From bf30af4f61f1c16232a5b36c58ae8495e23fa299 Mon Sep 17 00:00:00 2001 From: Annie_wang Date: Fri, 15 Jul 2022 16:48:29 +0800 Subject: [PATCH] update docs Signed-off-by: Annie_wang --- .../security/accesstoken-guidelines.md | 46 +++++++- .../security/accesstoken-overview.md | 108 ++++++++++-------- .../security/figures/permission-workflow.png | Bin 26962 -> 27019 bytes .../security/permission-list.md | 15 +-- 4 files changed, 105 insertions(+), 64 deletions(-) diff --git a/en/application-dev/security/accesstoken-guidelines.md b/en/application-dev/security/accesstoken-guidelines.md index 0eefcc9175..2e706b7617 100644 --- a/en/application-dev/security/accesstoken-guidelines.md +++ b/en/application-dev/security/accesstoken-guidelines.md @@ -24,9 +24,13 @@ The table below lists only the API used in this guide. For more information, see ## Declaring Permissions -### config.json +Declare the permissions required by the app one by one in the project configuration file. The app cannot obtain the permissions that are not declared in the configuration file. The ability framework provides two models: Feature Ability (FA) model and Stage model. For more information, see [Ability Framework Overview](../ability/ability-brief.md). -Declare the permissions required by the app one by one in the **config.json** file. The app can obtain permissions that have been declared in the **config.json** file. +Note that the app bundle structure and configuration file vary with the ability framework model. + +### FA Model + +For the apps based on the FA model, declare the permissions in the **config.json** file. **Description of config.json** @@ -40,6 +44,41 @@ Declare the permissions required by the app one by one in the **config.json** fi **Example** +```json +{ + "module" : { + "reqPermissions":[ + { + "name" : "ohos.permission.PERMISSION1", + "reason": "$string:reason", + "usedScene": { + "abilities": [ + "FormAbility" + ], + "when":"inuse" + } + }, + { + "name" : "ohos.permission.PERMISSION2", + "reason": "$string:reason", + "usedScene": { + "abilities": [ + "FormAbility" + ], + "when":"always" + } + } + ], + } +} +``` + +### Stage Model + +For the apps based on the stage model, declare the permissions in the **module.json5** file. + +**Example** + ```json { "module" : { @@ -68,11 +107,12 @@ Declare the permissions required by the app one by one in the **config.json** fi } } ``` + ## Declaring the ACL The permission level of **ohos.permission.PERMISSION2** is **system_basic**, which is higher than the app's APL. In this case, use the ACL. -In addition to declaring all the permissions in the **config.json** file, you must declare the permissions whose levels are higher than the app's APL in the app's [profile](../quick-start/app-provision-structure.md). In this example, declare the permission under the **acls** field: +In addition to declaring all the permissions in the configuration file, you must declare the permissions whose levels are higher than the app's APL in the app's [profile](../quick-start/app-provision-structure.md). In this example, declare the permission under the **acls** field: ```json { "version-name": "1.0.0", diff --git a/en/application-dev/security/accesstoken-overview.md b/en/application-dev/security/accesstoken-overview.md index f4241cadfe..4537e67fa4 100644 --- a/en/application-dev/security/accesstoken-overview.md +++ b/en/application-dev/security/accesstoken-overview.md @@ -1,6 +1,5 @@ # Access Control Overview -## Introduction AccessTokenManager (ATM) implements unified app permission management based on access tokens on OpenHarmony. By default, apps can access limited system resources. However, in some cases, an app needs to access excess data (including personal data) and functions of the system or another app to implement extended functions. The system or apps must also share their data or functions through interfaces in an explicit manner. OpenHarmony uses app permissions to perform access control and prevent improper or malicious use of these data or functions. @@ -12,9 +11,9 @@ App permissions are used to protect the following objects: Without the required permissions, an app cannot access or perform operations on the target object. Permissions must be clearly defined for apps. With well-defined app permissions, the system can standardize the behavior of apps and protect user privacy. Before an app accesses the target object, the target object verifies the app's permissions and denies the access if the app does not have required permissions. -Currently, ATM performs app permission verification based on the token identity (Token ID). A token ID identifies an app. The ATM manages app permissions based on the app's token ID. +Currently, ATM verifies app permissions based on the token identity (Token ID). A token ID identifies an app. The ATM manages app permissions based on the app's token ID. -## How to Develop +## Permission Workflow Determine the permissions required for an app to access data or perform an operation. Declare the required permissions in the app installation package. @@ -22,12 +21,34 @@ Determine whether the required permissions need to be authorized by users. If ye After the user grants permissions to the app, the app can access the data or perform the operation. -The figure below shows the process. +The figure below shows the permission workflow. ![](figures/permission-workflow.png) +1. Refer to the figure below for the process of applying for app permissions. + +![](figures/permission-application-process.png) + +1. For details about the mapping between the application Ability Privilege Level (APL) and permission level, see [Permission Levels](#permission-levels). + +2. The permission authorization modes include user_grant (permission granted by the user) and system_grant (permission granted by the system). For details, see [Permission Authorization Modes](#permission-authorization-mode). + +3. A low-level app can have a high-level permission by using the Access Control List (ACL). For details, see [ACL](#acl). + ## When to Use +### Basic Principles + +Observe the following principles for permission management: + +- Provide clear description about the app functions and scenarios for each permission required by the app so that users can clearly know why and when these permissions are required. Do not induce or mislead users' authorization. The permissions on an app must comply with the description provided in the app. +- Use the principle of least authority for user permissions. Allow only necessary permissions for service functions. +- When an app is started for the first time, avoid frequently displaying dialog boxes to request permissions. Allow the app to apply for permissions only when it needs to use the corresponding service functions. +- If a user rejects to authorize a permission, the user can still use functions irrelevant to this permission and can register and access the app. +- Provide no more message if a user rejects the authorization required by a function. Provide onscreen instructions to direct the user to grant the permission in **Settings** if the user triggers this function again or needs to use this function. + +- All the permissions granted to apps must come from the [Permission List](permission-list.md). Custom permissions are not allowed for apps currently. + ### Scenarios The following describes two common scenarios. @@ -46,25 +67,13 @@ The following describes two common scenarios. ohos.permission.CAMERA (allowing the apps to use the camera to take photos and record videos) -### Basic Principles - -Observe the following principles for permission management: - -- Provide clear description about the app functions and scenarios for each permission required by the app so that users can clearly know why and when these permissions are required. Do not induce or mislead users' authorization. The permissions on an app must comply with the description provided in the app. -- Use the principle of least authority for user permissions. Allow only necessary permissions for service functions. -- When an app is started for the first time, avoid frequently displaying dialog boxes to request permissions. Allow the app to apply for permissions only when it needs to use the corresponding service functions. -- If a user rejects to authorize a permission, the user can still use functions irrelevant to this permission and can register and access the app. -- Provide no more message if a user rejects the authorization required by a function. Provide onscreen instructions to direct the user to grant the permission in **Settings** if the user triggers this function again or needs to use this function. - -- All the permissions granted to apps must come from the Permission List. Custom permissions are not allowed for apps currently. - ## Permission Levels To protect user privacy, ATM defines different permission levels based on the sensitivity of the data involved or the security threat of the ability. -### App APL +### App APLs -The ability privilege level (APL) defines the priority of the app permission requested. Apps of different APLs can apply for permissions of different levels. +The APL defines the priority of the app permission requested. Apps of different APLs can apply for permissions of different levels. The table below describes the APLs. @@ -78,7 +87,7 @@ By default, apps are of the normal APL. For the app of the system_basic or system_core APL, declare the app APL level in the **apl** field in the app's profile, and use the profile signing tool to generate a certificate when developing the app installation package. For details about the signing process, see [Hapsigner Guide](hapsigntool-guidelines.md). -### Permission Levels +### Levels of Permissions The permissions open to apps vary with the permission level. The permission levels include the following in ascending order of seniority. @@ -100,33 +109,6 @@ The permissions open to apps vary with the permission level. The permission leve The permissions of this type are not open to any app currently. -### ACL - -As described above, permission levels and app APLs are in one-to-one correspondence. In principle, **an app with a lower APL cannot apply for higher permissions by default**. - -The Access Control List (ACL) makes low-level apps have high-level permissions. - -**Example** - -The APL of app A is normal. App A needs to have permission B (system_basic level) and permission C (normal level). - -In this case, you can use the ACL to grant permission B to app A. - -For details, see [Using the ACL](#using-the-acl). -For details about whether the ACL is enabled for a permission, see [Permission List](permission-list.md). - -### Using the ACL - -If the permission required by an app has higher level than the app's APL, you can use the ACL to grant the permissions required. - -In addition to the preceding [authorization processes](#authorization-processes), you must declare the ACL. - -In other words, in addition to declaring the required permissions in the **config.json** file, you must declare the high-level permissions in the app's [profile](accesstoken-guidelines.md#declaring-the-acl). The subsequent steps of authorization are the same. - -**NOTE** - -Declare the target ACL in the **acl** field of the app's profile in the app installation package, and generate a certificate using the profile signing tool. For details about the signing process, see [Hapsigner Guide](hapsigntool-guidelines.md). - ## Permission Authorization Modes Permissions can be classified into the following types based on the authorization mode: @@ -151,15 +133,15 @@ Permissions can be classified into the following types based on the authorizatio The process for an app obtaining the required permissions varies depending on the permission authorization mode. -- For a system_grant permission, you need to [declare the permission](accesstoken-guidelines.md) in the **config.json** file. The permission will be pre-granted when the app is installed. +- For a system_grant permission, you need to [declare the permission](accesstoken-guidelines.md#declaring-permissions) in the configuration file. The permission will be pre-granted when the app is installed. -- For a user_grant permission, you need to [declare the permission](accesstoken-guidelines.md) in the **config.json** file, and a dialog box needs to be displayed to request user authorization during the running of the app. +- For a user_grant permission, you need to [declare the permission](accesstoken-guidelines.md#declaring-permissions) in the configuration file and trigger user authorization through a dialog box during the running of the app. ### Permission Authorization Process (user_grant) The procedure is as follows: -1. In the **config.json** file, declare the permissions required by the app. For details, see [Access Control Development](accesstoken-guidelines.md). +1. In the configuration file, declare the permissions required by the app. For details, see [Access Control Development](accesstoken-guidelines.md). 2. Associate the object that requires the permissions in the app with the target permissions. In this way, the user knows the operations to be granted with the specified permissions. @@ -170,7 +152,33 @@ The procedure is as follows: **Precautions** - Check the app's permission each time before the operation requiring the permission is performed. - - To check whether a user has granted specific permissions to your app, use the [verifyAccessToken](../reference/apis/js-apis-abilityAccessCtrl.md) method. This method returns [PERMISSION_GRANTED](../reference/apis/js-apis-abilityAccessCtrl.md) or [PERMISSION_DENIED](../reference/apis/js-apis-abilityAccessCtrl.md). For details about the sample code, see [Access Control Development](accesstoken-guidelines.md). - Users must be able to understand and control the authorization of user_grant permissions. During the running process, the app requiring user authorization must proactively call the API to dynamically request the authorization. Then, the system displays a dialog box asking the user to grant the requested permission. The user will determine whether to grant the permission based on the running context of the app. - The permission authorized is not permanent, because the user may revoke the authorization at any time. Therefore, even if the user has granted the requested permission to the app, the app must check for the permission before calling the API controlled by this permission. + +## ACL + +As described above, permission levels and app APLs are in one-to-one correspondence. In principle, **an app with a lower APL cannot apply for higher permissions by default**. + +The ACL makes low-level apps have high-level permissions. + +**Example** + +The APL of app A is normal. App A needs to have permission B (system_basic level) and permission C (normal level). + +In this case, you can use the ACL to grant permission B to app A. + +For details, see [Using the ACL](#using-the-acl). +For details about whether a permission can be enabled through the ACL, see the [Permission List](permission-list.md). + +### Using the ACL + +If the permission required by an app has higher level than the app's APL, you can use the ACL to grant the permissions required. + +In addition to the preceding [authorization processes](#authorization-processes), you must declare the ACL. + +In other words, in addition to declaring the required permissions in the **config.json** file, you must declare the high-level permissions in the app's [profile](accesstoken-guidelines.md#declaring-the-acl). The subsequent steps of authorization are the same. + +**NOTE** + +Declare the target ACL in the **acl** field of the app's profile in the app installation package, and generate a certificate using the profile signing tool. For details about the signing process, see [Hapsigner Guide](hapsigntool-guidelines.md). diff --git a/en/application-dev/security/figures/permission-workflow.png b/en/application-dev/security/figures/permission-workflow.png index 03d329c575e822c92f0dc4b9d0323e1a90405073..db44f9d26d422c2eff640ca123a4d2ede0b91b72 100644 GIT binary patch delta 15765 zcmc(`WmFwqxTTwrKyddU0fKKV1h)hYt^tBe2pZgiRdBc9?yehWW5F#z@J+Db?(SWD zU!QZ&xMz$W_x|W^e!;3@Rn@AhwdOmYSz}{QL&u*+eMB&S1=Uz*0GdZDOVB9|)Oq~- zQ82H!DmTl{WpiSvE%-|diG7cWLNZRS9qtZS*hGAf8#~#pmDsF=#{4SoZw2qqa#D^X zN%+(TBb7amwcoH~G&Oth?s}J#?F1bkRW7q)7u*!WNO$trmRrbEphMYoB*e)|r}SL) zm75wwhZPT=&pL0;fS=oJm=gXC({22XKPi1-~w-2THp{>^g(@4@6h`1%=)3cS1 zCla@t7t?u~(ZI-ui!4VGQKAFsEhe{!tkrU|Gq~<`q7>|Hae}&jSvuyK%WnQaq+jh~ z)w(pfPJw`nooCR{>bh3m#+IL%2BZ2eTi0=YIOl?RI887vSNw#T%8GQhcsS$Z72B8E zlfV72k3!SyyN$X`2ffP>nTs-HX7K2~kvf16a|<~FBYJNnB9~*aoY&)b991r&9=oP(Mdvatqr1DYoqC^Jy8nrF z(f#wR^KJQ_z{hDT{W;g+^EMa#`nz`fk*V`Ts2h(Y&-6jvtX!LLne~;_FVt8H)F+Zq zrw^q7Ll1uUTozoQ+`7&Hk`;Qfx@|Zaw+BrfcG^r`H=phPMmF$xNbc`&xwHy@Tn5Fq zNKYISr@(j0#!}%FTwag&QYD8t)KMZc8y3339KF=NZ`n+5!x8Hd`Ere%Nn3YPj8eS< zNv1lEHBowJpiy=jFBUF`A8&&2M(1o75GQvIEF2^%TbNt&LmWV{ch&wO@TBcF1xKZn zA+bZ`VVWz^%K@cLaDu^8rNgJg-jHu0yS_wkcpf~(Zq)1jry_Fq(+82~oD zr%HS)fRl3Xs*Tz3LS}PW=vz?ML|lWi*YC`X%2za$)jiB5`(xzD>Q?!`iKTHZa{H?C zB|}LodLzG9apXvblk((vTHy9qzPm!^>$yA2RojXY#dKKZ)wrVXj*cMP?t>0%h>{-k z8>7<#11PDd^%}*{IKNk;dKCU});B;vWav?g3x zZXE$J0PJ0Sw}4gBn-1w?E0$GvQp(rkn3Vn;T+d{8wn{7=p>Fr$bDDr32X;9Kz4Lq? zLOdvPQIq3Xg`-7Z&7!NH3}QE}sI2nhjv(w(a$K>b<78D9zgG8FEL->pkRgT~Q68@g zyWR_9>RZ$*$}41dwMu*A#Vjt9;Fz*G+y5MQhsOBoHMGD@O4HDoCa|yC54Q>pVqgfkp_#9K{8~r9j(mp z)Ch~>GZlHu={qmLDEphk_$!`JmCqdr-MpEe_6~>3&!9C%KPpT0@Z%@ZI)9*V5z9ox zyzP_ENQ`2LURhnmY01m$(wmFMLc?Dn%yENO^SJE(MCiVh<86V@qzG^udK)2R3p9hj zr+~l0o)FIZYT4Tv*&-r=*?)_d^Upd3ME6;5D}{HyWN(u0w{(ZECEJ^huGK z<9$A}%_VAtK)5~!2YB6hDsMt84IH=z(v-uFNk_wh>Q4q)`#SQ_?VpTYviTa>D)|Xb z#BD}Kh?w;qmt9cVq07Bd?QKHaV+*vZ0AZBb8~ByRhyt!yR4kre>G&uA?KkIfd3%~U1kYFajR>4{Osyds6?Qrx?>Z*!K^ zUqI^r*zF#Bas_hWDt6Bt!h5D-aK2e(_Q@#YX;;`;{1U4KAccVWs9kgC>TI|4G4}h2?T- z*OXl+F(1A2dEmXY(BXWNm~HtH)wx#6Z-&6C;+$qh;-)& zCfAbl4hUcjsNYf+7$UUsW=pSdst~ihdNurAa%_!}}!x3z^T@&ffeEC1RLC zoalI3n|XLGB$2N>Se2&0IkkfWY?8zZlJa$3pboA?Q|laZ4pRu#s0R;3Ffn9l?Otjv zfn-R;5MW5`0zP->#+os&HJE|M4lShdWD6&nM77ShWym|F+xhyMP-`tRm6h(Q8d3}k z3)?N3yD*8)@}CvT8WAQwXlSu$=gpQK`6eZzCz<;q<>i-Boyk|491CGE=aomIZ z2dEg9Izh_c&p7e3y*~*yJvrD@slUr&?tSw<5V06<65g1FjYc?Wq+JU@<$@VMRr^rO zk(w%~|5d}+luhen=&`0+T^DqkrG(i-@EkQWQ)g<)QwWE=zd2K3LYTWLxIVq#LfFe< z{ad3mIzP~j9=IQ0?}0I@tDVdYi;mc?G!2I@GKRxx&UKqh)hA4azXaLKS2@)WoRUne z#h72OOt|ebsT@m?lPLqkA}-G=&FdIC_3}eXMV#p4t_8BmcCMS%Htnb~v}X-0 zE$T@=L*X*{9d!nQC$KuT8NwjhfFl1omNP=_G|f5)?rdoBZ67cKjhhHPBlkBFsg`$~ z;oq1UuaStY=I`Y;af*Y)jMdniHKHMvuDcr{8=K_G`X=hI;+2FQQCaU!ZtX|JMOA10d7P>2< zjhX(jZds^51#zGQAFCSCjqj40Vxt*W>YOvv>`*pxtZ>X=?kcM{9yqTst6Ilfi10eYUQWvV3}PwZt`6L9ll#cvqs z1i+a3yBdmWVNf!gE7GgWbqj;;CYc0-kqA^sVjA0Yi&0sxchL-SiM7m|Dk?~n_22%p z=xH-%!PM#5+QR~fjnd3^aeA};MDUJIa+zcM=3eRUKiX|-=NC3a$+`Gw;Z5e}K*Sv$ zbtXWz1(8emDMwIgs79kF5wb{4pnerEHvCSWRZ|TuMag*Zg-}<~z@0tsqn68!Y;f*gpwGpIkiCA8^St*vIY# zzLtufPsx3Yn7EX)5+m5Ytr6D4TMjjmAt_&=aHgYNcdM@Ct~u#3+@G?VUS>XWWVvNw zW*=MBE7GH<`rsIW=dXERXXY`ND=^l*1A(k`S8u$~buqDX9(b&AkE(`C@hm?Y|o&SREBl=mRmdZ zWLPehl^XorCu>b_+L@j~Zf;$Ic(vuaXVe!aUJK$Loh!Kmn-U3Gxd>?L&zTg&rzuGv zx`PiDl>{?rCYHq;1Oh8I_OG43+y){tL68l9M0h4?KILrf*BeA%!6jq>pYTRH-L0yI z9_?01r1;(Htn!6`{O?W9lD*TG?d8FlDiuaR;-{P0gDLm3QTyvQVJCamvW)7BfQy5?e z-%P*`JlJjU0V~p_ITnfpqr`WO6BFK%FO%0!PB)<#%%^{%ni@LC?@GO=5|dI>t0Z(Wj3ZqP&y=R02w%X1nxX2r=3TM&W`e zh3RjW{nHF8txJqg@;PH}K=oOd9~mJ-58LpZRd0X@clKG4cxhQfMPO41wK%53!WztpB&`gui2)^huVzI;In7*71W8liyS`&wev zs!q;!DOeyW^Btj5ICh@a(LuGZ`-%i^o^t;t8-z~Z+}s_~z5Un!hL^R=;yCE_YJ@bt z?3>V!VUNmG{DvllTE>(>+3kH$a80Zq11-H{%Z1`vj3zlhKnd_qQ$JS>imNRBP^#ji zB#cM$ILhM?h%VWX3cuT$Fdc?sM`#YdGHR_q4GS|a^O4O|)PggV^lzYlk2nQ5bW+y! z!auSdLCMZ2lR;?o_EXTo@n1D^7D_4Ne?>`b1!ix&Ty#zbCi`wBE?!iu(xF#b0i~)8v5~h zCjvpIj@jVik{VC4B0=)@S2s)M&lLJ)G&S_ zd2bU+tC?wpe!RZGQkwgWh=AGmHo|@kP-Pe7aw`kl8N#yrs}ovNt~E<(Jka;r@Kdn$ z4rjD6c@GmriQ~yPhw1dMaS<`nM~c$S!AOlcpJM0U8%g-?ItsD!)XENScjL6Iy%I1M z)XdDr2bvp=3C@jpgh9nG&i?No_1Ume{KStDx9D8b-CF8?X(OysPzOmK;3rt>`TYTl zreJwCXXXKWPD3A(_++Eayh0cQW=R!GA!7u@dzt_ur_WV$})3f=N zc+qi5&f##0FUQ@CFhoJu50alSrfQHZjQnt4J9;T6`R4v$jl215F!b_#*z$5OxM|Fr zi>Zjq&@1WVe2~>8<0c)jX_y)4BOXkF>!!JxHFFpjeN2@d7~Cr-`r=dWqU*O;Ugz~W zQ3;bT3alM7%?3?8EPLrMhoAyufe`*a@5TZ2#P!Z<$>4nhWmfx@W$c8M&}<81R8llG zs>h@ju?~noRnHzX^3JoTRf-DMd8VZ+h(z!?yB!>?(Pp^$E>o+i&T}{D zIPru>W);%g3Go#L#6q7k!9_dt0j+?!Uv8x}aWwiuD!bns5Hi8X^0g~E(=TusM=-eu z2otr8ETY?vfTZ`DHySjbWrvpWNun<9eA>ufJy-(|ja1lsXss9RTpoMV37^H4?W4k9 z9}ku&X)3>h*;x1lK{s-mi?In10SS0{zBnmF$;)aF`z zx^lwrPY2)og9Rr7LIyS^S!o`s`7n|D%lKx#ExNpvv%!&qp49?6DEhaf7|pxPzvi*S zBy{u<0Nj3;V*PgZ+pXDwJm0<9+czQ1hR&O9CYcRYsCe9_)Da8I-6lqy#RiN#$%03( z8f8xx=5oeyqd4h;TN+6sH(TIa0_|kit8~=O@ct0gvJ*P@A1*j8JQq}U4&jtCi}p|+ z9z0?k0Fb}?~8_b>v%6D=!iR9|O#7Q8^~r<Y_O~3442JbPOSNmjJ9ahB(Jnh9=omMYpF@Hi8CXizVY^-tfl)gD=*Mn6BI=SL}&9}hWRp~rY^hK`iY^79rZtK8nG|w2c|!fQtafWI_x7Ej9b}R zf73Ie3>H)`vn)6XVXYjz#x372-QiY&@k+MAE20M%m&(&&Z)k-l`d4hWy{P|$3LyjH ze(y*YQnUq?V&b0;@@Oe(wBhRifen1E&-QAA8Ex=xPjX$X1--DH&N-) zk+e4!FnF0Qlj*;{wEfYm0#hYDj;V^__Iz?Jv<%-L;oYv`#}oKcUC$tcfQn$i_{q9~ zH#Swt!gt$1236hY4KIYWY8}3U!X2KoGaU5~TLGe0&}kmZb#i~+%2GAcqHpEZ_GE|e zr4cJ(xU#E7LbsUi^Qk*U%MNLCw{*Vm^|>C)`-5RJpV|}2zccM9h1U*fs7%9#lj$$v zmS5wAHKQX8pNFv0>8inihSxHV(5>w8?gB#Jd*Xn*3GtdsrxNcmt2|2s`|0kJfL?nh zrDA6nvro+giP`IyKD+z_);LafsFl+4SSV9&WQob)(Cz%!G_w`gxEPk}#@&}pyIwcJ zf1lq9_^8p-h_a&M(owOrHW$lyDGu;rih9EURr?1 ze!tZfbTg4_7;ZKMa8cpt`hHr8n^gEL7;0sRvNzGg)g{*8;0t55)y8x(IZruES2%^O z`kKrKfBn-ClfZ92p?%ByX~91BXD*&O^Hhsvhqr{oVRG_vl0{;beBS~UOxq$v_Owl` z`>RlsPC=hY!k1Otw`g-q1x(GEKOvJs7a7Lk=!Kt z3REHDO2%yiaF_}zMr@x(-}%;T$J3LF17ZrkKg*BQA`Uie5yQ(XD7p<>kqSIZBN;W>hij%2 z_|xKN^{%hg2kISV7QY=cgjC1;Qb?5h1BArP|t9 zyNi__u}CPX4)$O5Y7~pSe;`^GrxY_S6HhzM=IJz}+(tsPAOqc)R1u_maz!8u zC?R#ZcarPyAG)@Q(q^2hOPT+P4L6uu zg9t&1}jb^xRR@nBLh3;ZIx*UH&FKmJ9CMs{^X`av@#qMq)!%rNOzZaxBy6#iVz zySuu<%lRXLv6-RELXI#7FI=ba-FfP~rd9s^(U@}lZq*-0ku}zYWva<@itQYFal)-C z?89YrXk#ai!v$KWNb^!1(MVj*6PwB_QXn9t;sQb@cpsT)zj5}0;S6C^{nw*GbCuH8 zyP5Y5%+}=x2hB{~77n^OjzOG|v}LBEdD;YMPWtL(aPt{+l``zNpL|tH-d_$qf-J1F z*-3|lMBDFGr^xNHX&6>T7sur3PqRQcRS#CK)Gq}rP79A{z>AC`mFN-4-e=Kc=V%3p znktQ!H4Jq;F=Ab%5%!+i0LS0QrTStN%EiZb_tK76??pdvpA*pNYASJ7?LgJl~+2xc8e$BaOA-WBa(79ckOPljl`R_ z@tKimDh!Q~fs(3XzAZgAB&4yk@;X$EqgfwI?S3oX1MegzS$hmR%zlX{5Q5NHR8oE@ zz^#@roc1pVG(z$QZ!fJyYGHIX$5)G*!XvHAt$V|(iPwY%-l$KG*8$JFMz71Ggp6om z<`tx~jwu@Xu>^k)t-d8zE7uV6ytSDZK_ zj_08)02bJHV4q}C_pfIL?26EKIINu_k~h$F`FNDWFRC~_BP2;t3+=MnUV>1Nf8tV! zMjU)>RNg8oTZ_9!35uI#%#k%;zJrvVD_ZLj$4`XghiH0L?gc zWU>C}@;oR9>A9-3(KTQlAFdRb@{6NtTb_B}V{`ZOp-4xe~)(AvF z<-vG{I(B2i9HY&RwTg1^lv&rxcTUfei3Eb<7DCgyLR#QWFF>t(n~~;nxIQHgO5*Sr zE=L{c@-o+1X6=m497AVP9A)`o3f!B`Kr~{oa5y75u94&Q^|RG5>G*jb=R|Z&GQgU) zC)0eM3!1IDd-^U~lSG8D$?mt210{a8V`GsnzruQ%c=52Nn?=hlB+uF=~F=nR{IwbEq2a)OV0jUzQu`Bc@ zg4t%jpTEgMIL;l!8XWf>*eLY*fXHbg9{Xt&*6{E9uxisjW(E*)3i^NgP^C;N>^aT%gMP zhx-Y*J%Yb*gMZkd703qt{Qm)e0_Pw$>WH9cb3R{>_zHl7CYJSIxSv447N+;|MPt~A z85GWV`*lE-+`i*U#L$o*==22`qJ!uDFZbhkqOO)ekX87n+lqD4gn_Aq(48HMjD~Og z~VP{2>!~k6p z?-&VoUL+r|HB2JLmmPw{;Efo|_~|?zKYbi~*jm zpcU&+kKSo-IX}?&5l6amP|~y%EmCmpa|z)tGkMEio*&A(kcu+Egm(oF6ppCyKoMm< zpQ__ZAu~~+&(KU_-216<8M&yfftRg5D+((ba$R6Y#1Uc3q;Q>ZdsF9Zh>n@TC8r&}eq z{!{e-6ZVioj z^4o!vvxKcRJtg2^4XZoe_(JJhrSecX1f5FhGv8iq&ELT4jCNbYWYGE~yQV+;>0*l6 z-q;fex7-^ZiS`kLBZl;(devMY$z_n2=Ch;YSplu-F##Fm79D$2QvZ6m*Py%O>ZOT` zRKV-T03toXA9(2b#3VjnGHr*-u}GHg>~x|-jz^lqFK(xB5^$}_v_Zwxkt zQD8?R9W_hf8WI%-r0fx=5ms1(6p*PfWqR&hb3OzeM1$y^?EBz*L)=qY8B>o;6NAl< z2n17kR~d~YQzyn34<=jeLbWCZ>6-tge?GSxX8+XJkL9&oj}V8+`%m@infHD$J9_~c zqA%1==C#QNf~0<#NHMs(RV~D44^5E*&B^cL}~FYU^~^xkHG{x@#{vC z9%L#7Yp6^1X2K?V#eFGMFdBDpOA9Tn{KT6Y1#^25L<>)OOMc3OVyizcJ#V8a*p4Np ztKZMN{8Lp&(_Lt|Os#Z&6G$jqDi@Y)#4a^$#BW=q+~I zbJQD^aB;ZPnf^5WHP_KD%nPbdlhD?wE97J%<53vXyV&JQlaE+z_*k2cv^Svt!R1-2 zk+bTQDXpl_v|bUM7#UWx`9=TDiQ48a#A;ONtzpcRF8;)UhQ=Wi{aJ31aqB*M>-Sx=Sm(}&2z#u7a1n<<_?@@oT^!L~gXs1-r zZR7N^=^&OCipNwkOjTf)%qWWYd!`BAm1~tU6!k)C%V!kg_tNu{5-lqZWZq4<1hhW2 z{b*V?o2bD$LYqK{fZe=kPYodapq@wRj z>sTQJW$LoGb0{$V9F#}Aqp@Kyjybx`x3Pwz3P@zBWU{$3&0^+l827i5t{GzAFe<_7 zC>Rt>+{+X(Ww;4fxCT^J$#AeLA+kjpZVO}(Z0glJaa67E*^PgN<*LEdqH z;h%FSVEEYdqz1BpDyQtg&h^rG@}somd5mC&t!kaw{Eqswycrpu?+dI*do0ntRYJGw zlu^1;Gc35hy+j5v$rJ!?=^5|uwH-yL^hko0lFFMsdf@asAQiRU!q5mQ+HBK?RIiVVAc2{Yl3fueD=%lWrz_@$9NkjFqYYj z#qF>uC;YX6l|L*DcEp1Yx#P9SFFKY#HCy@Axb9wF2_){*2lN7&e&5Cl^`gm5@)5k~` z=~+B|uVcsHxB2+Jt$HLMC;B?`6@`Uz|B&9rHMs@*f*x_52N!wXN;6D7RaHS%4AnZ6 z83Az@S$VtQd%&fzq0BU4=QWs`^4$(&Hgbzf)q6PzO_+Jho{Z(tf?Zmcbk0%Ss9npN znXHk$Hq=|h^NZg>j|3>3?x`o7GEUtUwP;`yxZ8{Ci{F~)#@?bwh3f42G;=p8p)%|p zuwPpAo_w260MG3D`zF8jCr2`eBE8c9nN*%x>u;`20AcGbt7#!ekqUqoC;RO7qczf@ zz_KC)HTDJ{hxN?1%4*|wo-eT)U z@i_xdLQ%(<5b|?NY#uU<9$2sL%>Kw$i=54k>$Q;Ztvc54#P}xTmdV+K#Yqyos6v~{ zt$_n%#gA#C?K>}rmoH>}PMW(XCN_Gg4_{2(JliO@y4W~fqdISnELg<5w4oIw-zi&Y zy)7Sp?ii&3I~EZANDoF-42hqCFoWTA##i+s!Z7h~%zKSj0H`qjZ{k4!PQteDRN&V#SM8U@+IrMC|6_*b%G$M^**WmcUPYif0!}Gq}t_+`?`~S9474Cfg z5?uW0s{-g&WK>@&=zWbw%PLdlU*nXk1O>uBQ6djRqh#0`a^8RJY$}|<_2dqhJjZP8 zzov=)zlDi_f6_z^pLETZhg;&myq(+rzNRh^q1#%q&MvuJ#QTzB7Vh?jdIUqZt8hZ^ zgW`_=7761AY2l9LyxJ%f|qUan{}c$om~tw+c2JiJ6j2oZ|-7dJ-xgY*_s&=ODh=#dh$%Bcnz`iMQ`Qe5u;qT-#t#C9)>zTi{& z?-JvGp)d{wA3$mFL;Zh`!T|X=4Y`-HCI+{2xux;$CSq zU&EW*6KZ1al94is-1u&f-wW+Q+2vW;UJu$y<%TXEH;Xm_4%W9$QX-?8hX&XfmrneA zxT{c`*$2WA)}QW86JOb$uUxz>O#-Lxp+d|0Ec36zW0R+51uN0LPnzZdg+9dM+B+yd z!+1p*5?-;z?wnE(VyFeQ?9U~t)B0yb1^>e2EXXWTbGk?lag)DN;>lx=I~Q{O$poAo z;)dUtg<(D!Q#v12!`|0B9eqedr&VjJGak?8V;^Dd@;1qX=g^6?hX~0!aQMpInm4lV zjqST$Z0+deGqYTy&j7mESJ|>fPDEfdHak|}pJ)+WF}~~z&V>Br0JbiU)ZDamyV#8S zw&?l*>o9s?dG1*4T(#^(+CXiFDx>TyfHi4pp0v-?SR9(L_(f_l?c>P7v5Py?$mCV< za9iMgYiPn`$c@o`%$qqqtd0lw4hFN1Q<25`KH?S0&H`xwuT{`I3brOfUr`s5Co%6P zs^WpQDo_0V?8Uy}V8_07L032@3toY`Qc0=4M)l+^xBx0$u%Mn=x4Wa&8_)Hu{S>{} zniaoxOKQant$uW62gGqyOrL3QCm5H)AAJ2wx*9F!3Yw~LOP8Oz^56-WY99`vzY-F= zjie~OL;$RkwSridZ^4ND4C0eC)%dJiqy(q2j82mo$6XKQ3>l~m5@}bbK=Ae-y@=`E z4X)6W;SNnG00W8tvJNdB8FpKhwZ7ekho|lvowP*~{tc$El8W{p=xlAXdk1zdEIJSA zLfN4jA#s`+8H@wp19!4w_ojuGwr%F*AJZX#SKH?>{QR$hHjcP?2^sQd{3t#FR9~E^ zEDM;4RWikQ1ZbKl2G=kobp zFV7+2cvxxo>r)~%G9jG@hideDF2#4Pz7MvSt&fY*QB3$YPH7SycK>(eKY7-xLL=+ zU}~7Xcc>J85&x7{0HWCjRr$2d!mzb%(6~umx~Sm`YNM}=|A?Vx`7>tkG5}GtS&}cZ z=`?dGOMwEX?BTUtczh_V-}q1WSyJ)(6{=9fcJb@qu;-!WsUp93aP}8>k#GwRhDm9O zOtWOdp~J^q~3zz&R@;we8O2QvZual-yA9p+E5N=5IaMh z-u~TjfNg#$tbp~GW@P1=t^&qWt|pVZF#2s4#es{EK>o%K6c%8nki@!7L-CtX2 ze;Dgw7OU4CH>EAZ$cW_0$FcRsfY@jQOtX=>EeV0nAq1a zh$AmO|8!FiuUginy zDb$wq+o#rWsk#A9k)jvA!50@Dr{4yRk7?6B9PW{o59Hf%=uj7#diY-~ zzAAB-ofOmcVN~$jIlgUL7Y zf`YpB?a#}8nX9`$`?bTm0s%*qU>3UJgQ8Uc3TDiokK_PK(>si^A@WAb3If20{f5$(J0d|N(374S~GhmpkA@IM3tDXZ=oCg0YsPoO3 z!UAxXe`RS_1w#Zi5^4HNicd?QllHxHNZ6?YyEbK1Q}F4u9C59^z1W6pDjnH{tPI=`I`Bulx2E$)otZ2uwiV%8*|i|j1Xwczll5?OZ?o- zo6SRq)*jL&%@&S;rj|%0TXd|1r-J8hv|PF1>g9?XP{8EVB~BM!7HRv}11&<&>pK`$ zI$TG)I|OOZq)rc|W@bm%C^Ob!jL1T~O?6D=)0cn;m{?B9DsTUjJj*)`_paC5jWm4` z=we}>?+zvbu~Wo-#amij^0CBGT_!z!+PZfn%_?tZ+nNFlv(YYmeF{FM8U?j83LSxw zpQEI(&mQg@^t=w$xN(uW9vrZTQOKCpICqW9FlHY@ov>7CRE*JA%dY0A6 z1ArgGBSo;g-fE}2eFZRR%ZGWO9N&EsJ93w04pl=2KMV3k3nwpx11}Fetl688*`52& ze!lg@zLyQcZ%kxw56s|Zi&9-H7MeD^hJ@mcli(KRWsn5vleZ2Ut5AK<;AQ)5usQAU zV&JI?_~3Er$m&xt^yY%uFcsA#gP#b%n)f1ElkczhE#H0xAE9y?@NM{@jXBt;@tmq!Ej#t=<4Mj%2}}Kn5lFKy8BWX^nfu$1)Y`~ zY~P!n@@d!e5c|aG?F4wWm(Tl$uJi`a#TJcky)-X{`RDyy>eAmo(rdLI5<&+0&HU_? zP`iB6d~*r7*nFM2-G}gz?y$T`i}Zj;`zxfG_gB_J}8);xF^c^LaH#hi;~`c#GYcJnd8J>NW%iqABAkNwn>44Qh9>r*cgb zg180dN$`L;>Jgtu0HhkNS#jT^#UP?4AIDVCPxx;i5{ zzrX^12yoONBgkx^hrY+Mmp4F-7SfZ)4NGYulRbXZm0X$mFNBN#ou6qa|EQ^g^J}ku zg2~=tq`I1f6)swBY36>(`BwNYUF$#b-Oph)$zE3ling0`LR|Fc#1jQXy|1y5fD1|u z_J?tEj!W-KYNY~oIOq($yEXU!*+1~O>2v%VY5M5j?jUuR!3U#kjP3oEo3_TWE` zF{@s3pq(5pZB?$ww#8cxBWAWctwCTK4_l)pcp(wlBx!CcyIu6 z;@_VLYu;@HEK3K9^D)9K=qo5yHT9G&ol~k&;B@p(rbE@$^!inzNOQZcP!EkI2-tb( z&f``RSfrp((Nb^&Y9)dRhiJ)IKdWq@L+4+x4)WD0)o}8Ca*5U!9)fcBi zbMA-lkoB+7_W$@J+)s34O-;@9gvU#1ULU`6?l7+0imV?!Kjc_Q5>}Fb{L&~kW4D&u zcxSXpG#AOxwRopuGHEj)#`^^a(5Z|JE@Eom-_{HDj9_sstyHrx5HBY9GYwEt(v$lB zA|2D_Kf(-ZjQYLgjaVG|TdwPXvX#bv8~pT!-CP`3vf!v>-RwKH7Fpv&2o}rG@i;v$ z9m^lYaiPk0h$y(lUmp%w?;W!~MkqJ43!=nG(NgoZ2By*me7Q0RL%SO)*Ph#YchlL+ z>vr`tLPuSgFoT*j_3^{JHb%M1cm7X69w%C8F+4BjaAV9D7w3ga-Q%isdx&$lV#4Ej k9JF90ZDh%~`{Y67PD?$pe`vJ&3HT!|p&(u^YT)xf0B_p#C;$Ke delta 15771 zcmc(`Wmp{D+wB<$5zrYv#ku;S=mCcJ12LU3=Z@w>ESVVPXQ|^Ls>_ZJ6#BGb9i9-VJoFb6Yt6 z4ws)oM?3n>H3odt`@SjQ>Lexm&Gn)gv0w?&cS_qXT}S}sZIZrmh{~dtaV# z`*zpRKQj^(I3W{{2I=5#=UUFZ=L@)=d2t7?LAqFe}+9cA5TTHf-2$)1F8 zl(W;9Q|!2HBFUUWeRQh?M3jL7*_r&dc~xcsP79h^UMNTWc8TV?jJLup6@+c@ltVS4#lDd9(p9+7bJFE{ znQr0xx~IcRX|vVsTCeN($F|$%L!4ya@884YrdxQLn*th^tZpuB-G?N>IyvX+&$y#1 zWx#SgMa)~+@MUNBZ^*uAMh8r~IOSCz;x^r?WVZR#7C1-N)sw^B?qLW$wtIdYi8|pOy^vT^al1Q(#1ftYc^<;uC@DF2qETJiQRvd_oZ9jl%QdCUps4ou=CW{!T4St4 zD>ftUgqbAQlqx1>=QL*7AtVbonNd#twx(`0j70p6Ki}y+p9NeC(iMQlK{t|*v;3(6 zu4o-%Q_TLFU9r`$Y>`z0HJ0BlcXaoME(gg@6A&Fl1B?SRmBm8T6hA-LK9{%g7_?Jf z_kHn<^Qjv7@-Yi5Z3TQDQ#%^#eMs0CiKq${{o5PGPS|}oR@iSILxgq{YR~VXbLV{v zE}i1UA)J>9;a-YHku;mAST_S0uTOdGTWj|?mjX@Uw&=ANvM~gDGgCGi>larr6#=WM z5{SmSRh^m&EeRnr6-{4bM^+-Mzh=K#EcrI;V}Z~_ybOi#46?L>xukb=@rIgkV8X+t zBLB#jm-HfiXqzf&EpBgvaEnVxk1ee|=0)f<^5i2)nd}PsYm4Neq}8F>M@~CH=U+=M zgZHp)!0MZ~ojMs!^Nf;BU&UC*kDLA?LT=}#wGN8yP$8_No41rQtRELMyJuY!I+66m z+oWPt9b};A8eeEU`U?A<>9dgMB*CW!Vsz56x%4`LYL%4A9HsZF%<>JxOryHU#KKvqbZfDf)sx-FkEDc-$bh_MdW}E;-L}(f6c}fHeT=yQshTy{`KrI#~>_uAx{O(T&vbn zW{ZVWlGn{GhKDd`wm(oGz?#foK?qBjS2yYfT0jhNNd_uryz zfei;gj{S;`8?FCk4x6kqgt6<;E7oHTU(PLR$#^^MnvWA@{*r!!FSb z$za&Nxoh9w=(R=BR|sz1Cg3@R8+37|;p+%ca$)-!U-= zCM|>hX^y5OWM(WuT6=1a76s*`eqJ4T`d1PY(?D=DGBDhWUY+yf^nT#5ZZoa=okYqB ziA$m%u%5WAMI;uBY=j{2?PEdl@mYcEhVhuOv#Vov6B7cx_JcHxbVBm%(ijIL_g)hu zy&pm=Anqjsu0fp;cxN3L6?Dz)s-9;@@GA9_^;wIzhbZG0vp{f=T7YmFy1f}|r4D|G z(fjY{uR`B5|FzaMW!wUeN=ql0t8k+9^0BKcM1C@T8Fs;IlLL7!1g+`Nr zs!9)mVF9;G>GHFLU`8V*KtrW4dd+2O?n6x^C#3+9Y5V%V6l2)a9cJGNGgt8EYBPy# zh{~nUye1{qos=VT8bPv5ic|rH%KbUcWv|a+gkVW%ZxEhq>MCGm`T3#_58tBsG_3k} zVQw2tARCDI*&`1HgL^&lD_#CdW< zfG;yf+bj4CKE56BbUMZi{%Hng>4dB{O}_BLYCjT9IP5Ig4r0-5ti(&|=-%m4PSMA? zqU%abccPtv73c6loFslbi~+1|$5l{#(RCh8P(U9tiyfKfePVNS2)W*2l*du%EJ0}F zX5>Iv4?q1`hq;c!1gVnfEG+UcY+MS&&tB}C$Urd5^pIdB=Wn2F38sShVZf^~dj*Xt zBSzJB`qp~55u`?ke^#_#`8blcr$`bQ#4gEf{*dPvtmO`oir=i8od}{D2|(!%wH@SE z{UrxHWn#i`D>b)MfQXnJ#C${%W$3Nbyq$l$v>P{(&{kkHhk z4X(kMa#CA_pLKuX7J`qdIW-r z!<L&$~_Q@`-DF?SU> zZ&@I#$_3U>MMi@U2&ElIv>NVn+4^3;2}d6MYP0~e9Vbt*_TW8g-v;6yCvAZGZFWh6A|Lz75I>yod1@281pQ>foHjL_8TLK zuSJrom3>vT3?@@Qa3Py_u7c0ft)QsRiov7DfX*X?7A1Tg&IqB zBKGd?S6GAXY3>Tid17IE)Xhiw6o$p3luGXBKAGaiTt!M_1!!4b`%Fwz^<#gU>ao5T zd8EG~gjQOxe!%b$sAf*DDQ|(c8O~^-vU9+pxORy>N@{mfglhXE7Wv33?TT4$tytnQ446Mp)w8<8 zH8E_Fxm$kA}&nNjVd#y_LCuSdmL1D~7VDEm7|2m<6AidSmxmmXv={j!xGv zCmT9Ru8xm$szT9eEq6n^JSgc5n!k2gVw>?HPfd$~?G@3}k#!;NqGTCTdB=S3>h^9k z!hj5(q9j#T?G3QK&1@VgoL3}@ULF~&%4l&DH)|Wg{DEj$OnS`mT+stm6JTBlshu)V zUvsZn4AQ#Iq>>dsI-5M(HX95(bivGblcBMa>*_qv=AAh%|KWIFJM-4ey`9jAb;xsK zg)`;(ipm9BU?noBBKE9F$vXNuMj{GUtXgLHS8o!9QLkF|T|SU8TSeCEC8>SZO`(=& zz(+Km2g4+dwIU)kJ#c#HBrWX#lGM7%9Qf|9lpgHJ2p^k0ZQYlI^@326avikqw+3jK7^x3HZdi@mHCPQ!`Y z3NfQS0@}GFYWwT_H0_|G#MQk+GwV~cDnSf;8Br(lEyrOGj&?k?*{+pZL_o|Y?YZLx z$!-g2L~J@id;3(H>5N)Ox?UTL`38*12`0a|o!YLh5{0g?ljb{;WZI>!>6#h(VmhJ zvbx{Y5|A0wxlcB-_E)L-uQxQRbd(O)38(&VxUn0FB5RGQT+W)T+kNhdNydvuB>0)I zG>2+Pi|duoQI&~xF9ej+74(vEcP=IJ7594jLH$o|PP4#Ms9!4MLJ}v`zID^y!gN4_ zY;VuO2EEbV+Rd+x5ObZ9u!I{AG#h0GMokFRC4~_8)`S@4gq`n3?hoTkbA*{m%iYqE zt@-wp8pOYuL$*8UM9OHHE^_3-#AmJIb2s&RH2(LsJ4i~7GZf?T&+FKE@8)?l)r7%P z6eh4JO!8`d{No4ZlOzd4qqt=sPUYd0`}c_2-`z;T?Bnq4sYOjK;xIG;1IQlf$!>gP zKk1j8e^vu#@K*87?>BwscYEq|2AY`o7T+msyFwQzyj(TQ((r_drE?-6{bbPrXwFw7 zv21g`HH&bnb>z#6gMX(6nz+5CTBrWD&(V z5B$KWED`slqQV#_NhXaOpu^{}bbF0b?3PvW4R(Qxo#FIjdLhDf^4xTA3yDHf6_nmZXu3$x`aWt)L{8_P{XHpm<&gdp0zw;# z>S1MgvB?{c0L(J)aF6AwJa z$;gB{bWR98F!2fsiT#>4zqP-SR|LEPDG2Wl5KGoIG>4xEdzMpB>8CkwxRftuNeGZs zTNKoQzza$i}_lr$0bg)w&2Kf4WW^v$1m zL)`g2OgA3CgMyG*d#Rm{mbw&0K5D>T_a8Gei9?XPwen{N8<+21qK?!n?3dNw^AtrZ z<0U8Ue3!r%o-wQFLVWf7v!LhUyw0xBSAxgHx-T}LMbqR4DCl+g`c-Gwfr_iH!kB#A z0K1mAHyD{!@uV+ZRL6|VW4#;kl^jy{zkjfm4JiidZT63+xN<(rD{mw z85RFxABJ=yYljH>ajOXNWcFeA+LT;B*oQ?Nxo9`|&#?(v%%}zZ`lGR9w?Rj1gwt_r z*h*F-8wDu;i$4BVir#cge^_>qV-SQA#fMoTafc>1Jd`pG%Y=l5iqnFY2XSti0 z6x20qh$yq(sMK@KM+?%MA~cE4|HiJfC%)v{?Vsdsf=$whh5ezTbXN z5Y?ff9r50Z$F7XAGf^+Zj(_0mUY;_6DFZ79A&6BM5&3IBf6g@AT>T9rX)90#4?{D1 ztJZvb<#LEbW8Ms-vf4|@sPG+We`1{*JfrB#sj%!HuIN)V5I&uzgJVaqJu5r6eG}A| z(}n5n`gmZP{~@rHp@{IBEE_@+QV-#m{yxR78js+;!gV!-aC&_CH=7J`y#2Q?m0|a6 zfd4yr0tVE11=@~Q^w3wxdACK3HlRI?^aL!_rv9IVnKJ7?5MNQdeRI6i%5U}FWh_e9 z!)It7$Y0e;0ELm8ZmaC!ob7iPf;3Xi(LI&T;@(xz(h>Sf43?v7XsAO%4(${Rejsk5 zGF8_L_iP31l?r*EO{gdf@0X!n0cO-RFzM@d=XihwadZil55Ak4nCUQ(jo z5P7%BE%R8U=7y!DQo@mee|}`73oJ~C^@(oy6T?^QaZUs2367f0dL4IucFF;Ectf9w zBqOJB(6i)sGt7Vj7sAnZWH!=~*%x=YoVXq*PnX|_XBGZnfD*-4&TZz(xVFP#Y{)2( zkDlz3KY)+(rA795SX_hyLD>AuTzdLR#4u&G_#^)OvI^{$(v~0*OdxS zaP}(qoP)^Ml{YZ=FSxp8Dk^gHMQ+q8=zv`vAqT!y#NCJ*3SqW|HJK16_vG~;Vd0h2 zNf*?C4(N3fru#8qc+gDb!MFYC=_q{lXwT2hKF*tc*~RX!74g{(6eqkrhn*iWQM@&!l#8ys-!*XR23I z-bp~Yse5zV11Z=C!K_tqXGqTQi(YDBP1gN>ybLp%wo#uAmSY~oB;4p!if!ExeJkPi zWCt0%jqTWYM!qi_Bh_@a#i)UvB-r3?kE{y+B*ou|w|3t*okVTM(Y-d0?B$fwOz|vp zk0j)E3)JQej6;aap?)yDB%UEWk0qU<5xsOMka{)+IefOGJxZNOf}Ph56&I4tkRq8* zPuD*tnOyr!nhhnfUvy)Wg{m6mi|;YM>H9h(=3Ta!Vh(REq~$Q)P#FrfP4S4HSo-x% ziTtg%(vn|?W8uAvT$6L2UuNMdOm$Fr+wqyeFyVIc_WR5De)H*O50UB}#Fh%K)v}Rh zN4i2N#QYq3Pug@xakN*;rnM%MDfUow#FW=I7c3?FB5}2?3I3elmZZinAKCqa?WC}> ze9?n#?{7JqM{K^ak*i6p*Rx_vFqsb6zpZ~k2~7t7UOm485} zK~(%Ked_$PX=Ptv={#|{qvGq@`!cTa8Y>B%=<2SchU^!rogH)v?yqS#@}$i2AS{M_ zp)o~&#tG!pe8>rYBy}kzn7h#9c?8lbMao8U76IQXS(XW~YjKAWC#prd?CdiGj2h62 z`=8FQ3H5tvK?^QLX)t3DPRj*!=qLlDt}35dmvYwe&44!lDDsFqI!4!;Uh9XTIt-Z11;z!sIbk2SXXL5K+OBeZ+=MbzQ3twBudbY9$HKOy*osjHq{Mf_xi1E@6}7 zEt;}O{CDtD3nMv*54F0KC95=yWg+B%BCn;es8RM&RC{se+mL&dm_o%4#Cwo%bUGwA zQiw6@+X_VsLuPewy|$m5oVY;*wVI1s>qP?op1zH+%XRy3>v7RxjLNnHbh*RgR?aBl z@cadNPv3bx$6Y`69lpr}p4TWj$UoAp)hGYpIAS|RKJP5HGf>C>mvdS7-3B^#Z8 zf-Q3rjy5{kb-!W9+WD1!E0*p<; z)R$jgVeu)HJ9_86;oIPQaX_lJc@==IJC>T3@KAx4Jiti z{8%LyAR@ERM{&oN=PP*fbu2XfVaE;s;qDz9x=Db%inEF~1o{?S=%-YCp2-xKCnP#> z5Hips2FNr54Lr!`Tl-t{7G_JVcj|v%aImYZj%~B2fiymG-xS4KDd#r$W8!0s{p2OU z4U~=ioX00XVvgzo2_8n=L~!saZkr)A#NQ_n2`%;n|H}mtcL6RKmWmApR*rL;_aloR z62Nep_o)i<7;tIl`~s~a1Q}S36!IrR7A*|LVmZj*Mvhzbcs$SW=t{~-Zk?%zd~EAH z1>!3`?6(q9JlWO(WjGHsPTWtl?+K%I6CIh4S95l@{zbXWYG>-JPVIbQ=f_}AqO3GD zby{&6Y;yAg6!7B1CmeSfEPwG6XBpmyi~RJfz0uM2j!KRzs2Lh_wkYQDNC2q`@rs}o zqzkcyZVyQjCvw_tT-W6K7xjm)lA2M|yZa8H=4;x3^V@yR3R1bhpHFa4kFZ_*3UBbw zAvCJzJZ>|JQ}4KZc%v_K9cyxW<7FdBmF)ORPv|xBdJ{?C+Zmc0C7#RHOYPr?|1EH8b-K0(X5zEmb^dc~sjY(s+f0;wGS*dEBQhZlYLyUpsQDNU|T%>T|o`8J){q8y&^7^7(EreQJZQHL* z&S}h_p4?X5{A~;+e*geRi8b>TV(0)cnk>e+N0ID+;JrZDk--SxTgaveX<6I4c^E0z ztPq&xR}2^Go?xl^^2^ADM0D?+ab~|k2Q674hRPg$iyk`V`g`0P^$sI(&qy>>W~I27 ztyA-z$v#{wt0XV&rb?V|AwXqY3(J>}Bb5a160=mp;*M@_c?}tV-4}+z#u)IbcY0PT zGKGGO^3Np`j*x$d*zSfR-|+G>i`o&FY>}f0&qOFPKV1vuP-d)Av?BjTFL&If-XTQLeS0Cbne8|r$RkOaU#jpp19v9Pd=QK$}Z%euAh3Yt?0fleaGI3 zI4#$29ZJ5}4~zBtw-Y`XZFb603X*jCV7*dMnAs`^swWN zVb5+=b|raAa}DLX&UT4+`&g1I{Y1>6+}H{=d$&Z)GZj9k!N=YHGS8q0OPdXe@b;bB>>5PJooLF7ylIM6 zk|+0gnNcDkVsSh&RqS;n1!G%h@CI)5>unjSq4kHyA$#?xYFf_P$~|#K#{_ zH@NKyX={o>#n2Ya@rEUUcH8FORm?%#e8+rUM<3_CQJoxB66ewvygm|f{TwSOpo${Q z=pvgmgb+;H4enS3k3epT^gi!QrcTh%$QM^jN{ysi%=?>%5B%<2)d6Fs%^2acMZr~Z z2qKeC%wc4x90Gse&?u&)|0-O!h!rX7K_Vh7Ar5Q(59G5W=mUEqd%I3b3Cd+owKlo- z(ucZrJp*`%MlR@pNyxbFb#D3pS+1(%Sy z2tQ$!lMv$Rv>G=|Q4aVel;eHij=8y5qA(^oBX$oCfhX4Z$V1or5A!3=ruhf!Q9?7> z%Okse-&(MH)P9aN_MxU=s-Iir>mSauUkJ$lI;kUex2O$g2GS}78n zreVVTJ-4XL4ERBSl?RL+(;Ng)r{|_}?s~XUWkx@@G>yXYYVBaC_)y>|3ib2rQN&ls zXBt~MveV40+z6vvQ1Mg{0IhgXt~X0qD?&@_^i^_5U^=;ZHRzj;jEq)!Q~=)M-bm5S ztw~VhW<{RrM1&J31aJ$X&=LbjKnbnf94L6eMT6rLj=AX};=py{WnxK^xDbkx%>TCtuopYB>Hii10t689KO;bzuO1RbTkr*+1MGmi6Apro*TgGc-qaG3 zxl~a6Zlq`8g1p~u*7lohuZ$nmKL~r^B%zW`FZOr6M3hUOG*-e05V|G7Br0M7jKy4t zCXS!y*2@fgzlgS(qdRgIA;3Gf`MLYn*QxV-{)ZhpaMBiJU)c6)K9_OP(ZAqd!Uvc< z(Cu&rvyV~v;je*H=!92UT1BdGmL>h(szg3n#@3GR{Rqy0`Ha!#mM6F#FFS`k=<`j* zSO{nu+Cez6c{yr8kLwX=*EkH|bLH|9DvA#<1+CI&`A zgf4ypHyJJjAmYiyc+6~<6)ZuvrOg$ky_Dteht0c`{$YZg{gBxIy{5KU#MdHB1ghpe zwGuL>hI}_OM$HtRa|EOe)@rH&J>hb(?3l z-f?$~bYGHJB*SRO{NCP0EffZ(nTVwi`VaBP#ZNbi0ta_-HrF+up)j@UV;+GHX z#jW+%c6pS}cU|v0qZIkjpx}FSSlYd8;^OSUWj}$&Hc1Pi}@qHw8*B*n<^w( zf9oBxXS(h)%`x7ar-m+iJZ}n~ub=M59UXakl|YKC*!HwC37a2PqCLT?IRe8)Gs=35 zNzWKA_(9Tt%LvMWa$C^TM?MS`1q*P;7C3xandNGn#eJbmz>0hmR9t(g?jw{;$T18EhM`i*y$fQ z_IrjAEzFC$+jIjp>oKH;)+##*_))dK@#q*OSy)I8oS_L?LTB0>`PI`Z-Jb6pg2$He zyxAAJoh}gO-4mB+o&Ed}AOfYkG(Ys?o*T74Xm4MGc-qlhRsv4n;#_$mm8wQtgTF&l z9y}NnO}oHt?eJ&REbqB1>uFm#NLV+K|fNnXTgUU6`*~w*&V^VkN~h3ref+}vf<9x z?gybiZ|@mfi}6uU)4x2=1BBYksVMiU_hbEDI&_Z59j|kjj5N{~p$_cU!^nNVsyxrX=AOm)@hi=i zDnG5|{XSxuH-rANUxrV21@Cs!Nw|-LpS_uQ?*L~(*lq3PigDzJuc}6v@d0@+ho(9E z?Z06Zewui|4zBhP%bxWIMplj!QMH~d*T<8xC+Aes`JtC`kTG`7s923>p($t9_hJa35ffW-ksGrvHK7+ zXk02de=k|72TQ=5Mpm$N&a4B)xqIBS!gn$0@F8P)==^(J@ya^z+@HnRHi^y{wE15f zW#Xbn-k_vwRo%s^PqPrTwy&}WbkGZp8YrvyJF+7}Oxq+s9u0axR81(sqqkl+;(?Dk zU6Zioy~Cm7J!L6W??Sc?I&F6_uv~`m09+$bI$K=G{TSeNoCz>>iiDaMD3Je^%n(3^ zkpGp;5I}|$|6zu;jz*qH6}%aM;z3v;!hAbrLCjbL%n<7nDFmn?9;BBk*2u0`@<`0d z-_u6_&%#EKf73?k)1izzAFN+!C~ z#TwaY#lz6^I^)!=_@Km)u{jzZ!NaKmdxxu(I7jgLC!}c7F%0twJnjG+C;k*OViO_f z3j|L7`l0y{H9r?BC07*F(|&q>L9d>vIxT~^r5|yU?V)SB5R`Q?E}WiirgL*=aO$(1 zZ7VAs6F+f5td$|ED8T2>JvGfwBhv%8ZokVfd)ps?JsP~)#b-&(D0Hs27kE5E9^@K> z1DhrF&ZZ0fKZ=e2YpsDkdN#_PORMw$jn;T#=l>-#<_MVquf@J>Iz}O%w8&NtWc^++ zKjU9<(Spi0qXLz&YXv2H{B0tM`HV4DwchZD%3W~mmt!k8j_)$R*<|f|+>_6O70xvB zw{hicM%|Y4OA)hY&@hXW1H{$_rKL-0?f|v!G~gY+9Np|emNv6RXQUG6Awua5!K_(0 z3^B~nU!YP7e0~4Rjyt!kcLXaGR8vB@P!?0IZmp{GTRWnRWU$u%$Nn{M6wKg7sIVH) zV@<$lVucyQGl(^j~e#P83 zJ|f=!p6q0dNzTJq&+PUQ%jOA4-stBgg8O^U2WL*gy6OQnXl!b!Dt_kY#fl9P7>63Uyst{ptim-H^~ zI3W$ir-qr?J9oZ2$1PrZm5p3mk}Tba7u0thOwmD%%8zIM&}be<2%ldX-|A2TN~ytv z>#1EiNPnu5i5~t}YB>Y}1o=(*o&Dg*Lvc}P^0l)aa{b_qJHNrO39u5nujEM`6Sg*d z6zz2|#AbKPZdWO&PT3WO3H{^ADihGS3)B<_2=_+aOM)5|Gs=7Yo7vcYuu^{V4vimS7zG<1%3M9s1_#pv0XuqDZ$(?>m~dtt+5mA(<8i&BDHtDHAt ztqCPnhnrr*0mk2ij@hGM-4=^x53!EC2X`TyuT0|pWgqx+ z+OqUO={ehVaXe4g>{SSgytw|Fhw0TwsW>07gkSa0yVL{uH$Bp;VD`)7N}fr>=Xzed zI)U1T7_387>(LxUgREHB&Re?=Gh8;c7}x+$3?#W!{CM9^;kmmOmITgMYDf|GZDEzA zReLjGBD{ zwpXShrDAd0Z?{+Ia_-Ghg-L} zKGM8KVG8pEMwiuGYk}pSaTFF3IWg>H)eq_BY0#Isuo`dH&CyO>vgk?>j>BsH;bJe2 ztvpOv`3?VQfxn}=d2Z}N>I0C*NW1`GGNH4 zctX$I2l_okbbq^}VH=5dEbQaqF&n_bV0_JRJa`Ur3yP4%Gq_}&p%gbGL`)LNfq@kXhS;i z=JY?o?Gw)$m2gNY_cn0HZ`AN+ZJJ8b#fpp!vrFx=s>g!Ms}vC{m1=edub;P3u09Mq zQaj%qRcN?46P8UCWW64qh3ne0sY`RJzdKPQkxkXM`RKPN_Vee^=XLyFwX%|+EJ0L^ z%k)24M%)#kx6j)pilL5SH)ZKRZ%82eKJpS)F}gZSg}!;qrv-l1UL^@^V#y9mkq)=h z?z%SH6FAr@+5n!Q+FP4-IztFQy=x^j9yf_owe;;^ia>denVQhqh|ik;(j{;({j(LO zndbbrd_=9~k0&>&j?89XjuV~y|4B@hGitThzk5nliLu3=@QY)+HdvWMtWfmcvBh&t zmfBNKs1bm#7o-W63R-};RSpohav~ClYphP-%^W0L8s&h-nsYi#rq_mE^k3TWlx(w( zkML6!FLUoV^JeX@JvyB!Z=d>g5OSV)iDwL52BZi^pDuV^%O>3L~cK<9k z)!KZ-9`Ma3y4g~8hZCrKm|E1FUhZaw-`}fvsssyhw7oyYSs7U^`#?%`R_};CMhz2C zsA6PktX4AZ7#6P@Iy?3eUBC9Z@>O$_{AJL3L|+iR5#7QBe82a}##h{CkuIOzdSL5X z-s&{iRk;4as%>u27N25BU6XC(9PQXYjNUfCZ(|~M0!)rK)Kt8@y3ZD-1iwrTvxJiD zi@WKO{FAlL`J7eU7GIILQhjK=zgTZh{0J=iLD2IatJL3}3FR-yA;~~C_OpbzbK7-p zGn`ww#0Fv^;}>@nM>+8dsE5r_8GkQU3j796;%ZN({6CW`9 zh_iR5=~VUKRptDbv-5Mi7A40d&zwLdK>$q%g2O87=W`g9A5W46PY%)H8I6_hO| z=5Ah~jx_w<*+docEXQ(cAHx9d7z(d__=A_nN3Y^!tLAVZ6bO6Ar!ckP zYkebC@KJY(>B^whF$AThvv^picH(A(e{5X39EFip;= zT_bgk;J*9NVKn<^w#zOp9=?tXLvOnSoqm1e<+-AAP%ltks?7WZ4DgDxDIp)aa8AQ( zr+fNSs8_Q22|60;Y866X0-Jgo$L0c~?i)@1`j1b@gJ?b~elQrtdN^y~PvTyaofu;~Fiu8mQBN8eF+86{=wt!k(-}xYwP)@7 zU^ni-qr~kMVP^%+woGIzh6d4Y?n7Ka8omwM85d^?u&JOspAM0xjx@ZMk9@(@E^XJi z6JN~FhBE>03-V-sy`i1kltUjaxa5q>7jIKFJfPRx`WNmIDwk|VE(+Lrua!4l( zpSm*q3DU3JvVC&Bs`{bbm`&Abs_Ip;4l$0fzc_E=-w;O$;b0A5N5ZuhKin*TyQ9qPF|SDEurlh<_C`Rqgj; z6H^VO2P5CA03jd&8wU2;FX-;#myOGdfyL7U`k4dipHU!Z=_IEnKq74sc;K>jYg&zG z)ThOaIEgCXcCj)82H+yu%e|Z3hE6Doucz0y)~Cpl6(y z;d`+AK_P~+i3F#5Tt=NW4e)OS)}4p5xHZbOTSF>g2N8Us4{wBdYCFKmCU)RsV@7WM zUzFLOF77O9 zCEwd|(GTLtz#c=K0(!Af&mx?l>u$2eX>+mK%lvdNbFhhUzyK1!Z@4V5-gOf7759^U zHZwdamx<|D-Vfa+VX;GhT7~>RIf^wS?8;jZi~Fjrbhn|#{YmQhU1h}lTMc4#XX-HQ zuxR5QQpkm4!6b%~{@_LCfJ3#Ox%+&Y;A!j8^?!O^I29IA0iV~@$FEqBTE-;=wr|2#gAVpY4j*vwga2K>B}Q