jnw&S?Qo)hIwM(hr~u^sn2S6pGrWEGiIjm( zo;O{S@}}9E1IQb!lRYp$Z_>%j>|h`k{cmefdxVc@x8Bz7)YRHS{l{J@4v1=^vuk~Hov%gy^|9tK;Cahz&IRu7Iq(o4$v)CeSj^W_&n`z(mWb^ z{9kVIvTpBSV%viVCer!s{k{*6(Mu8|s2_UBHhx71RK=Dzuo)^rk8hJOH%4-)(^vz3E zouJR%A%9pc>yWI?86k;y4|&*TyLripTb&U{KS@s9vzK>C%nkCf(P)^_oMRNGaeOA3mcG9 zch+s^ww}4S^`f&KF(6B_`y65GrjXuWG*|zci}MNK|JP0<^f>|dA4+p8nApLto7WD^ z4VRqlyr<5&f~;P!*UYV|j>hS$#=riWFp(5=GVRA&a3WZ!vhQlMeV9gq>8_cCP3`Mr za^G_s`d0k&@sV-X!@V%fvn{)Bn}NB}Zo>vCi@qF`tMdu!!b8xO7J=o(%*8^?PUAzi zzXvYIavk@vF=9?lp}ESv_r2l#a$F(kypNW5TcKHfTj4EWjI-r{St76s+{w-EW4jES zKK9hGJH~2sLqoG>Dl_o`Y&ereW&dIDj^jzVHQo{&Hg-f zt@xc_GHHb4;Ht|rh$Q4PDZI$tSbR~hdTgA2$N#=@v7a#vgytngl>kHSrOUvc%kJ~(Zx~@n*Q`o zyx5-MHT-BKp(I5BSBsF__o!G4h5k~QgeYN65)p=iN?RG8ml$=s4{lsJo~+8A6uUx(F^rC>AI})(vV(x&-05Q zVR4Cy8mO;9q;7y3BUl^7EH)b&o~8RcMC^WD43EI(wkPdY%OodZE`p zlF|?@YiE(NyMA^b?StB6z9d`PKCiHXQgK$~f-h^yrOK_4l+VH?#Rlcgr~EH!?z}KN znf&WgOdm;z|8>an={c2IKowLt7C>12g>e4>+d$#xU+(2C)tajZVjejSUkZ%=MfIJ3 zyy6$amMZq8n^E!Q1&nd2mGD2AxCVe2z>Q_m=Z25#jxC9wOOg$Ruq49k;<84b1tZ8Y z$rm6uj{+j>Q7Ym!E`BdYaUUh6PwcKWqr1zcSTlRuDuK*RSEvZ*syy2rTpt-7_Bsk( zdMvB29M@2KGE!QD)*Z^H3C=m_cHSqXrtP=C{iwRK-l2^?igJ*Z>jj0F$d7BTZ&V~7bRJ}M zD@ZQK`vK0pt<$@M_mbz&)IGr)%FLhxv4IOcenO2KgEpg;T$z4wKXFq4P+9^1uk1u= zDud9>3IR$d4aM=k9M@gCy)E zYSCGncl5Gm{kTv?ama0h=W!mnFr>qf^)h?3bArRq7y15=v;8tjPvWJcIK(%!uUgZ2 zNt(RjIWxyPvjLu>B`)U0GSGAxVWfXV6WN-&`^*keBaXRil2gV^%3L8u6;HxM1Pm(K z^x*N_`tp36!1i1YOkOF>(U#vr-$25MIMw#%y-Xb~eH~>uL89LuV6$F~@gF}t!m?|) z^dCusmBmaBG^a?9tJgMP5anj2y6mp^C`-pZlHt$8lMPm-N9@JDbxWmY7F}Bamg+57}!hCJ~EmKt$ zR$wJjFvmQe@s+Q?(n}(m2O4q1LLXe$pr433(?+ZqlbflvEry-hrMCUx!{wtK1x0&iR?DgNP!OFnhhd zauoH;5|{8b8hnf+_Aj6_I&rR4BIgIXiKUkNjz#cpFbM}9_3@hIb#pRCawsTsEEVWy&i`Z@_ zj%+hx_NXy-=@e3cLCs+T3F;BB<4i)zTs@=Zy#2JtacRC696j5JEV7&K=HNNfrxj88vpaU)ii0>^xnRRrO+)Qa)(BoBP70Kdh+hKUnJrYWyz0V z`PZ0``oz z`3n#93Zg3?`jatyA&6H^5Nmvhz6`EpAG6U>wmQbmvSECh4N$bTzsCMtI4~ADo#4*I_wsxFbucDy$xyv;dFq;LRF7X2XVUu&V;@ZJmb>8B)XyQq zcFCm19bQV85VGe4D@zK&S~F}=!&y(zRjp-iKT!nATzs9S+e3IQ#y8tB;;~ciIl}Q# z_fa38ga6KoyK-z=F(_SUnkKZuqW{vKGX@S5*7cqKGmHw7K9I25k;FXP+Z8&bfoPdX z#|u#?oUiea<(=x8mTjt<;vsHGkm)up-EW*wXxds{lg_SdnDZtPCptXN&MtC#T_CJK z+BPV)KW9d*>wG$MZtGdCnL=E`M=;~5S5ecN zGisrF@5a&RpZ6$;Z>ul420KA&VKNCG4sGks>3XbJD!Kg5eY_WXY@mn?(~s=jHjUxj z!p}unLn7NEr50jMOOov9z!5MHbc=v)3wOwXM&uE=P)Tl$?5{ArRz=O*x_CUe;@QvO zfmQX~*2`809)S7n<_~+~QpXV)t=+`=DjxJL`?xl?`XmUFB6c2LJHIQ04$x_R(`m?{ zzY7PQ5H^rnFEEsm5lX`#Wy5zyelk~#(o-vkI25NoVGctvJp2eo>UR-NKl7Zg{)ZhU za=B$ki=Nz(5bxGM<*Tl&vdNf*Vcv{Wyx(m7@wdh42(;N4bD|{U&YbfUeSEmpc^d1z zDv}n_;k`Xa*#1CN<7(^Wz>FR2-mq=TFLPAr$_3T6c8k^HWfM{4GovYbCIi7lc?zcdxLY^uKDl^)|ks0-em)xp)1Q6tt*EfPp&m@ zyo0)#Inj@2chGBQ$Qw}2h1X}7#!C|VY0}4>K+Pbhv#8z*l?i7PdG(VpPP^L(QGEK3 z0iPSg$A#?yGQR^!mO4I)e6Kw&R0g$cYF(4g2Y&4B*H%}gkrm6>r+I8;3z5mp<78u` zxX}EnIE4Z~B^Ehc+|FuTcd){f?H?i!z2~Zx+JMFUVlTKup|IBdo4Ojl)^I*Upr}&X zjr{rmQFrS^h~o}vAB$$dAh+Q2t94bGr9#AghNsUV>^OqbG!Z*MjgsH1>+g^Bs z#CdZ?HsM!gj`oZWGmr8*qWiuLZVTcNK}%Ljw4EN@Wrj5+nj3DRk2}$CY`LwP)SN-z zYMM;_Hh@6qYEHS)B|iI-uhaawrt^V6Z9Qo8ptTnNDVhO$RidCoTe@62*|9!dr`d?l zWuz|@s6h0(76-TKh`lL`KI?|#DbGvPo;+3q-#DnCbAI1|YyAZbj&xS7{U(t+(wus? zFbAkagmDl)d?`0CArH(?k4WU*5y2WlQ(c?}UGsNQY{kc7GZi17m;)+N@mq52de*F- zGv=FNh$bg`M^rM2gT3{ginmv*YCUb&QkSLs>TC^K?{{&EbsyhakLz>4QZ0tD zqPK|J9iH)vLvZcW`v}R!m0|a0=xc<6kvCzqb5X86PKI5gz;bi3mAV1@RVV<7HSy~S z8vk{C6OLhI;tPXwZ6%lGyr`$C!|W}|xsw}s~3=Hc8np>1pTM1~@i`;N?qAmhUq zIiYjESZmE`<)&(8lMZU1W6g+POW;B?OW+g1ZAJ@l>KVAFgeg&x zXwuxK+0nR6#T^S1Z^VBcLnAItpyHJF0G5xi7r=athDJQBNl;c0hG7i1KYIb3GVo*l zX1X_?<=4><+{aCSoeOu+Z+rF&Nr0yLH?z&{dnP~r@9_V+1*iL}xw-i+VdnrmxqmzE@1PAURbj}+I2r&g OXwu^HV#Oi`pZ*_8zdV5e literal 0 HcmV?d00001 diff --git a/docs/experiment-b7-cookie-secret-rotation.md b/docs/experiment-b7-cookie-secret-rotation.md new file mode 100644 index 0000000..8319083 --- /dev/null +++ b/docs/experiment-b7-cookie-secret-rotation.md @@ -0,0 +1,250 @@ +# B-7 — oauth2-proxy 의 cookie secret 을 교체하면 → Q1 미지수 7 + +브랜치 `feature/keycloak-b7-cookie-secret-rotation` · +증거 [`docs/evidence/b7-cookie-secret/`](evidence/b7-cookie-secret/) · +2026-09-04 16:00–16:15 KST + +선행: [`B-6`](experiment-b6-key-rotation.md) — 같은 "key 회전" 주제의 다른 사례 + +**대응 질문** — Q1 미지수 7 +> *"OAuth2-Proxy 구조의 replica 들이 같은 cookie secret 을 어떻게 공유하고 +> 교체하게 되는가. 교체하는 동안 로그인해 있던 사람은 어떻게 되는가."* + +--- + +## 0. 결론부터 + +| 물음 | 답 | +|---|---| +| replica 가 secret 을 어떻게 공유하는가 | **같은 k8s Secret 을 읽는다.** 그러면 **콜백이 다른 replica 로 가도 된다** | +| 겹침 구간을 만들 수 있는가 | **★ 없다.** `--cookie-secret` 은 **단수**다 | +| 교체하면 로그인한 사람은 | **쿠키가 무효가 된다.** SSO 가 살아 있으면 재로그인이 조용히 일어난다 | +| **서버 쪽 세션은** | **★ 고아로 남는다.** 티켓을 못 풀어 지우지도 못한다 | + +--- + +## 1. BFF 와 정반대의 성질 + +B-0 에서 **BFF 는 replica 2개면 로그인 자체가 실패**했다. 인가 요청이 +인스턴스 메모리에 있어 콜백이 다른 인스턴스로 가면 못 찾기 때문이다. + +oauth2-proxy 는 그렇지 않았다. + +``` +--- replica 8p5hl --- +[oauthproxy.go:1024] No valid authentication in request. Initiating login. +GET "/api/echo" ← 흐름을 시작한 replica + +--- replica b9928 --- +[AuthSuccess] Authenticated via OAuth2: Session{email:labuser@example.com ...} +GET "/oauth2/callback?state=..." ← 콜백을 받은 replica +``` + +**시작한 replica 와 콜백을 처리한 replica 가 다른데도 성공했다.** + +| 왜 | | +|---|---| +| BFF | 인가 요청을 **HttpSession**(인스턴스 메모리)에 둔다 | +| oauth2-proxy | 인가 요청(state, CSRF)을 **쿠키**에 두고 **secret 으로 서명**한다 | + +**secret 만 같으면 어느 replica 든 그 쿠키를 검증할 수 있다.** +이것이 Q1 이 물은 "어떻게 공유하는가" 의 답이다 — **공유할 상태가 없고, +공유할 것은 secret 하나뿐이다.** + +--- + +## 2. 문제 — 큰 쿠키가 프록시를 넘지 못했다 + +처음 구성에서 콜백이 계속 **502** 였다. + +``` +GET /oauth2/callback?state=...&code=... → 502 Bad Gateway +``` + +**계층을 분리해 원인을 좁혔다.** + +```bash +# Traefik 직접 (nginx 우회) +curl -H "Host: app2.hyeonworks.com" http://192.168.122.11/ping → 200 +curl -H "Host: app2.hyeonworks.com" http://192.168.122.11/ → 302 +``` + +**Traefik 은 정상이고 nginx 가 502 를 낸다.** 그리고 502 는 **쿠키를 설정하는 +응답에서만** 났다. + +**진단** — oauth2-proxy 는 기본적으로 **세션 전체를 쿠키에 담는다.** +그 `Set-Cookie` 가 nginx 의 `proxy_buffer_size` 를 넘겼다. + +> **B-4 에서 본 헤더 크기 절벽이 이번에는 응답 쪽에서 나타났다.** +> 거기서는 요청 헤더가 8KB 에서 400 이 됐고, 여기서는 응답 헤더가 +> 프록시 버퍼를 넘겨 502 가 됐다. **같은 종류의 한계다.** + +### 그리고 여기서 환경 사실 하나를 발견했다 + +nginx 설정을 보려는 시도가 계속 **빈 결과**였다. + +``` +$ sudo -n true +sudo: a password is required +``` + +**test-server 의 sudo 는 비밀번호를 요구한다.** 게스트(kc-lab-1/2)는 무암호라 +A층에서 `conntrack`·`tc` 를 문제없이 썼는데, **호스트는 다르다.** + +> **앞선 "nginx 로그가 비어 있다" 는 관측은 로그가 없던 것이 아니라 +> sudo 가 조용히 실패한 것이었다.** A층 내내 만난 "조용한 실패" 유형이 +> 도구 자체에서 또 나왔다. + +### 해결 — 세션을 Redis 로 옮긴다 + +```yaml +- --session-store-type=redis +- --redis-connection-url=redis://redis.keycloak-lab.svc:6379 +``` + +``` +쿠키: _oauth2_proxy=djIuWDI5aGRYUm9NbDl3Y205NGVTMWlNall4TVRGbVltUXhabVJoWWpO...|1788500470|iPSRUlwHDB0XgC6sUdU4dq1EHq9WQDPYrDoezajKVUA= + └─ 세션 전체가 아니라 티켓이다 (약 180자) +``` + +**쿠키가 티켓으로 줄자 502 가 사라졌다.** + +``` +Redis: _oauth2_proxy-b26111fbd1fdab3ae2182e287001b02a +``` + +--- + +## 3. 동작 확인 — upstream 이 받는 것 + +![oauth2-proxy 로그인 성공](evidence/b7-cookie-secret/b7-oauth2proxy-login-success.png) + +```json +"x-forwarded-email" : [ "labuser@example.com" ], +"x-forwarded-preferred-username" : [ "labuser" ], +"x-forwarded-user" : [ "27df5ea9-8703-4ec5-badd-d972c583e1ff" ], +"x-forwarded-proto" : [ "https" ] +``` + +**B-4 에서 위조가 통한다고 측정한 바로 그 헤더**를 oauth2-proxy 가 붙인다. +Forward-Auth 구조의 신원 전달 방식이며, **B-4 의 결론이 그대로 적용된다** — +edge 가 붙인 것과 공격자가 보낸 것을 upstream 은 구별하지 못한다. + +--- + +## 4. ★ secret 교체 — 겹침 구간이 없다 + +```bash +kubectl -n keycloak-lab exec deploy/oauth2-proxy -- /bin/oauth2-proxy --help | grep cookie-secret +``` + +``` +--cookie-secret string the seed string for secure cookies (optionally base64 encoded) +``` + +**단수다.** `--cookie-secrets` 도 `--old-cookie-secret` 도 없다. + +> **B-6 에서 Keycloak 이 두 키를 동시에 들고 무중단 회전을 할 수 있었던 것과 +> 대비된다.** 거기서는 `kid` 로 여러 키를 구분했는데, **oauth2-proxy 의 쿠키에는 +> 그런 식별자가 없다.** +> +> **key 식별자가 없으면 회전에 겹침 구간을 만들 수 없다** — B-6 에서 +> "값과 함께 key 식별자를 저장해야 한다" 고 쓴 것의 반례다. + +### 교체하고 관찰했다 + +```bash +kubectl -n keycloak-lab patch deployment oauth2-proxy --type=json \ + -p '[{"op":"replace","path":"/spec/.../secretKeyRef/key","value":"COOKIE_SECRET_B"}]' +``` + +``` +[stored_session.go:94] Error loading cookied session: + session ticket cookie failed validation: , removing session +[stored_session.go:97] Error removing session: + error decoding ticket to clear session: session ticket cookie failed validation +[oauthproxy.go:1024] No valid authentication in request. Initiating login. +... +[AuthSuccess] Authenticated via OAuth2: Session{email:labuser@example.com ...} +``` + +| 관찰 | | +|---|---| +| 옛 쿠키 | **검증 실패** — `session ticket cookie failed validation` | +| 사용자 경험 | **Keycloak SSO 가 살아 있어 조용히 재로그인**됐다. 로그인 화면을 안 봤다 | +| **서버 쪽 세션** | **★ 지우지 못했다** | + +### 고아 세션이 남는다 + +``` +_oauth2_proxy-978dfaefbdadccb96c7be1625dba5616 ← 새 세션 +_oauth2_proxy-b26111fbd1fdab3ae2182e287001b02a ← ★ 옛 세션. 남아 있다 +총: 2 개 +``` + +**`Error removing session: error decoding ticket to clear session`** + +정리하려면 **티켓에서 Redis 키를 계산해야 하는데, 그 티켓을 못 푼다.** +그래서 **지울 수도 없다.** + +``` + secret 교체 + └─ 옛 티켓을 못 푼다 + ├─ 사용자는 재로그인 (SSO 가 있으면 조용히) + └─ ★ 서버 세션은 TTL 만료까지 고아로 남는다 +``` + +**로그인한 사용자 수만큼 고아가 생긴다.** TTL(여기서는 1시간)이 지나야 사라진다. + +--- + +## 5. Q1 미지수 7 에 대한 답 + +| 물음 | 답 | +|---|---| +| **어떻게 공유하는가** | 같은 k8s Secret 을 모든 replica 가 읽는다. 상태를 공유할 필요가 없다 | +| **어떻게 교체하는가** | **무중단 교체 수단이 없다.** 옵션이 단수이므로 한 번에 바뀐다 | +| **교체 중 로그인한 사람은** | 쿠키가 무효가 된다. **IdP SSO 가 살아 있으면 눈에 안 띄고, 없으면 전원 로그인 화면** | +| (추가로 드러난 것) | **서버 세션이 고아로 남는다** | + +### 그래서 무엇을 해야 하는가 + +| | | +|---|---| +| 교체 시점 | **트래픽이 적은 시간.** 전원이 한 번씩 재인증을 거친다 | +| IdP SSO 유지 | SSO 세션이 살아 있으면 **사용자에게 안 보인다** — 이것이 실질적 완충재다 | +| 고아 정리 | TTL 에 의존하거나 **교체 전에 Redis 를 비운다** (어차피 다 무효다) | +| 근본 | 쿠키에 **key 식별자**가 있어야 겹침이 가능하다 — 지금 구현엔 없다 | + +--- + +## 6. 재현 절차 (명령어) + +```bash +# 1. 배포 (Redis 세션 저장소로 — 쿠키가 크면 프록시에서 502) +kubectl apply -f deploy/lab/k8s/b7-oauth2-proxy.yaml + +# 2. 502 가 나면 계층을 분리한다 +curl -H "Host: app2.hyeonworks.com" http:///ping # Traefik 직접 + +# 3. 겹침 가능 여부 — 옵션이 단수인지 확인 +kubectl -n keycloak-lab exec deploy/oauth2-proxy -- /bin/oauth2-proxy --help | grep cookie-secret + +# 4. 교체 +kubectl -n keycloak-lab patch deployment oauth2-proxy --type=json \ + -p '[{"op":"replace","path":"/spec/template/spec/containers/0/env/1/valueFrom/secretKeyRef/key","value":"COOKIE_SECRET_B"}]' + +# 5. 무슨 일이 났는지 — 로그와 Redis 를 함께 본다 +kubectl -n keycloak-lab logs deploy/oauth2-proxy | grep -i "stored_session" +kubectl -n keycloak-lab exec deploy/redis -- redis-cli --scan --pattern '_oauth2_proxy*' +``` + +--- + +## 7. 다음 실험에 남기는 것 + +| 실험 | 이 실험이 준 것 | +|---|---| +| **C-1** SSO | **app1(BFF) 과 app2(oauth2-proxy) 두 앱이 준비됐다.** 서로 다른 구조로 같은 IdP 를 쓴다 | +| **D-3** 비밀 관리 | cookie secret 이 k8s Secret 에 평문이다 | +| 운영 | secret 교체는 **무중단이 아니다.** 창을 고르고 고아를 정리한다 |