From 4a8fe58d49aced7d777efc849cd542c185f03a3f Mon Sep 17 00:00:00 2001 From: Bryan Bell-Smith Date: Mon, 26 Jan 2026 13:18:50 -0500 Subject: [PATCH 01/14] Initial attempt to replace nginx with haproxy for ingress. Removed chart dependencies. Updated Readme. Simplified values file. Removed cert-manager namespace. Updated self-signed test conditions. --- Chart.yaml | 12 ----- README.md | 45 +++++++++++++++++-- .../cert-manager/cert-manager-namespace.yaml | 6 --- .../cert-manager/self-signed-certificate.yaml | 2 +- .../self-signed-cluster-issuer.yaml | 2 +- values.yaml | 36 ++------------- 6 files changed, 46 insertions(+), 57 deletions(-) delete mode 100644 templates/cert-manager/cert-manager-namespace.yaml diff --git a/Chart.yaml b/Chart.yaml index 81c50e8..0e635b7 100644 --- a/Chart.yaml +++ b/Chart.yaml @@ -9,15 +9,3 @@ version: 1.5.0 appVersion: "4.2.2-cpu" icon: https://cdn.prod.website-files.com/6682257d9fc729d59a7f121b/66cba74e2ef9cbe1c20e261c_favicon.png - -dependencies: - - name: cert-manager - repository: oci://quay.io/jetstack/charts - version: v1.18.2 - alias: certmanager - condition: certmanager.enabled - - name: ingress-nginx - repository: https://kubernetes.github.io/ingress-nginx - version: 4.14.1 - alias: ingressnginx - condition: ingressnginx.enabled diff --git a/README.md b/README.md index d1cbb9f..f696eef 100644 --- a/README.md +++ b/README.md @@ -64,14 +64,50 @@ helm uninstall --namespace private-ai private-ai To customize your deployment, enable different sections of your values.yaml file as per the documentation below. ### Ingress Controller -If you would like to set up an external ingress to enable external traffic to reach your the Private AI deployment, you must enable the ingress-nginx and cert-manager helm charts in the values.yaml file. Additionally, a sample ingress deployment file is included, and can be deployed with self-signed certificates for testing. +If you would like to set up an external ingress to enable external traffic to reach your the Private AI deployment, you must enable the haproxy-ingress and cert-manager helm charts in the values.yaml file. Additionally, a sample ingress deployment file is included, and can be deployed with self-signed certificates for testing. -If you would like to deploy your own certificate issuer and certificates, please see the [cert-manager docs](https://cert-manager.io/docs/) +If you would like to deploy your own certificate issuer and certificates, please see the [cert-manager docs](https://cert-manager.io/docs/). -The ingress-nginx configuration required to host a certificate and manage incoming traffic from the ingress to the Private AI deployment is included with the chart. For more advanced configuration, please see the [ingress-nginx docs](https://github.com/kubernetes/ingress-nginx) +The haproxy-ingress configuration required to host a certificate and manage incoming traffic from the ingress to the Private AI deployment is included with the chart. For more advanced configuration, please see the [haproxy-ingress docs](https://haproxy-ingress.github.io/docs/getting-started/). + +Note: The haproxy-ingress and cert-manager helm charts are not listed as dependencies in this chart, and must be installed separately prior to installation. + +```console +# Create a namespaces in your cluster for the cert-manager and ingress-nginx (private-ai) deployment +kubectl create namespace cert-manager +kubectl create namespace haproxy-ingress + +# Upgrade or install cert-manager into the cluster +helm upgrade --install \ + cert-manager oci://quay.io/jetstack/charts/cert-manager \ + --version v1.19.2 \ + --namespace cert-manager \ + --set crds.enabled=true \ + --set clusterResourceNamespace=private-ai \ + --set webhook.hostNetwork=true \ + --set webhook.securePort=10255 + +# Required webhook settings if deploying to AWS with the VPC-CNI plugin +# --set webhook.hostNetwork=true \ +# --set webhook.securePort=10255 + +# Add haproxy-ingress repo +helm repo add haproxy-ingress https://haproxy-ingress.github.io/charts +helm repo update + +# Upgrade or install ingress-nginx into the cluster +helm upgrade --install \ + haproxy-ingress haproxy-ingress/haproxy-ingress \ + --namespace haproxy-ingress \ + --set controller.ingressClassResource.enabled=true + +# Update your values.custom.yaml file with the appropriate values under certmanager, haproxy, and ingress +``` ### External Secrets Operator -If you would like to store you license file and docker credentials in an external secret store, you can use the External Secrets Operator helm chart. Note: The External Secrets chart is not listed as a dependency in this chart, and must be installed separately prior to installation. +If you would like to store you license file and docker credentials in an external secret store, you can use the External Secrets Operator helm chart. + +Note: The External Secrets chart is not listed as a dependency in this chart, and must be installed separately prior to installation. ```console # Create a namespace in your cluster for the private-ai deployment @@ -86,6 +122,7 @@ helm -n private-ai upgrade --install external-secrets external-secrets/external- # Create two secrets, one for the license file and one for the docker credentials, in your external secret store of choice ``` + #### Example AWS secret for Private AI license file ![license-type](./images/license-type.png) ![license-name](./images/license-name.png) diff --git a/templates/cert-manager/cert-manager-namespace.yaml b/templates/cert-manager/cert-manager-namespace.yaml deleted file mode 100644 index f69de05..0000000 --- a/templates/cert-manager/cert-manager-namespace.yaml +++ /dev/null @@ -1,6 +0,0 @@ -{{- if .Values.certmanager.enabled }} -apiVersion: v1 -kind: Namespace -metadata: - name: cert-manager -{{- end }} diff --git a/templates/cert-manager/self-signed-certificate.yaml b/templates/cert-manager/self-signed-certificate.yaml index d27ee70..26a1e87 100644 --- a/templates/cert-manager/self-signed-certificate.yaml +++ b/templates/cert-manager/self-signed-certificate.yaml @@ -1,4 +1,4 @@ -{{- if and .Values.certmanager.enabled .Values.ingress.selfsigned }} +{{- if .Values.ingress.selfsigned }} apiVersion: cert-manager.io/v1 kind: Certificate metadata: diff --git a/templates/cert-manager/self-signed-cluster-issuer.yaml b/templates/cert-manager/self-signed-cluster-issuer.yaml index 49de054..55c45ab 100644 --- a/templates/cert-manager/self-signed-cluster-issuer.yaml +++ b/templates/cert-manager/self-signed-cluster-issuer.yaml @@ -1,4 +1,4 @@ -{{- if and .Values.certmanager.enabled .Values.ingress.selfsigned }} +{{- if .Values.ingress.selfsigned }} apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: diff --git a/values.yaml b/values.yaml index 5a50db7..006d862 100644 --- a/values.yaml +++ b/values.yaml @@ -177,43 +177,13 @@ secrets: # - name: "PAI_AZ_COMPUTER_VISION_KEY" # value: "keyvalue" -# Configuration for the cert-manager subchart -certmanager: - enabled: false - namespace: "cert-manager" - clusterResourceNamespace: "private-ai" - crds: - enabled: true - # Change keep flag to false if you would like helm to remove the cert-manager CRDs on uninstall - keep: true - # Required webhook settings if deploying to AWS with the VPC-CNI pluggin - # webhook: - # hostNetwork: true - # securePort: 10255 - -# Configuration for the ingress-nginx subchart -ingressnginx: - enabled: false - # Azure load balancer settings for the internal Private AI service - # controller: - # service: - # annotations: - # service.beta.kubernetes.io/azure-load-balancer-health-probe-request-path: "/healthz" - # externalTrafficPolicy: "Local" - # AWS load balancer setting for the internal Private AI service - # controller: - # service: - # internal: - # enabled: true - # annotations: - # service.beta.kubernetes.io/aws-load-balancer-scheme: "internal" # Specifies whether to deploy the kubernetes ingress -# Requires ingress-nginx and cert-manager to be installed +# Requires haproxy-ingress and cert-manager to be installed ingress: enabled: false - # Set the class to handle the ingress traffic. Default to nginx - ingressClassName: "nginx" + # Set the class to handle the ingress traffic. Default to haproxy + ingressClassName: "haproxy" # Set your own custom annotations annotations: {} # annotations: { From 7b187277672a7d2e6735c66a9271a892dc1fbd76 Mon Sep 17 00:00:00 2001 From: Bryan Bell-Smith Date: Tue, 27 Jan 2026 14:18:46 -0500 Subject: [PATCH 02/14] Remove lockfile, no more chart dependencies --- Chart.lock | 9 --------- 1 file changed, 9 deletions(-) delete mode 100644 Chart.lock diff --git a/Chart.lock b/Chart.lock deleted file mode 100644 index 48e531c..0000000 --- a/Chart.lock +++ /dev/null @@ -1,9 +0,0 @@ -dependencies: -- name: cert-manager - repository: oci://quay.io/jetstack/charts - version: v1.18.2 -- name: ingress-nginx - repository: https://kubernetes.github.io/ingress-nginx - version: 4.14.1 -digest: sha256:f8512c0264b06e5018db22512d310bdf5a15935e5406d8d9c8b68483210173b7 -generated: "2026-01-26T15:28:53.199535-05:00" From 59748a84eeaef70671a0005e61b712535b09833e Mon Sep 17 00:00:00 2001 From: Bryan Bell-Smith Date: Tue, 27 Jan 2026 14:19:24 -0500 Subject: [PATCH 03/14] Minor reformat of the NOTES file. We should display the pod status instructions regardless of ingress or not --- templates/NOTES.txt | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/templates/NOTES.txt b/templates/NOTES.txt index e0dc352..48e6845 100644 --- a/templates/NOTES.txt +++ b/templates/NOTES.txt @@ -1,13 +1,14 @@ Successfully installed {{ .Release.Name }} version {{ .Chart.AppVersion }} -{{- if .Values.ingress.enabled }} -To test the ingress connectivity, run the following - curl {{ if .Values.ingress.selfsigned }}-k {{ end }}https://{{ .Values.ingress.host }}/ -{{- else if eq "LoadBalancer" .Values.service.type }} NOTE: It can take a few minutes to download and start the container. To get the status of the container, run the following kubectl --namespace {{ .Release.Namespace }} get pods +{{- if .Values.ingress.enabled }} +To test the ingress connectivity, run the following + curl {{ if .Values.ingress.selfsigned }}-k {{ end }}https://{{ .Values.ingress.host }}/ +{{- else if eq "LoadBalancer" .Values.service.type }} + NOTE: It may take a few minutes for the LoadBalancer IP to be available. To get the status of the load balancer, run the following kubectl --namespace {{ .Release.Namespace }} get service {{ include "private-ai.fullname" . }} From 61e989653a922eceaccb7028b4b8c54aa6685394 Mon Sep 17 00:00:00 2001 From: Bryan Bell-Smith Date: Tue, 27 Jan 2026 14:21:45 -0500 Subject: [PATCH 04/14] Cleanup values file adding more documentation, switching to yaml format for examples, switching to haproxy ingress example --- values.yaml | 44 +++++++++++++++++++++++++++++--------------- 1 file changed, 29 insertions(+), 15 deletions(-) diff --git a/values.yaml b/values.yaml index 006d862..a0b3548 100644 --- a/values.yaml +++ b/values.yaml @@ -19,20 +19,34 @@ gpuEnabled: false imagePullSecrets: name: "crprivateaiprod-creds" +# Override the default name of the application, used in the helper script to populate things like selector labels nameOverride: "" +# Override the full name of the application fullnameOverride: "" +# Add custom pod annotations to the deployment podAnnotations: {} +# Example annotations +# podAnnotations: +# annotation-key1: "annotation-value1" +# annotation-key2: "annotation-value1" +# Add kubrernetes service configuration for the deployment service: + # Set the type for the service type: "LoadBalancer" + # Set the port for the service port: 80 + # Set the target port for the deployment targetPort: 8080 + # Add custom annotations to the service annotations: {} # Set the Azure load balancer to be internal only, if you are planning to use an ingress to manage traffic - # annotations: { + # annotations: # service.beta.kubernetes.io/azure-load-balancer-internal: "true" - # } + # Set the AWS load balancer to be internal only, if you are planning to use an ingress to manage traffic + # annotations: + # service.beta.kubernetes.io/aws-load-balancer-scheme: "internal" # These are the values for liveness, startup and readiness probes. # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.26/#probe-v1-core @@ -113,7 +127,6 @@ topologySpreadConstraints: # topologyKey: "topology.kubernetes.io/zone" # whenUnsatisfiable: "ScheduleAnyway" - tolerations: enabled: false values: [] @@ -124,8 +137,6 @@ tolerations: # value: "private-ai" # effect: "NoSchedule" - - # There are the values for requests and limits # https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits limits: @@ -153,15 +164,17 @@ license: # If you use the External Secrets Operator, you can ignore this setting as the license file will be populated via a secret data: 'Override with your license data. See readme for more details' +# Enter any environment variables for your deployment. You can find the list at https://docs.private-ai.com/environment-variables/ envVars: [] - # Enter any environment variables for your deployment. You can find the list at https://docs.private-ai.com/environment-variables/ - # - name: "PAI_DISABLE_RAM_CHECK" - # value: "true" +# Example environment variables: +# envVars: +# - name: "PAI_DISABLE_RAM_CHECK" +# value: "true" # Configuration options for adding a kubernetes secret # This secret will be added to the environment variable for the Private AI deployment +# If you use the External Secrets Operator, this section will be ignored secrets: - # If you use the External Secrets Operator, this section will be ignored # Sets the name for the secrets name: "pai-secrets" # Add optional annotations for the deployment secret. For more details see https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ @@ -177,19 +190,20 @@ secrets: # - name: "PAI_AZ_COMPUTER_VISION_KEY" # value: "keyvalue" - # Specifies whether to deploy the kubernetes ingress # Requires haproxy-ingress and cert-manager to be installed ingress: + # Enable or disable the ingress configuration enabled: false # Set the class to handle the ingress traffic. Default to haproxy ingressClassName: "haproxy" - # Set your own custom annotations + # Set your own custom annotations, see https://www.haproxy.com/documentation/kubernetes-ingress/community/configuration-reference/ingress/ annotations: {} - # annotations: { - # alb.ingress.kubernetes.io/ip-address-type: "ipv4" - # } - # Provision selfsigned certificates by default. Change if you wish to customize + # Example to rate limit to 15 requests per minute + # annotations: + # haproxy.org/rate-limit-requests: 15 + # haproxy.org/rate-limit-period: "1m" + # Provision selfsigned certificates by default via cert-manager. Change if you wish to customize selfsigned: true # Replace this with the domain name for the ingress host: "ingress.domain.com" From dcc0fbaf34f659cf07170ff4962041d5e841d3ff Mon Sep 17 00:00:00 2001 From: Bryan Bell-Smith Date: Tue, 27 Jan 2026 15:10:47 -0500 Subject: [PATCH 05/14] Minor fix for default install without cert-manager, external secrets, or ingress --- templates/cert-manager/self-signed-certificate.yaml | 2 +- templates/cert-manager/self-signed-cluster-issuer.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/templates/cert-manager/self-signed-certificate.yaml b/templates/cert-manager/self-signed-certificate.yaml index 26a1e87..5ec0807 100644 --- a/templates/cert-manager/self-signed-certificate.yaml +++ b/templates/cert-manager/self-signed-certificate.yaml @@ -1,4 +1,4 @@ -{{- if .Values.ingress.selfsigned }} +{{- if and .Values.ingress.enabled .Values.ingress.selfsigned }} apiVersion: cert-manager.io/v1 kind: Certificate metadata: diff --git a/templates/cert-manager/self-signed-cluster-issuer.yaml b/templates/cert-manager/self-signed-cluster-issuer.yaml index 55c45ab..11d4ed5 100644 --- a/templates/cert-manager/self-signed-cluster-issuer.yaml +++ b/templates/cert-manager/self-signed-cluster-issuer.yaml @@ -1,4 +1,4 @@ -{{- if .Values.ingress.selfsigned }} +{{- if and .Values.ingress.enabled .Values.ingress.selfsigned }} apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: From d751021de519070f63be04a2e6f92c717f72e4c0 Mon Sep 17 00:00:00 2001 From: Bryan Bell-Smith Date: Tue, 27 Jan 2026 17:33:24 -0500 Subject: [PATCH 06/14] Fix for AWS internal load balancer --- values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/values.yaml b/values.yaml index a0b3548..289cacd 100644 --- a/values.yaml +++ b/values.yaml @@ -46,7 +46,7 @@ service: # service.beta.kubernetes.io/azure-load-balancer-internal: "true" # Set the AWS load balancer to be internal only, if you are planning to use an ingress to manage traffic # annotations: - # service.beta.kubernetes.io/aws-load-balancer-scheme: "internal" + # service.beta.kubernetes.io/aws-load-balancer-internal: "true" # These are the values for liveness, startup and readiness probes. # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.26/#probe-v1-core From 324af6f59dec4ea6830c2601bc7b042c7b0aa4c7 Mon Sep 17 00:00:00 2001 From: Bryan Bell-Smith Date: Tue, 27 Jan 2026 17:34:14 -0500 Subject: [PATCH 07/14] Many updates to the README to attempt to make the instructions clearer --- README.md | 63 +++++++++++++++++++++++++++++++------------------------ 1 file changed, 36 insertions(+), 27 deletions(-) diff --git a/README.md b/README.md index f696eef..6b57db8 100644 --- a/README.md +++ b/README.md @@ -37,11 +37,10 @@ license: # Upgrade or install the Private AI chart with a name and namespace of private-ai helm upgrade --install \ ---namespace private-ai \ -private-ai \ --f values.custom.yaml \ -oci://crprivateaiprod.azurecr.io/helm/private-ai \ ---version 1.5.0 + private-ai oci://crprivateaiprod.azurecr.io/helm/private-ai \ + --namespace private-ai \ + -f values.custom.yaml \ + --version 1.5.0 ``` ## Testing @@ -73,39 +72,48 @@ The haproxy-ingress configuration required to host a certificate and manage inco Note: The haproxy-ingress and cert-manager helm charts are not listed as dependencies in this chart, and must be installed separately prior to installation. ```console -# Create a namespaces in your cluster for the cert-manager and ingress-nginx (private-ai) deployment +# Create a namespaces in your cluster for the cert-manager chart kubectl create namespace cert-manager -kubectl create namespace haproxy-ingress -# Upgrade or install cert-manager into the cluster +# Upgrade or install cert-manager into the cluster with custom resource definitions helm upgrade --install \ cert-manager oci://quay.io/jetstack/charts/cert-manager \ - --version v1.19.2 \ --namespace cert-manager \ --set crds.enabled=true \ - --set clusterResourceNamespace=private-ai \ - --set webhook.hostNetwork=true \ - --set webhook.securePort=10255 + --set clusterResourceNamespace=private-ai # Required webhook settings if deploying to AWS with the VPC-CNI plugin # --set webhook.hostNetwork=true \ # --set webhook.securePort=10255 -# Add haproxy-ingress repo -helm repo add haproxy-ingress https://haproxy-ingress.github.io/charts -helm repo update +# Create a namespaces in your cluster for the haproxy-ingress chart +kubectl create namespace cert-manager -# Upgrade or install ingress-nginx into the cluster +# Upgrade or install haproxy-ingress into the cluster helm upgrade --install \ - haproxy-ingress haproxy-ingress/haproxy-ingress \ - --namespace haproxy-ingress \ - --set controller.ingressClassResource.enabled=true + haproxy-kubernetes-ingress oci://ghcr.io/haproxytech/helm-charts/kubernetes-ingress \ + --namespace haproxy-controller \ + --set controller.service.type=LoadBalancer + +# Required setting for AWS, see https://github.com/haproxytech/helm-charts/tree/main/kubernetes-ingress#installing-on-amazon-elastic-kubernetes-service-eks +# --set controller.service.enablePorts.quic=false + +# Required setting for Azure, see https://github.com/haproxytech/helm-charts/tree/main/kubernetes-ingress#installing-on-azure-managed-kubernetes-service-aks +# --set controller.service.annotations."service\.beta\.kubernetes\.io/azure-load-balancer-health-probe-request-path"=/healthz + -# Update your values.custom.yaml file with the appropriate values under certmanager, haproxy, and ingress +# Update your values.custom.yaml file with the appropriate values under ingress + +# Proceed with installing / upgrading private-ai via helm into the private-ai namespace +helm upgrade --install \ + private-ai oci://crprivateaiprod.azurecr.io/helm/private-ai \ + --namespace private-ai \ + -f values.custom.yaml \ + --version 1.5.0 ``` ### External Secrets Operator -If you would like to store you license file and docker credentials in an external secret store, you can use the External Secrets Operator helm chart. +If you would like to store you license file and docker credentials in an external secret store, you can use the External Secrets Operator helm chart. Please see the [external secrets operator docs](https://external-secrets.io/latest/). Note: The External Secrets chart is not listed as a dependency in this chart, and must be installed separately prior to installation. @@ -118,7 +126,9 @@ helm repo add external-secrets https://charts.external-secrets.io helm repo update # Upgrade or install the External Secrets operator into the private-ai namespace -helm -n private-ai upgrade --install external-secrets external-secrets/external-secrets +helm upgrade --install \ + external-secrets external-secrets/external-secrets \ + --namespace private-ai # Create two secrets, one for the license file and one for the docker credentials, in your external secret store of choice ``` @@ -173,9 +183,8 @@ externalsecrets: # Proceed with installing / upgrading private-ai via helm into the private-ai namespace helm upgrade --install \ ---namespace private-ai \ -private-ai \ --f values.custom.yaml \ -oci://crprivateaiprod.azurecr.io/helm/private-ai \ ---version 1.5.0 + private-ai oci://crprivateaiprod.azurecr.io/helm/private-ai \ + --namespace private-ai \ + -f values.custom.yaml \ + --version 1.5.0 ``` From 291d84f38417f96591dea8716906fb9cde3d4328 Mon Sep 17 00:00:00 2001 From: Bryan Bell-Smith Date: Thu, 5 Feb 2026 10:44:50 -0500 Subject: [PATCH 08/14] Missing refreshInterval for deployment secrets --- values.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/values.yaml b/values.yaml index 289cacd..711093f 100644 --- a/values.yaml +++ b/values.yaml @@ -258,6 +258,8 @@ externalsecrets: # annotations: # annotation-key1: "annotation-value1" # annotation-key2: "annotation-value2" + # Set the refresh interval to check for updated secrets + refreshInterval: "1h" # Enables or disables Private AI environment secrets enabled: false # This is the reference to the name of the secret from the secret store From 993ace5488582ba78d5f5f11d44a1c5ba1eb60b7 Mon Sep 17 00:00:00 2001 From: Bryan Bell-Smith Date: Thu, 5 Feb 2026 10:45:28 -0500 Subject: [PATCH 09/14] External secrets deployment secrets name pulling from incorrect value --- templates/external-secrets-operator/deploy-external-secret.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/external-secrets-operator/deploy-external-secret.yaml b/templates/external-secrets-operator/deploy-external-secret.yaml index 68b93dd..39d57ff 100644 --- a/templates/external-secrets-operator/deploy-external-secret.yaml +++ b/templates/external-secrets-operator/deploy-external-secret.yaml @@ -15,7 +15,7 @@ spec: kind: SecretStore refreshInterval: {{ .Values.externalsecrets.secrets.refreshInterval }} target: - name: {{ .Values.secrets.name }} + name: {{ .Values.externalsecrets.secrets.name }} dataFrom: - extract: key: {{ .Values.externalsecrets.secrets.remoteRefKey }} From 3ed993e5d64f97d47b5f5ca83194dd1a8b03ad58 Mon Sep 17 00:00:00 2001 From: Bryan Bell-Smith Date: Thu, 5 Feb 2026 11:50:33 -0500 Subject: [PATCH 10/14] Fixed hard-coded value for license property in ESO --- .../external-secrets-operator/license-external-secret.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/external-secrets-operator/license-external-secret.yaml b/templates/external-secrets-operator/license-external-secret.yaml index 23d0df3..c3cd988 100644 --- a/templates/external-secrets-operator/license-external-secret.yaml +++ b/templates/external-secrets-operator/license-external-secret.yaml @@ -20,5 +20,5 @@ spec: - secretKey: license.json remoteRef: key: {{ .Values.externalsecrets.license.remoteRefKey }} - property: license.json + property: {{ .Values.externalsecrets.license.licenseProperty }} {{- end }} From c37de1410bde247eefe4fd599bd4032fc32b9b9b Mon Sep 17 00:00:00 2001 From: Bryan Bell-Smith Date: Thu, 5 Feb 2026 11:51:11 -0500 Subject: [PATCH 11/14] Moved environment secrets enabled flag further up the block --- values.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/values.yaml b/values.yaml index 711093f..90b3fc8 100644 --- a/values.yaml +++ b/values.yaml @@ -252,6 +252,8 @@ externalsecrets: secrets: # Name of the externalsecret and secret objects for deployment name: "pai-secrets" + # Enables or disables Private AI environment secrets + enabled: false # Optional annotations for the deployment externalsecret and secret objects annotations: {} # Example annotations @@ -260,8 +262,6 @@ externalsecrets: # annotation-key2: "annotation-value2" # Set the refresh interval to check for updated secrets refreshInterval: "1h" - # Enables or disables Private AI environment secrets - enabled: false # This is the reference to the name of the secret from the secret store # All properties will be added from the secret in the secret store to the container environment variables remoteRefKey: "pai-secrets" From f0f49c51f89331bc0a0d44a895428e8004a81945 Mon Sep 17 00:00:00 2001 From: Bryan Bell-Smith Date: Thu, 5 Feb 2026 11:54:19 -0500 Subject: [PATCH 12/14] Added ESO instructions for Azure. Minor README typos and improvements. Renamed AWS images and added Azure images. --- README.md | 117 +++++++++++++++--- .../{docker-name.png => aws-docker-name.png} | Bin .../{docker-type.png => aws-docker-type.png} | Bin images/{env-name.png => aws-env-name.png} | Bin images/{env-type.png => aws-env-type.png} | Bin ...{license-name.png => aws-license-name.png} | Bin ...{license-type.png => aws-license-type.png} | Bin images/azure-docker-name.png | Bin 0 -> 38039 bytes images/azure-env-name.png | Bin 0 -> 36421 bytes images/azure-license-name.png | Bin 0 -> 36881 bytes 10 files changed, 103 insertions(+), 14 deletions(-) rename images/{docker-name.png => aws-docker-name.png} (100%) rename images/{docker-type.png => aws-docker-type.png} (100%) rename images/{env-name.png => aws-env-name.png} (100%) rename images/{env-type.png => aws-env-type.png} (100%) rename images/{license-name.png => aws-license-name.png} (100%) rename images/{license-type.png => aws-license-type.png} (100%) create mode 100644 images/azure-docker-name.png create mode 100644 images/azure-env-name.png create mode 100644 images/azure-license-name.png diff --git a/README.md b/README.md index 6b57db8..847e3aa 100644 --- a/README.md +++ b/README.md @@ -87,7 +87,7 @@ helm upgrade --install \ # --set webhook.securePort=10255 # Create a namespaces in your cluster for the haproxy-ingress chart -kubectl create namespace cert-manager +kubectl create namespace haproxy-controller # Upgrade or install haproxy-ingress into the cluster helm upgrade --install \ @@ -130,23 +130,24 @@ helm upgrade --install \ external-secrets external-secrets/external-secrets \ --namespace private-ai -# Create two secrets, one for the license file and one for the docker credentials, in your external secret store of choice +# Create two secrets, one for the license file and one for the docker credentials, in your external secret store of choice. You can optionally create a secret for environment variables to configure the Private AI container. ``` -#### Example AWS secret for Private AI license file -![license-type](./images/license-type.png) -![license-name](./images/license-name.png) -#### Example AWS secret for Private AI docker credentials -![docker-type](./images/docker-type.png) -![docker-name](./images/docker-name.png) -#### Example AWS secret for Private AI environment variables +#### AWS Secrets Manager Steps +Example AWS secret for Private AI license file +![license-type](./images/aws-license-type.png) +![license-name](./images/aws-license-name.png) +Example AWS secret for Private AI docker credentials +![docker-type](./images/aws-docker-type.png) +![docker-name](./images/aws-docker-name.png) +Example AWS secret for Private AI environment variables This is optional, and can be enabled or disabled in the values file. -![env-type](./images/env-type.png) -![env-name](./images/env-name.png) +![env-type](./images/aws-env-type.png) +![env-name](./images/aws-env-name.png) +Next, configure the AWS Secret Store. See [the AWS Secrets Manager docs](https://external-secrets.io/latest/provider/aws-secrets-manager/) for detailed instructions. ```console # Create a secret-store within the private-ai namespace -# See https://external-secrets.io/latest/api/secretstore/ for detailed instructions # Example AWS secret store based on access key: kubectl create secret -n private-ai generic awssm-secret --from-file=./access-key --from-file=./secret-access-key kubectl apply -f aws-secret-store.yaml @@ -174,9 +175,97 @@ spec: name: awssm-secret key: secret-access-key ``` +#### Azure Key Vault Steps +Note: Azure does not allow for multiple key-value pairs per secret entry. To match the data structure of the External Secrets Operator, each secret must be uploaded as a JSON object, with the key matching the property from the values file. + +Example Azure secret for Private AI license file +![license-name](./images/azure-license-name.png) +```json +{ + "license.json": { "id": 1, "tier": "..." } +} +``` +Example Azure secret for Private AI docker credentials +![docker-name](./images/azure-docker-name.png) +```json +{ + "server": "crprivateaiprod.azurecr.io", + "username": "docker-username", + "password": "docker-password" +} +``` +Example Azure secret for Private AI environment variables +This is optional, and can be enabled or disabled in the values file. +![env-name](./images/azure-env-name.png) +```json +{ + "PAI_AZ_COMPUTER_VISION_KEY": "secretvalue" +} +``` + +Next, configure the Azure Secret Store. See the [Azure Key Vault docs](https://external-secrets.io/latest/provider/azure-key-vault/) for more detailed instructions. + +You must configure access from the Secret Store object in kubernetes to the Azure Key Vault. In this example, we are using a workload identity federated with an OIDC provider in the kubernetes cluster, and a simple access policy on the key vault. See the [Azure Workload Identity docs](https://azure.github.io/azure-workload-identity/docs/quick-start.html) for more options. + +```console +# Set up your AKS cluster and resource group variables +export AKS_CLUSTER_NAME="yourcluster" +export RESOURCE_GROUP="yourresourcegroup" +export USER_ASSIGNED_IDENTITY_NAME="youridentityname" + +# Get the Key Vault URL +export KEY_VAULT_URL="$(az keyvault show --name $AKS_CLUSTER_NAME --query 'properties.vaultUri' -o tsv)" + +# Create a user-assigned managed identity if using user-assigned managed identity for this tutorial +az identity create --name $AKS_CLUSTER_NAME --resource-group $RESOURCE_GROUP + +# Create key vault policy for UAI +az keyvault set-policy --name $AKS_CLUSTER_NAME \ + --secret-permissions get \ + --object-id $(az identity show --name $AKS_CLUSTER_NAME --resource-group $RESOURCE_GROUP --query 'principalId' -o tsv) + +# Create kubernetes service account bound to UAI +export USER_ASSIGNED_IDENTITY_CLIENT_ID="$(az identity show --name $AKS_CLUSTER_NAME --resource-group $RESOURCE_GROUP --query 'clientId' -o tsv)" +export USER_ASSIGNED_IDENTITY_TENANT_ID="$(az identity show --name $AKS_CLUSTER_NAME --resource-group $RESOURCE_GROUP --query 'tenantId' -o tsv)" +cat <-YZgynnsN@pv4_F#EdpwfEZVT6?W?ool~)q#{dnf$9Pd4i1sLoRm5a z4qg!s&Y7(9_~4s$6Z{D9hYUf|MTPV!R3YYr2l0hm4<; zA3cMGn_WR#As<4dCLb0rn7Gu$T(EqzOyn2A?l4TeAX|K4q>T7eB8fydlRi0W&LS1j zT_5M>+I6qJdXo6Dg4S8_+%=)$fs}%h8WTM922V3dU%Rfe6e`DE;sPF_grp1A8+aOz9_7)6L^UmSYVE!|usmb8|Xwxms4 z;-~ig7<8W^!XSHXlumeIRkC4UMrG;k%q^Jx_j~fKRd>b@P*wel$^~zJki5BYyS4n< zEh#lkmJ9i6O;DeV&n$gP5hYDxHOsJ9=cDXHy_3?lVxASSn5*m*%iU;9nB>m6+q7@r zkG#z5YyypBerUW=Fpp}}W&8|(osQAw6{?#+u-ayi<)O;T zIIQ6Fd7LwEU^sZ-(;4tX1%7aF&W60kAppNg!H-lD?!Q~{ijvO$`}3KslM5v@B<1D7 zZw(WBGcy|p3tLBP{!vlT6%wZT*zvKll8}k5HOEs^TVpd0SLI0(6lF#L6e5cquZH75i8Uza$-MHn6{KcbhkwKt>Z=eWmlk3sYTJw5#cdsC>8 zx|GbnZU=vfFjzP`J`>{Pba8RvaN*&wwKwPF5)>5VyvNPS&CL$3V0Un{aeV5^ZsWlC zcPIbuN6O5>#2)s{5oT*cf70($V_PRj5e9~n2mR;Y-{UlMh5h$QHV*%q7MLLCNed?z z$34#f^bKx(aPqCtBbck1m97-b8i)rxLzI`B|G{6^|JL%~C;oEhlMuOw%OKJI;tV0~ zg*yZxw+TZe-jUv7e#byBr&pL#Y@x>7W1OzvmS6Q4O59e`paeyh0xpZe>G3BmH}yB;YRe zKf3zs&;RpXa)}}5`EAGVRynVRoF%y2yn{64Z1AIu6h>ET^rk9ChP-Zh{QDGqG}(d} zUg+{b+kC3zz1#U)%dppx9FUMe(S5lm zu2bjgeD2l|i5>k+=C$Y+FSQReUV(3R7& z40$h}6Rmq}P<;!Tq8P)KAIvD*TJLjKY;2E@4tq=BI)To$hr9X}=vwT9U4L2;Js=5F4D6oq*O!F7c@W`1 zp>b+T&L`Vdo!UxG)uVQ$$;rvm-o0r=){pK*)!s+gdn>m)zo>A&H^1O&BE*?yvZh@v z`_C2j`Az{wal0o{*mcVZ`MoNgQb~M%eQ|5UMwU8C$SF%!7**+1#Tt}K5yJ;(syjZa zx^$iU`yd^c@yqy#44+h_p*Q5{=QMHE@oc1F1ggrV4Kv|wn|^nR%Af>}EN$X_mNvia z*id)0uV_El&Z3p28LSY_D&G;qH(R-!SF|&BEa<+S(LtqO1oh7`tQ&_yPzVglS#5tX zSHF$DY|J?Ocz4uxbLtIUYXFU~K{}^FdH1fq%cX1g#O-IAr-b;eM|iJ`dX~$^V#Yo4 zHFNc}6e8{}W>JpDD#!8&`Xu&$72-^W{bV4pG4h>S+#TS%(g{FUS-#l+uzpl z3YSC}PP+$s`bQ&vd(%j$e0Z5m7ABsBqwyJ;bAkn{h}&NCW8}u~Zd|mWxL(|iU-U3I zS}XsF2vSJ*)kVsyL_t5&#em2jHeN~dLayk=4C3QtvM zgy?m(bY@GEHl55zA75Oe=2yzAn0xP!FE&yPV|+u5?X>8t56-Jg@wrCS{a~w|r#7Y( z3kEzBb9K1R+k0^!J946OWbQ2S_ktREe)A z?UC#%#`&xs@$15!dx3S$f5$EE9WMS?ju=KQ5v*L`wNW+eLy>qaWwj z?8Yo)YxL`%l~4ie9J7%ct+OUw)HGJ(wKq%YHXE)pmR&yn=0`2Qd!Pa3EYWWU^Hx-S zc!lnnC&rrrjD>p(*J00OFSCS+6nR$L=acj2?{t(ptoT{dfmmgGnGF5!BVLEU#9v?fWD_7Y|*)`^syP5-qFewZF)$TjiV^#sL{oId<^2 z{88<;H3QVYY-g@L+9Z8_@io-ldZHGUkgP$C-Ckr&^ggP{P4C06!>$QqpBz^_n|e{b z(MX+V-LbzkRFI4sEJ@gg1r(Wgm5vID*e`T{%&Q!?9rG1l+Wkf>R$kaT#*>K9)E;aGm^w&=l3D4%8jdG||e(H8E+yk}L<+6t|4nKU-*+t!%nXHO$D z7oZr?@IwFJwg^H-5>03XepcKkG++5FIof1xR3-jrZNdY$-sE==+%{dU z2#PkE83Ttd(K837S}!hHb&!fWN<@XL7XQ{lpbK6gdZ zmi1ubjVzTBI`j=S3D8@MF^^Q_BRS%UXaz_2@nne}?y(V3@jly8MG`yE?FC8SYz3Syst$SH))acoEM-9xU(c0Y#3*`R<_CDsxtaJ+XVPTp5dFi|OIo8k#6($ptW=l! z=pZXkilR$xP^?V>G@%(8cLFEl^Bqu_#UB`z9??ZA=-$?Rnct5{cKyLTR5%}8JN-S| zP`WTKjW5Ui+?rONfuN4ZzRX!mF0+rY_(v!mYrhx2E#*5-l6j+uP+000R`#{gHFUg* ziip0T)Uicujyz1pJYlAHEUq^8v7pRnffnu5O~# z5ZiXA%GjiA7jl^U&@s~sbJ$>!eor2(Dt6d!lFN#S`FQlPVFsaa%E>xx!)Is{1>VkN4V4j%{jF zx>7X5-sbF<)<8*@FjldPQ!^uIxxBV#CA&SEXEc%8wz`Kl_JLa=Ffr*AgE_hyHnn@u zilhDIRZYP_8Qh_62b3akMaBeHJrKsp9FFbYu*m}tr8~fOOWcNN1rh} zS+9qDeqSGkll8$*<8_@iHGq+{v2=2wO3&mScqq53GY8jkn%mVx@#SydhqPtV<|DzD zQu#u+GHM_AV$%iAVII?m9Wf78f~3!i6r3yEHh_f6r}x5=l>G3mEs=TF6HVKJMI=>& zZj(L)D`dyT?CexSJx+-~^c2GGObJO-ih1uZrb9;U+>+ssVDw!ql^F+HU1Dgf5!h=x zLg?ZA8p_ATIDXEv)oH1W!vMr9|lM-lM65nU|+=-{XZqb7i!Q(v7@cP% zTX@2Ihob!&w`sEx<%rA3(qL}v0;CT%^28Fm+KT9Uu zA=Vn{T9pJWis7uY8#8h`1fJD|bG4Q{Tqs8K5274R9RCcBNX~y0ry{d@7m!)gOb9pa zT>Dn|u|p(8ppDO&{Vox7QSWg~cC20u1bmaT*%nOE*iV~6(ki|@dMEC3rd~-F0)5o=N!o8FE!Kv#Bd*tOX2x+ecNRQefO5Rg^!5jAwmPT@HzCMfl&z&4%0fQwyl@ z8qI|9!g}x9&X$hagxc2b&1La@jJq&WH(ukRh}~TkNgEez(l4{I<_R~xUnAKUl!tFStrX&d-B7V_> z^>6&*Y1Xiw$t3*Cd`XLVg^u12$8@X(NJw27ShrFoVMIBZ{;mRM`7}m_lK@ zS|24R4Ax5WGhb4D?}feAtM-LNV(<^q!$sz+#Z{7TE)Qo~3)QG1As5Vg__DW!_Gjwh z`8E8FX-){{c>IiEWvWTS;swFV-AH^ho4P~iK&P@e{$gtgn_~K9OB}Ye`cQ`e%yLh% z>?+wMr+ov@`0W;7AcCU99;Hlig?lF5D|wJAXI+nu#}~EUwIK%J`1XMh2LwhWezOW} zxH{^gc`JS!@o?6uI#sTI*ej}`-gi#?%}zfjKCodvN4B_1#^GXP~-hz*wY3^&I4zlJ^gF;3+{}D$JiY z%(`<8_=BN1<5tLWK>|&FlOsu-c$_bAhGtF87H>PneAHNR{8q;k+b|w4QqAyBSmIU3I2U z_C!bM1z(m8L4l}cyUYLd(7-6g3n|Vk-(wrToEX6Phhf}eKJ!AiWznWb=QraaP9J`e zq+MaQ4(AfxKU@v)r<@Az8BUx!N87LoJCy5O)YvlS4#Dr>2DtLPzj*zZoI$ZXj7Nh< z9*PAsK8LyY|8wa(@tiL?Z^w{|QVGi@)sK(-n59%29>4PaP249_`L0htXf!yA8NY&+ z4!A+8d)0%_@;3zNFHzI^bl=5EO!oBLrw`#tm~TQa#r^KPpQjH}!h1;8-uq>I$M~7# zp!j1S`Yxii_i?X&^F2;3J=ZH08={0&Df?}&23o2fExy2Aq<;Ozw?Cmv=j(93V-k-28k`&M>{nUM;-`7f<{s0%R=&Nlf#h=Fd zf*f>u>qh#`Kd8q`!{QA%y3FQ51 zB984(FDV`i=v3~$isYYW@xP1szl-?4Z{qK7#{b2e*!$)<A0BknMtpn=_n$lKW*iy&+aSu0;SV`)o7{dJTtE3xrqC&U7?01W}Yz@|`x36y0dG_Gg4EEf>xawGudEoXMN|6InNxs0+ zFG(+b!D{HU1PDFmT&%Kn@*`?IF#942K?I~r4oo+(N~fVramy>`J?>?@70C@3n7ny| ze!a6i3qr!Jp?O=A#69~ell1w$qoqc(<0Ayt6u4`4g13_@smiGVD4xAmkSr@*_kHUn zE+wI@dS-naXU!euSl$SYbQQ?$_2v9J1=BtzZkv^%?0{D$vJVlRFO$&*rvVJPMck*v z&{W4q=nWWDK5z|nOGs#h_Wd2Thp#VPXT8pCx}Mj{kDI9?epWZ;+$`j^=T-@Zqx95j z`P{m_zOA9!3V@`uOQC~(`(fSZQ;3y$KEkDWBF5KxrS(cJZ;L5K(VrmtVeC382_9>L z6>~B0yvlCTP_>;7q~WN0#nw#3Tt}?paN(>~O+3?CtHBlBPr9@qJ`Zd3k8SP{n6L_5 z>~HijMBH8;%nkke>Z0QQ_7Mv&315rnRD!T=UfcsW_0}*J#$0_dMvx!5TGNP0u8kZi zS&q7tbKIg9>ZVntZ4K)$FR(&YY5|a2!=pxpMp&U@b2de3k-OAuzSDO2Fs6dfv6)17 zXOxwC(*5Vun^d*r#tw)@v>&dUp&8^%QiNE1vI6;8Sc=y~cS08ue#9 zk=(v^&S&PS2ME+m{yr@7IeIyC}TWP@_w-7=niPf=(;paAQe6V%6mBtdVDzJOcN zbZiJ8oF8lW;No0YWQRU~n=i5GoxlgZkMe4E^^i_(zNfbMpJV{S5~fa~;&zM*LCXe^9DZGb9P#@k2+ft}Ne<-b^0b7p zgce)%JamL`uqQWth@csDiCR<$-W;{9lSek1M@Bo@!4j z9WzbaB9uYe#%x(D%RqOny6CyZAxkLpC_+UnO(ovAE{c*(TWNfCSR=01YPec=+^fp( zu5O_eRSf4aRrmfuQP)aEW#i+~Qck(UeWH{CLa%s${H)E>;e~`g#}5p+A!vMbm9o6@ zaP_n8Y)=zy=*nZG|@$xCt90u#&DU)klmwV;;j7{BFo$uWi)V- z$~;RzR5+~Yv@}T3(N6_?VHhJaP+-EWFUGnQbwkwtai!BLE1mb|yOznvFz&*^)`N3m zhMoPE-StqYEAJ7y5k!xvhIO@b)lZn<(^sm>o&_^Fi_mqn+ACnzL=1eg#V|)KAUzcd zK$TWWVi7A}3y^s!LpZ8R7(6YM(T)a5C5QQz+_G`Y*xnT$$lLMj9uaqSQ*_Yd{P5fH zEwp_se&{I9W$(kC$b|w@=*SQ6qb<60>S~6d96WBb%0^R&sBIzHo7S_$5AM9VOcR2x zqhkR{*RXu0xfBii`A+t}wBuV;AA0LHaL-+6=Bztla2c~p&sCp2!lokLT;8pL>aySa zQc$_GB$$px(D1nzBd+;ADSPp^S{oes0%kJ6;c|7fBizG_|bh-nIYXH+VB> zmV;sh^DZPhRbykU4dmgh9d9Qy5){e9`2<{I}2c$b&HfV`XpgLxv< z`rv6HSFuu}C?splC0~=z&`~zv8Vs|@E7LL9JsHe1`-nKKrYc8d?XasB5t*2#J#4Bi zc$zsNi8{k=hi@$5Y>++dU4!zsB5OCcFj+nYwTQZ~udgmB zgf{w{4i~19I^AtGblN=~mx`W?d#(*~!KUKJN2Qm2?j~y99KF74q+RQ|XOF z+TAs?XRSlSXUU0Z7yG3!nQqI2`3{#osx9XtBS3PZa`)J*Ru0}0%=iW|Fd3ScI!hjp zn<2r1`EeHqU5kEAZS(o?8F4S{xuTy+bbpBGxA2*YVi;#WOA3}xf7Oq3zj-?m+DusV z`caaqZ@&Y}`CGTo918dHZSrE()AvPo9G9~z1+0c12|inYe%G*|7ivMl_GBzsrE**6 zh`%?rYO^3>w(@S?WNE^Bx_-CI#*cn6)ky65Ys=QYjN@*7$nA7PWM zMoX1n6VusH-p6DZ@jDi5Q?Nyh@;hE}gy>uD7sH&-STMsS&+1SO*?SA=4HueO^AB`? zl(fPR%ZukT-?c)|t(M|9I-=MhMT$I?yppCt(SsQh6)(TXgv1=_x?NcB>AU2F!8u^V`ug73V*ayrjzBR z9DZLco@86zzb_=c5U#_KZ=1}%7}^-aYrWKy;bm7dKaq)`VACdzf1e_qxH%uz3RQSI zUp5|cnPx<|YNl>=)GseSb;t3_qWca9L5p6gmD%!w7s4J~Q`xK^FD%bl^g1H1E*Xhr zj^ATV^xCbc-d)O8U!8ih^0b4L+GudgF5!8`nM{bVi+l@dWIElFlVWW8Rm&dERv?f_ zJ*KzFPtuB+I&}%C{NsgdSPY#JJMXo$RPEJ~&3$UyA{6C`hVGN?X?Q}G5od0gY|m405@i%GTL&x_E+Y!@|hB5NJ_0H?&%Y z+q~0L%OQp)P51Wrp#$p@Za)?ImQ$Wa6IQD!cYcvK7jQLP>7dj;QdbtnOZ*(Y=TUeS zrCTnv$i^Ls%lq4p(3!0x0bZ9E!wkK>W9@3L?wocajn0v7Vl_V_6yDFj65(l+=;lk@ zoN1Z1+V>o&SE2txb4Z${D!iq|`+O$f0_RS*ctq((Lst`4-J&N6>I>Nc9ysktJEEnA zl7(^;o)7TYepz~!i{EF_1Be^7FNQlez&0;z`;UE@L=GSKsUZ*BqflO0s1@?TYa=L| z+8b-s!}5sUEk!I<-1YU#Q?A(G zI2nlx07mQtrZ3@%XO!0mznvcmDryBfw^yCcI?=f1lVbwi8ry$+<`Ol+FArc%yeZK{ZjB#Gcdp&R^!C zMFB))g_RJ;tEaU4FRGLr3dDKpm_zgJQ04~k5j8PP< z@+TlYTar)Cd>U`~jlDvKe59d}EP^d}Vm|$sowr8A{ zr(rnOq>1FHDbgV{?w6eUxQss{v3Ms+;u9-Q`KK2KmkfZLQDh~5Y72P|*5%eSvV}kL z1C36?QR~0MXJ;++N&X6Wuw7c%ZxtriiC*?b!<()U`{e6}fi{p;)gmVU)#Y+7lOF?2 z%#0`V*%$1sa^b9STvVTAzAfGXC{L{*!XZnV&5rFa5Z$+68!oe*7$6{frfLikIP*rT z?^p2#UBdfH+wQ)XN}1}M8&l|ku^~+#s>Nr8vpUKQj3O#*dO1-j zot(#Z*M*_QOl0pj^+Q-kTyn&9%~0YF*rSkuM`Pb^opHZPi!yv`)q& z-LRKbIlcAa8jguJ!dR=Iws!vhc6RebjYu6l_2ha$M==ArNv33r%smffTVJsg+8&Xk zSnubLALs;BvNSUpqPfi@B)yN>qw_oN_IVws<+X&#C%FEQKcVoM^>w|hTB~d;-pWo< zj@71$?FvK7A~?H5FxA^@1Byb`y%P4bt=7wVPijU?Ae)!rCILpx&II%$Nh5&<)Ukx}MAH6UiCV5G#dO7yt8X?>9^$OblQ{F4)C{&6j@Gl0O(0*kpwDaTsp))Yho>KR5i-KyZo=ljyPf3fN6zBoQP z-KbfqmiE?o=0L~gL5TaVr|c2Gp?Xalps>!gi5d=ZW?(dHWuLfjNCRN2D!0_=3$ELM zr(g$QKOP!m_Tl*oThQPT5b{=FYFT?fN_yy)*~Ejq?cjsG?_}!Lu6CKb&-nHxeKBS& zAr0e^MWaGBpJ&=uS5ys(3i+)bqj?zHge_9fuoo72ZWi%STmVwkmN~F3Kdc(4ZzUuv zAN;heRI|Ip7Q$&Ligl?q+k)<`ei@%NJukM7TIU6qR6#X z<^^C0u)h}0v`1^4ux>%1TD-HJI5mNoZ#_RC9{J8Hc2b9|C#eUhwlzt$aq9b0FR6|5 z)c5+FKI(}b789A4SPb{#S8h8rveb_Bn2ew)*mQ<0N0{SfP&FO`EQYl&EJkUBYgqtm zr=+Q-DJjv<$r4$(e4d}@`jcoSoP0CCtA&;Wtonv$6|55wgZus5X9@uv@O3S4G4ZD4 zYdP6amb5SBY08YV{Vf_^`G<18`yn?G_|)Rqz4=75Ngcxmca+0?r~E~-XH|^HG@I=_ zU2?BKd@*lq;JqC1i=z^xd5(9w)ewZns!ZjFC!sOKdcB#E+pX2q?YIUrQ`9AfSwO6f zRhY%J&~{&9hjf>V``~W2an?1{xQxM;VG)BGsv_1CstLSmHq~5_)tjx^&K_%Hf`yJP zq=0!Fwv9%rCfK0#^vb*%Y5Sz-<~yU=!j+%5>##h1p+RH4_)d8oHb3AxcfIX+RZ!r>C%V4CCdbs`hBMpa%_$>R0H@T zTQJjP&Y2<`rsM_DP>Qr+L-#|iZ0**s(tg&@mGZR;9=cJ#?Fwg${0VPb^u=cHs)@xG zA5>se;g1S_%uYsQukG(FvjHA*&7~W>&Crm+Ons!+RRAh|-Ccx}dBO*CDje4iBCMAO z^=(Te5UB1hWegvoZS{ssk5U1#^1V8bK-%6yGd7O^tk@cIZ4{$efx;u@%T_3Q%*VLq zixCUjr4f=-LTVY-sJ`+ekI2%Z`wT9e{MAciff%jU-u@&Oh(ZX8PJM_Jk6^q~iIlns zU5rd|8DC@}7JW2;S4!pjVc~O&aW{RW*G9j1godvnZV%LihvsI{RJ_k@dJJlnZJj~`5pXkz^jxVm z7Q%}&P1|fwXFgojR%tr|YmA9ckroqf4d>*9BXjJ|6}841h2^Uw@q9#Gj}g>kdmW~H z;VceiQGDhAXv}t88tTdMcc?P}NTGAszUjBK1jNmo z6l}M_!tVxet$kCC?R0Q9buStZ&~WUC^P3aXYYk_!P1_DD8`kaI`0hC%u5Ey8_-7lq z^s&6>Dw&Q;(p6+uO(?#uQ)wGd_9x|^;7Z|wsMhmsr zwq}>aHop;*84U0ii60w!9X`xnezM3o@5?d(*No(X-rVhgu2RLj7a4u=90oq!J>>@1 z0MUj=l%6h}wJ)@(+IwI9U^$=S>{DpQY5rtqc~pmYS~l^uEZ>+YOFij?e@&wys|b6h*BY|qou=L{y(4y zw!;ThmVm{s&Fa8Mswu5p}PF762rs3>Uvgds{y>uNyPmZI` zjYmdh_VuMJhw9BuUDewzQbt}Kt#rzcU&|PN%0&@>`T7;LhmHjpz_=M+d|nsxJSqPZ zasSWZ9Le3Su8UUUsz~}cVVAsIsy?UWPoGvam5Ee@bWLPCYEpmUS_F;Y@&2W!X!lQm z)RO5-=lSy^P3l&d#34iRxTg=RF*k!KcN3^6m{FIDWy)>pkL88+l?N!q$4Z!6@ zi+24upa#{C)vjA{6M+O)T*+)dVM8{4p5ql)%=3sf2SZN9z&*V?qU6YQBD|2;=lD9W z5!hTestH#X!@Qh+-Y?e=V_g)eLeI@Sag5JY72T6kh58U!d|HlQg0SjLHmGW8X>MgsRSf67{)8x1{dO12%UoK7Ql+DtqNQd&G%+Xxt_-7> zTbAXwW*9BCEkgNa(#&tQUw@;*GgjgdN%O5wRfL5|8LGS38=2U=Ac7A;=5OiS4io4} zk#jPsJ~)bcU~<(HSyEKIpkcr_WLTzRU6F2oo8M#DH+nI{uXZ21TWQgzOX$w#{McTOBu&A!`T02f~r^YIw3*(d`B0FTzhyF#eq9fk2;VL^{FzMpprFP@C%b({*~_B@Dy{@s#+I`A z`F_212fcoUrie>yYsE@<*&u!Q<)?+nnrC4)BI5n6ZcfB76LTcJv)65z|tCHzld7uwUV``3tCz6* zA98`Y>r~;oG<~~*{FgNaP>Aul2Rgbc1>a1Kehn1=P1#|Q0Jw!hx!;E~KDTZKahT`{ z7P7Gt?!3+WzJbiFZ$WZ5{`To@Q9gv~Ie`21~o}T0155~I#&>`_VS-*Ii{~6h> zS}>gNbp+dgNal+JTpb`257kZ+4*u3W`VBCg+eacv1i#Mi-~FCBVJDHixBOEZ5YIif z4fGk2Q!4zgS)G3b7Vr5Z%|Ee>^IMmn(~zE>M42BOPuR9Q(`Oe7-POoO`*`eobs}f5Sse3s`(m; z+(TTdW_KF}jh0|eIO!4vmF1ZX*cQiiMDLJca(*~`Y=v&lK1 zJor4$RG=sH8suGB4)-yt#v)Z?@&45O%|l$ttFLQ00dhgkrfm=-CBxKm)XQ>eK7Rv> z{3k>W(W3>%z5V4c>IKHP_YN_+_CMF34)0@2hxV_BOareh_~Lw58_KNhbxI8xvr220 z7Mo;mgbO1ayB+#~qBS*Eq?K~Y#^V%71UQh&$s%t*uneZ zgGYI-wy-Q`xbCt008Qc~QX!M_{4%d3sQ3^coB^qys;O^g8zHIO4udP7hc8nLX=>*f zTq#{X=kW1tTSS$L@aGjB>^LHE+31pOoKd(7egqV{DB96!&s}P4@mlgXB_?@z23Pmv zmrL+_%Re`!OOeq$hH%5a6nREaHR9ku1H#Y~yvyyNpeY4Z78Zh#AJW9@t5{T-;Jzup z_;W6{(4pxvb_+lREr8N9^NKPdGFQJWCetr+28)($<>@Mph&1$)2lfv-x-gNSn8WLn zlc|xWFs~9nv(S^ASGv|LNp0VJ7dURX#uffw&kA1DPe>saFJ z{bZ)tQ?LEz^6IJ_@RU+);z#)J^{2>_wM2^5#R(zwE=P-pLiG^`8%@v=W9b(A)so(M zKhBxuFTMcf8?i@1Tv|*5OGAKq$Zfnm-xAJNHdDt~rv~-mB*FJt z>`OmEzogFgs`NN5#0bElzI~vIr=W`Oe4fu@qd!$kWeGe!YjZKZW_1q?+;Pgjv6G6A z+r*9!$gH^|KA~BknLFmj@O=`n9Wl+X1E^~i8WdslfU1hOqMkoLqeMYDMsdsg_Z(V< zFHz`m-B5Y666zZjJu;!&ELy~=CxNX)%aRcv?~P%S1F@@uIk$6qejlzv1A zIj=;akaxMc-DjGwu@)b>3dEINabsRn@N6_*vuqVDB!PtbaUu&&LWY zkn63uU-a}FzDFk;jnI%a3WEYQDu`rRfBRLBqrLf+TI&lBA%+?tPzLTs8fp)HJ# z5oD3r#Wq2XdF(zy;VpltaiXVx=!BY=tmIxD4cQM&!bH!^hHw^!t4Z+5Q5wSROF>Rz%U>ywi$pM~9K=$2IE*4y8oavgy6K zmyCjU&xclMC5fMj=J6=CFm!y10rlV`&O67}nf4Pk>N`hRvzfQS&WU^LMfpAlWJ+}k z)nh8#%(gcupJO`f-)DLQKS%zJ2_Z`mzqMW<0oRy)8~d(3sKB#>Xp7Mmli$^BF3BIN z>oW%x8PJxH+kPm+6gf4dxuj>O>RZu0I8Qg%p0Jp~^!9Ar5Rh9WId-N^#rx?uC$y*F z-cqPo)z1XFJUgK5Q%j+o!rq8zqH_C*=<4I-=mpz z(ex%Le)+>&nCUyZW|ut^QHrHDFBdiRJY>f%gE!=70vaCYo=BSYz!{TW3hVf4f8n}r zfYe()bV@t#R9ennxl~wFv!UsO{23kp{1aMi;W{Qu=qyiOS~lm(=+L zv>^AUZlrV0e_sQ$P8kAXo2quHjq}`TiKMAZ*72_WY5%_M@B@0!XS}L>yG18LO z_MmdI?*%*0c3X#KWPar8XjvOz8QrS2B2D?Bw z&B1O(3LEUw{cPm(0Djf+c)PDF#oeFESz!=v<-X;skzB=YTNj~?kUw%DCw$M~ExhD2ci zVrof*UfCz0%V5=L|GMF}ImhSMRd*9$sNp-*{H@?1f(LnqRocoumkI~F9x#$IeTcMy zRE>xtb9Fcyy(%y_Ytek83f^OhrVH>yjtlt>HBUVAJNC|J)K|U2mycw(u0QP-sppD+ zzOL(;cwt4Sktc?1NKgXVJE?}Tfut%es;gIO%7c1E;#ri-M3E|Qag+OY5Ga!#HVIaa zZ7y9MT`5@;=)(f5cq<Td-IloK!?Ez|Kaw>$+t z_yD(0hM@C>A4i8+2sU0oVB9sC&{HcCq{BzWBi4}QgR&ic6w3qIY_o0Q;ni-og#&!o z<`IXHPmc0G(21!qyr<-mDAsiz`83!^s!?b4isUf4?~>CMSLVm59ZRB^q;T4;l1H9z zE5&*K>AR#@o{6^~%3k}aX&n^gOALobT$UpHa+zj-G=N1mATF=OCQc#-CdI_I{CUjP zgdn@z_pWwMIgx2aeln=dijm>3S|WV2Q9(P;FnNCc_||>We>fR- zWRqA;qbDHYcy5s0^3}t7LW4zKNr3#3u#p!QUkSybtL0jJcInq#7|A+kJ%;6&e@*s5 zU&L78y6Eu5h5oNhq|qx)UvT~%KmBrpEPW0r0;Zg$_~pC*__97mAQ(ND+$i`@(Vc`= z?-)SrqBc}<2bV>M9@1EBZ>po&N<+_hI$R+Y|4(R{6HQTdg%8BFmvK*GinGi9;UMm4 zn7W&FI=P#v4`>4Wi1(ybII91OM*kg4{dXMlQqK=cZrL*~{3-4fUjYG-vB0N4wvnD3 z@FHb{hdQnIf6L}A1jJk`GW~yQlVbqAhBW&pQU7-s|NT?|=mYQn3Z4HrSU~8mxZ-%4 z+WhxJ=$%0*S3s@y$F_Ip0V#n&;Dybfg4ypJUk8;qenzJIG(GI^(AH-N z1gs4OsVzwAB;y`TEg|p+J;MV;5jqcwzsBlw zF(>-7bea=Znj@i#{HJ{X>1rVL3h~MhuvF(jY>H{}!%PE)-6^tviI#-m43VjbKx*bp zb0ptobG6f23z!(P&eARQ?k0rLbL((GAi)XB07L_yixx6heRAq+GTxoygk(JT3N(JL zXjFIce;hmlZTTP4|8MEtTLuA4A@E6~AGn3&=vQe2H!iW>J?=dmQthgC!tmdxYArPH zqFqE)MFM&yOIU|{F`wNJsq5W!bv0cejM=?^3cmiAGLmG75Bcg+z1>^N&QE!`XWzTC zS~ffSbV6Yo&?{G>xO{epZEN`8gUziJYzMT&+x37vZuY>l~15Pb7eb6U7-k=ibvGJmoi|2bPopOTEyegKd$_21>r7Fjo z&-#fXQq)sh^V*>8QEDd?^{QN5NnZk@5FcOs*6qbU<@)Iyau#(dkgaAEc3BBJb9O&A zNl|9+=X9XyaIe{BqP|TqK<^cfy$%7rAbPWDP0aML(n)=8t?D+|?h9Qv81_KTx#_{r z4g1}8T^4{HSi{#RCG0n6EZJQ}F{?Etr&#oS z%B!_ORqkX>hcYP_`y}Zr85S>uwd6r2A^>N$4d~FywKSy!hQkhC;f@<@(EVp9C**J? zRm%Qmo9O1i^D~8>4fYdyPAxWTsMMsA0L&?Pw(f|PTA2xH zp6Jcwy|$;ZcF(5sP`}o*!c)vX<vv9tJml`3EFSJE%w@H@yKzNdO6b? zuD>}EY{;sebthWsITVax6F9wcfKr<}@@-(omv|f;w{UfI|KioVLA%EY-QF~L_-OBP zdyJq)p;;SKszP|76RTF96|TX#6_0s3!zRAZyzO|lafL=lp1Kw<_}pwO<+p`aM@qxN zDPMA6wLqmnNAE|3hrU+R=m{F&-=YNXDNMC6%9ec7))ZG7hh&cxPz1b^c;&^d2Fl)K zSr-<)l#JEm8TrsuNLA@>`E*L(UTb7N{gnpB6q6=_RVuUE{rsJDr39-k|5aKGv6Jco zI|BwHI+#V_GIRtx<(T7=|HSyyE9jC1+1}i8en(9lNI|*|fU1(h1{1p9wys+`XFAF^ zb#Mty_k<%4buOmVx$Asg9j?NtRm zRHMe-$$Bmr-_I-Rr*ARub-f-xhoUF~brLTvBJ=Y-59B%BW`bo`YQHjhuouF}V%6s2 zhH5;Bb&S?jO+eWGAoFp-53NIF4ofT#^wkV8 zjnFL$R?RSQR*r(HX-Z%9vX<{lU~HYNxA6brR{6}_{p>tJ+LPF{<~3k)4X^OQ{fC8D z2HSJMAwaFb1wPD^PL*IGG6v`S(0qhmg*Aq#Ao@P}kQ150dX(;>1{eKmTho-O&E7^o ze4O&^CN^2)A~?-vE=zCNI?H70tF+aG0m1ZoT2M4=y2b%CrakW)QyVNmcdQzi@4TzD zp6fS}SkJx9VbSFm%O_PLSaeN#;c6m&VQ~(hs>?P9_%39uVrvKmaI=#9aAk0Y$rUCZ z<+gDIb|t$q?5=KaEz%nlzp!U(=Q&zqJ;<6xy4!`AAL)FaggCcXem({as}$P_&JN9% z7ro!_F4b8LtG^SvI=iI~gj1sN5J79o{7;OwMX8?97`EQZf>(IsU3cwkJ|0D6LT`Ql zHmonjIbKM|UkdrYwMzF6GGM321t|MK|-WMLXi%lQbLhXLXo2M-g}!ne(yQwMLE}8 zGe72{oG~mwbovH#pr_gbeV#xABGLcg-I@5`ZE5KHm|e-mt)Kt=Ra}T zSf#mQtljsO@y9BlDRBaYBkcoa&d4)Q$4hh$`DJABq*uZGte}e;FLFVQf}yiE1@5?5 zgO&<~hXVb-X?zhh|0=ghWv@C{f*?HjyU*^t5Zo3};Od=p`S3#l8@pJx)IVGcwE}=t zTEGvX!NCdBwxon>q|m}$yO{jB(_3dQ*SpP|M3fHAaDrV0j|9F}SBU2uW!10pERNvN zYlCo2uho9|V2<+Mb*qT+Kto#1&$Ejf_hiCq;xplK%)s?UC;z^&%a65INFr-1jX}Yq zYTNH0J2DqGb&zMRJ0684O&WV$&(}vsSc#&o+QoyFCWi$d`3{&3Ig_lfa=aa-_ z`b09>^w>hU@=xEXdO8()LugesnO~%hb7CR;vOu5uOsd>%tcx*Et3c-*cPk041!Ze{ zG*1nOjoK_Jf8dmje0<*ZjITQMAF?Xu%OCB`*my0Mof31^dLE3=`w|yKfF!>vs2ycD zAjI|*H-7$3@|E7BF&hwt@?ZYu2g13(svOOLS&62J=e8wmy%;xs7kzbi&{A2&68&)Z z#41zGXhVpp54+hR!9>&Z(R8CelvXx`wCSC2Naev-THQL+@Q8O3I-nFT_KtgSA`00_ z4I(NtLh}&HR(Y<^ufq>2dLjqRXmge& z^E6m(u|=8Q>}jhHq$d-=Iia*V(K_e(u$;H@HeGA&%+UK+q{@-pI@ml|vE8oFq(BIc z976M6GPZ*aulP?8cf@kq9)>>Pw|SMTUm;K8wH}!+Z1WJ>0exBFwh$i9d~<9XnH2Hz zEln)(7^c^JXw=!gSmR~TGTm0&18ofO6N(MW@k%oXij33-3XZ{CK}K8POd@or)$O(K z?}50Y3?a?884v}XrMZu#QKq4I_*y-O8=9d7EY;>i-020(RZjAIigU}MQ3A9|&sEer z&hwIHd|Y%6{<21M<%(syW6!IVyjkzP?aBVvk~+&@s7#%7yw^H(-NH5ih}74@x%gtR zIBjFQF|3|NF$&}0HxI;qT1Yp$Rib*jG!1>101|?AN?>Br-N#&>vimQLgd0t5Pkq~D zw6mk)FpuQGn_^A^D7q5!rrPZ$f~c{+(!LZ$2_vP!?xwx!l7x$tG)%@NMM{#_Gm!t4 zeu1B)$uHs4W#OB1vHA;x*!9Fc;%otU<1pW*Q01`Ai7!BmH!BZYT$OCcm5{vNBep22 zb~bu$wbLbOY*ZZy3rNjRo8Q8FtY8|PcEN_52m(w+oc&kV*3zGY1I9>R zRO@WlAM>T}FrvL?ijk(#k%t;n@oxX=E3J7zdLi{-@x#hFg5m&@~3*oHNw+Orv5I}oy|b5 z-Q<2^?b?wKR3swUr$Y=QZxx;k{a?=ZrQ@DxKhBpwE-57-A~yy3{{IK$EJ*kF;L;a= zU$}UvfDmuU!Em|zxW9qnd8GS)nrBx`-ZI8>-l15cuOak2#=|~_ZOKwpUEe@fc588M zjtv+bU6}Dw|83GLmJveJ)RfBV%`L!tuM&O+#%%qDLB_U*r3rjm_7U#4oRj@#LOFOc~fOl@~%&Aa3Amvj&-Vww2) zBQd;Qzh}c_r;DZ2EFkkkRfc$}GhS~Gz~+nVG0&_WfSvDulmuu_!joM<9=JU=8Ztgo z_k8G;Z1sNKsYMLfL}iEU8Avy#dO(5EQB{ApD5c_^u0M!iFkkR>`?I4VlHt}DrI;8G zgk^`OJB(=ry_iCM`fG8(VCrNRts=sEccV`zvAiLeE|Qexmh7+XX1tI`DM^G<`Q;53xjg{67X=A*g)pF4$a4vwpwfp=OD6AU;V3Y zik;TQqfY`4JH1w7$f*O)gFAo?2QuEv+xA;e^(!qhTM`8CWE_+Q0|nFl3)e(O`hyqa zO??jZzXnx{3#t$NqtgF$IdoGJurXhP3qf2aQ%W^M@rv|1JBRK|mKZ_%maDXXOYI?0 z(JyD70AsA+<$$9|03MnnVkGMkL?>_}T4M8yz17~aydA?tw|6gsI_V}oQ_@huY+NG{ z0o(+6+&iN(XO&I+!FwU=pb+5fkdEe%$Eq4mbY}vT_X7~0Q@`j*YU^KFfHCR%aKBSW z0V!}Gu+RENjE)%?|JIDP#_N5Jsl`-#!x7F%b!<9RyD5n)-b-o*4qGUjM1V{U`y=u~ zIESA7z*kUmphk%knC{9%bDCBgQMM%W#FyGeouc>Bq=TiW0=VTMOR{>W-)6-vnmZ#= zPxVe2a6&L(QA@bxJlPugj#WcBmftenb=C^cFyL8r_&j*CqI~eR8=|PmP~8woc6|M~ z&G`j~5{F@KyfPnOkh_qrCC4pi8cPG~vWRI-;JZu7ZFCEm2SmufrB!-E&W!M_@j+pU zP{1vMrNVta3ODR=7l2aSfmA%<_utDm0V)_@IM33_uC-SESr-W39gtVbah<<7;}EE{ z%I%LXG&heqcV6d9KfH|&pyXm7=Xel0(R$Moz$%AS<}e`4Fas46|CI0x0W@g($um=$Yc~A?TIz}7%s|W$p9|k# z7w#<)>~;BDJWqNemsfikU_I02ElZ2l=(<~jss7v)^I^cqq1O)!P=);s$L}8tomM`d z8BqV_5CAc-1P%dq-=3_bHvzk8L%3>wuD*7%??$YI+t}14^W_MMiT#kgIvo&Vz6l5j zZ-lg}KAqRwcJ1TWE4G~24~o5=Zm@10z8n{{ViYgrcD>-|rAtC0(TBl%ZY|)sp$PI> zlRabusCeu%d~_*{;Wl8J=aoG69OW2L-h{eQ9y5T7xBT%W>mz043RJgaHouDfq#9+9 zRkAnti?dWE)EYp?81W*Ia==fEm|`vKVQS@*lq{cp5^S!GUi^!6YPBKe(x#y}2!B2> zfCcWLncg*fD}kg2-cJYx2H|U=Kym>~&@Fd?-m$ws(6a(GO8Px@qiVt8ff1pDr@ zs`6R`FGBwH2I$7tt=oe4Pdebs=g(eYZx(+Cy#hsrRPIhyZ}j|K-@mfVTBXW@8yEa^ zmWu5r;EQ^5I43{hPYJxw>)9(DjS`U@7+~Lds6qakX$V0u$GB_Cd(Wf}lQ-VgYwjl?oO$(iNBFC;Jdf{swMHZ z9(%msBik=`PI6@IR1=!=bx&UXJ^eh*FrvW#5T^b&z-6`hoZUb(*0QGAnB{3FAgDVs z9m|uVqTq{}oN{NWQ2v~QCcu-p`t!pJ@hus8tuEDRESjr(&USNacSvRTp-Gw_5Z2wN z9*Ym}J_1(Ztv}~&?2;#1lI&1*3nelvq*3ehyNJu&4>aRqrs2RGGV+7@{UM}jac(Dd z@dF_OcI3SnRW>fT+LBseULnGtlS{1XeyO*_8OO=CM4=B>9C5xbagX`l>5oT%qqUzw zzlr>k+syj~y>q6Pof&WW#}4NQPkHFb?QAUzGo`+alJ+BxVvtKe6`gf6z$KbHWn`v( zKQL_}ulK&@93lHpzT-It8)WyzK8?d{d8 zSH;JY5=5=qTCDOUHHIb=MIEZ4Ro!0T*+W#VP?f0iN!fNN!>lZ!DHWg{|EQjn{z1M3 z=f(UWy?8OY<9$Q#_+K;ySys>341Dw{Y&PEaPi^DC202ODt|is}M(W~_4?Js5xu2QC zcdrTZM6@nZ%gk&e;4i7?2C<8n1$R=G;+h39fLND&Zh3vlc;f@!m0T#>cA<22Y*#L@ z)#rhCo3-rb*JdN-Xl^?VC_^*bomL+`gD#ms?%h@HSYP)U0c{)j&*>8}Nh%r|(XKW) zv2M5IJm3x9-0wO&UbQ*Anc#k*vI18LI|rLeeI?N|bMQjn8YU?>{5S@tWTq>_0kTd* zQno*113w<3J(?B+n`hkRdQtX%d9>xTC}A$(pTfH+JeR+3z(oA(}}d&CM+1EX5W)E#0lA1@1{~e=^t)- z#~RQ4m!L%7!=d>xmmGb_IV$dg(FaJdHFgGL%2-83mDp)HxU`Yg;|V3nGs^>C-@4`V z8?*NnYAaM+@-Z?>5Zqd*c##%sJgF`46cJwwKUK7rV869+Ik(fMvR%~G>nMHqYh0)p zM{tjHK_y2EwzL7E@1p(2zW<*5TThuJ*n~bs*Bf#}tBn#Y!rlP6t7I22JVxDFD>5S#_2n`jmA*qgVHJ5Y(4H|TCrv)XG+nyC718FfZ z5rRKQ(5VX2=9WhHKs0hpd-iTpu&SXPWLx%Z;m^0jx($h4DZIURf7%_oXHRK;a%EXn zik1<>4Z#;R(MtPQI~<`bG2D7CGh*)3H-SG1T78G*GjQcsiYQ#{dtXuI(>%rokt(2Q z8*Sgtbhzb0Xb`*k#feZqu1=24i!e1+Za&F@>W&ksqz&yKP!Rt)qF75utNcKWSL8)s zT*LfOqOIZiiy;LLglqOD!s^2n?jcP+SyN{|iLA%HNtelg{3SpX$?qjbZ9uJlu&tup z?1MJdyV6KA9F&W*%;?i; zBbQ&C6@aVFqCH>kSknszwzAO_b^1kbiXs=hBok{RHxC}td~UYx`>|crAV_Tb=xY%5 z%GT>k5Ng|gIZ}DR*~$*^<5|-dyvHom3c!Ds!F{N&A9EP| z`|JL1A57Wr65{f&P7rS2-~~RsFt5+2l{7ReJ~X^~Ng0Vu@-YCi4Cnis&J;%@Lgd!?h?3>K?;bMm}s1uh(AzZdXWrY{#IwB8kv*OZz-v3^SFyQ{`|69R>JM@ z*kXXCZVw+$Gy+A9C17YIsbBNZg7J#xd#|9PrKOb@ucoLN8g1fvUp+}YcDBUHT6%yU zc(s5sXbB`{C1;_Dm5z!OBC$NCy)j%AL+y08=3oP+Zk!~M@bXAW0Di@%d^^1*5hDmt z-07#r@a>WPi({Fr3d)Nn67A;iM@J3#Fnii>lr4>*>M(#*io)_DTWI=;dmBL=*}HdnKIT@I*F{J1C3`)_=ebS+Nu8WrND%_AMQ8Qv z$$wrz?Tgb}uI-$xotgLEgqMWK$jFdixiUVzn0oh>1vdT73Z}hAv3RC?Y@uQyDj+P3 zf8`D9y;&C3t30l=U6HToe0rTjoKyT!IMZY%U#7hqYVYHlLvOe@0j7F9ve4YJ(b!!H zc)u_+Gt1#m(}jU|&xo>NzkB4<`<1nysmhs!^Kn6XqDkN~!n-LHY%d&+xL=}W*B zymPn~QvLe7?IPKL%WO9{FI;EG%gFGY=UgtJn3Vv{K96nEP-U>%-M9yH>E)e<*OO{h z8;NdDjfRYMDA1#gC7i}yt9s9J=@)xOl0G#C86^NO=g;|LXG~0pAD@4GrbwLObOf zlvF-9G(Zw?wT@sdU;lAXl1Yy|CfyXmmFV z{F&!*Kk8r27xVFTGItZz7kOai(icl#>b^Y=Ep9ffLL<>EQUOgFzX z#tS#Z`}LX5mthf@UP&7U+s!12mF{TMem9q(L-*NSz+#*Bjp&`ESc6SWBkfA!Oj5jQ z_#S@*_T3k;7@}l>6hz&}oB$FO$*@nwgFGYsa+i6Q(U#syj0#WnEf!f8@13i9QKBLv8n=bzx@$z=Et zM3a^pc9Iv7!@R^ zMWt*uuHj7?2A>*7GjbagHA39v6ch%=L;J0`01LeKeRVWMs-LedzNQuu0F?ut>K31X zo?>_Y`MhiS=jAWaCMbX8qjyT{V~wn1Y!pjaM_9CQklEqENpWh^I9NuV2-3?oO3XUN z8nhL{*Ej?1X7$=_5PWk*$9tEcoNy;nNk-dr_^lp|yLjvR=O^SLFB}bH@Gw>*=LoKa z)7zsXO>Q1lV+m<8Ni26&W6|;Lvl3FmSw1t!t4w=qq`Rm^+lU>;<>O!S?!CY@)JvY>42EF?oRBMtxhK@9`aTyd9=|3so(^RQ&!-2Dj z4k&*W*7Wu5=xW+3iBYXr^rkFJfXn=6(IS}=oXKu}S4C0Y+I**B6ptz7HddU<s$dL7#Knz(89(D&8leJ$Y)=+H#CWt|p^#xyneOHX zr-150p6oQty4HpC#<3=C{s*&Faft#A7Wd`kx+D6~kO5m3q*|-w3O9#d4)3ns`iA7V zD7SV-(d0vPr5p2nc%;+;6X>!O2})NzXPm@t0hKQ50qdb76Jj9uioZ)`>=dc53}|rDelyXchK`5Z_jdM6TtoS$}hwd#wy;oHxO-y@4svh^3U)&ny&*z8 zxHR}fL4jSfY5B==(Q*hIGYgAy%i45OR5nmPEJHfojQgX@jGS8qSE~AOGoYOlS|$#h zb+J;u)m3vqHp{0nAI=Qv=knT5}-$b z`%{(KHJU|deSt5>6f%t@{Oe5ZQe2gC~qct?k!(((@z-!kd8K5bnhw@`!P&>eM~W)O*ie{8KnN1o!cBaike~P;ku;P zL==1C{9+|-y3X+^0+dT)v&gnvxjCALhm^KUnA!~8>Yc<+dm^6KEUhKx5@YM(hVV4D z?A?PbBPAE=^r$&P1N}r$$WbxysDFL1y!ncqK|J$|b@kF4GQj2I6a_;N>ML->4e!Yv z=oOoMRfADe0T2Z{zFq6L)T?Ptw#v;Yo=NNarfC-BdLYzf>0p-;dR!|@M-7ZWyeECW0OGG^kv%N;Vuj5dJ+ z$Xoum9-#DVXON`;77$0Mq@+YnOUtpmyo@q$xS*t_);g1TW%}m;-HHIieRjO)_7kE##uS+g zt>4Q)OFBE2D9QCe!CmHwNpF;hq)y3#=tOex))w3SOJByC4a~5mP}p?G$Al0=o|sl> zMh`HJvADf>+JLe}G#&SkMR@r#m;}U@8B?r;#HxS{1sEpN^HUc~FlY3buSKQaCLh~X zJ9VyC(P_bcpdVprn>>Tf@oY-q;Up?9-+Kzo3!S=k^ukhgPEW+&_{V$?H6^TU<*gZm zaT9V=ev?4CKvN+W)71}6zb-^$6ms2-L9Z{(=gwk6*Uim%#BgGhVw*eHQ;sIIFg&}; z^8iZWFUy@0Uo}goU*1#!u~_%;em5)U5+v61$;742bz%LE^ikq+MYeXaF2{AYrzuM( zTl}ym&p1BY(HjV(`5iy~Wjo-pP-bQM;}daTkCk5G4Q}<9=gV$aShoRZH6i>2+Te0; zt5zy6`WB7ow6sjOd5*FYggFPE&NMCitUtLA`-C%Z&0NI0eB;9_G&ep7!`J3mC2mfh zNrZblBYdciw!-ntC*GrL+1adF2&-76xfvq9SFkVa+4aHbEwrM~#bY(9wXdYmXWz50 z3hrLA-lvnEkB$ zpl??MiuqZh_V!Aqc{ktg`^wd}0f2p~0d6tpe28J$;}_yLOvBQ=dH?F-Z@6(OzB5jHV{EX| z44R}2Qz6=d{DaYgy#nTLXYQH{E00_H-Xb1kYOQp=W3(KW9KK_<*|I8;KTNRCt$8#Q zG(Gp%R(V~Zox@Ni3^ibT_1fjj7SD`^712`=tZ(g!H?Ln8sO24#;)OG}S4zwQgQigZ z+g8ejKfjDe8QMnzDNtfJp1o`?g3<>{sw`d?c^W$T))2HH3%w|{C0)IHa0j?jRkEVT za^yt-Suc7P9|12!BB;26H@%-uKiN@=MKS5WG`hmp-Fzi-NDZUp(L`3Z6G@unBk`>o z^&PIp%tlGhgvKEoa~JI{Q5=TTreQE2lDg9?%MLcHpxCi(*Ce=?Ybcd@Tb=_*pNji5 zcxu+t#P?g!`X+9muoDK-y79?mJ(VXse?FSN1zT;xqKP2L)%zN}9<+&|GQGTti=Lu)aHw8> z>9xO(ODcCzdl|iu*bQ{3yAAz*2m517KhVODeLx}#GjF~;-H*ry45flSoq*;AI`Jn1 z)VnJf&_~V#Sg@Z3XpnypwM2iXB#>o1Js>QFk4x#JL~Ak{QzkAs)ts@9WTWHkw9jTD0<%*x%)EOMzh@GRS1fX@|j$HJBo(M%#D51-wY9cv2H zh>_|_DxoH#*NA7?c@?|h+x;Jj8|c0|>NAioMs-k_9ZA z2IjJX3U^?2=e;(vO(+!6P_9}C3#8oOG979M=FSzmn9w_m1<7q8$u0EoI0OPAhly%~ zqFa{cECZ61FMxYB^e-sj1qhs9Ya3Rrf0bQ(x~}~ow4z0;o;hCIGEk4?;q>D=r)^V} z=CDGm1KJ+Mn^||dLX`{2Q#(}KA^Oim_OkC$A66|6mrPdid6y_k=6xLRF`SoQddH$3 z0knXg2E!%u?i8Q17J!+*+-l9f+Sh8YMv^U+h{lRisTp_a$#TGjH79`ddT1isxrSH;mzznS(D=#BXS4sc#2`IdX} zBGVjZuu_$Hy}F^0Lll(WH{pkqvGQ$@7usshfYQlQYS6c%qvA4`L6^N}jtm&=g~;`3 z#EVd4SV+VdW@AH^66%wtWsZdF6Nuo_>)>x zZBNi9RU6r(3S71~#&D+55fPXBY!42%n~F5j7fFSCId$7#z@DZYdsK|6@Y?h;hBQX% z6)o>|N}&YqvS+7Fx{m&&5lmw$hf=(A>{c--wI3~eFbgU?*g?5?7|UDQK3rD_orHYC z_-(mo0UrIJ@poOCe^!Z}G248eJ;%8To~0sZ+@L!qU>t*R&5lZ=ZFFD2_Gvc&Gn9lH zX<*OUBB_==PbxtZ{jQ`~CHb(G$`MhG_*M~=P-eVAFL{H0*zHYv+a~zdoy#u2}tfyRxF5kC0e*1hgiOz_$noa(qjjPiAFaU7j@|2!pb; zv_of=@5zqTk4LkZEpYy$LU%E^#GUCMJ0QeUG8LYEx8ZV8wiVkvJN}|y-@EK95LV!O zE3POFLy3;03`>-^G%v*iThPg?AF>|u@i%x{jg%YlIWwrt0x`NBS))_>*1eIRL;~?n zz%jyYk&|@6%TZxI(B>AE`@Y$;hp{L1`@hG1W`vP9V);m{L96NO0Qd!_f8dCA2Jyqu zh$R$aM-X@71X;e)J(&kogv9JIkyIy&K&Dbn_2FS*8a|E&j;)NlkotwU&2J!FTd+^TmS6YV%u}efa&wWwe2lrVBi^PpqhHeNls+`mZah4lw`o(ul@joJM z20wu7leLtSaplRK@IOcS(B346jDmtO@s2x7qhp;X@hAzY!33F-bE9km4Aj>F^P45SsbK2}@@ z&=G#8GbpxJ0xJOs5>Zc|^LqX>D_P3M6I4#Cy#M^=-xaU^-%l?I)qkII^~txfhnxks{==C^d4|44fNvuJlq2T#J4!H&@h z`AOS@OnzKG1b!R@u*WXVi^=~kezY9>?;2lWaQ{y48>)`G4WBC@UDvZentT5JA46%u z{g-u&njG_}2x@?{)C!02#iJG1{~F@Pw*Xl9zvwaglle;8-8D+MCg!!3qac6po+1#q zw28H!Iqt@YDv5!RhDOS)^7B3ot3n7}7+7e^4<4uuM5`y>Y1-eE8X4pXKJFoqiKsA4 zMX*^VwvJNJ3fo7_R=7s4vlLt*|B3T3pbH6_IPOg=S`3eFDm8@AM}t10(#U`-jPuJu8di;kfY{P*P{$`f?cUe$ zuH|Px&x^6E2qTrNl)oTana%tM?t30V761^#OGtnw*aITm@tXYLcfh@*@rqqusPCY2 zi0#ldhg5KUGrJG*J!IF*;siGzR>)Js31}v~DwwebrxU;{}7p?q{O z_}&si3QA^`_me$M>0g?h)<2T+TlAN3=Br7#X(jCs2XoGf{00eWZV?f(+~(lt*MhVr zF~+49gYuzFPwXHh7Af7k`HnX zikDg$80Aw=oPFXqBgI#PQ7ARJ>HQvq*?W5mv7b$A@vwn?1-Bx1J7}tO>^(mS8ev^s z#Ke{#eo`HM^8T{7$arJ*@gAPLixnDpvIJr_4^lmd$#gwk2G)J9|%Ex6`Of7}f z(1+ikKeTUmjbDooGA_W-wVNd0JluPfEkIjrl5|_&@KkWp()Z0DA#lVz2W@(HpkrDC zPNSdc%r4e;AC>zmy>n}L428rs`DMmSY(D+ZJ>y^7qvlgEnlbAe1KO5)SZ@98Q4OKH z*)pI7u-qV(&17Du@8_8&Qd%L88NB9o^lKG6J}I~mS5Qp>->`QVIn;KgaL%Dn~(wSW|F&LzYh-A@G>Cf`j&?wj(a@9!>I&ed(nxF=f4&CYr zsJAvCnI?H3&Rf%QU-XJ%xQ$zgu6h-M=~#Q`)ZHrr)kJ&@n$wjFco8}=F0y)bHe6=% z_d5fDLUcj@ZUDOB?YJzztc=q&fF-BYvZgUsI_&cfkE{tm(~#=JL0h1+xeCyMBNWGWI6yl2IcF!ia*Tv2`wN+TtR2eU&M>Zk`HBYI&+2eQn6%nU(?2kWm{M_`uUr zRjc`w#kx2c^?KO3__8N-DDM z?thMZub>etVH4#t+y5nrR($KiF7>r*H$i)4G=@AeFxh(ncIHCcmI6w<0icpZFQs1; zd^@jlvRLm_a6%}%rEGg&od89s=SU~f_M*EIxi06!XKISo;Y}l0{?SQq{tPQu4O%;! zBO8=+Q>IH}*<)r#tVXl59l(amn~QxOJ6qo4f@pOliMor%jSd zLQ2zExqa?))3=qp^FT4Fkpy!}yJ4a{J)-piA23)(-Q1EmCO<=?(JAM(u& z3N--O)0e>b@y8p}AFfHknimpXKY8U1!0vHp8;K79J21g=-X)CSu4NkRfLE6N&*EE9e$OQiTSKn>lHbX3MKKVWFrbKe+*U!W^Z-ur!g zMet~hYpQr=X68!2&0*yFY>yIXdIid<)mIt|%&7X$1I?N0Q0!UT9sW3H60izwt4vTC>(N8LAdl{>r5qzH%`yDs+UQtgXv#$Xkqd zHm~H$`145knA2+1U9QsNJcdA_>k*o0%H@$l3a5cnhT~HM$jx!AFk4BUKKttE*7e^e za4lY-L_XrZ=E5T(kvPW@LUQW#WiJAB`M2u2f;iaj2%v>@BY8667KuLRQXx-t&YxS} zTkt;Ih;TV0jBDG1)tvXVLZ?@MS5=NBohW9SQ+Wr_#rA%`pYJsbeBjovjl_U3 z#M!*x_x|1&<(xmxIqR%-*7~^?GR%JVv!CbQbzk>&-8m}ipv-n7=$v?k5w=* zaLO?-FrzNvf^UxUrOCk`Pb?lidMfki5#3VG1T)XdgR!RIxNwbMh2dE^Ety z!vOLMkFzl(hVkL^&4PvTHu#S_t{y+D7o@s91m8?uE>@ht z^PijieV@msj>Zla_D~BuTe{QxK6`HG1Qoe``?R6|`S+jaG#_9RG7~P*wQ!TcM{GuBO)7k1cF~c|aSYJokBp|GNH>PuKjn^1loJTTz(f^ws}mivQU8uWx~&MK23;{79i%Ux5*T~jALQ`_>x>QRhwAy zrAa7@Y~&P4z)Kv7mnOskx9Q^O966g+R%KTnte93iPGl{A z)>3`_5(DcJo$qh|iC-p_j(XUF_;OVo0~3e%xBtFi;gtV+^xKzz{VClGid1&ijDP-l zPmI%Al>cAV%F5?^sgS_e7EJxXWU|&PoJo~|$)LJ?>_rRpHEL?F5`AXmtKVMw^iLxk zcsvI3137oPVV!rO_mO)(f2r+wWnYn*Qd>Cvd*saO<8urm9f!r_9XQ?eo@_2HL^OOM z#b?6IUd|42ax{4&)A*Lqv?H4Bst4>XAteL7Y~&X)j_RKezXfmW(A?Zx)Tu@5JviG1 z;^~)vMKz$h-@FfJ7veI0X59QCOyU)8(nSVsFA@W|i`Rb1rmwpl!V$qbXe`B3-}A z`NguUtzNl(!$PJ0CiV7e%W!Z|5b2Rj6!Q!0Hw_<}$Rp5J0%*MXv4-N_m7sim&z7+~ z*N{JK9!5W<=_~h~gYaN}rT>la!8SvybdZUisV|P_0LzXm4Eh~H=TU`!bckHg)eS{3VBW3M8y!<`KbiC4u@4*VZYP}GD zvdnf|$F>Hgp?g#|=^a5NcKEc^W^~@N*8a!C2e#v!_EX|*(QFATL!g8%O)4a~e?eq# z?2dYlMpQVxT;($T4rHb|s5GU-3OTZZh~-R+WKw+s{m?DE{lTO)^wuZ#)lIkU`L@}% z2ubvCtyk4-SJLRNYMu^n0_Q?rgb`eVmhQgGx}J8SNxiP6)#eQR=W=`y6KV;yua$^a*W{o>)8V7N( zvt*21>tp0v9(Y1%?Z!gNtQHFFCR+)OvEiZX%T%BggtmIjC*VdvMHmUY%zNhRPLA@+ z;A^##?{8FOs$IExU)&wFJXZwYbvrr2GiwQ=6*HJ{ogqv)y3V2@k4r?eDwLleNDgDC zi6f@ixF*$QkCDN0UfFXlTG#d};j(}j#n=|>I{7mS-#&tTvqqx+^6sTw~k1Z4bDSfVm)+dtJYEXKq zFJo;$Vh_f9ywk7bFltja?Cv<70tcaGQi^Z+AUg&nS6feliQeKN0UC_f7h23M^ zh0xrCNLj;`w@XfflGuum-V(gvvl)!$rdLB)4(5{Y@Rpn9E{XKWix4(1IfYR2D^7T$ zZ9EKWypwKZH{9zEzq!Zz$z#?{vGk9V6NU7Pm%5couY^Lxj>{c~a7&>xyQ6kxm>h)e zOFGJm_HrRhLfRDRF9P9&^GYxBVR3Sm&5^39X=yg%ZNr0%QkF*TnifM}K3REI(!`-r zmQP|;d9V>8_=w?+>L+pj7X(aOf~nz4sg+9H6+9T3Vu~2du~t2FgY8i)N&T&0mD*_M z>0j~w^~2wWFA0v$5UZSsGn2_hFAv)ZlwFL^%3hZ&t66i*Z}j+m=)*PqK5~`wsLJ^y za;-KTcIj443T6)Lueaz$UHhRB&8j`UlZqMr^nIB{@OuBzg!>9x9G9tVV*ldKV_2?E zi7buBDrd!dKc8urTF03a%W%KvS&{eIkqP#@p`Sj%L;-c*>6J=Cuo#s1 zpnAj;%2F}8j(RVkcvmd8=MfG&i^>7uA4$*l;GkCu`RH_7nYSK%|qF0t$FhzwD#1|segJTvv@e9Qx05(JiZxC zUZY1fj-6R%ER1~|gtsfm%qTvgYsDu$MDdhg-9MNy7{k_CN26+R1B=a{K6$01UkNQ3 z4cP41KA5KTPgZ)RS&O9yQ%Wf%Hx!yAepuA|VrG`cf>hRzLNu6u1%9c?G21 z#Q6f(SG{Ud?>PV2L60wi4(cCOYUKAVDo5nA#xTR-7PHLiFlZh67{ga zN+G*He-}1RsA}r-X@SFLRJP%yFZZ6lTsxBxn_`OlXDb=7%*hH#b{)0(ZRQ!y6+0TB zvfe57!boVuyvK%%^MweNVOY!EU@5lVTZ*`vlsbI6?(8j*;Cqqo!ANb#%6k=^pv%ip zaoFleNe6CFqK(&grU2ks+6PH;CsmVD*O4st&#d>~~o(LOwy@Me5OJXP3jWTP?1mVM)lZ^{@rO zp(npPy?(P-FEPKe%8pB36qPJMt+K@wmdG>2I9h8>&`KUJy6iI-Mukug=vXF;YI*d} z%}7*N{dh|`8=)i`5P?XKdw7s0al=dKqv(ZRk&kIgBmGT1M{GhD?10ZvN`#=X>`M>e zG4H9z9R$l+%C*JFcwVcKvM3f!=RE$5;ir`hG3-M5#^n6AiK<6|ntM#1mAjfS#iaD- zO@YqtY4AJW3r*#aBN_*h5A_>m$(~M@*`*MWbA5A4iszkY=}ANLzOn%x`R*abVgE`W zYp!+?q=IW2elszKn!*TLIC`+V#sW67vUPCJa8a*=avk$QUEl$&Ip0VA98gsXC>p8@ z*6q&mT8@<8t2fP3$(R-{=;OuUuzOjNKce8d*IMy}17=Ki)~g4e@7+)0k$AP=7zTW{ zWpYfrx*iqQBF4iX7zYEqn!YM3Y={Xo|#UsAMQy8Fic7|pW}U)TAt4LT9=a&^WNJPOPL9expQ}foN8DM zC9z#27?q+E1sxBvZv#K6q=DOx6jY8|hqds&i@qau#ZKKOGZE65XIM9}@?tz|CBzH3 zG}9*X7d!}0(32_n9fs z*(T42EEaidnL@AY_SUWzq|CyVqTb=9u8v@x?iV>28^goi54q&rkk&gP!qX*XRqK@< zqDxBHbik#`OB6!Q-R0ZMdc96<;X!zr7oe7|Na;M)TrJLCR<=E-+(0r8TV#cUp`+}| zGKB#NgFG?eZ9#fw=5{xhll^WVlc6uqG;=xU)Ot2i>*KmY&_!aikz~herJW(9zUs>gTm;r=fw6xHva|FXv)`De2uy76UP1E{ zu|FKsDcvcDgYXR@O{y0Pj}G^i0)*(5U+D`mb>r4vIZB9|ORjK|4L!cA zzS-#+xFJl=W%6?+ASl^uwmnL2hp{%*i;P`Qpq3errvC$9cWx;T<^Jc7R;f!$bo9Vg zV!gj-ohRN!W;iasp0hjCEfTolN%iQD_30Z}pXxK>bQE`^uRMa?6KYaa7Y=P;y|=OY zgY*xhg8+wLI>~8;#$JpVRlSXIvQXqJA<`G_SmaNH)Rnnw#>i4#gyzq$iG%Y}$7I4P zg`)GIQTP^T>^0d@qb@1R-~F@GMsl9eZDQ$Z65^4a7j_8^$GK#mkzUoL^@l49-VaVp zSMPKI@4@fUnA3=gO1QZA`%aEw>Y42kTVXG?^-Z@(>_58a6e!*e5*NpW51y2DE!LU@i1FmbM_(rw;|>(&r0eql;f;AL(Gx9KBw=dn6JJI6vcJvF#@<1aj4uM+ZZUnl#hW4 z|9Rl(e9p7_5ns4u|K^gk<9TI2FB4B)&KEP2`hD!3-c;EaL-U<4&$(s)+u;8_lhS3o zMKl-O+Lbu3J1}v+G7ytm$qsdO1)Mi~PP>FD@D^4d)j1=Gt{TK9zpiu-pI7tYb-H@e z+jNNY%D%FQ`?6FYCsLnx)5n-tdjH$td1m`xlm7o@&}21wxOW9(U}>h+XHROh7iX!? zetm! z)PG5U?aXQ)x`lIvTIeqJ0gAq!^jn^B;B#Vg9tjM;Ul({B-%n{AKB1C4v%m^p*zvf| z{Y+T>aFn5bE`_Azy#4UD8d!f{PuzU_=A5l+Dg^_R{Uq`8d1b_(z)Em?r};kXIZHm~ z3C`DRQ#ut68Hu7^LS2_as2?y`A#($Yx{=KwkZU^Si&=Z+VvSFGBoo(1pOcTH=uvwl zT)(f%g`>iCGqq0Pvwyuh(-*)hfJn&uZY$jq%c#|fn$d;Lbm3676mA(o$idky3a;+= z1*e?GwpR}XpKr8y9#uMR{hA4B8eXt64%z=&W#cinTf2-~=(CY5QV6_N@%Ufrny=gp zeU3_U)_dnDhx%WgvyOuzox)TELNrj|ho zMo<|qP@U=3`Vt1>Xbfb@+g$Q{<5f;kLql2~OZ4m2s&9#CZ&~!ER}9`OHvo=F&r~!- z&Mo>!<6HOj-#q+x_xxZf?kdr2y7S1`;^aXXa6p#Rm-vbec#D>jx{@+Xb2PTb(`B{* z+?5`7n429oONoLm_38KS(?q!OS}#7;)> za#uegpk-(A(Y1JGKqUI>BaiLar(}KGYY`o;TaGRjedCnzb%lo!xV5yDx*8v`37ESw}R*U4%!6{Z;CCpbMpYT zp}jO%l2g4oPZ=)gcmqwFwh!oq%t`(>Y$9PgB9Q@UKx+sg-Q3QyUcaun*4jLvET#~B zo*v2l0^hI+1VTk*0fS(Ti+qhYld-nl-4?_@aj#@$Alk0klkI?hu!!n@LrUd*Io#@d zswBQlifB!-=j_#9r`qBV)chKyHsg>?A>NotZ?uB@-m>Z5%7Lbm$bS0a;dXalx`is` z7=;k@oyh!}=47{6%=&nhOz&;Uj3+1xE~j=i3nV-*&;4i5Epoxpc&bVKr|nN;^fgG!L#lSh}{|_fg`J#dECZ3tdS?=>0dKXL@}5el+?c z>YDc9&q62!Wof)tIoslSbF5MZ_ft0(R6dGhR#a_`Z#_isLbA6rn3_O$#a!X2xtEoy zGVGIbU}rwq8CSa2mGoe(&JlKpFmh?3qb&lq%8rgRdf7&CI4HiqH|evXHg^_8ywena zr9)91$Pv*YQch|}%sN5x;=TmtB$FH-pTfcA5Rv0@;caXWnYeq zUBdV^o5D_Lr7_X=h2xF7lN%z=u(&PP4z@CZ#wk+2>-3>u1&v7BPi%Wmb!%_(#Ft9g z^=a)sVlfeOOMYR{>Xtq%c@L>eyN8&uFjNlUCoJbLm7HuZkvNWoc7WJax!qS@tV*i7IIk@mU*oTw=0~ zQoxN?m5sdjY;v8?u(-thqYO-3C_^o)udolN_Zss9=hZJW_8`__SX2+yzr7$6A*9d| zSE>HR2vg96tA2-KJx51L|qKWX;ktK{m7h1h&e!f4dW z-ka;}YER?&ELi1Y*u!GeIBTy{x~nDh+Keh!hK z6dlXtvTho%|9n4X)Yfs*lpCH%P04Q?nF={bUKkOGD>8{j)Y&;_4=$ns-*jllcPs*Tf#;;O(HwhP5hUur*FNxGt=U@yCRww%@VC2xc!`f$6J z>!^j?VJuf>c0=`E3EKrf>1#bcQkC<`5Q}A=23WGKSJTfY!Bn@k)idZS+Z>pF*L! z4WUF-LmaxL)?pxGHYzzVqjsONk`BE!*I`Xt*;5Hu=RNYLUA^6}=XCogwabvI+eJw5N`{HHY09&6>O&q_&1;>% zi3XImOs(gB`X}ucX>8~CVMz%(`pd$$nRk`Ah~&#rgTjz(qp_(k1|i2){r)U^K1Zn3 zlV)%I%7Ofj>JAggGIRpyB8EGq^*Oqk;$^b^O!QZjV3Z+8ySfX+`Dfe>@p`Ov3HFz| znA>j#rW`DvN{{0VY9U8^mn1prJS}RdZ1R)@tVVLR6N7g;R>w~i@pH8b!WVfM*bbl) zFg3pZtCQ|%o28+GS4DCL%RLfMHugLizB)4Bhsl1h(3C}2YHx*vWYWE=sQO5QamjRW zwh!gGb9nHY*KV#~G^H&kzxwuf+FS^c72mLUk!a}ltR$hz+EDEy*$Fp`<<#V|VmF=C z8%JAub>7%nHdr1Z!hI^s{GaXiRyb;!F|l!V@CidLvh-oW)w>5PyEW*N5$coUzN7en zRMnEitqC-3c_x<-+EtP+>dwa4K7UX4_q45P{Iv|}9}iVNKYdnI zt4|M$*VmiKS{T{ipgh_GZls5W*?falX2$X8Kq@LnGv5}wJwq<4*l(UnKj1GE?!XZx=$)1`8F|A1zh3?4ZvU4S& zGZUOw&}YAUX6-2+QbLlOv2hbHKL($`L3OUZ&Bbb+qv@lL z@C-hD7Ml@h_^n58St|Qkxe%h8R4J;;WEF$rab=~7)ZLmjwl*-;YCty3xW(Gwe7)V1 zCug=aI5U1%uxxunxTg#C?CQaQO1DMVNQn29CFnE56FzJaGSnH^=x1~xd<(7i#aI?^ z?Q3|$T>T=2N`=Fm17A(8<(HNe-w%P`6ug{=m2yL1iCGznsAAH}r>r?!wx z%<7Mcx}C@&nIwOPYl+3_>OSSxXOPY_w}FnLk}B^ z>5k+wMfp{|+h>r_e}Zu0_5gvrbW9_~y7cYNNA1|ko5H^}TknH;M3XTIyXS}h8pRao zM-+485?$yu9F3z=l}v@C=PB>vuQhkvJo7q!(!fdA_%A#QyPtTS7Z*#9Y1x@m>pYyJ zgqeBIJ@8A=pASzLntB?e{5;xZbmsp5-7kbeyv*%?EB?Q392Jjsqf_SOlDZKpeR9qp zjz9Z#`28nm$+Ieesrak!6cc2Zp>>+FeC$w!p5t@q!$S^Ug)#k55tf*rm6A=L{s`L=bnK8Z$o^h2J_w;j>Tf6PzUO zGkhb&~&kGSNxmeK6?NH8`r3 z38ZjLC*otpWS49M60++4ilT4L%}-wUc4{cKE*?tG*^w;j*c6uU)YRgt0AWM}YqvZb zVye$8zG=?H`9dFu(^YXgczxAIEu+)&U{Dn|R_Tqy!=ewA9!wtGSZ^DN|J`eJSQmK8 zOWZe}FR9x-#|dViyTVkNz|&r)EcO=lav}zi9(T|qdMcC+;$qZT#ubO@R`K+;1ur5@v$V_f`b$D)2*A68F0rTsh znNk0pV@k=sBV|KXvrcVF^JXalJh8$-1_>WeH|wTxn40_;g8qrZUncVsi@~~Zxph2h zBbscaEXHQEbcC7WlE>U!aQLVvC%bNGV)gDa%a;B7`BVK$#li%0UxD#O?JDQIyegnx zblVDGOn2R!Ryk@|-fFnG(ZNy2>MRzuQlqFa@G<%rC%&e{`$#B1PWPZ`q{f_qOj~dL zc6D9!1qS(>95yLFini68Pk@(G>d8HC)r(OY{aO?o%!_9$ZfKMSjDOCK`%QuVsB`#& znA_~?a8W8|!Jv{DTaIR4w3JS1aRd8NuDxtksmkCzE~gPSx09N^^lq~h!K$?!i1QIZl?hFsRz?~G z4IQ_BLHCk&eZ zjL?3Gr-4Sqy&Zc`GwLmo{=vgVz2#4j{H>>~;_-Yf?5%)G6wXng1Cx*AQdDPBN&mdB zlF(g}hf2!*0_2db4&0V3c1|LDZV*d18kfo48w8GGT^=}a zdOv1{l|H5>gpgBR!i8C-Bq7tnB*hjq`BZV7z_XW06S<>E(`v=jcq4_iI{>r@wMN=> zn=0qN@)sn?M{MgAXqEa7i#iB`LeOFMOH%M6&6q>*iq&vcdnF(CzP#I4laNxYNk!&_ z4{*j5PuUS+bS{VhHhd?uJ7b3BYd!VRxJ5fHcn(*`WRpFp1~Fm`QsGkDT@Uor`xETI z>aiC9_ehgW`CM*yB3h)_b-683ut@m8oTX}VKZ;pseYJg{H-?C(UH}ioP5ImGN4<;lW1&LhB`HTOcHRR%CC&_~0mE6fhM3Y}`m+U)+jIw)7i8 z!S66Mq0nN_pFjL}+mm3FrIx7Ax!m|oWSrV$v~k8jKJU<$9w=*?61lkgPL^~p;GO#z z6K`jXsXo=gr?)_kSC9&{3B*N1I~l9&FvaK9miOhz;$4UwmPGeZWjnEDO^YNmhdX}a zvZOuYyW^0gT%i&xndT4V8E)@y?5bex6a1{+y$Xqc{$^_~-8}58GhyyqLfS$l^|is8 zD*bP@(5&#jYHiiwLZ|mO+4x^Wc$A(FFjhr#Xlhu-)t7r83(&WlxCzqNc3;=uW&t2& zx9CYx%MKnKpj3u8mv4j)7eR)X!WG4;&+a2^A0^-hC2hky&%vg?>J0uXu{MU(!If});0eEJwEFD zx>@@cj$dwt;nDmdF8mZF4n`TL@k1*a7Y5@Ae3NuIgp{u0C2+Ym%arVg$XOZbcU<`+ zg<}zm^%6y(tS z$czG?PeF=-egp^S)VIg|PRl{oWg!2N!T;ZWBXH=cFbQp!_LyX+u#^ijaV9|#s#pk zWV4si^}mhz?-!Cd)r(vUhMZRxb}Lkf>um!t>y+g+Es-Uc{ZA`c752N+-=W%i_-A?| zG##tgLRBVdeNVQn`Aztau%__>PC2}}s-5>1F$DC#$b-B%la2(z&O1ML&a@@oepR6Q z&J!?tlzds<={8?)qU$jSI;2f}^Z6SMdB1`L0{{KIms~F|?%jiYb0?i#(I67z!7fO`u zSwjzh;b~VmyjfU(JZ$g}uFS4GT|135kn19PYrL%)V(z)x+c)^8=7d`RlzvG&`1P{5 zcP!Vu&(N$1knx6F&Ed3(N-A@g@s#sAjqvPS?wD&Ic3g`Sv~n(V3!&nC7@e<`Y`uU# z{}>(3?#Me@wxfxj@Jd-R61Gdkh&IcNhS)EOBBmX)r@X_sf&rwSU9Muvpg2hQgjo7Kd zz5d#mG9jn%J5s^r2ZQ{yoQI()}s@>rYuPzRY*8NJ&2iQO==Nr>S zBAQ|pz-&_^`3ri045k~s1~^C(94cu3_D#B`(#iVEXN&&KaDGEkLAT{dDxL;LMEe2Y+!2v2f#I7V zJz`@arK9K8qjbeJp;J=OZM9d!;qccBCWF-1v#nvOTjR+}%o^GEmil2XRI4ldjtiy( ztzmF4Zb)Y&NCuMy=+87)yTx*J&<5=Nj{5*0r@Q1Ez}>qjsW$-QO3%kPI7|=Xuwiw; z!yBz_p36SmNN6dw4y7;*xyI-rH;Me^o^HmQGP;7yuX-NDM(A8|vAVbbx1x1=tF6_~ zgg92zt8(D8fj*D)+I4;8`i~oI*7XNJe>6Im;WqPXji$Xj{ctWxxlSzjg+8wD8*ox=ne?3~-2HarF0C?oi*z-36ME&ld}&tfMw zKX>`NCKsbl^a)|AbSZ-1DlGE$)rRvnLr}hesQ2oS*3l;GcxClW#d{l^hc_0r?VrB%ik&Jw z;?FyY-Z48mK$Rjos2_~jjPHH_tn55FWLM|3=CNL3wpPogTUx$b;lua3Pn4;7Hb==P zzfBW8Td8Q*^@9djPMRu$|H09W0^DN((KZ_EIs9fsv;xi@Y9$NjbSv7Pqv`^`X6y#) zP9|_1#A*aD_DzgVs;cae2N-WTCmjZD@yExWjB+v^ukTaV92`GECF82p>P)a`_z1sW z_b?ran*1)ZvQ#QI39Bxt8r-Azz>R611F3r~-DNf`a-9b%7cSq3^ry9b2E$)I(9>D3 zs4Be9q$e#u)oPniACcs)1!M;S!NH|yVIK=fY;=tWhXS?dafO);?MR4XqwbHEhd=4% z-)bHo?wbNWD%H5RX=Y_G&kX%t+BV8#BP@GwoYAOn^dn>l#Zf-${nB|owH(1v!| zX<39YUDz4PQd$YI5`5FiCUrZ&u#x)51IPIfh_A8yb_T0pKUwuaIQN-XZl@W8j19Tf zJ49lhP4?s5pLae&{4LZb;)FDi9} zrc#F)1x6IiRpa*g*GM&LcDe_Vvk9EuSQ~*iP{@dM6R`>|n@jRM@yo1Y1u>6Q;NP z3-w3_#xG<%XuKID7s9B~TOYLmeQbxWzEE?`ieSgl2LGp@r_H1foaP?~$S+6IXfsu^ z0C1r(HB|ZEu?9L#;bGIhnumPv6n4?x{|5}ibPa#M;Q~PGCUnL#amyr%2 z;a0B{Z99nBnx&+hhdA*)Rg?PrEPxGmAO451blfhhV z=k~P0{%e!v)^8pkWT;+u`sC*2kg5tzVQ1dBE;4V!>AoOvmfHn>o!$x-Sgu1i>QW%& zr%~Bg7l{ftd=6h!Lf5twtA&O13xIF5Irzh98t<{iA${=d6bds|LGX z=p=M93wr(v9dk9lLLweW+29bo)K5&p44jBaR_#LR<$ zGLAj9ApPJ=(%IKEn?y(EmuGa>g5(_rZL6QTGTA@l1bixIt>4S)xZzj*K4Ij#wA^y$ zCCsGgAvJa-1^KJ5AfbPFcD~{mSZ%eqni$4u%x7@H-_QmRzzo^YcbEUHiGdZy3Q$k@ z#uej7bZ;&{hAGhdyL?OU>E*UQgP-Vx{{fza@Op$fz-)Mz29~_@39`iu*b{4F#TBmH z`MbUUv?G8;G1j-C8d-nA^}ks4%v=72o!-%5ZcW@?gxm)qqW^%Ye^F3=^`}tI_6h!Z zWtXl2C?~=H>eIPUjvc&|J-5zzWsgHo(Mcsa!EY4mUk%gQ19ak-(0eY-dwB}wdJsnU z&aR909yR zNo{?QDOy=L-+c4p$(c(CP}CSx-zH^=}unrj@>(B(ZArf z_|wxTAmnPu1I@OU8Mm}`Y8RPI15xg1_IH&k#iWnyUu$|>uii1)5A4C#t5Ue1S%vo% zFp-rm8}2DRFEpDTdpd5-%Iq&T5~YLv<<{P^;PEw=38qH>kWe0rzSmK&Jt`J!=KW2nxj4v1Pmcuth%t7WSVe|H=ywwSA2fftR& z>+_iWG$QA54F$yMIF3Y@bl7dlyUfh80IV`#U%YbPFSd9KoDtI2M=uACeXxrHD6_-& z_{elHH*Ra8OU!h9q(o&NUUe7jqlK=UxA#Fts>$@X0EhVbE3ks$kVjdH$g+e{iTs)b>J` z+*L>FiRP4BUhXUI8#U_IlbhqO05{uOXy_9~$S{-BZRRzbukX{g){Lm|0lBUbcHj(| zA9vpBPCi&~wQEU7htP;HgFMO51iMYl5|qzV6FyjC1G>m<%Gm#F}n#JXyqavFBFl zal<43$3?}WEB#WIYWcVPL#UzwBWM~z%Ax$wVYZcN-?p3al;zuDFfaN)p(jgG01k3c z8@Ma0NM;mzExADuiA*3xI}9A>GAtCutjQ;lf4Ez--7)%tkS~Y_lN#2U!mo5A9z$_G z!S5P*Z)@xZ~rXR=rZoPM)r zE&DHl^4c$$VjT0@NJ&WxHDl6cty<3uOv=@-tM}(Aoe|u2Gspwb*(Ek4l^2DAf$G?r z$|vjz5iggvEBD%wJ?>zYCI{!$$J}ehSp<|q17jT zr(Y?S_>6MdIF_^JlAtv-t!T3anFnt=ELt{zejzq|V3j!672@_p`yN4Jx0W zU#J+x`Q*GhbW1&3Eo`F`+VWNMvfL|NLK}U=vU{bImBsi$oin;y>?E?nab9+=-DPx* z8Q?N%A?M-^{v*bYIxcX|Oh(;fAl33>`A4&8|?(!zc=DYkzZQ{ev0|ytV6g+ej1S}Wc z;GDf!-su@W5DGJ!sts^rQD2>p*#55wgRP!NM8jTh6ry!OQi9EVT>lr{vURx8xM8z5 zpgT_!yEQ);7Ud*PcZ>AUndVQ#3}U@kOd3&K81P8dcAgBTwj#?B1DUXDpPwpwa}5iF zsp(SbQe!z~|Mm4I+-Bk&=b+)zT@PGMxL$=RSgl2orG4U2xTUA3wnRecEFckz3H_-J zq=dE>y&u@d2eU#Z+M9zYP0HiEwbJcxq0{=Wfdi73vvr1T;!RHFv_pCqv0YVL<%{~4 z{J0fxhi*j>^0u&kocOGKN0W$1_$dM<3fOJu&dSf|Q;GPo$2#1)1=hgEX4R=mFVX?N zyKB~^=e(CJQnhAfN;2jsix<(5X$t<{Ro9n|X0@1H$p@poqn(sRZ?tyemm?7mb~oMx zDXUh!L6NBN)ZzYiU;ZQ+B;HiQ!jgvS3v}sPfFQ*TN)0gBrTsEBG$xFH>^yW+F!4e& z`z0L>iro0)Mj{oM?KsQZEGwlY9TkxJ?vS^Xj!DKQG}m+V-L`zqrF0zmhC>rxjTahK zrmffYVh_1E5R>xcCbgGowGxcRQX@Qn+WRmpI;1r{AmWt!S6OSgNUsT(Yq)3QF@#f- zn5u1J`84(M3m~VEcivm(wUXrio|tN->K5&}Z%d|6B?`1W;Y|G*&OkcBFOi>Ex;)8X z|Ct^LV@rKR{NbGQ1Nv4kAr!1oj`bOrU9=;3;EF?71oL;(Mj$aAwFoGJbcc=FRv{p9 zY&zwwOF~^M>vf$Y`Vb+ebNs(cl2h&XWbf7N_iDfxORbOw;9Qy0BT)jW#Ju&O%%gy+ zY|mEDN!P1z;H#2>-Dv(s6_ux3Hgcgux7bx+LOjCJGHGznKW-N`{J1h&EhwJ%F`3z< z$zV|5YU+Op(!^y^L#OypHwfu09&}Hyx#sDVm{w@t_5S&hBLkd^^dkN=l-gU8bA?uv z)zDk8N1i12E}+ObtzJcaQ6-Tgpta>5;PK^cV7N%xqTQ$j`1?6EZ$nUORYLaZzYZ1v`v?!Zj_4Sr8m$ zgW@p&`+@FVA3wP`R|A$WBxhZ@Q_uM4Bf4R1J)ul815afGHx%!F59=>)&A2|5Vb)7x zJ;D+{hYE~ilHUp#eRP}tfy1O(nmYhjR|SF_`uv*X${H%eHZ{d)^}LZ1QxI2ku1ryU zldGJTiFYs?6edR$^j&<7G^HxM|~IyM+bzf`yR(t&e5aKDC;+c z;YyO$Be`*26lvQ$4`B)*`DgZrzwQvK1iIqzDT$%d zc`V0c0@kI440r_f(nScCnh6IHOjdbrS8$zegH$s(1RUVsl z9i3>rSp!1OLwsHCs>x0wA!2*hl)W&)QoECvIm>AwrG@wn{FVbl5PLUvntW2HPJbd= zF25ow(O0%WhZIriv>eOG=uGBSnWoBf|8p592pD&<_e#zf0;$?zp-C3vwOj&UlBQJm zW|h#dJ%ulO;@lO`>@<$DIB&jV%m!jh5mDd0wz6u65MI zwmc{n*RQXQa&u2DOFeSMx3w6TYjHRru(e16&Y*M*Tt5Q{n)v84(Z%L;Z6f7P78`Su zLZp2$Y23#hB{Q}7yEG<<`0ub$;9TF?s2x?^!3)_OZl=c5{nK^zb@A(9dE+70WgvDT z*`~jl72_nvbJxwVcPiKeWKjeyLR-Jx+Z%HX0jWu%4fUbu$i{C1cF%V|`Bg57b$uCj z3mE3``h(Z1FFBkH3wUhMf~HS@ee_6$a% z3&Q~kk5=jz{mFM>_i*{Gb#D2J-^I^8u*r~55TfsDB);ud{ekdI3-53M5BS}#=c#NI zI|*K+jIuFZeN?I~*{idmjQ`-HpVy57Q(>3>kM_PhD5|WBQxFi$iohU(I4DR~$r(pQ zktjJeD9}hovgF_>qeMYKGLq>gb^{GfG!UB{ZMtcaNMHR zEa1!8_rQ+F#bb(9!hO+JeJE2gO2>13o?9hem<}crdLX?mU=09%o&`ymiHCsoSwZ!N zfuDy&{Cp--%z==qT4C0BI@d5eEN{5zO3tS6&q9H-~m@{;?=0AR6 zD5-A8V!Nq}Fuu-pz+Qv45>!=+hAC-&P7VHvvCh5$7uDA-gMY%3|Gnl0zKbWd)F*!^ z{QP%ev0tD_PW$Z*n;nFbrN1ziO!ctyF)7iz$*q%DE^J4@YX^z_x<=(SX#eDYVFUKW zTV@U6w|ur;^ilQ@4I{%kpG8n=_arV}12of<<@qQY^1i7iyRWyoG`zI%ENyXT^;E99VtMp3#Xa zBoRy3rwJ+-#XOq|9c^yd5*LSj`!=$>lV!YY{o8WA)|<}hJ5Y)MSCeOM)Vs5?4Zses zWw6v{0-U21M0(2?p)8{D@`C|X3HkqI`pJ)F{CF*oD80~6jx&h=n7JbyjA@=HM3Qs3Kha*>TCJl#vv_sL?%&^)!aZywFWPci~g7UYh{qs zFX%Xx1dKFk$wdaaw(5Sz%RsotydW~!kuq#E^lbhT&|mVIycMS?pc`+%9s$(2#IzmZ z1Pr%o1jZ-DIYjrTJ?fuw+D)oRpHl){3EX6;c`H3Fjcj06U?btNn&JI@LSDbxx)dKj zrDHWvmh`PDP803Az~gCK=fAH}B!AmuFI3FPZoLfzP9Rs;M*t0M!cA>3levJG2@g{Z z+I8FxKkv+^uvoby+ngkY3K9DFUdGD}W0)kV*kjRl)h32-wGB1ggzS*zs`lE53=?!G z^F{|{f$E`BYNec%jz1?I8GXf;H%^v>pWwhWzNX2(MuDV^`HED9Ul)NOLaHDj&cNr)@yFQpAv-hz}@oW z&(qU$v>BG%pg@^S3}h-n`eNdVLKf{2vm!91K^LnDtf<{Q+O%HjT@gj4H);ww0A%`} zEL2|q5}qvvEnT}xt9-vhi{XV^gy)zRGEx5CA$8hFC3dV(xv*Yl&k>QG=~7*jx3@VB z;c6)z8S0~-M1`y;S{M+|x=dNjVUH=FFz~)(I%OSux;XCeK~xMtXmGB7r%moroXzQ+!L#Lb z>VWm4T|=t9Jip@5R-$mKffdMOd9-q_%f*G{O>!zVJBKXVcqB)hCojNib20R3@DLvV0N;TdnTpbo9yP0pA*Sl?aj53N?;r)Gi1%Ulr7H5toYb{#v z63&?jy7Qb`(n6(U@Fo7=7)^Y_4%wXckAoyT_B5Z}V9BaCt_)#5Q>al#<;><={&KoR z5;!4ZWZZRQet&raI}&3LIM@m%WBftNG`+kQJdYpISCOTwZnMcWS^Kxt6nZsEXZKdh zh|&OvmO;wzUX;oLbozw6;!4{Q#iN#c+dfxbo?v*FWidMp2KVZuWysSt-ZEF7j2OVv zo_KejGyNgPo<5={&Bo2@nNqN7Xs?}v+G9LG6Hl#U-%Q4;I`UcEDoR8=`Aowi&g=1% zPRdS$2!Dw}IF8dW%i6x*&{?~3hbF-Wop@?8UnO-%xSZj^4ZhC(++Xbh2g>C2D2+~g zl-Xjxjfcw>Yn~JNOZzL8UP+!YvOmwE6uUvT`ptfA6Q63+SnKeU233G-Bx(iJ3PT|z z8niU-`(XbO&C+9+-(B`g6rkr+J)3kZ7wi%BqC3C_L1J|+@TG+hoKx53gN>a>4EWHo zkc){~sAN5nZI6 z6r0+$2A}5>EzxBA*3Z!VMa@=W6~8yKGF{G+KXQ8y0ypg3RFN`urR`LvE(`n+a|l!D z0JpP&edU5E^0XG6l!)V>`a(+C0|2Bpn$B`& zY_>gK3tgu3`n>yK>(!*i?5W+20TVmtQ{{ zT@P?3u*_x*6A4CEGMSk5`s;%-=DfJDrb;8QMSCo?cO!+@22-7~MX(Vatn!e<&S_-> zkw13MY4DPGk%phJ0tHNKNriw$mJ2sG1eW2w-W9Y8 z&aF6kHRIyORs(%W71i*WZ7l%dIzpbp?_Z8;Pa2Miw^(uM=mt7ag#ChnRNrFy8M$}B z^%={vEnFv?;=|e48aOWkle64O+8uJ=)O-1cVL_8Bn2Faqxkwx`5E`zzZWSz9s>YNx zVC8QB1M<*7M-MwWkh(^KBtT7~cbw4h8?-`!fGtCZU%gXNcMy2(f9Y{FIo%F{{??UH?bbVS9eb-!f$jzkL=}T~6 zWzm`>)hIbb|C>#34!1|>-knn{U$^hjoVhs{40)!SG6I)n?xJ(@C_qk7p@e&aofhbT zb$EZl6{h)U8+n7B)Pq&IhzR+2ajNbU-snFKUOqQc^H?6Cz$t-`Xn~#vE-rxa>;Y}4zO*8>W$M2Mqtl5&B#6lv(M*AmwKq=!?-btGI}{3cuV6IE)BMWW_j zvDlZJ&JT)zxXA{%aH^%PfVyuowW_U%>=HhKiQC^IEesuV(bnE3u9!UdV=3Us(UZ5? zyRV3AF`T^{e}_r^*}ALoqt3W`Mg%jWO&+=_Z zs13dJ_6*d|CE^fuI-W|5f*CRebiM%~E}LnlIGT8^q*1`?1|uF3E8wE~lzI7@NYl^8 zJ4Yz5@J8@c6h!oyKmIj3K0@isw7hfvUTt{9v7a;hfBx;CB_LRjNH(Sk`ZZervj$x2 zOfge9#P03?|K9)0<05}|`pnyNK>O)Ns~j(^sCN3dQ~*Umy2m*#>J(IE>{QVGH|_g- z=NxG{_xSZ#w9r7v1&Z3^dXxQ`G^o6Ex1~%AzwfT8(g(=a>^Q&`fbLxA{P`yT?!lOI zz$a0{6Mt9&8nFOibcE0G>0g&SyMNsT?J{FMrfZzwOr=wx_d!iIc{&+24(o&E8kEk? zc9+gc3^*M^7Fd2MUj}_PIDkp)nK{t$(!NweEQ@v=On0vib(bdWNUK3&WD;K; zAo&B5_#1{M;L8M9sJ&wiliSNL&WJqkly{x|IvU7X7x)Ae%qvoD1c_0@U_!FR$UDJd7qY~Mq&QL#F16=yA#b(0}JkYdhbn5O{>hr0S43%#+q&t zy9>Jo#Z1@85_6xsl+eg-yvwr(=HzekFMtErtJN!fsxI(pVYR4E0=*dA&BzY;zTQ7} z`cfx`Lm|gKMHcX@@*<<6M9iB`pr?|(N`by?VX#8eV|B6%h+Lz2-R*}Q8uQEgJpJbknL4q1mxTT zrGUS97yaILE>NQ8JQ)3SQSM1q^7FA_dtGqI<)MZ>m4X=son9D|EB9c@@FCydG<${P zlG?Y}7K732-XB7{>jFCW)Av@gwLA7PvU}^AtWus@5HvnA%O0>aw)ZQSN_d`-J*2XL z!5Yu+zyA)wtmBnpxudeGLwxm%O)Dy|-gK>|uGBbImDe6<6f*-=`i=Y7GsM4;Y8RxF zrPkVga1#??1J(z`z;7+E$qQFDh?R>@FAPxxw*;2XSsan#Wl#|O_Gg;K_cmIEqco}Q zG+$?^V3H*c*-d{vaCN8rLrz>@t1y%mZpkI?HotZA6pLtY^+fbrj_4{ueGq$Ueu8Ox zj=r4Q038$HkjhQ_qULQ^fFTnHx3<*YjZrn_d6V{tvpaQ1C4svUOuMiE5Xz?I3PW68 z7!Qb|bx7qTUyy?L)1~cUWpq>JZ=*UGFX2kPP&M1DN+?#AaZ=@)s?XkruDyI-JUy-F z8_6GiOBz0=C=c*!PxZDvjm+a z^L)M>phm1Fr`&RlS4|WjwV$-1!|kWe&rO)l(p|b88ego8%Kq zZ{=~CXvyqKSD0C>^r{%Zt~QMd)=bl+e@Y60-#(hs{g{i^V*DY5@a!aTDqCzji99KC zqSK>=>SuTdEf3&7q2Tclv_ToN z6){9xW?J>I;74Lu8yj>YWq7Mk&FYFfq}aMFl)A+kTKB;wBwUUFg z0GP$MiY!s*o)&17(H5GLDH-Xnr~2HEV?S(L1-qJ1xdxnx-$3h5&}q%k**-kG4wNeg z3JM+=d>&^3t$)my7lyNM!uXcU+%gyn-i*@ zZeBsA#xkg-^8daXZq@vj1D~(7bRTSKrEMN&>DgDWUVVOg1EjQQeW#wHt2;UkA$?^FH8wo%R;-+c>nCrZTftE_=qoRmbfcJ5c z)OFv!b7B74U&))dwySa{R1iL&bPA36PxN9Zcau$-9T{)%>g2r#oa^k@^qkLO_>SI~ zDQ7ijGs#-L8yL}ewd$#uBqi2mgk&Y>MukiK*o9y5_-9>|zGt54Pxi`Bsd&03qAoS` z6-?B0Eyq1gc16HV@hJM!mxP;q%s%wFR%ZtH=Rw9NBT*FeC@Jig%lqjeg)>ubPR-z7~VM**SfZ(wHzVEI3@;-cg zL4#(7daQn15r!9$py3m=n70;Z@_+)|x`O^L^64p$QEE`)>hw|r9x_^hlCNE;)7N|{ zVHQ7?@ASeHh$^}=6jxw7v9&p_@ED#)h(B%VGNVHRjb@Tab0)Y7in0V;SyyT3MM=y# z-W01lPppBVI=yg+W2lttY!1*8SGXo$&gCDHX#O(ftY(q2X>nIAVs5^bA2=f1s=lrp zCU0)8%9UC*8hOl?Xu$FdgS4IN>?9v(ebP4keX%OU(<=k2rO$03+)_FGE?W`jVBL{C zq`LWN#hFqz1`DNN#=V!RHr3aRVYSfLn&OSQS4zNU+k7n=Ri)9=K>J9Tup}!NtQR0p zlG!WSx)aIBwqgDRURQbk&%r{uMY0#JtJe+T=I1edQ5Z_EvI-J*!WPqt@2C+=AC~!; z*Slk<|2ViBb?f|zp|z;QkY=u9Cp#Ud__Ja)_{yOaGoS`z(z1a6*@=-I2pP?l{CU;A zHIJ23W~!|p>SaAfwOey{Wego#s%yyko?j;8kkE{ls<4hB=_5l`k3z>Up(6;Ar71H6 zJ+5vY*2s+ZApmG@OW3(wJS4QPwX1WN~AQReH~_@xu{HHgHomI@!aX zB~SwZjOwZ^Nk99Z{)v> zEK+^fqmX^r(@2AxN}u;WEK{b+1le$EqNwBn0rB4u*a%2DCf<%5LZy&rzfR^gPn2|7 z9r833;lPPDoGRt8LAyQ3zHuBk}ivJk~6EI?*FVPg(bt)h)BLS7i z09=a)x-+mN=9ia?*Ecl4fQc)QUeQRVND~ChQv?hz?68RXqz=H;sa(SX<4_PTOB?Rg zfBtbIMq0r1xI){d(iQ3oDS^q1uD5p;s7z;0wk7OrV5M8-D1nZy6L?|vW-2lD6`Bmo zotgMKX00QEv02du@F^cdQC$#p3-1XuFby#>^TC-r7i!H5C-YRgUJczxu7B6>d#*Q7Edz=}dZoH4<3;~V@ zUbq^c`B(7yGr3C{clU}WVOjiF{d1sE%5G`(x7l!~vh`H0t z{@z;`e^?Hb2L7n)H0$e~5>$b@b(?qu^mR-HbjQ}G!ZxLV8FA}dprPm;#v)`f_P4@y zQ)fG8duNAXil1Z6ku%^U+gG1trZoznEc;NkPyuCWHk{Pi8R-ABDloLG!84O7!8yTe z=kx)VxF0Rpb!_V2Fc_3rz9kL=(?LO-JkU_Dq9KGW=?P1R3^A`}$6n{v2DA3nJcCR^ z^-^0-{2DMb3Lr0_9XFW{S>-amuGmaybfC3ney4;A!C3I2w$h};RF$0CmS>Ynm(R85_^6Gaa(2wzqZ|=Ut>xlc#-z<*tixr{QWOegA)}FJd%m8H_Pst z#QN29&3?)4@fK^cOsAOI$e^*Ct#B>mJrh4Tjk#IifPKea*Av^dbgB&W)Q^xOs;YvTI>K$*O{i+J>Sn3Oi)^*OWo0qLYlqWJAizDm^n z@MMCRPm;8U#$}(a4>hDwF9vRnF9`uosvL>nBT}X&w>?~}hBCG3&+Yj4ydBS8-^M4+ z`uLQzTxic#EjG8It-Ktuhl~y=zT~Su=oGBo9oxs1JElvi;?}GIuDso>&-k^A&R9QU zZsHtA6^-EO%K}q^x3HI89BNix)qwEdVF;zl`F^3k54bB5&y+6?p=UckIE#7tLccwz z1{jQW4?2`b8r1WHFQPkdc9_DV>O zK2;fRycNpiIPoHdbGDqm*c1LVB)OuZgyn%@%|;RK)3{i4Z&4Vu#CGnA$_~H2%$&l^ z6|NEO8}8+t1nt{4?yP-(#YwsBX3(#+1V(C`sTRVYNPH6Bn)$d$B2BhQxhs}ZZ!FF9 zDQRXa>jX3MYn49Ku3rAM<_Wrb_1Ls$Pt8j`K5Ws(e1v*6>NP}1mx&GMfp&+(GG!B@ zpG~|UjgF2U5C5w(H9$?muS#aY;-d0<@kg7D@eA47z~-_oUPKe<8C;jhU1sPLFQ(&F zH+AMj?S$RiF9C{e2QUl~eCDgi_=38qA;d=opq8#`hMWUxa{D=REMooTj)gOsu?o|Z zwflYfz~ojhD`B9LX$3?!hENhy-74gSbZ67L%(7%nZ`uT6M36RQ%`yRspK z88=OLhTk7bi?5Q#ntqF)Gmk!%jPBc;s^oj8J&?z%B zUMs-eKxDqq0W~BJOdXFtA|oMFJMFF_v1-o}i-=~yBg_oP^iak!#0Asblwv!a4qRu+ zYspbgM$Xr9|450g057m3CMLSYTu-k2(q-68K}luMWpnW%WS-wN zNs^pK?s0UedhaS$flX#6AL;)d>aGvEmnMK1VQ5^tc5l*m6-=&xYAR6h4vtj~^~U6Y z%ZYmNrx%qaKD=Z(1KTSXv1-Q&+9{9hcLpZpPzv14vucc^hZstxQ40usJM zF~4cXg5FnX7GA^D)?_;`2cPYkt6V)-u|v-Yh-!lOnhKFX^)$SQ=uv5AEgN>O{Bgi> z1|CZ=4~rWRYo>~k9dFmsZwx!VX%BB>fo!|=14aJBT*IW_5v{NQ)y@8}qm3IKTPlm= zEevfl@J3HubJ$JXXCM!nq(OnZpK>rMa72{a&JfE7j5VE{5d9J)((d!I##!K5XI};< ze&Q1^I{ak~{ox?tn?u{Mc#yD{jbjv}jf>aHB%CUoZoYv-FwL!hXIdVDrQ3jf1k#-+ zFm2>3nll%3fU#FIa-H+O-f0J%`|ywwW0ke{o~!j>MlldtOxR_2_z2p=tRB1BM9<2Ps45&iMLTy7thu;1oVW!gfDKwyb#YJra(`RieZU`?l2qdnNSJ z_cyXT^Fl-tY5}*W-E}Q(W8}pds0Y*GD;i)Ak$q=YpgS?mP)xEd{q}lGdy-=NWtT_H z{a%a3p|dBL1o#a5qtJSsSYV@efk9hY!pYolSI{+9TmgjXvfI-f(bpgS0rs_lv@dti z7EKRp!_$>V6A`43cGy@qI%@Lv}jsYpjf(f%9ufrEy=3-*yk9@WL7*v@`SZM3l&OQ z!~6GVR+KTW5_W^a?t%g*w!9tH>XmG!Z!HeaQ zwNxnECH_MrJ1U4j=JIuE@+WDM3M~I-yEB6u!Y?n?JSv8SenQM=zFNgrOzCV_W0H{|r2R!PpA z`_Da0bZrRnPobWa5_I@0JX{xi613i1Sb|A7Qa+1csiYMYJ?D1jilvYJl$<^T3D(Lz zz)Ps5oyS*b0t(9jP}~olOaYOYSUSe|;%z!v3d1*+%!Z;VF(00;S$WwP^WEG6nA8uM z)!E}9vj5`=BlA(p+gBsry~_YpF>=`llO!XAR=$LfHCaDkO| zA$RQOq;DBeBL!-s*5rQ(@BhowG&#P^c+bST`!Lm_|1fxs?@5V=!n9i;OO6#3u{z90 zr)~*6`L1gF(I4}uf1of5DsPZPVq)V<4l`LDaR(WLFV|GSVcBO5$ipU-R0a?5ME_=g z{4d@S+EO>wKT*X7k;bin1yoS3I+aVA(`-l>F|C-(m{vZC(fB$$bQ24G&Nt`*XNU{t{ z0RsP5rt!D$03S$Z)+Vsr2({layOs!@vus}OeZ!f+`E?xH?Ul~(0uf{bUeI{YZGLN*G}mI|A0 zbmfK_{f@c_iI#gN^|0f>-=)-HPZfW-XU9H_xtu3ThyQb<$OiN9m2ZcJ>4WYGx^I$I!NV)cDGYC63 zoOE62S5e#D8MdDSC2TlIL(q+7vAV!?UkhoW5-k83loCG;oW`F~^I2{bZmC@Ko6?>= zuX|TW_ptFEew;n0^@jzenbRIQ$j$=;K>)3A5@3!|oahf$^fIeWp9c{hNK_bk z)RhC8c{jO#zyDrxKw!+RNZ*zMZG8w9y>J}zq`#uFL~9*q&q?Dwip9qV)IU4pHyA9wZh zN+Pm>H~!By_V@n<>awR&8ZA|=mAPGA==_x8=O|PGAi%}wQlGN2CGoYO{3PWE50?8U zTH`c1?$@N{_Uyxtwi6(JJGcdcBzgR9P>asXW*x70%4}|e=}Du?I8*5EdU&!z*fj=p z#gSsVIO~^Ma2I3LY)Z;iG;y;+*5FRSx!^Z2Ae0L1 zGj)y(t*pseavsi;odF!#-HFJFHzeL0CduK1VW^b8_4biC3m{^`N zI(iP^aOss9UCt}W4w=H`0fsy*_7`?pQBGaZ_p~`;WJtCHEAECe5FNgiwV; zGWHQ1_Ofcg>EKf*QeqiL5MtK~_I*??f^;2b)zGTHYVMR-z-LgBBfEcR^z261A;|=^x$alEhsHhl1xa)+$VQo@jH& zNquflbhEa7G#aZ!vWsXaah+lpA@XtHFY>(X; zjO_vylFqtj!#>aTrH9WEXw!5dUyJyJ?*|l$?CjK(*00mI)WfFApdv>+5LC zdE*wSqZ4BrQ!k$W3xz_C?c~Pj9V#U2oS{7iqBCFmy?w z8ZE!MEAp&1ncn*|Xhs1DQVWFi4Sg;$4FsKVpSw7<@J46RT2C1{a7jG_8Mac_6@{Mr zd`fb)JAbR!tnaS4zQIS~C+iFWYqa9L^h07?F^&Y! z=QXCxdiPcblMSB|d@bXQ>euc+_fzvB^?w`ZnKhEKYL?ybc2CkUhNXMAb8hOKC$edN zkRF|~bxPUx4LcBb1>R?$rZoC^M@bE+aHOcR@*cPmVxE8UsT{+Xa(iwe+jz#SUatfl zD`*c}Tvk4?LCeunwVl5wr?*TCwpxk+pZ0{`c6^HOp=v7$mEJ20$v3auxb^D5GLLwB zgxQF>`5EvZ3N#>BRazJvEx66p&-~f`Lx4;Er9@r-BLg0<%YWKd|J`NTBdFWw%P%#_ zWH=m{<$r!O{~f>)^p{`#jq}g!}GBC zEaEk|sQfJFun?5i8^mq_a`)E{iwN22!Ns@{^}`~hvs)lqr1T4$zH&%FB+m&h-un3A zuqLzY%VZp9|5DeT15-x+F+dq$4$#0mpl8P~c%1wQ*(_#PA}#3GYajvx5LXLT5YJ&Z zts^_PY&qXOb6|!2J?6InwHHFOO~42UQw-Ca^ck4U%3Bi-F74MRxB z2iYIt-~MB-Z||42fSI}HzV0i}>pafmIInll^?_aNy&GO`lo1|l)~X{ zx1o(wFQbZQRwIgf_sy*5E50UN?c&nOJcPWM2+Mq}6)&SB+@H9y<%%#9O1M^cjk2^| zRrEmhQT#@~3|u>JeVj^QX-(|Q(G&TVw{x^mhrigQ+NvK+{g|vCSe7gDn<4hYzu#7I zn^yd}G6O#Hd9$f^_6LT3+33<{ky;e=4PLB6gjXs;CEl)x!AyR)MDk8k@>h<0rsgAu zf#J(s&PJv&^p6cUixwwa3%}94aQ|Mj__W)d@6A{I68WhMJoRe&TUW{Mf{s-+QI|56 zlf!rjUgKe0@PlGtgI5>8FB$m7z`zRk#lQvsuYq6jRLuWe#coW+`p@eN1!rFrRT7hu z0{@ka9864X9L;T=SV?24K~cj{WpyWYIaz)qTWb~rV_QQLmKWA`XSZMozTgKhtxcQ^ zs9#uH**NmQ5W4sC8~ot)*~hH+sDFON$x`T^y4*8rF(?JC)qgu(=5?~}o|5Y})Rq*Un{%6n^CRQ5aP;1aV;2FYP9DIU5zyI5n|9;}X?o|KpJJ~td&)xd3 zOTXT#;%MR^W@`4lECOykyYhh_>FNoD1MT|uiR-`^We{q^bBDnj4R zSavbt(;tqb753@f2E67ykfWVt8jWJpUDw2BNPHWq3^)YYnEPI)(h)lx9}2vtvM~0_e&px5Lq2oM`tRc(VjHL z%y6-!jVo2PSh$xZLnws=#|~HWkaJV+8@nUC&a3LnW2JeMh=xF^2s)|eU<#p?7q;3J zb`2Z+M)nljHqE2KK|wc;rIYweM8CY=`LY~=wp1*O2(_f2yF+2Cz4!&zG3memYbB^d zYp^jd`%0~5UYK$)I!b-&Hii8_R4oB3nB4eL*EP)Xtg8jPae`d z3H-2If4rw9P@ssVgsj=}|FJi2>wLQ1EyC))w;HxlhwhTE9N=zQ8AjTMK)=d$4=+c1 z{n+%IYY7v}Rmr1M$yE-kf}z@ic&E%!m0oCYqxI0(SgEB+qc0H;3RPIW{xRUF+;&=b zYrfqq?{ur3b?XGZ(GFIX4uVy?qGwObg^*HE{i9j;I{)5mh)5gnw8w1kg3$g1&0wBd zOkbu<^@1Y%O(Hu`eO%OjTjMKiOaXZYR?1(aiH} z<BiZ9?^zO#fc?R!**;}BAVZsPgPaM2b(%omsMe^Z}G zxsyXGXCI|yTdTr_G3NoL?x?OXi-&%Y=4_Tvd~`QN9=l_lf3 zE$OPB#4B;lc4*LajxHX%E%n?Dfy4%@G|x>1k9i&~Bc>2;R+e-L?$olJ4Z5C(CcSEi z>~fs&#PCpd^QJgc&&pe!x{mvrAN0Lz4rT(@RkSz6?Db~dL$q(r6aCge@xV_}mByD= z`v#JljoVYaq$0+PWx}jT=Nnbf8QHGZR%J;>$SGK!6*nv^wo1MhTeoWwN|xck8c%xD zf2&JiV+122Vm>oq8?__IOvcp*4VR~u^O27~%$P@{c!tAJLsFw3P1bfK_7SQlKeoFa z#;wao-5eJ>ij;_9Vw|1Mt0M;8y*Y7MIE0~KHvcu$4-L`tIxdAHr@K-_Sdn!{xt3bR zUAkV!u<8O!o#lQmv+iW;a+upk^Tcv8t8}gmTlfbk&Qn{%tdQOXwYH>yyWWq{11z`g;s>Hv%S~V&+V~ieQTLY?fNPZfuv)Iv+3Py( zOu}DklTF2!NzD;u^2!9}vG8R12)aHyD9ed3H%)MNPAHysl{2Ay z{WWs3+NC-xe?_>HxL-fcldmE7b)YDgZk`&_nS}-zu0lp1x#r0%Ir4-|1S)blrm%ZK z=P^vLc3iG)t--V^-@Vsb4?ThUPWj7*?j8A%*vT~3^yPAllJ79nTumuD$ta$C!Lvh! z0o(SYY3E9>KaSBW=DIA+Dg{1|*&trywnzrbm|li(d9bks32wE}I5ZORN`CwNW`3l| z=%e8m{N9%lrc6+t1kYs>W-R6^jCv(5$nN*XD*_2>wHD}=_o94y5drL#{BRjS@ot0b)xUf+(h^@s%Hz#2;k^U zbxr0yeuH1Qw-bajH`Dg2pZ|Roa_r{CUmAA-J3Ix_)4)dGFXN-5IZ-}2Ezq3kR_5@w z4*IFJ_K_0l>9}euk zeR8-+g{XqdN#f{dujf5|8vbH7&Makj$$P(ya;LO=mX_yNBP@9r^X?_zWljAmme^v` z*t#ktNfxOA+3o(_znnVR=(U(4o2m+<<;4a*8n<5KbKlD+sye9h#feDVt=%~Q`+Ek& z8?!FAYR}ayW%*FT|GGWJFmL>E6uZ$AbQGtVyt@@x9hBZ|NjEjhZFDNQd;ewwf>WO%cWi8Co}Ik`1+xEGy<^1N?MIAz%g#YsSNH_R-}sQ6uT(?eRkrTBdl zXTpAU*%zuWY&g1;ci*$!|r*b=9*4N=F5GV zYwljtptZ-P&7Qwo7Ax;irqm7W&raFv-t1=M*Q`#p{jJ=k{r@WDWl(NkQ)^DhYI}dL zTYIc5>e`81ae>nsBVuVl5PpOZ zU`{AM#q)aMAK%5Q6;gr|zXGO>iL5Gl0>K7(^rrji2JX})Eg}mrtiWL` zz4Fj*Y-O|&RinwVrOS&Vt;2l4is5L(qBm6!^PgcY(1P zQRbBBgU1`AN5@%ByyFPj7e~HhioE-AbQpEj47o&#p=Fx3ihYWC6#mwq|k)~8hP zxv=}0q>@LO7f9jKX~IN(LI>#zcLv@}&1yN3eO1$gn~eA5X8^ZJX0|EFnpmFm(+>2V ze2x+#7_L=np)!1=9&eIq`F8o$(O8WAY!lxg(hZjKB-=6ywl=2nP_57kp}tb3222sG z;7g{0}G~1d~c=_N(L?}A9^DkIPBKuLro$6l=0)+a~Ma8(UvR2f?w%pKyj!{Qt9_I?J zEmLXRVa$I0*uslh8U|G?>d&`xm1to}Y~&9FlxO?ybKyCg(O-oR8h-quEy^*ewv3WN z`y3SZpXk2$_Qta8S&rg;fy^#=XAYR-)tF*cw`*{uY65T!Cx*$lg$u{m`-yg2L&(^+ zRk$KL;mx5ju}WBx zQS%ri0f`^qx**FpFiU3F9>o}g%;mvSC|>2UnONGcSRdH!t2;TewC5(j+oop;MnVo}lu5wOd z`4-aaSjP7XmFFPX$1kqw0pB;naj}b12{&nWZM?iZPSO72=Mo##P{EoKHEfN2e`_Q? zWOTQ4V!u*>zzJ+K#m23M&HeAi{PMK9@Ukv2bn-Z28o0?nZcY{DB~l&A*XYL?DPd+N z(;oPgjw7A~yo)Q%@IhxJETrV}@B7?68EV=%gZK*z`8TqZXi6V}*T*VzE#GC*_qcB; z`snk^DF(QFSnZp__BsU~)LKac&C}qK99Mp!=fg?(CcWI%JN!p;P2@Hece}D+aK@yj z>`@gmYJb~aN2fJTqLm5facfFcFrT&gc$I3bJbVB{UE7;+@y^Du$mx%MVNpfI=|xnA zg6BlNSN&Rusl^urtubM|PMQ0@jU|%Q@%=;Z3AI{NkM-x-M^6NPA4@xL#++xDtQxs* zY;A!_teJt+aCuAS2&T!u|@LrxX^1Im6s|h z7ylds@&1n8s7OeK^{1jFq>boYY+- zlh{ACnL(S{BhG-~PV_gLKeSUk8KdDtOEvut-fuo9F@#zcjL2tfnc_c{8%7UdW7=B3 zB=n~`;YEOA*&6zo{?G-GIWUv~HSUi?e%m5I>ps(hVr4&Y1^l+@;!zX3g8JOsNbaHe z%_V_gc(a|&5E7=&KaJ1-H1mH(^K9|`&!ojB{-3q^^8b+ug5E>QoSDl)dT;Lf{Aj2W zqU8<2twMwW`^|G^i8>$i`Sa&}+4dw1N@d#W$cSs?^tYq0foSm)>Z=#Ii1(}zi}#-f z-+A{!h2_mTYe#GAo&GeWEwvjLShPlK<9OrS&!E@96Yi|#t(r_j+=T^^*a&* zM!5nKj@zh;)MfTM-i>+MtpGxcsNsU`kwsght+`f?7d_Noek3(sAl$-X{`C`f3e_~p z{`w^2@zHKnz%ACM{p%}t?R4<1CMuo-nqb|<%5o?_3`9x~g($nQz8wjWbP4zWQsbAl z-n3VIOQDm}&g&D)z12bFJS`w#^|o2qiyYnQH=9%~*uAgD8+wepw-G}j;Ee4cU9)2G zbz|JN9yTa+vY3)4ijhqG?cO&z{2MP$D&_k=N;vYtk9Jfr+hbT`RGGC}UT@AK`J-uWL5LkuOfw^LIny^WZqm-j-v;9Dx6tWE+{(d z@zRJ5dbw~ATU2RN%cfQk+KtRmNIA*%-Af28{MP6@>Q=cu7tLcmCV9AZ!>U$?4$FFI zRU=Jk8ZdZAORg}HpfFl2e4gSGzP@eopvRU+VK6c_YIzd5y~|KTU${l!X$l>r6@ zwZg;_+f%C6SoZWK?mF`AqygmgC*zmLDL6G{ngRpzC1Gp*R|bYTAAqlJ*vXP?SfDyxUQ6LvnRs+#j8 z;g3s#+g4A>zml;#L@Kk{6L@_AU`$B5505sW7t4n(QjpI)! zoy!T3=U9%~!{00>t4fVqLPf`fcS4t{j5V8r$r%M)R=N5MG+SBgf80Ah+ABrFY73jG z++|Pp>rbV&Z!%j^TaA2pzZZ+N#S%VNcH3XS|0Uo?%vh;K`v8Mdrctw*^&kzf3fW;a znK7*=x#~sX;xU2I!=1QmV7#RP(#n*L<0#XO%2k;U7QlZul)?kcom||R^`pufy|Q;- zIx@5zy>k`8s#R_kwmwR)e-jX>PORqYse??`&UG^-Ws<@ca|!kJb1n;Rc?0)%&+IVv^ys8$1M-V zWN~+=i0JXxf3L}qj~YAiT-oT!kK);zM;^BF}ACibkhS86qrcG+N?){+x)6`z~t&b?dfr1x))p8Hdcd+7_6@*6{c;Z=f z_(|-@?kDjJE!v0K(~U&&Ihr0iv=Ao<4W=51^~x6Y(!IzU)k4-!4Gx98<70UmLJ^fL z*f03xH#7wbHy_p3V+_KTGZwKXgTvY|e9LFBw;a3_WL+R%@xstNg^5?;|i4!6g% zxX^O9wp^N$8I(d2N{*sIK9u+0{J`8-5h z$6UWqWG0t2!r84Wo!HBd{dpoYd=D;e?7OV|c;8`bPKtcMVOni%%A&9{{JwOX>h^{G zjyRdoJ6#t#kK9t95Rn@@>_LZGZ0X3w+d-@~bF6k>61FYsx>KIMCYhURT+P2c-9N-k^B%T`s%VSS-Xv>r^{e?wuM4 zzqM>l7OI91evK-;zi>V2bG9h+{tSrA)@@`Z*nB*;yRrp+DH|YvI1o;^7G+#Fki%M# zlY!>eTJKlDZP`gNZILSWRrE+{%2`w-eoK4dSg4O1lN+sscqn`#j?Sy%wHT1(d$E+7 zuU^?^`Znr;Mqj$Tay(-_`Sa&$CmkkL>=BHQ3h95W-{jJ*c~Mk5l|Sk@=S6UH40a+& zW`cEouS2|afyg4{buF2TUhv43660wfM&5qabgfT3sS0L1^Vg-V#uBK*j|2Ndq(=JF zTWz)@sqddUHg@>UH2Pg>-CG- zoRc_>TVl!zz{_|BT@k5Wbl$j8l}+qTqAVz#zk9FV&CZAY&@lceM?m+R!b^HhkBfOI zM{U*@A8o+wPq;0IBpY5`%zUTeBIV;A&;CS|nh*cSxNJbOF(pnItDYyPPA_L@{%r5G z0Nm~`z_vd)5-9T+{rG}tnv6Y07n9XxK^Gj0%ZId+UM@S_biSh*QA?=6{kXP>;1XCdAY&GA!kPgZUm{ zfw)ndD)zafZ?==%3X@`{mp1g8gOf7SPigw9)aO`kYNW`e4;tFpi+`d&c#Le|RBaZaQU{HfZrn`5Q?)Xz4 zf%#(Xp(%N48`v!qJD2(77v8#SxrNK?4WveKuJzR3O`>!CEXzKSs_fxEq$0e3vLvW~ z99n0*%#kn|#iHW|oT^!sPN;LdY3Ymo?wo9b7naXDhb!eNHqn7KHE%V~wKQS=IwX8ntKIKDF^clxdr9hCr{66@KCKThZjIbJ`{4)9R!%S6j4 z-GdL>Ur9aWFBENn1O%fseZ9-1;Mn&xs6(gK_U#YweFd6}P1+Y~=5L%^%#g4A*Cn^O z8)q!zAHuela^tKe&bv;3JIimMdB1HX++Iu{l^^$>mW?&IlGKg5yS+bYuO)k-hKHJ@e=2Aa{Q3u$6GBk zt}mH?>9TsvX6NRXn4l&S!fnRL?^v=CvK16&_g+E-vAJjhA?kvu*{{yQ_liqPiw{gk zD!gBRXKwgFY}j}GPf<`~@ce*PwAjWk*z)Jw#}B{=y^iHN9~bz0@)D1pMM2RgJp#W} z^z5xSF+S~KKP|7##DnF2L<|rYxDukur#&N-a}=dcejEzz(JwSrUBJ4pkm9B6h72y|pbtzm@@!a+NWNs%vT;sSc zqnR{Io}CG;h&ue{0ASTD04!Mxh0FDDllJJgURkubGNEK+zx)Q?x08DtP!YDw|Pg(P0Eo?18oU?)JL00Box!y%C6^G9i_Bl0MR7)5!Uz^5UWU_!<60J_tbFBcJE;FwAgM^JLcdpdED5{AG<-jf zAu6QxOTaA?0PZ-UXDeDX^CiPB?DN)Nvmvb~ z$LO^p-l{qluULjyvemXzaom-o-P_$E9&M{%#hPIjrdTBEiiTFi{Oq z(C85$z%-avNaE0NSm?OVT6YjWnJnNE%%t=2FXOn#Fi|YrHj=e*8T8(1QL|InNu}e0 zvjQKN1#kPj_C-JXls>JhVELxV`@=qH!$1!i%t4XPKZzRJ1U z8o9~^79p&hsHg(nTIriCnoN8Sb00`eqdFToxgMo3sb>{&WDthSe)@V}Zs2j^PEMn9 zQMKIySRLpJbQ$tf9NK=0CN%t_=XCY(<$AYWw9xI#cPb+1cRTtODm_znU7%5y%=t1O zzhU&k1+W!J^(aw8wbinTj~a~qhCU#xRNrr7gt)I4T8#HYVxxhYa8#}C?m6bo8~>3g z8<8j98%QioSPAlK1ZfuGVaJi+Wc7Y%A+nxjFn5xkcj`s@U@yH4rJ&O@)qL&y8Xt|r z{5qW;?1%HWac0HPt+ahmM94GW>NqV~@|y+1*s)c%{q2aATF)0(XzikvkLRlJXrmxm z?Os@W@u{(esQE~b!>#f1*(QZhu)z7Mt)J-(U+ceS;<=wRbHe+WQ`9S&cRF8`M@JXF zd!sc}*ylR;1qWu!;er@|gqyBc_oa~5 z)y@lI8wFd(`w`k=gB@&1RT&NJI{TKDDON1QmprEi3YD~);@+$RdAcD&8%QR*S<==J zZm(QWfHH6J*q>os%4}eR=h6asfCs_S^)E|HifI~&K*?Ta>B_8EH&J*gTPe@)3OSwM zWr~k+X%TdCTvtZkZcc`d>*@sRAvAcb23q7Rg+1mzXgp;bI|(9%4$=1;q4(AzF3mPq zCw9N7SEAUEXM= z7ia-;@1HT0U36}1x1$h3O~9J(X3kvSv~L*A6X{I<8>=O#e2rqDw!AV%$fgq`>to{< zbQZkcqZm(8`h~53b*<;6`m`^JkA+W!7=374ehdkD)xziT@QAxNS5V+M1 z6wtMXb6cuPMJ%-Kn1|pC^BBt7$sv?XL6C5E>CA-~DN5hFdqwc6^*lX7Tp^DguENH|7jM~<_ohTTSO?L4 zt`M-wD%Cd#rDp2%9$To zkCj})ho2WKga`c>M)_c>z9a{|dI5U^du6{)t6?-@fU(|C;hoUGiEA6dS7#z4<4!v<2!TF(vf=>7UwSa19ho zryl<&wDeXG)aU=8X7-8e#+(g_wgRRly>%3oJ4+~m8LO^Bqao9|rbE;(ruAh;AJuL| z^>zBc-sNW~vIj{x|kg6bO$uLS_EcI8O1H-wopmrs=GfqLH$3v#T#za^i z1`RiWWJ+NZSKLb_HNgH{_~QHJb0hFJ1k6E0UpbEqOr#halO1Q*`8oPG8j;L8L#4|> z>Awrsz*gpc2A%#lS;niIT&+UxduLJE`I#^3ttle)kxUvK-^0W|k@EX?<9N_v;S%}3 zoYJ0rBS+5Lc3^L`cH!U9WM!po^}PS|v&MyDXOtlPpaGY|YUEjtcBTK1BNPvx+fKF> z8s?t%45?GC+La(*x6bkcJ{Va-Hj;4y(t4MYojMKi=7m;6hg}4Ni5E1 z;J(r6d2I(V>3&o;?TSw_-!~m-3H#_U*d|`B`7d*TGLRMB^@P=fBnJNl@oyZ zGJ#@vYvUqf1M$>Ekv z1N~(1J3brKGHh2<%+~`t{$sWH!bh)D&w`offV40~>4D^^Qaxm)X(w6r8d9&YEoQpo zcPMrceQCC7R6ho%E-?+wMbp6`59xrXI0mYno9AaX2d@^x`$JDcQ~4KKBHtUVy4nv_ zb7`$L%flIzvfjFXmGqHVOL_5ls8ECPN~tv?*=J}V^1uj-Ml&S#3VsSw5SILaX;=T|->JYA+-5rSKG0(`Dp8Igg((b|;` zG7aMd((@0a?u+>nQkpJyC&eJ21UalFup4FN>(%Qz%(dJ#>a5ZNBwr-hga1SF!3G_t z%)RJkZ?gi1xQiu@(=7N$oeOeuZ7+aY&%~El!G5KED!B~lnwa+*ROBYvjzb*7$Tj-2$ zJ%XVUbGJ5|k5>;P=oOsT2=;#1?X;>Tcn7u)AHL(3f3rKE7zy7pyY&vfWfG&l-<1-9 z6h8b2zV;Uxy-4~GilFX#qB_r}L(A?&q{5e~B!^vvM(Of&r$To>(;tz`XjR#&& zksi_CcdPU3X}qr|9W5b=@wVwBB++so=%m`g6d|$X$THkua(Zf2TLm*Lx0W!}rK1G1a4G{vXa#Gl7=~;ejn?JKsRpjKxlxsw*2`XQ!ylY+95$Ls(h1|;u^437^ z;3MZI1(DI&B)u1R_W<&&=Kbb|v^Gx(rV_E)FSQwb=)ALJtJA#OxjE}K2G>*=A3~`W zD)$bJ*1DGqolaCb7COdrTayV`uMCV>?zY1|&+}S}919K|#`o?$-)OYADYuwf&7GZX z4h|Y*-RR4E>aw9@MMGQyN%^d&TTDcPS6<(LRGpzm&TCV$STm9tFgXO*^V*G?9TP8XZl$Z>|Nf1Wu=lij5aOd7C%s9->^o zAxwI_W?tR>W3vRgc^Dn)8Rb@&zN9vV0feDl7y)@+vJrtYen#J}OD6G`Hv2H0Wfiij z<*Ty~o9u4*M1Pj>uh@&K5Io+G*0Ko$B=+br$VzcJw#HjHo4cyLPZ!Ld6@%kj?qotDEo&*aa& zrnGyl!;cP0=gpM8a7td!)KfHWIwIi#CG~43O>yd8dLG9tXjBAiwSM;%=R`LJEQXMY z-SC1!4So5$G#z1*Gs6`|Chy#LHtJ8yMkxT57XX;JAUIM(nJm+#uH-4$*51OiMak){lr_-36QN6IbGNUa0F-LArtMB^LaR!+m8i1^YYtv3iWkbQ@0RafeJ-ST zYWnE@$aZ5dy`Hs&*Q@}Y-Xi_NBRC&DEX89~0!+El`wO+(^K*GWCuQx?MgS`UvTpWa zv3Y;$Vjs8($KBKL?`cVLG>!iwQ1^IRqweG;ZL|`#m*dZ|!6c19{%tOTrl+67q$TY+ z8WM*gV{bPWb0A|Gg&N%t8LoDaX&0HoQ`C!n)mA}ILcgvD>dsZQN%e#x1Xts3a#u%zgFhLCW~4rQCO=#xzNuLEuXTh zu6^7$`~D%>+*b0nWy=&KhDP=gM1Vo-rN|Tm`h?T%Ut3Y(E$=S@H@}>KgjnZCRVD2> z+pbyxuGzY)AkAy_ENSK%UVqtv;JgA?#jzC7tM}h^-(9^s-xeMA(L}l(m#T)1FRR?|h33%!$OS@d-$ZfdTZUs%q-r0Z(Y(=XVCv?{rI{j13y zAAPJQt9G|ank=@qCsK5xR)+HEfmpvt>46+uXX&(S1W1g^QOPR<>I^v`w=#0E#9wb* zSdIpXu95yX+GM6`c*l>AXk|B0BKtoGIP7Pz-?3;s1_>Z02ptO{X8YZCRlHu_B)Xh{ zB@_v5QX1N+!2_|xu1ByY(EJOY1ai_$f}Q2<=pWx3x!T!0M%YL>=48+(h?FduZpz8o zxn70{IJtaa@nu{R1?s4#zH1u}YI;(vUUMx5?$qvkcM3~A6XWTOWI!DBA)n1%zAyhd z3&3%Kqk*p5JjPKr1>dy*?5kH>SZe@({!l;M3HTw?k%VS(ch>BAGxlwk&( z1#Rb-%7^FRV5scH9mhz|DKV9*wXR5@#WPKl{f{LcfzW&tzJlnQ~(Ld@Rq0XVQq(JVR-l{zC9hmczIr$4q8zNSkVm@Pea16j(K4_~>t@2^LB z9v`&<@}!ZD-*wBFRM0%Mwj1bHFO9>@Z~uET{XN0#Zb@$G$Kp8E9n28qC>OojS(?(R zBioJQvYnD`3L#&d>c+0st9CBP*R13aU93vkIkR$rv_sXk&mNZsyDMM*)&x>w=Vn9D zz)w?tR^YaOT5(C%W}$to>0PqsYZq(e`p;2r+lOeU$9$%`6^gK?*6$DhBM&-i;{Sjf3ie+m|9spc~(M|=k z!V35fivWYn`|M9g*i2Sk91VZ#a+)p^6@C?jBgaahJ~n7gB6Dhm=I>M08=*umn3;lq z>t;v~=JQ(FOI1u_)Zvz&_6#pLD@3sroFbd1P?#czQ%Du(+H`AwE@pW?=oTU zx5_o#v&vXIbOJ};Ul0$x&Z;{xI1Hq(Ixvs6$X1@v$nG5ppr~5yO|QPrtf<@+Okvc_ zX1&5iYMgb+VnOp#zaP16P4Cbk^{`nAQ79|UmFOFcY9o#|Rm*hl9mnI3BKTr>ju?YSTLoIfkx3LqaO#GX-X97=`y39kL2Sxr;QOJ!Q{MW;R@C-9gjSAMT~q2hjynx za&Fmd6)p&khTUk7X{U>j8ajwmwkcg~y5)nd3&NDD1;;@r#zBf#Nj6MUY^CKzE z8OJ0c<3{(>)9D$nP%>X*Gx<@XEt(l+ z)%H?BBnliMBeiMx#rhN>ANP<#K-e-wK%SqX$ncBwH60F3aFPRe^^*kTiRCe%xW*ij zuq!20;2ZR%jX^)LU13rsl3b28z(u2|mY6i^1wO z=Th`~M3+w0$i9|rsKv?Yf((#`W;_XsPZLdQ3L+n8;?VlGRSw{?9!#4vkBr;GoHK=M zWaoHpBeS6OtHaRVL#@KZ9ZwYV_~T0?v3WXqSxZ>hTrx7v)posx36rWI3pYnQC+&`~ z#|ZYGL#3Xo=kcx@XH-e@tH(C0 zi=Ai{Ml&ahdDOV+bGzR@>k@*LVX!jS2vz~ye+F;e7w_XH$-N@hw&&6`Es z9{|d4gzIn~4k?JRY>X}ZepU!I@nvt?PQvyGdL)3gpEfkL$p!$4K!T@)(P`Be$dFWp zkicRm!|P9r)2}M%XN5U4{`JVMQZUv!q z-7LQ2V>(^CMX<)5I*?6Xc#{%Po+!9C=0&R%Si=zjgCocL6FP%?3Lr&yC=Oxi79-^D z4DyOySJ%N|GNZ$}bi_-M<`JX_lj)P=Jry147#8bkR5>_xrENtePka1i>aRsgbJG-( zB}VN7c>z;6+h@Rp&x7b3r;-qX48iuZ*FZ=h-LZK)C8iA=o|DwKvP~`Udx+ng_!2FM zD;CyfdKWBHLxcm+v2&gTRI(P#4|*ipKvz#-#$GnEB8R5t#RR9CVPBe%s+q@XLy#loElBRa^! z^-g&upQWX6hkm)Zwe?ceP=M(tK8fMJEtZP}Q#QBiSe3Iwjk`RSYXEqT!_ctN+Py+z zJP;20X1q>UY*^fJrI7am4-r$)7TQ~K zsv_m|1k}}#-EW1v98QugZE44}&W1NJt)`tQP&pmN#(j{GD zc#Pk9HP&PEi$14Hkv}+!YcSvBrZocO|FC~Hty@;2q>ugb9Uk?WZd_WZ#QaHOp=DN_ zO}tLlsJU2&7%qtJF15w?yMfnuTTmkiISRUVzo);4uG_{5ikurvp!ojVVP&*na|`;PzHuJF*3B%8ssXi;BuM zEkZXeNcq#tCsynzw}|?5Mo`g9zS)}3)ScuHr?;haogY+N>p8v;WS9)u%2U{lF$!k#7LIm1U&N>6^!*V0GhK0*)gvEmp|s#Vt)e8$at0 z&FBhYijNZQ(R(?OT}q@$j%_hWYLGrthVowieAM-V3o9Q;5O}gx%4DI{3&Ur`X1}1W zOdK@!$XFKPF>y-52iuBtWrGmq7!Jv6RofI0p3D$P84Z2!OY5g~*%)Kal#ysB2@#=_ zOW@`t_#RW-T+_U`ZjsVKx+wHLi2)G}P7~uGHMl6=+z0YjLg;;~v@D;DrAZK2J14FY zPydb&fQBW5!~5+BTPcNIaXiD%^GN35A58Ac#qYTu&0p_?^y>$rg%{Pe zk?id3dw0y>OdC~G%_*L_K1)i>0x-8OmECWCMv9QTrcHwwA)ES>mDFH-^V~EKA;s3#4KhpORo;j6tU4vI;Nbf;Ha&Q{@&`-LL8QQ zsU>hu5POo%a<}zDASs9WcWRQI#JTcd7rhaAVa!@LrwCo!+9VHtS%q^(!W-}E*KOq& zHsV0JRe42bxP0r@YTxR8ujYyI@1DpDw>MH_3KQmQyU~Jr<7E0;bMowH8CUe0aGF9@VEa%p{htWdOC%K^w_HDWEizGID!`WXZAVG^cK<&5(;wb&@uH&~|qEm{D_3y(w`ke9Y)UA$c1QS2pi4f|Liv8oAbY^LHfp zRpzCBENc|?e$Z_`MWKjq+2+rbHzH0_>-P}bJrwl1BUT;9Y4 z0Qw9KU1ndIU%0md4gW@ZuK;Ka74h>AO-f}G_`l4GUXdE5Dm$Smeg zRYLxe*3Y)rkTwJi>#>+z1|Pe%Cw& zD(F zz;l1eL;lw|$)~IO@fkD?jF@<@l5$?a;+kfWw|LvU!DLU~W$C>LRCHCooRJ=n&z58EeB15m;mzEAtEtnAu z@i~W0e)a*R;^Mt~oL1muL=K}S1rGR;6G;6Nt7yK1-1~QKY2Hcc!z2M0dEuk)Vth_Z zJ*Bxg@E>QYK-X>0%T-CQxq7P2uJmH41G;wX3&awtMU}Ic|M+vsZo8g%pjzg<2f;NH*k?jB~&z{xj=8p|84x81? z9Jr=Pl`;btAx`DogJ@IUyU|I6opv$Bx?11l@ZaE~Aym+1w$Yy6FRK}!|jbi(u3 z?Sl4!a%`=M!ryc;t~8w6M;x6%vU=dL{dAl4uoj4QYrVby4C(A84P3Uj)@RWXoVw*LXD>fsxGX-P)}1EjpiXb- zzH5pZ%ZrE3KJHQCdKVNF#TLPW8cCjQ0{}M-5Wn5Ehdy_VzkMiz%_?~;o}nGYI1-fW>U>iSd9tKf;pA?{34+y z_QB zLSr8~K621I7#nvaEpm6lJ^>VdiRI`J!E7{Y%@n2A8y&mNXVwv_QwozqZeXUeFVQZD zSb$E0wOzr)BH>~TaCI4-H3JM=7SNV-E9mDjA-4v?nf}tZZrc2&Sq8^xEYAN~50J6p zgN{drA7|qGEN#Vt>Vt4kXi@#%_VJ_l*Eucu@_}T8=>i338D6$LvxP>b%Hu9c&B z7DpC{ZT$;U3&fhh`<}4tAYw`^2fv!V7N+n9>jj%$#b=tZeuzLfdkwGJt;}0ufRf#&>lPS&O-Sy;g-R zL*?a^mdO9rP{<)+HOO@}_ia)i*PP(U-=q0WZij1iJY>Sr&?0YfJw3ioadrrt6E3Pa zk*OHpm!b;XO7}PcHdY6&t`}#YBWr9%MZDe>14E}ecP!>@lj6r&;LIGr_)|6RjXt=g z0@scwL@Bb8_gXm)O&OIyD zeuDizf(ZWaYE{nGfGPhB4ZRDT5zg+DTE#2X9;^Mbr1?=GhHgumZ=$3Q=yUF=GF(6w zeHj^khpjQIL<5^PZKg=j&3hxkDB;Q?n9#h*+D_qbpkVqP3WVOofoTYkH^d_QrQ4!7 z8BI}<(KuJgnD;*Iwd;2owqmr0A(``-d-}?-{oqBe2(WtG9!1u$IkkUX8A}Jo3)6VkAg%?z>mmxf*nrr!|L#>Ij|*%6uT4>twU-fLg8 zT11xe0zLmi1Zz!!wKC7Rr&#YZ`iCEt>pXw0Hb2UIXu}_?DH7C^JzVKPQQUGYn=;w0 zzz@JBO|EW1QhTCkvj`@F71p26NciE#N6zw21 zfryf6ngo;^9rki5$mv^?+T`K64ie%E~$^z(=LK)m$x7R7<&t3XnpLEOYle zKyO7l)lqW(`OeT3LgK*mx#7-e;Dt$Hhi?+F_zL)ZG_o6*G<)mhT*o7z z!54=ke(luTf`R%Q_|MgI+ZKc!?%cUE6__&)ba*A!Ju`5VLfN-73zY&i0a2~K4?6Mr@IG1I%92y9P}KtCx1VEoOr>6VPe&2 zVC8v3TGJ?c8e32searuxTxKvW@0{g)57qtQIv=0;2(CSFse}hhpb<0@-UmqC??#bZ zz0a-&(?&dDf8zM_D`7Jm{Giqm6OJ$_l?Odzuim}lAr*gpsvY@woFUR(skniL(pYnm zM(Fp24jhCw>qM7Pj9GwU>{{5tPLJ|h6Wp+ko?WA@V4Xs*XT@Og_&tq?<6PWQ&0sv} zTN~|Z0wN8YZ;1(K;x*ozPJgv$w@D>16`?GC!^h_sn~zezY?5x;_<@oc=VO%Za)@J^ zVGZ`xYI6vN;U>oK(@l?UqD!oSCRSs2ZCc29V|6twG?Z-CRXOPa+cg%Y&^o~bCR3oc zV%ZmGYx4Iu{Z4KB)__{VJ0U>hd=%WkdvN!|q~uv^;2Mhby0@RE;mQd}wgLdjAC6J; z$?R<`vIABnsfI^E0=NlyhWmIBtk^T)gY|_W?zOTM*&K>oW2o9+s!CVQ>_{O8q$$5w z_oU(M@!iq}7-XAH><%ky%e{8BI-h;(LeKrha{HwPZ4lfH%Yoq%w8nk*70YC-qd*}b z2YgaZot@nJsErW_oGl`!_JjB%85=>=ZB>K*dabsJ7=s?)7_(3euly;XXo3qb#4J!f zPe&amHxom;L;yHBwlY1ymz`7WnM z^^G6%-)j?h_IDwd*_Zv8O?iw1a7glc^+^u>WR#uCr1#<9oV$5E&KT0tDRFG_%KW*;_c`<@ zX~nXHv5#I<_w9TUT7?fqbiS~YzJ>B|*QEG;9t#m;1~Cbdebz&5S}-d%6bN2wdjDB& zwnKkvl1&vM=%dun%eWosWa^w?PzFyr9a2s}alal228Um?w3}(7NGiwIxCT)E_EcG0 z)MLI_KoGH`qK}{Rewx>oD&E_ikE@R$${lk(bgC?VIqB&C9PDHgVXqN5D2b&*=K#sN z%b0hwiQVS%an8tSb*$&sV5SCnFG3B)%WWR77+S5Np@kK+HrXvQEwZ1M2ZE5+8|!I@ zl>8Q-*AEgvTo_0sGHYYx>{Sm>5Hf#AhVE@RSNrVjK^tzQ{YRoF)YPA`_@zP@-i*lDIp zfk7ceTAKY`S=89fepsLGeQH6=G?0{BY^K=!iKN>LgjuQVmOTaO`4I@6(r%MRVcRD! z?f911aw_LP5q-^Pv2*S{Uy1j}gN>|$2sc^M7YucswS?pldqtUGp{5wW$yl{XTO6QOl&LrW;pP3}!lFVMW^Xd4M%ng*#=JcBOl6de4Jhs{Cz-`m`Em#Xv6 zT|&WLDsLLaUEU*?)4v+KrWj7OAs=^#d0!Gftp{>B$i0iXCU;ESO1}|Kcca zF#!?kQm&MZNrF()^uXMe+Z-@zO($(!e=lZ2xv>Dqc+EKu*M9$ZBW zjTaS_J#5#dI!8)pH8zsfk91nREt=wTAJ2Wu{VCB!S4Ew%p092lFP|Ru>86)&20j^m zY5>>T@|iX*-mS5*EI=`idt$A-5FDc(*vI5 z^gGKm=pK&^x(?b;D>!ObXzhOI@1@nm^%Ym1_Q7kH>C-L- zx>d0Ahny^barGa=#BIC~t_a7j7@I5|G*8cT$SIAPGkyu|l4e>UF+k>I?$JNr7%Jnd zmc`HDd76&5r4k5S?UzP)d4I3E0Gs2-4+gt^SAc8v1b2yh$uNtnuqz!ab>?n2tdOX}$*;2xbI&45WzP$N7%e56m1)HG32Qqni_uDbkPwJZi)yLe(^0+E{# zcjEf`ageW6nnZErN6h0UhyvlS$w^aO$qPJ%B$qG4zkh$qrjIPSepijPXSTvZ*>AEr z1O;+3(4P5*bz|-3f01*hxvu`&THvWU!A=%{7RXF*59nmr)zyP7%kJF1{ZOaWk_mLD zU3|`2bWP*qM1%ltf$$IgG@yCqvJD|Rd1Tlt3^$#{bVfkGLx}04)KxSM^7v?9kvT?V ztKl2Ly8%0e=*KLrON{2WIo`@*G*=^Km$Jwh^eqYH_o*H~=q1%H&5eDbnyDlZ>q8)B zEg<0dZ(vzK0gi9e5bq3`U5Kw)0H;0@7uabXEuH_DFw>z~Q%g84%SaENP-%C?3n|K; zO2iMY_;E$fp>j%naiBah!G&hFk`*uWck%t}o~Tv=K-7ISlFx`>g!`jM0H*s1nz+a7 zi}y$*L;2<5@JamVcXPjp(Z&aN4gb|q+ELk2<9&|x1Tyud1=i}p=j3x|@rCsyg;4!s zUmYVn(ZnzbsO%;B!kByWS~WFu3D^;=i|*@nNn9TXn~>PHO@loa z;2<=?T&o$V37P5+%kDQ|DfQnDA=URb+-|3$5@gT#T_pJR>sPxj5$(PVrn?2f!I^tK zT=4npf~>VKNGX+4lUnwUs`W=2Ap*s<%cE7Af=8SEH_AbGpam53UQKQ;N#85`h2G4& z_?q!f2 zp1RFB#?G?4I2OUY^PCC5!`X4V#qOom8$hky;r2_~)wN>o)T84ebj2>ZOliVMf{ylo zp}57YAMO(~guce_>gu{mMP+IEqg=+!$&LB8Oow6h9aTEkS%iB@so&wASEfl*{+(H2 zW!j1t?UX_3AU}fFWQ9T4nFE{1XSuG^iFJ{zyKwT+Uf+Z7owOt=vj{fedwNNinrnY& zM@y>6Fx}bJ8Z(yqhJcVTRu-hdGS(e$#ajgp-9^U(uC7@GJGX=i7n?(p zs@d^KOb~$peGE5lRlz_fyeIrSG3~9e8(7)v%h^8CV#oB-P{w zOs%emRq9@y4&!!tcS9l~|EC`>LYk7KWNF-EBjJZ9OZTpV#^1ldW}d?=7xTX528fE< zK$mydEdE0s8@2?JVw=Xt4dX_86^2~qjE;2Um(FTCs%&5CS;jwE1+0|#a`HBmJ$~E@ zP7PfLPUq&e(Nx$(JzmjQow$Ln^Nvu-g_?WD2?nV$!Pl_`LR}I^;z_)Zy^nUyXG;k+ z0%MnG`vB-%Z#D>78lC!)%`Q~r?X#d2yVfP!o#8|cXt?kP1G$-?Q}Fc%F7|>F^c485 z2A+KV`qiXy8q7`GQ>4Q^zq}8w{8(Yx zj&bT`frnhA6lpxzww-QchdW`9@m5@y$9P>jte_wnSuIaR9cSy_-RM#7$>oA{Vosey zWi1zbYHau;Adq2? z#GbMFouVq?aLz}WO}lD4((zz!?P|^UiR$iRrDw4~oI}#+0Prz<9QJdKQ))BY5C$YSy?W_*7t&9;YijiOkCVuLWxcrkE zmVPdyzl>s*C^I0mJ<%D8%e;O(V)Rrxa=74Kq~|jfpbj4KRROg+w5U!#k`>y44FS%| zSg;u$mKOz}WL!BS-HK6g%hw=UT={{Gx2QLw^hoOm$30GLS>;(;1g}npFd^k?onfu6L_S+LOFx*0-;(OWC#Qw zSq8=Y!Tva}*@oP@57`uI7FljPfBKvNZPkE@*<dK^(FKTH7#P71Hm&{zeR zA03wOqA!CO3UNQ++h_&K@dBj6Qt){^t_y(}-sT>SQ1+RDN;TRK$|Bsbt%S&}2$wXG z0{Wp3<6KdYsi+W-z?L_oHesZF8T(WUsJ0YiXP4DtUg(=zVKt=gVA1hz=dp{RVV059 zU^(|U4r-T$!V2@{>2yq-9JVcG9Pg0p>4|CpPx->Yi_XtLUMUZ%o%LicpLWDteD}uX z@)u3-Tk{h|P4`Nm**5*@lIuQ)y#%GTd-LoO&oUrvs?mTpjaN(+$jY$B8ayBO7Dcrg z$??ZyVB~|~k!qC`RJ6svA6~APF*SM94@RE#^wTSV3(+Iv=^7IP5^!~)j$nmQa`p4? z%JdmrxF`p5A{`58S>p-?TH4NwI^Nb!3Lb#Pv1{_XXb4~t&DV_kzU69=^7(xZkx2Tr zfLhcbkKvL?egF->!_3^Kgsn^F%jgW{(yxl+(3uV5y8nII*PG(E3Lulv>dHmzaT~k6 zY-(VK&z@|YnMJzhMzzg>UcTPj06-<0dOAe{g^h@9FBTAnIRDQ71cAJsJH#(Jj$5ZA zP}LZ~E+g@bUI@LL#Y+S?#C1Uwj zwvH{Gg<e(R`KTm|8qe9`KV zTUg|Q-jQc^j<%q%!(m}$$k;|9*gA9}d+kxOcn62pqBO1>vM{hcUA0`xcU)sVz9de< zb%mo-Y`Yp&m38X1-q9<1pDFq>brBXA!&TEwy4AzJy85z@-baekz~w<|{0aq|$|FbU zv$hmUOQ67x{`m1lI6Iv4S0Gze^F91QnF)|K90mkvPk_nWRKK0A(rbXce7i;=Y$WBl za5y>CozgU@dw1&l>N>MDN3Lk;)^v_amDLdm*<&ZGgD3jbHHMu7Ra=Bwk< zrl{n}kdy_6&^-U=&S%mtgNxrB?thq|+P<_SGGjUhtE%7i6aC(yEmfbKKeU&2Zu^et(# ziMC@nYK-4)QLMU9)QQjA3zlXRz1%AH)dsPh?M!5W*Jxlf zew6^9cqE|yF1G3Vl`B`ef!E{J9ig8Vv$6tn*$_qnMg%DPotN%2)z)?8O>=nk-awfSWbLq;r?v@21_{P7D zd$wfYV@QkJZ(jMF{U<)M8d60@#h!wX+HGd3PVll5&p=)g-E`*56W9JfoQBK!6+t-{ z%brt|$zWLoT$fv9^0(8F?+BYDPkZ7}$!Y1J|CethyXcT9Xnji8mDp7c@UXJGP?}TF zG-%ZkG>l{`>Yl(F|7lOq-2lJUGjFO>*lIGn%rjqj{(Fl5FRx;KXGESXAW~SA6Okzw zq@<+48eYlX;Q(s*lS?A*rC7#k)4-Co6C7Xc?cDDUHJ$~Dj{R&U{3mjtcPXFwEXT#NQ8Ww9eH3McjCVM&v)Bp`dTw8 zlc!BDvP~mPdZ_ zb#6MVU~?}~2+n!LxeR3+_1LfzZ^pwX9?&$xe&Sne?zoe!ce{YUTA;p`Hr@QU2|K7! zUq(Gg4@}A8u09C095p#A0joR5Uh`~&m3%{z1-j)*Nv_r9ksQxdK)Zp{SSBR;?b}#; z5Kun|)X5u*!?FNea3_j734STE5*2l%!Q;MqvyR^&r;e8G8oUV-QTVLed@spSHra72 zrFs)$h3voo?zc8xeJ_DkJS8~|4Tr-_$2ByWC`heTLuft2xsJ=nbfm~R^;k!dE^tjl z5A=ruAPntJ^$>DEc!b`uVPSn9ehn%fnYBwM!NQ z_BNMt0X=6Af54@kt0N#LQ82Y;sWGZd$qC=5dn_qT)#UV_isx*kIt z%ivw1LRNneHAwJGpK097#OYUbH@NTW13 znO@9X1d{Tq#^z=m0!irKKu1ywT7`m}2C{#N7Hl*v!=<;w0%>$(1O=E8wO_@xRu$F) z+nl4R&P0e(LS@W+0#~eO{dr4hS3TS;6gqe$BM|H9^R^^Q@5xfu)2Fxl==o+dbz+Uc z@*h?}&&I7RKoZSOf7ce^o77CMmfZ{Rv<^^rUwO#*XJ%_PIaGU+RYb_ak?Q>Jo zbMfQho#s{DD6qo|lk)L4TeixsVC7<2n@XMcSr+g8En1VM1mW&7MVLdr%W^Z?*3eJ_ z#509xYhWsN^UBAs7>@t&F%ivQ1^Xi{+p0hWCE><*_n*Tz zcPF;*leA2-*J`}23y6}+FzpL8=1q~-Hm40@H@K99dFOLu3l7(bj68>EFTCYoY^pHJ z+nr-vpE!`-G0~Ow>jwg?(1T2SpcNZHlf< zK(keNZ37c4P4v572T9l{gp%}8vofAji^%Ca?0nSN@&I=E9%oY?!*G(ZIlAyjt9UkT zT?_1H#m(3`rv8u!EzXeFYzxoo&y};V`(~Zt9s?@2f8DTW@CQ}u%YbMm4ynd#tzF|@ z$^k^iCZ3qpJFr-j+`c>}+cA_+qa||;(Kq6N^r%TbaDQ589@@+FecnAc9e!h)s&p=t z4~( zb}EW~8w*vv#F9v%FO!Yp+sup7`K6Q~RJZ$^F(uT2&?=15xuzNrdTXHB)B;pBY)?P> zjyNbo+|q&OBQFr_qf*a|?{?_Wx?RIA|E5*cq+WR+ZQuM@`Ar;y<`7pj*Dr3gE&H9H z%Qj)b0%xa-&qrqu!9IYTv6d!GxK)Drp8nSl}h@)wVRfu zaa;%D_G^LAZ38=MKU0j_568rFP)BlymI;fWME=B6Jh(NiHQ!iXNr`!%y-JDhP=?}VL|&d;vbyf}Lt+3E1Re8~Y+{DA6EILioXb4}v*cM2tARBmI{ruJ@*;ngdn z;%vq>VfL-X<&`PI^S`k(EkyW(_OT{{cIhCp#ptXb0X8V|&}V@AvUe@2GGML8;FjPV zrT%YE$Cb!4vCosjGxc$8{`$dn_??jP>FG!tSY+UDrGOQ#qKxi&nEBiP|NT<$mYv%< zsOAra#NTG(KQ9LqK;ejH4p=%lP5&9JPy&Nkt8B_ss*idzP*qw9-f}$6HdOBf2KCG# z=+nMa5G0S96_b1tJ#8=_49d|;b;?a}n=%2H;O9X@cgDQL{pK^aM z-@a&EU)}2A+@;e7v0$*WBRcN1V%>@v{Iq7*9=e?R(}GP@+nvgO{5DnozTb`b0Co_J zCqw%GRzTohPKbcP{Ni-8Q;Isgc(55o@nFDr+S3O6!JtDTr@(J_!rvF~zn9YYznAj= due Date: Thu, 5 Feb 2026 14:10:29 -0500 Subject: [PATCH 13/14] Fix typos in Azure Key Vault instructions --- README.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 847e3aa..a9af10c 100644 --- a/README.md +++ b/README.md @@ -217,16 +217,16 @@ export USER_ASSIGNED_IDENTITY_NAME="youridentityname" export KEY_VAULT_URL="$(az keyvault show --name $AKS_CLUSTER_NAME --query 'properties.vaultUri' -o tsv)" # Create a user-assigned managed identity if using user-assigned managed identity for this tutorial -az identity create --name $AKS_CLUSTER_NAME --resource-group $RESOURCE_GROUP +az identity create --name $USER_ASSIGNED_IDENTITY_NAME --resource-group $RESOURCE_GROUP # Create key vault policy for UAI az keyvault set-policy --name $AKS_CLUSTER_NAME \ --secret-permissions get \ - --object-id $(az identity show --name $AKS_CLUSTER_NAME --resource-group $RESOURCE_GROUP --query 'principalId' -o tsv) + --object-id $(az identity show --name $USER_ASSIGNED_IDENTITY_NAME --resource-group $RESOURCE_GROUP --query 'principalId' -o tsv) # Create kubernetes service account bound to UAI -export USER_ASSIGNED_IDENTITY_CLIENT_ID="$(az identity show --name $AKS_CLUSTER_NAME --resource-group $RESOURCE_GROUP --query 'clientId' -o tsv)" -export USER_ASSIGNED_IDENTITY_TENANT_ID="$(az identity show --name $AKS_CLUSTER_NAME --resource-group $RESOURCE_GROUP --query 'tenantId' -o tsv)" +export USER_ASSIGNED_IDENTITY_CLIENT_ID="$(az identity show --name $USER_ASSIGNED_IDENTITY_NAME --resource-group $RESOURCE_GROUP --query 'clientId' -o tsv)" +export USER_ASSIGNED_IDENTITY_TENANT_ID="$(az identity show --name $USER_ASSIGNED_IDENTITY_NAME --resource-group $RESOURCE_GROUP --query 'tenantId' -o tsv)" cat < Date: Thu, 5 Feb 2026 15:11:41 -0500 Subject: [PATCH 14/14] Bump version from 1.5.0 to prepare for 1.6.0 release --- Chart.yaml | 2 +- README.md | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/Chart.yaml b/Chart.yaml index 0e635b7..6d6c683 100644 --- a/Chart.yaml +++ b/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v2 name: private-ai description: A Helm chart that deploys the Private AI deidentification solution -version: 1.5.0 +version: 1.6.0 # This is the default version deployed by the chart. # However, this is simply a label - if you wish to change the version, update your values.yaml diff --git a/README.md b/README.md index a9af10c..6b85c0a 100644 --- a/README.md +++ b/README.md @@ -29,7 +29,7 @@ kubectl -n private-ai create secret docker-registry crprivateaiprod-creds \ helm registry login crprivateaiprod.azurecr.io # Create a custom values file for your specific installation -helm show values oci://crprivateaiprod.azurecr.io/helm/private-ai:1.5.0 > values.custom.yaml +helm show values oci://crprivateaiprod.azurecr.io/helm/private-ai:1.6.0 > values.custom.yaml # Copy your license.json file contents and paste them into the license.data section of the values.custom.yaml file with single quotes surrounding, as per below license: @@ -40,7 +40,7 @@ helm upgrade --install \ private-ai oci://crprivateaiprod.azurecr.io/helm/private-ai \ --namespace private-ai \ -f values.custom.yaml \ - --version 1.5.0 + --version 1.6.0 ``` ## Testing @@ -109,7 +109,7 @@ helm upgrade --install \ private-ai oci://crprivateaiprod.azurecr.io/helm/private-ai \ --namespace private-ai \ -f values.custom.yaml \ - --version 1.5.0 + --version 1.6.0 ``` ### External Secrets Operator @@ -275,5 +275,5 @@ helm upgrade --install \ private-ai oci://crprivateaiprod.azurecr.io/helm/private-ai \ --namespace private-ai \ -f values.custom.yaml \ - --version 1.5.0 + --version 1.6.0 ```