From f2f46b227bacac004d4f8e4fff189dd236ea17d9 Mon Sep 17 00:00:00 2001 From: Lee Fine <50836957+leefine02@users.noreply.github.com> Date: Fri, 22 Apr 2022 10:27:19 -0400 Subject: [PATCH] Linux permissions winrm credentials (#37) --- CHANGELOG.md | 6 ++++++ Images/Image12.png | Bin 13939 -> 27634 bytes Images/custom-field-5.png | Bin 0 -> 15265 bytes Images/setup-3.png | Bin 18900 -> 24837 bytes PEMStoreSSH/ApplicationSettings.cs | 4 ++++ PEMStoreSSH/Management.cs | 16 ++++++++------ PEMStoreSSH/PEMStore.cs | 8 +++---- .../RemoteHandlers/BaseRemoteHandler.cs | 2 +- PEMStoreSSH/RemoteHandlers/IRemoteHandler.cs | 2 +- PEMStoreSSH/RemoteHandlers/SSHHandler.cs | 17 ++++++++++++--- PEMStoreSSH/RemoteHandlers/WinRMHandler.cs | 11 ++++++++-- PEMStoreSSH/config.json | 3 ++- README.md | 20 ++++++++++++------ README.md.tpl | 20 ++++++++++++------ 14 files changed, 79 insertions(+), 30 deletions(-) create mode 100644 Images/custom-field-5.png diff --git a/CHANGELOG.md b/CHANGELOG.md index d79d9be..dfe5274 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,9 @@ +v2.3 +- Add new config.json setting DefaultLinuxPermissionsOnStoreCreation, and certificate store type custom parameter linuxFilePermissionsOnStoreCreation +- Add ability to use client machine credentials for WinRM Windows servers rather than always using the Keyfactor service account + + + v2.2 - Limit the valid characters that can be used for store paths to protect against command injection. diff --git a/Images/Image12.png b/Images/Image12.png index a08598861a6dcbee465a49980338e8c048632ea0..d44f6a9b7a8080c5b2d6312380e1478e7d30b934 100644 GIT binary patch literal 27634 zcmdqJby!qw-vw#`($WnQ0t$jkw}gPwAX3sXbO;PFgwh=%AT1yzHFSeROCvEf(jY^} zkTYkakMH}u@ArP+`OZ1l`Qw~@UCK4GXJ+qv-}m~h-&*T7R8?6HABP&}+O=!=&*f#* zuU)%-eC^r|uiKcwzu>X^X8=F0JFCk{T`L)&-2h(P0!b=KUb|KnjeB8?0lda`l-F^- zc8#Fz>d*BqhkUbZ*KC5H%SgU-H`tn;52taP<32&%T-|`kvEuw zbfczUM8xyhW7wX`jc$h;O)*V)?5t^MzJFm|(D2z_L_Y^ICn5bh=|nQKAH#(3AqsfQ}Z1a#%SLym4zO+5XX zO08+Xevxv5A(1XJg=?F47;$6&s_@avmf;)!6z3qBQ2&dVU?6ht7>$gs(u z#&FeXzdKm)%?Y=_m8FRk&!U{h)5ppgO<{V?v%n2fTg%iEa-;;-@83b#fY1N zySvXD_aK)dfg@V!W075h`59>4YBhWNpVL&;HnpzD(ih*VBraEOM|qV8(E?w* zPeHh_eQ$J(6~@IFcZqxKCbg2GF8F4d$17bdn7ce<;ZoXn8*{)$u2k5#g3hcdgSH~^ z97e1=pgq$PVCoBnyDi(!5|nQXVxQY$2$Z~px}$g+?d{+hPFa;E{qfS(PfA59kCxe9edfgf>SH_##HfqZbY~ZytQ( z=l0oWoD=jMwqo3)Mo46&Vwm`J;$X`K6dpGGuv}@@!k7D8BBBZ5JG_D3;J!IMw-@eO z)F8lnvqM;Uz@?wVaH;)=kBsu-!TZgiE?32Q2?(|!tv6w5kBb9n#|5o4eN-rTX@Opf zf=A=ct#3HRc~{fN<0;k@M?U}-+qwsDhn`aFxbshD!Lt>?K?mQ?NQ5E6@%z3BPH6+z zv9GWffh)(%OqGU~hXssl`sf>EGtaH3g|=rYVYFzIMr__^Pdc>}Z5n5UtVg$1Ii$5s zqhUz~DT@_tB7JtW2;%ZJi4GWJ#`H6kl1TKE`mV~B2^bezHfL~Gw#K(3WABWksf+s@ zb@G^Ne9O_TW*c$71aUtngX0G();y}@3l0fM*IN^6Qk{lju_`Qas$urmVT=GqSVBk{BahxJsLG#F3zEP>>bgeT-29pyTKst6bskc+Wg?@|h`eNY zcI@5V-_g>z�VU{An2e=E;R%mA*I83>{6?s&_fb;+w`Is4LcaxG!wuK){?%Vp?gh zyq~RT9KVjJ`{$lhceA0WHT;L6*c;8LkwNW?uLKwVQ}EWLzT|EH7VWgl`U7GjwZRZo z__dbPCH|J}aZYb*zHi&-P2=iKnCCd;QBxEraB*GV$2)VJ@>{iBuwndTe|5d>!VY^k zXz7ndq6W;%NQl>J;xCpWHmlbhk@Ygd7}Quq{^;=jSL!9^;$g zIt@X8@s22d6_Mez#GF@vidS(eDRuC_Tz?x9f+@Dfoj;tMr{6}G-C4r8AgVQo?n0&_ zXZ2S;k-YR3ykFJfTbo{%LF0bh*bm#DD(R=^sN76+%-Wf()kiJ!Mmtauf!Dc{Hqscj#uyy;vg6#F4(ii2=1wfFF7Yvmh;-8DqrZwa z&)YSl5+jAZHfoyV?WbUz#%^=iodV^`*P@oK!+clyz(}xAT4&I@DTir$64=?kJ`qe^rY#wM`Y-|_htP21L-djd1sdDvx;$TJnk z$LpZ!xNW%>WZ7K^0ZOQ11OYfxtTI}VuN@w3Ami=&gGrn^!1t& z?uA7*wuaKEBfm?Z8Ze4GSiEB+o6Wq1<%ie~`VoirMK^(U11-$vP2;@8gLB`LkF!Z? zy%OJibRL}EwpZT=O|PuLZZlM6pVl_q ztZa0dLxZ6HqP$gqFqskcx;%NPX$#FRu{56ehU7=(ha!#=J5A~6I4<9+sDoKmFvVKK z>ei$HHrTkTr`Cbr(;N*Od8H71~1sDJ)4lMFk?ldi^o46^Cn zX!3Ar{2@{+7Znl2XFmalp(4)6&Vx0IwuD=F4~g0q6SubvHcD#H6ibJNHry}pU*(>c zKY`K`p0^Oqa>K#aRIZJ1hCBixgS5f==^v=q_(Hjx6D|Dk%bG;p^VTCqLpaB@SD_gL zAw>A{Na8q*jma~;^EQ}?iD_!%f99Q}ckzJJvaT8b@2TqlYxu6uf%aNqW}U+ts5iX$mC|X) z32eS5P!f+%JLd)lC!JJGIO5)9Q9E_#BvnJ7?pIHH&nxJ)8w#ldit`$TZF{YSBn zlak!-Y6z7qwA0fGuuLSXEPUX?cn_SAN5bDvzM=$I596R6?gSsV1te#|!g( zR3S%QTi@0Gn!d|S!%p)i-jONv93B9hdn!)vr$b4Rgw?RR)(g(Jr$k^mK9xEx9tb9G zZy@NdHHP_Y-8$}e|F(1exc@8ah~d#hUTV-;#EfY3;dce^g%aOQ!Ar$Fs&*q}={LV7 zO{o_*1O&47XTOlE7EMd)_YN?9DA4t7ut8MW;_cZgE$UYG$}4QO4B2MCCusYCp|?bX z@lhG7$4HkrR1JEnlbaHMT5Ob|l+7tXSpL!slszX{9)UMdbf`!x{c%tqu%(?9|&QeoZgb!C?^|j zGAd=}=G!ky`<@WymB4Ax;WgpiruwWC`}n69We_Bg4ExZX9v>gf%&ky4b`Ufp|I&;m zOg>11-R^KG!xGQH-+MK%X@KW=mbjS>`U$ScA&-?_#^8p5dP5&N zA!eI*g{l@XQK!^3yi6?Zv?XwvbGCNWZMZ<6JDa&C_@E%;+gT%9(A`DI4CO>!jEbKkl4@Tf__4R^S@IaF0+NNv^1jv3V{l^oRHa2N%Qcha8ZPw~;_bvKv;;zXW zYezN(et+$Y-#9ydACY^qeF6jiI&f~dKWE*;fCttAKc5j1MoT{eE z3(qrcIz;h+Gm%VX-0LTdRXeBw=X!c(a%oZhw?~w|`cNAVFXGHeypNleY1QGk_-yK1Z?Ee+jgFMBN}_Lr?W_$2oo+)6hb%6eCOC|JTCFz|Rmhcp#59}KxV1#g zhfA}On_0t**eLK1{~9j^7)p_MbG`Ye_=5ABEhxxEc$LVG#9-Yr8NkR=ItoOw^|6A#)cTgQhZ2KV; z!pW?n^OsjZ{tm@eg%al*uKcl6c1{6+aJE8XsfnFkKLE`ozTF-^Is*s@1}btgr#L*M>W%~Gj@l~`5!L=VamKg9X+n1 zo|UJGkUOViJw41XOCAEHLJkiM^xGc$x5C5cO#&B`uYb-&X$iGthLtl>tn$0Fda&ieW z?;Isa%ce)s8V|-z|1?XQU2nsE=JXm^`+t?1+BKkrn=Y`{U&p>zk03Bn|DzmrRpYbl zzH*=4m00wkQ3PIKZw%HN7@iRTrM9d&*;!lV6?sD1>%+#eQW=By2ik)m9891>e>|j^ zJEVXnY)ULHv}Hi6k0(w8x_uAjBIvt48XGUNk1Ed8(b!mvh-rx5(r~sW zHqxQk@DU68Y8c*SDofTdEtE(oDE@kI@)?rW&iB-YW}Ef9=ui=b4#3+*zel|}Q%qxD zrx$g%yp$C={Z&c-->tX_;G1JFyvsd8)BiCWL;aid`|pzT$CkP-*1q$*zhIF1<2)z@ z<6|aoj~&Q8jrB#r?W_aMh}3{}s-?iFiwE&9j9p#FsD2JR?KGd4@Qg+SQ&ou)fxo=O z_%V=(ajt|BG{twS%^UWT4Y6Wz7pO?FkBr)xZqw+zoYq{9U~kO~QIv>&Q7GWRODkDE z;bMUg>xQSLT)T;_k&t=t?7bsv?AU4y@B25zY(}5M%Hy+mno69TTWM}4Q*yg3%TfR2 z;o))L$VohF)klvzoh2#rgj`(#Iii?Yoj5`0+vL$y{^zz3kPSGbx>r6J#OM!(4!-E0 z!C9=o<#~G}OmU^8tmX?l>E>}`6{m$X)ytJZl#zh>tnf3MmAX5N9-)r2x$<9V_K&=1 z7b5y51;mDz-7}dbzF(WK0I3+(Hc0DBIAi%>4Z5MHq@Z20w;*H(3#g$|d3L>pLYV#X zz3-YN7#e>1BQtae%S?j-Qy+1*>k`ocJk1glkpAPey{$LYnPz3k)MmA(Ov%sej6AcR z?@7t|@KJ69YU3inoAj*1RPgM=;6^)ymrj07nS5I>)x_gNxB<}LemIeWL6YhI!v6NE zeojd8Em8lp>YKo@fVLgyIY-H^E=qT;PIZRt$CL-xjSB6W`mUNnL6s+hFKor^?*(z|ak4lZ@yVd8u+BND1YkB;6-bMMGHKXMF%MX+)sSuS) z01do5^z_dassk|aXa4=Sj1eHV^y`CKKL@pmm2gqEg}zryrrzcB!T9+26_lL?r>-Tg zc>QLjm6eBd^r9EvuCVW4DQvcg8+C2dMK+HN>1*Ex{jS+gF;K`w(BB|VpX{;~ z6^ntz8TSb<_p-3wpt!ivmY1|;>2OlKE3kKw@^(Gi8K7iBLk=x9TQBuC6LG&?-K42e zzJ_YCeC_5SQ5^agnt@`cY@d_9tZ{%l1xw8Tg#4|o_yRl=-Iji3R3}ixG{VEC`Ci<4L7)ufl(z1Px%mQx!sGJ}nizv_(D|xrc(mivE8R?ALv{VC zf}+WoqJx*wKoun7cIU-+Pd{h4>Ou^5Eva`!krKa}kRQXmKRmX5e>EYnY^$#aGgp^Q zzvm}6@^-E6*Cj7vMCV@rUw*-Sf?t!)H%78(MhnUi*{ny-nw4f=d?bFcrPCxz`Lp?1 z>hPR8KD9^Ex1Uwy3z>2riAD_F+O#D%3i{4olV+TSzx&r0E72mhtTD@=pZUt|QeUWF0U2d-=h=QN|lJA*G%)v^-OsyglTpbo|j_iNq%x(!ymW6b@% zJAJLY%bS=GLq~qq7i=-|IWfG%-LJNI$E>oQsJN?8+AMg?dhsbiv=Nq+neup@UL9oH zU})Eplh(RcEOwXqYqkkjF{gHuk`mdl}Kxx=deI*SZ}8TP+RzN=o;D z)D_z$shNqy?xm^9+CljY>5GRtFYiS8kj3InZkFZsW?48~qaI5p zLF6KWqinN9*#z)C>U5}X9~(~#So^YnJVX{8xqS)si)!iG_Pt{AlrRH11M5Z|5zU8W zNvt}yN4c6MPiG%Z^x~7oO_``l-#4$JUEde(wR(ly-9N}|IAE%5|J23B)xdh%p9Z0u zK@FCE;&m>&Lx=$fmP%Q5^(r0_#-POVMKkA`(CKtS@*+uk%3@)6fQ51H+GFl_)A#G% zIJX)(D42_e4k0)#(x^Q^LTSk!nl=Zn#gj-sv1&V*xTi0BZ9+nGn}4u`5HOVwe!!$T zXHVv+m|A{gvZf7uz&REmp|f{wGkM{LruH>kylK1>#j882w-;U(l(P9$upjiht`^E) zn+60mlx?1XH%+AO&8<*>??aTT<80l?*R2(XGywfhr?-T+`L_X1rbU9)P;TfJ&P2^~ zC$cl9Z)&hQ7=vYsZ&|~M(t>)!jP{!%(Nw0-OQ_AD3p1@GOS&|-xIT<);q`O5nD1Cy zSq-#0DqKW?vG0#Q6Tdky#%fS5O>}oxpYskj2Ybtv5L{UJ3l!^-&D5g9c`D1&oDd;??*Mq2OujXgQHEBf zuMwVS*OLgYxhFcPzU$7_LpdT-FFj$=rVnO)DjUQ+AD}A+I;!4bnkda-F->5=Znsc z?;f|H!^#}Bz4tyn>JY2gDR0+vd9caI+lwTFL3yD&g`r1S{58Wkjs3iLstEhE%dVKt zwiRa&e`RS#M{KvD|Bnm%cF@ zgIqczjfU^18n~8*GMt9^ihp7@9C_e4Fq~34$VDy4SnZEvW?5Zz9r>;(X+(Ic>*bV@ z1b&{@y<5eGD=n_%rI*{LoIM#w2OgZdeCrubD5!>WmEWb9mybdV$Oj+SA=zCF(nYZ5 z&0q>k_Q4OA6M>!aa5a0}l52TAOo-UVXZXPpY<+x$ zc#J?BS@|6yxoaN2Yu<@(bd4J-44fX(hBZH6MCVlC!zJ1ZTPl#5JjGRn4#EP&NDe{Y ztJ21Gh5fJAFPxT)cKF%!U=OcbjSbxE6Bmk%n=Cw$x-pa7d0DsKH+`|s-DE^Eo4ebk zwTIgAl(Y?AAxdrD#tQ>3hpZ$^|BUjSz)%L67__;z+sPo_HdY3oZ+ZRt^rb!5{y0A# zKDbVDh$bzLAuax`M5I8f=}^+E8XNRZ72jKlB5B_Hz*T6y(mLw<#zKVP#Ad% z$Ife+Fx12b9>wXM9fs384)TJ4x|pHYX!`xEG`c?Hhj zM~fO2md*bVfvCjyxjfQZ;h%gg zmrW)8M=8)!*P)o{#V@dJY-Snw*!Cl4%|FW+hhfG|CN-jZC^3pFaVxn!5>CIKV>A3{#l`} zrqJi6`AM}XKShyID+iB#0bmYeoz3m61Ug*N?eAI(C+Q7WZLjEeq%Tm4|BXYXh)&Sl z`@EzkgMV{ao^(%256V*@Q>aoKbi!Lf@#+Gh8+Gm=2H zVS{I^W?!f9Fhu}q%ve^g&jX+@C1?uC1Axoq$?$I3qC* zvo(v_iGly@)7H@`AJPSR;%9cccd1GKBA@f^N_*6cvf9!!GP$Z%$qSmLopZAH=wty_ zWOKCj~kKF!^;6h5R)lLeS@dE&j&N5&?`Ob$T+8P{-$}k#{ia zhS1mgYj)Y96jGuRUvgD=ssDTnxyax~1>(k&(A!eRBVVwQeobMgP{w!GDg_VrlgPeM zBV-L0bu51be9GnD*%9V8eG|5tm5^+D~QgE~M{;#)oTtC`TR_ad{gu^G6d zwtFExu+#e{{g*H#s;hfOKuC{Tz9NV;_*5P%`FJrZS{APT~sRhLGOe++It- z!^>#K=|aw2{yMK2slfZtz4@2a%KVp<`!C`}90r6BtL@R}_B+^tL{%vM7|vY|?EAHi zuh+?=294m`mlG|9J#!Sht?x**hfrYTz>k$A3aD0>TTdpBc6H~V5i-=~_y%on-m$5L zg@p1$5$2F|9?S+`yRyzJq`PbAh8cRJ&jz})le_nz+0%x?Vot}=@ABbmO2o^ZTjza! zA~6NDa7UBqC{yUjvHX?iqz}x2zk5#nm=OHQNgXqrajd5eel8O-3+FfbhBzZ?$A4yr z$Y`*G9~^H{zjsNB%X!3|zEbB{!b{ z<#YO}w70B1y`kquPO~Gt#WmF@cLdJ_u(ztmCu}BlWYWwW;?-{_VelqXBUs-YRr58g zJtBG$KlC0QuTJziOvy&{r$>7ml@8PJ0IyY~cl7840}w26SQx!ucU|xzzHg6`Vs0|< zW}fl_9f0#U@pr`_$A^IpBBMt@}0p0{8W$|8Wq$(yE_Lj+$h?fNz+OTxl$pKd- zFpF93_Xo^$FS6LJ!#c@1Dg$OGu-G%00z61 z+Nr73I8Wr0utTw-_Ww;pJ>_k544=R=oJgOu>J>JGGB3^zr*GCE4ZBh4VMi6 z2A7;ya5;DdmtDW%vK|eb@f$Av|G?!O0GAnm!KLWXZ!GQl=7yC~p`tPCJYRLlxWCAJTtS{u$k#r3?+_-b`T;>o@i5?M2 z{C$r-E9jjiOPG6ZMDD?`^N9T?-Gb~DJo_)nlI*mBjMKK1k7byg%nI$++KR0+4GOXr zT%G!F^r=#tgU)1OG8287s~#ZCD>W;m-DO_*UZ_;tsrCkn#$z;1a;jeKoqZy}?O`fT z(o&Z*l8~8cP|~){q3s_NpiUU^+WJ$>z^9AGIPbf(0(^IDi{DT$08129o2~PLkvOf( zJ<0G2(suax^rz<%w!#9HlH7{O2%!FAP1{DJG2wy6=xOk#Ij>?+GK8mo_v}ga)O{Ipt8qy~c9foQ4kZn_uDgMP* zc`|baOgzjKvJ&FX`6;y0dUd~6(IL(6`A7$7ze^x8=?mP8a znCYc048yjmcjnOj)zPBbt=QO`22dc3W7tg?aE7HY;Lel<0xjmASXdFr3Ia?PAeUSG zZSZp9xyfWYK|B11*cO+n(&n%H`_8V#_i4qrbi^mSe*LJ^rJqDbS> z?y8&gS@YqibwxeE;WsPp(l>Pgxa-}qY0CDtV;@%`0kXZ?(cFfI4A$+9<37Dg0acGZ zP0i=c4kJhq^uYZ%Vl`aWVAhKDsj_9wcV2N<=apaFmH0=81)WEM2gs($u|WPQ8($=* zl&1Jo_Vh$gC}(zR*M*nz4Ig@JwtT(`e60qsMk}v?M0BH~2pn70&AB?jg6HzW z@l@XaX(dJ`4Z>4;1mAe0onz1BCh^$_7VbNoFUcZjEGKM6c_nyi^K zCI`PoN|?eEA{b%Y=I7o122h8SqO?q9nZaRl|EBDyR3a%+^gPQ9AQj#_WC;+tmp67u z1Va^%7il~z>KvJLb{U4m_iw>jM0MQd{^jdZS`xz!4*95*iRJZbN_+ zgE-WrL5Ea_?^a-L<+|hN^>|U14IJwB(i0>4vjUD&NxWiQ@v*_9&LOUer7XA8TIxFq zz_WbVBbKDY_V_x-Vzkl@alxY#<^!)e1M22FyPX_S>yD)wQ6SdbE)^{PWcc>l;k%>T*l1N! zIl#AlkXEeaO3Taw{hw(N|Bn3sty}cJ3Z(t6JHz}ZM{vWmmJqP`Z&5XQ2QS|?pl#0LGNdm@D zfnQY)k22_k<*nhDMANTar;&+)}gg|v=x1|>HFKc3Dj4K?(i!5G` zblnMUk1dWe7<8XG|IzW)hacxr8|#~@1ToQf)~oxbxADFo|FN2; z)uG7Nx~SKp0qxz(#Y`kmVrqy%2Sz*80{NJ^4)G(mgP-IJw$b&g*x9vkxm+s0ne6Z;(=4i}_ImOBZ&qT)kKkc_24p_uRYU9bz9NxvUkDAj2G&zm1lPS4xsPuAH9JVYa}{Ip%%abZSKzMKTxKqpWd zw$7U912RbcPT2DR^?L>3)6}Pe7CdB?)KO~A6mL8od+KJO zq|I*VK4X!-|DlN2?k+>dv)u2pg}P76?057YiiE4?KJcwWW(KN1@O!xy^f_HlG&T1A z48oOqPq5X3U|_L5#G}|QHs!XBo^|)Y)b!%2*hG^pLu5F`Z%@%d0XFA7M-$1E&NZ5g*V@l#aeces^M#iBHX`=R`tNN48T0XAdneS?S zEhy%@S>i6wGV53CbO)gF^olRD{8%G-r64oiL}}`+`l^XQX*?q^%K8KwP<*vwDyQ2k8%xv?p$?LC~ty z$kj1c_kxw+zD$Q}?hawda&KO)KXZ2r9~@e&%k?flR!TTcN~*PkAdCEkGf@Du8g|N= z49uQ;`op#HD33COk(Ox|7*}s`w~|!%*x~H22w0K#qop+J1_*=h6E!NTk*A{ZovBt# z@r9ozYsCD!os+Y( z`(r`nN;ndA-@T(C(Cik}U3%3d{b!Hw%8Cax;H#JsD1=?`)hqhUH+DeUK?1m($c1ll zY}&6c$T{%baPHtAwe)yg9&TuW@J^`!>r4^IGCX@`y*<7a8Fe8q(z9_|*uSHz z0m{e1y2=c=?aWmOQ(HNl0v^2f4!RtAlDW=dH+8N*XebtaUmLip>9;$V?=yD2@cIAC zu0PVd>3-hYYq;dUj)XOhP8jvS?+pAO6!!mJb^Dcb_+{0#@WA6qv{JEw(0$xP3`oU$ z=?C=EeUI)$${4SHu@uUP%$a>!rJiAHFgTUJq9~L7n6m6PQyJ<0QT4&3*_Wg{5ni)Y z`=9jX9>>XWuG&hAMw+yp_Jyl;6==$`(g!D{%6Vkz|LTa!s@fjM%VK!?dJwK{i}2hb z5;G;if;1#ca@sN(Zni7l#L#Hd2)(^# zxx4~ z%oCGPtd5g8G;@}MrKSB-IBV|~as4dNAr*NuXD&GO_^k6&Io+%%*${!1jIczqs2ALd zc&QepDskS)uh6ovGCrt*Lx^(tkyI>Y z#3@csiJkR_?;$puZ)x)^nSzsx8bnGU7c03|TtV{e5&5<)s5tv-?$NRU5_M(}lw?@> z$?u>+?P}2Y?w?RsF_1G57R9Bi^l#F$DN*#mKQCID*?R5lrw zEG?f+e<|w)Z?13i^SMwp*;$Vxa*sXlM~Cs11e&Nj47hyNG(|$WM}dfFRvHKwMo&Y8 z0Pyl$x`oL&d%*^yAvRH73v8LQW%d&zL44=o+GB}~xVIT{CXZy!bGIUEfcDlbMU>rM zz?ywk{ZT8U%<4TTrr)e?@XrVb(v_ByWK_(?^a`)kw=CN_Y3q?tOL9-{kuqcGX1@x1 zsENaMK>B*avn(vz)3j640^~I+CalsKhCa~b&4{iZm@lv7cF)ZlKp~S9KLI;_c%ULD z_oRIYXbX-}Lkw&aG`iA?WW~D9g`%Iq2m*lxf+dTpw~9}K3S~SMh4P0h+vcPmz~O^cKWbJVG0k zsjEkOd$`$=r0LOkiD^_=5nK8Wguh6VB9YoNk97)qL$SJ}Y1w zx>_$U=Bgg*gV*Yyw;VwX&*m8~Q1zYR+DjS#rfjRx+YyGOR zOaeIbA0B~ZV&(Hz*Qf4`C6--Kag%O*d}86P~9ww04++ z*{~f2P7l9pZJF1^IL$)65;11Q9iQ%Rl^YXxB$6^Q;xYU1!StQDrR?b;kHSxCvYotl zRB|4JlI2&HwX3oGX1!CJXIUl!$JCVJIp--onNy=$DB^O4`=3Ydvn*S*rdMBiA;v=d z&MOHu-i*H|qXLjJpNg#aZp*5aHWcm6wIZG~aBJ9m_YIh;YeBH)0{)*Jyu`A^8xiA1 zBi&k9x;HJuCaaDY3>B9?5GJHr0lSOD{zFLsk(^++6> z$}SwRR9>Tr2pLcTRaIRBY%(Yy2Nd)>0v7_rpEnzGjerFanMv}qu+Z17^Umpfwp=0c z_I%IjyyESyu|2YXX@x3$a}FS?X~Ih#Da5YGSX{WU`#hdX#LuuJ*({*6&ixcxGL3 zPfhhIF`U+b1iYX^JN#pd`}Zi&9<~r!U08Z&{dtHk0T3k1V!4$E9z?LW#5A|~vf0s8^EWlFYfUuM5`$>l_!nbPmP9r_(U&IiKBAvrYjB0!L6 zTF-O`GxxGC_EE8}(^WQ?-RaStp)^NJ8z{Aqh~+)eK1Up34|u+jTcjIS7tqAl^N|ns}9A`@((mAjjuf}3}kvxW!AuF-2OPesc^+CHA!}g z7l^|ReK)VwuG-e_`{F9Mq_ehaJi7lHAj~~JYxP(?RNIssHNK0vf6nT= zi62&#QL?1bJJ7n$V%ik(p3`)qc8;GfCb}U?Qs1Wk{s&#=C@Y0(A>K9G6xIhF*1k}i z;%V3H&*!8s;?0tYdMntRdDW76?f^X-9}oLWNLLxsLBJYv9!=sR5=^I;F@*H_%bH63 zZB1<@VM34x11GUCuESP_1l>=QXvB<3zrb#UzV*NsBdkQy#?0oGw$6j{ZL=~7gbSp; zH~jg-5t-`mmHv}rcG+)bUfL7$Pi$MjWaL|W&n&x90=)872{Q=$;UTA4kCbORT5S26 zHvMW4OqQ*qxo2BBM;s51@-f;t^wOv z)<&sCWCK2uecyYDZajE4T4a~PIZ?%zWiS8)FM-`rpN#tX&0ZrZ@o{^0*NxyUDVn5D zp0_ipR}6IHNAtb2vxEkB;T=bL63DVgHO_drM#H+dwg``7yT+T!L}>rCHO>TJ{CA&6 zXl=0Ky%*puRpUA}$pa1jqjaXXAceeeh(YPp))C*N8Y3%=Y!mlBXb#_Ao*y3!Kcfi@ zP~?D#*uHi%u$v-a)N%P)Jyl7!&DTMQYoe2y?H57PsQ(H}P-u0wqk{;{*Wo~l*!n4I zqTahbLt4c_)z_o+Zs5BJW_EQAS};@#k2ViaPy0+?SV8W;}y>@D35bdgFvdF{ zrT})1{4?yTCm~vn(rOXrwQagMk!$+k*36l6#q3DUzUrIqpk}YK9*qZdyT79zM(FyY zQqi$eg|X{dTYn<6HGxLac9e)T2iob~E{Q{t0q28{gNd;j&Z|_^zsR5i%VD0z(y8ox z{n_fhDT_aM0_+8-@r8JaxlKe}>_sP_9wec_H8MU8QH^yvP~^P)qlpcVKch4KJNaJ? zB>zoZ(>HOaV&{gDLsja5uQ?>Bm zr;)Qo3*VskhF6^M1`k43S}8o&O)@A$}Qr&Hqb-?|;ri{9-5n zf67CY{%XmeJt6nbGgAS6xyYh6>C5-^1);?B12Q6Z+9 z7|xLjlT9=b!nCigUk(_z7y5d6+>J{Q>NE)!`pU(8ERfi*opUQWGg?teR0xSGM1*!n zYpC=@gIj4|4NU`*zOx|Za_~ZnV%6#7s{tb3e8xBe?VR2@2lix)kBpPsPTNmI0)Wjq7-eSWs7J>LPh5(k<;t5E4 z;1BcD22(!YZfX$L`4eTjn87uNDaO)+W>;E@j|h!$U=u3|CgkR+`|WQgY-4msv=OQ} z_X-GXEajH4+wn;PgZk87FmqKwfPKWt-I=VgsU%iLzTevbs&3ZnOLJM>O?vSSbe}Y> z^ig#JkqTp4SerbVYH9abmT>@6`OGQKgY0pt-?2BX*tnx$K-!G(cxh(tJxvC;a#2zu zRjk{PXEAFOqZ?*{mAp%p;Pn?H{+NPs{_ZB0XBCL^#|e-L8PG`|og>5>ukGkRz5FP2 z5nt4SZK37Zpfi21cfJb!L9xIkt-LuM&9NPVT$Yll`NS-$3>%`i`N~Ni3k;*iXgA|>yqKKO*D*X3t(7b z50eA?)YQ{LH-#N!6JAS$$Da=9fSO)Q=_f3dlp!Cgj4F7%EP6*C_U%reA6~5u;^wsG zU>A@?F|!t#P|~5|NfTzp1&0ptaGS2K@DS(FV4dp$p_7%Qwv!hnEz#VK{`y$T3!@^( z``asoCb={{T4I6 zw~g!oe?cD$$?7n_r_%a*76$(%F2i&C*im3Yr2oo)+nG6AeS_qk{c0B&N8eg+_n=TlouBtCm=8x@TYv%#&6_k(;nKqa zV_SuSIKG}|lreO*E-C-u)~h;C9DLoT6}&a&2J)c6JmOSt2{ z$i|AdDfM=9h;3$FKBCAc8C$|gBzcwM>8*WHpA z*?@1<;vto@Hn=gV88!u;|B{`mz(|kJ{GR>k8Z8xK3+MZSV7cZb<>qNimk}Y5uBrXz z2h=5ryP@aq71Rw8HR+JvK=5E+uOM^gl>S@@AVI9_1OF|Ns}NkdyWIS=JZcHI{Mn{o z(-P|{vKLG^^EpNW{~!6BssU$WzZK>FsSQzz!SV6nB7Tns>xF*Zerqlut5cr(fAn_d z@lf`AAHQ2j7)060k|d-o*#@^QvfiZ#*|LmXWM9iN_N|h#6|ysy$<`PWA$wtFEQ3su zWyUfYF_`BXbuZ^U=bYEGoagc1Tr;m(uI2ah`+h&~_XTt+70pT;a@8ht)haDou%FeW zF;%89&7Pu)Vf(6_D^Zh0hU<1_CIC@4b@sSFf;eR-nkLUoGBWm4uEh4im51=bef-rc zgZGZzoy$UkD~MD5hs>(1l!uV_qkLkAEmNj`(X}1oeH!aux=KsNxhb@6rTNL&1+`Ft zX70MG&t^Xuy@Rpl$6R|uxeb^<7b>s|lVO75l}4@~&M^u@Z=H`VH&6g${N|*kiys7@ zPgWe!I&Y>9ANy78QFOYlpbF%zfqt@8N!1ry0DA7c_x-h3uE+K{!O62DB__H(1Ce{? zAVp2r-Sno-mR2uBe4e$3choZmGu#deI-l^l5{ZJ z%r-L)quJqUj!GSx9X)J58v{0*jvi{%>)GVswnpxptIRR1bKcYtdB z^hHoh;r|!(A8ng4hFWL0zg2m=yHIC$f}I|gk)cz1+tLU61Mdsm_+lIhBX z<^IN7c~nT7ghcrH9ldN)IQkF5`0^~d^|KDxD+{MVOL}$oy+5(#6=^MpBfFCcQp*VI~$i;n_ADBP$Eh8+e0|OM^%_wyV}F- z{N9#an-b8wcls_a7;+0eyuAyN;P;avavJ5>JlJpR&GQ6pN)648850ynCr1I%bKS3eD7J?COL|f@uR(iF%X?i3dF6cNS;o5 zcjCk8;jgrXPbxMjaW;2xQPbe=L5f7*2>yGb3Lzu0skYoM@IAdPsD+eKjUTcGdmJm7 zdffJU91!a~ov%;*Ok2qIS!!akKybope|7K^l(F$lT-EGU08`>78Fh)^t2OJ2=fFqaJLxQMuN}Dx z!uo?0WuQ+->+C$&lHI<%+B^=wk$w6!_FIXZmCGw8zUWOAS|*a!306WX!_i8k~5 zT+(T}oEPWCeXh9`_aY?Q$!4@#tol#ADgJtF!l( ziHXAraH|eNzkOzMYNq?L-8T71bM1$$`VdSOBxK9P@>gF=-`2sVYcbBE*-c{Bnp1Rc zaoIg5%S~lkmc~pcOJ9m8z~#2}kNruQ-?fmb|4mQ(%(q;TQDR)IOzDJX$|pI0q*y7? z>{jR#JL`9wjoN5wu0u{c(Y$kY``YBMnEYGaxqC~Ody+MJqWhlQN$N80y`VHIt(GucLi!|>BgqYgtBhLaYLu&*4|``*YRxyg&3Y&$%$UcD5z zO{dPh`OZvI;nC$w8jI(rXBH&fM%R5jX?-oL*4q5o66=zcc3YvuC1!k290+yQf2Ii2IIy0Gep`I%J|I)Mqw22vecYrxA=GIsO%9`6Zx7o2ja55r)-m1I zKnu@v|AI26UgS-97r!>xswV1{xwfEu>UJpCwqgj@bl6n@k+;drBkGcRL)Y`7MI8vv zQh{116e5&?t^_{UuIpvNW>H?7-na*zJspzNkK#3E) zt-#gfUAzb$L4Ub5R3fZz+Lqasxzi(%stsBp-18PAt9C5H)n0hgG?Te@({LiVN{`3e zn@;&+ec&){)E7oe!+Fc;p-=5F;--{W7;rf?aIWxOkGi}vOkgHq=G#5T!g0C-`U(iW z+Ijj}KRJILAcL)tQaRcRtT$H6#pEk|I?|H_SyO~eY8Nckj55XLPi#xvS(LV@v-)Jf zA0*6V)jw>@%*;&Uj8a(xhIx5$uZS|k0dWP&hZ+IzQ-J16%-;ll)S?jpRcZqAT%M~f zGfoywj)r2!wDuDCx;86E`qgCDXnW&alm?be?=>@8swa^Z7P7j|OX+z`1?N@e?(V29 z^H-}W^;zzj@7pX*9sMeN-0fDQSw}#~)`*G?WU5r-)g!>Q;Bg!e3<$YrT|t{Es1~Pj+fNy%*z;*ebEts#%7w4d0fx-R#PT69|t_nVW&7C?))t zjZk^=Ec7uii(&G|CW2WWdi1@0T@7@e%-kX`zl%i}t|M(5EsiARz}4Inn9G3^zrA4S z?&NhG*wxQn85L3-61rg+^Ebq_1{H$s1ep`tgIla3AAvw3s7n;B9V{vqf+-gN0 z$AcI8A(C!U)E~T`gnS4rYiq656W`s@brMJA`c}w_%FWRgTp#f;=R+05S&Ve1Ur<1P zB}ZDx_Vzrbohy@_H()Evk*LUi>-x7~O38>tMV97yJAr3L2mTiqCO$}+d=&w7(FW_lT?z zaF=M&45a|sZXm4~YVf<@<3!)AXrP0U#SKx{~d~#u}NP=E&W>X2aBs zDwC(--pDwR6~wvEgwi;Ui*{T^5&ZiauCOVNIw+%8_1TJ=Ife2s7S!$W@WsL`*x{_R z&8@%KwDFpAeawBrS~do$ASK^N6#(x-gibyRE)+OIm>|*;{a@*cMJMq>z4RE0ZX7L}KFk7Odi!q2 z5Ms)<+65uGu(m301RyCuh1Eq`d7XKC(Ct6Fkx!n3xrAUi%(J4K1m(F{=bUI`%4NK5 zlC8YT-|hk3o&3>_@F^Drz+*Wtj04)3%Zwx=e1nyd@M8(RDaDspa^jq>jZpg;KEKz6 zy=j)AM5RjG)MPr6KiA@Ktna1||E8;zUIqNe+3@f-&xDwI=0d?$L0xvLef=X`Lu(+7XUSjzzV-QS8 z3ydv=zM9IH~N*ziatUq z6_{?6L2GzDTDTpS9qp5oUG4xmQrXRbEdFkos_X%vA1CnOKU@eSMz=4Wfu9n8ymR=9 zY%kYS=xEN!y^8}UeKLwq$<*IId`&pUS1Bg?XpM?7NKrURx3krSQ*~8f!LQNz!l&sQE5n>0<@W+QRW-TOkXFE$%*U+4@Lma8{9~^)M(OG&Yx<#K!u5eR}QnPYrccLq` zV^1yAB^v~(RT7q1yr2s2|#pf>-LA>rp-`dVlQaM_SG)B_|25urvR zOeY`dma-k&X52u>;Evs$ofYI&g(r1y!9Kl>Vd$}GI_}@MOf4hyGcl9SOA8+1`7(#$ z4(ilA>*EKRdL$R{1!gK0aXapEKNc; z#d)XekHs42wm+*r^LdkaUyn)z;<3}dUz-AE!q8kx2cLtAvWhZxMaD-T5@uJ&^b}0M z1eKK&-3Okv0I08f!El;0xw zeWN}-rJF^DQOhxRygV1mokxXkaE31_XqM|mPvoqfepOXXG|P^ljC=u>#^IXG9-J*!5f zEJUDEo)MS=TuWf8HM>rrn_;vU?@)ZlYXjM{_E48gIxaF8LTv8U@Eqkvd2g_pQdVqUp_kO#njvf}gENQZ4+Lhw1YkHnPJ>8#&%WfJHPem71sJwWh$Z@+71vLYZ8_VTCrdoJ=YVVW?i$a1R3z9w0`bwI@8Xd zeFjry&!W?d1dF{JXn3B-Bc)zwxQ;NseGkf85ybm2YkSx5>Y5nH|I1HPW&BwpW0X~a zeDzRPAzg`{zoeChEQ%w~1JSiy)a5Cc5u3Jh!=6}TYq(rEAW=m7YLpta0l#bKowIe)UX*Wq6G6t=l-NyGw}OX;LhSJZ zPMr>l?+HFTnNpL*Lo+%A8=m@5dhZS`rCcrWv-F920t67o@}}!DLesT0Jb`7JTfx(h zDG!d|u;l3j$mQo`c1kwaUZYK=THU^l&;az$2;I}j5bv*@X155@TaS++J|4K*fN-!h z8!ed$eO_pMt0l{M`S)S*FkrCs;l3i9@NyJtK3;_Hd=bdaQTRURdc?USB<-X0;6&ZX5JN z>%SPc3;h~J!835?GuNyJIK4<9jKm8EL8Q;ytmQ1f6^kv2U!|AxQV- zjT)sp{}9KwJ(RTTOgE4j6xw)3*^V$^2E_lEm zTK;&so%+9H!$s?DPMg~{k3{zVQb7)Re!4Zj7*=ZCUV;5&b9cFLaM!|UE)<(L-z%AW zD|1YI6E12sVq{7S%64)NT9+8Kp>RpMS^5sjP3?Ssg_JVgW@Om%+od0D!(^}K5P*9G z7$LfH&%O69m-+b1Nb$1SevJTEJBm|}gQ|=KU6&ZOx?5B^JD1(<@SQUy z51HDPkr+6+Jw-1A63snZfLjr8w`s#zb+zi!fXwx9E8T3dXeYXd2aT705fcvy4HQ4+9Sy3WB-TdyaduZRXmOmKS*5Wh321{A}+mqm&eSQlVe7V0w+po!HeH zpN$0CZ_KxvE-)Y?*mQE&QQ=b*^LdK4>l|qpYdho6Og(?HFf{_46eg5ijADt&VK*e?Z z`8e781JgaEOS+?Pkt6R7y}+b#-0R$_6q`EF+dFP3CHG_glyHS^?Pld6kR{=DPzWHf`f;r7 zGt4gBsr8I~a>}y;@R)tI!9$j~=U@vx)#1L~H%Z=W*9)`>huB#RjglL~W)eBP`-0|MRil*+H;z;zKoVPW+wP;6ZprWOGb@Z+ z?SHL1Mcrx7x!8}YOGH5p*+%~_H*7!OkKKYo)zcCPxEC%MFUby481KR7D|(+vJwn-i z4uxv4^a2A=YR~Q}B^BPNqCVp#S@`o+r$462XiyxT6}~s~(udX9)zJ90)w?&WS_4D+ o|71M;dF!gbE&I@}QI2q%@qn2Qi-`gE>H6iWwviT0!#46i0J#LyZU6uP literal 13939 zcmb7r2UJttwl4k_LI-wVpCLN?n2}PQr1nHefZ_)#y z_YerZ6YAUOJ@1`!um3ss?J=@4_TE`*?={z4bAI!iGeNJEq=|0azk!E`Mom@Q9V?{q&;zmWsN-LH~_Mj1mtpdD|uz}6DjUpL-~Jroo5J~_ngU=ZsH%w3<^TxDp8fg^k^ zP`GlHOfZTg%HNv~9C+~@<70al7c<#n7OkZNdWgWqQBGGF2bw;`O52vCdg+DPfa+^- z#{vfTZKuyp3u((v3pFhAbS4j_`KQsi8fv#*y>QRRRbzO5;#G->w zGYq^alo7;cLW?iI2kX1Yb@Xw|D3H$U=`zSn%=j+t?!Pu_w#QK1UtO z-VTnA#u%T|ywWV`qcvdx2FM9_=Mro0^SBr3mFG)Xv$0c`^PP=3O-jY%!?x_yQ>*0E zXZgbMnF=@Z7$|7Pb=BgUU*4m&$30+_7HYnAW1wrdkYPf0g^gawx8aN$IJyK|VT_kZ zTV{fyNLvW{XJMogMsrmUk#n2l>bPb4;oVu^*Pgj{%jgt{F4m90uwnuhb~tWiBkQPK z5g{gLj#Jp~1;O?7dp6a03O}>dpjsLl8j8LfCxb*ybIZH0>pz4@+|lGkId>9hoF2$P z?b4SqWNJC#hzb}weLC}DRaU%4N29a81)$-5*D

jAg^+AEPnA~ zm47@{qM;K!3(C2Xk^z~(p16YZMr_&ARLt(#^d-%on z3tHWEXXfa<_NXQ>X7Io#|JpAl7f|w$8P>#}U{cS)VZWYbm%JaDUxdVMoS$uoouj#? z&$pC^ZeHvg;_!Kr4hq?O9rxvF@bDJJu|V_U|EDRj!j2f|5#c=#$!g&fUisVZX;jL} z$_EDr`}5B1&Z>Q#BAG9 zkt6}oG}27sBfE+nAKw7AS>JvdFuqq>Wm*u4l#2|_?uWUL%%YT&^pHOMV8X=1H@|wb za+=Ti_Cx2vnAsz12e;!Ekj~q=MS>ru?;&c&)jiRo6lsR>(t4hj4%D+D}fU{Ag0u@lM_GH;T-tN${l4BigCWTs4Qpw zv%+&I7kRZKm3)~QcFFC!fAzHAlgg+x`v!Y^N8^wiP)yB$v&w14N)$-i^@LWk`BT<&8%zD>Q4>R%Sf2Y->FnW_(@yL^IVg(A$=~%N6BI6yHa)-g z7$mXe$%aW#x|{Jh`)K9YXy<2j^&LUUWA9%86a0c4)nD1+kPW!QOHN(IPZ9@jICBfT zdDK%W10sNujW9uKV`w1=B2CK7FG1Y*xTGe?Hs)e@I3x4OhxX|KxArI%du5M6modb)i3WdJ%v$SPYYn^cEe&c~~+l$SV~ z&Lxoq^bxt-vwWt@GUOwcwq}n-KALTMSaw=ln~_Rc&1Gv#0F8A`M-mh{&MW0A^cy0^ z&?+T9P9k88`F0HVUK-jttS+?O0>Ko7FwYa655@t-{vd~~9cEejnZR(v1Ac)^|BMJZU%JBn;J|(a?fVM60 zcscjnmM~NNF9mdzfo{KwrVA`5RF;0*$ZS9VvcmsLgD+IQ5`pjmwg>5h z$Ou2rC#zSW45+qX%-n8rx)0elg54G>kCcK7j{1(FX8Q)Eq5oskM|4KZ=XxUY4$1&*E*RGdba3-fC`U*Vn?|xt zsKbCyhLdT>Z&K%f3p$)xMKx5A++#m=J*POd`FF9SNHz-@vaIKiSu88 zlv)8PNoR&jDTNa$28sBZ8DsHY+@;{zYFO%NfN=-kJ9qk=`r(}vWsMRPB=7N2ph<+M zMP%D1Q4xjm?ck#xWh$HB1`7>}ywPIiWZzw%tl^ijjgcG&QfVj(SzS2AAYt+H2*UR1SLf-M;wskr}k%lfOjgwIMm0?kEnYMKT+8 zEY(kP(0bu}rmvOxD&7+oqD$8SX$elIu9#CI1#kZ)0piaISG)nn#34HXs)n^7kd zwjXA>>Dy#vLi@rC?6%)n#9-h;exLrX6Xvd z*G9%G%3x&b(g#nfM0)cu*Z|%~d6z99j6edP)Z`x}{ z+`iQrO2RtFTp+Q`d~nl{rdq0%Sa|6{!10b$#@Op=`RctRZ9eSo0MaAuY3GnbNuq{9Mm}rJ-7KyO?SrowAj;OcH&qgg)d483g5u$_M!N)z1}4Gz zauNIEZ|*$=uwMc)G{!#E=1>V5zH@J^p1Wdj3=EdXr1c)wmk!HoIPQSsW!SgT{#1PR zENk=o?AiyT)i4gCVU6q7h-YPJtHhD&V1qkh9{(6ET}z;p;hOqZsiu3n$E#Z_#R)Dl znZrk8$%pmDvvy_SHE!?(^>)+;2Ln0j9f-B;ihiQ;@|~U;OWcu#q;`S9PG@PzxMCZA zGU!3Wsl@5##$MYfUOC9gK?C5eAm`@oj7Dnyw zdnH&$FS1UDzXj_rZ;Tkwm!2wSm9JP$iSyA;3ZFw(Q$dJh^z=#7`KPw&vz=6<>4S66 zQ+~uDXSu!K{{<3RPS}p$c51kSPzSS2>uuG)G-hNpUAInDXrn8j>lSUw@i_~LHGg-M z%jP7vC+{TGf7`koo4p}Vr7qu8nS@Eikvr+H4))h($nwuk##NsnBfoq0is9F*z+cOy67X)K{H{F~}BSVCUBT(rVa-)*k} zq+^9&kyiH_Ywv60G{}6Wy^O)O^2Z z+s_g!(NJ)|_V)hHmfAc2Du(unQ_o)6UiK*NA)&{FTwkWra%FAZRY;l$0JtF#5wAG>uDgb{h* z4JdU}PBw(KvJPNa!Z^ipsp8VuaHURx+2O-0L7#PV!s9kI`^sXYe}G=R%yioew~u)C z05c$mS*O)4`B@(42`eN!C<_6sDW$$fUVT4G@K=sy=K=iayax#7b_e7veFO=n= zF*BFawE`@6(e%=-@- z*)+NbYt{W-JlZK-OiA%Q0_$77c;RY3Y8Hw6M41GxYMI2u<)}cj$Xg9AVq89Om8|g8 z{IwwDJ>ky7vOJs~?}n2P+_*oo%O!USzC;oB&|GoX_y{A^6tvCjTv^}B31?Z;xEO7t z3HJbE_gzFxI3v|C#IS@3;xzOY>(}3RFC}d5&Vi0Inj~0#W(FA~DMsO1Fr=Pe;EBN& z?99m|AZ7lVj$bJHUR?dW&R#cPalEya3YCk<6)qT~FKAg|07g9(6Q-BQoj$ZYC)P>9 zg>2-PB!CQql#Z8C2wKqtRSm5Vj9_VVH6`$#5_(+C$yy5L$N%|(Pof0UXP;^9?r|as%%}hFoPT@Ql|4Y~4;Nbi` zV}oy9JHC`C-}Y?L4(e;K>{f!QBqEv*Fy{Q3&h1><8}FeV_=|gt_%Ht1vs8n<7tQ9x z(Bll}cq?!~xvF2`in4B>4=UpE0WgRpEP2=Q+bl-qfFy+xY<3xpKXMP|s~>8_jB@w7 zfrFiezVamR=zW3ie|VDPHn6i}5QBUqroM2_7;11baQ2ZjtYXvPIu@p1A-qy~{)O@E z`a4;uQ~G7PmiK5zNFPDLDxlWwVwYnr={4&f}DFzdCTal2;!RJNC1D1h}+^ljPurqw$A}5@s|5+>uZwvs23}Tw0 zRl@BEmN;U9%jaf-qL7o)?~Y}?s@R*u#9-;AXcbC1jVn){W78$kWw{G?rl6BP=H zV5H>4;2ecv3pL_PuQG|N?-(_OpD4_$NXH0Ptp|SkoPs#T6waTsOCCRDn=6fZTYx0! zzf=4$tTm+%C*GJ3p{&HD2RvmIF5XLGygK)7ZTW?8ebb> z5s}I1>G6oJG{^0N7~5}NRz=K!^M62w-P+p1;YNG<1##+~{4q0HztO{eQb9t-=~uY& zF#>g800gW%pV{{H-L5ZSe+hu2m>kKu@oI?+^x&rb@b4}3*yqPlfeM{m~F065XST=hEoLr9Wxao)*bbz(NW#tY3?UgG(h zf*%nkq%>7D(9i&hK!mwPg4mtxu;y$FuKkv_=(8Bu{9kX4Q-G^aUZ-RSpZgWSNMD$F z^rzIW_oJtr%c&k^uM6~vziy4F4@uXqN?J}p+Vs`RKNZBR2&kG`xEDYo^et*XB-J{OZ8O{?&+NHDbCPcy^fWlc5Y%jH<1c9uwBPESpcT{q02(k6 ztRm0t7uG{`tbuBN#?uvzEPjPHQY2&oCsp;zy|J)lS1u8K{DtrJxS;^@XP=tXq_7r^ zwuv_Oo^zGQje-FtC&Y-&Ds}ea>$Ogr0tlbE%KR(y<@XQ({^zT>d}Ar!?`<3t&{e;w zgXZk29e8xUD+471E%ri;EciL)b6LNa@5iN4wg#tKO$>`Oinqq+?%U>z7iyzrv08fj zelg{_s&Sl9%~%D*b8W-Yq90@F8u#s;2D7gD4h&o8<`Fw9RhZ0Iv9CpgvWNWxyosm| zLs(#3%G(+p8QrJc6?|M4dpK*bh9-^s4X~MixI8pJ=2&;tD>qX=l@qkCcKfO3I?-^8 zq%YF`SVQNlS;6*0GzWRPIOM0K5}^Tk&Gt(K16QOHdxWoulu#E6nR8ru8kmIcajL@R zULNW($zA&bN?hrDXN4Z8>?veEHr4K*5OXBF=E9do+DTNI{qv^CRal7x;4zWA;>-)~ zsUdaBc-H)2GZi-T%A4?8xb>~9{Si8-MGOnf6z-aRKYmPGM8)eTgo~nk;+BQ#(E#)O z)!}leibfm;9SbKL15H%tVw^cutc|ed1$q3$KCPst{?XWAn_{c%{>8HdPMIdy8dpk{ zwVaA+K*~p?R=RI0BmkCXR@54AB(@atIQ51N{+e^rRTHN)?Yjpo5cM~@DVblgv~wW6 zY&x7F&)&@snJ@h$GE{qAoiA`C0UK{Nwd~N)S?22q>5`*)OhNd#;=wwF@__5;sB#&N zW1Fj9nf(_-7d=H{FW?=7v3H;%>4T1|qJAIbecQkO z$oa@RKkxZP23owhy-&YEzR~O*5Qfysw0Co$PdDK@xgIZP^6ah*#C}J-?L~#UB=nB@ z$jiLoZ6=M8O1|~fgPqCNkWgH%n2nQVm|+>3H}@{WH{_+b5C3{P`vd7# z=`G}N`o{OivUOe~9enDho|pLnqN)Ve)AZ+LpNd1I<+?CIlth?g7#&tZNbozoyuz&H5b3=B8ue1js ztE!{YWa%@~0a8Cif277`qfsS3N`=Z!hK6J4Q7S}tRddPDz5~iN{L{-mv3%~q_m&h` zv@(BIPvBiea!_g~F2o(6lddd?&M2|7*<^0l`*e(;y`o&=242-6Dv83U3?amc210s`|akUiE9|2`^f z-Z?HOj@NMejo_2nEU+{cgHi%7WZ{t+_JZ!y%vH%zI`ZOSoR3GLwpfNcNtHsg4e7r3 zKZU9ETL?moR!2IuRLr<9B>WZ|dh-QKCUL_@QcWE)X2^F{7DXDb?R%m}0G)apjISA> zBDR9Z<@-O^@t>A;_U!BoaLr0_O8T%`eW6Qn7twf1N(wC<9qN|w_I-40=SrF58?6ia z>qe3ArHRMTS}6v6LaD!Fu`d|w2oxS(pOHloQSTq9hd8OcTe5<`;wfuj z!{t&Pi70wgYmO=iU3CT6W+lEp>&cfQB1?5agd(F4r+45km+{OnGsynV6nO*I&-iyy zBIx28|EZ*;ij`s_Vp*v1)Lld`CG2vV4nR=pk?WF313&+9;SWnKr_t5yzei< zwKFI#lG58WddTKqlkhVv^6+IotQ z(yESdY=Y|?t&&cxVH+j0@2#;1bhfdDbB9`J^6k>CJ2ZUWnN@Ni<5VYAt{)p2bHZ!8 zE`t-0hVr`R?d->=P&{{MUF_Q`JUJ6e8E6&p;eeLktnl5?HkRSwT93>o2n~hz`9OJ6 z3718_3QEg*+nJBpM#LK0RPC^OJM>Q53)tcM6{IwG2rn>rKsrk+P+FU*fP?(vx=0ujH`MW0@rD0Z&;k zXwZ)LasHlKDepRSDI6Tre+l8^RRAt}lhGC0)-*!+ zF5E>c63gy?t z(mF`?!oxH6D>CO2;(SIMG`;rO0JY~kRYlyKH<~OgTK}nM=YTZ3HGDC*!CGKXR6Hel zosCb?DoL_GK9}p6H`jeBTgvy`PG7}Pqd(PTT~*S317bj5Zwq_=c&`)*Dr6SUjuaGf zgfU)gFiwTf((U63$d_ai+tnIkuM?*15+?Qwya!10G|~c9-1aMPsYK+Z>Wkpv4m*{1 zMw}Sq%eZy!BZ1#COo6?RHfVN(J>q`T# zL(7%v<*dX`*4i-&O*)wD-f)U`BK4R$mQ#q$A~sn9EikUUlX<#`=R4HOv$rU;PulJG0(Nu|woy zzB94>yxyTQ&garzt^+T9SAYlFtG2Y6tGhzIPG@D1Q&~Ozg=B5e9%@MU(GS^g@wkZ; za4Wk6`d2J41bH0{N7$?)>&ADyZjOL_tlS2l>b{>&epyCP?A#>p?M+^ zG-$eBvaORi);XA8i0lKiqVpiJulbeL1J%di3M3^)1>HMc=Gy%0_64ODDRDygJ#rd~ zjV=E*Fj$pXmn*zmFoyN3Kk?5T`nEYIBHGi~engV*)~1-k}=EB$0ub#efDXW}IP0T%FQ50PE(lt<9=m0Hy#^zR9 zbxTSFEc_H;SG!PLB6w%8~O&t)ef&GXWuCB zz^R!nGeXNWI%|TYEJR_mmU+U(6uyd)X;d>? zf`gmK_;qN5;@f3rY~ic0ZPgn|>dmT*DmqqQ^CGGqw)Oy_1`?aKasQ{IP|b>E$2k%SVNkgLjw2gv`wyQIFmA~`$xNz40&E% zW*$KGQP$C0@p3AIcfp2(a^_^Ol3)R2uDtg_jxRL#V&J+j<;91rjkwDe@(?!fFjqlc zdc%5*YuuHUddM}wDIS;7eP@p#y98ILrNfeAwB8`#R>jx}%ezTfhOmz=^y>WzYDeJqUCRO=Vy?x9*wcSP+ql>$*T>vI^4 z8v_ac5H%ua964N>7kc3A`ys#RA{aTdWU;E&8UK#Z`My?m1k?G=IK06JJjE#xhj_$P zX*|0LH5td$h-33_!FG%qjc+74veD!yxjxX8UtB5~rky4PwDCXK)_=9a|G;|RuWu8@ z+U7yu@B-aumzS5fwxVXVZeDORs`UlV;X^WQ zS;Z*f;h7hejs%#|;QjEF`D5eciwGp5^@-NWxo{^~LLUr|@Yyg{DGIdYd(s%!E-op0 zXS?A$snbWmZ>%4tDt-0;kM#%tl=cK-d9I3h+h_nWPDr3uK^4Wv1B{#>cV7NZrcp;- z;K^zIDQ}AuYapb%_5YHc@RcfQs`&V$yLVa4A6#|YJyJhQms7HEiE(+XXP7viT`fTi z>)p9JX+a&4=MpTNd^Nc1MxDpOdKe=RR%`+Z({vbVF=LBwzfqxA`p=w(XZ_lSJaHa+ zue9ye*Bvz?>-#$O3`wYv61PjP()E8Mw6Ktkv{N*q= zZ`Dp8bIY5VTHf*48&zE!vstGB+^0PmUFoEE;~||9Lf!Z@4M3KaD;8w&PIo4+pZanN zliYea&TV-U>pP@|y$RpoG}Cy_&&s(H^Sb~5kfJ`e7c$TnU}4loDbv)=-accF*jKRL za1cyp4DPb*_?4xf0m?aiRaoMV!L^eKg}a=0^OuhMbIaloRbXu{XRgd7h{ z5#Zj82!h11X;feXpyI{l`2)IZ3^~$&i%e7H4_=}kQk)?l!$_awYdOC1F0^8&@#%bvVw+Yg?Mt2%#C`(3E``g;EMtXcm}!Y{~#%$@`wTksIbbUuLe0CQplHpyj}BeM(*_41bstdyiD7Sq!; z&gJZI1>qK1xEZ{g-7_mXY@Uk5EwUf?eJZRk>WP~^Uu-KN=-wN^%}<|9DTUAQlkiQ= zD(q%E*OGwor9lFaQap?+&cP$0bL){x8<}fe;|j_HjM-aF25CQc6gJO)$C^`sOwjh} zMB1a0uh%C;fxh&n!!jPt3^EPRM~bo$qX$)Un{wsXZqj7f=WuQ^bvrd@5}0H-DXS@K z(b%N(j33-)4%^r{N<_Nx0-{y7PbG$@1Y9R@2tOSBRwv3;mR^hOY09NrN&c?k#Z<_- z>7Z|`%^U-Fj?izHny3$Z%s-9MFoO%bpl#`q6m~m&d9W#@`$rG zMdkGuy{zd>z0BaHRy`b{F*IRKlWC$Wv>?84n!4B~&cD|E|8*UAXLNAykFs zx(QFQQLYFKZn;LZHt{VCWff0$GSE4Wm4X$zWi?vUEEEJgUGhmcuf`-5)*me<6_!3i zg*u+RwLl##Zxq<4s$493C9*>N!AaQR+2e~R_aURSg;^0*v^tZt>gLw`xo*iL ziy?LMHB>^OH4YKF$4B%Fisn<=OYiD>VSI~aR@ltMq)d0V)2b_GVMan_Q`R#TpUa6g zhCDs98r6}W2d;rzVR5uX$+i+xev7u-gq!0d``)RreR4qeoq&Mv3E3_O`4;#9->ZoC z+n5Rd8a&VK9?ds$f4!_;PM9JM&4FLs+56`LIETEoXU6khSlN4Ar(cGERc^|Kn-%TG zc|R^H8f7b|8rC7AgOe0ANENV?HJz4NM(KB2vvoU1l=)3&o-K#3!As_MCmg7nqe~S; zN2`1QLPZ+1=rSU4n-AvK_T>BEh`M?%{?J4O2AyCt#kT3zoppu_Rea>~IWE-WnvUF{ zo&)N*wzjT-cI!zJR7Kj4!7`sG@0CX&)ZSFjHfd$vQmC7I)$>(%l18VKMcxk#?`#K? z(!GtrF|FgVgQ69$BbH3-3kkpUfnTou?ghr@`h;wV`d=G@3$r2v1*#NgWG?u{wTfx) zvy)LaI{hF|!UZbB={qwI{)>0qnwS2FA?rxun*IwXHBxa!;QB?8NL{pn`SfgTdy?|P zjO)L(hj$78clPji=7-~BZL;y1X$iWHKF48!Dum*qnhE?8V3Sf)Q`bCiFQD5)K>4Da z+eCt~##5TLJb;ypG^pb&ZtM*C9B;~Utcj&^V8cfgxmx_!v9 zFPq2~gDh|j=^+IyZX}3I4y#@(iTN#$8%z-PsjoY~jHr_T=V~(BemB6-0d-J->o1BX z1&!7N5#}^Am9y}Sd-1~Bo-Y)skM+{3vnE?;8cO<*N5a>)y}ZbvAY)*FS_VrSL;%F* zTc{GP3m2%)KJ2PZP5WXqlP^EKfA2^Jx>MSRB#4TR7B@Ds9J~zA8IJ-vjx#~z`U&?O zJcw4AA@}L>w%FWwAAxrL!;BsxBuz?712zm)Hy9inVcvC=wT|;Cj?b~lIY9D`@MN#- z?%V@aTHR(o|6 zQo(o+CD5YHvUPUqL74np$@<5=y3)?u) z?aVREAsO;mJOBY@kQc9!=|crJTilJQ%gfiZwg3vM|u3hgR7>H%sDa*tj>^ z!#3%=(&@FFx3N<*bTR+XCY3f>uRRUx=I#48%)fX%`%UZya4Cv$?iaBs9=w+4tE120 zf3aj$pwiY$6)HW(`^M2E;pb0Veb3(QWguVQGZ^F@*llS!snuF~!^1G~SmRMI^}8sk zw&O<$_m8(rAGt&H_(!-cCwzPMorKqBFlEEp^~1CRty3@+P(X{yG1#9Y7Obu9V0=lW z;CJ!bAlGA`#tG@i3A$NawZRe3k5-UdvgvD5*monaS~F+oql0w;VAAgC$Rd5giu6_l zuWyeO(}8?uLDQMGgnOZ_PCDaG0MvpDVYc8tus$!_q%m5lVNHCb?J+}noUH`^Qty=A zsp%8;qDd@IfXS^h!M*SHp8Oz*3b~k6Sg*}em)l*EI2Ky0Vax8IYvr5CZ{5yJk-93h( z-^OzfLBFSSYv6~zeJ0ma^I9Pj_3S~aNgHLocikEu$JrP2ok0o`hWStwz2edr*DthG z=X!kZfCkX&sS)!&k?87gOQV8-&3n^-B6A(RamTyiTpIxvTg`e6u9$laQuY#Cc_Tuu zD=q`2Xw-2^`DMUiuYTVHEZB3bDl1H9>kp=DVtQIkOl-X4WBVTr-|vJ`<#!M}m$ZIN zEsxN28^d&@ir`{ci#$-rK=g=VI}cTJH7edw!9;fou$a>IMXs;^tsOW2&$#waS^a;x z7Lna^ei?5Dtp$+(PXHA8w?yK9yYXWHfaMo}*#+}*U3$H9-FE5bhI0u~p$SDM@q5Xr zj{t0L>rE9q-%D;kZPyD6*>js(GgT=x0iZf?+aM^_>~?(3XOEH^g`RyIeyjR88X#Ln zj$U8yk(1^ zS4$}K*b`%bNIg|q&#gD8=_-6H85xfb!l9SozO?7s{EQI1=WA+hR3rlM+8onIErL#+ z9M)@^-y&paTr|k|KPS=a&nd=^N5@U(lsT!d66_4F6w3mL7cb3Oi6+)(Z(1Qd=4q91 zPB?gaGM|Pz7BoKiU|P1`FiJh#c{4iOOc999pRdJ&{9|;whznXJ;d2A+Y9c@PiQ!0( z%y2#Tw@2QWyKb-DpF-O~`^W$lSv6||aq_xo>QfC>-Q5`Z{7Ajag{$W>@K+E4=hdq` z8x<3-RYU!ck7Y;Kxk7(S;{Xjx@xQ-XUDlUVP2H+D$weQju|D$&34>>#NGe8a4b~J? zRKitBO)9Yj-8>#bfUJ<~5MlD|x3BsN+J=Z6vJhk#mD#X3~cRk2s`*K{oi13Cvo6*GeIe<@@~Ve>{$&_u*U?BsOcJwV~8 z^t(9!Okeyhukk-`ObLsL>5$^RkKa8xIXS=Ncbnbd)5jm_z#ql%WF?he!X@5({6D*+ B%YOg> diff --git a/Images/custom-field-5.png b/Images/custom-field-5.png new file mode 100644 index 0000000000000000000000000000000000000000..8e2d9b6a41cd5b83386f096a87f8409417f5cd4e GIT binary patch literal 15265 zcmc(GXH-*dx2+wJ8c=#Mbm_epB?ti&P?TPzHz6RsOAVa>(wh`PsnR=07myYpbPz)e zy$0!b^S<9b-*?YFXPk4!xMSQO8A%vB>}RjNp0(zjYwj?0RYk)4)c0@PxIw4{m49{P z#!YMB^%?gb@E5U{IR3!fO{Z6iayLo`X)(Z;JC;vhJiT$FJO=;V_%84r&jG6AbmIn5 z$Mx%G5A2KCjT@38O7c%%yBluJ&8g|RWy(5SeyE?p=fU2xwnwal%yB;GCDl-QxTzVS z`D`C|ivVSVf?j05@;Fp!Vlr=Te3__ezx-6$SF>ua;{L10;jecJpIXV~PYu6#PS5Ah z7a>>OmHXmD4T)MTYmJ4{LhI0~)MQV$)F~y=$_2HLL^_V&P~hH-k>605_2lH_jfgIj z@+KX^))VjhT;vg5`-alqViEU9K(TCgc6R)EVWCZt;1}{s#st=kjKro;GLQ!)BsKI$ z2PINop1vEw%DB%LA_R(sUmq%Uedz08nCz9}`9_X#d3={&m#pt)iLfId@ber9^27Gl zmat9Fr^F966XMU+cc_pj)gH5Tu5=S_MMFsKULE2|C9KM<2r7fOG;QX|O0UMd?W0NQ z3($tzHu@CKu;{&TCdTPc|8)d+adX@g?a_nOh&?MPsKK zN)%rw`o(qXHEgGFCXY}!*%OM+%h*cE>^`O5=+<2TJE8NNLSd$?2kps~6h34pc{@on z$GxRmJm^#Xl3Ur7A+XwlW; zc;V*T+g}e>oQ?*6Xb@-c=0K*ogA8!3Ts|Q#b-r(YPMkQYRFay{rKpz9%lhqEHnnXF zTj1}==G)<#Z!FJta!oL5jB$rgg^Z~F(hBuU?kr$Z^4@PN+Z7}vHo$fq?^(YHXrK&{ zJ$pO9ncx{9nCBN(>&Yn#qu`lKQloyD3BUaoI{H=Xapcu_#s|$aVvNsWV*m04>V5~| zjGXRj2{)q)6E{PAi7PQFvcW!!ipTPD>DKQo9fmo&{gku1^9HV~QTF-xWjJxLtcjCd zt{m=;Xx{Q(O2HX}XRi<`~gKe$DD;U#cu`_q(#A7&)jPyoW(PYFYNm0hBW2 z8!Xae`ty|K_c6!u2hkk^;hFd+t-Di$ynoK8HBO+gRy^-8wOa|(7fhO)Tat2i8geb( z?90{P73+M}Zq4|PJ}%1g`(tiww4Wj*Bkh%aSm*0}b02c%f^V zhN^hBG5Yv$pgVN|d#Xqp+DM2)$DEfj1aVwQXz4ZZnbEhH7+TgCjYJ=RdJnwDCutr!Zj(8uiad6*KKa;*3%%P9arf36A+0#h86ATqnKk_o5x~MXxUtwmu2zA zAL9qGyE*RF-;7>*JKMdRKn%*(hv8$4Zo412FDru)oWX}Hv%=@IhHh{ZsK%T)7LhpZ`1~|*<_DDI-Jp-YyJL&XV*}cC z1pP8wv!=Tifi)*BR&q8Qb`PcAL$gZkP;R>b<_5c<1q??qaiab^yGxav?yFlH?k2P| zL>+X|*~wa7WsBt(D~SWYx;-QjxpnV01DW!!4h{4(1UhUFdR@{lvZuOJh%n+bZjc|o z^K~Y^%CVvYW6`kGXy87VNU>gUVn%rTWVGDrQOMBNoEYhdgKi0O@zNR8Wve5$#c{qi zxJpX2c1v^}*hbxCjXkZ#>5>Pd#E{hWNVX73*P`emQZrHlrk&JLe_PGahjt9{rL1{d zN6fUmbiV@TZh9g&G#FBh|Kz$ko>X?xdFCcSBw)wPet%?2lVV0KC>+PB@BNwjT!9eE z=WZzL_WZosj{A%dW__mMF>`kiF<(C~R`yiyQYv}1{m&Q)lp5B;g4#y6XY~u(HXI96Q6g%&L8GiBU_`Xd2-e>fS>{n1p&&BSvB>vH-gQGYr9-dpp^Dka5 zN_}Z>(WF9_8Fg*dZw;mFHI*b_mj<>dj@95E^N)A@j}7@^UJPdYlCl$HyjLXV`9qZE zy9$C0tD-1~z7D>=ZzUP&rssNtCt3;iKu$t^Q5DAxG7XX|)1O*4^-Bp1s_L`*wO3sv zwox~rwo%=}oJrZEE}n-kJu*@2mowZmiN=&s*EWrdo*9s9A|p1eL~OD&Kfr#qD5vKl7LtS%Qla{1t! zU0nwmm^-FAq{OvV%$kGPy7`yqrDDSZHo1`uNQWP_3nqKtueiKlGPphh&MY2n8*S7Y zp|+CF;BpoE(-KAUT?XQL=58VG(WVzO;kkjlsCY8sN0{8HLnoWCyyMO8pWOdTgXzyE zqIwC%ELB{ysXpqreZKet!!H@5gPmHxo0hFl&=IFbtaH|$MyuD``g^pIbyE+g)=2D7 z0V=t0qd!X#yt-aKuVGhR&z*Nft2cpf=yhg+Np^K@;iDfyS$rPHrImpjqL=2CtA35`V3T>*&5le(HK;H2UEa;?r!bW^GVv9pXwJo zYcTcgQG`ltIiv9pU3-)G50~44ut+y*^yz}8*yT-p;p_dRhth}St3moNQo6A_t7}f z_=BXl?qfTBh7(GPVyC0T7EEvIjNG(46UXJ?n)JSwVkyn)30)6&7=d-pg}6F&M?2ck zRmKU&(Q-}aXq^)!wrUSHAh*|D>8duc;{DTMlyHuwvTWXS#mKhs+1m-qL`$l)&k?zB zjz#*FSRFO=7nMxV$D<4_r(|tBmTmU_C~)j(J%KG&((eo)$oIdlU~x2Q%*V;=IQ-vX zztzI41Y+iVAsi@P(6>QpNUD_|mcW{@?Rl`|ZDre%KQE0iwS_O{5;KzyKjq=Lda1S= z+ui0g-&mOtK-RqOmG!S_dHjODXrZ+BK=ut!!jMct%;NM+yxqDfPpx;e&GlxY!$MuF+yGEDQf~a;fL8wl6!t$q)JZ&Vf}bAS z#*n5kpPEY^;*HBHh>h%=&nv#cJUM zEWLFRQgse1E;uwX%RG55U+^RfqPs+aKztCE)8@TAa$}^70+Vkg8Df1Qy2Z~;*=gmW z^j`e53eH?nF872%3j&Q7R-xGn4R6?;!h?nOJ6vw<%FEqaH*IDSp8O4 z1jQfS_b`tWw`8RuDv!1NLdZ1H+B@tqik2~F6mxP=eCLR%w<`&izW#;|Nnpj8lS7EN zUUm3o?$sOU24$q{URdatwW2Zs_tSUdsfDUtTy~HC+bxaC%~t!bW(>t7bRTgBy7h)NXDM0Zs5OhA_c(%!l^68` zPqfkJYvO#FHC%DcsB&B%^oETMLfux;$ooNU;?||RwVG$GkI0PLcS;t}Y4=O1dp@T2 z@~~I=7C0m9tG^QYTPyZg&3bCgRBc|*J4BhrU5HNvSZsK3pZI*)Zz9Y1j;QfskqdYQ znbvln8Pza~k_q8*@t-RHjDT~}&agLbs| zW_f%Adj6skEFGkwoDwN1BdR>FPp$!FJssxppW`4#iheMG z?z9Yj-r6|$?S4QSylS5XHkhq7n2yV;-0v2njbW0J^4AOdE%R|xEnzid%{jhuuu_#5}yNg`G~=81CGq_3^~Sc8AmFxs=SJ9JJ^SW}s_i;xh$jBVu@w z$T+CyN!d~CG_~OrCl~cGQN;Kd`)?luD?1ww?@iHm$!{GFin*qBrUk3{=|^}b&MpjK zyDcZ{v(xnIM-HW%>BI#HVHrYUm9%KrzK`28Ja)a<8JgSsjoEgX-RCOC49eJ^V4!m7 zT?9D`{Q8s3EB)w%Mbr;dnY?Bz-{=glK;qj}g|OFDFRMGwoaVesG)%6)8QWEHG}0s$ zlrGeniqByB%#{kucDnzKBZX(CwY{SKoHmgnV#Mlj*LkgHq{WebdSJe|Qrau|$84PN z9j3Fgy>bohr9=wzK1O5Fw|Bl?a;-vnN!L$=llnRi+l_O@v1Re*s|DYpW{agX=k+%o z@5g2!R=>PF9-Xck-J_E;FVx*)R&jFiOxNZQ=F3Z}#@RjdMYR(;TUcea29gpi zw>!4J+`g^S^xOHlSgr8_QNfupt;!;~RBxMn+8tM>)TqUnjAM_PlOb*s=O^>DX#+lX z8&Mq|if@h6Jo(iVH@MxuhWGHgzO$vOy?5Jci~9SodYQu-3NK_uE)tTcWh}5hr z?v|AWF=j@N#gtaZFMizToR`%Oj5(xN7jNzjY0`?GXk`~7GzBr@QhtViRzdRe1=HQ# zPI;EAC10<*v!0$_a*9U~A%Gt;-ct_~vk)7#cv}yAH5><*)YKRkzYLjd4d0h5cq#XP<5??G}PuRE0~Uxd4ZK&L2frVZrEEtD?BGx&_DS0 zy~6;mF%1n4#3lU9GC0uViUU#L zZK}*A8|i(R8*BnCd&@yC7jrn~C2@`$&Go2NC}4XVG!_2%8UfNL3DZSxDS!x-&X`bu zm|>U_4jvl~e5;0Y-Ud2&(WyNj^%g4g(D`(6hoK!>yrA7P!5>uR5_&p$>1!=XD&M*t zBc2xeg5PR@9QfuiU8Y!c)mf0RRc4wx!9Wy=+6$(QiFKh?yE z6l6q+-Z*6)#uM}s<$stU(yhYSP-l?)Le^O;9h{M(%xEVP-Ww`o$Qrq99Es6>;Y-br zx0zkF8Mz4&VDI_zm>WhS4fY7+a}|rhBrkY#fnrsnx$-W`h4x*wS4KlmE)>-2>nu)8 zwfN>?A=yrKras2BreSyDMwRpr??ySUJQrYx-Le*}yRi6{#D4fo_^f01#1v{74(5(B z@#gZEe^1>TfvQmsfspf=+4a|FHOzf#l6(*i=AH?At~^Etsz-;0NHQZ-LL`Ikq18Jn zYt}w~7yyJPKP4y)gbL|ofXLrZ$qV}OFr8B=$QzQJ9{HUiW12p0aLcCAxV4H*P95T| zvA`!s$xrj_71p>FTyi!}7Yzo(sDr7~5`_VL>?lt`R06)KsJ((Oo|$-q09)b~wT{h_2PIvnUc&MDoQNfdVMv z*~miW6(W(Y{gpttIv-a|)T0Nn^XJGKUn$T?c0Da}+#zJ4jXTOYDVmrJH102fiy?@+ zkVcZxw+rC}hJ6`yXTRQjw0}wOHsr_!zpLgWGSEvOiSTqM;k+yvgSOdonB(fUbY4Eg zFVQTua&0cnxx|&(jK*Vr-ui+QE&S4;Lllafeo(6Y{fgV4l{DDi?`MO$a`LYi44d5j z%UF&Rllo@MLw0+6WZBDhY#JV$0HD`VJv6oEQ!u3TBNPnSsYZJu~X1+y0P~f zrMq6*kx@X)dXIXmZCJP`aIs*Z^;?`CXclJ)lU{mT%ev-Y17|pLAtgf zkkyYui5wECzMaz5Z8m@22{*p9N&mPSWV75ETy=@Gu=S35*->R%wXedHG|)#M3JIyI zoZBpMva-f~gc+n0F(>lKd_R?%wP3Tn)FfP!-cce)T4rM6aHIR{3&Nai+p(_iTuJdS zs&dMudB8SV>{FNZB0^b>%g8jy{Xjy4mAx-yyXop%>2(O#!HHqptu06y_IVo3$XJ?? zQTp;tUH3&EQ=wsP+`jamFgv;`Pp)T@@G5kdMg<|}grJH>y0B)&!kNWl;1O?Svw>aN z&F)1gvBM_=uaJEc*tVPr%BF2H`tSixL*4{=&%0h{LFzQmSjs4x)lb!5L3R~(2gX>B zIKu_2vZ^VY;)Pk^P`w8HDLu+}N!C8;hudE80Uw^Jp5?sF_|nnv{QOdrvQ{$&GaXZ! zdm1a37BIpbgF*j6nEgiAHy>J-#MqAq<6JX#b~bWav)d=@Csxm3MrBflgAh|P&-j@v z_@+Dqb!rCKF6G6il4?A{s0JT#EeTkGDf^UW)}BI2d=E~ZoBj6L4b~c%?lg@;qu`VN z1X&{i+aA}-$DOxPPKIJA9cE`E8fx=7ku{t;A8EETDL3c+^gjsu$A^X%Aec4c8-hXQ z)@v~@t^QnGp}vTBd*p-FReh(+WzLmzA*?wD$Pv^m8ors@u3b(e%&7M=UU@ zUORA!^ay!XADMa0rZ;-*U_*?!(otM?W$z`TAHLt-rEZeg`g^RUoP`ema}zjO))hED3p?gLPbVk zgGL3Cr@AC}eL8Ha&EREPQt7asaqU}9 zFL35XoHcnhzVFP%>qO(>ZM;n9 z+*HG~Y;A~(uhr+0p6*b2Ts3I>^q0QA;k)QUhdrAfSC=c@ zTVku;O=I7%$p8y^*O2$3ry}kkDIs%p_lD<@$!9bgTX+Z3RMt=X{#%HZ@~!NnPv89nV_u@mFgP&SZ*cc&43V$TD^I>#yzWp#6k zD8mKc5SDOS-k|n~@80DuQ(2bd>n2^9OVL}2KFpd$5&g)DOLeRXXBv<7XnC=FW`(vP z4}C876AjDH_x%y?ySXYZZc6i{ynLqy=h0pA*2Sp+H1%?|;I}`GJ<5j*nY>jn>M9YN zX;be{9D3%T<~C2E{P7eUBcN8qh74cMUaeua-xDm)Aa}W`R(Ygh&sKsv?xEYWg;lU- zzx6p&Klh|_FRaqd7(5gBl$E%7_iII_v)AIWvC)vy$=;^J_S({(E0l)fLpZu!f~%A(&j4Ei`JW&=6}@uj7i@4dD$D^UOLm(u6dP_XybKnu$a-E`e%{46z!2dTTu{2 z{=Ti*QW1U|0}_FmwJ5#Xj|r`lefcWW&Rm@7Y_Pqb^0D$9eoNQa(~CIqEOD?v=!G5pFSODp%v@=ddVQb5(iy zXPGAlI;U`}*53>{EQ}m`3r6O<@48wjTCUZ#RHdQClY_o1=MSN4Ra2Ah(TAH&!f%=j zA)dCj_=18l-`YO0=4hziKFwZQ>`&q?5g#v-$QwtYRPsJ6mOvOJ$U7p!ew3HQhn$OwWih>pP-9vlHuW~ALmM+R1cGyG=cY!&*7C;DgMh@$ zD7|a-;G&Iva|&Qf1F?sBNeT@k)}IeoUO#Br71Mkh;_S{9*uEKuyWwL9#g-X#%4Jn8_;8h{;{_g@Dfvey2C+`8vnF zj0K&|FfvdEqoNRNbAZ_ocy_On{Q0yV$|FH;I%d-Eyz%f0B$SmDDrWP(*Dxk@?NF=& zAD$Ku`r|F*O#FFZk&rVl&=jRCF>8Fs{hq0`j6PS8D8f>PY~-2OjVSt)n9WO>*{AaI z%hAkvg1x?n&iD9*?B>di-vX()wY=sDi1^NL|Dth4I#9o>i(`};APZyI-w%!>d{3S4 zIvuoj0k{#7>ic2ATL$olXuIg8IssyHPt#K7iV=4m={4lFT_ z->3WS1(6P`5Xj?+5cM;WqKy7m5<5Frmpdh2U$HUgS%P5vkcKf1)_c>#vy&fKF~-L% zTIMMB2I>YtwhgYS5n~19?YAuMHh}w~*=Nnp7NY0Gl?w0=wt59uqPPOd~ zAG^l8vY?SRt0$sDLcfMCH;0r1bp22s4bLYYyUEE-6O5GR-xCt5&gGQ}*XzeVO+3mg zL8wwfz!EytNI=(A+R;mCll>C$zSg0%{EctT^v}L3E?~RH>Ip^a>FO#6Oj8Xv{G^(% zAtOWP(^f=0W+wBoO8Rb}5H#?H0OQ22ni%3d@nz1uKUL{y>zNMQHi5MI(`Bp6!lwCn~+v?pIU(Kzf#Ohys zU^@c0svkqBhYCb)Brgf4o;GVeDIyz<9~_J}QHQnJ+AG-F7NNAWMaS4U^B!a}Vi)x5K+E|+g!;NOv#e|?D4+tt`}k)$&Q zl;1t!t8O5@@P^K#AQ!faMtfz!WT1pUJHX7N=C^+G>u`Qs)12atI(lA zJ&o%ETU%4ZCwPEMLtw)wu`Kk7L7BeA`vjS)0n}w(JG*9iUC%Lz!)#Ojrevr*FurFV zn;iucZ9Q$I8tzL#0BTr`4MF0D0RzB_BG2yVaFG`os=z8o8^wfX<7To<)W>`xP))&-IeO9%K+5Nj>D&}0ij{t&*zux9GPvLVpy-_3=6v&-z`BwUtyu6Gt92~Jkj~lMa5xlMJ|Fi zimHy5Iy%8ThJ;f?Qgx(9Jotxkzj~ZsHxLB<9QoDr`0nV*im7`%|;ojke!^M&-}6m1oOdn&NJ|IG?vVL zkDtov3TjSoZORuc5WF>zUEF!BU#w46HXN_|XC#HMhCPi|u9n}AOoQSASEBU&%CZF{!%(3wYdV+&2ZyYri)zeyz|8~y~w~-Fb#cnHlmT-`XN>w zKIQ61nGNut#mD`U5{`}y?ZbimE!@%`J>0&W`}v^F%_N^NM%wB5_(9&tM`PI(Oo3~} z@M1(FPM-{GF8I!}##1g*IWsHLZetQq{m*3}#~4Nb&5QVt9RO^U0~k;`nk60m(7XQ} zo(f)u+kb8??FTyC(JP?C9hL>FY+GNB2XKO$tE+?I0ES9Gp=&u=(Q9&#txO~Vjn`7} z8ve5FZC+kpFlLpuT*^)>B(j$LR5`Vv=M);MTCh4)Njet8Okt$!RH)?w6$CVpa1rJ& zqsUxW6<|zi$~WD`cHPTb`hH<5-~2r#1!@4l)pgrD-GK33{b?=!TS1|~;Uy&nB_Jch zJSX5ZM07|`zh84>w{62iL(>njQli_rrG;!I$9SZm5m)L)nrr_p< z`u^^6|3AjeHntlqNMtT5o0u+Qu}hv&g8Ps$dnJ>|(TaF_;DcsqP}SB{A6)`i22UfV=?qPZgZ*eL(Cwoo2glE>Qi}V0vlSS4Ia~+ zjC_Ge)YpWsl&5F8p$Y+O3_5(boqcGHjYI>$TmEi<5+2_B(9~rqshb2(fg}pcM41sJ zJ~ONOP4?a4q~rx%=yRK^buew5j7=I`})=1^n2#%QwHp$^W46 z9|?k3aN!y`_i4Ks|9}sw%bp&Q$-x<(dMyCRX$==Z8e$8>0ZT`?o^nju0_3awbO%gQ zJiS&y&XlI8-S%+o2Vq*#0+KDn_nLOWc!IXFE$tb+81u+aKh=zcJU2M0Yv%Z$(`>B9 z(pSjo&g>Zk)$46Q)p$Mz9iHaBcVqu!bN76f^pxC%XIF=McvG~^sX8JM>c3z27hSKih_2&B=8Ir04-~ z^uX7MU7Vh9X;f1*IX=^20A(flngbjZox*?kAms7K>PsSNOeClVdm6n+l)+II+l}B2 z$`f9(6X2yiH8*ISus0MVFz%#H13W+@*#upg^#^DFui~kw4KeNz)bA+Rl$Faxhxex`1I3AjNcsO9v2JPx~@LhB<^D^zzwXq~Ji|8dm)Mxu_p;d3m-| z0tmb|tLzo|_HuuDPh>nJc`pUc$6zv9K$H?eP0A@_EdV_u0bX%9k2* zNV~E^uFXZh0aX@MtX#eH>3!78IKV8Lv4*%@xVkW!eKFV50k3?hMh_TR=**=NT*{y6 zfB6{@tdr3pPfNQ#Sd?oUauBZL5L=XdESwJ`#9W%Pp?LYzOxcK}ym_=We{Wj_Z7zq5(=e%D}<_^ys7nh&=7Hkhai2p~_w7IqW zJFhQ?^tR~UdW>Iyk$$s*KFk}}?_edZyP_5M+(`do)+P(E{kU9=$~H$dy6xDdl^xu} zS(p=lvD< z71qtY^1vrj&#pqd_>_y#Dr*Ryb-u*L^0Y*DL&_k3LyRG}3sK6Lx4ObgvT+C&;4nTv zx#}=Fxg@?^j!@p<{x$8vaJkY)Cq;Xq_s5q%1RiWI>Zs&7=1Az!a|&SC7Ud2x65Nk> zss%r}qzE=`nLxE3BJuy6Bh?nYHnJRrQNav~#k+GXd98J%0Xt>$ZL;Sb!Ep_J2#fOd zmcBsGvJWUA$U7V4O~U%b?!VfNZ75;AO4t)$8zRdGsI!gVRlw|rdxHMh=$uvKiwL?Dzduv0LfZ$oM=Q5K8RHb3x)$FhX=h+>zX$ zXG;a{2LnL3i-5=&g;Nl<)?sBXS9mXx4GC(A1}RVae7PdJ3ePJ3UXVSMA@+8#b5}!{ zirTO z7>k7n0qNX%${@Hu=jHcKO)>$jDygJI|U5o6m1tRNp~4(P{;PUv#(<;mWs9 z0XrDy=R&ufzqTpBF(}8l$ot8TezkGEic{h>YN>iv=*jlCN`&s5ZIspcBe90az;sfw8kk=kbUh>QT%>B`em}7+1!REuihwYhnorIZB-$dic_BuRAKi zDE%}Gqr}N9A*MRby&w@x_ngu6g}rLeuVX^6-3u)ko~g8N5Svyp<~E?}y(CPZM2JB6 zL-T%KQxMX~N7P%2d=hwq7C?W+&#kQNS@VGh%mMJ;d|RTsL#A_6h`VYdx$Hm!vPOIt zM4yD(C;b)sh;fAdH1Or5cqY*N0k|E5-8P@I2clHJ3DmSxvj>;<7^N~b@HDus-hOb1 z8L~^veFK=BHn0dqop|KIi71i5J@zIX)BaYDw{cJ4-yXs4_Nvzw!v=>6-~h&3YKVV` zY$2+gpx%6{rgn!3MIU7pz-f`n@ZPxKdsr^I0(ibF3-65MM)~z;c;HnE+JSK>3b`l zm=!qZYbQ2fuIzOGWh;Y%s%7^unm{GY7_CUR&Hj^@ZaeuSU$k}y1t;}-3>TBF4hIZV*qS+FvD$p5LSRF?{E9Oxkf-TKRAiB4wDUD`?T-fvE%m zGc4b{Eo;MO#|=ur=G)UrWpZS=%rQ_TYEK7{i?w7i zNb!7;{%4P)?h;coC>b4@W$3t9LXl9}e4R_=^+|sdly{(LEGf$4;=AAb2~E#>3&b4z zn(?-NP+N80#{Ze_^1O`ucT;7?0o78Ji*Hm)F;`N}e())g;40k)eZ}?aUh)LeFf_${ z=WOj9G8B){GHMN=p*qkeoSG3Uni0#Yu?Ph=rs7Jo=uvxW_6q3g>4Pkb;@*sDVR|oe z|7dn!3$2A0#gqqSk3O$@W?_9Iy#UGcdZBcsrRegY?v+_PrjLW^_0cImsqI^R+Vn4T z&we}!B>%C{X#LX*-BD1nyn|Thu5mia4AQ`=bozY+#(2w>{lVt;Z-7|U=ykYE4Shd3 z)2>~4H-82VIN-1-{-)oGNZcN~j}eru+r)ii2{@kY6&Uoukw72|Vgx&hv}*U{ zr+ZbPtuKvF^d>~iFx0O!7L2 z!~4{ea!0>0u*kAq%nuT+LFIqSneL}oGv`K=*8LN(#!YXl8vg`tpHDj2bu!$q#=mJ~ z8s98`8!e5;=`>}2@`tA~Yqm$vCjx1D&XlPykYq5PSt$+FQWxk@gIbaYXI_^6Da&A! z&w@nDeF3HObDZlc+PqCCh}e2EkPk{a*c%kqX#*h}Yx)5~l_uC(SSZMVUa#hj9oaMU zIkpL(d%LtylCj(@`KP9@zWMPyC!k#cw5ghOt}wCcm_M11cR>}m&{jJ^VxNv$EQz9ZIHoF%X!)N*;=@d!%8+gEnci`JVZvn3L=$dfSoppSv z%O`RtNBGDMR|2=qv408Em-V`s$a$YV?AglUhIP@gH~!;`Aeg>Tl}ds6l<+~0Nt45B z$36R2`&vv1LS+86XNQ%f*8;Vc2=DIQ%X1F;g{w(QxZl7CnsCj4+kayQFp(?qo<5w5 zLE^(7&MXH*7%Rjfn+`5Fca(-4H3B>CqX*cmn~rN&D4i|j;S!rJvLb{SM}dFkRrW+8avGROL(M-Uj?H97H32 literal 0 HcmV?d00001 diff --git a/Images/setup-3.png b/Images/setup-3.png index 9c7c1a79b78cfabb5a066392a522bf60e4efac2c..17d528805b2cc96d5d9e729192b5cc6594179cd4 100644 GIT binary patch literal 24837 zcmdSAXF!w7+c!uNIEa9Xf)oLjBK=5}4k}HW0*Z8$-jPlM35voIr1vfoK%_*vKtcqR z79dCqH4*70gql!NHlF|U;oWEV-F^1sez=p|leuT+zUG?wUFA3L9+?@ipXWPIM@PqQ zWca{>j*h{Qc6t59Oe=Z1Gps@Tq7Sw(xJOqvBCtWbIp?8ks!K;#pTb6Z&P2Os4K%a~ zrlaHN`E$|t1$=U)qjSzTdZ23+;fPysde0wPOax*DG*zTt?%5x|kd=P9RMzH&%X*u6 zt2#w--;gVrceQ&+?@RJ)*R;fIwU46yO86LgbD5XYpT=zFlU;boaNu0b>RkNog)+Uy z4P^eV#ygcasuj-#=R3wn^XPnjsj83kG>#FYz=+QcNbQ`3Fmtt+;RvTOYoi?G5$eg& z*#vZO;SN0=-M5Pjm+9zYVq?zH(ftw@rj^|Ni}tQ`9RIC2#;;BWd?19$mLrvXjJ^>- zjYs^vQ+Z#9fsSr2H?AzoalfKBPJ}C&^m2dvEkuHGOr-&^Y8r`~@Zs7tRSiFp0+U`+ zL`t0Qdi43#MJ;ijnRPliWKC9s_rVl}5cKk3wNm8f=u1_r2>Y$CR%V46iR8!yk%j7p z_R}nTBKR;j6l_`Cj3i`ggl;mP%qNFG={)M2b{twGyef>`u~7{h_4TQZMWlO}!{ww@ zemBA-C?eH(-zKNCqt75mO{yPVjOry0El|=Mh*vMKl7r4>?SRh-B3+&GB4{D}H<$R8 zubt_uX+2@{EX8(>OCaD$WE&brCG@Q{Uxhx0gP!m^j^8didC=K(U-={ZLbdoxCq7Bm z@)1jM6g5sIFbz3F)+s(M&0D*n8n*fwq1l;%LTQLcx_J)n0Wk5N#YJBw zkvdHO=)Sm(YG_nMblhgDfZE=xD6dvx`2NaDxL^O>@Eg;D2fsfTs$Xj+T?*}kF26v7 z`RSaKP0s5Suo?7j({IS73^2BY_tq}$Pw>hezUR4=Dyy-@1VP*tld~uA?FGmcW)|{h ztBXqU$MN~qlmP9=!uV{l>XPvsnsRa)#C#ZO{$M{5rlM_06pX|MGzGlxUxA(037i=R zfa1++0du#S$UB<*74|UFEBmOmLMu{C2sXp+O6uu>rU>G0<6}JLuntSL&oikWNzx>YYp2G~7JuZx6T|wm*x@oE_IkJSkbY4u1KJW0|EV zMIh4jDNWPB0O-MxEOuV?F!gCr@*v0IG-#IcrQ#Fg{BDFPDWD zY;}lLar?#g=C46UBSl^*_?gY<@;U#ql`%IbheQsLB@4u6$_b4hf|4+0x}R|4Zk-Xo zzY5$98gYVpF{bZ`D`5O#m_%Fmg*r0X?`f2SM z_`vWy`od!W^v4)T()wHUGEaCUesA-O0N|q-ikoAmBsL}_`p8r@q@$CPV?NN90zKC4 zu6mi2WmETBd&B{S%&NCO=Id_SyYA@U_+CkMReC9ntEct%DUwKD+TYJZLoDuoUec6i zp|tLvk>qI__rS3~uY}WhrCW%FediI`-m#Np1TGMaRD$`gwoD%cdEU|J^zRVIW=&E~ zqs2=Ka0Le~ZjUxPiqmuCay?28kE~NT0h6b0*6SUMgm3zX5C)G98Zb z=&;COBztjsf8oq?i?Ed30g!ejA{UFAA3ZzOuhV$m($PtL7aX+n-Lj=}jfDku6yWFR z6zx>3xt_!|5gq@L;Xvdk{RRMG{iqeIUZ#6+I_R?>1BU~x%qVM!BSOv`Sk}DgF7M{! zaa#>pR52^m`j=E&&?ZD+o#>c1hI+BCz(VKiYhsvxM}XJva%v|$>fz2-$$HtA{y7m~ zbsvl<$Dw+|<<{&kE#g;nf59o`ahseXR_Ll@#^i^W7qaE9p{JfQi3B6p)<(X@p6Ygr zNiAp(Y(mz+iv2}4WHdX&*x{DY59Zfkd`f_Sy(SOYnXnw=T8!KW{<>+bJ^qW^?Y8h+ zDL=;axSH_d97ggQiUS!P&hB50sXvxdZB_F#Hg|?OTUq<-m4i4u_p5zZnk>} zMjZjqahIekkOkwQt}ByHM*;DA%pz28@T{HhDj^^J&HLB0yw1vR8rS?8=ZPTy997Sn zIw!aYYBsQ}bS1MfDlD=%OCblnjNDOK3aCHorXRr9ZaAhpO&7l@+xHDLmTWSOjZysS z5b+GOxA_@6{_E&az(zwle!FLWb4G2!HEg9&-~cGaae~y!?c0@Uv6<4& zk9+-3Dj~Kb8EIK5>t%Ro(8x@GGb+(se|1{_xtdpC|YZ zs-X5k1eKZz*<0JY!-LLi^t$T3Ore53e-*gcI5VUx_z_V{_0+^fJ7mR&FbGFPwQ6h0 zr||QqcBThYT2AUCbLaW1Q5pdXe@U;Z7C@H|vN)ILs{;n}!nJ-r3Tj69ox!8h=)GEw zgiwmV*Osg9eQFi^gx3~4@A#O0L;Zx5DRkkcmdp6T^3fxv)+T0puVdAUQCz3}_x;UI z&-=N!Ck5`*YeK0e<|rg(EmSxv@$U#hpPy`+WU}5G?=~u$?9$@|^|vc-ZoPYSz{{!| z>o#z`O>tk9p00cK*A3i!T5!_dk~crwYaGD@*tCrg@nBgwd*v;mtEtSbH6Od3BY5GMFSoj=rbN3ORDUB}G~ z2^|32IN}A9OI+{i$Um1pe!{LDHFY+K@W(1p6au?cE{Wsh7Ez>c!PSld8DO8?K2?vI zW{zW2X*pYf8j^wT+CS$FbT8%~&bq3Qcty^l5|TXv^xoSyW2a*jj~_-)Ts^)PHeu3f9$ffiw?QaLuCdE=Ik}z6NQ83_Q9DBc|&Ch-buOY{oiz^>L z-b*v)1ASx|vkv-++_syF+tWSUYrU-es7h!zXs|~3w{c(0(brIUc;vc9Z zk5WHr%>wgweo&o)-UxL#O_~ViuSukh+KVRc_zVMfL6dOA3+)KPe?)!jsB;Xb zx|0*J>9GwKb3_?f>5M%`op6>JEDUaGqZI&&ei2lDleON%2H%URLqQrFGJTxqE0>kP zc|)xmuV0F@h*WyifRQqr&*kD!y`ggn&_#JN|uuk3;~_HlO|TCX0QbyaMfFvKkE zJSEr9K625b*!gw^jB%)(1Gs_Fmisj)GRP79n>>M363bgE{6uCLH7GX}a7S>iKhNX7 z83A$KgRh41WGQI7-{|B=R|yhcs;wP#`#3v;)m!*yz(2trrQyckd4)!0+MQT#tR7jQC+ z{mLHU+!tS&xn;fq@OqU0oNN#+%2RT9|4r@vAgDjyN#G<)KuX|1Fkj_JlRYrZK`E69 zt{1+pwGT-SzZaX%%2GP#Lc9)eL{D}+xkfsD#d4}?zr>inq3Xko0jHt&y3fvHJ9%xt zCXQdB*vl&AO?QP|EUN2}`vkkck0c2S1^f8U9;FbHYG9wAe-=7dcwVM@59hWNZ z(7Th^#xP!UxRmwNA`jhOX(#6p)#k3oId3IJr=pZ1{bTdj=jIffWKKKNCfP7T5zWZZ z)!2T!cpfKqIifZBgagc>hG$z_R#GTFxe!;O@Z;2c?9AI!)ih}ivx@pWee#~PXusgt zV)GX`uneJ zwKJZ8=jQwr_E3ZNSy|!COS7oL;#+iI-6}2^($$R0C?CAfn(I)g@4H0z#qVNjjMwy9 zOY*}yDsk+!M@`(NR61u5n!jiHrAs{G7ZunCkv|;npr?6#+ZWD>I7@aZxcCt8yYzHn z%Kyz1{NFf;|9>e?mSH#CnymT$qP{etGSLEme9QM9bS|ryO0{!w_-xZCt6Eii7TfEY z9SXA;r+RTHA=?E-XZA(6YmKWrrL$h>?w`EQ%=R9$MKqWE7THQlxUwJVFco+eGWIOT zzvIS{zFj-z>ra3hy90J5?m?}4YqNCuSc9UtxvTMX^q8ucOMQ)%%3ZMz(?+df_9Unnzt`0Jd}AF1;Rb zdZ{3eq-^97Y^HN+$XA~Eo%`Wf?$>oqFBvzHG>7!3-{tGji49*KrJgd=1EqY!N(3~s zJyhhA%$@}8C8d-V?6^DJrOWkEQ58Pv`R#^Z9``YB&P}tD6dj1TCl65KZ4$rk_dtFC z0vR_l5(#c_BbM`%h}!KZ~gEFB7r$-NUwJ*K4Wz&qS=mu{(m11 zHs^fB3=ngaJ#Tk`d%Xk~))2+NarQ{@OtW}h4byIfZg~O@eXKJUbh0{1L zbIa)+5dydWGHxu+MbL~r34{1!%b?| zN5var9fB1RU>EH|4!Pw>?~f+q1| zvXjlA~%p6kn9Nzg9&0*-%B#F;PZAgEbvf(Y#R+y~ofl_;{lX_;1mka@i#xe}T;bS7S? zvVH2tW-*lSA|}SlKE}R)nF)D#8Sp#<%D#&6%fyk!B;dbTwW_Dm$uo!kGRAM*C@fVEI}@=XmO=yC64zK>X|y~Tv}ft>ZY7S4{vO!&wdoAG~nt$aBw`xdiqx1E@SK6}Q1 zl@TA`o9qUv*^Ab4kpd-T)m#hdGwkV9%x7w=+x_=-20zYef^#L9qM2NpDG9OOLCh)H|mnz5jas zJ{Mzpo__l_acF~5ghusZ1K=xTep}cK0r1fAR?ZmP-v=KZID#)k_Pv8YGRlvsw7qKd zBbE+gkP33_YTtZtsK6`0laVYD08+c&aRYX69}(YC{k)S~;E=ARpn!70!URfUVb?Kl zBJW0`2(G5T>c#EJR12i~^P{&67L5@0QgB0u%^{@yBGPzR)(Wluj-~dVhYdgSmlEp3 zoiVA+bY?#78%KP4@ZVGVQ)dzY{x|5!^W^!ehf{euedolrzcFpg7YM4e2YMaMjxum4 zol~*3=5JtPZ`bWn_Kwmy?La;m5a)rcS7tg^O0aVQLOS9D>X~jx3mppPW0=OrQ>!0# zY%%Re_|NPFyU%a?y#&t}D<{~z^C{DSMRdt1dmtwDzdplX$hKy*7d^m>JUI_IGT}6I zEX*H<%ipW0|Mp zqC_4mg<}=RCu7z*zv$Zc=zGdF&2O-@PQ%C!t-pThICj8T)BY5%Q#?4 z1!aMkGO|9~td}mm7`wAFg6c4|y~esg*HTt6A3HJm;e&O#+EB57)1B(9gY@B*@@G|s zkNMLn0}T!tL70%lzNXTuf8c*}7VYX+!Y5&={1MrU*Nw4bz(cz!{uUwRc1Gg;PUmmjIii;kENuwA9%f>vVq%*Dl5hK@^>*2Gdng z(N{weG8KJ8cBXd&On6dZkFtiiS^A91h4Y-}|4WkQp#=?A{e~8?B`5b1a0BPQ$SfRs zq{1>%+AIzj`tC`5m8q~EFXdW@@$wB(Bk;zLvZ4-!nHE-5VzJdqA+L$mo|nhI3yPd& zWG+eAc%NE-4pS2MV{E;2o~+TrGO#5oIZ?(pQ-Fzn&i?u=t`t<$8KOi3%|8-tt{V#|k&76#h*w=d}j&So^U zpV&znjm)1mB5~~4^LE^+LzMEa+t#=H@697T10NJ~MiCfp9_|8xUiLcqQJ7p=;Yc0{ z-ISew{_Az+hJay6wj_!$-Q1ulUbg`S|2{lWDRp%3Sfo73hRSVc3>9XY26=*zWjE#F>R*-c4;i8RKfUDgNMbn{*)^`ot#HRi3w<{P%PI zuj0hg61Yby_aRHbOOi+GA(%kWS3dk!qdclaHCiO3`=3#KC?54$^hP;#@WPC_7cU30 zV_6_dt4|a8B7UdaQ4CHD*l+DI9aIa2@B%B)hB*U@nbk5?GCtE^gg)h&1*#9R8L~R0 zOaZKW-nN+r&;8o^y^t-va@jFgzID1qQaE%NS3f6`<}^hGLc^4XCWm6zO80ElFhR;% z*HATOCt~)y7c4?;HYw-YhZ7)6yf){@esdo;GFbF(tGnaoqsN!7-zwwuV9`ghFt(^n z5xxM_c3@}tf{>xFTWiuDw~wcFvM)pv+OZRSl=PD&C4jqwxR7Pf!T3^xr+@vac1w=F zY(AZ@kP4X>Li3YpHu{!SLAFV!NclZSc>oixXnm^u@qn@9^G>7mbSp{iJv(1kze5WN zyq&LIu> z)ZC~OT-|;6b)%&bOE-a*U-Spj+F?EOgKSTM6NlF~_N~bAdH1tqCw-mQTe3y?LBpi; zbnJ%U@HW|%pt_h#&?sv4`MT@8AR?{R zhkdSbBl<*m5E8SDE3h&0*td|pDpIoN|D)ig0Y-(8`;rlP9OD||jZtxn4Sr9Ify?uF zuHKz;srKyv_x>wWq{x9O48k08Fl-rY_S??)TT62}J?r{bt#QX>rhB6(?r8CxbEhQM zTe*DFF{kci7D3Gdan-5evK9GFy$Uem>McJrj#|vBH6uQ>ZJC#;9zKbr`cS&an(A;f zYFG(5i=hj454P9^y?AYvV#`qUav7jUIc2yGb*oTUjCSC0=yfk!guBQ4nJf2CJBraw zQ)sCGiixR&_~mqyRkujC08WN)!w>#smjW-Q($Y}^=R|0qEcC3jjFs;HuDIKT0H-1> zgRSUdYVQQ=0Jd=9pB(I|TUfH(gus&tj|YC(_J|F6y~ir06?cF-0Ao&9Z}d~ETc!)` z38(Kr`PpA8efRMbzY{I+%l|*giTzJp9+%aaD@WEZB@#Z~PWaejZ0cf3zp)iSdGPp( z-s3CHxP+Mh{93s}|L#wX+k+Aemudg#JpHww#uumF`2?!fUn|a1-;)Wa)_v>6iPTa6G|e6=2tE^OMxed)DbXtYyUT! z+yIiIh@mXxlpXL{7O)voZwhrrK6H$lEWmE$m>ZK9uG*aOP>P+)+n zV%^l+EG$x;LUp1HJ3EG{Ema8RSNuC269id?vG+$9mqg|D?HM9}+vN+b^i|RU(Th~l zj9w&wDmddr?gyg;XV$3LiNTHdm7O1>$CeY>=O73_WWM@5`(-DP7|&KE#Q$CzWuDWJ zOpFqv?soI_GcnruhNj@RWlm2Gj!hCA9WRp9?<$EO9W zq8!0gO(5aH1byV*(mFAUJggK6JvEM`bT|Kljzcz;0R?^ZJGre6FE&EBbvH3tZmevcA_NhL&M7tf1_^ zg6(%>k%Ku0*HTStkw2(W4?$;pDt{F6lbx;4{%_qiS>$v+XugVZj1296_}!;Kf?@1J zC@#u|8xOjNIqPPVdGA%y_TBiwHEJ7On z@W%^df+E3*IF$oXB2Lu5p0-pM_Ji)BPQ+bN3m}izPB~_z2Lz25-6Ng>pPCpX#7vF`_cS>ZY)%jZY=#KruyS5+?5uOJL+DrnU&h z%*QNiLdahVix&%gTcw4WIK7-~Td@=Qh?pxH5b`ThqmBEYZD>NKW^t5jvRdKVDl-JS zGPohW+;t|D8lOzDCxKEbj z=(q;H_oZTjCK`6b#0E68I1MN!6Ul3d+bjhq8?;C(_B0|jy|PM%)sPH5I161=plxF8$POWQbA;Ds_p-w_RXt&+z zkA8-E=+P|6l(J)`Iu?nD5p>6oiX}}2I~~5-pMsxl5@MQ6H{)0!s-K3LAh^f>c|f)F zyH;#dUnKKJ<$aVe4!Y^%6y>LWoiKl}1%EePH z0BX;E|1G{S0@YPfcqX7;MxQp-TXI_IJVI?KAju6SI4~bo5Fv<=!%}|zvH461^qvvm>o~*h{}J# zpWh$&laNeX_?+LmQu?PkZ_vMzqc!(GL%{!a5EF&gXG>3Dg4I8JE-=IQD=1Sf{fxW)BtoM|D1&HL)j?Iq_ z|0)PrR@ujR{KS`js{Ld`To{=XU-A5c5G0ptSVk`tyFm5c^V>K@Nv>79MXrA-=5%Vm zT_kt2H}4t15qyT;4>>BVc^{2eYC9a`0%(wJN1$rZ=z6iWX53u>DYWhK3B{`dk=HJU zFS;vyCa5ZYov7qcLBt#;iV0uq61uVT;eP1^VwD)MIx&*P$2WDs#dJEJ|BzXsd2X`tS2dPCUnk(jVd z9Ong~+inbVIdJ7Ta(pY;wC)WcwXW7NtNY?TD@#5-;)hSJ6BhGpPR?}JTpERdXWw>Ni%~`SaAmGkZXzJ5US;U;E6IW& z=WPgZAHDBSm^%o_4feLIJ6^L3=BU#SgKq!qCFwO%XQM;9Rq;!@s0k&Y4yk!=-F6uy}1dcNjzAz66_n#n3=X(65 zG$|++WcAz%Ng-Y&BT}b0(k|sJc_V2|xfCJoWNa{()ZP+ZiE>KI0g~SVJNn;^~%!`HNQmeAg*tX0jTH(?E}lmCahG5 z>4-MLQq$R-!zuch-V5p&ibIDWh+oif^((2pLoO?9_?Two6jZOxqXeAwe6v^_CdKYR z_1K>Lr>(ogd`B5-8hQ1eU#Gu`&Z%u33?i-;EPCynV~6&Z2YFh3pLpvmW+sJ{pQ`@hEAl-ffRM?r7Zqhk`9O#w+`E ze-x;3{5g8*ykU_p|L?asN|9S>CF?Ieb{@XBLw%Y{TJne18j(L0_YsQ(aH`6Ehh#O} z8MurG=dL;=f4a4a?(7>e+QJVi8%Fjt$pFYt=KLeqGL=-J2iF1E1x{q5?wR}S_gx<# z$8-yRHkT0OdE)=_QmXQ&{+KJjzRZEm~&zNTURpi(nS)qI#&{zh|M{{f3aP%EpeJB6Uh8~F&z9LI54TR5-! zm2oAwf<0GdB!B0hSV730gX2d~v7vW*;oIZxCr85C{@Fi^4M}y&L(zcCyXH4_zm0p@ z+i6yA1y|zyadK>-JzKr!M7VN?jeNdPr^(}>7N4H8m`GeV^avh4OU^(Q&H66n#z58t zx%A}$odBvPFb$BR8h^UDn%)`K%1j`V0vkW+4ziugKt*OSrgthYau-Mh(|hxsMpJN# zKn+~mxH?8LX2M*BOpF}2IRqx1j+b0XB^liPhz|a8p`~}h@$C04KW*;j>jxt%_n}Os zmU19$BeMQ>9t(KMDWX7744yl->jCKQZk>M322_v>2C07a91-tw5eHlX9h(j0Iw}F{ zY$lWkI)*p=s`aiDEp2$m9XaH%wK6n7yULsD3r!QlfHn!hR4rxpxSVvN=J6X1Y74r^ zi}TvTB{O2c<4AS4)eoK6Z5>^mvFj&?w_>Za;H%z!SXJvG%~0xx7EQX<xwFo#fbSB_mP+&d$*jA5+Y zgQLHAsAqp)yD&Rm9_YGP%t+~6*S6$R%Q<2kYg&VuGDCz%rv(Wq!+Wj(9}~G8)^lsi zUzr60FuYKn0a`av<$7Ji%4Q>gBk z77HByL7ttCnTVY8!;)~Gz2v^G2!axDv8bNsiI2-Hva4a?^d=1*9@Bf(x?OI>GG1x_ z;jV4ZE|!A<=_LzIF@~gw(TEE)+r0F;r;NPt5ilQfY&G>7*xB{!gY{O*d`8+?%2pE| z&4{aCT_3q}-mt~PtJw?q3KkpulUbxgI_)6$hVaI~3-i?&jnkok*w%>4xx(vgAkjw%nY+ z6`JuNPd}jH@fZ=PCrewTC*$Huj|;xNEYS#F%r6;%7j2GnqBfJaz~xr)C0bFH(PkU> zgJWh{mSM8}%~MhY;f5RHA&J8~o~zt(h_Xm+7VGmAGyk6Cw(GyKc#a(Y)FzmnNNh}# ze3&4OnFaOhpKbk=R1HRsg31YpHVC`y+0X51^aERADraw>?)v6|@2Q~rG=sa|SBtAH zXcJEGE5Vh@b_J}46}sS6KRgV$L6X{EC$Fkr4F>A-TLVG16Qh^sImUu*wrUEs0tlws zxwMU*CboQ@?zEXf7u8IYitAopLeNy6nN;t=blqg zm*@wYuJW=wV-(69p&4ZN!|z8IP}nzp|IGP-X680$mA7ZCvw2Vja@M(Wc7<6>EX~mh zT?0+xEi!h8g8Hp<_ha)TDc<-V!f#B6l9xYX>jw<{JYaP#y3FtK4l$rC&n;5F(x>>9 z18b5;j_7=>Vg)=Thy0ZLU)xPE+S3oE$%$0x;_wcaloO7QaO|-Z)2Q3I2AI680fA2o z)ww|>L&PsIiHt8DtZSa;JL2XMRB_6&uFn2AEH4>;UB12MG5vsIkoD(yU$xfO>E02S z(-_yfK+Jgcm#+IjTfnbL@(QG-!rxP8AG$vTt-Tg?b%xV$5%t6e>jDtRS2f?j3Yn|qfoho4*r{3--^EH#xPKJ zRz%nqJTTR!!hW%caNT2B@|+8q-NLcX3Mr6&z56V%!6M|R{+W}rgomKL_;%!xc}9`J zZQ#5~P3Hl}Zd6$BrT+3lI8_xgTD4|4UaC3g)JEV`&X{0nz5kjRk1Uv4N9)8!oU1%%$8R|I=z{m~p`=@XmaKPzT_75SbI3Xs4%lq&K z&IWl_TSF|U{_yMb?H~CkH-ZaDSv$6?j=S$lW}LjJ+^q^>ehXjp-H$#pL*iG~-=WV?O6S~4 z0wR_kevd7_(tJYOa^u^@tTD<6x-gS~1zG9;igZro{(tl+`ToljZSnczPkI$cfsXR2 z+O&x6K$xix&9kH(VmL_rzdz96;?FQfC9Q=ow^7enRZovYj;6s;22<2Z>Z-(_K=Zez zRT1Ino6SyIGEmTdGxb0p(BKHR9c(rym8j_d2|SPIr^FogHSQx3T2fBO+GcLO#3Am~ zsd7gXW3}3>_r}s``;-z{#M)sg8Ct1b;ad6(T~#17XCbu~S~3~- zt+VpB61brV@L1lc5k{kDC|LN1zFs(8qEy!~FLTa8|*W&9lBE z)vi~q{!W)Xd2SRMY7eX@{cLc3VPoTc##Vk7UOzutl}{8A5hSjaKd-W|&u$S)P($** zySk|+xO$!5i;>2#s9lK<^KC4XTkkru(_DX1_1^X9^LNLq)`xF|-j}gNDBGpp(~_AP z4Rqd$NYWQ86aNkRik6y<(2qY6_p9vMP!Ry#-|O6It$GvQTm%hchRzXX4Aorfx`&?x zV> zl?M8nbib@&v#q$f4?q71>Ff0kuen}h%_e%?pOa5B#v-rlU1zDal#Og;{R&LK>?^D$ z>0wvc+8kH3yG?d%27#G=pb*xRG!Ur6XRj1KwD(+=@7}o26AM7v=zek@jjFL%V}%~x zyPR=vp`;W!6n^9D(P(ygh{?kw=eGEiQl{X*qqQ|AXctLwD9<=F8IBuZHKZkH&t;A* z$0)vZ;^gHpbmUBD$GLa%jVe^V1$|TYHP76^{sh(%Z|iGt=eX8MPpnx;cse_k)3K99@K#Js6}yr4RMC_Oih7;y z#+KJuPenBgWC6KZ^yqafmV>2em>Kfuz8imCy5eb%dPAX^@egCMY*oSi=5S>WLvq}m zXO!Zm!IwtyazBUfK$4s)wGr8wOJ&x30>HV<8O~D_U%5!$kWqP6Nj@1?`T*>Ml^kxGPmqRjZB|sm^?wy~ zN5PP=NwWu)Gy`8((-C$4Vo2xhOqDV!x8R+yCVtd`FiGny>bRH zocJ3#Vl5ZZf$5oCCHYMsz$2LlDNU~k=@1uQRx$htGOlbCr#_@jlkI#A1bv0@@UA;Y z_voup#Ne0KX?X(ogI34Xud3_Y&px9IqC^?yFUIQkV16fTWYto)?WqvBV}?C7>}6ka zK)gAP1gxpN%3V+thM-sA4B;f69)=)V6(6kp-W!#}`*vgoJfOZ9u+Bv{-#54z1;*n}?6Hh(ye@$WZQ zj`*N7@hCSn?H_TGs-&L0U(qe4gNDi;{=p)mc@hsN?Jvdie{nRK9x{xhejJ@^dYQu_3Vcvd;!=u!N5WkajL+441(*+;nt9 zDQ&EVc1eHmvO@2_r&jy2nIX+6=!hwKe0D9Z=Ra}W?yJkWUcQpTWH9v<8f=N~BuNI{ z{Wn8t_4T!YLXsai5!XuH?fiem>lkr=7dt!om0WJWb&vNONX}tGwuj)xFDAuccdo6dx7ye_^!gz#+$5xdNG=9bzk$ zm+IOncAYw@Z5;p?O$tL(y+wpdadYJo%3>&nvQ@h=)@1doE>Vtm2xQ|{|@KfNiO^qg?kxwrS8(pY@)?r_PO>DLg2GVAR>m@WYomn^O`M4F5zmt^}+b==$BR19_(hz`&w z#ZT@w)ZvXqUtBh?5DmCz1{F1qB!f$ZXF_g#G;nUZqac2f%NtZp6;rSofGAyq2dp|| z_5!ckJbN~FZKb~SZ@aAIJabu52{^#Gmn&U`tqhrC=6$PR)a?+uJ_K-UWRh5ycati! zj>HU9%M`7={~nCIyc5G89bhcU#@3+t?3%=nM)^!!Z;{4XPtO)M4RA-wX5r~c$Wuwv z@QtvBpX6_GbMISmr)On5J_9Ctrv(+3IWKyt^BKJ0f=j7^TuJJ^Wg|wPg;KXW3(}(Q zK-a#$E>?k&L(77%{LM=5B@nFR&c&C0IbA~92+kEEI$54N8u**)$q#0~;P`96n-MRR zTcImCfx8Oq=#(~92U&YZj+eQNp>~fK+@E+;sCHRQ@AAApcU`rx-hBJ!3bR7C$^2pd zo3^Bx4=e*F9;NFtDJlW%hV99*kH#|eC3cRKLklcwPvCAc?2qpRXwgDiY8vH9)$G7k zxZVL~QC30$1u1T_C@sG0GXxw4h)c<+C$N7KtC=Z@QaA^BDk{obl&z8&cg1v?&k=Tg zXn|AhG}u0QCFdap0Jj2LyD{47)->zaJhQMcxE zJviY%@6Nc|RxoSfIJTE7GC2E7IiaUjQjJeJ9dMCw-@r4XMuh!<8mjpmuJP z=eDZWOXqSW7J)9_Y-*c$WL+h_VN^9Hq#}^2hEyX9$6Om8>z5HwKs~eXGyW0JH(igP z)K{&YtEsZAT4}BqeE4LrP@`y#%NI3kNFyC*A2lb0yEo;R=Q@U}jnCD?a2G+$62*3x z500k+G9HYN!N_xG8vs+e9;?6apV6*chKFaF_n9&_)?V?oyCX;(Q z`4%Wlkko)N;i;Z3rxm*b`SU}hvZ9$zf=|!5Qfq?z?6a-sGvn1Ee!lvQ7J*0pV@B3| z zCm$pJvxVm&+F#)5eDAdq&KtUG;~p?UzA}r*-KMFv<$KlMzM>4~H6^YO*^tybDYqk9 zS1VNw=rd^az`w0$^Aa|YyVG{=tGpZsF$a(Cj~(#w^Q(=KJv@hwUj}b=x5=w$@|Mw8 ziLOL=ufuQA56sIN|A1Ts-2SX`3=QC-ABanbh-AbH7Ccpzt?KGN>|`Ex9Ca&;j z3}n29N3>|@VLfD=mV-zg(k-T;vRARtrXr+f9CanZqJIVQcaTz3UX1H(_xtbNG&AIt zfkV7+J>+2E5IVITJKHY(?!D^9IzWbJ`#x6hz}dA^T4~Li?!vHTfisuw?=ZL+tko_f z%2)T{W6me$*HaJS@N8)w`Sg*i<+&)sPW#5z+%T2^^}~SXeDa+`AIa_evqoUVNZ#D# zurI{6f-g0Aqw*k&dbx}L*_-+bGhPRqR64de_3n-glm_FO*KRvsW*AHQ{f5IgJ(5o0 zxI&1IuJtea4gDL!Hx6`TfCQw3BD|0H8?OWNxu=k-=Fj7|DD4Vgx_ zQ2P28|HBqqJRdZq*g}?RVat&{qcYOb<@%z}K_cx0X>g19)A;}8j6dDoRWaec)@hm> z49m@kQQUGmzz+b55UZSYbS=G6=OEg}Sx%HAn>~=yc&2+4YKXqdCi|I�Cv=Mc+Np zmmDsp{{Dmk81v!kh_R6Y02?)odD+yKMbo&cvAkf$gTXU!`~1YZ%0RnSW9eQ7tI?{@ z(wah9X=v`fMuCjO25q9F6^>Ml@r?+D#uG7>?y<5&&HH~Jf9`brFyv7f7#{~a-=3@2N31wY_$t0y@Z-A z!o&aA15kcU6o?$X8r=xy`Qbb39PyOcL!mquySSP4&?AI;r|9+6@n>^_ zkhkfI=s)OZy;_?f{oMo=H-7d4)A1;?9cSi+v``Z(k2^s~&HpN>rhL8P4H7c(u#vBS zt(_FZPjeUyD<0e3o+1ktI>U(fN+IG&7V~&NZ{z5;jik9+BdrQuyvjlJZG3$m!o?^H?Q z@rKK2G@+*1Vsv#jIRktGle4~WUk#(O0?O4WOg;VaOmymuG>c*UcHiX|l|GHw|D&Dj zjB2Xg(qI768u2dbWJ))U~?2eArQmXL*fW7Bq&azkwCeYCaX=H9Z<{(Z$z}Y)$97&9JV*=DSm+4 zYl!CI#V*oi$vW0a_HibrMYWKw<>N##p@rpakHOYVwI(j+ccmr*u~XJ5fueWoc`Xm~ zsZ+Hzz)aB;OJ+cT4N>R~Y)IA3hU*mcXnp3PF=CDW!5aN#l})z5i4wheKO^P}Ts-`c z;;Car;w1B7dR7s&4CS=j?Lni?IMH)Ys4B3<#OuWy*sEoE#N=?xy-57dws&89tSta% z6O+PXR>|}s^uu;Zc*SO7TlWI>nCZ%2NDN&p0N^-k>z7taTN>Vce(Xe z#d|;}IM03i8=T(=Al}4ln7V4H}Gn(k~CCQQ7*}9*IkgwN_)5EG*0F)g1H{n*h9^;dew+r145Kgj!d6Z zo{6x_?+MB!pe)|-f@ehzfeP`D?$TUg5#poC7nJ!o8SMG5j1SO^sRK2(Le@N2>5N7L zg)C!`z04W&p4zI6sw2Jd`TWz{w~{rP!!!?(K=4$2$D;=v@lN-f6DYBz|ObOTJ9ue(n?_B8lYuL>pZm+YOm*seI;>F<=0W zRYmsAW@xWIH)3jz662tR&&i6dSGdCPT9JU9Ss=_u87BLLhJs?QWBd%N;Ftb*i)n(2IVSS&|dDx!)`Mt47Bm@2@B@Rd6s#2H>dKq7KB_ zGqw)AfA??b-md~%VF_SZF+l5_YfCwUG9c>%MQy}`62lXa;^sX3nSZce)Yrv)^j0VF zrwlOj4VBm~FF@5ej&|?Bss%Gm;xWK>7BpDhl|{s9nuI5!cn0ArAS4nj;o2JzvXyJ` zObOmyJU%gpyetA%*~LT~+4huQoN!k(KW4vBqTmOpO6qpZ35jc(+Ix&xatz9ERcW0_Z_%|)BmO1vyez}g&XV!O}BWO8I~z&cTgr8%#%sA6RW zr9!14ILhcS%bbjf4%u8ecMs3oKmS4_SY;CR66+@E9r-CuPOVnSx~xtUg~%oVO=}7I zjg?`|>cG9#;*_?xLEp7OF3zX7E=9L5oCtd%p6Ye|In2DzyyG_)r4w^@X1pR*?k1P% z-2JC&^D zTdKkdQ47~?fyS%(0!s9dY}kkwiZ^dn0&`t!HpA+)!NUY$ZZwJ|?GH72*xi<_;T-sV|r|NHG^CUX()Z|a6eZ^=Y5b}LfFIDxxp@MrwKqa|9vPJj!{q{)`f zl)Wsx;gg3nFc4uY#UV3NWV;b$Hv`=A^|Y0CV(CO=NYa+=6LS{FI;GV*QgA=1duJ>- z@Kv&nv0V6_!pNhVo|QTlH1h^hg?Uq&xLjmq+INg%M6V)|M!pNL6#!xlM0ovlc0W0{ zcwQ!ma*x(cfK6VnB1(YdA(}<7HMWdtc9grHK@zFKBnPjN-5)e@UYSM-Dg#{yG%jAa zD^YvR=aKs7p?tB2-lx?WlshySI#p^$u_e;2lqx~@$AnU`G{WeG=WJAEYUb3$fzjys zUxbVe+ik?A9bp~nQ@6C9;Wm2I7ge$< zH|IOibjKc-f#^MZ7p4lKSUQ{CIJo&~)J5<%@2P>`VonWs3rZXqc8GpwH6IVj2`HAT z8X4X)GtE`DtP#SnYL7E8AiDQk>uAAk8mBWOQ?|Q)oAb)bjV(JL*5*rM_qjRe|d zI?`ZoX`^g4gGf?_#-vp{0=O5ol5%ZYFKrceJ^&R)syl`UVxjVUpJ~h4GeMpUJBV}V zLSLmnH+vc9Wg~ql!6K(b{&!o9_9&4n{30v=Z-`Ucw&rpom?q8|WJqn-$N2J}*KW%& z%pgiMJjt|l%5(QwAXxiV13lT+;CBvpdur`HKBt4u9dJaBc}P8?1Q$}GX;jbfj9>2E z_vLFZS57+)%iBeQv#N?6UY2O%_EW%-jLe`_6cYOR{YiodJv<9(3HP@^ z$j*i$biP*naUK}&qOxWy!W#n2Io;X$G z;cH9j*Ei}@VRG)o;C?TS;C9MPdATH>oumK}Fd^3KW5vzKWHv*RydG3K6{*|nx}1~_ zP}}Xue9s%;w!PZ&_)^k~W%ClwZ?CC8wQ{A)`Zn;Y1?QtSl)!UPWKqPuAgsd^9!LM{ z^85|~V)C~&E&9*V<9J2s;e3p9Efe(?73tSlOizzEbIr)`Am&U9zsdbrZ=5R{Q%&GX z6vccuEs6ALa#0ZFtGF-Cr9zu&{V85b+J6DZiW0phln9fA3Z%x`m+%A|X9i@jq#-=I z+`cu|ANEVfvX7gqWnL&dEY3dvW@P`zpTikRkt#RvS|@6!`{1yp5uw5YoDhpb9ROh#6UgB~Oc=_di&off&_M!Kac@ZT3`HF)FkELKHaXkSUFSu+Ose-1yWtN%Ptt_6mG33=Y zcm5id(i^rYQ@lc+$P`gRZ^67Q-`E+W%bYE=mZ z>&x4d26x5nGzbr9i4YweY4jqb^<}Rb*)g*Q;Br-uEYTnI@;*Hkv{@Q+%b`EZQ^af& zPYB);y=W;W`jwFdEHLEeS3eEF@i9$3vd-MN)o$6+%~_v17ja&ZP<>ue60Db8yCpMy zXuk>NID`7bZ)~jh5SA0g@*(hy**qX?LzU#hFDT4}uz^y(n&(Vgzww>(YwhF2w~b#S zYC+yV!JUb(KeOBUD&AHcoJ6lsk6+S)9P5(&4udfnvU&=He1mWm7@xR*O|tfi#H;l0 zSL``xc``hWPbU-9)|F_9P1`cyjzL)9&qT}4_beA3Hd^YB^Tu#FxI48Dn@x{&!y_33 z$07S7W9j(lQUvC?oNe4pYlCnPQs}KFZr68SOK&vtFW9QR5%l~Hr$!Tf-I!#(DMfRy zq8#gd2*68*4F#@_+p>voHbx(mH5+h>D*KzX-)%#H`*A!)1Vf)bsp0o zFIO6rtSvady!_q*9e}X5&|iZwMQcN;k_ufH)wDZ#c+)yZzuz%qT`|a#(Cn+jXJUv{ zC~W0LWy+%MZu^+EdFd7CTlN)%^(n@{)W|^5UeIYITs_9$LsN@w;A}wkVN;F9pkcf^ znKankzp1d-y1#LoUWz_6KMh*2=1d2znh)_&^gc@NDCm2x_*)XfX8+>cR4g(?0=lwL z{JmjPurl}~1~bWsv1yf(?n(C|e0_;_Q-97{5wVDrvBpO_E(9z{%g%{TCzdG)h642{qqjuwFnl;b4wLE5i0nR!VRFkw0!YKaZWce3sgB5$;Yd^pt5>uhbkl! z*!k>;2q{`{a_9#dCGf1Xw!W>64#(9iRKBC0Ld+tQr?I;cvlubqDJzbudwX58fmjE$ zHrFjey=+6c7ZuoCf2VAT9dZ|m4#|T@^OWu z)Nh&Q+%5R=Q{h#Q+ z9j~)GwFmCWsDnPa&}2uBMQ`3WZj#VBC`TP+B(%H%p1EN_y9Y>lQp}X+n_X+K6J$B2 z0Nn$&#t}#zm}>p+lXD2r*ey%%byZ$8(At?3%JBtw#PYw()&ZpM5P{!5A_KY}Xlx*` zd@oe&7g9Mq{)tH=aessT-Cgz)D|{1aB<|NW3=dUZ39BU`=LTec~w zhRMe!086%yXcsjF^svRLHf2PWlV7G8N@6fq#O(P-m%JH)g3da_JNK7not0?E!o=&+ z00?d_yh?XTs>b+HtNW*(LO#Gzpg1pB@vElLKk%C5JX16#fsE4G(=6QH{4gouj7OW& z!XV{%HR$Idwe^{!zA1E9Ov}E846pT*1}ApUm0T91EX&M!TofMbinjLR>wznZH z>AaZh>pz_${k;k1^{_SOyrfkMN7BS}HJH8JfY-Q>`E7w~(I5>E zV}@g$`gzP5O7k+e*$DXergttLN)1Oz#)L56eNCe$uKAEYX}eIM%xie|Y=AVx!Xyr- z9+;FDSPp^^y=6Y8JEjm<4^#&{Qes`QqA=GzQc8*Nk=rh7)#KaDq4;l@V{6hRX_I4j zx+?uU_w952Jv9qm8{j5QwV?Sl&*8c_tHsXTkQcJ(HpPxvOD4v`O8jfTKI(NZvUswG z&+;DLqhZWu<8pNE>f$*o^oLZ9C*Wb-q21N8@y+rB+r`{Fz@KGRZ=C0|p;SALZXZ1AhyJAg|m zYdFeR!fwUF3jqlv<>FYQME!D$kFdu}zSCo;j^vKx{ z)9vdhsqvnp{UrN?og`GTq={g?SE=x->*E-p59W|F=QnAC5JV zWjc1y{}r$`CzBk>b7W?K8$4KQI>N=*Z;_;a;d*R=$1It8b3U}$5Ozljcz{AhN%MZ8 Ig4xS|0VtITrvLx| literal 18900 zcmeIacT|(xw>FB~Efxf)LxI=VmNfFF)?e*ph7qQ7thxSVp=QGP;K+QYd3eE8E|UPGRa4i&?2 zV08xgeBM>X*qx4!spaJ7REJB!OFBALN7bkDdao@gWJXv0nfldN_FuZ5&!6YLc=1Di zmVM3E^JI5nvuoGBz6iREekW)oE#XG8PB2kCQ~ZLDa=q%^^`O5Lnf|!>{-&sPcGfp} z3*YDJikG07e-*qZx-wg6iYBtJh|(IVEuBQsQB{OWdfKY}QM~ceXs?BfZ^^c)^J?03 zofsY6x2vrZbadl?VNTJl(W4mY-bj9c(b3h(Lr>HFVzlOd$gaeHS8i^2qNYuZ22p-SR>!FQt#M zw^HNg_Wibx#66GWGHtG`mT|Hyi9rV@3A@Nng^WPzk3fHR4rECq<;edBY!JS(Q5n!w z+`+i`V7o!JQB;oI<2$zTaAvcYiA(O45SxtqY%5i@cZ_hS}YTq8%VHe$Vp4&)@p z{=g3=(Z&VYrO=s!4}Ej@r!~H>%EF!~z)?g}K;W8F9?~+gj%SPh4S$i3i2Ci?>=>DQ zFkP;RJ7tQ{z@@;SU+!(}wVKp`=RZH)CLB!>lx^aD)=Fy=IaW1RHdNj&DzCOF=|c4P zX6G&22lty!9Y5UeS$&2Z&Fw$ac-O-J=De{zPXjfG(0uUAFyl{QQX*rR#&O}hD2eUP zIXkoKrf-^pSPmDJd*$x`{y~^OG~5o{tTYO}t6~<3Ei`-JdcIJu`Y!BV-j#IM> z`Hz16>JN;pmvOBSmy;-CI>t1ySRJ?1uy-~C)~E8F8*Oz|fgwKH4h@A626~L@dSS`B zGr18Btft7xcqW4qJ&awF@b>5^U8bN)%|dCZMY8amIOgihYoySO$O%04ket!mV9B++ zK{gD>9#}8q<@9e!>p{S036pVM*6O~ao&NIbr@tFSC)Tf(5Ijn80@!lP721m-mmNdm zIlw!OlOEJArH;mR6OJ~%m)5StTf(enBql@ ze3s1KGV1#@K7nX7_uHO6)kJGyW}26RHGeYy`aC9oRZi6Go-MTmm0Le^Wr?$}@J?8z z;dL7SVFfW;f7{HsP5~|KzVW>iB?gZQq?;%k5-&qY^?50(ZId0{xwpf0M2u?UQ_j`Q?5$C|n8@v;nW| z7ujpPexW>c_Q2B!Uw#W>DxH4pILZ^0_<1+_{!6I$_A1)ZYWC1+xsKFehqFAGdh_`r zf*A-#d6!6n4RLmstWpxyUiv&Ux?vDVhIB>EU%Stw?qh6vX0xIM_LqMMPz19xx_*&* zR~sKlC+d%kSIE4+y8AP^)9^@`+Ffxrl-2Y~4IyByU3>LQeYe^M;?>Lb-&)eN(#N+j zQ>WamRFSlYdxUfWnvC0KIpf(PI}bMsSL5w@+0}%~>U05%+J&!$`8A^I0>+Uom7+0x zeZjp6wH!S*fuGq@NA!~#;}*GSokQ!)M>a!cgLp__)yDSmLv6~6*egUnRfBQGT7f5= zhqTFH>a~*|8bM*m?F6a4u=5m756eKai*-eZN&C6pZe#fe;b@~l{zG41lvKu-_ z9&aNC_Js>oSxELmlH=DSOm`BF-X~sz=p1;RT0VXB6Ij3k9?^z4#P3>ml1`a_7$$0YSRq-Qoz} z`3RJKv#2$f-6sPE4zdP(&v855@qi+lvAkQIuyfe;C(X?=qb!i+L||M??6v}%Ix*`%ZSy&si50bx=rWujZ?whw3AJ4Y1*Cl|Xa zSeGFLL5ofyPcwWu9zqJM<&#*yar|lbvS&CKl4wt2U*V>E&MYsHe{Ns2VVsSmpA@e#>xx+azGXAGSy|#k>!=y0g`ECiiMUmFzyl3qfnz?0LBR zun0z>QPqqBA*`fMqp>7e9NS6}nN^l`|H6K<=niae=zFkw{IS8%vFT13rmdavaHM*N z+sj{*$4_LJv7l(b!2;c-^IIgagK&2hI#0BoHsL?2(ovwz3Kouw;xrZeI61PCpRdvkAN%eXLW{ z?E8GjaVPrAE9#w@mFj}{-cpvvYI9-C5~je)(VDi*I;b}!;@{Jb(9hkgr#u7pqQijG zWfHP8t;TuVaNuWHwdLL`Lz>TKjeNbGs1{9s{FmID!>Q3S1pylKi+ru+i-D%JqavbK zo#%XKpNvm9LDqftdz`m?`HV)*`r-tkYa5~u7{koRHUD=(wEAXulqHlq9d)G|J^@K){A5kf5Eb3CYpT}w@w=lVy5uhXy zOmD*iIe%xhP>wS&x6~3tpxi(;#!2i%buPM0<7)sEjZXxUTn&YTDa!n6a7Gm6yFH2S zqx%Qg?#&}xw;dir&rQrJan@Fel)4hcmHuyJ-T%Md`rQp`>9deK7woYz=1n1@n`|_6R8_+g-M_s#)%5zo zV!1M7N)-!G`6Lg)c+{Y#(AK^=7Br$=L8UKpu> zgV)t?vPm@@md!3CB;+)hr*Us!&1Y-gD!*}KV04e z*{9Dk&GX?7Ho9P2oRvwk-FN=TydnMq+EwSh>Cs-SPnd_VqDL$klt7( zhYlK<%I=~Vtu(12q^>|4VwY;tqMmrSU!mzWJ+w(FhMOyL#I%qwj)9TJYTXC#rdp!R zNk^K~VN`^6_DlQW9aXyIhpZ_7`Mw(*2$%N7M50uIyM=`X>GLD^S)&Mk>lh(Ltk-I3 zzRK~@;T<8NVj0u+NcQaD{;&XG89K`|!PMbbBco70_l%J2`0w3)B7u$bTsn!rvhEXgTpAT(D_X69qbhGFle;Sw$gLQhM>vbNyu z-SnFy#m3p^quK7?WGfT7@)oo*QkFr#wdi0~^@aFg#4_-3vsbPx^cjsx8Im_uh%r&0 z>q*}fZP;r4?M^E=5Lku33vvFLtWE7BTLr($bsn^Keb^lE=zr7+7%X2d<=uS(mS z&X%+k`fDT%1gTin=y+3quscrgez9>32&|^=%wRJT2$Jwg44xpMY|v6W;z;h1+96Iz;WMzD*dbq^3Hdaf$Kn{dq5vB>)Q2!~U;>W=)VXjZ43mkT`3C~6nt0A6pgzy( zm|ERfa=m{LJcjdf@hrDWVr<{|O9Q%OJMd<J<8-sedl7?G{%Z_9ld}rh)`i9(N}BOtHWt83uUPTS{btD zSF6apZYM?#IaEt2Mau2ZXa7Q7f^5&1KJoWZS=s_gUkZnj+2@~TW|N7P@V4;lDY$pK zEmGNz7M&`LOI2A^*T+tJ0uP15dTJ3%HoY1L569AUJcX_~UrT-R`;#IirPx$MV{ree zft+9X&v2<$Oufa#!K`Eq7sQTY%>eB3jEpi{giE-?(AGx_ONbXqKNd{%YiWrFE6vx! zW5qLtXJ@kvZw=h2V1ut97Ajw_{|+G_Z~8VkDB@S>TMfEH$fZ}jZHMNmq1-Y)1X*^L zWbJ{noLnMvOB_`@g2>zABVNZw{58yNv7zVReD#^n-!4^08b&Htvtn06ui%>9dgD5~Xa!>=5i@ zeNt&p)?2+Leb1ZEK2TZ(Blevee6TiYyhS{ZYDY52`*^B`+m4T80vcSkk9omDGI`-! zG*%N@B?2nYhYDC|)hG^_iC=;iGjT1;cyBX%of8d7#l15VO{`ZhKGcx(laGP+J)`8t z^wm`q*B4Eoxn5LnBo9n06 zDXzybMctfqj}OG!Z-loc?jPY!WUjbUG+D5vz;>B{V#!*0=+cLSb*o$*sZexyILC|B$)RzB?Yy?{>+P2O@5OzeJkMu2u1qw_ zIfVNszt~=u6ja(b+ zR_5`~Df$t(8ya}7z4AuI93%xj{5=FV1SM>1`Povk`pkKiZl!7S)2#UY@z%9V z)8Au<*;xKrN{{9a-@ZTpvSDN+U7)9}={QQ-c7AHr4Y7WfbPUqBadbrba7%f7=bH1u z_LN9{EeLwKQwbA}v14sW=wGgSPqj+dOak>i8!DL5*75?DGaMVnJ>W2~J>UvV7k(iH zI$a4%tF20*s+LI2v$z709P}L5<4hgJ?LPYxB|IzTP~`M@npQH9A>`n=%GK* z)egcs+vm0JEv&{3?qwwl%>rdjvJmwg zbX&~VY@&vnAx3Q%Gg)Y|mG$yMJ`|`Ekss7;0ChHUUl^;cl*qO#6vhByK;>+=HnXE% z(X2H|Mm-ADr>HvQQF*IkE`o9%SpwhSN)D|SSyD~)mLO4Hu3_q<{(D|X;oRDmJmN?wxquO*6K8BiFoplgte^4E zr{s1jcH2d_LGRYvnk7?ZR|Ls4nogPm=$q*P%#j z+P4g5m$90eiPUF~R#hso!5*Glg!PR>o+KUzA@uRL4&^&SybKG4NMTsbfaoLO>6XC% zGQDs7YWZ~z>asdRwqm$AR)=ta-iT1K;T^V&Ikptm$?4bEH6^;{TDk$_YAj@L!@ym6 zg`+GSSyZdTViT3h4$tZ|NcR1iBw^;5_$BLhXW2~*N96~KyKbw5qV^-*R)h@;${!w1 z$h$3MA5MV(you@6xJf>=|@p9lrm&!dH5@6%B*WEKb`yDi*FxqNSb+>zg5c) z+&hpPIs(ACD4(dmx3{-54xt8-X=9ZGhKDx3wABe=bLvKTLYYxQJv9$BQZlhinz;kU z9?SsAb>n_$8jsOj3^R|p3AS!y_ZZ!?IF()$TC9~)2!lFXh?W__BEFuXZGP1%CJU!0 z!2SfoNk`G1Dnk_V&Um$zq^)l$2bx$}EiKJ;9i^eIS6Jcx`X*Z0$Ii&7v_~bjy%i+0 z-*eGdDV(5b;YIe`iIN=8f%#0wUvSpeJf0SiLr?N53$4`H;Dv*O)!@EAgqyeBhl?M9 z$m>0tOUVrtS4b`m+pDqdu73vXkIvmOEJ4YNU?^X6dNp)CKTs5S0_|FGatHAumzUr1 z-~Spf!B4Tfp6>SB!TQ8@Lq>=PS{cKutNYKr9QN5AnGN}^>h=>R%-y@e$y?9vT0>MR zduv+6lvD|ruAAKE&&px8XjsDU1EO=8dCh#TE7X+iHF1cIbjx;JZJE3^Z9)$2*y0N+6g znG}Em#~JgrQ#X&JH2p<3$$)p78{tM#Dft01E&CTi z;wsr#&!fFw0n$~lla*fwS2jH}H#BN8Wixf|Iw>V{$++kyCjJvVo5D|mFU3(Q+Dsa;U%#kH(M%MzbRagqXs%{cZag- zpsj>}NXfHL zxrr%CsK0a6net#Hi?w}RtXg`w%bo0bW*@0dJA0ifWRe{K>^P$x21Brcfi+~oo-|y* z)f{l@XV(5$2gZN8xb3ztrTcWCtThF`UOZ+`nr!FI;8Z7e3*E=;K>@e%F?bj!R!g!t z&_NDNzF0Oiy?!>i6(cp@{{dyg^T9*i5{L)}hc+}b1DFkN;o8aGin<;>y_Eqgn^>cM zjgde{0Ubs;JNsGzN9AarhoSfmJ57Gdep01x{C6S`ga_9T)5zqtHAxE6S9PbvpSS3TF` z3g-&zRC81YEFon63X@x*v#g?L06ek)6kaKukYKG0Kwc~2dG$3G3ofs2@W`0Y(hdd| zC@_$306s+KgOM7Z=Icp@#lwTjF%4p41;KSk`!^<87CH4o>`i^!t`2$gWV#hUh@oK9 zq7ikK?tPi^KAq*J@V&0NV|H(G{ra78nop9CmZdT%>Fyz=@2djZSUlleo$^=f-VUB zrcN{#kripJF0(y@^Vn?;@WHp!%*1SVz>`hwy3?mXVH71Kas1ZMW^TS4+UYteEI<2E zqxZO{iV3!}kxF##+6k;%&6XPx#_)Jg_uo)}?=H_Q zN(dr%Op6xk_J%`Tr+NcrjiaPER>wDE2TU%P9&k&)cHJMX-(OrZDVq^38(8D=iX6B$ zKCx|86J)6fJ$qgCDP;@MM4KFUV-z*tClSZ}?C)UOxHwu7*?_Cs<}R|33fC6CgZT}} zJ!mY?pLQY%1U z-H|vWgcK0!`52d;m2P^^CV@4|KTtBS?7XgT_sPxJ-;P{^mxyg-$_H(1Zl1l!=DJ#M z<5_DzH_rjD=^wA^&t8($J9K~LwK9BkAAazsubz0ZGQ~e%E`g`QdlaHcJcjDo(nig_ z$R!y>FPMNkL$XH-=F1|~<&)!i`|gyf5MjltZ;Qp+rV)n2pOCR?mfK;l`aeOKYM34n z$@=EC0ycCH@lmlBe=vTa^7)2&zjdowLH?V{>qkA7gvnr57XlzT8o_mT6Ps33wg1-CwJDHAW_T5nnx(mR4H% zTf*%SWFbiAbKV)&t-64Ht9elyJx`Y`zA!hbl)CC%R?iOCbF6S0dDCq|dMc;bMQvK~ z$FM0C@iY|n8Mt+1rswuJRUJtwI**EHW?(Lu7;pDKSZakp3FT>lVxk)&o+ zg4}SQ?vPT^NjNeQp5Spoc56Mq)b!;@)uGMs@}pS99Z5k7Cy^tBiK|eFB+qNP;z~>Q zaS9wLACP=?Lm!?p*`k$e<@JGB?&&I4(bBv9RY%|7+SE4xJoy8Gek7vc?OIW`&eXTJ zrvV4UE%K0v?8`rYjVF^fCo{yIl>G-bgF4ZnJ5pXD=QAYDa*Q)v9WPKn%B+9Qkl|eT zmA*u;(}tnfBi5JrH!H|h9!V^Mc)cD7$=pHZch1gRlRV4M^p!-I8jl$JdtA?oFRy3* zS|N-5tb!((aBoi>(Y#9PFGmoVI_o7$m*ehj@b9G@P7Bp#AY(#=XJI$uHO1<_2r=Rm@FB32AbLj7 zgK7FZ8aFD2^{j`)FqDdCWfApl)<|gC2hZoD$mv`@eXiGU-O!6yNh=;NeUqYns^e?? zf5@oM@zE}I_b|gn-DLDvF2-9yNoTzqlOer5hSWAU;mDr%DZvik(wF$JJi0XY8>t;J zooEU1t4Zw?F(M;>>ZeHl7?P8AcJ^9glTE|Q#zuX4y@)}KXxN+6pig30$oC8Vjyr}Y z$5>HZdeeOPfNU0usoJ0lXJNE~9+BfSF^sniMd6vm!6-At+-2RXzAc^nwmU1tQ1PTz zQLpzqVhI`=P++c=?S$cGhsW_1Nv|0IMLVZaIdoV|frE0|8M&ZXPIEt(NQv56&XyLhxec8(K z?+GU`2^|n?CTd>KCfkD-5zbspv#3${R(=1EE=vMktT#f@` z>6c4B0~yP5gyWT?2Pyim<#ZPc*zW%}Kog$ur`biJN=|7!jj-oQb8-amMtg_*azY{C zq|`QXl-5~&iIm+@3DM_FhGc6}TD0BI&q(dIpTC-dJk$GEzG_p1h^ig|=j6HqZ13F1 zc$SoPDWm6a*)^U`5XXQ!v}7OU^{dowCe+(pJ1W&0AYj^V3nu3(QzX&Q`&BoG;ad29 zZ3B!!OR4yolFSmloMqN;9%uaKr?k*FB}P~M<{$_#v@&4co_Xm84Qe{rA4gc&T43kH zDk386yUKK{VV7X~{ga8}81y}C3nEod*8u1Fa0kG)+>ytk3GDY?ys`K?GGS!TTuU}7 zo3G!AMoR{7xsUChUjZM%mxY}f$6Q;YoGtt{dfm$ESHfJdNTIG1|8Mv`A2-x9OBASL zHjXG#ffiMv9L%017%a3FSoOb2Y+_N!)y+s#oEbK4toH6& zEiumx9=SW_eHXRdTS9mVwmeg7-c$e`PRW!hOeTu1IH_K^P-+;#@+&=Kyyz5UCZthy z`+`<~Pf+`cVGT1;0Gt)hk305x_9kTQE* zCMExcSz;qmQJvrsv+R6j?yMA(p-pHJ4O%}ex7)-_fw|tX#<8=Y$bE`X`*(k*l?Co5 zCuRFJMeo1M_y5jy?)FK>eLK8U?aZW!FZu)J#rzmCaNhOapLCBkzt0fh#e09y^*#Py z=;$l9y+q0_xWv;{{?RSe!Rh=B3vF~{=4g{#9zTXEP%#$W@xR#$m&+CW; zp2&-|eK^siT3x;AGR!=s`wH!qXU?1%uJK$N2AWJ0c^Kyr z5l;-$A#G=*v_MIm)0%ddvf`*2@z{qL__8I0Q37k*#o~;-j}fik(t#YNNqcVq9V67) z_`Vz+N`{p7;!lX%^mpLx&U*R%2nwP*8hcCJ7F?k5|iC~;H- z)3}+o`V8oM#Hcj}9FCni1v-cFPo!!>?uAE0kg8o=qJVBE5u&cHzFn~L-a`?o?PZyD z1Q-^dP%I*5SZrh!<&a(#>amD-obUT8Q8<{ZG*sYj{7{xv*u-PKjn(vQnig$qAzMaG zQZimZ3n8E@lSAUi`PWXzsV`I8C>g{-yrpki#i)tL1AQuKs|DJCjW@9GwjC}ucEY#4 zg@=jH0Ik7mEG)#zu^;9*EO$j%nK{ltIIL13$W64$!38BFFg9Ose@Mh$__u{|wsHa* zlkfN&;iijAo4*^<0z4->-v|mJ-ru_GRm+~|jg(=NZ}|(;>vlFI!in)tv*#^>RW^wg zO-PF>)d3fWdYmdcC8Mn+C@MN~FGYZIBc5MlK#Sb%pyirP^d4x%(2p&Ma*{yL8;IpA zFT^ti9V9E$2H`Q{NT6luTtUWq(tc;h78%84LPF(tmEubd}f_nu|!}3Q;?WuDftk$X5$vi2o0O z3*Y`oal4FF?^nRe^;a%)xy7@QQpz;L;0TAmTB*iFFnN1{~7a1O+IAew9(*r-p=^1gBe#jm)@$1Kv~ zvXk^j?5XXO1=`v8xJ8YPbDkJ3rDjygBkBs7mK7m#VIn&F?In`EBGW~hW*%iQYw~;Q zG$tFTLBIRlp4%VnhM*o&qhgZv5k=fQF=h+8v6iO-f3-_27sgkYecK z3qtcWQuC-esFM1sz~dug6!>!WAT}6Pmg9Jni0bO>!~=$Rc(@YGq?=vu4hPsLB%(Ie zrNQ{LlPV7>EB-S=j^PFE%soAjHhxk{*Y)tAObRR9QhEsyOlH_D|_CUu8AEcxq$7hZb&e3JEJ3T=i?hNM7C5d!R z^LQ0<9M@c>>$?d4O6ZXS#N!`r{xb+pyFpjwTFZq0pmXbd6i)G5f^v&MA- z;tpbamD5mRX6CQ8$&kZMCqTa8{X0zHT`V2}2w%p%=R7|+_Gc;nqrZ69VGTHRK2wH2 z)%afe@N9SLYVBP5i(A4P?j6xwpuS~dm7^G9nV_4mIjX=8k_)I~AtajlY%k^pOCKL> z0<5y9DUzt!$6z8#d15kAS0_zTxnod#j{E!1k2e&mkU^KlZ7S`$2ab4ssmte6egm68 ze)a=J%oGFdk1c;SrNp@OnoZ0uQfG|Y=`S@jKoq^WgfXR7;fzH8CRe=4ST52DiIlt z0|4+(-l5B+OV+fXDPU)hTSm~(g==Fd8)dR|Ekpofw@;-Mr3#TDfQ&#fO6vUu1_lcK zQbm_YC9fLUXJ@5kZc(uFo{SKn7Sd&rr4nowk*V6`pu+sT;!wP93^u+Yj58}G+HFKQ zC_U>41aRGf;|>14OS;C!$TN3@h0Sq@65%?f>x8Z((GfH8Vit{iuZEh%yGu-~7stNp z_szTmD<$e?FXoMoW~WJcrieSnF{%#`3<72D*XaQ5LwypTs8-RG!JsAPorJXiz6b1T z$tMReI!&?2aW&}{>=x#R|Nd70tHK~_z+k>RE5JaD(qR0WUka4TlVZM9C`B3}O}z2t zC{sz~2Bv79voJ^=Qoqq&uTVNzYQDMny3b12!UEnAd8Q5wCzQ*F_SL+ay5<7vV|?}M z6^dKGx`QXM&Pm9=XTJX=>v*gx;kWC`Sff|@NngpyXp)Habk=y@1m*H_Ind884C_;grU^RbU&_f1yy( z{!+GBEC_7eE#f!+s`9z@XySUxu)4je=}ej5%pD%TwYMO&pvS3cgF%a(oT!tPW$X!c(m#h>$FScF9T2U3wpMVf4Tn?`*_cGH zrlwX}x6x@-CX|xB5*HNvT8Pw@KHdP@;f76}T2v9Xe{<%3^yvW@INf1k|$$bH|s6$szUf?#g^cfMA{r!-eey3X0i zY}$zH%kVbL3J8$)xC4QdFE^bnj3R7`neQ}|Y>@iH^RA+`>1nBhckHe6`z93r2av09 zj~42B-I+J!ZKn#8D>6B$0sjnGUqeds(DQtmt!_0SEGy(&a3c!u0@5(pFx70z;NCNG z^Bfnf$fDloOnd|?VI!#|lab`KXn*S~x~(cjmE)g5|21s!RW}q~%o`fR=aVF2Zc^p& z6-NOvJ52*h`=3DO;`xQ(J0-<^*GxEm?Cdz8)*94;*Z~r5tuGI?cji$R`tsaiFb%Vv zSQZtZ@44ueE^uZI3_$zTlV5+;D2TJgoRzE4guk&?yi3j?Fhg5A!e%so|Z+bu`U12Jxg;RUs% z^lv1^)}d|k003Ofi!h_HndaNIQ6(GJqwbW}JZWM-na0&RAhY$D^aC^sqvw6PQ@~Q~ z;<&2PiM2D%%UlWp@m1`!11z2Q=DzohK^EeyJ|Hh%g63`Fuj;QVBGqYNy=yD<>`#df)s zKmQqlGdi~vw%PA+_rGcxDz3iTq&e5P)* z#~F}dgfelN03tZF^T>(%lUdKJS7rw~UT1t7usL2=Gfm2tVukZs9rnmkj9^JgVHBV^ zLUo2Uv=$~B1A!%2Gx~}3T*6OQ_R2D}J3jyzX@yXxGrUO06bNFu?~UCEkVgUgI?wof zPO~~3KTz#5k(G5*W-)KV@1)lBjh*)ty?y(kU(I677N7s4F@rze5P{BMO{BKR%-mey z;gV%F^#g#Fdii#YIbkq+paAY{J^|4j&2(v`@kK5vJhvMYw=~;D+rL`ss^Fc=a5C0W z+Zi~7hg)&^kB2suxt89yfDh6H^=lDxF-eNmCnHuO&J)_(NNy80uTvE z`b)qmD!WlUa!0=-M47ZK8S*A=yAl`dZEbS_(;x?PRO5lXn}l{Y)G+9}_v-gkbWtM~ zX$#ceDS0bo*!3%`6g&(F6rIaJQNHBX1Ok@<%0{P~KAqv$?}!Hj8BEfrPlW97EI{B^ zqo@HQ!ArJ3!hrX8WjZ>Mub#eZUu;~dR0Ks)-di%k*kLkghvV}ue6T<;*6?}Wv*dv+ zMFtsl$Qx25-HQ(tp_S=^O9Nz#W?4Ap)l|D+FFp(M>-TSK8Bi?=soCw4lIDAssBx0rm@4jln?bgnPKmF&7e)6MAWz{0aRCkI%~8n zl?pmYq3q}WGUsqC@g!$Ei~5F|jdgt$9t1FrM4T)Ucb|R6IR9Iz1ys&Dg83YP%|HF- z1oNjIyxwEG0Lz^eXZRXG7X*lu7p_UW{(21gAvAqu;+7$3;mGLpMmx% zv4@^%wg8La6CR;&8(FIIX>2h&)DDoB_A%P~y}psA0#%;nu*mu1aj?72r=GaAJgQsd zQdU7~hIhRWC1=BJoLu^kSeEqLJn85Z05QGvBcWU%{XD_6;DQ0{R~yKcfJr4us8?yY z3=J6yC=N1fZ>xD)t{B{qzUR>QS1`5~=*{Ej=e5Z{1-GxaQ?E-4Cxirz-v`RZ=eXId zqW6G%L~_eWQSpxl_+tKy%PWKIzHqz0G*VWbUJJt)XcJAve_1eDb38VGI3;*Fj5GF9w!>|E3uNv)3XB5rBG*t} zUj8AH{E5hqk3P~WKQDz}dfPMg|FRFl; z;?XDWxyiMVAy#E!0-@z70DR_|dpm9bhYvznst$I|Nznn$r+vDu@tr;35={?5pMABS zkjzYFHzdx#u`4~_CJ{JRbv{Mfy8_M=5gzWgEmDi@M_?>TgHgDE#Kc5;X1d1!P5A$2 z)uu-&^EpNL3+H}~MC)XJegZc7y}#inbsA9BNe=s+q64^-|LQPt|9flNYQ9#l`GF4q zvD#DeuHj9(H+BW*+o;VmUG}0zMpJStddPp(j>E96rWWOQu~qnzU8E(zVO}QDz2O`L zo&r#%%z^uk_u>+*?|EQ zXEOK~OL1LY9Z-`1%eQ;9(^$69>SOzoP;Lbv+y$kB9E}pj0?%qg7$9M8I-Sh^;N^FK zeEiP^+yl9+*cKp00_A`UKz^FK)aP1pT>-NG6@W4gyDG5U4-z)1nm>v2N>{%8Ltr+k zv;&*Rn0?^e<*%F3TRtMBY(Brt_ ze0lil*SEKzKF{98p`s!wTcs{!+c~9!YZhnzRpvbd&QmNukhzRvyn*S}GcXXUx*Kp4 z11A$ts=Oxv`_b&#XO#_6C+jU3t08B)l9pD~TAcbPs}K|unKo|yFGY=|=dXPO^?BDS z$8h_oe0@D?n}pmvI;6q&ooZ<-IGcE8vw*#s&c^TS$#yzUUmno(0=xFrRY#-vp*T@F*xQDbNKCa1^LI7>7j2FOa>BmP5UX8aP z$FPejx%Uq$deLFtr~I0Vk%Myqh-i9G@)ss7J$H^+oUf6J0D^z3#x2Y@kcyP9sKa%j z5cAe;*hnbzTWdP&gr|Q6K!Qo365}P(B`>2A%f=(%ECl`y6C=eOh-xbzhP5pX4Dv!f z%1u?49`r|Bdk$YN=>aJLJdkcXh6wP}WxTCQC!w>lgx>61jlykCQYbUeu>U4NeWnA2 znJ=Etc()F!oOe_0G;nuy`%@nkt&y3^o{a^8nej9U%t!cn^cwcKGE@ReaBVunN+?&o zPBQT)vy)s^RevNHS|CqV@5iY^oqzCN)f#*13RdL^DY#O&g|tvaLv zZK-Kd6X4@|E~UdFY6104f@EDE;8lur0>71>J(*1Y>{jry*IJP1`Yb0ZLa)d{c%c|1NQu?r?o3 z-nll8MPcf@xcU?4&9NT+NChvF)R@OH7pK?>V3s3q>;NF>LFbTP?FIK#0dNxwgqV!L zqgoJUxBpbOdr{YQj&mJ<7hNpclD?a2{>%O1#yA*B0@o!Ma8M)V{Ek{M|8r$LVwjxY zE#932B$>Zi?yhUNk%w_wot~9II2$MEo?b+@r31u=XWzz>S!RZm^BBH&B*nh+DS@6ijy?Uajsu2GJS|3G65LM;FLp7zf@4O>u|A;Dau<6Og}+#7NmmI3;^nL0+-Uw>d!#mp@{K~J z>isO+;U7=5o?RuSps|ik;;%F`SQ&wN{mnb6%B+1mt!lq`rX-?1Wq$#|R=w|p8q)gP zt$0nU`=yRAa!c=q-zh!E({Jgw9?WD<8uj>0D03!C%7BG@@GECO0uvlVIS%r3l<%0! zV71QBy#(;;1axIRPUq7kysDEXC)7{T?dJZ2Vj1Z)zbF9PxYE;(|2S6r^B)rQq{7-% zPqN*JfeihNm9*#jyI1!ws8kZ^pdKlpcjr<8=F=Z&FYYApWd5U$PU!L?(a}w_{g-s; zfAdQ_{yVDe|MRZ``Jbo$j|Kk60{>%y|GfqN@4AWPcA!*n@c360{QoB8v?hxk^O)!0 XLl}f^z5%|8iB45f^J(dm7w`Tr!=AKl diff --git a/PEMStoreSSH/ApplicationSettings.cs b/PEMStoreSSH/ApplicationSettings.cs index 0d85c6b..2d1d0b8 100644 --- a/PEMStoreSSH/ApplicationSettings.cs +++ b/PEMStoreSSH/ApplicationSettings.cs @@ -19,6 +19,9 @@ class ApplicationSettings public static string SeparateUploadFilePath { get; set; } public static bool UseNegotiateAuth { get; set; } public static bool UseSCP { get; set; } + public static string DefaultLinuxPermissionsOnStoreCreation { get; set; } + + private const string DEFAULT_LINUX_PERMISSION_SETTING = "600"; public static void Initialize(string currLocation) { @@ -40,6 +43,7 @@ public static void Initialize(string currLocation) SeparateUploadFilePath = AddTrailingSlash(jsonContents.SeparateUploadFilePath.Value); UseNegotiateAuth = jsonContents.UseNegotiateAuth.Value.Equals("Y", System.StringComparison.OrdinalIgnoreCase); UseSCP = jsonContents.UseSCP == null || !jsonContents.UseSCP.Value.Equals("Y", System.StringComparison.OrdinalIgnoreCase) ? false : true; + DefaultLinuxPermissionsOnStoreCreation = jsonContents.DefaultLinuxPermissionsOnStoreCreation == null ? DEFAULT_LINUX_PERMISSION_SETTING : jsonContents.DefaultLinuxPermissionsOnStoreCreation.Value; } private static string AddTrailingSlash(string path) diff --git a/PEMStoreSSH/Management.cs b/PEMStoreSSH/Management.cs index 0725e2d..a3f212d 100644 --- a/PEMStoreSSH/Management.cs +++ b/PEMStoreSSH/Management.cs @@ -39,7 +39,11 @@ public JobResult ProcessJob(ManagementJobConfiguration config) { throw new PEMException("Certificate store is set has having a separate private key but no private key path is specified in the store definition."); } - + + string linuxFilePermissions = properties.linuxFilePermissionsOnStoreCreation == null || string.IsNullOrEmpty(properties.linuxFilePermissionsOnStoreCreation.Value) ? + ApplicationSettings.DefaultLinuxPermissionsOnStoreCreation : + properties.linuxFilePermissionsOnStoreCreation.Value; + PEMStore pemStore = new PEMStore ( certStore.ClientMachine, @@ -67,9 +71,9 @@ public JobResult ProcessJob(ManagementJobConfiguration config) if (ApplicationSettings.CreateStoreOnAddIfMissing && !storeExists) { - pemStore.CreateEmptyStoreFile(certStore.StorePath); + pemStore.CreateEmptyStoreFile(certStore.StorePath, linuxFilePermissions); if (hasSeparatePrivateKey && privateKeyPath != null) - pemStore.CreateEmptyStoreFile(privateKeyPath); + pemStore.CreateEmptyStoreFile(privateKeyPath, linuxFilePermissions); } if (!ApplicationSettings.CreateStoreOnAddIfMissing && !storeExists) @@ -95,7 +99,7 @@ public JobResult ProcessJob(ManagementJobConfiguration config) throw new PEMException($"Certificate store {certStore.StorePath} does not exist."); } - pemStore.RemoveCertificate(jobCert.Alias); + pemStore.RemoveCertificate(jobCert.Alias, linuxFilePermissions); break; @@ -105,10 +109,10 @@ public JobResult ProcessJob(ManagementJobConfiguration config) throw new PEMException($"Certificate store {certStore.StorePath} already exists and cannot be created."); } - pemStore.CreateEmptyStoreFile(certStore.StorePath); + pemStore.CreateEmptyStoreFile(certStore.StorePath, linuxFilePermissions); if (hasSeparatePrivateKey && privateKeyPath != null) { - pemStore.CreateEmptyStoreFile(privateKeyPath); + pemStore.CreateEmptyStoreFile(privateKeyPath, linuxFilePermissions); } break; diff --git a/PEMStoreSSH/PEMStore.cs b/PEMStoreSSH/PEMStore.cs index 2918fc0..922ccea 100644 --- a/PEMStoreSSH/PEMStore.cs +++ b/PEMStoreSSH/PEMStore.cs @@ -137,7 +137,7 @@ internal X509Certificate2Collection GetCertificates(string storePassword, out bo } } - internal void RemoveCertificate(string alias) + internal void RemoveCertificate(string alias, string linuxFilePermissions) { try { @@ -159,7 +159,7 @@ internal void RemoveCertificate(string alias) { mutex.WaitOne(); SSH.RemoveCertificateFile(PrivateKeyPath); - SSH.CreateEmptyStoreFile(PrivateKeyPath); + SSH.CreateEmptyStoreFile(PrivateKeyPath, linuxFilePermissions); } catch (Exception ex) { @@ -196,9 +196,9 @@ internal bool IsValidStore(string path) return CertificateHandler.IsValidStore(path, ServerType, SSH); } - internal void CreateEmptyStoreFile(string path) + internal void CreateEmptyStoreFile(string path, string linuxFilePermissions) { - SSH.CreateEmptyStoreFile(path); + SSH.CreateEmptyStoreFile(path, linuxFilePermissions); } internal bool IsStorePathValid(string path) diff --git a/PEMStoreSSH/RemoteHandlers/BaseRemoteHandler.cs b/PEMStoreSSH/RemoteHandlers/BaseRemoteHandler.cs index 4d5d02d..602f61b 100644 --- a/PEMStoreSSH/RemoteHandlers/BaseRemoteHandler.cs +++ b/PEMStoreSSH/RemoteHandlers/BaseRemoteHandler.cs @@ -33,7 +33,7 @@ public BaseRemoteHandler() public abstract void RemoveCertificateFile(string path); - public abstract void CreateEmptyStoreFile(string path); + public abstract void CreateEmptyStoreFile(string path, string linuxFilePermissions); } } diff --git a/PEMStoreSSH/RemoteHandlers/IRemoteHandler.cs b/PEMStoreSSH/RemoteHandlers/IRemoteHandler.cs index 7d8fb4f..81d4b97 100644 --- a/PEMStoreSSH/RemoteHandlers/IRemoteHandler.cs +++ b/PEMStoreSSH/RemoteHandlers/IRemoteHandler.cs @@ -23,6 +23,6 @@ interface IRemoteHandler void RemoveCertificateFile(string path); - void CreateEmptyStoreFile(string path); + void CreateEmptyStoreFile(string path, string linuxFilePermissions); } } diff --git a/PEMStoreSSH/RemoteHandlers/SSHHandler.cs b/PEMStoreSSH/RemoteHandlers/SSHHandler.cs index 7cdc2ed..0700a86 100644 --- a/PEMStoreSSH/RemoteHandlers/SSHHandler.cs +++ b/PEMStoreSSH/RemoteHandlers/SSHHandler.cs @@ -10,12 +10,15 @@ using System; using System.Collections.Generic; using System.IO; +using System.Text.RegularExpressions; using System.Text; namespace Keyfactor.Extensions.Orchestrator.PEMStoreSSH.RemoteHandlers { class SSHHandler : BaseRemoteHandler { + private const string LINUX_PERMISSION_REGEXP = "^[0-7]{3}$"; + private ConnectionInfo Connection { get; set; } internal SSHHandler(string server, string serverLogin, string serverPassword) @@ -79,7 +82,7 @@ public override string RunCommand(string commandText, object[] arguments, bool w _logger.LogDebug($"RunCommand: {displayCommand}"); command.Execute(); _logger.LogDebug($"SSH Results: {displayCommand}::: {command.Result}::: {command.Error}"); - return command.Result; + return commandText.StartsWith("ls ", StringComparison.OrdinalIgnoreCase) && string.IsNullOrEmpty(command.Result) && !string.IsNullOrEmpty(command.Error) ? command.Error : command.Result; } } finally @@ -247,9 +250,10 @@ public override void RemoveCertificateFile(string path) RunCommand($"rm {path}", null, ApplicationSettings.UseSudo, null); } - public override void CreateEmptyStoreFile(string path) + public override void CreateEmptyStoreFile(string path, string linuxFilePermissions) { - RunCommand($"touch {path}", null, ApplicationSettings.UseSudo, null); + AreLinuxPermissionsValid(linuxFilePermissions); + RunCommand($"install -m {linuxFilePermissions} /dev/null {path}", null, false, null); // modify file owner if cert store file was created with sudo if (ApplicationSettings.UseSudo) @@ -258,6 +262,13 @@ public override void CreateEmptyStoreFile(string path) } } + public static void AreLinuxPermissionsValid(string permissions) + { + Regex regex = new Regex(LINUX_PERMISSION_REGEXP); + if (!regex.IsMatch(permissions)) + throw new PEMException($"Invalid format for Linux file permissions. This value must be exactly 3 digits long with each digit between 0-7 but found {permissions} instead."); + } + private string ReplaceSpacesWithLF(string privateKey) { return privateKey.Replace(" RSA PRIVATE ", "^^^").Replace(" ", System.Environment.NewLine).Replace("^^^", " RSA PRIVATE "); diff --git a/PEMStoreSSH/RemoteHandlers/WinRMHandler.cs b/PEMStoreSSH/RemoteHandlers/WinRMHandler.cs index e6d7950..9c3dd90 100644 --- a/PEMStoreSSH/RemoteHandlers/WinRMHandler.cs +++ b/PEMStoreSSH/RemoteHandlers/WinRMHandler.cs @@ -10,12 +10,15 @@ using System.Collections.Generic; using System.Management.Automation; using System.Management.Automation.Runspaces; +using System.Net; using System.Text; namespace Keyfactor.Extensions.Orchestrator.PEMStoreSSH.RemoteHandlers { class WinRMHandler : BaseRemoteHandler { + WSManConnectionInfo connectionInfo { get; set; } + internal WinRMHandler(string server, string serverLogin, string serverPassword) { if (string.IsNullOrEmpty(server)) @@ -24,6 +27,11 @@ internal WinRMHandler(string server, string serverLogin, string serverPassword) } Server = server; + connectionInfo = new WSManConnectionInfo(new System.Uri($"{Server}/wsman")); + if (!string.IsNullOrEmpty(serverLogin)) + { + connectionInfo.Credential = new PSCredential(serverLogin, new NetworkCredential(serverLogin, serverPassword).SecurePassword); + } } public override string RunCommand(string commandText, object[] parameters, bool withSudo, string[] passwordsToMaskInLog) @@ -32,7 +40,6 @@ public override string RunCommand(string commandText, object[] parameters, bool try { - WSManConnectionInfo connectionInfo = new WSManConnectionInfo(new System.Uri($"{Server}/wsman")); if (ApplicationSettings.UseNegotiateAuth) { connectionInfo.AuthenticationMechanism = AuthenticationMechanism.Negotiate; @@ -146,7 +153,7 @@ public override void RemoveCertificateFile(string path) RunCommand($@"rm ""{path}""", null, false, null); } - public override void CreateEmptyStoreFile(string path) + public override void CreateEmptyStoreFile(string path, string linuxFilePermissions) { RunCommand($@"Out-File -FilePath ""{path}""", null, false, null); } diff --git a/PEMStoreSSH/config.json b/PEMStoreSSH/config.json index 6b77ffb..407f6dd 100644 --- a/PEMStoreSSH/config.json +++ b/PEMStoreSSH/config.json @@ -4,5 +4,6 @@ "UseSeparateUploadFilePath": "N", "SeparateUploadFilePath": "/path/to/upload/folder/", "UseNegotiateAuth": "N", - "UseSCP": "N" + "UseSCP": "N", + "DefaultLinuxPermissionsOnStoreCreation": "600" } diff --git a/README.md b/README.md index 182daf2..3de0a6c 100644 --- a/README.md +++ b/README.md @@ -61,8 +61,10 @@ In Keyfactor Command create a new Certificate Store Type similar to the one belo - **Private Keys** – Optional (a certificate in a PEM/PKCS12 Keystore may or may not contain a private key) - **PFX Password Style** – Select Custom. - **Job Types** – Discovery, Inventory, Add, and Remove are the 3 job types implemented by this Orchestrator -- **Parameters** – Three custom parameters are used for this store type. They are: +- **Parameters** – Five custom parameters are used for this store type. They are: + ![](Images/setup-3.png) + - **Type (Name MUST be "type"):** ![](Images/custom-field-1.png) @@ -79,6 +81,9 @@ In Keyfactor Command create a new Certificate Store Type similar to the one belo ![](Images/custom-field-4.png) + - **Linux File Permissions on Store Creation (Name MUST be "linuxFilePermissionsOnStoreCreation"):** - Optional parameter. Overrides the optional config.json DefaultLinuxPermissionsOnStoreCreation setting (see section 4 below) for a specific certificate store. This value will set the file permissions (Linux only) of a new certificate store created via a Management-Create job. If this parameter is not added or added but not set, the permissions used will be derived from the DefaultLinuxPermissionsOnStoreCreation setting. +![](Images/custom-field-5.png) + **2. Register the PEM_PKCS12 Orchestrator with Keyfactor** @@ -100,13 +105,14 @@ If you choose to manually create a PEM_PKCS12 store In Keyfactor Command rather - PAM provider information to pass the UserId/Password or UserId/SSH private key credentials - When setting up a Windows server, the format of the machine name must be – [http://_ServerName_:5985](http://ServerName:5985/), where "5985" is the WinRM port number. 5985 is the standard, but if your organization uses a different, use that. The credentials used will be the Keyfactor Command service account. Because of this, for Windows orchestrated servers, setting an additional set of credentials is not necessary. **However, it is required that the *Change Credentials* link still be clicked on and the resulting dialog closed by clicking OK.** + When setting up a Windows server, the format of the machine name must be – http://ServerName:5985, where "5985" is the WinRM port number. 5985 is the standard, but if your organization uses a different port, use that. The Keyfactor Command service account will be used if the credentials are left blank. **However, if you choose to not enter credentials and use the Keyfactor Command service account, it is required that the *Change Credentials* link still be clicked on and the resulting dialog closed by clicking OK.** - **Store Path** – Required. The FULL PATH and file name of the PEM/PKCS12 store being managed. File paths on Linux servers will always begin with a "/". Windows servers will always begin with the drive letter, colon, and backslash, such as "c:\\". Valid characters for Linux store paths include any alphanumeric character, space, forward slash, hyphen, underscore, and period. For Windows servers, the aforementioned characters as well as a colon and backslash. - **Type** – Select either PEM or PKCS12 - **Separate Private Key File** – Check if the store has a separate private key file. - **Path to Private Key File** – If Separate Private Key File is checked, enter the FULL PATH to the private key file. File paths on Linux servers will always begin with a "/". Windows servers will always begin with the drive letter, colon, and backslash, such as "c:". - **Orchestrator** – Select the orchestrator you wish to use to manage this store -- **Store Password** – Set the store password or set no password after clicking the supplied button. If a store password is entered, this value will be used when encrypting private keys that get written to the certificate store during certificate add operations. Selecting "No Password" will cause an unencrypted private key to be saved during add operations. +- **Store Password** – Required. Set the store password or set no password after clicking the supplied button. If a store password is entered, this value will be used when encrypting private keys that get written to the certificate store during certificate add operations. Selecting "No Password" will cause an unencrypted private key to be saved during add operations. +- **Linux File Permissions on Store Creation** - Optional (Linux only). Set the Linux file permissions you wish to be set when creating a new physical certificate store via checking Create Certificate Store above. This value must be 3 digits all betwwen 0-7. - **Inventory Schedule** – Set a schedule for running Inventory jobs or none, if you choose not to schedule Inventory at this time. **3b. (Optional) Schedule a PEM_PKCS12 Discovery Job** @@ -127,7 +133,7 @@ First, in Keyfactor Command navigate to Certificate Locations =\> Certificate St - PAM provider information to pass the UserId/Password or UserId/SSH private key credentials - When setting up a Windows server, the format of the machine name must be – [http://_ServerName_:5985](http://ServerName:5985/), where "5985" is the WinRM port number. 5985 is the standard, but if your organization uses a different, use that. The credentials used will be the Keyfactor Command service account. Because of this, for Windows orchestrated servers, setting an additional set of credentials is not necessary. **However, it is required that the *Change Credentials* link still be clicked on and the resulting dialog closed by clicking OK.** + When setting up a Windows server, the format of the machine name must be – http://ServerName:5985, where "5985" is the WinRM port number. 5985 is the standard, but if your organization uses a different port, use that. The Keyfactor Command service account will be used if the credentials are left blank. **However, if you choose to not enter credentials and use the Keyfactor Command service account, it is required that the *Change Credentials* link still be clicked on and the resulting dialog closed by clicking OK.** - **When** – Required. The date and time when you would like this to execute. - **Directories to search** – Required. A comma delimited list of the FULL PATHs and file names where you would like to recursively search for PEM/PKCS12 stores. File paths on Linux servers will always begin with a "/". Windows servers will always begin with the drive letter, colon, and backslash, such as "c:\\". Entering the string "fullscan" when Discovering against a Windows server will automatically do a recursive search on ALL local drives on the server. - **Directories to ignore** – Optional. A comma delimited list of the FULL PATHs that should be recursively ignored when searching for PEM/PKCS12 stores. Linux file paths will always begin with a "/". Windows servers will always begin with the drive letter, colon, and backslash, such as "c:\\". @@ -150,7 +156,8 @@ The PEM_PKCS12 Orchestrator uses a JSON config file: "UseSeparateUploadFilePath": "N", "SeparateUploadFilePath": "/path/to/upload/folder/", "UseNegotiateAuth": "N", -"UseSCP": "N" +"UseSCP": "N", +"DefaultLinuxPermissionsOnStoreCreation": "600" } **UseSudo** - Y/N - Determines whether to prefix certain Linux command with "sudo". This can be very helpful in ensuring that the user id running commands ssh uses "least permissions necessary" to process each task. Setting this value to "Y" will prefix all Linux commands with "sudo" with the expectation that the command being executed on the orchestrated Linux server will look in the sudoers file to determine whether the logged in ID has elevated permissions for that specific command. For orchestrated Windows servers, this setting has no effect. Setting this value to "N" will result in "sudo" not being added to Linux commands. @@ -158,7 +165,8 @@ The PEM_PKCS12 Orchestrator uses a JSON config file: **UseSeparateUploadFilePath** (Linux only) – When adding a certificate to a PEM or PKCS12 store, the PEM_PKCS12 Orchestrator must upload the certificate being deployed to the server where the certificate store resides. Setting this value to "Y" looks to the next setting, SeparateUploadFilePath, to determine where this file should be uploaded. Set this value to "N" to use the same path where the certificate store being managed resides. **SeparateUploadFilePath** (Linux only) – Only used when UseSeparateUploadFilePath is set to "Y". Set this to the path you wish to use as the location to upload and later remove PEM/PKCS12 certificate store data before being moved to the final destination. **UseNegotiateAuth** (Windows only) – Y/N - Determines if WinRM should use Negotiate (Y) when connecting to the remote server. -**UseSCP** (Optional, Linux only) - Y/N - Detemines if SCP (Y) or SFTP (N) should be used in uploading certificate files during Management-Add jobs. +**UseSCP** (Optional, Linux only) - Y/N - Detemines if SCP (Y) or SFTP (N) should be used in uploading certificate files during Management-Add jobs. +**DefaultLinuxPermissionsOnStoreCreation** (Linux only) - Optional. Value must be 3 digits all between 0-7. The Linux file permissions that will be set on a new certificate store created via a Management Create job. This value will be used for all certificate stores managed by this orchestrator instance unless overridden by the optional "Linux File Permissions on Store Creation" custom parameter setting on a specific certificate store. If "Linux File Permissions on Store Creation" and DefaultLinuxPermissionsOnStoreCreation are not set, a default permission of 600 will be used. *** diff --git a/README.md.tpl b/README.md.tpl index aec0cde..4a690bd 100644 --- a/README.md.tpl +++ b/README.md.tpl @@ -61,8 +61,10 @@ In Keyfactor Command create a new Certificate Store Type similar to the one belo - **Private Keys** – Optional (a certificate in a PEM/PKCS12 Keystore may or may not contain a private key) - **PFX Password Style** – Select Custom. - **Job Types** – Discovery, Inventory, Add, and Remove are the 3 job types implemented by this Orchestrator -- **Parameters** – Three custom parameters are used for this store type. They are: +- **Parameters** – Five custom parameters are used for this store type. They are: + ![](Images/setup-3.png) + - **Type (Name MUST be "type"):** ![](Images/custom-field-1.png) @@ -79,6 +81,9 @@ In Keyfactor Command create a new Certificate Store Type similar to the one belo ![](Images/custom-field-4.png) + - **Linux File Permissions on Store Creation (Name MUST be "linuxFilePermissionsOnStoreCreation"):** - Optional parameter. Overrides the optional config.json DefaultLinuxPermissionsOnStoreCreation setting (see section 4 below) for a specific certificate store. This value will set the file permissions (Linux only) of a new certificate store created via a Management-Create job. If this parameter is not added or added but not set, the permissions used will be derived from the DefaultLinuxPermissionsOnStoreCreation setting. +![](Images/custom-field-5.png) + **2. Register the PEM_PKCS12 Orchestrator with Keyfactor** @@ -100,13 +105,14 @@ If you choose to manually create a PEM_PKCS12 store In Keyfactor Command rather - PAM provider information to pass the UserId/Password or UserId/SSH private key credentials - When setting up a Windows server, the format of the machine name must be – [http://_ServerName_:5985](http://ServerName:5985/), where "5985" is the WinRM port number. 5985 is the standard, but if your organization uses a different, use that. The credentials used will be the Keyfactor Command service account. Because of this, for Windows orchestrated servers, setting an additional set of credentials is not necessary. **However, it is required that the *Change Credentials* link still be clicked on and the resulting dialog closed by clicking OK.** + When setting up a Windows server, the format of the machine name must be – http://ServerName:5985, where "5985" is the WinRM port number. 5985 is the standard, but if your organization uses a different port, use that. The Keyfactor Command service account will be used if the credentials are left blank. **However, if you choose to not enter credentials and use the Keyfactor Command service account, it is required that the *Change Credentials* link still be clicked on and the resulting dialog closed by clicking OK.** - **Store Path** – Required. The FULL PATH and file name of the PEM/PKCS12 store being managed. File paths on Linux servers will always begin with a "/". Windows servers will always begin with the drive letter, colon, and backslash, such as "c:\\". Valid characters for Linux store paths include any alphanumeric character, space, forward slash, hyphen, underscore, and period. For Windows servers, the aforementioned characters as well as a colon and backslash. - **Type** – Select either PEM or PKCS12 - **Separate Private Key File** – Check if the store has a separate private key file. - **Path to Private Key File** – If Separate Private Key File is checked, enter the FULL PATH to the private key file. File paths on Linux servers will always begin with a "/". Windows servers will always begin with the drive letter, colon, and backslash, such as "c:". - **Orchestrator** – Select the orchestrator you wish to use to manage this store -- **Store Password** – Set the store password or set no password after clicking the supplied button. If a store password is entered, this value will be used when encrypting private keys that get written to the certificate store during certificate add operations. Selecting "No Password" will cause an unencrypted private key to be saved during add operations. +- **Store Password** – Required. Set the store password or set no password after clicking the supplied button. If a store password is entered, this value will be used when encrypting private keys that get written to the certificate store during certificate add operations. Selecting "No Password" will cause an unencrypted private key to be saved during add operations. +- **Linux File Permissions on Store Creation** - Optional (Linux only). Set the Linux file permissions you wish to be set when creating a new physical certificate store via checking Create Certificate Store above. This value must be 3 digits all betwwen 0-7. - **Inventory Schedule** – Set a schedule for running Inventory jobs or none, if you choose not to schedule Inventory at this time. **3b. (Optional) Schedule a PEM_PKCS12 Discovery Job** @@ -127,7 +133,7 @@ First, in Keyfactor Command navigate to Certificate Locations =\> Certificate St - PAM provider information to pass the UserId/Password or UserId/SSH private key credentials - When setting up a Windows server, the format of the machine name must be – [http://_ServerName_:5985](http://ServerName:5985/), where "5985" is the WinRM port number. 5985 is the standard, but if your organization uses a different, use that. The credentials used will be the Keyfactor Command service account. Because of this, for Windows orchestrated servers, setting an additional set of credentials is not necessary. **However, it is required that the *Change Credentials* link still be clicked on and the resulting dialog closed by clicking OK.** + When setting up a Windows server, the format of the machine name must be – http://ServerName:5985, where "5985" is the WinRM port number. 5985 is the standard, but if your organization uses a different port, use that. The Keyfactor Command service account will be used if the credentials are left blank. **However, if you choose to not enter credentials and use the Keyfactor Command service account, it is required that the *Change Credentials* link still be clicked on and the resulting dialog closed by clicking OK.** - **When** – Required. The date and time when you would like this to execute. - **Directories to search** – Required. A comma delimited list of the FULL PATHs and file names where you would like to recursively search for PEM/PKCS12 stores. File paths on Linux servers will always begin with a "/". Windows servers will always begin with the drive letter, colon, and backslash, such as "c:\\". Entering the string "fullscan" when Discovering against a Windows server will automatically do a recursive search on ALL local drives on the server. - **Directories to ignore** – Optional. A comma delimited list of the FULL PATHs that should be recursively ignored when searching for PEM/PKCS12 stores. Linux file paths will always begin with a "/". Windows servers will always begin with the drive letter, colon, and backslash, such as "c:\\". @@ -150,7 +156,8 @@ The PEM_PKCS12 Orchestrator uses a JSON config file: "UseSeparateUploadFilePath": "N", "SeparateUploadFilePath": "/path/to/upload/folder/", "UseNegotiateAuth": "N", -"UseSCP": "N" +"UseSCP": "N", +"DefaultLinuxPermissionsOnStoreCreation": "600" } **UseSudo** - Y/N - Determines whether to prefix certain Linux command with "sudo". This can be very helpful in ensuring that the user id running commands ssh uses "least permissions necessary" to process each task. Setting this value to "Y" will prefix all Linux commands with "sudo" with the expectation that the command being executed on the orchestrated Linux server will look in the sudoers file to determine whether the logged in ID has elevated permissions for that specific command. For orchestrated Windows servers, this setting has no effect. Setting this value to "N" will result in "sudo" not being added to Linux commands. @@ -158,7 +165,8 @@ The PEM_PKCS12 Orchestrator uses a JSON config file: **UseSeparateUploadFilePath** (Linux only) – When adding a certificate to a PEM or PKCS12 store, the PEM_PKCS12 Orchestrator must upload the certificate being deployed to the server where the certificate store resides. Setting this value to "Y" looks to the next setting, SeparateUploadFilePath, to determine where this file should be uploaded. Set this value to "N" to use the same path where the certificate store being managed resides. **SeparateUploadFilePath** (Linux only) – Only used when UseSeparateUploadFilePath is set to "Y". Set this to the path you wish to use as the location to upload and later remove PEM/PKCS12 certificate store data before being moved to the final destination. **UseNegotiateAuth** (Windows only) – Y/N - Determines if WinRM should use Negotiate (Y) when connecting to the remote server. -**UseSCP** (Optional, Linux only) - Y/N - Detemines if SCP (Y) or SFTP (N) should be used in uploading certificate files during Management-Add jobs. +**UseSCP** (Optional, Linux only) - Y/N - Detemines if SCP (Y) or SFTP (N) should be used in uploading certificate files during Management-Add jobs. +**DefaultLinuxPermissionsOnStoreCreation** (Linux only) - Optional. Value must be 3 digits all between 0-7. The Linux file permissions that will be set on a new certificate store created via a Management Create job. This value will be used for all certificate stores managed by this orchestrator instance unless overridden by the optional "Linux File Permissions on Store Creation" custom parameter setting on a specific certificate store. If "Linux File Permissions on Store Creation" and DefaultLinuxPermissionsOnStoreCreation are not set, a default permission of 600 will be used. ***