From bcedf69549652b9d201cc9e02f64c086d6501d14 Mon Sep 17 00:00:00 2001 From: nixbitcoin Date: Thu, 24 Dec 2020 10:29:14 +0000 Subject: [PATCH] readme: update and split into various parts --- README.md | 199 ++++++++++++++-------------------- docs/hardware.md | 8 ++ docs/img/nix-bitcoin-logo.png | Bin 0 -> 45002 bytes examples/README.md | 59 ++++++++++ test/run-tests.sh | 2 +- 5 files changed, 147 insertions(+), 121 deletions(-) create mode 100644 docs/hardware.md create mode 100644 docs/img/nix-bitcoin-logo.png create mode 100644 examples/README.md diff --git a/README.md b/README.md index 71b38f2..3c5b718 100644 --- a/README.md +++ b/README.md @@ -1,144 +1,103 @@ -nix-bitcoin -=== - -[![Build Status](https://api.cirrus-ci.com/github/fort-nix/nix-bitcoin.svg?branch=master)](https://cirrus-ci.com/github/fort-nix/nix-bitcoin) - -Nix packages and nixos modules for easily installing Bitcoin nodes and higher layer protocols with an emphasis on security. -This is a work in progress - don't expect it to be bug-free, secure or stable. - -The default configuration sets up a Bitcoin Core node and c-lightning. The user can enable spark-wallet in `configuration.nix` to make c-lightning accessible with a smartphone using spark-wallet. -A simple webpage shows the lightning nodeid and links to nanopos letting the user receive donations. -It also includes elements-daemon. -Outbound peer-to-peer traffic is forced through Tor, and listening services are bound to onion addresses. - -A demo installation is running at [http://6tr4dg3f2oa7slotdjp4syvnzzcry2lqqlcvqkfxdavxo6jsuxwqpxad.onion](http://6tr4dg3f2oa7slotdjp4syvnzzcry2lqqlcvqkfxdavxo6jsuxwqpxad.onion). -The following screen cast shows a fresh deployment of a nix-bitcoin node. -

- + nix-bitcoin logo

+
+

+ + CirrusCI status + + + GitHub tag (latest SemVer) + + + GitHub commit activity + + + GitHub contributors + + + GitHub downloads + +

+
+nix-bitcoin is a collection of Nix packages and NixOS modules for easily installing **full-featured Bitcoin nodes** with an emphasis on **security**. +Overview +--- +A Bitcoin node verifies the Bitcoin protocol and provides ways of interacting with the Bitcoin network. nix-bitcoin +nodes are used for a variety of purposes and can serve as personal or merchant wallets, second layer public +infrastructure and as backends for Bitcoin applications. In all cases, the aim is to provide security and privacy by +default. However, while nix-bitcoin is used in production today, it is still considered experimental. -The goal is to make it easy to deploy a reasonably secure Bitcoin node with a usable wallet. -It should allow managing bitcoin (the currency) effectively and providing public infrastructure. -It should be a reproducible and extensible platform for applications building on Bitcoin. +A full installation of nix-bitcoin is usually deployed either on a dedicated (virtual) machine or runs in a container +and is online 24/7. Alternatively, the Nix packages, NixOS modules and configurations can be used independently and +combined freely. + +nix-bitcoin is built on top of Nix and NixOS which provide powerful abstractions to keep it highly customizable and +maintainable. Testament to this are nix-bitcoin's robust security features and its potent test framework. However, +running nix-bitcoin does not require any previous experience with the Nix ecosystem. Examples --- -The easiest way to try out nix-bitcoin is to use one of the provided examples. +See the [examples directory](examples/README.md). -```bash -git clone https://github.com/fort-nix/nix-bitcoin -cd nix-bitcoin/examples/ -nix-shell -``` - -The following example scripts set up a nix-bitcoin node according to [`examples/configuration.nix`](examples/configuration.nix) and then -shut down immediately. They leave no traces (outside of `/nix/store`) on the host system. - -- [`./deploy-container.sh`](examples/deploy-container.sh) creates a [NixOS container](https://github.com/erikarvstedt/extra-container).\ - This is the fastest way to set up a node.\ - Requires: [Nix](https://nixos.org/), a systemd-based Linux distro and root privileges - -- [`./deploy-qemu-vm.sh`](examples/deploy-qemu-vm.sh) creates a QEMU VM.\ - Requires: [Nix](https://nixos.org/nix/) - -- [`./deploy-nixops.sh`](examples/deploy-nixops.sh) creates a VirtualBox VM via [NixOps](https://github.com/NixOS/nixops).\ - NixOps can be used to deploy to various other backends like cloud providers.\ - Requires: [Nix](https://nixos.org/nix/), [VirtualBox](https://www.virtualbox.org) - -- [`./deploy-container-minimal.sh`](examples/deploy-container-minimal.sh) creates a - container defined by [minimal-configuration.nix](examples/minimal-configuration.nix) that - doesn't use the [secure-node.nix](modules/presets/secure-node.nix) preset. - Also shows how to use nix-bitcoin in an existing NixOS config.\ - Requires: [Nix](https://nixos.org/), a systemd-based Linux distro and root privileges - -Run the examples with option `--interactive` or `-i` to start a shell for interacting with -the node: -```bash -./deploy-qemu-vm.sh -i -``` - -#### Tests -The internal test suite is also useful for exploring features.\ -The following `run-tests.sh` commands leave no traces (outside of `/nix/store`) on -the host system. - -```bash -git clone https://github.com/fort-nix/nix-bitcoin -cd nix-bitcoin/test - -# Run a Python test shell inside a VM node -./run-tests.sh debug -print(succeed("systemctl status bitcoind")) - -# Run a node in a container. Requires systemd and root privileges. -./run-tests.sh container -c systemctl status bitcoind - -# Explore a single feature -./run-tests.sh --scenario electrs container -``` -See [`run-tests.sh`](test/run-tests.sh) for a complete documentation. - -Available modules +Features --- -By default the `configuration.nix` provides: -* bitcoind with outbound connections through Tor and inbound connections through a hidden service. By default loaded with banlist of spy nodes. -* [clightning](https://github.com/ElementsProject/lightning) with outbound connections through Tor, not listening -* includes "nodeinfo" script which prints basic info about the node -* adds non-root user "operator" which has access to bitcoin-cli and lightning-cli +A [configuration preset](modules/presets/secure-node.nix) for setting up a secure node +* All applications use Tor for outbound connections and accept inbound connections via onion services. +* Includes a [nodeinfo](modules/nodeinfo.nix) script which prints basic info about the node. -In `configuration.nix` the user can enable: -* a clightning hidden service with [plugins](https://github.com/lightningd/plugins) -* [liquid](https://github.com/elementsproject/elements) -* [lightning charge](https://github.com/ElementsProject/lightning-charge) -* [nanopos](https://github.com/ElementsProject/nanopos) -* an index page using nginx to display node information and link to nanopos -* [spark-wallet](https://github.com/shesek/spark-wallet) -* [electrs](https://github.com/romanz/electrs) -* recurring-donations, a module to repeatedly send lightning payments to recipients specified in the configuration. -* [bitcoin-core-hwi](https://github.com/bitcoin-core/HWI). - * You no longer need extra software to connect your hardware wallet to Bitcoin Core. Use Bitcoin Core's own **H**ardware **W**allet **I**nterface with one `configuration.nix` setting. - -The data directories of the services can be found in `/var/lib` on the deployed machines. - -Installation ---- -See [install.md](docs/install.md) for a detailed tutorial. +NixOS modules +* Application services + * [bitcoind](https://github.com/bitcoin/bitcoin), with a default banlist against spy nodes + * [clightning](https://github.com/ElementsProject/lightning) with support for announcing an onion service\ + Available plugins: + * [clboss](https://github.com/ZmnSCPxj/clboss): automated C-Lightning Node Manager + * [helpme](https://github.com/lightningd/plugins/tree/master/helpme): walks you through setting up a fresh c-lightning node + * [monitor](https://github.com/renepickhardt/plugins/tree/master/monitor): helps you analyze the health of your peers and channels + * [prometheus](https://github.com/lightningd/plugins/tree/master/prometheus): lightning node exporter for the prometheus timeseries server + * [rebalance](https://github.com/lightningd/plugins/tree/master/rebalance): keeps your channels balanced + * [summary](https://github.com/lightningd/plugins/tree/master/summary): print a nice summary of the node status + * [zmq](https://github.com/lightningd/plugins/tree/master/zmq): publishes notifications via ZeroMQ to configured endpoints + * [lnd](https://github.com/lightningnetwork/lnd) with support for announcing an onion service + * [spark-wallet](https://github.com/shesek/spark-wallet) + * [electrs](https://github.com/romanz/electrs) + * [btcpayserver](https://github.com/btcpayserver/btcpayserver) + * [liquid](https://github.com/elementsproject/elements) + * [lightning charge](https://github.com/ElementsProject/lightning-charge) (deprecated) + * [nanopos](https://github.com/ElementsProject/nanopos) (deprecated) + * [Lightning Loop](https://github.com/lightninglabs/loop) + * [JoinMarket](https://github.com/joinmarket-org/joinmarket-clientserver) + * [recurring-donations](modules/recurring-donations.nix): for periodic lightning payments + * [bitcoin-core-hwi](https://github.com/bitcoin-core/HWI) +* Helper + * [netns-isolation](modules/netns-isolation.nix): isolates applications on the network-level via network namespaces + * [backups](modules/backups.nix): daily duplicity backups of all your node's important files + * [operator](modules/operator.nix): adds non-root user `operator` who has access to client tools (e.g. `bitcoin-cli`, `lightning-cli`) + * [nix-bitcoin webindex](modules/nix-bitcoin-webindex.nix): a local website to display node information Security --- -* **Simplicity:** Only services you select in `configuration.nix` and their dependencies are installed, packages and dependencies are [pinned](pkgs/nixpkgs-pinned.nix), most packages are built from the [nixos stable channel](https://github.com/NixOS/nixpkgs-channels/tree/nixos-19.03), with a few exceptions that are built from the nixpkgs unstable channel, builds happen in a [sandboxed environment](https://nixos.org/nix/manual/), code is continuously reviewed and refined. +* **Simplicity:** Only services you select in `configuration.nix` and their dependencies are installed, packages and dependencies are [pinned](pkgs/nixpkgs-pinned.nix), most packages are built from the [NixOS stable channel](https://github.com/NixOS/nixpkgs/tree/nixos-20.09), with a few exceptions that are built from the nixpkgs unstable channel, builds happen in a [sandboxed environment](https://nixos.org/manual/nix/stable/#conf-sandbox), code is continuously reviewed and refined. * **Integrity:** Nix package manager, NixOS and packages can be built from source to reduce reliance on binary caches, nix-bitcoin merge commits are signed, all commits are approved by multiple nix-bitcoin developers, upstream packages are cryptographically verified where possible, we use this software ourselves. -* **Principle of Least Privilege:** Services operate with least privileges; they each have their own user and are restricted further with [systemd options](modules/nix-bitcoin-services.nix), there's a non-root user *operator* to interact with the various services. -* **Defense-in-depth:** nix-bitcoin is built with a [hardened kernel](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/profiles/hardened.nix) by default, services are confined through discretionary access control, Linux namespaces, and seccomp-bpf with continuous improvements. +* **Principle of Least Privilege:** Services operate with least privileges; they each have their own user and are restricted further with [systemd options](modules/nix-bitcoin-services.nix), [RPC whitelisting](modules/bitcoind-rpc-public-whitelist.nix), and [netns-isolation](modules/netns-isolation.nix). There's a non-root user *operator* to interact with the various services. +* **Defense-in-depth:** nix-bitcoin is built with a [hardened kernel](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/profiles/hardened.nix) by default, services are confined through discretionary access control, Linux namespaces, [dbus firewall](modules/security.nix) and seccomp-bpf with continuous improvements. -Note that nix-bitcoin is still experimental. -Also, by design if the machine you're deploying *from* is insecure, there is nothing nix-bitcoin can do to protect itself. +Note that if the machine you're deploying *from* is insecure, there is nothing nix-bitcoin can do to protect itself. -Hardware requirements +Docs --- -* Disk space: 300 GB (235GB for Bitcoin blockchain + some room) - * Bitcoin Core pruning is not supported at the moment because it's not supported by c-lightning. It's possible to use pruning but you need to know what you're doing. -* RAM: 2GB of memory. ECC memory is better. Additionally, it's recommended to use DDR4 memory with targeted row refresh (TRR) enabled (https://rambleed.com/). - -Tested hardware includes [pcengine's apu2c4](https://pcengines.ch/apu2c4.htm), [GB-BACE-3150](https://www.gigabyte.com/Mini-PcBarebone/GB-BACE-3150-rev-10), [GB-BACE-3160](https://www.gigabyte.com/de/Mini-PcBarebone/GB-BACE-3160-rev-10#ov). -Some hardware (including Intel NUCs) may not be compatible with the hardened kernel turned on by default (see https://github.com/fort-nix/nix-bitcoin/issues/39#issuecomment-517366093 for a workaround). - -Usage ---- -For usage instructions, such as how to connect to spark-wallet, electrs and the ssh Tor Hidden Service, see [usage.md](docs/usage.md). +* [FAQ](docs/faq.md) +* [Hardware Requirements](docs/hardware.md) +* [Install instructions](docs/install.md) +* [Usage instructions](docs/usage.md) Troubleshooting --- If you are having problems with nix-bitcoin check the [FAQ](docs/faq.md) or submit an issue. There's also a `#nix-bitcoin` IRC channel on freenode. We are always happy to help. - -Docs ---- -* [FAQ](docs/faq.md) -* [Install instructions](docs/install.md) -* [Usage instructions](docs/usage.md) diff --git a/docs/hardware.md b/docs/hardware.md new file mode 100644 index 0000000..46279e8 --- /dev/null +++ b/docs/hardware.md @@ -0,0 +1,8 @@ +Hardware requirements +--- +* Disk space: 500 GB (400GB for Bitcoin blockchain + some room) + * Bitcoin Core pruning is not supported at the moment because it's not supported by c-lightning. It's possible to use pruning but you need to know what you're doing. +* RAM: 2GB of memory. ECC memory is better. Additionally, it's recommended to use DDR4 memory with targeted row refresh (TRR) enabled (https://rambleed.com/). + +Tested hardware includes [pcengine's apu2c4](https://pcengines.ch/apu2c4.htm), [GB-BACE-3150](https://www.gigabyte.com/Mini-PcBarebone/GB-BACE-3150-rev-10), [GB-BACE-3160](https://www.gigabyte.com/de/Mini-PcBarebone/GB-BACE-3160-rev-10#ov). +Some hardware (including Intel NUCs) may not be compatible with the hardened kernel turned on by default (see https://github.com/fort-nix/nix-bitcoin/issues/39#issuecomment-517366093 for a workaround). diff --git a/docs/img/nix-bitcoin-logo.png b/docs/img/nix-bitcoin-logo.png new file mode 100644 index 0000000000000000000000000000000000000000..72d56833863b0be9de57abccc5b70de030b8268e GIT binary patch literal 45002 zcmeAS@N?(olHy`uVBq!ia0y~yU^&Uaz{t+Q#=yX^rAzQT0|NtRfk$L91B1dM5N5nu zz#hiH5D<_V5>XQ2>tmIipR1RclAn~SSCL!500K7l6$OdO*{LN8NvY|XdA3ULckfqH z$V{%1*XSQL?w=vZ=7D$SufCElE_U$j!+swyLmI z0-I}l#hD=EpgRdNJbs1V^Bpx~Tel&WB=XQrEMU}&OXZmDNzYG!U}uA^XN zU}&OmV4-hhple`hWom3?V59&AN_Jcd3JNwwDQQ+gE^bikic->Sl`=|73as??%gf94 z%8m8%i_-NCEiEne4UF`SjC6}q(sYX}^GXscbn}XpA%?)raY-#sF3Kz@$;{7F0GXSZ zlwVq6tE2?72x_YW)S`;q0=Pwa#n7-z&d=4aNG#Ad)HBe>rYR*EuBV{1Cej#cug|CBdnA#i?+UK#3+5Dys*IPjI4ztHWwqNoE=je}QChMoMZ$CJt>N z8HhG;8iyo3n~K~5E9aur#FG4?ko^1{J4p5kfTaxuXJ>GBQP2p_%uC5HFV?itN7sT# z$OzL?T@p)D?TieJ40H{Rbd5|x42`XfjIE5!wG9ld3=EJAfv7|?!#6)AGp!QE3}b^3 zLlY|#ODiK&WHXRdqMMOgl9-ZMl1P*($ZCFSF$H8fnn57f z<24AZ0No%PeNcIrlR4@)a^j6DafZu~fr~GS(;$Wc1LPN6K?}}w=ve_*p2B6w0Qo5| zvjQV{N%9Xi0|w47gR0zvl!mB9J#t`!f(cwGBi9h18rRp?$}_LHBrz{J)zihUBDX*< zGc(01&B!z{HPIqf*TT#+NjEXo#8lV9#4ttI&?qrA(IhE3In6W~Tn(dYMUs6DRF;6p3OEEUkO*2VL(@iljNzt`TG)U4-NwF|7 zNisA`G){wCfyEdMt2{D`OY(~_(n2=j(#mpEF;06Sdv__S(=$)N|LdzMT$|1u8EL!|)Sm-8MS{Ujk znOaz+B&8)9o0yov{6~7UVd;iJ!WbO6=;4Hjd(zY`mnLwM; z#+E6%DM^XOiDpIyW~L?vpnMOq3&}8ScI8vrnuY`j7Gn^$!Q#OM5!^_PXHZ-~MpUhQ z6N|D_Q|#OlbBa^Jnoz}&OvD&NwJOdjMH~DAH`G!4Nzk+cifdAb#4v3Hjmvsx=B3#A z7o_HaM%5H_6+%L6^zo=f_yFP(P`!smd17v6PNiLFQfXdEDOU3!3Wzh!zqBMLGcVOG zGbc4Tvntij0Go;Eiik7XEx$A`rKr+QR~MU^Fj?Zv3QH|2&dkrVGtjfZ>Oz=2ai)2v z7UgB;r8{S&CTACy=3@6Wx+3C?21Pq~*goD+&nO;lgRzB$k&&6Pp_vKxuz-&BqiQ0~ zMk4KiD%0#MiS7AERU`ip*1uwv&7B_>QppgBwe7HOvp4_a6w{nsvT$`!qi3|T^LnK`w4~TsHdP z6$_w=V6YUt-9Re_)M2zT9%AmOC6I6+k{k^#A_EGdY&5ta;Xoug8eBvM6hzr*a6!U> zNOCl|hzux*veDpzgaeV}XmAl3P!MIK!37BiBFWLsqfNH`Eljs_Qz0R>Su8eEWYAd(ynE+PX8qHHv{AmKnHIT~C< z1{6fuXmCNofk<*RxQGlWh_cb(f`kK+qqrn9U2O`PQ;36`hAj(FA3la`Q zlB2;zWI#cbjRqGa9Ec=GgNw+3f+!meE=V{KNsa~=kpTr!HX2-za3GQ#4K5-B3ZiT@ zxFF#`Bsm&fLJ=LkS_y6l_~>6Lo)-z&;JYz4KEoON(~qoUL`OvSj}Ky5YL|!f7FeEA?}N( zi(^Q|tv7co=fs50{r=HE^`(mJq; +a|2z@QUb~@>oE8O2|nKE3Hh2!(tw;?jIye zGoDq-$V^{YSdw<-qRBZ6tL`AqKt-*R0_Tuji+2c=ytwd2VdVyAhh2>=6DEB5e0-;? z*4(&NtKQpwzf-;c{q@!HbC<3*84Ai3V8x;a68gSo-AOAnscatS;9%Hz2Iv?gIuYe~=n^G5at`xRWBAPp`4 zAoVLlh0|0bzP{L?Q_yn$<&p-W0{aWuKdr@dmtEzF;oTDz>J4(UN)5=(Ckn(8ni8j8 zOpJVB+G7`b$^YzuuLoW?tetkLMz~6{i(c~<;P5z8n8hR z|A>DGb^r9q@qseq@R2blSuqzV=A7KAX&x0Saz`sw>m)3on?AXS2eEn@G)CwlCD z)7Bosaj=TbSoCAs8-I71R|*fJ9;iI1l(+xR^v2#qYh@NV@OHQ=pLB6)n$8r*x<`74 z$d5JO^8*Xn3+y)BZrqd7xVlDXzsR@cQF+YQUTy&=|H5v!Nu3=()LFMM9cMZo`d5b8 zNB-H@`CS*ve>YCQUtgx6@7;KwVg9#=o9{8nWLo~efBgQ$0#GVYdc@3n(#1vUau;Wv z?EAmxn7A7yP51p5c92h-yLQEoJ>PB5mn!Jb|8gpSkMgFlwh7<0OMijmV28V-k>JE% zx=dBae@bdTn0=u3K(64=d(8*f4ZEM~^I7U^`fPaluW-tJ#sk&5&#R3$I4++6)>yqo zZDxnZ-!8jaKjQ*h19hkSwblh{A7(IDO6LFED=w_Dd1VWy88|0(B!l8-<@uC9bMq|t zckpF&1xVU3&0%~~prHR))Bbj_?)L?;y5L+fXQ{%>4v*S@LNi`}PM^n8W194|fIIEg zQf?{D{mO>j-)?{5exNwl3GC&(pb0)MOYF3ne%;y6WGA(8Qv`R-#ff{aMAx~V*_CEC zwFK%zZ;%gf$+GOxK5#ysb&qLM>Zk7q`ejafuYGFHxZ^<4JvM{OPGH-Q1cK7t#-yR^Rh!_p(>_yQY2qU{o;GPjS0$+&;Zt&Zeg~ ztz(Ni{pIUb({81%_lg3Qu79QN1qCJVS~oO1dze4Hn{Z!zqx2hoW^TjRO|6=&HNrdO zf5bnKc)&aD^M~LEg>#+qqW09p3cfhf^NTAeYN@W0lF}o)w|SaMM%zRcm)+%w;Xl(E zQ2CbS9D`hug8tb9RS9}g8{)rBSNy>MF5FyNK$&>4wLpdciAoEm&5u)qTTbO_r^Rk~ z%l9NzF73GY?clWe2U#q@v8}=c3UtZ4oCieMKYdJla9=sBY_@^4+>Q;-&u2F{>n{J9 zduD|dIGQ^fJiDi_57s;p@yWqHswATA#*VT`p?zum8@P5HY1~sIuw!lp>*;;{HUVC^?+JV>1rIq%(J_-p2{?;{I z@N!yErjM1u;-l*h>jdq~m~vg8QSVzG!|9gI65Bd_cf*S?(}I+iQ~3hMZ;OJPUiG+5 z>~!&G`^@km^1V!))gfN78NBk-669iXj`dibTg~C>a;46Di>8NKrH{&ABdOaDS6|KU zsM>SPQ)L~S0ry3IiwV;$XEc24;h1{AZ2g~YY75rAIkLuGP3hvrcVFA3?w+mSyzut! zlBJ<@l$5TOBs9f7&fRZ)wT?Su*HS5w|JOL99+m2K&q!RYR9IqOAh$tohD1@^rUOzB zc=)y&{P~yl;;ogNiGC@ zVD?_eGplE)9^1!Ib9&;Q8m@}?Bd6ZiH>^LhCC`TQ&yj;QwbDQKTa~(gyLj|P_J%(9 z?()S`!wkDST-N=47xa5>4A&%8f4Tqe6MC-{tW2C}v0Grr)yA472FlLju514M6El8m zl(+7bn32BqwB<)<+>NyFj}-TFIm3Kdm2r9C&Wl2V6En8nUz@dmvbW==Cz_F7%UL)7 zSm+Uxdwk9MuREA4GuhT1*Lfi?y4z6sfm}!AUJc6`%NKpGR!WoIy~Z!za|ch_!aC_` z3sN;)T>j+j*WWzln$Vd`YLg7OCaHQ)oVfiE?;)-&kCz^~t$g6+jJrIC&E$XBU5pa= zA9*Iqf!S~+zx3wTGjsc%W@;6bUA-UOATPAGVO7U{tBf4?_aB$2D=A&f_O}jwa&oak zl4 zd=IkNKZnXZydTeBBfNRpT#rdx63azq{&H4Qx|rwQt@SGR&M<$>d+ueyFYZ}hwV{(S&T(JD8k zMc<+yc{y%+azfQ4S1`JaIsM@=r!SKmvm3%)*YMbP%-kpCs>=Sk#F6*<&-0Awuf9xW zIoUELPy6D{uh#978!tBAyt|f%hw1KtsSf;7k%~$ucP`Hfy{LX#MYK^$)H}2MrGN($ z55s%LI(Li9m8;HvJh$7NQQu|BpRxodv;EA^Twm<4XZmwyqs`K+J)ORZWqa;0{fS$? zLFK@t3BR3f`KG!aJ01K~-8t90cuPW4YUY*|TRU!S);O}|bKlncLJFX={!b}?fnI^F zf#H)qDTa&_j13nv%$cs6QfBw_!RGn5e_bdJ=i%dXOHKS4v~9x8#}V`HG08+e&Ys=) zy1_h&sZL2qU-G?r{MU5*rqG z-0-*|dGGw>hR2OJ+4pCO1urxI_#rlWalsn)!s1m=Pg%v=^Y6H}yYt?<;0TpZMKd0R z_9eKREf2k-q$H#cs$5wfcOT$9P{jV}Q|1ExAM@U}Y;HYc^NqJ9lqq?$+uqk!6;{^U z-ln{s#(2H|^ZHG#XXIs1U*>sG%e&{j%b630zY9*B*sf$$WbCyg*xS{`MadIXw?Bws z*~1ngQ)Cx(AnSqMgKr8#C&Y{-6BN}r!X!nvO(^V1u&6kw6L)J{_w#vWRSB1;@;%Fx zG}wFa`#jDXu^&tP;z4D+rxfeSNsH|lW_Gt^TC2S%;4X+bQJHyc&Eztr3m0sT7Hv@^>c#gr0A=v4hx3=1f&t?fXRs?UG zz_|J00j6)fEwas=ZNA%QKJ1*Vc45}s!_4&+bMEeriI$%KK9yVYdKq7>X~886du7%d z<_ZSk2cn(P^%8$!0A#>ZXVOIcezVIzhsg(>MAE>vjflt4Y%*H?FU!pVu;z zuZk_L>hAW&|E${>zcasXtUt77^*1XW_7hsOmiearD=hY08njL}Tzq+yn4#mkkF%Km zFjzP(U%$fs$?daqJ336(g}>c?V}U~CCac!OH4S^?T=kh|uwLB%#3N3R>D^J5!|z!4 z^+&e9l6kPT#r{#QJ^Ptirxv=OEzb|eOG1=8|Q;H^Yc!baTSXaGG z^BEu5wiy4l{1hY{bjH4p&o_APjq)_3g3|c%pP_tDo;oz$o%8fRqkI7Glo=X~vvs!p zl+`K{6x@1Wi1*fAqe`m=n++NdO2QVeWHstB*87{9v#)!*aEkJ~qig`C5pgkezW6%9FmS<)5D4d-6m-F{Np2T>%-@~xFYUekKJbR1iXHb}^M73-;p*a)yWiTtJK@T$y6|gq!M}Ca2Tbr;B|Y8i@T7x2v(F^B z&04zm`jox%AAV`L4gt{_0}y)Q*nex8)aq zZ@!hEIio4XD2O>Y$k5|X3ir(I%>P?B+kC@2k9ZfK7U8Qun+hRXH%TXS2q`zx7$^^KpkY2pVDXa8n`ALy|Tuc|G@&~v|W?ta{u0S zTAuI2=kv$^9bUI}hUrPrh=EHIsQ>BNlA~xWZV{>~Sl=#FslYB{adzsPnw{%+$8fyZ z+^twMe^S;AP+#fD)TR`rNh0ZsHJ^1(@H+VC@v{pixtq9eW-_gN`C4!PspscwZPR3J zXa8gPva$`-0r!Z}^iWgsEZov$f@2eju?4iXaO3CO45x!;lpq)*z?Fe zzXag|-Vd4&_8z!+;LGw;f7_W?%bt9`{P(WY>3yG#yA+@7UZSN2>W39BcU|ME^3IR# z*=mWT$EpwH9^^gfTXmoRTj}(8xu><_Ox%Xt_u4gC*SvhKcYnTaN?!hhzn>d}b)NqW zeBc&p3-VZ}HS0+im3Lbb>Pu^)yK9oRO}H8L zyjuUjKaCHo8}6=}1hQSIoNH32M@}mD%(OFGtP8JSNQij)UHL)<_?KO_LHlm*&1qi z*GqctzrG`6%HH`4|LZB8ER-?`KKh_#?hJ+-1(#KF`+|PieqelXd&Yv`8Gda0m}*uW zyROeD7IE%zenWL=t@C8IqI>>TGwcHU{+bs`NG!Au`FXK-hDXiQJ!VSbSL2p6x|Y`Y zm0Aa78eeI?74g9=4?wg+tBY@Y_*~`CS=qr+k43`6}$R%TfN8KvU4ijtg}~Z z9Vlt$EnPdU?^AvBp0>Tmtu^-EyYH&9&*bW*eRF3_O!&@F8@k^-*fe$hdh09CzGo?L z*Bom6v}?us-8I$QCj9J|ira0}@@Hzu(zW+Pp03VYCw24a7FOYawGl>6^H&sYzS=CO z*5wjd*^4!~g-)UU+d*!S7D)QaiRwZxLc#ynddkcb{T!IxS0| za{Ua$xh-?nznyW{N%e>H>QiS!yO)+|*DhKbDtpB%UZeBx!a3zUe=fcM+CE8vzr%Qj;eEBNwtUHhrLBQU5spEZkta0j%1AKbw%_Q?*meANUuIwU7z3kVWaFV{mA!MGqvCTTw=&&6(4%T zyJP>U#v6}h8_vxz)5~n)oDeGYQm%=6N@;|~{IK^o+_x6r7X0w@)}vBBD;a%u->otS z-^Etn*qE!XpL_pkU+(UT%-eq7_SjfdJee-0bF7w)zaX0x6fa{v4&!EGG1h%u~2l!jo&weN}F%5P8M9@8n^fTnqBjCSO4t`{XIAFenUiG27k;dS5?2{ zrE$ysY~Ig$)irJXug+@6>q!T!8Rj0*j<|O8#p~@q6K((T)vh(+n5{eQ@=KTekVL*6 zXD{uXcymWt&?MqZfYT>0oxPXGW1*-H+6}v{~UAdZ=ms4 z4|fyZ+jBopTDqw#NpkChZ#92idX;YP&E~)TtNg=q_xaB^{{DaD***0gzpwKbUq8$L z@jo)!g2Njx6#xAgpj=0eK|FyB%E1qxsw?sDX7k)0KB%she zVMYJ3{G&ZS8jt@oZ`km=vhYQ*r%j*pt=GqM)%GzO-LSs2(&w%9+OX`)rHScTA2=|tZ z(=L!r>+*Ixs`zMj*?YTW*QR~N+BdZ>5W|Mui#b0X5DZ-RqSSZtm*Y~V z`s+*N`q{V?pDRP^tLeHa&luaI{py*^mT&X^qVv&eiL6SxxcfwfCkFhgVyYi@=NIVM zOE%s8aY|HoMxbZzy}hB4%NHJTc&d0W%ST{Gy^Xw?Yczal5^)^;`7dV}9t?i6nBGNyFK`Vs}}vj@Ibm+{AmINgfc z5dUiD#aDs#9!nnXyOOJ7>=5?y`tC({cW;lLwBXZvn>QKPS85n;I+Pt<^!TShuS)hE zrEh-w--H%MybahA`7U5fg4?90vUud1&%2km`*KC@wha#|PiOiu^fAV<>m0G!Ys)l))rUEa$+}_g0qz5j4+tNqJ+L=! z_V42fuP!vLt-U+jpS_Ov49DgspE)*)lV=^MIepTOzb1aV)XL9p-hUM*-dei1?&+kK z>CV%Yk1ulhAU$j6s!tn~`z1rKt-lRWA`_FS&^I(JMqD`KeBJt z7RY{Ya;|){ZsvneCfcS-+la&?b;(t<1gLK*ze+K^xvv&`Qv}P zLJKc;OWJNdRkTa?o}r#~5Z_CIS22Ry=NrWeB;C5*P~Bi{;JESB`?E7zFSuX59_yD_ zfAC&=V?4``pOWuq%wgYi?D_e5kGJk#Uj4LM`vdO-sr8?2^==+&di{HsdA-z+oCwjZ zYl#bwRC{-ryz_d$=Y2q62hZ*HOC@EC)t`JR)`+kSN&Vt0$9hU7?(d{szqfNu`dOX4 z(Cz3vzcU?bvz@O-uj<>ZU3%`>(OOeJ_NL9PXA}>_M|fmO|L*76Eq&w8^;kKXkbW7r zoZYy3*^);SW~{IdSf()Zf3KGu>#3Z$Csm%$wwyM5vu^$d*6-rqY>q!S%ay(tmB=$w z&GKBr4Ua=NzSV9$KmR-11LFg?oz}3QJ@DJ`@ap}~?{2t%_XK+?H#Zw7oER!h)Bc)d zr^!}1NTh}@Y76XtY#_Ut?XKaB2agR8Y&^h}@MyyIZ?D^oE`^1}E_a=@PUMp5z0_F6 zd)6;*8GWieHN^VKPtFmQ~Ac-=Zbd8wphP4l0D?Q zTB6bF?u&KP^b?vit~PG4Zq#LDJ=|u@8g z+QoG>vc|PPx9_^*dX4M7)y;*ACbZn2q3N(~y{_Wdh20tsVf?J8RQ$A+OUW_qW^AS=+wJ<#fr7hh05H|$M!|vE_tsWeL{wRPg&3O(56IZ@eA7} zd8AJUz2X1;Jy|4@>jy_#)FZ~eu>O+={vYl!`IG(N*RR*to80%v>YFn(o^PCESS>YK z&3{X*pFOkO%Fni&Z%8w&?%}c)oAKPaZk7SR!@oU^HJ#RapYz&EC#!mf9C`Q5D^SpF zzEM9@O7D(K*@vq`M1+{9R{!`Dp&v3qM?!lK^M$30HeBO;d9){JL#p7jmlf?#-{0!H z+weebks;TDDv_I?dGtemDivsqHKOsCqtUDo@9@@u|t>lUjgmvxHXP3d%5nZIhm znGZSJSuO8Q?)6q(abfkM2@(;TDt_+z)|)-OwC|e|>&d3Q4^J$}oNo4|dhW!$(=X$m z#aiUVni$>Sjo=lSD>!jGbA9LUgBu>obp18mb1j{l``Bf(y@EgXP5-{)r~QFwgUbg0 zBhE{2Ze?BldzX2-q2o3OpR8FYdTw6MnSOF}Ty&X5wR>ymdPy_uBagpYJ(xXXVnegX zl>ALaJ2qQy@t9Dg;b0b4o!~9?Hpw#Xs&Ph1ymsM*jTJw4t?SL6-g`qmaDvVawxz

81a7J>6_JZ{@V-O!pa#Hh%azxU4~Q3}fA_NYIlAU-*mbM=n}?bhAK2d8 z`DpgDnZYwI*+ixv{Sb5@)FI4OFw-$!-}TUy#=GpZ0_+pBX{L+d4 zoEMEc?TFZ7nLUGOxv29Emd*;ctd^POT!GNYmDz#J@>tN zsOfiO>VdrdMnab~HfhZ4y!o-HuS;p(+@OgKIZ8jCDi_UA*wAw~o-ayD_lkUp^t>=b z51uW0ar^RaR2zn0SCL-vIceI#cjwx^X1Tu>zHz0I)8|&rtn06q-j+L1zR@zIX0Mgl zHIu|;Z*PA2os)QQZt1?~HV;0Feg47yzQ*d*r;QQpdpfO_<)m|S=e>D-?~mbw(~r*{ zXyMe1dggaM(r}w{<7&g~LvOtC;Hr<->@pZH?M^BBL! z-?lve_VCtwPeswJ(!&=X|CL+)IK12IxIz10g_9Z6sw%Z#&)Kx>#Z|-E;?uef8JEe; zx6^OGyL?jg1rzVt_d5Ry8h$N%bid(dQw%g8yua}6rrKAV)+*f0de0Qj1WHg)f(ZF^bEIqSE1_$Al7gbU`r&Dp&t_g1H5WAJLr1K$l6ugTdd zEv&#?!SX}w!@E`g-yiS!af*38r^4UL8K$SWu9)|Jaz1cz#>5QXnWZmy<_doOY4AZm z&bG7rl*c{2`L`bZTXjBr{jQTm57{;yeJw5)I#v07(Ii_fgU12?>$uZILc<-t$NYUG zzvF!6^TN8G>a~pCe{W4vK7QzY_5HZ_%P(ucFLS^3(W_47mRaH>)u#=YHLLAyL%;9J zjr%QFc3_RglGx4L)FNjV%oF<-&Z^6GW zAwj*sikB^C)-u0G4PQd$ihkWWwSwgY+a86(OzY1_sYJS3LwQ-?Ha7O;KII)b+b&-fV`>li`*(V1eI3saPX}}L>5TPp z=cPBbo(VpXdEi@>u(y1X!=7(ETa!zVeBRHxQ-N0(KNl^pmc?ncgxe2 z#pNmUL)jO2@lA1Ge|^4B_1}(HX6x)9Y`LtsU7dMGdupZk+sd2XufGVqD_&K)$o0?B z`Ty$gWg8#bbbfEOkhsIkggM#Ae}w)>aX?Z?3^m+rq(mL_r9iXnD;$1 z{B+x^%jHV5zQ3A%%kR+KNB5d5DtDKuRYATIYnoC;oBDTMfsDj zPb+JkP&PfB|IjSmt4(rSy6deBm4gm*{Mi=zUv=ebmgyYo0n@_o^1F(s{n-At+im5+ zU75uzemrHd{}cPIRHn2q=+nXNn_5}7zGL|j`9NX*<^8P2tsi?2=$u)``v1}2>eRRE zcQ>lLXBy9!T_!B?M2gMwOjL5|Nin0>dyLkc{PHDa)-u0Kk%9B&AN)6omJZuo9@47) z%aGseP)*hCg<86TQ`GmAmV{NmT>U?738#KQFlX2_=Rg1Uwn%GayDvU@ws7ISOyAOXefALI3M7-t7!gWVK9%yA;azFU% zb8&;kxBkg(u70NTK=!~=cQ3!TX#NMLR4HGzy4Spm{dD8@y_@>`+miR@ z_Z$DZKKiuk`@&e8TTUL^Lz17{_ukE%#+)%LRYHyFdFzGF)mtxr>19^UU@~ zd-ztF-Tl3Nx8Y^+>Nd;tBF5==bI#~>fr6^}K+%HyE!TZ#m^4nayj&V~<+*3pe5*H; zida5HD9v$*>|WxrrC1LGlJ?|T}T-W3#&fd1;C-P|8Se_-gaK& zRc|8_^wPGU&2n7pZg%B<5>pw-J+}?Gf9A`+G<~`A@=Sw3?Qhp#YPrQ<_d9k!E=JI4 z*RF#?cddK;7&lG4&3D^6itj;O!o1XK5m`PQsO&<=a1kHsm;f(EArMHyL`CB z?K=a1q{d;(Ub*c#iotC6*x$&!`=2hmXyr8Ch{Z}9gcvr|&W&lAws=B@M|*+pb-gEx z@4MW-)^_`H>~GHWZ$5!n1DRHwo;&TgQbSXUsI1uKEJth0*0sF9{Ufa0EZ#|;{_1~O z=diKx@93ldSvGHe8o|eKj?+NCJ;`llEwAv6Psy>{sXHBX2u^c zF4WJzWHa;GG)*h*SD*Ly7`BEg)y}=L)pOB-GTXIZZvP7Xa`@ZAT>t95bN)`RF9_uS z=FX~r(RLlng3D=1-P6~fZf;5uO?|V@cUtho_PRaRI?F9DZ8J229XdbFSR) zsO&DkH~F_Vq?|aqSa!GnfprQ}{`()D`nGP`c?SD6AGe;?eV)6d zjM5LYyEe!E&*xwB_0`+7Ga75QGbFDq`Y)4qBu?P%&zYu6>=)%Iel|)w^^%!g#-jIR zu-dCNE6(>DG{$eNKYNLHT1TSwgA41FTo(@WaXL*uTK!E% z!y|01d^PvgWubS@$rRs~op)->X`xwZGgY1&_c3@kXUWd`Q+7tgWA?7&KmNZGoF@5T zePcY+es({}$9s40{q(Jx<;+8eG8_2`x+(M6{OmtmklbD3b!F`mC62Xsa{JV>gC}+$ z&bfAe1zT#)#=G_JI|?F8kNmmeVRR#lzj%Sd&4Acxmm(J}Dtk3!{kA#Jgx>I7-!HQ^ zU2vJmx8+gyIyp72J_@^cFWcuJgL$F}+ zPP>LZ`rjTJpHn@mGFMEwO6&*k2m1s6neTOS_GNvEt?-(5`7-ac9V^a$D&6GmYPX1| zY54{qZm-P&(K4*tR~dJM(GCopUeL=Q%gCU$`PFzGlOmd#7i7 z-IHa=X>qRT-?6G$k*_^&e?Io(e|v+h-SfXL@^;Bf{Wux6Rmsj<&s@*Ehu4C~LcoIa zhr$Qd2W$@lMZ;fQKk-%U^6AwljyjsXPW3$c_RK~J1v|%0jWgtwJ=@}DcfQR0_D}X8 z7vitho*Jw z`|4HFL<;Jg-^aK7omib%EwbbG@13WA?-bTOBySpfAjli!lSc}(&Ht*3Ztrt-c>9B^ z`?$x~h(FsHtxtzN6;-(%zkcl@ckZHH%kEn1btip@y|(zPPE3JSTCeWxS2MFDkDYyy z@%En2gHqGFa}n9=WW5Zeg>+czu0N=LY}J(`U~KzB&WGVm-UGh(@0qjMl8TEM`pPt&VYSj9*{)T`{bsQLX?<#PJ@CF&Ond7E$J@52{{Ls$ z>=q@rx#7Q(kHUH*r5x=7-48RRUj2w( zm2)F(Z*Wga4Vd6_XX5snc_&X4iCuoxm1&(<{A$mu%|B}A=Pl)5q!3xrIzK$ndbRN8 z2el&ZBJ14z6=MtKzLg8a#Xf(X%buHcvuV$!ysPyge{b`gX=Bm9Hsjn!mhECOyAFOA zm0hz~f1^1=+4Aqd^?Vw9c6**GFc05$?d_SDQEGfABkax}>HWRjLatlx4eQBItIj{# zTo=u$=^>W%u={e?jE2l9W`#GJBEx;}Bvgl=u5P@4?dQB@0#@n075n%GJ+?wJ#Up`eeqZwyE9PcNS0zW(*@|60wPIJ- z`BU43f+qN+Jej;fwwhb?_ri{*J&7~hA}`b`rtL})+g!ZFH(RQr|Ew>o9FrW6MQ?D! z|08dlB&WRO-Shm9z`E_<6W#vaX%=go)=}!0S#xBW$CUgp)uDI%w(=I*$n7<>EqD1V zVE^&Mq7*!S_@AFVh3Yu9XRKh~6@w{>kj z?;fcirXRE)oV2p5)+^vGTb5|DNiE#4<Mpywx-901XINQA=mZ@}-n}O48{Wt#5w>ryEUa|p$~ek$pfCOXiw&(V+0!po)r#M^_n=ySYecyF zjiz0?xnz-C zu%GLL?tc>V?3MNfP4HRrjoV9b$JvR0R4QjZbvfhobE-o`s^H&NlWm_9uJooK{AV9^ z>T!hQrYbqF8j&AbY2S}cTywm~Y_`OK@|}zOuCL=+XcyCY^Ms=cpZO76EjG^p`(U@} z+h&C2_nh9CW4N|w)moQ{O({xWV-57#^@{J&I`Y1E_%f=L*e@R zV;}!nGo83Bb%yDWdv(1$L!HT~*X`@v&8CTbaC76I#G9~elH9A$<<(8MmPe;;*nB%} ztL==~O4mmPk7t0wuw?RlpTCCx@=|5vCSKI^Pz##RcgE>oqTlX24Usdf^JW=zZwY5g za%Y?z`qXVJ+h*aE#qSQ^k4>s-5WP2_pVg1$mxS#GlWSEehb!%teA>6S?|K}A&xSes z=O-?U?s{=7@QD1{X_sDx26lJsNNnnISdy1JW|K4 zb)pAn7-=<~@LbKI(j}rIyfVJ;gLsqv(GQ0<2ZgRKyL>s=@{j4}{gZT4mi2vJT=zJ5 znjAyjg#*9mE&jIfe{}=@^#bFMR!x$ce_u<*Pv>7~{NE%^*9^4oV^e9Y@1c&IX#U^D ztF{Tba!u;IQs1a&IiWx7(bjJlWX^aPt-QF#nV(_vx9k6VJ}<6&7CddAQ!@9ldcKGU ze?=O#4U~_*JIYcwkL}&JSHEAc%)Ndpm|5e~^oIB=KW-T??F(nLE=}v`=;-mbWW2vI zygf1{C2F$I61&(I`>r)fnitOP3%;}HRm_=LDM8Jg!oge4WUl-3bx)4s-Hq>mPgq-aX2q8D z#@UVMlbX`bPV0VNa%NUp-R^bAuFn-cRQ^x5VEH*7&d`EF!a~=SZRWE~cwz6$axH~>W=^yGPha`X*IDMU)CdWi{1#5Te)@ZamHax62gTc& z@2~v0^{BwABj%-H9UUDWy+&G06DMkVs2OcDNt?BFwOFFt6xXY)tCF_PwkZ|5eEIOY ztM{2=rt79i-MsqoJIi*vqatVe);KTMl;@CnU2Juq@fqs}*?r!*-FM`8_na)6TEVy@ zD!r|vqeFk1$^+|dQC`c}yiy5VqA>Hsja>!lvYRHx@N9A2kfY9gI`n9k`RfVHXI4cY zwieo<7Jb5G)4to`%;$dTxBuD8YwY^LFhSR#T4w%Uffs5!&dTqLd;I#IywlVO_uTBI zogE!6k^Nl?MW?iwI+a*Yy0~3;ESaYr8jm*gy5_$wf<6WQFa1HcivScXrHaZ~aqZ zM)E5^KQ3pA=g@dv&G4M`aeB+nczJ(8~!&;^Nzha@{{QUN7|Ily*%N=R79n{c;Itm0?~0sM0;>70&W`Z_A4{{$|n@+gC-s zZHwGcZ!-6$)3Yg7lYhu36f;ELH+b@%yW!{JKmSV}98vslc5=0G@t*(NABrD1pIwt{ z*rK(N^|$J|st}e(4V$_YCVu*rr*v|u!psvNtTt|6vGl&4vXuYt^GDybXlymPCLFZn z`884LSsXRy(I;d=k5`v5$Zsv!ygQ}mzdh&XxY!wSY`3zjUp~k=GbM0#S<Qsdb{; zEe?d)<^%>>UsZdO6w_xJstPVOH?8j}FP14?+gIQJxbgbRT~`a!qwa^C&f;!dow#9M z>25uye@}w1r6(-YwddEn#$dxp=e_RAG;U3l}icE{HfIk!4*E-i}A)t9fyKBcfFqfhd+1x`?WKUew@!*_jIY`v#OMO_MA13ziK;Mt^fYwjKFPQ!Ee`I z-C6KR%>7G*kM{CMa+BBIbu%{9JM43&Z)(ST5fx#>PcvBGKVEip_rkJ^>L1GAuD&tr z>W`4q3-|Fgt6%;2Yd>S&rZ1+m8_b!Xw?a|1&{2&DLo4w*|4fsxoHz4^C_4 z6}s$yx^Kmfi)LGd&TCH3d}I42z*=u2XfxW*geggX{!RTaoef!GHJrmkOV4-Q$~FP1W}ZmC)ISTk`$CG&bKy>&0P&It26 z`u57l6UR6F$*Ef|7aHEF#d^}^4Ab|uVwZ1=94g;)=Hj{Q3>!rLi*@$T-BQ2!gw`_# z`<8>xq~iaZq@CShaevD{DGOO)ku~myEqng;pX1{6oSnB$Wnqr5bhcyTrj1{se6-~c zf7<+W?x|JlghD5Wuq^Vk*Vb9K{p4$g(!?fbv(n1U@785JatzZF#gyi+(ApWE<<#}% z&P&IdFPsOWBy5C(noaloQ(W-i?v8E8*3779-NRk6Z{K!aIkq`jmg~BaWPO1HMqK)}gx^cfhWu#x<*vBf??|SD+a@87_nxzv{CVla%Kbcg; z{H9hY{>ZAZ9pcH|zBJZCa3?eoaS6B#CCqwWt>c9{hRFa*sJj`uNYB+vZ9E z>wF!=Hcz{oZm@gFy|+_8ckX)QGVScIb<(RdPO3hz{uberty#6eKy3Ez``eDLxN|G1 zs>h{f`O9gOLf+0`eVZHEJM*2zmdmA<-^#D*B+gU&YF!ay$0NhLM|HvZ`)qd}-`#Tm z>EAn?ImdET3}#IYlYYLeQ>Ng-l?9VM8Sl3ow0C;--E`mc$}?Y%oM)IWw6|UNw!!YQ zzU1~32hA(LURl;#dpC8u+eg#N)B+u~2{AuwuW;0MA2(2TQ>`+(AzOQ4v6A@lFHwH$ zdn@uap1MmXuI7(FViVHcyy#ZpM5*_OLs%v`SSCz8`ej=}Q_UGm&mE`8fPhTs3 zjp%(}DfxrtLvaFcL50h?ztN3P57Y|2$_Q&Q?OMYb!6Cye6aV%139H`%_nE%E_$2Hp zt9XaOyJU&*2if0-i_hk=cHa)1kh8|@&^6{~uJ>x4^LgIYe%au>#Eol`r_jxJ6_h|pm9nLK-mCc>cv5_zy`VhgW_O(2{)Wi(JQ=pxhQXY+^YKUJu`QJis~irWIDTkZ*`Z2{XWz>=q&k#_ zFY=z%V@9lnHsyM|}JWp>zjdg)tn(bl{wSq87(J)zo>O)R(Y6)VQ z+tY3_`ufbhm$Lgze1D{HUgg~PuaEmo{>%13^vtZ(brMHdrrY(^H(oYwm^p3#@$%oh zPM`nzCGzUQ4LMiehqK;LfARHPX6G|g<8$Ww3%4^`D_^~Qq~83j+?ieL%+BxKv+6^~ zwdDNiKSXCJ1c$t?klM{}eWlO)2`FbwI{xlgy!5Lb2VXF)+i-_5`{SjvmQ{P!9c3|* zXP(DtD8HQHbFP}j>kG_>eyw|c@PX`vU(?y{{oa3IcH?%Y{|$FFk2t?&yvF#y<-fGv z9{ZN}mrsP8)_h~_d&$ipM@7n2%vbWXdDztKg)aVjjONF-y?!QSGAn1z?RF{`0@)y~>(x zmSr{aJH#s(jhkLuA5b^U{=1j$H{+(e2ey}Tb}gCo^b1=_@zdRP-Y=gB1 zEgPlVxkpoHu(JnFKKPF(HYTeJhmf3iY z*n^VUoaZbGK&v@;K3n^I6BDP#s%R@8IV2$&)<2)Qf3;@koU%9lY*%}y{;%3-d`oTmgimh{ zy?e1#b;s_yoEyJ3T0a$fZ?VO7&77R;bH5&`f3;Pmp($k&OXVBCHR0v?#QL+V7e*Oa$L$jgia!1`lKH^Yd*?&WaBMbDyykG4 z$vvR@L8f_H;``ov=kpD%!`|`j^I%)M#@BpD`h@A*-X|U37Q1Il?(=!e-XS`J(9eo9p5kW_^`zt>*2cHHnS+2O)l-u?%=-HY6g$5xAStgZA|{H2indx zSN~m7!H22SeHs249eRGA`^NnVF30N6zB%+R?{q@beOs-%`(G2DFN|J&-ELZP+`PXx z(kbXEC8R3`6uec+wR=|%qH=akYyW}fB# zfAro_UvsTvh6ki|mj9f)yZ-Nowj9M`#XOtd)5&FP{sc5+<{W<$QPuwVYhtQ$zLc57 zw?lem?{26|h=pHIYMLX&o4NjPKCj|iKhb)HoO>s>t3I)qw!z*ied6@Iz|g82j}xme zuNHdezx&Ohe~0AZsez73QAsc-*yr1|`&r+v$Jd@t`Wdal2{;Q!iw(B{0# ztkVqVbMKz>)>l(yK`^B^(-wAAoyNovMT9uQtQ$n~! z&oWHT^$nlEiiqB8XD83N%h7ctkp1GEG|M~Br(N9QecO+fZ|j_AvtI50QaZgnoqOif z1M3aA@3dzseXy0V5e(v2S;+LIG=E;#%%bWuZw{x|R9*MpeRHGl!3|b5(l-_-6~vv} zeKJ}kNzSTNf{9=0hSfeBuswNYNBdGBnCDKeVvO5e<< zt+4yynpx>ssC9 zS=NhJD_@$P;I^pz*dCwXd*4??dc4&C+LtZ3Rylg*V`+}`u7^|O>UY{cF?yjgM=+%# zb$wY(k}Jqfla6j_nvrH1BL1yBc-5P-n-dTGGM2VDTQtj@!JqHDeC^$*?3-H87(H0t zvj6c@rw3UQHRc^mpU)#{WlqZv3uZ z?_4RuHGws8ZPx+M%=c0|XMSK#nX2F%*{)h(tGM)L+Ri+2!^WLwXDo1CeZ60^`m5dB z;#q%p7$&`Y#IXNy#nwb7i`jrSzV2fRGm6}lk$U%wPQ2ae#_X+=sWS73 zC*N*=@8&samNDsTJS;Bjedb*4uC2TLyZVD)8{@8AkNvkkN3mGugE`-ni>fmwIwh{H z4YV~{Qx$S!qM8}IH0Y_*uQTsK44Xm*b7z4(idzJ@o+J-zbm z?-~hZ{i*GBxr|>X-jcOguXTT;tnd^q!E+w_dakGEe6HKhGx@ys&E1Yu?$^HPn{a!l z*WUXNo-S2iQ1a>CbA8U8_cBd39GTXXBBX9+eaCEBB;VE6znRlLBjcAO34Vw=of*fw zC**PVe=%W+s@=?~UrQg@J-F_u_K5Xx-$9lGB0RGQc|GjhM_R8mzwR5Y~rCikv zmnzIW;wre?KjhG>2jUy|-%f4!7yqFVA?Y;B)Sv%D*`64-9F{oYqDa%kc{Bc5ez;I! zpW|VW^I}#aSDS15vM9d%iw5Rq(KnH}q@mj(x7P_MWy)S@o*yw8iI%oDY`m6LFH?BDOa4DW6(GaAy9h z+fyIjn!E7$f=kDitgh?-{`(ozo6TYycYisR@%EqA`*h*7lt})qwi+j^pUzpnk70@K z>;F!)Jiy;z&U8Eb%zqOfhBZ~@o~(x-J**V@v*NqjHqr0RQFUC&BHLz2f70b+;fvby zOD=5gdG;&y+EuA{9u>&0V0ks&YSMhM_57FRFMNDaw&jn$+%n%cU;oW1-oqD~9llws zaGAo)BaX|Dc6V{h{?U7rU%L0u>xgehcF67J7XGqvijNd1I z+F=}|%~ixAo|Ad}Y-U&B^2}+IICeEoT(S9P!0wVnjrIxCU5}Jkd_8!;T6g)+;s+N$ z);PqM|FmydzcZlWa=LHqEu->ZOAlmb1pZa2V%gz&RAF(9{q0bmh2N#Gsqf*5;w+ol zq?8u5`ih$Hhv(Z9(;7PL**?^_M+mCFRC8OjrsMC?U$K{7-mSQC#qr1M1lET&Z~E87 zzD?d+qGVy1|IpEAwxO$Tuu(0j2APnUqj*EmCMbTt;>)Hr-G4OiW2j<`JW-{J-D$-*y_YN0V+dS=yRwe=bubv}^}Yl={Ekd;W{AvTT0X z+Ob(gWwOSpgz}F!`R>$l-D~{&z$3lqRj^@;N$vZbFQwDpvzUTM>oHM}j8!EV{9Ar> z|MP70J8jJXvrRouzjSE?gmJT;P`N0gGI_A3$)G?vP2{cXfs+Ru4=kK<;6}S)Xj{%&wy6EFNyqgZldn0 zvW4>9r)*o@e!R_B<(klG;OVL$cq!3v?YWM!Z?_GDIdXN`u0C3NQ}E!XT@1hZxz?~6 z{@!&udUNZUpa*FQX){>wn&b+7?w^17nXkXmj&y;IS>|dI*Vykc-(kJ;_HSjhgygP2 zvY$&s9xeXluyVUOT2HyS{?bCJdtnZ`BQ@CMM!)0s=ObnyM7re z&oNVdQ~lgo=e^k(k67RRCPj+N?mk|+U-976{RdwQe_x^1CBZexQ)J0T=^vT>6_uq) zhoo?SR=_sy`9W6WVh19&hgQE~Ta^Gh>trEJaV{jKmpP_#K>-$Jd5w>6PR1+(8CczMJ;!}!3xi^h6i zZyLqznDFFtAC!FFel+=)t%Vu8=gGX z)jPgONTzJ-9@jaOtUm6^?m94)asHIbMWSoZRn9%Au>8kbo{bZ^e*I=GJX77E$~gTr z)1&V#d&I4+!{+WQe7k8~R9wZerTa^^uCe3$Q_L{mnnQ-w=Eb4uXT*%U8}2ilO?>|J zr~Td&({9gC36PF6%hLYf_MkuT)R(RE?Qg#P16nBkJod1bz31((ISj%oFBSeRKGyV( zIbZ45>%UJ7E@w}7*`XI+w@9T|@@n{zd&fe}`aRQI-tjK3(b3}HXx({#SF&n?>zUi{ z7pxELy3CWG`s&E%b)26VTsA()m1!_wPI0W?zo4&@%{Wz8V|C}Vl7kzcG`?%Nd}Bl5 z+f6lV^~)?grXA|}VRiob`M*oE&BbpzJ>$`Nzr}LWa{0Qx#|IloJ~vOXZa_7&b6g%+8yu3pBUz=@A!JM>&W-c%FYCFSKYjr-D{q0Dz@-oyYR$xSN@le z#`X*~mzV0#)J?g^@aNjpKQ=|@FWdb7!L4__JKeDR@qN}iFaP>6-)B>^ny~-t4AT}R zLpA*@$4w7);`Zsik9F3z59FP*cKxo(-q)rZ=1Irz|582wy8PiyUe&c5&F*mC%1OMh z;1d%%y;iQ=eP`G;$=54?b)1A-c z#~fW}^4rgMo2bq@mZMdx>(m2FZ$9Tx&)CK)JYl6wd)y@Pg7X{93o@+>*09SemEPJ> zc5}x1nM;y{1aBS>JHzyS|EGnAD|O$oo><11zI)2@D=i{xZ|=1D@ca19t&dZqkN@EF z5qRVGKyHD4^obnVcSmdQDu1&MXH3r{CYJ4alT>s0 zWtjDkyMD(HYJ$eyREiJ9{QJ><{O0D{+Xc_{CpRVh_L+J{%;@}&8DF~_k{hnK$Fyjk znI-z2dHYL|vUhB&VvfHqzSo;OA+v*J>G9upmoDO1yY{8z!~d7B*y*lyKYDXRTpNGF zQ}-XABc85LR!sW6&&5?i$!Lu{llAwpf@T|XlTc#-PS>m#v^O`sxfDX9m@aTmcV&~qtxMBOXpLXKQqv9BR3icj&o_1-^ zp6v6v=WRaS>3t)sSXRDmLSZHMnP|gEn0{bvI>k{j4GsZkl_;+9apwap@>rHi?D(~^m>5jD4%@J-ay<*1{1kwU( zcnJ%xyz6`5X!4$A+?$)H7;kDl!}H)w$F!fX8~?Kf37-1Q@Ifw1zEWbz%^8A~x>mJd ztK61@4m7OYckIP$o1GR{izE$f52e=06=WXy^oOB9EG;GSM&I{WOV|AboqM6QIG{b! zWl7z127Ae8_vP91N(}ZNm6-A~z45ZrwCD359aH*Ok@{V7?k=!mWzgXsOX_wv7B}ou z{9h-U*CSKqx@|(GX+aRrshUOM`)+nT{eAjCmiwnqoM&E`34(xR8z{VcB@gI4*}wJG z{g^pfkt$KID|^$_(#~$T6g>Ui^?)wl6J^#K;UC6x_kpeX4YsC`KY=OLx-q)ZI`&k| zwh1#CVgxoD)r+PbKemkH=}*=5^K2eD#La5_dLRa-Eog#|OG-^1n_Y)>@T*mOd1r_p zHac(o>lvqB6;Fl!hegblGuv-|+~m1@Jtz`S#DUJ}>bWoVz+U!DxZ$zXI>iqcJD&a& z)4#7*A)K~64CH#jkD#MeAN5a|1)!c5jJNB5iwXI$>0b3VJVzEnm3J-gnumD(Uz zC;5O*$Mn5k_wR{I-TTvd6(`Cjr85U7$E^`=e9x$!bgjL+tDpHeIc#{sYJ?CO-acAXiLp`lMl`dRKbaX`Oa(5F`U;K++R)sxntrIP?)IH^)ZX7zxXZ3 z8`I1A!{sPL!L0ArIqXcaF4`9~K!!a6oq*!U=oUQvxpqe8#@(_fP8S{s zwJHTCtCOHi)H&Vrz|U!y@4P)xzMo~YMD3J23^A`f;`pwff)O~df@_H1N)@ox^F(+ z=B#mF-VX|9P+ML}>7yZg#q_5p@0shE-!PnGktoXL$KgG>zs4B4)gsKLGdRDDhVGwFiF_<)MS0y z8`fv+4c{yFA2#C`)|f4}@Uhhc+1m=I-+Rrq0|kQ;ILllN=TSTx)VqGSyal(hkyg%n z_J6Z8-d0rVr@6!lJl!rV{04lOuOK)&cR4o(>n^WU->|Xo`hStl$EI}rvIo39+G-p8`0aLF0F_L;{dRR4F~Y`x?kwILp) za0&Q`;EQS1;isoJu9m8K-+Dl|FXs0;rcHv@*XpL-4?fTjJyiEi^hePH$QT`!MHJRf#s7=)uJC_AH1F6`eyM1L7xSM%m%3~*K=6kF}!2@wda00 z!}%BBJRvAK6BH2_uk_qBy|irYjHCCCXDg?@dJx5as*n?OY?GkXx9t^Azo&lVZMysP zZ(Y>#c2I)!_zMoPWyS`Z=s z?FL`F`e%6$Vjjq`pDIyGtKGCXWG~pjN#IlbUhGt8`S$x%gIzg8MgMo}oXiL94&AH3 z=RSFS0+l#Ix|(m^XYCZ;EEgF7TF2lvt@Ulj1F177j6ik?dJ2Hj)1p+)4F`&5U1vVe zGUr(Df#WiokAoZaSFHk9mMY!gz!5su^jFpU<(f@1u4QaXaGRnVPzrG_-`hM*B_Ubk z24mgjKP^54cfX8f(P6olpt!c~0p9}t9eZD$XI_;BPL3xRgGz%E9wvUK$nMNI);&3f zd*>dIJm8ivuYZ0ezZyf>-_ILXflv7D2m!lZR-eJUF}lHW+9jRV54Q5hSx!|oJhQqV zeT?P6y8}IZubJO5m#qZn(2f%s;OLlk_P}og?z`r!bFRH_*zNpl-gYK=mTO66Uu0fI zew(XQX)X`NzNhoqUgFXL?&Fh_a+jN0! z@Mr>iB6hdo>&dnP2hyj9>;aoLNd;76xJ283$onJv^{c=KZqc znJIsbp*my@l8z&Xc@Nz0{cIe^RMn^rIx|*DNokVFt-C=kDt7yLWcb&}JTA3v*xgv& zuy57<*&p*wW`RxhSORv2zC2SO+dY;&9h?n!S?@%CjXr1qP6HDa!2vgY?u^zy>CF6# vwjPCeDr=IIj7*3o*a*-P!9{=nGcv@#-?6xP|0R0{1_lOCS3j3^P6